github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

globbing support for whitelists

Browse source
This commit is contained in:
netblue30 2020-04-01 09:56:49 -04:00
parent bf9675a40a
commit 601df2fbb9
2 changed files with 40 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
src/firejail/fs_home.c
View file

@ -20,7 +20,6 @@
#include "firejail.h"
#include <sys/mount.h>
#include <linux/limits.h>
#include <glob.h>
#include <dirent.h>
#include <errno.h>
#include <sys/stat.h>

40
src/firejail/fs_whitelist.c
View file

@ -346,6 +346,39 @@ static void whitelist_home(int topdir) {
}
static void globbing(const char *pattern) {
assert(pattern);
// globbing
glob_t globbuf;
int globerr = glob(pattern, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf);
if (globerr) {
fprintf(stderr, "Error: failed to glob private-bin pattern %s\n", pattern);
exit(1);
}
size_t i;
for (i = 0; i < globbuf.gl_pathc; i++) {
assert(globbuf.gl_pathv[i]);
// testing for GLOB_NOCHECK - no pattern matched returns the original pattern
if (strcmp(globbuf.gl_pathv[i], pattern) == 0)
continue;
// build the new profile command
char *newcmd;
if (asprintf(&newcmd, "whitelist %s", globbuf.gl_pathv[i]) == -1)
errExit("asprintf");
// add the new profile command at the end of the list
if (arg_debug || arg_debug_whitelists)
printf("Adding new profile command: %s\n", newcmd);
profile_add(newcmd);
}
globfree(&globbuf);
}
void fs_whitelist(void) {
ProfileEntry *entry = cfg.profile;
if (!entry)
@ -444,6 +477,13 @@ void fs_whitelist(void) {
else
fname = realpath(new_name, NULL);
// if this is not a real path, let's try globbing
// mark this entry as EMPTY_STRING and push the new paths at the end of profile entry list
// the new profile entries will be processed in this loop
// currently there is no globbing support for nowhitelist
if (!fname && !nowhitelist_flag)
globbing(new_name);
if (!fname) {
// file not found, blank the entry in the list and continue
if (arg_debug || arg_debug_whitelists) {