run: Populate XDG_RUNTIME_DIR with symlinks into /run/flatpak

If XDG_RUNTIME_DIR is under app control, as it will be with #4120, we
don't want to be mounting pieces of filesystem directly into it, because
that will mean that the app could create a symlink that will cause us
to create a mount point for it at the target of the symlink, potentially
elsewhere in the host filesystem.

Instead, we mount them in /run/flatpak, which is a per-instance
directory entirely controlled by Flatpak; and then create (relative)
symlinks in XDG_RUNTIME_DIR, pointing into /run/flatpak.

In this commit, we still know that the XDG_RUNTIME_DIR is a
per-instance tmpfs, so we can safely create the symlinks using
the --symlink option. In a subsequent commit this will change to
creating them in a shared XDG_RUNTIME_DIR, if any.

Signed-off-by: Simon McVittie <smcv@collabora.com>

6 files changed, 77 insertions, 16 deletions

diff --git a/app/flatpak-builtins-build.c b/app/flatpak-builtins-build.c
index d98a02ea..4ae3bacf 100644
--- a/app/flatpak-builtins-build.c
+++ b/app/flatpak-builtins-build.c
@@ -580,6 +580,8 @@ flatpak_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
                               NULL);
     }
 
+  flatpak_bwrap_populate_runtime_dir (bwrap);
+
   flatpak_bwrap_envp_to_args (bwrap);
 
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
diff --git a/common/flatpak-bwrap-private.h b/common/flatpak-bwrap-private.h
index 801ef74b..9d6b6311 100644
--- a/common/flatpak-bwrap-private.h
+++ b/common/flatpak-bwrap-private.h
@@ -27,6 +27,7 @@ typedef struct
   GArray    *noinherit_fds; /* Just keep these open while the bwrap lives */
   GArray    *fds;
   GStrv      envp;
+  GPtrArray *runtime_dir_members;
 } FlatpakBwrap;
 
 extern char *flatpak_bwrap_empty_env[1];
@@ -82,6 +83,9 @@ gboolean      flatpak_bwrap_bundle_args (FlatpakBwrap *bwrap,
                                          int           end,
                                          gboolean      one_arg,
                                          GError      **error);
+void          flatpak_bwrap_add_runtime_dir_member (FlatpakBwrap *bwrap,
+                                                    const char *name);
+void          flatpak_bwrap_populate_runtime_dir (FlatpakBwrap *bwrap);
 
 void          flatpak_bwrap_child_setup_cb (gpointer user_data);
 void          flatpak_bwrap_child_setup (GArray *fd_array,
diff --git a/common/flatpak-bwrap.c b/common/flatpak-bwrap.c
index c55d6d7e..0faed691 100644
--- a/common/flatpak-bwrap.c
+++ b/common/flatpak-bwrap.c
@@ -223,6 +223,16 @@ flatpak_bwrap_append_bwrap (FlatpakBwrap *bwrap,
                                  key, eq + 1, TRUE);
         }
     }
+
+  if (other->runtime_dir_members != NULL)
+    {
+      if (bwrap->runtime_dir_members == NULL)
+        bwrap->runtime_dir_members = g_ptr_array_new_with_free_func (g_free);
+
+      for (i = 0; i < other->runtime_dir_members->len; i++)
+        g_ptr_array_add (bwrap->runtime_dir_members,
+                         g_strdup (g_ptr_array_index (other->runtime_dir_members, i)));
+    }
 }
 
 void
@@ -393,6 +403,42 @@ flatpak_bwrap_bundle_args (FlatpakBwrap *bwrap,
   return TRUE;
 }
 
+/*
+ * Remember that we need to arrange for $XDG_RUNTIME_DIR/$name to be
+ * a symlink to /run/flatpak/$name.
+ */
+void
+flatpak_bwrap_add_runtime_dir_member (FlatpakBwrap *bwrap,
+                                      const char *name)
+{
+  if (bwrap->runtime_dir_members == NULL)
+    bwrap->runtime_dir_members = g_ptr_array_new_with_free_func (g_free);
+
+  g_ptr_array_add (bwrap->runtime_dir_members, g_strdup (name));
+}
+
+void
+flatpak_bwrap_populate_runtime_dir (FlatpakBwrap *bwrap)
+{
+  flatpak_bwrap_add_arg (bwrap, "--symlink");
+  flatpak_bwrap_add_arg (bwrap, "../../../.flatpak-info");
+  flatpak_bwrap_add_arg_printf (bwrap, "/run/user/%d/flatpak-info", getuid ());
+
+  if (bwrap->runtime_dir_members != NULL)
+    {
+      gsize i;
+
+      for (i = 0; i < bwrap->runtime_dir_members->len; i++)
+        {
+          const char *member = g_ptr_array_index (bwrap->runtime_dir_members, i);
+
+          flatpak_bwrap_add_arg (bwrap, "--symlink");
+          flatpak_bwrap_add_arg_printf (bwrap, "../../flatpak/%s", member);
+          flatpak_bwrap_add_arg_printf (bwrap, "/run/user/%d/%s", getuid (), member);
+        }
+    }
+}
+
 void
 flatpak_bwrap_child_setup (GArray *fd_array,
                            gboolean close_fd_workaround)
diff --git a/common/flatpak-context.c b/common/flatpak-context.c
index f18bac49..66fd935b 100644
--- a/common/flatpak-context.c
+++ b/common/flatpak-context.c
@@ -2536,7 +2536,7 @@ flatpak_context_append_bwrap_filesystem (FlatpakContext  *context,
   if (app_id_dir != NULL)
     {
       g_autofree char *user_runtime_dir = flatpak_get_real_xdg_runtime_dir ();
-      g_autofree char *run_user_app_dst = g_strdup_printf ("/run/user/%d/app/%s", getuid (), app_id);
+      g_autofree char *run_user_app_dst = g_strdup_printf ("/run/flatpak/app/%s", app_id);
       g_autofree char *run_user_app_src = g_build_filename (user_runtime_dir, "app", app_id, NULL);
 
       if (glnx_shutil_mkdir_p_at (AT_FDCWD,
@@ -2547,6 +2547,9 @@ flatpak_context_append_bwrap_filesystem (FlatpakContext  *context,
         flatpak_bwrap_add_args (bwrap,
                                 "--bind", run_user_app_src, run_user_app_dst,
                                 NULL);
+
+      /* Later, we'll make $XDG_RUNTIME_DIR/app a symlink to /run/flatpak/app */
+      flatpak_bwrap_add_runtime_dir_member (bwrap, "app");
     }
 
   /* This actually outputs the args for the hide/expose operations
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
index 712c1aff..5ec908ad 100644
--- a/common/flatpak-dir.c
+++ b/common/flatpak-dir.c
@@ -7857,6 +7857,8 @@ apply_extra_data (FlatpakDir   *self,
                                          NULL, cancellable, error))
     return FALSE;
 
+  flatpak_bwrap_populate_runtime_dir (bwrap);
+
   flatpak_bwrap_envp_to_args (bwrap);
 
   flatpak_bwrap_add_arg (bwrap, "/app/bin/apply_extra");
diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index 5b1c905b..f53e73ef 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -315,7 +315,7 @@ flatpak_run_add_wayland_args (FlatpakBwrap *bwrap)
       flatpak_bwrap_set_env (bwrap, "WAYLAND_DISPLAY", wayland_display, TRUE);
     }
 
-  sandbox_wayland_socket = g_strdup_printf ("/run/user/%d/%s", getuid (), wayland_display);
+  sandbox_wayland_socket = g_strdup_printf ("/run/flatpak/%s", wayland_display);
 
   if (stat (wayland_socket, &statbuf) == 0 &&
       (statbuf.st_mode & S_IFMT) == S_IFSOCK)
@@ -324,6 +324,7 @@ flatpak_run_add_wayland_args (FlatpakBwrap *bwrap)
       flatpak_bwrap_add_args (bwrap,
                               "--ro-bind", wayland_socket, sandbox_wayland_socket,
                               NULL);
+      flatpak_bwrap_add_runtime_dir_member (bwrap, wayland_display);
     }
   return res;
 }
@@ -733,11 +734,11 @@ flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap)
 
   if (pulseaudio_socket && g_file_test (pulseaudio_socket, G_FILE_TEST_EXISTS))
     {
+      static const char sandbox_socket_path[] = "/run/flatpak/pulse/native";
+      static const char pulse_server[] = "unix:/run/flatpak/pulse/native";
+      static const char config_path[] = "/run/flatpak/pulse/config";
       gboolean share_shm = FALSE; /* TODO: When do we add this? */
       g_autofree char *client_config = g_strdup_printf ("enable-shm=%s\n", share_shm ? "yes" : "no");
-      g_autofree char *sandbox_socket_path = g_strdup_printf ("/run/user/%d/pulse/native", getuid ());
-      g_autofree char *pulse_server = g_strdup_printf ("unix:/run/user/%d/pulse/native", getuid ());
-      g_autofree char *config_path = g_strdup_printf ("/run/user/%d/pulse/config", getuid ());
 
       /* FIXME - error handling */
       if (!flatpak_bwrap_add_args_data (bwrap, "pulseaudio", client_config, -1, config_path, NULL))
@@ -749,6 +750,7 @@ flatpak_run_add_pulseaudio_args (FlatpakBwrap *bwrap)
 
       flatpak_bwrap_set_env (bwrap, "PULSE_SERVER", pulse_server, TRUE);
       flatpak_bwrap_set_env (bwrap, "PULSE_CLIENTCONFIG", config_path, TRUE);
+      flatpak_bwrap_add_runtime_dir_member (bwrap, "pulse");
     }
   else
     g_debug ("Could not find pulseaudio socket");
@@ -879,11 +881,11 @@ flatpak_run_add_session_dbus_args (FlatpakBwrap   *app_bwrap,
                                    FlatpakRunFlags flags,
                                    const char     *app_id)
 {
+  static const char sandbox_socket_path[] = "/run/flatpak/bus";
+  static const char sandbox_dbus_address[] = "unix:path=/run/flatpak/bus";
   gboolean unrestricted, no_proxy;
   const char *dbus_address = g_getenv ("DBUS_SESSION_BUS_ADDRESS");
   g_autofree char *dbus_session_socket = NULL;
-  g_autofree char *sandbox_socket_path = g_strdup_printf ("/run/user/%d/bus", getuid ());
-  g_autofree char *sandbox_dbus_address = g_strdup_printf ("unix:path=/run/user/%d/bus", getuid ());
 
   unrestricted = (context->sockets & FLATPAK_CONTEXT_SOCKET_SESSION_BUS) != 0;
 
@@ -915,6 +917,7 @@ flatpak_run_add_session_dbus_args (FlatpakBwrap   *app_bwrap,
                               "--ro-bind", dbus_session_socket, sandbox_socket_path,
                               NULL);
       flatpak_bwrap_set_env (app_bwrap, "DBUS_SESSION_BUS_ADDRESS", sandbox_dbus_address, TRUE);
+      flatpak_bwrap_add_runtime_dir_member (app_bwrap, "bus");
 
       return TRUE;
     }
@@ -945,6 +948,7 @@ flatpak_run_add_session_dbus_args (FlatpakBwrap   *app_bwrap,
                               "--ro-bind", proxy_socket, sandbox_socket_path,
                               NULL);
       flatpak_bwrap_set_env (app_bwrap, "DBUS_SESSION_BUS_ADDRESS", sandbox_dbus_address, TRUE);
+      flatpak_bwrap_add_runtime_dir_member (app_bwrap, "bus");
 
       return TRUE;
     }
@@ -2429,7 +2433,6 @@ flatpak_run_add_app_info_args (FlatpakBwrap       *bwrap,
   int fd, fd2, fd3;
   g_autoptr(GKeyFile) keyfile = NULL;
   g_autofree char *runtime_path = NULL;
-  g_autofree char *old_dest = g_strdup_printf ("/run/user/%d/flatpak-info", getuid ());
   const char *group;
   g_autofree char *instance_id = NULL;
   glnx_autofd int lock_fd = -1;
@@ -2444,7 +2447,7 @@ flatpak_run_add_app_info_args (FlatpakBwrap       *bwrap,
   if (instance_id == NULL)
     return flatpak_fail_error (error, FLATPAK_ERROR_SETUP_FAILED, _("Unable to allocate instance id"));
 
-  instance_id_sandbox_dir = g_strdup_printf ("/run/user/%d/.flatpak/%s", getuid (), instance_id);
+  instance_id_sandbox_dir = g_strdup_printf ("/run/flatpak/.flatpak/%s", instance_id);
   instance_id_lock_file = g_build_filename (instance_id_sandbox_dir, ".ref", NULL);
 
   flatpak_bwrap_add_args (bwrap,
@@ -2454,6 +2457,7 @@ flatpak_run_add_app_info_args (FlatpakBwrap       *bwrap,
                           "--lock-file",
                           instance_id_lock_file,
                           NULL);
+  flatpak_bwrap_add_runtime_dir_member (bwrap, ".flatpak");
   /* Keep the .ref lock held until we've started bwrap to avoid races */
   flatpak_bwrap_add_noinherit_fd (bwrap, glnx_steal_fd (&lock_fd));
 
@@ -2595,9 +2599,6 @@ flatpak_run_add_app_info_args (FlatpakBwrap       *bwrap,
                                   "--file", fd, "/.flatpak-info");
   flatpak_bwrap_add_args_data_fd (bwrap,
                                   "--ro-bind-data", fd2, "/.flatpak-info");
-  flatpak_bwrap_add_args (bwrap,
-                          "--symlink", "../../../.flatpak-info", old_dest,
-                          NULL);
 
   /* Tell the application that it's running under Flatpak in a generic way. */
   flatpak_bwrap_add_args (bwrap,
@@ -2740,7 +2741,7 @@ add_monitor_path_args (gboolean      use_session_helper,
 
       if (g_variant_lookup (session_data, "pkcs11-socket", "s", &pkcs11_socket_path))
         {
-          g_autofree char *sandbox_pkcs11_socket_path = g_strdup_printf ("/run/user/%d/p11-kit/pkcs11", getuid ());
+          static const char sandbox_pkcs11_socket_path[] = "/run/flatpak/p11-kit/pkcs11";
           const char *trusted_module_contents =
             "# This overrides the runtime p11-kit-trusted module with a client one talking to the trust module on the host\n"
             "module: p11-kit-client.so\n";
@@ -2753,6 +2754,7 @@ add_monitor_path_args (gboolean      use_session_helper,
                                       "--ro-bind", pkcs11_socket_path, sandbox_pkcs11_socket_path,
                                       NULL);
               flatpak_bwrap_unset_env (bwrap, "P11_KIT_SERVER_ADDRESS");
+              flatpak_bwrap_add_runtime_dir_member (bwrap, "p11-kit");
             }
         }
     }
@@ -2804,21 +2806,21 @@ add_document_portal_args (FlatpakBwrap *bwrap,
           if (g_dbus_message_to_gerror (reply, &local_error))
             {
               if (g_error_matches (local_error, G_DBUS_ERROR, G_DBUS_ERROR_SERVICE_UNKNOWN))
-                g_debug ("Document portal not available, not mounting /run/user/%d/doc", getuid ());
+                g_debug ("Document portal not available, not mounting /run/flatpak/doc");
               else
                 g_message ("Can't get document portal: %s", local_error->message);
             }
           else
             {
+              static const char dst_path[] = "/run/flatpak/doc";
               g_autofree char *src_path = NULL;
-              g_autofree char *dst_path = NULL;
               g_variant_get (g_dbus_message_get_body (reply),
                              "(^ay)", &doc_mount_path);
 
               src_path = g_strdup_printf ("%s/by-app/%s",
                                           doc_mount_path, app_id);
-              dst_path = g_strdup_printf ("/run/user/%d/doc", getuid ());
               flatpak_bwrap_add_args (bwrap, "--bind", src_path, dst_path, NULL);
+              flatpak_bwrap_add_runtime_dir_member (bwrap, "doc");
             }
         }
     }
@@ -4328,6 +4330,8 @@ flatpak_run_app (FlatpakDecomposed *app_ref,
         flatpak_bwrap_add_args_data_fd (bwrap, "--pidns", pidns_fd, NULL);
     }
 
+  flatpak_bwrap_populate_runtime_dir (bwrap);
+
   if (custom_command)
     {
       command = custom_command;