pressure-vessel: Add experimental code path for Flatpak sub-sandboxing
-
Review changes -
-
Download -
Patches
-
Plain diff
Requirements
- a non-setuid bwrap executable, and a kernel that allows the non-setuid bwrap to create new user namespaces
- good: Debian 11/testing/unstable, Ubuntu, Fedora, Arch Linux default kernel with
bubblewrap
- bad: Debian 10 or older, SteamOS 2, Arch Linux
linux-hardened
withbubblewrap-suid
- good: Debian 11/testing/unstable, Ubuntu, Fedora, Arch Linux default kernel with
- some Flatpak branches that have not been reviewed and merged yet (infrequently-updated integration branch: https://github.com/smcv/flatpak/tree/for-pressure-vessel)
- the patched
flatpak-portal
running or D-Bus-activatable, and able to find the patchedflatpak
inPATH
-
PATH="${builddir}:$PATH" "${builddir}/flatpak-portal" -vr
might work
-
${builddir}/flatpak override --user --allow=per-app-dev-shm --allow=per-app-tmp com.valvesoftware.Steam
-
com.valvesoftware.Steam
launched by the patchedflatpak
- Run Steam with
PRESSURE_VESSEL_FLATPAK_PR4018
in the environment (deliberately undocumented) to opt-in to the new code path
You will probably want to run with all the debug runes: G_MESSAGES_DEBUG=all
, PROTON_LOG=1
, STEAM_LINUX_RUNTIME_VERBOSE=1
, STEAM_LINUX_RUNTIME_LOG=1
, and usually PRESSURE_VESSEL_SHELL=instead
.
Current status
- native Linux games can be launched (Floating Point works)
- Proton games can be launched and basically work (the Windows version of Life Is Strange works!)
- The Flatpak
libshared-library-guard.so
doesn't work because it's found via/app/links/$LIB
, which we correctly translate to/run/parent/app/links/$LIB
, but then/run/parent/app/links/lib
contains absolute symlinks to/app/lib
and/app/lib32
. We should be able to fix this in Flathub's Steam app by changing them to be relative symlinks.
Commits
-
pressure-vessel: Add experimental code path for Flatpak sub-sandboxing
This is experimental and subject to change. It requires branches of Flatpak that have not yet been reviewed or merged, so it's guarded by (deliberately undocumented) environment variables by default. Only enable this if you are a pressure-vessel developer and know precisely what you're doing.
This feature also requires a non-setuid bwrap executable, and a kernel that allows the non-setuid bwrap to create new user namespaces. Fedora, Ubuntu, Debian >= 11, and Arch Linux's default kernel are examples of systems that should be OK; Debian <= 10, SteamOS 2, and Arch Linux's linux-hardened are not.
I'm landing this despite its experimental status because leaving it in a branch means we have to rebase it all the time, which just slows us down.
-
runtime: Communicate whether we're going to run in a Flatpak subsandbox
-
runtime: Assume /app will be visible in Flatpak subsandbox
My Flatpak branch puts it at /run/parent/app, alongside /run/parent/usr.
-
runtime: Check consistency of arguments for Flatpak subsandbox
Flatpak subsandboxes don't have sufficiently powerful control over the container to use bubblewrap or FlatpakExports directly.
Merge request reports
- version 20ae6ac1b2
- version 19ae6ac1b2
- version 18bd52cec6
- version 17bd52cec6
- version 16d0255a10
- version 15d0255a10
- version 147f9663ce
- version 1389d27fef
- version 1289d27fef
- version 11479c9bfc
- version 106c787f95
- version 983fc4cb0
- version 8e9d593ed
- version 772c2c646
- version 63a11c22e
- version 54039aea6
- version 44039aea6
- version 34039aea6
- version 2549111e2
- version 19c8404fc
- master (base)
- latest version6deea16f4 commits,
- version 20ae6ac1b25 commits,
- version 19ae6ac1b27 commits,
- version 18bd52cec65 commits,
- version 17bd52cec66 commits,
- version 16d0255a1010 commits,
- version 15d0255a1014 commits,
- version 147f9663ce11 commits,
- version 1389d27fef2 commits,
- version 1289d27fef6 commits,
- version 11479c9bfc6 commits,
- version 106c787f956 commits,
- version 983fc4cb01 commit,
- version 8e9d593ed1 commit,
- version 772c2c6461 commit,
- version 63a11c22e4 commits,
- version 54039aea61 commit,
- version 44039aea610 commits,
- version 34039aea617 commits,
- version 2549111e217 commits,
- version 19c8404fc10 commits,
- Side-by-side
- Inline