diff --git a/pressure-vessel/environ.c b/pressure-vessel/environ.c index 041727b97b19061161700eb4f9adb315ff3412dd..f83b3386d10bd6411d4ef2d5e26203f198d2a0f8 100644 --- a/pressure-vessel/environ.c +++ b/pressure-vessel/environ.c @@ -1,6 +1,6 @@ /* * Copyright © 2014-2018 Red Hat, Inc - * Copyright © 2020 Collabora Ltd. + * Copyright © 2020-2021 Collabora Ltd. * SPDX-License-Identifier: LGPL-2.1-or-later * * This program is free software; you can redistribute it and/or @@ -29,27 +29,16 @@ * - Forced to be unset * - Inherited from the execution environment of bwrap(1) * - * together with a *locked* flag. The locked flag indicates that if the - * container is running pressure-vessel-launcher(1), then the variable - * cannot be overridden by pressure-vessel-launch(1). - * - * In particular, the locked flag can be combined with any value, and - * a variable can also be locked to the inherited value. - * * We represent this as follows: * * - Set to a value: values[VAR] = VAL * - Forced to be unset: values[VAR] = NULL * - Inherited from the execution environment of bwrap(1): VAR not in `values` - * - * Variables that are locked are also added to `locked`. */ struct _PvEnviron { /* (element-type filename filename) */ GHashTable *values; - /* (element-type filename ignored) */ - GHashTable *locked; }; PvEnviron * @@ -59,8 +48,6 @@ pv_environ_new (void) self->values = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, g_free); - self->locked = g_hash_table_new_full (g_str_hash, g_str_equal, - g_free, NULL); return g_steal_pointer (&self); } @@ -70,59 +57,35 @@ pv_environ_free (PvEnviron *self) g_return_if_fail (self != NULL); g_clear_pointer (&self->values, g_hash_table_unref); - g_clear_pointer (&self->locked, g_hash_table_unref); g_slice_free (PvEnviron, self); } /* - * Lock @var to be set to @val, which may be %NULL to unset it. - * It cannot be overridden by a subsequent pressure-vessel-launch - * invocation. + * Set @var to @val, which may be %NULL to unset it. */ void -pv_environ_lock_env (PvEnviron *self, - const char *var, - const char *val) +pv_environ_setenv (PvEnviron *self, + const char *var, + const char *val) { g_return_if_fail (self != NULL); g_return_if_fail (var != NULL); - /* val may be NULL, to lock it to be unset */ + /* val may be NULL, to unset it */ g_hash_table_replace (self->values, g_strdup (var), g_strdup (val)); - g_hash_table_add (self->locked, g_strdup (var)); } /* - * Lock @var to whatever value it happens to have inherited, in a way - * that cannot be overridden by a subsequent pressure-vessel-launch - * invocation. + * Set @var to whatever value it happens to have inherited. */ void -pv_environ_lock_inherit_env (PvEnviron *self, - const char *var) +pv_environ_inherit_env (PvEnviron *self, + const char *var) { g_return_if_fail (self != NULL); g_return_if_fail (var != NULL); g_hash_table_remove (self->values, var); - g_hash_table_add (self->locked, g_strdup (var)); -} - -/* - * Set @var to @val, in a way that can be overridden by a subsequent - * pressure-vessel-launch invocation. - */ -void -pv_environ_set_env_overridable (PvEnviron *self, - const char *var, - const char *val) -{ - g_return_if_fail (self != NULL); - g_return_if_fail (var != NULL); - /* val may be NULL, to lock it to be unset */ - - g_hash_table_replace (self->values, g_strdup (var), g_strdup (val)); - g_hash_table_remove (self->locked, var); } static int @@ -134,7 +97,7 @@ generic_strcmp (gconstpointer a, /* * Returns: (transfer container): The variables that are set or forced - * to be unset, but not the variables that are locked to be inherited + * to be unset, but not the variables that are inherited */ GList * pv_environ_get_vars (PvEnviron *self) @@ -144,32 +107,9 @@ pv_environ_get_vars (PvEnviron *self) return g_list_sort (g_hash_table_get_keys (self->values), generic_strcmp); } -/* - * Returns: (transfer container): The variables that are locked in some way - */ -GList * -pv_environ_get_locked (PvEnviron *self) -{ - g_return_val_if_fail (self != NULL, NULL); - - return g_list_sort (g_hash_table_get_keys (self->locked), generic_strcmp); -} - -/* - * Returns: %TRUE if @var is locked - */ -gboolean -pv_environ_is_locked (PvEnviron *self, - const char *var) -{ - g_return_val_if_fail (self != NULL, FALSE); - - return g_hash_table_contains (self->locked, var); -} - /* * Returns: (nullable): The value of @var, or %NULL if @var is either - * locked-to-be-unset, locked-to-be-inherited or unspecified + * unset or inherited */ const char * pv_environ_getenv (PvEnviron *self, diff --git a/pressure-vessel/environ.h b/pressure-vessel/environ.h index f2f118ca3fc66ac3577b34cef929c2882dd8cca2..89521622463103d324324a4ddfe0dbc110cc576b 100644 --- a/pressure-vessel/environ.h +++ b/pressure-vessel/environ.h @@ -28,20 +28,14 @@ typedef struct _PvEnviron PvEnviron; PvEnviron *pv_environ_new (void); void pv_environ_free (PvEnviron *self); -void pv_environ_lock_env (PvEnviron *self, - const char *var, - const char *val); -void pv_environ_lock_inherit_env (PvEnviron *self, - const char *var); -void pv_environ_set_env_overridable (PvEnviron *self, - const char *var, - const char *val); +void pv_environ_setenv (PvEnviron *self, + const char *var, + const char *val); +void pv_environ_inherit_env (PvEnviron *self, + const char *var); GList *pv_environ_get_vars (PvEnviron *self); -GList *pv_environ_get_locked (PvEnviron *self); const char *pv_environ_getenv (PvEnviron *self, const char *var); -gboolean pv_environ_is_locked (PvEnviron *self, - const char *var); G_DEFINE_AUTOPTR_CLEANUP_FUNC (PvEnviron, pv_environ_free) diff --git a/pressure-vessel/launcher.1.md b/pressure-vessel/launcher.1.md index 7c9650126a0200d44ae7ca2e2e5a14dd92467a68..52ba49652a096979bc29e78b936be01abe038f9c 100644 --- a/pressure-vessel/launcher.1.md +++ b/pressure-vessel/launcher.1.md @@ -63,13 +63,6 @@ D-Bus session bus, and executes arbitrary commands as subprocesses. This fd will be closed (reach end-of-file) when the server is ready. The default is standard output, equivalent to **--info-fd=1**. -**--lock-env-from-fd** *FD* -: List of environment variables, separated with the null character - '\0', that will be locked to their initial value (whether that - is inherited or unset). If **pressure-vessel-launch**(1) asks - to unset these variables or change their values, that request - will be ignored. - **--replace** : When used with **--bus-name**, allow other **pressure-vessel-launcher** processes to take over the bus name, @@ -83,7 +76,7 @@ D-Bus session bus, and executes arbitrary commands as subprocesses. `PWD` : Set to the current working directory for each command executed - inside the container, overriding **--lock-env-from-fd**. + inside the container. `PRESSURE_VESSEL_LOG_INFO` (boolean) : If set to `1`, increase the log verbosity up to the info level. diff --git a/pressure-vessel/launcher.c b/pressure-vessel/launcher.c index e95a7cedd1b730460101bc140c18c4969587c538..ea080400f6361b06144a4f4dff5d6758c2f15251 100644 --- a/pressure-vessel/launcher.c +++ b/pressure-vessel/launcher.c @@ -52,7 +52,6 @@ static PvPortalListener *global_listener; -static GHashTable *lock_env_hash = NULL; static GHashTable *client_pid_data_hash = NULL; static GMainLoop *main_loop; static PvLauncher1 *launcher; @@ -326,22 +325,9 @@ handle_launch (PvLauncher1 *object, if (arg_flags & PV_LAUNCH_FLAGS_CLEAR_ENV) { - GHashTableIter iter; - const gchar *env_var; - const gchar *env_val; - gpointer k; char *empty[] = { NULL }; - env = g_strdupv (empty); - /* Do not clear the variables that were locked */ - g_hash_table_iter_init (&iter, lock_env_hash); - while (g_hash_table_iter_next (&iter, &k, NULL)) - { - env_var = k; - env_val = g_getenv (env_var); - if (env_val != NULL) - env = g_environ_setenv (env, env_var, env_val, TRUE); - } + env = g_strdupv (empty); } else { @@ -355,20 +341,10 @@ handle_launch (PvLauncher1 *object, const char *val = NULL; g_variant_get_child (arg_envs, i, "{&s&s}", &var, &val); - /* Ignore PWD: we special-case that later, and the debug message - * if it is locked would be confusing */ + /* Ignore PWD: we special-case that later */ if (g_strcmp0 (var, "PWD") == 0) continue; - if (g_hash_table_contains (lock_env_hash, var)) - { - const gchar *locked_val = g_environ_getenv (env, var); - if (g_strcmp0 (val, locked_val) != 0) - g_info ("Ignoring request to set %s=\"%s\" because it was locked to \"%s\"", - var, val, locked_val ? locked_val : "<unset>"); - continue; - } - env = g_environ_setenv (env, var, val, TRUE); } @@ -380,15 +356,6 @@ handle_launch (PvLauncher1 *object, if (g_strcmp0 (unset_env[i], "PWD") == 0) continue; - if (g_hash_table_contains (lock_env_hash, unset_env[i])) - { - const gchar *locked_val = g_environ_getenv (env, unset_env[i]); - if (locked_val != NULL) - g_info ("Ignoring request to unset %s because it was locked to \"%s\"", - unset_env[i], locked_val); - continue; - } - g_debug ("Unsetting the environment variable %s...", unset_env[i]); env = g_environ_unsetenv (env, unset_env[i]); } @@ -820,7 +787,6 @@ set_up_exit_on_readable (int fd, static gchar *opt_bus_name = NULL; static gint opt_exit_on_readable_fd = -1; static gint opt_info_fd = -1; -static gint opt_lock_env_fd = -1; static gboolean opt_replace = FALSE; static gchar *opt_socket = NULL; static gchar *opt_socket_directory = NULL; @@ -843,11 +809,6 @@ static GOptionEntry options[] = "Indicate readiness and print details of how to connect on this " "file descriptor instead of stdout.", "FD" }, - { "lock-env-from-fd", '\0', - G_OPTION_FLAG_NONE, G_OPTION_ARG_INT, &opt_lock_env_fd, - "List of environment variables, separated with the null character " - "'\\0', that will be locked to their initial value. ", - "FD" }, { "replace", '\0', G_OPTION_FLAG_NONE, G_OPTION_ARG_NONE, &opt_replace, "Replace a previous instance with the same bus name. " @@ -929,29 +890,6 @@ main (int argc, goto out; } - lock_env_hash = g_hash_table_new_full (g_str_hash, g_str_equal, g_free, NULL); - - if (opt_lock_env_fd >= 0) - { - g_autofree char *elem = NULL; - size_t len = 0; - g_autoptr(FILE) lock_env_file = fdopen (opt_lock_env_fd, "r"); - - if (lock_env_file == NULL) - { - glnx_null_throw_errno_prefix (error, - "Unable to read the given lock env fd %d", - opt_lock_env_fd); - ret = EX_OSERR; - goto out; - } - - while (getdelim (&elem, &len, '\0', lock_env_file) > 0) - { - g_hash_table_add (lock_env_hash, g_strdup (elem)); - } - } - if (opt_exit_on_readable_fd >= 0) { if (!set_up_exit_on_readable (opt_exit_on_readable_fd, @@ -1054,7 +992,6 @@ out: g_free (opt_socket); g_free (opt_socket_directory); g_clear_object (&global_listener); - g_hash_table_destroy (lock_env_hash); if (local_error == NULL) ret = 0; diff --git a/pressure-vessel/runtime.c b/pressure-vessel/runtime.c index a4b8b027ba09268cdabc9e558c61700126903967..f033e7d318aebdc259c271d5a8513f1d375bc3f3 100644 --- a/pressure-vessel/runtime.c +++ b/pressure-vessel/runtime.c @@ -2578,7 +2578,7 @@ bind_runtime_base (PvRuntime *self, "--symlink", "../run", "/var/run", NULL); - pv_environ_lock_env (container_env, "XDG_RUNTIME_DIR", xrd); + pv_environ_setenv (container_env, "XDG_RUNTIME_DIR", xrd); if (self->provider != NULL && (g_strcmp0 (self->provider->path_in_host_ns, "/") != 0 @@ -5233,23 +5233,23 @@ pv_runtime_use_provider_graphics_stack (PvRuntime *self, } if (dri_path->len != 0) - pv_environ_lock_env (container_env, "LIBGL_DRIVERS_PATH", dri_path->str); + pv_environ_setenv (container_env, "LIBGL_DRIVERS_PATH", dri_path->str); else - pv_environ_lock_env (container_env, "LIBGL_DRIVERS_PATH", NULL); + pv_environ_setenv (container_env, "LIBGL_DRIVERS_PATH", NULL); if (egl_path->len != 0) - pv_environ_lock_env (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES", - egl_path->str); + pv_environ_setenv (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES", + egl_path->str); else - pv_environ_lock_env (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES", - NULL); + pv_environ_setenv (container_env, "__EGL_VENDOR_LIBRARY_FILENAMES", + NULL); - pv_environ_lock_env (container_env, "__EGL_VENDOR_LIBRARY_DIRS", NULL); + pv_environ_setenv (container_env, "__EGL_VENDOR_LIBRARY_DIRS", NULL); if (vulkan_path->len != 0) - pv_environ_lock_env (container_env, "VK_ICD_FILENAMES", vulkan_path->str); + pv_environ_setenv (container_env, "VK_ICD_FILENAMES", vulkan_path->str); else - pv_environ_lock_env (container_env, "VK_ICD_FILENAMES", NULL); + pv_environ_setenv (container_env, "VK_ICD_FILENAMES", NULL); if (self->flags & PV_RUNTIME_FLAGS_IMPORT_VULKAN_LAYERS) { @@ -5273,17 +5273,17 @@ pv_runtime_use_provider_graphics_stack (PvRuntime *self, prepended_data_dirs = g_strdup_printf ("%s:%s", override_share, xdg_data_dirs); - pv_environ_lock_env (container_env, "XDG_DATA_DIRS", - prepended_data_dirs); + pv_environ_setenv (container_env, "XDG_DATA_DIRS", + prepended_data_dirs); } - pv_environ_lock_env (container_env, "VK_LAYER_PATH", NULL); + pv_environ_setenv (container_env, "VK_LAYER_PATH", NULL); } if (va_api_path->len != 0) - pv_environ_lock_env (container_env, "LIBVA_DRIVERS_PATH", - va_api_path->str); + pv_environ_setenv (container_env, "LIBVA_DRIVERS_PATH", + va_api_path->str); else - pv_environ_lock_env (container_env, "LIBVA_DRIVERS_PATH", NULL); + pv_environ_setenv (container_env, "LIBVA_DRIVERS_PATH", NULL); /* We binded the VDPAU drivers in "%{libdir}/vdpau". * Unfortunately VDPAU_DRIVER_PATH can hold just a single path, so we can't @@ -5294,7 +5294,7 @@ pv_runtime_use_provider_graphics_stack (PvRuntime *self, g_autofree gchar *vdpau_val = g_strdup_printf ("%s/lib/platform-${PLATFORM}/vdpau", self->overrides_in_container); - pv_environ_lock_env (container_env, "VDPAU_DRIVER_PATH", vdpau_val); + pv_environ_setenv (container_env, "VDPAU_DRIVER_PATH", vdpau_val); return TRUE; } @@ -5438,7 +5438,7 @@ pv_runtime_bind (PvRuntime *self, * We do not do this for games developed against soldier, because * backwards compatibility is not a concern for game developers who * have specifically opted-in to using the newer runtime. */ - pv_environ_lock_env (container_env, "STEAM_RUNTIME", "/"); + pv_environ_setenv (container_env, "STEAM_RUNTIME", "/"); /* Scout is configured without Wayland support. For this reason, if * the Wayland driver was forced via SDL_VIDEODRIVER, we expect that @@ -5446,7 +5446,7 @@ pv_runtime_bind (PvRuntime *self, * unset SDL_VIDEODRIVER, so that the default x11 gets chosen instead */ sdl_videodriver = g_environ_getenv (self->original_environ, "SDL_VIDEODRIVER"); if (g_strcmp0 (sdl_videodriver, "wayland") == 0) - pv_environ_lock_env (container_env, "SDL_VIDEODRIVER", NULL); + pv_environ_setenv (container_env, "SDL_VIDEODRIVER", NULL); } pv_runtime_set_search_paths (self, container_env); @@ -5500,12 +5500,12 @@ pv_runtime_set_search_paths (PvRuntime *self, NULL); if (g_file_test (terminfo_path, G_FILE_TEST_IS_DIR)) - pv_environ_lock_env (container_env, "TERMINFO_DIRS", "/lib/terminfo"); + pv_environ_setenv (container_env, "TERMINFO_DIRS", "/lib/terminfo"); /* The PATH from outside the container doesn't really make sense inside the * container: in principle the layout could be totally different. */ - pv_environ_lock_env (container_env, "PATH", "/usr/bin:/bin"); - pv_environ_lock_env (container_env, "LD_LIBRARY_PATH", ld_library_path->str); + pv_environ_setenv (container_env, "PATH", "/usr/bin:/bin"); + pv_environ_setenv (container_env, "LD_LIBRARY_PATH", ld_library_path->str); } gboolean diff --git a/pressure-vessel/wrap-pipewire.c b/pressure-vessel/wrap-pipewire.c index 910788860eda692fed76eef6cf5a17547ff2fc99..988a228bb4129b36736d51df7175eae8b90b3207 100644 --- a/pressure-vessel/wrap-pipewire.c +++ b/pressure-vessel/wrap-pipewire.c @@ -77,7 +77,7 @@ pv_wrap_add_pipewire_args (FlatpakBwrap *sharing_bwrap, const char *member; /* Make Pipewire look in the container's XDG_RUNTIME_DIR */ - pv_environ_lock_env (container_env, "PIPEWIRE_RUNTIME_DIR", NULL); + pv_environ_setenv (container_env, "PIPEWIRE_RUNTIME_DIR", NULL); if (g_file_test (DEFAULT_SYSTEM_RUNTIME_DIR, G_FILE_TEST_IS_DIR)) flatpak_bwrap_add_args (sharing_bwrap, @@ -124,7 +124,7 @@ pv_wrap_add_pipewire_args (FlatpakBwrap *sharing_bwrap, g_autofree gchar *container_socket = g_strdup_printf ("/run/user/%d/pv-pipewire", getuid ()); - pv_environ_lock_env (container_env, "PIPEWIRE_REMOTE", "pv-pipewire"); + pv_environ_setenv (container_env, "PIPEWIRE_REMOTE", "pv-pipewire"); flatpak_bwrap_add_args (sharing_bwrap, "--ro-bind", host_socket, @@ -133,7 +133,7 @@ pv_wrap_add_pipewire_args (FlatpakBwrap *sharing_bwrap, } else { - pv_environ_lock_env (container_env, "PIPEWIRE_REMOTE", NULL); + pv_environ_setenv (container_env, "PIPEWIRE_REMOTE", NULL); } } } diff --git a/pressure-vessel/wrap-setup.c b/pressure-vessel/wrap-setup.c index a8a19a4bda88590e1c1458c99c8baa6f90347ed4..98f48ab05f1bf9b5594395db2b360a720bd4f57e 100644 --- a/pressure-vessel/wrap-setup.c +++ b/pressure-vessel/wrap-setup.c @@ -49,13 +49,13 @@ pv_wrap_share_sockets (FlatpakBwrap *bwrap, g_return_if_fail (container_env != NULL); /* If these are set by flatpak_run_add_x11_args(), etc., we'll - * change them from locked-and-unset to locked-and-set later. + * change them from unset to set later. * Every variable that is unset with flatpak_bwrap_unset_env() in * the functions we borrow from Flatpak (below) should be listed * here. */ - pv_environ_lock_env (container_env, "DISPLAY", NULL); - pv_environ_lock_env (container_env, "PULSE_SERVER", NULL); - pv_environ_lock_env (container_env, "XAUTHORITY", NULL); + pv_environ_setenv (container_env, "DISPLAY", NULL); + pv_environ_setenv (container_env, "PULSE_SERVER", NULL); + pv_environ_setenv (container_env, "XAUTHORITY", NULL); flatpak_run_add_font_path_args (sharing_bwrap); @@ -121,13 +121,13 @@ pv_wrap_share_sockets (FlatpakBwrap *bwrap, /* If this warning is reached, we might need to add this * variable to the block of - * pv_environ_lock_env (container_env, ., NULL) calls above */ + * pv_environ_setenv (container_env, ., NULL) calls above */ if (j >= G_N_ELEMENTS (known_vars)) g_warning ("Extra environment variable %s set during container " "setup but not in known_vars; check logic", var); - pv_environ_lock_env (container_env, var, val); + pv_environ_setenv (container_env, var, val); } g_warn_if_fail (g_strv_length (sharing_bwrap->envp) == 0); diff --git a/pressure-vessel/wrap.c b/pressure-vessel/wrap.c index 4e2b8a18a514291cd5cabcdf51eb78c9cd3ad8ac..2bcb3d5df2f3bad20ea463d2358241e7c0864acc 100644 --- a/pressure-vessel/wrap.c +++ b/pressure-vessel/wrap.c @@ -357,7 +357,7 @@ bind_and_propagate_from_environ (FlatpakExports *exports, { g_autofree gchar *joined = g_strjoinv (":", values); - pv_environ_lock_env (container_env, variable, joined); + pv_environ_setenv (container_env, variable, joined); } } @@ -420,9 +420,9 @@ use_tmpfs_home (FlatpakExports *exports, "--symlink", tmp, "/var/tmp", NULL); - pv_environ_lock_env (container_env, "XDG_CACHE_HOME", cache); - pv_environ_lock_env (container_env, "XDG_CONFIG_HOME", config); - pv_environ_lock_env (container_env, "XDG_DATA_HOME", data); + pv_environ_setenv (container_env, "XDG_CACHE_HOME", cache); + pv_environ_setenv (container_env, "XDG_CONFIG_HOME", config); + pv_environ_setenv (container_env, "XDG_DATA_HOME", data); return expose_steam (exports, FLATPAK_FILESYSTEM_MODE_READ_ONLY, FALSE, real_home, NULL, error); @@ -502,9 +502,9 @@ use_fake_home (FlatpakExports *exports, "--bind", tmp, "/var/tmp", NULL); - pv_environ_lock_env (container_env, "XDG_CACHE_HOME", cache); - pv_environ_lock_env (container_env, "XDG_CONFIG_HOME", config); - pv_environ_lock_env (container_env, "XDG_DATA_HOME", data); + pv_environ_setenv (container_env, "XDG_CACHE_HOME", cache); + pv_environ_setenv (container_env, "XDG_CONFIG_HOME", config); + pv_environ_setenv (container_env, "XDG_DATA_HOME", data); flatpak_exports_add_path_expose (exports, FLATPAK_FILESYSTEM_MODE_READ_WRITE, @@ -1337,9 +1337,6 @@ main (int argc, g_autofree gchar *tools_dir = NULL; g_autoptr(PvRuntime) runtime = NULL; g_autoptr(FILE) original_stdout = NULL; - g_autoptr(GString) lock_env = g_string_new (""); - g_auto(GLnxTmpfile) lock_env_tmpf = { 0, }; - g_autofree char *lock_env_fd = NULL; g_autoptr(GArray) pass_fds_through_adverb = g_array_new (FALSE, FALSE, sizeof (int)); setlocale (LC_ALL, ""); @@ -2184,8 +2181,8 @@ main (int argc, g_autofree gchar *adjusted_blockedlist = NULL; adjusted_blockedlist = g_build_filename ("/run/parent", blockedlist, NULL); - pv_environ_lock_env (container_env, "SHARED_LIBRARY_GUARD_CONFIG", - adjusted_blockedlist); + pv_environ_setenv (container_env, "SHARED_LIBRARY_GUARD_CONFIG", + adjusted_blockedlist); } } } @@ -2259,9 +2256,9 @@ main (int argc, else { if (adjusted->len != 0) - pv_environ_lock_env (container_env, variable, adjusted->str); + pv_environ_setenv (container_env, variable, adjusted->str); else - pv_environ_lock_env (container_env, variable, NULL); + pv_environ_setenv (container_env, variable, NULL); } } @@ -2334,16 +2331,16 @@ main (int argc, else { for (i = 0; i < G_N_ELEMENTS (known_required_env); i++) - pv_environ_lock_env (container_env, - known_required_env[i].name, - g_getenv (known_required_env[i].name)); + pv_environ_setenv (container_env, + known_required_env[i].name, + g_getenv (known_required_env[i].name)); flatpak_bwrap_add_args (flatpak_subsandbox, "--directory", cwd_p, NULL); } - pv_environ_lock_env (container_env, "PWD", NULL); + pv_environ_setenv (container_env, "PWD", NULL); /* Put Steam Runtime environment variables back, if /usr is mounted * from the host. */ @@ -2369,7 +2366,7 @@ main (int argc, *equals = '\0'; - pv_environ_lock_env (container_env, opt_env_if_host[i], + pv_environ_setenv (container_env, opt_env_if_host[i], equals + 1); *equals = '='; @@ -2428,12 +2425,12 @@ main (int argc, const GList *iter; /* Let these inherit from the sub-sandbox environment */ - pv_environ_lock_inherit_env (container_env, "FLATPAK_ID"); - pv_environ_lock_inherit_env (container_env, "FLATPAK_SANDBOX_DIR"); - pv_environ_lock_inherit_env (container_env, "DBUS_SESSION_BUS_ADDRESS"); - pv_environ_lock_inherit_env (container_env, "DBUS_SYSTEM_BUS_ADDRESS"); - pv_environ_lock_inherit_env (container_env, "DISPLAY"); - pv_environ_lock_inherit_env (container_env, "XDG_RUNTIME_DIR"); + pv_environ_inherit_env (container_env, "FLATPAK_ID"); + pv_environ_inherit_env (container_env, "FLATPAK_SANDBOX_DIR"); + pv_environ_inherit_env (container_env, "DBUS_SESSION_BUS_ADDRESS"); + pv_environ_inherit_env (container_env, "DBUS_SYSTEM_BUS_ADDRESS"); + pv_environ_inherit_env (container_env, "DISPLAY"); + pv_environ_inherit_env (container_env, "XDG_RUNTIME_DIR"); /* The bwrap envp will be completely ignored when calling * pv-launch, and in fact putting them in its environment @@ -2476,21 +2473,6 @@ main (int argc, final_argv = flatpak_bwrap_new (original_environ); - /* Lock variables where appropriate */ - { - g_autoptr(GList) vars = pv_environ_get_locked (container_env); - const GList *iter; - - for (iter = vars; iter != NULL; iter = iter->next) - { - const char *var = iter->data; - - g_debug ("Locking environment variable: %s", var); - g_string_append (lock_env, var); - g_string_append_c (lock_env, '\0'); - } - } - /* Populate final_argv->envp, overwriting its copy of original_environ. * We skip this if we are in a Flatpak environment, because in that case * we already used `--setenv` for all the variables that we care about and @@ -2531,16 +2513,6 @@ main (int argc, * if we try. */ g_clear_pointer (&container_env, pv_environ_free); - if (opt_launcher) - { - if (!flatpak_buffer_to_sealed_memfd_or_tmpfile (&lock_env_tmpf, "lock-env", - lock_env->str, lock_env->len, - error)) - goto out; - - lock_env_fd = g_strdup_printf ("%d", lock_env_tmpf.fd); - } - if (bwrap != NULL) { /* Tell the application that it's running under a container manager @@ -2645,9 +2617,6 @@ main (int argc, flatpak_bwrap_add_arg_printf (adverb_argv, "--pass-fd=%d", fd); } - if (lock_env_fd != NULL) - flatpak_bwrap_add_arg_printf (adverb_argv, "--pass-fd=%s", lock_env_fd); - switch (opt_shell) { case PV_SHELL_AFTER: @@ -2715,13 +2684,6 @@ main (int argc, if (opt_verbose) flatpak_bwrap_add_arg (launcher_argv, "--verbose"); - g_debug ("Adding locked environment variables..."); - g_assert (lock_env_fd != NULL); - g_assert (lock_env_tmpf.fd >= 0); - flatpak_bwrap_add_fd (launcher_argv, glnx_steal_fd (&lock_env_tmpf.fd)); - flatpak_bwrap_add_args (launcher_argv, - "--lock-env-from-fd", lock_env_fd, NULL); - /* In --launcher mode, arguments after the "--" separator are * passed to the launcher */ flatpak_bwrap_append_argsv (launcher_argv, &argv[1], argc - 1);