From 5bc5326a6b721ba346d017f90ca4e8b6d097a773 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Thu, 22 Jul 2021 11:39:09 +0100
Subject: [PATCH] runtime: Adjust fallback behaviour when taking files from
 provider

Previously, we assumed that if OS files on the provider are in a
location that is not /usr or a related directory, for example if the OS
has /lib/ld-linux.so.2 -> /some/odd/path/i386/ld.so, then they will
appear below the same path_in_container_ns as /usr, for example
/run/host/some/odd/path/i386/ld.so. However, nothing sets this up for
directories other than /usr, /lib*, /bin, /sbin and /etc, so it's
a bad assumption.

A previous commit handled /etc by redirecting it to /run/host/etc,
/run/parent/etc or /run/gfx/etc as appropriate, so we don't need to
worry about that here.

For the rest, assume that if they appear in the container at all,
they'll appear at a path that matches their location in the provider.
For the common case where provider = host, which is the only one where
we really need to support non-FHS layouts, this means that users can
work around lack of explicit support for a particular non-FHS directory
with something like PRESSURE_VESSEL_FILESYSTEMS_RO=/some/odd/path.

In particular, if we didn't have explicit support for /nix, NixOS users
would have been able to use that workaround to get it mounted.

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 pressure-vessel/runtime.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/pressure-vessel/runtime.c b/pressure-vessel/runtime.c
index 7cce3f4a3..fdc5b1040 100644
--- a/pressure-vessel/runtime.c
+++ b/pressure-vessel/runtime.c
@@ -3003,10 +3003,16 @@ pv_runtime_take_from_provider (PvRuntime *self,
 
           g_warning ("\"%s\" is unlikely to appear in \"%s\"",
                      source_in_provider, self->provider->path_in_container_ns);
-          /* ... but try it anyway, it can't hurt.
-           * TODO: Is "/" more likely to work than "/run/host" here? */
-          target = g_build_filename (self->provider->path_in_container_ns,
-                                     source_in_provider, NULL);
+          /* We might as well try *something*.
+           * path_visible_in_provider_namespace() covers all the paths
+           * that are going to appear in /run/host or similar, so try with
+           * no special prefix here, as though
+           * path_visible_in_container_namespace() had returned true:
+           * that way, even if we're on a non-FHS distro that puts
+           * ld.so in /some/odd/path, it will be possible to use
+           * PRESSURE_VESSEL_FILESYSTEMS_RO=/some/odd/path
+           * as a workaround until pressure-vessel can be adjusted. */
+          target = g_build_filename ("/", source_in_provider, NULL);
         }
 
       g_return_val_if_fail (target != NULL, FALSE);
-- 
GitLab