diff options
| author | Simon McVittie <smcv@collabora.com> | 2021-08-18 16:51:29 +0100 |
|---|---|---|
| committer | Alexander Larsson <alexander.larsson@gmail.com> | 2021-08-20 15:28:58 +0200 |
| commit | 6e5b02e2d486c345762a8b8f5796e0ba132baa9a (patch) | |
| tree | 99c2910c33e90f878b38ccdd435211fb8821e71b /tests/test-run.sh | |
| parent | c392e5adf63ea2817a6f05081365fdd7acdfc04e (diff) | |
| download | flatpak-6e5b02e2d486c345762a8b8f5796e0ba132baa9a.tar.gz | |
run: Don't let XDG_RUNTIME_DIR from user override the value we set
We use `bwrap --setenv XDG_RUNTIME_DIR` to set it to `/run/user/UID`,
regardless of what it is on the host system, but the changes made
to resolve CVE-2021-21261 unintentionally broke this by overwriting it
with the user's XDG_RUNTIME_DIR.
In practice this worked for most people, who either have
XDG_RUNTIME_DIR set to the same value we use (which is the conventional
setup from systemd-logind and elogind), or entirely unset (if they do not
have systemd-logind or elogind). However, it broke Wayland and other
XDG_RUNTIME_DIR-based protocols for people who intentionally set up an
XDG_RUNTIME_DIR that is different.
Fixes: 6d1773d2 "run: Convert all environment variables into bwrap arguments"
Resolves: https://github.com/flatpak/flatpak/issues/4372
Signed-off-by: Simon McVittie <smcv@collabora.com>
Diffstat (limited to 'tests/test-run.sh')
| -rw-r--r-- | tests/test-run.sh | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/tests/test-run.sh b/tests/test-run.sh index 3c344df1..994ce1cf 100644 --- a/tests/test-run.sh +++ b/tests/test-run.sh @@ -24,7 +24,7 @@ set -euo pipefail skip_without_bwrap skip_revokefs_without_fuse -echo "1..18" +echo "1..19" # Use stable rather than master as the branch so we can test that the run # command automatically finds the branch correctly @@ -74,6 +74,12 @@ assert_file_has_content hello_out '^Hello world, from a sandbox$' ok "hello" +XDG_RUNTIME_DIR="$(pwd)/xrd" run_sh org.test.Platform 'echo $XDG_RUNTIME_DIR' > value-in-sandbox +head value-in-sandbox >&2 +assert_file_has_content value-in-sandbox "^/run/user/$(id -u)\$" + +ok "XDG_RUNTIME_DIR not inherited" + run_sh org.test.Platform cat /.flatpak-info >runtime-fpi assert_file_has_content runtime-fpi "[Runtime]" assert_file_has_content runtime-fpi "^runtime=runtime/org\.test\.Platform/$ARCH/stable$" |