Skip to content

check-requirements: Don't error out if srt-bwrap is broken by a rogue LD_PRELOAD module

Simon McVittie requested to merge wip/smcv/no-ld-preload-for-bwrap into main

  • pressure-vessel, launch-options: Stop setting LD_PRELOAD=$SYSTEM_LD_PRELOAD

    None of the scripts that set up a LD_LIBRARY_PATH Steam Runtime (steam.sh or run.sh) actually set this, so in practice it will be unset anyway, unless it has been set by a developer or tinkerer.

    It's safest to guarantee that the container runtime will run with LD_PRELOAD unset, because LD_PRELOAD modules frequently make unsafe assumptions, and the container runtime framework (particularly srt-bwrap) needs to run in a somewhat precarious environment that can easily break those assumptions.

    Helps: https://github.com/ValveSoftware/steam-runtime/issues/658

  • check-requirements: Use a sanitized environment to run srt-bwrap

    Some LD_PRELOAD modules will break srt-bwrap, which appears to be what is happening in https://github.com/ValveSoftware/steam-runtime/issues/658; but this doesn't actually matter when it's used in production, because pressure-vessel-unruntime sanitizes the environment (escaping from the scout environment and unsetting LD_AUDIT and LD_PRELOAD) to run the actual container tools from a clean slate.

    Do the same in check-requirements, so that srt-bwrap will only crash when run from check-requirements if it would also crash when run by the real container infrastructure.

    Helps: https://github.com/ValveSoftware/steam-runtime/issues/658

Merge request reports