Open wbthomason opened 3 years ago
This will break sandboxing, ie with firejail, as luarocks does not conform to XDGBDS.
@matu3ba: could you say more? This would not allow the luarocks
module to install to or uninstall from system-level rock trees, but just avoid installs if a rock already exists. Does that still break sandboxing in an undesirable way?
@matu3ba: could you say more? This would not allow the
luarocks
module to install to or uninstall from system-level rock trees, but just avoid installs if a rock already exists. Does that still break sandboxing in an undesirable way?
Sorry for not explaining properly. The behavior occurs for firejail
, which is the easiest to use (and fairly complete) sandboxing solution for Linux desktop programs (I tested luarocks).
What happens is that luarocks downloads the manifest to $HOME and errors out in a unexpected way (and very unclear way) about not finding proper paths, because default sandboxing only allows data access to often necessary paths of applications like .config
, .local
.
Access to "unknown paths" in $HOME
like .luarocks
is forbidden on default, unless there is a profile for the application.
When do you plan to implement this?
I certainly won't be implementing this before March, and I'd characterize it as not very high priority.
Add an option to allow the luarocks functionality to use a system-level luarocks package, if installed, rather than re-installing luarocks and luaJIT via hererocks.