- Sep 21, 2020
-
-
Ludovico de Nittis authored
Setting STEAM_RUNTIME=/ caused configuration changes in libraries like Pango and GTK, which broke module loading when not in the LD_LIBRARY_PATH Steam Runtime. We updated the affected libraries' search paths so it is safe now to reimplement the STEAM_RUNTIME change. This reverts commit dc71943a and reapplies commit eb716698. Signed-off-by:
Ludovico de Nittis <ludovico.denittis@collabora.com>
-
- Sep 09, 2020
-
-
Simon McVittie authored
This is preparation for combining pressure-vessel with steam-runtime-tools. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Sep 08, 2020
-
-
Simon McVittie authored
This should go some way towards resolving failures to run games ported by Feral Interactive, which explicitly check that they have been run by Steam. See <https://github.com/ValveSoftware/steam-runtime/issues/202> and <https://github.com/ValveSoftware/steam-runtime/issues/249 >. Resolves: pressure-vessel#8 Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
The basic Name Service Switch plugins that ship with glibc are entitled to assume that they are used alongside a corresponding glibc, and can use private symbols from it. This is not a complete set, only the ones required by the nsswitch.conf that we ship in practice. We can expand coverage later if desired. For a practical example of this, use soldier (glibc 2.28) on Arch Linux (glibc 2.32), and run `LD_DEBUG=files id`. soldier's libnss_files.so.2 fails to load with an undefined reference to __libc_readline_unlocked. This might also resolve various previously-reported bugs with DNS not working in the scout container: * https://github.com/ValveSoftware/steam-runtime/issues/226 (scout on Debian 10) * https://github.com/ValveSoftware/steam-runtime/issues/264, https://github.com/ValveSoftware/steam-runtime/issues/258, https://github.com/ValveSoftware/steam-runtime/issues/192 (scout on Fedora 31) * https://github.com/ValveSoftware/steam-runtime/issues/262 (scout on Arch Linux) * https://github.com/ValveSoftware/steam-runtime/issues/227 (scout on unspecified distribution) Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Sep 04, 2020
-
-
Simon McVittie authored
This lets us create /run/host and /run/pressure-vessel unconditionally, even if we're mostly using the host filesystem rather than a runtime. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
Now that we export each subdirectory of the root separately, there's nothing to stop us from using the same function in the runtime and no-runtime cases. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Sep 03, 2020
-
-
Simon McVittie authored
Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Sep 02, 2020
-
-
Ludovico de Nittis authored
pressure-vessel had a few hard coded assumptions about the host system and where to look at for the graphics provider. For example it was assumed that the root was the same host system used by both pressure-vessel current environment (where pressure-vessel-wrap runs) and also later on by `bwrap`. But when we run pressure-vessel in a Flatpak container, the final `bwrap` command is expected to be executed against the real host system (mounted in `/run/host`, in Flatpak). Also when we are in a Flatpak container we might want to pick the graphics stack from the host system (`/run/host`), from the Flatpak container itself or it could even be a completely separate one. (T22373, T22371) Signed-off-by:
Ludovico de Nittis <ludovico.denittis@collabora.com>
-
Ludovico de Nittis authored
The filesystem that is providing /usr might not be mounted in the same place in the current namespace, and on the host system where bwrap will be run. If it isn't, we need to use one path to do file I/O when inspecting it, but pass a different path to bwrap. Signed-off-by:
Ludovico de Nittis <ludovico.denittis@collabora.com>
-
- Aug 20, 2020
-
-
Simon McVittie authored
This doesn't work for current scout because libpng has some weird symlinks, which are not shipped in the .deb but are created by ldconfig (see also Debian #706181, #713270), but a new version of libpng will fix that (T23209). Resolves: #3, T22126 Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Aug 19, 2020
-
-
Simon McVittie authored
Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Aug 18, 2020
-
-
Simon McVittie authored
While we control /run, we might as well be consistent. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
This will let us have the following logic when sharing a container between multiple commands using -launcher and -launch: * For setup commands, don't wrap the launched command in the adverb. If the setup command starts background processes, they'll continue to run. This matches how installscript commands have historically worked for Windows (and Wine/Proton) games in Steam: the setup command is launched with system(), and can leak background processes like wineserver. * For the main game, wait for all processes to exit, by wrapping the launched command in the adverb, with --subreaper only. This matches how native Linux games, and the main command of Windows/Wine/Proton games, have historically worked in Steam. * When all processes belonging to the main game have exited, the -launcher can exit, at which point the subreaper that wraps it can clean up any background processes from the setup commands. --terminate-idle-timeout can be used to wait a few seconds before sending SIGTERM, if desired. Because the adverb now blocks SIGCHLD, we need to unblock it before running the child process; otherwise the child process will inherit the blocked signal, breaking things like g_spawn_async(). Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Aug 11, 2020
-
-
Simon McVittie authored
If we want to be able to use --filesystem=/tmp, then we can't set up the X11 socket until after we're finished with that. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Jul 29, 2020
-
-
Simon McVittie authored
When using a scout sysroot with a newer-than-scout host, we were not overwriting locale(1) and localedef(1) with the host copy, causing mismatches. Resolves: T22877 Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
This will make it easier to debug things going wrong in the adverb, by inheriting --verbose or PRESSURE_VESSEL_VERBOSE from the wrapper. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
Recent versions of Flatpak and systemd-nspawn can mount the host's os-release at /run/host/os-release, even if the rest of the host's /etc and /usr are not exposed to the container. For feature parity we should try to do the same. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Jul 21, 2020
-
-
Ludovico de Nittis authored
pressure-vessel-with-lock has been renamed to pressure-vessel-adverb because now it has more capabilities than just taking a lock. This change should help the environments that are not able to normally run `bwrap`, like if we are in a Docker container or in a Flatpak app. Signed-off-by:
Ludovico de Nittis <ludovico.denittis@collabora.com>
-
- Jul 09, 2020
-
-
Simon McVittie authored
tests/containers.py was failing on SteamOS 2 'brewmaster' with the libc6-i686 package installed, because that package contains an optimized i686 glibc in /lib/i386-linux-gnu/i686/cmov/libc.so.6, which is used in preference to the baseline i586 glibc in /lib/i386-linux-gnu/libc.so.6. There are no corresponding optimized gconv modules, only /usr/lib/i386-linux-gnu/gconv/*. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Jul 08, 2020
-
-
Simon McVittie authored
For runtimes that support it, this gives us a way to override library comparisons. In particular, we can make sure libgcc_s.so.1 is compared by its version-definitions and symbols. (T16561, T16562) Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
This doesn't currently include the --dest because that varies - it's usually arch->libdir_on_host, but not always. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
When we're entering the container to generate locales, we need to bind-mount the staging area for /overrides in *that* bwrap invocation, not add it as a bind-mount to the bwrap invocation that will actually run the game. Fixes: 5e2f9f25 "runtime: Bind-mount /overrides to run locale-gen" Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
- Jun 23, 2020
-
-
Simon McVittie authored
Because we do a "cheap copy" with hard-links where possible, .ref is a hard-link to its counterpart in the original (non-copied) runtime, so a lock on one is a lock on the other. We hold a lock on the original runtime while we do setup, so we would never actually delete the temporary runtimes unless we break the hard-link by re-creating the lock file. Resolves: T22035 Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Ludovico de Nittis authored
Prioritize "/usr/" over "/lib/" if it is available to avoid issues when we use a non merged-/usr container with a host system that is merged-/usr (Fixes: T22125) Signed-off-by:
Ludovico de Nittis <ludovico.denittis@collabora.com>
-
- Jun 17, 2020
-
-
Simon McVittie authored
Flatpak is not going to give us control over the root directory when using sub-sandboxing - the most we're likely to get is control over which directory is chosen to be /usr. Prepare for this by using /usr/lib/pressure-vessel/overrides instead of /overrides for the things we overwrite. To be nice to developers and steam-runtime-tools, put a symlink overrides -> usr/lib/pressure-vessel/overrides at the root, as a hint for where to look. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
In a mutable sysroot, overwrite ld.so with a symlink into /run/host. We overwrite both the interoperable path (to avoid long chains of symlinks in the common case) and the canonicalized path (to make sure nothing can end up finding the container's ld.so, which is incompatible with the libc we have dropped in). If building a long bwrap command-line, we have to mount over the canonicalized path, and just live with the fact that there will be a long chain of symlinks leading to it. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
We currently arrange for the overridden libraries to be used by setting the LD_LIBRARY_PATH, but this fails in two cases: - If we want to use the scout LD_LIBRARY_PATH Steam Runtime inside a newer container (approximating how Steam games currently run in practice), it will reset the LD_LIBRARY_PATH instead of prepending to it. - Games also sometimes overwrite the LD_LIBRARY_PATH instead of prepending to it. We can avoid all that by arranging for our directories in /overrides to be in the default search path for ld.so, by editing ld.so.conf and running ldconfig, like Flatpak does (T14481). However, if we do that, we cannot reliably force a resolution order: ldconfig considers the OS ABI tag, which exists on some libraries and in particular on the versions of glibc and Mesa in scout, to be more important than directory search order. See also: https://bugs.freedesktop.org/show_bug.cgi?id=26663 If we don't remove the unwanted version of glibc, we also run the risk of encountering mismatched copies of glibc and ld.so, leading to an immediate crash. This is particularly likely to happen if we use bwrap to enter the partially-set-up container. Because we have a temporary mutable copy of the sysroot, we can solve this easily by deleting the overridden libraries. That way, there can be no confusion: the only remaining implementation of each SONAME is the one we wanted :-) Note that after removing the overridden libraries, we will be unable to execute code in the sysroot without mounting /overrides/lib and setting up the LD_LIBRARY_PATH to point into it: for example, in the common case where we have taken libc from the host, the mutable sysroot no longer contains libc.so.6. This is why it's so important that a previous commit avoided the call to readlink(1) inside the container for the mutable case. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
If we have a mutable copy of the sysroot (which we know is a complete sysroot, not just /usr), then we don't need to use bwrap to rearrange it into something where we can canonicalize a path. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
This no longer needs to be read/write, because we make all the changes we are going to make during setup. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
This means we don't need to alter the PATH in the runtime. If we're using a mutable runtime, we'll delete the version in the runtime and replace it with a symlink to /run/host/usr/bin/locale or similar; if not, we'll bind-mount the host /usr/bin/locale onto it. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
Because that isn't going to work if you have EGL/Vulkan ICDs installed in your home directory or something, and the JSON file is small, we fall back to copying in this case. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
Feature parity with the existing code requires that we check for a compatible container: in containers where /usr/share/libdrm is not a directory, this won't work. Beef up the compatibility check a bit so that it checks for directory vs. non-directory generically. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
We only strictly need pressure-vessel-with-lock and GLib (and we could skip even the GLib dependency if we assume the runtime contains GLib >= 2.32, as all ours do), but the relocatable copy is designed to be portable to any OS, so for now let's copy the whole thing in. When we do it like this, it's in /usr, because we anticipate that Flatpak sub-sandboxing is not going to give us control over /run. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
Flatpak sub-sandboxing won't let us bind-mount arbitrary things over arbitrary locations, but if we have a mutable copy of the runtime, we can delete runtime content and replace it with host system equivalents. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
We're about to start editing the mutable runtime in-place to replace files we don't want with symlinks to /run/host, but if /run/host isn't mounted then that can't work. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
Even in the case where we're using a temporary directory, it's going to survive at least as long as the call to locale-gen, so we don't need to translate it into a long series of --dir and --symlink directives. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
This means we're able to inspect it in --only-prepare mode. At the moment we still create /overrides/bin/localedef, /overrides/bin/locale, and sometimes EGL and Vulkan JSON via --symlink or --ro-bind, so we have to make /overrides read/write from the perspective of the container. However, when we have moved to creating those files as symlinks in /overrides, we will be able to lock it down to read-only from the perspective of the container. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
I'd originally intended this to be done by a wrapper script, but in fact it's just as straightforward to do it here, which has the advantage that it keeps all the knowledge about the contents of the temporary runtimes directory in one place. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-
Simon McVittie authored
This is primarily useful for testing and development: it lets us generate the temporary sysroot and inspect its contents, even if we are in a container (such as Docker or Flatpak) that does not give us the necessary privileges to run bubblewrap and create a new user namespace. In particular, this will make it more straightforward for us to check some of our assumptions when running on a non-Debian-derived host system. Signed-off-by:
Simon McVittie <smcv@collabora.com>
-