Allow --tmpfs inside $HOME for unprivileged users

--tmpfs was added in 0.9.14 and restricted to root only in 0.9.38
due to priv-esc CVE-2016-10117 (e.g. --tmpfs=/etc and modify
/etc/sudoers). This commit reintroduce it for normal users, if the
realpath of it is inside users-home.

1 files changed, 0 insertions, 4 deletions

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 5d83e6a73..8ed187b20 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1563,10 +1563,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         else if (strncmp(ptr, "noexec ", 7) == 0)
                 ptr += 7;
         else if (strncmp(ptr, "tmpfs ", 6) == 0) {
-                if (getuid() != 0) {
-                        fprintf(stderr, "Error: tmpfs available only when running the sandbox as root\n");
-                        exit(1);
-                }
                 ptr += 6;
         }
         else {