security/fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 36 Wiki Activity

fst: rename device field
All checks were successful
Test / Create distribution (push) Successful in 26s
Details
Test / Sandbox (push) Successful in 1m46s
Details
Test / Fortify (push) Successful in 2m39s
Details
Test / Sandbox (race detector) (push) Successful in 3m1s
Details
Test / Fpkg (push) Successful in 3m38s
Details
Test / Fortify (race detector) (push) Successful in 4m10s
Details
Test / Flake checks (push) Successful in 1m5s
Details

Browse Source 
Dev is very ambiguous. Rename it here alongside upcoming config changes.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-04-11 19:22:00 +09:00
parent 9967909460
commit 2f4f21fb18
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
7 changed files with 14 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/fpkg/app.go
View File

@ -29,7 +29,7 @@ type appInfo struct {
// passed through to [fst.Config]
Net bool `json:"net,omitempty"`
// passed through to [fst.Config]
Dev bool `json:"dev,omitempty"`
Device bool `json:"dev,omitempty"`
// passed through to [fst.Config]
Tty bool `json:"tty,omitempty"`
// passed through to [fst.Config]
@ -79,7 +79,7 @@ func (app *appInfo) toFst(pathSet *appPathSet, argv []string, flagDropShell bool
Devel: app.Devel,
Userns: app.Userns,
Net: app.Net,
Dev: app.Dev,
Device: app.Device,
Tty: app.Tty || flagDropShell,
MapRealUID: app.MapRealUID,
DirectWayland: app.DirectWayland,

2
fst/config.go
View File

@ -105,7 +105,7 @@ func Template() *Config {
Devel: true,
Userns: true,
Net: true,
Dev: true,
Device: true,
Seccomp: seccomp.FilterMultiarch,
Tty: true,
Multiarch: true,

4
fst/sandbox.go
View File

@ -39,7 +39,7 @@ type (
MapRealUID bool `json:"map_real_uid"`
// expose all devices
Dev bool `json:"dev,omitempty"`
Device bool `json:"device,omitempty"`
// container host filesystem bind mounts
Filesystem []*FilesystemConfig `json:"filesystem"`
// create symlinks inside container filesystem
@ -135,7 +135,7 @@ func (s *SandboxConfig) ToContainer(sys SandboxSys, uid, gid *int) (*sandbox.Par
Proc("/proc").
Tmpfs(Tmp, 1<<12, 0755)
if !s.Dev {
if !s.Device {
container.Dev("/dev").Mqueue("/dev/mqueue")
} else {
container.Bind("/dev", "/dev", sandbox.BindDevice)

2
nixos.nix
View File

@ -108,7 +108,7 @@ in
devel
userns
net
dev
device
tty
multiarch
env

2
options.nix
View File

@ -177,7 +177,7 @@ in
nix = mkEnableOption "nix daemon access";
mapRealUid = mkEnableOption "mapping to priv-user uid";
dev = mkEnableOption "access to all devices";
device = mkEnableOption "access to all devices";
insecureWayland = mkEnableOption "direct access to the Wayland socket";
gpu = mkOption {

3
print.go
View File

@ -92,8 +92,9 @@ func printShowInstance(
}
}
writeFlag("userns", sandbox.Userns)
writeFlag("devel", sandbox.Devel)
writeFlag("net", sandbox.Net)
writeFlag("dev", sandbox.Dev)
writeFlag("device", sandbox.Device)
writeFlag("tty", sandbox.Tty)
writeFlag("mapuid", sandbox.MapRealUID)
writeFlag("directwl", sandbox.DirectWayland)

10
print_test.go
View File

@ -41,7 +41,7 @@ func Test_printShowInstance(t *testing.T) {
Groups: ["video"]
Directory: /var/lib/persist/home/org.chromium.Chromium
Hostname: "localhost"
Flags: userns net dev tty mapuid autoetc
Flags: userns devel net device tty mapuid autoetc
Etc: /etc
Cover: /var/run/nscd
Path: /run/current-system/sw/bin/chromium
@ -120,7 +120,7 @@ App
Groups: ["video"]
Directory: /var/lib/persist/home/org.chromium.Chromium
Hostname: "localhost"
Flags: userns net dev tty mapuid autoetc
Flags: userns devel net device tty mapuid autoetc
Etc: /etc
Cover: /var/run/nscd
Path: /run/current-system/sw/bin/chromium
@ -217,7 +217,7 @@ App
"GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
},
"map_real_uid": true,
"dev": true,
"device": true,
"filesystem": [
{
"src": "/nix/store"
@ -342,7 +342,7 @@ App
"GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
},
"map_real_uid": true,
"dev": true,
"device": true,
"filesystem": [
{
"src": "/nix/store"
@ -521,7 +521,7 @@ func Test_printPs(t *testing.T) {
"GOOGLE_DEFAULT_CLIENT_SECRET": "OTJgUOQcT7lO7GsGZq2G4IlT"
},
"map_real_uid": true,
"dev": true,
"device": true,
"filesystem": [
{
"src": "/nix/store"