diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-04-11 18:54:00 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-04-11 18:54:00 +0900 |
| commit | 996790946092a9291eb21e297d1f0f04deab8b42 (patch) | |
| tree | a3a8ff49deb5ed02ae282391720ce9613c2db7b3 /internal | |
| parent | c806f43881223a85ad888f434e078dcc68de028d (diff) | |
sandbox: relative autoetc links
This allows nested containers to use autoetc, and increases compatibility with other implementations.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'internal')
| -rw-r--r-- | internal/app/app_nixos_test.go | 3 | ||||
| -rw-r--r-- | internal/app/app_pd_test.go | 6 | ||||
| -rw-r--r-- | internal/app/seal.go | 12 |
3 files changed, 15 insertions, 6 deletions
diff --git a/internal/app/app_nixos_test.go b/internal/app/app_nixos_test.go index 30175518..88efa7d3 100644 --- a/internal/app/app_nixos_test.go +++ b/internal/app/app_nixos_test.go @@ -124,8 +124,7 @@ var testCasesNixos = []sealTestCase{ Bind("/sys/devices", "/sys/devices", sandbox.BindOptional). Bind("/run/opengl-driver", "/run/opengl-driver", 0). Bind("/dev/dri", "/dev/dri", sandbox.BindDevice|sandbox.BindWritable|sandbox.BindOptional). - Bind("/etc", fst.Tmp+"/etc", 0). - Etc(fst.Tmp+"/etc"). + Etc("/etc", "8e2c76b066dabe574cf073bdb46eb5c1"). Tmpfs("/run/user", 4096, 0755). Tmpfs("/run/user/1971", 8388608, 0700). Bind("/tmp/fortify.1971/tmpdir/1", "/tmp", sandbox.BindWritable). diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go index fc796ecf..ac07d703 100644 --- a/internal/app/app_pd_test.go +++ b/internal/app/app_pd_test.go @@ -63,8 +63,7 @@ var testCasesPd = []sealTestCase{ Bind("/dev/kvm", "/dev/kvm", sandbox.BindWritable|sandbox.BindDevice|sandbox.BindOptional). Tmpfs("/run/user/1971", 8192, 0755). Tmpfs("/run/dbus", 8192, 0755). - Bind("/etc", fst.Tmp+"/etc", 0). - Etc(fst.Tmp+"/etc"). + Etc("/etc", "4a450b6596d7bc15bd01780eb9a607ac"). Tmpfs("/run/user", 4096, 0755). Tmpfs("/run/user/65534", 8388608, 0700). Bind("/tmp/fortify.1971/tmpdir/0", "/tmp", sandbox.BindWritable). @@ -206,8 +205,7 @@ var testCasesPd = []sealTestCase{ Bind("/dev/kvm", "/dev/kvm", sandbox.BindWritable|sandbox.BindDevice|sandbox.BindOptional). Tmpfs("/run/user/1971", 8192, 0755). Tmpfs("/run/dbus", 8192, 0755). - Bind("/etc", fst.Tmp+"/etc", 0). - Etc(fst.Tmp+"/etc"). + Etc("/etc", "ebf083d1b175911782d413369b64ce7c"). Tmpfs("/run/user", 4096, 0755). Tmpfs("/run/user/65534", 8388608, 0700). Bind("/tmp/fortify.1971/tmpdir/9", "/tmp", sandbox.BindWritable). diff --git a/internal/app/seal.go b/internal/app/seal.go index 4c8fbc78..3c93b34d 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -301,6 +301,18 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co } } + if !config.Confinement.Sandbox.AutoEtc { + if config.Confinement.Sandbox.Etc != "" { + seal.container.Bind(config.Confinement.Sandbox.Etc, "/etc", 0) + } + } else { + etcPath := config.Confinement.Sandbox.Etc + if etcPath == "" { + etcPath = "/etc" + } + seal.container.Etc(etcPath, seal.id.String()) + } + // inner XDG_RUNTIME_DIR default formatting of `/run/user/%d` as mapped uid innerRuntimeDir := path.Join("/run/user", mapuid.String()) seal.container.Tmpfs("/run/user", 1<<12, 0755) |