--chroot fixes (Debian problem)

2 files changed, 16 insertions, 22 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 5d9526b4c..0e719ceaf 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -543,7 +543,8 @@ static void enforce_filters(void) {
         // drop all supplementary groups; /etc/group file inside chroot
         // is controlled by a regular usr
         arg_nogroups = 1;
-        fmessage("Dropping all Linux capabilities and enforcing default seccomp filter\n");
+        fmessage("\n** Warning: dropping all Linux capabilities and enforcing  **\n");
+        fmessage("**                  default seccomp filter                 **\n\n");
 }
 
 int sandbox(void* sandbox_arg) {
@@ -744,7 +745,13 @@ int sandbox(void* sandbox_arg) {
 
         // need ld.so.preload if tracing or seccomp with any non-default lists
         bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec;
-
+        // for --appimage, --chroot and --overlay* we replace the seccomp filter with the default one
+        // we also drop all capabilities
+        if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay)) {
+                enforce_filters();
+                need_preload = arg_trace || arg_tracelog;
+                arg_seccomp = 1;
+        }
         // trace pre-install
         if (need_preload)
                 fs_trace_preload();
@@ -756,19 +763,10 @@ int sandbox(void* sandbox_arg) {
         //****************************
         // configure filesystem
         //****************************
-        if (arg_appimage)
-                enforce_filters();
-
 #ifdef HAVE_CHROOT
         if (cfg.chrootdir) {
                 fs_chroot(cfg.chrootdir);
 
-                // force caps and seccomp if not started as root
-                if (getuid() != 0)
-                        enforce_filters();
-                else
-                        arg_seccomp = 1;
-
                 //****************************
                 // trace pre-install, this time inside chroot
                 //****************************
@@ -778,14 +776,8 @@ int sandbox(void* sandbox_arg) {
         else
 #endif
 #ifdef HAVE_OVERLAYFS
-        if (arg_overlay)        {
+        if (arg_overlay)
                 fs_overlayfs();
-                // force caps and seccomp if not started as root
-                if (getuid() != 0)
-                        enforce_filters();
-                else
-                        arg_seccomp = 1;
-        }
         else
 #endif
                 fs_basic_fs();
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index d7e402e31..c09684596 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -100,7 +100,8 @@ $ firejail --allusers
 Enable AppArmor confinement. For more information, please see \fBAPPARMOR\fR section below.
 .TP
 \fB\-\-appimage
-Sandbox an AppImage (https://appimage.org/) application.
+Sandbox an AppImage (https://appimage.org/) application. If the sandbox is started as a
+regular user, default seccomp and capabilities filters are enabled.
 .br
 
 .br
@@ -272,8 +273,7 @@ Example:
 \fB\-\-chroot=dirname
 Chroot the sandbox into a root filesystem. Unlike the regular filesystem container,
 the system directories are mounted read-write. If the sandbox is started as a
-regular user, default seccomp and capabilities filters are enabled. This
-option is not available on Grsecurity systems.
+regular user, default seccomp and capabilities filters are enabled.
 .br
 
 .br
@@ -1268,6 +1268,7 @@ Similar to \-\-output, but stderr is also stored.
 Mount a filesystem overlay on top of the current filesystem.  Unlike the regular filesystem container,
 the system directories are mounted read-write. All filesystem modifications go into the overlay.
 Directories /run, /tmp and /dev are not covered by the overlay. The overlay is stored in $HOME/.firejail/<PID> directory.
+If the sandbox is started as a regular user, default seccomp and capabilities filters are enabled.
 .br
 
 .br
@@ -1287,6 +1288,7 @@ Mount a filesystem overlay on top of the current filesystem.  Unlike the regular
 the system directories are mounted read-write. All filesystem modifications go into the overlay.
 Directories /run, /tmp and /dev are not covered by the overlay. The overlay is stored in $HOME/.firejail/<NAME> directory.
 The created overlay can be reused between multiple sessions.
+If the sandbox is started as a regular user, default seccomp and capabilities filters are enabled.
 .br
 
 .br
@@ -1304,7 +1306,7 @@ $ firejail \-\-overlay-named=jail1 firefox
 \fB\-\-overlay-tmpfs
 Mount a filesystem overlay on top of the current filesystem. All filesystem modifications
 are discarded when the sandbox is closed. Directories /run, /tmp and /dev are not covered by the overlay.
-
+If the sandbox is started as a regular user, default seccomp and capabilities filters are enabled.
 .br
 
 .br