| Age | Commit message (Collapse) | Author |
|---|
|
While fd created from this side always has the FD_CLOEXEC flag, the same is not true for files left open by the parent. This change prevents those files from leaking into the container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This prevents leaking the setup pipe.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This writes the 16-byte instance identifier to file descriptor specified by --identifier-fd if set, and closes the file.
This enables safely obtaining the new instance's identifier.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
While it is unlikely a use case for hakurei on i686 exists, it does not hurt to have this support.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This leaves slots available for additional uid ranges in Rosa OS.
This breaks all existing installations! Users are required to fix ownership manually.
Closes #18.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is more useful now that state is tracked here.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Wanted to do this for a long time, since the key is redundant. This also makes it easier to migrate to the new store interface.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This makes the resulting json easier to parse since it can now be deserialised into the config struct.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The hst package only deals with data serialisation, however since many parts of hakurei make use of C libraries in some way it can be easy to inadvertently depend on cgo.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Updated according to evaluation warning.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Sharing and persisting these directories do not always make sense. Make it optional here.
Closes #16.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This discontinues the dependency on shared tmpdir and xdg_runtime_dir implementation detail, for #16.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This enables configured filesystems to cover system mount points.
Closes #8.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This sets XDG_SESSION_TYPE to the corresponding values specified in pam_systemd(8) according to enablements.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
No idea what systemd is doing with this to cause its options to change.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This change also moves pd behaviour to cmd/hakurei, as this does not belong in the hst API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This can seriously break things, and exposes extra host attack surface, so include it here.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This package is replaced by container/stub. Remove and replace it with unexported implementation for the upcoming test suite rewrite.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The integration vm is being very slow for some reason. This change should reduce spurious timeouts.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This checks init timeout on lingering process after initial process termination.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This begins the effort of the removal of the sys package.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This prepares the test suite for private TMPDIR.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Since this is going to be placed in a shared directory, it needs to be unique to the identity. Instead of trying to figure out identity from mountinfo, just have the test script pass hardcoded values.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is not always obvious from mountinfo.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This makes it possible to place markers with private tmpdir.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This avoids covering /dev/shm mounts from hst.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This otherwise dereferences a nil pointer when dbus-verbose is set and either session or system bus are nil.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This helps work around faulty software that misinterprets unix: DISPLAY string.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Programs expect /dev/shm to be a writable tmpfs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The privileged user is identifier to hakurei through its hsu userid. Using the kernel uid here makes little sense and is a leftover design choice from before hsu was implemented.
Closes #7.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There is no reason to give the home directory special treatment, as this behaviour can be quite confusing. The home directory also does not necessarily require its own mount point, it could be provided by a parent or simply be ephemeral.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This no longer needs special treatment since it can be specified as a generic filesystem entry.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
|
|
This is the first hakurei run in the test, if the container outright fails to start this is often where it happens, so throwing away the output is very unhelpful.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging https://git.gensokyo.uk/security/hakurei/pulls/1.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This finally exposes overlay mounts in the high level hakurei API.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is unfortunately the only feasible way of doing this in nix.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
The lowerdir is in the nix store.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is a pd workaround that does nothing in the nixos module.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
There's often good reason to mount tmpfs in the container.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Doing this instead of mounting directly on / because it's impossible to ensure a parent is available for every path hakurei wants to mount to. This situation is similar to autoetc hence the similar name, however a symlink mirror will not work in this case.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This hopefully fixes the intermittent failures.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
|
This is useful for programs that take a long time to clean up.
Signed-off-by: Ophestra <cat@gensokyo.uk>
|
