From e956ece973d35ccd2a311b7e6f3bfa67fbba5584 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Tue, 8 Sep 2020 14:43:42 +0100
Subject: [PATCH] runtime: Load basic NSS plugins along with host system glibc

The basic Name Service Switch plugins that ship with glibc are entitled
to assume that they are used alongside a corresponding glibc, and can
use private symbols from it.

This is not a complete set, only the ones required by the nsswitch.conf
that we ship in practice. We can expand coverage later if desired.

For a practical example of this, use soldier (glibc 2.28) on Arch Linux
(glibc 2.32), and run `LD_DEBUG=files id`. soldier's libnss_files.so.2
fails to load with an undefined reference to __libc_readline_unlocked.

This might also resolve various previously-reported bugs with DNS not
working in the scout container:

* https://github.com/ValveSoftware/steam-runtime/issues/226
  (scout on Debian 10)
* https://github.com/ValveSoftware/steam-runtime/issues/264,
  https://github.com/ValveSoftware/steam-runtime/issues/258,
  https://github.com/ValveSoftware/steam-runtime/issues/192
  (scout on Fedora 31)
* https://github.com/ValveSoftware/steam-runtime/issues/262
  (scout on Arch Linux)
* https://github.com/ValveSoftware/steam-runtime/issues/227
  (scout on unspecified distribution)

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 src/runtime.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/runtime.c b/src/runtime.c
index f6ae88183..d014eed26 100644
--- a/src/runtime.c
+++ b/src/runtime.c
@@ -2522,13 +2522,16 @@ pv_runtime_use_provider_graphics_stack (PvRuntime *self,
                                                         bwrap, error))
                 return FALSE;
 
-              /* Collect miscellaneous libraries that libc might dlopen.
-               * At the moment this is just libidn2. */
+              /* Collect miscellaneous libraries that libc might dlopen. */
               g_assert (temp_bwrap == NULL);
               temp_bwrap = pv_runtime_get_capsule_capture_libs (self, arch);
               flatpak_bwrap_add_args (temp_bwrap,
                                       "--dest", arch->libdir_in_current_namespace,
                                       "if-exists:libidn2.so.0",
+                                      "if-exists:even-if-older:soname-match:libnss_compat.so.*",
+                                      "if-exists:even-if-older:soname-match:libnss_db.so.*",
+                                      "if-exists:even-if-older:soname-match:libnss_dns.so.*",
+                                      "if-exists:even-if-older:soname-match:libnss_files.so.*",
                                       NULL);
               flatpak_bwrap_finish (temp_bwrap);
 
-- 
GitLab