1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
|
/*
* Copyright (C) 2014, 2015 Firejail Authors
*
* This file is part of firejail project
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License along
* with this program; if not, write to the Free Software Foundation, Inc.,
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
*/
#include "firejail.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <dirent.h>
static void disable_file(const char *path, const char *file) {
assert(file);
assert(path);
struct stat s;
char *fname;
if (asprintf(&fname, "%s/%s", path, file) == -1)
errExit("asprintf");
if (stat(fname, &s) == -1)
goto doexit;
if (arg_debug)
printf("Disable%s\n", fname);
if (S_ISDIR(s.st_mode)) {
if (mount(RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
errExit("disable file");
}
else {
if (mount(RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
errExit("disable file");
}
doexit:
free(fname);
}
// disable pulseaudio socket
void pulseaudio_disable(void) {
// blacklist user config directory
disable_file(cfg.homedir, ".config/pulse");
// blacklist any pulse* file in /tmp directory
DIR *dir;
if (!(dir = opendir("/tmp"))) {
// sleep 2 seconds and try again
sleep(2);
if (!(dir = opendir("/tmp"))) {
fprintf(stderr, "Warning: cannot open /tmp directory. PulseAudio sockets are not disabled\n");
return;
}
}
struct dirent *entry;
while ((entry = readdir(dir))) {
if (strncmp(entry->d_name, "pulse-", 6) == 0) {
disable_file("/tmp", entry->d_name);
}
}
closedir(dir);
// blacklist XDG_RUNTIME_DIR
char *name = getenv("XDG_RUNTIME_DIR");
if (name)
disable_file(name, "pulse/native");
}
// disable shm in pulseaudio
void pulseaudio_init(void) {
struct stat s;
// do we have pulseaudio in the system?
if (stat("/etc/pulse/client.conf", &s) == -1)
return;
// create the new user pulseaudio directory
fs_build_mnt_dir();
int rv = mkdir(PULSE_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
(void) rv; // in --chroot mode the directory canalready be there
if (chown(PULSE_DIR, getuid(), getgid()) < 0)
errExit("chown");
if (chmod(PULSE_DIR, 0700) < 0)
errExit("chmod");
// create the new client.conf file
char *pulsecfg = NULL;
if (asprintf(&pulsecfg, "%s/client.conf", PULSE_DIR) == -1)
errExit("asprintf");
if (copy_file("/etc/pulse/client.conf", pulsecfg))
errExit("copy_file");
FILE *fp = fopen(pulsecfg, "a+");
if (!fp)
errExit("fopen");
fprintf(fp, "%s", "\nenable-shm = no\n");
fclose(fp);
if (chmod(pulsecfg, 0644) == -1)
errExit("chmod");
if (chown(pulsecfg, getuid(), getgid()) == -1)
errExit("chown");
// set environment
if (setenv("PULSE_CLIENTCONFIG", pulsecfg, 1) < 0)
errExit("setenv");
free(pulsecfg);
}
|
