opt-in: skip blacklisted files in private-etc - netblue30#5010, netbl…

…ue30#5230
smitsohu · Jan 15, 2023 · 76e2829 · 76e2829
1 parent 15011a6
commit 76e2829
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 1 deletion.
diff --git a/etc/firejail.config b/etc/firejail.config
@@ -95,6 +95,9 @@
 # Enable or disable private-etc feature, default enabled.
 # private-etc yes
 
+# Remove blacklisted files from private-etc list, default disabled.
+# private-etc-no-blacklisted no
+
 # Enable or disable private-home feature, default enabled
 # private-home yes
 

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
@@ -52,6 +52,7 @@ int checkcfg(int val) {
  cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
  cfg_val[CFG_FORCE_NONEWPRIVS] = 0;
  cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0;
+ cfg_val[CFG_PRIVATE_ETC_NO_BLACKLISTED] = 0;
  cfg_val[CFG_FIREJAIL_PROMPT] = 0;
  cfg_val[CFG_DISABLE_MNT] = 0;
  cfg_val[CFG_ARP_PROBES] = DEFAULT_ARP_PROBES;
@@ -119,6 +120,7 @@ int checkcfg(int val) {
  PARSE_YESNO(CFG_PRIVATE_BIN_NO_LOCAL, "private-bin-no-local")
  PARSE_YESNO(CFG_PRIVATE_CACHE, "private-cache")
  PARSE_YESNO(CFG_PRIVATE_ETC, "private-etc")
+ PARSE_YESNO(CFG_PRIVATE_ETC_NO_BLACKLISTED, "private-etc-no-blacklisted")
  PARSE_YESNO(CFG_PRIVATE_HOME, "private-home")
  PARSE_YESNO(CFG_PRIVATE_LIB, "private-lib")
  PARSE_YESNO(CFG_PRIVATE_OPT, "private-opt")

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
@@ -815,6 +815,7 @@ enum {
  CFG_PRIVATE_BIN_NO_LOCAL,
  CFG_PRIVATE_CACHE,
  CFG_PRIVATE_ETC,
+ CFG_PRIVATE_ETC_NO_BLACKLISTED,
  CFG_PRIVATE_HOME,
  CFG_PRIVATE_LIB,
  CFG_PRIVATE_OPT,

diff --git a/src/firejail/fs.c b/src/firejail/fs.c
@@ -162,7 +162,7 @@ static void disable_file(OPERATION op, const char *filename) {
  fs_logger2("blacklist-nolog", fname);
 
  // files in /etc will be reprocessed during /etc rebuild
- if (strncmp(fname, "/etc/", 5) == 0) {
+ if (checkcfg(CFG_PRIVATE_ETC_NO_BLACKLISTED) && strncmp(fname, "/etc/", 5) == 0) {
  ProfileEntry *prf = malloc(sizeof(ProfileEntry));
  if (!prf)
  errExit("malloc");