diff --git a/Makefile.in b/Makefile.in index fb6460dfd..7152019d4 100644 --- a/Makefile.in +++ b/Makefile.in @@ -82,6 +82,8 @@ realinstall: install -c -m 0644 src/libconnect/libconnect.so $(DESTDIR)/$(libdir)/firejail/. install -c -m 0755 src/ftee/ftee $(DESTDIR)/$(libdir)/firejail/. install -c -m 0755 src/fshaper/fshaper.sh $(DESTDIR)/$(libdir)/firejail/. + install -c -m 0755 src/fgit/fgit-install.sh $(DESTDIR)/$(libdir)/firejail/. + install -c -m 0755 src/fgit/fgit-uninstall.sh $(DESTDIR)/$(libdir)/firejail/. install -c -m 0644 src/firecfg/firecfg.config $(DESTDIR)/$(libdir)/firejail/. install -c -m 0755 src/faudit/faudit $(DESTDIR)/$(libdir)/firejail/. install -c -m 0755 src/fnet/fnet $(DESTDIR)/$(libdir)/firejail/. diff --git a/contrib/update_src.sh b/contrib/update_src.sh deleted file mode 100755 index a61244c49..000000000 --- a/contrib/update_src.sh +++ /dev/null @@ -1,11 +0,0 @@ -#!/bin/sh -# Purpose: Fetch, compile, and install firejail from GitHub source. Package-manager agnostic. -set -e -git clone --depth=1 https://www.github.com/netblue30/firejail.git -cd firejail -./configure -make -sudo make install-strip -echo "Firejail was updated!" -cd .. -rm -rf firejail diff --git a/src/fgit/fgit-install.sh b/src/fgit/fgit-install.sh new file mode 100755 index 000000000..9e43559a1 --- /dev/null +++ b/src/fgit/fgit-install.sh @@ -0,0 +1,20 @@ +#!/bin/sh +# Purpose: Fetch, compile, and install firejail from GitHub source. Package-manager agnostic. +# + +set -e # exit immediately if one of the commands fails +cd /tmp # by the time we start this, we should have a tmpfs mounted on top of /tmp +git clone --depth=1 https://www.github.com/netblue30/firejail.git +cd firejail +./configure +make +sudo make install-strip +echo "**********************************************************************" +echo "Mainline git Firejail version was installed in /usr/local." +echo "If you want to remove it, run" +echo +echo " firejail --git-uninstall" +echo +echo "**********************************************************************" +cd .. +rm -rf firejail diff --git a/src/fgit/fgit-uninstall.sh b/src/fgit/fgit-uninstall.sh new file mode 100644 index 000000000..9a370546d --- /dev/null +++ b/src/fgit/fgit-uninstall.sh @@ -0,0 +1,16 @@ +#!/bin/sh +# Purpose: Fetch, compile, and install firejail from GitHub source. Package-manager agnostic. +# + +set -e # exit immediately if one of the commands fails +cd /tmp # by the time we start this, we should have a tmpfs mounted on top of /tmp +git clone --depth=1 https://www.github.com/netblue30/firejail.git +cd firejail +./configure +sudo make uninstall +echo "**********************************************************************" +echo "Firejail mainline git version uninstalled from /usr/local" +echo +echo "**********************************************************************" +cd .. +rm -rf firejail diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 7e5412630..40d81f3aa 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h @@ -720,5 +720,9 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, int sbox_run(unsigned filter, int num, ...); +// git.c +void git_install(); +void git_uninstall(); + #endif diff --git a/src/firejail/git.c b/src/firejail/git.c new file mode 100644 index 000000000..bacceba59 --- /dev/null +++ b/src/firejail/git.c @@ -0,0 +1,91 @@ +/* + * Copyright (C) 2014-2016 Firejail Authors + * + * This file is part of firejail project + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ +#include "firejail.h" +#include +#include +#include + +// install a simple mount/pid namespace sandbox with a tmpfs on top of /tmp +static void sbox_ns(void) { + if (unshare(CLONE_NEWNS | CLONE_NEWIPC) < 0) + errExit("unshare"); + + if (mount(NULL, "/tmp", "tmpfs", 0, NULL) < 0) + errExit("mount"); +} + +void git_install() { + // redirect to "/usr/bin/firejail --noprofile --private-tmp /usr/lib/firejail/fgit-install.sh" + EUID_ASSERT(); + EUID_ROOT(); + + // install a mount namespace with a tmpfs on top of /tmp + sbox_ns(); + + // drop privileges + if (setgid(getgid()) < 0) + errExit("setgid/getgid"); + if (setuid(getuid()) < 0) + errExit("setuid/getuid"); + assert(getenv("LD_PRELOAD") == NULL); + + printf("Running as "); fflush(0); + int rv = system("whoami"); + (void) rv; + printf("/tmp directory: "); fflush(0); + rv = system("ls -l /tmp"); + (void) rv; + + // run command + const char *cmd = LIBDIR "/firejail/fgit-install.sh"; + rv = system(cmd); + (void) rv; + exit(0); +} + +void git_uninstall() { + // redirect to "/usr/bin/firejail --noprofile --private-tmp /usr/lib/firejail/fgit-install.sh" + EUID_ASSERT(); + EUID_ROOT(); + + // install a mount namespace with a tmpfs on top of /tmp + sbox_ns(); + + // drop privileges + if (setgid(getgid()) < 0) + errExit("setgid/getgid"); + if (setuid(getuid()) < 0) + errExit("setuid/getuid"); + assert(getenv("LD_PRELOAD") == NULL); + + printf("Running as "); fflush(0); + int rv = system("whoami"); + (void) rv; + printf("/tmp directory: "); fflush(0); + rv = system("ls -l /tmp"); + (void) rv; + + // run command + const char *cmd = LIBDIR "/firejail/fgit-uninstall.sh"; + rv = system(cmd); + (void) rv; + exit(0); +} + diff --git a/src/firejail/main.c b/src/firejail/main.c index 7c6568903..ee89a7281 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c @@ -846,10 +846,15 @@ int main(int argc, char **argv) { EUID_INIT(); EUID_USER(); + // process git-install and git-uninstall + if (check_arg(argc, argv, "--git-install")) + git_install(); // this function will not return + if (check_arg(argc, argv, "--git-uninstall")) + git_uninstall(); // this function will not return // check argv[0] symlink wrapper if this is not a login shell if (*argv[0] != '-') - run_symlink(argc, argv); + run_symlink(argc, argv); // this function will not return // check if we already have a sandbox running // If LXC is detected, start firejail sandbox