From 242e8906a4ae2a6c36f08fe27c7dfb9e13af1666 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Thu, 11 Mar 2021 17:49:57 +0000
Subject: [PATCH] wrap: Put game-specific $HOME on bwrap command-line before
 exports

This is how Flatpak behaves, and it's necessary to prevent the
game-specific $HOME from being mounted over the top of some of the
exports, preventing (for example) ~/.steam from being exposed to the
container.

We only do this for $HOME rather than completely reverting 3a8e939d,
so that it won't be a regression for a symlink at /var/tmp.

If the logical and physical paths to the real $HOME differ, we now also
mount the game-specific $HOME onto the real $HOME's physical path, and
replicate the logical path's symlinks in the container. This matches how
Flatpak works, and avoids a similar regression.

Fixes: 3a8e939d "pv-wrap: Delay --dir, etc. until after FlatpakExports are processed"
Resolves: https://gitlab.steamos.cloud/steamrt/steam-runtime-tools/-/issues/63
Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 pressure-vessel/wrap.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c
index 2f2cf85ad..0edada1ff 100644
--- a/pressure-vessel/wrap.c
+++ b/pressure-vessel/wrap.c
@@ -475,8 +475,18 @@ use_fake_home (FlatpakExports *exports,
                                         data2);
     }
 
+  /* If the logical path to real_home has a symlink among its ancestors
+   * (e.g. /home/user when /home -> var/home exists), make sure the
+   * symlink structure gets mirrored in the container */
+  flatpak_exports_add_path_dir (exports, g_get_home_dir ());
+
+  /* Mount the fake home directory onto the physical path to real_home,
+   * so that it will not conflict with symlinks created by the exports.
+   * See also https://github.com/flatpak/flatpak/issues/1278 and
+   * Flatpak commit f1df5cb1 */
+  flatpak_bwrap_add_bind_arg (bwrap, "--bind", fake_home, real_home);
+
   flatpak_bwrap_add_args (bwrap,
-                          "--bind", fake_home, real_home,
                           "--bind", tmp, "/var/tmp",
                           NULL);
 
@@ -1296,6 +1306,7 @@ main (int argc,
   g_autoptr(PvEnviron) container_env = NULL;
   g_autoptr(FlatpakBwrap) bwrap = NULL;
   g_autoptr(FlatpakBwrap) bwrap_filesystem_arguments = NULL;
+  g_autoptr(FlatpakBwrap) bwrap_home_arguments = NULL;
   g_autoptr(FlatpakBwrap) argv_in_container = NULL;
   g_autoptr(FlatpakBwrap) final_argv = NULL;
   g_autoptr(FlatpakExports) exports = NULL;
@@ -2090,7 +2101,9 @@ main (int argc,
         }
       else
         {
-          if (!use_fake_home (exports, bwrap_filesystem_arguments,
+          bwrap_home_arguments = flatpak_bwrap_new (flatpak_bwrap_empty_env);
+
+          if (!use_fake_home (exports, bwrap_home_arguments,
                               container_env, opt_fake_home,
                               error))
             goto out;
@@ -2375,6 +2388,17 @@ main (int argc,
       g_assert (bwrap != NULL);
       g_assert (bwrap_filesystem_arguments != NULL);
 
+      if (bwrap_home_arguments != NULL)
+        {
+          /* The filesystem arguments to set up a fake $HOME (if any) have
+           * to come before the exports, as they do in Flatpak, so that
+           * mounting the fake $HOME will not mask the exports used for
+           * ~/.steam, etc. */
+          g_warn_if_fail (g_strv_length (bwrap_home_arguments->envp) == 0);
+          flatpak_bwrap_append_bwrap (bwrap, bwrap_home_arguments);
+          g_clear_pointer (&bwrap_home_arguments, flatpak_bwrap_free);
+        }
+
       flatpak_exports_append_bwrap_args (exports, exports_bwrap);
       adjust_exports (exports_bwrap, home);
       g_warn_if_fail (g_strv_length (exports_bwrap->envp) == 0);
-- 
GitLab