From ec5e91b8c97f02707a70a789ba4af84d51394ea5 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Tue, 25 Mar 2025 04:42:30 +0900 Subject: system: optimise string formatting Signed-off-by: Ophestra --- internal/app/app_nixos_test.go | 2 +- internal/app/app_pd_test.go | 2 +- internal/app/process.go | 31 +++++++++---------------------- internal/app/seal.go | 10 +++++----- 4 files changed, 16 insertions(+), 29 deletions(-) (limited to 'internal') diff --git a/internal/app/app_nixos_test.go b/internal/app/app_nixos_test.go index ca9fde08..d89d099b 100644 --- a/internal/app/app_nixos_test.go +++ b/internal/app/app_nixos_test.go @@ -45,7 +45,7 @@ var testCasesNixos = []sealTestCase{ Call: map[string]string{}, Broadcast: map[string]string{}, Filter: true, }, - Enablements: system.EWayland.Mask() | system.EDBus.Mask() | system.EPulse.Mask(), + Enablements: system.EWayland | system.EDBus | system.EPulse, }, }, fst.ID{ diff --git a/internal/app/app_pd_test.go b/internal/app/app_pd_test.go index 15355797..bde436f2 100644 --- a/internal/app/app_pd_test.go +++ b/internal/app/app_pd_test.go @@ -196,7 +196,7 @@ var testCasesPd = []sealTestCase{ }, Filter: true, }, - Enablements: system.EWayland.Mask() | system.EDBus.Mask() | system.EPulse.Mask(), + Enablements: system.EWayland | system.EDBus | system.EPulse, }, }, fst.ID{ diff --git a/internal/app/process.go b/internal/app/process.go index 6c337142..00f66432 100644 --- a/internal/app/process.go +++ b/internal/app/process.go @@ -5,7 +5,6 @@ import ( "errors" "log" "os/exec" - "strings" "time" "git.gensokyo.uk/security/fortify/fst" @@ -54,17 +53,16 @@ func (seal *outcome) Run(rs *fst.RunState) error { revert app setup transaction */ - rt, ec := new(system.Enablements), new(system.Criteria) - ec.Enablements = new(system.Enablements) - ec.Set(system.Process) + var rt system.Enablement + ec := system.Process if states, err := c.Load(); err != nil { // revert per-process state here to limit damage storeErr.OpErr = err - return seal.sys.Revert(ec) + return seal.sys.Revert((*system.Criteria)(&ec)) } else { if l := len(states); l == 0 { fmsg.Verbose("no other launchers active, will clean up globals") - ec.Set(system.User) + ec |= system.User } else { fmsg.Verbosef("found %d active launchers, cleaning up without globals", l) } @@ -72,31 +70,20 @@ func (seal *outcome) Run(rs *fst.RunState) error { // accumulate enablements of remaining launchers for i, s := range states { if s.Config != nil { - *rt |= s.Config.Confinement.Enablements + rt |= s.Config.Confinement.Enablements } else { log.Printf("state entry %d does not contain config", i) } } } - // invert accumulated enablements for cleanup - for i := system.Enablement(0); i < system.Enablement(system.ELen); i++ { - if !rt.Has(i) { - ec.Set(i) - } - } + ec |= rt ^ (system.EWayland | system.EX11 | system.EDBus | system.EPulse) if fmsg.Load() { - labels := make([]string, 0, system.ELen+1) - for i := system.Enablement(0); i < system.Enablement(system.ELen+2); i++ { - if ec.Has(i) { - labels = append(labels, system.TypeString(i)) - } - } - if len(labels) > 0 { - fmsg.Verbose("reverting operations type", strings.Join(labels, ", ")) + if ec > 0 { + fmsg.Verbose("reverting operations type", system.TypeString(ec)) } } - return seal.sys.Revert(ec) + return seal.sys.Revert((*system.Criteria)(&ec)) }() }) storeErr.save([]error{revertErr, store.Close()}) diff --git a/internal/app/seal.go b/internal/app/seal.go index a25897dc..549de160 100644 --- a/internal/app/seal.go +++ b/internal/app/seal.go @@ -224,7 +224,7 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co conf.Cover = append(conf.Cover, nscd) } // bind GPU stuff - if config.Confinement.Enablements.Has(system.EX11) || config.Confinement.Enablements.Has(system.EWayland) { + if config.Confinement.Enablements&(system.EX11|system.EWayland) != 0 { conf.Filesystem = append(conf.Filesystem, &fst.FilesystemConfig{Src: "/dev/dri", Device: true}) } // opportunistically bind kvm @@ -338,7 +338,7 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co seal.env[term] = t } - if config.Confinement.Enablements.Has(system.EWayland) { + if config.Confinement.Enablements&system.EWayland != 0 { // outer wayland socket (usually `/run/user/%d/wayland-%d`) var socketPath string if name, ok := sys.LookupEnv(wl.WaylandDisplay); !ok { @@ -371,7 +371,7 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co } } - if config.Confinement.Enablements.Has(system.EX11) { + if config.Confinement.Enablements&system.EX11 != 0 { if d, ok := sys.LookupEnv(display); !ok { return fmsg.WrapError(ErrXDisplay, "DISPLAY is not set") @@ -386,7 +386,7 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co PulseAudio server and authentication */ - if config.Confinement.Enablements.Has(system.EPulse) { + if config.Confinement.Enablements&system.EPulse != 0 { // PulseAudio runtime directory (usually `/run/user/%d/pulse`) pulseRuntimeDir := path.Join(sc.RuntimePath, "pulse") // PulseAudio socket (usually `/run/user/%d/pulse/native`) @@ -439,7 +439,7 @@ func (seal *outcome) finalise(ctx context.Context, sys sys.State, config *fst.Co D-Bus proxy */ - if config.Confinement.Enablements.Has(system.EDBus) { + if config.Confinement.Enablements&system.EDBus != 0 { // ensure dbus session bus defaults if config.Confinement.SessionBus == nil { config.Confinement.SessionBus = dbus.NewConfig(config.ID, true, true) -- cgit v1.3.1