100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
cat	878b66022e	hst/fsbind: optional ensure source ... This exposes the BindEnsure flag of BindMountOp. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 00:50:23 +09:00
cat	2e0a4795f6	container/initbind: optional ensure host directory ... This is used for ensuring persistent data directories specific to the container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 00:44:45 +09:00
cat	c328b584c0	hst/fslink: improve string representation ... This shortens the representation of most common use cases and generally improves readability. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 22:52:48 +09:00
cat	9585b35d5b	hst/config: remove symlink field ... Closes #6. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 22:23:54 +09:00
cat	26cafe3e80	hst/fs: implement link fstype ... Symlinks do not require special treatment, and doing this allows placing links in order. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 21:57:38 +09:00
cat	125f150784	hst/fs: update doc comments ... The Type method no longer exists on the interface. Update doc comments to reflect that. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 21:11:39 +09:00
cat	0dcac55a0c	hst/config: remove container etc field ... This no longer needs special treatment since it can be specified as a generic filesystem entry. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 19:24:33 +09:00
cat	6d202d73b4	hst/fsbind: optional autoetc behaviour ... This generalises the special field allowing any special behaviour to be matched from target. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 18:38:19 +09:00
cat	1438096339	hst/config: handle filesystem entry targeting root ... This allows any fstype supported by hst to be directly mounted on sysroot. A special case in internal/app applies the matching entry early and excludes it from path hiding. Closes #5. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 17:52:57 +09:00
cat	059164d4fa	hst/fsbind: optional autoroot behaviour ... This allows autoroot to be configured via Filesystem. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 17:44:12 +09:00
cat	8db906ee64	container/dispatcher: remove exit stub test log ... Turns out testing.T does not like being called in defer. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 17:33:35 +09:00
cat	cedfceded5	container/autoroot: remove prefix field ... This field has been a noop for a long time. Remove it to prevent further confusion. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 03:39:20 +09:00
cat	33d2dcce1b	container/initoverlay: internal bypass sysroot prefix ... This is for supporting overlay mounts for autoroot. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 02:42:22 +09:00
cat	2baa2d7063	container/init: measure init behaviour ... This used to be entirely done via integration tests, with almost no hope of error injection and coverage profile. These tests significantly increase confidence of future work in this area. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-24 04:52:32 +09:00
cat	0166833431	container/dispatcher: start goroutine in dispatcher ... This allows instrumentation of calls from goroutine without relying on finalizers. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-23 21:58:40 +09:00
cat	b3da3da525	container/init: avoid multiple lastcap calls ... This reduces the size of []kexpect in the test suite. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-23 11:09:11 +09:00
cat	1b3902df78	container/dispatcher: instrument each goroutine individually ... Scheduler nondeterminism cannot be accounted for, so do this instead. There should not be any performance penalty as these calls are optimised out for direct. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-23 11:07:16 +09:00
cat	ea1e3ebae9	container/params: pass fd instead of file ... The file is very difficult to stub. Pass fd instead as it is the value that is actually useful. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-23 00:16:46 +09:00
cat	1c692bfb79	container/init: call lockOSThread through dispatcher ... This degrades test performance if not stubbed out. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-22 22:24:14 +09:00
cat	141a18999f	container: move integration test helpers ... With the new instrumentation it is now possible to run init code outside integration tests. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-22 22:07:19 +09:00
cat	afe23600d2	container/path: use syscall dispatcher ... This allows path and mount functions to be instrumented. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-22 22:02:21 +09:00
cat	09d2844981	container/init: wrap syscall helper functions ... This allows tests to stub all kernel behaviour, enabling measurement of all function call arguments and error injection. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-22 19:27:31 +09:00
cat	d500d6e559	system/dbus: share host net ns for abstract ... Host abstract unix sockets are only accessible when also in the init net ns. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-21 21:55:23 +09:00
cat	5b73316ae0	container/syscall: doc comments from manpages ... These are pulled straight from the manpages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-21 00:33:46 +09:00
cat	5d8a2199b6	container/init: op interface valid method ... Check ops early and eliminate duplicate checks. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-21 00:18:50 +09:00
cat	a1482ecdd0	container/inittmpfs: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 20:17:28 +09:00
cat	a07f9ed84c	container/initsymlink: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 20:03:02 +09:00
cat	51304b03af	container/initremount: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 19:55:51 +09:00
cat	c6397b941f	container/initproc: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 19:29:45 +09:00
cat	d65e5f817a	container/initplace: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 19:19:27 +09:00
cat	696e593898	container/initoverlay: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 17:33:15 +09:00
cat	97ab24feef	container/init: use absolute compare method ... More checks are also added. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 17:14:36 +09:00
cat	31f0dd36df	absolute: efficient equivalence check method ... This is more efficient and makes the call site cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 17:06:38 +09:00
cat	9aec2f46fe	container/initdev: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:55:45 +09:00
cat	022cc26b2e	container/capability: check CAP_TO_INDEX and CAP_TO_MASK ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:45:00 +09:00
cat	b4c018da8f	container/autoetc: do not bypass absolute check ... This can now be done cleanly via path function wrappers. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:37:11 +09:00
cat	66f52407d3	container/initmkdir: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:32:22 +09:00
cat	e463faf649	container/initbind: check path equivalence by value ... Same problem as autoroot, never updated the checks after integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:22:04 +09:00
cat	375acb476d	container/autoroot: check host path equivalence by value ... This will never return true otherwise unless the equivalent paths happen to be interned by the caller. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:14:39 +09:00
cat	c81c9a9d75	container/init: split setup ops into individual files ... This significantly increases readability. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 01:28:31 +09:00
cat	339e4080dc	container/ops: move Op type to init file ... This helps with the eventual separation of all setup ops into individual files. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 01:11:24 +09:00
cat	e0533aaa68	container/autoroot: filter dentry with empty name ... This is unreachable, but nice to have just in case. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 01:03:49 +09:00
cat	13c7083bc0	container: ptrace protection via Yama LSM ... This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway. Closes #4. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 00:43:55 +09:00
cat	6947ff04e0	system/dbus/proc: host abstract only when not binding ... The test failure seems to be caused by an unrelated bug in xdg-dbus-proxy. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-19 23:39:14 +09:00
cat	140fe21237	container/params: check setup/receive behaviour ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 22:30:34 +09:00
cat	f52d2c7db6	container/path: check create and mountinfo helpers ... These can quite easily be checked within the framework. The scanner fault injection might require updating at some point if the implementation changes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 21:30:28 +09:00
cat	3c9e547c4a	cmd/hpkg: add deprecation notice ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 17:00:27 +09:00
cat	a3988c1a77	hst: rename net and abstract fields ... This makes more sense and matches the container library. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 16:48:01 +09:00
cat	69a4ab8105	container: move PR_SET_NO_NEW_PRIVS to parent ... This allows some LSM setup in the parent. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:46:02 +09:00
cat	22d577ab49	test/sandbox: do not discard stderr getting hash ... This is the first hakurei run in the test, if the container outright fails to start this is often where it happens, so throwing away the output is very unhelpful. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:36:13 +09:00
cat	83a1c75f1a	app: set up acl on X11 socket ... The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging security/hakurei#1. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:30:58 +09:00
cat	0ac6e99818	container: start from locked thread ... This allows setup that relies on per-thread state like securebits and landlock, from the parent side. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 17:42:22 +09:00
cat	f35733810e	container: check output helper functions ... The container test suite has always been somewhat inadequate due to the inability of coverage tooling to reach into containers. This has become an excuse for not testing non-container code as well, which lead to the general lack of confidence when working with container code. This change aims to be one of many to address that to some extent. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 02:59:37 +09:00
cat	9c1a5d43ba	container: enforce nonrepeatable autoetc and autoroot ... These keep track of some internal state, and they don't make sense to have multiple instances of anyway, so instead of dealing with that, just make them nonrepetable. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 01:43:11 +09:00
cat	8aa65f28c6	container: allow additional state between ops ... This is useful for ops that need to be aware of previous instances of themselves. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 01:32:07 +09:00
cat	f9edec7e41	hst: merge miscellaneous files ... These structs were going to be bigger at some point. They turned out not to be. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:32:57 +09:00
cat	305c600cf5	hst: move container type to config ... Container state initialisation is no longer implemented in hst so splitting them no longer makes sense. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:28:36 +09:00
cat	8dd3e1ee5d	hst/fs: rename method Target to Path ... This allows adapter structs to use the same field names as Op structs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:06:41 +09:00
cat	4ffeec3004	hst/enablement: editor friendly enablement adaptor ... Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 05:16:51 +09:00
cat	9ed3ba85ea	hst/fs: implement overlay fstype ... This finally exposes overlay mounts in the high level hakurei API. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 04:00:55 +09:00
cat	4433c993fa	nix: check config via hakurei ... This is unfortunately the only feasible way of doing this in nix. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 03:27:54 +09:00
cat	430991c39b	hst/fs: remove type method ... Having a method that returns the canonical string representation of its type seemed like a much better idea for an implementation that never made it to staging. Remove it here and clean up marshal type assertions. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 00:39:02 +09:00
cat	ba3227bf15	container: export overlay escape ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 23:44:11 +09:00
cat	0e543a58b3	hst/fs: valid method on underlying interface ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 21:36:22 +09:00
cat	c989e7785a	hst/info: include extra information ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 19:52:03 +09:00
cat	332d90d6c7	container/path: remove unused path ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 05:00:09 +09:00
cat	99ac96511b	hst/fs: interface filesystem config ... This allows mount points to be represented by different underlying structs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 04:52:49 +09:00
cat	e99d7affb0	container: use absolute for pathname ... This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-11 04:56:42 +09:00
cat	41ac2be965	container/absolute: wrap safe stdlib functions ... These functions do not change the absoluteness of a pathname. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-10 03:11:10 +09:00
cat	02271583fb	container: remove PATH lookup behaviour ... This is way higher level than the container package and does not even work unless every path is mounted in the exact same location. This behaviour causes nothing but confusion and problems, Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 19:08:54 +09:00
cat	ef54b2cd08	container/absolute: early absolute pathname check ... This is less error-prone, and allows pathname to be checked once. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 18:53:46 +09:00
cat	82608164f6	container/params: remove confusingly named error ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 17:37:46 +09:00
cat	edd6f2cfa9	container: document ambient capabilities ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 02:11:55 +09:00
cat	acffa76812	container/ops: implement overlay op ... There are significant limitations to using the overlay mount, and the implementation in the kernel is quite quirky. For now the Op is quite robust, however a higher level interface for it has not been decided yet. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 01:54:48 +09:00
cat	8da76483e6	container/path: fix typo "paths" ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 01:32:48 +09:00
cat	534c932906	container: test case runtime initialisation ... This allows for more sophisticated test setup. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 01:03:35 +09:00
cat	fee10fed4d	container: test bypass output buffer on verbose ... This restores verbose behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 00:57:27 +09:00
cat	a4f7e92e1c	test/interactive: helper scripts for tracing ... The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 00:56:25 +09:00
cat	f1a53d6116	container: raise CAP_DAC_OVERRIDE ... This is required for upperdir and workdir checks in overlayfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 00:43:19 +09:00
cat	b353c3deea	nix: make src overlay writable ... The lowerdir is in the nix store. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 18:07:19 +09:00
cat	fde5f1ca64	container: buffer test output ... This further reduces noise on test failure by only passing through output of the failed test. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 02:55:58 +09:00
cat	4d0bdd84b5	container: test respect verbose flag ... This reduces noise on test failure. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 02:50:00 +09:00
cat	72a931a71a	nix: interactive nixos vm ... This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 02:46:04 +09:00
cat	9a25542c6d	container/init: use mount string constants ... These literals were missed when the constants were first defined. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-04 04:00:05 +09:00
cat	c6be82bcf9	container/path: fhs path constants ... This increases readability since this can help disambiguate absolute paths from similarly named path segments. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 21:16:45 +09:00
cat	38245559dc	container/ops: mount dev readonly ... There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 19:18:53 +09:00
cat	7b416d47dc	container/ops: merge mqueue and dev Ops ... There is no reason to mount mqueue anywhere else, and these Ops usually follow each other. This change merges them. This helps decrease IPC overhead and also enables mounting dev readonly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 19:13:46 +09:00
cat	15170735ba	container/mount: move tmpfs sysroot prefixing to caller ... The mountTmpfs helper is a relatively low level function that is not exposed as part of the API. Prefixing sysroot here not only introduces overhead but is also quite error-prone. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 18:06:41 +09:00
cat	6a3886e9db	container/op: unexport bind resolved source field ... This is used for symlink resolution and is only used internally. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 17:57:37 +09:00
cat	ff66296378	container/mount: mount data escape helper function ... For formatting user-supplied path strings into overlayfs mount data. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 17:46:14 +09:00
cat	347a79df72	container: improve clone flags readability ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 18:19:44 +09:00
cat	0f78864a67	container/mount: export mount string constants ... This improves code readability and should also be useful for callers choosing to preserve CAP_SYS_ADMIN. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 17:20:09 +09:00
cat	b32b1975a8	hst/container: remove cover ... This was never useful, and is now completely replaced by regular FilesystemConfig being able to mount tmpfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 00:34:52 +09:00
cat	2b1eaa62f1	update github notice ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 00:21:16 +09:00
cat	f13dca184c	release: 0.1.3 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 00:02:54 +09:00
cat	3b8a3d3b00	app: remount root readonly ... This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 23:56:28 +09:00
cat	c5d24979f5	container/ops: expose remount as Op ... This is useful for building a filesystem hierarchy then remounting it readonly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 23:48:02 +09:00
cat	1dc780bca7	container/mount: separate remount from bind ... Remount turns out to be useful in other places. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 23:32:38 +09:00
cat	ec33061c92	nix: remove nscd cover ... This is a pd workaround that does nothing in the nixos module. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 22:04:58 +09:00
cat	af0899de96	hst/container: mount tmpfs via magic src string ... There's often good reason to mount tmpfs in the container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 21:23:52 +09:00