maemachinebroke/hakurei
1
0
Fork 0
forked from rosa/hakurei
Code Pull Requests Activity
2,429 Commits 7 Branches 12 Tags
fbd2329d50a9ef2b15c0a6b62e9aa24635c2662a
Commit Graph
2429 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
cat 2efedf56c0 nix: collect fortify ps output 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 13:48:39 +09:00
cat b752ec4468 fipc: export config struct 
Also store full config as part of state.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 13:45:55 +09:00
cat 5d00805a7c nix: check acl rollback 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-18 12:49:32 +09:00
cat 7b6052a473 nix: run Go tests in nixos 
Nix build environment does not support ACLs in any filesystem. This allows acl tests to run.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 21:16:55 +09:00
cat 38653c6ab5 release: 0.2.3 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 14:06:17 +09:00
cat b5cbbeab90 dist: generate distribution tarball 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 14:02:54 +09:00
cat c3ba0c3cce nix: rename nixos test 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 13:02:12 +09:00
cat b453f70ca2 cmd/fsu: check uid range before syscall 
This limits potential exploits to the fortify uid range.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 13:01:36 +09:00
cat c2b178e626 xcb: refactor and clean up 
No clean way to write Go tests for this package. Will rely on NixOS tests for now.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 12:46:36 +09:00
cat aeda40fc92 nix: test x11 permissive defaults 
Also invoke glinfo/wayland-info as part of tests.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 12:40:29 +09:00
cat 65dc39956f workflows: set action names 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 11:12:39 +09:00
cat 35505c8a26 workflows: invoke nix flake checks 
Integration tests are implemented as nix flake checks.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-17 10:49:43 +09:00
cat 3f993021f8 nix: permissive defaults nixos test 
Adapted from nixos sway integration tests.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 22:56:10 +09:00
cat 4d3bd5338f nix: implement flake checks 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 20:54:28 +09:00
cat 138666d753 nix: skip acl test 
The nix build environment does not support ACLs.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 19:29:01 +09:00
cat f4628e181b acl: create test file in tmpdir 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 18:58:09 +09:00
cat c8a90666c5 acl: refactor and clean up 
Move all C code to c.go, switch to pkg-config, set up finalizer for acl.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 18:27:19 +09:00
cat ee41b37606 acl: add tests 
These tests test UpdatePerm correctness by parsing getfacl output.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-16 16:00:31 +09:00
cat e3f1d7ba60 release: 0.2.2 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 21:47:22 +09:00
cat 39e3ac3ccd nix: require /etc/userdb nix-daemon 
There seems to be some kind of credential caching in nix-daemon.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 21:07:57 +09:00
cat 33c95b80ca cmd/fuserdb: rename home directories 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 20:23:46 +09:00
cat 40cc8a68d1 nix: rename home directories 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 20:15:37 +09:00
cat f773c92411 system: prevent duplicate Wayland op 
Wayland is implemented as an Op to enforce dependency and cleanup, its implementation does not allow multiple instances on a single sys object, nor would doing that make any sense.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-07 19:45:37 +09:00
cat 16ab734fcd update README document 
A lot of this information is no longer true since fsu. Remove them for now and write up proper documentation later.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 17:04:36 +09:00
cat cc816a1aaa proc: cleaner extra files 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 16:05:04 +09:00
cat b3ef53b193 app: integrate security-context-v1 
Should be able to get rid of XDG_RUNTIME_DIR share after this.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:25:33 +09:00
cat 8d0573405a helper/bwrap: implement sync fd 
This is required by wayland security-context-v1.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:21:37 +09:00
cat 38e92edb8e system/wayland: integrate security-context-v1 
Had to pass the sync fd through sys. The rest are just part of a standard Op.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:20:15 +09:00
cat 2d606b1f4b wl: implement security-context-v1 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 04:15:13 +09:00
cat 1b5b089c78 fortify: rename --dbus-id to --id 
This value is no longer specific to D-Bus defaults.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 03:26:09 +09:00
cat 6b8ddca7b4 nix: track nixos stable 24.11 
Reduce rebuilds during development on my system.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-12-06 00:44:04 +09:00
cat 95668ac998 nix: expose no_new_session in module 
Useful for shells and terminal programs like chat clients.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-28 00:19:06 +09:00
cat b291f0b710 app: add nixos-based config test case 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-21 12:13:21 +09:00
cat 3a20b149ce update README document 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-21 11:22:34 +09:00
cat 30b8bce90a fortify: zsh completion 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-20 01:25:19 +09:00
cat de0d78daae release: 0.2.1 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 21:03:50 +09:00
cat 6bf33ce507 fortify: use resolved username 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 21:03:09 +09:00
cat 9faf3b3596 app: validate username 
This value is used for passwd generation. Bad input can cause very confusing issues. This is not a security issue, however validation will improve user experience.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 21:01:41 +09:00
cat d99c8b1fb4 release: 0.2.0 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:15:09 +09:00
cat 6e4870775f update README document 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:14:06 +09:00
cat 0a546885e3 nix: update options doc 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:12:35 +09:00
cat 653d69da0a nix: module descriptions 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 18:10:57 +09:00
cat f8256137ae nix: separate module options from implementation 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-19 17:08:22 +09:00
cat 54b47b0315 nix: copy pixmaps directory to share package 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 14:46:08 +09:00
cat ae2628e57a cmd/fshim/ipc: install signal handler on shim start 
Getting killed at this point will result in inconsistent state.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 13:33:46 +09:00
cat c026a4b5dc fortify: permissive defaults resolve home directory from os 
When starting with the permissive defaults "run" command, attempt to resolve home directory from os by default and fall back to /var/empty.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 13:01:07 +09:00
cat 748a0ae2c8 nix: wrap program from libexec 
This avoids renaming the fortify binary.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 12:58:47 +09:00
cat 8f3f0c7bbf nix: integrate dynamic users 
Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 02:49:48 +09:00
cat 05b7dbf066 app: alternative inner home path 
Support binding home to an alternative path in the mount namespace.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-18 00:18:21 +09:00
cat 866270ff05 fmsg: add to wg prior to enqueue 
Adding after channel write is racy.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
 2024-11-17 23:50:02 +09:00