Skip to content
Snippets Groups Projects
  • Simon McVittie's avatar
    feb948ed
    wrap: Add the ability to unshare the pid namespace · feb948ed
    Simon McVittie authored
    This improves isolation between the host system and the game, and can
    be used in conjunction with bwrap's init/reaper process to make game
    termination fully reliable (unlike subreapers, killing the init process
    automatically kills the entire pid namespace).
    
    One major down-side of doing this is that if the game uses
    process-ID-oriented APIs, for example older versions of
    <https://github.com/FeralInteractive/gamemode
    
    >, then they will not
    work, because the process ID inside the container is not the same as
    the process ID outside the container.
    
    Unfortunately, Steam's own tracking of the processes that belong to a game
    is one of the process-ID-oriented APIs that this harms, so this branch
    does not unshare the pid namespace by default, only when requested. We
    can use this to test whether it can be done without breaking Steam;
    We will probably need to cope with separate pid namespaces if we create
    new containers from inside a Flatpak environment.
    
    Also add an option to unload the gameoverlayrenderer.so module, which
    is not acceptable for production use, but at least works around this
    well enough to unblock further testing.
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
    feb948ed
    History
    wrap: Add the ability to unshare the pid namespace
    Simon McVittie authored
    This improves isolation between the host system and the game, and can
    be used in conjunction with bwrap's init/reaper process to make game
    termination fully reliable (unlike subreapers, killing the init process
    automatically kills the entire pid namespace).
    
    One major down-side of doing this is that if the game uses
    process-ID-oriented APIs, for example older versions of
    <https://github.com/FeralInteractive/gamemode
    
    >, then they will not
    work, because the process ID inside the container is not the same as
    the process ID outside the container.
    
    Unfortunately, Steam's own tracking of the processes that belong to a game
    is one of the process-ID-oriented APIs that this harms, so this branch
    does not unshare the pid namespace by default, only when requested. We
    can use this to test whether it can be done without breaking Steam;
    We will probably need to cope with separate pid namespaces if we create
    new containers from inside a Flatpak environment.
    
    Also add an option to unload the gameoverlayrenderer.so module, which
    is not acceptable for production use, but at least works around this
    well enough to unblock further testing.
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>