security
/
fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

app/config: always use nobody UID within sandbox 

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra Umiker 2024-10-13 00:50:24 +09:00
parent f320dfc2ee
commit 655020eb5d
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
1 changed files with 3 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
internal/app/config.go
View File

@ -50,11 +50,8 @@ type SandboxConfig struct {
// mediated access to wayland socket // mediated access to wayland socket
Wayland bool `json:"wayland,omitempty"` Wayland bool `json:"wayland,omitempty"`
UID int `json:"uid,omitempty"`
GID int `json:"gid,omitempty"`
// final environment variables // final environment variables
Env map[string]string `json:"env"` Env map[string]string `json:"env"`
// sandbox host filesystem access // sandbox host filesystem access
Filesystem []*FilesystemConfig `json:"filesystem"` Filesystem []*FilesystemConfig `json:"filesystem"`
} }
@ -77,9 +74,12 @@ func (s *SandboxConfig) Bwrap() *bwrap.Config {
return nil return nil
} }
nobody := 65534
conf := &bwrap.Config{ conf := &bwrap.Config{
Net: s.Net, Net: s.Net,
UserNS: s.UserNS, UserNS: s.UserNS,
UID: &nobody,
GID: &nobody,
Hostname: s.Hostname, Hostname: s.Hostname,
Clearenv: true, Clearenv: true,
SetEnv: s.Env, SetEnv: s.Env,
@ -89,12 +89,6 @@ func (s *SandboxConfig) Bwrap() *bwrap.Config {
NewSession: !s.NoNewSession, NewSession: !s.NoNewSession,
DieWithParent: true, DieWithParent: true,
} }
if s.UID > 0 {
conf.UID = &s.UID
}
if s.GID > 0 {
conf.GID = &s.GID
}
for _, c := range s.Filesystem { for _, c := range s.Filesystem {
if c == nil { if c == nil {
@ -150,8 +144,6 @@ func Template() *Config {
Net: true, Net: true,
NoNewSession: true, NoNewSession: true,
Wayland: false, Wayland: false,
UID: 150,
GID: 101,
// example API credentials pulled from Google Chrome // example API credentials pulled from Google Chrome
// DO NOT USE THESE IN A REAL BROWSER // DO NOT USE THESE IN A REAL BROWSER
Env: map[string]string{ Env: map[string]string{