| Age | Commit message (Collapse) | Author |
|---|
|
In case this might want to be an io.Writer.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This removes the requirement to call fmsg.Exit on every exit path, and enables direct use of the "log" package. However, fmsg.BeforeExit is still encouraged when possible to catch exit on suspended output.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows the caller to defer fulfilling its payload.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These are significantly more efficient and less error-prone than mounting an external tmpfile. This should also reduce attack surface as the resulting files are private to its specific sandbox.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This replaces the pipes object and integrates context into helper process lifecycle.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows errors written during a timeout to be received and handled.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This makes the code much cleaner, and eliminates the intermittent ErrInvalid errors.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is a generic implementation of helper/pipe.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This helps debug implementation errors of [proc.File].
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Storing extra files as a slice requires the caller to allocate a large enough slice before initialising any file and never grow the slice.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Turns out the doc comment on os.File was lying about its methods being safe for concurrent use. The race detector picked up a data race from concurrent use of Fd and Close.
This change eliminates that by calling Fd in the prepare routine.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Helpers use extra files for various purposes. This provides a generic interface for implementing the fulfillment of these extra files without having to specifically handle them in the process creation code.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Returning an error here puts exporter in an invalid state. The caller should guard against this condition instead.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This also does not require the libc tmpfile call.
BPF programs emitted by libseccomp seems to be deterministic. The tests would catch regressions as it verifies the program against known good output backed by manual testing.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This (slightly) improves performance.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is required for copying bwrap configurations across processes.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This is required by wayland security-context-v1.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Trying to print to a shared stdout is a terrible idea. This change makes it possible to withhold output for the lifetime of the sandbox.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This guarantees consistency of resulting args.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
The argument builder was written based on the incorrect assumption that bwrap arguments are unordered. The argument builder is replaced in this commit to correct that mistake.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Bubblewrap expects an octal representation of mode.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Bwrap argument order determines the order their corresponding actions are performed. This allows generic arguments like tmpfs to the end of the stream to override bind mounts.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
This configuration is not saved anywhere, and does not need to be saved. Bwrap configuration information is already saved into p.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
These flags do not support --chmod.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Bubblewrap apparently requires --unshare-user even when --unshare-all is set to apply --disable-userns. This behaviour is not clearly documented.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Tests internal to the helper package sets crash-test-dummy as the command whenever a launch is expected to go through, and the hardcoded args are only valid for internal tests, so this characteristic is used here to exclude external tests that pass real program names and custom bwrap configurations.
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
|
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
|
