--nosound option

4 files changed, 72 insertions, 4 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index cbc4086fb..ed3e2679f 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -174,6 +174,7 @@ extern int arg_private_etc;	// private etc directory
 extern int arg_private_bin;     // private bin directory
 extern int arg_scan;            // arp-scan all interfaces
 extern int arg_whitelist;       // whitelist commad
+extern int arg_nosound; // disable sound
 
 extern int parent_to_child_fds[2];
 extern int child_to_parent_fds[2];
@@ -406,6 +407,7 @@ void errno_print(void);
 
 // pulseaudio.c
 void pulseaudio_init(void);
+void pulseaudio_disable(void);
 
 // fs_bin.c
 void fs_check_bin_list(void);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 616b26894..14ba21db5 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -85,6 +85,7 @@ int arg_private_etc = 0;			// private etc directory
 int arg_private_bin = 0;                        // private bin directory
 int arg_scan = 0;                               // arp-scan all interfaces
 int arg_whitelist = 0;                          // whitelist commad
+int arg_nosound = 0;                            // disable sound
 
 int parent_to_child_fds[2];
 int child_to_parent_fds[2];
@@ -791,7 +792,11 @@ int main(int argc, char **argv) {
                 }
                 else if (strncmp(argv[i], "--env=", 6) == 0)
                         env_store(argv[i] + 6);
-                
+                else if (strncmp(argv[i], "--nosound", 9) == 0) {
+                        arg_nosound = 1;
+                        arg_private_dev = 1;
+                }
+                                
                 //*************************************
                 // network
                 //*************************************
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index bea0cc940..7ab77998e 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -21,8 +21,66 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/mount.h>
+#include <dirent.h>
 
-// disable shm in pulse audio
+static void disable_file(const char *file) {
+        assert(file);
+        
+        struct stat s;
+        char *fname;
+        if (asprintf(&fname, "/tmp/%s", file) == -1)
+                errExit("asprintf");
+        if (stat(fname, &s) == -1)
+                return;
+        if (S_ISDIR(s.st_mode)) {
+                if (mount(RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                        errExit("disable file");
+        }
+        else {
+                if (mount(RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                        errExit("disable file");
+        }
+}
+
+// disable pulseaudio socket
+void pulseaudio_disable(void) {
+        //**************************************
+        // blacklist any pulse* directory in /tmp directory
+        //**************************************
+        DIR *dir;
+        if (!(dir = opendir("/tmp"))) {
+                // sleep 2 seconds and try again
+                sleep(2);
+                if (!(dir = opendir("/tmp"))) {
+                        fprintf(stderr, "Warning: cannot open /tmp directory. PulseAudio sockets not disabled\n");
+                        return;
+                }
+        }
+
+        struct dirent *entry;
+        while ((entry = readdir(dir))) {
+                if (strncmp(entry->d_name, "pulse-", 6) == 0) {
+                        if (arg_debug)
+                                printf("Disable %s\n", entry->d_name);
+                        disable_file(entry->d_name);
+                }
+        }
+
+        closedir(dir);
+
+        //**************************************
+        // blacklist XDG_RUNTIME_DIR
+        //**************************************
+        char *name = getenv("XDG_RUNTIME_DIR");
+        if (name) {
+                if (arg_debug)
+                        printf("Disable %s\n", name);
+                disable_file(name);
+        }
+}
+
+
+// disable shm in pulseaudio
 void pulseaudio_init(void) {
         struct stat s;
         
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index d3f92e51b..50fe50380 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -272,9 +272,12 @@ int sandbox(void* sandbox_arg) {
         fs_proc_sys_dev_boot();
         
         //****************************
-        // fix for pulseaudio 7.0
+        // --nosound and fix for pulseaudio 7.0
         //****************************
-        pulseaudio_init();
+        if (arg_nosound)
+                pulseaudio_disable();
+        else
+                pulseaudio_init();
         
         //****************************
         // networking