diff options
Diffstat (limited to 'src/firejail/fs_var.c')
-rw-r--r-- | src/firejail/fs_var.c | 26 |
1 files changed, 14 insertions, 12 deletions
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c index f07581cd8..9523875d7 100644 --- a/src/firejail/fs_var.c +++ b/src/firejail/fs_var.c | |||
@@ -1,5 +1,5 @@ | |||
1 | /* | 1 | /* |
2 | * Copyright (C) 2014-2021 Firejail Authors | 2 | * Copyright (C) 2014-2022 Firejail Authors |
3 | * | 3 | * |
4 | * This file is part of firejail project | 4 | * This file is part of firejail project |
5 | * | 5 | * |
@@ -20,7 +20,6 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | 21 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 22 | #include <sys/stat.h> |
23 | #include <linux/limits.h> | ||
24 | #include <glob.h> | 23 | #include <glob.h> |
25 | #include <dirent.h> | 24 | #include <dirent.h> |
26 | #include <fcntl.h> | 25 | #include <fcntl.h> |
@@ -127,17 +126,17 @@ void fs_var_log(void) { | |||
127 | 126 | ||
128 | // create an empty /var/log/wtmp file | 127 | // create an empty /var/log/wtmp file |
129 | /* coverity[toctou] */ | 128 | /* coverity[toctou] */ |
130 | FILE *fp = fopen("/var/log/wtmp", "w"); | 129 | FILE *fp = fopen("/var/log/wtmp", "wxe"); |
131 | if (fp) { | 130 | if (fp) { |
132 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH); | 131 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH); |
133 | fclose(fp); | 132 | fclose(fp); |
134 | } | 133 | } |
135 | fs_logger("touch /var/log/wtmp"); | 134 | fs_logger("touch /var/log/wtmp"); |
136 | 135 | ||
137 | // create an empty /var/log/btmp file | 136 | // create an empty /var/log/btmp file |
138 | fp = fopen("/var/log/btmp", "w"); | 137 | fp = fopen("/var/log/btmp", "wxe"); |
139 | if (fp) { | 138 | if (fp) { |
140 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP); | 139 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP); |
141 | fclose(fp); | 140 | fclose(fp); |
142 | } | 141 | } |
143 | fs_logger("touch /var/log/btmp"); | 142 | fs_logger("touch /var/log/btmp"); |
@@ -158,8 +157,7 @@ void fs_var_lib(void) { | |||
158 | fs_logger("tmpfs /var/lib/dhcp"); | 157 | fs_logger("tmpfs /var/lib/dhcp"); |
159 | 158 | ||
160 | // isc dhcp server requires a /var/lib/dhcp/dhcpd.leases file | 159 | // isc dhcp server requires a /var/lib/dhcp/dhcpd.leases file |
161 | FILE *fp = fopen("/var/lib/dhcp/dhcpd.leases", "w"); | 160 | FILE *fp = fopen("/var/lib/dhcp/dhcpd.leases", "wxe"); |
162 | |||
163 | if (fp) { | 161 | if (fp) { |
164 | fprintf(fp, "\n"); | 162 | fprintf(fp, "\n"); |
165 | SET_PERMS_STREAM(fp, 0, 0, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH); | 163 | SET_PERMS_STREAM(fp, 0, 0, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH); |
@@ -287,7 +285,7 @@ void fs_var_utmp(void) { | |||
287 | if (stat(UTMP_FILE, &s) == 0) | 285 | if (stat(UTMP_FILE, &s) == 0) |
288 | utmp_group = s.st_gid; | 286 | utmp_group = s.st_gid; |
289 | else { | 287 | else { |
290 | fwarning("cannot find /var/run/utmp\n"); | 288 | fwarning("cannot find %s\n", UTMP_FILE); |
291 | return; | 289 | return; |
292 | } | 290 | } |
293 | 291 | ||
@@ -296,7 +294,7 @@ void fs_var_utmp(void) { | |||
296 | printf("Create the new utmp file\n"); | 294 | printf("Create the new utmp file\n"); |
297 | 295 | ||
298 | /* coverity[toctou] */ | 296 | /* coverity[toctou] */ |
299 | FILE *fp = fopen(RUN_UTMP_FILE, "w"); | 297 | FILE *fp = fopen(RUN_UTMP_FILE, "we"); |
300 | if (!fp) | 298 | if (!fp) |
301 | errExit("fopen"); | 299 | errExit("fopen"); |
302 | 300 | ||
@@ -315,7 +313,7 @@ void fs_var_utmp(void) { | |||
315 | // save new utmp file | 313 | // save new utmp file |
316 | int rv = fwrite(&u_boot, sizeof(u_boot), 1, fp); | 314 | int rv = fwrite(&u_boot, sizeof(u_boot), 1, fp); |
317 | (void) rv; | 315 | (void) rv; |
318 | SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH); | 316 | SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH); |
319 | fclose(fp); | 317 | fclose(fp); |
320 | 318 | ||
321 | // mount the new utmp file | 319 | // mount the new utmp file |
@@ -323,5 +321,9 @@ void fs_var_utmp(void) { | |||
323 | printf("Mount the new utmp file\n"); | 321 | printf("Mount the new utmp file\n"); |
324 | if (mount(RUN_UTMP_FILE, UTMP_FILE, NULL, MS_BIND|MS_NOSUID|MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0) | 322 | if (mount(RUN_UTMP_FILE, UTMP_FILE, NULL, MS_BIND|MS_NOSUID|MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0) |
325 | errExit("mount bind utmp"); | 323 | errExit("mount bind utmp"); |
326 | fs_logger("create /var/run/utmp"); | 324 | fs_logger2("create", UTMP_FILE); |
325 | |||
326 | // blacklist RUN_UTMP_FILE | ||
327 | if (mount(RUN_RO_FILE, RUN_UTMP_FILE, NULL, MS_BIND, "mode=400,gid=0") < 0) | ||
328 | errExit("mount bind"); | ||
327 | } | 329 | } |