7 files changed, 84 insertions, 47 deletions

diff --git a/Makefile.in b/Makefile.in
index 4d7526826..4e55e5ea1 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -86,7 +86,8 @@ realinstall:
         sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
         rm -fr .etc
         # install apparmor profile
-        sh -c "if [ -d /etc/apparmor.d ]; then install -c -m 0644 etc/firejail-default /etc/apparmor.d/firejail-default; fi;"
+        sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d; fi;"
+        install -c -m 0644 etc/firejail-default $(DESTDIR)/$(sysconfdir)/apparmor.d/.
         # man pages
         install -m 0755 -d $(DESTDIR)/$(mandir)/man1
         install -m 0755 -d $(DESTDIR)/$(mandir)/man5
diff --git a/etc/firejail-default b/etc/firejail-default
index 609ab6c19..8abf2400b 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -1,19 +1,38 @@
-#include <tunables/global>
+#########################################
+# Generic Firejail AppArmor profile
+#########################################
+
+##########
+# A simple PID declaration based on Ubuntu's @{pid}
+# Ubuntu keeps it under tunables/kernelvars and include it via tunables/global.
+# We don't know if this definition is available outside Debian and Ubuntu, so
+# we declare our own here.
+##########
+@{PID}={[1-9],[1-9][0-9],[1-9][0-9][0-9],[1-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9],[1-9][0-9][0-9][0-9][0-9][0-9]}
 
 profile firejail-default {
 
-#####
-# D-Bus is a huge security hole, we disable it here. Uncomment this line if you
-# need D-Bus functionality.
-#
+##########
+# D-Bus is a huge security hole. Uncomment this line if you need D-Bus
+# functionality.
+##########
 #dbus,
 
-#####
+##########
 # Mask /proc and /sys information leakage. The configuration here is barely
 # enough to run "top" or "ps aux".
-#
+##########
 / r,
 /[^proc,^sys]** mrwlk,
+/{,var/}run/ r,
+/{,var/}run/** r,
+/{,var/}run/user/**/dconf/ rw,
+/{,var/}run/user/**/dconf/user rw,
+/{,var/}run/user/**/pulse/ rw,
+/{,var/}run/user/**/pulse/** rw,
+/{,var/}run/firejail/mnt/fslogger r,
+/{run,dev}/shm/ r,
+/{run,dev}/shm/** rmwk,
 
 /proc/ r,
 /proc/meminfo r,
@@ -22,16 +41,21 @@ profile firejail-default {
 /proc/uptime r,
 /proc/loadavg r,
 /proc/stat r,
-/proc/@{pid}/ r,
-/proc/@{pid}/fd/ r,
-/proc/@{pid}/task/ r,
-/proc/@{pid}/cmdline r,
-/proc/@{pid}/comm r,
-/proc/@{pid}/stat r,
-/proc/@{pid}/statm r,
-/proc/@{pid}/status r,
+
+/proc/@{PID}/ r,
+/proc/@{PID}/fd/ r,
+/proc/@{PID}/task/ r,
+/proc/@{PID}/cmdline r,
+/proc/@{PID}/comm r,
+/proc/@{PID}/stat r,
+/proc/@{PID}/statm r,
+/proc/@{PID}/status r,
+/proc/@{PID}/task/@{PID}/stat r,
 /proc/sys/kernel/pid_max r,
 /proc/sys/kernel/shmmax r,
+/proc/sys/vm/overcommit_memory r,
+/proc/sys/vm/overcommit_ratio r,
+
 /sys/ r,
 /sys/bus/ r,
 /sys/bus/** r,
@@ -40,19 +64,15 @@ profile firejail-default {
 /sys/devices/ r,
 /sys/devices/** r,
 
-/proc/@{pid}/maps r,
-/proc/@{pid}/mounts r,
-/proc/@{pid}/mountinfo r,
-/proc/@{pid}/oom_score_adj r,
+/proc/@{PID}/maps r,
+/proc/@{PID}/mounts r,
+/proc/@{PID}/mountinfo r,
+/proc/@{PID}/oom_score_adj r,
 
-/{,var/}run/firejail/mnt/fslogger r,
-/{,var/}run/user/**/dconf/ r,
-/{,var/}run/user/**/dconf/user r,
-
-#####
+##########
 # Allow running programs only from well-known system directories. If you need
 # to run programs from your home directory, uncomment /home line.
-#
+##########
 /lib/** ix,
 /lib64/** ix,
 /bin/** ix,
@@ -65,24 +85,23 @@ profile firejail-default {
 /opt/** ix,
 #/home/** ix,
 
-#####
+##########
 # Allow all networking functionality, and control it from Firejail.
-#
+##########
 network inet,
 network inet6,
 network unix,
 network netlink,
 network raw,
 
-#####
+##########
 # There is no equivalent in Firejail for filtering signals.
-#
+##########
 signal,
 
-#####
-# Disable all capabilities. If you run your sandbox as root, you might need to
-# enable/uncomment some of them.
-#
+##########
+# We let Firejail deal with capabilities.
+##########
 capability chown,
 capability dac_override,
 capability dac_read_search,
@@ -118,12 +137,13 @@ capability setfcap,
 capability mac_override,
 capability mac_admin,
 
-#####
-# No mount/umount functionality when running as regular user.
-#
+##########
+# We let Firejail deal with mount/umount functionality.
+##########
 mount,
 remount,
 umount,
 pivot_root,
 
 }
+
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index f0f2aaeb7..9c7c49e1d 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -26,6 +26,7 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include "../include/common.h"
+static int arg_debug = 0;
 
 static void usage(void) {
         printf("firecfg - version %s\n\n", VERSION);
@@ -37,6 +38,7 @@ static void usage(void) {
         printf("DESKTOP INTEGRATION section in man 1 firejail.\n\n");
         printf("Usage: firecfg [OPTIONS]\n\n");
         printf("   --clean - remove all firejail symbolic links.\n\n");
+        printf("   --debug - print debug messages.\n\n");
         printf("   --help, -? - this help screen.\n\n");
         printf("   --list - list all firejail symbolic links.\n\n");
         printf("   --version - print program version and exit.\n\n");
@@ -67,9 +69,12 @@ static int find(const char *program, const char *directory) {
                 errExit("asprintf");
                 
         struct stat s;
-        if (stat(fname, &s) == 0)
+        if (stat(fname, &s) == 0) {
+                if (arg_debug)
+                        printf("found %s in directory %s\n", program, directory);
                 retval = 1;
-        
+        }
+                
         free(fname);
         return retval;
 }
@@ -206,8 +211,9 @@ static void set_file(const char *name, const char *firejail_exec) {
                 errExit("asprintf");
         
         struct stat s;
-        if (stat(fname, &s) == 0)
-                ; //printf("%s already present\n", fname);
+        if (stat(fname, &s) == 0) {
+                printf("%s is already present, skipping...\n", fname);
+        }
         else {
                 int rv = symlink(firejail_exec, fname);
                 if (rv) {
@@ -289,6 +295,8 @@ int main(int argc, char **argv) {
                         usage();
                         return 0;
                 }
+                else if (strcmp(argv[i], "--debug") == 0)
+                        arg_debug = 1;
                 else if (strcmp(argv[i], "--version") == 0) {
                         printf("firecfg version %s\n\n", VERSION);
                         return 0;
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index dca66888c..cc2aa8f4d 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -28,6 +28,8 @@ static char *paths[] = {
         "/usr/local/bin",
         "/usr/bin",
         "/bin",
+        "/usr/games",
+        "/usr/local/games",
         "/usr/local/sbin",
         "/usr/sbin",
         "/sbin",
@@ -76,7 +78,8 @@ static char *check_dir_or_file(const char *name) {
         }
 
         if (!fname) {
-//              fprintf(stderr, "Warning: file %s not found\n", name);
+                if (arg_debug)
+                        fprintf(stderr, "Warning: file %s not found\n", name);
                 return NULL;
         }
         
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index d9866385e..f37605e20 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -541,6 +541,11 @@ int sandbox(void* sandbox_arg) {
                 fs_private_tmp();
         
         //****************************
+        // update /proc, /sys, /dev, /boot directorymy
+        //****************************
+        fs_proc_sys_dev_boot();
+        
+        //****************************
         // apply the profile file
         //****************************
         if (cfg.profile) {
@@ -558,11 +563,6 @@ int sandbox(void* sandbox_arg) {
                 fs_trace();
                 
         //****************************
-        // update /proc, /dev, /boot directorymy
-        //****************************
-        fs_proc_sys_dev_boot();
-        
-        //****************************
         // --nosound and fix for pulseaudio 7.0
         //****************************
         if (arg_nosound) {
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt
index c12bf7731..9458c4b67 100644
--- a/src/man/firecfg.txt
+++ b/src/man/firecfg.txt
@@ -17,6 +17,9 @@ The symbolic links are placed in /usr/local/bin. For more information, see
 \fB\-\-clean
 Remove all firejail symbolic links.
 .TP
+\fB\-\-debug
+Print debug messages.
+.TP
 \fB\-?\fR, \fB\-\-help\fR
 Print options end exit.
 .TP
diff --git a/todo b/todo
index 7a96bb2c4..323374525 100644
--- a/todo
+++ b/todo
@@ -263,4 +263,6 @@ $ sudo aa-notify -p -f /var/log/audit/audit.log
 /sys/module/apparmor/parameters/enabled
 /sys/kernel/security/apparmor
 
+24. check monitor proc behaviour for sandboxes with --blacklist=/proc
+also check --apparmor in this case