fixes

5 files changed, 39 insertions, 3 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index b526b5e00..9c4dcc9a6 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -369,6 +369,7 @@ char *expand_home(const char *path, const char* homedir);
 const char *gnu_basename(const char *path);
 uid_t pid_get_uid(pid_t pid);
 void invalid_filename(const char *fname);
+uid_t get_tty_gid(void);
 
 // fs_var.c
 void fs_var_log(void);  // mounting /var/log
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 5c645b8da..2fd450391 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -178,9 +178,21 @@ void fs_private_dev(void){
         create_char_dev("/dev/pts/ptmx", 0666, 5, 2); //"mknod -m 666 /dev/pts/ptmx c 5 2");
         fs_logger("mknod /dev/pts/ptmx");
         create_link("/dev/pts/ptmx", "/dev/ptmx");
+
+// code before github issue #351
         // mount -vt devpts -o newinstance -o ptmxmode=0666 devpts //dev/pts
-        if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,  "newinstance,ptmxmode=0666") < 0)
+//      if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,  "newinstance,ptmxmode=0666") < 0)
+//              errExit("mounting /dev/pts");
+
+
+        // mount /dev/pts
+        gid_t ttygid = get_tty_gid();
+        char *data;
+        if (asprintf(&data, "newinstance,gid=%d,mode=620,ptmxmode=0666", (int) ttygid) == -1)
+                errExit("asprintf");
+        if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,  data) < 0)
                 errExit("mounting /dev/pts");
+        free(data);
         fs_logger("clone /dev/pts");
 
 #if 0
diff --git a/src/firejail/ls.c b/src/firejail/ls.c
index b814af445..90ef43a62 100644
--- a/src/firejail/ls.c
+++ b/src/firejail/ls.c
@@ -255,6 +255,12 @@ void ls(pid_t pid, const char *path) {
                 exit(1);
         }
 
+        // access chek is performed with the real UID
+        if (access(fname, R_OK) == -1) {
+                fprintf(stderr, "Error: Cannot access file %s\n", fname);
+                exit(1);
+        }
+
         // list directory contents
         struct stat s;
         if (stat(fname, &s) == -1) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 68606a313..e2f197a92 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1746,8 +1746,15 @@ int main(int argc, char **argv) {
                 if (asprintf(&map_path, "/proc/%d/gid_map", child) == -1)
                         errExit("asprintf");
                 gid_t gid = getgid();
-                if (asprintf(&map, "%d %d 1", gid, gid) == -1)
-                        errExit("asprintf");
+                gid_t ttygid = get_tty_gid();
+                if (ttygid == 0)  {
+                        if (asprintf(&map, "%d %d 1", gid, gid) == -1)
+                                errExit("asprintf");
+                }
+                else {
+                        if (asprintf(&map, "%d %d 1\n%d %d 1", gid, gid, ttygid, ttygid) == -1)
+                                errExit("asprintf");
+                }
                 EUID_ROOT();
                 update_map(map, map_path);
                 EUID_USER();
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 3463095f9..c62f4285c 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -629,3 +629,13 @@ void invalid_filename(const char *fname) {
                 exit(1);
         }
 }
+
+uid_t get_tty_gid(void) {
+        // find tty group id
+        gid_t ttygid = 0;
+        struct group *g = getgrnam("tty");
+        if (g)
+                ttygid = g->gr_gid;
+
+        return ttygid;
+}