2 files changed, 5 insertions, 55 deletions

diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 7ff7e3c59..5774ebf6a 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1010,24 +1010,13 @@ void fs_chroot(const char *rootdir) {
                 create_empty_dir_as_root(rundir, 0755);
                 free(rundir);
                 
-                // create /run/firejail/mnt directory in chroot and mount a tmpfs
-                if (asprintf(&rundir, "%s/run/firejail/mnt", rootdir) == -1)
+                // create /run/firejail/mnt directory in chroot and mount the current one
+                if (asprintf(&rundir, "%s%s", rootdir, RUN_MNT_DIR) == -1)
                         errExit("asprintf");
                 create_empty_dir_as_root(rundir, 0755);
-                if (mount("tmpfs", rundir, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
-                        errExit("mounting /run/firejail/mnt");
-                fs_logger2("tmpfs", RUN_MNT_DIR);
-                free(rundir);
+                if (mount(RUN_MNT_DIR, rundir, NULL, MS_BIND|MS_REC, NULL) < 0)
+                        errExit("mount bind");
 
-                // retrieve seccomp.protocol
-                struct stat s;
-                if (stat(RUN_SECCOMP_PROTOCOL, &s) == 0) {
-                        if (asprintf(&rundir, "%s%s", rootdir, RUN_SECCOMP_PROTOCOL) == -1)
-                                errExit("asprintf");
-                        copy_file(RUN_SECCOMP_PROTOCOL, rundir, getuid(), getgid(), 0644);
-                        free(rundir);
-                }
-                
                 // copy /etc/resolv.conf in chroot directory
                 // if resolv.conf in chroot is a symbolic link, this will fail
                 // no exit on error, let the user deal with the problem
@@ -1053,9 +1042,6 @@ void fs_chroot(const char *rootdir) {
         if (chroot(rootdir) < 0)
                 errExit("chroot");
 
-        // create all other /run/firejail files and directories
-        preproc_build_firejail_dir();
-                
         if (checkcfg(CFG_CHROOT_DESKTOP)) {
                 // update /var directory in order to support multiple sandboxes running on the same root directory
 //              if (!arg_private_dev)
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 30c63d734..4678f366b 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -94,16 +94,6 @@ int seccomp_load(const char *fname) {
 
 // i386 filter installed on amd64 architectures
 void seccomp_filter_32(void) {
-#if 0
-        if (arg_debug)
-                printf("Build secondary 32-bit filter\n");
-
-        // build the seccomp filter as a regular user
-        int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                PATH_FSECCOMP, "secondary", "32", RUN_SECCOMP_I386);
-        if (rv)
-                exit(rv);
-#endif
         if (seccomp_load(RUN_SECCOMP_I386) == 0) {
                 if (arg_debug)
                         printf("Dual i386/amd64 seccomp filter configured\n");
@@ -112,17 +102,6 @@ void seccomp_filter_32(void) {
 
 // amd64 filter installed on i386 architectures
 void seccomp_filter_64(void) {
-#if 0
-        if (arg_debug)
-                printf("Build secondary 64-bit filter\n");
-
-        // build the seccomp filter as a regular user
-        int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                PATH_FSECCOMP, "secondary", "64", RUN_SECCOMP_AMD64);
-        if (rv)
-                exit(rv);
-#endif
-
         if (seccomp_load(RUN_SECCOMP_AMD64) == 0) {
                 if (arg_debug)
                         printf("Dual i386/amd64 seccomp filter configured\n");
@@ -139,21 +118,6 @@ int seccomp_filter_drop(int enforce_seccomp) {
 #if defined(__i386__)
                 seccomp_filter_64();
 #endif
-
-#if 0
-                if (arg_debug)
-                        printf("Build default seccomp filter\n");
-                // build the seccomp filter as a regular user
-                int rv;
-                if (arg_allow_debuggers)
-                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
-                                PATH_FSECCOMP, "default", RUN_SECCOMP_CFG, "allow-debuggers");
-                else
-                        rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3,
-                                PATH_FSECCOMP, "default", RUN_SECCOMP_CFG);
-                if (rv)
-                        exit(rv);
-#endif
         }
         // default seccomp filter with additional drop list
         else if (cfg.seccomp_list && cfg.seccomp_list_drop == NULL) {
@@ -209,7 +173,7 @@ int seccomp_filter_drop(int enforce_seccomp) {
                 exit(1);
         }
         
-        if (arg_debug)
+        if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0)
                 sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3,
                         PATH_FSECCOMP, "print", RUN_SECCOMP_CFG);