aboutsummaryrefslogtreecommitdiffhomepage
path: root/fst
AgeCommit message (Collapse)Author
2025-02-18fst: move App interface declarationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-18sys: rename from linuxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-17system: move out of internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-16fmsg: implement suspend in writerOphestra
This removes the requirement to call fmsg.Exit on every exit path, and enables direct use of the "log" package. However, fmsg.BeforeExit is still encouraged when possible to catch exit on suspended output. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-22fst: add missing fields to templateOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-22helper/bwrap: integrate seccomp into helper interfaceOphestra
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-21state: store config in separate gob streamOphestra
This enables early serialisation of config. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-20fst: include syscall filter configurationOphestra
This value is passed through to shim. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-15fst: hide sockets exposed via FilesystemOphestra
This is mostly useful for permissive defaults. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-15fst: move sandbox struct to separate fileOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-04fst/config: allocate filesystem sliceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-01fortify: show system info when instance is not specifiedOphestra
This contains useful information not obtainable by external tools. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-28app: ensure extra pathsOphestra
The primary use case for extra perms is app-specific state directories, which may or may not exist (first run of any app). Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-28app: extra acl entries from configurationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-28fst/config: add template etc entryOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-27fst/config: autoetc read custom pathOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-27fst/config: alternative /etc directoryOphestra
This is useful for static /etc directories provided by self-contained application packages, or in cases where autoetc is useful for paths other than /etc. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-26fst/config: improve correctness of commentsOphestra
The meanings of many of these fields have changed since they were added. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-21app: rename /fortify to /.fortifyOphestra
Also removed the inner share tmpfs mount. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20migrate to git.gensokyo.uk/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-19fst: implement app id parserOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18fst: rename from fipcOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>