--writable-run-user, solving ssh/gnupg authentication problems for smarcards

10 files changed, 65 insertions, 30 deletions

diff --git a/README.md b/README.md
index 26055300b..255384e2e 100644
--- a/README.md
+++ b/README.md
@@ -96,8 +96,14 @@ Use this issue to request new profiles: [#1139](https://github.com/netblue30/fir
 `````
 
 `````
-# 0.9.50 release pending
+# Current development version: 0.9.51
 
-Development moved on  0.9.50-bugfixes branch: https://github.com/netblue30/firejail/tree/0.9.50-bugfixes
+## New command line options
+`````
+      --writable-run-user
+              This    options    disables   the   default   blacklisting   of
+              run/user/$UID/systemd and /run/user/$UID/gnupg.
 
-# Current development version: 0.9.51
+              Example:
+              $ sudo firejail --writable-run-user
+`````
diff --git a/RELNOTES b/RELNOTES
index eea0d4a3a..85c554b32 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,6 +1,7 @@
 firejail (0.9.51) baseline; urgency=low
   * work in progress!
- -- netblue30 <netblue30@yahoo.com>  Mon, 12 Jun 2017 20:00:00 -0500
+  * feature: --writable-run-user
+ -- netblue30 <netblue30@yahoo.com>  Thu, 14 Sep 2017 20:00:00 -0500
 
 firejail (0.9.50~rc1) baseline; urgency=low
   * release pending!
diff --git a/etc/ssh-agent.profile b/etc/ssh-agent.profile
index ba5115521..7e9d34c92 100644
--- a/etc/ssh-agent.profile
+++ b/etc/ssh-agent.profile
@@ -25,3 +25,4 @@ noroot
 notv
 protocol unix,inet,inet6
 seccomp
+writable-run-user
diff --git a/etc/ssh.profile b/etc/ssh.profile
index 6cf33318a..7ac0b8417 100644
--- a/etc/ssh.profile
+++ b/etc/ssh.profile
@@ -35,3 +35,5 @@ private-dev
 memory-deny-write-execute
 noexec ${HOME}
 noexec /tmp
+writable-run-user
+
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 75450fe0f..0ab27e89b 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -353,6 +353,7 @@ extern int arg_nice;		// nice value configured
 extern int arg_ipc;             // enable ipc namespace
 extern int arg_writable_etc;    // writable etc
 extern int arg_writable_var;    // writable var
+extern int arg_writable_run_user;       // writable /run/user
 extern int arg_writable_var_log; // writable /var/log
 extern int arg_appimage;        // appimage
 extern int arg_audit;           // audit
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 6695fc6b4..0ea71e6ba 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -582,33 +582,35 @@ void fs_proc_sys_dev_boot(void) {
 
 
         // disable various ipc sockets in /run/user
-        struct stat s;
-
-        char *fname;
-        if (asprintf(&fname, "/run/user/%d", getuid()) == -1)
-                errExit("asprintf");
-        if (is_dir(fname)) { // older distros don't have this directory
-                // disable /run/user/{uid}/gnupg
-                char *fnamegpg;
-                if (asprintf(&fnamegpg, "/run/user/%d/gnupg", getuid()) == -1)
-                        errExit("asprintf");
-                if (stat(fnamegpg, &s) == -1)
-                    mkdir_attr(fnamegpg, 0700, getuid(), getgid());
-                if (stat(fnamegpg, &s) == 0)
-                        disable_file(BLACKLIST_FILE, fnamegpg);
-                free(fnamegpg);
-
-                // disable /run/user/{uid}/systemd
-                char *fnamesysd;
-                if (asprintf(&fnamesysd, "/run/user/%d/systemd", getuid()) == -1)
+        if (!arg_writable_run_user) {
+                struct stat s;
+        
+                char *fname;
+                if (asprintf(&fname, "/run/user/%d", getuid()) == -1)
                         errExit("asprintf");
-                if (stat(fnamesysd, &s) == -1)
-                        mkdir_attr(fnamesysd, 0755, getuid(), getgid());
-                if (stat(fnamesysd, &s) == 0)
-                        disable_file(BLACKLIST_FILE, fnamesysd);
-                free(fnamesysd);
+                if (is_dir(fname)) { // older distros don't have this directory
+                        // disable /run/user/{uid}/gnupg
+                        char *fnamegpg;
+                        if (asprintf(&fnamegpg, "/run/user/%d/gnupg", getuid()) == -1)
+                                errExit("asprintf");
+                        if (stat(fnamegpg, &s) == -1)
+                            mkdir_attr(fnamegpg, 0700, getuid(), getgid());
+                        if (stat(fnamegpg, &s) == 0)
+                                disable_file(BLACKLIST_FILE, fnamegpg);
+                        free(fnamegpg);
+        
+                        // disable /run/user/{uid}/systemd
+                        char *fnamesysd;
+                        if (asprintf(&fnamesysd, "/run/user/%d/systemd", getuid()) == -1)
+                                errExit("asprintf");
+                        if (stat(fnamesysd, &s) == -1)
+                                mkdir_attr(fnamesysd, 0755, getuid(), getgid());
+                        if (stat(fnamesysd, &s) == 0)
+                                disable_file(BLACKLIST_FILE, fnamesysd);
+                        free(fnamesysd);
+                }
+                free(fname);
         }
-        free(fname);
 
         if (getuid() != 0) {
                 // disable /dev/kmsg and /proc/kmsg
diff --git a/src/firejail/main.c b/src/firejail/main.c
index c317aa477..399770142 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -100,6 +100,8 @@ int arg_nice = 0;				// nice value configured
 int arg_ipc = 0;                                        // enable ipc namespace
 int arg_writable_etc = 0;                       // writable etc
 int arg_writable_var = 0;                       // writable var
+int arg_writable_run_user = 0;                  // writable /run/user
+int arg_writable_var_log = 0;           // writable /var/log
 int arg_appimage = 0;                           // appimage
 int arg_audit = 0;                              // audit
 char *arg_audit_prog = NULL;                    // audit
@@ -110,7 +112,6 @@ int arg_x11_xorg = 0;				// use X11 security extention
 int arg_allusers = 0;                           // all user home directories visible
 int arg_machineid = 0;                          // preserve /etc/machine-id
 int arg_allow_private_blacklist = 0;            // blacklist things in private directories
-int arg_writable_var_log = 0;           // writable /var/log
 int arg_disable_mnt = 0;                        // disable /mnt and /media
 int arg_noprofile = 0; // use default.profile if none other found/specified
 int arg_memory_deny_write_execute = 0;          // block writable and executable memory
@@ -1560,6 +1561,9 @@ int main(int argc, char **argv) {
                 else if (strcmp(argv[i], "--writable-var") == 0) {
                         arg_writable_var = 1;
                 }
+                else if (strcmp(argv[i], "--writable-run-user") == 0) {
+                        arg_writable_run_user = 1;
+                }
                 else if (strcmp(argv[i], "--writable-var-log") == 0) {
                         arg_writable_var_log = 1;
                 }
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index e61f59f46..6880bcaa7 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -719,6 +719,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_writable_var = 1;
                 return 0;
         }
+        // writable-run-user
+        if (strcmp(ptr, "writable-run-user") == 0) {
+                arg_writable_run_user = 1;
+                return 0;
+        }
         if (strcmp(ptr, "writable-var-log") == 0) {
                 arg_writable_var_log = 1;
                 return 0;
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 050c3d7e5..14485d5c1 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -273,6 +273,9 @@ the same top directory. For user home, both the link and the real file should be
 \fBwritable-etc
 Mount /etc directory read-write.
 .TP
+\fBwritable-run-user
+Disable the default blacklisting of run/user/$UID/systemd and /run/user/$UID/gnupg.
+.TP
 \fBwritable-var
 Mount /var directory read-write.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index c9d57b87b..d317a3fa4 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1965,6 +1965,16 @@ Example:
 $ sudo firejail --writable-etc
 
 .TP
+\fB\-\-writable-run-user
+This options disables the default blacklisting of run/user/$UID/systemd and /run/user/$UID/gnupg.
+.br
+
+.br
+Example:
+.br
+$ sudo firejail --writable-run-user
+
+.TP
 \fB\-\-writable-var
 Mount /var directory read-write.
 .br