XDG_RUNTIME_DIR not set inside of sandbox

[1kjo]

Linux distribution and version

Gentoo with the Sway Wayland compositor

Flatpak version

I tried both Flatpak 1.10.2 and 1.11.1 and they don't work.

Description of the problem

I have XDG_RUNTIME_DIR set to something other than /run/user/<UID>.

When running an application with Flatpak, it seems like it correctly sets up the sockets in /run/user/<UID> for the application but it also inherits my XDG_RUNTIME_DIR when it should instead set it to /run/user/<UID>. This breaks Wayland in the sandbox.

It can be seen by looking at the environment variables inside the sandbox by starting a shell:

$ echo $XDG_RUNTIME_DIR
/run/xdg-runtime-dir
$ flatpak run --user --command=sh org.mozilla.Thunderbird
[...]
[📦 org.mozilla.Thunderbird ~]$ echo $XDG_RUNTIME_DIR
/run/xdg-runtime-dir
[📦 org.mozilla.Thunderbird ~]$ ls $XDG_RUNTIME_DIR
ls: cannot access '/run/xdg-runtime-dir': No such file or directory
[📦 org.mozilla.Thunderbird ~]$ ls /run/user/1000
Xauthority  app  at-spi-bus  bus  flatpak-info	p11-kit  pulse	wayland-1

Steps to reproduce

I think running the following commands on a Wayland session should work to reproduce the issue. The application inside of the sandbox won't connect to the Wayland socket because the XDG_RUNTIME_DIR environment variable is not set correctly. Here I've chosen Thunderbird. For some reason, not all apps don't work: for instance, Firefox can still connect to the Wayland socket.

Setup

$ old_xdr="$XDG_RUNTIME_DIR"
$ export XDG_RUNTIME_DIR="$(mktemp -d)"
$ ln -s "$old_xdr/$WAYLAND_DISPLAY" "$XDG_RUNTIME_DIR/"

This command fails ...

$ flatpak run --nosocket=x11 --nosocket=fallback-x11 --env=MOZ_ENABLE_WAYLAND=1 org.mozilla.Thunderbird

... but not this one

$ flatpak run --nosocket=x11 --nosocket=fallback-x11 --env=MOZ_ENABLE_WAYLAND=1 --env=XDG_RUNTIME_DIR=/run/user/1000 org.mozilla.Thunderbird

[smcv]

I have XDG_RUNTIME_DIR set to something other than /run/user/<UID>.

Pragmatically, I'd recommend not doing that, if possible.

Flatpak is already meant to force it to /run/user/<UID> in the sandbox, but perhaps there's some inheritance happening in the wrong order...

[smcv]

Specifically, flatpak_run_setup_base_argv() in common/flatpak-run.c adds "--setenv", "XDG_RUNTIME_DIR", run_dir, to the bwrap command-line. It's possible that this is unintentionally getting overwritten as a result of the changes I made to resolve CVE-2021-21261.

If you run flatpak run with -vv, then that might help to indicate where this is going wrong.

Adding {"XDG_RUNTIME_DIR", NULL} to default_exports[] in common/flatpak-run.c might help?

[1kjo]

Specifically, flatpak_run_setup_base_argv() in common/flatpak-run.c adds "--setenv", "XDG_RUNTIME_DIR", run_dir, to the bwrap command-line. It's possible that this is unintentionally getting overwritten as a result of the changes I made to resolve CVE-2021-21261.

If you run flatpak run with -vv, then that might help to indicate where this is going wrong.

Yes, it seems like bwrap command line gets two arguments for setting XDG_RUNTIME_DIR.

$ flatpak run -vv --nosocket=x11 org.mozilla.Thunderbird
[...]
F: bwrap --args 36 = ...
[...]
F:     --dir
F:     /run/user/1000
F:     --setenv
F:     XDG_RUNTIME_DIR
F:     /run/user/1000
F:     --symlink
F:     ../run
F:     /var/run
[...]
F:     --setenv
F:     XDG_DATA_HOME
F:     /home/greg/.var/app/org.mozilla.Thunderbird/data
F:     --setenv
F:     XDG_RUNTIME_DIR
F:     /run/xdg-runtime-dir
[...]
F: Running 'bwrap --args 36 thunderbird'

Adding {"XDG_RUNTIME_DIR", NULL} to default_exports[] in common/flatpak-run.c might help?

Yes, with that change the second one is gone and the issue is fixed.

[smcv]

Minimal reproducer:

$ mkdir ~/tmp/xrd
$ XDG_RUNTIME_DIR=$HOME/tmp/xrd flatpak run --command=bash org.gnome.Recipes -c 'echo $XDG_RUNTIME_DIR'
/home/smcv/tmp/xrd

should output something like /run/user/1000 instead.