mirror of
https://github.com/flatpak/flatpak.git
synced 2026-10-08 22:16:10 -04:00
Simon McVittie
0902090726
On entry to `flatpak run`, these fds have been inheritable (not FD_CLOEXEC), otherwise they would not have been inherited; but we don't want the "payload" command to inherit them, so set them as non-close-on-exec as soon as we receive them. In the cases where we pass them down to the underlying bwrap command, we'll either dup them, or set them to be inheritable again (in practice we dup them). In particular, Chromium-derived web browsers get very upset when their subsandbox processes inherit unexpected fds, which has been causing crashes with no useful diagnostic information since CVE-2026-34078 was fixed. Fixes:1b5e886d"run: Add --usr-fd and --app-fd options" Fixes:b5ae89ed"run: Add --(ro-)bind-fd options" Resolves: https://github.com/flatpak/flatpak/issues/6582 Signed-off-by: Simon McVittie <smcv@collabora.com>