787 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Ophestra	d5c7523726	container/init: fix prctl call ... This is a very silly typo. Luckily has no effect due to an upper layer doing PR_SET_NO_NEW_PRIVS already. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 14:06:14 +09:00
Ophestra	ddfcc51b91	container: move capset implementation ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 13:47:13 +09:00
Ophestra	8ebedbd88a	container: move syscall constants ... These aren't missing from all targets. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 13:23:01 +09:00
Ophestra	84e8142a2d	container/seccomp: move personality constants ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 12:44:32 +09:00
Ophestra	2c7b7ad845	container/seccomp: cross-platform sysnum cutoff ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 12:27:00 +09:00
Ophestra	72c2b66fc0	nix: cross-platform syscall wrapper ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-07 04:22:55 +09:00
Ophestra	356b42a406	container/init: use /proc/self as intermediate ... Setting up via /tmp is okay, /proc/self/fd makes a lot more sense though for reasons described in the comment. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-06 02:14:35 +09:00
Ophestra	d9b6d48e7c	add miscellaneous badges ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 18:04:09 +09:00
Ophestra	087959e81b	app: remove split implementation ... It is completely nonsensical and highly error-prone to have multiple implementations of this in the same build. This should be switched at compile time instead therefore the split packages are pointless. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 04:36:59 +09:00
Ophestra	e6967b8bbb	release: 0.1.0 ... Signed-off-by: Ophestra <cat@gensokyo.uk> v0.1.0	2025-07-03 03:42:58 +09:00
Ophestra	d2f9a9b83b	treewide: migrate to hakurei.app ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 03:30:39 +09:00
Ophestra	1b5ecd9eaf	container: move out of toplevel ... This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 02:59:43 +09:00
Ophestra	82561d62b6	system: move system access packages ... These packages loosely belong in the "system" package and "system" provides high level wrappers for all of them. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 21:52:07 +09:00
Ophestra	eec021cc4b	hakurei: move container helpers toplevel ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 21:31:29 +09:00
Ophestra	a1d98823f8	hakurei: move container toplevel ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 21:23:55 +09:00
Ophestra	255b77d91d	cmd/hakurei: move command handlers ... The hakurei command is a bit ugly since it's also used for validating the command package. This alleviates some of the ugliness. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 20:59:17 +09:00
Ophestra	f84ec5a3f8	sandbox/wl: track generated files ... This allows the package to be imported. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 20:52:22 +09:00
Ophestra	eb22a8bcc1	cmd/hakurei: move to cmd ... Having it at the project root never made sense since the "ego" name was deprecated. This change finally addresses it. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 20:42:51 +09:00
Ophestra	31aef905fa	sandbox: expose seccomp interface ... There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 04:47:13 +09:00
Ophestra	a6887f7253	sandbox/seccomp: import dot for syscall ... This significantly increases readability in some places. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 02:30:35 +09:00
Ophestra	69bd581af7	sandbox/seccomp: append suffix to ops ... This avoids clashes with stdlib names to allow for . imports. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 01:09:04 +09:00
Ophestra	26b7afc890	sandbox/seccomp: prepare -> export ... Export makes a lot more sense, and also matches the libseccomp function. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 00:32:48 +09:00
Ophestra	d5532aade0	sandbox/seccomp: native rule slice in helpers ... These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 00:22:27 +09:00
Ophestra	0c5409aec7	sandbox/seccomp: native rule type alias ... This makes it easier to keep API stable. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 00:00:08 +09:00
Ophestra	1a8840bebc	sandbox/seccomp: resolve rules natively ... This enables loading syscall filter policies from external cross-platform config files. This also removes a significant amount of C code. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-01 22:11:32 +09:00
Ophestra	1fb453dffe	sandbox/seccomp: extra constants ... These all resolve to pseudo syscall numbers in libseccomp, but are necessary anyway for other platforms. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-01 20:15:42 +09:00
Ophestra	e03d702d08	sandbox/seccomp: implement syscall lookup ... This uses the Go map and is verified against libseccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-01 00:35:27 +09:00
Ophestra	241dc964a6	sandbox/seccomp: wire extra syscall ... These values are only useful for libseccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-01 00:32:08 +09:00
Ophestra	8ef71e14d5	sandbox/seccomp: emit syscall constants ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-30 20:34:33 +09:00
Ophestra	972f4006f0	treewide: switch to hakurei.app ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-26 04:01:02 +09:00
Ophestra	9a8a047908	sandbox/seccomp: syscall name lookup table ... The script is from Go source of same name. The result is checked against libseccomp. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-26 03:49:07 +09:00
Ophestra	863bf69ad3	treewide: reapply clang-format ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 23:43:42 +09:00
Ophestra	0e957cc9c1	release: 0.0.2 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 21:11:11 +09:00
Ophestra	aa454b158f	cmd/planterette: remove hsu special case ... Remove special case and invoke hakurei out of process. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 20:50:24 +09:00
Ophestra	7007bd6a1c	workflows: port release workflow to github ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 20:17:53 +09:00
Ophestra	00efc95ee7	workflows: port test workflow to github ... This is a much less useful port of the test workflow and runs much slower due to runner limitations. Still better than nothing though. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 19:37:45 +09:00
Ophestra	b380bb248c	release: 0.0.1 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 05:05:06 +09:00
Ophestra	87e008d56d	treewide: rename to hakurei ... Fortify makes little sense for a container tool. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 04:57:41 +09:00
Ophestra	3992073212	dist: move comp to dist ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-18 17:01:16 +09:00
Ophestra	ef80b19f2f	treewide: switch to clang-format ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-18 13:45:34 +09:00
Ophestra	717771ae80	app: share runtime dir ... This allows apps with the same identity to access the same runtime dir. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-08 03:24:48 +09:00
Ophestra	bf5772bd8a	nix: deduplicate home-manager merging ... This becomes a problem when extraHomeConfig defines nixos module options. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-08 01:12:18 +09:00
Ophestra	9a7c81a44e	nix: go generate in src derivation ... This saves the generated files in the nix store and exposes them for use by external tools. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-07 03:10:36 +09:00
Ophestra	b7e991de5b	nix: update flake lock ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-05 04:05:39 +09:00
Ophestra	6c1205106d	release: 0.4.1 ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-26 02:55:19 +09:00
Ophestra	2ffca6984a	nix: use reverse-DNS style id as unique identifier ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-25 20:12:30 +09:00
Ophestra	dde2516304	dbus: handle bizarre dbus proxy behaviour ... There is a strange behaviour in xdg-dbus-proxy where if any interface string when stripped of a single ".*" suffix does not contain a '.' byte anywhere, the program will exit with code 1 without any output. This checks for such conditions to make the failure less confusing. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-25 19:50:06 +09:00
Ophestra	f30a439bcd	nix: improve common usability ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-16 04:40:12 +09:00
Ophestra	008e9e7fc5	nix: update flake lock	2025-05-07 21:35:37 +09:00
Ophestra	23aefcd759	fortify: update help strings ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-05-07 19:06:36 +09:00