maemachinebroke/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
797 Commits 7 Branches 12 Tags
625632c59391d73d32389e877179d3e023e224f2
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
cat 625632c593 nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-26 18:57:54 +09:00
cat e71ae3b8c5 container: remove custom cmd initialisation 
This part of the interface is very unintuitive and only used for testing, even in testing it is inelegant and can be done better.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-25 00:45:10 +09:00
cat 9d7a19d162 container: use more reliable nonexistence 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-18 23:18:26 +09:00
cat 6ba19a7ba5 release: 0.1.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-09 05:42:31 +09:00
cat 749a2779f5 test/sandbox: add arm64 constants 
Most of these are differences in qemu.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-09 05:36:35 +09:00
cat e574042d76 test/sandbox: verify seccomp on all test cases 
This change also makes seccomp hashes cross-platform.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-09 04:21:35 +09:00
cat 2b44493e8a test/sandbox: guard on testtool tag 
This tool should not show up when building hakurei normally.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 20:11:29 +09:00
cat c30dd4e630 test/sandbox/seccomp: remove uselib 
This syscall is not wired on all platforms. This test barely does anything anyway and seccomp is covered by the privileged test instrumentation.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 15:28:55 +09:00
cat d90da1c8f5 container/seccomp: add arm64 constants 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 14:58:03 +09:00
cat 5853d7700f container/seccomp: move bpf hashes 
Filter programs are different across platforms. This representation is also much more readable.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 14:41:47 +09:00
cat d5c7523726 container/init: fix prctl call 
This is a very silly typo. Luckily has no effect due to an upper layer doing PR_SET_NO_NEW_PRIVS already.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 14:06:14 +09:00
cat ddfcc51b91 container: move capset implementation 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 13:47:13 +09:00
cat 8ebedbd88a container: move syscall constants 
These aren't missing from all targets.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 13:23:01 +09:00
cat 84e8142a2d container/seccomp: move personality constants 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 12:44:32 +09:00
cat 2c7b7ad845 container/seccomp: cross-platform sysnum cutoff 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 12:27:00 +09:00
cat 72c2b66fc0 nix: cross-platform syscall wrapper 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-07 04:22:55 +09:00
cat 356b42a406 container/init: use /proc/self as intermediate 
Setting up via /tmp is okay, /proc/self/fd makes a lot more sense though for reasons described in the comment.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-06 02:14:35 +09:00
cat d9b6d48e7c add miscellaneous badges 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 18:04:09 +09:00
cat 087959e81b app: remove split implementation 
It is completely nonsensical and highly error-prone to have multiple implementations of this in the same build. This should be switched at compile time instead therefore the split packages are pointless.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 04:36:59 +09:00
cat e6967b8bbb release: 0.1.0 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 03:42:58 +09:00
cat d2f9a9b83b treewide: migrate to hakurei.app 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 03:30:39 +09:00
cat 1b5ecd9eaf container: move out of toplevel 
This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-03 02:59:43 +09:00
cat 82561d62b6 system: move system access packages 
These packages loosely belong in the "system" package and "system" provides high level wrappers for all of them.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 21:52:07 +09:00
cat eec021cc4b hakurei: move container helpers toplevel 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 21:31:29 +09:00
cat a1d98823f8 hakurei: move container toplevel 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 21:23:55 +09:00
cat 255b77d91d cmd/hakurei: move command handlers 
The hakurei command is a bit ugly since it's also used for validating the command package. This alleviates some of the ugliness.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 20:59:17 +09:00
cat f84ec5a3f8 sandbox/wl: track generated files 
This allows the package to be imported.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 20:52:22 +09:00
cat eb22a8bcc1 cmd/hakurei: move to cmd 
Having it at the project root never made sense since the "ego" name was deprecated. This change finally addresses it.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 20:42:51 +09:00
cat 31aef905fa sandbox: expose seccomp interface 
There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 04:47:13 +09:00
cat a6887f7253 sandbox/seccomp: import dot for syscall 
This significantly increases readability in some places.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 02:30:35 +09:00
cat 69bd581af7 sandbox/seccomp: append suffix to ops 
This avoids clashes with stdlib names to allow for . imports.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 01:09:04 +09:00
cat 26b7afc890 sandbox/seccomp: prepare -> export 
Export makes a lot more sense, and also matches the libseccomp function.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 00:32:48 +09:00
cat d5532aade0 sandbox/seccomp: native rule slice in helpers 
These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 00:22:27 +09:00
cat 0c5409aec7 sandbox/seccomp: native rule type alias 
This makes it easier to keep API stable.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-02 00:00:08 +09:00
cat 1a8840bebc sandbox/seccomp: resolve rules natively 
This enables loading syscall filter policies from external cross-platform config files.

This also removes a significant amount of C code.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 22:11:32 +09:00
cat 1fb453dffe sandbox/seccomp: extra constants 
These all resolve to pseudo syscall numbers in libseccomp, but are necessary anyway for other platforms.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 20:15:42 +09:00
cat e03d702d08 sandbox/seccomp: implement syscall lookup 
This uses the Go map and is verified against libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 00:35:27 +09:00
cat 241dc964a6 sandbox/seccomp: wire extra syscall 
These values are only useful for libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-01 00:32:08 +09:00
cat 8ef71e14d5 sandbox/seccomp: emit syscall constants 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-30 20:34:33 +09:00
cat 972f4006f0 treewide: switch to hakurei.app 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-26 04:01:02 +09:00
cat 9a8a047908 sandbox/seccomp: syscall name lookup table 
The script is from Go source of same name. The result is checked against libseccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-26 03:49:07 +09:00
cat 863bf69ad3 treewide: reapply clang-format 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 23:43:42 +09:00
cat 0e957cc9c1 release: 0.0.2 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 21:11:11 +09:00
cat aa454b158f cmd/planterette: remove hsu special case 
Remove special case and invoke hakurei out of process.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 20:50:24 +09:00
cat 7007bd6a1c workflows: port release workflow to github 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 20:17:53 +09:00
cat 00efc95ee7 workflows: port test workflow to github 
This is a much less useful port of the test workflow and runs much slower due to runner limitations.

Still better than nothing though.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 19:37:45 +09:00
cat b380bb248c release: 0.0.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 05:05:06 +09:00
cat 87e008d56d treewide: rename to hakurei 
Fortify makes little sense for a container tool.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-25 04:57:41 +09:00
cat 3992073212 dist: move comp to dist 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-18 17:01:16 +09:00
cat ef80b19f2f treewide: switch to clang-format 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-18 13:45:34 +09:00
cat 717771ae80 app: share runtime dir 
This allows apps with the same identity to access the same runtime dir.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-08 03:24:48 +09:00
cat bf5772bd8a nix: deduplicate home-manager merging 
This becomes a problem when extraHomeConfig defines nixos module options.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-08 01:12:18 +09:00
cat 9a7c81a44e nix: go generate in src derivation 
This saves the generated files in the nix store and exposes them for use by external tools.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-07 03:10:36 +09:00
cat b7e991de5b nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-06-05 04:05:39 +09:00
cat 6c1205106d release: 0.4.1 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-26 02:55:19 +09:00
cat 2ffca6984a nix: use reverse-DNS style id as unique identifier 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-25 20:12:30 +09:00
cat dde2516304 dbus: handle bizarre dbus proxy behaviour 
There is a strange behaviour in xdg-dbus-proxy where if any interface string when stripped of a single ".*" suffix does not contain a '.' byte anywhere, the program will exit with code 1 without any output. This checks for such conditions to make the failure less confusing.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-25 19:50:06 +09:00
cat f30a439bcd nix: improve common usability 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-16 04:40:12 +09:00
cat 008e9e7fc5 nix: update flake lock 2025-05-07 21:35:37 +09:00
cat 23aefcd759 fortify: update help strings 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-05-07 19:06:36 +09:00
cat cb8b886446 nix: update flake lock 2025-04-22 22:23:21 +09:00
cat 5979d8b1e0 dbus: clean up wrapper implementation 
The dbus proxy wrapper haven't been updated much ever since the helper interface was introduced.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-16 23:35:17 +09:00
cat e587112e63 test: check xdg-dbus-proxy termination 
This process runs outside the application container's pid namespace, so it is a good idea to check whether its lifecycle becomes decoupled from the application.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-15 20:45:31 +09:00
cat d6cf736abf release: 0.4.0 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-13 11:10:45 +09:00
cat 15011c4173 app/instance/common: optimise ops allocation 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-13 03:49:07 +09:00
cat 31b7ddd122 fst: improve config 
The config struct more or less "grew" to what it is today. This change moves things around to make more sense and fixes nonsensical comments describing obsolete behaviour.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-13 03:30:19 +09:00
cat c460892cbd fst: check template 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-12 18:00:25 +09:00
cat 6309469e93 app/instance: wrap internal implementation 
This reduces the scope of the fst package, which was growing questionably large.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-12 13:56:41 +09:00
cat 0d7c1a9a43 app: rename app implementation package 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-12 10:54:24 +09:00
cat ae6f5ede19 fst: mount passthrough /dev writable 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-11 20:01:54 +09:00
cat 807d511c8b test/sandbox: check device outcome 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-11 19:55:16 +09:00
cat 2f4f21fb18 fst: rename device field 
Dev is very ambiguous. Rename it here alongside upcoming config changes.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-11 19:32:15 +09:00
cat 9967909460 sandbox: relative autoetc links 
This allows nested containers to use autoetc, and increases compatibility with other implementations.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-11 18:54:00 +09:00
cat c806f43881 sandbox: implement autoetc as setup op 
This significantly reduces setup op count and the readdir call now happens in the context of the init process.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-10 18:54:25 +09:00
cat 584405f7cc sandbox/seccomp: rename flag type and constants 
The names are ambiguous. Rename them to make more sense.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-08 01:59:45 +09:00
cat 50127ed5f9 fortify: print synthesised id in ps 
This is not the full synthesised id so it does not get too long.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-07 21:55:07 +09:00
cat b5eff27c40 fortify: check fst id string length 
This should never be a problem, however in case it happens printing a warning message is better than relying on the runtime to panic.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-07 21:39:46 +09:00
cat 74ba183256 app: install seccomp filter to shim 
This does not necessarily reduce attack surface but does not affect functionality or introduce any side effects, so is nice to have.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-07 04:13:08 +09:00
cat f885dede9b sandbox/seccomp: unexport println wrapper 
This is an implementation detail that was exported for the bwrap argument builder. The removal of that package allows it to be unexported.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-07 04:07:20 +09:00
cat e9a7cd526f app: improve shim process management 
This ensures a signal gets delivered to the process instead of relying on parent death behaviour.

SIGCONT was chosen as it is the only signal an unprivileged process is allowed to send to processes with different credentials.

A custom signal handler is installed because the Go runtime does not expose signal information other than which signal was received, and shim must check pid to ensure reasonable behaviour.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-07 03:55:17 +09:00
cat 12be7bc78e release: 0.3.3 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-01 01:42:10 +09:00
cat 0ba8be659f sandbox: document less obvious parts of setup 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-01 01:21:04 +09:00
cat 022242a84a app: wayland socket in process share 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-01 00:53:04 +09:00
cat 8aeb06f53c app: share path setup on demand 
This removes the unnecessary creation and destruction of share paths when none of the enablements making use of them are set.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-04-01 00:47:32 +09:00
cat 4036da3b5c fst: optional configured shell path 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-31 21:27:31 +09:00
cat 986105958c fortify: update show output 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-31 04:54:10 +09:00
cat ecdd4d8202 fortify: clean ps output 
This format never changed ever since it was added. It used to show everything there is in a process state but that is no longer true for a long time. This change cleans it up in favour of `fortify show` displaying extra information.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-31 04:41:08 +09:00
cat bdee0c3921 nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 23:15:18 +09:00
cat 48f634d046 release: 0.3.2 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 23:05:57 +09:00
cat 2a46f5bb12 sandbox/seccomp: update doc comment 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 23:00:20 +09:00
cat 7f2c0af5ad fst: set multiarch bit 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 22:55:00 +09:00
cat 297b444dfb test: separate app and sandbox 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 22:09:46 +09:00
cat 89a05909a4 test: move test program to sandbox directory 
This prepares for the separation of app and sandbox tests.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 21:09:16 +09:00
cat f772940768 test/sandbox: treat ESRCH as temporary failure 
This is an ugly fix that makes various assumptions guaranteed to hold true in the testing vm. The test package is filtered by the build system so some ugliness is tolerable here.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 03:50:59 +09:00
cat 8886c40974 test/sandbox: separate check filter 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-30 02:15:08 +09:00
cat 8b62e08b44 test: build test program in nixos config 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-29 19:33:17 +09:00
cat 72c59f9229 nix: check share/applications in share package 
This allows share directories without share/applications/ to build correctly.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-29 19:28:20 +09:00
cat ff3cfbb437 test/sandbox: check seccomp outcome 
This is as ugly as it is because it has to have CAP_SYS_ADMIN and not be in seccomp mode.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-28 02:24:27 +09:00
cat c13eb70d7d sandbox/seccomp: add fortify default sample 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-28 02:02:02 +09:00
cat 389402f955 test/sandbox/ptrace: generic filter block type 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-03-28 01:47:24 +09:00