| Age | Commit message (Collapse) | Author |
|---|
|
This limits potential exploits to the fortify uid range.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
No clean way to write Go tests for this package. Will rely on NixOS tests for now.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Also invoke glinfo/wayland-info as part of tests.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Integration tests are implemented as nix flake checks.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Adapted from nixos sway integration tests.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
The nix build environment does not support ACLs.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Move all C code to c.go, switch to pkg-config, set up finalizer for acl.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
These tests test UpdatePerm correctness by parsing getfacl output.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
There seems to be some kind of credential caching in nix-daemon.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Wayland is implemented as an Op to enforce dependency and cleanup, its implementation does not allow multiple instances on a single sys object, nor would doing that make any sense.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
A lot of this information is no longer true since fsu. Remove them for now and write up proper documentation later.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Should be able to get rid of XDG_RUNTIME_DIR share after this.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This is required by wayland security-context-v1.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Had to pass the sync fd through sys. The rest are just part of a standard Op.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This value is no longer specific to D-Bus defaults.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Reduce rebuilds during development on my system.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Useful for shells and terminal programs like chat clients.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This value is used for passwd generation. Bad input can cause very confusing issues. This is not a security issue, however validation will improve user experience.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Getting killed at this point will result in inconsistent state.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
When starting with the permissive defaults "run" command, attempt to resolve home directory from os by default and fall back to /var/empty.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This avoids renaming the fortify binary.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Support binding home to an alternative path in the mount namespace.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Adding after channel write is racy.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Dirty fix. Will rewrite after fsu integration complete.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This provides user records via nss-systemd. Static drop-in entries are generated to reduce complexity and attack surface.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Despite presenting itself as a generic desktop integration interface, xdg-desktop portal is highly flatpak-centric and only supports flatpak and snap in practice. It is a significant attack surface to begin with as it is a privileged process which accepts input from unprivileged processes, and the lack of support for anything other than fortify also introduces various information leaks when exposed to fortify as it treats fortified programs as unsandboxed, privileged programs in many cases.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This option only changes mapped uid in the user namespace.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
