diff options
author | netblue30 <netblue30@protonmail.com> | 2024-04-28 10:18:05 -0400 |
---|---|---|
committer | netblue30 <netblue30@protonmail.com> | 2024-04-28 10:18:05 -0400 |
commit | 58e8b0613d47b266cb2242815de3f8e52d333ac4 (patch) | |
tree | b696113c3ff5e7004ffea77254bce8b2561a9d5e /src | |
parent | --fbuilder cleanup (diff) | |
parent | profiles: fluffychat: remove option already present in disable-common.inc (#6... (diff) | |
download | firejail-58e8b0613d47b266cb2242815de3f8e52d333ac4.tar.gz firejail-58e8b0613d47b266cb2242815de3f8e52d333ac4.tar.zst firejail-58e8b0613d47b266cb2242815de3f8e52d333ac4.zip |
Merge branch 'master' of ssh://github.com/netblue30/firejail
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/chroot.c | 5 | ||||
-rw-r--r-- | src/firejail/firejail.h | 9 | ||||
-rw-r--r-- | src/firejail/main.c | 44 | ||||
-rw-r--r-- | src/firejail/preproc.c | 96 |
4 files changed, 118 insertions, 36 deletions
diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c index ffa6c8b51..67097852e 100644 --- a/src/firejail/chroot.c +++ b/src/firejail/chroot.c | |||
@@ -273,7 +273,10 @@ void fs_chroot(const char *rootdir) { | |||
273 | errExit("mounting /proc"); | 273 | errExit("mounting /proc"); |
274 | 274 | ||
275 | // create all other /run/firejail files and directories | 275 | // create all other /run/firejail files and directories |
276 | preproc_build_firejail_dir(); | 276 | preproc_build_firejail_dir_unlocked(); |
277 | preproc_lock_firejail_dir(); | ||
278 | preproc_build_firejail_dir_locked(); | ||
279 | preproc_unlock_firejail_dir(); | ||
277 | 280 | ||
278 | // update /var directory in order to support multiple sandboxes running on the same root directory | 281 | // update /var directory in order to support multiple sandboxes running on the same root directory |
279 | // if (!arg_private_dev) | 282 | // if (!arg_private_dev) |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index b8ec4d474..736af018d 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -282,6 +282,8 @@ static inline int any_dhcp(void) { | |||
282 | return any_ip_dhcp() || any_ip6_dhcp(); | 282 | return any_ip_dhcp() || any_ip6_dhcp(); |
283 | } | 283 | } |
284 | 284 | ||
285 | extern int lockfd_directory; | ||
286 | extern int lockfd_network; | ||
285 | extern int arg_private; // mount private /home | 287 | extern int arg_private; // mount private /home |
286 | extern int arg_private_cache; // private home/.cache | 288 | extern int arg_private_cache; // private home/.cache |
287 | extern int arg_debug; // print debug messages | 289 | extern int arg_debug; // print debug messages |
@@ -429,7 +431,12 @@ int net_get_mac(const char *ifname, unsigned char mac[6]); | |||
429 | void net_config_interface(const char *dev, uint32_t ip, uint32_t mask, int mtu); | 431 | void net_config_interface(const char *dev, uint32_t ip, uint32_t mask, int mtu); |
430 | 432 | ||
431 | // preproc.c | 433 | // preproc.c |
432 | void preproc_build_firejail_dir(void); | 434 | void preproc_lock_firejail_dir(void); |
435 | void preproc_unlock_firejail_dir(void); | ||
436 | void preproc_lock_firejail_network_dir(void); | ||
437 | void preproc_unlock_firejail_network_dir(void); | ||
438 | void preproc_build_firejail_dir_unlocked(void); | ||
439 | void preproc_build_firejail_dir_locked(void); | ||
433 | void preproc_mount_mnt_dir(void); | 440 | void preproc_mount_mnt_dir(void); |
434 | void preproc_clean_run(void); | 441 | void preproc_clean_run(void); |
435 | 442 | ||
diff --git a/src/firejail/main.c b/src/firejail/main.c index 0ce18ab01..acbb4bf38 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -63,6 +63,8 @@ gid_t firejail_gid = 0; | |||
63 | static char child_stack[STACK_SIZE] __attribute__((aligned(STACK_ALIGNMENT))); // space for child's stack | 63 | static char child_stack[STACK_SIZE] __attribute__((aligned(STACK_ALIGNMENT))); // space for child's stack |
64 | 64 | ||
65 | Config cfg; // configuration | 65 | Config cfg; // configuration |
66 | int lockfd_directory = -1; | ||
67 | int lockfd_network = -1; | ||
66 | int arg_private = 0; // mount private /home and /tmp directoryu | 68 | int arg_private = 0; // mount private /home and /tmp directoryu |
67 | int arg_private_cache = 0; // mount private home/.cache | 69 | int arg_private_cache = 0; // mount private home/.cache |
68 | int arg_debug = 0; // print debug messages | 70 | int arg_debug = 0; // print debug messages |
@@ -1056,8 +1058,6 @@ static int check_postexec(const char *list) { | |||
1056 | int main(int argc, char **argv, char **envp) { | 1058 | int main(int argc, char **argv, char **envp) { |
1057 | int i; | 1059 | int i; |
1058 | int prog_index = -1; // index in argv where the program command starts | 1060 | int prog_index = -1; // index in argv where the program command starts |
1059 | int lockfd_network = -1; | ||
1060 | int lockfd_directory = -1; | ||
1061 | int custom_profile = 0; // custom profile loaded | 1061 | int custom_profile = 0; // custom profile loaded |
1062 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) | 1062 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) |
1063 | char **ptr; | 1063 | char **ptr; |
@@ -1166,19 +1166,13 @@ int main(int argc, char **argv, char **envp) { | |||
1166 | #endif | 1166 | #endif |
1167 | 1167 | ||
1168 | // build /run/firejail directory structure | 1168 | // build /run/firejail directory structure |
1169 | preproc_build_firejail_dir(); | 1169 | preproc_build_firejail_dir_unlocked(); |
1170 | preproc_lock_firejail_dir(); | ||
1171 | preproc_build_firejail_dir_locked(); | ||
1170 | const char *container_name = env_get("container"); | 1172 | const char *container_name = env_get("container"); |
1171 | if (!container_name || strcmp(container_name, "firejail")) { | 1173 | if (!container_name || strcmp(container_name, "firejail")) |
1172 | lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR); | ||
1173 | if (lockfd_directory != -1) { | ||
1174 | int rv = fchown(lockfd_directory, 0, 0); | ||
1175 | (void) rv; | ||
1176 | flock(lockfd_directory, LOCK_EX); | ||
1177 | } | ||
1178 | preproc_clean_run(); | 1174 | preproc_clean_run(); |
1179 | flock(lockfd_directory, LOCK_UN); | 1175 | preproc_unlock_firejail_dir(); |
1180 | close(lockfd_directory); | ||
1181 | } | ||
1182 | 1176 | ||
1183 | delete_run_files(getpid()); | 1177 | delete_run_files(getpid()); |
1184 | atexit(clear_atexit); | 1178 | atexit(clear_atexit); |
@@ -2990,12 +2984,7 @@ int main(int argc, char **argv, char **envp) { | |||
2990 | // check and assign an IP address - for macvlan it will be done again in the sandbox! | 2984 | // check and assign an IP address - for macvlan it will be done again in the sandbox! |
2991 | if (any_bridge_configured()) { | 2985 | if (any_bridge_configured()) { |
2992 | EUID_ROOT(); | 2986 | EUID_ROOT(); |
2993 | lockfd_network = open(RUN_NETWORK_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR); | 2987 | preproc_lock_firejail_network_dir(); |
2994 | if (lockfd_network != -1) { | ||
2995 | int rv = fchown(lockfd_network, 0, 0); | ||
2996 | (void) rv; | ||
2997 | flock(lockfd_network, LOCK_EX); | ||
2998 | } | ||
2999 | 2988 | ||
3000 | if (cfg.bridge0.configured && cfg.bridge0.arg_ip_none == 0) | 2989 | if (cfg.bridge0.configured && cfg.bridge0.arg_ip_none == 0) |
3001 | check_network(&cfg.bridge0); | 2990 | check_network(&cfg.bridge0); |
@@ -3024,21 +3013,13 @@ int main(int argc, char **argv, char **envp) { | |||
3024 | 3013 | ||
3025 | // set name and x11 run files | 3014 | // set name and x11 run files |
3026 | EUID_ROOT(); | 3015 | EUID_ROOT(); |
3027 | lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR); | 3016 | preproc_lock_firejail_dir(); |
3028 | if (lockfd_directory != -1) { | ||
3029 | int rv = fchown(lockfd_directory, 0, 0); | ||
3030 | (void) rv; | ||
3031 | flock(lockfd_directory, LOCK_EX); | ||
3032 | } | ||
3033 | if (cfg.name) | 3017 | if (cfg.name) |
3034 | set_name_run_file(sandbox_pid); | 3018 | set_name_run_file(sandbox_pid); |
3035 | int display = x11_display(); | 3019 | int display = x11_display(); |
3036 | if (display > 0) | 3020 | if (display > 0) |
3037 | set_x11_run_file(sandbox_pid, display); | 3021 | set_x11_run_file(sandbox_pid, display); |
3038 | if (lockfd_directory != -1) { | 3022 | preproc_unlock_firejail_dir(); |
3039 | flock(lockfd_directory, LOCK_UN); | ||
3040 | close(lockfd_directory); | ||
3041 | } | ||
3042 | EUID_USER(); | 3023 | EUID_USER(); |
3043 | 3024 | ||
3044 | #ifdef HAVE_DBUSPROXY | 3025 | #ifdef HAVE_DBUSPROXY |
@@ -3276,10 +3257,7 @@ int main(int argc, char **argv, char **envp) { | |||
3276 | close(parent_to_child_fds[1]); | 3257 | close(parent_to_child_fds[1]); |
3277 | 3258 | ||
3278 | EUID_ROOT(); | 3259 | EUID_ROOT(); |
3279 | if (lockfd_network != -1) { | 3260 | preproc_unlock_firejail_network_dir(); |
3280 | flock(lockfd_network, LOCK_UN); | ||
3281 | close(lockfd_network); | ||
3282 | } | ||
3283 | EUID_USER(); | 3261 | EUID_USER(); |
3284 | 3262 | ||
3285 | // lock netfilter firewall | 3263 | // lock netfilter firewall |
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c index 2c7d4264d..e0ca2141f 100644 --- a/src/firejail/preproc.c +++ b/src/firejail/preproc.c | |||
@@ -18,15 +18,101 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/file.h> | ||
21 | #include <sys/mount.h> | 22 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
23 | #include <sys/types.h> | 24 | #include <sys/types.h> |
24 | #include <dirent.h> | 25 | #include <dirent.h> |
26 | #include <fcntl.h> | ||
25 | 27 | ||
26 | static int tmpfs_mounted = 0; | 28 | static int tmpfs_mounted = 0; |
27 | 29 | ||
30 | static void preproc_lock_file(const char *path, int *lockfd_ptr) { | ||
31 | assert(path != NULL); | ||
32 | assert(lockfd_ptr != NULL); | ||
33 | |||
34 | long pid = (long)getpid(); | ||
35 | if (arg_debug) | ||
36 | fprintf(stderr, "pid=%ld: locking %s ...\n", pid, path); | ||
37 | |||
38 | if (*lockfd_ptr != -1) { | ||
39 | if (arg_debug) | ||
40 | fprintf(stderr, "pid=%ld: already locked %s\n", pid, path); | ||
41 | return; | ||
42 | } | ||
43 | |||
44 | int lockfd = open(path, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR); | ||
45 | if (lockfd == -1) { | ||
46 | fprintf(stderr, "Error: cannot create a lockfile at %s\n", path); | ||
47 | errExit("open"); | ||
48 | } | ||
49 | |||
50 | if (fchown(lockfd, 0, 0) == -1) { | ||
51 | fprintf(stderr, "Error: cannot chown root:root %s\n", path); | ||
52 | errExit("fchown"); | ||
53 | } | ||
54 | |||
55 | if (flock(lockfd, LOCK_EX) == -1) { | ||
56 | fprintf(stderr, "Error: cannot lock %s\n", path); | ||
57 | errExit("flock"); | ||
58 | } | ||
59 | |||
60 | *lockfd_ptr = lockfd; | ||
61 | if (arg_debug) | ||
62 | fprintf(stderr, "pid=%ld: locked %s\n", pid, path); | ||
63 | } | ||
64 | |||
65 | static void preproc_unlock_file(const char *path, int *lockfd_ptr) { | ||
66 | assert(path != NULL); | ||
67 | assert(lockfd_ptr != NULL); | ||
68 | |||
69 | long pid = (long)getpid(); | ||
70 | if (arg_debug) | ||
71 | fprintf(stderr, "pid=%ld: unlocking %s ...\n", pid, path); | ||
72 | |||
73 | int lockfd = *lockfd_ptr; | ||
74 | if (lockfd == -1) { | ||
75 | if (arg_debug) | ||
76 | fprintf(stderr, "pid=%ld: already unlocked %s\n", pid, path); | ||
77 | return; | ||
78 | } | ||
79 | |||
80 | if (flock(lockfd, LOCK_UN) == -1) { | ||
81 | fprintf(stderr, "Error: cannot unlock %s\n", path); | ||
82 | errExit("flock"); | ||
83 | } | ||
84 | |||
85 | if (close(lockfd) == -1) { | ||
86 | fprintf(stderr, "Error: cannot close %s\n", path); | ||
87 | errExit("close"); | ||
88 | } | ||
89 | |||
90 | *lockfd_ptr = -1; | ||
91 | if (arg_debug) | ||
92 | fprintf(stderr, "pid=%ld: unlocked %s\n", pid, path); | ||
93 | } | ||
94 | |||
95 | void preproc_lock_firejail_dir(void) { | ||
96 | preproc_lock_file(RUN_DIRECTORY_LOCK_FILE, &lockfd_directory); | ||
97 | } | ||
98 | |||
99 | void preproc_unlock_firejail_dir(void) { | ||
100 | preproc_unlock_file(RUN_DIRECTORY_LOCK_FILE, &lockfd_directory); | ||
101 | } | ||
102 | |||
103 | void preproc_lock_firejail_network_dir(void) { | ||
104 | preproc_lock_file(RUN_NETWORK_LOCK_FILE, &lockfd_network); | ||
105 | } | ||
106 | |||
107 | void preproc_unlock_firejail_network_dir(void) { | ||
108 | preproc_unlock_file(RUN_NETWORK_LOCK_FILE, &lockfd_network); | ||
109 | } | ||
110 | |||
28 | // build /run/firejail directory | 111 | // build /run/firejail directory |
29 | void preproc_build_firejail_dir(void) { | 112 | // |
113 | // Note: This creates the base directory of the rundir lockfile; | ||
114 | // it should be called before preproc_lock_firejail_dir(). | ||
115 | void preproc_build_firejail_dir_unlocked(void) { | ||
30 | struct stat s; | 116 | struct stat s; |
31 | 117 | ||
32 | // CentOS 6 doesn't have /run directory | 118 | // CentOS 6 doesn't have /run directory |
@@ -35,6 +121,14 @@ void preproc_build_firejail_dir(void) { | |||
35 | } | 121 | } |
36 | 122 | ||
37 | create_empty_dir_as_root(RUN_FIREJAIL_DIR, 0755); | 123 | create_empty_dir_as_root(RUN_FIREJAIL_DIR, 0755); |
124 | } | ||
125 | |||
126 | // build directory hierarchy under /run/firejail | ||
127 | // | ||
128 | // Note: Remounts have timing hazards. This function should | ||
129 | // only be called after acquiring the directory lock via | ||
130 | // preproc_lock_firejail_dir(). | ||
131 | void preproc_build_firejail_dir_locked(void) { | ||
38 | create_empty_dir_as_root(RUN_FIREJAIL_NETWORK_DIR, 0755); | 132 | create_empty_dir_as_root(RUN_FIREJAIL_NETWORK_DIR, 0755); |
39 | create_empty_dir_as_root(RUN_FIREJAIL_BANDWIDTH_DIR, 0755); | 133 | create_empty_dir_as_root(RUN_FIREJAIL_BANDWIDTH_DIR, 0755); |
40 | create_empty_dir_as_root(RUN_FIREJAIL_NAME_DIR, 0755); | 134 | create_empty_dir_as_root(RUN_FIREJAIL_NAME_DIR, 0755); |