aboutsummaryrefslogtreecommitdiffhomepage
diff options
context:
space:
mode:
Diffstat
-rw-r--r--dbus/run.go16
-rw-r--r--helper/args_test.go2
-rw-r--r--helper/bwrap.go18
-rw-r--r--helper/bwrap_test.go36
-rw-r--r--helper/direct.go15
-rw-r--r--helper/direct_test.go6
-rw-r--r--internal/app/shim/main.go10
7 files changed, 55 insertions, 48 deletions
diff --git a/dbus/run.go b/dbus/run.go
index ae2d9e08..e1f54fb9 100644
--- a/dbus/run.go
+++ b/dbus/run.go
@@ -28,25 +28,25 @@ func (p *Proxy) Start(ctx context.Context, output io.Writer, sandbox bool) error
var (
h helper.Helper
- argF = func(argsFD, statFD int) []string {
- if statFD == -1 {
- return []string{"--args=" + strconv.Itoa(argsFD)}
+ argF = func(argsFd, statFd int) []string {
+ if statFd == -1 {
+ return []string{"--args=" + strconv.Itoa(argsFd)}
} else {
- return []string{"--args=" + strconv.Itoa(argsFD), "--fd=" + strconv.Itoa(statFD)}
+ return []string{"--args=" + strconv.Itoa(argsFd), "--fd=" + strconv.Itoa(statFd)}
}
}
)
c, cancel := context.WithCancelCause(ctx)
if !sandbox {
- h = helper.NewDirect(c, p.seal, p.name, argF, func(cmd *exec.Cmd) {
+ h = helper.NewDirect(c, p.name, p.seal, true, argF, func(cmd *exec.Cmd) {
if output != nil {
cmd.Stdout, cmd.Stderr = output, output
}
// xdg-dbus-proxy does not need to inherit the environment
cmd.Env = make([]string, 0)
- }, true)
+ })
} else {
// look up absolute path if name is just a file name
toolPath := p.name
@@ -116,11 +116,11 @@ func (p *Proxy) Start(ctx context.Context, output io.Writer, sandbox bool) error
bc.Bind(k, k)
}
- h = helper.MustNewBwrap(c, bc, toolPath, true, p.seal, argF, func(cmd *exec.Cmd) {
+ h = helper.MustNewBwrap(c, toolPath, p.seal, true, argF, func(cmd *exec.Cmd) {
if output != nil {
cmd.Stdout, cmd.Stderr = output, output
}
- }, nil, nil, true)
+ }, bc, true, nil, nil)
p.bwrap = bc
}
diff --git a/helper/args_test.go b/helper/args_test.go
index a23b315f..9014041e 100644
--- a/helper/args_test.go
+++ b/helper/args_test.go
@@ -9,7 +9,7 @@ import (
"git.gensokyo.uk/security/fortify/helper"
)
-func Test_argsFD_String(t *testing.T) {
+func Test_argsFd_String(t *testing.T) {
wantString := strings.Join(wantArgs, " ")
if got := argsWt.(fmt.Stringer).String(); got != wantString {
t.Errorf("String(): got %v; want %v",
diff --git a/helper/bwrap.go b/helper/bwrap.go
index 7ced938d..7e9e9bcf 100644
--- a/helper/bwrap.go
+++ b/helper/bwrap.go
@@ -51,17 +51,17 @@ func (b *bubblewrap) Start() error {
// Function argF returns an array of arguments passed directly to the child process.
func MustNewBwrap(
ctx context.Context,
- conf *bwrap.Config,
name string,
- setpgid bool,
wt io.WriterTo,
- argF func(argsFD, statFD int) []string,
+ stat bool,
+ argF func(argsFd, statFd int) []string,
cmdF func(cmd *exec.Cmd),
+ conf *bwrap.Config,
+ setpgid bool,
extraFiles []*os.File,
syncFd *os.File,
- stat bool,
) Helper {
- b, err := NewBwrap(ctx, conf, name, setpgid, wt, argF, cmdF, extraFiles, syncFd, stat)
+ b, err := NewBwrap(ctx, name, wt, stat, argF, cmdF, conf, setpgid, extraFiles, syncFd)
if err != nil {
panic(err.Error())
} else {
@@ -74,20 +74,20 @@ func MustNewBwrap(
// Function argF returns an array of arguments passed directly to the child process.
func NewBwrap(
ctx context.Context,
- conf *bwrap.Config,
name string,
- setpgid bool,
wt io.WriterTo,
+ stat bool,
argF func(argsFd, statFd int) []string,
cmdF func(cmd *exec.Cmd),
+ conf *bwrap.Config,
+ setpgid bool,
extraFiles []*os.File,
syncFd *os.File,
- stat bool,
) (Helper, error) {
b := new(bubblewrap)
b.name = name
- b.helperCmd = newHelperCmd(ctx, BubblewrapName, wt, argF, extraFiles, stat)
+ b.helperCmd = newHelperCmd(ctx, BubblewrapName, wt, argF, stat, extraFiles)
if setpgid {
b.Cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
}
diff --git a/helper/bwrap_test.go b/helper/bwrap_test.go
index 4b423564..08b383ea 100644
--- a/helper/bwrap_test.go
+++ b/helper/bwrap_test.go
@@ -33,9 +33,10 @@ func TestBwrap(t *testing.T) {
h := helper.MustNewBwrap(
context.Background(),
- sc, "fortify", false,
- argsWt, argF, nil,
- nil, nil, false,
+ "fortify",
+ argsWt, false,
+ argF, nil,
+ sc, false, nil, nil,
)
if err := h.Start(); !errors.Is(err, os.ErrNotExist) {
@@ -47,9 +48,10 @@ func TestBwrap(t *testing.T) {
t.Run("valid new helper nil check", func(t *testing.T) {
if got := helper.MustNewBwrap(
context.TODO(),
- sc, "fortify", false,
- argsWt, argF, nil,
- nil, nil, false,
+ "fortify",
+ argsWt, false,
+ argF, nil,
+ sc, false, nil, nil,
); got == nil {
t.Errorf("MustNewBwrap(%#v, %#v, %#v) got nil",
sc, argsWt, "fortify")
@@ -68,22 +70,24 @@ func TestBwrap(t *testing.T) {
helper.MustNewBwrap(
context.TODO(),
- &bwrap.Config{Hostname: "\x00"}, "fortify", false,
- nil, argF, nil,
- nil, nil, false,
+ "fortify",
+ nil, false,
+ argF, nil,
+ &bwrap.Config{Hostname: "\x00"}, false, nil, nil,
)
})
t.Run("start without pipes", func(t *testing.T) {
helper.InternalReplaceExecCommand(t)
- c, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+ ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
defer cancel()
stdout, stderr := new(strings.Builder), new(strings.Builder)
h := helper.MustNewBwrap(
- c, sc, "crash-test-dummy", false,
- nil, argFChecked, func(cmd *exec.Cmd) { cmd.Stdout, cmd.Stderr = stdout, stderr },
- nil, nil, false,
+ ctx, "crash-test-dummy",
+ nil, false,
+ argFChecked, func(cmd *exec.Cmd) { cmd.Stdout, cmd.Stderr = stdout, stderr },
+ sc, false, nil, nil,
)
if err := h.Start(); err != nil {
@@ -101,8 +105,10 @@ func TestBwrap(t *testing.T) {
t.Run("implementation compliance", func(t *testing.T) {
testHelper(t, func(ctx context.Context, cmdF func(cmd *exec.Cmd), stat bool) helper.Helper {
return helper.MustNewBwrap(
- ctx, sc, "crash-test-dummy", false,
- argsWt, argF, cmdF, nil, nil, stat,
+ ctx, "crash-test-dummy",
+ argsWt, stat,
+ argF, cmdF,
+ sc, false, nil, nil,
)
})
})
diff --git a/helper/direct.go b/helper/direct.go
index 16aede83..74dd46ef 100644
--- a/helper/direct.go
+++ b/helper/direct.go
@@ -17,14 +17,14 @@ import (
// Function argF returns an array of arguments passed directly to the child process.
func NewDirect(
ctx context.Context,
- wt io.WriterTo,
name string,
+ wt io.WriterTo,
+ stat bool,
argF func(argsFd, statFd int) []string,
cmdF func(cmd *exec.Cmd),
- stat bool,
) Helper {
d := new(direct)
- d.helperCmd = newHelperCmd(ctx, name, wt, argF, nil, stat)
+ d.helperCmd = newHelperCmd(ctx, name, wt, argF, stat, nil)
if cmdF != nil {
cmdF(d.helperCmd.Cmd)
}
@@ -53,9 +53,12 @@ func (h *direct) Start() error {
}
func newHelperCmd(
- ctx context.Context, name string,
- wt io.WriterTo, argF func(argsFd, statFd int) []string,
- extraFiles []*os.File, stat bool,
+ ctx context.Context,
+ name string,
+ wt io.WriterTo,
+ argF func(argsFd, statFd int) []string,
+ stat bool,
+ extraFiles []*os.File,
) (cmd *helperCmd) {
cmd = new(helperCmd)
cmd.ctx = ctx
diff --git a/helper/direct_test.go b/helper/direct_test.go
index 7af0e3a6..6431edec 100644
--- a/helper/direct_test.go
+++ b/helper/direct_test.go
@@ -12,7 +12,7 @@ import (
func TestDirect(t *testing.T) {
t.Run("start non-existent helper path", func(t *testing.T) {
- h := helper.NewDirect(context.Background(), argsWt, "/nonexistent", argF, nil, false)
+ h := helper.NewDirect(context.Background(), "/nonexistent", argsWt, false, argF, nil)
if err := h.Start(); !errors.Is(err, os.ErrNotExist) {
t.Errorf("Start: error = %v, wantErr %v",
@@ -21,7 +21,7 @@ func TestDirect(t *testing.T) {
})
t.Run("valid new helper nil check", func(t *testing.T) {
- if got := helper.NewDirect(context.TODO(), argsWt, "fortify", argF, nil, false); got == nil {
+ if got := helper.NewDirect(context.TODO(), "fortify", argsWt, false, argF, nil); got == nil {
t.Errorf("New(%q, %q) got nil",
argsWt, "fortify")
return
@@ -30,7 +30,7 @@ func TestDirect(t *testing.T) {
t.Run("implementation compliance", func(t *testing.T) {
testHelper(t, func(ctx context.Context, cmdF func(cmd *exec.Cmd), stat bool) helper.Helper {
- return helper.NewDirect(ctx, argsWt, "crash-test-dummy", argF, cmdF, stat)
+ return helper.NewDirect(ctx, "crash-test-dummy", argsWt, stat, argF, cmdF)
})
})
}
diff --git a/internal/app/shim/main.go b/internal/app/shim/main.go
index 5690f8f6..c7c853be 100644
--- a/internal/app/shim/main.go
+++ b/internal/app/shim/main.go
@@ -128,13 +128,11 @@ func Main() {
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
defer stop() // unreachable
if b, err := helper.NewBwrap(
- ctx,
- conf, path.Join(fst.Tmp, "sbin/init0"), false,
- nil, func(int, int) []string { return make([]string, 0) },
+ ctx, path.Join(fst.Tmp, "sbin/init0"),
+ nil, false,
+ func(int, int) []string { return make([]string, 0) },
func(cmd *exec.Cmd) { cmd.Stdin, cmd.Stdout, cmd.Stderr = os.Stdin, os.Stdout, os.Stderr },
- extraFiles,
- syncFd,
- false,
+ conf, false, extraFiles, syncFd,
); err != nil {
log.Fatalf("malformed sandbox config: %v", err)
} else {
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 03:31:52 +0000