From 2faf510146733c28a5dbc3245175700abcf4f966 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Tue, 15 Oct 2024 02:15:55 +0900 Subject: helper/bwrap: ordered filesystem args The argument builder was written based on the incorrect assumption that bwrap arguments are unordered. The argument builder is replaced in this commit to correct that mistake. Signed-off-by: Ophestra Umiker --- internal/shim/parent.go | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'internal/shim') diff --git a/internal/shim/parent.go b/internal/shim/parent.go index 98856555..59be5885 100644 --- a/internal/shim/parent.go +++ b/internal/shim/parent.go @@ -8,12 +8,13 @@ import ( "os" "syscall" + "git.ophivana.moe/cat/fortify/acl" "git.ophivana.moe/cat/fortify/internal/verbose" ) // called in the parent process -func ServeConfig(socket string, payload *Payload, wl string, done chan struct{}) (*net.UnixConn, error) { +func ServeConfig(socket string, uid int, payload *Payload, wl string, done chan struct{}) (*net.UnixConn, error) { var ws *net.UnixConn if payload.WL { if f, err := net.DialUnix("unix", nil, &net.UnixAddr{Name: wl, Net: "unix"}); err != nil { @@ -28,7 +29,7 @@ func ServeConfig(socket string, payload *Payload, wl string, done chan struct{}) return nil, err } else { verbose.Println("configuring shim on socket", socket) - if err = os.Chmod(socket, 0777); err != nil { + if err = acl.UpdatePerm(socket, uid, acl.Read, acl.Write, acl.Execute); err != nil { fmt.Println("fortify: cannot change permissions of shim setup socket:", err) } @@ -39,6 +40,7 @@ func ServeConfig(socket string, payload *Payload, wl string, done chan struct{}) } else { if err = gob.NewEncoder(conn).Encode(*payload); err != nil { fmt.Println("fortify: cannot stream shim payload:", err) + _ = os.Remove(socket) return } -- cgit v1.3.1