using UID_MIN/GID_MIN values from /etc/login.def

5 files changed, 38 insertions, 5 deletions

diff --git a/Makefile.in b/Makefile.in
index 3008ba703..7bb59db6e 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -66,7 +66,7 @@ distclean: clean
         for dir in $(MYLIBS); do \
                 $(MAKE) -C $$dir distclean; \
         done
-        rm -fr Makefile autom4te.cache config.log config.status config.h
+        rm -fr Makefile autom4te.cache config.log config.status config.h uids.h
 
 realinstall:
         # firejail executable
diff --git a/configure b/configure
index cd4be9296..050b4df9c 100755
--- a/configure
+++ b/configure
@@ -3673,6 +3673,9 @@ if test "$prefix" = /usr; then
         sysconfdir="/etc"
 fi
 
+# extract UID_MIN and GID_MIN from login.def
+./mkuid.sh
+
 ac_config_files="$ac_config_files Makefile src/lib/Makefile src/firejail/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/ftee/Makefile src/faudit/Makefile"
 
 cat >confcache <<\_ACEOF
@@ -4861,6 +4864,9 @@ echo "   X11 sandboxing support: $HAVE_X11"
 echo "   whitelisting: $HAVE_WHITELIST"
 echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
+printf "   uid_min: "; grep UID_MIN uids.h
+printf "   gid_min: "; grep GID_MIN uids.h
 echo
 
 
+
diff --git a/configure.ac b/configure.ac
index c22228d0f..a84396ad4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -106,6 +106,9 @@ if test "$prefix" = /usr; then
         sysconfdir="/etc"
 fi
 
+# extract UID_MIN and GID_MIN from login.def
+./mkuid.sh
+
 AC_OUTPUT(Makefile src/lib/Makefile src/firejail/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/ftee/Makefile src/faudit/Makefile)
 
 echo
@@ -123,6 +126,9 @@ echo "   X11 sandboxing support: $HAVE_X11"
 echo "   whitelisting: $HAVE_WHITELIST"
 echo "   file transfer support: $HAVE_FILE_TRANSFER"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
+printf "   uid_min: "; grep UID_MIN uids.h
+printf "   gid_min: "; grep GID_MIN uids.h
 echo
 
 
+
diff --git a/mkuid.sh b/mkuid.sh
new file mode 100755
index 000000000..f03fdaf94
--- /dev/null
+++ b/mkuid.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+
+echo "extracting UID_MIN and GID_MIN"
+echo "#ifndef FIREJAIL_UIDS_H" > uids.h
+echo "#define FIREJAIL_UIDS_H" >> uids.h
+
+if [ -f /etc/login.defs ]
+then
+        echo "// using values extracted from /etc/login.defs" >> uids.h
+        UID_MIN=`awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs`
+        GID_MIN=`awk '/^\s*GID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs`
+        echo "#define UID_MIN $UID_MIN" >> uids.h
+        echo "#define GID_MIN $GID_MIN" >> uids.h
+else
+        echo "// using default values" >> uids.h
+        echo "#define UID_MIN 1000" >> uids.h
+        echo "#define GID_MIN 1000" >> uids.h
+fi
+
+echo "#endif" >> uids.h
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index 5a41c441b..de798037f 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -26,6 +26,7 @@
 #include <dirent.h>
 #include <fcntl.h>
 #include <errno.h>
+#include "../../uids.h"
 
 #define MAXBUF 1024
 
@@ -118,7 +119,7 @@ static void sanitize_passwd(void) {
         if (stat("/etc/passwd", &s) == -1)
                 return;
         if (arg_debug)
-                printf("Sanitizing /etc/passwd\n");
+                printf("Sanitizing /etc/passwd, UID_MIN %d\n", UID_MIN);
         if (is_link("/etc/passwd")) {
                 fprintf(stderr, "Error: invalid /etc/passwd\n");
                 exit(1);
@@ -170,7 +171,7 @@ static void sanitize_passwd(void) {
                 int rv = sscanf(ptr, "%d:", &uid);
                 if (rv == 0 || uid < 0)
                         goto errout;
-                if (uid < 1000) { // todo extract UID_MIN from /etc/login.def
+                if (uid < UID_MIN) {
                         fprintf(fpout, "%s", buf);
                         continue;
                 }
@@ -255,7 +256,7 @@ static void sanitize_group(void) {
         if (stat("/etc/group", &s) == -1)
                 return;
         if (arg_debug)
-                printf("Sanitizing /etc/group\n");
+                printf("Sanitizing /etc/group, GID_MIN %d\n", GID_MIN);
         if (is_link("/etc/group")) {
                 fprintf(stderr, "Error: invalid /etc/group\n");
                 exit(1);
@@ -306,7 +307,7 @@ static void sanitize_group(void) {
                 int rv = sscanf(ptr, "%d:", &gid);
                 if (rv == 0 || gid < 0)
                         goto errout;
-                if (gid < 1000) { // todo extract GID_MIN from /etc/login.def
+                if (gid < GID_MIN) {
                         if (copy_line(fpout, buf, ptr))
                                 goto errout;
                         continue;