fixes

5 files changed, 37 insertions, 8 deletions

diff --git a/src/firejail/list.c b/src/firejail/list.c
index cd53264b6..d093a1f85 100644
--- a/src/firejail/list.c
+++ b/src/firejail/list.c
@@ -21,7 +21,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-static void grsec_elevate_privileges(void) {
+static void set_privileges(void) {
         struct stat s;
         if (stat("/proc/sys/kernel/grsecurity", &s) == 0) {
                 EUID_ROOT();
@@ -32,49 +32,69 @@ static void grsec_elevate_privileges(void) {
                 if (setregid(0, 0))
                         errExit("setregid");
         }
+        else
+                drop_privs(1);
+}
+
+static char *get_firemon_path(const char *cmd) {
+        assert(cmd);
+        
+        // start the argv[0] program in a new sandbox
+        char *firemon;
+        if (asprintf(&firemon, "%s/bin/firemon %s", PREFIX, cmd) == -1)
+                errExit("asprintf");
+
+        return firemon;
 }
 
 void top(void) {
         EUID_ASSERT();
-        
+        drop_privs(1);
+        char *cmd = get_firemon_path("--top");
+
         char *arg[4];
         arg[0] = "bash";
         arg[1] = "-c";
-        arg[2] = "firemon --top";
+        arg[2] = cmd;
         arg[3] = NULL;
         execvp("/bin/bash", arg); 
 }
 
 void netstats(void) {
         EUID_ASSERT();
-        grsec_elevate_privileges();     
+        set_privileges();       
+        char *cmd = get_firemon_path("--netstats");
         
         char *arg[4];
         arg[0] = "bash";
         arg[1] = "-c";
-        arg[2] = "firemon --netstats";
+        arg[2] = cmd;
         arg[3] = NULL;
         execvp("/bin/bash", arg); 
 }
 
 void list(void) {
         EUID_ASSERT();
+        drop_privs(1);
+        char *cmd = get_firemon_path("--list");
         
         char *arg[4];
         arg[0] = "bash";
         arg[1] = "-c";
-        arg[2] = "firemon --list";
+        arg[2] = cmd;
         arg[3] = NULL;
         execvp("/bin/bash", arg); 
 }
 
 void tree(void) {
         EUID_ASSERT();
+        drop_privs(1);
+        char *cmd = get_firemon_path("--tree");
         
         char *arg[4];
         arg[0] = "bash";
         arg[1] = "-c";
-        arg[2] = "firemon --tree";
+        arg[2] = cmd;
         arg[3] = NULL;
         execvp("/bin/bash", arg); 
 }
diff --git a/src/firejail/output.c b/src/firejail/output.c
index 269ac25ea..91fe7f164 100644
--- a/src/firejail/output.c
+++ b/src/firejail/output.c
@@ -27,7 +27,6 @@ void check_output(int argc, char **argv) {
         
         int i;
         char *outfile = NULL;
-//      drop_privs(0);
 
         int found = 0;
         for (i = 1; i < argc; i++) {
@@ -91,6 +90,7 @@ void check_output(int argc, char **argv) {
         sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile);
 
         // run command
+        drop_privs(0);
         char *a[4];
         a[0] = "/bin/bash";
         a[1] = "-c";
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c
index d57816e12..cc6f6b3e9 100644
--- a/src/firejail/run_symlink.c
+++ b/src/firejail/run_symlink.c
@@ -91,6 +91,12 @@ void run_symlink(int argc, char **argv) {
 
         printf("Redirecting symlink to %s\n", program);
 
+        // drop privileges
+        if (setgid(getgid()) < 0)
+                errExit("setgid/getgid");
+        if (setuid(getuid()) < 0)
+                errExit("setuid/getuid");
+
         // run command
         char *a[3 + argc];
         a[0] = firejail;
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 3d5fc214d..dc906532f 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -29,6 +29,7 @@
 // drop privileges
 // - for root group or if nogroups is set, supplementary groups are not configured
 void drop_privs(int nogroups) {
+        EUID_ROOT();
         gid_t gid = getgid();
 
         // configure supplementary groups
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 985ca9337..300078872 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -173,6 +173,7 @@ void x11_start_xephyr(int argc, char **argv) {
                 fprintf(stderr, "Error: X11 sandboxing is not available when running as root\n");
                 exit(1);
         }
+        drop_privs(0);
 
         // check xephyr
         if (x11_check_xephyr() == 0) {
@@ -295,6 +296,7 @@ void x11_start_xpra(int argc, char **argv) {
                 fprintf(stderr, "Error: X11 sandboxing is not available when running as root\n");
                 exit(1);
         }
+        drop_privs(0);
 
         // check xpra
         if (x11_check_xpra() == 0) {