mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-04-09 09:30:24 -04:00
Code Issues Packages Projects Releases Wiki Activity

Make per-app generated files read-only

Browse Source 
We generate various configuration files for each sandbox instance,
and expose them to the sandbox using flatpak_bwrap_add_args_data,
which in the end passed --bind-data to bwrap. These files are not
sensitive or shared, but it still doesn't really make sense for
the sandbox to allow them to be modified, so lets switch them
to --ro-bind-data.

This affects these files in the sandbox:

 $HOME/.var/app/$APPID/config/user-dirs.dirs
 /etc/group
 /etc/ld.so.conf
 /etc/passwd
 /etc/pkcs11/modules/p11-kit-trust.module
 /etc/pkcs11/pkcs11.conf
 /etc/timezone
 /run/flatpak/ld.so.conf.d/*.conf
 /run/user/$UID/pulse/config
 /run/user/$UID/Xauthority
This commit is contained in:
Alexander Larsson
2018-11-12 11:30:53 +01:00
parent 08e47e9544
commit a71f6ef13b
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
common/flatpak-bwrap.c
View File

@@ -245,7 +245,7 @@ flatpak_bwrap_add_args_data (FlatpakBwrap *bwrap,
if (!flatpak_buffer_to_sealed_memfd_or_tmpfile (&args_tmpf, name, content, content_size, error))
return FALSE;
flatpak_bwrap_add_args_data_fd (bwrap, "--bind-data", glnx_steal_fd (&args_tmpf.fd), path);
flatpak_bwrap_add_args_data_fd (bwrap, "--ro-bind-data", glnx_steal_fd (&args_tmpf.fd), path);
return TRUE;
}

2
common/flatpak-run.c
View File

@@ -207,7 +207,7 @@ flatpak_run_add_x11_args (FlatpakBwrap *bwrap,
g_autofree char *dest = g_strdup_printf ("/run/user/%d/Xauthority", getuid ());
write_xauth (d, output);
flatpak_bwrap_add_args_data_fd (bwrap, "--bind-data", tmp_fd, dest);
flatpak_bwrap_add_args_data_fd (bwrap, "--ro-bind-data", tmp_fd, dest);
flatpak_bwrap_set_env (bwrap, "XAUTHORITY", dest, TRUE);
}