fst: hide sockets exposed via Filesystem

This is mostly useful for permissive defaults.

Signed-off-by: Ophestra <cat@gensokyo.uk>

4 files changed, 22 insertions, 93 deletions

diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go
index f025b44d..968a11ab 100644
--- a/internal/app/app_pd_test.go
+++ b/internal/app/app_pd_test.go
@@ -62,45 +62,14 @@ var testCasesPd = []sealTestCase{
 			Bind("/lib64", "/lib64", false, true).
 			Bind("/nix", "/nix", false, true).
 			Bind("/root", "/root", false, true).
+			Bind("/run", "/run", false, true).
 			Bind("/srv", "/srv", false, true).
 			Bind("/sys", "/sys", false, true).
 			Bind("/usr", "/usr", false, true).
 			Bind("/var", "/var", false, true).
-			Bind("/run/agetty.reload", "/run/agetty.reload", false, true).
-			Bind("/run/binfmt", "/run/binfmt", false, true).
-			Bind("/run/booted-system", "/run/booted-system", false, true).
-			Bind("/run/credentials", "/run/credentials", false, true).
-			Bind("/run/cryptsetup", "/run/cryptsetup", false, true).
-			Bind("/run/current-system", "/run/current-system", false, true).
-			Bind("/run/host", "/run/host", false, true).
-			Bind("/run/keys", "/run/keys", false, true).
-			Bind("/run/libvirt", "/run/libvirt", false, true).
-			Bind("/run/libvirtd.pid", "/run/libvirtd.pid", false, true).
-			Bind("/run/lock", "/run/lock", false, true).
-			Bind("/run/log", "/run/log", false, true).
-			Bind("/run/lvm", "/run/lvm", false, true).
-			Bind("/run/mount", "/run/mount", false, true).
-			Bind("/run/NetworkManager", "/run/NetworkManager", false, true).
-			Bind("/run/nginx", "/run/nginx", false, true).
-			Bind("/run/nixos", "/run/nixos", false, true).
-			Bind("/run/nscd", "/run/nscd", false, true).
-			Bind("/run/opengl-driver", "/run/opengl-driver", false, true).
-			Bind("/run/pppd", "/run/pppd", false, true).
-			Bind("/run/resolvconf", "/run/resolvconf", false, true).
-			Bind("/run/sddm", "/run/sddm", false, true).
-			Bind("/run/store", "/run/store", false, true).
-			Bind("/run/syncoid", "/run/syncoid", false, true).
-			Bind("/run/system", "/run/system", false, true).
-			Bind("/run/systemd", "/run/systemd", false, true).
-			Bind("/run/tmpfiles.d", "/run/tmpfiles.d", false, true).
-			Bind("/run/udev", "/run/udev", false, true).
-			Bind("/run/udisks2", "/run/udisks2", false, true).
-			Bind("/run/utmp", "/run/utmp", false, true).
-			Bind("/run/virtlogd.pid", "/run/virtlogd.pid", false, true).
-			Bind("/run/wrappers", "/run/wrappers", false, true).
-			Bind("/run/zed.pid", "/run/zed.pid", false, true).
-			Bind("/run/zed.state", "/run/zed.state", false, true).
 			Bind("/dev/kvm", "/dev/kvm", true, true, true).
+			Tmpfs("/run/user/1971", 8192).
+			Tmpfs("/run/dbus", 8192).
 			Bind("/etc", fst.Tmp+"/etc").
 			Symlink(fst.Tmp+"/etc/alsa", "/etc/alsa").
 			Symlink(fst.Tmp+"/etc/bashrc", "/etc/bashrc").
@@ -317,46 +286,15 @@ var testCasesPd = []sealTestCase{
 			Bind("/lib64", "/lib64", false, true).
 			Bind("/nix", "/nix", false, true).
 			Bind("/root", "/root", false, true).
+			Bind("/run", "/run", false, true).
 			Bind("/srv", "/srv", false, true).
 			Bind("/sys", "/sys", false, true).
 			Bind("/usr", "/usr", false, true).
 			Bind("/var", "/var", false, true).
-			Bind("/run/agetty.reload", "/run/agetty.reload", false, true).
-			Bind("/run/binfmt", "/run/binfmt", false, true).
-			Bind("/run/booted-system", "/run/booted-system", false, true).
-			Bind("/run/credentials", "/run/credentials", false, true).
-			Bind("/run/cryptsetup", "/run/cryptsetup", false, true).
-			Bind("/run/current-system", "/run/current-system", false, true).
-			Bind("/run/host", "/run/host", false, true).
-			Bind("/run/keys", "/run/keys", false, true).
-			Bind("/run/libvirt", "/run/libvirt", false, true).
-			Bind("/run/libvirtd.pid", "/run/libvirtd.pid", false, true).
-			Bind("/run/lock", "/run/lock", false, true).
-			Bind("/run/log", "/run/log", false, true).
-			Bind("/run/lvm", "/run/lvm", false, true).
-			Bind("/run/mount", "/run/mount", false, true).
-			Bind("/run/NetworkManager", "/run/NetworkManager", false, true).
-			Bind("/run/nginx", "/run/nginx", false, true).
-			Bind("/run/nixos", "/run/nixos", false, true).
-			Bind("/run/nscd", "/run/nscd", false, true).
-			Bind("/run/opengl-driver", "/run/opengl-driver", false, true).
-			Bind("/run/pppd", "/run/pppd", false, true).
-			Bind("/run/resolvconf", "/run/resolvconf", false, true).
-			Bind("/run/sddm", "/run/sddm", false, true).
-			Bind("/run/store", "/run/store", false, true).
-			Bind("/run/syncoid", "/run/syncoid", false, true).
-			Bind("/run/system", "/run/system", false, true).
-			Bind("/run/systemd", "/run/systemd", false, true).
-			Bind("/run/tmpfiles.d", "/run/tmpfiles.d", false, true).
-			Bind("/run/udev", "/run/udev", false, true).
-			Bind("/run/udisks2", "/run/udisks2", false, true).
-			Bind("/run/utmp", "/run/utmp", false, true).
-			Bind("/run/virtlogd.pid", "/run/virtlogd.pid", false, true).
-			Bind("/run/wrappers", "/run/wrappers", false, true).
-			Bind("/run/zed.pid", "/run/zed.pid", false, true).
-			Bind("/run/zed.state", "/run/zed.state", false, true).
 			Bind("/dev/dri", "/dev/dri", true, true, true).
 			Bind("/dev/kvm", "/dev/kvm", true, true, true).
+			Tmpfs("/run/user/1971", 8192).
+			Tmpfs("/run/dbus", 8192).
 			Bind("/etc", fst.Tmp+"/etc").
 			Symlink(fst.Tmp+"/etc/alsa", "/etc/alsa").
 			Symlink(fst.Tmp+"/etc/bashrc", "/etc/bashrc").
diff --git a/internal/app/app_stub_test.go b/internal/app/app_stub_test.go
index 9ab09197..4d2e83e9 100644
--- a/internal/app/app_stub_test.go
+++ b/internal/app/app_stub_test.go
@@ -2,7 +2,6 @@ package app_test
 
 import (
 	"fmt"
-	"io"
 	"io/fs"
 	"os/user"
 	"strconv"
@@ -128,12 +127,12 @@ func (s *stubNixOS) Open(name string) (fs.File, error) {
 	}
 }
 
-func (s *stubNixOS) Exit(code int) {
-	panic("called exit on stub with code " + strconv.Itoa(code))
+func (s *stubNixOS) EvalSymlinks(path string) (string, error) {
+	return path, nil
 }
 
-func (s *stubNixOS) Stdout() io.Writer {
-	panic("requested stdout")
+func (s *stubNixOS) Exit(code int) {
+	panic("called exit on stub with code " + strconv.Itoa(code))
 }
 
 func (s *stubNixOS) Paths() linux.Paths {
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index a8fd761e..25691ffe 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -1,6 +1,7 @@
 package app_test
 
 import (
+	"encoding/json"
 	"io/fs"
 	"reflect"
 	"testing"
@@ -48,14 +49,22 @@ func TestApp(t *testing.T) {
 
 			t.Run("compare bwrap", func(t *testing.T) {
 				if !reflect.DeepEqual(gotBwrap, tc.wantBwrap) {
-					t.Errorf("seal: bwrap = %#v, want %#v",
-						gotBwrap, tc.wantBwrap)
+					t.Errorf("seal: bwrap =\n%s\n, want\n%s",
+						mustMarshal(gotBwrap), mustMarshal(tc.wantBwrap))
 				}
 			})
 		})
 	}
 }
 
+func mustMarshal(v any) string {
+	if b, err := json.Marshal(v); err != nil {
+		panic(err.Error())
+	} else {
+		return string(b)
+	}
+}
+
 func stubDirEntries(names ...string) (e []fs.DirEntry, err error) {
 	e = make([]fs.DirEntry, len(names))
 	for i, name := range names {
diff --git a/internal/app/seal.go b/internal/app/seal.go
index 27663771..a67feb45 100644
--- a/internal/app/seal.go
+++ b/internal/app/seal.go
@@ -194,7 +194,6 @@ func (a *app) Seal(config *fst.Config) error {
 				switch p {
 				case "/proc":
 				case "/dev":
-				case "/run":
 				case "/tmp":
 				case "/mnt":
 				case "/etc":
@@ -205,23 +204,7 @@ func (a *app) Seal(config *fst.Config) error {
 			}
 			conf.Filesystem = append(conf.Filesystem, b...)
 		}
-		// bind entries in /run
-		if d, err := a.os.ReadDir("/run"); err != nil {
-			return err
-		} else {
-			b := make([]*fst.FilesystemConfig, 0, len(d))
-			for _, ent := range d {
-				name := ent.Name()
-				switch name {
-				case "user":
-				case "dbus":
-				default:
-					p := "/run/" + name
-					b = append(b, &fst.FilesystemConfig{Src: p, Write: true, Must: true})
-				}
-			}
-			conf.Filesystem = append(conf.Filesystem, b...)
-		}
+
 		// hide nscd from sandbox if present
 		nscd := "/var/run/nscd"
 		if _, err := a.os.Stat(nscd); !errors.Is(err, fs.ErrNotExist) {