security fix

1 files changed, 21 insertions, 1 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index e70e20eec..3a347b3d9 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -35,6 +35,7 @@
 #include <signal.h>
 #include <time.h>
 #include <net/if.h>
+#include <sys/utsname.h>
 
 #if 0
 #include <sys/times.h>
@@ -817,8 +818,27 @@ int main(int argc, char **argv) {
         
         if (check_arg(argc, argv, "--quiet"))
                 arg_quiet = 1;
-        if (check_arg(argc, argv, "--allow-debuggers"))
+        if (check_arg(argc, argv, "--allow-debuggers")) {
+                // check kernel version
+                struct utsname u;
+                int rv = uname(&u);
+                if (rv != 0)
+                        errExit("uname");
+                int major;
+                int minor;
+                if (2 != sscanf(u.release, "%d.%d", &major, &minor)) {
+                        fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version);
+                        exit(1);
+                }
+                if (major < 4 || (major == 4 && minor < 8)) {
+                        fprintf(stderr, "Error: --allow-debuggers is disabled on Linux kernels prior to 4.8. "
+                                "A bug in ptrace call allows a full bypass of the seccomp filter. "
+                                "Your current kernel version is %d.%d.\n", major, minor);
+                        exit(1);
+                }
+
                 arg_allow_debuggers = 1;
+        }
 
         // drop permissions by default and rise them when required
         EUID_INIT();