ASSERT_PERMS macros

2 files changed, 23 insertions, 1 deletions

diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 37e3de5d8..513a5a8a2 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -81,6 +81,7 @@ void appimage_set(const char *appimage_path) {
                 fprintf(stderr, "Error: cannot create temporary directory\n");
                 exit(1);
         }
+        ASSERT_PERMS(mntdir, getuid(), getgid(), 0700);
         
         char *mode;
         if (asprintf(&mode, "mode=700,uid=%d,gid=%d", getuid(), getgid()) == -1)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 8e30e929a..4bc953e24 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -75,6 +75,27 @@
 #define DEFAULT_ROOT_PROFILE    "server"
 #define MAX_INCLUDE_LEVEL 6             // include levels in profile files
 
+
+#define ASSERT_PERMS(file, uid, gid, mode) \
+        do { \
+                assert(file);\
+                struct stat s;\
+                if (stat(file, &s) == -1) errExit("stat");\
+                assert(s.st_uid == uid && s.st_gid == gid && (s.st_mode & 07777) == mode);\
+        } while (0)
+#define ASSERT_PERMS_FD(fd, uid, gid, mode) \
+        do { \
+                struct stat s;\
+                if (stat(fd, &s) == -1) errExit("stat");\
+                assert(s.st_uid == uid && s.st_gid == gid && (s.st_mode & 07777) == mode);\
+        } while (0)
+#define ASSERT_PERMS_STREAM(file, uid, gid, mode) \
+        do { \
+                int fd = fileno(file);\
+                if (fd == -1) errExit("fileno");\
+                ASSERT_PERMS_FD(fd, uid, gid, mode);\
+        } while (0)
+
 // main.c
 typedef struct bridge_t {
         // on the host
@@ -386,7 +407,7 @@ void logsignal(int s);
 void logmsg(const char *msg);
 void logargs(int argc, char **argv) ;
 void logerr(const char *msg);
-int copy_file(const char *srcname, const char *destname);
+int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
 int is_dir(const char *fname);
 int is_link(const char *fname);
 char *line_remove_spaces(const char *buf);