When --device=all is *not* passed to Flatpak, --dev is passed to bwrap,
which causes it to use an intermediate user namespace to mount devpts
because it can only be mounted as UID 0. Therefore, when expose-pids
is used, Flatpak will pass both --userns *and* --userns2 to handle
the presence of the intermediate namespace.
However, when --device=all *is* passed, there is no intermediate
namespace. Thus, setns(userns2) will fail with EINVAL. In order to
handle this, --userns2 is no longer passed if the namespace is
identical to that passed via --userns.
Fixes#3722.
We already verify that the ref is not installed on add_ref(), so we
did check for "user error". If the transaction either raced with some
other process, or the install from the install-authentitcator signal
that should not be treated as an error.
Ensure we normalize ops before requesting authentication so we
can trust the op->skip value to be set for no-op updates (which
don't need authentication).
Currently Flatpak only supports extensions which come from the same
remote as the thing being extended; for discussion on this see
https://github.com/flatpak/flatpak/issues/861
However in general it isn't clear from the metadata what remote provides
an extension. For example com.endlessm.apps.Platform//5 defines the
extension org.freedesktop.Platform.VAAPI.Intel (inherited from
org.freedesktop.Platform) which can be found on flathub not eos-sdk. So
we don't want to add an extension refspec to the transaction if the
current remote is not the one that actually provides it. In
flatpak_dir_find_remote_related_for_metadata() this invariant is
maintained because we check if the ref exists in the remote before
adding it with add_related(). However in
flatpak_dir_find_local_related_for_metadata() we check for existing
deploy data but omit checking that the deploy origin matches the origin
passed in, and in that case can accidentally add an incorrect refspec to
a transaction. So this commit adds the missing origin check.
One way to reproduce this issue is with this command, having both the
Endless platform and the VAAPI extension already installed:
$ flatpak update --no-pull com.endlessm.apps.Platform//5
Looking for updates…
error: Refspec 'eos-sdk:runtime/org.freedesktop.Platform.VAAPI.Intel/x86_64/1.6' not found
This issue also affects GNOME Software which does a no-deploy
transaction followed by a no-pull transaction (this issue occurs in the
latter) and is treated as fatal causing updates not to be applied.
However it only happens in some niche circumstances, because
flatpak_transaction_add_op() will only use the first remote passed to it
if called more than once for the same ref from different remotes. This
is normally fine; refs generally only come from one remote. But it does
mean this issue only occurs if the extension in question was not already
added to the transaction with a correct origin.
Instead of relying on the runtime tzdate we now always expose the host
/usr/share/zoneinfo in that location and make /etc/localtime a regular
symlink to it. This means applications that parse the content of the
localtime symlink will work, and additionally it means that we're
guaranteed that the host configure timezone exists (and works with)
the tzdata in the app.
This unfortunately means we no longer make the localtime an indirect
file via the session helper, and thus that localtime configurations
are static over the lifetime of an app sandbox. However, I don't
think there is a workable solution to this.
This fixes https://github.com/flatpak/flatpak/issues/3338
We only want the run dir to be overridable in unit tests because we
depend on it being /run/flatpak in flatpak-create-sideload-symlinks.sh,
so don't mention it in the flatpak man page.
Currently with the sideload implementation of offline updates you have
to manually create a symlink to your USB drive to sideload from it,
which is a regression compared to the previous implementation which
scanned all mounted filesystems in OstreeRepoFinderMount in libostree.
So this commit adds a few systemd units and a bash script so that any
time a USB drive is plugged in and automatically mounted by udisks, a
symlink to it is created in /run/flatpak/sideload-repos. When the drive
is unplugged the symlink is removed.
However this solution still has a lot of moving parts, so we may want to
instead have libflatpak use GVolumeMonitor and find the mounted
filesystems itself; see https://github.com/flatpak/flatpak/issues/3705
Fixes https://github.com/flatpak/flatpak/issues/3490
Currently we only support links in /var/lib/flatpak/sideload-repos,
/run/flatpak/sideload-repos, etc. to be actual ostree repos, but this
commit makes it so you can also link to the root directory of a USB,
and Flatpak will check the subpaths "ostree/repo", ".ostree/repo", and
".ostree/repos.d" for compatibility with "flatpak create-usb". This will
allow the logic in the following commit to be much simpler, where we're
linking to hot-plugged drives in a script run by systemd.
Note that we still only allow actual repos in the other places where a
sideload path can be specified, such as the --sideload-repo CLI option.
If a transaction requires to install an authenticator before it can
continue this signal will be emitted, allowing you to create a new
transaction to install the required authenticator.
Per the conventions around using GError, failure code paths must set a
GError if a non-NULL pointer is passed for that parameter. And in case
the error is left unset it leads to an assertion failure (and crash) in
flatpak_installation_list_installed_refs_for_update(); see
https://github.com/endlessm/flatpak/pull/224
So add assertions to the failure code paths in
flatpak_transaction_real_run() to catch such mistakes earlier and make
the resulting crash stack trace more useful, since it points closer to
where the problem is. This could be implemented with the "goto out;"
idiom but I don't think that's a good idea in this case because in the
latter half of the function we have to do some cleanup before returning.
Commits 32194f2d2 and b8d2196c2 made create-usb detect partially
installed commits and omit them except when --allow-partial is specified
(and in the case of extensions of related refs omit them
unconditionally). The reasoning was that if on the other computer using
the USB for an installation you need a different subpath of a commit
(such as a different language of a locale extension), the installation
will fail. But in most real world cases the users on both ends will
speak the same language so it will not often be an issue. Also, if you
are offline and have only your own language's subpaths for your locale
extensions, it makes sense to put them on the USB because you have no
way to get the full locale extension and the receiver probably wants the
same subpath as you.
The way "flatpak create-usb" is most often used in Endless is via
gnome-software which calls it under the hood. So while we could have it
pass --allow-partial that would not accomplish much; it doesn't solve
the problems above.
For the online case we may want to attempt to download the full locale
extensions before copying to the USB, but that is for a later commit.
Fixes https://github.com/flatpak/flatpak/issues/3491
Currently in the FlatpakTransaction implementation we add dependencies
and related refs for each operation in the transaction regardless of if
it's skipped or not. This is an issue in the case of an
end-of-life-rebased ref because in that case if the user agrees a new
install operation is added for the new ref, an uninstall operation is
added for the end-of-lifed ref, and the update operation for the
end-of-lifed one is marked as to be skipped. Then the dependencies of
the end-of-lifed ref get added to the transaction and ultimately after
all the sorting is done you end up with duplicate operations. In the
case of having org.gnome.tetravex installed, "flatpak update" yields a
transaction which uninstalls org.gnome.tetravex.Locale twice and errors
out on the second time (in addition to uninstalling org.gnome.tetravex
and installing org.gnome.Tetravex and org.gnome.Tetravex.Locale).
Fix the issue by skipping operations marked as to be skipped when adding
dependencies and related refs to the transaction.
