8 files changed, 239 insertions, 18 deletions

diff --git a/src/fbuilder/build_bin.c b/src/fbuilder/build_bin.c
new file mode 100644
index 000000000..7d0e2cb7c
--- /dev/null
+++ b/src/fbuilder/build_bin.c
@@ -0,0 +1,121 @@
+/*
+ * Copyright (C) 2014-2017 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fbuilder.h"
+
+static FileDB *bin_out = NULL;
+
+static void process_bin(const char *fname) {
+        assert(fname);
+        
+        // process trace file
+        FILE *fp = fopen(fname, "r");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot open %s\n", fname);
+                exit(1);
+        }
+        
+        char buf[MAX_BUF];
+        while (fgets(buf, MAX_BUF, fp)) {
+                // remove \n
+                char *ptr = strchr(buf, '\n');
+                if (ptr)
+                        *ptr = '\0';
+        
+                // parse line: 4:galculator:access /etc/fonts/conf.d:0
+                // number followed by :
+                ptr = buf;
+                if (!isdigit(*ptr))
+                        continue;
+                while (isdigit(*ptr))
+                        ptr++;
+                if (*ptr != ':')
+                        continue;
+                ptr++;
+
+                // next :
+                ptr = strchr(ptr, ':');
+                if (!ptr)
+                        continue;
+                ptr++;
+                if (strncmp(ptr, "exec ", 5) == 0)
+                        ptr +=  5;
+                else
+                        continue;
+                if (strncmp(ptr, "/bin/", 5) == 0)
+                        ptr += 5;
+                else if (strncmp(ptr, "/sbin/", 6) == 0)
+                        ptr += 6;
+                else if (strncmp(ptr, "/usr/bin/", 9) == 0)
+                        ptr += 9;
+                else if (strncmp(ptr, "/usr/sbin/", 10) == 0)
+                        ptr += 10;
+                else if (strncmp(ptr, "/usr/local/bin/", 15) == 0)
+                        ptr += 15;
+                else if (strncmp(ptr, "/usr/local/sbin/", 16) == 0)
+                        ptr += 16;
+                else if (strncmp(ptr, "/usr/games/", 11) == 0)
+                        ptr += 12;
+                else if (strncmp(ptr, "/usr/local/games/", 17) == 0)
+                        ptr += 17;
+                else
+                        continue;
+
+                // end of filename
+                char *ptr2 = strchr(ptr, ':');
+                if (!ptr2)
+                        continue;
+                *ptr2 = '\0';
+                
+                bin_out = filedb_add(bin_out, ptr);
+        }
+        
+        fclose(fp);
+}
+
+
+// process fname, fname.1, fname.2, fname.3, fname.4, fname.5
+void build_bin(const char *fname) {
+        assert(fname);
+        
+        // run fname
+        process_bin(fname);
+        
+        // run all the rest
+        struct stat s;
+        int i;
+        for (i = 1; i <= 5; i++) {
+                char *newname;
+                if (asprintf(&newname, "%s.%d", fname, i) == -1)
+                        errExit("asprintf");
+                if (stat(newname, &s) == 0)
+                        process_bin(newname);
+                free(newname);
+        }
+
+        if (bin_out) {
+                printf("# private-bin ");
+                FileDB *ptr = bin_out;
+                while (ptr) {
+                        printf("%s,", ptr->fname);
+                        ptr = ptr->next;
+                }
+                printf("\n");
+        }
+}
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index 5fca22648..3f5fe48ca 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -33,6 +33,7 @@ static char *cmdlist[] = {
         "--caps.drop=all",
         "--nonewprivs",
         "--trace",
+        "--shell=none",
         "/usr/bin/strace", // also used as a marker in build_profile()
         "-c",
         "-f",
@@ -56,8 +57,6 @@ static void clear_tmp_files(void) {
 }
 
 void build_profile(int argc, char **argv, int index) {
-        unlink("/tmp/strace-output");
-
         // next index is the application name
         if (index >= argc) {
                 fprintf(stderr, "Error: application name missing\n");
@@ -136,6 +135,7 @@ void build_profile(int argc, char **argv, int index) {
                 build_dev(TRACE_OUTPUT);
                 build_etc(TRACE_OUTPUT);
                 build_var(TRACE_OUTPUT);
+                build_bin(TRACE_OUTPUT);
                 printf("\n");
 
                 printf("### security filters\n");
diff --git a/src/fbuilder/fbuilder.h b/src/fbuilder/fbuilder.h
index a9049ea2d..c448f3e06 100644
--- a/src/fbuilder/fbuilder.h
+++ b/src/fbuilder/fbuilder.h
@@ -44,6 +44,9 @@ void build_var(const char *fname);
 void build_tmp(const char *fname);
 void build_dev(const char *fname);
 
+// build_bin.c
+void build_bin(const char *fname);
+
 // build_home.c
 void build_home(const char *fname);
 
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 5d6afe68b..5a36f5e3e 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -20,6 +20,7 @@ amarok
 amule
 android-studio
 apktool
+arch-audit
 ardour4
 ardour5
 arduino
@@ -65,6 +66,7 @@ clementine
 clipit
 cmus
 conkeror
+conky
 corebird
 cvlc
 cyberfox
@@ -97,6 +99,7 @@ evolution
 exiftool
 fbreader
 feh
+ffmpeg
 file-roller
 filezilla
 firefox
@@ -290,7 +293,7 @@ soundconverter
 spotify
 sqlitebrowser
 ssh
-ssh-agent
+# ssh-agent - problems on Arch with Fish shell (#1568)
 start-tor-browser
 steam
 stellarium
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index 1ecfbf524..5928b9ae5 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -31,6 +31,7 @@
 #include <errno.h>
 #include <sys/mman.h>
 #include <pwd.h>
+#include <dirent.h>
 
 #include "../include/common.h"
 static int arg_debug = 0;
@@ -277,7 +278,8 @@ static void set_file(const char *name, const char *firejail_exec) {
         free(fname);
 }
 
-static void set_links(void) {
+// parse /usr/lib/firejail/firecfg.cfg file
+static void set_links_firecfg(void) {
         char *cfgfile;
         if (asprintf(&cfgfile, "%s/firejail/firecfg.config", LIBDIR) == -1)
                 errExit("asprintf");
@@ -286,12 +288,13 @@ static void set_links(void) {
         if (asprintf(&firejail_exec, "%s/bin/firejail", PREFIX) == -1)
                 errExit("asprintf");
 
+        // parse /usr/lib/firejail/firecfg.cfg file
         FILE *fp = fopen(cfgfile, "r");
         if (!fp) {
                 fprintf(stderr, "Error: cannot open %s\n", cfgfile);
                 exit(1);
         }
-        printf("Configuring symlinks in /usr/local/bin\n");
+        printf("Configuring symlinks in /usr/local/bin based on firecfg.config\n");
 
         char buf[MAX_BUF];
         int lineno = 0;
@@ -330,7 +333,69 @@ static void set_links(void) {
         free(firejail_exec);
 }
 
-int have_profile(const char *filename) {
+// parse ~/.config/firejail/ directory
+static void set_links_homedir(const char *homedir) {
+        assert(homedir);
+
+        // check firejail config directory
+        char *dirname;
+        if (asprintf(&dirname, "%s/.config/firejail", homedir) == -1)
+                errExit("asprintf");
+        struct stat s;
+        if (stat(dirname, &s) != 0) {
+                free(dirname);
+                return;
+        }
+
+        char *firejail_exec;
+        if (asprintf(&firejail_exec, "%s/bin/firejail", PREFIX) == -1)
+                errExit("asprintf");
+
+        // parse ~/.config/firejail/ directory
+        printf("\nConfiguring symlinks in /usr/local/bin based on local firejail config directory\n");
+
+        DIR *dir = opendir(dirname);
+        if (!dir) {
+                fprintf(stderr, "Error: cannot open ~/.config/firejail directory\n");
+                free(dirname);
+                return;
+        }
+
+        struct dirent *entry;
+        while ((entry = readdir(dir))) {
+                if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
+                        continue;
+
+                char *exec = strdup(entry->d_name);
+                if (!exec)
+                        errExit("strdup");
+                char *ptr = strrchr(exec, '.');
+                if (!ptr) {
+                        free(exec);
+                        continue;
+                }
+                if (strcmp(ptr, ".profile") != 0) {
+                        free(exec);
+                        continue;
+                }
+
+                *ptr = '\0';
+                set_file(exec, firejail_exec);
+                free(exec);
+        }
+        closedir(dir);
+
+        free(firejail_exec);
+}
+
+// look for a profile file in /etc/firejail diectory and in homedir/.config/firejail directory
+static int have_profile(const char *filename, const char *homedir) {
+        assert(filename);
+        assert(homedir);
+
+        if (arg_debug)
+                printf("checking profile for %s\n", filename);
+
         // remove .desktop extension
         char *f1 = strdup(filename);
         if (!f1)
@@ -338,15 +403,29 @@ int have_profile(const char *filename) {
         f1[strlen(filename) - 8] = '\0';
 
         // build profile name
-        char *profname;
-        if (asprintf(&profname, "%s/%s.profile", SYSCONFDIR, f1) == -1)
+        char *profname1;
+        char *profname2;
+        if (asprintf(&profname1, "%s/%s.profile", SYSCONFDIR, f1) == -1)
+                errExit("asprintf");
+        if (asprintf(&profname2, "%s/.config/firejail/%s.profile", homedir, f1) == -1)
                 errExit("asprintf");
 
-        struct stat s;
-        int rv = stat(profname, &s);
+        int rv = 0;
+        if (access(profname1, R_OK) == 0) {
+                if (arg_debug)
+                        printf("found %s\n", profname1);
+                rv = 1;
+        }
+        else if (access(profname2, R_OK) == 0) {
+                if (arg_debug)
+                        printf("found %s\n", profname2);
+                rv = 1;
+        }
+                
         free(f1);
-        free(profname);
-        return (rv == 0)? 1: 0;
+        free(profname1);
+        free(profname2);
+        return rv;
 }
 
 static void fix_desktop_files(char *homedir) {
@@ -411,7 +490,7 @@ static void fix_desktop_files(char *homedir) {
                         errExit("stat");
 
                 // no profile in /etc/firejail, no desktop file fixing
-                if (!have_profile(filename))
+                if (!have_profile(filename, homedir))
                         continue;
 
                 /* coverity[toctou] */
@@ -599,7 +678,7 @@ int main(int argc, char **argv) {
                         }
                 }
         }
-        set_links();
+        set_links_firecfg();
 
 
 
@@ -623,6 +702,9 @@ int main(int argc, char **argv) {
                         goto errexit;
                 }
 
+                // running as root
+                set_links_homedir(home);
+
                 // drop permissions
                 if (setgroups(0, NULL) < 0)
                         errExit("setgroups");
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 3e0729620..4d1c94c25 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -196,7 +196,7 @@ static int copy_file_by_fd(int src, int dst) {
                         done += rv;
                 }
         }
-        fflush(0);
+//      fflush(0);
         return 0;
 }
 
diff --git a/src/libtrace/libtrace.c b/src/libtrace/libtrace.c
index 5cdb254a3..04cf64997 100644
--- a/src/libtrace/libtrace.c
+++ b/src/libtrace/libtrace.c
@@ -673,3 +673,15 @@ int setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
 
         return rv;
 }
+
+// every time a new process is started, this gets called
+// it can be used to build things like private-bin
+__attribute__((constructor))
+static void log_exec(int argc, char** argv) {
+        static char buf[PATH_MAX + 1];
+        int rv = readlink("/proc/self/exe", buf, PATH_MAX);
+        if (rv != -1) {
+                buf[rv] = '\0'; // readlink does not add a '\0' at the end
+                printf("%u:%s:exec %s:0\n", pid(), name(), buf);
+        }
+}
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index f205bfa30..9bbb224e1 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1338,13 +1338,13 @@ $ ps
 .br
    48 pts/0    00:00:00 ps
 .br
-$ 
+$
 .br
 
 
 .TP
 \fB\-\-private-dev
-Create a new /dev directory. Only dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available.
+Create a new /dev directory. Only disc, dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available.
 .br
 
 .br
@@ -1358,7 +1358,7 @@ Child process initialized
 .br
 $ ls /dev
 .br
-dri  full  log  null  ptmx  pts  random  shm  snd  tty  urandom  zero
+cdrom  cdrw  dri  dvd  dvdrw  full  log  null  ptmx  pts  random  shm  snd  sr0  tty  urandom  zero
 .br
 $
 .TP