6 files changed, 38 insertions, 89 deletions

diff --git a/RELNOTES b/RELNOTES
index a560c79b9..647377e8b 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,6 +1,6 @@
 firejail (0.9.53) baseline; urgency=low
   * work in progress
-  * add --noautopulse to disable automatic ~/.config/pulse (for complex setups)
+  * --force depercated
   * modif: support for private-bin, private-lib and shell none has been
      disabled while running AppImage archives in order to be able to use
      our regular profile files with AppImages.
@@ -10,6 +10,7 @@ firejail (0.9.53) baseline; urgency=low
      All users of Firefox-based browsers who use addons and plugins
      that read/write from ${HOME} will need to uncomment the includes for
      firefox-common-addons.inc in firefox-common.profile.
+  * add --noautopulse to disable automatic ~/.config/pulse (for complex setups)
   * Spectre mitigation patch for gcc and clang compiler
   * D-Bus handling (--nodbus)
   * AppArmor support for overlayfs and chroot sandboxes
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 25b52f5ce..29cca0761 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -707,8 +707,6 @@ void fs_basic_fs(void) {
         restrict_users();
 
         // when starting as root, firejail config is not disabled;
-        // this mode could be used to install and test new software by chaining
-        // firejail sandboxes (firejail --force)
         if (uid)
                 disable_config();
 }
@@ -1020,8 +1018,6 @@ void fs_overlayfs(void) {
         restrict_users();
 
         // when starting as root, firejail config is not disabled;
-        // this mode could be used to install and test new software by chaining
-        // firejail sandboxes (firejail --force)
         if (getuid() != 0)
                 disable_config();
 
@@ -1265,8 +1261,6 @@ void fs_chroot(const char *rootdir) {
                 restrict_users();
 
                 // when starting as root, firejail config is not disabled;
-                // this mode could be used to install and test new software by chaining
-                // firejail sandboxes (firejail --force)
                 if (getuid() != 0)
                         disable_config();
         }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 52f6af667..0d53a24a8 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -829,18 +829,24 @@ int main(int argc, char **argv) {
         int lockfd_network = -1;
         int lockfd_directory = -1;
         int option_cgroup = 0;
-        int option_force = 0;
         int custom_profile = 0; // custom profile loaded
-
         atexit(clear_atexit);
 
-        // get starting timestamp
-        start_timestamp = getticks();
+        // drop permissions by default and rise them when required
+        EUID_INIT();
+        EUID_USER();
+
+        // check if the user is allowed to use firejail
+        init_cfg(argc, argv);
 
+        // get starting timestamp, process --quiet
+        start_timestamp = getticks();
         if (check_arg(argc, argv, "--quiet", 1))
                 arg_quiet = 1;
 
+
         // build /run/firejail directory structure
+        EUID_ROOT();
         preproc_build_firejail_dir();
         char *container_name = getenv("container");
         if (!container_name || strcmp(container_name, "firejail")) {
@@ -854,7 +860,10 @@ int main(int argc, char **argv) {
                 flock(lockfd_directory, LOCK_UN);
                 close(lockfd_directory);
         }
+        EUID_USER();
+
 
+        // process allow-debuggers
         if (check_arg(argc, argv, "--allow-debuggers", 1)) {
                 // check kernel version
                 struct utsname u;
@@ -875,11 +884,12 @@ int main(int argc, char **argv) {
                 }
 
                 arg_allow_debuggers = 1;
+                char *cmd = strdup("noblacklist ${PATH}/strace");
+                if (!cmd)
+                        errExit("strdup");
+                profile_add(cmd);
         }
 
-        // drop permissions by default and rise them when required
-        EUID_INIT();
-        EUID_USER();
 
 #ifdef HAVE_GIT_INSTALL
         // process git-install and git-uninstall
@@ -900,51 +910,29 @@ int main(int argc, char **argv) {
         // check if we already have a sandbox running
         // If LXC is detected, start firejail sandbox
         // otherwise try to detect a PID namespace by looking under /proc for specific kernel processes and:
-        //      - if --force flag is set, start firejail sandbox
-        //      -- if --force flag is not set, start the application in a /bin/bash shell
+        //      - start the application in a /bin/bash shell
         if (check_namespace_virt() == 0) {
                 EUID_ROOT();
                 int rv = check_kernel_procs();
                 EUID_USER();
                 if (rv == 0) {
-                        // if --force option is passed to the program, disregard the existing sandbox
-                        if (check_arg(argc, argv, "--force", 1))
-                                option_force = 1;
-                        else {
-                                if (check_arg(argc, argv, "--version", 1)) {
-                                        printf("firejail version %s\n", VERSION);
-                                        exit(0);
-                                }
-
-                                // start the program directly without sandboxing
-                                run_no_sandbox(argc, argv);
-                                // it will never get here!
-                                assert(0);
+                        if (check_arg(argc, argv, "--version", 1)) {
+                                printf("firejail version %s\n", VERSION);
+                                exit(0);
                         }
-                }
-        }
 
-        // check root/suid
-        EUID_ROOT();
-        if (geteuid()) {
-                // only --version is supported without SUID support
-                if (check_arg(argc, argv, "--version", 1)) {
-                        printf("firejail version %s\n", VERSION);
-                        exit(0);
+                        // start the program directly without sandboxing
+                        run_no_sandbox(argc, argv);
+                        // it will never get here!
+                        assert(0);
                 }
-
-                fprintf(stderr, "Error: cannot rise privileges\n");
-                exit(1);
         }
-        EUID_USER();
+        EUID_ASSERT();
 
-        // initialize globals
-        init_cfg(argc, argv);
 
         // check firejail directories
         EUID_ROOT();
         delete_run_files(sandbox_pid);
-
         EUID_USER();
 
         //check if the parent is sshd daemon
@@ -998,6 +986,7 @@ int main(int argc, char **argv) {
                         free(comm);
                 }
         }
+        EUID_ASSERT();
 
         // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users
         if (*argv[0] == '-' || parent_sshd) {
@@ -1047,30 +1036,19 @@ int main(int argc, char **argv) {
                 // check --output option and execute it;
                 check_output(argc, argv); // the function will not return if --output or --output-stderr option was found
         }
+        EUID_ASSERT();
 
 
         // check for force-nonewprivs in /etc/firejail/firejail.config file
         if (checkcfg(CFG_FORCE_NONEWPRIVS))
                 arg_nonewprivs = 1;
 
-        if (arg_allow_debuggers) {
-                char *cmd = strdup("noblacklist ${PATH}/strace");
-                if (!cmd)
-                        errExit("strdup");
-                profile_add(cmd);
-        }
-
         // parse arguments
         for (i = 1; i < argc; i++) {
                 run_cmd_and_exit(i, argc, argv); // will exit if the command is recognized
 
-                if (strcmp(argv[i], "--debug") == 0) {
-                        if (!arg_quiet) {
-                                arg_debug = 1;
-                                if (option_force)
-                                        fmessage("Entering sandbox-in-sandbox mode\n");
-                        }
-                }
+                if (strcmp(argv[i], "--debug") == 0 && !arg_quiet)
+                        arg_debug = 1;
                 else if (strcmp(argv[i], "--debug-check-filename") == 0)
                         arg_debug_check_filename = 1;
                 else if (strcmp(argv[i], "--debug-blacklists") == 0)
@@ -1083,8 +1061,6 @@ int main(int argc, char **argv) {
                         arg_quiet = 1;
                         arg_debug = 0;
                 }
-                else if (strcmp(argv[i], "--force") == 0)
-                        ;
                 else if (strcmp(argv[i], "--allow-debuggers") == 0) {
                         // already handled
                 }
@@ -2273,6 +2249,7 @@ int main(int argc, char **argv) {
                         break;
                 }
         }
+        EUID_ASSERT();
 
         // prog_index could still be -1 if no program was specified
         if (prog_index == -1 && arg_shell_none) {
@@ -2401,6 +2378,7 @@ int main(int argc, char **argv) {
                                 fmessage("\n** Note: you can use --noprofile to disable %s.profile **\n\n", profile_name);
                 }
         }
+        EUID_ASSERT();
 
         // block X11 sockets
         if (arg_x11_block)
@@ -2428,6 +2406,7 @@ int main(int argc, char **argv) {
                 network_set_run_file(sandbox_pid);
                 EUID_USER();
         }
+        EUID_ASSERT();
 
         // create the parent-child communication pipe
         if (pipe(parent_to_child_fds) < 0)
@@ -2479,6 +2458,7 @@ int main(int argc, char **argv) {
         else if (arg_debug)
                 printf("Using the local network stack\n");
 
+        EUID_ASSERT();
         EUID_ROOT();
         child = clone(sandbox,
                 child_stack + STACK_SIZE,
@@ -2519,6 +2499,7 @@ int main(int argc, char **argv) {
                 waitpid(net_child, NULL, 0);
                 EUID_USER();
         }
+        EUID_ASSERT();
 
         // close each end of the unused pipes
         close(parent_to_child_fds[0]);
@@ -2594,6 +2575,7 @@ int main(int argc, char **argv) {
                 EUID_USER();
                 free(map_path);
         }
+        EUID_ASSERT();
 
         // notify child that UID/GID mapping is complete
         notify_other(parent_to_child_fds[1]);
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 1c878c818..542747efc 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -76,7 +76,6 @@ static char *usage_str =
         "    --dns=address - set DNS server.\n"
         "    --dns.print=name|pid - print DNS configuration.\n"
         "    --env=name=value - set environment variable.\n"
-        "    --force - attempt to start a new sandbox inside the existing sandbox.\n"
         "    --fs.print=name|pid - print the filesystem log.\n"
         "    --get=name|pid filename - get a file from sandbox container.\n"
 #ifdef HAVE_GIT_INSTALL
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index f481f5c46..85550e576 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -468,13 +468,6 @@ Example:
 $ firejail \-\-env=LD_LIBRARY_PATH=/opt/test/lib
 
 .TP
-\fB\-\-force
-By default, if Firejail is started in an existing sandbox, it will run the program in a bash shell.
-This option disables this behavior, and attempts to start Firejail in the existing sandbox.
-There could be lots of reasons for it to fail, for example if the existing sandbox disables
-admin capabilities, SUID binaries, or if it runs seccomp.
-
-.TP
 \fB\-\-fs.print=name|print
 Print the filesystem log for the sandbox identified by name or by PID.
 .br
diff --git a/test/environment/firejail-in-firejail.exp b/test/environment/firejail-in-firejail.exp
index 6f8f4316f..29f82007b 100755
--- a/test/environment/firejail-in-firejail.exp
+++ b/test/environment/firejail-in-firejail.exp
@@ -24,26 +24,6 @@ after 100
 send --  "exit\r"
 after 100
 
-send --  "firejail --force\r"
-expect {
-        timeout {puts "TESTING ERROR 3\n";exit}
-        "cannot rise privileges"
-}
-after 100
-
-send --  "firejail --version\r"
-expect {
-        timeout {puts "TESTING ERROR 4\n";exit}
-        "firejail version"
-}
-after 100
-
-send --  "firejail --version --force\r"
-expect {
-        timeout {puts "TESTING ERROR 5\n";exit}
-        "firejail version"
-}
-after 100
 
 
 puts "\nall done\n"