4 files changed, 64 insertions, 3 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 12f792af8..3ffb2b527 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -249,6 +249,7 @@ void net_dns_print(pid_t pid);
 
 // network.c
 void net_if_up(const char *ifname);
+void net_if_down(const char *ifname);
 void net_if_ip(const char *ifname, uint32_t ip, uint32_t mask, int mtu);
 int net_get_if_addr(const char *bridge, uint32_t *ip, uint32_t *mask, uint8_t mac[6], int *mtu);
 int net_add_route(uint32_t dest, uint32_t mask, uint32_t gw);
diff --git a/src/firejail/network.c b/src/firejail/network.c
index 5f7a84a1e..ece406fc8 100644
--- a/src/firejail/network.c
+++ b/src/firejail/network.c
@@ -240,6 +240,40 @@ void net_if_up(const char *ifname) {
         close(sock);
 }
 
+// bring interface up
+void net_if_down(const char *ifname) {
+        if (strlen(ifname) > IFNAMSIZ) {
+                fprintf(stderr, "Error: invalid network device name %s\n", ifname);
+                exit(1);
+        }
+        
+        int sock = socket(AF_INET,SOCK_DGRAM,0);
+        if (sock < 0)
+                errExit("socket");
+
+        // get the existing interface flags
+        struct ifreq ifr;
+        memset(&ifr, 0, sizeof(ifr));
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        ifr.ifr_addr.sa_family = AF_INET;
+
+        // read the existing flags
+        if (ioctl(sock, SIOCGIFFLAGS, &ifr ) < 0) {
+                close(sock);
+                errExit("ioctl");
+        }
+
+        ifr.ifr_flags &= ~IFF_UP;
+
+        // set the new flags
+        if (ioctl( sock, SIOCSIFFLAGS, &ifr ) < 0) {
+                close(sock);
+                errExit("ioctl");
+        }
+
+        close(sock);
+}
+
 // configure interface
 void net_if_ip(const char *ifname, uint32_t ip, uint32_t mask, int mtu) {
         if (strlen(ifname) > IFNAMSIZ) {
diff --git a/src/firejail/network_main.c b/src/firejail/network_main.c
index c93c47eda..66eff0b85 100644
--- a/src/firejail/network_main.c
+++ b/src/firejail/network_main.c
@@ -121,12 +121,12 @@ void net_configure_veth_pair(Bridge *br, const char *ifname, pid_t child) {
                 errExit("asprintf");
         net_create_veth(dev, ifname, child);
 
-        // bring up the interface
-        net_if_up(dev);
-
         // add interface to the bridge
         net_bridge_add_interface(br->dev, dev);
 
+        // bring up the interface
+        net_if_up(dev);
+
         char *msg;
         if (asprintf(&msg, "%d.%d.%d.%d address assigned to sandbox", PRINT_IP(br->ipsandbox)) == -1)
                 errExit("asprintf");
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 356807acf..25662d90e 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -161,6 +161,32 @@ static void monitor_application(pid_t app_pid) {
                 if (app_pid != 0 && arg_debug)
                         printf("Sandbox monitor: monitoring %u\n", app_pid);
         }
+
+#if 0
+// todo: find a way to shut down interfaces before closing the namespace
+// the problem is we don't have enough privileges to shutdown interfaces in this momen
+        // shut down bridge/macvlan interfaces
+        if (any_bridge_configured()) {
+                
+                if (cfg.bridge0.configured) {
+                        printf("Shutting down %s\n", cfg.bridge0.devsandbox);
+                        net_if_down( cfg.bridge0.devsandbox);
+                }
+                if (cfg.bridge1.configured) {
+                        printf("Shutting down %s\n", cfg.bridge1.devsandbox);
+                        net_if_down( cfg.bridge1.devsandbox);
+                }
+                if (cfg.bridge2.configured) {
+                        printf("Shutting down %s\n", cfg.bridge2.devsandbox);
+                        net_if_down( cfg.bridge2.devsandbox);
+                }
+                if (cfg.bridge3.configured) {
+                        printf("Shutting down %s\n", cfg.bridge3.devsandbox);
+                        net_if_down( cfg.bridge3.devsandbox);
+                }
+                usleep(20000);  // 20 ms sleep
+        }       
+#endif  
 }