From e789a177f2a649e7cfbf641d2ec0b8921c09efec Mon Sep 17 00:00:00 2001 From: Ludovico de Nittis <ludovico.denittis@collabora.com> Date: Mon, 19 Oct 2020 10:14:50 +0200 Subject: [PATCH] wrap: Set all the env vars before building the locking list The list of locked environment variables should include all the vars that we decided to want, or avoid. Also use `extra_locked_vars_to_unset` everywhere instead of directly unsetting a variable. Signed-off-by: Ludovico de Nittis <ludovico.denittis@collabora.com> --- pressure-vessel/flatpak-run-private.h | 4 +- pressure-vessel/flatpak-run.c | 10 ++-- pressure-vessel/wrap.c | 69 +++++++++++++-------------- 3 files changed, 43 insertions(+), 40 deletions(-) diff --git a/pressure-vessel/flatpak-run-private.h b/pressure-vessel/flatpak-run-private.h index 1b42f9526..13fe7c94d 100644 --- a/pressure-vessel/flatpak-run-private.h +++ b/pressure-vessel/flatpak-run-private.h @@ -39,9 +39,11 @@ #include "steam-runtime-tools/glib-backports-internal.h" void flatpak_run_add_x11_args (FlatpakBwrap *bwrap, + GHashTable *extra_locked_vars_to_unset, gboolean allowed); gboolean flatpak_run_add_wayland_args (FlatpakBwrap *bwrap); -void flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap); +void flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap, + GHashTable *extra_locked_vars_to_unset); gboolean flatpak_run_add_system_dbus_args (FlatpakBwrap *app_bwrap); gboolean flatpak_run_add_session_dbus_args (FlatpakBwrap *app_bwrap); void flatpak_run_apply_env_appid (FlatpakBwrap *bwrap, diff --git a/pressure-vessel/flatpak-run.c b/pressure-vessel/flatpak-run.c index 68d399d48..ab66ddc78 100644 --- a/pressure-vessel/flatpak-run.c +++ b/pressure-vessel/flatpak-run.c @@ -160,6 +160,7 @@ write_xauth (char *number, FILE *output) void flatpak_run_add_x11_args (FlatpakBwrap *bwrap, + GHashTable *extra_locked_vars_to_unset, gboolean allowed) { g_autofree char *x11_socket = NULL; @@ -175,7 +176,7 @@ flatpak_run_add_x11_args (FlatpakBwrap *bwrap, if (!allowed) { - flatpak_bwrap_unset_env (bwrap, "DISPLAY"); + g_hash_table_add (extra_locked_vars_to_unset, g_strdup ("DISPLAY")); return; } @@ -229,7 +230,7 @@ flatpak_run_add_x11_args (FlatpakBwrap *bwrap, } else { - flatpak_bwrap_unset_env (bwrap, "DISPLAY"); + g_hash_table_add (extra_locked_vars_to_unset, g_strdup ("DISPLAY")); } } @@ -533,7 +534,8 @@ flatpak_run_parse_pulse_server (const char *value) } void -flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap) +flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap, + GHashTable *extra_locked_vars_to_unset) { g_autofree char *pulseaudio_server = flatpak_run_get_pulseaudio_server (); g_autofree char *pulseaudio_socket = NULL; @@ -545,7 +547,7 @@ flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap) if (!pulseaudio_socket) pulseaudio_socket = g_build_filename (user_runtime_dir, "pulse/native", NULL); - flatpak_bwrap_unset_env (bwrap, "PULSE_SERVER"); + g_hash_table_add (extra_locked_vars_to_unset, g_strdup ("PULSE_SERVER")); /* SteamOS system-wide PulseAudio instance */ if (!g_file_test (pulseaudio_socket, G_FILE_TEST_EXISTS)) diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c index c107efb3c..f44fb6869 100644 --- a/pressure-vessel/wrap.c +++ b/pressure-vessel/wrap.c @@ -1953,6 +1953,40 @@ main (int argc, } } + /* Convert the exported directories into extra bubblewrap arguments */ + exports_bwrap = flatpak_bwrap_new (flatpak_bwrap_empty_env); + flatpak_exports_append_bwrap_args (exports, exports_bwrap); + adjust_exports (exports_bwrap, home); + flatpak_bwrap_append_bwrap (bwrap, exports_bwrap); + + /* We need to set up IPC rendezvous points relatively late, so that + * even if we are sharing /tmp via --filesystem=/tmp, we'll still + * mount our own /tmp/.X11-unix over the top of the OS's. */ + if (runtime != NULL) + { + flatpak_run_add_wayland_args (bwrap); + + /* When in a Flatpak container the "DISPLAY" env is equal to ":99.0", + * but it might be different on the host system. As a workaround we simply + * bind the whole "/tmp/.X11-unix" directory and later unset the container + * "DISPLAY" env. + */ + if (is_flatpak_env) + { + flatpak_bwrap_add_args (bwrap, + "--ro-bind", "/tmp/.X11-unix", "/tmp/.X11-unix", + NULL); + } + else + { + flatpak_run_add_x11_args (bwrap, extra_locked_vars_to_unset, TRUE); + } + + flatpak_run_add_pulseaudio_args (bwrap, extra_locked_vars_to_unset); + flatpak_run_add_session_dbus_args (bwrap); + flatpak_run_add_system_dbus_args (bwrap); + } + if (is_flatpak_env) { /* These are the environment variables that will be wrong, or useless, @@ -2074,41 +2108,6 @@ main (int argc, lock_env_fd = g_strdup_printf ("%d", lock_env_tmpf.fd); flatpak_bwrap_add_fd (bwrap, glnx_steal_fd (&lock_env_tmpf.fd)); - /* Convert the exported directories into extra bubblewrap arguments */ - exports_bwrap = flatpak_bwrap_new (flatpak_bwrap_empty_env); - flatpak_exports_append_bwrap_args (exports, exports_bwrap); - adjust_exports (exports_bwrap, home); - flatpak_bwrap_append_bwrap (bwrap, exports_bwrap); - - /* We need to set up IPC rendezvous points relatively late, so that - * even if we are sharing /tmp via --filesystem=/tmp, we'll still - * mount our own /tmp/.X11-unix over the top of the OS's. */ - if (runtime != NULL) - { - flatpak_run_add_wayland_args (bwrap); - - /* When in a Flatpak container the "DISPLAY" env is equal to ":99.0", - * but it might be different on the host system. As a workaround we simply - * bind the whole "/tmp/.X11-unix" directory and unset the container - * "DISPLAY" env. - */ - if (g_file_test ("/.flatpak-info", G_FILE_TEST_IS_REGULAR)) - { - flatpak_bwrap_add_args (bwrap, - "--ro-bind", "/tmp/.X11-unix", "/tmp/.X11-unix", - NULL); - flatpak_bwrap_unset_env (bwrap, "DISPLAY"); - } - else - { - flatpak_run_add_x11_args (bwrap, TRUE); - } - - flatpak_run_add_pulseaudio_args (bwrap); - flatpak_run_add_session_dbus_args (bwrap); - flatpak_run_add_system_dbus_args (bwrap); - } - if (opt_verbose) { g_message ("%s options before bundling:", bwrap_executable); -- GitLab