trace, tracelog: don't truncate /etc/ld.so.preload

3 files changed, 28 insertions, 17 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 2a7d88575..bcc7e6ed1 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -621,7 +621,8 @@ void caps_print_filter(pid_t pid) __attribute__((noreturn));
 void caps_drop_dac_override(void);
 
 // fs_trace.c
-void fs_trace_preload(void);
+void fs_trace_touch_preload(void);
+void fs_trace_touch_or_store_preload(void);
 void fs_tracefile(void);
 void fs_trace(void);
 
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index 475a391ec..718786cdc 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -26,19 +26,26 @@
 #include <fcntl.h>
 #include <pwd.h>
 
-void fs_trace_preload(void) {
+// create an empty /etc/ld.so.preload
+void fs_trace_touch_preload(void) {
+        create_empty_file_as_root("/etc/ld.so.preload", S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+}
+
+void fs_trace_touch_or_store_preload(void) {
         struct stat s;
 
-        // create an empty /etc/ld.so.preload
-        if (stat("/etc/ld.so.preload", &s)) {
-                if (arg_debug)
-                        printf("Creating an empty /etc/ld.so.preload file\n");
-                FILE *fp = fopen("/etc/ld.so.preload", "wxe");
-                if (!fp)
-                        errExit("fopen");
-                SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
-                fclose(fp);
-                fs_logger("touch /etc/ld.so.preload");
+        if (stat("/etc/ld.so.preload", &s) != 0) {
+                fs_trace_touch_preload();
+                return;
+        }
+
+        if (s.st_size == 0)
+                return;
+
+        // create a copy of /etc/ld.so.preload
+        if (copy_file("/etc/ld.so.preload", RUN_LDPRELOAD_FILE, 0, 0, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) {
+                fprintf(stderr, "Error: cannot copy /etc/ld.so.preload file\n");
+                exit(1);
         }
 }
 
@@ -83,7 +90,7 @@ void fs_trace(void) {
         if (arg_debug)
                 printf("Create the new ld.so.preload file\n");
 
-        FILE *fp = fopen(RUN_LDPRELOAD_FILE, "we");
+        FILE *fp = fopen(RUN_LDPRELOAD_FILE, "ae");
         if (!fp)
                 errExit("fopen");
         const char *prefix = RUN_FIREJAIL_LIB_DIR;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 995827fb7..7a1ce737b 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -798,7 +798,7 @@ int sandbox(void* sandbox_arg) {
 
         // trace pre-install
         if (need_preload)
-                fs_trace_preload();
+                fs_trace_touch_or_store_preload();
 
         // store hosts file
         if (cfg.hosts_file)
@@ -814,8 +814,11 @@ int sandbox(void* sandbox_arg) {
                 //****************************
                 // trace pre-install, this time inside chroot
                 //****************************
-                if (need_preload)
-                        fs_trace_preload();
+                if (need_preload) {
+                        int rv = unlink(RUN_LDPRELOAD_FILE);
+                        (void) rv;
+                        fs_trace_touch_or_store_preload();
+                }
         }
         else
 #endif
@@ -992,7 +995,7 @@ int sandbox(void* sandbox_arg) {
 
                         // create /etc/ld.so.preload file again
                         if (need_preload)
-                                fs_trace_preload();
+                                fs_trace_touch_preload();
 
                         // openSUSE configuration is split between /etc and /usr/etc
                         // process private-etc a second time