security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 36 Wiki Activity

cmd/fpkg/install: pass app to fortify invocations
All checks were successful
Tests / Go tests (push) Successful in 34s
Details
Nix / NixOS tests (push) Successful in 3m53s
Details

Browse Source 
Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2024-12-29 23:51:10 +09:00
parent 66ba4cea5c
commit 031304444a
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
cmd/fpkg/install.go
View File

@ -142,7 +142,7 @@ func actionInstall(args []string) {
"nix copy --offline --no-check-sigs --all --from file://$BUNDLE/res --to $PWD", "nix copy --offline --no-check-sigs --all --from file://$BUNDLE/res --to $PWD",
// make cache directory world-readable for autoetc // make cache directory world-readable for autoetc
"chmod 0755 .", "chmod 0755 .",
}, workDir, bundle, pathSet, dropShellInstall, cleanup) }, workDir, app, pathSet, dropShellInstall, cleanup)
/* /*
Activate home-manager generation. Activate home-manager generation.
@ -155,7 +155,7 @@ func actionInstall(args []string) {
"rm -rf .local/state/{nix,home-manager}", "rm -rf .local/state/{nix,home-manager}",
// run activation script // run activation script
bundle.ActivationPackage + "/activate", bundle.ActivationPackage + "/activate",
}, false, bundle, pathSet, dropShellActivate, cleanup) }, false, app, pathSet, dropShellActivate, cleanup)
/* /*
Installation complete. Write metadata to block re-installs or downgrades. Installation complete. Write metadata to block re-installs or downgrades.
@ -184,9 +184,9 @@ func actionInstall(args []string) {
cleanup() cleanup()
} }
func withNixDaemon(action string, command []string, net bool, bundle *bundleInfo, pathSet *appPathSet, dropShell bool, beforeFail func()) { func withNixDaemon(action string, command []string, net bool, app *bundleInfo, pathSet *appPathSet, dropShell bool, beforeFail func()) {
fortifyAppDropShell(&fst.Config{ fortifyAppDropShell(&fst.Config{
ID: bundle.ID, ID: app.ID,
Command: []string{shell, "-lc", "rm -f /nix/var/nix/daemon-socket/socket && " + Command: []string{shell, "-lc", "rm -f /nix/var/nix/daemon-socket/socket && " +
// start nix-daemon // start nix-daemon
"nix-daemon --store / & " + "nix-daemon --store / & " +
@ -197,13 +197,13 @@ func withNixDaemon(action string, command []string, net bool, bundle *bundleInfo
" && pkill nix-daemon", " && pkill nix-daemon",
}, },
Confinement: fst.ConfinementConfig{ Confinement: fst.ConfinementConfig{
AppID: bundle.AppID, AppID: app.AppID,
Groups: bundle.Groups, Groups: app.Groups,
Username: "fortify", Username: "fortify",
Inner: path.Join("/data/data", bundle.ID), Inner: path.Join("/data/data", app.ID),
Outer: pathSet.homeDir, Outer: pathSet.homeDir,
Sandbox: &fst.SandboxConfig{ Sandbox: &fst.SandboxConfig{
Hostname: formatHostname(bundle.Name) + "-" + action, Hostname: formatHostname(app.Name) + "-" + action,
UserNS: true, // nix sandbox requires userns UserNS: true, // nix sandbox requires userns
Net: net, Net: net,
NoNewSession: dropShell, NoNewSession: dropShell,
@ -211,7 +211,7 @@ func withNixDaemon(action string, command []string, net bool, bundle *bundleInfo
{Src: pathSet.nixPath, Dst: "/nix", Write: true, Must: true}, {Src: pathSet.nixPath, Dst: "/nix", Write: true, Must: true},
}, },
Link: [][2]string{ Link: [][2]string{
{bundle.CurrentSystem, "/run/current-system"}, {app.CurrentSystem, "/run/current-system"},
{"/run/current-system/sw/bin", "/bin"}, {"/run/current-system/sw/bin", "/bin"},
{"/run/current-system/sw/bin", "/usr/bin"}, {"/run/current-system/sw/bin", "/usr/bin"},
}, },
@ -226,24 +226,24 @@ func withNixDaemon(action string, command []string, net bool, bundle *bundleInfo
}, dropShell, beforeFail) }, dropShell, beforeFail)
} }
func withCacheDir(action string, command []string, workDir string, bundle *bundleInfo, pathSet *appPathSet, dropShell bool, beforeFail func()) { func withCacheDir(action string, command []string, workDir string, app *bundleInfo, pathSet *appPathSet, dropShell bool, beforeFail func()) {
fortifyAppDropShell(&fst.Config{ fortifyAppDropShell(&fst.Config{
ID: bundle.ID, ID: app.ID,
Command: []string{shell, "-lc", strings.Join(command, " && ")}, Command: []string{shell, "-lc", strings.Join(command, " && ")},
Confinement: fst.ConfinementConfig{ Confinement: fst.ConfinementConfig{
AppID: bundle.AppID, AppID: app.AppID,
Username: "nixos", Username: "nixos",
Inner: path.Join("/data/data", bundle.ID, "cache"), Inner: path.Join("/data/data", app.ID, "cache"),
Outer: pathSet.cacheDir, // this also ensures cacheDir via fshim Outer: pathSet.cacheDir, // this also ensures cacheDir via fshim
Sandbox: &fst.SandboxConfig{ Sandbox: &fst.SandboxConfig{
Hostname: formatHostname(bundle.Name) + "-" + action, Hostname: formatHostname(app.Name) + "-" + action,
NoNewSession: dropShell, NoNewSession: dropShell,
Filesystem: []*fst.FilesystemConfig{ Filesystem: []*fst.FilesystemConfig{
{Src: path.Join(workDir, "nix"), Dst: "/nix", Must: true}, {Src: path.Join(workDir, "nix"), Dst: "/nix", Must: true},
{Src: workDir, Dst: path.Join(fst.Tmp, "bundle"), Must: true}, {Src: workDir, Dst: path.Join(fst.Tmp, "bundle"), Must: true},
}, },
Link: [][2]string{ Link: [][2]string{
{bundle.CurrentSystem, "/run/current-system"}, {app.CurrentSystem, "/run/current-system"},
{"/run/current-system/sw/bin", "/bin"}, {"/run/current-system/sw/bin", "/bin"},
{"/run/current-system/sw/bin", "/usr/bin"}, {"/run/current-system/sw/bin", "/usr/bin"},
}, },