diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/firejail/checkcfg.c | 4 | ||||
-rw-r--r-- | src/firejail/firejail.h | 2 | ||||
-rw-r--r-- | src/firejail/fs.c | 2 | ||||
-rw-r--r-- | src/firejail/fs_etc.c | 7 |
4 files changed, 8 insertions, 7 deletions
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index 590543217..ce8446cc8 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -51,7 +51,7 @@ int checkcfg(int val) { | |||
51 | cfg_val[i] = 1; // most of them are enabled by default | 51 | cfg_val[i] = 1; // most of them are enabled by default |
52 | cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default | 52 | cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default |
53 | cfg_val[CFG_FORCE_NONEWPRIVS] = 0; | 53 | cfg_val[CFG_FORCE_NONEWPRIVS] = 0; |
54 | cfg_val[CFG_ETC_NO_BLACKLISTED] = 0; | 54 | cfg_val[CFG_ETC_HIDE_BLACKLISTED] = 0; |
55 | cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0; | 55 | cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0; |
56 | cfg_val[CFG_FIREJAIL_PROMPT] = 0; | 56 | cfg_val[CFG_FIREJAIL_PROMPT] = 0; |
57 | cfg_val[CFG_DISABLE_MNT] = 0; | 57 | cfg_val[CFG_DISABLE_MNT] = 0; |
@@ -116,7 +116,7 @@ int checkcfg(int val) { | |||
116 | PARSE_YESNO(CFG_TRACELOG, "tracelog") | 116 | PARSE_YESNO(CFG_TRACELOG, "tracelog") |
117 | PARSE_YESNO(CFG_XEPHYR_WINDOW_TITLE, "xephyr-window-title") | 117 | PARSE_YESNO(CFG_XEPHYR_WINDOW_TITLE, "xephyr-window-title") |
118 | PARSE_YESNO(CFG_OVERLAYFS, "overlayfs") | 118 | PARSE_YESNO(CFG_OVERLAYFS, "overlayfs") |
119 | PARSE_YESNO(CFG_ETC_NO_BLACKLISTED, "etc-no-blacklisted") | 119 | PARSE_YESNO(CFG_ETC_HIDE_BLACKLISTED, "etc-hide-blacklisted") |
120 | PARSE_YESNO(CFG_PRIVATE_BIN, "private-bin") | 120 | PARSE_YESNO(CFG_PRIVATE_BIN, "private-bin") |
121 | PARSE_YESNO(CFG_PRIVATE_BIN_NO_LOCAL, "private-bin-no-local") | 121 | PARSE_YESNO(CFG_PRIVATE_BIN_NO_LOCAL, "private-bin-no-local") |
122 | PARSE_YESNO(CFG_PRIVATE_CACHE, "private-cache") | 122 | PARSE_YESNO(CFG_PRIVATE_CACHE, "private-cache") |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index cf5c5b2fa..13ee573ad 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -811,7 +811,7 @@ enum { | |||
811 | CFG_FORCE_NONEWPRIVS, | 811 | CFG_FORCE_NONEWPRIVS, |
812 | CFG_XEPHYR_WINDOW_TITLE, | 812 | CFG_XEPHYR_WINDOW_TITLE, |
813 | CFG_OVERLAYFS, | 813 | CFG_OVERLAYFS, |
814 | CFG_ETC_NO_BLACKLISTED, | 814 | CFG_ETC_HIDE_BLACKLISTED, |
815 | CFG_PRIVATE_BIN, | 815 | CFG_PRIVATE_BIN, |
816 | CFG_PRIVATE_BIN_NO_LOCAL, | 816 | CFG_PRIVATE_BIN_NO_LOCAL, |
817 | CFG_PRIVATE_CACHE, | 817 | CFG_PRIVATE_CACHE, |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 3066c50ed..84f207fac 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -162,7 +162,7 @@ static void disable_file(OPERATION op, const char *filename) { | |||
162 | fs_logger2("blacklist-nolog", fname); | 162 | fs_logger2("blacklist-nolog", fname); |
163 | 163 | ||
164 | // files in /etc will be reprocessed during /etc rebuild | 164 | // files in /etc will be reprocessed during /etc rebuild |
165 | if (checkcfg(CFG_ETC_NO_BLACKLISTED) && strncmp(fname, "/etc/", 5) == 0) { | 165 | if (checkcfg(CFG_ETC_HIDE_BLACKLISTED) && strncmp(fname, "/etc/", 5) == 0) { |
166 | ProfileEntry *prf = malloc(sizeof(ProfileEntry)); | 166 | ProfileEntry *prf = malloc(sizeof(ProfileEntry)); |
167 | if (!prf) | 167 | if (!prf) |
168 | errExit("malloc"); | 168 | errExit("malloc"); |
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c index e58537e49..aa4d76431 100644 --- a/src/firejail/fs_etc.c +++ b/src/firejail/fs_etc.c | |||
@@ -265,9 +265,10 @@ void fs_private_dir_list(const char *private_dir, const char *private_run_dir, c | |||
265 | void fs_rebuild_etc(void) { | 265 | void fs_rebuild_etc(void) { |
266 | int have_dhcp = 1; | 266 | int have_dhcp = 1; |
267 | if (cfg.dns1 == NULL && !any_dhcp()) { | 267 | if (cfg.dns1 == NULL && !any_dhcp()) { |
268 | // this function has the effect that updates to files using rename(2) don't propagate into the sandbox | 268 | // Disabling this option ensures that updates to files using |
269 | // avoid this in the default setting, in order to not break /etc/resolv.conf (issue #5010) | 269 | // rename(2) propagate into the sandbox, in order to avoid |
270 | if (!checkcfg(CFG_ETC_NO_BLACKLISTED)) | 270 | // breaking /etc/resolv.conf (issue #5010). |
271 | if (!checkcfg(CFG_ETC_HIDE_BLACKLISTED)) | ||
271 | return; | 272 | return; |
272 | have_dhcp = 0; | 273 | have_dhcp = 0; |
273 | } | 274 | } |