diff --git a/pressure-vessel-wrap b/pressure-vessel-wrap index ebc8acb4ab3c9c180522d6b368f3c0934124fe95..cf786580a22f78eb060ab24f792b2ea1b5da548e 100755 --- a/pressure-vessel-wrap +++ b/pressure-vessel-wrap @@ -305,18 +305,26 @@ if [ -e "$HOME/.steam/steam.pipe" ]; then set -- --bind "$HOME/.steam/steam.pipe" "$HOME/.steam/steam.pipe" "$@" fi -# Set up the home directory -mkdir -m700 -p "$fake_home" -set -- --bind "$fake_home" "$HOME" --bind "$fake_home" "$fake_home" "$@" - -# Set up /var/tmp, XDG_*_HOME like Flatpak does -mkdir -m700 -p "$fake_home/cache/tmp" -set -- --bind "$fake_home/cache/tmp" /var/tmp "$@" -set -- --setenv XDG_CACHE_HOME "$fake_home/cache" "$@" -mkdir -m700 -p "$fake_home/config" -set -- --setenv XDG_CONFIG_HOME "$fake_home/config" "$@" -mkdir -m700 -p "$fake_home/data" -set -- --setenv XDG_DATA_HOME "$fake_home/data" "$@" +# The shellcheck tool warns that -m is only applied to the deepest +# directory and not any parents created via -p, but that's fine here: +# we use a separate mkdir -p for each directory whose permissions we +# care about. +# shellcheck disable=SC2174 +{ + # Set up the home directory + mkdir -m700 -p "$fake_home" + set -- --bind "$fake_home" "$HOME" --bind "$fake_home" "$fake_home" "$@" + + # Set up /var/tmp, XDG_*_HOME like Flatpak does + mkdir -m700 -p "$fake_home/cache" + mkdir -m700 -p "$fake_home/cache/tmp" + set -- --bind "$fake_home/cache/tmp" /var/tmp "$@" + set -- --setenv XDG_CACHE_HOME "$fake_home/cache" "$@" + mkdir -m700 -p "$fake_home/config" + set -- --setenv XDG_CONFIG_HOME "$fake_home/config" "$@" + mkdir -m700 -p "$fake_home/data" + set -- --setenv XDG_DATA_HOME "$fake_home/data" "$@" +} # Protect other users' homes (but guard against the unlikely situation # that they don't exist)