feature: add notpm command & keep tpm devices in private-dev

netblue30 · Jul 4, 2024 · 4da75ef · 4da75ef
1 parent b89ec81
commit 4da75ef
Show file tree

Hide file tree

Showing 13 changed files with 54 additions and 6 deletions.
diff --git a/contrib/syntax/lists/profile_commands_arg0.list b/contrib/syntax/lists/profile_commands_arg0.list
@@ -27,6 +27,7 @@ nonewprivs
 noprinters
 noroot
 nosound
+notpm
 notv
 nou2f
 novideo

diff --git a/etc/profile-a-l/default.profile b/etc/profile-a-l/default.profile
@@ -37,6 +37,7 @@ noinput
 nonewprivs
 noroot
 #nosound
+#notpm
 notv
 #nou2f
 novideo

diff --git a/etc/templates/profile.template b/etc/templates/profile.template
@@ -175,6 +175,7 @@ include globals.local
 #noprinters
 #noroot
 #nosound
+#notpm
 #notv
 #nou2f
 #novideo

diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
@@ -138,6 +138,7 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
 		fprintf(fp, "#noinput\t# disable input devices\n");
 		fprintf(fp, "nonewprivs\n");
 		fprintf(fp, "noroot\n");
+		fprintf(fp, "#notpm\t# disable TPM devices\n");
 		fprintf(fp, "#notv\t# disable DVB TV devices\n");
 		fprintf(fp, "#nou2f\t# disable U2F devices\n");
 		fprintf(fp, "#novideo\t# disable video capture devices\n");

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
@@ -366,6 +366,7 @@ extern int arg_machineid;	// spoof /etc/machine-id
 extern int arg_disable_mnt;	// disable /mnt and /media
 extern int arg_noprofile;	// use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;	// block writable and executable memory
+extern int arg_notpm;	// --notpm
 extern int arg_notv;	// --notv
 extern int arg_nodvd;	// --nodvd
 extern int arg_nou2f;	// --nou2f
@@ -646,6 +647,7 @@ void fs_dev_disable_3d(void);
 void fs_dev_disable_video(void);
 void fs_dev_disable_tv(void);
 void fs_dev_disable_dvd(void);
+void fs_dev_disable_tpm(void);
 void fs_dev_disable_u2f(void);
 void fs_dev_disable_input(void);
 

diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
@@ -37,9 +37,10 @@ typedef enum {
 	DEV_SOUND,
 	DEV_3D,
 	DEV_VIDEO,
+	DEV_TPM,
 	DEV_TV,
-	DEV_DVD,
 	DEV_U2F,
+	DEV_DVD,
 	DEV_INPUT
 } DEV_TYPE;
 
@@ -79,6 +80,12 @@ static DevEntry dev[] = {
 	{"/dev/video9", RUN_DEV_DIR "/video9", DEV_VIDEO},
 	{"/dev/dvb", RUN_DEV_DIR "/dvb", DEV_TV}, // DVB (Digital Video Broadcasting) - TV device
 	{"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players
+	{"/dev/tpm0", RUN_DEV_DIR "/tpm0", DEV_TPM}, // TPM (Trusted Platform Module) devices
+	{"/dev/tpm1", RUN_DEV_DIR "/tpm1", DEV_TPM},
+	{"/dev/tpm2", RUN_DEV_DIR "/tpm2", DEV_TPM},
+	{"/dev/tpm3", RUN_DEV_DIR "/tpm3", DEV_TPM},
+	{"/dev/tpm4", RUN_DEV_DIR "/tpm4", DEV_TPM},
+	{"/dev/tpm5", RUN_DEV_DIR "/tpm5", DEV_TPM},
 	{"/dev/hidraw0", RUN_DEV_DIR "/hidraw0", DEV_U2F},
 	{"/dev/hidraw1", RUN_DEV_DIR "/hidraw1", DEV_U2F},
 	{"/dev/hidraw2", RUN_DEV_DIR "/hidraw2", DEV_U2F},
@@ -103,6 +110,7 @@ static void deventry_mount(void) {
 			if ((dev[i].type == DEV_SOUND && arg_nosound == 0) ||
 			    (dev[i].type == DEV_3D && arg_no3d == 0) ||
 			    (dev[i].type == DEV_VIDEO && arg_novideo == 0) ||
+			    (dev[i].type == DEV_TPM && arg_notpm == 0) ||
 			    (dev[i].type == DEV_TV && arg_notv == 0) ||
 			    (dev[i].type == DEV_DVD && arg_nodvd == 0) ||
 			    (dev[i].type == DEV_U2F && arg_nou2f == 0) ||
@@ -384,6 +392,15 @@ void fs_dev_disable_dvd(void) {
 	}
 }
 
+void fs_dev_disable_tpm(void) {
+	int i = 0;
+	while (dev[i].dev_fname != NULL) {
+		if (dev[i].type == DEV_TPM)
+			disable_file_or_dir(dev[i].dev_fname);
+		i++;
+	}
+}
+
 void fs_dev_disable_u2f(void) {
 	int i = 0;
 	while (dev[i].dev_fname != NULL) {

diff --git a/src/firejail/main.c b/src/firejail/main.c
@@ -153,6 +153,7 @@ int arg_allow_private_blacklist = 0;		// blacklist things in private directories
 int arg_disable_mnt = 0;			// disable /mnt and /media
 int arg_noprofile = 0; // use default.profile if none other found/specified
 int arg_memory_deny_write_execute = 0;		// block writable and executable memory
+int arg_notpm = 0; // --notpm
 int arg_notv = 0;	// --notv
 int arg_nodvd = 0; // --nodvd
 int arg_nou2f = 0; // --nou2f
@@ -2205,6 +2206,8 @@ int main(int argc, char **argv, char **envp) {
 			profile_add("blacklist /dev/lp*");
 			profile_add("blacklist /run/cups/cups.sock");
 		}
+		else if (strcmp(argv[i], "--notpm") == 0)
+			arg_notpm = 1;
 		else if (strcmp(argv[i], "--notv") == 0)
 			arg_notv = 1;
 		else if (strcmp(argv[i], "--nodvd") == 0)

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
@@ -451,6 +451,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 		arg_keep_config_pulse = 1;
 		return 0;
 	}
+	else if (strcmp(ptr, "notpm") == 0) {
+		arg_notpm = 1;
+		return 0;
+	}
 	else if (strcmp(ptr, "notv") == 0) {
 		arg_notv = 1;
 		return 0;

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
@@ -1095,6 +1095,9 @@ int sandbox(void* sandbox_arg) {
 	if (arg_no3d)
 		fs_dev_disable_3d();
 
+	if (arg_notpm)
+		fs_dev_disable_tpm();
+
 	if (arg_notv)
 		fs_dev_disable_tv();
 

diff --git a/src/firejail/usage.c b/src/firejail/usage.c
@@ -190,8 +190,9 @@ static const char *const usage_str =
 #endif
 	"    --nosound - disable sound system.\n"
 	"    --noautopulse - disable automatic ~/.config/pulse init.\n"
-	"    --novideo - disable video devices.\n"
+	"    --notpm - disable TPM devices.\n"
 	"    --nou2f - disable U2F devices.\n"
+	"    --novideo - disable video devices.\n"
 	"    --nowhitelist=filename - disable whitelist for file or directory.\n"
 	"    --oom=value - configure OutOfMemory killer for the sandbox\n"
 #ifdef HAVE_OUTPUT

diff --git a/src/man/firejail-profile.5.in b/src/man/firejail-profile.5.in
@@ -383,8 +383,8 @@ Set working directory inside the jail. Full directory path is required. Symbolic
 .TP
 \fBprivate-dev
 Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx,
-random, snd, urandom, video, log, shm and usb devices are available.
-Use the options no3d, nodvd, nosound, notv, nou2f and novideo for additional restrictions.
+random, snd, urandom, video, log, shm, tpm and usb devices are available.
+Use the options no3d, nodvd, nosound, notpm, notv, nou2f and novideo for additional restrictions.
 
 .TP
 \fBprivate-etc file,directory
@@ -817,6 +817,9 @@ Disable input devices.
 \fBnosound
 Disable sound system.
 .TP
+\fBnotpm
+Disable Trusted Platform Module (TPM) devices.
+.TP
 \fBnotv
 Disable DVB (Digital Video Broadcasting) TV devices.
 .TP

diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in
@@ -1918,6 +1918,16 @@ Example:
 .br
 $ firejail \-\-nosound firefox
 
+.TP
+\fB\-\-notpm
+Disable Trusted Platform Module (TPM) devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-notpm
+
 .TP
 \fB\-\-notv
 Disable DVB (Digital Video Broadcasting) TV devices.
@@ -2172,8 +2182,8 @@ $ pwd
 
 .TP
 \fB\-\-private-dev
-Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log, shm and usb devices are available.
-Use the options --no3d, --nodvd, --nosound, --notv, --nou2f and --novideo for additional restrictions.
+Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log, shm, tpm and usb devices are available.
+Use the options --no3d, --nodvd, --nosound, --notpm, --notv, --nou2f and --novideo for additional restrictions.
 .br
 
 .br

diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
@@ -134,6 +134,7 @@ _firejail_args=(
     '--nonewprivs[sets the NO_NEW_PRIVS prctl]'
     '--noprinters[disable printers]'
     '--nosound[disable sound system]'
+    '--notpm[disable TPM devices]'
     '--nou2f[disable U2F devices]'
     '--novideo[disable video devices]'
     '--private[temporary home directory]'