diff options
Diffstat (limited to 'src/firejail/main.c')
-rw-r--r-- | src/firejail/main.c | 63 |
1 files changed, 51 insertions, 12 deletions
diff --git a/src/firejail/main.c b/src/firejail/main.c index 6f1e7531a..047d1a010 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -879,25 +879,35 @@ int main(int argc, char **argv) { | |||
879 | arg_quiet = 1; | 879 | arg_quiet = 1; |
880 | parent_sshd = 1; | 880 | parent_sshd = 1; |
881 | 881 | ||
882 | #if 0 | 882 | #ifdef DEBUG_RESTRICTED_SHELL |
883 | EUID_ROOT(); | 883 | {EUID_ROOT(); |
884 | FILE *fp = fopen("/mylog", "w"); | 884 | FILE *fp = fopen("/firelog", "w"); |
885 | if (fp) { | 885 | if (fp) { |
886 | int i; | 886 | int i; |
887 | for (i = 0; i < argc; i++) | 887 | fprintf(fp, "argc %d: ", argc); |
888 | fprintf(fp, "#%s# ", argv[i]); | 888 | for (i = 0; i < argc; i++) |
889 | fprintf(fp, "\n"); | 889 | fprintf(fp, "#%s# ", argv[i]); |
890 | fclose(fp); | 890 | fprintf(fp, "\n"); |
891 | } | 891 | fclose(fp); |
892 | EUID_USER(); | 892 | } |
893 | EUID_USER();} | ||
893 | #endif | 894 | #endif |
894 | |||
895 | // run sftp and scp directly without any sandboxing | 895 | // run sftp and scp directly without any sandboxing |
896 | // regular login has argv[0] == "-firejail" | 896 | // regular login has argv[0] == "-firejail" |
897 | if (*argv[0] != '-') { | 897 | if (*argv[0] != '-') { |
898 | if (strcmp(argv[1], "-c") == 0 && argc > 2) { | 898 | if (strcmp(argv[1], "-c") == 0 && argc > 2) { |
899 | if (strcmp(argv[2], "/usr/lib/openssh/sftp-server") == 0 || | 899 | if (strcmp(argv[2], "/usr/lib/openssh/sftp-server") == 0 || |
900 | strncmp(argv[2], "scp ", 4) == 0) { | 900 | strncmp(argv[2], "scp ", 4) == 0) { |
901 | #ifdef DEBUG_RESTRICTED_SHELL | ||
902 | {EUID_ROOT(); | ||
903 | FILE *fp = fopen("/firelog", "a"); | ||
904 | if (fp) { | ||
905 | fprintf(fp, "run without a sandbox\n"); | ||
906 | fclose(fp); | ||
907 | } | ||
908 | EUID_USER();} | ||
909 | #endif | ||
910 | |||
901 | drop_privs(1); | 911 | drop_privs(1); |
902 | run_no_sandbox(argc, argv); | 912 | run_no_sandbox(argc, argv); |
903 | } | 913 | } |
@@ -914,6 +924,21 @@ EUID_USER(); | |||
914 | login_shell = 1; | 924 | login_shell = 1; |
915 | fullargc = restricted_shell(cfg.username); | 925 | fullargc = restricted_shell(cfg.username); |
916 | if (fullargc) { | 926 | if (fullargc) { |
927 | |||
928 | #ifdef DEBUG_RESTRICTED_SHELL | ||
929 | {EUID_ROOT(); | ||
930 | FILE *fp = fopen("/firelog", "a"); | ||
931 | if (fp) { | ||
932 | fprintf(fp, "fullargc %d: ", fullargc); | ||
933 | int i; | ||
934 | for (i = 0; i < fullargc; i++) | ||
935 | fprintf(fp, "#%s# ", fullargv[i]); | ||
936 | fprintf(fp, "\n"); | ||
937 | fclose(fp); | ||
938 | } | ||
939 | EUID_USER();} | ||
940 | #endif | ||
941 | |||
917 | int j; | 942 | int j; |
918 | for (i = 1, j = fullargc; i < argc && j < MAX_ARGS; i++, j++, fullargc++) | 943 | for (i = 1, j = fullargc; i < argc && j < MAX_ARGS; i++, j++, fullargc++) |
919 | fullargv[j] = argv[i]; | 944 | fullargv[j] = argv[i]; |
@@ -921,6 +946,20 @@ EUID_USER(); | |||
921 | // replace argc/argv with fullargc/fullargv | 946 | // replace argc/argv with fullargc/fullargv |
922 | argv = fullargv; | 947 | argv = fullargv; |
923 | argc = j; | 948 | argc = j; |
949 | |||
950 | #ifdef DEBUG_RESTRICTED_SHELL | ||
951 | {EUID_ROOT(); | ||
952 | FILE *fp = fopen("/firelog", "a"); | ||
953 | if (fp) { | ||
954 | fprintf(fp, "argc %d: ", argc); | ||
955 | int i; | ||
956 | for (i = 0; i < argc; i++) | ||
957 | fprintf(fp, "#%s# ", argv[i]); | ||
958 | fprintf(fp, "\n"); | ||
959 | fclose(fp); | ||
960 | } | ||
961 | EUID_USER();} | ||
962 | #endif | ||
924 | } | 963 | } |
925 | } | 964 | } |
926 | else { | 965 | else { |