6 files changed, 85 insertions, 25 deletions

diff --git a/RELNOTES b/RELNOTES
index 3b287ed0c..2760d3f2a 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -5,7 +5,8 @@ firejail (0.9.40-rc1) baseline; urgency=low
   * added --x11=xephyr option
   * added --cpu.print option
   * added filetransfer options --ls and --get
-  * added mkdir, ipc-namespace, net iface and nosound profile commands
+  * added mkdir, ipc-namespace, and nosound profile commands
+  * added net iface, and iprange profile commands
   * --version also prints compile options
   * --output option also redirects stderr
   * added compile-time option to restrict --net= to root only
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index f43f31f02..92fd151c1 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -182,6 +182,19 @@ typedef struct config_t {
 } Config;
 extern Config cfg;
 
+static inline Bridge *last_bridge_configured(void) {
+        if (cfg.bridge3.configured)
+                return &cfg.bridge3;
+        else if (cfg.bridge2.configured)
+                return &cfg.bridge2;
+        else if (cfg.bridge1.configured)
+                return &cfg.bridge1;
+        else if (cfg.bridge0.configured)
+                return &cfg.bridge0;
+        else
+                return NULL;
+}
+
 static inline int any_bridge_configured(void) {
         if (cfg.bridge0.configured || cfg.bridge1.configured || cfg.bridge2.configured || cfg.bridge3.configured)
                 return 1;
diff --git a/src/firejail/list.c b/src/firejail/list.c
index b7c0b5264..cd53264b6 100644
--- a/src/firejail/list.c
+++ b/src/firejail/list.c
@@ -21,7 +21,6 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 
-#if 0
 static void grsec_elevate_privileges(void) {
         struct stat s;
         if (stat("/proc/sys/kernel/grsecurity", &s) == 0) {
@@ -34,7 +33,6 @@ static void grsec_elevate_privileges(void) {
                         errExit("setregid");
         }
 }
-#endif
 
 void top(void) {
         EUID_ASSERT();
@@ -49,7 +47,7 @@ void top(void) {
 
 void netstats(void) {
         EUID_ASSERT();
-//      grsec_elevate_privileges();     
+        grsec_elevate_privileges();     
         
         char *arg[4];
         arg[0] = "bash";
diff --git a/src/firejail/main.c b/src/firejail/main.c
index e8b17bf45..b267a5ecb 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -132,19 +132,6 @@ static void my_handler(int s){
         myexit(1);
 }
 
-static inline Bridge *last_bridge_configured(void) {
-        if (cfg.bridge3.configured)
-                return &cfg.bridge3;
-        else if (cfg.bridge2.configured)
-                return &cfg.bridge2;
-        else if (cfg.bridge1.configured)
-                return &cfg.bridge1;
-        else if (cfg.bridge0.configured)
-                return &cfg.bridge0;
-        else
-                return NULL;
-}
-
 // return 1 if error, 0 if a valid pid was found
 static inline int read_pid(char *str, pid_t *pid) {
         char *endptr;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index a917152ff..6ded0ca2f 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -274,6 +274,52 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         
+        else if (strncmp(ptr, "iprange ", 8) == 0) {
+#ifdef HAVE_NETWORK
+                if (checkcfg(CFG_NETWORK)) {
+                        Bridge *br = last_bridge_configured();
+                        if (br == NULL) {
+                                fprintf(stderr, "Error: no network device configured\n");
+                                exit(1);
+                        }
+                        if (br->iprange_start || br->iprange_end) {
+                                fprintf(stderr, "Error: cannot configure the IP range twice for the same interface\n");
+                                exit(1);
+                        }
+
+                        // parse option arguments
+                        char *firstip = ptr + 8;
+                        char *secondip = firstip;
+                        while (*secondip != '\0') {
+                                if (*secondip == ',')
+                                        break;
+                                secondip++;
+                        }
+                        if (*secondip == '\0') {
+                                fprintf(stderr, "Error: invalid IP range\n");
+                                exit(1);
+                        }
+                        *secondip = '\0';
+                        secondip++;
+                        
+                        // check addresses
+                        if (atoip(firstip, &br->iprange_start) || atoip(secondip, &br->iprange_end) ||
+                            br->iprange_start >= br->iprange_end) {
+                                fprintf(stderr, "Error: invalid IP range\n");
+                                exit(1);
+                        }
+                        if (in_netrange(br->iprange_start, br->ip, br->mask) || in_netrange(br->iprange_end, br->ip, br->mask)) {
+                                fprintf(stderr, "Error: IP range addresses not in network range\n");
+                                exit(1);
+                        }
+                }
+                else
+                        fprintf(stderr, "Warning: networking features are disabled in Firejail configuration file\n");
+#endif
+                return 0;
+        }
+
+        
         if (strncmp(ptr, "protocol ", 9) == 0) {
 #ifdef HAVE_SECCOMP
                 if (checkcfg(CFG_SECCOMP))
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index ddfae5948..9045c1122 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -287,6 +287,29 @@ Disable sound system.
 .SH Networking
 Networking features available in profile files.
 
+\fBdns address
+Set a DNS server for the sandbox. Up to three DNS servers can be defined.
+
+.TP
+\fBhostname name
+Set a hostname for the sandbox.
+
+.TP
+\fBiprange address,address
+Assign  an  IP address in the provided range to the last network
+interface defined by  a  net command.  A  default  gateway  is assigned by default.
+.br
+
+.br
+Example:
+.br
+
+.br
+net eth0
+.br
+iprange 192.168.1.150,192.168.1.160
+.br
+
 .TP
 \fBnetfilter
 If a new network namespace is created, enabled default network filter.
@@ -322,14 +345,6 @@ available in the new namespace is a new loopback interface (lo).
 Use this option to deny network access to programs that don't
 really need network access.
 
-.TP
-\fBdns address
-Set a DNS server for the sandbox. Up to three DNS servers can be defined.
-
-.TP
-\fBhostname name
-Set a hostname for the sandbox.
-
 .SH RELOCATING PROFILES
 For various reasons some users might want to keep the profile files in a different directory.
 Using \fB--profile-path\fR command line option, Firejail can be instructed to look for profiles