2 files changed, 8 insertions, 13 deletions

diff --git a/RELNOTES b/RELNOTES
index ec25f3bb3..a6a24636a 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,5 +1,7 @@
 firejail (0.9.65) baseline; urgency=low
-  * allow --tmpfs and --bind inside $HOME for unprivileged users
+  * allow --tmpfs inside $HOME for unprivileged users
+  *  --disable-usertmpfs  compile time option
+ -- netblue30 <netblue30@yahoo.com>  Wed, 21 Oct 2020 08:00:00 -0500
 
 firejail (0.9.64) baseline; urgency=low
   * replaced --nowrap option with --wrap in firemon
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 4942f99ff..11a74ddd3 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1415,6 +1415,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         if (strncmp(ptr, "bind ", 5) == 0) {
                 if (checkcfg(CFG_BIND)) {
                         // extract two directories
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: --bind option is available only if running as root\n");
+                                exit(1);
+                        }
+
                         char *dname1 = ptr + 5;
                         char *dname2 = split_comma(dname1); // this inserts a '0 to separate the two dierctories
                         if (dname2 == NULL) {
@@ -1429,18 +1434,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                                 fprintf(stderr, "Error: invalid file name.\n");
                                 exit(1);
                         }
-                        if (getuid() != 0) {
-                                char *resolved_path1 = realpath(dname1, NULL);
-                                char *resolved_path2 = realpath(dname2, NULL);
-                                assert(resolved_path1 && resolved_path2);
-                                        if (strncmp(cfg.homedir, resolved_path1, strlen(cfg.homedir)) != 0
-                                        || strncmp(cfg.homedir, resolved_path2, strlen(cfg.homedir)) != 0) {
-                                                fprintf(stderr, "Error: bind outside $HOME is only available for root\n");
-                                                exit(1);
-                                        }
-                                free(resolved_path1);
-                                free(resolved_path2);
-                        }
                         if (is_link(dname1) || is_link(dname2)) {
                                 fprintf(stderr, "Symbolic links are not allowed for bind command\n");
                                 exit(1);