diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/firejail.h | 1 | ||||
-rw-r--r-- | src/firejail/main.c | 5 | ||||
-rw-r--r-- | src/firejail/restrict_users.c | 3 | ||||
-rw-r--r-- | src/firejail/usage.c | 1 | ||||
-rw-r--r-- | src/man/firejail.txt | 9 |
5 files changed, 19 insertions, 0 deletions
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index e3bf5e187..e76f54ec3 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -318,6 +318,7 @@ extern char *arg_audit_prog; // audit | |||
318 | extern int arg_apparmor; // apparmor | 318 | extern int arg_apparmor; // apparmor |
319 | extern int arg_allow_debuggers; // allow debuggers | 319 | extern int arg_allow_debuggers; // allow debuggers |
320 | extern int arg_x11_block; // block X11 | 320 | extern int arg_x11_block; // block X11 |
321 | extern int arg_allusers; // all user home directories visible | ||
321 | 322 | ||
322 | extern int login_shell; | 323 | extern int login_shell; |
323 | extern int parent_to_child_fds[2]; | 324 | extern int parent_to_child_fds[2]; |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 03ffab788..1f2ee9573 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -106,8 +106,11 @@ char *arg_audit_prog = NULL; // audit | |||
106 | int arg_apparmor = 0; // apparmor | 106 | int arg_apparmor = 0; // apparmor |
107 | int arg_allow_debuggers = 0; // allow debuggers | 107 | int arg_allow_debuggers = 0; // allow debuggers |
108 | int arg_x11_block = 0; // block X11 | 108 | int arg_x11_block = 0; // block X11 |
109 | int arg_allusers = 0; // all user home directories visible | ||
110 | |||
109 | int login_shell = 0; | 111 | int login_shell = 0; |
110 | 112 | ||
113 | |||
111 | int parent_to_child_fds[2]; | 114 | int parent_to_child_fds[2]; |
112 | int child_to_parent_fds[2]; | 115 | int child_to_parent_fds[2]; |
113 | 116 | ||
@@ -1296,6 +1299,8 @@ int main(int argc, char **argv) { | |||
1296 | //************************************* | 1299 | //************************************* |
1297 | // filesystem | 1300 | // filesystem |
1298 | //************************************* | 1301 | //************************************* |
1302 | else if (strcmp(argv[i], "--allusers") == 0) | ||
1303 | arg_allusers = 1; | ||
1299 | #ifdef HAVE_BIND | 1304 | #ifdef HAVE_BIND |
1300 | else if (strncmp(argv[i], "--bind=", 7) == 0) { | 1305 | else if (strncmp(argv[i], "--bind=", 7) == 0) { |
1301 | if (checkcfg(CFG_BIND)) { | 1306 | if (checkcfg(CFG_BIND)) { |
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c index 6aca49b1a..5ef9524d7 100644 --- a/src/firejail/restrict_users.c +++ b/src/firejail/restrict_users.c | |||
@@ -335,6 +335,9 @@ errout: | |||
335 | } | 335 | } |
336 | 336 | ||
337 | void restrict_users(void) { | 337 | void restrict_users(void) { |
338 | if (arg_allusers) | ||
339 | return; | ||
340 | |||
338 | // only in user mode | 341 | // only in user mode |
339 | if (getuid()) { | 342 | if (getuid()) { |
340 | if (strncmp(cfg.homedir, "/home/", 6) == 0) { | 343 | if (strncmp(cfg.homedir, "/home/", 6) == 0) { |
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index c08ec18a0..3425b050e 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -35,6 +35,7 @@ void usage(void) { | |||
35 | printf("Options:\n\n"); | 35 | printf("Options:\n\n"); |
36 | printf(" -- - signal the end of options and disables further option processing.\n\n"); | 36 | printf(" -- - signal the end of options and disables further option processing.\n\n"); |
37 | printf(" --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n\n"); | 37 | printf(" --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n\n"); |
38 | printf(" --allusers - all user home directories are visible inside the sandbox.\n\n"); | ||
38 | printf(" --apparmor - enable AppArmor confinement\n\n"); | 39 | printf(" --apparmor - enable AppArmor confinement\n\n"); |
39 | printf(" --appimage - sandbox an AppImage application\n\n"); | 40 | printf(" --appimage - sandbox an AppImage application\n\n"); |
40 | printf(" --audit - audit the sandbox, see Audit section for more details\n\n"); | 41 | printf(" --audit - audit the sandbox, see Audit section for more details\n\n"); |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 88c884801..71624afc2 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -84,6 +84,15 @@ Example: | |||
84 | .br | 84 | .br |
85 | $ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox | 85 | $ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox |
86 | .TP | 86 | .TP |
87 | \fB\-\-allusers | ||
88 | All user home directories are visible inside the sandbox. By default, only current user home directory is visible. | ||
89 | .br | ||
90 | |||
91 | .br | ||
92 | Example: | ||
93 | .br | ||
94 | $ firejail --allusers | ||
95 | .TP | ||
87 | \fB\-\-apparmor | 96 | \fB\-\-apparmor |
88 | Enable AppArmor confinement. For more information, please see \fBAPPARMOR\fR section below. | 97 | Enable AppArmor confinement. For more information, please see \fBAPPARMOR\fR section below. |
89 | .TP | 98 | .TP |