Skip to content

Commit 6e5ae7a

Browse files
smcvalexlarsson
authored andcommitted
context: Add --env-fd option
This allows environment variables to be added to the context without making their values visible to processes running under a different uid, which might be significant if the variable's value is a token or some other secret value. Signed-off-by: Simon McVittie <smcv@collabora.com> Part-of: GHSA-4ppf-fxf6-vxg2
1 parent 8212498 commit 6e5ae7a

File tree

5 files changed

+132
-0
lines changed

5 files changed

+132
-0
lines changed

Diff for: common/flatpak-context.c

+60
Original file line numberDiff line numberDiff line change
@@ -1119,6 +1119,65 @@ option_env_cb (const gchar *option_name,
11191119
return TRUE;
11201120
}
11211121

1122+
static gboolean
1123+
option_env_fd_cb (const gchar *option_name,
1124+
const gchar *value,
1125+
gpointer data,
1126+
GError **error)
1127+
{
1128+
FlatpakContext *context = data;
1129+
g_autoptr(GBytes) env_block = NULL;
1130+
gsize remaining;
1131+
const char *p;
1132+
guint64 fd;
1133+
gchar *endptr;
1134+
1135+
fd = g_ascii_strtoull (value, &endptr, 10);
1136+
1137+
if (endptr == NULL || *endptr != '\0' || fd > G_MAXINT)
1138+
return glnx_throw (error, "Not a valid file descriptor: %s", value);
1139+
1140+
env_block = glnx_fd_readall_bytes ((int) fd, NULL, error);
1141+
1142+
if (env_block == NULL)
1143+
return FALSE;
1144+
1145+
p = g_bytes_get_data (env_block, &remaining);
1146+
1147+
/* env_block might not be \0-terminated */
1148+
while (remaining > 0)
1149+
{
1150+
size_t len = strnlen (p, remaining);
1151+
const char *equals;
1152+
1153+
g_assert (len <= remaining);
1154+
1155+
equals = memchr (p, '=', len);
1156+
1157+
if (equals == NULL || equals == p)
1158+
return glnx_throw (error,
1159+
"Environment variable must be given in the form VARIABLE=VALUE, not %.*s", (int) len, p);
1160+
1161+
flatpak_context_set_env_var (context,
1162+
g_strndup (p, equals - p),
1163+
g_strndup (equals + 1, len - (equals - p) - 1));
1164+
p += len;
1165+
remaining -= len;
1166+
1167+
if (remaining > 0)
1168+
{
1169+
g_assert (*p == '\0');
1170+
p += 1;
1171+
remaining -= 1;
1172+
}
1173+
}
1174+
1175+
if (fd >= 3)
1176+
close (fd);
1177+
1178+
return TRUE;
1179+
}
1180+
11221181
static gboolean
11231182
option_own_name_cb (const gchar *option_name,
11241183
const gchar *value,
@@ -1316,6 +1375,7 @@ static GOptionEntry context_options[] = {
13161375
{ "filesystem", 0, G_OPTION_FLAG_IN_MAIN, G_OPTION_ARG_CALLBACK, &option_filesystem_cb, N_("Expose filesystem to app (:ro for read-only)"), N_("FILESYSTEM[:ro]") },
13171376
{ "nofilesystem", 0, G_OPTION_FLAG_IN_MAIN, G_OPTION_ARG_CALLBACK, &option_nofilesystem_cb, N_("Don't expose filesystem to app"), N_("FILESYSTEM") },
13181377
{ "env", 0, G_OPTION_FLAG_IN_MAIN, G_OPTION_ARG_CALLBACK, &option_env_cb, N_("Set environment variable"), N_("VAR=VALUE") },
1378+
{ "env-fd", 0, G_OPTION_FLAG_IN_MAIN, G_OPTION_ARG_CALLBACK, &option_env_fd_cb, N_("Read environment variables in env -0 format from FD"), N_("FD") },
13191379
{ "own-name", 0, G_OPTION_FLAG_IN_MAIN, G_OPTION_ARG_CALLBACK, &option_own_name_cb, N_("Allow app to own name on the session bus"), N_("DBUS_NAME") },
13201380
{ "talk-name", 0, G_OPTION_FLAG_IN_MAIN, G_OPTION_ARG_CALLBACK, &option_talk_name_cb, N_("Allow app to talk to name on the session bus"), N_("DBUS_NAME") },
13211381
{ "no-talk-name", 0, G_OPTION_FLAG_IN_MAIN, G_OPTION_ARG_CALLBACK, &option_no_talk_name_cb, N_("Don't allow app to talk to name on the session bus"), N_("DBUS_NAME") },

Diff for: doc/flatpak-build-finish.xml

+18
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,24 @@ key=v1;v2;
286286
</para></listitem>
287287
</varlistentry>
288288

289+
<varlistentry>
290+
<term><option>--env-fd=<replaceable>FD</replaceable></option></term>
291+
292+
<listitem><para>
293+
Read environment variables from the file descriptor
294+
<replaceable>FD</replaceable>, and set them as if
295+
via <option>--env</option>. This can be used to avoid
296+
environment variables and their values becoming visible
297+
to other users.
298+
</para><para>
299+
Each environment variable is in the form
300+
<replaceable>VAR</replaceable>=<replaceable>VALUE</replaceable>
301+
followed by a zero byte. This is the same format used by
302+
<literal>env -0</literal> and
303+
<filename>/proc/*/environ</filename>.
304+
</para></listitem>
305+
</varlistentry>
306+
289307
<varlistentry>
290308
<term><option>--own-name=NAME</option></term>
291309

Diff for: doc/flatpak-build.xml

+18
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,24 @@ key=v1;v2;
288288
</para></listitem>
289289
</varlistentry>
290290

291+
<varlistentry>
292+
<term><option>--env-fd=<replaceable>FD</replaceable></option></term>
293+
294+
<listitem><para>
295+
Read environment variables from the file descriptor
296+
<replaceable>FD</replaceable>, and set them as if
297+
via <option>--env</option>. This can be used to avoid
298+
environment variables and their values becoming visible
299+
to other users.
300+
</para><para>
301+
Each environment variable is in the form
302+
<replaceable>VAR</replaceable>=<replaceable>VALUE</replaceable>
303+
followed by a zero byte. This is the same format used by
304+
<literal>env -0</literal> and
305+
<filename>/proc/*/environ</filename>.
306+
</para></listitem>
307+
</varlistentry>
308+
291309
<varlistentry>
292310
<term><option>--own-name=NAME</option></term>
293311

Diff for: doc/flatpak-override.xml

+18
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,24 @@ key=v1;v2;
262262
</para></listitem>
263263
</varlistentry>
264264

265+
<varlistentry>
266+
<term><option>--env-fd=<replaceable>FD</replaceable></option></term>
267+
268+
<listitem><para>
269+
Read environment variables from the file descriptor
270+
<replaceable>FD</replaceable>, and set them as if
271+
via <option>--env</option>. This can be used to avoid
272+
environment variables and their values becoming visible
273+
to other users.
274+
</para><para>
275+
Each environment variable is in the form
276+
<replaceable>VAR</replaceable>=<replaceable>VALUE</replaceable>
277+
followed by a zero byte. This is the same format used by
278+
<literal>env -0</literal> and
279+
<filename>/proc/*/environ</filename>.
280+
</para></listitem>
281+
</varlistentry>
282+
265283
<varlistentry>
266284
<term><option>--own-name=NAME</option></term>
267285

Diff for: doc/flatpak-run.xml

+18
Original file line numberDiff line numberDiff line change
@@ -409,6 +409,24 @@ key=v1;v2;
409409
</para></listitem>
410410
</varlistentry>
411411

412+
<varlistentry>
413+
<term><option>--env-fd=<replaceable>FD</replaceable></option></term>
414+
415+
<listitem><para>
416+
Read environment variables from the file descriptor
417+
<replaceable>FD</replaceable>, and set them as if
418+
via <option>--env</option>. This can be used to avoid
419+
environment variables and their values becoming visible
420+
to other users.
421+
</para><para>
422+
Each environment variable is in the form
423+
<replaceable>VAR</replaceable>=<replaceable>VALUE</replaceable>
424+
followed by a zero byte. This is the same format used by
425+
<literal>env -0</literal> and
426+
<filename>/proc/*/environ</filename>.
427+
</para></listitem>
428+
</varlistentry>
429+
412430
<varlistentry>
413431
<term><option>--own-name=NAME</option></term>
414432

0 commit comments

Comments
 (0)