--tracelog

4 files changed, 38 insertions, 5 deletions

diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index ebeaf51c7..e62e2676b 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -157,6 +157,7 @@ void fs_delete_cp_command(void) {
 //***********************************************
 typedef enum {
         BLACKLIST_FILE,
+        BLACKLIST_NOLOG,
         MOUNT_READONLY,
         MOUNT_TMPFS,
         OPERATION_MAX
@@ -194,7 +195,7 @@ static void disable_file(OPERATION op, const char *filename) {
         }
 
         // modify the file
-        if (op == BLACKLIST_FILE) {
+        if (op == BLACKLIST_FILE || op == BLACKLIST_NOLOG) {
                 // some distros put all executables under /usr/bin and make /bin a symbolic link
                 if ((strcmp(fname, "/bin") == 0 || strcmp(fname, "/usr/bin") == 0) &&
                       is_link(filename) &&
@@ -213,7 +214,10 @@ static void disable_file(OPERATION op, const char *filename) {
                                         errExit("disable file");
                         }
                         last_disable = SUCCESSFUL;
-                        fs_logger2("blacklist", fname);
+                        if (op == BLACKLIST_FILE)
+                                fs_logger2("blacklist", fname);
+                        else
+                                fs_logger2("blacklist-nolog", fname);
                 }
         }
         else if (op == MOUNT_READONLY) {
@@ -282,6 +286,8 @@ static void globbing(OPERATION op, const char *pattern, const char *noblacklist[
                 }
                 if (okay_to_blacklist)
                         disable_file(op, path);
+                else if (arg_debug)
+                        printf("Not blacklist %s\n", path);
         }
         globfree(&globbuf);
 }
@@ -366,6 +372,10 @@ void fs_blacklist(void) {
                         ptr = entry->data + 10;
                         op = BLACKLIST_FILE;
                 }
+                else if (strncmp(entry->data, "blacklist-nolog ", 16) == 0)  {
+                        ptr = entry->data + 16;
+                        op = BLACKLIST_NOLOG;
+                }
                 else if (strncmp(entry->data, "read-only ", 10) == 0) {
                         ptr = entry->data + 10;
                         op = MOUNT_READONLY;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index a8eedcaff..50fdeda7e 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -370,6 +370,8 @@ int profile_check_line(char *ptr, int lineno) {
         // rest of filesystem
         if (strncmp(ptr, "blacklist ", 10) == 0)
                 ptr += 10;
+        else if (strncmp(ptr, "blacklist-nolog ", 16) == 0)
+                ptr += 16;
         else if (strncmp(ptr, "noblacklist ", 12) == 0)
                 ptr += 12;
         else if (strncmp(ptr, "whitelist ", 10) == 0) {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index a64bafeb4..d060af5eb 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -263,8 +263,8 @@ void usage(void) {
         printf("\t--tmpfs=dirname - mount a tmpfs filesystem on directory dirname.\n\n");
         printf("\t--top - monitor the most CPU-intensive sandboxes.\n\n");
         printf("\t--trace - trace open, access and connect system calls.\n\n");
-        printf("\t--tracelog - add a log message in syslog for every access to blacklisted\n");
-        printf("\t\tfiles or directories.\n\n");
+        printf("\t--tracelog - add a syslog message for every access to files or\n");
+        printf("\t\tdirectoires blacklisted by the security profile.\n\n");
         printf("\t--tree - print a tree of all sandboxed processes.\n\n");
         printf("\t--version - print program version and exit.\n\n");
         printf("\t--whitelist=dirname_or_filename - whitelist directory or file.\n\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 28f75d023..62225c407 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1297,7 +1297,28 @@ Child process initialized
 parent is shutting down, bye...
 .TP
 \fB\-\-tracelog
-Add a log message in syslog for every access to blacklisted files or directories.
+This option enables auditing blacklisted files and directories. A message
+is sent to syslog in case the file or the directory is accessed. 
+.br
+
+.br
+Example:
+.br
+$ firejail --tracelog firefox
+.br
+
+.br
+Sample messages:
+.br
+$ sudo tail -f /var/log/syslog
+.br
+[...]
+.br
+Dec  3 11:43:25 debian firejail[70]: blacklist violation - sandbox 26370, exe firefox, syscall open64, path /etc/shadow
+.br
+Dec  3 11:46:17 debian firejail[70]: blacklist violation - sandbox 26370, exe firefox, syscall opendir, path /boot
+.br
+[...]
 .TP
 \fB\-\-tree
 Print a tree of all sandboxed processes, see MONITORING section for more details.