1 files changed, 79 insertions, 38 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index 2ae3213ee..6fd011868 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -85,13 +85,14 @@ int arg_shell_none = 0;			// run the program directly without a shell
 int arg_private_dev = 0;                        // private dev directory
 int arg_private_etc = 0;                        // private etc directory
 int arg_private_bin = 0;                        // private bin directory
+int arg_private_tmp = 0;                        // private tmp directory
 int arg_scan = 0;                               // arp-scan all interfaces
 int arg_whitelist = 0;                          // whitelist commad
 int arg_nosound = 0;                            // disable sound
 int arg_quiet = 0;                              // no output for scripting
 int arg_join_network = 0;                       // join only the network namespace
 int arg_join_filesystem = 0;                    // join only the mount namespace
-
+int arg_nice = 0;                               // nice value configured
 
 int parent_to_child_fds[2];
 int child_to_parent_fds[2];
@@ -107,7 +108,7 @@ static void myexit(int rv) {
                 printf("\nparent is shutting down, bye...\n");
         
         // delete sandbox files in shared memory
-        bandwidth_shm_del_file(sandbox_pid);            // bandwidht file
+        bandwidth_shm_del_file(sandbox_pid);            // bandwidth file
         network_shm_del_file(sandbox_pid);              // network map file
         
         exit(rv); 
@@ -208,7 +209,7 @@ static void check_network(Bridge *br) {
         }
 }
 
-
+#ifdef HAVE_USERNS
 void check_user_namespace(void) {
         if (getuid() == 0) {
                 fprintf(stderr, "Error: --noroot option cannot be used when starting the sandbox as root.\n");
@@ -228,6 +229,7 @@ void check_user_namespace(void) {
                 arg_noroot = 0;
         }
 }
+#endif
 
 // exit commands
 static void run_cmd_and_exit(int i, int argc, char **argv) {
@@ -241,8 +243,24 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
         }
         else if (strcmp(argv[i], "--version") == 0) {
                 printf("firejail version %s\n", VERSION);
+#ifndef HAVE_NETWORK
+                printf("Networking support is disabled.\n");
+#endif
+#ifndef HAVE_USERNS
+                printf("User namespace support is disabled.\n");
+#endif
+#ifndef HAVE_SECCOMP
+                printf("Seccomp-bpf support is disabled.\n");
+#endif
+#ifndef HAVE_BIND
+                printf("Bind support is disabled.\n");
+#endif
+#ifndef HAVE_CHROOT
+                printf("Chroot support is disabled.\n");
+#endif
                 exit(0);
         }
+#ifdef HAVE_NETWORK     
         else if (strncmp(argv[i], "--bandwidth=", 12) == 0) {
                 logargs(argc, argv);
                 
@@ -300,10 +318,10 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 if (read_pid(argv[i] + 12, &pid) == 0)
                         bandwidth_pid(pid, cmd, dev, down, up);
                 else
-                                bandwidth_name(argv[i] + 12, cmd, dev, down, up);
+                        bandwidth_name(argv[i] + 12, cmd, dev, down, up);
                 exit(0);
         }
-
+#endif
         //*************************************
         // independent commands - the program will exit!
         //*************************************
@@ -382,10 +400,12 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 top();
                 exit(0);
         }
+#ifdef HAVE_NETWORK     
         else if (strcmp(argv[i], "--netstats") == 0) {
                 netstats();
                 exit(0);
         }
+#endif  
         else if (strncmp(argv[i], "--join=", 7) == 0) {
                 logargs(argc, argv);
                 
@@ -397,6 +417,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                         join_name(argv[i] + 7, cfg.homedir, argc, argv, i + 1);
                 exit(0);
         }
+#ifdef HAVE_NETWORK     
         else if (strncmp(argv[i], "--join-network=", 15) == 0) {
                 logargs(argc, argv);
                 arg_join_network = 1;
@@ -413,6 +434,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                         join_name(argv[i] + 15, cfg.homedir, argc, argv, i + 1);
                 exit(0);
         }
+#endif
         else if (strncmp(argv[i], "--join-filesystem=", 18) == 0) {
                 logargs(argc, argv);
                 arg_join_filesystem = 1;
@@ -459,8 +481,9 @@ int main(int argc, char **argv) {
         int highest_errno = errno_highest_nr();
 #endif
 
-        // check argv[0] symlink wrapper
-        run_symlink(argc, argv);
+        // check argv[0] symlink wrapper if this is not a login shell
+        if (*argv[0] != '-')
+                run_symlink(argc, argv);
 
 
         // check if we already have a sandbox running
@@ -514,6 +537,7 @@ int main(int argc, char **argv) {
         else {
                 // check --output option and execute it;
                 check_output(argc, argv); // the function will not return if --output option was found
+                check_user(argc, argv); // the function will not return if --user option was found
         }
         
         // parse arguments
@@ -669,6 +693,10 @@ int main(int argc, char **argv) {
                         arg_ipc = 1;
                 else if (strncmp(argv[i], "--cpu=", 6) == 0)
                         read_cpu_list(argv[i] + 6);
+                else if (strncmp(argv[i], "--nice=", 7) == 0) {
+                        cfg.nice = atoi(argv[i] + 7);
+                        arg_nice = 1;
+                }
                 else if (strncmp(argv[i], "--cgroup=", 9) == 0) {
                         if (arg_cgroup) {
                                 fprintf(stderr, "Error: only a cgroup can be defined\n");
@@ -750,13 +778,18 @@ int main(int argc, char **argv) {
                         struct stat s;
                         if (stat(dirname, &s) == -1) {
                                 /* coverity[toctou] */
-                                if (mkdir(dirname, S_IRWXU | S_IRWXG | S_IRWXO))
+                                if (mkdir(dirname, 0700))
                                         errExit("mkdir");
                                 if (chown(dirname, getuid(), getgid()) < 0)
                                         errExit("chown");
-                                if (chmod(dirname, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) < 0)
+                                if (chmod(dirname, 0700) < 0)
                                         errExit("chmod");
                         }
+                        else if (is_link(dirname)) {
+                                fprintf(stderr, "Error: invalid ~/.firejail directory\n");
+                                exit(1);
+                        }
+                        
                         free(dirname);
                         
                         // check overlay directory
@@ -882,11 +915,6 @@ int main(int argc, char **argv) {
                 else if (strcmp(argv[i], "--private") == 0)
                         arg_private = 1;
                 else if (strncmp(argv[i], "--private=", 10) == 0) {
-                        if (cfg.home_private_keep) {
-                                fprintf(stderr, "Error: a private list of files was already defined with --private-home option.\n");
-                                exit(1);
-                        }
-                        
                         // extract private home dirname
                         cfg.home_private = argv[i] + 10;
                         if (*cfg.home_private == '\0') {
@@ -896,26 +924,11 @@ int main(int argc, char **argv) {
                         fs_check_private_dir();
                         arg_private = 1;
                 }
-                else if (strncmp(argv[i], "--private-home=", 15) == 0) {
-                        if (cfg.home_private) {
-                                fprintf(stderr, "Error: a private home directory was already defined with --private option.\n");
-                                exit(1);
-                        }
-                        
-                        // extract private home dirname
-                        cfg.home_private_keep = argv[i] + 15;
-                        if (*cfg.home_private_keep == '\0') {
-                                fprintf(stderr, "Error: invalid private-home option\n");
-                                exit(1);
-                        }
-                        fs_check_home_list();
-                        arg_private = 1;
-                }
                 else if (strcmp(argv[i], "--private-dev") == 0) {
                         arg_private_dev = 1;
                 }
                 else if (strncmp(argv[i], "--private-etc=", 14) == 0) {
-                        // extract private etc dirname
+                        // extract private etc list
                         cfg.etc_private_keep = argv[i] + 14;
                         if (*cfg.etc_private_keep == '\0') {
                                 fprintf(stderr, "Error: invalid private-etc option\n");
@@ -930,7 +943,7 @@ int main(int argc, char **argv) {
                         }
                 }
                 else if (strncmp(argv[i], "--private-bin=", 14) == 0) {
-                        // extract private etc dirname
+                        // extract private bin list
                         cfg.bin_private_keep = argv[i] + 14;
                         if (*cfg.bin_private_keep == '\0') {
                                 fprintf(stderr, "Error: invalid private-bin option\n");
@@ -939,8 +952,9 @@ int main(int argc, char **argv) {
                         fs_check_bin_list();
                         arg_private_bin = 1;
                 }
-                        
-
+                else if (strcmp(argv[i], "--private-tmp") == 0) {
+                        arg_private_tmp = 1;
+                }
 
                 //*************************************
                 // hostname, etc
@@ -961,9 +975,11 @@ int main(int argc, char **argv) {
                 }
                 else if (strcmp(argv[i], "--nogroups") == 0)
                         arg_nogroups = 1;
+#ifdef HAVE_USERNS
                 else if (strcmp(argv[i], "--noroot") == 0) {
                         check_user_namespace();
                 }
+#endif
                 else if (strncmp(argv[i], "--env=", 6) == 0)
                         env_store(argv[i] + 6);
                 else if (strncmp(argv[i], "--nosound", 9) == 0) {
@@ -974,6 +990,7 @@ int main(int argc, char **argv) {
                 //*************************************
                 // network
                 //*************************************
+#ifdef HAVE_NETWORK     
                 else if (strncmp(argv[i], "--interface=", 12) == 0) {
                         // checks
                         if (arg_nonetwork) {
@@ -1163,6 +1180,7 @@ int main(int argc, char **argv) {
                                 return 1;
                         }
                 }
+#endif          
                 else if (strncmp(argv[i], "--dns=", 6) == 0) {
                         uint32_t dns;
                         if (atoip(argv[i] + 6, &dns)) {
@@ -1181,6 +1199,7 @@ int main(int argc, char **argv) {
                                 return 1;
                         }
                 }
+#ifdef HAVE_NETWORK
                 else if (strcmp(argv[i], "--netfilter") == 0)
                         arg_netfilter = 1;
                 else if (strncmp(argv[i], "--netfilter=", 12) == 0) {
@@ -1193,7 +1212,7 @@ int main(int argc, char **argv) {
                         arg_netfilter6_file = argv[i] + 13;
                         check_netfilter_file(arg_netfilter6_file);
                 }
-
+#endif
                 //*************************************
                 // command
                 //*************************************
@@ -1315,18 +1334,22 @@ int main(int argc, char **argv) {
         // build the sandbox command
         if (prog_index == -1 && arg_zsh) {
                 cfg.command_line = "/usr/bin/zsh";
+                cfg.window_title = "/usr/bin/zsh";
                 cfg.command_name = "zsh";
         }
         else if (prog_index == -1 && arg_csh) {
                 cfg.command_line = "/bin/csh";
+                cfg.window_title = "/bin/csh";
                 cfg.command_name = "csh";
         }
         else if (prog_index == -1 && cfg.shell) {
                 cfg.command_line = cfg.shell;
+                cfg.window_title = cfg.shell;
                 cfg.command_name = cfg.shell;
         }
         else if (prog_index == -1) {
                 cfg.command_line = "/bin/bash";
+                cfg.window_title = "/bin/bash";
                 cfg.command_name = "bash";
         }
         else {
@@ -1341,16 +1364,24 @@ int main(int argc, char **argv) {
                 cfg.command_line = malloc(len + 1); // + '\0'
                 if (!cfg.command_line)
                         errExit("malloc");
-                char *ptr = cfg.command_line;
+                cfg.window_title = malloc(len + 1); // + '\0'
+                if (!cfg.window_title)
+                        errExit("malloc");
+
+                char *ptr1 = cfg.command_line;
+                char *ptr2 = cfg.window_title;
                 for (i = 0; i < argcnt; i++) {
                         // detect bash commands
                         if (strstr(argv[i + prog_index], "&&") || strstr(argv[i + prog_index], "||")) {
-                                sprintf(ptr, "%s ", argv[i + prog_index]);
+                                sprintf(ptr1, "%s ", argv[i + prog_index]);
                         }
                         else {
-                                sprintf(ptr, "\"%s\" ", argv[i + prog_index]);
+                                sprintf(ptr1, "\"%s\" ", argv[i + prog_index]);
                         }
-                        ptr += strlen(ptr);
+                        sprintf(ptr2, "%s ", argv[i + prog_index]);
+
+                        ptr1 += strlen(ptr1);
+                        ptr2 += strlen(ptr2);
                 }
         }
         
@@ -1582,6 +1613,16 @@ int main(int argc, char **argv) {
                 free(cfg.seccomp_list_errno);
         }
 #endif
+        if (cfg.profile) {
+                ProfileEntry *prf = cfg.profile;
+                while (prf != NULL) {
+                        ProfileEntry *next = prf->next;
+                        free(prf->data);
+                        free(prf->link);
+                        free(prf);
+                        prf = next;
+                }
+        }
 
         myexit(0);