diff options
-rw-r--r-- | README | 2 | ||||
-rw-r--r-- | etc/dnscrypt-proxy.profile | 2 | ||||
-rw-r--r-- | etc/dnsmasq.profile | 1 | ||||
-rw-r--r-- | etc/snap.profile | 2 | ||||
-rw-r--r-- | etc/unbound.profile | 2 | ||||
-rw-r--r-- | etc/wireshark.profile | 3 | ||||
-rwxr-xr-x | gcov.sh | 5 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 4 | ||||
-rw-r--r-- | src/fldd/main.c | 5 | ||||
-rw-r--r-- | src/fseccomp/syscall.c | 1 | ||||
-rwxr-xr-x | test/fs/fs.sh | 3 | ||||
-rwxr-xr-x | test/fs/private-lib.exp | 44 | ||||
-rwxr-xr-x | test/utils/seccomp-print.exp | 4 |
13 files changed, 67 insertions, 11 deletions
@@ -411,6 +411,8 @@ smithsohu (https://github.com/smitsohu) | |||
411 | - fixed device discovery for simple-scan | 411 | - fixed device discovery for simple-scan |
412 | - add novideo support in many profiles | 412 | - add novideo support in many profiles |
413 | - improve server profiles, harden musescore | 413 | - improve server profiles, harden musescore |
414 | - snap profile cleanup | ||
415 | - tighten some capability sets further | ||
414 | soredake (https://github.com/soredake) | 416 | soredake (https://github.com/soredake) |
415 | - fix steam startup with >=llvm-4 | 417 | - fix steam startup with >=llvm-4 |
416 | SpotComms (https://github.com/SpotComms) | 418 | SpotComms (https://github.com/SpotComms) |
diff --git a/etc/dnscrypt-proxy.profile b/etc/dnscrypt-proxy.profile index a1ccfbe22..86af9c7b3 100644 --- a/etc/dnscrypt-proxy.profile +++ b/etc/dnscrypt-proxy.profile | |||
@@ -17,7 +17,7 @@ include /etc/firejail/disable-passwdmgr.inc | |||
17 | include /etc/firejail/disable-programs.inc | 17 | include /etc/firejail/disable-programs.inc |
18 | 18 | ||
19 | caps | 19 | caps |
20 | # caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot,sys_resource | 20 | # caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot |
21 | no3d | 21 | no3d |
22 | nodvd | 22 | nodvd |
23 | nonewprivs | 23 | nonewprivs |
diff --git a/etc/dnsmasq.profile b/etc/dnsmasq.profile index ce159c343..d4cd0530e 100644 --- a/etc/dnsmasq.profile +++ b/etc/dnsmasq.profile | |||
@@ -17,6 +17,7 @@ include /etc/firejail/disable-passwdmgr.inc | |||
17 | include /etc/firejail/disable-programs.inc | 17 | include /etc/firejail/disable-programs.inc |
18 | 18 | ||
19 | caps | 19 | caps |
20 | # caps.keep net_admin,net_bind_service,net_raw,setgid,setuid | ||
20 | no3d | 21 | no3d |
21 | nodvd | 22 | nodvd |
22 | nonewprivs | 23 | nonewprivs |
diff --git a/etc/snap.profile b/etc/snap.profile index 238dffeab..38aef7c23 100644 --- a/etc/snap.profile +++ b/etc/snap.profile | |||
@@ -14,5 +14,3 @@ include /etc/firejail/disable-programs.inc | |||
14 | whitelist ${DOWNLOADS} | 14 | whitelist ${DOWNLOADS} |
15 | whitelist ~/snap | 15 | whitelist ~/snap |
16 | include /etc/firejail/whitelist-common.inc | 16 | include /etc/firejail/whitelist-common.inc |
17 | nodvd | ||
18 | notv | ||
diff --git a/etc/unbound.profile b/etc/unbound.profile index afc903e88..2a38aa7c6 100644 --- a/etc/unbound.profile +++ b/etc/unbound.profile | |||
@@ -17,7 +17,7 @@ include /etc/firejail/disable-passwdmgr.inc | |||
17 | include /etc/firejail/disable-programs.inc | 17 | include /etc/firejail/disable-programs.inc |
18 | 18 | ||
19 | caps | 19 | caps |
20 | # caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot,sys_resource | 20 | # caps.keep net_bind_service,setgid,setuid,sys_chroot,sys_resource |
21 | no3d | 21 | no3d |
22 | nodvd | 22 | nodvd |
23 | nonewprivs | 23 | nonewprivs |
diff --git a/etc/wireshark.profile b/etc/wireshark.profile index 57f4f2f5b..f1a17ba93 100644 --- a/etc/wireshark.profile +++ b/etc/wireshark.profile | |||
@@ -12,7 +12,7 @@ include /etc/firejail/disable-devel.inc | |||
12 | include /etc/firejail/disable-passwdmgr.inc | 12 | include /etc/firejail/disable-passwdmgr.inc |
13 | include /etc/firejail/disable-programs.inc | 13 | include /etc/firejail/disable-programs.inc |
14 | 14 | ||
15 | # caps.drop all | 15 | caps.keep dac_override,net_admin,net_raw |
16 | netfilter | 16 | netfilter |
17 | no3d | 17 | no3d |
18 | # nogroups - breaks unprivileged wireshark usage | 18 | # nogroups - breaks unprivileged wireshark usage |
@@ -21,6 +21,7 @@ no3d | |||
21 | nodvd | 21 | nodvd |
22 | nosound | 22 | nosound |
23 | notv | 23 | notv |
24 | novideo | ||
24 | # protocol unix,inet,inet6,netlink | 25 | # protocol unix,inet,inet6,netlink |
25 | # seccomp - breaks unprivileged wireshark usage | 26 | # seccomp - breaks unprivileged wireshark usage |
26 | shell none | 27 | shell none |
@@ -8,12 +8,13 @@ gcov_init() { | |||
8 | /usr/lib/firejail/fseccomp --help > /dev/null | 8 | /usr/lib/firejail/fseccomp --help > /dev/null |
9 | /usr/lib/firejail/ftee --help > /dev/null | 9 | /usr/lib/firejail/ftee --help > /dev/null |
10 | /usr/lib/firejail/fcopy --help > /dev/null | 10 | /usr/lib/firejail/fcopy --help > /dev/null |
11 | /usr/lib/firejail/fldd --help > /dev/null | ||
11 | firecfg --help > /dev/null | 12 | firecfg --help > /dev/null |
12 | sudo chown $USER:$USER `find .` | 13 | sudo chown $USER:$USER `find .` |
13 | } | 14 | } |
14 | 15 | ||
15 | generate() { | 16 | generate() { |
16 | lcov -q --capture -d src/firejail -d src/firemon -d src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg --output-file gcov-file-new | 17 | lcov -q --capture -d src/firejail -d src/firemon -d src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-new |
17 | lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file | 18 | lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file |
18 | rm -fr gcov-dir | 19 | rm -fr gcov-dir |
19 | genhtml -q gcov-file --output-directory gcov-dir | 20 | genhtml -q gcov-file --output-directory gcov-dir |
@@ -24,7 +25,7 @@ generate() { | |||
24 | 25 | ||
25 | 26 | ||
26 | gcov_init | 27 | gcov_init |
27 | lcov -q --capture -d src/firejail -d src/firemon -d src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg --output-file gcov-file-old | 28 | lcov -q --capture -d src/firejail -d src/firemon -d src/fcopy -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-old |
28 | 29 | ||
29 | #make test-environment | 30 | #make test-environment |
30 | #generate | 31 | #generate |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 8074fcd74..656942440 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -107,7 +107,9 @@ static void set_caps(void) { | |||
107 | caps_default_filter(); | 107 | caps_default_filter(); |
108 | 108 | ||
109 | // drop discretionary access control capabilities for root sandboxes | 109 | // drop discretionary access control capabilities for root sandboxes |
110 | caps_drop_dac_override(); | 110 | // if caps.keep, the user has to set it manually in the list |
111 | if (!arg_caps_keep) | ||
112 | caps_drop_dac_override(); | ||
111 | } | 113 | } |
112 | 114 | ||
113 | void save_nogroups(void) { | 115 | void save_nogroups(void) { |
diff --git a/src/fldd/main.c b/src/fldd/main.c index 947c6b4ae..5fda45266 100644 --- a/src/fldd/main.c +++ b/src/fldd/main.c | |||
@@ -265,6 +265,11 @@ printf("\n"); | |||
265 | } | 265 | } |
266 | 266 | ||
267 | 267 | ||
268 | if (strcmp(argv[1], "--help") == 0) { | ||
269 | usage(); | ||
270 | return 0; | ||
271 | } | ||
272 | |||
268 | // check program access | 273 | // check program access |
269 | if (access(argv[1], R_OK)) { | 274 | if (access(argv[1], R_OK)) { |
270 | fprintf(stderr, "Error fldd: cannot access %s\n", argv[1]); | 275 | fprintf(stderr, "Error fldd: cannot access %s\n", argv[1]); |
diff --git a/src/fseccomp/syscall.c b/src/fseccomp/syscall.c index abdedb957..d0692b2ef 100644 --- a/src/fseccomp/syscall.c +++ b/src/fseccomp/syscall.c | |||
@@ -110,7 +110,6 @@ static const SyscallGroupList sysgroups[] = { | |||
110 | { .name = "@default", .list = | 110 | { .name = "@default", .list = |
111 | "@cpu-emulation," | 111 | "@cpu-emulation," |
112 | "@debug," | 112 | "@debug," |
113 | "@module," | ||
114 | "@obsolete," | 113 | "@obsolete," |
115 | "@privileged," | 114 | "@privileged," |
116 | "@resources," | 115 | "@resources," |
diff --git a/test/fs/fs.sh b/test/fs/fs.sh index 9e7ead3c9..e67ccc476 100755 --- a/test/fs/fs.sh +++ b/test/fs/fs.sh | |||
@@ -28,6 +28,9 @@ echo "TESTING: kmsg access (test/fs/kmsg.exp)" | |||
28 | echo "TESTING: read/write /var/tmp (test/fs/fs_var_tmp.exp)" | 28 | echo "TESTING: read/write /var/tmp (test/fs/fs_var_tmp.exp)" |
29 | ./fs_var_tmp.exp | 29 | ./fs_var_tmp.exp |
30 | 30 | ||
31 | echo "TESTING: private-lib (test/fs/private-lib.exp)" | ||
32 | ./private-lib.exp | ||
33 | |||
31 | echo "TESTING: read/write /var/lock (test/fs/fs_var_lock.exp)" | 34 | echo "TESTING: read/write /var/lock (test/fs/fs_var_lock.exp)" |
32 | ./fs_var_lock.exp | 35 | ./fs_var_lock.exp |
33 | 36 | ||
diff --git a/test/fs/private-lib.exp b/test/fs/private-lib.exp new file mode 100755 index 000000000..dd418da0f --- /dev/null +++ b/test/fs/private-lib.exp | |||
@@ -0,0 +1,44 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2017 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | spawn $env(SHELL) | ||
8 | match_max 100000 | ||
9 | |||
10 | send -- "firejail --private-lib --private-bin=sh,bash,dash,ps,grep,ls,find,echo \r" | ||
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 1\n";exit} | ||
13 | "Child process initialized" | ||
14 | } | ||
15 | after 100 | ||
16 | |||
17 | send -- "find /bin; echo done\r" | ||
18 | expect { | ||
19 | timeout {puts "TESTING ERROR 2\n";exit} | ||
20 | "rm" {puts "TESTING ERROR 3\n";exit} | ||
21 | "cp" {puts "TESTING ERROR 4\n";exit} | ||
22 | "done" | ||
23 | } | ||
24 | after 100 | ||
25 | |||
26 | send -- "find /lib; echo done\r" | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 5\n";exit} | ||
29 | "modules" {puts "TESTING ERROR 6\n";exit} | ||
30 | "firmware" {puts "TESTING ERROR 7\n";exit} | ||
31 | "libc.so" | ||
32 | } | ||
33 | after 100 | ||
34 | |||
35 | send -- "find /usr/lib; echo done\r" | ||
36 | expect { | ||
37 | timeout {puts "TESTING ERROR 8\n";exit} | ||
38 | "grub" {puts "TESTING ERROR 9\n";exit} | ||
39 | "mozilla" {puts "TESTING ERROR 10\n";exit} | ||
40 | "libdl.so" | ||
41 | } | ||
42 | after 100 | ||
43 | |||
44 | puts "\nall done\n" | ||
diff --git a/test/utils/seccomp-print.exp b/test/utils/seccomp-print.exp index 5a76d7fcc..b3ab5e13c 100755 --- a/test/utils/seccomp-print.exp +++ b/test/utils/seccomp-print.exp | |||
@@ -22,11 +22,11 @@ expect { | |||
22 | } | 22 | } |
23 | expect { | 23 | expect { |
24 | timeout {puts "TESTING ERROR 2\n";exit} | 24 | timeout {puts "TESTING ERROR 2\n";exit} |
25 | "init_module" | 25 | "delete_module" |
26 | } | 26 | } |
27 | expect { | 27 | expect { |
28 | timeout {puts "TESTING ERROR 3\n";exit} | 28 | timeout {puts "TESTING ERROR 3\n";exit} |
29 | "delete_module" | 29 | "init_module" |
30 | } | 30 | } |
31 | expect { | 31 | expect { |
32 | timeout {puts "TESTING ERROR 4\n";exit} | 32 | timeout {puts "TESTING ERROR 4\n";exit} |