When starting non-static command using bwrap use "--"

This ensures that the command is not taken to be a bwrap option. Resolves: CVE-2024-32462 Resolves: GHSA-phv6-cpc2-2fgj Signed-off-by: Alexander Larsson <alexl@redhat.com> [smcv: Fix DISABLE_SANDBOXED_TRIGGERS code path] [smcv: Make flatpak_run_maybe_start_dbus_proxy() more obviously correct] Signed-off-by: Simon McVittie <smcv@collabora.com>
flatpak · Apr 17, 2024 · b7c1a55 · b7c1a55
1 parent 2a9a668
commit b7c1a55
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 2 deletions.
diff --git a/app/flatpak-builtins-build.c b/app/flatpak-builtins-build.c
@@ -587,7 +587,8 @@ flatpak_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
-  flatpak_bwrap_add_args (bwrap, command, NULL);
+  flatpak_bwrap_add_args (bwrap, "--", command, NULL);
+
   flatpak_bwrap_append_argsv (bwrap,
                               &argv[rest_argv_start + 2],
                               rest_argc - 2);

diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
@@ -7071,6 +7071,7 @@ flatpak_dir_run_triggers (FlatpakDir   *self,
                                   "--proc", "/proc",
                                   "--dev", "/dev",
                                   "--bind", basedir, basedir,
+                                  "--",
                                   NULL);
 #endif
           flatpak_bwrap_add_args (bwrap,

diff --git a/common/flatpak-run.c b/common/flatpak-run.c
@@ -1299,6 +1299,9 @@ add_bwrap_wrapper (FlatpakBwrap *bwrap,
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
+  /* End of options: the next argument will be the executable name */
+  flatpak_bwrap_add_arg (bwrap, "--");
+
   return TRUE;
 }
 
@@ -4682,7 +4685,7 @@ flatpak_run_app (FlatpakDecomposed *app_ref,
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
-  flatpak_bwrap_add_arg (bwrap, command);
+  flatpak_bwrap_add_args (bwrap, "--", command, NULL);
 
   if (!add_rest_args (bwrap, app_id,
                       exports, (flags & FLATPAK_RUN_FLAG_FILE_FORWARDING) != 0,