mirror of
https://github.com/keyboardio/Chrysalis.git
synced 2026-02-28 19:07:17 +01:00
c406f6cff8
On Linux, sandboxing requires either a suid root helper (which we can't ship in the AppImage build), running as root (which is something we'd rather avoid), or unprivileged user namespace cloning (which is only available on more recent kernels). Since we do not want to run as root, and we'd like users to run Chrysalis without having to explicitly pass arguments to it, on Linux, we wrap the launcher. The wrapper checks for the necessary kernel feature, and disables the sandbox if the feature is not available. This is still a better and safer experience than running as root, or than the user having to explicitly run Chrysalis with `--no-sandbox`. This is only done on Linux, and only for the AppImage build. Running `yarn run start` will still require the extra flag. Fixes #499. Signed-off-by: Gergely Nagy <algernon@keyboard.io>
31 lines
858 B
JavaScript
31 lines
858 B
JavaScript
const path = require('path');
|
|
const fs = require('fs');
|
|
const util = require('util');
|
|
|
|
const renameAsync = util.promisify(fs.rename);
|
|
const unlinkAsync = util.promisify(fs.unlink);
|
|
|
|
module.exports = async function(context) {
|
|
// Replace the app launcher on linux only.
|
|
if (process.platform !== 'linux') {
|
|
return;
|
|
}
|
|
|
|
const executableName = context.packager.executableName;
|
|
const sourceExecutable = path.join(context.appOutDir, executableName);
|
|
const targetExecutable = path.join(context.appOutDir, `${executableName}-bin`);
|
|
const launcherScript = path.join(
|
|
context.appOutDir,
|
|
'resources',
|
|
'launcher.sh'
|
|
);
|
|
|
|
return Promise.all([
|
|
// rename chrysalis to chrysalis-bin
|
|
renameAsync(sourceExecutable, targetExecutable),
|
|
|
|
// rename launcher script to chrysalis
|
|
renameAsync(launcherScript, sourceExecutable)
|
|
]);
|
|
};
|