mirror of
https://github.com/flatpak/flatpak.git
synced 2026-10-28 10:29:42 -04:00
Sebastian Wick
22eec07b5a
fd_map_remap_fd assigns a temporary fd number (++max_fd) that may later be used as a conflict resolution target. If the source fd passed to fd_map_remap_fd is higher than max_fd, conflict resolution can assign a replacement value that collides with that source fd. In child_setup_func, the dup2 for the conflicting entry then overwrites the source fd before it is remapped, delivering the wrong fd to the child process. In practice this manifests as sandbox-expose-fd-ro passing a random fd (e.g. a socket) instead of the intended O_PATH fd to flatpak run via --ro-bind-fd, producing errors like: error: /proc/self/fd/21 resolves to non-absolute path socket:[423446] Similar error have been observed in Epiphany/WebKit: https://bugs.webkit.org/show_bug.cgi?id=305344