chroot: make search permission check explicit

1 files changed, 5 insertions, 0 deletions

diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c
index 6f484e59a..72322221c 100644
--- a/src/firejail/chroot.c
+++ b/src/firejail/chroot.c
@@ -119,6 +119,11 @@ void fs_chroot(const char *rootdir) {
         int parentfd = safer_openat(-1, rootdir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (parentfd == -1)
                 errExit("safer_openat");
+
+        if (faccessat(parentfd, ".", X_OK, 0) != 0) {
+                fprintf(stderr, "Error: no search permission on chroot directory\n");
+                exit(1);
+        }
         // rootdir has to be owned by root and is not allowed to be generally writable,
         // this also excludes /tmp and friends
         struct stat s;