diff options
| author | Ophestra Umiker <cat@ophivana.moe> | 2024-11-16 21:19:45 +0900 |
|---|---|---|
| committer | Ophestra Umiker <cat@ophivana.moe> | 2024-11-16 21:19:45 +0900 |
| commit | df33123bd7f1e0cb4e98580b7e63818c82aa7206 (patch) | |
| tree | 8b21831634e6169eb875cbfd359fa4006d6c66b3 /internal/app/system.go | |
| parent | 1a09b55bd4753c6d5cbecf96d1b56f23b0e44b95 (diff) | |
app: integrate fsu
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
Diffstat (limited to 'internal/app/system.go')
| -rw-r--r-- | internal/app/system.go | 24 |
1 files changed, 21 insertions, 3 deletions
diff --git a/internal/app/system.go b/internal/app/system.go index 47bbd7ed..6a03b92f 100644 --- a/internal/app/system.go +++ b/internal/app/system.go @@ -1,8 +1,6 @@ package app import ( - "os/user" - "git.ophivana.moe/security/fortify/dbus" "git.ophivana.moe/security/fortify/helper/bwrap" "git.ophivana.moe/security/fortify/internal/linux" @@ -18,7 +16,7 @@ type appSealSys struct { // default formatted XDG_RUNTIME_DIR of User runtime string // target user sealed from config - user *user.User + user appUser // mapped uid and gid in user namespace mappedID int @@ -32,6 +30,26 @@ type appSealSys struct { // protected by upstream mutex } +type appUser struct { + // full uid resolved by fsu + uid int + // string representation of uid + us string + + // supplementary group ids + supp []string + + // application id + aid int + // string representation of aid + as string + + // app user home directory + home string + // passwd database username + username string +} + // shareAll calls all share methods in sequence func (seal *appSeal) shareAll(bus [2]*dbus.Config, os linux.System) error { if seal.shared { |