internal/acl: skip superfluous acl_set_file

This slightly reduces startup latency.

Signed-off-by: Ophestra <cat@gensokyo.uk>

13 files changed, 43 insertions, 43 deletions

diff --git a/internal/outcome/run_test.go b/internal/outcome/run_test.go
index a1d83ec9..e4e33dca 100644
--- a/internal/outcome/run_test.go
+++ b/internal/outcome/run_test.go
@@ -48,13 +48,13 @@ func TestOutcomeRun(t *testing.T) {
 			Ensure(m("/tmp/hakurei.0/runtime"), 0700).
 			UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
 			Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).
-			UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute).
+			UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
 
 			// spTmpdirOp
 			Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).
 			UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
 			Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).
-			UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read, acl.Write, acl.Execute).
+			UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
 
 			// instance
 			Ephemeral(system.Process, m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"), 0711).
@@ -84,13 +84,13 @@ func TestOutcomeRun(t *testing.T) {
 					"unix:path=/var/run/dbus/system_bus_socket",
 					"/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/system_bus_socket",
 				},
-			).UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bus"), acl.Read, acl.Write).
-			UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/system_bus_socket"), acl.Read, acl.Write).
+			).UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bus"), acl.Read|acl.Write).
+			UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/system_bus_socket"), acl.Read|acl.Write).
 
 			// spFilesystemOp
 			Ensure(m("/var/lib/hakurei/u0"), 0700).
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0"), acl.Execute).
-			UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"), acl.Read, acl.Write, acl.Execute), &container.Params{
+			UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"), acl.Read|acl.Write|acl.Execute), &container.Params{
 
 			Dir: m("/data/data/org.chromium.Chromium"),
 			Env: []string{
@@ -205,11 +205,11 @@ func TestOutcomeRun(t *testing.T) {
 			Ensure(m("/tmp/hakurei.0/runtime"), 0700).
 			UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
 			Ensure(m("/tmp/hakurei.0/runtime/0"), 0700).
-			UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/0"), acl.Read, acl.Write, acl.Execute).
+			UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/0"), acl.Read|acl.Write|acl.Execute).
 			Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).
 			UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
 			Ensure(m("/tmp/hakurei.0/tmpdir/0"), 01700).
-			UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/0"), acl.Read, acl.Write, acl.Execute), &container.Params{
+			UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/0"), acl.Read|acl.Write|acl.Execute), &container.Params{
 
 			Dir:  m("/home/chronos"),
 			Path: m("/run/current-system/sw/bin/zsh"),
@@ -329,9 +329,9 @@ func TestOutcomeRun(t *testing.T) {
 		}, system.New(t.Context(), msg, 10009).
 			Ensure(m("/tmp/hakurei.0"), 0711).
 			Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
-			Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute).
+			Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
 			Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
-			Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read, acl.Write, acl.Execute).
+			Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
 			Ephemeral(system.Process, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c"), 0711).
 			Wayland(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
 			PipeWire(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/pipewire"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
@@ -371,8 +371,8 @@ func TestOutcomeRun(t *testing.T) {
 				"unix:path=/var/run/dbus/system_bus_socket",
 				"/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket",
 			}).
-			UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/bus"), acl.Read, acl.Write).
-			UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket"), acl.Read, acl.Write), &container.Params{
+			UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/bus"), acl.Read|acl.Write).
+			UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket"), acl.Read|acl.Write), &container.Params{
 
 			Dir:  m("/home/chronos"),
 			Path: m("/run/current-system/sw/bin/zsh"),
@@ -480,12 +480,12 @@ func TestOutcomeRun(t *testing.T) {
 		}, system.New(t.Context(), msg, 10001).
 			Ensure(m("/tmp/hakurei.0"), 0711).
 			Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
-			Ensure(m("/tmp/hakurei.0/runtime/1"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read, acl.Write, acl.Execute).
+			Ensure(m("/tmp/hakurei.0/runtime/1"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read|acl.Write|acl.Execute).
 			Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
-			Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read, acl.Write, acl.Execute).
+			Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read|acl.Write|acl.Execute).
 			Ensure(m("/run/user/1971"), 0700).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
 			Ensure(m("/run/user/1971/hakurei"), 0700).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
-			UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read, acl.Write, acl.Execute).
+			UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read|acl.Write|acl.Execute).
 			Ephemeral(system.Process, m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1"), 0711).
 			PipeWire(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/pipewire"), "org.chromium.Chromium", "8e2c76b066dabe574cf073bdb46eb5c1").
 			MustProxyDBus(&hst.BusConfig{
@@ -515,8 +515,8 @@ func TestOutcomeRun(t *testing.T) {
 				"unix:path=/var/run/dbus/system_bus_socket",
 				"/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket",
 			}).
-			UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/bus"), acl.Read, acl.Write).
-			UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket"), acl.Read, acl.Write), &container.Params{
+			UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/bus"), acl.Read|acl.Write).
+			UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket"), acl.Read|acl.Write), &container.Params{
 
 			Uid:  1971,
 			Gid:  100,
diff --git a/internal/outcome/spcontainer.go b/internal/outcome/spcontainer.go
index bfa5dbdc..0ddc10ac 100644
--- a/internal/outcome/spcontainer.go
+++ b/internal/outcome/spcontainer.go
@@ -354,17 +354,17 @@ func flattenExtraPerms(sys *system.I, extraPerms []hst.ExtraPermConfig) {
 			sys.Ensure(p.Path, 0700)
 		}
 
-		perms := make(acl.Perms, 0, 3)
+		var perms acl.Perm
 		if p.Read {
-			perms = append(perms, acl.Read)
+			perms |= acl.Read
 		}
 		if p.Write {
-			perms = append(perms, acl.Write)
+			perms |= acl.Write
 		}
 		if p.Execute {
-			perms = append(perms, acl.Execute)
+			perms |= acl.Execute
 		}
-		sys.UpdatePermType(system.User, p.Path, perms...)
+		sys.UpdatePermType(system.User, p.Path, perms)
 	}
 }
 
diff --git a/internal/outcome/spcontainer_test.go b/internal/outcome/spcontainer_test.go
index 7dd47735..d9436cb4 100644
--- a/internal/outcome/spcontainer_test.go
+++ b/internal/outcome/spcontainer_test.go
@@ -313,7 +313,7 @@ func TestSpFilesystemOp(t *testing.T) {
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
 				acl.Execute).
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
-				acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
+				acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
 			state.filesystem = append(configSmall.Container.Filesystem, hst.FilesystemConfigJSON{})
 		})), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
@@ -346,7 +346,7 @@ func TestSpFilesystemOp(t *testing.T) {
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
 				acl.Execute).
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
-				acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
+				acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
 			state.filesystem = configSmall.Container.Filesystem
 		})), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
@@ -401,7 +401,7 @@ func TestSpFilesystemOp(t *testing.T) {
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
 				acl.Execute).
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
-				acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
+				acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
 			state.filesystem = config.Container.Filesystem[1:]
 		})), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
@@ -445,14 +445,14 @@ func TestFlattenExtraPerms(t *testing.T) {
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
 				acl.Execute).
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
-				acl.Read, acl.Write, acl.Execute)},
+				acl.Read|acl.Write|acl.Execute)},
 
 		{"template", hst.Template().ExtraPerms, newI().
 			Ensure(m("/var/lib/hakurei/u0"), 0700).
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
 				acl.Execute).
 			UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
-				acl.Read, acl.Write, acl.Execute)},
+				acl.Read|acl.Write|acl.Execute)},
 	}
 	for _, tc := range testCases {
 		t.Run(tc.name, func(t *testing.T) {
diff --git a/internal/outcome/spdbus.go b/internal/outcome/spdbus.go
index a50f9cd2..c45dde6c 100644
--- a/internal/outcome/spdbus.go
+++ b/internal/outcome/spdbus.go
@@ -38,10 +38,10 @@ func (s *spDBusOp) toSystem(state *outcomeStateSys) error {
 		return err
 	}
 
-	state.sys.UpdatePerm(sessionPath, acl.Read, acl.Write)
+	state.sys.UpdatePerm(sessionPath, acl.Read|acl.Write)
 	if state.systemBus != nil {
 		s.ProxySystem = true
-		state.sys.UpdatePerm(systemPath, acl.Read, acl.Write)
+		state.sys.UpdatePerm(systemPath, acl.Read|acl.Write)
 	}
 	return nil
 }
diff --git a/internal/outcome/spdbus_test.go b/internal/outcome/spdbus_test.go
index 6f357193..0e4704a8 100644
--- a/internal/outcome/spdbus_test.go
+++ b/internal/outcome/spdbus_test.go
@@ -89,7 +89,7 @@ func TestSpDBusOp(t *testing.T) {
 			); err != nil {
 				t.Fatalf("cannot prepare sys: %v", err)
 			}
-			sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read, acl.Write)
+			sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read|acl.Write)
 			return sys
 		}(), sysUsesInstance(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
@@ -171,8 +171,8 @@ func TestSpDBusOp(t *testing.T) {
 			); err != nil {
 				t.Fatalf("cannot prepare sys: %v", err)
 			}
-			sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read, acl.Write).
-				UpdatePerm(m(wantInstancePrefix+"/system_bus_socket"), acl.Read, acl.Write)
+			sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read|acl.Write).
+				UpdatePerm(m(wantInstancePrefix+"/system_bus_socket"), acl.Read|acl.Write)
 			return sys
 		}(), sysUsesInstance(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
diff --git a/internal/outcome/spruntime.go b/internal/outcome/spruntime.go
index c08bfe81..9d36f252 100644
--- a/internal/outcome/spruntime.go
+++ b/internal/outcome/spruntime.go
@@ -79,7 +79,7 @@ func (s *spRuntimeOp) toSystem(state *outcomeStateSys) error {
 		state.sys.Ensure(runtimeDir, 0700)
 		state.sys.UpdatePermType(system.User, runtimeDir, acl.Execute)
 		state.sys.Ensure(runtimeDirInst, 0700)
-		state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read, acl.Write, acl.Execute)
+		state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read|acl.Write|acl.Execute)
 	}
 
 	if state.et&hst.EWayland != 0 {
diff --git a/internal/outcome/spruntime_test.go b/internal/outcome/spruntime_test.go
index 25f2684c..618fc7ac 100644
--- a/internal/outcome/spruntime_test.go
+++ b/internal/outcome/spruntime_test.go
@@ -36,7 +36,7 @@ func TestSpRuntimeOp(t *testing.T) {
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
 			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
-			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{
 			Ops: new(container.Ops).
@@ -64,7 +64,7 @@ func TestSpRuntimeOp(t *testing.T) {
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
 			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
-			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{
 			Ops: new(container.Ops).
@@ -92,7 +92,7 @@ func TestSpRuntimeOp(t *testing.T) {
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
 			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
-			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{
 			Ops: new(container.Ops).
@@ -116,7 +116,7 @@ func TestSpRuntimeOp(t *testing.T) {
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
 			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
-			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{
 			Ops: new(container.Ops).
diff --git a/internal/outcome/sptmpdir.go b/internal/outcome/sptmpdir.go
index daa6f0de..3acb069f 100644
--- a/internal/outcome/sptmpdir.go
+++ b/internal/outcome/sptmpdir.go
@@ -22,7 +22,7 @@ func (s spTmpdirOp) toSystem(state *outcomeStateSys) error {
 		state.sys.Ensure(tmpdir, 0700)
 		state.sys.UpdatePermType(system.User, tmpdir, acl.Execute)
 		state.sys.Ensure(tmpdirInst, 01700)
-		state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read, acl.Write, acl.Execute)
+		state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read|acl.Write|acl.Execute)
 	}
 	return nil
 }
diff --git a/internal/outcome/sptmpdir_test.go b/internal/outcome/sptmpdir_test.go
index 620f51b0..2073ad81 100644
--- a/internal/outcome/sptmpdir_test.go
+++ b/internal/outcome/sptmpdir_test.go
@@ -24,7 +24,7 @@ func TestSpTmpdirOp(t *testing.T) {
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), 0700).
 			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), acl.Execute).
 			Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), 01700).
-			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+			UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{
 			Ops: new(container.Ops).
diff --git a/internal/outcome/spwayland.go b/internal/outcome/spwayland.go
index 3c60ff10..db79d1d2 100644
--- a/internal/outcome/spwayland.go
+++ b/internal/outcome/spwayland.go
@@ -49,7 +49,7 @@ func (s *spWaylandOp) toSystem(state *outcomeStateSys) error {
 		state.msg.Verbose("direct wayland access, PROCEED WITH CAUTION")
 		state.ensureRuntimeDir()
 		s.SocketPath = socketPath
-		state.sys.UpdatePermType(hst.EWayland, socketPath, acl.Read, acl.Write, acl.Execute)
+		state.sys.UpdatePermType(hst.EWayland, socketPath, acl.Read|acl.Write|acl.Execute)
 	}
 	return nil
 }
diff --git a/internal/outcome/spwayland_test.go b/internal/outcome/spwayland_test.go
index 7cc4ba84..9bb35512 100644
--- a/internal/outcome/spwayland_test.go
+++ b/internal/outcome/spwayland_test.go
@@ -69,7 +69,7 @@ func TestSpWaylandOp(t *testing.T) {
 			Ensure(m(wantRunDirPath), 0700).
 			UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
 			// toSystem
-			UpdatePermType(hst.EWayland, m("/proc/nonexistent/wayland"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
+			UpdatePermType(hst.EWayland, m("/proc/nonexistent/wayland"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{
 			Ops: new(container.Ops).
diff --git a/internal/outcome/spx11.go b/internal/outcome/spx11.go
index c71ff530..ebd5c77e 100644
--- a/internal/outcome/spx11.go
+++ b/internal/outcome/spx11.go
@@ -56,7 +56,7 @@ func (s *spX11Op) toSystem(state *outcomeStateSys) error {
 				), Err: err}
 			}
 		} else {
-			state.sys.UpdatePermType(hst.EX11, socketPath, acl.Read, acl.Write, acl.Execute)
+			state.sys.UpdatePermType(hst.EX11, socketPath, acl.Read|acl.Write|acl.Execute)
 			if state.Container.Flags&hst.FHostAbstract == 0 {
 				s.Display = "unix:" + socketPath.String()
 			}
diff --git a/internal/outcome/spx11_test.go b/internal/outcome/spx11_test.go
index 0ede2d65..d183f798 100644
--- a/internal/outcome/spx11_test.go
+++ b/internal/outcome/spx11_test.go
@@ -83,7 +83,7 @@ func TestSpX11Op(t *testing.T) {
 			call("lookupEnv", stub.ExpectArgs{"DISPLAY"}, "unix:/tmp/.X11-unix/X0", nil),
 			call("stat", stub.ExpectArgs{"/tmp/.X11-unix/X0"}, (*stubFi)(nil), nil),
 		}, newI().
-			UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read, acl.Write, acl.Execute).
+			UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read|acl.Write|acl.Execute).
 			ChangeHosts("#10009"), nil, nil, insertsOps(nil), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{
@@ -106,7 +106,7 @@ func TestSpX11Op(t *testing.T) {
 			call("lookupEnv", stub.ExpectArgs{"DISPLAY"}, ":0", nil),
 			call("stat", stub.ExpectArgs{"/tmp/.X11-unix/X0"}, (*stubFi)(nil), nil),
 		}, newI().
-			UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read, acl.Write, acl.Execute).
+			UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read|acl.Write|acl.Execute).
 			ChangeHosts("#10009"), nil, nil, insertsOps(nil), []stub.Call{
 			// this op configures the container state and does not make calls during toContainer
 		}, &container.Params{