allow mixing of whitelist and private

2 files changed, 11 insertions, 7 deletions

diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index fd2a29372..9203e3d00 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -213,6 +213,15 @@ void fs_whitelist(void) {
 
                 // check for supported directories
                 if (strncmp(new_name, cfg.homedir, strlen(cfg.homedir)) == 0) {
+                        // whitelisting home directory is disabled if --private or --private-home option is present
+                        if (arg_private) {
+                                if (arg_debug)
+                                        printf("Removed whitelist path %s, --private option is present\n", entry->data);
+
+                                *entry->data = '\0';
+                                continue;
+                        }
+
                         entry->home_dir = 1;
                         home_dir = 1;
                         // both path and absolute path are under /home
@@ -271,6 +280,7 @@ void fs_whitelist(void) {
                 
         // create mount points
         fs_build_mnt_dir();
+        
 
         // /home/user
         if (home_dir) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 384688b54..c105894bb 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -354,13 +354,7 @@ int sandbox(void* sandbox_arg) {
         //****************************
         if (cfg.profile) {
                 // apply all whitelist commands ... 
-                if (arg_whitelist) {
-                        // whitelist commands are disabled if --private or --private-home option is present
-                        if (arg_private == 0)
-                                fs_whitelist();
-                        else
-                                fprintf(stderr, "Warning: whitelists disabled by private or private-home\n");
-                }
+                fs_whitelist();
                 
                 // ... followed by blacklist commands
                 fs_blacklist();