From aabfdbde8e30e2d0413f5368c34c7f32ee1c3b1a Mon Sep 17 00:00:00 2001
From: Alexander Larsson <alexl@redhat.com>
Date: Mon, 15 Apr 2024 16:10:36 +0200
Subject: [PATCH 1/2] When starting non-static command using bwrap use "--"

This ensures that the command is not taken to be a bwrap option.

Resolves: CVE-2024-32462
Resolves: GHSA-phv6-cpc2-2fgj
Signed-off-by: Alexander Larsson <alexl@redhat.com>
[smcv: Fix DISABLE_SANDBOXED_TRIGGERS code path]
[smcv: Make flatpak_run_maybe_start_dbus_proxy() more obviously correct]
Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 app/flatpak-builtins-build.c | 3 ++-
 common/flatpak-dir.c         | 1 +
 common/flatpak-run.c         | 5 ++++-
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/app/flatpak-builtins-build.c b/app/flatpak-builtins-build.c
index ce9ff7ea..039c4668 100644
--- a/app/flatpak-builtins-build.c
+++ b/app/flatpak-builtins-build.c
@@ -569,7 +569,8 @@ flatpak_builtin_build (int argc, char **argv, GCancellable *cancellable, GError
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
-  flatpak_bwrap_add_args (bwrap, command, NULL);
+  flatpak_bwrap_add_args (bwrap, "--", command, NULL);
+
   flatpak_bwrap_append_argsv (bwrap,
                               &argv[rest_argv_start + 2],
                               rest_argc - 2);
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
index 1c1a48eb..57292aa6 100644
--- a/common/flatpak-dir.c
+++ b/common/flatpak-dir.c
@@ -5393,6 +5393,7 @@ flatpak_dir_run_triggers (FlatpakDir   *self,
           g_ptr_array_add (argv_array, g_strdup ("--bind"));
           g_ptr_array_add (argv_array, g_strdup (basedir));
           g_ptr_array_add (argv_array, g_strdup (basedir));
+          g_ptr_array_add (argv_array, g_strdup ("--"));
 #endif
           g_ptr_array_add (argv_array, g_file_get_path (child));
           g_ptr_array_add (argv_array, g_strdup (basedir));
diff --git a/common/flatpak-run.c b/common/flatpak-run.c
index 08bfe54a..4c7f94f3 100644
--- a/common/flatpak-run.c
+++ b/common/flatpak-run.c
@@ -752,6 +752,9 @@ add_bwrap_wrapper (FlatpakBwrap *bwrap,
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
+  /* End of options: the next argument will be the executable name */
+  flatpak_bwrap_add_arg (bwrap, "--");
+
   return TRUE;
 }
 
@@ -3142,7 +3145,7 @@ flatpak_run_app (const char     *app_ref,
   if (!flatpak_bwrap_bundle_args (bwrap, 1, -1, FALSE, error))
     return FALSE;
 
-  flatpak_bwrap_add_arg (bwrap, command);
+  flatpak_bwrap_add_args (bwrap, "--", command, NULL);
 
   if (!add_rest_args (bwrap, app_ref_parts[1],
                       exports, (flags & FLATPAK_RUN_FLAG_FILE_FORWARDING) != 0,
-- 
2.44.0


From b758670addf94e4255deff8e77ba82d7328933a6 Mon Sep 17 00:00:00 2001
From: Simon McVittie <smcv@collabora.com>
Date: Tue, 16 Apr 2024 10:50:00 +0100
Subject: [PATCH 2/2] test-run: Add a reproducer for CVE-2024-32462

Signed-off-by: Simon McVittie <smcv@collabora.com>
---
 tests/test-run.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tests/test-run.sh b/tests/test-run.sh
index 9d83d82e..ab2c0089 100755
--- a/tests/test-run.sh
+++ b/tests/test-run.sh
@@ -23,7 +23,7 @@ set -euo pipefail
 
 skip_without_bwrap
 
-echo "1..12"
+echo "1..13"
 
 setup_repo
 install_repo
@@ -69,6 +69,15 @@ assert_file_has_content hello_out '^Hello world, from a sandbox$'
 
 echo "ok hello"
 
+# This should try and fail to run e.g. /usr/bin/--tmpfs, which will
+# exit with status 127 because there is no such executable.
+# It should not pass "--tmpfs /blah hello.sh" as bwrap options.
+exit_status=0
+run --command=--tmpfs org.test.Hello /blah hello.sh >&2 || exit_status=$?
+assert_not_streq "$exit_status" 0
+
+echo "ok avoided CVE-2024-32462"
+
 run_sh cat /run/user/`id -u`/flatpak-info > fpi
 assert_file_has_content fpi '^name=org.test.Hello$'
 
-- 
2.44.0