security
/
fortify
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 14 Wiki Activity

app/config: rename map_real_uid from use_real_uid
test / test (push) Successful in 19s Details 

This option only changes mapped uid in the user namespace.

Signed-off-by: Ophestra Umiker <cat@ophivana.moe>
This commit is contained in:
Ophestra Umiker 2024-11-09 11:57:36 +09:00
parent 45fead18c3
commit 9a13b311ac
Signed by: cat
SSH Key Fingerprint: SHA256:gQ67O0enBZ7UdZypgtspB2FDM1g3GVw8nX0XSdcFw8Q
3 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
internal/app/config.go
View File

@ -55,7 +55,7 @@ type SandboxConfig struct {
// do not run in new session // do not run in new session
NoNewSession bool `json:"no_new_session,omitempty"` NoNewSession bool `json:"no_new_session,omitempty"`
// map target user uid to privileged user uid in the user namespace // map target user uid to privileged user uid in the user namespace
UseRealUID bool `json:"use_real_uid"` MapRealUID bool `json:"map_real_uid"`
// mediated access to wayland socket // mediated access to wayland socket
Wayland bool `json:"wayland,omitempty"` Wayland bool `json:"wayland,omitempty"`
@ -92,7 +92,7 @@ func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error) {
} }
var uid int var uid int
if !s.UseRealUID { if !s.MapRealUID {
uid = 65534 uid = 65534
} else { } else {
uid = os.Geteuid() uid = os.Geteuid()
@ -185,7 +185,7 @@ func Template() *Config {
UserNS: true, UserNS: true,
Net: true, Net: true,
NoNewSession: true, NoNewSession: true,
UseRealUID: true, MapRealUID: true,
Dev: true, Dev: true,
Wayland: false, Wayland: false,
// example API credentials pulled from Google Chrome // example API credentials pulled from Google Chrome

2
internal/app/seal.go
View File

@ -130,7 +130,7 @@ func (a *app) Seal(config *Config) error {
seal.sys = new(appSealSys) seal.sys = new(appSealSys)
// mapped uid // mapped uid
if config.Confinement.Sandbox != nil && config.Confinement.Sandbox.UseRealUID { if config.Confinement.Sandbox != nil && config.Confinement.Sandbox.MapRealUID {
seal.sys.mappedID = a.os.Geteuid() seal.sys.mappedID = a.os.Geteuid()
} else { } else {
seal.sys.mappedID = 65534 seal.sys.mappedID = 65534

4
nixos.nix
View File

@ -130,7 +130,7 @@ in
Whether to allow userns within sandbox. Whether to allow userns within sandbox.
''; '';
useRealUid = mkEnableOption '' mapRealUid = mkEnableOption ''
Whether to map to fortify's real UID within the sandbox. Whether to map to fortify's real UID within the sandbox.
''; '';
@ -330,7 +330,7 @@ in
dev dev
env env
; ;
use_real_uid = launcher.useRealUid; map_real_uid = launcher.mapRealUid;
filesystem = filesystem =
[ [
{ src = "/bin"; } { src = "/bin"; }