fortify/fst
Ophestra e9a7cd526f
All checks were successful
Test / Create distribution (push) Successful in 27s
Test / Sandbox (push) Successful in 1m45s
Test / Fortify (push) Successful in 2m36s
Test / Sandbox (race detector) (push) Successful in 2m49s
Test / Fpkg (push) Successful in 3m33s
Test / Fortify (race detector) (push) Successful in 4m13s
Test / Flake checks (push) Successful in 1m6s
app: improve shim process management
This ensures a signal gets delivered to the process instead of relying on parent death behaviour.

SIGCONT was chosen as it is the only signal an unprivileged process is allowed to send to processes with different credentials.

A custom signal handler is installed because the Go runtime does not expose signal information other than which signal was received, and shim must check pid to ensure reasonable behaviour.

Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-04-07 03:55:17 +09:00
..
app.go app: improve shim process management 2025-04-07 03:55:17 +09:00
config.go fst: optional configured shell path 2025-03-31 21:27:31 +09:00
id_test.go migrate to git.gensokyo.uk/security/fortify 2024-12-20 00:20:02 +09:00
id.go fst: implement app id parser 2024-12-19 18:19:47 +09:00
info.go fortify: show system info when instance is not specified 2025-01-01 19:35:50 +09:00
path_test.go fst: hide sockets exposed via Filesystem 2025-01-15 10:13:18 +09:00
path.go fst: hide sockets exposed via Filesystem 2025-01-15 10:13:18 +09:00
sandbox.go fst: set multiarch bit 2025-03-30 22:55:00 +09:00