security/hakurei
6
3
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

system: enforce absolute paths
All checks were successful
Test / Create distribution (push) Successful in 1m17s
Details
Test / Sandbox (push) Successful in 2m56s
Details
Test / Hakurei (push) Successful in 3m54s
Details
Test / Hpkg (push) Successful in 4m51s
Details
Test / Sandbox (race detector) (push) Successful in 5m3s
Details
Test / Hakurei (race detector) (push) Successful in 6m0s
Details
Test / Flake checks (push) Successful in 1m38s
Details

Browse Source 
This is less error-prone, and is quite easy to integrate considering internal/app has already migrated to container.Absolute.

Closes #11.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra
2025-10-03 02:26:14 +09:00
parent e58181a930
commit d16da6da8c
15 changed files with 125 additions and 117 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
system/acl.go
View File

@@ -6,19 +6,20 @@ import (
"os"
"slices"
"hakurei.app/container"
"hakurei.app/hst"
"hakurei.app/system/acl"
)
// UpdatePerm calls UpdatePermType with the [Process] criteria.
func (sys *I) UpdatePerm(path string, perms ...acl.Perm) *I {
func (sys *I) UpdatePerm(path *container.Absolute, perms ...acl.Perm) *I {
sys.UpdatePermType(Process, path, perms...)
return sys
}
// UpdatePermType maintains [acl.Perms] on a file until its [Enablement] is no longer satisfied.
func (sys *I) UpdatePermType(et hst.Enablement, path string, perms ...acl.Perm) *I {
sys.ops = append(sys.ops, &aclUpdateOp{et, path, perms})
func (sys *I) UpdatePermType(et hst.Enablement, path *container.Absolute, perms ...acl.Perm) *I {
sys.ops = append(sys.ops, &aclUpdateOp{et, path.String(), perms})
return sys
}

16
system/acl_test.go
View File

@@ -60,42 +60,42 @@ func TestACLUpdateOp(t *testing.T) {
0xdeadbeef,
func(_ *testing.T, sys *I) {
sys.
UpdatePerm("/run/user/1971/hakurei", acl.Execute).
UpdatePerm("/tmp/hakurei.0/tmpdir/150", acl.Read, acl.Write, acl.Execute)
UpdatePerm(m("/run/user/1971/hakurei"), acl.Execute).
UpdatePerm(m("/tmp/hakurei.0/tmpdir/150"), acl.Read, acl.Write, acl.Execute)
}, []Op{
&aclUpdateOp{Process, "/run/user/1971/hakurei", []acl.Perm{acl.Execute}},
&aclUpdateOp{Process, "/tmp/hakurei.0/tmpdir/150", []acl.Perm{acl.Read, acl.Write, acl.Execute}},
}, stub.Expect{}},
{"tmpdirp", 0xdeadbeef, func(_ *testing.T, sys *I) {
sys.UpdatePermType(User, "/tmp/hakurei.0/tmpdir", acl.Execute)
sys.UpdatePermType(User, m("/tmp/hakurei.0/tmpdir"), acl.Execute)
}, []Op{
&aclUpdateOp{User, "/tmp/hakurei.0/tmpdir", []acl.Perm{acl.Execute}},
}, stub.Expect{}},
{"tmpdir", 0xdeadbeef, func(_ *testing.T, sys *I) {
sys.UpdatePermType(User, "/tmp/hakurei.0/tmpdir/150", acl.Read, acl.Write, acl.Execute)
sys.UpdatePermType(User, m("/tmp/hakurei.0/tmpdir/150"), acl.Read, acl.Write, acl.Execute)
}, []Op{
&aclUpdateOp{User, "/tmp/hakurei.0/tmpdir/150", []acl.Perm{acl.Read, acl.Write, acl.Execute}},
}, stub.Expect{}},
{"share", 0xdeadbeef, func(_ *testing.T, sys *I) {
sys.UpdatePermType(Process, "/run/user/1971/hakurei/fcb8a12f7c482d183ade8288c3de78b5", acl.Execute)
sys.UpdatePermType(Process, m("/run/user/1971/hakurei/fcb8a12f7c482d183ade8288c3de78b5"), acl.Execute)
}, []Op{
&aclUpdateOp{Process, "/run/user/1971/hakurei/fcb8a12f7c482d183ade8288c3de78b5", []acl.Perm{acl.Execute}},
}, stub.Expect{}},
{"passwd", 0xdeadbeef, func(_ *testing.T, sys *I) {
sys.
UpdatePermType(Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/passwd", acl.Read).
UpdatePermType(Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/group", acl.Read)
UpdatePermType(Process, m("/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/passwd"), acl.Read).
UpdatePermType(Process, m("/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/group"), acl.Read)
}, []Op{
&aclUpdateOp{Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/passwd", []acl.Perm{acl.Read}},
&aclUpdateOp{Process, "/tmp/hakurei.0/fcb8a12f7c482d183ade8288c3de78b5/group", []acl.Perm{acl.Read}},
}, stub.Expect{}},
{"wayland", 0xdeadbeef, func(_ *testing.T, sys *I) {
sys.UpdatePermType(hst.EWayland, "/run/user/1971/wayland-0", acl.Read, acl.Write, acl.Execute)
sys.UpdatePermType(hst.EWayland, m("/run/user/1971/wayland-0"), acl.Read, acl.Write, acl.Execute)
}, []Op{
&aclUpdateOp{hst.EWayland, "/run/user/1971/wayland-0", []acl.Perm{acl.Read, acl.Write, acl.Execute}},
}, stub.Expect{}},

6
system/dbus.go
View File

@@ -21,7 +21,7 @@ var (
)
// MustProxyDBus calls ProxyDBus and panics if an error is returned.
func (sys *I) MustProxyDBus(sessionPath string, session *dbus.Config, systemPath string, system *dbus.Config) *I {
func (sys *I) MustProxyDBus(sessionPath *container.Absolute, session *dbus.Config, systemPath *container.Absolute, system *dbus.Config) *I {
if _, err := sys.ProxyDBus(session, system, sessionPath, systemPath); err != nil {
panic(err.Error())
} else {
@@ -31,7 +31,7 @@ func (sys *I) MustProxyDBus(sessionPath string, session *dbus.Config, systemPath
// ProxyDBus finalises configuration ahead of time and starts xdg-dbus-proxy via [dbus] and terminates it on revert.
// This [Op] is always [Process] scoped.
func (sys *I) ProxyDBus(session, system *dbus.Config, sessionPath, systemPath string) (func(), error) {
func (sys *I) ProxyDBus(session, system *dbus.Config, sessionPath, systemPath *container.Absolute) (func(), error) {
d := new(dbusProxyOp)
// session bus is required as otherwise this is effectively a very expensive noop
@@ -45,7 +45,7 @@ func (sys *I) ProxyDBus(session, system *dbus.Config, sessionPath, systemPath st
var sessionBus, systemBus dbus.ProxyPair
sessionBus[0], systemBus[0] = sys.dbusAddress()
sessionBus[1], systemBus[1] = sessionPath, systemPath
sessionBus[1], systemBus[1] = sessionPath.String(), systemPath.String()
d.out = &linePrefixWriter{println: log.Println, prefix: "(dbus) ", buf: new(strings.Builder)}
if final, err := sys.dbusFinalise(sessionBus, systemBus, session, system); err != nil {
if errors.Is(err, syscall.EINVAL) {

14
system/dbus_test.go
View File

@@ -82,7 +82,7 @@ func TestDBusProxyOp(t *testing.T) {
Op: "dbus", Err: ErrDBusConfig,
Msg: "attempted to create message bus proxy args without session bus config",
}
if f, err := sys.ProxyDBus(nil, new(dbus.Config), "", ""); !reflect.DeepEqual(err, wantErr) {
if f, err := sys.ProxyDBus(nil, new(dbus.Config), nil, nil); !reflect.DeepEqual(err, wantErr) {
t.Errorf("ProxyDBus: error = %v, want %v", err, wantErr)
} else if f != nil {
t.Errorf("ProxyDBus: f = %p", f)
@@ -98,10 +98,10 @@ func TestDBusProxyOp(t *testing.T) {
}()
sys.MustProxyDBus(
"/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/bus", &dbus.Config{
m("/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/bus"), &dbus.Config{
// use impossible value here as an implicit assert that it goes through the stub
Talk: []string{"session\x00"}, Filter: true,
}, "/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/system_bus_socket", &dbus.Config{
}, m("/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/system_bus_socket"), &dbus.Config{
// use impossible value here as an implicit assert that it goes through the stub
Talk: []string{"system\x00"}, Filter: true,
})
@@ -128,8 +128,8 @@ func TestDBusProxyOp(t *testing.T) {
// use impossible value here as an implicit assert that it goes through the stub
Talk: []string{"system\x00"}, Filter: true,
},
"/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/bus",
"/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/system_bus_socket"); !reflect.DeepEqual(err, wantErr) {
m("/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/bus"),
m("/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/system_bus_socket")); !reflect.DeepEqual(err, wantErr) {
t.Errorf("ProxyDBus: error = %v", err)
} else if f != nil {
t.Errorf("ProxyDBus: f = %p", f)
@@ -146,10 +146,10 @@ func TestDBusProxyOp(t *testing.T) {
{"full", 0xcafebabe, func(_ *testing.T, sys *I) {
sys.MustProxyDBus(
"/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/bus", &dbus.Config{
m("/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/bus"), &dbus.Config{
// use impossible value here as an implicit assert that it goes through the stub
Talk: []string{"session\x00"}, Filter: true,
}, "/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/system_bus_socket", &dbus.Config{
}, m("/tmp/hakurei.0/99dd71ee2146369514e0d10783368f8f/system_bus_socket"), &dbus.Config{
// use impossible value here as an implicit assert that it goes through the stub
Talk: []string{"system\x00"}, Filter: true,
})

9
system/link.go
View File

@@ -3,15 +3,18 @@ package system
import (
"fmt"
"hakurei.app/container"
"hakurei.app/hst"
)
// Link calls LinkFileType with the [Process] criteria.
func (sys *I) Link(oldname, newname string) *I { return sys.LinkFileType(Process, oldname, newname) }
func (sys *I) Link(oldname, newname *container.Absolute) *I {
return sys.LinkFileType(Process, oldname, newname)
}
// LinkFileType maintains a hardlink until its [Enablement] is no longer satisfied.
func (sys *I) LinkFileType(et hst.Enablement, oldname, newname string) *I {
sys.ops = append(sys.ops, &hardlinkOp{et, newname, oldname})
func (sys *I) LinkFileType(et hst.Enablement, oldname, newname *container.Absolute) *I {
sys.ops = append(sys.ops, &hardlinkOp{et, newname.String(), oldname.String()})
return sys
}

4
system/link_test.go
View File

@@ -40,13 +40,13 @@ func TestHardlinkOp(t *testing.T) {
checkOpsBuilder(t, "LinkFileType", []opsBuilderTestCase{
{"type", 0xcafebabe, func(_ *testing.T, sys *I) {
sys.LinkFileType(User, "/run/user/1000/pulse/native", "/run/user/1000/hakurei/9663730666a44cfc2a81610379e02ed6/pulse")
sys.LinkFileType(User, m("/run/user/1000/pulse/native"), m("/run/user/1000/hakurei/9663730666a44cfc2a81610379e02ed6/pulse"))
}, []Op{
&hardlinkOp{User, "/run/user/1000/hakurei/9663730666a44cfc2a81610379e02ed6/pulse", "/run/user/1000/pulse/native"},
}, stub.Expect{}},
{"link", 0xcafebabe, func(_ *testing.T, sys *I) {
sys.Link("/run/user/1000/pulse/native", "/run/user/1000/hakurei/9663730666a44cfc2a81610379e02ed6/pulse")
sys.Link(m("/run/user/1000/pulse/native"), m("/run/user/1000/hakurei/9663730666a44cfc2a81610379e02ed6/pulse"))
}, []Op{
&hardlinkOp{Process, "/run/user/1000/hakurei/9663730666a44cfc2a81610379e02ed6/pulse", "/run/user/1000/pulse/native"},
}, stub.Expect{}},

9
system/mkdir.go
View File

@@ -5,18 +5,19 @@ import (
"fmt"
"os"
"hakurei.app/container"
"hakurei.app/hst"
)
// Ensure ensures the existence of a directory.
func (sys *I) Ensure(name string, perm os.FileMode) *I {
sys.ops = append(sys.ops, &mkdirOp{User, name, perm, false})
func (sys *I) Ensure(name *container.Absolute, perm os.FileMode) *I {
sys.ops = append(sys.ops, &mkdirOp{User, name.String(), perm, false})
return sys
}
// Ephemeral ensures the existence of a directory until its [Enablement] is no longer satisfied.
func (sys *I) Ephemeral(et hst.Enablement, name string, perm os.FileMode) *I {
sys.ops = append(sys.ops, &mkdirOp{et, name, perm, true})
func (sys *I) Ephemeral(et hst.Enablement, name *container.Absolute, perm os.FileMode) *I {
sys.ops = append(sys.ops, &mkdirOp{et, name.String(), perm, true})
return sys
}

4
system/mkdir_test.go
View File

@@ -57,13 +57,13 @@ func TestMkdirOp(t *testing.T) {
checkOpsBuilder(t, "EnsureEphemeral", []opsBuilderTestCase{
{"ensure", 0xcafebabe, func(_ *testing.T, sys *I) {
sys.Ensure("/tmp/hakurei.0", 0700)
sys.Ensure(m("/tmp/hakurei.0"), 0700)
}, []Op{
&mkdirOp{User, "/tmp/hakurei.0", 0700, false},
}, stub.Expect{}},
{"ephemeral", 0xcafebabe, func(_ *testing.T, sys *I) {
sys.Ephemeral(Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711)
sys.Ephemeral(Process, m("/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9"), 0711)
}, []Op{
&mkdirOp{Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711, true},
}, stub.Expect{}},

24
system/system_test.go
View File

@@ -133,34 +133,34 @@ func TestEqual(t *testing.T) {
ChangeHosts("chronos"),
New(t.Context(), container.NewMsg(nil), 150).
ChangeHosts("chronos").
Ensure("/run", 0755),
Ensure(m("/run"), 0755),
false},
{"op value mismatch",
New(t.Context(), container.NewMsg(nil), 150).
ChangeHosts("chronos").
Ensure("/run", 0644),
Ensure(m("/run"), 0644),
New(t.Context(), container.NewMsg(nil), 150).
ChangeHosts("chronos").
Ensure("/run", 0755),
Ensure(m("/run"), 0755),
false},
{"op type mismatch",
New(t.Context(), container.NewMsg(nil), 150).
ChangeHosts("chronos").
CopyFile(new([]byte), "/home/ophestra/xdg/config/pulse/cookie", 0, 256),
CopyFile(new([]byte), m("/home/ophestra/xdg/config/pulse/cookie"), 0, 256),
New(t.Context(), container.NewMsg(nil), 150).
ChangeHosts("chronos").
Ensure("/run", 0755),
Ensure(m("/run"), 0755),
false},
{"op equals",
New(t.Context(), container.NewMsg(nil), 150).
ChangeHosts("chronos").
Ensure("/run", 0755),
Ensure(m("/run"), 0755),
New(t.Context(), container.NewMsg(nil), 150).
ChangeHosts("chronos").
Ensure("/run", 0755),
Ensure(m("/run"), 0755),
true},
}
@@ -187,7 +187,7 @@ func TestCommitRevert(t *testing.T) {
}{
{"apply xhost partial mkdir", func(sys *I) {
sys.
Ephemeral(Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711).
Ephemeral(Process, m("/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9"), 0711).
ChangeHosts("chronos")
}, 0xff, []stub.Call{
call("verbose", stub.ExpectArgs{[]any{"ensuring directory", &mkdirOp{Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711, true}}}, nil, nil),
@@ -202,7 +202,7 @@ func TestCommitRevert(t *testing.T) {
{"apply xhost", func(sys *I) {
sys.
Ephemeral(Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711).
Ephemeral(Process, m("/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9"), 0711).
ChangeHosts("chronos")
}, 0xff, []stub.Call{
call("verbose", stub.ExpectArgs{[]any{"ensuring directory", &mkdirOp{Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711, true}}}, nil, nil),
@@ -216,7 +216,7 @@ func TestCommitRevert(t *testing.T) {
{"revert multi", func(sys *I) {
sys.
Ephemeral(Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711).
Ephemeral(Process, m("/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9"), 0711).
ChangeHosts("chronos")
}, 0xff, []stub.Call{
call("verbose", stub.ExpectArgs{[]any{"ensuring directory", &mkdirOp{Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711, true}}}, nil, nil),
@@ -234,7 +234,7 @@ func TestCommitRevert(t *testing.T) {
{"success", func(sys *I) {
sys.
Ephemeral(Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711).
Ephemeral(Process, m("/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9"), 0711).
ChangeHosts("chronos")
}, 0xff, []stub.Call{
call("verbose", stub.ExpectArgs{[]any{"ensuring directory", &mkdirOp{Process, "/tmp/hakurei.0/f2f3bcd492d0266438fa9bf164fe90d9", 0711, true}}}, nil, nil),
@@ -312,3 +312,5 @@ func TestNop(t *testing.T) {
new(noCopy).Unlock()
new(noCopy).Lock()
}
func m(pathname string) *container.Absolute { return container.MustAbs(pathname) }

5
system/tmpfiles.go
View File

@@ -8,14 +8,15 @@ import (
"os"
"syscall"
"hakurei.app/container"
"hakurei.app/hst"
)
// CopyFile reads up to n bytes from src and writes the resulting byte slice to payloadP.
func (sys *I) CopyFile(payloadP *[]byte, src string, cap int, n int64) *I {
func (sys *I) CopyFile(payloadP *[]byte, src *container.Absolute, cap int, n int64) *I {
buf := new(bytes.Buffer)
buf.Grow(cap)
sys.ops = append(sys.ops, &tmpfileOp{payloadP, src, n, buf})
sys.ops = append(sys.ops, &tmpfileOp{payloadP, src.String(), n, buf})
return sys
}

2
system/tmpfiles_test.go
View File

@@ -98,7 +98,7 @@ func TestTmpfileOp(t *testing.T) {
checkOpsBuilder(t, "CopyFile", []opsBuilderTestCase{
{"pulse", 0xcafebabe, func(_ *testing.T, sys *I) {
sys.CopyFile(new([]byte), "/home/ophestra/xdg/config/pulse/cookie", 1<<8, 1<<8)
sys.CopyFile(new([]byte), m("/home/ophestra/xdg/config/pulse/cookie"), 1<<8, 1<<8)
}, []Op{&tmpfileOp{
new([]byte), "/home/ophestra/xdg/config/pulse/cookie", 1 << 8,
func() *bytes.Buffer { buf := new(bytes.Buffer); buf.Grow(1 << 8); return buf }(),

5
system/wayland.go
View File

@@ -5,6 +5,7 @@ import (
"fmt"
"os"
"hakurei.app/container"
"hakurei.app/hst"
"hakurei.app/system/acl"
"hakurei.app/system/wayland"
@@ -19,8 +20,8 @@ type waylandConn interface {
// Wayland maintains a wayland socket with security-context-v1 attached via [wayland].
// The socket stops accepting connections once the pipe referred to by sync is closed.
// The socket is pathname only and is destroyed on revert.
func (sys *I) Wayland(syncFd **os.File, dst, src, appID, instanceID string) *I {
sys.ops = append(sys.ops, &waylandOp{syncFd, dst, src, appID, instanceID, new(wayland.Conn)})
func (sys *I) Wayland(syncFd **os.File, dst, src *container.Absolute, appID, instanceID string) *I {
sys.ops = append(sys.ops, &waylandOp{syncFd, dst.String(), src.String(), appID, instanceID, new(wayland.Conn)})
return sys
}

4
system/wayland_test.go
View File

@@ -218,8 +218,8 @@ func TestWaylandOp(t *testing.T) {
{"chromium", 0xcafe, func(_ *testing.T, sys *I) {
sys.Wayland(
new(*os.File),
"/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland",
"/run/user/1971/wayland-0",
m("/tmp/hakurei.1971/ebf083d1b175911782d413369b64ce7c/wayland"),
m("/run/user/1971/wayland-0"),
"org.chromium.Chromium",
"ebf083d1b175911782d413369b64ce7c",
)