From 22d9b7ecc083c61ad6cacec886a676083a27ad4e Mon Sep 17 00:00:00 2001
From: smitsohu <smitsohu@gmail.com>
Date: Wed, 2 May 2018 23:06:31 +0200
Subject: harden pulseaudio, xauthority mounts

---
 src/firejail/pulseaudio.c | 14 +++++++++++++-
 src/firejail/x11.c        |  8 ++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index 9109a6865..ad93efe3c 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -162,22 +162,34 @@ void pulseaudio_init(void) {
 	}
 	free(dir1);
 
-
 	// if we have ~/.config/pulse mount the new directory, else set environment variable
 	char *homeusercfg;
 	if (asprintf(&homeusercfg, "%s/.config/pulse", cfg.homedir) == -1)
 		errExit("asprintf");
 	if (stat(homeusercfg, &s) == 0) {
+		if (is_link(homeusercfg)) {
+			fprintf(stderr, "Error: user .config/pulse is a symbolic link\n");
+			exit(1);
+		}
 		if (mount(RUN_PULSE_DIR, homeusercfg, "none", MS_BIND, NULL) < 0 ||
 		    mount(NULL, homeusercfg, NULL, MS_NOEXEC|MS_NODEV|MS_NOSUID|MS_BIND|MS_REMOUNT, NULL) < 0)
 			errExit("mount pulseaudio");
 		fs_logger2("tmpfs", homeusercfg);
+
+		// check /proc/self/mounts to confirm the mount is ok
+		MountData *mptr = get_last_mount();
+		if (strncmp(mptr->dir,homeusercfg,strlen(homeusercfg)) != 0) {
+			fprintf(stderr, "Error: invalid mount on top of %s (should be %s)\n", mptr->dir, homeusercfg);
+			exit(1);
+		}
+
 		char *p;
 		if (asprintf(&p, "%s/client.conf", homeusercfg) == -1)
 			errExit("asprintf");
 		fs_logger2("create", p);
 		free(p);
 	}
+
 	else {
 		// set environment
 		if (setenv("PULSE_CLIENTCONFIG", pulsecfg, 1) < 0)
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 8cf4fccf3..d8b5961a2 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -1193,6 +1193,14 @@ void x11_xorg(void) {
 	// just  in case...
 	if (set_perms(dest, getuid(), getgid(), 0600))
 		errExit("set_perms");
+
+	// check /proc/self/mounts to confirm the mount is ok
+	MountData *mptr = get_last_mount();
+	if (strncmp(mptr->dir,dest,strlen(dest)) != 0) {
+		fprintf(stderr, "Error: invalid mount on top of %s (should be %s)\n", mptr->dir, dest);
+		exit(1);
+	}
+
 	free(dest);
 #endif
 }
-- 
cgit v1.2.3-54-g00ecf