From 54610aaddcc01e335c34087bc0c3bc1de6d23cf8 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Mon, 15 Dec 2025 12:43:58 +0900 Subject: internal/outcome: expose pipewire via pipewire-pulse This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst. Closes #29. Signed-off-by: Ophestra --- test/sandbox/case/device.nix | 10 +++------- test/sandbox/case/mapuid.nix | 10 +++------- test/sandbox/case/pdlike.nix | 10 +++------- test/sandbox/case/preset.nix | 10 +++------- test/sandbox/case/tty.nix | 10 +++------- test/test.py | 7 +++---- 6 files changed, 18 insertions(+), 39 deletions(-) (limited to 'test') diff --git a/test/sandbox/case/device.nix b/test/sandbox/case/device.nix index 37581034..b9dc4b33 100644 --- a/test/sandbox/case/device.nix +++ b/test/sandbox/case/device.nix @@ -41,7 +41,6 @@ in "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus" "DISPLAY=unix:/tmp/.X11-unix/X0" "HOME=/var/lib/hakurei/u0/a4" - "PIPEWIRE_REMOTE=/run/user/65534/pipewire-0" "SHELL=/run/current-system/sw/bin/bash" "TERM=linux" "USER=u0_a4" @@ -49,6 +48,7 @@ in "XDG_RUNTIME_DIR=/run/user/65534" "XDG_SESSION_CLASS=user" "XDG_SESSION_TYPE=wayland" + "PULSE_SERVER=unix:/run/user/65534/pulse/native" ]; fs = fs "dead" { @@ -138,12 +138,8 @@ in user = fs "800001ed" { "65534" = fs "800001c0" { bus = fs "10001fd" null null; - pulse = fs "800001c0" { - native = fs "10001ff" null null; - pid = fs "1a4" null null; - } null; + pulse = fs "800001c0" { native = fs "10001ff" null null; } null; wayland-0 = fs "1000038" null null; - pipewire-0 = fs "1000038" null null; } null; } null; } null; @@ -229,7 +225,6 @@ in (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10004,gid=10004") (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/tmp/.X11-unix" "/tmp/.X11-unix" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") - (ent ignore "/run/user/65534/pipewire-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") @@ -246,6 +241,7 @@ in (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir=/host/nix/.ro-store:/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,userxattr") (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/var/lib/hakurei/u0/a4" "/var/lib/hakurei/u0/a4" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") + (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") ]; seccomp = true; diff --git a/test/sandbox/case/mapuid.nix b/test/sandbox/case/mapuid.nix index 569be230..8b2a635e 100644 --- a/test/sandbox/case/mapuid.nix +++ b/test/sandbox/case/mapuid.nix @@ -49,7 +49,6 @@ in env = [ "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus" "HOME=/var/lib/hakurei/u0/a3" - "PIPEWIRE_REMOTE=/run/user/1000/pipewire-0" "SHELL=/run/current-system/sw/bin/bash" "TERM=linux" "USER=u0_a3" @@ -57,6 +56,7 @@ in "XDG_RUNTIME_DIR=/run/user/1000" "XDG_SESSION_CLASS=user" "XDG_SESSION_TYPE=wayland" + "PULSE_SERVER=unix:/run/user/1000/pulse/native" ]; fs = fs "dead" { @@ -163,12 +163,8 @@ in user = fs "800001ed" { "1000" = fs "800001f8" { bus = fs "10001fd" null null; - pulse = fs "800001c0" { - native = fs "10001ff" null null; - pid = fs "1a4" null null; - } null; + pulse = fs "800001c0" { native = fs "10001ff" null null; } null; wayland-0 = fs "1000038" null null; - pipewire-0 = fs "1000038" null null; } null; } null; } null; @@ -256,7 +252,6 @@ in (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003") (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10003,gid=10003") (ent ignore "/run/user/1000/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") - (ent ignore "/run/user/1000/pipewire-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent ignore "/run/user/1000/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") @@ -273,6 +268,7 @@ in (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir=/host/nix/.ro-store:/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,userxattr") (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/var/lib/hakurei/u0/a3" "/var/lib/hakurei/u0/a3" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") + (ent ignore "/run/user/1000/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") ]; seccomp = true; diff --git a/test/sandbox/case/pdlike.nix b/test/sandbox/case/pdlike.nix index b6ddceee..9be58348 100644 --- a/test/sandbox/case/pdlike.nix +++ b/test/sandbox/case/pdlike.nix @@ -49,7 +49,6 @@ in env = [ "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus" "HOME=/var/lib/hakurei/u0/a5" - "PIPEWIRE_REMOTE=/run/user/65534/pipewire-0" "SHELL=/run/current-system/sw/bin/bash" "TERM=linux" "USER=u0_a5" @@ -57,6 +56,7 @@ in "XDG_RUNTIME_DIR=/run/user/65534" "XDG_SESSION_CLASS=user" "XDG_SESSION_TYPE=wayland" + "PULSE_SERVER=unix:/run/user/65534/pulse/native" ]; fs = fs "dead" { @@ -161,12 +161,8 @@ in user = fs "800001ed" { "65534" = fs "800001f8" { bus = fs "10001fd" null null; - pulse = fs "800001c0" { - native = fs "10001ff" null null; - pid = fs "1a4" null null; - } null; + pulse = fs "800001c0" { native = fs "10001ff" null null; } null; wayland-0 = fs "1000038" null null; - pipewire-0 = fs "1000038" null null; } null; } null; } null; @@ -254,7 +250,6 @@ in (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10005,gid=10005") (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10005,gid=10005") (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") - (ent ignore "/run/user/65534/pipewire-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") @@ -268,6 +263,7 @@ in (ent "/var/tmp" "/var/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/var/lib/hakurei/u0/a5" "/var/lib/hakurei/u0/a5" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") + (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") ]; seccomp = true; diff --git a/test/sandbox/case/preset.nix b/test/sandbox/case/preset.nix index 9b604a72..a333d356 100644 --- a/test/sandbox/case/preset.nix +++ b/test/sandbox/case/preset.nix @@ -49,7 +49,6 @@ in env = [ "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus" "HOME=/var/lib/hakurei/u0/a1" - "PIPEWIRE_REMOTE=/run/user/65534/pipewire-0" "SHELL=/run/current-system/sw/bin/bash" "TERM=linux" "USER=u0_a1" @@ -57,6 +56,7 @@ in "XDG_RUNTIME_DIR=/run/user/65534" "XDG_SESSION_CLASS=user" "XDG_SESSION_TYPE=wayland" + "PULSE_SERVER=unix:/run/user/65534/pulse/native" ]; fs = fs "dead" { @@ -160,12 +160,8 @@ in user = fs "800001ed" { "65534" = fs "800001c0" { bus = fs "10001fd" null null; - pulse = fs "800001c0" { - native = fs "10001ff" null null; - pid = fs "1a4" null null; - } null; + pulse = fs "800001c0" { native = fs "10001ff" null null; } null; wayland-0 = fs "1000038" null null; - pipewire-0 = fs "1000038" null null; } null; } null; } null; @@ -251,7 +247,6 @@ in (ent ignore "/etc/passwd" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10001,gid=10001") (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10001,gid=10001") (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") - (ent ignore "/run/user/65534/pipewire-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") @@ -265,6 +260,7 @@ in (ent "/var/tmp" "/var/tmp" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/var/lib/hakurei/u0/a1" "/var/lib/hakurei/u0/a1" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") + (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") ]; seccomp = true; diff --git a/test/sandbox/case/tty.nix b/test/sandbox/case/tty.nix index 87749c61..7c00baed 100644 --- a/test/sandbox/case/tty.nix +++ b/test/sandbox/case/tty.nix @@ -50,7 +50,6 @@ in "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/65534/bus" "DISPLAY=:0" "HOME=/var/lib/hakurei/u0/a2" - "PIPEWIRE_REMOTE=/run/user/65534/pipewire-0" "SHELL=/run/current-system/sw/bin/bash" "TERM=linux" "USER=u0_a2" @@ -58,6 +57,7 @@ in "XDG_RUNTIME_DIR=/run/user/65534" "XDG_SESSION_CLASS=user" "XDG_SESSION_TYPE=wayland" + "PULSE_SERVER=unix:/run/user/65534/pulse/native" ]; fs = fs "dead" { @@ -165,12 +165,8 @@ in user = fs "800001ed" { "65534" = fs "800001f8" { bus = fs "10001fd" null null; - pulse = fs "800001c0" { - native = fs "10001ff" null null; - pid = fs "1a4" null null; - } null; + pulse = fs "800001c0" { native = fs "10001ff" null null; } null; wayland-0 = fs "1000038" null null; - pipewire-0 = fs "1000038" null null; } null; } null; } null; @@ -262,7 +258,6 @@ in (ent ignore "/etc/group" "ro,nosuid,nodev,relatime" "tmpfs" "rootfs" "rw,uid=10002,gid=10002") (ent ignore "/run/user/65534/wayland-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/tmp/.X11-unix" "/tmp/.X11-unix" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") - (ent ignore "/run/user/65534/pipewire-0" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent ignore "/run/user/65534/bus" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/bin" "/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/usr/bin" "/usr/bin" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") @@ -279,6 +274,7 @@ in (ent "/" "/.hakurei/store" "rw,relatime" "overlay" "overlay" "rw,lowerdir=/host/nix/.ro-store:/host/nix/.rw-store/upper,upperdir=/host/tmp/.hakurei-store-rw/upper,workdir=/host/tmp/.hakurei-store-rw/work,redirect_dir=nofollow,uuid=on,userxattr") (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") (ent "/var/lib/hakurei/u0/a2" "/var/lib/hakurei/u0/a2" "rw,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") + (ent ignore "/run/user/65534/pulse/native" "ro,nosuid,nodev,relatime" "ext4" "/dev/vda" "rw") ]; seccomp = true; diff --git a/test/test.py b/test/test.py index 9b06a8f2..194c2d3a 100644 --- a/test/test.py +++ b/test/test.py @@ -226,15 +226,14 @@ machine.send_chars("clear; pactl info && touch /var/tmp/pulse-ok\n") machine.wait_for_file("/var/tmp/pulse-ok", timeout=15) collect_state_ui("pulse_wayland") check_state("pa-foot", {"wayland": True, "pipewire": True}) -# Test PipeWire: -machine.send_chars("clear; pw-cli i 0 && touch /var/tmp/pw-ok\n") -machine.wait_for_file("/var/tmp/pw-ok", timeout=15) -collect_state_ui("pipewire_wayland") machine.send_chars("exit\n") machine.wait_until_fails("pgrep foot", timeout=5) # Test PipeWire SecurityContext: machine.succeed("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei -v run --pulse pactl info") machine.fail("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei -v run --pulse pactl set-sink-mute @DEFAULT_SINK@ toggle") +# Test PipeWire direct access: +machine.succeed("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 pw-dump") +machine.fail("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei -v run --pipewire pw-dump") # Test XWayland (foot does not support X): swaymsg("exec x11-alacritty") -- cgit v1.3.1