7 files changed, 219 insertions, 140 deletions

diff --git a/src/firejail/cmdline.c b/src/firejail/cmdline.c
new file mode 100644
index 000000000..517124d9e
--- /dev/null
+++ b/src/firejail/cmdline.c
@@ -0,0 +1,151 @@
+/*
+ * Copyright (C) 2014-2016 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#include "firejail.h"
+#include <string.h>
+#include <stdbool.h>
+#include <stdio.h>
+#include <linux/limits.h>
+#include <assert.h>
+#include <errno.h>
+
+int cmdline_length(int argc, char **argv, int index) {
+        int i,j;
+        int len = 0;
+        int argcnt = argc - index;
+        bool in_quotes = false;
+
+        for (i = 0; i < argcnt; i++) {
+                in_quotes = false;
+                for (j = 0; j < strlen(argv[i + index]); j++) {
+                        if (argv[i + index][j] == '\'') {
+                                if (in_quotes)
+                                        len++;
+                                if (j > 0 && argv[i + index][j-1] == '\'')
+                                        len++;
+                                else
+                                        len += 3;
+                                in_quotes = false;
+                        } else {
+                                if (!in_quotes)
+                                        len++;
+                                len++;
+                                in_quotes = true;
+                        }
+                }
+                if (in_quotes) {
+                        len++;
+                }
+                if (strlen(argv[i + index]) == 0) {
+                        len += 2;
+                }
+                len++;
+        }
+
+        return len;
+}
+
+void quote_cmdline(char *command_line, char *window_title, int len, int argc, char **argv, int index) {
+        int i,j;
+        int argcnt = argc - index;
+        bool in_quotes = false;
+        char *ptr1 = command_line;
+        char *ptr2 = window_title;
+
+        for (i = 0; i < argcnt; i++) {
+
+                // enclose args by single quotes,
+                // and since single quote can't be represented in single quoted text
+                // each occurence of it should be enclosed by double quotes
+                in_quotes = false;
+                for (j = 0; j < strlen(argv[i + index]); j++) {
+                        // single quote
+                        if (argv[i + index][j] == '\'') {
+                                if (in_quotes) {
+                                        // close quotes
+                                        ptr1[0] = '\'';
+                                        ptr1++;
+                                }
+                                // previous char was single quote too
+                                if (j > 0 && argv[i + index][j-1] == '\'') {
+                                        ptr1--;
+                                        sprintf(ptr1, "\'\"");
+                                } 
+                                // this first in series
+                                else
+                                {
+                                        sprintf(ptr1, "\"\'\"");
+                                }
+                                ptr1 += strlen(ptr1);
+                                in_quotes = false;
+                        }
+                        // anything other
+                        else
+                        {
+                                if (!in_quotes) {
+                                        // open quotes
+                                        ptr1[0] = '\'';
+                                        ptr1++;
+                                }
+                                ptr1[0] = argv[i + index][j];
+                                ptr1++;
+                                in_quotes = true;
+                        }
+                }
+                // close quotes
+                if (in_quotes) {
+                        ptr1[0] = '\'';
+                        ptr1++;
+                }
+                // handle empty argument case
+                if (strlen(argv[i + index]) == 0) {
+                        sprintf(ptr1, "\'\'");
+                        ptr1 += strlen(ptr1);
+                }
+                // add space
+                sprintf(ptr1, " ");
+                ptr1 += strlen(ptr1);
+
+                sprintf(ptr2, "%s ", argv[i + index]);
+                ptr2 += strlen(ptr2);
+        }
+
+        assert(len == strlen(command_line));
+}
+
+void build_cmdline(char **command_line, char **window_title, int argc, char **argv, int index) {
+        int len = cmdline_length(argc, argv, index);
+        if (len > ARG_MAX) {
+                errno = E2BIG;
+                errExit("cmdline_length");
+        }
+
+        *command_line = malloc(len + 1);
+        if (!*command_line)
+                        errExit("malloc");
+        *window_title = malloc(len + 1);
+        if (!*window_title)
+                        errExit("malloc");
+        
+        quote_cmdline(*command_line, *window_title, len, argc, argv, index);
+
+        assert(*command_line);
+        assert(*window_title);
+}
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c
index 50bcc613b..5bc2df2cc 100644
--- a/src/firejail/fs_mkdir.c
+++ b/src/firejail/fs_mkdir.c
@@ -22,8 +22,38 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <grp.h>
- #include <sys/wait.h>
- 
+#include <sys/wait.h>
+#include <string.h>
+
+static void mkdir_recursive(char *path) {
+        char *subdir = NULL;
+        struct stat s;
+
+        if (chdir("/")) {
+                fprintf(stderr, "Error: can't chdir to /");
+                return;
+        }
+
+        subdir = strtok(path, "/");
+        while(subdir) {
+                if (stat(subdir, &s) == -1) {
+                        if (mkdir(subdir, 0700) == -1) {
+                                fprintf(stderr, "Warning: cannot create %s directory\n", subdir);
+                                return;
+                        }
+                } else if (!S_ISDIR(s.st_mode)) {
+                        fprintf(stderr, "Warning: '%s' exists, but is no directory\n", subdir);
+                        return;
+                }
+                if (chdir(subdir)) {
+                        fprintf(stderr, "Error: can't chdir to %s", subdir);
+                        return;
+                }
+
+                subdir = strtok(NULL, "/");
+        }
+}
+
 void fs_mkdir(const char *name) {
         EUID_ASSERT();
         
@@ -50,8 +80,7 @@ void fs_mkdir(const char *name) {
                 drop_privs(0);
 
                 // create directory
-                if (mkdir(expanded, 0700) == -1)
-                        fprintf(stderr, "Warning: cannot create %s directory\n", expanded);
+                mkdir_recursive(expanded);
                 exit(0);
         }
         // wait for the child to finish
@@ -101,4 +130,4 @@ void fs_mkfile(const char *name) {
 
 doexit:
         free(expanded);
-}
\ No newline at end of file
+}
diff --git a/src/firejail/join.c b/src/firejail/join.c
index c14108986..0b5b6a34a 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -49,29 +49,9 @@ static void extract_command(int argc, char **argv, int index) {
                 exit(1);
         }
 
-
-        int len = 0;
-        int i;
-        // calculate command length
-        for (i = index; i < argc; i++) {
-                len += strlen(argv[i]) + 3;
-        }
-        assert(len > 0);
-
         // build command
-        cfg.command_line = malloc(len + 1);
-        *cfg.command_line = '\0';
-        for (i = index; i < argc; i++) {
-                if (strchr(argv[i], '&')) {
-                        strcat(cfg.command_line, "\'");
-                        strcat(cfg.command_line, argv[i]);
-                        strcat(cfg.command_line, "\' ");
-                }
-                else {
-                        strcat(cfg.command_line, argv[i]);
-                        strcat(cfg.command_line, " ");
-                }
-        }
+        build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, index);
+
         if (arg_debug)
                 printf("Extracted command #%s#\n", cfg.command_line);
 }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index cbc3d57cf..e86d78ff1 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2004,109 +2004,7 @@ int main(int argc, char **argv) {
                 cfg.window_title = "appimage";
         }
         else {
-                // calculate the length of the command
-                int i;
-                int len = 0;
-                int argcnt = argc - prog_index;
-                int j;
-                bool in_quotes = false;
-
-                for (i = 0; i < argcnt; i++) {
-                        in_quotes = false;
-                        for (j = 0; j < strlen(argv[i + prog_index]); j++) {
-                                if (argv[i + prog_index][j] == '\'') {
-                                        if (in_quotes)
-                                                len++;
-                                        if (j > 0 && argv[i + prog_index][j-1] == '\'')
-                                                len++;
-                                        else
-                                                len += 3;
-                                        in_quotes = false;
-                                } else {
-                                        if (!in_quotes)
-                                                len++;
-                                        len++;
-                                        in_quotes = true;
-                                }
-                        }
-                        if (in_quotes) {
-                                len++;
-                        }
-                        if (strlen(argv[i + prog_index]) == 0) {
-                                len += 2;
-                        }
-                        len++;
-                }
-
-                // build the string
-                cfg.command_line = malloc(len + 1); // + '\0'
-                if (!cfg.command_line)
-                        errExit("malloc");
-                cfg.window_title = malloc(len + 1); // + '\0'
-                if (!cfg.window_title)
-                        errExit("malloc");
-
-                char *ptr1 = cfg.command_line;
-                char *ptr2 = cfg.window_title;
-                for (i = 0; i < argcnt; i++) {
-
-                        // enclose args by single quotes,
-                        // and since single quote can't be represented in single quoted text
-                        // each occurence of it should be enclosed by double quotes
-                        in_quotes = false;
-                        for (j = 0; j < strlen(argv[i + prog_index]); j++) {
-                                // single quote
-                                if (argv[i + prog_index][j] == '\'') {
-                                        if (in_quotes) {
-                                                // close quotes
-                                                ptr1[0] = '\'';
-                                                ptr1++;
-                                        }
-                                        // previous char was single quote too
-                                        if (j > 0 && argv[i + prog_index][j-1] == '\'') {
-                                                ptr1--;
-                                                sprintf(ptr1, "\'\"");
-                                        } 
-                                        // this first in series
-                                        else
-                                        {
-                                                sprintf(ptr1, "\"\'\"");
-                                        }
-                                        ptr1 += strlen(ptr1);
-                                        in_quotes = false;
-                                }
-                                // anything other
-                                else
-                                {
-                                        if (!in_quotes) {
-                                                // open quotes
-                                                ptr1[0] = '\'';
-                                                ptr1++;
-                                        }
-                                        ptr1[0] = argv[i + prog_index][j];
-                                        ptr1++;
-                                        in_quotes = true;
-                                }
-                        }
-                        // close quotes
-                        if (in_quotes) {
-                                ptr1[0] = '\'';
-                                ptr1++;
-                        }
-                        // handle empty argument case
-                        if (strlen(argv[i + prog_index]) == 0) {
-                                sprintf(ptr1, "\'\'");
-                                ptr1 += strlen(ptr1);
-                        }
-                        // add space
-                        sprintf(ptr1, " ");
-                        ptr1 += strlen(ptr1);
-
-                        sprintf(ptr2, "%s ", argv[i + prog_index]);
-                        ptr2 += strlen(ptr2);
-                }
-
-                assert(len == strlen(cfg.command_line));
+                build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
         }
         
         assert(cfg.command_name);
diff --git a/src/libtrace/libtrace.c b/src/libtrace/libtrace.c
index a3d1571f7..dde3df2ea 100644
--- a/src/libtrace/libtrace.c
+++ b/src/libtrace/libtrace.c
@@ -423,11 +423,36 @@ int stat(const char *pathname, struct stat *buf) {
 typedef int (*orig_stat64_t)(const char *pathname, struct stat64 *buf);
 static orig_stat64_t orig_stat64 = NULL;
 int stat64(const char *pathname, struct stat64 *buf) {
-        if (!orig_stat)
+        if (!orig_stat64)
                 orig_stat64 = (orig_stat64_t)dlsym(RTLD_NEXT, "stat64");
                         
         int rv = orig_stat64(pathname, buf);
-        printf("%u:%s:stat %s:%d\n", pid(), name(), pathname, rv);
+        printf("%u:%s:stat64 %s:%d\n", pid(), name(), pathname, rv);
+        return rv;
+}
+#endif /* __GLIBC__ */
+
+// lstat
+typedef int (*orig_lstat_t)(const char *pathname, struct stat *buf);
+static orig_lstat_t orig_lstat = NULL;
+int lstat(const char *pathname, struct stat *buf) {
+        if (!orig_lstat)
+                orig_lstat = (orig_lstat_t)dlsym(RTLD_NEXT, "lstat");
+
+        int rv = orig_lstat(pathname, buf);
+        printf("%u:%s:lstat %s:%d\n", pid(), name(), pathname, rv);
+        return rv;
+}
+
+#ifdef __GLIBC__
+typedef int (*orig_lstat64_t)(const char *pathname, struct stat64 *buf);
+static orig_lstat64_t orig_lstat64 = NULL;
+int lstat64(const char *pathname, struct stat64 *buf) {
+        if (!orig_lstat64)
+                orig_lstat64 = (orig_lstat64_t)dlsym(RTLD_NEXT, "lstat64");
+
+        int rv = orig_lstat64(pathname, buf);
+        printf("%u:%s:lstat64 %s:%d\n", pid(), name(), pathname, rv);
         return rv;
 }
 #endif /* __GLIBC__ */
diff --git a/src/libtracelog/libtracelog.c b/src/libtracelog/libtracelog.c
index 3e65587c4..dedba5513 100644
--- a/src/libtracelog/libtracelog.c
+++ b/src/libtracelog/libtracelog.c
@@ -562,7 +562,7 @@ int stat64(const char *pathname, struct stat64 *buf) {
 #ifdef DEBUG
         printf("%s %s\n", __FUNCTION__, pathname);
 #endif
-        if (!orig_stat)
+        if (!orig_stat64)
                 orig_stat64 = (orig_stat64_t)dlsym(RTLD_NEXT, "stat64");
         if (!blacklist_loaded)
                 load_blacklist();
@@ -598,7 +598,7 @@ int lstat64(const char *pathname, struct stat64 *buf) {
 #ifdef DEBUG
         printf("%s %s\n", __FUNCTION__, pathname);
 #endif
-        if (!orig_lstat)
+        if (!orig_lstat64)
                 orig_lstat64 = (orig_lstat64_t)dlsym(RTLD_NEXT, "lstat64");
         if (!blacklist_loaded)
                 load_blacklist();
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 504842a9e..7e33a6b45 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -136,7 +136,7 @@ The directory is created if it doesn't already exist.
 .br
 Use this command for whitelisted directories you need to preserve
 when the sandbox is closed. Without it, the application will create the directory, and the directory
-will be deleted when the sandbox is closed. Subdirectories also need to be created using mkdir. Example from
+will be deleted when the sandbox is closed. Subdirectories are recursively created. Example from
 firefox profile:
 .br
 
@@ -145,17 +145,13 @@ mkdir ~/.mozilla
 .br
 whitelist ~/.mozilla
 .br
-mkdir ~/.cache
-.br
-mkdir ~/.cache/mozilla
-.br
 mkdir ~/.cache/mozilla/firefox
 .br
 whitelist ~/.cache/mozilla/firefox
 .TP
 \fBmkfile file
 Similar to mkdir, this command creates a file in user home before the sandbox is started.
-The file is created if it doesn't already exist.
+The file is created if it doesn't already exist, but it's target directory has to exist.
 .TP
 \fBnoexec file_or_directory
 Remount the file or the directory noexec, nodev and nosuid.