Add dbus filter options

The options --dbus-user.talk, --dbus-user.own, --dbus-system.talk, and
--dbus-system.own control which names can be accessed and owned on the user and
system buses.

5 files changed, 206 insertions, 19 deletions

diff --git a/src/firejail/dbus.c b/src/firejail/dbus.c
index 5cdd4b372..bf1ae9a1e 100644
--- a/src/firejail/dbus.c
+++ b/src/firejail/dbus.c
@@ -24,6 +24,7 @@
 #include <sys/wait.h>
 #include <unistd.h>
 #include <fcntl.h>
+#include <string.h>
 
 #define DBUS_SOCKET_PATH_PREFIX "unix:path="
 #define DBUS_USER_SOCKET_FORMAT "/run/user/%d/bus"
@@ -33,12 +34,82 @@
 #define DBUS_SESSION_BUS_ADDRESS_ENV "DBUS_SESSION_BUS_ADDRESS"
 #define DBUS_USER_PROXY_SOCKET_FORMAT RUN_FIREJAIL_DBUS_DIR "/%d-user"
 #define DBUS_SYSTEM_PROXY_SOCKET_FORMAT RUN_FIREJAIL_DBUS_DIR "/%d-system"
+#define DBUS_MAX_NAME_LENGTH 255
 
 static pid_t dbus_proxy_pid = 0;
 static int dbus_proxy_status_fd = -1;
 static char *dbus_user_proxy_socket = NULL;
 static char *dbus_system_proxy_socket = NULL;
 
+int dbus_check_name(const char *name) {
+        unsigned long length = strlen(name);
+        if (length == 0 || length > DBUS_MAX_NAME_LENGTH)
+                return 0;
+        const char *p = name;
+        int segments = 1;
+        int in_segment = 0;
+        while (*p) {
+                int alpha = (*p >= 'a' && *p <= 'z') || (*p >= 'A' && *p <= 'Z');
+                int digit = *p >= '0' && *p <= '9';
+                if (in_segment) {
+                        if (*p == '.') {
+                                ++segments;
+                                in_segment = 0;
+                        } else if (!alpha && !digit && *p != '_' && *p != '-') {
+                                return 0;
+                        }
+                }
+                else {
+                        if (*p == '*') {
+                                return *(p + 1) == '\0';
+                        } else if (!alpha && *p != '_' && *p != '-') {
+                                return 0;
+                        }
+                        in_segment = 1;
+                }
+                ++p;
+        }
+        return in_segment && segments >= 2;
+}
+
+static void dbus_check_bus_profile(char const *prefix, DbusPolicy policy) {
+        size_t prefix_length = strlen(prefix);
+        ProfileEntry *it = cfg.profile;
+        while (it) {
+                char *data = it->data;
+                it = it->next;
+                if (strncmp(prefix, data, prefix_length) == 0) {
+                        switch (policy) {
+                        case DBUS_POLICY_ALLOW:
+                                // We should never get here, because profile parsing will fail earlier.
+                                fprintf(stderr,
+                                                "Error: %s filter rule configured, but the bus is not "
+                                                "set to filter.\n",
+                                                prefix);
+                                exit(1);
+                                break;
+                        case DBUS_POLICY_FILTER:
+                                // All good.
+                                break;
+                        case DBUS_POLICY_BLOCK:
+                                fwarning("%s filter rule configured, but the bus is blocked.\n", prefix);
+                                fwarning("Ignoring \"%s\" and any other %s filter rules.\n", data, prefix);
+                                break;
+                        default:
+                                fprintf(stderr, "Error: Unknown %s policy.\n", prefix);
+                                exit(1);
+                                break;
+                        }
+                        break;
+                }
+        }
+}
+
+void dbus_check_profile(void) {
+        dbus_check_bus_profile("dbus-user", arg_dbus_user);
+        dbus_check_bus_profile("dbus-system", arg_dbus_system);
+}
+
 static void write_arg(int fd, char const *format, ...) {
         va_list ap;
         va_start(ap, format);
@@ -55,6 +126,24 @@ static void write_arg(int fd, char const *format, ...) {
         free(arg);
 }
 
+static void write_profile(int fd, char const *prefix) {
+        size_t prefix_length = strlen(prefix);
+        ProfileEntry *it = cfg.profile;
+        while (it) {
+                char *data = it->data;
+                it = it->next;
+                if (strncmp(prefix, data, prefix_length) != 0)
+                        continue;
+                data += prefix_length;
+                int arg_length = 0;
+                while (data[arg_length] != '\0' && data[arg_length] != ' ')
+                        arg_length++;
+                if (data[arg_length] != ' ')
+                        continue;
+                write_arg(fd, "--%.*s=%s", arg_length, data, &data[arg_length + 1]);
+        }
+}
+
 void dbus_proxy_start(void) {
         int status_pipe[2];
         if (pipe(status_pipe) == -1)
@@ -96,7 +185,7 @@ void dbus_proxy_start(void) {
                                 errExit("asprintf");
                         write_arg(args_pipe[1], dbus_user_proxy_socket);
                         write_arg(args_pipe[1], "--filter");
-                        // TODO Write filter rules to pipe
+                        write_profile(args_pipe[1], "dbus-user.");
                 }
 
                 if (arg_dbus_system == DBUS_POLICY_FILTER) {
@@ -105,7 +194,7 @@ void dbus_proxy_start(void) {
                                 errExit("asprintf");
                         write_arg(args_pipe[1], dbus_system_proxy_socket);
                         write_arg(args_pipe[1], "--filter");
-                        // TODO Write filter rules to pipe
+                        write_profile(args_pipe[1], "dbus-system.");
                 }
 
                 if (close(args_pipe[1]) == -1)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 36ffd89b6..b811a6cd4 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -846,6 +846,8 @@ void set_x11_run_file(pid_t pid, int display);
 void set_profile_run_file(pid_t pid, const char *fname);
 
 // dbus.c
+int dbus_check_name(const char *name);
+void dbus_check_profile(void);
 void dbus_proxy_start(void);
 void dbus_proxy_stop(void);
 void dbus_apply_policy(void);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index b642329bf..b906f3047 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -256,6 +256,7 @@ void fs_blacklist(void) {
                 // whitelist commands handled by fs_whitelist()
                 if (strncmp(entry->data, "whitelist ", 10) == 0 ||
                     strncmp(entry->data, "nowhitelist ", 12) == 0 ||
+                    strncmp(entry->data, "dbus-", 5) == 0 ||
                    *entry->data == '\0') {
                         entry = entry->next;
                         continue;
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9e82a00b5..f59fc26e4 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2059,9 +2059,11 @@ int main(int argc, char **argv, char **envp) {
                         arg_dbus_system = DBUS_POLICY_BLOCK;
                 }
                 else if (strncmp("--dbus-user=", argv[i], 12) == 0) {
-                        if (strcmp("allow", argv[i] + 12) == 0) {
-                                arg_dbus_user = DBUS_POLICY_ALLOW;
-                        } else if (strcmp("filter", argv[i] + 12) == 0) {
+                        if (strcmp("filter", argv[i] + 12) == 0) {
+                                if (arg_dbus_user == DBUS_POLICY_BLOCK) {
+                                        fprintf(stderr, "Error: Cannot relax --dbus-user policy, it is already set to block\n");
+                                        exit(1);
+                                }
                                 arg_dbus_user = DBUS_POLICY_FILTER;
                         } else if (strcmp("none", argv[i] + 12) == 0) {
                                 arg_dbus_user = DBUS_POLICY_BLOCK;
@@ -2070,10 +2072,28 @@ int main(int argc, char **argv, char **envp) {
                                 exit(1);
                         }
                 }
+                else if (strncmp(argv[i], "--dbus-user.talk=", 17) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-user.talk %s", argv[i] + 17) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
+                else if (strncmp(argv[i], "--dbus-user.own=", 16) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-user.own %s", argv[i] + 16) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
                 else if (strncmp("--dbus-system=", argv[i], 14) == 0) {
-                        if (strcmp("allow", argv[i] + 14) == 0) {
-                                arg_dbus_system = DBUS_POLICY_ALLOW;
-                        } else if (strcmp("filter", argv[i] + 14) == 0) {
+                        if (strcmp("filter", argv[i] + 14) == 0) {
+                                if (arg_dbus_system == DBUS_POLICY_BLOCK) {
+                                        fprintf(stderr, "Error: Cannot relax --dbus-system policy, it is already set to block\n");
+                                        exit(1);
+                                }
                                 arg_dbus_system = DBUS_POLICY_FILTER;
                         } else if (strcmp("none", argv[i] + 14) == 0) {
                                 arg_dbus_system = DBUS_POLICY_BLOCK;
@@ -2082,6 +2102,22 @@ int main(int argc, char **argv, char **envp) {
                                 exit(1);
                         }
                 }
+                else if (strncmp(argv[i], "--dbus-system.talk=", 19) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-system.talk %s", argv[i] + 19) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
+                else if (strncmp(argv[i], "--dbus-system.own=", 18) == 0) {
+                        char *line;
+                        if (asprintf(&line, "dbus-system.own %s", argv[i] + 18) == -1)
+                                errExit("asprintf");
+
+                        profile_check_line(line, 0, NULL); // will exit if something wrong
+                        profile_add(line);
+                }
 
                 //*************************************
                 // network
@@ -2767,11 +2803,14 @@ int main(int argc, char **argv, char **envp) {
         }
         EUID_USER();
 
-        if (checkcfg(CFG_DBUS) &&
-                (arg_dbus_user == DBUS_POLICY_FILTER || arg_dbus_system == DBUS_POLICY_FILTER)) {
-                EUID_ROOT();
-                dbus_proxy_start();
-                EUID_USER();
+        if (checkcfg(CFG_DBUS)) {
+                dbus_check_profile();
+                if (arg_dbus_user == DBUS_POLICY_FILTER ||
+                        arg_dbus_system == DBUS_POLICY_FILTER) {
+                        EUID_ROOT();
+                        dbus_proxy_start();
+                        EUID_USER();
+                }
         }
 
         // clone environment
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 14533ce08..9bfd2ff1c 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -438,9 +438,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         }
         else if (strncmp("dbus-user ", ptr, 10) == 0) {
                 ptr += 10;
-                if (strcmp("allow", ptr) == 0) {
-                        arg_dbus_user = DBUS_POLICY_ALLOW;
-                } else if (strcmp("filter", ptr) == 0) {
+                if (strcmp("filter", ptr) == 0) {
+                        if (arg_dbus_user == DBUS_POLICY_BLOCK) {
+                                fprintf(stderr, "Error: Cannot relax dbus-user policy, it is already set to block\n");
+                                exit(1);
+                        }
                         arg_dbus_user = DBUS_POLICY_FILTER;
                 } else if (strcmp("none", ptr) == 0) {
                         arg_dbus_user = DBUS_POLICY_BLOCK;
@@ -450,11 +452,39 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 0;
         }
+        else if (strncmp(ptr, "dbus-user.talk ", 15) == 0) {
+                if (arg_dbus_user == DBUS_POLICY_ALLOW) {
+                        fprintf(stderr, "Session DBus filtering (dbus-user filter) is "
+                                                        "required for dbus-user.talk rules\n");
+                        exit(1);
+                }
+
+                if (!dbus_check_name(ptr + 15)) {
+                        printf("Invalid dbus-user.talk name: %s\n", ptr + 15);
+                        exit(1);
+                }
+                return 1;
+        }
+        else if (strncmp(ptr, "dbus-user.own ", 14) == 0) {
+                if (arg_dbus_user == DBUS_POLICY_ALLOW) {
+                        fprintf(stderr, "Session DBus filtering (dbus-user filter) is "
+                                                        "required for dbus-user.own rules\n");
+                        exit(1);
+                }
+
+                if (!dbus_check_name(ptr + 14)) {
+                        fprintf(stderr, "Invalid dbus-user.own name: %s\n", ptr + 14);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strncmp("dbus-system ", ptr, 12) == 0) {
                 ptr += 12;
-                if (strcmp("allow", ptr) == 0) {
-                        arg_dbus_system = DBUS_POLICY_ALLOW;
-                } else if (strcmp("filter", ptr) == 0) {
+                if (strcmp("filter", ptr) == 0) {
+                        if (arg_dbus_system == DBUS_POLICY_BLOCK) {
+                                fprintf(stderr, "Error: Cannot relax dbus-system policy, it is already set to block\n");
+                                exit(1);
+                        }
                         arg_dbus_system = DBUS_POLICY_FILTER;
                 } else if (strcmp("none", ptr) == 0) {
                         arg_dbus_system = DBUS_POLICY_BLOCK;
@@ -464,6 +494,32 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 return 0;
         }
+        else if (strncmp(ptr, "dbus-system.talk ", 17) == 0) {
+                if (arg_dbus_system == DBUS_POLICY_ALLOW) {
+                        fprintf(stderr, "System DBus filtering (dbus-system filter) is "
+                                                        "required for dbus-system.talk rules\n");
+                        exit(1);
+                }
+
+                if (!dbus_check_name(ptr + 17)) {
+                        fprintf(stderr, "Invalid dbus-system.talk name: %s\n", ptr + 17);
+                        exit(1);
+                }
+                return 1;
+        }
+        else if (strncmp(ptr, "dbus-system.own ", 16) == 0) {
+                if (arg_dbus_system == DBUS_POLICY_ALLOW) {
+                        fprintf(stderr, "System DBus filtering (dbus-system filter) is "
+                                                        "required for dbus-system.own rules\n");
+                        exit(1);
+                }
+
+                if (!dbus_check_name(ptr + 16)) {
+                        fprintf(stderr, "Invalid dbus-system.own name: %s\n", ptr + 16);
+                        exit(1);
+                }
+                return 1;
+        }
         else if (strcmp(ptr, "nou2f") == 0) {
                 arg_nou2f = 1;
                 return 0;