maemachinebroke/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
496 Commits 7 Branches 12 Tags
d1f83f40d6eb3458bb01d39cf6177d5e6285b27f
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
cat d1f83f40d6 helper/bwrap: rename Write to WriteFile 
In case this might want to be an io.Writer.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-19 00:34:19 +09:00
cat a748d40745 app: store values with string representation 
Improves code readability without changing memory layout.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-19 00:25:00 +09:00
cat 648e1d641a app: separate interface from implementation 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 23:07:28 +09:00
cat 3c327084d3 fst: declare wrappers for sandbox config 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 23:04:13 +09:00
cat ffaa12b9d8 sys: wrap log methods 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 22:52:09 +09:00
cat bf95127332 fst: move App interface declaration 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 22:36:45 +09:00
cat e0f321b2c4 sys: rename from linux 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 18:47:48 +09:00
cat 2c9c7fee5b linux: wrap fsu lookup error 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 17:39:53 +09:00
cat d0400f3c81 fmsg: PrintBaseError skip empty message 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 17:01:26 +09:00
cat e9b0f9faef fmsg: export logBaseError function 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-18 13:02:51 +09:00
cat e85be67fd9 acl: implement Update in C 
The original implementation was effectively just writing C in Go.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 21:39:14 +09:00
cat 7e69893264 acl: rename UpdatePerms to Update 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 20:33:18 +09:00
cat 38a3e6af03 system: make xcb internal 
This package is hauntingly ugly. Move this to internal until it is removed or replaced.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 19:07:53 +09:00
cat 90cb01b274 system: move out of internal 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 19:00:43 +09:00
cat b1e1d5627e system: wrap console output functions 
This eliminates all fmsg imports from internal/system.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 18:17:55 +09:00
cat 3ae2ab652e system/wayland: sync file at caller specified address 
Storing this in sys is incredibly ugly: sys should be stateless and Ops must keep track of their state.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 13:24:17 +09:00
cat db71fbe22b system/tmpfiles: fail gracefully in API misuse 
Panicking here leaves garbage behind. Not ideal if this package is going to be exported.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 12:17:01 +09:00
cat 83e72c2b59 release: 0.2.15 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 00:13:04 +09:00
cat 82a072f641 system/tmpfiles: implement private tmpfiles 
These are only available within the mount namespace and should significantly reduce attack surface.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-17 00:07:52 +09:00
cat 60c10c3f4a nix: run integration tests with race detector 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 20:58:08 +09:00
cat 468696f611 internal: beforeExit before reachable fatal calls 
These are the only two calls to log.Fatal* reachable during suspended output. Call fmsg.BeforeExit here to catch that.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 19:03:34 +09:00
cat 29c38caac8 app/shim/manager: return error on bad fsu path 
This results in a graceful failure that does not leave garbage behind.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 18:59:45 +09:00
cat e599b5583d fmsg: implement suspend in writer 
This removes the requirement to call fmsg.Exit on every exit path, and enables direct use of the "log" package. However, fmsg.BeforeExit is still encouraged when possible to catch exit on suspended output.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 18:51:53 +09:00
cat 33a4ab11c2 internal: move shim and init into app 
This structure makes more sense, as both processes are part of an app's lifecycle.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 16:28:46 +09:00
cat 1fa5e992e4 helper/bwrap: expose address of DataConfig 
This allows the caller to defer fulfilling its payload.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 12:33:59 +09:00
cat c667b13a00 system: separate link Op implementation 
This Op would still be useful after replacing the Tmpfiles interface, so isolate it here.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-16 12:15:26 +09:00
cat 90b86a5531 release: 0.2.14 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 23:05:02 +09:00
cat f545e154f0 workflows: use native nix runner 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 22:58:04 +09:00
cat 268a90f1a5 app: improve WAYLAND_DISPLAY correctness 
This now has identical behaviour as wayland C library.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 14:45:09 +09:00
cat 3054527ca5 fortify: prevent exit status 0 on app failure 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 14:40:19 +09:00
cat ddb2f9c11b app: remove wayland socket hard link 
This Op was not doing anything useful.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 10:54:00 +09:00
cat 6ae02e72fa nix: test direct_wayland behaviour 
This should never be used outside tests unless you absolutely know what you're doing or are using GNOME.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 10:45:27 +09:00
cat 989fb5395f nix: remove unused configuration 
User setup no longer depends on userdb.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 10:10:42 +09:00
cat f955b15b84 system: remove write mode tmpfiles 
This interface is ugly and bug-prone. This change removes its write mode which has been obsoleted by CopyBind.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 03:22:20 +09:00
cat 0340c67995 app: port passwd and group files to copy 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 03:19:06 +09:00
cat 72b0160aad helper/bwrap: implement file copy flags 
These are significantly more efficient and less error-prone than mounting an external tmpfile. This should also reduce attack surface as the resulting files are private to its specific sandbox.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 03:13:15 +09:00
cat ea8d1c07df priv/shim: move /sbin/init setup to app 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 03:06:10 +09:00
cat a0062d8275 fmsg: resume on exit 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 02:22:09 +09:00
cat 43d2e4f5d7 nix: sway increase resolution 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 02:21:24 +09:00
cat be7d944b39 helper/bwrap: PositionalArg implement fmt.Stringer 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-15 00:11:48 +09:00
cat ace97952cc helper/bwrap: merge Args and FDArgs 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 18:13:06 +09:00
cat 73146ea7fa dbus: remove BwrapStatic method 
This method does not do anything and is not called from anywhere. It also does not make any sense as a public interface since the argument builder is no longer stateless.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 18:09:59 +09:00
cat 88040504b2 helper/bwrap: remove fmsg import 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 18:05:00 +09:00
cat 1fd571d561 cmd/fsu: check parse behaviour 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 16:43:55 +09:00
cat be30e2f11e cmd/fsu: revert offset in error message 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 15:31:39 +09:00
cat aaebb8f3ab fortify: check print behaviour 
These output are supposed to be deterministic, so checking them is a good way to catch regressions.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 14:44:28 +09:00
cat 1f74b636d3 state/join: use Join method when available 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 14:11:02 +09:00
cat e431ab3c24 app: check username length against LOGIN_NAME_MAX 
This limit is arbitrary, but it's good to enforce it anyway.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 12:44:55 +09:00
cat 3fba33687b fortify: print line after ps output 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-14 12:23:20 +09:00
cat 820f48ef94 release: 0.2.13 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 23:45:54 +09:00
cat fe7d208cf7 helper: use generic extra files interface 
This replaces the pipes object and integrates context into helper process lifecycle.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 23:34:15 +09:00
cat 60c2873750 helper/proc: cancel ec on parent ctx 
This allows errors written during a timeout to be received and handled.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 23:08:28 +09:00
cat d1d20c06fb helper/seccomp: use sync.Once for closeWrite 
This makes the code much cleaner, and eliminates the intermittent ErrInvalid errors.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 22:49:16 +09:00
cat 1e6a059668 helper/seccomp: benchmark exporter 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 22:37:51 +09:00
cat 318df0f7e1 nix: test syscall filter 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 22:01:16 +09:00
cat 58eb8f971d proc/pipe: implement args and stat file 
This is a generic implementation of helper/pipe.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 19:57:24 +09:00
cat 0a1d7c01cd helper/proc: count dispatched errs 
This helps debug implementation errors of [proc.File].

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 19:55:37 +09:00
cat 60ca1c6c55 helper/proc: store file addresses in linked list 
Storing extra files as a slice requires the caller to allocate a large enough slice before initialising any file and never grow the slice.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 17:42:12 +09:00
cat 099da78af5 helper/seccomp: eliminate data race on pfd 
Turns out the doc comment on os.File was lying about its methods being safe for concurrent use. The race detector picked up a data race from concurrent use of Fd and Close.

This change eliminates that by calling Fd in the prepare routine.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-13 10:40:51 +09:00
cat 18466cfd02 helper/proc: declare generic extra files interface 
Helpers use extra files for various purposes. This provides a generic interface for implementing the fulfillment of these extra files without having to specifically handle them in the process creation code.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-11 16:34:47 +09:00
cat e14923ae53 helper/proc: move package out of internal 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-08 13:03:45 +09:00
cat 7aff3ead3a nix: vm test remove unnecessary setup 
This step is no longer required as the NixOS module is responsible for home directory creation.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-07 22:29:56 +09:00
cat 72fb13dccc dbus: lock for read in public args interface 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-07 13:42:29 +09:00
cat a48386bd56 system/dbus: dump messages on early fault 
In the current app implementation this gets dumped in the wait method after resuming output. Wait is never called in an early fault condition, so any error messages get lost.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-07 13:20:56 +09:00
cat 2e52191404 system/dbus: dump method prints msgbuf 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-07 13:16:54 +09:00
cat 568d7758d5 helper/seccomp: panic on invalid closeWrite use 
Returning an error here puts exporter in an invalid state. The caller should guard against this condition instead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-07 12:58:20 +09:00
cat 5b7b3fa9a4 helper/seccomp: implement reader interface via pipe 
This also does not require the libc tmpfile call.

BPF programs emitted by libseccomp seems to be deterministic. The tests would catch regressions as it verifies the program against known good output backed by manual testing.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-03 19:43:03 +09:00
cat d58fb8c6ee workflows: fix nix store cache 
Prefix does not seem to match correctly, this appears to be a Gitea implementation bug.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-01 21:16:13 +09:00
cat 5808fe61c3 nix: vm test set sway background 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 22:28:04 +09:00
cat f338d3bb4b nix: update flake lock 2025-01-25 19:46:33 +09:00
cat 8d04dd72f1 nix: mount nvidia devices 
These non-standard paths are required in the sandbox for nvidia drivers to work.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 18:05:18 +09:00
cat 21735a8abe release: 0.2.12 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 13:40:48 +09:00
cat 34272672b1 nix: verify silent output when not running with -v 
This checks behaviour of fmsg and seccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 13:38:18 +09:00
cat 7b96cd6ded helper/seccomp: do not call F_println if not verbose 
This (slightly) improves performance.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 13:19:38 +09:00
cat 163f15e93f helper/seccomp: separate seccomp package 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 12:59:11 +09:00
cat 016da20443 nix: expose compat flag in nixos module 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 12:42:48 +09:00
cat 37780456a7 helper: block more unusual/privileged syscalls 
These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 12:35:47 +09:00
cat efacaa40fa nix: set deny_devel correctly 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:50:35 +09:00
cat ad6d0ee55f workflows: rename integration test artifact 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:30:39 +09:00
cat cf791469d8 workflows: gc store and purge old caches 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:25:57 +09:00
cat be14421775 workflows: merge test build job into test 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:22:44 +09:00
cat 045983d7f4 wl: separate inline C 
Having a huge blurb of inline C hurts readability on web pages and some text editors.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 22:06:29 +09:00
cat 7106b00968 release: 0.2.11 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 20:49:49 +09:00
cat 96d5d8a396 nix: apply shared home config to reserved aid 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 20:48:04 +09:00
cat 8a00a83c71 nix: expose syscall filter policy 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 17:24:42 +09:00
cat 134247b57d nix: configure target users via nixos 
This makes patching home-manager no longer necessary.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 17:04:19 +09:00
cat b5bb7654da nix: redirect sway output to journal 
This makes swaymsg exec output appear in test output.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 16:08:22 +09:00
cat cc1efa22e2 fst: add missing fields to template 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 12:09:25 +09:00
cat 580128922b cmd/fpkg: expose syscall policy options 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 12:01:30 +09:00
cat 23e1152baa app/share: clean BaseError message 
This removes trailing '\n' in the PulseAudio warning.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 11:54:16 +09:00
cat 8c51012ef5 dbus: enable syscall filter 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 11:49:23 +09:00
cat 5a64cdaf4f ldd: enable syscall filter 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 02:00:49 +09:00
cat a30f5e1226 fortify: set up seccomp verbose logging early 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 01:58:54 +09:00
cat 9a239fa1a5 helper/bwrap: integrate seccomp into helper interface 
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 01:52:57 +09:00
cat 82029948e6 proc: append to ExtraFiles slice pointer 
This is useful for initialising extra files before command.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-21 12:51:39 +09:00
cat dfcdc5ce20 state: store config in separate gob stream 
This enables early serialisation of config.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-21 12:10:58 +09:00
cat fa0616b274 fortify: print permissive defaults warning early 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-21 12:05:31 +09:00
cat 20a3d4c458 proc/priv/shim: resolve and load seccomp rules 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 23:52:56 +09:00
cat 3df344828f proc/priv/shim: seccomp bpf filter via libseccomp 
Rulesets adapted from Flatpak for compatibility.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 23:39:47 +09:00
cat 27f5922d5c fst: include syscall filter configuration 
This value is passed through to shim.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 21:12:39 +09:00