9 files changed, 47 insertions, 36 deletions

diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c
index fca3396c4..c0f4a3407 100644
--- a/src/fbuilder/build_home.c
+++ b/src/fbuilder/build_home.c
@@ -24,7 +24,7 @@ static FileDB *db_skip = NULL;
 static FileDB *db_out = NULL;
 
 static void load_whitelist_common(void) {
-        FILE *fp = fopen("/etc/firejail/whitelist-common.inc", "r");
+        FILE *fp = fopen(SYSCONFDIR "/whitelist-common.inc", "r");
         if (!fp) {
                 fprintf(stderr, "Error: cannot open whitelist-common.inc\n");
                 exit(1);
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index adc00e67b..0517c837e 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -80,10 +80,19 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
           stroutput,
         };
 
-        // detect strace
+        // detect strace and check if Yama LSM allows us to use it
         int have_strace = 0;
-        if (access("/usr/bin/strace", X_OK) == 0)
+        int have_yama_permission = 1;
+        if (access("/usr/bin/strace", X_OK) == 0) {
                 have_strace = 1;
+                FILE *fp = fopen("/proc/sys/kernel/yama/ptrace_scope", "r");
+                if (fp) {
+                        unsigned val;
+                        if (fscanf(fp, "%u", &val) == 1)
+                                have_yama_permission = (val < 2);
+                        fclose(fp);
+                }
+        }
 
         // calculate command length
         unsigned len = (int) sizeof(cmdlist) / sizeof(char*) + argc - index + 1;
@@ -93,10 +102,11 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
         cmd[0] = cmdlist[0];    // explicit assignment to clean scan-build error
 
         // build command
+        int skip_strace = !(have_strace && have_yama_permission);
         unsigned i = 0;
         for (i = 0; i < (int) sizeof(cmdlist) / sizeof(char*); i++) {
-                // skip strace if not installed
-                if (have_strace == 0 && strcmp(cmdlist[i], "/usr/bin/strace") == 0)
+                // skip strace if not installed, or no permission to use it
+                if (skip_strace && strcmp(cmdlist[i], "/usr/bin/strace") == 0)
                         break;
                 cmd[i] = cmdlist[i];
         }
@@ -172,12 +182,14 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
                 fprintf(fp, "caps.drop all\n");
                 fprintf(fp, "nonewprivs\n");
                 fprintf(fp, "seccomp\n");
-                if (have_strace)
-                        build_seccomp(strace_output, fp);
-                else {
+                if (!have_strace) {
                         fprintf(fp, "# If you install strace on your system, Firejail will also create a\n");
                         fprintf(fp, "# whitelisted seccomp filter.\n");
                 }
+                else if (!have_yama_permission)
+                        fprintf(fp, "# Yama security module prevents creation of a whitelisted seccomp filter\n");
+                else
+                        build_seccomp(strace_output, fp);
                 fprintf(fp, "\n");
 
                 fprintf(fp, "### network\n");
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 23b1e364a..109f89f39 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -455,6 +455,7 @@ macrofusion
 magicor
 # man
 manaplus
+marker
 masterpdfeditor
 masterpdfeditor4
 masterpdfeditor5
@@ -621,6 +622,7 @@ qemu-launcher
 qgis
 qlipper
 qmmp
+qnapi
 qpdfview
 qt-faststart
 qtox
@@ -662,6 +664,7 @@ secret-tool
 shellcheck
 shortwave
 shotcut
+shotwell
 signal-cli
 signal-desktop
 silentarmy
@@ -771,6 +774,7 @@ tremulous
 trojita
 truecraft
 tshark
+tutanota-desktop
 tuxguitar
 tvbrowser
 twitch
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index 941d6ad82..b76999d8f 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -165,7 +165,7 @@ void fslib_copy_dir(const char *full_path) {
         mkdir_attr(dest, 0755, 0, 0);
 
         if (mount(full_path, dest, NULL, MS_BIND|MS_REC, NULL) < 0 ||
-                mount(NULL, dest, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NODEV|MS_REC, NULL) < 0)
+                mount(NULL, dest, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV|MS_REC, NULL) < 0)
                 errExit("mount bind");
         fs_logger2("clone", full_path);
         fs_logger2("mount", full_path);
diff --git a/src/firejail/join.c b/src/firejail/join.c
index d2f802add..4f0210f95 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -296,7 +296,7 @@ static void extract_umask(pid_t pid) {
                 fprintf(stderr, "Error: cannot open umask file\n");
                 exit(1);
         }
-        if (fscanf(fp, "%o", &orig_umask) != 1) {
+        if (fscanf(fp, "%3o", &orig_umask) != 1) {
                 fprintf(stderr, "Error: cannot read umask\n");
                 exit(1);
         }
@@ -335,7 +335,7 @@ bool is_ready_for_join(const pid_t pid) {
         struct stat s;
         if (fstat(fd, &s) == -1)
                 errExit("fstat");
-        if (!S_ISREG(s.st_mode) || s.st_uid != 0) {
+        if (!S_ISREG(s.st_mode) || s.st_uid != 0 || s.st_size != 1) {
                 close(fd);
                 return false;
         }
@@ -411,7 +411,7 @@ void join(pid_t pid, int argc, char **argv, int index) {
         extract_x11_display(parent);
 
         int shfd = -1;
-        if (!arg_shell_none)
+        if (!arg_shell_none && !arg_audit)
                 shfd = open_shell();
 
         EUID_ROOT();
@@ -423,6 +423,7 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 extract_cgroup(pid);
                 extract_nogroups(pid);
                 extract_user_namespace(pid);
+                extract_umask(pid);
 #ifdef HAVE_APPARMOR
                 extract_apparmor(pid);
 #endif
@@ -432,9 +433,6 @@ void join(pid_t pid, int argc, char **argv, int index) {
         if (cfg.cgroup) // not available for uid 0
                 set_cgroup(cfg.cgroup);
 
-        // set umask, also uid 0
-        extract_umask(pid);
-
         // join namespaces
         if (arg_join_network) {
                 if (join_namespace(pid, "net"))
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 0b095e1be..911c8bd94 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -565,27 +565,18 @@ char *clean_pathname(const char *path) {
         if (!rv)
                 errExit("malloc");
 
-        if (len > 0) {
-                size_t i = 0, j = 0, cnt = 0;
-                for (; i < len; i++) {
-                        if (path[i] == '/')
-                                cnt++;
-                        else
-                                cnt = 0;
-
-                        if (cnt < 2) {
-                                rv[j] = path[i];
-                                j++;
-                        }
-                }
-                rv[j] = '\0';
-
-                // remove a trailing slash
-                if (j > 1 && rv[j - 1] == '/')
-                        rv[j - 1] = '\0';
+        size_t i = 0;
+        size_t j = 0;
+        while (path[i]) {
+                while (path[i] == '/' && path[i+1] == '/')
+                        i++;
+                rv[j++] = path[i++];
         }
-        else
-                *rv = '\0';
+        rv[j] = '\0';
+
+        // remove a trailing slash
+        if (j > 1 && rv[j - 1] == '/')
+                rv[j - 1] = '\0';
 
         return rv;
 }
diff --git a/src/lib/syscall.c b/src/lib/syscall.c
index 4903971ad..6823d0ae6 100644
--- a/src/lib/syscall.c
+++ b/src/lib/syscall.c
@@ -336,6 +336,7 @@ static const SyscallGroupList sysgroups[] = {
 #endif
         },
         { .name = "@default-keep", .list =
+          "execveat," // commonly used by fexecve
           "execve,"
           "prctl"
         },
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 9524254c1..030a3c95c 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -862,6 +862,11 @@ the parent interface specified by --net is not configured. An IP address and
 a default gateway address also have to be added.
 
 .TP
+\fBnetns namespace
+Run the program in a named, persistent network namespace. These can
+be created and configured using "ip netns".
+
+.TP
 \fBveth-name name
 Use this name for the interface connected to the bridge for --net=bridge_interface commands,
 instead of the default one.
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 347e2b31b..e72ef48c2 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -2273,7 +2273,7 @@ rm: cannot remove `testfile': Operation not permitted
 .TP
 \fB\-\-seccomp.keep=syscall,@group,!syscall2
 Enable seccomp filter, blacklist all syscall not listed and "syscall2".
-The system calls needed by Firejail (group @default-keep: prctl, execve)
+The system calls needed by Firejail (group @default-keep: prctl, execve, execveat)
 are handled with the preload library. On a 64 bit architecture, an
 additional filter for 32 bit system calls can be installed with
 \-\-seccomp.32.keep.