private-bin and private-lib fixes

1 files changed, 23 insertions, 35 deletions

diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index a17c8dac0..364431077 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -99,16 +99,23 @@ static char *check_dir_or_file(const char *name) {
 static int valid_full_path_file(const char *name) {
         assert(name);
 
-        char *real_path = realpath(name, NULL);
-        if (!real_path)
-                goto errexit;
-        char *fname = strrchr(real_path, '/');
-        if (!fname)
-                goto errexit;
-        if (*(++fname) == '\0')
-                goto errexit;
-
-        int found = 0;
+        if (*name != '/')
+                return 0;
+        if (strstr(name, ".."))
+                return 0;
+
+        // do we have a file?
+        struct stat s;
+        if (stat(name, &s) == -1)
+                return 0;
+        // directories not allowed
+        if (S_ISDIR(s.st_mode))
+                return 0;
+        // checking access
+        if (access(name, X_OK) == -1)
+                return 0;
+
+        // check standard paths
         int i = 0;
         while (paths[i]) {
                 // private-bin-no-local can be disabled in /etc/firejail/firejail.config
@@ -117,34 +124,13 @@ static int valid_full_path_file(const char *name) {
                         continue;
                 }
 
-                // check file
-                char *path;
-                if (asprintf(&path, "%s/%s", paths[i], fname) == -1)
-                        errExit("asprintf");
-
-                if (strcmp(real_path, path) == 0) {
-                        free(path);
-                        // checking access
-                        if (access(real_path, X_OK) == 0)
-                                found = 1;
-                        break;
-                }
-
-                free(path);
+                int len = strlen(paths[i]);
+                if (strncmp(name, paths[i], len) == 0 && name[len] == '/' && name[len + 1] != '\0')
+                        return 1;
                 i++;
         }
-
-        if (!found)
-                goto errexit;
-
-        free(real_path);
-        return 1;
-
-errexit:
         if (arg_debug)
-                fwarning("file %s not found\n", name);
-        if (real_path)
-                free(real_path);
+                printf("file %s not found\n", name);
         return 0;
 }
 
@@ -205,6 +191,7 @@ static void duplicate(char *fname, FILE *fplist) {
                         char *actual_path = realpath(full_path, NULL);
                         if (actual_path) {
                                 if (valid_full_path_file(actual_path)) {
+                                        // solving problems such as /bin/sh -> /bin/dash
                                         // copy the real file pointed by symlink
                                         sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, actual_path, RUN_BIN_DIR);
                                         char *f = strrchr(actual_path, '/');
@@ -214,6 +201,7 @@ static void duplicate(char *fname, FILE *fplist) {
                                 free(actual_path);
                         }
                 }
+
                 // copy a file or a symlink
                 sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, full_path, RUN_BIN_DIR);
         }