3 files changed, 31 insertions, 0 deletions

diff --git a/Makefile.in b/Makefile.in
index ebf9d40e8..e9df6264d 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -21,6 +21,7 @@ HAVE_APPARMOR=@HAVE_APPARMOR@
 HAVE_CONTRIB_INSTALL=@HAVE_CONTRIB_INSTALL@
 HAVE_GIT_INSTALL=@HAVE_GIT_INSTALL@
 BUSYBOX_WORKAROUND=@BUSYBOX_WORKAROUND@
+HAVE_SUID=@HAVE_SUID@
 
 uids.h:; ./mkuid.sh
 
@@ -81,7 +82,9 @@ realinstall:
         # firejail executable
         install -m 0755 -d $(DESTDIR)/$(bindir)
         install -c -m 0755 src/firejail/firejail $(DESTDIR)/$(bindir)/.
+ifeq ($(HAVE_SUID),yes)
         chmod u+s $(DESTDIR)/$(bindir)/firejail
+endif
         # firemon executable
         install -c -m 0755 src/firemon/firemon $(DESTDIR)/$(bindir)/.
         # firecfg executable
diff --git a/configure b/configure
index 5addefc72..eebdddb32 100755
--- a/configure
+++ b/configure
@@ -630,6 +630,7 @@ HAVE_GIT_INSTALL
 HAVE_GCOV
 BUSYBOX_WORKAROUND
 HAVE_FATAL_WARNINGS
+HAVE_SUID
 HAVE_WHITELIST
 HAVE_FILE_TRANSFER
 HAVE_X11
@@ -712,6 +713,7 @@ enable_userns
 enable_x11
 enable_file_transfer
 enable_whitelist
+enable_suid
 enable_fatal_warnings
 enable_busybox_workaround
 enable_gcov
@@ -1362,6 +1364,7 @@ Optional Features:
   --disable-x11           disable X11 sandboxing support
   --disable-file-transfer disable file transfer
   --disable-whitelist     disable whitelist
+  --disable-suid          install as a non-SUID executable
   --enable-fatal-warnings -W -Wall -Werror
   --enable-busybox-workaround
                           enable busybox workaround
@@ -3729,6 +3732,20 @@ if test "x$enable_whitelist" != "xno"; then :
 
 fi
 
+HAVE_SUID=""
+# Check whether --enable-suid was given.
+if test "${enable_suid+set}" = set; then :
+  enableval=$enable_suid;
+fi
+
+if test "x$enable_suid" = "xno"; then :
+  HAVE_SUID="no"
+else
+  HAVE_SUID="yes"
+
+fi
+
+
 HAVE_FATAL_WARNINGS=""
 # Check whether --enable-fatal_warnings was given.
 if test "${enable_fatal_warnings+set}" = set; then :
@@ -5071,4 +5088,5 @@ echo "   EXTRA_CFLAGS: $EXTRA_CFLAGS"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo "   Gcov instrumentation: $HAVE_GCOV"
 echo "   Install contrib scripts: $HAVE_CONTRIB_INSTALL"
+echo "   Install as a SUID executable: $HAVE_SUID"
 echo
diff --git a/configure.ac b/configure.ac
index 460c93d50..7495ac4c4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -144,6 +144,15 @@ AS_IF([test "x$enable_whitelist" != "xno"], [
         AC_SUBST(HAVE_WHITELIST)
 ])
 
+HAVE_SUID=""
+AC_ARG_ENABLE([suid],
+    AS_HELP_STRING([--disable-suid], [install as a non-SUID executable]))
+AS_IF([test "x$enable_suid" = "xno"],
+        [HAVE_SUID="no"],
+        [HAVE_SUID="yes"]
+)
+AC_SUBST(HAVE_SUID)
+
 HAVE_FATAL_WARNINGS=""
 AC_ARG_ENABLE([fatal_warnings],
     AS_HELP_STRING([--enable-fatal-warnings], [-W -Wall -Werror]))
@@ -228,4 +237,5 @@ echo "   EXTRA_CFLAGS: $EXTRA_CFLAGS"
 echo "   fatal warnings: $HAVE_FATAL_WARNINGS"
 echo "   Gcov instrumentation: $HAVE_GCOV"
 echo "   Install contrib scripts: $HAVE_CONTRIB_INSTALL"
+echo "   Install as a SUID executable: $HAVE_SUID"
 echo