security
/
fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

shim: update payload comment 

Generating permissive default no longer happens in shim.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra Umiker 2024-10-13 17:19:50 +09:00
parent 77f2c320a6
commit 3739b56504
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
2 changed files with 4 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
internal/shim/main.go
View File

@ -18,7 +18,7 @@ import (
// everything beyond this point runs as target user // everything beyond this point runs as target user
// proceed with caution! // proceed with caution!
func shim(socket string) { func doShim(socket string) {
// re-exec // re-exec
if len(os.Args) > 0 && os.Args[0] != "fortify" && path.IsAbs(os.Args[0]) { if len(os.Args) > 0 && os.Args[0] != "fortify" && path.IsAbs(os.Args[0]) {
if err := syscall.Exec(os.Args[0], []string{"fortify", "shim"}, os.Environ()); err != nil { if err := syscall.Exec(os.Args[0], []string{"fortify", "shim"}, os.Environ()); err != nil {
@ -163,7 +163,7 @@ func receiveWLfd(conn *net.UnixConn) (int, error) {
func Try() { func Try() {
if args := flag.Args(); len(args) == 1 && args[0] == "shim" { if args := flag.Args(); len(args) == 1 && args[0] == "shim" {
if s, ok := os.LookupEnv(EnvShim); ok { if s, ok := os.LookupEnv(EnvShim); ok {
shim(s) doShim(s)
panic("unreachable") panic("unreachable")
} }
} }

6
internal/shim/payload.go
View File

@ -1,8 +1,6 @@
package shim package shim
import ( import "git.ophivana.moe/cat/fortify/helper/bwrap"
"git.ophivana.moe/cat/fortify/helper/bwrap"
)
const EnvShim = "FORTIFY_SHIM" const EnvShim = "FORTIFY_SHIM"
@ -11,7 +9,7 @@ type Payload struct {
Argv []string Argv []string
// bwrap, target full exec path // bwrap, target full exec path
Exec [2]string Exec [2]string
// bwrap config, nil for permissive // bwrap config
Bwrap *bwrap.Config Bwrap *bwrap.Config
// whether to pass wayland fd // whether to pass wayland fd
WL bool WL bool