enhanced globbing for --blacklist

14 files changed, 40 insertions, 31 deletions

diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 0f7ab40ff..2a045f628 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -45,7 +45,7 @@ void appimage_set(const char *appimage) {
 
 #ifdef LOOP_CTL_GET_FREE
         // check appimage file
-        invalid_filename(appimage);
+        invalid_filename(appimage, 0); // no globbing
         if (access(appimage, R_OK) == -1) {
                 fprintf(stderr, "Error: cannot access AppImage file\n");
                 exit(1);
diff --git a/src/firejail/cgroup.c b/src/firejail/cgroup.c
index 70f07dd23..8d6496aab 100644
--- a/src/firejail/cgroup.c
+++ b/src/firejail/cgroup.c
@@ -72,7 +72,7 @@ errout:
 void set_cgroup(const char *path) {
         EUID_ASSERT();
 
-        invalid_filename(path);
+        invalid_filename(path, 0); // no globbing
 
         // path starts with /sys/fs/cgroup
         if (strncmp(path, "/sys/fs/cgroup", 14) != 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index bea195f36..e64bde857 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -497,7 +497,7 @@ void notify_other(int fd);
 char *expand_home(const char *path, const char* homedir);
 const char *gnu_basename(const char *path);
 uid_t pid_get_uid(pid_t pid);
-void invalid_filename(const char *fname);
+void invalid_filename(const char *fname, int globbing);
 uid_t get_group_id(const char *group);
 int remove_directory(const char *path);
 void flush_stdin(void);
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 5a4b0a161..f6c83ef26 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -153,7 +153,7 @@ static void duplicate(char *fname, FILE *fplist) {
                 fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
 
         char *full_path;
         if (*fname == '/') {
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index b0835d50b..9502844b2 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -103,7 +103,7 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
                 fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
 
         char *src;
         if (asprintf(&src,  "%s/%s", private_dir, fname) == -1)
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 9e3678c33..0de003e58 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -325,7 +325,7 @@ void fs_private(void) {
 // check new private home directory (--private= option) - exit if it fails
 void fs_check_private_dir(void) {
         EUID_ASSERT();
-        invalid_filename(cfg.home_private);
+        invalid_filename(cfg.home_private, 0); // no globbing
 
         // Expand the home directory
         char *tmp = expand_home(cfg.home_private, cfg.homedir);
@@ -367,7 +367,7 @@ static char *check_dir_or_file(const char *name) {
         assert(name);
 
         // basic checks
-        invalid_filename(name);
+        invalid_filename(name, 0); // no globbing
         if (arg_debug)
                 printf("Private home: checking %s\n", name);
 
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index 42255070c..0cf715fe2 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -129,7 +129,7 @@ void fs_resolvconf(void) {
 
 char *fs_check_hosts_file(const char *fname) {
         assert(fname);
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
         char *rv = expand_home(fname, cfg.homedir);
 
         // no a link
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c
index 20ffe825a..7975ae323 100644
--- a/src/firejail/fs_mkdir.c
+++ b/src/firejail/fs_mkdir.c
@@ -59,7 +59,7 @@ void fs_mkdir(const char *name) {
         EUID_ASSERT();
 
         // check directory name
-        invalid_filename(name);
+        invalid_filename(name, 0); // no globbing
         char *expanded = expand_home(name, cfg.homedir);
         if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 &&
             strncmp(expanded, "/tmp", 4) != 0) {
@@ -99,7 +99,7 @@ void fs_mkfile(const char *name) {
         EUID_ASSERT();
 
         // check file name
-        invalid_filename(name);
+        invalid_filename(name, 0); // no globbing
         char *expanded = expand_home(name, cfg.homedir);
         if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 &&
             strncmp(expanded, "/tmp", 4) != 0) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index c9edcec29..9f963d203 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -571,7 +571,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                                 exit(1);
                         }
                         char *path = argv[i + 1];
-                         invalid_filename(path);
+                         invalid_filename(path, 0); // no globbing
                          if (strstr(path, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path);
                                 exit(1);
@@ -595,13 +595,13 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                                 exit(1);
                         }
                         char *path1 = argv[i + 1];
-                         invalid_filename(path1);
+                         invalid_filename(path1, 0); // no globbing
                          if (strstr(path1, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path1);
                                 exit(1);
                          }
                         char *path2 = argv[i + 2];
-                         invalid_filename(path2);
+                         invalid_filename(path2, 0); // no globbing
                          if (strstr(path2, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path2);
                                 exit(1);
@@ -625,7 +625,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                                 exit(1);
                         }
                         char *path = argv[i + 1];
-                         invalid_filename(path);
+                         invalid_filename(path, 0); // no globbing
                          if (strstr(path, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path);
                                 exit(1);
@@ -1433,7 +1433,7 @@ int main(int argc, char **argv) {
                                 }
 
                                 // check name
-                                invalid_filename(subdirname);
+                                invalid_filename(subdirname, 0); // no globbing
                                 if (strstr(subdirname, "..") || strstr(subdirname, "/")) {
                                         fprintf(stderr, "Error: invalid overlay name\n");
                                         exit(1);
@@ -1482,7 +1482,7 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                         custom_profile_dir = expand_home(argv[i] + 15, cfg.homedir);
-                        invalid_filename(custom_profile_dir);
+                        invalid_filename(custom_profile_dir, 0); // no globbing
                         if (!is_dir(custom_profile_dir) || is_link(custom_profile_dir) || strstr(custom_profile_dir, "..")) {
                                 fprintf(stderr, "Error: invalid profile path\n");
                                 exit(1);
@@ -1541,7 +1541,7 @@ int main(int argc, char **argv) {
                                 }
 
 
-                                invalid_filename(argv[i] + 9);
+                                invalid_filename(argv[i] + 9, 0); // no globbing
 
                                 // extract chroot dirname
                                 cfg.chrootdir = argv[i] + 9;
@@ -2192,7 +2192,7 @@ int main(int argc, char **argv) {
                                 fprintf(stderr, "Error: --shell=none was already specified.\n");
                                 return 1;
                         }
-                        invalid_filename(argv[i] + 8);
+                        invalid_filename(argv[i] + 8, 0); // no globbing
 
                         if (cfg.shell) {
                                 fprintf(stderr, "Error: only one user shell can be specified\n");
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index 14b3b54a6..cb0d9d7af 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -45,7 +45,7 @@ static char *client_filter =
 
 void check_netfilter_file(const char *fname) {
         EUID_ASSERT();
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
 
         if (is_dir(fname) || is_link(fname) || strstr(fname, "..") || access(fname, R_OK )) {
                 fprintf(stderr, "Error: invalid network filter file %s\n", fname);
diff --git a/src/firejail/netns.c b/src/firejail/netns.c
index fdd108652..f52613490 100644
--- a/src/firejail/netns.c
+++ b/src/firejail/netns.c
@@ -49,7 +49,7 @@ void check_netns(const char *nsname) {
                 fprintf(stderr, "Error: invalid netns name %s\n", nsname);
                 exit(1);
         }
-        invalid_filename(nsname);
+        invalid_filename(nsname, 0); // no globbing
         char *control_file = netns_control_file(nsname);
 
         EUID_ASSERT();
diff --git a/src/firejail/output.c b/src/firejail/output.c
index b99604ec4..4f68b8ca3 100644
--- a/src/firejail/output.c
+++ b/src/firejail/output.c
@@ -48,7 +48,7 @@ void check_output(int argc, char **argv) {
         drop_privs(0);
         char *outfile = argv[outindex];
         outfile += (enable_stderr)? 16:9;
-        invalid_filename(outfile);
+        invalid_filename(outfile, 0); // no globbing
 
         // do not accept directories, links, and files with ".."
         if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 6880bcaa7..8aabac6fa 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -925,7 +925,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         }
 
                         // check name
-                        invalid_filename(subdirname);
+                        invalid_filename(subdirname, 0); // no globbing
                         if (strstr(subdirname, "..") || strstr(subdirname, "/")) {
                                 fprintf(stderr, "Error: invalid overlay name\n");
                                 exit(1);
@@ -993,8 +993,8 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         }
 
                         // check directories
-                        invalid_filename(dname1);
-                        invalid_filename(dname2);
+                        invalid_filename(dname1, 0); // no globbing
+                        invalid_filename(dname2, 0); // no globbing
                         if (strstr(dname1, "..") || strstr(dname2, "..")) {
                                 fprintf(stderr, "Error: invalid file name.\n");
                                 exit(1);
@@ -1118,7 +1118,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         }
 
         // some characters just don't belong in filenames
-        invalid_filename(ptr);
+        invalid_filename(ptr, 1); // globbing
         if (strstr(ptr, "..")) {
                 if (lineno == 0)
                         fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
@@ -1165,7 +1165,7 @@ void profile_read(const char *fname) {
         }
 
         // check file
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
         if (strlen(fname) == 0 || is_dir(fname)) {
                 fprintf(stderr, "Error: invalid profile file\n");
                 exit(1);
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 4d1c94c25..559f7ee48 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -747,7 +747,7 @@ uid_t pid_get_uid(pid_t pid) {
 }
 
 
-void invalid_filename(const char *fname) {
+void invalid_filename(const char *fname, int globbing) {
 //      EUID_ASSERT();
         assert(fname);
         const char *ptr = fname;
@@ -763,10 +763,19 @@ void invalid_filename(const char *fname) {
                 return;
 
         int len = strlen(ptr);
-        // file globbing ('*') is allowed
-        if (strcspn(ptr, "\\&!?\"'<>%^(){}[];,") != (size_t)len) {
-                fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
-                exit(1);
+        
+        if (globbing) {
+                // file globbing ('*?[]') is allowed
+                if (strcspn(ptr, "\\&!\"'<>%^(){};,") != (size_t)len) {
+                        fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
+                        exit(1);
+                }
+        }
+        else {
+                if (strcspn(ptr, "\\&!?\"'<>%^(){};,*[]") != (size_t)len) {
+                        fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
+                        exit(1);
+                }
         }
 }