Merge pull request #4004 from smitsohu/privatelib4

add PATH_FCOPY to private-lib automatically

3 files changed, 82 insertions, 34 deletions

diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index a7f5b0bfc..9bf17b981 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -28,6 +28,7 @@
 #define MAXBUF 4096
 
 extern void fslib_install_stdc(void);
+extern void fslib_install_firejail(void);
 extern void fslib_install_system(void);
 
 static int lib_cnt = 0;
@@ -141,14 +142,11 @@ void fslib_duplicate(const char *full_path) {
 // requires full path for lib
 // it could be a library or an executable
 // lib is not copied, only libraries used by it
-void fslib_copy_libs(const char *full_path) {
-        assert(full_path);
-        if (arg_debug || arg_debug_private_lib)
-                printf("    fslib_copy_libs %s\n", full_path);
-
+static void fslib_copy_libs(const char *full_path, unsigned mask) {
         // if library/executable does not exist or the user does not have read access to it
         // print a warning and exit the function.
-        if (access(full_path, R_OK)) {
+        if (((mask & SBOX_USER) && access(full_path, R_OK)) ||
+            ((mask & SBOX_ROOT) && access(full_path, F_OK))) {
                 if (arg_debug || arg_debug_private_lib)
                         printf("cannot find %s for private-lib, skipping...\n", full_path);
                 return;
@@ -157,13 +155,15 @@ void fslib_copy_libs(const char *full_path) {
         // create an empty RUN_LIB_FILE and allow the user to write to it
         unlink(RUN_LIB_FILE);                     // in case is there
         create_empty_file_as_root(RUN_LIB_FILE, 0644);
-        if (chown(RUN_LIB_FILE, getuid(), getgid()))
-                errExit("chown");
+        if (mask & SBOX_USER) {
+                if (chown(RUN_LIB_FILE, getuid(), getgid()))
+                        errExit("chown");
+        }
 
         // run fldd to extract the list of files
         if (arg_debug || arg_debug_private_lib)
                 printf("    running fldd %s\n", full_path);
-        sbox_run(SBOX_USER | SBOX_SECCOMP | SBOX_CAPS_NONE, 3, PATH_FLDD, full_path, RUN_LIB_FILE);
+        sbox_run(mask | SBOX_SECCOMP | SBOX_CAPS_NONE, 3, PATH_FLDD, full_path, RUN_LIB_FILE);
 
         // open the list of libraries and install them on by one
         FILE *fp = fopen(RUN_LIB_FILE, "r");
@@ -182,6 +182,19 @@ void fslib_copy_libs(const char *full_path) {
         unlink(RUN_LIB_FILE);
 }
 
+void fslib_copy_libs_parse_as_root(const char *full_path) {
+        assert(full_path);
+        if (arg_debug || arg_debug_private_lib)
+                printf("    fslib_copy_libs_parse_as_root %s\n", full_path);
+        fslib_copy_libs(full_path, SBOX_ROOT);
+}
+
+void fslib_copy_libs_parse_as_user(const char *full_path) {
+        assert(full_path);
+        if (arg_debug || arg_debug_private_lib)
+                printf("    fslib_copy_libs_parse_as_user %s\n", full_path);
+        fslib_copy_libs(full_path, SBOX_USER);
+}
 
 void fslib_copy_dir(const char *full_path) {
         assert(full_path);
@@ -236,7 +249,7 @@ static void load_library(const char *fname) {
                                     access(fname, X_OK) != 0) // don't duplicate executables, just install the libraries
                                         fslib_duplicate(fname);
 
-                                fslib_copy_libs(fname);
+                                fslib_copy_libs_parse_as_user(fname);
                         }
                 }
         }
@@ -379,25 +392,12 @@ void fs_private_lib(void) {
                 printf("Installing standard C library\n");
         fslib_install_stdc();
 
-        // start timetrace
-        timetrace_start();
-
-        // bring in firejail executable libraries in case we are redirected here by a firejail symlink from /usr/local/bin/firejail
+        // install other libraries needed by firejail
         if (arg_debug || arg_debug_private_lib)
                 printf("Installing Firejail libraries\n");
-        fslib_install_list(PATH_FIREJAIL);
-
-        // bring in firejail directory
-        fslib_install_list(LIBDIR "/firejail");
-
-        // bring in dhclient libraries
-        if (any_dhcp()) {
-                if (arg_debug || arg_debug_private_lib)
-                        printf("Installing dhclient libraries\n");
-                fslib_install_list(RUN_MNT_DIR "/dhclient");
-        }
-        fmessage("Firejail libraries installed in %0.2f ms\n", timetrace_end());
+        fslib_install_firejail();
 
+        // start timetrace
         timetrace_start();
 
         // copy the libs in the new lib directory for the main exe
diff --git a/src/firejail/fs_lib2.c b/src/firejail/fs_lib2.c
index 30e993438..d46cfed86 100644
--- a/src/firejail/fs_lib2.c
+++ b/src/firejail/fs_lib2.c
@@ -22,7 +22,8 @@
 #include <sys/stat.h>
 
 extern void fslib_duplicate(const char *full_path);
-extern void fslib_copy_libs(const char *full_path);
+extern void fslib_copy_libs_parse_as_user(const char *full_path);
+extern void fslib_copy_libs_parse_as_root(const char *full_path);
 extern void fslib_copy_dir(const char *full_path);
 
 //***************************************************************
@@ -123,6 +124,52 @@ void fslib_install_stdc(void) {
         fmessage("Standard C library installed in %0.2f ms\n", timetrace_end());
 }
 
+//***************************************************************
+// Firejail libraries
+//***************************************************************
+
+static void fdir(void) {
+        fslib_copy_dir(LIBDIR "/firejail");
+
+        // executables and libraries from firejail directory
+        static const char * const fbin[] = {
+                PATH_FCOPY, // currently sufficient to find all needed libraries
+                // PATH_FSECCOMP,
+                // PATH_FSEC_OPTIMIZE,
+                // PATH_FSEC_PRINT,
+                // RUN_FIREJAIL_LIB_DIR "/libtrace.so",
+                // RUN_FIREJAIL_LIB_DIR "/libtracelog.so",
+                // RUN_FIREJAIL_LIB_DIR "/libpostexecseccomp.so",
+                NULL,
+        };
+
+        // need to run fldd as root user, unprivileged users have no read permission on executables
+        int i;
+        for (i = 0; fbin[i]; i++)
+                fslib_copy_libs_parse_as_root(fbin[i]);
+}
+
+void fslib_install_firejail(void) {
+        timetrace_start();
+        // bring in firejail executable libraries, in case we are redirected here
+        // by a firejail symlink from /usr/local/bin/firejail
+        fslib_copy_libs_parse_as_user(PATH_FIREJAIL);
+
+        // bring in firejail directory
+        fdir();
+
+        // bring in dhclient libraries
+        if (any_dhcp())
+                fslib_copy_libs_parse_as_user(RUN_MNT_DIR "/dhclient");
+
+#ifdef HAVE_X11
+        // bring in xauth libraries
+        if (arg_x11_xorg)
+                fslib_copy_libs_parse_as_user("/usr/bin/xauth");
+#endif
+
+        fmessage("Firejail libraries installed in %0.2f ms\n", timetrace_end());
+}
 
 //***************************************************************
 // various system libraries
@@ -268,7 +315,7 @@ void fslib_install_system(void) {
                         if (asprintf(&name, "/usr/lib/x86_64-linux-gnu/%s", ptr->dir1) == -1)
                                 errExit("asprintf");
                         if (access(name, R_OK) == 0) {
-                                fslib_copy_libs(name);
+                                fslib_copy_libs_parse_as_user(name);
                                 fslib_copy_dir(name);
                         }
                         else {
@@ -277,7 +324,7 @@ void fslib_install_system(void) {
                                 if (asprintf(&name, "/usr/lib64/%s", ptr->dir1) == -1)
                                         errExit("asprintf");
                                 if (access(name, R_OK) == 0) {
-                                        fslib_copy_libs(name);
+                                        fslib_copy_libs_parse_as_user(name);
                                         fslib_copy_dir(name);
                                 }
                         }
@@ -288,7 +335,7 @@ void fslib_install_system(void) {
                                 if (asprintf(&name, "/usr/lib/x86_64-linux-gnu/%s", ptr->dir2) == -1)
                                         errExit("asprintf");
                                 if (access(name, R_OK) == 0) {
-                                        fslib_copy_libs(name);
+                                        fslib_copy_libs_parse_as_user(name);
                                         fslib_copy_dir(name);
                                 }
                                 else {
@@ -297,7 +344,7 @@ void fslib_install_system(void) {
                                         if (asprintf(&name, "/usr/lib64/%s", ptr->dir2) == -1)
                                                 errExit("asprintf");
                                         if (access(name, R_OK) == 0) {
-                                                fslib_copy_libs(name);
+                                                fslib_copy_libs_parse_as_user(name);
                                                 fslib_copy_dir(name);
                                         }
                                 }
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index 933c93b0d..f9c41f661 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -203,15 +203,16 @@ static int __attribute__((noreturn)) sbox_do_exec_v(unsigned filtermask, char *
                 }
         }
 
-        if (filtermask & SBOX_ROOT) {
+        if (filtermask & SBOX_USER)
+                drop_privs(1);
+        else if (filtermask & SBOX_ROOT) {
                 // elevate privileges in order to get grsecurity working
                 if (setreuid(0, 0))
                         errExit("setreuid");
                 if (setregid(0, 0))
                         errExit("setregid");
         }
-        else if (filtermask & SBOX_USER)
-                drop_privs(1);
+        else assert(0);
 
         if (arg[0]) { // get rid of scan-build warning
                 int fd = open(arg[0], O_PATH | O_CLOEXEC);