aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal/app/seal.go
AgeCommit message (Collapse)Author
2025-09-02system: update doc commands and remove mutexOphestra
The mutex is not really doing anything, none of these methods make sense when called concurrently anyway. The copylocks analysis is still satisfied by the noCopy struct. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-09-02container/dispatcher: stub.Call initialisation helper functionOphestra
This keeps composites analysis happy without making the test cases (too) bloated. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-08-28internal/app: remove seal interfaceOphestra
This further cleans up the package for the restructure. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-12app: rename app implementation packageOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-11sandbox: relative autoetc linksOphestra
This allows nested containers to use autoetc, and increases compatibility with other implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-01app: wayland socket in process shareOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-01app: share path setup on demandOphestra
This removes the unnecessary creation and destruction of share paths when none of the enablements making use of them are set. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-31fst: optional configured shell pathOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27app/seal: check for '=' in envvOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27app: pass through $SHELLOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26app: create XDG_RUNTIME_DIR with perm 0700Ophestra
Many programs complain about this. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25sandbox/wl: move into sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25system: optimise string formattingOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25app: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: wrap fmsg interfaceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13internal/app: rename init to init0Ophestra
This makes way for the new container init. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-21app: separate instance from process stateOphestra
This works better for the implementation. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app: defer system.I revertOphestra
Just returning an error after a successful call of commit will leave garbage behind with no way for the caller to clean them. This change ensures revert is always called after successful commit with at least per-process state enabled. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app: remove share methodOphestra
This is yet another implementation detail from before system.I, getting rid of this vastly cuts down on redundant seal state. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app: separate appSeal finalise methodOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app: merge seal with sysOphestra
The existence of the appSealSys struct was an implementation detail obsolete since system.I was integrated in 084cd84f36a1d608541b4aa4e1e95334395d8953. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app: embed appSeal in app structOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app/seal: improve documentationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app/seal: embed enablementsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-19app: store values with string representationOphestra
Improves code readability without changing memory layout. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-18app: separate interface from implementationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-18sys: rename from linuxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-18linux: wrap fsu lookup errorOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-17system: move out of internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-17system: wrap console output functionsOphestra
This eliminates all fmsg imports from internal/system. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-16fmsg: implement suspend in writerOphestra
This removes the requirement to call fmsg.Exit on every exit path, and enables direct use of the "log" package. However, fmsg.BeforeExit is still encouraged when possible to catch exit on suspended output. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-14app: check username length against LOGIN_NAME_MAXOphestra
This limit is arbitrary, but it's good to enforce it anyway. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-07system/dbus: dump method prints msgbufOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-22helper/bwrap: integrate seccomp into helper interfaceOphestra
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-21state: store config in separate gob streamOphestra
This enables early serialisation of config. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-20fst: include syscall filter configurationOphestra
This value is passed through to shim. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-01-15fst: hide sockets exposed via FilesystemOphestra
This is mostly useful for permissive defaults. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-28app: ensure extra pathsOphestra
The primary use case for extra perms is app-specific state directories, which may or may not exist (first run of any app). Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-28app: extra acl entries from configurationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-28app: merge share methodsOphestra
This significantly increases readability and makes order of ops more obvious. Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-22app: mount /dev/kvm in permissive defaultsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2024-12-20migrate to git.gensokyo.uk/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-19state: expose aids and use instance id as keyOphestra Umiker
Fortify state store instances was specific to aids due to outdated design decisions carried over from the ego rewrite. That no longer makes sense in the current application, so the interface now enables a single store object to manage all transient state. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18fst: rename from fipcOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-18fipc: export config structOphestra Umiker
Also store full config as part of state. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-12-06app: integrate security-context-v1Ophestra Umiker
Should be able to get rid of XDG_RUNTIME_DIR share after this. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-19app: validate usernameOphestra Umiker
This value is used for passwd generation. Bad input can cause very confusing issues. This is not a security issue, however validation will improve user experience. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-18app: alternative inner home pathOphestra Umiker
Support binding home to an alternative path in the mount namespace. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-16app: integrate fsuOphestra Umiker
This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-11-09app/config: rename map_real_uid from use_real_uidOphestra Umiker
This option only changes mapped uid in the user namespace. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-15 22:41:44 +0000