Add capability filter for network services, additive filter

The new capability filter SBOX_CAPS_NET_SERVICE allows forked processes
to bind to low ports (privileged network services).

Because dhcp clients require both low ports and network administration
privileges, this patch also allows (bitwise) combination of capability filters
(except SBOX_CAPS_NONE, which completely drops any capabilities)
to grant both SBOX_CAPS_NETWORK and SBOX_CAPS_NET_SERVICE to a dhcp client.
This way, fnet and fnetfilter calls still do not get CAP_NET_BIND_SERVICE.

1 files changed, 23 insertions, 12 deletions

diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index a90cb7668..a1e65cd3c 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -190,23 +190,34 @@ int sbox_run_v(unsigned filtermask, char * const arg[]) {
                 // apply filters
                 if (filtermask & SBOX_CAPS_NONE) {
                         caps_drop_all();
-                }
-                else if (filtermask & SBOX_CAPS_NETWORK) {
+                } else {
+      uint64_t set = 0;
+      if (filtermask & SBOX_CAPS_NETWORK) {
 #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files
-                        uint64_t set = ((uint64_t) 1) << CAP_NET_ADMIN;
-                        set |=  ((uint64_t) 1) << CAP_NET_RAW;
-                        caps_set(set);
+        set |= ((uint64_t) 1) << CAP_NET_ADMIN;
+        set |= ((uint64_t) 1) << CAP_NET_RAW;
 #endif
-                }
-                else if (filtermask & SBOX_CAPS_HIDEPID) {
+      }
+      if (filtermask & SBOX_CAPS_HIDEPID) {
 #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files
-                        uint64_t set = ((uint64_t) 1) << CAP_SYS_PTRACE;
-                        set |=  ((uint64_t) 1) << CAP_SYS_PACCT;
-                        caps_set(set);
+        set |= ((uint64_t) 1) << CAP_SYS_PTRACE;
+        set |= ((uint64_t) 1) << CAP_SYS_PACCT;
 #endif
-                }
+      }
+      if (filtermask & SBOX_CAPS_NET_SERVICE) {
+#ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files
+        set |= ((uint64_t) 1) << CAP_NET_BIND_SERVICE;
+        set |= ((uint64_t) 1) << CAP_NET_BROADCAST;
+#endif
+      }
+      if (set != 0) { // some SBOX_CAPS_ flag was specified, drop all other capabilities
+#ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files
+        caps_set(set);
+#endif
+      }
+    }
 
-                if (filtermask & SBOX_SECCOMP) {
+    if (filtermask & SBOX_SECCOMP) {
                         if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
                                 perror("prctl(NO_NEW_PRIVS)");
                         }