From df33123bd7f1e0cb4e98580b7e63818c82aa7206 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Sat, 16 Nov 2024 21:19:45 +0900 Subject: app: integrate fsu This removes the dependency on external user switchers like sudo/machinectl and decouples fortify user ids from the passwd database. Signed-off-by: Ophestra Umiker --- internal/app/system.go | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) (limited to 'internal/app/system.go') diff --git a/internal/app/system.go b/internal/app/system.go index 47bbd7ed..6a03b92f 100644 --- a/internal/app/system.go +++ b/internal/app/system.go @@ -1,8 +1,6 @@ package app import ( - "os/user" - "git.ophivana.moe/security/fortify/dbus" "git.ophivana.moe/security/fortify/helper/bwrap" "git.ophivana.moe/security/fortify/internal/linux" @@ -18,7 +16,7 @@ type appSealSys struct { // default formatted XDG_RUNTIME_DIR of User runtime string // target user sealed from config - user *user.User + user appUser // mapped uid and gid in user namespace mappedID int @@ -32,6 +30,26 @@ type appSealSys struct { // protected by upstream mutex } +type appUser struct { + // full uid resolved by fsu + uid int + // string representation of uid + us string + + // supplementary group ids + supp []string + + // application id + aid int + // string representation of aid + as string + + // app user home directory + home string + // passwd database username + username string +} + // shareAll calls all share methods in sequence func (seal *appSeal) shareAll(bus [2]*dbus.Config, os linux.System) error { if seal.shared { -- cgit v1.3.1