bring back postexecseccomp for chroot/appimage/overlay sandboxes

back in the days always the same default seccomp filter was loaded
for chroot/appimage/overlayfs sandboxes. Nowadays users can configure
their own filters, so allow postexecseccomp again.

1 files changed, 4 insertions, 5 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index a4c038897..b6e0468c6 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -786,14 +786,13 @@ int sandbox(void* sandbox_arg) {
 #else
         bool always_enforce_filters = false;
 #endif
-        // need ld.so.preload if tracing or seccomp with any non-default lists
-        bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec;
         // for --appimage, --chroot and --overlay* we force NO_NEW_PRIVS
         // and drop all capabilities
-        if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay || always_enforce_filters)) {
+        if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay || always_enforce_filters))
                 enforce_filters();
-                need_preload = arg_trace || arg_tracelog;
-        }
+
+        // need ld.so.preload if tracing or seccomp with any non-default lists
+        bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec;
 
         // trace pre-install
         if (need_preload)