From 54610aaddcc01e335c34087bc0c3bc1de6d23cf8 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 15 Dec 2025 12:43:58 +0900 Subject: internal/outcome: expose pipewire via pipewire-pulse This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst. Closes #29. Signed-off-by: Ophestra --- test/sandbox/case/mapuid.nix | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) (limited to 'test/sandbox/case/mapuid.nix') diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix index 569be230..8b2a635e 100644 --- a/test/sandbox/case/mapuid.nix +++ b/test/sandbox/case/mapuid.nix @@ -49,7 +49,6 @@ in env = [ "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus" "HOME=/var/lib/hakurei/u0/a3" - "PIPEWIRE_REMOTE=/run/user/1000/pipewire-0" "SHELL=/run/current-system/sw/bin/bash" "TERM=linux" "USER=u0_a3" @@ -57,6 +56,7 @@ in "XDG_RUNTIME_DIR=/run/user/1000" "XDG_SESSION_CLASS=user" "XDG_SESSION_TYPE=wayland" + "PULSE_SERVER=unix:/run/user/1000/pulse/native" ]; fs = fs "dead" { @@ -163,12 +163,8 @@ in user = fs "800001ed" { "1000" = fs "800001f8" { bus = fs "10001fd" null null; - pulse = fs "800001c0" { - native = fs "10001ff" null null; - pid = fs "1a4" null null; - } null; + pulse = fs "800001c0" { native = fs "10001ff" null null; } null; wayland-0 = fs "1000038" null null; - pipewire-0 = fs "1000038" null null; } null; } null; } null; @@ -256,7 +252,6 @@ in (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003") (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003") (ent ignore "/run/user/1000/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") - (ent ignore "/run/user/1000/pipewire-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent ignore "/run/user/1000/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") @@ -273,6 +268,7 @@ in (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir=/host/nix/.ro-store:/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,userxattr") (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/var/lib/hakurei/u0/a3" "/var/lib/hakurei/u0/a3" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") + (ent ignore "/run/user/1000/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") ]; seccomp = true; -- cgit v1.3.1