diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/fs_whitelist.c | 28 | ||||
-rw-r--r-- | src/man/firejail.txt | 6 |
2 files changed, 18 insertions, 16 deletions
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c index ba6c8cd74..926e5415c 100644 --- a/src/firejail/fs_whitelist.c +++ b/src/firejail/fs_whitelist.c | |||
@@ -181,11 +181,15 @@ static void whitelist_path(ProfileEntry *entry) { | |||
181 | char *wfile = NULL; | 181 | char *wfile = NULL; |
182 | 182 | ||
183 | if (entry->home_dir) { | 183 | if (entry->home_dir) { |
184 | fname = path + strlen(cfg.homedir); | 184 | if (strncmp(path, cfg.homedir, strlen(cfg.homedir)) == 0) { |
185 | if (*fname == '\0') { | 185 | fname = path + strlen(cfg.homedir); |
186 | fprintf(stderr, "Error: file %s is not in user home directory, exiting...\n", path); | 186 | if (*fname == '\0') { |
187 | exit(1); | 187 | fprintf(stderr, "Error: file %s is not in user home directory, exiting...\n", path); |
188 | exit(1); | ||
189 | } | ||
188 | } | 190 | } |
191 | else | ||
192 | fname = path; | ||
189 | 193 | ||
190 | if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_HOME_USER_DIR, fname) == -1) | 194 | if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_HOME_USER_DIR, fname) == -1) |
191 | errExit("asprintf"); | 195 | errExit("asprintf"); |
@@ -248,9 +252,6 @@ static void whitelist_path(ProfileEntry *entry) { | |||
248 | printf("Whitelisting %s\n", path); | 252 | printf("Whitelisting %s\n", path); |
249 | } | 253 | } |
250 | else { | 254 | else { |
251 | if (arg_debug || arg_debug_whitelists) { | ||
252 | fprintf(stderr, "Warning (whitelisting): %s is an invalid file, skipping...\n", path); | ||
253 | } | ||
254 | return; | 255 | return; |
255 | } | 256 | } |
256 | 257 | ||
@@ -390,13 +391,14 @@ void fs_whitelist(void) { | |||
390 | 391 | ||
391 | entry->home_dir = 1; | 392 | entry->home_dir = 1; |
392 | home_dir = 1; | 393 | home_dir = 1; |
394 | if (arg_debug) | ||
395 | fprintf(stderr, "Debug %d: fname #%s#, cfg.homedir #%s#\n", | ||
396 | __LINE__, fname, cfg.homedir); | ||
397 | |||
393 | // both path and absolute path are under /home | 398 | // both path and absolute path are under /home |
394 | if (strncmp(fname, cfg.homedir, strlen(cfg.homedir)) != 0) { | 399 | // if (strncmp(fname, cfg.homedir, strlen(cfg.homedir)) != 0) { |
395 | if (arg_debug) | 400 | // goto errexit; |
396 | fprintf(stderr, "Debug %d: fname #%s#, cfg.homedir #%s#\n", | 401 | // } |
397 | __LINE__, fname, cfg.homedir); | ||
398 | goto errexit; | ||
399 | } | ||
400 | } | 402 | } |
401 | else if (strncmp(new_name, "/tmp/", 5) == 0) { | 403 | else if (strncmp(new_name, "/tmp/", 5) == 0) { |
402 | entry->tmp_dir = 1; | 404 | entry->tmp_dir = 1; |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index cd9ea6a8a..f7079200e 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -1515,14 +1515,14 @@ firejail version 0.9.27 | |||
1515 | .TP | 1515 | .TP |
1516 | \fB\-\-whitelist=dirname_or_filename | 1516 | \fB\-\-whitelist=dirname_or_filename |
1517 | Whitelist directory or file. This feature is implemented only for user home, /dev, /media, /opt, /var, and /tmp directories. | 1517 | Whitelist directory or file. This feature is implemented only for user home, /dev, /media, /opt, /var, and /tmp directories. |
1518 | When whitlisting symbolic links, both the link and the real file should be in the same top directory | 1518 | With the exeception of user home, both the link and the real file should be in |
1519 | (home user, /media, /var etc.) | 1519 | the same top directory. |
1520 | .br | 1520 | .br |
1521 | 1521 | ||
1522 | .br | 1522 | .br |
1523 | Example: | 1523 | Example: |
1524 | .br | 1524 | .br |
1525 | $ firejail \-\-whitelist=~/.mozilla \-\-whitelist=~/Downloads | 1525 | $ firejail \-\-noprofile \-\-whitelist=~/.mozilla |
1526 | .br | 1526 | .br |
1527 | $ firejail \-\-whitelist=/tmp/.X11-unix --whitelist=/dev/null | 1527 | $ firejail \-\-whitelist=/tmp/.X11-unix --whitelist=/dev/null |
1528 | .br | 1528 | .br |