From af15b1c048e97c092f7a5eeb30f20d13cd972486 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Mon, 4 Nov 2024 03:15:39 +0900 Subject: app: support mapping target uid as privileged uid in sandbox Chromium's D-Bus client implementation refuses to work when its getuid call returns a different value than what the D-Bus server is running as. The reason behind this is not fully understood, but this workaround is implemented to support chromium and electron apps. This is not used by default since it has many side effects that break many other programs, like SSH on NixOS. Signed-off-by: Ophestra Umiker --- internal/app/seal.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) (limited to 'internal/app/seal.go') diff --git a/internal/app/seal.go b/internal/app/seal.go index 6852ddc6..aaf8a2d6 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -129,6 +129,15 @@ func (a *app) Seal(config *Config) error { // create seal system component seal.sys = new(appSealSys) + // mapped uid + if config.Confinement.Sandbox != nil && config.Confinement.Sandbox.UseRealUID { + seal.sys.mappedID = a.os.Geteuid() + } else { + seal.sys.mappedID = 65534 + } + seal.sys.mappedIDString = strconv.Itoa(seal.sys.mappedID) + seal.sys.runtime = path.Join("/run/user", seal.sys.mappedIDString) + // look up user from system if u, err := a.os.Lookup(config.User); err != nil { if errors.As(err, new(user.UnknownUserError)) { @@ -139,7 +148,6 @@ func (a *app) Seal(config *Config) error { } } else { seal.sys.user = u - seal.sys.runtime = path.Join("/run/user", mappedIDString) } // map sandbox config to bwrap @@ -228,7 +236,7 @@ func (a *app) Seal(config *Config) error { config.Confinement.Sandbox = conf } - seal.sys.bwrap = config.Confinement.Sandbox.Bwrap() + seal.sys.bwrap = config.Confinement.Sandbox.Bwrap(a.os.Geteuid()) seal.sys.override = config.Confinement.Sandbox.Override if seal.sys.bwrap.SetEnv == nil { seal.sys.bwrap.SetEnv = make(map[string]string) -- cgit v1.3.1