From c5aa682c21861b49e86ae1301e3d18ea92d6c550 Mon Sep 17 00:00:00 2001 From: Simon McVittie <smcv@collabora.com> Date: Fri, 2 Aug 2024 18:47:50 +0100 Subject: [PATCH] pv-runtime: Don't import host CA certificates when running under Snap steamrt/tasks#416 Mitigates: https://github.com/canonical/steam-snap/issues/397 Signed-off-by: Simon McVittie <smcv@collabora.com> --- pressure-vessel/runtime.c | 3 ++- pressure-vessel/utils.c | 6 ++---- pressure-vessel/utils.h | 13 ++++++++----- tests/pressure-vessel/utils.c | 2 +- 4 files changed, 13 insertions(+), 11 deletions(-) diff --git a/pressure-vessel/runtime.c b/pressure-vessel/runtime.c index 7f3ee72e6..1341a4b3b 100644 --- a/pressure-vessel/runtime.c +++ b/pressure-vessel/runtime.c @@ -3537,7 +3537,8 @@ bind_runtime_base (PvRuntime *self, } } - if (self->flags & PV_RUNTIME_FLAGS_IMPORT_CA_CERTS) + if ((self->flags & PV_RUNTIME_FLAGS_IMPORT_CA_CERTS) + && !(self->workarounds & PV_WORKAROUND_FLAGS_STEAMSNAP_397)) { g_autoptr(FlatpakBwrap) ca_args = NULL; g_autoptr(GError) local_error = NULL; diff --git a/pressure-vessel/utils.c b/pressure-vessel/utils.c index 85025c32b..8bd41a114 100644 --- a/pressure-vessel/utils.c +++ b/pressure-vessel/utils.c @@ -121,6 +121,7 @@ pv_get_workarounds (SrtBwrapFlags bwrap_flags, { PV_WORKAROUND_FLAGS_STEAMSNAP_359, { "steam-snap#359", "steamsnap359" } }, { PV_WORKAROUND_FLAGS_STEAMSNAP_369, { "steam-snap#369", "steamsnap369" } }, { PV_WORKAROUND_FLAGS_STEAMSNAP_370, { "steam-snap#370", "steamsnap370" } }, + { PV_WORKAROUND_FLAGS_STEAMSNAP_397, { "steam-snap#397", "steamsnap397" } }, { PV_WORKAROUND_FLAGS_BWRAP_SETUID, { "bwrap-setuid" } }, }; PvWorkaroundFlags flags = PV_WORKAROUND_FLAGS_NONE; @@ -134,13 +135,10 @@ pv_get_workarounds (SrtBwrapFlags bwrap_flags, if (bwrap_flags & SRT_BWRAP_FLAGS_SETUID) flags |= PV_WORKAROUND_FLAGS_BWRAP_SETUID; - /* Reinstate this if workarounds for snapd need to be used by default */ -#if 0 if (_srt_environ_getenv (envp, "SNAP") != NULL && _srt_environ_getenv (envp, "SNAP_NAME") != NULL && _srt_environ_getenv (envp, "SNAP_REVISION") != NULL) - flags |= PV_WORKAROUND_FLAGS_SNAP; -#endif + flags |= PV_WORKAROUND_FLAGS_STEAMSNAP_397; if (value != NULL) { diff --git a/pressure-vessel/utils.h b/pressure-vessel/utils.h index 61c01b3fb..5d54b72c5 100644 --- a/pressure-vessel/utils.h +++ b/pressure-vessel/utils.h @@ -47,20 +47,23 @@ typedef enum PV_WORKAROUND_FLAGS_STEAMSNAP_359 = (1 << 4), /* Setuid system copy of bwrap */ PV_WORKAROUND_FLAGS_BWRAP_SETUID = (1 << 5), + /* https://github.com/canonical/steam-snap/issues/397 */ + PV_WORKAROUND_FLAGS_STEAMSNAP_397 = (1 << 6), PV_WORKAROUND_FLAGS_NONE = 0 } PvWorkaroundFlags; /* Workarounds for old snapd bugs, no longer used by default */ #define PV_WORKAROUND_FLAGS_OLD_SNAP \ - (PV_WORKAROUND_FLAGS_STEAMSNAP_356 \ - | PV_WORKAROUND_FLAGS_STEAMSNAP_359 \ - | PV_WORKAROUND_FLAGS_STEAMSNAP_369 \ - | PV_WORKAROUND_FLAGS_STEAMSNAP_370) #define PV_WORKAROUND_FLAGS_ALL \ (PV_WORKAROUND_FLAGS_BWRAP_NO_PERMS \ | PV_WORKAROUND_FLAGS_BWRAP_SETUID \ - | PV_WORKAROUND_FLAGS_OLD_SNAP) + | PV_WORKAROUND_FLAGS_STEAMSNAP_356 \ + | PV_WORKAROUND_FLAGS_STEAMSNAP_359 \ + | PV_WORKAROUND_FLAGS_STEAMSNAP_369 \ + | PV_WORKAROUND_FLAGS_STEAMSNAP_370 \ + | PV_WORKAROUND_FLAGS_STEAMSNAP_397 \ + | PV_WORKAROUND_FLAGS_NONE) PvWorkaroundFlags pv_get_workarounds (SrtBwrapFlags bwrap_flags, const char * const *envp); diff --git a/tests/pressure-vessel/utils.c b/tests/pressure-vessel/utils.c index aae69b396..70a998a2f 100644 --- a/tests/pressure-vessel/utils.c +++ b/tests/pressure-vessel/utils.c @@ -726,7 +726,7 @@ test_workarounds (Fixture *f, g_assert_cmpint (pv_get_workarounds (SRT_BWRAP_FLAGS_HAS_PERMS, all_env), ==, PV_WORKAROUND_FLAGS_ALL); g_assert_cmpint (pv_get_workarounds (SRT_BWRAP_FLAGS_HAS_PERMS, snap_env), - ==, PV_WORKAROUND_FLAGS_NONE); + ==, (PV_WORKAROUND_FLAGS_STEAMSNAP_397)); g_assert_cmpint (pv_get_workarounds (SRT_BWRAP_FLAGS_HAS_PERMS, config_env), ==, (PV_WORKAROUND_FLAGS_BWRAP_NO_PERMS | PV_WORKAROUND_FLAGS_STEAMSNAP_356)); -- GitLab