diff options
Diffstat (limited to 'hst')
| -rw-r--r-- | hst/config.go | 11 | ||||
| -rw-r--r-- | hst/enablement.go | 25 | ||||
| -rw-r--r-- | hst/enablement_test.go | 4 | ||||
| -rw-r--r-- | hst/hst.go | 2 | ||||
| -rw-r--r-- | hst/hst_test.go | 1 |
5 files changed, 33 insertions, 10 deletions
diff --git a/hst/config.go b/hst/config.go index d7078551..c6cd790c 100644 --- a/hst/config.go +++ b/hst/config.go @@ -23,9 +23,20 @@ type Config struct { // System D-Bus proxy configuration. // If set to nil, system bus proxy is disabled. SystemBus *BusConfig `json:"system_bus,omitempty"` + // Direct access to wayland socket, no attempt is made to attach security-context-v1 // and the bare socket is made available to the container. + // + // This option is unsupported and most likely enables full control over the Wayland + // session. Do not set this to true unless you are sure you know what you are doing. DirectWayland bool `json:"direct_wayland,omitempty"` + // Direct access to PulseAudio socket, no attempt is made to establish pipewire-pulse + // server via a PipeWire socket with a SecurityContext attached and the bare socket + // is made available to the container. + // + // This option is unsupported and enables arbitrary code execution as the PulseAudio + // server. Do not set this to true, this is insecure under any configuration. + DirectPulse bool `json:"direct_pulse,omitempty"` // Extra acl updates to perform before setuid. ExtraPerms []ExtraPermConfig `json:"extra_perms,omitempty"` diff --git a/hst/enablement.go b/hst/enablement.go index 7a1056d1..9024078d 100644 --- a/hst/enablement.go +++ b/hst/enablement.go @@ -17,6 +17,8 @@ const ( EX11 // EDBus enables the per-container xdg-dbus-proxy daemon. EDBus + // EPipeWire exposes a pipewire pathname socket via SecurityContext. + EPipeWire // EPulse copies the PulseAudio cookie to [hst.PrivateTmp] and exposes the PulseAudio socket. EPulse @@ -35,6 +37,8 @@ func (e Enablement) String() string { return "x11" case EDBus: return "dbus" + case EPipeWire: + return "pipewire" case EPulse: return "pulseaudio" default: @@ -62,10 +66,11 @@ type Enablements Enablement // enablementsJSON is the [json] representation of [Enablements]. type enablementsJSON = struct { - Wayland bool `json:"wayland,omitempty"` - X11 bool `json:"x11,omitempty"` - DBus bool `json:"dbus,omitempty"` - Pulse bool `json:"pulse,omitempty"` + Wayland bool `json:"wayland,omitempty"` + X11 bool `json:"x11,omitempty"` + DBus bool `json:"dbus,omitempty"` + PipeWire bool `json:"pipewire,omitempty"` + Pulse bool `json:"pulse,omitempty"` } // Unwrap returns the underlying [Enablement]. @@ -81,10 +86,11 @@ func (e *Enablements) MarshalJSON() ([]byte, error) { return nil, syscall.EINVAL } return json.Marshal(&enablementsJSON{ - Wayland: Enablement(*e)&EWayland != 0, - X11: Enablement(*e)&EX11 != 0, - DBus: Enablement(*e)&EDBus != 0, - Pulse: Enablement(*e)&EPulse != 0, + Wayland: Enablement(*e)&EWayland != 0, + X11: Enablement(*e)&EX11 != 0, + DBus: Enablement(*e)&EDBus != 0, + PipeWire: Enablement(*e)&EPipeWire != 0, + Pulse: Enablement(*e)&EPulse != 0, }) } @@ -108,6 +114,9 @@ func (e *Enablements) UnmarshalJSON(data []byte) error { if v.DBus { ve |= EDBus } + if v.PipeWire { + ve |= EPipeWire + } if v.Pulse { ve |= EPulse } diff --git a/hst/enablement_test.go b/hst/enablement_test.go index 75d8d946..5ba9b710 100644 --- a/hst/enablement_test.go +++ b/hst/enablement_test.go @@ -32,6 +32,7 @@ func TestEnablementString(t *testing.T) { {hst.EWayland | hst.EDBus | hst.EPulse, "wayland, dbus, pulseaudio"}, {hst.EX11 | hst.EDBus | hst.EPulse, "x11, dbus, pulseaudio"}, {hst.EWayland | hst.EX11 | hst.EDBus | hst.EPulse, "wayland, x11, dbus, pulseaudio"}, + {hst.EM - 1, "wayland, x11, dbus, pipewire, pulseaudio"}, {1 << 5, "e20"}, {1 << 6, "e40"}, @@ -62,8 +63,9 @@ func TestEnablements(t *testing.T) { {"wayland", hst.NewEnablements(hst.EWayland), `{"wayland":true}`, `{"value":{"wayland":true},"magic":3236757504}`}, {"x11", hst.NewEnablements(hst.EX11), `{"x11":true}`, `{"value":{"x11":true},"magic":3236757504}`}, {"dbus", hst.NewEnablements(hst.EDBus), `{"dbus":true}`, `{"value":{"dbus":true},"magic":3236757504}`}, + {"pipewire", hst.NewEnablements(hst.EPipeWire), `{"pipewire":true}`, `{"value":{"pipewire":true},"magic":3236757504}`}, {"pulse", hst.NewEnablements(hst.EPulse), `{"pulse":true}`, `{"value":{"pulse":true},"magic":3236757504}`}, - {"all", hst.NewEnablements(hst.EWayland | hst.EX11 | hst.EDBus | hst.EPulse), `{"wayland":true,"x11":true,"dbus":true,"pulse":true}`, `{"value":{"wayland":true,"x11":true,"dbus":true,"pulse":true},"magic":3236757504}`}, + {"all", hst.NewEnablements(hst.EM - 1), `{"wayland":true,"x11":true,"dbus":true,"pipewire":true,"pulse":true}`, `{"value":{"wayland":true,"x11":true,"dbus":true,"pipewire":true,"pulse":true},"magic":3236757504}`}, } for _, tc := range testCases { @@ -70,7 +70,7 @@ func Template() *Config { return &Config{ ID: "org.chromium.Chromium", - Enablements: NewEnablements(EWayland | EDBus | EPulse), + Enablements: NewEnablements(EWayland | EDBus | EPipeWire | EPulse), SessionBus: &BusConfig{ See: nil, diff --git a/hst/hst_test.go b/hst/hst_test.go index b487dd5e..01d229fe 100644 --- a/hst/hst_test.go +++ b/hst/hst_test.go @@ -105,6 +105,7 @@ func TestTemplate(t *testing.T) { "enablements": { "wayland": true, "dbus": true, + "pipewire": true, "pulse": true }, "session_bus": { |