fix firecfg links in restrictive sandboxes

firejail symbolic link redirection currently depends
on a shell, but in restrictive sandboxes there
might be no execute permission, or private-lib might
have removed necessary libraries, or seccomp might
block required syscalls ...

Fix this by forcing --shell=none.

closes #3911

1 files changed, 12 insertions, 10 deletions

diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 1e8951afc..60a82821e 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -167,15 +167,6 @@ void run_no_sandbox(int argc, char **argv) {
         if (setresuid(-1, getuid(), getuid()) != 0)
                 errExit("setresuid");
 
-        // use $SHELL to get shell used in sandbox, guess shell otherwise
-        cfg.shell = guess_shell();
-        if (!cfg.shell) {
-                fprintf(stderr, "Error: unable to guess your shell, please set SHELL environment variable\n");
-                exit(1);
-        }
-        else if (arg_debug)
-                printf("Selecting %s as shell\n", cfg.shell);
-
         // process limited subset of options
         // and find first non option arg:
         //      - first argument not starting with --,
@@ -203,9 +194,20 @@ void run_no_sandbox(int argc, char **argv) {
         }
 
         if (prog_index == 0) {
-                assert(cfg.command_line == NULL); // runs cfg.shell
+                // got no command, require a shell and try to execute it
+                cfg.shell = guess_shell();
+                if (!cfg.shell) {
+                        fprintf(stderr, "Error: unable to guess your shell, please set SHELL environment variable\n");
+                        exit(1);
+                }
+
+                assert(cfg.command_line == NULL);
                 cfg.window_title = cfg.shell;
         } else {
+                // this sandbox might not allow execution of a shell
+                // force --shell=none in order to not break firecfg symbolic links
+                arg_shell_none = 1;
+
                 build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
         }