Merge branch 'master' into security

8 files changed, 193 insertions, 122 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index fed934434..5bc859f8d 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -241,6 +241,14 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        else if (strncmp(ptr, "chroot-desktop ", 15) == 0) {
+                                if (strcmp(ptr + 15, "yes") == 0)
+                                        cfg_val[CFG_CHROOT_DESKTOP] = 1;
+                                else if (strcmp(ptr + 15, "no") == 0)
+                                        cfg_val[CFG_CHROOT_DESKTOP] = 0;
+                                else
+                                        goto errout;
+                        }
                         else
                                 goto errout;
 
diff --git a/src/firejail/env.c b/src/firejail/env.c
index c05abadca..2c8be3852 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -123,10 +123,14 @@ void env_defaults(void) {
                 errExit("setenv");
         if (cfg.shell && setenv("SHELL", cfg.shell, 1) < 0)
                 errExit("setenv");
+
         // set prompt color to green
-        //export PS1='\[\e[1;32m\][\u@\h \W]\$\[\e[0m\] '
-//      if (setenv("PROMPT_COMMAND", "export PS1=\"\\[\\e[1;32m\\][\\u@\\h \\W]\\$\\[\\e[0m\\] \"", 1) < 0)
-//              errExit("setenv");
+        char *prompt = getenv("FIREJAIL_PROMPT");
+        if (prompt && strcmp(prompt, "yes") == 0) {
+                //export PS1='\[\e[1;32m\][\u@\h \W]\$\[\e[0m\] '
+                if (setenv("PROMPT_COMMAND", "export PS1=\"\\[\\e[1;32m\\][\\u@\\h \\W]\\$\\[\\e[0m\\] \"", 1) < 0)
+                        errExit("setenv");
+        }
 
         // set the window title
         printf("\033]0;firejail %s\007", cfg.window_title);
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 4bc953e24..a3b573acc 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -614,7 +614,8 @@ void sandboxfs(int op, pid_t pid, const char *patqh);
 #define CFG_XEPHYR_WINDOW_TITLE 10
 #define CFG_REMOUNT_PROC_SYS 11
 #define CFG_OVERLAYFS 12
-#define CFG_MAX 13 // this should always be the last entry
+#define CFG_CHROOT_DESKTOP 13
+#define CFG_MAX 14 // this should always be the last entry
 extern char *xephyr_screen;
 extern char *xephyr_extra_params;
 extern char *netfilter_default;
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index ddb25c2dd..6c87df1e9 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -817,9 +817,10 @@ void fs_basic_fs(void) {
 
 #ifdef HAVE_OVERLAYFS
 char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
-        // create ~/.firejail directory
         struct stat s;
         char *dirname;
+
+        // create ~/.firejail directory
         if (asprintf(&dirname, "%s/.firejail", cfg.homedir) == -1)
                 errExit("asprintf");
         if (stat(dirname, &s) == -1) {
@@ -835,12 +836,15 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
                 fprintf(stderr, "Error: invalid ~/.firejail directory\n");
                 exit(1);
         }
-
         free(dirname);
 
         // check overlay directory
         if (asprintf(&dirname, "%s/.firejail/%s", cfg.homedir, subdirname) == -1)
                 errExit("asprintf");
+        if (is_link(dirname)) {
+                fprintf(stderr, "Error: overlay directory is a symbolic link\n");
+                exit(1);
+        }
         if (allow_reuse == 0) {
                 if (stat(dirname, &s) == 0) {
                         fprintf(stderr, "Error: overlay directory already exists: %s\n", dirname);
@@ -1207,56 +1211,58 @@ int fs_check_chroot_dir(const char *rootdir) {
 void fs_chroot(const char *rootdir) {
         assert(rootdir);
         
-        // mount-bind a /dev in rootdir
-        char *newdev;
-        if (asprintf(&newdev, "%s/dev", rootdir) == -1)
-                errExit("asprintf");
-        if (arg_debug)
-                printf("Mounting /dev on %s\n", newdev);
-        if (mount("/dev", newdev, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mounting /dev");
-        free(newdev);
-        
-        // x11
-        if (getenv("FIREJAIL_X11")) {
-                char *newx11;
-                if (asprintf(&newx11, "%s/tmp/.X11-unix", rootdir) == -1)
+        if (checkcfg(CFG_CHROOT_DESKTOP)) {
+                // mount-bind a /dev in rootdir
+                char *newdev;
+                if (asprintf(&newdev, "%s/dev", rootdir) == -1)
                         errExit("asprintf");
                 if (arg_debug)
-                        printf("Mounting /tmp/.X11-unix on %s\n", newx11);
-                if (mount("/tmp/.X11-unix", newx11, NULL, MS_BIND|MS_REC, NULL) < 0)
-                        errExit("mounting /tmp/.X11-unix");
-                free(newx11);
-        }
-        
-        // some older distros don't have a /run directory
-        // create one by default
-        // no exit on error, let the user deal with any problems
-        char *rundir;
-        if (asprintf(&rundir, "%s/run", rootdir) == -1)
-                errExit("asprintf");
-        if (!is_dir(rundir)) {
-                int rv = mkdir(rundir, 0755);
-                (void) rv;
-                rv = chown(rundir, 0, 0);
-                (void) rv;
+                        printf("Mounting /dev on %s\n", newdev);
+                if (mount("/dev", newdev, NULL, MS_BIND|MS_REC, NULL) < 0)
+                        errExit("mounting /dev");
+                free(newdev);
+                
+                // x11
+                if (getenv("FIREJAIL_X11")) {
+                        char *newx11;
+                        if (asprintf(&newx11, "%s/tmp/.X11-unix", rootdir) == -1)
+                                errExit("asprintf");
+                        if (arg_debug)
+                                printf("Mounting /tmp/.X11-unix on %s\n", newx11);
+                        if (mount("/tmp/.X11-unix", newx11, NULL, MS_BIND|MS_REC, NULL) < 0)
+                                errExit("mounting /tmp/.X11-unix");
+                        free(newx11);
+                }
+                
+                // some older distros don't have a /run directory
+                // create one by default
+                // no exit on error, let the user deal with any problems
+                char *rundir;
+                if (asprintf(&rundir, "%s/run", rootdir) == -1)
+                        errExit("asprintf");
+                if (!is_dir(rundir)) {
+                        int rv = mkdir(rundir, 0755);
+                        (void) rv;
+                        rv = chown(rundir, 0, 0);
+                        (void) rv;
+                }
+                
+                // copy /etc/resolv.conf in chroot directory
+                // if resolv.conf in chroot is a symbolic link, this will fail
+                // no exit on error, let the user deal with the problem
+                char *fname;
+                if (asprintf(&fname, "%s/etc/resolv.conf", rootdir) == -1)
+                        errExit("asprintf");
+                if (arg_debug)
+                        printf("Updating /etc/resolv.conf in %s\n", fname);
+                if (is_link(fname)) {
+                        fprintf(stderr, "Error: invalid %s file\n", fname);
+                        exit(1);
+                }
+                if (copy_file("/etc/resolv.conf", fname) == -1)
+                        fprintf(stderr, "Warning: /etc/resolv.conf not initialized\n");
         }
         
-        // copy /etc/resolv.conf in chroot directory
-        // if resolv.conf in chroot is a symbolic link, this will fail
-        // no exit on error, let the user deal with the problem
-        char *fname;
-        if (asprintf(&fname, "%s/etc/resolv.conf", rootdir) == -1)
-                errExit("asprintf");
-        if (arg_debug)
-                printf("Updating /etc/resolv.conf in %s\n", fname);
-        if (is_link(fname)) {
-                fprintf(stderr, "Error: invalid %s file\n", fname);
-                exit(1);
-        }
-        if (copy_file("/etc/resolv.conf", fname) == -1)
-                fprintf(stderr, "Warning: /etc/resolv.conf not initialized\n");
-                
         // chroot into the new directory
         if (arg_debug)
                 printf("Chrooting into %s\n", rootdir);
@@ -1265,24 +1271,26 @@ void fs_chroot(const char *rootdir) {
         // mount a new tmpfs in /run/firejail/mnt - the old one was lost in chroot
         fs_build_remount_mnt_dir();
                 
-        // update /var directory in order to support multiple sandboxes running on the same root directory
-        if (!arg_private_dev)
-                fs_dev_shm();
-        fs_var_lock();
-        fs_var_tmp();
-        fs_var_log();
-        fs_var_lib();
-        fs_var_cache();
-        fs_var_utmp();
-
-        // don't leak user information
-        restrict_users();
-
-        // when starting as root, firejail config is not disabled;
-        // this mode could be used to install and test new software by chaining
-        // firejail sandboxes (firejail --force)
-        if (getuid() != 0)
-                disable_config();
+        if (checkcfg(CFG_CHROOT_DESKTOP)) {
+                // update /var directory in order to support multiple sandboxes running on the same root directory
+                if (!arg_private_dev)
+                        fs_dev_shm();
+                fs_var_lock();
+                fs_var_tmp();
+                fs_var_log();
+                fs_var_lib();
+                fs_var_cache();
+                fs_var_utmp();
+        
+                // don't leak user information
+                restrict_users();
+        
+                // when starting as root, firejail config is not disabled;
+                // this mode could be used to install and test new software by chaining
+                // firejail sandboxes (firejail --force)
+                if (getuid() != 0)
+                        disable_config();
+        }
 }
 #endif
 
diff --git a/src/firejail/main.c b/src/firejail/main.c
index bdb8e0df5..27e2a7f1a 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1365,6 +1365,13 @@ int main(int argc, char **argv) {
                                         fprintf(stderr, "Error: invalid overlay option\n");
                                         exit(1);
                                 }
+                                
+                                // check name
+                                invalid_filename(subdirname);
+                                if (strstr(subdirname, "..") || strstr(subdirname, "/")) {
+                                        fprintf(stderr, "Error: invalid overlay name\n");
+                                        exit(1);
+                                }
                                 cfg.overlay_dir = fs_check_overlay_dir(subdirname, arg_overlay_reuse);
                         }
                         else {
@@ -1373,6 +1380,7 @@ int main(int argc, char **argv) {
                         }
 
                 }
+#if 0 // disabled for now, it could be used to overwrite system directories     
                 else if (strncmp(argv[i], "--overlay-path=", 15) == 0) {
                         if (checkcfg(CFG_OVERLAYFS)) {
                                 if (cfg.chrootdir) {
@@ -1400,6 +1408,7 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                 }
+#endif
                 else if (strcmp(argv[i], "--overlay-tmpfs") == 0) {
                         if (checkcfg(CFG_OVERLAYFS)) {
                                 if (cfg.chrootdir) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 0818bf450..40df00a98 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -378,7 +378,30 @@ void start_application(void) {
         exit(1); // it should never get here!!!
 }
 
-
+static void enforce_filters(void) {
+        // force default seccomp inside the chroot, no keep or drop list
+        // the list build on top of the default drop list is kept intact
+        arg_seccomp = 1;
+        if (cfg.seccomp_list_drop) {
+                free(cfg.seccomp_list_drop);
+                cfg.seccomp_list_drop = NULL;
+        }
+        if (cfg.seccomp_list_keep) {
+                free(cfg.seccomp_list_keep);
+                cfg.seccomp_list_keep = NULL;
+        }
+        
+        // disable all capabilities
+        if (arg_caps_default_filter || arg_caps_list)
+                fprintf(stderr, "Warning: all capabilities disabled for a regular user in chroot\n");
+        arg_caps_drop_all = 1;
+        
+        // drop all supplementary groups; /etc/group file inside chroot
+        // is controlled by a regular usr
+        arg_nogroups = 1;
+        if (!arg_quiet)
+                printf("Dropping all Linux capabilities and enforcing default seccomp filter\n");
+}
 
 int sandbox(void* sandbox_arg) {
         // Get rid of unused parameter warning
@@ -463,37 +486,13 @@ int sandbox(void* sandbox_arg) {
 #ifdef HAVE_CHROOT              
         if (cfg.chrootdir) {
                 fs_chroot(cfg.chrootdir);
-
-//              // redo cp command
-//              fs_build_cp_command();
                 
                 // force caps and seccomp if not started as root
                 if (getuid() != 0) {
-                        // force default seccomp inside the chroot, no keep or drop list
-                        // the list build on top of the default drop list is kept intact
-                        arg_seccomp = 1;
+                        enforce_filters();
 #ifdef HAVE_SECCOMP
                         enforce_seccomp = 1;
 #endif
-                        if (cfg.seccomp_list_drop) {
-                                free(cfg.seccomp_list_drop);
-                                cfg.seccomp_list_drop = NULL;
-                        }
-                        if (cfg.seccomp_list_keep) {
-                                free(cfg.seccomp_list_keep);
-                                cfg.seccomp_list_keep = NULL;
-                        }
-                        
-                        // disable all capabilities
-                        if (arg_caps_default_filter || arg_caps_list)
-                                fprintf(stderr, "Warning: all capabilities disabled for a regular user in chroot\n");
-                        arg_caps_drop_all = 1;
-                        
-                        // drop all supplementary groups; /etc/group file inside chroot
-                        // is controlled by a regular usr
-                        arg_nogroups = 1;
-                        if (!arg_quiet)
-                                printf("Dropping all Linux capabilities and enforcing default seccomp filter\n");
                 }
                 else
                         arg_seccomp = 1;
@@ -507,8 +506,18 @@ int sandbox(void* sandbox_arg) {
         else 
 #endif          
 #ifdef HAVE_OVERLAYFS
-        if (arg_overlay)        
+        if (arg_overlay)        {
                 fs_overlayfs();
+                // force caps and seccomp if not started as root
+                if (getuid() != 0) {
+                        enforce_filters();
+#ifdef HAVE_SECCOMP
+                        enforce_seccomp = 1;
+#endif
+                }
+                else
+                        arg_seccomp = 1;
+        }
         else
 #endif
                 fs_basic_fs();
@@ -524,8 +533,14 @@ int sandbox(void* sandbox_arg) {
         // private mode
         //****************************
         if (arg_private) {
-                if (cfg.home_private)   // --private=
-                        fs_private_homedir();
+                if (cfg.home_private) { // --private=
+                        if (cfg.chrootdir)
+                                fprintf(stderr, "Warning: private=directory feature is disabled in chroot\n");
+                        else if (arg_overlay)
+                                fprintf(stderr, "Warning: private=directory feature is disabled in overlay\n");
+                        else
+                                fs_private_homedir();
+                }
                 else // --private
                         fs_private();
         }
@@ -533,11 +548,20 @@ int sandbox(void* sandbox_arg) {
    if (arg_private_template) 
       fs_private_template();
 
-        if (arg_private_dev)
-                fs_private_dev();
+        if (arg_private_dev) {
+                if (cfg.chrootdir)
+                        fprintf(stderr, "Warning: private-dev feature is disabled in chroot\n");
+                else if (arg_overlay)
+                        fprintf(stderr, "Warning: private-dev feature is disabled in overlay\n");
+                else
+                        fs_private_dev();
+        }
+                
         if (arg_private_etc) {
                 if (cfg.chrootdir)
                         fprintf(stderr, "Warning: private-etc feature is disabled in chroot\n");
+                else if (arg_overlay)
+                        fprintf(stderr, "Warning: private-etc feature is disabled in overlay\n");
                 else {
                         fs_private_etc_list();
                         // create /etc/ld.so.preload file again
@@ -545,14 +569,24 @@ int sandbox(void* sandbox_arg) {
                                 fs_trace_preload();
                 }
         }
+        
         if (arg_private_bin) {
                 if (cfg.chrootdir)
                         fprintf(stderr, "Warning: private-bin feature is disabled in chroot\n");
+                else if (arg_overlay)
+                        fprintf(stderr, "Warning: private-bin feature is disabled in overlay\n");
                 else
                         fs_private_bin_list();
         }
-        if (arg_private_tmp)
-                fs_private_tmp();
+        
+        if (arg_private_tmp) {
+                if (cfg.chrootdir)
+                        fprintf(stderr, "Warning: private-tmp feature is disabled in chroot\n");
+                else if (arg_overlay)
+                        fprintf(stderr, "Warning: private-tmp feature is disabled in overlay\n");
+                else
+                        fs_private_tmp();
+        }
         
         //****************************
         // update /proc, /sys, /dev, /boot directorymy
@@ -565,7 +599,12 @@ int sandbox(void* sandbox_arg) {
         //****************************
         if (cfg.profile) {
                 // apply all whitelist commands ... 
-                fs_whitelist();
+                if (cfg.chrootdir)
+                        fprintf(stderr, "Warning: whitelist feature is disabled in chroot\n");
+                else if (arg_overlay)
+                        fprintf(stderr, "Warning: whitelist feature is disabled in overlay\n");
+                else
+                        fs_whitelist();
                 
                 // ... followed by blacklist commands
                 fs_blacklist();
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index ebe1c8830..d4eab7802 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -185,10 +185,30 @@ void usage(void) {
         printf("\t$HOME/.firejail/<NAME> directory. (OverlayFS support is required in\n");
         printf("\tLinux kernel for this option to work). \n\n");
 
+#if 0 // disabled for now, it could be used to overwrite system directories     
         printf("    --overlay-path=path - mount a filesystem overlay on top of the current\n");
         printf("\tfilesystem. The upper filesystem layer is persistent, and stored in\n");
         printf("\tthe specified path. (OverlayFS support is required in Linux kernel for\n");
         printf("\tthis option to work). \n\n");
+        
+.TP
+\fB\-\-overlay-path=path
+Mount a filesystem overlay on top of the current filesystem.  Unlike the regular filesystem container,
+the system directories are mounted read-write. All filesystem modifications go into the overlay.
+The overlay is stored in the specified path. The created overlay can be reused between multiple sessions.
+.br
+
+.br
+OverlayFS support is required in Linux kernel for this option to work.
+OverlayFS was officially introduced in Linux kernel version 3.18.
+This option is not available on Grsecurity systems.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-overlay-path=~/jails/jail1 firefox
+#endif
 
         printf("    --overlay-tmpfs - mount a filesystem overlay on top of the current\n");
         printf("\tfilesystem. The upper layer is stored in a tmpfs filesystem,\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index b258c3d20..19fca9854 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1037,24 +1037,6 @@ Example:
 $ firejail \-\-overlay-named=jail1 firefox
 
 .TP
-\fB\-\-overlay-path=path
-Mount a filesystem overlay on top of the current filesystem.  Unlike the regular filesystem container,
-the system directories are mounted read-write. All filesystem modifications go into the overlay.
-The overlay is stored in the specified path. The created overlay can be reused between multiple sessions.
-.br
-
-.br
-OverlayFS support is required in Linux kernel for this option to work.
-OverlayFS was officially introduced in Linux kernel version 3.18.
-This option is not available on Grsecurity systems.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-overlay-path=~/jails/jail1 firefox
-
-.TP
 \fB\-\-overlay-tmpfs
 Mount a filesystem overlay on top of the current filesystem. All filesystem modifications go into the overlay,
 and are discarded when the sandbox is closed.