From 3fea265cc9b772c576b7874daaf9b03176d6a64f Mon Sep 17 00:00:00 2001 From: Simon McVittie <smcv@collabora.com> Date: Tue, 16 Jun 2020 16:24:57 +0100 Subject: [PATCH] runtime: Reset PATH in the container The PATH from outside the container doesn't really make sense inside the container, because the directory hierarchy could be totally different (particularly on unusual host systems like GoboLinux and Exherbo). Resetting it also makes sure we don't pick up local installations in ~/bin or ~/.local/bin, which could have dependencies that are unsatisfied in the container. Conversely, the PATH from the host might not include everything we need in the container. If the host system is an OS that only supports merged-/usr use, like Arch Linux, then it might not have both /usr/bin and /bin in the PATH - but if the container is not merged /usr, like a scout SDK sysroot, then we'll need both. This approximately matches Flatpak's behaviour: by default it resets PATH to /app/bin:/usr/bin (because it puts app-specific content in /app and can assume that its runtimes are always merged-/usr). Signed-off-by: Simon McVittie <smcv@collabora.com> --- src/runtime.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/src/runtime.c b/src/runtime.c index b4def4e1d..7ba1ff9d9 100644 --- a/src/runtime.c +++ b/src/runtime.c @@ -1284,6 +1284,7 @@ pv_runtime_use_host_graphics_stack (PvRuntime *self, return FALSE; flatpak_bwrap_add_args (temp_bwrap, + "env", "PATH=/usr/bin:/bin", "readlink", "-e", arch->ld_so, NULL); flatpak_bwrap_finish (temp_bwrap); @@ -2078,16 +2079,8 @@ pv_runtime_set_search_paths (PvRuntime *self, FlatpakBwrap *bwrap) { g_autoptr(GString) ld_library_path = g_string_new (""); - g_autoptr(GString) bin_path = g_string_new (""); gsize i; - pv_search_path_append (bin_path, "/overrides/bin"); - pv_search_path_append (bin_path, g_getenv ("PATH")); - flatpak_bwrap_add_args (bwrap, - "--setenv", "PATH", - bin_path->str, - NULL); - /* TODO: Adapt the use_ld_so_cache code from Flatpak instead * of setting LD_LIBRARY_PATH, for better robustness against * games that set their own LD_LIBRARY_PATH ignoring what they @@ -2107,6 +2100,11 @@ pv_runtime_set_search_paths (PvRuntime *self, /* This would be filtered out by a setuid bwrap, so we have to go * via --setenv. */ flatpak_bwrap_add_args (bwrap, + /* The PATH from outside the container doesn't + * really make sense inside the container: + * in principle the layout could be totally + * different. */ + "--setenv", "PATH", "/overrides/bin:/usr/bin:/bin", "--setenv", "LD_LIBRARY_PATH", ld_library_path->str, NULL); -- GitLab