aboutsummaryrefslogtreecommitdiffhomepage
AgeCommit message (Collapse)Author
2025-03-14sandbox: separate bind mount function from opOphestra
This is useful in the implementation of various other ops. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13internal/app: rename init to init0Ophestra
This makes way for the new container init. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: native container toolingOphestra
This should eventually replace bwrap. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13test: run go test under regular userOphestra
By default test vm commands run as root, this causes buildFHSEnv bwrap to cover some parts of /proc, making it impossible to mount proc in a mount namespace created under it. Running as a regular user gets around this issue. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13test: print output of failed testOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13internal: pull EINTR loop from stdlibOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: read overflow idsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13test/sandbox: bypass fieldsOphestra
A field is bypassed if it contains a single null byte. This will never appear in the text format so is safe to use. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-12ldd: handle musl static behaviourOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-12helper/seccomp: improve error handlingOphestra
This passes both errno and libseccomp return value. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-12helper/seccomp: seccomp_load on negative fdOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-12test/sandbox/mount: work around nondeterminismOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-10nix: update flake lockOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-09helper/proc: expose setup fileOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-07internal/prctl: rename prctl wrappersOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-04test/sandbox: check seccomp outcomeOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-03test/sandbox: check fs outcomeOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-02test/sandbox: assert filesystem jsonOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-02test/sandbox: compare filesystem hierarchyOphestra
For checking deterministic aspects of fs outcome. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-02test: rename session message identifierOphestra
Labelling this as sway is misleading. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-02test/sandbox/assert: wrap printfOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-28test/sandbox: check mount outcomeOphestra
Do this at the beginning of the test for early failure. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-28test/sandbox: assert mntent jsonOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-28test/sandbox: wrap libc getmntentOphestra
For checking mounts outcome. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-28nix: increase nixfmt max widthOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26app: print comp values earlyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fpkg: call app in-processOphestra
Wrapping fortify is slow, painful and error-prone. Start apps in-process instead. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fsu: allow switch from fpkgOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26fortify: move internal commands upOphestra
This improves readability. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26app: handle RunState errorsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26fortify: configure seccomp logger earlyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26app: define errors in a separate fileOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26test: verify fsu ppid checkOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26test: remove sway process checkOphestra
This eliminates the race where systemd restarts sway too quick. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fpkg/test: nixos test fpkg install/startOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fpkg/build: expose nixos configurationOphestra
This should be used sparingly as the NixOS closure is in the bootstrap store which compresses rather poorly. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26nix: wrap fpkgOphestra
This is usable on nixos now due to the static build. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fpkg: use fortify path from internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26internal: store fortify path in internalOphestra
This now makes more sense due to the changes in build system. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25cmd/fpkg/build: run final build step in nixOphestra
This used to be a script that had to be run outside of nix because the sandbox disallows access to nix store state. Turns out closureInfo is the proper way to do that. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25nix: interrupt via ttyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25dbus: set process group idOphestra
This stops signals sent by the TTY driver from propagating to the xdg-dbus-proxy process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25nix: include fsu sources in dist buildOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25nix: verify silent signal exitOphestra
This catches errors in the cleanup process initiated by a signal. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25system/acl: do not fail gone revert targetOphestra
A removed file effectively already has its ACLs stripped, so failing this makes no sense. Still print a message to warn about it. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25system/dbus: filter context cancellation errorOphestra
This message would otherwise show up when alternative exit path is taken due to a signal. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25fortify: improve handling of RevertErrOphestra
All this error wrapping is getting a bit ridiculous and I might want to do something about that somewhere down the line. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-24nix: exclude files ending in ".py"Ophestra
This reduces rebuilds when debugging nixos tests. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23cmd/fpkg: integrate command handlerOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-23cmd/fpkg/build: prepend extra nix flagsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>