Bug 278578 – [WPE][GTK] when flatpak sandbox unavailable, processes are run unsandboxed with no warning

• Status: REOPENED
• Component: WebKitGTK

i run `Tools/Scripts/run-minibrowser --release --gtk` or `flatpak run --share=network --socket=wayland --device=dri --command=/usr/libexec/webkitgtk-6.0/MiniBrowser org.gnome.Platform//master`

these are not installed apps, so flatpak-portal doesn't know about them.

from execsnoop logs it seems it tries to use `flatpak-spawn`, sees it's not available, and just silently falls back to no sandbox, with no warning printed

```
 /app/webkit/WebKitBuild/GTK/Release/bin/MiniBrowser 
 /app/webkit/WebKitBuild/GTK/Release/bin/WebKitNetworkProcess 6 13 15 
 /usr/bin/flatpak-spawn --sandbox --sandbox-expose-path-ro-try=/this_path_doesnt_exist echo 
 /app/webkit/WebKitBuild/GTK/Release/bin/WebKitWebProcess 13 18 20 
 /usr/libexec/p11-kit/p11-kit-remote --provider p11-kit-trust.so pkcs11:model=p11-kit-trust?write-protected=yes 
 /app/webkit/WebKitBuild/GTK/Release/bin/WebKitWebProcess 22 33 35 
 /app/webkit/WebKitBuild/GTK/Release/bin/WebKitWebProcess 26 36 39 
```

[Michael Catanzaro]

Well you can't use flatpak sandbox and you can't use bubblewrap sandbox. We could make it print a warning, sure. That's going to show up in test output, though.

[Michael Catanzaro]

I suppose it would be really bad to silently disable the sandbox if this we are actually running under flatpak and flatpak-spawn is legitimately broken. In that case, we should surely crash.

[Michael Catanzaro]

I'll add a crash. Of course this will break your use case, though.

(In reply to two from comment #0)
> i run `Tools/Scripts/run-minibrowser --release --gtk`

I assume this isn't actually running under flatpak and is just caused by bug #278774. If I'm wrong, then this will break run-minibrowser and we should have tons of EWS failures.

[Michael Catanzaro]

Pull request: https://github.com/WebKit/WebKit/pull/33206

[EWS]

Committed 283361@main (9fc6b8810c52): <https://commits.webkit.org/283361@main>

Reviewed commits have been landed. Closing PR #33206 and removing active labels.

[Michael Catanzaro]

Reopened Bugzilla.
Crash when running under flatpak without installed flatpak, as by run-minibrowser script, tracking revert in https://bugs.webkit.org/show_bug.cgi?id=279446.