11 files changed, 163 insertions, 176 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index d172efce1..368e0d88d 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -78,6 +78,7 @@
 #define RUN_HOSTNAME_FILE       "/run/firejail/mnt/hostname"
 #define RUN_HOSTS_FILE  "/run/firejail/mnt/hosts"
 #define RUN_RESOLVCONF_FILE     "/run/firejail/mnt/resolv.conf"
+#define RUN_MACHINEID   "/run/firejail/mnt/machine-id"
 #define RUN_LDPRELOAD_FILE      "/run/firejail/mnt/ld.so.preload"
 #define RUN_UTMP_FILE           "/run/firejail/mnt/utmp"
 #define RUN_PASSWD_FILE         "/run/firejail/mnt/passwd"
@@ -342,6 +343,7 @@ extern int arg_allow_debuggers;	// allow debuggers
 extern int arg_x11_block;       // block X11
 extern int arg_x11_xorg;        // use X11 security extention
 extern int arg_allusers;        // all user home directories visible
+extern int arg_machineid;       // preserve /etc/machine-id
 
 extern int login_shell;
 extern int parent_to_child_fds[2];
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index ffad961c3..905d2903d 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -662,7 +662,8 @@ void fs_basic_fs(void) {
         fs_var_lib();
         fs_var_cache();
         fs_var_utmp();
-
+        fs_machineid();
+        
         // don't leak user information
         restrict_users();
         
@@ -945,6 +946,7 @@ void fs_overlayfs(void) {
         fs_var_lib();
         fs_var_cache();
         fs_var_utmp();
+        fs_machineid();
 
         // don't leak user information
         restrict_users();
@@ -1126,6 +1128,7 @@ void fs_chroot(const char *rootdir) {
                 fs_var_lib();
                 fs_var_cache();
                 fs_var_utmp();
+                fs_machineid();
         
                 // don't leak user information
                 restrict_users();
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 9a28ac601..a04bf6725 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -23,6 +23,57 @@
 #include <sys/types.h>
 #include <unistd.h>
 
+// spoof /etc/machine_id
+void fs_machineid(void) {
+        union machineid_t {
+                uint8_t u8[16];
+                uint32_t u32[4];
+        } mid;
+
+        // if --machine-id flag is active, do nothing
+        if (arg_machineid)
+                return;
+
+        // init random number generator
+        srand(time(NULL));
+        
+        // generate random id
+        mid.u32[0] = rand();
+        mid.u32[1] = rand();
+        mid.u32[2] = rand();
+        mid.u32[3] = rand();
+        
+        // UUID version 4 and DCE variant
+        mid.u8[6] = (mid.u8[6] & 0x0F) | 0x40;
+        mid.u8[8] = (mid.u8[8] & 0x3F) | 0x80;
+        
+        // write it in a file
+        FILE *fp = fopen(RUN_MACHINEID, "w");
+        if (!fp)
+                errExit("fopen");
+        fprintf(fp, "%08x%08x%08x%08x\n", mid.u32[0], mid.u32[1], mid.u32[2], mid.u32[3]);
+        fclose(fp);
+        if (set_perms(RUN_MACHINEID, 0, 0, 0444))
+                errExit("set_perms");
+                
+
+        struct stat s;
+        // mount-bind 
+        if (stat("/etc/machine-id", &s) == 0) {
+                if (arg_debug)
+                        printf("installing a new /etc/machine-id\n");
+
+                if (mount(RUN_MACHINEID, "/etc/machine-id", "none", MS_BIND, "mode=444,gid=0"))
+                        errExit("mount");
+        }
+//#if 0 // todo: investigate    
+        if (stat("/var/lib/dbus/machine-id", &s) == 0) {
+                if (mount(RUN_MACHINEID, "/etc/machine-id", "none", MS_BIND, "mode=444,gid=0"))
+                        errExit("mount");
+        }
+//#endif
+}
+
 // return 0 if file not found, 1 if found
 static int check_dir_or_file(const char *fname) {
         assert(fname);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index aa855b7eb..b25bad9f2 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -111,6 +111,7 @@ int arg_allow_debuggers = 0;			// allow debuggers
 int arg_x11_block = 0;                          // block X11
 int arg_x11_xorg = 0;                           // use X11 security extention
 int arg_allusers = 0;                           // all user home directories visible
+int arg_machineid = 0;                          // preserve /etc/machine-id
 
 int login_shell = 0;
 
@@ -750,42 +751,6 @@ static void delete_x11_file(pid_t pid) {
         free(fname);
 }
 
-static void detect_quiet(int argc, char **argv) {
-        int i;
-        
-        // detect --quiet
-        for (i = 1; i < argc; i++) {
-                if (strcmp(argv[i], "--quiet") == 0) {
-                        arg_quiet = 1;
-                        break;
-                }
-                
-                // detect end of firejail params
-                if (strcmp(argv[i], "--") == 0)
-                        break;
-                if (strncmp(argv[i], "--", 2) != 0)
-                        break;
-        }
-}
-
-static void detect_allow_debuggers(int argc, char **argv) {
-        int i;
-        
-        // detect --allow-debuggers
-        for (i = 1; i < argc; i++) {
-                if (strcmp(argv[i], "--allow-debuggers") == 0) {
-                        arg_allow_debuggers = 1;
-                        break;
-                }
-                
-                // detect end of firejail params
-                if (strcmp(argv[i], "--") == 0)
-                        break;
-                if (strncmp(argv[i], "--", 2) != 0)
-                        break;
-        }
-}
-
 char *guess_shell(void) {
         char *shell = NULL;
         // shells in order of preference
@@ -805,6 +770,25 @@ char *guess_shell(void) {
         return shell;
 }
 
+static int check_arg(int argc, char **argv, const char *argument) {
+        int i;
+        int found = 0;
+        for (i = 1; i < argc; i++) {
+                if (strcmp(argv[i], argument) == 0) {
+                        found = 1;
+                        break;
+                }
+
+                // detect end of firejail params
+                if (strcmp(argv[i], "--") == 0)
+                        break;
+                if (strncmp(argv[i], "--", 2) != 0)
+                        break;
+        }
+        
+        return found;
+}
+
 //*******************************************
 // Main program
 //*******************************************
@@ -821,8 +805,10 @@ int main(int argc, char **argv) {
         // build /run/firejail directory structure
         preproc_build_firejail_dir();
         
-        detect_quiet(argc, argv);
-        detect_allow_debuggers(argc, argv);
+        if (check_arg(argc, argv, "--quiet"))
+                arg_quiet = 1;
+        if (check_arg(argc, argv, "--allow-debuggers"))
+                arg_allow_debuggers = 1;
 
         // drop permissions by default and rise them when required
         EUID_INIT();
@@ -844,78 +830,32 @@ int main(int argc, char **argv) {
                 EUID_USER();
                 if (rv == 0) {
                         // if --force option is passed to the program, disregard the existing sandbox
-                        int found = 0;
-                        for (i = 1; i < argc; i++) {
-                                if (strcmp(argv[i], "--force") == 0 ||
-                                    strcmp(argv[i], "--list") == 0 ||   
-                                    strcmp(argv[i], "--netstats") == 0 ||       
-                                    strcmp(argv[i], "--tree") == 0 ||   
-                                    strcmp(argv[i], "--top") == 0 ||
-                                    strncmp(argv[i], "--ls=", 5) == 0 ||
-                                    strncmp(argv[i], "--get=", 6) == 0 ||
-                                    strcmp(argv[i], "--debug-caps") == 0 ||
-                                    strcmp(argv[i], "--debug-errnos") == 0 ||
-                                    strcmp(argv[i], "--debug-syscalls") == 0 ||
-                                    strcmp(argv[i], "--debug-protocols") == 0 ||
-                                    strcmp(argv[i], "--help") == 0 ||
-                                    strcmp(argv[i], "--version") == 0 ||
-                                    strcmp(argv[i], "--overlay-clean") == 0 ||
-                                    strncmp(argv[i], "--dns.print=", 12) == 0 ||
-                                    strncmp(argv[i], "--bandwidth=", 12) == 0 ||
-                                    strncmp(argv[i], "--caps.print=", 13) == 0 ||
-                                    strncmp(argv[i], "--cpu.print=", 12) == 0 ||
-        //********************************************************************************
-        // todo: fix the following problems
-                                    strncmp(argv[i], "--join=", 7) == 0 ||
-        //[netblue@debian Downloads]$ firejail --join=896
-        //Switching to pid 897, the first child process inside the sandbox
-        //Error: seccomp file not found
-        //********************************************************************************
-        
-                                    strncmp(argv[i], "--join-filesystem=", 18) == 0 ||
-                                    strncmp(argv[i], "--join-network=", 15) == 0 ||
-                                    strncmp(argv[i], "--fs.print=", 11) == 0 ||
-                                    strncmp(argv[i], "--protocol.print=", 17) == 0 ||
-                                    strncmp(argv[i], "--seccomp.print", 15) == 0 ||
-                                    strncmp(argv[i], "--shutdown=", 11) == 0) {
-                                        found = 1;
-                                        break;
+                        if (check_arg(argc, argv, "--force"))
+                                option_force = 1;
+                        else {
+                                if (check_arg(argc, argv, "--version")) {
+                                        printf("firejail version %s\n", VERSION);
+                                        exit(0);
                                 }
-        
-                                // detect end of firejail params
-                                if (strcmp(argv[i], "--") == 0)
-                                        break;
-                                if (strncmp(argv[i], "--", 2) != 0)
-                                        break;
-                        }
-                        
-                        if (found == 0) {
+                                
                                 // start the program directly without sandboxing
                                 run_no_sandbox(argc, argv);
                                 // it will never get here!
                                 assert(0);
                         }
-                        else
-                                option_force = 1;
                 }
         }
-        
+
         // check root/suid
         EUID_ROOT();
         if (geteuid()) {
-                // detect --version
-                for (i = 1; i < argc; i++) {
-                        if (strcmp(argv[i], "--version") == 0) {
-                                printf("firejail version %s\n", VERSION);
-                                exit(0);
-                        }
-                        
-                        // detect end of firejail params
-                        if (strcmp(argv[i], "--") == 0)
-                                break;
-                        if (strncmp(argv[i], "--", 2) != 0)
-                                break;
+                // only --version is supported without SUID support
+                if (check_arg(argc, argv, "--version")) {
+                        printf("firejail version %s\n", VERSION);
+                        exit(0);
                 }
+
+                fprintf(stderr, "Error: cannot rise privileges\n");
                 exit(1);
         }
         EUID_USER();
@@ -1520,6 +1460,9 @@ int main(int argc, char **argv) {
                 else if (strcmp(argv[i], "--writable-var") == 0) {
                         arg_writable_var = 1;
                 }
+                else if (strcmp(argv[i], "--machine-id") == 0) {
+                        arg_machineid = 1;
+                }
                 else if (strcmp(argv[i], "--private") == 0) {
                         arg_private = 1;
                 }
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 8af555ea2..c56d90994 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -165,84 +165,28 @@ void run_no_sandbox(int argc, char **argv) {
         // process limited subset of options
         int i;
         for (i = 0; i < argc; i++) {
-                if (strcmp(argv[i], "--csh") == 0) {
-                        if (arg_shell_none) {
-                                fprintf(stderr, "Error: --shell=none was already specified.\n");
-                                exit(1);
-                        }
-                        if (cfg.shell) {
-                                fprintf(stderr, "Error: only one default user shell can be specified\n");
-                                exit(1);
-                        }
-                        cfg.shell = "/bin/csh";
-                }
-                else if (strcmp(argv[i], "--zsh") == 0) {
-                        if (arg_shell_none) {
-                                fprintf(stderr, "Error: --shell=none was already specified.\n");
-                                exit(1);
-                        }
-                        if (cfg.shell) {
-                                fprintf(stderr, "Error: only one default user shell can be specified\n");
-                                exit(1);
-                        }
-                        cfg.shell = "/bin/zsh";
-                }
-                else if (strcmp(argv[i], "--shell=none") == 0) {
-                        arg_shell_none = 1;
-                        if (cfg.shell) {
-                                fprintf(stderr, "Error: a shell was already specified\n");
-                                exit(1);
-                        }
-                }
-                else if (strncmp(argv[i], "--shell=", 8) == 0) {
-                        if (arg_shell_none) {
-                                fprintf(stderr, "Error: --shell=none was already specified.\n");
-                                exit(1);
-                        }
-                        invalid_filename(argv[i] + 8);
-
-                        if (cfg.shell) {
-                                fprintf(stderr, "Error: only one user shell can be specified\n");
-                                exit(1);
-                        }
-                        cfg.shell = argv[i] + 8;
-
-                        if (is_dir(cfg.shell) || strstr(cfg.shell, "..")) {
-                                fprintf(stderr, "Error: invalid shell\n");
-                                exit(1);
-                        }
-
-                        // access call checks as real UID/GID, not as effective UID/GID
-                        if(cfg.chrootdir) {
-                                char *shellpath;
-                                if (asprintf(&shellpath, "%s%s", cfg.chrootdir, cfg.shell) == -1)
-                                        errExit("asprintf");
-                                if (access(shellpath, R_OK)) {
-                                        fprintf(stderr, "Error: cannot access shell file in chroot\n");
-                                        exit(1);
-                                }
-                                free(shellpath);
-                        } else if (access(cfg.shell, R_OK)) {
-                                fprintf(stderr, "Error: cannot access shell file\n");
-                                exit(1);
-                        }
-                }
+                if (strcmp(argv[i], "--debug") == 0)
+                        arg_debug = 1;
+                else if (strcmp(argv[i], "--csh") == 0 ||
+                    strcmp(argv[i], "--zsh") == 0 ||
+                    strcmp(argv[i], "--shell=none") == 0 ||
+                    strncmp(argv[i], "--shell=", 8) == 0)
+                        fprintf(stderr, "Warning: shell-related command line options are disregarded - using SHELL environment variable");
         }
 
         // use $SHELL to get shell used in sandbox
-        if (!arg_shell_none && !cfg.shell) {
-                char *shell =  getenv("SHELL");
-                if (shell && access(shell, R_OK) == 0)
-                        cfg.shell = shell;
-        }
+        char *shell =  getenv("SHELL");
+        if (shell && access(shell, R_OK) == 0)
+                cfg.shell = shell;
+
         // guess shell otherwise
-        if (!arg_shell_none && !cfg.shell) {
+        if (!cfg.shell) {
                 cfg.shell = guess_shell();
                 if (arg_debug)
                         printf("Autoselecting %s as shell\n", cfg.shell);
         }
-        if (!arg_shell_none && !cfg.shell) {
-                fprintf(stderr, "Error: unable to guess your shell, please set explicitly by using --shell option.\n");
+        if (!cfg.shell) {
+                fprintf(stderr, "Error: unable to guess your shell, please set SHELL environment variable\n");
                 exit(1);
         }
 
@@ -266,13 +210,11 @@ void run_no_sandbox(int argc, char **argv) {
                 }
         }
 
-        if (!arg_shell_none) {
-                if (prog_index == 0) {
-                        cfg.command_line = cfg.shell;
-                        cfg.window_title = cfg.shell;
-                } else {
-                        build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
-                }
+        if (prog_index == 0) {
+                cfg.command_line = cfg.shell;
+                cfg.window_title = cfg.shell;
+        } else {
+                build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
         }
 
         cfg.original_argv = argv;
@@ -287,5 +229,6 @@ void run_no_sandbox(int argc, char **argv) {
                 fprintf(stderr, "Warning: an existing sandbox was detected. "
                         "%s will run without any additional sandboxing features\n", command);
 
+        arg_quiet = 1;
         start_application();
 }
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 3697b54b9..da3daf95a 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -650,6 +650,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         
+        if (strcmp(ptr, "machine-id") == 0) {
+                arg_machineid = 1;
+                return 0;
+        }
         // writable-var
         if (strcmp(ptr, "writable-var") == 0) {
                 arg_writable_var = 1;
@@ -1049,6 +1053,9 @@ void profile_read(const char *fname) {
 //              else {
 //                      free(ptr);
 //              }
+#ifdef HAVE_GCOV
+                __gcov_flush();
+#endif
         }
         fclose(fp);
 }
diff --git a/src/firejail/rlimit.c b/src/firejail/rlimit.c
index a774fd6f5..47dd846d2 100644
--- a/src/firejail/rlimit.c
+++ b/src/firejail/rlimit.c
@@ -27,6 +27,9 @@ void set_rlimits(void) {
         if (arg_rlimit_nofile) {
                 rl.rlim_cur = (rlim_t) cfg.rlimit_nofile;
                 rl.rlim_max = (rlim_t) cfg.rlimit_nofile;
+#ifdef HAVE_GCOV        // gcov-instrumented programs might crash at this point
+                __gcov_dump();
+#endif
                 if (setrlimit(RLIMIT_NOFILE, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -36,6 +39,9 @@ void set_rlimits(void) {
         if (arg_rlimit_nproc) {
                 rl.rlim_cur = (rlim_t) cfg.rlimit_nproc;
                 rl.rlim_max = (rlim_t) cfg.rlimit_nproc;
+#ifdef HAVE_GCOV
+                __gcov_dump();
+#endif
                 if (setrlimit(RLIMIT_NPROC, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -45,6 +51,9 @@ void set_rlimits(void) {
         if (arg_rlimit_fsize) {
                 rl.rlim_cur = (rlim_t) cfg.rlimit_fsize;
                 rl.rlim_max = (rlim_t) cfg.rlimit_fsize;
+#ifdef HAVE_GCOV
+                __gcov_dump();
+#endif
                 if (setrlimit(RLIMIT_FSIZE, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -54,6 +63,9 @@ void set_rlimits(void) {
         if (arg_rlimit_sigpending) {
                 rl.rlim_cur = (rlim_t) cfg.rlimit_sigpending;
                 rl.rlim_max = (rlim_t) cfg.rlimit_sigpending;
+#ifdef HAVE_GCOV
+                __gcov_dump();
+#endif
                 if (setrlimit(RLIMIT_SIGPENDING, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 68b8f554d..50fcd6ed0 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -286,6 +286,9 @@ void start_application(void) {
         //****************************************
         if (arg_audit) {
                 assert(arg_audit_prog);
+#ifdef HAVE_GCOV
+        __gcov_dump();
+#endif
                 execl(arg_audit_prog, arg_audit_prog, NULL);
         }
         //****************************************
@@ -309,6 +312,9 @@ void start_application(void) {
                 if (!arg_command && !arg_quiet)
                         printf("Child process initialized\n");
 
+#ifdef HAVE_GCOV
+        __gcov_dump();
+#endif
                 execvp(cfg.original_argv[cfg.original_program_index], &cfg.original_argv[cfg.original_program_index]);
                 exit(1);
         }
@@ -356,6 +362,9 @@ void start_application(void) {
 
                 if (!arg_command && !arg_quiet)
                         printf("Child process initialized\n");
+#ifdef HAVE_GCOV
+        __gcov_dump();
+#endif
                 execvp(arg[0], arg);
         }
 
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index c8bed06e3..db3c25a5a 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -94,6 +94,9 @@ void usage(void) {
         printf("    --ls=name|pid dir_or_filename - list files in sandbox container.\n");
 #ifdef HAVE_NETWORK     
         printf("    --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n");
+#endif
+        printf("    --machine-id - preserve /etc/machine-id\n");
+#ifdef HAVE_NETWORK     
         printf("    --mtu=number - set interface MTU.\n");
 #endif
         printf("    --name=name - set sandbox name.\n");
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 007374c75..fa522c154 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -447,6 +447,10 @@ iprange 192.168.1.150,192.168.1.160
 Assign MAC addresses to the last network interface defined by a net command.
 
 .TP
+\fBmachine-id
+Preserve id number in /etc/machine-id file. By default a new random id is generated inside the sandbox.
+
+.TP
 \fBmtu number
 Assign a MTU value to the last network interface defined by a net command.
 
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 450f30c68..fdeb9ea3f 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -666,6 +666,16 @@ Example:
 $ firejail \-\-net=eth0 \-\-mac=00:11:22:33:44:55 firefox
 
 .TP
+\fB\-\-machine-id
+Preserve id number in /etc/machine-id file. By default a new random id is generated inside the sandbox.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-machine-id
+
+.TP
 \fB\-\-mtu=number
 Assign a MTU value to the last network interface defined by a \-\-net option.
 .br