glib2.0/gio/gsandbox.c

/* GIO - GLib Input, Output and Streaming Library
 *
 * Copyright 2022 Canonical Ltd
 *
 * SPDX-License-Identifier: LGPL-2.1-or-later
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 2.1 of the License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General
 * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
 */

#include "config.h"

#include "gsandbox.h"

#include <string.h>

#define SNAP_CONFINEMENT_PREFIX "confinement:"

static gboolean
is_flatpak (void)
{
  const char *flatpak_info = "/.flatpak-info";
  gboolean found;

#ifdef G_PORTAL_SUPPORT_TEST
        char *test_key_file =
          g_build_filename (g_get_user_runtime_dir (), flatpak_info, NULL);
        flatpak_info = test_key_file;
#endif

  found = g_file_test (flatpak_info, G_FILE_TEST_EXISTS);

#ifdef G_PORTAL_SUPPORT_TEST
  g_clear_pointer (&test_key_file, g_free);
#endif

  return found;
}

static gchar *
get_snap_confinement (const char  *snap_yaml,
                      GError     **error)
{
  char *confinement = NULL;
  char *yaml_contents;

  if (g_file_get_contents (snap_yaml, &yaml_contents, NULL, error))
    {
      const char *line = yaml_contents;

      do
        {
          if (g_str_has_prefix (line, SNAP_CONFINEMENT_PREFIX))
            break;

          line = strchr (line, '\n');
          if (line)
            line += 1;
        }
      while (line != NULL);

      if (line)
        {
          const char *start = line + strlen (SNAP_CONFINEMENT_PREFIX);
          const char *end = strchr (start, '\n');

          confinement =
            g_strstrip (end ? g_strndup (start, end-start) : g_strdup (start));
        }

      g_free (yaml_contents);
    }

  return g_steal_pointer (&confinement);
}

static gboolean
is_snap (void)
{
  GError *error = NULL;
  const gchar *snap_path;
  gchar *yaml_path;
  char *confinement;
  gboolean result;

  snap_path = g_getenv ("SNAP");
  if (snap_path == NULL)
    return FALSE;

  result = FALSE;
  yaml_path = g_build_filename (snap_path, "meta", "snap.yaml", NULL);
  confinement = get_snap_confinement (yaml_path, &error);
  g_free (yaml_path);

  /* Classic snaps are de-facto no sandboxed apps, so we can ignore them */
  if (!error && g_strcmp0 (confinement, "classic") != 0)
    result = TRUE;

  g_clear_error (&error);
  g_free (confinement);

  return result;
}

/*
 * glib_get_sandbox_type:
 *
 * Gets the type of sandbox this process is running inside.
 *
 * Checking for sandboxes may involve doing blocking I/O calls, but should not take
 * any significant time.
 *
 * The sandbox will not change over the lifetime of the process, so calling this
 * function once and reusing the result is valid.
 *
 * If this process is not sandboxed then @G_SANDBOX_TYPE_UNKNOWN will be returned.
 * This is because this function only detects known sandbox types in #GSandboxType.
 * It may be updated in the future if new sandboxes come into use.
 *
 * Returns: a #GSandboxType.
 */
GSandboxType
glib_get_sandbox_type (void)
{
  if (is_flatpak ())
    return G_SANDBOX_TYPE_FLATPAK;
  else if (is_snap ())
    return G_SANDBOX_TYPE_SNAP;
  else
    return G_SANDBOX_TYPE_UNKNOWN;
}