set umask for internal use

5 files changed, 55 insertions, 3 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 7a711cef3..0654439d6 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -98,6 +98,7 @@
 #define RUN_PASSWD_FILE         "/run/firejail/mnt/passwd"
 #define RUN_GROUP_FILE          "/run/firejail/mnt/group"
 #define RUN_FSLOGGER_FILE               "/run/firejail/mnt/fslogger"
+#define RUN_UMASK_FILE          "/run/firejail/mnt/umask"
 #define RUN_OVERLAY_ROOT        "/run/firejail/mnt/oroot"
 
 
@@ -391,6 +392,7 @@ extern int login_shell;
 extern int parent_to_child_fds[2];
 extern int child_to_parent_fds[2];
 extern pid_t sandbox_pid;
+extern mode_t orig_umask;
 extern unsigned long long start_timestamp;
 
 #define MAX_ARGS 128            // maximum number of command arguments (argc)
diff --git a/src/firejail/join.c b/src/firejail/join.c
index d4a2389c6..e6da4c248 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -205,6 +205,22 @@ static void extract_user_namespace(pid_t pid) {
         free(uidmap);
 }
 
+static void extract_umask(pid_t pid) {
+        char *fname;
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_UMASK_FILE) == -1)
+                errExit("asprintf");
+
+        FILE *fp = fopen(fname, "re");
+        free(fname);
+        if (!fp)
+                return;
+        if (fscanf(fp, "%4o", &orig_umask) < 1) {
+                fprintf(stderr, "Error: cannot read umask\n");
+                exit(1);
+        }
+        fclose(fp);
+}
+
 void join(pid_t pid, int argc, char **argv, int index) {
         EUID_ASSERT();
         char *homedir = cfg.homedir;
@@ -254,6 +270,9 @@ void join(pid_t pid, int argc, char **argv, int index) {
         if (cfg.cgroup) // not available for uid 0
                 set_cgroup(cfg.cgroup);
 
+        // get umask, it will be set by start_application()
+        extract_umask(pid);
+
         // join namespaces
         if (arg_join_network) {
                 if (join_namespace(pid, "net"))
diff --git a/src/firejail/main.c b/src/firejail/main.c
index ef8d8172f..42ed504f9 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -135,6 +135,7 @@ char *fullargv[MAX_ARGS];			// expanded argv for restricted shell
 int fullargc = 0;
 static pid_t child = 0;
 pid_t sandbox_pid;
+mode_t orig_umask = 022;
 unsigned long long start_timestamp;
 
 static void clear_atexit(void) {
@@ -833,7 +834,9 @@ static void run_builder(int argc, char **argv) {
                 errExit("setgid/getgid");
         if (setuid(getuid()) < 0)
                 errExit("setuid/getuid");
+
         assert(getenv("LD_PRELOAD") == NULL);
+        umask(orig_umask);
 
         argv[0] = LIBDIR "/firejail/fbuilder";
         execvp(argv[0], argv);
@@ -858,6 +861,9 @@ int main(int argc, char **argv) {
         EUID_INIT();
         EUID_USER();
 
+        // sanitize the umask
+        orig_umask = umask(022);
+
         // check if the user is allowed to use firejail
         init_cfg(argc, argv);
 
@@ -991,9 +997,10 @@ int main(int argc, char **argv) {
                                                         EUID_USER();}
 #endif
 
-                                                        drop_privs(1);
-                                                        int rv = system(argv[2]);
-                                                        exit(rv);
+                                                        drop_privs(1);
+                                                        umask(orig_umask);
+                                                        int rv = system(argv[2]);
+                                                        exit(rv);
                                                 }
                                         }
                                 }
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c
index 2bb4a2ed7..5714206d4 100644
--- a/src/firejail/run_symlink.c
+++ b/src/firejail/run_symlink.c
@@ -89,6 +89,9 @@ void run_symlink(int argc, char **argv, int run_as_is) {
 
         free(selfpath);
 
+        // restore original umask
+        umask(orig_umask);
+
         // desktop integration is not supported for root user; instead, the original program is started
         if (getuid() == 0 || run_as_is) {
                 argv[0] = program;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 7922da9b9..66881c040 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -126,6 +126,19 @@ void save_nogroups(void) {
 
 }
 
+void save_umask(void) {
+        FILE *fp = fopen(RUN_UMASK_FILE, "wxe");
+        if (fp) {
+                fprintf(fp, "%o\n", orig_umask);
+                SET_PERMS_STREAM(fp, 0, 0, 0644); // assume mode 0644
+                fclose(fp);
+        }
+        else {
+                fprintf(stderr, "Error: cannot save umask\n");
+                exit(1);
+        }
+}
+
 static void sandbox_if_up(Bridge *br) {
         assert(br);
         if (!br->configured)
@@ -367,6 +380,9 @@ void start_application(int no_sandbox) {
                 env_defaults();
                 env_apply();
         }
+        // restore original umask
+        umask(orig_umask);
+
         if (arg_debug) {
                 printf("starting application\n");
                 printf("LD_PRELOAD=%s\n", getenv("LD_PRELOAD"));
@@ -555,6 +571,11 @@ int sandbox(void* sandbox_arg) {
         fs_logger("install mount namespace");
 
         //****************************
+        // save the umask
+        //****************************
+        save_umask();
+
+        //****************************
         // netfilter
         //****************************
         if (arg_netfilter && any_bridge_configured()) { // assuming by default the client filter