Ophestra Umiker
6220f7e197
Both machinectl and sudo launch methods launch shim as shim is now responsible for setting up the sandbox. Various app structures are adapted to accommodate bwrap configuration and mediated wayland access. Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
56 lines
836 B
Go
56 lines
836 B
Go
package app
|
|
|
|
import (
|
|
"net"
|
|
"os/exec"
|
|
"sync"
|
|
)
|
|
|
|
type App interface {
|
|
Seal(config *Config) error
|
|
Start() error
|
|
Wait() (int, error)
|
|
WaitErr() error
|
|
String() string
|
|
}
|
|
|
|
type app struct {
|
|
// child process related information
|
|
seal *appSeal
|
|
// underlying fortified child process
|
|
cmd *exec.Cmd
|
|
// wayland connection if wayland mediation is enabled
|
|
wayland *net.UnixConn
|
|
// error returned waiting for process
|
|
wait error
|
|
|
|
lock sync.RWMutex
|
|
}
|
|
|
|
func (a *app) String() string {
|
|
if a == nil {
|
|
return "(invalid fortified app)"
|
|
}
|
|
|
|
a.lock.RLock()
|
|
defer a.lock.RUnlock()
|
|
|
|
if a.cmd != nil {
|
|
return a.cmd.String()
|
|
}
|
|
|
|
if a.seal != nil {
|
|
return "(sealed fortified app as uid " + a.seal.sys.Uid + ")"
|
|
}
|
|
|
|
return "(unsealed fortified app)"
|
|
}
|
|
|
|
func (a *app) WaitErr() error {
|
|
return a.wait
|
|
}
|
|
|
|
func New() App {
|
|
return new(app)
|
|
}
|