1 files changed, 40 insertions, 17 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index b5a97c71e..e210ceb31 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -54,9 +54,9 @@ Config cfg;					// configuration
 int arg_private = 0;                            // mount private /home and /tmp directoryu
 int arg_private_template = 0; // mount private /home using a template
 int arg_debug = 0;                              // print debug messages
-int arg_debug_check_filename;           // print debug messages for filename checking
-int arg_debug_blacklists;                       // print debug messages for blacklists
-int arg_debug_whitelists;                       // print debug messages for whitelists
+int arg_debug_check_filename = 0;               // print debug messages for filename checking
+int arg_debug_blacklists = 0;                   // print debug messages for blacklists
+int arg_debug_whitelists = 0;                   // print debug messages for whitelists
 int arg_nonetwork = 0;                          // --net=none
 int arg_command = 0;                            // -c
 int arg_overlay = 0;                            // overlay option
@@ -404,8 +404,8 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
 #ifdef HAVE_SECCOMP
         else if (strcmp(argv[i], "--debug-syscalls") == 0) {
                 if (checkcfg(CFG_SECCOMP)) {
-                        syscall_print();
-                        exit(0);
+                        int rv = sbox_run(SBOX_USER | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FSECCOMP, "debug-syscalls");
+                        exit(rv);
                 }
                 else {
                         fprintf(stderr, "Error: seccomp feature is disabled in Firejail configuration file\n");
@@ -414,7 +414,8 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
         }
         else if (strcmp(argv[i], "--debug-errnos") == 0) {
                 if (checkcfg(CFG_SECCOMP)) {
-                        errno_print();
+                        int rv = sbox_run(SBOX_USER | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FSECCOMP, "debug-errnos");
+                        exit(rv);
                 }
                 else {
                         fprintf(stderr, "Error: seccomp feature is disabled in Firejail configuration file\n");
@@ -438,8 +439,8 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 exit(0);
         }
         else if (strcmp(argv[i], "--debug-protocols") == 0) {
-                protocol_list();
-                exit(0);
+                int rv = sbox_run(SBOX_USER | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FSECCOMP, "debug-protocols");
+                exit(rv);
         }
         else if (strncmp(argv[i], "--protocol.print=", 17) == 0) {
                 if (checkcfg(CFG_SECCOMP)) {
@@ -498,27 +499,32 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 exit(0);
         }
         else if (strcmp(argv[i], "--list") == 0) {
-                list();
-                exit(0);
+                int rv = sbox_run(SBOX_USER | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FIREMON, "--list");
+                exit(rv);
         }
         else if (strcmp(argv[i], "--tree") == 0) {
-                tree();
-                exit(0);
+                int rv = sbox_run(SBOX_USER | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FIREMON, "--tree");
+                exit(rv);
         }
         else if (strcmp(argv[i], "--top") == 0) {
-                top();
-                exit(0);
+                int rv = sbox_run(SBOX_USER | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FIREMON, "--top");
+                exit(rv);
         }
 #ifdef HAVE_NETWORK     
         else if (strcmp(argv[i], "--netstats") == 0) {
                 if (checkcfg(CFG_NETWORK)) {
-                        netstats();
+                        struct stat s;
+                        int rv;
+                        if (stat("/proc/sys/kernel/grsecurity", &s) == 0)
+                                rv = sbox_run(SBOX_ROOT | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FIREMON, "--netstats");
+                        else
+                                rv = sbox_run(SBOX_USER | SBOX_CAPS | SBOX_SECCOMP, 2, PATH_FIREMON, "--netstats");
+                        exit(rv);
                 }
                 else {
                         fprintf(stderr, "Error: networking features are disabled in Firejail configuration file\n");
                         exit(1);
                 }
-                exit(0);
         }
 #endif  
 #ifdef HAVE_FILE_TRANSFER
@@ -1112,7 +1118,16 @@ int main(int argc, char **argv) {
 #ifdef HAVE_SECCOMP
                 else if (strncmp(argv[i], "--protocol=", 11) == 0) {
                         if (checkcfg(CFG_SECCOMP)) {
-                                protocol_store(argv[i] + 11);
+                                if (cfg.protocol) {
+                                        if (!arg_quiet)
+                                                fprintf(stderr, "Warning: a protocol list is present, the new list \"%s\" will not be installed\n", argv[i] + 11);
+                                }
+                                else {
+                                        // store list
+                                        cfg.protocol = strdup(argv[i] + 11);
+                                        if (!cfg.protocol)
+                                                errExit("strdup");
+                                }
                         }
                         else {
                                 fprintf(stderr, "Error: seccomp feature is disabled in Firejail configuration file\n");
@@ -1605,6 +1620,14 @@ int main(int argc, char **argv) {
                                         return 1;
                                 }
                                 
+                                // don't allow "--chroot=/"
+                                char *rpath = realpath(cfg.chrootdir, NULL);
+                                if (rpath == NULL || strcmp(rpath, "/") == 0) {
+                                        fprintf(stderr, "Error: invalid chroot directory\n");
+                                        exit(1);
+                                }
+                                free(rpath);
+                                
                                 // check chroot directory structure
                                 if (fs_check_chroot_dir(cfg.chrootdir)) {
                                         fprintf(stderr, "Error: invalid chroot\n");