7 files changed, 116 insertions, 70 deletions

diff --git a/src/fcopy/main.c b/src/fcopy/main.c
index 0a4a61e2a..e65501d6d 100644
--- a/src/fcopy/main.c
+++ b/src/fcopy/main.c
@@ -111,7 +111,7 @@ static void copy_file(const char *srcname, const char *destname, mode_t mode, ui
         }
 
         // open destination
-        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, 0755);
+        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR);
         if (dst < 0) {
                 if (!arg_quiet)
                         fprintf(stderr, "Warning fcopy: cannot open %s, file not copied\n", destname);
@@ -132,7 +132,8 @@ static void copy_file(const char *srcname, const char *destname, mode_t mode, ui
                         done += rv;
                 }
         }
-        fflush(0);
+        if (len < 0)
+                goto errexit;
 
         if (fchown(dst, uid, gid) == -1)
                 goto errexit;
@@ -179,7 +180,7 @@ void copy_link(const char *target, const char *linkpath, mode_t mode, uid_t uid,
 
         // if the link is already there, don't create it
         struct stat s;
-        if (stat(linkpath, &s) == 0)
+        if (lstat(linkpath, &s) == 0)
                return;
 
         char *rp = realpath(target, NULL);
@@ -413,25 +414,19 @@ int main(int argc, char **argv) {
 
         warn_dumpable();
 
-        // trim trailing chars
-        if (src[strlen(src) - 1] == '/')
-                src[strlen(src) - 1] = '\0';
-        if (dest[strlen(dest) - 1] == '/')
-                dest[strlen(dest) - 1] = '\0';
-
         // check the two files; remove ending /
-        int len = strlen(src);
-        if (src[len - 1] == '/')
-                src[len - 1] = '\0';
-        if (strcspn(src, "\\*&!?\"'<>%^(){}[];,") != (size_t)len) {
+        size_t len = strlen(src);
+        while (len > 1 && src[len - 1] == '/')
+                src[--len] = '\0';
+        if (strcspn(src, "\\*&!?\"'<>%^(){}[];,") != len) {
                 fprintf(stderr, "Error fcopy: invalid source file name %s\n", src);
                 exit(1);
         }
 
         len = strlen(dest);
-        if (dest[len - 1] == '/')
-                dest[len - 1] = '\0';
-        if (strcspn(dest, "\\*&!?\"'<>%^(){}[];,~") != (size_t)len) {
+        while (len > 1 && dest[len - 1] == '/')
+                dest[--len] = '\0';
+        if (strcspn(dest, "\\*&!?\"'<>%^(){}[];,~") != len) {
                 fprintf(stderr, "Error fcopy: invalid dest file name %s\n", dest);
                 exit(1);
         }
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 109f89f39..e924ef2ec 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -149,6 +149,7 @@ conkeror
 conky
 conplay
 corebird
+coyim
 crawl
 crawl-tiles
 crow
@@ -390,6 +391,7 @@ kazam
 kcalc
 # kdeinit4
 kdenlive
+kdiff3
 keepass
 keepass2
 keepassx
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index a5c005931..b8c1b21b1 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -33,6 +33,52 @@ extern void fslib_install_system(void);
 static int lib_cnt = 0;
 static int dir_cnt = 0;
 
+char *find_in_path(const char *program) {
+        EUID_ASSERT();
+        if (arg_debug)
+                printf("Searching $PATH for %s\n", program);
+
+        char self[MAXBUF];
+        ssize_t len = readlink("/proc/self/exe", self, MAXBUF - 1);
+        if (len < 0)
+                errExit("readlink");
+        self[len] = '\0';
+
+        char *path = getenv("PATH");
+        if (!path)
+                return NULL;
+        char *dup = strdup(path);
+        if (!dup)
+                errExit("strdup");
+        char *tok = strtok(dup, ":");
+        while (tok) {
+                char *fname;
+                if (asprintf(&fname, "%s/%s", tok, program) == -1)
+                        errExit("asprintf");
+
+                if (arg_debug)
+                        printf("trying #%s#\n", fname);
+                struct stat s;
+                if (stat(fname, &s) == 0) {
+                        // but skip links created by firecfg
+                        char *rp = realpath(fname, NULL);
+                        if (!rp)
+                                errExit("realpath");
+                        if (strcmp(self, rp) != 0) {
+                                free(rp);
+                                free(dup);
+                                return fname;
+                        }
+                        free(rp);
+                }
+                free(fname);
+                tok = strtok(NULL, ":");
+        }
+
+        free(dup);
+        return NULL;
+}
+
 static void report_duplication(const char *full_path) {
         char *fname = strrchr(full_path, '/');
         if (fname && *(++fname) != '\0') {
@@ -337,20 +383,39 @@ void fs_private_lib(void) {
         timetrace_start();
 
         // bring in firejail executable libraries in case we are redirected here by a firejail symlink from /usr/local/bin/firejail
+        if (arg_debug || arg_debug_private_lib)
+                printf("Installing Firejail libraries\n");
         fslib_install_list(PATH_FIREJAIL);
 
         // bring in firejail directory
-        fslib_install_list("firejail");
+        fslib_install_list(LIBDIR "/firejail");
 
-        // for dhclient
-        if (any_dhcp())
+        // bring in dhclient libraries
+        if (any_dhcp()) {
+                if (arg_debug || arg_debug_private_lib)
+                        printf("Installing dhclient libraries\n");
                 fslib_install_list(RUN_MNT_DIR "/dhclient");
+        }
+        fmessage("Firejail libraries installed in %0.2f ms\n", timetrace_end());
+
+        timetrace_start();
 
         // copy the libs in the new lib directory for the main exe
         if (cfg.original_program_index > 0) {
                 if (arg_debug || arg_debug_private_lib)
                         printf("Installing sandboxed program libraries\n");
-                fslib_install_list(cfg.original_argv[cfg.original_program_index]);
+
+                if (strchr(cfg.original_argv[cfg.original_program_index], '/'))
+                        fslib_install_list(cfg.original_argv[cfg.original_program_index]);
+                else { // search executable in $PATH
+                        EUID_USER();
+                        char *fname = find_in_path(cfg.original_argv[cfg.original_program_index]);
+                        EUID_ROOT();
+                        if (fname) {
+                                fslib_install_list(fname);
+                                free(fname);
+                        }
+                }
         }
 
         // for the shell
@@ -379,7 +444,7 @@ void fs_private_lib(void) {
         }
         fmessage("Program libraries installed in %0.2f ms\n", timetrace_end());
 
-        // install the reset of the system libraries
+        // install the rest of the system libraries
         if (arg_debug || arg_debug_private_lib)
                 printf("Installing system libraries\n");
         fslib_install_system();
diff --git a/src/firejail/fs_lib2.c b/src/firejail/fs_lib2.c
index 758e079a4..95e10ee05 100644
--- a/src/firejail/fs_lib2.c
+++ b/src/firejail/fs_lib2.c
@@ -108,18 +108,13 @@ void fslib_install_stdc(void) {
         // install standard C libraries
         timetrace_start();
         struct stat s;
-        char *stdclib = "/lib64";                 // CentOS, Fedora, Arch
-
         if (stat("/lib/x86_64-linux-gnu", &s) == 0) {   // Debian & friends
-                // PT_INTERP
-                fslib_duplicate("/lib64/ld-linux-x86-64.so.2");
-
                 mkdir_attr(RUN_LIB_DIR "/x86_64-linux-gnu", 0755, 0, 0);
                 selinux_relabel_path(RUN_LIB_DIR "/x86_64-linux-gnu", "/lib/x86_64-linux-gnu");
-                stdclib = "/lib/x86_64-linux-gnu";
+                stdc("/lib/x86_64-linux-gnu");
         }
 
-        stdc(stdclib);
+        stdc("/lib64"); // CentOS, Fedora, Arch, ld-linux.so in Debian & friends
 
         // install locale
         if (stat("/usr/lib/locale", &s) == 0)
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c
index ea3889024..b38cc0ca6 100644
--- a/src/firejail/run_symlink.c
+++ b/src/firejail/run_symlink.c
@@ -22,6 +22,8 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
+extern char *find_in_path(const char *program);
+
 void run_symlink(int argc, char **argv, int run_as_is) {
         EUID_ASSERT();
 
@@ -40,54 +42,17 @@ void run_symlink(int argc, char **argv, int run_as_is) {
                 errExit("setresuid");
 
         // find the real program by looking in PATH
-        char *p = getenv("PATH");
-        if (!p) {
+        if (!getenv("PATH")) {
                 fprintf(stderr, "Error: PATH environment variable not set\n");
                 exit(1);
         }
 
-        char *path = strdup(p);
-        if (!path)
-                errExit("strdup");
-
-        char *selfpath = realpath("/proc/self/exe", NULL);
-        if (!selfpath)
-                errExit("realpath");
-
-        // look in path for our program
-        char *tok = strtok(path, ":");
-        int found = 0;
-        while (tok) {
-                char *name;
-                if (asprintf(&name, "%s/%s", tok, program) == -1)
-                        errExit("asprintf");
-
-                struct stat s;
-                if (stat(name, &s) == 0) {
-                        /* coverity[toctou] */
-                        char* rp = realpath(name, NULL);
-                        if (!rp)
-                                errExit("realpath");
-
-                        if (strcmp(selfpath, rp) != 0) {
-                                program = strdup(name);
-                                found = 1;
-                                free(rp);
-                                break;
-                        }
-
-                        free(rp);
-                }
-
-                free(name);
-                tok = strtok(NULL, ":");
-        }
-        if (!found) {
+        char *p = find_in_path(program);
+        if (!p) {
                 fprintf(stderr, "Error: cannot find the program in the path\n");
                 exit(1);
         }
-
-        free(selfpath);
+        program = p;
 
         // restore original umask
         umask(orig_umask);
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index e72ef48c2..8958dfaee 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1317,7 +1317,7 @@ $ firejail --netfilter=/etc/firejail/webserver.net --net=eth0 \\
 .br
 
 .br
-.B nolocal.net
+.B nolocal.net/nolocal6.net
 is a desktop client firewall that disable access to local network. Example:
 .br
 
diff --git a/src/profstats/main.c b/src/profstats/main.c
index 4c1221464..68f62831b 100644
--- a/src/profstats/main.c
+++ b/src/profstats/main.c
@@ -30,6 +30,8 @@ static int cnt_seccomp = 0;
 static int cnt_caps = 0;
 static int cnt_dbus_system_none = 0;
 static int cnt_dbus_user_none = 0;
+static int cnt_dbus_system_filter = 0;
+static int cnt_dbus_user_filter = 0;
 static int cnt_dotlocal = 0;
 static int cnt_globalsdotlocal = 0;
 static int cnt_netnone = 0;
@@ -107,6 +109,7 @@ void process_file(const char *fname) {
                 return;
         }
 
+        int have_include_local = 0;
         char buf[MAXBUF];
         while (fgets(buf, MAXBUF, fp)) {
                 char *ptr = strchr(buf, '\n');
@@ -152,11 +155,16 @@ void process_file(const char *fname) {
                         cnt_privateetc++;
                 else if (strncmp(ptr, "dbus-system none", 16) == 0)
                         cnt_dbus_system_none++;
+                else if (strncmp(ptr, "dbus-system", 11) == 0)
+                        cnt_dbus_system_filter++;
                 else if (strncmp(ptr, "dbus-user none", 14) == 0)
                         cnt_dbus_user_none++;
+                else if (strncmp(ptr, "dbus-user", 9) == 0)
+                        cnt_dbus_user_filter++;
                 else if (strncmp(ptr, "include ", 8) == 0) {
                         // not processing .local files
                         if (strstr(ptr, ".local")) {
+                                have_include_local = 1;
 //printf("dotlocal %d, level %d - #%s#, redirect #%s#\n", cnt_dotlocal, level, fname, buf + 8);
                                 if (strstr(ptr, "globals.local"))
                                         cnt_globalsdotlocal++;
@@ -174,6 +182,8 @@ void process_file(const char *fname) {
         }
 
         fclose(fp);
+        if (!have_include_local)
+                printf("No include .local found in %s\n", fname);
         level--;
 }
 
@@ -257,7 +267,9 @@ int main(int argc, char **argv) {
                 int whitelistrunuser = cnt_whitelistrunuser;
                 int whitelistusrshare = cnt_whitelistusrshare;
                 int dbussystemnone = cnt_dbus_system_none;
+                int dbussystemfilter = cnt_dbus_system_filter;
                 int dbususernone = cnt_dbus_user_none;
+                int dbususerfilter = cnt_dbus_user_filter;
                 int ssh = cnt_ssh;
                 int mdwx = cnt_mdwx;
 
@@ -278,6 +290,16 @@ int main(int argc, char **argv) {
                         cnt_globalsdotlocal = globalsdotlocal + 1;
                 if (cnt_whitelistrunuser > (whitelistrunuser + 1))
                         cnt_whitelistrunuser = whitelistrunuser + 1;
+                if (cnt_seccomp > (seccomp + 1))
+                        cnt_seccomp = seccomp + 1;
+                if (cnt_dbus_user_none > (dbususernone + 1))
+                        cnt_dbus_user_none = dbususernone + 1;
+                if (cnt_dbus_user_filter > (dbususerfilter + 1))
+                        cnt_dbus_user_filter = dbususerfilter + 1;
+                if (cnt_dbus_system_none > (dbussystemnone + 1))
+                        cnt_dbus_system_none = dbussystemnone + 1;
+                if (cnt_dbus_system_filter > (dbussystemfilter + 1))
+                        cnt_dbus_system_filter = dbussystemfilter + 1;
 
                 if (arg_dbus_system_none && dbussystemnone == cnt_dbus_system_none)
                         printf("No dbus-system none found in %s\n", argv[i]);
@@ -337,7 +359,9 @@ int main(int argc, char **argv) {
         printf("    whitelist usr/share\t\t%d   (include whitelist-usr-share-common.inc\n", cnt_whitelistusrshare);
         printf("    net none\t\t\t%d\n", cnt_netnone);
         printf("    dbus-user none \t\t%d\n", cnt_dbus_user_none);
+        printf("    dbus-user filter \t\t%d\n", cnt_dbus_user_filter);
         printf("    dbus-system none \t\t%d\n", cnt_dbus_system_none);
+        printf("    dbus-system filter \t\t%d\n", cnt_dbus_system_filter);
         printf("\n");
         return 0;
 }