Pisilinux/main
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0e10948e4806dff453fff27eccf23c10ebaed708
main/hardware/virtualization/flatpak/files/bubblewrap_libglnx_submodule.patch
T
Ertuğrul Erata 3323140092 flatpak works continue... 
ostree has a build problems, flatpak-1.0.0 need >ostree-2018.7
2018-08-24 22:24:02 +03:00

13536 lines
496 KiB
Diff
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
diff -Nuar flatpak-1.0.0.orig/bubblewrap/autogen.sh flatpak-1.0.0/bubblewrap/autogen.sh
--- flatpak-1.0.0.orig/bubblewrap/autogen.sh 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/autogen.sh 2018-02-03 21:26:06.272233339 +0300
@@ -0,0 +1,19 @@
+#!/bin/sh
+
+test -n "$srcdir" || srcdir=`dirname "$0"`
+test -n "$srcdir" || srcdir=.
+
+olddir=`pwd`
+cd $srcdir
+
+if ! (autoreconf --version >/dev/null 2>&1); then
+ echo "*** No autoreconf found, please install it ***"
+ exit 1
+fi
+
+mkdir -p m4
+
+autoreconf --force --install --verbose
+
+cd $olddir
+test -n "$NOCONFIGURE" || "$srcdir/configure" "$@"
diff -Nuar flatpak-1.0.0.orig/bubblewrap/bind-mount.c flatpak-1.0.0/bubblewrap/bind-mount.c
--- flatpak-1.0.0.orig/bubblewrap/bind-mount.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/bind-mount.c 2018-02-03 21:26:06.272233339 +0300
@@ -0,0 +1,440 @@
+/* bubblewrap
+ * Copyright (C) 2016 Alexander Larsson
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "config.h"
+
+#include <sys/mount.h>
+
+#include "utils.h"
+#include "bind-mount.h"
+
+static char *
+skip_token (char *line, bool eat_whitespace)
+{
+ while (*line != ' ' && *line != '\n')
+ line++;
+
+ if (eat_whitespace && *line == ' ')
+ line++;
+
+ return line;
+}
+
+static char *
+unescape_inline (char *escaped)
+{
+ char *unescaped, *res;
+ const char *end;
+
+ res = escaped;
+ end = escaped + strlen (escaped);
+
+ unescaped = escaped;
+ while (escaped < end)
+ {
+ if (*escaped == '\\')
+ {
+ *unescaped++ =
+ ((escaped[1] - '0') << 6) |
+ ((escaped[2] - '0') << 3) |
+ ((escaped[3] - '0') << 0);
+ escaped += 4;
+ }
+ else
+ {
+ *unescaped++ = *escaped++;
+ }
+ }
+ *unescaped = 0;
+ return res;
+}
+
+static bool
+match_token (const char *token, const char *token_end, const char *str)
+{
+ while (token != token_end && *token == *str)
+ {
+ token++;
+ str++;
+ }
+ if (token == token_end)
+ return *str == 0;
+
+ return FALSE;
+}
+
+static unsigned long
+decode_mountoptions (const char *options)
+{
+ const char *token, *end_token;
+ int i;
+ unsigned long flags = 0;
+ static const struct { int flag;
+ char *name;
+ } flags_data[] = {
+ { 0, "rw" },
+ { MS_RDONLY, "ro" },
+ { MS_NOSUID, "nosuid" },
+ { MS_NODEV, "nodev" },
+ { MS_NOEXEC, "noexec" },
+ { MS_NOATIME, "noatime" },
+ { MS_NODIRATIME, "nodiratime" },
+ { MS_RELATIME, "relatime" },
+ { 0, NULL }
+ };
+
+ token = options;
+ do
+ {
+ end_token = strchr (token, ',');
+ if (end_token == NULL)
+ end_token = token + strlen (token);
+
+ for (i = 0; flags_data[i].name != NULL; i++)
+ {
+ if (match_token (token, end_token, flags_data[i].name))
+ {
+ flags |= flags_data[i].flag;
+ break;
+ }
+ }
+
+ if (*end_token != 0)
+ token = end_token + 1;
+ else
+ token = NULL;
+ }
+ while (token != NULL);
+
+ return flags;
+}
+
+typedef struct MountInfo MountInfo;
+struct MountInfo {
+ char *mountpoint;
+ unsigned long options;
+};
+
+typedef MountInfo *MountTab;
+
+static void
+mount_tab_free (MountTab tab)
+{
+ int i;
+
+ for (i = 0; tab[i].mountpoint != NULL; i++)
+ free (tab[i].mountpoint);
+ free (tab);
+}
+
+static inline void
+cleanup_mount_tabp (void *p)
+{
+ void **pp = (void **) p;
+
+ if (*pp)
+ mount_tab_free ((MountTab)*pp);
+}
+
+#define cleanup_mount_tab __attribute__((cleanup (cleanup_mount_tabp)))
+
+typedef struct MountInfoLine MountInfoLine;
+struct MountInfoLine {
+ const char *mountpoint;
+ const char *options;
+ bool covered;
+ int id;
+ int parent_id;
+ MountInfoLine *first_child;
+ MountInfoLine *next_sibling;
+};
+
+static unsigned int
+count_lines (const char *data)
+{
+ unsigned int count = 0;
+ const char *p = data;
+
+ while (*p != 0)
+ {
+ if (*p == '\n')
+ count++;
+ p++;
+ }
+
+ /* If missing final newline, add one */
+ if (p > data && *(p-1) != '\n')
+ count++;
+
+ return count;
+}
+
+static int
+count_mounts (MountInfoLine *line)
+{
+ MountInfoLine *child;
+ int res = 0;
+
+ if (!line->covered)
+ res += 1;
+
+ child = line->first_child;
+ while (child != NULL)
+ {
+ res += count_mounts (child);
+ child = child->next_sibling;
+ }
+
+ return res;
+}
+
+static MountInfo *
+collect_mounts (MountInfo *info, MountInfoLine *line)
+{
+ MountInfoLine *child;
+
+ if (!line->covered)
+ {
+ info->mountpoint = xstrdup (line->mountpoint);
+ info->options = decode_mountoptions (line->options);
+ info ++;
+ }
+
+ child = line->first_child;
+ while (child != NULL)
+ {
+ info = collect_mounts (info, child);
+ child = child->next_sibling;
+ }
+
+ return info;
+}
+
+static MountTab
+parse_mountinfo (int proc_fd,
+ const char *root_mount)
+{
+ cleanup_free char *mountinfo = NULL;
+ cleanup_free MountInfoLine *lines = NULL;
+ cleanup_free MountInfoLine **by_id = NULL;
+ cleanup_mount_tab MountTab mount_tab = NULL;
+ MountInfo *end_tab;
+ int n_mounts;
+ char *line;
+ int i;
+ int max_id;
+ unsigned int n_lines;
+ int root;
+
+ mountinfo = load_file_at (proc_fd, "self/mountinfo");
+ if (mountinfo == NULL)
+ die_with_error ("Can't open /proc/self/mountinfo");
+
+ n_lines = count_lines (mountinfo);
+ lines = xcalloc (n_lines * sizeof (MountInfoLine));
+
+ max_id = 0;
+ line = mountinfo;
+ i = 0;
+ root = -1;
+ while (*line != 0)
+ {
+ int rc, consumed = 0;
+ unsigned int maj, min;
+ char *end;
+ char *rest;
+ char *mountpoint;
+ char *mountpoint_end;
+ char *options;
+ char *options_end;
+ char *next_line;
+
+ assert (i < n_lines);
+
+ end = strchr (line, '\n');
+ if (end != NULL)
+ {
+ *end = 0;
+ next_line = end + 1;
+ }
+ else
+ next_line = line + strlen (line);
+
+ rc = sscanf (line, "%d %d %u:%u %n", &lines[i].id, &lines[i].parent_id, &maj, &min, &consumed);
+ if (rc != 4)
+ die ("Can't parse mountinfo line");
+ rest = line + consumed;
+
+ rest = skip_token (rest, TRUE); /* mountroot */
+ mountpoint = rest;
+ rest = skip_token (rest, FALSE); /* mountpoint */
+ mountpoint_end = rest++;
+ options = rest;
+ rest = skip_token (rest, FALSE); /* vfs options */
+ options_end = rest;
+
+ *mountpoint_end = 0;
+ lines[i].mountpoint = unescape_inline (mountpoint);
+
+ *options_end = 0;
+ lines[i].options = options;
+
+ if (lines[i].id > max_id)
+ max_id = lines[i].id;
+ if (lines[i].parent_id > max_id)
+ max_id = lines[i].parent_id;
+
+ if (path_equal (lines[i].mountpoint, root_mount))
+ root = i;
+
+ i++;
+ line = next_line;
+ }
+ assert (i == n_lines);
+
+ if (root == -1)
+ {
+ mount_tab = xcalloc (sizeof (MountInfo) * (1));
+ return steal_pointer (&mount_tab);
+ }
+
+ by_id = xcalloc ((max_id + 1) * sizeof (MountInfoLine*));
+ for (i = 0; i < n_lines; i++)
+ by_id[lines[i].id] = &lines[i];
+
+ for (i = 0; i < n_lines; i++)
+ {
+ MountInfoLine *this = &lines[i];
+ MountInfoLine *parent = by_id[this->parent_id];
+ MountInfoLine **to_sibling;
+ MountInfoLine *sibling;
+ bool covered = FALSE;
+
+ if (!has_path_prefix (this->mountpoint, root_mount))
+ continue;
+
+ if (parent == NULL)
+ continue;
+
+ if (strcmp (parent->mountpoint, this->mountpoint) == 0)
+ parent->covered = TRUE;
+
+ to_sibling = &parent->first_child;
+ sibling = parent->first_child;
+ while (sibling != NULL)
+ {
+ /* If this mountpoint is a path prefix of the sibling,
+ * say this->mp=/foo/bar and sibling->mp=/foo, then it is
+ * covered by the sibling, and we drop it. */
+ if (has_path_prefix (this->mountpoint, sibling->mountpoint))
+ {
+ covered = TRUE;
+ break;
+ }
+
+ /* If the sibling is a path prefix of this mount point,
+ * say this->mp=/foo and sibling->mp=/foo/bar, then the sibling
+ * is covered, and we drop it.
+ */
+ if (has_path_prefix (sibling->mountpoint, this->mountpoint))
+ *to_sibling = sibling->next_sibling;
+ else
+ to_sibling = &sibling->next_sibling;
+ sibling = sibling->next_sibling;
+ }
+
+ if (covered)
+ continue;
+
+ *to_sibling = this;
+ }
+
+ n_mounts = count_mounts (&lines[root]);
+ mount_tab = xcalloc (sizeof (MountInfo) * (n_mounts + 1));
+
+ end_tab = collect_mounts (&mount_tab[0], &lines[root]);
+ assert (end_tab == &mount_tab[n_mounts]);
+
+ return steal_pointer (&mount_tab);
+}
+
+int
+bind_mount (int proc_fd,
+ const char *src,
+ const char *dest,
+ bind_option_t options)
+{
+ bool readonly = (options & BIND_READONLY) != 0;
+ bool devices = (options & BIND_DEVICES) != 0;
+ bool recursive = (options & BIND_RECURSIVE) != 0;
+ unsigned long current_flags, new_flags;
+ cleanup_mount_tab MountTab mount_tab = NULL;
+ cleanup_free char *resolved_dest = NULL;
+ int i;
+
+ if (src)
+ {
+ if (mount (src, dest, NULL, MS_MGC_VAL | MS_BIND | (recursive ? MS_REC : 0), NULL) != 0)
+ return 1;
+ }
+
+ /* The mount operation will resolve any symlinks in the destination
+ path, so to find it in the mount table we need to do that too. */
+ resolved_dest = realpath (dest, NULL);
+ if (resolved_dest == NULL)
+ return 2;
+
+ mount_tab = parse_mountinfo (proc_fd, resolved_dest);
+ if (mount_tab[0].mountpoint == NULL)
+ {
+ errno = EINVAL;
+ return 2; /* No mountpoint at dest */
+ }
+
+ assert (path_equal (mount_tab[0].mountpoint, resolved_dest));
+ current_flags = mount_tab[0].options;
+ new_flags = current_flags | (devices ? 0 : MS_NODEV) | MS_NOSUID | (readonly ? MS_RDONLY : 0);
+ if (new_flags != current_flags &&
+ mount ("none", resolved_dest,
+ NULL, MS_MGC_VAL | MS_BIND | MS_REMOUNT | new_flags, NULL) != 0)
+ return 3;
+
+ /* We need to work around the fact that a bind mount does not apply the flags, so we need to manually
+ * apply the flags to all submounts in the recursive case.
+ * Note: This does not apply the flags to mounts which are later propagated into this namespace.
+ */
+ if (recursive)
+ {
+ for (i = 1; mount_tab[i].mountpoint != NULL; i++)
+ {
+ current_flags = mount_tab[i].options;
+ new_flags = current_flags | (devices ? 0 : MS_NODEV) | MS_NOSUID | (readonly ? MS_RDONLY : 0);
+ if (new_flags != current_flags &&
+ mount ("none", mount_tab[i].mountpoint,
+ NULL, MS_MGC_VAL | MS_BIND | MS_REMOUNT | new_flags, NULL) != 0)
+ {
+ /* If we can't read the mountpoint we can't remount it, but that should
+ be safe to ignore because its not something the user can access. */
+ if (errno != EACCES)
+ return 5;
+ }
+ }
+ }
+
+ return 0;
+}
diff -Nuar flatpak-1.0.0.orig/bubblewrap/bind-mount.h flatpak-1.0.0/bubblewrap/bind-mount.h
--- flatpak-1.0.0.orig/bubblewrap/bind-mount.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/bind-mount.h 2018-02-03 21:26:06.272233339 +0300
@@ -0,0 +1,30 @@
+/* bubblewrap
+ * Copyright (C) 2016 Alexander Larsson
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+typedef enum {
+ BIND_READONLY = (1 << 0),
+ BIND_DEVICES = (1 << 2),
+ BIND_RECURSIVE = (1 << 3),
+} bind_option_t;
+
+int bind_mount (int proc_fd,
+ const char *src,
+ const char *dest,
+ bind_option_t options);
diff -Nuar flatpak-1.0.0.orig/bubblewrap/bubblewrap.c flatpak-1.0.0/bubblewrap/bubblewrap.c
--- flatpak-1.0.0.orig/bubblewrap/bubblewrap.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/bubblewrap.c 2018-02-03 21:26:06.272233339 +0300
@@ -0,0 +1,2223 @@
+/* bubblewrap
+ * Copyright (C) 2016 Alexander Larsson
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "config.h"
+
+#include <poll.h>
+#include <sched.h>
+#include <pwd.h>
+#include <grp.h>
+#include <sys/mount.h>
+#include <sys/socket.h>
+#include <sys/wait.h>
+#include <sys/eventfd.h>
+#include <sys/fsuid.h>
+#include <sys/signalfd.h>
+#include <sys/capability.h>
+#include <sys/prctl.h>
+#include <linux/sched.h>
+#include <linux/seccomp.h>
+#include <linux/filter.h>
+
+#include "utils.h"
+#include "network.h"
+#include "bind-mount.h"
+
+#ifndef CLONE_NEWCGROUP
+#define CLONE_NEWCGROUP 0x02000000 /* New cgroup namespace */
+#endif
+
+/* Globals to avoid having to use getuid(), since the uid/gid changes during runtime */
+static uid_t real_uid;
+static gid_t real_gid;
+static uid_t overflow_uid;
+static gid_t overflow_gid;
+static bool is_privileged;
+static const char *argv0;
+static const char *host_tty_dev;
+static int proc_fd = -1;
+static char *opt_exec_label = NULL;
+static char *opt_file_label = NULL;
+
+char *opt_chdir_path = NULL;
+bool opt_unshare_user = FALSE;
+bool opt_unshare_user_try = FALSE;
+bool opt_unshare_pid = FALSE;
+bool opt_unshare_ipc = FALSE;
+bool opt_unshare_net = FALSE;
+bool opt_unshare_uts = FALSE;
+bool opt_unshare_cgroup = FALSE;
+bool opt_unshare_cgroup_try = FALSE;
+bool opt_needs_devpts = FALSE;
+bool opt_new_session = FALSE;
+bool opt_die_with_parent = FALSE;
+uid_t opt_sandbox_uid = -1;
+gid_t opt_sandbox_gid = -1;
+int opt_sync_fd = -1;
+int opt_block_fd = -1;
+int opt_info_fd = -1;
+int opt_seccomp_fd = -1;
+char *opt_sandbox_hostname = NULL;
+
+typedef enum {
+ SETUP_BIND_MOUNT,
+ SETUP_RO_BIND_MOUNT,
+ SETUP_DEV_BIND_MOUNT,
+ SETUP_MOUNT_PROC,
+ SETUP_MOUNT_DEV,
+ SETUP_MOUNT_TMPFS,
+ SETUP_MOUNT_MQUEUE,
+ SETUP_MAKE_DIR,
+ SETUP_MAKE_FILE,
+ SETUP_MAKE_BIND_FILE,
+ SETUP_MAKE_RO_BIND_FILE,
+ SETUP_MAKE_SYMLINK,
+ SETUP_REMOUNT_RO_NO_RECURSIVE,
+ SETUP_SET_HOSTNAME,
+} SetupOpType;
+
+typedef enum {
+ NO_CREATE_DEST = (1 << 0),
+} SetupOpFlag;
+
+typedef struct _SetupOp SetupOp;
+
+struct _SetupOp
+{
+ SetupOpType type;
+ const char *source;
+ const char *dest;
+ int fd;
+ SetupOpFlag flags;
+ SetupOp *next;
+};
+
+typedef struct _LockFile LockFile;
+
+struct _LockFile
+{
+ const char *path;
+ LockFile *next;
+};
+
+static SetupOp *ops = NULL;
+static SetupOp *last_op = NULL;
+static LockFile *lock_files = NULL;
+static LockFile *last_lock_file = NULL;
+
+enum {
+ PRIV_SEP_OP_DONE,
+ PRIV_SEP_OP_BIND_MOUNT,
+ PRIV_SEP_OP_PROC_MOUNT,
+ PRIV_SEP_OP_TMPFS_MOUNT,
+ PRIV_SEP_OP_DEVPTS_MOUNT,
+ PRIV_SEP_OP_MQUEUE_MOUNT,
+ PRIV_SEP_OP_REMOUNT_RO_NO_RECURSIVE,
+ PRIV_SEP_OP_SET_HOSTNAME,
+};
+
+typedef struct
+{
+ uint32_t op;
+ uint32_t flags;
+ uint32_t arg1_offset;
+ uint32_t arg2_offset;
+} PrivSepOp;
+
+static SetupOp *
+setup_op_new (SetupOpType type)
+{
+ SetupOp *op = xcalloc (sizeof (SetupOp));
+
+ op->type = type;
+ op->fd = -1;
+ op->flags = 0;
+ if (last_op != NULL)
+ last_op->next = op;
+ else
+ ops = op;
+
+ last_op = op;
+ return op;
+}
+
+static LockFile *
+lock_file_new (const char *path)
+{
+ LockFile *lock = xcalloc (sizeof (LockFile));
+
+ lock->path = path;
+ if (last_lock_file != NULL)
+ last_lock_file->next = lock;
+ else
+ lock_files = lock;
+
+ last_lock_file = lock;
+ return lock;
+}
+
+
+static void
+usage (int ecode, FILE *out)
+{
+ fprintf (out, "usage: %s [OPTIONS...] COMMAND [ARGS...]\n\n", argv0);
+
+ fprintf (out,
+ " --help Print this help\n"
+ " --version Print version\n"
+ " --args FD Parse nul-separated args from FD\n"
+ " --unshare-all Unshare every namespace we support by default\n"
+ " --share-net Retain the network namespace (can only combine with --unshare-all)\n"
+ " --unshare-user Create new user namespace (may be automatically implied if not setuid)\n"
+ " --unshare-user-try Create new user namespace if possible else continue by skipping it\n"
+ " --unshare-ipc Create new ipc namespace\n"
+ " --unshare-pid Create new pid namespace\n"
+ " --unshare-net Create new network namespace\n"
+ " --unshare-uts Create new uts namespace\n"
+ " --unshare-cgroup Create new cgroup namespace\n"
+ " --unshare-cgroup-try Create new cgroup namespace if possible else continue by skipping it\n"
+ " --uid UID Custom uid in the sandbox (requires --unshare-user)\n"
+ " --gid GID Custon gid in the sandbox (requires --unshare-user)\n"
+ " --hostname NAME Custom hostname in the sandbox (requires --unshare-uts)\n"
+ " --chdir DIR Change directory to DIR\n"
+ " --setenv VAR VALUE Set an environment variable\n"
+ " --unsetenv VAR Unset an environment variable\n"
+ " --lock-file DEST Take a lock on DEST while sandbox is running\n"
+ " --sync-fd FD Keep this fd open while sandbox is running\n"
+ " --bind SRC DEST Bind mount the host path SRC on DEST\n"
+ " --dev-bind SRC DEST Bind mount the host path SRC on DEST, allowing device access\n"
+ " --ro-bind SRC DEST Bind mount the host path SRC readonly on DEST\n"
+ " --remount-ro DEST Remount DEST as readonly, it doesn't recursively remount\n"
+ " --exec-label LABEL Exec Label for the sandbox\n"
+ " --file-label LABEL File label for temporary sandbox content\n"
+ " --proc DEST Mount procfs on DEST\n"
+ " --dev DEST Mount new dev on DEST\n"
+ " --tmpfs DEST Mount new tmpfs on DEST\n"
+ " --mqueue DEST Mount new mqueue on DEST\n"
+ " --dir DEST Create dir at DEST\n"
+ " --file FD DEST Copy from FD to dest DEST\n"
+ " --bind-data FD DEST Copy from FD to file which is bind-mounted on DEST\n"
+ " --ro-bind-data FD DEST Copy from FD to file which is readonly bind-mounted on DEST\n"
+ " --symlink SRC DEST Create symlink at DEST with target SRC\n"
+ " --seccomp FD Load and use seccomp rules from FD\n"
+ " --block-fd FD Block on FD until some data to read is available\n"
+ " --info-fd FD Write information about the running container to FD\n"
+ " --new-session Create a new terminal session\n"
+ " --die-with-parent Kills with SIGKILL child process (COMMAND) when bwrap or bwrap's parent dies.\n"
+ );
+ exit (ecode);
+}
+
+/* If --die-with-parent was specified, use PDEATHSIG to ensure SIGKILL
+ * is sent to the current process when our parent dies.
+ */
+static void
+handle_die_with_parent (void)
+{
+ if (opt_die_with_parent && prctl (PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0) != 0)
+ die_with_error ("prctl");
+}
+
+static void
+block_sigchild (void)
+{
+ sigset_t mask;
+ int status;
+
+ sigemptyset (&mask);
+ sigaddset (&mask, SIGCHLD);
+
+ if (sigprocmask (SIG_BLOCK, &mask, NULL) == -1)
+ die_with_error ("sigprocmask");
+
+ /* Reap any outstanding zombies that we may have inherited */
+ while (waitpid (-1, &status, WNOHANG) > 0)
+ ;
+}
+
+static void
+unblock_sigchild (void)
+{
+ sigset_t mask;
+
+ sigemptyset (&mask);
+ sigaddset (&mask, SIGCHLD);
+
+ if (sigprocmask (SIG_UNBLOCK, &mask, NULL) == -1)
+ die_with_error ("sigprocmask");
+}
+
+/* Closes all fd:s except 0,1,2 and the passed in array of extra fds */
+static int
+close_extra_fds (void *data, int fd)
+{
+ int *extra_fds = (int *) data;
+ int i;
+
+ for (i = 0; extra_fds[i] != -1; i++)
+ if (fd == extra_fds[i])
+ return 0;
+
+ if (fd <= 2)
+ return 0;
+
+ close (fd);
+ return 0;
+}
+
+static int
+propagate_exit_status (int status)
+{
+ if (WIFEXITED (status))
+ return WEXITSTATUS (status);
+
+ /* The process died of a signal, we can't really report that, but we
+ * can at least be bash-compatible. The bash manpage says:
+ * The return value of a simple command is its
+ * exit status, or 128+n if the command is
+ * terminated by signal n.
+ */
+ if (WIFSIGNALED (status))
+ return 128 + WTERMSIG (status);
+
+ /* Weird? */
+ return 255;
+}
+
+/* This stays around for as long as the initial process in the app does
+ * and when that exits it exits, propagating the exit status. We do this
+ * by having pid 1 in the sandbox detect this exit and tell the monitor
+ * the exit status via a eventfd. We also track the exit of the sandbox
+ * pid 1 via a signalfd for SIGCHLD, and exit with an error in this case.
+ * This is to catch e.g. problems during setup. */
+static void
+monitor_child (int event_fd, pid_t child_pid)
+{
+ int res;
+ uint64_t val;
+ ssize_t s;
+ int signal_fd;
+ sigset_t mask;
+ struct pollfd fds[2];
+ int num_fds;
+ struct signalfd_siginfo fdsi;
+ int dont_close[] = { event_fd, -1 };
+ pid_t died_pid;
+ int died_status;
+
+ /* Close all extra fds in the monitoring process.
+ Any passed in fds have been passed on to the child anyway. */
+ fdwalk (proc_fd, close_extra_fds, dont_close);
+
+ sigemptyset (&mask);
+ sigaddset (&mask, SIGCHLD);
+
+ signal_fd = signalfd (-1, &mask, SFD_CLOEXEC | SFD_NONBLOCK);
+ if (signal_fd == -1)
+ die_with_error ("Can't create signalfd");
+
+ num_fds = 1;
+ fds[0].fd = signal_fd;
+ fds[0].events = POLLIN;
+ if (event_fd != -1)
+ {
+ fds[1].fd = event_fd;
+ fds[1].events = POLLIN;
+ num_fds++;
+ }
+
+ while (1)
+ {
+ fds[0].revents = fds[1].revents = 0;
+ res = poll (fds, num_fds, -1);
+ if (res == -1 && errno != EINTR)
+ die_with_error ("poll");
+
+ /* Always read from the eventfd first, if pid 2 died then pid 1 often
+ * dies too, and we could race, reporting that first and we'd lose
+ * the real exit status. */
+ if (event_fd != -1)
+ {
+ s = read (event_fd, &val, 8);
+ if (s == -1 && errno != EINTR && errno != EAGAIN)
+ die_with_error ("read eventfd");
+ else if (s == 8)
+ exit ((int) val - 1);
+ }
+
+ /* We need to read the signal_fd, or it will keep polling as read,
+ * however we ignore the details as we get them from waitpid
+ * below anway */
+ s = read (signal_fd, &fdsi, sizeof (struct signalfd_siginfo));
+ if (s == -1 && errno != EINTR && errno != EAGAIN)
+ die_with_error ("read signalfd");
+
+ /* We may actually get several sigchld compressed into one
+ SIGCHLD, so we have to handle all of them. */
+ while ((died_pid = waitpid (-1, &died_status, WNOHANG)) > 0)
+ {
+ /* We may be getting sigchild from other children too. For instance if
+ someone created a child process, and then exec:ed bubblewrap. Ignore them */
+ if (died_pid == child_pid)
+ exit (propagate_exit_status (died_status));
+ }
+ }
+}
+
+/* This is pid 1 in the app sandbox. It is needed because we're using
+ * pid namespaces, and someone has to reap zombies in it. We also detect
+ * when the initial process (pid 2) dies and report its exit status to
+ * the monitor so that it can return it to the original spawner.
+ *
+ * When there are no other processes in the sandbox the wait will return
+ * ECHILD, and we then exit pid 1 to clean up the sandbox. */
+static int
+do_init (int event_fd, pid_t initial_pid, struct sock_fprog *seccomp_prog)
+{
+ int initial_exit_status = 1;
+ LockFile *lock;
+
+ for (lock = lock_files; lock != NULL; lock = lock->next)
+ {
+ int fd = open (lock->path, O_RDONLY | O_CLOEXEC);
+ if (fd == -1)
+ die_with_error ("Unable to open lock file %s", lock->path);
+
+ struct flock l = {
+ .l_type = F_RDLCK,
+ .l_whence = SEEK_SET,
+ .l_start = 0,
+ .l_len = 0
+ };
+
+ if (fcntl (fd, F_SETLK, &l) < 0)
+ die_with_error ("Unable to lock file %s", lock->path);
+
+ /* Keep fd open to hang on to lock */
+ }
+
+ /* Optionally bind our lifecycle to that of the caller */
+ handle_die_with_parent ();
+
+ if (seccomp_prog != NULL &&
+ prctl (PR_SET_SECCOMP, SECCOMP_MODE_FILTER, seccomp_prog) != 0)
+ die_with_error ("prctl(PR_SET_SECCOMP)");
+
+ while (TRUE)
+ {
+ pid_t child;
+ int status;
+
+ child = wait (&status);
+ if (child == initial_pid && event_fd != -1)
+ {
+ uint64_t val;
+ int res UNUSED;
+
+ initial_exit_status = propagate_exit_status (status);
+
+ val = initial_exit_status + 1;
+ res = write (event_fd, &val, 8);
+ /* Ignore res, if e.g. the parent died and closed event_fd
+ we don't want to error out here */
+ }
+
+ if (child == -1 && errno != EINTR)
+ {
+ if (errno != ECHILD)
+ die_with_error ("init wait()");
+ break;
+ }
+ }
+
+ return initial_exit_status;
+}
+
+/* low 32bit caps needed */
+#define REQUIRED_CAPS_0 (CAP_TO_MASK (CAP_SYS_ADMIN) | CAP_TO_MASK (CAP_SYS_CHROOT) | CAP_TO_MASK (CAP_NET_ADMIN) | CAP_TO_MASK (CAP_SETUID) | CAP_TO_MASK (CAP_SETGID))
+/* high 32bit caps needed */
+#define REQUIRED_CAPS_1 0
+
+static void
+set_required_caps (void)
+{
+ struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };
+ struct __user_cap_data_struct data[2] = { { 0 } };
+
+ /* Drop all non-require capabilities */
+ data[0].effective = REQUIRED_CAPS_0;
+ data[0].permitted = REQUIRED_CAPS_0;
+ data[0].inheritable = 0;
+ data[1].effective = REQUIRED_CAPS_1;
+ data[1].permitted = REQUIRED_CAPS_1;
+ data[1].inheritable = 0;
+ if (capset (&hdr, data) < 0)
+ die_with_error ("capset failed");
+}
+
+static void
+drop_all_caps (void)
+{
+ struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };
+ struct __user_cap_data_struct data[2] = { { 0 } };
+
+ if (capset (&hdr, data) < 0)
+ die_with_error ("capset failed");
+}
+
+static bool
+has_caps (void)
+{
+ struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };
+ struct __user_cap_data_struct data[2] = { { 0 } };
+
+ if (capget (&hdr, data) < 0)
+ die_with_error ("capget failed");
+
+ return data[0].permitted != 0 || data[1].permitted != 0;
+}
+
+static void
+drop_cap_bounding_set (void)
+{
+ unsigned long cap;
+
+ /* We ignore both EINVAL and EPERM, as we are actually relying
+ * on PR_SET_NO_NEW_PRIVS to ensure the right capabilities are
+ * available. EPERM in particular can happen with old, buggy
+ * kernels. See:
+ * https://github.com/projectatomic/bubblewrap/pull/175#issuecomment-278051373
+ * https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/security/commoncap.c?id=160da84dbb39443fdade7151bc63a88f8e953077
+ */
+ for (cap = 0; cap <= 63; cap++)
+ {
+ int res = prctl (PR_CAPBSET_DROP, cap, 0, 0, 0);
+ if (res == -1 && !(errno == EINVAL || errno == EPERM))
+ die_with_error ("Dropping capability %ld from bounds", cap);
+ }
+}
+
+/* This acquires the privileges that the bwrap will need it to work.
+ * If bwrap is not setuid, then this does nothing, and it relies on
+ * unprivileged user namespaces to be used. This case is
+ * "is_privileged = FALSE".
+ *
+ * If bwrap is setuid, then we do things in phases.
+ * The first part is run as euid 0, but with with fsuid as the real user.
+ * The second part, inside the child, is run as the real user but with
+ * capabilities.
+ * And finally we drop all capabilities.
+ * The reason for the above dance is to avoid having the setup phase
+ * being able to read files the user can't, while at the same time
+ * working around various kernel issues. See below for details.
+ */
+static void
+acquire_privs (void)
+{
+ uid_t euid, new_fsuid;
+
+ euid = geteuid ();
+
+ /* Are we setuid ? */
+ if (real_uid != euid)
+ {
+ if (euid == 0)
+ is_privileged = TRUE;
+ else
+ die ("Unexpected setuid user %d, should be 0", euid);
+
+ /* We want to keep running as euid=0 until at the clone()
+ * operation because doing so will make the user namespace be
+ * owned by root, which makes it not ptrace:able by the user as
+ * it otherwise would be. After that we will run fully as the
+ * user, which is necessary e.g. to be able to read from a fuse
+ * mount from the user.
+ *
+ * However, we don't want to accidentally mis-use euid=0 for
+ * escalated filesystem access before the clone(), so we set
+ * fsuid to the uid.
+ */
+ if (setfsuid (real_uid) < 0)
+ die_with_error ("Unable to set fsuid");
+
+ /* setfsuid can't properly report errors, check that it worked (as per manpage) */
+ new_fsuid = setfsuid (-1);
+ if (new_fsuid != real_uid)
+ die ("Unable to set fsuid (was %d)", (int)new_fsuid);
+
+ /* We never need capabilies after execve(), so lets drop everything from the bounding set */
+ drop_cap_bounding_set ();
+
+ /* Keep only the required capabilities for setup */
+ set_required_caps ();
+ }
+ else if (real_uid != 0 && has_caps ())
+ {
+ /* We have some capabilities in the non-setuid case, which should not happen.
+ Probably caused by the binary being setcap instead of setuid which we
+ don't support anymore */
+ die ("Unexpected capabilities but not setuid, old file caps config?");
+ }
+
+ /* Else, we try unprivileged user namespaces */
+}
+
+/* This is called once we're inside the namespace */
+static void
+switch_to_user_with_privs (void)
+{
+ /* If we're in a new user namespace, we got back the bounding set, clear it again */
+ if (opt_unshare_user)
+ drop_cap_bounding_set ();
+
+ if (!is_privileged)
+ return;
+
+ /* Tell kernel not clear capabilities when later dropping root uid */
+ if (prctl (PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0)
+ die_with_error ("prctl(PR_SET_KEEPCAPS) failed");
+
+ if (setuid (opt_sandbox_uid) < 0)
+ die_with_error ("unable to drop root uid");
+
+ /* Regain effective required capabilities from permitted */
+ set_required_caps ();
+}
+
+static void
+drop_privs (void)
+{
+ if (!is_privileged)
+ return;
+
+ /* Drop root uid */
+ if (setuid (opt_sandbox_uid) < 0)
+ die_with_error ("unable to drop root uid");
+
+ drop_all_caps ();
+}
+
+static char *
+get_newroot_path (const char *path)
+{
+ while (*path == '/')
+ path++;
+ return strconcat ("/newroot/", path);
+}
+
+static char *
+get_oldroot_path (const char *path)
+{
+ while (*path == '/')
+ path++;
+ return strconcat ("/oldroot/", path);
+}
+
+static void
+write_uid_gid_map (uid_t sandbox_uid,
+ uid_t parent_uid,
+ uid_t sandbox_gid,
+ uid_t parent_gid,
+ pid_t pid,
+ bool deny_groups,
+ bool map_root)
+{
+ cleanup_free char *uid_map = NULL;
+ cleanup_free char *gid_map = NULL;
+ cleanup_free char *dir = NULL;
+ cleanup_fd int dir_fd = -1;
+ uid_t old_fsuid = -1;
+
+ if (pid == -1)
+ dir = xstrdup ("self");
+ else
+ dir = xasprintf ("%d", pid);
+
+ dir_fd = openat (proc_fd, dir, O_RDONLY | O_PATH);
+ if (dir_fd < 0)
+ die_with_error ("open /proc/%s failed", dir);
+
+ if (map_root && parent_uid != 0 && sandbox_uid != 0)
+ uid_map = xasprintf ("0 %d 1\n"
+ "%d %d 1\n", overflow_uid, sandbox_uid, parent_uid);
+ else
+ uid_map = xasprintf ("%d %d 1\n", sandbox_uid, parent_uid);
+
+ if (map_root && parent_gid != 0 && sandbox_gid != 0)
+ gid_map = xasprintf ("0 %d 1\n"
+ "%d %d 1\n", overflow_gid, sandbox_gid, parent_gid);
+ else
+ gid_map = xasprintf ("%d %d 1\n", sandbox_gid, parent_gid);
+
+ /* We have to be root to be allowed to write to the uid map
+ * for setuid apps, so temporary set fsuid to 0 */
+ if (is_privileged)
+ old_fsuid = setfsuid (0);
+
+ if (write_file_at (dir_fd, "uid_map", uid_map) != 0)
+ die_with_error ("setting up uid map");
+
+ if (deny_groups &&
+ write_file_at (dir_fd, "setgroups", "deny\n") != 0)
+ {
+ /* If /proc/[pid]/setgroups does not exist, assume we are
+ * running a linux kernel < 3.19, i.e. we live with the
+ * vulnerability known as CVE-2014-8989 in older kernels
+ * where setgroups does not exist.
+ */
+ if (errno != ENOENT)
+ die_with_error ("error writing to setgroups");
+ }
+
+ if (write_file_at (dir_fd, "gid_map", gid_map) != 0)
+ die_with_error ("setting up gid map");
+
+ if (is_privileged)
+ {
+ setfsuid (old_fsuid);
+ if (setfsuid (-1) != real_uid)
+ die ("Unable to re-set fsuid");
+ }
+}
+
+static void
+privileged_op (int privileged_op_socket,
+ uint32_t op,
+ uint32_t flags,
+ const char *arg1,
+ const char *arg2)
+{
+ if (privileged_op_socket != -1)
+ {
+ uint32_t buffer[2048]; /* 8k, but is int32 to guarantee nice alignment */
+ PrivSepOp *op_buffer = (PrivSepOp *) buffer;
+ size_t buffer_size = sizeof (PrivSepOp);
+ uint32_t arg1_offset = 0, arg2_offset = 0;
+
+ /* We're unprivileged, send this request to the privileged part */
+
+ if (arg1 != NULL)
+ {
+ arg1_offset = buffer_size;
+ buffer_size += strlen (arg1) + 1;
+ }
+ if (arg2 != NULL)
+ {
+ arg2_offset = buffer_size;
+ buffer_size += strlen (arg2) + 1;
+ }
+
+ if (buffer_size >= sizeof (buffer))
+ die ("privilege separation operation to large");
+
+ op_buffer->op = op;
+ op_buffer->flags = flags;
+ op_buffer->arg1_offset = arg1_offset;
+ op_buffer->arg2_offset = arg2_offset;
+ if (arg1 != NULL)
+ strcpy ((char *) buffer + arg1_offset, arg1);
+ if (arg2 != NULL)
+ strcpy ((char *) buffer + arg2_offset, arg2);
+
+ if (write (privileged_op_socket, buffer, buffer_size) != buffer_size)
+ die ("Can't write to privileged_op_socket");
+
+ if (read (privileged_op_socket, buffer, 1) != 1)
+ die ("Can't read from privileged_op_socket");
+
+ return;
+ }
+
+ /*
+ * This runs a privileged request for the unprivileged setup
+ * code. Note that since the setup code is unprivileged it is not as
+ * trusted, so we need to verify that all requests only affect the
+ * child namespace as set up by the privileged parts of the setup,
+ * and that all the code is very careful about handling input.
+ *
+ * This means:
+ * * Bind mounts are safe, since we always use filesystem namespace. They
+ * must be recursive though, as otherwise you can use a non-recursive bind
+ * mount to access an otherwise over-mounted mountpoint.
+ * * Mounting proc, tmpfs, mqueue, devpts in the child namespace is assumed to
+ * be safe.
+ * * Remounting RO (even non-recursive) is safe because it decreases privileges.
+ * * sethostname() is safe only if we set up a UTS namespace
+ */
+ switch (op)
+ {
+ case PRIV_SEP_OP_DONE:
+ break;
+
+ case PRIV_SEP_OP_REMOUNT_RO_NO_RECURSIVE:
+ if (bind_mount (proc_fd, NULL, arg2, BIND_READONLY) != 0)
+ die_with_error ("Can't remount readonly on %s", arg2);
+ break;
+
+ case PRIV_SEP_OP_BIND_MOUNT:
+ /* We always bind directories recursively, otherwise this would let us
+ access files that are otherwise covered on the host */
+ if (bind_mount (proc_fd, arg1, arg2, BIND_RECURSIVE | flags) != 0)
+ die_with_error ("Can't bind mount %s on %s", arg1, arg2);
+ break;
+
+ case PRIV_SEP_OP_PROC_MOUNT:
+ if (mount ("proc", arg1, "proc", MS_MGC_VAL | MS_NOSUID | MS_NOEXEC | MS_NODEV, NULL) != 0)
+ die_with_error ("Can't mount proc on %s", arg1);
+ break;
+
+ case PRIV_SEP_OP_TMPFS_MOUNT:
+ {
+ cleanup_free char *opt = label_mount ("mode=0755", opt_file_label);
+ if (mount ("tmpfs", arg1, "tmpfs", MS_MGC_VAL | MS_NOSUID | MS_NODEV, opt) != 0)
+ die_with_error ("Can't mount tmpfs on %s", arg1);
+ break;
+ }
+
+ case PRIV_SEP_OP_DEVPTS_MOUNT:
+ if (mount ("devpts", arg1, "devpts", MS_MGC_VAL | MS_NOSUID | MS_NOEXEC,
+ "newinstance,ptmxmode=0666,mode=620") != 0)
+ die_with_error ("Can't mount devpts on %s", arg1);
+ break;
+
+ case PRIV_SEP_OP_MQUEUE_MOUNT:
+ if (mount ("mqueue", arg1, "mqueue", 0, NULL) != 0)
+ die_with_error ("Can't mount mqueue on %s", arg1);
+ break;
+
+ case PRIV_SEP_OP_SET_HOSTNAME:
+ /* This is checked at the start, but lets verify it here in case
+ something manages to send hacked priv-sep operation requests. */
+ if (!opt_unshare_uts)
+ die ("Refusing to set hostname in original namespace");
+ if (sethostname (arg1, strlen(arg1)) != 0)
+ die_with_error ("Can't set hostname to %s", arg1);
+ break;
+
+ default:
+ die ("Unexpected privileged op %d", op);
+ }
+}
+
+/* This is run unprivileged in the child namespace but can request
+ * some privileged operations (also in the child namespace) via the
+ * privileged_op_socket.
+ */
+static void
+setup_newroot (bool unshare_pid,
+ int privileged_op_socket)
+{
+ SetupOp *op;
+
+ for (op = ops; op != NULL; op = op->next)
+ {
+ cleanup_free char *source = NULL;
+ cleanup_free char *dest = NULL;
+ int source_mode = 0;
+ int i;
+
+ if (op->source &&
+ op->type != SETUP_MAKE_SYMLINK)
+ {
+ source = get_oldroot_path (op->source);
+ source_mode = get_file_mode (source);
+ if (source_mode < 0)
+ die_with_error ("Can't get type of source %s", op->source);
+ }
+
+ if (op->dest &&
+ (op->flags & NO_CREATE_DEST) == 0)
+ {
+ dest = get_newroot_path (op->dest);
+ if (mkdir_with_parents (dest, 0755, FALSE) != 0)
+ die_with_error ("Can't mkdir parents for %s", op->dest);
+ }
+
+ switch (op->type)
+ {
+ case SETUP_RO_BIND_MOUNT:
+ case SETUP_DEV_BIND_MOUNT:
+ case SETUP_BIND_MOUNT:
+ if (source_mode == S_IFDIR)
+ {
+ if (mkdir (dest, 0755) != 0 && errno != EEXIST)
+ die_with_error ("Can't mkdir %s", op->dest);
+ }
+ else if (ensure_file (dest, 0666) != 0)
+ die_with_error ("Can't create file at %s", op->dest);
+
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_BIND_MOUNT,
+ (op->type == SETUP_RO_BIND_MOUNT ? BIND_READONLY : 0) |
+ (op->type == SETUP_DEV_BIND_MOUNT ? BIND_DEVICES : 0),
+ source, dest);
+ break;
+
+ case SETUP_REMOUNT_RO_NO_RECURSIVE:
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_REMOUNT_RO_NO_RECURSIVE, 0, NULL, dest);
+ break;
+
+ case SETUP_MOUNT_PROC:
+ if (mkdir (dest, 0755) != 0 && errno != EEXIST)
+ die_with_error ("Can't mkdir %s", op->dest);
+
+ if (unshare_pid)
+ {
+ /* Our own procfs */
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_PROC_MOUNT, 0,
+ dest, NULL);
+ }
+ else
+ {
+ /* Use system procfs, as we share pid namespace anyway */
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_BIND_MOUNT, 0,
+ "oldroot/proc", dest);
+ }
+
+ /* There are a bunch of weird old subdirs of /proc that could potentially be
+ problematic (for instance /proc/sysrq-trigger lets you shut down the machine
+ if you have write access). We should not have access to these as a non-privileged
+ user, but lets cover them anyway just to make sure */
+ const char *cover_proc_dirs[] = { "sys", "sysrq-trigger", "irq", "bus" };
+ for (i = 0; i < N_ELEMENTS (cover_proc_dirs); i++)
+ {
+ cleanup_free char *subdir = strconcat3 (dest, "/", cover_proc_dirs[i]);
+ /* Some of these may not exist */
+ if (get_file_mode (subdir) == -1)
+ continue;
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_BIND_MOUNT, BIND_READONLY,
+ subdir, subdir);
+ }
+
+ break;
+
+ case SETUP_MOUNT_DEV:
+ if (mkdir (dest, 0755) != 0 && errno != EEXIST)
+ die_with_error ("Can't mkdir %s", op->dest);
+
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_TMPFS_MOUNT, 0,
+ dest, NULL);
+
+ static const char *const devnodes[] = { "null", "zero", "full", "random", "urandom", "tty" };
+ for (i = 0; i < N_ELEMENTS (devnodes); i++)
+ {
+ cleanup_free char *node_dest = strconcat3 (dest, "/", devnodes[i]);
+ cleanup_free char *node_src = strconcat ("/oldroot/dev/", devnodes[i]);
+ if (create_file (node_dest, 0666, NULL) != 0)
+ die_with_error ("Can't create file %s/%s", op->dest, devnodes[i]);
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_BIND_MOUNT, BIND_DEVICES,
+ node_src, node_dest);
+ }
+
+ static const char *const stdionodes[] = { "stdin", "stdout", "stderr" };
+ for (i = 0; i < N_ELEMENTS (stdionodes); i++)
+ {
+ cleanup_free char *target = xasprintf ("/proc/self/fd/%d", i);
+ cleanup_free char *node_dest = strconcat3 (dest, "/", stdionodes[i]);
+ if (symlink (target, node_dest) < 0)
+ die_with_error ("Can't create symlink %s/%s", op->dest, stdionodes[i]);
+ }
+
+ {
+ cleanup_free char *pts = strconcat (dest, "/pts");
+ cleanup_free char *ptmx = strconcat (dest, "/ptmx");
+ cleanup_free char *shm = strconcat (dest, "/shm");
+
+ if (mkdir (shm, 0755) == -1)
+ die_with_error ("Can't create %s/shm", op->dest);
+
+ if (mkdir (pts, 0755) == -1)
+ die_with_error ("Can't create %s/devpts", op->dest);
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_DEVPTS_MOUNT, 0, pts, NULL);
+
+ if (symlink ("pts/ptmx", ptmx) != 0)
+ die_with_error ("Can't make symlink at %s/ptmx", op->dest);
+ }
+
+ /* If stdout is a tty, that means the sandbox can write to the
+ outside-sandbox tty. In that case we also create a /dev/console
+ that points to this tty device. This should not cause any more
+ access than we already have, and it makes ttyname() work in the
+ sandbox. */
+ if (host_tty_dev != NULL && *host_tty_dev != 0)
+ {
+ cleanup_free char *src_tty_dev = strconcat ("/oldroot", host_tty_dev);
+ cleanup_free char *dest_console = strconcat (dest, "/console");
+
+ if (create_file (dest_console, 0666, NULL) != 0)
+ die_with_error ("creating %s/console", op->dest);
+
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_BIND_MOUNT, BIND_DEVICES,
+ src_tty_dev, dest_console);
+ }
+
+ break;
+
+ case SETUP_MOUNT_TMPFS:
+ if (mkdir (dest, 0755) != 0 && errno != EEXIST)
+ die_with_error ("Can't mkdir %s", op->dest);
+
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_TMPFS_MOUNT, 0,
+ dest, NULL);
+ break;
+
+ case SETUP_MOUNT_MQUEUE:
+ if (mkdir (dest, 0755) != 0 && errno != EEXIST)
+ die_with_error ("Can't mkdir %s", op->dest);
+
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_MQUEUE_MOUNT, 0,
+ dest, NULL);
+ break;
+
+ case SETUP_MAKE_DIR:
+ if (mkdir (dest, 0755) != 0 && errno != EEXIST)
+ die_with_error ("Can't mkdir %s", op->dest);
+
+ break;
+
+ case SETUP_MAKE_FILE:
+ {
+ cleanup_fd int dest_fd = -1;
+
+ dest_fd = creat (dest, 0666);
+ if (dest_fd == -1)
+ die_with_error ("Can't create file %s", op->dest);
+
+ if (copy_file_data (op->fd, dest_fd) != 0)
+ die_with_error ("Can't write data to file %s", op->dest);
+
+ close (op->fd);
+ }
+ break;
+
+ case SETUP_MAKE_BIND_FILE:
+ case SETUP_MAKE_RO_BIND_FILE:
+ {
+ cleanup_fd int dest_fd = -1;
+ char tempfile[] = "/bindfileXXXXXX";
+
+ dest_fd = mkstemp (tempfile);
+ if (dest_fd == -1)
+ die_with_error ("Can't create tmpfile for %s", op->dest);
+
+ if (copy_file_data (op->fd, dest_fd) != 0)
+ die_with_error ("Can't write data to file %s", op->dest);
+
+ close (op->fd);
+
+ if (ensure_file (dest, 0666) != 0)
+ die_with_error ("Can't create file at %s", op->dest);
+
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_BIND_MOUNT,
+ (op->type == SETUP_MAKE_RO_BIND_FILE ? BIND_READONLY : 0),
+ tempfile, dest);
+
+ /* Remove the file so we're sure the app can't get to it in any other way.
+ Its outside the container chroot, so it shouldn't be possible, but lets
+ make it really sure. */
+ unlink (tempfile);
+ }
+ break;
+
+ case SETUP_MAKE_SYMLINK:
+ if (symlink (op->source, dest) != 0)
+ die_with_error ("Can't make symlink at %s", op->dest);
+ break;
+
+ case SETUP_SET_HOSTNAME:
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_SET_HOSTNAME, 0,
+ op->dest, NULL);
+ break;
+
+ default:
+ die ("Unexpected type %d", op->type);
+ }
+ }
+ privileged_op (privileged_op_socket,
+ PRIV_SEP_OP_DONE, 0, NULL, NULL);
+}
+
+/* We need to resolve relative symlinks in the sandbox before we
+ chroot so that absolute symlinks are handled correctly. We also
+ need to do this after we've switched to the real uid so that
+ e.g. paths on fuse mounts work */
+static void
+resolve_symlinks_in_ops (void)
+{
+ SetupOp *op;
+
+ for (op = ops; op != NULL; op = op->next)
+ {
+ const char *old_source;
+
+ switch (op->type)
+ {
+ case SETUP_RO_BIND_MOUNT:
+ case SETUP_DEV_BIND_MOUNT:
+ case SETUP_BIND_MOUNT:
+ old_source = op->source;
+ op->source = realpath (old_source, NULL);
+ if (op->source == NULL)
+ die_with_error ("Can't find source path %s", old_source);
+ break;
+ default:
+ break;
+ }
+ }
+}
+
+
+static const char *
+resolve_string_offset (void *buffer,
+ size_t buffer_size,
+ uint32_t offset)
+{
+ if (offset == 0)
+ return NULL;
+
+ if (offset > buffer_size)
+ die ("Invalid string offset %d (buffer size %zd)", offset, buffer_size);
+
+ return (const char *) buffer + offset;
+}
+
+static uint32_t
+read_priv_sec_op (int read_socket,
+ void *buffer,
+ size_t buffer_size,
+ uint32_t *flags,
+ const char **arg1,
+ const char **arg2)
+{
+ const PrivSepOp *op = (const PrivSepOp *) buffer;
+ ssize_t rec_len;
+
+ do
+ rec_len = read (read_socket, buffer, buffer_size - 1);
+ while (rec_len == -1 && errno == EINTR);
+
+ if (rec_len < 0)
+ die_with_error ("Can't read from unprivileged helper");
+
+ if (rec_len == 0)
+ exit (1); /* Privileged helper died and printed error, so exit silently */
+
+ if (rec_len < sizeof (PrivSepOp))
+ die ("Invalid size %zd from unprivileged helper", rec_len);
+
+ /* Guarantee zero termination of any strings */
+ ((char *) buffer)[rec_len] = 0;
+
+ *flags = op->flags;
+ *arg1 = resolve_string_offset (buffer, rec_len, op->arg1_offset);
+ *arg2 = resolve_string_offset (buffer, rec_len, op->arg2_offset);
+
+ return op->op;
+}
+
+static void __attribute__ ((noreturn))
+print_version_and_exit (void)
+{
+ printf ("%s\n", PACKAGE_STRING);
+ exit (0);
+}
+
+static void
+parse_args_recurse (int *argcp,
+ char ***argvp,
+ bool in_file,
+ int *total_parsed_argc_p)
+{
+ SetupOp *op;
+ int argc = *argcp;
+ char **argv = *argvp;
+ /* I can't imagine a case where someone wants more than this.
+ * If you do...you should be able to pass multiple files
+ * via a single tmpfs and linking them there, etc.
+ *
+ * We're adding this hardening due to precedent from
+ * http://googleprojectzero.blogspot.com/2014/08/the-poisoned-nul-byte-2014-edition.html
+ *
+ * I picked 9000 because the Internet told me to and it was hard to
+ * resist.
+ */
+ static const uint32_t MAX_ARGS = 9000;
+
+ if (*total_parsed_argc_p > MAX_ARGS)
+ die ("Exceeded maximum number of arguments %u", MAX_ARGS);
+
+ while (argc > 0)
+ {
+ const char *arg = argv[0];
+
+ if (strcmp (arg, "--help") == 0)
+ {
+ usage (EXIT_SUCCESS, stdout);
+ }
+ else if (strcmp (arg, "--version") == 0)
+ {
+ print_version_and_exit ();
+ }
+ else if (strcmp (arg, "--args") == 0)
+ {
+ int the_fd;
+ char *endptr;
+ char *data, *p;
+ char *data_end;
+ size_t data_len;
+ cleanup_free char **data_argv = NULL;
+ char **data_argv_copy;
+ int data_argc;
+ int i;
+
+ if (in_file)
+ die ("--args not supported in arguments file");
+
+ if (argc < 2)
+ die ("--args takes an argument");
+
+ the_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || the_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ data = load_file_data (the_fd, &data_len);
+ if (data == NULL)
+ die_with_error ("Can't read --args data");
+
+ data_end = data + data_len;
+ data_argc = 0;
+
+ p = data;
+ while (p != NULL && p < data_end)
+ {
+ data_argc++;
+ (*total_parsed_argc_p)++;
+ if (*total_parsed_argc_p > MAX_ARGS)
+ die ("Exceeded maximum number of arguments %u", MAX_ARGS);
+ p = memchr (p, 0, data_end - p);
+ if (p != NULL)
+ p++;
+ }
+
+ data_argv = xcalloc (sizeof (char *) * (data_argc + 1));
+
+ i = 0;
+ p = data;
+ while (p != NULL && p < data_end)
+ {
+ /* Note: load_file_data always adds a nul terminator, so this is safe
+ * even for the last string. */
+ data_argv[i++] = p;
+ p = memchr (p, 0, data_end - p);
+ if (p != NULL)
+ p++;
+ }
+
+ data_argv_copy = data_argv; /* Don't change data_argv, we need to free it */
+ parse_args_recurse (&data_argc, &data_argv_copy, TRUE, total_parsed_argc_p);
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--unshare-all") == 0)
+ {
+ /* Keep this in order with the older (legacy) --unshare arguments,
+ * we use the --try variants of user and cgroup, since we want
+ * to support systems/kernels without support for those.
+ */
+ opt_unshare_user_try = opt_unshare_ipc = opt_unshare_pid =
+ opt_unshare_uts = opt_unshare_cgroup_try =
+ opt_unshare_net = TRUE;
+ }
+ /* Begin here the older individual --unshare variants */
+ else if (strcmp (arg, "--unshare-user") == 0)
+ {
+ opt_unshare_user = TRUE;
+ }
+ else if (strcmp (arg, "--unshare-user-try") == 0)
+ {
+ opt_unshare_user_try = TRUE;
+ }
+ else if (strcmp (arg, "--unshare-ipc") == 0)
+ {
+ opt_unshare_ipc = TRUE;
+ }
+ else if (strcmp (arg, "--unshare-pid") == 0)
+ {
+ opt_unshare_pid = TRUE;
+ }
+ else if (strcmp (arg, "--unshare-net") == 0)
+ {
+ opt_unshare_net = TRUE;
+ }
+ else if (strcmp (arg, "--unshare-uts") == 0)
+ {
+ opt_unshare_uts = TRUE;
+ }
+ else if (strcmp (arg, "--unshare-cgroup") == 0)
+ {
+ opt_unshare_cgroup = TRUE;
+ }
+ else if (strcmp (arg, "--unshare-cgroup-try") == 0)
+ {
+ opt_unshare_cgroup_try = TRUE;
+ }
+ /* Begin here the newer --share variants */
+ else if (strcmp (arg, "--share-net") == 0)
+ {
+ opt_unshare_net = FALSE;
+ }
+ /* End --share variants, other arguments begin */
+ else if (strcmp (arg, "--chdir") == 0)
+ {
+ if (argc < 2)
+ die ("--chdir takes one argument");
+
+ opt_chdir_path = argv[1];
+ argv++;
+ argc--;
+ }
+ else if (strcmp (arg, "--remount-ro") == 0)
+ {
+ if (argc < 2)
+ die ("--remount-ro takes one argument");
+
+ SetupOp *op = setup_op_new (SETUP_REMOUNT_RO_NO_RECURSIVE);
+ op->dest = argv[1];
+
+ argv++;
+ argc--;
+ }
+ else if (strcmp (arg, "--bind") == 0)
+ {
+ if (argc < 3)
+ die ("--bind takes two arguments");
+
+ op = setup_op_new (SETUP_BIND_MOUNT);
+ op->source = argv[1];
+ op->dest = argv[2];
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--ro-bind") == 0)
+ {
+ if (argc < 3)
+ die ("--ro-bind takes two arguments");
+
+ op = setup_op_new (SETUP_RO_BIND_MOUNT);
+ op->source = argv[1];
+ op->dest = argv[2];
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--dev-bind") == 0)
+ {
+ if (argc < 3)
+ die ("--dev-bind takes two arguments");
+
+ op = setup_op_new (SETUP_DEV_BIND_MOUNT);
+ op->source = argv[1];
+ op->dest = argv[2];
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--proc") == 0)
+ {
+ if (argc < 2)
+ die ("--proc takes an argument");
+
+ op = setup_op_new (SETUP_MOUNT_PROC);
+ op->dest = argv[1];
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--exec-label") == 0)
+ {
+ if (argc < 2)
+ die ("--exec-label takes an argument");
+ opt_exec_label = argv[1];
+ die_unless_label_valid (opt_exec_label);
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--file-label") == 0)
+ {
+ if (argc < 2)
+ die ("--file-label takes an argument");
+ opt_file_label = argv[1];
+ die_unless_label_valid (opt_file_label);
+ if (label_create_file (opt_file_label))
+ die_with_error ("--file-label setup failed");
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--dev") == 0)
+ {
+ if (argc < 2)
+ die ("--dev takes an argument");
+
+ op = setup_op_new (SETUP_MOUNT_DEV);
+ op->dest = argv[1];
+ opt_needs_devpts = TRUE;
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--tmpfs") == 0)
+ {
+ if (argc < 2)
+ die ("--tmpfs takes an argument");
+
+ op = setup_op_new (SETUP_MOUNT_TMPFS);
+ op->dest = argv[1];
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--mqueue") == 0)
+ {
+ if (argc < 2)
+ die ("--mqueue takes an argument");
+
+ op = setup_op_new (SETUP_MOUNT_MQUEUE);
+ op->dest = argv[1];
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--dir") == 0)
+ {
+ if (argc < 2)
+ die ("--dir takes an argument");
+
+ op = setup_op_new (SETUP_MAKE_DIR);
+ op->dest = argv[1];
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--file") == 0)
+ {
+ int file_fd;
+ char *endptr;
+
+ if (argc < 3)
+ die ("--file takes two arguments");
+
+ file_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || file_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ op = setup_op_new (SETUP_MAKE_FILE);
+ op->fd = file_fd;
+ op->dest = argv[2];
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--bind-data") == 0)
+ {
+ int file_fd;
+ char *endptr;
+
+ if (argc < 3)
+ die ("--bind-data takes two arguments");
+
+ file_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || file_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ op = setup_op_new (SETUP_MAKE_BIND_FILE);
+ op->fd = file_fd;
+ op->dest = argv[2];
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--ro-bind-data") == 0)
+ {
+ int file_fd;
+ char *endptr;
+
+ if (argc < 3)
+ die ("--ro-bind-data takes two arguments");
+
+ file_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || file_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ op = setup_op_new (SETUP_MAKE_RO_BIND_FILE);
+ op->fd = file_fd;
+ op->dest = argv[2];
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--symlink") == 0)
+ {
+ if (argc < 3)
+ die ("--symlink takes two arguments");
+
+ op = setup_op_new (SETUP_MAKE_SYMLINK);
+ op->source = argv[1];
+ op->dest = argv[2];
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--lock-file") == 0)
+ {
+ if (argc < 2)
+ die ("--lock-file takes an argument");
+
+ (void) lock_file_new (argv[1]);
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--sync-fd") == 0)
+ {
+ int the_fd;
+ char *endptr;
+
+ if (argc < 2)
+ die ("--sync-fd takes an argument");
+
+ the_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || the_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ opt_sync_fd = the_fd;
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--block-fd") == 0)
+ {
+ int the_fd;
+ char *endptr;
+
+ if (argc < 2)
+ die ("--block-fd takes an argument");
+
+ the_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || the_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ opt_block_fd = the_fd;
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--info-fd") == 0)
+ {
+ int the_fd;
+ char *endptr;
+
+ if (argc < 2)
+ die ("--info-fd takes an argument");
+
+ the_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || the_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ opt_info_fd = the_fd;
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--seccomp") == 0)
+ {
+ int the_fd;
+ char *endptr;
+
+ if (argc < 2)
+ die ("--seccomp takes an argument");
+
+ the_fd = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || the_fd < 0)
+ die ("Invalid fd: %s", argv[1]);
+
+ opt_seccomp_fd = the_fd;
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--setenv") == 0)
+ {
+ if (argc < 3)
+ die ("--setenv takes two arguments");
+
+ xsetenv (argv[1], argv[2], 1);
+
+ argv += 2;
+ argc -= 2;
+ }
+ else if (strcmp (arg, "--unsetenv") == 0)
+ {
+ if (argc < 2)
+ die ("--unsetenv takes an argument");
+
+ xunsetenv (argv[1]);
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--uid") == 0)
+ {
+ int the_uid;
+ char *endptr;
+
+ if (argc < 2)
+ die ("--uid takes an argument");
+
+ the_uid = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || the_uid < 0)
+ die ("Invalid uid: %s", argv[1]);
+
+ opt_sandbox_uid = the_uid;
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--gid") == 0)
+ {
+ int the_gid;
+ char *endptr;
+
+ if (argc < 2)
+ die ("--gid takes an argument");
+
+ the_gid = strtol (argv[1], &endptr, 10);
+ if (argv[1][0] == 0 || endptr[0] != 0 || the_gid < 0)
+ die ("Invalid gid: %s", argv[1]);
+
+ opt_sandbox_gid = the_gid;
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--hostname") == 0)
+ {
+ if (argc < 2)
+ die ("--hostname takes an argument");
+
+ op = setup_op_new (SETUP_SET_HOSTNAME);
+ op->dest = argv[1];
+ op->flags = NO_CREATE_DEST;
+
+ opt_sandbox_hostname = argv[1];
+
+ argv += 1;
+ argc -= 1;
+ }
+ else if (strcmp (arg, "--new-session") == 0)
+ {
+ opt_new_session = TRUE;
+ }
+ else if (strcmp (arg, "--die-with-parent") == 0)
+ {
+ opt_die_with_parent = TRUE;
+ }
+ else if (*arg == '-')
+ {
+ die ("Unknown option %s", arg);
+ }
+ else
+ {
+ break;
+ }
+
+ argv++;
+ argc--;
+ }
+
+ *argcp = argc;
+ *argvp = argv;
+}
+
+static void
+parse_args (int *argcp,
+ char ***argvp)
+{
+ int total_parsed_argc = *argcp;
+
+ parse_args_recurse (argcp, argvp, FALSE, &total_parsed_argc);
+}
+
+static void
+read_overflowids (void)
+{
+ cleanup_free char *uid_data = NULL;
+ cleanup_free char *gid_data = NULL;
+
+ uid_data = load_file_at (AT_FDCWD, "/proc/sys/kernel/overflowuid");
+ if (uid_data == NULL)
+ die_with_error ("Can't read /proc/sys/kernel/overflowuid");
+
+ overflow_uid = strtol (uid_data, NULL, 10);
+ if (overflow_uid == 0)
+ die ("Can't parse /proc/sys/kernel/overflowuid");
+
+ gid_data = load_file_at (AT_FDCWD, "/proc/sys/kernel/overflowgid");
+ if (gid_data == NULL)
+ die_with_error ("Can't read /proc/sys/kernel/overflowgid");
+
+ overflow_gid = strtol (gid_data, NULL, 10);
+ if (overflow_gid == 0)
+ die ("Can't parse /proc/sys/kernel/overflowgid");
+}
+
+int
+main (int argc,
+ char **argv)
+{
+ mode_t old_umask;
+ cleanup_free char *base_path = NULL;
+ int clone_flags;
+ char *old_cwd = NULL;
+ pid_t pid;
+ int event_fd = -1;
+ int child_wait_fd = -1;
+ const char *new_cwd;
+ uid_t ns_uid;
+ gid_t ns_gid;
+ struct stat sbuf;
+ uint64_t val;
+ int res UNUSED;
+ cleanup_free char *seccomp_data = NULL;
+ size_t seccomp_len;
+ struct sock_fprog seccomp_prog;
+
+ /* Handle --version early on before we try to acquire/drop
+ * any capabilities so it works in a build environment;
+ * right now flatpak's build runs bubblewrap --version.
+ * https://github.com/projectatomic/bubblewrap/issues/185
+ */
+ if (argc == 2 && (strcmp (argv[1], "--version") == 0))
+ print_version_and_exit ();
+
+ real_uid = getuid ();
+ real_gid = getgid ();
+
+ /* Get the (optional) privileges we need */
+ acquire_privs ();
+
+ /* Never gain any more privs during exec */
+ if (prctl (PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
+ die_with_error ("prctl(PR_SET_NO_NEW_CAPS) failed");
+
+ /* The initial code is run with high permissions
+ (i.e. CAP_SYS_ADMIN), so take lots of care. */
+
+ read_overflowids ();
+
+ argv0 = argv[0];
+
+ if (isatty (1))
+ host_tty_dev = ttyname (1);
+
+ argv++;
+ argc--;
+
+ if (argc == 0)
+ usage (EXIT_FAILURE, stderr);
+
+ parse_args (&argc, &argv);
+
+ /* We have to do this if we weren't installed setuid (and we're not
+ * root), so let's just DWIM */
+ if (!is_privileged && getuid () != 0)
+ opt_unshare_user = TRUE;
+
+#ifdef ENABLE_REQUIRE_USERNS
+ /* In this build option, we require userns. */
+ if (is_privileged && getuid () != 0)
+ opt_unshare_user = TRUE;
+#endif
+
+ if (opt_unshare_user_try &&
+ stat ("/proc/self/ns/user", &sbuf) == 0)
+ {
+ bool disabled = FALSE;
+
+ /* RHEL7 has a kernel module parameter that lets you enable user namespaces */
+ if (stat ("/sys/module/user_namespace/parameters/enable", &sbuf) == 0)
+ {
+ cleanup_free char *enable = NULL;
+ enable = load_file_at (AT_FDCWD, "/sys/module/user_namespace/parameters/enable");
+ if (enable != NULL && enable[0] == 'N')
+ disabled = TRUE;
+ }
+
+ /* Debian lets you disable *unprivileged* user namespaces. However this is not
+ a problem if we're privileged, and if we're not opt_unshare_user is TRUE
+ already, and there is not much we can do, its just a non-working setup. */
+
+ if (!disabled)
+ opt_unshare_user = TRUE;
+ }
+
+ if (argc == 0)
+ usage (EXIT_FAILURE, stderr);
+
+ __debug__ (("Creating root mount point\n"));
+
+ if (opt_sandbox_uid == -1)
+ opt_sandbox_uid = real_uid;
+ if (opt_sandbox_gid == -1)
+ opt_sandbox_gid = real_gid;
+
+ if (!opt_unshare_user && opt_sandbox_uid != real_uid)
+ die ("Specifying --uid requires --unshare-user");
+
+ if (!opt_unshare_user && opt_sandbox_gid != real_gid)
+ die ("Specifying --gid requires --unshare-user");
+
+ if (!opt_unshare_uts && opt_sandbox_hostname != NULL)
+ die ("Specifying --hostname requires --unshare-uts");
+
+ /* We need to read stuff from proc during the pivot_root dance, etc.
+ Lets keep a fd to it open */
+ proc_fd = open ("/proc", O_RDONLY | O_PATH);
+ if (proc_fd == -1)
+ die_with_error ("Can't open /proc");
+
+ /* We need *some* mountpoint where we can mount the root tmpfs.
+ We first try in /run, and if that fails, try in /tmp. */
+ base_path = xasprintf ("/run/user/%d/.bubblewrap", real_uid);
+ if (mkdir (base_path, 0755) && errno != EEXIST)
+ {
+ free (base_path);
+ base_path = xasprintf ("/tmp/.bubblewrap-%d", real_uid);
+ if (mkdir (base_path, 0755) && errno != EEXIST)
+ die_with_error ("Creating root mountpoint failed");
+ }
+
+ __debug__ (("creating new namespace\n"));
+
+ if (opt_unshare_pid)
+ {
+ event_fd = eventfd (0, EFD_CLOEXEC | EFD_NONBLOCK);
+ if (event_fd == -1)
+ die_with_error ("eventfd()");
+ }
+
+ /* We block sigchild here so that we can use signalfd in the monitor. */
+ block_sigchild ();
+
+ clone_flags = SIGCHLD | CLONE_NEWNS;
+ if (opt_unshare_user)
+ clone_flags |= CLONE_NEWUSER;
+ if (opt_unshare_pid)
+ clone_flags |= CLONE_NEWPID;
+ if (opt_unshare_net)
+ clone_flags |= CLONE_NEWNET;
+ if (opt_unshare_ipc)
+ clone_flags |= CLONE_NEWIPC;
+ if (opt_unshare_uts)
+ clone_flags |= CLONE_NEWUTS;
+ if (opt_unshare_cgroup)
+ {
+ if (stat ("/proc/self/ns/cgroup", &sbuf))
+ {
+ if (errno == ENOENT)
+ die ("Cannot create new cgroup namespace because the kernel does not support it");
+ else
+ die_with_error ("stat on /proc/self/ns/cgroup failed");
+ }
+ clone_flags |= CLONE_NEWCGROUP;
+ }
+ if (opt_unshare_cgroup_try)
+ if (!stat ("/proc/self/ns/cgroup", &sbuf))
+ clone_flags |= CLONE_NEWCGROUP;
+
+ child_wait_fd = eventfd (0, EFD_CLOEXEC);
+ if (child_wait_fd == -1)
+ die_with_error ("eventfd()");
+
+ pid = raw_clone (clone_flags, NULL);
+ if (pid == -1)
+ {
+ if (opt_unshare_user)
+ {
+ if (errno == EINVAL)
+ die ("Creating new namespace failed, likely because the kernel does not support user namespaces. bwrap must be installed setuid on such systems.");
+ else if (errno == EPERM && !is_privileged)
+ die ("No permissions to creating new namespace, likely because the kernel does not allow non-privileged user namespaces. On e.g. debian this can be enabled with 'sysctl kernel.unprivileged_userns_clone=1'.");
+ }
+
+ die_with_error ("Creating new namespace failed");
+ }
+
+ ns_uid = opt_sandbox_uid;
+ ns_gid = opt_sandbox_gid;
+
+ if (pid != 0)
+ {
+ /* Parent, outside sandbox, privileged (initially) */
+
+ if (is_privileged && opt_unshare_user)
+ {
+ /* We're running as euid 0, but the uid we want to map is
+ * not 0. This means we're not allowed to write this from
+ * the child user namespace, so we do it from the parent.
+ *
+ * Also, we map uid/gid 0 in the namespace (to overflowuid)
+ * if opt_needs_devpts is true, because otherwise the mount
+ * of devpts fails due to root not being mapped.
+ */
+ write_uid_gid_map (ns_uid, real_uid,
+ ns_gid, real_gid,
+ pid, TRUE, opt_needs_devpts);
+ }
+
+ /* Initial launched process, wait for exec:ed command to exit */
+
+ /* We don't need any privileges in the launcher, drop them immediately. */
+ drop_privs ();
+
+ /* Optionally bind our lifecycle to that of the parent */
+ handle_die_with_parent ();
+
+ /* Let child run now that the uid maps are set up */
+ val = 1;
+ res = write (child_wait_fd, &val, 8);
+ /* Ignore res, if e.g. the child died and closed child_wait_fd we don't want to error out here */
+ close (child_wait_fd);
+
+ if (opt_info_fd != -1)
+ {
+ cleanup_free char *output = xasprintf ("{\n \"child-pid\": %i\n}\n", pid);
+ size_t len = strlen (output);
+ if (write (opt_info_fd, output, len) != len)
+ die_with_error ("Write to info_fd");
+ close (opt_info_fd);
+ }
+
+ monitor_child (event_fd, pid);
+ exit (0); /* Should not be reached, but better safe... */
+ }
+
+ /* Child, in sandbox, privileged in the parent or in the user namespace (if --unshare-user).
+ *
+ * Note that for user namespaces we run as euid 0 during clone(), so
+ * the child user namespace is owned by euid 0., This means that the
+ * regular user namespace parent (with uid != 0) doesn't have any
+ * capabilities in it, which is nice as we can't exploit those. In
+ * particular the parent user namespace doesn't have CAP_PTRACE
+ * which would otherwise allow the parent to hijack of the child
+ * after this point.
+ *
+ * Unfortunately this also means you can't ptrace the final
+ * sandboxed process from outside the sandbox either.
+ */
+
+ if (opt_info_fd != -1)
+ close (opt_info_fd);
+
+ /* Wait for the parent to init uid/gid maps and drop caps */
+ res = read (child_wait_fd, &val, 8);
+ close (child_wait_fd);
+
+ /* At this point we can completely drop root uid, but retain the
+ * required permitted caps. This allow us to do full setup as
+ * the user uid, which makes e.g. fuse access work.
+ */
+ switch_to_user_with_privs ();
+
+ if (opt_unshare_net)
+ loopback_setup (); /* Will exit if unsuccessful */
+
+ ns_uid = opt_sandbox_uid;
+ ns_gid = opt_sandbox_gid;
+ if (!is_privileged && opt_unshare_user)
+ {
+ /* In the unprivileged case we have to write the uid/gid maps in
+ * the child, because we have no caps in the parent */
+
+ if (opt_needs_devpts)
+ {
+ /* This is a bit hacky, but we need to first map the real uid/gid to
+ 0, otherwise we can't mount the devpts filesystem because root is
+ not mapped. Later we will create another child user namespace and
+ map back to the real uid */
+ ns_uid = 0;
+ ns_gid = 0;
+ }
+
+ write_uid_gid_map (ns_uid, real_uid,
+ ns_gid, real_gid,
+ -1, TRUE, FALSE);
+ }
+
+ old_umask = umask (0);
+
+ /* Need to do this before the chroot, but after we're the real uid */
+ resolve_symlinks_in_ops ();
+
+ /* Mark everything as slave, so that we still
+ * receive mounts from the real root, but don't
+ * propagate mounts to the real root. */
+ if (mount (NULL, "/", NULL, MS_SLAVE | MS_REC, NULL) < 0)
+ die_with_error ("Failed to make / slave");
+
+ /* Create a tmpfs which we will use as / in the namespace */
+ if (mount ("", base_path, "tmpfs", MS_NODEV | MS_NOSUID, NULL) != 0)
+ die_with_error ("Failed to mount tmpfs");
+
+ old_cwd = get_current_dir_name ();
+
+ /* Chdir to the new root tmpfs mount. This will be the CWD during
+ the entire setup. Access old or new root via "oldroot" and "newroot". */
+ if (chdir (base_path) != 0)
+ die_with_error ("chdir base_path");
+
+ /* We create a subdir "$base_path/newroot" for the new root, that
+ * way we can pivot_root to base_path, and put the old root at
+ * "$base_path/oldroot". This avoids problems accessing the oldroot
+ * dir if the user requested to bind mount something over / */
+
+ if (mkdir ("newroot", 0755))
+ die_with_error ("Creating newroot failed");
+
+ if (mkdir ("oldroot", 0755))
+ die_with_error ("Creating oldroot failed");
+
+ if (pivot_root (base_path, "oldroot"))
+ die_with_error ("pivot_root");
+
+ if (chdir ("/") != 0)
+ die_with_error ("chdir / (base path)");
+
+ if (is_privileged)
+ {
+ pid_t child;
+ int privsep_sockets[2];
+
+ if (socketpair (AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC, 0, privsep_sockets) != 0)
+ die_with_error ("Can't create privsep socket");
+
+ child = fork ();
+ if (child == -1)
+ die_with_error ("Can't fork unprivileged helper");
+
+ if (child == 0)
+ {
+ /* Unprivileged setup process */
+ drop_privs ();
+ close (privsep_sockets[0]);
+ setup_newroot (opt_unshare_pid, privsep_sockets[1]);
+ exit (0);
+ }
+ else
+ {
+ int status;
+ uint32_t buffer[2048]; /* 8k, but is int32 to guarantee nice alignment */
+ uint32_t op, flags;
+ const char *arg1, *arg2;
+ cleanup_fd int unpriv_socket = -1;
+
+ unpriv_socket = privsep_sockets[0];
+ close (privsep_sockets[1]);
+
+ do
+ {
+ op = read_priv_sec_op (unpriv_socket, buffer, sizeof (buffer),
+ &flags, &arg1, &arg2);
+ privileged_op (-1, op, flags, arg1, arg2);
+ if (write (unpriv_socket, buffer, 1) != 1)
+ die ("Can't write to op_socket");
+ }
+ while (op != PRIV_SEP_OP_DONE);
+
+ waitpid (child, &status, 0);
+ /* Continue post setup */
+ }
+ }
+ else
+ {
+ setup_newroot (opt_unshare_pid, -1);
+ }
+
+ /* The old root better be rprivate or we will send unmount events to the parent namespace */
+ if (mount ("oldroot", "oldroot", NULL, MS_REC | MS_PRIVATE, NULL) != 0)
+ die_with_error ("Failed to make old root rprivate");
+
+ if (umount2 ("oldroot", MNT_DETACH))
+ die_with_error ("unmount old root");
+
+ if (opt_unshare_user &&
+ (ns_uid != opt_sandbox_uid || ns_gid != opt_sandbox_gid))
+ {
+ /* Now that devpts is mounted and we've no need for mount
+ permissions we can create a new userspace and map our uid
+ 1:1 */
+
+ if (unshare (CLONE_NEWUSER))
+ die_with_error ("unshare user ns");
+
+ write_uid_gid_map (opt_sandbox_uid, ns_uid,
+ opt_sandbox_gid, ns_gid,
+ -1, FALSE, FALSE);
+ }
+
+ /* Now make /newroot the real root */
+ if (chdir ("/newroot") != 0)
+ die_with_error ("chdir newroot");
+ if (chroot ("/newroot") != 0)
+ die_with_error ("chroot /newroot");
+ if (chdir ("/") != 0)
+ die_with_error ("chdir /");
+
+ /* All privileged ops are done now, so drop it */
+ drop_privs ();
+
+ if (opt_block_fd != -1)
+ {
+ char b[1];
+ read (opt_block_fd, b, 1);
+ close (opt_block_fd);
+ }
+
+ if (opt_seccomp_fd != -1)
+ {
+ seccomp_data = load_file_data (opt_seccomp_fd, &seccomp_len);
+ if (seccomp_data == NULL)
+ die_with_error ("Can't read seccomp data");
+
+ if (seccomp_len % 8 != 0)
+ die ("Invalid seccomp data, must be multiple of 8");
+
+ seccomp_prog.len = seccomp_len / 8;
+ seccomp_prog.filter = (struct sock_filter *) seccomp_data;
+
+ close (opt_seccomp_fd);
+ }
+
+ umask (old_umask);
+
+ new_cwd = "/";
+ if (opt_chdir_path)
+ {
+ if (chdir (opt_chdir_path))
+ die_with_error ("Can't chdir to %s", opt_chdir_path);
+ new_cwd = opt_chdir_path;
+ }
+ else if (chdir (old_cwd) == 0)
+ {
+ /* If the old cwd is mapped in the sandbox, go there */
+ new_cwd = old_cwd;
+ }
+ else
+ {
+ /* If the old cwd is not mapped, go to home */
+ const char *home = getenv ("HOME");
+ if (home != NULL &&
+ chdir (home) == 0)
+ new_cwd = home;
+ }
+ xsetenv ("PWD", new_cwd, 1);
+ free (old_cwd);
+
+ if (opt_new_session &&
+ setsid () == (pid_t) -1)
+ die_with_error ("setsid");
+
+ if (label_exec (opt_exec_label) == -1)
+ die_with_error ("label_exec %s", argv[0]);
+
+ __debug__ (("forking for child\n"));
+
+ if (opt_unshare_pid || lock_files != NULL || opt_sync_fd != -1)
+ {
+ /* We have to have a pid 1 in the pid namespace, because
+ * otherwise we'll get a bunch of zombies as nothing reaps
+ * them. Alternatively if we're using sync_fd or lock_files we
+ * need some process to own these.
+ */
+
+ pid = fork ();
+ if (pid == -1)
+ die_with_error ("Can't fork for pid 1");
+
+ if (pid != 0)
+ {
+ /* Close fds in pid 1, except stdio and optionally event_fd
+ (for syncing pid 2 lifetime with monitor_child) and
+ opt_sync_fd (for syncing sandbox lifetime with outside
+ process).
+ Any other fds will been passed on to the child though. */
+ {
+ int dont_close[3];
+ int j = 0;
+ if (event_fd != -1)
+ dont_close[j++] = event_fd;
+ if (opt_sync_fd != -1)
+ dont_close[j++] = opt_sync_fd;
+ dont_close[j++] = -1;
+ fdwalk (proc_fd, close_extra_fds, dont_close);
+ }
+
+ return do_init (event_fd, pid, seccomp_data != NULL ? &seccomp_prog : NULL);
+ }
+ }
+
+ __debug__ (("launch executable %s\n", argv[0]));
+
+ if (proc_fd != -1)
+ close (proc_fd);
+
+ if (opt_sync_fd != -1)
+ close (opt_sync_fd);
+
+ /* We want sigchild in the child */
+ unblock_sigchild ();
+
+ /* Optionally bind our lifecycle */
+ handle_die_with_parent ();
+
+ /* Should be the last thing before execve() so that filters don't
+ * need to handle anything above */
+ if (seccomp_data != NULL &&
+ prctl (PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &seccomp_prog) != 0)
+ die_with_error ("prctl(PR_SET_SECCOMP)");
+
+ if (execvp (argv[0], argv) == -1)
+ die_with_error ("execvp %s", argv[0]);
+
+ return 0;
+}
diff -Nuar flatpak-1.0.0.orig/bubblewrap/bubblewrap.jpg flatpak-1.0.0/bubblewrap/bubblewrap.jpg
--- flatpak-1.0.0.orig/bubblewrap/bubblewrap.jpg 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/bubblewrap.jpg 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,143 @@
+����JFIFHH��C��C������ 
+���� �c6M��5G?�or��y-�=:I.l֯�v+ܐj���J�����N�턐1%�=��U ɮ���P|5q6��`: �y/M=.q��$�� l_��ӛg7�}� <
+DoM�����s��_����Vsf5D�j��s���2�`w5^.�v�b'�d�I��ȯH�m�X�3!��e7a�%�QY��: x)���3����rah_ױ��RZ��*�P�)E� ˦���ۦ��7�.�K6�q'q�������oҋ�j�9�����㱞�˹N�9SjR�r�U�T/вa:�Bi�e��{.�ޥ�+���[5D�E<�<ϋs0y���e��}�F˥a|�f���,WA[HI��ž�צu]�R�������N��d&��)4+}������i�3W7�W"Y���f?7�?����
+6h���=��Jy���f;iB��ѩ���V9g٭b����V�`ѐ_l��[3���6<V7�ݝ�nN��XK�o����-���:�f@����3�X��jk��>� `z,R5� ��`�g��a����6D�/��aD2dg�� �G�RYWG�1�ák[��r�C:�K"%���������[�B�~g�����|d��M��l��Ia���
tp��!���G�nuX&!�K�ۘ����GNh�-��� �:j��p5R>{mG�A�v�T���a��z�Re[x�W���O0!牮�P-d,���ww~��Q��u_���vSdcB<�T�՞gb�2�v�r>ߔo�K����
���!A��
+�lF!�f%hQ����d���]~��ϊ�O�����H� 𰙐�k;<��x�LK��k1YN�֩蟵����Z��+2|Ď� A&�.\� �a�p���%B����e_�>�Sy[OEIOO>��:3,a�M�T���CE�hʷ~�����%/�p�9�qp�:
+vpi);y�$��C���9!��Xݲ���ϲx1ˁ��V�et�LM,�\�0��4�zԺ'�y��"dp� A+��ݑ�ܵd/�V�'a��s���;�6�>7+g�q1VR�k>�oeT����O5u���/:vJ
.
�����ف�EԵ���� �105�����\�8�8ۤ�O�]��7��+.��mŀ��ʾy��;)f G��"?�s��j�K����<�*˻��8\�I�-ZΊ���|l8A������'��1}>Qz�\An�I��K����=�ʙS��;��.T���}���6�k��  ���Ʉ �6!���R�Q 6�H��/r7�|����.V���5o(��!.�[+ӕ���[>z�M4����8g�&s�uM��6}jpHe�3C�
+5��ҧq�����4ߖx�k[ͺ����nF��Ȯ=y���}Q��=�}���9$*j����RO1b\7�J 7��*9���ݟ|�� �ت�� �{9���r�3ѵs�[j��z�]!�VG2�J�������!�� ���-T:����E�O�?A0������^k֭w��!׻�r�\y��އ5��@�������'���6���������G�CBxϗ����]���4O!>5n#Ûn��r:0�D�)2l(r�i�t.�_
���b`�ԁs��m3bƹ�^+Y���!�&�L����%�� ���wE0�1v]X��Yw\ Y��w,����Jf�drAm53Z��",kN�Vk�:4Y0�H�ѐ�-�,]QAvm���>���j�a]�dI����5\�$P��dGD��?��%!"#$����k��
+L���XZ�V�{6��k���R��l�@g���.�Tr�жn��J��gՍ2.dG�t���� %��� ��k�-A�TA`LO�^�3����L����y��DP9�\���or��v� �E���ޠ)�"?W��%�����ק}�Y�O��y����u򯣜������z:[7�������8�S�;AwW����B'�[���5�')���6P&I�BTmO4�H��H�g��㺈(���t�1��@o�������73s�ޫ^Z�C;�a�3T,���Г�*��sK@֭>��ho�r ]{vz5�Xz ���� -I�0i�C^�]����V�M��%4���զ�z#?7�� :�!Y�à�8�|���U�,��H�F1/�5:�^뛆��k˜z֋f???*)�][d���3��D2��p���ؼ��iW)���UJ#�%�9��b�s|�XJ��YMqu�M1G�
B�\�g����җ>�B_�&������jd�'y~)�׎���}|ī�i���1F�mU�9���5G�F����V�����zB�O>�Q/}�N�HTX����k[b�YT�|��!�
�ԋ�+-�Q^� =G�H? A^��Ck�����5�b.�Q��#8�����!��sy��K���N�'�t��Z�o�<@GOI�1k;j�e�;������hh:���gV0�C�������MA�o_] $���)������._����r3�#Kİ���S��|�ڪk��${�����/���=?(K���������l�=�U7��ڇ>grFO;T���W�}=����d8=hߺ�XvD1� �-oɌ�78l�>_ �<�Ǣ
�/�%�����/���.�����1��&��� �g�[Q�nu�{5�Ύ���˧|�db����)�* �6���ؤNP(�"(U;��阫%d�@�{
+���%�����[;� ��/��5&���H���ҏ�����U�^M���-S5���>��s,L͙_��������猉NѤ���V v5Aig10�%��α�� g���n�aZ]"�Y ���
+�l�P�K"�D�t���*A|��t;�C0�z6��z�g!�^�wJ"9�濫���|�Kҧ=��u1[�3����Σ���h"��Z
s�4_� ��u���
-��Yv����$�V#���еcw��vx��`�<[�ie�{�.thl�ݤ_�v�g�Q�����yQU���ԖM_Ei�)2ٺ$WG��o�����
+j�K�A�0�B�
`�뚁>��"�AЍ
+�ޜ�[� ��z}�~;c����{Mo��zW�2�Df2�A��tǮ�O���^ˇF��~�ui�X,[�׺��J8���Gb�}��A��O��I��A፜����.j�InQk�70ׯO��T=�����l��*\Y�����7�y�b��k����E��]�y��o���!���,
h /�]L�P�z�aX,Z}�=�k��Nk��V�8FE����KMb�v��A'���SQ70��G¥���3�*�{'G/�ζ����d��5v��j��O�Uf�J�Q��26D��k$�D�X��ӆ+cy�p;zi��Ld�5E�������9�,�%ʠ��9�e6�q�����,}}V*j�XGO; ��Pxm���tݎ�9{Z�mNca�b���{�� �$�M�P��R���(砈��P��Ė�r. si>(�E")���Gڣ(�FQ̹j�&0G�o{i��g�� �� [;Fߑ5����������<�.n'͞��[BgX��z�71���>��)���g���6xA\t֙2&�����&����t�)�d�/����@|�O�f
+yt%�e+���a�� ��WasY����E�}>Ǘ&��b��^�R^�3$��z۶_�m3g����^����fc~�{����3S3�1C2�$�#g�2�����ǰx�s|=����l����_���^5��r(�wQKUXTK{H}`��m�\7%�M��3v{e�����N��SW=�C���=q�)�.~�XU����_�����Q�_�h��1R_����%V����aS#�}�����q[8
+�j�z5_�~Y������t���Vl6w���=��s����~wY�+�L~q������t$���&
X��X�W�ϛO���.�^o���V%"�"��5����%�w�f����i,�M��pv�
2�k4�vg�\��B�����t!+�r\�,+h�1=�������%�p:�ͧ��Fɮ+�ٱm���B�
+���af��O����-s3d^�:-�����krTur����a���F�j�k8�d�f���l8 a�L-}V%y�/X�f�H�o@�R��e���O���!?a����*T�{��X��.Ht+��5��h+}���F(��q]�Gp��^I#�tX��b� �cĒ��2����[�+QBc)Zb�Jڔ�.*qj\�W����f��Ŧ�������P�Kbr9+/�������;����i��X�jGK��8�k4���e������2����u����?S�� z����Z��9�7Ɵ��
+����|'���6g����F
"2#3BC�!1QRSabr$Aqs�4T����Dcdt����������?��V�$�X�|�b�X��9c�oK�����H���++*ن[m���I�T�Ǎ�£b�UJ��­v̘��Q�jI$�b�=Z�ݔ�ib�-�Q�ˑZ�kT�J�s&�����獘fʬ$v�4mJG2��bHՒ�,6��'��l2�C%��Ċ��3 %�#qm(ؑ��ј���e�2-�$�y
b�Em����CV���btq,�r�~5V�5bLr!�q#Y|]�� �Qc���Э�� ,�UF��cN��}aY�%5�#L����9r�Fe��kͷ�
�Y<!�����K7#۸ѫHV�U��<��~#�8���-��������X�i=>��V�&��sh�Ib8�oHfU�Hd�ܱVR�$m��d�p!���DklF���3U�t꫉7�$j�#1�m��������b�_�߰��еe�
+��3*��I��{zg��F-�XqRMd�K��4m'H��j��2�����\HٷH�c�$�[Q��|����7ȷL�Z�b9�$�cɍV��j�����j�T�w���L~=��_��ѫr �%4nRሲ3q$�W��i�Ij{�r6\��F��$�լ4���� �ao�X�d7�� ��^B͸��i
�U~ēP���jLZ2?�n2�"�U]�xC2�X��������c�U��ⱛ��2I<��fɍ?+f��U�,��s�N��&��lu�xX�}"����1V�B�[�7��Rv�s��dtd�EV=��f��J���k~�r�����v��qRi*�MeȒ[`n7�C�Y"���+)��m�$�dĚ�KS^��oX�q?��ff��v�l���*�Q� ��akYnV�yj�U����v0�-V���=ꤒ3
!�썚6���'f#�2�����i٫�4ބ��=�K�)����+fV5��Srؑ��IW,I*�e���Tl�P��⧚�ym���k��dC 3UE��+2�U{=��G�f4���^�̱�$����U��b��j��bM�/dy �F�2Վ<EZ��c3dL�
���E$o1_.��йm��)ȇN�C����L���U���sg�,m���r�6R�#iZL�#�����
+��I,R ����k1_���o(�l�k����ǽ8�:�ڢ<V3�vulm��HѭF�٧U���e:��R6�64��! k��?�I2����"�5*�R�i;8���Ṟd*� �Qlċ�l���m����[�k�xP��\�+e�M {k�R+6#.X��b6��R=Bƹx��<�t�=�����5m�甒m���I���V�%5KpIRF�Ǘdm�Q�Ɵ�f�d����Z��eU�=,|Q�O���,�2��呣�|Ʊ�����'.�9�<w�ˑ޳wB��-�!�Y���)6�]�Y7���I2�V��dʣs8�Z��E�Vo1o�t���VQ��-[o���i,te��ekȶ&�U���VBi7
:�c�I�Q#�r�>�[<������T����'Y������D������:�K�G�i�Y5SoiMD��I�i�Ѳ�j��N���%��ef\b��H�5M�V��
n�E˗e�-X����o�k,G�V��G�
+�.GU���/�L���7e����n5���V<��J�ku\��i;��,+"��Jk$�]��U,��r"�]��Z�c�U��MV�d5
f���Z�<��FݞZ�� �
�_�� �H��6a[ ����ٹ ���|�E&����[w�Hٙ|N��Jѱ�.7��u��[ksU����P��Y{��Q�~�TU�^2�B�i�xU�&X�#
+�[
�ȯ�G ͍�Uf��o�謆i�I��b[�
+�T�5I�En��Ch�����5�c�r$� UdU��gV���1����(����d�QV�bI6�ۆ�����
&%�*�-�l�? �c��K5�U�5�7���#�t�U���_R��c�'P��+G��b�8�7-���e���-q#�6�d��W����9}��Q�1&�%�V]�mSI�HU�j���Z�qDZY��QZ�RK�_�5~>?�L��X�x��f�+yX��K=��Y`��M�$�q�fۖ�G���5�1�ñ6�(VOX�F�r-V�#Y��l��aW�T���5U-��Z�YX�FȪ�ª���k���a��~/����{�s���VN��U��j��"�7/�!ffZ�4�ؖ�)kb{;��%�^?x�Kb5�U��Y�Vŕx���c����f?/����5,,�����a��#[+a�n_q�[���8�Cb�W��O`͈�!�-c���v7��%��t�� :q���/G�^�x�7����o�O�bF��{���GO�����O�/A�Ӝcr���t|���ggG���G
+"#23�B!ACQRq$1DSabr���4Tc����dst���������?/<��n���wϯ��m���� (�XLiJr�L1�ʆ F;R�H��u��Ļ jJbb�)i��d�p�m>�Kq�E.!�ca2�v&$�u낻���D��Q�Z�f��p7Z��e>�!j�2��N�ze�l�����p�����L�h��
V*�ˉ���js*%�-[Ub5�)�j��*�VYP��R��Œ�V1�%��+"S�׉���J e��/ s#����B������(7�8���u��� ,���=u��e���?$heQZ�A""�������.��!h�B,�x-�^ �#�����43
K���.\�����=����}*��U��+�& %�r�k �.��΂$\Qc��S�d���Yo�*����o�x!(0Wib���F��B��g������؄Ql��� �8�ШK�
�r�{
+��SK�
+�iG|�Uʨ�6���v I�e*)��,�o�dr���J=ݬ���I!ʬ� xV)|����a��ҡ���VU5ŝ��JSө�lBc����~����M��y��u��-�{5���ҕ �/��ʥ�/��/y���X�Vl�ؚT��͉�J]F»�ʅ���0i^�̹P�1YbJ�4�vź�]����>����ᘄ�b��A��+�e�m����4MY�!)hƌk�!���Y���i��}�f��,�����u��>����PJ)�8�+�G\?�§ �"�~!b���,AWN�\K� sD��]`�tV
�*5;V7)��1ԭ$*��2"���a§�W��B�%�
���\W ]8�n�l!��^�w�J�]�5��l����A�+�0P�TR�۲��
+�P�f�N�F9c��蠰���n��-+f�`��a $�$��u댧S��*�s G6��..�A��#�fQ�C�>����9w��i��LTp��R�ZqtZ�+F&��Щ���$�Ä�/�͕U��Y�{�D�Dqf�&��ܫ�Qv��Yc��2�"���d������_DH�
дۈs�B,�M>���l�(��-�r"��;�]h�H���K�[tr��ҕH���U��ON�S\_OU�W_��I���K����Z_֠
��?��"�,!k��[�K� M�|7E��Ή JhX�tn��NP�ۧ��T��U8�P���)���8f��.��2�إ��Ŭ�ۚ����"+���_�ieUa]����M����R�AUSw��^a�G�̬&�e���.� ��)�g��YJ}����a]nn��vi�U�N7�����ʔt�#wc
+ىu�0�L�&�Q��LK 
l��,/��3x,%A�%�Ȣ�O�(��r����
�l�$��fȚq��X��v\�>k����:�~z~����|�]��f�J�W"�m�9�BPK4q 4�p�r�T8����[�ҿZ���J)m��7�,Ś�iGNEUmO^��p��D��0�1k��;���Û��t,�6��[;�)�VKVh��n��pB֓'w(Œ�)��gxm��W�Qnn���|��A�U�s7�l%�
+/Eolդ�V\�Mn�K��p�PG{`��}�[�_`�{
+���6˽�$<0�Yl��n�
+Q-��8ˆ'(�wn+�������1bJ�c���b�|&�XKR��J��,!��+�(�+��Y0�h���4K�Z0�t���9���B����4� ��SXQ�U\K�M�1�K,�1uP�K�L�˔�0�k�tT��R_:j�qAU�t5��Z~?��}Ҏ�eJǕ5./z�4���~��XR׎��Zك�U�iQ�+�KQ�f;f�N�ߞ�#l,��h��x{-�%�xo�������O�u���K���3^R����-/�a-� !d��3*��u¸�d�7k��k%Q(U�L��dD�]�I
�^ �����F:�J�]�Jj�
+�^4Z�9Ir�d�,
+�� ��2�g�-� � ,��g�F����i٦e�������� �kL�e�L�ʃ�p�x��If���Nqpq�j��w�S�u�IX��qS����ڢ�o��L�+&�c�8�Az9��ꅸ�ܪ:���d^X+�2; �/�cNw��#�(D=�7/j]˗f믢3���}���+!�Jv
�y?���IkwГ���mö�kf�h�gV��ꗿr���QkHyP�-��EŅ�)u5�[Z�)��� "��
�,)����7�!!�rͰm)m��[./�]��o�]z��[K ���N�Ǻ:�\_��%O��ʂ��{ʌ�Us֢�|�k*�ew*]�"e
ECX*�2�U��kW��GB���e֎i���7,�Z=Ym݄"CD0���e��{�V^�˚[��0�}a�I��Ki>��զb]�z��W��&���T"�S!$�ZR����V`�:US��PV$6��1b̧>�"�{�R�a�PFR��!��0Fу�-�
+����n�f��-�M�����S3���8b0�P���{�OK�L/K-? ��m�翰�����.�PG,�G�
� ��El�Y�&�%ݖ����B"3?�)���n�����豷1K�����Rۡe�W ��sB/f�A�L����:vM���/df�P�M��i^��4���9�4�:KGdzN��,��6��c��:;<=z�4f�|��׫�� 6@���S�׫�L)��4O��O "#3!2BC1RSbc$Ars4���DQa��Tq�����dt�������%5�����?��b7DF���L���f�D|�)$
�>1����( ��L:W�q������K��KQGS��Ţ�R��+�?�suO���M`F���\��Y}ίS�i�6IW(�~��uvY�]����:����'��ښ!������tJ�lMba+tTT���#��mbئ���r�;6��
+QK���^�6�+88��e��t����X+N2&�$�,̽��}&�hYe��
�2��z��Eo�}�̞NJ�-lͥUr��h�*ǵ*M5l �Ǒ`dV?��o5J������G,'�
�I]J~X�57���I�a���5vw*J�0T���=t�� j�M�'/]��f��)�n� ��c*��� �TdɕM?K���a�s�ș�qS��~�>�y��E0�]U�hH�1����]�},��䱪ҒV_T�l�� ,F��[bق���_U_ &�5(fT0��/�<�+��9�2&*�&��nmv*cT��TF
�m����sQ2��:��-K֨K�*�yE�+J�T���kΓ~//P)1�9�D�|�@xG�,-štϊ)�z�i�(JuY��*���#?��� \(v�S����y�-�9<e����������ؔ���)��y��1�� ��Bs�R��T´Hi�λ�+'�]&YuMD�K��&�����/��[��k�5�1=ր�m�4��&����C�+-�?�_�²�����Ū`/ڛ�_6���뷩�$����,����.g����R�����:@�7 f%N>p��5>��V��m�akp���2�MYM %Zb��G��ޢ�[5QZ� 5ZA/%x|~�V3J�IT�UP��H�Ne���.�%��|�p��i���4~u����}Ujj����%�P�ޚ�@;M^p�ܫ��V�խ��5��qXשl> Z�D�zz�GSKL���E�5�;/dp0�?K�n�(kdѴj lB�<��\��Lö�7O��TD�è�UcN� �rJ�n^�����7H�z��AS�2��]@<��Ұ��꒒}cC���2����b�ZK����}���7 2�����1���Ҫ�'L���&k#oTE'��(�Y1r����]D
:�a��ݡ��M:[ٛ�c���W���^]!+$���3 R6J�
+ƓZg�ȥ�q|,��=d�嵔�XR^/:�� �N�袞��j���U��S1T�
+��(� 6(�CG����9|�����t��Χ7 [�]�d_!��Z�.V��f�O����J���M%��ӛr+�ԇ�ң���HY�S�c����P�>��ر3[�ndwE�+H�� u��>�PG����W�l���
+҂�&�.���`&7���V�|P= �́D���t�@�2o�@VA]�$#l������I�����7H�� x<��r6��ұ�I0��
+ZiೖNw/� W�b�CR袨U]�ߟ�R&ⵦ �?����uOF�&��|SR@��6����g3��9s�N���@K�>P/#�)OX��2��{K�HO��߫���t�#U@ s1�q�x��&��]D�BѲ�~��kC# �Z������j>S`�^�CQR�����;���b5�j��-�@��6�*�w{ֹ X"ήJ�J����t2�����5$�{n��Bx����1u�YZ���'aS������*�j��>:v�h.����*9jR���f���iMI�T �]���k�Lf;Ijc�U�[���ŏr��0j��D������e5^�U꜕���������gK����^�h�ƻ)�
+"��� �=&����/�rc��W*�7d&�Xt�X��]D�Nj����*�F�����Mj�jN.����SP;6����:�6��B���W�OO�v�dY�V5)J�Ƥ�v�mu}5hʛN�Mz9��Mm�MPg�Z�����7[��rj�䢍��5uk[�bi|X��nS6��-%���"��5����D�=߲�
VӸ�b�Ƶ��V�a��:p�R5���8X<B�<��.�O��6�n�r�n#L� ��+�֊��ê`U�E"��\�;+h#!*����d���%],�GUgQ/%?jU-(b����5��8��Bل������yzkS~�n�x�ԂDd*��r�P�N�X|J���U�.�6vwVH�b�@��m�(����/���K�n����������4���V�
��yղڃ�|�̰�'L�N��&�Y������E��e4r��Y�$����O""����Z��&����d/�Tc��9Y�JΧ1~���Nl�R�Hgp-i�k�>C�1ɪq�@�YB���Õh�{�`������*in��_Ueo�>j�.���*��o��|g�40���j��'���o{�����U=Q��j��R3�}�r����=:�o���:��٠t�RH�42��D`�bb�X��s2��h��1��4�|!���@~@�!ko��G�cצ]�o�6��K�B��P���3�~R�aI�7��/���*���զGk�pe���V.�Ucj�eWII�״VH$*~�k1������X�T1_��TJ����ʪ,�*WPќi��˗����$kG-�,��p����"v6�'Hy9]��j��v��������Q��S�E�)l���[���� }>$NO��Of[�lɎ�L��u^��v�cΤpTm6R���Ui֮�ML��^�R�7T�@��)X8*͒��\�k�����g+�R�ꙁ؉�ǕmV9�R��!U9*f���U�+�v�/gd����K'_Y��i�j����C�b��qb͗)@�����Rk�h�B����VTe�m���ZXm:�su}AC�*����C� j�do+')\ܩ0���t����.����CU�ֿ��ٻSZf�7��D4\�4��*q�>i
���y���*���8����'�5(,8��K�l��U+��8]2�l��{�'yYh��;:\̸�5��YZ��>�Ŀ�zQ�JR'��1q�#g���Ǫ�Q6񼄘�Ӧ���8W����e ӘVE%Fz��u�j W������
+�Vv4�n�v S �UJ�D�?ڪ����+��+T���$DY�i ��t�h�� z�[YNm��2�+]�$W�Ft�tۉ�Hl���<_�~\_���V�.�Q7����?��%[��`�w'�̗cѧ���)�R^(Y�ܫL�qe�-�}� f�������0�������&��wc�&��RRr3��ʭ �Q�,��5�U) T��r�5;9���� �������� ���B������H�o� �|��.��5�c�;�h�\���hʿ����*���J�H5�Keu"�D]?;T� z�n��2J�8���L˾�ߜ���>��jJ��U]9M�uBJ�n�M�B���C��h�6D�V$YQN۔�2�*�_R�|ΓoW�mmj�HQW\��"���N�������-ғS
+���I=��.rM'IkLش�T����ʥ���*:�]+�.�`o�*��2 �j^��lʮf��;&v=S�Po�j�\�U}3����n��Ef�Oh�p��T��$�XD������b�F|�WS%%�f�UO�GN–���ï�h�4�?(�&7�u�z����\�Ś�-�U-�n�j ��6r��8�]�%Ed�m�����|ί��r��&T��
���� )���J�w��"?=���4)ų�$.T�J�xk �
Hcwh�j������K�~�m��EYL�
+f��
+��Z�e�5����MEML
+�T�8�M�r���B`��z��~�����\V���J�H�1T�\� >O!C�J X�^����R�U�x�?��
~�$�1�p$��FOi�o=���(2b�|]q���<+S4�"Mu�> �H/�r�,g��ZSjjGz���c�J��
�R��`]�;y�K��4�5U���D�6G�8�����@(���i֤��������g��gd�
��jMS3g�>0�1�|�K\(U*%ePp�|�'oĸ����x�.���9��f,�Y�� ���=U��(�
d��>f!��/�y~.���S~⒁���x��������N�Ld�����
+�J���l�٪�%ez�Q��B�����T��y)�O�PچsZ�Ĝ�;*��R�v0*������2�]m:r,����Y9��j��jĠ3\�#J�� O�B���g-� f^ �}%K�hB��i*��-Wg�3��<ű�ʞsp�]���iU,�Օ�z[�8����N6^�-�W�R�;cT�UJO,ٖ-��B�TK�m���#V�7��u*��.�N�*n ��ZVr����[;.V��w+T���U�k�0�p%�~*�81�!|��x�W��\%��$�k6��L��P�1��U��OfZ��NY]g(���n�X̺�].^>�tCN�0J�%��+���+;9������>vϥw)��X�T��t���Խ����LD� ��1|�^o�ï�#ll�܅��QPt̫��r����')]���I�.��
c��s��5��1&�SW�|��a�=�ͤ���T�zDZ����/8p9����4�F�6�F�"DL�\�����9~���Rʊrr��p�ɼ�r��ËK����n�������
�E(��>����z�S�'���G����
;hm=�Q��6�2�Z������7�i�;�Bہ��j�~%���-3��2��4`$Sg���>.��"d��25o��_�T�b*���X�����U���&�ɻ�د���:��@.MY.=���D�����#�m�Ã2Zi�<Ó'�~],�l�'tq�� w�G f�ſ� �\E�=΢#6��f{͎ �G~K�zY9\�n<Z�Ö!p�B�
�p�~������êc�����Ċ�R@�@�9�B���ur���U.?k�����E5?'�||�fCN����zMJۦT̨��k���y\����,��R�����z�){�i{�B�k�[��qDn�${�~�y���2�\�T�3�JC��m3��|�k_𰱪Х�wi����"cҷ�g��W���ŁL���)�hS\��q�)y=.W/Aɱ ,t �xD�>������6��g�U�����t+�eh���d��M��`Y?p�i{oii�S��XMtec*[�]�E �-;ȩ�;��|6ꎂ��0�(�Vu�v��g���9�k���+����*�i���M��(
+���m�m�ZYz^
6�vh�d}?g2���;��Q�]O�
+��w�; �vxG�ՃN��Y�k��i���$V��A�������E��V*H���4�����
+��
��� �ⷃ%���u����"�-�a���~����D�TADE��NJ�̻@���
+��;� �f�~��Q9"��N���/߿X�+�d� ����W��q�R0�~R*w�
+e �����5
:�Q���
�'��E�,$��% @_�*,��_�k?|>&��cM27>����
+���>M~�����ra5"�)�A�k};8��S]�7A0[�b-2�e��釧�R���)U���-�CV�Tm���ҕ�`�5�hmV-Kg+���jSCcѤ{-eQK�l�Q����"<_�?�����5J���i��Y4 ¥�����]���O����⪨k��T����:�􈏙b��t�W���X����Q)
͒��>�M��V)��9�Ǖ������d���PT�ʠ��0S��|�5�������j��c*��P 16�\ߟ�h{�6V!�凕�fO3���ԅ;%��:�Y/�����|z�}S$���sq��������_������ǽ�#��P���uw�X�l������jN���k�gfT%����S�E�����h�N��u_L��V��U �P�S�. �UY�?�o���͞U˦eEΪ��eS�{6%����寕�����Ljh:��E\�4�ƞ��G���OKe.F�ȡB��1?6�_�F�)��n�Dz1�����Cfq�ܣ����-���ARg��()�A�� I�J�OVQ�x���`�z����W�[iU-�L�0K�#�<� V|Z�2���{��M8�3.�����V���~n�c�w�&��?�K���{���3�������;�Ou�K�Θ+����J�FD������̄s0� �t����==ԜTF콝��P�����ڦ��o5��o0luP�y�i��<<�8��mb�J��ޭ���_Juu୕p��sWFbf4��5:]X�c)�T�����UKO��;6�(s�H���P�q}��l�
�Q���@:��٪��Tx��(2UUU#g����H�B R!­����g��]^�<���%f�"xn�)�x����b�Ʒ�KR��ӂ�oL���1>!����������cv
+�
�����س���� ��\��j�ld�Ji����ńa���ԴX�k��WR����"�T^����f]
+��I�-�Z۞a����g3���BVŜ��A��H���4/����I92�� ��R/P?/O{�&��b�T��� 7�G���;�m�H�&���چ�j|�x�ois2sl���;IՃ��j�Zt�NT�>U���������ijX8�����Dps
�XjW�)˘�U�S�FZ���� >}�si/���e�Z$��$n��#7�?��Ӝm� l.g����/q\3r�#�D���X= ���Sa}�Vy��� ���2‹g�ӻ����҄�j��(���^����:��tF����������$��g�/��#![�����{��k+��-pR���23%��M��W������&"0�"U��x<���i�9�z��*�jl��,1��jc9JWEMȬU�kPL�V��g���I�'m��lnШˋ���*�m�lU�Ӷ���^��T;����S�����[=��e>�A�pM�&�Z!��Ƿ>�;�E�B��#Q/Ē���'�_Qm��g%eAH3qF�2��zy�C+�R���7�lPb�>e��?���zc�IBfNѓ�U�c��Єӆ!+�o9����f��Є��B���qŰ��Y�>�=+4��C�-\�(� �o���d�U�ɿ�^kJ,��O��.���&h"'*ؑ��~]m�W�)k*��5"�
+J⬢ALFK�gU��Srr���QR��KKOKybl8��"Px�ҿUt��i*'iR��T$��*��d%P�`v~�]O�����j�D�T^��KLm�l�#����is!'N&D1�0C���h
[��{�{�(��w[�k+a�d[�c�����/~��.�/�ҙ
o�]iE�)��ݫ�tD{g~�(�QiG�|�����:� B�r��Lb.>;n��ytח��5Z�pSl��B]�í����D.�j���T{F����k�bl�+N�i9$�'�\}�� Cj*YP���R����4�����g櫰PTMC�L?�ƭG��EE�e%9����)խR�H*�ʹ�Dy�>
+�=�w���W���j��6{�J�[�*�sj ��Q��!_l�����jv,GE^ë JIH@ddv���:Q���o��kS��A��[
uH3��L�Z�_�cU���l�ԃ(�
:DJؼ��v_�g�L_+�.�-ޭ�Pfb[��pd���]���pmqr�L�D���������k��N��IYu������&�@IδŒ�`.��+�@,|��Rj�-�ag��C�k� �# 1,Y1e�u8�.��;��:HE9��(!!�!+j�� |Y~�uKGNy_ש����]C�C�n�͎���$�c�m�!ԍh�vk��'�̚�d�ߪ���h��NΧ�\����d�M������޶�{�\��z��
+��������t��������9N��jƭƩ 嚯�J{,J3�3�Ĥ�O'��g��`� �Y����4�f�-�������5��rE;�x�����Sr�}�c>?��#���3�n�=���!-���Uq n\ď�_�1i�7H -bR;���Z�����s}^���i����Udřq��6�˙gr��o|F�Hvάvy�$��� �6��2�#9���u�A�ENީQ�� n5,Sc�J���f��#YV��j��ڝM@�3o~���R���UJ�2�箍$a�m�����>U5�
������YmJ����"4���^�=�+�w���mj�cyN�t�>�dF��><��]Br-��[k����[t��ꦤJI�P4���CUc���c���v�i�A�-blJdT4nj?� \�����e=5+~���f�cJS%�`�?0�z�&���a��=�>e�<��hI�>G2-V������Ft����
+��Z1*i�I�+����[�"�W����*��5��Hf��l�߳ѭT���軠�t�yI���3b��kW�ˠ>���
+h�K^�.�W�gK��Zk��E7A�}��~Sy��z�S��f-Q$���xD�g���Z�eP2���[�C�m�F;6v�VШ��A����U�kzfwӕ:�t���҆֙�h��4)^/��$i�B��`������= $S�H�[� >+�ٔV�����@��\B7v���!�<��/�詏������/q�H������#p��?N���z����Ffxe@>[}�KO�K�o~���j��m�^��������]��������թ��`>" ��٤Q�S��S:��e,E� �CO&l��[r-��3ru�7�_ i�3tBN��x���ϫ�[Xvs���N���,�M�X��a�+���WC�=F���(aՐ$uT��gkU!u�As���v-l����ݨM�����9T��R�H`�͌ż�x�ގ%bV�ivX��T"���3��U�~3`|=RdrSN�\EAȴ�w$�3�E��uy'��;�^�@��j, T�`^d"^�:�K�n�?����I
eH�6R�S>0�5���\NmA��s����^@g ����U;�(X_}�m�%���^O�W�B������<,[���0\�/>�� ���E6+g���Ll�q�smg�+����5J���ɹ�d~�ߧ=�z�����eR�eև,�g��9�Oi������6WN�u?@MX$6E�������{�K�B��a�[J�|n�GRT�HEVCE��^W+���G:���"CVB���Z![����/�hW��_]��� ���R���s._��s���Ul�7�I\��k�!�Fv�Փ��jI�.��2�Dc��������ĩޣ�@�����h�XǾؙ��<}>_��P��p��h�k���^@�FЫySR� �,�V@�:@ �'���7�ri������Y%��I�Ӑs0TZ��^m�dŤ_�žf�L��2�2��l��5j�x�5���,G�M�Ϥ�t��������6��E����*Z62������WM�\�n�캴2�������'�-ig�;9x�V�'rX�K?F;��h,cj0�$�R��\�gT�.c9Y@��ʕ��ڵ��
+��T�Xe��>%z<c���M�H�uA�. Ģ8uE�/M� ��1+EL�*��L�R����.kH�[�������U'7�իs�<�-i5I{�����J�akS��vI�Q9�I:��N�o��N?%�����әļ����d�`���qS�~����\ɻ�w��V�Ө��!��."���U�mF���h�I���g���\8*Q�q�.������������T+��Q�
��X��v;����=�u��F^}1@��.Rw�f��5?9�׫tn�?
+����(��1�ٵ)�e�f�-r�_c]�S�
�Oh0V&/��.f�i(�ᣨ�MU*�&�l���c��z�I�^<��T���ӲU%|K^*��J�K�bH}]S9��]�v|�&�S)jF� ��x�m���=5��3�ՐŌ>>�P��jl���[����g3G_Z��e�!D�q��!+��w���������g�����#LUGhJJ��\��:wu�SM}.��3N{9
������[�UNp��̭� ���:m��i�j$��Db���ޫ��Y��gK[N���!�@��Ik���ǎ����j�o����U]G���lBj��=[����L�Qՠwk��훱۵i�E_P;8h���W,�:�J�~&)� ��諗��V��{F�P%*�5jhA��h%�gS"֮o7+S��06���?lŷ�S��6�WQC�]N`�+�ۃ�C��?��Y(6��������ص��~+���_�%�r�Enͩ؛0��n�h��D�J���@����V,<���̐�l�J��qZA�����j���3�2��2���\������ŵYO�����
��ID��͔���X�U16a��R0V���~=�5 �7��w��TA����h-�@�G��6�%�(��:,K:@�e��e��U��ަ�/�����]1#(h� 4V�8��#��
�[��w[siQ��2�h(�1+
j������NW���:��r�8NJ�尪�-� O�x>�W[9<�6��Ɣ�����5*�!�1�Ey>)�=QQ��(؉g;��C ��|a�W��$�
+�������Բ�O���Ǫg�_T�D�wn��C����,#�0��l�E�h�N\W)�������e�h��ٔ� ��p��*�����@s9�%j��km`�!�!H��M-`�q��j�g�?�ʳ.��eY���J��Bj+�"U,�X�|-m�uZ_OXtn�T�j�Fn5|Ui���qT2观�x�磐d�K��(6x�s��ZOn �`7�� q�P��=A�ӵ�=������M���K�1 $EU 2����ϋgK���4����Pw8x�hr�Y�L�� 2�-��-���X>�4��1����p�? 4�
+B�ȝ�-�i��n
9J�"� ��1���B�\(�V3;���:(� %2)n�`���EP}Ў�\nj���˼�0"7���xD�κ������﷾.��F����v}R�V>�g�� �{e�/�=���*�]e�[+e׭���P4ʬ����@1�� �gh��^�����]�\���fp�4��wX�� rc^_��fݢ�XMR�vP"o�����U��W&�i���?t����e��N�8e��|]R��ꎨ
+:B-�`Q?~g�-SW�m:q}�]3qS��uU�_EF����_j�+�e�N���6�IJ�s�0Oʼn����#�#(T�OS*�(���u@�P;j��9$_iƳ��mEC�R������DlQ^���i��q���3������.��
+�]к6����Ų�#��&%^���)
� �5SVB�˄�;�| �}&��J��&�.�SoX�S����3�����X�0w>
0'� s,�hs=^�-Ȏ�p"wp�ˍ��V��g���cn/�2��MV�fI��Ɯ���kp(*q+�!�1_K�՗WT�UX���hM���؏�:m^EsloF�U=]�
+�S���t�Pd�j�Ň\Kb����o��JHO�ݸ
��he �#S�;�����hX�a���!�������Y������۵3��������k>��%ǻ� ���H.�i@�L���T��5���8 ݿ�>�� IE�u���շO�tF�
}�����u5OgLf� ;.%^x��o+-~�Jk�E%_@��%h[yP5�k魝]2А��e+�q��p����s�J�í�MWE�f�`�ǐ��Z@Fߨ
+S���&� �J�J�o��B�����ީg��iU5�{bm�IZ�s�/� S��&ux=]�B"6��ԅ�x������T!���&);�k��/e�Ϫ��+)��N�کtU�e(Q@�A�\�O��;�J��}EkuF�Mh2��%=�"����PN?��Nj�������H��R�8|v�.�8̚�|�J<>�����XU�hc���`�ýa���|����Z딁_mB��<D��y����꺞���U�lE�N$���NxΠ��_5NSR�� �:����*TѪ��� ��~L�c�M�I�Y��R��Qڐ���� r�s��������!�j��V>��ϏRrR�2F �?5��Ҋ��������y�a����Fs?~�������F��X D�ǵ��ݡ'o۾D���%,k��R6����:wH2FfFw��-��M2�d����gͦ1POvC������[_;�c�6�[٧ �� �Vx?��%�;��������~��Lխ֕�twŅ�/!�&t׍��JB*�Z^�3��zMj�3X�"&E��!��[�IZ�P����v�?ɏJ� 6740����h���Z�9�� f��q�H�ɭ�F����ER�Ŵ���q*�MEՑ�!�"pҨ�ǃ��>f�sۗWl��T��@*j��y8Ô��d��}]T�*Z���,M=w�0���!�g��up��r~��:�a���)����J��;S1TT) t�I�?R�mU �6�Y�W��A���fFr�4SR/�`
+�
��*D��'�I�g��쪓���T��Z��'�Ø88 ������]ff��G<�uR�D��=�3�w�C��͡n�����7��lG��D�qw�D�� ���Z�Q���E�1��S�b[�C���A�'�����V�$~(�'��:�l�����#Kw�6����ҙgp��cI�|(����U'�"#���_�jN�^G���
�@�������cd\g�C"���.�����A�fT�MV�n���m��$�w�����MIe�" x.W����:��Պ�N`�� ���W����=W�Χ��ňi���� �%y
��o�����(p�e���a��G�ψ��P���X������~5�2hkE5T5 3{Dj��7
���+R�vZ^_U�kT�JJ�QT���-�H�y4K�eS�#9V#�����b�l儅�*��-�p$  e�&6���i�n6�;��M�6�C��7s� ���_�it�M��5�75�W���5�p8,���5�i��{>�
�211���Son
���|�����ݠN� �f'C)9��(�&��L[��6�m�����]U��`�i���&��,�O���E.)��[�bwB����P31l�tƃ#�I�MA��xآ���n]�-˶���u�Z� )��N(��'������w�Gywo��ik�KT3�+/��h�jKfn1�D�c��ZMN:�5��f�rd�V�m�Y�����@�LY*�\fp���|9?L��Ӑw ���zfOXr �|%m�6x.t�|�O
���'��;��
������tϷ\th����∈���Z�${m�����Z\$����~_����
+fd�?�- �̙wn��rb&B7�L�ua��L{5~� ��:�wG���^9ݿ��ۡ����3�����d�2!�ހ�Ύ�*SOr�c�,�k’�����EE*�_��oL2}M>�h$�u;H��%����|�f�o�;���F�5���Z�Y��`fђ��-Z���x���:aV��'w��H_h����G ��{��:xf��1�3x� ��Cx��d���{�Ťӂg�;����G�Z̚�d�`N7n�˦\�;�}�N����7Gt�V���S=��zݺCE�]�,w���=����0ǻ�ݭ��7w���c��x���w|wwnՍ�Dn�ϟX�. ����éa�S埻Co�;�v��ۭ���x�wV�4�LJj��Х��n7ŷ��� �!-*��wL`f�"�8G�5������[t^����T����������Ӂ;�E�13�������2?�G~��6�Gtj���r�b]�w�;��P����ݻ
��G~��󭟴"K�˜[����^� YMa��F��-;bq���f-�o����Q��0��P}Ő�O�߭���ſ���X������\,|^����lF����-D�^� !6ZQ?x�����<#���CΤ��v���]��$O߿�O��' !1Aa0q��Q��������?!5���yB>
+F&t�Z
8��[�x^�MC���j�6�HC�/%X�qe߀3K���u�J(<�(�[�В�a92R�`�q�G(L�4���� ��:�a_`����� �}����ݍ��H�_�o@8z�G�q�� ��#�4��A�G ����Bᾇpwv�,�:��pPO.��q-�$B ���#��4 �-:�H� |� �C,���$��&�@�'��Ȅ᱀��O�N++�B�-#���9�C�E�i�14�8�����G.��
+�OG@(1
·��ݎ�C�Ȁ���BD��+��^������$g -eDbQ����nq�f�Ҕ#Fj@�J�fpgÏ�H��IM���I��*�NI,T�I�8~�(�@��3��\̔
������!�p�I��h�G�l�� x� -�R�ϴ��1�;�*���
�R��pw�ʉ��P��?�aiP'Tpzڎ{����GV��$�Zkd�ӽh�!�[����� �6D��xHf�hH wZkT��-��VN*���
+����m s�B��f��QƠD���-��|�BʜɍPL��(zZ��"i� {q����G��F`��<�߾î�s�����<$&���i��������i�(��D��X�����h��">ī-4��q�,ֱ�dZI��g���t=�l��8�1�L/���C#�` ^��.PڣL�2���F�g� �����I�*ұ���7�b+�6��I�$�5�ze�\L{(�3��
ޣ'�Kk�=�8qf�!b���s;�@���b�G�icWMv�>(p�7xɝ�#4��`\�.��h��G�2J)��?#K�������+��gEQ�m��$L��&R��K��p����]n v�$C�pa�0���4�g��0�@%����W!0sP�c;�r�;�JU$��O$Pԇ
g �]2�ˀz�e�0"IOp���"���422�pda�ݫ!����+�X��9��w�����YcA��M^Z�iO&}m�$-ْ��G'�O�
'�L7� ���45�`&1���%���\P3^���Ӈc��b[I&�,J� x���Kx9�.j���E3����d�m���a��R�n_#�9�X ��>��kH‡yݛ��K��VG C���0�5�B��3!�!+ �%2�M�
�D!��B�'1q�)cqrAO�[H9��d��0: <�C`#S�"$fB�����3����#��Q�e�Q��
+ǃZf�f��H6�z aG�;]�m�{v����M&!�Ua'i& ���K��!(-�,��(Z�����_����:�O
+�@m=�`��6������q�;����Zrb4OLJBp��d���/�� �� _r1��a����L%�3tk��
�� w �N-�Fyd+�� ���h�T8�!�3���=>�j�����<6��^H�3���Y'<���D�x��eե��C��A��zT�Ix*
+F�J`��
q���I-�0�>���3;�X��� �F\��S@�����R��N@��ᔌ�8b�&%�s�zd��I���&.Ŝ� 2���
+D��2��0�f
Wz�]K9���Ӭ��1�qF�@�+�L�DB}��H+�
�r h�"ID�U�Nٴ��a�\�@��3�e 帍�Lp��2��-[!���7P�?I���5��i^�j������hp�M�%A���jP� U*�\)�}�ؠ(G�!މ�ѥ�a�
+^��ט�
+ ���HS��L��O�4G)�@8�i䕄;�E�vrJT:ؐ�ga{� G�"��E��xTÞ)˔���(��ab��@�Yn鴁I�SA��0�:�A$'t��U��
+eE�(F��Ž$�`X��ne�� :�� �H!d���,�f��QBP��D���B�ã�%�U����B�&�=�F9�{Rш��{9D#�0KK�
+8(1T����s�H��"�����PF��\���Ȉ����HK�1q�RK��De�t�|= J1mp!ep
nÀ�2^�F����u/�J�0&'p��OF��1}!�@}Bn��4_�b��T�$��1Ƣ�qK���F�_J�
�`��3�d�k�1 �<9�`@E6�E�
8�}� w�@f�a�hb����>�����JT�����X���\0�ʓ�Y� �q�+��1�cQ�� Ƌl���X���v���ZC�ܜP�O�����J��۩��S�0 �&���y�e�*ڗ�}��+X8�� ��#z�iIH�(��d�ޠü�o�R�%*��������LzreP1zy �� �,���qB :�W<yZ�'���J�
+H��3�b2��B3Adž�S�̉�E��:�A)��D���۝��8���7,&W sCmZo��ah����q����aC���{����H;�eAI�E(
|!ETDUa�;���m���-��9���#ɔ3��mp�Y-cL�6i��¡�VT�����" �dB�YK$��Im2��������۰ �P''�G��(a��Fψq��N@k[���B0b�%c�~� ���Q��H��������DwS U��>rN49�(=N#k��8�C0�jM�0 1Jx�|�c�� I�:YԤ��w�HH���U���I���2Z����U��ت��3\F���or��� c�
.Dxe)h��5�ZRFM+`]A��w�� =�e(��5�psBk�Xy%��P1 ���q���Udf7������1���dG%�n-cm#l�ך�"��
�Q��G��� ƽ�BHG~�nqY�a��V��!���Mc��,��m��S1�n&G1��%�0�C3 ��F:��@6�`*��ݎn�A�>f��⦿�V2<�^8�*��:]��0P)ww�ER��"�%�
�Ukm��k�t�3v#� �7�nI
^�� t��ϑ{�e��o�v=����;?�+1�kDq�����0Gڃ�ٺ>]��6�kW�w�l��to��ɗ�BK��.�%��M�������\� �C�݃��72�~S}g��Ӵ5����<��Ӟ�����G�]}����n���� ��� �jw����L���^�b65"���"wI"�$h�H�7KZ�㭨�����:��s �5m�������Nl�<���P��fz
+}��)�"E�S�)�%<z����D�Ty�> g��jo�7F��ṭ��v���'&�
+D��U2�%�%�$��9/� Ƀ�{N��3���G!������#%���ҷ�֏��F4�fu�qB^�!
+M���S��0�ϓ�� &U ȥ�@�{N�<�c�Ց�����&!1AQaq�����������?ښ�i 2�/j ���|O*�*2����*�u��C^��r\w��y��n�ن���}F/ �����퉙/�O��5&�
](�\������0���w�S�؏7��d���)n�m�7>�؇
��{ b���Bk����#�c�ʸ<|7�G� x�oSY��wфM��Z�7��+̩��ťQ��A��r�n�IJ�=��lN�{��^��<}��a������l9��)筋�Ba:c�~V:5�$�Lo�\�Ԗ\�3Q��SH�(w����EF9��q��=��yNmM���UDގ�]V`�U2�ܨr����G������GT6��旀y�8$>V�\ۤÌJ�#��iNE���o���&�j���GȘpj4?�d�"?�u��z.�i�0���rx���"���ǃ6�_M�a���e�wdL�192���� >)M�c���?F��B_6+u�x��F0�9��=��Ho�����pg�V4�
e�����7v���ێ�Š�s��Dc�">P�ڣ�<���_�;��t�`;S��33��~٭�c�EX�nC��m'0~���,�ډ���
룷��FGC5>�[s{��4;�'.K#��|��NQ5��_T�U$�^��{�t7L�?�-3�H�'���᥿!G���� �I�Ze]�N���F2
+Rh��msCF��ff�)o?�
踂c���o>}1ɐлtID�XΗ`s*ٚQ�)���{kω{��F�y�a�d
=V6�4�/��c�x�A���i��-v��=
+�=r""�"dAn`���3�s`�͇��n{�\�*��G�d&[,������vYI$v+3���0pԁ7*�����w~�J���U�:"��sxA�vK�n��9WЉ���S�zN;�SM�oû�˖��G!��K�
N�sv�v�)a���D�+ɗE�(���������v�V?��{V����
'ƌ>́
t�к��Ktn�e� ��~#�&V�dA��@����aբ���A�{}�pn��c��%���\�$��z04����� h���_���x��H���0�$y�Ã���`�a/ΜЍˆ��.��{� }�~�����d�6(�5X���7(08L�5 w�����~1�ܹ�L�P����ּ ��I�!қyg�*������� �����{����F�5R 巫�6-g�㧼�cþşDK�=�؉F�^���0�> �ʿ�_���:�JX��CT��'��0W� ��~V��!�n*�}x͊�:�kd�����ч'���z���F?��r"ٍъ<��V�2/{������0��n�V�ZO� �� ����xnPW�f �s�N�4��s�"��n��;t]4բgU��DWB1����d|{
+��~���x��@��$�Q�4
3g.��c:��oa��A����c _��"Ӱc:���M7߲f�p���^O�*Sː��-B�\��8���W+_&�:Y1B~H�\�%�4apj�Fy�VK���rN�.��'� נ����r�c�M��%�8�о��Z���Kj&��yʈ5uU�V"����oj�a��䬖�</E�~1�g���S�isY�l�"��/5G������yu�LU6�}KJI�_O����f|z �V���� ���U:���8k���sy ����J�_8L�]R択 ��:���W��f���Nb&��0g���1ul:� N
+)0���mti����t��R!��S�� �[�*3O �������[j�[f�{�Q��Ըv(��k�>�Lv)z�D5՘��U��r��Z�*+'�+����Lo &�4�"�����>rAŷd�iȔ��Ӷ�O�Vd�� �}m��e�p7���1���%
+��K�ٺ(�]H�F��d�BxQ�%��JEՏ$��?�lO�I�`�{�1ndJ����&�<�
Z���T�~I濍&2�uF�h�;����p"�T�?`�_��t��l�/����>>j*���I�
++���J7y�]y�����]��R��WE~@:�����[YA��������A���tG�؞�R@��j�rA�ͽ_g7�J��H��Jj��Dڶ6z��6�,S��*��ato*0���Y� z0ٮ��a�g��8c��$�����>��>�M��R6�]ca�۰8���vTL��C���N��l�'�v+D����9�
+��_��BWl�n�5�0��?�p (�x�cw9+�����x>F�}0� ��������j��)
9D��j}}01v��Q�����a�U���W4?+���&,�wa��j��qnL���U�\�3���yV)#j�:D��B�߇}880V�u��u�@2���� 챧��
y��%{�luQ7j&xE$���
�L�e��p�_6'>���
6hx�-���_�{�1�O�+�cbMeڗ ����d�����Ⱥռ_�Q3혭k�����(��S*tt|���+\�@���B�eK��)`fƙ�P��!�Т��A�jo8��:��{
�� ������ݥA����0����f�6
�hɋ�v��Û�MT:��=~jc3���`�mݖxhp?��SLb+��"!h`�D#���S~� ��q��I��Y��/��(=�����2O����g�靶��Z:���~Ϻg�d�8�xi;Y����ӎX�7+=Q�d
�RЛ�Mq��^:�>9����2X��������F���(@L�XOq`}k=�jAH߻1��߻/�Jw�q�=��-�5.�@��f:��/X����L$LA����a�b�Lh2� ��*��K�&gǠ�����vB<�v�K<[�ɰ3�q���kӸ`jϛG��%uY-�1,0�ׯ��*[��aVc��'v+�A��C=49���ڞjQ��z<(������I� i���<�s@���K�3_&��Hcb��A�ч�Z�� E$���Ǥ�Q��{{2�֍֗;��_���2O��?��U7B5��JP���k�֍�LM�����Da�7�?�vd��~ڛ�2���n�Z���s��ʁ��7
+Bэ�W�l�70��#u��`|��ƙ�`ν��_r�j�����Sctb�;�鸙y��r߰��� I����4�B�F9^�y�������>�W5�
/�4��k��U�7fػ��x\��aݺ1࿮�N�F"=����I(��ƜިӅ+i��� �_����<.�C3��5~�d�L�dz~{��Y��(B�Ꮲ�#��V���ؤ��9�'|~�e
^.�j�>�ݲ�L�F�����FZ��R�{+l��-�B��J�3�8g�i�:q�?��{�k�-��l�*����ۻ�,|���\L�8����^E�{���޸`������ŧj'���c�W���#n�>���1�r�M��5y�io�ju7SSk���/ �<� o�7���y*��d��}2��f�o˽.E �
+s�>
+�z.� �^��d+?@ɠ��x��ؙα�&������qƙHIӕo�"���bO�kvW���3��6;��n&��G�dž�����k�����K2� ��oWaD.eϯ��S����ݐ�X���a΁�u��Z)&���"�i[�#L E"fs����0��.C�Λ��6�HR[ ��DǼy��uv��]�B�294����A���v�ٟϯs�5��Į�!��F���D�|KmDdt3S�ء���>���U�X5-��h{�>V�Ù?�����:n2�����z� B1W\���3>= 1T�^͏X��2e[������Xi��q=���t��F�ߢ1�PB4O�8J�0��S��ƕU�G��_��,�̅B͈A�A�bJ��
R?_� pf�%�"Ӱ�[�M�N쁲�f 2OK����=���3������H��&!1AQaq�����������?�x��:���(�T��-%�R87@ctD�@�4�9�)���PIP2��8E0ȁ�f ����
+�I�H�E�o�v|z�o�#D��%t�Bf@$I8G2�_@:���(�}�ܤ0��xd���~G�~�ҁA��%i���rW=l�F�|�Ysa3_3�D��(y�P.�$�#����B��E����h�n��N�a+��S�9/ܹ+��7TY49Q)vM�A�y�X�E��e�c"=����U-d��(!ם��4��Y'r��s��C���%
+��>T�=P�.�僫�w3��טƝI#8bn����*z{_��tUL��a�+�G8B�ȝ1�*O�lzv0���]>�c�N<u3��g��J`�+dy�S䢇Nu v�}
�iO��Vn�tH���E+t5��J�@E>&f���:"�g� T@X��@UP��Ԕ��A��dRAD ����r��05Е()]�bH�8S!�U��� �U&6<�S���wᣤ�%*K>3y�(՟ZBR0��8��S%p$�j�^�iB�Uc����~�[���'�JPԱ"��JP� �� ҳ�\1l�NY��A$�(p@\AV �n, �y��l�K���ۀ��<Ȧ����NDd�\!fx��זO���S�;��u7��ۍ3�.��[Q[�Ծ0�%�
+k7��!73���j��j+_o���T Ѐ�*��k�$�� HU&Ix@%I��*Nb��?�ȒP^J�����r�8�x2_�kڑ�����_t���h-����ݡC
+�8w�/���j��=c��J
]��xq�������6r��]^*�d�P�p���S�2ZJj���ċ��}�2[��JF��oYc���š���P�D� �9B�_�K~Ǔ���P���=�N~�����ϊ[X#�@*X �"�,Ą�8K��%��d&W������ �r��鵳&6I���� �wo+����ܺM�R�t�؊�B�::�d��� t�+���aT�x6�2��Ki��"�\x�i�r8���#�|pʾ���$T 0dÖ2Ѡ�r����Z]�0t�+��Fg�"��3�S�G{O����&���\�}C�W���o
�ֺ� ��\� VB��H���
+R`%0 @Ht
+�Aq0P �(S�T
+d�r(�G ��w�H��2�R�}-E{vX�=�)��S���T���e�!8�?�(}�U�9�.c���I��2��J�m�,�X�I>V�)[���%I%O��\�� �_��Y+^ѩ�p.k;� |J����A%�_X�<��O#E�c����H�_]��[�f\g8C��oST֫$V�/k��X��BC$CA"8�?Q�fm�Ŕ��K� �EHG]&Q�����Y��!B�HA2� 1xBY��L,p�(+W�V���PC5O��Ɲ��l]z�D�t)O��IQ���< ;i~�4
�@��Í����B1'|iA�H��B˽�F'M9^4b�����v���0���4�E�� �?a���0�p~����j&%�I� hP�U����t�����,PMԅ@@� "#�|�0DR��~Q�@��2�hN��f�P����/p����t��j\�x��M=rq!�HO�hy���.��E�k˝I���8?���������Ь�q���>,(ی�Â<�Y���jb�؜7 @��FJ�}����W�RK����&r��L�u�U�/�UC�gsC8�G�D�foL�O�,������Kv��I*��J5�%Z��� ��0F-aR�zne���(<�m��G�ioLty����h���b l�&��e�`��0���9#�[>QNO��K�8W�a�Y����/Ŏ4�yL���9��/W�Ewx{���J �\ء$�h�}��z+�4a,�ZIIh�쬼�����m&����3 E�էԍ@��*zK� ���4K/w�O����sN+p�����;3ƅF���d~x4W���U�B �)d�}p�4��~D�����?{��=Ji��S��Z`�r�- ����(���)$�1���4��A�!���Q@����՗�>'�8<`6i<S��8�Ɋ7F�m��x���
+U|+V_��U�c�2n�c���Q��d��K�����F֌�yKm8s�3�\.�h_~�x��%���P|�al ���L �:y�|o�JR?N�.}D�?s��1(�T{��2�팟�� �~ ʌ�� R� X6d��(�@�
+4&%�"Q�!U�0�.u֚rQ�Z�K�
+T�������i�)��"�~Q
+�
c3-L�Y�7Şu��xƸtGx��< ��<�x=]��Υ�])����F%��7�2�[>_�T�U��W������R�N4Q��� ޣ�j,�H`f�]�Lӊ���"��ģ?8䴗��g���I�9$��I$��.ï��^��/�a��#$[bKvM�������!��k��8~�+�[k�}`z�v����p{OI��Q�})FϿ�����~-��)�a:M��9���x�kg�qH�]���������7Y'T��{Ȣ9̤�e��7�B��ҩx�q���!(I�y����c��)���LB ,�f�iRxp!SK����vU���)N\}c��-����a_�����
+��dv�q��r�o1�V}�F�*M�+{y�`ht��) Ǻ���#��؞$%��Z�G�{�F@�F��3�����N~vv��h���0*T��A@�]h��pyX�0��+3b<ˤH奚��&h�V�����J[�ǫN<�c���_�/l�Q��4%0(������kջ�o{���"E���$��8��lc��7�;�G�y�c�o�x��O0K�*A&�T�!R�{9�+�H5&��mwX�g:f!��ǺJ���9�ZKH�\2�J��moy��S�o�*u����7�@Ty�$��~���^�����S���gv|�� %rL�C��+i��ׇ�LLԟc�l ��~���C:]�,�s1��C<7�̩}������RFe.j�)��U{��Zq�o752�*_��zޑT�5���+@.��\v�>��3'��ϊ��Z�W�}��6w��$�
+nT,J+�^
c;l��hEն���O�b�~R:�\g�I_�j�
+��c��9Q9�]��) "��AGz���#��@B�JP-�_����v��pr7�G�pv�f��!�v�/��������y���3Y:��y��ثG{��r�p�9���b��t���^��H�l�y`/2-ˡ�gf\���� �ʅi�Ӹ�G��*�ۃ�V'y�}�c���Y�S�B���
+�/b(j
@ ��.omfz}D���V�����w �(�z[��6�K�f��(5N��.,9/�a� �!y,�����/��H�-| jL㠺�(�2�]0��%���� �r�;Õ����=0��Z�j�ۗqI?��$uW���c���t�XJT��'Sjʂ<�ٖ����T�;�+Z*=��="C�Ͷ����eڝ$�����_��B*~t���f��-��
+B ��
@��r9��@����c�cG��P�?�1�_�Nm*‰���j���j������ ����N7�=���������'|r\`��'��5/�������ci������C��|{FHz=P�O�J:%Z� G �,�f�8;�'�쑱�?�F}���Ӻ�m��2�S�;�gș�>�^�FaRS�0��2��نȆ5~j���Z�4qz=
+6-�5�� �9��G�"cv|��£�گ��ґP�Zn��N<���h�d��l;G��;�s!�L��ϋ�f;��џw��E�۽�F�������(��oHښ�kGU +v:�V�W9ux�U��XRԭ�AGc��5tY4]עC�)�ya
��}e���$�THK��񲈼�=#;c �O:�\��-%��H���c�`�)�R�y�8\���gY�o���)�����/�JQ1}�4nn��������Rx�*I5�]�BrQG����q����jy/ă���W��t:-z�["��"�OZrQI���t���Q�;a:ci���x�Ye�M�Ѡp4���ZT�M�_�.?�Q��hg ��N�"b��,����C
��SQ�=��5��ZN�����T%(�F��P�s��s��Ӓ��Y��%���O�;���ӧ�22m1��(�S�N���/&3t���^H'���k� 3j�=�%H-��*b��4$h��{�P�����04�5]+�@
+eZ��`� Ep��|Ű>B3O�V�*R}��4� �ӧv���܋�1)��� ��N2�`�Lg� �U�x�9�ȏ��&!1AQaq�����������?`̞�4��4/�OܼW�9$� r��j�+
+���=��I7��J�u�s� �h�� 8�D�^a,)`@����R��F!��PB� �]B8Q�B�+2C�=.A��P1
I�#��>҂����X�K���>��8��2�Q���"��E�,���.� �]ŧ��g/�9A"Oa, J�R���I�����JHq}r��L8F�ġ�W�Gl3qM��mgƪ��u!a��Re P��ώ��*�,'o�P��`_�
HP�2�!Y 0���E]V%D�2�T��)���W8�F*� ��!�����LF�y g:�A��
���g�-�
j�����p�X F��D0U ���Ƒ"Jr�
+��ZR7��!R�ĪA@��$�Y
+ӝܚ2 X� *�`zKA��Xeii���`���Ӂr5�?�|��=x�m���j����iDcJ�����Ru�/�"���/�.���A�=-s���օ��A�u%lx!*!+�
p� �o��|�Q!d�S���i$`D.Ă �<�aLr�C$ᐝs�U/[DH�9-�N�c1��O> `�](j� �
+E\��a�� @V�C�S�К���>� A�:�hNP�P&�'89A�����-qT��3DF��8"����;��6�|������@ t�2D24����$�M������������5bK�/2rTt���BA)CjTd�I�6H$����Pa��($c @: ���!0A�dSB�+!�,D���8آ�/l���#��B�Yg��U
+��F
�i��t\���K��@* $D� � 3H�h�h�I��jr@7�@��L؞��@Ɖ� ː_��A�b *��B{��)c���M��Лo!o��ur`bǁڠ ����:�Oa1��m�y���X����']*}��C������mV��_�ߚ:�1�GT��lH�ńjIc
��#��fQE��X��P68��y3���X� b�k��Na���;6Q� 3ŭ����GZ���XDЮ�4���� ���Xv��%[_�����~�Ri�'��r :��w��(��T1XDېI�h�J`�"� x�#څ��Q���(v�RO����b%��rҤ_�~hrD��*5=���u�(@���/E�K �Q��N�C�*F ���V:��P9ł�8@~����"O��U�@`���wX� :���X/
Pi"�����ɮ���"�E���L�8B�["�LQ�WM�0�Y�*��� R* ��S���6
+l�A}K�R@��������^�w�An+�* �\ih,P��KZ�آ�l+�o C($'h���]z,+{�d)�R�����I����O�-�B\�����w��"M����4.��Z�Dho�y}x^I�R�g��k(w��i%�\�U䱤�
.d$ !X
+5��C�^R@ӂzY4)l'�oxA`J��,Q��R�R�o�j�>E���+cha�5"�n���&�
+�a�}�XVJW��(�n�jE
�M�:eJxp�\P���D=c�%tR~�uEI@�o����J��R�q�AL��Dx@�+O�1&J�1�?�POX$K�C:�0�
+ JZ��p�Ϡ�PQ@Y�����rh`;�AG+��2�~ �4p��PC�g6��j3���:M@ �������L���d����K.�Ԧ��`/��f�6�?�����# ���X�]�1=$�y�蛥�X�����������5i�(�;h��L�T���Z��\�p�&�ȰS�[v�t�I��٭��B�Zn�6�A78����J�
+8_s��"�dN�*,�A�
+��. ��WA�V�F%H��c�#b�P$RaA�J^ ���IP��)XNX?�
��3,����8�0�h�I;�U�ћ����Z&��j��e��#��_*�t�؛��
),S���^�@�&��Ɂy�Hw0b=��XBB��9+�C'E��dÞ���!X�`{^Y�I�'�-��ۉ�D��|w����;���0&�xlQlB�sڈ�$�
{���тAS#���G�LL3)���m`Dz�d�HI�F�2�8+�M�������6b?ܸɖ`Q�+pJnG��b@�_�P
+��?ܧ%�0�Q��H zN��jKI��Y'����kYjN�@,���H5�z�Q��1�Sռ�'�/�#!1����UO/1~8�I�֨}��M �r��ND�?�@��gR/Urj`!��N��7#�( бBBL�����@��0�e��CB5i؛$AoM�a�/*0F:��JF|�}�ي^�֤���5��UA�E��v�f`
+��`�Nsi�d[O���X).�M��Gv\w,,@i����9L ��Q0�e��P���bAd���Z���D� ���N�Jj@fa���u����l� �]�ʴ�F��\�j�#��OP��<�>�ɯ=���� ��]b$6"�M(�к��jm(Y�EC0Yf b&���T�H3�C)H�3AbAU�V`
+��;��)�_h*,6N�eF��t]�N���� =�T(ւ���3�8�7�8 DP�JL�� �4I+� #��@q���9��Be$�;�{ $��:ؙ"$��/D8���ssq�I���z^ �׌V�(`p�hQ���g΄������dvjbUIZ!��V � B�`�#��.w�!���㾠ưa�M��@�4��8����eBV��e
+I �ϋ���Tm�A�a�����H~�'3- �Z�L���GyX��vCԠ��d�p��q��YkH��_b!8(l���p���AK����j��>h%@
+���@�L%��r&��
+i�q�}�.��f9� � ��c�j�y �@��gIp6���������"X&
+�zH�5�����%
�-
+X�X����(pXan�+�) a�J�B J��Ps0`Xk�A Z�
+��� J��Iv&����K�Vi��Z��ܦ��јB���HN����p?�Rp: ��ߵ���N�u�biC�J������A��C�P� �)J�e`X�;/eI$���J� ��+�"���
+�R��y=+XFlf^� y�ޤ�����۟
+�E����#X�"oIr��� AP��Co
+��%�! �!V=Ad
+Z�X��R��R�e��5���L�:u- �wg'/R2
��Vp|���DC����L�&�(�IFP'x� � ���
+�)�{�2� �g�]�����}�Z�h�T E����xew�jn^Q;Bb���� �o�A���Z���!"��2�����I��
3���y"���Ű�8t��hK �<נ6;��W䄠��%����$hO�E��̠���\� s�qhh���d�?�x�h�����e�$|1MQ����F�ۢ�C�=7�X� �X�*I�����"CA C���u&�i��@�N��LE�sқHRA�lTH0�/UL�N�]�J� Pb���.�����$\og�`!b=�ښ��
+��`���- ���1�Ј!s�����P��]B�Y�� kA�<��bDK�n&�Q:�Ɂ��bmSዢ�5(�d c�K@����@1�ؠH���gjT2`^A��hmF�9�x�y�IH�a��J�!�m���&7��0��_!�b@$;7�������O��'�Icu ƀ��*�� �D�"�B^� �J��FW����O���it��q6:pG6�7R�!
+]�C�+? Aa[V_,@�(-p�"����J�
�e-��@,�{CR�������_�
+�����PGJ Õ� D�^���(�D���͖�鼷�ph9��5{��I3��5g_�
+0��Y�Vg��\S�1N/�R�ٙϝ�v����=m(+�©9�������%ӿ�LV�ܔ�)�L7f�l {����-�'_ ��q"B��RzPX^k@��K�(Y@|v�k?":e`q���" 3�5�Z��P��h� �z ���Kg s3;�S+ �U|�]� � �h-�����͗���m��s�*�S�^�u�F�BpV�����Ov�Y��+ U�E�L.�
f�. PY��)���E�4�i��Y�$Z
�� �0��^��k0`�E�
\�J��=o{uSS��Y�`!���b@`�<)B�U�<��@e�pȜV@@6P�N�U���0�� At!�.R`f�9'�X�İo���OB$n�>5-v!�ÐlĴ�x*:$ꑴ"K�X��
+��s]��Hχ�4)A�2 n�\��ʨ
+0�^z�BS���^�xM�;�MG,��{Ѩ� �v�X#�fXԮ�O|�� Od�c�]T�Qۇ��/�TXi�AD��S̀�=<±!ˋ~]p�CN��B�$Uc�-g.�C|KY����d$���_ ��"p�9P�����c݈�0�`�a.Hܗ����tA�o���z@/�c�����hiC^��AÇ5�l�07ǚ�s�^a9 lt�&c����P' G��M��/$��T�v#��Y�p}�4=�nj��
7�5P�F z�@�U?����XR@~�B��lO�^K(��\kd��y�C�+��I��N�V�B������%
+�6T��k��`)�k�j���}�Ҫ t�u ��)Շ� ��Tf��,s��B,���f�����ţ�y[6��(�#hM�jkE� M�kE��/�\�alu�-X$_��\ ����r�_������X��
5u�97s��N�=X�;Y��$�1w(yB́lW�V�%@|xа2��:A�ˢ�o=—4�����^�d�1�K��� 9I��"�5E���6�;���f3.�26 Y��v|����7�B%�ڀ꺾xh�k�3)iPd�#,���l6\C�������=R��N�#�x9�Ă �:�3��l�eS�`.“���2 >��4E�d�P��t'
+v��ɲ�]0>�g�+��
\ Dosya sonunda yenisatır yok.
diff -Nuar flatpak-1.0.0.orig/bubblewrap/bwrap.xml flatpak-1.0.0/bubblewrap/bwrap.xml
--- flatpak-1.0.0.orig/bubblewrap/bwrap.xml 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/bwrap.xml 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,320 @@
+<?xml version="1.0"?>
+<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.3//EN"
+ "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" [
+]>
+<refentry id="bwrap">
+
+<refentryinfo>
+ <title>bwrap</title>
+ <productname>Project Atomic</productname>
+ <authorgroup>
+ <author>
+ <contrib>Developer</contrib>
+ <firstname>Alexander</firstname>
+ <surname>Larsson</surname>
+ </author>
+ <author>
+ <contrib>Developer</contrib>
+ <firstname>Colin</firstname>
+ <surname>Walters</surname>
+ </author>
+ </authorgroup>
+</refentryinfo>
+
+<refmeta>
+ <refentrytitle>bwrap</refentrytitle>
+ <manvolnum>1</manvolnum>
+ <refmiscinfo class="manual">User Commands</refmiscinfo>
+</refmeta>
+
+<refnamediv>
+ <refname>bwrap</refname>
+ <refpurpose>container setup utility</refpurpose>
+</refnamediv>
+
+<refsynopsisdiv>
+<cmdsynopsis>
+<command>bwrap</command>
+<arg choice="opt" rep="repeat"><replaceable>OPTION</replaceable></arg>
+<arg choice="opt"><replaceable>COMMAND</replaceable></arg>
+</cmdsynopsis>
+</refsynopsisdiv>
+
+<refsect1><title>Description</title>
+<para>
+ <command>bwrap</command> is a privileged helper for container setup. You
+ are unlikely to use it directly from the commandline, although that is possible.
+</para>
+<para>
+ It works by creating a new, completely empty, filesystem namespace where the root
+ is on a tmpfs that is invisible from the host, and which will be automatically
+ cleaned up when the last process exists. You can then use commandline options to
+ construct the root filesystem and process environment for the command to run in
+ the namespace.
+</para>
+<para>
+ By default, <command>bwrap</command> creates a new mount namespace for the sandbox.
+ Optionally it also sets up new user, ipc, pid, network and uts namespaces (but note the
+ user namespace is required if bwrap is not installed setuid root).
+ The application in the sandbox can be made to run with a different UID and GID.
+</para>
+<para>
+ If needed (e.g. when using a PID namespace) <command>bwrap</command>
+ is running a minimal pid 1 process in the sandbox that is
+ responsible for reaping zombies. It also detects when the initial
+ application process (pid 2) dies and reports its exit status back to
+ the original spawner. The pid 1 process exits to clean up the
+ sandbox when there are no other processes in the sandbox left.
+</para>
+</refsect1>
+
+<refsect1><title>Options</title>
+ <para>
+ When options are used multiple times, the last option wins, unless otherwise
+ specified.
+ </para>
+ <para>General options:</para>
+ <variablelist>
+ <varlistentry>
+ <term><option>--help</option></term>
+ <listitem><para>Print help and exit</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--version</option></term>
+ <listitem><para>Print version</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--args <arg choice="plain">FD</arg></option></term>
+ <listitem><para>
+ Parse nul-separated arguments from the given file descriptor.
+ This option can be used multiple times to parse options from
+ multiple sources.
+ </para></listitem>
+ </varlistentry>
+ </variablelist>
+ <para>Options related to kernel namespaces:</para>
+ <variablelist>
+ <varlistentry>
+ <term><option>--unshare-user</option></term>
+ <listitem><para>Create a new user namespace</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-user-try</option></term>
+ <listitem><para>Create a new user namespace if possible else skip it</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-ipc</option></term>
+ <listitem><para>Create a new ipc namespace</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-pid</option></term>
+ <listitem><para>Create a new pid namespace</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-net</option></term>
+ <listitem><para>Create a new network namespace</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-uts</option></term>
+ <listitem><para>Create a new uts namespace</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-cgroup</option></term>
+ <listitem><para>Create a new cgroup namespace</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-cgroup-try</option></term>
+ <listitem><para>Create a new cgroup namespace if possible else skip it</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unshare-all</option></term>
+ <listitem><para>Unshare all possible namespaces. Currently equivalent with: <option>--unshare-user-try</option> <option>--unshare-ipc</option> <option>--unshare-pid</option> <option>--unshare-net</option> <option>--unshare-uts</option> <option>--unshare-cgroup-try</option></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--uid <arg choice="plain">UID</arg></option></term>
+ <listitem><para>Use a custom user id in the sandbox (requires <option>--unshare-user</option>)</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--gid <arg choice="plain">GID</arg></option></term>
+ <listitem><para>Use a custom group id in the sandbox (requires <option>--unshare-user</option>)</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--hostname <arg choice="plain">HOSTNAME</arg></option></term>
+ <listitem><para>Use a custom hostname in the sandbox (requires <option>--unshare-uts</option>)</para></listitem>
+ </varlistentry>
+ </variablelist>
+ <para>Options about environment setup:</para>
+ <variablelist>
+ <varlistentry>
+ <term><option>--chdir <arg choice="plain">DIR</arg></option></term>
+ <listitem><para>Change directory to <arg choice="plain">DIR</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--setenv <arg choice="plain">VAR</arg> <arg choice="plain">VALUE</arg></option></term>
+ <listitem><para>Set an environment variable</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--unsetenv <arg choice="plain">VAR</arg></option></term>
+ <listitem><para>Unset an environment variable</para></listitem>
+ </varlistentry>
+ </variablelist>
+ <para>Options for monitoring the sandbox from the outside:</para>
+ <variablelist>
+ <varlistentry>
+ <term><option>--lock-file <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>
+ Take a lock on <arg choice="plain">DEST</arg> while the sandbox is running.
+ This option can be used multiple times to take locks on multiple files.
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--sync-fd <arg choice="plain">FD</arg></option></term>
+ <listitem><para>Keep this file descriptor open while the sandbox is running</para></listitem>
+ </varlistentry>
+ </variablelist>
+ <para>
+ Filesystem related options. These are all operations that modify the filesystem directly, or
+ mounts stuff in the filesystem. These are applied in the order they are given as arguments.
+ Any missing parent directories that are required to create a specified destination are
+ automatically created as needed.
+ </para>
+ <variablelist>
+ <varlistentry>
+ <term><option>--bind <arg choice="plain">SRC</arg> <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Bind mount the host path <arg choice="plain">SRC</arg> on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--dev-bind <arg choice="plain">SRC</arg> <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Bind mount the host path <arg choice="plain">SRC</arg> on <arg choice="plain">DEST</arg>, allowing device access</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--ro-bind <arg choice="plain">SRC</arg> <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Bind mount the host path <arg choice="plain">SRC</arg> readonly on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--remount-ro <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Remount the path <arg choice="plain">DEST</arg> as readonly. It works only on the specified mount point, without changing any other mount point under the specified path</para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--proc <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Mount procfs on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--dev <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Mount new devtmpfs on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--tmpfs <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Mount new tmpfs on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--mqueue <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Mount new mqueue on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--dir <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Create a directory at <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--file <arg choice="plain">FD</arg> <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Copy from the file descriptor <arg choice="plain">FD</arg> to <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--bind-data <arg choice="plain">FD</arg> <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Copy from the file descriptor <arg choice="plain">FD</arg> to a file which is bind-mounted on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--ro-bind-data <arg choice="plain">FD</arg> <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Copy from the file descriptor <arg choice="plain">FD</arg> to a file which is bind-mounted readonly on <arg choice="plain">DEST</arg></para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--symlink <arg choice="plain">SRC</arg> <arg choice="plain">DEST</arg></option></term>
+ <listitem><para>Create a symlink at <arg choice="plain">DEST</arg> with target <arg choice="plain">SRC</arg></para></listitem>
+ </varlistentry>
+ </variablelist>
+ <para>Lockdown options:</para>
+ <variablelist>
+ <varlistentry>
+ <term><option>--seccomp <arg choice="plain">FD</arg></option></term>
+ <listitem><para>
+ Load and use seccomp rules from <arg choice="plain">FD</arg>.
+ The rules need to be in the form of a compiled eBPF program,
+ as generated by seccomp_export_bpf.
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--exec-label <arg choice="plain">LABEL</arg></option></term>
+ <listitem><para>
+ Exec Label from the sandbox. On an SELinux system you can specify the SELinux
+ context for the sandbox process(s).
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--file-label <arg choice="plain">LABEL</arg></option></term>
+ <listitem><para>
+ File label for temporary sandbox content. On an SELinux system you can specify
+ the SELinux context for the sandbox content.
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--block-fd <arg choice="plain">FD</arg></option></term>
+ <listitem><para>
+ Block the sandbox on reading from FD until some data is available.
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--info-fd <arg choice="plain">FD</arg></option></term>
+ <listitem><para>
+ Write information in JSON format about the sandbox to FD.
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--new-session</option></term>
+ <listitem><para>
+ Create a new terminal session for the sandbox (calls setsid()). This
+ disconnects the sandbox from the controlling terminal which means
+ the sandbox can't for instance inject input into the terminal.
+ </para><para>
+ Note: In a general sandbox, if you don't use --new-session, it is
+ recommended to use seccomp to disallow the TIOCSTI ioctl, otherwise
+ the application can feed keyboard input to the terminal.
+ </para></listitem>
+ </varlistentry>
+ <varlistentry>
+ <term><option>--die-with-parent</option></term>
+ <listitem><para>
+ Ensures child process (COMMAND) dies when bwrap's parent dies. Kills (SIGKILL)
+ all bwrap sandbox processes in sequence from parent to child
+ including COMMAND process when bwrap or bwrap's parent dies.
+ See prctl, PR_SET_PDEATHSIG.
+ </para></listitem>
+ </varlistentry>
+ </variablelist>
+</refsect1>
+
+<refsect1>
+ <title>Environment</title>
+
+ <variablelist>
+ <varlistentry>
+ <term><envar>HOME</envar></term>
+ <listitem><para>
+ Used as the cwd in the sandbox if <option>--cwd</option> has not been
+ explicitly specified and the current cwd is not present inside the sandbox.
+ The <option>--setenv</option> option can be used to override the value
+ that is used here.
+ </para></listitem>
+ </varlistentry>
+ </variablelist>
+</refsect1>
+
+<refsect1>
+ <title>Exit status</title>
+
+ <para>
+ The <command>bwrap</command> command returns the exit status of the
+ initial application process (pid 2 in the sandbox).
+ </para>
+</refsect1>
+
+</refentry>
diff -Nuar flatpak-1.0.0.orig/bubblewrap/ci/redhat-ci.sh flatpak-1.0.0/bubblewrap/ci/redhat-ci.sh
--- flatpak-1.0.0.orig/bubblewrap/ci/redhat-ci.sh 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/ci/redhat-ci.sh 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+distro=$1
+
+runcontainer() {
+ docker run --rm --env=container=true --env=BWRAP_SUID=${BWRAP_SUID:-} --env CFLAGS="${CFLAGS:-}" --net=host --privileged -v /usr:/host/usr -v $(pwd):/srv/code -w /srv/code $distro ./ci/redhat-ci.sh $distro
+}
+
+buildinstall_to_host() {
+
+ yum -y install git autoconf automake libtool make gcc redhat-rpm-config \
+ libcap-devel 'pkgconfig(libselinux)' 'libxslt' 'docbook-style-xsl' \
+ lib{a,ub,t}san /usr/bin/eu-readelf
+
+ echo testing: $(git describe --tags --always --abbrev=42)
+
+ env NOCONFIGURE=1 ./autogen.sh
+ ./configure --prefix=/usr --libdir=/usr/lib64
+ make -j 8
+ tmpd=$(mktemp -d)
+ make install DESTDIR=${tmpd}
+ for san in a t ub; do
+ if eu-readelf -d ${tmpd}/usr/bin/bwrap | grep -q "NEEDED.*lib${san}san"; then
+ for x in /usr/lib64/lib${san}san*.so.*; do
+ install -D $x ${tmpd}${x}
+ done
+ fi
+ done
+ rsync -rlv ${tmpd}/usr/ /host/usr/
+ if ${BWRAP_SUID}; then
+ chmod u+s /host/usr/bin/bwrap
+ fi
+ rm ${tmpd} -rf
+}
+
+if test -z "${container:-}"; then
+ ostree admin unlock
+ # Hack until the host tree is updated in rhci
+ rpm -Uvh https://kojipkgs.fedoraproject.org//packages/glibc/2.24/4.fc25/x86_64/{libcrypt-nss,glibc,glibc-common,glibc-all-langpacks}-2.24-4.fc25.x86_64.rpm
+ useradd bwrap-tester
+ runcontainer
+ runuser -u bwrap-tester env ASAN_OPTIONS=detect_leaks=false ./tests/test-run.sh
+else
+ buildinstall_to_host
+fi
diff -Nuar flatpak-1.0.0.orig/bubblewrap/completions/bash/bwrap flatpak-1.0.0/bubblewrap/completions/bash/bwrap
--- flatpak-1.0.0.orig/bubblewrap/completions/bash/bwrap 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/completions/bash/bwrap 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,60 @@
+#!/bin/bash
+#
+# bash completion file for bubblewrap commands
+#
+
+_bwrap() {
+ local cur prev words cword
+ _init_completion || return
+
+ local boolean_options="
+ --help
+ --unshare-cgroup
+ --unshare-cgroup-try
+ --unshare-user
+ --unshare-user-try
+ --unshare-ipc
+ --unshare-net
+ --unshare-pid
+ --unshare-uts
+ --version
+ "
+
+ local options_with_args="
+ $boolean_optons
+ --args
+ --bind
+ --bind-data
+ --block-fd
+ --chdir
+ --dev
+ --dev-bind
+ --dir
+ --exec-label
+ --file
+ --file-label
+ --gid
+ --hostname
+ --info-fd
+ --lock-file
+ --proc
+ --ro-bind
+ --remount-ro
+ --seccomp
+ --setenv
+ --symlink
+ --sync-fd
+ --uid
+ --unsetenv
+ --seccomp
+ --symlink
+ --die-with-parent
+ "
+
+ if [[ "$cur" == -* ]]; then
+ COMPREPLY=( $( compgen -W "$boolean_options $options_with_args" -- "$cur" ) )
+ fi
+
+ return 0
+}
+complete -F _bwrap bwrap
diff -Nuar flatpak-1.0.0.orig/bubblewrap/configure.ac flatpak-1.0.0/bubblewrap/configure.ac
--- flatpak-1.0.0.orig/bubblewrap/configure.ac 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/configure.ac 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,127 @@
+AC_PREREQ([2.63])
+AC_INIT([bubblewrap], [0.1.8], [atomic-devel@projectatomic.io])
+AC_CONFIG_HEADER([config.h])
+AC_CONFIG_MACRO_DIR([m4])
+AC_CONFIG_AUX_DIR([build-aux])
+
+AC_USE_SYSTEM_EXTENSIONS
+
+AM_INIT_AUTOMAKE([1.11 -Wno-portability foreign no-define tar-ustar no-dist-gzip dist-xz])
+AM_MAINTAINER_MODE([enable])
+AM_SILENT_RULES([yes])
+
+AC_SYS_LARGEFILE
+
+AC_PROG_CC
+AM_PROG_CC_C_O
+
+AC_CHECK_HEADERS([sys/capability.h], [], [AC_MSG_ERROR([*** POSIX caps headers not found])])
+
+AC_ARG_ENABLE(man,
+ [AS_HELP_STRING([--enable-man],
+ [generate man pages [default=auto]])],,
+ enable_man=maybe)
+
+AS_IF([test "$enable_man" != no], [
+ AC_PATH_PROG([XSLTPROC], [xsltproc], [])
+ AS_IF([test -z "$XSLTPROC"], [
+ AS_IF([test "$enable_man" = yes], [
+ AC_MSG_ERROR([xsltproc is required for --enable-man])
+ ])
+ enable_man=no
+ ], [
+ enable_man=yes
+ ])
+])
+AM_CONDITIONAL(ENABLE_MAN, test "$enable_man" != no)
+
+AC_ARG_WITH([bash-completion-dir],
+ AS_HELP_STRING([--with-bash-completion-dir[=PATH]],
+ [Install the bash auto-completion script in this directory. @<:@default=yes@:>@]),
+ [],
+ [with_bash_completion_dir=yes])
+
+if test "x$with_bash_completion_dir" = "xyes"; then
+ PKG_CHECK_MODULES([BASH_COMPLETION], [bash-completion >= 2.0],
+ [BASH_COMPLETION_DIR="`pkg-config --variable=completionsdir bash-completion`"],
+ [BASH_COMPLETION_DIR="$datadir/bash-completion/completions"])
+else
+ BASH_COMPLETION_DIR="$with_bash_completion_dir"
+fi
+
+AC_SUBST([BASH_COMPLETION_DIR])
+AM_CONDITIONAL([ENABLE_BASH_COMPLETION],[test "x$with_bash_completion_dir" != "xno"])
+# ------------------------------------------------------------------------------
+have_selinux=no
+AC_ARG_ENABLE(selinux, AS_HELP_STRING([--disable-selinux], [Disable optional SELINUX support]))
+if test "x$enable_selinux" != "xno"; then
+ PKG_CHECK_MODULES([SELINUX], [libselinux >= 2.1.9],
+ [AC_DEFINE(HAVE_SELINUX, 1, [Define if SELinux is available])
+ have_selinux=yes
+ M4_DEFINES="$M4_DEFINES -DHAVE_SELINUX"],
+ [have_selinux=no])
+ if test "x$have_selinux" = xno -a "x$enable_selinux" = xyes; then
+ AC_MSG_ERROR([*** SELinux support requested but libraries not found])
+ fi
+fi
+AM_CONDITIONAL(HAVE_SELINUX, [test "$have_selinux" = "yes"])
+
+dnl Keep this in sync with ostree, except remove -Werror=declaration-after-statement
+CC_CHECK_FLAGS_APPEND([WARN_CFLAGS], [CFLAGS], [\
+ -pipe \
+ -Wall \
+ -Werror=empty-body \
+ -Werror=strict-prototypes \
+ -Werror=missing-prototypes \
+ -Werror=implicit-function-declaration \
+ "-Werror=format=2 -Werror=format-security -Werror=format-nonliteral" \
+ -Werror=pointer-arith -Werror=init-self \
+ -Werror=missing-declarations \
+ -Werror=return-type \
+ -Werror=overflow \
+ -Werror=int-conversion \
+ -Werror=parenthesis \
+ -Werror=incompatible-pointer-types \
+ -Werror=misleading-indentation \
+ -Werror=missing-include-dirs -Werror=aggregate-return \
+])
+AC_SUBST(WARN_CFLAGS)
+
+AC_ARG_WITH(priv-mode,
+ AS_HELP_STRING([--with-priv-mode=setuid/none],
+ [How to set privilege-raising during make install]),
+ [],
+ [with_priv_mode="none"])
+
+AM_CONDITIONAL(PRIV_MODE_SETUID, test "x$with_priv_mode" = "xsetuid")
+
+AC_ARG_ENABLE(sudo,
+ AS_HELP_STRING([--enable-sudo],[Use sudo to set privileged mode on binaries during install (only needed if --with-priv-mode used)]),
+ [SUDO_BIN="sudo"], [SUDO_BIN=""])
+AC_SUBST([SUDO_BIN])
+
+AC_ARG_ENABLE(require-userns,
+ AS_HELP_STRING([--enable-require-userns=yes/no (default no)],
+ [Require user namespaces by default when installed suid]),
+ [],
+ [enable_require_userns="no"])
+
+AS_IF([ test "x$enable_require_userns" = "xyes" ], [
+ AC_DEFINE(ENABLE_REQUIRE_USERNS, 1, [Define if userns should be used by default in suid mode])
+ ])
+
+AC_CONFIG_FILES([
+Makefile
+])
+AC_OUTPUT
+
+echo "
+ bubblewrap $VERSION
+ ===================
+
+ man pages (xsltproc): $enable_man
+ SELinux: $have_selinux
+ setuid mode on make install: $with_priv_mode
+ require default userns: $enable_require_userns
+ mysteriously satisfying to pop: yes"
+echo ""
diff -Nuar flatpak-1.0.0.orig/bubblewrap/COPYING flatpak-1.0.0/bubblewrap/COPYING
--- flatpak-1.0.0.orig/bubblewrap/COPYING 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/COPYING 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,481 @@
+ GNU LIBRARY GENERAL PUBLIC LICENSE
+ Version 2, June 1991
+
+ Copyright (C) 1991 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the library GPL. It is
+ numbered 2 because it goes with version 2 of the ordinary GPL.]
+
+ Preamble
+
+ The licenses for most software are designed to take away your
+freedom to share and change it. By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+ This license, the Library General Public License, applies to some
+specially designated Free Software Foundation software, and to any
+other libraries whose authors decide to use it. You can use it for
+your libraries, too.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+ To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if
+you distribute copies of the library, or if you modify it.
+
+ For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you. You must make sure that they, too, receive or can get the source
+code. If you link a program with the library, you must provide
+complete object files to the recipients so that they can relink them
+with the library, after making changes to the library and recompiling
+it. And you must show them these terms so they know their rights.
+
+ Our method of protecting your rights has two steps: (1) copyright
+the library, and (2) offer you this license which gives you legal
+permission to copy, distribute and/or modify the library.
+
+ Also, for each distributor's protection, we want to make certain
+that everyone understands that there is no warranty for this free
+library. If the library is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original
+version, so that any problems introduced by others will not reflect on
+the original authors' reputations.
+
+ Finally, any free program is threatened constantly by software
+patents. We wish to avoid the danger that companies distributing free
+software will individually obtain patent licenses, thus in effect
+transforming the program into proprietary software. To prevent this,
+we have made it clear that any patent must be licensed for everyone's
+free use or not licensed at all.
+
+ Most GNU software, including some libraries, is covered by the ordinary
+GNU General Public License, which was designed for utility programs. This
+license, the GNU Library General Public License, applies to certain
+designated libraries. This license is quite different from the ordinary
+one; be sure to read it in full, and don't assume that anything in it is
+the same as in the ordinary license.
+
+ The reason we have a separate public license for some libraries is that
+they blur the distinction we usually make between modifying or adding to a
+program and simply using it. Linking a program with a library, without
+changing the library, is in some sense simply using the library, and is
+analogous to running a utility program or application program. However, in
+a textual and legal sense, the linked executable is a combined work, a
+derivative of the original library, and the ordinary General Public License
+treats it as such.
+
+ Because of this blurred distinction, using the ordinary General
+Public License for libraries did not effectively promote software
+sharing, because most developers did not use the libraries. We
+concluded that weaker conditions might promote sharing better.
+
+ However, unrestricted linking of non-free programs would deprive the
+users of those programs of all benefit from the free status of the
+libraries themselves. This Library General Public License is intended to
+permit developers of non-free programs to use free libraries, while
+preserving your freedom as a user of such programs to change the free
+libraries that are incorporated in them. (We have not seen how to achieve
+this as regards changes in header files, but we have achieved it as regards
+changes in the actual functions of the Library.) The hope is that this
+will lead to faster development of free libraries.
+
+ The precise terms and conditions for copying, distribution and
+modification follow. Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library". The
+former contains code derived from the library, while the latter only
+works together with the library.
+
+ Note that it is possible for a library to be covered by the ordinary
+General Public License rather than by this special one.
+
+ GNU LIBRARY GENERAL PUBLIC LICENSE
+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+ 0. This License Agreement applies to any software library which
+contains a notice placed by the copyright holder or other authorized
+party saying it may be distributed under the terms of this Library
+General Public License (also called "this License"). Each licensee is
+addressed as "you".
+
+ A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+ The "Library", below, refers to any such software library or work
+which has been distributed under these terms. A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language. (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+ "Source code" for a work means the preferred form of the work for
+making modifications to it. For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+ Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it). Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+ 1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+ You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+ 2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+ a) The modified work must itself be a software library.
+
+ b) You must cause the files modified to carry prominent notices
+ stating that you changed the files and the date of any change.
+
+ c) You must cause the whole of the work to be licensed at no
+ charge to all third parties under the terms of this License.
+
+ d) If a facility in the modified Library refers to a function or a
+ table of data to be supplied by an application program that uses
+ the facility, other than as an argument passed when the facility
+ is invoked, then you must make a good faith effort to ensure that,
+ in the event an application does not supply such function or
+ table, the facility still operates, and performs whatever part of
+ its purpose remains meaningful.
+
+ (For example, a function in a library to compute square roots has
+ a purpose that is entirely well-defined independent of the
+ application. Therefore, Subsection 2d requires that any
+ application-supplied function or table used by this function must
+ be optional: if the application does not supply it, the square
+ root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+ 3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library. To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License. (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.) Do not make any other change in
+these notices.
+
+ Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+ This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+ 4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+ If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+ 5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library". Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+ However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library". The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+ When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library. The
+threshold for this to be true is not precisely defined by law.
+
+ If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work. (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+ Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+ 6. As an exception to the Sections above, you may also compile or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+ You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License. You must supply a copy of this License. If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License. Also, you must do one
+of these things:
+
+ a) Accompany the work with the complete corresponding
+ machine-readable source code for the Library including whatever
+ changes were used in the work (which must be distributed under
+ Sections 1 and 2 above); and, if the work is an executable linked
+ with the Library, with the complete machine-readable "work that
+ uses the Library", as object code and/or source code, so that the
+ user can modify the Library and then relink to produce a modified
+ executable containing the modified Library. (It is understood
+ that the user who changes the contents of definitions files in the
+ Library will not necessarily be able to recompile the application
+ to use the modified definitions.)
+
+ b) Accompany the work with a written offer, valid for at
+ least three years, to give the same user the materials
+ specified in Subsection 6a, above, for a charge no more
+ than the cost of performing this distribution.
+
+ c) If distribution of the work is made by offering access to copy
+ from a designated place, offer equivalent access to copy the above
+ specified materials from the same place.
+
+ d) Verify that the user has already received a copy of these
+ materials or that you have already sent this user a copy.
+
+ For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it. However, as a special exception,
+the source code distributed need not include anything that is normally
+distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+ It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system. Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+ 7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+ a) Accompany the combined library with a copy of the same work
+ based on the Library, uncombined with any other library
+ facilities. This must be distributed under the terms of the
+ Sections above.
+
+ b) Give prominent notice with the combined library of the fact
+ that part of it is a work based on the Library, and explaining
+ where to find the accompanying uncombined form of the same work.
+
+ 8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License. Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License. However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+ 9. You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Library or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+ 10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+ 11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all. For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+ 12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded. In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+ 13. The Free Software Foundation may publish revised and/or new
+versions of the Library General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation. If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+ 14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission. For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this. Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+ NO WARRANTY
+
+ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Libraries
+
+ If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change. You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+ To apply these terms, attach the following notices to the library. It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+ <one line to give the library's name and a brief idea of what it does.>
+ Copyright (C) <year> <name of author>
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public
+ License along with this library; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary. Here is a sample; alter the names:
+
+ Yoyodyne, Inc., hereby disclaims all copyright interest in the
+ library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+ <signature of Ty Coon>, 1 April 1990
+ Ty Coon, President of Vice
+
+That's all there is to it!
diff -Nuar flatpak-1.0.0.orig/bubblewrap/demos/bubblewrap-shell.sh flatpak-1.0.0/bubblewrap/demos/bubblewrap-shell.sh
--- flatpak-1.0.0.orig/bubblewrap/demos/bubblewrap-shell.sh 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/demos/bubblewrap-shell.sh 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Use bubblewrap to run /bin/sh reusing the host OS binaries (/usr), but with
+# separate /tmp, /home, /var, /run, and /etc. For /etc we just inherit the
+# host's resolv.conf, and set up "stub" passwd/group files. Not sharing
+# /home for example is intentional. If you wanted to, you could design
+# a bwrap-using program that shared individual parts of /home, perhaps
+# public content.
+#
+# Another way to build on this example is to remove --share-net to disable
+# networking.
+set -euo pipefail
+(exec bwrap --ro-bind /usr /usr \
+ --dir /tmp \
+ --dir /var \
+ --symlink ../tmp var/tmp \
+ --proc /proc \
+ --dev /dev \
+ --ro-bind /etc/resolv.conf /etc/resolv.conf \
+ --symlink usr/lib /lib \
+ --symlink usr/lib64 /lib64 \
+ --symlink usr/bin /bin \
+ --symlink usr/sbin /sbin \
+ --chdir / \
+ --unshare-all \
+ --share-net \
+ --dir /run/user/$(id -u) \
+ --setenv XDG_RUNTIME_DIR "/run/user/`id -u`" \
+ --setenv PS1 "bwrap-demo$ " \
+ --file 11 /etc/passwd \
+ --file 12 /etc/group \
+ /bin/sh) \
+ 11< <(getent passwd $UID 65534) \
+ 12< <(getent group $(id -g) 65534)
diff -Nuar flatpak-1.0.0.orig/bubblewrap/demos/flatpak.bpf flatpak-1.0.0/bubblewrap/demos/flatpak.bpf
--- flatpak-1.0.0.orig/bubblewrap/demos/flatpak.bpf 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/demos/flatpak.bpf 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,2 @@
+ >>� WeVgU�T�S�R�Q�P�O�N�M�L�KJIH*Gg@F�@E�@D�@C�@B�@A�@@�@?�@>�@=@<@;*@: @9@8����38@8 T/2)@ 5*) -) 5 5$ '  
   @ 3Vg{���
 & 6
+= Pf ax T�
\ Dosya sonunda yenisatır yok.
diff -Nuar flatpak-1.0.0.orig/bubblewrap/demos/flatpak-run.sh flatpak-1.0.0/bubblewrap/demos/flatpak-run.sh
--- flatpak-1.0.0.orig/bubblewrap/demos/flatpak-run.sh 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/demos/flatpak-run.sh 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,65 @@
+#!/bin/bash
+# For this to work you first have to run these commands:
+# curl -O http://sdk.gnome.org/nightly/keys/nightly.gpg
+# flatpak --user remote-add --gpg-key=nightly.gpg gnome-nightly http://sdk.gnome.org/nightly/repo/
+# flatpak --user install gnome-nightly org.gnome.Platform
+# flatpak --user install gnome-nightly org.gnome.Weather
+
+mkdir -p ~/.var/app/org.gnome.Weather/cache ~/.var/app/org.gnome.Weather/config ~/.var/app/org.gnome.Weather/data
+
+(
+ exec bwrap \
+ --ro-bind ~/.local/share/flatpak/runtime/org.gnome.Platform/x86_64/master/active/files /usr \
+ --lock-file /usr/.ref \
+ --ro-bind ~/.local/share/flatpak/app/org.gnome.Weather/x86_64/master/active/files/ /app \
+ --lock-file /app/.ref \
+ --dev /dev \
+ --proc /proc \
+ --dir /tmp \
+ --symlink /tmp /var/tmp \
+ --symlink /run /var/run \
+ --symlink usr/lib /lib \
+ --symlink usr/lib64 /lib64 \
+ --symlink usr/bin /bin \
+ --symlink usr/sbin /sbin \
+ --symlink usr/etc /etc \
+ --dir /run/user/`id -u` \
+ --ro-bind /etc/machine-id /usr/etc/machine-id \
+ --ro-bind /etc/resolv.conf /run/host/monitor/resolv.conf \
+ --ro-bind /sys/block /sys/block \
+ --ro-bind /sys/bus /sys/bus \
+ --ro-bind /sys/class /sys/class \
+ --ro-bind /sys/dev /sys/dev \
+ --ro-bind /sys/devices /sys/devices \
+ --dev-bind /dev/dri /dev/dri \
+ --bind /tmp/.X11-unix/X0 /tmp/.X11-unix/X99 \
+ --bind ~/.var/app/org.gnome.Weather ~/.var/app/org.gnome.Weather \
+ --bind ~/.config/dconf ~/.config/dconf \
+ --bind /run/user/`id -u`/dconf /run/user/`id -u`/dconf \
+ --unshare-pid \
+ --setenv XDG_RUNTIME_DIR "/run/user/`id -u`" \
+ --setenv DISPLAY :99 \
+ --setenv GI_TYPELIB_PATH /app/lib/girepository-1.0 \
+ --setenv GST_PLUGIN_PATH /app/lib/gstreamer-1.0 \
+ --setenv LD_LIBRARY_PATH /app/lib:/usr/lib/GL \
+ --setenv DCONF_USER_CONFIG_DIR .config/dconf \
+ --setenv PATH /app/bin:/usr/bin \
+ --setenv XDG_CONFIG_DIRS /app/etc/xdg:/etc/xdg \
+ --setenv XDG_DATA_DIRS /app/share:/usr/share \
+ --setenv SHELL /bin/sh \
+ --setenv XDG_CACHE_HOME ~/.var/app/org.gnome.Weather/cache \
+ --setenv XDG_CONFIG_HOME ~/.var/app/org.gnome.Weather/config \
+ --setenv XDG_DATA_HOME ~/.var/app/org.gnome.Weather/data \
+ --file 10 /run/user/`id -u`/flatpak-info \
+ --bind-data 11 /usr/etc/passwd \
+ --bind-data 12 /usr/etc/group \
+ --seccomp 13 \
+ /bin/sh) \
+ 11< <(getent passwd $UID 65534 ) \
+ 12< <(getent group $(id -g) 65534) \
+ 13< `dirname $0`/flatpak.bpf \
+ 10<<EOF
+[Application]
+name=org.gnome.Weather
+runtime=runtime/org.gnome.Platform/x86_64/master
+EOF
diff -Nuar flatpak-1.0.0.orig/bubblewrap/.dir-locals.el flatpak-1.0.0/bubblewrap/.dir-locals.el
--- flatpak-1.0.0.orig/bubblewrap/.dir-locals.el 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/.dir-locals.el 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1 @@
+((c-mode . ((indent-tabs-mode . nil) (c-file-style . "gnu"))))
diff -Nuar flatpak-1.0.0.orig/bubblewrap/.editorconfig flatpak-1.0.0/bubblewrap/.editorconfig
--- flatpak-1.0.0.orig/bubblewrap/.editorconfig 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/.editorconfig 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,6 @@
+[*.[ch]]
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+indent_brace_style = gnu
+
diff -Nuar flatpak-1.0.0.orig/bubblewrap/.git flatpak-1.0.0/bubblewrap/.git
--- flatpak-1.0.0.orig/bubblewrap/.git 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/.git 2018-02-03 21:25:59.242232860 +0300
@@ -0,0 +1 @@
+gitdir: ../.git/modules/bubblewrap
diff -Nuar flatpak-1.0.0.orig/bubblewrap/git.mk flatpak-1.0.0/bubblewrap/git.mk
--- flatpak-1.0.0.orig/bubblewrap/git.mk 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/git.mk 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,348 @@
+# git.mk, a small Makefile to autogenerate .gitignore files
+# for autotools-based projects.
+#
+# Copyright 2009, Red Hat, Inc.
+# Copyright 2010,2011,2012,2013 Behdad Esfahbod
+# Written by Behdad Esfahbod
+#
+# Copying and distribution of this file, with or without modification,
+# is permitted in any medium without royalty provided the copyright
+# notice and this notice are preserved.
+#
+# The latest version of this file can be downloaded from:
+GIT_MK_URL = https://raw.githubusercontent.com/behdad/git.mk/master/git.mk
+#
+# Bugs, etc, should be reported upstream at:
+# https://github.com/behdad/git.mk
+#
+# To use in your project, import this file in your git repo's toplevel,
+# then do "make -f git.mk". This modifies all Makefile.am files in
+# your project to -include git.mk. Remember to add that line to new
+# Makefile.am files you create in your project, or just rerun the
+# "make -f git.mk".
+#
+# This enables automatic .gitignore generation. If you need to ignore
+# more files, add them to the GITIGNOREFILES variable in your Makefile.am.
+# But think twice before doing that. If a file has to be in .gitignore,
+# chances are very high that it's a generated file and should be in one
+# of MOSTLYCLEANFILES, CLEANFILES, DISTCLEANFILES, or MAINTAINERCLEANFILES.
+#
+# The only case that you need to manually add a file to GITIGNOREFILES is
+# when remove files in one of mostlyclean-local, clean-local, distclean-local,
+# or maintainer-clean-local make targets.
+#
+# Note that for files like editor backup, etc, there are better places to
+# ignore them. See "man gitignore".
+#
+# If "make maintainer-clean" removes the files but they are not recognized
+# by this script (that is, if "git status" shows untracked files still), send
+# me the output of "git status" as well as your Makefile.am and Makefile for
+# the directories involved and I'll diagnose.
+#
+# For a list of toplevel files that should be in MAINTAINERCLEANFILES, see
+# Makefile.am.sample in the git.mk git repo.
+#
+# Don't EXTRA_DIST this file. It is supposed to only live in git clones,
+# not tarballs. It serves no useful purpose in tarballs and clutters the
+# build dir.
+#
+# This file knows how to handle autoconf, automake, libtool, gtk-doc,
+# gnome-doc-utils, yelp.m4, mallard, intltool, gsettings, dejagnu, appdata,
+# appstream.
+#
+# This makefile provides the following targets:
+#
+# - all: "make all" will build all gitignore files.
+# - gitignore: makes all gitignore files in the current dir and subdirs.
+# - .gitignore: make gitignore file for the current dir.
+# - gitignore-recurse: makes all gitignore files in the subdirs.
+#
+# KNOWN ISSUES:
+#
+# - Recursive configure doesn't work as $(top_srcdir)/git.mk inside the
+# submodule doesn't find us. If you have configure.{in,ac} files in
+# subdirs, add a proxy git.mk file in those dirs that simply does:
+# "include $(top_srcdir)/../git.mk". Add more ..'s to your taste.
+# And add those files to git. See vte/gnome-pty-helper/git.mk for
+# example.
+#
+
+
+
+###############################################################################
+# Variables user modules may want to add to toplevel MAINTAINERCLEANFILES:
+###############################################################################
+
+#
+# Most autotools-using modules should be fine including this variable in their
+# toplevel MAINTAINERCLEANFILES:
+GITIGNORE_MAINTAINERCLEANFILES_TOPLEVEL = \
+ $(srcdir)/aclocal.m4 \
+ $(srcdir)/autoscan.log \
+ $(srcdir)/configure.scan \
+ `AUX_DIR=$(srcdir)/$$(cd $(top_srcdir); $(AUTOCONF) --trace 'AC_CONFIG_AUX_DIR:$$1' ./configure.ac); \
+ test "x$$AUX_DIR" = "x$(srcdir)/" && AUX_DIR=$(srcdir); \
+ for x in \
+ ar-lib \
+ compile \
+ config.guess \
+ config.sub \
+ depcomp \
+ install-sh \
+ ltmain.sh \
+ missing \
+ mkinstalldirs \
+ test-driver \
+ ylwrap \
+ ; do echo "$$AUX_DIR/$$x"; done` \
+ `cd $(top_srcdir); $(AUTOCONF) --trace 'AC_CONFIG_HEADERS:$$1' ./configure.ac | \
+ head -n 1 | while read f; do echo "$(srcdir)/$$f.in"; done`
+#
+# All modules should also be fine including the following variable, which
+# removes automake-generated Makefile.in files:
+GITIGNORE_MAINTAINERCLEANFILES_MAKEFILE_IN = \
+ `cd $(top_srcdir); $(AUTOCONF) --trace 'AC_CONFIG_FILES:$$1' ./configure.ac | \
+ while read f; do \
+ case $$f in Makefile|*/Makefile) \
+ test -f "$(srcdir)/$$f.am" && echo "$(srcdir)/$$f.in";; esac; \
+ done`
+#
+# Modules that use libtool and use AC_CONFIG_MACRO_DIR() may also include this,
+# though it's harmless to include regardless.
+GITIGNORE_MAINTAINERCLEANFILES_M4_LIBTOOL = \
+ `MACRO_DIR=$(srcdir)/$$(cd $(top_srcdir); $(AUTOCONF) --trace 'AC_CONFIG_MACRO_DIR:$$1' ./configure.ac); \
+ if test "x$$MACRO_DIR" != "x$(srcdir)/"; then \
+ for x in \
+ libtool.m4 \
+ ltoptions.m4 \
+ ltsugar.m4 \
+ ltversion.m4 \
+ lt~obsolete.m4 \
+ ; do echo "$$MACRO_DIR/$$x"; done; \
+ fi`
+
+
+
+###############################################################################
+# Default rule is to install ourselves in all Makefile.am files:
+###############################################################################
+
+git-all: git-mk-install
+
+git-mk-install:
+ @echo "Installing git makefile"
+ @any_failed=; \
+ find "`test -z "$(top_srcdir)" && echo . || echo "$(top_srcdir)"`" -name Makefile.am | while read x; do \
+ if grep 'include .*/git.mk' $$x >/dev/null; then \
+ echo "$$x already includes git.mk"; \
+ else \
+ failed=; \
+ echo "Updating $$x"; \
+ { cat $$x; \
+ echo ''; \
+ echo '-include $$(top_srcdir)/git.mk'; \
+ } > $$x.tmp || failed=1; \
+ if test x$$failed = x; then \
+ mv $$x.tmp $$x || failed=1; \
+ fi; \
+ if test x$$failed = x; then : else \
+ echo "Failed updating $$x"; >&2 \
+ any_failed=1; \
+ fi; \
+ fi; done; test -z "$$any_failed"
+
+git-mk-update:
+ wget $(GIT_MK_URL) -O $(top_srcdir)/git.mk
+
+.PHONY: git-all git-mk-install git-mk-update
+
+
+
+###############################################################################
+# Actual .gitignore generation:
+###############################################################################
+
+$(srcdir)/.gitignore: Makefile.am $(top_srcdir)/git.mk
+ @echo "git.mk: Generating $@"
+ @{ \
+ if test "x$(DOC_MODULE)" = x -o "x$(DOC_MAIN_SGML_FILE)" = x; then :; else \
+ for x in \
+ $(DOC_MODULE)-decl-list.txt \
+ $(DOC_MODULE)-decl.txt \
+ tmpl/$(DOC_MODULE)-unused.sgml \
+ "tmpl/*.bak" \
+ $(REPORT_FILES) \
+ $(DOC_MODULE).pdf \
+ xml html \
+ ; do echo "/$$x"; done; \
+ FLAVOR=$$(cd $(top_srcdir); $(AUTOCONF) --trace 'GTK_DOC_CHECK:$$2' ./configure.ac); \
+ case $$FLAVOR in *no-tmpl*) echo /tmpl;; esac; \
+ if echo "$(SCAN_OPTIONS)" | grep -q "\-\-rebuild-types"; then \
+ echo "/$(DOC_MODULE).types"; \
+ fi; \
+ if echo "$(SCAN_OPTIONS)" | grep -q "\-\-rebuild-sections"; then \
+ echo "/$(DOC_MODULE)-sections.txt"; \
+ fi; \
+ if test "$(abs_srcdir)" != "$(abs_builddir)" ; then \
+ for x in \
+ $(SETUP_FILES) \
+ $(DOC_MODULE).types \
+ ; do echo "/$$x"; done; \
+ fi; \
+ fi; \
+ if test "x$(DOC_MODULE)$(DOC_ID)" = x -o "x$(DOC_LINGUAS)" = x; then :; else \
+ for lc in $(DOC_LINGUAS); do \
+ for x in \
+ $(if $(DOC_MODULE),$(DOC_MODULE).xml) \
+ $(DOC_PAGES) \
+ $(DOC_INCLUDES) \
+ ; do echo "/$$lc/$$x"; done; \
+ done; \
+ for x in \
+ $(_DOC_OMF_ALL) \
+ $(_DOC_DSK_ALL) \
+ $(_DOC_HTML_ALL) \
+ $(_DOC_MOFILES) \
+ $(DOC_H_FILE) \
+ "*/.xml2po.mo" \
+ "*/*.omf.out" \
+ ; do echo /$$x; done; \
+ fi; \
+ if test "x$(HELP_ID)" = x -o "x$(HELP_LINGUAS)" = x; then :; else \
+ for lc in $(HELP_LINGUAS); do \
+ for x in \
+ $(HELP_FILES) \
+ "$$lc.stamp" \
+ "$$lc.mo" \
+ ; do echo "/$$lc/$$x"; done; \
+ done; \
+ fi; \
+ if test "x$(gsettings_SCHEMAS)" = x; then :; else \
+ for x in \
+ $(gsettings_SCHEMAS:.xml=.valid) \
+ $(gsettings__enum_file) \
+ ; do echo "/$$x"; done; \
+ fi; \
+ if test "x$(appdata_XML)" = x; then :; else \
+ for x in \
+ $(appdata_XML:.xml=.valid) \
+ ; do echo "/$$x"; done; \
+ fi; \
+ if test "x$(appstream_XML)" = x; then :; else \
+ for x in \
+ $(appstream_XML:.xml=.valid) \
+ ; do echo "/$$x"; done; \
+ fi; \
+ if test -f $(srcdir)/po/Makefile.in.in; then \
+ for x in \
+ po/Makefile.in.in \
+ po/Makefile.in.in~ \
+ po/Makefile.in \
+ po/Makefile \
+ po/Makevars.template \
+ po/POTFILES \
+ po/Rules-quot \
+ po/stamp-it \
+ po/stamp-po \
+ po/.intltool-merge-cache \
+ "po/*.gmo" \
+ "po/*.header" \
+ "po/*.mo" \
+ "po/*.sed" \
+ "po/*.sin" \
+ po/$(GETTEXT_PACKAGE).pot \
+ intltool-extract.in \
+ intltool-merge.in \
+ intltool-update.in \
+ ; do echo "/$$x"; done; \
+ fi; \
+ if test -f $(srcdir)/configure; then \
+ for x in \
+ autom4te.cache \
+ configure \
+ config.h \
+ stamp-h1 \
+ libtool \
+ config.lt \
+ ; do echo "/$$x"; done; \
+ fi; \
+ if test "x$(DEJATOOL)" = x; then :; else \
+ for x in \
+ $(DEJATOOL) \
+ ; do echo "/$$x.sum"; echo "/$$x.log"; done; \
+ echo /site.exp; \
+ fi; \
+ if test "x$(am__dirstamp)" = x; then :; else \
+ echo "$(am__dirstamp)"; \
+ fi; \
+ if test "x$(LTCOMPILE)" = x -a "x$(LTCXXCOMPILE)" = x -a "x$(GTKDOC_RUN)" = x; then :; else \
+ for x in \
+ "*.lo" \
+ ".libs" "_libs" \
+ ; do echo "$$x"; done; \
+ fi; \
+ for x in \
+ .gitignore \
+ $(GITIGNOREFILES) \
+ $(CLEANFILES) \
+ $(PROGRAMS) $(check_PROGRAMS) $(EXTRA_PROGRAMS) \
+ $(LIBRARIES) $(check_LIBRARIES) $(EXTRA_LIBRARIES) \
+ $(LTLIBRARIES) $(check_LTLIBRARIES) $(EXTRA_LTLIBRARIES) \
+ so_locations \
+ $(MOSTLYCLEANFILES) \
+ $(TEST_LOGS) \
+ $(TEST_LOGS:.log=.trs) \
+ $(TEST_SUITE_LOG) \
+ $(TESTS:=.test) \
+ "*.gcda" \
+ "*.gcno" \
+ $(DISTCLEANFILES) \
+ $(am__CONFIG_DISTCLEAN_FILES) \
+ $(CONFIG_CLEAN_FILES) \
+ TAGS ID GTAGS GRTAGS GSYMS GPATH tags \
+ "*.tab.c" \
+ $(MAINTAINERCLEANFILES) \
+ $(BUILT_SOURCES) \
+ $(patsubst %.vala,%.c,$(filter %.vala,$(SOURCES))) \
+ $(filter %_vala.stamp,$(DIST_COMMON)) \
+ $(filter %.vapi,$(DIST_COMMON)) \
+ $(filter $(addprefix %,$(notdir $(patsubst %.vapi,%.h,$(filter %.vapi,$(DIST_COMMON))))),$(DIST_COMMON)) \
+ Makefile \
+ Makefile.in \
+ "*.orig" \
+ "*.rej" \
+ "*.bak" \
+ "*~" \
+ ".*.sw[nop]" \
+ ".dirstamp" \
+ ; do echo "/$$x"; done; \
+ for x in \
+ "*.$(OBJEXT)" \
+ $(DEPDIR) \
+ ; do echo "$$x"; done; \
+ } | \
+ sed "s@^/`echo "$(srcdir)" | sed 's/\(.\)/[\1]/g'`/@/@" | \
+ sed 's@/[.]/@/@g' | \
+ LC_ALL=C sort | uniq > $@.tmp && \
+ mv $@.tmp $@;
+
+all: $(srcdir)/.gitignore gitignore-recurse-maybe
+gitignore: $(srcdir)/.gitignore gitignore-recurse
+
+gitignore-recurse-maybe:
+ @for subdir in $(DIST_SUBDIRS); do \
+ case " $(SUBDIRS) " in \
+ *" $$subdir "*) :;; \
+ *) test "$$subdir" = . -o -e "$$subdir/.git" || (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) gitignore || echo "Skipping $$subdir");; \
+ esac; \
+ done
+gitignore-recurse:
+ @for subdir in $(DIST_SUBDIRS); do \
+ test "$$subdir" = . -o -e "$$subdir/.git" || (cd $$subdir && $(MAKE) $(AM_MAKEFLAGS) gitignore || echo "Skipping $$subdir"); \
+ done
+
+maintainer-clean: gitignore-clean
+gitignore-clean:
+ -rm -f $(srcdir)/.gitignore
+
+.PHONY: gitignore-clean gitignore gitignore-recurse gitignore-recurse-maybe
diff -Nuar flatpak-1.0.0.orig/bubblewrap/LICENSE flatpak-1.0.0/bubblewrap/LICENSE
--- flatpak-1.0.0.orig/bubblewrap/LICENSE 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/LICENSE 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,481 @@
+ GNU LIBRARY GENERAL PUBLIC LICENSE
+ Version 2, June 1991
+
+ Copyright (C) 1991 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the library GPL. It is
+ numbered 2 because it goes with version 2 of the ordinary GPL.]
+
+ Preamble
+
+ The licenses for most software are designed to take away your
+freedom to share and change it. By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+ This license, the Library General Public License, applies to some
+specially designated Free Software Foundation software, and to any
+other libraries whose authors decide to use it. You can use it for
+your libraries, too.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+ To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if
+you distribute copies of the library, or if you modify it.
+
+ For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you. You must make sure that they, too, receive or can get the source
+code. If you link a program with the library, you must provide
+complete object files to the recipients so that they can relink them
+with the library, after making changes to the library and recompiling
+it. And you must show them these terms so they know their rights.
+
+ Our method of protecting your rights has two steps: (1) copyright
+the library, and (2) offer you this license which gives you legal
+permission to copy, distribute and/or modify the library.
+
+ Also, for each distributor's protection, we want to make certain
+that everyone understands that there is no warranty for this free
+library. If the library is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original
+version, so that any problems introduced by others will not reflect on
+the original authors' reputations.
+
+ Finally, any free program is threatened constantly by software
+patents. We wish to avoid the danger that companies distributing free
+software will individually obtain patent licenses, thus in effect
+transforming the program into proprietary software. To prevent this,
+we have made it clear that any patent must be licensed for everyone's
+free use or not licensed at all.
+
+ Most GNU software, including some libraries, is covered by the ordinary
+GNU General Public License, which was designed for utility programs. This
+license, the GNU Library General Public License, applies to certain
+designated libraries. This license is quite different from the ordinary
+one; be sure to read it in full, and don't assume that anything in it is
+the same as in the ordinary license.
+
+ The reason we have a separate public license for some libraries is that
+they blur the distinction we usually make between modifying or adding to a
+program and simply using it. Linking a program with a library, without
+changing the library, is in some sense simply using the library, and is
+analogous to running a utility program or application program. However, in
+a textual and legal sense, the linked executable is a combined work, a
+derivative of the original library, and the ordinary General Public License
+treats it as such.
+
+ Because of this blurred distinction, using the ordinary General
+Public License for libraries did not effectively promote software
+sharing, because most developers did not use the libraries. We
+concluded that weaker conditions might promote sharing better.
+
+ However, unrestricted linking of non-free programs would deprive the
+users of those programs of all benefit from the free status of the
+libraries themselves. This Library General Public License is intended to
+permit developers of non-free programs to use free libraries, while
+preserving your freedom as a user of such programs to change the free
+libraries that are incorporated in them. (We have not seen how to achieve
+this as regards changes in header files, but we have achieved it as regards
+changes in the actual functions of the Library.) The hope is that this
+will lead to faster development of free libraries.
+
+ The precise terms and conditions for copying, distribution and
+modification follow. Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library". The
+former contains code derived from the library, while the latter only
+works together with the library.
+
+ Note that it is possible for a library to be covered by the ordinary
+General Public License rather than by this special one.
+
+ GNU LIBRARY GENERAL PUBLIC LICENSE
+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+ 0. This License Agreement applies to any software library which
+contains a notice placed by the copyright holder or other authorized
+party saying it may be distributed under the terms of this Library
+General Public License (also called "this License"). Each licensee is
+addressed as "you".
+
+ A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+ The "Library", below, refers to any such software library or work
+which has been distributed under these terms. A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language. (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+ "Source code" for a work means the preferred form of the work for
+making modifications to it. For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+ Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it). Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+ 1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+ You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+ 2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+ a) The modified work must itself be a software library.
+
+ b) You must cause the files modified to carry prominent notices
+ stating that you changed the files and the date of any change.
+
+ c) You must cause the whole of the work to be licensed at no
+ charge to all third parties under the terms of this License.
+
+ d) If a facility in the modified Library refers to a function or a
+ table of data to be supplied by an application program that uses
+ the facility, other than as an argument passed when the facility
+ is invoked, then you must make a good faith effort to ensure that,
+ in the event an application does not supply such function or
+ table, the facility still operates, and performs whatever part of
+ its purpose remains meaningful.
+
+ (For example, a function in a library to compute square roots has
+ a purpose that is entirely well-defined independent of the
+ application. Therefore, Subsection 2d requires that any
+ application-supplied function or table used by this function must
+ be optional: if the application does not supply it, the square
+ root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+ 3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library. To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License. (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.) Do not make any other change in
+these notices.
+
+ Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+ This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+ 4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+ If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+ 5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library". Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+ However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library". The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+ When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library. The
+threshold for this to be true is not precisely defined by law.
+
+ If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work. (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+ Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+ 6. As an exception to the Sections above, you may also compile or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+ You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License. You must supply a copy of this License. If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License. Also, you must do one
+of these things:
+
+ a) Accompany the work with the complete corresponding
+ machine-readable source code for the Library including whatever
+ changes were used in the work (which must be distributed under
+ Sections 1 and 2 above); and, if the work is an executable linked
+ with the Library, with the complete machine-readable "work that
+ uses the Library", as object code and/or source code, so that the
+ user can modify the Library and then relink to produce a modified
+ executable containing the modified Library. (It is understood
+ that the user who changes the contents of definitions files in the
+ Library will not necessarily be able to recompile the application
+ to use the modified definitions.)
+
+ b) Accompany the work with a written offer, valid for at
+ least three years, to give the same user the materials
+ specified in Subsection 6a, above, for a charge no more
+ than the cost of performing this distribution.
+
+ c) If distribution of the work is made by offering access to copy
+ from a designated place, offer equivalent access to copy the above
+ specified materials from the same place.
+
+ d) Verify that the user has already received a copy of these
+ materials or that you have already sent this user a copy.
+
+ For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it. However, as a special exception,
+the source code distributed need not include anything that is normally
+distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+ It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system. Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+ 7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+ a) Accompany the combined library with a copy of the same work
+ based on the Library, uncombined with any other library
+ facilities. This must be distributed under the terms of the
+ Sections above.
+
+ b) Give prominent notice with the combined library of the fact
+ that part of it is a work based on the Library, and explaining
+ where to find the accompanying uncombined form of the same work.
+
+ 8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License. Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License. However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+ 9. You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Library or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+ 10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+ 11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all. For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+ 12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded. In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+ 13. The Free Software Foundation may publish revised and/or new
+versions of the Library General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation. If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+ 14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission. For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this. Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+ NO WARRANTY
+
+ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Libraries
+
+ If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change. You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+ To apply these terms, attach the following notices to the library. It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+ <one line to give the library's name and a brief idea of what it does.>
+ Copyright (C) <year> <name of author>
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public
+ License along with this library; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary. Here is a sample; alter the names:
+
+ Yoyodyne, Inc., hereby disclaims all copyright interest in the
+ library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+ <signature of Ty Coon>, 1 April 1990
+ Ty Coon, President of Vice
+
+That's all there is to it!
diff -Nuar flatpak-1.0.0.orig/bubblewrap/m4/attributes.m4 flatpak-1.0.0/bubblewrap/m4/attributes.m4
--- flatpak-1.0.0.orig/bubblewrap/m4/attributes.m4 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/m4/attributes.m4 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,292 @@
+dnl Macros to check the presence of generic (non-typed) symbols.
+dnl Copyright (c) 2006-2008 Diego Pettenò <flameeyes@gmail.com>
+dnl Copyright (c) 2006-2008 xine project
+dnl Copyright (c) 2012 Lucas De Marchi <lucas.de.marchi@gmail.com>
+dnl
+dnl This program is free software; you can redistribute it and/or modify
+dnl it under the terms of the GNU General Public License as published by
+dnl the Free Software Foundation; either version 2, or (at your option)
+dnl any later version.
+dnl
+dnl This program is distributed in the hope that it will be useful,
+dnl but WITHOUT ANY WARRANTY; without even the implied warranty of
+dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+dnl GNU General Public License for more details.
+dnl
+dnl You should have received a copy of the GNU General Public License
+dnl along with this program; if not, write to the Free Software
+dnl Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+dnl 02110-1301, USA.
+dnl
+dnl As a special exception, the copyright owners of the
+dnl macro gives unlimited permission to copy, distribute and modify the
+dnl configure scripts that are the output of Autoconf when processing the
+dnl Macro. You need not follow the terms of the GNU General Public
+dnl License when using or distributing such scripts, even though portions
+dnl of the text of the Macro appear in them. The GNU General Public
+dnl License (GPL) does govern all other use of the material that
+dnl constitutes the Autoconf Macro.
+dnl
+dnl This special exception to the GPL applies to versions of the
+dnl Autoconf Macro released by this project. When you make and
+dnl distribute a modified version of the Autoconf Macro, you may extend
+dnl this special exception to the GPL to apply to your modified version as
+dnl well.
+
+dnl Check if FLAG in ENV-VAR is supported by compiler and append it
+dnl to WHERE-TO-APPEND variable. Note that we invert -Wno-* checks to
+dnl -W* as gcc cannot test for negated warnings. If a C snippet is passed,
+dnl use it, otherwise use a simple main() definition that just returns 0.
+dnl CC_CHECK_FLAG_APPEND([WHERE-TO-APPEND], [ENV-VAR], [FLAG], [C-SNIPPET])
+
+AC_DEFUN([CC_CHECK_FLAG_APPEND], [
+ AC_CACHE_CHECK([if $CC supports flag $3 in envvar $2],
+ AS_TR_SH([cc_cv_$2_$3]),
+ [eval "AS_TR_SH([cc_save_$2])='${$2}'"
+ eval "AS_TR_SH([$2])='${cc_save_$2} -Werror `echo "$3" | sed 's/^-Wno-/-W/'`'"
+ AC_LINK_IFELSE([AC_LANG_SOURCE(ifelse([$4], [],
+ [int main(void) { return 0; } ],
+ [$4]))],
+ [eval "AS_TR_SH([cc_cv_$2_$3])='yes'"],
+ [eval "AS_TR_SH([cc_cv_$2_$3])='no'"])
+ eval "AS_TR_SH([$2])='$cc_save_$2'"])
+
+ AS_IF([eval test x$]AS_TR_SH([cc_cv_$2_$3])[ = xyes],
+ [eval "$1='${$1} $3'"])
+])
+
+dnl CC_CHECK_FLAGS_APPEND([WHERE-TO-APPEND], [ENV-VAR], [FLAG1 FLAG2], [C-SNIPPET])
+AC_DEFUN([CC_CHECK_FLAGS_APPEND], [
+ for flag in [$3]; do
+ CC_CHECK_FLAG_APPEND([$1], [$2], $flag, [$4])
+ done
+])
+
+dnl Check if the flag is supported by linker (cacheable)
+dnl CC_CHECK_LDFLAGS([FLAG], [ACTION-IF-FOUND],[ACTION-IF-NOT-FOUND])
+
+AC_DEFUN([CC_CHECK_LDFLAGS], [
+ AC_CACHE_CHECK([if $CC supports $1 flag],
+ AS_TR_SH([cc_cv_ldflags_$1]),
+ [ac_save_LDFLAGS="$LDFLAGS"
+ LDFLAGS="$LDFLAGS $1"
+ AC_LINK_IFELSE([int main() { return 1; }],
+ [eval "AS_TR_SH([cc_cv_ldflags_$1])='yes'"],
+ [eval "AS_TR_SH([cc_cv_ldflags_$1])="])
+ LDFLAGS="$ac_save_LDFLAGS"
+ ])
+
+ AS_IF([eval test x$]AS_TR_SH([cc_cv_ldflags_$1])[ = xyes],
+ [$2], [$3])
+])
+
+dnl define the LDFLAGS_NOUNDEFINED variable with the correct value for
+dnl the current linker to avoid undefined references in a shared object.
+AC_DEFUN([CC_NOUNDEFINED], [
+ dnl We check $host for which systems to enable this for.
+ AC_REQUIRE([AC_CANONICAL_HOST])
+
+ case $host in
+ dnl FreeBSD (et al.) does not complete linking for shared objects when pthreads
+ dnl are requested, as different implementations are present; to avoid problems
+ dnl use -Wl,-z,defs only for those platform not behaving this way.
+ *-freebsd* | *-openbsd*) ;;
+ *)
+ dnl First of all check for the --no-undefined variant of GNU ld. This allows
+ dnl for a much more readable command line, so that people can understand what
+ dnl it does without going to look for what the heck -z defs does.
+ for possible_flags in "-Wl,--no-undefined" "-Wl,-z,defs"; do
+ CC_CHECK_LDFLAGS([$possible_flags], [LDFLAGS_NOUNDEFINED="$possible_flags"])
+ break
+ done
+ ;;
+ esac
+
+ AC_SUBST([LDFLAGS_NOUNDEFINED])
+])
+
+dnl Check for a -Werror flag or equivalent. -Werror is the GCC
+dnl and ICC flag that tells the compiler to treat all the warnings
+dnl as fatal. We usually need this option to make sure that some
+dnl constructs (like attributes) are not simply ignored.
+dnl
+dnl Other compilers don't support -Werror per se, but they support
+dnl an equivalent flag:
+dnl - Sun Studio compiler supports -errwarn=%all
+AC_DEFUN([CC_CHECK_WERROR], [
+ AC_CACHE_CHECK(
+ [for $CC way to treat warnings as errors],
+ [cc_cv_werror],
+ [CC_CHECK_CFLAGS_SILENT([-Werror], [cc_cv_werror=-Werror],
+ [CC_CHECK_CFLAGS_SILENT([-errwarn=%all], [cc_cv_werror=-errwarn=%all])])
+ ])
+])
+
+AC_DEFUN([CC_CHECK_ATTRIBUTE], [
+ AC_REQUIRE([CC_CHECK_WERROR])
+ AC_CACHE_CHECK([if $CC supports __attribute__(( ifelse([$2], , [$1], [$2]) ))],
+ AS_TR_SH([cc_cv_attribute_$1]),
+ [ac_save_CFLAGS="$CFLAGS"
+ CFLAGS="$CFLAGS $cc_cv_werror"
+ AC_COMPILE_IFELSE([AC_LANG_SOURCE([$3])],
+ [eval "AS_TR_SH([cc_cv_attribute_$1])='yes'"],
+ [eval "AS_TR_SH([cc_cv_attribute_$1])='no'"])
+ CFLAGS="$ac_save_CFLAGS"
+ ])
+
+ AS_IF([eval test x$]AS_TR_SH([cc_cv_attribute_$1])[ = xyes],
+ [AC_DEFINE(
+ AS_TR_CPP([SUPPORT_ATTRIBUTE_$1]), 1,
+ [Define this if the compiler supports __attribute__(( ifelse([$2], , [$1], [$2]) ))]
+ )
+ $4],
+ [$5])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_CONSTRUCTOR], [
+ CC_CHECK_ATTRIBUTE(
+ [constructor],,
+ [void __attribute__((constructor)) ctor() { int a; }],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_FORMAT], [
+ CC_CHECK_ATTRIBUTE(
+ [format], [format(printf, n, n)],
+ [void __attribute__((format(printf, 1, 2))) printflike(const char *fmt, ...) { fmt = (void *)0; }],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_FORMAT_ARG], [
+ CC_CHECK_ATTRIBUTE(
+ [format_arg], [format_arg(printf)],
+ [char *__attribute__((format_arg(1))) gettextlike(const char *fmt) { fmt = (void *)0; }],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_VISIBILITY], [
+ CC_CHECK_ATTRIBUTE(
+ [visibility_$1], [visibility("$1")],
+ [void __attribute__((visibility("$1"))) $1_function() { }],
+ [$2], [$3])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_NONNULL], [
+ CC_CHECK_ATTRIBUTE(
+ [nonnull], [nonnull()],
+ [void __attribute__((nonnull())) some_function(void *foo, void *bar) { foo = (void*)0; bar = (void*)0; }],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_UNUSED], [
+ CC_CHECK_ATTRIBUTE(
+ [unused], ,
+ [void some_function(void *foo, __attribute__((unused)) void *bar);],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_SENTINEL], [
+ CC_CHECK_ATTRIBUTE(
+ [sentinel], ,
+ [void some_function(void *foo, ...) __attribute__((sentinel));],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_DEPRECATED], [
+ CC_CHECK_ATTRIBUTE(
+ [deprecated], ,
+ [void some_function(void *foo, ...) __attribute__((deprecated));],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_ALIAS], [
+ CC_CHECK_ATTRIBUTE(
+ [alias], [weak, alias],
+ [void other_function(void *foo) { }
+ void some_function(void *foo) __attribute__((weak, alias("other_function")));],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_MALLOC], [
+ CC_CHECK_ATTRIBUTE(
+ [malloc], ,
+ [void * __attribute__((malloc)) my_alloc(int n);],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_PACKED], [
+ CC_CHECK_ATTRIBUTE(
+ [packed], ,
+ [struct astructure { char a; int b; long c; void *d; } __attribute__((packed));],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_CONST], [
+ CC_CHECK_ATTRIBUTE(
+ [const], ,
+ [int __attribute__((const)) twopow(int n) { return 1 << n; } ],
+ [$1], [$2])
+])
+
+AC_DEFUN([CC_FLAG_VISIBILITY], [
+ AC_REQUIRE([CC_CHECK_WERROR])
+ AC_CACHE_CHECK([if $CC supports -fvisibility=hidden],
+ [cc_cv_flag_visibility],
+ [cc_flag_visibility_save_CFLAGS="$CFLAGS"
+ CFLAGS="$CFLAGS $cc_cv_werror"
+ CC_CHECK_CFLAGS_SILENT([-fvisibility=hidden],
+ cc_cv_flag_visibility='yes',
+ cc_cv_flag_visibility='no')
+ CFLAGS="$cc_flag_visibility_save_CFLAGS"])
+
+ AS_IF([test "x$cc_cv_flag_visibility" = "xyes"],
+ [AC_DEFINE([SUPPORT_FLAG_VISIBILITY], 1,
+ [Define this if the compiler supports the -fvisibility flag])
+ $1],
+ [$2])
+])
+
+AC_DEFUN([CC_FUNC_EXPECT], [
+ AC_REQUIRE([CC_CHECK_WERROR])
+ AC_CACHE_CHECK([if compiler has __builtin_expect function],
+ [cc_cv_func_expect],
+ [ac_save_CFLAGS="$CFLAGS"
+ CFLAGS="$CFLAGS $cc_cv_werror"
+ AC_COMPILE_IFELSE([AC_LANG_SOURCE(
+ [int some_function() {
+ int a = 3;
+ return (int)__builtin_expect(a, 3);
+ }])],
+ [cc_cv_func_expect=yes],
+ [cc_cv_func_expect=no])
+ CFLAGS="$ac_save_CFLAGS"
+ ])
+
+ AS_IF([test "x$cc_cv_func_expect" = "xyes"],
+ [AC_DEFINE([SUPPORT__BUILTIN_EXPECT], 1,
+ [Define this if the compiler supports __builtin_expect() function])
+ $1],
+ [$2])
+])
+
+AC_DEFUN([CC_ATTRIBUTE_ALIGNED], [
+ AC_REQUIRE([CC_CHECK_WERROR])
+ AC_CACHE_CHECK([highest __attribute__ ((aligned ())) supported],
+ [cc_cv_attribute_aligned],
+ [ac_save_CFLAGS="$CFLAGS"
+ CFLAGS="$CFLAGS $cc_cv_werror"
+ for cc_attribute_align_try in 64 32 16 8 4 2; do
+ AC_COMPILE_IFELSE([AC_LANG_SOURCE([
+ int main() {
+ static char c __attribute__ ((aligned($cc_attribute_align_try))) = 0;
+ return c;
+ }])], [cc_cv_attribute_aligned=$cc_attribute_align_try; break])
+ done
+ CFLAGS="$ac_save_CFLAGS"
+ ])
+
+ if test "x$cc_cv_attribute_aligned" != "x"; then
+ AC_DEFINE_UNQUOTED([ATTRIBUTE_ALIGNED_MAX], [$cc_cv_attribute_aligned],
+ [Define the highest alignment supported])
+ fi
+])
diff -Nuar flatpak-1.0.0.orig/bubblewrap/Makefile.am flatpak-1.0.0/bubblewrap/Makefile.am
--- flatpak-1.0.0.orig/bubblewrap/Makefile.am 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/Makefile.am 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,46 @@
+AM_CFLAGS = $(WARN_CFLAGS)
+CLEANFILES =
+EXTRA_DIST =
+
+GITIGNOREFILES = build-aux/ gtk-doc.make config.h.in aclocal.m4
+
+bin_PROGRAMS = bwrap
+
+bwrap_srcpath := $(srcdir)
+include Makefile-bwrap.am
+
+install-exec-hook:
+if PRIV_MODE_SETUID
+ $(SUDO_BIN) chown root $(DESTDIR)$(bindir)/bwrap
+ $(SUDO_BIN) chmod u+s $(DESTDIR)$(bindir)/bwrap
+endif
+
+check_PROGRAMS = test-bwrap
+
+test-bwrap: bwrap
+ rm -rf test-bwrap
+ cp bwrap test-bwrap
+if PRIV_MODE_SETUID
+ $(SUDO_BIN) chown root test-bwrap
+ $(SUDO_BIN) chmod u+s test-bwrap
+endif
+
+test_bwrap_SOURCES=
+
+include Makefile-docs.am
+
+TESTS = tests/test-run.sh
+TESTS_ENVIRONMENT = BWRAP=$(abs_top_builddir)/test-bwrap
+
+EXTRA_DIST += $(TESTS)
+
+if ENABLE_BASH_COMPLETION
+bashcompletiondir = $(BASH_COMPLETION_DIR)
+dist_bashcompletion_DATA = completions/bash/bwrap
+endif
+
+-include $(top_srcdir)/git.mk
+
+AM_DISTCHECK_CONFIGURE_FLAGS = \
+ --with-bash-completion-dir="\$(datadir)"/bash-completion/ \
+ $(NULL)
diff -Nuar flatpak-1.0.0.orig/bubblewrap/Makefile-bwrap.am flatpak-1.0.0/bubblewrap/Makefile-bwrap.am
--- flatpak-1.0.0.orig/bubblewrap/Makefile-bwrap.am 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/Makefile-bwrap.am 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,13 @@
+
+bwrap_SOURCES = \
+ $(bwrap_srcpath)/bubblewrap.c \
+ $(bwrap_srcpath)/bind-mount.h \
+ $(bwrap_srcpath)/bind-mount.c \
+ $(bwrap_srcpath)/network.h \
+ $(bwrap_srcpath)/network.c \
+ $(bwrap_srcpath)/utils.h \
+ $(bwrap_srcpath)/utils.c \
+ $(NULL)
+
+bwrap_CFLAGS = $(AM_CFLAGS)
+bwrap_LDADD = $(SELINUX_LIBS)
diff -Nuar flatpak-1.0.0.orig/bubblewrap/Makefile-docs.am flatpak-1.0.0/bubblewrap/Makefile-docs.am
--- flatpak-1.0.0.orig/bubblewrap/Makefile-docs.am 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/Makefile-docs.am 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,18 @@
+XSLTPROC = xsltproc
+
+XSLTPROC_FLAGS = \
+ --nonet \
+ --stringparam man.output.quietly 1 \
+ --stringparam funcsynopsis.style ansi \
+ --stringparam man.th.extra1.suppress 1 \
+ --stringparam man.authors.section.enabled 0 \
+ --stringparam man.copyright.section.enabled 0
+
+.xml.1:
+ $(XSLTPROC) $(XSLTPROC_FLAGS) http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl $<
+
+if ENABLE_MAN
+man_MANS = bwrap.1
+CLEANFILES += $(man_MANS)
+endif
+EXTRA_DIST += bwrap.xml
diff -Nuar flatpak-1.0.0.orig/bubblewrap/network.c flatpak-1.0.0/bubblewrap/network.c
--- flatpak-1.0.0.orig/bubblewrap/network.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/network.c 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,198 @@
+/* bubblewrap
+ * Copyright (C) 2016 Alexander Larsson
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "config.h"
+
+#include <arpa/inet.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <linux/loop.h>
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+
+#include "utils.h"
+#include "network.h"
+
+static void *
+add_rta (struct nlmsghdr *header,
+ int type,
+ size_t size)
+{
+ struct rtattr *rta;
+ size_t rta_size = RTA_LENGTH (size);
+
+ rta = (struct rtattr *) ((char *) header + NLMSG_ALIGN (header->nlmsg_len));
+ rta->rta_type = type;
+ rta->rta_len = rta_size;
+
+ header->nlmsg_len = NLMSG_ALIGN (header->nlmsg_len) + rta_size;
+
+ return RTA_DATA (rta);
+}
+
+static int
+rtnl_send_request (int rtnl_fd,
+ struct nlmsghdr *header)
+{
+ struct sockaddr_nl dst_addr = { AF_NETLINK, 0 };
+ ssize_t sent;
+
+ sent = sendto (rtnl_fd, (void *) header, header->nlmsg_len, 0,
+ (struct sockaddr *) &dst_addr, sizeof (dst_addr));
+ if (sent < 0)
+ return -1;
+
+ return 0;
+}
+
+static int
+rtnl_read_reply (int rtnl_fd,
+ int seq_nr)
+{
+ char buffer[1024];
+ ssize_t received;
+ struct nlmsghdr *rheader;
+
+ while (1)
+ {
+ received = recv (rtnl_fd, buffer, sizeof (buffer), 0);
+ if (received < 0)
+ return -1;
+
+ rheader = (struct nlmsghdr *) buffer;
+ while (received >= NLMSG_HDRLEN)
+ {
+ if (rheader->nlmsg_seq != seq_nr)
+ return -1;
+ if (rheader->nlmsg_pid != getpid ())
+ return -1;
+ if (rheader->nlmsg_type == NLMSG_ERROR)
+ {
+ uint32_t *err = NLMSG_DATA (rheader);
+ if (*err == 0)
+ return 0;
+
+ return -1;
+ }
+ if (rheader->nlmsg_type == NLMSG_DONE)
+ return 0;
+
+ rheader = NLMSG_NEXT (rheader, received);
+ }
+ }
+}
+
+static int
+rtnl_do_request (int rtnl_fd,
+ struct nlmsghdr *header)
+{
+ if (rtnl_send_request (rtnl_fd, header) != 0)
+ return -1;
+
+ if (rtnl_read_reply (rtnl_fd, header->nlmsg_seq) != 0)
+ return -1;
+
+ return 0;
+}
+
+static struct nlmsghdr *
+rtnl_setup_request (char *buffer,
+ int type,
+ int flags,
+ size_t size)
+{
+ struct nlmsghdr *header;
+ size_t len = NLMSG_LENGTH (size);
+ static uint32_t counter = 0;
+
+ memset (buffer, 0, len);
+
+ header = (struct nlmsghdr *) buffer;
+ header->nlmsg_len = len;
+ header->nlmsg_type = type;
+ header->nlmsg_flags = flags | NLM_F_REQUEST;
+ header->nlmsg_seq = counter++;
+ header->nlmsg_pid = getpid ();
+
+ return (struct nlmsghdr *) header;
+}
+
+void
+loopback_setup (void)
+{
+ int r, if_loopback;
+ cleanup_fd int rtnl_fd = -1;
+ char buffer[1024];
+ struct sockaddr_nl src_addr = { AF_NETLINK, 0 };
+ struct nlmsghdr *header;
+ struct ifaddrmsg *addmsg;
+ struct ifinfomsg *infomsg;
+ struct in_addr *ip_addr;
+
+ src_addr.nl_pid = getpid ();
+
+ if_loopback = (int) if_nametoindex ("lo");
+ if (if_loopback <= 0)
+ die_with_error ("loopback: Failed to look up lo");
+
+ rtnl_fd = socket (PF_NETLINK, SOCK_RAW | SOCK_CLOEXEC, NETLINK_ROUTE);
+ if (rtnl_fd < 0)
+ die_with_error ("loopback: Failed to create NETLINK_ROUTE socket");
+
+ r = bind (rtnl_fd, (struct sockaddr *) &src_addr, sizeof (src_addr));
+ if (r < 0)
+ die_with_error ("loopback: Failed to bind NETLINK_ROUTE socket");
+
+ header = rtnl_setup_request (buffer, RTM_NEWADDR,
+ NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK,
+ sizeof (struct ifaddrmsg));
+ addmsg = NLMSG_DATA (header);
+
+ addmsg->ifa_family = AF_INET;
+ addmsg->ifa_prefixlen = 8;
+ addmsg->ifa_flags = IFA_F_PERMANENT;
+ addmsg->ifa_scope = RT_SCOPE_HOST;
+ addmsg->ifa_index = if_loopback;
+
+ ip_addr = add_rta (header, IFA_LOCAL, sizeof (*ip_addr));
+ ip_addr->s_addr = htonl (INADDR_LOOPBACK);
+
+ ip_addr = add_rta (header, IFA_ADDRESS, sizeof (*ip_addr));
+ ip_addr->s_addr = htonl (INADDR_LOOPBACK);
+
+ assert (header->nlmsg_len < sizeof (buffer));
+
+ if (rtnl_do_request (rtnl_fd, header) != 0)
+ die_with_error ("loopback: Failed RTM_NEWADDR");
+
+ header = rtnl_setup_request (buffer, RTM_NEWLINK,
+ NLM_F_ACK,
+ sizeof (struct ifinfomsg));
+ infomsg = NLMSG_DATA (header);
+
+ infomsg->ifi_family = AF_UNSPEC;
+ infomsg->ifi_type = 0;
+ infomsg->ifi_index = if_loopback;
+ infomsg->ifi_flags = IFF_UP;
+ infomsg->ifi_change = IFF_UP;
+
+ assert (header->nlmsg_len < sizeof (buffer));
+
+ if (rtnl_do_request (rtnl_fd, header) != 0)
+ die_with_error ("loopback: Failed RTM_NEWLINK");
+}
diff -Nuar flatpak-1.0.0.orig/bubblewrap/network.h flatpak-1.0.0/bubblewrap/network.h
--- flatpak-1.0.0.orig/bubblewrap/network.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/network.h 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,21 @@
+/* bubblewrap
+ * Copyright (C) 2016 Alexander Larsson
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+void loopback_setup (void);
diff -Nuar flatpak-1.0.0.orig/bubblewrap/packaging/bubblewrap.spec flatpak-1.0.0/bubblewrap/packaging/bubblewrap.spec
--- flatpak-1.0.0.orig/bubblewrap/packaging/bubblewrap.spec 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/packaging/bubblewrap.spec 2018-02-03 21:26:06.273233339 +0300
@@ -0,0 +1,49 @@
+%global commit0 66d12bb23b04e201c5846e325f0b10930ed802f8
+%global shortcommit0 %(c=%{commit0}; echo ${c:0:7})
+
+Summary: Core execution tool for unprivileged containers
+Name: bubblewrap
+Version: 0
+Release: 1%{?dist}
+#VCS: git:https://github.com/projectatomic/bubblewrap
+Source0: https://github.com/projectatomic/%{name}/archive/%{commit0}.tar.gz#/%{name}-%{shortcommit0}.tar.gz
+License: LGPLv2+
+URL: https://github.com/projectatomic/bubblewrap
+
+BuildRequires: git
+# We always run autogen.sh
+BuildRequires: autoconf automake libtool
+BuildRequires: libcap-devel
+BuildRequires: pkgconfig(libselinux)
+BuildRequires: libxslt
+BuildRequires: docbook-style-xsl
+
+%description
+Bubblewrap (/usr/bin/bwrap) is a core execution engine for unprivileged
+containers that works as a setuid binary on kernels without
+user namespaces.
+
+%prep
+%autosetup -Sgit -n %{name}-%{version}
+
+%build
+env NOCONFIGURE=1 ./autogen.sh
+%configure --disable-silent-rules --with-priv-mode=none
+
+make %{?_smp_mflags}
+
+%install
+make install DESTDIR=$RPM_BUILD_ROOT INSTALL="install -p -c"
+find $RPM_BUILD_ROOT -name '*.la' -delete
+
+%files
+%license COPYING
+%doc README.md
+%{_datadir}/bash-completion/completions/bwrap
+%if (0%{?rhel} != 0 && 0%{?rhel} <= 7)
+%attr(4755,root,root) %{_bindir}/bwrap
+%else
+%{_bindir}/bwrap
+%endif
+%{_mandir}/man1/*
+
diff -Nuar flatpak-1.0.0.orig/bubblewrap/README.md flatpak-1.0.0/bubblewrap/README.md
--- flatpak-1.0.0.orig/bubblewrap/README.md 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/README.md 2018-02-03 21:26:06.272233339 +0300
@@ -0,0 +1,179 @@
+Bubblewrap
+==========
+
+Many container runtime tools like `systemd-nspawn`, `docker`,
+etc. focus on providing infrastructure for system administrators and
+orchestration tools (e.g. Kubernetes) to run containers.
+
+These tools are not suitable to give to unprivileged users, because it
+is trivial to turn such access into to a fully privileged root shell
+on the host.
+
+User namespaces
+---------------
+
+There is an effort in the Linux kernel called
+[user namespaces](https://www.google.com/search?q=user+namespaces+site%3Ahttps%3A%2F%2Flwn.net)
+which attempts to allow unprivileged users to use container features.
+While significant progress has been made, there are
+[still concerns](https://lwn.net/Articles/673597/) about it, and
+it is not available to unprivileged users in several production distributions
+such as CentOS/Red Hat Enterprise Linux 7, Debian Jessie, etc.
+
+See for example
+[CVE-2016-3135](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3135)
+which is a local root vulnerability introduced by userns.
+[This March 2016 post](https://lkml.org/lkml/2016/3/9/555) has some
+more discussion.
+
+Bubblewrap could be viewed as setuid implementation of a *subset* of
+user namespaces. Emphasis on subset - specifically relevant to the
+above CVE, bubblewrap does not allow control over iptables.
+
+The original bubblewrap code existed before user namespaces - it inherits code from
+[xdg-app helper](https://cgit.freedesktop.org/xdg-app/xdg-app/tree/common/xdg-app-helper.c)
+which in turn distantly derives from
+[linux-user-chroot](https://git.gnome.org/browse/linux-user-chroot).
+
+Security
+--------
+
+The maintainers of this tool believe that it does not, even when used
+in combination with typical software installed on that distribution,
+allow privilege escalation. It may increase the ability of a logged
+in user to perform denial of service attacks, however.
+
+In particular, bubblewrap uses `PR_SET_NO_NEW_PRIVS` to turn off
+setuid binaries, which is the [traditional way](https://en.wikipedia.org/wiki/Chroot#Limitations) to get out of things
+like chroots.
+
+Users
+-----
+
+This program can be shared by all container tools which perform
+non-root operation, such as:
+
+ - [Flatpak](http://www.flatpak.org)
+ - [rpm-ostree unprivileged](https://github.com/projectatomic/rpm-ostree/pull/209)
+
+We would also like to see this be available in Kubernetes/OpenShift
+clusters. Having the ability for unprivileged users to use container
+features would make it significantly easier to do interactive
+debugging scenarios and the like.
+
+Usage
+-----
+
+bubblewrap works by creating a new, completely empty, mount
+namespace where the root is on a tmpfs that is invisible from the
+host, and will be automatically cleaned up when the last process
+exits. You can then use commandline options to construct the root
+filesystem and process environment and command to run in the
+namespace.
+
+There's a larger [demo script](./demos/bubblewrap-shell.sh) in the
+source code, but here's a trimmed down version which runs
+a new shell reusing the host's `/usr`.
+
+```
+bwrap --ro-bind /usr /usr --symlink usr/lib64 /lib64 --proc /proc --dev /dev --unshare-pid bash
+```
+
+This is an incomplete example, but useful for purposes of
+illustration. More often, rather than creating a container using the
+host's filesystem tree, you want to target a chroot. There, rather
+than creating the symlink `lib64 -> usr/lib64` in the tmpfs, you might
+have already created it in the target rootfs.
+
+Sandboxing
+----------
+
+The goal of bubblewrap is to run an application in a sandbox, where it
+has restricted access to parts of the operating system or user data
+such as the home directory.
+
+bubblewrap always creates a new mount namespace, and the user can specify
+exactly what parts of the filesystem should be visible in the sandbox.
+Any such directories you specify mounted `nodev` by default, and can be made readonly.
+
+Additionally you can use these kernel features:
+
+User namespaces ([CLONE_NEWUSER](http://linux.die.net/man/2/clone)): This hides all but the current uid and gid from the
+sandbox. You can also change what the value of uid/gid should be in the sandbox.
+
+IPC namespaces ([CLONE_NEWIPC](http://linux.die.net/man/2/clone)): The sandbox will get its own copy of all the
+different forms of IPCs, like SysV shared memory and semaphores.
+
+PID namespaces ([CLONE_NEWPID](http://linux.die.net/man/2/clone)): The sandbox will not see any processes outside the sandbox. Additionally, bubblewrap will run a trivial pid1 inside your container to handle the requirements of reaping children in the sandbox. .This avoids what is known now as the [Docker pid 1 problem](https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping-problem/).
+
+
+Network namespaces ([CLONE_NEWNET](http://linux.die.net/man/2/clone)): The sandbox will not see the network. Instead it will have its own network namespace with only a loopback device.
+
+UTS namespace ([CLONE_NEWUTS](http://linux.die.net/man/2/clone)): The sandbox will have its own hostname.
+
+Seccomp filters: You can pass in seccomp filters that limit which syscalls can be done in the sandbox. For more information, see [Seccomp](https://en.wikipedia.org/wiki/Seccomp).
+
+Related project comparison: Firejail
+------------------------------------
+
+[Firejail](https://github.com/netblue30/firejail/tree/master/src/firejail)
+is similar to Flatpak before bubblewrap was split out in that it combines
+a setuid tool with a lot of desktop-specific sandboxing features. For
+example, Firejail knows about Pulseaudio, whereas bubblewrap does not.
+
+The bubblewrap authors believe it's much easier to audit a small
+setuid program, and keep features such as Pulseaudio filtering as an
+unprivileged process, as now occurs in Flatpak.
+
+Also, @cgwalters thinks trying to
+[whitelist file paths](https://github.com/netblue30/firejail/blob/37a5a3545ef6d8d03dad8bbd888f53e13274c9e5/src/firejail/fs_whitelist.c#L176)
+is a bad idea given the myriad ways users have to manipulate paths,
+and the myriad ways in which system administrators may configure a
+system. The bubblewrap approach is to only retain a few specific
+Linux capabilities such as `CAP_SYS_ADMIN`, but to always access the
+filesystem as the invoking uid. This entirely closes
+[TOCTTOU attacks](https://cwe.mitre.org/data/definitions/367.html) and
+such.
+
+Related project comparison: Sandstorm.io
+----------------------------------------
+
+[Sandstorm.io](https://sandstorm.io/) requries unprivileged user
+namespaces to set up its sandbox, though it could easily be adapted
+to operate in a setuid mode as well. @cgwalters believes their code is
+fairly good, but it could still make sense to unify on bubblewrap.
+However, @kentonv (of Sandstorm) feels that while this makes sense
+in principle, the switching cost outweighs the practical benefits for
+now. This decision could be re-evaluated in the future, but it is not
+being actively pursued today.
+
+Related project comparison: runc/binctr
+----------------------------------------
+
+[runC](https://github.com/opencontainers/runc) is currently working on
+supporting [rootless containers](https://github.com/opencontainers/runc/pull/774),
+without needing `setuid` or any other privileges during installation of
+runC (using unprivileged user namespaces rather than `setuid`),
+creation, and management of containers. However, the standard mode of
+using runC is similar to [systemd nspawn](https://www.freedesktop.org/software/systemd/man/systemd-nspawn.html)
+in that it is tooling intended to be invoked by root.
+
+The bubblewrap authors believe that runc and systemd-nspawn are not
+designed to be made setuid, and are distant from supporting such a mode.
+However with rootless containers, runC will be able to fulfill certain usecases
+that bubblewrap supports (with the added benefit of being a standardised and
+complete OCI runtime).
+
+[binctr](https://github.com/jfrazelle/binctr) is just a wrapper for
+runC, so inherits all of its design tradeoffs.
+
+Whats with the name ?!
+----------------------
+
+The name bubblewrap was chosen to convey that this
+tool runs as the parent of the application (so wraps it in some sense) and creates
+a protective layer (the sandbox) around it.
+
+![](bubblewrap.jpg)
+
+(Bubblewrap cat by [dancing_stupidity](https://www.flickr.com/photos/27549668@N03/))
diff -Nuar flatpak-1.0.0.orig/bubblewrap/.redhat-ci.yml flatpak-1.0.0/bubblewrap/.redhat-ci.yml
--- flatpak-1.0.0.orig/bubblewrap/.redhat-ci.yml 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/.redhat-ci.yml 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,25 @@
+context: centos7
+required: true
+
+branches:
+ - master
+ - auto
+ - try
+
+host:
+ distro: centos/7/atomic
+
+tests:
+ - env BWRAP_SUID=true ./ci/redhat-ci.sh centos:7
+
+timeout: 30m
+
+---
+
+inherit: true
+
+context: f25-asan-ubsan
+required: true
+
+tests:
+ - env CFLAGS='-g -Og -fsanitize=undefined -fsanitize=address' ./ci/redhat-ci.sh fedora:25
diff -Nuar flatpak-1.0.0.orig/bubblewrap/tests/test-run.sh flatpak-1.0.0/bubblewrap/tests/test-run.sh
--- flatpak-1.0.0.orig/bubblewrap/tests/test-run.sh 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/tests/test-run.sh 2018-02-03 21:26:06.274233339 +0300
@@ -0,0 +1,132 @@
+#!/bin/bash
+
+set -xeuo pipefail
+
+srcd=$(cd $(dirname $0) && pwd)
+bn=$(basename $0)
+tempdir=$(mktemp -d /var/tmp/tap-test.XXXXXX)
+touch ${tempdir}/.testtmp
+function cleanup () {
+ if test -n "${TEST_SKIP_CLEANUP:-}"; then
+ echo "Skipping cleanup of ${test_tmpdir}"
+ else if test -f ${tempdir}/.test; then
+ rm "${tempdir}" -rf
+ fi
+ fi
+}
+trap cleanup EXIT
+cd ${tempdir}
+
+: "${BWRAP:=bwrap}"
+
+skip () {
+ echo $@ 1>&2; exit 77
+}
+
+assert_not_reached () {
+ echo $@ 1>&2; exit 1
+}
+
+assert_file_has_content () {
+ if ! grep -q -e "$2" "$1"; then
+ echo 1>&2 "File '$1' doesn't match regexp '$2'"; exit 1
+ fi
+}
+
+FUSE_DIR=
+for mp in $(cat /proc/self/mounts | grep " fuse[. ]" | grep user_id=$(id -u) | awk '{print $2}'); do
+ if test -d $mp; then
+ echo Using $mp as test fuse mount
+ FUSE_DIR=$mp
+ break
+ fi
+done
+
+# This is supposed to be an otherwise readable file in an unreadable (by the user) dir
+UNREADABLE=/root/.bashrc
+if test -x `dirname $UNREADABLE`; then
+ UNREADABLE=
+fi
+
+# Default arg, bind whole host fs to /, tmpfs on /tmp
+RUN="${BWRAP} --bind / / --tmpfs /tmp"
+
+if ! $RUN true; then
+ skip Seems like bwrap is not working at all. Maybe setuid is not working
+fi
+
+# Test help
+${BWRAP} --help > help.txt
+assert_file_has_content help.txt "usage: ${BWRAP}"
+
+for ALT in "" "--unshare-user-try" "--unshare-pid" "--unshare-user-try --unshare-pid"; do
+ # Test fuse fs as bind source
+ if [ x$FUSE_DIR != x ]; then
+ $RUN $ALT --proc /proc --dev /dev --bind $FUSE_DIR /tmp/foo true
+ fi
+ # no --dev => no devpts => no map_root workaround
+ $RUN $ALT --proc /proc true
+ # No network
+ $RUN $ALT --unshare-net --proc /proc --dev /dev true
+ # Unreadable file
+ echo -n "expect EPERM: "
+ if $RUN $ALT --unshare-net --proc /proc --bind /etc/shadow /tmp/foo cat /etc/shadow; then
+ assert_not_reached Could read /etc/shadow
+ fi
+ # Unreadable dir
+ if [ x$UNREADABLE != x ]; then
+ echo -n "expect EPERM: "
+ if $RUN $ALT --unshare-net --proc /proc --dev /dev --bind $UNREADABLE /tmp/foo cat /tmp/foo ; then
+ assert_not_reached Could read $UNREADABLE
+ fi
+ fi
+
+ # bind dest in symlink (https://github.com/projectatomic/bubblewrap/pull/119)
+ $RUN $ALT --dir /tmp/dir --symlink dir /tmp/link --bind /etc /tmp/link true
+done
+
+# Test --die-with-parent
+
+cat >lockf-n.py <<EOF
+#!/usr/bin/env python
+import struct,fcntl,sys
+path = sys.argv[1]
+if sys.argv[2] == 'wait':
+ locktype = fcntl.F_SETLKW
+else:
+ locktype = fcntl.F_SETLK
+lockdata = struct.pack("hhllhh", fcntl.F_WRLCK, 0, 0, 0, 0, 0)
+fd=open(sys.argv[1], 'a')
+try:
+ fcntl.fcntl(fd.fileno(), locktype, lockdata)
+except IOError as e:
+ sys.exit(1)
+sys.exit(0)
+EOF
+chmod a+x lockf-n.py
+touch lock
+
+for die_with_parent_argv in "--die-with-parent" "--die-with-parent --unshare-pid"; do
+ /bin/bash -c "$RUN ${die_with_parent_argv} --lock-file $(pwd)/lock sleep 1h && true" &
+ childshellpid=$!
+
+ # Wait for lock to be taken (yes hacky)
+ for x in $(seq 10); do
+ if ./lockf-n.py ./lock nowait; then
+ sleep 1
+ else
+ break
+ fi
+ done
+ if ./lockf-n.py ./lock nowait; then
+ assert_not_reached "timed out waiting for lock"
+ fi
+
+ # Kill the shell, which should kill bwrap (and the sleep)
+ kill -9 ${childshellpid}
+ # Lock file should be unlocked
+ ./lockf-n.py ./lock wait
+ echo "ok die with parent ${die_with_parent_argv}"
+done
+
+echo OK
diff -Nuar flatpak-1.0.0.orig/bubblewrap/.travis.yml flatpak-1.0.0/bubblewrap/.travis.yml
--- flatpak-1.0.0.orig/bubblewrap/.travis.yml 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/.travis.yml 2018-02-03 21:26:06.271233339 +0300
@@ -0,0 +1,25 @@
+language: c
+dist: trusty
+addons:
+ apt:
+ packages:
+ - automake
+ - autotools-dev
+ - libcap-dev
+script:
+ - env NOCONFIGURE=1 ./autogen.sh
+ - mkdir build
+ - cd build && ../configure
+ - make -j 2
+ - make check
+
+notifications:
+ # This is Colin's instance of Homu, in the future
+ # we'll move this to a production cluster.
+ webhooks: http://escher.verbum.org:54856/travis
+ email: false
+
+branches:
+ only:
+ - auto
+
diff -Nuar flatpak-1.0.0.orig/bubblewrap/uncrustify.cfg flatpak-1.0.0/bubblewrap/uncrustify.cfg
--- flatpak-1.0.0.orig/bubblewrap/uncrustify.cfg 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/uncrustify.cfg 2018-02-03 21:26:06.274233339 +0300
@@ -0,0 +1,136 @@
+newlines lf
+
+input_tab_size 8
+output_tab_size 8
+
+string_escape_char 92
+string_escape_char2 0
+
+# indenting
+indent_columns 2
+indent_with_tabs 0
+indent_align_string True
+indent_brace 2
+indent_braces false
+indent_braces_no_func True
+indent_func_call_param false
+indent_func_def_param false
+indent_func_proto_param false
+indent_switch_case 0
+indent_case_brace 2
+indent_paren_close 1
+
+# spacing
+sp_arith Add
+sp_assign Add
+sp_enum_assign Add
+sp_bool Add
+sp_compare Add
+sp_inside_paren Remove
+sp_inside_fparens Remove
+sp_func_def_paren Force
+sp_func_proto_paren Force
+sp_paren_paren Remove
+sp_balance_nested_parens False
+sp_paren_brace Remove
+sp_before_square Remove
+sp_before_squares Remove
+sp_inside_square Remove
+sp_before_ptr_star Add
+sp_between_ptr_star Remove
+sp_after_comma Add
+sp_before_comma Remove
+sp_after_cast Add
+sp_sizeof_paren Add
+sp_not Remove
+sp_inv Remove
+sp_addr Remove
+sp_member Remove
+sp_deref Remove
+sp_sign Remove
+sp_incdec Remove
+sp_attribute_paren remove
+sp_macro Force
+sp_func_call_paren Force
+sp_func_call_user_paren Remove
+set func_call_user _ N_ C_ g_autoptr g_auto
+sp_brace_typedef add
+sp_cond_colon add
+sp_cond_question add
+sp_defined_paren remove
+
+# alignment
+align_keep_tabs False
+align_with_tabs False
+align_on_tabstop False
+align_number_left True
+align_func_params True
+align_var_def_span 0
+align_var_def_amp_style 1
+align_var_def_colon true
+align_enum_equ_span 0
+align_var_struct_span 2
+align_var_def_star_style 2
+align_var_def_amp_style 2
+align_typedef_span 2
+align_typedef_func 0
+align_typedef_star_style 2
+align_typedef_amp_style 2
+
+# newlines
+nl_assign_leave_one_liners True
+nl_enum_leave_one_liners False
+nl_func_leave_one_liners False
+nl_if_leave_one_liners False
+nl_end_of_file Add
+nl_assign_brace Remove
+nl_func_var_def_blk 1
+nl_fcall_brace Add
+nl_enum_brace Remove
+nl_struct_brace Force
+nl_union_brace Force
+nl_if_brace Force
+nl_brace_else Force
+nl_elseif_brace Force
+nl_else_brace Add
+nl_for_brace Force
+nl_while_brace Force
+nl_do_brace Force
+nl_brace_while Force
+nl_switch_brace Force
+nl_before_case True
+nl_after_case False
+nl_func_type_name Force
+nl_func_proto_type_name Remove
+nl_func_paren Remove
+nl_func_decl_start Remove
+nl_func_decl_args Force
+nl_func_decl_end Remove
+nl_fdef_brace Force
+nl_after_return False
+nl_define_macro False
+nl_create_if_one_liner False
+nl_create_for_one_liner False
+nl_create_while_one_liner False
+nl_after_semicolon True
+nl_multi_line_cond true
+
+# mod
+# I'd like these to be remove, but that removes brackets in if { if { foo } }, which i dislike
+# Not clear what to do about that...
+mod_full_brace_for Remove
+mod_full_brace_if Remove
+mod_full_brace_if_chain True
+mod_full_brace_while Remove
+mod_full_brace_do Remove
+mod_full_brace_nl 3
+mod_paren_on_return Remove
+
+# line splitting
+#code_width = 78
+ls_for_split_full True
+ls_func_split_full True
+
+# positioning
+pos_bool Trail
+pos_conditional Trail
diff -Nuar flatpak-1.0.0.orig/bubblewrap/uncrustify.sh flatpak-1.0.0/bubblewrap/uncrustify.sh
--- flatpak-1.0.0.orig/bubblewrap/uncrustify.sh 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/uncrustify.sh 2018-02-03 21:26:06.274233339 +0300
@@ -0,0 +1,2 @@
+#!/bin/sh
+uncrustify -c uncrustify.cfg --no-backup `git ls-tree --name-only -r HEAD | grep \\\.[ch]$`
diff -Nuar flatpak-1.0.0.orig/bubblewrap/utils.c flatpak-1.0.0/bubblewrap/utils.c
--- flatpak-1.0.0.orig/bubblewrap/utils.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/utils.c 2018-02-03 21:26:06.274233339 +0300
@@ -0,0 +1,709 @@
+/* bubblewrap
+ * Copyright (C) 2016 Alexander Larsson
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "config.h"
+
+#include "utils.h"
+#include <sys/syscall.h>
+#ifdef HAVE_SELINUX
+#include <selinux/selinux.h>
+#endif
+
+void
+die_with_error (const char *format, ...)
+{
+ va_list args;
+ int errsv;
+
+ errsv = errno;
+
+ va_start (args, format);
+ vfprintf (stderr, format, args);
+ va_end (args);
+
+ fprintf (stderr, ": %s\n", strerror (errsv));
+
+ exit (1);
+}
+
+void
+die (const char *format, ...)
+{
+ va_list args;
+
+ va_start (args, format);
+ vfprintf (stderr, format, args);
+ va_end (args);
+
+ fprintf (stderr, "\n");
+
+ exit (1);
+}
+
+void
+die_unless_label_valid (const char *label)
+{
+#ifdef HAVE_SELINUX
+ if (is_selinux_enabled () == 1)
+ {
+ if (security_check_context ((security_context_t) label) < 0)
+ die_with_error ("invalid label %s", label);
+ return;
+ }
+#endif
+ die ("labeling not supported on this system");
+}
+
+void
+die_oom (void)
+{
+ puts ("Out of memory");
+ exit (1);
+}
+
+void *
+xmalloc (size_t size)
+{
+ void *res = malloc (size);
+
+ if (res == NULL)
+ die_oom ();
+ return res;
+}
+
+void *
+xcalloc (size_t size)
+{
+ void *res = calloc (1, size);
+
+ if (res == NULL)
+ die_oom ();
+ return res;
+}
+
+void *
+xrealloc (void *ptr, size_t size)
+{
+ void *res = realloc (ptr, size);
+
+ if (size != 0 && res == NULL)
+ die_oom ();
+ return res;
+}
+
+char *
+xstrdup (const char *str)
+{
+ char *res;
+
+ assert (str != NULL);
+
+ res = strdup (str);
+ if (res == NULL)
+ die_oom ();
+
+ return res;
+}
+
+void
+strfreev (char **str_array)
+{
+ if (str_array)
+ {
+ int i;
+
+ for (i = 0; str_array[i] != NULL; i++)
+ free (str_array[i]);
+
+ free (str_array);
+ }
+}
+
+/* Compares if str has a specific path prefix. This differs
+ from a regular prefix in two ways. First of all there may
+ be multiple slashes separating the path elements, and
+ secondly, if a prefix is matched that has to be en entire
+ path element. For instance /a/prefix matches /a/prefix/foo/bar,
+ but not /a/prefixfoo/bar. */
+bool
+has_path_prefix (const char *str,
+ const char *prefix)
+{
+ while (TRUE)
+ {
+ /* Skip consecutive slashes to reach next path
+ element */
+ while (*str == '/')
+ str++;
+ while (*prefix == '/')
+ prefix++;
+
+ /* No more prefix path elements? Done! */
+ if (*prefix == 0)
+ return TRUE;
+
+ /* Compare path element */
+ while (*prefix != 0 && *prefix != '/')
+ {
+ if (*str != *prefix)
+ return FALSE;
+ str++;
+ prefix++;
+ }
+
+ /* Matched prefix path element,
+ must be entire str path element */
+ if (*str != '/' && *str != 0)
+ return FALSE;
+ }
+}
+
+bool
+path_equal (const char *path1,
+ const char *path2)
+{
+ while (TRUE)
+ {
+ /* Skip consecutive slashes to reach next path
+ element */
+ while (*path1 == '/')
+ path1++;
+ while (*path2 == '/')
+ path2++;
+
+ /* No more prefix path elements? Done! */
+ if (*path1 == 0 || *path2 == 0)
+ return *path1 == 0 && *path2 == 0;
+
+ /* Compare path element */
+ while (*path1 != 0 && *path1 != '/')
+ {
+ if (*path1 != *path2)
+ return FALSE;
+ path1++;
+ path2++;
+ }
+
+ /* Matched path1 path element, must be entire path element */
+ if (*path2 != '/' && *path2 != 0)
+ return FALSE;
+ }
+}
+
+
+bool
+has_prefix (const char *str,
+ const char *prefix)
+{
+ return strncmp (str, prefix, strlen (prefix)) == 0;
+}
+
+void
+xsetenv (const char *name, const char *value, int overwrite)
+{
+ if (setenv (name, value, overwrite))
+ die ("setenv failed");
+}
+
+void
+xunsetenv (const char *name)
+{
+ if (unsetenv (name))
+ die ("unsetenv failed");
+}
+
+char *
+strconcat (const char *s1,
+ const char *s2)
+{
+ size_t len = 0;
+ char *res;
+
+ if (s1)
+ len += strlen (s1);
+ if (s2)
+ len += strlen (s2);
+
+ res = xmalloc (len + 1);
+ *res = 0;
+ if (s1)
+ strcat (res, s1);
+ if (s2)
+ strcat (res, s2);
+
+ return res;
+}
+
+char *
+strconcat3 (const char *s1,
+ const char *s2,
+ const char *s3)
+{
+ size_t len = 0;
+ char *res;
+
+ if (s1)
+ len += strlen (s1);
+ if (s2)
+ len += strlen (s2);
+ if (s3)
+ len += strlen (s3);
+
+ res = xmalloc (len + 1);
+ *res = 0;
+ if (s1)
+ strcat (res, s1);
+ if (s2)
+ strcat (res, s2);
+ if (s3)
+ strcat (res, s3);
+
+ return res;
+}
+
+char *
+xasprintf (const char *format,
+ ...)
+{
+ char *buffer = NULL;
+ va_list args;
+
+ va_start (args, format);
+ if (vasprintf (&buffer, format, args) == -1)
+ die_oom ();
+ va_end (args);
+
+ return buffer;
+}
+
+int
+fdwalk (int proc_fd, int (*cb)(void *data,
+ int fd), void *data)
+{
+ int open_max;
+ int fd;
+ int dfd;
+ int res = 0;
+ DIR *d;
+
+ dfd = openat (proc_fd, "self/fd", O_DIRECTORY | O_RDONLY | O_NONBLOCK | O_CLOEXEC | O_NOCTTY);
+ if (dfd == -1)
+ return res;
+
+ if ((d = fdopendir (dfd)))
+ {
+ struct dirent *de;
+
+ while ((de = readdir (d)))
+ {
+ long l;
+ char *e = NULL;
+
+ if (de->d_name[0] == '.')
+ continue;
+
+ errno = 0;
+ l = strtol (de->d_name, &e, 10);
+ if (errno != 0 || !e || *e)
+ continue;
+
+ fd = (int) l;
+
+ if ((long) fd != l)
+ continue;
+
+ if (fd == dirfd (d))
+ continue;
+
+ if ((res = cb (data, fd)) != 0)
+ break;
+ }
+
+ closedir (d);
+ return res;
+ }
+
+ open_max = sysconf (_SC_OPEN_MAX);
+
+ for (fd = 0; fd < open_max; fd++)
+ if ((res = cb (data, fd)) != 0)
+ break;
+
+ return res;
+}
+
+/* Sets errno on error (!= 0), ENOSPC on short write */
+int
+write_to_fd (int fd,
+ const char *content,
+ ssize_t len)
+{
+ ssize_t res;
+
+ while (len > 0)
+ {
+ res = write (fd, content, len);
+ if (res < 0 && errno == EINTR)
+ continue;
+ if (res <= 0)
+ {
+ if (res == 0) /* Unexpected short write, should not happen when writing to a file */
+ errno = ENOSPC;
+ return -1;
+ }
+ len -= res;
+ content += res;
+ }
+
+ return 0;
+}
+
+/* Sets errno on error (!= 0), ENOSPC on short write */
+int
+write_file_at (int dirfd,
+ const char *path,
+ const char *content)
+{
+ int fd;
+ bool res;
+ int errsv;
+
+ fd = openat (dirfd, path, O_RDWR | O_CLOEXEC, 0);
+ if (fd == -1)
+ return -1;
+
+ res = 0;
+ if (content)
+ res = write_to_fd (fd, content, strlen (content));
+
+ errsv = errno;
+ close (fd);
+ errno = errsv;
+
+ return res;
+}
+
+/* Sets errno on error (!= 0), ENOSPC on short write */
+int
+create_file (const char *path,
+ mode_t mode,
+ const char *content)
+{
+ int fd;
+ int res;
+ int errsv;
+
+ fd = creat (path, mode);
+ if (fd == -1)
+ return -1;
+
+ res = 0;
+ if (content)
+ res = write_to_fd (fd, content, strlen (content));
+
+ errsv = errno;
+ close (fd);
+ errno = errsv;
+
+ return res;
+}
+
+int
+ensure_file (const char *path,
+ mode_t mode)
+{
+ struct stat buf;
+
+ /* We check this ahead of time, otherwise
+ the create file will fail in the read-only
+ case with EROFD instead of EEXIST */
+ if (stat (path, &buf) == 0 &&
+ S_ISREG (buf.st_mode))
+ return 0;
+
+ if (create_file (path, mode, NULL) != 0 && errno != EEXIST)
+ return -1;
+
+ return 0;
+}
+
+
+#define BUFSIZE 8192
+/* Sets errno on error (!= 0), ENOSPC on short write */
+int
+copy_file_data (int sfd,
+ int dfd)
+{
+ char buffer[BUFSIZE];
+ ssize_t bytes_read;
+
+ while (TRUE)
+ {
+ bytes_read = read (sfd, buffer, BUFSIZE);
+ if (bytes_read == -1)
+ {
+ if (errno == EINTR)
+ continue;
+
+ return -1;
+ }
+
+ if (bytes_read == 0)
+ break;
+
+ if (write_to_fd (dfd, buffer, bytes_read) != 0)
+ return -1;
+ }
+
+ return 0;
+}
+
+/* Sets errno on error (!= 0), ENOSPC on short write */
+int
+copy_file (const char *src_path,
+ const char *dst_path,
+ mode_t mode)
+{
+ int sfd;
+ int dfd;
+ int res;
+ int errsv;
+
+ sfd = open (src_path, O_CLOEXEC | O_RDONLY);
+ if (sfd == -1)
+ return -1;
+
+ dfd = creat (dst_path, mode);
+ if (dfd == -1)
+ {
+ errsv = errno;
+ close (sfd);
+ errno = errsv;
+ return -1;
+ }
+
+ res = copy_file_data (sfd, dfd);
+
+ errsv = errno;
+ close (sfd);
+ close (dfd);
+ errno = errsv;
+
+ return res;
+}
+
+/* Sets errno on error (== NULL),
+ * Always ensures terminating zero */
+char *
+load_file_data (int fd,
+ size_t *size)
+{
+ cleanup_free char *data = NULL;
+ ssize_t data_read;
+ ssize_t data_len;
+ ssize_t res;
+ int errsv;
+
+ data_read = 0;
+ data_len = 4080;
+ data = xmalloc (data_len);
+
+ do
+ {
+ if (data_len == data_read + 1)
+ {
+ data_len *= 2;
+ data = xrealloc (data, data_len);
+ }
+
+ do
+ res = read (fd, data + data_read, data_len - data_read - 1);
+ while (res < 0 && errno == EINTR);
+
+ if (res < 0)
+ {
+ errsv = errno;
+ close (fd);
+ errno = errsv;
+ return NULL;
+ }
+
+ data_read += res;
+ }
+ while (res > 0);
+
+ data[data_read] = 0;
+
+ if (size)
+ *size = (size_t) data_read;
+
+ return steal_pointer (&data);
+}
+
+/* Sets errno on error (== NULL),
+ * Always ensures terminating zero */
+char *
+load_file_at (int dirfd,
+ const char *path)
+{
+ int fd;
+ char *data;
+ int errsv;
+
+ fd = openat (dirfd, path, O_CLOEXEC | O_RDONLY);
+ if (fd == -1)
+ return NULL;
+
+ data = load_file_data (fd, NULL);
+
+ errsv = errno;
+ close (fd);
+ errno = errsv;
+
+ return data;
+}
+
+/* Sets errno on error (< 0) */
+int
+get_file_mode (const char *pathname)
+{
+ struct stat buf;
+
+ if (stat (pathname, &buf) != 0)
+ return -1;
+
+ return buf.st_mode & S_IFMT;
+}
+
+/* Sets errno on error (!= 0) */
+int
+mkdir_with_parents (const char *pathname,
+ int mode,
+ bool create_last)
+{
+ cleanup_free char *fn = NULL;
+ char *p;
+ struct stat buf;
+
+ if (pathname == NULL || *pathname == '\0')
+ {
+ errno = EINVAL;
+ return -1;
+ }
+
+ fn = xstrdup (pathname);
+
+ p = fn;
+ while (*p == '/')
+ p++;
+
+ do
+ {
+ while (*p && *p != '/')
+ p++;
+
+ if (!*p)
+ p = NULL;
+ else
+ *p = '\0';
+
+ if (!create_last && p == NULL)
+ break;
+
+ if (stat (fn, &buf) != 0)
+ {
+ if (mkdir (fn, mode) == -1 && errno != EEXIST)
+ return -1;
+ }
+ else if (!S_ISDIR (buf.st_mode))
+ {
+ errno = ENOTDIR;
+ return -1;
+ }
+
+ if (p)
+ {
+ *p++ = '/';
+ while (*p && *p == '/')
+ p++;
+ }
+ }
+ while (p);
+
+ return 0;
+}
+
+int
+raw_clone (unsigned long flags,
+ void *child_stack)
+{
+#if defined(__s390__) || defined(__CRIS__)
+ /* On s390 and cris the order of the first and second arguments
+ * of the raw clone() system call is reversed. */
+ return (int) syscall (__NR_clone, child_stack, flags);
+#else
+ return (int) syscall (__NR_clone, flags, child_stack);
+#endif
+}
+
+int
+pivot_root (const char * new_root, const char * put_old)
+{
+#ifdef __NR_pivot_root
+ return syscall (__NR_pivot_root, new_root, put_old);
+#else
+ errno = ENOSYS;
+ return -1;
+#endif
+}
+
+char *
+label_mount (const char *opt, const char *mount_label)
+{
+#ifdef HAVE_SELINUX
+ if (mount_label)
+ {
+ if (opt)
+ return xasprintf ("%s,context=\"%s\"", opt, mount_label);
+ else
+ return xasprintf ("context=\"%s\"", mount_label);
+ }
+#endif
+ if (opt)
+ return xstrdup (opt);
+ return NULL;
+}
+
+int
+label_create_file (const char *file_label)
+{
+#ifdef HAVE_SELINUX
+ if (is_selinux_enabled () > 0 && file_label)
+ return setfscreatecon ((security_context_t) file_label);
+#endif
+ return 0;
+}
+
+int
+label_exec (const char *exec_label)
+{
+#ifdef HAVE_SELINUX
+ if (is_selinux_enabled () > 0 && exec_label)
+ return setexeccon ((security_context_t) exec_label);
+#endif
+ return 0;
+}
diff -Nuar flatpak-1.0.0.orig/bubblewrap/utils.h flatpak-1.0.0/bubblewrap/utils.h
--- flatpak-1.0.0.orig/bubblewrap/utils.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/bubblewrap/utils.h 2018-02-03 21:26:06.274233339 +0300
@@ -0,0 +1,166 @@
+/* bubblewrap
+ * Copyright (C) 2016 Alexander Larsson
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#pragma once
+
+#include <assert.h>
+#include <dirent.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#if 0
+#define __debug__(x) printf x
+#else
+#define __debug__(x)
+#endif
+
+#define UNUSED __attribute__((__unused__))
+
+#define N_ELEMENTS(arr) (sizeof (arr) / sizeof ((arr)[0]))
+
+#define TRUE 1
+#define FALSE 0
+typedef int bool;
+
+#define PIPE_READ_END 0
+#define PIPE_WRITE_END 1
+
+void die_with_error (const char *format,
+ ...) __attribute__((__noreturn__)) __attribute__((format (printf, 1, 2)));
+void die (const char *format,
+ ...) __attribute__((__noreturn__)) __attribute__((format (printf, 1, 2)));
+void die_oom (void) __attribute__((__noreturn__));
+void die_unless_label_valid (const char *label);
+
+void *xmalloc (size_t size);
+void *xcalloc (size_t size);
+void *xrealloc (void *ptr,
+ size_t size);
+char *xstrdup (const char *str);
+void strfreev (char **str_array);
+void xsetenv (const char *name,
+ const char *value,
+ int overwrite);
+void xunsetenv (const char *name);
+char *strconcat (const char *s1,
+ const char *s2);
+char *strconcat3 (const char *s1,
+ const char *s2,
+ const char *s3);
+char * xasprintf (const char *format,
+ ...) __attribute__((format (printf, 1, 2)));
+bool has_prefix (const char *str,
+ const char *prefix);
+bool has_path_prefix (const char *str,
+ const char *prefix);
+bool path_equal (const char *path1,
+ const char *path2);
+int fdwalk (int proc_fd,
+ int (*cb)(void *data,
+ int fd),
+ void *data);
+char *load_file_data (int fd,
+ size_t *size);
+char *load_file_at (int dirfd,
+ const char *path);
+int write_file_at (int dirfd,
+ const char *path,
+ const char *content);
+int write_to_fd (int fd,
+ const char *content,
+ ssize_t len);
+int copy_file_data (int sfd,
+ int dfd);
+int copy_file (const char *src_path,
+ const char *dst_path,
+ mode_t mode);
+int create_file (const char *path,
+ mode_t mode,
+ const char *content);
+int ensure_file (const char *path,
+ mode_t mode);
+int get_file_mode (const char *pathname);
+int mkdir_with_parents (const char *pathname,
+ int mode,
+ bool create_last);
+
+/* syscall wrappers */
+int raw_clone (unsigned long flags,
+ void *child_stack);
+int pivot_root (const char *new_root,
+ const char *put_old);
+char *label_mount (const char *opt,
+ const char *mount_label);
+int label_exec (const char *exec_label);
+int label_create_file (const char *file_label);
+
+static inline void
+cleanup_freep (void *p)
+{
+ void **pp = (void **) p;
+
+ if (*pp)
+ free (*pp);
+}
+
+static inline void
+cleanup_strvp (void *p)
+{
+ void **pp = (void **) p;
+
+ strfreev (*pp);
+}
+
+static inline void
+cleanup_fdp (int *fdp)
+{
+ int fd;
+
+ assert (fdp);
+
+ fd = *fdp;
+ if (fd != -1)
+ (void) close (fd);
+}
+
+#define cleanup_free __attribute__((cleanup (cleanup_freep)))
+#define cleanup_fd __attribute__((cleanup (cleanup_fdp)))
+#define cleanup_strv __attribute__((cleanup (cleanup_strvp)))
+
+static inline void *
+steal_pointer (void *pp)
+{
+ void **ptr = (void **) pp;
+ void *ref;
+
+ ref = *ptr;
+ *ptr = NULL;
+
+ return ref;
+}
+
+/* type safety */
+#define steal_pointer(pp) \
+ (0 ? (*(pp)) : (steal_pointer) (pp))
diff -Nuar flatpak-1.0.0.orig/libglnx/COPYING flatpak-1.0.0/libglnx/COPYING
--- flatpak-1.0.0.orig/libglnx/COPYING 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/COPYING 2018-02-03 21:26:06.307233341 +0300
@@ -0,0 +1,502 @@
+ GNU LESSER GENERAL PUBLIC LICENSE
+ Version 2.1, February 1999
+
+ Copyright (C) 1991, 1999 Free Software Foundation, Inc.
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+[This is the first released version of the Lesser GPL. It also counts
+ as the successor of the GNU Library Public License, version 2, hence
+ the version number 2.1.]
+
+ Preamble
+
+ The licenses for most software are designed to take away your
+freedom to share and change it. By contrast, the GNU General Public
+Licenses are intended to guarantee your freedom to share and change
+free software--to make sure the software is free for all its users.
+
+ This license, the Lesser General Public License, applies to some
+specially designated software packages--typically libraries--of the
+Free Software Foundation and other authors who decide to use it. You
+can use it too, but we suggest you first think carefully about whether
+this license or the ordinary General Public License is the better
+strategy to use in any particular case, based on the explanations below.
+
+ When we speak of free software, we are referring to freedom of use,
+not price. Our General Public Licenses are designed to make sure that
+you have the freedom to distribute copies of free software (and charge
+for this service if you wish); that you receive source code or can get
+it if you want it; that you can change the software and use pieces of
+it in new free programs; and that you are informed that you can do
+these things.
+
+ To protect your rights, we need to make restrictions that forbid
+distributors to deny you these rights or to ask you to surrender these
+rights. These restrictions translate to certain responsibilities for
+you if you distribute copies of the library or if you modify it.
+
+ For example, if you distribute copies of the library, whether gratis
+or for a fee, you must give the recipients all the rights that we gave
+you. You must make sure that they, too, receive or can get the source
+code. If you link other code with the library, you must provide
+complete object files to the recipients, so that they can relink them
+with the library after making changes to the library and recompiling
+it. And you must show them these terms so they know their rights.
+
+ We protect your rights with a two-step method: (1) we copyright the
+library, and (2) we offer you this license, which gives you legal
+permission to copy, distribute and/or modify the library.
+
+ To protect each distributor, we want to make it very clear that
+there is no warranty for the free library. Also, if the library is
+modified by someone else and passed on, the recipients should know
+that what they have is not the original version, so that the original
+author's reputation will not be affected by problems that might be
+introduced by others.
+
+ Finally, software patents pose a constant threat to the existence of
+any free program. We wish to make sure that a company cannot
+effectively restrict the users of a free program by obtaining a
+restrictive license from a patent holder. Therefore, we insist that
+any patent license obtained for a version of the library must be
+consistent with the full freedom of use specified in this license.
+
+ Most GNU software, including some libraries, is covered by the
+ordinary GNU General Public License. This license, the GNU Lesser
+General Public License, applies to certain designated libraries, and
+is quite different from the ordinary General Public License. We use
+this license for certain libraries in order to permit linking those
+libraries into non-free programs.
+
+ When a program is linked with a library, whether statically or using
+a shared library, the combination of the two is legally speaking a
+combined work, a derivative of the original library. The ordinary
+General Public License therefore permits such linking only if the
+entire combination fits its criteria of freedom. The Lesser General
+Public License permits more lax criteria for linking other code with
+the library.
+
+ We call this license the "Lesser" General Public License because it
+does Less to protect the user's freedom than the ordinary General
+Public License. It also provides other free software developers Less
+of an advantage over competing non-free programs. These disadvantages
+are the reason we use the ordinary General Public License for many
+libraries. However, the Lesser license provides advantages in certain
+special circumstances.
+
+ For example, on rare occasions, there may be a special need to
+encourage the widest possible use of a certain library, so that it becomes
+a de-facto standard. To achieve this, non-free programs must be
+allowed to use the library. A more frequent case is that a free
+library does the same job as widely used non-free libraries. In this
+case, there is little to gain by limiting the free library to free
+software only, so we use the Lesser General Public License.
+
+ In other cases, permission to use a particular library in non-free
+programs enables a greater number of people to use a large body of
+free software. For example, permission to use the GNU C Library in
+non-free programs enables many more people to use the whole GNU
+operating system, as well as its variant, the GNU/Linux operating
+system.
+
+ Although the Lesser General Public License is Less protective of the
+users' freedom, it does ensure that the user of a program that is
+linked with the Library has the freedom and the wherewithal to run
+that program using a modified version of the Library.
+
+ The precise terms and conditions for copying, distribution and
+modification follow. Pay close attention to the difference between a
+"work based on the library" and a "work that uses the library". The
+former contains code derived from the library, whereas the latter must
+be combined with the library in order to run.
+
+ GNU LESSER GENERAL PUBLIC LICENSE
+ TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+ 0. This License Agreement applies to any software library or other
+program which contains a notice placed by the copyright holder or
+other authorized party saying it may be distributed under the terms of
+this Lesser General Public License (also called "this License").
+Each licensee is addressed as "you".
+
+ A "library" means a collection of software functions and/or data
+prepared so as to be conveniently linked with application programs
+(which use some of those functions and data) to form executables.
+
+ The "Library", below, refers to any such software library or work
+which has been distributed under these terms. A "work based on the
+Library" means either the Library or any derivative work under
+copyright law: that is to say, a work containing the Library or a
+portion of it, either verbatim or with modifications and/or translated
+straightforwardly into another language. (Hereinafter, translation is
+included without limitation in the term "modification".)
+
+ "Source code" for a work means the preferred form of the work for
+making modifications to it. For a library, complete source code means
+all the source code for all modules it contains, plus any associated
+interface definition files, plus the scripts used to control compilation
+and installation of the library.
+
+ Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope. The act of
+running a program using the Library is not restricted, and output from
+such a program is covered only if its contents constitute a work based
+on the Library (independent of the use of the Library in a tool for
+writing it). Whether that is true depends on what the Library does
+and what the program that uses the Library does.
+
+ 1. You may copy and distribute verbatim copies of the Library's
+complete source code as you receive it, in any medium, provided that
+you conspicuously and appropriately publish on each copy an
+appropriate copyright notice and disclaimer of warranty; keep intact
+all the notices that refer to this License and to the absence of any
+warranty; and distribute a copy of this License along with the
+Library.
+
+ You may charge a fee for the physical act of transferring a copy,
+and you may at your option offer warranty protection in exchange for a
+fee.
+
+ 2. You may modify your copy or copies of the Library or any portion
+of it, thus forming a work based on the Library, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+ a) The modified work must itself be a software library.
+
+ b) You must cause the files modified to carry prominent notices
+ stating that you changed the files and the date of any change.
+
+ c) You must cause the whole of the work to be licensed at no
+ charge to all third parties under the terms of this License.
+
+ d) If a facility in the modified Library refers to a function or a
+ table of data to be supplied by an application program that uses
+ the facility, other than as an argument passed when the facility
+ is invoked, then you must make a good faith effort to ensure that,
+ in the event an application does not supply such function or
+ table, the facility still operates, and performs whatever part of
+ its purpose remains meaningful.
+
+ (For example, a function in a library to compute square roots has
+ a purpose that is entirely well-defined independent of the
+ application. Therefore, Subsection 2d requires that any
+ application-supplied function or table used by this function must
+ be optional: if the application does not supply it, the square
+ root function must still compute square roots.)
+
+These requirements apply to the modified work as a whole. If
+identifiable sections of that work are not derived from the Library,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works. But when you
+distribute the same sections as part of a whole which is a work based
+on the Library, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote
+it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Library.
+
+In addition, mere aggregation of another work not based on the Library
+with the Library (or with a work based on the Library) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+ 3. You may opt to apply the terms of the ordinary GNU General Public
+License instead of this License to a given copy of the Library. To do
+this, you must alter all the notices that refer to this License, so
+that they refer to the ordinary GNU General Public License, version 2,
+instead of to this License. (If a newer version than version 2 of the
+ordinary GNU General Public License has appeared, then you can specify
+that version instead if you wish.) Do not make any other change in
+these notices.
+
+ Once this change is made in a given copy, it is irreversible for
+that copy, so the ordinary GNU General Public License applies to all
+subsequent copies and derivative works made from that copy.
+
+ This option is useful when you wish to copy part of the code of
+the Library into a program that is not a library.
+
+ 4. You may copy and distribute the Library (or a portion or
+derivative of it, under Section 2) in object code or executable form
+under the terms of Sections 1 and 2 above provided that you accompany
+it with the complete corresponding machine-readable source code, which
+must be distributed under the terms of Sections 1 and 2 above on a
+medium customarily used for software interchange.
+
+ If distribution of object code is made by offering access to copy
+from a designated place, then offering equivalent access to copy the
+source code from the same place satisfies the requirement to
+distribute the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+ 5. A program that contains no derivative of any portion of the
+Library, but is designed to work with the Library by being compiled or
+linked with it, is called a "work that uses the Library". Such a
+work, in isolation, is not a derivative work of the Library, and
+therefore falls outside the scope of this License.
+
+ However, linking a "work that uses the Library" with the Library
+creates an executable that is a derivative of the Library (because it
+contains portions of the Library), rather than a "work that uses the
+library". The executable is therefore covered by this License.
+Section 6 states terms for distribution of such executables.
+
+ When a "work that uses the Library" uses material from a header file
+that is part of the Library, the object code for the work may be a
+derivative work of the Library even though the source code is not.
+Whether this is true is especially significant if the work can be
+linked without the Library, or if the work is itself a library. The
+threshold for this to be true is not precisely defined by law.
+
+ If such an object file uses only numerical parameters, data
+structure layouts and accessors, and small macros and small inline
+functions (ten lines or less in length), then the use of the object
+file is unrestricted, regardless of whether it is legally a derivative
+work. (Executables containing this object code plus portions of the
+Library will still fall under Section 6.)
+
+ Otherwise, if the work is a derivative of the Library, you may
+distribute the object code for the work under the terms of Section 6.
+Any executables containing that work also fall under Section 6,
+whether or not they are linked directly with the Library itself.
+
+ 6. As an exception to the Sections above, you may also combine or
+link a "work that uses the Library" with the Library to produce a
+work containing portions of the Library, and distribute that work
+under terms of your choice, provided that the terms permit
+modification of the work for the customer's own use and reverse
+engineering for debugging such modifications.
+
+ You must give prominent notice with each copy of the work that the
+Library is used in it and that the Library and its use are covered by
+this License. You must supply a copy of this License. If the work
+during execution displays copyright notices, you must include the
+copyright notice for the Library among them, as well as a reference
+directing the user to the copy of this License. Also, you must do one
+of these things:
+
+ a) Accompany the work with the complete corresponding
+ machine-readable source code for the Library including whatever
+ changes were used in the work (which must be distributed under
+ Sections 1 and 2 above); and, if the work is an executable linked
+ with the Library, with the complete machine-readable "work that
+ uses the Library", as object code and/or source code, so that the
+ user can modify the Library and then relink to produce a modified
+ executable containing the modified Library. (It is understood
+ that the user who changes the contents of definitions files in the
+ Library will not necessarily be able to recompile the application
+ to use the modified definitions.)
+
+ b) Use a suitable shared library mechanism for linking with the
+ Library. A suitable mechanism is one that (1) uses at run time a
+ copy of the library already present on the user's computer system,
+ rather than copying library functions into the executable, and (2)
+ will operate properly with a modified version of the library, if
+ the user installs one, as long as the modified version is
+ interface-compatible with the version that the work was made with.
+
+ c) Accompany the work with a written offer, valid for at
+ least three years, to give the same user the materials
+ specified in Subsection 6a, above, for a charge no more
+ than the cost of performing this distribution.
+
+ d) If distribution of the work is made by offering access to copy
+ from a designated place, offer equivalent access to copy the above
+ specified materials from the same place.
+
+ e) Verify that the user has already received a copy of these
+ materials or that you have already sent this user a copy.
+
+ For an executable, the required form of the "work that uses the
+Library" must include any data and utility programs needed for
+reproducing the executable from it. However, as a special exception,
+the materials to be distributed need not include anything that is
+normally distributed (in either source or binary form) with the major
+components (compiler, kernel, and so on) of the operating system on
+which the executable runs, unless that component itself accompanies
+the executable.
+
+ It may happen that this requirement contradicts the license
+restrictions of other proprietary libraries that do not normally
+accompany the operating system. Such a contradiction means you cannot
+use both them and the Library together in an executable that you
+distribute.
+
+ 7. You may place library facilities that are a work based on the
+Library side-by-side in a single library together with other library
+facilities not covered by this License, and distribute such a combined
+library, provided that the separate distribution of the work based on
+the Library and of the other library facilities is otherwise
+permitted, and provided that you do these two things:
+
+ a) Accompany the combined library with a copy of the same work
+ based on the Library, uncombined with any other library
+ facilities. This must be distributed under the terms of the
+ Sections above.
+
+ b) Give prominent notice with the combined library of the fact
+ that part of it is a work based on the Library, and explaining
+ where to find the accompanying uncombined form of the same work.
+
+ 8. You may not copy, modify, sublicense, link with, or distribute
+the Library except as expressly provided under this License. Any
+attempt otherwise to copy, modify, sublicense, link with, or
+distribute the Library is void, and will automatically terminate your
+rights under this License. However, parties who have received copies,
+or rights, from you under this License will not have their licenses
+terminated so long as such parties remain in full compliance.
+
+ 9. You are not required to accept this License, since you have not
+signed it. However, nothing else grants you permission to modify or
+distribute the Library or its derivative works. These actions are
+prohibited by law if you do not accept this License. Therefore, by
+modifying or distributing the Library (or any work based on the
+Library), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Library or works based on it.
+
+ 10. Each time you redistribute the Library (or any work based on the
+Library), the recipient automatically receives a license from the
+original licensor to copy, distribute, link with or modify the Library
+subject to these terms and conditions. You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties with
+this License.
+
+ 11. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Library at all. For example, if a patent
+license would not permit royalty-free redistribution of the Library by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Library.
+
+If any portion of this section is held invalid or unenforceable under any
+particular circumstance, the balance of the section is intended to apply,
+and the section as a whole is intended to apply in other circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system which is
+implemented by public license practices. Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+ 12. If the distribution and/or use of the Library is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Library under this License may add
+an explicit geographical distribution limitation excluding those countries,
+so that distribution is permitted only in or among countries not thus
+excluded. In such case, this License incorporates the limitation as if
+written in the body of this License.
+
+ 13. The Free Software Foundation may publish revised and/or new
+versions of the Lesser General Public License from time to time.
+Such new versions will be similar in spirit to the present version,
+but may differ in detail to address new problems or concerns.
+
+Each version is given a distinguishing version number. If the Library
+specifies a version number of this License which applies to it and
+"any later version", you have the option of following the terms and
+conditions either of that version or of any later version published by
+the Free Software Foundation. If the Library does not specify a
+license version number, you may choose any version ever published by
+the Free Software Foundation.
+
+ 14. If you wish to incorporate parts of the Library into other free
+programs whose distribution conditions are incompatible with these,
+write to the author to ask for permission. For software which is
+copyrighted by the Free Software Foundation, write to the Free
+Software Foundation; we sometimes make exceptions for this. Our
+decision will be guided by the two goals of preserving the free status
+of all derivatives of our free software and of promoting the sharing
+and reuse of software generally.
+
+ NO WARRANTY
+
+ 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO
+WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW.
+EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
+OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY
+KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE
+LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME
+THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN
+WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY
+AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU
+FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE
+LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING
+RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A
+FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF
+SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+DAMAGES.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Libraries
+
+ If you develop a new library, and you want it to be of the greatest
+possible use to the public, we recommend making it free software that
+everyone can redistribute and change. You can do so by permitting
+redistribution under these terms (or, alternatively, under the terms of the
+ordinary General Public License).
+
+ To apply these terms, attach the following notices to the library. It is
+safest to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least the
+"copyright" line and a pointer to where the full notice is found.
+
+ <one line to give the library's name and a brief idea of what it does.>
+ Copyright (C) <year> <name of author>
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with this library; if not, write to the Free Software
+ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+
+Also add information on how to contact you by electronic and paper mail.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the library, if
+necessary. Here is a sample; alter the names:
+
+ Yoyodyne, Inc., hereby disclaims all copyright interest in the
+ library `Frob' (a library for tweaking knobs) written by James Random Hacker.
+
+ <signature of Ty Coon>, 1 April 1990
+ Ty Coon, President of Vice
+
+That's all there is to it!
diff -Nuar flatpak-1.0.0.orig/libglnx/.git flatpak-1.0.0/libglnx/.git
--- flatpak-1.0.0.orig/libglnx/.git 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/.git 2018-02-03 21:26:06.241233337 +0300
@@ -0,0 +1 @@
+gitdir: ../.git/modules/libglnx
diff -Nuar flatpak-1.0.0.orig/libglnx/.gitignore flatpak-1.0.0/libglnx/.gitignore
--- flatpak-1.0.0.orig/libglnx/.gitignore 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/.gitignore 2018-02-03 21:26:06.307233341 +0300
@@ -0,0 +1,16 @@
+# A path ostree writes to work around automake bug with
+# subdir-objects
+Makefile-libglnx.am.inc
+
+# Some standard bits
+.deps
+.libs
+.dirstamp
+*.typelib
+*.la
+*.lo
+*.o
+*.pyc
+*.stamp
+*~
+
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-backport-autocleanups.h flatpak-1.0.0/libglnx/glnx-backport-autocleanups.h
--- flatpak-1.0.0.orig/libglnx/glnx-backport-autocleanups.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-backport-autocleanups.h 2018-02-03 21:26:06.307233341 +0300
@@ -0,0 +1,124 @@
+/*
+ * Copyright © 2015 Canonical Limited
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the licence, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ *
+ * Author: Ryan Lortie <desrt@desrt.ca>
+ */
+
+#pragma once
+
+#include <glnx-backport-autoptr.h>
+
+#if !GLIB_CHECK_VERSION(2, 43, 4)
+
+static inline void
+g_autoptr_cleanup_generic_gfree (void *p)
+{
+ void **pp = (void**)p;
+ if (*pp)
+ g_free (*pp);
+}
+
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GAsyncQueue, g_async_queue_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GBookmarkFile, g_bookmark_file_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GBytes, g_bytes_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GChecksum, g_checksum_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GDateTime, g_date_time_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GDir, g_dir_close)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GError, g_error_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GHashTable, g_hash_table_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GHmac, g_hmac_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GIOChannel, g_io_channel_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GKeyFile, g_key_file_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GList, g_list_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GArray, g_array_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GPtrArray, g_ptr_array_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GMainContext, g_main_context_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GMainLoop, g_main_loop_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GSource, g_source_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GMappedFile, g_mapped_file_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GMarkupParseContext, g_markup_parse_context_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(gchar, g_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GNode, g_node_destroy)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GOptionContext, g_option_context_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GOptionGroup, g_option_group_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GPatternSpec, g_pattern_spec_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GQueue, g_queue_free)
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GQueue, g_queue_clear)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GRand, g_rand_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GRegex, g_regex_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GMatchInfo, g_match_info_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GScanner, g_scanner_destroy)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GSequence, g_sequence_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GSList, g_slist_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GStringChunk, g_string_chunk_free)
+G_DEFINE_AUTO_CLEANUP_FREE_FUNC(GStrv, g_strfreev, NULL)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GThread, g_thread_unref)
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GMutex, g_mutex_clear)
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GCond, g_cond_clear)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GTimer, g_timer_destroy)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GTimeZone, g_time_zone_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GTree, g_tree_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GVariant, g_variant_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GVariantBuilder, g_variant_builder_unref)
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GVariantBuilder, g_variant_builder_clear)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GVariantIter, g_variant_iter_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GVariantDict, g_variant_dict_unref)
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GVariantDict, g_variant_dict_clear)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GVariantType, g_variant_type_free)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GSubprocess, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GSubprocessLauncher, g_object_unref)
+
+/* Add GObject-based types as needed. */
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GCancellable, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GConverter, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GConverterOutputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GDataInputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GFile, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GFileEnumerator, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GFileIOStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GFileInfo, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GFileInputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GFileMonitor, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GFileOutputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GInputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GMemoryInputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GMemoryOutputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GOutputStream, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GSocket, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GSocketAddress, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GTask, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GTlsCertificate, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GTlsDatabase, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GTlsInteraction, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GDBusConnection, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GDBusMessage, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GZlibCompressor, g_object_unref)
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GZlibDecompressor, g_object_unref)
+
+#endif
+
+#if !GLIB_CHECK_VERSION(2, 45, 8)
+
+static inline void
+g_autoptr_cleanup_gstring_free (GString *string)
+{
+ if (string)
+ g_string_free (string, TRUE);
+}
+
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(GString, g_autoptr_cleanup_gstring_free)
+
+#endif
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-backport-autoptr.h flatpak-1.0.0/libglnx/glnx-backport-autoptr.h
--- flatpak-1.0.0.orig/libglnx/glnx-backport-autoptr.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-backport-autoptr.h 2018-02-03 21:26:06.308233341 +0300
@@ -0,0 +1,133 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2015 Colin Walters <walters@verbum.org>
+ *
+ * GLIB - Library of useful routines for C programming
+ * Copyright (C) 1995-1997 Peter Mattis, Spencer Kimball and Josh MacDonald
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <gio/gio.h>
+
+G_BEGIN_DECLS
+
+#if !GLIB_CHECK_VERSION(2, 43, 4)
+
+#define _GLIB_AUTOPTR_FUNC_NAME(TypeName) glib_autoptr_cleanup_##TypeName
+#define _GLIB_AUTOPTR_TYPENAME(TypeName) TypeName##_autoptr
+#define _GLIB_AUTO_FUNC_NAME(TypeName) glib_auto_cleanup_##TypeName
+#define _GLIB_CLEANUP(func) __attribute__((cleanup(func)))
+#define _GLIB_DEFINE_AUTOPTR_CHAINUP(ModuleObjName, ParentName) \
+ typedef ModuleObjName *_GLIB_AUTOPTR_TYPENAME(ModuleObjName); \
+ static inline void _GLIB_AUTOPTR_FUNC_NAME(ModuleObjName) (ModuleObjName **_ptr) { \
+ _GLIB_AUTOPTR_FUNC_NAME(ParentName) ((ParentName **) _ptr); } \
+
+
+/* these macros are API */
+#define G_DEFINE_AUTOPTR_CLEANUP_FUNC(TypeName, func) \
+ typedef TypeName *_GLIB_AUTOPTR_TYPENAME(TypeName); \
+ G_GNUC_BEGIN_IGNORE_DEPRECATIONS \
+ static inline void _GLIB_AUTOPTR_FUNC_NAME(TypeName) (TypeName **_ptr) { if (*_ptr) (func) (*_ptr); } \
+ G_GNUC_END_IGNORE_DEPRECATIONS
+#define G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(TypeName, func) \
+ G_GNUC_BEGIN_IGNORE_DEPRECATIONS \
+ static inline void _GLIB_AUTO_FUNC_NAME(TypeName) (TypeName *_ptr) { (func) (_ptr); } \
+ G_GNUC_END_IGNORE_DEPRECATIONS
+#define G_DEFINE_AUTO_CLEANUP_FREE_FUNC(TypeName, func, none) \
+ G_GNUC_BEGIN_IGNORE_DEPRECATIONS \
+ static inline void _GLIB_AUTO_FUNC_NAME(TypeName) (TypeName *_ptr) { if (*_ptr != none) (func) (*_ptr); } \
+ G_GNUC_END_IGNORE_DEPRECATIONS
+#define g_autoptr(TypeName) _GLIB_CLEANUP(_GLIB_AUTOPTR_FUNC_NAME(TypeName)) _GLIB_AUTOPTR_TYPENAME(TypeName)
+#define g_auto(TypeName) _GLIB_CLEANUP(_GLIB_AUTO_FUNC_NAME(TypeName)) TypeName
+#define g_autofree _GLIB_CLEANUP(g_autoptr_cleanup_generic_gfree)
+
+/**
+ * g_steal_pointer:
+ * @pp: a pointer to a pointer
+ *
+ * Sets @pp to %NULL, returning the value that was there before.
+ *
+ * Conceptually, this transfers the ownership of the pointer from the
+ * referenced variable to the "caller" of the macro (ie: "steals" the
+ * reference).
+ *
+ * The return value will be properly typed, according to the type of
+ * @pp.
+ *
+ * This can be very useful when combined with g_autoptr() to prevent the
+ * return value of a function from being automatically freed. Consider
+ * the following example (which only works on GCC and clang):
+ *
+ * |[
+ * GObject *
+ * create_object (void)
+ * {
+ * g_autoptr(GObject) obj = g_object_new (G_TYPE_OBJECT, NULL);
+ *
+ * if (early_error_case)
+ * return NULL;
+ *
+ * return g_steal_pointer (&obj);
+ * }
+ * ]|
+ *
+ * It can also be used in similar ways for 'out' parameters and is
+ * particularly useful for dealing with optional out parameters:
+ *
+ * |[
+ * gboolean
+ * get_object (GObject **obj_out)
+ * {
+ * g_autoptr(GObject) obj = g_object_new (G_TYPE_OBJECT, NULL);
+ *
+ * if (early_error_case)
+ * return FALSE;
+ *
+ * if (obj_out)
+ * *obj_out = g_steal_pointer (&obj);
+ *
+ * return TRUE;
+ * }
+ * ]|
+ *
+ * In the above example, the object will be automatically freed in the
+ * early error case and also in the case that %NULL was given for
+ * @obj_out.
+ *
+ * Since: 2.44
+ */
+static inline gpointer
+(g_steal_pointer) (gpointer pp)
+{
+ gpointer *ptr = (gpointer *) pp;
+ gpointer ref;
+
+ ref = *ptr;
+ *ptr = NULL;
+
+ return ref;
+}
+
+/* type safety */
+#define g_steal_pointer(pp) \
+ (0 ? (*(pp)) : (g_steal_pointer) (pp))
+
+#endif /* !GLIB_CHECK_VERSION(2, 43, 3) */
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-backports.c flatpak-1.0.0/libglnx/glnx-backports.c
--- flatpak-1.0.0.orig/libglnx/glnx-backports.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-backports.c 2018-02-03 21:26:06.308233341 +0300
@@ -0,0 +1,61 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2015 Colin Walters <walters@verbum.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include "glnx-backports.h"
+
+#if !GLIB_CHECK_VERSION(2, 44, 0)
+gboolean
+glnx_strv_contains (const gchar * const *strv,
+ const gchar *str)
+{
+ g_return_val_if_fail (strv != NULL, FALSE);
+ g_return_val_if_fail (str != NULL, FALSE);
+
+ for (; *strv != NULL; strv++)
+ {
+ if (g_str_equal (str, *strv))
+ return TRUE;
+ }
+
+ return FALSE;
+}
+
+gboolean
+glnx_set_object (GObject **object_ptr,
+ GObject *new_object)
+{
+ GObject *old_object = *object_ptr;
+
+ if (old_object == new_object)
+ return FALSE;
+
+ if (new_object != NULL)
+ g_object_ref (new_object);
+
+ *object_ptr = new_object;
+
+ if (old_object != NULL)
+ g_object_unref (old_object);
+
+ return TRUE;
+}
+#endif
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-backports.h flatpak-1.0.0/libglnx/glnx-backports.h
--- flatpak-1.0.0.orig/libglnx/glnx-backports.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-backports.h 2018-02-03 21:26:06.308233341 +0300
@@ -0,0 +1,46 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2015 Colin Walters <walters@verbum.org>
+ *
+ * GLIB - Library of useful routines for C programming
+ * Copyright (C) 1995-1997 Peter Mattis, Spencer Kimball and Josh MacDonald
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <gio/gio.h>
+
+G_BEGIN_DECLS
+
+#if !GLIB_CHECK_VERSION(2, 44, 0)
+
+#define g_strv_contains glnx_strv_contains
+gboolean glnx_strv_contains (const gchar * const *strv,
+ const gchar *str);
+
+#define g_set_object(object_ptr, new_object) \
+ (/* Check types match. */ \
+ 0 ? *(object_ptr) = (new_object), FALSE : \
+ glnx_set_object ((GObject **) (object_ptr), (GObject *) (new_object)) \
+ )
+gboolean glnx_set_object (GObject **object_ptr,
+ GObject *new_object);
+
+#endif /* !GLIB_CHECK_VERSION(2, 44, 0) */
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-console.c flatpak-1.0.0/libglnx/glnx-console.c
--- flatpak-1.0.0.orig/libglnx/glnx-console.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-console.c 2018-05-26 00:50:25.433037228 +0300
@@ -0,0 +1,359 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2013,2014,2015 Colin Walters <walters@verbum.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include "glnx-console.h"
+
+#include <unistd.h>
+#include <string.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <errno.h>
+#include <sys/ioctl.h>
+
+/* For people with widescreen monitors and maximized terminals, it looks pretty
+ * bad to have an enormous progress bar. For much the same reason as web pages
+ * tend to have a maximum width;
+ * https://ux.stackexchange.com/questions/48982/suggest-good-max-width-for-fluid-width-design
+ */
+#define MAX_PROGRESSBAR_COLUMNS 20
+
+/* Max updates output per second. On a tty there's no point to rendering
+ * extremely fast; and for a non-tty we're probably in a Jenkins job
+ * or whatever and having percentages spam multiple lines there is annoying.
+ */
+#define MAX_TTY_UPDATE_HZ (5)
+#define MAX_NONTTY_UPDATE_HZ (1)
+
+static gboolean locked;
+static guint64 last_update_ms; /* monotonic time in millis we last updated */
+
+gboolean
+glnx_stdout_is_tty (void)
+{
+ static gsize initialized = 0;
+ static gboolean stdout_is_tty_v;
+
+ if (g_once_init_enter (&initialized))
+ {
+ stdout_is_tty_v = isatty (1);
+ g_once_init_leave (&initialized, 1);
+ }
+
+ return stdout_is_tty_v;
+}
+
+static volatile guint cached_columns = 0;
+static volatile guint cached_lines = 0;
+
+static int
+fd_columns (int fd)
+{
+ struct winsize ws = {};
+
+ if (ioctl (fd, TIOCGWINSZ, &ws) < 0)
+ return -errno;
+
+ if (ws.ws_col <= 0)
+ return -EIO;
+
+ return ws.ws_col;
+}
+
+/**
+ * glnx_console_columns:
+ *
+ * Returns: The number of columns for terminal output
+ */
+guint
+glnx_console_columns (void)
+{
+ if (G_UNLIKELY (cached_columns == 0))
+ {
+ int c;
+
+ c = fd_columns (STDOUT_FILENO);
+
+ if (c <= 0)
+ c = 80;
+
+ if (c > 256)
+ c = 256;
+
+ cached_columns = c;
+ }
+
+ return cached_columns;
+}
+
+static int
+fd_lines (int fd)
+{
+ struct winsize ws = {};
+
+ if (ioctl (fd, TIOCGWINSZ, &ws) < 0)
+ return -errno;
+
+ if (ws.ws_row <= 0)
+ return -EIO;
+
+ return ws.ws_row;
+}
+
+/**
+ * glnx_console_lines:
+ *
+ * Returns: The number of lines for terminal output
+ */
+guint
+glnx_console_lines (void)
+{
+ if (G_UNLIKELY (cached_lines == 0))
+ {
+ int l;
+
+ l = fd_lines (STDOUT_FILENO);
+
+ if (l <= 0)
+ l = 24;
+
+ cached_lines = l;
+ }
+
+ return cached_lines;
+}
+
+static void
+on_sigwinch (int signum)
+{
+ cached_columns = 0;
+ cached_lines = 0;
+}
+
+void
+glnx_console_lock (GLnxConsoleRef *console)
+{
+ static gsize sigwinch_initialized = 0;
+
+ g_return_if_fail (!locked);
+ g_return_if_fail (!console->locked);
+
+ console->is_tty = glnx_stdout_is_tty ();
+
+ locked = console->locked = TRUE;
+
+ if (console->is_tty)
+ {
+ if (g_once_init_enter (&sigwinch_initialized))
+ {
+ signal (SIGWINCH, on_sigwinch);
+ g_once_init_leave (&sigwinch_initialized, 1);
+ }
+
+ { static const char initbuf[] = { '\n', 0x1B, 0x37 };
+ (void) fwrite (initbuf, 1, sizeof (initbuf), stdout);
+ }
+ }
+}
+
+static void
+printpad (const char *padbuf,
+ guint padbuf_len,
+ guint n)
+{
+ const guint d = n / padbuf_len;
+ const guint r = n % padbuf_len;
+ guint i;
+
+ for (i = 0; i < d; i++)
+ fwrite (padbuf, 1, padbuf_len, stdout);
+ fwrite (padbuf, 1, r, stdout);
+}
+
+static void
+text_percent_internal (const char *text,
+ int percentage)
+{
+ /* Check whether we're trying to render too fast; unless percentage is 100, in
+ * which case we assume this is the last call, so we always render it.
+ */
+ const guint64 current_ms = g_get_monotonic_time () / 1000;
+ if (percentage != 100)
+ {
+ const guint64 diff_ms = current_ms - last_update_ms;
+ if (glnx_stdout_is_tty ())
+ {
+ if (diff_ms < (1000/MAX_TTY_UPDATE_HZ))
+ return;
+ }
+ else
+ {
+ if (diff_ms < (1000/MAX_NONTTY_UPDATE_HZ))
+ return;
+ }
+ }
+ last_update_ms = current_ms;
+
+ static const char equals[] = "====================";
+ const guint n_equals = sizeof (equals) - 1;
+ static const char spaces[] = " ";
+ const guint n_spaces = sizeof (spaces) - 1;
+ const guint ncolumns = glnx_console_columns ();
+ const guint bar_min = 10;
+
+ if (text && !*text)
+ text = NULL;
+
+ const guint input_textlen = text ? strlen (text) : 0;
+
+ if (!glnx_stdout_is_tty ())
+ {
+ if (text)
+ fprintf (stdout, "%s", text);
+ if (percentage != -1)
+ {
+ if (text)
+ fputc (' ', stdout);
+ fprintf (stdout, "%u%%", percentage);
+ }
+ fputc ('\n', stdout);
+ fflush (stdout);
+ return;
+ }
+
+ if (ncolumns < bar_min)
+ return; /* TODO: spinner */
+
+ /* Restore cursor */
+ { const char beginbuf[2] = { 0x1B, 0x38 };
+ (void) fwrite (beginbuf, 1, sizeof (beginbuf), stdout);
+ }
+
+ if (percentage == -1)
+ {
+ if (text != NULL)
+ fwrite (text, 1, input_textlen, stdout);
+
+ /* Overwrite remaining space, if any */
+ if (ncolumns > input_textlen)
+ printpad (spaces, n_spaces, ncolumns - input_textlen);
+ }
+ else
+ {
+ const guint textlen = MIN (input_textlen, ncolumns - bar_min);
+ const guint barlen = MIN (MAX_PROGRESSBAR_COLUMNS, ncolumns - (textlen + 1));
+
+ if (textlen > 0)
+ {
+ fwrite (text, 1, textlen, stdout);
+ fputc (' ', stdout);
+ }
+
+ {
+ const guint nbraces = 2;
+ const guint textpercent_len = 5;
+ const guint bar_internal_len = barlen - nbraces - textpercent_len;
+ const guint eqlen = bar_internal_len * (percentage / 100.0);
+ const guint spacelen = bar_internal_len - eqlen;
+
+ fputc ('[', stdout);
+ printpad (equals, n_equals, eqlen);
+ printpad (spaces, n_spaces, spacelen);
+ fputc (']', stdout);
+ fprintf (stdout, " %3d%%", percentage);
+ }
+ }
+
+ fflush (stdout);
+}
+
+/**
+ * glnx_console_progress_text_percent:
+ * @text: Show this text before the progress bar
+ * @percentage: An integer in the range of 0 to 100
+ *
+ * On a tty, print to the console @text followed by an ASCII art
+ * progress bar whose percentage is @percentage. If stdout is not a
+ * tty, a more basic line by line change will be printed.
+ *
+ * You must have called glnx_console_lock() before invoking this
+ * function.
+ *
+ */
+void
+glnx_console_progress_text_percent (const char *text,
+ guint percentage)
+{
+ g_return_if_fail (percentage <= 100);
+
+ text_percent_internal (text, percentage);
+}
+
+/**
+ * glnx_console_progress_n_items:
+ * @text: Show this text before the progress bar
+ * @current: An integer for how many items have been processed
+ * @total: An integer for how many items there are total
+ *
+ * On a tty, print to the console @text followed by [@current/@total],
+ * then an ASCII art progress bar, like glnx_console_progress_text_percent().
+ *
+ * You must have called glnx_console_lock() before invoking this
+ * function.
+ */
+void
+glnx_console_progress_n_items (const char *text,
+ guint current,
+ guint total)
+{
+ g_return_if_fail (current <= total);
+ g_return_if_fail (total > 0);
+
+ g_autofree char *newtext = g_strdup_printf ("%s (%u/%u)", text, current, total);
+ /* Special case current == total to ensure we end at 100% */
+ int percentage = (current == total) ? 100 : (((double)current) / total * 100);
+ glnx_console_progress_text_percent (newtext, percentage);
+}
+
+void
+glnx_console_text (const char *text)
+{
+ text_percent_internal (text, -1);
+}
+
+/**
+ * glnx_console_unlock:
+ *
+ * Print a newline, and reset all cached console progress state.
+ *
+ * This function does nothing if stdout is not a tty.
+ */
+void
+glnx_console_unlock (GLnxConsoleRef *console)
+{
+ g_return_if_fail (locked);
+ g_return_if_fail (console->locked);
+
+ if (console->is_tty)
+ fputc ('\n', stdout);
+
+ locked = console->locked = FALSE;
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-console.h flatpak-1.0.0/libglnx/glnx-console.h
--- flatpak-1.0.0.orig/libglnx/glnx-console.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-console.h 2018-05-26 00:50:25.433037228 +0300
@@ -0,0 +1,61 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2013,2014,2015 Colin Walters <walters@verbum.org>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published
+ * by the Free Software Foundation; either version 2 of the licence or (at
+ * your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <glnx-backport-autocleanups.h>
+
+G_BEGIN_DECLS
+
+struct GLnxConsoleRef {
+ gboolean locked;
+ gboolean is_tty;
+};
+
+typedef struct GLnxConsoleRef GLnxConsoleRef;
+
+gboolean glnx_stdout_is_tty (void);
+
+void glnx_console_lock (GLnxConsoleRef *ref);
+
+void glnx_console_text (const char *text);
+
+void glnx_console_progress_text_percent (const char *text,
+ guint percentage);
+
+void glnx_console_progress_n_items (const char *text,
+ guint current,
+ guint total);
+
+void glnx_console_unlock (GLnxConsoleRef *ref);
+
+guint glnx_console_lines (void);
+
+guint glnx_console_columns (void);
+
+static inline void
+glnx_console_ref_cleanup (GLnxConsoleRef *p)
+{
+ if (p->locked)
+ glnx_console_unlock (p);
+}
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GLnxConsoleRef, glnx_console_ref_cleanup)
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-dirfd.c flatpak-1.0.0/libglnx/glnx-dirfd.c
--- flatpak-1.0.0.orig/libglnx/glnx-dirfd.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-dirfd.c 2018-05-26 00:50:25.433037228 +0300
@@ -0,0 +1,425 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include <string.h>
+
+#include <glnx-dirfd.h>
+#include <glnx-fdio.h>
+#include <glnx-errors.h>
+#include <glnx-local-alloc.h>
+#include <glnx-shutil.h>
+
+/**
+ * glnx_opendirat_with_errno:
+ * @dfd: File descriptor for origin directory
+ * @name: Pathname, relative to @dfd
+ * @follow: Whether or not to follow symbolic links
+ *
+ * Use openat() to open a directory, using a standard set of flags.
+ * This function sets errno.
+ */
+int
+glnx_opendirat_with_errno (int dfd,
+ const char *path,
+ gboolean follow)
+{
+ int flags = O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_CLOEXEC | O_NOCTTY;
+ if (!follow)
+ flags |= O_NOFOLLOW;
+
+ dfd = glnx_dirfd_canonicalize (dfd);
+
+ return openat (dfd, path, flags);
+}
+
+/**
+ * glnx_opendirat:
+ * @dfd: File descriptor for origin directory
+ * @path: Pathname, relative to @dfd
+ * @follow: Whether or not to follow symbolic links
+ * @error: Error
+ *
+ * Use openat() to open a directory, using a standard set of flags.
+ */
+gboolean
+glnx_opendirat (int dfd,
+ const char *path,
+ gboolean follow,
+ int *out_fd,
+ GError **error)
+{
+ int ret = glnx_opendirat_with_errno (dfd, path, follow);
+ if (ret == -1)
+ return glnx_throw_errno_prefix (error, "opendir(%s)", path);
+ *out_fd = ret;
+ return TRUE;
+}
+
+struct GLnxRealDirfdIterator
+{
+ gboolean initialized;
+ int fd;
+ DIR *d;
+};
+typedef struct GLnxRealDirfdIterator GLnxRealDirfdIterator;
+
+/**
+ * glnx_dirfd_iterator_init_at:
+ * @dfd: File descriptor, may be AT_FDCWD or -1
+ * @path: Path, may be relative to @dfd
+ * @follow: If %TRUE and the last component of @path is a symlink, follow it
+ * @out_dfd_iter: (out caller-allocates): A directory iterator, will be initialized
+ * @error: Error
+ *
+ * Initialize @out_dfd_iter from @dfd and @path.
+ */
+gboolean
+glnx_dirfd_iterator_init_at (int dfd,
+ const char *path,
+ gboolean follow,
+ GLnxDirFdIterator *out_dfd_iter,
+ GError **error)
+{
+ glnx_autofd int fd = -1;
+ if (!glnx_opendirat (dfd, path, follow, &fd, error))
+ return FALSE;
+
+ if (!glnx_dirfd_iterator_init_take_fd (&fd, out_dfd_iter, error))
+ return FALSE;
+
+ return TRUE;
+}
+
+/**
+ * glnx_dirfd_iterator_init_take_fd:
+ * @dfd: File descriptor - ownership is taken, and the value is set to -1
+ * @dfd_iter: A directory iterator
+ * @error: Error
+ *
+ * Steal ownership of @dfd, using it to initialize @dfd_iter for
+ * iteration.
+ */
+gboolean
+glnx_dirfd_iterator_init_take_fd (int *dfd,
+ GLnxDirFdIterator *dfd_iter,
+ GError **error)
+{
+ GLnxRealDirfdIterator *real_dfd_iter = (GLnxRealDirfdIterator*) dfd_iter;
+ DIR *d = fdopendir (*dfd);
+ if (!d)
+ return glnx_throw_errno_prefix (error, "fdopendir");
+
+ real_dfd_iter->fd = glnx_steal_fd (dfd);
+ real_dfd_iter->d = d;
+ real_dfd_iter->initialized = TRUE;
+
+ return TRUE;
+}
+
+/**
+ * glnx_dirfd_iterator_next_dent:
+ * @dfd_iter: A directory iterator
+ * @out_dent: (out) (transfer none): Pointer to dirent; do not free
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Read the next value from @dfd_iter, causing @out_dent to be
+ * updated. If end of stream is reached, @out_dent will be set
+ * to %NULL, and %TRUE will be returned.
+ */
+gboolean
+glnx_dirfd_iterator_next_dent (GLnxDirFdIterator *dfd_iter,
+ struct dirent **out_dent,
+ GCancellable *cancellable,
+ GError **error)
+{
+ GLnxRealDirfdIterator *real_dfd_iter = (GLnxRealDirfdIterator*) dfd_iter;
+
+ g_return_val_if_fail (out_dent, FALSE);
+ g_return_val_if_fail (dfd_iter->initialized, FALSE);
+
+ if (g_cancellable_set_error_if_cancelled (cancellable, error))
+ return FALSE;
+
+ do
+ {
+ errno = 0;
+ *out_dent = readdir (real_dfd_iter->d);
+ if (*out_dent == NULL && errno != 0)
+ return glnx_throw_errno_prefix (error, "readdir");
+ } while (*out_dent &&
+ (strcmp ((*out_dent)->d_name, ".") == 0 ||
+ strcmp ((*out_dent)->d_name, "..") == 0));
+
+ return TRUE;
+}
+
+/**
+ * glnx_dirfd_iterator_next_dent_ensure_dtype:
+ * @dfd_iter: A directory iterator
+ * @out_dent: (out) (transfer none): Pointer to dirent; do not free
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * A variant of @glnx_dirfd_iterator_next_dent, which will ensure the
+ * `dent->d_type` member is filled in by calling `fstatat`
+ * automatically if the underlying filesystem type sets `DT_UNKNOWN`.
+ */
+gboolean
+glnx_dirfd_iterator_next_dent_ensure_dtype (GLnxDirFdIterator *dfd_iter,
+ struct dirent **out_dent,
+ GCancellable *cancellable,
+ GError **error)
+{
+ g_return_val_if_fail (out_dent, FALSE);
+
+ if (!glnx_dirfd_iterator_next_dent (dfd_iter, out_dent, cancellable, error))
+ return FALSE;
+
+ struct dirent *ret_dent = *out_dent;
+ if (ret_dent)
+ {
+
+ if (ret_dent->d_type == DT_UNKNOWN)
+ {
+ struct stat stbuf;
+ if (!glnx_fstatat (dfd_iter->fd, ret_dent->d_name, &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return FALSE;
+ ret_dent->d_type = IFTODT (stbuf.st_mode);
+ }
+ }
+
+ return TRUE;
+}
+
+/**
+ * glnx_dirfd_iterator_clear:
+ * @dfd_iter: Iterator, will be de-initialized
+ *
+ * Unset @dfd_iter, freeing any resources. If @dfd_iter is not
+ * initialized, do nothing.
+ */
+void
+glnx_dirfd_iterator_clear (GLnxDirFdIterator *dfd_iter)
+{
+ GLnxRealDirfdIterator *real_dfd_iter = (GLnxRealDirfdIterator*) dfd_iter;
+ /* fd is owned by dfd_iter */
+ if (!real_dfd_iter->initialized)
+ return;
+ (void) closedir (real_dfd_iter->d);
+ real_dfd_iter->initialized = FALSE;
+}
+
+/**
+ * glnx_fdrel_abspath:
+ * @dfd: Directory fd
+ * @path: Path
+ *
+ * Turn a fd-relative pair into something that can be used for legacy
+ * APIs expecting absolute paths.
+ *
+ * This is Linux specific, and only valid inside this process (unless
+ * you set up the child process to have the exact same fd number, but
+ * don't try that).
+ */
+char *
+glnx_fdrel_abspath (int dfd,
+ const char *path)
+{
+ dfd = glnx_dirfd_canonicalize (dfd);
+ if (dfd == AT_FDCWD)
+ return g_strdup (path);
+ return g_strdup_printf ("/proc/self/fd/%d/%s", dfd, path);
+}
+
+/**
+ * glnx_gen_temp_name:
+ * @tmpl: (type filename): template directory name, the last 6 characters will be replaced
+ *
+ * Replace the last 6 characters of @tmpl with random ASCII. You must
+ * use this in combination with a mechanism to ensure race-free file
+ * creation such as `O_EXCL`.
+ */
+void
+glnx_gen_temp_name (gchar *tmpl)
+{
+ g_return_if_fail (tmpl != NULL);
+ const size_t len = strlen (tmpl);
+ g_return_if_fail (len >= 6);
+
+ static const char letters[] =
+ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+ static const int NLETTERS = sizeof (letters) - 1;
+
+ char *XXXXXX = tmpl + (len - 6);
+ for (int i = 0; i < 6; i++)
+ XXXXXX[i] = letters[g_random_int_range(0, NLETTERS)];
+}
+
+/**
+ * glnx_mkdtempat:
+ * @dfd: Directory fd
+ * @tmpl: (type filename): Initial template directory name, last 6 characters will be replaced
+ * @mode: permissions with which to create the temporary directory
+ * @out_tmpdir: (out caller-allocates): Initialized tempdir structure
+ * @error: Error
+ *
+ * Somewhat similar to g_mkdtemp_full(), but fd-relative, and returns a
+ * structure that uses autocleanups. Note that the supplied @dfd lifetime
+ * must match or exceed that of @out_tmpdir in order to remove the directory.
+ */
+gboolean
+glnx_mkdtempat (int dfd, const char *tmpl, int mode,
+ GLnxTmpDir *out_tmpdir, GError **error)
+{
+ g_return_val_if_fail (tmpl != NULL, FALSE);
+ g_return_val_if_fail (out_tmpdir != NULL, FALSE);
+ g_return_val_if_fail (!out_tmpdir->initialized, FALSE);
+
+ dfd = glnx_dirfd_canonicalize (dfd);
+
+ g_autofree char *path = g_strdup (tmpl);
+ for (int count = 0; count < 100; count++)
+ {
+ glnx_gen_temp_name (path);
+
+ /* Ideally we could use openat(O_DIRECTORY | O_CREAT | O_EXCL) here
+ * to create and open the directory atomically, but that’s not supported by
+ * current kernel versions: http://www.openwall.com/lists/oss-security/2014/11/26/14
+ * (Tested on kernel 4.10.10-200.fc25.x86_64). For the moment, accept a
+ * TOCTTOU race here. */
+ if (mkdirat (dfd, path, mode) == -1)
+ {
+ if (errno == EEXIST)
+ continue;
+
+ /* Any other error will apply also to other names we might
+ * try, and there are 2^32 or so of them, so give up now.
+ */
+ return glnx_throw_errno_prefix (error, "mkdirat");
+ }
+
+ /* And open it */
+ glnx_autofd int ret_dfd = -1;
+ if (!glnx_opendirat (dfd, path, FALSE, &ret_dfd, error))
+ {
+ /* If we fail to open, let's try to clean up */
+ (void)unlinkat (dfd, path, AT_REMOVEDIR);
+ return FALSE;
+ }
+
+ /* Return the initialized directory struct */
+ out_tmpdir->initialized = TRUE;
+ out_tmpdir->src_dfd = dfd; /* referenced; see above docs */
+ out_tmpdir->fd = glnx_steal_fd (&ret_dfd);
+ out_tmpdir->path = g_steal_pointer (&path);
+ return TRUE;
+ }
+
+ /* Failure */
+ g_set_error (error, G_IO_ERROR, G_IO_ERROR_EXISTS,
+ "glnx_mkdtempat ran out of combinations to try");
+ return FALSE;
+}
+
+/**
+ * glnx_mkdtemp:
+ * @tmpl: (type filename): Source template directory name, last 6 characters will be replaced
+ * @mode: permissions to create the temporary directory with
+ * @out_tmpdir: (out caller-allocates): Return location for tmpdir data
+ * @error: Return location for a #GError, or %NULL
+ *
+ * Similar to glnx_mkdtempat(), but will use g_get_tmp_dir() as the parent
+ * directory to @tmpl.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ * Since: UNRELEASED
+ */
+gboolean
+glnx_mkdtemp (const gchar *tmpl,
+ int mode,
+ GLnxTmpDir *out_tmpdir,
+ GError **error)
+{
+ g_autofree char *path = g_build_filename (g_get_tmp_dir (), tmpl, NULL);
+ return glnx_mkdtempat (AT_FDCWD, path, mode,
+ out_tmpdir, error);
+}
+
+static gboolean
+_glnx_tmpdir_free (GLnxTmpDir *tmpd,
+ gboolean delete_dir,
+ GCancellable *cancellable,
+ GError **error)
+{
+ /* Support being passed NULL so we work nicely in a GPtrArray */
+ if (!(tmpd && tmpd->initialized))
+ return TRUE;
+ g_assert_cmpint (tmpd->fd, !=, -1);
+ glnx_close_fd (&tmpd->fd);
+ g_assert (tmpd->path);
+ g_assert_cmpint (tmpd->src_dfd, !=, -1);
+ g_autofree char *path = tmpd->path; /* Take ownership */
+ tmpd->initialized = FALSE;
+ if (delete_dir)
+ {
+ if (!glnx_shutil_rm_rf_at (tmpd->src_dfd, path, cancellable, error))
+ return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ * glnx_tmpdir_delete:
+ * @tmpf: Temporary dir
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Deallocate a tmpdir, closing the fd and recursively deleting the path. This
+ * is normally called indirectly via glnx_tmpdir_cleanup() by the autocleanup
+ * attribute, but you can also invoke this directly.
+ *
+ * If an error occurs while deleting the filesystem path, @tmpf will still have
+ * been deallocated and should not be reused.
+ *
+ * See also `glnx_tmpdir_unset` to avoid deleting the path.
+ */
+gboolean
+glnx_tmpdir_delete (GLnxTmpDir *tmpf, GCancellable *cancellable, GError **error)
+{
+ return _glnx_tmpdir_free (tmpf, TRUE, cancellable, error);
+}
+
+/**
+ * glnx_tmpdir_unset:
+ * @tmpf: Temporary dir
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Deallocate a tmpdir, but do not delete the filesystem path. See also
+ * `glnx_tmpdir_delete()`.
+ */
+void
+glnx_tmpdir_unset (GLnxTmpDir *tmpf)
+{
+ (void) _glnx_tmpdir_free (tmpf, FALSE, NULL, NULL);
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-dirfd.h flatpak-1.0.0/libglnx/glnx-dirfd.h
--- flatpak-1.0.0.orig/libglnx/glnx-dirfd.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-dirfd.h 2018-02-03 21:26:06.308233341 +0300
@@ -0,0 +1,137 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <glnx-backport-autocleanups.h>
+#include <glnx-macros.h>
+#include <glnx-errors.h>
+#include <limits.h>
+#include <dirent.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+G_BEGIN_DECLS
+
+/**
+ * glnx_dirfd_canonicalize:
+ * @fd: A directory file descriptor
+ *
+ * It's often convenient in programs to use `-1` for "unassigned fd",
+ * and also because gobject-introspection doesn't support `AT_FDCWD`,
+ * libglnx honors `-1` to mean `AT_FDCWD`. This small inline function
+ * canonicalizes `-1 -> AT_FDCWD`.
+ */
+static inline int
+glnx_dirfd_canonicalize (int fd)
+{
+ if (fd == -1)
+ return AT_FDCWD;
+ return fd;
+}
+
+struct GLnxDirFdIterator {
+ gboolean initialized;
+ int fd;
+ gpointer padding_data[4];
+};
+
+typedef struct GLnxDirFdIterator GLnxDirFdIterator;
+gboolean glnx_dirfd_iterator_init_at (int dfd, const char *path,
+ gboolean follow,
+ GLnxDirFdIterator *dfd_iter, GError **error);
+gboolean glnx_dirfd_iterator_init_take_fd (int *dfd, GLnxDirFdIterator *dfd_iter, GError **error);
+gboolean glnx_dirfd_iterator_next_dent (GLnxDirFdIterator *dfd_iter,
+ struct dirent **out_dent,
+ GCancellable *cancellable,
+ GError **error);
+gboolean glnx_dirfd_iterator_next_dent_ensure_dtype (GLnxDirFdIterator *dfd_iter,
+ struct dirent **out_dent,
+ GCancellable *cancellable,
+ GError **error);
+void glnx_dirfd_iterator_clear (GLnxDirFdIterator *dfd_iter);
+
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GLnxDirFdIterator, glnx_dirfd_iterator_clear)
+
+int glnx_opendirat_with_errno (int dfd,
+ const char *path,
+ gboolean follow);
+
+gboolean glnx_opendirat (int dfd,
+ const char *path,
+ gboolean follow,
+ int *out_fd,
+ GError **error);
+
+char *glnx_fdrel_abspath (int dfd,
+ const char *path);
+
+void glnx_gen_temp_name (gchar *tmpl);
+
+/**
+ * glnx_ensure_dir:
+ * @dfd: directory fd
+ * @path: Directory path
+ * @mode: Mode
+ * @error: Return location for a #GError, or %NULL
+ *
+ * Wrapper around mkdirat() which adds #GError support, ensures that
+ * it retries on %EINTR, and also ignores `EEXIST`.
+ *
+ * See also `glnx_shutil_mkdir_p_at()` for recursive handling.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ */
+static inline gboolean
+glnx_ensure_dir (int dfd,
+ const char *path,
+ mode_t mode,
+ GError **error)
+{
+ if (TEMP_FAILURE_RETRY (mkdirat (dfd, path, mode)) != 0)
+ {
+ if (G_UNLIKELY (errno != EEXIST))
+ return glnx_throw_errno_prefix (error, "mkdirat(%s)", path);
+ }
+ return TRUE;
+}
+
+typedef struct {
+ gboolean initialized;
+ int src_dfd;
+ int fd;
+ char *path;
+} GLnxTmpDir;
+gboolean glnx_tmpdir_delete (GLnxTmpDir *tmpf, GCancellable *cancellable, GError **error);
+void glnx_tmpdir_unset (GLnxTmpDir *tmpf);
+static inline void
+glnx_tmpdir_cleanup (GLnxTmpDir *tmpf)
+{
+ (void)glnx_tmpdir_delete (tmpf, NULL, NULL);
+}
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GLnxTmpDir, glnx_tmpdir_cleanup)
+
+gboolean glnx_mkdtempat (int dfd, const char *tmpl, int mode,
+ GLnxTmpDir *out_tmpdir, GError **error);
+
+gboolean glnx_mkdtemp (const char *tmpl, int mode,
+ GLnxTmpDir *out_tmpdir, GError **error);
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-errors.c flatpak-1.0.0/libglnx/glnx-errors.c
--- flatpak-1.0.0.orig/libglnx/glnx-errors.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-errors.c 2018-05-26 00:50:25.433037228 +0300
@@ -0,0 +1,131 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include <glnx-backport-autocleanups.h>
+#include <glnx-errors.h>
+
+/* Set @error with G_IO_ERROR/G_IO_ERROR_FAILED.
+ *
+ * This function returns %FALSE so it can be used conveniently in a single
+ * statement:
+ *
+ * ```
+ * if (strcmp (foo, "somevalue") != 0)
+ * return glnx_throw (error, "key must be somevalue, not '%s'", foo);
+ * ```
+ */
+gboolean
+glnx_throw (GError **error,
+ const char *fmt,
+ ...)
+{
+ if (error == NULL)
+ return FALSE;
+
+ va_list args;
+ va_start (args, fmt);
+ GError *new = g_error_new_valist (G_IO_ERROR, G_IO_ERROR_FAILED, fmt, args);
+ va_end (args);
+ g_propagate_error (error, g_steal_pointer (&new));
+ return FALSE;
+}
+
+void
+glnx_real_set_prefix_error_va (GError *error,
+ const char *format,
+ va_list args)
+{
+ if (error == NULL)
+ return;
+
+ g_autofree char *old_msg = g_steal_pointer (&error->message);
+ g_autoptr(GString) buf = g_string_new ("");
+ g_string_append_vprintf (buf, format, args);
+ g_string_append (buf, ": ");
+ g_string_append (buf, old_msg);
+ error->message = g_string_free (g_steal_pointer (&buf), FALSE);
+}
+
+/* Prepend to @error's message by `$prefix: ` where `$prefix` is computed via
+ * printf @fmt. Returns %FALSE so it can be used conveniently in a single
+ * statement:
+ *
+ * ```
+ * if (!function_that_fails (s, error))
+ * return glnx_throw_prefix (error, "while handling '%s'", s);
+ * ```
+ * */
+gboolean
+glnx_prefix_error (GError **error,
+ const char *fmt,
+ ...)
+{
+ if (error == NULL)
+ return FALSE;
+
+ va_list args;
+ va_start (args, fmt);
+ glnx_real_set_prefix_error_va (*error, fmt, args);
+ va_end (args);
+ return FALSE;
+}
+
+void
+glnx_real_set_prefix_error_from_errno_va (GError **error,
+ gint errsv,
+ const char *format,
+ va_list args)
+{
+ if (!error)
+ return;
+
+ g_set_error_literal (error,
+ G_IO_ERROR,
+ g_io_error_from_errno (errsv),
+ g_strerror (errsv));
+ glnx_real_set_prefix_error_va (*error, format, args);
+}
+
+/* Set @error using the value of `$prefix: g_strerror (errno)` where `$prefix`
+ * is computed via printf @fmt.
+ *
+ * This function returns %FALSE so it can be used conveniently in a single
+ * statement:
+ *
+ * ```
+ * return glnx_throw_errno_prefix (error, "unlinking %s", pathname);
+ * ```
+ */
+gboolean
+glnx_throw_errno_prefix (GError **error,
+ const char *fmt,
+ ...)
+{
+ int errsv = errno;
+ va_list args;
+ va_start (args, fmt);
+ glnx_real_set_prefix_error_from_errno_va (error, errsv, fmt, args);
+ va_end (args);
+ /* See comment in glnx_throw_errno() about preserving errno */
+ errno = errsv;
+ return FALSE;
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-errors.h flatpak-1.0.0/libglnx/glnx-errors.h
--- flatpak-1.0.0.orig/libglnx/glnx-errors.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-errors.h 2018-05-26 00:50:25.433037228 +0300
@@ -0,0 +1,134 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <glnx-backport-autocleanups.h>
+#include <errno.h>
+
+G_BEGIN_DECLS
+
+gboolean glnx_throw (GError **error, const char *fmt, ...) G_GNUC_PRINTF (2,3);
+
+/* Like `glnx_throw ()`, but returns %NULL. */
+#define glnx_null_throw(error, args...) \
+ ({glnx_throw (error, args); NULL;})
+
+/* Implementation detail of glnx_throw_prefix() */
+void glnx_real_set_prefix_error_va (GError *error,
+ const char *format,
+ va_list args) G_GNUC_PRINTF (2,0);
+
+gboolean glnx_prefix_error (GError **error, const char *fmt, ...) G_GNUC_PRINTF (2,3);
+
+/* Like `glnx_prefix_error ()`, but returns %NULL. */
+#define glnx_prefix_error_null(error, args...) \
+ ({glnx_prefix_error (error, args); NULL;})
+
+/**
+ * GLNX_AUTO_PREFIX_ERROR:
+ *
+ * An autocleanup-based macro to automatically call `g_prefix_error()` (also with a colon+space `: `)
+ * when it goes out of scope. This is useful when one wants error strings built up by the callee
+ * function, not all callers.
+ *
+ * ```
+ * gboolean start_http_request (..., GError **error)
+ * {
+ * GLNX_AUTO_PREFIX_ERROR ("HTTP request", error)
+ *
+ * if (!libhttp_request_start (..., error))
+ * return FALSE;
+ * ...
+ * return TRUE;
+ * ```
+ */
+typedef struct {
+ const char *prefix;
+ GError **error;
+} GLnxAutoErrorPrefix;
+static inline void
+glnx_cleanup_auto_prefix_error (GLnxAutoErrorPrefix *prefix)
+{
+ if (prefix->error && *(prefix->error))
+ g_prefix_error (prefix->error, "%s: ", prefix->prefix);
+}
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GLnxAutoErrorPrefix, glnx_cleanup_auto_prefix_error)
+#define GLNX_AUTO_PREFIX_ERROR(text, error) \
+ G_GNUC_UNUSED g_auto(GLnxAutoErrorPrefix) _GLNX_MAKE_ANONYMOUS(_glnxautoprefixerror_) = { text, error }
+
+/* Set @error using the value of `g_strerror (errno)`.
+ *
+ * This function returns %FALSE so it can be used conveniently in a single
+ * statement:
+ *
+ * ```
+ * if (unlinkat (fd, somepathname) < 0)
+ * return glnx_throw_errno (error);
+ * ```
+ */
+static inline gboolean
+glnx_throw_errno (GError **error)
+{
+ /* Save the value of errno, in case one of the
+ * intermediate function calls happens to set it.
+ */
+ int errsv = errno;
+ g_set_error_literal (error, G_IO_ERROR,
+ g_io_error_from_errno (errsv),
+ g_strerror (errsv));
+ /* We also restore the value of errno, since that's
+ * what was done in a long-ago libgsystem commit
+ * https://git.gnome.org/browse/libgsystem/commit/?id=ed106741f7a0596dc8b960b31fdae671d31d666d
+ * but I certainly can't remember now why I did that.
+ */
+ errno = errsv;
+ return FALSE;
+}
+
+/* Like glnx_throw_errno(), but yields a NULL pointer. */
+#define glnx_null_throw_errno(error) \
+ ({glnx_throw_errno (error); NULL;})
+
+/* Implementation detail of glnx_throw_errno_prefix() */
+void glnx_real_set_prefix_error_from_errno_va (GError **error,
+ gint errsv,
+ const char *format,
+ va_list args) G_GNUC_PRINTF (3,0);
+
+gboolean glnx_throw_errno_prefix (GError **error, const char *fmt, ...) G_GNUC_PRINTF (2,3);
+
+/* Like glnx_throw_errno_prefix(), but yields a NULL pointer. */
+#define glnx_null_throw_errno_prefix(error, args...) \
+ ({glnx_throw_errno_prefix (error, args); NULL;})
+
+/* BEGIN LEGACY APIS */
+
+#define glnx_set_error_from_errno(error) \
+ do { \
+ glnx_throw_errno (error); \
+ } while (0);
+
+#define glnx_set_prefix_error_from_errno(error, format, args...) \
+ do { \
+ glnx_throw_errno_prefix (error, format, args); \
+ } while (0);
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-fdio.c flatpak-1.0.0/libglnx/glnx-fdio.c
--- flatpak-1.0.0.orig/libglnx/glnx-fdio.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-fdio.c 2018-05-26 00:50:25.434037228 +0300
@@ -0,0 +1,1106 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * Portions derived from systemd:
+ * Copyright 2010 Lennart Poettering
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <sys/ioctl.h>
+#include <sys/sendfile.h>
+#include <errno.h>
+
+#include <glnx-fdio.h>
+#include <glnx-dirfd.h>
+#include <glnx-errors.h>
+#include <glnx-xattrs.h>
+#include <glnx-backport-autoptr.h>
+#include <glnx-local-alloc.h>
+#include <glnx-missing.h>
+
+/* The standardized version of BTRFS_IOC_CLONE */
+#ifndef FICLONE
+#define FICLONE _IOW(0x94, 9, int)
+#endif
+
+/* Returns the number of chars needed to format variables of the
+ * specified type as a decimal string. Adds in extra space for a
+ * negative '-' prefix (hence works correctly on signed
+ * types). Includes space for the trailing NUL. */
+#define DECIMAL_STR_MAX(type) \
+ (2+(sizeof(type) <= 1 ? 3 : \
+ sizeof(type) <= 2 ? 5 : \
+ sizeof(type) <= 4 ? 10 : \
+ sizeof(type) <= 8 ? 20 : sizeof(int[-2*(sizeof(type) > 8)])))
+
+gboolean
+glnx_stdio_file_flush (FILE *f, GError **error)
+{
+ if (fflush (f) != 0)
+ return glnx_throw_errno_prefix (error, "fflush");
+ if (ferror (f) != 0)
+ return glnx_throw_errno_prefix (error, "ferror");
+ return TRUE;
+}
+
+/* An implementation of renameat2(..., RENAME_NOREPLACE)
+ * with fallback to a non-atomic version.
+ */
+int
+glnx_renameat2_noreplace (int olddirfd, const char *oldpath,
+ int newdirfd, const char *newpath)
+{
+#ifndef ENABLE_WRPSEUDO_COMPAT
+ if (renameat2 (olddirfd, oldpath, newdirfd, newpath, RENAME_NOREPLACE) < 0)
+ {
+ if (G_IN_SET(errno, EINVAL, ENOSYS))
+ {
+ /* Fall through */
+ }
+ else
+ {
+ return -1;
+ }
+ }
+ else
+ return TRUE;
+#endif
+
+ if (linkat (olddirfd, oldpath, newdirfd, newpath, 0) < 0)
+ return -1;
+
+ if (unlinkat (olddirfd, oldpath, 0) < 0)
+ return -1;
+
+ return 0;
+}
+
+static gboolean
+rename_file_noreplace_at (int olddirfd, const char *oldpath,
+ int newdirfd, const char *newpath,
+ gboolean ignore_eexist,
+ GError **error)
+{
+ if (glnx_renameat2_noreplace (olddirfd, oldpath,
+ newdirfd, newpath) < 0)
+ {
+ if (errno == EEXIST && ignore_eexist)
+ {
+ (void) unlinkat (olddirfd, oldpath, 0);
+ return TRUE;
+ }
+ else
+ return glnx_throw_errno_prefix (error, "renameat");
+ }
+ return TRUE;
+}
+
+/* An implementation of renameat2(..., RENAME_EXCHANGE)
+ * with fallback to a non-atomic version.
+ */
+int
+glnx_renameat2_exchange (int olddirfd, const char *oldpath,
+ int newdirfd, const char *newpath)
+{
+#ifndef ENABLE_WRPSEUDO_COMPAT
+ if (renameat2 (olddirfd, oldpath, newdirfd, newpath, RENAME_EXCHANGE) == 0)
+ return 0;
+ else
+ {
+ if (G_IN_SET(errno, ENOSYS, EINVAL))
+ {
+ /* Fall through */
+ }
+ else
+ {
+ return -1;
+ }
+ }
+#endif
+
+ /* Fallback */
+ { char *old_tmp_name_buf = glnx_strjoina (oldpath, ".XXXXXX");
+ /* This obviously isn't race-free, but doing better gets tricky, since if
+ * we're here the kernel isn't likely to support RENAME_NOREPLACE either.
+ * Anyways, upgrade the kernel. Failing that, avoid use of this function in
+ * shared subdirectories like /tmp.
+ */
+ glnx_gen_temp_name (old_tmp_name_buf);
+ const char *old_tmp_name = old_tmp_name_buf;
+
+ /* Move old out of the way */
+ if (renameat (olddirfd, oldpath, olddirfd, old_tmp_name) < 0)
+ return -1;
+ /* Now move new into its place */
+ if (renameat (newdirfd, newpath, olddirfd, oldpath) < 0)
+ return -1;
+ /* And finally old(tmp) into new */
+ if (renameat (olddirfd, old_tmp_name, newdirfd, newpath) < 0)
+ return -1;
+ }
+ return 0;
+}
+
+/* Deallocate a tmpfile, closing the fd and deleting the path, if any. This is
+ * normally called by default by the autocleanup attribute, but you can also
+ * invoke this directly.
+ */
+void
+glnx_tmpfile_clear (GLnxTmpfile *tmpf)
+{
+ /* Support being passed NULL so we work nicely in a GPtrArray */
+ if (!tmpf)
+ return;
+ if (!tmpf->initialized)
+ return;
+ glnx_close_fd (&tmpf->fd);
+ /* If ->path is set, we're likely aborting due to an error. Clean it up */
+ if (tmpf->path)
+ {
+ (void) unlinkat (tmpf->src_dfd, tmpf->path, 0);
+ g_free (tmpf->path);
+ }
+ tmpf->initialized = FALSE;
+}
+
+static gboolean
+open_tmpfile_core (int dfd, const char *subpath,
+ int flags,
+ GLnxTmpfile *out_tmpf,
+ GError **error)
+{
+ /* Picked this to match mkstemp() */
+ const guint mode = 0600;
+
+ dfd = glnx_dirfd_canonicalize (dfd);
+
+ /* Creates a temporary file, that shall be renamed to "target"
+ * later. If possible, this uses O_TMPFILE – in which case
+ * "ret_path" will be returned as NULL. If not possible a the
+ * tempoary path name used is returned in "ret_path". Use
+ * link_tmpfile() below to rename the result after writing the file
+ * in full. */
+#if defined(O_TMPFILE) && !defined(DISABLE_OTMPFILE) && !defined(ENABLE_WRPSEUDO_COMPAT)
+ {
+ glnx_autofd int fd = openat (dfd, subpath, O_TMPFILE|flags, mode);
+ if (fd == -1 && !(G_IN_SET(errno, ENOSYS, EISDIR, EOPNOTSUPP)))
+ return glnx_throw_errno_prefix (error, "open(O_TMPFILE)");
+ if (fd != -1)
+ {
+ /* Workaround for https://sourceware.org/bugzilla/show_bug.cgi?id=17523
+ * See also https://github.com/ostreedev/ostree/issues/991
+ */
+ if (fchmod (fd, mode) < 0)
+ return glnx_throw_errno_prefix (error, "fchmod");
+ out_tmpf->initialized = TRUE;
+ out_tmpf->src_dfd = dfd; /* Copied; caller must keep open */
+ out_tmpf->fd = glnx_steal_fd (&fd);
+ out_tmpf->path = NULL;
+ return TRUE;
+ }
+ }
+ /* Fallthrough */
+#endif
+
+ const guint count_max = 100;
+ { g_autofree char *tmp = g_strconcat (subpath, "/tmp.XXXXXX", NULL);
+
+ for (int count = 0; count < count_max; count++)
+ {
+ glnx_gen_temp_name (tmp);
+
+ glnx_autofd int fd = openat (dfd, tmp, O_CREAT|O_EXCL|O_NOFOLLOW|O_NOCTTY|flags, mode);
+ if (fd < 0)
+ {
+ if (errno == EEXIST)
+ continue;
+ else
+ return glnx_throw_errno_prefix (error, "Creating temp file");
+ }
+ else
+ {
+ out_tmpf->initialized = TRUE;
+ out_tmpf->src_dfd = dfd; /* Copied; caller must keep open */
+ out_tmpf->fd = glnx_steal_fd (&fd);
+ out_tmpf->path = g_steal_pointer (&tmp);
+ return TRUE;
+ }
+ }
+ }
+ g_set_error (error, G_IO_ERROR, G_IO_ERROR_EXISTS,
+ "Exhausted %u attempts to create temporary file", count_max);
+ return FALSE;
+}
+
+/* Allocate a temporary file, using Linux O_TMPFILE if available. The file mode
+ * will be 0600.
+ *
+ * The result will be stored in @out_tmpf, which is caller allocated
+ * so you can store it on the stack in common scenarios.
+ *
+ * The directory fd @dfd must live at least as long as the output @out_tmpf.
+ */
+gboolean
+glnx_open_tmpfile_linkable_at (int dfd,
+ const char *subpath,
+ int flags,
+ GLnxTmpfile *out_tmpf,
+ GError **error)
+{
+ /* Don't allow O_EXCL, as that has a special meaning for O_TMPFILE;
+ * it's used for glnx_open_anonymous_tmpfile().
+ */
+ g_return_val_if_fail ((flags & O_EXCL) == 0, FALSE);
+
+ return open_tmpfile_core (dfd, subpath, flags, out_tmpf, error);
+}
+
+/* A variant of `glnx_open_tmpfile_linkable_at()` which doesn't support linking.
+ * Useful for true temporary storage. The fd will be allocated in /var/tmp to
+ * ensure maximum storage space.
+ */
+gboolean
+glnx_open_anonymous_tmpfile (int flags,
+ GLnxTmpfile *out_tmpf,
+ GError **error)
+{
+ /* Add in O_EXCL */
+ if (!open_tmpfile_core (AT_FDCWD, "/var/tmp", flags | O_EXCL, out_tmpf, error))
+ return FALSE;
+ if (out_tmpf->path)
+ {
+ (void) unlinkat (out_tmpf->src_dfd, out_tmpf->path, 0);
+ g_clear_pointer (&out_tmpf->path, g_free);
+ }
+ out_tmpf->anonymous = TRUE;
+ out_tmpf->src_dfd = -1;
+ return TRUE;
+}
+
+/* Use this after calling glnx_open_tmpfile_linkable_at() to give
+ * the file its final name (link into place).
+ */
+gboolean
+glnx_link_tmpfile_at (GLnxTmpfile *tmpf,
+ GLnxLinkTmpfileReplaceMode mode,
+ int target_dfd,
+ const char *target,
+ GError **error)
+{
+ const gboolean replace = (mode == GLNX_LINK_TMPFILE_REPLACE);
+ const gboolean ignore_eexist = (mode == GLNX_LINK_TMPFILE_NOREPLACE_IGNORE_EXIST);
+
+ g_return_val_if_fail (!tmpf->anonymous, FALSE);
+ g_return_val_if_fail (tmpf->fd >= 0, FALSE);
+ g_return_val_if_fail (tmpf->src_dfd == AT_FDCWD || tmpf->src_dfd >= 0, FALSE);
+
+ /* Unlike the original systemd code, this function also supports
+ * replacing existing files.
+ */
+
+ /* We have `tmpfile_path` for old systems without O_TMPFILE. */
+ if (tmpf->path)
+ {
+ if (replace)
+ {
+ /* We have a regular tempfile, we're overwriting - this is a
+ * simple renameat().
+ */
+ if (renameat (tmpf->src_dfd, tmpf->path, target_dfd, target) < 0)
+ return glnx_throw_errno_prefix (error, "renameat");
+ }
+ else
+ {
+ /* We need to use renameat2(..., NOREPLACE) or emulate it */
+ if (!rename_file_noreplace_at (tmpf->src_dfd, tmpf->path, target_dfd, target,
+ ignore_eexist,
+ error))
+ return FALSE;
+ }
+ /* Now, clear the pointer so we don't try to unlink it */
+ g_clear_pointer (&tmpf->path, g_free);
+ }
+ else
+ {
+ /* This case we have O_TMPFILE, so our reference to it is via /proc/self/fd */
+ char proc_fd_path[strlen("/proc/self/fd/") + DECIMAL_STR_MAX(tmpf->fd) + 1];
+
+ sprintf (proc_fd_path, "/proc/self/fd/%i", tmpf->fd);
+
+ if (replace)
+ {
+ /* In this case, we had our temp file atomically hidden, but now
+ * we need to make it visible in the FS so we can do a rename.
+ * Ideally, linkat() would gain AT_REPLACE or so.
+ */
+ /* TODO - avoid double alloca, we can just alloca a copy of
+ * the pathname plus space for tmp.XXXXX */
+ char *dnbuf = strdupa (target);
+ const char *dn = dirname (dnbuf);
+ char *tmpname_buf = glnx_strjoina (dn, "/tmp.XXXXXX");
+
+ const guint count_max = 100;
+ guint count;
+ for (count = 0; count < count_max; count++)
+ {
+ glnx_gen_temp_name (tmpname_buf);
+
+ if (linkat (AT_FDCWD, proc_fd_path, target_dfd, tmpname_buf, AT_SYMLINK_FOLLOW) < 0)
+ {
+ if (errno == EEXIST)
+ continue;
+ else
+ return glnx_throw_errno_prefix (error, "linkat");
+ }
+ else
+ break;
+ }
+ if (count == count_max)
+ {
+ g_set_error (error, G_IO_ERROR, G_IO_ERROR_EXISTS,
+ "Exhausted %u attempts to create temporary file", count);
+ return FALSE;
+ }
+ if (!glnx_renameat (target_dfd, tmpname_buf, target_dfd, target, error))
+ {
+ /* This is currently the only case where we need to have
+ * a cleanup unlinkat() still with O_TMPFILE.
+ */
+ (void) unlinkat (target_dfd, tmpname_buf, 0);
+ return FALSE;
+ }
+ }
+ else
+ {
+ if (linkat (AT_FDCWD, proc_fd_path, target_dfd, target, AT_SYMLINK_FOLLOW) < 0)
+ {
+ if (errno == EEXIST && mode == GLNX_LINK_TMPFILE_NOREPLACE_IGNORE_EXIST)
+ ;
+ else
+ return glnx_throw_errno_prefix (error, "linkat");
+ }
+ }
+
+ }
+ return TRUE;
+}
+
+/**
+ * glnx_openat_rdonly:
+ * @dfd: File descriptor for origin directory
+ * @path: Pathname, relative to @dfd
+ * @follow: Whether or not to follow symbolic links in the final component
+ * @out_fd: (out): File descriptor
+ * @error: Error
+ *
+ * Use openat() to open a file, with flags `O_RDONLY | O_CLOEXEC | O_NOCTTY`.
+ * Like the other libglnx wrappers, will use `TEMP_FAILURE_RETRY` and
+ * also includes @path in @error in case of failure.
+ */
+gboolean
+glnx_openat_rdonly (int dfd,
+ const char *path,
+ gboolean follow,
+ int *out_fd,
+ GError **error)
+{
+ int flags = O_RDONLY | O_CLOEXEC | O_NOCTTY;
+ if (!follow)
+ flags |= O_NOFOLLOW;
+ int fd = TEMP_FAILURE_RETRY (openat (dfd, path, flags));
+ if (fd == -1)
+ return glnx_throw_errno_prefix (error, "openat(%s)", path);
+ *out_fd = fd;
+ return TRUE;
+}
+
+static guint8*
+glnx_fd_readall_malloc (int fd,
+ gsize *out_len,
+ gboolean nul_terminate,
+ GCancellable *cancellable,
+ GError **error)
+{
+ const guint maxreadlen = 4096;
+
+ struct stat stbuf;
+ if (!glnx_fstat (fd, &stbuf, error))
+ return FALSE;
+
+ gsize buf_allocated;
+ if (S_ISREG (stbuf.st_mode) && stbuf.st_size > 0)
+ buf_allocated = stbuf.st_size;
+ else
+ buf_allocated = 16;
+
+ g_autofree guint8* buf = g_malloc (buf_allocated);
+
+ gsize buf_size = 0;
+ while (TRUE)
+ {
+ gsize readlen = MIN (buf_allocated - buf_size, maxreadlen);
+
+ if (g_cancellable_set_error_if_cancelled (cancellable, error))
+ return FALSE;
+
+ gssize bytes_read;
+ do
+ bytes_read = read (fd, buf + buf_size, readlen);
+ while (G_UNLIKELY (bytes_read == -1 && errno == EINTR));
+ if (G_UNLIKELY (bytes_read == -1))
+ return glnx_null_throw_errno (error);
+ if (bytes_read == 0)
+ break;
+
+ buf_size += bytes_read;
+ if (buf_allocated - buf_size < maxreadlen)
+ buf = g_realloc (buf, buf_allocated *= 2);
+ }
+
+ if (nul_terminate)
+ {
+ if (buf_allocated - buf_size == 0)
+ buf = g_realloc (buf, buf_allocated + 1);
+ buf[buf_size] = '\0';
+ }
+
+ *out_len = buf_size;
+ return g_steal_pointer (&buf);
+}
+
+/**
+ * glnx_fd_readall_bytes:
+ * @fd: A file descriptor
+ * @cancellable: Cancellable:
+ * @error: Error
+ *
+ * Read all data from file descriptor @fd into a #GBytes. It's
+ * recommended to only use this for small files.
+ *
+ * Returns: (transfer full): A newly allocated #GBytes
+ */
+GBytes *
+glnx_fd_readall_bytes (int fd,
+ GCancellable *cancellable,
+ GError **error)
+{
+ gsize len;
+ guint8 *buf = glnx_fd_readall_malloc (fd, &len, FALSE, cancellable, error);
+ if (!buf)
+ return NULL;
+ return g_bytes_new_take (buf, len);
+}
+
+/**
+ * glnx_fd_readall_utf8:
+ * @fd: A file descriptor
+ * @out_len: (out): Returned length
+ * @cancellable: Cancellable:
+ * @error: Error
+ *
+ * Read all data from file descriptor @fd, validating
+ * the result as UTF-8.
+ *
+ * Returns: (transfer full): A string validated as UTF-8, or %NULL on error.
+ */
+char *
+glnx_fd_readall_utf8 (int fd,
+ gsize *out_len,
+ GCancellable *cancellable,
+ GError **error)
+{
+ gsize len;
+ g_autofree guint8 *buf = glnx_fd_readall_malloc (fd, &len, TRUE, cancellable, error);
+ if (!buf)
+ return FALSE;
+
+ if (!g_utf8_validate ((char*)buf, len, NULL))
+ {
+ g_set_error (error,
+ G_IO_ERROR,
+ G_IO_ERROR_INVALID_DATA,
+ "Invalid UTF-8");
+ return FALSE;
+ }
+
+ if (out_len)
+ *out_len = len;
+ return (char*)g_steal_pointer (&buf);
+}
+
+/**
+ * glnx_file_get_contents_utf8_at:
+ * @dfd: Directory file descriptor
+ * @subpath: Path relative to @dfd
+ * @out_len: (out) (allow-none): Optional length
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Read the entire contents of the file referred
+ * to by @dfd and @subpath, validate the result as UTF-8.
+ * The length is optionally stored in @out_len.
+ *
+ * Returns: (transfer full): UTF-8 validated text, or %NULL on error
+ */
+char *
+glnx_file_get_contents_utf8_at (int dfd,
+ const char *subpath,
+ gsize *out_len,
+ GCancellable *cancellable,
+ GError **error)
+{
+ dfd = glnx_dirfd_canonicalize (dfd);
+
+ glnx_autofd int fd = -1;
+ if (!glnx_openat_rdonly (dfd, subpath, TRUE, &fd, error))
+ return NULL;
+
+ gsize len;
+ g_autofree char *buf = glnx_fd_readall_utf8 (fd, &len, cancellable, error);
+ if (G_UNLIKELY(!buf))
+ return FALSE;
+
+ if (out_len)
+ *out_len = len;
+ return g_steal_pointer (&buf);
+}
+
+/**
+ * glnx_readlinkat_malloc:
+ * @dfd: Directory file descriptor
+ * @subpath: Subpath
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Read the value of a symlink into a dynamically
+ * allocated buffer.
+ */
+char *
+glnx_readlinkat_malloc (int dfd,
+ const char *subpath,
+ GCancellable *cancellable,
+ GError **error)
+{
+ dfd = glnx_dirfd_canonicalize (dfd);
+
+ size_t l = 100;
+ for (;;)
+ {
+ g_autofree char *c = g_malloc (l);
+ ssize_t n = TEMP_FAILURE_RETRY (readlinkat (dfd, subpath, c, l-1));
+ if (n < 0)
+ return glnx_null_throw_errno_prefix (error, "readlinkat");
+
+ if ((size_t) n < l-1)
+ {
+ c[n] = 0;
+ return g_steal_pointer (&c);
+ }
+
+ l *= 2;
+ }
+
+ g_assert_not_reached ();
+}
+
+static gboolean
+copy_symlink_at (int src_dfd,
+ const char *src_subpath,
+ const struct stat *src_stbuf,
+ int dest_dfd,
+ const char *dest_subpath,
+ GLnxFileCopyFlags copyflags,
+ GCancellable *cancellable,
+ GError **error)
+{
+ g_autofree char *buf = glnx_readlinkat_malloc (src_dfd, src_subpath, cancellable, error);
+ if (!buf)
+ return FALSE;
+
+ if (TEMP_FAILURE_RETRY (symlinkat (buf, dest_dfd, dest_subpath)) != 0)
+ return glnx_throw_errno_prefix (error, "symlinkat");
+
+ if (!(copyflags & GLNX_FILE_COPY_NOXATTRS))
+ {
+ g_autoptr(GVariant) xattrs = NULL;
+
+ if (!glnx_dfd_name_get_all_xattrs (src_dfd, src_subpath, &xattrs,
+ cancellable, error))
+ return FALSE;
+
+ if (!glnx_dfd_name_set_all_xattrs (dest_dfd, dest_subpath, xattrs,
+ cancellable, error))
+ return FALSE;
+ }
+
+ if (TEMP_FAILURE_RETRY (fchownat (dest_dfd, dest_subpath,
+ src_stbuf->st_uid, src_stbuf->st_gid,
+ AT_SYMLINK_NOFOLLOW)) != 0)
+ return glnx_throw_errno_prefix (error, "fchownat");
+
+ return TRUE;
+}
+
+#define COPY_BUFFER_SIZE (16*1024)
+
+/* Most of the code below is from systemd, but has been reindented to GNU style,
+ * and changed to use POSIX error conventions (return -1, set errno) to more
+ * conveniently fit in with the rest of libglnx.
+ */
+
+/* Like write(), but loop until @nbytes are written, or an error
+ * occurs.
+ *
+ * On error, -1 is returned an @errno is set. NOTE: This is an
+ * API change from previous versions of this function.
+ */
+int
+glnx_loop_write(int fd, const void *buf, size_t nbytes)
+{
+ g_return_val_if_fail (fd >= 0, -1);
+ g_return_val_if_fail (buf, -1);
+
+ errno = 0;
+
+ const uint8_t *p = buf;
+ while (nbytes > 0)
+ {
+ ssize_t k = write(fd, p, nbytes);
+ if (k < 0)
+ {
+ if (errno == EINTR)
+ continue;
+
+ return -1;
+ }
+
+ if (k == 0) /* Can't really happen */
+ {
+ errno = EIO;
+ return -1;
+ }
+
+ p += k;
+ nbytes -= k;
+ }
+
+ return 0;
+}
+
+/* Read from @fdf until EOF, writing to @fdt. If max_bytes is -1, a full-file
+ * clone will be attempted. Otherwise Linux copy_file_range(), sendfile()
+ * syscall will be attempted. If none of those work, this function will do a
+ * plain read()/write() loop.
+ *
+ * The file descriptor @fdf must refer to a regular file.
+ *
+ * If provided, @max_bytes specifies the maximum number of bytes to read from @fdf.
+ * On error, this function returns `-1` and @errno will be set.
+ */
+int
+glnx_regfile_copy_bytes (int fdf, int fdt, off_t max_bytes)
+{
+ /* Last updates from systemd as of commit 6bda23dd6aaba50cf8e3e6024248cf736cc443ca */
+ static int have_cfr = -1; /* -1 means unknown */
+ bool try_cfr = have_cfr != 0;
+ static int have_sendfile = -1; /* -1 means unknown */
+ bool try_sendfile = have_sendfile != 0;
+
+ g_return_val_if_fail (fdf >= 0, -1);
+ g_return_val_if_fail (fdt >= 0, -1);
+ g_return_val_if_fail (max_bytes >= -1, -1);
+
+ /* If we've requested to copy the whole range, try a full-file clone first.
+ */
+ if (max_bytes == (off_t) -1)
+ {
+ if (ioctl (fdt, FICLONE, fdf) == 0)
+ return 0;
+ /* Fall through */
+ struct stat stbuf;
+
+ /* Gather the size so we can provide the whole thing at once to
+ * copy_file_range() or sendfile().
+ */
+ if (fstat (fdf, &stbuf) < 0)
+ return -1;
+ max_bytes = stbuf.st_size;
+ }
+
+ while (TRUE)
+ {
+ ssize_t n;
+
+ /* First, try copy_file_range(). Note this is an inlined version of
+ * try_copy_file_range() from systemd upstream, which works better since
+ * we use POSIX errno style.
+ */
+ if (try_cfr)
+ {
+ n = copy_file_range (fdf, NULL, fdt, NULL, max_bytes, 0u);
+ if (n < 0)
+ {
+ if (errno == ENOSYS)
+ {
+ /* No cfr in kernel, mark as permanently unavailable
+ * and fall through to sendfile().
+ */
+ have_cfr = 0;
+ try_cfr = false;
+ }
+ else if (errno == EXDEV)
+ /* We won't try cfr again for this run, but let's be
+ * conservative and not mark it as available/unavailable until
+ * we know for sure.
+ */
+ try_cfr = false;
+ else
+ return -1;
+ }
+ else
+ {
+ /* cfr worked, mark it as available */
+ if (have_cfr == -1)
+ have_cfr = 1;
+
+ if (n == 0) /* EOF */
+ break;
+ else
+ /* Success! */
+ goto next;
+ }
+ }
+
+ /* Next try sendfile(); this version is also changed from systemd upstream
+ * to match the same logic we have for copy_file_range().
+ */
+ if (try_sendfile)
+ {
+ n = sendfile (fdt, fdf, NULL, max_bytes);
+ if (n < 0)
+ {
+ if (G_IN_SET (errno, EINVAL, ENOSYS))
+ {
+ /* No sendfile(), or it doesn't work on regular files.
+ * Mark it as permanently unavailable, and fall through
+ * to plain read()/write().
+ */
+ have_sendfile = 0;
+ try_sendfile = false;
+ }
+ else
+ return -1;
+ }
+ else
+ {
+ /* sendfile() worked, mark it as available */
+ if (have_sendfile == -1)
+ have_sendfile = 1;
+
+ if (n == 0) /* EOF */
+ break;
+ else if (n > 0)
+ /* Succcess! */
+ goto next;
+ }
+ }
+
+ /* As a fallback just copy bits by hand */
+ { size_t m = COPY_BUFFER_SIZE;
+ if (max_bytes != (off_t) -1)
+ {
+ if ((off_t) m > max_bytes)
+ m = (size_t) max_bytes;
+ }
+ char buf[m];
+
+ n = TEMP_FAILURE_RETRY (read (fdf, buf, m));
+ if (n < 0)
+ return -1;
+ if (n == 0) /* EOF */
+ break;
+
+ if (glnx_loop_write (fdt, buf, (size_t) n) < 0)
+ return -1;
+ }
+
+ next:
+ if (max_bytes != (off_t) -1)
+ {
+ g_assert_cmpint (max_bytes, >=, n);
+ max_bytes -= n;
+ if (max_bytes == 0)
+ break;
+ }
+ }
+
+ return 0;
+}
+
+/**
+ * glnx_file_copy_at:
+ * @src_dfd: Source directory fd
+ * @src_subpath: Subpath relative to @src_dfd
+ * @src_stbuf: (allow-none): Optional stat buffer for source; if a stat() has already been done
+ * @dest_dfd: Target directory fd
+ * @dest_subpath: Destination name
+ * @copyflags: Flags
+ * @cancellable: cancellable
+ * @error: Error
+ *
+ * Perform a full copy of the regular file or symbolic link from @src_subpath to
+ * @dest_subpath; if @src_subpath is anything other than a regular file or
+ * symbolic link, an error will be returned.
+ *
+ * If the source is a regular file and the destination exists as a symbolic
+ * link, the symbolic link will not be followed; rather the link itself will be
+ * replaced. Related to this: for regular files, when `GLNX_FILE_COPY_OVERWRITE`
+ * is specified, this function always uses `O_TMPFILE` (if available) and does a
+ * rename-into-place rather than `open(O_TRUNC)`.
+ */
+gboolean
+glnx_file_copy_at (int src_dfd,
+ const char *src_subpath,
+ struct stat *src_stbuf,
+ int dest_dfd,
+ const char *dest_subpath,
+ GLnxFileCopyFlags copyflags,
+ GCancellable *cancellable,
+ GError **error)
+{
+ /* Canonicalize dfds */
+ src_dfd = glnx_dirfd_canonicalize (src_dfd);
+ dest_dfd = glnx_dirfd_canonicalize (dest_dfd);
+
+ if (g_cancellable_set_error_if_cancelled (cancellable, error))
+ return FALSE;
+
+ /* Automatically do stat() if no stat buffer was supplied */
+ struct stat local_stbuf;
+ if (!src_stbuf)
+ {
+ if (!glnx_fstatat (src_dfd, src_subpath, &local_stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return FALSE;
+ src_stbuf = &local_stbuf;
+ }
+
+ /* For symlinks, defer entirely to copy_symlink_at() */
+ if (S_ISLNK (src_stbuf->st_mode))
+ {
+ return copy_symlink_at (src_dfd, src_subpath, src_stbuf,
+ dest_dfd, dest_subpath,
+ copyflags,
+ cancellable, error);
+ }
+ else if (!S_ISREG (src_stbuf->st_mode))
+ {
+ g_set_error (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,
+ "Cannot copy non-regular/non-symlink file: %s", src_subpath);
+ return FALSE;
+ }
+
+ /* Regular file path below here */
+
+ glnx_autofd int src_fd = -1;
+ if (!glnx_openat_rdonly (src_dfd, src_subpath, FALSE, &src_fd, error))
+ return FALSE;
+
+ /* Open a tmpfile for dest. Particularly for AT_FDCWD calls, we really want to
+ * open in the target directory, otherwise we may not be able to link.
+ */
+ g_auto(GLnxTmpfile) tmp_dest = { 0, };
+ { char *dnbuf = strdupa (dest_subpath);
+ const char *dn = dirname (dnbuf);
+ if (!glnx_open_tmpfile_linkable_at (dest_dfd, dn, O_WRONLY | O_CLOEXEC,
+ &tmp_dest, error))
+ return FALSE;
+ }
+
+ if (glnx_regfile_copy_bytes (src_fd, tmp_dest.fd, (off_t) -1) < 0)
+ return glnx_throw_errno_prefix (error, "regfile copy");
+
+ if (fchown (tmp_dest.fd, src_stbuf->st_uid, src_stbuf->st_gid) != 0)
+ return glnx_throw_errno_prefix (error, "fchown");
+
+ if (!(copyflags & GLNX_FILE_COPY_NOXATTRS))
+ {
+ g_autoptr(GVariant) xattrs = NULL;
+
+ if (!glnx_fd_get_all_xattrs (src_fd, &xattrs,
+ cancellable, error))
+ return FALSE;
+
+ if (!glnx_fd_set_all_xattrs (tmp_dest.fd, xattrs,
+ cancellable, error))
+ return FALSE;
+ }
+
+ /* Always chmod after setting xattrs, in case the file has mode 0400 or less,
+ * like /etc/shadow. Linux currently allows write() on non-writable open files
+ * but not fsetxattr().
+ */
+ if (fchmod (tmp_dest.fd, src_stbuf->st_mode & 07777) != 0)
+ return glnx_throw_errno_prefix (error, "fchmod");
+
+ struct timespec ts[2];
+ ts[0] = src_stbuf->st_atim;
+ ts[1] = src_stbuf->st_mtim;
+ (void) futimens (tmp_dest.fd, ts);
+
+ if (copyflags & GLNX_FILE_COPY_DATASYNC)
+ {
+ if (fdatasync (tmp_dest.fd) < 0)
+ return glnx_throw_errno_prefix (error, "fdatasync");
+ }
+
+ const GLnxLinkTmpfileReplaceMode replacemode =
+ (copyflags & GLNX_FILE_COPY_OVERWRITE) ?
+ GLNX_LINK_TMPFILE_REPLACE :
+ GLNX_LINK_TMPFILE_NOREPLACE;
+
+ if (!glnx_link_tmpfile_at (&tmp_dest, replacemode, dest_dfd, dest_subpath, error))
+ return FALSE;
+
+ return TRUE;
+}
+
+/**
+ * glnx_file_replace_contents_at:
+ * @dfd: Directory fd
+ * @subpath: Subpath
+ * @buf: (array len=len) (element-type guint8): File contents
+ * @len: Length (if `-1`, assume @buf is `NUL` terminated)
+ * @flags: Flags
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Create a new file, atomically replacing the contents of @subpath
+ * (relative to @dfd) with @buf. By default, if the file already
+ * existed, fdatasync() will be used before rename() to ensure stable
+ * contents. This and other behavior can be controlled via @flags.
+ *
+ * Note that no metadata from the existing file is preserved, such as
+ * uid/gid or extended attributes. The default mode will be `0666`,
+ * modified by umask.
+ */
+gboolean
+glnx_file_replace_contents_at (int dfd,
+ const char *subpath,
+ const guint8 *buf,
+ gsize len,
+ GLnxFileReplaceFlags flags,
+ GCancellable *cancellable,
+ GError **error)
+{
+ return glnx_file_replace_contents_with_perms_at (dfd, subpath, buf, len,
+ (mode_t) -1, (uid_t) -1, (gid_t) -1,
+ flags, cancellable, error);
+}
+
+/**
+ * glnx_file_replace_contents_with_perms_at:
+ * @dfd: Directory fd
+ * @subpath: Subpath
+ * @buf: (array len=len) (element-type guint8): File contents
+ * @len: Length (if `-1`, assume @buf is `NUL` terminated)
+ * @mode: File mode; if `-1`, use `0666 - umask`
+ * @flags: Flags
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Like glnx_file_replace_contents_at(), but also supports
+ * setting mode, and uid/gid.
+ */
+gboolean
+glnx_file_replace_contents_with_perms_at (int dfd,
+ const char *subpath,
+ const guint8 *buf,
+ gsize len,
+ mode_t mode,
+ uid_t uid,
+ gid_t gid,
+ GLnxFileReplaceFlags flags,
+ GCancellable *cancellable,
+ GError **error)
+{
+ char *dnbuf = strdupa (subpath);
+ const char *dn = dirname (dnbuf);
+
+ dfd = glnx_dirfd_canonicalize (dfd);
+
+ /* With O_TMPFILE we can't use umask, and we can't sanely query the
+ * umask...let's assume something relatively standard.
+ */
+ if (mode == (mode_t) -1)
+ mode = 0644;
+
+ g_auto(GLnxTmpfile) tmpf = { 0, };
+ if (!glnx_open_tmpfile_linkable_at (dfd, dn, O_WRONLY | O_CLOEXEC,
+ &tmpf, error))
+ return FALSE;
+
+ if (len == -1)
+ len = strlen ((char*)buf);
+
+ if (!glnx_try_fallocate (tmpf.fd, 0, len, error))
+ return FALSE;
+
+ if (glnx_loop_write (tmpf.fd, buf, len) < 0)
+ return glnx_throw_errno_prefix (error, "write");
+
+ if (!(flags & GLNX_FILE_REPLACE_NODATASYNC))
+ {
+ struct stat stbuf;
+ gboolean do_sync;
+
+ if (!glnx_fstatat_allow_noent (dfd, subpath, &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return FALSE;
+ if (errno == ENOENT)
+ do_sync = (flags & GLNX_FILE_REPLACE_DATASYNC_NEW) > 0;
+ else
+ do_sync = TRUE;
+
+ if (do_sync)
+ {
+ if (fdatasync (tmpf.fd) != 0)
+ return glnx_throw_errno_prefix (error, "fdatasync");
+ }
+ }
+
+ if (uid != (uid_t) -1)
+ {
+ if (fchown (tmpf.fd, uid, gid) != 0)
+ return glnx_throw_errno_prefix (error, "fchown");
+ }
+
+ if (fchmod (tmpf.fd, mode) != 0)
+ return glnx_throw_errno_prefix (error, "fchmod");
+
+ if (!glnx_link_tmpfile_at (&tmpf, GLNX_LINK_TMPFILE_REPLACE,
+ dfd, subpath, error))
+ return FALSE;
+
+ return TRUE;
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-fdio.h flatpak-1.0.0/libglnx/glnx-fdio.h
--- flatpak-1.0.0.orig/libglnx/glnx-fdio.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-fdio.h 2018-05-26 00:50:25.434037228 +0300
@@ -0,0 +1,369 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <glnx-backport-autocleanups.h>
+#include <gio/gfiledescriptorbased.h>
+#include <limits.h>
+#include <dirent.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <string.h>
+#include <stdio.h>
+#include <sys/xattr.h>
+// For dirname(), and previously basename()
+#include <libgen.h>
+
+#include <glnx-macros.h>
+#include <glnx-errors.h>
+
+G_BEGIN_DECLS
+
+/* Irritatingly, g_basename() which is what we want
+ * is deprecated.
+ */
+static inline
+const char *glnx_basename (const char *path)
+{
+ gchar *base = strrchr (path, G_DIR_SEPARATOR);
+
+ if (base)
+ return base + 1;
+
+ return path;
+}
+
+/* Utilities for standard FILE* */
+static inline void
+glnx_stdio_file_cleanup (void *filep)
+{
+ FILE *f = filep;
+ if (f)
+ fclose (f);
+}
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(FILE, glnx_stdio_file_cleanup)
+
+/**
+ * glnx_stdio_file_flush:
+ * Call fflush() and check ferror().
+ */
+gboolean
+glnx_stdio_file_flush (FILE *f, GError **error);
+
+typedef struct {
+ gboolean initialized;
+ gboolean anonymous;
+ int src_dfd;
+ int fd;
+ char *path;
+} GLnxTmpfile;
+void glnx_tmpfile_clear (GLnxTmpfile *tmpf);
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GLnxTmpfile, glnx_tmpfile_clear)
+
+gboolean
+glnx_open_anonymous_tmpfile (int flags,
+ GLnxTmpfile *out_tmpf,
+ GError **error);
+
+gboolean
+glnx_open_tmpfile_linkable_at (int dfd,
+ const char *subpath,
+ int flags,
+ GLnxTmpfile *out_tmpf,
+ GError **error);
+
+typedef enum {
+ GLNX_LINK_TMPFILE_REPLACE,
+ GLNX_LINK_TMPFILE_NOREPLACE,
+ GLNX_LINK_TMPFILE_NOREPLACE_IGNORE_EXIST
+} GLnxLinkTmpfileReplaceMode;
+
+gboolean
+glnx_link_tmpfile_at (GLnxTmpfile *tmpf,
+ GLnxLinkTmpfileReplaceMode flags,
+ int target_dfd,
+ const char *target,
+ GError **error);
+
+gboolean
+glnx_openat_rdonly (int dfd,
+ const char *path,
+ gboolean follow,
+ int *out_fd,
+ GError **error);
+
+GBytes *
+glnx_fd_readall_bytes (int fd,
+ GCancellable *cancellable,
+ GError **error);
+
+char *
+glnx_fd_readall_utf8 (int fd,
+ gsize *out_len,
+ GCancellable *cancellable,
+ GError **error);
+
+char *
+glnx_file_get_contents_utf8_at (int dfd,
+ const char *subpath,
+ gsize *out_len,
+ GCancellable *cancellable,
+ GError **error);
+
+/**
+ * GLnxFileReplaceFlags:
+ * @GLNX_FILE_REPLACE_DATASYNC_NEW: Call fdatasync() even if the file did not exist
+ * @GLNX_FILE_REPLACE_NODATASYNC: Never call fdatasync()
+ *
+ * Flags controlling file replacement.
+ */
+typedef enum {
+ GLNX_FILE_REPLACE_DATASYNC_NEW = (1 << 0),
+ GLNX_FILE_REPLACE_NODATASYNC = (1 << 1),
+} GLnxFileReplaceFlags;
+
+gboolean
+glnx_file_replace_contents_at (int dfd,
+ const char *subpath,
+ const guint8 *buf,
+ gsize len,
+ GLnxFileReplaceFlags flags,
+ GCancellable *cancellable,
+ GError **error);
+
+gboolean
+glnx_file_replace_contents_with_perms_at (int dfd,
+ const char *subpath,
+ const guint8 *buf,
+ gsize len,
+ mode_t mode,
+ uid_t uid,
+ gid_t gid,
+ GLnxFileReplaceFlags flags,
+ GCancellable *cancellable,
+ GError **error);
+
+char *
+glnx_readlinkat_malloc (int dfd,
+ const char *subpath,
+ GCancellable *cancellable,
+ GError **error);
+
+int
+glnx_loop_write (int fd, const void *buf, size_t nbytes);
+
+int
+glnx_regfile_copy_bytes (int fdf, int fdt, off_t max_bytes);
+
+typedef enum {
+ GLNX_FILE_COPY_OVERWRITE = (1 << 0),
+ GLNX_FILE_COPY_NOXATTRS = (1 << 1),
+ GLNX_FILE_COPY_DATASYNC = (1 << 2)
+} GLnxFileCopyFlags;
+
+gboolean
+glnx_file_copy_at (int src_dfd,
+ const char *src_subpath,
+ struct stat *src_stbuf,
+ int dest_dfd,
+ const char *dest_subpath,
+ GLnxFileCopyFlags copyflags,
+ GCancellable *cancellable,
+ GError **error);
+
+int glnx_renameat2_noreplace (int olddirfd, const char *oldpath,
+ int newdirfd, const char *newpath);
+int glnx_renameat2_exchange (int olddirfd, const char *oldpath,
+ int newdirfd, const char *newpath);
+
+/**
+ * glnx_try_fallocate:
+ * @fd: File descriptor
+ * @size: Size
+ * @error: Error
+ *
+ * Wrapper for Linux fallocate(). Explicitly ignores a @size of zero.
+ * Also, will silently do nothing if the underlying filesystem doesn't
+ * support it. Use this instead of posix_fallocate(), since the glibc fallback
+ * is bad: https://sourceware.org/bugzilla/show_bug.cgi?id=18515
+ */
+static inline gboolean
+glnx_try_fallocate (int fd,
+ off_t offset,
+ off_t size,
+ GError **error)
+{
+ /* This is just nicer than throwing an error */
+ if (size == 0)
+ return TRUE;
+
+ if (fallocate (fd, 0, offset, size) < 0)
+ {
+ if (G_IN_SET(errno, ENOSYS, EOPNOTSUPP))
+ ; /* Ignore */
+ else
+ return glnx_throw_errno_prefix (error, "fallocate");
+ }
+
+ return TRUE;
+}
+
+/**
+ * glnx_fstat:
+ * @fd: FD to stat
+ * @buf: (out caller-allocates): Return location for stat details
+ * @error: Return location for a #GError, or %NULL
+ *
+ * Wrapper around fstat() which adds #GError support and ensures that it retries
+ * on %EINTR.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ * Since: UNRELEASED
+ */
+static inline gboolean
+glnx_fstat (int fd,
+ struct stat *buf,
+ GError **error)
+{
+ if (TEMP_FAILURE_RETRY (fstat (fd, buf)) != 0)
+ return glnx_throw_errno_prefix (error, "fstat");
+ return TRUE;
+}
+
+/**
+ * glnx_fchmod:
+ * @fd: FD
+ * @mode: Mode
+ * @error: Return location for a #GError, or %NULL
+ *
+ * Wrapper around fchmod() which adds #GError support and ensures that it
+ * retries on %EINTR.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ * Since: UNRELEASED
+ */
+static inline gboolean
+glnx_fchmod (int fd,
+ mode_t mode,
+ GError **error)
+{
+ if (TEMP_FAILURE_RETRY (fchmod (fd, mode)) != 0)
+ return glnx_throw_errno_prefix (error, "fchmod");
+ return TRUE;
+}
+
+/**
+ * glnx_fstatat:
+ * @dfd: Directory FD to stat beneath
+ * @path: Path to stat beneath @dfd
+ * @buf: (out caller-allocates): Return location for stat details
+ * @flags: Flags to pass to fstatat()
+ * @error: Return location for a #GError, or %NULL
+ *
+ * Wrapper around fstatat() which adds #GError support and ensures that it
+ * retries on %EINTR.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ * Since: UNRELEASED
+ */
+static inline gboolean
+glnx_fstatat (int dfd,
+ const gchar *path,
+ struct stat *buf,
+ int flags,
+ GError **error)
+{
+ if (TEMP_FAILURE_RETRY (fstatat (dfd, path, buf, flags)) != 0)
+ return glnx_throw_errno_prefix (error, "fstatat(%s)", path);
+ return TRUE;
+}
+
+/**
+ * glnx_fstatat_allow_noent:
+ * @dfd: Directory FD to stat beneath
+ * @path: Path to stat beneath @dfd
+ * @buf: (out caller-allocates) (allow-none): Return location for stat details
+ * @flags: Flags to pass to fstatat()
+ * @error: Return location for a #GError, or %NULL
+ *
+ * Like glnx_fstatat(), but handles `ENOENT` in a non-error way. Instead,
+ * on success `errno` will be zero, otherwise it will be preserved. Hence
+ * you can test `if (errno == 0)` to conditionalize on the file existing,
+ * or `if (errno == ENOENT)` for non-existence.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise (errno is preserved)
+ * Since: UNRELEASED
+ */
+static inline gboolean
+glnx_fstatat_allow_noent (int dfd,
+ const char *path,
+ struct stat *out_buf,
+ int flags,
+ GError **error)
+{
+ G_GNUC_UNUSED struct stat unused_stbuf;
+ if (TEMP_FAILURE_RETRY (fstatat (dfd, path, out_buf ? out_buf : &unused_stbuf, flags)) != 0)
+ {
+ if (errno != ENOENT)
+ return glnx_throw_errno_prefix (error, "fstatat(%s)", path);
+ /* Note we preserve errno as ENOENT */
+ }
+ else
+ errno = 0;
+ return TRUE;
+}
+
+/**
+ * glnx_renameat:
+ *
+ * Wrapper around renameat() which adds #GError support and ensures that it
+ * retries on %EINTR.
+ */
+static inline gboolean
+glnx_renameat (int src_dfd,
+ const gchar *src_path,
+ int dest_dfd,
+ const gchar *dest_path,
+ GError **error)
+{
+ if (TEMP_FAILURE_RETRY (renameat (src_dfd, src_path, dest_dfd, dest_path)) != 0)
+ return glnx_throw_errno_prefix (error, "renameat(%s, %s)", src_path, dest_path);
+ return TRUE;
+}
+
+/**
+ * glnx_unlinkat:
+ *
+ * Wrapper around unlinkat() which adds #GError support and ensures that it
+ * retries on %EINTR.
+ */
+static inline gboolean
+glnx_unlinkat (int dfd,
+ const gchar *path,
+ int flags,
+ GError **error)
+{
+ if (TEMP_FAILURE_RETRY (unlinkat (dfd, path, flags)) != 0)
+ return glnx_throw_errno_prefix (error, "unlinkat(%s)", path);
+ return TRUE;
+}
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-local-alloc.c flatpak-1.0.0/libglnx/glnx-local-alloc.c
--- flatpak-1.0.0.orig/libglnx/glnx-local-alloc.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-local-alloc.c 2018-02-03 21:26:06.308233341 +0300
@@ -0,0 +1,72 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2012,2015 Colin Walters <walters@verbum.org>
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include "glnx-local-alloc.h"
+
+/**
+ * SECTION:glnxlocalalloc
+ * @title: GLnx local allocation
+ * @short_description: Release local variables automatically when they go out of scope
+ *
+ * These macros leverage the GCC extension __attribute__ ((cleanup))
+ * to allow calling a cleanup function such as g_free() when a
+ * variable goes out of scope. See <ulink
+ * url="http://gcc.gnu.org/onlinedocs/gcc/Variable-Attributes.html">
+ * for more information on the attribute.
+ *
+ * The provided macros make it easy to use the cleanup attribute for
+ * types that come with GLib. The primary two are #glnx_free and
+ * #glnx_unref_object, which correspond to g_free() and
+ * g_object_unref(), respectively.
+ *
+ * The rationale behind this is that particularly when handling error
+ * paths, it can be very tricky to ensure the right variables are
+ * freed. With this, one simply applies glnx_unref_object to a
+ * locally-allocated #GFile for example, and it will be automatically
+ * unreferenced when it goes out of scope.
+ *
+ * Note - you should only use these macros for <emphasis>stack
+ * allocated</emphasis> variables. They don't provide garbage
+ * collection or let you avoid freeing things. They're simply a
+ * compiler assisted deterministic mechanism for calling a cleanup
+ * function when a stack frame ends.
+ *
+ * <example id="gs-lfree"><title>Calling g_free automatically</title>
+ * <programlisting>
+ *
+ * GFile *
+ * create_file (GError **error)
+ * {
+ * glnx_free char *random_id = NULL;
+ *
+ * if (!prepare_file (error))
+ * return NULL;
+ *
+ * random_id = alloc_random_id ();
+ *
+ * return create_file_real (error);
+ * // Note that random_id is freed here automatically
+ * }
+ * </programlisting>
+ * </example>
+ *
+ */
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-local-alloc.h flatpak-1.0.0/libglnx/glnx-local-alloc.h
--- flatpak-1.0.0.orig/libglnx/glnx-local-alloc.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-local-alloc.h 2018-02-03 21:26:06.308233341 +0300
@@ -0,0 +1,91 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2012,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <gio/gio.h>
+#include <errno.h>
+
+G_BEGIN_DECLS
+
+/**
+ * glnx_unref_object:
+ *
+ * Call g_object_unref() on a variable location when it goes out of
+ * scope. Note that unlike g_object_unref(), the variable may be
+ * %NULL.
+ */
+#define glnx_unref_object __attribute__ ((cleanup(glnx_local_obj_unref)))
+static inline void
+glnx_local_obj_unref (void *v)
+{
+ GObject *o = *(GObject **)v;
+ if (o)
+ g_object_unref (o);
+}
+#define glnx_unref_object __attribute__ ((cleanup(glnx_local_obj_unref)))
+
+static inline int
+glnx_steal_fd (int *fdp)
+{
+ int fd = *fdp;
+ *fdp = -1;
+ return fd;
+}
+
+/**
+ * glnx_close_fd:
+ * @fdp: Pointer to fd
+ *
+ * Effectively `close (glnx_steal_fd (&fd))`. Also
+ * asserts that `close()` did not raise `EBADF` - encountering
+ * that error is usually a critical bug in the program.
+ */
+static inline void
+glnx_close_fd (int *fdp)
+{
+ int errsv;
+
+ g_assert (fdp);
+
+ int fd = glnx_steal_fd (fdp);
+ if (fd >= 0)
+ {
+ errsv = errno;
+ if (close (fd) < 0)
+ g_assert (errno != EBADF);
+ errno = errsv;
+ }
+}
+
+/**
+ * glnx_fd_close:
+ *
+ * Deprecated in favor of `glnx_autofd`.
+ */
+#define glnx_fd_close __attribute__((cleanup(glnx_close_fd)))
+/**
+ * glnx_autofd:
+ *
+ * Call close() on a variable location when it goes out of scope.
+ */
+#define glnx_autofd __attribute__((cleanup(glnx_close_fd)))
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-lockfile.c flatpak-1.0.0/libglnx/glnx-lockfile.c
--- flatpak-1.0.0.orig/libglnx/glnx-lockfile.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-lockfile.c 2018-05-26 00:50:25.434037228 +0300
@@ -0,0 +1,179 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+/***
+ This file is part of systemd.
+ Now copied into libglnx:
+ - Use GError
+
+ Copyright 2010 Lennart Poettering
+ Copyright 2015 Colin Walters <walters@verbum.org>
+
+ systemd is free software; you can redistribute it and/or modify it
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
+ (at your option) any later version.
+
+ systemd is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public License
+ along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "config.h"
+
+#include <stdlib.h>
+#include <stdbool.h>
+#include <errno.h>
+#include <string.h>
+#include <stdio.h>
+#include <limits.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/file.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+#include "glnx-lockfile.h"
+#include "glnx-errors.h"
+#include "glnx-fdio.h"
+#include "glnx-backport-autocleanups.h"
+#include "glnx-local-alloc.h"
+
+#define newa(t, n) ((t*) alloca(sizeof(t)*(n)))
+
+/**
+ * glnx_make_lock_file:
+ * @dfd: Directory file descriptor (if not `AT_FDCWD`, must have lifetime `>=` @out_lock)
+ * @p: Path
+ * @operation: one of `LOCK_SH`, `LOCK_EX`, `LOCK_UN`, as passed to flock()
+ * @out_lock: (out) (caller allocates): Return location for lock
+ * @error: Error
+ *
+ * Block until a lock file named @p (relative to @dfd) can be created,
+ * using the flags in @operation, returning the lock data in the
+ * caller-allocated location @out_lock.
+ *
+ * This API wraps new-style process locking if available, otherwise
+ * falls back to BSD locks.
+ */
+gboolean
+glnx_make_lock_file(int dfd, const char *p, int operation, GLnxLockFile *out_lock, GError **error) {
+ glnx_autofd int fd = -1;
+ g_autofree char *t = NULL;
+ int r;
+
+ /*
+ * We use UNPOSIX locks if they are available. They have nice
+ * semantics, and are mostly compatible with NFS. However,
+ * they are only available on new kernels. When we detect we
+ * are running on an older kernel, then we fall back to good
+ * old BSD locks. They also have nice semantics, but are
+ * slightly problematic on NFS, where they are upgraded to
+ * POSIX locks, even though locally they are orthogonal to
+ * POSIX locks.
+ */
+
+ t = g_strdup(p);
+
+ for (;;) {
+#ifdef F_OFD_SETLK
+ struct flock fl = {
+ .l_type = (operation & ~LOCK_NB) == LOCK_EX ? F_WRLCK : F_RDLCK,
+ .l_whence = SEEK_SET,
+ };
+#endif
+ struct stat st;
+
+ fd = openat(dfd, p, O_CREAT|O_RDWR|O_NOFOLLOW|O_CLOEXEC|O_NOCTTY, 0600);
+ if (fd < 0)
+ return glnx_throw_errno(error);
+
+ /* Unfortunately, new locks are not in RHEL 7.1 glibc */
+#ifdef F_OFD_SETLK
+ r = fcntl(fd, (operation & LOCK_NB) ? F_OFD_SETLK : F_OFD_SETLKW, &fl);
+#else
+ r = -1;
+ errno = EINVAL;
+#endif
+ if (r < 0) {
+
+ /* If the kernel is too old, use good old BSD locks */
+ if (errno == EINVAL)
+ r = flock(fd, operation);
+
+ if (r < 0)
+ return glnx_throw_errno_prefix (error, "flock");
+ }
+
+ /* If we acquired the lock, let's check if the file
+ * still exists in the file system. If not, then the
+ * previous exclusive owner removed it and then closed
+ * it. In such a case our acquired lock is worthless,
+ * hence try again. */
+
+ if (!glnx_fstat (fd, &st, error))
+ return FALSE;
+ if (st.st_nlink > 0)
+ break;
+
+ glnx_close_fd (&fd);
+ }
+
+ /* Note that if this is not AT_FDCWD, the caller takes responsibility
+ * for the fd's lifetime being >= that of the lock.
+ */
+ out_lock->initialized = TRUE;
+ out_lock->dfd = dfd;
+ out_lock->path = g_steal_pointer (&t);
+ out_lock->fd = glnx_steal_fd (&fd);
+ out_lock->operation = operation;
+ return TRUE;
+}
+
+void glnx_release_lock_file(GLnxLockFile *f) {
+ int r;
+
+ if (!(f && f->initialized))
+ return;
+
+ if (f->path) {
+
+ /* If we are the exclusive owner we can safely delete
+ * the lock file itself. If we are not the exclusive
+ * owner, we can try becoming it. */
+
+ if (f->fd >= 0 &&
+ (f->operation & ~LOCK_NB) == LOCK_SH) {
+#ifdef F_OFD_SETLK
+ static const struct flock fl = {
+ .l_type = F_WRLCK,
+ .l_whence = SEEK_SET,
+ };
+
+ r = fcntl(f->fd, F_OFD_SETLK, &fl);
+#else
+ r = -1;
+ errno = EINVAL;
+#endif
+ if (r < 0 && errno == EINVAL)
+ r = flock(f->fd, LOCK_EX|LOCK_NB);
+
+ if (r >= 0)
+ f->operation = LOCK_EX|LOCK_NB;
+ }
+
+ if ((f->operation & ~LOCK_NB) == LOCK_EX) {
+ (void) unlinkat(f->dfd, f->path, 0);
+ }
+
+ g_free(f->path);
+ f->path = NULL;
+ }
+
+ glnx_close_fd (&f->fd);
+ f->operation = 0;
+ f->initialized = FALSE;
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-lockfile.h flatpak-1.0.0/libglnx/glnx-lockfile.h
--- flatpak-1.0.0.orig/libglnx/glnx-lockfile.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-lockfile.h 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,40 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+#pragma once
+
+/***
+ This file is part of systemd.
+
+ Copyright 2011 Lennart Poettering
+ Copyright 2015 Colin Walters <walters@verbum.org>
+
+ systemd is free software; you can redistribute it and/or modify it
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
+ (at your option) any later version.
+
+ systemd is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public License
+ along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include "config.h"
+
+#include "glnx-backport-autoptr.h"
+
+typedef struct GLnxLockFile {
+ gboolean initialized;
+ int dfd;
+ char *path;
+ int fd;
+ int operation;
+} GLnxLockFile;
+
+gboolean glnx_make_lock_file(int dfd, const char *p, int operation, GLnxLockFile *ret, GError **error);
+void glnx_release_lock_file(GLnxLockFile *f);
+
+G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(GLnxLockFile, glnx_release_lock_file)
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-macros.h flatpak-1.0.0/libglnx/glnx-macros.h
--- flatpak-1.0.0.orig/libglnx/glnx-macros.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-macros.h 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,189 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Colin Walters <walters@verbum.org>
+ * With original source from systemd:
+ * Copyright 2010 Lennart Poettering
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <stdlib.h>
+#include <string.h>
+#include <gio/gio.h>
+
+G_BEGIN_DECLS
+
+/* All of these are for C only. */
+#ifndef __GI_SCANNER__
+
+/* Taken from https://github.com/systemd/systemd/src/basic/string-util.h
+ * at revision v228-666-gcf6c8c4
+ */
+#define glnx_strjoina(a, ...) \
+ ({ \
+ const char *_appendees_[] = { a, __VA_ARGS__ }; \
+ char *_d_, *_p_; \
+ size_t _len_ = 0; \
+ unsigned _i_; \
+ for (_i_ = 0; _i_ < G_N_ELEMENTS(_appendees_) && _appendees_[_i_]; _i_++) \
+ _len_ += strlen(_appendees_[_i_]); \
+ _p_ = _d_ = alloca(_len_ + 1); \
+ for (_i_ = 0; _i_ < G_N_ELEMENTS(_appendees_) && _appendees_[_i_]; _i_++) \
+ _p_ = stpcpy(_p_, _appendees_[_i_]); \
+ *_p_ = 0; \
+ _d_; \
+ })
+
+#ifndef G_IN_SET
+
+/* Infrastructure for `G_IN_SET`; this code is copied from
+ * systemd's macro.h - please treat that version as canonical
+ * and submit patches first to systemd.
+ */
+#define _G_INSET_CASE_F(X) case X:
+#define _G_INSET_CASE_F_1(CASE, X) _G_INSET_CASE_F(X)
+#define _G_INSET_CASE_F_2(CASE, X, ...) CASE(X) _G_INSET_CASE_F_1(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_3(CASE, X, ...) CASE(X) _G_INSET_CASE_F_2(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_4(CASE, X, ...) CASE(X) _G_INSET_CASE_F_3(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_5(CASE, X, ...) CASE(X) _G_INSET_CASE_F_4(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_6(CASE, X, ...) CASE(X) _G_INSET_CASE_F_5(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_7(CASE, X, ...) CASE(X) _G_INSET_CASE_F_6(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_8(CASE, X, ...) CASE(X) _G_INSET_CASE_F_7(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_9(CASE, X, ...) CASE(X) _G_INSET_CASE_F_8(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_10(CASE, X, ...) CASE(X) _G_INSET_CASE_F_9(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_11(CASE, X, ...) CASE(X) _G_INSET_CASE_F_10(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_12(CASE, X, ...) CASE(X) _G_INSET_CASE_F_11(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_13(CASE, X, ...) CASE(X) _G_INSET_CASE_F_12(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_14(CASE, X, ...) CASE(X) _G_INSET_CASE_F_13(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_15(CASE, X, ...) CASE(X) _G_INSET_CASE_F_14(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_16(CASE, X, ...) CASE(X) _G_INSET_CASE_F_15(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_17(CASE, X, ...) CASE(X) _G_INSET_CASE_F_16(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_18(CASE, X, ...) CASE(X) _G_INSET_CASE_F_17(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_19(CASE, X, ...) CASE(X) _G_INSET_CASE_F_18(CASE, __VA_ARGS__)
+#define _G_INSET_CASE_F_20(CASE, X, ...) CASE(X) _G_INSET_CASE_F_19(CASE, __VA_ARGS__)
+
+#define _G_INSET_GET_CASE_F(_1,_2,_3,_4,_5,_6,_7,_8,_9,_10,_11,_12,_13,_14,_15,_16,_17,_18,_19,_20,NAME,...) NAME
+#define _G_INSET_FOR_EACH_MAKE_CASE(...) \
+ _G_INSET_GET_CASE_F(__VA_ARGS__,_G_INSET_CASE_F_20,_G_INSET_CASE_F_19,_G_INSET_CASE_F_18,_G_INSET_CASE_F_17,_G_INSET_CASE_F_16,_G_INSET_CASE_F_15,_G_INSET_CASE_F_14,_G_INSET_CASE_F_13,_G_INSET_CASE_F_12,_G_INSET_CASE_F_11, \
+ _G_INSET_CASE_F_10,_G_INSET_CASE_F_9,_G_INSET_CASE_F_8,_G_INSET_CASE_F_7,_G_INSET_CASE_F_6,_G_INSET_CASE_F_5,_G_INSET_CASE_F_4,_G_INSET_CASE_F_3,_G_INSET_CASE_F_2,_G_INSET_CASE_F_1) \
+ (_G_INSET_CASE_F,__VA_ARGS__)
+
+/* Note: claiming the name here even though it isn't upstream yet
+ * https://bugzilla.gnome.org/show_bug.cgi?id=783751
+ */
+/**
+ * G_IN_SET:
+ * @x: Integer (or smaller) sized value
+ * @...: Elements to compare
+ *
+ * It's quite common to test whether or not `char` values or Unix @errno (among) others
+ * are members of a small set. Normally one has to choose to either use `if (x == val || x == otherval ...)`
+ * or a `switch` statement. This macro is useful to reduce duplication in the first case,
+ * where one can write simply `if (G_IN_SET (x, val, otherval))`, and avoid the verbosity
+ * that the `switch` statement requires.
+ */
+#define G_IN_SET(x, ...) \
+ ({ \
+ gboolean _g_inset_found = FALSE; \
+ /* If the build breaks in the line below, you need to extend the case macros */ \
+ static G_GNUC_UNUSED char _static_assert__macros_need_to_be_extended[20 - sizeof((int[]){__VA_ARGS__})/sizeof(int)]; \
+ switch(x) { \
+ _G_INSET_FOR_EACH_MAKE_CASE(__VA_ARGS__) \
+ _g_inset_found = TRUE; \
+ break; \
+ default: \
+ break; \
+ } \
+ _g_inset_found; \
+ })
+
+#endif /* ifndef G_IN_SET */
+
+#define _GLNX_CONCAT(a, b) a##b
+#define _GLNX_CONCAT_INDIRECT(a, b) _GLNX_CONCAT(a, b)
+#define _GLNX_MAKE_ANONYMOUS(a) _GLNX_CONCAT_INDIRECT(a, __COUNTER__)
+
+#define _GLNX_HASH_TABLE_FOREACH_IMPL_KV(guard, ht, it, kt, k, vt, v) \
+ gboolean guard = TRUE; \
+ G_STATIC_ASSERT (sizeof (kt) == sizeof (void*)); \
+ G_STATIC_ASSERT (sizeof (vt) == sizeof (void*)); \
+ for (GHashTableIter it; \
+ guard && ({ g_hash_table_iter_init (&it, ht), TRUE; }); \
+ guard = FALSE) \
+ for (kt k; guard; guard = FALSE) \
+ for (vt v; g_hash_table_iter_next (&it, (gpointer)&k, (gpointer)&v);)
+
+
+/* Cleaner method to iterate over a GHashTable. I.e. rather than
+ *
+ * gpointer k, v;
+ * GHashTableIter it;
+ * g_hash_table_iter_init (&it, table);
+ * while (g_hash_table_iter_next (&it, &k, &v))
+ * {
+ * const char *str = k;
+ * GPtrArray *arr = v;
+ * ...
+ * }
+ *
+ * you can simply do
+ *
+ * GLNX_HASH_TABLE_FOREACH_IT (table, it, const char*, str, GPtrArray*, arr)
+ * {
+ * ...
+ * }
+ *
+ * All variables are scoped within the loop. You may use the `it` variable as
+ * usual, e.g. to remove an element using g_hash_table_iter_remove(&it). There
+ * are shorter variants for the more common cases where you do not need access
+ * to the iterator or to keys/values:
+ *
+ * GLNX_HASH_TABLE_FOREACH (table, const char*, str) { ... }
+ * GLNX_HASH_TABLE_FOREACH_V (table, MyData*, data) { ... }
+ * GLNX_HASH_TABLE_FOREACH_KV (table, const char*, str, MyData*, data) { ... }
+ *
+ */
+#define GLNX_HASH_TABLE_FOREACH_IT(ht, it, kt, k, vt, v) \
+ _GLNX_HASH_TABLE_FOREACH_IMPL_KV( \
+ _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_guard_), ht, it, kt, k, vt, v)
+
+/* Variant of GLNX_HASH_TABLE_FOREACH without having to specify an iterator. An
+ * anonymous iterator will be created. */
+#define GLNX_HASH_TABLE_FOREACH_KV(ht, kt, k, vt, v) \
+ _GLNX_HASH_TABLE_FOREACH_IMPL_KV( \
+ _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_guard_), ht, \
+ _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_it_), kt, k, vt, v)
+
+/* Variant of GLNX_HASH_TABLE_FOREACH_KV which omits unpacking keys. */
+#define GLNX_HASH_TABLE_FOREACH_V(ht, vt, v) \
+ _GLNX_HASH_TABLE_FOREACH_IMPL_KV( \
+ _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_guard_), ht, \
+ _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_it_), \
+ gpointer, _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_v_), \
+ vt, v)
+
+/* Variant of GLNX_HASH_TABLE_FOREACH_KV which omits unpacking vals. */
+#define GLNX_HASH_TABLE_FOREACH(ht, kt, k) \
+ _GLNX_HASH_TABLE_FOREACH_IMPL_KV( \
+ _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_guard_), ht, \
+ _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_it_), kt, k, \
+ gpointer, _GLNX_MAKE_ANONYMOUS(_glnx_ht_iter_v_))
+
+#endif /* GI_SCANNER */
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-missing.h flatpak-1.0.0/libglnx/glnx-missing.h
--- flatpak-1.0.0.orig/libglnx/glnx-missing.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-missing.h 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,95 @@
+#pragma once
+
+/***
+ This file was originally part of systemd.
+
+ Copyright 2010 Lennart Poettering
+
+ systemd is free software; you can redistribute it and/or modify it
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
+ (at your option) any later version.
+
+ systemd is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public License
+ along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+/* Missing glibc definitions to access certain kernel APIs.
+ This file is last updated from systemd git:
+
+ commit 71e5200f94b22589922704aa4abdf95d4fe2e528
+ Author: Daniel Mack <daniel@zonque.org>
+ AuthorDate: Tue Oct 18 17:57:10 2016 +0200
+ Commit: Lennart Poettering <lennart@poettering.net>
+ CommitDate: Fri Sep 22 15:24:54 2017 +0200
+
+ Add abstraction model for BPF programs
+*/
+
+#include <errno.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <sys/resource.h>
+#include <sys/syscall.h>
+#include <uchar.h>
+#include <unistd.h>
+
+/* The precise definition of __O_TMPFILE is arch specific; use the
+ * values defined by the kernel (note: some are hexa, some are octal,
+ * duplicated as-is from the kernel definitions):
+ * - alpha, parisc, sparc: each has a specific value;
+ * - others: they use the "generic" value.
+ */
+
+#ifndef __O_TMPFILE
+#if defined(__alpha__)
+#define __O_TMPFILE 0100000000
+#elif defined(__parisc__) || defined(__hppa__)
+#define __O_TMPFILE 0400000000
+#elif defined(__sparc__) || defined(__sparc64__)
+#define __O_TMPFILE 0x2000000
+#else
+#define __O_TMPFILE 020000000
+#endif
+#endif
+
+/* a horrid kludge trying to make sure that this will fail on old kernels */
+#ifndef O_TMPFILE
+#define O_TMPFILE (__O_TMPFILE | O_DIRECTORY)
+#endif
+
+#ifndef RENAME_NOREPLACE
+#define RENAME_NOREPLACE (1 << 0)
+#endif
+#ifndef RENAME_EXCHANGE
+#define RENAME_EXCHANGE (1 << 1)
+#endif
+
+#ifndef F_LINUX_SPECIFIC_BASE
+#define F_LINUX_SPECIFIC_BASE 1024
+#endif
+
+#ifndef F_ADD_SEALS
+#define F_ADD_SEALS (F_LINUX_SPECIFIC_BASE + 9)
+#define F_GET_SEALS (F_LINUX_SPECIFIC_BASE + 10)
+
+#define F_SEAL_SEAL 0x0001 /* prevent further seals from being set */
+#define F_SEAL_SHRINK 0x0002 /* prevent file from shrinking */
+#define F_SEAL_GROW 0x0004 /* prevent file from growing */
+#define F_SEAL_WRITE 0x0008 /* prevent writes */
+#endif
+
+#ifndef MFD_ALLOW_SEALING
+#define MFD_ALLOW_SEALING 0x0002U
+#endif
+
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
+#endif
+
+#include "glnx-missing-syscall.h"
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-missing-syscall.h flatpak-1.0.0/libglnx/glnx-missing-syscall.h
--- flatpak-1.0.0.orig/libglnx/glnx-missing-syscall.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-missing-syscall.h 2018-05-26 00:50:25.434037228 +0300
@@ -0,0 +1,154 @@
+/***
+ This file was originally part of systemd.
+
+ Copyright 2010 Lennart Poettering
+ Copyright 2016 Zbigniew Jędrzejewski-Szmek
+
+ systemd is free software; you can redistribute it and/or modify it
+ under the terms of the GNU Lesser General Public License as published by
+ the Free Software Foundation; either version 2.1 of the License, or
+ (at your option) any later version.
+
+ systemd is distributed in the hope that it will be useful, but
+ WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public License
+ along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+/* Missing glibc definitions to access certain kernel APIs.
+ This file is last updated from systemd git:
+
+ commit 71e5200f94b22589922704aa4abdf95d4fe2e528
+ Author: Daniel Mack <daniel@zonque.org>
+ AuthorDate: Tue Oct 18 17:57:10 2016 +0200
+ Commit: Lennart Poettering <lennart@poettering.net>
+ CommitDate: Fri Sep 22 15:24:54 2017 +0200
+
+ Add abstraction model for BPF programs
+*/
+
+#include "config.h"
+
+#if !HAVE_DECL_RENAMEAT2
+# ifndef __NR_renameat2
+# if defined __x86_64__
+# define __NR_renameat2 316
+# elif defined __arm__
+# define __NR_renameat2 382
+# elif defined __aarch64__
+# define __NR_renameat2 276
+# elif defined _MIPS_SIM
+# if _MIPS_SIM == _MIPS_SIM_ABI32
+# define __NR_renameat2 4351
+# endif
+# if _MIPS_SIM == _MIPS_SIM_NABI32
+# define __NR_renameat2 6315
+# endif
+# if _MIPS_SIM == _MIPS_SIM_ABI64
+# define __NR_renameat2 5311
+# endif
+# elif defined __i386__
+# define __NR_renameat2 353
+# elif defined __powerpc64__
+# define __NR_renameat2 357
+# elif defined __s390__ || defined __s390x__
+# define __NR_renameat2 347
+# elif defined __arc__
+# define __NR_renameat2 276
+# else
+# warning "__NR_renameat2 unknown for your architecture"
+# endif
+# endif
+
+static inline int renameat2(int oldfd, const char *oldname, int newfd, const char *newname, unsigned flags) {
+# ifdef __NR_renameat2
+ return syscall(__NR_renameat2, oldfd, oldname, newfd, newname, flags);
+# else
+ errno = ENOSYS;
+ return -1;
+# endif
+}
+#endif
+
+#if !HAVE_DECL_MEMFD_CREATE
+# ifndef __NR_memfd_create
+# if defined __x86_64__
+# define __NR_memfd_create 319
+# elif defined __arm__
+# define __NR_memfd_create 385
+# elif defined __aarch64__
+# define __NR_memfd_create 279
+# elif defined __s390__
+# define __NR_memfd_create 350
+# elif defined _MIPS_SIM
+# if _MIPS_SIM == _MIPS_SIM_ABI32
+# define __NR_memfd_create 4354
+# endif
+# if _MIPS_SIM == _MIPS_SIM_NABI32
+# define __NR_memfd_create 6318
+# endif
+# if _MIPS_SIM == _MIPS_SIM_ABI64
+# define __NR_memfd_create 5314
+# endif
+# elif defined __i386__
+# define __NR_memfd_create 356
+# elif defined __arc__
+# define __NR_memfd_create 279
+# else
+# warning "__NR_memfd_create unknown for your architecture"
+# endif
+# endif
+
+static inline int memfd_create(const char *name, unsigned int flags) {
+# ifdef __NR_memfd_create
+ return syscall(__NR_memfd_create, name, flags);
+# else
+ errno = ENOSYS;
+ return -1;
+# endif
+}
+#endif
+
+/* Copied from systemd git:
+ commit 6bda23dd6aaba50cf8e3e6024248cf736cc443ca
+ Author: Yu Watanabe <watanabe.yu+github@gmail.com>
+ AuthorDate: Thu Jul 27 20:22:54 2017 +0900
+ Commit: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
+ CommitDate: Thu Jul 27 07:22:54 2017 -0400
+*/
+#if !HAVE_DECL_COPY_FILE_RANGE
+# ifndef __NR_copy_file_range
+# if defined(__x86_64__)
+# define __NR_copy_file_range 326
+# elif defined(__i386__)
+# define __NR_copy_file_range 377
+# elif defined __s390__
+# define __NR_copy_file_range 375
+# elif defined __arm__
+# define __NR_copy_file_range 391
+# elif defined __aarch64__
+# define __NR_copy_file_range 285
+# elif defined __powerpc__
+# define __NR_copy_file_range 379
+# elif defined __arc__
+# define __NR_copy_file_range 285
+# else
+# warning "__NR_copy_file_range not defined for your architecture"
+# endif
+# endif
+
+static inline ssize_t copy_file_range(int fd_in, loff_t *off_in,
+ int fd_out, loff_t *off_out,
+ size_t len,
+ unsigned int flags) {
+# ifdef __NR_copy_file_range
+ return syscall(__NR_copy_file_range, fd_in, off_in, fd_out, off_out, len, flags);
+# else
+ errno = ENOSYS;
+ return -1;
+# endif
+}
+#endif
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-shutil.c flatpak-1.0.0/libglnx/glnx-shutil.c
--- flatpak-1.0.0.orig/libglnx/glnx-shutil.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-shutil.c 2018-05-26 00:50:25.434037228 +0300
@@ -0,0 +1,260 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include <string.h>
+
+#include <glnx-shutil.h>
+#include <glnx-errors.h>
+#include <glnx-local-alloc.h>
+
+static gboolean
+glnx_shutil_rm_rf_children (GLnxDirFdIterator *dfd_iter,
+ GCancellable *cancellable,
+ GError **error)
+{
+ struct dirent *dent;
+
+ while (TRUE)
+ {
+ if (!glnx_dirfd_iterator_next_dent_ensure_dtype (dfd_iter, &dent, cancellable, error))
+ return FALSE;
+ if (dent == NULL)
+ break;
+
+ if (dent->d_type == DT_DIR)
+ {
+ g_auto(GLnxDirFdIterator) child_dfd_iter = { 0, };
+
+ if (!glnx_dirfd_iterator_init_at (dfd_iter->fd, dent->d_name, FALSE,
+ &child_dfd_iter, error))
+ return FALSE;
+
+ if (!glnx_shutil_rm_rf_children (&child_dfd_iter, cancellable, error))
+ return FALSE;
+
+ if (unlinkat (dfd_iter->fd, dent->d_name, AT_REMOVEDIR) == -1)
+ return glnx_throw_errno_prefix (error, "unlinkat");
+ }
+ else
+ {
+ if (unlinkat (dfd_iter->fd, dent->d_name, 0) == -1)
+ {
+ if (errno != ENOENT)
+ return glnx_throw_errno_prefix (error, "unlinkat");
+ }
+ }
+ }
+
+ return TRUE;
+}
+
+/**
+ * glnx_shutil_rm_rf_at:
+ * @dfd: A directory file descriptor, or `AT_FDCWD` or `-1` for current
+ * @path: Path
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Recursively delete the filename referenced by the combination of
+ * the directory fd @dfd and @path; it may be a file or directory. No
+ * error is thrown if @path does not exist.
+ */
+gboolean
+glnx_shutil_rm_rf_at (int dfd,
+ const char *path,
+ GCancellable *cancellable,
+ GError **error)
+{
+ dfd = glnx_dirfd_canonicalize (dfd);
+
+
+ /* With O_NOFOLLOW first */
+ glnx_autofd int target_dfd =
+ openat (dfd, path, O_RDONLY | O_NONBLOCK | O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW);
+
+ if (target_dfd == -1)
+ {
+ int errsv = errno;
+ if (errsv == ENOENT)
+ {
+ ;
+ }
+ else if (errsv == ENOTDIR || errsv == ELOOP)
+ {
+ if (unlinkat (dfd, path, 0) != 0)
+ return glnx_throw_errno_prefix (error, "unlinkat");
+ }
+ else
+ return glnx_throw_errno_prefix (error, "open(%s)", path);
+ }
+ else
+ {
+ g_auto(GLnxDirFdIterator) dfd_iter = { 0, };
+ if (!glnx_dirfd_iterator_init_take_fd (&target_dfd, &dfd_iter, error))
+ return FALSE;
+
+ if (!glnx_shutil_rm_rf_children (&dfd_iter, cancellable, error))
+ return FALSE;
+
+ if (unlinkat (dfd, path, AT_REMOVEDIR) == -1)
+ {
+ if (errno != ENOENT)
+ return glnx_throw_errno_prefix (error, "unlinkat");
+ }
+ }
+
+ return TRUE;
+}
+
+static gboolean
+mkdir_p_at_internal (int dfd,
+ char *path,
+ int mode,
+ GCancellable *cancellable,
+ GError **error)
+{
+ gboolean did_recurse = FALSE;
+
+ if (g_cancellable_set_error_if_cancelled (cancellable, error))
+ return FALSE;
+
+ again:
+ if (mkdirat (dfd, path, mode) == -1)
+ {
+ if (errno == ENOENT)
+ {
+ char *lastslash;
+
+ g_assert (!did_recurse);
+
+ lastslash = strrchr (path, '/');
+ if (lastslash == NULL)
+ {
+ /* This can happen if @dfd was deleted between being opened and
+ * passed to mkdir_p_at_internal(). */
+ return glnx_throw_errno_prefix (error, "mkdir(%s)", path);
+ }
+
+ /* Note we can mutate the buffer as we dup'd it */
+ *lastslash = '\0';
+
+ if (!glnx_shutil_mkdir_p_at (dfd, path, mode,
+ cancellable, error))
+ return FALSE;
+
+ /* Now restore it for another mkdir attempt */
+ *lastslash = '/';
+
+ did_recurse = TRUE;
+ goto again;
+ }
+ else if (errno == EEXIST)
+ {
+ /* Fall through; it may not have been a directory,
+ * but we'll find that out on the next call up.
+ */
+ }
+ else
+ return glnx_throw_errno_prefix (error, "mkdir(%s)", path);
+ }
+
+ return TRUE;
+}
+
+/**
+ * glnx_shutil_mkdir_p_at:
+ * @dfd: Directory fd
+ * @path: Directory path to be created
+ * @mode: Mode for newly created directories
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Similar to g_mkdir_with_parents(), except operates relative to the
+ * directory fd @dfd.
+ *
+ * See also glnx_ensure_dir() for a non-recursive version.
+ *
+ * This will return %G_IO_ERROR_NOT_FOUND if @dfd has been deleted since being
+ * opened. It may return other errors from mkdirat() in other situations.
+ */
+gboolean
+glnx_shutil_mkdir_p_at (int dfd,
+ const char *path,
+ int mode,
+ GCancellable *cancellable,
+ GError **error)
+{
+ struct stat stbuf;
+ char *buf;
+
+ /* Fast path stat to see whether it already exists */
+ if (fstatat (dfd, path, &stbuf, AT_SYMLINK_NOFOLLOW) == 0)
+ {
+ /* Note early return */
+ if (S_ISDIR (stbuf.st_mode))
+ return TRUE;
+ }
+
+ buf = strdupa (path);
+
+ if (!mkdir_p_at_internal (dfd, buf, mode, cancellable, error))
+ return FALSE;
+
+ return TRUE;
+}
+
+/**
+ * glnx_shutil_mkdir_p_at_open:
+ * @dfd: Directory fd
+ * @path: Directory path to be created
+ * @mode: Mode for newly created directories
+ * @out_dfd: (out caller-allocates): Return location for an FD to @dfd/@path,
+ * or `-1` on error
+ * @cancellable: (nullable): Cancellable, or %NULL
+ * @error: Return location for a #GError, or %NULL
+ *
+ * Similar to glnx_shutil_mkdir_p_at(), except it opens the resulting directory
+ * and returns a directory FD to it. Currently, this is not guaranteed to be
+ * race-free.
+ *
+ * Returns: %TRUE on success, %FALSE otherwise
+ * Since: UNRELEASED
+ */
+gboolean
+glnx_shutil_mkdir_p_at_open (int dfd,
+ const char *path,
+ int mode,
+ int *out_dfd,
+ GCancellable *cancellable,
+ GError **error)
+{
+ /* FIXME: It’s not possible to eliminate the race here until
+ * openat(O_DIRECTORY | O_CREAT) works (and returns a directory rather than a
+ * file). It appears to be not supported in current kernels. (Tested with
+ * 4.10.10-200.fc25.x86_64.) */
+ *out_dfd = -1;
+
+ if (!glnx_shutil_mkdir_p_at (dfd, path, mode, cancellable, error))
+ return FALSE;
+
+ return glnx_opendirat (dfd, path, TRUE, out_dfd, error);
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-shutil.h flatpak-1.0.0/libglnx/glnx-shutil.h
--- flatpak-1.0.0.orig/libglnx/glnx-shutil.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-shutil.h 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,48 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <glnx-dirfd.h>
+
+G_BEGIN_DECLS
+
+gboolean
+glnx_shutil_rm_rf_at (int dfd,
+ const char *path,
+ GCancellable *cancellable,
+ GError **error);
+
+gboolean
+glnx_shutil_mkdir_p_at (int dfd,
+ const char *path,
+ int mode,
+ GCancellable *cancellable,
+ GError **error);
+
+gboolean
+glnx_shutil_mkdir_p_at_open (int dfd,
+ const char *path,
+ int mode,
+ int *out_dfd,
+ GCancellable *cancellable,
+ GError **error);
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-xattrs.c flatpak-1.0.0/libglnx/glnx-xattrs.c
--- flatpak-1.0.0.orig/libglnx/glnx-xattrs.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-xattrs.c 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,444 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+
+#include <string.h>
+#include <stdio.h>
+
+#include <glnx-macros.h>
+#include <glnx-xattrs.h>
+#include <glnx-errors.h>
+#include <glnx-local-alloc.h>
+
+static GVariant *
+variant_new_ay_bytes (GBytes *bytes)
+{
+ gsize size;
+ gconstpointer data;
+ data = g_bytes_get_data (bytes, &size);
+ g_bytes_ref (bytes);
+ return g_variant_new_from_data (G_VARIANT_TYPE ("ay"), data, size,
+ TRUE, (GDestroyNotify)g_bytes_unref, bytes);
+}
+
+static char *
+canonicalize_xattrs (char *xattr_string,
+ size_t len)
+{
+ char *p;
+ GSList *xattrs = NULL;
+ GSList *iter;
+ GString *result;
+
+ result = g_string_new (0);
+
+ p = xattr_string;
+ while (p < xattr_string+len)
+ {
+ xattrs = g_slist_prepend (xattrs, p);
+ p += strlen (p) + 1;
+ }
+
+ xattrs = g_slist_sort (xattrs, (GCompareFunc) strcmp);
+ for (iter = xattrs; iter; iter = iter->next) {
+ g_string_append (result, iter->data);
+ g_string_append_c (result, '\0');
+ }
+
+ g_slist_free (xattrs);
+ return g_string_free (result, FALSE);
+}
+
+static gboolean
+read_xattr_name_array (const char *path,
+ int fd,
+ const char *xattrs,
+ size_t len,
+ GVariantBuilder *builder,
+ GError **error)
+{
+ gboolean ret = FALSE;
+ const char *p;
+ int r;
+ const char *funcstr;
+
+ g_assert (path != NULL || fd != -1);
+
+ funcstr = fd != -1 ? "fgetxattr" : "lgetxattr";
+
+ for (p = xattrs; p < xattrs+len; p = p + strlen (p) + 1)
+ {
+ ssize_t bytes_read;
+ g_autofree char *buf = NULL;
+ g_autoptr(GBytes) bytes = NULL;
+
+ again:
+ if (fd != -1)
+ bytes_read = fgetxattr (fd, p, NULL, 0);
+ else
+ bytes_read = lgetxattr (path, p, NULL, 0);
+ if (bytes_read < 0)
+ {
+ if (errno == ENODATA)
+ continue;
+
+ glnx_set_prefix_error_from_errno (error, "%s", funcstr);
+ goto out;
+ }
+ if (bytes_read == 0)
+ continue;
+
+ buf = g_malloc (bytes_read);
+ if (fd != -1)
+ r = fgetxattr (fd, p, buf, bytes_read);
+ else
+ r = lgetxattr (path, p, buf, bytes_read);
+ if (r < 0)
+ {
+ if (errno == ERANGE)
+ {
+ g_free (g_steal_pointer (&buf));
+ goto again;
+ }
+ else if (errno == ENODATA)
+ continue;
+
+ glnx_set_prefix_error_from_errno (error, "%s", funcstr);
+ goto out;
+ }
+
+ bytes = g_bytes_new_take (g_steal_pointer (&buf), bytes_read);
+ g_variant_builder_add (builder, "(@ay@ay)",
+ g_variant_new_bytestring (p),
+ variant_new_ay_bytes (bytes));
+ }
+
+ ret = TRUE;
+ out:
+ return ret;
+}
+
+static gboolean
+get_xattrs_impl (const char *path,
+ int fd,
+ GVariant **out_xattrs,
+ GCancellable *cancellable,
+ GError **error)
+{
+ gboolean ret = FALSE;
+ ssize_t bytes_read, real_size;
+ g_autofree char *xattr_names = NULL;
+ g_autofree char *xattr_names_canonical = NULL;
+ GVariantBuilder builder;
+ gboolean builder_initialized = FALSE;
+ g_autoptr(GVariant) ret_xattrs = NULL;
+
+ g_assert (path != NULL || fd != -1);
+
+ g_variant_builder_init (&builder, G_VARIANT_TYPE ("a(ayay)"));
+ builder_initialized = TRUE;
+
+ again:
+ if (path)
+ bytes_read = llistxattr (path, NULL, 0);
+ else
+ bytes_read = flistxattr (fd, NULL, 0);
+
+ if (bytes_read < 0)
+ {
+ if (errno != ENOTSUP)
+ {
+ glnx_set_prefix_error_from_errno (error, "%s", "llistxattr");
+ goto out;
+ }
+ }
+ else if (bytes_read > 0)
+ {
+ xattr_names = g_malloc (bytes_read);
+ if (path)
+ real_size = llistxattr (path, xattr_names, bytes_read);
+ else
+ real_size = flistxattr (fd, xattr_names, bytes_read);
+ if (real_size < 0)
+ {
+ if (errno == ERANGE)
+ {
+ g_free (xattr_names);
+ goto again;
+ }
+ glnx_set_prefix_error_from_errno (error, "%s", "llistxattr");
+ goto out;
+ }
+ else if (real_size > 0)
+ {
+ xattr_names_canonical = canonicalize_xattrs (xattr_names, real_size);
+
+ if (!read_xattr_name_array (path, fd, xattr_names_canonical, real_size, &builder, error))
+ goto out;
+ }
+ }
+
+ ret_xattrs = g_variant_builder_end (&builder);
+ builder_initialized = FALSE;
+ g_variant_ref_sink (ret_xattrs);
+
+ ret = TRUE;
+ if (out_xattrs)
+ *out_xattrs = g_steal_pointer (&ret_xattrs);
+ out:
+ if (!builder_initialized)
+ g_variant_builder_clear (&builder);
+ return ret;
+}
+
+/**
+ * glnx_fd_get_all_xattrs:
+ * @fd: a file descriptor
+ * @out_xattrs: (out): A new #GVariant containing the extended attributes
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Read all extended attributes from @fd in a canonical sorted order, and
+ * set @out_xattrs with the result.
+ *
+ * If the filesystem does not support extended attributes, @out_xattrs
+ * will have 0 elements, and this function will return successfully.
+ */
+gboolean
+glnx_fd_get_all_xattrs (int fd,
+ GVariant **out_xattrs,
+ GCancellable *cancellable,
+ GError **error)
+{
+ return get_xattrs_impl (NULL, fd, out_xattrs,
+ cancellable, error);
+}
+
+/**
+ * glnx_dfd_name_get_all_xattrs:
+ * @dfd: Parent directory file descriptor
+ * @name: File name
+ * @out_xattrs: (out): Extended attribute set
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Load all extended attributes for the file named @name residing in
+ * directory @dfd.
+ */
+gboolean
+glnx_dfd_name_get_all_xattrs (int dfd,
+ const char *name,
+ GVariant **out_xattrs,
+ GCancellable *cancellable,
+ GError **error)
+{
+ if (G_IN_SET(dfd, AT_FDCWD, -1))
+ {
+ return get_xattrs_impl (name, -1, out_xattrs, cancellable, error);
+ }
+ else
+ {
+ char buf[PATH_MAX];
+ /* A workaround for the lack of lgetxattrat(), thanks to Florian Weimer:
+ * https://mail.gnome.org/archives/ostree-list/2014-February/msg00017.html
+ */
+ snprintf (buf, sizeof (buf), "/proc/self/fd/%d/%s", dfd, name);
+ return get_xattrs_impl (buf, -1, out_xattrs, cancellable, error);
+ }
+}
+
+static gboolean
+set_all_xattrs_for_path (const char *path,
+ GVariant *xattrs,
+ GCancellable *cancellable,
+ GError **error)
+{
+ const guint n = g_variant_n_children (xattrs);
+ for (guint i = 0; i < n; i++)
+ {
+ const guint8* name;
+ g_autoptr(GVariant) value = NULL;
+ g_variant_get_child (xattrs, i, "(^&ay@ay)",
+ &name, &value);
+
+ gsize value_len;
+ const guint8* value_data = g_variant_get_fixed_array (value, &value_len, 1);
+
+ if (lsetxattr (path, (char*)name, (char*)value_data, value_len, 0) < 0)
+ return glnx_throw_errno_prefix (error, "lsetxattr");
+ }
+
+ return TRUE;
+}
+
+/**
+ * glnx_dfd_name_set_all_xattrs:
+ * @dfd: Parent directory file descriptor
+ * @name: File name
+ * @xattrs: Extended attribute set
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * Set all extended attributes for the file named @name residing in
+ * directory @dfd.
+ */
+gboolean
+glnx_dfd_name_set_all_xattrs (int dfd,
+ const char *name,
+ GVariant *xattrs,
+ GCancellable *cancellable,
+ GError **error)
+{
+ if (G_IN_SET(dfd, AT_FDCWD, -1))
+ {
+ return set_all_xattrs_for_path (name, xattrs, cancellable, error);
+ }
+ else
+ {
+ char buf[PATH_MAX];
+ /* A workaround for the lack of lsetxattrat(), thanks to Florian Weimer:
+ * https://mail.gnome.org/archives/ostree-list/2014-February/msg00017.html
+ */
+ snprintf (buf, sizeof (buf), "/proc/self/fd/%d/%s", dfd, name);
+ return set_all_xattrs_for_path (buf, xattrs, cancellable, error);
+ }
+}
+
+/**
+ * glnx_fd_set_all_xattrs:
+ * @fd: File descriptor
+ * @xattrs: Extended attributes
+ * @cancellable: Cancellable
+ * @error: Error
+ *
+ * For each attribute in @xattrs, set its value on the file or
+ * directory referred to by @fd. This function does not remove any
+ * attributes not in @xattrs.
+ */
+gboolean
+glnx_fd_set_all_xattrs (int fd,
+ GVariant *xattrs,
+ GCancellable *cancellable,
+ GError **error)
+{
+ const guint n = g_variant_n_children (xattrs);
+ for (guint i = 0; i < n; i++)
+ {
+ const guint8* name;
+ g_autoptr(GVariant) value = NULL;
+ g_variant_get_child (xattrs, i, "(^&ay@ay)",
+ &name, &value);
+
+ gsize value_len;
+ const guint8* value_data = g_variant_get_fixed_array (value, &value_len, 1);
+
+ if (TEMP_FAILURE_RETRY (fsetxattr (fd, (char*)name, (char*)value_data, value_len, 0)) < 0)
+ return glnx_throw_errno_prefix (error, "fsetxattr");
+ }
+
+ return TRUE;
+}
+
+/**
+ * glnx_lgetxattrat:
+ * @dfd: Directory file descriptor
+ * @subpath: Subpath
+ * @attribute: Extended attribute to retrieve
+ * @error: Error
+ *
+ * Retrieve an extended attribute value, relative to a directory file
+ * descriptor.
+ */
+GBytes *
+glnx_lgetxattrat (int dfd,
+ const char *subpath,
+ const char *attribute,
+ GError **error)
+{
+ char pathbuf[PATH_MAX];
+ snprintf (pathbuf, sizeof (pathbuf), "/proc/self/fd/%d/%s", dfd, subpath);
+
+ ssize_t bytes_read, real_size;
+ if (TEMP_FAILURE_RETRY (bytes_read = lgetxattr (pathbuf, attribute, NULL, 0)) < 0)
+ return glnx_null_throw_errno_prefix (error, "lgetxattr");
+
+ g_autofree guint8 *buf = g_malloc (bytes_read);
+ if (TEMP_FAILURE_RETRY (real_size = lgetxattr (pathbuf, attribute, buf, bytes_read)) < 0)
+ return glnx_null_throw_errno_prefix (error, "lgetxattr");
+
+ return g_bytes_new_take (g_steal_pointer (&buf), real_size);
+}
+
+/**
+ * glnx_fgetxattr_bytes:
+ * @fd: Directory file descriptor
+ * @attribute: Extended attribute to retrieve
+ * @error: Error
+ *
+ * Returns: (transfer full): An extended attribute value, or %NULL on error
+ */
+GBytes *
+glnx_fgetxattr_bytes (int fd,
+ const char *attribute,
+ GError **error)
+{
+ ssize_t bytes_read, real_size;
+
+ if (TEMP_FAILURE_RETRY (bytes_read = fgetxattr (fd, attribute, NULL, 0)) < 0)
+ return glnx_null_throw_errno_prefix (error, "fgetxattr");
+
+ g_autofree guint8 *buf = g_malloc (bytes_read);
+ if (TEMP_FAILURE_RETRY (real_size = fgetxattr (fd, attribute, buf, bytes_read)) < 0)
+ return glnx_null_throw_errno_prefix (error, "fgetxattr");
+
+ return g_bytes_new_take (g_steal_pointer (&buf), real_size);
+}
+
+/**
+ * glnx_lsetxattrat:
+ * @dfd: Directory file descriptor
+ * @subpath: Path
+ * @attribute: An attribute name
+ * @value: (array length=len) (element-type guint8): Attribute value
+ * @len: Length of @value
+ * @flags: Flags, containing either XATTR_CREATE or XATTR_REPLACE
+ * @error: Error
+ *
+ * Set an extended attribute, relative to a directory file descriptor.
+ */
+gboolean
+glnx_lsetxattrat (int dfd,
+ const char *subpath,
+ const char *attribute,
+ const guint8 *value,
+ gsize len,
+ int flags,
+ GError **error)
+{
+ char pathbuf[PATH_MAX];
+ snprintf (pathbuf, sizeof (pathbuf), "/proc/self/fd/%d/%s", dfd, subpath);
+
+ if (TEMP_FAILURE_RETRY (lsetxattr (subpath, attribute, value, len, flags)) < 0)
+ return glnx_throw_errno_prefix (error, "lsetxattr");
+
+ return TRUE;
+}
+
diff -Nuar flatpak-1.0.0.orig/libglnx/glnx-xattrs.h flatpak-1.0.0/libglnx/glnx-xattrs.h
--- flatpak-1.0.0.orig/libglnx/glnx-xattrs.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/glnx-xattrs.h 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,78 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2014,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <glnx-backport-autocleanups.h>
+#include <limits.h>
+#include <dirent.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <sys/xattr.h>
+
+G_BEGIN_DECLS
+
+gboolean
+glnx_dfd_name_get_all_xattrs (int dfd,
+ const char *name,
+ GVariant **out_xattrs,
+ GCancellable *cancellable,
+ GError **error);
+
+gboolean
+glnx_fd_get_all_xattrs (int fd,
+ GVariant **out_xattrs,
+ GCancellable *cancellable,
+ GError **error);
+
+gboolean
+glnx_dfd_name_set_all_xattrs (int dfd,
+ const char *name,
+ GVariant *xattrs,
+ GCancellable *cancellable,
+ GError **error);
+
+gboolean
+glnx_fd_set_all_xattrs (int fd,
+ GVariant *xattrs,
+ GCancellable *cancellable,
+ GError **error);
+
+GBytes *
+glnx_lgetxattrat (int dfd,
+ const char *subpath,
+ const char *attribute,
+ GError **error);
+
+GBytes *
+glnx_fgetxattr_bytes (int fd,
+ const char *attribute,
+ GError **error);
+
+gboolean
+glnx_lsetxattrat (int dfd,
+ const char *subpath,
+ const char *attribute,
+ const guint8 *value,
+ gsize len,
+ int flags,
+ GError **error);
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/libglnx.doap flatpak-1.0.0/libglnx/libglnx.doap
--- flatpak-1.0.0.orig/libglnx/libglnx.doap 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/libglnx.doap 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Project xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+ xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#"
+ xmlns:foaf="http://xmlns.com/foaf/0.1/"
+ xmlns:gnome="http://api.gnome.org/doap-extensions#"
+ xmlns="http://usefulinc.com/ns/doap#">
+
+ <name>libglnx</name>
+ <shortname>libglnx</shortname>
+
+ <shortdesc xml:lang="en">"Copylib" for system service modules using GLib with Linux</shortdesc>
+
+ <description xml:lang="en">This module is intended for use by
+ infrastructure code using GLib that is also Linux specific, such as
+ ostree, NetworkManager, and others.
+ </description>
+
+ <license rdf:resource="http://usefulinc.com/doap/licenses/lgpl" />
+ <mailing-list rdf:resource="mailto:desktop-devel-list@gnome.org" />
+
+ <programming-language>C</programming-language>
+
+ <maintainer>
+ <foaf:Person>
+ <foaf:name>Colin Walters</foaf:name>
+ <foaf:mbox rdf:resource="mailto:walters@verbum.org"/>
+ <gnome:userid>walters</gnome:userid>
+ </foaf:Person>
+ </maintainer>
+
+</Project>
diff -Nuar flatpak-1.0.0.orig/libglnx/libglnx.h flatpak-1.0.0/libglnx/libglnx.h
--- flatpak-1.0.0.orig/libglnx/libglnx.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/libglnx.h 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,40 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2012,2013,2015 Colin Walters <walters@verbum.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+#include <gio/gio.h>
+
+G_BEGIN_DECLS
+
+#include <glnx-macros.h>
+#include <glnx-missing.h>
+#include <glnx-local-alloc.h>
+#include <glnx-backport-autocleanups.h>
+#include <glnx-backports.h>
+#include <glnx-lockfile.h>
+#include <glnx-errors.h>
+#include <glnx-dirfd.h>
+#include <glnx-shutil.h>
+#include <glnx-xattrs.h>
+#include <glnx-console.h>
+#include <glnx-fdio.h>
+
+G_END_DECLS
diff -Nuar flatpak-1.0.0.orig/libglnx/libglnx.m4 flatpak-1.0.0/libglnx/libglnx.m4
--- flatpak-1.0.0.orig/libglnx/libglnx.m4 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/libglnx.m4 2018-05-26 00:50:25.434037228 +0300
@@ -0,0 +1,33 @@
+AC_DEFUN([LIBGLNX_CONFIGURE],
+[
+AC_CHECK_DECLS([
+ renameat2,
+ memfd_create,
+ copy_file_range],
+ [], [], [[
+#include <sys/types.h>
+#include <unistd.h>
+#include <sys/mount.h>
+#include <fcntl.h>
+#include <sched.h>
+#include <linux/loop.h>
+#include <linux/random.h>
+#include <sys/mman.h>
+]])
+
+AC_ARG_ENABLE(otmpfile,
+ [AS_HELP_STRING([--disable-otmpfile],
+ [Disable use of O_TMPFILE [default=no]])],,
+ [enable_otmpfile=yes])
+AS_IF([test $enable_otmpfile = yes], [], [
+ AC_DEFINE([DISABLE_OTMPFILE], 1, [Define if we should avoid using O_TMPFILE])])
+
+AC_ARG_ENABLE(wrpseudo-compat,
+ [AS_HELP_STRING([--enable-wrpseudo-compat],
+ [Disable use syscall() and filesystem calls to for compatibility with wrpseudo [default=no]])],,
+ [enable_wrpseudo_compat=no])
+AS_IF([test $enable_wrpseudo_compat = no], [], [
+ AC_DEFINE([ENABLE_WRPSEUDO_COMPAT], 1, [Define if we should be compatible with wrpseudo])])
+
+dnl end LIBGLNX_CONFIGURE
+])
diff -Nuar flatpak-1.0.0.orig/libglnx/Makefile-libglnx.am flatpak-1.0.0/libglnx/Makefile-libglnx.am
--- flatpak-1.0.0.orig/libglnx/Makefile-libglnx.am 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/Makefile-libglnx.am 2018-02-03 21:26:06.307233341 +0300
@@ -0,0 +1,78 @@
+# Copyright (C) 2015 Colin Walters <walters@verbum.org>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, write to the
+# Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+# Boston, MA 02111-1307, USA.
+
+EXTRA_DIST += \
+ $(libglnx_srcpath)/README.md \
+ $(libglnx_srcpath)/COPYING \
+ $(libglnx_srcpath)/libglnx.m4 \
+ $(NULL)
+
+libglnx_la_SOURCES = \
+ $(libglnx_srcpath)/glnx-macros.h \
+ $(libglnx_srcpath)/glnx-backport-autocleanups.h \
+ $(libglnx_srcpath)/glnx-backport-autoptr.h \
+ $(libglnx_srcpath)/glnx-backports.h \
+ $(libglnx_srcpath)/glnx-backports.c \
+ $(libglnx_srcpath)/glnx-local-alloc.h \
+ $(libglnx_srcpath)/glnx-local-alloc.c \
+ $(libglnx_srcpath)/glnx-errors.h \
+ $(libglnx_srcpath)/glnx-errors.c \
+ $(libglnx_srcpath)/glnx-console.h \
+ $(libglnx_srcpath)/glnx-console.c \
+ $(libglnx_srcpath)/glnx-dirfd.h \
+ $(libglnx_srcpath)/glnx-dirfd.c \
+ $(libglnx_srcpath)/glnx-fdio.h \
+ $(libglnx_srcpath)/glnx-fdio.c \
+ $(libglnx_srcpath)/glnx-lockfile.h \
+ $(libglnx_srcpath)/glnx-lockfile.c \
+ $(libglnx_srcpath)/glnx-missing-syscall.h \
+ $(libglnx_srcpath)/glnx-missing.h \
+ $(libglnx_srcpath)/glnx-xattrs.h \
+ $(libglnx_srcpath)/glnx-xattrs.c \
+ $(libglnx_srcpath)/glnx-shutil.h \
+ $(libglnx_srcpath)/glnx-shutil.c \
+ $(libglnx_srcpath)/libglnx.h \
+ $(libglnx_srcpath)/tests/libglnx-testlib.h \
+ $(NULL)
+
+libglnx_la_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+libglnx_la_LDFLAGS = -avoid-version -Bsymbolic-functions -export-symbols-regex "^glnx_" -no-undefined -export-dynamic
+libglnx_la_LIBADD = $(libglnx_libs)
+
+libglnx_tests = test-libglnx-xattrs test-libglnx-fdio test-libglnx-errors test-libglnx-macros test-libglnx-shutil
+TESTS += $(libglnx_tests)
+
+check_PROGRAMS += $(libglnx_tests)
+test_libglnx_xattrs_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-xattrs.c
+test_libglnx_xattrs_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_xattrs_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_fdio_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-fdio.c
+test_libglnx_fdio_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_fdio_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_errors_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-errors.c
+test_libglnx_errors_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_errors_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_macros_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-macros.c
+test_libglnx_macros_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_macros_LDADD = $(libglnx_libs) libglnx.la
+
+test_libglnx_shutil_SOURCES = $(libglnx_srcpath)/tests/test-libglnx-shutil.c
+test_libglnx_shutil_CFLAGS = $(AM_CFLAGS) $(libglnx_cflags)
+test_libglnx_shutil_LDADD = $(libglnx_libs) libglnx.la
diff -Nuar flatpak-1.0.0.orig/libglnx/README.md flatpak-1.0.0/libglnx/README.md
--- flatpak-1.0.0.orig/libglnx/README.md 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/README.md 2018-05-26 00:50:25.433037228 +0300
@@ -0,0 +1,52 @@
+libglnx is the successor to libgsystem: https://git.gnome.org/browse/libgsystem
+
+It is for modules which depend on both GLib and Linux, intended to be
+used as a git submodule.
+
+Features:
+
+ - File APIs which use `openat()` like APIs, but also take a `GCancellable`
+ to support dynamic cancellation
+ - APIs also have a `GError` parameter
+ - High level "shutil", somewhat inspired by Python's
+ - A "console" API for tty output
+ - A backport of the GLib cleanup macros for projects which can't yet take
+ a dependency on 2.40.
+
+Why?
+----
+
+There are multiple projects which have a hard dependency on Linux and
+GLib, such as NetworkManager, ostree, flatpak, etc. It makes sense
+for them to be able to share Linux-specific APIs.
+
+This module also contains some code taken from systemd, which has very
+high quality LGPLv2+ shared library code, but most of the internal
+shared library is private, and not namespaced.
+
+One could also compare this project to gnulib; the salient differences
+there are that at least some of this module is eventually destined for
+inclusion in GLib.
+
+Porting from libgsystem
+-----------------------
+
+For all of the filesystem access code, libglnx exposes only
+fd-relative API, not `GFile*`. It does use `GCancellable` where
+applicable.
+
+For local allocation macros, you should start using the `g_auto`
+macros from GLib. A backport is included in libglnx. There are a few
+APIs not defined in GLib yet, such as `glnx_autofd`.
+
+`gs_transfer_out_value` is replaced by `g_steal_pointer`.
+
+Contributing
+------------
+
+Currently there is not a Bugzilla product - one may be created
+in the future. You can submit PRs against the Github mirror:
+
+https://github.com/GNOME/libglnx/pulls
+
+Or alternatively, email one of the maintainers directly.
diff -Nuar flatpak-1.0.0.orig/libglnx/tests/libglnx-testlib.h flatpak-1.0.0/libglnx/tests/libglnx-testlib.h
--- flatpak-1.0.0.orig/libglnx/tests/libglnx-testlib.h 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/tests/libglnx-testlib.h 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,34 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#pragma once
+
+typedef GError _GLnxTestAutoError;
+static inline void
+_glnx_test_auto_error_cleanup (_GLnxTestAutoError *autoerror)
+{
+ g_assert_no_error (autoerror);
+ /* We could add a clear call here, but no point...we'll have aborted */
+}
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(_GLnxTestAutoError, _glnx_test_auto_error_cleanup);
+
+#define _GLNX_TEST_DECLARE_ERROR(local_error, error) \
+ g_autoptr(_GLnxTestAutoError) local_error = NULL; \
+ GError **error = &local_error
diff -Nuar flatpak-1.0.0.orig/libglnx/tests/test-libglnx-errors.c flatpak-1.0.0/libglnx/tests/test-libglnx-errors.c
--- flatpak-1.0.0.orig/libglnx/tests/test-libglnx-errors.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/tests/test-libglnx-errors.c 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,183 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "libglnx.h"
+#include <glib.h>
+#include <stdlib.h>
+#include <gio/gio.h>
+#include <string.h>
+
+static void
+test_error_throw (void)
+{
+ g_autoptr(GError) error = NULL;
+
+ g_assert (!glnx_throw (&error, "foo: %s %d", "hello", 42));
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+ g_assert_cmpstr (error->message, ==, "foo: hello 42");
+ g_clear_error (&error);
+
+ gpointer dummy = glnx_null_throw (&error, "literal foo");
+ g_assert (dummy == NULL);
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+ g_assert_cmpstr (error->message, ==, "literal foo");
+ g_clear_error (&error);
+
+ gpointer dummy2 = glnx_null_throw (&error, "foo: %s %d", "hola", 24);
+ g_assert (dummy2 == NULL);
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_FAILED);
+ g_assert_cmpstr (error->message, ==, "foo: hola 24");
+ g_clear_error (&error);
+}
+
+static void
+test_error_errno (void)
+{
+ g_autoptr(GError) error = NULL;
+ const char noent_path[] = "/enoent-this-should-not-exist";
+ int fd;
+
+ fd = open (noent_path, O_RDONLY);
+ if (fd < 0)
+ {
+ g_assert (!glnx_throw_errno (&error));
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_assert (!glnx_prefix_error (&error, "myprefix"));
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_assert (g_str_has_prefix (error->message, "myprefix: "));
+ g_clear_error (&error);
+ }
+ else
+ g_assert_cmpint (fd, ==, -1);
+
+ fd = open (noent_path, O_RDONLY);
+ if (fd < 0)
+ {
+ gpointer dummy = glnx_null_throw_errno (&error);
+ g_assert (dummy == NULL);
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ dummy = glnx_prefix_error_null (&error, "myprefix");
+ g_assert (dummy == NULL);
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_assert (g_str_has_prefix (error->message, "myprefix: "));
+ g_clear_error (&error);
+ }
+ else
+ g_assert_cmpint (fd, ==, -1);
+
+ fd = open (noent_path, O_RDONLY);
+ if (fd < 0)
+ {
+ g_autofree char *expected_prefix = g_strdup_printf ("Failed to open %s", noent_path);
+ g_assert (!glnx_throw_errno_prefix (&error, "Failed to open %s", noent_path));
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_assert (g_str_has_prefix (error->message, expected_prefix));
+ g_clear_error (&error);
+ /* And test the legacy wrapper */
+ glnx_set_prefix_error_from_errno (&error, "Failed to open %s", noent_path);
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_assert (g_str_has_prefix (error->message, expected_prefix));
+ g_clear_error (&error);
+ }
+ else
+ g_assert_cmpint (fd, ==, -1);
+
+ fd = open (noent_path, O_RDONLY);
+ if (fd < 0)
+ {
+ gpointer dummy = glnx_null_throw_errno_prefix (&error, "Failed to open file");
+ g_assert (dummy == NULL);
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_assert (g_str_has_prefix (error->message, "Failed to open file"));
+ g_clear_error (&error);
+ }
+ else
+ g_assert_cmpint (fd, ==, -1);
+
+ fd = open (noent_path, O_RDONLY);
+ if (fd < 0)
+ {
+ gpointer dummy = glnx_null_throw_errno_prefix (&error, "Failed to open %s", noent_path);
+ g_assert (dummy == NULL);
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_assert (g_str_has_prefix (error->message, glnx_strjoina ("Failed to open ", noent_path)));
+ g_clear_error (&error);
+ }
+ else
+ g_assert_cmpint (fd, ==, -1);
+}
+
+static void
+test_error_auto_nothrow (GError **error)
+{
+ GLNX_AUTO_PREFIX_ERROR("foo", error);
+ /* Side effect to avoid otherwise empty function */
+ g_assert_no_error (*error);
+}
+
+static void
+test_error_auto_throw (GError **error)
+{
+ GLNX_AUTO_PREFIX_ERROR("foo", error);
+ (void) glnx_throw (error, "oops");
+}
+
+static void
+test_error_auto_throw_recurse (GError **error)
+{
+ GLNX_AUTO_PREFIX_ERROR("foo", error);
+
+ if (TRUE)
+ {
+ GLNX_AUTO_PREFIX_ERROR("bar", error);
+ (void) glnx_throw (error, "oops");
+ }
+}
+
+static void
+test_error_auto (void)
+{
+ g_autoptr(GError) error = NULL;
+ test_error_auto_nothrow (&error);
+ g_assert_no_error (error);
+ test_error_auto_throw (&error);
+ g_assert_nonnull (error);
+ g_assert_cmpstr (error->message, ==, "foo: oops");
+ g_clear_error (&error);
+ test_error_auto_throw_recurse (&error);
+ g_assert_nonnull (error);
+ g_assert_cmpstr (error->message, ==, "foo: bar: oops");
+}
+
+int main (int argc, char **argv)
+{
+ int ret;
+
+ g_test_init (&argc, &argv, NULL);
+
+ g_test_add_func ("/error-throw", test_error_throw);
+ g_test_add_func ("/error-errno", test_error_errno);
+ g_test_add_func ("/error-auto", test_error_auto);
+
+ ret = g_test_run();
+
+ return ret;
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/tests/test-libglnx-fdio.c flatpak-1.0.0/libglnx/tests/test-libglnx-fdio.c
--- flatpak-1.0.0.orig/libglnx/tests/test-libglnx-fdio.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/tests/test-libglnx-fdio.c 2018-05-26 00:50:25.435037228 +0300
@@ -0,0 +1,254 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "libglnx.h"
+#include <glib.h>
+#include <stdlib.h>
+#include <gio/gio.h>
+#include <err.h>
+#include <string.h>
+
+#include "libglnx-testlib.h"
+
+static gboolean
+renameat_test_setup (int *out_srcfd, int *out_destfd,
+ GError **error)
+{
+ glnx_autofd int srcfd = -1;
+ glnx_autofd int destfd = -1;
+
+ (void) glnx_shutil_rm_rf_at (AT_FDCWD, "srcdir", NULL, NULL);
+ if (mkdir ("srcdir", 0755) < 0)
+ err (1, "mkdir");
+ if (!glnx_opendirat (AT_FDCWD, "srcdir", TRUE, &srcfd, error))
+ return FALSE;
+ (void) glnx_shutil_rm_rf_at (AT_FDCWD, "destdir", NULL, NULL);
+ if (mkdir ("destdir", 0755) < 0)
+ err (1, "mkdir");
+ if (!glnx_opendirat (AT_FDCWD, "destdir", TRUE, &destfd, error))
+ return FALSE;
+
+ if (!glnx_file_replace_contents_at (srcfd, "foo", (guint8*)"foo contents", strlen ("foo contents"),
+ GLNX_FILE_REPLACE_NODATASYNC, NULL, error))
+ return FALSE;
+ if (!glnx_file_replace_contents_at (destfd, "bar", (guint8*)"bar contents", strlen ("bar contents"),
+ GLNX_FILE_REPLACE_NODATASYNC, NULL, error))
+ return FALSE;
+
+ *out_srcfd = srcfd; srcfd = -1;
+ *out_destfd = destfd; destfd = -1;
+ return TRUE;
+}
+
+static void
+test_renameat2_noreplace (void)
+{
+ _GLNX_TEST_DECLARE_ERROR(local_error, error);
+ glnx_autofd int srcfd = -1;
+ glnx_autofd int destfd = -1;
+ struct stat stbuf;
+
+ if (!renameat_test_setup (&srcfd, &destfd, error))
+ return;
+
+ if (glnx_renameat2_noreplace (srcfd, "foo", destfd, "bar") == 0)
+ g_assert_not_reached ();
+ else
+ {
+ g_assert_cmpint (errno, ==, EEXIST);
+ }
+
+ if (glnx_renameat2_noreplace (srcfd, "foo", destfd, "baz") < 0)
+ return (void)glnx_throw_errno_prefix (error, "renameat");
+ if (!glnx_fstatat (destfd, "bar", &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return;
+
+ if (fstatat (srcfd, "foo", &stbuf, AT_SYMLINK_NOFOLLOW) == 0)
+ g_assert_not_reached ();
+ else
+ g_assert_cmpint (errno, ==, ENOENT);
+}
+
+static void
+test_renameat2_exchange (void)
+{
+ _GLNX_TEST_DECLARE_ERROR(local_error, error);
+
+ glnx_autofd int srcfd = -1;
+ glnx_autofd int destfd = -1;
+ if (!renameat_test_setup (&srcfd, &destfd, error))
+ return;
+
+ if (glnx_renameat2_exchange (AT_FDCWD, "srcdir", AT_FDCWD, "destdir") < 0)
+ return (void)glnx_throw_errno_prefix (error, "renameat");
+
+ /* Ensure the dir fds are the same */
+ struct stat stbuf;
+ if (!glnx_fstatat (srcfd, "foo", &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return;
+ if (!glnx_fstatat (destfd, "bar", &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return;
+ /* But the dirs should be swapped */
+ if (!glnx_fstatat (AT_FDCWD, "destdir/foo", &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return;
+ if (!glnx_fstatat (AT_FDCWD, "srcdir/bar", &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return;
+}
+
+static void
+test_tmpfile (void)
+{
+ _GLNX_TEST_DECLARE_ERROR(local_error, error);
+
+ g_auto(GLnxTmpfile) tmpf = { 0, };
+ if (!glnx_open_tmpfile_linkable_at (AT_FDCWD, ".", O_WRONLY|O_CLOEXEC, &tmpf, error))
+ return;
+ if (glnx_loop_write (tmpf.fd, "foo", strlen ("foo")) < 0)
+ return (void)glnx_throw_errno_prefix (error, "write");
+ if (glnx_link_tmpfile_at (&tmpf, GLNX_LINK_TMPFILE_NOREPLACE, AT_FDCWD, "foo", error))
+ return;
+}
+
+static void
+test_stdio_file (void)
+{
+ _GLNX_TEST_DECLARE_ERROR(local_error, error);
+ g_auto(GLnxTmpfile) tmpf = { 0, };
+ g_autoptr(FILE) f = NULL;
+
+ if (!glnx_open_anonymous_tmpfile (O_RDWR|O_CLOEXEC, &tmpf, error))
+ return;
+ f = fdopen (tmpf.fd, "w");
+ tmpf.fd = -1; /* Ownership was transferred via fdopen() */
+ if (!f)
+ return (void)glnx_throw_errno_prefix (error, "fdopen");
+ if (fwrite ("hello", 1, strlen ("hello"), f) != strlen ("hello"))
+ return (void)glnx_throw_errno_prefix (error, "fwrite");
+ if (!glnx_stdio_file_flush (f, error))
+ return;
+}
+
+static void
+test_fstatat (void)
+{
+ _GLNX_TEST_DECLARE_ERROR(local_error, error);
+ struct stat stbuf = { 0, };
+
+ if (!glnx_fstatat_allow_noent (AT_FDCWD, ".", &stbuf, 0, error))
+ return;
+ g_assert_cmpint (errno, ==, 0);
+ g_assert_no_error (local_error);
+ g_assert (S_ISDIR (stbuf.st_mode));
+ if (!glnx_fstatat_allow_noent (AT_FDCWD, "nosuchfile", &stbuf, 0, error))
+ return;
+ g_assert_cmpint (errno, ==, ENOENT);
+ g_assert_no_error (local_error);
+
+ /* test NULL parameter for stat */
+ if (!glnx_fstatat_allow_noent (AT_FDCWD, ".", NULL, 0, error))
+ return;
+ g_assert_cmpint (errno, ==, 0);
+ g_assert_no_error (local_error);
+ if (!glnx_fstatat_allow_noent (AT_FDCWD, "nosuchfile", NULL, 0, error))
+ return;
+ g_assert_cmpint (errno, ==, ENOENT);
+ g_assert_no_error (local_error);
+}
+
+static void
+test_filecopy (void)
+{
+ _GLNX_TEST_DECLARE_ERROR(local_error, error);
+ const char foo[] = "foo";
+ struct stat stbuf;
+
+ if (!glnx_ensure_dir (AT_FDCWD, "subdir", 0755, error))
+ return;
+
+ if (!glnx_file_replace_contents_at (AT_FDCWD, foo, (guint8*)foo, sizeof (foo),
+ GLNX_FILE_REPLACE_NODATASYNC, NULL, error))
+ return;
+
+ /* Copy it into both the same dir and a subdir */
+ if (!glnx_file_copy_at (AT_FDCWD, foo, NULL, AT_FDCWD, "bar",
+ GLNX_FILE_COPY_NOXATTRS, NULL, error))
+ return;
+ if (!glnx_file_copy_at (AT_FDCWD, foo, NULL, AT_FDCWD, "subdir/bar",
+ GLNX_FILE_COPY_NOXATTRS, NULL, error))
+ return;
+ if (!glnx_fstatat (AT_FDCWD, "subdir/bar", &stbuf, 0, error))
+ return;
+
+ if (glnx_file_copy_at (AT_FDCWD, foo, NULL, AT_FDCWD, "bar",
+ GLNX_FILE_COPY_NOXATTRS, NULL, error))
+ g_assert_not_reached ();
+ g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_EXISTS);
+ g_clear_error (&local_error);
+
+ if (!glnx_file_copy_at (AT_FDCWD, foo, NULL, AT_FDCWD, "bar",
+ GLNX_FILE_COPY_NOXATTRS | GLNX_FILE_COPY_OVERWRITE,
+ NULL, error))
+ return;
+
+ if (symlinkat ("nosuchtarget", AT_FDCWD, "link") < 0)
+ return (void) glnx_throw_errno_prefix (error, "symlinkat");
+
+ /* Shouldn't be able to overwrite a symlink without GLNX_FILE_COPY_OVERWRITE */
+ if (glnx_file_copy_at (AT_FDCWD, foo, NULL, AT_FDCWD, "link",
+ GLNX_FILE_COPY_NOXATTRS,
+ NULL, error))
+ g_assert_not_reached ();
+ g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_EXISTS);
+ g_clear_error (&local_error);
+
+ /* Test overwriting symlink */
+ if (!glnx_file_copy_at (AT_FDCWD, foo, NULL, AT_FDCWD, "link",
+ GLNX_FILE_COPY_NOXATTRS | GLNX_FILE_COPY_OVERWRITE,
+ NULL, error))
+ return;
+
+ if (!glnx_fstatat_allow_noent (AT_FDCWD, "nosuchtarget", &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return;
+ g_assert_cmpint (errno, ==, ENOENT);
+ g_assert_no_error (local_error);
+
+ if (!glnx_fstatat (AT_FDCWD, "link", &stbuf, AT_SYMLINK_NOFOLLOW, error))
+ return;
+ g_assert (S_ISREG (stbuf.st_mode));
+}
+
+int main (int argc, char **argv)
+{
+ int ret;
+
+ g_test_init (&argc, &argv, NULL);
+
+ g_test_add_func ("/tmpfile", test_tmpfile);
+ g_test_add_func ("/stdio-file", test_stdio_file);
+ g_test_add_func ("/filecopy", test_filecopy);
+ g_test_add_func ("/renameat2-noreplace", test_renameat2_noreplace);
+ g_test_add_func ("/renameat2-exchange", test_renameat2_exchange);
+ g_test_add_func ("/fstat", test_fstatat);
+
+ ret = g_test_run();
+
+ return ret;
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/tests/test-libglnx-macros.c flatpak-1.0.0/libglnx/tests/test-libglnx-macros.c
--- flatpak-1.0.0.orig/libglnx/tests/test-libglnx-macros.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/tests/test-libglnx-macros.c 2018-02-03 21:26:06.309233341 +0300
@@ -0,0 +1,109 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "libglnx.h"
+#include <glib.h>
+#include <stdlib.h>
+#include <gio/gio.h>
+#include <string.h>
+
+static void
+test_inset (void)
+{
+ g_assert (G_IN_SET (7, 7));
+ g_assert (G_IN_SET (7, 42, 7));
+ g_assert (G_IN_SET (7, 7,42,3,9));
+ g_assert (G_IN_SET (42, 7,42,3,9));
+ g_assert (G_IN_SET (3, 7,42,3,9));
+ g_assert (G_IN_SET (9, 7,42,3,9));
+ g_assert (!G_IN_SET (8, 7,42,3,9));
+ g_assert (!G_IN_SET (-1, 7,42,3,9));
+ g_assert (G_IN_SET ('x', 'a', 'x', 'c'));
+ g_assert (!G_IN_SET ('y', 'a', 'x', 'c'));
+}
+
+static void
+test_hash_table_foreach (void)
+{
+ /* use var names all different from the macro metavars to ensure proper
+ * substitution */
+ g_autoptr(GHashTable) table = g_hash_table_new (g_str_hash, g_str_equal);
+ const char *keys[] = {"key1", "key2"};
+ const char *vals[] = {"val1", "val2"};
+ g_hash_table_insert (table, (gpointer)keys[0], (gpointer)vals[0]);
+ g_hash_table_insert (table, (gpointer)keys[1], (gpointer)vals[1]);
+
+ guint i = 0;
+ GLNX_HASH_TABLE_FOREACH_IT (table, it, const char*, key, const char*, val)
+ {
+ g_assert_cmpstr (key, ==, keys[i]);
+ g_assert_cmpstr (val, ==, vals[i]);
+ i++;
+ }
+ g_assert_cmpuint (i, ==, 2);
+
+ i = 0;
+ GLNX_HASH_TABLE_FOREACH_IT (table, it, const char*, key, const char*, val)
+ {
+ g_hash_table_iter_remove (&it);
+ break;
+ }
+ g_assert_cmpuint (g_hash_table_size (table), ==, 1);
+
+ g_hash_table_insert (table, (gpointer)keys[1], (gpointer)vals[1]);
+ g_assert_cmpuint (g_hash_table_size (table), ==, 1);
+
+ g_hash_table_insert (table, (gpointer)keys[0], (gpointer)vals[0]);
+ g_assert_cmpuint (g_hash_table_size (table), ==, 2);
+
+ i = 0;
+ GLNX_HASH_TABLE_FOREACH_KV (table, const char*, key, const char*, val)
+ {
+ g_assert_cmpstr (key, ==, keys[i]);
+ g_assert_cmpstr (val, ==, vals[i]);
+ i++;
+ }
+ g_assert_cmpuint (i, ==, 2);
+
+ i = 0;
+ GLNX_HASH_TABLE_FOREACH (table, const char*, key)
+ {
+ g_assert_cmpstr (key, ==, keys[i]);
+ i++;
+ }
+ g_assert_cmpuint (i, ==, 2);
+
+ i = 0;
+ GLNX_HASH_TABLE_FOREACH_V (table, const char*, val)
+ {
+ g_assert_cmpstr (val, ==, vals[i]);
+ i++;
+ }
+ g_assert_cmpuint (i, ==, 2);
+}
+
+int main (int argc, char **argv)
+{
+ g_test_init (&argc, &argv, NULL);
+ g_test_add_func ("/inset", test_inset);
+ g_test_add_func ("/hash_table_foreach", test_hash_table_foreach);
+ return g_test_run();
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/tests/test-libglnx-shutil.c flatpak-1.0.0/libglnx/tests/test-libglnx-shutil.c
--- flatpak-1.0.0.orig/libglnx/tests/test-libglnx-shutil.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/tests/test-libglnx-shutil.c 2018-05-26 00:50:25.435037228 +0300
@@ -0,0 +1,63 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright © 2017 Endless Mobile, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "libglnx.h"
+#include <glib.h>
+#include <stdlib.h>
+#include <gio/gio.h>
+#include <err.h>
+#include <string.h>
+
+#include "libglnx-testlib.h"
+
+static void
+test_mkdir_p_enoent (void)
+{
+ _GLNX_TEST_DECLARE_ERROR(local_error, error);
+ glnx_autofd int dfd = -1;
+
+ if (!glnx_ensure_dir (AT_FDCWD, "test", 0755, error))
+ return;
+ if (!glnx_opendirat (AT_FDCWD, "test", FALSE, &dfd, error))
+ return;
+ if (rmdir ("test") < 0)
+ return (void) glnx_throw_errno_prefix (error, "rmdir(%s)", "test");
+
+ /* This should fail with ENOENT. */
+ glnx_shutil_mkdir_p_at (dfd, "blah/baz", 0755, NULL, error);
+ g_assert_error (local_error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND);
+ g_clear_error (&local_error);
+}
+
+int
+main (int argc,
+ char **argv)
+{
+ int ret;
+
+ g_test_init (&argc, &argv, NULL);
+
+ g_test_add_func ("/mkdir-p/enoent", test_mkdir_p_enoent);
+
+ ret = g_test_run();
+
+ return ret;
+}
diff -Nuar flatpak-1.0.0.orig/libglnx/tests/test-libglnx-xattrs.c flatpak-1.0.0/libglnx/tests/test-libglnx-xattrs.c
--- flatpak-1.0.0.orig/libglnx/tests/test-libglnx-xattrs.c 1970-01-01 02:00:00.000000000 +0200
+++ flatpak-1.0.0/libglnx/tests/test-libglnx-xattrs.c 2018-05-26 00:50:25.435037228 +0300
@@ -0,0 +1,283 @@
+/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*-
+ *
+ * Copyright (C) 2017 Red Hat, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include "config.h"
+#include "libglnx.h"
+#include <glib.h>
+#include <stdlib.h>
+#include <gio/gio.h>
+#include <string.h>
+
+#define XATTR_THREAD_RUN_TIME_USECS (5 * G_USEC_PER_SEC)
+
+struct XattrWorker {
+ int dfd;
+ gboolean is_writer;
+ guint n_attrs_read;
+};
+
+typedef enum {
+ WRITE_RUN_MUTATE,
+ WRITE_RUN_CREATE,
+} WriteType;
+
+static gboolean
+set_random_xattr_value (int fd, const char *name, GError **error)
+{
+ const guint8 randxattrbyte = g_random_int_range (0, 256);
+ const guint32 randxattrvalue_len = (g_random_int () % 256) + 1; /* Picked to be not too small or large */
+ g_autofree char *randxattrvalue = g_malloc (randxattrvalue_len);
+
+ memset (randxattrvalue, randxattrbyte, randxattrvalue_len);
+
+ if (fsetxattr (fd, name, randxattrvalue, randxattrvalue_len, 0) < 0)
+ {
+ glnx_set_error_from_errno (error);
+ return FALSE;
+ }
+
+ return TRUE;
+}
+
+static gboolean
+add_random_xattrs (int fd, GError **error)
+{
+ const guint nattrs = MIN (2, g_random_int () % 16);
+
+ for (guint i = 0; i < nattrs; i++)
+ {
+ guint32 randxattrname_v = g_random_int ();
+ g_autofree char *randxattrname = g_strdup_printf ("user.test%u", randxattrname_v);
+
+ if (!set_random_xattr_value (fd, randxattrname, error))
+ return FALSE;
+ }
+
+ return TRUE;
+}
+
+static gboolean
+do_write_run (GLnxDirFdIterator *dfd_iter, GError **error)
+{
+ WriteType wtype = g_random_int () % 2;
+
+ if (wtype == WRITE_RUN_CREATE)
+ {
+ guint32 randname_v = g_random_int ();
+ g_autofree char *randname = g_strdup_printf ("file%u", randname_v);
+ glnx_autofd int fd = -1;
+
+ again:
+ fd = openat (dfd_iter->fd, randname, O_CREAT | O_EXCL, 0644);
+ if (fd < 0)
+ {
+ if (errno == EEXIST)
+ {
+ g_printerr ("Congratulations! I suggest purchasing a lottery ticket today!\n");
+ goto again;
+ }
+ else
+ {
+ glnx_set_error_from_errno (error);
+ return FALSE;
+ }
+ }
+
+ if (!add_random_xattrs (fd, error))
+ return FALSE;
+ }
+ else if (wtype == WRITE_RUN_MUTATE)
+ {
+ while (TRUE)
+ {
+ struct dirent *dent;
+ if (!glnx_dirfd_iterator_next_dent (dfd_iter, &dent, NULL, error))
+ return FALSE;
+ if (!dent)
+ break;
+
+ glnx_autofd int fd = -1;
+ if (!glnx_openat_rdonly (dfd_iter->fd, dent->d_name, FALSE, &fd, error))
+ return FALSE;
+
+ g_autoptr(GVariant) current_xattrs = NULL;
+ if (!glnx_fd_get_all_xattrs (fd, &current_xattrs, NULL, error))
+ return FALSE;
+
+ for (int i = 0; i < g_variant_n_children (current_xattrs); i++)
+ {
+ const char *name, *value;
+ g_variant_get_child (current_xattrs, i, "(^&ay^&ay)", &name, &value);
+
+ /* We don't want to potentially test/change xattrs like security.selinux
+ * that were injected by the system.
+ */
+ if (!g_str_has_prefix (name, "user.test"))
+ continue;
+
+ if (!set_random_xattr_value (fd, name, error))
+ return FALSE;
+ }
+ }
+ }
+ else
+ g_assert_not_reached ();
+
+ return TRUE;
+}
+
+static gboolean
+do_read_run (GLnxDirFdIterator *dfd_iter,
+ guint *out_n_read,
+ GError **error)
+{
+ guint nattrs = 0;
+ while (TRUE)
+ {
+ struct dirent *dent;
+ if (!glnx_dirfd_iterator_next_dent (dfd_iter, &dent, NULL, error))
+ return FALSE;
+ if (!dent)
+ break;
+
+ glnx_autofd int fd = -1;
+ if (!glnx_openat_rdonly (dfd_iter->fd, dent->d_name, FALSE, &fd, error))
+ return FALSE;
+
+ g_autoptr(GVariant) current_xattrs = NULL;
+ if (!glnx_fd_get_all_xattrs (fd, &current_xattrs, NULL, error))
+ return FALSE;
+
+ /* We don't actually care about the values, just use the variable
+ * to avoid compiler warnings.
+ */
+ nattrs += g_variant_n_children (current_xattrs);
+ }
+
+ *out_n_read = nattrs;
+ return TRUE;
+}
+
+static gpointer
+xattr_thread (gpointer data)
+{
+ g_autoptr(GError) local_error = NULL;
+ GError **error = &local_error;
+ struct XattrWorker *worker = data;
+ guint64 end_time = g_get_monotonic_time () + XATTR_THREAD_RUN_TIME_USECS;
+ guint n_read = 0;
+
+ while (g_get_monotonic_time () < end_time)
+ {
+ g_auto(GLnxDirFdIterator) dfd_iter = { 0, };
+
+ if (!glnx_dirfd_iterator_init_at (worker->dfd, ".", TRUE, &dfd_iter, error))
+ goto out;
+
+ if (worker->is_writer)
+ {
+ if (!do_write_run (&dfd_iter, error))
+ goto out;
+ }
+ else
+ {
+ if (!do_read_run (&dfd_iter, &n_read, error))
+ goto out;
+ }
+ }
+
+ out:
+ g_assert_no_error (local_error);
+
+ return GINT_TO_POINTER (n_read);
+}
+
+static void
+test_xattr_races (void)
+{
+ /* If for some reason we're built in a VM which only has one vcpu, let's still
+ * at least make the test do something.
+ */
+ /* FIXME - this deadlocks for me on 4.9.4-201.fc25.x86_64, whether
+ * using overlayfs or xfs as source/dest.
+ */
+ const guint nprocs = MAX (4, g_get_num_processors ());
+ struct XattrWorker wdata[nprocs];
+ GThread *threads[nprocs];
+ g_autoptr(GError) local_error = NULL;
+ GError **error = &local_error;
+ g_auto(GLnxTmpDir) tmpdir = { 0, };
+ g_autofree char *tmpdir_path = g_strdup_printf ("%s/libglnx-xattrs-XXXXXX",
+ getenv ("TMPDIR") ?: "/var/tmp");
+ guint nread = 0;
+
+ if (!glnx_mkdtempat (AT_FDCWD, tmpdir_path, 0700,
+ &tmpdir, error))
+ goto out;
+
+ /* Support people building/testing on tmpfs https://github.com/flatpak/flatpak/issues/686 */
+ if (fsetxattr (tmpdir.fd, "user.test", "novalue", strlen ("novalue"), 0) < 0)
+ {
+ if (errno == EOPNOTSUPP)
+ {
+ g_test_skip ("no xattr support");
+ return;
+ }
+ else
+ {
+ glnx_set_error_from_errno (error);
+ goto out;
+ }
+ }
+
+ for (guint i = 0; i < nprocs; i++)
+ {
+ struct XattrWorker *worker = &wdata[i];
+ worker->dfd = tmpdir.fd;
+ worker->is_writer = i % 2 == 0;
+ threads[i] = g_thread_new (NULL, xattr_thread, worker);
+ }
+
+ for (guint i = 0; i < nprocs; i++)
+ {
+ if (wdata[i].is_writer)
+ (void) g_thread_join (threads[i]);
+ else
+ nread += GPOINTER_TO_UINT (g_thread_join (threads[i]));
+ }
+
+ g_print ("Read %u xattrs race free!\n", nread);
+
+ out:
+ g_assert_no_error (local_error);
+}
+
+int main (int argc, char **argv)
+{
+ int ret;
+
+ g_test_init (&argc, &argv, NULL);
+
+ g_test_add_func ("/xattr-races", test_xattr_races);
+
+ ret = g_test_run();
+
+ return ret;
+}
Reference in New Issue View Git Blame Copy Permalink