Skip to content
Snippets Groups Projects
  1. May 21, 2020
  2. May 20, 2020
  3. May 19, 2020
  4. May 18, 2020
  5. May 05, 2020
  6. Apr 15, 2020
  7. Apr 09, 2020
  8. Apr 08, 2020
    • Simon McVittie's avatar
      Merge branch 'wip/smcv/unshare-pid' into 'master' · 5990173f
      Simon McVittie authored
      wrap: Add the ability to unshare the pid namespace
      
      See merge request steam/pressure-vessel!16
      5990173f
    • Simon McVittie's avatar
      wrap: Add the ability to unshare the pid namespace · feb948ed
      Simon McVittie authored
      This improves isolation between the host system and the game, and can
      be used in conjunction with bwrap's init/reaper process to make game
      termination fully reliable (unlike subreapers, killing the init process
      automatically kills the entire pid namespace).
      
      One major down-side of doing this is that if the game uses
      process-ID-oriented APIs, for example older versions of
      <https://github.com/FeralInteractive/gamemode
      
      >, then they will not
      work, because the process ID inside the container is not the same as
      the process ID outside the container.
      
      Unfortunately, Steam's own tracking of the processes that belong to a game
      is one of the process-ID-oriented APIs that this harms, so this branch
      does not unshare the pid namespace by default, only when requested. We
      can use this to test whether it can be done without breaking Steam;
      We will probably need to cope with separate pid namespaces if we create
      new containers from inside a Flatpak environment.
      
      Also add an option to unload the gameoverlayrenderer.so module, which
      is not acceptable for production use, but at least works around this
      well enough to unblock further testing.
      
      Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
      feb948ed
  9. Apr 06, 2020
Loading