hardening: replace setuid/setgid calls with setresuid/setresgid

when nesting containers and sandboxes, it is possible setuid() fails
silently to reset the saved uid, which is then cleared only by
the next execve. This is solved by replacing setuid() with more
robust setresuid() function calls.

Also add code to drop privileges when entering the run_no_sandbox()
function (along with some minor tidy up).

1 files changed, 12 insertions, 13 deletions

diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 9ad4e8ba1..096f34cc5 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -161,32 +161,31 @@ int check_kernel_procs(void) {
 
 void run_no_sandbox(int argc, char **argv) {
         EUID_ASSERT();
+        // drop privileges
+        gid_t gid = getgid();
+        uid_t uid = getuid();
+        if (setresgid(gid, gid, gid) != 0)
+                errExit("setresgid");
+        if (setresuid(uid, uid, uid) != 0)
+                errExit("setresuid");
 
         // process limited subset of options
         int i;
         for (i = 0; i < argc; i++) {
                 if (strcmp(argv[i], "--debug") == 0)
                         arg_debug = 1;
-                else if (strcmp(argv[i], "--shell=none") == 0 ||
-                    strncmp(argv[i], "--shell=", 8) == 0)
+                else if (strncmp(argv[i], "--shell=", 8) == 0)
                         fwarning("shell-related command line options are disregarded - using SHELL environment variable\n");
         }
 
-        // use $SHELL to get shell used in sandbox
-        char *shell =  getenv("SHELL");
-        if (shell && access(shell, R_OK) == 0)
-                cfg.shell = shell;
-
-        // guess shell otherwise
-        if (!cfg.shell) {
-                cfg.shell = guess_shell();
-                if (arg_debug)
-                        printf("Autoselecting %s as shell\n", cfg.shell);
-        }
+        // use $SHELL to get shell used in sandbox, guess shell otherwise
+        cfg.shell = guess_shell();
         if (!cfg.shell) {
                 fprintf(stderr, "Error: unable to guess your shell, please set SHELL environment variable\n");
                 exit(1);
         }
+        else if (arg_debug)
+                printf("Selecting %s as shell\n", cfg.shell);
 
         int prog_index = 0;
         // find first non option arg: