fixes

6 files changed, 43 insertions, 3 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index d3cfb1e96..297624c3b 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -26,6 +26,7 @@
 #define RO_DIR  "/tmp/firejail/firejail.ro.dir"
 #define RO_FILE "/tmp/firejail/firejail.ro.file"
 #define MNT_DIR "/tmp/firejail/mnt"
+#define CP_COMMAND      "/tmp/firejail/mnt/cp"
 #define HOME_DIR        "/tmp/firejail/mnt/home"
 #define ETC_DIR "/tmp/firejail/mnt/etc"
 #define BIN_DIR "/tmp/firejail/mnt/bin"
@@ -217,6 +218,10 @@ int net_get_mac(const char *ifname, unsigned char mac[6]);
 void fs_build_firejail_dir(void);
 // build /tmp/firejail/mnt directory
 void fs_build_mnt_dir(void);
+// grab a copy of cp command
+void fs_build_cp_command(void);
+// delete the temporary cp command
+void fs_delete_cp_command(void) ;
 // blacklist files or directoies by mounting empty files on top of them
 void fs_blacklist(void);
 // remount a directory read-only
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index b3748de51..42d31f567 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -83,6 +83,37 @@ void fs_build_mnt_dir(void) {
         }
 }
 
+// grab a copy of cp command
+void fs_build_cp_command(void) {
+        struct stat s;
+        fs_build_mnt_dir();
+        if (stat(CP_COMMAND, &s)) {
+                char* fname = realpath("/bin/cp", NULL);
+                if (fname == NULL) {
+                        fprintf(stderr, "Error: /bin/cp not found\n");
+                        exit(1);
+                }
+                if (stat(fname, &s)) {
+                        fprintf(stderr, "Error: /bin/cp not found\n");
+                        exit(1);
+                }
+                int rv = copy_file(fname, CP_COMMAND);
+                if (rv) {
+                        fprintf(stderr, "Error: cannot access /bin/cp\n");
+                        exit(1);
+                }
+                if (chmod(CP_COMMAND, 0755))
+                        errExit("chmod");
+                        
+                free(fname);
+        }
+}
+
+// delete the temporary cp command
+void fs_delete_cp_command(void) {
+        unlink(CP_COMMAND);
+}
+
 //***********************************************
 // process profile file
 //***********************************************
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 668223755..0105716b2 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -137,7 +137,7 @@ static void duplicate(char *fname) {
         char *actual_path = realpath(full_path, NULL);
         if (actual_path) {
                 // copy the file
-                if (asprintf(&cmd, "cp -a %s %s/%s", actual_path, BIN_DIR, fname) == -1)
+                if (asprintf(&cmd, "%s -a %s %s/%s", CP_COMMAND, actual_path, BIN_DIR, fname) == -1)
                         errExit("asprintf");
                 if (arg_debug)
                         printf("%s\n", cmd);
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 8e5fe1b86..617d45d06 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -76,7 +76,7 @@ static void duplicate(char *fname) {
         char *cmd;
 
         // copy the file
-        if (asprintf(&cmd, "cp -a --parents /etc/%s %s", fname, MNT_DIR) == -1)
+        if (asprintf(&cmd, "%s -a --parents /etc/%s %s", CP_COMMAND, fname, MNT_DIR) == -1)
                 errExit("asprintf");
         if (arg_debug)
                 printf("%s\n", cmd);
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 1144e90e8..2cbb59e69 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -376,7 +376,7 @@ static void duplicate(char *name) {
         }
 
         // copy the file
-        if (asprintf(&cmd, "cp -a --parents \"%s\" %s", fname, HOME_DIR) == -1)
+        if (asprintf(&cmd, "%s -a --parents \"%s\" %s", CP_COMMAND, fname, HOME_DIR) == -1)
                 errExit("asprintf");
         if (arg_debug)
                 printf("%s\n", cmd);
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 6eab5fc4e..51ca2daf5 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -170,6 +170,8 @@ int sandbox(void* sandbox_arg) {
                 netfilter(arg_netfilter_file);
         }
 
+        fs_build_cp_command();
+        
         //****************************
         // trace pre-install
         //****************************
@@ -365,6 +367,8 @@ int sandbox(void* sandbox_arg) {
                         printf("\n");
                 }
         }
+        
+        fs_delete_cp_command();
 
         //****************************
         // start executable