github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 22:01:33 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

Consider nosound and novideo when keeping groups

Browse source 
Even when `nogroups` is not used, avoid keeping the audio and video
groups when `nosound` and `novideo` are used, respectively.

Based on @rusty-snake's suggestion:
https://github.com/netblue30/firejail/issues/4603#issuecomment-944046299

Relates to #4603.
This commit is contained in:
Kelvin M. Klann 2021-10-16 02:26:17 -03:00
parent 615ce15623
commit ea564eb74a
2 changed files with 22 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

20
src/firejail/main.c
View file

@ -3144,17 +3144,21 @@ int main(int argc, char **argv, char **envp) {
}
// add audio group
g = get_group_id("audio");
if (g) {
sprintf(ptr, "%d %d 1\n", g, g);
ptr += strlen(ptr);
if (!arg_nosound) {
g = get_group_id("audio");
if (g) {
sprintf(ptr, "%d %d 1\n", g, g);
ptr += strlen(ptr);
}
}
// add video group
g = get_group_id("video");
if (g) {
sprintf(ptr, "%d %d 1\n", g, g);
ptr += strlen(ptr);
if (!arg_novideo) {
g = get_group_id("video");
if (g) {
sprintf(ptr, "%d %d 1\n", g, g);
ptr += strlen(ptr);
}
}
// add games group

13
src/firejail/util.c
View file

@ -142,14 +142,11 @@ static void clean_supplementary_groups(gid_t gid) {
goto clean_all;
// clean supplementary group list
// allow only firejail, tty, audio, video, games
gid_t new_groups[MAX_GROUPS];
int new_ngroups = 0;
char *allowed[] = {
"firejail",
"tty",
"audio",
"video",
"games",
NULL
};
@ -161,6 +158,16 @@ static void clean_supplementary_groups(gid_t gid) {
i++;
}
if (!arg_nosound) {
copy_group_ifcont("audio", groups, ngroups,
new_groups, &new_ngroups, MAX_GROUPS);
}
if (!arg_novideo) {
copy_group_ifcont("video", groups, ngroups,
new_groups, &new_ngroups, MAX_GROUPS);
}
if (new_ngroups) {
rv = setgroups(new_ngroups, new_groups);
if (rv)