Add --dbus-*.see options

The SEE policy of xdg-dbus-proxy allows clients to see objects and bus
names, but not interact with them. The --call and --broadcast can allow
interactions with objects that have the SEE policy set. Profile support
for these proxy options will be added in a future commit.

2 files changed, 30 insertions, 0 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index dc213b988..fa2b0e2e1 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2073,6 +2073,14 @@ int main(int argc, char **argv, char **envp) {
                                 exit(1);
                         }
                 }
+                else if (strncmp(argv[i], "--dbus-user.see=", 16) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-user.see %s", argv[i] + 16) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
                 else if (strncmp(argv[i], "--dbus-user.talk=", 17) == 0) {
                         char *line;
                         if (asprintf(&line, "dbus-user.talk %s", argv[i] + 17) == -1)
@@ -2103,6 +2111,14 @@ int main(int argc, char **argv, char **envp) {
                                 exit(1);
                         }
                 }
+                else if (strncmp(argv[i], "--dbus-system.see=", 18) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-system.see %s", argv[i] + 18) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
                 else if (strncmp(argv[i], "--dbus-system.talk=", 19) == 0) {
                         char *line;
                         if (asprintf(&line, "dbus-system.talk %s", argv[i] + 19) == -1)
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 0be119903..f2959686a 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -452,6 +452,13 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 0;
         }
+        else if (strncmp(ptr, "dbus-user.see ", 14) == 0) {
+                if (!dbus_check_name(ptr + 14)) {
+                        printf("Invalid dbus-user.see name: %s\n", ptr + 15);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strncmp(ptr, "dbus-user.talk ", 15) == 0) {
                 if (!dbus_check_name(ptr + 15)) {
                         printf("Invalid dbus-user.talk name: %s\n", ptr + 15);
@@ -482,6 +489,13 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 0;
         }
+        else if (strncmp(ptr, "dbus-system.see ", 16) == 0) {
+                if (!dbus_check_name(ptr + 16)) {
+                        fprintf(stderr, "Invalid dbus-system.see name: %s\n", ptr + 17);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strncmp(ptr, "dbus-system.talk ", 17) == 0) {
                 if (!dbus_check_name(ptr + 17)) {
                         fprintf(stderr, "Invalid dbus-system.talk name: %s\n", ptr + 17);