clean local overlay storage directory (--overlay-clean)

6 files changed, 47 insertions, 3 deletions

diff --git a/RELNOTES b/RELNOTES
index da53398de..eb49768d4 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -4,6 +4,7 @@ firejail (0.9.38.1) baseline; urgency=low
   * security: disable x32 ABI, submitted by Jann Horn
   * security: tighten --chroot, submitted by Jann Horn
   * security: terminal sandbox escape, submitted by Stephan Sokolow
+  * feature: clean local overlay storage directory (--overlay-clean)
  -- netblue30 <netblue30@yahoo.com>  Fri, 12 Aug 2016 10:00:00 -0500
 
 firejail (0.9.38) baseline; urgency=low
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 39bc2beeb..5104bd688 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -357,6 +357,7 @@ char *expand_home(const char *path, const char* homedir);
 const char *gnu_basename(const char *path);
 uid_t pid_get_uid(pid_t pid);
 void invalid_filename(const char *fname);
+int remove_directory(const char *path);
 
 // fs_var.c
 void fs_var_log(void);  // mounting /var/log
diff --git a/src/firejail/main.c b/src/firejail/main.c
index bcddaf7ab..c28dba16b 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -245,6 +245,21 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 printf("firejail version %s\n", VERSION);
                 exit(0);
         }
+        else if (strcmp(argv[i], "--overlay-clean") == 0) {
+                char *path;
+                if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1)
+                        errExit("asprintf");
+                if (setreuid(0, 0) < 0)
+                        errExit("setreuid");
+                if (setregid(0, 0) < 0)
+                        errExit("setregid");
+                errno = 0;
+                int rv = remove_directory(path);
+                if (rv) {
+                        fprintf(stderr, "Error: cannot removed overlays stored in ~/.firejail directory, errno %d\n", errno);
+                        exit(1);
+                }
+        }
 #ifdef HAVE_NETWORK     
         else if (strncmp(argv[i], "--bandwidth=", 12) == 0) {
                 logargs(argc, argv);
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 323884c89..9cb97187e 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -355,9 +355,6 @@ int sandbox(void* sandbox_arg) {
 #ifdef HAVE_CHROOT              
         if (cfg.chrootdir) {
                 fs_chroot(cfg.chrootdir);
-                // redo cp command
-//              fs_build_cp_command();
-                
                 // force caps and seccomp if not started as root
                 if (getuid() != 0) {
                         // force default seccomp inside the chroot, no keep or drop list
diff --git a/src/firejail/util.c b/src/firejail/util.c
index d7964ccb8..f72df9fc6 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -24,6 +24,7 @@
 #include <errno.h>
 #include <dirent.h>
 #include <grp.h>
+#include <ftw.h>
 
 #define MAX_GROUPS 1024
 // drop privileges
@@ -615,3 +616,21 @@ void invalid_filename(const char *fname) {
                 exit(1);
         }
 }
+
+static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) {
+        (void) sb;
+        (void) typeflag;
+        (void) ftwbuf;
+        
+        int rv = remove(fpath);
+        if (rv)
+                perror(fpath);
+
+        return rv;
+}
+
+
+int remove_directory(const char *path) {
+        // FTW_PHYS - do not follow symbolic links
+        return nftw(path, remove_callback, 64, FTW_DEPTH | FTW_PHYS);
+}
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index ee019a24f..0adb72151 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -921,6 +921,17 @@ Example:
 $ firejail \-\-overlay-tmpfs firefox
 
 .TP
+\fB\-\-overlay-clean
+Clean all overlays stored in $HOME/.firejail directory. Overlays created with --overlay-path=path
+outside $HOME/.firejail will not be deleted.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-overlay-clean
+
+.TP
 \fB\-\-private
 Mount new /root and /home/user directories in temporary
 filesystems. All modifications are discarded when the sandbox is