Codebase list firejail / 220685a
Merge tag 'upstream/0.9.44.2' Upstream version 0.9.44.2 # gpg: Signature made Sun 04 Dec 2016 09:27:48 PM CET # gpg: using RSA key D8F6FA7DEA24D90D6EAC733BCCF04928DB0EEAA7 # gpg: issuer "reiner@reiner-h.de" # gpg: Good signature from "Reiner Herrmann <reiner@reiner-h.de>" [ultimate] # Primary key fingerprint: 2F5D AF3F C1F7 93D9 4F3D 900C A721 DA05 5374 AA4F # Subkey fingerprint: D8F6 FA7D EA24 D90D 6EAC 733B CCF0 4928 DB0E EAA7 Reiner Herrmann 7 years ago
23 changed file(s) with 251 addition(s) and 201 deletion(s). Raw diff Collapse all Expand all
+18
-0
RELNOTES less more
0 firejail (0.9.44.2) baseline; urgency=low
1 * security: overwrite /etc/resolv.conf found by Martin Carpenter
2 * secuirty: TOCTOU exploit for --get and --put found by Daniel Hodson
3 * security: invalid environment exploit found by Martin Carpenter
4 * security: several security enhancements
5 * bugfix: crashing VLC by pressing Ctrl-O
6 * bugfix: use user configured icons in KDE
7 * bugfix: mkdir and mkfile are not applied to private directories
8 * bugfix: cannot open files on Deluge running under KDE
9 * bugfix: --private=dir where dir is the user home directory
10 * bugfix: cannot start Vivaldi browser
11 * bugfix: cannot start mupdf
12 * bugfix: ssh profile problems
13 * bugfix: --quiet
14 * bugfix: quiet in git profile
15 * bugfix: memory corruption
16 -- netblue30 <netblue30@yahoo.com> Fri, 2 Dec 2016 08:00:00 -0500
17
018 firejail (0.9.44) baseline; urgency=low
119 * CVE-2016-7545 submitted by Aleksey Manevich
220 * modifs: removed man firejail-config
+9
-9
configure less more
00 #! /bin/sh
11 # Guess values for system-dependent variables and create Makefiles.
2 # Generated by GNU Autoconf 2.69 for firejail 0.9.44.
2 # Generated by GNU Autoconf 2.69 for firejail 0.9.44.2.
33 #
44 # Report bugs to <netblue30@yahoo.com>.
55 #
579579 # Identity of this package.
580580 PACKAGE_NAME='firejail'
581581 PACKAGE_TARNAME='firejail'
582 PACKAGE_VERSION='0.9.44'
583 PACKAGE_STRING='firejail 0.9.44'
582 PACKAGE_VERSION='0.9.44.2'
583 PACKAGE_STRING='firejail 0.9.44.2'
584584 PACKAGE_BUGREPORT='netblue30@yahoo.com'
585585 PACKAGE_URL='http://firejail.wordpress.com'
586586
12581258 # Omit some internal or obsolete options to make the list less imposing.
12591259 # This message is too long to be a string in the A/UX 3.1 sh.
12601260 cat <<_ACEOF
1261 \`configure' configures firejail 0.9.44 to adapt to many kinds of systems.
1261 \`configure' configures firejail 0.9.44.2 to adapt to many kinds of systems.
12621262
12631263 Usage: $0 [OPTION]... [VAR=VALUE]...
12641264
13191319
13201320 if test -n "$ac_init_help"; then
13211321 case $ac_init_help in
1322 short | recursive ) echo "Configuration of firejail 0.9.44:";;
1322 short | recursive ) echo "Configuration of firejail 0.9.44.2:";;
13231323 esac
13241324 cat <<\_ACEOF
13251325
14231423 test -n "$ac_init_help" && exit $ac_status
14241424 if $ac_init_version; then
14251425 cat <<\_ACEOF
1426 firejail configure 0.9.44
1426 firejail configure 0.9.44.2
14271427 generated by GNU Autoconf 2.69
14281428
14291429 Copyright (C) 2012 Free Software Foundation, Inc.
17251725 This file contains any messages produced by compilers while
17261726 running configure, to aid debugging if configure makes a mistake.
17271727
1728 It was created by firejail $as_me 0.9.44, which was
1728 It was created by firejail $as_me 0.9.44.2, which was
17291729 generated by GNU Autoconf 2.69. Invocation command line was
17301730
17311731 $ $0 $@
43024302 # report actual input values of CONFIG_FILES etc. instead of their
43034303 # values after options handling.
43044304 ac_log="
4305 This file was extended by firejail $as_me 0.9.44, which was
4305 This file was extended by firejail $as_me 0.9.44.2, which was
43064306 generated by GNU Autoconf 2.69. Invocation command line was
43074307
43084308 CONFIG_FILES = $CONFIG_FILES
43564356 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
43574357 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
43584358 ac_cs_version="\\
4359 firejail config.status 0.9.44
4359 firejail config.status 0.9.44.2
43604360 configured by $0, generated by GNU Autoconf 2.69,
43614361 with options \\"\$ac_cs_config\\"
43624362
+1
-1
configure.ac less more
00 AC_PREREQ([2.68])
1 AC_INIT(firejail, 0.9.44, netblue30@yahoo.com, , http://firejail.wordpress.com)
1 AC_INIT(firejail, 0.9.44.2, netblue30@yahoo.com, , http://firejail.wordpress.com)
22 AC_CONFIG_SRCDIR([src/firejail/main.c])
33 #AC_CONFIG_HEADERS([config.h])
44
+2
-3
etc/deluge.profile less more
1313 seccomp
1414
1515 shell none
16 private-bin deluge,sh,python,uname
17 whitelist /tmp/.X11-unix
16 #private-bin deluge,sh,python,uname
1817 private-dev
19 nosound
18 private-tmp
2019
+1
-2
etc/git.profile less more
00 # git profile
1
1 quiet
22 noblacklist ~/.gitconfig
33 noblacklist ~/.ssh
44 noblacklist ~/.gnupg
1111 include /etc/firejail/disable-programs.inc
1212 include /etc/firejail/disable-passwdmgr.inc
1313
14 quiet
1514
1615 caps.drop all
1716 netfilter
+6
-1
etc/mupdf.profile less more
1414 shell none
1515 tracelog
1616
17 private-bin mupdf
1817 private-tmp
1918 private-dev
19 private-etc fonts
2020
2121 # mupdf will never write anything
2222 read-only ${HOME}
2323
24 #
25 # Experimental:
26 #
27 #seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,mremap,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
28 # private-bin mupdf,sh,tempfile,rm
+1
-0
etc/ssh.profile less more
11 quiet
22 noblacklist ~/.ssh
33 noblacklist /tmp/ssh-*
4 noblacklist /etc/ssh
45
56 include /etc/firejail/disable-common.inc
67 include /etc/firejail/disable-programs.inc
+0
-1
etc/vivaldi.profile less more
55 include /etc/firejail/disable-devel.inc
66
77 netfilter
8 nonewprivs
98
109 whitelist ${DOWNLOADS}
1110 mkdir ~/.config/vivaldi
+1
-1
etc/vlc.profile less more
1010 nogroups
1111 nonewprivs
1212 noroot
13 protocol unix,inet,inet6
13 protocol unix,inet,inet6,netlink
1414 seccomp
1515 shell none
1616
+4
-1
etc/whitelist-common.inc less more
2929 mkdir ~/.config/dconf
3030 whitelist ~/.config/dconf
3131
32 # qt
32 # qt/kde
3333 whitelist ~/.config/kdeglobals
34 whitelist ~/.kde/share/config/oxygenrc
35 whitelist ~/.kde/share/config/kdeglobals
36 whitelist ~/.kde/share/icons
+4
-1
platform/rpm/old-mkrpm.sh less more
00 #!/bin/bash
1 VERSION="0.9.44"
1 VERSION="0.9.44.2"
22 rm -fr ~/rpmbuild
33 rm -f firejail-$VERSION-1.x86_64.rpm
44
457457 chmod u+s /usr/bin/firejail
458458
459459 %changelog
460 * Sat Dec 3 2016 netblue30 <netblue30@yahoo.com> 0.9.44.2-1
461 - bugfix release
462
460463 * Fri Oct 21 2016 netblue30 <netblue30@yahoo.com> 0.9.44-1
461464 - CVE-2016-7545 submitted by Aleksey Manevich
462465 - modifs: removed man firejail-config
+1
-0
src/firejail/bandwidth.c less more
461461 arg[1] = "-c";
462462 arg[2] = cmd;
463463 arg[3] = NULL;
464 clearenv();
464465 execvp(arg[0], arg);
465466
466467 // it will never get here
+14
-0
src/firejail/fs.c less more
496496 ptr = entry->data + 6;
497497 op = MOUNT_TMPFS;
498498 }
499 else if (strncmp(entry->data, "mkdir ", 6) == 0) {
500 EUID_USER();
501 fs_mkdir(entry->data + 6);
502 EUID_ROOT();
503 entry = entry->next;
504 continue;
505 }
506 else if (strncmp(entry->data, "mkfile ", 7) == 0) {
507 EUID_USER();
508 fs_mkfile(entry->data + 7);
509 EUID_ROOT();
510 entry = entry->next;
511 continue;
512 }
499513 else {
500514 fprintf(stderr, "Error: invalid profile line %s\n", entry->data);
501515 entry = entry->next;
+1
-0
src/firejail/fs_bin.c less more
190190 char *f;
191191 if (asprintf(&f, "%s/%s", RUN_BIN_DIR, fname) == -1)
192192 errExit("asprintf");
193 clearenv();
193194 execlp(RUN_CP_COMMAND, RUN_CP_COMMAND, "-a", actual_path, f, NULL);
194195 perror("execlp");
195196 _exit(1);
+1
-0
src/firejail/fs_etc.c less more
104104 char *f;
105105 if (asprintf(&f, "/etc/%s", fname) == -1)
106106 errExit("asprintf");
107 clearenv();
107108 execlp(RUN_CP_COMMAND, RUN_CP_COMMAND, "-a", "--parents", f, RUN_MNT_DIR, NULL);
108109 perror("execlp");
109110 _exit(1);
+87
-132
src/firejail/ls.c less more
323323
324324 // get file from sandbox and store it in the current directory
325325 else if (op == SANDBOX_FS_GET) {
326 // check source file (sandbox)
327 char *src_fname;
328 if (asprintf(&src_fname, "%s%s", rootdir, fname1) == -1)
329 errExit("asprintf");
326 char *src_fname =fname1;
327 char *dest_fname = strrchr(fname1, '/');
328 if (!dest_fname || *(++dest_fname) == '\0') {
329 fprintf(stderr, "Error: invalid file name %s\n", fname1);
330 exit(1);
331 }
332
330333 EUID_ROOT();
331 struct stat s;
332 if (stat(src_fname, &s) == -1) {
333 fprintf(stderr, "Error: Cannot access %s\n", fname1);
334 exit(1);
335 }
336 if (is_dir(src_fname)) {
337 fprintf(stderr, "Error: source file name is a directory\n");
338 exit(1);
339 }
340
341 // try to open the source file - we need to chroot
334 if (arg_debug)
335 printf("copy %s to %s\n", src_fname, dest_fname);
336
337 // create a user-owned temporary file in /run/firejail directory
338 char tmp_fname[] = "/run/firejail/tmpget-XXXXXX";
339 int fd = mkstemp(tmp_fname);
340 SET_PERMS_FD(fd, getuid(), getgid(), 0600);
341 close(fd);
342
343 // copy the source file into the temporary file - we need to chroot
342344 pid_t child = fork();
343345 if (child < 0)
344346 errExit("fork");
352354 // drop privileges
353355 drop_privs(0);
354356
355 // try to read the file
356 if (access(fname1, R_OK) == -1) {
357 fprintf(stderr, "Error: Cannot read %s\n", fname1);
358 exit(1);
359 }
357 // copy the file
358 if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600))
359 _exit(1);
360360 _exit(0);
361361 }
362362
364364 int status = 0;
365365 waitpid(child, &status, 0);
366366 if (WIFEXITED(status) && WEXITSTATUS(status) == 0);
367 else
368 exit(1);
367 else {
368 unlink(tmp_fname);
369 exit(1);
370 }
371
372 // copy the temporary file into the destionation file
373 child = fork();
374 if (child < 0)
375 errExit("fork");
376 if (child == 0) {
377 // drop privileges
378 drop_privs(0);
379
380 // copy the file
381 if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600))
382 _exit(1);
383 _exit(0);
384 }
385
386 // wait for the child to finish
387 status = 0;
388 waitpid(child, &status, 0);
389 if (WIFEXITED(status) && WEXITSTATUS(status) == 0);
390 else {
391 unlink(tmp_fname);
392 exit(1);
393 }
394
395 // remove the temporary file
396 unlink(tmp_fname);
369397 EUID_USER();
370
371 // check destination file (host)
372 char *dest_fname = strrchr(fname1, '/');
373 if (!dest_fname || *(++dest_fname) == '\0') {
374 fprintf(stderr, "Error: invalid file name %s\n", fname1);
375 exit(1);
376 }
377
378 if (access(dest_fname, F_OK) == -1) {
379 // try to create the file as a regular user
380 pid_t child = fork();
381 if (child < 0)
382 errExit("fork");
383 if (child == 0) {
384 // drop privileges
385 drop_privs(0);
386
387 FILE *fp = fopen(dest_fname, "w");
388 if (!fp) {
389 fprintf(stderr, "Error: cannot create %s\n", dest_fname);
390 exit(1);
391 }
392 fclose(fp);
393 _exit(0);
394 }
395
396 // wait for the child to finish
397 int status = 0;
398 waitpid(child, &status, 0);
399 if (WIFEXITED(status) && WEXITSTATUS(status) == 0);
400 else
401 exit(1);
402 }
403 else {
404 if (access(dest_fname, W_OK) == -1) {
405 fprintf(stderr, "Error: cannot write %s\n", dest_fname);
406 exit(1);
407 }
408 }
409
410 // copy file
398 }
399
400 // get file from host and store it in the sandbox
401 else if (op == SANDBOX_FS_PUT && path2) {
402 char *src_fname =fname1;
403 char *dest_fname = fname2;
404
405 EUID_ROOT();
411406 if (arg_debug)
412407 printf("copy %s to %s\n", src_fname, dest_fname);
413 EUID_ROOT();
414 if (copy_file(src_fname, dest_fname, getuid(), getgid(), 0644))
415 fprintf(stderr, "Error: transfer failed\n");
416 else
417 printf("Transfer complete\n");
418 EUID_USER();
419 }
420 // get file from host and store it in the sandbox
421 else if (op == SANDBOX_FS_PUT && path2) {
422 // verify the source file
423 const char *src_fname = path1;
424 struct stat s;
425 if (stat(src_fname, &s) == -1) {
426 fprintf(stderr, "Error: Cannot access %s\n", fname1);
427 exit(1);
428 }
429 if (is_dir(src_fname)) {
430 fprintf(stderr, "Error: source file name is a directory\n");
431 exit(1);
432 }
433
434 // try to open the source file
408
409 // create a user-owned temporary file in /run/firejail directory
410 char tmp_fname[] = "/run/firejail/tmpget-XXXXXX";
411 int fd = mkstemp(tmp_fname);
412 SET_PERMS_FD(fd, getuid(), getgid(), 0600);
413 close(fd);
414
415 // copy the source file into the temporary file - we need to chroot
435416 pid_t child = fork();
436417 if (child < 0)
437418 errExit("fork");
439420 // drop privileges
440421 drop_privs(0);
441422
442 // try to read the file
443 if (access(src_fname, R_OK) == -1) {
444 fprintf(stderr, "Error: Cannot read %s\n", src_fname);
445 exit(1);
446 }
423 // copy the file
424 if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600))
425 _exit(1);
447426 _exit(0);
448427 }
449428
451430 int status = 0;
452431 waitpid(child, &status, 0);
453432 if (WIFEXITED(status) && WEXITSTATUS(status) == 0);
454 else
455 exit(1);
456
457 // check destination file (sandbox)
458 char *dest_fname;
459 if (asprintf(&dest_fname, "%s%s", rootdir, fname2) == -1)
460 errExit("asprintf");
461 EUID_ROOT();
462 if (is_dir(dest_fname)) {
463 fprintf(stderr, "Error: destination file name is a directory inside the sandbox\n");
464 exit(1);
465 }
466
467 // check write access on destination
433 else {
434 unlink(tmp_fname);
435 exit(1);
436 }
437
438 // copy the temporary file into the destionation file
468439 child = fork();
469440 if (child < 0)
470441 errExit("fork");
474445 errExit("chroot");
475446 if (chdir("/") < 0)
476447 errExit("chdir");
477
448
478449 // drop privileges
479450 drop_privs(0);
480
481 if (access(path2, F_OK) == -1) {
482 FILE *fp = fopen(path2, "w");
483 if (!fp) {
484 fprintf(stderr, "Error: cannot create %s\n", path2);
485 exit(1);
486 }
487 fclose(fp);
488 }
489 else {
490 if (access(path2, W_OK) == -1) {
491 fprintf(stderr, "Error: cannot write %s\n", path2);
492 exit(1);
493 }
494 }
495
451
452 // copy the file
453 if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600))
454 _exit(1);
496455 _exit(0);
497456 }
498457
500459 status = 0;
501460 waitpid(child, &status, 0);
502461 if (WIFEXITED(status) && WEXITSTATUS(status) == 0);
503 else
504 exit(1);
505
506 // copy file
507 if (arg_debug)
508 printf("copy %s to %s\n", src_fname, dest_fname);
509 EUID_ROOT();
510 if (copy_file(src_fname, dest_fname, getuid(), getgid(), 0644))
511 fprintf(stderr, "Error: transfer failed\n");
512 else
513 printf("Transfer complete\n");
462 else {
463 unlink(tmp_fname);
464 exit(1);
465 }
466
467 // remove the temporary file
468 unlink(tmp_fname);
514469 EUID_USER();
515470 }
516471
+14
-0
src/firejail/main.c less more
16041604 return 1;
16051605 }
16061606
1607 // don't allow "--chroot=/"
1608 char *rpath = realpath(cfg.chrootdir, NULL);
1609 if (rpath == NULL || strcmp(rpath, "/") == 0) {
1610 fprintf(stderr, "Error: invalid chroot directory\n");
1611 exit(1);
1612 }
1613 free(rpath);
1614
16071615 // check chroot directory structure
16081616 if (fs_check_chroot_dir(cfg.chrootdir)) {
16091617 fprintf(stderr, "Error: invalid chroot\n");
16421650 exit(1);
16431651 }
16441652 fs_check_private_dir();
1653
1654 // downgrade to --private if the directory is the user home directory
1655 if (strcmp(cfg.home_private, cfg.homedir) == 0) {
1656 free(cfg.home_private);
1657 cfg.home_private = NULL;
1658 }
16451659 arg_private = 1;
16461660 }
16471661 #ifdef HAVE_PRIVATE_HOME
+3
-0
src/firejail/netfilter.c less more
143143
144144 // wipe out environment variables
145145 environ = NULL;
146 clearenv();
146147 execl(iptables_restore, iptables_restore, NULL);
147148 perror("execl");
148149 _exit(1);
256257
257258 // wipe out environment variables
258259 environ = NULL;
260 clearenv();
259261 execl(ip6tables_restore, ip6tables_restore, NULL);
260262 perror("execl");
261263 _exit(1);
270272 errExit("fork");
271273 if (child == 0) {
272274 environ = NULL;
275 clearenv();
273276 execl(ip6tables, ip6tables, "-vL", NULL);
274277 perror("execl");
275278 _exit(1);
+22
-22
src/firejail/profile.c less more
104104 // mkdir
105105 if (strncmp(ptr, "mkdir ", 6) == 0) {
106106 fs_mkdir(ptr + 6);
107 return 0;
107 return 1;
108108 }
109109 // mkfile
110110 if (strncmp(ptr, "mkfile ", 7) == 0) {
111111 fs_mkfile(ptr + 7);
112 return 0;
112 return 1;
113113 }
114114 // sandbox name
115115 else if (strncmp(ptr, "name ", 5) == 0) {
129129 #if HAVE_USERNS
130130 if (checkcfg(CFG_USERNS))
131131 check_user_namespace();
132 else
132 else if (!arg_quiet)
133133 fprintf(stderr, "Warning: user namespace feature is disabled in Firejail configuration file\n");
134134 #endif
135135
143143 #ifdef HAVE_SECCOMP
144144 if (checkcfg(CFG_SECCOMP))
145145 arg_seccomp = 1;
146 else
146 else if (!arg_quiet)
147147 fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
148148 #endif
149149 return 0;
175175 fs_check_home_list();
176176 arg_private = 1;
177177 }
178 else
178 else if (!arg_quiet)
179179 fprintf(stderr, "Warning: private-home is disabled in Firejail configuration file\n");
180180 #endif
181181 return 0;
208208 #ifdef HAVE_NETWORK
209209 if (checkcfg(CFG_NETWORK))
210210 arg_netfilter = 1;
211 else
211 else if (!arg_quiet)
212212 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
213213 #endif
214214 return 0;
222222 errExit("strdup");
223223 check_netfilter_file(arg_netfilter_file);
224224 }
225 else
225 else if (!arg_quiet)
226226 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
227227 #endif
228228 return 0;
236236 errExit("strdup");
237237 check_netfilter_file(arg_netfilter6_file);
238238 }
239 else
239 else if (!arg_quiet)
240240 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
241241 #endif
242242 return 0;
254254 cfg.interface2.configured = 0;
255255 cfg.interface3.configured = 0;
256256 }
257 else
257 else if (!arg_quiet)
258258 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
259259 #endif
260260 return 0;
295295 }
296296 net_configure_bridge(br, ptr + 4);
297297 }
298 else
298 else if (!arg_quiet)
299299 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
300300 #endif
301301 return 0;
318318 exit(1);
319319 }
320320 }
321 else
321 else if (!arg_quiet)
322322 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
323323 #endif
324324 return 0;
363363 exit(1);
364364 }
365365 }
366 else
366 else if (!arg_quiet)
367367 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
368368 #endif
369369 return 0;
390390 exit(1);
391391 }
392392 }
393 else
393 else if (!arg_quiet)
394394 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
395395 #endif
396396 return 0;
410410 exit(1);
411411 }
412412 }
413 else
413 else if (!arg_quiet)
414414 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
415415 #endif
416416 return 0;
439439 }
440440 }
441441 }
442 else
442 else if (!arg_quiet)
443443 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
444444 #endif
445445 return 0;
467467 // }
468468
469469 }
470 else
470 else if (!arg_quiet)
471471 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
472472 #endif
473473 return 0;
481481 exit(1);
482482 }
483483 }
484 else
484 else if (!arg_quiet)
485485 fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
486486 #endif
487487 return 0;
498498 #ifdef HAVE_SECCOMP
499499 if (checkcfg(CFG_SECCOMP))
500500 protocol_store(ptr + 9);
501 else
501 else if (!arg_quiet)
502502 fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
503503 #endif
504504 return 0;
522522 if (!cfg.seccomp_list)
523523 errExit("strdup");
524524 }
525 else
525 else if (!arg_quiet)
526526 fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
527527 #endif
528528
538538 if (!cfg.seccomp_list_drop)
539539 errExit("strdup");
540540 }
541 else
541 else if (!arg_quiet)
542542 fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
543543 #endif
544544 return 0;
553553 if (!cfg.seccomp_list_keep)
554554 errExit("strdup");
555555 }
556 else
556 else if (!arg_quiet)
557557 fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
558558 #endif
559559 return 0;
779779 *(dname2 - 1) = ',';
780780 return 1;
781781 }
782 else {
782 else if (!arg_quiet) {
783783 fprintf(stderr, "Warning: bind feature is disabled in Firejail configuration file\n");
784784 return 0;
785785 }
+9
-6
src/firejail/sandbox.c less more
295295 void start_application(void) {
296296 //if (setsid() == -1)
297297 //errExit("setsid");
298
299 // set environment
300 env_defaults();
301 env_apply();
302 if (arg_debug) {
303 printf("starting application\n");
304 printf("LD_PRELOAD=%s\n", getenv("LD_PRELOAD"));
305 }
306
298307 //****************************************
299308 // audit
300309 //****************************************
775784 }
776785 }
777786
778 // set environment
779 env_defaults();
780
781 // set user-supplied environment variables
782 env_apply();
783
784787 // set nice
785788 if (arg_nice) {
786789 errno = 0;
+47
-14
src/firejail/x11.c less more
252252 }
253253
254254 for (i = 0; i < (int) strlen(xephyr_extra_params)-1; i++) {
255 if (pos >= (sizeof(server_argv)/sizeof(*server_argv))) {
255 if (pos >= (sizeof(server_argv)/sizeof(*server_argv)) - 2) {
256256 fprintf(stderr, "Error: arg count limit exceeded while parsing xephyr_extra_params\n");
257257 exit(1);
258258 }
310310 if (server == 0) {
311311 if (arg_debug)
312312 printf("Starting xephyr...\n");
313
313
314 // running without privileges - see drop_privs call above
315 assert(getenv("LD_PRELOAD") == NULL);
314316 execvp(server_argv[0], server_argv);
315317 perror("execvp");
316318 _exit(1);
352354 if (!arg_quiet)
353355 printf("\n*** Attaching to Xephyr display %d ***\n\n", display);
354356
357 // running without privileges - see drop_privs call above
358 assert(getenv("LD_PRELOAD") == NULL);
355359 execvp(jail_argv[0], jail_argv);
356360 perror("execvp");
357361 _exit(1);
431435 dup2(fd_null,2);
432436 }
433437
438 // running without privileges - see drop_privs call above
439 assert(getenv("LD_PRELOAD") == NULL);
434440 execvp(server_argv[0], server_argv);
435441 perror("execvp");
436442 _exit(1);
477483 if (!arg_quiet)
478484 printf("\n*** Attaching to xpra display %d ***\n\n", display);
479485
486 // running without privileges - see drop_privs call above
487 assert(getenv("LD_PRELOAD") == NULL);
480488 execvp(attach_argv[0], attach_argv);
481489 perror("execvp");
482490 _exit(1);
507515 if (jail < 0)
508516 errExit("fork");
509517 if (jail == 0) {
518 // running without privileges - see drop_privs call above
519 assert(getenv("LD_PRELOAD") == NULL);
510520 if (firejail_argv[0]) // shut up llvm scan-build
511521 execvp(firejail_argv[0], firejail_argv);
512522 perror("execvp");
533543 dup2(fd_null,1);
534544 dup2(fd_null,2);
535545 }
546 // running without privileges - see drop_privs call above
547 assert(getenv("LD_PRELOAD") == NULL);
536548 execvp(stop_argv[0], stop_argv);
537549 perror("execvp");
538550 _exit(1);
631643
632644 void x11_xorg(void) {
633645 #ifdef HAVE_X11
634 // destination
646 // destination - create an empty ~/.Xauthotrity file if it doesn't exist already, and use it as a mount point
635647 char *dest;
636648 if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
637649 errExit("asprintf");
645657 fclose(fp);
646658 }
647659
660 // check xauth utility is present in the system
648661 if (stat("/usr/bin/xauth", &s) == -1) {
649662 fprintf(stderr, "Error: cannot find /usr/bin/xauth executable\n");
650663 exit(1);
651664 }
665
666 // create a temporary .Xauthority file
667 char tmpfname[] = "/tmp/.tmpXauth-XXXXXX";
668 int fd = mkstemp(tmpfname);
669 if (fd == -1) {
670 fprintf(stderr, "Error: cannot create .Xauthority file\n");
671 exit(1);
672 }
673 close(fd);
674 if (chown(tmpfname, getuid(), getgid()) == -1)
675 errExit("chown");
652676
653677 pid_t child = fork();
654678 if (child < 0)
655679 errExit("fork");
656680 if (child == 0) {
657 // generate a new .Xauthority file
681 // generate the new .Xauthority file using xauth utility
658682 if (arg_debug)
659683 printf("Generating a new .Xauthority file\n");
660
661 // elevate privileges - files in /run/firejail/mnt directory belong to root
662 if (setreuid(0, 0) < 0)
663 errExit("setreuid");
664 if (setregid(0, 0) < 0)
665 errExit("setregid");
666
684 drop_privs(1);
685
667686 char *display = getenv("DISPLAY");
668687 if (!display)
669688 display = ":0.0";
670
671 execlp("/usr/bin/xauth", "/usr/bin/xauth", "-f", RUN_XAUTHORITY_SEC_FILE,
689
690 clearenv();
691 execlp("/usr/bin/xauth", "/usr/bin/xauth", "-f", tmpfname,
672692 "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL);
673693
674694 _exit(0);
675695 }
696
676697 // wait for the child to finish
677698 waitpid(child, NULL, 0);
678699
679700 // check the file was created and set mode and ownership
680 if (stat(RUN_XAUTHORITY_SEC_FILE, &s) == -1) {
701 if (stat(tmpfname, &s) == -1) {
681702 fprintf(stderr, "Error: cannot create the new .Xauthority file\n");
703 exit(1);
704 }
705 if (chown(tmpfname, getuid(), getgid()) == -1)
706 errExit("chown");
707 if (chmod(tmpfname, 0600) == -1)
708 errExit("chmod");
709
710 // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted
711 // automatically when the sandbox is closed
712 if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) {
713 fprintf(stderr, "asdfdsfError: cannot create the new .Xauthority file\n");
682714 exit(1);
683715 }
684716 if (chown(RUN_XAUTHORITY_SEC_FILE, getuid(), getgid()) == -1)
685717 errExit("chown");
686718 if (chmod(RUN_XAUTHORITY_SEC_FILE, 0600) == -1)
687719 errExit("chmod");
720 unlink(tmpfname);
688721
689722 // mount
690723 if (mount(RUN_XAUTHORITY_SEC_FILE, dest, "none", MS_BIND, "mode=0600") == -1) {
+4
-2
src/man/firejail.txt less more
18561856 .TP
18571857 \fB\-\-get=name|pid filename
18581858 Retrieve the container file and store it on the host in the current working directory.
1859 The container is specified by name or PID.
1859 The container is specified by name or PID. This option is not available for sandboxes
1860 using --chroot.
18601861
18611862 .TP
18621863 \fB\-\-ls=name|pid dir_or_filename
18651866 .TP
18661867 \fB\-\-put=name|pid src-filename dest-filename
18671868 Put src-filename in sandbox container.
1868 The container is specified by name or PID.
1869 The container is specified by name or PID. This option is not available for sandboxes
1870 using --chroot.
18691871
18701872 .TP
18711873 Examples:
+1
-5
test/utils/ls.exp less more
2323 }
2424 sleep 1
2525 send -- "firejail --get=test ~/lstesting\r"
26 expect {
27 timeout {puts "TESTING ERROR 2\n";exit}
28 "Transfer complete"
29 }
30 sleep 1
26 sleep 2
3127 send -- "cat lstesting\r"
3228 expect {
3329 timeout {puts "TESTING ERROR 3\n";exit}