73 lines
2.8 KiB
Diff
73 lines
2.8 KiB
Diff
From 72016e3fce8fcbeab707daf4f1a02b931fcc004d Mon Sep 17 00:00:00 2001
|
|
From: Alexander Larsson <alexl@redhat.com>
|
|
Date: Mon, 15 Apr 2024 16:10:36 +0200
|
|
Subject: [PATCH] When starting non-static command using bwrap use "--"
|
|
|
|
Origin: https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d
|
|
|
|
This ensures that the command is not taken to be a bwrap option.
|
|
|
|
Resolves: CVE-2024-32462
|
|
Resolves: GHSA-phv6-cpc2-2fgj
|
|
Signed-off-by: Alexander Larsson <alexl@redhat.com>
|
|
[smcv: Fix DISABLE_SANDBOXED_TRIGGERS code path]
|
|
[smcv: Make flatpak_run_maybe_start_dbus_proxy() more obviously correct]
|
|
Signed-off-by: Simon McVittie <smcv@collabora.com>
|
|
---
|
|
app/flatpak-builtins-build.c | 2 +-
|
|
common/flatpak-dir.c | 1 +
|
|
common/flatpak-run.c | 5 ++++-
|
|
3 files changed, 6 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/app/flatpak-builtins-build.c b/app/flatpak-builtins-build.c
|
|
index ce9ff7e..bb4bd06 100644
|
|
--- a/app/flatpak-builtins-build.c
|
|
+++ b/app/flatpak-builtins-build.c
|
|
@@ -569,7 +569,7 @@ flatpak_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
|
|
if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
|
|
return FALSE;
|
|
|
|
- flatpak_bwrap_add_args (bwrap, command, NULL);
|
|
+ flatpak_bwrap_add_args (bwrap, "--", command, NULL);
|
|
flatpak_bwrap_append_argsv (bwrap,
|
|
&argv[rest_argv_start + 2],
|
|
rest_argc - 2);
|
|
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
|
|
index f00e6bf..e7bc1f8 100644
|
|
--- a/common/flatpak-dir.c
|
|
+++ b/common/flatpak-dir.c
|
|
@@ -5391,6 +5391,7 @@ flatpak_dir_run_triggers (FlatpakDir *self,
|
|
g_ptr_array_add (argv_array, g_strdup ("--dev"));
|
|
g_ptr_array_add (argv_array, g_strdup ("/dev"));
|
|
g_ptr_array_add (argv_array, g_strdup ("--bind"));
|
|
+ g_ptr_array_add (argv_array, g_strdup ("--"));
|
|
g_ptr_array_add (argv_array, g_strdup (basedir));
|
|
g_ptr_array_add (argv_array, g_strdup (basedir));
|
|
#endif
|
|
diff --git a/common/flatpak-run.c b/common/flatpak-run.c
|
|
index d48be1f..0b2bada 100644
|
|
--- a/common/flatpak-run.c
|
|
+++ b/common/flatpak-run.c
|
|
@@ -754,6 +754,9 @@ add_bwrap_wrapper (FlatpakBwrap *bwrap,
|
|
if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
|
|
return FALSE;
|
|
|
|
+ /* End of options: the next argument will be the executable name */
|
|
+ flatpak_bwrap_add_arg (bwrap, "--");
|
|
+
|
|
return TRUE;
|
|
}
|
|
|
|
@@ -3176,7 +3179,7 @@ flatpak_run_app (const char *app_ref,
|
|
if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
|
|
return FALSE;
|
|
|
|
- flatpak_bwrap_add_arg (bwrap, command);
|
|
+ flatpak_bwrap_add_args (bwrap, "--", command, NULL);
|
|
|
|
if (!add_rest_args (bwrap, app_ref_parts[1],
|
|
exports, (flags & FLATPAK_RUN_FLAG_FILE_FORWARDING) != 0,
|
|
--
|
|
2.33.0
|
|
|