aboutsummaryrefslogtreecommitdiffhomepage
path: root/internal
AgeCommit message (Collapse)Author
2025-03-31fst: optional configured shell pathOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27sys: update doc commentOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27state/multi: fix backend cache population raceOphestra
This race is never able to happen since no caller concurrently requests the same aid yet. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27app/seal: check for '=' in envvOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-27app: pass through $SHELLOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26app: create XDG_RUNTIME_DIR with perm 0700Ophestra
Many programs complain about this. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25fst/sandbox: do not create /etc in advanceOphestra
This is now handled by the setup op. This also gets rid of the hardcoded /etc path. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25sandbox/wl: move into sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25app: merge shim into app packageOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25system: optimise string formattingOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-25app: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17internal/sys: wrap getuid/getgidOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move out of internalOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: move params setup functionsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17sandbox: wrap fmsg interfaceOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-17seccomp: install output atomicallyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: check command function pointerOphestra
Setting default CommandContext on initialisation is somewhat of a footgun. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16ldd: lib paths resolve functionOphestra
This is what always happens right after a ldd call, so implement it here. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-16sandbox: return on zero length opsOphestra
This dodges potentially confusing behaviour where init fails due to Ops being clobbered during transfer. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox/init: early params nil checkOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox: return error on doubled startOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15sandbox: expose cancel behaviourOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: expose extra files to directOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: rearrange initialisation argsOphestra
This improves consistency across two different helper implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-15helper: clean up interfaceOphestra
The helper interface was messy due to odd context acquisition order. That has changed, so this cleans it up. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14helper/proc: pass extra files and startOphestra
For integration with native container tooling. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14seccomp: move out of helperOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14helper: embed context on creationOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14ldd: run in native sandboxOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: write uid/gid map as initOphestra
This avoids PR_SET_DUMPABLE in the parent process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: invert seccomp ruleset defaultsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: mount container /devOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox/mount: pass custom tmpfs nameOphestra
The tmpfs driver allows arbitrary fsname. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: pass params to setup opsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox/mount: fix source flag pathOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: separate tmpfs function from opOphestra
This is useful in the implementation of various other ops. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-14sandbox: separate bind mount function from opOphestra
This is useful in the implementation of various other ops. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13internal/app: rename init to init0Ophestra
This makes way for the new container init. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: native container toolingOphestra
This should eventually replace bwrap. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13internal: pull EINTR loop from stdlibOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-13sandbox: read overflow idsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-09helper/proc: expose setup fileOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-07internal/prctl: rename prctl wrappersOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26app: print comp values earlyOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26cmd/fpkg: call app in-processOphestra
Wrapping fortify is slow, painful and error-prone. Start apps in-process instead. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26app: handle RunState errorsOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26app: define errors in a separate fileOphestra
Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-26internal: store fortify path in internalOphestra
This now makes more sense due to the changes in build system. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25dbus: set process group idOphestra
This stops signals sent by the TTY driver from propagating to the xdg-dbus-proxy process. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-02-25fortify: improve handling of RevertErrOphestra
All this error wrapping is getting a bit ridiculous and I might want to do something about that somewhere down the line. Signed-off-by: Ophestra <cat@gensokyo.uk>