Allow firejail --trace option to take an optional parameter which is the trace log file path. The trace log file will be created if it does not exist and then bind mounted to RUN_TRACE_FILE so that the sandboxed program can access it.

3 files changed, 25 insertions, 0 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 14cad4190..4a59522bf 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -260,6 +260,7 @@ extern int arg_caps_keep;		// keep list
 extern char *arg_caps_list;             // optional caps list
 
 extern int arg_trace;           // syscall tracing support
+extern char *arg_tracefile;     // syscall tracing file
 extern int arg_tracelog;        // blacklist tracing support
 extern int arg_rlimit_cpu;      // rlimit cpu
 extern int arg_rlimit_nofile;   // rlimit nofile
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index 26dd5cb27..eac73a074 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -41,6 +41,25 @@ void fs_trace_preload(void) {
                 fclose(fp);
                 fs_logger("touch /etc/ld.so.preload");
         }
+        if (arg_tracefile) {
+                if (arg_debug)
+                        printf("Creating an empty trace log file: %s\n", arg_tracefile);
+                // create a bind mounted trace logfile that the sandbox can see
+                FILE *fp = fopen(arg_tracefile, "w");
+                if (!fp)
+                        errExit("fopen");
+                SET_PERMS_STREAM(fp, firejail_uid, firejail_gid, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+                fclose(fp);
+                fp = fopen(RUN_TRACE_FILE, "w");
+                if (!fp)
+                        errExit("fopen");
+                fclose(fp);
+                fs_logger2("touch ", arg_tracefile);
+                if (mount(arg_tracefile, RUN_TRACE_FILE, NULL, MS_BIND|MS_REC, NULL) < 0)
+                        errExit("mount bind " RUN_TRACE_FILE);
+                if (arg_debug)
+                        printf("Bind mount %s to %s\n", arg_tracefile, RUN_TRACE_FILE);
+        }
 }
 
 void fs_trace(void) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9f44c6281..4c6d20626 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -80,6 +80,7 @@ int arg_caps_keep = 0;			// keep list
 char *arg_caps_list = NULL;                     // optional caps list
 
 int arg_trace = 0;                              // syscall tracing support
+char *arg_tracefile = NULL;                     // syscall tracing file
 int arg_tracelog = 0;                           // blacklist tracing support
 int arg_rlimit_cpu = 0;                         // rlimit max cpu time
 int arg_rlimit_nofile = 0;                      // rlimit nofile
@@ -1296,6 +1297,10 @@ int main(int argc, char **argv) {
                 }
                 else if (strcmp(argv[i], "--trace") == 0)
                         arg_trace = 1;
+                else if (strncmp(argv[i], "--trace=", 8) == 0) {
+                        arg_trace = 1;
+                        arg_tracefile = argv[i] + 8;
+                }
                 else if (strcmp(argv[i], "--tracelog") == 0)
                         arg_tracelog = 1;
                 else if (strncmp(argv[i], "--rlimit-cpu=", 13) == 0) {