From af15b1c048e97c092f7a5eeb30f20d13cd972486 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Mon, 4 Nov 2024 03:15:39 +0900 Subject: app: support mapping target uid as privileged uid in sandbox Chromium's D-Bus client implementation refuses to work when its getuid call returns a different value than what the D-Bus server is running as. The reason behind this is not fully understood, but this workaround is implemented to support chromium and electron apps. This is not used by default since it has many side effects that break many other programs, like SSH on NixOS. Signed-off-by: Ophestra Umiker --- internal/app/share.system.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'internal/app/share.system.go') diff --git a/internal/app/share.system.go b/internal/app/share.system.go index 26e9b568..08b006c3 100644 --- a/internal/app/share.system.go +++ b/internal/app/share.system.go @@ -58,12 +58,12 @@ func (seal *appSeal) sharePasswd(os linux.System) { homeDir = seal.sys.user.HomeDir seal.sys.bwrap.SetEnv["HOME"] = seal.sys.user.HomeDir } - passwd := username + ":x:" + mappedIDString + ":" + mappedIDString + ":Fortify:" + homeDir + ":" + sh + "\n" + passwd := username + ":x:" + seal.sys.mappedIDString + ":" + seal.sys.mappedIDString + ":Fortify:" + homeDir + ":" + sh + "\n" seal.sys.Write(passwdPath, passwd) // write /etc/group groupPath := path.Join(seal.share, "group") - seal.sys.Write(groupPath, "fortify:x:"+mappedIDString+":\n") + seal.sys.Write(groupPath, "fortify:x:"+seal.sys.mappedIDString+":\n") // bind /etc/passwd and /etc/group seal.sys.bwrap.Bind(passwdPath, "/etc/passwd") -- cgit v1.3.1