aboutsummaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2025-11-19workflows: do not duplicate on pullsOphestra
This condition causes two runs to be created on a pull, as gitea does not check whether a run has already been created for the current commit. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-19internal/wayland: clean up pathname socketOphestra
This is cleaner than cleaning up in internal/system as it covers the failure paths. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-17internal/wayland: do not double close fdOphestra
These are already closed during securityContextBindPipe on a non-nil error. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-17internal/wayland: expose WAYLAND_VERSIONOphestra
This might be useful troubleshooting information. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-16.clang-format: increase indent widthOphestra
This significantly increases readability. This patch is pretty big so it is being done after mostly everything has settled. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-16internal/wayland: check pathname sizeOphestra
This avoids passing a truncated pathname to the kernel. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-16internal/wayland: increase error detailOphestra
This includes targeted paths in the returned errors. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-16internal/wayland: remove fd typecastsOphestra
These are no longer necessary since RawConn is no longer used. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-16internal/wayland: reimplement connect/bind codeOphestra
The old implementation is relocated to system/wayland/deprecated.go. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-15internal/wayland: relocate connection structOphestra
This interface is getting replaced, so relocating it to the deprecated wrapper package before working on its replacement. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-15internal/wayland: improve error handlingOphestra
Note: wl_registry_add_listener is undocumented everywhere. Its implementation calls wl_proxy_add_listener which returns 0 on success or -1 on failure. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-15.clang-format: do not limit line lengthOphestra
This hard limit destroys readability in some places. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-15nix: build with clangOphestra
Clang is better than gcc in various ways. This also pulls in clang-format which is very helpful. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-15internal: relocate packagesOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14cmd/hakurei: reorder show entriesOphestra
This order semantically makes more sense and generally looks tidier. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14treewide: migrate ldd callersOphestra
This discontinues use of the deprecated ldd.Exec function for #25. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14ldd: require absolute pathnameOphestra
The sandbox which ldd(1) runs in does not inherit parent work directory, so relative pathnames will not work correctly. While it is trivial to support such a use case, the use of relative pathnames is highly error-prone and generally frowned against in this project. The Exec function remains available under the same signature until v0.4.0 where it will be removed. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14ldd: cancel on decoder errorOphestra
This prevents blocking from failures caused by ldd(1) emitting output that is not anticipated by the decoder. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14ldd: create musl entry representationOphestra
This mostly helps with debugging. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14ldd: check decoder scan guardOphestra
This was unreachable via the Parse wrapper. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14container: provide usage exampleOphestra
This requires cgo so unfortunately will not run in the playground. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14ldd: update package doc commentOphestra
This should hopefully deter misuse of this package. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14ldd: decode from readerOphestra
This should reduce memory footprint of the parsing process and allow decoding part of the stream. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14internal/outcome: rename run from mainOphestra
The "main.go" name is quite confusing as this is often only present in main packages. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-14container/fhs: add constant for /dev/shm/Ophestra
This is mounted for the default read-only /dev/ when programs want to use shm_open(3). Defining it here is less error-prone and saves the extra append at runtime. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-13internal/info: relocate from internalOphestra
This is cleaner and makes more sense. The longer LDFLAGS was never a valid concern since it is always inserted by a script. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-13treewide: document linkname usesOphestra
These provide justification for each use of linkname. Poorly thought out uses of linkname are removed. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-13treewide: import internal/systemOphestra
For #24. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-13internal/system: relocate from systemOphestra
These packages are highly specific to hakurei and are difficult to use safely from other pieces of code. Their exported symbols are made available until v0.4.0 where they will be removed for #24. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-12treewide: import internal/helperOphestra
For #24. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-12internal/helper: relocate from helperOphestra
This package is ugly and is pending removal only kept alive by xdg-dbus-proxy. Its exported symbols are made available until v0.4.0 where it will be removed for #24. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-12test: move package sandbox internalOphestra
This should never be used outside vm tests. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-12release: 0.3.1v0.3.1Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-12container: set FD_CLOEXEC on all open filesOphestra
While fd created from this side always has the FD_CLOEXEC flag, the same is not true for files left open by the parent. This change prevents those files from leaking into the container. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-11container/init: close setup pipe earlyOphestra
This prevents leaking the setup pipe. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-10container/init: close initial process files on terminationOphestra
This closes them during the adopt wait delay. This also keeps them alive. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-10treewide: reject impossible user-supplied fdOphestra
These are all trusted user input, however this check reduces the likelihood of hard to debug errors. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-10cmd/hakurei: expose current instance identifierOphestra
This writes the 16-byte instance identifier to file descriptor specified by --identifier-fd if set, and closes the file. This enables safely obtaining the new instance's identifier. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-09internal/outcome: handle group lookup messageOphestra
This results in slightly less messy error reporting. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-09nix: update names to reflect new terminologyOphestra
These are terminology from way early days. Update them now to be less confusing. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-07container/std/seccomp: remove ineffectual typecastOphestra
This is no longer necessary since the return type changed. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-07container/seccomp/presets: add fields to literalsOphestra
This keeps composites analysis happy. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-07std: separate seccomp constantsOphestra
This avoids inadvertently using PNRs as syscall numbers. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-06release: 0.3.0v0.3.0Ophestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-06container/std: syscall JSON adapterOphestra
This provides cross-platform JSON adapter for syscall number. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-05container: add 386 constantsOphestra
While it is unlikely a use case for hakurei on i686 exists, it does not hurt to have this support. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-05treewide: fit test untyped int literals in 32-bitOphestra
This enables hakurei test suite to run on 32-bit targets. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-05container/std: relocate rule typesOphestra
This enables its use in hst for #15. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-05container/seccomp: use native typesOphestra
This prepares NativeRule for relocation to std for #15. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-11-05container/seccomp: alias libseccomp typesOphestra
This enables tests to refer to these types and check its size. Signed-off-by: Ophestra <cat@gensokyo.uk>