diff options
author | 2016-10-10 08:30:54 -0400 | |
---|---|---|
committer | 2016-10-10 08:30:54 -0400 | |
commit | 19302eb4a3f6d8594f87019018a434439ff4bde4 (patch) | |
tree | 1fe5ba70eaf958588ba6e0bb8b81179ae7b18bd5 /src | |
parent | github (diff) | |
download | firejail-19302eb4a3f6d8594f87019018a434439ff4bde4.tar.gz firejail-19302eb4a3f6d8594f87019018a434439ff4bde4.tar.zst firejail-19302eb4a3f6d8594f87019018a434439ff4bde4.zip |
0.9.38.4 testing0.9.38.4
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/firejail.h | 1 | ||||
-rw-r--r-- | src/firejail/join.c | 8 | ||||
-rw-r--r-- | src/firejail/main.c | 1 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 26 | ||||
-rw-r--r-- | src/firejail/util.c | 14 |
5 files changed, 25 insertions, 25 deletions
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 5104bd688..759569cb4 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -358,6 +358,7 @@ const char *gnu_basename(const char *path); | |||
358 | uid_t pid_get_uid(pid_t pid); | 358 | uid_t pid_get_uid(pid_t pid); |
359 | void invalid_filename(const char *fname); | 359 | void invalid_filename(const char *fname); |
360 | int remove_directory(const char *path); | 360 | int remove_directory(const char *path); |
361 | void flush_stdin(void); | ||
361 | 362 | ||
362 | // fs_var.c | 363 | // fs_var.c |
363 | void fs_var_log(void); // mounting /var/log | 364 | void fs_var_log(void); // mounting /var/log |
diff --git a/src/firejail/join.c b/src/firejail/join.c index b05e25387..575baf71e 100644 --- a/src/firejail/join.c +++ b/src/firejail/join.c | |||
@@ -29,6 +29,12 @@ static uint64_t caps = 0; | |||
29 | static int apply_seccomp = 0; | 29 | static int apply_seccomp = 0; |
30 | #define BUFLEN 4096 | 30 | #define BUFLEN 4096 |
31 | 31 | ||
32 | static void signal_handler(int sig){ | ||
33 | flush_stdin(); | ||
34 | |||
35 | exit(sig); | ||
36 | } | ||
37 | |||
32 | static void extract_command(int argc, char **argv, int index) { | 38 | static void extract_command(int argc, char **argv, int index) { |
33 | if (index >= argc) | 39 | if (index >= argc) |
34 | return; | 40 | return; |
@@ -194,6 +200,7 @@ void join_name(const char *name, const char *homedir, int argc, char **argv, int | |||
194 | 200 | ||
195 | void join(pid_t pid, const char *homedir, int argc, char **argv, int index) { | 201 | void join(pid_t pid, const char *homedir, int argc, char **argv, int index) { |
196 | extract_command(argc, argv, index); | 202 | extract_command(argc, argv, index); |
203 | signal (SIGTERM, signal_handler); | ||
197 | 204 | ||
198 | // if the pid is that of a firejail process, use the pid of the first child process | 205 | // if the pid is that of a firejail process, use the pid of the first child process |
199 | char *comm = pid_proc_comm(pid); | 206 | char *comm = pid_proc_comm(pid); |
@@ -388,6 +395,7 @@ void join(pid_t pid, const char *homedir, int argc, char **argv, int index) { | |||
388 | 395 | ||
389 | // wait for the child to finish | 396 | // wait for the child to finish |
390 | waitpid(child, NULL, 0); | 397 | waitpid(child, NULL, 0); |
398 | flush_stdin(); | ||
391 | exit(0); | 399 | exit(0); |
392 | } | 400 | } |
393 | 401 | ||
diff --git a/src/firejail/main.c b/src/firejail/main.c index b945f504b..9e2aec4d5 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -111,6 +111,7 @@ static void myexit(int rv) { | |||
111 | bandwidth_shm_del_file(sandbox_pid); // bandwidth file | 111 | bandwidth_shm_del_file(sandbox_pid); // bandwidth file |
112 | network_shm_del_file(sandbox_pid); // network map file | 112 | network_shm_del_file(sandbox_pid); // network map file |
113 | 113 | ||
114 | flush_stdin(); | ||
114 | exit(rv); | 115 | exit(rv); |
115 | } | 116 | } |
116 | 117 | ||
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 9cb97187e..fc93e1eef 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -171,31 +171,6 @@ static void monitor_application(pid_t app_pid) { | |||
171 | printf("Sandbox monitor: monitoring %u\n", app_pid); | 171 | printf("Sandbox monitor: monitoring %u\n", app_pid); |
172 | } | 172 | } |
173 | 173 | ||
174 | #if 0 | ||
175 | // todo: find a way to shut down interfaces before closing the namespace | ||
176 | // the problem is we don't have enough privileges to shutdown interfaces in this moment | ||
177 | // shut down bridge/macvlan interfaces | ||
178 | if (any_bridge_configured()) { | ||
179 | |||
180 | if (cfg.bridge0.configured) { | ||
181 | printf("Shutting down %s\n", cfg.bridge0.devsandbox); | ||
182 | net_if_down( cfg.bridge0.devsandbox); | ||
183 | } | ||
184 | if (cfg.bridge1.configured) { | ||
185 | printf("Shutting down %s\n", cfg.bridge1.devsandbox); | ||
186 | net_if_down( cfg.bridge1.devsandbox); | ||
187 | } | ||
188 | if (cfg.bridge2.configured) { | ||
189 | printf("Shutting down %s\n", cfg.bridge2.devsandbox); | ||
190 | net_if_down( cfg.bridge2.devsandbox); | ||
191 | } | ||
192 | if (cfg.bridge3.configured) { | ||
193 | printf("Shutting down %s\n", cfg.bridge3.devsandbox); | ||
194 | net_if_down( cfg.bridge3.devsandbox); | ||
195 | } | ||
196 | usleep(20000); // 20 ms sleep | ||
197 | } | ||
198 | #endif | ||
199 | } | 174 | } |
200 | 175 | ||
201 | 176 | ||
@@ -672,6 +647,7 @@ int sandbox(void* sandbox_arg) { | |||
672 | } | 647 | } |
673 | 648 | ||
674 | monitor_application(app_pid); // monitor application | 649 | monitor_application(app_pid); // monitor application |
650 | flush_stdin(); | ||
675 | 651 | ||
676 | return 0; | 652 | return 0; |
677 | } | 653 | } |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 7b871ae0d..9c2caaf74 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -25,6 +25,8 @@ | |||
25 | #include <dirent.h> | 25 | #include <dirent.h> |
26 | #include <grp.h> | 26 | #include <grp.h> |
27 | #include <ftw.h> | 27 | #include <ftw.h> |
28 | #include <sys/ioctl.h> | ||
29 | #include <termios.h> | ||
28 | 30 | ||
29 | #define MAX_GROUPS 1024 | 31 | #define MAX_GROUPS 1024 |
30 | // drop privileges | 32 | // drop privileges |
@@ -641,3 +643,15 @@ int remove_directory(const char *path) { | |||
641 | // FTW_PHYS - do not follow symbolic links | 643 | // FTW_PHYS - do not follow symbolic links |
642 | return nftw(path, remove_callback, 64, FTW_DEPTH | FTW_PHYS); | 644 | return nftw(path, remove_callback, 64, FTW_DEPTH | FTW_PHYS); |
643 | } | 645 | } |
646 | |||
647 | void flush_stdin(void) { | ||
648 | if (isatty(STDIN_FILENO)) { | ||
649 | int cnt = 0; | ||
650 | ioctl(STDIN_FILENO, FIONREAD, &cnt); | ||
651 | if (cnt) { | ||
652 | if (!arg_quiet) | ||
653 | printf("Warning: removing %d bytes from stdin\n", cnt); | ||
654 | ioctl(STDIN_FILENO, TCFLSH, TCIFLUSH); | ||
655 | } | ||
656 | } | ||
657 | } | ||