From 0823eebfb6fc3c972d2a591ddae2ec4e668c95ff Mon Sep 17 00:00:00 2001 From: netblue30 Date: Thu, 3 Aug 2017 13:52:42 -0400 Subject: private-lib: split fldd as a separate application --- src/firejail/firejail.h | 2 + src/firejail/fs_lib.c | 156 ++++++++++-------------------------------------- 2 files changed, 34 insertions(+), 124 deletions(-) (limited to 'src') diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index dc903962b..19edb40a0 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h @@ -49,6 +49,7 @@ #define RUN_BIN_DIR "/run/firejail/mnt/bin" #define RUN_PULSE_DIR "/run/firejail/mnt/pulse" #define RUN_LIB_DIR "/run/firejail/mnt/lib" +#define RUN_LIB_FILE "/run/firejail/mnt/libfiles" #define RUN_SECCOMP_PROTOCOL "/run/firejail/mnt/seccomp.protocol" // protocol filter #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp" // configured filter @@ -739,6 +740,7 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, #define PATH_FSECCOMP (LIBDIR "/firejail/fseccomp") #define PATH_FCOPY (LIBDIR "/firejail/fcopy") #define SBOX_STDIN_FILE "/run/firejail/mnt/sbox_stdin" +#define PATH_FLDD (LIBDIR "/firejail/fldd") // bitmapped filters for sbox_run #define SBOX_ROOT (1 << 0) // run the sandbox as root diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c index d86588792..576b4a0df 100644 --- a/src/firejail/fs_lib.c +++ b/src/firejail/fs_lib.c @@ -18,156 +18,60 @@ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. */ #include "firejail.h" -#include -#include -#include #include #include #include #include -#ifdef __LP64__ -#define Elf_Ehdr Elf64_Ehdr -#define Elf_Phdr Elf64_Phdr -#define Elf_Shdr Elf64_Shdr -#define Elf_Dyn Elf64_Dyn -#else -#define Elf_Ehdr Elf32_Ehdr -#define Elf_Phdr Elf32_Phdr -#define Elf_Shdr Elf32_Shdr -#define Elf_Dyn Elf32_Dyn -#endif - -static const char * const lib_paths[] = { - "/lib", - "/lib/x86_64-linux-gnu", - "/lib64", - "/usr/lib", - "/usr/lib/x86_64-linux-gnu", - LIBDIR, - "/usr/local/lib", - NULL -}; - -static void copy_libs_for_lib(const char *lib, const char *private_run_dir); - static void duplicate(const char *fname, const char *private_run_dir) { if (arg_debug) printf("copying %s to private %s\n", fname, private_run_dir); sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", fname, private_run_dir); } -static void copy_libs_for_exe(const char *exe, const char *private_run_dir) { - if (arg_debug) - printf("copy libs for %s\n", exe); - int f; - f = open(exe, O_RDONLY); - if (f < 0) - return; - struct stat s; - char *base = NULL; - if (fstat(f, &s) == -1) - goto error_close; - base = mmap(0, s.st_size, PROT_READ | PROT_WRITE, MAP_PRIVATE, f, 0); - if (base == MAP_FAILED) - goto error_close; - - Elf_Ehdr *ebuf = (Elf_Ehdr *)base; - if (strncmp((const char *)ebuf->e_ident, ELFMAG, SELFMAG) != 0) - goto close; - - Elf_Phdr *pbuf = (Elf_Phdr *)(base + sizeof(*ebuf)); - while (ebuf->e_phnum-- > 0) { - switch (pbuf->p_type) { - case PT_INTERP: - // dynamic loader ld-linux.so - duplicate(base + pbuf->p_offset, private_run_dir); - break; - } - pbuf++; - } - - Elf_Shdr *sbuf = (Elf_Shdr *)(base + ebuf->e_shoff); - - // Find strings section - char *strbase = NULL; - int sections = ebuf->e_shnum; - while (sections-- > 0) { - if (sbuf->sh_type == SHT_STRTAB) { - strbase = base + sbuf->sh_offset; - break; - } - sbuf++; +static void copy_libs(const char *exe, const char *dir, const char *file) { + // create an empty RUN_LIB_FILE and allow the user to write to it + unlink(file); // in case is there + create_empty_file_as_root(file, 0644); + if (chown(file, getuid(), getgid())) + errExit("chown"); + + // run fldd to extact the list of file + sbox_run(SBOX_USER | SBOX_SECCOMP | SBOX_CAPS_NONE, 3, PATH_FLDD, exe, file); + + // open the list of libraries and install them on by one + FILE *fp = fopen(file, "r"); + if (!fp) + errExit("fopen"); + +#define MAXBUF 4096 + char buf[MAXBUF]; + while (fgets(buf, MAXBUF, fp)) { + // remove \n + char *ptr = strchr(buf, '\n'); + if (ptr) + *ptr = '\0'; + duplicate(buf, dir); } - if (strbase == NULL) - goto error_close; - - // Find dynamic section - sections = ebuf->e_shnum; - while (sections-- > 0) { - if (sbuf->sh_type == SHT_DYNAMIC) { - // Find DT_NEEDED tags - Elf_Dyn *dbuf = (Elf_Dyn *)(base + sbuf->sh_offset); - while (sbuf->sh_size >= sizeof(*dbuf)) { - if (dbuf->d_tag == DT_NEEDED) { - const char *lib = strbase + dbuf->d_un.d_ptr; - copy_libs_for_lib(lib, private_run_dir); - } - sbuf->sh_size -= sizeof(*dbuf); - dbuf++; - } - } - sbuf++; - } - goto close; - - error_close: - perror("copy libs"); - close: - if (base) - munmap(base, s.st_size); - close(f); + fclose(fp); } -static void copy_libs_for_lib(const char *lib, const char *private_run_dir) { - int i; - for (i = 0; lib_paths[i]; i++) { - char *fname; - if (asprintf(&fname, "%s/%s", lib_paths[i], lib) == -1) - errExit("asprintf"); - if (access(fname, R_OK) == 0) { - char *dst; - if (asprintf(&dst, "%s/%s", private_run_dir, lib) == -1) - errExit("asprintf"); - - if (access(dst, R_OK) != 0) { - duplicate(fname, private_run_dir); - // libs may need other libs - copy_libs_for_exe(fname, private_run_dir); - } - free(dst); - free(fname); - return; - } - free(fname); - } - errExit("library not found"); -} void fs_private_lib(void) { - char *private_list = cfg.lib_private_keep; +// char *private_list = cfg.lib_private_keep; // create /run/firejail/mnt/lib directory mkdir_attr(RUN_LIB_DIR, 0755, 0, 0); // copy the libs in the new lib directory for the main exe if (cfg.original_program_index > 0) - copy_libs_for_exe(cfg.original_argv[cfg.original_program_index], RUN_LIB_DIR); + copy_libs(cfg.original_argv[cfg.original_program_index], RUN_LIB_DIR, RUN_LIB_FILE); // for the shell if (!arg_shell_none) - copy_libs_for_exe(cfg.shell, RUN_LIB_DIR); + copy_libs(cfg.shell, RUN_LIB_DIR, RUN_LIB_FILE); +#if 0 // TODO - work in progress // for the listed libs if (private_list && *private_list != '\0') { if (arg_debug) @@ -185,6 +89,7 @@ void fs_private_lib(void) { free(dlist); fs_logger_print(); } +#endif // for our trace and tracelog libs if (arg_trace) @@ -194,14 +99,17 @@ void fs_private_lib(void) { if (arg_debug) printf("Mount-bind %s on top of /lib /lib64 /usr/lib\n", RUN_LIB_DIR); + if (mount(RUN_LIB_DIR, "/lib", NULL, MS_BIND|MS_REC, NULL) < 0 || mount(NULL, "/lib", NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NODEV|MS_REC, NULL) < 0) errExit("mount bind"); fs_logger("mount /lib"); + if (mount(RUN_LIB_DIR, "/lib64", NULL, MS_BIND|MS_REC, NULL) < 0 || mount(NULL, "/lib64", NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NODEV|MS_REC, NULL) < 0) errExit("mount bind"); fs_logger("mount /lib64"); + if (mount(RUN_LIB_DIR, "/usr/lib", NULL, MS_BIND|MS_REC, NULL) < 0 || mount(NULL, "/usr/lib", NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NODEV|MS_REC, NULL) < 0) errExit("mount bind"); -- cgit v1.2.3-70-g09d2