100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
cat	82a072f641	system/tmpfiles: implement private tmpfiles ... These are only available within the mount namespace and should significantly reduce attack surface. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-17 00:07:52 +09:00
cat	60c10c3f4a	nix: run integration tests with race detector ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-16 20:58:08 +09:00
cat	468696f611	internal: beforeExit before reachable fatal calls ... These are the only two calls to log.Fatal* reachable during suspended output. Call fmsg.BeforeExit here to catch that. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-16 19:03:34 +09:00
cat	29c38caac8	app/shim/manager: return error on bad fsu path ... This results in a graceful failure that does not leave garbage behind. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-16 18:59:45 +09:00
cat	e599b5583d	fmsg: implement suspend in writer ... This removes the requirement to call fmsg.Exit on every exit path, and enables direct use of the "log" package. However, fmsg.BeforeExit is still encouraged when possible to catch exit on suspended output. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-16 18:51:53 +09:00
cat	33a4ab11c2	internal: move shim and init into app ... This structure makes more sense, as both processes are part of an app's lifecycle. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-16 16:28:46 +09:00
cat	1fa5e992e4	helper/bwrap: expose address of DataConfig ... This allows the caller to defer fulfilling its payload. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-16 12:33:59 +09:00
cat	c667b13a00	system: separate link Op implementation ... This Op would still be useful after replacing the Tmpfiles interface, so isolate it here. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-16 12:15:26 +09:00
cat	90b86a5531	release: 0.2.14 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 23:05:02 +09:00
cat	f545e154f0	workflows: use native nix runner ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 22:58:04 +09:00
cat	268a90f1a5	app: improve WAYLAND_DISPLAY correctness ... This now has identical behaviour as wayland C library. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 14:45:09 +09:00
cat	3054527ca5	fortify: prevent exit status 0 on app failure ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 14:40:19 +09:00
cat	ddb2f9c11b	app: remove wayland socket hard link ... This Op was not doing anything useful. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 10:54:00 +09:00
cat	6ae02e72fa	nix: test direct_wayland behaviour ... This should never be used outside tests unless you absolutely know what you're doing or are using GNOME. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 10:45:27 +09:00
cat	989fb5395f	nix: remove unused configuration ... User setup no longer depends on userdb. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 10:10:42 +09:00
cat	f955b15b84	system: remove write mode tmpfiles ... This interface is ugly and bug-prone. This change removes its write mode which has been obsoleted by CopyBind. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 03:22:20 +09:00
cat	0340c67995	app: port passwd and group files to copy ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 03:19:06 +09:00
cat	72b0160aad	helper/bwrap: implement file copy flags ... These are significantly more efficient and less error-prone than mounting an external tmpfile. This should also reduce attack surface as the resulting files are private to its specific sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 03:13:15 +09:00
cat	ea8d1c07df	priv/shim: move /sbin/init setup to app ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 03:06:10 +09:00
cat	a0062d8275	fmsg: resume on exit ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 02:22:09 +09:00
cat	43d2e4f5d7	nix: sway increase resolution ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 02:21:24 +09:00
cat	be7d944b39	helper/bwrap: PositionalArg implement fmt.Stringer ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-15 00:11:48 +09:00
cat	ace97952cc	helper/bwrap: merge Args and FDArgs ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 18:13:06 +09:00
cat	73146ea7fa	dbus: remove BwrapStatic method ... This method does not do anything and is not called from anywhere. It also does not make any sense as a public interface since the argument builder is no longer stateless. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 18:09:59 +09:00
cat	88040504b2	helper/bwrap: remove fmsg import ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 18:05:00 +09:00
cat	1fd571d561	cmd/fsu: check parse behaviour ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 16:43:55 +09:00
cat	be30e2f11e	cmd/fsu: revert offset in error message ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 15:31:39 +09:00
cat	aaebb8f3ab	fortify: check print behaviour ... These output are supposed to be deterministic, so checking them is a good way to catch regressions. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 14:44:28 +09:00
cat	1f74b636d3	state/join: use Join method when available ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 14:11:02 +09:00
cat	e431ab3c24	app: check username length against LOGIN_NAME_MAX ... This limit is arbitrary, but it's good to enforce it anyway. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 12:44:55 +09:00
cat	3fba33687b	fortify: print line after ps output ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-14 12:23:20 +09:00
cat	820f48ef94	release: 0.2.13 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 23:45:54 +09:00
cat	fe7d208cf7	helper: use generic extra files interface ... This replaces the pipes object and integrates context into helper process lifecycle. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 23:34:15 +09:00
cat	60c2873750	helper/proc: cancel ec on parent ctx ... This allows errors written during a timeout to be received and handled. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 23:08:28 +09:00
cat	d1d20c06fb	helper/seccomp: use sync.Once for closeWrite ... This makes the code much cleaner, and eliminates the intermittent ErrInvalid errors. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 22:49:16 +09:00
cat	1e6a059668	helper/seccomp: benchmark exporter ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 22:37:51 +09:00
cat	318df0f7e1	nix: test syscall filter ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 22:01:16 +09:00
cat	58eb8f971d	proc/pipe: implement args and stat file ... This is a generic implementation of helper/pipe. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 19:57:24 +09:00
cat	0a1d7c01cd	helper/proc: count dispatched errs ... This helps debug implementation errors of [proc.File]. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 19:55:37 +09:00
cat	60ca1c6c55	helper/proc: store file addresses in linked list ... Storing extra files as a slice requires the caller to allocate a large enough slice before initialising any file and never grow the slice. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 17:42:12 +09:00
cat	099da78af5	helper/seccomp: eliminate data race on pfd ... Turns out the doc comment on os.File was lying about its methods being safe for concurrent use. The race detector picked up a data race from concurrent use of Fd and Close. This change eliminates that by calling Fd in the prepare routine. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-13 10:40:51 +09:00
cat	18466cfd02	helper/proc: declare generic extra files interface ... Helpers use extra files for various purposes. This provides a generic interface for implementing the fulfillment of these extra files without having to specifically handle them in the process creation code. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-11 16:34:47 +09:00
cat	e14923ae53	helper/proc: move package out of internal ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-08 13:03:45 +09:00
cat	7aff3ead3a	nix: vm test remove unnecessary setup ... This step is no longer required as the NixOS module is responsible for home directory creation. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-07 22:29:56 +09:00
cat	72fb13dccc	dbus: lock for read in public args interface ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-07 13:42:29 +09:00
cat	a48386bd56	system/dbus: dump messages on early fault ... In the current app implementation this gets dumped in the wait method after resuming output. Wait is never called in an early fault condition, so any error messages get lost. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-07 13:20:56 +09:00
cat	2e52191404	system/dbus: dump method prints msgbuf ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-07 13:16:54 +09:00
cat	568d7758d5	helper/seccomp: panic on invalid closeWrite use ... Returning an error here puts exporter in an invalid state. The caller should guard against this condition instead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-07 12:58:20 +09:00
cat	5b7b3fa9a4	helper/seccomp: implement reader interface via pipe ... This also does not require the libc tmpfile call. BPF programs emitted by libseccomp seems to be deterministic. The tests would catch regressions as it verifies the program against known good output backed by manual testing. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-03 19:43:03 +09:00
cat	d58fb8c6ee	workflows: fix nix store cache ... Prefix does not seem to match correctly, this appears to be a Gitea implementation bug. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-02-01 21:16:13 +09:00
cat	5808fe61c3	nix: vm test set sway background ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 22:28:04 +09:00
cat	f338d3bb4b	nix: update flake lock	2025-01-25 19:46:33 +09:00
cat	8d04dd72f1	nix: mount nvidia devices ... These non-standard paths are required in the sandbox for nvidia drivers to work. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 18:05:18 +09:00
cat	21735a8abe	release: 0.2.12 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 13:40:48 +09:00
cat	34272672b1	nix: verify silent output when not running with -v ... This checks behaviour of fmsg and seccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 13:38:18 +09:00
cat	7b96cd6ded	helper/seccomp: do not call F_println if not verbose ... This (slightly) improves performance. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 13:19:38 +09:00
cat	163f15e93f	helper/seccomp: separate seccomp package ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 12:59:11 +09:00
cat	016da20443	nix: expose compat flag in nixos module ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 12:42:48 +09:00
cat	37780456a7	helper: block more unusual/privileged syscalls ... These are toggled by F_EXT and exposed as SyscallPolicy.Compat in the Go interface. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-25 12:35:47 +09:00
cat	efacaa40fa	nix: set deny_devel correctly ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-24 00:50:35 +09:00
cat	ad6d0ee55f	workflows: rename integration test artifact ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-24 00:30:39 +09:00
cat	cf791469d8	workflows: gc store and purge old caches ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-24 00:25:57 +09:00
cat	be14421775	workflows: merge test build job into test ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-24 00:22:44 +09:00
cat	045983d7f4	wl: separate inline C ... Having a huge blurb of inline C hurts readability on web pages and some text editors. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 22:06:29 +09:00
cat	7106b00968	release: 0.2.11 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 20:49:49 +09:00
cat	96d5d8a396	nix: apply shared home config to reserved aid ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 20:48:04 +09:00
cat	8a00a83c71	nix: expose syscall filter policy ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 17:24:42 +09:00
cat	134247b57d	nix: configure target users via nixos ... This makes patching home-manager no longer necessary. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 17:04:19 +09:00
cat	b5bb7654da	nix: redirect sway output to journal ... This makes swaymsg exec output appear in test output. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-23 16:08:22 +09:00
cat	cc1efa22e2	fst: add missing fields to template ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 12:09:25 +09:00
cat	580128922b	cmd/fpkg: expose syscall policy options ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 12:01:30 +09:00
cat	23e1152baa	app/share: clean BaseError message ... This removes trailing '\n' in the PulseAudio warning. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 11:54:16 +09:00
cat	8c51012ef5	dbus: enable syscall filter ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 11:49:23 +09:00
cat	5a64cdaf4f	ldd: enable syscall filter ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 02:00:49 +09:00
cat	a30f5e1226	fortify: set up seccomp verbose logging early ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 01:58:54 +09:00
cat	9a239fa1a5	helper/bwrap: integrate seccomp into helper interface ... This makes API usage much cleaner, and encapsulates all bwrap arguments in argsWt. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-22 01:52:57 +09:00
cat	82029948e6	proc: append to ExtraFiles slice pointer ... This is useful for initialising extra files before command. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-21 12:51:39 +09:00
cat	dfcdc5ce20	state: store config in separate gob stream ... This enables early serialisation of config. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-21 12:10:58 +09:00
cat	fa0616b274	fortify: print permissive defaults warning early ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-21 12:05:31 +09:00
cat	20a3d4c458	proc/priv/shim: resolve and load seccomp rules ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 23:52:56 +09:00
cat	3df344828f	proc/priv/shim: seccomp bpf filter via libseccomp ... Rulesets adapted from Flatpak for compatibility. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 23:39:47 +09:00
cat	27f5922d5c	fst: include syscall filter configuration ... This value is passed through to shim. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 21:12:39 +09:00
cat	2cf1f46ea2	nix: test show without --short ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 21:10:24 +09:00
cat	3c55fc8e86	proc/priv/shim: do not log bwrap args ... This message is very long and does not serve much real purpose. Remove it to de-clutter verbose messages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 19:51:28 +09:00
cat	eb0ef2d115	helper/bwrap: generic extra file interface ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-20 00:20:04 +09:00
cat	2f70506865	helper/bwrap: move sync to helper state ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-19 18:38:13 +09:00
cat	cae567c109	proc/priv/shim: remove unnecessary state ... These values are only used during process creation. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-19 18:09:07 +09:00
cat	1ec901f79e	release: 0.2.10 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 22:50:08 +09:00
cat	715addaccd	helper/bwrap: append --sync-fd before -- ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 12:30:03 +09:00
cat	b31d055e20	proc/priv/init: early init check ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 12:33:33 +09:00
cat	7baca66a56	proc: remove duplicate compile-time fortify reference ... This is no longer needed since shim and init are now part of the main program. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 11:59:33 +09:00
cat	27d2914286	proc/priv/init: merge init into main program ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-18 11:47:01 +09:00
cat	ea8f228af3	proc/priv/shim: merge shim into main program ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-17 23:43:32 +09:00
cat	16db3dabe2	internal: do PR_SET_PDEATHSIG once ... This prctl affects the entire process, doing it on every OS thread is pointless. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-17 23:08:46 +09:00
cat	c4de450217	nix: do not force static linking on nix ... In a typical Nix or NixOS-based setup, the entire /nix/store directory is available to the sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-17 22:56:16 +09:00
cat	b60c01f440	fortify: switch to static linking ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-16 17:32:52 +09:00
cat	124743ffd3	app: expose single run method ... App is no longer just a simple [exec.Cmd] wrapper, so exposing these steps separately no longer makes sense and actually hinders proper error handling, cleanup and cancellation. This change removes the five-second wait when the shim dies before receiving the payload, and provides caller the ability to gracefully stop execution of the confined process. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 23:39:51 +09:00
cat	be4d8b6300	release: 0.2.9 ... This release mostly contains permissive defaults fixes and optimisations. It also contains a proof of concept version of fpkg. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 13:14:43 +09:00
cat	3e11ce6868	helper/bwrap: separate sequential/static args ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 13:07:06 +09:00
cat	562f5ed797	fst: hide sockets exposed via Filesystem ... This is mostly useful for permissive defaults. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-01-15 10:13:18 +09:00