fixes

7 files changed, 68 insertions, 60 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 78c0e5c60..963d95bed 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -185,6 +185,8 @@ int checkcfg(int val) {
                                         exit(1);
                                 }
                                 
+                                if (netfilter_default)
+                                        goto errout;
                                 netfilter_default = strdup(fname);
                                 if (!netfilter_default)
                                         errExit("strdup");
@@ -216,6 +218,8 @@ int checkcfg(int val) {
                                 
                         // Xephyr command extra parameters
                         else if (strncmp(ptr, "xephyr-extra-params ", 19) == 0) {
+                                if (*xephyr_extra_params != '\0')
+                                        goto errout;
                                 xephyr_extra_params = strdup(ptr + 19);
                                 if (!xephyr_extra_params)
                                         errExit("strdup");
diff --git a/src/firejail/ls.c b/src/firejail/ls.c
index 86c3a6079..5444ad9c2 100644
--- a/src/firejail/ls.c
+++ b/src/firejail/ls.c
@@ -258,42 +258,35 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                 // drop privileges
                 drop_privs(0);
 
+                // check access
                 if (access(fname1, R_OK) == -1) {
                         fprintf(stderr, "Error: Cannot access %s\n", fname1);
                         exit(1);
                 }
+                char *rp = realpath(fname1, NULL);
+                if (!rp) {
+                        fprintf(stderr, "Error: Cannot access %s\n", fname1);
+                        exit(1);
+                }
+                if (arg_debug)
+                        printf("realpath %s\n", rp);
+                
         
                 // list directory contents
                 struct stat s;
-                if (stat(fname1, &s) == -1) {
-                        fprintf(stderr, "Error: Cannot access %s\n", fname1);
+                if (stat(rp, &s) == -1) {
+                        fprintf(stderr, "Error: Cannot access %s\n", rp);
                         exit(1);
                 }
                 if (S_ISDIR(s.st_mode)) {
-                        char *rp = realpath(fname1, NULL);
-                        if (!rp) {
-                                fprintf(stderr, "Error: Cannot access %s\n", fname1);
-                                exit(1);
-                        }
-                        if (arg_debug)
-                                printf("realpath %s\n", rp);
-        
                         char *dir;
                         if (asprintf(&dir, "%s/", rp) == -1)
                                 errExit("asprintf");
                         
                         print_directory(dir);
-                        free(rp);
                         free(dir);
                 }
                 else {
-                        char *rp = realpath(fname1, NULL);
-                        if (!rp) {
-                                fprintf(stderr, "Error: Cannot access %s\n", fname1);
-                                exit(1);
-                        }
-                        if (arg_debug)
-                                printf("realpath %s\n", rp);
                         char *split = strrchr(rp, '/');
                         if (split) {
                                 *split = '\0';
@@ -302,8 +295,8 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                                         printf("path %s, file %s\n", rp, rp2);
                                 print_file_or_dir(rp, rp2, 1);
                         }
-                        free(rp);
                 }
+                free(rp);
         }
         
         // get file from sandbox and store it in the current directory
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 111a1d751..0929347b7 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2064,8 +2064,7 @@ int main(int argc, char **argv) {
                 // command
                 //*************************************
                 else if (strcmp(argv[i], "--audit") == 0) {
-                        if (asprintf(&arg_audit_prog, "%s/firejail/faudit", LIBDIR) == -1)
-                                errExit("asprintf");
+                        arg_audit_prog = LIBDIR "/firejail/faudit";
                         arg_audit = 1;
                 }
                 else if (strncmp(argv[i], "--audit=", 8) == 0) {
@@ -2076,6 +2075,12 @@ int main(int argc, char **argv) {
                         arg_audit_prog = strdup(argv[i] + 8);
                         if (!arg_audit_prog)
                                 errExit("strdup");
+
+                        struct stat s;
+                        if (stat(arg_audit_prog, &s) != 0) {
+                                fprintf(stderr, "Error: cannot find the audit program %s\n", arg_audit_prog);
+                                exit(1);
+                        }
                         arg_audit = 1;
                 }
                 else if (strcmp(argv[i], "--appimage") == 0)
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index ad77caeb2..0a6777fef 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -236,12 +236,15 @@ static int monitor_application(pid_t app_pid) {
                         
                         // todo: make this generic
                         // Dillo browser leaves a dpid process running, we need to shut it down
+                        int found = 0;
                         if (strcmp(cfg.command_name, "dillo") == 0) {
                                 char *pidname = pid_proc_comm(pid);
                                 if (pidname && strcmp(pidname, "dpid") == 0)
-                                        break;
+                                        found = 1;
                                 free(pidname);
                         }
+                        if (found)
+                                break;
 
                         monitored_pid = pid;
                         break;
@@ -283,11 +286,6 @@ void start_application(void) {
         //****************************************
         if (arg_audit) {
                 assert(arg_audit_prog);
-                struct stat s;
-                if (stat(arg_audit_prog, &s) != 0) {
-                        fprintf(stderr, "Error: cannot find the audit program\n");
-                        exit(1);
-                }
                 execl(arg_audit_prog, arg_audit_prog, NULL);
         }
         //****************************************
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 4678f366b..dd133b2ba 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -52,44 +52,53 @@ char *seccomp_check_list(const char *str) {
 
 int seccomp_load(const char *fname) {
         assert(fname);
+        
+        // open filter file
+        int fd = open(fname, O_RDONLY);
+        if (fd == -1)
+                goto errexit;
 
-        // check file
-        struct stat s;
-        if (stat(fname, &s) == -1) {
-                fprintf(stderr, "Error: cannot read protocol filter file\n");
-                exit(1);
-        }
-        int size = s.st_size;
+        // calculate the number of entries
+        int size = lseek(fd, 0, SEEK_END);
+        if (size == -1)
+                goto errexit;
+        if (lseek(fd, 0 , SEEK_SET) == -1)
+                goto errexit;
         unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter);
-//printf("size %d, entries %d\n", s.st_size, entries);
+        if (arg_debug)
+                printf("reading %d seccomp entries from %s\n", entries, fname);
 
         // read filter
-        struct sock_filter filter[entries];
+        struct sock_filter *filter = malloc(size);
+        if (filter == NULL)
+                goto errexit;
         memset(&filter[0], 0, sizeof(filter));
-        int src = open(fname, O_RDONLY);
         int rd = 0;
         while (rd < size) {
-                int rv = read(src, (unsigned char *) filter + rd, size - rd);
-                if (rv == -1) {
-                        fprintf(stderr, "Error: cannot read %s file\n", fname);
-                        exit(1);
-                }
+                int rv = read(fd, (unsigned char *) filter + rd, size - rd);
+                if (rv == -1)
+                        goto errexit;
                 rd += rv;
         }
-        close(src);
+        
+        // close file
+        close(fd);
 
         // install filter
         struct sock_fprog prog = {
                 .len = entries,
                 .filter = filter,
         };
-
         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) || prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
                 fprintf(stderr, "Warning: seccomp disabled, it requires a Linux kernel version 3.5 or newer.\n");
                 return 1;
         }
         
         return 0;
+        
+errexit:
+        fprintf(stderr, "Error: cannot read %s\n", fname);
+        exit(1);
 }
 
 // i386 filter installed on amd64 architectures
diff --git a/src/firemon/x11.c b/src/firemon/x11.c
index b0efb090a..73dc310d3 100644
--- a/src/firemon/x11.c
+++ b/src/firemon/x11.c
@@ -37,20 +37,17 @@ void x11(pid_t pid, int print_procs) {
                         if (asprintf(&x11file, "/run/firejail/x11/%d", i) == -1)
                                 errExit("asprintf");
 
-                        struct stat s;
-                        if (stat(x11file, &s) == 0) {
-                                FILE *fp = fopen(x11file, "r");
-                                if (!fp) {
-                                        free(x11file);
-                                        continue;
-                                }
-                                int display;
-                                int rv = fscanf(fp, "%d", &display);
-                                if (rv == 1)
-                                        printf("  DISPLAY :%d\n", display);
-                                fclose(fp);
+                        FILE *fp = fopen(x11file, "r");
+                        if (!fp) {
+                                free(x11file);
+                                continue;
                         }
 
+                        int display;
+                        int rv = fscanf(fp, "%d", &display);
+                        if (rv == 1)
+                                printf("  DISPLAY :%d\n", display);
+                        fclose(fp);
                         free(x11file);
                 }
         }
diff --git a/src/libtracelog/libtracelog.c b/src/libtracelog/libtracelog.c
index ff884c7d7..ca496d41c 100644
--- a/src/libtracelog/libtracelog.c
+++ b/src/libtracelog/libtracelog.c
@@ -163,9 +163,9 @@ static char *storage_find(const char *str) {
 #define RUN_FSLOGGER_FILE               "/run/firejail/mnt/fslogger"
 #define MAXBUF 4096
 static int blacklist_loaded = 0;
-static char *sandbox_pid_str = 0;
+static char *sandbox_pid_str = NULL;
 static char *sandbox_name_str = NULL;
-void load_blacklist(void) {
+static void load_blacklist(void) {
         if (blacklist_loaded)
                 return;
         
@@ -184,13 +184,15 @@ void load_blacklist(void) {
                         char *ptr = strchr(buf, '\n');
                         if (ptr)
                                 *ptr = '\0';
-                        sandbox_pid_str = strdup(buf + 13);
+                        if (sandbox_pid_str == NULL)
+                                sandbox_pid_str = strdup(buf + 13);
                 }
                 else if (strncmp(buf, "sandbox name: ", 14) == 0) {
                         char *ptr = strchr(buf, '\n');
                         if (ptr)
                                 *ptr = '\0';
-                        sandbox_name_str = strdup(buf + 14);
+                        if (sandbox_name_str == NULL);
+                                sandbox_name_str = strdup(buf + 14);
                 }
                 else if (strncmp(buf, "blacklist ", 10) == 0) {
                         char *ptr = strchr(buf, '\n');