Add ./configure --enable-force-nonewprivs

This will always set 'nonewprivs', 'caps.drop all' and 'nogroups'.

1 files changed, 6 insertions, 1 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index ff5f4cb1e..e320e77f9 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -795,11 +795,16 @@ int sandbox(void* sandbox_arg) {
                         exit(rv);
         }
 
+#ifdef HAVE_FORCE_NONEWPRIVS
+        bool always_enforce_filters = true;
+#else
+        bool always_enforce_filters = false;
+#endif
         // need ld.so.preload if tracing or seccomp with any non-default lists
         bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec;
         // for --appimage, --chroot and --overlay* we force NO_NEW_PRIVS
         // and drop all capabilities
-        if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay)) {
+        if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay || always_enforce_filters)) {
                 enforce_filters();
                 need_preload = arg_trace || arg_tracelog;
         }