Skip to content
Snippets Groups Projects
  • Simon McVittie's avatar
    13946a0c
    pv-wrap: Try harder to get the initial LD_LIBRARY_PATH into pv-adverb · 13946a0c
    Simon McVittie authored
    
    If bwrap is setuid root, we were previously pushing LD_LIBRARY_PATH
    into it via bwrap --setenv, but it turns out that doesn't actually work:
    the fact that bwrap is setuid means that the environment variable won't
    stick. The result is that pv-adverb doesn't have the host system's glibc
    in its library search path and can't start.
    
    We can avoid this problem by using ld.so(8) to invoke pv-adverb with a
    specified search path, and then telling pv-adverb to finish setting up
    the environment before it runs ldconfig(8) to regenerate the ld.so.cache.
    
    Instead of second-guessing which environment variables glibc is going
    to filter out in setuid executables, we just serialize all of them -
    with `--env-fd` there's no longer any real reason not to.
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
    13946a0c
    History
    pv-wrap: Try harder to get the initial LD_LIBRARY_PATH into pv-adverb
    Simon McVittie authored
    
    If bwrap is setuid root, we were previously pushing LD_LIBRARY_PATH
    into it via bwrap --setenv, but it turns out that doesn't actually work:
    the fact that bwrap is setuid means that the environment variable won't
    stick. The result is that pv-adverb doesn't have the host system's glibc
    in its library search path and can't start.
    
    We can avoid this problem by using ld.so(8) to invoke pv-adverb with a
    specified search path, and then telling pv-adverb to finish setting up
    the environment before it runs ldconfig(8) to regenerate the ld.so.cache.
    
    Instead of second-guessing which environment variables glibc is going
    to filter out in setuid executables, we just serialize all of them -
    with `--env-fd` there's no longer any real reason not to.
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>