mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
jailtest -> jailcheck (#4268)
This commit is contained in:
netblue30
parent
98fe39849c
commit
b79e4416fe
24 changed files with 58 additions and 59 deletions
4
.gitignore
vendored
4
.gitignore
vendored
|
|
@ -22,7 +22,7 @@ firejail-users.5
|
|||
firejail.1
|
||||
firemon.1
|
||||
firecfg.1
|
||||
jailtest.5
|
||||
jailcheck.5
|
||||
mkdeb.sh
|
||||
src/firejail/firejail
|
||||
src/firemon/firemon
|
||||
|
|
@ -41,7 +41,7 @@ src/fbuilder/fbuilder
|
|||
src/profstats/profstats
|
||||
src/bash_completion/firejail.bash_completion
|
||||
src/zsh_completion/_firejail
|
||||
src/jailtest/jailtest
|
||||
src/jailcheck/jailcheck
|
||||
uids.h
|
||||
seccomp
|
||||
seccomp.debug
|
||||
|
|
|
|||
10
Makefile.in
10
Makefile.in
|
|
@ -25,13 +25,13 @@ COMPLETIONDIRS = src/zsh_completion src/bash_completion
|
|||
|
||||
.PHONY: all
|
||||
all: all_items mydirs $(MAN_TARGET) filters
|
||||
APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats src/jailtest/jailtest
|
||||
APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats src/jailcheck/jailcheck
|
||||
SBOX_APPS = src/fbuilder/fbuilder src/ftee/ftee
|
||||
SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter
|
||||
MYDIRS = src/lib $(MAN_SRC) $(COMPLETIONDIRS)
|
||||
MYLIBS = src/libpostexecseccomp/libpostexecseccomp.so src/libtrace/libtrace.so src/libtracelog/libtracelog.so
|
||||
COMPLETIONS = src/zsh_completion/_firejail src/bash_completion/firejail.bash_completion
|
||||
MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 jailtest.5
|
||||
MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 jailcheck.5
|
||||
SBOX_APPS_NON_DUMPABLE += src/fsec-optimize/fsec-optimize src/fsec-print/fsec-print src/fseccomp/fseccomp
|
||||
SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx seccomp.mdwx.32
|
||||
ALL_ITEMS = $(APPS) $(SBOX_APPS) $(SBOX_APPS_NON_DUMPABLE) $(MYLIBS)
|
||||
|
|
@ -112,8 +112,8 @@ endif
|
|||
install -m 0755 src/firemon/firemon $(DESTDIR)$(bindir)
|
||||
# firecfg executable
|
||||
install -m 0755 src/firecfg/firecfg $(DESTDIR)$(bindir)
|
||||
# jailtest executable
|
||||
install -m 0755 src/jailtest/jailtest $(DESTDIR)$(bindir)
|
||||
# jailcheck executable
|
||||
install -m 0755 src/jailcheck/jailcheck $(DESTDIR)$(bindir)
|
||||
# libraries and plugins
|
||||
install -m 0755 -d $(DESTDIR)$(libdir)/firejail
|
||||
install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS) src/firecfg/firecfg.config
|
||||
|
|
@ -182,7 +182,7 @@ uninstall:
|
|||
rm -f $(DESTDIR)$(bindir)/firemon
|
||||
rm -f $(DESTDIR)$(bindir)/firecfg
|
||||
rm -fr $(DESTDIR)$(libdir)/firejail
|
||||
rm -fr $(DESTDIR)$(libdir)/jailtest
|
||||
rm -fr $(DESTDIR)$(libdir)/jailcheck
|
||||
rm -fr $(DESTDIR)$(datarootdir)/doc/firejail
|
||||
for man in $(MANPAGES); do \
|
||||
rm -f $(DESTDIR)$(mandir)/man5/$$man*; \
|
||||
|
|
|
|||
28
README.md
28
README.md
|
|
@ -198,32 +198,32 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
|
|||
Milestone page: https://github.com/netblue30/firejail/milestone/1
|
||||
Release discussion: https://github.com/netblue30/firejail/issues/3696
|
||||
|
||||
### jailtest
|
||||
### jailcheck
|
||||
`````
|
||||
JAILTEST(1) JAILTEST man page JAILTEST(1)
|
||||
JAILCHECK(1) JAILCHECK man page JAILCHECK(1)
|
||||
|
||||
NAME
|
||||
jailtest - Simple utility program to test running sandboxes
|
||||
jailcheck - Simple utility program to test running sandboxes
|
||||
|
||||
SYNOPSIS
|
||||
sudo jailtest [OPTIONS] [directory]
|
||||
sudo jailcheck [OPTIONS] [directory]
|
||||
|
||||
DESCRIPTION
|
||||
WORK IN PROGRESS! jailtest attaches itself to all sandboxes started by
|
||||
the user and performs some basic tests on the sandbox filesystem:
|
||||
jailcheck attaches itself to all sandboxes started by the user and per‐
|
||||
forms some basic tests on the sandbox filesystem:
|
||||
|
||||
1. Virtual directories
|
||||
jailtest extracts a list with the main virtual directories in‐
|
||||
jailcheck extracts a list with the main virtual directories in‐
|
||||
stalled by the sandbox. These directories are build by firejail
|
||||
at startup using --private* and --whitelist commands.
|
||||
|
||||
2. Noexec test
|
||||
jailtest inserts executable programs in /home/username, /tmp,
|
||||
and /var/tmp directories and tries to run them form inside the
|
||||
jailcheck inserts executable programs in /home/username, /tmp,
|
||||
and /var/tmp directories and tries to run them from inside the
|
||||
sandbox, thus testing if the directory is executable or not.
|
||||
|
||||
3. Read access test
|
||||
jailtest creates test files in the directories specified by the
|
||||
jailcheck creates test files in the directories specified by the
|
||||
user and tries to read them from inside the sandbox.
|
||||
|
||||
4. AppArmor test
|
||||
|
|
@ -234,10 +234,10 @@ DESCRIPTION
|
|||
|
||||
OPTIONS
|
||||
--debug
|
||||
Print debug messages
|
||||
Print debug messages.
|
||||
|
||||
-?, --help
|
||||
Print options end exit.
|
||||
Print options and exit.
|
||||
|
||||
--version
|
||||
Print program version and exit.
|
||||
|
|
@ -255,7 +255,7 @@ OUTPUT
|
|||
rectories and various warnings.
|
||||
|
||||
EXAMPLE
|
||||
$ sudo jailtest
|
||||
$ sudo jailcheck
|
||||
2014:netblue::firejail /usr/bin/gimp
|
||||
Virtual dirs: /tmp, /var/tmp, /dev, /usr/share,
|
||||
Warning: I can run programs in /home/netblue
|
||||
|
|
@ -290,7 +290,7 @@ SEE ALSO
|
|||
firejail(1), firemon(1), firecfg(1), firejail-profile(5), firejail-lo‐
|
||||
gin(5), firejail-users(5),
|
||||
|
||||
0.9.65 Feb 2021 JAILTEST(1)
|
||||
0.9.65 May 2021 JAILCHECK(1)
|
||||
`````
|
||||
|
||||
### Profile Statistics
|
||||
|
|
|
|||
4
configure
vendored
4
configure
vendored
|
|
@ -4366,7 +4366,7 @@ fi
|
|||
|
||||
ac_config_files="$ac_config_files mkdeb.sh"
|
||||
|
||||
ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailtest/Makefile"
|
||||
ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile"
|
||||
|
||||
cat >confcache <<\_ACEOF
|
||||
# This file is a shell script that caches the results of configure
|
||||
|
|
@ -5099,7 +5099,7 @@ do
|
|||
"src/zsh_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/zsh_completion/Makefile" ;;
|
||||
"src/bash_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/bash_completion/Makefile" ;;
|
||||
"test/Makefile") CONFIG_FILES="$CONFIG_FILES test/Makefile" ;;
|
||||
"src/jailtest/Makefile") CONFIG_FILES="$CONFIG_FILES src/jailtest/Makefile" ;;
|
||||
"src/jailcheck/Makefile") CONFIG_FILES="$CONFIG_FILES src/jailcheck/Makefile" ;;
|
||||
|
||||
*) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
|
||||
esac
|
||||
|
|
|
|||
|
|
@ -307,7 +307,7 @@ AC_OUTPUT(Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Ma
|
|||
src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \
|
||||
src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile \
|
||||
src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile \
|
||||
src/jailtest/Makefile)
|
||||
src/jailcheck/Makefile)
|
||||
|
||||
echo
|
||||
echo "Configuration options:"
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@ rm -rf %{buildroot}
|
|||
%attr(4755, -, -) %{_bindir}/__NAME__
|
||||
%{_bindir}/firecfg
|
||||
%{_bindir}/firemon
|
||||
%{_bindir}/jailtest
|
||||
%{_bindir}/jailcheck
|
||||
%{_libdir}/__NAME__
|
||||
%{_datarootdir}/bash-completion/completions/__NAME__
|
||||
%{_datarootdir}/bash-completion/completions/firecfg
|
||||
|
|
@ -48,5 +48,5 @@ rm -rf %{buildroot}
|
|||
%{_mandir}/man5/__NAME__-login.5.gz
|
||||
%{_mandir}/man5/__NAME__-profile.5.gz
|
||||
%{_mandir}/man5/__NAME__-users.5.gz
|
||||
%{_mandir}/man5/jailtest.5.gz
|
||||
%{_mandir}/man5/jailcheck.5.gz
|
||||
%config(noreplace) %{_sysconfdir}/__NAME__
|
||||
|
|
|
|||
|
|
@ -1,16 +1,16 @@
|
|||
.PHONY: all
|
||||
all: jailtest
|
||||
all: jailcheck
|
||||
|
||||
include ../common.mk
|
||||
|
||||
%.o : %.c $(H_FILE_LIST) ../include/common.h ../include/pid.h
|
||||
$(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
|
||||
|
||||
jailtest: $(OBJS)
|
||||
jailcheck: $(OBJS)
|
||||
$(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS)
|
||||
|
||||
.PHONY: clean
|
||||
clean:; rm -fr *.o jailtest *.gcov *.gcda *.gcno *.plist
|
||||
clean:; rm -fr *.o jailcheck *.gcov *.gcda *.gcno *.plist
|
||||
|
||||
.PHONY: distclean
|
||||
distclean: clean
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
#include <dirent.h>
|
||||
#include <sys/wait.h>
|
||||
|
||||
|
|
@ -74,7 +74,7 @@ void access_setup(const char *directory) {
|
|||
|
||||
// create a test file
|
||||
char *test_file;
|
||||
if (asprintf(&test_file, "%s/jailtest-access-%d", path, getpid()) == -1)
|
||||
if (asprintf(&test_file, "%s/jailcheck-access-%d", path, getpid()) == -1)
|
||||
errExit("asprintf");
|
||||
|
||||
FILE *fp = fopen(test_file, "w");
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
|
||||
#ifdef HAVE_APPARMOR
|
||||
#include <sys/apparmor.h>
|
||||
|
|
@ -17,8 +17,8 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#ifndef JAILTEST_H
|
||||
#define JAILTEST_H
|
||||
#ifndef JAILCHECK_H
|
||||
#define JAILCHECK_H
|
||||
|
||||
#include "../include/common.h"
|
||||
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
#include "../include/firejail_user.h"
|
||||
#include "../include/pid.h"
|
||||
#include <sys/wait.h>
|
||||
|
|
@ -30,7 +30,7 @@ char *user_run_dir = NULL;
|
|||
int arg_debug = 0;
|
||||
|
||||
static char *usage_str =
|
||||
"Usage: jailtest [options] directory [directory]\n\n"
|
||||
"Usage: jailcheck [options] directory [directory]\n\n"
|
||||
"Options:\n"
|
||||
" --debug - print debug messages.\n"
|
||||
" --help, -? - this help screen.\n"
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
#include <sys/wait.h>
|
||||
#include <sys/stat.h>
|
||||
#include <fcntl.h>
|
||||
|
|
@ -67,7 +67,7 @@ void noexec_test(const char *path) {
|
|||
return;
|
||||
|
||||
char *fname;
|
||||
if (asprintf(&fname, "%s/jailtest-noexec-%d", path, getpid()) == -1)
|
||||
if (asprintf(&fname, "%s/jailcheck-noexec-%d", path, getpid()) == -1)
|
||||
errExit("asprintf");
|
||||
|
||||
pid_t child = fork();
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
#define MAXBUF 4096
|
||||
|
||||
void seccomp_test(pid_t pid) {
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
#include <dirent.h>
|
||||
#include <sys/wait.h>
|
||||
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
#include "../include/pid.h"
|
||||
#include <errno.h>
|
||||
#include <pwd.h>
|
||||
|
|
@ -17,7 +17,7 @@
|
|||
* with this program; if not, write to the Free Software Foundation, Inc.,
|
||||
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
||||
*/
|
||||
#include "jailtest.h"
|
||||
#include "jailcheck.h"
|
||||
#include <dirent.h>
|
||||
#include <sys/wait.h>
|
||||
|
||||
|
|
@ -43,7 +43,7 @@ void virtual_setup(const char *directory) {
|
|||
|
||||
// create a test file
|
||||
char *test_file;
|
||||
if (asprintf(&test_file, "%s/jailtest-private-%d", directory, getpid()) == -1)
|
||||
if (asprintf(&test_file, "%s/jailcheck-private-%d", directory, getpid()) == -1)
|
||||
errExit("asprintf");
|
||||
|
||||
FILE *fp = fopen(test_file, "w");
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
.PHONY: all
|
||||
all: firecfg.man firejail.man firejail-login.man firejail-users.man firejail-profile.man firemon.man jailtest.man
|
||||
all: firecfg.man firejail.man firejail-login.man firejail-users.man firejail-profile.man firemon.man jailcheck.man
|
||||
|
||||
include ../common.mk
|
||||
|
||||
|
|
|
|||
|
|
@ -135,4 +135,4 @@ Homepage: https://firejail.wordpress.com
|
|||
.BR firejail-profile (5),
|
||||
.BR firejail-login (5),
|
||||
.BR firejail-users (5),
|
||||
.BR jailtest (1)
|
||||
.BR jailcheck (1)
|
||||
|
|
|
|||
|
|
@ -39,4 +39,4 @@ Homepage: https://firejail.wordpress.com
|
|||
.BR firecfg (1),
|
||||
.BR firejail-profile (5),
|
||||
.BR firejail-users (5),
|
||||
.BR jailtest (1)
|
||||
.BR jailcheck (1)
|
||||
|
|
|
|||
|
|
@ -986,7 +986,7 @@ Homepage: https://firejail.wordpress.com
|
|||
.BR firecfg (1),
|
||||
.BR firejail-login (5),
|
||||
.BR firejail-users (5),
|
||||
.BR jailtest (1)
|
||||
.BR jailcheck (1)
|
||||
|
||||
.UR https://github.com/netblue30/firejail/wiki/Creating-Profiles
|
||||
.UE
|
||||
|
|
|
|||
|
|
@ -59,4 +59,4 @@ Homepage: https://firejail.wordpress.com
|
|||
.BR firecfg (1),
|
||||
.BR firejail-profile (5),
|
||||
.BR firejail-login (5),
|
||||
.BR jailtest (1)
|
||||
.BR jailcheck (1)
|
||||
|
|
|
|||
|
|
@ -3367,7 +3367,7 @@ Homepage: https://firejail.wordpress.com
|
|||
.BR firejail-profile (5),
|
||||
.BR firejail-login (5),
|
||||
.BR firejail-users (5),
|
||||
.BR jailtest (1)
|
||||
.BR jailcheck (1)
|
||||
|
||||
.UR https://github.com/netblue30/firejail/wiki
|
||||
.UE ,
|
||||
|
|
|
|||
|
|
@ -120,4 +120,4 @@ Homepage: https://firejail.wordpress.com
|
|||
.BR firejail-profile (5),
|
||||
.BR firejail-login (5),
|
||||
.BR firejail-users (5),
|
||||
.BR jailtest (1)
|
||||
.BR jailcheck (1)
|
||||
|
|
|
|||
|
|
@ -1,23 +1,22 @@
|
|||
.TH JAILTEST 1 "MONTH YEAR" "VERSION" "JAILTEST man page"
|
||||
.TH JAILCHECK 1 "MONTH YEAR" "VERSION" "JAILCHECK man page"
|
||||
.SH NAME
|
||||
jailtest \- Simple utility program to test running sandboxes
|
||||
jailcheck \- Simple utility program to test running sandboxes
|
||||
.SH SYNOPSIS
|
||||
sudo jailtest [OPTIONS] [directory]
|
||||
sudo jailcheck [OPTIONS] [directory]
|
||||
.SH DESCRIPTION
|
||||
WORK IN PROGRESS!
|
||||
jailtest attaches itself to all sandboxes started by the user and performs some basic tests
|
||||
jailcheck attaches itself to all sandboxes started by the user and performs some basic tests
|
||||
on the sandbox filesystem:
|
||||
.TP
|
||||
\fB1. Virtual directories
|
||||
jailtest extracts a list with the main virtual directories installed by the sandbox.
|
||||
jailcheck extracts a list with the main virtual directories installed by the sandbox.
|
||||
These directories are build by firejail at startup using --private* and --whitelist commands.
|
||||
.TP
|
||||
\fB2. Noexec test
|
||||
jailtest inserts executable programs in /home/username, /tmp, and /var/tmp directories
|
||||
jailcheck inserts executable programs in /home/username, /tmp, and /var/tmp directories
|
||||
and tries to run them from inside the sandbox, thus testing if the directory is executable or not.
|
||||
.TP
|
||||
\fB3. Read access test
|
||||
jailtest creates test files in the directories specified by the user and tries to read
|
||||
jailcheck creates test files in the directories specified by the user and tries to read
|
||||
them from inside the sandbox.
|
||||
.TP
|
||||
\fB4. AppArmor test
|
||||
|
|
@ -49,7 +48,7 @@ It is followed by relevant sandbox information, such as the virtual directories
|
|||
|
||||
.SH EXAMPLE
|
||||
|
||||
$ sudo jailtest
|
||||
$ sudo jailcheck
|
||||
.br
|
||||
2014:netblue::firejail /usr/bin/gimp
|
||||
.br
|
||||
Loading…
Add table
Add a link
Reference in a new issue