allow PulseAudio sockets in --private-tmp

3 files changed, 44 insertions, 15 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 8831d07f0..09fadcf34 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -408,6 +408,7 @@ void fs_overlayfs(void);
 // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf
 void fs_chroot(const char *rootdir);
 void fs_check_chroot_dir(const char *rootdir);
+void fs_private_tmp(void);
 
 // profile.c
 // find and read the profile specified by name from dir directory
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 025e715e6..ac68e7738 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1214,4 +1214,46 @@ void fs_chroot(const char *rootdir) {
 }
 #endif
 
+// this function is called from sandbox.c before blacklist/whitelist functions
+void fs_private_tmp(void) {
+        // check XAUTHORITY file, KDE keeps it under /tmp
+        char *xauth = getenv("XAUTHORITY");
+        if (xauth) {
+                char *rp = realpath(xauth, NULL);
+                if (rp && strncmp(rp, "/tmp/", 5) == 0) {
+                        char *cmd;
+                        if (asprintf(&cmd, "whitelist %s", rp) == -1)
+                                errExit("asprintf");
+                        profile_add(cmd); // profile_add does not duplicate the string
+                }
+                if (rp)
+                        free(rp);
+        }
+        
+        // whitelist x11 directory
+        profile_add("whitelist /tmp/.X11-unix");
+        
+        // whitelist any pulse* file in /tmp directory
+        // some distros use PulseAudio sockets under /tmp instead of the socket in /urn/user
+        DIR *dir;
+        if (!(dir = opendir("/tmp"))) {
+                // sleep 2 seconds and try again
+                sleep(2);
+                if (!(dir = opendir("/tmp"))) {
+                        return;
+                }
+        }
 
+        struct dirent *entry;
+        while ((entry = readdir(dir))) {
+                if (strncmp(entry->d_name, "pulse-", 6) == 0) {
+                        char *cmd;
+                        if (asprintf(&cmd, "whitelist /tmp/%s", entry->d_name) == -1)
+                                errExit("asprintf");
+                        profile_add(cmd); // profile_add does not duplicate the string
+                }
+        }
+        closedir(dir);
+
+
+}
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 35ca4ff2d..e6deddac5 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -741,21 +741,7 @@ int sandbox(void* sandbox_arg) {
                 else {
                         // private-tmp is implemented as a whitelist
                         EUID_USER();
-                        // check XAUTHORITY file, KDE keeps it under /tmp
-                        char *xauth = getenv("XAUTHORITY");
-                        if (xauth) {
-                                char *rp = realpath(xauth, NULL);
-                                if (rp && strncmp(rp, "/tmp/", 5) == 0) {
-                                        char *cmd;
-                                        if (asprintf(&cmd, "whitelist %s", rp) == -1)
-                                                errExit("asprintf");
-                                        profile_add(cmd); // profile_add does not duplicate the string
-                                }
-                                if (rp)
-                                        free(rp);
-                        }
-                        // whitelist x11 directory
-                        profile_add("whitelist /tmp/.X11-unix");
+                        fs_private_tmp();
                         EUID_ROOT();
                 }
         }