fixed whitelist problem

3 files changed, 77 insertions, 8 deletions

diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 22b5fb0a7..0f2d6a089 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -336,6 +336,14 @@ void fs_whitelist(void) {
                 if (arg_debug)
                         fprintf(stderr, "Debug %d: new_name #%s#\n", __LINE__, new_name);
 
+                // valid path referenced to filesystem root
+                if (*new_name != '/') {
+                        if (arg_debug)
+                                fprintf(stderr, "Debug %d: \n", __LINE__);
+                        goto errexit;
+                }
+
+
                 // extract the absolute path of the file
                 // realpath function will fail with ENOENT if the file is not found
                 char *fname = realpath(new_name, NULL);
@@ -349,19 +357,27 @@ void fs_whitelist(void) {
                                 perror("realpath");
                         }
                         *entry->data = '\0';
+
+                        // if 1 the file was not found; mount an empty directory
+                        if (strncmp(new_name, cfg.homedir, strlen(cfg.homedir)) == 0)
+                                home_dir = 1;
+                        else if (strncmp(new_name, "/tmp/", 5) == 0)
+                                tmp_dir = 1;
+                        else if (strncmp(new_name, "/media/", 7) == 0)
+                                media_dir = 1;
+                        else if (strncmp(new_name, "/var/", 5) == 0)
+                                var_dir = 1;
+                        else if (strncmp(new_name, "/dev/", 5) == 0)
+                                dev_dir = 1;
+                        else if (strncmp(new_name, "/opt/", 5) == 0)
+                                opt_dir = 1;
+
                         continue;
                 }
                 
-                // valid path referenced to filesystem root
-                if (*new_name != '/') {
-                        if (arg_debug)
-                                fprintf(stderr, "Debug %d: \n", __LINE__);
-                        goto errexit;
-                }
-
                 // check for supported directories
                 if (strncmp(new_name, cfg.homedir, strlen(cfg.homedir)) == 0) {
-                        // whitelisting home directory is disabled if --private or --private-home option is present
+                        // whitelisting home directory is disabled if --private option is present
                         if (arg_private) {
                                 if (arg_debug || arg_debug_whitelists)
                                         printf("Removed whitelist path %s, --private option is present\n", entry->data);
diff --git a/test/test.sh b/test/test.sh
index 6273c0a1b..ca7152b55 100755
--- a/test/test.sh
+++ b/test/test.sh
@@ -15,6 +15,9 @@ echo "TESTING: invalid filename"
 echo "TESTING: environment variables"
 ./env.exp
 
+echo "TESTING: whitelist empty"
+./whitelist-empty.exp
+
 echo "TESTING: ignore command"
 ./ignore.exp
 
diff --git a/test/whitelist-empty.exp b/test/whitelist-empty.exp
new file mode 100755
index 000000000..226b019db
--- /dev/null
+++ b/test/whitelist-empty.exp
@@ -0,0 +1,50 @@
+#!/usr/bin/expect -f
+
+set timeout 30
+spawn $env(SHELL)
+match_max 100000
+
+send -- "firejail --whitelist=~/blablabla --whitelist=/tmp/blablabla --whitelist=/media/blablabla --whitelist=/var/blablabla --whitelist=/dev/blablabla --whitelist=/opt/blablabla\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "ls -l ~/ | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "0"
+}
+
+send -- "ls -l /tmp | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "0"
+}
+
+send -- "ls -l /media | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "0"
+}
+
+send -- "ls -l /var | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "0"
+}
+
+send -- "ls -l /dev | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "0"
+}
+send -- "ls -l /opt | wc -l\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "0"
+}
+
+
+puts "\nall done\n"