diff options
Diffstat (limited to 'src/firejail/main.c')
-rw-r--r-- | src/firejail/main.c | 78 |
1 files changed, 40 insertions, 38 deletions
diff --git a/src/firejail/main.c b/src/firejail/main.c index 7a9d3d00d..ac84f00c9 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -47,12 +47,12 @@ | |||
47 | #endif | 47 | #endif |
48 | 48 | ||
49 | #ifdef __ia64__ | 49 | #ifdef __ia64__ |
50 | /* clone(2) has a different interface on ia64, as it needs to know | 50 | /* clone(2) has a different interface on ia64, as it needs to know the size of |
51 | the size of the stack */ | 51 | * the stack */ |
52 | int __clone2(int (*fn)(void *), | 52 | int __clone2(int (*fn)(void *), |
53 | void *child_stack_base, size_t stack_size, | 53 | void *child_stack_base, size_t stack_size, |
54 | int flags, void *arg, ... | 54 | int flags, void *arg, ... |
55 | /* pid_t *ptid, struct user_desc *tls, pid_t *ctid */ ); | 55 | /* pid_t *ptid, struct user_desc *tls, pid_t *ctid */ ); |
56 | #endif | 56 | #endif |
57 | 57 | ||
58 | uid_t firejail_uid = 0; | 58 | uid_t firejail_uid = 0; |
@@ -106,7 +106,7 @@ char *arg_netfilter6_file = NULL; // netfilter6 file | |||
106 | char *arg_netns = NULL; // "ip netns"-created network namespace to use | 106 | char *arg_netns = NULL; // "ip netns"-created network namespace to use |
107 | int arg_doubledash = 0; // double dash | 107 | int arg_doubledash = 0; // double dash |
108 | int arg_private_dev = 0; // private dev directory | 108 | int arg_private_dev = 0; // private dev directory |
109 | int arg_keep_dev_shm = 0; // preserve /dev/shm | 109 | int arg_keep_dev_shm = 0; // preserve /dev/shm |
110 | int arg_private_etc = 0; // private etc directory | 110 | int arg_private_etc = 0; // private etc directory |
111 | int arg_private_opt = 0; // private opt directory | 111 | int arg_private_opt = 0; // private opt directory |
112 | int arg_private_srv = 0; // private srv directory | 112 | int arg_private_srv = 0; // private srv directory |
@@ -129,7 +129,7 @@ int arg_writable_etc = 0; // writable etc | |||
129 | int arg_keep_config_pulse = 0; // disable automatic ~/.config/pulse init | 129 | int arg_keep_config_pulse = 0; // disable automatic ~/.config/pulse init |
130 | int arg_keep_shell_rc = 0; // do not copy shell configuration from /etc/skel | 130 | int arg_keep_shell_rc = 0; // do not copy shell configuration from /etc/skel |
131 | int arg_writable_var = 0; // writable var | 131 | int arg_writable_var = 0; // writable var |
132 | int arg_keep_var_tmp = 0; // don't overwrite /var/tmp | 132 | int arg_keep_var_tmp = 0; // don't overwrite /var/tmp |
133 | int arg_writable_run_user = 0; // writable /run/user | 133 | int arg_writable_run_user = 0; // writable /run/user |
134 | int arg_writable_var_log = 0; // writable /var/log | 134 | int arg_writable_var_log = 0; // writable /var/log |
135 | int arg_appimage = 0; // appimage | 135 | int arg_appimage = 0; // appimage |
@@ -141,7 +141,7 @@ int arg_x11_block = 0; // block X11 | |||
141 | int arg_x11_xorg = 0; // use X11 security extension | 141 | int arg_x11_xorg = 0; // use X11 security extension |
142 | int arg_allusers = 0; // all user home directories visible | 142 | int arg_allusers = 0; // all user home directories visible |
143 | int arg_machineid = 0; // spoof /etc/machine-id | 143 | int arg_machineid = 0; // spoof /etc/machine-id |
144 | int arg_allow_private_blacklist = 0; // blacklist things in private directories | 144 | int arg_allow_private_blacklist = 0; // blacklist things in private directories |
145 | int arg_disable_mnt = 0; // disable /mnt and /media | 145 | int arg_disable_mnt = 0; // disable /mnt and /media |
146 | int arg_noprofile = 0; // use default.profile if none other found/specified | 146 | int arg_noprofile = 0; // use default.profile if none other found/specified |
147 | int arg_memory_deny_write_execute = 0; // block writable and executable memory | 147 | int arg_memory_deny_write_execute = 0; // block writable and executable memory |
@@ -150,7 +150,7 @@ int arg_nodvd = 0; // --nodvd | |||
150 | int arg_nou2f = 0; // --nou2f | 150 | int arg_nou2f = 0; // --nou2f |
151 | int arg_noinput = 0; // --noinput | 151 | int arg_noinput = 0; // --noinput |
152 | int arg_deterministic_exit_code = 0; // always exit with first child's exit status | 152 | int arg_deterministic_exit_code = 0; // always exit with first child's exit status |
153 | int arg_deterministic_shutdown = 0; // shut down the sandbox if first child dies | 153 | int arg_deterministic_shutdown = 0; // shut down the sandbox if first child dies |
154 | int arg_keep_fd_all = 0; // inherit all file descriptors to sandbox | 154 | int arg_keep_fd_all = 0; // inherit all file descriptors to sandbox |
155 | DbusPolicy arg_dbus_user = DBUS_POLICY_ALLOW; // --dbus-user | 155 | DbusPolicy arg_dbus_user = DBUS_POLICY_ALLOW; // --dbus-user |
156 | DbusPolicy arg_dbus_system = DBUS_POLICY_ALLOW; // --dbus-system | 156 | DbusPolicy arg_dbus_system = DBUS_POLICY_ALLOW; // --dbus-system |
@@ -768,11 +768,11 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
768 | exit(1); | 768 | exit(1); |
769 | } | 769 | } |
770 | char *path = argv[i + 1]; | 770 | char *path = argv[i + 1]; |
771 | invalid_filename(path, 0); // no globbing | 771 | invalid_filename(path, 0); // no globbing |
772 | if (strstr(path, "..")) { | 772 | if (strstr(path, "..")) { |
773 | fprintf(stderr, "Error: invalid file name %s\n", path); | 773 | fprintf(stderr, "Error: invalid file name %s\n", path); |
774 | exit(1); | 774 | exit(1); |
775 | } | 775 | } |
776 | 776 | ||
777 | // get file | 777 | // get file |
778 | pid_t pid = require_pid(argv[i] + 6); | 778 | pid_t pid = require_pid(argv[i] + 6); |
@@ -796,17 +796,17 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
796 | exit(1); | 796 | exit(1); |
797 | } | 797 | } |
798 | char *path1 = argv[i + 1]; | 798 | char *path1 = argv[i + 1]; |
799 | invalid_filename(path1, 0); // no globbing | 799 | invalid_filename(path1, 0); // no globbing |
800 | if (strstr(path1, "..")) { | 800 | if (strstr(path1, "..")) { |
801 | fprintf(stderr, "Error: invalid file name %s\n", path1); | 801 | fprintf(stderr, "Error: invalid file name %s\n", path1); |
802 | exit(1); | 802 | exit(1); |
803 | } | 803 | } |
804 | char *path2 = argv[i + 2]; | 804 | char *path2 = argv[i + 2]; |
805 | invalid_filename(path2, 0); // no globbing | 805 | invalid_filename(path2, 0); // no globbing |
806 | if (strstr(path2, "..")) { | 806 | if (strstr(path2, "..")) { |
807 | fprintf(stderr, "Error: invalid file name %s\n", path2); | 807 | fprintf(stderr, "Error: invalid file name %s\n", path2); |
808 | exit(1); | 808 | exit(1); |
809 | } | 809 | } |
810 | 810 | ||
811 | // get file | 811 | // get file |
812 | pid_t pid = require_pid(argv[i] + 6); | 812 | pid_t pid = require_pid(argv[i] + 6); |
@@ -830,15 +830,15 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
830 | exit(1); | 830 | exit(1); |
831 | } | 831 | } |
832 | char *path = argv[i + 1]; | 832 | char *path = argv[i + 1]; |
833 | invalid_filename(path, 0); // no globbing | 833 | invalid_filename(path, 0); // no globbing |
834 | if (strstr(path, "..")) { | 834 | if (strstr(path, "..")) { |
835 | fprintf(stderr, "Error: invalid file name %s\n", path); | 835 | fprintf(stderr, "Error: invalid file name %s\n", path); |
836 | exit(1); | 836 | exit(1); |
837 | } | 837 | } |
838 | 838 | ||
839 | // list directory contents | 839 | // list directory contents |
840 | if (!arg_debug) | 840 | if (!arg_debug) |
841 | arg_quiet = 1; | 841 | arg_quiet = 1; |
842 | pid_t pid = require_pid(argv[i] + 5); | 842 | pid_t pid = require_pid(argv[i] + 5); |
843 | sandboxfs(SANDBOX_FS_LS, pid, path, NULL); | 843 | sandboxfs(SANDBOX_FS_LS, pid, path, NULL); |
844 | exit(0); | 844 | exit(0); |
@@ -867,7 +867,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
867 | 867 | ||
868 | // write file contents to stdout | 868 | // write file contents to stdout |
869 | if (!arg_debug) | 869 | if (!arg_debug) |
870 | arg_quiet = 1; | 870 | arg_quiet = 1; |
871 | pid_t pid = require_pid(argv[i] + 6); | 871 | pid_t pid = require_pid(argv[i] + 6); |
872 | sandboxfs(SANDBOX_FS_CAT, pid, path, NULL); | 872 | sandboxfs(SANDBOX_FS_CAT, pid, path, NULL); |
873 | exit(0); | 873 | exit(0); |
@@ -894,8 +894,8 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
894 | 894 | ||
895 | } | 895 | } |
896 | else if (strncmp(argv[i], "--join-or-start=", 16) == 0) { | 896 | else if (strncmp(argv[i], "--join-or-start=", 16) == 0) { |
897 | // NOTE: this is first part of option handler, | 897 | // Note: This is the first part of the option handler; the |
898 | // sandbox name is set in other part | 898 | // sandbox name is set in the other part |
899 | if (checkcfg(CFG_JOIN) || getuid() == 0) { | 899 | if (checkcfg(CFG_JOIN) || getuid() == 0) { |
900 | logargs(argc, argv); | 900 | logargs(argc, argv); |
901 | 901 | ||
@@ -1050,11 +1050,11 @@ static int check_postexec(const char *list) { | |||
1050 | //******************************************* | 1050 | //******************************************* |
1051 | int main(int argc, char **argv, char **envp) { | 1051 | int main(int argc, char **argv, char **envp) { |
1052 | int i; | 1052 | int i; |
1053 | int prog_index = -1; // index in argv where the program command starts | 1053 | int prog_index = -1; // index in argv where the program command starts |
1054 | int lockfd_network = -1; | 1054 | int lockfd_network = -1; |
1055 | int lockfd_directory = -1; | 1055 | int lockfd_directory = -1; |
1056 | int custom_profile = 0; // custom profile loaded | 1056 | int custom_profile = 0; // custom profile loaded |
1057 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) | 1057 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) |
1058 | char **ptr; | 1058 | char **ptr; |
1059 | 1059 | ||
1060 | 1060 | ||
@@ -1080,7 +1080,8 @@ int main(int argc, char **argv, char **envp) { | |||
1080 | // sanity check for arguments | 1080 | // sanity check for arguments |
1081 | for (i = 0; i < argc; i++) { | 1081 | for (i = 0; i < argc; i++) { |
1082 | if (strlen(argv[i]) >= MAX_ARG_LEN) { | 1082 | if (strlen(argv[i]) >= MAX_ARG_LEN) { |
1083 | fprintf(stderr, "Error: too long arguments: argv[%d] len (%zu) >= MAX_ARG_LEN (%d)\n", i, strlen(argv[i]), MAX_ARG_LEN); | 1083 | fprintf(stderr, "Error: too long argument: argv[%d] len (%zu) >= MAX_ARG_LEN (%d): %s\n", |
1084 | i, strlen(argv[i]), MAX_ARG_LEN, argv[i]); | ||
1084 | exit(1); | 1085 | exit(1); |
1085 | } | 1086 | } |
1086 | } | 1087 | } |
@@ -1983,7 +1984,7 @@ int main(int argc, char **argv, char **envp) { | |||
1983 | arg_writable_var = 1; | 1984 | arg_writable_var = 1; |
1984 | } | 1985 | } |
1985 | else if (strcmp(argv[i], "--keep-var-tmp") == 0) { | 1986 | else if (strcmp(argv[i], "--keep-var-tmp") == 0) { |
1986 | arg_keep_var_tmp = 1; | 1987 | arg_keep_var_tmp = 1; |
1987 | } | 1988 | } |
1988 | else if (strcmp(argv[i], "--writable-run-user") == 0) { | 1989 | else if (strcmp(argv[i], "--writable-run-user") == 0) { |
1989 | arg_writable_run_user = 1; | 1990 | arg_writable_run_user = 1; |
@@ -2818,8 +2819,9 @@ int main(int argc, char **argv, char **envp) { | |||
2818 | } | 2819 | } |
2819 | #endif | 2820 | #endif |
2820 | else if (strncmp(argv[i], "--join-or-start=", 16) == 0) { | 2821 | else if (strncmp(argv[i], "--join-or-start=", 16) == 0) { |
2821 | // NOTE: this is second part of option handler, | 2822 | // Note: This is the second part of the option handler; |
2822 | // atempt to find and join sandbox is done in other one | 2823 | // the attempt to find and join the sandbox is done in |
2824 | // the other one | ||
2823 | 2825 | ||
2824 | // set sandbox name and start normally | 2826 | // set sandbox name and start normally |
2825 | cfg.name = argv[i] + 16; | 2827 | cfg.name = argv[i] + 16; |