hst/container: optional runtime and tmpdir sharing

Sharing and persisting these directories do not always make sense. Make it optional here.

Closes #16.

Signed-off-by: Ophestra <cat@gensokyo.uk>

3 files changed, 31 insertions, 20 deletions

diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index ab01798d..65010917 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -70,7 +70,7 @@ func TestApp(t *testing.T) {
 				Path: m("/run/current-system/sw/bin/zsh"),
 				Args: []string{"/run/current-system/sw/bin/zsh"},
 
-				Flags: hst.FUserns | hst.FHostNet | hst.FHostAbstract | hst.FTty,
+				Flags: hst.FUserns | hst.FHostNet | hst.FHostAbstract | hst.FTty | hst.FShareRuntime | hst.FShareTmpdir,
 			}},
 			state.ID{
 				0x4a, 0x45, 0x0b, 0x65,
@@ -193,7 +193,7 @@ func TestApp(t *testing.T) {
 					Path: m("/run/current-system/sw/bin/zsh"),
 					Args: []string{"zsh", "-c", "exec chromium "},
 
-					Flags: hst.FUserns | hst.FHostNet | hst.FHostAbstract | hst.FTty,
+					Flags: hst.FUserns | hst.FHostNet | hst.FHostAbstract | hst.FTty | hst.FShareRuntime | hst.FShareTmpdir,
 				},
 			},
 			state.ID{
@@ -331,7 +331,7 @@ func TestApp(t *testing.T) {
 
 					Path: m("/nix/store/yqivzpzzn7z5x0lq9hmbzygh45d8rhqd-chromium-start"),
 
-					Flags: hst.FUserns | hst.FHostNet | hst.FMapRealUID,
+					Flags: hst.FUserns | hst.FHostNet | hst.FMapRealUID | hst.FShareRuntime | hst.FShareTmpdir,
 				},
 				SystemBus: &hst.BusConfig{
 					Talk:   []string{"org.bluez", "org.freedesktop.Avahi", "org.freedesktop.UPower"},
diff --git a/internal/app/spruntime.go b/internal/app/spruntime.go
index 35ebff05..d8c5af94 100644
--- a/internal/app/spruntime.go
+++ b/internal/app/spruntime.go
@@ -72,11 +72,13 @@ type spRuntimeOp struct {
 }
 
 func (s *spRuntimeOp) toSystem(state *outcomeStateSys) error {
-	runtimeDir, runtimeDirInst := s.commonPaths(state.outcomeState)
-	state.sys.Ensure(runtimeDir, 0700)
-	state.sys.UpdatePermType(system.User, runtimeDir, acl.Execute)
-	state.sys.Ensure(runtimeDirInst, 0700)
-	state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read, acl.Write, acl.Execute)
+	if state.Container.Flags&hst.FShareRuntime != 0 {
+		runtimeDir, runtimeDirInst := s.commonPaths(state.outcomeState)
+		state.sys.Ensure(runtimeDir, 0700)
+		state.sys.UpdatePermType(system.User, runtimeDir, acl.Execute)
+		state.sys.Ensure(runtimeDirInst, 0700)
+		state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read, acl.Write, acl.Execute)
+	}
 
 	if state.et&hst.EWayland != 0 {
 		s.SessionType = sessionTypeWayland
@@ -106,10 +108,13 @@ func (s *spRuntimeOp) toContainer(state *outcomeStateParams) error {
 
 	}
 
-	_, runtimeDirInst := s.commonPaths(state.outcomeState)
-	state.params.
-		Tmpfs(fhs.AbsRunUser, 1<<12, 0755).
-		Bind(runtimeDirInst, state.runtimeDir, bits.BindWritable)
+	state.params.Tmpfs(fhs.AbsRunUser, 1<<12, 0755)
+	if state.Container.Flags&hst.FShareRuntime != 0 {
+		_, runtimeDirInst := s.commonPaths(state.outcomeState)
+		state.params.Bind(runtimeDirInst, state.runtimeDir, bits.BindWritable)
+	} else {
+		state.params.Mkdir(state.runtimeDir, 0700)
+	}
 	return nil
 }
 
diff --git a/internal/app/sptmpdir.go b/internal/app/sptmpdir.go
index cb49f78a..b926f46e 100644
--- a/internal/app/sptmpdir.go
+++ b/internal/app/sptmpdir.go
@@ -6,6 +6,7 @@ import (
 	"hakurei.app/container/bits"
 	"hakurei.app/container/check"
 	"hakurei.app/container/fhs"
+	"hakurei.app/hst"
 	"hakurei.app/system"
 	"hakurei.app/system/acl"
 )
@@ -16,18 +17,23 @@ func init() { gob.Register(spTmpdirOp{}) }
 type spTmpdirOp struct{}
 
 func (s spTmpdirOp) toSystem(state *outcomeStateSys) error {
-	tmpdir, tmpdirInst := s.commonPaths(state.outcomeState)
-	state.sys.Ensure(tmpdir, 0700)
-	state.sys.UpdatePermType(system.User, tmpdir, acl.Execute)
-	state.sys.Ensure(tmpdirInst, 01700)
-	state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read, acl.Write, acl.Execute)
+	if state.Container.Flags&hst.FShareTmpdir != 0 {
+		tmpdir, tmpdirInst := s.commonPaths(state.outcomeState)
+		state.sys.Ensure(tmpdir, 0700)
+		state.sys.UpdatePermType(system.User, tmpdir, acl.Execute)
+		state.sys.Ensure(tmpdirInst, 01700)
+		state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read, acl.Write, acl.Execute)
+	}
 	return nil
 }
 
 func (s spTmpdirOp) toContainer(state *outcomeStateParams) error {
-	// mount inner /tmp from share so it shares persistence and storage behaviour of host /tmp
-	_, tmpdirInst := s.commonPaths(state.outcomeState)
-	state.params.Bind(tmpdirInst, fhs.AbsTmp, bits.BindWritable)
+	if state.Container.Flags&hst.FShareTmpdir != 0 {
+		_, tmpdirInst := s.commonPaths(state.outcomeState)
+		state.params.Bind(tmpdirInst, fhs.AbsTmp, bits.BindWritable)
+	} else {
+		state.params.Tmpfs(fhs.AbsTmp, 0, 01777)
+	}
 	return nil
 }