Merge pull request #734 from manevich/audit

join fixes

1 files changed, 25 insertions, 67 deletions

diff --git a/src/firejail/join.c b/src/firejail/join.c
index 632715fea..37bac7e65 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -122,7 +122,7 @@ static void extract_caps_seccomp(pid_t pid) {
                         break;
                 }
                 else if (strncmp(buf, "CapBnd:", 7) == 0) {             
-                        char *ptr = buf + 8;
+                        char *ptr = buf + 7;
                         unsigned long long val;
                         sscanf(ptr, "%llx", &val);
                         apply_caps = 1;
@@ -295,9 +295,8 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 // set seccomp filter
                 if (apply_seccomp == 1) // not available for uid 0
                         seccomp_set();
-                
 #endif
-                
+
                 // fix qt 4.8
                 if (setenv("QT_X11_NO_MITSHM", "1", 1) < 0)
                         errExit("setenv");
@@ -314,6 +313,11 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 else 
                         drop_privs(arg_nogroups);       // nogroups not available for uid 0
 
+                // user namespace resets capabilities
+                // set caps filter
+                if (apply_caps == 1)    // not available for uid 0
+                        caps_set(caps);
+
                 // set prompt color to green
                 //export PS1='\[\e[1;32m\][\u@\h \W]\$\[\e[0m\] '
                 if (setenv("PROMPT_COMMAND", "export PS1=\"\\[\\e[1;32m\\][\\u@\\h \\W]\\$\\[\\e[0m\\] \"", 1) < 0)
@@ -333,77 +337,31 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 // run cmdline trough shell
                 if (cfg.command_line == NULL) {
                         assert(cfg.shell);
+                        cfg.command_line = cfg.shell;
+                        cfg.window_title = cfg.shell;
+                }
 
-                        // replace the process with a shell
-                        execlp(cfg.shell, cfg.shell, NULL);
-                        
-                        // it should never get here
-                        errExit("execlp");
+                int cwd = 0;
+                if (cfg.cwd) {
+                        if (chdir(cfg.cwd) == 0)
+                                cwd = 1;
                 }
-                else {
-                        // run the command supplied by the user
-                        int cwd = 0;
-                        if (cfg.cwd) {
-                                if (chdir(cfg.cwd) == 0)
-                                        cwd = 1;
-                        }
-                        
-                        if (!cwd) {
-                                if (chdir("/") < 0)
-                                        errExit("chdir");
-                                if (cfg.homedir) {
-                                        struct stat s;
-                                        if (stat(cfg.homedir, &s) == 0) {
-                                                if (chdir(cfg.homedir) < 0)
-                                                        errExit("chdir");
-                                        }
-                                }
-                        }
 
-                        if (arg_shell_none) {
-                                if (arg_debug) {
-                                        int i;
-                                        for (i = cfg.original_program_index; i < cfg.original_argc; i++) {
-                                                if (cfg.original_argv[i] == NULL)
-                                                        break;
-                                                printf("execvp argument %d: %s\n", i - cfg.original_program_index, cfg.original_argv[i]);
-                                        }
-                                }
-                
-                                if (cfg.original_program_index == 0) {
-                                        fprintf(stderr, "Error: --shell=none configured, but no program specified\n");
-                                        exit(1);
-                                }
-                
-                                if (!arg_command && !arg_quiet)
-                                        printf("Child process initialized\n");
-                
-                                execvp(cfg.original_argv[cfg.original_program_index], &cfg.original_argv[cfg.original_program_index]);
-                                exit(1);
-                        } else {
-                                assert(cfg.shell);
-
-                                char *arg[5];
-                                arg[0] = cfg.shell;
-                                arg[1] = "-c";
-                                if (arg_debug)
-                                        printf("Starting %s\n", cfg.command_line);
-                                if (!arg_doubledash) {
-                                        arg[2] = cfg.command_line;
-                                        arg[3] = NULL;
+                if (!cwd) {
+                        if (chdir("/") < 0)
+                                errExit("chdir");
+                        if (cfg.homedir) {
+                                struct stat s;
+                                if (stat(cfg.homedir, &s) == 0) {
+                                        /* coverity[toctou] */
+                                        if (chdir(cfg.homedir) < 0)
+                                                errExit("chdir");
                                 }
-                                else {
-                                        arg[2] = "--";
-                                        arg[3] = cfg.command_line;
-                                        arg[4] = NULL;
-                                }
-                                execvp(arg[0], arg);
-
-                                // it should never get here
-                                errExit("execvp");
                         }
                 }
 
+                start_application();
+
                 // it will never get here!!!
         }