diff options
| -rw-r--r-- | cmd/fpkg/app.go | 4 | ||||
| -rw-r--r-- | fst/config.go | 2 | ||||
| -rw-r--r-- | fst/sandbox.go | 4 | ||||
| -rw-r--r-- | nixos.nix | 2 | ||||
| -rw-r--r-- | options.nix | 2 | ||||
| -rw-r--r-- | print.go | 3 | ||||
| -rw-r--r-- | print_test.go | 10 |
7 files changed, 14 insertions, 13 deletions
diff --git a/cmd/fpkg/app.go b/cmd/fpkg/app.go index c6ed60e6..facf2dc2 100644 --- a/cmd/fpkg/app.go +++ b/cmd/fpkg/app.go @@ -29,7 +29,7 @@ type appInfo struct { // passed through to [fst.Config] Net bool `json:"net,omitempty"` // passed through to [fst.Config] - Dev bool `json:"dev,omitempty"` + Device bool `json:"dev,omitempty"` // passed through to [fst.Config] Tty bool `json:"tty,omitempty"` // passed through to [fst.Config] @@ -79,7 +79,7 @@ func (app *appInfo) toFst(pathSet *appPathSet, argv []string, flagDropShell bool Devel: app.Devel, Userns: app.Userns, Net: app.Net, - Dev: app.Dev, + Device: app.Device, Tty: app.Tty || flagDropShell, MapRealUID: app.MapRealUID, DirectWayland: app.DirectWayland, diff --git a/fst/config.go b/fst/config.go index 1a989e42..f227b029 100644 --- a/fst/config.go +++ b/fst/config.go @@ -105,7 +105,7 @@ func Template() *Config { Devel: true, Userns: true, Net: true, - Dev: true, + Device: true, Seccomp: seccomp.FilterMultiarch, Tty: true, Multiarch: true, diff --git a/fst/sandbox.go b/fst/sandbox.go index 2a6f3475..0cc37908 100644 --- a/fst/sandbox.go +++ b/fst/sandbox.go @@ -39,7 +39,7 @@ type ( MapRealUID bool `json:"map_real_uid"` // expose all devices - Dev bool `json:"dev,omitempty"` + Device bool `json:"device,omitempty"` // container host filesystem bind mounts Filesystem []*FilesystemConfig `json:"filesystem"` // create symlinks inside container filesystem @@ -135,7 +135,7 @@ func (s *SandboxConfig) ToContainer(sys SandboxSys, uid, gid *int) (*sandbox.Par Proc("/proc"). Tmpfs(Tmp, 1<<12, 0755) - if !s.Dev { + if !s.Device { container.Dev("/dev").Mqueue("/dev/mqueue") } else { container.Bind("/dev", "/dev", sandbox.BindDevice) @@ -108,7 +108,7 @@ in devel userns net - dev + device tty multiarch env diff --git a/options.nix b/options.nix index e0bf5489..8af00c5e 100644 --- a/options.nix +++ b/options.nix @@ -177,7 +177,7 @@ in nix = mkEnableOption "nix daemon access"; mapRealUid = mkEnableOption "mapping to priv-user uid"; - dev = mkEnableOption "access to all devices"; + device = mkEnableOption "access to all devices"; insecureWayland = mkEnableOption "direct access to the Wayland socket"; gpu = mkOption { @@ -92,8 +92,9 @@ func printShowInstance( } } writeFlag("userns", sandbox.Userns) + writeFlag("devel", sandbox.Devel) writeFlag("net", sandbox.Net) - writeFlag("dev", sandbox.Dev) + writeFlag("device", sandbox.Device) writeFlag("tty", sandbox.Tty) writeFlag("mapuid", sandbox.MapRealUID) writeFlag("directwl", sandbox.DirectWayland) diff --git a/print_test.go b/print_test.go index ee9a79fd..fe5e694f 100644 --- a/print_test.go +++ b/print_test.go @@ -41,7 +41,7 @@ func Test_printShowInstance(t *testing.T) { Groups: ["video"] Directory: /var/lib/persist/home/org.chromium.Chromium Hostname: "localhost" - Flags: userns net dev tty mapuid autoetc + Flags: userns devel net device tty mapuid autoetc Etc: /etc Cover: /var/run/nscd Path: /run/current-system/sw/bin/chromium @@ -120,7 +120,7 @@ App Groups: ["video"] Directory: /var/lib/persist/home/org.chromium.Chromium Hostname: "localhost" - Flags: userns net dev tty mapuid autoetc + Flags: userns devel net device tty mapuid autoetc Etc: /etc Cover: /var/run/nscd Path: /run/current-system/sw/bin/chromium @@ -217,7 +217,7 @@ App "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT" }, "map_real_uid": true, - "dev": true, + "device": true, "filesystem": [ { "src": "/nix/store" @@ -342,7 +342,7 @@ App "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT" }, "map_real_uid": true, - "dev": true, + "device": true, "filesystem": [ { "src": "/nix/store" @@ -521,7 +521,7 @@ func Test_printPs(t *testing.T) { "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT" }, "map_real_uid": true, - "dev": true, + "device": true, "filesystem": [ { "src": "/nix/store" |