All checks were successful
Test / Create distribution (push) Successful in 28s
Test / Sandbox (push) Successful in 42s
Test / Hakurei (push) Successful in 3m20s
Test / Hpkg (push) Successful in 2m13s
Test / Sandbox (race detector) (push) Successful in 4m25s
Test / Hakurei (race detector) (push) Successful in 3m21s
Test / Flake checks (push) Successful in 1m30s
This no longer exposes the pipewire socket to the container, and instead mediates access via pipewire-pulse. This makes insecure parts of the protocol inaccessible as explained in the doc comment in hst. Closes #29. Signed-off-by: Ophestra <cat@gensokyo.uk>
54 lines
1.5 KiB
Go
54 lines
1.5 KiB
Go
package outcome
|
|
|
|
import (
|
|
"encoding/gob"
|
|
|
|
"hakurei.app/container/check"
|
|
"hakurei.app/hst"
|
|
"hakurei.app/internal/pipewire"
|
|
)
|
|
|
|
const pipewirePulseName = "pipewire-pulse"
|
|
|
|
func init() { gob.Register(new(spPipeWireOp)) }
|
|
|
|
// spPipeWireOp exports the PipeWire server to the container via SecurityContext.
|
|
// Runs after spRuntimeOp.
|
|
type spPipeWireOp struct {
|
|
// Path to pipewire-pulse server. Populated during toSystem if DirectPipeWire is false.
|
|
CompatServerPath *check.Absolute
|
|
}
|
|
|
|
func (s *spPipeWireOp) toSystem(state *outcomeStateSys) error {
|
|
if state.et&hst.EPipeWire == 0 {
|
|
return errNotEnabled
|
|
}
|
|
if !state.directPipeWire {
|
|
if n, err := state.k.lookPath(pipewirePulseName); err != nil {
|
|
return &hst.AppError{Step: "look up " + pipewirePulseName, Err: err}
|
|
} else if s.CompatServerPath, err = check.NewAbs(n); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
|
|
appId := state.appId
|
|
if appId == "" {
|
|
// use instance ID in case app id is not set
|
|
appId = "app.hakurei." + state.id.String()
|
|
}
|
|
state.sys.PipeWire(state.instance().Append("pipewire"), appId, state.id.String())
|
|
return nil
|
|
}
|
|
|
|
func (s *spPipeWireOp) toContainer(state *outcomeStateParams) error {
|
|
if s.CompatServerPath == nil {
|
|
innerPath := state.runtimeDir.Append(pipewire.PW_DEFAULT_REMOTE)
|
|
state.env[pipewire.Remote] = innerPath.String()
|
|
state.params.Bind(state.instancePath().Append("pipewire"), innerPath, 0)
|
|
}
|
|
|
|
// pipewire-pulse behaviour implemented in shim.go
|
|
state.pipewirePulsePath = s.CompatServerPath
|
|
return nil
|
|
}
|