| Age | Commit message (Collapse) | Author |
|---|
|
This further cleans up the package for the restructure.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Use the default value of NAME_REGEX from adduser. Should not hurt compatibility while being less strict.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This should not be used and is not useful in other packages.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This helps work around faulty software that misinterprets unix: DISPLAY string.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There is no reason to give the home directory special treatment, as this behaviour can be quite confusing. The home directory also does not necessarily require its own mount point, it could be provided by a parent or simply be ephemeral.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This no longer needs special treatment since it can be specified as a generic filesystem entry.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This generalises the special field allowing any special behaviour to be matched from target.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows any fstype supported by hst to be directly mounted on sysroot. A special case in internal/app applies the matching entry early and excludes it from path hiding.
Closes #5.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This makes more sense and matches the container library.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
|
|
The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging https://git.gensokyo.uk/security/hakurei/pulls/1.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Container state initialisation is no longer implemented in hst so splitting them no longer makes sense.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows adapter structs to use the same field names as Op structs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This allows mount points to be represented by different underlying structs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This increases readability since this can help disambiguate absolute paths from similarly named path segments.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This was never useful, and is now completely replaced by regular FilesystemConfig being able to mount tmpfs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There's often good reason to mount tmpfs in the container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Doing this instead of mounting directly on / because it's impossible to ensure a parent is available for every path hakurei wants to mount to. This situation is similar to autoetc hence the similar name, however a symlink mirror will not work in this case.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is useful for programs that take a long time to clean up.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
It is completely nonsensical and highly error-prone to have multiple implementations of this in the same build. This should be switched at compile time instead therefore the split packages are pointless.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
