BundleData retains explicit GPG key data with g_bytes_ref(), but its
cleanup treats the data as a GObject. This crashes transaction cleanup
when a bundle is installed with explicit key bytes.
Use g_clear_pointer() with g_bytes_unref() to release the retained data.
Parse the cursor as a long before narrowing it to the completion
structure's integer field. This lets malformed, negative, and overflowing
positions fail before they can index outside the command-line buffer, while
preserving the existing behavior of clamping positive positions beyond the
line length.
libglnx v2017.2-255-g2ed30d8
* chase: Pass NO_AUTOMOUNT to chase_open_tree in shortcut path
* chase: Fix incorrect comment
* build: Suppress `-Wmissing-field-initializers`
* fdio: Don't change ownership of symlinks if not requested
(Resolves: https://github.com/flatpak/flatpak-builder/issues/770)
* fdio: Don't try to use fd-relative operations to set symlink xattrs
(Resolves: https://github.com/flatpak/flatpak/issues/6818)
Signed-off-by: Simon McVittie <smcv@collabora.com>
g_format_size() output is unit-suffixed and locale-dependent, which
makes it awkward to sort or parse in scripts.
-b/--bytes prints a plain byte count; human-readable remains the
default. Also update the man page, the completion test and the tests.
flatpak_context_to_args() built the D-Bus name options from
flatpak_policy_to_string(). That function gives the values used in the
[Session Bus Policy] and [System Bus Policy] metadata groups. Two of
them, "none" and "see", are not command-line options. A context that
contained such a policy gave --none-name= and --system-none-name=.
flatpak-run(1) writes these arguments to the [Instance] extra-args of
/.flatpak-info. flatpak-portal gives them back to flatpak(1) when a
sandboxed app calls flatpak-spawn(1). flatpak(1) then rejected the whole
command line with "Unknown option --none-name=...", so --no-talk-name
and --system-no-talk-name broke flatpak-spawn(1).
Map each policy to the option that sets it: --no-talk-name for
FLATPAK_POLICY_NONE, --talk-name for FLATPAK_POLICY_TALK, and --own-name
for FLATPAK_POLICY_OWN. FLATPAK_POLICY_SEE has no command-line option,
so emit nothing for it. It cannot occur here: the only caller serializes
a context that comes from the command line.
A decimal-aligned cell padded itself to widths[j], the natural column
width, while the title row and left-aligned cells padded themselves to
len, the width after expansion and ellipsization. In a table with an
expanding decimal column the title row and the cells therefore ended at
different offsets, and every column after the decimal one lost its
alignment. A cell with no decimal point in it used the left-aligned path,
so it stayed with the title row while its neighbours in the same column
moved.
The natural width of a decimal column is also not the width of its widest
cell: the cells split at the decimal point, so the column needs
lwidths[i] characters before the point and rwidths[i] after it. Take that
into account, so the trailing padding can no longer go negative and push
the rest of the row to the right.
Now that our error messages are valid UTF-8, we should no longer need to
do this.
This reverts commit 242e9893e7.
Signed-off-by: Simon McVittie <smcv@collabora.com>
While I'm changing the translatable string anyway, this also
incorporates a suggestion from #6753 to quote the invalid character, so
that output is clearer in the case where the invalid character is
whitespace.
Thanks: Christian Stadelmann
Signed-off-by: Simon McVittie <smcv@collabora.com>
Until now we have been using `%c` to show invalid characters, but in
general that will corrupt our output if the input is non-ASCII,
because the individual bytes of a UTF-8 string are not valid UTF-8 alone.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Instead of announcing ahead of time how many tests will be run, just
log 1..32 or similar at the end, from the done_testing function.
This should go some way towards preventing unnecessary cherry-pick
conflicts when tests added to this script get backported.
Resolves: https://github.com/flatpak/flatpak/issues/6793
Signed-off-by: Simon McVittie <smcv@collabora.com>
This is the equivalent of the function of the same name in Perl's
Test::More. If we already emitted a test plan, it asserts that the
number of tests we planned to do equals the number we actually did.
If not, it assumes that however many tests we have done, that's all of
the tests that we intend to do - this can be useful in test scripts
that routinely increase in length, like test-run.sh which is becoming
rather long (and has frequent conflicts for the "plan" line when we
cherry-pick new test coverage to older branches).
Signed-off-by: Simon McVittie <smcv@collabora.com>
This is approximately the equivalent of 'plan' in Perl Test::More:
it announces how many tests we plan to run.
Signed-off-by: Simon McVittie <smcv@collabora.com>
This will help us to emit correct TAP syntax, without having to always
declare up-front how many tests we are going to run.
Signed-off-by: Simon McVittie <smcv@collabora.com>
We now have subprojects for a few dependencies. libglnx and
variant-schema-compiler used to be git subtrees and we recommend
distributions to use those vendored dependencies. We turned them into
meson wraps, which means they are no longer vendored in. We can include
them with --include-subprojects, but then we have to make sure that the
subprojects we recommend to use from the system (bwrap and
xdg-dbus-proxy) are disabled.
It is not a meson project, but we can use the patch_directory key to
overlay a meson.build file over the git checkout. It uses
meson.override_find_program so that in flatpak, a call to
find_program('variant-schema-compiler') will find the program.
After creating the symlink, open it with O_PATH to pin the inode and
verify the target matches. All subsequent operations (xattrs, chown) go
through the pinned fd instead of path-based operations.
From openat2(2):
EAGAIN how.resolve contains either RESOLVE_IN_ROOT or
RESOLVE_BENEATH, and the kernel could not ensure that a
".." component didn't escape (due to a race condition or
potential attack). The caller may choose to retry the
openat2() call.
We should handle this by simply retrying the syscall.
Reject summaries, subsummaries, and summary indexes that are not in
GVariant normal form before passing them to the generated variant
accessor framework, which performs direct pointer arithmetic without
structural validation.
The cache_dirs_in_use tracks the cache dirs, and which pull it is
associated with. It can also be associated with no pull anymore in which
case the value is NULL.
The iteration over cache_dirs_in_use thus needs to handle NULL values.
fd_map_remap_fd assigns a temporary fd number (++max_fd) that may later
be used as a conflict resolution target. If the source fd passed to
fd_map_remap_fd is higher than max_fd, conflict resolution can assign
a replacement value that collides with that source fd. In
child_setup_func, the dup2 for the conflicting entry then overwrites
the source fd before it is remapped, delivering the wrong fd to the
child process.
In practice this manifests as sandbox-expose-fd-ro passing a random fd
(e.g. a socket) instead of the intended O_PATH fd to flatpak run via
--ro-bind-fd, producing errors like:
error: /proc/self/fd/21 resolves to non-absolute path socket:[423446]
Similar error have been observed in Epiphany/WebKit:
https://bugs.webkit.org/show_bug.cgi?id=305344
We require glib 2.46, so we can't rely on g_hash_table_new_similar.
Fixes: 17cb1135 ("context: Keep fallback-x11 separate from x11 conditionals")
Closes: #6775
On architectures like i386, socket operations were historically
multiplexed through the socketcall syscall. The seccomp socket family
filter only applied to the direct socket syscall, so a binary using
socketcall could bypass it entirely.
Switch from seccomp_rule_add_exact to seccomp_rule_add, which lets
libseccomp also block socketcall. Since libseccomp cannot inspect
socketcall arguments (they are behind a userspace pointer), this
blocks all of socketcall, forcing userspace to use the direct socket
syscalls that have been available on i386 since Linux 4.3.
Older versions of Meson parsed TAP output very strictly, and would fail
the test when a `g_test_message()` mentions non-UTF-8, which results
in GLib adding a prefix on stdout that is not valid TAP syntax.
Ideally our error messages should all be valid UTF-8 even if the input
is not, but that's a larger refactor that shouldn't block security fix
releases, so for now just tell Meson to get the tests' pass/fail status
from their exit status rather than parsing their stdout.
Signed-off-by: Simon McVittie <smcv@collabora.com>
Razze