From aa6003767c9ed2a20afba75c345be5c274b8ea5b Mon Sep 17 00:00:00 2001 From: Simon McVittie <smcv@collabora.com> Date: Tue, 24 Apr 2018 15:37:56 +0100 Subject: [PATCH] Make sure $fake_home/cache is created with the intended permissions Thanks, shellcheck. Silence the equivalent warning in the cases where it was a false positive. Signed-off-by: Simon McVittie <smcv@collabora.com> --- pressure-vessel-wrap | 32 ++++++++++++++++++++------------ 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/pressure-vessel-wrap b/pressure-vessel-wrap index ebc8acb4a..cf786580a 100755 --- a/pressure-vessel-wrap +++ b/pressure-vessel-wrap @@ -305,18 +305,26 @@ if [ -e "$HOME/.steam/steam.pipe" ]; then set -- --bind "$HOME/.steam/steam.pipe" "$HOME/.steam/steam.pipe" "$@" fi -# Set up the home directory -mkdir -m700 -p "$fake_home" -set -- --bind "$fake_home" "$HOME" --bind "$fake_home" "$fake_home" "$@" - -# Set up /var/tmp, XDG_*_HOME like Flatpak does -mkdir -m700 -p "$fake_home/cache/tmp" -set -- --bind "$fake_home/cache/tmp" /var/tmp "$@" -set -- --setenv XDG_CACHE_HOME "$fake_home/cache" "$@" -mkdir -m700 -p "$fake_home/config" -set -- --setenv XDG_CONFIG_HOME "$fake_home/config" "$@" -mkdir -m700 -p "$fake_home/data" -set -- --setenv XDG_DATA_HOME "$fake_home/data" "$@" +# The shellcheck tool warns that -m is only applied to the deepest +# directory and not any parents created via -p, but that's fine here: +# we use a separate mkdir -p for each directory whose permissions we +# care about. +# shellcheck disable=SC2174 +{ + # Set up the home directory + mkdir -m700 -p "$fake_home" + set -- --bind "$fake_home" "$HOME" --bind "$fake_home" "$fake_home" "$@" + + # Set up /var/tmp, XDG_*_HOME like Flatpak does + mkdir -m700 -p "$fake_home/cache" + mkdir -m700 -p "$fake_home/cache/tmp" + set -- --bind "$fake_home/cache/tmp" /var/tmp "$@" + set -- --setenv XDG_CACHE_HOME "$fake_home/cache" "$@" + mkdir -m700 -p "$fake_home/config" + set -- --setenv XDG_CONFIG_HOME "$fake_home/config" "$@" + mkdir -m700 -p "$fake_home/data" + set -- --setenv XDG_DATA_HOME "$fake_home/data" "$@" +} # Protect other users' homes (but guard against the unlikely situation # that they don't exist) -- GitLab