From c8dc4d175513e69e0f44b632afdc6d9794f93b7e Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Thu, 19 Feb 2015 19:52:17 +0100
Subject: [PATCH] xdg-app build - clean the environment

For builds, reproducability and not accidentally getting
the host environment details into the build is pretty important,
so we rebuild the entire environment, controlling exactly
what gets into it.
---
 xdg-app-builtins-build.c | 17 +++-----
 xdg-app-run.c            | 88 +++++++++++++++++++++++++++++++++++-----
 xdg-app-run.h            |  2 +
 3 files changed, 85 insertions(+), 22 deletions(-)

diff --git a/xdg-app-builtins-build.c b/xdg-app-builtins-build.c
index 35acc3671..237bbdbeb 100644
--- a/xdg-app-builtins-build.c
+++ b/xdg-app-builtins-build.c
@@ -48,6 +48,7 @@ xdg_app_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
   gs_free_error GError *my_error = NULL;
   gs_free_error GError *my_error2 = NULL;
   gs_unref_ptrarray GPtrArray *argv_array = NULL;
+  gs_unref_ptrarray GPtrArray *env_array = NULL;
   gsize metadata_size;
   const char *directory = NULL;
   const char *command = "/bin/sh";
@@ -139,19 +140,11 @@ xdg_app_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
 
   g_ptr_array_add (argv_array, NULL);
 
-  g_unsetenv ("ACLOCAL_FLAGS");
-  g_setenv ("ACLOCAL_PATH", "/self/share/aclocal", TRUE);
-  g_setenv ("C_INCLUDE_PATH", "/self/include", TRUE);
-  g_setenv ("CPLUS_INCLUDE_PATH", "/self/include", TRUE);
-  g_setenv ("GI_TYPELIB_PATH", "/self/lib/girepository-1.0", TRUE);
-  g_setenv ("LDFLAGS", "-L/self/lib ", TRUE);
-  g_setenv ("PKG_CONFIG_PATH", "/self/lib/pkgconfig:/self/share/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig", TRUE);
+  env_array = g_ptr_array_new_with_free_func (g_free);
+  xdg_app_run_setup_minimal_env (env_array, TRUE);
+  g_ptr_array_add (env_array, NULL);
 
-  g_setenv ("XDG_DATA_DIRS", "/self/share:/usr/share", TRUE);
-  g_unsetenv ("LD_LIBRARY_PATH");
-  g_setenv ("PATH", "/self/bin:/usr/bin", TRUE);
-
-  if (!execv (HELPER, (char **)argv_array->pdata))
+  if (!execve (HELPER, (char **)argv_array->pdata, (char **)env_array->pdata))
     {
       g_set_error (error, G_IO_ERROR, g_io_error_from_errno (errno), "Unable to start app");
       goto out;
diff --git a/xdg-app-run.c b/xdg-app-run.c
index 159662100..f0c3817af 100644
--- a/xdg-app-run.c
+++ b/xdg-app-run.c
@@ -92,12 +92,6 @@ xdg_app_run_add_wayland_args (GPtrArray *argv_array)
     g_free (wayland_socket);
 }
 
-void
-xdg_app_run_add_no_x11_args (GPtrArray *argv_array)
-{
-  g_unsetenv ("DISPLAY");
-}
-
 void
 xdg_app_run_add_pulseaudio_args (GPtrArray *argv_array)
 {
@@ -191,10 +185,6 @@ xdg_app_run_add_environment_args (GPtrArray *argv_array,
       g_debug ("Allowing x11 access");
       xdg_app_run_add_x11_args (argv_array);
     }
-  else
-    {
-      xdg_app_run_add_no_x11_args (argv_array);
-    }
 
   if ((g_key_file_get_boolean (metakey, "Environment", "wayland", NULL) || g_strv_contains (allow, "wayland")) &&
       !g_strv_contains (forbid, "wayland"))
@@ -224,3 +214,81 @@ xdg_app_run_add_environment_args (GPtrArray *argv_array,
       xdg_app_run_add_session_dbus_args (argv_array);
     }
 }
+
+void
+xdg_app_run_setup_minimal_env (GPtrArray *env_array,
+			       gboolean devel)
+{
+  static const char const *exports[] = {
+    "XDG_DATA_DIRS=/self/share:/usr/share",
+    "PATH=/self/bin:/usr/bin",
+    "SHELL=/bin/sh",
+  };
+  static const char const *exports_devel[] = {
+    "ACLOCAL_PATH=/self/share/aclocal",
+    "C_INCLUDE_PATH=/self/include",
+    "CPLUS_INCLUDE_PATH=/self/include",
+    "GI_TYPELIB_PATH=/self/lib/girepository-1.0",
+    "LDFLAGS=-L/self/lib ",
+    "PKG_CONFIG_PATH=/self/lib/pkgconfig:/self/share/pkgconfig:/usr/lib/pkgconfig:/usr/share/pkgconfig",
+    "LC_ALL=en_US.utf8",
+  };
+  static const char const *copy[] = {
+    "GDMSESSION",
+    "XDG_CURRENT_DESKTOP",
+    "XDG_SESSION_DESKTOP",
+    "DESKTOP_SESSION",
+    "EMAIL_ADDRESS",
+    "HOME",
+    "HOSTNAME",
+    "LOGNAME",
+    "REAL_NAME",
+    "TERM",
+    "USER",
+    "USERNAME",
+  };
+  static const char const *copy_nodevel[] = {
+    "LANG",
+    "LANGUAGE",
+    "LC_ALL",
+    "LC_ADDRESS",
+    "LC_COLLATE",
+    "LC_CTYPE",
+    "LC_IDENTIFICATION",
+    "LC_MEASUREMENT",
+    "LC_MESSAGES",
+    "LC_MONETARY",
+    "LC_NAME",
+    "LC_NUMERIC",
+    "LC_PAPER",
+    "LC_TELEPHONE",
+    "LC_TIME",
+  };
+  int i;
+
+  for (i = 0; i < G_N_ELEMENTS(exports); i++)
+    g_ptr_array_add (env_array, g_strdup (exports[i]));
+
+  if (devel)
+    {
+      for (i = 0; i < G_N_ELEMENTS(exports_devel); i++)
+	g_ptr_array_add (env_array, g_strdup (exports_devel[i]));
+    }
+
+  for (i = 0; i < G_N_ELEMENTS(copy); i++)
+    {
+      const char *current = g_getenv(copy[i]);
+      if (current)
+	g_ptr_array_add (env_array, g_strdup_printf ("%s=%s", copy[i], current));
+    }
+
+  if (!devel)
+    {
+      for (i = 0; i < G_N_ELEMENTS(copy_nodevel); i++)
+	{
+	  const char *current = g_getenv(copy_nodevel[i]);
+	  if (current)
+	    g_ptr_array_add (env_array, g_strdup_printf ("%s=%s", copy_nodevel[i], current));
+	}
+    }
+}
diff --git a/xdg-app-run.h b/xdg-app-run.h
index b9088edab..1925d6909 100644
--- a/xdg-app-run.h
+++ b/xdg-app-run.h
@@ -7,6 +7,8 @@ void     xdg_app_run_add_environment_args    (GPtrArray   *argv_array,
 					      GKeyFile    *metakey,
 					      const char **allow,
 					      const char **forbid);
+void     xdg_app_run_setup_minimal_env       (GPtrArray   *env_array,
+					      gboolean     devel);
 
 void xdg_app_run_add_x11_args          (GPtrArray *argv_array);
 void xdg_app_run_add_no_x11_args       (GPtrArray *argv_array);