From 6bc5be7e5a2334274adf2945ad6d29d063a7086b Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Wed, 23 Oct 2024 21:46:21 +0900 Subject: internal: wrap calls to os standard library functions This change helps tests stub out and simulate OS behaviour during the sealing process. This also removes dependency on XDG_RUNTIME_DIR as the internal.System implementation provided to App provides a compat directory inside the tmpdir-based share when XDG_RUNTIME_DIR is unavailable. Signed-off-by: Ophestra Umiker --- internal/app/share.runtime.go | 1 + 1 file changed, 1 insertion(+) (limited to 'internal/app/share.runtime.go') diff --git a/internal/app/share.runtime.go b/internal/app/share.runtime.go index 1c65aa77..dd3a6b13 100644 --- a/internal/app/share.runtime.go +++ b/internal/app/share.runtime.go @@ -29,6 +29,7 @@ func (seal *appSeal) shareRuntime() { seal.sys.UpdatePermType(system.User, seal.RunDirPath, acl.Execute) // ensure runtime directory ACL (e.g. `/run/user/%d`) + seal.sys.Ensure(seal.RuntimePath, 0700) // ensure this dir in case XDG_RUNTIME_DIR is unset seal.sys.UpdatePermType(system.User, seal.RuntimePath, acl.Execute) // ensure process-specific share local to XDG_RUNTIME_DIR (e.g. `/run/user/%d/fortify/%s`) -- cgit v1.3.1