71 lines
2.7 KiB
Diff
71 lines
2.7 KiB
Diff
|
From 72016e3fce8fcbeab707daf4f1a02b931fcc004d Mon Sep 17 00:00:00 2001
|
||
|
|
From: Alexander Larsson <alexl@redhat.com>
|
||
|
|
Date: Mon, 15 Apr 2024 16:10:36 +0200
|
||
|
|
Subject: [PATCH] When starting non-static command using bwrap use "--"
|
||
|
|
|
||
|
|
Origin: https://github.com/flatpak/flatpak/commit/72016e3fce8fcbeab707daf4f1a02b931fcc004d
|
||
|
|
|
||
|
|
This ensures that the command is not taken to be a bwrap option.
|
||
|
|
|
||
|
|
Resolves: CVE-2024-32462
|
||
|
|
Resolves: GHSA-phv6-cpc2-2fgj
|
||
|
|
Signed-off-by: Alexander Larsson <alexl@redhat.com>
|
||
|
|
[smcv: Fix DISABLE_SANDBOXED_TRIGGERS code path]
|
||
|
|
[smcv: Make flatpak_run_maybe_start_dbus_proxy() more obviously correct]
|
||
|
|
Signed-off-by: Simon McVittie <smcv@collabora.com>
|
||
|
|
---
|
||
|
|
app/flatpak-builtins-build.c | 3 ++-
|
||
|
|
common/flatpak-dir.c | 1 +
|
||
|
|
common/flatpak-run.c | 5 ++++-
|
||
|
|
3 files changed, 7 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/app/flatpak-builtins-build.c b/app/flatpak-builtins-build.c
|
||
|
|
index c0b12dbca1..761af9a1b0 100644
|
||
|
|
--- a/app/flatpak-builtins-build.c
|
||
|
|
+++ b/app/flatpak-builtins-build.c
|
||
|
|
@@ -576,7 +576,8 @@ flatpak_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
|
||
|
|
if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
|
||
|
|
return FALSE;
|
||
|
|
|
||
|
|
- flatpak_bwrap_add_args (bwrap, command, NULL);
|
||
|
|
+ flatpak_bwrap_add_args (bwrap, "--", command, NULL);
|
||
|
|
+
|
||
|
|
flatpak_bwrap_append_argsv (bwrap,
|
||
|
|
&argv[rest_argv_start + 2],
|
||
|
|
rest_argc - 2);
|
||
|
|
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
|
||
|
|
index 6e07d08e3d..296a7dfd78 100644
|
||
|
|
--- a/common/flatpak-dir.c
|
||
|
|
+++ b/common/flatpak-dir.c
|
||
|
|
@@ -6653,6 +6653,7 @@ flatpak_dir_run_triggers (FlatpakDir *self,
|
||
|
|
"--proc", "/proc",
|
||
|
|
"--dev", "/dev",
|
||
|
|
"--bind", basedir, basedir,
|
||
|
|
+ "--",
|
||
|
|
NULL);
|
||
|
|
#endif
|
||
|
|
flatpak_bwrap_add_args (bwrap,
|
||
|
|
diff --git a/common/flatpak-run.c b/common/flatpak-run.c
|
||
|
|
index c4dcaca9e6..7a3900c651 100644
|
||
|
|
--- a/common/flatpak-run.c
|
||
|
|
+++ b/common/flatpak-run.c
|
||
|
|
@@ -1082,6 +1082,9 @@ add_bwrap_wrapper (FlatpakBwrap *bwrap,
|
||
|
|
if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
|
||
|
|
return FALSE;
|
||
|
|
|
||
|
|
+ /* End of options: the next argument will be the executable name */
|
||
|
|
+ flatpak_bwrap_add_arg (bwrap, "--");
|
||
|
|
+
|
||
|
|
return TRUE;
|
||
|
|
}
|
||
|
|
|
||
|
|
@@ -4175,7 +4178,7 @@ flatpak_run_app (FlatpakDecomposed *app_ref,
|
||
|
|
if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
|
||
|
|
return FALSE;
|
||
|
|
|
||
|
|
- flatpak_bwrap_add_arg (bwrap, command);
|
||
|
|
+ flatpak_bwrap_add_args (bwrap, "--", command, NULL);
|
||
|
|
|
||
|
|
if (!add_rest_args (bwrap, app_id,
|
||
|
|
exports, (flags & FLATPAK_RUN_FLAG_FILE_FORWARDING) != 0,
|