From 05b7dbf066cb74d2901ff9acb3a42662a2af722e Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Mon, 18 Nov 2024 00:18:21 +0900 Subject: app: alternative inner home path Support binding home to an alternative path in the mount namespace. Signed-off-by: Ophestra Umiker --- internal/app/seal.go | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) (limited to 'internal/app/seal.go') diff --git a/internal/app/seal.go b/internal/app/seal.go index f01061af..5ad588d0 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -100,15 +100,19 @@ func (a *app) Seal(config *Config) error { seal.sys.user = appUser{ aid: config.Confinement.AppID, as: strconv.Itoa(config.Confinement.AppID), - home: config.Confinement.Home, + data: config.Confinement.Outer, + home: config.Confinement.Inner, username: config.Confinement.Username, } if seal.sys.user.username == "" { seal.sys.user.username = "chronos" } - if seal.sys.user.home == "" || !path.IsAbs(seal.sys.user.home) { + if seal.sys.user.data == "" || !path.IsAbs(seal.sys.user.data) { return fmsg.WrapError(ErrHome, - fmt.Sprintf("invalid home directory %q", seal.sys.user.home)) + fmt.Sprintf("invalid home directory %q", seal.sys.user.data)) + } + if seal.sys.user.home == "" { + seal.sys.user.home = seal.sys.user.data } // invoke fsu for full uid -- cgit v1.3.1