From fa79162b5eada1d0b9daa11ca327d65b42ed1b71 Mon Sep 17 00:00:00 2001 From: netblue30 Date: Sat, 26 Nov 2016 10:25:06 -0500 Subject: fixes --- src/firejail/checkcfg.c | 4 ++++ src/firejail/ls.c | 31 ++++++++++++------------------- src/firejail/main.c | 9 +++++++-- src/firejail/sandbox.c | 10 ++++------ src/firejail/seccomp.c | 43 ++++++++++++++++++++++++++----------------- src/firemon/x11.c | 21 +++++++++------------ src/libtracelog/libtracelog.c | 10 ++++++---- 7 files changed, 68 insertions(+), 60 deletions(-) (limited to 'src') diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index 78c0e5c60..963d95bed 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c @@ -185,6 +185,8 @@ int checkcfg(int val) { exit(1); } + if (netfilter_default) + goto errout; netfilter_default = strdup(fname); if (!netfilter_default) errExit("strdup"); @@ -216,6 +218,8 @@ int checkcfg(int val) { // Xephyr command extra parameters else if (strncmp(ptr, "xephyr-extra-params ", 19) == 0) { + if (*xephyr_extra_params != '\0') + goto errout; xephyr_extra_params = strdup(ptr + 19); if (!xephyr_extra_params) errExit("strdup"); diff --git a/src/firejail/ls.c b/src/firejail/ls.c index 86c3a6079..5444ad9c2 100644 --- a/src/firejail/ls.c +++ b/src/firejail/ls.c @@ -258,42 +258,35 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { // drop privileges drop_privs(0); + // check access if (access(fname1, R_OK) == -1) { fprintf(stderr, "Error: Cannot access %s\n", fname1); exit(1); } + char *rp = realpath(fname1, NULL); + if (!rp) { + fprintf(stderr, "Error: Cannot access %s\n", fname1); + exit(1); + } + if (arg_debug) + printf("realpath %s\n", rp); + // list directory contents struct stat s; - if (stat(fname1, &s) == -1) { - fprintf(stderr, "Error: Cannot access %s\n", fname1); + if (stat(rp, &s) == -1) { + fprintf(stderr, "Error: Cannot access %s\n", rp); exit(1); } if (S_ISDIR(s.st_mode)) { - char *rp = realpath(fname1, NULL); - if (!rp) { - fprintf(stderr, "Error: Cannot access %s\n", fname1); - exit(1); - } - if (arg_debug) - printf("realpath %s\n", rp); - char *dir; if (asprintf(&dir, "%s/", rp) == -1) errExit("asprintf"); print_directory(dir); - free(rp); free(dir); } else { - char *rp = realpath(fname1, NULL); - if (!rp) { - fprintf(stderr, "Error: Cannot access %s\n", fname1); - exit(1); - } - if (arg_debug) - printf("realpath %s\n", rp); char *split = strrchr(rp, '/'); if (split) { *split = '\0'; @@ -302,8 +295,8 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { printf("path %s, file %s\n", rp, rp2); print_file_or_dir(rp, rp2, 1); } - free(rp); } + free(rp); } // get file from sandbox and store it in the current directory diff --git a/src/firejail/main.c b/src/firejail/main.c index 111a1d751..0929347b7 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c @@ -2064,8 +2064,7 @@ int main(int argc, char **argv) { // command //************************************* else if (strcmp(argv[i], "--audit") == 0) { - if (asprintf(&arg_audit_prog, "%s/firejail/faudit", LIBDIR) == -1) - errExit("asprintf"); + arg_audit_prog = LIBDIR "/firejail/faudit"; arg_audit = 1; } else if (strncmp(argv[i], "--audit=", 8) == 0) { @@ -2076,6 +2075,12 @@ int main(int argc, char **argv) { arg_audit_prog = strdup(argv[i] + 8); if (!arg_audit_prog) errExit("strdup"); + + struct stat s; + if (stat(arg_audit_prog, &s) != 0) { + fprintf(stderr, "Error: cannot find the audit program %s\n", arg_audit_prog); + exit(1); + } arg_audit = 1; } else if (strcmp(argv[i], "--appimage") == 0) diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index ad77caeb2..0a6777fef 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c @@ -236,12 +236,15 @@ static int monitor_application(pid_t app_pid) { // todo: make this generic // Dillo browser leaves a dpid process running, we need to shut it down + int found = 0; if (strcmp(cfg.command_name, "dillo") == 0) { char *pidname = pid_proc_comm(pid); if (pidname && strcmp(pidname, "dpid") == 0) - break; + found = 1; free(pidname); } + if (found) + break; monitored_pid = pid; break; @@ -283,11 +286,6 @@ void start_application(void) { //**************************************** if (arg_audit) { assert(arg_audit_prog); - struct stat s; - if (stat(arg_audit_prog, &s) != 0) { - fprintf(stderr, "Error: cannot find the audit program\n"); - exit(1); - } execl(arg_audit_prog, arg_audit_prog, NULL); } //**************************************** diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index 4678f366b..dd133b2ba 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c @@ -52,44 +52,53 @@ char *seccomp_check_list(const char *str) { int seccomp_load(const char *fname) { assert(fname); + + // open filter file + int fd = open(fname, O_RDONLY); + if (fd == -1) + goto errexit; - // check file - struct stat s; - if (stat(fname, &s) == -1) { - fprintf(stderr, "Error: cannot read protocol filter file\n"); - exit(1); - } - int size = s.st_size; + // calculate the number of entries + int size = lseek(fd, 0, SEEK_END); + if (size == -1) + goto errexit; + if (lseek(fd, 0 , SEEK_SET) == -1) + goto errexit; unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter); -//printf("size %d, entries %d\n", s.st_size, entries); + if (arg_debug) + printf("reading %d seccomp entries from %s\n", entries, fname); // read filter - struct sock_filter filter[entries]; + struct sock_filter *filter = malloc(size); + if (filter == NULL) + goto errexit; memset(&filter[0], 0, sizeof(filter)); - int src = open(fname, O_RDONLY); int rd = 0; while (rd < size) { - int rv = read(src, (unsigned char *) filter + rd, size - rd); - if (rv == -1) { - fprintf(stderr, "Error: cannot read %s file\n", fname); - exit(1); - } + int rv = read(fd, (unsigned char *) filter + rd, size - rd); + if (rv == -1) + goto errexit; rd += rv; } - close(src); + + // close file + close(fd); // install filter struct sock_fprog prog = { .len = entries, .filter = filter, }; - if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) || prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { fprintf(stderr, "Warning: seccomp disabled, it requires a Linux kernel version 3.5 or newer.\n"); return 1; } return 0; + +errexit: + fprintf(stderr, "Error: cannot read %s\n", fname); + exit(1); } // i386 filter installed on amd64 architectures diff --git a/src/firemon/x11.c b/src/firemon/x11.c index b0efb090a..73dc310d3 100644 --- a/src/firemon/x11.c +++ b/src/firemon/x11.c @@ -37,20 +37,17 @@ void x11(pid_t pid, int print_procs) { if (asprintf(&x11file, "/run/firejail/x11/%d", i) == -1) errExit("asprintf"); - struct stat s; - if (stat(x11file, &s) == 0) { - FILE *fp = fopen(x11file, "r"); - if (!fp) { - free(x11file); - continue; - } - int display; - int rv = fscanf(fp, "%d", &display); - if (rv == 1) - printf(" DISPLAY :%d\n", display); - fclose(fp); + FILE *fp = fopen(x11file, "r"); + if (!fp) { + free(x11file); + continue; } + int display; + int rv = fscanf(fp, "%d", &display); + if (rv == 1) + printf(" DISPLAY :%d\n", display); + fclose(fp); free(x11file); } } diff --git a/src/libtracelog/libtracelog.c b/src/libtracelog/libtracelog.c index ff884c7d7..ca496d41c 100644 --- a/src/libtracelog/libtracelog.c +++ b/src/libtracelog/libtracelog.c @@ -163,9 +163,9 @@ static char *storage_find(const char *str) { #define RUN_FSLOGGER_FILE "/run/firejail/mnt/fslogger" #define MAXBUF 4096 static int blacklist_loaded = 0; -static char *sandbox_pid_str = 0; +static char *sandbox_pid_str = NULL; static char *sandbox_name_str = NULL; -void load_blacklist(void) { +static void load_blacklist(void) { if (blacklist_loaded) return; @@ -184,13 +184,15 @@ void load_blacklist(void) { char *ptr = strchr(buf, '\n'); if (ptr) *ptr = '\0'; - sandbox_pid_str = strdup(buf + 13); + if (sandbox_pid_str == NULL) + sandbox_pid_str = strdup(buf + 13); } else if (strncmp(buf, "sandbox name: ", 14) == 0) { char *ptr = strchr(buf, '\n'); if (ptr) *ptr = '\0'; - sandbox_name_str = strdup(buf + 14); + if (sandbox_name_str == NULL); + sandbox_name_str = strdup(buf + 14); } else if (strncmp(buf, "blacklist ", 10) == 0) { char *ptr = strchr(buf, '\n'); -- cgit v1.2.3-54-g00ecf