7 files changed, 57 insertions, 34 deletions

diff --git a/RELNOTES b/RELNOTES
index b11862382..c1125cb58 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,4 +1,10 @@
 firejail (0.9.54) baseline; urgency=low
+  * work in progress
+  * support full paths in private-lib
+  * globbing support in private-lib
+ -- netblue30 <netblue30@yahoo.com>  Fri, 5 May 2018 08:00:00 -0500
+
+firejail (0.9.54) baseline; urgency=low
   * modif: --force removed
   * modif: --csh, --zsh removed
   * modif: --debug-check-filename removed
diff --git a/etc/eog.profile b/etc/eog.profile
index 8a0925655..5b9ed9bd6 100644
--- a/etc/eog.profile
+++ b/etc/eog.profile
@@ -37,7 +37,7 @@ shell none
 private-bin eog
 private-dev
 private-etc fonts
-private-lib gdk-pixbuf-2.0,gio,girepository-1.0,gvfs,libgconf-2.so.4
+private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*
 private-tmp
 
 #memory-deny-write-execute  - breaks on Arch
diff --git a/etc/evince.profile b/etc/evince.profile
index cca564557..4a8c1a898 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -37,8 +37,7 @@ private-bin evince,evince-previewer,evince-thumbnailer
 private-dev
 private-etc fonts
 
-#private-lib - seems to be breaking on Gnome Shell 3.26.2, Mutter WM, issue 1711
-private-lib evince,gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.4,libpoppler-glib.so.8,librsvg-2.so.2
+private-lib evince,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libpoppler-glib.so.*,librsvg-2.so.*
 
 private-tmp
 
diff --git a/etc/gedit.profile b/etc/gedit.profile
index d7ac6d36c..67ea43ca3 100644
--- a/etc/gedit.profile
+++ b/etc/gedit.profile
@@ -38,7 +38,7 @@ tracelog
 # private-bin gedit
 private-dev
 # private-etc fonts
-private-lib /usr/bin/gedit,libtinfo.so.5,libreadline.so.7,gedit,libgspell-1.so.1,gconv,aspell
+private-lib /usr/bin/gedit,libtinfo.so.*,libreadline.so.*,gedit,libgspell-1.so.*,gconv,aspell
 private-tmp
 
 noexec ${HOME}
diff --git a/etc/gnome-calculator.profile b/etc/gnome-calculator.profile
index 0aed6f52a..b915b0bce 100644
--- a/etc/gnome-calculator.profile
+++ b/etc/gnome-calculator.profile
@@ -35,7 +35,7 @@ shell none
 disable-mnt
 private-bin gnome-calculator
 private-dev
-private-lib gdk-pixbuf-2.0,gio,girepository-1.0,gvfs,libgconf-2.so.4,libgnutls.so.30,libproxy.so.1,librsvg-2.so.2,libxml2.so.2
+private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.*
 private-tmp
 
 #memory-deny-write-execute  - breaks on Arch
diff --git a/etc/gnome-logs.profile b/etc/gnome-logs.profile
index f8bb68fdd..ca4e5f204 100644
--- a/etc/gnome-logs.profile
+++ b/etc/gnome-logs.profile
@@ -35,7 +35,7 @@ disable-mnt
 private-bin gnome-logs
 private-dev
 private-etc fonts,localtime,machine-id
-private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.4,librsvg-2.so.2
+private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*
 private-tmp
 writable-var-log
 
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index ec12ff01b..501188ca7 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -24,6 +24,7 @@
 #include <sys/types.h>
 #include <unistd.h>
 #include <dirent.h>
+#include <glob.h>
 #define MAXBUF 4096
 
 extern void fslib_install_stdc(void);
@@ -171,59 +172,76 @@ void fslib_copy_dir(const char *full_path) {
         free(dest);
 }
 
+// fname should be a vallid full path at this point
+static void load_library(const char *fname) {
+        assert(fname);
+        assert(*fname == '/');
 
+        // existing file owned by root, read access
+        struct stat s;
+        if (stat(fname, &s) == 0 && s.st_uid == 0 && !access(fname, R_OK)) {
+                // load directories, regular 64 bit libraries, and 64 bit executables
+                if (is_dir(fname) || is_lib_64(fname)) {
+                        if (is_dir(fname))
+                                fslib_copy_dir(fname);
+                        else {
+                                if (strstr(fname, ".so") ||
+                                    access(fname, X_OK) != 0) // don't duplicate executables, just install the libraries
+                                        fslib_duplicate(fname);
+
+                                fslib_copy_libs(fname);
+                        }
+                }
+        }
+}
 
 static void install_list_entry(const char *lib) {
-        char *fname = NULL;
-
         // filename check
         int len = strlen(lib);
-        if (strcspn(lib, "\\&!?\"'<>%^(){}[];,*") != (size_t)len ||
+        if (strcspn(lib, "\\&!?\"'<>%^(){}[];,") != (size_t)len ||
         strstr(lib, "..")) {
                 fprintf(stderr, "Error: \"%s\" is an invalid library\n", lib);
                 exit(1);
         }
 
         // if this is a full path, use it as is
-        if (*lib == '/') {
-                fname = strdup(lib);
-                goto load_library;
-        }
+        if (*lib == '/')
+                return load_library(lib);
 
 
         // find the library
         int i;
         for (i = 0; default_lib_paths[i]; i++) {
+                char *fname = NULL;
                 if (asprintf(&fname, "%s/%s", default_lib_paths[i], lib) == -1)
                         errExit("asprintf");
 
-                // existing file owned by root, read access
-                struct stat s;
-                if (stat(fname, &s) == 0 && s.st_uid == 0 && !access(fname, R_OK)) {
-                        // load directories and regular 64 bit libraries
-                        if (is_dir(fname) || is_lib_64(fname))
-                                goto load_library;
-                        // if not 64bit, continue searching
+#define DO_GLOBBING
+#ifdef DO_GLOBBING
+                // globbing
+                glob_t globbuf;
+                int globerr = glob(fname, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf);
+                if (globerr) {
+                        fprintf(stderr, "Error: failed to glob private-lib pattern %s\n", fname);
+                        exit(1);
+                }
+                size_t j;
+                for (j = 0; j < globbuf.gl_pathc; j++) {
+                        assert(globbuf.gl_pathv[j]);
+//printf("glob %s\n", globbuf.gl_pathv[j]);
+                        // GLOB_NOCHECK - no pattern matched returns the original pattern; try to load it anyway
+                        load_library(globbuf.gl_pathv[j]);
                 }
+
+                globfree(&globbuf);
+#else
+                load_library(fname);
+#endif
                 free(fname);
         }
 
 //      fwarning("%s library not found, skipping...\n", lib);
         return;
-
-load_library:
-        if (fname) {
-                if (is_dir(fname))
-                        fslib_copy_dir(fname);
-                else {
-                        if (strstr(fname, ".so") ||
-                            access(fname, X_OK) != 0) // don't duplicate executables
-                                fslib_duplicate(fname);
-
-                        fslib_copy_libs(fname);
-                }
-                free(fname);
-        }
 }