diff options
Diffstat (limited to 'src/firejail')
-rw-r--r-- | src/firejail/firejail.h | 2 | ||||
-rw-r--r-- | src/firejail/preproc.c | 1 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 9 | ||||
-rw-r--r-- | src/firejail/seccomp.c | 16 |
4 files changed, 3 insertions, 25 deletions
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 7544b642a..2db171070 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -59,14 +59,12 @@ | |||
59 | 59 | ||
60 | #define RUN_SECCOMP_PROTOCOL "/run/firejail/mnt/seccomp.protocol" // protocol filter | 60 | #define RUN_SECCOMP_PROTOCOL "/run/firejail/mnt/seccomp.protocol" // protocol filter |
61 | #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp" // configured filter | 61 | #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp" // configured filter |
62 | #define RUN_SECCOMP_64 "/run/firejail/mnt/seccomp.64" // 64bit arch filter installed on 32bit architectures | ||
63 | #define RUN_SECCOMP_32 "/run/firejail/mnt/seccomp.32" // 32bit arch filter installed on 64bit architectures | 62 | #define RUN_SECCOMP_32 "/run/firejail/mnt/seccomp.32" // 32bit arch filter installed on 64bit architectures |
64 | #define RUN_SECCOMP_MDWX "/run/firejail/mnt/seccomp.mdwx" // filter for memory-deny-write-execute | 63 | #define RUN_SECCOMP_MDWX "/run/firejail/mnt/seccomp.mdwx" // filter for memory-deny-write-execute |
65 | #define RUN_SECCOMP_BLOCK_SECONDARY "/run/firejail/mnt/seccomp.block_secondary" // secondary arch blocking filter | 64 | #define RUN_SECCOMP_BLOCK_SECONDARY "/run/firejail/mnt/seccomp.block_secondary" // secondary arch blocking filter |
66 | #define RUN_SECCOMP_POSTEXEC "/run/firejail/mnt/seccomp.postexec" // filter for post-exec library | 65 | #define RUN_SECCOMP_POSTEXEC "/run/firejail/mnt/seccomp.postexec" // filter for post-exec library |
67 | #define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp") // default filter built during make | 66 | #define PATH_SECCOMP_DEFAULT (LIBDIR "/firejail/seccomp") // default filter built during make |
68 | #define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug") // default filter built during make | 67 | #define PATH_SECCOMP_DEFAULT_DEBUG (LIBDIR "/firejail/seccomp.debug") // default filter built during make |
69 | #define PATH_SECCOMP_64 (LIBDIR "/firejail/seccomp.64") // 64bit arch filter built during make | ||
70 | #define PATH_SECCOMP_32 (LIBDIR "/firejail/seccomp.32") // 32bit arch filter built during make | 68 | #define PATH_SECCOMP_32 (LIBDIR "/firejail/seccomp.32") // 32bit arch filter built during make |
71 | #define PATH_SECCOMP_MDWX (LIBDIR "/firejail/seccomp.mdwx") // filter for memory-deny-write-execute built during make | 69 | #define PATH_SECCOMP_MDWX (LIBDIR "/firejail/seccomp.mdwx") // filter for memory-deny-write-execute built during make |
72 | #define PATH_SECCOMP_BLOCK_SECONDARY (LIBDIR "/firejail/seccomp.block_secondary") // secondary arch blocking filter built during make | 70 | #define PATH_SECCOMP_BLOCK_SECONDARY (LIBDIR "/firejail/seccomp.block_secondary") // secondary arch blocking filter built during make |
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c index 45399bd48..9fb4840c6 100644 --- a/src/firejail/preproc.c +++ b/src/firejail/preproc.c | |||
@@ -87,7 +87,6 @@ void preproc_mount_mnt_dir(void) { | |||
87 | else { | 87 | else { |
88 | //copy default seccomp files | 88 | //copy default seccomp files |
89 | copy_file(PATH_SECCOMP_32, RUN_SECCOMP_32, getuid(), getgid(), 0644); // root needed | 89 | copy_file(PATH_SECCOMP_32, RUN_SECCOMP_32, getuid(), getgid(), 0644); // root needed |
90 | copy_file(PATH_SECCOMP_64, RUN_SECCOMP_64, getuid(), getgid(), 0644); // root needed | ||
91 | } | 90 | } |
92 | if (arg_allow_debuggers) | 91 | if (arg_allow_debuggers) |
93 | copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed | 92 | copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 8abdf6b2c..1498007eb 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -1017,18 +1017,9 @@ int sandbox(void* sandbox_arg) { | |||
1017 | else | 1017 | else |
1018 | seccomp_filter_drop(); | 1018 | seccomp_filter_drop(); |
1019 | 1019 | ||
1020 | // clean unused filters | ||
1021 | #if defined(__LP64__) | ||
1022 | int rv = unlink(RUN_SECCOMP_64); | ||
1023 | #endif | ||
1024 | #if defined(__ILP32__) | ||
1025 | int rv = unlink(RUN_SECCOMP_32); | ||
1026 | #endif | ||
1027 | (void) rv; | ||
1028 | } | 1020 | } |
1029 | else { // clean seccomp files under /run/firejail/mnt | 1021 | else { // clean seccomp files under /run/firejail/mnt |
1030 | int rv = unlink(RUN_SECCOMP_CFG); | 1022 | int rv = unlink(RUN_SECCOMP_CFG); |
1031 | rv |= unlink(RUN_SECCOMP_64); | ||
1032 | rv |= unlink(RUN_SECCOMP_32); | 1023 | rv |= unlink(RUN_SECCOMP_32); |
1033 | (void) rv; | 1024 | (void) rv; |
1034 | } | 1025 | } |
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index 1ee6256d4..3da0206e1 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -138,6 +138,7 @@ errexit: | |||
138 | } | 138 | } |
139 | 139 | ||
140 | // 32 bit arch filter installed on 64 bit architectures | 140 | // 32 bit arch filter installed on 64 bit architectures |
141 | #if defined(__x86_64__) | ||
141 | #if defined(__LP64__) | 142 | #if defined(__LP64__) |
142 | static void seccomp_filter_32(void) { | 143 | static void seccomp_filter_32(void) { |
143 | if (seccomp_load(RUN_SECCOMP_32) == 0) { | 144 | if (seccomp_load(RUN_SECCOMP_32) == 0) { |
@@ -146,15 +147,6 @@ static void seccomp_filter_32(void) { | |||
146 | } | 147 | } |
147 | } | 148 | } |
148 | #endif | 149 | #endif |
149 | |||
150 | // 64 bit arch filter installed on 32 bit architectures | ||
151 | #if defined(__ILP32__) | ||
152 | static void seccomp_filter_64(void) { | ||
153 | if (seccomp_load(RUN_SECCOMP_64) == 0) { | ||
154 | if (arg_debug) | ||
155 | printf("Dual 32/64 bit seccomp filter configured\n"); | ||
156 | } | ||
157 | } | ||
158 | #endif | 150 | #endif |
159 | 151 | ||
160 | static void seccomp_filter_block_secondary(void) { | 152 | static void seccomp_filter_block_secondary(void) { |
@@ -177,11 +169,10 @@ int seccomp_filter_drop(void) { | |||
177 | if (arg_seccomp_block_secondary) | 169 | if (arg_seccomp_block_secondary) |
178 | seccomp_filter_block_secondary(); | 170 | seccomp_filter_block_secondary(); |
179 | else { | 171 | else { |
172 | #if defined(__x86_64__) | ||
180 | #if defined(__LP64__) | 173 | #if defined(__LP64__) |
181 | seccomp_filter_32(); | 174 | seccomp_filter_32(); |
182 | #endif | 175 | #endif |
183 | #if defined(__ILP32__) | ||
184 | seccomp_filter_64(); | ||
185 | #endif | 176 | #endif |
186 | } | 177 | } |
187 | } | 178 | } |
@@ -190,11 +181,10 @@ int seccomp_filter_drop(void) { | |||
190 | if (arg_seccomp_block_secondary) | 181 | if (arg_seccomp_block_secondary) |
191 | seccomp_filter_block_secondary(); | 182 | seccomp_filter_block_secondary(); |
192 | else { | 183 | else { |
184 | #if defined(__x86_64__) | ||
193 | #if defined(__LP64__) | 185 | #if defined(__LP64__) |
194 | seccomp_filter_32(); | 186 | seccomp_filter_32(); |
195 | #endif | 187 | #endif |
196 | #if defined(__ILP32__) | ||
197 | seccomp_filter_64(); | ||
198 | #endif | 188 | #endif |
199 | } | 189 | } |
200 | if (arg_debug) | 190 | if (arg_debug) |