From f9edec7e4169ecda63ba15762f12e64803b9984d Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sat, 16 Aug 2025 02:32:57 +0900 Subject: hst: merge miscellaneous files These structs were going to be bigger at some point. They turned out not to be. Signed-off-by: Ophestra --- hst/config.go | 1 - hst/hst.go | 120 +++++++++++++++++++++++++++++++++++++ hst/hst_test.go | 163 +++++++++++++++++++++++++++++++++++++++++++++++++++ hst/info.go | 6 -- hst/paths.go | 15 ----- hst/template.go | 102 -------------------------------- hst/template_test.go | 163 --------------------------------------------------- 7 files changed, 283 insertions(+), 287 deletions(-) create mode 100644 hst/hst.go create mode 100644 hst/hst_test.go delete mode 100644 hst/info.go delete mode 100644 hst/paths.go delete mode 100644 hst/template.go delete mode 100644 hst/template_test.go diff --git a/hst/config.go b/hst/config.go index c6946069..34100e4f 100644 --- a/hst/config.go +++ b/hst/config.go @@ -1,4 +1,3 @@ -// Package hst exports shared types for invoking hakurei. package hst import ( diff --git a/hst/hst.go b/hst/hst.go new file mode 100644 index 00000000..92769a23 --- /dev/null +++ b/hst/hst.go @@ -0,0 +1,120 @@ +// Package hst exports stable shared types for interacting with hakurei. +package hst + +import ( + "hakurei.app/container" + "hakurei.app/container/seccomp" + "hakurei.app/system" + "hakurei.app/system/dbus" +) + +// Paths contains environment-dependent paths used by hakurei. +type Paths struct { + // temporary directory returned by [os.TempDir] (usually `/tmp`) + TempDir *container.Absolute `json:"temp_dir"` + // path to shared directory (usually `/tmp/hakurei.%d`) + SharePath *container.Absolute `json:"share_path"` + // XDG_RUNTIME_DIR value (usually `/run/user/%d`) + RuntimePath *container.Absolute `json:"runtime_path"` + // application runtime directory (usually `/run/user/%d/hakurei`) + RunDirPath *container.Absolute `json:"run_dir_path"` +} + +type Info struct { + User int `json:"user"` + Paths +} + +// Template returns a fully populated instance of Config. +func Template() *Config { + return &Config{ + ID: "org.chromium.Chromium", + + Path: container.AbsFHSRun.Append("current-system/sw/bin/chromium"), + Args: []string{ + "chromium", + "--ignore-gpu-blocklist", + "--disable-smooth-scrolling", + "--enable-features=UseOzonePlatform", + "--ozone-platform=wayland", + }, + + Enablements: NewEnablements(system.EWayland | system.EDBus | system.EPulse), + + SessionBus: &dbus.Config{ + See: nil, + Talk: []string{"org.freedesktop.Notifications", "org.freedesktop.FileManager1", "org.freedesktop.ScreenSaver", + "org.freedesktop.secrets", "org.kde.kwalletd5", "org.kde.kwalletd6", "org.gnome.SessionManager"}, + Own: []string{"org.chromium.Chromium.*", "org.mpris.MediaPlayer2.org.chromium.Chromium.*", + "org.mpris.MediaPlayer2.chromium.*"}, + Call: map[string]string{"org.freedesktop.portal.*": "*"}, + Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"}, + Log: false, + Filter: true, + }, + SystemBus: &dbus.Config{ + See: nil, + Talk: []string{"org.bluez", "org.freedesktop.Avahi", "org.freedesktop.UPower"}, + Own: nil, + Call: nil, + Broadcast: nil, + Log: false, + Filter: true, + }, + DirectWayland: false, + + Username: "chronos", + Shell: container.AbsFHSRun.Append("current-system/sw/bin/zsh"), + Data: container.AbsFHSVarLib.Append("hakurei/u0/org.chromium.Chromium"), + Dir: container.MustAbs("/data/data/org.chromium.Chromium"), + ExtraPerms: []*ExtraPermConfig{ + {Path: container.AbsFHSVarLib.Append("hakurei/u0"), Ensure: true, Execute: true}, + {Path: container.AbsFHSVarLib.Append("hakurei/u0/org.chromium.Chromium"), Read: true, Write: true, Execute: true}, + }, + + Identity: 9, + Groups: []string{"video", "dialout", "plugdev"}, + + Container: &ContainerConfig{ + Hostname: "localhost", + Devel: true, + Userns: true, + Net: true, + Device: true, + WaitDelay: -1, + SeccompFlags: seccomp.AllowMultiarch, + SeccompPresets: seccomp.PresetExt, + SeccompCompat: true, + Tty: true, + Multiarch: true, + MapRealUID: true, + // example API credentials pulled from Google Chrome + // DO NOT USE THESE IN A REAL BROWSER + Env: map[string]string{ + "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY", + "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com", + "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT", + }, + Filesystem: []FilesystemConfigJSON{ + {&FSEphemeral{Target: container.AbsFHSTmp, Write: true, Perm: 0755}}, + {&FSOverlay{ + Target: container.MustAbs("/nix/store"), + Lower: []*container.Absolute{container.MustAbs("/mnt-root/nix/.ro-store")}, + Upper: container.MustAbs("/mnt-root/nix/.rw-store/upper"), + Work: container.MustAbs("/mnt-root/nix/.rw-store/work"), + }}, + {&FSBind{Source: container.MustAbs("/nix/store")}}, + {&FSBind{Source: container.AbsFHSRun.Append("current-system")}}, + {&FSBind{Source: container.AbsFHSRun.Append("opengl-driver")}}, + {&FSBind{Source: container.AbsFHSVarLib.Append("hakurei/u0/org.chromium.Chromium"), + Target: container.MustAbs("/data/data/org.chromium.Chromium"), Write: true}}, + {&FSBind{Source: container.AbsFHSDev.Append("dri"), Device: true, Optional: true}}, + }, + Link: []LinkConfig{{container.AbsFHSRunUser.Append("65534"), container.FHSRunUser + "150"}}, + AutoRoot: container.AbsFHSVarLib.Append("hakurei/base/org.debian"), + RootFlags: container.BindWritable, + Etc: container.AbsFHSEtc, + AutoEtc: true, + }, + } +} diff --git a/hst/hst_test.go b/hst/hst_test.go new file mode 100644 index 00000000..31b9013e --- /dev/null +++ b/hst/hst_test.go @@ -0,0 +1,163 @@ +package hst_test + +import ( + "encoding/json" + "testing" + + "hakurei.app/hst" +) + +func TestTemplate(t *testing.T) { + const want = `{ + "id": "org.chromium.Chromium", + "path": "/run/current-system/sw/bin/chromium", + "args": [ + "chromium", + "--ignore-gpu-blocklist", + "--disable-smooth-scrolling", + "--enable-features=UseOzonePlatform", + "--ozone-platform=wayland" + ], + "enablements": { + "wayland": true, + "dbus": true, + "pulse": true + }, + "session_bus": { + "see": null, + "talk": [ + "org.freedesktop.Notifications", + "org.freedesktop.FileManager1", + "org.freedesktop.ScreenSaver", + "org.freedesktop.secrets", + "org.kde.kwalletd5", + "org.kde.kwalletd6", + "org.gnome.SessionManager" + ], + "own": [ + "org.chromium.Chromium.*", + "org.mpris.MediaPlayer2.org.chromium.Chromium.*", + "org.mpris.MediaPlayer2.chromium.*" + ], + "call": { + "org.freedesktop.portal.*": "*" + }, + "broadcast": { + "org.freedesktop.portal.*": "@/org/freedesktop/portal/*" + }, + "filter": true + }, + "system_bus": { + "see": null, + "talk": [ + "org.bluez", + "org.freedesktop.Avahi", + "org.freedesktop.UPower" + ], + "own": null, + "call": null, + "broadcast": null, + "filter": true + }, + "username": "chronos", + "shell": "/run/current-system/sw/bin/zsh", + "data": "/var/lib/hakurei/u0/org.chromium.Chromium", + "dir": "/data/data/org.chromium.Chromium", + "extra_perms": [ + { + "ensure": true, + "path": "/var/lib/hakurei/u0", + "x": true + }, + { + "path": "/var/lib/hakurei/u0/org.chromium.Chromium", + "r": true, + "w": true, + "x": true + } + ], + "identity": 9, + "groups": [ + "video", + "dialout", + "plugdev" + ], + "container": { + "hostname": "localhost", + "wait_delay": -1, + "seccomp_flags": 1, + "seccomp_presets": 1, + "seccomp_compat": true, + "devel": true, + "userns": true, + "net": true, + "tty": true, + "multiarch": true, + "env": { + "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY", + "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com", + "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT" + }, + "map_real_uid": true, + "device": true, + "filesystem": [ + { + "type": "ephemeral", + "dst": "/tmp/", + "write": true, + "perm": 493 + }, + { + "type": "overlay", + "dst": "/nix/store", + "lower": [ + "/mnt-root/nix/.ro-store" + ], + "upper": "/mnt-root/nix/.rw-store/upper", + "work": "/mnt-root/nix/.rw-store/work" + }, + { + "type": "bind", + "src": "/nix/store" + }, + { + "type": "bind", + "src": "/run/current-system" + }, + { + "type": "bind", + "src": "/run/opengl-driver" + }, + { + "type": "bind", + "dst": "/data/data/org.chromium.Chromium", + "src": "/var/lib/hakurei/u0/org.chromium.Chromium", + "write": true + }, + { + "type": "bind", + "src": "/dev/dri", + "dev": true, + "optional": true + } + ], + "symlink": [ + { + "target": "/run/user/65534", + "linkname": "/run/user/150" + } + ], + "auto_root": "/var/lib/hakurei/base/org.debian", + "root_flags": 2, + "etc": "/etc/", + "auto_etc": true + } +}` + + if p, err := json.MarshalIndent(hst.Template(), "", "\t"); err != nil { + t.Fatalf("cannot marshal: %v", err) + } else if s := string(p); s != want { + t.Fatalf("Template:\n%s\nwant:\n%s", + s, want) + } +} diff --git a/hst/info.go b/hst/info.go deleted file mode 100644 index e52f7465..00000000 --- a/hst/info.go +++ /dev/null @@ -1,6 +0,0 @@ -package hst - -type Info struct { - User int `json:"user"` - Paths -} diff --git a/hst/paths.go b/hst/paths.go deleted file mode 100644 index 7410d7a0..00000000 --- a/hst/paths.go +++ /dev/null @@ -1,15 +0,0 @@ -package hst - -import "hakurei.app/container" - -// Paths contains environment-dependent paths used by hakurei. -type Paths struct { - // temporary directory returned by [os.TempDir] (usually `/tmp`) - TempDir *container.Absolute `json:"temp_dir"` - // path to shared directory (usually `/tmp/hakurei.%d`) - SharePath *container.Absolute `json:"share_path"` - // XDG_RUNTIME_DIR value (usually `/run/user/%d`) - RuntimePath *container.Absolute `json:"runtime_path"` - // application runtime directory (usually `/run/user/%d/hakurei`) - RunDirPath *container.Absolute `json:"run_dir_path"` -} diff --git a/hst/template.go b/hst/template.go deleted file mode 100644 index b06e3239..00000000 --- a/hst/template.go +++ /dev/null @@ -1,102 +0,0 @@ -package hst - -import ( - "hakurei.app/container" - "hakurei.app/container/seccomp" - "hakurei.app/system" - "hakurei.app/system/dbus" -) - -// Template returns a fully populated instance of Config. -func Template() *Config { - return &Config{ - ID: "org.chromium.Chromium", - - Path: container.AbsFHSRun.Append("current-system/sw/bin/chromium"), - Args: []string{ - "chromium", - "--ignore-gpu-blocklist", - "--disable-smooth-scrolling", - "--enable-features=UseOzonePlatform", - "--ozone-platform=wayland", - }, - - Enablements: NewEnablements(system.EWayland | system.EDBus | system.EPulse), - - SessionBus: &dbus.Config{ - See: nil, - Talk: []string{"org.freedesktop.Notifications", "org.freedesktop.FileManager1", "org.freedesktop.ScreenSaver", - "org.freedesktop.secrets", "org.kde.kwalletd5", "org.kde.kwalletd6", "org.gnome.SessionManager"}, - Own: []string{"org.chromium.Chromium.*", "org.mpris.MediaPlayer2.org.chromium.Chromium.*", - "org.mpris.MediaPlayer2.chromium.*"}, - Call: map[string]string{"org.freedesktop.portal.*": "*"}, - Broadcast: map[string]string{"org.freedesktop.portal.*": "@/org/freedesktop/portal/*"}, - Log: false, - Filter: true, - }, - SystemBus: &dbus.Config{ - See: nil, - Talk: []string{"org.bluez", "org.freedesktop.Avahi", "org.freedesktop.UPower"}, - Own: nil, - Call: nil, - Broadcast: nil, - Log: false, - Filter: true, - }, - DirectWayland: false, - - Username: "chronos", - Shell: container.AbsFHSRun.Append("current-system/sw/bin/zsh"), - Data: container.AbsFHSVarLib.Append("hakurei/u0/org.chromium.Chromium"), - Dir: container.MustAbs("/data/data/org.chromium.Chromium"), - ExtraPerms: []*ExtraPermConfig{ - {Path: container.AbsFHSVarLib.Append("hakurei/u0"), Ensure: true, Execute: true}, - {Path: container.AbsFHSVarLib.Append("hakurei/u0/org.chromium.Chromium"), Read: true, Write: true, Execute: true}, - }, - - Identity: 9, - Groups: []string{"video", "dialout", "plugdev"}, - - Container: &ContainerConfig{ - Hostname: "localhost", - Devel: true, - Userns: true, - Net: true, - Device: true, - WaitDelay: -1, - SeccompFlags: seccomp.AllowMultiarch, - SeccompPresets: seccomp.PresetExt, - SeccompCompat: true, - Tty: true, - Multiarch: true, - MapRealUID: true, - // example API credentials pulled from Google Chrome - // DO NOT USE THESE IN A REAL BROWSER - Env: map[string]string{ - "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY", - "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com", - "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT", - }, - Filesystem: []FilesystemConfigJSON{ - {&FSEphemeral{Target: container.AbsFHSTmp, Write: true, Perm: 0755}}, - {&FSOverlay{ - Target: container.MustAbs("/nix/store"), - Lower: []*container.Absolute{container.MustAbs("/mnt-root/nix/.ro-store")}, - Upper: container.MustAbs("/mnt-root/nix/.rw-store/upper"), - Work: container.MustAbs("/mnt-root/nix/.rw-store/work"), - }}, - {&FSBind{Source: container.MustAbs("/nix/store")}}, - {&FSBind{Source: container.AbsFHSRun.Append("current-system")}}, - {&FSBind{Source: container.AbsFHSRun.Append("opengl-driver")}}, - {&FSBind{Source: container.AbsFHSVarLib.Append("hakurei/u0/org.chromium.Chromium"), - Target: container.MustAbs("/data/data/org.chromium.Chromium"), Write: true}}, - {&FSBind{Source: container.AbsFHSDev.Append("dri"), Device: true, Optional: true}}, - }, - Link: []LinkConfig{{container.AbsFHSRunUser.Append("65534"), container.FHSRunUser + "150"}}, - AutoRoot: container.AbsFHSVarLib.Append("hakurei/base/org.debian"), - RootFlags: container.BindWritable, - Etc: container.AbsFHSEtc, - AutoEtc: true, - }, - } -} diff --git a/hst/template_test.go b/hst/template_test.go deleted file mode 100644 index 31b9013e..00000000 --- a/hst/template_test.go +++ /dev/null @@ -1,163 +0,0 @@ -package hst_test - -import ( - "encoding/json" - "testing" - - "hakurei.app/hst" -) - -func TestTemplate(t *testing.T) { - const want = `{ - "id": "org.chromium.Chromium", - "path": "/run/current-system/sw/bin/chromium", - "args": [ - "chromium", - "--ignore-gpu-blocklist", - "--disable-smooth-scrolling", - "--enable-features=UseOzonePlatform", - "--ozone-platform=wayland" - ], - "enablements": { - "wayland": true, - "dbus": true, - "pulse": true - }, - "session_bus": { - "see": null, - "talk": [ - "org.freedesktop.Notifications", - "org.freedesktop.FileManager1", - "org.freedesktop.ScreenSaver", - "org.freedesktop.secrets", - "org.kde.kwalletd5", - "org.kde.kwalletd6", - "org.gnome.SessionManager" - ], - "own": [ - "org.chromium.Chromium.*", - "org.mpris.MediaPlayer2.org.chromium.Chromium.*", - "org.mpris.MediaPlayer2.chromium.*" - ], - "call": { - "org.freedesktop.portal.*": "*" - }, - "broadcast": { - "org.freedesktop.portal.*": "@/org/freedesktop/portal/*" - }, - "filter": true - }, - "system_bus": { - "see": null, - "talk": [ - "org.bluez", - "org.freedesktop.Avahi", - "org.freedesktop.UPower" - ], - "own": null, - "call": null, - "broadcast": null, - "filter": true - }, - "username": "chronos", - "shell": "/run/current-system/sw/bin/zsh", - "data": "/var/lib/hakurei/u0/org.chromium.Chromium", - "dir": "/data/data/org.chromium.Chromium", - "extra_perms": [ - { - "ensure": true, - "path": "/var/lib/hakurei/u0", - "x": true - }, - { - "path": "/var/lib/hakurei/u0/org.chromium.Chromium", - "r": true, - "w": true, - "x": true - } - ], - "identity": 9, - "groups": [ - "video", - "dialout", - "plugdev" - ], - "container": { - "hostname": "localhost", - "wait_delay": -1, - "seccomp_flags": 1, - "seccomp_presets": 1, - "seccomp_compat": true, - "devel": true, - "userns": true, - "net": true, - "tty": true, - "multiarch": true, - "env": { - "GOOGLE_API_KEY": "AIzaSyBHDrl33hwRp4rMQY0ziRbj8K9LPA6vUCY", - "GOOGLE_DEFAULT_CLIENT_ID": "77185425430.apps.googleusercontent.com", - "GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT" - }, - "map_real_uid": true, - "device": true, - "filesystem": [ - { - "type": "ephemeral", - "dst": "/tmp/", - "write": true, - "perm": 493 - }, - { - "type": "overlay", - "dst": "/nix/store", - "lower": [ - "/mnt-root/nix/.ro-store" - ], - "upper": "/mnt-root/nix/.rw-store/upper", - "work": "/mnt-root/nix/.rw-store/work" - }, - { - "type": "bind", - "src": "/nix/store" - }, - { - "type": "bind", - "src": "/run/current-system" - }, - { - "type": "bind", - "src": "/run/opengl-driver" - }, - { - "type": "bind", - "dst": "/data/data/org.chromium.Chromium", - "src": "/var/lib/hakurei/u0/org.chromium.Chromium", - "write": true - }, - { - "type": "bind", - "src": "/dev/dri", - "dev": true, - "optional": true - } - ], - "symlink": [ - { - "target": "/run/user/65534", - "linkname": "/run/user/150" - } - ], - "auto_root": "/var/lib/hakurei/base/org.debian", - "root_flags": 2, - "etc": "/etc/", - "auto_etc": true - } -}` - - if p, err := json.MarshalIndent(hst.Template(), "", "\t"); err != nil { - t.Fatalf("cannot marshal: %v", err) - } else if s := string(p); s != want { - t.Fatalf("Template:\n%s\nwant:\n%s", - s, want) - } -} -- cgit v1.3.1