Add keep-xattr option

By default, firejail preserves only xattrs for bind-mounted files. To
preserve xattrs on copied files (produced by private-bin, private-etc
and private-home options) it's possible to use keep-xattr option.

keep-xattr is very useful in systems with signature-based IMA appraisal
enabled (especially, when IMA policy prohibits running unsigned
binaries).

contrib/vim/syntax/firejail.vim

@@ -51,7 +51,7 @@ syn match fjVar /\v\$\{(CFG|DESKTOP|DOCUMENTS|DOWNLOADS|HOME|MUSIC|PATH|PICTURES
 " Generate list with: { rg -o 'strn?cmp\(ptr, "([^"]+) "' -r '$1' src/firejail/profile.c; echo private-lib; } | grep -vEx '(include|ignore|caps\.drop|caps\.keep|protocol|seccomp|seccomp\.drop|seccomp\.keep|env|rmenv|net|ip)' | sort -u | tr $'\n' '|' # private-lib is special-cased in the code and doesn't match the regex; grep-ed patterns are handled later with 'syn match nextgroup=' directives (except for include which is special-cased as a fjCommandNoCond keyword)
 syn match fjCommand /\v(bind|blacklist|blacklist-nolog|cgroup|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained
 " Generate list with: rg -o 'strn?cmp\(ptr, "([^ "]*[^ ])"' -r '$1' src/firejail/profile.c | grep -vEx '(include|rlimit|quiet)' | sed -e 's/\./\\./' | sort -u | tr $'\n' '|' # include/rlimit are false positives, quiet is special-cased below
-syn match fjCommand /\v(allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-fd|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noprinters|noroot|nosound|notv|nou2f|novideo|overlay|overlay-tmpfs|private|private-cache|private-cwd|private-dev|private-lib|private-tmp|seccomp|seccomp\.32|seccomp\.block-secondary|tracelog|writable-etc|writable-run-user|writable-var|writable-var-log|x11)$/ contained
+syn match fjCommand /\v(allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-fd|keep-xattr|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noprinters|noroot|nosound|notv|nou2f|novideo|overlay|overlay-tmpfs|private|private-cache|private-cwd|private-dev|private-lib|private-tmp|seccomp|seccomp\.32|seccomp\.block-secondary|tracelog|writable-etc|writable-run-user|writable-var|writable-var-log|x11)$/ contained
 syn match fjCommand /ignore / nextgroup=fjCommand,fjCommandNoCond skipwhite contained
 syn match fjCommand /caps\.drop / nextgroup=fjCapability,fjAll skipwhite contained
 syn match fjCommand /caps\.keep / nextgroup=fjCapability skipwhite contained

src/firejail/dhcp.c

@@ -146,7 +146,7 @@ void dhcp_store_exec(void) {
 		}
 	}
 
-	sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", dhclient_path, RUN_MNT_DIR);
+	sbox_run(SBOX_ROOT| SBOX_SECCOMP, 6, PATH_FCOPY, "--follow-link", "--keep-xattr", cfg.keep_xattr, dhclient_path, RUN_MNT_DIR);
 }
 
 void dhcp_start(void) {

src/firejail/firejail.h

@@ -162,6 +162,7 @@ typedef struct config_t {
 #define MAX_PROFILE_IGNORE 32
 	char *profile_ignore[MAX_PROFILE_IGNORE];
 	char *keep_fd;		// inherit file descriptors to sandbox
+	char *keep_xattr;	// keep xattrs on copied files
 	char *chrootdir;	// chroot directory
 	char *home_private;	// private home directory
 	char *home_private_keep;	// keep list for private home directory

src/firejail/fs_bin.c

@@ -187,7 +187,7 @@ static void duplicate(char *fname) {
 			if (valid_full_path_file(actual_path)) {
 				// solving problems such as /bin/sh -> /bin/dash
 				// copy the real file pointed by symlink
-				sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, actual_path, RUN_BIN_DIR);
+				sbox_run(SBOX_ROOT| SBOX_SECCOMP, 5, PATH_FCOPY, "--keep-xattr", cfg.keep_xattr, actual_path, RUN_BIN_DIR);
 				prog_cnt++;
 				char *f = strrchr(actual_path, '/');
 				if (f && *(++f) !='\0')
@@ -198,7 +198,7 @@ static void duplicate(char *fname) {
 	}
 
 	// copy a file or a symlink
-	sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, full_path, RUN_BIN_DIR);
+	sbox_run(SBOX_ROOT| SBOX_SECCOMP, 5, PATH_FCOPY, "--keep-xattr", cfg.keep_xattr, full_path, RUN_BIN_DIR);
 	prog_cnt++;
 	free(full_path);
 	report_duplication(fname);

src/firejail/fs_etc.c

@@ -170,9 +170,9 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
 	// this will solve problems such as NixOS #4887
 	// don't follow links to dynamic directories such as /proc
 	if (strcmp(src, "/etc/mtab") == 0)
-		sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FCOPY, src, dst);
+		sbox_run(SBOX_ROOT | SBOX_SECCOMP, 5, PATH_FCOPY, "--keep-xattr", cfg.keep_xattr, src, dst);
 	else
-		sbox_run(SBOX_ROOT | SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", src, dst);
+		sbox_run(SBOX_ROOT | SBOX_SECCOMP, 6, PATH_FCOPY, "--follow-link", "--keep-xattr", cfg.keep_xattr, src, dst);
 
 	free(dst);
 	fs_logger2("clone", src);

src/firejail/fs_home.c

@@ -569,11 +569,11 @@ static void duplicate(char *name) {
 		if (asprintf(&path, "%s/%s", RUN_HOME_DIR, ptr) == -1)
 			errExit("asprintf");
 		create_empty_dir_as_user(path, 0755);
-		sbox_run(SBOX_USER| SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FCOPY, fname, path);
+		sbox_run(SBOX_USER| SBOX_CAPS_NONE | SBOX_SECCOMP, 5, PATH_FCOPY, "--keep-xattr", cfg.keep_xattr, fname, path);
 		free(path);
 	}
 	else
-		sbox_run(SBOX_USER| SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FCOPY, fname, RUN_HOME_DIR);
+		sbox_run(SBOX_USER| SBOX_CAPS_NONE | SBOX_SECCOMP, 5, PATH_FCOPY, "--keep-xattr", cfg.keep_xattr, fname, RUN_HOME_DIR);
 	fs_logger2("clone", fname);
 	fs_logger_print();	// save the current log
 

src/firejail/main.c

@@ -1885,6 +1885,10 @@ int main(int argc, char **argv, char **envp) {
 				profile_list_augment(&cfg.keep_fd, add);
 			}
 		}
+		else if (strncmp(argv[i], "--keep-xattr=", 13) == 0) {
+			const char *xattr = argv[i] + 13;
+			profile_list_augment(&cfg.keep_xattr, xattr);
+		}
 #ifdef HAVE_CHROOT
 		else if (strncmp(argv[i], "--chroot=", 9) == 0) {
 			if (checkcfg(CFG_CHROOT)) {
@@ -2972,6 +2976,10 @@ int main(int argc, char **argv, char **envp) {
 	}
 	EUID_ASSERT();
 
+	// make sure that xattr list is non-null
+	if (!cfg.keep_xattr)
+		cfg.keep_xattr = "";
+
 	// block X11 sockets
 	if (arg_x11_block)
 		x11_block();

src/firejail/profile.c

@@ -303,6 +303,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 		}
 		return 0;
 	}
+	if (strncmp(ptr, "keep-xattr ", 11) == 0) {
+		const char *xattr = ptr + 11;
+		profile_list_augment(&cfg.keep_xattr, xattr);
+		return 0;
+	}
 	if (strncmp(ptr, "xephyr-screen ", 14) == 0) {
 #ifdef HAVE_X11
 		if (checkcfg(CFG_X11)) {

src/firejail/usage.c

@@ -120,6 +120,7 @@ static char *usage_str =
 	"    --keep-config-pulse - disable automatic ~/.config/pulse init.\n"
 	"    --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n"
 	"    --keep-fd - inherit open file descriptors to sandbox.\n"
+	"    --keep-xattr - copy specified extended attributes to sandbox.\n"
 	"    --keep-var-tmp - /var/tmp directory is untouched.\n"
 	"    --list - list all sandboxes.\n"
 #ifdef HAVE_FILE_TRANSFER

src/man/firejail-profile.txt

@@ -745,6 +745,10 @@ Enable IPC namespace.
 \fBkeep-fd
 Inherit open file descriptors to sandbox.
 
+.TP
+\fBkeep-xattr
+Copy specified extended attributes to sandbox.
+
 .TP
 \fBname sandboxname
 Set sandbox name. Example:

src/man/firejail.txt

@@ -1123,6 +1123,16 @@ Example:
 .br
 $ firejail --keep-fd=3,4,5
 
+.TP
+\fB\-\-keep-xattr=xattr_name
+Copy specified extended attributes. By default none of xattrs is copied for files in private-bin, private-etc and private-home. Attributes are always preserved for bind-mounted files.
+.br
+
+.br
+Example:
+.br
+$ firejail --keep-xattr=security.ima,security.SMACK64
+
 .TP
 \fB\-\-keep-var-tmp
 /var/tmp directory is untouched.

src/zsh_completion/_firejail.in

@@ -105,6 +105,7 @@ _firejail_args=(
     '--keep-config-pulse[disable automatic ~/.config/pulse init]'
     '--keep-dev-shm[/dev/shm directory is untouched (even with --private-dev)]'
     '--keep-fd[inherit open file descriptors to sandbox]'
+    '--keep-xattr[copy specified extended attributes to sandbox]'
     '--keep-var-tmp[/var/tmp directory is untouched]'
     '--machine-id[spoof /etc/machine-id with a random id]'
     '--memory-deny-write-execute[seccomp filter to block attempts to create memory mappings that are both writable and executable]'