From ccd9c8a7fa8bee1b728e683c2d478f4408cd651c Mon Sep 17 00:00:00 2001 From: Simon McVittie Date: Wed, 8 Apr 2026 09:44:55 +0100 Subject: [PATCH] run: Mount original app on /run/parent/app when using --app-path="" Before addressing CVE-2026-34078, we would always mount the original app *somewhere*, either /app (in the normal case) or /run/parent/app (when using a custom or empty /app for the subsandbox). The empty-app case regressed during the fix for CVE-2026-34078; bring back previous behaviour. Fixes: ac62ebe3 "run: Use O_PATH fds for the runtime and app deploy directories" Resolves: https://github.com/flatpak/flatpak/issues/6568 Signed-off-by: Simon McVittie (cherry picked from commit fde4716f67b6620da57fd74481694eb58795d589) --- common/flatpak-run.c | 1 + 1 file changed, 1 insertion(+) diff --git a/common/flatpak-run.c b/common/flatpak-run.c index f44c66ffa..b90af6720 100644 --- a/common/flatpak-run.c +++ b/common/flatpak-run.c @@ -3335,6 +3335,7 @@ flatpak_run_app (FlatpakDecomposed *app_ref, } else if (custom_app_fd == FLATPAK_RUN_APP_DEPLOY_APP_EMPTY) { + original_app_target_path = "/run/parent/app"; app_fd = -1; app_files = NULL; }