app

Documentation

Index

• Variables
• type App
  • func New(os linux.System) (App, error)
• type Config
  • func Template() *Config
• type ConfinementConfig
• type FilesystemConfig
• type ID
  • func (a *ID) String() string
• type RevertCompoundError
• type SandboxConfig
  • func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error)
• type StateStoreError
  • func (e *StateStoreError) Error() string
  • func (e *StateStoreError) Unwrap() (errs []error)

Variables

var (
	ErrConfig = errors.New("no configuration to seal")
	ErrUser   = errors.New("invalid aid")
	ErrHome   = errors.New("invalid home directory")
	ErrName   = errors.New("invalid username")
)

var (
	ErrWayland  = errors.New(waylandDisplay + " unset")
	ErrXDisplay = errors.New(display + " unset")
)

var (
	ErrPulseCookie = errors.New("pulse cookie not present")
	ErrPulseSocket = errors.New("pulse socket not present")
	ErrPulseMode   = errors.New("unexpected pulse socket mode")
)

Types

type App

type App interface {
	// ID returns a copy of App's unique ID.
	ID() ID
	// Start sets up the system and starts the App.
	Start() error
	// Wait waits for App's process to exit and reverts system setup.
	Wait() (int, error)
	// WaitErr returns error returned by the underlying wait syscall.
	WaitErr() error

	Seal(config *Config) error
	String() string
}

func New

func New(os linux.System) (App, error)

type Config

type Config struct {
	// D-Bus application ID
	ID string `json:"id"`
	// value passed through to the child process as its argv
	Command []string `json:"command"`

	// child confinement configuration
	Confinement ConfinementConfig `json:"confinement"`
}

Config is used to seal an *App

func Template

func Template() *Config

Template returns a fully populated instance of Config.

type ConfinementConfig

type ConfinementConfig struct {
	// numerical application id, determines uid in the init namespace
	AppID int `json:"app_id"`
	// list of supplementary groups to inherit
	Groups []string `json:"groups"`
	// passwd username in the sandbox, defaults to chronos
	Username string `json:"username,omitempty"`
	// home directory in sandbox, empty for outer
	Inner string `json:"home_inner"`
	// home directory in init namespace
	Outer string `json:"home"`
	// bwrap sandbox confinement configuration
	Sandbox *SandboxConfig `json:"sandbox"`

	// reference to a system D-Bus proxy configuration,
	// nil value disables system bus proxy
	SystemBus *dbus.Config `json:"system_bus,omitempty"`
	// reference to a session D-Bus proxy configuration,
	// nil value makes session bus proxy assume built-in defaults
	SessionBus *dbus.Config `json:"session_bus,omitempty"`

	// child capability enablements
	Enablements system.Enablements `json:"enablements"`
}

ConfinementConfig defines fortified child's confinement

type FilesystemConfig

type FilesystemConfig struct {
	// mount point in sandbox, same as src if empty
	Dst string `json:"dst,omitempty"`
	// host filesystem path to make available to sandbox
	Src string `json:"src"`
	// write access
	Write bool `json:"write,omitempty"`
	// device access
	Device bool `json:"dev,omitempty"`
	// exit if unable to share
	Must bool `json:"require,omitempty"`
}

type ID

type ID [16]byte

func (*ID) String

func (a *ID) String() string

type RevertCompoundError

type RevertCompoundError interface {
	Error() string
	Unwrap() []error
}

type SandboxConfig

type SandboxConfig struct {
	// unix hostname within sandbox
	Hostname string `json:"hostname,omitempty"`
	// userns availability within sandbox
	UserNS bool `json:"userns,omitempty"`
	// share net namespace
	Net bool `json:"net,omitempty"`
	// share all devices
	Dev bool `json:"dev,omitempty"`
	// do not run in new session
	NoNewSession bool `json:"no_new_session,omitempty"`
	// map target user uid to privileged user uid in the user namespace
	MapRealUID bool `json:"map_real_uid"`
	// mediated access to wayland socket
	Wayland bool `json:"wayland,omitempty"`

	// final environment variables
	Env map[string]string `json:"env"`
	// sandbox host filesystem access
	Filesystem []*FilesystemConfig `json:"filesystem"`
	// symlinks created inside the sandbox
	Link [][2]string `json:"symlink"`
	// automatically set up /etc symlinks
	AutoEtc bool `json:"auto_etc"`
	// paths to override by mounting tmpfs over them
	Override []string `json:"override"`
}

SandboxConfig describes resources made available to the sandbox.

func (*SandboxConfig) Bwrap

func (s *SandboxConfig) Bwrap(os linux.System) (*bwrap.Config, error)

Bwrap returns the address of the corresponding bwrap.Config to s. Note that remaining tmpfs entries must be queued by the caller prior to launch.

type StateStoreError

type StateStoreError struct {
	// whether inner function was called
	Inner bool
	// error returned by state.Store Do method
	DoErr error
	// error returned by state.Backend Save method
	InnerErr error
	// any other errors needing to be tracked
	Err error
}

StateStoreError is returned for a failed state save

func (*StateStoreError) Error

func (e *StateStoreError) Error() string

func (*StateStoreError) Unwrap

func (e *StateStoreError) Unwrap() (errs []error)