diff options
author | rusty-snake <41237666+rusty-snake@users.noreply.github.com> | 2020-10-16 18:51:37 +0200 |
---|---|---|
committer | rusty-snake <41237666+rusty-snake@users.noreply.github.com> | 2020-10-23 11:01:12 +0200 |
commit | 1ebdf894c675925109031b3fbb859478a2ece566 (patch) | |
tree | 6e656ad5d5e4047bcdc078aefbf926e084309589 | |
parent | 0.9.64 testing (diff) | |
download | firejail-1ebdf894c675925109031b3fbb859478a2ece566.tar.gz firejail-1ebdf894c675925109031b3fbb859478a2ece566.tar.zst firejail-1ebdf894c675925109031b3fbb859478a2ece566.zip |
Allow --tmpfs inside $HOME for unprivileged users
--tmpfs was added in 0.9.14 and restricted to root only in 0.9.38
due to priv-esc CVE-2016-10117 (e.g. --tmpfs=/etc and modify
/etc/sudoers). This commit reintroduce it for normal users, if the
realpath of it is inside users-home.
-rw-r--r-- | RELNOTES | 3 | ||||
-rw-r--r-- | src/firejail/fs.c | 8 | ||||
-rw-r--r-- | src/firejail/profile.c | 4 |
3 files changed, 11 insertions, 4 deletions
@@ -1,3 +1,6 @@ | |||
1 | firejail (0.9.65) baseline; urgency=low | ||
2 | * allow --tmpfs inside $HOME for unprivileged users | ||
3 | |||
1 | firejail (0.9.64) baseline; urgency=low | 4 | firejail (0.9.64) baseline; urgency=low |
2 | * replaced --nowrap option with --wrap in firemon | 5 | * replaced --nowrap option with --wrap in firemon |
3 | * The blocking action of seccomp filters has been changed from | 6 | * The blocking action of seccomp filters has been changed from |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 2000ffc62..2f2bfdc79 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -366,6 +366,14 @@ void fs_blacklist(void) { | |||
366 | else if (strncmp(entry->data, "tmpfs ", 6) == 0) { | 366 | else if (strncmp(entry->data, "tmpfs ", 6) == 0) { |
367 | ptr = entry->data + 6; | 367 | ptr = entry->data + 6; |
368 | op = MOUNT_TMPFS; | 368 | op = MOUNT_TMPFS; |
369 | char *resolved_path = realpath(ptr, NULL); | ||
370 | if (!resolved_path || strncmp(cfg.homedir, resolved_path, strlen(cfg.homedir)) != 0) { | ||
371 | if (getuid() != 0) { | ||
372 | fprintf(stderr, "Error: tmpfs outside $HOME is only available for root\n"); | ||
373 | exit(1); | ||
374 | } | ||
375 | } | ||
376 | free(resolved_path); | ||
369 | } | 377 | } |
370 | else if (strncmp(entry->data, "mkdir ", 6) == 0) { | 378 | else if (strncmp(entry->data, "mkdir ", 6) == 0) { |
371 | EUID_USER(); | 379 | EUID_USER(); |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 5d83e6a73..8ed187b20 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -1563,10 +1563,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
1563 | else if (strncmp(ptr, "noexec ", 7) == 0) | 1563 | else if (strncmp(ptr, "noexec ", 7) == 0) |
1564 | ptr += 7; | 1564 | ptr += 7; |
1565 | else if (strncmp(ptr, "tmpfs ", 6) == 0) { | 1565 | else if (strncmp(ptr, "tmpfs ", 6) == 0) { |
1566 | if (getuid() != 0) { | ||
1567 | fprintf(stderr, "Error: tmpfs available only when running the sandbox as root\n"); | ||
1568 | exit(1); | ||
1569 | } | ||
1570 | ptr += 6; | 1566 | ptr += 6; |
1571 | } | 1567 | } |
1572 | else { | 1568 | else { |