app: Refuse to work with sudo and --userdisallow-sudo-per-user

Have heard of people running Flatpak commands with both sudo and --user,
and not expecting it work on the root user's installation. Let's just
not allow it since it's not something people ever do intentionally.

4 files changed, 37 insertions, 23 deletions

diff --git a/app/flatpak-main.c b/app/flatpak-main.c
index bbf18490..b2a4b14e 100644
--- a/app/flatpak-main.c
+++ b/app/flatpak-main.c
@@ -369,6 +369,16 @@ flatpak_option_context_parse (GOptionContext     *context,
         flatpak_disable_fancy_output ();
     }
 
+  /* sudo flatpak --user ... would operate on the root user's installation,
+   * which is almost certainly not what the user intended so just consider it
+   * an error.
+   */
+  if (opt_user && running_under_sudo ())
+    return flatpak_fail_error (error, FLATPAK_ERROR,
+                               _("Refusing to operate under sudo with --user. "
+                                 "Omit sudo to operate on the user installation, "
+                                 "or use a root shell to operate on the root user's installation."));
+
   if (!(flags & FLATPAK_BUILTIN_FLAG_NO_DIR))
     {
       dirs = g_ptr_array_new_with_free_func ((GDestroyNotify) g_object_unref);
diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index c331f3a5..2eca4c98 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -3877,27 +3877,6 @@ open_namespace_fd_if_needed (const char *path,
   return -1;
 }
 
-static gboolean
-check_sudo (GError **error)
-{
-  const char *sudo_command_env = g_getenv ("SUDO_COMMAND");
-  g_auto(GStrv) split_command = NULL;
-
-  /* This check exists to stop accidental usage of `sudo flatpak run`
-     and is not to prevent running as root.
-   */
-
-  if (!sudo_command_env)
-    return TRUE;
-
-  /* SUDO_COMMAND could be a value like `/usr/bin/flatpak run foo` */
-  split_command = g_strsplit (sudo_command_env, " ", 2);
-  if (g_str_has_suffix (split_command[0], "flatpak"))
-    return flatpak_fail_error (error, FLATPAK_ERROR, _("\"flatpak run\" is not intended to be run as `sudo flatpak run`, use `sudo -i` or `su -l` instead and invoke \"flatpak run\" from inside the new shell"));
-
-  return TRUE;
-}
-
 gboolean
 flatpak_run_app (FlatpakDecomposed *app_ref,
                  FlatpakDeploy     *app_deploy,
@@ -3969,8 +3948,14 @@ flatpak_run_app (FlatpakDecomposed *app_ref,
 
   g_return_val_if_fail (app_ref != NULL, FALSE);
 
-  if (!check_sudo (error))
-    return FALSE;
+  /* This check exists to stop accidental usage of `sudo flatpak run`
+     and is not to prevent running as root.
+   */
+  if (running_under_sudo ())
+    return flatpak_fail_error (error, FLATPAK_ERROR,
+                               _("\"flatpak run\" is not intended to be run as `sudo flatpak run`. "
+                                 "Use `sudo -i` or `su -l` instead and invoke \"flatpak run\" from "
+                                 "inside the new shell."));
 
   app_id = flatpak_decomposed_dup_id (app_ref);
   g_return_val_if_fail (app_id != NULL, FALSE);
diff --git a/common/flatpak-utils-private.h b/common/flatpak-utils-private.h
index aa013847..281f26bf 100644
--- a/common/flatpak-utils-private.h
+++ b/common/flatpak-utils-private.h
@@ -916,6 +916,8 @@ gboolean flatpak_str_is_integer (const char *s);
 gboolean flatpak_uri_equal (const char *uri1,
                             const char *uri2);
 
+gboolean running_under_sudo (void);
+
 #define FLATPAK_MESSAGE_ID "c7b39b1e006b464599465e105b361485"
 
 #endif /* __FLATPAK_UTILS_H__ */
diff --git a/common/flatpak-utils.c b/common/flatpak-utils.c
index f7d53e64..a4cea524 100644
--- a/common/flatpak-utils.c
+++ b/common/flatpak-utils.c
@@ -9076,3 +9076,20 @@ flatpak_uri_equal (const char *uri1,
 
   return g_strcmp0 (uri1_norm, uri2_norm) == 0;
 }
+
+gboolean
+running_under_sudo (void)
+{
+  const char *sudo_command_env = g_getenv ("SUDO_COMMAND");
+  g_auto(GStrv) split_command = NULL;
+
+  if (!sudo_command_env)
+    return FALSE;
+
+  /* SUDO_COMMAND could be a value like `/usr/bin/flatpak run foo` */
+  split_command = g_strsplit (sudo_command_env, " ", 2);
+  if (g_str_has_suffix (split_command[0], "flatpak"))
+    return TRUE;
+
+  return FALSE;
+}