Ophestra
e9a7cd526f
All checks were successful
Test / Create distribution (push) Successful in 27s
Test / Sandbox (push) Successful in 1m45s
Test / Fortify (push) Successful in 2m36s
Test / Sandbox (race detector) (push) Successful in 2m49s
Test / Fpkg (push) Successful in 3m33s
Test / Fortify (race detector) (push) Successful in 4m13s
Test / Flake checks (push) Successful in 1m6s
This ensures a signal gets delivered to the process instead of relying on parent death behaviour. SIGCONT was chosen as it is the only signal an unprivileged process is allowed to send to processes with different credentials. A custom signal handler is installed because the Go runtime does not expose signal information other than which signal was received, and shim must check pid to ensure reasonable behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>
58 lines
1.5 KiB
Go
58 lines
1.5 KiB
Go
// Package fst exports shared fortify types.
|
|
package fst
|
|
|
|
import (
|
|
"syscall"
|
|
"time"
|
|
)
|
|
|
|
type App interface {
|
|
// ID returns a copy of [fst.ID] held by App.
|
|
ID() ID
|
|
|
|
// Seal determines the outcome of config as a [SealedApp].
|
|
// The value of config might be overwritten and must not be used again.
|
|
Seal(config *Config) (SealedApp, error)
|
|
|
|
String() string
|
|
}
|
|
|
|
type SealedApp interface {
|
|
// Run commits sealed system setup and starts the app process.
|
|
Run(rs *RunState) error
|
|
}
|
|
|
|
// RunState stores the outcome of a call to [SealedApp.Run].
|
|
type RunState struct {
|
|
// Time is the exact point in time where the process was created.
|
|
// Location must be set to UTC.
|
|
//
|
|
// Time is nil if no process was ever created.
|
|
Time *time.Time
|
|
// RevertErr is stored by the deferred revert call.
|
|
RevertErr error
|
|
// WaitErr is the generic error value created by the standard library.
|
|
WaitErr error
|
|
|
|
syscall.WaitStatus
|
|
}
|
|
|
|
// SetStart stores the current time in [RunState] once.
|
|
func (rs *RunState) SetStart() {
|
|
if rs.Time != nil {
|
|
panic("attempted to store time twice")
|
|
}
|
|
now := time.Now().UTC()
|
|
rs.Time = &now
|
|
}
|
|
|
|
// Paths contains environment-dependent paths used by fortify.
|
|
type Paths struct {
|
|
// path to shared directory (usually `/tmp/fortify.%d`)
|
|
SharePath string `json:"share_path"`
|
|
// XDG_RUNTIME_DIR value (usually `/run/user/%d`)
|
|
RuntimePath string `json:"runtime_path"`
|
|
// application runtime directory (usually `/run/user/%d/fortify`)
|
|
RunDirPath string `json:"run_dir_path"`
|
|
}
|