From 847b667489e661d0e59240d64614a33392d94e0d Mon Sep 17 00:00:00 2001 From: Ophestra Date: Sat, 28 Dec 2024 13:23:27 +0900 Subject: app: extra acl entries from configuration Signed-off-by: Ophestra --- fst/config.go | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'fst') diff --git a/fst/config.go b/fst/config.go index 05b588d6..27e13f04 100644 --- a/fst/config.go +++ b/fst/config.go @@ -35,6 +35,8 @@ type ConfinementConfig struct { Outer string `json:"home"` // bwrap sandbox confinement configuration Sandbox *SandboxConfig `json:"sandbox"` + // extra acl entries to append + ExtraPerms []*ExtraPermConfig `json:"extra_perms,omitempty"` // reference to a system D-Bus proxy configuration, // nil value disables system bus proxy @@ -78,6 +80,29 @@ type SandboxConfig struct { Override []string `json:"override"` } +type ExtraPermConfig struct { + Path string `json:"path"` + Read bool `json:"r,omitempty"` + Write bool `json:"w,omitempty"` + Execute bool `json:"x,omitempty"` +} + +func (e *ExtraPermConfig) String() string { + buf := make([]byte, 0, 4+len(e.Path)) + buf = append(buf, '-', '-', '-', ':') + buf = append(buf, []byte(e.Path)...) + if e.Read { + buf[0] = 'r' + } + if e.Write { + buf[1] = 'w' + } + if e.Execute { + buf[2] = 'x' + } + return string(buf) +} + type FilesystemConfig struct { // mount point in sandbox, same as src if empty Dst string `json:"dst,omitempty"` -- cgit v1.3.1