Sebastian Wick 1000c71d40 dir: Use fd-relative operations for files/etc during runtime deploy ...

The runtime deploy path used GFile operations to manipulate files
inside files/etc (passwd, group, machine-id, resolv.conf). While
the "files" directory is validated with glnx_chaseat using
GLNX_CHASE_RESOLVE_NO_SYMLINKS, "etc" inside it is not checked.
A malicious runtime with files/etc as a symlink causes the GFile
operations (g_file_delete, g_file_replace_contents,
g_file_make_symbolic_link) to follow it and modify files at the
symlink target. On system installs (running as root), this modifies
arbitrary files — e.g. replacing /etc/resolv.conf.

This commit uses fd-based operations to prevent to prevent the symlink
attack.

Resolves: CVE-2026-97024
Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-8xgq-v545-vgvf

2026-09-28 09:44:36 +01:00

..

flatpak-appdata-private.h

flatpak-appdata: Add support for extracting app content ratings

2019-10-03 10:42:04 +02:00

flatpak-appdata.c

appdata: Fix sscanf format mismatch for date parsing

2026-09-22 10:21:15 +00:00

flatpak-auth-private.h

authenticator: Fix sandboxed authenticators

2019-12-19 10:33:21 +01:00

flatpak-auth.c

auth: Return NULL instead of FALSE in pointer-returning function

2026-07-27 13:41:00 +00:00

flatpak-bundle-ref.c

bundle-ref: Use g_clear_pointer for nullable GBytes fields

2026-08-04 11:38:22 +00:00

flatpak-bundle-ref.h

Add G_BEGIN_DECLS/G_END_DECLS to public headers

2021-02-12 15:58:09 +01:00

flatpak-bwrap-private.h

flatpak-bwrap: Add dup-ing variant flatpak_bwrap_add_args_data_fd_dup

2026-04-07 16:17:51 -04:00

flatpak-bwrap.c

common: Put each bubblewrap child process in its own process group

2026-09-28 09:44:36 +01:00

flatpak-chain-input-stream-private.h

common: Stop using G_GNUC_CONST in _get_type funcs

2026-07-06 08:23:01 +00:00

flatpak-chain-input-stream.c

chain-input-stream: Close all child streams on close

2026-08-04 11:38:22 +00:00

flatpak-common-types-private.h

Revert "run: Add --no-scope to flatpak run"

2026-04-07 15:13:44 +00:00

flatpak-context-private.h

context: Add USB Portal conditional

2026-04-16 10:37:45 +00:00

flatpak-context.c

context: Emit valid option names for D-Bus name policies

2026-09-18 14:47:43 +00:00

flatpak-dir-private.h

dir: Add fd-relative helpers for accessing deploy directories

2026-09-28 09:44:36 +01:00

flatpak-dir-utils-private.h

common: Break out the parts of flatpak-utils that deal with FlatpakDir

2024-07-09 17:12:55 -03:00

flatpak-dir-utils.c

dir-utils: Reject path traversal in extension metadata

2026-08-10 23:06:17 +02:00

flatpak-dir.c

dir: Use fd-relative operations for files/etc during runtime deploy

2026-09-28 09:44:36 +01:00

flatpak-docker-reference-private.h

image-source: Add flatpak_image_source_new_for_location

2025-08-25 15:56:20 +00:00

flatpak-docker-reference.c

docker-reference: Validate domain in docker_reference_parse

2026-08-04 11:38:22 +00:00

flatpak-enum-types.c.template

enum-types: Make generated files more reproducible

2022-09-07 09:21:58 +02:00

flatpak-enum-types.h.template

enum-types: Explicitly set the enum nick in some cases

2026-07-27 13:41:00 +00:00

flatpak-error.c

Run uncrustify

2019-02-25 18:12:30 +00:00

flatpak-error.h

fix: cross typos, detail below

2026-01-21 17:58:19 +00:00

flatpak-exports-private.h

exports: add host-root

2025-09-24 17:19:21 +00:00

flatpak-exports.c

exports: Add recursion depth limit to flatpak_exports_path_get_mode

2026-07-27 13:41:00 +00:00

flatpak-glib-backports-private.h

glib-backports: Add g_set_str from 2.84.1

2025-08-26 11:51:07 +00:00

flatpak-glib-backports.c

glib-backports: Use g_ascii_string_to_unsigned if GLib is new enough

2023-05-17 11:35:44 +01:00

flatpak-image-collection-private.h

image-collection: Add the new FlatpakImageCollection class

2025-10-24 16:27:33 +00:00

flatpak-image-collection.c

image-collection: Guard against NULL manifests

2026-08-04 11:38:22 +00:00

flatpak-image-source-private.h

common: Check signatures when installing OCI images

2025-12-08 19:09:56 +00:00

flatpak-image-source.c

image-source: Handle NULL commit subjects and bodies

2026-07-27 13:41:00 +00:00

flatpak-installation-private.h

Export (private) flatpak_installation_get_dir()

2019-10-02 14:57:11 +02:00

flatpak-installation.c

system-dir: Prevent removing of deployed refs via the system-helper

2026-08-11 01:22:28 +02:00

flatpak-installation.h

common: Report the age of the configuration

2026-04-20 14:00:20 +00:00

flatpak-installed-ref-private.h

installation: Use the FlatpakDecomposed APIs to create FlatpakRef:s

2020-11-05 10:43:10 +01:00

flatpak-installed-ref.c

Revert "Add support for files generated by appstreamcli compose (#5277)"

2023-02-04 12:30:15 -06:00

flatpak-installed-ref.h

Add G_BEGIN_DECLS/G_END_DECLS to public headers

2021-02-12 15:58:09 +01:00

flatpak-instance-private.h

flatpak-instance: Make constructing failable

2026-07-27 13:41:00 +00:00

flatpak-instance.c

flatpak-instance: Make constructing failable

2026-07-27 13:41:00 +00:00

flatpak-instance.h

Add G_BEGIN_DECLS/G_END_DECLS to public headers

2021-02-12 15:58:09 +01:00

flatpak-json-backports-private.h

common: Move json-glib backports to their own file

2023-05-17 11:35:44 +01:00

flatpak-json-oci-private.h

json-oci: Make FlatpakOciSignature just a simple signature

2025-12-08 19:09:56 +00:00

flatpak-json-oci.c

json-oci: Clean up dead code in flatpak_oci_index_get_manifest_for_arch

2026-07-27 13:41:00 +00:00

flatpak-json-private.h

Make mandatory properties from OCI specifications mandatory

2026-06-16 20:13:10 +00:00

flatpak-json.c

flatpak-json: Fix strict struct JSON parsing

2026-07-27 13:41:00 +00:00

flatpak-locale-utils-private.h

common: Move locale utils to their own small translation unit

2023-11-14 18:39:22 +00:00

flatpak-locale-utils.c

locale-utils: Ensure the flatpak lang only contains a-zA-Z

2026-07-27 13:41:00 +00:00

flatpak-metadata-private.h

flatpak: Add USB enumerables / hidden lists

2024-10-16 14:11:56 -03:00

flatpak-oci-registry-private.h

oci-registry: Check signatures from mirrored repo in the system helper

2026-06-11 18:26:52 +00:00

flatpak-oci-registry.c

oci: Rebase hardlink targets in OCI archive extraction

2026-08-11 01:22:28 +02:00

flatpak-oci-signatures-private.h

common: Check signatures when installing OCI images

2025-12-08 19:09:56 +00:00

flatpak-oci-signatures.c

Handle null properties as missing properties

2026-06-16 20:13:10 +00:00

flatpak-parental-controls-private.h

dir: Support filtering app installs/upgrades by user’s OARS settings

2019-10-03 10:42:04 +02:00

flatpak-parental-controls.c

common: Use g_info() for messages that will be shown by flatpak -v

2022-12-15 16:45:35 +00:00

flatpak-permission-utils-private.h

user-data: Expose app data deletion in libflatpak

2026-09-23 09:28:18 +00:00

flatpak-permission-utils.c

user-data: Expose app data deletion in libflatpak

2026-09-23 09:28:18 +00:00

flatpak-portal-error.c

common: Move flatpak-portal-error.[ch] back to common code

2018-04-26 07:41:17 +00:00

flatpak-portal-error.h

doc: Document FlatpakPortalError

2019-12-01 14:04:59 -05:00

flatpak-progress-private.h

transaction: Add flatpak_transaction_progress_get_bytes_per_second()

2026-06-23 09:50:04 +00:00

flatpak-progress.c

progress: Clamp to avoid unsigned underflow if fetched exceeds total

2026-07-27 13:41:00 +00:00

flatpak-prune-private.h

common: Explicitly include ostree.h where needed

2024-07-09 17:12:55 -03:00

flatpak-prune.c

prune: Fix object equality check comparing a to itself

2026-07-27 13:41:00 +00:00

flatpak-ref-utils-private.h

ref-utils: Make remote name validation public and take an error

2026-08-10 23:06:17 +02:00

flatpak-ref-utils.c

ref-utils: Always produce valid UTF-8 in validation error messages

2026-08-21 16:07:48 +00:00

flatpak-ref.c

utils: Remove unnecessary flatpak-ref-utils-private.h inclusion

2024-07-09 17:12:55 -03:00

flatpak-ref.h

Add G_BEGIN_DECLS/G_END_DECLS to public headers

2021-02-12 15:58:09 +01:00

flatpak-related-ref-private.h

Drop more collection_id use

2020-03-23 17:58:04 +01:00

flatpak-related-ref.c

Add a vim modeline and .editorconfig

2022-08-22 19:48:10 -07:00

flatpak-related-ref.h

Add G_BEGIN_DECLS/G_END_DECLS to public headers

2021-02-12 15:58:09 +01:00

flatpak-remote-private.h

lib: Only support FLATPAK_REMOTE_TYPE_STATIC remote types

2020-03-25 08:52:28 +01:00

flatpak-remote-ref-private.h

installation: Use the FlatpakDecomposed APIs to create FlatpakRef:s

2020-11-05 10:43:10 +01:00

flatpak-remote-ref.c

remote-ref: Fix the get_property of the download-size property

2026-07-27 13:41:00 +00:00

flatpak-remote-ref.h

Add G_BEGIN_DECLS/G_END_DECLS to public headers

2021-02-12 15:58:09 +01:00

flatpak-remote.c

typo: Fix URL usages

2026-01-05 21:16:15 +05:30

flatpak-remote.h

Add G_BEGIN_DECLS/G_END_DECLS to public headers

2021-02-12 15:58:09 +01:00

flatpak-repo-utils-private.h

transaction, remote-info: Include extra-data in download size estimate

2026-09-22 10:23:32 +00:00

flatpak-repo-utils.c

transaction, remote-info: Include extra-data in download size estimate

2026-09-22 10:23:32 +00:00

flatpak-run-cups-private.h

common: Split up socket setup from flatpak-run into multiple files

2023-05-15 19:54:51 +01:00

flatpak-run-cups.c

fix: cross typos, detail below

2026-01-21 17:58:19 +00:00

flatpak-run-dbus-private.h

context: Support condtional permissions for socket and devices

2025-10-13 18:31:33 +00:00

flatpak-run-dbus.c

run-dbus: Correct --broadcast rules for the AT-SPI bus

2026-08-10 23:06:17 +02:00

flatpak-run-private.h

run: Add (ro-)bind fds to flatpak_run_app

2026-04-07 16:17:51 -04:00

flatpak-run-pulseaudio-private.h

common: Split up socket setup from flatpak-run into multiple files

2023-05-15 19:54:51 +01:00

flatpak-run-pulseaudio.c

fix: cross typos, detail below

2026-01-21 17:58:19 +00:00

flatpak-run-sockets-private.h

common: add support for Wayland security context

2023-08-24 12:17:53 +02:00

flatpak-run-sockets.c

run-sockets: Fix a memory leak in flatpak_run_add_gpg_agent_args

2026-07-27 13:41:00 +00:00

flatpak-run-wayland-private.h

context: Support condtional permissions for socket and devices

2025-10-13 18:31:33 +00:00

flatpak-run-wayland.c

wayland: Create the socket with SOCK_CLOEXEC and use glnx_autofd

2026-07-27 13:41:00 +00:00

flatpak-run-x11-private.h

common: Split up socket setup from flatpak-run into multiple files

2023-05-15 19:54:51 +01:00

flatpak-run-x11.c

Use g_steal_fd()

2023-09-04 13:25:32 +01:00

flatpak-run.c

run: Forward documents using the sandbox mount path

2026-09-24 12:04:14 +00:00

flatpak-syscalls-private.h

common: Add a list of recently-added Linux syscalls

2021-10-08 12:53:20 +02:00

flatpak-transaction-private.h

Transaction: Ensure we download the subsummary for the arch of added refs

2021-05-19 09:49:30 +02:00

flatpak-transaction.c

transaction, remote-info: Include extra-data in download size estimate

2026-09-22 10:23:32 +00:00

flatpak-transaction.h

enum-types: Explicitly set the enum nick in some cases

2026-07-27 13:41:00 +00:00

flatpak-uri-private.h

uri: Don't do scheme-based normalization with GLib 2.66.x

2022-09-06 13:20:05 +02:00

flatpak-uri.c

uri: Don't rely on g_time_zone_new_offset()

2022-09-07 09:21:19 +02:00

flatpak-usb-private.h

context: Implement device lists for usb

2024-10-16 14:11:56 -03:00

flatpak-usb.c

usb: Parse the vnd rule into the vendor union member

2026-07-27 13:41:00 +00:00

flatpak-user-data-utils.c

user-data: Expose app data deletion in libflatpak

2026-09-23 09:28:18 +00:00

flatpak-user-data-utils.h

user-data: Expose app data deletion in libflatpak

2026-09-23 09:28:18 +00:00

flatpak-utils-base-private.h

session-helper: track the destinations of broken symlinks

2025-10-13 19:02:44 +00:00

flatpak-utils-base.c

session-helper: track the destinations of broken symlinks

2025-10-13 19:02:44 +00:00

flatpak-utils-http-private.h

common: Implement /etc/containers/certs.d for OCI registries

2025-05-08 16:08:21 +00:00

flatpak-utils-http.c

Revert "http: Reset curl TLS options between transfers"

2026-08-10 20:28:11 +00:00

flatpak-utils-private.h

utils: Add a function to describe invalid characters in strings

2026-08-21 16:07:48 +00:00

flatpak-utils.c

utils: Avoid corrupting our output if an invalid glob is not UTF-8

2026-08-21 16:07:48 +00:00

flatpak-version-macros.h.in

doc: Fix a duplicate section

2019-12-02 07:45:51 -05:00

flatpak-xml-utils-private.h

xml-utils: Don't expose symbols that don't need to be visble

2024-05-03 13:21:29 +01:00

flatpak-xml-utils.c

xml-utils: Escape XML attribute values when serializing

2026-07-27 13:41:00 +00:00

flatpak-zstd-compressor-private.h

flatpak-build-bundle: Add --oci-layer-compress=zstd

2025-11-20 17:30:07 +00:00

flatpak-zstd-compressor.c

zstd-compressor: Abort on ZSTD_initCStream error

2026-07-27 13:41:00 +00:00

flatpak-zstd-decompressor-private.h

zstd-decompressor: Replace boilerplate with G_DECLARE_FINAL_TYPE macro

2025-11-20 17:30:07 +00:00

flatpak-zstd-decompressor.c

oci: Make libzstd optional (and disable OCI deltas if not there)

2020-06-05 09:35:30 +02:00

flatpak.c

Merge lib/* into common

2018-05-24 11:59:52 +00:00

flatpak.h

user-data: Expose app data deletion in libflatpak

2026-09-23 09:28:18 +00:00

meson.build

user-data: Expose app data deletion in libflatpak

2026-09-23 09:28:18 +00:00

test-lib.c

build: Consistently include libglnx header as "libglnx.h"

2022-04-11 10:32:34 +02:00

valgrind-private.h

fix: cross typos, detail below

2026-01-21 17:58:19 +00:00