1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
/*
* Copyright (C) 2014-2016 Firejail Authors
*
* This file is part of firejail project
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include "firejail.h"
#include <sys/mount.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
// return 0 if file not found, 1 if found
static int check_dir_or_file(const char *fname) {
assert(fname);
struct stat s;
if (stat(fname, &s) == -1) {
if (arg_debug)
printf("Warning: file %s not found.\n", fname);
return 0;
}
// read access
if (access(fname, R_OK) == -1)
goto errexit;
// dir or regular file
if (S_ISDIR(s.st_mode) || S_ISREG(s.st_mode) || !is_link(fname))
return 1; // normal exit
errexit:
fprintf(stderr, "Error: invalid file type, %s.\n", fname);
exit(1);
}
static void duplicate(char *fname) {
if (*fname == '~' || *fname == '/' || strstr(fname, "..")) {
fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
exit(1);
}
invalid_filename(fname);
char *src;
if (asprintf(&src, "/etc/%s", fname) == -1)
errExit("asprintf");
if (check_dir_or_file(src) == 0) {
if (!arg_quiet)
fprintf(stderr, "Warning: skipping %s for private bin\n", fname);
free(src);
return;
}
struct stat s;
if (stat(src, &s) == 0 && S_ISDIR(s.st_mode)) {
// create the directory in RUN_ETC_DIR
char *dirname;
if (asprintf(&dirname, "%s/%s", RUN_ETC_DIR, fname) == -1)
errExit("asprintf");
create_empty_dir_as_root(dirname, s.st_mode);
sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, src, dirname);
free(dirname);
}
else
sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, src, RUN_ETC_DIR);
fs_logger2("clone", src);
free(src);
}
void fs_private_etc_list(void) {
char *private_list = cfg.etc_private_keep;
assert(private_list);
// create /run/firejail/mnt/etc directory
mkdir_attr(RUN_ETC_DIR, 0755, 0, 0);
fs_logger("tmpfs /etc");
fs_logger_print(); // save the current log
// copy the list of files in the new etc directory
// using a new child process with root privileges
if (*private_list != '\0') {
if (arg_debug)
printf("Copying files in the new etc directory:\n");
// copy the list of files in the new home directory
char *dlist = strdup(private_list);
if (!dlist)
errExit("strdup");
char *ptr = strtok(dlist, ",");
duplicate(ptr);
while ((ptr = strtok(NULL, ",")) != NULL)
duplicate(ptr);
free(dlist);
fs_logger_print();
}
if (arg_debug)
printf("Mount-bind %s on top of /etc\n", RUN_ETC_DIR);
if (mount(RUN_ETC_DIR, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0)
errExit("mount bind");
fs_logger("mount /etc");
}
|
