internal/outcome: expose pipewire via pipewire-pulse

This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.

Closes #29.

Signed-off-by: Ophestra <cat@gensokyo.uk>

1 files changed, 3 insertions, 7 deletions

diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix
index 569be230..8b2a635e 100644
--- a/test/sandbox/case/mapuid.nix
+++ b/test/sandbox/case/mapuid.nix
@@ -49,7 +49,6 @@ in
     env = [
       "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus"
       "HOME=/var/lib/hakurei/u0/a3"
-      "PIPEWIRE_REMOTE=/run/user/1000/pipewire-0"
       "SHELL=/run/current-system/sw/bin/bash"
       "TERM=linux"
       "USER=u0_a3"
@@ -57,6 +56,7 @@ in
       "XDG_RUNTIME_DIR=/run/user/1000"
       "XDG_SESSION_CLASS=user"
       "XDG_SESSION_TYPE=wayland"
+      "PULSE_SERVER=unix:/run/user/1000/pulse/native"
     ];
 
     fs = fs "dead" {
@@ -163,12 +163,8 @@ in
         user = fs "800001ed" {
           "1000" = fs "800001f8" {
             bus = fs "10001fd" null null;
-            pulse = fs "800001c0" {
-              native = fs "10001ff" null null;
-              pid = fs "1a4" null null;
-            } null;
+            pulse = fs "800001c0" { native = fs "10001ff" null null; } null;
             wayland-0 = fs "1000038" null null;
-            pipewire-0 = fs "1000038" null null;
           } null;
         } null;
       } null;
@@ -256,7 +252,6 @@ in
       (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003")
       (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003")
       (ent ignore "/run/user/1000/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
-      (ent ignore "/run/user/1000/pipewire-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
       (ent ignore "/run/user/1000/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
       (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
       (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
@@ -273,6 +268,7 @@ in
       (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir=/host/nix/.ro-store:/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,userxattr")
       (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
       (ent "/var/lib/hakurei/u0/a3" "/var/lib/hakurei/u0/a3" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
+      (ent ignore "/run/user/1000/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw")
     ];
 
     seccomp = true;