diff options
Diffstat (limited to 'internal/app/config.go')
| -rw-r--r-- | internal/app/config.go | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/internal/app/config.go b/internal/app/config.go index eccb5922..6a25d833 100644 --- a/internal/app/config.go +++ b/internal/app/config.go @@ -8,11 +8,6 @@ import ( "git.ophivana.moe/security/fortify/internal/system" ) -const ( - mappedID = 65534 - mappedIDString = "65534" -) - // Config is used to seal an *App type Config struct { // D-Bus application ID @@ -54,6 +49,8 @@ type SandboxConfig struct { Net bool `json:"net,omitempty"` // do not run in new session NoNewSession bool `json:"no_new_session,omitempty"` + // map target user uid to privileged user uid in the user namespace + UseRealUID bool `json:"use_real_uid"` // mediated access to wayland socket Wayland bool `json:"wayland,omitempty"` @@ -82,11 +79,15 @@ type FilesystemConfig struct { // Bwrap returns the address of the corresponding bwrap.Config to s. // Note that remaining tmpfs entries must be queued by the caller prior to launch. -func (s *SandboxConfig) Bwrap() *bwrap.Config { +func (s *SandboxConfig) Bwrap(uid int) *bwrap.Config { if s == nil { return nil } + if !s.UseRealUID { + uid = 65534 + } + conf := (&bwrap.Config{ Net: s.Net, UserNS: s.UserNS, @@ -100,7 +101,7 @@ func (s *SandboxConfig) Bwrap() *bwrap.Config { // initialise map Chmod: make(map[string]os.FileMode), }). - SetUID(mappedID).SetGID(mappedID). + SetUID(uid).SetGID(uid). Procfs("/proc").DevTmpfs("/dev").Mqueue("/dev/mqueue"). Tmpfs("/dev/fortify", 4*1024) |