tighten security

10 files changed, 26 insertions, 80 deletions

diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index f6ca28227..bab117b7e 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -37,11 +37,8 @@ void fs_trace_preload(void) {
                 FILE *fp = fopen("/etc/ld.so.preload", "w");
                 if (!fp)
                         errExit("fopen");
+                SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
                 fclose(fp);
-                if (chown("/etc/ld.so.preload", 0, 0) < 0)
-                        errExit("chown");
-                if (chmod("/etc/ld.so.preload", S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
-                        errExit("chmod");
                 fs_logger("touch /etc/ld.so.preload");
         }
 }
@@ -66,12 +63,9 @@ void fs_trace(void) {
         }       
         else
                 assert(0);
-                
+
+        SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
         fclose(fp);
-        if (chown(RUN_LDPRELOAD_FILE, 0, 0) < 0)
-                errExit("chown");
-        if (chmod(RUN_LDPRELOAD_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
-                errExit("chmod");
         
         // mount the new preload file
         if (arg_debug)
@@ -81,5 +75,3 @@ void fs_trace(void) {
         fs_logger("create /etc/ld.so.preload");
 }
 
-                
-        
\ No newline at end of file
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c
index 1516d684f..a578d04e6 100644
--- a/src/firejail/fs_var.c
+++ b/src/firejail/fs_var.c
@@ -131,22 +131,16 @@ void fs_var_log(void) {
                 // create an empty /var/log/wtmp file
                 /* coverity[toctou] */
                 FILE *fp = fopen("/var/log/wtmp", "w");
+                SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH);
                 if (fp)
                         fclose(fp);
-                if (chown("/var/log/wtmp", 0, wtmp_group) < 0)
-                        errExit("chown");
-                if (chmod("/var/log/wtmp", S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH ) < 0)
-                        errExit("chmod");
                 fs_logger("touch /var/log/wtmp");
                         
                 // create an empty /var/log/btmp file
                 fp = fopen("/var/log/btmp", "w");
+                SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP);
                 if (fp)
                         fclose(fp);
-                if (chown("/var/log/btmp", 0, wtmp_group) < 0)
-                        errExit("chown");
-                if (chmod("/var/log/btmp", S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP) < 0)
-                        errExit("chmod");
                 fs_logger("touch /var/log/btmp");
         }
         else
@@ -169,11 +163,8 @@ void fs_var_lib(void) {
                 
                 if (fp) {
                         fprintf(fp, "\n");
+                        SET_PERMS_STREAM(fp, 0, 0, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
                         fclose(fp);
-                        if (chown("/var/lib/dhcp/dhcpd.leases", 0, 0) == -1)
-                                errExit("chown");
-                        if (chmod("/var/lib/dhcp/dhcpd.leases", S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH))
-                                errExit("chmod");
                         fs_logger("touch /var/lib/dhcp/dhcpd.leases");
                 }
         }
@@ -279,10 +270,9 @@ void fs_var_lock(void) {
                                 // create directory
                                 if (mkdir(lnk, S_IRWXU|S_IRWXG|S_IRWXO))
                                         errExit("mkdir");
-                                if (chown(lnk, 0, 0))
-                                        errExit("chown");
                                 if (chmod(lnk, S_IRWXU|S_IRWXG|S_IRWXO))
                                         errExit("chmod");
+                                ASSERT_PERMS(lnk, 0, 0, S_IRWXU|S_IRWXG|S_IRWXO);
                         }
                         if (arg_debug)
                                 printf("Mounting tmpfs on %s on behalf of /var/lock\n", lnk);
@@ -353,11 +343,8 @@ void fs_var_utmp(void) {
                         
         // save new utmp file
         fwrite(&u_boot, sizeof(u_boot), 1, fp);
+        SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH);
         fclose(fp);
-        if (chown(RUN_UTMP_FILE, 0, utmp_group) < 0)
-                errExit("chown");
-        if (chmod(RUN_UTMP_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH ) < 0)
-                errExit("chmod");
         
         // mount the new utmp file
         if (arg_debug)
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 90b91f9dd..33037da29 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -275,18 +275,14 @@ static void whitelist_path(ProfileEntry *entry) {
                                 fprintf(stderr, "Error: cannot create empty file in home directory\n");
                                 exit(1);
                         }
+                        // set file properties
+                        SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode);
                         fclose(fp);
                 }
                 else
                         return; // the file is already present
         }
         
-        // set file properties
-        if (chown(path, s.st_uid, s.st_gid) < 0)
-                errExit("chown");
-        if (chmod(path, s.st_mode) < 0)
-                errExit("chmod");
-
         // mount
         if (mount(wfile, path, NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind");
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 2181a274b..dbb92a899 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -663,14 +663,10 @@ static void set_name_file(pid_t pid) {
                 exit(1);
         }
         fprintf(fp, "%s\n", cfg.name);
-        fclose(fp);
-        
+
         // mode and ownership
-        if (chown(fname, 0, 0) == -1)
-                errExit("chown");
-        if (chmod(fname, 0644) == -1)
-                errExit("chmod");
-        
+        SET_PERMS_STREAM(fp, 0, 0, 0644);
+        fclose(fp);
 }
 
 static void delete_name_file(pid_t pid) {
@@ -694,14 +690,10 @@ static void set_x11_file(pid_t pid, int display) {
                 exit(1);
         }
         fprintf(fp, "%d\n", display);
-        fclose(fp);
-        
+
         // mode and ownership
-        if (chown(fname, 0, 0) == -1)
-                errExit("chown");
-        if (chmod(fname, 0644) == -1)
-                errExit("chmod");
-        
+        SET_PERMS_STREAM(fp, 0, 0, 0644);
+        fclose(fp);
 }
 
 static void delete_x11_file(pid_t pid) {
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index 7e5ab7dfb..1ef5bf13d 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -273,14 +273,8 @@ void protocol_filter_save(void) {
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s\n", cfg.protocol);
+        SET_PERMS_STREAM(fp, 0, 0, 0600);
         fclose(fp);
-
-        if (chmod(RUN_PROTOCOL_CFG, 0600) < 0)
-                errExit("chmod");
-
-        if (chown(RUN_PROTOCOL_CFG, 0, 0) < 0)
-                errExit("chown");
-
 }
 
 void protocol_filter_load(const char *fname) {
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index dd26d219c..7db8d2c18 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -120,11 +120,8 @@ void pulseaudio_init(void) {
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s", "\nenable-shm = no\n");
+        SET_PERMS_STREAM(fp, getuid(), getgid(), 0644);
         fclose(fp);
-        if (chmod(pulsecfg, 0644) == -1)
-                errExit("chmod");
-        if (chown(pulsecfg, getuid(), getgid()) == -1)
-                errExit("chown");
 
         // create ~/.config/pulse directory if not present
         char *dir1;
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index de798037f..cb999a4a6 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -187,12 +187,9 @@ static void sanitize_passwd(void) {
                 fprintf(fpout, "%s", buf);
         }
         fclose(fpin);
+        SET_PERMS_STREAM(fpout, 0, 0, 0644);
         fclose(fpout);
-        if (chown(RUN_PASSWD_FILE, 0, 0) == -1)
-                errExit("chown");
-        if (chmod(RUN_PASSWD_FILE, 0644) == -1)
-                errExit("chmod");
-                
+
         // mount-bind tne new password file
         if (mount(RUN_PASSWD_FILE, "/etc/passwd", "none", MS_BIND, "mode=400,gid=0") < 0)
                 errExit("mount");
@@ -319,12 +316,9 @@ static void sanitize_group(void) {
                         goto errout;
         }
         fclose(fpin);
+        SET_PERMS_STREAM(fpout, 0, 0, 0644);
         fclose(fpout);
-        if (chown(RUN_GROUP_FILE, 0, 0) == -1)
-                errExit("chown");
-        if (chmod(RUN_GROUP_FILE, 0644) == -1)
-                errExit("chmod");
-                
+
         // mount-bind tne new group file
         if (mount(RUN_GROUP_FILE, "/etc/group", "none", MS_BIND, "mode=400,gid=0") < 0)
                 errExit("mount");
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 5f845fbd3..9423ae7e0 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -104,9 +104,8 @@ void save_nogroups(void) {
         FILE *fp = fopen(RUN_GROUPS_CFG, "w");
         if (fp) {
                 fprintf(fp, "\n");
+                SET_PERMS_STREAM(fp, 0, 0, 0644); // assume mode 0644
                 fclose(fp);
-                if (chown(RUN_GROUPS_CFG, 0, 0) < 0)
-                        errExit("chown");
         }
         else {
                 fprintf(stderr, "Error: cannot save nogroups state\n");
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 7aaf1a5cd..c2da1168a 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -290,9 +290,8 @@ static void write_seccomp_file(void) {
                 fprintf(stderr, "Error: cannot save seccomp filter\n");
                 exit(1);
         }
+        SET_PERMS_FD(fd, 0, 0, S_IRUSR | S_IWUSR);
         close(fd);
-        if (chown(RUN_SECCOMP_CFG, 0, 0) < 0)
-                errExit("chown");
 }
 
 // read seccomp filter from /run/firejail/mnt/seccomp
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 3d0918b2c..a68b54cdb 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -132,13 +132,9 @@ void fs_x11(void) {
                 fprintf(stderr, "Error: cannot create empty file in x11 directory\n");
                 exit(1);
         }
-        fclose(fp);
-
         // set file properties
-        if (chown(x11file, s.st_uid, s.st_gid) < 0)
-                errExit("chown");
-        if (chmod(x11file, s.st_mode) < 0)
-                errExit("chmod");
+        SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode);
+        fclose(fp);
 
         // mount
         char *wx11file;