firejail: don't pass command line through shell when redirecting output

When redirecting output via --output or --output-stderr, firejail was
concatenating all command line arguments into a single string
that was passed to a shell. As the arguments were no longer escaped,
the shell was able to interpret them.
Someone who has control over the command line arguments of the
sandboxed application could use this to run arbitrary other commands.

Instead of passing it through a shell for piping the output to ftee,
the pipeline is now manually created and the processes are executed
directly.

Fixes: CVE-2020-17368

Reported-by: Tim Starling <tstarling@wikimedia.org>

0 files changed, 0 insertions, 0 deletions