6 files changed, 79 insertions, 14 deletions

diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index bec22e5a6..dbc74bfff 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -20,7 +20,6 @@
 #include "firejail.h"
 #include <sys/mount.h>
 #include <linux/limits.h>
-#include <glob.h>
 #include <dirent.h>
 #include <errno.h>
 #include <sys/stat.h>
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index c5b066b12..3f3075570 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -346,6 +346,39 @@ static void whitelist_home(int topdir) {
 }
 
 
+static void globbing(const char *pattern) {
+        assert(pattern);
+
+        // globbing
+        glob_t globbuf;
+        int globerr = glob(pattern, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf);
+        if (globerr) {
+                fprintf(stderr, "Error: failed to glob private-bin pattern %s\n", pattern);
+                exit(1);
+        }
+
+        size_t i;
+        for (i = 0; i < globbuf.gl_pathc; i++) {
+                assert(globbuf.gl_pathv[i]);
+                // testing for GLOB_NOCHECK - no pattern matched returns the original pattern
+                if (strcmp(globbuf.gl_pathv[i], pattern) == 0)
+                        continue;
+
+                // build the new profile command
+                char *newcmd;
+                if (asprintf(&newcmd, "whitelist %s", globbuf.gl_pathv[i]) == -1)
+                        errExit("asprintf");
+
+                // add the new profile command at the end of the list
+                if (arg_debug || arg_debug_whitelists)
+                        printf("Adding new profile command: %s\n", newcmd);
+                profile_add(newcmd);
+        }
+
+        globfree(&globbuf);
+}
+
+
 void fs_whitelist(void) {
         ProfileEntry *entry = cfg.profile;
         if (!entry)
@@ -444,6 +477,13 @@ void fs_whitelist(void) {
                 else
                         fname = realpath(new_name, NULL);
 
+                // if this is not a real path, let's try globbing
+                // mark this entry as EMPTY_STRING and push the new paths at the end of profile entry list
+                // the new profile entries will be processed in this loop
+                // currently there is no globbing support for nowhitelist
+                if (!fname && !nowhitelist_flag)
+                        globbing(new_name);
+
                 if (!fname) {
                         // file not found, blank the entry in the list and continue
                         if (arg_debug || arg_debug_whitelists) {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index c98ad3620..77bfea8c6 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -208,6 +208,7 @@ static char *usage_str =
         "\twhitelist the syscalls specified by the command.\n"
         "    --seccomp.print=name|pid - print the seccomp filter for the sandbox\n"
         "\tidentified by name or PID.\n"
+        "    --seccomp.32[.drop,.keep][=syscall] - like above but for 32 bit architecture.\n"
 #endif
         "    --shell=none - run the program directly without a user shell.\n"
         "    --shell=program - set default user shell.\n"
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 74de24b47..98ac184d9 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -1235,16 +1235,15 @@ void x11_xorg(void) {
 
         // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted
         // automatically when the sandbox is closed (rename doesn't work)
-                                                  // root needed
-        if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) {
-                fprintf(stderr, "Error: cannot create the new .Xauthority file\n");
-                exit(1);
-        }
+        if (arg_debug)
+                printf("Copying the new .Xauthority file\n");
+        copy_file_from_user_to_root(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600);
+        
         /* coverity[toctou] */
         unlink(tmpfname);
         umount("/tmp");
 
-        // remount RUN_XAUTHORITY_SEC_FILE noexec, nodev, nosuid
+        // mount RUN_XAUTHORITY_SEC_FILE noexec, nodev, nosuid
         fs_remount(RUN_XAUTHORITY_SEC_FILE, MOUNT_NOEXEC, 0);
 
         // Ensure there is already a file in the usual location, so that bind-mount below will work.
@@ -1354,19 +1353,17 @@ void fs_x11(void) {
         if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
                 errExit("mount bind");
 
-        // This directory must be mode 1777, or Xlib will barf.
+        // This directory must be mode 1777
         if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
                 MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,
                 "mode=1777,uid=0,gid=0") < 0)
                 errExit("mounting tmpfs on /tmp/.X11-unix");
         fs_logger("tmpfs /tmp/.X11-unix");
 
-        // create an empty file which will have the desired socket bind-mounted over it
-        int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT);
+        // create an empty root-owned file which will have the desired socket bind-mounted over it
+        int fd = open(x11file, O_RDONLY|O_CREAT|O_EXCL, S_IRUSR | S_IWUSR);
         if (fd < 0)
                 errExit(x11file);
-        if (fchown(fd, x11stat.st_uid, x11stat.st_gid))
-                errExit("fchown");
         close(fd);
 
         // the mount source is under control of the user, so be careful and
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 13dcf09ee..1bed40015 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -2346,6 +2346,10 @@ the same top directory. For user home, both the link and the real file should be
 .br
 
 .br
+File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
+.br
+
+.br
 Example:
 .br
 $ firejail \-\-noprofile \-\-whitelist=~/.mozilla
@@ -2353,6 +2357,8 @@ $ firejail \-\-noprofile \-\-whitelist=~/.mozilla
 $ firejail \-\-whitelist=/tmp/.X11-unix --whitelist=/dev/null
 .br
 $ firejail "\-\-whitelist=/home/username/My Virtual Machines"
+.br
+$ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups*
 
 .TP
 \fB\-\-writable-etc
@@ -2722,7 +2728,7 @@ The globbing feature is implemented using glibc glob command. For more informati
 
 .br
 .TP
-The following command line options are supported: \-\-blacklist, \-\-private-bin, \-\-noexec, \-\-read-only, \-\-read-write, and \-\-tmpfs.
+The following command line options are supported: \-\-blacklist, \-\-private-bin, \-\-noexec, \-\-read-only, \-\-read-write, \-\-tmpfs, and \-\-whitelist.
 .br
 
 .br
diff --git a/src/profstats/main.c b/src/profstats/main.c
index 76b90f01b..f8818982f 100644
--- a/src/profstats/main.c
+++ b/src/profstats/main.c
@@ -35,6 +35,8 @@ static int cnt_noexec = 0;	// include disable-exec.inc
 static int cnt_privatedev = 0;
 static int cnt_privatetmp = 0;
 static int cnt_whitelistvar = 0;        // include whitelist-var-common.inc
+static int cnt_whitelistrunuser = 0;    // include whitelist-runuser-common.inc
+static int cnt_whitelistusrshare = 0;   // include whitelist-usr-share-common.inc
 static int cnt_ssh = 0;
 
 static int level = 0;
@@ -46,6 +48,8 @@ static int arg_noexec = 0;
 static int arg_privatedev = 0;
 static int arg_privatetmp = 0;
 static int arg_whitelistvar = 0;
+static int arg_whitelistrunuser = 0;
+static int arg_whitelistusrshare = 0;
 static int arg_ssh = 0;
 
 static char *profile = NULL;
@@ -63,6 +67,8 @@ static void usage(void) {
         printf("   --private-tmp - print profiles without private-tmp\n");
         printf("   --seccomp - print profiles without seccomp\n");
         printf("   --whitelist-var - print profiles without \"include whitelist-var-common.inc\"\n");
+        printf("   --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\"\n");
+        printf("   --whitelist-usrshare - print profiles without \"include whitelist-usr-share-common.inc\"\n");
         printf("   --debug\n");
         printf("\n");
 }
@@ -102,6 +108,10 @@ void process_file(const char *fname) {
                         cnt_noexec++;
                 else if (strncmp(ptr, "include whitelist-var-common.inc", 32) == 0)
                         cnt_whitelistvar++;
+                else if (strncmp(ptr, "include whitelist-runuser-common.inc", 32) == 0)
+                        cnt_whitelistrunuser++;
+                else if (strncmp(ptr, "include whitelist-usr-share-common.inc", 32) == 0)
+                        cnt_whitelistusrshare++;
                 else if (strncmp(ptr, "include disable-common.inc", 26) == 0)
                         cnt_ssh++;
                 else if (strncmp(ptr, "net none", 8) == 0)
@@ -159,6 +169,10 @@ int main(int argc, char **argv) {
                         arg_privatetmp = 1;
                 else if (strcmp(argv[i], "--whitelist-var") == 0)
                         arg_whitelistvar = 1;
+                else if (strcmp(argv[i], "--whitelist-runuser") == 0)
+                        arg_whitelistrunuser = 1;
+                else if (strcmp(argv[i], "--whitelist-usrshare") == 0)
+                        arg_whitelistusrshare = 1;
                 else if (strcmp(argv[i], "--ssh") == 0)
                         arg_ssh = 1;
                 else if (*argv[i] == '-') {
@@ -188,6 +202,8 @@ int main(int argc, char **argv) {
                 int dotlocal = cnt_dotlocal;
                 int globalsdotlocal = cnt_globalsdotlocal;
                 int whitelistvar = cnt_whitelistvar;
+                int whitelistrunuser = cnt_whitelistrunuser;
+                int whitelistusrshare = cnt_whitelistusrshare;
                 int ssh = cnt_ssh;
 
                 // process file
@@ -220,6 +236,10 @@ int main(int argc, char **argv) {
                         printf("No private-tmp found in %s\n", argv[i]);
                 if (arg_whitelistvar && whitelistvar == cnt_whitelistvar)
                         printf("No include whitelist-var-common.inc found in %s\n", argv[i]);
+                if (arg_whitelistrunuser && whitelistrunuser == cnt_whitelistrunuser)
+                        printf("No include whitelist-runuser-common.inc found in %s\n", argv[i]);
+                if (arg_whitelistusrshare && whitelistusrshare == cnt_whitelistusrshare)
+                        printf("No include whitelist-usr-share-common.inc found in %s\n", argv[i]);
                 if (arg_ssh && ssh == cnt_ssh)
                         printf("No include disable-common.inc found in %s\n", argv[i]);
 
@@ -238,7 +258,9 @@ int main(int argc, char **argv) {
         printf("    apparmor\t\t\t%d\n", cnt_apparmor);
         printf("    private-dev\t\t\t%d\n", cnt_privatedev);
         printf("    private-tmp\t\t\t%d\n", cnt_privatetmp);
-        printf("    whitelist var directory\t%d   (include whitelist-var-common.inc)\n", cnt_whitelistvar);
+        printf("    whitelist var\t\t%d   (include whitelist-var-common.inc)\n", cnt_whitelistvar);
+        printf("    whitelist run/user\t\t%d   (include whitelist-runuser-common.inc)\n", cnt_whitelistrunuser);
+        printf("    whitelist usr/share\t\t%d   (include whitelist-usr-share-common.inc)\n", cnt_whitelistusrshare);
         printf("    net none\t\t\t%d\n", cnt_netnone);
         printf("\n");
         return 0;