removed compile time --enable-network=restricted, --net=none allowed even if networking was disabled at compile time or at run time, fixed issue #2061

3 files changed, 28 insertions, 81 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 42ff31976..7483136f4 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -373,6 +373,13 @@ int checkcfg(int val) {
                 initialized = 1;
         }
 
+
+        // merge CFG_RESTRICTED_NETWORK into CFG_NETWORK
+        if (val == CFG_NETWORK) {
+                if (cfg_val[CFG_RESTRICTED_NETWORK] && getuid() != 0)
+                        return 0;
+        }
+
         return cfg_val[val];
 
 errout:
@@ -443,10 +450,6 @@ void print_compiletime_support(void) {
 #endif
                 );
 
-#ifdef HAVE_NETWORK_RESTRICTED
-        printf("\t- networking features are available only to root user\n");
-#endif
-
         printf("\t- overlayfs support is %s\n",
 #ifdef HAVE_OVERLAYFS
                 "enabled"
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 8e4fc6f38..3e092a3cc 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1745,22 +1745,21 @@ int main(int argc, char **argv) {
                 //*************************************
                 // network
                 //*************************************
+                else if (strcmp(argv[i], "--net=none") == 0) {
+                        arg_nonetwork  = 1;
+                        cfg.bridge0.configured = 0;
+                        cfg.bridge1.configured = 0;
+                        cfg.bridge2.configured = 0;
+                        cfg.bridge3.configured = 0;
+                        cfg.interface0.configured = 0;
+                        cfg.interface1.configured = 0;
+                        cfg.interface2.configured = 0;
+                        cfg.interface3.configured = 0;
+                        continue;
+                }
 #ifdef HAVE_NETWORK
                 else if (strncmp(argv[i], "--interface=", 12) == 0) {
                         if (checkcfg(CFG_NETWORK)) {
-#ifdef HAVE_NETWORK_RESTRICTED
-                                // compile time restricted networking
-                                if (getuid() != 0) {
-                                        fprintf(stderr, "Error: --interface is allowed only to root user\n");
-                                        exit(1);
-                                }
-#endif
-                                // run time restricted networking
-                                if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) {
-                                        fprintf(stderr, "Error: --interface is allowed only to root user\n");
-                                        exit(1);
-                                }
-
                                 // checks
                                 if (arg_nonetwork) {
                                         fprintf(stderr, "Error: --network=none and --interface are incompatible\n");
@@ -1818,18 +1817,6 @@ int main(int argc, char **argv) {
                                         continue;
                                 }
 
-#ifdef HAVE_NETWORK_RESTRICTED
-                                // compile time restricted networking
-                                if (getuid() != 0) {
-                                        fprintf(stderr, "Error: only --net=none is allowed to non-root users\n");
-                                        exit(1);
-                                }
-#endif
-                                // run time restricted networking
-                                if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) {
-                                        fprintf(stderr, "Error: only --net=none is allowed to non-root users\n");
-                                        exit(1);
-                                }
                                 if (strcmp(argv[i] + 6, "lo") == 0) {
                                         fprintf(stderr, "Error: cannot attach to lo device\n");
                                         exit(1);
@@ -2072,18 +2059,6 @@ int main(int argc, char **argv) {
 
 #ifdef HAVE_NETWORK
                 else if (strcmp(argv[i], "--netfilter") == 0) {
-#ifdef HAVE_NETWORK_RESTRICTED
-                        // compile time restricted networking
-                        if (getuid() != 0) {
-                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
-                                exit(1);
-                        }
-#endif
-                        // run time restricted networking
-                        if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) {
-                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
-                                exit(1);
-                        }
                         if (checkcfg(CFG_NETWORK)) {
                                 arg_netfilter = 1;
                         }
@@ -2092,18 +2067,6 @@ int main(int argc, char **argv) {
                 }
 
                 else if (strncmp(argv[i], "--netfilter=", 12) == 0) {
-#ifdef HAVE_NETWORK_RESTRICTED
-                        // compile time restricted networking
-                        if (getuid() != 0) {
-                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
-                                exit(1);
-                        }
-#endif
-                        // run time restricted networking
-                        if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) {
-                                fprintf(stderr, "Error: --netfilter is only allowed for root\n");
-                                exit(1);
-                        }
                         if (checkcfg(CFG_NETWORK)) {
                                 arg_netfilter = 1;
                                 arg_netfilter_file = argv[i] + 12;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 425f8f5c9..4b2fb3abd 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -307,39 +307,20 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         else if (strcmp(ptr, "net none") == 0) {
-#ifdef HAVE_NETWORK
-                if (checkcfg(CFG_NETWORK)) {
-                        arg_nonetwork  = 1;
-                        cfg.bridge0.configured = 0;
-                        cfg.bridge1.configured = 0;
-                        cfg.bridge2.configured = 0;
-                        cfg.bridge3.configured = 0;
-                        cfg.interface0.configured = 0;
-                        cfg.interface1.configured = 0;
-                        cfg.interface2.configured = 0;
-                        cfg.interface3.configured = 0;
-                }
-                else
-                        warning_feature_disabled("networking");
-#endif
+                arg_nonetwork  = 1;
+                cfg.bridge0.configured = 0;
+                cfg.bridge1.configured = 0;
+                cfg.bridge2.configured = 0;
+                cfg.bridge3.configured = 0;
+                cfg.interface0.configured = 0;
+                cfg.interface1.configured = 0;
+                cfg.interface2.configured = 0;
+                cfg.interface3.configured = 0;
                 return 0;
         }
         else if (strncmp(ptr, "net ", 4) == 0) {
 #ifdef HAVE_NETWORK
                 if (checkcfg(CFG_NETWORK)) {
-#ifdef HAVE_NETWORK_RESTRICTED
-                        // compile time restricted networking
-                        if (getuid() != 0) {
-                                fprintf(stderr, "Error: only \"net none\" is allowed to non-root users\n");
-                                exit(1);
-                        }
-#endif
-                        // run time restricted networking
-                        if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) {
-                                fprintf(stderr, "Error: only \"net none\" is allowed to non-root users\n");
-                                exit(1);
-                        }
-
                         if (strcmp(ptr + 4, "lo") == 0) {
                                 fprintf(stderr, "Error: cannot attach to lo device\n");
                                 exit(1);