From 81de86783f13b45f7b981b4005dbfcaf95c1da64 Mon Sep 17 00:00:00 2001 From: Simon McVittie <smcv@collabora.com> Date: Wed, 7 Aug 2024 19:39:36 +0100 Subject: [PATCH] pv-wrap: Don't make XDG_CONFIG_DIRS, XDG_DATA_DIRS available in container Unlike XDG_CONFIG_HOME and XDG_DATA_HOME, these search paths are expected to be read-only, making it much less likely that a game or app component will misbehave if they contain a dangling symlink. Also unlike XDG_CONFIG_HOME and XDG_DATA_HOME, these paths are much more likely to contain OS-related path elements that can cause container runtime regressions, such as /var/cache (steamrt/tasks#434) and /var/lib (steamrt/tasks#493). A regression risk with this change is that if a user has set for example `XDG_DATA_DIRS=/offload/data:/usr/local/share:/usr/share`, since 0.20240301.0 the result has been that /offload/data has been shared with the container, which means apps and games in a SLR container will load icons, .desktop files, etc. from that location. No longer doing this is both good and bad. It's good because it makes the container more self-contained again, but it's bad because users might have come to rely on `/offload/data` being available, which would no longer be the case after this change. steamrt/tasks#493 Signed-off-by: Simon McVittie <smcv@collabora.com> --- pressure-vessel/wrap-setup.c | 8 -------- tests/pressure-vessel/wrap-setup.c | 2 +- 2 files changed, 1 insertion(+), 9 deletions(-) diff --git a/pressure-vessel/wrap-setup.c b/pressure-vessel/wrap-setup.c index 72bd82a5d..8bac27bd7 100644 --- a/pressure-vessel/wrap-setup.c +++ b/pressure-vessel/wrap-setup.c @@ -1156,15 +1156,7 @@ static const EnvMount known_required_env[] = { "STEAM_EXTRA_COMPAT_TOOLS_PATHS", ENV_MOUNT_FLAGS_COLON_DELIMITED }, { "XDG_CACHE_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED }, { "XDG_CONFIG_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED }, - { "XDG_CONFIG_DIRS", - ENV_MOUNT_FLAGS_IF_HOME_SHARED - | ENV_MOUNT_FLAGS_COLON_DELIMITED, - PV_WRAP_EXPORT_FLAGS_OS_QUIET }, { "XDG_DATA_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED }, - { "XDG_DATA_DIRS", - ENV_MOUNT_FLAGS_IF_HOME_SHARED - | ENV_MOUNT_FLAGS_COLON_DELIMITED, - PV_WRAP_EXPORT_FLAGS_OS_QUIET }, { "XDG_STATE_HOME", ENV_MOUNT_FLAGS_IF_HOME_SHARED }, }; diff --git a/tests/pressure-vessel/wrap-setup.c b/tests/pressure-vessel/wrap-setup.c index 50b833af3..cf358cf3e 100644 --- a/tests/pressure-vessel/wrap-setup.c +++ b/tests/pressure-vessel/wrap-setup.c @@ -1674,7 +1674,7 @@ test_use_home_shared (Fixture *f, "STEAM_COMPAT_MOUNTS=/overrides/forbidden", "PRESSURE_VESSEL_FILESYSTEMS_RO=/ro", "PRESSURE_VESSEL_FILESYSTEMS_RW=:/rw:/rw2:/nonexistent:::::", - "XDG_DATA_DIRS=/offload/user/data:/usr/local/share:/usr/share", + "XDG_DATA_HOME=/offload/user/data", "XDG_STATE_HOME=/offload/user/state", NULL }; -- GitLab