From 82a072f641b2b8eb4f966a01056283f93b57342f Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 17 Feb 2025 00:07:52 +0900 Subject: system/tmpfiles: implement private tmpfiles These are only available within the mount namespace and should significantly reduce attack surface. Signed-off-by: Ophestra --- internal/app/app_pd_test.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'internal/app/app_pd_test.go') diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go index 269c8aa3..4d90d7fc 100644 --- a/internal/app/app_pd_test.go +++ b/internal/app/app_pd_test.go @@ -219,7 +219,7 @@ var testCasesPd = []sealTestCase{ Ensure("/tmp/fortify.1971/wayland", 0711). Wayland("/tmp/fortify.1971/wayland/ebf083d1b175911782d413369b64ce7c", "/run/user/1971/wayland-0", "org.chromium.Chromium", "ebf083d1b175911782d413369b64ce7c"). Link("/run/user/1971/pulse/native", "/run/user/1971/fortify/ebf083d1b175911782d413369b64ce7c/pulse"). - CopyFile("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/pulse-cookie", "/home/ophestra/xdg/config/pulse/cookie"). + CopyFile(new([]byte), "/home/ophestra/xdg/config/pulse/cookie", 256, 256). MustProxyDBus("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/bus", &dbus.Config{ Talk: []string{ "org.freedesktop.Notifications", @@ -382,7 +382,7 @@ var testCasesPd = []sealTestCase{ CopyBind("/etc/group", []byte("fortify:x:65534:\n")). Bind("/tmp/fortify.1971/wayland/ebf083d1b175911782d413369b64ce7c", "/run/user/65534/wayland-0"). Bind("/run/user/1971/fortify/ebf083d1b175911782d413369b64ce7c/pulse", "/run/user/65534/pulse/native"). - Bind("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/pulse-cookie", fst.Tmp+"/pulse-cookie"). + CopyBind(fst.Tmp+"/pulse-cookie", nil). Bind("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/bus", "/run/user/65534/bus"). Bind("/tmp/fortify.1971/ebf083d1b175911782d413369b64ce7c/system_bus_socket", "/run/dbus/system_bus_socket"). Tmpfs("/var/run/nscd", 8192). -- cgit v1.3.1