/var and /etc are noexec by default

1 files changed, 2 insertions, 0 deletions

diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index de59b6676..4b2b91b17 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -722,10 +722,12 @@ void fs_basic_fs(void) {
                 printf("Mounting read-only /bin, /sbin, /lib, /lib32, /lib64, /usr");
         if (!arg_writable_etc) {
                 fs_rdonly("/etc");
+                fs_noexec("/etc");
                 if (arg_debug) printf(", /etc");
         }
         if (!arg_writable_var) {
                 fs_rdonly("/var");
+                fs_noexec("/var");
                 if (arg_debug) printf(", /var");
         }
         if (arg_debug) printf("\n");