100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
cat	f280994957	internal/app: check nscd socket for path hiding ... This can seriously break things, and exposes extra host attack surface, so include it here. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 20:47:30 +09:00
cat	ae7b343cde	hst: reword and move constants ... These values are considered part of the stable, exported API, so move them to hst. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 17:40:32 +09:00
cat	a63a372fe0	internal/app: merge static stub ... These tests now serve as integration tests, and finer grained tests for each op will be added slowly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 17:15:14 +09:00
cat	16f9001f5f	hst/config: update doc comments ... Some information here are horribly out of date. This change updates and improves all doc comments. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 04:12:53 +09:00
cat	80ad2e4e23	internal/app: do not offset base value ... This value is applied to the shim, it is incorrect to offset the base value as well. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 03:59:52 +09:00
cat	92b83bd599	internal/app: apply pd behaviour to outcomeState ... This avoids needlessly clobbering hst.Config. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 03:53:23 +09:00
cat	8ace214832	system/wayland: hang up security-context-v1 internally ... This should have been an implementation detail and should not be up to the caller to close. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 03:25:13 +09:00
cat	eb5ee4fece	internal/app: modularise outcome finalise ... This is the initial effort of splitting up host and container side of finalisation for params to shim. The new layout also enables much finer grained unit testing of each step, as well as partition access to per-app state for each step. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-05 02:52:50 +09:00
cat	9462af08f3	system/dbus: dump buffer internally ... This should have been an implementation detail and should not be up to the caller to call it. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-04 20:31:14 +09:00
cat	a5f0aa3f30	internal/app: declutter and merge small files ... This should make internal/app easier to work with for the upcoming params to shim. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-03 16:59:29 +09:00
cat	dd0bb0a391	internal/app: check username validation ... This stuff should be hardcoded in libc, but check it anyway. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-03 16:42:42 +09:00
cat	d16da6da8c	system: enforce absolute paths ... This is less error-prone, and is quite easy to integrate considering internal/app has already migrated to container.Absolute. Closes #11. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-10-03 02:26:14 +09:00
cat	e58181a930	internal/app/paths: defer extra formatting ... This reduces payload size for params to shim. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-30 00:21:26 +09:00
cat	71e70b7b5f	internal/app/paths: do not print messages ... This change was missed while merging the rest of the logging changes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-29 09:30:57 +09:00
cat	afa1a8043e	helper/proc: raise FulfillmentTimeout in tests ... This appears to be yet another source of spurious test failures. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-29 07:44:33 +09:00
cat	1ba1cb8865	hst/config: remove seccomp bit fields ... These serve little purpose and are not friendly for use from other languages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-29 07:07:16 +09:00
cat	44ba7a5f02	hst/enablement: move bits from system ... This is part of the hst API, should not be in the implementation package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-29 06:34:29 +09:00
cat	dc467493d8	internal: remove hlog ... This package has been fully replaced by container.Msg. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-29 06:21:04 +09:00
cat	46cd3a28c8	container: remove global msg ... This frees all container instances of side effects. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-29 06:11:47 +09:00
cat	ad1bc6794f	release: 0.2.2 ... Unfortunately removal of internal/hlog brought about some changes that breaks API. This will likely be the last 0.2.x release. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-28 21:58:19 +09:00
cat	e55822c62f	container/init: reduce verbose noise ... This makes it possible to optionally omit the identifying verbose message, for when the Op implementation can provide a much more useful message in its case, using information not yet available to the String method. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-28 21:51:10 +09:00
cat	802e6afa34	container/output: move global output to msg ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-27 19:55:37 +09:00
cat	e906cae9ee	container/output: export suspendable writer ... This is quite useful for other packages as well. This change prepares internal/hlog for removal. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-27 19:46:35 +09:00
cat	ae2df2c450	internal: remove sys package ... This package is replaced by container/stub. Remove and replace it with unexported implementation for the upcoming test suite rewrite. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-25 13:51:54 +09:00
cat	6e3f34f2ec	internal/app: merge finalise test cases ... This cleans everything up a bit for the upcoming test suite rewrite. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-25 12:11:02 +09:00
cat	65a0bb9729	internal/sys/hsu: expose hsurc identifier ... This maintains a compatible interface for now, to ease merging of the upcoming changes to internal/app. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-24 21:17:04 +09:00
cat	afa7a0800d	cmd/hsu: return hsurc id ... The uid format is stable, this value is what caller has to obtain through hsu. Closes #14. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-24 21:10:13 +09:00
cat	773253fdf5	test/sandbox: raise timeout ... The integration vm is being very slow for some reason. This change should reduce spurious timeouts. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-24 19:41:59 +09:00
cat	409ed172c8	internal/app: handle LookupGroup error ... This could return errnos from the cgo calls. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-24 19:36:55 +09:00
cat	1c4f593566	internal/app: unexport outcome, remove app struct ... The App struct no longer does anything, and the outcome struct is entirely opaque. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-24 18:44:14 +09:00
cat	b99c63337d	internal/app: do not return from shim start ... The whole RunState ugliness and the other horrendous error handling conditions for internal/app come from an old design proposal for maintaining all app containers under the same daemon process for a user. The proposal was ultimately rejected but the implementation remained. It is removed here to alleviate internal/app from much of its ugliness and unreadability. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-24 13:37:38 +09:00
cat	f09133a224	test: check init lingering timeout behaviour ... This checks init timeout on lingering process after initial process termination. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-22 21:56:29 +09:00
cat	16409b37a2	internal/app: compensate shim timeout ... This catches cases where the shim has somehow locked up, so it should wait out the full shim WaitDelay as well. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-16 02:23:19 +09:00
cat	a2a291791c	internal/sys: separate hsu uid cache ... This begins the effort of the removal of the sys package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-15 02:30:47 +09:00
cat	8690419c2d	hst: replace internal/app error ... This turns out to still be quite useful across internal/app and its relatives. Perhaps a cleaner replacement for baseError. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-15 01:44:43 +09:00
cat	1cdc6b4246	test/sandbox: create marker in /var/tmp ... This prepares the test suite for private TMPDIR. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-14 16:45:17 +09:00
cat	56aad8dc11	test/sandbox/tool: marker pathname from flag ... Since this is going to be placed in a shared directory, it needs to be unique to the identity. Instead of trying to figure out identity from mountinfo, just have the test script pass hardcoded values. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-14 15:57:41 +09:00
cat	83c4f8b767	test/sandbox: check extra writable paths ... This is not always obvious from mountinfo. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-14 15:12:51 +09:00
cat	d0ddd71934	test/sandbox: bind /var/tmp writable ... This makes it possible to place markers with private tmpdir. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-14 14:59:53 +09:00
cat	70e02090f7	nix: use slightly less ambiguous type ... I had trouble getting Nix to merge json arrays properly, I am not sure that this helps. At this point I have given up trying to understand Nix type system, and I am just trying to keep the Nix stuff going with extensive tests until it can be replaced by lkl for testing and planterette for general usage. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-14 14:45:14 +09:00
cat	ca247b8037	internal/app: mount /dev/shm early ... This avoids covering /dev/shm mounts from hst. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-14 01:49:42 +09:00
cat	3f25c3f0af	container: initialise cmd early ... This allows use of more cmd methods. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-13 20:01:33 +09:00
cat	e271fa77aa	nix: update flake lock ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-13 12:07:57 +09:00
cat	f876043844	internal/hlog: remove error wrapping ... This was a stopgap solution that lasted for way too long. This finally removes it and prepares internal/app for some major changes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-12 06:52:35 +09:00
cat	6265aea73a	system: partial I inherit dispatcher ... This enables I struct methods to be checked. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-11 02:02:31 +09:00
cat	c8a0effe90	system/wayland: use syscall dispatcher ... This enables wayland op methods to be instrumented. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-11 01:48:18 +09:00
cat	8df01b71d4	system: remove test package ... This prepares the Commit and Revert methods for testing via stub. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-10 23:50:22 +09:00
cat	985c4dd2fc	system/xhost: wrap revert error correctly ... This otherwise creates a confusing error message on a revert failure. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-08 04:17:39 +09:00
cat	da2b9c01ce	system/tmpfiles: do not fail for smaller files ... The limit is meant to be an upper bound. Handle EOF and print verbose message for it instead of failing. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-08 03:22:10 +09:00
cat	323d132c40	system/mkdir: use syscall dispatcher ... This enables mkdir op methods to be instrumented. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 22:30:08 +09:00
cat	6cc2b406a4	system/link: use syscall dispatcher ... This enables hardlink op methods to be instrumented. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 19:47:58 +09:00
cat	fcd0f2ede7	system/output: pass through LinkError ... This has similar formatting to PathError. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 17:41:06 +09:00
cat	e68db7fbfc	system: unexport Op implementations ... None of these are valid with their zero value, and the implementations assume they are created by the builder methods. They are by all means an implementation detail and exporting them makes no sense. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 16:16:03 +09:00
cat	ac81cfbedc	system/dbus: print incomplete string in buffer ... Not sure if this will ever be reached, but nice to have nonetheless. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 15:50:29 +09:00
cat	05db06c87b	system/dbus: use syscall dispatcher ... This allows dbus op methods and builder to be instrumented. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 14:25:19 +09:00
cat	e603b688ca	system/dispatcher: expose test reporting to builder ... This is currently unused but useful for builders with errors. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 12:59:33 +09:00
cat	a9def08533	system/dbus: drop proxy output beyond threshold ... This prevents xdg-dbus-proxy from running the priv process out of memory. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 02:56:21 +09:00
cat	ecaf43358d	system/dbus: create context in subtest ... This is causing a huge amount of spurious test failures due to the poor performance of the integration vm. This should finally put an end to the annoyance. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-05 05:15:40 +09:00
cat	197fa65b8f	system/dbus: remove redundant proxy pairs ... This is left over from before dbus.Final. Remove them now as they serve no purpose. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-05 02:07:56 +09:00
cat	e81a45e849	container/dispatcher: optional stub wait4 signal association ... This synchronises the wait4 return after the toplevel signal call in lowlastcap_signaled_cancel_forward_error. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-04 20:28:49 +09:00
cat	3920acf8c2	container/stub: remove function call in handleExit ... This gets inlined and does not cause problems usually but turns out -coverpkg uninlines it and breaks the recovery. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-04 19:39:12 +09:00
cat	19630a9593	container/dispatcher: remove wait4 test log ... Turns out the reporting methods are not safe for concurrent use, despite the claim in testing.T doc comment. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-04 05:30:57 +09:00
cat	4051577d6b	container/stub: override goexit methods ... FailNow, Fatal, Fatalf, SkipNow, Skip and Skipf must be called from the goroutine created by the test. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-04 04:51:49 +09:00
cat	ddfb865e2d	system/dispatcher: wrap syscall helper functions ... This allows tests to stub all kernel behaviour, like in the container package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-04 04:15:25 +09:00
cat	024d2ff782	system: improve tests of the I struct ... This cleans up for the test overhaul of this package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-03 02:16:10 +09:00
cat	6f719bc3c1	system: update doc commands and remove mutex ... The mutex is not really doing anything, none of these methods make sense when called concurrently anyway. The copylocks analysis is still satisfied by the noCopy struct. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-02 04:54:34 +09:00
cat	1b5d20a39b	container/dispatcher: stub.Call initialisation helper function ... This keeps composites analysis happy without making the test cases (too) bloated. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-02 04:44:08 +09:00
cat	49600a6f46	container/stub: export stub helpers ... These are very useful in many packages containing relatively large amount of code making calls to difficult or impossible to stub functions. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-31 23:11:25 +09:00
cat	b489a3bba1	system/output: implement MessageError ... This error is also formatted differently based on state. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-31 13:51:21 +09:00
cat	780e3e5465	container/msg: optionally provide error messages ... This makes handling of fatal errors a lot less squirmy. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-31 11:57:59 +09:00
cat	712cfc06d7	container: wrap container init start errors ... This helps indicate the exact origin and nature of the error. This eliminates generic WrapErr from container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-30 23:44:48 +09:00
cat	f5abce9df5	system: wrap op errors ... This passes more information allowing for better error handling. This eliminates generic WrapErr from system. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-30 22:49:12 +09:00
cat	ddb003e39b	system/internal/xcb: refactor and clean up ... This package still does not deserve to be out of internal, but at least it is less haunting now. I am still not handling the xcb error though, the struct is almost entirely undocumented and the implementation is unreadable. Not even going to try. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-30 20:02:18 +09:00
cat	b12c290f12	system/wayland: improve error descriptions ... A lot of these errors have very short and nondescript descriptions. These are only returned on incorrect API usage, but it makes sense to make them more descriptive anyway. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-30 16:51:40 +09:00
cat	0122593312	system/acl: wrap libacl errors in PathError ... This helps determine which libacl function the errno came from. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-30 13:19:15 +09:00
cat	6aa431d57a	system/acl: update test log messages ... Most of these were never updated after UpdatePerm was renamed to Update. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-30 12:55:49 +09:00
cat	08eeafe817	container/mount: unwrap vfs decoder errors ... These are now handled by init. This eliminates generic WrapErr from mount and procPaths. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 22:15:05 +09:00
cat	d7c7c69a13	container/dispatcher: check simple test errors via reflect ... Again, avoids the errors package concealing unexpected behaviours. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 22:12:21 +09:00
cat	50972096cd	container/vfs: wrap decoder errors ... This passes line information and handles strconv errors so it reads better. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 21:51:31 +09:00
cat	905b9f9785	container/initoverlay: invalid argument type ... This eliminates generic WrapErr from overlay. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 02:56:56 +09:00
cat	1c7e634f09	container/dispatcher: check test errors via reflect ... Using the errors package might conceal some incorrect behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 02:35:24 +09:00
cat	8d472ebf2b	container/inittmpfs: unwrap out of bounds error ... This eliminates generic WrapErr from tmpfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 02:15:48 +09:00
cat	4da6463135	container/init: unwrap path errors ... These are also now handled by init properly, so wrapping them in self is meaningless and unreachable. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 02:04:09 +09:00
cat	eb3385d490	container/initsymlink: unwrap mount errors ... The mount function now wraps its own errors in a much more descriptive type with proper message formatting. Wrapping them no longer makes any sense. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 01:46:54 +09:00
cat	b8669338da	container/initsymlink: unwrap absolute error ... This is now handled properly by the init. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 01:43:11 +09:00
cat	f24dd4ab8c	container/init: handle unwrapped errors ... This is much cleaner from both the return statement and the error handling. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 01:37:13 +09:00
cat	a462341a0a	container: repeat and impossible state types ... This moves repeated Op errors and impossible internal state errors off of msg. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 01:12:02 +09:00
cat	84ad9791e2	container: wrap mount syscall errno ... This is the first step to deprecating the generalised error wrapping error message pattern. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-29 01:06:12 +09:00
cat	b14690aa77	internal/app: remove seal interface ... This further cleans up the package for the restructure. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-28 01:07:51 +09:00
cat	d0b6852cd7	internal/app: remove app interface ... It is very clear at this point that there will not be multiple implementations of App, and the internal/app package will never move out of internal due to hsu. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-28 00:54:44 +09:00
cat	da0459aca1	internal/app: update doc comments ... A lot of these comments are quite old and have not been updated to reflect changes. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-28 00:45:57 +09:00
cat	1be8de6f5c	internal/app: less strict username regex ... Use the default value of NAME_REGEX from adduser. Should not hurt compatibility while being less strict. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-28 00:22:55 +09:00
cat	0f41d96671	internal: move sysconf wrapper to app ... This should not be used and is not useful in other packages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-28 00:04:58 +09:00
cat	92f510a647	cmd/hakurei/command: pd run dbus-verbose nil check ... This otherwise dereferences a nil pointer when dbus-verbose is set and either session or system bus are nil. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-09-06 00:09:25 +09:00
cat	acb6931f3e	app/seal: leave $DISPLAY as is on host abstract ... This helps work around faulty software that misinterprets unix: DISPLAY string. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-27 20:42:03 +09:00
cat	9d932d1039	release: 0.2.1 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 03:33:45 +09:00
cat	9bc8532d56	container/initdev: mount tmpfs on shm for ro dev ... Programs expect /dev/shm to be a writable tmpfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 03:27:07 +09:00
cat	07194c74cb	release: 0.2.0 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 02:23:59 +09:00
cat	4cf694d2b3	hst: use hsu userid for share path suffix ... The privileged user is identifier to hakurei through its hsu userid. Using the kernel uid here makes little sense and is a leftover design choice from before hsu was implemented. Closes #7. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 02:16:33 +09:00
cat	c9facb746b	hst/config: remove data field, rename dir to home ... There is no reason to give the home directory special treatment, as this behaviour can be quite confusing. The home directory also does not necessarily require its own mount point, it could be provided by a parent or simply be ephemeral. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 00:56:10 +09:00