From 81de86783f13b45f7b981b4005dbfcaf95c1da64 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Wed, 7 Aug 2024 19:39:36 +0100
Subject: [PATCH] pv-wrap: Don't make XDG_CONFIG_DIRS, XDG_DATA_DIRS available
 in container

Unlike XDG_CONFIG_HOME and XDG_DATA_HOME, these search paths are
expected to be read-only, making it much less likely that a game or
app component will misbehave if they contain a dangling symlink.

Also unlike XDG_CONFIG_HOME and XDG_DATA_HOME, these paths are much
more likely to contain OS-related path elements that can cause
container runtime regressions, such as /var/cache (steamrt/tasks#434)
and /var/lib (steamrt/tasks#493).

A regression risk with this change is that if a user has set for example
`XDG_DATA_DIRS=/offload/data:/usr/local/share:/usr/share`, since
0.20240301.0 the result has been that /offload/data has been shared
with the container, which means apps and games in a SLR container will
load icons, .desktop files, etc. from that location. No longer doing
this is both good and bad. It's good because it makes the container
more self-contained again, but it's bad because users might have come
to rely on `/offload/data` being available, which would no longer be
the case after this change.

steamrt/tasks#493

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 pressure-vessel/wrap-setup.c       | 8 --------
 tests/pressure-vessel/wrap-setup.c | 2 +-
 2 files changed, 1 insertion(+), 9 deletions(-)

diff --git a/pressure-vessel/wrap-setup.c b/pressure-vessel/wrap-setup.c
index 72bd82a5d..8bac27bd7 100644
--- a/pressure-vessel/wrap-setup.c
+++ b/pressure-vessel/wrap-setup.c
@@ -1156,15 +1156,7 @@ static const EnvMount known_required_env[] =
     { "STEAM_EXTRA_COMPAT_TOOLS_PATHS", ENV_MOUNT_FLAGS_COLON_DELIMITED },
     { "XDG_CACHE_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED },
     { "XDG_CONFIG_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED },
-    { "XDG_CONFIG_DIRS",
-      ENV_MOUNT_FLAGS_IF_HOME_SHARED
-      | ENV_MOUNT_FLAGS_COLON_DELIMITED,
-      PV_WRAP_EXPORT_FLAGS_OS_QUIET },
     { "XDG_DATA_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED },
-    { "XDG_DATA_DIRS",
-      ENV_MOUNT_FLAGS_IF_HOME_SHARED
-      | ENV_MOUNT_FLAGS_COLON_DELIMITED,
-      PV_WRAP_EXPORT_FLAGS_OS_QUIET },
     { "XDG_STATE_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED },
 };
 
diff --git a/tests/pressure-vessel/wrap-setup.c b/tests/pressure-vessel/wrap-setup.c
index 50b833af3..cf358cf3e 100644
--- a/tests/pressure-vessel/wrap-setup.c
+++ b/tests/pressure-vessel/wrap-setup.c
@@ -1674,7 +1674,7 @@ test_use_home_shared (Fixture *f,
     "STEAM_COMPAT_MOUNTS=/overrides/forbidden",
     "PRESSURE_VESSEL_FILESYSTEMS_RO=/ro",
     "PRESSURE_VESSEL_FILESYSTEMS_RW=:/rw:/rw2:/nonexistent:::::",
-    "XDG_DATA_DIRS=/offload/user/data:/usr/local/share:/usr/share",
+    "XDG_DATA_HOME=/offload/user/data",
     "XDG_STATE_HOME=/offload/user/state",
     NULL
   };
-- 
GitLab