aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal/outcome
diff options
context:
space:
mode:
Diffstat (limited to 'internal/outcome')
-rw-r--r--internal/outcome/outcome.go8
-rw-r--r--internal/outcome/run_test.go52
-rw-r--r--internal/outcome/spcontainer.go4
-rw-r--r--internal/outcome/spcontainer_test.go16
-rw-r--r--internal/outcome/spdbus_test.go4
-rw-r--r--internal/outcome/sppipewire_test.go2
-rw-r--r--internal/outcome/sppulse_test.go24
-rw-r--r--internal/outcome/spruntime.go4
-rw-r--r--internal/outcome/spruntime_test.go16
-rw-r--r--internal/outcome/sptmpdir.go4
-rw-r--r--internal/outcome/sptmpdir_test.go4
-rw-r--r--internal/outcome/spwayland_test.go8
12 files changed, 73 insertions, 73 deletions
diff --git a/internal/outcome/outcome.go b/internal/outcome/outcome.go
index 0fe0016e..414b421f 100644
--- a/internal/outcome/outcome.go
+++ b/internal/outcome/outcome.go
@@ -240,8 +240,8 @@ func (state *outcomeStateSys) ensureRuntimeDir() {
state.useRuntimeDir = true
state.sys.
// ensure this dir in case XDG_RUNTIME_DIR is unset
- Ensure(state.sc.RuntimePath, 0700).UpdatePermType(system.User, state.sc.RuntimePath, acl.Execute).
- Ensure(state.sc.RunDirPath, 0700).UpdatePermType(system.User, state.sc.RunDirPath, acl.Execute)
+ Ensure(state.sc.RuntimePath, 0700, true).UpdatePermType(system.User, state.sc.RuntimePath, acl.Execute).
+ Ensure(state.sc.RunDirPath, 0700, true).UpdatePermType(system.User, state.sc.RunDirPath, acl.Execute)
}
// instance returns the pathname to a process-specific directory within TMPDIR.
@@ -252,7 +252,7 @@ func (state *outcomeStateSys) instance() *check.Absolute {
return state.sharePath
}
state.sharePath = state.instancePath()
- state.sys.Ephemeral(system.Process, state.sharePath, 0711)
+ state.sys.Ephemeral(system.Process, state.sharePath, 0711, false)
return state.sharePath
}
@@ -265,7 +265,7 @@ func (state *outcomeStateSys) runtime() *check.Absolute {
}
state.ensureRuntimeDir()
state.runtimeSharePath = state.runtimePath()
- state.sys.Ephemeral(system.Process, state.runtimeSharePath, 0700)
+ state.sys.Ephemeral(system.Process, state.runtimeSharePath, 0700, true)
state.sys.UpdatePerm(state.runtimeSharePath, acl.Execute)
return state.runtimeSharePath
}
diff --git a/internal/outcome/run_test.go b/internal/outcome/run_test.go
index e4e33dca..a8297768 100644
--- a/internal/outcome/run_test.go
+++ b/internal/outcome/run_test.go
@@ -42,22 +42,22 @@ func TestOutcomeRun(t *testing.T) {
}{
{"template", new(stubNixOS), hst.Template(), checkExpectInstanceId, system.New(panicMsgContext{}, message.New(nil), 10009).
// spParamsOp
- Ensure(m("/tmp/hakurei.0"), 0711).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
// spRuntimeOp
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).
+ Ensure(m("/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
// spTmpdirOp
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).
+ Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
// instance
- Ephemeral(system.Process, m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"), 0711).
+ Ephemeral(system.Process, m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"), 0711, false).
// spWaylandOp
Wayland(
@@ -88,7 +88,7 @@ func TestOutcomeRun(t *testing.T) {
UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/system_bus_socket"), acl.Read|acl.Write).
// spFilesystemOp
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"), acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"), acl.Read|acl.Write|acl.Execute), &container.Params{
@@ -201,14 +201,14 @@ func TestOutcomeRun(t *testing.T) {
0xbd, 0x01, 0x78, 0x0e,
0xb9, 0xa6, 0x07, 0xac,
}, system.New(t.Context(), msg, 10000).
- Ensure(m("/tmp/hakurei.0"), 0711).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/0"), 0700).
+ Ensure(m("/tmp/hakurei.0/runtime/0"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/0"), acl.Read|acl.Write|acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/0"), 01700).
+ Ensure(m("/tmp/hakurei.0/tmpdir/0"), 01700, true).
UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/0"), acl.Read|acl.Write|acl.Execute), &container.Params{
Dir: m("/home/chronos"),
@@ -327,12 +327,12 @@ func TestOutcomeRun(t *testing.T) {
0x82, 0xd4, 0x13, 0x36,
0x9b, 0x64, 0xce, 0x7c,
}, system.New(t.Context(), msg, 10009).
- Ensure(m("/tmp/hakurei.0"), 0711).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
- Ephemeral(system.Process, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c"), 0711).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/runtime/9"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
+ Ephemeral(system.Process, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c"), 0711, false).
Wayland(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
PipeWire(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/pipewire"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
MustProxyDBus(&hst.BusConfig{
@@ -478,15 +478,15 @@ func TestOutcomeRun(t *testing.T) {
0x4c, 0xf0, 0x73, 0xbd,
0xb4, 0x6e, 0xb5, 0xc1,
}, system.New(t.Context(), msg, 10001).
- Ensure(m("/tmp/hakurei.0"), 0711).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/1"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read|acl.Write|acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read|acl.Write|acl.Execute).
- Ensure(m("/run/user/1971"), 0700).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
- Ensure(m("/run/user/1971/hakurei"), 0700).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/runtime/1"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read|acl.Write|acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read|acl.Write|acl.Execute).
+ Ensure(m("/run/user/1971"), 0700, true).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
+ Ensure(m("/run/user/1971/hakurei"), 0700, true).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read|acl.Write|acl.Execute).
- Ephemeral(system.Process, m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1"), 0711).
+ Ephemeral(system.Process, m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1"), 0711, false).
PipeWire(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/pipewire"), "org.chromium.Chromium", "8e2c76b066dabe574cf073bdb46eb5c1").
MustProxyDBus(&hst.BusConfig{
Talk: []string{
diff --git a/internal/outcome/spcontainer.go b/internal/outcome/spcontainer.go
index 0ddc10ac..4ba3bb2d 100644
--- a/internal/outcome/spcontainer.go
+++ b/internal/outcome/spcontainer.go
@@ -39,7 +39,7 @@ type spParamsOp struct {
func (s *spParamsOp) toSystem(state *outcomeStateSys) error {
s.Term, s.TermSet = state.k.lookupEnv("TERM")
- state.sys.Ensure(state.sc.SharePath, 0711)
+ state.sys.Ensure(state.sc.SharePath, 0711, false)
return nil
}
@@ -351,7 +351,7 @@ func flattenExtraPerms(sys *system.I, extraPerms []hst.ExtraPermConfig) {
}
if p.Ensure {
- sys.Ensure(p.Path, 0700)
+ sys.Ensure(p.Path, 0700, true)
}
var perms acl.Perm
diff --git a/internal/outcome/spcontainer_test.go b/internal/outcome/spcontainer_test.go
index d9436cb4..54c276f9 100644
--- a/internal/outcome/spcontainer_test.go
+++ b/internal/outcome/spcontainer_test.go
@@ -36,7 +36,7 @@ func TestSpParamsOp(t *testing.T) {
}, nil, []stub.Call{
call("lookupEnv", stub.ExpectArgs{"TERM"}, "xterm", nil),
}, newI().
- Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711), nil, nil, nil, []stub.Call{
+ Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711, false), nil, nil, nil, []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, nil, nil, &hst.AppError{
Step: "finalise",
@@ -57,7 +57,7 @@ func TestSpParamsOp(t *testing.T) {
}, nil, []stub.Call{
call("lookupEnv", stub.ExpectArgs{"TERM"}, "xterm", nil),
}, newI().
- Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711), nil, nil, nil, []stub.Call{
+ Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711, false), nil, nil, nil, []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Hostname: config.Container.Hostname,
@@ -94,7 +94,7 @@ func TestSpParamsOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
call("lookupEnv", stub.ExpectArgs{"TERM"}, "xterm", nil),
}, newI().
- Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711), nil, nil, nil, []stub.Call{
+ Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711, false), nil, nil, nil, []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Hostname: config.Container.Hostname,
@@ -309,7 +309,7 @@ func TestSpFilesystemOp(t *testing.T) {
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium"}, nePrefix+"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium", nil),
call("verbosef", stub.ExpectArgs{"hiding path %q from %q", []any{"/proc/nonexistent/eval/etc/dbus", "/etc/"}}, nil, nil),
}, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
@@ -342,7 +342,7 @@ func TestSpFilesystemOp(t *testing.T) {
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium"}, nePrefix+"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium", nil),
call("verbosef", stub.ExpectArgs{"hiding path %q from %q", []any{"/proc/nonexistent/eval/etc/dbus", "/etc/"}}, nil, nil),
}, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
@@ -397,7 +397,7 @@ func TestSpFilesystemOp(t *testing.T) {
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.debian/usr"}, nePrefix+"/var/lib/hakurei/base/org.debian/usr", nil),
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.debian/var"}, nePrefix+"/var/lib/hakurei/base/org.debian/var", nil),
}, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
@@ -441,14 +441,14 @@ func TestFlattenExtraPerms(t *testing.T) {
want *system.I
}{
{"path nil check", append(hst.Template().ExtraPerms, hst.ExtraPermConfig{}), newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
acl.Read|acl.Write|acl.Execute)},
{"template", hst.Template().ExtraPerms, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
diff --git a/internal/outcome/spdbus_test.go b/internal/outcome/spdbus_test.go
index 0e4704a8..4720b5c8 100644
--- a/internal/outcome/spdbus_test.go
+++ b/internal/outcome/spdbus_test.go
@@ -81,7 +81,7 @@ func TestSpDBusOp(t *testing.T) {
)}}, nil, nil),
}, func() *system.I {
sys := system.New(panicMsgContext{}, message.New(nil), checkExpectUid)
- sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711)
+ sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711, false)
if err := sys.ProxyDBus(
dbus.NewConfig(config.ID, true, true), nil,
dbus.ProxyPair{"unix:path=/run/user/1000/bus", wantInstancePrefix + "/bus"},
@@ -163,7 +163,7 @@ func TestSpDBusOp(t *testing.T) {
)}}, nil, nil),
}, func() *system.I {
sys := system.New(panicMsgContext{}, message.New(nil), checkExpectUid)
- sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711)
+ sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711, false)
if err := sys.ProxyDBus(
config.SessionBus, config.SystemBus,
dbus.ProxyPair{"unix:path=/run/user/1000/bus", wantInstancePrefix + "/bus"},
diff --git a/internal/outcome/sppipewire_test.go b/internal/outcome/sppipewire_test.go
index 1e3dab6a..804404dc 100644
--- a/internal/outcome/sppipewire_test.go
+++ b/internal/outcome/sppipewire_test.go
@@ -31,7 +31,7 @@ func TestSpPipeWireOp(t *testing.T) {
return c
}, nil, []stub.Call{}, newI().
// state.instance
- Ephemeral(system.Process, m(wantInstancePrefix), 0711).
+ Ephemeral(system.Process, m(wantInstancePrefix), 0711, false).
// toSystem
PipeWire(
m(wantInstancePrefix+"/pipewire"),
diff --git a/internal/outcome/sppulse_test.go b/internal/outcome/sppulse_test.go
index a1ff0d03..a9995562 100644
--- a/internal/outcome/sppulse_test.go
+++ b/internal/outcome/sppulse_test.go
@@ -143,12 +143,12 @@ func TestSpPulseOp(t *testing.T) {
call("open", stub.ExpectArgs{"/proc/nonexistent/cookie"}, &stubOsFile{Reader: bytes.NewReader(sampleCookie)}, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
@@ -175,12 +175,12 @@ func TestSpPulseOp(t *testing.T) {
call("open", stub.ExpectArgs{"/proc/nonexistent/cookie"}, &stubOsFile{Reader: bytes.NewReader(sampleCookie[:len(sampleCookie)-0xe])}, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
@@ -208,12 +208,12 @@ func TestSpPulseOp(t *testing.T) {
call("open", stub.ExpectArgs{"/proc/nonexistent/cookie"}, &stubOsFile{Reader: bytes.NewReader(sampleCookie)}, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
@@ -238,12 +238,12 @@ func TestSpPulseOp(t *testing.T) {
call("verbose", stub.ExpectArgs{[]any{"cannot locate PulseAudio cookie (tried $PULSE_COOKIE, $XDG_CONFIG_HOME/pulse/cookie, $HOME/.pulse-cookie)"}}, nil, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
diff --git a/internal/outcome/spruntime.go b/internal/outcome/spruntime.go
index 9d36f252..55feac1d 100644
--- a/internal/outcome/spruntime.go
+++ b/internal/outcome/spruntime.go
@@ -76,9 +76,9 @@ type spRuntimeOp struct {
func (s *spRuntimeOp) toSystem(state *outcomeStateSys) error {
if state.Container.Flags&hst.FShareRuntime != 0 {
runtimeDir, runtimeDirInst := s.commonPaths(state.outcomeState)
- state.sys.Ensure(runtimeDir, 0700)
+ state.sys.Ensure(runtimeDir, 0700, true)
state.sys.UpdatePermType(system.User, runtimeDir, acl.Execute)
- state.sys.Ensure(runtimeDirInst, 0700)
+ state.sys.Ensure(runtimeDirInst, 0700, true)
state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read|acl.Write|acl.Execute)
}
diff --git a/internal/outcome/spruntime_test.go b/internal/outcome/spruntime_test.go
index 618fc7ac..20e55d63 100644
--- a/internal/outcome/spruntime_test.go
+++ b/internal/outcome/spruntime_test.go
@@ -33,9 +33,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
@@ -61,9 +61,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
@@ -89,9 +89,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
@@ -113,9 +113,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
diff --git a/internal/outcome/sptmpdir.go b/internal/outcome/sptmpdir.go
index 3acb069f..9a637f8b 100644
--- a/internal/outcome/sptmpdir.go
+++ b/internal/outcome/sptmpdir.go
@@ -19,9 +19,9 @@ type spTmpdirOp struct{}
func (s spTmpdirOp) toSystem(state *outcomeStateSys) error {
if state.Container.Flags&hst.FShareTmpdir != 0 {
tmpdir, tmpdirInst := s.commonPaths(state.outcomeState)
- state.sys.Ensure(tmpdir, 0700)
+ state.sys.Ensure(tmpdir, 0700, true)
state.sys.UpdatePermType(system.User, tmpdir, acl.Execute)
- state.sys.Ensure(tmpdirInst, 01700)
+ state.sys.Ensure(tmpdirInst, 01700, true)
state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read|acl.Write|acl.Execute)
}
return nil
diff --git a/internal/outcome/sptmpdir_test.go b/internal/outcome/sptmpdir_test.go
index 2073ad81..421d65ab 100644
--- a/internal/outcome/sptmpdir_test.go
+++ b/internal/outcome/sptmpdir_test.go
@@ -21,9 +21,9 @@ func TestSpTmpdirOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), 0700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), 0700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), 01700).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), 01700, true).
UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
diff --git a/internal/outcome/spwayland_test.go b/internal/outcome/spwayland_test.go
index 9bb35512..eea23136 100644
--- a/internal/outcome/spwayland_test.go
+++ b/internal/outcome/spwayland_test.go
@@ -34,7 +34,7 @@ func TestSpWaylandOp(t *testing.T) {
call("lookupEnv", stub.ExpectArgs{"WAYLAND_DISPLAY"}, "wayland-1", nil),
}, newI().
// state.instance
- Ephemeral(system.Process, m(wantInstancePrefix), 0711).
+ Ephemeral(system.Process, m(wantInstancePrefix), 0711, false).
// toSystem
Wayland(
m(wantInstancePrefix+"/wayland"),
@@ -64,9 +64,9 @@ func TestSpWaylandOp(t *testing.T) {
call("verbose", stub.ExpectArgs{[]any{"direct wayland access, PROCEED WITH CAUTION"}}, nil, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// toSystem
UpdatePermType(hst.EWayland, m("/proc/nonexistent/wayland"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
@@ -85,7 +85,7 @@ func TestSpWaylandOp(t *testing.T) {
call("verbose", stub.ExpectArgs{[]any{"WAYLAND_DISPLAY is not set, assuming wayland-0"}}, nil, nil),
}, newI().
// state.instance
- Ephemeral(system.Process, m(wantInstancePrefix), 0711).
+ Ephemeral(system.Process, m(wantInstancePrefix), 0711, false).
// toSystem
Wayland(
m(wantInstancePrefix+"/wayland"),
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-14 20:04:48 +0000