aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal/shim/payload.go
AgeCommit message (Collapse)Author
2024-11-02cmd: shim and init into separate binariesOphestra Umiker
This change also fixes a deadlock when shim fails to connect and complete the setup. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-27shim: user switcher process management structOphestra Umiker
This change moves all user switcher and shim management to the shim package and withholds output while shim is alive. This also eliminated all exit scenarios where revert is skipped. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-20migrate to git.ophivana.moe/security/fortifyOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-14init: custom init process inside sandboxOphestra Umiker
Bubblewrap as init is a bit awkward and don't support a few setup actions fortify will need, such as starting/supervising nscd. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-13shim: update payload commentOphestra Umiker
Generating permissive default no longer happens in shim. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-13app: generate and replace passwd and group filesOphestra Umiker
This ensures libc functions get correct user information. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-11shim: use bwrap config as it isOphestra Umiker
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
2024-10-11shim: new shim implementationOphestra Umiker
This implementation of shim accepts configuration as a gob stream over a unix socket, with support for mediating access to wayland via WAYLAND_SOCKET fd. All configuration is now included in the payload, and child is started inside bwrap configured with supplied bwrap.Config. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>