github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 22:01:33 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

Allow changing "protocol" list after initial set

Browse source 
Firejail uses set-once logic for "protocol" list. This makes it
impossible to accumulate list of allowed protocols from multiple
include files.

Use profile_list_augment() for maintaining list of protocols. This
implicitly means protocols can be added/removed via any number of
command line options / profile configuration files.

Signed-off-by: Simo Piiroinen <simo.piiroinen@jolla.com>
Signed-off-by: Tomi Leppänen <tomi.leppanen@jolla.com>
This commit is contained in:
Simo Piiroinen 2020-11-06 10:13:35 +02:00 • committed by Tomi Leppänen
parent cddc483222
commit 5ffd9287fc
2 changed files with 8 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

13
src/firejail/main.c
View file

@ -1285,15 +1285,10 @@ int main(int argc, char **argv, char **envp) {
#endif
else if (strncmp(argv[i], "--protocol=", 11) == 0) {
if (checkcfg(CFG_SECCOMP)) {
if (cfg.protocol) {
fwarning("more than one protocol list is present, \"%s\" will be installed\n", cfg.protocol);
}
else {
// store list
cfg.protocol = strdup(argv[i] + 11);
if (!cfg.protocol)
errExit("strdup");
}
const char *add = argv[i] + 11;
profile_list_augment(&cfg.protocol, add);
if (arg_debug)
fprintf(stderr, "[option] combined protocol list: \"%s\"\n", cfg.protocol);
}
else
exit_err_feature("seccomp");

13
src/firejail/profile.c
View file

@ -911,15 +911,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
if (strncmp(ptr, "protocol ", 9) == 0) {
if (checkcfg(CFG_SECCOMP)) {
if (cfg.protocol) {
fwarning("more than one protocol list is present, \"%s\" will be installed\n", cfg.protocol);
return 0;
}
// store list
cfg.protocol = strdup(ptr + 9);
if (!cfg.protocol)
errExit("strdup");
const char *add = ptr + 9;
profile_list_augment(&cfg.protocol, add);
if (arg_debug)
fprintf(stderr, "[profile] combined protocol list: \"%s\"\n", cfg.protocol);
}
else
warning_feature_disabled("seccomp");