From 7070dbf96c7dadb715c0496d9c0c8a5909ccdd56 Mon Sep 17 00:00:00 2001 From: Alexander Larsson Date: Tue, 28 Jun 2016 15:05:01 +0200 Subject: [PATCH] Make journal always available in the sandbox I don't think it makes sense to have to enable this for everything. It should be safe in the sense that you can't ever do more than the user can do anyway, and there is no way to use this to communicate with the rest of the system because you can't read from it. The worst this could ever cause is to overload the system, but the sandbox doesn't protect against that in any other way anyway. --- common/flatpak-run.c | 13 ++----------- doc/flatpak-build-finish.xml | 4 ++-- doc/flatpak-build.xml | 4 ++-- doc/flatpak-override.xml | 4 ++-- doc/flatpak-run.xml | 4 ++-- 5 files changed, 10 insertions(+), 19 deletions(-) diff --git a/common/flatpak-run.c b/common/flatpak-run.c index 54bc65916..4865b713b 100644 --- a/common/flatpak-run.c +++ b/common/flatpak-run.c @@ -72,7 +72,6 @@ typedef enum { FLATPAK_CONTEXT_SOCKET_PULSEAUDIO = 1 << 2, FLATPAK_CONTEXT_SOCKET_SESSION_BUS = 1 << 3, FLATPAK_CONTEXT_SOCKET_SYSTEM_BUS = 1 << 4, - FLATPAK_CONTEXT_SOCKET_JOURNAL = 1 << 5, } FlatpakContextSockets; /* Same order as enum */ @@ -82,7 +81,6 @@ const char *flatpak_context_sockets[] = { "pulseaudio", "session-bus", "system-bus", - "journal", NULL }; @@ -1534,8 +1532,7 @@ flatpak_run_add_pulseaudio_args (GPtrArray *argv_array, } static void -flatpak_run_add_journal_args (GPtrArray *argv_array, - char ***envp_p) +flatpak_run_add_journal_args (GPtrArray *argv_array) { const char *journal_socket_socket = g_strdup ("/run/systemd/journal/socket"); const char *journal_stdout_socket = g_strdup ("/run/systemd/journal/stdout"); @@ -1997,12 +1994,6 @@ flatpak_run_add_environment_args (GPtrArray *argv_array, flatpak_run_add_pulseaudio_args (argv_array, fd_array, envp_p); } - if (context->sockets & FLATPAK_CONTEXT_SOCKET_JOURNAL) - { - g_debug ("Allowing journal access"); - flatpak_run_add_journal_args (argv_array, envp_p); - } - unrestricted_session_bus = (context->sockets & FLATPAK_CONTEXT_SOCKET_SESSION_BUS) != 0; if (unrestricted_session_bus) g_debug ("Allowing session-dbus access"); @@ -3164,7 +3155,7 @@ flatpak_run_app (const char *app_ref, session_bus_proxy_argv, system_bus_proxy_argv, app_ref_parts[1], app_context, app_id_dir); - + flatpak_run_add_journal_args (argv_array); add_font_path_args (argv_array); /* Must run this before spawning the dbus proxy, to ensure it diff --git a/doc/flatpak-build-finish.xml b/doc/flatpak-build-finish.xml index 980cd2c24..5db1bed54 100644 --- a/doc/flatpak-build-finish.xml +++ b/doc/flatpak-build-finish.xml @@ -114,7 +114,7 @@ Expose a well known socket to the application. This updates the [Context] group in the metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times. @@ -125,7 +125,7 @@ Don't expose a well known socket to the application. This updates the [Context] group in the metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times. diff --git a/doc/flatpak-build.xml b/doc/flatpak-build.xml index f2cdc6fe8..a802753c7 100644 --- a/doc/flatpak-build.xml +++ b/doc/flatpak-build.xml @@ -139,7 +139,7 @@ Expose a well-known socket to the application. This overrides to the Context section from the application metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times. @@ -150,7 +150,7 @@ Don't expose a well-known socket to the application. This overrides to the Context section from the application metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times. diff --git a/doc/flatpak-override.xml b/doc/flatpak-override.xml index 111084708..5946f3320 100644 --- a/doc/flatpak-override.xml +++ b/doc/flatpak-override.xml @@ -95,7 +95,7 @@ Expose a well-known socket to the application. This overrides to the Context section from the application metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times. @@ -106,7 +106,7 @@ Don't expose a well-known socket to the application. This overrides to the Context section from the application metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times. diff --git a/doc/flatpak-run.xml b/doc/flatpak-run.xml index fcd1a5366..dc9d52abb 100644 --- a/doc/flatpak-run.xml +++ b/doc/flatpak-run.xml @@ -173,7 +173,7 @@ Expose a well known socket to the application. This overrides to the Context section from the application metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times. @@ -184,7 +184,7 @@ Don't expose a well known socket to the application. This overrides to the Context section from the application metadata. - SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus, journal. + SOCKET must be one of: x11, wayland, pulseaudio, system-bus, session-bus. This option can be used multiple times.