15 files changed, 106 insertions, 34 deletions

diff --git a/src/fcopy/main.c b/src/fcopy/main.c
index e7b4ffa8a..cbb551125 100644
--- a/src/fcopy/main.c
+++ b/src/fcopy/main.c
@@ -41,6 +41,11 @@ static void copy_file(const char *srcname, const char *destname, mode_t mode, ui
         assert(destname);
         mode &= 07777;
 
+        // don't copy the file if it is already there
+        struct stat s;
+        if (stat(destname, &s) == 0)
+                return;
+
         // open source
         int src = open(srcname, O_RDONLY);
         if (src < 0) {
@@ -113,10 +118,18 @@ void copy_link(const char *target, const char *linkpath, mode_t mode, uid_t uid,
         (void) mode;
         (void) uid;
         (void) gid;
+
+        // if the link is already there, don't create it
+        struct stat s;
+        if (stat(linkpath, &s) == 0)
+               return;  
+
         char *rp = realpath(target, NULL);
         if (rp) {
-                if (symlink(rp, linkpath) == -1)
+                if (symlink(rp, linkpath) == -1) {
+                        free(rp);
                         goto errout;
+                }
                 free(rp);
         }
         else
@@ -129,6 +142,7 @@ errout:
 }
 
 
+
 static int first = 1;
 static int fs_copydir(const char *infname, const struct stat *st, int ftype, struct FTW *sftw) {
         (void) st;
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 0f7ab40ff..2a045f628 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -45,7 +45,7 @@ void appimage_set(const char *appimage) {
 
 #ifdef LOOP_CTL_GET_FREE
         // check appimage file
-        invalid_filename(appimage);
+        invalid_filename(appimage, 0); // no globbing
         if (access(appimage, R_OK) == -1) {
                 fprintf(stderr, "Error: cannot access AppImage file\n");
                 exit(1);
diff --git a/src/firejail/cgroup.c b/src/firejail/cgroup.c
index 70f07dd23..8d6496aab 100644
--- a/src/firejail/cgroup.c
+++ b/src/firejail/cgroup.c
@@ -72,7 +72,7 @@ errout:
 void set_cgroup(const char *path) {
         EUID_ASSERT();
 
-        invalid_filename(path);
+        invalid_filename(path, 0); // no globbing
 
         // path starts with /sys/fs/cgroup
         if (strncmp(path, "/sys/fs/cgroup", 14) != 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index b9eb68fb0..e10a5d346 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -499,7 +499,7 @@ void notify_other(int fd);
 char *expand_home(const char *path, const char* homedir);
 const char *gnu_basename(const char *path);
 uid_t pid_get_uid(pid_t pid);
-void invalid_filename(const char *fname);
+void invalid_filename(const char *fname, int globbing);
 uid_t get_group_id(const char *group);
 int remove_directory(const char *path);
 void flush_stdin(void);
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 9aa227caf..6bd7ecd17 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -23,6 +23,7 @@
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <unistd.h>
+#include <glob.h>
 
 static char *paths[] = {
         "/usr/local/bin",
@@ -146,11 +147,13 @@ errexit:
 }
 
 static void duplicate(char *fname, FILE *fplist) {
+        assert(fname);
+
         if (*fname == '~' || strstr(fname, "..")) {
                 fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
 
         char *full_path;
         if (*fname == '/') {
@@ -203,6 +206,52 @@ static void duplicate(char *fname, FILE *fplist) {
         free(full_path);
 }
 
+static void globbing(char *fname, FILE *fplist) {
+        assert(fname);
+
+        // go directly to duplicate() if no globbing char is present - see man 7 glob
+        if (strrchr(fname, '*') == NULL &&
+            strrchr(fname, '[') == NULL &&
+            strrchr(fname, '?') == NULL)
+                return duplicate(fname, fplist);
+
+        // loop through paths[]
+        int i = 0;
+        while (paths[i]) {
+                // private-bin-no-local can be disabled in /etc/firejail/firejail.config
+                if (checkcfg(CFG_PRIVATE_BIN_NO_LOCAL) && strstr(paths[i], "local/")) {
+                        i++;
+                        continue;
+                }
+
+                // check file
+                char *pattern;
+                if (asprintf(&pattern, "%s/%s", paths[i], fname) == -1)
+                        errExit("asprintf");
+
+                // globbing
+                glob_t globbuf;
+                int globerr = glob(pattern, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf);
+                if (globerr) {
+                        fprintf(stderr, "Error: failed to glob private-bin pattern %s\n", pattern);
+                        exit(1);
+                }
+
+                size_t j;
+                for (j = 0; j < globbuf.gl_pathc; j++) {
+                        assert(globbuf.gl_pathv[j]);
+                        // testing for GLOB_NOCHECK - no pattern matched returns the original pattern
+                        if (strcmp(globbuf.gl_pathv[j], pattern) == 0)
+                                continue;
+
+                        duplicate(globbuf.gl_pathv[j], fplist);
+                }
+
+                globfree(&globbuf);
+                free(pattern);
+                i++;
+        }
+}
 
 void fs_private_bin_list(void) {
         char *private_list = cfg.bin_private_keep;
@@ -228,9 +277,9 @@ void fs_private_bin_list(void) {
         }
 
         char *ptr = strtok(dlist, ",");
-        duplicate(ptr, fplist);
+        globbing(ptr, fplist);
         while ((ptr = strtok(NULL, ",")) != NULL)
-                duplicate(ptr, fplist);
+                globbing(ptr, fplist);
         free(dlist);
         fs_logger_print();
         if (fplist)
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index b0835d50b..9502844b2 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -103,7 +103,7 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
                 fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
 
         char *src;
         if (asprintf(&src,  "%s/%s", private_dir, fname) == -1)
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 9e3678c33..0de003e58 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -325,7 +325,7 @@ void fs_private(void) {
 // check new private home directory (--private= option) - exit if it fails
 void fs_check_private_dir(void) {
         EUID_ASSERT();
-        invalid_filename(cfg.home_private);
+        invalid_filename(cfg.home_private, 0); // no globbing
 
         // Expand the home directory
         char *tmp = expand_home(cfg.home_private, cfg.homedir);
@@ -367,7 +367,7 @@ static char *check_dir_or_file(const char *name) {
         assert(name);
 
         // basic checks
-        invalid_filename(name);
+        invalid_filename(name, 0); // no globbing
         if (arg_debug)
                 printf("Private home: checking %s\n", name);
 
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index 42255070c..0cf715fe2 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -129,7 +129,7 @@ void fs_resolvconf(void) {
 
 char *fs_check_hosts_file(const char *fname) {
         assert(fname);
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
         char *rv = expand_home(fname, cfg.homedir);
 
         // no a link
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c
index 20ffe825a..7975ae323 100644
--- a/src/firejail/fs_mkdir.c
+++ b/src/firejail/fs_mkdir.c
@@ -59,7 +59,7 @@ void fs_mkdir(const char *name) {
         EUID_ASSERT();
 
         // check directory name
-        invalid_filename(name);
+        invalid_filename(name, 0); // no globbing
         char *expanded = expand_home(name, cfg.homedir);
         if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 &&
             strncmp(expanded, "/tmp", 4) != 0) {
@@ -99,7 +99,7 @@ void fs_mkfile(const char *name) {
         EUID_ASSERT();
 
         // check file name
-        invalid_filename(name);
+        invalid_filename(name, 0); // no globbing
         char *expanded = expand_home(name, cfg.homedir);
         if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 &&
             strncmp(expanded, "/tmp", 4) != 0) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 54cbf1526..458bba6f6 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -572,7 +572,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                                 exit(1);
                         }
                         char *path = argv[i + 1];
-                         invalid_filename(path);
+                         invalid_filename(path, 0); // no globbing
                          if (strstr(path, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path);
                                 exit(1);
@@ -596,13 +596,13 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                                 exit(1);
                         }
                         char *path1 = argv[i + 1];
-                         invalid_filename(path1);
+                         invalid_filename(path1, 0); // no globbing
                          if (strstr(path1, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path1);
                                 exit(1);
                          }
                         char *path2 = argv[i + 2];
-                         invalid_filename(path2);
+                         invalid_filename(path2, 0); // no globbing
                          if (strstr(path2, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path2);
                                 exit(1);
@@ -626,7 +626,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                                 exit(1);
                         }
                         char *path = argv[i + 1];
-                         invalid_filename(path);
+                         invalid_filename(path, 0); // no globbing
                          if (strstr(path, "..")) {
                                 fprintf(stderr, "Error: invalid file name %s\n", path);
                                 exit(1);
@@ -1434,7 +1434,7 @@ int main(int argc, char **argv) {
                                 }
 
                                 // check name
-                                invalid_filename(subdirname);
+                                invalid_filename(subdirname, 0); // no globbing
                                 if (strstr(subdirname, "..") || strstr(subdirname, "/")) {
                                         fprintf(stderr, "Error: invalid overlay name\n");
                                         exit(1);
@@ -1483,7 +1483,7 @@ int main(int argc, char **argv) {
                                 exit(1);
                         }
                         custom_profile_dir = expand_home(argv[i] + 15, cfg.homedir);
-                        invalid_filename(custom_profile_dir);
+                        invalid_filename(custom_profile_dir, 0); // no globbing
                         if (!is_dir(custom_profile_dir) || is_link(custom_profile_dir) || strstr(custom_profile_dir, "..")) {
                                 fprintf(stderr, "Error: invalid profile path\n");
                                 exit(1);
@@ -1542,7 +1542,7 @@ int main(int argc, char **argv) {
                                 }
 
 
-                                invalid_filename(argv[i] + 9);
+                                invalid_filename(argv[i] + 9, 0); // no globbing
 
                                 // extract chroot dirname
                                 cfg.chrootdir = argv[i] + 9;
@@ -2193,7 +2193,7 @@ int main(int argc, char **argv) {
                                 fprintf(stderr, "Error: --shell=none was already specified.\n");
                                 return 1;
                         }
-                        invalid_filename(argv[i] + 8);
+                        invalid_filename(argv[i] + 8, 0); // no globbing
 
                         if (cfg.shell) {
                                 fprintf(stderr, "Error: only one user shell can be specified\n");
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index 14b3b54a6..cb0d9d7af 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -45,7 +45,7 @@ static char *client_filter =
 
 void check_netfilter_file(const char *fname) {
         EUID_ASSERT();
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
 
         if (is_dir(fname) || is_link(fname) || strstr(fname, "..") || access(fname, R_OK )) {
                 fprintf(stderr, "Error: invalid network filter file %s\n", fname);
diff --git a/src/firejail/netns.c b/src/firejail/netns.c
index fdd108652..f52613490 100644
--- a/src/firejail/netns.c
+++ b/src/firejail/netns.c
@@ -49,7 +49,7 @@ void check_netns(const char *nsname) {
                 fprintf(stderr, "Error: invalid netns name %s\n", nsname);
                 exit(1);
         }
-        invalid_filename(nsname);
+        invalid_filename(nsname, 0); // no globbing
         char *control_file = netns_control_file(nsname);
 
         EUID_ASSERT();
diff --git a/src/firejail/output.c b/src/firejail/output.c
index b99604ec4..4f68b8ca3 100644
--- a/src/firejail/output.c
+++ b/src/firejail/output.c
@@ -48,7 +48,7 @@ void check_output(int argc, char **argv) {
         drop_privs(0);
         char *outfile = argv[outindex];
         outfile += (enable_stderr)? 16:9;
-        invalid_filename(outfile);
+        invalid_filename(outfile, 0); // no globbing
 
         // do not accept directories, links, and files with ".."
         if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 789a8b060..a1c94579c 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -925,7 +925,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         }
 
                         // check name
-                        invalid_filename(subdirname);
+                        invalid_filename(subdirname, 0); // no globbing
                         if (strstr(subdirname, "..") || strstr(subdirname, "/")) {
                                 fprintf(stderr, "Error: invalid overlay name\n");
                                 exit(1);
@@ -993,8 +993,8 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         }
 
                         // check directories
-                        invalid_filename(dname1);
-                        invalid_filename(dname2);
+                        invalid_filename(dname1, 0); // no globbing
+                        invalid_filename(dname2, 0); // no globbing
                         if (strstr(dname1, "..") || strstr(dname2, "..")) {
                                 fprintf(stderr, "Error: invalid file name.\n");
                                 exit(1);
@@ -1123,7 +1123,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         }
 
         // some characters just don't belong in filenames
-        invalid_filename(ptr);
+        invalid_filename(ptr, 1); // globbing
         if (strstr(ptr, "..")) {
                 if (lineno == 0)
                         fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
@@ -1170,7 +1170,7 @@ void profile_read(const char *fname) {
         }
 
         // check file
-        invalid_filename(fname);
+        invalid_filename(fname, 0); // no globbing
         if (strlen(fname) == 0 || is_dir(fname)) {
                 fprintf(stderr, "Error: invalid profile file\n");
                 exit(1);
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 4d1c94c25..559f7ee48 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -747,7 +747,7 @@ uid_t pid_get_uid(pid_t pid) {
 }
 
 
-void invalid_filename(const char *fname) {
+void invalid_filename(const char *fname, int globbing) {
 //      EUID_ASSERT();
         assert(fname);
         const char *ptr = fname;
@@ -763,10 +763,19 @@ void invalid_filename(const char *fname) {
                 return;
 
         int len = strlen(ptr);
-        // file globbing ('*') is allowed
-        if (strcspn(ptr, "\\&!?\"'<>%^(){}[];,") != (size_t)len) {
-                fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
-                exit(1);
+        
+        if (globbing) {
+                // file globbing ('*?[]') is allowed
+                if (strcspn(ptr, "\\&!\"'<>%^(){};,") != (size_t)len) {
+                        fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
+                        exit(1);
+                }
+        }
+        else {
+                if (strcspn(ptr, "\\&!?\"'<>%^(){};,*[]") != (size_t)len) {
+                        fprintf(stderr, "Error: \"%s\" is an invalid filename\n", ptr);
+                        exit(1);
+                }
         }
 }