cfg userns

4 files changed, 22 insertions, 3 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 68dc6ac58..670fdc502 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -86,6 +86,15 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // bind
+                        else if (strncmp(ptr, "userns ", 7) == 0) {
+                                if (strcmp(ptr + 7, "yes") == 0)
+                                        cfg_val[CFG_USERNS] = 1;
+                                else if (strcmp(ptr + 7, "no") == 0)
+                                        cfg_val[CFG_USERNS] = 0;
+                                else
+                                        goto errout;
+                        }
                         else
                                 goto errout;
                         free(ptr);
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index ff6eb485b..ed9343345 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -541,7 +541,8 @@ void sandboxfs(int op, pid_t pid, const char *patqh);
 #define CFG_FILE_TRANSFER 0
 #define CFG_X11 1
 #define CFG_BIND 2
-#define CFG_MAX 3 // this should always be the last entry
+#define CFG_USERNS 3
+#define CFG_MAX 4 // this should always be the last entry
 int checkcfg(int val);
 
 #endif
diff --git a/src/firejail/main.c b/src/firejail/main.c
index d1d0f91a6..df625a7ba 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1155,7 +1155,12 @@ int main(int argc, char **argv) {
                         arg_nogroups = 1;
 #ifdef HAVE_USERNS
                 else if (strcmp(argv[i], "--noroot") == 0) {
-                        check_user_namespace();
+                        if (checkcfg(CFG_USERNS))
+                                check_user_namespace();
+                        else {
+                                fprintf(stderr, "Error: --noroot feature is disabled in Firejail configuration file\n");
+                                exit(1);
+                        }
                 }
 #endif
                 else if (strncmp(argv[i], "--env=", 6) == 0)
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 36741ad4a..1c843a460 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -123,8 +123,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         // seccomp, caps, private, user namespace
         else if (strcmp(ptr, "noroot") == 0) {
 #if HAVE_USERNS
-                check_user_namespace();
+                if (checkcfg(CFG_USERNS))
+                        check_user_namespace();
+                else
+                        fprintf(stderr, "Warning: user namespace feature is disabled in Firejail configuration file\n");
 #endif
+
                 return 0;
         }
         else if (strcmp(ptr, "seccomp") == 0) {