10 files changed, 168 insertions, 146 deletions

diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c
index b08afb939..1b8231033 100644
--- a/src/fbuilder/build_fs.c
+++ b/src/fbuilder/build_fs.c
@@ -165,10 +165,12 @@ void build_var(const char *fname, FILE *fp) {
 
         process_files(fname, "/var", var_callback);
 
-        if (var_out == NULL)
+        if (var_out == NULL) {
                 fprintf(fp, "blacklist /var\n");
-        else
+        } else {
                 filedb_print(var_out, "whitelist ", fp);
+                fprintf(fp, "include whitelist-var-common.inc\n");
+        }
 }
 
 
@@ -202,10 +204,12 @@ void build_share(const char *fname, FILE *fp) {
 
         process_files(fname, "/usr/share", share_callback);
 
-        if (share_out == NULL)
+        if (share_out == NULL) {
                 fprintf(fp, "blacklist /usr/share\n");
-        else
+        } else {
                 filedb_print(share_out, "whitelist ", fp);
+                fprintf(fp, "include whitelist-usr-share-common.inc\n");
+        }
 }
 
 //*******************************************
diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c
index 8db17a942..fca3396c4 100644
--- a/src/fbuilder/build_home.c
+++ b/src/fbuilder/build_home.c
@@ -32,9 +32,9 @@ static void load_whitelist_common(void) {
 
         char buf[MAX_BUF];
         while (fgets(buf, MAX_BUF, fp)) {
-                if (strncmp(buf, "whitelist ~/", 12) != 0)
+                if (strncmp(buf, "whitelist ${HOME}/", 18) != 0)
                         continue;
-                char *fn = buf + 12;
+                char *fn = buf + 18;
                 char *ptr = strchr(buf, '\n');
                 if (!ptr)
                         continue;
@@ -190,8 +190,8 @@ void build_home(const char *fname, FILE *fp) {
 
         // print the out list if any
         if (db_out) {
-                filedb_print(db_out, "whitelist ~/", fp);
-                fprintf(fp, "include /etc/firejail/whitelist-common.inc\n");
+                filedb_print(db_out, "whitelist ${HOME}/", fp);
+                fprintf(fp, "include whitelist-common.inc\n");
         }
         else
                 fprintf(fp, "private\n");
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index ea9e9a4a0..adc00e67b 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -131,18 +131,21 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
                 if (fp == stdout)
                         printf("--- Built profile beings after this line ---\n");
-                fprintf(fp, "############################################\n");
-                fprintf(fp, "# %s profile\n", argv[index]);
-                fprintf(fp, "############################################\n");
+                fprintf(fp, "# Firejail profile for %s\n", argv[index]);
+                fprintf(fp, "# Persistent local customizations\n");
+                fprintf(fp, "#include %s.local\n", argv[index]);
                 fprintf(fp, "# Persistent global definitions\n");
-                fprintf(fp, "# include /etc/firejail/globals.local\n");
+                fprintf(fp, "#include globals.local\n");
                 fprintf(fp, "\n");
 
                 fprintf(fp, "### basic blacklisting\n");
-                fprintf(fp, "include /etc/firejail/disable-common.inc\n");
-                fprintf(fp, "# include /etc/firejail/disable-devel.inc\n");
-                fprintf(fp, "include /etc/firejail/disable-passwdmgr.inc\n");
-                fprintf(fp, "# include /etc/firejail/disable-programs.inc\n");
+                fprintf(fp, "include disable-common.inc\n");
+                fprintf(fp, "# include disable-devel.inc\n");
+                fprintf(fp, "# include disable-exec.inc\n");
+                fprintf(fp, "# include disable-interpreters.inc\n");
+                fprintf(fp, "include disable-passwdmgr.inc\n");
+                fprintf(fp, "# include disable-programs.inc\n");
+                fprintf(fp, "# include disable-xdg.inc\n");
                 fprintf(fp, "\n");
 
                 fprintf(fp, "### home directory whitelisting\n");
@@ -150,12 +153,19 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
                 fprintf(fp, "\n");
 
                 fprintf(fp, "### filesystem\n");
-                build_tmp(trace_output, fp);
-                build_dev(trace_output, fp);
-                build_etc(trace_output, fp);
+                fprintf(fp, "# /usr/share:\n");
+                build_share(trace_output, fp);
+                fprintf(fp, "# /var:\n");
                 build_var(trace_output, fp);
+                fprintf(fp, "\n");
+                fprintf(fp, "# $PATH:\n");
                 build_bin(trace_output, fp);
-                build_share(trace_output, fp);
+                fprintf(fp, "# /dev:\n");
+                build_dev(trace_output, fp);
+                fprintf(fp, "# /etc:\n");
+                build_etc(trace_output, fp);
+                fprintf(fp, "# /tmp:\n");
+                build_tmp(trace_output, fp);
                 fprintf(fp, "\n");
 
                 fprintf(fp, "### security filters\n");
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index a19819552..313f796b9 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -346,6 +346,7 @@ jd-gui
 jdownloader
 jerry
 jitsi
+jitsi-meet-desktop
 jumpnbump
 jumpnbump-menu
 k3b
@@ -492,6 +493,7 @@ neverputt
 newsbeuter
 newsboat
 nheko
+nicotine
 nitroshare
 nitroshare-cli
 nitroshare-nmh
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index dbc74bfff..ff6d78bf2 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -352,20 +352,6 @@ void fs_private(void) {
         int xflag = store_xauthority();
         int aflag = store_asoundrc();
 
-        // mask /home
-        if (u == 0 && arg_allusers) // allow --allusers when starting the sandbox as root
-                ;
-        else {
-                if (arg_debug)
-                        printf("Mounting a new /home directory\n");
-                if (arg_allusers)
-                        fwarning("allusers option disabled by private or whitelist option\n");
-                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mounting /home directory");
-                selinux_relabel_path("/home", "/home");
-                fs_logger("tmpfs /home");
-        }
-
         // mask /root
         if (arg_debug)
                 printf("Mounting a new /root directory\n");
@@ -373,28 +359,39 @@ void fs_private(void) {
                 errExit("mounting /root directory");
         fs_logger("tmpfs /root");
 
-        if (u != 0) {
-                if (strncmp(homedir, "/home/", 6) == 0) {
-                        // create /home/user
-                        if (arg_debug)
-                                printf("Create a new user directory\n");
-                        if (mkdir(homedir, S_IRWXU) == -1) {
-                                if (mkpath_as_root(homedir) == -1)
-                                        errExit("mkpath");
-                                if (mkdir(homedir, S_IRWXU) == -1 && errno != EEXIST)
-                                        errExit("mkdir");
-                        }
-                        if (chown(homedir, u, g) < 0)
-                                errExit("chown");
-                        selinux_relabel_path(homedir, homedir);
+        if (arg_allusers) {
+                if (u != 0)
+                        fs_tmpfs(homedir, 1); // check if directory is owned by the current user
+        }
+        else { // mask /home
+                if (arg_debug)
+                        printf("Mounting a new /home directory\n");
+                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME,  "mode=755,gid=0") < 0)
+                        errExit("mounting /home directory");
+                selinux_relabel_path("/home", "/home");
+                fs_logger("tmpfs /home");
 
-                        fs_logger2("mkdir", homedir);
-                        fs_logger2("tmpfs", homedir);
+                if (u != 0) {
+                        if (strncmp(homedir, "/home/", 6) == 0) {
+                                // create /home/user
+                                if (arg_debug)
+                                        printf("Create a new user directory\n");
+                                if (mkdir(homedir, S_IRWXU) == -1) {
+                                        if (mkpath_as_root(homedir) == -1)
+                                                errExit("mkpath");
+                                        if (mkdir(homedir, S_IRWXU) == -1 && errno != EEXIST)
+                                                errExit("mkdir");
+                                }
+                                if (chown(homedir, u, g) < 0)
+                                        errExit("chown");
+
+                                selinux_relabel_path(homedir, homedir);
+                                fs_logger2("mkdir", homedir);
+                                fs_logger2("tmpfs", homedir);
+                        }
+                        else
+                                fs_tmpfs(homedir, 1); // check if directory is owned by the current user
                 }
-                else
-                        // user directory is outside /home, mask it as well
-                        // check if directory is owned by the current user
-                        fs_tmpfs(homedir, 1);
         }
 
         skel(homedir, u, g);
@@ -518,7 +515,7 @@ static void duplicate(char *name) {
                 ptr++;
                 if (asprintf(&path, "%s/%s", RUN_HOME_DIR, ptr) == -1)
                         errExit("asprintf");
-                mkdir_attr(path, 0755, getuid(), getgid());
+                create_empty_dir_as_user(path, 0755);
                 sbox_run(SBOX_USER| SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FCOPY, fname, path);
                 free(path);
         }
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index a8fb838ab..b4df78dda 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -27,7 +27,7 @@
 
 #include <fcntl.h>
 #ifndef O_PATH
-# define O_PATH 010000000
+#define O_PATH 010000000
 #endif
 
 // disable pulseaudio socket
@@ -72,8 +72,13 @@ void pulseaudio_disable(void) {
         closedir(dir);
 }
 
+static void pulseaudio_set_environment(const char *path) {
+        assert(path);
+        if (setenv("PULSE_CLIENTCONFIG", path, 1) < 0)
+                errExit("setenv");
+}
 
-// disable shm in pulseaudio
+// disable shm in pulseaudio (issue #69)
 void pulseaudio_init(void) {
         struct stat s;
 
@@ -108,84 +113,63 @@ void pulseaudio_init(void) {
                 errExit("set_perms");
 
         // create ~/.config/pulse directory if not present
-        char *homeusercfg;
+        char *homeusercfg = NULL;
         if (asprintf(&homeusercfg, "%s/.config", cfg.homedir) == -1)
                 errExit("asprintf");
-        if (lstat(homeusercfg, &s) == -1) {
-                if (create_empty_dir_as_user(homeusercfg, 0700))
-                        fs_logger2("create", homeusercfg);
-        }
-        else if (!S_ISDIR(s.st_mode)) {
-                if (S_ISLNK(s.st_mode))
-                        fprintf(stderr, "Error: %s is a symbolic link\n", homeusercfg);
-                else
-                        fprintf(stderr, "Error: %s is not a directory\n", homeusercfg);
-                exit(1);
-        }
-        free(homeusercfg);
+        if (create_empty_dir_as_user(homeusercfg, 0700))
+                fs_logger2("create", homeusercfg);
 
+        free(homeusercfg);
         if (asprintf(&homeusercfg, "%s/.config/pulse", cfg.homedir) == -1)
                 errExit("asprintf");
-        if (lstat(homeusercfg, &s) == -1) {
-                if (create_empty_dir_as_user(homeusercfg, 0700))
-                        fs_logger2("create", homeusercfg);
-        }
-        else if (!S_ISDIR(s.st_mode)) {
-                if (S_ISLNK(s.st_mode))
-                        fprintf(stderr, "Error: %s is a symbolic link\n", homeusercfg);
-                else
-                        fprintf(stderr, "Error: %s is not a directory\n", homeusercfg);
-                exit(1);
+        if (create_empty_dir_as_user(homeusercfg, 0700))
+                fs_logger2("create", homeusercfg);
+
+        // if ~/.config/pulse now exists and there are no symbolic links, mount the new directory
+        // else set environment variable
+        int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        if (fd == -1) {
+                pulseaudio_set_environment(pulsecfg);
+                goto out;
         }
-
-        // if we have ~/.config/pulse mount the new directory, else set environment variable.
-        if (stat(homeusercfg, &s) == 0) {
-                // get a file descriptor for ~/.config/pulse, fails if there is any symlink
-                int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-                if (fd == -1)
-                        errExit("safe_fd");
-                // confirm the actual mount destination is owned by the user
-                if (fstat(fd, &s) == -1)
-                        errExit("fstat");
-                if (s.st_uid != getuid()) {
-                        fprintf(stderr, "Error: %s is not owned by the current user\n", homeusercfg);
-                        exit(1);
-                }
-                // preserve a read-only mount
-                struct statvfs vfs;
-                if (fstatvfs(fd, &vfs) == -1)
-                        errExit("fstatvfs");
-                if ((vfs.f_flag & MS_RDONLY) == MS_RDONLY)
-                        fs_remount(RUN_PULSE_DIR, MOUNT_READONLY, 0);
-                // mount via the link in /proc/self/fd
-                if (arg_debug)
-                        printf("Mounting %s on %s\n", RUN_PULSE_DIR, homeusercfg);
-                char *proc;
-                if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                        errExit("asprintf");
-                if (mount(RUN_PULSE_DIR, proc, "none", MS_BIND, NULL) < 0)
-                        errExit("mount pulseaudio");
-                fs_logger2("tmpfs", homeusercfg);
-                free(proc);
+        // confirm the actual mount destination is owned by the user
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (s.st_uid != getuid()) {
                 close(fd);
-                // check /proc/self/mountinfo to confirm the mount is ok
-                MountData *mptr = get_last_mount();
-                if (strcmp(mptr->dir, homeusercfg) != 0 || strcmp(mptr->fstype, "tmpfs") != 0)
-                        errLogExit("invalid pulseaudio mount");
-
-                char *p;
-                if (asprintf(&p, "%s/client.conf", homeusercfg) == -1)
-                        errExit("asprintf");
-                fs_logger2("create", p);
-                free(p);
-        }
-
-        else {
-                // set environment
-                if (setenv("PULSE_CLIENTCONFIG", pulsecfg, 1) < 0)
-                        errExit("setenv");
+                pulseaudio_set_environment(pulsecfg);
+                goto out;
         }
+        // preserve a read-only mount
+        struct statvfs vfs;
+        if (fstatvfs(fd, &vfs) == -1)
+                errExit("fstatvfs");
+        if ((vfs.f_flag & MS_RDONLY) == MS_RDONLY)
+                fs_remount(RUN_PULSE_DIR, MOUNT_READONLY, 0);
+        // mount via the link in /proc/self/fd
+        if (arg_debug)
+                printf("Mounting %s on %s\n", RUN_PULSE_DIR, homeusercfg);
+        char *proc;
+        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
+                errExit("asprintf");
+        if (mount(RUN_PULSE_DIR, proc, "none", MS_BIND, NULL) < 0)
+                errExit("mount pulseaudio");
+        // check /proc/self/mountinfo to confirm the mount is ok
+        MountData *mptr = get_last_mount();
+        if (strcmp(mptr->dir, homeusercfg) != 0 || strcmp(mptr->fstype, "tmpfs") != 0)
+                errLogExit("invalid pulseaudio mount");
+        fs_logger2("tmpfs", homeusercfg);
+        free(proc);
+        close(fd);
+
+        char *p;
+        if (asprintf(&p, "%s/client.conf", homeusercfg) == -1)
+                errExit("asprintf");
+        fs_logger2("create", p);
+        pulseaudio_set_environment(p);
+        free(p);
 
+out:
         free(pulsecfg);
         free(homeusercfg);
 }
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index 5ebb0e9ec..804b45339 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -29,7 +29,7 @@
 
 #include <fcntl.h>
 #ifndef O_PATH
-# define O_PATH 010000000
+#define O_PATH 010000000
 #endif
 
 #define MAXBUF 1024
@@ -68,24 +68,25 @@ static USER_LIST *ulist_find(const char *user) {
 
 static void sanitize_home(void) {
         assert(getuid() != 0);  // this code works only for regular users
+        struct stat s;
 
         if (arg_debug)
                 printf("Cleaning /home directory\n");
 
-        struct stat s;
-        if (stat(cfg.homedir, &s) == -1) {
-                // cannot find home directory, just return
-                fwarning("cannot find home directory\n");
-                return;
-        }
-
         if (mkdir(RUN_WHITELIST_HOME_DIR, 0755) == -1)
                 errExit("mkdir");
 
         // keep a copy of the user home directory
         int fd = safe_fd(cfg.homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-        if (fd == -1)
-                errExit("safe_fd");
+        if (fd == -1) {
+                if (errno == ENOENT)
+                        fwarning("cannot find user home directory\n");
+                else
+                        fwarning("cannot clean /home directory\n");
+                return;
+        }
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
         char *proc;
         if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
                 errExit("asprintf");
@@ -167,7 +168,7 @@ static void sanitize_run(void) {
         if (set_perms(runuser, getuid(), getgid(), 0700))
                 errExit("set_perms");
 
-        // mount user home directory
+        // mount /run/user/$UID directory
         if (mount(RUN_WHITELIST_RUN_DIR, runuser, NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind");
 
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 37d108750..631f721ad 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -198,6 +198,32 @@ static FILE *create_ready_for_join_file(void) {
         }
 }
 
+#ifdef HAVE_SECCOMP
+static void seccomp_debug(void) {
+        if (arg_debug == 0)
+                return;
+
+        pid_t child = fork();
+        if (child < 0)
+                errExit("fork");
+        if (child == 0) {
+                // dropping privs before calling system(3)
+                drop_privs(1);
+                printf("Seccomp directory:\n");
+                int rv = system("ls -l "  RUN_SECCOMP_DIR);
+                (void) rv;
+                printf("Active seccomp files:\n");
+                rv = system("cat " RUN_SECCOMP_LIST);
+                (void) rv;
+#ifdef HAVE_GCOV
+                __gcov_flush();
+#endif
+                _exit(0);
+        }
+        waitpid(child, NULL, 0);
+}
+#endif
+
 static void sandbox_if_up(Bridge *br) {
         assert(br);
         if (!br->configured)
@@ -1136,14 +1162,7 @@ int sandbox(void* sandbox_arg) {
 
         // make seccomp filters read-only
         fs_remount(RUN_SECCOMP_DIR, MOUNT_READONLY, 0);
-        if (arg_debug) {
-                printf("Seccomp directory:\n");
-                int rv = system("ls -l "  RUN_SECCOMP_DIR);
-                (void) rv;
-                printf("Active seccomp files:\n");
-                rv = system("cat " RUN_SECCOMP_LIST);
-                (void) rv;
-        }
+        seccomp_debug();
 #endif
 
         // set capabilities
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index e7fa267d8..91c658f96 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -32,6 +32,7 @@
 #endif
 
 static int sbox_do_exec_v(unsigned filtermask, char * const arg[]) {
+        // build a new, clean environment
         int env_index = 0;
         char *new_environment[256] = { NULL };
         // preserve firejail-specific env vars
@@ -40,7 +41,6 @@ static int sbox_do_exec_v(unsigned filtermask, char * const arg[]) {
                 if (asprintf(&new_environment[env_index++], "FIREJAIL_FILE_COPY_LIMIT=%s", cl) == -1)
                         errExit("asprintf");
         }
-        clearenv();
         if (arg_quiet) // --quiet is passed as an environment variable
                 new_environment[env_index++] = "FIREJAIL_QUIET=yes";
         if (arg_debug) // --debug is passed as an environment variable
@@ -123,6 +123,9 @@ static int sbox_do_exec_v(unsigned filtermask, char * const arg[]) {
 #ifdef SYS_mount
                         BLACKLIST(SYS_mount), // mount/unmount filesystems
 #endif
+#ifdef SYS_umount
+                        BLACKLIST(SYS_umount),
+#endif
 #ifdef SYS_umount2
                         BLACKLIST(SYS_umount2),
 #endif
diff --git a/src/profstats/main.c b/src/profstats/main.c
index b94fdd213..a75ad8e29 100644
--- a/src/profstats/main.c
+++ b/src/profstats/main.c
@@ -246,6 +246,8 @@ int main(int argc, char **argv) {
                         cnt_dotlocal = dotlocal + 1;
                 if (cnt_globalsdotlocal > (globalsdotlocal + 1))
                         cnt_globalsdotlocal = globalsdotlocal + 1;
+                if (cnt_whitelistrunuser > (whitelistrunuser + 1))
+                        cnt_whitelistrunuser = whitelistrunuser + 1;
 
                 if (arg_apparmor && apparmor == cnt_apparmor)
                         printf("No apparmor found in %s\n", argv[i]);