5 files changed, 56 insertions, 26 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index f37605e20..a131d9e91 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -460,8 +460,9 @@ int sandbox(void* sandbox_arg) {
 #ifdef HAVE_CHROOT              
         if (cfg.chrootdir) {
                 fs_chroot(cfg.chrootdir);
-                // redo cp command
-                fs_build_cp_command();
+
+//              // redo cp command
+//              fs_build_cp_command();
                 
                 // force caps and seccomp if not started as root
                 if (getuid() != 0) {
@@ -482,7 +483,7 @@ int sandbox(void* sandbox_arg) {
                         
                         // disable all capabilities
                         if (arg_caps_default_filter || arg_caps_list)
-                                fprintf(stderr, "Warning: all capabilities disabled for a regular user during chroot\n");
+                                fprintf(stderr, "Warning: all capabilities disabled for a regular user in chroot\n");
                         arg_caps_drop_all = 1;
                         
                         // drop all supplementary groups; /etc/group file inside chroot
@@ -530,13 +531,21 @@ int sandbox(void* sandbox_arg) {
         if (arg_private_dev)
                 fs_private_dev();
         if (arg_private_etc) {
-                fs_private_etc_list();
-                // create /etc/ld.so.preload file again
-                if (arg_trace || arg_tracelog)
-                        fs_trace_preload();
+                if (cfg.chrootdir)
+                        fprintf(stderr, "Warning: private-etc feature is disabled in chroot\n");
+                else {
+                        fs_private_etc_list();
+                        // create /etc/ld.so.preload file again
+                        if (arg_trace || arg_tracelog)
+                                fs_trace_preload();
+                }
+        }
+        if (arg_private_bin) {
+                if (cfg.chrootdir)
+                        fprintf(stderr, "Warning: private-bin feature is disabled in chroot\n");
+                else
+                        fs_private_bin_list();
         }
-        if (arg_private_bin)
-                fs_private_bin_list();
         if (arg_private_tmp)
                 fs_private_tmp();
         
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index efe24a211..88620d1dd 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -101,10 +101,22 @@ static void filter_init(void) {
         sfilter_alloc_size = SECSIZE;
         
         // copy the start entries
+#if defined(__x86_64__)
+#define X32_SYSCALL_BIT 0x40000000
+        struct sock_filter filter[] = {
+                VALIDATE_ARCHITECTURE,
+                EXAMINE_SYSCALL,
+                // handle X32 ABI
+                BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, X32_SYSCALL_BIT, 1, 0),
+                BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, 0, 1, 0),
+                RETURN_ERRNO(EPERM)
+        };
+#else
         struct sock_filter filter[] = {
                 VALIDATE_ARCHITECTURE,
                 EXAMINE_SYSCALL
         };
+#endif
         sfilter_index = sizeof(filter) / sizeof(struct sock_filter);    
         memcpy(sfilter, filter, sizeof(filter));
 }
diff --git a/test/features/1.2.exp b/test/features/1.2.exp
index 685acf737..bcb227304 100755
--- a/test/features/1.2.exp
+++ b/test/features/1.2.exp
@@ -115,22 +115,22 @@ if { $chroot == "chroot" } {
                 timeout {puts "TESTING ERROR 5.3\n";exit}
                 "proc /proc/sys proc"
         }
-        expect {
-                timeout {puts "TESTING ERROR 5.4\n";exit}
-                "proc /proc/sysrq-trigger proc"
-        }
+#       expect {
+#               timeout {puts "TESTING ERROR 5.4\n";exit}
+#               "proc /proc/sysrq-trigger proc"
+#       }
 #       expect {
 #               timeout {puts "TESTING ERROR 5.5\n";exit}
 #               "proc /proc/sys/kernel/hotplug"
 #       }
-        expect {
-                timeout {puts "TESTING ERROR 5.6\n";exit}
-                "proc /proc/irq proc"
-        }
-        expect {
-                timeout {puts "TESTING ERROR 5.7\n";exit}
-                "proc /proc/bus proc"
-        }
+#       expect {
+#               timeout {puts "TESTING ERROR 5.6\n";exit}
+#               "proc /proc/irq proc"
+#       }
+#       expect {
+#               timeout {puts "TESTING ERROR 5.7\n";exit}
+#               "proc /proc/bus proc"
+#       }
         after 100
         send -- "exit\r"
         sleep 1
diff --git a/test/features/3.6.exp b/test/features/3.6.exp
index a00517716..389e63a1d 100755
--- a/test/features/3.6.exp
+++ b/test/features/3.6.exp
@@ -60,14 +60,19 @@ if { $chroot == "chroot" } {
         expect {
                 timeout {puts "TESTING ERROR 4\n";exit}
                 "chroot option is not available" {puts "grsecurity\n"; exit}
+                "private-etc feature is disabled in chroot"
+        }
+        expect {
+                timeout {puts "TESTING ERROR 5\n";exit}
+                "chroot option is not available" {puts "grsecurity\n"; exit}
                 "Child process initialized"
         }
         sleep 1
         
-        send -- "ls -al /etc | wc -l\r"
+        send -- "ls /etc | grep firejail\r"
         expect {
-                timeout {puts "TESTING ERROR 5.1\n";exit}
-                "10"
+                timeout {puts "TESTING ERROR 6\n";exit}
+                "firejail"
         }
         
         after 100
diff --git a/test/features/3.8.exp b/test/features/3.8.exp
index 94a1abf67..d941fa9b7 100755
--- a/test/features/3.8.exp
+++ b/test/features/3.8.exp
@@ -61,14 +61,18 @@ if { $chroot == "chroot" } {
         send -- "firejail --noprofile --chroot=/tmp/chroot --private-bin=bash,cat,cp,ls,wc\r"
         expect {
                 timeout {puts "TESTING ERROR 4\n";exit}
+                "private-bin feature is disabled in chroot"
+        }
+        expect {
+                timeout {puts "TESTING ERROR 5\n";exit}
                 "Child process initialized"
         }
         sleep 1
         
         send -- "ls -l /usr/bin | wc -l\r"
         expect {
-                timeout {puts "TESTING ERROR 5.1\n";exit}
-                "6"
+                timeout {puts "TESTING ERROR 6\n";exit}
+                "9"
         }
         
         after 100