From 1302bcede057538665a4eb626357409d8cb515e8 Mon Sep 17 00:00:00 2001 From: Ophestra Umiker Date: Mon, 14 Oct 2024 02:27:02 +0900 Subject: init: custom init process inside sandbox Bubblewrap as init is a bit awkward and don't support a few setup actions fortify will need, such as starting/supervising nscd. Signed-off-by: Ophestra Umiker --- main.go | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'main.go') diff --git a/main.go b/main.go index 9ccdf0bc..6f1ab571 100644 --- a/main.go +++ b/main.go @@ -8,6 +8,7 @@ import ( "git.ophivana.moe/cat/fortify/internal" "git.ophivana.moe/cat/fortify/internal/app" + init0 "git.ophivana.moe/cat/fortify/internal/init" "git.ophivana.moe/cat/fortify/internal/shim" "git.ophivana.moe/cat/fortify/internal/verbose" ) @@ -27,15 +28,14 @@ func main() { // linux/sched/coredump.h if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, 0, 0); errno != 0 { fmt.Printf("fortify: cannot set SUID_DUMP_DISABLE: %s", errno.Error()) - } else { - verbose.Println("prctl(PR_SET_DUMPABLE, SUID_DUMP_DISABLE) succeeded") } if internal.SdBootedV { verbose.Println("system booted with systemd as init system") } - // shim early exit + // shim/init early exit + init0.Try() shim.Try() // root check -- cgit v1.3.1