Merge pull request #1004 from thewisenerd/patch-multiple-private-argv

allow multiple private-argv

2 files changed, 62 insertions, 14 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index c74fb02d2..e70e20eec 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1509,7 +1509,15 @@ int main(int argc, char **argv) {
                                 }
                                 
                                 // extract private home dirname
-                                cfg.home_private_keep = argv[i] + 15;
+                                if (*(argv[i] + 15) == '\0') {
+                                        fprintf(stderr, "Error: invalid private-home option\n");
+                                        exit(1);
+                                }
+                                if (cfg.home_private_keep) {
+                                        if ( asprintf(&cfg.home_private_keep, "%s,%s", cfg.home_private_keep, argv[i] + 15) < 0 )
+                                                errExit("asprintf");
+                                } else
+                                        cfg.home_private_keep = argv[i] + 15;
                                 arg_private = 1;
                         }
                         else
@@ -1526,38 +1534,54 @@ int main(int argc, char **argv) {
                         }
                         
                         // extract private etc list
-                        cfg.etc_private_keep = argv[i] + 14;
-                        if (*cfg.etc_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-etc option\n");
                                 exit(1);
                         }
+                        if (cfg.etc_private_keep) {
+                                if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.etc_private_keep = argv[i] + 14;
                         arg_private_etc = 1;
                 }
                 else if (strncmp(argv[i], "--private-opt=", 14) == 0) {
                         // extract private opt list
-                        cfg.opt_private_keep = argv[i] + 14;
-                        if (*cfg.opt_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-opt option\n");
                                 exit(1);
                         }
+                        if (cfg.opt_private_keep) {
+                                if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.opt_private_keep = argv[i] + 14;
                         arg_private_opt = 1;
                 }
                 else if (strncmp(argv[i], "--private-srv=", 14) == 0) {
                         // extract private srv list
-                        cfg.srv_private_keep = argv[i] + 14;
-                        if (*cfg.srv_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-etc option\n");
                                 exit(1);
                         }
+                        if (cfg.srv_private_keep) {
+                                if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.srv_private_keep = argv[i] + 14;
                         arg_private_srv = 1;
                 }
                 else if (strncmp(argv[i], "--private-bin=", 14) == 0) {
                         // extract private bin list
-                        cfg.bin_private_keep = argv[i] + 14;
-                        if (*cfg.bin_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-bin option\n");
                                 exit(1);
                         }
+                        if (cfg.bin_private_keep) {
+                                if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.bin_private_keep = argv[i] + 14;
                         arg_private_bin = 1;
                 }
                 else if (strcmp(argv[i], "--private-tmp") == 0) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index da3daf95a..fab4f1efa 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -179,7 +179,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         if (strncmp(ptr, "private-home ", 13) == 0) {
 #ifdef HAVE_PRIVATE_HOME
                 if (checkcfg(CFG_PRIVATE_HOME)) {
-                        cfg.home_private_keep = ptr + 13;
+                        if (cfg.home_private_keep) {
+                                if ( asprintf(&cfg.home_private_keep, "%s,%s", cfg.home_private_keep, ptr + 13) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.home_private_keep = ptr + 13;
                         arg_private = 1;
                 }
                 else
@@ -748,7 +752,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
                         exit(1);
                 }
-                cfg.etc_private_keep = ptr + 12;
+                if (cfg.etc_private_keep) {
+                        if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.etc_private_keep = ptr + 12;
+                }
                 arg_private_etc = 1;
                 
                 return 0;
@@ -756,7 +765,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /opt list of files and directories
         if (strncmp(ptr, "private-opt ", 12) == 0) {
-                cfg.opt_private_keep = ptr + 12;
+                if (cfg.opt_private_keep) {
+                        if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.opt_private_keep = ptr + 12;
+                }
                 arg_private_opt = 1;
                 
                 return 0;
@@ -764,7 +778,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /srv list of files and directories
         if (strncmp(ptr, "private-srv ", 12) == 0) {
-                cfg.srv_private_keep = ptr + 12;
+                if (cfg.srv_private_keep) {
+                        if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.srv_private_keep = ptr + 12;
+                }
                 arg_private_srv = 1;
                 
                 return 0;
@@ -772,7 +791,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /bin list of files
         if (strncmp(ptr, "private-bin ", 12) == 0) {
-                cfg.bin_private_keep = ptr + 12;
+                if (cfg.bin_private_keep) {
+                        if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.bin_private_keep = ptr + 12;
+                }
                 arg_private_bin = 1;
                 return 0;
         }