Preload library answers stat/open/access/readlink in-process via a
trampoline page proot 0014 lets through seccomp. On by default with a
Performance toggle; also sets GLIBC_TUNABLES rseq=0 and malloc top_pad.
* feat: run Flatpak apps through a proot bwrap stand-in and add a Flathub store
* feat: give Flatpak apps the KGSL GPU, the controllers and a CPU LLVM can target
* feat: Flatpak games on the desktop, Store apps on the Desktop page, safer remove
* test: cover the sandbox planner and store helpers; docs: explain Flatpak on DroidDeck
* fix: keep controller focus through Store tabs and app pages; show progress per Flatpak step
* fix: let Chromium, Electron and Firefox Flatpaks start without their own sandboxes
* fix: fetch Flatpak's supporting libraries when the runtime lacks them
* fix: add Flathub without a download, log store commands, keep Electron apps on X11 under gamescope
* feat: import ARM64 AppImages from storage and run them from the Desktop page
* fix: report failed Flatpak installs as failures and deploy runtimes that ship a resolv.conf link
* fix: let Flatpak create its repo where Android denies hard links
* fix: point store commands at the current network's DNS
* fix: keep failed Flatpak extensions non-fatal, give Electron AppImages a bus, X11 and time to relaunch
* docs: AppImage import and what x86 apps would take
* feat: put the Flathub Store and AppImage import behind beta toggles in Setup
---------
Co-authored-by: MaxsTechReview <maxjividen@gmail.com>
fake_id0 (loaded by -i for Xwayland's set*id) now traces only the set*id
family and the xattr fixups when the ids given are proot's own, and the
seccomp filter traces ioctl only for the termios and FICLONE requests
proot rewrites. The faccessat2 and statx exit stops are dropped on
kernels that have the calls.
Brings the proot patch set up to WinNative 53836ca9 on top of the #772 port:
- trace prctl, setrlimit and prlimit64 in the seccomp filter only for the
arguments proot acts on, and uname only where the core rewrites it
- answer a seccomp stop's filter flags from the registers fetched for its
translation, reuse those registers, and skip the sysexit stop of wait4 left
to the kernel and accept without a sockaddr; the flags come from proot's list
merged with the enabled extensions, and a syscall an extension replaced
keeps its exit stop
- take a clone3 child's flags and exit signal from struct clone_args
- name a thread's /proc/self by its thread group and resolve /proc/thread-self
- translate fchmodat2, send openat2 callers to openat, and bound sysnum lookups
by the table length
- sweep relatives only for tracees that have children or ptracees, and empty
the per-stop memory collector instead of reallocating it
The runtime carries Termux's proot 5.1.107-70 as a prebuilt binary, built from
termux/proot 4dba3afb (every file:line site in it matches that commit). The apk
now builds that same commit with the NDK, with three patches ported from
WinNative's feature/proot-enhancements, and prefers it over the runtime's copy:
- Tracees are hashed by pid, so each ptrace stop finds its tracee without
walking a list of every thread, and terminated tracees are swept only after
a termination.
- A clean absolute path three or more directories deep under the rootfs alone
has its parent opened once and taken as canonical when the kernel's path for
it is the one proot would build, instead of an lstat per component; the final
component of a call that does not follow it is no longer lstat'ed. Extensions
still see the parent's host path, and the f2fs workaround keeps the old walk.
- A clone3 thread keeps its inherited flags when clone_args cannot be read.
talloc is linked in statically from Samba's release tarball, so libproot.so
needs only libc and libdl. On an x86_64 Android 15 emulator the same build ran
a path and thread test suite with output identical to the unpatched commit
(fake id, fake root, link2symlink, with and without seccomp), and a stat-heavy
benchmark ran 25-27% faster, 31-36% with 1500 live threads.
maxjivi05