fix join/seccomp #2296

3 files changed, 75 insertions, 29 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 245ea5bde..a3d3dfcd4 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -57,7 +57,7 @@
 #define RUN_LIB_FILE    "/run/firejail/mnt/libfiles"
 #define RUN_DNS_ETC     "/run/firejail/mnt/dns-etc"
 
-
+#define RUN_SECCOMP_LIST        "/run/firejail/mnt/seccomp.list"        // list of seccomp files installed
 #define RUN_SECCOMP_PROTOCOL    "/run/firejail/mnt/seccomp.protocol"    // protocol filter
 #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp"                     // configured filter
 #define RUN_SECCOMP_32  "/run/firejail/mnt/seccomp.32"          // 32bit arch filter installed on 64bit architectures
@@ -607,6 +607,7 @@ int seccomp_filter_keep(void);
 void seccomp_print_filter(pid_t pid);
 
 // caps.c
+void seccomp_load_file_list(void);
 int caps_default_filter(void);
 void caps_print(void);
 void caps_drop_all(void);
diff --git a/src/firejail/join.c b/src/firejail/join.c
index 3ee069305..9cc4cd75d 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -160,7 +160,7 @@ static void extract_cgroup(pid_t pid) {
         free(fname);
 }
 
-static void extract_caps_seccomp(pid_t pid) {
+static void extract_caps(pid_t pid) {
         // open stat file
         char *file;
         if (asprintf(&file, "/proc/%u/status", pid) == -1) {
@@ -173,16 +173,7 @@ static void extract_caps_seccomp(pid_t pid) {
 
         char buf[BUFLEN];
         while (fgets(buf, BUFLEN - 1, fp)) {
-                if (strncmp(buf, "Seccomp:", 8) == 0) {
-                        char *ptr = buf + 8;
-                        int val;
-                        if (sscanf(ptr, "%d", &val) != 1)
-                                goto errexit;
-                        if (val == 2)
-                                apply_seccomp = 1;
-                        break;
-                }
-                else if (strncmp(buf, "CapBnd:", 7) == 0) {
+                if (strncmp(buf, "CapBnd:", 7) == 0) {
                         char *ptr = buf + 7;
                         unsigned long long val;
                         if (sscanf(ptr, "%llx", &val) != 1)
@@ -323,7 +314,7 @@ void join(pid_t pid, int argc, char **argv, int index) {
         // in user mode set caps seccomp, cpu, cgroup, etc
         if (getuid() != 0) {
                 extract_nonewprivs(pid);  // redundant on Linux >= 4.10; duplicated in function extract_caps_seccomp
-                extract_caps_seccomp(pid);
+                extract_caps(pid);
                 extract_cpu(pid);
                 extract_cgroup(pid);
                 extract_nogroups(pid);
@@ -397,15 +388,8 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 if (apply_caps == 1)    // not available for uid 0
                         caps_set(caps);
 #ifdef HAVE_SECCOMP
-                // read cfg.protocol from file
                 if (getuid() != 0)
-                        protocol_filter_load(RUN_PROTOCOL_CFG);
-                if (cfg.protocol)       // not available for uid 0
-                        seccomp_load(RUN_SECCOMP_PROTOCOL);     // install filter
-
-                // set seccomp filter
-                if (apply_seccomp == 1)  // not available for uid 0
-                        seccomp_load(RUN_SECCOMP_CFG);
+                        seccomp_load_file_list();
 #endif
 
                 // mount user namespace or drop privileges
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 974e36ba7..1cdd96025 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -83,6 +83,41 @@ int seccomp_install_filters(void) {
         return r;
 }
 
+static void seccomp_save_file_list(const char *fname) {
+        assert(fname);
+
+        FILE *fp = fopen(RUN_SECCOMP_LIST, "a+");
+        if (!fp)
+                errExit("fopen");
+
+        fprintf(fp, "%s\n", fname);
+        fclose(fp);
+        int rv = chown(RUN_SECCOMP_LIST, getuid(), getgid());
+        (void) rv;
+}
+
+#define MAXBUF 4096
+static int load_file_list_flag = 0;
+void seccomp_load_file_list(void) {
+        FILE *fp = fopen(RUN_SECCOMP_LIST, "r");
+        if (!fp)
+                return; // no seccomp configuration whatsoever
+
+        load_file_list_flag = 1;
+        char buf[MAXBUF];
+        while (fgets(buf, MAXBUF, fp)) {
+                // clean '\n'
+                char *ptr = strchr(buf, '\n');
+                if (ptr)
+                        *ptr = '\0';
+                seccomp_load(buf);
+        }
+
+        fclose(fp);
+        load_file_list_flag = 0;
+}
+
+
 int seccomp_load(const char *fname) {
         assert(fname);
 
@@ -125,6 +160,10 @@ int seccomp_load(const char *fname) {
                         PATH_FSEC_PRINT, fname);
         }
 
+        // save the file name in seccomp list
+        if (!load_file_list_flag)
+                seccomp_save_file_list(fname);
+
         return 0;
 errexit:
         fprintf(stderr, "Error: cannot read %s\n", fname);
@@ -308,23 +347,45 @@ void seccomp_print_filter(pid_t pid) {
                 }
         }
 
-        // find the seccomp filter
+        // find the seccomp list file
         EUID_ROOT();
         char *fname;
-        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_CFG) == -1)
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_LIST) == -1)
                 errExit("asprintf");
 
         struct stat s;
-        if (stat(fname, &s) == -1) {
-                printf("Cannot access seccomp filter.\n");
-                exit(1);
-        }
+        if (stat(fname, &s) == -1)
+                goto errexit;
 
-        // read and print the filter - run this as root, the user doesn't have access
-        sbox_run(SBOX_ROOT | SBOX_SECCOMP, 2, PATH_FSEC_PRINT, fname);
+        FILE *fp = fopen(fname, "r");
+        if (!fp)
+                goto errexit;
         free(fname);
 
+        char buf[MAXBUF];
+        while (fgets(buf, MAXBUF, fp)) {
+                // clean '\n'
+                char *ptr = strchr(buf, '\n');
+                if (ptr)
+                        *ptr = '\0';
+
+                if (asprintf(&fname, "/proc/%d/root%s", pid, buf) == -1)
+                        errExit("asprintf");
+                printf("FILE: %s\n", fname); fflush(0);
+
+                // read and print the filter - run this as root, the user doesn't have access
+                sbox_run(SBOX_ROOT | SBOX_SECCOMP, 2, PATH_FSEC_PRINT, fname);
+                fflush(0);
+
+                printf("\n"); fflush(0);
+                free(fname);
+        }
+        fclose(fp);
         exit(0);
+
+errexit:
+        printf("Cannot access seccomp filter.\n");
+        exit(1);
 }
 
 #endif // HAVE_SECCOMP