maemachinebroke/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
429 Commits 7 Branches 12 Tags
d58fb8c6eee659e4a71c4d69bfb8539199b431bd
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
cat d58fb8c6ee workflows: fix nix store cache 
Prefix does not seem to match correctly, this appears to be a Gitea implementation bug.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-02-01 21:16:13 +09:00
cat 5808fe61c3 nix: vm test set sway background 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 22:28:04 +09:00
cat f338d3bb4b nix: update flake lock 2025-01-25 19:46:33 +09:00
cat 8d04dd72f1 nix: mount nvidia devices 
These non-standard paths are required in the sandbox for nvidia drivers to work.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 18:05:18 +09:00
cat 21735a8abe release: 0.2.12 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 13:40:48 +09:00
cat 34272672b1 nix: verify silent output when not running with -v 
This checks behaviour of fmsg and seccomp.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 13:38:18 +09:00
cat 7b96cd6ded helper/seccomp: do not call F_println if not verbose 
This (slightly) improves performance.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 13:19:38 +09:00
cat 163f15e93f helper/seccomp: separate seccomp package 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 12:59:11 +09:00
cat 016da20443 nix: expose compat flag in nixos module 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 12:42:48 +09:00
cat 37780456a7 helper: block more unusual/privileged syscalls 
These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-25 12:35:47 +09:00
cat efacaa40fa nix: set deny_devel correctly 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:50:35 +09:00
cat ad6d0ee55f workflows: rename integration test artifact 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:30:39 +09:00
cat cf791469d8 workflows: gc store and purge old caches 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:25:57 +09:00
cat be14421775 workflows: merge test build job into test 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-24 00:22:44 +09:00
cat 045983d7f4 wl: separate inline C 
Having a huge blurb of inline C hurts readability on web pages and some text editors.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 22:06:29 +09:00
cat 7106b00968 release: 0.2.11 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 20:49:49 +09:00
cat 96d5d8a396 nix: apply shared home config to reserved aid 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 20:48:04 +09:00
cat 8a00a83c71 nix: expose syscall filter policy 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 17:24:42 +09:00
cat 134247b57d nix: configure target users via nixos 
This makes patching home-manager no longer necessary.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 17:04:19 +09:00
cat b5bb7654da nix: redirect sway output to journal 
This makes swaymsg exec output appear in test output.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-23 16:08:22 +09:00
cat cc1efa22e2 fst: add missing fields to template 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 12:09:25 +09:00
cat 580128922b cmd/fpkg: expose syscall policy options 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 12:01:30 +09:00
cat 23e1152baa app/share: clean BaseError message 
This removes trailing '\n' in the PulseAudio warning.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 11:54:16 +09:00
cat 8c51012ef5 dbus: enable syscall filter 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 11:49:23 +09:00
cat 5a64cdaf4f ldd: enable syscall filter 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 02:00:49 +09:00
cat a30f5e1226 fortify: set up seccomp verbose logging early 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 01:58:54 +09:00
cat 9a239fa1a5 helper/bwrap: integrate seccomp into helper interface 
This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-22 01:52:57 +09:00
cat 82029948e6 proc: append to ExtraFiles slice pointer 
This is useful for initialising extra files before command.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-21 12:51:39 +09:00
cat dfcdc5ce20 state: store config in separate gob stream 
This enables early serialisation of config.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-21 12:10:58 +09:00
cat fa0616b274 fortify: print permissive defaults warning early 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-21 12:05:31 +09:00
cat 20a3d4c458 proc/priv/shim: resolve and load seccomp rules 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 23:52:56 +09:00
cat 3df344828f proc/priv/shim: seccomp bpf filter via libseccomp 
Rulesets adapted from Flatpak for compatibility.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 23:39:47 +09:00
cat 27f5922d5c fst: include syscall filter configuration 
This value is passed through to shim.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 21:12:39 +09:00
cat 2cf1f46ea2 nix: test show without --short 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 21:10:24 +09:00
cat 3c55fc8e86 proc/priv/shim: do not log bwrap args 
This message is very long and does not serve much real purpose. Remove it to de-clutter verbose messages.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 19:51:28 +09:00
cat eb0ef2d115 helper/bwrap: generic extra file interface 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-20 00:20:04 +09:00
cat 2f70506865 helper/bwrap: move sync to helper state 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-19 18:38:13 +09:00
cat cae567c109 proc/priv/shim: remove unnecessary state 
These values are only used during process creation.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-19 18:09:07 +09:00
cat 1ec901f79e release: 0.2.10 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 22:50:08 +09:00
cat 715addaccd helper/bwrap: append --sync-fd before -- 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 12:30:03 +09:00
cat b31d055e20 proc/priv/init: early init check 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 12:33:33 +09:00
cat 7baca66a56 proc: remove duplicate compile-time fortify reference 
This is no longer needed since shim and init are now part of the main program.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 11:59:33 +09:00
cat 27d2914286 proc/priv/init: merge init into main program 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-18 11:47:01 +09:00
cat ea8f228af3 proc/priv/shim: merge shim into main program 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-17 23:43:32 +09:00
cat 16db3dabe2 internal: do PR_SET_PDEATHSIG once 
This prctl affects the entire process, doing it on every OS thread is pointless.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-17 23:08:46 +09:00
cat c4de450217 nix: do not force static linking on nix 
In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-17 22:56:16 +09:00
cat b60c01f440 fortify: switch to static linking 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-16 17:32:52 +09:00
cat 124743ffd3 app: expose single run method 
App is no longer just a simple [exec.Cmd] wrapper, so exposing these steps separately no longer makes sense and actually hinders proper error handling, cleanup and cancellation. This change removes the five-second wait when the shim dies before receiving the payload, and provides caller the ability to gracefully stop execution of the confined process.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-15 23:39:51 +09:00
cat be4d8b6300 release: 0.2.9 
This release mostly contains permissive defaults fixes and optimisations. It also contains a proof of concept version of fpkg.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-15 13:14:43 +09:00
cat 3e11ce6868 helper/bwrap: separate sequential/static args 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-15 13:07:06 +09:00
cat 562f5ed797 fst: hide sockets exposed via Filesystem 
This is mostly useful for permissive defaults.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-15 10:13:18 +09:00
cat db03565614 fst: move sandbox struct to separate file 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-15 09:42:44 +09:00
cat 7d99e45b88 helper/bwrap: register OverlayConfig with gob 
This is required for copying bwrap configurations across processes.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-14 12:25:10 +09:00
cat 1651eb06df dbus: implement dbus_parse_address 
This parses D-Bus addresses according to spec. It does significantly fewer copies than dbus_parse_address.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-12 23:24:03 +09:00
cat ac543a1ce8 dbus: rename makeTestCases 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-12 23:21:28 +09:00
cat e2489059c1 helper/bwrap: implement overlayfs builder 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-05 20:09:35 +09:00
cat 2e3f6a4c51 helper/bwrap: move test out of bwrap package 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-05 19:45:24 +09:00
cat 2162029f46 helper/bwrap: add json struct tag to filesystem 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-05 19:41:04 +09:00
cat a1148edd00 fst/config: allocate filesystem slice 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-04 00:16:41 +09:00
cat 6acd0d4e88 linux/std: handle fsu exit status 1 
Printing "exit status 1" is confusing. This handles the ExitError and returns EACCES instead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-01 21:34:57 +09:00
cat 35b7142317 fortify: show system info when instance is not specified 
This contains useful information not obtainable by external tools.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-01-01 19:35:50 +09:00
cat c4d6651cae update reverse-DNS style identifiers 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-31 16:16:38 +09:00
cat 22a4b99674 cmd/fpkg/install: deduplicate nix store 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-30 02:25:04 +09:00
cat 1464ef774b cmd/fpkg: expose nixGL wrappers 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-30 02:02:20 +09:00
cat 66ba4cea5c cmd/fpkg: remove workDir acl from activation 
Activation does not require access to workDir, and by this point all information is available in dataHome.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 23:48:45 +09:00
cat f8d0786509 cmd/fpkg: include nixGL source in inner store 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 23:37:11 +09:00
cat 56a73bb019 nix: create nixpkgs symlink 
This is included as part of the system as nixGL needs to be built somewhere between activation and start.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 23:23:11 +09:00
cat fb8abf63db nix: update flake lock 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 23:14:16 +09:00
cat 63802c5f0d nix: nixos test create parent directory 
This tests directory creation in shim.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 22:36:53 +09:00
cat aff80b6b00 cmd/fpkg: optional network access when invoking with nix daemon 
This is useful for building nixGL.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 18:32:44 +09:00
cat a98a176907 cmd/fpkg: bind and document more gpu devices 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 18:25:26 +09:00
cat 5302879b88 cmd/fpkg: improve readability of fortify invocations 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 17:55:56 +09:00
cat 891b3cbde7 cmd/fpkg: compare all three store paths 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 17:10:41 +09:00
cat c795293f36 cmd/fpkg: clean up broken links before activation 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 15:21:40 +09:00
cat 42e1043300 nix: set home-manager user information 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 15:11:36 +09:00
cat 5416b07daa nix: remove unused argument 'self' 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 14:49:55 +09:00
cat e57a0e9bf2 nix: rename fortifyBundle to buildPackage 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 14:35:37 +09:00
cat ab48706ebe dist: install fpkg to /usr/bin 
This is a high level user-facing tool.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 01:04:53 +09:00
cat c1a459a0b1 cmd/fpkg/start: correct drop to shell wording 
Activation no longer happens during application startup.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 00:56:14 +09:00
cat 5125e96ecf nix: generate application package build script 
This takes some metadata, sandbox options, a launch script and a list of home-manager modules. The result needs to be executed in an environment with nix daemon access, and it produces the final package file.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 00:42:21 +09:00
cat e0e2f40e84 cmd/fpkg: app bundle helper 
This helper program creates fortify configuration for running an application bundle. The activate action wraps a home-manager activation package and ensures each generation gets activated once.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 13:21:49 +09:00
cat bf8094c6ca internal: include path to fortify main program 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 12:48:48 +09:00
cat 2e3bb1893e release: 0.2.8 
This release mostly fixes bugs uncovered when running fortify on a generic linux distribution.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-29 01:09:47 +09:00
cat 9b206072fa cmd/fshim: ensure data directory 
Ensuring home directory in shim causes the directory to be owned by the target user.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-28 14:39:01 +09:00
cat b9e2003d5b app: ensure extra paths 
The primary use case for extra perms is app-specific state directories, which may or may not exist (first run of any app).

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-28 14:07:49 +09:00
cat 66ec0d882f dist: build with -trimpath 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-28 13:44:05 +09:00
cat 847b667489 app: extra acl entries from configuration 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-28 13:23:27 +09:00
cat c70f0612ad fortify/print: skip nil filesystem entries 
This fixes a panic when displaying configurations with nil filesystem entries.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-28 12:14:42 +09:00
cat 85e5b097fd fst/config: add template etc entry 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-28 12:05:32 +09:00
cat 0107620d8c app: merge share methods 
This significantly increases readability and makes order of ops more obvious.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-28 11:12:35 +09:00
cat fc26659ea1 fst/config: autoetc read custom path 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-27 18:57:44 +09:00
cat 1f173a469c system/dbus: fix inverted system bus state 
Debug message and socket cleanup gets missed due to this value being inverted.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-27 18:38:11 +09:00
cat 2fdbd6a4dd fst/config: alternative /etc directory 
This is useful for static /etc directories provided by self-contained application packages, or in cases where autoetc is useful for paths other than /etc.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-27 18:06:26 +09:00
cat aef847b5ae helper/bwrap: fix typo in --dir config builder 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-27 15:34:43 +09:00
cat 0a2aa5823b cmd/fshim: bind finit inside sandbox 
The outer finit executable is normally inaccessible inside the sandbox. This was obscured by the current Nix-based setup exposing /nix/store to the sandbox.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-27 14:44:57 +09:00
cat b956ce4052 ldd: trim leading and trailing white spaces from name 
Glibc emits ldd output with \t prefix for formatting. Remove that here.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 16:53:01 +09:00
cat dc579dc610 dbus/run: bind ldd entry absolute name 
The ld.so entry has an absolute name. They are usually symlinks so binding path does not guarantee ld.so availability under its expected path in the mount namespace.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 16:36:03 +09:00
cat ade57c39af ldd: add fhs glibc test case 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 16:33:02 +09:00
cat 614ad86a5b dbus: fail on LookPath error 
An absolute path to xdg-dbus-proxy is required.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 16:08:48 +09:00
cat 831dc6a181 dist: create checksum in dist directory 
This makes verification easier.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2024-12-26 15:14:35 +09:00