-
Notifications
You must be signed in to change notification settings - Fork 584
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
modif: lookup xauth in PATH #6087
Conversation
a8d52a9
to
3768d91
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for the patch!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I see now that there already is a function for doing this: find_in_path()
in
fs_lib.c
:
firejail/src/firejail/fs_lib.c
Line 55 in b689b69
char *find_in_path(const char *program) {
Please try using that instead of adding a new one.
3768d91
to
e2483cb
Compare
done |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks better now, thanks.
Note: There is still a TOCTOU issue with the checks due to this allowing a
potentially user-writable xauth binary, though fixing the issue properly
requires refactoring elsewhere, so I might try that after this PR.
e2483cb
to
407c05e
Compare
Don't use hardcoded `/usr/bin/xauth`, iterate over directories inside PATH instead. This fixes netblue30#6006
Merged, thanks! |
Merged, thanks! |
This reverts commit 407c05e. If --private-lib is used (and firejail is configured with --enable-private-lib), the following error occurs: $ firejail --quiet --noprofile --private-lib true firejail: fs_lib.c:56: find_in_path: Assertion `geteuid() != 0' failed. Error: proc 10000 cannot sync with peer: unexpected EOF Peer 10001 unexpectedly killed (Segmentation fault) Given that it causes an uid assertion failure, the logic appears to not be correct and the current behavior may be unsafe, so for now revert that commit until the issue is properly addressed. Relates to netblue30#6006 netblue30#6087. Fixes netblue30#6113.
Don't use hardcoded
/usr/bin/xauth
,iterate over directories inside PATH instead.
This fixes #6006