cleanup seccomp run files

4 files changed, 131 insertions, 6 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 709ce96b6..5c7f73fc1 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -997,6 +997,10 @@ int sandbox(void* sandbox_arg) {
                 seccomp_load(RUN_SECCOMP_PROTOCOL);     // install filter
                 protocol_filter_save(); // save filter in RUN_PROTOCOL_CFG
         }
+        else {
+                int rv = unlink(RUN_SECCOMP_PROTOCOL);
+                (void) rv;
+        }
 #endif
 
         // if a keep list is available, disregard the drop list
@@ -1005,13 +1009,21 @@ int sandbox(void* sandbox_arg) {
                         seccomp_filter_keep();
                 else
                         seccomp_filter_drop();
-        }
 
-        if (arg_debug) {
-                printf("\nSeccomp files:\n");
-                int rv = system("ls -l /run/firejail/mnt/seccomp*\n");
+                // clean unused filters
+#if defined(__LP64__)
+                int rv = unlink(RUN_SECCOMP_64);
+#endif
+#if defined(__ILP32__)
+                int rv = unlink(RUN_SECCOMP_32);
+#endif
+                (void) rv;
+        }
+        else { // clean seccomp files under /run/firejail/mnt
+                int rv = unlink(RUN_SECCOMP_CFG);
+                rv |= unlink(RUN_SECCOMP_64);
+                rv |= unlink(RUN_SECCOMP_32);
                 (void) rv;
-                printf("\n");
         }
 
         if (arg_memory_deny_write_execute) {
@@ -1019,6 +1031,17 @@ int sandbox(void* sandbox_arg) {
                         printf("Install memory write&execute filter\n");
                 seccomp_load(RUN_SECCOMP_MDWX); // install filter
         }
+        else {
+                int rv = unlink(RUN_SECCOMP_MDWX);
+                (void) rv;
+        }
+
+        if (arg_debug) {
+                printf("\nSeccomp files:\n");
+                int rv = system("ls -l /run/firejail/mnt/seccomp*\n");
+                (void) rv;
+                printf("\n");
+        }
 #endif
 
         //****************************************
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index fed1f7ba7..cc2b08542 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -153,12 +153,13 @@ int sbox_run(unsigned filter, int num, ...) {
                 for (i = 3; i < max; i++)
                         close(i); // close open files
 
+#if 0
                 if (arg_debug) {
                         printf("sbox file descriptors:\n");
                         int rv = system("ls -l /proc/self/fd");
                         (void) rv;
                 }
-
+#endif
                 umask(027);
 
                 // apply filters
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 45b1d0459..12f13606b 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -28,6 +28,9 @@ fi
 echo "TESTING: debug options (test/filters/debug.exp)"
 ./debug.exp
 
+echo "TESTING: seccomp run files (test/filters/seccomp-run-files.exp)"
+./seccomp-run-files.exp
+
 echo "TESTING: noroot (test/filters/noroot.exp)"
 ./noroot.exp
 
diff --git a/test/filters/seccomp-run-files.exp b/test/filters/seccomp-run-files.exp
new file mode 100755
index 000000000..a72b9aef7
--- /dev/null
+++ b/test/filters/seccomp-run-files.exp
@@ -0,0 +1,98 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2018 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --debug\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "/run/firejail/mnt/seccomp seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "/run/firejail/mnt/seccomp.32 seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "/run/firejail/mnt/seccomp.protocol seccomp filter"
+}
+after 100
+send -- "ls -l /run/firejail/mnt | grep seccomp | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "4"
+}
+send -- "exit\r"
+sleep 1
+
+send --  "firejail --ignore=seccomp --debug\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "/run/firejail/mnt/seccomp seccomp filter" {puts "TESTING ERROR 5\n";exit}
+        "/run/firejail/mnt/seccomp.32 seccomp filter" {puts "TESTING ERROR 6\n";exit}
+        "/run/firejail/mnt/seccomp.64 seccomp filter" {puts "TESTING ERROR 7\n";exit}
+        "/run/firejail/mnt/seccomp.protocol seccomp filter"
+}
+after 100
+send -- "ls -l /run/firejail/mnt | grep seccomp | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "1"
+}
+send -- "exit\r"
+sleep 1
+
+send --  "firejail --ignore=protocol --debug\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "/run/firejail/mnt/seccomp seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "/run/firejail/mnt/seccomp.32 seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 11\n";exit}
+        "/run/firejail/mnt/seccomp.protocol seccomp filter" {puts "TESTING ERROR 12\n";exit}
+        "monitoring"
+}
+after 100
+send -- "ls -l /run/firejail/mnt | grep seccomp | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 13\n";exit}
+        "3"
+}
+send -- "exit\r"
+sleep 1
+
+send --  "firejail --memory-deny-write-execute --debug\r"
+expect {
+        timeout {puts "TESTING ERROR 14\n";exit}
+        "/run/firejail/mnt/seccomp.mdwx seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 15\n";exit}
+        "/run/firejail/mnt/seccomp seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 16\n";exit}
+        "/run/firejail/mnt/seccomp.32 seccomp filter"
+}
+expect {
+        timeout {puts "TESTING ERROR 17\n";exit}
+        "/run/firejail/mnt/seccomp.protocol seccomp filter"
+}
+after 100
+send -- "ls -l /run/firejail/mnt | grep seccomp | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 18\n";exit}
+        "5"
+}
+send -- "exit\r"
+sleep 1
+
+puts "all done\n"