run: Prevent accidentally running with sudowip/tingping/sudo-check

It is a common user error to prepend many flatpak commands with sudo
and doing so with run is quite unsafe and can cause issues.

This check simply handles the `sudo flatpak run foo` case and does
not prevent running as root or even running in a shell created by
sudo.

See also #1357

1 files changed, 24 insertions, 0 deletions

diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index 7a872ec8..e9fa2961 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -3426,6 +3426,27 @@ open_namespace_fd_if_needed (const char *path, const char *type)
   return -1;
 }
 
+static gboolean
+check_sudo (GError **error)
+{
+  const char *sudo_command_env = g_getenv ("SUDO_COMMAND");
+  g_auto(GStrv) split_command = NULL;
+
+  /* This check exists to stop accidental usage of `sudo flatpak run`
+     and is not to prevent running as root.
+   */
+
+  if (!sudo_command_env)
+    return TRUE;
+
+  /* SUDO_COMMAND could be a value like `/usr/bin/flatpak run foo` */
+  split_command = g_strsplit (sudo_command_env, " ", 2);
+  if (g_str_has_suffix (split_command[0], "flatpak"))
+    return flatpak_fail_error (error, FLATPAK_ERROR, _("\"flatpak run\" is not intended to be ran with sudo"));
+
+  return TRUE;
+}
+
 gboolean
 flatpak_run_app (const char     *app_ref,
                  FlatpakDeploy  *app_deploy,
@@ -3482,6 +3503,9 @@ flatpak_run_app (const char     *app_ref,
 
   struct stat s;
 
+  if (!check_sudo (error))
+    return FALSE;
+
   app_ref_parts = flatpak_decompose_ref (app_ref, error);
   if (app_ref_parts == NULL)
     return FALSE;