Add force-nonewprivs setting

4 files changed, 22 insertions, 2 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 430b0c5a6..4fdbe1897 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -36,7 +36,9 @@ int checkcfg(int val) {
                 int i;
                 for (i = 0; i < CFG_MAX; i++)
                         cfg_val[i] = 1; // most of them are enabled by default
+
                 cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
+                cfg_val[CFG_FORCE_NONEWPRIVS  ] = 0; // disabled by default
                 
                 // open configuration file
                 char *fname;
@@ -106,6 +108,15 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // nonewprivs
+                        else if (strncmp(ptr, "force-nonewprivs ", 17) == 0) {
+                                if (strcmp(ptr + 17, "yes") == 0)
+                                        cfg_val[CFG_SECCOMP] = 1;
+                                else if (strcmp(ptr + 17, "no") == 0)
+                                        cfg_val[CFG_SECCOMP] = 0;
+                                else
+                                        goto errout;
+                        }
                         // seccomp
                         else if (strncmp(ptr, "seccomp ", 8) == 0) {
                                 if (strcmp(ptr + 8, "yes") == 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index c9c090a97..661073730 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -566,7 +566,8 @@ void sandboxfs(int op, pid_t pid, const char *patqh);
 #define CFG_SECCOMP 5
 #define CFG_NETWORK 6
 #define CFG_RESTRICTED_NETWORK 7
-#define CFG_MAX 8 // this should always be the last entry
+#define CFG_FORCE_NONEWPRIVS 8
+#define CFG_MAX 9 // this should always be the last entry
 int checkcfg(int val);
 
 // fs_rdwr.c
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 843c1efe5..6133a610d 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -750,7 +750,7 @@ int sandbox(void* sandbox_arg) {
         //****************************************
         // Set NO_NEW_PRIVS if desired
         //****************************************
-        if (arg_nonewprivs) {
+        if (arg_nonewprivs || checkcfg(CFG_FORCE_NONEWPRIVS)) {
                 int no_new_privs = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 
                 if(no_new_privs != 0)
diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt
index fcf4109ee..dcede2ec6 100644
--- a/src/man/firejail-config.txt
+++ b/src/man/firejail-config.txt
@@ -49,6 +49,14 @@ Enable or disable user namespace support, default enabled.
 Enable or disable X11 sandboxing support, default enabled.
 
 .TP
+\fBforce-nonewprivs
+Force use of nonewprivs.  This mitigates the possibility of
+a user abusing firejail's features to trick a privileged (suid
+or file capabilities) process into loading code or configuration
+that is partially under their control.  Default disabled.
+
+
+.TP
 \fBxephyr-screen
 Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
 a full list of resolutions available on your specific setup. Examples: