Fix symlinks that go though /proc/self

When constructing sandbox fs, /etc/mtab which is symlink to
/proc/self/mounts gets resolved as /proc/PID/mounts. Where
PID is not the pid of the process that is going to get
executed in the firejail -> the result is broken/unaccessible
symlink from the application point of view.

Use /proc/self/xxx type symlink target if it resolves similarly
as the /proc/PID/xxx type would at the time of mapping.

Signed-off-by: Simo Piiroinen <simo.piiroinen@jolla.com>
Signed-off-by: Tomi Leppänen <tomi.leppanen@jolla.com>

1 files changed, 42 insertions, 1 deletions

diff --git a/src/fcopy/main.c b/src/fcopy/main.c
index 01633be59..a41df52a1 100644
--- a/src/fcopy/main.c
+++ b/src/fcopy/main.c
@@ -172,6 +172,47 @@ static void mkdir_attr(const char *fname, mode_t mode, uid_t uid, gid_t gid) {
         }
 }
 
+static char *proc_pid_to_self(const char *target)
+{
+        char *use_target = 0;
+        char *proc_pid = 0;
+
+        if (!(use_target = canonicalize_file_name(target)))
+                goto done;
+
+        // target is under /proc/<PID>?
+        static const char proc[] = "/proc/";
+        if (strncmp(use_target, proc, sizeof proc - 1))
+                goto done;
+
+        int digit = use_target[sizeof proc - 1];
+        if (digit < '1' || digit > '9')
+                goto done;
+
+        // check where /proc/self points to
+        static const char proc_self[] = "/proc/self";
+        if (!(proc_pid = canonicalize_file_name(proc_self)))
+                goto done;
+
+        // redirect /proc/PID/xxx -> /proc/self/XXX
+        size_t pfix = strlen(proc_pid);
+        if (strncmp(use_target, proc_pid, pfix))
+                goto done;
+
+        if (use_target[pfix] != 0 && use_target[pfix] != '/')
+                goto done;
+
+        char *tmp;
+        if (asprintf(&tmp, "%s%s", proc_self, use_target + pfix) != -1) {
+                if (arg_debug)
+                        fprintf(stderr, "SYMLINK %s\n  -->   %s\n", use_target, tmp);
+                free(use_target), use_target = tmp;
+        }
+
+done:
+        free(proc_pid);
+        return use_target;
+}
 
 void copy_link(const char *target, const char *linkpath, mode_t mode, uid_t uid, gid_t gid) {
         (void) mode;
@@ -183,7 +224,7 @@ void copy_link(const char *target, const char *linkpath, mode_t mode, uid_t uid,
         if (lstat(linkpath, &s) == 0)
                return;
 
-        char *rp = realpath(target, NULL);
+        char *rp = proc_pid_to_self(target);
         if (rp) {
                 if (symlink(rp, linkpath) == -1) {
                         free(rp);