hakurei

Author	SHA1	Message	Date
cat	b7e991de5b	nix: update flake lock Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-05 04:05:39 +09:00
cat	6c1205106d	release: 0.4.1 Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-26 02:55:19 +09:00
cat	2ffca6984a	nix: use reverse-DNS style id as unique identifier Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-25 20:12:30 +09:00
cat	dde2516304	dbus: handle bizarre dbus proxy behaviour There is a strange behaviour in xdg-dbus-proxy where if any interface string when stripped of a single ".*" suffix does not contain a '.' byte anywhere, the program will exit with code 1 without any output. This checks for such conditions to make the failure less confusing. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-25 19:50:06 +09:00
cat	f30a439bcd	nix: improve common usability Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-16 04:40:12 +09:00
cat	008e9e7fc5	nix: update flake lock	2025-05-07 21:35:37 +09:00
cat	23aefcd759	fortify: update help strings Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-07 19:06:36 +09:00
cat	cb8b886446	nix: update flake lock	2025-04-22 22:23:21 +09:00
cat	5979d8b1e0	dbus: clean up wrapper implementation The dbus proxy wrapper haven't been updated much ever since the helper interface was introduced. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-16 23:35:17 +09:00
cat	e587112e63	test: check xdg-dbus-proxy termination This process runs outside the application container's pid namespace, so it is a good idea to check whether its lifecycle becomes decoupled from the application. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-15 20:45:31 +09:00
cat	d6cf736abf	release: 0.4.0 Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-13 11:10:45 +09:00
cat	15011c4173	app/instance/common: optimise ops allocation Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-13 03:49:07 +09:00
cat	31b7ddd122	fst: improve config The config struct more or less "grew" to what it is today. This change moves things around to make more sense and fixes nonsensical comments describing obsolete behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-13 03:30:19 +09:00
cat	c460892cbd	fst: check template Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-12 18:00:25 +09:00
cat	6309469e93	app/instance: wrap internal implementation This reduces the scope of the fst package, which was growing questionably large. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-12 13:56:41 +09:00
cat	0d7c1a9a43	app: rename app implementation package Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-12 10:54:24 +09:00
cat	ae6f5ede19	fst: mount passthrough /dev writable Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-11 20:01:54 +09:00
cat	807d511c8b	test/sandbox: check device outcome Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-11 19:55:16 +09:00
cat	2f4f21fb18	fst: rename device field Dev is very ambiguous. Rename it here alongside upcoming config changes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-11 19:32:15 +09:00
cat	9967909460	sandbox: relative autoetc links This allows nested containers to use autoetc, and increases compatibility with other implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-11 18:54:00 +09:00
cat	c806f43881	sandbox: implement autoetc as setup op This significantly reduces setup op count and the readdir call now happens in the context of the init process. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-10 18:54:25 +09:00
cat	584405f7cc	sandbox/seccomp: rename flag type and constants The names are ambiguous. Rename them to make more sense. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-08 01:59:45 +09:00
cat	50127ed5f9	fortify: print synthesised id in ps This is not the full synthesised id so it does not get too long. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-07 21:55:07 +09:00
cat	b5eff27c40	fortify: check fst id string length This should never be a problem, however in case it happens printing a warning message is better than relying on the runtime to panic. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-07 21:39:46 +09:00
cat	74ba183256	app: install seccomp filter to shim This does not necessarily reduce attack surface but does not affect functionality or introduce any side effects, so is nice to have. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-07 04:13:08 +09:00
cat	f885dede9b	sandbox/seccomp: unexport println wrapper This is an implementation detail that was exported for the bwrap argument builder. The removal of that package allows it to be unexported. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-07 04:07:20 +09:00
cat	e9a7cd526f	app: improve shim process management This ensures a signal gets delivered to the process instead of relying on parent death behaviour. SIGCONT was chosen as it is the only signal an unprivileged process is allowed to send to processes with different credentials. A custom signal handler is installed because the Go runtime does not expose signal information other than which signal was received, and shim must check pid to ensure reasonable behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-07 03:55:17 +09:00
cat	12be7bc78e	release: 0.3.3 Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-01 01:42:10 +09:00
cat	0ba8be659f	sandbox: document less obvious parts of setup Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-01 01:21:04 +09:00
cat	022242a84a	app: wayland socket in process share Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-01 00:53:04 +09:00
cat	8aeb06f53c	app: share path setup on demand This removes the unnecessary creation and destruction of share paths when none of the enablements making use of them are set. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-01 00:47:32 +09:00
cat	4036da3b5c	fst: optional configured shell path Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-31 21:27:31 +09:00
cat	986105958c	fortify: update show output Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-31 04:54:10 +09:00
cat	ecdd4d8202	fortify: clean ps output This format never changed ever since it was added. It used to show everything there is in a process state but that is no longer true for a long time. This change cleans it up in favour of `fortify show` displaying extra information. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-31 04:41:08 +09:00
cat	bdee0c3921	nix: update flake lock Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 23:15:18 +09:00
cat	48f634d046	release: 0.3.2 Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 23:05:57 +09:00
cat	2a46f5bb12	sandbox/seccomp: update doc comment Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 23:00:20 +09:00
cat	7f2c0af5ad	fst: set multiarch bit Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 22:55:00 +09:00
cat	297b444dfb	test: separate app and sandbox Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 22:09:46 +09:00
cat	89a05909a4	test: move test program to sandbox directory This prepares for the separation of app and sandbox tests. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 21:09:16 +09:00
cat	f772940768	test/sandbox: treat ESRCH as temporary failure This is an ugly fix that makes various assumptions guaranteed to hold true in the testing vm. The test package is filtered by the build system so some ugliness is tolerable here. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 03:50:59 +09:00
cat	8886c40974	test/sandbox: separate check filter Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-30 02:15:08 +09:00
cat	8b62e08b44	test: build test program in nixos config Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-29 19:33:17 +09:00
cat	72c59f9229	nix: check share/applications in share package This allows share directories without share/applications/ to build correctly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-29 19:28:20 +09:00
cat	ff3cfbb437	test/sandbox: check seccomp outcome This is as ugly as it is because it has to have CAP_SYS_ADMIN and not be in seccomp mode. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-28 02:24:27 +09:00
cat	c13eb70d7d	sandbox/seccomp: add fortify default sample Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-28 02:02:02 +09:00
cat	389402f955	test/sandbox/ptrace: generic filter block type Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-28 01:47:24 +09:00
cat	660a2898dc	test/sandbox/ptrace: dump seccomp bpf program Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-28 01:35:56 +09:00
cat	faf59e12c0	test/sandbox: expose test tool Some test elements implemented in the test tool might need to run outside the sandbox. This change allows that to happen. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-28 00:08:47 +09:00
cat	d97a03c7c6	test/sandbox: separate test tool source This improves readability and allows gofmt to format the file. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 23:43:13 +09:00
cat	a102178019	sys: update doc comment Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 22:43:17 +09:00
cat	e400862a12	state/multi: fix backend cache population race This race is never able to happen since no caller concurrently requests the same aid yet. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 22:37:08 +09:00
cat	184e9db2b2	sandbox: support privileged container Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 19:40:19 +09:00
cat	605d018be2	app/seal: check for '=' in envv Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 18:25:23 +09:00
cat	78aaae7ee0	helper/args: copy args on wt creation Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 18:22:07 +09:00
cat	5c82f1ed3e	helper/stub: output to stdout Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 17:25:10 +09:00
cat	f8502c3ece	test/sandbox: check environment Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 03:16:33 +09:00
cat	996b42634d	test/sandbox: invoke check program directly Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 03:11:50 +09:00
cat	300571af47	app: pass through $SHELL Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 01:22:40 +09:00
cat	32c90ef4e7	nix: pass through exec arguments This is useful for when a wrapper script is unnecessary. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-27 03:04:46 +09:00
cat	2a4e2724a3	release: 0.3.1 Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 07:48:50 +09:00
cat	d613257841	sandbox/init: clear inheritable set Inheritable should not be able to affect anything regardless of its value, due to no_new_privs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 07:46:13 +09:00
cat	18644d90be	sandbox: wrap capset syscall Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 07:44:07 +09:00
cat	52fcc48ac1	sandbox/init: drop capabilities During development the syscall filter caused me to make an incorrect assumption about SysProcAttr. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 06:32:08 +09:00
cat	8b69bcd215	sandbox: cache kernel.cap_last_cap value Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 06:19:19 +09:00
cat	2dd49c437c	app: create XDG_RUNTIME_DIR with perm 0700 Many programs complain about this. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 02:49:37 +09:00
cat	92852d8235	release: 0.3.0 Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 02:18:59 +09:00
cat	371dd5b938	nix: create current-system symlink This is copied at runtime because it appears to be impossible to obtain this path in nix. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 02:06:11 +09:00
cat	4836d570ae	test: raise long timeout to 15 seconds The race detector really slows down container tooling. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 01:59:05 +09:00
cat	985f9442e6	sandbox: copy symlink with magic prefix This does not dereference the symlink, but only reads one level of it. This is useful for symlink targets that are not yet known at the time the configuration is emitted. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 01:42:39 +09:00
cat	67eb28466d	nix: create opengl-driver symlink Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 20:52:20 +09:00
cat	c326c3f97d	fst/sandbox: do not create /etc in advance This is now handled by the setup op. This also gets rid of the hardcoded /etc path. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 20:00:34 +09:00
cat	971c79bb80	sandbox: remove hardcoded parent perm Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 19:49:51 +09:00
cat	f86d868274	sandbox: wrap error with its own text message PathError has a pretty good text message, many of them are wrapped with its own text message. This change adds a function to do just that to improve readability. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 19:42:20 +09:00
cat	33940265a6	sandbox: do not ensure symlink target This masks EEXIST on target and might clobber filesystems and lead to other confusing behaviour. Create its parent instead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 19:30:53 +09:00
cat	b39f3aeb59	helper: remove bubblewrap wrapper Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 05:35:02 +09:00
cat	61dbfeffe7	sandbox/wl: move into sandbox Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 05:26:37 +09:00
cat	532feb4bfa	app: merge shim into app package Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 05:21:47 +09:00
cat	ec5e91b8c9	system: optimise string formatting Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 04:42:30 +09:00
cat	ee51320abf	test: check revert type selection Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 04:37:58 +09:00
cat	5c4058d5ac	app: run in native sandbox Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 01:52:49 +09:00
cat	e732dca762	wl: fix sync pipe keepalive Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 01:33:37 +09:00
cat	a9adcd914b	fortify/parse: omit try fd fallthrough message This reduces noise in verbose output. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 01:21:11 +09:00
cat	3dd4ff29c8	test/sandbox: check mount table length Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:36:53 +09:00
cat	61d86c5e10	test/sandbox: fix stdout tty check Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:23:50 +09:00
cat	d097eaa28f	test/sandbox: unquote fail messages Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:03:53 +09:00
cat	ad3576c164	sandbox: resolve tty name Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:03:07 +09:00
cat	b989a4601a	test/sandbox: fail on mismatched mount entry Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 13:43:32 +09:00
cat	a11237b158	sandbox/vfs: add doc comments Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 13:21:55 +09:00
cat	40f00d570e	sandbox: set mkdir perm Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 12:51:39 +09:00
cat	0eb1bc6301	test/sandbox: verify outcome via mountinfo Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 01:42:38 +09:00
cat	1eb837eab8	test/sandbox: warn about misuse in doc comment Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 23:28:28 +09:00
cat	0a4e633db2	nix: filter test from source Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 22:20:19 +09:00
cat	e8809125d4	sandbox: verify outcome via mountinfo This contains much more information than /proc/mounts and allows for more fields to be checked. This also removes the dependency on the test package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 22:17:36 +09:00
cat	806ce18c0a	test/sandbox: check mapuid outcome Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:56:07 +09:00
cat	b71d2bf534	test/sandbox: check tty outcome This makes no difference currently but has different behaviour in the native sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:28:57 +09:00
cat	46059b1840	test/sandbox: print mismatching file content Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:24:52 +09:00
cat	d2c329bcea	test: format path aid offsets Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:21:14 +09:00
cat	2d379b5a38	test/sandbox: pass want file as argument This avoids building the check program multiple times. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 15:00:59 +09:00
cat	75e0c5d406	test/sandbox: parse full test case This makes declaring multiple tests much cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 14:53:50 +09:00