diff --git a/pressure-vessel/flatpak-run.c b/pressure-vessel/flatpak-run.c index 5dc2c7a4ec11bd4cefb575d4ce099b07cf193c4c..b62c520f7f6c5792fc5bcf73584b588d0c0549b9 100644 --- a/pressure-vessel/flatpak-run.c +++ b/pressure-vessel/flatpak-run.c @@ -1,6 +1,6 @@ /* * Cut-down version of common/flatpak-run.c from Flatpak - * Last updated: Flatpak 1.9.x, commit 1.8.0-138-g132b0560 + * Last updated: Flatpak commit 1.10.1-20-gc7bb35d3 * * Copyright © 2017-2019 Collabora Ltd. * Copyright © 2014-2019 Red Hat, Inc @@ -105,7 +105,24 @@ xauth_entry_should_propagate (Xauth *xa, /* ensure entry is for this machine */ if (xa->family == FamilyLocal && !auth_streq (hostname, xa->address, xa->address_length)) - return FALSE; + { + /* OpenSUSE inherits the hostname value from DHCP without updating + * its X11 authentication cookie. The old hostname value can still + * be found in the environment variable XAUTHLOCALHOSTNAME. + * For reference: + * https://bugzilla.opensuse.org/show_bug.cgi?id=262309 + * For this reason if we have a cookie whose address is equal to the + * variable XAUTHLOCALHOSTNAME, we still need to propagate it, but + * we also need to change its address to `unames.nodename`. + */ + const char *xauth_local_hostname; + xauth_local_hostname = g_getenv ("XAUTHLOCALHOSTNAME"); + if (xauth_local_hostname == NULL) + return FALSE; + + if (!auth_streq ((char *) xauth_local_hostname, xa->address, xa->address_length)) + return FALSE; + } /* ensure entry is for this session */ if (xa->number != NULL && !auth_streq (number, xa->number, xa->number_length)) @@ -147,6 +164,17 @@ write_xauth (char *number, FILE *output) local_xa.number_length = 2; } + if (local_xa.family == FamilyLocal && + !auth_streq (unames.nodename, local_xa.address, local_xa.address_length)) + { + /* If we decided to propagate this cookie, but its address + * doesn't match `unames.nodename`, we need to change it or + * inside the container it will not work. + */ + local_xa.address = unames.nodename; + local_xa.address_length = strlen (local_xa.address); + } + if (!XauWriteAuth (output, &local_xa)) g_warning ("xauth write error"); } @@ -700,6 +728,15 @@ flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap) } #if 0 +static void +flatpak_run_add_resolved_args (FlatpakBwrap *bwrap) +{ + const char *resolved_socket = "/run/systemd/resolve/io.systemd.Resolve"; + + if (g_file_test (resolved_socket, G_FILE_TEST_EXISTS)) + flatpak_bwrap_add_args (bwrap, "--bind", resolved_socket, resolved_socket, NULL); +} + static void flatpak_run_add_journal_args (FlatpakBwrap *bwrap) { @@ -974,9 +1011,7 @@ start_dbus_proxy (FlatpakBwrap *app_bwrap, g_autoptr(FlatpakBwrap) proxy_bwrap = NULL; int sync_fds[2] = {-1, -1}; int proxy_start_index; - g_auto(GStrv) minimal_envp = NULL; - minimal_envp = flatpak_run_get_minimal_env (FALSE, FALSE); proxy_bwrap = flatpak_bwrap_new (NULL); if (!add_bwrap_wrapper (proxy_bwrap, app_info_path, error)) @@ -1050,17 +1085,15 @@ flatpak_extension_compare_by_path (gconstpointer _a, } gboolean -flatpak_run_add_extension_args (FlatpakBwrap *bwrap, - GKeyFile *metakey, - const char *full_ref, - gboolean use_ld_so_cache, - char **extensions_out, - GCancellable *cancellable, - GError **error) -{ - g_auto(GStrv) parts = NULL; +flatpak_run_add_extension_args (FlatpakBwrap *bwrap, + GKeyFile *metakey, + FlatpakDecomposed *ref, + gboolean use_ld_so_cache, + char **extensions_out, + GCancellable *cancellable, + GError **error) +{ g_autoptr(GString) used_extensions = g_string_new (""); - gboolean is_app; GList *extensions, *path_sorted_extensions, *l; g_autoptr(GString) ld_library_path = g_string_new (""); int count = 0; @@ -1068,15 +1101,11 @@ flatpak_run_add_extension_args (FlatpakBwrap *bwrap, g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL); g_autoptr(GHashTable) created_symlink = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL); + g_autofree char *arch = flatpak_decomposed_dup_arch (ref); + const char *branch = flatpak_decomposed_get_branch (ref); + gboolean is_app = flatpak_decomposed_is_app (ref); - parts = g_strsplit (full_ref, "/", 0); - if (g_strv_length (parts) != 4) - return flatpak_fail_error (error, FLATPAK_ERROR_INVALID_REF, _("Failed to determine parts from ref: %s"), full_ref); - - is_app = strcmp (parts[0], "app") == 0; - - extensions = flatpak_list_extensions (metakey, - parts[2], parts[3]); + extensions = flatpak_list_extensions (metakey, arch, branch); /* First we apply all the bindings, they are sorted alphabetically in order for parent directory to be mounted before child directories */ @@ -1088,7 +1117,7 @@ flatpak_run_add_extension_args (FlatpakBwrap *bwrap, FlatpakExtension *ext = l->data; g_autofree char *directory = g_build_filename (is_app ? "/app" : "/usr", ext->directory, NULL); g_autofree char *full_directory = g_build_filename (directory, ext->subdir_suffix, NULL); - g_autofree char *ref = g_build_filename (full_directory, ".ref", NULL); + g_autofree char *ref_file = g_build_filename (full_directory, ".ref", NULL); g_autofree char *real_ref = g_build_filename (ext->files_path, ext->directory, ".ref", NULL); if (ext->needs_tmpfs) @@ -1110,7 +1139,7 @@ flatpak_run_add_extension_args (FlatpakBwrap *bwrap, if (g_file_test (real_ref, G_FILE_TEST_EXISTS)) flatpak_bwrap_add_args (bwrap, - "--lock-file", ref, + "--lock-file", ref_file, NULL); } @@ -1142,7 +1171,7 @@ flatpak_run_add_extension_args (FlatpakBwrap *bwrap, { g_autofree char *contents = g_strconcat (ld_path, "\n", NULL); /* We prepend app or runtime and a counter in order to get the include order correct for the conf files */ - g_autofree char *ld_so_conf_file = g_strdup_printf ("%s-%03d-%s.conf", parts[0], ++count, ext->installed_id); + g_autofree char *ld_so_conf_file = g_strdup_printf ("%s-%03d-%s.conf", flatpak_decomposed_get_kind_str (ref), ++count, ext->installed_id); g_autofree char *ld_so_conf_file_path = g_build_filename ("/run/flatpak/ld.so.conf.d", ld_so_conf_file, NULL); if (!flatpak_bwrap_add_args_data (bwrap, "ld-so-conf", @@ -1376,24 +1405,6 @@ flatpak_run_add_environment_args (FlatpakBwrap *bwrap, flatpak_run_add_system_dbus_args (bwrap, proxy_arg_bwrap, context, flags); flatpak_run_add_a11y_dbus_args (bwrap, proxy_arg_bwrap, context, flags); - if (g_environ_getenv (bwrap->envp, "LD_LIBRARY_PATH") != NULL) - { - /* LD_LIBRARY_PATH is overridden for setuid helper, so pass it as cmdline arg */ - flatpak_bwrap_add_args (bwrap, - "--setenv", "LD_LIBRARY_PATH", g_environ_getenv (bwrap->envp, "LD_LIBRARY_PATH"), - NULL); - flatpak_bwrap_unset_env (bwrap, "LD_LIBRARY_PATH"); - } - - if (g_environ_getenv (bwrap->envp, "TMPDIR") != NULL) - { - /* TMPDIR is overridden for setuid helper, so pass it as cmdline arg */ - flatpak_bwrap_add_args (bwrap, - "--setenv", "TMPDIR", g_environ_getenv (bwrap->envp, "TMPDIR"), - NULL); - flatpak_bwrap_unset_env (bwrap, "TMPDIR"); - } - /* Must run this before spawning the dbus proxy, to ensure it ends up in the app cgroup */ if (!flatpak_run_in_transient_unit (app_id, &my_error)) @@ -1613,7 +1624,7 @@ flatpak_run_apply_env_vars (FlatpakBwrap *bwrap, FlatpakContext *context) const char *var = key; const char *val = value; - if (val && val[0] != 0) + if (val) flatpak_bwrap_set_env (bwrap, var, val, TRUE); else flatpak_bwrap_unset_env (bwrap, var); @@ -2234,26 +2245,26 @@ flatpak_run_add_dconf_args (FlatpakBwrap *bwrap, } gboolean -flatpak_run_add_app_info_args (FlatpakBwrap *bwrap, - GFile *app_files, - GBytes *app_deploy_data, - const char *app_extensions, - GFile *runtime_files, - GBytes *runtime_deploy_data, - const char *runtime_extensions, - const char *app_id, - const char *app_branch, - const char *runtime_ref, - GFile *app_id_dir, - FlatpakContext *final_app_context, - FlatpakContext *cmdline_context, - gboolean sandbox, - gboolean build, - gboolean devel, - char **app_info_path_out, - int instance_id_fd, - char **instance_id_host_dir_out, - GError **error) +flatpak_run_add_app_info_args (FlatpakBwrap *bwrap, + GFile *app_files, + GBytes *app_deploy_data, + const char *app_extensions, + GFile *runtime_files, + GBytes *runtime_deploy_data, + const char *runtime_extensions, + const char *app_id, + const char *app_branch, + FlatpakDecomposed *runtime_ref, + GFile *app_id_dir, + FlatpakContext *final_app_context, + FlatpakContext *cmdline_context, + gboolean sandbox, + gboolean build, + gboolean devel, + char **app_info_path_out, + int instance_id_fd, + char **instance_id_host_dir_out, + GError **error) { g_autofree char *info_path = NULL; g_autofree char *bwrapinfo_path = NULL; @@ -2261,7 +2272,6 @@ flatpak_run_add_app_info_args (FlatpakBwrap *bwrap, g_autoptr(GKeyFile) keyfile = NULL; g_autofree char *runtime_path = NULL; g_autofree char *old_dest = g_strdup_printf ("/run/user/%d/flatpak-info", getuid ()); - g_auto(GStrv) runtime_ref_parts = g_strsplit (runtime_ref, "/", 0); const char *group; g_autofree char *instance_id = NULL; glnx_autofd int lock_fd = -1; @@ -2269,6 +2279,7 @@ flatpak_run_add_app_info_args (FlatpakBwrap *bwrap, g_autofree char *instance_id_sandbox_dir = NULL; g_autofree char *instance_id_lock_file = NULL; g_autofree char *user_runtime_dir = flatpak_get_real_xdg_runtime_dir (); + g_autofree char *arch = flatpak_decomposed_dup_arch (runtime_ref); instance_id = flatpak_run_allocate_id (&lock_fd); if (instance_id == NULL) @@ -2299,7 +2310,7 @@ flatpak_run_add_app_info_args (FlatpakBwrap *bwrap, g_key_file_set_string (keyfile, group, FLATPAK_METADATA_KEY_NAME, app_id); g_key_file_set_string (keyfile, group, FLATPAK_METADATA_KEY_RUNTIME, - runtime_ref); + flatpak_decomposed_get_ref (runtime_ref)); g_key_file_set_string (keyfile, FLATPAK_METADATA_GROUP_INSTANCE, FLATPAK_METADATA_KEY_INSTANCE_ID, instance_id); @@ -2335,7 +2346,7 @@ flatpak_run_add_app_info_args (FlatpakBwrap *bwrap, g_key_file_set_string (keyfile, FLATPAK_METADATA_GROUP_INSTANCE, FLATPAK_METADATA_KEY_BRANCH, app_branch); g_key_file_set_string (keyfile, FLATPAK_METADATA_GROUP_INSTANCE, - FLATPAK_METADATA_KEY_ARCH, runtime_ref_parts[2]); + FLATPAK_METADATA_KEY_ARCH, arch); g_key_file_set_string (keyfile, FLATPAK_METADATA_GROUP_INSTANCE, FLATPAK_METADATA_KEY_FLATPAK_VERSION, PACKAGE_VERSION); @@ -2973,8 +2984,10 @@ flatpak_run_setup_base_argv (FlatpakBwrap *bwrap, "--proc", "/proc", NULL); + if (!(flags & FLATPAK_RUN_FLAG_PARENT_SHARE_PIDS)) + flatpak_bwrap_add_arg (bwrap, "--unshare-pid"); + flatpak_bwrap_add_args (bwrap, - "--unshare-pid", "--dir", "/tmp", "--dir", "/var/tmp", "--dir", "/run/host", @@ -3378,6 +3391,7 @@ regenerate_ld_cache (GPtrArray *base_argv_array, "--dev", "/dev", "--bind", flatpak_file_get_path_cached (ld_so_dir), "/run/ld-so-cache-dir", NULL); + flatpak_bwrap_envp_to_args (bwrap); if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error)) return -1; @@ -3448,25 +3462,19 @@ regenerate_ld_cache (GPtrArray *base_argv_array, /* Check that this user is actually allowed to run this app. When running * from the gnome-initial-setup session, an app filter might not be available. */ static gboolean -check_parental_controls (const char *app_ref, - FlatpakDeploy *deploy, - GCancellable *cancellable, - GError **error) +check_parental_controls (FlatpakDecomposed *app_ref, + FlatpakDeploy *deploy, + GCancellable *cancellable, + GError **error) { #ifdef HAVE_LIBMALCONTENT - g_auto(GStrv) app_ref_parts = NULL; g_autoptr(MctManager) manager = NULL; g_autoptr(MctAppFilter) app_filter = NULL; - g_autoptr(GAsyncResult) app_filter_result = NULL; g_autoptr(GDBusConnection) system_bus = NULL; g_autoptr(GError) local_error = NULL; g_autoptr(GDesktopAppInfo) app_info = NULL; gboolean allowed = FALSE; - app_ref_parts = flatpak_decompose_ref (app_ref, error); - if (app_ref_parts == NULL) - return FALSE; - system_bus = g_bus_get_sync (G_BUS_TYPE_SYSTEM, NULL, error); if (system_bus == NULL) return FALSE; @@ -3478,7 +3486,14 @@ check_parental_controls (const char *app_ref, if (g_error_matches (local_error, MCT_APP_FILTER_ERROR, MCT_APP_FILTER_ERROR_DISABLED)) { g_debug ("Skipping parental controls check for %s since parental " - "controls are disabled globally", app_ref); + "controls are disabled globally", flatpak_decomposed_get_ref (app_ref)); + return TRUE; + } + else if (g_error_matches (local_error, G_DBUS_ERROR, G_DBUS_ERROR_SERVICE_UNKNOWN) || + g_error_matches (local_error, G_DBUS_ERROR, G_DBUS_ERROR_NAME_HAS_NO_OWNER)) + { + g_debug ("Skipping parental controls check for %s since a required " + "service was not found", flatpak_decomposed_get_ref (app_ref)); return TRUE; } else if (local_error != NULL) @@ -3493,7 +3508,7 @@ check_parental_controls (const char *app_ref, * multiple .desktop files, we use the main one. The app ID check is * always done, as the binary executed by `flatpak run` isn’t necessarily * extracted from a .desktop file. */ - allowed = mct_app_filter_is_flatpak_ref_allowed (app_filter, app_ref); + allowed = mct_app_filter_is_flatpak_ref_allowed (app_filter, flatpak_decomposed_get_ref (app_ref)); /* Look up the app’s main .desktop file. */ if (deploy != NULL && allowed) @@ -3502,11 +3517,12 @@ check_parental_controls (const char *app_ref, const char *deploy_path; g_autofree char *desktop_file_name = NULL; g_autofree char *desktop_file_path = NULL; + g_autofree char *app_id = flatpak_decomposed_dup_id (app_ref); deploy_dir = flatpak_deploy_get_dir (deploy); deploy_path = flatpak_file_get_path_cached (deploy_dir); - desktop_file_name = g_strconcat (app_ref_parts[1], ".desktop", NULL); + desktop_file_name = g_strconcat (app_id, ".desktop", NULL); desktop_file_path = g_build_path (G_DIR_SEPARATOR_S, deploy_path, "export", @@ -3525,7 +3541,7 @@ check_parental_controls (const char *app_ref, return flatpak_fail_error (error, FLATPAK_ERROR_PERMISSION_DENIED, /* Translators: The placeholder is for an app ref. */ _("Running %s is not allowed by the policy set by your administrator"), - app_ref); + flatpak_decomposed_get_ref (app_ref)); #endif /* HAVE_LIBMALCONTENT */ return TRUE; @@ -3574,22 +3590,22 @@ check_sudo (GError **error) } gboolean -flatpak_run_app (const char *app_ref, - FlatpakDeploy *app_deploy, - FlatpakContext *extra_context, - const char *custom_runtime, - const char *custom_runtime_version, - const char *custom_runtime_commit, - int parent_pid, - FlatpakRunFlags flags, - const char *cwd, - const char *custom_command, - char *args[], - int n_args, - int instance_id_fd, - char **instance_dir_out, - GCancellable *cancellable, - GError **error) +flatpak_run_app (FlatpakDecomposed *app_ref, + FlatpakDeploy *app_deploy, + FlatpakContext *extra_context, + const char *custom_runtime, + const char *custom_runtime_version, + const char *custom_runtime_commit, + int parent_pid, + FlatpakRunFlags flags, + const char *cwd, + const char *custom_command, + char *args[], + int n_args, + int instance_id_fd, + char **instance_dir_out, + GCancellable *cancellable, + GError **error) { g_autoptr(FlatpakDeploy) runtime_deploy = NULL; g_autoptr(GBytes) runtime_deploy_data = NULL; @@ -3599,23 +3615,24 @@ flatpak_run_app (const char *app_ref, g_autoptr(GFile) bin_ldconfig = NULL; g_autoptr(GFile) app_id_dir = NULL; g_autoptr(GFile) real_app_id_dir = NULL; - g_autofree char *default_runtime = NULL; + g_autofree char *default_runtime_pref = NULL; + g_autoptr(FlatpakDecomposed) default_runtime = NULL; g_autofree char *default_command = NULL; - g_autofree char *runtime_ref = NULL; g_autoptr(GKeyFile) metakey = NULL; g_autoptr(GKeyFile) runtime_metakey = NULL; g_autoptr(FlatpakBwrap) bwrap = NULL; const char *command = "/bin/sh"; g_autoptr(GError) my_error = NULL; - g_auto(GStrv) runtime_parts = NULL; + g_autoptr(FlatpakDecomposed) runtime_ref = NULL; int i; g_autoptr(GPtrArray) previous_app_id_dirs = NULL; + g_autofree char *app_id = NULL; + g_autofree char *app_arch = NULL; g_autofree char *app_info_path = NULL; g_autofree char *instance_id_host_dir = NULL; g_autoptr(FlatpakContext) app_context = NULL; g_autoptr(FlatpakContext) overrides = NULL; g_autoptr(FlatpakExports) exports = NULL; - g_auto(GStrv) app_ref_parts = NULL; g_autofree char *commandline = NULL; g_autofree char *doc_mount_path = NULL; g_autofree char *app_extensions = NULL; @@ -3627,15 +3644,14 @@ flatpak_run_app (const char *app_ref, gboolean use_ld_so_cache = TRUE; gboolean sandboxed = (flags & FLATPAK_RUN_FLAG_SANDBOX) != 0; gboolean parent_expose_pids = (flags & FLATPAK_RUN_FLAG_PARENT_EXPOSE_PIDS) != 0; - + gboolean parent_share_pids = (flags & FLATPAK_RUN_FLAG_PARENT_SHARE_PIDS) != 0; struct stat s; if (!check_sudo (error)) return FALSE; - app_ref_parts = flatpak_decompose_ref (app_ref, error); - if (app_ref_parts == NULL) - return FALSE; + app_id = flatpak_decomposed_dup_id (app_ref); + app_arch = flatpak_decomposed_dup_arch (app_ref); /* Check the user is allowed to run this flatpak. */ if (!check_parental_controls (app_ref, app_deploy, cancellable, error)) @@ -3647,8 +3663,8 @@ flatpak_run_app (const char *app_ref, if (app_deploy == NULL) { - g_assert (g_str_has_prefix (app_ref, "runtime/")); - default_runtime = g_strdup (app_ref + strlen ("runtime/")); + g_assert (flatpak_decomposed_is_runtime (app_ref)); + default_runtime_pref = flatpak_decomposed_dup_pref (app_ref); } else { @@ -3664,9 +3680,9 @@ flatpak_run_app (const char *app_ref, key = FLATPAK_METADATA_KEY_RUNTIME; metakey = flatpak_deploy_get_metadata (app_deploy); - default_runtime = g_key_file_get_string (metakey, - FLATPAK_METADATA_GROUP_APPLICATION, - key, &my_error); + default_runtime_pref = g_key_file_get_string (metakey, + FLATPAK_METADATA_GROUP_APPLICATION, + key, &my_error); if (my_error) { g_propagate_error (error, g_steal_pointer (&my_error)); @@ -3674,39 +3690,47 @@ flatpak_run_app (const char *app_ref, } } - runtime_parts = g_strsplit (default_runtime, "/", 0); - if (g_strv_length (runtime_parts) != 3) - return flatpak_fail_error (error, FLATPAK_ERROR_INVALID_REF, _("Wrong number of components in runtime %s"), default_runtime); + default_runtime = flatpak_decomposed_new_from_pref (FLATPAK_KINDS_RUNTIME, default_runtime_pref, error); + if (default_runtime == NULL) + return FALSE; - if (custom_runtime) + if (custom_runtime != NULL || custom_runtime_version != NULL) { - g_auto(GStrv) custom_runtime_parts = g_strsplit (custom_runtime, "/", 0); + g_auto(GStrv) custom_runtime_parts = NULL; + const char *custom_runtime_id = NULL; + const char *custom_runtime_arch = NULL; - for (i = 0; i < 3 && custom_runtime_parts[i] != NULL; i++) + if (custom_runtime) { - if (strlen (custom_runtime_parts[i]) > 0) + custom_runtime_parts = g_strsplit (custom_runtime, "/", 0); + for (i = 0; i < 3 && custom_runtime_parts[i] != NULL; i++) { - g_free (runtime_parts[i]); - runtime_parts[i] = g_steal_pointer (&custom_runtime_parts[i]); + if (strlen (custom_runtime_parts[i]) > 0) + { + if (i == 0) + custom_runtime_id = custom_runtime_parts[i]; + if (i == 1) + custom_runtime_arch = custom_runtime_parts[i]; + + if (i == 2 && custom_runtime_version == NULL) + custom_runtime_version = custom_runtime_parts[i]; + } } } - } - if (custom_runtime_version) - { - g_free (runtime_parts[2]); - runtime_parts[2] = g_strdup (custom_runtime_version); + runtime_ref = flatpak_decomposed_new_from_decomposed (default_runtime, + FLATPAK_KINDS_RUNTIME, + custom_runtime_id, + custom_runtime_arch, + custom_runtime_version, + error); + if (runtime_ref == NULL) + return FALSE; } + else + runtime_ref = flatpak_decomposed_ref (default_runtime); - runtime_ref = flatpak_compose_ref (FALSE, - runtime_parts[0], - runtime_parts[2], - runtime_parts[1], - error); - if (runtime_ref == NULL) - return FALSE; - - runtime_deploy = flatpak_find_deploy_for_ref (runtime_ref, custom_runtime_commit, cancellable, error); + runtime_deploy = flatpak_find_deploy_for_ref (flatpak_decomposed_get_ref (runtime_ref), custom_runtime_commit, NULL, cancellable, error); if (runtime_deploy == NULL) return FALSE; @@ -3743,7 +3767,7 @@ flatpak_run_app (const char *app_ref, gsize len = 0; gboolean do_migrate; - real_app_id_dir = flatpak_get_data_dir (app_ref_parts[1]); + real_app_id_dir = flatpak_get_data_dir (app_id); app_files = flatpak_deploy_get_files (app_deploy); previous_app_id_dirs = g_ptr_array_new_with_free_func (g_object_unref); @@ -3799,13 +3823,13 @@ flatpak_run_app (const char *app_ref, if (!flatpak_file_rename (previous_app_id_dir, real_app_id_dir, cancellable, &local_error)) { g_warning (_("Failed to migrate old app data directory %s to new name %s: %s"), - flatpak_file_get_path_cached (previous_app_id_dir), app_ref_parts[1], + flatpak_file_get_path_cached (previous_app_id_dir), app_id, local_error->message); } else { /* Leave a symlink in place of the old data dir */ - if (!g_file_make_symbolic_link (previous_app_id_dir, app_ref_parts[1], cancellable, &local_error)) + if (!g_file_make_symbolic_link (previous_app_id_dir, app_id, cancellable, &local_error)) { g_warning (_("Failed to create symlink while migrating %s: %s"), flatpak_file_get_path_cached (previous_app_id_dir), @@ -3827,7 +3851,7 @@ flatpak_run_app (const char *app_ref, flatpak_run_apply_env_default (bwrap, use_ld_so_cache); flatpak_run_apply_env_vars (bwrap, app_context); - flatpak_run_apply_env_prompt (bwrap, app_ref_parts[1]); + flatpak_run_apply_env_prompt (bwrap, app_id); if (real_app_id_dir) { @@ -3881,7 +3905,7 @@ flatpak_run_app (const char *app_ref, flags |= flatpak_context_get_run_flags (app_context); - if (!flatpak_run_setup_base_argv (bwrap, runtime_files, app_id_dir, app_ref_parts[2], flags, error)) + if (!flatpak_run_setup_base_argv (bwrap, runtime_files, app_id_dir, app_arch, flags, error)) return FALSE; if (generate_ld_so_conf) @@ -3901,24 +3925,27 @@ flatpak_run_app (const char *app_ref, if (!flatpak_run_add_app_info_args (bwrap, app_files, app_deploy_data, app_extensions, runtime_files, runtime_deploy_data, runtime_extensions, - app_ref_parts[1], app_ref_parts[3], + app_id, flatpak_decomposed_get_branch (app_ref), runtime_ref, app_id_dir, app_context, extra_context, sandboxed, FALSE, flags & FLATPAK_RUN_FLAG_DEVEL, &app_info_path, instance_id_fd, &instance_id_host_dir, error)) return FALSE; - if (!flatpak_run_add_dconf_args (bwrap, app_ref_parts[1], metakey, error)) + if (!flatpak_run_add_dconf_args (bwrap, app_id, metakey, error)) return FALSE; if (!sandboxed && !(flags & FLATPAK_RUN_FLAG_NO_DOCUMENTS_PORTAL)) - add_document_portal_args (bwrap, app_ref_parts[1], &doc_mount_path); + add_document_portal_args (bwrap, app_id, &doc_mount_path); if (!flatpak_run_add_environment_args (bwrap, app_info_path, flags, - app_ref_parts[1], app_context, app_id_dir, previous_app_id_dirs, + app_id, app_context, app_id_dir, previous_app_id_dirs, &exports, cancellable, error)) return FALSE; + if ((app_context->shares & FLATPAK_CONTEXT_SHARED_NETWORK) != 0) + flatpak_run_add_resolved_args (bwrap); + flatpak_run_add_journal_args (bwrap); add_font_path_args (bwrap); add_icon_path_args (bwrap); @@ -3932,7 +3959,7 @@ flatpak_run_app (const char *app_ref, if (cwd) flatpak_bwrap_add_args (bwrap, "--chdir", cwd, NULL); - if (parent_expose_pids) + if (parent_expose_pids || parent_share_pids) { g_autofree char *userns_path = NULL; g_autofree char *pidns_path = NULL; @@ -3979,12 +4006,14 @@ flatpak_run_app (const char *app_ref, command = default_command; } + flatpak_bwrap_envp_to_args (bwrap); + if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error)) return FALSE; flatpak_bwrap_add_arg (bwrap, command); - if (!add_rest_args (bwrap, app_ref_parts[1], + if (!add_rest_args (bwrap, app_id, exports, (flags & FLATPAK_RUN_FLAG_FILE_FORWARDING) != 0, doc_mount_path, args, n_args, error)) @@ -4009,6 +4038,12 @@ flatpak_run_app (const char *app_ref, /* We use LEAVE_DESCRIPTORS_OPEN to work around dead-lock, see flatpak_close_fds_workaround */ spawn_flags |= G_SPAWN_LEAVE_DESCRIPTORS_OPEN; + /* flatpak_bwrap_envp_to_args() moved the environment variables to + * be set into --setenv instructions in argv, so the environment + * in which the bwrap command runs must be empty. */ + g_assert (bwrap->envp != NULL); + g_assert (bwrap->envp[0] == NULL); + if (!g_spawn_async (NULL, (char **) bwrap->argv->pdata, bwrap->envp, @@ -4036,6 +4071,12 @@ flatpak_run_app (const char *app_ref, * we do want to allow inheriting fds into flatpak run. */ flatpak_bwrap_child_setup (bwrap->fds, FALSE); + /* flatpak_bwrap_envp_to_args() moved the environment variables to + * be set into --setenv instructions in argv, so the environment + * in which the bwrap command runs must be empty. */ + g_assert (bwrap->envp != NULL); + g_assert (bwrap->envp[0] == NULL); + if (execvpe (flatpak_get_bwrap (), (char **) bwrap->argv->pdata, bwrap->envp) == -1) { g_set_error_literal (error, G_IO_ERROR, g_io_error_from_errno (errno),