fortify

Author	SHA1	Message	Date
Ophestra	2a4e2724a3	release: 0.3.1 All checks were successful Release / Create release (push) Successful in 35s Details Test / Create distribution (push) Successful in 19s Details Test / Fpkg (push) Successful in 33s Details Test / Fortify (push) Successful in 39s Details Test / Data race detector (push) Successful in 39s Details Test / Flake checks (push) Successful in 55s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 07:48:50 +09:00
Ophestra	d613257841	sandbox/init: clear inheritable set All checks were successful Test / Create distribution (push) Successful in 28s Details Test / Fpkg (push) Successful in 3m52s Details Test / Data race detector (push) Successful in 4m47s Details Test / Fortify (push) Successful in 2m4s Details Test / Flake checks (push) Successful in 57s Details Inheritable should not be able to affect anything regardless of its value, due to no_new_privs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 07:46:13 +09:00
Ophestra	18644d90be	sandbox: wrap capset syscall All checks were successful Test / Create distribution (push) Successful in 21s Details Test / Fortify (push) Successful in 2m25s Details Test / Data race detector (push) Successful in 3m10s Details Test / Fpkg (push) Successful in 2m59s Details Test / Flake checks (push) Successful in 1m4s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 07:44:07 +09:00
Ophestra	52fcc48ac1	sandbox/init: drop capabilities All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m39s Details Test / Fpkg (push) Successful in 3m31s Details Test / Data race detector (push) Successful in 4m32s Details Test / Flake checks (push) Successful in 58s Details During development the syscall filter caused me to make an incorrect assumption about SysProcAttr. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 06:32:08 +09:00
Ophestra	8b69bcd215	sandbox: cache kernel.cap_last_cap value All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m37s Details Test / Fpkg (push) Successful in 3m33s Details Test / Data race detector (push) Successful in 4m27s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 06:19:19 +09:00
Ophestra	2dd49c437c	app: create XDG_RUNTIME_DIR with perm 0700 All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m41s Details Test / Fpkg (push) Successful in 3m31s Details Test / Data race detector (push) Successful in 4m30s Details Test / Flake checks (push) Successful in 59s Details Many programs complain about this. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 02:49:37 +09:00
Ophestra	92852d8235	release: 0.3.0 All checks were successful Test / Create distribution (push) Successful in 20s Details Release / Create release (push) Successful in 35s Details Test / Fortify (push) Successful in 2m45s Details Test / Fpkg (push) Successful in 3m27s Details Test / Data race detector (push) Successful in 4m20s Details Test / Flake checks (push) Successful in 1m1s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 02:18:59 +09:00
Ophestra	371dd5b938	nix: create current-system symlink All checks were successful Test / Create distribution (push) Successful in 20s Details Release / Create release (push) Successful in 27s Details Test / Fpkg (push) Successful in 35s Details Test / Fortify (push) Successful in 40s Details Test / Data race detector (push) Successful in 40s Details Test / Flake checks (push) Successful in 58s Details This is copied at runtime because it appears to be impossible to obtain this path in nix. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 02:06:11 +09:00
Ophestra	4836d570ae	test: raise long timeout to 15 seconds All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fpkg (push) Successful in 34s Details Test / Fortify (push) Successful in 2m20s Details Test / Data race detector (push) Successful in 3m4s Details Test / Flake checks (push) Successful in 57s Details The race detector really slows down container tooling. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 01:59:05 +09:00
Ophestra	985f9442e6	sandbox: copy symlink with magic prefix All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m39s Details Test / Fpkg (push) Successful in 3m31s Details Test / Data race detector (push) Successful in 2m40s Details Test / Flake checks (push) Successful in 59s Details This does not dereference the symlink, but only reads one level of it. This is useful for symlink targets that are not yet known at the time the configuration is emitted. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-26 01:42:39 +09:00
Ophestra	67eb28466d	nix: create opengl-driver symlink All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 33s Details Test / Fortify (push) Successful in 2m18s Details Test / Data race detector (push) Successful in 3m3s Details Test / Flake checks (push) Successful in 53s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 20:52:20 +09:00
Ophestra	c326c3f97d	fst/sandbox: do not create /etc in advance All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m43s Details Test / Fpkg (push) Successful in 3m36s Details Test / Data race detector (push) Successful in 4m31s Details Test / Flake checks (push) Successful in 56s Details This is now handled by the setup op. This also gets rid of the hardcoded /etc path. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 20:00:34 +09:00
Ophestra	971c79bb80	sandbox: remove hardcoded parent perm All checks were successful Test / Create distribution (push) Successful in 27s Details Test / Fortify (push) Successful in 2m43s Details Test / Fpkg (push) Successful in 3m41s Details Test / Data race detector (push) Successful in 4m32s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 19:49:51 +09:00
Ophestra	f86d868274	sandbox: wrap error with its own text message All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m40s Details Test / Fpkg (push) Successful in 3m33s Details Test / Data race detector (push) Successful in 4m24s Details Test / Flake checks (push) Successful in 57s Details PathError has a pretty good text message, many of them are wrapped with its own text message. This change adds a function to do just that to improve readability. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 19:42:20 +09:00
Ophestra	33940265a6	sandbox: do not ensure symlink target All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m40s Details Test / Fpkg (push) Successful in 3m29s Details Test / Data race detector (push) Successful in 4m31s Details Test / Flake checks (push) Successful in 1m4s Details This masks EEXIST on target and might clobber filesystems and lead to other confusing behaviour. Create its parent instead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 19:30:53 +09:00
Ophestra	b39f3aeb59	helper: remove bubblewrap wrapper All checks were successful Test / Create distribution (push) Successful in 19s Details Test / Fortify (push) Successful in 2m12s Details Test / Fpkg (push) Successful in 3m34s Details Test / Data race detector (push) Successful in 4m19s Details Test / Flake checks (push) Successful in 57s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 05:35:02 +09:00
Ophestra	61dbfeffe7	sandbox/wl: move into sandbox All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m49s Details Test / Fpkg (push) Successful in 3m54s Details Test / Data race detector (push) Successful in 4m36s Details Test / Flake checks (push) Successful in 58s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 05:26:37 +09:00
Ophestra	532feb4bfa	app: merge shim into app package All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m48s Details Test / Fpkg (push) Successful in 3m39s Details Test / Data race detector (push) Successful in 4m35s Details Test / Flake checks (push) Successful in 56s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 05:21:47 +09:00
Ophestra	ec5e91b8c9	system: optimise string formatting All checks were successful Test / Create distribution (push) Successful in 20s Details Test / Fpkg (push) Successful in 36s Details Test / Fortify (push) Successful in 42s Details Test / Data race detector (push) Successful in 43s Details Test / Flake checks (push) Successful in 1m10s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 04:42:30 +09:00
Ophestra	ee51320abf	test: check revert type selection All checks were successful Test / Create distribution (push) Successful in 20s Details Test / Fortify (push) Successful in 2m18s Details Test / Fpkg (push) Successful in 3m1s Details Test / Data race detector (push) Successful in 4m32s Details Test / Flake checks (push) Successful in 1m4s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 04:37:58 +09:00
Ophestra	5c4058d5ac	app: run in native sandbox All checks were successful Test / Create distribution (push) Successful in 20s Details Test / Fortify (push) Successful in 2m5s Details Test / Fpkg (push) Successful in 3m0s Details Test / Data race detector (push) Successful in 4m12s Details Test / Flake checks (push) Successful in 1m4s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 01:52:49 +09:00
Ophestra	e732dca762	wl: fix sync pipe keepalive All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 3m36s Details Test / Data race detector (push) Successful in 4m14s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 01:33:37 +09:00
Ophestra	a9adcd914b	fortify/parse: omit try fd fallthrough message All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m33s Details Test / Fpkg (push) Successful in 3m28s Details Test / Data race detector (push) Successful in 4m12s Details Test / Flake checks (push) Successful in 57s Details This reduces noise in verbose output. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-25 01:21:11 +09:00
Ophestra	3dd4ff29c8	test/sandbox: check mount table length All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fpkg (push) Successful in 37s Details Test / Fortify (push) Successful in 2m20s Details Test / Data race detector (push) Successful in 2m51s Details Test / Flake checks (push) Successful in 1m0s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:36:53 +09:00
Ophestra	61d86c5e10	test/sandbox: fix stdout tty check All checks were successful Test / Create distribution (push) Successful in 27s Details Test / Fpkg (push) Successful in 37s Details Test / Fortify (push) Successful in 2m22s Details Test / Data race detector (push) Successful in 2m57s Details Test / Flake checks (push) Successful in 56s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:23:50 +09:00
Ophestra	d097eaa28f	test/sandbox: unquote fail messages All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m31s Details Test / Fpkg (push) Successful in 3m22s Details Test / Data race detector (push) Successful in 4m22s Details Test / Flake checks (push) Successful in 57s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:03:53 +09:00
Ophestra	ad3576c164	sandbox: resolve tty name All checks were successful Test / Create distribution (push) Successful in 19s Details Test / Fortify (push) Successful in 2m17s Details Test / Fpkg (push) Successful in 3m15s Details Test / Data race detector (push) Successful in 4m10s Details Test / Flake checks (push) Successful in 56s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 16:03:07 +09:00
Ophestra	b989a4601a	test/sandbox: fail on mismatched mount entry All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fpkg (push) Successful in 34s Details Test / Fortify (push) Successful in 2m26s Details Test / Data race detector (push) Successful in 2m47s Details Test / Flake checks (push) Successful in 57s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 13:43:32 +09:00
Ophestra	a11237b158	sandbox/vfs: add doc comments All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m42s Details Test / Fpkg (push) Successful in 3m40s Details Test / Data race detector (push) Successful in 4m15s Details Test / Flake checks (push) Successful in 55s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 13:21:55 +09:00
Ophestra	40f00d570e	sandbox: set mkdir perm All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m34s Details Test / Fpkg (push) Successful in 3m26s Details Test / Data race detector (push) Successful in 4m7s Details Test / Flake checks (push) Successful in 57s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 12:51:39 +09:00
Ophestra	0eb1bc6301	test/sandbox: verify outcome via mountinfo All checks were successful Test / Fpkg (push) Successful in 36s Details Test / Create distribution (push) Successful in 4m56s Details Test / Fortify (push) Successful in 6m33s Details Test / Data race detector (push) Successful in 7m3s Details Test / Flake checks (push) Successful in 54s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-24 01:42:38 +09:00
Ophestra	1eb837eab8	test/sandbox: warn about misuse in doc comment All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fpkg (push) Successful in 34s Details Test / Fortify (push) Successful in 2m16s Details Test / Data race detector (push) Successful in 2m45s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 23:28:28 +09:00
Ophestra	0a4e633db2	nix: filter test from source All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m42s Details Test / Fpkg (push) Successful in 3m52s Details Test / Data race detector (push) Successful in 4m19s Details Test / Flake checks (push) Successful in 54s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 22:20:19 +09:00
Ophestra	e8809125d4	sandbox: verify outcome via mountinfo All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m39s Details Test / Fpkg (push) Successful in 3m29s Details Test / Data race detector (push) Successful in 4m17s Details Test / Flake checks (push) Successful in 1m6s Details This contains much more information than /proc/mounts and allows for more fields to be checked. This also removes the dependency on the test package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 22:17:36 +09:00
Ophestra	806ce18c0a	test/sandbox: check mapuid outcome All checks were successful Test / Create distribution (push) Successful in 27s Details Test / Fpkg (push) Successful in 37s Details Test / Fortify (push) Successful in 2m23s Details Test / Data race detector (push) Successful in 2m50s Details Test / Flake checks (push) Successful in 55s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:56:07 +09:00
Ophestra	b71d2bf534	test/sandbox: check tty outcome All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 34s Details Test / Fortify (push) Successful in 2m21s Details Test / Data race detector (push) Successful in 2m48s Details Test / Flake checks (push) Successful in 54s Details This makes no difference currently but has different behaviour in the native sandbox. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:28:57 +09:00
Ophestra	46059b1840	test/sandbox: print mismatching file content All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 34s Details Test / Fortify (push) Successful in 2m3s Details Test / Data race detector (push) Successful in 2m32s Details Test / Flake checks (push) Successful in 51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:24:52 +09:00
Ophestra	d2c329bcea	test: format path aid offsets All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fpkg (push) Successful in 36s Details Test / Fortify (push) Successful in 2m12s Details Test / Data race detector (push) Successful in 2m41s Details Test / Flake checks (push) Successful in 51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 17:21:14 +09:00
Ophestra	2d379b5a38	test/sandbox: pass want file as argument All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 33s Details Test / Fortify (push) Successful in 2m7s Details Test / Data race detector (push) Successful in 2m36s Details Test / Flake checks (push) Successful in 49s Details This avoids building the check program multiple times. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 15:00:59 +09:00
Ophestra	75e0c5d406	test/sandbox: parse full test case All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m37s Details Test / Fpkg (push) Successful in 3m52s Details Test / Data race detector (push) Successful in 4m12s Details Test / Flake checks (push) Successful in 50s Details This makes declaring multiple tests much cleaner. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 14:53:50 +09:00
Ophestra	770b37ae16	sandbox/vfs: match MS_NOSYMFOLLOW flag All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m27s Details Test / Fpkg (push) Successful in 3m33s Details Test / Data race detector (push) Successful in 4m10s Details Test / Flake checks (push) Successful in 52s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 13:57:30 +09:00
Ophestra	c638193268	sandbox: apply vfs options to bind mounts All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m41s Details Test / Fpkg (push) Successful in 3m45s Details Test / Data race detector (push) Successful in 4m11s Details Test / Flake checks (push) Successful in 56s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 05:27:57 +09:00
Ophestra	8c3a817881	sandbox/vfs: unfold mount hierarchy All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m33s Details Test / Fpkg (push) Successful in 3m31s Details Test / Data race detector (push) Successful in 4m11s Details Test / Flake checks (push) Successful in 53s Details This presents all visible mount points under path. This is useful for applying extra vfs options to bind mounts. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 05:23:31 +09:00
Ophestra	e2fce321c1	sandbox/vfs: expose mountinfo line scanning All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m38s Details Test / Fpkg (push) Successful in 3m30s Details Test / Data race detector (push) Successful in 4m9s Details Test / Flake checks (push) Successful in 51s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-23 02:46:58 +09:00
Ophestra	241702ae3a	go: 1.23 All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m48s Details Test / Data race detector (push) Successful in 4m22s Details Test / Fpkg (push) Successful in 1h28m30s Details Test / Flake checks (push) Successful in 49s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-22 18:20:06 +09:00
Ophestra	d21d9c5b1d	sandbox/vfs: parse vfs options All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m36s Details Test / Fpkg (push) Successful in 3m20s Details Test / Data race detector (push) Successful in 4m4s Details Test / Flake checks (push) Successful in 50s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 17:12:10 +09:00
Ophestra	a70daf2250	sandbox: resolve inverted flags in op All checks were successful Test / Create distribution (push) Successful in 26s Details Test / Fortify (push) Successful in 2m5s Details Test / Data race detector (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 2m48s Details Test / Flake checks (push) Successful in 48s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:58:38 +09:00
Ophestra	632b18addd	test/sandbox: rename misleading bind destination All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fpkg (push) Successful in 34s Details Test / Fortify (push) Successful in 2m15s Details Test / Data race detector (push) Successful in 2m49s Details Test / Flake checks (push) Successful in 59s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:56:11 +09:00
Ophestra	a57a7a6a16	test/sandbox: check type handling host_passthrough All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m30s Details Test / Fpkg (push) Successful in 3m30s Details Test / Data race detector (push) Successful in 4m20s Details Test / Flake checks (push) Successful in 52s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:21:08 +09:00
Ophestra	5098b12e4a	sandbox/vfs: count mountinfo entries All checks were successful Test / Create distribution (push) Successful in 25s Details Test / Fortify (push) Successful in 2m39s Details Test / Fpkg (push) Successful in 3m37s Details Test / Data race detector (push) Successful in 4m10s Details Test / Flake checks (push) Successful in 52s Details Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-03-21 12:14:33 +09:00

1 2 3 4 5 ...

684 Commits