mirror/flatpak
1
0
Fork 0
mirror of https://github.com/flatpak/flatpak.git synced 2026-05-13 19:15:03 -04:00
Code Issues Packages Projects Releases Wiki Activity

dir: Document the apply_extra_data run flags

Browse Source 
They are the same as `flatpak run --sandbox` with two exceptions:

  * `FLATPAK_RUN_FLAG_MULTIARCH` might be required so we just add it
    always
  * `FLATPAK_RUN_FLAG_NO_PROC` is added to prevent sandbox escapes via
    `/proc/self/exe`

Signed-off-by: Sebastian Wick <sebastian.wick@redhat.com>
This commit is contained in:
Sebastian Wick
2023-07-03 16:50:44 +02:00
committed by Alexander Larsson
parent c4738f8005
commit bbac52e6af
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
common/flatpak-dir.c
View File

@@ -8328,15 +8328,22 @@ apply_extra_data (FlatpakDir *self,
"--cap-drop", "ALL",
NULL);
/* Might need multiarch in apply_extra (see e.g. #3742).
* Should be pretty safe in this limited context */
run_flags = (FLATPAK_RUN_FLAG_MULTIARCH |
/* Run flags which equal flatpak run --sandbox */
run_flags = (FLATPAK_RUN_FLAG_SANDBOX |
FLATPAK_RUN_FLAG_NO_SESSION_HELPER |
FLATPAK_RUN_FLAG_NO_PROC |
FLATPAK_RUN_FLAG_NO_SESSION_BUS_PROXY |
FLATPAK_RUN_FLAG_NO_SYSTEM_BUS_PROXY |
FLATPAK_RUN_FLAG_NO_A11Y_BUS_PROXY);
/* Might need multiarch in apply_extra (see e.g. #3742).
* Should be pretty safe in this limited context. */
run_flags |= FLATPAK_RUN_FLAG_MULTIARCH;
/* This sandbox is run as root and /proc/self/exe can sometimes be used to
* access outside files (see cd21428).
* Disable /proc entirely in this context. */
run_flags |= FLATPAK_RUN_FLAG_NO_PROC;
if (!flatpak_run_setup_base_argv (bwrap, runtime_files, NULL, runtime_arch,
run_flags, error))
return FALSE;