containers / bubblewrap

Low-level unprivileged sandboxing tool used by Flatpak and similar projects
Other
3.9k stars 238 forks source link

Directory at /proc/{PID}/root doesn't match root of the sandbox #589

Closed StandingPadAnimations closed 1 year ago

StandingPadAnimations commented 1 year ago

While debugging some issues related to portals (https://github.com/flatpak/xdg-desktop-portal/issues/1076), it seems like the root folder in /proc/{PID} (where PID is the PID of the command ran by bwrap) doesn't match what is expected in the sandboxed environment, which causes issues when trying to use portals.

For instance, I have a .flatpak-info file in the root folder of the sandboxed environment (required for portals to work correctly), but said file does not appear in the root folder of /proc/{PID}.

Of course the program still reports the filesystem correctly, but other programs like xdg-desktop-portal will behave differently then intended

rusty-snake commented 1 year ago

WFM

Can you give more STR like bwrap command (as minimal as reproducible at best) and how you find the pid.

bwrap --unshare-all --share-net --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --symlink usr/sbin /sbin --ro-bind /usr /usr --ro-bind /etc /etc --dev /dev --proc /proc --dir /tmp --new-session --ro-bind-data 3 /.flatpak-info bash 3<<EOF 
[Application]
name=org.mozilla.firefox
EOF
$ ps -efH
[...]
rusty-snake    380653  [...]         bwrap --unshare-all --share-net --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --symlink usr/sbin /sbin --ro-bind /usr /usr --ro-bind /etc /etc --dev /d
rusty-snake    380654  [...]           bwrap --unshare-all --share-net --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --symlink usr/sbin /sbin --ro-bind /usr /usr --ro-bind /etc /etc --dev 
rusty-snake    380655  [...]             bash
               ^^^^^^
[...]
$ cat /proc/380655/root/.flatpak-info
[Application]
name=org.mozilla.firefox

required for portals to work correctly

StandingPadAnimations commented 1 year ago

Closing this since I realized it was user error