proc/priv/shim: remove unnecessary state

These values are only used during process creation.

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/app/start.go

@@ -45,20 +45,16 @@ func (a *app) Run(ctx context.Context, rs *RunState) error {
 		}
 	}
 
-	// construct shim manager
+	a.shim = new(shim.Shim)
-	a.shim = shim.New(
+	// keep a reference to shim payload for sync fd
-		uint32(a.seal.sys.UID()),
+	payload := &shim.Payload{
-		a.seal.sys.user.as,
-		a.seal.sys.user.supp,
-		&shim.Payload{
 		Argv:  a.seal.command,
 		Exec:  shimExec,
 		Bwrap: a.seal.sys.bwrap,
 		Home:  a.seal.sys.user.data,
 
 		Verbose: fmsg.Verbose(),
-		},
+	}
-	)
 
 	// startup will go ahead, commit system setup
 	if err := a.seal.sys.Commit(); err != nil {
@@ -71,7 +67,11 @@ func (a *app) Run(ctx context.Context, rs *RunState) error {
 
 	// start shim via manager
 	waitErr := make(chan error, 1)
-	if startTime, err := a.shim.Start(); err != nil {
+	if startTime, err := a.shim.Start(
+		a.seal.sys.user.as,
+		a.seal.sys.user.supp,
+		payload,
+	); err != nil {
 		return err
 	} else {
 		// shim process created
@@ -88,7 +88,7 @@ func (a *app) Run(ctx context.Context, rs *RunState) error {
 		}()
 
 		// send payload
-		if err = a.shim.Serve(shimSetupCtx); err != nil {
+		if err = a.shim.Serve(shimSetupCtx, payload); err != nil {
 			return err
 		}
 

internal/proc/priv/shim/manager.go

@@ -20,24 +20,12 @@ import (
 type Shim struct {
 	// user switcher process
 	cmd *exec.Cmd
-	// uid of shim target user
-	uid uint32
-	// string representation of application id
-	aid string
-	// string representation of supplementary group ids
-	supp []string
 	// fallback exit notifier with error returned killing the process
 	killFallback chan error
-	// shim setup payload
-	payload *Payload
 	// monitor to shim encoder
 	encoder *gob.Encoder
 }
 
-func New(uid uint32, aid string, supp []string, payload *Payload) *Shim {
-	return &Shim{uid: uid, aid: aid, supp: supp, payload: payload}
-}
-
 func (s *Shim) String() string {
 	if s.cmd == nil {
 		return "(unused shim manager)"
@@ -53,7 +41,14 @@ func (s *Shim) WaitFallback() chan error {
 	return s.killFallback
 }
 
-func (s *Shim) Start() (*time.Time, error) {
+func (s *Shim) Start(
+	// string representation of application id
+	aid string,
+	// string representation of supplementary group ids
+	supp []string,
+	// shim setup payload
+	payload *Payload,
+) (*time.Time, error) {
 	// prepare user switcher invocation
 	var fsu string
 	if p, ok := internal.Path(internal.Fsu); !ok {
@@ -72,22 +67,22 @@ func (s *Shim) Start() (*time.Time, error) {
 		s.encoder = e
 		s.cmd.Env = []string{
 			Env + "=" + strconv.Itoa(fd),
-			"FORTIFY_APP_ID=" + s.aid,
+			"FORTIFY_APP_ID=" + aid,
 		}
 	}
 
 	// format fsu supplementary groups
-	if len(s.supp) > 0 {
+	if len(supp) > 0 {
-		fmsg.VPrintf("attaching supplementary group ids %s", s.supp)
+		fmsg.VPrintf("attaching supplementary group ids %s", supp)
-		s.cmd.Env = append(s.cmd.Env, "FORTIFY_GROUPS="+strings.Join(s.supp, " "))
+		s.cmd.Env = append(s.cmd.Env, "FORTIFY_GROUPS="+strings.Join(supp, " "))
 	}
 	s.cmd.Stdin, s.cmd.Stdout, s.cmd.Stderr = os.Stdin, os.Stdout, os.Stderr
 	s.cmd.Dir = "/"
 
 	// pass sync fd if set
-	if s.payload.Bwrap.Sync() != nil {
+	if payload.Bwrap.Sync() != nil {
-		fd := proc.ExtraFile(s.cmd, s.payload.Bwrap.Sync())
+		fd := proc.ExtraFile(s.cmd, payload.Bwrap.Sync())
-		s.payload.Sync = &fd
+		payload.Sync = &fd
 	}
 
 	fmsg.VPrintln("starting shim via fsu:", s.cmd)
@@ -101,7 +96,7 @@ func (s *Shim) Start() (*time.Time, error) {
 	return &startTime, nil
 }
 
-func (s *Shim) Serve(ctx context.Context) error {
+func (s *Shim) Serve(ctx context.Context, payload *Payload) error {
 	// kill shim if something goes wrong and an error is returned
 	s.killFallback = make(chan error, 1)
 	killShim := func() {
@@ -112,7 +107,7 @@ func (s *Shim) Serve(ctx context.Context) error {
 	defer func() { killShim() }()
 
 	encodeErr := make(chan error)
-	go func() { encodeErr <- s.encoder.Encode(s.payload) }()
+	go func() { encodeErr <- s.encoder.Encode(payload) }()
 
 	select {
 	// encode return indicates setup completion