Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bugfix: do not interact with dbus directory if dbus proxy is disabled #6591

Merged
merged 1 commit into from
Feb 6, 2025
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
bugfix: do not interact with dbus directory if dbus proxy is disabled
Fix a failing assert when running `firejail` inside:
`firejail --chroot=somedir --noprofile`

firejail: ../../src/firejail/util.c:1039: create_empty_dir_as_root:
Assertion `(s.st_mode & 07777) == (mode)' failed.

The assert is checking whether the newly created `/run/firejail/dbus`
empty directory, has the correct mode set, which in this case is `0755`.
The issue is that, since the directory already exists and has the mode
`0400`, because of the first ran chroot command, the assert fails.

This commit circumvents this issue, by making `firejail` ignore the dbug
directory entirely, in the `src/firejail/preproc.c` file when compiling
the project using `configure --disable-dbusproxy`.
There's also really no need for `firejail` to care about that directory
if `--disable-dbusproxy` is used.
powerjungle committed Feb 1, 2025
commit c011879198b7114a876ca6a5082c4bf555d5d483
2 changes: 2 additions & 0 deletions src/firejail/preproc.c
Original file line number Diff line number Diff line change
@@ -142,8 +142,10 @@ void preproc_build_firejail_dir_locked(void) {
// only root should be able to lock files in this directory
create_empty_dir_as_root(RUN_FIREJAIL_SANDBOX_DIR, 0700);

#ifdef HAVE_DBUSPROXY
create_empty_dir_as_root(RUN_FIREJAIL_DBUS_DIR, 0755);
fs_remount(RUN_FIREJAIL_DBUS_DIR, MOUNT_NOEXEC, 0);
#endif

create_empty_dir_as_root(RUN_RO_DIR, S_IRUSR);
fs_remount(RUN_RO_DIR, MOUNT_READONLY, 0);