| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
storage_find function fails on relative path, so nothing reported to log when blacklisted file accessed by relative path.
This is because CWD is NULL when realpath function called.
How to reproduce:
touch /home/user/somefile
firejail --blacklist=somefile --tracelog cat somefile
Solution: keep CWD value and set it before calling realpath. In order to do this:
* new wrapper for chdir call, and variable to keep CWD added.
* storage_find modified to chdir before calling realpath function.
* order of storage_find and orig_* calls in syscall wrappers changed,
to prevent error set by calls in storage_find leak outside.
* condition for calling realpath changed to include double-slash
and path without initial slash.
|
Aleksey Manevich
Martin Carpenter
netblue30
Reiner Herrmann