diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-18 02:24:56 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-18 11:30:58 +0900 |
| commit | 83a1c75f1ac4d2d611b3a96474ed07df3cb557b6 (patch) | |
| tree | ca9b0aba65d1453c24c419781cc8ed7377b77d74 /test/sandbox/case/tty.nix | |
| parent | 0ac6e998188e41d90ebc2b479a7e440361a3eecc (diff) | |
app: set up acl on X11 socket
The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging https://git.gensokyo.uk/security/hakurei/pulls/1.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'test/sandbox/case/tty.nix')
| -rw-r--r-- | test/sandbox/case/tty.nix | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/test/sandbox/case/tty.nix b/test/sandbox/case/tty.nix index 267ac661..ff7bf035 100644 --- a/test/sandbox/case/tty.nix +++ b/test/sandbox/case/tty.nix @@ -34,6 +34,7 @@ in mapRealUid = false; useCommonPaths = true; userns = false; + x11 = true; # 0, PresetExt | PresetDenyNS | PresetDenyDevel expectedFilter = { @@ -44,6 +45,7 @@ in want = { env = [ "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus" + "DISPLAY=unix:/tmp/.X11-unix/X0" "HOME=/var/lib/hakurei/u0/a2" "PULSE_SERVER=unix:/run/user/65534/pulse/native" "SHELL=/run/current-system/sw/bin/bash" @@ -188,7 +190,9 @@ in } null; devices = fs "800001ed" null null; } null; - tmp = fs "800001f8" { } null; + tmp = fs "800001f8" { + ".X11-unix" = fs "801001ff" { X0 = fs "10001fd" null null; } null; + } null; usr = fs "800001c0" { bin = fs "800001ed" { env = fs "80001ff" null null; } null; } null; var = fs "800001c0" { lib = fs "800001c0" { @@ -263,10 +267,15 @@ in (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000002,gid=1000002") (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=1000002,gid=1000002") (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") + (ent "/tmp/.X11-unix" "/tmp/.X11-unix" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "tmpfs" "tmpfs" ignore) (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw") ]; seccomp = true; + + try_socket = "/tmp/.X11-unix/X0"; + socket_abstract = true; + socket_pathname = true; }; } |