-
Simon McVittie authored
If bwrap is setuid root, we were previously pushing LD_LIBRARY_PATH into it via bwrap --setenv, but it turns out that doesn't actually work: the fact that bwrap is setuid means that the environment variable won't stick. The result is that pv-adverb doesn't have the host system's glibc in its library search path and can't start. We can avoid this problem by using ld.so(8) to invoke pv-adverb with a specified search path, and then telling pv-adverb to finish setting up the environment before it runs ldconfig(8) to regenerate the ld.so.cache. Instead of second-guessing which environment variables glibc is going to filter out in setuid executables, we just serialize all of them - with `--env-fd` there's no longer any real reason not to. Signed-off-by:
Simon McVittie <smcv@collabora.com>
Simon McVittie authoredIf bwrap is setuid root, we were previously pushing LD_LIBRARY_PATH into it via bwrap --setenv, but it turns out that doesn't actually work: the fact that bwrap is setuid means that the environment variable won't stick. The result is that pv-adverb doesn't have the host system's glibc in its library search path and can't start. We can avoid this problem by using ld.so(8) to invoke pv-adverb with a specified search path, and then telling pv-adverb to finish setting up the environment before it runs ldconfig(8) to regenerate the ld.so.cache. Instead of second-guessing which environment variables glibc is going to filter out in setuid executables, we just serialize all of them - with `--env-fd` there's no longer any real reason not to. Signed-off-by:
Simon McVittie <smcv@collabora.com>