--tracelog

4 files changed, 18 insertions, 1 deletions

diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index f9e8d62f9..d43302c9b 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -237,7 +237,7 @@ void fs_private(void) {
         if (arg_debug)
                 printf("Mounting a new /root directory\n");
         if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=700,gid=0") < 0)
-                errExit("mounting home directory");
+                errExit("mounting root directory");
         fs_logger("mount tmpfs on /root");
 
         if (u != 0) {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 70b9cf24e..a64bafeb4 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -263,6 +263,8 @@ void usage(void) {
         printf("\t--tmpfs=dirname - mount a tmpfs filesystem on directory dirname.\n\n");
         printf("\t--top - monitor the most CPU-intensive sandboxes.\n\n");
         printf("\t--trace - trace open, access and connect system calls.\n\n");
+        printf("\t--tracelog - add a log message in syslog for every access to blacklisted\n");
+        printf("\t\tfiles or directories.\n\n");
         printf("\t--tree - print a tree of all sandboxed processes.\n\n");
         printf("\t--version - print program version and exit.\n\n");
         printf("\t--whitelist=dirname_or_filename - whitelist directory or file.\n\n");
diff --git a/src/libtrace/libtrace.c b/src/libtrace/libtrace.c
index 3db931de1..3ca3ec698 100644
--- a/src/libtrace/libtrace.c
+++ b/src/libtrace/libtrace.c
@@ -29,6 +29,7 @@
 #include <arpa/inet.h>
 #include <sys/un.h>
 #include <sys/stat.h>
+#include <dirent.h>
 
 // break recursivity on fopen call
 typedef FILE *(*orig_fopen_t)(const char *pathname, const char *mode);
@@ -431,6 +432,17 @@ int stat64(const char *pathname, struct stat64 *buf) {
 }
 #endif /* __GLIBC__ */
 
+// opendir
+typedef DIR *(*orig_opendir_t)(const char *pathname);
+static orig_opendir_t orig_opendir = NULL;
+DIR *opendir(const char *pathname) {
+        if (!orig_opendir)
+                orig_opendir = (orig_opendir_t)dlsym(RTLD_NEXT, "opendir");
+                        
+        DIR *rv = orig_opendir(pathname);
+        printf("%u:%s:opendir %s:%p\n", pid(), name(), pathname, rv);
+        return rv;
+}
 
 // access
 typedef int (*orig_access_t)(const char *pathname, int mode);
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index fc52d4b79..28f75d023 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1296,6 +1296,9 @@ Child process initialized
 .br
 parent is shutting down, bye...
 .TP
+\fB\-\-tracelog
+Add a log message in syslog for every access to blacklisted files or directories.
+.TP
 \fB\-\-tree
 Print a tree of all sandboxed processes, see MONITORING section for more details.
 .br