fix forwarding of login option to restricted shell

If firejail is the login shell, the SHELL environment variable
is set to the path of the firejail executable. This leads to execution of a
'firejail -l' command, but firejail inside the sandbox does
not know what to do with the -l option and just starts bash without
forwarding this option.

Fix this by not checking $SHELL when guessing which shell should be used.
run_no_sandbox(), which relies on reading the environment, runs before
setting the login_shell variable, and is not affected.

2 files changed, 8 insertions, 5 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index b8ed29ece..78aec5e25 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -864,11 +864,13 @@ char *guess_shell(void) {
         char *shell = NULL;
         struct stat s;
 
-        shell = getenv("SHELL");
-        if (shell) {
-                invalid_filename(shell, 0); // no globbing
-                if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0)
-                        return shell;
+        if (!login_shell) { // if firejail is the login shell, SHELL is set to path of firejail executable
+                shell = getenv("SHELL");
+                if (shell) {
+                        invalid_filename(shell, 0); // no globbing
+                        if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0)
+                                return shell;
+                }
         }
 
         // shells in order of preference
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 01df77ee6..6d01d443a 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -177,6 +177,7 @@ void run_no_sandbox(int argc, char **argv) {
         }
 
         // use $SHELL to get shell used in sandbox, guess shell otherwise
+        assert(login_shell == 0);
         cfg.shell = guess_shell();
         if (!cfg.shell) {
                 fprintf(stderr, "Error: unable to guess your shell, please set SHELL environment variable\n");