mirror of
https://github.com/flatpak/flatpak.git
synced 2026-01-06 06:48:01 -05:00
bb46c1dbd6
Historycally the system helper has been running in a generic
unconfined_service_t domain. However, this caused problems with the
new revokefs support, because passing the revokefs unix domain socket
over the system bus got it kicked of the bus, because to do this
dbus-daemon needs rw rights to the socket.
So, this module creates a custom domain flatpak_helper_t, which
allows us to add special permissions to dbus-daemon to allow
access to its sockets.
The domain is otherwise uncontained just like before. I did try
to make it contained, but that is a lot of work as the permissions
it needs are very complex.
Note to packagers on selinux systems, for flatpak to work well
you need to install this module and relabel the system-helper
binary.
In my testing on fedora I used something like this:
%post
%selinux_modules_install %{_datadir}/selinux/packages/flatpak.pp.bz2
%postun
if [ $1 -eq 0 ]; then
%selinux_modules_uninstall %{_datadir}/selinux/packages/flatpak.pp.bz2
fi
With these new files:
%{_datadir}/selinux/packages/flatpak.pp.bz2
%{_datadir}/selinux/devel/include/contrib/flatpak.if
Closes: #2657
Approved by: alexlarsson
192 lines
5.2 KiB
Makefile
192 lines
5.2 KiB
Makefile
NULL =
|
|
|
|
bin_PROGRAMS = $(NULL)
|
|
dist_installed_test_extra_scripts = $(NULL)
|
|
noinst_PROGRAMS = $(NULL)
|
|
noinst_LTLIBRARIES = $(NULL)
|
|
libexec_PROGRAMS = $(NULL)
|
|
CLEANFILES = $(NULL)
|
|
MAINTAINERCLEANFILES = $(NULL)
|
|
DISTCLEANFILES= $(NULL)
|
|
BUILT_SOURCES = $(NULL)
|
|
EXTRA_DIST =
|
|
|
|
include $(top_srcdir)/buildutil/glib-tap.mk
|
|
|
|
SUBDIRS =
|
|
|
|
|
|
if BUILD_DOCUMENTATION
|
|
SUBDIRS += . doc
|
|
endif
|
|
|
|
SUBDIRS += po
|
|
|
|
%.service: %.service.in config.log
|
|
$(AM_V_GEN) $(SED) -e "s|\@libexecdir\@|$(libexecdir)|" \
|
|
-e "s|\@localstatedir\@|$(localstatedir)|" \
|
|
-e "s|\@extraargs\@||" $< > $@
|
|
|
|
dbus_servicedir = $(DBUS_SERVICE_DIR)
|
|
service_in_files = $(NULL)
|
|
dbus_service_DATA = $(NULL)
|
|
systemduserunit_DATA = $(NULL)
|
|
CLEANFILES += $(dbus_service_DATA)
|
|
CLEANFILES += $(systemduserunit_DATA)
|
|
EXTRA_DIST += $(service_in_files)
|
|
|
|
FLATPAK_BINDIR=$(bindir)
|
|
|
|
ACLOCAL_AMFLAGS = -I m4 -I libglnx ${ACLOCAL_FLAGS}
|
|
AM_CPPFLAGS = \
|
|
-DFLATPAK_BINDIR=\"$(FLATPAK_BINDIR)\" \
|
|
-DFLATPAK_SYSTEMDIR=\"$(SYSTEM_INSTALL_DIR)\" \
|
|
-DFLATPAK_CONFIGDIR=\"$(sysconfdir)/flatpak\" \
|
|
-DFLATPAK_BASEDIR=\"$(pkgdatadir)\" \
|
|
-DFLATPAK_TRIGGERDIR=\"$(pkgdatadir)/triggers\" \
|
|
-DSYSTEM_FONTS_DIR=\"$(SYSTEM_FONTS_DIR)\" \
|
|
-DSYSTEM_HELPER_USER=\"$(SYSTEM_HELPER_USER)\" \
|
|
-DSYSTEM_FONT_CACHE_DIRS=\"$(SYSTEM_FONT_CACHE_DIRS)\" \
|
|
-DG_LOG_DOMAIN=\"flatpak\" \
|
|
-I$(srcdir)/libglnx \
|
|
-I$(srcdir)/common \
|
|
-I$(builddir)/common \
|
|
-include "config.h" \
|
|
$(NULL)
|
|
|
|
AM_CFLAGS = $(WARN_CFLAGS)
|
|
|
|
if WITH_SYSTEM_BWRAP
|
|
AM_CPPFLAGS += -DHELPER=\"$(BWRAP)\"
|
|
else
|
|
AM_CPPFLAGS += -DHELPER=\"$(libexecdir)/flatpak-bwrap\"
|
|
endif
|
|
|
|
if WITH_SYSTEM_DBUS_PROXY
|
|
AM_CPPFLAGS += -DDBUSPROXY=\"$(DBUS_PROXY)\"
|
|
else
|
|
AM_CPPFLAGS += -DDBUSPROXY=\"$(libexecdir)/flatpak-dbus-proxy\"
|
|
endif
|
|
|
|
triggersdir = $(pkgdatadir)/triggers
|
|
dist_triggers_SCRIPTS = \
|
|
triggers/gtk-icon-cache.trigger \
|
|
triggers/mime-database.trigger \
|
|
triggers/desktop-database.trigger \
|
|
$(NULL)
|
|
|
|
# This canonicalizes the PKG_CHECK_MODULES or AM_PATH_GPGME results
|
|
INTERNAL_GPGME_CFLAGS = $(DEP_GPGME_CFLAGS) $(GPGME_PTHREAD_CFLAGS)
|
|
INTERNAL_GPGME_LIBS = $(DEP_GPGME_LIBS) $(GPGME_PTHREAD_LIBS)
|
|
|
|
lib_LTLIBRARIES =
|
|
noinst_LTLIBRARIES += libglnx.la
|
|
libglnx_srcpath := $(srcdir)/libglnx
|
|
libglnx_cflags := \
|
|
$(BASE_CFLAGS) \
|
|
"-I$(libglnx_srcpath)" \
|
|
-std=gnu99 \
|
|
$(HIDDEN_VISIBILITY_CFLAGS) \
|
|
$(NULL)
|
|
libglnx_libs := $(BASE_LIBS)
|
|
include libglnx/Makefile-libglnx.am.inc
|
|
|
|
include common/Makefile.am.inc
|
|
include data/Makefile.am.inc
|
|
include app/Makefile.am.inc
|
|
include session-helper/Makefile.am.inc
|
|
include portal/Makefile.am.inc
|
|
include system-helper/Makefile.am.inc
|
|
include icon-validator/Makefile.am.inc
|
|
include revokefs/Makefile.am.inc
|
|
include selinux/Makefile.am.inc
|
|
include tests/Makefile.am.inc
|
|
|
|
if !WITH_SYSTEM_DBUS_PROXY
|
|
libexec_PROGRAMS+=flatpak-dbus-proxy
|
|
flatpak_dbus_proxy_SOURCES = \
|
|
dbus-proxy/flatpak-proxy.c \
|
|
dbus-proxy/flatpak-proxy.h \
|
|
dbus-proxy/dbus-proxy.c \
|
|
dbus-proxy/backport-autoptr.h \
|
|
$(NULL)
|
|
flatpak_dbus_proxy_LDADD = $(AM_LDADD) $(BASE_LIBS)
|
|
flatpak_dbus_proxy_CFLAGS = $(AM_CFLAGS) $(BASE_CFLAGS)
|
|
endif
|
|
|
|
if !WITH_SYSTEM_BWRAP
|
|
|
|
bwrap_PROGRAMS = flatpak-bwrap
|
|
flatpak_bwrap_SOURCES = $(bwrap_SOURCES)
|
|
flatpak_bwrap_CFLAGS = $(AM_CFLAGS) $(bwrap_CFLAGS)
|
|
flatpak_bwrap_LDADD = $(AM_LDADD) $(bwrap_LDADD) $(CAP_LIB)
|
|
bwrapdir = $(libexecdir)
|
|
include bubblewrap/Makefile-bwrap.am.inc
|
|
|
|
endif # !WITH_SYSTEM_BWRAP
|
|
|
|
# NOTE: bwrap is install-bwrapPROGS which is run from install-data, not install-exec, this data-hook is used
|
|
install-data-hook:
|
|
$(MAKE) $(AM_MAKEFLAGS) install-test-data-hook
|
|
if !WITH_SYSTEM_BWRAP
|
|
if PRIV_MODE_SETUID
|
|
$(SUDO_BIN) chown root $(DESTDIR)$(libexecdir)/flatpak-bwrap
|
|
$(SUDO_BIN) chmod u+s $(DESTDIR)$(libexecdir)/flatpak-bwrap
|
|
endif # !PRIV_MODE_SETUID
|
|
endif # !WITH_SYSTEM_BWRAP
|
|
|
|
bashcompletiondir = $(datadir)/bash-completion/completions
|
|
bashcompletion_DATA = completion/flatpak
|
|
EXTRA_DIST += $(bashcompletion_DATA)
|
|
|
|
zshcompletiondir = $(datadir)/zsh/site-functions
|
|
zshcompletion_DATA = completion/_flatpak
|
|
EXTRA_DIST += $(zshcompletion_DATA)
|
|
|
|
profiledir = $(PROFILE_DIR)
|
|
profile_DATA = profile/flatpak.sh
|
|
EXTRA_DIST += $(profile_DATA)
|
|
|
|
envdir = $(datadir)/gdm/env.d
|
|
env_DATA = flatpak.env
|
|
EXTRA_DIST += env.d/flatpak.env.in env.d/60-flatpak
|
|
DISTCLEANFILES += flatpak.env
|
|
|
|
flatpak.env: env.d/flatpak.env.in
|
|
$(AM_V_GEN) $(SED) -e "s|\@localstatedir\@|$(localstatedir)|" \
|
|
-e "s|\@sysconfdir\@|$(sysconfdir)|" $< > $@
|
|
|
|
envgendir = $(systemduserenvgendir)
|
|
envgen_SCRIPTS = env.d/60-flatpak
|
|
|
|
pkgconfigdir = $(libdir)/pkgconfig
|
|
pkgconfig_DATA = flatpak.pc
|
|
EXTRA_DIST += flatpak.pc.in
|
|
|
|
scriptsdir = $(bindir)
|
|
scripts_SCRIPTS = scripts/flatpak-bisect scripts/flatpak-coredumpctl
|
|
EXTRA_DIST += scripts/flatpak-bisect scripts/flatpak-coredumpctl
|
|
|
|
EXTRA_DIST += README.md
|
|
|
|
EXTRA_DIST += flatpak.png
|
|
|
|
AM_DISTCHECK_CONFIGURE_FLAGS = \
|
|
--enable-documentation \
|
|
--disable-maintainer-mode \
|
|
--enable-introspection
|
|
|
|
.PHONY: coverage lcov-clean genlcov
|
|
|
|
coverage:
|
|
$(AM_V_GEN) $(MAKE) $(AM_MAKEFLAGS) lcov-clean
|
|
$(AM_V_GEN) $(MAKE) check
|
|
$(AM_V_GEN) $(MAKE) $(AM_MAKEFLAGS) genlcov
|
|
|
|
lcov-clean:
|
|
$(AM_V_GEN) $(LCOV) --directory $(top_builddir) --zerocounters
|
|
|
|
genlcov:
|
|
$(AM_V_GEN) $(LCOV) --directory $(top_builddir) --capture --output-file coverage.info
|
|
$(AM_V_GEN) $(GENHTML) --prefix $(top_builddir) --output-directory coverage coverage.info
|