Bug 278578
| Summary: | [WPE][GTK] when flatpak sandbox unavailable, processes are run unsandboxed with no warning | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | two |
| Component: | WebKitGTK | Assignee: | Michael Catanzaro <mcatanzaro> |
| Status: | REOPENED | ||
| Severity: | Normal | CC: | bugs-noreply, mcatanzaro, nham |
| Priority: | P2 | ||
| Version: | WebKit Local Build | ||
| Hardware: | PC | ||
| OS: | Linux | ||
| Bug Depends on: | 279446 | ||
| Bug Blocks: | |||
two
i run `Tools/Scripts/run-minibrowser --release --gtk` or `flatpak run --share=network --socket=wayland --device=dri --command=/usr/libexec/webkitgtk-6.0/MiniBrowser org.gnome.Platform//master`
these are not installed apps, so flatpak-portal doesn't know about them.
from execsnoop logs it seems it tries to use `flatpak-spawn`, sees it's not available, and just silently falls back to no sandbox, with no warning printed
```
/app/webkit/WebKitBuild/GTK/Release/bin/MiniBrowser
/app/webkit/WebKitBuild/GTK/Release/bin/WebKitNetworkProcess 6 13 15
/usr/bin/flatpak-spawn --sandbox --sandbox-expose-path-ro-try=/this_path_doesnt_exist echo
/app/webkit/WebKitBuild/GTK/Release/bin/WebKitWebProcess 13 18 20
/usr/libexec/p11-kit/p11-kit-remote --provider p11-kit-trust.so pkcs11:model=p11-kit-trust?write-protected=yes
/app/webkit/WebKitBuild/GTK/Release/bin/WebKitWebProcess 22 33 35
/app/webkit/WebKitBuild/GTK/Release/bin/WebKitWebProcess 26 36 39
```
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Michael Catanzaro
Well you can't use flatpak sandbox and you can't use bubblewrap sandbox. We could make it print a warning, sure. That's going to show up in test output, though.
Michael Catanzaro
I suppose it would be really bad to silently disable the sandbox if this we are actually running under flatpak and flatpak-spawn is legitimately broken. In that case, we should surely crash.
Michael Catanzaro
I'll add a crash. Of course this will break your use case, though.
(In reply to two from comment #0)
> i run `Tools/Scripts/run-minibrowser --release --gtk`
I assume this isn't actually running under flatpak and is just caused by bug #278774. If I'm wrong, then this will break run-minibrowser and we should have tons of EWS failures.
Michael Catanzaro
Pull request: https://github.com/WebKit/WebKit/pull/33206
EWS
Committed 283361@main (9fc6b8810c52): <https://commits.webkit.org/283361@main>
Reviewed commits have been landed. Closing PR #33206 and removing active labels.
Michael Catanzaro
Reopened Bugzilla.
Crash when running under flatpak without installed flatpak, as by run-minibrowser script, tracking revert in https://bugs.webkit.org/show_bug.cgi?id=279446.