| 1 | Share /gnu/store in the BubbleWrap container and remove FHS mounts.
|
| 2 | Also share system locale directory and paths in LOCPATH, GUIX_LOCPATH,
|
| 3 | and LIBVA_DRIVERS_PATH.
|
| 4 |
|
| 5 | This is a Guix-specific patch not meant to be upstreamed.
|
| 6 | diff --git a/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp b/Source/WebKit/UIProcess/Launcher/glib/BubblewrapLauncher.cpp
|
| 7 | index f0a5e4b05dff..88b11f806968 100644
|
| 8 | |
| 9 | |
| 10 | @@ -854,27 +854,21 @@ GRefPtr<GSubprocess> bubblewrapSpawn(GSubprocessLauncher* launcher, const Proces
|
| 11 | "--ro-bind", "/sys/dev", "/sys/dev",
|
| 12 | "--ro-bind", "/sys/devices", "/sys/devices",
|
| 13 |
|
| 14 | - "--ro-bind-try", "/usr/share", "/usr/share",
|
| 15 | - "--ro-bind-try", "/usr/local/share", "/usr/local/share",
|
| 16 | "--ro-bind-try", DATADIR, DATADIR,
|
| 17 | -
|
| 18 | - // We only grant access to the libdirs webkit is built with and
|
| 19 | - // guess system libdirs. This will always have some edge cases.
|
| 20 | - "--ro-bind-try", "/lib", "/lib",
|
| 21 | - "--ro-bind-try", "/usr/lib", "/usr/lib",
|
| 22 | - "--ro-bind-try", "/usr/local/lib", "/usr/local/lib",
|
| 23 | "--ro-bind-try", LIBDIR, LIBDIR,
|
| 24 | -#if CPU(ADDRESS64)
|
| 25 | - "--ro-bind-try", "/lib64", "/lib64",
|
| 26 | - "--ro-bind-try", "/usr/lib64", "/usr/lib64",
|
| 27 | - "--ro-bind-try", "/usr/local/lib64", "/usr/local/lib64",
|
| 28 | -#else
|
| 29 | - "--ro-bind-try", "/lib32", "/lib32",
|
| 30 | - "--ro-bind-try", "/usr/lib32", "/usr/lib32",
|
| 31 | - "--ro-bind-try", "/usr/local/lib32", "/usr/local/lib32",
|
| 32 | -#endif
|
| 33 | -
|
| 34 | "--ro-bind-try", PKGLIBEXECDIR, PKGLIBEXECDIR,
|
| 35 | +
|
| 36 | + // Bind mount the store inside the WebKitGTK sandbox.
|
| 37 | + "--ro-bind", "@storedir@", "@storedir@",
|
| 38 | +
|
| 39 | + // This is needed for system locales.
|
| 40 | + "--ro-bind-try", "@localedir@", "@localedir@",
|
| 41 | };
|
| 42 | + // User specified locale directory.
|
| 43 | + bindPathVar(sandboxArgs, "LOCPATH");
|
| 44 | + // Locales in case of foreign system.
|
| 45 | + bindPathVar(sandboxArgs, "GUIX_LOCPATH");
|
| 46 | + // Drivers for video hardware acceleration (va-api).
|
| 47 | + bindPathVar(sandboxArgs, "LIBVA_DRIVERS_PATH");
|
| 48 |
|
| 49 | if (launchOptions.processType == ProcessLauncher::ProcessType::DBusProxy) {
|