Skip to content

pv-wrap: Improve handling of paths that cannot be exported

Simon McVittie requested to merge wip/task434 into main

  • pv-wrap: Share code to handle suppressing exports that won't work

    Make this a method on the PvWrapContext, so that it can use a hash table (lazily allocated) to store the set of paths for which we already logged a warning.

    No functional change intended, except for some slightly different warning messages.

    steamrt/tasks#434

    Helps: https://github.com/ValveSoftware/steam-for-linux/issues/10789

  • wrap-context: Treat more paths as "part of the OS"

    ClearLinux adds /var/cache to the XDG_DATA_DIRS, and in a subsequent commit we will want to ignore that with only an informational message, rather than logging warnings about a situation that is considered correct.

    Similarly, we don't want to log warnings about /etc/xdg being in XDG_CONFIG_DIRS, and an OS might conceivably put generated files in /run on the same basis that ClearLinux uses /var/cache.

    I haven't added /bin, /lib* or /sbin here, on the basis that they are unlikely to appear in these search paths in practice.

    steamrt/tasks#434

    Helps: https://github.com/ValveSoftware/steam-for-linux/issues/10789

  • pv-wrap: Have a longer table of reserved paths

    This matches the behaviour of FlatpakExports, except that instead of silently ignoring these paths like FlatpakExports would, we want to log a warning if necessary.

    steamrt/tasks#434

    Helps: https://github.com/ValveSoftware/steam-for-linux/issues/10789

  • FlatpakExports: Modify to use pressure-vessel's list of reserved paths

    pressure-vessel reserves more paths than Flatpak does, and we need to avoid all of them. For most of the code paths that set up exports, we will avoid the paths anyway (in order to log warnings), but as a fallback, it would be good to be sure that every possible reason for paths to be exported is covered.

    steamrt/tasks#434

    Helps: https://github.com/ValveSoftware/steam-for-linux/issues/10789

  • pv-wrap, FlatpakExports: Refuse to export parents of a reserved directory

    Some of our reserved paths, notably /run/pressure-vessel and /var/pressure-vessel, are not at the top level. We must avoid allowing the parents of these directories to be exported, because if we allowed that, it would break our ability to write to the child: for example, if we bind-mount /run from the host, we will not be able to create /run/pressure-vessel in the root-owned /run.

    This is very similar to https://github.com/flatpak/flatpak/commit/e3507918c0e496b0d111653e0e15e74108dbce16 in the Flatpak 1.15.x development branch, also written by me.

    steamrt/tasks#434

    Helps: https://github.com/ValveSoftware/steam-for-linux/issues/10789

  • pv-utils: Reserve more paths used internally by pressure-vessel

    This avoids a failure mode seen on ClearLinux where including /var/cache in XDG_DATA_DIRS would prevent pressure-vessel startup.

    It also preemptively avoids the same situation potentially happening for /run/host, /run/parent and similar paths.

    steamrt/tasks#434

    Resolves: https://github.com/ValveSoftware/steam-for-linux/issues/10789

Merge request reports