100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
cat	d65e5f817a	container/initplace: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 19:19:27 +09:00
cat	696e593898	container/initoverlay: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 17:33:15 +09:00
cat	97ab24feef	container/init: use absolute compare method ... More checks are also added. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 17:14:36 +09:00
cat	31f0dd36df	absolute: efficient equivalence check method ... This is more efficient and makes the call site cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 17:06:38 +09:00
cat	9aec2f46fe	container/initdev: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:55:45 +09:00
cat	022cc26b2e	container/capability: check CAP_TO_INDEX and CAP_TO_MASK ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:45:00 +09:00
cat	b4c018da8f	container/autoetc: do not bypass absolute check ... This can now be done cleanly via path function wrappers. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:37:11 +09:00
cat	66f52407d3	container/initmkdir: check path equivalence by value ... Fixes regression introduced while integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:32:22 +09:00
cat	e463faf649	container/initbind: check path equivalence by value ... Same problem as autoroot, never updated the checks after integrating Absolute. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:22:04 +09:00
cat	375acb476d	container/autoroot: check host path equivalence by value ... This will never return true otherwise unless the equivalent paths happen to be interned by the caller. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 02:14:39 +09:00
cat	c81c9a9d75	container/init: split setup ops into individual files ... This significantly increases readability. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 01:28:31 +09:00
cat	339e4080dc	container/ops: move Op type to init file ... This helps with the eventual separation of all setup ops into individual files. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 01:11:24 +09:00
cat	e0533aaa68	container/autoroot: filter dentry with empty name ... This is unreachable, but nice to have just in case. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 01:03:49 +09:00
cat	13c7083bc0	container: ptrace protection via Yama LSM ... This is only a nice to have feature as the init process has no additional privileges and the monitor process was never reachable anyway. Closes #4. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-20 00:43:55 +09:00
cat	6947ff04e0	system/dbus/proc: host abstract only when not binding ... The test failure seems to be caused by an unrelated bug in xdg-dbus-proxy. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-19 23:39:14 +09:00
cat	140fe21237	container/params: check setup/receive behaviour ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 22:30:34 +09:00
cat	f52d2c7db6	container/path: check create and mountinfo helpers ... These can quite easily be checked within the framework. The scanner fault injection might require updating at some point if the implementation changes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 21:30:28 +09:00
cat	3c9e547c4a	cmd/hpkg: add deprecation notice ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 17:00:27 +09:00
cat	a3988c1a77	hst: rename net and abstract fields ... This makes more sense and matches the container library. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 16:48:01 +09:00
cat	69a4ab8105	container: move PR_SET_NO_NEW_PRIVS to parent ... This allows some LSM setup in the parent. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:46:02 +09:00
cat	22d577ab49	test/sandbox: do not discard stderr getting hash ... This is the first hakurei run in the test, if the container outright fails to start this is often where it happens, so throwing away the output is very unhelpful. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:36:13 +09:00
cat	83a1c75f1a	app: set up acl on X11 socket ... The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging security/hakurei#1. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:30:58 +09:00
cat	0ac6e99818	container: start from locked thread ... This allows setup that relies on per-thread state like securebits and landlock, from the parent side. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 17:42:22 +09:00
cat	f35733810e	container: check output helper functions ... The container test suite has always been somewhat inadequate due to the inability of coverage tooling to reach into containers. This has become an excuse for not testing non-container code as well, which lead to the general lack of confidence when working with container code. This change aims to be one of many to address that to some extent. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 02:59:37 +09:00
cat	9c1a5d43ba	container: enforce nonrepeatable autoetc and autoroot ... These keep track of some internal state, and they don't make sense to have multiple instances of anyway, so instead of dealing with that, just make them nonrepetable. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 01:43:11 +09:00
cat	8aa65f28c6	container: allow additional state between ops ... This is useful for ops that need to be aware of previous instances of themselves. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-17 01:32:07 +09:00
cat	f9edec7e41	hst: merge miscellaneous files ... These structs were going to be bigger at some point. They turned out not to be. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:32:57 +09:00
cat	305c600cf5	hst: move container type to config ... Container state initialisation is no longer implemented in hst so splitting them no longer makes sense. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:28:36 +09:00
cat	8dd3e1ee5d	hst/fs: rename method Target to Path ... This allows adapter structs to use the same field names as Op structs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:06:41 +09:00
cat	4ffeec3004	hst/enablement: editor friendly enablement adaptor ... Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 05:16:51 +09:00
cat	9ed3ba85ea	hst/fs: implement overlay fstype ... This finally exposes overlay mounts in the high level hakurei API. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 04:00:55 +09:00
cat	4433c993fa	nix: check config via hakurei ... This is unfortunately the only feasible way of doing this in nix. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 03:27:54 +09:00
cat	430991c39b	hst/fs: remove type method ... Having a method that returns the canonical string representation of its type seemed like a much better idea for an implementation that never made it to staging. Remove it here and clean up marshal type assertions. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 00:39:02 +09:00
cat	ba3227bf15	container: export overlay escape ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 23:44:11 +09:00
cat	0e543a58b3	hst/fs: valid method on underlying interface ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 21:36:22 +09:00
cat	c989e7785a	hst/info: include extra information ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 19:52:03 +09:00
cat	332d90d6c7	container/path: remove unused path ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 05:00:09 +09:00
cat	99ac96511b	hst/fs: interface filesystem config ... This allows mount points to be represented by different underlying structs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 04:52:49 +09:00
cat	e99d7affb0	container: use absolute for pathname ... This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-11 04:56:42 +09:00
cat	41ac2be965	container/absolute: wrap safe stdlib functions ... These functions do not change the absoluteness of a pathname. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-10 03:11:10 +09:00
cat	02271583fb	container: remove PATH lookup behaviour ... This is way higher level than the container package and does not even work unless every path is mounted in the exact same location. This behaviour causes nothing but confusion and problems, Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 19:08:54 +09:00
cat	ef54b2cd08	container/absolute: early absolute pathname check ... This is less error-prone, and allows pathname to be checked once. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 18:53:46 +09:00
cat	82608164f6	container/params: remove confusingly named error ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 17:37:46 +09:00
cat	edd6f2cfa9	container: document ambient capabilities ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 02:11:55 +09:00
cat	acffa76812	container/ops: implement overlay op ... There are significant limitations to using the overlay mount, and the implementation in the kernel is quite quirky. For now the Op is quite robust, however a higher level interface for it has not been decided yet. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 01:54:48 +09:00
cat	8da76483e6	container/path: fix typo "paths" ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 01:32:48 +09:00
cat	534c932906	container: test case runtime initialisation ... This allows for more sophisticated test setup. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 01:03:35 +09:00
cat	fee10fed4d	container: test bypass output buffer on verbose ... This restores verbose behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 00:57:27 +09:00
cat	a4f7e92e1c	test/interactive: helper scripts for tracing ... The vm state is discarded often, and it is quite cumbersome to set everything up again when the shell history is gone. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 00:56:25 +09:00
cat	f1a53d6116	container: raise CAP_DAC_OVERRIDE ... This is required for upperdir and workdir checks in overlayfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-08 00:43:19 +09:00
cat	b353c3deea	nix: make src overlay writable ... The lowerdir is in the nix store. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 18:07:19 +09:00
cat	fde5f1ca64	container: buffer test output ... This further reduces noise on test failure by only passing through output of the failed test. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 02:55:58 +09:00
cat	4d0bdd84b5	container: test respect verbose flag ... This reduces noise on test failure. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 02:50:00 +09:00
cat	72a931a71a	nix: interactive nixos vm ... This is useful for quickly spinning up an ephemeral hakurei environment for testing changes or reproducing vm test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-07 02:46:04 +09:00
cat	9a25542c6d	container/init: use mount string constants ... These literals were missed when the constants were first defined. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-04 04:00:05 +09:00
cat	c6be82bcf9	container/path: fhs path constants ... This increases readability since this can help disambiguate absolute paths from similarly named path segments. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 21:16:45 +09:00
cat	38245559dc	container/ops: mount dev readonly ... There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 19:18:53 +09:00
cat	7b416d47dc	container/ops: merge mqueue and dev Ops ... There is no reason to mount mqueue anywhere else, and these Ops usually follow each other. This change merges them. This helps decrease IPC overhead and also enables mounting dev readonly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 19:13:46 +09:00
cat	15170735ba	container/mount: move tmpfs sysroot prefixing to caller ... The mountTmpfs helper is a relatively low level function that is not exposed as part of the API. Prefixing sysroot here not only introduces overhead but is also quite error-prone. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 18:06:41 +09:00
cat	6a3886e9db	container/op: unexport bind resolved source field ... This is used for symlink resolution and is only used internally. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 17:57:37 +09:00
cat	ff66296378	container/mount: mount data escape helper function ... For formatting user-supplied path strings into overlayfs mount data. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 17:46:14 +09:00
cat	347a79df72	container: improve clone flags readability ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 18:19:44 +09:00
cat	0f78864a67	container/mount: export mount string constants ... This improves code readability and should also be useful for callers choosing to preserve CAP_SYS_ADMIN. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 17:20:09 +09:00
cat	b32b1975a8	hst/container: remove cover ... This was never useful, and is now completely replaced by regular FilesystemConfig being able to mount tmpfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 00:34:52 +09:00
cat	2b1eaa62f1	update github notice ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 00:21:16 +09:00
cat	f13dca184c	release: 0.1.3 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 00:02:54 +09:00
cat	3b8a3d3b00	app: remount root readonly ... This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 23:56:28 +09:00
cat	c5d24979f5	container/ops: expose remount as Op ... This is useful for building a filesystem hierarchy then remounting it readonly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 23:48:02 +09:00
cat	1dc780bca7	container/mount: separate remount from bind ... Remount turns out to be useful in other places. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 23:32:38 +09:00
cat	ec33061c92	nix: remove nscd cover ... This is a pd workaround that does nothing in the nixos module. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 22:04:58 +09:00
cat	af0899de96	hst/container: mount tmpfs via magic src string ... There's often good reason to mount tmpfs in the container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 21:23:52 +09:00
cat	547a2adaa4	container/mount: pass tmpfs flags ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 18:59:06 +09:00
cat	c02948e155	cmd/hakurei: print autoroot configuration ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 04:29:01 +09:00
cat	387b86bcdd	app: integrate container autoroot ... Doing this instead of mounting directly on / because it's impossible to ensure a parent is available for every path hakurei wants to mount to. This situation is similar to autoetc hence the similar name, however a symlink mirror will not work in this case. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 04:21:54 +09:00
cat	4e85643865	container: implement autoroot as setup op ... This code is useful beyond just pd behaviour, and implementing it this way also reduces IPC overhead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 04:04:36 +09:00
cat	987981df73	test/sandbox: check pd behaviour ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 03:27:02 +09:00
cat	f14e7255be	container/ops: use correct flags value in bind string ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 00:54:08 +09:00
cat	a8a79a8664	cmd/hpkg: rename from planterette ... Planterette is now developed in another repository, so rename this proof of concept to avoid confusion. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-31 23:57:11 +09:00
cat	3ae0cec000	test: increase vm memory ... This hopefully fixes the intermittent failures. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-31 22:08:01 +09:00
cat	4e518f11d8	container/ops: autoetc implementation to separate file ... This is not a general purpose setup Op. Separate it so it is easier to find. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-31 19:54:03 +09:00
cat	cb513bb1cd	release: 0.1.2 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-29 03:11:33 +09:00
cat	f7bd28118c	hst: configurable wait delay ... This is useful for programs that take a long time to clean up. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-29 03:06:49 +09:00
cat	940ee00ffe	container/init: configurable lingering process wait delay ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-29 02:38:17 +09:00
cat	b43d104680	app: integrate interrupt forwarding ... This significantly increases usability of command line tools running through hakurei. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-29 02:23:06 +09:00
cat	ddf48a6c22	app/shim: implement signal handler outcome in Go ... This needs to be done from the Go side eventually anyway to integrate the signal forwarding behaviour now supported by the container package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 23:39:30 +09:00
cat	a0f499e30a	app/shim: separate signal handler implementation ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 21:52:53 +09:00
cat	d6b07f12ff	container: forward context cancellation ... This allows container processes to exit gracefully. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 01:45:38 +09:00
cat	65fe09caf9	container: check cancel signal delivery ... This change also makes some parts of the test more robust. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 01:04:29 +09:00
cat	a1e5f020f4	container: improve doc comments ... Putting them on the builder methods is more useful. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-27 12:27:42 +09:00
cat	bd3fa53a55	container: access test case by index in helper ... This is more elegant and allows for much easier extension of the tests. Mountinfo is still serialised however due to libPaths nondeterminism. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-26 18:59:19 +09:00
cat	625632c593	nix: update flake lock ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-26 18:57:54 +09:00
cat	e71ae3b8c5	container: remove custom cmd initialisation ... This part of the interface is very unintuitive and only used for testing, even in testing it is inelegant and can be done better. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-25 00:45:10 +09:00
cat	9d7a19d162	container: use more reliable nonexistence ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-18 23:18:26 +09:00
cat	6ba19a7ba5	release: 0.1.1 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-09 05:42:31 +09:00
cat	749a2779f5	test/sandbox: add arm64 constants ... Most of these are differences in qemu. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-09 05:36:35 +09:00
cat	e574042d76	test/sandbox: verify seccomp on all test cases ... This change also makes seccomp hashes cross-platform. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-09 04:21:35 +09:00
cat	2b44493e8a	test/sandbox: guard on testtool tag ... This tool should not show up when building hakurei normally. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 20:11:29 +09:00
cat	c30dd4e630	test/sandbox/seccomp: remove uselib ... This syscall is not wired on all platforms. This test barely does anything anyway and seccomp is covered by the privileged test instrumentation. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 15:28:55 +09:00
cat	d90da1c8f5	container/seccomp: add arm64 constants ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 14:58:03 +09:00
cat	5853d7700f	container/seccomp: move bpf hashes ... Filter programs are different across platforms. This representation is also much more readable. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 14:41:47 +09:00