From 242e8906a4ae2a6c36f08fe27c7dfb9e13af1666 Mon Sep 17 00:00:00 2001 From: Simon McVittie <smcv@collabora.com> Date: Thu, 11 Mar 2021 17:49:57 +0000 Subject: [PATCH] wrap: Put game-specific $HOME on bwrap command-line before exports This is how Flatpak behaves, and it's necessary to prevent the game-specific $HOME from being mounted over the top of some of the exports, preventing (for example) ~/.steam from being exposed to the container. We only do this for $HOME rather than completely reverting 3a8e939d, so that it won't be a regression for a symlink at /var/tmp. If the logical and physical paths to the real $HOME differ, we now also mount the game-specific $HOME onto the real $HOME's physical path, and replicate the logical path's symlinks in the container. This matches how Flatpak works, and avoids a similar regression. Fixes: 3a8e939d "pv-wrap: Delay --dir, etc. until after FlatpakExports are processed" Resolves: https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/issues/63 Signed-off-by: Simon McVittie <smcv@collabora.com> --- pressure-vessel/wrap.c | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c index 2f2cf85ad..0edada1ff 100644 --- a/pressure-vessel/wrap.c +++ b/pressure-vessel/wrap.c @@ -475,8 +475,18 @@ use_fake_home (FlatpakExports *exports, data2); } + /* If the logical path to real_home has a symlink among its ancestors + * (e.g. /home/user when /home -> var/home exists), make sure the + * symlink structure gets mirrored in the container */ + flatpak_exports_add_path_dir (exports, g_get_home_dir ()); + + /* Mount the fake home directory onto the physical path to real_home, + * so that it will not conflict with symlinks created by the exports. + * See also https://github.com/flatpak/flatpak/issues/1278 and + * Flatpak commit f1df5cb1 */ + flatpak_bwrap_add_bind_arg (bwrap, "--bind", fake_home, real_home); + flatpak_bwrap_add_args (bwrap, - "--bind", fake_home, real_home, "--bind", tmp, "/var/tmp", NULL); @@ -1296,6 +1306,7 @@ main (int argc, g_autoptr(PvEnviron) container_env = NULL; g_autoptr(FlatpakBwrap) bwrap = NULL; g_autoptr(FlatpakBwrap) bwrap_filesystem_arguments = NULL; + g_autoptr(FlatpakBwrap) bwrap_home_arguments = NULL; g_autoptr(FlatpakBwrap) argv_in_container = NULL; g_autoptr(FlatpakBwrap) final_argv = NULL; g_autoptr(FlatpakExports) exports = NULL; @@ -2090,7 +2101,9 @@ main (int argc, } else { - if (!use_fake_home (exports, bwrap_filesystem_arguments, + bwrap_home_arguments = flatpak_bwrap_new (flatpak_bwrap_empty_env); + + if (!use_fake_home (exports, bwrap_home_arguments, container_env, opt_fake_home, error)) goto out; @@ -2375,6 +2388,17 @@ main (int argc, g_assert (bwrap != NULL); g_assert (bwrap_filesystem_arguments != NULL); + if (bwrap_home_arguments != NULL) + { + /* The filesystem arguments to set up a fake $HOME (if any) have + * to come before the exports, as they do in Flatpak, so that + * mounting the fake $HOME will not mask the exports used for + * ~/.steam, etc. */ + g_warn_if_fail (g_strv_length (bwrap_home_arguments->envp) == 0); + flatpak_bwrap_append_bwrap (bwrap, bwrap_home_arguments); + g_clear_pointer (&bwrap_home_arguments, flatpak_bwrap_free); + } + flatpak_exports_append_bwrap_args (exports, exports_bwrap); adjust_exports (exports_bwrap, home); g_warn_if_fail (g_strv_length (exports_bwrap->envp) == 0); -- GitLab