5 files changed, 56 insertions, 21 deletions

diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 96957eeaf..b2837b443 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -315,6 +315,7 @@ blacklist ${HOME}/.config/keybase
 blacklist ${HOME}/.davfs2/secrets
 blacklist ${HOME}/.ecryptfs
 blacklist ${HOME}/.fetchmailrc
+blacklist ${HOME}/.fscrypt
 blacklist ${HOME}/.git-credential-cache
 blacklist ${HOME}/.git-credentials
 blacklist ${HOME}/.gnome2/keyrings
@@ -335,6 +336,7 @@ blacklist ${HOME}/.local/share/pki
 blacklist ${HOME}/.smbcredentials
 blacklist ${HOME}/.ssh
 blacklist ${HOME}/.vaults
+blacklist /.fscrypt
 blacklist /etc/davfs2/secrets
 blacklist /etc/group+
 blacklist /etc/group-
@@ -348,6 +350,7 @@ blacklist /etc/shadow+
 blacklist /etc/shadow-
 blacklist /etc/ssh
 blacklist /home/.ecryptfs
+blacklist /home/.fscrypt
 blacklist /var/backup
 
 # cloud provider configuration
diff --git a/etc/firejail-default b/etc/firejail-default
index e7831e145..56fce654c 100644
--- a/etc/firejail-default
+++ b/etc/firejail-default
@@ -97,6 +97,9 @@ deny /proc/@{PID}/oom_score_adj w,
 # Common backup directory
 deny /**/.snapshots/ rwx,
 
+# fscrypt
+deny /**/.fscrypt/ rwx,
+
 ##########
 # Allow all networking functionality, and control it from Firejail.
 ##########
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 3df551d4c..3e802efb5 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1191,15 +1191,15 @@ void fs_private_cache(void) {
         // check if ~/.cache is a valid destination
         struct stat s;
         if (lstat(cache, &s) == -1) {
-                fwarning("cannot find %s, tmpfs not mounted\n", cache);
+                fwarning("skipping private-cache: cannot find %s\n", cache);
                 free(cache);
                 return;
         }
         if (!S_ISDIR(s.st_mode)) {
                 if (S_ISLNK(s.st_mode))
-                        fwarning("%s is a symbolic link, tmpfs not mounted\n", cache);
+                        fwarning("skipping private-cache: %s is a symbolic link\n", cache);
                 else
-                        fwarning("%s is not a directory; cannot mount a tmpfs on top of it\n", cache);
+                        fwarning("skipping private-cache: %s is not a directory\n", cache);
                 free(cache);
                 return;
         }
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 25c167af1..2e8a8ad96 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -250,6 +250,9 @@ void fs_private_homedir(void) {
         int xflag = store_xauthority();
         int aflag = store_asoundrc();
 
+        // home directory outside /home?
+        int oflag = (strncmp(homedir, "/home/", 6) != 0);
+
         uid_t u = getuid();
         gid_t g = getgid();
 
@@ -259,20 +262,33 @@ void fs_private_homedir(void) {
         // get file descriptors for homedir and private_homedir, fails if there is any symlink
         int src = safe_fd(private_homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (src == -1)
-                errExit("safe_fd");
+                errExit("opening private directory");
         int dst = safe_fd(homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (dst == -1)
-                errExit("safe_fd");
-        // check if new home directory is owned by the user
-        struct stat s;
-        if (fstat(src, &s) == -1)
-                errExit("fstat");
-        if (s.st_uid != getuid()) {
-                fprintf(stderr, "Error: private directory is not owned by the current user\n");
-                exit(1);
+                errExit("opening home directory");
+        if (u != 0) {
+                struct stat s;
+                // sometimes system users are assigned home directories like /, /proc, ...
+                // require that a home directory outside /home is owned by the user
+                if (oflag) {
+                        if (fstat(dst, &s) == -1)
+                                errExit("fstat");
+                        if (s.st_uid != u) {
+                                fprintf(stderr, "Error: cannot mount private directory:\n"
+                                        "Home directory is not owned by the current user\n");
+                                exit(1);
+                        }
+                }
+                // check if new home directory is owned by the user
+                if (fstat(src, &s) == -1)
+                        errExit("fstat");
+                if (s.st_uid != u) {
+                        fprintf(stderr, "Error: private directory is not owned by the current user\n");
+                        exit(1);
+                }
+                if ((S_IRWXU & s.st_mode) != S_IRWXU)
+                        fwarning("no full permissions on private directory\n");
         }
-        if ((S_IRWXU & s.st_mode) != S_IRWXU)
-                fwarning("no full permissions on private directory\n");
         // mount via the links in /proc/self/fd
         char *proc_src, *proc_dst;
         if (asprintf(&proc_src, "/proc/self/fd/%d", src) == -1)
@@ -308,7 +324,7 @@ void fs_private_homedir(void) {
                         errExit("mounting home directory");
                 fs_logger("tmpfs /root");
         }
-        if (u == 0 || strncmp(homedir, "/home/", 6) != 0) {
+        if (oflag) {
                 // mask /home
                 if (arg_debug)
                         printf("Mounting a new /home directory\n");
@@ -317,7 +333,6 @@ void fs_private_homedir(void) {
                 fs_logger("tmpfs /home");
         }
 
-
         skel(homedir, u, g);
         if (xflag)
                 copy_xauthority();
@@ -377,6 +392,7 @@ void fs_private(void) {
                 }
                 else
                         // user directory is outside /home, mask it as well
+                        // check if directory is owned by the current user
                         fs_tmpfs(homedir, 1);
         }
 
@@ -385,7 +401,6 @@ void fs_private(void) {
                 copy_xauthority();
         if (aflag)
                 copy_asoundrc();
-
 }
 
 // check new private home directory (--private= option) - exit if it fails
@@ -531,6 +546,9 @@ void fs_private_home_list(void) {
         int xflag = store_xauthority();
         int aflag = store_asoundrc();
 
+        // home directory outside /home?
+        int oflag = (strncmp(homedir, "/home/", 6) != 0);
+
         uid_t uid = getuid();
         gid_t gid = getgid();
 
@@ -563,7 +581,19 @@ void fs_private_home_list(void) {
 
         int fd = safe_fd(homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
-                errExit("safe_fd");
+                errExit("opening home directory");
+        if (uid != 0 && oflag) {
+                // home directory outside /home should be owned by the user
+                struct stat s;
+                if (fstat(fd, &s) == -1)
+                        errExit("fstat");
+                if (s.st_uid != uid) {
+                        fprintf(stderr, "Error: cannot mount private directory:\n"
+                                "Home directory is not owned by the current user\n");
+                        exit(1);
+                }
+        }
+        // mount using the file descriptor
         char *proc;
         if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
                 errExit("asprintf");
@@ -584,7 +614,7 @@ void fs_private_home_list(void) {
                 if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=700,gid=0") < 0)
                         errExit("mounting home directory");
         }
-        if (uid == 0 || strncmp(homedir, "/home/", 6) != 0) {
+        if (oflag) {
                 // mask /home
                 if (arg_debug)
                         printf("Mounting a new /home directory\n");
@@ -600,5 +630,4 @@ void fs_private_home_list(void) {
 
         if (!arg_quiet)
                 fprintf(stderr, "Home directory installed in %0.2f ms\n", timetrace_end());
-
 }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 5b39dd491..1786cfac2 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -262,7 +262,7 @@ static int has_link(const char *dir) {
 
 static void check_homedir(void) {
         assert(cfg.homedir);
-        if (cfg.homedir[0] != '/' || cfg.homedir[1] == '\0') { // system users sometimes have root directory as home
+        if (cfg.homedir[0] != '/') {
                 fprintf(stderr, "Error: invalid user directory \"%s\"\n", cfg.homedir);
                 exit(1);
         }