app: generate and replace passwd and group files

This ensures libc functions get correct user information.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>

internal/app/seal.go

@@ -9,6 +9,7 @@ import (
 	"strconv"
 
 	"git.ophivana.moe/cat/fortify/dbus"
+	"git.ophivana.moe/cat/fortify/helper/bwrap"
 	"git.ophivana.moe/cat/fortify/internal"
 	"git.ophivana.moe/cat/fortify/internal/state"
 	"git.ophivana.moe/cat/fortify/internal/verbose"
@@ -159,6 +160,11 @@ func (a *app) Seal(config *Config) error {
 			}
 			conf.Filesystem = append(conf.Filesystem, b...)
 		}
+		// hide nscd from sandbox if present
+		nscd := "/var/run/nscd"
+		if _, err := os.Stat(nscd); !errors.Is(err, os.ErrNotExist) {
+			conf.Tmpfs = append(conf.Tmpfs, bwrap.TmpfsConfig{Size: 8 * 1024, Dir: nscd})
+		}
 		// bind GPU stuff
 		if config.Confinement.Enablements.Has(state.EnableX) || config.Confinement.Enablements.Has(state.EnableWayland) {
 			conf.Filesystem = append(conf.Filesystem, &FilesystemConfig{Src: "/dev/dri", Device: true})