From 54610aaddcc01e335c34087bc0c3bc1de6d23cf8 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 15 Dec 2025 12:43:58 +0900 Subject: internal/outcome: expose pipewire via pipewire-pulse This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst. Closes #29. Signed-off-by: Ophestra --- cmd/hakurei/command.go | 9 --------- 1 file changed, 9 deletions(-) (limited to 'cmd') diff --git a/cmd/hakurei/command.go b/cmd/hakurei/command.go index ca685790..26c48d78 100644 --- a/cmd/hakurei/command.go +++ b/cmd/hakurei/command.go @@ -14,7 +14,6 @@ import ( _ "unsafe" // for go:linkname "hakurei.app/command" - "hakurei.app/container" "hakurei.app/container/check" "hakurei.app/container/fhs" "hakurei.app/hst" @@ -187,14 +186,6 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr }}) } - // start pipewire-pulse: this most likely exists on host if PipeWire is available - if flagPulse { - config.Container.Filesystem = append(config.Container.Filesystem, hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSDaemon{ - Target: fhs.AbsRunUser.Append(strconv.Itoa(container.OverflowUid(msg)), "pulse/native"), - Exec: shell, Args: []string{"-lc", "exec pipewire-pulse"}, - }}) - } - config.Container.Filesystem = append(config.Container.Filesystem, // opportunistically bind kvm hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSBind{ -- cgit v1.3.1