Skip to content
Snippets Groups Projects
Commit 1e7e83c9 authored by Simon McVittie's avatar Simon McVittie
Browse files

pressure-vessel: Add experimental code path for Flatpak sub-sandboxing


This is experimental and subject to change. It requires branches of
Flatpak that have not yet been reviewed or merged, so it's guarded
by (deliberately undocumented) environment variables by default.
Only enable this if you are a pressure-vessel developer and know
precisely what you're doing.

This feature also requires a non-setuid bwrap executable, and a kernel
that allows the non-setuid bwrap to create new user namespaces.
Fedora, Ubuntu, Debian >= 11, and Arch Linux's default kernel are
examples of systems that should be OK; Debian <= 10, SteamOS 2, and
Arch Linux's linux-hardened are not.

I'm landing this despite its experimental status because leaving it in
a branch means we have to rebase it all the time, which just slows
us down.

Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
parent 0031fb8b
No related branches found
No related tags found
1 merge request!203pressure-vessel: Add experimental code path for Flatpak sub-sandboxing
......@@ -1789,6 +1789,7 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self,
RuntimeArchitecture *arch)
{
const gchar *ld_library_path;
g_autofree gchar *remap_app = NULL;
g_autofree gchar *remap_usr = NULL;
g_autofree gchar *remap_lib = NULL;
FlatpakBwrap *ret;
......@@ -1803,6 +1804,11 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self,
if (ld_library_path != NULL)
flatpak_bwrap_set_env (ret, "LD_LIBRARY_PATH", ld_library_path, TRUE);
/* Every symlink that starts with exactly /app/ (for Flatpak) */
remap_app = g_strjoin (NULL, "/app/", "=",
self->provider_in_container_namespace,
"/app/", NULL);
/* Every symlink that starts with exactly /usr/ */
remap_usr = g_strjoin (NULL, "/usr/", "=",
self->provider_in_container_namespace,
......@@ -1816,6 +1822,7 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self,
flatpak_bwrap_add_args (ret,
arch->capsule_capture_libs,
"--container", self->container_access,
"--remap-link-prefix", remap_app,
"--remap-link-prefix", remap_usr,
"--remap-link-prefix", remap_lib,
"--provider",
......@@ -4661,3 +4668,11 @@ pv_runtime_initable_iface_init (GInitableIface *iface,
{
iface->init = pv_runtime_initable_init;
}
const char *
pv_runtime_get_modified_usr (PvRuntime *self)
{
g_return_val_if_fail (PV_IS_RUNTIME (self), NULL);
g_return_val_if_fail (self->mutable_sysroot != NULL, NULL);
return self->runtime_usr;
}
......@@ -95,6 +95,7 @@ gboolean pv_runtime_bind (PvRuntime *self,
FlatpakBwrap *bwrap,
PvEnviron *container_env,
GError **error);
const char *pv_runtime_get_modified_usr (PvRuntime *self);
void pv_runtime_cleanup (PvRuntime *self);
gboolean pv_runtime_garbage_collect_legacy (const char *variable_dir,
......
This diff is collapsed.
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment