From 8d0573405a8a58a57c39b008150d75d3be2894c2 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Fri, 6 Dec 2024 04:21:37 +0900 Subject: helper/bwrap: implement sync fd This is required by wayland security-context-v1. Signed-off-by: Ophestra Umiker --- helper/bwrap/config.go | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'helper/bwrap/config.go') diff --git a/helper/bwrap/config.go b/helper/bwrap/config.go index 0aad6de0..9e15a29a 100644 --- a/helper/bwrap/config.go +++ b/helper/bwrap/config.go @@ -68,13 +68,16 @@ type Config struct { // (--as-pid-1) AsInit bool `json:"as_init"` + // keep this fd open while sandbox is running + // (--sync-fd FD) + sync *os.File + /* unmapped options include: --unshare-user-try Create new user namespace if possible else continue by skipping it --unshare-cgroup-try Create new cgroup namespace if possible else continue by skipping it --userns FD Use this user namespace (cannot combine with --unshare-user) --userns2 FD After setup switch to this user namespace, only useful with --userns --pidns FD Use this pid namespace (as parent namespace if using --unshare-pid) - --sync-fd FD Keep this fd open while sandbox is running --exec-label LABEL Exec label for the sandbox --file-label LABEL File label for temporary sandbox content --file FD DEST Copy from FD to destination DEST @@ -92,6 +95,12 @@ type Config struct { among which --args is used internally for passing arguments */ } +// Sync keep this fd open while sandbox is running +// (--sync-fd FD) +func (c *Config) Sync() *os.File { + return c.sync +} + type UnshareConfig struct { // (--unshare-user) // create new user namespace -- cgit v1.3.1