diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-26 02:49:37 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-26 02:49:37 +0900 |
| commit | 2dd49c437c19fcd55ce22e732b544d22b91a6342 (patch) | |
| tree | 491a71711f0985f3fc47076f8912acd92f14d439 /internal | |
| parent | 92852d823508ac38d0e346b14cf01a69456f1cdb (diff) | |
app: create XDG_RUNTIME_DIR with perm 0700
Many programs complain about this.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/app/app_nixos_test.go | 2 | ||||
| -rw-r--r-- | internal/app/app_pd_test.go | 4 | ||||
| -rw-r--r-- | internal/app/seal.go | 2 |
3 files changed, 4 insertions, 4 deletions
diff --git a/internal/app/app_nixos_test.go b/internal/app/app_nixos_test.go index 0b5b42c6..e6fb3700 100644 --- a/internal/app/app_nixos_test.go +++ b/internal/app/app_nixos_test.go @@ -203,7 +203,7 @@ var testCasesNixos = []sealTestCase{ Link(fst.Tmp+"/etc/zshenv", "/etc/zshenv"). Link(fst.Tmp+"/etc/zshrc", "/etc/zshrc"). Tmpfs("/run/user", 4096, 0755). - Tmpfs("/run/user/1971", 8388608, 0755). + Tmpfs("/run/user/1971", 8388608, 0700). Bind("/tmp/fortify.1971/tmpdir/1", "/tmp", sandbox.BindWritable). Bind("/var/lib/persist/module/fortify/0/1", "/var/lib/persist/module/fortify/0/1", sandbox.BindWritable). Place("/etc/passwd", []byte("u0_a1:x:1971:100:Fortify:/var/lib/persist/module/fortify/0/1:/run/current-system/sw/bin/zsh\n")). diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go index 50e1611b..d7fbc2b8 100644 --- a/internal/app/app_pd_test.go +++ b/internal/app/app_pd_test.go @@ -146,7 +146,7 @@ var testCasesPd = []sealTestCase{ Link(fst.Tmp+"/etc/zshenv", "/etc/zshenv"). Link(fst.Tmp+"/etc/zshrc", "/etc/zshrc"). Tmpfs("/run/user", 4096, 0755). - Tmpfs("/run/user/65534", 8388608, 0755). + Tmpfs("/run/user/65534", 8388608, 0700). Bind("/tmp/fortify.1971/tmpdir/0", "/tmp", sandbox.BindWritable). Bind("/home/chronos", "/home/chronos", sandbox.BindWritable). Place("/etc/passwd", []byte("chronos:x:65534:65534:Fortify:/home/chronos:/run/current-system/sw/bin/zsh\n")). @@ -366,7 +366,7 @@ var testCasesPd = []sealTestCase{ Link(fst.Tmp+"/etc/zshenv", "/etc/zshenv"). Link(fst.Tmp+"/etc/zshrc", "/etc/zshrc"). Tmpfs("/run/user", 4096, 0755). - Tmpfs("/run/user/65534", 8388608, 0755). + Tmpfs("/run/user/65534", 8388608, 0700). Bind("/tmp/fortify.1971/tmpdir/9", "/tmp", sandbox.BindWritable). Bind("/home/chronos", "/home/chronos", sandbox.BindWritable). Place("/etc/passwd", []byte("chronos:x:65534:65534:Fortify:/home/chronos:/run/current-system/sw/bin/zsh\n")). diff --git a/internal/app/seal.go b/internal/app/seal.go index c9ec4bc6..80e95370 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -291,7 +291,7 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co // inner XDG_RUNTIME_DIR default formatting of `/run/user/%d` as post-fsu user innerRuntimeDir := path.Join("/run/user", mapuid.String()) seal.container.Tmpfs("/run/user", 1<<12, 0755) - seal.container.Tmpfs(innerRuntimeDir, 1<<23, 0755) + seal.container.Tmpfs(innerRuntimeDir, 1<<23, 0700) seal.env[xdgRuntimeDir] = innerRuntimeDir seal.env[xdgSessionClass] = "user" seal.env[xdgSessionType] = "tty" |