sandbox setup: postpone library preloading

for now avoids mixing of traces from sandbox helpers
into application traces

1 files changed, 10 insertions, 6 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 9a4be5cc0..57ea2c477 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -1015,12 +1015,6 @@ int sandbox(void* sandbox_arg) {
                 fs_dev_disable_video();
 
         //****************************
-        // install trace
-        //****************************
-        if (need_preload)
-                fs_trace();
-
-        //****************************
         // set dns
         //****************************
         fs_resolvconf();
@@ -1136,6 +1130,16 @@ int sandbox(void* sandbox_arg) {
         fs_remount(RUN_SECCOMP_DIR, MOUNT_READONLY, 0);
         seccomp_debug();
 
+        //****************************
+        // install trace - still need capabilities
+        //****************************
+        if (need_preload)
+                fs_trace();
+
+        //****************************
+        // continue security filters
+        //****************************
+
         // set capabilities
         set_caps();