security/hakurei
6
3
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

hst/config: remove data field, rename dir to home
All checks were successful
Test / Create distribution (push) Successful in 34s
Details
Test / Sandbox (push) Successful in 2m13s
Details
Test / Hakurei (push) Successful in 3m10s
Details
Test / Hpkg (push) Successful in 4m5s
Details
Test / Sandbox (race detector) (push) Successful in 4m27s
Details
Test / Hakurei (race detector) (push) Successful in 5m7s
Details
Test / Flake checks (push) Successful in 1m28s
Details

Browse Source 
There is no reason to give the home directory special treatment, as this behaviour can be quite confusing. The home directory also does not necessarily require its own mount point, it could be provided by a parent or simply be ephemeral.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra
2025-08-26 00:52:49 +09:00
parent 878b66022e
commit c9facb746b
20 changed files with 44 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/hakurei/command.go
View File

@@ -121,7 +121,7 @@ func buildCommand(out io.Writer) command.Command {
log.Fatal(err.Error())
return err
} else {
config.Data = a
config.Home = a
}
var e system.Enablement

4
cmd/hakurei/print.go
View File

@@ -81,8 +81,8 @@ func printShowInstance(
if len(config.Groups) > 0 {
t.Printf(" Groups:\t%s\n", strings.Join(config.Groups, ", "))
}
if config.Data != nil {
t.Printf(" Data:\t%s\n", config.Data)
if config.Home != nil {
t.Printf(" Home:\t%s\n", config.Home)
}
if config.Container != nil {
params := config.Container

13
cmd/hakurei/print_test.go
View File

@@ -39,7 +39,7 @@ func Test_printShowInstance(t *testing.T) {
Identity: 9 (org.chromium.Chromium)
Enablements: wayland, dbus, pulseaudio
Groups: video, dialout, plugdev
Data: /var/lib/hakurei/u0/org.chromium.Chromium
Home: /data/data/org.chromium.Chromium
Hostname: localhost
Flags: userns devel net abstract device tty mapuid
Path: /run/current-system/sw/bin/chromium
@@ -116,7 +116,7 @@ App
Identity: 9 (org.chromium.Chromium)
Enablements: wayland, dbus, pulseaudio
Groups: video, dialout, plugdev
Data: /var/lib/hakurei/u0/org.chromium.Chromium
Home: /data/data/org.chromium.Chromium
Hostname: localhost
Flags: userns devel net abstract device tty mapuid
Path: /run/current-system/sw/bin/chromium
@@ -236,8 +236,7 @@ App
},
"username": "chronos",
"shell": "/run/current-system/sw/bin/zsh",
"data": "/var/lib/hakurei/u0/org.chromium.Chromium",
"dir": "/data/data/org.chromium.Chromium",
"home": "/data/data/org.chromium.Chromium",
"extra_perms": [
{
"ensure": true,
@@ -393,8 +392,7 @@ App
},
"username": "chronos",
"shell": "/run/current-system/sw/bin/zsh",
"data": "/var/lib/hakurei/u0/org.chromium.Chromium",
"dir": "/data/data/org.chromium.Chromium",
"home": "/data/data/org.chromium.Chromium",
"extra_perms": [
{
"ensure": true,
@@ -604,8 +602,7 @@ func Test_printPs(t *testing.T) {
},
"username": "chronos",
"shell": "/run/current-system/sw/bin/zsh",
"data": "/var/lib/hakurei/u0/org.chromium.Chromium",
"dir": "/data/data/org.chromium.Chromium",
"home": "/data/data/org.chromium.Chromium",
"extra_perms": [
{
"ensure": true,

4
cmd/hpkg/app.go
View File

@@ -78,8 +78,7 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *container.Absolute, arg
Username: "hakurei",
Shell: pathShell,
Data: pathSet.homeDir,
Dir: pathDataData.Append(app.ID),
Home: pathDataData.Append(app.ID),
Identity: app.Identity,
Groups: app.Groups,
@@ -106,6 +105,7 @@ func (app *appInfo) toHst(pathSet *appPathSet, pathname *container.Absolute, arg
{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("class"), Optional: true}},
{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("dev"), Optional: true}},
{FilesystemConfig: &hst.FSBind{Source: container.AbsFHSSys.Append("devices"), Optional: true}},
{FilesystemConfig: &hst.FSBind{Target: pathDataData.Append(app.ID), Source: pathSet.homeDir, Write: true, Ensure: true}},
},
},
ExtraPerms: []*hst.ExtraPermConfig{

8
cmd/hpkg/with.go
View File

@@ -33,8 +33,7 @@ func withNixDaemon(
Username: "hakurei",
Shell: pathShell,
Data: pathSet.homeDir,
Dir: pathDataData.Append(app.ID),
Home: pathDataData.Append(app.ID),
ExtraPerms: []*hst.ExtraPermConfig{
{Path: dataHome, Execute: true},
{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
@@ -54,6 +53,7 @@ func withNixDaemon(
{FilesystemConfig: &hst.FSLink{Target: pathCurrentSystem, Linkname: app.CurrentSystem.String()}},
{FilesystemConfig: &hst.FSLink{Target: pathBin, Linkname: pathSwBin.String()}},
{FilesystemConfig: &hst.FSLink{Target: container.AbsFHSUsrBin, Linkname: pathSwBin.String()}},
{FilesystemConfig: &hst.FSBind{Target: pathDataData.Append(app.ID), Source: pathSet.homeDir, Write: true, Ensure: true}},
},
},
}), dropShell, beforeFail)
@@ -71,8 +71,7 @@ func withCacheDir(
Username: "nixos",
Shell: pathShell,
Data: pathSet.cacheDir, // this also ensures cacheDir via shim
Dir: pathDataData.Append(app.ID, "cache"),
Home: pathDataData.Append(app.ID, "cache"),
ExtraPerms: []*hst.ExtraPermConfig{
{Path: dataHome, Execute: true},
{Ensure: true, Path: pathSet.baseDir, Read: true, Write: true, Execute: true},
@@ -92,6 +91,7 @@ func withCacheDir(
{FilesystemConfig: &hst.FSLink{Target: pathBin, Linkname: pathSwBin.String()}},
{FilesystemConfig: &hst.FSLink{Target: container.AbsFHSUsrBin, Linkname: pathSwBin.String()}},
{FilesystemConfig: &hst.FSBind{Source: workDir, Target: hst.AbsTmp.Append("bundle")}},
{FilesystemConfig: &hst.FSBind{Target: pathDataData.Append(app.ID, "cache"), Source: pathSet.cacheDir, Write: true, Ensure: true}},
},
},
}, dropShell, beforeFail)