diff options
38 files changed, 182 insertions, 218 deletions
diff --git a/.gitignore b/.gitignore index 1285dea92..5e26f1711 100644 --- a/.gitignore +++ b/.gitignore | |||
@@ -14,6 +14,7 @@ firejail-*.tar.xz | |||
14 | firejail-login.5 | 14 | firejail-login.5 |
15 | firejail-profile.5 | 15 | firejail-profile.5 |
16 | firejail-config.5 | 16 | firejail-config.5 |
17 | firejail-users.5 | ||
17 | firejail.1 | 18 | firejail.1 |
18 | firemon.1 | 19 | firemon.1 |
19 | firecfg.1 | 20 | firecfg.1 |
@@ -251,6 +251,11 @@ glitsj16 (https://github.com/glitsj16) | |||
251 | - gunzip, bunzip2 profiles | 251 | - gunzip, bunzip2 profiles |
252 | - enchant, enchat-2, enchant-lsmod, enchant-lsmod-2 profiles | 252 | - enchant, enchat-2, enchant-lsmod, enchant-lsmod-2 profiles |
253 | - atool, soundconvertor, mpd, gnome-calculator, makepkg profile fixes | 253 | - atool, soundconvertor, mpd, gnome-calculator, makepkg profile fixes |
254 | - acat, adiff, als, apack, arepack, aunpack profiles, | ||
255 | - fix sqlitebrowser blacklist | ||
256 | - spelling fixes | ||
257 | - bitblbee profile fixes | ||
258 | - fix firefox common addons | ||
254 | graywolf (https://github.com/graywolf) | 259 | graywolf (https://github.com/graywolf) |
255 | - spelling fix | 260 | - spelling fix |
256 | greigdp (https://github.com/greigdp) | 261 | greigdp (https://github.com/greigdp) |
@@ -295,6 +300,8 @@ James Elford (https://github.com/jelford) | |||
295 | - removed shell none from ssh-agent configuration, fixing the infinit loop | 300 | - removed shell none from ssh-agent configuration, fixing the infinit loop |
296 | - added gcloud profile | 301 | - added gcloud profile |
297 | - blacklist sensitive cloud provider files in disable-common | 302 | - blacklist sensitive cloud provider files in disable-common |
303 | Jean Lucas (https://github.com/flacks) | ||
304 | - fix Discord profile | ||
298 | Jericho (https://github.com/attritionorg) | 305 | Jericho (https://github.com/attritionorg) |
299 | - spelling | 306 | - spelling |
300 | Jesse Smith (https://github.com/slicer69) | 307 | Jesse Smith (https://github.com/slicer69) |
@@ -368,4 +368,5 @@ pycharm-community, pycharm-professional, Pitivi, OnionShare, Fritzing, Kaffeine, | |||
368 | tilp, vivaldi-snapshot, bitcoin-qt, VS Code, falkon, gnome-builder, lobase, asunder, | 368 | tilp, vivaldi-snapshot, bitcoin-qt, VS Code, falkon, gnome-builder, lobase, asunder, |
369 | gnome-recipes, akonadi_control, evince-previewer, evince-thumbnailer, blender-2.8, | 369 | gnome-recipes, akonadi_control, evince-previewer, evince-thumbnailer, blender-2.8, |
370 | thunderbird-beta, ncdu, gnome-logs, gcloud, musixmatch, gunzip, bunzip2, | 370 | thunderbird-beta, ncdu, gnome-logs, gcloud, musixmatch, gunzip, bunzip2, |
371 | enchant, enchant-2, enchant-lsmod, enchant-lsmod-2 | 371 | enchant, enchant-2, enchant-lsmod, enchant-lsmod-2, Discord, |
372 | acat, adiff, als, apack, arepack, aunpack profiles | ||
@@ -1,6 +1,8 @@ | |||
1 | firejail (0.9.53) baseline; urgency=low | 1 | firejail (0.9.53) baseline; urgency=low |
2 | * work in progress | 2 | * work in progress |
3 | * modif: --force depercated | 3 | * modif: --force depercated |
4 | * modif: --csg, --zsh deprecated | ||
5 | * modif: --debug-check-filename deprecated | ||
4 | * modif: --git-install and --git-uninstall deprecated | 6 | * modif: --git-install and --git-uninstall deprecated |
5 | * modif: support for private-bin, private-lib and shell none has been | 7 | * modif: support for private-bin, private-lib and shell none has been |
6 | disabled while running AppImage archives in order to be able to use | 8 | disabled while running AppImage archives in order to be able to use |
@@ -39,7 +41,9 @@ firejail (0.9.53) baseline; urgency=low | |||
39 | * new profiles: akonadi_controle, evince-previewer, evince-thumbnailer, | 41 | * new profiles: akonadi_controle, evince-previewer, evince-thumbnailer, |
40 | * new profiles: blender-2.8, thunderbird-beta, ncdu, gnome-logs, gcloud | 42 | * new profiles: blender-2.8, thunderbird-beta, ncdu, gnome-logs, gcloud |
41 | * new profiles: musixmatch, gunzip, bunzip2, enchant-lsmod, enchant-lsmod-2 | 43 | * new profiles: musixmatch, gunzip, bunzip2, enchant-lsmod, enchant-lsmod-2 |
42 | * new profiles: enchant, enchant-2 | 44 | * new profiles: enchant, enchant-2, Discord, acat, adiff, als, apack |
45 | * new profiles: arepack, aunpack profiles | ||
46 | |||
43 | -- netblue30 <netblue30@yahoo.com> Thu, 1 Mar 2018 08:00:00 -0500 | 47 | -- netblue30 <netblue30@yahoo.com> Thu, 1 Mar 2018 08:00:00 -0500 |
44 | 48 | ||
45 | firejail (0.9.52) baseline; urgency=low | 49 | firejail (0.9.52) baseline; urgency=low |
diff --git a/etc/bitlbee.profile b/etc/bitlbee.profile index b6baa66bc..1cd5d6a69 100644 --- a/etc/bitlbee.profile +++ b/etc/bitlbee.profile | |||
@@ -28,7 +28,6 @@ seccomp | |||
28 | disable-mnt | 28 | disable-mnt |
29 | private | 29 | private |
30 | private-dev | 30 | private-dev |
31 | private-dev | ||
32 | private-tmp | 31 | private-tmp |
33 | read-write /var/lib/bitlbee | 32 | read-write /var/lib/bitlbee |
34 | 33 | ||
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index ff5dc7b6b..7bc66b1e9 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -116,6 +116,10 @@ blacklist /run/user/*/kdeinit5__* | |||
116 | # blacklist /tmp/ksocket-*/kdeinit4__* | 116 | # blacklist /tmp/ksocket-*/kdeinit4__* |
117 | # - causes issues when kdeinit4 gets killed; enable on KDE Plasma 4 | 117 | # - causes issues when kdeinit4 gets killed; enable on KDE Plasma 4 |
118 | 118 | ||
119 | # gnome | ||
120 | # contains extensions, last used times of applications, and notifications | ||
121 | blacklist ${HOME}/.local/share/gnome-shell | ||
122 | |||
119 | # systemd | 123 | # systemd |
120 | blacklist ${HOME}/.config/systemd | 124 | blacklist ${HOME}/.config/systemd |
121 | blacklist ${HOME}/.local/share/systemd | 125 | blacklist ${HOME}/.local/share/systemd |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index 54e0cfb1f..b8c49b28a 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -430,6 +430,7 @@ blacklist ${HOME}/.local/share/telepathy | |||
430 | blacklist ${HOME}/.local/share/terasology | 430 | blacklist ${HOME}/.local/share/terasology |
431 | blacklist ${HOME}/.local/share/torbrowser | 431 | blacklist ${HOME}/.local/share/torbrowser |
432 | blacklist ${HOME}/.local/share/totem | 432 | blacklist ${HOME}/.local/share/totem |
433 | blacklist ${HOME}/.local/share/uzbl | ||
433 | blacklist ${HOME}/.local/share/vlc | 434 | blacklist ${HOME}/.local/share/vlc |
434 | blacklist ${HOME}/.local/share/vpltd | 435 | blacklist ${HOME}/.local/share/vpltd |
435 | blacklist ${HOME}/.local/share/vulkan | 436 | blacklist ${HOME}/.local/share/vulkan |
diff --git a/etc/firefox-common-addons.inc b/etc/firefox-common-addons.inc index b237c3c05..333ebdaa2 100644 --- a/etc/firefox-common-addons.inc +++ b/etc/firefox-common-addons.inc | |||
@@ -16,7 +16,6 @@ noblacklist ${HOME}/.kde4/share/apps/okular | |||
16 | noblacklist ${HOME}/.kde4/share/config/kgetrc | 16 | noblacklist ${HOME}/.kde4/share/config/kgetrc |
17 | noblacklist ${HOME}/.kde4/share/config/okularpartrc | 17 | noblacklist ${HOME}/.kde4/share/config/okularpartrc |
18 | noblacklist ${HOME}/.kde4/share/config/okularrc | 18 | noblacklist ${HOME}/.kde4/share/config/okularrc |
19 | # noblacklist ${HOME}/.local/share/gnome-shell/extensions | ||
20 | noblacklist ${HOME}/.local/share/kget | 19 | noblacklist ${HOME}/.local/share/kget |
21 | noblacklist ${HOME}/.local/share/okular | 20 | noblacklist ${HOME}/.local/share/okular |
22 | noblacklist ${HOME}/.local/share/qpdfview | 21 | noblacklist ${HOME}/.local/share/qpdfview |
@@ -41,7 +40,6 @@ whitelist ${HOME}/.kde4/share/config/okularpartrc | |||
41 | whitelist ${HOME}/.kde4/share/config/okularrc | 40 | whitelist ${HOME}/.kde4/share/config/okularrc |
42 | whitelist ${HOME}/.keysnail.js | 41 | whitelist ${HOME}/.keysnail.js |
43 | whitelist ${HOME}/.lastpass | 42 | whitelist ${HOME}/.lastpass |
44 | whitelist ${HOME}/.local/share/gnome-shell/extensions | ||
45 | whitelist ${HOME}/.local/share/kget | 43 | whitelist ${HOME}/.local/share/kget |
46 | whitelist ${HOME}/.local/share/okular | 44 | whitelist ${HOME}/.local/share/okular |
47 | whitelist ${HOME}/.local/share/qpdfview | 45 | whitelist ${HOME}/.local/share/qpdfview |
@@ -53,3 +51,14 @@ whitelist ${HOME}/.wine-pipelight | |||
53 | whitelist ${HOME}/.wine-pipelight64 | 51 | whitelist ${HOME}/.wine-pipelight64 |
54 | whitelist ${HOME}/.zotero | 52 | whitelist ${HOME}/.zotero |
55 | whitelist ${HOME}/dwhelper | 53 | whitelist ${HOME}/dwhelper |
54 | |||
55 | # GNOME Shell integration (chrome-gnome-shell) needs dbus and python 3 (blacklisted by disable-interpreters.inc) | ||
56 | noblacklist ${HOME}/.local/share/gnome-shell/extensions | ||
57 | whitelist ${HOME}/.local/share/gnome-shell/extensions | ||
58 | ignore nodbus | ||
59 | noblacklist ${PATH}/python3* | ||
60 | noblacklist /usr/lib/python3* | ||
61 | |||
62 | # Flash plugin | ||
63 | # private-etc must first be enabled in firefox-common.profile and in profiles including it. | ||
64 | #private-etc adobe | ||
diff --git a/etc/firejail-default b/etc/firejail-default index 2e48439f5..5cfb1b5ea 100644 --- a/etc/firejail-default +++ b/etc/firejail-default | |||
@@ -21,10 +21,10 @@ profile firejail-default flags=(attach_disconnected,mediate_deleted) { | |||
21 | #dbus, | 21 | #dbus, |
22 | 22 | ||
23 | ########## | 23 | ########## |
24 | # Allows to attach to a running program and modify the process memory. | 24 | # With ptrace it is possible to inspect and hijack running programs. Usually this |
25 | # May be needed by chromium crash handler. Uncomment if you need it. | 25 | # is needed only for debugging. To allow ptrace, uncomment the following line |
26 | ########## | 26 | ########## |
27 | #ptrace (trace tracedby), | 27 | #ptrace, |
28 | 28 | ||
29 | ########## | 29 | ########## |
30 | # Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes | 30 | # Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes |
@@ -133,8 +133,8 @@ network raw, | |||
133 | signal, | 133 | signal, |
134 | 134 | ||
135 | ########## | 135 | ########## |
136 | # We let Firejail deal with capabilities, | 136 | # We let Firejail deal with capabilities, but ensure that |
137 | # but mac_admin should be dropped in any case. | 137 | # some AppArmor related capabilities will not be available. |
138 | ########## | 138 | ########## |
139 | capability chown, | 139 | capability chown, |
140 | capability dac_override, | 140 | capability dac_override, |
diff --git a/etc/flowblade.profile b/etc/flowblade.profile index bad8538cf..e06107f0f 100644 --- a/etc/flowblade.profile +++ b/etc/flowblade.profile | |||
@@ -8,6 +8,12 @@ include /etc/firejail/globals.local | |||
8 | noblacklist ${HOME}/.config/flowblade | 8 | noblacklist ${HOME}/.config/flowblade |
9 | noblacklist ${HOME}/.flowblade | 9 | noblacklist ${HOME}/.flowblade |
10 | 10 | ||
11 | # Allow python (blacklisted by disable-interpreters.inc) | ||
12 | noblacklist ${PATH}/python2* | ||
13 | noblacklist ${PATH}/python3* | ||
14 | noblacklist /usr/lib/python2* | ||
15 | noblacklist /usr/lib/python3* | ||
16 | |||
11 | include /etc/firejail/disable-common.inc | 17 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-devel.inc | 18 | include /etc/firejail/disable-devel.inc |
13 | include /etc/firejail/disable-interpreters.inc | 19 | include /etc/firejail/disable-interpreters.inc |
diff --git a/etc/less.profile b/etc/less.profile index e2616ba4f..9b04329f2 100644 --- a/etc/less.profile +++ b/etc/less.profile | |||
@@ -20,7 +20,7 @@ shell none | |||
20 | tracelog | 20 | tracelog |
21 | writable-var-log | 21 | writable-var-log |
22 | 22 | ||
23 | # The user can have a custom coloring scritps configured in ${HOME}/.lessfilter. | 23 | # The user can have a custom coloring script configured in ${HOME}/.lessfilter. |
24 | # Enable private-bin and private-lib if you are not using any filter. | 24 | # Enable private-bin and private-lib if you are not using any filter. |
25 | # private-bin less | 25 | # private-bin less |
26 | # private-lib | 26 | # private-lib |
diff --git a/etc/musixmatch.profile b/etc/musixmatch.profile index 1a3ee5e6f..fce60e89e 100644 --- a/etc/musixmatch.profile +++ b/etc/musixmatch.profile | |||
@@ -24,7 +24,6 @@ notv | |||
24 | novideo | 24 | novideo |
25 | protocol unix,inet,inet6,netlink | 25 | protocol unix,inet,inet6,netlink |
26 | seccomp | 26 | seccomp |
27 | shell none | ||
28 | 27 | ||
29 | disable-mnt | 28 | disable-mnt |
30 | private-dev | 29 | private-dev |
diff --git a/etc/openshot.profile b/etc/openshot.profile index 114580f1e..832008564 100644 --- a/etc/openshot.profile +++ b/etc/openshot.profile | |||
@@ -8,6 +8,12 @@ include /etc/firejail/globals.local | |||
8 | noblacklist ${HOME}/.openshot | 8 | noblacklist ${HOME}/.openshot |
9 | noblacklist ${HOME}/.openshot_qt | 9 | noblacklist ${HOME}/.openshot_qt |
10 | 10 | ||
11 | # Allow python (blacklisted by disable-interpreters.inc) | ||
12 | noblacklist ${PATH}/python2* | ||
13 | noblacklist ${PATH}/python3* | ||
14 | noblacklist /usr/lib/python2* | ||
15 | noblacklist /usr/lib/python3* | ||
16 | |||
11 | include /etc/firejail/disable-common.inc | 17 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-devel.inc | 18 | include /etc/firejail/disable-devel.inc |
13 | include /etc/firejail/disable-interpreters.inc | 19 | include /etc/firejail/disable-interpreters.inc |
diff --git a/etc/ranger.profile b/etc/ranger.profile index 94b282669..ff65a057b 100644 --- a/etc/ranger.profile +++ b/etc/ranger.profile | |||
@@ -5,11 +5,19 @@ include /etc/firejail/ranger.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include /etc/firejail/globals.local | 6 | include /etc/firejail/globals.local |
7 | 7 | ||
8 | noblacklist ${HOME}/.config/ranger | ||
9 | |||
10 | # Allow python (blacklisted by disable-interpreters.inc) | ||
11 | noblacklist ${PATH}/python2* | ||
12 | noblacklist ${PATH}/python3* | ||
13 | noblacklist /usr/lib/python2* | ||
14 | noblacklist /usr/lib/python3* | ||
15 | |||
16 | # Allow perl | ||
8 | # noblacklist ${PATH}/cpan* | 17 | # noblacklist ${PATH}/cpan* |
9 | noblacklist ${PATH}/perl | 18 | noblacklist ${PATH}/perl |
10 | noblacklist /usr/lib/perl* | 19 | noblacklist /usr/lib/perl* |
11 | noblacklist /usr/share/perl* | 20 | noblacklist /usr/share/perl* |
12 | noblacklist ${HOME}/.config/ranger | ||
13 | 21 | ||
14 | include /etc/firejail/disable-common.inc | 22 | include /etc/firejail/disable-common.inc |
15 | include /etc/firejail/disable-devel.inc | 23 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/skypeforlinux.profile b/etc/skypeforlinux.profile index 015709247..c2270ce39 100644 --- a/etc/skypeforlinux.profile +++ b/etc/skypeforlinux.profile | |||
@@ -25,7 +25,7 @@ seccomp | |||
25 | shell none | 25 | shell none |
26 | 26 | ||
27 | disable-mnt | 27 | disable-mnt |
28 | #private-dev | 28 | # private-dev - needs /dev/disk |
29 | private-tmp | 29 | private-tmp |
30 | 30 | ||
31 | noexec ${HOME} | 31 | noexec ${HOME} |
diff --git a/etc/uzbl-browser.profile b/etc/uzbl-browser.profile index 0a3549c97..b8a3fa497 100644 --- a/etc/uzbl-browser.profile +++ b/etc/uzbl-browser.profile | |||
@@ -7,6 +7,13 @@ include /etc/firejail/globals.local | |||
7 | 7 | ||
8 | noblacklist ${HOME}/.config/uzbl | 8 | noblacklist ${HOME}/.config/uzbl |
9 | noblacklist ${HOME}/.gnupg | 9 | noblacklist ${HOME}/.gnupg |
10 | noblacklist ${HOME}/.local/share/uzbl | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | noblacklist ${PATH}/python2* | ||
14 | noblacklist ${PATH}/python3* | ||
15 | noblacklist /usr/lib/python2* | ||
16 | noblacklist /usr/lib/python3* | ||
10 | 17 | ||
11 | include /etc/firejail/disable-common.inc | 18 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-devel.inc | 19 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/zathura.profile b/etc/zathura.profile index b47aeb0da..028e15ef5 100644 --- a/etc/zathura.profile +++ b/etc/zathura.profile | |||
@@ -15,6 +15,7 @@ include /etc/firejail/disable-passwdmgr.inc | |||
15 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | machine-id | ||
18 | # net none | 19 | # net none |
19 | # nodbus | 20 | # nodbus |
20 | nodvd | 21 | nodvd |
@@ -29,7 +30,7 @@ shell none | |||
29 | 30 | ||
30 | private-bin zathura | 31 | private-bin zathura |
31 | private-dev | 32 | private-dev |
32 | private-etc fonts | 33 | private-etc fonts,machine-id |
33 | private-tmp | 34 | private-tmp |
34 | 35 | ||
35 | read-only ${HOME}/ | 36 | read-only ${HOME}/ |
@@ -6,15 +6,15 @@ echo "#define FIREJAIL_UIDS_H" >> uids.h | |||
6 | 6 | ||
7 | if [ -r /etc/login.defs ] | 7 | if [ -r /etc/login.defs ] |
8 | then | 8 | then |
9 | echo "// using values extracted from /etc/login.defs" >> uids.h | ||
10 | UID_MIN=`awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs` | 9 | UID_MIN=`awk '/^\s*UID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs` |
11 | GID_MIN=`awk '/^\s*GID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs` | 10 | GID_MIN=`awk '/^\s*GID_MIN\s*([0-9]*).*?$/ {print $2}' /etc/login.defs` |
12 | echo "#define UID_MIN $UID_MIN" >> uids.h | ||
13 | echo "#define GID_MIN $GID_MIN" >> uids.h | ||
14 | else | ||
15 | echo "// using default values" >> uids.h | ||
16 | echo "#define UID_MIN 1000" >> uids.h | ||
17 | echo "#define GID_MIN 1000" >> uids.h | ||
18 | fi | 11 | fi |
19 | 12 | ||
13 | # use default values if not found | ||
14 | [ -z "$UID_MIN" ] && UID_MIN="1000" | ||
15 | [ -z "$GID_MIN" ] && GID_MIN="1000" | ||
16 | |||
17 | echo "#define UID_MIN $UID_MIN" >> uids.h | ||
18 | echo "#define GID_MIN $GID_MIN" >> uids.h | ||
19 | |||
20 | echo "#endif" >> uids.h | 20 | echo "#endif" >> uids.h |
diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c index 49e58528c..eb3794d3f 100644 --- a/src/firecfg/desktop_files.c +++ b/src/firecfg/desktop_files.c | |||
@@ -163,8 +163,6 @@ void fix_desktop_files(char *homedir) { | |||
163 | // skip links | 163 | // skip links |
164 | if (is_link(filename)) | 164 | if (is_link(filename)) |
165 | continue; | 165 | continue; |
166 | if (stat(filename, &sb) == -1) | ||
167 | errExit("stat"); | ||
168 | 166 | ||
169 | // no profile in /etc/firejail, no desktop file fixing | 167 | // no profile in /etc/firejail, no desktop file fixing |
170 | if (!have_profile(filename, homedir)) | 168 | if (!have_profile(filename, homedir)) |
@@ -173,23 +171,33 @@ void fix_desktop_files(char *homedir) { | |||
173 | //**************************************************** | 171 | //**************************************************** |
174 | // load the file in memory and do some basic checking | 172 | // load the file in memory and do some basic checking |
175 | //**************************************************** | 173 | //**************************************************** |
176 | /* coverity[toctou] */ | 174 | FILE *fp = fopen(filename, "r"); |
177 | int fd = open(filename, O_RDONLY); | 175 | if (!fp) { |
178 | if (fd == -1) { | ||
179 | fprintf(stderr, "Warning: cannot open /usr/share/applications/%s\n", filename); | 176 | fprintf(stderr, "Warning: cannot open /usr/share/applications/%s\n", filename); |
180 | continue; | 177 | continue; |
181 | } | 178 | } |
182 | 179 | ||
183 | char *buf = mmap(NULL, sb.st_size + 1, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); | 180 | fseek(fp, 0, SEEK_END); |
184 | if (buf == MAP_FAILED) | 181 | size_t size = ftell(fp); |
185 | errExit("mmap"); | 182 | fseek(fp, 0, SEEK_SET); |
186 | close(fd); | 183 | char *buf = malloc(size + 1); |
184 | if (!buf) | ||
185 | errExit("malloc"); | ||
186 | |||
187 | size_t loaded = fread(buf, size, 1, fp); | ||
188 | fclose(fp); | ||
189 | if (loaded != 1) { | ||
190 | fprintf(stderr, "Warning: cannot read /usr/share/applications/%s\n", filename); | ||
191 | free(buf); | ||
192 | continue; | ||
193 | } | ||
194 | buf[size] = '\0'; | ||
187 | 195 | ||
188 | // check format | 196 | // check format |
189 | if (strstr(buf, "[Desktop Entry]\n") == NULL) { | 197 | if (strstr(buf, "[Desktop Entry]\n") == NULL) { |
190 | if (arg_debug) | 198 | if (arg_debug) |
191 | printf(" %s - skipped: wrong format?\n", filename); | 199 | printf(" %s - skipped: wrong format?\n", filename); |
192 | munmap(buf, sb.st_size + 1); | 200 | free(buf); |
193 | continue; | 201 | continue; |
194 | } | 202 | } |
195 | 203 | ||
@@ -198,7 +206,7 @@ void fix_desktop_files(char *homedir) { | |||
198 | if (!ptr || strlen(ptr) < 7) { | 206 | if (!ptr || strlen(ptr) < 7) { |
199 | if (arg_debug) | 207 | if (arg_debug) |
200 | printf(" %s - skipped: wrong format?\n", filename); | 208 | printf(" %s - skipped: wrong format?\n", filename); |
201 | munmap(buf, sb.st_size + 1); | 209 | free(buf); |
202 | continue; | 210 | continue; |
203 | } | 211 | } |
204 | 212 | ||
@@ -207,7 +215,7 @@ void fix_desktop_files(char *homedir) { | |||
207 | if (execname[0] == '"') { | 215 | if (execname[0] == '"') { |
208 | if (arg_debug) | 216 | if (arg_debug) |
209 | printf(" %s - skipped: path quoting unsupported\n", filename); | 217 | printf(" %s - skipped: path quoting unsupported\n", filename); |
210 | munmap(buf, sb.st_size + 1); | 218 | free(buf); |
211 | continue; | 219 | continue; |
212 | } | 220 | } |
213 | 221 | ||
@@ -241,12 +249,9 @@ void fix_desktop_files(char *homedir) { | |||
241 | } | 249 | } |
242 | } | 250 | } |
243 | 251 | ||
244 | if (change_exec == NULL && change_dbus == 0) { | 252 | free(buf); |
245 | munmap(buf, sb.st_size + 1); | 253 | if (change_exec == NULL && change_dbus == 0) |
246 | continue; | 254 | continue; |
247 | } | ||
248 | |||
249 | munmap(buf, sb.st_size + 1); | ||
250 | 255 | ||
251 | //**************************************************** | 256 | //**************************************************** |
252 | // generate output file | 257 | // generate output file |
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in index 48d985d73..d0f43041c 100644 --- a/src/firejail/Makefile.in +++ b/src/firejail/Makefile.in | |||
@@ -2,7 +2,7 @@ all: firejail | |||
2 | 2 | ||
3 | include ../common.mk | 3 | include ../common.mk |
4 | 4 | ||
5 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h ../include/firejail_user.h | 5 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/ldd_utils.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h ../include/firejail_user.h |
6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | 6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ |
7 | 7 | ||
8 | firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o | 8 | firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o |
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index 7b0ae30b6..f8094e893 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -166,10 +166,6 @@ int checkcfg(int val) { | |||
166 | else | 166 | else |
167 | goto errout; | 167 | goto errout; |
168 | } | 168 | } |
169 | // follow symlink in private-bin command | ||
170 | else if (strncmp(ptr, "follow-symlink-private-bin ", 27) == 0) { | ||
171 | fwarning("follow-symlink-private-bin from firejail.config was deprecated\n"); | ||
172 | } | ||
173 | // nonewprivs | 169 | // nonewprivs |
174 | else if (strncmp(ptr, "force-nonewprivs ", 17) == 0) { | 170 | else if (strncmp(ptr, "force-nonewprivs ", 17) == 0) { |
175 | if (strcmp(ptr + 17, "yes") == 0) | 171 | if (strcmp(ptr + 17, "yes") == 0) |
@@ -311,9 +307,6 @@ int checkcfg(int val) { | |||
311 | else | 307 | else |
312 | goto errout; | 308 | goto errout; |
313 | } | 309 | } |
314 | else if (strncmp(ptr, "remount-proc-sys ", 17) == 0) { | ||
315 | fwarning("remount-proc-sys from firejail.config was deprecated\n"); | ||
316 | } | ||
317 | else if (strncmp(ptr, "overlayfs ", 10) == 0) { | 310 | else if (strncmp(ptr, "overlayfs ", 10) == 0) { |
318 | if (strcmp(ptr + 10, "yes") == 0) | 311 | if (strcmp(ptr + 10, "yes") == 0) |
319 | cfg_val[CFG_OVERLAYFS] = 1; | 312 | cfg_val[CFG_OVERLAYFS] = 1; |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 4fd11ab4f..2746deea1 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -309,7 +309,6 @@ static inline int any_interface_configured(void) { | |||
309 | extern int arg_private; // mount private /home | 309 | extern int arg_private; // mount private /home |
310 | extern int arg_private_template; // private /home template | 310 | extern int arg_private_template; // private /home template |
311 | extern int arg_debug; // print debug messages | 311 | extern int arg_debug; // print debug messages |
312 | extern int arg_debug_check_filename; // print debug messages for filename checking | ||
313 | extern int arg_debug_blacklists; // print debug messages for blacklists | 312 | extern int arg_debug_blacklists; // print debug messages for blacklists |
314 | extern int arg_debug_whitelists; // print debug messages for whitelists | 313 | extern int arg_debug_whitelists; // print debug messages for whitelists |
315 | extern int arg_debug_private_lib; // print debug messages for private-lib | 314 | extern int arg_debug_private_lib; // print debug messages for private-lib |
@@ -577,9 +576,6 @@ void caps_keep_list(const char *clist); | |||
577 | void caps_print_filter(pid_t pid); | 576 | void caps_print_filter(pid_t pid); |
578 | void caps_drop_dac_override(void); | 577 | void caps_drop_dac_override(void); |
579 | 578 | ||
580 | // syscall.c | ||
581 | const char *syscall_find_nr(int nr); | ||
582 | |||
583 | // fs_trace.c | 579 | // fs_trace.c |
584 | void fs_trace_preload(void); | 580 | void fs_trace_preload(void); |
585 | void fs_trace(void); | 581 | void fs_trace(void); |
@@ -647,12 +643,6 @@ void env_ibus_load(void); | |||
647 | // fs_whitelist.c | 643 | // fs_whitelist.c |
648 | void fs_whitelist(void); | 644 | void fs_whitelist(void); |
649 | 645 | ||
650 | // errno.c | ||
651 | int errno_highest_nr(void); | ||
652 | int errno_find_name(const char *name); | ||
653 | char *errno_find_nr(int nr); | ||
654 | void errno_print(void); | ||
655 | |||
656 | // pulseaudio.c | 646 | // pulseaudio.c |
657 | void pulseaudio_init(void); | 647 | void pulseaudio_init(void); |
658 | void pulseaudio_disable(void); | 648 | void pulseaudio_disable(void); |
@@ -795,10 +785,6 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, | |||
795 | // run sbox | 785 | // run sbox |
796 | int sbox_run(unsigned filter, int num, ...); | 786 | int sbox_run(unsigned filter, int num, ...); |
797 | 787 | ||
798 | // git.c | ||
799 | void git_install(); | ||
800 | void git_uninstall(); | ||
801 | |||
802 | // run_files.c | 788 | // run_files.c |
803 | void delete_run_files(pid_t pid); | 789 | void delete_run_files(pid_t pid); |
804 | void delete_bandwidth_run_file(pid_t pid); | 790 | void delete_bandwidth_run_file(pid_t pid); |
diff --git a/src/firejail/main.c b/src/firejail/main.c index e676bbd7c..2d8af7f41 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -47,7 +47,6 @@ Config cfg; // configuration | |||
47 | int arg_private = 0; // mount private /home and /tmp directoryu | 47 | int arg_private = 0; // mount private /home and /tmp directoryu |
48 | int arg_private_template = 0; // mount private /home using a template | 48 | int arg_private_template = 0; // mount private /home using a template |
49 | int arg_debug = 0; // print debug messages | 49 | int arg_debug = 0; // print debug messages |
50 | int arg_debug_check_filename = 0; // print debug messages for filename checking | ||
51 | int arg_debug_blacklists = 0; // print debug messages for blacklists | 50 | int arg_debug_blacklists = 0; // print debug messages for blacklists |
52 | int arg_debug_whitelists = 0; // print debug messages for whitelists | 51 | int arg_debug_whitelists = 0; // print debug messages for whitelists |
53 | int arg_debug_private_lib = 0; // print debug messages for private-lib | 52 | int arg_debug_private_lib = 0; // print debug messages for private-lib |
@@ -1051,8 +1050,6 @@ int main(int argc, char **argv) { | |||
1051 | 1050 | ||
1052 | if (strcmp(argv[i], "--debug") == 0 && !arg_quiet) | 1051 | if (strcmp(argv[i], "--debug") == 0 && !arg_quiet) |
1053 | arg_debug = 1; | 1052 | arg_debug = 1; |
1054 | else if (strcmp(argv[i], "--debug-check-filename") == 0) | ||
1055 | arg_debug_check_filename = 1; | ||
1056 | else if (strcmp(argv[i], "--debug-blacklists") == 0) | 1053 | else if (strcmp(argv[i], "--debug-blacklists") == 0) |
1057 | arg_debug_blacklists = 1; | 1054 | arg_debug_blacklists = 1; |
1058 | else if (strcmp(argv[i], "--debug-whitelists") == 0) | 1055 | else if (strcmp(argv[i], "--debug-whitelists") == 0) |
@@ -1439,9 +1436,6 @@ int main(int argc, char **argv) { | |||
1439 | custom_profile = 1; | 1436 | custom_profile = 1; |
1440 | free(ppath); | 1437 | free(ppath); |
1441 | } | 1438 | } |
1442 | else if (strncmp(argv[i], "--profile-path=", 15) == 0) { | ||
1443 | fwarning("--profile-path has been deprecated\n"); | ||
1444 | } | ||
1445 | else if (strcmp(argv[i], "--noprofile") == 0) { | 1439 | else if (strcmp(argv[i], "--noprofile") == 0) { |
1446 | if (custom_profile) { | 1440 | if (custom_profile) { |
1447 | fprintf(stderr, "Error: --profile and --noprofile options are mutually exclusive\n"); | 1441 | fprintf(stderr, "Error: --profile and --noprofile options are mutually exclusive\n"); |
@@ -1541,9 +1535,6 @@ int main(int argc, char **argv) { | |||
1541 | else if (strcmp(argv[i], "--machine-id") == 0) { | 1535 | else if (strcmp(argv[i], "--machine-id") == 0) { |
1542 | arg_machineid = 1; | 1536 | arg_machineid = 1; |
1543 | } | 1537 | } |
1544 | else if (strcmp(argv[i], "--allow-private-blacklist") == 0) { | ||
1545 | fwarning("--allow-private-blacklist was deprecated\n"); | ||
1546 | } | ||
1547 | else if (strcmp(argv[i], "--private") == 0) { | 1538 | else if (strcmp(argv[i], "--private") == 0) { |
1548 | arg_private = 1; | 1539 | arg_private = 1; |
1549 | } | 1540 | } |
@@ -2117,29 +2108,6 @@ int main(int argc, char **argv) { | |||
2117 | } | 2108 | } |
2118 | else if (strcmp(argv[i], "--appimage") == 0) | 2109 | else if (strcmp(argv[i], "--appimage") == 0) |
2119 | arg_appimage = 1; | 2110 | arg_appimage = 1; |
2120 | else if (strcmp(argv[i], "--csh") == 0) { | ||
2121 | if (arg_shell_none) { | ||
2122 | |||
2123 | fprintf(stderr, "Error: --shell=none was already specified.\n"); | ||
2124 | return 1; | ||
2125 | } | ||
2126 | if (cfg.shell) { | ||
2127 | fprintf(stderr, "Error: only one default user shell can be specified\n"); | ||
2128 | return 1; | ||
2129 | } | ||
2130 | cfg.shell = "/bin/csh"; | ||
2131 | } | ||
2132 | else if (strcmp(argv[i], "--zsh") == 0) { | ||
2133 | if (arg_shell_none) { | ||
2134 | fprintf(stderr, "Error: --shell=none was already specified.\n"); | ||
2135 | return 1; | ||
2136 | } | ||
2137 | if (cfg.shell) { | ||
2138 | fprintf(stderr, "Error: only one default user shell can be specified\n"); | ||
2139 | return 1; | ||
2140 | } | ||
2141 | cfg.shell = "/bin/zsh"; | ||
2142 | } | ||
2143 | else if (strcmp(argv[i], "--shell=none") == 0) { | 2111 | else if (strcmp(argv[i], "--shell=none") == 0) { |
2144 | arg_shell_none = 1; | 2112 | arg_shell_none = 1; |
2145 | if (cfg.shell) { | 2113 | if (cfg.shell) { |
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c index ba955bcca..5bd3f7e09 100644 --- a/src/firejail/no_sandbox.c +++ b/src/firejail/no_sandbox.c | |||
@@ -167,9 +167,7 @@ void run_no_sandbox(int argc, char **argv) { | |||
167 | for (i = 0; i < argc; i++) { | 167 | for (i = 0; i < argc; i++) { |
168 | if (strcmp(argv[i], "--debug") == 0) | 168 | if (strcmp(argv[i], "--debug") == 0) |
169 | arg_debug = 1; | 169 | arg_debug = 1; |
170 | else if (strcmp(argv[i], "--csh") == 0 || | 170 | else if (strcmp(argv[i], "--shell=none") == 0 || |
171 | strcmp(argv[i], "--zsh") == 0 || | ||
172 | strcmp(argv[i], "--shell=none") == 0 || | ||
173 | strncmp(argv[i], "--shell=", 8) == 0) | 171 | strncmp(argv[i], "--shell=", 8) == 0) |
174 | fwarning("shell-related command line options are disregarded - using SHELL environment variable\n"); | 172 | fwarning("shell-related command line options are disregarded - using SHELL environment variable\n"); |
175 | } | 173 | } |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 3ef9a1856..156ffa24a 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -257,10 +257,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
257 | arg_nodbus = 1; | 257 | arg_nodbus = 1; |
258 | return 0; | 258 | return 0; |
259 | } | 259 | } |
260 | else if (strcmp(ptr, "allow-private-blacklist") == 0) { | ||
261 | fmessage("--allow-private-blacklist was deprecated\n"); | ||
262 | return 0; | ||
263 | } | ||
264 | else if (strcmp(ptr, "netfilter") == 0) { | 260 | else if (strcmp(ptr, "netfilter") == 0) { |
265 | #ifdef HAVE_NETWORK | 261 | #ifdef HAVE_NETWORK |
266 | if (checkcfg(CFG_NETWORK)) | 262 | if (checkcfg(CFG_NETWORK)) |
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index effbf3751..742fc0465 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -29,8 +29,6 @@ static char *usage_str = | |||
29 | "Options:\n" | 29 | "Options:\n" |
30 | " -- - signal the end of options and disables further option processing.\n" | 30 | " -- - signal the end of options and disables further option processing.\n" |
31 | " --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n" | 31 | " --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n" |
32 | " --allow-private-blacklist - allow blacklisting files in private\n" | ||
33 | "\thome directories.\n" | ||
34 | " --allusers - all user home directories are visible inside the sandbox.\n" | 32 | " --allusers - all user home directories are visible inside the sandbox.\n" |
35 | " --apparmor - enable AppArmor confinement.\n" | 33 | " --apparmor - enable AppArmor confinement.\n" |
36 | " --apparmor.print=name|pid - print apparmor status.\n" | 34 | " --apparmor.print=name|pid - print apparmor status.\n" |
@@ -58,11 +56,9 @@ static char *usage_str = | |||
58 | #endif | 56 | #endif |
59 | " --cpu=cpu-number,cpu-number - set cpu affinity.\n" | 57 | " --cpu=cpu-number,cpu-number - set cpu affinity.\n" |
60 | " --cpu.print=name|pid - print the cpus in use.\n" | 58 | " --cpu.print=name|pid - print the cpus in use.\n" |
61 | " --csh - use /bin/csh as default shell.\n" | ||
62 | " --debug - print sandbox debug messages.\n" | 59 | " --debug - print sandbox debug messages.\n" |
63 | " --debug-blacklists - debug blacklisting.\n" | 60 | " --debug-blacklists - debug blacklisting.\n" |
64 | " --debug-caps - print all recognized capabilities.\n" | 61 | " --debug-caps - print all recognized capabilities.\n" |
65 | " --debug-check-filename - debug filename checking.\n" | ||
66 | " --debug-errnos - print all recognized error numbers.\n" | 62 | " --debug-errnos - print all recognized error numbers.\n" |
67 | " --debug-private-lib - debug for --private-lib option.\n" | 63 | " --debug-private-lib - debug for --private-lib option.\n" |
68 | " --debug-protocols - print all recognized protocols.\n" | 64 | " --debug-protocols - print all recognized protocols.\n" |
@@ -77,7 +73,9 @@ static char *usage_str = | |||
77 | " --dns.print=name|pid - print DNS configuration.\n" | 73 | " --dns.print=name|pid - print DNS configuration.\n" |
78 | " --env=name=value - set environment variable.\n" | 74 | " --env=name=value - set environment variable.\n" |
79 | " --fs.print=name|pid - print the filesystem log.\n" | 75 | " --fs.print=name|pid - print the filesystem log.\n" |
76 | #ifdef HAVE_FILE_TRANSFER | ||
80 | " --get=name|pid filename - get a file from sandbox container.\n" | 77 | " --get=name|pid filename - get a file from sandbox container.\n" |
78 | #endif | ||
81 | " --help, -? - this help screen.\n" | 79 | " --help, -? - this help screen.\n" |
82 | " --hostname=name - set sandbox hostname.\n" | 80 | " --hostname=name - set sandbox hostname.\n" |
83 | " --hosts-file=file - use file as /etc/hosts.\n" | 81 | " --hosts-file=file - use file as /etc/hosts.\n" |
@@ -97,7 +95,9 @@ static char *usage_str = | |||
97 | #endif | 95 | #endif |
98 | " --join-or-start=name|pid - join the sandbox or start a new one.\n" | 96 | " --join-or-start=name|pid - join the sandbox or start a new one.\n" |
99 | " --list - list all sandboxes.\n" | 97 | " --list - list all sandboxes.\n" |
98 | #ifdef HAVE_FILE_TRANSFER | ||
100 | " --ls=name|pid dir_or_filename - list files in sandbox container.\n" | 99 | " --ls=name|pid dir_or_filename - list files in sandbox container.\n" |
100 | #endif | ||
101 | #ifdef HAVE_NETWORK | 101 | #ifdef HAVE_NETWORK |
102 | " --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n" | 102 | " --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n" |
103 | #endif | 103 | #endif |
@@ -159,13 +159,16 @@ static char *usage_str = | |||
159 | "\tfilesystem, and copy the files and directories in the list.\n" | 159 | "\tfilesystem, and copy the files and directories in the list.\n" |
160 | " --private-tmp - mount a tmpfs on top of /tmp directory.\n" | 160 | " --private-tmp - mount a tmpfs on top of /tmp directory.\n" |
161 | " --private-opt=file,directory - build a new /opt in a temporary filesystem.\n" | 161 | " --private-opt=file,directory - build a new /opt in a temporary filesystem.\n" |
162 | " --private-srv=file,directory - build a new /srv in a temporary filesystem.\n" | ||
162 | " --profile=filename - use a custom profile.\n" | 163 | " --profile=filename - use a custom profile.\n" |
163 | " --profile.print=name|pid - print the name of profile file.\n" | 164 | " --profile.print=name|pid - print the name of profile file.\n" |
164 | " --profile-path=directory - use this directory to look for profile files.\n" | 165 | " --profile-path=directory - use this directory to look for profile files.\n" |
165 | " --protocol=protocol,protocol,protocol - enable protocol filter.\n" | 166 | " --protocol=protocol,protocol,protocol - enable protocol filter.\n" |
166 | " --protocol.print=name|pid - print the protocol filter.\n" | 167 | " --protocol.print=name|pid - print the protocol filter.\n" |
168 | #ifdef HAVE_FILE_TRANSFER | ||
167 | " --put=name|pid src-filename dest-filename - put a file in sandbox\n" | 169 | " --put=name|pid src-filename dest-filename - put a file in sandbox\n" |
168 | "\tcontainer.\n" | 170 | "\tcontainer.\n" |
171 | #endif | ||
169 | " --quiet - turn off Firejail's output.\n" | 172 | " --quiet - turn off Firejail's output.\n" |
170 | " --read-only=filename - set directory or file read-only..\n" | 173 | " --read-only=filename - set directory or file read-only..\n" |
171 | " --read-write=filename - set directory or file read-write.\n" | 174 | " --read-write=filename - set directory or file read-write.\n" |
@@ -230,7 +233,6 @@ static char *usage_str = | |||
230 | " --x11=xvfb - enable Xvfb X11 server.\n" | 233 | " --x11=xvfb - enable Xvfb X11 server.\n" |
231 | " --xephyr-screen=WIDTHxHEIGHT - set screen size for --x11=xephyr.\n" | 234 | " --xephyr-screen=WIDTHxHEIGHT - set screen size for --x11=xephyr.\n" |
232 | #endif | 235 | #endif |
233 | " --zsh - use /usr/bin/zsh as default shell.\n" | ||
234 | "\n" | 236 | "\n" |
235 | "Examples:\n" | 237 | "Examples:\n" |
236 | " $ firejail firefox\n" | 238 | " $ firejail firefox\n" |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 3437d495f..a44e52e98 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -800,9 +800,6 @@ void invalid_filename(const char *fname, int globbing) { | |||
800 | assert(fname); | 800 | assert(fname); |
801 | const char *ptr = fname; | 801 | const char *ptr = fname; |
802 | 802 | ||
803 | if (arg_debug_check_filename) | ||
804 | printf("Checking filename %s\n", fname); | ||
805 | |||
806 | if (strncmp(ptr, "${HOME}", 7) == 0) | 803 | if (strncmp(ptr, "${HOME}", 7) == 0) |
807 | ptr = fname + 7; | 804 | ptr = fname + 7; |
808 | else if (strncmp(ptr, "${PATH}", 7) == 0) | 805 | else if (strncmp(ptr, "${PATH}", 7) == 0) |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index 7040dea18..8cf4fccf3 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -1078,7 +1078,7 @@ void x11_xorg(void) { | |||
1078 | // check xauth utility is present in the system | 1078 | // check xauth utility is present in the system |
1079 | struct stat s; | 1079 | struct stat s; |
1080 | if (stat("/usr/bin/xauth", &s) == -1) { | 1080 | if (stat("/usr/bin/xauth", &s) == -1) { |
1081 | fprintf(stderr, "Error: xauth utility not found in PATH. Please install it:\n" | 1081 | fprintf(stderr, "Error: xauth utility not found in /usr/bin. Please install it:\n" |
1082 | " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); | 1082 | " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); |
1083 | exit(1); | 1083 | exit(1); |
1084 | } | 1084 | } |
diff --git a/src/firemon/usage.c b/src/firemon/usage.c index 37bd4e874..a4d642d66 100644 --- a/src/firemon/usage.c +++ b/src/firemon/usage.c | |||
@@ -43,6 +43,7 @@ static char *help_str = | |||
43 | "\t--tree - print a tree of all sandboxed processes.\n\n" | 43 | "\t--tree - print a tree of all sandboxed processes.\n\n" |
44 | "\t--top - monitor the most CPU-intensive sandboxes.\n\n" | 44 | "\t--top - monitor the most CPU-intensive sandboxes.\n\n" |
45 | "\t--version - print program version and exit.\n\n" | 45 | "\t--version - print program version and exit.\n\n" |
46 | "\t--x11 - print X11 display number.\n\n" | ||
46 | 47 | ||
47 | "Without any options, firemon monitors all fork, exec, id change, and exit\n" | 48 | "Without any options, firemon monitors all fork, exec, id change, and exit\n" |
48 | "events in the sandbox. Monitoring a specific PID is also supported.\n\n" | 49 | "events in the sandbox. Monitoring a specific PID is also supported.\n\n" |
diff --git a/src/lib/firejail_user.c b/src/lib/firejail_user.c index 5d92aa133..7d9784392 100644 --- a/src/lib/firejail_user.c +++ b/src/lib/firejail_user.c | |||
@@ -45,6 +45,12 @@ int firejail_user_check(const char *name) { | |||
45 | if (strcmp(name, "root") == 0) | 45 | if (strcmp(name, "root") == 0) |
46 | return 1; | 46 | return 1; |
47 | 47 | ||
48 | // user nobody disabled by default | ||
49 | if (strcmp(name, "nobody") == 0) { | ||
50 | fprintf(stderr, "Error: user nobody is not allowed to run the sandbox\n"); | ||
51 | exit(1); | ||
52 | } | ||
53 | |||
48 | // check file existence | 54 | // check file existence |
49 | char *fname = get_fname(); | 55 | char *fname = get_fname(); |
50 | if (access(fname, F_OK)) { | 56 | if (access(fname, F_OK)) { |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index b529f63e3..0217e1353 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -223,7 +223,8 @@ Build a new /bin in a temporary filesystem, and copy the programs in the list. | |||
223 | The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin. | 223 | The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin. |
224 | .TP | 224 | .TP |
225 | \fBprivate-dev | 225 | \fBprivate-dev |
226 | Create a new /dev directory. Only dri, null, full, zero, tty, pts, ptmx, random, urandom, log and shm devices are available. | 226 | Create a new /dev directory. Only disc, dri, null, full, zero, tty, pts, ptmx, |
227 | random, snd, urandom, video, log and shm devices are available. | ||
227 | .TP | 228 | .TP |
228 | \fBprivate-etc file,directory | 229 | \fBprivate-etc file,directory |
229 | Build a new /etc in a temporary | 230 | Build a new /etc in a temporary |
@@ -448,6 +449,12 @@ Run the program directly, without a shell. | |||
448 | \fBipc-namespace | 449 | \fBipc-namespace |
449 | Enable IPC namespace. | 450 | Enable IPC namespace. |
450 | .TP | 451 | .TP |
452 | \fBnodbus | ||
453 | Disable D-Bus access. Only the regular UNIX socket is handled by | ||
454 | this command. To disable the abstract socket, you would need to | ||
455 | request a new network namespace using the net command. Another | ||
456 | option is to remove unix from protocol set. | ||
457 | .TP | ||
451 | \fBnosound | 458 | \fBnosound |
452 | Disable sound system. | 459 | Disable sound system. |
453 | .TP | 460 | .TP |
diff --git a/src/man/firejail-users.txt b/src/man/firejail-users.txt index fcc0f914b..ec91e495c 100644 --- a/src/man/firejail-users.txt +++ b/src/man/firejail-users.txt | |||
@@ -5,7 +5,7 @@ firejail.users \- Firejail user access database | |||
5 | .SH DESCRIPTION | 5 | .SH DESCRIPTION |
6 | /etc/firejail/firejail.users lists the users allowed to run firejail SUID executable. | 6 | /etc/firejail/firejail.users lists the users allowed to run firejail SUID executable. |
7 | If the file is not present in the system, all users are allowed to use the sandbox. | 7 | If the file is not present in the system, all users are allowed to use the sandbox. |
8 | root user is allowed by default. | 8 | root user is allowed by default, user nobody is denied access by default. |
9 | 9 | ||
10 | Example: | 10 | Example: |
11 | 11 | ||
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 6e8e4eb2c..d8fed1f31 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -314,15 +314,6 @@ $ firejail \-\-list | |||
314 | $ firejail \-\-cpu.print=3272 | 314 | $ firejail \-\-cpu.print=3272 |
315 | 315 | ||
316 | .TP | 316 | .TP |
317 | \fB\-\-csh | ||
318 | Use /bin/csh as default user shell. | ||
319 | .br | ||
320 | |||
321 | .br | ||
322 | Example: | ||
323 | .br | ||
324 | $ firejail \-\-csh | ||
325 | .TP | ||
326 | \fB\-\-debug\fR | 317 | \fB\-\-debug\fR |
327 | Print debug messages. | 318 | Print debug messages. |
328 | .br | 319 | .br |
@@ -351,15 +342,6 @@ Print all recognized capabilities in the current Firejail software build and exi | |||
351 | Example: | 342 | Example: |
352 | .br | 343 | .br |
353 | $ firejail \-\-debug-caps | 344 | $ firejail \-\-debug-caps |
354 | .TP | ||
355 | \fB\-\-debug-check-filename\fR | ||
356 | Debug filename checking. | ||
357 | .br | ||
358 | |||
359 | .br | ||
360 | Example: | ||
361 | .br | ||
362 | $ firejail \-\-debug-check-filename firefox | ||
363 | 345 | ||
364 | .TP | 346 | .TP |
365 | \fB\-\-debug-errnos | 347 | \fB\-\-debug-errnos |
@@ -1620,20 +1602,16 @@ $ firejail \-\-net=eth0 \-\-scan | |||
1620 | .TP | 1602 | .TP |
1621 | \fB\-\-seccomp | 1603 | \fB\-\-seccomp |
1622 | Enable seccomp filter and blacklist the syscalls in the default list (@default). The default list is as follows: | 1604 | Enable seccomp filter and blacklist the syscalls in the default list (@default). The default list is as follows: |
1623 | mount, umount2, ptrace, kexec_load, kexec_file_load, name_to_handle_at, open_by_handle_at, create_module, init_module, finit_module, delete_module, | 1605 | _sysctl, acct, add_key, adjtimex, afs_syscall, bdflush, bpf, break, chroot, clock_adjtime, clock_settime, |
1624 | iopl, ioperm, ioprio_set, swapon, swapoff, syslog, process_vm_readv, process_vm_writev, | 1606 | create_module, delete_module, fanotify_init, finit_module, ftime, get_kernel_syms, getpmsg, gtty, init_module, |
1625 | sysfs,_sysctl, adjtimex, clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init, kcmp, | 1607 | io_cancel, io_destroy, io_getevents, io_setup, io_submit, ioperm, iopl, ioprio_set, kcmp, kexec_file_load, |
1626 | add_key, request_key, keyctl, uselib, acct, modify_ldt, pivot_root, io_setup, | 1608 | kexec_load, keyctl, lock, lookup_dcookie, mbind, mfsservctl, migrate_pages, modify_ldt, mount, move_pages, mpx, |
1627 | io_destroy, io_getevents, io_submit, io_cancel, | 1609 | name_to_handle_at, open_by_handle_at, pciconfig_iobase, pciconfig_read, pciconfig_write, perf_event_open, |
1628 | remap_file_pages, mbind, set_mempolicy, | 1610 | personality, pivot_root, process_vm_readv, process_vm_writev, process_vm_writev, prof, profil, ptrace, putpmsg, |
1629 | migrate_pages, move_pages, vmsplice, chroot, | 1611 | query_module, reboot, remap_file_pages, request_key, rtas, s390_mmio_read, s390_mmio_write, s390_runtime_instr, |
1630 | tuxcall, reboot, mfsservctl, get_kernel_syms, | 1612 | security, set_mempolicy, setdomainname, sethostname, settimeofday, sgetmask, ssetmask, stime, stty, subpage_prot, |
1631 | bpf, clock_settime, personality, process_vm_writev, query_module, | 1613 | swapoff, swapon, switch_endian, sysfs, syslog, tuxcall, ulimit, umount, umount2, uselib, userfaultfd, ustat, vhangup, |
1632 | settimeofday, stime, umount, userfaultfd, ustat, vm86, vm86old, | 1614 | vm86, vm86old, vmsplice and vserver. |
1633 | afs_syscall, bdflush, break, ftime, getpmsg, gtty, lock, mpx, pciconfig_iobase, pciconfig_read, | ||
1634 | pciconfig_write, prof, profil, putpmsg, rtas, s390_runtime_instr, s390_mmio_read, s390_mmio_write, | ||
1635 | security, setdomainname, sethostname, sgetmask, ssetmask, stty, subpage_prot, switch_endian, | ||
1636 | ulimit, vhangup and vserver. | ||
1637 | 1615 | ||
1638 | .br | 1616 | .br |
1639 | To help creating useful seccomp filters more easily, the following | 1617 | To help creating useful seccomp filters more easily, the following |
@@ -1716,7 +1694,7 @@ Bad system call | |||
1716 | .br | 1694 | .br |
1717 | 1695 | ||
1718 | .TP | 1696 | .TP |
1719 | \fB\-\-seccomp.block_secondary | 1697 | \fB\-\-seccomp.block-secondary |
1720 | Enable seccomp filter and filter system call architectures so that | 1698 | Enable seccomp filter and filter system call architectures so that |
1721 | only the native architecture is allowed. For example, on amd64, i386 | 1699 | only the native architecture is allowed. For example, on amd64, i386 |
1722 | and x32 system calls are blocked as well as changing the execution | 1700 | and x32 system calls are blocked as well as changing the execution |
@@ -1949,8 +1927,7 @@ $ firejail \-\-shell=none script.sh | |||
1949 | \fB\-\-shell=program | 1927 | \fB\-\-shell=program |
1950 | Set default user shell. Use this shell to run the application using \-c shell option. | 1928 | Set default user shell. Use this shell to run the application using \-c shell option. |
1951 | For example "firejail \-\-shell=/bin/dash firefox" will start Mozilla Firefox as "/bin/dash \-c firefox". | 1929 | For example "firejail \-\-shell=/bin/dash firefox" will start Mozilla Firefox as "/bin/dash \-c firefox". |
1952 | By default Bash shell (/bin/bash) is used. Options such as \-\-zsh and \-\-csh can also set the default | 1930 | By default Bash shell (/bin/bash) is used. |
1953 | shell. | ||
1954 | .br | 1931 | .br |
1955 | 1932 | ||
1956 | .br | 1933 | .br |
@@ -2324,16 +2301,6 @@ Example: | |||
2324 | $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox | 2301 | $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox |
2325 | .br | 2302 | .br |
2326 | 2303 | ||
2327 | .TP | ||
2328 | \fB\-\-zsh | ||
2329 | Use /usr/bin/zsh as default user shell. | ||
2330 | .br | ||
2331 | |||
2332 | .br | ||
2333 | Example: | ||
2334 | .br | ||
2335 | $ firejail \-\-zsh | ||
2336 | |||
2337 | .SH DESKTOP INTEGRATION | 2304 | .SH DESKTOP INTEGRATION |
2338 | A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. | 2305 | A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. |
2339 | The symbolic link should be placed in the first $PATH position. On most systems, a good place | 2306 | The symbolic link should be placed in the first $PATH position. On most systems, a good place |
diff --git a/test/appimage/appimage-args.exp b/test/appimage/appimage-args.exp index dcf16452f..0ec07c1ad 100755 --- a/test/appimage/appimage-args.exp +++ b/test/appimage/appimage-args.exp | |||
@@ -56,7 +56,7 @@ expect { | |||
56 | sleep 2 | 56 | sleep 2 |
57 | 57 | ||
58 | spawn $env(SHELL) | 58 | spawn $env(SHELL) |
59 | send -- "firemon --seccomp\r" | 59 | send -- "firemon --seccomp --nowrap\r" |
60 | expect { | 60 | expect { |
61 | timeout {puts "TESTING ERROR 8\n";exit} | 61 | timeout {puts "TESTING ERROR 8\n";exit} |
62 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} | 62 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} |
@@ -71,7 +71,7 @@ expect { | |||
71 | "name=blablabla" | 71 | "name=blablabla" |
72 | } | 72 | } |
73 | after 100 | 73 | after 100 |
74 | send -- "firemon --caps\r" | 74 | send -- "firemon --caps --nowrap\r" |
75 | expect { | 75 | expect { |
76 | timeout {puts "TESTING ERROR 11\n";exit} | 76 | timeout {puts "TESTING ERROR 11\n";exit} |
77 | "appimage Leafpad" | 77 | "appimage Leafpad" |
diff --git a/test/appimage/appimage-v1.exp b/test/appimage/appimage-v1.exp index 073c32dab..90b13b9ff 100755 --- a/test/appimage/appimage-v1.exp +++ b/test/appimage/appimage-v1.exp | |||
@@ -44,7 +44,7 @@ expect { | |||
44 | sleep 2 | 44 | sleep 2 |
45 | 45 | ||
46 | spawn $env(SHELL) | 46 | spawn $env(SHELL) |
47 | send -- "firemon --seccomp\r" | 47 | send -- "firemon --seccomp --nowrap\r" |
48 | expect { | 48 | expect { |
49 | timeout {puts "TESTING ERROR 5\n";exit} | 49 | timeout {puts "TESTING ERROR 5\n";exit} |
50 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} | 50 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} |
@@ -59,7 +59,7 @@ expect { | |||
59 | "name=blablabla" | 59 | "name=blablabla" |
60 | } | 60 | } |
61 | after 100 | 61 | after 100 |
62 | send -- "firemon --caps\r" | 62 | send -- "firemon --caps --nowrap\r" |
63 | expect { | 63 | expect { |
64 | timeout {puts "TESTING ERROR 6\n";exit} | 64 | timeout {puts "TESTING ERROR 6\n";exit} |
65 | "appimage Leafpad" | 65 | "appimage Leafpad" |
diff --git a/test/environment/csh.exp b/test/environment/csh.exp index 10a278ebc..7b5ab9b33 100755 --- a/test/environment/csh.exp +++ b/test/environment/csh.exp | |||
@@ -1,49 +1,31 @@ | |||
1 | #!/usr/bin/expect -f | 1 | #!/usr/bin/expect -f |
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2018 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | 2 | ||
6 | set timeout 10 | 3 | set timeout 10 |
4 | cd /home | ||
7 | spawn $env(SHELL) | 5 | spawn $env(SHELL) |
8 | match_max 100000 | 6 | match_max 100000 |
9 | 7 | ||
10 | send -- "firejail --private --tracelog --csh\r" | 8 | send -- "firejail --private --shell=/bin/csh\r" |
11 | expect { | 9 | expect { |
12 | timeout {puts "TESTING ERROR 0\n";exit} | 10 | timeout {puts "TESTING ERROR 0\n";exit} |
13 | "Child process initialized" | 11 | "Child process initialized" |
14 | } | 12 | } |
15 | sleep 1 | 13 | sleep 1 |
16 | 14 | ||
17 | send -- "find ~\r" | 15 | send -- "env | grep SHELL;pwd\r" |
18 | expect { | 16 | expect { |
19 | timeout {puts "TESTING ERROR 1\n";exit} | 17 | timeout {puts "TESTING ERROR 1\n";exit} |
20 | ".cshrc" | 18 | "SHELL" |
21 | } | ||
22 | |||
23 | send -- "env | grep SHELL\r" | ||
24 | expect { | ||
25 | timeout {puts "TESTING ERROR 2\n";exit} | ||
26 | "SHELL" | ||
27 | } | 19 | } |
28 | expect { | 20 | expect { |
29 | timeout {puts "TESTING ERROR 2.1\n";exit} | 21 | timeout {puts "TESTING ERROR 2\n";exit} |
30 | "/bin/csh" | 22 | "/bin/csh" |
31 | } | 23 | } |
32 | send -- "exit\r" | ||
33 | sleep 1 | ||
34 | |||
35 | send -- "firejail --shell=none --csh\r" | ||
36 | expect { | 24 | expect { |
37 | timeout {puts "TESTING ERROR 3\n";exit} | 25 | timeout {puts "TESTING ERROR 3\n";exit} |
38 | "shell=none was already specified" | 26 | "home" |
39 | } | ||
40 | after 100 | ||
41 | |||
42 | send -- "firejail --csh --shell=none\r" | ||
43 | expect { | ||
44 | timeout {puts "TESTING ERROR 4\n";exit} | ||
45 | "a shell was already specified" | ||
46 | } | 27 | } |
28 | send -- "exit\r" | ||
47 | after 100 | 29 | after 100 |
48 | 30 | ||
49 | puts "\n" | 31 | puts "\nall done\n" |
diff --git a/test/environment/zsh.exp b/test/environment/zsh.exp index e7f610e98..a1b94a326 100755 --- a/test/environment/zsh.exp +++ b/test/environment/zsh.exp | |||
@@ -1,49 +1,31 @@ | |||
1 | #!/usr/bin/expect -f | 1 | #!/usr/bin/expect -f |
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2018 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | 2 | ||
6 | set timeout 10 | 3 | set timeout 10 |
4 | cd /home | ||
7 | spawn $env(SHELL) | 5 | spawn $env(SHELL) |
8 | match_max 100000 | 6 | match_max 100000 |
9 | 7 | ||
10 | send -- "firejail --private --tracelog --zsh\r" | 8 | send -- "firejail --private --shell=/bin/zsh\r" |
11 | expect { | 9 | expect { |
12 | timeout {puts "TESTING ERROR 0\n";exit} | 10 | timeout {puts "TESTING ERROR 0\n";exit} |
13 | "Child process initialized" | 11 | "Child process initialized" |
14 | } | 12 | } |
15 | sleep 1 | 13 | sleep 1 |
16 | 14 | ||
17 | send -- "find ~\r" | ||
18 | expect { | ||
19 | timeout {puts "TESTING ERROR 1\n";exit} | ||
20 | ".zshrc" | ||
21 | } | ||
22 | |||
23 | send -- "env | grep SHELL;pwd\r" | 15 | send -- "env | grep SHELL;pwd\r" |
24 | expect { | 16 | expect { |
25 | timeout {puts "TESTING ERROR 2\n";exit} | 17 | timeout {puts "TESTING ERROR 1\n";exit} |
26 | "SHELL" | 18 | "SHELL" |
27 | } | 19 | } |
28 | expect { | 20 | expect { |
29 | timeout {puts "TESTING ERROR 2.1\n";exit} | 21 | timeout {puts "TESTING ERROR 2\n";exit} |
30 | "/bin/zsh" | 22 | "/bin/zsh" |
31 | } | 23 | } |
32 | send -- "exit\r" | ||
33 | sleep 1 | ||
34 | |||
35 | send -- "firejail --shell=none --zsh\r" | ||
36 | expect { | 24 | expect { |
37 | timeout {puts "TESTING ERROR 3\n";exit} | 25 | timeout {puts "TESTING ERROR 3\n";exit} |
38 | "shell=none was already specified" | 26 | "home" |
39 | } | ||
40 | after 100 | ||
41 | |||
42 | send -- "firejail --zsh --shell=none\r" | ||
43 | expect { | ||
44 | timeout {puts "TESTING ERROR 4\n";exit} | ||
45 | "a shell was already specified" | ||
46 | } | 27 | } |
28 | send -- "exit\r" | ||
47 | after 100 | 29 | after 100 |
48 | 30 | ||
49 | puts "\nall done\n" | 31 | puts "\nall done\n" |
diff --git a/test/root/private.exp b/test/root/private.exp index 784761fc8..e3d3245ae 100755 --- a/test/root/private.exp +++ b/test/root/private.exp | |||
@@ -54,6 +54,21 @@ expect { | |||
54 | after 100 | 54 | after 100 |
55 | send -- "exit\r" | 55 | send -- "exit\r" |
56 | sleep 1 | 56 | sleep 1 |
57 | send -- "firejail --whitelist=/opt/firejail-test-file --whitelist=/opt/firejail-test-dir --debug\r" | ||
58 | expect { | ||
59 | timeout {puts "TESTING ERROR 3.1\n";exit} | ||
60 | "Child process initialized" | ||
61 | } | ||
62 | sleep 1 | ||
63 | |||
64 | send -- "find /opt | wc -l\r" | ||
65 | expect { | ||
66 | timeout {puts "TESTING ERROR 4.1\n";exit} | ||
67 | "4" | ||
68 | } | ||
69 | after 100 | ||
70 | send -- "exit\r" | ||
71 | sleep 1 | ||
57 | 72 | ||
58 | 73 | ||
59 | send -- "touch /srv/firejail-test-file\r" | 74 | send -- "touch /srv/firejail-test-file\r" |
@@ -77,14 +92,20 @@ expect { | |||
77 | after 100 | 92 | after 100 |
78 | send -- "exit\r" | 93 | send -- "exit\r" |
79 | sleep 1 | 94 | sleep 1 |
95 | send -- "firejail --whitelist=/srv/firejail-test-file --whitelist=/srv/firejail-test-dir --debug\r" | ||
96 | expect { | ||
97 | timeout {puts "TESTING ERROR 5.1\n";exit} | ||
98 | "Child process initialized" | ||
99 | } | ||
100 | sleep 1 | ||
80 | 101 | ||
81 | 102 | send -- "find /srv | wc -l\r" | |
82 | 103 | expect { | |
83 | 104 | timeout {puts "TESTING ERROR 6.1\n";exit} | |
84 | 105 | "4" | |
85 | 106 | } | |
86 | 107 | after 100 | |
87 | 108 | send -- "exit\r" | |
88 | 109 | sleep 1 | |
89 | 110 | ||
90 | puts "\nall done\n" | 111 | puts "\nall done\n" |