cmd/fpkg/test/configuration.nix

@@ -55,8 +55,6 @@
     stateDir = "/var/lib/fortify";
     users.alice = 0;
 
-    extraHomeConfig = {
+    home-manager = _: _: { home.stateVersion = "23.05"; };
-      home.stateVersion = "23.05";
-    };
   };
 }

comp/_fortify

@@ -7,24 +7,24 @@ _fortify_app() {
 
 _fortify_run() {
   _arguments \
-    '--id[Reverse-DNS style Application identifier, leave empty to inherit instance identifier]:id' \
+    '--id[App ID, leave empty to disable security context app_id]:id' \
-    '-a[Application identity]: :_numbers' \
+    '-a[Fortify application ID]: :_numbers' \
-    '-g[Groups inherited by all container processes]: :_groups' \
+    '-g[Groups inherited by the app process]: :_groups' \
-    '-d[Container home directory]: :_files -/' \
+    '-d[Application home directory]: :_files -/' \
-    '-u[Passwd user name within sandbox]: :_users' \
+    '-u[Passwd name within sandbox]: :_users' \
-    '--wayland[Enable connection to Wayland via security-context-v1]' \
+    '--wayland[Share Wayland socket]' \
-    '-X[Enable direct connection to X11]' \
+    '-X[Share X11 socket and allow connection]' \
-    '--dbus[Enable proxied connection to D-Bus]' \
+    '--dbus[Proxy D-Bus connection]' \
-    '--pulse[Enable direct connection to PulseAudio]' \
+    '--pulse[Share PulseAudio socket and cookie]' \
-    '--dbus-config[Path to session bus proxy config file]: :_files -g "*.json"' \
+    '--dbus-config[Path to D-Bus proxy config file]: :_files -g "*.json"' \
-    '--dbus-system[Path to system bus proxy config file]: :_files -g "*.json"' \
+    '--dbus-system[Path to system D-Bus proxy config file]: :_files -g "*.json"' \
     '--mpris[Allow owning MPRIS D-Bus path]' \
-    '--dbus-log[Force buffered logging in the D-Bus proxy]'
+    '--dbus-log[Force logging in the D-Bus proxy]'
 }
 
 _fortify_ps() {
   _arguments \
-    '--short[List instances only]'
+    '--short[Print instance id]'
 }
 
 _fortify_show() {
@@ -78,5 +78,5 @@ __fortify_instances() {
 
 _arguments -C \
   '-v[Verbose output]' \
-  '--json[Serialise output in JSON when applicable]' \
+  '--json[Format output in JSON when applicable]' \
   '*::fortify command:_fortify_commands'

dbus/config.go

@@ -7,9 +7,6 @@ import (
 	"os"
 )
 
-// ProxyPair is an upstream dbus address and a downstream socket path.
-type ProxyPair [2]string
-
 type Config struct {
 	// See set 'see' policy for NAME (--see=NAME)
 	See []string `json:"see"`
@@ -27,7 +24,7 @@ type Config struct {
 	Filter bool `json:"filter"`
 }
 
-func (c *Config) Args(bus ProxyPair) (args []string) {
+func (c *Config) Args(bus [2]string) (args []string) {
 	argc := 2 + len(c.See) + len(c.Talk) + len(c.Own) + len(c.Call) + len(c.Broadcast)
 	if c.Log {
 		argc++

dbus/dbus_test.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"os"
 	"os/exec"
 	"strings"
@@ -20,21 +19,64 @@ import (
 	"git.gensokyo.uk/security/fortify/sandbox"
 )
 
-func TestFinalise(t *testing.T) {
+func TestNew(t *testing.T) {
-	if _, err := dbus.Finalise(dbus.ProxyPair{}, dbus.ProxyPair{}, nil, nil); !errors.Is(err, syscall.EBADE) {
+	for _, tc := range [][2][2]string{
-		t.Errorf("Finalise: error = %v, want %v",
+		{
-			err, syscall.EBADE)
+			{"unix:path=/run/user/1971/bus", "/tmp/fortify.1971/1ca5d183ef4c99e74c3e544715f32702/bus"},
+			{"unix:path=/run/dbus/system_bus_socket", "/tmp/fortify.1971/1ca5d183ef4c99e74c3e544715f32702/system_bus_socket"},
+		},
+		{
+			{"unix:path=/run/user/1971/bus", "/tmp/fortify.1971/881ac3796ff3f3bf0a773824383187a0/bus"},
+			{"unix:path=/run/dbus/system_bus_socket", "/tmp/fortify.1971/881ac3796ff3f3bf0a773824383187a0/system_bus_socket"},
+		},
+		{
+			{"unix:path=/run/user/1971/bus", "/tmp/fortify.1971/3d1a5084520ef79c0c6a49a675bac701/bus"},
+			{"unix:path=/run/dbus/system_bus_socket", "/tmp/fortify.1971/3d1a5084520ef79c0c6a49a675bac701/system_bus_socket"},
+		},
+		{
+			{"unix:path=/run/user/1971/bus", "/tmp/fortify.1971/2a1639bab712799788ea0ff7aa280c35/bus"},
+			{"unix:path=/run/dbus/system_bus_socket", "/tmp/fortify.1971/2a1639bab712799788ea0ff7aa280c35/system_bus_socket"},
+		},
+	} {
+		t.Run("create instance for "+tc[0][0]+" and "+tc[1][0], func(t *testing.T) {
+			if got := dbus.New(tc[0], tc[1]); !got.CompareTestNew(tc[0], tc[1]) {
+				t.Errorf("New(%q, %q) = %v",
+					tc[0], tc[1],
+					got)
+			}
+		})
+	}
+}
+
+func TestProxy_Seal(t *testing.T) {
+	t.Run("double seal panic", func(t *testing.T) {
+		defer func() {
+			want := "dbus proxy sealed twice"
+			if r := recover(); r != want {
+				t.Errorf("Seal: panic = %q, want %q",
+					r, want)
+			}
+		}()
+
+		p := dbus.New([2]string{}, [2]string{})
+		_ = p.Seal(dbus.NewConfig("", true, false), nil)
+		_ = p.Seal(dbus.NewConfig("", true, false), nil)
+	})
+
+	ep := dbus.New([2]string{}, [2]string{})
+	if err := ep.Seal(nil, nil); !errors.Is(err, dbus.ErrConfig) {
+		t.Errorf("Seal(nil, nil) error = %v, want %v",
+			err, dbus.ErrConfig)
 	}
 
 	for id, tc := range testCasePairs() {
-		t.Run("create final for "+id, func(t *testing.T) {
+		t.Run("create seal for "+id, func(t *testing.T) {
-			var wt io.WriterTo
+			p := dbus.New(tc[0].bus, tc[1].bus)
-			if v, err := dbus.Finalise(tc[0].bus, tc[1].bus, tc[0].c, tc[1].c); (errors.Is(err, syscall.EINVAL)) != tc[0].wantErr {
+			if err := p.Seal(tc[0].c, tc[1].c); (errors.Is(err, syscall.EINVAL)) != tc[0].wantErr {
-				t.Errorf("Finalise: error = %v, wantErr %v",
+				t.Errorf("Seal(%p, %p) error = %v, wantErr %v",
+					tc[0].c, tc[1].c,
 					err, tc[0].wantErr)
 				return
-			} else {
-				wt = v
 			}
 
 			// rest of the tests happen for sealed instances
@@ -47,23 +89,25 @@ func TestFinalise(t *testing.T) {
 			args := append(tc[0].want, tc[1].want...)
 			for _, arg := range args {
 				want.WriteString(arg)
-				want.WriteByte(0)
+				want.WriteByte('\x00')
 			}
 
+			wt := p.AccessTestProxySeal()
 			got := new(strings.Builder)
 			if _, err := wt.WriteTo(got); err != nil {
-				t.Errorf("WriteTo: error = %v", err)
+				t.Errorf("p.seal.WriteTo(): %v", err)
 			}
 
 			if want.String() != got.String() {
-				t.Errorf("Seal: %q, want %q",
+				t.Errorf("Seal(%p, %p) seal = %v, want %v",
+					tc[0].c, tc[1].c,
 					got.String(), want.String())
 			}
 		})
 	}
 }
 
-func TestProxyStartWaitCloseString(t *testing.T) {
+func TestProxy_Start_Wait_Close_String(t *testing.T) {
 	oldWaitDelay := helper.WaitDelay
 	helper.WaitDelay = 16 * time.Second
 	t.Cleanup(func() { helper.WaitDelay = oldWaitDelay })
@@ -72,62 +116,29 @@ func TestProxyStartWaitCloseString(t *testing.T) {
 		proxyName := dbus.ProxyName
 		dbus.ProxyName = os.Args[0]
 		t.Cleanup(func() { dbus.ProxyName = proxyName })
-		testProxyFinaliseStartWaitCloseString(t, true)
+		testProxyStartWaitCloseString(t, true)
 	})
-	t.Run("direct", func(t *testing.T) { testProxyFinaliseStartWaitCloseString(t, false) })
+	t.Run("direct", func(t *testing.T) { testProxyStartWaitCloseString(t, false) })
 }
 
-func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) {
+func testProxyStartWaitCloseString(t *testing.T, useSandbox bool) {
-	var p *dbus.Proxy
-
-	t.Run("string for nil proxy", func(t *testing.T) {
-		want := "(invalid dbus proxy)"
-		if got := p.String(); got != want {
-			t.Errorf("String: %q, want %q",
-				got, want)
-		}
-	})
-
-	t.Run("invalid start", func(t *testing.T) {
-		if !useSandbox {
-			p = dbus.NewDirect(context.TODO(), nil, nil)
-		} else {
-			p = dbus.New(context.TODO(), nil, nil)
-		}
-
-		if err := p.Start(); !errors.Is(err, syscall.ENOTRECOVERABLE) {
-			t.Errorf("Start: error = %q, wantErr %q",
-				err, syscall.ENOTRECOVERABLE)
-			return
-		}
-	})
-
 	for id, tc := range testCasePairs() {
 		// this test does not test errors
 		if tc[0].wantErr {
 			continue
 		}
 
-		t.Run("proxy for "+id, func(t *testing.T) {
+		t.Run("string for nil proxy", func(t *testing.T) {
-			var final *dbus.Final
+			var p *dbus.Proxy
-			t.Run("finalise", func(t *testing.T) {
+			want := "(invalid dbus proxy)"
-				if v, err := dbus.Finalise(tc[0].bus, tc[1].bus, tc[0].c, tc[1].c); err != nil {
+			if got := p.String(); got != want {
-					t.Errorf("Finalise: error = %v, wantErr %v",
+				t.Errorf("String() = %v, want %v",
-						err, tc[0].wantErr)
+					got, want)
-					return
-				} else {
-					final = v
-				}
-			})
-
-			ctx, cancel := context.WithTimeout(context.TODO(), 5*time.Second)
-			defer cancel()
-			if !useSandbox {
-				p = dbus.NewDirect(ctx, final, nil)
-			} else {
-				p = dbus.New(ctx, final, nil)
 			}
+		})
 
+		t.Run("proxy for "+id, func(t *testing.T) {
+			p := dbus.New(tc[0].bus, tc[1].bus)
 			p.CommandContext = func(ctx context.Context) (cmd *exec.Cmd) {
 				return exec.CommandContext(ctx, os.Args[0], "-test.v",
 					"-test.run=TestHelperInit", "--", "init")
@@ -152,52 +163,79 @@ func testProxyFinaliseStartWaitCloseString(t *testing.T, useSandbox bool) {
 			p.FilterF = func(v []byte) []byte { return bytes.SplitN(v, []byte("TestHelperInit\n"), 2)[1] }
 			output := new(strings.Builder)
 
-			t.Run("invalid wait", func(t *testing.T) {
+			t.Run("unsealed", func(t *testing.T) {
-				wantErr := "dbus: not started"
-				if err := p.Wait(); err == nil || err.Error() != wantErr {
-					t.Errorf("Wait: error = %v, wantErr %v",
-						err, wantErr)
-				}
-			})
-
-			t.Run("string", func(t *testing.T) {
-				want := "(unused dbus proxy)"
-				if got := p.String(); got != want {
-					t.Errorf("String: %q, want %q",
-						got, want)
-					return
-				}
-			})
-
-			t.Run("start", func(t *testing.T) {
-				if err := p.Start(); err != nil {
-					t.Fatalf("Start: error = %v",
-						err)
-				}
-
 				t.Run("string", func(t *testing.T) {
-					wantSubstr := fmt.Sprintf("%s -test.run=TestHelperStub -- --args=3 --fd=4", os.Args[0])
+					want := "(unsealed dbus proxy)"
-					if useSandbox {
+					if got := p.String(); got != want {
-						wantSubstr = fmt.Sprintf(`argv: ["%s" "-test.run=TestHelperStub" "--" "--args=3" "--fd=4"], flags: 0x0, seccomp: 0x3e`, os.Args[0])
+						t.Errorf("String() = %v, want %v",
+							got, want)
+						return
 					}
-					if got := p.String(); !strings.Contains(got, wantSubstr) {
+				})
-						t.Errorf("String: %q, want %q",
+
-							got, wantSubstr)
+				t.Run("start", func(t *testing.T) {
+					want := "proxy not sealed"
+					if err := p.Start(context.Background(), nil, useSandbox); err == nil || err.Error() != want {
+						t.Errorf("Start() error = %v, wantErr %q",
+							err, errors.New(want))
 						return
 					}
 				})
 
 				t.Run("wait", func(t *testing.T) {
-					done := make(chan struct{})
+					wantErr := "dbus: not started"
-					go func() {
+					if err := p.Wait(); err == nil || err.Error() != wantErr {
+						t.Errorf("Wait() error = %v, wantErr %v",
+							err, wantErr)
+					}
+				})
+			})
+
+			t.Run("seal with "+id, func(t *testing.T) {
+				if err := p.Seal(tc[0].c, tc[1].c); err != nil {
+					t.Errorf("Seal(%p, %p) error = %v, wantErr %v",
+						tc[0].c, tc[1].c,
+						err, tc[0].wantErr)
+					return
+				}
+			})
+
+			t.Run("sealed", func(t *testing.T) {
+				want := strings.Join(append(tc[0].want, tc[1].want...), " ")
+				if got := p.String(); got != want {
+					t.Errorf("String() = %v, want %v",
+						got, want)
+					return
+				}
+
+				t.Run("start", func(t *testing.T) {
+					ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+					defer cancel()
+
+					if err := p.Start(ctx, output, useSandbox); err != nil {
+						t.Fatalf("Start(nil, nil) error = %v",
+							err)
+					}
+
+					t.Run("string", func(t *testing.T) {
+						wantSubstr := fmt.Sprintf("%s -test.run=TestHelperStub -- --args=3 --fd=4", os.Args[0])
+						if useSandbox {
+							wantSubstr = fmt.Sprintf(`argv: ["%s" "-test.run=TestHelperStub" "--" "--args=3" "--fd=4"], flags: 0x0, seccomp: 0x3e`, os.Args[0])
+						}
+						if got := p.String(); !strings.Contains(got, wantSubstr) {
+							t.Errorf("String() = %v, want %v",
+								p.String(), wantSubstr)
+							return
+						}
+					})
+
+					t.Run("wait", func(t *testing.T) {
+						p.Close()
 						if err := p.Wait(); err != nil {
-							t.Errorf("Wait: error = %v\noutput: %s",
+							t.Errorf("Wait() error = %v\noutput: %s",
 								err, output.String())
 						}
-						close(done)
+					})
-					}()
-					p.Close()
-					<-done
 				})
 			})
 		})

dbus/export_test.go

@@ -1,13 +1,13 @@
 package dbus
 
-import (
+import "io"
-	"context"
-	"io"
-)
 
-// NewDirect returns a new instance of [Proxy] with its sandbox disabled.
+// CompareTestNew provides TestNew with comparison access to unexported Proxy fields.
-func NewDirect(ctx context.Context, final *Final, output io.Writer) *Proxy {
+func (p *Proxy) CompareTestNew(session, system [2]string) bool {
-	p := New(ctx, final, output)
+	return session == p.session && system == p.system
-	p.useSandbox = false
+}
-	return p
+
+// AccessTestProxySeal provides TestProxy_Seal with access to unexported Proxy seal field.
+func (p *Proxy) AccessTestProxySeal() io.WriterTo {
+	return p.seal
 }

dbus/proc.go

@@ -3,12 +3,14 @@ package dbus
 import (
 	"context"
 	"errors"
+	"io"
 	"os"
 	"os/exec"
 	"path"
 	"path/filepath"
 	"slices"
 	"strconv"
+	"strings"
 	"syscall"
 
 	"git.gensokyo.uk/security/fortify/helper"
@@ -17,30 +19,25 @@ import (
 	"git.gensokyo.uk/security/fortify/sandbox/seccomp"
 )
 
-// Start starts and configures a D-Bus proxy process.
+// Start launches the D-Bus proxy.
-func (p *Proxy) Start() error {
+func (p *Proxy) Start(ctx context.Context, output io.Writer, useSandbox bool) error {
-	if p.final == nil || p.final.WriterTo == nil {
+	p.lock.Lock()
-		return syscall.ENOTRECOVERABLE
+	defer p.lock.Unlock()
+
+	if p.seal == nil {
+		return errors.New("proxy not sealed")
 	}
 
-	p.mu.Lock()
+	var h helper.Helper
-	defer p.mu.Unlock()
-	p.pmu.Lock()
-	defer p.pmu.Unlock()
 
-	if p.cancel != nil || p.cause != nil {
+	c, cancel := context.WithCancelCause(ctx)
-		return errors.New("dbus: already started")
+	if !useSandbox {
-	}
+		h = helper.NewDirect(c, p.name, p.seal, true, argF, func(cmd *exec.Cmd) {
-
-	ctx, cancel := context.WithCancelCause(p.ctx)
-
-	if !p.useSandbox {
-		p.helper = helper.NewDirect(ctx, p.name, p.final, true, argF, func(cmd *exec.Cmd) {
 			if p.CmdF != nil {
 				p.CmdF(cmd)
 			}
-			if p.output != nil {
+			if output != nil {
-				cmd.Stdout, cmd.Stderr = p.output, p.output
+				cmd.Stdout, cmd.Stderr = output, output
 			}
 			cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
 			cmd.Env = make([]string, 0)
@@ -62,15 +59,15 @@ func (p *Proxy) Start() error {
 			libPaths = ldd.Path(entries)
 		}
 
-		p.helper = helper.New(
+		h = helper.New(
-			ctx, toolPath,
+			c, toolPath,
-			p.final, true,
+			p.seal, true,
 			argF, func(container *sandbox.Container) {
 				container.Seccomp |= seccomp.FilterMultiarch
 				container.Hostname = "fortify-dbus"
 				container.CommandContext = p.CommandContext
-				if p.output != nil {
+				if output != nil {
-					container.Stdout, container.Stderr = p.output, p.output
+					container.Stdout, container.Stderr = output, output
 				}
 
 				if p.CmdF != nil {
@@ -84,17 +81,10 @@ func (p *Proxy) Start() error {
 
 				// upstream bus directories
 				upstreamPaths := make([]string, 0, 2)
-				for _, addr := range [][]AddrEntry{p.final.SessionUpstream, p.final.SystemUpstream} {
+				for _, as := range []string{p.session[0], p.system[0]} {
-					for _, ent := range addr {
+					if len(as) > 0 && strings.HasPrefix(as, "unix:path=/") {
-						if ent.Method != "unix" {
+						// leave / intact
-							continue
+						upstreamPaths = append(upstreamPaths, path.Dir(as[10:]))
-						}
-						for _, pair := range ent.Values {
-							if pair[0] != "path" || !path.IsAbs(pair[1]) {
-								continue
-							}
-							upstreamPaths = append(upstreamPaths, path.Dir(pair[1]))
-						}
 					}
 				}
 				slices.Sort(upstreamPaths)
@@ -105,10 +95,10 @@ func (p *Proxy) Start() error {
 
 				// parent directories of bind paths
 				sockDirPaths := make([]string, 0, 2)
-				if d := path.Dir(p.final.Session[1]); path.IsAbs(d) {
+				if d := path.Dir(p.session[1]); path.IsAbs(d) {
 					sockDirPaths = append(sockDirPaths, d)
 				}
-				if d := path.Dir(p.final.System[1]); path.IsAbs(d) {
+				if d := path.Dir(p.system[1]); path.IsAbs(d) {
 					sockDirPaths = append(sockDirPaths, d)
 				}
 				slices.Sort(sockDirPaths)
@@ -123,13 +113,14 @@ func (p *Proxy) Start() error {
 			}, nil)
 	}
 
-	if err := p.helper.Start(); err != nil {
+	if err := h.Start(); err != nil {
 		cancel(err)
-		p.helper = nil
 		return err
 	}
 
-	p.cancel, p.cause = cancel, func() error { return context.Cause(ctx) }
+	p.helper = h
+	p.ctx = c
+	p.cancel = cancel
 	return nil
 }
 
@@ -137,30 +128,28 @@ var proxyClosed = errors.New("proxy closed")
 
 // Wait blocks until xdg-dbus-proxy exits and releases resources.
 func (p *Proxy) Wait() error {
-	p.mu.RLock()
+	p.lock.RLock()
-	defer p.mu.RUnlock()
+	defer p.lock.RUnlock()
 
-	p.pmu.RLock()
+	if p.helper == nil {
-	if p.helper == nil || p.cancel == nil || p.cause == nil {
-		p.pmu.RUnlock()
 		return errors.New("dbus: not started")
 	}
 
 	errs := make([]error, 3)
 
 	errs[0] = p.helper.Wait()
-	if errors.Is(errs[0], context.Canceled) &&
+	if p.cancel == nil &&
-		errors.Is(p.cause(), proxyClosed) {
+		errors.Is(errs[0], context.Canceled) &&
+		errors.Is(context.Cause(p.ctx), proxyClosed) {
 		errs[0] = nil
 	}
-	p.pmu.RUnlock()
 
 	// ensure socket removal so ephemeral directory is empty at revert
-	if err := os.Remove(p.final.Session[1]); err != nil && !errors.Is(err, os.ErrNotExist) {
+	if err := os.Remove(p.session[1]); err != nil && !errors.Is(err, os.ErrNotExist) {
 		errs[1] = err
 	}
-	if p.final.System[1] != "" {
+	if p.sysP {
-		if err := os.Remove(p.final.System[1]); err != nil && !errors.Is(err, os.ErrNotExist) {
+		if err := os.Remove(p.system[1]); err != nil && !errors.Is(err, os.ErrNotExist) {
 			errs[2] = err
 		}
 	}
@@ -170,13 +159,14 @@ func (p *Proxy) Wait() error {
 
 // Close cancels the context passed to the helper instance attached to xdg-dbus-proxy.
 func (p *Proxy) Close() {
-	p.pmu.Lock()
+	p.lock.Lock()
-	defer p.pmu.Unlock()
+	defer p.lock.Unlock()
 
 	if p.cancel == nil {
 		panic("dbus: not started")
 	}
 	p.cancel(proxyClosed)
+	p.cancel = nil
 }
 
 func argF(argsFd, statFd int) []string {

dbus/proxy.go

@@ -2,10 +2,11 @@ package dbus
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"io"
 	"os/exec"
 	"sync"
-	"syscall"
 
 	"git.gensokyo.uk/security/fortify/helper"
 )
@@ -14,88 +15,84 @@ import (
 // Overriding ProxyName will only affect Proxy instance created after the change.
 var ProxyName = "xdg-dbus-proxy"
 
-// Proxy holds the state of a xdg-dbus-proxy process, and should never be copied.
+// Proxy holds references to a xdg-dbus-proxy process, and should never be copied.
+// Once sealed, configuration changes will no longer be possible and attempting to do so will result in a panic.
 type Proxy struct {
 	helper helper.Helper
 	ctx    context.Context
-
 	cancel context.CancelCauseFunc
-	cause  func() error
 
-	final      *Final
+	name    string
-	output     io.Writer
+	session [2]string
-	useSandbox bool
+	system  [2]string
-
+	CmdF    func(any)
-	name string
+	sysP    bool
-	CmdF func(any)
 
 	CommandContext func(ctx context.Context) (cmd *exec.Cmd)
 	FilterF        func([]byte) []byte
 
-	mu, pmu sync.RWMutex
+	seal io.WriterTo
+	lock sync.RWMutex
 }
 
+func (p *Proxy) Session() [2]string { return p.session }
+func (p *Proxy) System() [2]string  { return p.system }
+func (p *Proxy) Sealed() bool       { p.lock.RLock(); defer p.lock.RUnlock(); return p.seal != nil }
+
+var (
+	ErrConfig = errors.New("no configuration to seal")
+)
+
 func (p *Proxy) String() string {
 	if p == nil {
 		return "(invalid dbus proxy)"
 	}
 
-	p.mu.RLock()
+	p.lock.RLock()
-	defer p.mu.RUnlock()
+	defer p.lock.RUnlock()
 
 	if p.helper != nil {
 		return p.helper.String()
 	}
 
-	return "(unused dbus proxy)"
+	if p.seal != nil {
+		return p.seal.(fmt.Stringer).String()
+	}
+
+	return "(unsealed dbus proxy)"
 }
 
-// Final describes the outcome of a proxy configuration.
+// Seal seals the Proxy instance.
-type Final struct {
+func (p *Proxy) Seal(session, system *Config) error {
-	Session, System ProxyPair
+	p.lock.Lock()
-	// parsed upstream address
+	defer p.lock.Unlock()
-	SessionUpstream, SystemUpstream []AddrEntry
+
-	io.WriterTo
+	if p.seal != nil {
-}
+		panic("dbus proxy sealed twice")
+	}
 
-// Finalise creates a checked argument writer for [Proxy].
-func Finalise(sessionBus, systemBus ProxyPair, session, system *Config) (final *Final, err error) {
 	if session == nil && system == nil {
-		return nil, syscall.EBADE
+		return ErrConfig
 	}
 
 	var args []string
 	if session != nil {
-		args = append(args, session.Args(sessionBus)...)
+		args = append(args, session.Args(p.session)...)
 	}
 	if system != nil {
-		args = append(args, system.Args(systemBus)...)
+		args = append(args, system.Args(p.system)...)
+		p.sysP = true
+	}
+	if seal, err := helper.NewCheckedArgs(args); err != nil {
+		return err
+	} else {
+		p.seal = seal
 	}
 
-	final = &Final{Session: sessionBus, System: systemBus}
+	return nil
-
-	final.WriterTo, err = helper.NewCheckedArgs(args)
-	if err != nil {
-		return
-	}
-
-	if session != nil {
-		final.SessionUpstream, err = Parse([]byte(final.Session[0]))
-		if err != nil {
-			return
-		}
-	}
-	if system != nil {
-		final.SystemUpstream, err = Parse([]byte(final.System[0]))
-		if err != nil {
-			return
-		}
-	}
-
-	return
 }
 
-// New returns a new instance of [Proxy].
+// New returns a reference to a new unsealed Proxy.
-func New(ctx context.Context, final *Final, output io.Writer) *Proxy {
+func New(session, system [2]string) *Proxy {
-	return &Proxy{name: ProxyName, ctx: ctx, final: final, output: output, useSandbox: true}
+	return &Proxy{name: ProxyName, session: session, system: system}
 }

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746171682,
+        "lastModified": 1742655702,
-        "narHash": "sha256-EyXUNSa+H+YvGVuQJP1nZskXAowxKYp79RNUsNdQTj4=",
+        "narHash": "sha256-jbqlw4sPArFtNtA1s3kLg7/A4fzP4GLk9bGbtUJg0JQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "50eee705bbdbac942074a8c120e8194185633675",
+        "rev": "0948aeedc296f964140d9429223c7e4a0702a1ff",
         "type": "github"
       },
       "original": {
@@ -23,11 +23,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746557022,
+        "lastModified": 1743231893,
-        "narHash": "sha256-QkNoyEf6TbaTW5UZYX0OkwIJ/ZMeKSSoOMnSDPQuol0=",
+        "narHash": "sha256-tpJsHMUPEhEnzySoQxx7+kA+KUtgWqvlcUBqROYNNt0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1d3aeb5a193b9ff13f63f4d9cc169fb88129f860",
+        "rev": "c570c1f5304493cafe133b8d843c7c1c4a10d3a6",
         "type": "github"
       },
       "original": {

main.go

@@ -72,7 +72,7 @@ func buildCommand(out io.Writer) command.Command {
 		return nil
 	}).
 		Flag(&flagVerbose, "v", command.BoolFlag(false), "Print debug messages to the console").
-		Flag(&flagJSON, "json", command.BoolFlag(false), "Serialise output in JSON when applicable")
+		Flag(&flagJSON, "json", command.BoolFlag(false), "Serialise output as JSON when applicable")
 
 	c.Command("shim", command.UsageInternal, func([]string) error { instance.ShimMain(); return errSuccess })
 
@@ -205,31 +205,31 @@ func buildCommand(out io.Writer) command.Command {
 			panic("unreachable")
 		}).
 			Flag(&dbusConfigSession, "dbus-config", command.StringFlag("builtin"),
-				"Path to session bus proxy config file, or \"builtin\" for defaults").
+				"Path to D-Bus proxy config file, or \"builtin\" for defaults").
 			Flag(&dbusConfigSystem, "dbus-system", command.StringFlag("nil"),
-				"Path to system bus proxy config file, or \"nil\" to disable").
+				"Path to system D-Bus proxy config file, or \"nil\" to disable").
 			Flag(&mpris, "mpris", command.BoolFlag(false),
 				"Allow owning MPRIS D-Bus path, has no effect if custom config is available").
 			Flag(&dbusVerbose, "dbus-log", command.BoolFlag(false),
-				"Force buffered logging in the D-Bus proxy").
+				"Force logging in the D-Bus proxy").
 			Flag(&fid, "id", command.StringFlag(""),
-				"Reverse-DNS style Application identifier, leave empty to inherit instance identifier").
+				"App ID, leave empty to disable security context app_id").
 			Flag(&aid, "a", command.IntFlag(0),
-				"Application identity").
+				"Fortify application ID").
 			Flag(nil, "g", &groups,
-				"Groups inherited by all container processes").
+				"Groups inherited by the app process").
 			Flag(&homeDir, "d", command.StringFlag("os"),
-				"Container home directory").
+				"Application home directory").
 			Flag(&userName, "u", command.StringFlag("chronos"),
-				"Passwd user name within sandbox").
+				"Passwd name within sandbox").
 			Flag(&wayland, "wayland", command.BoolFlag(false),
-				"Enable connection to Wayland via security-context-v1").
+				"Allow Wayland connections").
 			Flag(&x11, "X", command.BoolFlag(false),
-				"Enable direct connection to X11").
+				"Share X11 socket and allow connection").
 			Flag(&dBus, "dbus", command.BoolFlag(false),
-				"Enable proxied connection to D-Bus").
+				"Proxy D-Bus connection").
 			Flag(&pulse, "pulse", command.BoolFlag(false),
-				"Enable direct connection to PulseAudio")
+				"Share PulseAudio socket and cookie")
 	}
 
 	var showFlagShort bool

main_test.go

@@ -36,31 +36,31 @@ Commands:
 Usage:	fortify run [-h | --help] [--dbus-config <value>] [--dbus-system <value>] [--mpris] [--dbus-log] [--id <value>] [-a <int>] [-g <value>] [-d <value>] [-u <value>] [--wayland] [-X] [--dbus] [--pulse] COMMAND [OPTIONS]
 
 Flags:
-  -X	Enable direct connection to X11
+  -X	Share X11 socket and allow connection
   -a int
-    	Application identity
+    	Fortify application ID
   -d string
-    	Container home directory (default "os")
+    	Application home directory (default "os")
   -dbus
-    	Enable proxied connection to D-Bus
+    	Proxy D-Bus connection
   -dbus-config string
-    	Path to session bus proxy config file, or "builtin" for defaults (default "builtin")
+    	Path to D-Bus proxy config file, or "builtin" for defaults (default "builtin")
   -dbus-log
-    	Force buffered logging in the D-Bus proxy
+    	Force logging in the D-Bus proxy
   -dbus-system string
-    	Path to system bus proxy config file, or "nil" to disable (default "nil")
+    	Path to system D-Bus proxy config file, or "nil" to disable (default "nil")
   -g value
-    	Groups inherited by all container processes
+    	Groups inherited by the app process
   -id string
-    	Reverse-DNS style Application identifier, leave empty to inherit instance identifier
+    	App ID, leave empty to disable security context app_id
   -mpris
     	Allow owning MPRIS D-Bus path, has no effect if custom config is available
   -pulse
-    	Enable direct connection to PulseAudio
+    	Share PulseAudio socket and cookie
   -u string
-    	Passwd user name within sandbox (default "chronos")
+    	Passwd name within sandbox (default "chronos")
   -wayland
-    	Enable connection to Wayland via security-context-v1
+    	Allow Wayland connections
 
 `,
 		},

nixos.nix

@@ -146,6 +146,7 @@ in
                         ]
                         ++ optionals app.nix [
                           (mustBind "/nix/var")
+                          (bind "/var/db/nix-channels")
                         ]
                         ++ optionals isGraphical [
                           (devBind "/dev/dri")
@@ -155,7 +156,6 @@ in
                           (devBind "/dev/nvidia-uvm-tools")
                           (devBind "/dev/nvidia0")
                         ]
-                        ++ optionals app.useCommonPaths cfg.commonPaths
                         ++ app.extraPaths;
                       auto_etc = true;
                       cover = [ "/var/run/nscd" ];
@@ -225,13 +225,13 @@ in
               # aid 0 is reserved
               imap1 (aid: app: {
                 ${getsubname fid aid} = mkMerge [
-                  cfg.extraHomeConfig
+                  (cfg.home-manager (getsubname fid aid) (getsubuid fid aid))
                   app.extraConfig
                   { home.packages = app.packages; }
                 ];
               }) cfg.apps
             ))
-            { ${getsubname fid 0} = cfg.extraHomeConfig; }
+            { ${getsubname fid 0} = cfg.home-manager (getsubname fid 0) (getsubuid fid 0); }
             acc
           ]
         ) privPackages cfg.users;

options.nix

@@ -3,38 +3,6 @@ packages:
 
 let
   inherit (lib) types mkOption mkEnableOption;
-
-  mountPoint =
-    let
-      inherit (types)
-        str
-        submodule
-        nullOr
-        listOf
-        ;
-    in
-    listOf (submodule {
-      options = {
-        dst = mkOption {
-          type = nullOr str;
-          default = null;
-          description = ''
-            Mount point in container, same as src if null.
-          '';
-        };
-
-        src = mkOption {
-          type = str;
-          description = ''
-            Host filesystem path to make available to the container.
-          '';
-        };
-
-        write = mkEnableOption "mounting path as writable";
-        dev = mkEnableOption "use of device files";
-        require = mkEnableOption "start failure if the bind mount cannot be established for any reason";
-      };
-    });
 in
 
 {
@@ -65,10 +33,14 @@ in
         '';
       };
 
-      extraHomeConfig = mkOption {
+      home-manager = mkOption {
-        type = types.anything;
+        type =
+          let
+            inherit (types) functionTo attrsOf anything;
+          in
+          functionTo (functionTo (attrsOf anything));
         description = ''
-          Extra home-manager configuration to merge with all target users.
+          Target user shared home-manager configuration.
         '';
       };
 
@@ -217,15 +189,11 @@ in
                 '';
               };
 
-              useCommonPaths = mkEnableOption "common extra paths" // {
-                default = true;
-              };
-
               extraPaths = mkOption {
-                type = mountPoint;
+                type = listOf anything;
                 default = [ ];
                 description = ''
-                  Extra paths to make available to the container.
+                  Extra paths to make available to the sandbox.
                 '';
               };
 
@@ -274,17 +242,7 @@ in
             };
           });
         default = [ ];
-        description = ''
+        description = "Declarative fortify apps.";
-          Declaratively configured fortify apps.
-        '';
-      };
-
-      commonPaths = mkOption {
-        type = mountPoint;
-        default = [ ];
-        description = ''
-          Common extra paths to make available to the container.
-        '';
       };
 
       stateDir = mkOption {

system/dbus.go

@@ -7,7 +7,6 @@ import (
 	"log"
 	"strings"
 	"sync"
-	"syscall"
 
 	"git.gensokyo.uk/security/fortify/dbus"
 )
@@ -27,62 +26,64 @@ func (sys *I) MustProxyDBus(sessionPath string, session *dbus.Config, systemPath
 func (sys *I) ProxyDBus(session, system *dbus.Config, sessionPath, systemPath string) (func(), error) {
 	d := new(DBus)
 
-	// session bus is required as otherwise this is effectively a very expensive noop
+	// session bus is mandatory
 	if session == nil {
 		return nil, msg.WrapErr(ErrDBusConfig,
-			"attempted to create message bus proxy args without session bus config")
+			"attempted to seal message bus proxy without session bus config")
 	}
 
 	// system bus is optional
 	d.system = system != nil
 
-	d.sessionBus[0], d.systemBus[0] = dbus.Address()
+	// upstream address, downstream socket path
-	d.sessionBus[1], d.systemBus[1] = sessionPath, systemPath
+	var sessionBus, systemBus [2]string
-	d.out = &scanToFmsg{msg: new(strings.Builder)}
+
-	if final, err := dbus.Finalise(d.sessionBus, d.systemBus, session, system); err != nil {
+	// resolve upstream bus addresses
-		if errors.Is(err, syscall.EINVAL) {
+	sessionBus[0], systemBus[0] = dbus.Address()
-			return nil, msg.WrapErr(err, "message bus proxy configuration contains NUL byte")
+
-		}
+	// set paths from caller
-		return nil, wrapErrSuffix(err, "cannot finalise message bus proxy:")
+	sessionBus[1], systemBus[1] = sessionPath, systemPath
-	} else {
+
-		if msg.IsVerbose() {
+	// create proxy instance
-			msg.Verbose("session bus proxy:", session.Args(d.sessionBus))
+	d.proxy = dbus.New(sessionBus, systemBus)
+
+	defer func() {
+		if msg.IsVerbose() && d.proxy.Sealed() {
+			msg.Verbose("sealed session proxy", session.Args(sessionBus))
 			if system != nil {
-				msg.Verbose("system bus proxy:", system.Args(d.systemBus))
+				msg.Verbose("sealed system proxy", system.Args(systemBus))
 			}
-
+			msg.Verbose("message bus proxy final args:", d.proxy)
-			// this calls the argsWt String method
-			msg.Verbose("message bus proxy final args:", final.WriterTo)
 		}
+	}()
 
-		d.final = final
+	// queue operation
-	}
-
 	sys.ops = append(sys.ops, d)
-	return d.out.Dump, nil
+
+	// seal dbus proxy
+	d.out = &scanToFmsg{msg: new(strings.Builder)}
+	return d.out.Dump, wrapErrSuffix(d.proxy.Seal(session, system),
+		"cannot seal message bus proxy:")
 }
 
 type DBus struct {
-	proxy *dbus.Proxy // populated during apply
+	proxy *dbus.Proxy
 
-	final *dbus.Final
+	out *scanToFmsg
-	out   *scanToFmsg
 	// whether system bus proxy is enabled
 	system bool
-
-	sessionBus, systemBus dbus.ProxyPair
 }
 
 func (d *DBus) Type() Enablement { return Process }
 
 func (d *DBus) apply(sys *I) error {
-	msg.Verbosef("session bus proxy on %q for upstream %q", d.sessionBus[1], d.sessionBus[0])
+	msg.Verbosef("session bus proxy on %q for upstream %q", d.proxy.Session()[1], d.proxy.Session()[0])
 	if d.system {
-		msg.Verbosef("system bus proxy on %q for upstream %q", d.systemBus[1], d.systemBus[0])
+		msg.Verbosef("system bus proxy on %q for upstream %q", d.proxy.System()[1], d.proxy.System()[0])
 	}
 
-	d.proxy = dbus.New(sys.ctx, d.final, d.out)
+	// this starts the process and blocks until ready
-	if err := d.proxy.Start(); err != nil {
+	if err := d.proxy.Start(sys.ctx, d.out, true); err != nil {
 		d.out.Dump()
 		return wrapErrSuffix(err,
 			"cannot start message bus proxy:")

test/configuration.nix

@@ -30,9 +30,13 @@
 
   environment = {
     systemPackages = with pkgs; [
+      # For glinfo and wayland-info:
+      mesa-demos
+      wayland-utils
+
       # For D-Bus tests:
-      mako
       libnotify
+      mako
     ];
 
     variables = {
@@ -95,21 +99,14 @@
     stateDir = "/var/lib/fortify";
     users.alice = 0;
 
-    extraHomeConfig = {
+    home-manager = _: _: { home.stateVersion = "23.05"; };
-      home.stateVersion = "23.05";
-    };
 
     apps = [
       {
         name = "ne-foot";
         verbose = true;
         share = pkgs.foot;
-        packages = with pkgs; [
+        packages = [ pkgs.foot ];
-          foot
-
-          # For wayland-info:
-          wayland-utils
-        ];
         command = "foot";
         capability = {
           dbus = false;
@@ -128,13 +125,7 @@
         name = "x11-alacritty";
         verbose = true;
         share = pkgs.alacritty;
-        packages = with pkgs; [
+        packages = [ pkgs.alacritty ];
-          # For X11 terminal emulator:
-          alacritty
-
-          # For glinfo:
-          mesa-demos
-        ];
         command = "alacritty";
         capability = {
           wayland = false;
@@ -148,12 +139,7 @@
         verbose = true;
         insecureWayland = true;
         share = pkgs.foot;
-        packages = with pkgs; [
+        packages = [ pkgs.foot ];
-          foot
-
-          # For wayland-info:
-          wayland-utils
-        ];
         command = "foot";
         capability = {
           dbus = false;

test/sandbox/case/default.nix

@@ -37,12 +37,7 @@ let
     {
       name = "check-sandbox-${tc.name}";
       verbose = true;
-      inherit (tc)
+      inherit (tc) tty device mapRealUid;
-        tty
-        device
-        mapRealUid
-        useCommonPaths
-        ;
       share = testProgram;
       packages = [ ];
       path = "${testProgram}/bin/fortify-test";

test/sandbox/case/device.nix

@@ -8,7 +8,6 @@
   tty = false;
   device = true;
   mapRealUid = false;
-  useCommonPaths = true;
 
   want = {
     env = [
@@ -141,12 +140,7 @@
             u0 = fs "800001c0" {
               a4 = fs "800001c0" {
                 ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
+                ".config" = fs "800001ed" { "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null; } null;
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
                 ".local" = fs "800001ed" {
                   state = fs "800001ed" {
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
@@ -170,7 +164,6 @@
           } null;
         } null;
         run = fs "800001ed" { nscd = fs "800001ed" { } null; } null;
-        cache = fs "800001ed" { private = fs "800001c0" null null; } null;
       } null;
     } null;
 
@@ -192,7 +185,6 @@
       (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
       (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
       (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/cache" "/var/cache" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
       (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
       (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=4k,mode=755,uid=1000004,gid=1000004")
       (ent "/" "/run/user/65534" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8192k,mode=700,uid=1000004,gid=1000004")

test/sandbox/case/mapuid.nix

@@ -8,7 +8,6 @@
   tty = false;
   device = false;
   mapRealUid = true;
-  useCommonPaths = true;
 
   want = {
     env = [
@@ -165,12 +164,7 @@
             u0 = fs "800001c0" {
               a3 = fs "800001c0" {
                 ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
+                ".config" = fs "800001ed" { "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null; } null;
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
                 ".local" = fs "800001ed" {
                   state = fs "800001ed" {
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
@@ -194,7 +188,6 @@
           } null;
         } null;
         run = fs "800001ed" { nscd = fs "800001ed" { } null; } null;
-        cache = fs "800001ed" { private = fs "800001c0" null null; } null;
       } null;
     } null;
 
@@ -220,7 +213,6 @@
       (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
       (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
       (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/cache" "/var/cache" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
       (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
       (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=4k,mode=755,uid=1000003,gid=1000003")
       (ent "/" "/run/user/1000" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8192k,mode=700,uid=1000003,gid=1000003")

test/sandbox/case/preset.nix

@@ -8,7 +8,6 @@
   tty = false;
   device = false;
   mapRealUid = false;
-  useCommonPaths = false;
 
   want = {
     env = [
@@ -165,12 +164,7 @@
             u0 = fs "800001c0" {
               a1 = fs "800001c0" {
                 ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
+                ".config" = fs "800001ed" { "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null; } null;
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
                 ".local" = fs "800001ed" {
                   state = fs "800001ed" {
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;

test/sandbox/case/tty.nix

@@ -8,7 +8,6 @@
   tty = true;
   device = false;
   mapRealUid = false;
-  useCommonPaths = true;
 
   want = {
     env = [
@@ -166,12 +165,7 @@
             u0 = fs "800001c0" {
               a2 = fs "800001c0" {
                 ".cache" = fs "800001ed" { ".keep" = fs "80001ff" null ""; } null;
-                ".config" = fs "800001ed" {
+                ".config" = fs "800001ed" { "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null; } null;
-                  "environment.d" = fs "800001ed" { "10-home-manager.conf" = fs "80001ff" null null; } null;
-                  systemd = fs "800001ed" {
-                    user = fs "800001ed" { "tray.target" = fs "80001ff" null null; } null;
-                  } null;
-                } null;
                 ".local" = fs "800001ed" {
                   state = fs "800001ed" {
                     home-manager = fs "800001ed" { gcroots = fs "800001ed" { current-home = fs "80001ff" null null; } null; } null;
@@ -195,7 +189,6 @@
           } null;
         } null;
         run = fs "800001ed" { nscd = fs "800001ed" { } null; } null;
-        cache = fs "800001ed" { private = fs "800001c0" null null; } null;
       } null;
     } null;
 
@@ -222,7 +215,6 @@
       (ent "/dev" "/sys/dev" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
       (ent "/devices" "/sys/devices" "ro,nosuid,nodev,noexec,relatime" "sysfs" "sysfs" "rw")
       (ent "/dri" "/dev/dri" "rw,nosuid" "devtmpfs" "devtmpfs" ignore)
-      (ent "/var/cache" "/var/cache" "rw,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
       (ent "/etc" ignore "ro,nosuid,nodev,relatime" "ext4" "/dev/disk/by-label/nixos" "rw")
       (ent "/" "/run/user" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=4k,mode=755,uid=1000002,gid=1000002")
       (ent "/" "/run/user/65534" "rw,nosuid,nodev,relatime" "tmpfs" "tmpfs" "rw,size=8192k,mode=700,uid=1000002,gid=1000002")

test/sandbox/configuration.nix

@@ -65,16 +65,7 @@ in
     stateDir = "/var/lib/fortify";
     users.alice = 0;
 
-    extraHomeConfig = {
+    home-manager = _: _: { home.stateVersion = "23.05"; };
-      home.stateVersion = "23.05";
-    };
-
-    commonPaths = [
-      {
-        src = "/var/cache";
-        write = true;
-      }
-    ];
 
     apps = with testCases; [
       preset

test/test.py

@@ -152,8 +152,6 @@ print(machine.fail("sudo -u alice -i fortify -v run --wayland true"))
 fortify('-v run --wayland --dbus notify-send -a "NixOS Tests" "Test notification" "Notification from within sandbox." && touch /tmp/dbus-ok')
 machine.wait_for_file("/tmp/dbus-ok", timeout=15)
 collect_state_ui("dbus_notify_exited")
-# not in pid namespace, verify termination
-machine.wait_until_fails("pgrep xdg-dbus-proxy")
 machine.succeed("pkill -9 mako")
 
 # Check revert type selection: