fst

Documentation

Overview

Package fst exports shared fortify types.

Index

• Constants
• Variables
• func NewAppID(id *ID) error
• func ParseAppID(id *ID, s string) error
• type App
• type Config
  • func Template() *Config
• type ConfinementConfig
• type ExtraPermConfig
  • func (e *ExtraPermConfig) String() string
• type FilesystemConfig
• type ID
  • func (a *ID) String() string
• type Info
• type Paths
• type RunState
• type SandboxConfig
  • func (s *SandboxConfig) Bwrap(sys SandboxSys, uid *int) (*bwrap.Config, error)
• type SandboxSys

Constants

const Tmp = "/.fortify"

Variables

var (
	ErrInvalidLength = errors.New("string representation must have a length of 32")
)

Functions

func NewAppID

func NewAppID(id *ID) error

func ParseAppID

func ParseAppID(id *ID, s string) error

Types

type App

type App interface {
	// ID returns a copy of App's unique ID.
	ID() ID
	// Run sets up the system and runs the App.
	Run(ctx context.Context, rs *RunState) error

	Seal(config *Config) error
	String() string
}

type Config

type Config struct {
	// reverse-DNS style arbitrary identifier string from config;
	// passed to wayland security-context-v1 as application ID
	// and used as part of defaults in dbus session proxy
	ID string `json:"id"`
	// final argv, passed to init
	Command []string `json:"command"`

	Confinement ConfinementConfig `json:"confinement"`
}

Config is used to seal an app

func Template

func Template() *Config

Template returns a fully populated instance of Config.

type ConfinementConfig

type ConfinementConfig struct {
	// numerical application id, determines uid in the init namespace
	AppID int `json:"app_id"`
	// list of supplementary groups to inherit
	Groups []string `json:"groups"`
	// passwd username in the sandbox, defaults to passwd name of target uid or chronos
	Username string `json:"username,omitempty"`
	// home directory in sandbox, empty for outer
	Inner string `json:"home_inner"`
	// home directory in init namespace
	Outer string `json:"home"`
	// bwrap sandbox confinement configuration
	Sandbox *SandboxConfig `json:"sandbox"`
	// extra acl ops, runs after everything else
	ExtraPerms []*ExtraPermConfig `json:"extra_perms,omitempty"`

	// reference to a system D-Bus proxy configuration,
	// nil value disables system bus proxy
	SystemBus *dbus.Config `json:"system_bus,omitempty"`
	// reference to a session D-Bus proxy configuration,
	// nil value makes session bus proxy assume built-in defaults
	SessionBus *dbus.Config `json:"session_bus,omitempty"`

	// system resources to expose to the sandbox
	Enablements system.Enablements `json:"enablements"`
}

ConfinementConfig defines fortified child's confinement

type ExtraPermConfig

type ExtraPermConfig struct {
	Ensure  bool   `json:"ensure,omitempty"`
	Path    string `json:"path"`
	Read    bool   `json:"r,omitempty"`
	Write   bool   `json:"w,omitempty"`
	Execute bool   `json:"x,omitempty"`
}

func (*ExtraPermConfig) String

func (e *ExtraPermConfig) String() string

type FilesystemConfig

type FilesystemConfig struct {
	// mount point in sandbox, same as src if empty
	Dst string `json:"dst,omitempty"`
	// host filesystem path to make available to sandbox
	Src string `json:"src"`
	// write access
	Write bool `json:"write,omitempty"`
	// device access
	Device bool `json:"dev,omitempty"`
	// fail if mount fails
	Must bool `json:"require,omitempty"`
}

type ID

type ID [16]byte

func (*ID) String

func (a *ID) String() string

type Info

type Info struct {
	User int `json:"user"`
}

type Paths

type Paths struct {
	// path to shared directory (usually `/tmp/fortify.%d`)
	SharePath string `json:"share_path"`
	// XDG_RUNTIME_DIR value (usually `/run/user/%d`)
	RuntimePath string `json:"runtime_path"`
	// application runtime directory (usually `/run/user/%d/fortify`)
	RunDirPath string `json:"run_dir_path"`
}

Paths contains environment-dependent paths used by fortify.

type RunState

type RunState struct {
	// Time is the exact point in time where the process was created.
	// Location must be set to UTC.
	//
	// Time is nil if no process was ever created.
	Time *time.Time
	// ExitCode is the value returned by shim.
	ExitCode int
	// RevertErr is stored by the deferred revert call.
	RevertErr error
	// WaitErr is error returned by the underlying wait syscall.
	WaitErr error
}

RunState stores the outcome of a call to [App.Run].

type SandboxConfig

type SandboxConfig struct {
	// unix hostname within sandbox
	Hostname string `json:"hostname,omitempty"`
	// allow userns within sandbox
	UserNS bool `json:"userns,omitempty"`
	// share net namespace
	Net bool `json:"net,omitempty"`
	// share all devices
	Dev bool `json:"dev,omitempty"`
	// seccomp syscall filter policy
	Syscall *bwrap.SyscallPolicy `json:"syscall"`
	// do not run in new session
	NoNewSession bool `json:"no_new_session,omitempty"`
	// map target user uid to privileged user uid in the user namespace
	MapRealUID bool `json:"map_real_uid"`
	// direct access to wayland socket; when this gets set no attempt is made to attach security-context-v1
	// and the bare socket is mounted to the sandbox
	DirectWayland bool `json:"direct_wayland,omitempty"`

	// final environment variables
	Env map[string]string `json:"env"`
	// sandbox host filesystem access
	Filesystem []*FilesystemConfig `json:"filesystem"`
	// symlinks created inside the sandbox
	Link [][2]string `json:"symlink"`
	// read-only /etc directory
	Etc string `json:"etc,omitempty"`
	// automatically set up /etc symlinks
	AutoEtc bool `json:"auto_etc"`
	// mount tmpfs over these paths,
	// runs right before [ConfinementConfig.ExtraPerms]
	Override []string `json:"override"`
}

SandboxConfig describes resources made available to the sandbox.

func (*SandboxConfig) Bwrap

func (s *SandboxConfig) Bwrap(sys SandboxSys, uid *int) (*bwrap.Config, error)

Bwrap returns the address of the corresponding bwrap.Config to s. Note that remaining tmpfs entries must be queued by the caller prior to launch.

type SandboxSys

type SandboxSys interface {
	Geteuid() int
	Paths() Paths
	ReadDir(name string) ([]fs.DirEntry, error)
	EvalSymlinks(path string) (string, error)

	Println(v ...any)
	Printf(format string, v ...any)
}

SandboxSys encapsulates system functions used during the creation of bwrap.Config.