aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal/outcome
diff options
context:
space:
mode:
Diffstat (limited to 'internal/outcome')
-rw-r--r--internal/outcome/run_test.go20
-rw-r--r--internal/outcome/spruntime.go3
-rw-r--r--internal/outcome/spruntime_test.go12
-rw-r--r--internal/outcome/sptmpdir.go3
-rw-r--r--internal/outcome/sptmpdir_test.go3
5 files changed, 15 insertions, 26 deletions
diff --git a/internal/outcome/run_test.go b/internal/outcome/run_test.go
index a8297768..81443c5d 100644
--- a/internal/outcome/run_test.go
+++ b/internal/outcome/run_test.go
@@ -45,14 +45,12 @@ func TestOutcomeRun(t *testing.T) {
Ensure(m("/tmp/hakurei.0"), 0711, false).
// spRuntimeOp
- Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).
- UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
// spTmpdirOp
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).
- UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
@@ -202,12 +200,10 @@ func TestOutcomeRun(t *testing.T) {
0xb9, 0xa6, 0x07, 0xac,
}, system.New(t.Context(), msg, 10000).
Ensure(m("/tmp/hakurei.0"), 0711, false).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).
- UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/tmp/hakurei.0/runtime/0"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/0"), acl.Read|acl.Write|acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).
- UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
Ensure(m("/tmp/hakurei.0/tmpdir/0"), 01700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/0"), acl.Read|acl.Write|acl.Execute), &container.Params{
@@ -328,9 +324,9 @@ func TestOutcomeRun(t *testing.T) {
0x9b, 0x64, 0xce, 0x7c,
}, system.New(t.Context(), msg, 10009).
Ensure(m("/tmp/hakurei.0"), 0711, false).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/tmp/hakurei.0/runtime/9"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
Ephemeral(system.Process, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c"), 0711, false).
Wayland(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
@@ -479,9 +475,9 @@ func TestOutcomeRun(t *testing.T) {
0xb4, 0x6e, 0xb5, 0xc1,
}, system.New(t.Context(), msg, 10001).
Ensure(m("/tmp/hakurei.0"), 0711, false).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/tmp/hakurei.0/runtime/1"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read|acl.Write|acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read|acl.Write|acl.Execute).
Ensure(m("/run/user/1971"), 0700, true).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
Ensure(m("/run/user/1971/hakurei"), 0700, true).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
diff --git a/internal/outcome/spruntime.go b/internal/outcome/spruntime.go
index 55feac1d..b8121bfa 100644
--- a/internal/outcome/spruntime.go
+++ b/internal/outcome/spruntime.go
@@ -76,8 +76,7 @@ type spRuntimeOp struct {
func (s *spRuntimeOp) toSystem(state *outcomeStateSys) error {
if state.Container.Flags&hst.FShareRuntime != 0 {
runtimeDir, runtimeDirInst := s.commonPaths(state.outcomeState)
- state.sys.Ensure(runtimeDir, 0700, true)
- state.sys.UpdatePermType(system.User, runtimeDir, acl.Execute)
+ state.sys.Ensure(runtimeDir, 0711, false)
state.sys.Ensure(runtimeDirInst, 0700, true)
state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read|acl.Write|acl.Execute)
}
diff --git a/internal/outcome/spruntime_test.go b/internal/outcome/spruntime_test.go
index 20e55d63..c549c857 100644
--- a/internal/outcome/spruntime_test.go
+++ b/internal/outcome/spruntime_test.go
@@ -33,8 +33,7 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
@@ -61,8 +60,7 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
@@ -89,8 +87,7 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
@@ -113,8 +110,7 @@ func TestSpRuntimeOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
diff --git a/internal/outcome/sptmpdir.go b/internal/outcome/sptmpdir.go
index 9a637f8b..c0c8db7b 100644
--- a/internal/outcome/sptmpdir.go
+++ b/internal/outcome/sptmpdir.go
@@ -19,8 +19,7 @@ type spTmpdirOp struct{}
func (s spTmpdirOp) toSystem(state *outcomeStateSys) error {
if state.Container.Flags&hst.FShareTmpdir != 0 {
tmpdir, tmpdirInst := s.commonPaths(state.outcomeState)
- state.sys.Ensure(tmpdir, 0700, true)
- state.sys.UpdatePermType(system.User, tmpdir, acl.Execute)
+ state.sys.Ensure(tmpdir, 0711, false)
state.sys.Ensure(tmpdirInst, 01700, true)
state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read|acl.Write|acl.Execute)
}
diff --git a/internal/outcome/sptmpdir_test.go b/internal/outcome/sptmpdir_test.go
index 421d65ab..74aceeee 100644
--- a/internal/outcome/sptmpdir_test.go
+++ b/internal/outcome/sptmpdir_test.go
@@ -21,8 +21,7 @@ func TestSpTmpdirOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), 0700, true).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), acl.Execute).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), 0711, false).
Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), 01700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-19 23:10:55 +0000