mirror of
https://github.com/projectatomic/bubblewrap.git
synced 2026-02-07 03:47:18 +01:00
e0a07f4de7
On e.g. debian by default unprivileged namespaces are not allowed. Typically the setuid mode is then used. However, if /dev is mounted (and thus devpts) then we need to do some workaround in how we create the uid/gid maps so uid 0 is mapped while we mount devpts. Unfortunately the way we were working around that is by using an unprivileged unshare(NEWUSER) in the sandbox, which doesn't work. See https://github.com/flatpak/flatpak/issues/2 for details. We work around this by mapping uid/gid 0 + the user. However, since this is a privileged operation we need to do that in the parent namespace, and we need setuid/setgid rights. Closes: #72 Approved by: cgwalters
32 lines
749 B
Makefile
32 lines
749 B
Makefile
AM_CFLAGS = $(WARN_CFLAGS)
|
|
CLEANFILES =
|
|
|
|
GITIGNOREFILES = build-aux/ gtk-doc.make config.h.in aclocal.m4
|
|
|
|
bin_PROGRAMS = bwrap
|
|
|
|
bwrap_srcpath := $(srcdir)
|
|
include Makefile-bwrap.am
|
|
|
|
install-exec-hook:
|
|
if PRIV_MODE_SETUID
|
|
$(SUDO_BIN) chown root $(DESTDIR)$(bindir)/bwrap
|
|
$(SUDO_BIN) chmod u+s $(DESTDIR)$(bindir)/bwrap
|
|
else
|
|
if PRIV_MODE_FILECAPS
|
|
$(SUDO_BIN) setcap cap_sys_admin,cap_net_admin,cap_sys_chroot,cap_setuid,cap_setgid+ep $(DESTDIR)$(bindir)/bwrap
|
|
endif
|
|
endif
|
|
|
|
include Makefile-docs.am
|
|
|
|
TESTS = tests/test-basic.sh
|
|
TESTS_ENVIRONMENT = PATH=$$(cd $(top_builddir) && pwd):$${PATH}
|
|
|
|
if ENABLE_BASH_COMPLETION
|
|
bashcompletiondir = $(BASH_COMPLETION_DIR)
|
|
dist_bashcompletion_DATA = completions/bash/bwrap
|
|
endif
|
|
|
|
-include $(top_srcdir)/git.mk
|