maemachinebroke/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
900 Commits 7 Branches 12 Tags
ea1e3ebae993a3d89302940dc1649b627c420aa1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
cat ea1e3ebae9 container/params: pass fd instead of file 
The file is very difficult to stub. Pass fd instead as it is the value that is actually useful.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-23 00:16:46 +09:00
cat 1c692bfb79 container/init: call lockOSThread through dispatcher 
This degrades test performance if not stubbed out.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-22 22:24:14 +09:00
cat 141a18999f container: move integration test helpers 
With the new instrumentation it is now possible to run init code outside integration tests.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-22 22:07:19 +09:00
cat afe23600d2 container/path: use syscall dispatcher 
This allows path and mount functions to be instrumented.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-22 22:02:21 +09:00
cat 09d2844981 container/init: wrap syscall helper functions 
This allows tests to stub all kernel behaviour, enabling measurement of all function call arguments and error injection.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-22 19:27:31 +09:00
cat d500d6e559 system/dbus: share host net ns for abstract 
Host abstract unix sockets are only accessible when also in the init net ns.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-21 21:55:23 +09:00
cat 5b73316ae0 container/syscall: doc comments from manpages 
These are pulled straight from the manpages.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-21 00:33:46 +09:00
cat 5d8a2199b6 container/init: op interface valid method 
Check ops early and eliminate duplicate checks.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-21 00:18:50 +09:00
cat a1482ecdd0 container/inittmpfs: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 20:17:28 +09:00
cat a07f9ed84c container/initsymlink: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 20:03:02 +09:00
cat 51304b03af container/initremount: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 19:55:51 +09:00
cat c6397b941f container/initproc: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 19:29:45 +09:00
cat d65e5f817a container/initplace: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 19:19:27 +09:00
cat 696e593898 container/initoverlay: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 17:33:15 +09:00
cat 97ab24feef container/init: use absolute compare method 
More checks are also added.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 17:14:36 +09:00
cat 31f0dd36df absolute: efficient equivalence check method 
This is more efficient and makes the call site cleaner.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 17:06:38 +09:00
cat 9aec2f46fe container/initdev: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 02:55:45 +09:00
cat 022cc26b2e container/capability: check CAP_TO_INDEX and CAP_TO_MASK 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 02:45:00 +09:00
cat b4c018da8f container/autoetc: do not bypass absolute check 
This can now be done cleanly via path function wrappers.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 02:37:11 +09:00
cat 66f52407d3 container/initmkdir: check path equivalence by value 
Fixes regression introduced while integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 02:32:22 +09:00
cat e463faf649 container/initbind: check path equivalence by value 
Same problem as autoroot, never updated the checks after integrating Absolute.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 02:22:04 +09:00
cat 375acb476d container/autoroot: check host path equivalence by value 
This will never return true otherwise unless the equivalent paths happen to be interned by the caller.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 02:14:39 +09:00
cat c81c9a9d75 container/init: split setup ops into individual files 
This significantly increases readability.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 01:28:31 +09:00
cat 339e4080dc container/ops: move Op type to init file 
This helps with the eventual separation of all setup ops into individual files.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 01:11:24 +09:00
cat e0533aaa68 container/autoroot: filter dentry with empty name 
This is unreachable, but nice to have just in case.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 01:03:49 +09:00
cat 13c7083bc0 container: ptrace protection via Yama LSM 
This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway.

Closes #4.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-20 00:43:55 +09:00
cat 6947ff04e0 system/dbus/proc: host abstract only when not binding 
The test failure seems to be caused by an unrelated bug in xdg-dbus-proxy.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-19 23:39:14 +09:00
cat 140fe21237 container/params: check setup/receive behaviour 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 22:30:34 +09:00
cat f52d2c7db6 container/path: check create and mountinfo helpers 
These can quite easily be checked within the framework. The scanner fault injection might require updating at some point if the implementation changes.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 21:30:28 +09:00
cat 3c9e547c4a cmd/hpkg: add deprecation notice 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 17:00:27 +09:00
cat a3988c1a77 hst: rename net and abstract fields 
This makes more sense and matches the container library.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 16:48:01 +09:00
cat 69a4ab8105 container: move PR_SET_NO_NEW_PRIVS to parent 
This allows some LSM setup in the parent.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 11:46:02 +09:00
cat 22d577ab49 test/sandbox: do not discard stderr getting hash 
This is the first hakurei run in the test, if the container outright fails to start this is often where it happens, so throwing away the output is very unhelpful.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 11:36:13 +09:00
cat 83a1c75f1a app: set up acl on X11 socket 
The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging security/hakurei#1.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-18 11:30:58 +09:00
cat 0ac6e99818 container: start from locked thread 
This allows setup that relies on per-thread state like securebits and landlock, from the parent side.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-17 17:42:22 +09:00
cat f35733810e container: check output helper functions 
The container test suite has always been somewhat inadequate due to the inability of coverage tooling to reach into containers. This has become an excuse for not testing non-container code as well, which lead to the general lack of confidence when working with container code. This change aims to be one of many to address that to some extent.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-17 02:59:37 +09:00
cat 9c1a5d43ba container: enforce nonrepeatable autoetc and autoroot 
These keep track of some internal state, and they don't make sense to have multiple instances of anyway, so instead of dealing with that, just make them nonrepetable.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-17 01:43:11 +09:00
cat 8aa65f28c6 container: allow additional state between ops 
This is useful for ops that need to be aware of previous instances of themselves.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-17 01:32:07 +09:00
cat f9edec7e41 hst: merge miscellaneous files 
These structs were going to be bigger at some point. They turned out not to be.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-16 02:32:57 +09:00
cat 305c600cf5 hst: move container type to config 
Container state initialisation is no longer implemented in hst so splitting them no longer makes sense.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-16 02:28:36 +09:00
cat 8dd3e1ee5d hst/fs: rename method Target to Path 
This allows adapter structs to use the same field names as Op structs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-16 02:06:41 +09:00
cat 4ffeec3004 hst/enablement: editor friendly enablement adaptor 
Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-15 05:16:51 +09:00
cat 9ed3ba85ea hst/fs: implement overlay fstype 
This finally exposes overlay mounts in the high level hakurei API.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-15 04:00:55 +09:00
cat 4433c993fa nix: check config via hakurei 
This is unfortunately the only feasible way of doing this in nix.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-15 03:27:54 +09:00
cat 430991c39b hst/fs: remove type method 
Having a method that returns the canonical string representation of its type seemed like a much better idea for an implementation that never made it to staging. Remove it here and clean up marshal type assertions.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-15 00:39:02 +09:00
cat ba3227bf15 container: export overlay escape 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-14 23:44:11 +09:00
cat 0e543a58b3 hst/fs: valid method on underlying interface 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-14 21:36:22 +09:00
cat c989e7785a hst/info: include extra information 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-14 19:52:03 +09:00
cat 332d90d6c7 container/path: remove unused path 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-14 05:00:09 +09:00
cat 99ac96511b hst/fs: interface filesystem config 
This allows mount points to be represented by different underlying structs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-14 04:52:49 +09:00
cat e99d7affb0 container: use absolute for pathname 
This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-11 04:56:42 +09:00
cat 41ac2be965 container/absolute: wrap safe stdlib functions 
These functions do not change the absoluteness of a pathname.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-10 03:11:10 +09:00
cat 02271583fb container: remove PATH lookup behaviour 
This is way higher level than the container package and does not even work unless every path is mounted in the exact same location.

This behaviour causes nothing but confusion and problems,

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-09 19:08:54 +09:00
cat ef54b2cd08 container/absolute: early absolute pathname check 
This is less error-prone, and allows pathname to be checked once.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-09 18:53:46 +09:00
cat 82608164f6 container/params: remove confusingly named error 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-09 17:37:46 +09:00
cat edd6f2cfa9 container: document ambient capabilities 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 02:11:55 +09:00
cat acffa76812 container/ops: implement overlay op 
There are significant limitations to using the overlay mount, and the implementation in the kernel is quite quirky. For now the Op is quite robust, however a higher level interface for it has not been decided yet.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 01:54:48 +09:00
cat 8da76483e6 container/path: fix typo "paths" 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 01:32:48 +09:00
cat 534c932906 container: test case runtime initialisation 
This allows for more sophisticated test setup.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 01:03:35 +09:00
cat fee10fed4d container: test bypass output buffer on verbose 
This restores verbose behaviour.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 00:57:27 +09:00
cat a4f7e92e1c test/interactive: helper scripts for tracing 
The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 00:56:25 +09:00
cat f1a53d6116 container: raise CAP_DAC_OVERRIDE 
This is required for upperdir and workdir checks in overlayfs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-08 00:43:19 +09:00
cat b353c3deea nix: make src overlay writable 
The lowerdir is in the nix store.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 18:07:19 +09:00
cat fde5f1ca64 container: buffer test output 
This further reduces noise on test failure by only passing through output of the failed test.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 02:55:58 +09:00
cat 4d0bdd84b5 container: test respect verbose flag 
This reduces noise on test failure.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 02:50:00 +09:00
cat 72a931a71a nix: interactive nixos vm 
This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-07 02:46:04 +09:00
cat 9a25542c6d container/init: use mount string constants 
These literals were missed when the constants were first defined.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-04 04:00:05 +09:00
cat c6be82bcf9 container/path: fhs path constants 
This increases readability since this can help disambiguate absolute paths from similarly named path segments.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 21:16:45 +09:00
cat 38245559dc container/ops: mount dev readonly 
There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 19:18:53 +09:00
cat 7b416d47dc container/ops: merge mqueue and dev Ops 
There is no reason to mount mqueue anywhere else, and these Ops usually follow each other. This change merges them. This helps decrease IPC overhead and also enables mounting dev readonly.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 19:13:46 +09:00
cat 15170735ba container/mount: move tmpfs sysroot prefixing to caller 
The mountTmpfs helper is a relatively low level function that is not exposed as part of the API. Prefixing sysroot here not only introduces overhead but is also quite error-prone.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 18:06:41 +09:00
cat 6a3886e9db container/op: unexport bind resolved source field 
This is used for symlink resolution and is only used internally.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 17:57:37 +09:00
cat ff66296378 container/mount: mount data escape helper function 
For formatting user-supplied path strings into overlayfs mount data.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-03 17:46:14 +09:00
cat 347a79df72 container: improve clone flags readability 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 18:19:44 +09:00
cat 0f78864a67 container/mount: export mount string constants 
This improves code readability and should also be useful for callers choosing to preserve CAP_SYS_ADMIN.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 17:20:09 +09:00
cat b32b1975a8 hst/container: remove cover 
This was never useful, and is now completely replaced by regular FilesystemConfig being able to mount tmpfs.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 00:34:52 +09:00
cat 2b1eaa62f1 update github notice 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 00:21:16 +09:00
cat f13dca184c release: 0.1.3 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-02 00:02:54 +09:00
cat 3b8a3d3b00 app: remount root readonly 
This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 23:56:28 +09:00
cat c5d24979f5 container/ops: expose remount as Op 
This is useful for building a filesystem hierarchy then remounting it readonly.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 23:48:02 +09:00
cat 1dc780bca7 container/mount: separate remount from bind 
Remount turns out to be useful in other places.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 23:32:38 +09:00
cat ec33061c92 nix: remove nscd cover 
This is a pd workaround that does nothing in the nixos module.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 22:04:58 +09:00
cat af0899de96 hst/container: mount tmpfs via magic src string 
There's often good reason to mount tmpfs in the container.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 21:23:52 +09:00
cat 547a2adaa4 container/mount: pass tmpfs flags 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 18:59:06 +09:00
cat c02948e155 cmd/hakurei: print autoroot configuration 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 04:29:01 +09:00
cat 387b86bcdd app: integrate container autoroot 
Doing this instead of mounting directly on / because it's impossible to ensure a parent is available for every path hakurei wants to mount to. This situation is similar to autoetc hence the similar name, however a symlink mirror will not work in this case.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 04:21:54 +09:00
cat 4e85643865 container: implement autoroot as setup op 
This code is useful beyond just pd behaviour, and implementing it this way also reduces IPC overhead.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 04:04:36 +09:00
cat 987981df73 test/sandbox: check pd behaviour 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 03:27:02 +09:00
cat f14e7255be container/ops: use correct flags value in bind string 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-08-01 00:54:08 +09:00
cat a8a79a8664 cmd/hpkg: rename from planterette 
Planterette is now developed in another repository, so rename this proof of concept to avoid confusion.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-31 23:57:11 +09:00
cat 3ae0cec000 test: increase vm memory 
This hopefully fixes the intermittent failures.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-31 22:08:01 +09:00
cat 4e518f11d8 container/ops: autoetc implementation to separate file 
This is not a general purpose setup Op. Separate it so it is easier to find.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-31 19:54:03 +09:00
cat cb513bb1cd release: 0.1.2 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 03:11:33 +09:00
cat f7bd28118c hst: configurable wait delay 
This is useful for programs that take a long time to clean up.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 03:06:49 +09:00
cat 940ee00ffe container/init: configurable lingering process wait delay 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 02:38:17 +09:00
cat b43d104680 app: integrate interrupt forwarding 
This significantly increases usability of command line tools running through hakurei.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-29 02:23:06 +09:00
cat ddf48a6c22 app/shim: implement signal handler outcome in Go 
This needs to be done from the Go side eventually anyway to integrate the signal forwarding behaviour now supported by the container package.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 23:39:30 +09:00
cat a0f499e30a app/shim: separate signal handler implementation 
Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 21:52:53 +09:00
cat d6b07f12ff container: forward context cancellation 
This allows container processes to exit gracefully.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 01:45:38 +09:00
cat 65fe09caf9 container: check cancel signal delivery 
This change also makes some parts of the test more robust.

Signed-off-by: Ophestra <cat@gensokyo.uk>
 2025-07-28 01:04:29 +09:00