don't allow --chroot as user without seccomp support

3 files changed, 12 insertions, 4 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 2f40b4d86..2a7ff4104 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -387,7 +387,7 @@ void fs_check_private_dir(void);
 
 
 // seccomp.c
-int seccomp_filter_drop(void);
+int seccomp_filter_drop(int enforce_seccomp);
 int seccomp_filter_keep(void);
 void seccomp_set(void);
 void seccomp_print_filter_name(const char *name);
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 02ff7737f..a7308dda6 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -349,6 +349,7 @@ int sandbox(void* sandbox_arg) {
         //****************************
         // configure filesystem
         //****************************
+        int enforce_seccomp = 0;
 #ifdef HAVE_CHROOT              
         if (cfg.chrootdir) {
                 fs_chroot(cfg.chrootdir);
@@ -360,6 +361,7 @@ int sandbox(void* sandbox_arg) {
                         // force default seccomp inside the chroot, no keep or drop list
                         // the list build on top of the default drop list is kept intact
                         arg_seccomp = 1;
+                        enforce_seccomp = 1;
                         if (cfg.seccomp_list_drop) {
                                 free(cfg.seccomp_list_drop);
                                 cfg.seccomp_list_drop = NULL;
@@ -603,7 +605,7 @@ int sandbox(void* sandbox_arg) {
                 else if (cfg.seccomp_list_errno)
                         seccomp_filter_errno(); 
                 else
-                        seccomp_filter_drop();
+                        seccomp_filter_drop(enforce_seccomp);
         }
 #endif
 
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 396ab99db..c97741a86 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -390,7 +390,7 @@ void seccomp_filter_32(void) {
 }
 
 // drop filter for seccomp option
-int seccomp_filter_drop(void) {
+int seccomp_filter_drop(int enforce_seccomp) {
         filter_init();
         
         // default seccomp
@@ -595,7 +595,13 @@ int seccomp_filter_drop(void) {
         };
 
         if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) || prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {
-                fprintf(stderr, "Warning: seccomp disabled, it requires a Linux kernel version 3.5 or newer.\n");
+                if (enforce_seccomp) {
+                        fprintf(stderr, "Error: a seccomp-enabled Linux kernel is required, exiting...\n");
+                        exit(1);
+                }
+                else
+                        fprintf(stderr, "Warning: seccomp disabled, it requires a Linux kernel version 3.5 or newer.\n");
+
                 return 1;
         }