security fix

1 files changed, 15 insertions, 0 deletions

diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index f890dd534..b3a22bad9 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -133,7 +133,15 @@ void pulseaudio_init(void) {
                                 {;} // do nothing
                 }
         }
+        else {
+                // make sure the directory is owned by the user
+                if (s.st_uid != getuid()) {
+                        fprintf(stderr, "Error: user .config directory is not owned by the current user\n");
+                        exit(1);
+                }
+        }
         free(dir1);
+        
         if (asprintf(&dir1, "%s/.config/pulse", cfg.homedir) == -1)
                 errExit("asprintf");
         if (stat(dir1, &s) == -1) {
@@ -144,6 +152,13 @@ void pulseaudio_init(void) {
                                 {;} // do nothing
                 }
         }
+        else {
+                // make sure the directory is owned by the user
+                if (s.st_uid != getuid()) {
+                        fprintf(stderr, "Error: user .config/pulse directory is not owned by the current user\n");
+                        exit(1);
+                }
+        }
         free(dir1);