Skip to content
Snippets Groups Projects
Commit feb948ed authored by Simon McVittie's avatar Simon McVittie
Browse files

wrap: Add the ability to unshare the pid namespace

This improves isolation between the host system and the game, and can
be used in conjunction with bwrap's init/reaper process to make game
termination fully reliable (unlike subreapers, killing the init process
automatically kills the entire pid namespace).

One major down-side of doing this is that if the game uses
process-ID-oriented APIs, for example older versions of
<https://github.com/FeralInteractive/gamemode

>, then they will not
work, because the process ID inside the container is not the same as
the process ID outside the container.

Unfortunately, Steam's own tracking of the processes that belong to a game
is one of the process-ID-oriented APIs that this harms, so this branch
does not unshare the pid namespace by default, only when requested. We
can use this to test whether it can be done without breaking Steam;
We will probably need to cope with separate pid namespaces if we create
new containers from inside a Flatpak environment.

Also add an option to unload the gameoverlayrenderer.so module, which
is not acceptable for production use, but at least works around this
well enough to unblock further testing.

Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
parent c41ad3c9
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment