Fixes for the private-lib and memory-deny-write-execute features

3 files changed, 19 insertions, 16 deletions

diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index 4d328af7f..cc60a330f 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -155,7 +155,6 @@ static void copy_libs_for_lib(const char *lib, const char *private_run_dir) {
 
 void fs_private_lib(void) {
         char *private_list = cfg.lib_private_keep;
-        assert(private_list);
 
         // create /run/firejail/mnt/lib directory
         mkdir_attr(RUN_LIB_DIR, 0755, 0, 0);
@@ -169,9 +168,9 @@ void fs_private_lib(void) {
                 copy_libs_for_exe(cfg.shell, RUN_LIB_DIR);
 
         // for the listed libs
-        if (*private_list != '\0') {
+        if (private_list && *private_list != '\0') {
                 if (arg_debug)
-                        printf("Copying extra files in the new lib directory:\n");
+                        printf("Copying extra files (%s) in the new lib directory:\n", private_list);
 
                 char *dlist = strdup(private_list);
                 if (!dlist)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 561a14f5a..ff57a5693 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1630,13 +1630,15 @@ int main(int argc, char **argv) {
                                 cfg.bin_private_keep = argv[i] + 14;
                         arg_private_bin = 1;
                 }
-                else if (strncmp(argv[i], "--private-lib=", 14) == 0) {
+                else if (strncmp(argv[i], "--private-lib", 13) == 0) {
                         // extract private lib list (if any)
-                        if (cfg.lib_private_keep) {
-                                if (asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, argv[i] + 14) < 0 )
-                                        errExit("asprintf");
-                        } else
-                                cfg.lib_private_keep = argv[i] + 14;
+                        if (argv[i][13] == '=') {
+                                if (cfg.lib_private_keep) {
+                                        if (argv[i][14] != '\0' && asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, argv[i] + 14) < 0)
+                                                errExit("asprintf");
+                                } else
+                                        cfg.lib_private_keep = argv[i] + 14;
+                        }
                         arg_private_lib = 1;
                 }
                 else if (strcmp(argv[i], "--private-tmp") == 0) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 6d5ee349c..972f5932d 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -596,7 +596,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         }
 
         // memory deny write&execute
-        if (strncmp(ptr, "memory-deny-write-execute ", sizeof("memory-deny-write-execute ") - 1) == 0) {
+        if (strcmp(ptr, "memory-deny-write-execute") == 0) {
 #ifdef HAVE_SECCOMP
                 if (checkcfg(CFG_SECCOMP))
                         arg_memory_deny_write_execute = 1;
@@ -861,12 +861,14 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         }
 
         // private /lib list of files
-        if (strncmp(ptr, "private-lib ", 12) == 0) {
-                if (cfg.lib_private_keep) {
-                        if (asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, ptr + 12) < 0 )
-                                errExit("asprintf");
-                } else {
-                        cfg.lib_private_keep = ptr + 12;
+        if (strncmp(ptr, "private-lib", 11) == 0) {
+                if (ptr[11] == ' ') {
+                        if (cfg.lib_private_keep) {
+                                if (ptr[12] != '\0' && asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, ptr + 12) < 0)
+                                        errExit("asprintf");
+                        } else {
+                                cfg.lib_private_keep = ptr + 12;
+                        }
                 }
                 arg_private_lib = 1;
                 return 0;