mainline merge

22 files changed, 458 insertions, 276 deletions

diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c
index 71b39390e..f09a23977 100644
--- a/src/firecfg/desktop_files.c
+++ b/src/firecfg/desktop_files.c
@@ -144,6 +144,8 @@ void fix_desktop_files(char *homedir) {
                 perror("opendir");
                 fprintf(stderr, "Warning: cannot access /usr/share/applications directory, desktop files fixing skipped...\n");
                 free(user_apps_dir);
+                if (dir)
+                        closedir(dir);
                 return;
         }
 
@@ -182,7 +184,9 @@ void fix_desktop_files(char *homedir) {
                 }
 
                 fseek(fp, 0, SEEK_END);
-                size_t size = ftell(fp);
+                long size = ftell(fp);
+                if (size == -1)
+                        errExit("ftell");
                 fseek(fp, 0, SEEK_SET);
                 char *buf = malloc(size + 1);
                 if (!buf)
@@ -266,12 +270,16 @@ void fix_desktop_files(char *homedir) {
 
                 if (stat(outname, &sb) == 0) {
                         printf("   %s skipped: file exists\n", filename);
+                        if (change_exec)
+                                free(change_exec);
                         continue;
                 }
 
                 FILE *fpin = fopen(filename, "r");
                 if (!fpin) {
                         fprintf(stderr, "Warning: cannot open /usr/share/applications/%s\n", filename);
+                        if (change_exec)
+                                free(change_exec);
                         continue;
                 }
 
@@ -279,6 +287,8 @@ void fix_desktop_files(char *homedir) {
                 if (!fpout) {
                         fprintf(stderr, "Warning: cannot open ~/.local/share/applications/%s\n", outname);
                         fclose(fpin);
+                        if (change_exec)
+                                free(change_exec);
                         continue;
                 }
                 fprintf(fpout, "# converted by firecfg\n");
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 0bbafb343..676c2d90a 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -10,6 +10,7 @@ Discord
 DiscordCanary
 FossaMail
 Fritzing
+JDownloader
 Mathematica
 Natron
 Telegram
@@ -94,6 +95,7 @@ deadbeef
 deluge
 dex2jar
 dia
+dig
 digikam
 dillo
 dino
@@ -217,6 +219,7 @@ inox
 iridium
 iridium-browser
 jd-gui
+jdownloader
 jitsi
 k3b
 kaffeine
@@ -442,6 +445,7 @@ weechat
 weechat-curses
 wesnoth
 wget
+whois
 wine
 wire-desktop
 wireshark
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index 298314d4f..810af6ff2 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -318,13 +318,14 @@ int main(int argc, char **argv) {
 
         // user setup
         char *user = get_user();
+        assert(user);
         uid_t uid;
         gid_t gid;
         char *home = get_homedir(user, &uid, &gid);
 
 
         // check for --bindir
-        for (i = i; i < argc; i++) {
+        for (i = 1; i < argc; i++) {
                 if (strncmp(argv[i], "--bindir=", 9) == 0) {
                         if (strncmp(argv[i] + 9, "~/", 2) == 0) {
                                 if (asprintf(&arg_bindir, "%s/%s", home, argv[i] + 11) == -1)
@@ -430,7 +431,7 @@ int main(int argc, char **argv) {
         set_links_firecfg();
 
         // add user to firejail access database - only for root
-        if (user && getuid() == 0) {
+        if (getuid() == 0) {
                 printf("\nAdding user %s to Firejail access database in %s/firejail.users\n", user, SYSCONFDIR);
                 firejail_user_add(user);
         }
diff --git a/src/firejail/arp.c b/src/firejail/arp.c
index c19cb0a47..288e5ded3 100644
--- a/src/firejail/arp.c
+++ b/src/firejail/arp.c
@@ -66,7 +66,7 @@ void arp_announce(const char *dev, Bridge *br) {
         // Find interface MAC address
         struct ifreq ifr;
         memset(&ifr, 0, sizeof (ifr));
-        strncpy(ifr.ifr_name, dev, IFNAMSIZ);
+        strncpy(ifr.ifr_name, dev, IFNAMSIZ - 1);
         if (ioctl(sock, SIOCGIFHWADDR, &ifr) < 0)
                 errExit("ioctl");
         close(sock);
@@ -138,7 +138,7 @@ int arp_check(const char *dev, uint32_t destaddr) {
         // Find interface MAC address
         struct ifreq ifr;
         memset(&ifr, 0, sizeof (ifr));
-        strncpy(ifr.ifr_name, dev, IFNAMSIZ);
+        strncpy(ifr.ifr_name, dev, IFNAMSIZ - 1);
         if (ioctl(sock, SIOCGIFHWADDR, &ifr) < 0)
                 errExit("ioctl");
         close(sock);
diff --git a/src/firejail/cmdline.c b/src/firejail/cmdline.c
index ce1e281a5..1fe5a2398 100644
--- a/src/firejail/cmdline.c
+++ b/src/firejail/cmdline.c
@@ -208,4 +208,5 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
 
         // free strdup
         free(tmp1);
+        free(command_line_tmp);
 }
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index d28ff534f..d92b6b1e0 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -555,6 +555,7 @@ void fs_mnt(void) {
 
 // mount /proc and /sys directories
 void fs_proc_sys_dev_boot(void) {
+
         if (arg_debug)
                 printf("Remounting /proc and /proc/sys filesystems\n");
         if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
@@ -571,8 +572,11 @@ void fs_proc_sys_dev_boot(void) {
         /* Mount a version of /sys that describes the network namespace */
         if (arg_debug)
                 printf("Remounting /sys directory\n");
-        if (umount2("/sys", MNT_DETACH) < 0)
-                fwarning("failed to unmount /sys\n");
+        // if this is an overlay, don't try to unmount, just mount a new sysfs
+        if (!arg_overlay) {
+                if (umount2("/sys", MNT_DETACH) < 0 && !cfg.chrootdir)
+                        fwarning("failed to unmount /sys\n");
+        }
         if (mount("sysfs", "/sys", "sysfs", MS_RDONLY|MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_REC, NULL) < 0)
                 fwarning("failed to mount /sys\n");
         else
@@ -779,19 +783,28 @@ void fs_basic_fs(void) {
 #ifndef LTS
 #ifdef HAVE_OVERLAYFS
 char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
+        assert(subdirname);
         struct stat s;
         char *dirname;
 
-        // create ~/.firejail directory
         if (asprintf(&dirname, "%s/.firejail", cfg.homedir) == -1)
                 errExit("asprintf");
-
-        if (is_link(dirname)) {
-                fprintf(stderr, "Error: ~/.firejail directory is a symbolic link\n");
-                exit(1);
+        // check if ~/.firejail already exists
+        if (lstat(dirname, &s) == 0) {
+                if (!S_ISDIR(s.st_mode)) {
+                        if (S_ISLNK(s.st_mode))
+                                fprintf(stderr, "Error: ~/.firejail is a symbolic link\n");
+                        else
+                                fprintf(stderr, "Error: ~/.firejail is not a directory\n");
+                        exit(1);
+                }
+                if (s.st_uid != getuid()) {
+                        fprintf(stderr, "Error: ~/.firejail directory is not owned by the current user\n");
+                        exit(1);
+                }
         }
-        if (stat(dirname, &s) == -1) {
-                // create directory
+        else {
+                // create ~/.firejail directory
                 pid_t child = fork();
                 if (child < 0)
                         errExit("fork");
@@ -805,6 +818,9 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
                         if (chmod(dirname, 0700) == -1)
                                 errExit("chmod");
                         ASSERT_PERMS(dirname, getuid(), getgid(), 0700);
+#ifdef HAVE_GCOV
+                        __gcov_flush();
+#endif
                         _exit(0);
                 }
                 // wait for the child to finish
@@ -813,23 +829,27 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
                         fprintf(stderr, "Error: cannot create ~/.firejail directory\n");
                         exit(1);
                 }
-        }
-        else if (s.st_uid != getuid()) {
-                fprintf(stderr, "Error: ~/.firejail directory is not owned by the current user\n");
-                exit(1);
+                fs_logger2("create", dirname);
         }
         free(dirname);
 
         // check overlay directory
         if (asprintf(&dirname, "%s/.firejail/%s", cfg.homedir, subdirname) == -1)
                 errExit("asprintf");
-        if (is_link(dirname)) {
-                fprintf(stderr, "Error: overlay directory is a symbolic link\n");
-                exit(1);
-        }
-        if (allow_reuse == 0) {
-                if (stat(dirname, &s) == 0) {
-                        fprintf(stderr, "Error: overlay directory already exists: %s\n", dirname);
+        if (lstat(dirname, &s) == 0) {
+                if (!S_ISDIR(s.st_mode)) {
+                        if (S_ISLNK(s.st_mode))
+                                fprintf(stderr, "Error: %s is a symbolic link\n", dirname);
+                        else
+                                fprintf(stderr, "Error: %s is not a directory\n", dirname);
+                        exit(1);
+                }
+                if (s.st_uid != 0) {
+                        fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", dirname);
+                        exit(1);
+                }
+                if (allow_reuse == 0) {
+                        fprintf(stderr, "Error: overlay directory exists, but reuse is not allowed\n");
                         exit(1);
                 }
         }
@@ -866,9 +886,11 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
 // # umount /root/overlay/root
 
 
-// to do: fix the code below; also, it might work without /dev; impose seccomp/caps filters when not root
+// to do: fix the code below; also, it might work without /dev, but consider keeping /dev/shm; add locking mechanism for overlay-clean
 #include <sys/utsname.h>
 void fs_overlayfs(void) {
+        struct stat s;
+
         // check kernel version
         struct utsname u;
         int rv = uname(&u);
@@ -894,50 +916,78 @@ void fs_overlayfs(void) {
         char *oroot = RUN_OVERLAY_ROOT;
         mkdir_attr(oroot, 0755, 0, 0);
 
-        struct stat s;
+        // set base for working and diff directories
         char *basedir = RUN_MNT_DIR;
+        int basefd = -1;
+
         if (arg_overlay_keep) {
-                // set base for working and diff directories
                 basedir = cfg.overlay_dir;
                 assert(basedir);
-
-                // does the overlay exist?
-                if (stat(basedir, &s) == 0) {
-                        if (arg_overlay_reuse == 0) {
-                                fprintf(stderr, "Error: overlay directory exists, but reuse is not allowed\n");
-                                exit(1);
-                        }
-                }
-                else {
-                        /* coverity[toctou] */
-                        if (mkdir(basedir, 0755) != 0) {
-                                fprintf(stderr, "Error: cannot create overlay directory\n");
-                                exit(1);
-                        }
+                // get a file descriptor for ~/.firejail, fails if there is any symlink
+                char *firejail;
+                if (asprintf(&firejail, "%s/.firejail", cfg.homedir) == -1)
+                        errExit("asprintf");
+                int fd = safe_fd(firejail, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+                if (fd == -1)
+                        errExit("safe_fd");
+                free(firejail);
+                // create basedir if it doesn't exist
+                // the new directory will be owned by root
+                const char *dirname = gnu_basename(basedir);
+                if (mkdirat(fd, dirname, 0755) == -1 && errno != EEXIST) {
+                        perror("mkdir");
+                        fprintf(stderr, "Error: cannot create overlay directory %s\n", basedir);
+                        exit(1);
                 }
+                // open basedir
+                basefd = openat(fd, dirname, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+                close(fd);
+        }
+        else {
+                basefd = open(basedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        }
+        if (basefd == -1) {
+                perror("open");
+                fprintf(stderr, "Error: cannot open overlay directory %s\n", basedir);
+                exit(1);
         }
 
-        char *odiff;
-        if(asprintf(&odiff, "%s/odiff", basedir) == -1)
-                errExit("asprintf");
+        // confirm once more base is owned by root
+        if (fstat(basefd, &s) == -1)
+                errExit("fstat");
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", basedir);
+                exit(1);
+        }
+        // confirm permissions of base are 0755
+        if (((S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH) & s.st_mode) != (S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH)) {
+                fprintf(stderr, "Error: invalid permissions on overlay directory %s\n", basedir);
+                exit(1);
+        }
 
+        // create diff and work directories inside base
         // no need to check arg_overlay_reuse
-        if (stat(odiff, &s) != 0) {
-                mkdir_attr(odiff, 0755, 0, 0);
+        char *odiff;
+        if (asprintf(&odiff, "%s/odiff", basedir) == -1)
+                errExit("asprintf");
+        // the new directory will be owned by root
+        if (mkdirat(basefd, "odiff", 0755) == -1 && errno != EEXIST) {
+                perror("mkdir");
+                fprintf(stderr, "Error: cannot create overlay directory %s\n", odiff);
+                exit(1);
         }
-        else if (set_perms(odiff, 0, 0, 0755))
-                errExit("set_perms");
+        ASSERT_PERMS(odiff, 0, 0, 0755);
 
         char *owork;
-        if(asprintf(&owork, "%s/owork", basedir) == -1)
+        if (asprintf(&owork, "%s/owork", basedir) == -1)
                 errExit("asprintf");
-
-        // no need to check arg_overlay_reuse
-        if (stat(owork, &s) != 0) {
-                mkdir_attr(owork, 0755, 0, 0);
+        // the new directory will be owned by root
+        if (mkdirat(basefd, "owork", 0755) == -1 && errno != EEXIST) {
+                perror("mkdir");
+                fprintf(stderr, "Error: cannot create overlay directory %s\n", owork);
+                exit(1);
         }
-        else if (set_perms(owork, 0, 0, 0755))
-                errExit("chown");
+        ASSERT_PERMS(owork, 0, 0, 0755);
 
         // mount overlayfs
         if (arg_debug)
@@ -977,43 +1027,48 @@ void fs_overlayfs(void) {
 
                         // BEFORE NEXT, WE NEED TO TEST IF /home has any contents or do we need to mount it?
                         // must create var for oroot/cfg.homedir
-                        if (asprintf(&overlayhome,"%s%s",oroot,cfg.homedir) == -1)
+                        if (asprintf(&overlayhome, "%s%s", oroot, cfg.homedir) == -1)
                                 errExit("asprintf");
-                        if (arg_debug) printf ("DEBUG: overlayhome var holds ##%s##\n",overlayhome);
+                        if (arg_debug) printf ("DEBUG: overlayhome var holds ##%s##\n", overlayhome);
 
                         // if no homedir in overlay -- create another overlay for /home
-                        if (stat(overlayhome, &s) == -1) {
-
-                                if(asprintf(&hroot, "%s/oroot/home", RUN_MNT_DIR) == -1)
-                                        errExit("asprintf");
-
-                                if(asprintf(&hdiff, "%s/hdiff", basedir) == -1)
-                                        errExit("asprintf");
+                        if (stat(cfg.homedir, &s) == 0 && stat(overlayhome, &s) == -1) {
 
                                 // no need to check arg_overlay_reuse
-                                if (stat(hdiff, &s) != 0) {
-                                        mkdir_attr(hdiff, S_IRWXU | S_IRWXG | S_IRWXO, 0, 0);
-                                }
-                                else if (set_perms(hdiff, 0, 0, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH))
-                                        errExit("set_perms");
-
-                                if(asprintf(&hwork, "%s/hwork", basedir) == -1)
+                                if (asprintf(&hdiff, "%s/hdiff", basedir) == -1)
                                         errExit("asprintf");
+                                // the new directory will be owned by root
+                                if (mkdirat(basefd, "hdiff", 0755) == -1 && errno != EEXIST) {
+                                        perror("mkdir");
+                                        fprintf(stderr, "Error: cannot create overlay directory %s\n", hdiff);
+                                        exit(1);
+                                }
+                                ASSERT_PERMS(hdiff, 0, 0, 0755);
 
                                 // no need to check arg_overlay_reuse
-                                if (stat(hwork, &s) != 0) {
-                                        mkdir_attr(hwork, S_IRWXU | S_IRWXG | S_IRWXO, 0, 0);
+                                if (asprintf(&hwork, "%s/hwork", basedir) == -1)
+                                        errExit("asprintf");
+                                // the new directory will be owned by root
+                                if (mkdirat(basefd, "hwork", 0755) == -1 && errno != EEXIST) {
+                                        perror("mkdir");
+                                        fprintf(stderr, "Error: cannot create overlay directory %s\n", hwork);
+                                        exit(1);
                                 }
-                                else if (set_perms(hwork, 0, 0, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH))
-                                        errExit("set_perms");
+                                ASSERT_PERMS(hwork, 0, 0, 0755);
 
                                 // no homedir in overlay so now mount another overlay for /home
+                                if (asprintf(&hroot, "%s/home", oroot) == -1)
+                                        errExit("asprintf");
                                 if (asprintf(&option, "lowerdir=/home,upperdir=%s,workdir=%s", hdiff, hwork) == -1)
                                         errExit("asprintf");
                                 if (mount("overlay", hroot, "overlay", MS_MGC_VAL, option) < 0)
                                         errExit("mounting overlayfs for mounted home directory");
 
                                 printf("OverlayFS for /home configured in %s directory\n", basedir);
+                                free(hroot);
+                                free(hdiff);
+                                free(hwork);
+
                         } // stat(overlayhome)
                         free(overlayhome);
                 }
@@ -1021,7 +1076,9 @@ void fs_overlayfs(void) {
                 //***************************
         }
         fmessage("OverlayFS configured in %s directory\n", basedir);
+        close(basefd);
 
+        // /dev, /run and /tmp are not covered by the overlay
         // mount-bind dev directory
         if (arg_debug)
                 printf("Mounting /dev\n");
@@ -1042,19 +1099,15 @@ void fs_overlayfs(void) {
                 errExit("mounting /run");
         fs_logger("whitelist /run");
 
-        // mount-bind /tmp/.X11-unix directory
-        if (stat("/tmp/.X11-unix", &s) == 0) {
-                if (arg_debug)
-                        printf("Mounting /tmp/.X11-unix\n");
-                char *x11;
-                if (asprintf(&x11, "%s/tmp/.X11-unix", oroot) == -1)
-                        errExit("asprintf");
-                if (mount("/tmp/.X11-unix", x11, NULL, MS_BIND|MS_REC, NULL) < 0)
-                        fwarning("cannot mount /tmp/.X11-unix in overlay\n");
-                else
-                        fs_logger("whitelist /tmp/.X11-unix");
-                free(x11);
-        }
+        // mount-bind tmp directory
+        if (arg_debug)
+                printf("Mounting /tmp\n");
+        char *tmp;
+        if (asprintf(&tmp, "%s/tmp", oroot) == -1)
+                errExit("asprintf");
+        if (mount("/tmp", tmp, NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mounting /tmp");
+        fs_logger("whitelist /tmp");
 
         // chroot in the new filesystem
 #ifdef HAVE_GCOV
@@ -1068,12 +1121,9 @@ void fs_overlayfs(void) {
 //              fs_dev_shm();
         fs_var_lock();
         if (!arg_keep_var_tmp)
-                fs_var_tmp();
+                fs_var_tmp();
         if (!arg_writable_var_log)
                 fs_var_log();
-        else
-                fs_rdwr("/var/log");
-
         fs_var_lib();
         fs_var_cache();
         fs_var_utmp();
@@ -1089,97 +1139,124 @@ void fs_overlayfs(void) {
         // cleanup and exit
         free(option);
         free(odiff);
+        free(owork);
+        free(dev);
+        free(run);
+        free(tmp);
 }
 #endif
 
 
 #ifdef HAVE_CHROOT
-// return 1 if error
+// exit if error
 void fs_check_chroot_dir(const char *rootdir) {
         EUID_ASSERT();
         assert(rootdir);
         struct stat s;
-        char *name;
+        int fd = -1;
+        int parentfd = -1;
 
-        if (strcmp(rootdir, "/tmp") == 0 || strcmp(rootdir, "/var/tmp") == 0) {
-                fprintf(stderr, "Error: invalid chroot directory\n");
+        char *overlay;
+        if (asprintf(&overlay, "%s/.firejail", cfg.homedir) == -1)
+                errExit("asprintf");
+        if (strncmp(rootdir, overlay, strlen(overlay)) == 0) {
+                fprintf(stderr, "Error: invalid chroot directory: no directories in ~/.firejail are allowed\n");
                 exit(1);
         }
+        free(overlay);
 
-        // rootdir has to be owned by root
-        if (stat(rootdir, &s) != 0) {
-                fprintf(stderr, "Error: cannot find chroot directory\n");
+        // fails if there is any symlink or if rootdir is not a directory
+        parentfd = safe_fd(rootdir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        if (parentfd == -1) {
+                fprintf(stderr, "Error: invalid chroot directory %s\n", rootdir);
                 exit(1);
         }
+        // rootdir has to be owned by root and is not allowed to be generally writable,
+        // this also excludes /tmp, /var/tmp and such
+        if (fstat(parentfd, &s) == -1)
+                errExit("fstat");
         if (s.st_uid != 0) {
                 fprintf(stderr, "Error: chroot directory should be owned by root\n");
                 exit(1);
         }
+        if (((S_IWGRP|S_IWOTH) & s.st_mode) != 0) {
+                fprintf(stderr, "Error: only root user should be given write permission on chroot directory\n");
+                exit(1);
+        }
 
         // check /dev
-        if (asprintf(&name, "%s/dev", rootdir) == -1)
-                errExit("asprintf");
-        if (stat(name, &s) == -1) {
-                fprintf(stderr, "Error: cannot find /dev in chroot directory\n");
+        fd = openat(parentfd, "dev", O_PATH|O_CLOEXEC);
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot open /dev in chroot directory\n");
                 exit(1);
         }
-        if (s.st_uid != 0) {
-                fprintf(stderr, "Error: chroot /dev directory should be owned by root\n");
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (!S_ISDIR(s.st_mode) || s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /dev should be a directory owned by root\n");
                 exit(1);
         }
-        free(name);
+        close(fd);
 
         // check /var/tmp
-        if (asprintf(&name, "%s/var/tmp", rootdir) == -1)
-                errExit("asprintf");
-        if (stat(name, &s) == -1) {
-                fprintf(stderr, "Error: cannot find /var/tmp in chroot directory\n");
+        fd = openat(parentfd, "var/tmp", O_PATH|O_CLOEXEC);
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot open /var/tmp in chroot directory\n");
                 exit(1);
         }
-        if (s.st_uid != 0) {
-                fprintf(stderr, "Error: chroot /var/tmp directory should be owned by root\n");
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (!S_ISDIR(s.st_mode) || s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /var/tmp should be a directory owned by root\n");
                 exit(1);
         }
-        free(name);
+        close(fd);
 
         // check /proc
-        if (asprintf(&name, "%s/proc", rootdir) == -1)
-                errExit("asprintf");
-        if (stat(name, &s) == -1) {
-                fprintf(stderr, "Error: cannot find /proc in chroot directory\n");
+        fd = openat(parentfd, "proc", O_PATH|O_CLOEXEC);
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot open /proc in chroot directory\n");
                 exit(1);
         }
-        if (s.st_uid != 0) {
-                fprintf(stderr, "Error: chroot /proc directory should be owned by root\n");
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (!S_ISDIR(s.st_mode) || s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /proc should be a directory owned by root\n");
                 exit(1);
         }
-        free(name);
+        close(fd);
 
         // check /tmp
-        if (asprintf(&name, "%s/tmp", rootdir) == -1)
-                errExit("asprintf");
-        if (stat(name, &s) == -1) {
-                fprintf(stderr, "Error: cannot find /tmp in chroot directory\n");
+        fd = openat(parentfd, "tmp", O_PATH|O_CLOEXEC);
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot open /tmp in chroot directory\n");
                 exit(1);
         }
-        if (s.st_uid != 0) {
-                fprintf(stderr, "Error: chroot /tmp directory should be owned by root\n");
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (!S_ISDIR(s.st_mode) || s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /tmp should be a directory owned by root\n");
                 exit(1);
         }
-        free(name);
+        close(fd);
 
         // check /etc
-        if (asprintf(&name, "%s/etc", rootdir) == -1)
-                errExit("asprintf");
-        if (stat(name, &s) == -1) {
-                fprintf(stderr, "Error: cannot find /etc in chroot directory\n");
+        fd = openat(parentfd, "etc", O_PATH|O_CLOEXEC);
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot open /etc in chroot directory\n");
                 exit(1);
         }
-        if (s.st_uid != 0) {
-                fprintf(stderr, "Error: chroot /etc directory should be owned by root\n");
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
+        if (!S_ISDIR(s.st_mode) || s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /etc should be a directory owned by root\n");
                 exit(1);
         }
-        free(name);
+        if (((S_IWGRP|S_IWOTH) & s.st_mode) != 0) {
+                fprintf(stderr, "Error: only root user should be given write permission on chroot /etc\n");
+                exit(1);
+        }
+        close(fd);
 
         // there should be no checking on <chrootdir>/etc/resolv.conf
         // the file is replaced with the real /etc/resolv.conf anyway
@@ -1211,19 +1288,21 @@ void fs_check_chroot_dir(const char *rootdir) {
 
         // check x11 socket directory
         if (getenv("FIREJAIL_X11")) {
-                char *name;
-                if (asprintf(&name, "%s/tmp/.X11-unix", rootdir) == -1)
-                        errExit("asprintf");
-                if (stat(name, &s) == -1) {
-                        fprintf(stderr, "Error: cannot find /tmp/.X11-unix in chroot directory\n");
+                fd = openat(parentfd, "tmp/.X11-unix", O_PATH|O_CLOEXEC);
+                if (fd == -1) {
+                        fprintf(stderr, "Error: cannot open /tmp/.X11-unix in chroot directory\n");
                         exit(1);
                 }
-                if (s.st_uid != 0) {
-                        fprintf(stderr, "Error: chroot /tmp/.X11-unix directory should be owned by root\n");
+                if (fstat(fd, &s) == -1)
+                        errExit("fstat");
+                if (!S_ISDIR(s.st_mode) || s.st_uid != 0) {
+                        fprintf(stderr, "Error: chroot /tmp/.X11-unix should be a directory owned by root\n");
                         exit(1);
                 }
-                free(name);
+                close(fd);
         }
+
+        close(parentfd);
 }
 
 // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf
@@ -1254,27 +1333,49 @@ void fs_chroot(const char *rootdir) {
 
         // some older distros don't have a /run directory
         // create one by default
-        // create /run/firejail directory in chroot
         char *rundir;
         if (asprintf(&rundir, "%s/run", rootdir) == -1)
                 errExit("asprintf");
-        if (is_link(rundir)) {
-                fprintf(stderr, "Error: invalid run directory inside chroot\n");
-                exit(1);
+        struct stat s;
+        if (lstat(rundir, &s) == 0) {
+                if (S_ISLNK(s.st_mode)) {
+                        fprintf(stderr, "Error: chroot /run is a symbolic link\n");
+                        exit(1);
+                }
+                if (!S_ISDIR(s.st_mode) || s.st_uid != 0) {
+                        fprintf(stderr, "Error: chroot /run should be a directory owned by root\n");
+                        exit(1);
+                }
+                if (((S_IWGRP|S_IWOTH) & s.st_mode) != 0) {
+                        fprintf(stderr, "Error: only root user should be given write permission on chroot /run\n");
+                        exit(1);
+                }
+        }
+        else {
+                // several sandboxes could race to create /run
+                if (mkdir(rundir, 0755) == -1 && errno != EEXIST)
+                        errExit("mkdir");
+                ASSERT_PERMS(rundir, 0, 0, 0755);
         }
-        create_empty_dir_as_root(rundir, 0755);
         free(rundir);
+
+        // create /run/firejail directory in chroot
         if (asprintf(&rundir, "%s/run/firejail", rootdir) == -1)
                 errExit("asprintf");
-        create_empty_dir_as_root(rundir, 0755);
+        if (mkdir(rundir, 0755) == -1 && errno != EEXIST)
+                errExit("mkdir");
+        ASSERT_PERMS(rundir, 0, 0, 0755);
         free(rundir);
 
         // create /run/firejail/mnt directory in chroot and mount the current one
         if (asprintf(&rundir, "%s%s", rootdir, RUN_MNT_DIR) == -1)
                 errExit("asprintf");
-        create_empty_dir_as_root(rundir, 0755);
+        if (mkdir(rundir, 0755) == -1 && errno != EEXIST)
+                errExit("mkdir");
+        ASSERT_PERMS(rundir, 0, 0, 0755);
         if (mount(RUN_MNT_DIR, rundir, NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind");
+        free(rundir);
 
         // copy /etc/resolv.conf in chroot directory
         char *fname;
@@ -1285,6 +1386,7 @@ void fs_chroot(const char *rootdir) {
         unlink(fname);
         if (copy_file("/etc/resolv.conf", fname, 0, 0, 0644) == -1) // root needed
                 fwarning("/etc/resolv.conf not initialized\n");
+        free(fname);
 
         // chroot into the new directory
 #ifdef HAVE_GCOV
@@ -1295,7 +1397,8 @@ void fs_chroot(const char *rootdir) {
         if (arg_debug)
                 printf("Chrooting into %s\n", rootdir);
         char *oroot = RUN_OVERLAY_ROOT;
-        mkdir_attr(oroot, 0755, 0, 0);
+        if (mkdir(oroot, 0755) == -1)
+                errExit("mkdir");
         if (mount(rootdir, oroot, NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mounting rootdir oroot");
         if (chroot(oroot) < 0)
@@ -1312,8 +1415,6 @@ void fs_chroot(const char *rootdir) {
                 fs_var_tmp();
         if (!arg_writable_var_log)
                 fs_var_log();
-        else
-                fs_rdwr("/var/log");
 
         fs_var_lib();
         fs_var_cache();
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 602985b4e..1fd1fb675 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -371,10 +371,13 @@ void fs_whitelist(void) {
 
                 // resolve macros
                 if (is_macro(dataptr)) {
-                        char *tmp = resolve_macro(dataptr);
-                        if (tmp != NULL)
-                                tmp = parse_nowhitelist(nowhitelist_flag, tmp);
-
+                        char *tmp = resolve_macro(dataptr); // returns allocated mem
+                        if (tmp != NULL) {
+                                char *tmp1 = parse_nowhitelist(nowhitelist_flag, tmp);
+                                assert(tmp1);
+                                free(tmp);
+                                tmp = tmp1;
+                        }
                         if (tmp) {
                                 entry->data = tmp;
                                 dataptr = (nowhitelist_flag)? entry->data + 12: entry->data + 10;
@@ -491,6 +494,7 @@ void fs_whitelist(void) {
                                         printf("\"%s\" disabled by --private\n", entry->data);
 
                                 entry->data = EMPTY_STRING;
+                                free(fname);
                                 continue;
                         }
 
@@ -503,14 +507,18 @@ void fs_whitelist(void) {
                         // both path and absolute path are under /home
                         if (strncmp(fname, cfg.homedir, strlen(cfg.homedir)) == 0) {
                                 // entire home directory is not allowed
-                                if (*(fname + strlen(cfg.homedir)) != '/')
+                                if (*(fname + strlen(cfg.homedir)) != '/') {
+                                        free(fname);
                                         goto errexit;
+                                }
                         }
                         else {
                                 if (checkcfg(CFG_FOLLOW_SYMLINK_AS_USER)) {
                                         // check if the file is owned by the user
-                                        if (stat(fname, &s) == 0 && s.st_uid != getuid())
+                                        if (stat(fname, &s) == 0 && s.st_uid != getuid()) {
+                                                free(fname);
                                                 goto errexit;
+                                        }
                                 }
                         }
                 }
@@ -520,6 +528,7 @@ void fs_whitelist(void) {
 
                         // both path and absolute path are under /tmp
                         if (strncmp(fname, "/tmp/", 5) != 0) {
+                                free(fname);
                                 goto errexit;
                         }
                 }
@@ -528,6 +537,7 @@ void fs_whitelist(void) {
                         media_dir = 1;
                         // both path and absolute path are under /media
                         if (strncmp(fname, "/media/", 7) != 0) {
+                                free(fname);
                                 goto errexit;
                         }
                 }
@@ -536,6 +546,7 @@ void fs_whitelist(void) {
                         mnt_dir = 1;
                         // both path and absolute path are under /mnt
                         if (strncmp(fname, "/mnt/", 5) != 0) {
+                                free(fname);
                                 goto errexit;
                         }
                 }
@@ -550,6 +561,7 @@ void fs_whitelist(void) {
                         else {
                                 // both path and absolute path are under /var
                                 if (strncmp(fname, "/var/", 5) != 0) {
+                                        free(fname);
                                         goto errexit;
                                 }
                         }
@@ -570,6 +582,7 @@ void fs_whitelist(void) {
                         else {
                                 // both path and absolute path are under /dev
                                 if (strncmp(fname, "/dev/", 5) != 0) {
+                                        free(fname);
                                         goto errexit;
                                 }
                         }
@@ -579,6 +592,7 @@ void fs_whitelist(void) {
                         opt_dir = 1;
                         // both path and absolute path are under /dev
                         if (strncmp(fname, "/opt/", 5) != 0) {
+                                free(fname);
                                 goto errexit;
                         }
                 }
@@ -587,6 +601,7 @@ void fs_whitelist(void) {
                         srv_dir = 1;
                         // both path and absolute path are under /srv
                         if (strncmp(fname, "/srv/", 5) != 0) {
+                                free(fname);
                                 goto errexit;
                         }
                 }
@@ -599,25 +614,32 @@ void fs_whitelist(void) {
                         else if (strcmp(new_name, "/etc/os-release") == 0);
                         // both path and absolute path are under /etc
                         else {
-                                if (strncmp(fname, "/etc/", 5) != 0)
+                                if (strncmp(fname, "/etc/", 5) != 0) {
+                                        free(fname);
                                         goto errexit;
+                                }
                         }
                 }
                 else if (strncmp(new_name, "/usr/share/", 11) == 0) {
                         entry->share_dir = 1;
                         share_dir = 1;
                         // both path and absolute path are under /etc
-                        if (strncmp(fname, "/usr/share/", 11) != 0)
+                        if (strncmp(fname, "/usr/share/", 11) != 0) {
+                                free(fname);
                                 goto errexit;
+                        }
                 }
                 else if (strncmp(new_name, "/sys/module/", 12) == 0) {
                         entry->module_dir = 1;
                         module_dir = 1;
                         // both path and absolute path are under /sys/module
-                        if (strncmp(fname, "/sys/module/", 12) != 0)
+                        if (strncmp(fname, "/sys/module/", 12) != 0) {
+                                free(fname);
                                 goto errexit;
+                        }
                 }
                 else {
+                        free(fname);
                         goto errexit;
                 }
 
diff --git a/src/firejail/main.c b/src/firejail/main.c
index c87032f6d..d35d8c207 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -777,18 +777,15 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
 
 }
 
-
-
 char *guess_shell(void) {
         char *shell = NULL;
         struct stat s;
 
         shell = getenv("SHELL");
         if (shell) {
-                // TODO: handle rogue shell variables?
-                if (stat(shell, &s) == 0 && access(shell, R_OK) == 0) {
+                invalid_filename(shell, 0); // no globbing
+                if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0)
                         return shell;
-                }
         }
 
         // shells in order of preference
@@ -797,7 +794,7 @@ char *guess_shell(void) {
         int i = 0;
         while (shells[i] != NULL) {
                 // access call checks as real UID/GID, not as effective UID/GID
-                if (stat(shells[i], &s) == 0 && access(shells[i], R_OK) == 0) {
+                if (stat(shells[i], &s) == 0 && access(shells[i], X_OK) == 0) {
                         shell = shells[i];
                         break;
                 }
@@ -867,6 +864,8 @@ int main(int argc, char **argv) {
         int lockfd_directory = -1;
         int option_cgroup = 0;
         int custom_profile = 0; // custom profile loaded
+        int arg_seccomp_cmdline = 0;    // seccomp requested on command line (used to break out of --chroot)
+        int arg_caps_cmdline = 0;       // caps requested on command line (used to break out of --chroot)
 
         // drop permissions by default and rise them when required
         EUID_INIT();
@@ -1154,6 +1153,7 @@ int main(int argc, char **argv) {
                                 }
                                 arg_seccomp = 1;
                                 cfg.seccomp_list = seccomp_check_list(argv[i] + 10);
+                                arg_seccomp_cmdline = 1;
                         }
                         else
                                 exit_err_feature("seccomp");
@@ -1166,6 +1166,7 @@ int main(int argc, char **argv) {
                                 }
                                 arg_seccomp = 1;
                                 cfg.seccomp_list_drop = seccomp_check_list(argv[i] + 15);
+                                arg_seccomp_cmdline = 1;
                         }
                         else
                                 exit_err_feature("seccomp");
@@ -1178,6 +1179,7 @@ int main(int argc, char **argv) {
                                 }
                                 arg_seccomp = 1;
                                 cfg.seccomp_list_keep = seccomp_check_list(argv[i] + 15);
+                                arg_seccomp_cmdline = 1;
                         }
                         else
                                 exit_err_feature("seccomp");
@@ -1196,8 +1198,10 @@ int main(int argc, char **argv) {
                                 exit_err_feature("seccomp");
                 }
 #endif
-                else if (strcmp(argv[i], "--caps") == 0)
+                else if (strcmp(argv[i], "--caps") == 0) {
                         arg_caps_default_filter = 1;
+                        arg_caps_cmdline = 1;
+                }
                 else if (strcmp(argv[i], "--caps.drop=all") == 0)
                         arg_caps_drop_all = 1;
                 else if (strncmp(argv[i], "--caps.drop=", 12) == 0) {
@@ -1207,6 +1211,7 @@ int main(int argc, char **argv) {
                                 errExit("strdup");
                         // verify caps list and exit if problems
                         caps_check_list(arg_caps_list, NULL);
+                        arg_caps_cmdline = 1;
                 }
                 else if (strncmp(argv[i], "--caps.keep=", 12) == 0) {
                         arg_caps_keep = 1;
@@ -1215,6 +1220,7 @@ int main(int argc, char **argv) {
                                 errExit("strdup");
                         // verify caps list and exit if problems
                         caps_check_list(arg_caps_list, NULL);
+                        arg_caps_cmdline = 1;
                 }
 
 
@@ -1516,13 +1522,12 @@ int main(int argc, char **argv) {
                                         cfg.chrootdir = tmp;
                                 }
 
-                                // check chroot dirname exists
-                                if (strstr(cfg.chrootdir, "..") || !is_dir(cfg.chrootdir) || is_link(cfg.chrootdir)) {
-                                        fprintf(stderr, "Error: invalid directory %s\n", cfg.chrootdir);
+                                if (strstr(cfg.chrootdir, "..") || is_link(cfg.chrootdir)) {
+                                        fprintf(stderr, "Error: invalid chroot directory %s\n", cfg.chrootdir);
                                         return 1;
                                 }
 
-                                // don't allow "--chroot=/"
+                                // check chroot dirname exists, don't allow "--chroot=/"
                                 char *rpath = realpath(cfg.chrootdir, NULL);
                                 if (rpath == NULL || strcmp(rpath, "/") == 0) {
                                         fprintf(stderr, "Error: invalid chroot directory\n");
@@ -2159,12 +2164,12 @@ int main(int argc, char **argv) {
                                 char *shellpath;
                                 if (asprintf(&shellpath, "%s%s", cfg.chrootdir, cfg.shell) == -1)
                                         errExit("asprintf");
-                                if (access(shellpath, R_OK)) {
+                                if (access(shellpath, X_OK)) {
                                         fprintf(stderr, "Error: cannot access shell file in chroot\n");
                                         exit(1);
                                 }
                                 free(shellpath);
-                        } else if (access(cfg.shell, R_OK)) {
+                        } else if (access(cfg.shell, X_OK)) {
                                 fprintf(stderr, "Error: cannot access shell file\n");
                                 exit(1);
                         }
@@ -2200,12 +2205,6 @@ int main(int argc, char **argv) {
                                 return 1;
                         }
                 }
-                else if (strcmp(argv[i], "--git-install") == 0 ||
-                        strcmp(argv[i], "--git-uninstall") == 0) {
-                        fprintf(stderr, "This feature is not enabled in the current build\n");
-                        exit(1);
-                }
-
                 else if (strcmp(argv[i], "--") == 0) {
                         // double dash - positional params to follow
                         arg_doubledash = 1;
@@ -2242,6 +2241,14 @@ int main(int argc, char **argv) {
         }
         EUID_ASSERT();
 
+        // exit for --chroot sandboxes when secomp or caps are explicitly specified on command line
+        if (getuid() != 0 && cfg.chrootdir && (arg_seccomp_cmdline || arg_caps_cmdline)) {
+                fprintf(stderr, "Error: for chroot sandboxes, default seccomp and capabilities filters are\n"
+                        "enabled by default. Please remove all --seccomp and --caps options from the\n"
+                        "command line.\n");
+                exit(1);
+        }
+
         // prog_index could still be -1 if no program was specified
         if (prog_index == -1 && arg_shell_none) {
                 fprintf(stderr, "Error: shell=none configured, but no program specified\n");
@@ -2257,12 +2264,12 @@ int main(int argc, char **argv) {
         // check user namespace (--noroot) options
         if (arg_noroot) {
                 if (arg_overlay) {
-                        fprintf(stderr, "Error: --overlay and --noroot are mutually exclusive.\n");
-                        exit(1);
+                        fwarning("--overlay and --noroot are mutually exclusive, --noroot disabled...\n");
+                        arg_noroot = 0;
                 }
                 else if (cfg.chrootdir) {
-                        fprintf(stderr, "Error: --chroot and --noroot are mutually exclusive.\n");
-                        exit(1);
+                        fwarning("--chroot and --noroot are mutually exclusive, --noroot disabled...\n");
+                        arg_noroot = 0;
                 }
         }
 
@@ -2336,39 +2343,30 @@ int main(int argc, char **argv) {
 
         // use default.profile as the default
         if (!custom_profile && !arg_noprofile) {
-                if (cfg.chrootdir) {
-                        fwarning("default profile disabled by --chroot option\n");
-                }
-//              else if (arg_overlay) {
-//                      fwarning("default profile disabled by --overlay option\n");
-//              }
-                else {
-                        // try to load a default profile
-                        char *profile_name = DEFAULT_USER_PROFILE;
-                        if (getuid() == 0)
-                                profile_name = DEFAULT_ROOT_PROFILE;
-                        if (arg_debug)
-                                printf("Attempting to find %s.profile...\n", profile_name);
-
-                        // look for the profile in ~/.config/firejail directory
-                        char *usercfgdir;
-                        if (asprintf(&usercfgdir, "%s/.config/firejail", cfg.homedir) == -1)
-                                errExit("asprintf");
-                        custom_profile = profile_find(profile_name, usercfgdir);
-                        free(usercfgdir);
+                char *profile_name = DEFAULT_USER_PROFILE;
+                if (getuid() == 0)
+                        profile_name = DEFAULT_ROOT_PROFILE;
+                if (arg_debug)
+                        printf("Attempting to find %s.profile...\n", profile_name);
 
-                        if (!custom_profile)
-                                // look for the profile in /etc/firejail directory
-                                custom_profile = profile_find(profile_name, SYSCONFDIR);
+                // look for the profile in ~/.config/firejail directory
+                char *usercfgdir;
+                if (asprintf(&usercfgdir, "%s/.config/firejail", cfg.homedir) == -1)
+                        errExit("asprintf");
+                custom_profile = profile_find(profile_name, usercfgdir);
+                free(usercfgdir);
 
-                        if (!custom_profile) {
-                                fprintf(stderr, "Error: no default.profile installed\n");
-                                exit(1);
-                        }
+                if (!custom_profile)
+                        // look for the profile in /etc/firejail directory
+                        custom_profile = profile_find(profile_name, SYSCONFDIR);
 
-                        if (custom_profile)
-                                fmessage("\n** Note: you can use --noprofile to disable %s.profile **\n\n", profile_name);
+                if (!custom_profile) {
+                        fprintf(stderr, "Error: no default.profile installed\n");
+                        exit(1);
                 }
+
+                if (custom_profile)
+                        fmessage("\n** Note: you can use --noprofile to disable %s.profile **\n\n", profile_name);
         }
         EUID_ASSERT();
 
@@ -2436,8 +2434,10 @@ int main(int argc, char **argv) {
         if (display > 0)
                 set_x11_run_file(sandbox_pid, display);
 #endif
-        flock(lockfd_directory, LOCK_UN);
-        close(lockfd_directory);
+        if (lockfd_directory != -1) {
+                flock(lockfd_directory, LOCK_UN);
+                close(lockfd_directory);
+        }
         EUID_USER();
 
         // clone environment
diff --git a/src/firejail/network.c b/src/firejail/network.c
index 7b84854d3..fed7539ca 100644
--- a/src/firejail/network.c
+++ b/src/firejail/network.c
@@ -78,7 +78,7 @@ int net_get_mtu(const char *ifname) {
 
         memset(&ifr, 0, sizeof(ifr));
         ifr.ifr_addr.sa_family = AF_INET;
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         if (ioctl(s, SIOCGIFMTU, (caddr_t)&ifr) == 0)
                 mtu = ifr.ifr_mtu;
         if (arg_debug)
@@ -106,7 +106,7 @@ void net_set_mtu(const char *ifname, int mtu) {
 
         memset(&ifr, 0, sizeof(ifr));
         ifr.ifr_addr.sa_family = AF_INET;
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_mtu = mtu;
         if (ioctl(s, SIOCSIFMTU, (caddr_t)&ifr) != 0)
                 fwarning("cannot set mtu for interface %s\n", ifname);
@@ -269,7 +269,7 @@ int net_get_mac(const char *ifname, unsigned char mac[6]) {
                 errExit("socket");
 
         memset(&ifr, 0, sizeof(ifr));
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
 
         if (ioctl(sock, SIOCGIFHWADDR, &ifr) == -1)
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index 9fb4840c6..f519ed85f 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -140,6 +140,8 @@ void preproc_clean_run(void) {
         if (fp) {
                 int val;
                 if (fscanf(fp, "%d", &val) == 1) {
+                        if (val > 4194304)      // this is the max value supported on 64 bit Linux kernels
+                                val = 4194304;
                         if (val >= max_pids)
                                 max_pids = val + 1;
                 }
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index a90a5e7d6..5f6707e4b 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -728,6 +728,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         cfg.dns4 = dns;
                 else {
                         fprintf(stderr, "Error: up to 4 DNS servers can be specified\n");
+                        free(dns);
                         return 1;
                 }
                 return 0;
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index d66deeb97..fa672eccb 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -41,6 +41,8 @@ static void ulist_add(const char *user) {
         assert(user);
 
         USER_LIST *nlist = malloc(sizeof(USER_LIST));
+        if (!nlist)
+                errExit("malloc");
         memset(nlist, 0, sizeof(USER_LIST));
         nlist->user = user;
         nlist->next = ulist;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 380257223..e0bc0e02f 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -546,7 +546,8 @@ static void enforce_filters(void) {
         // drop all supplementary groups; /etc/group file inside chroot
         // is controlled by a regular usr
         arg_nogroups = 1;
-        fmessage("Dropping all Linux capabilities and enforcing default seccomp filter\n");
+        fmessage("\n** Warning: dropping all Linux capabilities and enforcing  **\n");
+        fmessage("**                  default seccomp filter                 **\n\n");
 }
 
 int sandbox(void* sandbox_arg) {
@@ -751,6 +752,17 @@ int sandbox(void* sandbox_arg) {
 #else
         bool need_preload = arg_seccomp_postexec;
 #endif
+        // for --appimage, --chroot and --overlay* we replace the seccomp filter with the default one
+        // we also drop all capabilities
+        if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay)) {
+                enforce_filters();
+#ifdef LTS
+                need_preload = 0;
+#else
+                need_preload = arg_trace || arg_tracelog;
+#endif
+                arg_seccomp = 1;
+        }
         // trace pre-install
         if (need_preload)
                 fs_trace_preload();
@@ -762,20 +774,11 @@ int sandbox(void* sandbox_arg) {
         //****************************
         // configure filesystem
         //****************************
-        if (arg_appimage)
-                enforce_filters();
-
 #ifndef LTS
 #ifdef HAVE_CHROOT
         if (cfg.chrootdir) {
                 fs_chroot(cfg.chrootdir);
 
-                // force caps and seccomp if not started as root
-                if (getuid() != 0)
-                        enforce_filters();
-                else
-                        arg_seccomp = 1;
-
                 //****************************
                 // trace pre-install, this time inside chroot
                 //****************************
@@ -785,14 +788,8 @@ int sandbox(void* sandbox_arg) {
         else
 #endif
 #ifdef HAVE_OVERLAYFS
-        if (arg_overlay)        {
+        if (arg_overlay)
                 fs_overlayfs();
-                // force caps and seccomp if not started as root
-                if (getuid() != 0)
-                        enforce_filters();
-                else
-                        arg_seccomp = 1;
-        }
         else
 #endif
 #endif // LTS
@@ -1052,7 +1049,10 @@ int sandbox(void* sandbox_arg) {
         //****************************
         // set capabilities
         set_caps();
-
+#ifndef LTS
+        // set rlimits
+        set_rlimits();
+#endif //LTS
         // set cpu affinity
         if (cfg.cpus) {
                 save_cpu(); // save cpu affinity mask to CPU_CFG file
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index c11daad58..1c6f3c327 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -142,8 +142,10 @@ int sbox_run(unsigned filter, int num, ...) {
                 }
                 else if ((filter & SBOX_ALLOW_STDIN) == 0) {
                         int fd = open("/dev/null",O_RDWR, 0);
-                        if (fd != -1)
+                        if (fd != -1) {
                                 dup2(fd, STDIN_FILENO);
+                                close(fd);
+                        }
                         else // the user could run the sandbox without /dev/null
                                 close(STDIN_FILENO);
                 }
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 050f7534a..ff2bceacd 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -828,25 +828,19 @@ uid_t get_group_id(const char *group) {
         return gid;
 }
 
-static int len_homedir = 0;
+
 static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) {
         (void) sb;
         (void) typeflag;
         (void) ftwbuf;
         assert(fpath);
 
-        if (len_homedir == 0)
-                len_homedir = strlen(cfg.homedir);
-
-        char *rp = realpath(fpath, NULL);       // this should never fail!
-        if (!rp)
-                return 1;
-        if (strncmp(rp, cfg.homedir, len_homedir) != 0)
-                return 1;
-        free(rp);
+        if (strcmp(fpath, ".") == 0)
+                return 0;
 
         if (remove(fpath)) {    // removes the link not the actual file
-                fprintf(stderr, "Error: cannot remove file %s\n", fpath);
+                perror("remove");
+                fprintf(stderr, "Error: cannot remove file from user .firejail directory: %s\n", fpath);
                 exit(1);
         }
 
@@ -855,26 +849,64 @@ static int remove_callback(const char *fpath, const struct stat *sb, int typefla
 
 
 int remove_overlay_directory(void) {
+        EUID_ASSERT();
+        struct stat s;
         sleep(1);
 
         char *path;
         if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1)
                 errExit("asprintf");
 
-        // deal with obvious problems such as symlinks and root ownership
-        if (is_link(path))
-                errLogExit("overlay directory is a symlink\n");
-        if (access(path, R_OK | W_OK | X_OK) == -1)
-                errLogExit("no access to overlay directory\n");
+        if (lstat(path, &s) == 0) {
+                // deal with obvious problems such as symlinks and root ownership
+                if (!S_ISDIR(s.st_mode)) {
+                        if (S_ISLNK(s.st_mode))
+                                fprintf(stderr, "Error: %s is a symbolic link\n", path);
+                        else
+                                fprintf(stderr, "Error: %s is not a directory\n", path);
+                        exit(1);
+                }
+                if (s.st_uid != getuid()) {
+                        fprintf(stderr, "Error: %s is not owned by the current user\n", path);
+                        exit(1);
+                }
+
+                pid_t child = fork();
+                if (child < 0)
+                        errExit("fork");
+                if (child == 0) {
+                        // open ~/.firejail, fails if there is any symlink
+                        int fd = safe_fd(path, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+                        if (fd == -1)
+                                errExit("safe_fd");
+                        // chdir to ~/.firejail
+                        if (fchdir(fd) == -1)
+                                errExit("fchdir");
+                        close(fd);
 
-        EUID_ROOT();
-        if (setreuid(0, 0) < 0 ||
-            setregid(0, 0) < 0)
-                errExit("setreuid/setregid");
-        errno = 0;
+                        EUID_ROOT();
+                        // FTW_PHYS - do not follow symbolic links
+                        if (nftw(".", remove_callback, 64, FTW_DEPTH | FTW_PHYS) == -1)
+                                errExit("nftw");
 
-        // FTW_PHYS - do not follow symbolic links
-        return nftw(path, remove_callback, 64, FTW_DEPTH | FTW_PHYS);
+                        EUID_USER();
+                        // remove ~/.firejail
+                        if (rmdir(path) == -1)
+                                errExit("rmdir");
+#ifdef HAVE_GCOV
+                        __gcov_flush();
+#endif
+                        _exit(0);
+                }
+                // wait for the child to finish
+                waitpid(child, NULL, 0);
+                // check if ~/.firejail was deleted
+                if (stat(path, &s) == -1)
+                        return 0;
+                else
+                        return 1;
+        }
+        return 0;
 }
 
 void flush_stdin(void) {
diff --git a/src/firemon/interface.c b/src/firemon/interface.c
index 71026c7b7..3e0f10d0b 100644
--- a/src/firemon/interface.c
+++ b/src/firemon/interface.c
@@ -62,7 +62,7 @@ static void net_ifprint(void) {
                                         // extract mac address
                                         struct ifreq ifr;
                                         memset(&ifr, 0, sizeof(ifr));
-                                        strncpy(ifr.ifr_name,  ifa->ifa_name, IFNAMSIZ);
+                                        strncpy(ifr.ifr_name,  ifa->ifa_name, IFNAMSIZ - 1);
                                         int rv = ioctl (fd, SIOCGIFHWADDR, &ifr);
 
                                         if (rv == 0)
diff --git a/src/fnet/arp.c b/src/fnet/arp.c
index 2b6df6945..794f6c8c8 100644
--- a/src/fnet/arp.c
+++ b/src/fnet/arp.c
@@ -60,7 +60,7 @@ void arp_scan(const char *dev, uint32_t ifip, uint32_t ifmask) {
                 errExit("socket");
         struct ifreq ifr;
         memset(&ifr, 0, sizeof (ifr));
-        strncpy(ifr.ifr_name, dev, IFNAMSIZ);
+        strncpy(ifr.ifr_name, dev, IFNAMSIZ - 1);
         if (ioctl(sock, SIOCGIFHWADDR, &ifr) < 0)
                 errExit("ioctl");
         close(sock);
diff --git a/src/fnet/interface.c b/src/fnet/interface.c
index f3e9a8993..283c6d312 100644
--- a/src/fnet/interface.c
+++ b/src/fnet/interface.c
@@ -58,7 +58,7 @@ void net_bridge_add_interface(const char *bridge, const char *dev) {
                 errExit("socket");
 
         memset(&ifr, 0, sizeof(ifr));
-        strncpy(ifr.ifr_name, bridge, IFNAMSIZ);
+        strncpy(ifr.ifr_name, bridge, IFNAMSIZ - 1);
 #ifdef SIOCBRADDIF
         ifr.ifr_ifindex = ifindex;
         err = ioctl(sock, SIOCBRADDIF, &ifr);
@@ -90,7 +90,7 @@ void net_if_up(const char *ifname) {
         // get the existing interface flags
         struct ifreq ifr;
         memset(&ifr, 0, sizeof(ifr));
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_addr.sa_family = AF_INET;
 
         // read the existing flags
@@ -135,7 +135,7 @@ int net_get_mtu(const char *ifname) {
 
         memset(&ifr, 0, sizeof(ifr));
         ifr.ifr_addr.sa_family = AF_INET;
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         if (ioctl(s, SIOCGIFMTU, (caddr_t)&ifr) == 0)
                 mtu = ifr.ifr_mtu;
         close(s);
@@ -154,7 +154,7 @@ void net_set_mtu(const char *ifname, int mtu) {
 
         memset(&ifr, 0, sizeof(ifr));
         ifr.ifr_addr.sa_family = AF_INET;
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_mtu = mtu;
         if (ioctl(s, SIOCSIFMTU, (caddr_t)&ifr) != 0) {
                 if (!arg_quiet)
@@ -238,7 +238,7 @@ int net_get_mac(const char *ifname, unsigned char mac[6]) {
                 errExit("socket");
 
         memset(&ifr, 0, sizeof(ifr));
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
 
         if (ioctl(sock, SIOCGIFHWADDR, &ifr) == -1)
@@ -258,7 +258,7 @@ void net_if_ip(const char *ifname, uint32_t ip, uint32_t mask, int mtu) {
 
         struct ifreq ifr;
         memset(&ifr, 0, sizeof(ifr));
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_addr.sa_family = AF_INET;
 
         ((struct sockaddr_in *)&ifr.ifr_addr)->sin_addr.s_addr = htonl(ip);
@@ -292,7 +292,7 @@ int net_if_mac(const char *ifname, const unsigned char mac[6]) {
                 errExit("socket");
 
         memset(&ifr, 0, sizeof(ifr));
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
         memcpy(ifr.ifr_hwaddr.sa_data, mac, 6);
 
@@ -350,7 +350,7 @@ void net_if_ip6(const char *ifname, const char *addr6) {
         // find interface index
         struct ifreq ifr;
         memset(&ifr, 0, sizeof(ifr));
-        strncpy(ifr.ifr_name, ifname, IFNAMSIZ);
+        strncpy(ifr.ifr_name, ifname, IFNAMSIZ - 1);
         ifr.ifr_addr.sa_family = AF_INET;
         if (ioctl(sock, SIOGIFINDEX, &ifr) < 0) {
                 perror("ioctl SIOGIFINDEX");
diff --git a/src/fsec-optimize/main.c b/src/fsec-optimize/main.c
index f4300f350..80ca098cb 100644
--- a/src/fsec-optimize/main.c
+++ b/src/fsec-optimize/main.c
@@ -87,7 +87,8 @@ printf("\n");
 
         return 0;
 errexit:
-        close(fd);
+        if (fd != -1)
+                close(fd);
         fprintf(stderr, "Error: cannot read %s\n", fname);
         exit(1);
 
diff --git a/src/fsec-print/main.c b/src/fsec-print/main.c
index 94c60687f..5a1e34080 100644
--- a/src/fsec-print/main.c
+++ b/src/fsec-print/main.c
@@ -74,7 +74,8 @@ printf("\n");
         close(fd);
         return 0;
 errexit:
-        close(fd);
+        if (fd != -1)
+                close(fd);
         fprintf(stderr, "Error: cannot read %s\n", fname);
         exit(1);
 
diff --git a/src/include/common.h b/src/include/common.h
index 413cf98a5..a80ad4688 100644
--- a/src/include/common.h
+++ b/src/include/common.h
@@ -32,7 +32,7 @@
 #include <ctype.h>
 #include <assert.h>
 
-#define errExit(msg)    do { char msgout[500]; sprintf(msgout, "Error %s: %s:%d %s", msg, __FILE__, __LINE__, __FUNCTION__); perror(msgout); exit(1);} while (0)
+#define errExit(msg)    do { char msgout[500]; snprintf(msgout, 500, "Error %s: %s:%d %s", msg, __FILE__, __LINE__, __FUNCTION__); perror(msgout); exit(1);} while (0)
 
 // macro to print ip addresses in a printf statement
 #define PRINT_IP(A) \
diff --git a/src/libpostexecseccomp/libpostexecseccomp.c b/src/libpostexecseccomp/libpostexecseccomp.c
index 0ccb74b10..de64d50c5 100644
--- a/src/libpostexecseccomp/libpostexecseccomp.c
+++ b/src/libpostexecseccomp/libpostexecseccomp.c
@@ -31,7 +31,9 @@ static void load_seccomp(void) {
         if (fd == -1)
                 return;
 
-        int size = lseek(fd, 0, SEEK_END);
+        off_t size = lseek(fd, 0, SEEK_END);
+        if (size <= 0)
+                return;
         unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter);
         struct sock_filter *filter = MAP_FAILED;
         if (size != 0)
@@ -39,7 +41,7 @@ static void load_seccomp(void) {
 
         close(fd);
 
-        if (size == 0 || filter == MAP_FAILED)
+        if (filter == MAP_FAILED)
                 return;
 
         // install filter