diff options
| author | Alexander Larsson <alexl@redhat.com> | 2022-01-11 10:27:46 +0100 |
|---|---|---|
| committer | Alexander Larsson <alexander.larsson@gmail.com> | 2022-01-12 19:48:16 +0100 |
| commit | 93357d357119093804df05acc32ff335839c6451 (patch) | |
| tree | fda46d06da582e0144cc786d5f65c301b89784bd | |
| parent | d9a8f9d8ccc0b7c1135d0ecde006a75d25f66aee (diff) | |
| download | flatpak-93357d357119093804df05acc32ff335839c6451.tar.gz | |
Require metadata in commit also for OCI remotes
This was disables a long time ago because the fedora remotes didn't
contain metadata, but that has been added since then. Requiring fixes
a security concern where an app claims to require no permissions (by
having no metadata in commit) but then actually requires permissions
in the installed app.
| -rw-r--r-- | common/flatpak-dir.c | 14 |
1 files changed, 4 insertions, 10 deletions
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c index 05aa91a1..e8bf106c 100644 --- a/common/flatpak-dir.c +++ b/common/flatpak-dir.c @@ -1795,7 +1795,6 @@ validate_commit_metadata (GVariant *commit_data, const char *ref, const char *required_metadata, gsize required_metadata_size, - gboolean require_xa_metadata, GError **error) { g_autoptr(GVariant) commit_metadata = NULL; @@ -1814,9 +1813,9 @@ validate_commit_metadata (GVariant *commit_data, xa_metadata = g_variant_get_string (xa_metadata_v, &xa_metadata_size); } - if ((xa_metadata == NULL && require_xa_metadata) || - (xa_metadata != NULL && (xa_metadata_size != required_metadata_size || - memcmp (xa_metadata, required_metadata, xa_metadata_size) != 0))) + if (xa_metadata == NULL || + xa_metadata_size != required_metadata_size || + memcmp (xa_metadata, required_metadata, xa_metadata_size) != 0) { g_set_error (error, G_IO_ERROR, G_IO_ERROR_PERMISSION_DENIED, _("Commit metadata for %s not matching expected metadata"), ref); @@ -5848,7 +5847,6 @@ flatpak_dir_pull (FlatpakDir *self, ref, (const char *)g_bytes_get_data (require_metadata, NULL), g_bytes_get_size (require_metadata), - TRUE, error)) goto out; } @@ -8173,7 +8171,6 @@ flatpak_dir_deploy (FlatpakDir *self, g_autoptr(GFile) metadata_file = NULL; g_autofree char *metadata_contents = NULL; gsize metadata_size = 0; - gboolean is_oci; const char *flatpak; if (!flatpak_dir_ensure_repo (self, cancellable, error)) @@ -8399,12 +8396,9 @@ flatpak_dir_deploy (FlatpakDir *self, /* Check the metadata in the commit to make sure it matches the actual * deployed metadata, in case we relied on the one in the commit for * a decision - * Note: For historical reason we don't enforce commits to contain xa.metadata - * since this was lacking in fedora builds. */ - is_oci = flatpak_dir_get_remote_oci (self, origin); if (!validate_commit_metadata (commit_data, flatpak_decomposed_get_ref (ref), - metadata_contents, metadata_size, !is_oci, error)) + metadata_contents, metadata_size, error)) return FALSE; dotref = g_file_resolve_relative_path (checkoutdir, "files/.ref"); |