grsecurity fixes

4 files changed, 12 insertions, 11 deletions

diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index 6b934bda6..2d42c7d8a 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -247,11 +247,13 @@ void caps_print(void) {
         // check current caps supported by the kernel
         int cnt = 0;
         unsigned long cap;
+        EUID_ROOT();    // grsecurity fix
         for (cap=0; cap <= 63; cap++) {
                 int code = prctl(PR_CAPBSET_DROP, cap, 0, 0, 0);
                 if (code == 0)
                         cnt++;
         }
+        EUID_USER();
         printf("Your kernel supports %d capabilities.\n", cnt);
         
         for (i = 0; i < elems; i++) {
diff --git a/src/firejail/list.c b/src/firejail/list.c
index 73feb48aa..b7c0b5264 100644
--- a/src/firejail/list.c
+++ b/src/firejail/list.c
@@ -21,6 +21,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
+#if 0
 static void grsec_elevate_privileges(void) {
         struct stat s;
         if (stat("/proc/sys/kernel/grsecurity", &s) == 0) {
@@ -33,10 +34,10 @@ static void grsec_elevate_privileges(void) {
                         errExit("setregid");
         }
 }
+#endif
 
 void top(void) {
         EUID_ASSERT();
-        grsec_elevate_privileges();
         
         char *arg[4];
         arg[0] = "bash";
@@ -48,7 +49,7 @@ void top(void) {
 
 void netstats(void) {
         EUID_ASSERT();
-        grsec_elevate_privileges();
+//      grsec_elevate_privileges();     
         
         char *arg[4];
         arg[0] = "bash";
@@ -60,7 +61,6 @@ void netstats(void) {
 
 void list(void) {
         EUID_ASSERT();
-        grsec_elevate_privileges();
         
         char *arg[4];
         arg[0] = "bash";
@@ -72,7 +72,6 @@ void list(void) {
 
 void tree(void) {
         EUID_ASSERT();
-        grsec_elevate_privileges();
         
         char *arg[4];
         arg[0] = "bash";
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index d148c1f40..22e23d148 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -131,7 +131,7 @@ static void chk_chroot(void) {
 }
 
 static int monitor_application(pid_t app_pid) {
-
+        EUID_USER();
 
         int status;
         while (app_pid) {
diff --git a/src/firemon/firemon.c b/src/firemon/firemon.c
index 9c3558362..3140c5f70 100644
--- a/src/firemon/firemon.c
+++ b/src/firemon/firemon.c
@@ -112,12 +112,6 @@ int main(int argc, char **argv) {
         unsigned pid = 0;
         int i;
 
-        struct stat s;
-        if (getuid() != 0 &&stat("/proc/sys/kernel/grsecurity", &s) == 0) {
-                fprintf(stderr, "Error: on Grsecurity systems only root user can run this program\n");
-                exit(1);
-        }
-        
         // handle CTRL-C
         signal (SIGINT, my_handler);
         signal (SIGTERM, my_handler);
@@ -143,6 +137,12 @@ int main(int argc, char **argv) {
                         return 0;
                 }
                 else if (strcmp(argv[i], "--netstats") == 0) {
+                        struct stat s;
+                        if (getuid() != 0 && stat("/proc/sys/kernel/grsecurity", &s) == 0) {
+                                fprintf(stderr, "Error: this feature is not available on Grsecurity systems\n");
+                                exit(1);
+                        }       
+
                         netstats();
                         return 0;
                 }