--hosts-file option

6 files changed, 79 insertions, 11 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 94e66920b..0f836f1db 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -213,6 +213,7 @@ typedef struct config_t {
         // networking
         char *name;             // sandbox name
         char *hostname; // host name
+        char *hosts_file;               // hosts file to be installed in the sandbox
         uint32_t defaultgw;     // default gateway
         Bridge bridge0;
         Bridge bridge1;
@@ -537,6 +538,9 @@ void fs_trace(void);
 // fs_hostname.c
 void fs_hostname(const char *hostname);
 void fs_resolvconf(void);
+char *fs_check_hosts_fiile(const char *fname);
+void fs_store_hosts_file(void);
+void fs_mount_hosts_file(void);
 
 // rlimit.c
 void set_rlimits(void);
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index b2e1b4a99..ac831f6b9 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -42,7 +42,7 @@ void fs_hostname(const char *hostname) {
         }
         
         // create a new /etc/hosts
-        if (stat("/etc/hosts", &s) == 0) {
+        if (cfg.hosts_file == NULL && stat("/etc/hosts", &s) == 0) {
                 if (arg_debug)
                         printf("Creating a new /etc/hosts file\n");
                 // copy /etc/host into our new file, and modify it on the fly
@@ -79,9 +79,7 @@ void fs_hostname(const char *hostname) {
                 fclose(fp2);
                 
                 // bind-mount the file on top of /etc/hostname
-                if (mount(RUN_HOSTS_FILE, "/etc/hosts", NULL, MS_BIND|MS_REC, NULL) < 0)
-                        errExit("mount bind /etc/hosts");
-                fs_logger("create /etc/hosts");
+                fs_mount_hosts_file();
         }
         return;
 
@@ -129,4 +127,53 @@ void fs_resolvconf(void) {
         }
 }
 
+char *fs_check_hosts_fiile(const char *fname) {
+        assert(fname);
+        invalid_filename(fname);
+        char *rv = expand_home(fname, cfg.homedir);
+
+        // no a link
+        if (is_link(rv))
+                goto errexit;
+        
+        // file owned by the user
+        struct stat s;
+        if (stat(rv, &s) == -1)
+                goto errexit;
         
+        if (s.st_uid != getuid())
+                goto errexit;
+
+        return rv;
+errexit:
+        fprintf(stderr, "Error: invalid file %s\n", fname);
+        exit(1);
+}
+
+void fs_store_hosts_file(void) {
+        copy_file(cfg.hosts_file, RUN_HOSTS_FILE, 0, 0, 0644); // root needed
+}
+
+void fs_mount_hosts_file(void) {
+        // check /etc/hosts file
+        struct stat s;
+        if (stat("/etc/hosts", &s) == -1)
+                goto errexit;
+        // not a link
+        if (is_link("/etc/hosts"))
+                goto errexit;
+        // owned by root
+        if (s.st_uid != 0)
+                goto errexit;
+
+        // bind-mount the file on top of /etc/hostname
+        if (mount(RUN_HOSTS_FILE, "/etc/hosts", NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mount bind /etc/hosts");
+        fs_logger("create /etc/hosts");
+        return;
+
+errexit:
+        fprintf(stderr, "Error: invalid /etc/hosts file\n");
+        exit(1);
+}
+
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9c6b6e001..8fea98950 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1947,6 +1947,9 @@ int main(int argc, char **argv) {
                                 return 1;
                         }
                 }
+                
+                else if (strncmp(argv[i], "--hosts-file=", 13) == 0)
+                        cfg.hosts_file = fs_check_hosts_fiile(argv[i] + 13);
 
 #ifdef HAVE_NETWORK
                 else if (strcmp(argv[i], "--netfilter") == 0) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 33b6eab91..2d49b60c0 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -602,6 +602,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         
+        // hosts-file
+        if (strncmp(ptr, "hosts-file ", 11) == 0) {
+                cfg.hosts_file = fs_check_hosts_fiile(ptr + 11);
+                return 0;
+        }
+        
         // dns
         if (strncmp(ptr, "dns ", 4) == 0) {
                 uint32_t dns;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 69cb8331e..812112b51 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -587,6 +587,10 @@ int sandbox(void* sandbox_arg) {
         if (arg_trace || arg_tracelog || mask_x11_abstract_socket)
                 fs_trace_preload();
 
+        // store hosts file
+        if (cfg.hosts_file)
+                fs_store_hosts_file();
+
         //****************************
         // configure filesystem
         //****************************
@@ -631,13 +635,6 @@ int sandbox(void* sandbox_arg) {
                 fs_basic_fs();
         
         //****************************
-        // set hostname in /etc/hostname
-        //****************************
-        if (cfg.hostname) {
-                fs_hostname(cfg.hostname);
-        }
-        
-        //****************************
         // private mode
         //****************************
         if (arg_private) {
@@ -735,6 +732,16 @@ int sandbox(void* sandbox_arg) {
                 }
         }
 
+        
+        //****************************
+        // hosts and hostname
+        //****************************
+        if (cfg.hostname)
+                fs_hostname(cfg.hostname);
+
+        if (cfg.hosts_file)
+                fs_mount_hosts_file();
+
         //****************************
         // /etc overrides from the network namespace
         //****************************
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 9f4dfd44c..6f16a5868 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -78,6 +78,7 @@ void usage(void) {
         printf("    --get=name|pid filename - get a file from sandbox container.\n");
         printf("    --help, -? - this help screen.\n");
         printf("    --hostname=name - set sandbox hostname.\n");
+        printf("    --hosts-file=file - use file as /etc/hosts.\n");
         printf("    --ignore=command - ignore command in profile files.\n");
 #ifdef HAVE_NETWORK     
         printf("    --interface=name - move interface in sandbox.\n");