security/hakurei
security/hakurei
6
3
Fork 0
Code Issues 11 Pull Requests Actions Packages Projects Releases 10 Wiki Activity

cmd/hakurei: exec instead of fork/exec from shell
All checks were successful
Test / Create distribution (push) Successful in 36s
Details
Test / Sandbox (push) Successful in 2m44s
Details
Test / Sandbox (race detector) (push) Successful in 4m40s
Details
Test / Hakurei (push) Successful in 4m53s
Details
Test / Hpkg (push) Successful in 5m5s
Details
Test / Hakurei (race detector) (push) Successful in 6m26s
Details
Test / Flake checks (push) Successful in 1m27s
Details

Browse Source 
There is no reason to keep the shell process around.

Signed-off-by: Ophestra <cat@gensokyo.uk>
This commit is contained in:
Ophestra 2025-12-08 22:29:41 +09:00
parent 462863e290
commit d5fb179012
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
4 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/hakurei/command.go
View File

@ -191,7 +191,7 @@ func buildCommand(ctx context.Context, msg message.Msg, early *earlyHardeningErr
if flagPulse { if flagPulse {
config.Container.Filesystem = append(config.Container.Filesystem, hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSDaemon{ config.Container.Filesystem = append(config.Container.Filesystem, hst.FilesystemConfigJSON{FilesystemConfig: &hst.FSDaemon{
Target: fhs.AbsRunUser.Append(strconv.Itoa(container.OverflowUid(msg)), "pulse/native"), Target: fhs.AbsRunUser.Append(strconv.Itoa(container.OverflowUid(msg)), "pulse/native"),
Exec: shell, Args: []string{"-lc", "pipewire-pulse"}, Exec: shell, Args: []string{"-lc", "exec pipewire-pulse"},
}}) }})
} }

2
nixos.nix
View File

@ -202,7 +202,7 @@ in
path = cfg.shell; path = cfg.shell;
args = [ args = [
"-lc" "-lc"
"pipewire-pulse" "exec pipewire-pulse"
]; ];
} }
++ [ ++ [

2
test/interactive/hakurei.nix
View File

@ -37,7 +37,7 @@
path = "/bin/sh"; path = "/bin/sh";
args = [ args = [
"-lc" "-lc"
"sleep 1 && false" "sleep 1 && exec false"
]; ];
} }
]; ];

1
test/test.py
View File

@ -233,6 +233,7 @@ collect_state_ui("pipewire_wayland")
machine.send_chars("exit\n") machine.send_chars("exit\n")
machine.wait_until_fails("pgrep foot", timeout=5) machine.wait_until_fails("pgrep foot", timeout=5)
# Test PipeWire SecurityContext: # Test PipeWire SecurityContext:
machine.succeed("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei -v run --pulse pactl info")
machine.fail("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei -v run --pulse pactl set-sink-mute @DEFAULT_SINK@ toggle") machine.fail("sudo -u alice -i XDG_RUNTIME_DIR=/run/user/1000 hakurei -v run --pulse pactl set-sink-mute @DEFAULT_SINK@ toggle")
# Test XWayland (foot does not support X): # Test XWayland (foot does not support X):