From 82a072f641b2b8eb4f966a01056283f93b57342f Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 17 Feb 2025 00:07:52 +0900 Subject: system/tmpfiles: implement private tmpfiles These are only available within the mount namespace and should significantly reduce attack surface. Signed-off-by: Ophestra --- internal/app/share.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'internal/app/share.go') diff --git a/internal/app/share.go b/internal/app/share.go index c7f0c7a3..1862fb2b 100644 --- a/internal/app/share.go +++ b/internal/app/share.go @@ -231,11 +231,11 @@ func (seal *appSeal) setupShares(bus [2]*dbus.Config, os linux.System) error { // not fatal fmsg.Verbose(strings.TrimSpace(err.(*fmsg.BaseError).Message())) } else { - dst := path.Join(seal.share, "pulse-cookie") innerDst := fst.Tmp + "/pulse-cookie" seal.sys.bwrap.SetEnv[pulseCookie] = innerDst - seal.sys.CopyFile(dst, src) - seal.sys.bwrap.Bind(dst, innerDst) + payload := new([]byte) + seal.sys.bwrap.CopyBindRef(innerDst, &payload) + seal.sys.CopyFile(payload, src, 256, 256) } } -- cgit v1.3.1