aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal
diff options
context:
space:
mode:
Diffstat (limited to 'internal')
-rw-r--r--internal/app/app_pd_test.go74
-rw-r--r--internal/app/app_stub_test.go9
-rw-r--r--internal/app/app_test.go13
-rw-r--r--internal/app/seal.go19
-rw-r--r--internal/linux/interface.go5
-rw-r--r--internal/linux/std.go4
6 files changed, 26 insertions, 98 deletions
diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go
index f025b44d..968a11ab 100644
--- a/internal/app/app_pd_test.go
+++ b/internal/app/app_pd_test.go
@@ -62,45 +62,14 @@ var testCasesPd = []sealTestCase{
Bind("/lib64", "/lib64", false, true).
Bind("/nix", "/nix", false, true).
Bind("/root", "/root", false, true).
+ Bind("/run", "/run", false, true).
Bind("/srv", "/srv", false, true).
Bind("/sys", "/sys", false, true).
Bind("/usr", "/usr", false, true).
Bind("/var", "/var", false, true).
- Bind("/run/agetty.reload", "/run/agetty.reload", false, true).
- Bind("/run/binfmt", "/run/binfmt", false, true).
- Bind("/run/booted-system", "/run/booted-system", false, true).
- Bind("/run/credentials", "/run/credentials", false, true).
- Bind("/run/cryptsetup", "/run/cryptsetup", false, true).
- Bind("/run/current-system", "/run/current-system", false, true).
- Bind("/run/host", "/run/host", false, true).
- Bind("/run/keys", "/run/keys", false, true).
- Bind("/run/libvirt", "/run/libvirt", false, true).
- Bind("/run/libvirtd.pid", "/run/libvirtd.pid", false, true).
- Bind("/run/lock", "/run/lock", false, true).
- Bind("/run/log", "/run/log", false, true).
- Bind("/run/lvm", "/run/lvm", false, true).
- Bind("/run/mount", "/run/mount", false, true).
- Bind("/run/NetworkManager", "/run/NetworkManager", false, true).
- Bind("/run/nginx", "/run/nginx", false, true).
- Bind("/run/nixos", "/run/nixos", false, true).
- Bind("/run/nscd", "/run/nscd", false, true).
- Bind("/run/opengl-driver", "/run/opengl-driver", false, true).
- Bind("/run/pppd", "/run/pppd", false, true).
- Bind("/run/resolvconf", "/run/resolvconf", false, true).
- Bind("/run/sddm", "/run/sddm", false, true).
- Bind("/run/store", "/run/store", false, true).
- Bind("/run/syncoid", "/run/syncoid", false, true).
- Bind("/run/system", "/run/system", false, true).
- Bind("/run/systemd", "/run/systemd", false, true).
- Bind("/run/tmpfiles.d", "/run/tmpfiles.d", false, true).
- Bind("/run/udev", "/run/udev", false, true).
- Bind("/run/udisks2", "/run/udisks2", false, true).
- Bind("/run/utmp", "/run/utmp", false, true).
- Bind("/run/virtlogd.pid", "/run/virtlogd.pid", false, true).
- Bind("/run/wrappers", "/run/wrappers", false, true).
- Bind("/run/zed.pid", "/run/zed.pid", false, true).
- Bind("/run/zed.state", "/run/zed.state", false, true).
Bind("/dev/kvm", "/dev/kvm", true, true, true).
+ Tmpfs("/run/user/1971", 8192).
+ Tmpfs("/run/dbus", 8192).
Bind("/etc", fst.Tmp+"/etc").
Symlink(fst.Tmp+"/etc/alsa", "/etc/alsa").
Symlink(fst.Tmp+"/etc/bashrc", "/etc/bashrc").
@@ -317,46 +286,15 @@ var testCasesPd = []sealTestCase{
Bind("/lib64", "/lib64", false, true).
Bind("/nix", "/nix", false, true).
Bind("/root", "/root", false, true).
+ Bind("/run", "/run", false, true).
Bind("/srv", "/srv", false, true).
Bind("/sys", "/sys", false, true).
Bind("/usr", "/usr", false, true).
Bind("/var", "/var", false, true).
- Bind("/run/agetty.reload", "/run/agetty.reload", false, true).
- Bind("/run/binfmt", "/run/binfmt", false, true).
- Bind("/run/booted-system", "/run/booted-system", false, true).
- Bind("/run/credentials", "/run/credentials", false, true).
- Bind("/run/cryptsetup", "/run/cryptsetup", false, true).
- Bind("/run/current-system", "/run/current-system", false, true).
- Bind("/run/host", "/run/host", false, true).
- Bind("/run/keys", "/run/keys", false, true).
- Bind("/run/libvirt", "/run/libvirt", false, true).
- Bind("/run/libvirtd.pid", "/run/libvirtd.pid", false, true).
- Bind("/run/lock", "/run/lock", false, true).
- Bind("/run/log", "/run/log", false, true).
- Bind("/run/lvm", "/run/lvm", false, true).
- Bind("/run/mount", "/run/mount", false, true).
- Bind("/run/NetworkManager", "/run/NetworkManager", false, true).
- Bind("/run/nginx", "/run/nginx", false, true).
- Bind("/run/nixos", "/run/nixos", false, true).
- Bind("/run/nscd", "/run/nscd", false, true).
- Bind("/run/opengl-driver", "/run/opengl-driver", false, true).
- Bind("/run/pppd", "/run/pppd", false, true).
- Bind("/run/resolvconf", "/run/resolvconf", false, true).
- Bind("/run/sddm", "/run/sddm", false, true).
- Bind("/run/store", "/run/store", false, true).
- Bind("/run/syncoid", "/run/syncoid", false, true).
- Bind("/run/system", "/run/system", false, true).
- Bind("/run/systemd", "/run/systemd", false, true).
- Bind("/run/tmpfiles.d", "/run/tmpfiles.d", false, true).
- Bind("/run/udev", "/run/udev", false, true).
- Bind("/run/udisks2", "/run/udisks2", false, true).
- Bind("/run/utmp", "/run/utmp", false, true).
- Bind("/run/virtlogd.pid", "/run/virtlogd.pid", false, true).
- Bind("/run/wrappers", "/run/wrappers", false, true).
- Bind("/run/zed.pid", "/run/zed.pid", false, true).
- Bind("/run/zed.state", "/run/zed.state", false, true).
Bind("/dev/dri", "/dev/dri", true, true, true).
Bind("/dev/kvm", "/dev/kvm", true, true, true).
+ Tmpfs("/run/user/1971", 8192).
+ Tmpfs("/run/dbus", 8192).
Bind("/etc", fst.Tmp+"/etc").
Symlink(fst.Tmp+"/etc/alsa", "/etc/alsa").
Symlink(fst.Tmp+"/etc/bashrc", "/etc/bashrc").
diff --git a/internal/app/app_stub_test.go b/internal/app/app_stub_test.go
index 9ab09197..4d2e83e9 100644
--- a/internal/app/app_stub_test.go
+++ b/internal/app/app_stub_test.go
@@ -2,7 +2,6 @@ package app_test
import (
"fmt"
- "io"
"io/fs"
"os/user"
"strconv"
@@ -128,12 +127,12 @@ func (s *stubNixOS) Open(name string) (fs.File, error) {
}
}
-func (s *stubNixOS) Exit(code int) {
- panic("called exit on stub with code " + strconv.Itoa(code))
+func (s *stubNixOS) EvalSymlinks(path string) (string, error) {
+ return path, nil
}
-func (s *stubNixOS) Stdout() io.Writer {
- panic("requested stdout")
+func (s *stubNixOS) Exit(code int) {
+ panic("called exit on stub with code " + strconv.Itoa(code))
}
func (s *stubNixOS) Paths() linux.Paths {
diff --git a/internal/app/app_test.go b/internal/app/app_test.go
index a8fd761e..25691ffe 100644
--- a/internal/app/app_test.go
+++ b/internal/app/app_test.go
@@ -1,6 +1,7 @@
package app_test
import (
+ "encoding/json"
"io/fs"
"reflect"
"testing"
@@ -48,14 +49,22 @@ func TestApp(t *testing.T) {
t.Run("compare bwrap", func(t *testing.T) {
if !reflect.DeepEqual(gotBwrap, tc.wantBwrap) {
- t.Errorf("seal: bwrap = %#v, want %#v",
- gotBwrap, tc.wantBwrap)
+ t.Errorf("seal: bwrap =\n%s\n, want\n%s",
+ mustMarshal(gotBwrap), mustMarshal(tc.wantBwrap))
}
})
})
}
}
+func mustMarshal(v any) string {
+ if b, err := json.Marshal(v); err != nil {
+ panic(err.Error())
+ } else {
+ return string(b)
+ }
+}
+
func stubDirEntries(names ...string) (e []fs.DirEntry, err error) {
e = make([]fs.DirEntry, len(names))
for i, name := range names {
diff --git a/internal/app/seal.go b/internal/app/seal.go
index 27663771..a67feb45 100644
--- a/internal/app/seal.go
+++ b/internal/app/seal.go
@@ -194,7 +194,6 @@ func (a *app) Seal(config *fst.Config) error {
switch p {
case "/proc":
case "/dev":
- case "/run":
case "/tmp":
case "/mnt":
case "/etc":
@@ -205,23 +204,7 @@ func (a *app) Seal(config *fst.Config) error {
}
conf.Filesystem = append(conf.Filesystem, b...)
}
- // bind entries in /run
- if d, err := a.os.ReadDir("/run"); err != nil {
- return err
- } else {
- b := make([]*fst.FilesystemConfig, 0, len(d))
- for _, ent := range d {
- name := ent.Name()
- switch name {
- case "user":
- case "dbus":
- default:
- p := "/run/" + name
- b = append(b, &fst.FilesystemConfig{Src: p, Write: true, Must: true})
- }
- }
- conf.Filesystem = append(conf.Filesystem, b...)
- }
+
// hide nscd from sandbox if present
nscd := "/var/run/nscd"
if _, err := a.os.Stat(nscd); !errors.Is(err, fs.ErrNotExist) {
diff --git a/internal/linux/interface.go b/internal/linux/interface.go
index dd0782df..1bb87db9 100644
--- a/internal/linux/interface.go
+++ b/internal/linux/interface.go
@@ -1,7 +1,6 @@
package linux
import (
- "io"
"io/fs"
"os/user"
"path"
@@ -30,10 +29,10 @@ type System interface {
Stat(name string) (fs.FileInfo, error)
// Open provides [os.Open]
Open(name string) (fs.File, error)
+ // EvalSymlinks provides [filepath.EvalSymlinks]
+ EvalSymlinks(path string) (string, error)
// Exit provides [os.Exit].
Exit(code int)
- // Stdout provides [os.Stdout].
- Stdout() io.Writer
// Paths returns a populated [Paths] struct.
Paths() Paths
diff --git a/internal/linux/std.go b/internal/linux/std.go
index a82fff26..7c6b9279 100644
--- a/internal/linux/std.go
+++ b/internal/linux/std.go
@@ -2,11 +2,11 @@ package linux
import (
"errors"
- "io"
"io/fs"
"os"
"os/exec"
"os/user"
+ "path/filepath"
"strconv"
"sync"
"syscall"
@@ -37,8 +37,8 @@ func (s *Std) LookupGroup(name string) (*user.Group, error) { return user.Lookup
func (s *Std) ReadDir(name string) ([]os.DirEntry, error) { return os.ReadDir(name) }
func (s *Std) Stat(name string) (fs.FileInfo, error) { return os.Stat(name) }
func (s *Std) Open(name string) (fs.File, error) { return os.Open(name) }
+func (s *Std) EvalSymlinks(path string) (string, error) { return filepath.EvalSymlinks(path) }
func (s *Std) Exit(code int) { fmsg.Exit(code) }
-func (s *Std) Stdout() io.Writer { return os.Stdout }
const xdgRuntimeDir = "XDG_RUNTIME_DIR"
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-30 05:17:56 +0000