Add dbus-*.call and dbus-*.broadcast commands

This allows setting per-member and per-object path policies for
xdg-dbus-proxy.

4 files changed, 130 insertions, 3 deletions

diff --git a/src/firejail/dbus.c b/src/firejail/dbus.c
index 0f4f18c57..5b47567e2 100644
--- a/src/firejail/dbus.c
+++ b/src/firejail/dbus.c
@@ -48,7 +48,7 @@ static int dbus_proxy_status_fd = -1;
 static char *dbus_user_proxy_socket = NULL;
 static char *dbus_system_proxy_socket = NULL;
 
-int dbus_check_name(const char *name) {
+static int check_bus_or_interface_name(const char *name, int hyphens_allowed) {
         unsigned long length = strlen(name);
         if (length == 0 || length > DBUS_MAX_NAME_LENGTH)
                 return 0;
@@ -62,14 +62,14 @@ int dbus_check_name(const char *name) {
                         if (*p == '.') {
                                 ++segments;
                                 in_segment = 0;
-                        } else if (!alpha && !digit && *p != '_' && *p != '-') {
+                        } else if (!alpha && !digit && *p != '_' && (!hyphens_allowed || *p != '-')) {
                                 return 0;
                         }
                 }
                 else {
                         if (*p == '*') {
                                 return *(p + 1) == '\0';
-                        } else if (!alpha && *p != '_' && *p != '-') {
+                        } else if (!alpha && *p != '_' && (!hyphens_allowed || *p != '-')) {
                                 return 0;
                         }
                         in_segment = 1;
@@ -79,6 +79,72 @@ int dbus_check_name(const char *name) {
         return in_segment && segments >= 2;
 }
 
+static int check_object_path(const char *path) {
+        unsigned long length = strlen(path);
+        if (length == 0 || path[0] != '/')
+                return 0;
+        // The root path "/" is the only path allowed to have a trailing slash.
+        if (length == 1)
+                return 1;
+        const char *p = path + 1;
+        int segments = 1;
+        int in_segment = 0;
+        while (*p) {
+                int alpha = (*p >= 'a' && *p <= 'z') || (*p >= 'A' && *p <= 'Z');
+                int digit = *p >= '0' && *p <= '9';
+                if (in_segment) {
+                        if (*p == '/') {
+                                ++segments;
+                                in_segment = 0;
+                        } else if (!alpha && !digit && *p != '_') {
+                                return 0;
+                        }
+                }
+                else {
+                        if (*p == '*') {
+                                return *(p + 1) == '\0';
+                        } else if (!alpha && *p != '_') {
+                                return 0;
+                        }
+                        in_segment = 1;
+                }
+                ++p;
+        }
+        return in_segment && segments >= 2;
+}
+
+int dbus_check_name(const char *name) {
+        return check_bus_or_interface_name(name, 1);
+}
+
+int dbus_check_call_rule(const char *rule) {
+        char buf[DBUS_MAX_NAME_LENGTH + 1];
+        char *name_end = strchr(rule, '=');
+        if (name_end == NULL)
+                return 0;
+        size_t name_length = (size_t) (name_end - rule);
+        if (name_length > DBUS_MAX_NAME_LENGTH)
+                return 0;
+        strncpy(buf, rule, (size_t) name_length);
+        buf[name_length] = '\0';
+        if (!dbus_check_name(buf))
+                return 0;
+        ++name_end;
+        char *interface_end = strchr(name_end, '@');
+        if (interface_end == NULL)
+                return check_bus_or_interface_name(name_end, 0);
+        size_t interface_length = (size_t) (interface_end - name_end);
+        if (interface_length > DBUS_MAX_NAME_LENGTH)
+                return 0;
+        if (interface_length > 0) {
+                strncpy(buf, name_end, interface_length);
+                buf[interface_length] = '\0';
+                if (!check_bus_or_interface_name(buf, 0))
+                        return 0;
+        }
+        return check_object_path(interface_end + 1);
+}
+
 static void dbus_check_bus_profile(char const *prefix, DbusPolicy *policy) {
         if (*policy == DBUS_POLICY_FILTER) {
                 struct stat s;
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 9b288b1b9..19ec2762c 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -847,6 +847,7 @@ void set_profile_run_file(pid_t pid, const char *fname);
 
 // dbus.c
 int dbus_check_name(const char *name);
+int dbus_check_call_rule(const char *name);
 void dbus_check_profile(void);
 void dbus_proxy_start(void);
 void dbus_proxy_stop(void);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index fa2b0e2e1..8d60d3790 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2097,6 +2097,22 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL); // will exit if something wrong
                         profile_add(line);
                 }
+                else if (strncmp(argv[i], "--dbus-user.call=", 17) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-user.call %s", argv[i] + 17) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
+                else if (strncmp(argv[i], "--dbus-user.broadcast=", 22) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-user.broadcast %s", argv[i] + 22) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
                 else if (strncmp("--dbus-system=", argv[i], 14) == 0) {
                         if (strcmp("filter", argv[i] + 14) == 0) {
                                 if (arg_dbus_system == DBUS_POLICY_BLOCK) {
@@ -2135,6 +2151,22 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL); // will exit if something wrong
                         profile_add(line);
                 }
+                else if (strncmp(argv[i], "--dbus-system.call=", 19) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-system.call %s", argv[i] + 19) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
+                else if (strncmp(argv[i], "--dbus-system.broadcast=", 24) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-system.broadcast %s", argv[i] + 24) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
 
                 //*************************************
                 // network
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index f2959686a..699ca4bea 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -473,6 +473,20 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 1;
         }
+        else if (strncmp(ptr, "dbus-user.call ", 15) == 0) {
+                if (!dbus_check_call_rule(ptr + 15)) {
+                        fprintf(stderr, "Invalid dbus-user.call rule: %s\n", ptr + 15);
+                        exit(1);
+                }
+                return 1;
+        }
+        else if (strncmp(ptr, "dbus-user.broadcast ", 20) == 0) {
+                if (!dbus_check_call_rule(ptr + 20)) {
+                        fprintf(stderr, "Invalid dbus-user.broadcast rule: %s\n", ptr + 20);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strncmp("dbus-system ", ptr, 12) == 0) {
                 ptr += 12;
                 if (strcmp("filter", ptr) == 0) {
@@ -510,6 +524,20 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 1;
         }
+        else if (strncmp(ptr, "dbus-system.call ", 17) == 0) {
+                if (!dbus_check_call_rule(ptr + 17)) {
+                        fprintf(stderr, "Invalid dbus-system.call rule: %s\n", ptr + 17);
+                        exit(1);
+                }
+                return 1;
+        }
+        else if (strncmp(ptr, "dbus-system.broadcast ", 22) == 0) {
+                if (!dbus_check_call_rule(ptr + 22)) {
+                        fprintf(stderr, "Invalid dbus-system.broadcast rule: %s\n", ptr + 22);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strcmp(ptr, "nou2f") == 0) {
                 arg_nou2f = 1;
                 return 0;