387 Commits

Author	SHA1	Message	Date
Ophestra	9bc8532d56	container/initdev: mount tmpfs on shm for ro dev ... Programs expect /dev/shm to be a writable tmpfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 03:27:07 +09:00
Ophestra	4cf694d2b3	hst: use hsu userid for share path suffix ... The privileged user is identifier to hakurei through its hsu userid. Using the kernel uid here makes little sense and is a leftover design choice from before hsu was implemented. Closes #7. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 02:16:33 +09:00
Ophestra	c9facb746b	hst/config: remove data field, rename dir to home ... There is no reason to give the home directory special treatment, as this behaviour can be quite confusing. The home directory also does not necessarily require its own mount point, it could be provided by a parent or simply be ephemeral. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-26 00:56:10 +09:00
Ophestra	9585b35d5b	hst/config: remove symlink field ... Closes #6. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 22:23:54 +09:00
Ophestra	0dcac55a0c	hst/config: remove container etc field ... This no longer needs special treatment since it can be specified as a generic filesystem entry. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 19:24:33 +09:00
Ophestra	6d202d73b4	hst/fsbind: optional autoetc behaviour ... This generalises the special field allowing any special behaviour to be matched from target. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 18:38:19 +09:00
Ophestra	1438096339	hst/config: handle filesystem entry targeting root ... This allows any fstype supported by hst to be directly mounted on sysroot. A special case in internal/app applies the matching entry early and excludes it from path hiding. Closes #5. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 17:52:57 +09:00
Ophestra	cedfceded5	container/autoroot: remove prefix field ... This field has been a noop for a long time. Remove it to prevent further confusion. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-25 03:39:20 +09:00
Ophestra	a3988c1a77	hst: rename net and abstract fields ... This makes more sense and matches the container library. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 16:48:01 +09:00
Clayton Gilmer	5db0714072	container: optionally isolate host abstract UNIX domain sockets via landlock	2025-08-18 16:28:14 +09:00
Ophestra	83a1c75f1a	app: set up acl on X11 socket ... The socket is typically owned by the priv-user, and inaccessible by the target user, so just allowing access to the directory is not enough. This change fixes this oversight and add checks that will also be useful for merging #1. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-18 11:30:58 +09:00
Ophestra	305c600cf5	hst: move container type to config ... Container state initialisation is no longer implemented in hst so splitting them no longer makes sense. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:28:36 +09:00
Ophestra	8dd3e1ee5d	hst/fs: rename method Target to Path ... This allows adapter structs to use the same field names as Op structs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-16 02:06:41 +09:00
Ophestra	4ffeec3004	hst/enablement: editor friendly enablement adaptor ... Having the bit field value here (in decimal, no less) is unfriendly to text editors. Use a bunch of booleans here to improve ease of use. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-15 05:16:51 +09:00
Ophestra	99ac96511b	hst/fs: interface filesystem config ... This allows mount points to be represented by different underlying structs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-14 04:52:49 +09:00
Ophestra	e99d7affb0	container: use absolute for pathname ... This is simultaneously more efficient and less error-prone. This change caused minor API changes in multiple other packages. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-11 04:56:42 +09:00
Ophestra	02271583fb	container: remove PATH lookup behaviour ... This is way higher level than the container package and does not even work unless every path is mounted in the exact same location. This behaviour causes nothing but confusion and problems, Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 19:08:54 +09:00
Ophestra	82608164f6	container/params: remove confusingly named error ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-09 17:37:46 +09:00
Ophestra	c6be82bcf9	container/path: fhs path constants ... This increases readability since this can help disambiguate absolute paths from similarly named path segments. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 21:16:45 +09:00
Ophestra	38245559dc	container/ops: mount dev readonly ... There is usually no good reason to write to /dev. This however doesn't work in internal/app because FilesystemConfig supplied by ContainerConfig might add entries to /dev, so internal/app follows DevWritable with Remount instead. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 19:18:53 +09:00
Ophestra	7b416d47dc	container/ops: merge mqueue and dev Ops ... There is no reason to mount mqueue anywhere else, and these Ops usually follow each other. This change merges them. This helps decrease IPC overhead and also enables mounting dev readonly. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-03 19:13:46 +09:00
Ophestra	b32b1975a8	hst/container: remove cover ... This was never useful, and is now completely replaced by regular FilesystemConfig being able to mount tmpfs. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-02 00:34:52 +09:00
Ophestra	3b8a3d3b00	app: remount root readonly ... This does nothing for security, but should help avoid hiding bugs of programs developed in a hakurei container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 23:56:28 +09:00
Ophestra	af0899de96	hst/container: mount tmpfs via magic src string ... There's often good reason to mount tmpfs in the container. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 21:23:52 +09:00
Ophestra	387b86bcdd	app: integrate container autoroot ... Doing this instead of mounting directly on / because it's impossible to ensure a parent is available for every path hakurei wants to mount to. This situation is similar to autoetc hence the similar name, however a symlink mirror will not work in this case. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-08-01 04:21:54 +09:00
Ophestra	f7bd28118c	hst: configurable wait delay ... This is useful for programs that take a long time to clean up. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-29 03:06:49 +09:00
Ophestra	b43d104680	app: integrate interrupt forwarding ... This significantly increases usability of command line tools running through hakurei. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-29 02:23:06 +09:00
Ophestra	ddf48a6c22	app/shim: implement signal handler outcome in Go ... This needs to be done from the Go side eventually anyway to integrate the signal forwarding behaviour now supported by the container package. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 23:39:30 +09:00
Ophestra	a0f499e30a	app/shim: separate signal handler implementation ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-28 21:52:53 +09:00
Ophestra	087959e81b	app: remove split implementation ... It is completely nonsensical and highly error-prone to have multiple implementations of this in the same build. This should be switched at compile time instead therefore the split packages are pointless. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 04:36:59 +09:00
Ophestra	d2f9a9b83b	treewide: migrate to hakurei.app ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 03:30:39 +09:00
Ophestra	1b5ecd9eaf	container: move out of toplevel ... This allows slightly easier use of the vanity url. This also provides some disambiguation between low level containers and hakurei app containers. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-03 02:59:43 +09:00
Ophestra	a1d98823f8	hakurei: move container toplevel ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 21:23:55 +09:00
Ophestra	eb22a8bcc1	cmd/hakurei: move to cmd ... Having it at the project root never made sense since the "ego" name was deprecated. This change finally addresses it. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 20:42:51 +09:00
Ophestra	31aef905fa	sandbox: expose seccomp interface ... There's no point in artificially limiting and abstracting away these options. The higher level hakurei package is responsible for providing a secure baseline and sane defaults. The sandbox package should present everything to the caller. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 04:47:13 +09:00
Ophestra	d5532aade0	sandbox/seccomp: native rule slice in helpers ... These helper functions took FilterPreset as input for ease of integration. This moves them to []NativeRule. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-02 00:22:27 +09:00
Ophestra	1a8840bebc	sandbox/seccomp: resolve rules natively ... This enables loading syscall filter policies from external cross-platform config files. This also removes a significant amount of C code. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-07-01 22:11:32 +09:00
Ophestra	972f4006f0	treewide: switch to hakurei.app ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-26 04:01:02 +09:00
Ophestra	aa454b158f	cmd/planterette: remove hsu special case ... Remove special case and invoke hakurei out of process. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 20:50:24 +09:00
Ophestra	87e008d56d	treewide: rename to hakurei ... Fortify makes little sense for a container tool. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-25 04:57:41 +09:00
Ophestra	717771ae80	app: share runtime dir ... This allows apps with the same identity to access the same runtime dir. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-06-08 03:24:48 +09:00
Ophestra	15011c4173	app/instance/common: optimise ops allocation ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-13 03:49:07 +09:00
Ophestra	31b7ddd122	fst: improve config ... The config struct more or less "grew" to what it is today. This change moves things around to make more sense and fixes nonsensical comments describing obsolete behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-13 03:30:19 +09:00
Ophestra	6309469e93	app/instance: wrap internal implementation ... This reduces the scope of the fst package, which was growing questionably large. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-12 13:56:41 +09:00
Ophestra	0d7c1a9a43	app: rename app implementation package ... Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-12 10:54:24 +09:00
Ophestra	9967909460	sandbox: relative autoetc links ... This allows nested containers to use autoetc, and increases compatibility with other implementations. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-11 18:54:00 +09:00
Ophestra	c806f43881	sandbox: implement autoetc as setup op ... This significantly reduces setup op count and the readdir call now happens in the context of the init process. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-10 18:54:25 +09:00
Ophestra	584405f7cc	sandbox/seccomp: rename flag type and constants ... The names are ambiguous. Rename them to make more sense. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-08 01:59:45 +09:00
Ophestra	74ba183256	app: install seccomp filter to shim ... This does not necessarily reduce attack surface but does not affect functionality or introduce any side effects, so is nice to have. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-07 04:13:08 +09:00
Ophestra	e9a7cd526f	app: improve shim process management ... This ensures a signal gets delivered to the process instead of relying on parent death behaviour. SIGCONT was chosen as it is the only signal an unprivileged process is allowed to send to processes with different credentials. A custom signal handler is installed because the Go runtime does not expose signal information other than which signal was received, and shim must check pid to ensure reasonable behaviour. Signed-off-by: Ophestra <cat@gensokyo.uk>	2025-04-07 03:55:17 +09:00