config support to disable access to /mnt and /media

6 files changed, 35 insertions, 7 deletions

diff --git a/RELNOTES b/RELNOTES
index 519415533..28bb6c307 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -32,7 +32,8 @@ firejail (0.9.45) baseline; urgency=low
   * feature: follow-symlink-private-bin option in /etc/firejail/firejail.config
   * feature: xvfb X11 server support (--x11=xvfb)
   * feature: allow /tmp directory in mkdir and mkfile profile commands
-  * feature: implemented --noblacklist command
+  * feature: implemented --noblacklist command, profile support
+  * feature: config support to disable access to /mnt and /media (disable-mnt)
   * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire,
   * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
   * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
diff --git a/etc/firejail.config b/etc/firejail.config
index 858ac4ec1..af190cb3c 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -14,6 +14,10 @@
 # and it will harden the rest of the chroot tree.
 # chroot-desktop yes
 
+# Disable /mnt, /media, /run/mount and /run/media access. By default access
+# to these directories is enabled.
+# disable-mnt no
+
 # Enable or disable file transfer support, default enabled.
 # file-transfer yes
 
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 02bff2bfa..2aa7e7373 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -43,10 +43,11 @@ int checkcfg(int val) {
                 for (i = 0; i < CFG_MAX; i++)
                         cfg_val[i] = 1; // most of them are enabled by default
                 cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
-                cfg_val[CFG_FORCE_NONEWPRIVS] = 0; // disabled by default
-                cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0; // disabled by default
-                cfg_val[CFG_FIREJAIL_PROMPT] = 0; // disabled by default
-                cfg_val[CFG_FOLLOW_SYMLINK_PRIVATE_BIN] = 0; // disabled by default
+                cfg_val[CFG_FORCE_NONEWPRIVS] = 0;
+                cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0;
+                cfg_val[CFG_FIREJAIL_PROMPT] = 0;
+                cfg_val[CFG_FOLLOW_SYMLINK_PRIVATE_BIN] = 0;
+                cfg_val[CFG_DISABLE_MNT] = 0;
                 
                 // open configuration file
                 const char *fname = SYSCONFDIR "/firejail.config";
@@ -314,6 +315,14 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        else if (strncmp(ptr, "disable-mnt ", 12) == 0) {
+                                if (strcmp(ptr + 12, "yes") == 0)
+                                        cfg_val[CFG_DISABLE_MNT] = 1;
+                                else if (strcmp(ptr + 12, "no") == 0)
+                                        cfg_val[CFG_DISABLE_MNT] = 0;
+                                else
+                                        goto errout;
+                        }
                         else
                                 goto errout;
 
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 74e5b2c6b..f4d24ffa5 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -419,6 +419,7 @@ void profile_read(const char *fname);
 int profile_check_line(char *ptr, int lineno, const char *fname);
 // add a profile entry in cfg.profile list; use str to populate the list
 void profile_add(char *str);
+void fs_mnt(void);
 
 // list.c
 void list(void);
@@ -682,6 +683,7 @@ enum {
         CFG_FIREJAIL_PROMPT,
         CFG_FOLLOW_SYMLINK_AS_USER,
         CFG_FOLLOW_SYMLINK_PRIVATE_BIN,
+        CFG_DISABLE_MNT,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 712e5fb0a..801bde57c 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -471,7 +471,13 @@ void fs_noexec(const char *dir) {
         }
 }
 
-
+// Disable /mnt, /media, /run/mount and /run/media access
+void fs_mnt(void) {
+        disable_file(BLACKLIST_FILE, "/mnt");
+        disable_file(BLACKLIST_FILE, "/media");
+        disable_file(BLACKLIST_FILE, "/run/mount");
+        disable_file(BLACKLIST_FILE, "//run/media");
+}
 
 // mount /proc and /sys directories
 void fs_proc_sys_dev_boot(void) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 84ee5ee11..83afff516 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -759,12 +759,18 @@ int sandbox(void* sandbox_arg) {
                 netns_mounts(arg_netns);
         
         //****************************
-        // update /proc, /sys, /dev, /boot directorymy
+        // update /proc, /sys, /dev, /boot directory
         //****************************
         if (checkcfg(CFG_REMOUNT_PROC_SYS))
                 fs_proc_sys_dev_boot();
         
         //****************************
+        // handle /mnt and /media
+        //****************************
+        if (checkcfg(CFG_DISABLE_MNT))
+                fs_mnt();
+
+        //****************************
         // apply the profile file
         //****************************
         // apply all whitelist commands ...