fixes

3 files changed, 8 insertions, 3 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 4fdbe1897..3ea8caf5b 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -47,7 +47,7 @@ int checkcfg(int val) {
 
                 FILE *fp = fopen(fname, "r");
                 if (!fp) {
-                        fprintf(stderr, "Error: Firejail configuration file %s not found\n", fname);
+                        fprintf(stderr, "Warning: Firejail configuration file %s not found\n", fname);
                         exit(1);
                 }
                 
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 2f4a78d4b..cda9e788e 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -806,7 +806,7 @@ int main(int argc, char **argv) {
                 }
         }
         
-        // is this a login shell, or a command passed by sshd insert command line options from /etc/firejail/login.users
+        // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users
         if (*argv[0] == '-' || parent_sshd) {
                 fullargc = restricted_shell(cfg.username);
                 if (fullargc) {
@@ -825,6 +825,11 @@ int main(int argc, char **argv) {
                 check_user(argc, argv); // the function will not return if --user option was found
         }
         
+        
+        // check for force-nonewprivs in /etc/firejail/firejail.config file
+        if (!option_force && checkcfg(CFG_FORCE_NONEWPRIVS))
+                arg_nonewprivs = 1;
+        
         // parse arguments
         for (i = 1; i < argc; i++) {
                 run_cmd_and_exit(i, argc, argv); // will exit if the command is recognized
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 6133a610d..843c1efe5 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -750,7 +750,7 @@ int sandbox(void* sandbox_arg) {
         //****************************************
         // Set NO_NEW_PRIVS if desired
         //****************************************
-        if (arg_nonewprivs || checkcfg(CFG_FORCE_NONEWPRIVS)) {
+        if (arg_nonewprivs) {
                 int no_new_privs = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 
                 if(no_new_privs != 0)