Fix sndio support

[nullenvk]

This patch allows sandboxed programs to access a sndiod server and play audio on systems where sndio handles audio.

[SkewedZeppelin]

-1, don't add /tmp to this, will effectively apply private-tmp to all profiles using whitelist-common

[SkewedZeppelin]

This is likely something you should add to your locals.

[rusty-snake]

• Move it into the common block (the first one)
• Only whitelist in ${HOME} (if whitelist /tmp/sndio is necessary, we should add it to private-tmp)

[nullenvk]

* [ ]  Move it into the common block (the first one)

* [ ]  Only `whitelist` in `${HOME}` (if `whitelist /tmp/sndio` is necessary, we should add it to `private-tmp`)

I've removed that last line and moved the cookie whitelist into the common block. However, I'm not quite sure how to handle the /tmp/sndio directory. Usually it contains UNIX domain sockets (e.g. /tmp/sndio/sndio0) used to connect to the server.

[rusty-snake]

However, I'm not quite sure how to handle the /tmp/sndio directory. Usually it contains UNIX domain sockets (e.g. /tmp/sndio/sndio0) used to connect to the server.

I think a profile_add("whitelist /tmp/sndio"); in fs_private_tmp works

firejail/src/firejail/fs.c

Lines 1251 to 1299 in 447e30e

	// this function is called from sandbox.c before blacklist/whitelist functions
	void fs_private_tmp(void) {
	EUID_ASSERT();
	if (arg_debug)
	printf("Generate private-tmp whitelist commands\n");
	// check XAUTHORITY file, KDE keeps it under /tmp
	const char *xauth = env_get("XAUTHORITY");
	if (xauth) {
	char *rp = realpath(xauth, NULL);
	if (rp && strncmp(rp, "/tmp/", 5) == 0) {
	char *cmd;
	if (asprintf(&cmd, "whitelist %s", rp) == -1)
	errExit("asprintf");
	profile_check_line(cmd, 0, NULL);
	profile_add(cmd); // profile_add does not duplicate the string
	}
	if (rp)
	free(rp);
	}
	// whitelist x11 directory
	profile_add("whitelist /tmp/.X11-unix");
	// read-only x11 directory
	profile_add("read-only /tmp/.X11-unix");
	// whitelist any pulse* file in /tmp directory
	// some distros use PulseAudio sockets under /tmp instead of the socket in /urn/user
	DIR *dir;
	if (!(dir = opendir("/tmp"))) {
	// sleep 2 seconds and try again
	sleep(2);
	if (!(dir = opendir("/tmp"))) {
	return;
	}
	}
	struct dirent *entry;
	while ((entry = readdir(dir))) {
	if (strncmp(entry->d_name, "pulse-", 6) == 0) {
	char *cmd;
	if (asprintf(&cmd, "whitelist /tmp/%s", entry->d_name) == -1)
	errExit("asprintf");
	profile_check_line(cmd, 0, NULL);
	profile_add(cmd); // profile_add does not duplicate the string
	}
	}
	closedir(dir);
	}

[nullenvk]

Done, now it works properly without any extra tweaking.

[rusty-snake]

LGTM

[netblue30]

Thanks for the patch!