1 files changed, 42 insertions, 104 deletions

diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 7e18840fd..80329d5ba 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -21,20 +21,13 @@
 #include <sys/mount.h>
 #include <sys/stat.h>
 #include <sys/types.h>
-#include <sys/wait.h>
 #include <unistd.h>
 
 // return 0 if file not found, 1 if found
-static int check_dir_or_file(const char *name) {
-        assert(name);
-        invalid_filename(name);
+static int check_dir_or_file(const char *fname) {
+        assert(fname);
 
         struct stat s;
-        char *fname;
-        if (asprintf(&fname, "/etc/%s", name) == -1)
-                errExit("asprintf");
-        if (arg_debug)
-                printf("Checking %s\n", fname);         
         if (stat(fname, &s) == -1) {
                 if (arg_debug)
                         printf("Warning: file %s not found.\n", fname);
@@ -46,78 +39,46 @@ static int check_dir_or_file(const char *name) {
                 goto errexit;
 
         // dir or regular file
-        if (S_ISDIR(s.st_mode) || S_ISREG(s.st_mode)) {
-                free(fname);
-                return 1;
-        }
-
-        if (!is_link(fname)) {
-                free(fname);
-                return 1;
-        }
-        
+        if (S_ISDIR(s.st_mode) || S_ISREG(s.st_mode) || !is_link(fname))
+                return 1;       // normal exit
 
 errexit:        
         fprintf(stderr, "Error: invalid file type, %s.\n", fname);
         exit(1);
 }
 
-void fs_check_etc_list(void) {
-        EUID_ASSERT();
-        if (strstr(cfg.etc_private_keep, "..")) {
-                fprintf(stderr, "Error: invalid private etc list\n");
+static void duplicate(char *fname) {
+        if (*fname == '~' || *fname == '/' || strstr(fname, "..")) {
+                fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
-        
-        char *dlist = strdup(cfg.etc_private_keep);
-        if (!dlist)
-                errExit("strdup");
-        
-        // build a new list only with the files found
-        char *newlist = malloc(strlen(cfg.etc_private_keep) + 1);
-        if (!newlist)
-                errExit("malloc");
-        *newlist = '\0';
-
-        char *ptr = strtok(dlist, ",");
-        if (check_dir_or_file(ptr))
-                strcat(newlist, ptr);
-        while ((ptr = strtok(NULL, ",")) != NULL) {
-                if (check_dir_or_file(ptr)) {
-                        strcat(newlist, ",");
-                        strcat(newlist, ptr);
-                }
+        invalid_filename(fname);
+
+        char *src;
+        if (asprintf(&src,  "/etc/%s", fname) == -1)
+                errExit("asprintf");
+        if (check_dir_or_file(src) == 0) {
+                if (!arg_quiet)
+                        fprintf(stderr, "Warning: skipping %s for private bin\n", fname);
+                free(src);
+                return;
         }
-        cfg.etc_private_keep = newlist;
-        
-        free(dlist);
-}
 
-static void duplicate(char *fname) {
-        // copy the file
-        if (arg_debug)
-                printf("running: %s -a --parents /etc/%s %s\n", RUN_CP_COMMAND, fname, RUN_MNT_DIR);
-
-        pid_t child = fork();
-        if (child < 0)
-                errExit("fork");
-        if (child == 0) {
-                char *f;
-                if (asprintf(&f, "/etc/%s", fname) == -1)
+        struct stat s;
+        if (stat(src, &s) == 0 && S_ISDIR(s.st_mode)) {
+                // create the directory in RUN_ETC_DIR
+                char *dirname;
+                if (asprintf(&dirname, "%s/%s", RUN_ETC_DIR, fname) == -1)
                         errExit("asprintf");
-                clearenv();     
-                execlp(RUN_CP_COMMAND, RUN_CP_COMMAND, "-a", "--parents", f, RUN_MNT_DIR, NULL);
-                perror("execlp");
-                _exit(1);
+                create_empty_dir_as_root(dirname, s.st_mode);
+                sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, src, dirname);
+                free(dirname);
         }
-        // wait for the child to finish
-        waitpid(child, NULL, 0);
+        else
+                sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, src, RUN_ETC_DIR);
 
-        char *name;
-        if (asprintf(&name, "/etc/%s", fname) == -1)
-                errExit("asprintf");
-        fs_logger2("clone", name);
-        free(name);
+        fs_logger2("clone", src);
+        free(src);
 }
 
 
@@ -125,12 +86,6 @@ void fs_private_etc_list(void) {
         char *private_list = cfg.etc_private_keep;
         assert(private_list);
         
-        struct stat s;
-        if (stat("/etc", &s) == -1) {
-                fprintf(stderr, "Error: cannot find user /etc directory\n");
-                exit(1);
-        }
-
         // create /run/firejail/mnt/etc directory
         mkdir_attr(RUN_ETC_DIR, 0755, 0, 0);
         fs_logger("tmpfs /etc");
@@ -141,39 +96,22 @@ void fs_private_etc_list(void) {
         // copy the list of files in the new etc directory
         // using a new child process with root privileges
         if (*private_list != '\0') {
-                pid_t child = fork();
-                if (child < 0)
-                        errExit("fork");
-                if (child == 0) {
-                        if (arg_debug)
-                                printf("Copying files in the new etc directory:\n");
+                if (arg_debug)
+                        printf("Copying files in the new etc directory:\n");
+
+                // copy the list of files in the new home directory
+                char *dlist = strdup(private_list);
+                if (!dlist)
+                        errExit("strdup");
         
-                        // elevate privileges - files in the new /etc directory belong to root
-                        if (setreuid(0, 0) < 0)
-                                errExit("setreuid");
-                        if (setregid(0, 0) < 0)
-                                errExit("setregid");
-                        
-                        // copy the list of files in the new home directory
-                        char *dlist = strdup(private_list);
-                        if (!dlist)
-                                errExit("strdup");
-                
+
+                char *ptr = strtok(dlist, ",");
+                duplicate(ptr);
         
-                        char *ptr = strtok(dlist, ",");
+                while ((ptr = strtok(NULL, ",")) != NULL)
                         duplicate(ptr);
-                
-                        while ((ptr = strtok(NULL, ",")) != NULL)
-                                duplicate(ptr);
-                        free(dlist);    
-                        fs_logger_print();
-#ifdef HAVE_GCOV
-                        __gcov_flush();
-#endif
-                        _exit(0);
-                }
-                // wait for the child to finish
-                waitpid(child, NULL, 0);
+                free(dlist);    
+                fs_logger_print();
         }
         
         if (arg_debug)