diff options
Diffstat (limited to 'internal/app')
| -rw-r--r-- | internal/app/app_pd_test.go | 4 | ||||
| -rw-r--r-- | internal/app/share.go | 2 | ||||
| -rw-r--r-- | internal/app/start.go | 2 | ||||
| -rw-r--r-- | internal/app/system.go | 4 |
4 files changed, 9 insertions, 3 deletions
diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go index 4d90d7fc..b5cf46bf 100644 --- a/internal/app/app_pd_test.go +++ b/internal/app/app_pd_test.go @@ -1,6 +1,8 @@ package app_test import ( + "os" + "git.gensokyo.uk/security/fortify/acl" "git.gensokyo.uk/security/fortify/dbus" "git.gensokyo.uk/security/fortify/fst" @@ -217,7 +219,7 @@ var testCasesPd = []sealTestCase{ Ensure("/run/user/1971", 0700).UpdatePermType(system.User, "/run/user/1971", acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset Ephemeral(system.Process, "/run/user/1971/fortify/ebf083d1b175911782d413369b64ce7c", 0700).UpdatePermType(system.Process, "/run/user/1971/fortify/ebf083d1b175911782d413369b64ce7c", acl.Execute). Ensure("/tmp/fortify.1971/wayland", 0711). - Wayland("/tmp/fortify.1971/wayland/ebf083d1b175911782d413369b64ce7c", "/run/user/1971/wayland-0", "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c"). + Wayland(new(*os.File), "/tmp/fortify.1971/wayland/ebf083d1b175911782d413369b64ce7c", "/run/user/1971/wayland-0", "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c"). Link("/run/user/1971/pulse/native", "/run/user/1971/fortify/ebf083d1b175911782d413369b64ce7c/pulse"). CopyFile(new([]byte), "/home/ophestra/xdg/config/pulse/cookie", 256, 256). MustProxyDBus("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/bus", &dbus.Config{ diff --git a/internal/app/share.go b/internal/app/share.go index 1862fb2b..beed4f0e 100644 --- a/internal/app/share.go +++ b/internal/app/share.go @@ -163,7 +163,7 @@ func (seal *appSeal) setupShares(bus [2]*dbus.Config, os linux.System) error { // use instance ID in case app id is not set appID = "uk.gensokyo.fortify." + seal.id } - seal.sys.Wayland(outerPath, socketPath, appID, seal.id) + seal.sys.Wayland(&seal.sys.sp, outerPath, socketPath, appID, seal.id) seal.sys.bwrap.Bind(outerPath, innerPath) } else { // bind mount wayland socket (insecure) fmsg.Verbose("direct wayland access, PROCEED WITH CAUTION") diff --git a/internal/app/start.go b/internal/app/start.go index 467735e1..8390b6be 100644 --- a/internal/app/start.go +++ b/internal/app/start.go @@ -58,7 +58,7 @@ func (a *app) Run(ctx context.Context, rs *RunState) error { if startTime, err := a.shim.Start( a.seal.sys.user.as, a.seal.sys.user.supp, - a.seal.sys.Sync(), + a.seal.sys.sp, ); err != nil { return err } else { diff --git a/internal/app/system.go b/internal/app/system.go index 241eafa5..f11efc86 100644 --- a/internal/app/system.go +++ b/internal/app/system.go @@ -1,6 +1,8 @@ package app import ( + "os" + "git.gensokyo.uk/security/fortify/helper/bwrap" "git.gensokyo.uk/security/fortify/internal/system" ) @@ -8,6 +10,8 @@ import ( // appSealSys encapsulates app seal behaviour with OS interactions type appSealSys struct { bwrap *bwrap.Config + // bwrap sync fd + sp *os.File // paths to override by mounting tmpfs over them override []string |