app: ensure extra paths

The primary use case for extra perms is app-specific state directories, which may or may not exist (first run of any app).

Signed-off-by: Ophestra <cat@gensokyo.uk>

2 files changed, 7 insertions, 2 deletions

diff --git a/internal/app/seal.go b/internal/app/seal.go
index 82b7983e..27663771 100644
--- a/internal/app/seal.go
+++ b/internal/app/seal.go
@@ -63,8 +63,9 @@ type appSeal struct {
 }
 
 type sealedExtraPerm struct {
-	name  string
-	perms acl.Perms
+	name   string
+	perms  acl.Perms
+	ensure bool
 }
 
 // Seal seals the app launch context
@@ -169,6 +170,7 @@ func (a *app) Seal(config *fst.Config) error {
 		if p.Execute {
 			seal.extraPerms[i].perms = append(seal.extraPerms[i].perms, acl.Execute)
 		}
+		seal.extraPerms[i].ensure = p.Ensure
 	}
 
 	// map sandbox config to bwrap
diff --git a/internal/app/share.go b/internal/app/share.go
index 0a18e310..3ee17948 100644
--- a/internal/app/share.go
+++ b/internal/app/share.go
@@ -297,6 +297,9 @@ func (seal *appSeal) setupShares(bus [2]*dbus.Config, os linux.System) error {
 		if p == nil {
 			continue
 		}
+		if p.ensure {
+			seal.sys.Ensure(p.name, 0700)
+		}
 		seal.sys.UpdatePermType(system.User, p.name, p.perms...)
 	}