Merge branch 'master' of https://github.com/netblue30/firejail

3 files changed, 11 insertions, 0 deletions

diff --git a/configure.ac b/configure.ac
index b5dcd6855..9b717d333 100644
--- a/configure.ac
+++ b/configure.ac
@@ -38,6 +38,9 @@ AC_ARG_ENABLE([network],
     AS_HELP_STRING([--disable-network], [disable network]))
 AS_IF([test "x$enable_network" != "xno"], [
         HAVE_NETWORK="-DHAVE_NETWORK"
+        AS_IF([test "x$enable_network" = "xrestricted"], [
+               HAVE_NETWORK="$HAVE_NETWORK -DHAVE_NETWORK_RESTRICTED"
+        ])
         AC_SUBST(HAVE_NETWORK)
 ])
 
diff --git a/src/firejail/main.c b/src/firejail/main.c
index d2a093520..3cbaf658e 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1095,6 +1095,12 @@ int main(int argc, char **argv) {
                                 cfg.interface3.configured = 0;
                                 continue;
                         }
+#ifdef HAVE_NETWORK_RESTRICTED
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: only --net=none is allowed to non-root users\n");
+                                exit(1);
+                        }
+#endif
                         if (strcmp(argv[i] + 6, "lo") == 0) {
                                 fprintf(stderr, "Error: cannot attach to lo device\n");
                                 exit(1);
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index c4f0dbd3e..681a105af 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -471,6 +471,8 @@ Example:
 .br
 $ firejail \-\-net=eth0 \-\-ip6=2001:0db8:0:f101::1/64 firefox
 
+Note: you don't need this option if you obtain your ip6 address from router via SLAAC (your ip6 address and default route will be configured by kernel automatically).
+
 .TP
 \fB\-\-iprange=address,address
 Assign an IP address in the provided range to the last network interface defined by a \-\-net option. A