9 files changed, 97 insertions, 23 deletions

diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 1835502a4..da8937717 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -15,12 +15,14 @@ Viber
 VirtualBox
 Wire
 Xephyr
+XMind
 abrowser
 akonadi_control
 akregator
 amarok
 amule
 android-studio
+anydesk
 apktool
 arch-audit
 archaudit-report
@@ -273,7 +275,7 @@ musescore
 musixmatch
 mutt
 natron
-nautilus
+#nautilus - removed in order to let the application start in a new sandbox when clicking on icons in the file manager
 ncdu
 netsurf
 neverball
@@ -298,7 +300,7 @@ pdftotext
 peek
 picard
 pidgin
-ping
+#ping - disabled until we fix  #1912
 pingus
 pinta
 pithos
@@ -331,6 +333,7 @@ ristretto
 rocketchat
 rtorrent
 runenpass.sh
+scallion
 scribus
 sdat2img
 seamonkey
@@ -410,6 +413,7 @@ vym
 w3m
 warzone2100
 waterfox
+webstorm
 weechat
 weechat-curses
 wesnoth
diff --git a/src/firecfg/util.c b/src/firecfg/util.c
index f0446ca8d..7ed86c36e 100644
--- a/src/firecfg/util.c
+++ b/src/firecfg/util.c
@@ -58,9 +58,15 @@ int which(const char *program) {
                 // use path2 to count the entries
                 char *ptr = strtok(path2, ":");
                 while (ptr) {
-                        if (find(program, ptr)) {
-                                free(path2);
-                                return 1;
+                        // Ubuntu 18.04 is adding  /snap/bin to PATH;
+                        // they populate /snap/bin with simbolic links to /usr/bin/ programs;
+                        // most simlinked programs are not installed by default.
+                        // Removing /snap/bin from our search
+                        if (strcmp(ptr, "/snap/bin") != 0) {
+                                if (find(program, ptr)) {
+                                        free(path2);
+                                        return 1;
+                                }
                         }
                         ptr = strtok(NULL, ":");
                 }
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 0df832c09..14f87c36c 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -524,6 +524,16 @@ unsigned extract_timeout(const char *str);
 void disable_file_or_dir(const char *fname);
 void disable_file_path(const char *path, const char *file);
 
+// Get info regarding the last kernel mount operation.
+// The return value points to a static area, and will be overwritten by subsequent calls.
+// The function does an exit(1) if anything goes wrong.
+typedef struct {
+        char *fsname;
+        char *dir;
+} MountData;
+MountData *get_last_mount(void);
+
+
 // fs_var.c
 void fs_var_log(void);  // mounting /var/log
 void fs_var_lib(void);  // various other fixes for software in /var directory
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index d4cdbbe0a..b0ad35299 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -25,6 +25,8 @@
 #include <unistd.h>
 #include <glob.h>
 
+static int prog_cnt = 0;
+
 static char *paths[] = {
         "/usr/local/bin",
         "/usr/bin",
@@ -191,6 +193,7 @@ static void duplicate(char *fname, FILE *fplist) {
                                 // solving problems such as /bin/sh -> /bin/dash
                                 // copy the real file pointed by symlink
                                 sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, actual_path, RUN_BIN_DIR);
+                                prog_cnt++;
                                 char *f = strrchr(actual_path, '/');
                                 if (f && *(++f) !='\0')
                                         report_duplication(f);
@@ -201,6 +204,7 @@ static void duplicate(char *fname, FILE *fplist) {
 
         // copy a file or a symlink
         sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, full_path, RUN_BIN_DIR);
+        prog_cnt++;
         free(full_path);
         report_duplication(fname);
 }
@@ -256,6 +260,9 @@ void fs_private_bin_list(void) {
         char *private_list = cfg.bin_private_keep;
         assert(private_list);
 
+        // start timetrace
+        timetrace_start();
+
         // create /run/firejail/mnt/bin directory
         mkdir_attr(RUN_BIN_DIR, 0755, 0, 0);
 
@@ -298,4 +305,5 @@ void fs_private_bin_list(void) {
                 }
                 i++;
         }
+        fmessage("%d %s installed in %0.2f ms\n", prog_cnt, (prog_cnt == 1)? "program": "programs", timetrace_end());
 }
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index 8a105be97..363b48d1d 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -201,7 +201,7 @@ static char *valid_file(const char *lib) {
                 }
                 free(fname);
         }
-printf("not found %s\n", lib);
+
         fwarning("%s library not found, skipping...\n", lib);
         return NULL;
 }
@@ -352,7 +352,7 @@ void fs_private_lib(void) {
                                                 fslib_copy_dir(name);
                                         free(name);
 
-                                        // /usr/lib/x86_linux-gnu - debian & frriends
+                                        // /usr/lib/x86_linux-gnu - debian & friends
                                         if (asprintf(&name, "/usr/lib/x86_64-linux-gnu/%s", ptr) == -1)
                                                 errExit("asprintf");
                                         if (is_dir(name))
@@ -377,20 +377,12 @@ void fs_private_lib(void) {
                 printf("*** Installing system libraries\n");
         fslib_install_system();
 
-        fmessage("Installed %d libraries and %d directories\n", lib_cnt, dir_cnt);
+        fmessage("Installed %d %s and %d %s\n", lib_cnt, (lib_cnt == 1)? "library": "libraries",
+                dir_cnt, (dir_cnt == 1)? "directory": "directories");
 
-        // bring in firejail directory for --trace options
+        // bring in firejail directory for --trace and seccomp post exec
         fslib_copy_dir(LIBDIR "/firejail");
 
-        // ... and for sandbox in sandbox functionality
-        fslib_copy_libs(LIBDIR "/firejail/faudit");
-        fslib_copy_libs(LIBDIR "/firejail/fbuilder");
-        fslib_copy_libs(LIBDIR "/firejail/fcopy");
-        fslib_copy_libs(LIBDIR "/firejail/fldd");
-        fslib_copy_libs(LIBDIR "/firejail/fnet");
-        fslib_copy_libs(LIBDIR "/firejail/fnetfilter");
-        fslib_copy_libs(LIBDIR "/firejail/fseccomp");
-        fslib_copy_libs(LIBDIR "/firejail/ftee");
         // mount lib filesystem
         mount_directories();
 }
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index d4c7de342..60bb0f6ed 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -317,6 +317,16 @@ static void whitelist_path(ProfileEntry *entry) {
         if (mount(wfile, path, NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind");
 
+        // check the last mount operation
+        MountData *mptr = get_last_mount(); // will do exit(1) if the mount cannot be found
+
+        // No mounts are allowed on top level directories. A destination such as "/etc" is very bad!
+        //  - there should be more than one '/' char in dest string
+        if (mptr->dir == strrchr(mptr->dir, '/')) {
+                fprintf(stderr, "Error: invalid mount on top of %s\n", mptr->dir);
+                exit(1);
+        }
+
         free(wfile);
         return;
 
@@ -859,6 +869,15 @@ void fs_whitelist(void) {
                                                 fprintf(stderr, "Warning cannot create symbolic link %s\n", entry->link);
                                         else if (arg_debug || arg_debug_whitelists)
                                                 printf("Created symbolic link %s -> %s\n", entry->link, entry->data + 10);
+
+                                        // check again for files in /tmp directory
+                                        if (strncmp(entry->link, "/tmp/", 5) == 0) {
+                                                char *path = realpath(entry->link, NULL);
+                                                if (path == NULL || strncmp(path, "/tmp/", 5) != 0) {
+                                                        fprintf(stderr, "Error: invalid symbolic link %s\n", entry->link);
+                                                        exit(1);
+                                                }
+                                        }
                                 }
                         }
                 }
diff --git a/src/firejail/util.c b/src/firejail/util.c
index a44e52e98..f441f283f 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -1029,3 +1029,39 @@ void disable_file_path(const char *path, const char *file) {
         free(fname);
 }
 
+#define MAX_BUF 4096
+static char mbuf[MAX_BUF];
+static MountData mdata;
+
+// Get info regarding the last kernel mount operation.
+// The return value points to a static area, and will be overwritten by subsequent calls.
+// The function does an exit(1) if anything goes wrong.
+MountData *get_last_mount(void) {
+        // open /proc/self/mounts
+        FILE *fp = fopen("/proc/self/mounts", "r");
+        if (!fp)
+                goto errexit;
+
+        mbuf[0] = '\0';
+        while (fgets(mbuf, MAX_BUF, fp));
+        fclose(fp);
+        if (arg_debug || arg_debug_whitelists)
+                printf("%s", mbuf);
+
+        // there should be no reason to have a new mount on top of a top level directory
+        mdata.fsname = mbuf;
+        mdata.dir = strstr(mbuf, " ");
+        if (!mdata.dir)
+                goto errexit;
+        mdata.dir++;
+        char *end = strstr(mdata.dir, " ");
+        if (!end)
+                goto errexit;
+        *end = '\0';
+
+        return &mdata;
+
+errexit:
+        fprintf(stderr, "Error: cannot read /proc/self/mounts");
+        exit(1);
+}
diff --git a/src/fldd/main.c b/src/fldd/main.c
index be4500d2a..4658e82fb 100644
--- a/src/fldd/main.c
+++ b/src/fldd/main.c
@@ -340,10 +340,8 @@ printf("\n");
         else {
                 if (is_lib_64(argv[1]))
                         parse_elf(argv[1]);
-                else {
-                        fprintf(stderr, "Error fldd: %s is not a 64bit program/library\n", argv[1]);
-                        exit(1);
-                }
+                else
+                        fprintf(stderr, "Warning fldd: %s is not a 64bit program/library\n", argv[1]);
         }
 
 
diff --git a/src/lib/firejail_user.c b/src/lib/firejail_user.c
index 09a4da0e7..0cc0ac6c1 100644
--- a/src/lib/firejail_user.c
+++ b/src/lib/firejail_user.c
@@ -47,7 +47,8 @@ int firejail_user_check(const char *name) {
                 return 1;
 
         // other system users will run the program as is
-        if (getuid() < UID_MIN || strcmp(name, "nobody") == 0)
+        uid_t uid = getuid();
+        if ((uid < UID_MIN && uid != 0) || strcmp(name, "nobody") == 0)
                 return 0;
 
         // check file existence