Merge pull request #537 from KellerFuchs/restricted-netfilter

Make `restricted-network` prevent use of netfilter

4 files changed, 31 insertions, 7 deletions

diff --git a/README.md b/README.md
index 4f90b6f27..2d5f472ea 100644
--- a/README.md
+++ b/README.md
@@ -197,9 +197,9 @@ The following features can be enabled or disabled:
        restricted-network
               Enable  or disable restricted network support, default disabled.
               If enabled, networking features should also be enabled  (network
-              yes).   Restricted  networking  grants access to --interface and
-              --net=ethXXX only to root user. Regular users are  only  allowed
-              --net=none.
+              yes).  Restricted networking  grants access to --interface,
+              --net=ethXXX and --netfilter only to root user.  Regular users
+                          are only allowed --net=none.  Default disabled
 
        secomp Enable or disable seccomp support, default enabled.
 
diff --git a/etc/firejail.config b/etc/firejail.config
index caaeb6792..55d2faa9f 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -17,8 +17,8 @@
 
 # Enable or disable restricted network support, default disabled. If enabled,
 # networking features should also be enabled (network yes).
-# Restricted networking grants access to --interface and --net=ethXXX
-# only to root user. Regular users are only allowed --net=none.
+# Restricted networking grants access to --interface, --net=ethXXX and
+# --netfilter only to root user. Regular users are only allowed --net=none.
 # restricted-network no
 
 # Enable or disable seccomp support, default enabled.
diff --git a/src/firejail/main.c b/src/firejail/main.c
index cda9e788e..955bd36bf 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1684,6 +1684,18 @@ int main(int argc, char **argv) {
 
 #ifdef HAVE_NETWORK
                 else if (strcmp(argv[i], "--netfilter") == 0) {
+#ifdef HAVE_NETWORK_RESTRICTED
+                        // compile time restricted networking
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
+                                exit(1);
+                        }
+#endif
+                        // run time restricted networking
+                        if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) {
+                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
+                                exit(1);
+                        }
                         if (checkcfg(CFG_NETWORK)) {
                                 arg_netfilter = 1;
                         }
@@ -1694,6 +1706,18 @@ int main(int argc, char **argv) {
                 }
 
                 else if (strncmp(argv[i], "--netfilter=", 12) == 0) {
+#ifdef HAVE_NETWORK_RESTRICTED
+                        // compile time restricted networking
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
+                                exit(1);
+                        }
+#endif
+                        // run time restricted networking
+                        if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) {
+                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
+                                exit(1);
+                        }
                         if (checkcfg(CFG_NETWORK)) {
                                 arg_netfilter = 1;
                                 arg_netfilter_file = argv[i] + 12;
diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt
index dcede2ec6..026765f1a 100644
--- a/src/man/firejail-config.txt
+++ b/src/man/firejail-config.txt
@@ -33,8 +33,8 @@ Enable or disable networking features, default enabled.
 \fBrestricted-network
 Enable or disable restricted network support, default disabled. If enabled,
 networking features should also be enabled (network yes).
-Restricted networking grants access to --interface and --net=ethXXX
-only to root user. Regular users are only allowed --net=none.
+Restricted networking grants access to --interface, --net=ethXXX and
+\-\-netfilter only to root user. Regular users are only allowed --net=none.
 
 .TP
 \fBsecomp