Skip to content

pv-wrap: Add an option to mount /sys read/write

Simon McVittie requested to merge wip/smcv/rw-sys into master

This allows developers to access debugfs, event tracing or similar facilities, if allowed by filesystem permissions.

This seems risky to support for production use, since it would potentially let games do things that are not long-term supportable, so gate it behind an option equivalent to flatpak run --devel. I've made the option generic so that we can use it to gate other similar features in future.

Note that programs inside the pressure-vessel container cannot run setuid, setgid or setcap executables for technical reasons.

To test:

  • Run Steam with PRESSURE_VESSEL_SHELL=instead in the environment
  • Configure some game to use either Proton 5.13+ or Steam Linux Runtime (I used DOTA 2)
  • Run the game
  • Instead of the game, you get an xterm in the container environment
  • grep sysfs /proc/self/mounts should say ro
  • If you want, you can run "$@" to run the actual game
  • exit
  • Change the launch options to PRESSURE_VESSEL_DEVEL=1 %command%
  • Run the game again
  • grep sysfs /proc/self/mounts should say rw

Merge request reports