diff options
Diffstat (limited to 'src/firejail/netfilter.c')
-rw-r--r-- | src/firejail/netfilter.c | 12 |
1 files changed, 3 insertions, 9 deletions
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c index ef4915f15..ed411313a 100644 --- a/src/firejail/netfilter.c +++ b/src/firejail/netfilter.c | |||
@@ -47,14 +47,8 @@ void check_netfilter_file(const char *fname) { | |||
47 | EUID_ASSERT(); | 47 | EUID_ASSERT(); |
48 | invalid_filename(fname); | 48 | invalid_filename(fname); |
49 | 49 | ||
50 | if (is_dir(fname) || is_link(fname) || strstr(fname, "..")) { | 50 | if (is_dir(fname) || is_link(fname) || strstr(fname, "..") || access(fname, R_OK )) { |
51 | fprintf(stderr, "Error: invalid network filter file\n"); | 51 | fprintf(stderr, "Error: invalid network filter file %s\n", fname); |
52 | exit(1); | ||
53 | } | ||
54 | |||
55 | // access call checks as real UID/GID, not as effective UID/GID | ||
56 | if (access(fname, R_OK)) { | ||
57 | fprintf(stderr, "Error: cannot access network filter file\n"); | ||
58 | exit(1); | 52 | exit(1); |
59 | } | 53 | } |
60 | } | 54 | } |
@@ -138,7 +132,7 @@ void netfilter6(const char *fname) { | |||
138 | char *filter = read_text_file_or_exit(fname); | 132 | char *filter = read_text_file_or_exit(fname); |
139 | FILE *fp = fopen(SBOX_STDIN_FILE, "w"); | 133 | FILE *fp = fopen(SBOX_STDIN_FILE, "w"); |
140 | if (!fp) { | 134 | if (!fp) { |
141 | fprintf(stderr, "Error: cannot open /tmp/netfilter6 file\n"); | 135 | fprintf(stderr, "Error: cannot open %s\n", SBOX_STDIN_FILE); |
142 | exit(1); | 136 | exit(1); |
143 | } | 137 | } |
144 | fprintf(fp, "%s\n", filter); | 138 | fprintf(fp, "%s\n", filter); |