From b9a4705f80e89fff3b65288cbbe8df73a365aee3 Mon Sep 17 00:00:00 2001 From: Maxim Cournoyer Date: Sun, 6 Feb 2022 23:26:24 -0500 Subject: gnu: webkitgtk: Adjust BubbleWrap wrapper. This revisits with a fix that doesn't require to have PULSE_CLIENTCONFIG point to an absolute store location, which will allow us to revert to have PULSE_CLIENTCONFIG point to a fixed location under /etc. This would alleviate the need to reboot to have changes to the PulseAudio configuration effected. * gnu/packages/patches/webkitgtk-share-store.patch: Delete file. * gnu/packages/patches/webkitgtk-bubblewrap-paths.patch: Add file. * gnu/packages/patches/webkitgtk-canonicalize-paths.patch: Likewise. * gnu/local.mk (dist_patch_DATA): Update patches list. * gnu/packages/webkit.scm (webkitgtk)[patches]: Adjust accordingly. --- .../webkitgtk-adjust-bubblewrap-paths.patch | 38 ++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 gnu/packages/patches/webkitgtk-adjust-bubblewrap-paths.patch (limited to 'gnu/packages/patches/webkitgtk-adjust-bubblewrap-paths.patch') diff --git a/gnu/packages/patches/webkitgtk-adjust-bubblewrap-paths.patch b/gnu/packages/patches/webkitgtk-adjust-bubblewrap-paths.patch new file mode 100644 index 0000000000..18ddb645ad --- /dev/null +++ b/gnu/packages/patches/webkitgtk-adjust-bubblewrap-paths.patch @@ -0,0 +1,38 @@ +Share /gnu/store in the BubbleWrap container and remove FHS mounts. + +This is a Guix-specific patch not meant to be upstreamed. +diff --git a/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp b/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp +index f0a5e4b05dff..88b11f806968 100644 +--- a/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp ++++ b/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp +@@ -854,27 +854,12 @@ GRefPtr bubblewrapSpawn(GSubprocessLauncher* launcher, const Proces + "--ro-bind", "/sys/dev", "/sys/dev", + "--ro-bind", "/sys/devices", "/sys/devices", + +- "--ro-bind-try", "/usr/share", "/usr/share", +- "--ro-bind-try", "/usr/local/share", "/usr/local/share", + "--ro-bind-try", DATADIR, DATADIR, +- +- // We only grant access to the libdirs webkit is built with and +- // guess system libdirs. This will always have some edge cases. +- "--ro-bind-try", "/lib", "/lib", +- "--ro-bind-try", "/usr/lib", "/usr/lib", +- "--ro-bind-try", "/usr/local/lib", "/usr/local/lib", + "--ro-bind-try", LIBDIR, LIBDIR, +-#if CPU(ADDRESS64) +- "--ro-bind-try", "/lib64", "/lib64", +- "--ro-bind-try", "/usr/lib64", "/usr/lib64", +- "--ro-bind-try", "/usr/local/lib64", "/usr/local/lib64", +-#else +- "--ro-bind-try", "/lib32", "/lib32", +- "--ro-bind-try", "/usr/lib32", "/usr/lib32", +- "--ro-bind-try", "/usr/local/lib32", "/usr/local/lib32", +-#endif +- + "--ro-bind-try", PKGLIBEXECDIR, PKGLIBEXECDIR, ++ ++ // Bind mount the store inside the WebKitGTK sandbox. ++ "--ro-bind", "@storedir@", "@storedir@", + }; + + if (launchOptions.processType == ProcessLauncher::ProcessType::DBusProxy) { -- cgit v1.2.3