pressure-vessel: Add experimental code path for Flatpak sub-sandboxing
This is experimental and subject to change. It requires branches of
Flatpak that have not yet been reviewed or merged, so it's guarded
by (deliberately undocumented) environment variables by default.
Only enable this if you are a pressure-vessel developer and know
precisely what you're doing.
This feature also requires a non-setuid bwrap executable, and a kernel
that allows the non-setuid bwrap to create new user namespaces.
Fedora, Ubuntu, Debian >= 11, and Arch Linux's default kernel are
examples of systems that should be OK; Debian <= 10, SteamOS 2, and
Arch Linux's linux-hardened are not.
I'm landing this despite its experimental status because leaving it in
a branch means we have to rebase it all the time, which just slows
us down.
Signed-off-by:
Simon McVittie <smcv@collabora.com>
parent
0031fb8b
No related branches found
No related tags found
This diff is collapsed.
Please register or sign in to comment