fix umask problem

5 files changed, 24 insertions, 0 deletions

diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 513a5a8a2..eb90a39dd 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -81,6 +81,8 @@ void appimage_set(const char *appimage_path) {
                 fprintf(stderr, "Error: cannot create temporary directory\n");
                 exit(1);
         }
+        if (chmod(mntdir, 0700) == -1)
+                errExit("chmod");
         ASSERT_PERMS(mntdir, getuid(), getgid(), 0700);
         
         char *mode;
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 855ebad7b..e38f128ea 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -36,6 +36,8 @@ static void create_dir_as_root(const char *dir, mode_t mode) {
 
         if (mkdir(dir, mode) == -1)
                 errExit("mkdir");
+        if (chmod(dir, mode) == -1)
+                errExit("chmod");
 
         ASSERT_PERMS(dir, 0, 0, mode);
 }
@@ -47,6 +49,8 @@ static void create_empty_dir(void) {
                 /* coverity[toctou] */
                 if (mkdir(RUN_RO_DIR, S_IRUSR | S_IXUSR) == -1)
                         errExit("mkdir");
+                if (chmod(RUN_RO_DIR, S_IRUSR | S_IXUSR) == -1)
+                        errExit("chmod");
                 ASSERT_PERMS(RUN_RO_DIR, 0, 0, S_IRUSR | S_IXUSR);
         }
 }
@@ -772,6 +776,8 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
                 /* coverity[toctou] */
                 if (mkdir(dirname, 0700))
                         errExit("mkdir");
+                if (chmod(dirname, 0700) == -1)
+                        errExit("chmod");
                 ASSERT_PERMS(dirname, getuid(), getgid(), 0700);
         }
         else if (is_link(dirname)) {
@@ -859,6 +865,8 @@ void fs_overlayfs(void) {
                 errExit("asprintf");
         if (mkdir(oroot, 0755))
                 errExit("mkdir");
+        if (chmod(oroot, 0755) == -1)
+                errExit("chmod");
         ASSERT_PERMS(oroot, 0, 0, 0755);
 
         struct stat s;
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index b9d8614d4..6c4db57b4 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -205,6 +205,8 @@ void fs_private_bin_list(void) {
         fs_build_mnt_dir();
         if (mkdir(RUN_BIN_DIR, 0755) == -1)
                 errExit("mkdir");
+        if (chmod(RUN_BIN_DIR, 0755) == -1)
+                errExit("chmod");
         ASSERT_PERMS(RUN_BIN_DIR, 0, 0, 0755);
         
         // copy the list of files in the new etc directory
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 701183ee1..363d3e484 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -75,6 +75,8 @@ void fs_private_dev(void){
         if (have_dri) {
                 if (mkdir(RUN_DRI_DIR, 0755) == -1)
                         errExit("mkdir");
+                if (chmod(RUN_DRI_DIR, 0755) == -1)
+                        errExit("chmod");
                 ASSERT_PERMS(RUN_DRI_DIR, 0, 0, 0755);
         
                 // keep a copy of /dev/dri under DRI_DIR
@@ -86,6 +88,8 @@ void fs_private_dev(void){
         if (have_snd) {
                 if (mkdir(RUN_SND_DIR, 0755) == -1)
                         errExit("mkdir");
+                if (chmod(RUN_SND_DIR, 0755) == -1)
+                        errExit("chmod");
                 ASSERT_PERMS(RUN_SND_DIR, 0, 0, 0755);
         
                 // keep a copy of /dev/dri under DRI_DIR
@@ -130,6 +134,8 @@ void fs_private_dev(void){
                 /* coverity[toctou] */
                 if (mkdir("/dev/snd", 0755) == -1)
                         errExit("mkdir");
+                if (chmod("/dev/snd", 0755) == -1)
+                        errExit("chmod");
                 ASSERT_PERMS("/dev/snd", 0, 0, 0755);
                 if (mount(RUN_SND_DIR, "/dev/snd", NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mounting /dev/snd");
@@ -140,6 +146,8 @@ void fs_private_dev(void){
         if (have_dri) {
                 if (mkdir("/dev/dri", 0755) == -1)
                         errExit("mkdir");
+                if (chmod("/dev/dri", 0755) == -1)
+                        errExit("chmod");
                 ASSERT_PERMS("/dev/dri", 0, 0, 0755);
                 if (mount(RUN_DRI_DIR, "/dev/dri", NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mounting /dev/dri");
@@ -178,6 +186,8 @@ void fs_private_dev(void){
         // pseudo-terminal
         if (mkdir("/dev/pts", 0755) == -1)
                 errExit("mkdir");
+        if (chmod("/dev/pts", 0755) == -1)
+                errExit("chmod");
         ASSERT_PERMS("/dev/pts", 0, 0, 0755);
         fs_logger("mkdir /dev/pts");
         create_char_dev("/dev/pts/ptmx", 0666, 5, 2); //"mknod -m 666 /dev/pts/ptmx c 5 2");
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index d5b348ee2..e860bc173 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -132,6 +132,8 @@ void fs_private_etc_list(void) {
         fs_build_mnt_dir();
         if (mkdir(RUN_ETC_DIR, 0755) == -1)
                 errExit("mkdir");
+        if (chmod(RUN_ETC_DIR, 0755) == -1)
+                errExit("chmod");
         ASSERT_PERMS(RUN_ETC_DIR, 0, 0, 0755);
         fs_logger("tmpfs /etc");