overlayfs fixes

6 files changed, 71 insertions, 48 deletions

diff --git a/RELNOTES b/RELNOTES
index 6d029d320..ee3d60230 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -16,7 +16,6 @@ firejail (0.9.42~rc2) baseline; urgency=low
   * noexec support (--noexec)
   * --overlay-clean option
   * --overlay-named=name option
-  * --overlay-path=path option
   * compile time and run time support to disable overlayfs
   * Ubuntu snap support
   * include /dev/snd in --private-dev
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index ddb25c2dd..c5ef27615 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -817,9 +817,10 @@ void fs_basic_fs(void) {
 
 #ifdef HAVE_OVERLAYFS
 char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
-        // create ~/.firejail directory
         struct stat s;
         char *dirname;
+
+        // create ~/.firejail directory
         if (asprintf(&dirname, "%s/.firejail", cfg.homedir) == -1)
                 errExit("asprintf");
         if (stat(dirname, &s) == -1) {
@@ -835,12 +836,15 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
                 fprintf(stderr, "Error: invalid ~/.firejail directory\n");
                 exit(1);
         }
-
         free(dirname);
 
         // check overlay directory
         if (asprintf(&dirname, "%s/.firejail/%s", cfg.homedir, subdirname) == -1)
                 errExit("asprintf");
+        if (is_link(dirname)) {
+                fprintf(stderr, "Error: overlay directory is a symbolic link\n");
+                exit(1);
+        }
         if (allow_reuse == 0) {
                 if (stat(dirname, &s) == 0) {
                         fprintf(stderr, "Error: overlay directory already exists: %s\n", dirname);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index bdb8e0df5..27e2a7f1a 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1365,6 +1365,13 @@ int main(int argc, char **argv) {
                                         fprintf(stderr, "Error: invalid overlay option\n");
                                         exit(1);
                                 }
+                                
+                                // check name
+                                invalid_filename(subdirname);
+                                if (strstr(subdirname, "..") || strstr(subdirname, "/")) {
+                                        fprintf(stderr, "Error: invalid overlay name\n");
+                                        exit(1);
+                                }
                                 cfg.overlay_dir = fs_check_overlay_dir(subdirname, arg_overlay_reuse);
                         }
                         else {
@@ -1373,6 +1380,7 @@ int main(int argc, char **argv) {
                         }
 
                 }
+#if 0 // disabled for now, it could be used to overwrite system directories     
                 else if (strncmp(argv[i], "--overlay-path=", 15) == 0) {
                         if (checkcfg(CFG_OVERLAYFS)) {
                                 if (cfg.chrootdir) {
@@ -1400,6 +1408,7 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                 }
+#endif
                 else if (strcmp(argv[i], "--overlay-tmpfs") == 0) {
                         if (checkcfg(CFG_OVERLAYFS)) {
                                 if (cfg.chrootdir) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 0818bf450..0851e71cd 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -378,7 +378,30 @@ void start_application(void) {
         exit(1); // it should never get here!!!
 }
 
-
+static void enforce_filters(void) {
+        // force default seccomp inside the chroot, no keep or drop list
+        // the list build on top of the default drop list is kept intact
+        arg_seccomp = 1;
+        if (cfg.seccomp_list_drop) {
+                free(cfg.seccomp_list_drop);
+                cfg.seccomp_list_drop = NULL;
+        }
+        if (cfg.seccomp_list_keep) {
+                free(cfg.seccomp_list_keep);
+                cfg.seccomp_list_keep = NULL;
+        }
+        
+        // disable all capabilities
+        if (arg_caps_default_filter || arg_caps_list)
+                fprintf(stderr, "Warning: all capabilities disabled for a regular user in chroot\n");
+        arg_caps_drop_all = 1;
+        
+        // drop all supplementary groups; /etc/group file inside chroot
+        // is controlled by a regular usr
+        arg_nogroups = 1;
+        if (!arg_quiet)
+                printf("Dropping all Linux capabilities and enforcing default seccomp filter\n");
+}
 
 int sandbox(void* sandbox_arg) {
         // Get rid of unused parameter warning
@@ -463,37 +486,13 @@ int sandbox(void* sandbox_arg) {
 #ifdef HAVE_CHROOT              
         if (cfg.chrootdir) {
                 fs_chroot(cfg.chrootdir);
-
-//              // redo cp command
-//              fs_build_cp_command();
                 
                 // force caps and seccomp if not started as root
                 if (getuid() != 0) {
-                        // force default seccomp inside the chroot, no keep or drop list
-                        // the list build on top of the default drop list is kept intact
-                        arg_seccomp = 1;
+                        enforce_filters();
 #ifdef HAVE_SECCOMP
                         enforce_seccomp = 1;
 #endif
-                        if (cfg.seccomp_list_drop) {
-                                free(cfg.seccomp_list_drop);
-                                cfg.seccomp_list_drop = NULL;
-                        }
-                        if (cfg.seccomp_list_keep) {
-                                free(cfg.seccomp_list_keep);
-                                cfg.seccomp_list_keep = NULL;
-                        }
-                        
-                        // disable all capabilities
-                        if (arg_caps_default_filter || arg_caps_list)
-                                fprintf(stderr, "Warning: all capabilities disabled for a regular user in chroot\n");
-                        arg_caps_drop_all = 1;
-                        
-                        // drop all supplementary groups; /etc/group file inside chroot
-                        // is controlled by a regular usr
-                        arg_nogroups = 1;
-                        if (!arg_quiet)
-                                printf("Dropping all Linux capabilities and enforcing default seccomp filter\n");
                 }
                 else
                         arg_seccomp = 1;
@@ -507,8 +506,18 @@ int sandbox(void* sandbox_arg) {
         else 
 #endif          
 #ifdef HAVE_OVERLAYFS
-        if (arg_overlay)        
+        if (arg_overlay)        {
                 fs_overlayfs();
+                // force caps and seccomp if not started as root
+                if (getuid() != 0) {
+                        enforce_filters();
+#ifdef HAVE_SECCOMP
+                        enforce_seccomp = 1;
+#endif
+                }
+                else
+                        arg_seccomp = 1;
+        }
         else
 #endif
                 fs_basic_fs();
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index ebe1c8830..d4eab7802 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -185,10 +185,30 @@ void usage(void) {
         printf("\t$HOME/.firejail/<NAME> directory. (OverlayFS support is required in\n");
         printf("\tLinux kernel for this option to work). \n\n");
 
+#if 0 // disabled for now, it could be used to overwrite system directories     
         printf("    --overlay-path=path - mount a filesystem overlay on top of the current\n");
         printf("\tfilesystem. The upper filesystem layer is persistent, and stored in\n");
         printf("\tthe specified path. (OverlayFS support is required in Linux kernel for\n");
         printf("\tthis option to work). \n\n");
+        
+.TP
+\fB\-\-overlay-path=path
+Mount a filesystem overlay on top of the current filesystem.  Unlike the regular filesystem container,
+the system directories are mounted read-write. All filesystem modifications go into the overlay.
+The overlay is stored in the specified path. The created overlay can be reused between multiple sessions.
+.br
+
+.br
+OverlayFS support is required in Linux kernel for this option to work.
+OverlayFS was officially introduced in Linux kernel version 3.18.
+This option is not available on Grsecurity systems.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-overlay-path=~/jails/jail1 firefox
+#endif
 
         printf("    --overlay-tmpfs - mount a filesystem overlay on top of the current\n");
         printf("\tfilesystem. The upper layer is stored in a tmpfs filesystem,\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index b258c3d20..19fca9854 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1037,24 +1037,6 @@ Example:
 $ firejail \-\-overlay-named=jail1 firefox
 
 .TP
-\fB\-\-overlay-path=path
-Mount a filesystem overlay on top of the current filesystem.  Unlike the regular filesystem container,
-the system directories are mounted read-write. All filesystem modifications go into the overlay.
-The overlay is stored in the specified path. The created overlay can be reused between multiple sessions.
-.br
-
-.br
-OverlayFS support is required in Linux kernel for this option to work.
-OverlayFS was officially introduced in Linux kernel version 3.18.
-This option is not available on Grsecurity systems.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-overlay-path=~/jails/jail1 firefox
-
-.TP
 \fB\-\-overlay-tmpfs
 Mount a filesystem overlay on top of the current filesystem. All filesystem modifications go into the overlay,
 and are discarded when the sandbox is closed.