4 files changed, 85 insertions, 22 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 18199c122..a656dcf7c 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -333,7 +333,7 @@ void fs_basic_fs(void);
 void fs_overlayfs(void);
 // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf
 void fs_chroot(const char *rootdir);
-int fs_check_chroot_dir(const char *rootdir);
+void fs_check_chroot_dir(const char *rootdir);
 void fs_private_tmp(void);
 
 // profile.c
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index fa212bbd5..da63ecd00 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -837,17 +837,36 @@ void fs_overlayfs(void) {
 
 #ifdef HAVE_CHROOT              
 // return 1 if error
-int fs_check_chroot_dir(const char *rootdir) {
+void fs_check_chroot_dir(const char *rootdir) {
         assert(rootdir);
         struct stat s;
         char *name;
 
+        if (strcmp(rootdir, "/tmp") == 0 || strcmp(rootdir, "/var/tmp") == 0) {
+                fprintf(stderr, "Error: invalid chroot directory\n");
+                exit(1);
+        }
+
+        // rootdir has to be owned by root
+        if (stat(rootdir, &s) != 0) {
+                fprintf(stderr, "Error: cannot find chroot directory\n");
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot directory should be owned by root\n");
+                exit(1);
+        }
+
         // check /dev
         if (asprintf(&name, "%s/dev", rootdir) == -1)
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /dev in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /dev directory should be owned by root\n");
+                exit(1);
         }
         free(name);
 
@@ -856,7 +875,11 @@ int fs_check_chroot_dir(const char *rootdir) {
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /var/tmp in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /var/tmp directory should be owned by root\n");
+                exit(1);
         }
         free(name);
         
@@ -865,29 +888,54 @@ int fs_check_chroot_dir(const char *rootdir) {
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /proc in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /proc directory should be owned by root\n");
+                exit(1);
         }
         free(name);
         
-        // check /proc
+        // check /tmp
         if (asprintf(&name, "%s/tmp", rootdir) == -1)
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /tmp in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /tmp directory should be owned by root\n");
+                exit(1);
         }
         free(name);
-        
-        // check /bin/bash
-        if (asprintf(&name, "%s/bin/bash", rootdir) == -1)
+
+        // check /etc
+        if (asprintf(&name, "%s/etc", rootdir) == -1)
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
-                fprintf(stderr, "Error: cannot find /bin/bash in chroot directory\n");
-                return 1;
+                fprintf(stderr, "Error: cannot find /etc in chroot directory\n");
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /etc directory should be owned by root\n");
+                exit(1);
         }
         free(name);
 
-        return 0;       
+        // check /etc/resolv.conf
+        if (asprintf(&name, "%s/etc/resolv.conf", rootdir) == -1)
+                errExit("asprintf");
+        if (stat(name, &s) == 0) {
+                if (s.st_uid != 0) {
+                        fprintf(stderr, "Error: chroot /etc/resolv.conf should be owned by root\n");
+                        exit(1);
+                }
+        }
+        if (is_link(name)) {
+                fprintf(stderr, "Error: invalid %s file\n", name);
+                exit(1);
+        }
+        free(name);
 }
 
 // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf
@@ -912,6 +960,10 @@ void fs_chroot(const char *rootdir) {
         char *rundir;
         if (asprintf(&rundir, "%s/run", rootdir) == -1)
                 errExit("asprintf");
+        if (is_link(rundir)) {
+                fprintf(stderr, "Error: invalid run directory inside chroot\n");
+                exit(1);
+        }
         if (!is_dir(rundir)) {
                 int rv = mkdir(rundir, 0755);
                 (void) rv;
@@ -931,8 +983,14 @@ void fs_chroot(const char *rootdir) {
                 fprintf(stderr, "Error: invalid %s file\n", fname);
                 exit(1);
         }
-        if (copy_file("/etc/resolv.conf", fname) == -1)
+        if (copy_file("/etc/resolv.conf", fname) == -1) // root needed
                 fprintf(stderr, "Warning: /etc/resolv.conf not initialized\n");
+        else {
+                if (chown("/etc/resolv.conf", 0, 0) == -1)
+                        errExit("chown");
+                if (chmod("/etc/resolv.conf", 0644) == -1)
+                        errExit("chmod");
+        }
                 
         // chroot into the new directory
         if (arg_debug)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9c1b73e7a..a7bd71356 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -885,6 +885,14 @@ int main(int argc, char **argv) {
                                 fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
                                 exit(1);
                         }
+                        
+                        struct stat s;
+                        if (stat("/proc/sys/kernel/grsecurity", &s) == 0) {
+                                fprintf(stderr, "Error: --chroot option is not available on Grsecurity systems\n");
+                                exit(1);        
+                        }
+                        
+                        
                         invalid_filename(argv[i] + 9);
                         
                         // extract chroot dirname
@@ -909,13 +917,10 @@ int main(int argc, char **argv) {
                                 fprintf(stderr, "Error: invalid chroot directory\n");
                                 exit(1);
                         }
-                        free(rpath);
-                                
+                        cfg.chrootdir = rpath;
+                        
                         // check chroot directory structure
-                        if (fs_check_chroot_dir(cfg.chrootdir)) {
-                                fprintf(stderr, "Error: invalid chroot\n");
-                                exit(1);
-                        }
+                        fs_check_chroot_dir(cfg.chrootdir);
                 }
 #endif
                 else if (strcmp(argv[i], "--private") == 0)
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 21f9a73e3..5a6cb0296 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -228,9 +228,9 @@ void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid
                         fprintf(stderr, "Warning: cannot copy %s\n", srcname);
                 else {
                         if (chown(destname, uid, gid) == -1)
-                                errExit("fchown");
+                                errExit("chown");
                         if (chmod(destname, mode) == -1)
-                                errExit("fchmod");
+                                errExit("chmod");
                 }
                 _exit(0);
         }