From 2faf510146733c28a5dbc3245175700abcf4f966 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Tue, 15 Oct 2024 02:15:55 +0900 Subject: helper/bwrap: ordered filesystem args The argument builder was written based on the incorrect assumption that bwrap arguments are unordered. The argument builder is replaced in this commit to correct that mistake. Signed-off-by: Ophestra Umiker --- internal/app/share.system.go | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) (limited to 'internal/app/share.system.go') diff --git a/internal/app/share.system.go b/internal/app/share.system.go index 1b17ca49..e1a3e1de 100644 --- a/internal/app/share.system.go +++ b/internal/app/share.system.go @@ -3,6 +3,9 @@ package app import ( "os" "path" + + "git.ophivana.moe/cat/fortify/acl" + "git.ophivana.moe/cat/fortify/internal/state" ) const ( @@ -38,6 +41,24 @@ func (seal *appSeal) shareSystem() { seal.sys.writeFile(groupPath, []byte("fortify:x:65534:\n")) // bind /etc/passwd and /etc/group - seal.sys.bind(passwdPath, "/etc/passwd", true) - seal.sys.bind(groupPath, "/etc/group", true) + seal.sys.bwrap.Bind(passwdPath, "/etc/passwd") + seal.sys.bwrap.Bind(groupPath, "/etc/group") +} + +func (seal *appSeal) shareTmpdirChild() string { + // ensure child tmpdir parent directory (e.g. `/tmp/fortify.%d/tmpdir`) + targetTmpdirParent := path.Join(seal.SharePath, "tmpdir") + seal.sys.ensure(targetTmpdirParent, 0700) + seal.sys.updatePermTag(state.EnableLength, targetTmpdirParent, acl.Execute) + + // ensure child tmpdir (e.g. `/tmp/fortify.%d/tmpdir/%d`) + targetTmpdir := path.Join(targetTmpdirParent, seal.sys.Uid) + seal.sys.ensure(targetTmpdir, 01700) + seal.sys.updatePermTag(state.EnableLength, targetTmpdir, acl.Read, acl.Write, acl.Execute) + seal.sys.bwrap.Bind(targetTmpdir, "/tmp", false, true) + + // mount tmpfs on inner shared directory (e.g. `/tmp/fortify.%d`) + seal.sys.bwrap.Tmpfs(seal.SharePath, 1*1024*1024) + + return targetTmpdir } -- cgit v1.3.1