aboutsummaryrefslogtreecommitdiffhomepage
path: root/cmd/fshim/main.go
AgeCommit message (Collapse)Author
2025-01-17proc/priv/shim: merge shim into main programOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-28cmd/fshim: ensure data directoryOphestra
Ensuring home directory in shim causes the directory to be owned by the target user. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-27cmd/fshim: bind finit inside sandboxOphestra
The outer finit executable is normally inaccessible inside the sandbox. This was obscured by the current Nix-based setup exposing /nix/store to the sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20migrate to git.gensokyo.uk/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18cmd/fshim: switch to setup pipeOphestra Umiker
The socket-based approach is no longer necessary as fsu allows extra files and sudo compatibility is no longer relevant. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18cmd/fshim: switch to generic setup funcOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-06app: integrate security-context-v1Ophestra Umiker
Should be able to get rid of XDG_RUNTIME_DIR share after this. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-16app: integrate fsuOphestra Umiker
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-02cmd: shim and init into separate binariesOphestra Umiker
This change also fixes a deadlock when shim fails to connect and complete the setup. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>