From 5091d3fbc5fd5f5cc4cead047834dfec212f6846 Mon Sep 17 00:00:00 2001 From: Ludovico de Nittis <ludovico.denittis@collabora.com> Date: Tue, 13 Apr 2021 11:18:43 +0200 Subject: [PATCH] Expose the modified /app to the subsandbox, if any If we modify "/app" we want to bind it to the new subsandbox instead of always binding an empty directory. Signed-off-by: Ludovico de Nittis <ludovico.denittis@collabora.com> --- pressure-vessel/runtime.c | 15 +++++++++++++++ pressure-vessel/runtime.h | 1 + pressure-vessel/wrap.c | 3 ++- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/pressure-vessel/runtime.c b/pressure-vessel/runtime.c index 8d55fb466..4692ec55e 100644 --- a/pressure-vessel/runtime.c +++ b/pressure-vessel/runtime.c @@ -74,6 +74,7 @@ struct _PvRuntime FlatpakBwrap *container_access_adverb; const gchar *runtime_files; /* either source_files or mutable_sysroot */ gchar *runtime_usr; /* either runtime_files or that + "/usr" */ + gchar *runtime_app; /* runtime_files + "/app" */ gchar *runtime_files_on_host; const gchar *adverb_in_container; gchar *provider_in_current_namespace; @@ -1393,6 +1394,7 @@ pv_runtime_initable_init (GInitable *initable, g_mkdir (self->overrides, 0700); + self->runtime_app = g_build_filename (self->runtime_files, "app", NULL); self->runtime_usr = g_build_filename (self->runtime_files, "usr", NULL); if (g_file_test (self->runtime_usr, G_FILE_TEST_IS_DIR)) @@ -1519,6 +1521,7 @@ pv_runtime_finalize (GObject *object) g_free (self->provider_in_host_namespace); g_free (self->provider_in_container_namespace); g_free (self->runtime_files_on_host); + g_free (self->runtime_app); g_free (self->runtime_usr); g_free (self->source); g_free (self->source_files); @@ -4937,3 +4940,15 @@ pv_runtime_get_modified_usr (PvRuntime *self) g_return_val_if_fail (self->mutable_sysroot != NULL, NULL); return self->runtime_usr; } + +const char * +pv_runtime_get_modified_app (PvRuntime *self) +{ + g_return_val_if_fail (PV_IS_RUNTIME (self), NULL); + g_return_val_if_fail (self->mutable_sysroot != NULL, NULL); + + if (g_file_test (self->runtime_app, G_FILE_TEST_IS_DIR)) + return self->runtime_app; + else + return NULL; +} diff --git a/pressure-vessel/runtime.h b/pressure-vessel/runtime.h index 1fe178e51..f5424010d 100644 --- a/pressure-vessel/runtime.h +++ b/pressure-vessel/runtime.h @@ -103,6 +103,7 @@ gboolean pv_runtime_bind (PvRuntime *self, PvEnviron *container_env, GError **error); const char *pv_runtime_get_modified_usr (PvRuntime *self); +const char *pv_runtime_get_modified_app (PvRuntime *self); void pv_runtime_cleanup (PvRuntime *self); gboolean pv_runtime_garbage_collect_legacy (const char *variable_dir, diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c index bff5bf4b6..6f9385858 100644 --- a/pressure-vessel/wrap.c +++ b/pressure-vessel/wrap.c @@ -2081,10 +2081,11 @@ main (int argc, if (flatpak_subsandbox != NULL) { + const char *app = pv_runtime_get_modified_app (runtime); const char *usr = pv_runtime_get_modified_usr (runtime); flatpak_bwrap_add_args (flatpak_subsandbox, - "--app-path=", + "--app-path", app == NULL ? "" : app, "--share-pids", "--usr-path", usr, NULL); -- GitLab