DHCP fixes

5 files changed, 40 insertions, 4 deletions

diff --git a/src/firejail/dhcp.c b/src/firejail/dhcp.c
index 37547a985..456bba91b 100644
--- a/src/firejail/dhcp.c
+++ b/src/firejail/dhcp.c
@@ -130,7 +130,9 @@ static void dhcp_waitll_all() {
                 dhcp_waitll(cfg.bridge3.devsandbox);
 }
 
-void dhcp_start(void) {
+// Temporarily copy dhclient executable under /run/firejail/mnt and start it from there
+// in order to recognize it later in firemon and firetools
+void dhcp_store_exec(void) {
         if (!any_dhcp())
                 return;
 
@@ -144,6 +146,26 @@ void dhcp_start(void) {
                 }
         }
 
+        sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", dhclient_path, RUN_MNT_DIR);
+}
+
+void dhcp_start(void) {
+        if (!any_dhcp())
+                return;
+
+        char *dhclient_path = RUN_MNT_DIR "/dhclient";;
+        struct stat s;
+        if (stat(dhclient_path, &s) == -1) {
+                dhclient_path = "/usr/sbin/dhclient";
+                if (stat(dhclient_path, &s) == -1) {
+                        fprintf(stderr, "Error: dhclient was not found.\n");
+                        exit(1);
+                }
+        }
+
+        sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", dhclient_path, RUN_MNT_DIR);
+        dhclient_path = RUN_MNT_DIR "/dhclient";
+
         EUID_ROOT();
         if (mkdir(RUN_DHCLIENT_DIR, 0700))
                 errExit("mkdir");
@@ -163,4 +185,6 @@ void dhcp_start(void) {
                         exit(1);
                 }
         }
+
+        unlink(dhclient_path);
 }
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 2bb8dd351..6c0ebcd43 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -867,6 +867,7 @@ void dbus_apply_policy(void);
 // dhcp.c
 extern pid_t dhclient4_pid;
 extern pid_t dhclient6_pid;
+void dhcp_store_exec(void);
 void dhcp_start(void);
 
 // selinux.c
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 5cc2d4123..daa924698 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -888,19 +888,20 @@ char *guess_shell(void) {
         return shell;
 }
 
+// return argument index
 static int check_arg(int argc, char **argv, const char *argument, int strict) {
         int i;
         int found = 0;
         for (i = 1; i < argc; i++) {
                 if (strict) {
                         if (strcmp(argv[i], argument) == 0) {
-                                found = 1;
+                                found = i;
                                 break;
                         }
                 }
                 else {
                         if (strncmp(argv[i], argument, strlen(argument)) == 0) {
-                                found = 1;
+                                found = i;
                                 break;
                         }
                 }
@@ -1046,6 +1047,14 @@ int main(int argc, char **argv, char **envp) {
         }
         EUID_USER();
 
+        // --ip=dhcp - we need access to /sbin and /usr/sbin directories in order to run ISC DHCP client (dhclient)
+        // these paths are disabled in disable-common.inc
+        if ((i = check_arg(argc, argv, "--ip", 0)) != 0) {
+                if (strncmp(argv[i] + 4, "=dhcp", 5) == 0) {
+                        profile_add("noblacklist /sbin");
+                        profile_add("noblacklist /usr/sbin");
+                }
+        }
 
         // for appimages we need to remove "include disable-shell.inc from the profile
         // a --profile command can show up before --appimage
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index ff6be986f..3e8dbe5d9 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -651,6 +651,8 @@ int sandbox(void* sandbox_arg) {
         if (mount(LIBDIR "/firejail", RUN_FIREJAIL_LIB_DIR, NULL, MS_BIND, NULL) < 0 ||
             mount(NULL, RUN_FIREJAIL_LIB_DIR, NULL, MS_RDONLY|MS_NOSUID|MS_NODEV|MS_BIND|MS_REMOUNT, NULL) < 0)
                 errExit("mounting " RUN_FIREJAIL_LIB_DIR);
+        // keep a copy of dhclient executable before the filesystem is modified
+        dhcp_store_exec();
 
         //****************************
         // log sandbox data
diff --git a/src/include/rundefs.h b/src/include/rundefs.h
index 4da2db748..21aad66f7 100644
--- a/src/include/rundefs.h
+++ b/src/include/rundefs.h
@@ -51,7 +51,7 @@
 #define RUN_LIB_DIR                     RUN_MNT_DIR "/lib"
 #define RUN_LIB_FILE                    RUN_MNT_DIR "/libfiles"
 #define RUN_DNS_ETC                     RUN_MNT_DIR "/dns-etc"
-#define RUN_DHCLIENT_DIR                        RUN_MNT_DIR "/dhclient"
+#define RUN_DHCLIENT_DIR                        RUN_MNT_DIR "/dhclient-dir"
 #define RUN_DHCLIENT_4_LEASES_FILE              RUN_DHCLIENT_DIR "/dhclient.leases"
 #define RUN_DHCLIENT_6_LEASES_FILE              RUN_DHCLIENT_DIR "/dhclient6.leases"
 #define RUN_DHCLIENT_4_LEASES_FILE              RUN_DHCLIENT_DIR "/dhclient.leases"