From 86cb5ac1dbd581078b10f5ec1eb723549c662a1b Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Thu, 10 Oct 2024 12:44:08 +0900 Subject: app: hardlink sockets to process-specific share local to XDG_RUNTIME_DIR This avoids adding ACLs to the PulseAudio directory. Signed-off-by: Ophestra Umiker --- internal/app/share.runtime.go | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'internal/app/share.runtime.go') diff --git a/internal/app/share.runtime.go b/internal/app/share.runtime.go index e43effe2..444d85a2 100644 --- a/internal/app/share.runtime.go +++ b/internal/app/share.runtime.go @@ -16,6 +16,7 @@ const ( func (seal *appSeal) shareRuntime() { // ensure RunDir (e.g. `/run/user/%d/fortify`) seal.sys.ensure(seal.RunDirPath, 0700) + seal.sys.updatePerm(seal.RunDirPath, acl.Execute) // ensure runtime directory ACL (e.g. `/run/user/%d`) seal.sys.updatePerm(seal.RuntimePath, acl.Execute) @@ -28,6 +29,11 @@ func (seal *appSeal) shareRuntime() { // acl is unnecessary as this directory is world executable seal.share = path.Join(seal.SharePath, seal.id.String()) seal.sys.ensureEphemeral(seal.share, 0701) + + // ensure process-specific share local to XDG_RUNTIME_DIR (e.g. `/run/user/%d/fortify/%s`) + seal.shareLocal = path.Join(seal.RunDirPath, seal.id.String()) + seal.sys.ensureEphemeral(seal.shareLocal, 0700) + seal.sys.updatePerm(seal.shareLocal, acl.Execute) } func (seal *appSeal) shareRuntimeChild() string { -- cgit v1.3.1