Merge pull request #319 from yumkam/network-restricted

Add compile-time option to restrict --net= to root only

1 files changed, 6 insertions, 0 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index 2a5ded984..be3dbd324 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1090,6 +1090,12 @@ int main(int argc, char **argv) {
                                 cfg.interface3.configured = 0;
                                 continue;
                         }
+#ifdef HAVE_NETWORK_RESTRICTED
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: only --net=none is allowed to non-root users\n");
+                                exit(1);
+                        }
+#endif
                         if (strcmp(argv[i] + 6, "lo") == 0) {
                                 fprintf(stderr, "Error: cannot attach to lo device\n");
                                 exit(1);