From fb8e8e6fe4e023ebeacff70d45c4177c01d63b20 Mon Sep 17 00:00:00 2001
From: Ludovico de Nittis <ludovico.denittis@collabora.com>
Date: Fri, 30 Apr 2021 12:18:13 +0200
Subject: [PATCH] wrap: Set the env var to adjust libshared-library-guard
 configuration path

When inside a Flatpak container, we expect that
`libshared-library-guard.so` looks for its blocklist configuration in
`/app/etc/freedesktop-sdk.ld.so.blockedlist`.

This will not work because we bind `/app` in `/run/parent/app`. For this
reason, when we detect this situation, we set the environment variable
`SHARED_LIBRARY_GUARD_CONFIG` to point `libshared-library-guard` in the
correct path.

Signed-off-by: Ludovico de Nittis <ludovico.denittis@collabora.com>
---
 pressure-vessel/wrap.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c
index 69159c56e..463ea0b73 100644
--- a/pressure-vessel/wrap.c
+++ b/pressure-vessel/wrap.c
@@ -2171,6 +2171,22 @@ main (int argc,
                   adjusted_path = g_build_filename ("/run/parent", preload, NULL);
                   g_debug ("%s -> %s", preload, adjusted_path);
                   pv_search_path_append (adjusted, adjusted_path);
+
+                  if (g_str_has_suffix (preload, "/libshared-library-guard.so"))
+                    {
+                      /* We special case libshared-library-guard because usually
+                       * its blockedlist file is located in `/app` and we need
+                       * to change that to the `/run/parent` counterpart */
+                      const gchar *blockedlist = "/app/etc/freedesktop-sdk.ld.so.blockedlist";
+                      if (g_file_test (blockedlist, G_FILE_TEST_EXISTS))
+                        {
+                          g_autofree gchar *adjusted_blockedlist = NULL;
+                          adjusted_blockedlist = g_build_filename ("/run/parent",
+                                                                   blockedlist, NULL);
+                          pv_environ_lock_env (container_env, "SHARED_LIBRARY_GUARD_CONFIG",
+                                               adjusted_blockedlist);
+                        }
+                    }
                 }
               else
                 {
-- 
GitLab