priv/shim: move /sbin/init setup to app

Signed-off-by: Ophestra <cat@gensokyo.uk>

4 files changed, 19 insertions, 30 deletions

diff --git a/internal/app/app_nixos_test.go b/internal/app/app_nixos_test.go
index c43034ab..e6e232bf 100644
--- a/internal/app/app_nixos_test.go
+++ b/internal/app/app_nixos_test.go
@@ -219,6 +219,8 @@ var testCasesNixos = []sealTestCase{
 			Bind("/tmp/fortify.1971/8e2c76b066dabe574cf073bdb46eb5c1/pulse-cookie", fst.Tmp+"/pulse-cookie").
 			Bind("/tmp/fortify.1971/8e2c76b066dabe574cf073bdb46eb5c1/bus", "/run/user/1971/bus").
 			Bind("/tmp/fortify.1971/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket", "/run/dbus/system_bus_socket").
-			Tmpfs("/var/run/nscd", 8192),
+			Tmpfs("/var/run/nscd", 8192).
+			Bind("/run/wrappers/bin/fortify", "/.fortify/sbin/fortify").
+			Symlink("fortify", "/.fortify/sbin/init"),
 	},
 }
diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go
index 98ddf31f..e124e873 100644
--- a/internal/app/app_pd_test.go
+++ b/internal/app/app_pd_test.go
@@ -156,7 +156,9 @@ var testCasesPd = []sealTestCase{
 			Bind("/home/chronos", "/home/chronos", false, true).
 			Bind("/tmp/fortify.1971/4a450b6596d7bc15bd01780eb9a607ac/passwd", "/etc/passwd").
 			Bind("/tmp/fortify.1971/4a450b6596d7bc15bd01780eb9a607ac/group", "/etc/group").
-			Tmpfs("/var/run/nscd", 8192),
+			Tmpfs("/var/run/nscd", 8192).
+			Bind("/run/wrappers/bin/fortify", "/.fortify/sbin/fortify").
+			Symlink("fortify", "/.fortify/sbin/init"),
 	},
 	{
 		"nixos permissive defaults chromium", new(stubNixOS),
@@ -387,6 +389,8 @@ var testCasesPd = []sealTestCase{
 			Bind("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/pulse-cookie", fst.Tmp+"/pulse-cookie").
 			Bind("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/bus", "/run/user/65534/bus").
 			Bind("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/system_bus_socket", "/run/dbus/system_bus_socket").
-			Tmpfs("/var/run/nscd", 8192),
+			Tmpfs("/var/run/nscd", 8192).
+			Bind("/run/wrappers/bin/fortify", "/.fortify/sbin/fortify").
+			Symlink("fortify", "/.fortify/sbin/init"),
 	},
 }
diff --git a/internal/app/app_stub_test.go b/internal/app/app_stub_test.go
index 4d2e83e9..4d4674db 100644
--- a/internal/app/app_stub_test.go
+++ b/internal/app/app_stub_test.go
@@ -16,9 +16,12 @@ type stubNixOS struct {
 	usernameErr map[string]error
 }
 
-func (s *stubNixOS) Geteuid() int {
-	return 1971
-}
+func (s *stubNixOS) Geteuid() int                             { return 1971 }
+func (s *stubNixOS) TempDir() string                          { return "/tmp" }
+func (s *stubNixOS) MustExecutable() string                   { return "/run/wrappers/bin/fortify" }
+func (s *stubNixOS) Exit(code int)                            { panic("called exit on stub with code " + strconv.Itoa(code)) }
+func (s *stubNixOS) EvalSymlinks(path string) (string, error) { return path, nil }
+func (s *stubNixOS) Uid(aid int) (int, error)                 { return 1000000 + 0*10000 + aid, nil }
 
 func (s *stubNixOS) LookupEnv(key string) (string, bool) {
 	switch key {
@@ -39,10 +42,6 @@ func (s *stubNixOS) LookupEnv(key string) (string, bool) {
 	}
 }
 
-func (s *stubNixOS) TempDir() string {
-	return "/tmp"
-}
-
 func (s *stubNixOS) LookPath(file string) (string, error) {
 	if s.lookPathErr != nil {
 		if err, ok := s.lookPathErr[file]; ok {
@@ -60,10 +59,6 @@ func (s *stubNixOS) LookPath(file string) (string, error) {
 	}
 }
 
-func (s *stubNixOS) Executable() (string, error) {
-	return "/home/ophestra/.nix-profile/bin/fortify", nil
-}
-
 func (s *stubNixOS) LookupGroup(name string) (*user.Group, error) {
 	switch name {
 	case "video":
@@ -127,14 +122,6 @@ func (s *stubNixOS) Open(name string) (fs.File, error) {
 	}
 }
 
-func (s *stubNixOS) EvalSymlinks(path string) (string, error) {
-	return path, nil
-}
-
-func (s *stubNixOS) Exit(code int) {
-	panic("called exit on stub with code " + strconv.Itoa(code))
-}
-
 func (s *stubNixOS) Paths() linux.Paths {
 	return linux.Paths{
 		SharePath:   "/tmp/fortify.1971",
@@ -142,11 +129,3 @@ func (s *stubNixOS) Paths() linux.Paths {
 		RunDirPath:  "/run/user/1971/fortify",
 	}
 }
-
-func (s *stubNixOS) Uid(aid int) (int, error) {
-	return 1000000 + 0*10000 + aid, nil
-}
-
-func (s *stubNixOS) SdBooted() bool {
-	return true
-}
diff --git a/internal/app/share.go b/internal/app/share.go
index 6e72c6f1..528cd09f 100644
--- a/internal/app/share.go
+++ b/internal/app/share.go
@@ -293,6 +293,10 @@ func (seal *appSeal) setupShares(bus [2]*dbus.Config, os linux.System) error {
 		seal.sys.bwrap.Tmpfs(dest, 8*1024)
 	}
 
+	// mount fortify in sandbox for init
+	seal.sys.bwrap.Bind(os.MustExecutable(), path.Join(fst.Tmp, "sbin/fortify"))
+	seal.sys.bwrap.Symlink("fortify", path.Join(fst.Tmp, "sbin/init"))
+
 	// append extra perms
 	for _, p := range seal.extraPerms {
 		if p == nil {