1 files changed, 181 insertions, 36 deletions

diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index a9242f035..aae490c34 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -23,6 +23,65 @@
 #include <unistd.h>
 #include <grp.h>
 
+#define MAX_BUF 4096
+
+int is_container(const char *str) {
+        assert(str);
+        if (strcmp(str, "lxc") == 0 ||
+             strcmp(str, "docker") == 0 ||
+             strcmp(str, "lxc-libvirt") == 0 ||
+             strcmp(str, "systemd-nspawn") == 0 ||
+             strcmp(str, "rkt") == 0)
+                return 1;
+        return 0;
+}
+
+// returns 1 if we are running under LXC
+int check_namespace_virt(void) {
+        EUID_ASSERT();
+        
+        // check container environment variable
+        char *str = getenv("container");
+        if (str && is_container(str))
+                return 1;
+        
+        // check PID 1 container environment variable
+        EUID_ROOT();
+        FILE *fp = fopen("/proc/1/environ", "r");
+        if (fp) {
+                int c = 0;
+                while (c != EOF) {
+                        // read one line
+                        char buf[MAX_BUF];
+                        int i = 0;
+                        while ((c = fgetc(fp)) != EOF) {
+                                if (c == 0)
+                                        break;
+                                buf[i] = (char) c;
+                                if (++i == (MAX_BUF - 1))
+                                        break;
+                        }
+                        buf[i] = '\0';
+                        
+                        // check env var name
+                        if (strncmp(buf, "container=", 10) == 0) {
+                                // found it
+                                if (is_container(buf + 10)) {
+                                        fclose(fp);
+                                        EUID_USER();
+                                        return 1;
+                                }
+                        }
+//                      printf("i %d c %d, buf #%s#\n", i, c, buf);
+                }
+                
+                fclose(fp);
+        }
+                
+        EUID_USER();
+        return 0;
+}
+
 // check process space for kernel processes
 // return 1 if found, 0 if not found
 int check_kernel_procs(void) {
@@ -103,44 +162,130 @@ int check_kernel_procs(void) {
 void run_no_sandbox(int argc, char **argv) {
         EUID_ASSERT();
 
-        // build command
-        char *command = NULL;
-        int allocated = 0;
-        if (argc == 1)
-                command = "/bin/bash";
-        else {
-                // calculate length
-                int len = 0;
-                int i;
-                for (i = 1; i < argc; i++) {
-                        if (*argv[i] == '-')
-                                continue;
+        // process limited subset of options
+        int i;
+        for (i = 0; i < argc; i++) {
+                if (strcmp(argv[i], "--csh") == 0) {
+                        if (arg_shell_none) {
+                                fprintf(stderr, "Error: --shell=none was already specified.\n");
+                                exit(1);
+                        }
+                        if (cfg.shell) {
+                                fprintf(stderr, "Error: only one default user shell can be specified\n");
+                                exit(1);
+                        }
+                        cfg.shell = "/bin/csh";
+                }
+                else if (strcmp(argv[i], "--zsh") == 0) {
+                        if (arg_shell_none) {
+                                fprintf(stderr, "Error: --shell=none was already specified.\n");
+                                exit(1);
+                        }
+                        if (cfg.shell) {
+                                fprintf(stderr, "Error: only one default user shell can be specified\n");
+                                exit(1);
+                        }
+                        cfg.shell = "/bin/zsh";
+                }
+                else if (strcmp(argv[i], "--shell=none") == 0) {
+                        arg_shell_none = 1;
+                        if (cfg.shell) {
+                                fprintf(stderr, "Error: a shell was already specified\n");
+                                exit(1);
+                        }
+                }
+                else if (strncmp(argv[i], "--shell=", 8) == 0) {
+                        if (arg_shell_none) {
+                                fprintf(stderr, "Error: --shell=none was already specified.\n");
+                                exit(1);
+                        }
+                        invalid_filename(argv[i] + 8);
+
+                        if (cfg.shell) {
+                                fprintf(stderr, "Error: only one user shell can be specified\n");
+                                exit(1);
+                        }
+                        cfg.shell = argv[i] + 8;
+
+                        if (is_dir(cfg.shell) || strstr(cfg.shell, "..")) {
+                                fprintf(stderr, "Error: invalid shell\n");
+                                exit(1);
+                        }
+
+                        // access call checks as real UID/GID, not as effective UID/GID
+                        if(cfg.chrootdir) {
+                                char *shellpath;
+                                if (asprintf(&shellpath, "%s%s", cfg.chrootdir, cfg.shell) == -1)
+                                        errExit("asprintf");
+                                if (access(shellpath, R_OK)) {
+                                        fprintf(stderr, "Error: cannot access shell file in chroot\n");
+                                        exit(1);
+                                }
+                                free(shellpath);
+                        } else if (access(cfg.shell, R_OK)) {
+                                fprintf(stderr, "Error: cannot access shell file\n");
+                                exit(1);
+                        }
+                }
+        }
+
+        // use $SHELL to get shell used in sandbox
+        if (!arg_shell_none && !cfg.shell) {
+                char *shell =  getenv("SHELL");
+                if (access(shell, R_OK) == 0)
+                        cfg.shell = shell;
+        }
+        // guess shell otherwise
+        if (!arg_shell_none && !cfg.shell) {
+                cfg.shell = guess_shell();
+                if (arg_debug)
+                        printf("Autoselecting %s as shell\n", cfg.shell);
+        }
+        if (!arg_shell_none && !cfg.shell) {
+                fprintf(stderr, "Error: unable to guess your shell, please set explicitly by using --shell option.\n");
+                exit(1);
+        }
+
+        int prog_index = 0;
+        // find first non option arg:
+        //      - first argument not starting wiht --,
+        //      - whatever follows after -c (example: firejail -c ls)
+        for (i = 1; i < argc; i++) {
+                if (strcmp(argv[i], "-c") == 0) {
+                        prog_index = i + 1;
+                        if (prog_index == argc) {
+                                fprintf(stderr, "Error: option -c requires an argument\n");
+                                exit(1);
+                        }
                         break;
                 }
-                int start_index = i;
-                for (i = start_index; i < argc; i++)
-                        len += strlen(argv[i]) + 1;
-                
-                // allocate
-                command = malloc(len + 1);
-                if (!command)
-                        errExit("malloc");
-                memset(command, 0, len + 1);
-                allocated = 1;
-                
-                // copy
-                for (i = start_index; i < argc; i++) {
-                        strcat(command, argv[i]);
-                        strcat(command, " ");
+                // check first argument not starting with --
+                if (strncmp(argv[i],"--",2) != 0) {
+                        prog_index = i;
+                        break;
                 }
         }
-        
-        // start the program in /bin/sh
-        fprintf(stderr, "Warning: an existing sandbox was detected. "
-                "%s will run without any additional sandboxing features in a /bin/sh shell\n", command);
-        int rv = system(command);
-        (void) rv;
-        if (allocated)
-                free(command);
-        exit(1);
+
+        if (!arg_shell_none) {
+                if (prog_index == 0) {
+                        cfg.command_line = cfg.shell;
+                        cfg.window_title = cfg.shell;
+                } else {
+                        build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
+                }
+        }
+
+        cfg.original_argv = argv;
+        cfg.original_program_index = prog_index;
+
+        char *command;
+        if (prog_index == 0)
+                command = cfg.shell;
+        else
+                command = argv[prog_index];
+        if (!arg_quiet)
+                fprintf(stderr, "Warning: an existing sandbox was detected. "
+                        "%s will run without any additional sandboxing features\n", command);
+
+        start_application();
 }