deprecated --private-home feature

8 files changed, 0 insertions, 266 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 2a7ff4104..39bc2beeb 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -123,7 +123,6 @@ typedef struct config_t {
         char *profile_ignore[MAX_PROFILE_IGNORE];
         char *chrootdir;        // chroot directory
         char *home_private;     // private home directory
-        char *home_private_keep;        // keep list for private home directory
         char *etc_private_keep; // keep list for private etc directory
         char *bin_private_keep; // keep list for private bin directory
         char *cwd;              // current working directory
@@ -378,10 +377,6 @@ void fs_private_dev(void);
 void fs_private(void);
 // private mode (--private=homedir)
 void fs_private_homedir(void);
-// private mode (--private-home=list)
-void fs_private_home_list(void);
-// check directory list specified by user (--private-home option) - exit if it fails
-void fs_check_home_list(void);
 // check new private home directory (--private= option) - exit if it fails
 void fs_check_private_dir(void);
 
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index ad849da3f..2bfabbe89 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -335,74 +335,6 @@ void fs_private(void) {
                 copy_asoundrc();
 }
 
-static void check_dir_or_file(const char *name) {
-        assert(name);
-        struct stat s;
-        
-        invalid_filename(name);
-        
-        
-        char *fname = expand_home(name, cfg.homedir);
-        if (!fname) {
-                fprintf(stderr, "Error: file %s not found.\n", name);
-                exit(1);
-        }
-        if (fname[0] != '/') {
-                // If it doesn't start with '/', it must be relative to homedir
-                char* tmp;
-                if (asprintf(&tmp, "%s/%s", cfg.homedir, fname) == -1)
-                        errExit("asprintf");
-                free(fname);
-                fname = tmp;
-        }
-        if (arg_debug)
-                printf("Checking %s\n", fname);         
-        if (stat(fname, &s) == -1) {
-                fprintf(stderr, "Error: file %s not found.\n", fname);
-                exit(1);
-        }
-        
-        // check uid
-        uid_t uid = getuid();
-        gid_t gid = getgid();
-        if (s.st_uid != uid || s.st_gid != gid) {
-                fprintf(stderr, "Error: only files or directories created by the current user are allowed.\n");
-                exit(1);
-        }
-
-        // dir or regular file
-        if (S_ISDIR(s.st_mode) || S_ISREG(s.st_mode)) {
-                free(fname);
-                return;
-        }
-
-        if (!is_link(fname)) {
-                free(fname);
-                return;
-        }
-        
-        fprintf(stderr, "Error: invalid file type, %s.\n", fname);
-        exit(1);
-}
-
-// check directory list specified by user (--private-home option) - exit if it fails
-void fs_check_home_list(void) {
-        if (strstr(cfg.home_private_keep, "..")) {
-                fprintf(stderr, "Error: invalid private-home list\n");
-                exit(1);
-        }
-        
-        char *dlist = strdup(cfg.home_private_keep);
-        if (!dlist)
-                errExit("strdup");
-
-        char *ptr = strtok(dlist, ",");
-        check_dir_or_file(ptr);
-        while ((ptr = strtok(NULL, ",")) != NULL)
-                check_dir_or_file(ptr);
-        
-        free(dlist);
-}
 
 // check new private home directory (--private= option) - exit if it fails
 void fs_check_private_dir(void) {
@@ -441,143 +373,3 @@ void fs_check_private_dir(void) {
         }
 }
 
-
-static void duplicate(char *name) {
-        char *cmd;
-        
-        char *fname = expand_home(name, cfg.homedir);
-        if (!fname) {
-                fprintf(stderr, "Error: file %s not found.\n", name);
-                exit(1);
-        }
-        if (fname[0] != '/') {
-                // If it doesn't start with '/', it must be relative to homedir
-                char* tmp;
-                if (asprintf(&tmp, "%s/%s", cfg.homedir, fname) == -1)
-                        errExit("asprintf");
-                free(fname);
-                fname = tmp;
-        }
-
-        // copy the file
-        if (asprintf(&cmd, "%s -a --parents \"%s\" %s", RUN_CP_COMMAND, fname, RUN_HOME_DIR) == -1)
-                errExit("asprintf");
-        if (arg_debug)
-                printf("%s\n", cmd);
-        if (system(cmd))
-                errExit("system cp -a --parents");
-        fs_logger2("clone", fname);
-        free(cmd);
-        free(fname);
-}
-
-
-// private mode (--private-home=list):
-//      mount homedir on top of /home/user,
-//      tmpfs on top of  /root in nonroot mode,
-//      tmpfs on top of /tmp in root mode,
-//      set skel files,
-//      restore .Xauthority
-void fs_private_home_list(void) {
-        char *homedir = cfg.homedir;
-        char *private_list = cfg.home_private_keep;
-        assert(homedir);
-        assert(private_list);
-        
-        int xflag = store_xauthority();
-        int aflag = store_asoundrc();
-        
-        uid_t u = getuid();
-        gid_t g = getgid();
-        struct stat s;
-        if (stat(homedir, &s) == -1) {
-                fprintf(stderr, "Error: cannot find user home directory\n");
-                exit(1);
-        }
-
-        // create /tmp/firejail/mnt/home directory
-        fs_build_mnt_dir();
-        int rv = mkdir(RUN_HOME_DIR, 0755);
-        if (rv == -1)
-                errExit("mkdir");
-        if (chown(RUN_HOME_DIR, u, g) < 0)
-                errExit("chown");
-        if (chmod(RUN_HOME_DIR, 0755) < 0)
-                errExit("chmod");
-
-        
-        // copy the list of files in the new home directory
-        // using a new child process without root privileges
-        fs_logger_print();      // save the current log
-        pid_t child = fork();
-        if (child < 0)
-                errExit("fork");
-        if (child == 0) {
-                if (arg_debug)
-                        printf("Copying files in the new home:\n");
-                
-                // drop privileges
-                if (setgroups(0, NULL) < 0)
-                        errExit("setgroups");
-                if (setgid(getgid()) < 0)
-                        errExit("setgid/getgid");
-                if (setuid(getuid()) < 0)
-                        errExit("setuid/getuid");
-                
-                // copy the list of files in the new home directory
-                char *dlist = strdup(cfg.home_private_keep);
-                if (!dlist)
-                        errExit("strdup");
-                
-                char *ptr = strtok(dlist, ",");
-                duplicate(ptr);
-        
-                while ((ptr = strtok(NULL, ",")) != NULL)
-                        duplicate(ptr);
-                free(dlist);    
-                fs_logger_print();
-                exit(0);
-        }
-        // wait for the child to finish
-        waitpid(child, NULL, 0);
-
-        // mount bind private_homedir on top of homedir
-        char *newhome;
-        if (asprintf(&newhome, "%s%s", RUN_HOME_DIR, cfg.homedir) == -1)
-                errExit("asprintf");
-
-        if (arg_debug)
-                printf("Mount-bind %s on top of %s\n", newhome, homedir);
-        if (mount(newhome, homedir, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mount bind");
-        fs_logger2("mount", homedir);
-// preserve mode and ownership
-//      if (chown(homedir, s.st_uid, s.st_gid) == -1)
-//              errExit("mount-bind chown");
-//      if (chmod(homedir, s.st_mode) == -1)
-//              errExit("mount-bind chmod");
-
-        if (u != 0) {
-                // mask /root
-                if (arg_debug)
-                        printf("Mounting a new /root directory\n");
-                if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=700,gid=0") < 0)
-                        errExit("mounting home directory");
-                fs_logger("mount tmpfs on /root");
-        }
-        else {
-                // mask /home
-                if (arg_debug)
-                        printf("Mounting a new /home directory\n");
-                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
-                        errExit("mounting home directory");
-                fs_logger("mount tmpfs on /home");
-        }
-
-        skel(homedir, u, g);
-        if (xflag)
-                copy_xauthority();
-        if (aflag)
-                copy_asoundrc();
-}
-
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 2c63bf7b0..1597a7efc 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -891,11 +891,6 @@ int main(int argc, char **argv) {
                 else if (strcmp(argv[i], "--private") == 0)
                         arg_private = 1;
                 else if (strncmp(argv[i], "--private=", 10) == 0) {
-                        if (cfg.home_private_keep) {
-                                fprintf(stderr, "Error: a private list of files was already defined with --private-home option.\n");
-                                exit(1);
-                        }
-                        
                         // extract private home dirname
                         cfg.home_private = argv[i] + 10;
                         if (*cfg.home_private == '\0') {
@@ -905,21 +900,6 @@ int main(int argc, char **argv) {
                         fs_check_private_dir();
                         arg_private = 1;
                 }
-                else if (strncmp(argv[i], "--private-home=", 15) == 0) {
-                        if (cfg.home_private) {
-                                fprintf(stderr, "Error: a private home directory was already defined with --private option.\n");
-                                exit(1);
-                        }
-                        
-                        // extract private home dirname
-                        cfg.home_private_keep = argv[i] + 15;
-                        if (*cfg.home_private_keep == '\0') {
-                                fprintf(stderr, "Error: invalid private-home option\n");
-                                exit(1);
-                        }
-                        fs_check_home_list();
-                        arg_private = 1;
-                }
                 else if (strcmp(argv[i], "--private-dev") == 0) {
                         arg_private_dev = 1;
                 }
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index bbdeafd60..bbec17447 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -304,14 +304,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
-        // private home list of files and directories
-        if (strncmp(ptr, "private-home ", 13) == 0) {
-                cfg.home_private_keep = ptr + 13;
-                fs_check_home_list();
-                arg_private = 1;
-                return 0;
-        }
-        
         // private /etc list of files and directories
         if (strncmp(ptr, "private-etc ", 12) == 0) {
                 cfg.etc_private_keep = ptr + 12;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index a876f6b5f..0ad8e2f65 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -412,8 +412,6 @@ int sandbox(void* sandbox_arg) {
         if (arg_private) {
                 if (cfg.home_private)   // --private=
                         fs_private_homedir();
-                else if (cfg.home_private_keep) // --private-home=
-                        fs_private_home_list();
                 else // --private
                         fs_private();
         }
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index dcd6a388e..b773cc146 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -221,11 +221,6 @@ void usage(void) {
         printf("\t\tand copy the programs in the list. The same directory is\n");
         printf("\t\talso bind-mounted over /sbin, /usr/bin and /usr/sbin.\n\n");
 
-        printf("\t--private-home=file,directory - build a new user home in a temporary\n");
-        printf("\t\tfilesystem, and copy the files and directories in the list in\n");
-        printf("\t\tthe new home. All modifications are discarded when the sandbox\n");
-        printf("\t\tis closed.\n\n");
-
         printf("\t--private-dev - create a new /dev directory. Only dri, null, full, zero,\n");
         printf("\t\tty, pst, ptms, random, urandom, log and shm devices are\n");
         printf("\t\tavailable.\n\n");
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 90c59d753..1e8555d9c 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -146,12 +146,6 @@ Use directory as user home.
 Build a new /bin in a temporary filesystem, and copy the programs in the list.
 The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin.
 .TP
-\fBprivate-home file,directory
-Build a new user home in a temporary
-filesystem, and copy the files and directories in the list in the
-new home. All modifications are discarded when the sandbox is
-closed.
-.TP
 \fBprivate-dev
 Create a new /dev directory. Only dri, null, full, zero, tty, pts, ptmx, random, urandom, log and shm devices are available.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index e60ecadaa..ee019a24f 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -961,18 +961,6 @@ $ ls /bin
 bash  cat  ls  sed
 
 .TP
-\fB\-\-private-home=file,directory
-Build a new user home in a temporary
-filesystem, and copy the files and directories in the list in the
-new home. All modifications are discarded when the sandbox is
-closed.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-private-home=.mozilla firefox
-.TP
 \fB\-\-private-dev
 Create a new /dev directory. Only dri, null, full, zero, tty, pts, ptmx, random, urandom, log and shm devices are available.
 .br