utils: Recognize applications in Toolbox containers from the host
utils: Recognize applications in Toolbox containers from the host

Toolbox [1] containers are development environments whose primary goal
isn't secure containment of processes, but to offer a safe haven for
development without touching the host operating system. This is
particularly useful on OSTree based systems like Fedora Silverblue,
where it's significantly difficult to set up a development prefix
directly on the host OS. These containers are rootless OCI containers,
not Flatpak containers, and are designed to blur the divide between the
host and the container as much as possible - full access to $HOME, the
D-Bus sockets, the Wayland and X11 sockets, host network access, no
PID namespace, etc..

Therefore, conceptually, running an application inside a Toolbox
container is the same thing as running it on the host.

Identifying the runtime environment for applications starts with
opening /proc/<app-pid>/root. For an application running inside a
toolbox and a portal on the host, the PID is visible to the portal, but
it fails to open it because /proc/<app-pid>/root points to the
container's root directory, not the host's. The openat(2) call fails
with EACCES.

So far, any failure to open /proc/<app-pid>/root was treated as an
indication that the application has died. This specific error
condition is now special-cased to denote privileged applications.

[1] https://github.com/debarshiray/toolbox

matthiasclasen/xdg-desktop-portal,flatpak/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal,flatpak/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal,flatpak/xdg-desktop-portal,flatpak/xdg-desktop-portal,matthiasclasen/xdg-desktop-portal