From c89dd59758e205e20da332edd7804be79cb225f2 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Thu, 7 Jan 2021 13:12:48 +0000
Subject: [PATCH] wrap: Only serialize the locked environment variables if
 using --launcher

If we are not using the --launcher, then there's no point in setting
this up: they won't be used for anything anyway.

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 pressure-vessel/wrap.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c
index dbb05eb3c..e0ebff04b 100644
--- a/pressure-vessel/wrap.c
+++ b/pressure-vessel/wrap.c
@@ -2129,13 +2129,15 @@ main (int argc,
    * if we try. */
   g_clear_pointer (&container_env, pv_environ_free);
 
-  if (!flatpak_buffer_to_sealed_memfd_or_tmpfile (&lock_env_tmpf, "lock-env",
-                                                  lock_env->str, lock_env->len,
-                                                  error))
-    goto out;
+  if (opt_launcher)
+    {
+      if (!flatpak_buffer_to_sealed_memfd_or_tmpfile (&lock_env_tmpf, "lock-env",
+                                                      lock_env->str, lock_env->len,
+                                                      error))
+        goto out;
 
-  lock_env_fd = g_strdup_printf ("%d", lock_env_tmpf.fd);
-  flatpak_bwrap_add_fd (bwrap, glnx_steal_fd (&lock_env_tmpf.fd));
+      lock_env_fd = g_strdup_printf ("%d", lock_env_tmpf.fd);
+    }
 
   if (is_flatpak_env)
     {
@@ -2257,7 +2259,8 @@ main (int argc,
           flatpak_bwrap_add_arg_printf (adverb_argv, "--pass-fd=%d", fd);
         }
 
-      flatpak_bwrap_add_arg_printf (adverb_argv, "--pass-fd=%s", lock_env_fd);
+      if (lock_env_fd != NULL)
+        flatpak_bwrap_add_arg_printf (adverb_argv, "--pass-fd=%s", lock_env_fd);
 
       switch (opt_shell)
         {
@@ -2327,6 +2330,9 @@ main (int argc,
         flatpak_bwrap_add_arg (launcher_argv, "--verbose");
 
       g_debug ("Adding locked environment variables...");
+      g_assert (lock_env_fd != NULL);
+      g_assert (lock_env_tmpf.fd >= 0);
+      flatpak_bwrap_add_fd (launcher_argv, glnx_steal_fd (&lock_env_tmpf.fd));
       flatpak_bwrap_add_args (launcher_argv,
                               "--lock-env-from-fd", lock_env_fd, NULL);
 
-- 
GitLab