diff options
author | 2017-02-05 11:50:04 -0500 | |
---|---|---|
committer | 2017-02-05 11:50:04 -0500 | |
commit | d17ce1322e6e42ca905393545db03a13570da1b0 (patch) | |
tree | 86b598adb3ac57adafe55a62996b9e37325a1eec /src | |
parent | enable strict seccomp filter on overlay options (diff) | |
download | firejail-d17ce1322e6e42ca905393545db03a13570da1b0.tar.gz firejail-d17ce1322e6e42ca905393545db03a13570da1b0.tar.zst firejail-d17ce1322e6e42ca905393545db03a13570da1b0.zip |
disable --git-install at compile time
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/Makefile.in | 3 | ||||
-rw-r--r-- | src/firejail/checkcfg.c | 8 | ||||
-rw-r--r-- | src/firejail/fs.c | 52 | ||||
-rw-r--r-- | src/firejail/git.c | 4 | ||||
-rw-r--r-- | src/firejail/main.c | 2 | ||||
-rw-r--r-- | src/firejail/usage.c | 2 |
6 files changed, 18 insertions, 53 deletions
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in index 6e5071925..80f35ff4d 100644 --- a/src/firejail/Makefile.in +++ b/src/firejail/Makefile.in | |||
@@ -22,13 +22,14 @@ HAVE_APPARMOR=@HAVE_APPARMOR@ | |||
22 | HAVE_OVERLAYFS=@HAVE_OVERLAYFS@ | 22 | HAVE_OVERLAYFS=@HAVE_OVERLAYFS@ |
23 | HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@ | 23 | HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@ |
24 | HAVE_GCOV=@HAVE_GCOV@ | 24 | HAVE_GCOV=@HAVE_GCOV@ |
25 | HAVE_GIT_INSTALL=@HAVE_GIT_INSTALL@ | ||
25 | EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@ | 26 | EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@ |
26 | 27 | ||
27 | H_FILE_LIST = $(sort $(wildcard *.[h])) | 28 | H_FILE_LIST = $(sort $(wildcard *.[h])) |
28 | C_FILE_LIST = $(sort $(wildcard *.c)) | 29 | C_FILE_LIST = $(sort $(wildcard *.c)) |
29 | OBJS = $(C_FILE_LIST:.c=.o) | 30 | OBJS = $(C_FILE_LIST:.c=.o) |
30 | BINOBJS = $(foreach file, $(OBJS), $file) | 31 | BINOBJS = $(foreach file, $(OBJS), $file) |
31 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security | 32 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) $(HAVE_GIT_INSTALL) -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security |
32 | LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread | 33 | LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread |
33 | 34 | ||
34 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h | 35 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h |
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index c3eedc510..73fa6e46b 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -351,6 +351,13 @@ void print_compiletime_support(void) { | |||
351 | #endif | 351 | #endif |
352 | ); | 352 | ); |
353 | 353 | ||
354 | printf("\t- git install support is %s\n", | ||
355 | #ifdef HAVE_GIT_INSTALL | ||
356 | "enabled" | ||
357 | #else | ||
358 | "disabled" | ||
359 | #endif | ||
360 | ); | ||
354 | 361 | ||
355 | #ifdef HAVE_NETWORK_RESTRICTED | 362 | #ifdef HAVE_NETWORK_RESTRICTED |
356 | printf("\t- networking features are available only to root user\n"); | 363 | printf("\t- networking features are available only to root user\n"); |
@@ -395,4 +402,5 @@ void print_compiletime_support(void) { | |||
395 | "disabled" | 402 | "disabled" |
396 | #endif | 403 | #endif |
397 | ); | 404 | ); |
405 | |||
398 | } | 406 | } |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 69b9d77bc..2a2e97419 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -572,58 +572,6 @@ void fs_proc_sys_dev_boot(void) { | |||
572 | } | 572 | } |
573 | free(fname); | 573 | free(fname); |
574 | 574 | ||
575 | // todo: investigate | ||
576 | #if 0 | ||
577 | // breaks too many applications, option needed | ||
578 | /* // disable /run/user/{uid}/bus */ | ||
579 | /* char *fnamebus; */ | ||
580 | /* if (asprintf(&fnamebus, "/run/user/%d/bus", getuid()) == -1) */ | ||
581 | /* errExit("asprintf"); */ | ||
582 | /* if (stat(fnamebus, &s) == 0) */ | ||
583 | /* disable_file(BLACKLIST_FILE, fnamebus); */ | ||
584 | /* free(fnamebus); */ | ||
585 | |||
586 | // WARNING: not working | ||
587 | // disable /run/user/{uid}/kdeinit* | ||
588 | //char *fnamekde; | ||
589 | //if (asprintf(&fnamekde, "/run/user/%d/kdeinit*", getuid()) == -1) | ||
590 | // errExit("asprintf"); | ||
591 | //if (stat(fnamekde, &s) == 0) | ||
592 | // disable_file(BLACKLIST_FILE, fnamekde); | ||
593 | //free(fnamekde); | ||
594 | |||
595 | |||
596 | // disable /run/user/{uid}/pulse | ||
597 | /* char *fnamepulse; */ | ||
598 | /* if (asprintf(&fnamepulse, "/run/user/%d/pulse", getuid()) == -1) */ | ||
599 | /* errExit("asprintf"); */ | ||
600 | /* if (stat(fnamepulse, &s) == 0) */ | ||
601 | /* disable_file(BLACKLIST_FILE, fnamepulse); */ | ||
602 | /* free(fnamepulse); */ | ||
603 | |||
604 | // disable /run/user/{uid}/dconf | ||
605 | /* char *fnamedconf; */ | ||
606 | /* if (asprintf(&fnamedconf, "/run/user/%d/dconf", getuid()) == -1) */ | ||
607 | /* errExit("asprintf"); */ | ||
608 | /* if (stat(fnamedconf, &s) == 0) */ | ||
609 | /* disable_file(BLACKLIST_FILE, fnamedconf); */ | ||
610 | /* free(fnamedconf); */ | ||
611 | |||
612 | |||
613 | // dirs in /run/user/{uid}/ | ||
614 | // using gnome: | ||
615 | // bus, dconf, gdm, gnome-shell, gnupg, gvfs, keyring, pulse, systemd | ||
616 | |||
617 | // using kde: | ||
618 | // kdeinit__0, ... | ||
619 | |||
620 | // more files with sockets to be blacklisted | ||
621 | // /run/dbus /run/systemd /run/udev /run/lvm | ||
622 | |||
623 | // /run/user/{uid} does not exist on some systems, usually used and created by desktop applications | ||
624 | |||
625 | #endif | ||
626 | |||
627 | if (getuid() != 0) { | 575 | if (getuid() != 0) { |
628 | // disable /dev/kmsg and /proc/kmsg | 576 | // disable /dev/kmsg and /proc/kmsg |
629 | disable_file(BLACKLIST_FILE, "/dev/kmsg"); | 577 | disable_file(BLACKLIST_FILE, "/dev/kmsg"); |
diff --git a/src/firejail/git.c b/src/firejail/git.c index 1cfbb1bf4..b67339c8b 100644 --- a/src/firejail/git.c +++ b/src/firejail/git.c | |||
@@ -17,6 +17,9 @@ | |||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | 17 | * with this program; if not, write to the Free Software Foundation, Inc., |
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | |||
21 | #ifdef HAVE_GIT_INSTALL | ||
22 | |||
20 | #include "firejail.h" | 23 | #include "firejail.h" |
21 | #include <sys/utsname.h> | 24 | #include <sys/utsname.h> |
22 | #include <sched.h> | 25 | #include <sched.h> |
@@ -84,3 +87,4 @@ void git_uninstall(void) { | |||
84 | exit(0); | 87 | exit(0); |
85 | } | 88 | } |
86 | 89 | ||
90 | #endif // HAVE_GIT_INSTALL | ||
diff --git a/src/firejail/main.c b/src/firejail/main.c index ee89a7281..0d4cf2595 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -846,11 +846,13 @@ int main(int argc, char **argv) { | |||
846 | EUID_INIT(); | 846 | EUID_INIT(); |
847 | EUID_USER(); | 847 | EUID_USER(); |
848 | 848 | ||
849 | #ifdef HAVE_GIT_INSTALL | ||
849 | // process git-install and git-uninstall | 850 | // process git-install and git-uninstall |
850 | if (check_arg(argc, argv, "--git-install")) | 851 | if (check_arg(argc, argv, "--git-install")) |
851 | git_install(); // this function will not return | 852 | git_install(); // this function will not return |
852 | if (check_arg(argc, argv, "--git-uninstall")) | 853 | if (check_arg(argc, argv, "--git-uninstall")) |
853 | git_uninstall(); // this function will not return | 854 | git_uninstall(); // this function will not return |
855 | #endif | ||
854 | 856 | ||
855 | // check argv[0] symlink wrapper if this is not a login shell | 857 | // check argv[0] symlink wrapper if this is not a login shell |
856 | if (*argv[0] != '-') | 858 | if (*argv[0] != '-') |
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index b9fff2011..dc8fcdfef 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -76,9 +76,11 @@ void usage(void) { | |||
76 | printf(" --env=name=value - set environment variable.\n"); | 76 | printf(" --env=name=value - set environment variable.\n"); |
77 | printf(" --fs.print=name|pid - print the filesystem log.\n"); | 77 | printf(" --fs.print=name|pid - print the filesystem log.\n"); |
78 | printf(" --get=name|pid filename - get a file from sandbox container.\n"); | 78 | printf(" --get=name|pid filename - get a file from sandbox container.\n"); |
79 | #ifdef HAVE_GIT_INSTALL | ||
79 | printf(" --git-install - download, compile and install mainline git version\n"); | 80 | printf(" --git-install - download, compile and install mainline git version\n"); |
80 | printf("\tof Firejail.\n"); | 81 | printf("\tof Firejail.\n"); |
81 | printf(" --git-uninstall - uninstall mainline git version of Firejail\n"); | 82 | printf(" --git-uninstall - uninstall mainline git version of Firejail\n"); |
83 | #endif | ||
82 | printf(" --help, -? - this help screen.\n"); | 84 | printf(" --help, -? - this help screen.\n"); |
83 | printf(" --hostname=name - set sandbox hostname.\n"); | 85 | printf(" --hostname=name - set sandbox hostname.\n"); |
84 | printf(" --hosts-file=file - use file as /etc/hosts.\n"); | 86 | printf(" --hosts-file=file - use file as /etc/hosts.\n"); |