From 83a1c75f1ac4d2d611b3a96474ed07df3cb557b6 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 18 Aug 2025 02:24:56 +0900 Subject: app: set up acl on X11 socket The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging https://git.gensokyo.uk/security/hakurei/pulls/1. Signed-off-by: Ophestra --- test/sandbox/case/mapuid.nix | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'test/sandbox/case/mapuid.nix') diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix index 1069f9fa..18d82e77 100644 --- a/test/sandbox/case/mapuid.nix +++ b/test/sandbox/case/mapuid.nix @@ -34,6 +34,7 @@ in mapRealUid = true; useCommonPaths = true; userns = false; + x11 = false; # 0, PresetStrict expectedFilter = { @@ -266,5 +267,9 @@ in ]; seccomp = true; + + try_socket = "/tmp/.X11-unix/X0"; + socket_abstract = true; + socket_pathname = false; }; } -- cgit v1.3.1