From df33123bd7f1e0cb4e98580b7e63818c82aa7206 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Sat, 16 Nov 2024 21:19:45 +0900 Subject: app: integrate fsu This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker --- internal/app/config.go | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) (limited to 'internal/app/config.go') diff --git a/internal/app/config.go b/internal/app/config.go index 96c51ce7..dd45b023 100644 --- a/internal/app/config.go +++ b/internal/app/config.go @@ -15,12 +15,8 @@ const fTmp = "/fortify" type Config struct { // D-Bus application ID ID string `json:"id"` - // username of the target user to switch to - User string `json:"user"` // value passed through to the child process as its argv Command []string `json:"command"` - // string representation of the child's launch method - Method string `json:"method"` // child confinement configuration Confinement ConfinementConfig `json:"confinement"` @@ -28,6 +24,14 @@ type Config struct { // ConfinementConfig defines fortified child's confinement type ConfinementConfig struct { + // numerical application id, determines uid in the init namespace + AppID int `json:"app_id"` + // list of supplementary groups to inherit + Groups []string `json:"groups"` + // passwd username in the sandbox, defaults to chronos + Username string `json:"username,omitempty"` + // home directory in sandbox + Home string `json:"home"` // bwrap sandbox confinement configuration Sandbox *SandboxConfig `json:"sandbox"` @@ -169,8 +173,7 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) { // Template returns a fully populated instance of Config. func Template() *Config { return &Config{ - ID: "org.chromium.Chromium", - User: "chronos", + ID: "org.chromium.Chromium", Command: []string{ "chromium", "--ignore-gpu-blocklist", @@ -178,8 +181,11 @@ func Template() *Config { "--enable-features=UseOzonePlatform", "--ozone-platform=wayland", }, - Method: "sudo", Confinement: ConfinementConfig{ + AppID: 9, + Groups: []string{"video"}, + Username: "chronos", + Home: "/var/lib/persist/home/org.chromium.Chromium", Sandbox: &SandboxConfig{ Hostname: "localhost", UserNS: true, -- cgit v1.3.1