security fixes

1 files changed, 97 insertions, 21 deletions

diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index f5e545bf3..4de082b06 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -106,6 +106,14 @@ static int store_xauthority(void) {
         // put a copy of .Xauthority in XAUTHORITY_FILE
         char *src;
         char *dest = RUN_XAUTHORITY_FILE;
+        // create an empty file 
+        FILE *fp = fopen(dest, "w");
+        if (fp) {
+                fprintf(fp, "\n");
+                SET_PERMS_STREAM(fp, getuid(), getgid(), 0600);
+                fclose(fp);
+        }
+        
         if (asprintf(&src, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
         
@@ -115,12 +123,28 @@ static int store_xauthority(void) {
                         fprintf(stderr, "Warning: invalid .Xauthority file\n");
                         return 0;
                 }
-                        
-                int rv = copy_file(src, dest, -1, -1, 0600);
-                if (rv) {
-                        fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
-                        return 0;
+
+                pid_t child = fork();
+                if (child < 0)
+                        errExit("fork");
+                if (child == 0) {
+                        // drop privileges
+                        drop_privs(0);
+        
+                        // copy, set permissions and ownership
+                        int rv = copy_file(src, dest, getuid(), getgid(), 0600);
+                        if (rv)
+                                fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
+                        else {
+                                fs_logger2("clone", dest);
+                        }
+#ifdef HAVE_GCOV
+                        __gcov_flush();
+#endif
+                        _exit(0);
                 }
+                // wait for the child to finish
+                waitpid(child, NULL, 0);
                 return 1; // file copied
         }
         
@@ -130,6 +154,14 @@ static int store_xauthority(void) {
 static int store_asoundrc(void) {
         char *src;
         char *dest = RUN_ASOUNDRC_FILE;
+        // create an empty file 
+        FILE *fp = fopen(dest, "w");
+        if (fp) {
+                fprintf(fp, "\n");
+                SET_PERMS_STREAM(fp, getuid(), getgid(), 0644);
+                fclose(fp);
+        }
+        
         if (asprintf(&src, "%s/.asoundrc", cfg.homedir) == -1)
                 errExit("asprintf");
         
@@ -150,11 +182,27 @@ static int store_asoundrc(void) {
                         free(rp);
                 }
 
-                int rv = copy_file(src, dest, -1, -1, -0644);
-                if (rv) {
-                        fprintf(stderr, "Warning: cannot transfer .asoundrc in private home directory\n");
-                        return 0;
+                pid_t child = fork();
+                if (child < 0)
+                        errExit("fork");
+                if (child == 0) {
+                        // drop privileges
+                        drop_privs(0);
+        
+                        // copy, set permissions and ownership
+                        int rv = copy_file(src, dest, getuid(), getgid(), 0644);
+                        if (rv)
+                                fprintf(stderr, "Warning: cannot transfer .asoundrc in private home directory\n");
+                        else {
+                                fs_logger2("clone", dest);
+                        }
+#ifdef HAVE_GCOV
+                        __gcov_flush();
+#endif
+                        _exit(0);
                 }
+                // wait for the child to finish
+                waitpid(child, NULL, 0);
                 return 1; // file copied
         }
         
@@ -174,13 +222,27 @@ static void copy_xauthority(void) {
                 exit(1);
         }
 
-        // copy, set permissions and ownership
-        int rv = copy_file(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR);
-        if (rv)
-                fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
-        else {
-                fs_logger2("clone", dest);
+        pid_t child = fork();
+        if (child < 0)
+                errExit("fork");
+        if (child == 0) {
+                // drop privileges
+                drop_privs(0);
+
+                // copy, set permissions and ownership
+                int rv = copy_file(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR);
+                if (rv)
+                        fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
+                else {
+                        fs_logger2("clone", dest);
+                }
+#ifdef HAVE_GCOV
+                __gcov_flush();
+#endif
+                _exit(0);
         }
+        // wait for the child to finish
+        waitpid(child, NULL, 0);
         
         // delete the temporary file
         unlink(src);
@@ -199,13 +261,27 @@ static void copy_asoundrc(void) {
                 exit(1);
         }
 
-        // copy, set permissions and ownership
-        int rv = copy_file(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR);
-        if (rv)
-                fprintf(stderr, "Warning: cannot transfer .asoundrc in private home directory\n");
-        else {
-                fs_logger2("clone", dest);
+        pid_t child = fork();
+        if (child < 0)
+                errExit("fork");
+        if (child == 0) {
+                // drop privileges
+                drop_privs(0);
+
+                // copy, set permissions and ownership
+                int rv = copy_file(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR);
+                if (rv)
+                        fprintf(stderr, "Warning: cannot transfer .asoundrc in private home directory\n");
+                else {
+                        fs_logger2("clone", dest);
+                }
+#ifdef HAVE_GCOV
+                __gcov_flush();
+#endif
+                _exit(0);
         }
+        // wait for the child to finish
+        waitpid(child, NULL, 0);
 
         // delete the temporary file
         unlink(src);