aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/firejail/env.c4
-rw-r--r--src/firejail/firejail.h2
-rw-r--r--src/firejail/main.c68
-rw-r--r--src/firejail/no_sandbox.c6
-rw-r--r--src/firejail/restricted_shell.c32
-rw-r--r--src/firejail/sandbox.c30
6 files changed, 101 insertions, 41 deletions
diff --git a/src/firejail/env.c b/src/firejail/env.c
index 328b19c5b..c05abadca 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -125,8 +125,8 @@ void env_defaults(void) {
125 errExit("setenv"); 125 errExit("setenv");
126 // set prompt color to green 126 // set prompt color to green
127 //export PS1='\[\e[1;32m\][\u@\h \W]\$\[\e[0m\] ' 127 //export PS1='\[\e[1;32m\][\u@\h \W]\$\[\e[0m\] '
128 if (setenv("PROMPT_COMMAND", "export PS1=\"\\[\\e[1;32m\\][\\u@\\h \\W]\\$\\[\\e[0m\\] \"", 1) < 0) 128// if (setenv("PROMPT_COMMAND", "export PS1=\"\\[\\e[1;32m\\][\\u@\\h \\W]\\$\\[\\e[0m\\] \"", 1) < 0)
129 errExit("setenv"); 129// errExit("setenv");
130 130
131 // set the window title 131 // set the window title
132 printf("\033]0;firejail %s\007", cfg.window_title); 132 printf("\033]0;firejail %s\007", cfg.window_title);
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 2a96afa1b..ce232ace5 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -22,6 +22,8 @@
22#include "../include/common.h" 22#include "../include/common.h"
23#include "../include/euid_common.h" 23#include "../include/euid_common.h"
24 24
25// debug restricted shell
26//#define DEBUG_RESTRICTED_SHELL
25 27
26// filesystem 28// filesystem
27#define RUN_FIREJAIL_BASEDIR "/run" 29#define RUN_FIREJAIL_BASEDIR "/run"
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 3e5663a9b..047d1a010 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -879,25 +879,35 @@ int main(int argc, char **argv) {
879 arg_quiet = 1; 879 arg_quiet = 1;
880 parent_sshd = 1; 880 parent_sshd = 1;
881 881
882#if 0 882#ifdef DEBUG_RESTRICTED_SHELL
883EUID_ROOT(); 883 {EUID_ROOT();
884FILE *fp = fopen("/mylog", "w"); 884 FILE *fp = fopen("/firelog", "w");
885if (fp) { 885 if (fp) {
886 int i; 886 int i;
887 for (i = 0; i < argc; i++) 887 fprintf(fp, "argc %d: ", argc);
888 fprintf(fp, "#%s# ", argv[i]); 888 for (i = 0; i < argc; i++)
889 fprintf(fp, "\n"); 889 fprintf(fp, "#%s# ", argv[i]);
890 fclose(fp); 890 fprintf(fp, "\n");
891} 891 fclose(fp);
892EUID_USER(); 892 }
893 EUID_USER();}
893#endif 894#endif
894 895 // run sftp and scp directly without any sandboxing
895 // run sftp and ssh directly without any sandboxing
896 // regular login has argv[0] == "-firejail" 896 // regular login has argv[0] == "-firejail"
897 if (*argv[0] != '-') { 897 if (*argv[0] != '-') {
898 if (strcmp(argv[1], "-c") == 0 && argc > 2) { 898 if (strcmp(argv[1], "-c") == 0 && argc > 2) {
899 if (strcmp(argv[2], "/usr/lib/openssh/sftp-server") == 0 || 899 if (strcmp(argv[2], "/usr/lib/openssh/sftp-server") == 0 ||
900 strncmp(argv[2], "scp ", 4) == 0) { 900 strncmp(argv[2], "scp ", 4) == 0) {
901#ifdef DEBUG_RESTRICTED_SHELL
902 {EUID_ROOT();
903 FILE *fp = fopen("/firelog", "a");
904 if (fp) {
905 fprintf(fp, "run without a sandbox\n");
906 fclose(fp);
907 }
908 EUID_USER();}
909#endif
910
901 drop_privs(1); 911 drop_privs(1);
902 run_no_sandbox(argc, argv); 912 run_no_sandbox(argc, argv);
903 } 913 }
@@ -910,9 +920,25 @@ EUID_USER();
910 920
911 // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users 921 // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users
912 if (*argv[0] == '-' || parent_sshd) { 922 if (*argv[0] == '-' || parent_sshd) {
913 login_shell = 1; 923 if (argc == 1)
924 login_shell = 1;
914 fullargc = restricted_shell(cfg.username); 925 fullargc = restricted_shell(cfg.username);
915 if (fullargc) { 926 if (fullargc) {
927
928#ifdef DEBUG_RESTRICTED_SHELL
929 {EUID_ROOT();
930 FILE *fp = fopen("/firelog", "a");
931 if (fp) {
932 fprintf(fp, "fullargc %d: ", fullargc);
933 int i;
934 for (i = 0; i < fullargc; i++)
935 fprintf(fp, "#%s# ", fullargv[i]);
936 fprintf(fp, "\n");
937 fclose(fp);
938 }
939 EUID_USER();}
940#endif
941
916 int j; 942 int j;
917 for (i = 1, j = fullargc; i < argc && j < MAX_ARGS; i++, j++, fullargc++) 943 for (i = 1, j = fullargc; i < argc && j < MAX_ARGS; i++, j++, fullargc++)
918 fullargv[j] = argv[i]; 944 fullargv[j] = argv[i];
@@ -920,6 +946,20 @@ EUID_USER();
920 // replace argc/argv with fullargc/fullargv 946 // replace argc/argv with fullargc/fullargv
921 argv = fullargv; 947 argv = fullargv;
922 argc = j; 948 argc = j;
949
950#ifdef DEBUG_RESTRICTED_SHELL
951 {EUID_ROOT();
952 FILE *fp = fopen("/firelog", "a");
953 if (fp) {
954 fprintf(fp, "argc %d: ", argc);
955 int i;
956 for (i = 0; i < argc; i++)
957 fprintf(fp, "#%s# ", argv[i]);
958 fprintf(fp, "\n");
959 fclose(fp);
960 }
961 EUID_USER();}
962#endif
923 } 963 }
924 } 964 }
925 else { 965 else {
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 933922ece..80ed72dca 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -172,8 +172,8 @@ void run_no_sandbox(int argc, char **argv) {
172 int len = 0; 172 int len = 0;
173 int i; 173 int i;
174 for (i = 1; i < argc; i++) { 174 for (i = 1; i < argc; i++) {
175// if (i == 1 && strcmp(argv[i], "-c") == 0) 175 if (i == 1 && strcmp(argv[i], "-c") == 0)
176// continue; 176 continue;
177 if (*argv[i] == '-') 177 if (*argv[i] == '-')
178 continue; 178 continue;
179 break; 179 break;
@@ -204,7 +204,7 @@ void run_no_sandbox(int argc, char **argv) {
204 } 204 }
205 205
206 // start the program in /bin/sh 206 // start the program in /bin/sh
207// if (!arg_quiet) 207 if (!arg_quiet)
208 fprintf(stderr, "Warning: an existing sandbox was detected. " 208 fprintf(stderr, "Warning: an existing sandbox was detected. "
209 "%s will run without any additional sandboxing features in a /bin/sh shell\n", command); 209 "%s will run without any additional sandboxing features in a /bin/sh shell\n", command);
210 int rv = system(command); 210 int rv = system(command);
diff --git a/src/firejail/restricted_shell.c b/src/firejail/restricted_shell.c
index 1920da40a..24ce27c2e 100644
--- a/src/firejail/restricted_shell.c
+++ b/src/firejail/restricted_shell.c
@@ -40,7 +40,7 @@ int restricted_shell(const char *user) {
40 char buf[MAX_READ]; 40 char buf[MAX_READ];
41 while (fgets(buf, MAX_READ, fp)) { 41 while (fgets(buf, MAX_READ, fp)) {
42 lineno++; 42 lineno++;
43 43
44 // remove empty spaces at the beginning of the line 44 // remove empty spaces at the beginning of the line
45 char *ptr = buf; 45 char *ptr = buf;
46 while (*ptr == ' ' || *ptr == '\t') { 46 while (*ptr == ' ' || *ptr == '\t') {
@@ -48,7 +48,7 @@ int restricted_shell(const char *user) {
48 } 48 }
49 if (*ptr == '\n' || *ptr == '#') 49 if (*ptr == '\n' || *ptr == '#')
50 continue; 50 continue;
51 51
52 // parse line 52 // parse line
53 char *usr = ptr; 53 char *usr = ptr;
54 char *args = strchr(usr, ':'); 54 char *args = strchr(usr, ':');
@@ -56,6 +56,7 @@ int restricted_shell(const char *user) {
56 fprintf(stderr, "Error: users.conf line %d\n", lineno); 56 fprintf(stderr, "Error: users.conf line %d\n", lineno);
57 exit(1); 57 exit(1);
58 } 58 }
59
59 *args = '\0'; 60 *args = '\0';
60 args++; 61 args++;
61 ptr = strchr(args, '\n'); 62 ptr = strchr(args, '\n');
@@ -70,6 +71,7 @@ int restricted_shell(const char *user) {
70 found = 1; 71 found = 1;
71 break; 72 break;
72 } 73 }
74 ptr2++;
73 } 75 }
74 if (!found) 76 if (!found)
75 continue; 77 continue;
@@ -82,16 +84,28 @@ int restricted_shell(const char *user) {
82 int i; 84 int i;
83 ptr = args; 85 ptr = args;
84 for (i = 1; i < MAX_ARGS; i++) { 86 for (i = 1; i < MAX_ARGS; i++) {
85 fullargv[i] = ptr; 87 // skip blanks
86 while (*ptr != ' ' && *ptr != '\t' && *ptr != '\0') 88 while (*ptr == ' ' || *ptr == '\t')
87 ptr++; 89 ptr++;
90 fullargv[i] = ptr;
91#ifdef DEBUG_RESTRICTED_SHELL
92 {EUID_ROOT();
93 FILE *fp = fopen("/firelog", "a");
94 if (fp) {
95 fprintf(fp, "i %d ptr #%s#\n", i, fullargv[i]);
96 fclose(fp);
97 }
98 EUID_USER();}
99#endif
100
88 if (*ptr != '\0') { 101 if (*ptr != '\0') {
102 // go to the end of the word
103 while (*ptr != ' ' && *ptr != '\t' && *ptr != '\0')
104 ptr++;
89 *ptr ='\0'; 105 *ptr ='\0';
90 fullargv[i] = strdup(fullargv[i]); 106 fullargv[i] = strdup(fullargv[i]);
91 if (fullargv[i] == NULL) { 107 if (fullargv[i] == NULL)
92 fprintf(stderr, "Error: cannot allocate memory\n"); 108 errExit("strdup");
93 exit(1);
94 }
95 ptr++; 109 ptr++;
96 while (*ptr == ' ' || *ptr == '\t') 110 while (*ptr == ' ' || *ptr == '\t')
97 ptr++; 111 ptr++;
@@ -107,7 +121,7 @@ int restricted_shell(const char *user) {
107 } 121 }
108 } 122 }
109 fclose(fp); 123 fclose(fp);
110 124
111 return 0; 125 return 0;
112} 126}
113 127
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 3e8b5f934..8178cfc8e 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -326,22 +326,26 @@ static void start_application(void) {
326 //**************************************** 326 //****************************************
327 else { 327 else {
328 assert(cfg.shell); 328 assert(cfg.shell);
329 assert(cfg.command_line);
329 330
330 char *arg[6]; 331 char *arg[5];
331 int index = 0; 332 int index = 0;
332 arg[index++] = cfg.shell; 333 arg[index++] = cfg.shell;
333 if (login_shell) 334 if (login_shell) {
334 arg[index++] = "-l"; 335 arg[index++] = "-l";
335 arg[index++] = "-c"; 336 if (arg_debug)
336 assert(cfg.command_line); 337 printf("Starting %s login shell\n", cfg.shell);
337 if (arg_debug) 338 } else {
338 printf("Starting %s\n", cfg.command_line); 339 arg[index++] = "-c";
339 if (arg_doubledash) 340 if (arg_debug)
340 arg[index++] = "--"; 341 printf("Running %s command through %s\n", cfg.command_line, cfg.shell);
341 arg[index++] = cfg.command_line; 342 if (arg_doubledash)
343 arg[index++] = "--";
344 arg[index++] = cfg.command_line;
345 }
342 arg[index] = NULL; 346 arg[index] = NULL;
343 assert(index < 5); 347 assert(index < 5);
344 348
345 if (arg_debug) { 349 if (arg_debug) {
346 char *msg; 350 char *msg;
347 if (asprintf(&msg, "sandbox %d, execvp into %s", sandbox_pid, cfg.command_line) == -1) 351 if (asprintf(&msg, "sandbox %d, execvp into %s", sandbox_pid, cfg.command_line) == -1)
@@ -349,7 +353,7 @@ static void start_application(void) {
349 logmsg(msg); 353 logmsg(msg);
350 free(msg); 354 free(msg);
351 } 355 }
352 356
353 if (arg_debug) { 357 if (arg_debug) {
354 int i; 358 int i;
355 for (i = 0; i < 5; i++) { 359 for (i = 0; i < 5; i++) {
@@ -358,12 +362,12 @@ static void start_application(void) {
358 printf("execvp argument %d: %s\n", i, arg[i]); 362 printf("execvp argument %d: %s\n", i, arg[i]);
359 } 363 }
360 } 364 }
361 365
362 if (!arg_command && !arg_quiet) 366 if (!arg_command && !arg_quiet)
363 printf("Child process initialized\n"); 367 printf("Child process initialized\n");
364 execvp(arg[0], arg); 368 execvp(arg[0], arg);
365 } 369 }
366 370
367 perror("execvp"); 371 perror("execvp");
368 exit(1); // it should never get here!!! 372 exit(1); // it should never get here!!!
369} 373}
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-12 11:06:50 +0000