1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
/* GIO - GLib Input, Output and Streaming Library
*
* Copyright 2022 Canonical Ltd
*
* SPDX-License-Identifier: LGPL-2.1-or-later
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General
* Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
*/
#include "config.h"
#include "gsandbox.h"
#include <string.h>
#define SNAP_CONFINEMENT_PREFIX "confinement:"
static gboolean
is_flatpak (void)
{
const char *flatpak_info = "/.flatpak-info";
gboolean found;
#ifdef G_PORTAL_SUPPORT_TEST
char *test_key_file =
g_build_filename (g_get_user_runtime_dir (), flatpak_info, NULL);
flatpak_info = test_key_file;
#endif
found = g_file_test (flatpak_info, G_FILE_TEST_EXISTS);
#ifdef G_PORTAL_SUPPORT_TEST
g_clear_pointer (&test_key_file, g_free);
#endif
return found;
}
static gchar *
get_snap_confinement (const char *snap_yaml,
GError **error)
{
char *confinement = NULL;
char *yaml_contents;
if (g_file_get_contents (snap_yaml, &yaml_contents, NULL, error))
{
const char *line = yaml_contents;
do
{
if (g_str_has_prefix (line, SNAP_CONFINEMENT_PREFIX))
break;
line = strchr (line, '\n');
if (line)
line += 1;
}
while (line != NULL);
if (line)
{
const char *start = line + strlen (SNAP_CONFINEMENT_PREFIX);
const char *end = strchr (start, '\n');
confinement =
g_strstrip (end ? g_strndup (start, end-start) : g_strdup (start));
}
g_free (yaml_contents);
}
return g_steal_pointer (&confinement);
}
static gboolean
is_snap (void)
{
GError *error = NULL;
const gchar *snap_path;
gchar *yaml_path;
char *confinement;
gboolean result;
snap_path = g_getenv ("SNAP");
if (snap_path == NULL)
return FALSE;
result = FALSE;
yaml_path = g_build_filename (snap_path, "meta", "snap.yaml", NULL);
confinement = get_snap_confinement (yaml_path, &error);
g_free (yaml_path);
/* Classic snaps are de-facto no sandboxed apps, so we can ignore them */
if (!error && g_strcmp0 (confinement, "classic") != 0)
result = TRUE;
g_clear_error (&error);
g_free (confinement);
return result;
}
/*
* glib_get_sandbox_type:
*
* Gets the type of sandbox this process is running inside.
*
* Checking for sandboxes may involve doing blocking I/O calls, but should not take
* any significant time.
*
* The sandbox will not change over the lifetime of the process, so calling this
* function once and reusing the result is valid.
*
* If this process is not sandboxed then @G_SANDBOX_TYPE_UNKNOWN will be returned.
* This is because this function only detects known sandbox types in #GSandboxType.
* It may be updated in the future if new sandboxes come into use.
*
* Returns: a #GSandboxType.
*/
GSandboxType
glib_get_sandbox_type (void)
{
if (is_flatpak ())
return G_SANDBOX_TYPE_FLATPAK;
else if (is_snap ())
return G_SANDBOX_TYPE_SNAP;
else
return G_SANDBOX_TYPE_UNKNOWN;
}
|
