aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal/outcome
diff options
context:
space:
mode:
Diffstat (limited to 'internal/outcome')
-rw-r--r--internal/outcome/dispatcher_test.go4
-rw-r--r--internal/outcome/finalise.go2
-rw-r--r--internal/outcome/outcome.go17
-rw-r--r--internal/outcome/run_test.go90
-rw-r--r--internal/outcome/shim-signal.c81
-rw-r--r--internal/outcome/shim-signal.h8
-rw-r--r--internal/outcome/shim.go7
-rw-r--r--internal/outcome/spcontainer.go14
-rw-r--r--internal/outcome/spcontainer_test.go26
-rw-r--r--internal/outcome/spdbus.go4
-rw-r--r--internal/outcome/spdbus_test.go14
-rw-r--r--internal/outcome/sppipewire_test.go2
-rw-r--r--internal/outcome/sppulse_test.go24
-rw-r--r--internal/outcome/spruntime.go7
-rw-r--r--internal/outcome/spruntime_test.go28
-rw-r--r--internal/outcome/sptmpdir.go7
-rw-r--r--internal/outcome/sptmpdir_test.go7
-rw-r--r--internal/outcome/spwayland.go2
-rw-r--r--internal/outcome/spwayland_test.go10
-rw-r--r--internal/outcome/spx11.go2
-rw-r--r--internal/outcome/spx11_test.go4
21 files changed, 184 insertions, 176 deletions
diff --git a/internal/outcome/dispatcher_test.go b/internal/outcome/dispatcher_test.go
index 00771e56..3f4732b5 100644
--- a/internal/outcome/dispatcher_test.go
+++ b/internal/outcome/dispatcher_test.go
@@ -209,7 +209,7 @@ func checkOpBehaviour(t *testing.T, testCases []opBehaviourTestCase) {
if err := s.populateLocal(k, k); err != nil {
t.Fatalf("populateLocal: error = %v", err)
}
- stateSys := s.newSys(config, system.New(panicMsgContext{}, k, checkExpectUid))
+ stateSys := s.newSys(config, system.New(panicMsgContext{}, k, checkExpectUid, nil))
if tc.pStateSys != nil {
tc.pStateSys(stateSys)
}
@@ -279,7 +279,7 @@ func checkOpBehaviour(t *testing.T, testCases []opBehaviourTestCase) {
}
}
-func newI() *system.I { return system.New(panicMsgContext{}, panicMsgContext{}, checkExpectUid) }
+func newI() *system.I { return system.New(panicMsgContext{}, panicMsgContext{}, checkExpectUid, nil) }
// simpleTestCase is a simple freeform test case utilising kstub.
type simpleTestCase struct {
diff --git a/internal/outcome/finalise.go b/internal/outcome/finalise.go
index 4049b8d3..7e5faab6 100644
--- a/internal/outcome/finalise.go
+++ b/internal/outcome/finalise.go
@@ -74,7 +74,7 @@ func (k *outcome) finalise(
return err
}
- sys := system.New(k.ctx, msg, s.uid.unwrap())
+ sys := system.New(k.ctx, msg, s.uid.unwrap(), s.sc.SharePath.Append("lock"))
if err := s.newSys(config, sys).toSystem(); err != nil {
return err
}
diff --git a/internal/outcome/outcome.go b/internal/outcome/outcome.go
index 0fe0016e..19ca9c7b 100644
--- a/internal/outcome/outcome.go
+++ b/internal/outcome/outcome.go
@@ -6,6 +6,7 @@ import (
"errors"
"maps"
"strconv"
+ "time"
"hakurei.app/check"
"hakurei.app/container"
@@ -125,6 +126,14 @@ func newOutcomeState(k syscallDispatcher, msg message.Msg, id *hst.ID, config *h
s.Shim.WaitDelay = s.Container.WaitDelay
}
+ if s.Container.AdoptWaitDelay > 5*time.Second {
+ s.Shim.AdoptWaitDelay = 5 * time.Second
+ } else if s.Container.AdoptWaitDelay < 0 {
+ s.Shim.AdoptWaitDelay = -1
+ } else {
+ s.Shim.AdoptWaitDelay = s.Container.AdoptWaitDelay
+ }
+
if s.Container.Flags&hst.FMapRealUID != 0 {
s.Mapuid, s.Mapgid = k.getuid(), k.getgid()
} else {
@@ -240,8 +249,8 @@ func (state *outcomeStateSys) ensureRuntimeDir() {
state.useRuntimeDir = true
state.sys.
// ensure this dir in case XDG_RUNTIME_DIR is unset
- Ensure(state.sc.RuntimePath, 0700).UpdatePermType(system.User, state.sc.RuntimePath, acl.Execute).
- Ensure(state.sc.RunDirPath, 0700).UpdatePermType(system.User, state.sc.RunDirPath, acl.Execute)
+ Ensure(state.sc.RuntimePath, 0700, true).UpdatePermType(system.User, state.sc.RuntimePath, acl.Execute).
+ Ensure(state.sc.RunDirPath, 0700, true).UpdatePermType(system.User, state.sc.RunDirPath, acl.Execute)
}
// instance returns the pathname to a process-specific directory within TMPDIR.
@@ -252,7 +261,7 @@ func (state *outcomeStateSys) instance() *check.Absolute {
return state.sharePath
}
state.sharePath = state.instancePath()
- state.sys.Ephemeral(system.Process, state.sharePath, 0711)
+ state.sys.Ephemeral(system.Process, state.sharePath, 0711, false)
return state.sharePath
}
@@ -265,7 +274,7 @@ func (state *outcomeStateSys) runtime() *check.Absolute {
}
state.ensureRuntimeDir()
state.runtimeSharePath = state.runtimePath()
- state.sys.Ephemeral(system.Process, state.runtimeSharePath, 0700)
+ state.sys.Ephemeral(system.Process, state.runtimeSharePath, 0700, true)
state.sys.UpdatePerm(state.runtimeSharePath, acl.Execute)
return state.runtimeSharePath
}
diff --git a/internal/outcome/run_test.go b/internal/outcome/run_test.go
index a1d83ec9..d9a41f53 100644
--- a/internal/outcome/run_test.go
+++ b/internal/outcome/run_test.go
@@ -40,24 +40,22 @@ func TestOutcomeRun(t *testing.T) {
wantSys *system.I
wantParams *container.Params
}{
- {"template", new(stubNixOS), hst.Template(), checkExpectInstanceId, system.New(panicMsgContext{}, message.New(nil), 10009).
+ {"template", new(stubNixOS), hst.Template(), checkExpectInstanceId, system.New(panicMsgContext{}, message.New(nil), 10009, nil).
// spParamsOp
- Ensure(m("/tmp/hakurei.0"), 0711).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
// spRuntimeOp
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime/9"), 0700, true).
+ UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
// spTmpdirOp
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read, acl.Write, acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700, true).
+ UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
// instance
- Ephemeral(system.Process, m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"), 0711).
+ Ephemeral(system.Process, m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"), 0711, false).
// spWaylandOp
Wayland(
@@ -84,13 +82,13 @@ func TestOutcomeRun(t *testing.T) {
"unix:path=/var/run/dbus/system_bus_socket",
"/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/system_bus_socket",
},
- ).UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bus"), acl.Read, acl.Write).
- UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/system_bus_socket"), acl.Read, acl.Write).
+ ).UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/bus"), acl.Read|acl.Write).
+ UpdatePerm(m("/tmp/hakurei.0/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/system_bus_socket"), acl.Read|acl.Write).
// spFilesystemOp
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"), acl.Execute).
- UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"), acl.Read, acl.Write, acl.Execute), &container.Params{
+ UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"), acl.Read|acl.Write|acl.Execute), &container.Params{
Dir: m("/data/data/org.chromium.Chromium"),
Env: []string{
@@ -200,16 +198,14 @@ func TestOutcomeRun(t *testing.T) {
0x96, 0xd7, 0xbc, 0x15,
0xbd, 0x01, 0x78, 0x0e,
0xb9, 0xa6, 0x07, 0xac,
- }, system.New(t.Context(), msg, 10000).
- Ensure(m("/tmp/hakurei.0"), 0711).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/0"), 0700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/0"), acl.Read, acl.Write, acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/0"), 01700).
- UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/0"), acl.Read, acl.Write, acl.Execute), &container.Params{
+ }, system.New(t.Context(), msg, 10000, nil).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime/0"), 0700, true).
+ UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/0"), acl.Read|acl.Write|acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/tmpdir/0"), 01700, true).
+ UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/0"), acl.Read|acl.Write|acl.Execute), &container.Params{
Dir: m("/home/chronos"),
Path: m("/run/current-system/sw/bin/zsh"),
@@ -326,13 +322,13 @@ func TestOutcomeRun(t *testing.T) {
0xb1, 0x75, 0x91, 0x17,
0x82, 0xd4, 0x13, 0x36,
0x9b, 0x64, 0xce, 0x7c,
- }, system.New(t.Context(), msg, 10009).
- Ensure(m("/tmp/hakurei.0"), 0711).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/9"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read, acl.Write, acl.Execute).
- Ephemeral(system.Process, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c"), 0711).
+ }, system.New(t.Context(), msg, 10009, nil).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime/9"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/tmpdir/9"), 01700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute).
+ Ephemeral(system.Process, m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c"), 0711, false).
Wayland(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/wayland"), m("/run/user/1971/wayland-0"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
PipeWire(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/pipewire"), "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c").
MustProxyDBus(&hst.BusConfig{
@@ -371,8 +367,8 @@ func TestOutcomeRun(t *testing.T) {
"unix:path=/var/run/dbus/system_bus_socket",
"/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket",
}).
- UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/bus"), acl.Read, acl.Write).
- UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket"), acl.Read, acl.Write), &container.Params{
+ UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/bus"), acl.Read|acl.Write).
+ UpdatePerm(m("/tmp/hakurei.0/ebf083d1b175911782d413369b64ce7c/system_bus_socket"), acl.Read|acl.Write), &container.Params{
Dir: m("/home/chronos"),
Path: m("/run/current-system/sw/bin/zsh"),
@@ -477,16 +473,16 @@ func TestOutcomeRun(t *testing.T) {
0x66, 0xda, 0xbe, 0x57,
0x4c, 0xf0, 0x73, 0xbd,
0xb4, 0x6e, 0xb5, 0xc1,
- }, system.New(t.Context(), msg, 10001).
- Ensure(m("/tmp/hakurei.0"), 0711).
- Ensure(m("/tmp/hakurei.0/runtime"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/runtime/1"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read, acl.Write, acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir"), 0700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read, acl.Write, acl.Execute).
- Ensure(m("/run/user/1971"), 0700).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
- Ensure(m("/run/user/1971/hakurei"), 0700).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
- UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read, acl.Write, acl.Execute).
- Ephemeral(system.Process, m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1"), 0711).
+ }, system.New(t.Context(), msg, 10001, nil).
+ Ensure(m("/tmp/hakurei.0"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/runtime/1"), 0700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/runtime/1"), acl.Read|acl.Write|acl.Execute).
+ Ensure(m("/tmp/hakurei.0/tmpdir"), 0711, false).
+ Ensure(m("/tmp/hakurei.0/tmpdir/1"), 01700, true).UpdatePermType(system.User, m("/tmp/hakurei.0/tmpdir/1"), acl.Read|acl.Write|acl.Execute).
+ Ensure(m("/run/user/1971"), 0700, true).UpdatePermType(system.User, m("/run/user/1971"), acl.Execute). // this is ordered as is because the previous Ensure only calls mkdir if XDG_RUNTIME_DIR is unset
+ Ensure(m("/run/user/1971/hakurei"), 0700, true).UpdatePermType(system.User, m("/run/user/1971/hakurei"), acl.Execute).
+ UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read|acl.Write|acl.Execute).
+ Ephemeral(system.Process, m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1"), 0711, false).
PipeWire(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/pipewire"), "org.chromium.Chromium", "8e2c76b066dabe574cf073bdb46eb5c1").
MustProxyDBus(&hst.BusConfig{
Talk: []string{
@@ -515,8 +511,8 @@ func TestOutcomeRun(t *testing.T) {
"unix:path=/var/run/dbus/system_bus_socket",
"/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket",
}).
- UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/bus"), acl.Read, acl.Write).
- UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket"), acl.Read, acl.Write), &container.Params{
+ UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/bus"), acl.Read|acl.Write).
+ UpdatePerm(m("/tmp/hakurei.0/8e2c76b066dabe574cf073bdb46eb5c1/system_bus_socket"), acl.Read|acl.Write), &container.Params{
Uid: 1971,
Gid: 100,
@@ -581,7 +577,7 @@ func TestOutcomeRun(t *testing.T) {
t.Fatalf("populateLocal: error = %#v", err)
}
- gotSys = system.New(t.Context(), msg, sPriv.uid.unwrap())
+ gotSys = system.New(t.Context(), msg, sPriv.uid.unwrap(), nil)
if err := sPriv.newSys(tc.config, gotSys).toSystem(); err != nil {
t.Fatalf("toSystem: error = %#v", err)
}
diff --git a/internal/outcome/shim-signal.c b/internal/outcome/shim-signal.c
index f02c0df1..6543d4b8 100644
--- a/internal/outcome/shim-signal.c
+++ b/internal/outcome/shim-signal.c
@@ -9,54 +9,57 @@ static pid_t hakurei_shim_param_ppid = -1;
static int hakurei_shim_fd = -1;
/* see shim.go for handling of the message */
-static inline ssize_t hakurei_shim_write(hakurei_shim_msg msg) {
- int savedErrno = errno;
- unsigned char buf = (unsigned char)msg;
- ssize_t ret = write(hakurei_shim_fd, &buf, 1);
- if (ret == -1 && errno != EAGAIN)
- exit(EXIT_FAILURE);
- errno = savedErrno;
- return ret;
+static inline ssize_t hakurei_shim_write(hakurei_shim_msg msg)
+{
+ int savedErrno = errno;
+ unsigned char buf = (unsigned char)msg;
+ ssize_t ret = write(hakurei_shim_fd, &buf, 1);
+ if (ret == -1 && errno != EAGAIN)
+ exit(EXIT_FAILURE);
+ errno = savedErrno;
+ return ret;
}
-static void hakurei_shim_sigaction(int sig, siginfo_t *si, void *ucontext) {
- if (sig != SIGCONT || si == NULL) {
- hakurei_shim_write(HAKUREI_SHIM_INVALID);
- return;
- }
+static void hakurei_shim_sigaction(int sig, siginfo_t *si, void *ucontext)
+{
+ if (sig != SIGCONT || si == NULL) {
+ hakurei_shim_write(HAKUREI_SHIM_INVALID);
+ return;
+ }
- if (si->si_pid == hakurei_shim_param_ppid) {
- hakurei_shim_write(HAKUREI_SHIM_EXIT_REQUESTED);
- return;
- }
+ if (si->si_pid == hakurei_shim_param_ppid) {
+ hakurei_shim_write(HAKUREI_SHIM_EXIT_REQUESTED);
+ return;
+ }
- hakurei_shim_write(HAKUREI_SHIM_BAD_PID);
+ hakurei_shim_write(HAKUREI_SHIM_BAD_PID);
- if (getppid() != hakurei_shim_param_ppid)
- hakurei_shim_write(HAKUREI_SHIM_ORPHAN);
+ if (getppid() != hakurei_shim_param_ppid)
+ hakurei_shim_write(HAKUREI_SHIM_ORPHAN);
}
-void hakurei_shim_setup_cont_signal(pid_t ppid, int fd) {
- if (hakurei_shim_param_ppid != -1 || hakurei_shim_fd != -1)
- *(volatile int *)NULL = 0; /* unreachable */
+void hakurei_shim_setup_cont_signal(pid_t ppid, int fd)
+{
+ if (hakurei_shim_param_ppid != -1 || hakurei_shim_fd != -1)
+ *(volatile int *)NULL = 0; /* unreachable */
- struct sigaction new_action = {0}, old_action = {0};
- if (sigaction(SIGCONT, NULL, &old_action) != 0)
- return;
- if (old_action.sa_handler != SIG_DFL) {
- errno = ENOTRECOVERABLE;
- return;
- }
+ struct sigaction new_action = { 0 }, old_action = { 0 };
+ if (sigaction(SIGCONT, NULL, &old_action) != 0)
+ return;
+ if (old_action.sa_handler != SIG_DFL) {
+ errno = ENOTRECOVERABLE;
+ return;
+ }
- new_action.sa_sigaction = hakurei_shim_sigaction;
- if (sigemptyset(&new_action.sa_mask) != 0)
- return;
- new_action.sa_flags = SA_ONSTACK | SA_SIGINFO;
+ new_action.sa_sigaction = hakurei_shim_sigaction;
+ if (sigemptyset(&new_action.sa_mask) != 0)
+ return;
+ new_action.sa_flags = SA_ONSTACK | SA_SIGINFO;
- if (sigaction(SIGCONT, &new_action, NULL) != 0)
- return;
+ if (sigaction(SIGCONT, &new_action, NULL) != 0)
+ return;
- errno = 0;
- hakurei_shim_param_ppid = ppid;
- hakurei_shim_fd = fd;
+ errno = 0;
+ hakurei_shim_param_ppid = ppid;
+ hakurei_shim_fd = fd;
}
diff --git a/internal/outcome/shim-signal.h b/internal/outcome/shim-signal.h
index f396a915..db43b561 100644
--- a/internal/outcome/shim-signal.h
+++ b/internal/outcome/shim-signal.h
@@ -2,10 +2,10 @@
/* see shim.go for documentation */
typedef enum {
- HAKUREI_SHIM_EXIT_REQUESTED,
- HAKUREI_SHIM_ORPHAN,
- HAKUREI_SHIM_INVALID,
- HAKUREI_SHIM_BAD_PID,
+ HAKUREI_SHIM_EXIT_REQUESTED,
+ HAKUREI_SHIM_ORPHAN,
+ HAKUREI_SHIM_INVALID,
+ HAKUREI_SHIM_BAD_PID,
} hakurei_shim_msg;
void hakurei_shim_setup_cont_signal(pid_t ppid, int fd);
diff --git a/internal/outcome/shim.go b/internal/outcome/shim.go
index 6e039b65..2e7b0910 100644
--- a/internal/outcome/shim.go
+++ b/internal/outcome/shim.go
@@ -72,6 +72,12 @@ type shimParams struct {
// Limits are enforced on the priv side.
WaitDelay time.Duration
+ // Duration to wait after the initial process terminates before all
+ // lingering processes are killed.
+ //
+ // Limits are enforced on the priv side.
+ AdoptWaitDelay time.Duration
+
// Verbosity pass through from [message.Msg].
Verbose bool
@@ -286,6 +292,7 @@ func shimEntrypoint(k syscallDispatcher) {
// bounds and default enforced in finalise.go
z.WaitDelay = state.Shim.WaitDelay
+ z.AdoptWaitDelay = state.Shim.AdoptWaitDelay
if stateParams.pipewirePulsePath != nil {
zpw := container.NewCommand(ctx, msg, stateParams.pipewirePulsePath, pipewirePulseName)
diff --git a/internal/outcome/spcontainer.go b/internal/outcome/spcontainer.go
index bfa5dbdc..4ba3bb2d 100644
--- a/internal/outcome/spcontainer.go
+++ b/internal/outcome/spcontainer.go
@@ -39,7 +39,7 @@ type spParamsOp struct {
func (s *spParamsOp) toSystem(state *outcomeStateSys) error {
s.Term, s.TermSet = state.k.lookupEnv("TERM")
- state.sys.Ensure(state.sc.SharePath, 0711)
+ state.sys.Ensure(state.sc.SharePath, 0711, false)
return nil
}
@@ -351,20 +351,20 @@ func flattenExtraPerms(sys *system.I, extraPerms []hst.ExtraPermConfig) {
}
if p.Ensure {
- sys.Ensure(p.Path, 0700)
+ sys.Ensure(p.Path, 0700, true)
}
- perms := make(acl.Perms, 0, 3)
+ var perms acl.Perm
if p.Read {
- perms = append(perms, acl.Read)
+ perms |= acl.Read
}
if p.Write {
- perms = append(perms, acl.Write)
+ perms |= acl.Write
}
if p.Execute {
- perms = append(perms, acl.Execute)
+ perms |= acl.Execute
}
- sys.UpdatePermType(system.User, p.Path, perms...)
+ sys.UpdatePermType(system.User, p.Path, perms)
}
}
diff --git a/internal/outcome/spcontainer_test.go b/internal/outcome/spcontainer_test.go
index 7dd47735..54c276f9 100644
--- a/internal/outcome/spcontainer_test.go
+++ b/internal/outcome/spcontainer_test.go
@@ -36,7 +36,7 @@ func TestSpParamsOp(t *testing.T) {
}, nil, []stub.Call{
call("lookupEnv", stub.ExpectArgs{"TERM"}, "xterm", nil),
}, newI().
- Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711), nil, nil, nil, []stub.Call{
+ Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711, false), nil, nil, nil, []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, nil, nil, &hst.AppError{
Step: "finalise",
@@ -57,7 +57,7 @@ func TestSpParamsOp(t *testing.T) {
}, nil, []stub.Call{
call("lookupEnv", stub.ExpectArgs{"TERM"}, "xterm", nil),
}, newI().
- Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711), nil, nil, nil, []stub.Call{
+ Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711, false), nil, nil, nil, []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Hostname: config.Container.Hostname,
@@ -94,7 +94,7 @@ func TestSpParamsOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
call("lookupEnv", stub.ExpectArgs{"TERM"}, "xterm", nil),
}, newI().
- Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711), nil, nil, nil, []stub.Call{
+ Ensure(m(container.Nonexistent+"/tmp/hakurei.0"), 0711, false), nil, nil, nil, []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Hostname: config.Container.Hostname,
@@ -309,11 +309,11 @@ func TestSpFilesystemOp(t *testing.T) {
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium"}, nePrefix+"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium", nil),
call("verbosef", stub.ExpectArgs{"hiding path %q from %q", []any{"/proc/nonexistent/eval/etc/dbus", "/etc/"}}, nil, nil),
}, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
- acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
+ acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
state.filesystem = append(configSmall.Container.Filesystem, hst.FilesystemConfigJSON{})
})), []stub.Call{
// this op configures the container state and does not make calls during toContainer
@@ -342,11 +342,11 @@ func TestSpFilesystemOp(t *testing.T) {
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium"}, nePrefix+"/var/lib/hakurei/base/org.nixos/org.chromium.Chromium", nil),
call("verbosef", stub.ExpectArgs{"hiding path %q from %q", []any{"/proc/nonexistent/eval/etc/dbus", "/etc/"}}, nil, nil),
}, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
- acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
+ acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
state.filesystem = configSmall.Container.Filesystem
})), []stub.Call{
// this op configures the container state and does not make calls during toContainer
@@ -397,11 +397,11 @@ func TestSpFilesystemOp(t *testing.T) {
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.debian/usr"}, nePrefix+"/var/lib/hakurei/base/org.debian/usr", nil),
call("evalSymlinks", stub.ExpectArgs{"/var/lib/hakurei/base/org.debian/var"}, nePrefix+"/var/lib/hakurei/base/org.debian/var", nil),
}, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
- acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
+ acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(needsApplyState(func(state *outcomeStateParams) {
state.filesystem = config.Container.Filesystem[1:]
})), []stub.Call{
// this op configures the container state and does not make calls during toContainer
@@ -441,18 +441,18 @@ func TestFlattenExtraPerms(t *testing.T) {
want *system.I
}{
{"path nil check", append(hst.Template().ExtraPerms, hst.ExtraPermConfig{}), newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
- acl.Read, acl.Write, acl.Execute)},
+ acl.Read|acl.Write|acl.Execute)},
{"template", hst.Template().ExtraPerms, newI().
- Ensure(m("/var/lib/hakurei/u0"), 0700).
+ Ensure(m("/var/lib/hakurei/u0"), 0700, true).
UpdatePermType(system.User, m("/var/lib/hakurei/u0"),
acl.Execute).
UpdatePermType(system.User, m("/var/lib/hakurei/u0/org.chromium.Chromium"),
- acl.Read, acl.Write, acl.Execute)},
+ acl.Read|acl.Write|acl.Execute)},
}
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
diff --git a/internal/outcome/spdbus.go b/internal/outcome/spdbus.go
index a50f9cd2..c45dde6c 100644
--- a/internal/outcome/spdbus.go
+++ b/internal/outcome/spdbus.go
@@ -38,10 +38,10 @@ func (s *spDBusOp) toSystem(state *outcomeStateSys) error {
return err
}
- state.sys.UpdatePerm(sessionPath, acl.Read, acl.Write)
+ state.sys.UpdatePerm(sessionPath, acl.Read|acl.Write)
if state.systemBus != nil {
s.ProxySystem = true
- state.sys.UpdatePerm(systemPath, acl.Read, acl.Write)
+ state.sys.UpdatePerm(systemPath, acl.Read|acl.Write)
}
return nil
}
diff --git a/internal/outcome/spdbus_test.go b/internal/outcome/spdbus_test.go
index 6f357193..3b9f07f7 100644
--- a/internal/outcome/spdbus_test.go
+++ b/internal/outcome/spdbus_test.go
@@ -80,8 +80,8 @@ func TestSpDBusOp(t *testing.T) {
"--broadcast=org.freedesktop.portal.*=@/org/freedesktop/portal/*",
)}}, nil, nil),
}, func() *system.I {
- sys := system.New(panicMsgContext{}, message.New(nil), checkExpectUid)
- sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711)
+ sys := system.New(panicMsgContext{}, message.New(nil), checkExpectUid, nil)
+ sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711, false)
if err := sys.ProxyDBus(
dbus.NewConfig(config.ID, true, true), nil,
dbus.ProxyPair{"unix:path=/run/user/1000/bus", wantInstancePrefix + "/bus"},
@@ -89,7 +89,7 @@ func TestSpDBusOp(t *testing.T) {
); err != nil {
t.Fatalf("cannot prepare sys: %v", err)
}
- sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read, acl.Write)
+ sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read|acl.Write)
return sys
}(), sysUsesInstance(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
// this op configures the container state and does not make calls during toContainer
@@ -162,8 +162,8 @@ func TestSpDBusOp(t *testing.T) {
"--talk=org.freedesktop.UPower",
)}}, nil, nil),
}, func() *system.I {
- sys := system.New(panicMsgContext{}, message.New(nil), checkExpectUid)
- sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711)
+ sys := system.New(panicMsgContext{}, message.New(nil), checkExpectUid, nil)
+ sys.Ephemeral(system.Process, m(wantInstancePrefix), 0711, false)
if err := sys.ProxyDBus(
config.SessionBus, config.SystemBus,
dbus.ProxyPair{"unix:path=/run/user/1000/bus", wantInstancePrefix + "/bus"},
@@ -171,8 +171,8 @@ func TestSpDBusOp(t *testing.T) {
); err != nil {
t.Fatalf("cannot prepare sys: %v", err)
}
- sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read, acl.Write).
- UpdatePerm(m(wantInstancePrefix+"/system_bus_socket"), acl.Read, acl.Write)
+ sys.UpdatePerm(m(wantInstancePrefix+"/bus"), acl.Read|acl.Write).
+ UpdatePerm(m(wantInstancePrefix+"/system_bus_socket"), acl.Read|acl.Write)
return sys
}(), sysUsesInstance(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
// this op configures the container state and does not make calls during toContainer
diff --git a/internal/outcome/sppipewire_test.go b/internal/outcome/sppipewire_test.go
index 1e3dab6a..804404dc 100644
--- a/internal/outcome/sppipewire_test.go
+++ b/internal/outcome/sppipewire_test.go
@@ -31,7 +31,7 @@ func TestSpPipeWireOp(t *testing.T) {
return c
}, nil, []stub.Call{}, newI().
// state.instance
- Ephemeral(system.Process, m(wantInstancePrefix), 0711).
+ Ephemeral(system.Process, m(wantInstancePrefix), 0711, false).
// toSystem
PipeWire(
m(wantInstancePrefix+"/pipewire"),
diff --git a/internal/outcome/sppulse_test.go b/internal/outcome/sppulse_test.go
index a1ff0d03..a9995562 100644
--- a/internal/outcome/sppulse_test.go
+++ b/internal/outcome/sppulse_test.go
@@ -143,12 +143,12 @@ func TestSpPulseOp(t *testing.T) {
call("open", stub.ExpectArgs{"/proc/nonexistent/cookie"}, &stubOsFile{Reader: bytes.NewReader(sampleCookie)}, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
@@ -175,12 +175,12 @@ func TestSpPulseOp(t *testing.T) {
call("open", stub.ExpectArgs{"/proc/nonexistent/cookie"}, &stubOsFile{Reader: bytes.NewReader(sampleCookie[:len(sampleCookie)-0xe])}, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
@@ -208,12 +208,12 @@ func TestSpPulseOp(t *testing.T) {
call("open", stub.ExpectArgs{"/proc/nonexistent/cookie"}, &stubOsFile{Reader: bytes.NewReader(sampleCookie)}, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
@@ -238,12 +238,12 @@ func TestSpPulseOp(t *testing.T) {
call("verbose", stub.ExpectArgs{[]any{"cannot locate PulseAudio cookie (tried $PULSE_COOKIE, $XDG_CONFIG_HOME/pulse/cookie, $HOME/.pulse-cookie)"}}, nil, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// state.runtime
- Ephemeral(system.Process, m(wantRuntimeSharePath), 0700).
+ Ephemeral(system.Process, m(wantRuntimeSharePath), 0700, true).
UpdatePerm(m(wantRuntimeSharePath), acl.Execute).
// toSystem
Link(m(wantRuntimePath+"/pulse/native"), m(wantRuntimeSharePath+"/pulse")), sysUsesRuntime(nil), nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
diff --git a/internal/outcome/spruntime.go b/internal/outcome/spruntime.go
index c08bfe81..b8121bfa 100644
--- a/internal/outcome/spruntime.go
+++ b/internal/outcome/spruntime.go
@@ -76,10 +76,9 @@ type spRuntimeOp struct {
func (s *spRuntimeOp) toSystem(state *outcomeStateSys) error {
if state.Container.Flags&hst.FShareRuntime != 0 {
runtimeDir, runtimeDirInst := s.commonPaths(state.outcomeState)
- state.sys.Ensure(runtimeDir, 0700)
- state.sys.UpdatePermType(system.User, runtimeDir, acl.Execute)
- state.sys.Ensure(runtimeDirInst, 0700)
- state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read, acl.Write, acl.Execute)
+ state.sys.Ensure(runtimeDir, 0711, false)
+ state.sys.Ensure(runtimeDirInst, 0700, true)
+ state.sys.UpdatePermType(system.User, runtimeDirInst, acl.Read|acl.Write|acl.Execute)
}
if state.et&hst.EWayland != 0 {
diff --git a/internal/outcome/spruntime_test.go b/internal/outcome/spruntime_test.go
index 25f2684c..c549c857 100644
--- a/internal/outcome/spruntime_test.go
+++ b/internal/outcome/spruntime_test.go
@@ -33,10 +33,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
+ UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Ops: new(container.Ops).
@@ -61,10 +60,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
+ UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Ops: new(container.Ops).
@@ -89,10 +87,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
+ UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Ops: new(container.Ops).
@@ -113,10 +110,9 @@ func TestSpRuntimeOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime"), 0711, false).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), 0700, true).
+ UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/runtime/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Ops: new(container.Ops).
diff --git a/internal/outcome/sptmpdir.go b/internal/outcome/sptmpdir.go
index daa6f0de..c0c8db7b 100644
--- a/internal/outcome/sptmpdir.go
+++ b/internal/outcome/sptmpdir.go
@@ -19,10 +19,9 @@ type spTmpdirOp struct{}
func (s spTmpdirOp) toSystem(state *outcomeStateSys) error {
if state.Container.Flags&hst.FShareTmpdir != 0 {
tmpdir, tmpdirInst := s.commonPaths(state.outcomeState)
- state.sys.Ensure(tmpdir, 0700)
- state.sys.UpdatePermType(system.User, tmpdir, acl.Execute)
- state.sys.Ensure(tmpdirInst, 01700)
- state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read, acl.Write, acl.Execute)
+ state.sys.Ensure(tmpdir, 0711, false)
+ state.sys.Ensure(tmpdirInst, 01700, true)
+ state.sys.UpdatePermType(system.User, tmpdirInst, acl.Read|acl.Write|acl.Execute)
}
return nil
}
diff --git a/internal/outcome/sptmpdir_test.go b/internal/outcome/sptmpdir_test.go
index 620f51b0..74aceeee 100644
--- a/internal/outcome/sptmpdir_test.go
+++ b/internal/outcome/sptmpdir_test.go
@@ -21,10 +21,9 @@ func TestSpTmpdirOp(t *testing.T) {
}, hst.Template, nil, []stub.Call{
// this op configures the system state and does not make calls during toSystem
}, newI().
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), 0700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), acl.Execute).
- Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), 01700).
- UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir"), 0711, false).
+ Ensure(m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), 01700, true).
+ UpdatePermType(system.User, m("/proc/nonexistent/tmp/hakurei.0/tmpdir/9"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Ops: new(container.Ops).
diff --git a/internal/outcome/spwayland.go b/internal/outcome/spwayland.go
index 3c60ff10..db79d1d2 100644
--- a/internal/outcome/spwayland.go
+++ b/internal/outcome/spwayland.go
@@ -49,7 +49,7 @@ func (s *spWaylandOp) toSystem(state *outcomeStateSys) error {
state.msg.Verbose("direct wayland access, PROCEED WITH CAUTION")
state.ensureRuntimeDir()
s.SocketPath = socketPath
- state.sys.UpdatePermType(hst.EWayland, socketPath, acl.Read, acl.Write, acl.Execute)
+ state.sys.UpdatePermType(hst.EWayland, socketPath, acl.Read|acl.Write|acl.Execute)
}
return nil
}
diff --git a/internal/outcome/spwayland_test.go b/internal/outcome/spwayland_test.go
index 7cc4ba84..eea23136 100644
--- a/internal/outcome/spwayland_test.go
+++ b/internal/outcome/spwayland_test.go
@@ -34,7 +34,7 @@ func TestSpWaylandOp(t *testing.T) {
call("lookupEnv", stub.ExpectArgs{"WAYLAND_DISPLAY"}, "wayland-1", nil),
}, newI().
// state.instance
- Ephemeral(system.Process, m(wantInstancePrefix), 0711).
+ Ephemeral(system.Process, m(wantInstancePrefix), 0711, false).
// toSystem
Wayland(
m(wantInstancePrefix+"/wayland"),
@@ -64,12 +64,12 @@ func TestSpWaylandOp(t *testing.T) {
call("verbose", stub.ExpectArgs{[]any{"direct wayland access, PROCEED WITH CAUTION"}}, nil, nil),
}, newI().
// state.ensureRuntimeDir
- Ensure(m(wantRuntimePath), 0700).
+ Ensure(m(wantRuntimePath), 0700, true).
UpdatePermType(system.User, m(wantRuntimePath), acl.Execute).
- Ensure(m(wantRunDirPath), 0700).
+ Ensure(m(wantRunDirPath), 0700, true).
UpdatePermType(system.User, m(wantRunDirPath), acl.Execute).
// toSystem
- UpdatePermType(hst.EWayland, m("/proc/nonexistent/wayland"), acl.Read, acl.Write, acl.Execute), nil, nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
+ UpdatePermType(hst.EWayland, m("/proc/nonexistent/wayland"), acl.Read|acl.Write|acl.Execute), nil, nil, insertsOps(afterSpRuntimeOp(nil)), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
Ops: new(container.Ops).
@@ -85,7 +85,7 @@ func TestSpWaylandOp(t *testing.T) {
call("verbose", stub.ExpectArgs{[]any{"WAYLAND_DISPLAY is not set, assuming wayland-0"}}, nil, nil),
}, newI().
// state.instance
- Ephemeral(system.Process, m(wantInstancePrefix), 0711).
+ Ephemeral(system.Process, m(wantInstancePrefix), 0711, false).
// toSystem
Wayland(
m(wantInstancePrefix+"/wayland"),
diff --git a/internal/outcome/spx11.go b/internal/outcome/spx11.go
index c71ff530..ebd5c77e 100644
--- a/internal/outcome/spx11.go
+++ b/internal/outcome/spx11.go
@@ -56,7 +56,7 @@ func (s *spX11Op) toSystem(state *outcomeStateSys) error {
), Err: err}
}
} else {
- state.sys.UpdatePermType(hst.EX11, socketPath, acl.Read, acl.Write, acl.Execute)
+ state.sys.UpdatePermType(hst.EX11, socketPath, acl.Read|acl.Write|acl.Execute)
if state.Container.Flags&hst.FHostAbstract == 0 {
s.Display = "unix:" + socketPath.String()
}
diff --git a/internal/outcome/spx11_test.go b/internal/outcome/spx11_test.go
index 0ede2d65..d183f798 100644
--- a/internal/outcome/spx11_test.go
+++ b/internal/outcome/spx11_test.go
@@ -83,7 +83,7 @@ func TestSpX11Op(t *testing.T) {
call("lookupEnv", stub.ExpectArgs{"DISPLAY"}, "unix:/tmp/.X11-unix/X0", nil),
call("stat", stub.ExpectArgs{"/tmp/.X11-unix/X0"}, (*stubFi)(nil), nil),
}, newI().
- UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read, acl.Write, acl.Execute).
+ UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read|acl.Write|acl.Execute).
ChangeHosts("#10009"), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
@@ -106,7 +106,7 @@ func TestSpX11Op(t *testing.T) {
call("lookupEnv", stub.ExpectArgs{"DISPLAY"}, ":0", nil),
call("stat", stub.ExpectArgs{"/tmp/.X11-unix/X0"}, (*stubFi)(nil), nil),
}, newI().
- UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read, acl.Write, acl.Execute).
+ UpdatePermType(hst.EX11, m("/tmp/.X11-unix/X0"), acl.Read|acl.Write|acl.Execute).
ChangeHosts("#10009"), nil, nil, insertsOps(nil), []stub.Call{
// this op configures the container state and does not make calls during toContainer
}, &container.Params{
generated by cgit v1.3.1 (git 2.54.0) at 2026-10-24 21:55:14 +0000