6 files changed, 272 insertions, 68 deletions

diff --git a/contrib/fix_private-bin.py b/contrib/fix_private-bin.py
new file mode 100755
index 000000000..270c758a2
--- /dev/null
+++ b/contrib/fix_private-bin.py
@@ -0,0 +1,157 @@
+#!/usr/bin/python3
+
+__author__ = "KOLANICH"
+__copyright__ = """This is free and unencumbered software released into the public domain.
+
+Anyone is free to copy, modify, publish, use, compile, sell, or
+distribute this software, either in source code form or as a compiled
+binary, for any purpose, commercial or non-commercial, and by any
+means.
+
+In jurisdictions that recognize copyright laws, the author or authors
+of this software dedicate any and all copyright interest in the
+software to the public domain. We make this dedication for the benefit
+of the public at large and to the detriment of our heirs and
+successors. We intend this dedication to be an overt act of
+relinquishment in perpetuity of all present and future rights to this
+software under copyright law.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+OTHER DEALINGS IN THE SOFTWARE.
+
+For more information, please refer to <http://unlicense.org/>"""
+__license__ = "Unlicense"
+
+import sys, os, glob, re
+
+privRx=re.compile("^(?:#\s*)?private-bin")
+
+def fixSymlinkedBins(files, replMap):
+        """
+        Used to add filenames to private-bin directives of files if the ones present are mentioned in replMap
+        replMap is a dict where key is the marker filename and value is the filename to add
+        """
+        
+        rxs=dict()
+        for (old,new) in replMap.items():
+                rxs[old]=re.compile("\\b"+old+"\\b")
+                rxs[new]=re.compile("\\b"+new+"\\b")
+        #print(rxs)
+        
+        for filename in files:
+                lines=None
+                with open(filename,"r") as file:
+                        lines=file.readlines()
+                
+                shouldUpdate=False
+                for (i,line) in enumerate(lines):
+                        if privRx.search(line):
+                                for (old,new) in replMap.items():
+                                        if rxs[old].search(line) and not rxs[new].search(line):
+                                                lines[i]=rxs[old].sub(old+","+new, line)
+                                                shouldUpdate=True
+                                                print(lines[i])
+                
+                if shouldUpdate:
+                        with open(filename,"w") as file:
+                                file.writelines(lines)
+                        pass
+
+def createSetOfBinaries(files):
+        """
+        Creates a set of binaries mentioned in private-bin directives of files.
+        """
+        s=set()
+        for filename in files:
+                lines=None
+                with open(filename,"r") as file:
+                        for line in file:
+                                if privRx.search(line):
+                                        bins=line.split(",")
+                                        bins[0]=bins[0].split(" ")[-1]
+                                        bins = [n.strip() for n in bins]
+                                        s=s|set(bins)
+        return s
+
+def createSymlinkTable(binDirs, binariesSet):
+        """
+        creates a dict of symlinked binaries in the system where a key is a symlink name and value is a symlinked binary.
+        binDirs are folders to look into for binaries symlinks
+        binariesSet is a set of binaries to be checked if they are actually a symlinks
+        """
+        m=dict()
+        toProcess=binariesSet
+        while len(toProcess)!=0:
+                additional=set()
+                for sh in toProcess:
+                        for bD in binDirs:
+                                p=bD+os.path.sep+sh
+                                if os.path.exists(p):
+                                        if os.path.islink(p):
+                                                m[sh]=os.readlink(p)
+                                                additional.add(m[sh].split(" ")[0])
+                                        else:
+                                                pass
+                                        break
+                toProcess=additional
+        return m
+
+def doTheFixes(profilesPath, binDirs):
+        """
+        Fixes private-bin in .profiles for firejail. The pipeline is as follows:
+        discover files -> discover mentioned binaries ->
+        discover the ones which are symlinks ->
+        make a look-up table for fix ->
+        filter the ones can be fixed (we cannot fix the ones which are not in directories for binaries) ->
+        apply fix
+        """
+        files=glob.glob(profilesPath+os.path.sep+"*.profile")
+        bins=createSetOfBinaries(files)
+        #print("The binaries used are:")
+        #print(bins)
+        stbl=createSymlinkTable(binDirs,bins)
+        print("The replacement table is:")
+        print(stbl)
+        stbl={a[0]:a[1] for a in stbl.items() if a[0].find(os.path.sep) < 0 and a[1].find(os.path.sep)<0}
+        print("Filtered replacement table is:")
+        print(stbl)
+        fixSymlinkedBins(files,stbl)
+
+def printHelp():
+        print("python3 "+os.path.basename(__file__)+" <dir with .profile files>\nThe default dir is "+defaultProfilesPath+"\n"+doTheFixes.__doc__)
+
+def main():
+        """The main function. Parses the commandline args, shows messages and calles the function actually doing the work."""
+        print(repr(sys.argv))
+        defaultProfilesPath="../etc"
+        if len(sys.argv)>2 or (len(sys.argv)==2 and (sys.argv[1] == '-h' or sys.argv[1] == '--help') ):
+                printHelp()
+                exit(1)
+        
+        profilesPath=None
+        if len(sys.argv)==2:
+                if os.path.isdir(sys.argv[1]):
+                        profilesPath=os.path.abspath(sys.argv[1])
+                else:
+                        if os.path.exists(sys.argv[1]):
+                                print(sys.argv[1]+" is not a dir")
+                        else:
+                                print(sys.argv[1]+" does not exist")
+                        printHelp()
+                        exit(1)
+        else:
+                print("Using default profiles dir: " + defaultProfilesPath)
+                profilesPath=defaultProfilesPath
+
+        binDirs=["/bin","/usr/bin","/usr/sbin","/usr/local/bin","/usr/local/sbin"]
+        print("Binaries dirs are:")
+        print(binDirs)
+        doTheFixes(profilesPath, binDirs)
+
+if __name__ == "__main__":
+        main()
diff --git a/contrib/fix_private-bin_for_symlinked_sh.py b/contrib/fix_private-bin_for_symlinked_sh.py
deleted file mode 100644
index 705e46e46..000000000
--- a/contrib/fix_private-bin_for_symlinked_sh.py
+++ /dev/null
@@ -1,68 +0,0 @@
-#!/usr/bin/python3
-
-import sys, os, glob, re
-
-privRx=re.compile("^(?:#\s*)?private-bin")
-
-def fixSymlinkedBins(files, replMap):
-        rxs=dict()
-        for (old,new) in replMap.items():
-                rxs[old]=re.compile("\\b"+old+"\\b")
-                rxs[new]=re.compile("\\b"+new+"\\b")
-        print(rxs)
-        
-        for filename in files:
-                lines=None
-                with open(filename,"r") as file:
-                        lines=file.readlines()
-                
-                shouldUpdate=False
-                for (i,line) in enumerate(lines):
-                        if privRx.search(line):
-                                for (old,new) in replMap.items():
-                                        if rxs[old].search(line) and not rxs[new].search(line):
-                                                lines[i]=rxs[old].sub(old+","+new, line)
-                                                shouldUpdate=True
-                                                print(lines[i])
-                
-                if shouldUpdate:
-                        with open(filename,"w") as file:
-                                file.writelines(lines)
-                                pass
-
-def createListOfBinaries(files):
-        s=set()
-        for filename in files:
-                lines=None
-                with open(filename,"r") as file:
-                        for line in file:
-                                if privRx.search(line):
-                                        bins=line.split(",")
-                                        bins[0]=bins[0].split(" ")[-1]
-                                        bins = [n.strip() for n in bins]
-                                        s=s|set(bins)
-        return s
-
-def createSymlinkTable(binDirs, binariesSet):
-        m=dict()
-        for sh in binariesSet:
-                for bD in binDirs:
-                        p=bD+os.path.sep+sh
-                        if os.path.exists(p):
-                                if os.path.islink(p):
-                                        m[sh]=os.readlink(p)
-                                else:
-                                        pass
-                                break
-        return m
-
-
-sh="sh"
-binDirs=["/bin","/usr/bin","/usr/sbin","/usr/local/bin","/usr/local/sbin"]
-profilesPath="."
-files=glob.glob(profilesPath+os.path.sep+"*.profile")
-
-bins=createListOfBinaries(files)
-stbl=createSymlinkTable(binDirs,bins)
-print(stbl)
-fixSymlinkedBins(files,{a[0]:a[1] for a in stbl.items() if a[0].find("/") < 0 and a[1].find("/")<0})
diff --git a/contrib/fjclip.py b/contrib/fjclip.py
new file mode 100755
index 000000000..cd12cd289
--- /dev/null
+++ b/contrib/fjclip.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python
+
+import re
+import sys
+import subprocess
+import fjdisplay
+
+usage = """fjclip.py src dest. src or dest can be named firejails or - for stdin or stdout.
+firemon --x11 to see available running x11 firejails. firejail names can be shortened
+to least ambiguous. for example 'work-libreoffice' can be shortened to 'work' if no
+other firejails name starts with 'work'.
+warning: browsers are dangerous. clipboards from browsers are dangerous.  see
+https://github.com/dxa4481/Pastejacking 
+fjclip.py strips whitespace from both
+ends, but does nothing else to protect you.  use a simple gui text editor like
+gedit if you want to see what your pasting.""" 
+
+if len(sys.argv) != 3 or sys.argv == '-h' or sys.argv == '--help':
+    print(usage)
+    exit(1)
+
+if sys.argv[1] == '-':
+    clipin_raw = sys.stdin.read()
+else:
+    display = fjdisplay.getdisplay(sys.argv[1])
+    clipin_raw = subprocess.check_output(['xsel','-b','--display',display])
+
+clipin = clipin_raw.strip()
+
+if sys.argv[2] == '-':
+    print(clipin)
+else:
+    display = fjdisplay.getdisplay(sys.argv[2])
+    clipout = subprocess.Popen(['xsel','-b','-i','--display',display],stdin=subprocess.PIPE)
+    clipout.communicate(clipin)
\ No newline at end of file
diff --git a/contrib/fjdisplay.py b/contrib/fjdisplay.py
new file mode 100755
index 000000000..0e0ef01ec
--- /dev/null
+++ b/contrib/fjdisplay.py
@@ -0,0 +1,43 @@
+#!/usr/bin/env python
+
+import re
+import sys
+import subprocess
+
+usage = """fjdisplay.py name-of-firejail
+returns the display in the form of ':NNN'
+"""
+
+def getfirejails():
+    output = subprocess.check_output(['firemon','--x11'])
+    firejails = {}
+    name = ''
+    for line in output.split('\n'):
+        namematch = re.search('--name=(\w+\S*)',line)
+        if namematch:
+          name = namematch.group(1)
+        displaymatch = re.search('DISPLAY (:\d+)',line) 
+        if displaymatch:
+          firejails[name] = displaymatch.group(1)
+    return firejails
+
+def getdisplay(name):
+    firejails = getfirejails()
+    fjlist = '\n'.join(firejails.keys())
+    namere = re.compile('^'+name+'.*', re.MULTILINE)
+    matchingjails = namere.findall(fjlist)
+    if len(matchingjails) == 1:
+        return firejails[matchingjails[0]]
+    if len(matchingjails) == 0:
+        raise NameError("firejail {} does not exist".format(name))
+    else:
+        raise NameError("ambiguous firejail name")
+
+if __name__ == '__main__':
+    if '-h' in sys.argv or '--help' in sys.argv or len(sys.argv) > 2:
+        print(usage)
+        exit()
+    if len(sys.argv) == 1:
+        print(getfirejails())
+    if len(sys.argv) == 2:
+        print (getdisplay(sys.argv[1]))
\ No newline at end of file
diff --git a/contrib/fjresize.py b/contrib/fjresize.py
new file mode 100755
index 000000000..52b289159
--- /dev/null
+++ b/contrib/fjresize.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python
+
+import sys
+import fjdisplay
+import subprocess
+
+usage = """usage: fjresize.py firejail-name displaysize
+resize firejail xephyr windows.
+fjdisplay.py with no other arguments will list running named firejails with displays.
+fjresize.py with only a firejail name will list valid resolutions.
+names can be shortend as long its unambiguous.
+note: you may need to move the xephyr window for the resize to take effect
+example:
+    fjresize.py browser 1280x800
+"""
+
+
+if len(sys.argv) == 2:
+    out = subprocess.check_output(['xrandr','--display',fjdisplay.getdisplay(sys.argv[1])])
+    print(out)
+elif len(sys.argv) == 3: 
+    out = subprocess.check_output(['xrandr','--display',fjdisplay.getdisplay(sys.argv[1]),'--output','default','--mode',sys.argv[2]])
+    print(out)
+else:
+    print(usage)
\ No newline at end of file
diff --git a/contrib/update_deb.sh b/contrib/update_deb.sh
new file mode 100755
index 000000000..c2adffaf8
--- /dev/null
+++ b/contrib/update_deb.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Purpose: Fetch, compile, and install firejail from GitHub source. For 
+#                       Debian-based distros only (Ubuntu, Mint, etc).
+set -e 
+git clone --depth=1 https://www.github.com/netblue30/firejail.git
+cd firejail
+./configure --prefix=/usr
+make deb
+sudo dpkg -i firejail*.deb
+echo "Firejail was updated!"
+cd ..
+rm -rf firejail