postpone procfs mount until after chroot call

issue #2301

3 files changed, 18 insertions, 33 deletions

diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c
index 1cc619c20..9ebbcea1a 100644
--- a/src/firejail/chroot.c
+++ b/src/firejail/chroot.c
@@ -164,19 +164,6 @@ void fs_chroot(const char *rootdir) {
         free(proc);
         close(fd);
 
-        // mount a brand new proc filesystem
-        if (arg_debug)
-                printf("Mounting /proc filesystem on chroot /proc\n");
-        fd = openat(parentfd, "proc", O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-        if (fd == -1)
-                errExit("open");
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount("proc", proc, "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
-                errExit("mounting /proc");
-        free(proc);
-        close(fd);
-
         // x11
         if (getenv("FIREJAIL_X11")) {
                 if (arg_debug)
@@ -259,6 +246,12 @@ void fs_chroot(const char *rootdir) {
         // create all other /run/firejail files and directories
         preproc_build_firejail_dir();
 
+        // mount a new proc filesystem
+        if (arg_debug)
+                printf("Mounting /proc filesystem representing the PID namespace\n");
+        if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
+                errExit("mounting /proc");
+
         // update /var directory in order to support multiple sandboxes running on the same root directory
         //      if (!arg_private_dev)
         //              fs_dev_shm();
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 003b15605..4fde3d661 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -725,6 +725,12 @@ void disable_config(void) {
 void fs_basic_fs(void) {
         uid_t uid = getuid();
 
+        // mount a new proc filesystem
+        if (arg_debug)
+                printf("Mounting /proc filesystem representing the PID namespace\n");
+        if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
+                errExit("mounting /proc");
+
         if (arg_debug)
                 printf("Basic read-only filesystem:\n");
         if (!arg_writable_etc) {
@@ -1077,15 +1083,6 @@ void fs_overlayfs(void) {
                 errExit("mounting /tmp");
         fs_logger("whitelist /tmp");
 
-        // mount a new proc filesystem
-        if (arg_debug)
-                printf("Mounting /proc\n");
-        char *proc;
-        if (asprintf(&proc, "%s/proc", oroot) == -1)
-                errExit("asprintf");
-        if (mount("proc", proc, "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
-                errExit("mounting /proc");
-
         // chroot in the new filesystem
 #ifdef HAVE_GCOV
         __gcov_flush();
@@ -1093,6 +1090,12 @@ void fs_overlayfs(void) {
         if (chroot(oroot) == -1)
                 errExit("chroot");
 
+        // mount a new proc filesystem
+        if (arg_debug)
+                printf("Mounting /proc filesystem representing the PID namespace\n");
+        if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
+                errExit("mounting /proc");
+
         // update /var directory in order to support multiple sandboxes running on the same root directory
 //      if (!arg_private_dev)
 //              fs_dev_shm();
@@ -1120,7 +1123,6 @@ void fs_overlayfs(void) {
         free(dev);
         free(run);
         free(tmp);
-        free(proc);
 }
 #endif
 
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 80b595a9f..995e98f9f 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -627,16 +627,6 @@ int sandbox(void* sandbox_arg) {
                 errExit("mounting " RUN_FIREJAIL_LIB_DIR);
 
         //****************************
-        // mount new proc filesystem
-        // representing the pid namespace
-        //****************************
-
-        if (arg_debug)
-                printf("Remounting /proc filesystem\n");
-        if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
-                errExit("mounting /proc");
-
-        //****************************
         // log sandbox data
         //****************************
         if (cfg.name)