11 files changed, 60 insertions, 44 deletions

diff --git a/Makefile.in b/Makefile.in
index 11193122d..ddc63c1af 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -116,7 +116,7 @@ endif
         install -m 0755 src/jailcheck/jailcheck $(DESTDIR)$(bindir)
         # libraries and plugins
         install -m 0755 -d $(DESTDIR)$(libdir)/firejail
-        install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS) src/firecfg/firecfg.config
+        install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS)
         install -m 0755 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS)
         # plugins w/o read permission (non-dumpable)
         install -m 0711 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS_NON_DUMPABLE)
@@ -135,6 +135,7 @@ endif
         install -m 0644 -t $(DESTDIR)$(DOCDIR) COPYING README RELNOTES etc/templates/*
         # profiles and settings
         install -m 0755 -d $(DESTDIR)$(sysconfdir)/firejail
+        install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail src/firecfg/firecfg.config
         install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail etc/profile-a-l/*.profile etc/profile-m-z/*.profile etc/inc/*.inc etc/net/*.net etc/firejail.config etc/ids.config
         sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;"
 ifeq ($(BUSYBOX_WORKAROUND),yes)
diff --git a/README.md b/README.md
index c58ef84c0..7594f1328 100644
--- a/README.md
+++ b/README.md
@@ -150,7 +150,7 @@ PulseAudio changes.
 Start your programs the way you are used to: desktop manager menus, file manager, desktop launchers.
 The integration applies to any program supported by default by Firejail. There are about 250 default applications
 in current Firejail version, and the number goes up with every new release.
-We keep the application list in [/usr/lib/firejail/firecfg.config](https://github.com/netblue30/firejail/blob/master/src/firecfg/firecfg.config) file.
+We keep the application list in [/etc/firejail/firecfg.config](https://github.com/netblue30/firejail/blob/master/src/firecfg/firecfg.config) file.
 
 ## Security profiles
 
diff --git a/etc/inc/allow-ssh.inc b/etc/inc/allow-ssh.inc
index a78798a18..5d41e6607 100644
--- a/etc/inc/allow-ssh.inc
+++ b/etc/inc/allow-ssh.inc
@@ -5,6 +5,11 @@ include allow-ssh.local
 noblacklist ${HOME}/.ssh
 noblacklist /etc/ssh
 noblacklist /etc/ssh/ssh_config
-noblacklist /tmp/ssh-*
 noblacklist ${PATH}/ssh
-noblacklist /usr/lib/openssh/ssh-keysign
+noblacklist /tmp/ssh-*
+# Arch Linux and derivatives
+noblacklist /usr/lib/ssh
+# Debian/Ubuntu and derivatives
+noblacklist /usr/lib/openssh
+# Fedora and derivatives
+noblacklist /usr/libexec/openssh
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index 1a4de9b26..bdc5ff6b2 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -495,7 +495,9 @@ blacklist ${PATH}/xev
 blacklist ${PATH}/xinput
 # from 0.9.67
 blacklist ${PATH}/ssh
-blacklist /usr/lib/openssh/ssh-keysign
+blacklist /usr/lib/openssh
+blacklist /usr/lib/ssh
+blacklist /usr/libexec/openssh
 blacklist ${PATH}/passwd
 blacklist /usr/lib/xorg/Xorg.wrap
 blacklist /usr/lib/policykit-1/polkit-agent-helper-1
diff --git a/src/fids/main.c b/src/fids/main.c
index c899b55e1..8f9bc1ea0 100644
--- a/src/fids/main.c
+++ b/src/fids/main.c
@@ -210,22 +210,29 @@ static void process_config(const char *fname) {
                 exit(1);
         }
 
-        // make sure the file is owned by root
-        struct stat s;
-        if (stat(fname, &s)) {
+        fprintf(stderr, "Opening config file %s\n", fname);
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
+        if (fd < 0) {
                 if (include_level == 1) {
-                        fprintf(stderr, "Error ids: config file not found\n");
+                        fprintf(stderr, "Error ids: cannot open config file %s\n", fname);
                         exit(1);
                 }
                 return;
         }
+
+        // make sure the file is owned by root
+        struct stat s;
+        if (fstat(fd, &s)) {
+                fprintf(stderr, "Error ids: cannot stat config file %s\n", fname);
+                exit(1);
+        }
         if (s.st_uid || s.st_gid) {
                 fprintf(stderr, "Error ids: config file not owned by root\n");
                 exit(1);
         }
 
-        fprintf(stderr, "Loading %s config file\n", fname);
-        FILE *fp = fopen(fname, "r");
+        fprintf(stderr, "Loading config file %s\n", fname);
+        FILE *fp = fdopen(fd, "r");
         if (!fp) {
                 fprintf(stderr, "Error fids: cannot open config file %s\n", fname);
                 exit(1);
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 0f4c1b18b..3ec5f9660 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -1,4 +1,4 @@
-# /usr/lib/firejail/firecfg.config - firecfg utility configuration file
+# /etc/firejail/firecfg.config - firecfg utility configuration file
 # This is the list of programs in alphabetical order handled by firecfg utility
 #
 0ad
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index 363000e15..fafa0e635 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -171,17 +171,17 @@ static void set_file(const char *name, const char *firejail_exec) {
         free(fname);
 }
 
-// parse /usr/lib/firejail/firecfg.cfg file
+// parse /etc/firejail/firecfg.config file
 static void set_links_firecfg(void) {
         char *cfgfile;
-        if (asprintf(&cfgfile, "%s/firejail/firecfg.config", LIBDIR) == -1)
+        if (asprintf(&cfgfile, "%s/firecfg.config", SYSCONFDIR) == -1)
                 errExit("asprintf");
 
         char *firejail_exec;
         if (asprintf(&firejail_exec, "%s/bin/firejail", PREFIX) == -1)
                 errExit("asprintf");
 
-        // parse /usr/lib/firejail/firecfg.cfg file
+        // parse /etc/firejail/firecfg.config file
         FILE *fp = fopen(cfgfile, "r");
         if (!fp) {
                 perror("fopen");
@@ -440,7 +440,7 @@ int main(int argc, char **argv) {
         // clear all symlinks
         clean();
 
-        // set new symlinks based on /usr/lib/firejail/firecfg.cfg
+        // set new symlinks based on /etc/firejail/firecfg.config
         set_links_firecfg();
 
         if (getuid() == 0) {
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 2266fa499..bb5b29d79 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -45,10 +45,10 @@ int appimage_find_profile(const char *archive) {
         assert(archive);
         assert(strlen(archive));
 
-        // try to match the name of the archive with the list of programs in /usr/lib/firejail/firecfg.config
-        FILE *fp = fopen(LIBDIR "/firejail/firecfg.config", "r");
+        // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config
+        FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r");
         if (!fp) {
-                fprintf(stderr, "Error: cannot find %s, firejail is not correctly installed\n", LIBDIR "/firejail/firecfg.config");
+                fprintf(stderr, "Error: cannot find %s, firejail is not correctly installed\n", SYSCONFDIR "/firecfg.config");
                 exit(1);
         }
         char buf[MAXBUF];
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 9c1b889ed..f62e6404e 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -94,16 +94,7 @@ static void disable_file(OPERATION op, const char *filename) {
                 return;
         }
 
-        // if the file is not present, do nothing
         assert(fname);
-        struct stat s;
-        if (stat(fname, &s) < 0) {
-                if (arg_debug)
-                        printf("Warning (blacklisting): cannot access %s: %s\n", fname, strerror(errno));
-                free(fname);
-                return;
-        }
-
         // check for firejail executable
         // we might have a file found in ${PATH} pointing to /usr/bin/firejail
         // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird
@@ -113,6 +104,24 @@ static void disable_file(OPERATION op, const char *filename) {
                 return;
         }
 
+        // if the file is not present, do nothing
+        int fd = open(fname, O_PATH|O_CLOEXEC);
+        if (fd < 0) {
+                if (arg_debug)
+                        printf("Warning (blacklisting): cannot open %s: %s\n", fname, strerror(errno));
+                free(fname);
+                return;
+        }
+
+        struct stat s;
+        if (fstat(fd, &s) < 0) {
+                if (arg_debug)
+                        printf("Warning (blacklisting): cannot stat %s: %s\n", fname, strerror(errno));
+                free(fname);
+                close(fd);
+                return;
+        }
+
         // modify the file
         if (op == BLACKLIST_FILE || op == BLACKLIST_NOLOG) {
                 // some distros put all executables under /usr/bin and make /bin a symbolic link
@@ -136,13 +145,6 @@ static void disable_file(OPERATION op, const char *filename) {
                                         printf(" - no logging\n");
                         }
 
-                        int fd = open(fname, O_PATH|O_CLOEXEC);
-                        if (fd < 0) {
-                                if (arg_debug)
-                                        printf("Warning (blacklisting): cannot open %s: %s\n", fname, strerror(errno));
-                                free(fname);
-                                return;
-                        }
                         EUID_ROOT();
                         if (S_ISDIR(s.st_mode)) {
                                 if (bind_mount_path_to_fd(RUN_RO_DIR, fd) < 0)
@@ -153,7 +155,6 @@ static void disable_file(OPERATION op, const char *filename) {
                                         errExit("disable file");
                         }
                         EUID_USER();
-                        close(fd);
 
                         if (op == BLACKLIST_FILE)
                                 fs_logger2("blacklist", fname);
@@ -180,8 +181,7 @@ static void disable_file(OPERATION op, const char *filename) {
         else if (op == MOUNT_TMPFS) {
                 if (!S_ISDIR(s.st_mode)) {
                         fwarning("%s is not a directory; cannot mount a tmpfs on top of it.\n", fname);
-                        free(fname);
-                        return;
+                        goto out;
                 }
 
                 uid_t uid = getuid();
@@ -191,8 +191,7 @@ static void disable_file(OPERATION op, const char *filename) {
                             strncmp(cfg.homedir, fname, strlen(cfg.homedir)) != 0 ||
                             fname[strlen(cfg.homedir)] != '/') {
                                 fwarning("you are not allowed to mount a tmpfs on %s\n", fname);
-                                free(fname);
-                                return;
+                                goto out;
                         }
                 }
 
@@ -202,6 +201,8 @@ static void disable_file(OPERATION op, const char *filename) {
         else
                 assert(0);
 
+out:
+        close(fd);
         free(fname);
 }
 
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 3d9bf9082..e02be29f1 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -435,11 +435,11 @@ void seccomp_print_filter(pid_t pid) {
         if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_LIST) == -1)
                 errExit("asprintf");
 
-        struct stat s;
-        if (stat(fname, &s) == -1)
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
+        if (fd < 0)
                 goto errexit;
 
-        FILE *fp = fopen(fname, "re");
+        FILE *fp = fdopen(fd, "r");
         if (!fp)
                 goto errexit;
         free(fname);
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt
index 7e0a57f92..189e9cc8d 100644
--- a/src/man/firecfg.txt
+++ b/src/man/firecfg.txt
@@ -27,7 +27,7 @@ desktop managers are supported in this moment
 To set it up, run "sudo firecfg" after installing Firejail software.
 The same command should also be run after
 installing new programs. If the program is supported by Firejail, the symbolic link in /usr/local/bin
-will be created. For a full list of programs supported by default run "cat /usr/lib/firejail/firecfg.config".
+will be created. For a full list of programs supported by default run "cat /etc/firejail/firecfg.config".
 
 For user-driven manual integration, see \fBDESKTOP INTEGRATION\fR section in \fBman 1 firejail\fR.
 .SH DEFAULT ACTIONS