Merge pull request #536 from KellerFuchs/no_new_privs

Enable using the NO_NEW_PRIVS prctl(2) flag

1 files changed, 6 insertions, 0 deletions

diff --git a/etc/firejail.config b/etc/firejail.config
index 41cd08e68..caaeb6792 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -30,6 +30,12 @@
 # Enable or disable X11 sandboxing support, default enabled.
 # x11 yes
 
+# Force use of nonewprivs.  This mitigates the possibility of
+# a user abusing firejail's features to trick a privileged (suid
+# or file capabilities) process into loading code or configuration
+# that is partially under their control.  Default disabled
+# force-nonewprivs no
+
 # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
 # a full list of resolutions available on your specific setup.
 # xephyr-screen 640x480