diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/env.c | 4 | ||||
-rw-r--r-- | src/firejail/firejail.h | 2 | ||||
-rw-r--r-- | src/firejail/main.c | 68 | ||||
-rw-r--r-- | src/firejail/no_sandbox.c | 6 | ||||
-rw-r--r-- | src/firejail/restricted_shell.c | 32 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 30 |
6 files changed, 101 insertions, 41 deletions
diff --git a/src/firejail/env.c b/src/firejail/env.c index 328b19c5b..c05abadca 100644 --- a/src/firejail/env.c +++ b/src/firejail/env.c | |||
@@ -125,8 +125,8 @@ void env_defaults(void) { | |||
125 | errExit("setenv"); | 125 | errExit("setenv"); |
126 | // set prompt color to green | 126 | // set prompt color to green |
127 | //export PS1='\[\e[1;32m\][\u@\h \W]\$\[\e[0m\] ' | 127 | //export PS1='\[\e[1;32m\][\u@\h \W]\$\[\e[0m\] ' |
128 | if (setenv("PROMPT_COMMAND", "export PS1=\"\\[\\e[1;32m\\][\\u@\\h \\W]\\$\\[\\e[0m\\] \"", 1) < 0) | 128 | // if (setenv("PROMPT_COMMAND", "export PS1=\"\\[\\e[1;32m\\][\\u@\\h \\W]\\$\\[\\e[0m\\] \"", 1) < 0) |
129 | errExit("setenv"); | 129 | // errExit("setenv"); |
130 | 130 | ||
131 | // set the window title | 131 | // set the window title |
132 | printf("\033]0;firejail %s\007", cfg.window_title); | 132 | printf("\033]0;firejail %s\007", cfg.window_title); |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 2a96afa1b..ce232ace5 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -22,6 +22,8 @@ | |||
22 | #include "../include/common.h" | 22 | #include "../include/common.h" |
23 | #include "../include/euid_common.h" | 23 | #include "../include/euid_common.h" |
24 | 24 | ||
25 | // debug restricted shell | ||
26 | //#define DEBUG_RESTRICTED_SHELL | ||
25 | 27 | ||
26 | // filesystem | 28 | // filesystem |
27 | #define RUN_FIREJAIL_BASEDIR "/run" | 29 | #define RUN_FIREJAIL_BASEDIR "/run" |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 3e5663a9b..047d1a010 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -879,25 +879,35 @@ int main(int argc, char **argv) { | |||
879 | arg_quiet = 1; | 879 | arg_quiet = 1; |
880 | parent_sshd = 1; | 880 | parent_sshd = 1; |
881 | 881 | ||
882 | #if 0 | 882 | #ifdef DEBUG_RESTRICTED_SHELL |
883 | EUID_ROOT(); | 883 | {EUID_ROOT(); |
884 | FILE *fp = fopen("/mylog", "w"); | 884 | FILE *fp = fopen("/firelog", "w"); |
885 | if (fp) { | 885 | if (fp) { |
886 | int i; | 886 | int i; |
887 | for (i = 0; i < argc; i++) | 887 | fprintf(fp, "argc %d: ", argc); |
888 | fprintf(fp, "#%s# ", argv[i]); | 888 | for (i = 0; i < argc; i++) |
889 | fprintf(fp, "\n"); | 889 | fprintf(fp, "#%s# ", argv[i]); |
890 | fclose(fp); | 890 | fprintf(fp, "\n"); |
891 | } | 891 | fclose(fp); |
892 | EUID_USER(); | 892 | } |
893 | EUID_USER();} | ||
893 | #endif | 894 | #endif |
894 | 895 | // run sftp and scp directly without any sandboxing | |
895 | // run sftp and ssh directly without any sandboxing | ||
896 | // regular login has argv[0] == "-firejail" | 896 | // regular login has argv[0] == "-firejail" |
897 | if (*argv[0] != '-') { | 897 | if (*argv[0] != '-') { |
898 | if (strcmp(argv[1], "-c") == 0 && argc > 2) { | 898 | if (strcmp(argv[1], "-c") == 0 && argc > 2) { |
899 | if (strcmp(argv[2], "/usr/lib/openssh/sftp-server") == 0 || | 899 | if (strcmp(argv[2], "/usr/lib/openssh/sftp-server") == 0 || |
900 | strncmp(argv[2], "scp ", 4) == 0) { | 900 | strncmp(argv[2], "scp ", 4) == 0) { |
901 | #ifdef DEBUG_RESTRICTED_SHELL | ||
902 | {EUID_ROOT(); | ||
903 | FILE *fp = fopen("/firelog", "a"); | ||
904 | if (fp) { | ||
905 | fprintf(fp, "run without a sandbox\n"); | ||
906 | fclose(fp); | ||
907 | } | ||
908 | EUID_USER();} | ||
909 | #endif | ||
910 | |||
901 | drop_privs(1); | 911 | drop_privs(1); |
902 | run_no_sandbox(argc, argv); | 912 | run_no_sandbox(argc, argv); |
903 | } | 913 | } |
@@ -910,9 +920,25 @@ EUID_USER(); | |||
910 | 920 | ||
911 | // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users | 921 | // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users |
912 | if (*argv[0] == '-' || parent_sshd) { | 922 | if (*argv[0] == '-' || parent_sshd) { |
913 | login_shell = 1; | 923 | if (argc == 1) |
924 | login_shell = 1; | ||
914 | fullargc = restricted_shell(cfg.username); | 925 | fullargc = restricted_shell(cfg.username); |
915 | if (fullargc) { | 926 | if (fullargc) { |
927 | |||
928 | #ifdef DEBUG_RESTRICTED_SHELL | ||
929 | {EUID_ROOT(); | ||
930 | FILE *fp = fopen("/firelog", "a"); | ||
931 | if (fp) { | ||
932 | fprintf(fp, "fullargc %d: ", fullargc); | ||
933 | int i; | ||
934 | for (i = 0; i < fullargc; i++) | ||
935 | fprintf(fp, "#%s# ", fullargv[i]); | ||
936 | fprintf(fp, "\n"); | ||
937 | fclose(fp); | ||
938 | } | ||
939 | EUID_USER();} | ||
940 | #endif | ||
941 | |||
916 | int j; | 942 | int j; |
917 | for (i = 1, j = fullargc; i < argc && j < MAX_ARGS; i++, j++, fullargc++) | 943 | for (i = 1, j = fullargc; i < argc && j < MAX_ARGS; i++, j++, fullargc++) |
918 | fullargv[j] = argv[i]; | 944 | fullargv[j] = argv[i]; |
@@ -920,6 +946,20 @@ EUID_USER(); | |||
920 | // replace argc/argv with fullargc/fullargv | 946 | // replace argc/argv with fullargc/fullargv |
921 | argv = fullargv; | 947 | argv = fullargv; |
922 | argc = j; | 948 | argc = j; |
949 | |||
950 | #ifdef DEBUG_RESTRICTED_SHELL | ||
951 | {EUID_ROOT(); | ||
952 | FILE *fp = fopen("/firelog", "a"); | ||
953 | if (fp) { | ||
954 | fprintf(fp, "argc %d: ", argc); | ||
955 | int i; | ||
956 | for (i = 0; i < argc; i++) | ||
957 | fprintf(fp, "#%s# ", argv[i]); | ||
958 | fprintf(fp, "\n"); | ||
959 | fclose(fp); | ||
960 | } | ||
961 | EUID_USER();} | ||
962 | #endif | ||
923 | } | 963 | } |
924 | } | 964 | } |
925 | else { | 965 | else { |
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c index 933922ece..80ed72dca 100644 --- a/src/firejail/no_sandbox.c +++ b/src/firejail/no_sandbox.c | |||
@@ -172,8 +172,8 @@ void run_no_sandbox(int argc, char **argv) { | |||
172 | int len = 0; | 172 | int len = 0; |
173 | int i; | 173 | int i; |
174 | for (i = 1; i < argc; i++) { | 174 | for (i = 1; i < argc; i++) { |
175 | // if (i == 1 && strcmp(argv[i], "-c") == 0) | 175 | if (i == 1 && strcmp(argv[i], "-c") == 0) |
176 | // continue; | 176 | continue; |
177 | if (*argv[i] == '-') | 177 | if (*argv[i] == '-') |
178 | continue; | 178 | continue; |
179 | break; | 179 | break; |
@@ -204,7 +204,7 @@ void run_no_sandbox(int argc, char **argv) { | |||
204 | } | 204 | } |
205 | 205 | ||
206 | // start the program in /bin/sh | 206 | // start the program in /bin/sh |
207 | // if (!arg_quiet) | 207 | if (!arg_quiet) |
208 | fprintf(stderr, "Warning: an existing sandbox was detected. " | 208 | fprintf(stderr, "Warning: an existing sandbox was detected. " |
209 | "%s will run without any additional sandboxing features in a /bin/sh shell\n", command); | 209 | "%s will run without any additional sandboxing features in a /bin/sh shell\n", command); |
210 | int rv = system(command); | 210 | int rv = system(command); |
diff --git a/src/firejail/restricted_shell.c b/src/firejail/restricted_shell.c index 1920da40a..24ce27c2e 100644 --- a/src/firejail/restricted_shell.c +++ b/src/firejail/restricted_shell.c | |||
@@ -40,7 +40,7 @@ int restricted_shell(const char *user) { | |||
40 | char buf[MAX_READ]; | 40 | char buf[MAX_READ]; |
41 | while (fgets(buf, MAX_READ, fp)) { | 41 | while (fgets(buf, MAX_READ, fp)) { |
42 | lineno++; | 42 | lineno++; |
43 | 43 | ||
44 | // remove empty spaces at the beginning of the line | 44 | // remove empty spaces at the beginning of the line |
45 | char *ptr = buf; | 45 | char *ptr = buf; |
46 | while (*ptr == ' ' || *ptr == '\t') { | 46 | while (*ptr == ' ' || *ptr == '\t') { |
@@ -48,7 +48,7 @@ int restricted_shell(const char *user) { | |||
48 | } | 48 | } |
49 | if (*ptr == '\n' || *ptr == '#') | 49 | if (*ptr == '\n' || *ptr == '#') |
50 | continue; | 50 | continue; |
51 | 51 | ||
52 | // parse line | 52 | // parse line |
53 | char *usr = ptr; | 53 | char *usr = ptr; |
54 | char *args = strchr(usr, ':'); | 54 | char *args = strchr(usr, ':'); |
@@ -56,6 +56,7 @@ int restricted_shell(const char *user) { | |||
56 | fprintf(stderr, "Error: users.conf line %d\n", lineno); | 56 | fprintf(stderr, "Error: users.conf line %d\n", lineno); |
57 | exit(1); | 57 | exit(1); |
58 | } | 58 | } |
59 | |||
59 | *args = '\0'; | 60 | *args = '\0'; |
60 | args++; | 61 | args++; |
61 | ptr = strchr(args, '\n'); | 62 | ptr = strchr(args, '\n'); |
@@ -70,6 +71,7 @@ int restricted_shell(const char *user) { | |||
70 | found = 1; | 71 | found = 1; |
71 | break; | 72 | break; |
72 | } | 73 | } |
74 | ptr2++; | ||
73 | } | 75 | } |
74 | if (!found) | 76 | if (!found) |
75 | continue; | 77 | continue; |
@@ -82,16 +84,28 @@ int restricted_shell(const char *user) { | |||
82 | int i; | 84 | int i; |
83 | ptr = args; | 85 | ptr = args; |
84 | for (i = 1; i < MAX_ARGS; i++) { | 86 | for (i = 1; i < MAX_ARGS; i++) { |
85 | fullargv[i] = ptr; | 87 | // skip blanks |
86 | while (*ptr != ' ' && *ptr != '\t' && *ptr != '\0') | 88 | while (*ptr == ' ' || *ptr == '\t') |
87 | ptr++; | 89 | ptr++; |
90 | fullargv[i] = ptr; | ||
91 | #ifdef DEBUG_RESTRICTED_SHELL | ||
92 | {EUID_ROOT(); | ||
93 | FILE *fp = fopen("/firelog", "a"); | ||
94 | if (fp) { | ||
95 | fprintf(fp, "i %d ptr #%s#\n", i, fullargv[i]); | ||
96 | fclose(fp); | ||
97 | } | ||
98 | EUID_USER();} | ||
99 | #endif | ||
100 | |||
88 | if (*ptr != '\0') { | 101 | if (*ptr != '\0') { |
102 | // go to the end of the word | ||
103 | while (*ptr != ' ' && *ptr != '\t' && *ptr != '\0') | ||
104 | ptr++; | ||
89 | *ptr ='\0'; | 105 | *ptr ='\0'; |
90 | fullargv[i] = strdup(fullargv[i]); | 106 | fullargv[i] = strdup(fullargv[i]); |
91 | if (fullargv[i] == NULL) { | 107 | if (fullargv[i] == NULL) |
92 | fprintf(stderr, "Error: cannot allocate memory\n"); | 108 | errExit("strdup"); |
93 | exit(1); | ||
94 | } | ||
95 | ptr++; | 109 | ptr++; |
96 | while (*ptr == ' ' || *ptr == '\t') | 110 | while (*ptr == ' ' || *ptr == '\t') |
97 | ptr++; | 111 | ptr++; |
@@ -107,7 +121,7 @@ int restricted_shell(const char *user) { | |||
107 | } | 121 | } |
108 | } | 122 | } |
109 | fclose(fp); | 123 | fclose(fp); |
110 | 124 | ||
111 | return 0; | 125 | return 0; |
112 | } | 126 | } |
113 | 127 | ||
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 3e8b5f934..8178cfc8e 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -326,22 +326,26 @@ static void start_application(void) { | |||
326 | //**************************************** | 326 | //**************************************** |
327 | else { | 327 | else { |
328 | assert(cfg.shell); | 328 | assert(cfg.shell); |
329 | assert(cfg.command_line); | ||
329 | 330 | ||
330 | char *arg[6]; | 331 | char *arg[5]; |
331 | int index = 0; | 332 | int index = 0; |
332 | arg[index++] = cfg.shell; | 333 | arg[index++] = cfg.shell; |
333 | if (login_shell) | 334 | if (login_shell) { |
334 | arg[index++] = "-l"; | 335 | arg[index++] = "-l"; |
335 | arg[index++] = "-c"; | 336 | if (arg_debug) |
336 | assert(cfg.command_line); | 337 | printf("Starting %s login shell\n", cfg.shell); |
337 | if (arg_debug) | 338 | } else { |
338 | printf("Starting %s\n", cfg.command_line); | 339 | arg[index++] = "-c"; |
339 | if (arg_doubledash) | 340 | if (arg_debug) |
340 | arg[index++] = "--"; | 341 | printf("Running %s command through %s\n", cfg.command_line, cfg.shell); |
341 | arg[index++] = cfg.command_line; | 342 | if (arg_doubledash) |
343 | arg[index++] = "--"; | ||
344 | arg[index++] = cfg.command_line; | ||
345 | } | ||
342 | arg[index] = NULL; | 346 | arg[index] = NULL; |
343 | assert(index < 5); | 347 | assert(index < 5); |
344 | 348 | ||
345 | if (arg_debug) { | 349 | if (arg_debug) { |
346 | char *msg; | 350 | char *msg; |
347 | if (asprintf(&msg, "sandbox %d, execvp into %s", sandbox_pid, cfg.command_line) == -1) | 351 | if (asprintf(&msg, "sandbox %d, execvp into %s", sandbox_pid, cfg.command_line) == -1) |
@@ -349,7 +353,7 @@ static void start_application(void) { | |||
349 | logmsg(msg); | 353 | logmsg(msg); |
350 | free(msg); | 354 | free(msg); |
351 | } | 355 | } |
352 | 356 | ||
353 | if (arg_debug) { | 357 | if (arg_debug) { |
354 | int i; | 358 | int i; |
355 | for (i = 0; i < 5; i++) { | 359 | for (i = 0; i < 5; i++) { |
@@ -358,12 +362,12 @@ static void start_application(void) { | |||
358 | printf("execvp argument %d: %s\n", i, arg[i]); | 362 | printf("execvp argument %d: %s\n", i, arg[i]); |
359 | } | 363 | } |
360 | } | 364 | } |
361 | 365 | ||
362 | if (!arg_command && !arg_quiet) | 366 | if (!arg_command && !arg_quiet) |
363 | printf("Child process initialized\n"); | 367 | printf("Child process initialized\n"); |
364 | execvp(arg[0], arg); | 368 | execvp(arg[0], arg); |
365 | } | 369 | } |
366 | 370 | ||
367 | perror("execvp"); | 371 | perror("execvp"); |
368 | exit(1); // it should never get here!!! | 372 | exit(1); // it should never get here!!! |
369 | } | 373 | } |