Skip to content
Snippets Groups Projects
Commit 1f4985a6 authored by Simon McVittie's avatar Simon McVittie
Browse files

Merge branch 'wip/flatpak' into 'master'

pressure-vessel: Add experimental code path for Flatpak sub-sandboxing

See merge request !203
parents e7fbf19e 6deea16f
No related branches found
No related tags found
1 merge request!203pressure-vessel: Add experimental code path for Flatpak sub-sandboxing
Pipeline #9595 passed
...@@ -128,11 +128,17 @@ G_DEFINE_TYPE_WITH_CODE (PvRuntime, pv_runtime, G_TYPE_OBJECT, ...@@ -128,11 +128,17 @@ G_DEFINE_TYPE_WITH_CODE (PvRuntime, pv_runtime, G_TYPE_OBJECT,
* that /etc/ld.so.cache, etc., are not shared. * that /etc/ld.so.cache, etc., are not shared.
*/ */
static gboolean static gboolean
path_visible_in_provider_namespace (const char *path) path_visible_in_provider_namespace (PvRuntimeFlags flags,
const char *path)
{ {
while (path[0] == '/') while (path[0] == '/')
path++; path++;
if ((flags & PV_RUNTIME_FLAGS_FLATPAK_SUBSANDBOX)
&& g_str_has_prefix (path, "app")
&& (path[3] == '\0' || path[3] == '/'))
return TRUE;
if (g_str_has_prefix (path, "usr") && if (g_str_has_prefix (path, "usr") &&
(path[3] == '\0' || path[3] == '/')) (path[3] == '\0' || path[3] == '/'))
return TRUE; return TRUE;
...@@ -1789,6 +1795,7 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self, ...@@ -1789,6 +1795,7 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self,
RuntimeArchitecture *arch) RuntimeArchitecture *arch)
{ {
const gchar *ld_library_path; const gchar *ld_library_path;
g_autofree gchar *remap_app = NULL;
g_autofree gchar *remap_usr = NULL; g_autofree gchar *remap_usr = NULL;
g_autofree gchar *remap_lib = NULL; g_autofree gchar *remap_lib = NULL;
FlatpakBwrap *ret; FlatpakBwrap *ret;
...@@ -1803,6 +1810,11 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self, ...@@ -1803,6 +1810,11 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self,
if (ld_library_path != NULL) if (ld_library_path != NULL)
flatpak_bwrap_set_env (ret, "LD_LIBRARY_PATH", ld_library_path, TRUE); flatpak_bwrap_set_env (ret, "LD_LIBRARY_PATH", ld_library_path, TRUE);
/* Every symlink that starts with exactly /app/ (for Flatpak) */
remap_app = g_strjoin (NULL, "/app/", "=",
self->provider_in_container_namespace,
"/app/", NULL);
/* Every symlink that starts with exactly /usr/ */ /* Every symlink that starts with exactly /usr/ */
remap_usr = g_strjoin (NULL, "/usr/", "=", remap_usr = g_strjoin (NULL, "/usr/", "=",
self->provider_in_container_namespace, self->provider_in_container_namespace,
...@@ -1816,6 +1828,7 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self, ...@@ -1816,6 +1828,7 @@ pv_runtime_get_capsule_capture_libs (PvRuntime *self,
flatpak_bwrap_add_args (ret, flatpak_bwrap_add_args (ret,
arch->capsule_capture_libs, arch->capsule_capture_libs,
"--container", self->container_access, "--container", self->container_access,
"--remap-link-prefix", remap_app,
"--remap-link-prefix", remap_usr, "--remap-link-prefix", remap_usr,
"--remap-link-prefix", remap_lib, "--remap-link-prefix", remap_lib,
"--provider", "--provider",
...@@ -2574,7 +2587,7 @@ pv_runtime_take_from_provider (PvRuntime *self, ...@@ -2574,7 +2587,7 @@ pv_runtime_take_from_provider (PvRuntime *self,
/* If it isn't in /usr, /lib, etc., then the symlink will be /* If it isn't in /usr, /lib, etc., then the symlink will be
* dangling and this probably isn't going to work. */ * dangling and this probably isn't going to work. */
if (!path_visible_in_provider_namespace (source_in_provider)) if (!path_visible_in_provider_namespace (self->flags, source_in_provider))
{ {
if (flags & TAKE_FROM_PROVIDER_FLAGS_COPY_FALLBACK) if (flags & TAKE_FROM_PROVIDER_FLAGS_COPY_FALLBACK)
{ {
...@@ -4496,6 +4509,17 @@ pv_runtime_bind (PvRuntime *self, ...@@ -4496,6 +4509,17 @@ pv_runtime_bind (PvRuntime *self,
g_return_val_if_fail (container_env != NULL, FALSE); g_return_val_if_fail (container_env != NULL, FALSE);
g_return_val_if_fail (error == NULL || *error == NULL, FALSE); g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
if (self->flags & PV_RUNTIME_FLAGS_FLATPAK_SUBSANDBOX)
{
g_return_val_if_fail (exports == NULL, FALSE);
g_return_val_if_fail (bwrap == NULL, FALSE);
}
else
{
g_return_val_if_fail (exports != NULL, FALSE);
g_return_val_if_fail (bwrap != NULL, FALSE);
}
if (bwrap != NULL if (bwrap != NULL
&& !bind_runtime_base (self, bwrap, container_env, error)) && !bind_runtime_base (self, bwrap, container_env, error))
return FALSE; return FALSE;
...@@ -4661,3 +4685,11 @@ pv_runtime_initable_iface_init (GInitableIface *iface, ...@@ -4661,3 +4685,11 @@ pv_runtime_initable_iface_init (GInitableIface *iface,
{ {
iface->init = pv_runtime_initable_init; iface->init = pv_runtime_initable_init;
} }
const char *
pv_runtime_get_modified_usr (PvRuntime *self)
{
g_return_val_if_fail (PV_IS_RUNTIME (self), NULL);
g_return_val_if_fail (self->mutable_sysroot != NULL, NULL);
return self->runtime_usr;
}
...@@ -40,6 +40,8 @@ ...@@ -40,6 +40,8 @@
* @PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS: Include host Vulkan layers * @PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS: Include host Vulkan layers
* @PV_RUNTIME_FLAGS_COPY_RUNTIME: Copy the runtime and modify the copy * @PV_RUNTIME_FLAGS_COPY_RUNTIME: Copy the runtime and modify the copy
* @PV_RUNTIME_FLAGS_UNPACK_ARCHIVE: Source is an archive, not a deployment * @PV_RUNTIME_FLAGS_UNPACK_ARCHIVE: Source is an archive, not a deployment
* @PV_RUNTIME_FLAGS_FLATPAK_SUBSANDBOX: The runtime will be used in a
* Flatpak subsandbox
* @PV_RUNTIME_FLAGS_NONE: None of the above * @PV_RUNTIME_FLAGS_NONE: None of the above
* *
* Flags affecting how we set up the runtime. * Flags affecting how we set up the runtime.
...@@ -53,6 +55,7 @@ typedef enum ...@@ -53,6 +55,7 @@ typedef enum
PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS = (1 << 4), PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS = (1 << 4),
PV_RUNTIME_FLAGS_COPY_RUNTIME = (1 << 5), PV_RUNTIME_FLAGS_COPY_RUNTIME = (1 << 5),
PV_RUNTIME_FLAGS_UNPACK_ARCHIVE = (1 << 6), PV_RUNTIME_FLAGS_UNPACK_ARCHIVE = (1 << 6),
PV_RUNTIME_FLAGS_FLATPAK_SUBSANDBOX = (1 << 7),
PV_RUNTIME_FLAGS_NONE = 0 PV_RUNTIME_FLAGS_NONE = 0
} PvRuntimeFlags; } PvRuntimeFlags;
...@@ -64,6 +67,7 @@ typedef enum ...@@ -64,6 +67,7 @@ typedef enum
| PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS \ | PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS \
| PV_RUNTIME_FLAGS_COPY_RUNTIME \ | PV_RUNTIME_FLAGS_COPY_RUNTIME \
| PV_RUNTIME_FLAGS_UNPACK_ARCHIVE \ | PV_RUNTIME_FLAGS_UNPACK_ARCHIVE \
| PV_RUNTIME_FLAGS_FLATPAK_SUBSANDBOX \
) )
typedef struct _PvRuntime PvRuntime; typedef struct _PvRuntime PvRuntime;
...@@ -95,6 +99,7 @@ gboolean pv_runtime_bind (PvRuntime *self, ...@@ -95,6 +99,7 @@ gboolean pv_runtime_bind (PvRuntime *self,
FlatpakBwrap *bwrap, FlatpakBwrap *bwrap,
PvEnviron *container_env, PvEnviron *container_env,
GError **error); GError **error);
const char *pv_runtime_get_modified_usr (PvRuntime *self);
void pv_runtime_cleanup (PvRuntime *self); void pv_runtime_cleanup (PvRuntime *self);
gboolean pv_runtime_garbage_collect_legacy (const char *variable_dir, gboolean pv_runtime_garbage_collect_legacy (const char *variable_dir,
......
This diff is collapsed.
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment