Merge branch 'master' of https://github.com/netblue30/firejail

6 files changed, 56 insertions, 72 deletions

diff --git a/etc/firejail-default b/etc/firejail-default
index 09dc896e6..e05d09468 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -22,42 +22,30 @@ dbus,
 
 ##########
 # With ptrace it is possible to inspect and hijack running programs. Usually this
-# is needed only for debugging. To allow ptrace, uncomment the following line
+# is needed only for debugging. To allow ptrace, uncomment the following line.
 ##########
 #ptrace,
 
 ##########
-# Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes
+# Allow read access to whole filesystem and control it from firejail.
 ##########
-/ r,
-/{usr,bin,sbin,dev,etc,home,root,lib,media,mnt,opt,srv,tmp,var}** mrwlk,
-/run/firejail/mnt/oroot/{usr,bin,sbin,dev,etc,home,root,lib,media,mnt,opt,srv,tmp,var}** mrwlk,
+/{,**} rklm,
 
-/{,var/}run/ r,
-/{,var/}run/** r,
-/run/firejail/mnt/oroot/{,var/}run/ r,
-/run/firejail/mnt/oroot/{,var/}run/** r,
-
-owner /{,var/}run/user/[0-9]*/** rw,
-owner /{,var/}run/user/[0-9]*/*.slave-socket rwl,
-owner /{,var/}run/user/[0-9]*/orcexec.* rwkm,
-owner /run/firejail/mnt/oroot/{,var/}run/user/[0-9]*/** rw,
-owner /run/firejail/mnt/oroot/{,var/}run/user/[0-9]*/*.slave-socket rwl,
-owner /run/firejail/mnt/oroot/{,var/}run/user/[0-9]*/orcexec.* rwkm,
+##########
+# Allow write access to paths writable in firejail which aren't used for
+# executing programs. /run, /proc and /sys are handled separately.
+# Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes.
+##########
+/{,run/firejail/mnt/oroot/}{dev,etc,home,media,mnt,root,srv,tmp,var}/** w,
 
-/{,var/}run/firejail/mnt/fslogger r,
-/{,var/}run/firejail/appimage r,
-/{,var/}run/firejail/appimage/** r,
-/{,var/}run/firejail/appimage/** ix,
-/run/firejail/mnt/oroot/{,var/}run/firejail/mnt/fslogger r,
-/run/firejail/mnt/oroot/{,var/}run/firejail/appimage r,
-/run/firejail/mnt/oroot/{,var/}run/firejail/appimage/** r,
-/run/firejail/mnt/oroot/{,var/}run/firejail/appimage/** ix,
+##########
+# Whitelist writable paths under /run, /proc and /sys.
+##########
+owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/** w,
+owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/*.slave-socket w,
+owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/orcexec.* w,
 
-/{run,dev}/shm/ r,
-owner /{run,dev}/shm/** rmwk,
-/run/firejail/mnt/oroot/{run,dev}/shm/ r,
-owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk,
+owner /{,run/firejail/mnt/oroot/}{run,dev}/shm/** w,
 
 # Allow logging Firejail blacklist violations to journal
 /{,var/}run/systemd/journal/socket w,
@@ -66,58 +54,41 @@ owner /run/firejail/mnt/oroot/{run,dev}/shm/** rmwk,
 # Needed for wine
 /{,var/}run/firejail/profile/@{PID} w,
 
-##########
-# Allow /proc and /sys read-only access.
-# Blacklisting is controlled from userspace Firejail.
-##########
-/proc/ r,
-/proc/** r,
+# Allow access to cups printing socket.
+/{,var/}run/cups/cups.sock w,
+
+# Needed for firefox sandbox
 /proc/[0-9]*/{uid_map,gid_map,setgroups} w,
-# Uncomment to silence all denied write warnings
-#deny /proc/** w,
+
+# Silence noise
 deny /proc/@{PID}/oom_adj w,
 deny /proc/@{PID}/oom_score_adj w,
 
-/sys/ r,
-/sys/** r,
 # Uncomment to silence all denied write warnings
-#deny /sys/** w,
+#deny /proc/** w,
 
-# Blacklist snapshots
-deny /**/.snapshots/ rwx,
+# Uncomment to silence all denied write warnings
+#deny /sys/** w,
 
 ##########
 # Allow running programs only from well-known system directories. If you need
 # to run programs from your home directory, uncomment /home line.
 ##########
-/lib/** ix,
-/lib64/** ix,
-/bin/** ix,
-/sbin/** ix,
-/usr/bin/** ix,
-/usr/sbin/** ix,
-/usr/local/** ix,
-/usr/lib/** ix,
-/usr/lib64/** ix,
-/usr/games/** ix,
-/opt/** ix,
-#/home/** ix,
-/run/firejail/mnt/oroot/lib/** ix,
-/run/firejail/mnt/oroot/lib64/** ix,
-/run/firejail/mnt/oroot/bin/** ix,
-/run/firejail/mnt/oroot/sbin/** ix,
-/run/firejail/mnt/oroot/usr/bin/** ix,
-/run/firejail/mnt/oroot/usr/sbin/** ix,
-/run/firejail/mnt/oroot/usr/local/** ix,
-/run/firejail/mnt/oroot/usr/lib/** ix,
-/run/firejail/mnt/oroot/usr/lib64/** ix,
-/run/firejail/mnt/oroot/usr/games/** ix,
-/run/firejail/mnt/oroot/opt/** ix,
+/{,run/firejail/mnt/oroot/}{,usr/,usr/local/}bin/** ix,
+/{,run/firejail/mnt/oroot/}{,usr/,usr/local/}sbin/** ix,
+/{,run/firejail/mnt/oroot/}{,usr/,usr/local/}games/** ix,
+/{,run/firejail/mnt/oroot/}{,usr/,usr/local/}lib{,32,64}/** ix,
+/{,run/firejail/mnt/oroot/}{,usr/,usr/local/}opt/** ix,
+#/{,run/firejail/mnt/oroot/}{,usr/,usr/local/}home/** ix,
+
+# Appimage support
+/{,run/firejail/mnt/oroot/}{,var/}run/firejail/appimage/** ix,
 
 ##########
-# Allow access to cups printing socket.
+# Blacklist specific sensitive paths.
 ##########
-/run/cups/cups.sock w,
+# Common backup directory
+deny /**/.snapshots/ rwx,
 
 ##########
 # Allow all networking functionality, and control it from Firejail.
diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c
index 71b39390e..de2b8cfa2 100644
--- a/src/firecfg/desktop_files.c
+++ b/src/firecfg/desktop_files.c
@@ -144,6 +144,8 @@ void fix_desktop_files(char *homedir) {
                 perror("opendir");
                 fprintf(stderr, "Warning: cannot access /usr/share/applications directory, desktop files fixing skipped...\n");
                 free(user_apps_dir);
+                if (dir)
+                        closedir(dir);
                 return;
         }
 
@@ -266,12 +268,16 @@ void fix_desktop_files(char *homedir) {
 
                 if (stat(outname, &sb) == 0) {
                         printf("   %s skipped: file exists\n", filename);
+                        if (change_exec)
+                                free(change_exec);
                         continue;
                 }
 
                 FILE *fpin = fopen(filename, "r");
                 if (!fpin) {
                         fprintf(stderr, "Warning: cannot open /usr/share/applications/%s\n", filename);
+                        if (change_exec)
+                                free(change_exec);
                         continue;
                 }
 
@@ -279,6 +285,8 @@ void fix_desktop_files(char *homedir) {
                 if (!fpout) {
                         fprintf(stderr, "Warning: cannot open ~/.local/share/applications/%s\n", outname);
                         fclose(fpin);
+                        if (change_exec)
+                                free(change_exec);
                         continue;
                 }
                 fprintf(fpout, "# converted by firecfg\n");
diff --git a/src/firejail/cmdline.c b/src/firejail/cmdline.c
index ce1e281a5..1fe5a2398 100644
--- a/src/firejail/cmdline.c
+++ b/src/firejail/cmdline.c
@@ -208,4 +208,5 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
 
         // free strdup
         free(tmp1);
+        free(command_line_tmp);
 }
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 602985b4e..9b68b6753 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -371,10 +371,13 @@ void fs_whitelist(void) {
 
                 // resolve macros
                 if (is_macro(dataptr)) {
-                        char *tmp = resolve_macro(dataptr);
-                        if (tmp != NULL)
-                                tmp = parse_nowhitelist(nowhitelist_flag, tmp);
-
+                        char *tmp = resolve_macro(dataptr); // returns allocated mem
+                        if (tmp != NULL) {
+                                char *tmp1 = parse_nowhitelist(nowhitelist_flag, tmp);
+                                assert(tmp1);
+                                free(tmp);
+                                tmp = tmp1;
+                        }
                         if (tmp) {
                                 entry->data = tmp;
                                 dataptr = (nowhitelist_flag)? entry->data + 12: entry->data + 10;
diff --git a/src/fsec-print/main.c b/src/fsec-print/main.c
index 94c60687f..5a1e34080 100644
--- a/src/fsec-print/main.c
+++ b/src/fsec-print/main.c
@@ -74,7 +74,8 @@ printf("\n");
         close(fd);
         return 0;
 errexit:
-        close(fd);
+        if (fd != -1)
+                close(fd);
         fprintf(stderr, "Error: cannot read %s\n", fname);
         exit(1);
 
diff --git a/src/libpostexecseccomp/libpostexecseccomp.c b/src/libpostexecseccomp/libpostexecseccomp.c
index 0ccb74b10..6d2c8c695 100644
--- a/src/libpostexecseccomp/libpostexecseccomp.c
+++ b/src/libpostexecseccomp/libpostexecseccomp.c
@@ -31,7 +31,7 @@ static void load_seccomp(void) {
         if (fd == -1)
                 return;
 
-        int size = lseek(fd, 0, SEEK_END);
+        off_t size = lseek(fd, 0, SEEK_END);
         unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter);
         struct sock_filter *filter = MAP_FAILED;
         if (size != 0)