added --force option

2 files changed, 24 insertions, 4 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index a9ccfc9cc..3a06ec0f1 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -425,10 +425,21 @@ int main(int argc, char **argv) {
         // check if we already have a sandbox running
         int rv = check_kernel_procs();
         if (rv == 0) {
-                // start the program directly without sandboxing
-                run_no_sandbox(argc, argv);
-                // it will never get here!
-                assert(0);
+                // if --force option is passed to the program, disregard the existing sandbox
+                int found = 0;
+                for (i = 1; i < argc; i++) {
+                        if (strcmp(argv[i], "--force") == 0) {
+                                found = 1;
+                                break;
+                        }
+                }
+                
+                if (found == 0) {
+                        // start the program directly without sandboxing
+                        run_no_sandbox(argc, argv);
+                        // it will never get here!
+                        assert(0);
+                }
         }
 
         // initialize globals
@@ -478,6 +489,8 @@ int main(int argc, char **argv) {
                         arg_debug_whitelists = 1;
                 else if (strcmp(argv[i], "--quiet") == 0)
                         arg_quiet = 1;
+                else if (strcmp(argv[i], "--force") == 0)
+                        ;
                 
                 //*************************************
                 // filtering
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index cd36bead6..eed87c574 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -368,6 +368,13 @@ Example:
 $ firejail \-\-env=LD_LIBRARY_PATH=/opt/test/lib
 
 .TP
+\fB\-\-force
+By default, if Firejail is started in an existing sandbox, it will run the program in a bash shell.
+This option disables this behavior, and attempts to start Firejail in the existing sandbox.
+There could be lots of reasons for it to fail, for example if the existing sandbox disables
+admin capabilities, SUID binaries, or if it runs seccomp.
+
+.TP
 \fB\-\-fs.print=name
 Print the filesystem log for the sandbox identified by name.
 .br