Filter environment variables

Save all environment variables for later use in the application, clear
environment and re-apply only whitelisted variables for the main
firejail process. The whitelisted environment is only used by C
library. Sandboxed tools will get further variables used
internally (FIREJAIL_*).

All variables will be reapplied for the firejailed application.

This also lifts the length restriction for environment variables,
except for the variables used by Firejail itself or the sandboxed
tools.

1 files changed, 4 insertions, 1 deletions

diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index a5c924a70..5df3d9cd3 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -42,7 +42,7 @@ void pulseaudio_disable(void) {
 
 
         // blacklist pulseaudio socket in XDG_RUNTIME_DIR
-        char *name = getenv("XDG_RUNTIME_DIR");
+        const char *name = env_get("XDG_RUNTIME_DIR");
         if (name)
                 disable_file_path(name, "pulse/native");
 
@@ -76,7 +76,10 @@ void pulseaudio_disable(void) {
 }
 
 static void pulseaudio_fallback(const char *path) {
+        assert(path);
+
         fmessage("Cannot mount tmpfs on %s/.config/pulse\n", cfg.homedir);
+        env_store_name_val("PULSE_CLIENTCONFIG", path, SETENV);
         if (setenv("PULSE_CLIENTCONFIG", path, 1) < 0)
                 errExit("setenv");
 }