Skip to content

Commit

Permalink
Require metadata in commit also for OCI remotes
Browse files Browse the repository at this point in the history
This was disables a long time ago because the fedora remotes didn't
contain metadata, but that has been added since then. Requiring fixes
a security concern where an app claims to require no permissions (by
having no metadata in commit) but then actually requires permissions
in the installed app.
  • Loading branch information
alexlarsson committed Jan 12, 2022
1 parent d9a8f9d commit 93357d3
Showing 1 changed file with 4 additions and 10 deletions.
14 changes: 4 additions & 10 deletions common/flatpak-dir.c
Original file line number Diff line number Diff line change
Expand Up @@ -1795,7 +1795,6 @@ validate_commit_metadata (GVariant *commit_data,
const char *ref,
const char *required_metadata,
gsize required_metadata_size,
gboolean require_xa_metadata,
GError **error)
{
g_autoptr(GVariant) commit_metadata = NULL;
Expand All @@ -1814,9 +1813,9 @@ validate_commit_metadata (GVariant *commit_data,
xa_metadata = g_variant_get_string (xa_metadata_v, &xa_metadata_size);
}

if ((xa_metadata == NULL && require_xa_metadata) ||
(xa_metadata != NULL && (xa_metadata_size != required_metadata_size ||
memcmp (xa_metadata, required_metadata, xa_metadata_size) != 0)))
if (xa_metadata == NULL ||
xa_metadata_size != required_metadata_size ||
memcmp (xa_metadata, required_metadata, xa_metadata_size) != 0)
{
g_set_error (error, G_IO_ERROR, G_IO_ERROR_PERMISSION_DENIED,
_("Commit metadata for %s not matching expected metadata"), ref);
Expand Down Expand Up @@ -5848,7 +5847,6 @@ flatpak_dir_pull (FlatpakDir *self,
ref,
(const char *)g_bytes_get_data (require_metadata, NULL),
g_bytes_get_size (require_metadata),
TRUE,
error))
goto out;
}
Expand Down Expand Up @@ -8173,7 +8171,6 @@ flatpak_dir_deploy (FlatpakDir *self,
g_autoptr(GFile) metadata_file = NULL;
g_autofree char *metadata_contents = NULL;
gsize metadata_size = 0;
gboolean is_oci;
const char *flatpak;

if (!flatpak_dir_ensure_repo (self, cancellable, error))
Expand Down Expand Up @@ -8399,12 +8396,9 @@ flatpak_dir_deploy (FlatpakDir *self,
/* Check the metadata in the commit to make sure it matches the actual
* deployed metadata, in case we relied on the one in the commit for
* a decision
* Note: For historical reason we don't enforce commits to contain xa.metadata
* since this was lacking in fedora builds.
*/
is_oci = flatpak_dir_get_remote_oci (self, origin);
if (!validate_commit_metadata (commit_data, flatpak_decomposed_get_ref (ref),
metadata_contents, metadata_size, !is_oci, error))
metadata_contents, metadata_size, error))
return FALSE;

dotref = g_file_resolve_relative_path (checkoutdir, "files/.ref");
Expand Down

0 comments on commit 93357d3

Please sign in to comment.