symlink whitelist fix

2 files changed, 7 insertions, 0 deletions

diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index f94040d0f..e3668140d 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -401,6 +401,9 @@ void fs_whitelist(void) {
                                 struct stat s;
                                 if (stat(fname, &s) == 0 && s.st_uid != getuid())
                                         goto errexit;
+                                        
+                                // set nonewprivs
+                                arg_nonewprivs = 1;
                         }
                 }
                 else if (strncmp(new_name, "/tmp/", 5) == 0) {
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index d8bd34f10..65744235e 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -949,6 +949,10 @@ cannot acquire new privileges using execve(2);  in particular,
 this means that calling a suid binary (or one with file capabilities)
 does not result in an increase of privilege.
 
+--nonewprivs is enabled by default if seccomp filter is activated, or if a
+symbolic link in user home directory pointing outside user home
+is whitelisted.
+
 .TP
 \fB\-\-nosound
 Disable sound system.