compile time support to disable file transfer

4 files changed, 33 insertions, 1 deletions

diff --git a/configure b/configure
index 71f421ff4..258417e3c 100755
--- a/configure
+++ b/configure
@@ -629,6 +629,7 @@ EGREP
 GREP
 CPP
 HAVE_FATAL_WARNINGS
+HAVE_FILE_TRANSFER
 HAVE_X11
 HAVE_USERNS
 HAVE_NETWORK
@@ -693,6 +694,7 @@ enable_bind
 enable_network
 enable_userns
 enable_x11
+enable_file_transfer
 enable_fatal_warnings
 '
       ac_precious_vars='build_alias
@@ -1321,6 +1323,7 @@ Optional Features:
                           restrict --net= to root only
   --disable-userns        disable user namespace
   --disable-x11           disable X11 support
+  --disable-file-transfer disable file transfer
   --enable-fatal-warnings -W -Wall -Werror
 
 Some influential environment variables:
@@ -3147,6 +3150,19 @@ if test "x$enable_x11" != "xno"; then :
 
 fi
 
+HAVE_FILE_TRANSFER=""
+# Check whether --enable-file-transfer was given.
+if test "${enable_file_transfer+set}" = set; then :
+  enableval=$enable_file_transfer;
+fi
+
+if test "x$enable_file_transfer" != "xno"; then :
+
+        HAVE_FILE_TRANSFER="-DHAVE_FILE_TRANSFER"
+
+
+fi
+
 HAVE_FATAL_WARNINGS=""
 # Check whether --enable-fatal_warnings was given.
 if test "${enable_fatal_warnings+set}" = set; then :
@@ -4806,6 +4822,7 @@ echo "   bind: $HAVE_BIND"
 echo "   network: $HAVE_NETWORK"
 echo "   user namespace: $HAVE_USERNS"
 echo "   X11 support: $HAVE_X11"
+echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo
 
diff --git a/configure.ac b/configure.ac
index 512159568..71e3eb410 100644
--- a/configure.ac
+++ b/configure.ac
@@ -62,6 +62,14 @@ AS_IF([test "x$enable_x11" != "xno"], [
         AC_SUBST(HAVE_X11)
 ])
 
+HAVE_FILE_TRANSFER=""
+AC_ARG_ENABLE([file-transfer],
+    AS_HELP_STRING([--disable-file-transfer], [disable file transfer]))
+AS_IF([test "x$enable_file_transfer" != "xno"], [
+        HAVE_FILE_TRANSFER="-DHAVE_FILE_TRANSFER"
+        AC_SUBST(HAVE_FILE_TRANSFER)
+])
+
 HAVE_FATAL_WARNINGS=""
 AC_ARG_ENABLE([fatal_warnings],
     AS_HELP_STRING([--enable-fatal-warnings], [-W -Wall -Werror]))
@@ -95,6 +103,7 @@ echo "   bind: $HAVE_BIND"
 echo "   network: $HAVE_NETWORK"
 echo "   user namespace: $HAVE_USERNS"
 echo "   X11 support: $HAVE_X11"
+echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo
 
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in
index ba6bda0a5..3ad4ba75e 100644
--- a/src/firejail/Makefile.in
+++ b/src/firejail/Makefile.in
@@ -15,13 +15,14 @@ HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
 HAVE_NETWORK=@HAVE_NETWORK@
 HAVE_USERNS=@HAVE_USERNS@
 HAVE_X11=@HAVE_X11@
+HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
 
 
 H_FILE_LIST       = $(sort $(wildcard *.[h]))
 C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_SECCOMP) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_SECCOMP) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/libnetlink.h ../include/pid.h
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 2c6b5a5e1..bfb0eadc9 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -271,6 +271,9 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
 #ifndef HAVE_X11
                 printf("X11 support is disabled.\n");
 #endif
+#ifndef HAVE_FILE_TRANSFER
+                printf("File transfer support is disabled.\n");
+#endif
                 exit(0);
         }
 #ifdef HAVE_X11
@@ -426,6 +429,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 exit(0);
         }
 #endif  
+#ifndef HAVE_FILE_TRANSFER
         else if (strncmp(argv[i], "--get=", 6) == 0) {
                 logargs(argc, argv);
                 
@@ -472,6 +476,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                         sandboxfs_name(SANDBOX_FS_LS, argv[i] + 5, path);
                 exit(0);
         }
+#endif
         else if (strncmp(argv[i], "--join=", 7) == 0) {
                 logargs(argc, argv);