This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst.
Closes#29.
Signed-off-by: Ophestra <cat@gensokyo.uk>
This is a private work directory owned by the specific shim. Useful for sockets owned by this instance of the shim and requires no direct assistance from the priv-side process.
Signed-off-by: Ophestra <cat@gensokyo.uk>
In some cases the signal might be delivered before the signal handler is installed, and synchronising against such a case is too expensive. Instead, use the pipe being closed as a fallback to the regular exit request. This change also moves installation of the signal handler early.
Signed-off-by: Ophestra <cat@gensokyo.uk>
The shim does not suspend output to begin with. These are leftovers from when container startup code suspends output.
Signed-off-by: Ophestra <cat@gensokyo.uk>
