mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-21 06:45:29 -06:00
commit
f67698e31d
15 changed files with 25 additions and 25 deletions
|
|
@ -87,7 +87,7 @@ int arp_check(const char *dev, uint32_t destaddr, uint32_t srcaddr) {
|
|||
memcpy(hdr.sender_ip, (uint8_t *)&srcaddr, 4);
|
||||
memcpy(hdr.target_ip, (uint8_t *)&destaddr, 4);
|
||||
|
||||
// buiild ethernet frame
|
||||
// build ethernet frame
|
||||
uint8_t frame[ETH_FRAME_LEN]; // includes eht header, vlan, and crc
|
||||
memset(frame, 0, sizeof(frame));
|
||||
frame[0] = frame[1] = frame[2] = frame[3] = frame[4] = frame[5] = 0xff;
|
||||
|
|
@ -130,7 +130,7 @@ int arp_check(const char *dev, uint32_t destaddr, uint32_t srcaddr) {
|
|||
return -1;
|
||||
}
|
||||
|
||||
// parse the incomming packet
|
||||
// parse the incoming packet
|
||||
if ((unsigned int) len < 14 + sizeof(ArpHdr))
|
||||
continue;
|
||||
if (frame[12] != (ETH_P_ARP / 256) || frame[13] != (ETH_P_ARP % 256))
|
||||
|
|
@ -384,7 +384,7 @@ void arp_scan(const char *dev, uint32_t ifip, uint32_t ifmask) {
|
|||
uint32_t dst = htonl(dest);
|
||||
memcpy(hdr.target_ip, (uint8_t *)&dst, 4);
|
||||
|
||||
// buiild ethernet frame
|
||||
// build ethernet frame
|
||||
uint8_t frame[ETH_FRAME_LEN]; // includes eht header, vlan, and crc
|
||||
memset(frame, 0, sizeof(frame));
|
||||
frame[0] = frame[1] = frame[2] = frame[3] = frame[4] = frame[5] = 0xff;
|
||||
|
|
@ -409,7 +409,7 @@ void arp_scan(const char *dev, uint32_t ifip, uint32_t ifmask) {
|
|||
perror("recvfrom");
|
||||
}
|
||||
|
||||
// parse the incomming packet
|
||||
// parse the incoming packet
|
||||
if ((unsigned int) len < 14 + sizeof(ArpHdr))
|
||||
continue;
|
||||
|
||||
|
|
|
|||
|
|
@ -271,7 +271,7 @@ void shm_write_bandwidth_file(pid_t pid) {
|
|||
return;
|
||||
|
||||
errout:
|
||||
fprintf(stderr, "Error: cannot write bandwidht file %s\n", fname);
|
||||
fprintf(stderr, "Error: cannot write bandwidth file %s\n", fname);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
|
|
@ -413,7 +413,7 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
|
|||
errExit("asprintf");
|
||||
FILE *fp = fopen(fname, "r");
|
||||
if (!fp) {
|
||||
fprintf(stderr, "Error: cannot read netowk map filel %s\n", fname);
|
||||
fprintf(stderr, "Error: cannot read network map file %s\n", fname);
|
||||
exit(1);
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -64,7 +64,7 @@ void load_cgroup(const char *fname) {
|
|||
return;
|
||||
}
|
||||
errout:
|
||||
fprintf(stderr, "Warrning: cannot load control group\n");
|
||||
fprintf(stderr, "Warning: cannot load control group\n");
|
||||
if (fp)
|
||||
fclose(fp);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -110,7 +110,7 @@ static void build_dirs(void) {
|
|||
void fs_var_log(void) {
|
||||
build_list("/var/log");
|
||||
|
||||
// create /var/log if it does't exit
|
||||
// create /var/log if it doesn't exit
|
||||
if (is_dir("/var/log")) {
|
||||
// extract group id for /var/log/wtmp
|
||||
struct stat s;
|
||||
|
|
@ -184,7 +184,7 @@ void fs_var_lib(void) {
|
|||
printf("Mounting tmpfs on /var/lib/nginx\n");
|
||||
if (mount("tmpfs", "/var/lib/nginx", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC, "mode=755,gid=0") < 0)
|
||||
errExit("mounting /var/lib/nginx");
|
||||
fs_logger("mount tmpfs on /var/lib/nignx");
|
||||
fs_logger("mount tmpfs on /var/lib/nginx");
|
||||
}
|
||||
|
||||
// net-snmp multiserver
|
||||
|
|
|
|||
|
|
@ -108,7 +108,7 @@ static void myexit(int rv) {
|
|||
printf("\nparent is shutting down, bye...\n");
|
||||
|
||||
// delete sandbox files in shared memory
|
||||
bandwidth_shm_del_file(sandbox_pid); // bandwidht file
|
||||
bandwidth_shm_del_file(sandbox_pid); // bandwidth file
|
||||
network_shm_del_file(sandbox_pid); // network map file
|
||||
|
||||
exit(rv);
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ static char *client_filter =
|
|||
":FORWARD DROP [0:0]\n"
|
||||
":OUTPUT ACCEPT [0:0]\n"
|
||||
"-A INPUT -i lo -j ACCEPT\n"
|
||||
"# echo replay is handled by -m state RELEATED/ESTABLISHED below\n"
|
||||
"# echo replay is handled by -m state RELATED/ESTABLISHED below\n"
|
||||
"#-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT\n"
|
||||
"-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n"
|
||||
"-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT\n"
|
||||
|
|
|
|||
|
|
@ -345,7 +345,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
|
|||
char *dname1 = ptr + 5;
|
||||
char *dname2 = split_comma(dname1); // this inserts a '0 to separate the two dierctories
|
||||
if (dname2 == NULL) {
|
||||
fprintf(stderr, "Error: mising second directory for bind\n");
|
||||
fprintf(stderr, "Error: missing second directory for bind\n");
|
||||
exit(1);
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -173,7 +173,7 @@ static void monitor_application(pid_t app_pid) {
|
|||
|
||||
#if 0
|
||||
// todo: find a way to shut down interfaces before closing the namespace
|
||||
// the problem is we don't have enough privileges to shutdown interfaces in this momen
|
||||
// the problem is we don't have enough privileges to shutdown interfaces in this moment
|
||||
// shut down bridge/macvlan interfaces
|
||||
if (any_bridge_configured()) {
|
||||
|
||||
|
|
|
|||
|
|
@ -432,7 +432,7 @@ int seccomp_filter_drop(int enforce_seccomp) {
|
|||
#ifdef SYS_ioperm
|
||||
filter_add_blacklist(SYS_ioperm, 0);
|
||||
#endif
|
||||
#ifdef SYS_ni_syscall // new io permisions call on arm devices
|
||||
#ifdef SYS_ni_syscall // new io permissions call on arm devices
|
||||
filter_add_blacklist(SYS_ni_syscall, 0);
|
||||
#endif
|
||||
#ifdef SYS_swapon
|
||||
|
|
|
|||
|
|
@ -31,9 +31,9 @@
|
|||
BLACKLIST(SYS_init_module), // kernel module handling
|
||||
BLACKLIST(SYS_finit_module),
|
||||
BLACKLIST(SYS_delete_module),
|
||||
BLACKLIST(SYS_iopl), // io permisions
|
||||
BLACKLIST(SYS_iopl), // io permissions
|
||||
BLACKLIST(SYS_ioperm),
|
||||
BLACKLIST(SYS_iopl), // io permisions
|
||||
BLACKLIST(SYS_iopl), // io permissions
|
||||
BLACKLIST(SYS_ni_syscall),
|
||||
BLACKLIST(SYS_swapon), // swap on/off
|
||||
BLACKLIST(SYS_swapoff),
|
||||
|
|
@ -141,4 +141,4 @@ struct seccomp_data {
|
|||
#define KILL_PROCESS \
|
||||
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL)
|
||||
|
||||
#endif
|
||||
#endif
|
||||
|
|
|
|||
|
|
@ -77,7 +77,7 @@ void usage(void) {
|
|||
printf("\t--debug-caps - print all recognized capabilities in the current\n");
|
||||
printf("\t\tFirejail software build and exit.\n\n");
|
||||
printf("\t--debug-check-filename - debug filename checking.\n\n");
|
||||
printf("\t--debug-errnos - print all recognized error numbres in the current\n");
|
||||
printf("\t--debug-errnos - print all recognized error numbers in the current\n");
|
||||
printf("\t\tFirejail software build and exit.\n\n");
|
||||
printf("\t--debug-protocols - print all recognized protocols in the current\n");
|
||||
printf("\t\tFirejail software build and exit.\n\n");
|
||||
|
|
@ -109,7 +109,7 @@ void usage(void) {
|
|||
printf("\t--ignore=command - ignore command in profile files.\n\n");
|
||||
#ifdef HAVE_NETWORK
|
||||
printf("\t--interface=name - move interface in a new network namespace. Up to\n");
|
||||
printf("\t\tfour --interface options can be sepcified.\n\n");
|
||||
printf("\t\tfour --interface options can be specified.\n\n");
|
||||
printf("\t--ip=address - set interface IP address.\n\n");
|
||||
printf("\t--ip=none - no IP address and no default gateway address are configured\n");
|
||||
printf("\t\tin the new network namespace. Use this option in case you intend\n");
|
||||
|
|
@ -227,7 +227,7 @@ void usage(void) {
|
|||
printf("\t\tis closed.\n\n");
|
||||
|
||||
printf("\t--private-dev - create a new /dev directory. Only dri, null, full, zero,\n");
|
||||
printf("\t\ttty, pst, ptms, random, urandom, log and shm devices are\n");
|
||||
printf("\t\tty, pst, ptms, random, urandom, log and shm devices are\n");
|
||||
printf("\t\tavailable.\n\n");
|
||||
|
||||
printf("\t--private-etc=file,directory - build a new /etc in a temporary\n");
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
/*
|
||||
* Copyright (C) 2014-2015 6etblue30 (netblue30@yahoo.com)
|
||||
* Copyright (C) 2014-2015 netblue30 (netblue30@yahoo.com)
|
||||
*
|
||||
* This file is part of firejail project
|
||||
*
|
||||
|
|
|
|||
|
|
@ -74,7 +74,7 @@ void firemon_drop_privs(void) {
|
|||
// sleep and wait for a key to be pressed
|
||||
void firemon_sleep(int st) {
|
||||
if (terminal_set == 0) {
|
||||
tcgetattr(0, &twait); // get current terminal attirbutes; 0 is the file descriptor for stdin
|
||||
tcgetattr(0, &twait); // get current terminal attributes; 0 is the file descriptor for stdin
|
||||
memcpy(&tlocal, &twait, sizeof(tlocal));
|
||||
twait.c_lflag &= ~ICANON; // disable canonical mode
|
||||
twait.c_lflag &= ~ECHO; // no echo
|
||||
|
|
|
|||
|
|
@ -139,7 +139,7 @@ static char *storage_find(const char *str) {
|
|||
|
||||
|
||||
//
|
||||
// load blacklistst form /run/firejail/mnt/fslogger
|
||||
// load blacklist form /run/firejail/mnt/fslogger
|
||||
//
|
||||
#define RUN_FSLOGGER_FILE "/run/firejail/mnt/fslogger"
|
||||
#define MAXBUF 4096
|
||||
|
|
|
|||
|
|
@ -430,7 +430,7 @@ $ firejail \-\-ignore=shell --ignore=seccomp firefox
|
|||
|
||||
.TP
|
||||
\fB\-\-interface=interface
|
||||
Move interface in a new network namespace. Up to four --interface options can be sepcified.
|
||||
Move interface in a new network namespace. Up to four --interface options can be specified.
|
||||
.br
|
||||
|
||||
.br
|
||||
|
|
@ -1196,7 +1196,7 @@ SECCOMP Filter:
|
|||
.br
|
||||
VALIDATE_ARCHITECTURE
|
||||
.br
|
||||
EXAMINE_SYSCAL
|
||||
EXAMINE_SYSCALL
|
||||
.br
|
||||
BLACKLIST 165 mount
|
||||
.br
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue