The way we're currently doing it is by setting the environment from the desktop file, and that works OK for things launched from that desktop file (right?).
So if when running a snap we find that env key not set, I think we need to set BAMF_DESKTOP_FILE_HINT to *something*. Otherwise things (bamf in this instance, but I'm sure other desktops do something similar) can and will pick up the unwrapped binary, in cases where the app is actually a wrapper shell script. So, I think what we do today in snappy is OK, in that we copy the snap- provided desktop files over, but it's not enough: we need to be a bit smarter, and ensure that every app that requests unity7 (and x11, methinks) has a desktop file, either generating it ourselves or denying the interface when missing, and we need to set that env key to point to something ourselves if it isn't set already. If a snap provides multiple desktop files per app, and the env key isn't provided, I think just matching the shortest exec line would work. If the app needs more control they can provide multiple apps that map to the same binary. If an app is launched that requests one of these interfaces and we can't match it with a desktop file, we should bail. This'll cover corner cases related to weird upgrade paths, amongst other things. To recap, I think: * `snap install` and friends should start creating desktop files when needed and missing (iow, if snap run won't be able to find it) * `snap run` figures out if the thing should have BAMF_DESKTOP_FILE_HINT, find the right desktop file, and set it to that; bailing if missing (if there's a way to know we were launched not-from-command-line, pop up a dialog?) * `snap-confine` should bail if an interface that we know needs this doesn't have it -- You received this bug notification because you are a member of Desktop Packages, which is subscribed to bamf in Ubuntu. https://bugs.launchpad.net/bugs/1643910 Title: BAMF_DESKTOP_FILE_HINT not set in correct place for unity7 Status in Snappy: Triaged Status in bamf package in Ubuntu: Triaged Bug description: Occasionally when I pin items to the Unity7 launcher, the BAMF code (as I'm told) incorrectly matches to /snap/app/revision/.... This is a security issue because the Exec= line points to /snap/app/revision/... which bypasses snap run (/snap/bin/...) and therefore snap-confine. I'm told by Marcus (aka, 3v1n0 aka Trevinho) that this is because BAMF_DESKTOP_FILE_HINT is not exported by snap env and instead only injected in the desktop file that is created in /var/lib/snapd/desktop/applications upon snap install. This means that the wrong Exec= (ie, where it points to the binary) may occur in two places: 1. when launching /snap/bin/... from the command line 2. when something in /var/lib/snapd/desktop/applications/*.desktop doesn't match properly In both cases, the initial launch is fine, but pinning the icon to the launcher results in the wrong entry in the Exec= line and launching from this pinned launcher entry after is unconfined. You can check by doing: 1. launch application from the dash 2. run sudo aa-status and see if it is launched under confinement 3. pin the icon that is in the launcher 4. close the application, then launch from the pinned icon 5. run sudo aa-status and see if it is launched under confinement This doesn't happen all the time. For example, vlc seems to work fine both from the command line and from launching via a pinned launcher entry. chrome-test on the other hand doesn't seem to work with either. Related https://github.com/snapcore/snapd/pull/1580 -- puts BAMF_DESKTOP_FILE_HINT in the desktop file instead of in the environment, but Marco requested that this change (https://github.com/snapcore/snapd/pull/1580#issuecomment-234546220). https://trello.com/c/xP1hN3BF/152-improve-desktop-file-support-by- adding-a-new-bamf-desktop-file-hint-environment-hint also discussed this issue, but the card is archived and therefore it won't be worked on. I'm having trouble finding a simple reproducer (other than chrome- test) but am told by Marco that the BAMF matching will always work if BAMF_DESKTOP_FILE_HINT in the process' environment always points to the desktop file in /var/lib/snapd/desktop/applications. I will continue to look for a simple reproducer. To manage notifications about this bug go to: https://bugs.launchpad.net/snappy/+bug/1643910/+subscriptions -- Mailing list: https://launchpad.net/~desktop-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~desktop-packages More help : https://help.launchpad.net/ListHelp
