diff options
author | 2018-01-31 09:22:36 -0500 | |
---|---|---|
committer | 2018-01-31 09:22:36 -0500 | |
commit | 00b6315c91893c3316686fa9d71350690d506b56 (patch) | |
tree | 86a431ef4ca848240ff42ad4c4ec871b4a579516 /src/firejail/main.c | |
parent | fix cd/dvd for dragon (diff) | |
download | firejail-00b6315c91893c3316686fa9d71350690d506b56.tar.gz firejail-00b6315c91893c3316686fa9d71350690d506b56.tar.zst firejail-00b6315c91893c3316686fa9d71350690d506b56.zip |
overlay fixes and additional hardening
Diffstat (limited to 'src/firejail/main.c')
-rw-r--r-- | src/firejail/main.c | 27 |
1 files changed, 17 insertions, 10 deletions
diff --git a/src/firejail/main.c b/src/firejail/main.c index 00e3729d0..7543c5f4b 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -314,16 +314,10 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
314 | #ifdef HAVE_OVERLAYFS | 314 | #ifdef HAVE_OVERLAYFS |
315 | else if (strcmp(argv[i], "--overlay-clean") == 0) { | 315 | else if (strcmp(argv[i], "--overlay-clean") == 0) { |
316 | if (checkcfg(CFG_OVERLAYFS)) { | 316 | if (checkcfg(CFG_OVERLAYFS)) { |
317 | char *path; | 317 | if (remove_overlay_directory()) { |
318 | if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1) | 318 | fprintf(stderr, "Error: cannot remove overlay directory\n"); |
319 | errExit("asprintf"); | 319 | exit(1); |
320 | EUID_ROOT(); | 320 | } |
321 | if (setreuid(0, 0) < 0 || | ||
322 | setregid(0, 0) < 0) | ||
323 | errExit("setreuid/setregid"); | ||
324 | errno = 0; | ||
325 | if (remove_directory(path)) | ||
326 | errExit("remove_directory"); | ||
327 | } | 321 | } |
328 | else | 322 | else |
329 | exit_err_feature("overlayfs"); | 323 | exit_err_feature("overlayfs"); |
@@ -1429,6 +1423,11 @@ int main(int argc, char **argv) { | |||
1429 | #ifdef HAVE_OVERLAYFS | 1423 | #ifdef HAVE_OVERLAYFS |
1430 | else if (strcmp(argv[i], "--overlay") == 0) { | 1424 | else if (strcmp(argv[i], "--overlay") == 0) { |
1431 | if (checkcfg(CFG_OVERLAYFS)) { | 1425 | if (checkcfg(CFG_OVERLAYFS)) { |
1426 | if (arg_overlay) { | ||
1427 | fprintf(stderr, "Error: only one overlay command is allowed\n"); | ||
1428 | exit(1); | ||
1429 | } | ||
1430 | |||
1432 | if (cfg.chrootdir) { | 1431 | if (cfg.chrootdir) { |
1433 | fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); | 1432 | fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); |
1434 | exit(1); | 1433 | exit(1); |
@@ -1453,6 +1452,10 @@ int main(int argc, char **argv) { | |||
1453 | } | 1452 | } |
1454 | else if (strncmp(argv[i], "--overlay-named=", 16) == 0) { | 1453 | else if (strncmp(argv[i], "--overlay-named=", 16) == 0) { |
1455 | if (checkcfg(CFG_OVERLAYFS)) { | 1454 | if (checkcfg(CFG_OVERLAYFS)) { |
1455 | if (arg_overlay) { | ||
1456 | fprintf(stderr, "Error: only one overlay command is allowed\n"); | ||
1457 | exit(1); | ||
1458 | } | ||
1456 | if (cfg.chrootdir) { | 1459 | if (cfg.chrootdir) { |
1457 | fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); | 1460 | fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); |
1458 | exit(1); | 1461 | exit(1); |
@@ -1485,6 +1488,10 @@ int main(int argc, char **argv) { | |||
1485 | } | 1488 | } |
1486 | else if (strcmp(argv[i], "--overlay-tmpfs") == 0) { | 1489 | else if (strcmp(argv[i], "--overlay-tmpfs") == 0) { |
1487 | if (checkcfg(CFG_OVERLAYFS)) { | 1490 | if (checkcfg(CFG_OVERLAYFS)) { |
1491 | if (arg_overlay) { | ||
1492 | fprintf(stderr, "Error: only one overlay command is allowed\n"); | ||
1493 | exit(1); | ||
1494 | } | ||
1488 | if (cfg.chrootdir) { | 1495 | if (cfg.chrootdir) { |
1489 | fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); | 1496 | fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n"); |
1490 | exit(1); | 1497 | exit(1); |