Skip to content

Improve Flatpak sub-sandboxing support

Simon McVittie requested to merge wip/smcv/flatpak into master

  • flatpak-run-private.h: Import flatpak-metadata(5) constants

  • pv-launch: Use constants to refer to Flatpak services

  • pv-wrap: Factor out checks for running under Flatpak

    wrap.c is too big, and main() in particular is too big, so anything we can reasonably factor out here is quite welcome.

  • pv-wrap: Get the Flatpak version number and log it

  • pv-wrap: Factor out get_subsandbox_adverb()

  • pv-wrap: Automatically use Flatpak sub-sandboxing if Flatpak is 1.11.x

    Now that the ability to specify a custom path for /usr and /app has been merged into Flatpak git master, we can mostly assume that if the user has a git snapshot of Flatpak, they have that feature available.

  • pv-wrap: Auto-detect whether sandbox escape is possible

    Now that we're parsing /.flatpak-info, we can check whether we are able to talk to the session helper to run arbitrary code on the host.

  • pv-wrap: Auto-detect which filesystems are shared

    For a working Steam overlay, we need either a per-app-ID /dev/shm (flatpak#4214), or /dev/shm shared with the host.

    Similarly, for a working Steam overlay web browser, we need either a per-app-ID /tmp (flatpak#4093), or /tmp shared with the host.

Resolves: T27564

Merge request reports