6 files changed, 50 insertions, 16 deletions

diff --git a/RELNOTES b/RELNOTES
index 61732c390..4775cf0f6 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -34,9 +34,6 @@ firejail (0.9.45) baseline; urgency=low
   * feature: allow /tmp directory in mkdir and mkfile profile commands
   * feature: implemented --noblacklist command, profile support
   * feature: config support to disable access to /mnt and /media (disable-mnt)
-  * feature: allow tmpfs for regular users for files in home directory
-  * feature: mount a tmpfs on top of ~/.cache directory by default
-  * feature: config support to disable tmpfs mounting on ~/.cache (cache-tmpfs)
   * feature: config support to disable join (join)
   * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire,
   * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 3413febcb..fc6bdc7d0 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -486,7 +486,15 @@ void fs_cache(void) {
         char *cache;
         if (asprintf(&cache, "%s/.cache", cfg.homedir) == -1)
                 errExit("asprintf");
+        if (is_link(cache)) {
+                fprintf(stderr, "Error: ~/.cache directory is a symbolik link\n");
+                exit(1);
+        }
         disable_file(MOUNT_TMPFS, cache);
+        if (is_link(cache)) {
+                fprintf(stderr, "Error: ~/.cache directory is a symbolik link\n");
+                exit(1);
+        }
         free(cache);
 }
 
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 4b3cab041..993acf2aa 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -970,19 +970,8 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 ptr += 7;
         else if (strncmp(ptr, "tmpfs ", 6) == 0) {
                 if (getuid() != 0) {
-                        // allow a non-root user  to mount tmpfs in user home directory, links are not allowed
-                        invalid_filename(ptr + 6);
-                        char *newfname = expand_home(ptr + 6, cfg.homedir);
-                        assert(newfname);
-                        if (is_link(newfname)) {
-                                fprintf(stderr, "Error: for regular user, tmpfs is not available for symbolic links\n");
-                                exit(1);        
-                        }
-                        if (strncmp(newfname, cfg.homedir, strlen(cfg.homedir)) != 0) {
-                                fprintf(stderr, "Error: for regular user, tmpfs is available only for files in user home directory\n");
-                                exit(1);        
-                        }
-                        free(newfname);
+                        fprintf(stderr, "Error: tmpfs available only when running the sandbox as root\n");
+                        exit(1);
                 }
                 ptr += 6;
         }
diff --git a/test/network/configure b/test/network/configure
index 35d938340..d4511c705 100755
--- a/test/network/configure
+++ b/test/network/configure
@@ -25,3 +25,6 @@ ip link add link eth0 name eth0.6 type vlan id 6
 ip link add link eth0 name eth0.7 type vlan id 7
 /sbin/ifconfig eth0.7 10.10.207.10/24 up
 
+# network namespace
+ip netns add red
+
diff --git a/test/network/netns.exp b/test/network/netns.exp
new file mode 100755
index 000000000..9475cf958
--- /dev/null
+++ b/test/network/netns.exp
@@ -0,0 +1,34 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2017 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --netns=red --noprofile\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "Child process initialized"
+}
+after 100
+
+send -- "ip link show\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "LOOPBACK"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "DOWN"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "link/loopback"
+}
+after 100
+send -- "exit\r"
+after 100
+
+puts "all done\n"
diff --git a/test/network/network.sh b/test/network/network.sh
index 2c60be0a5..c4c104042 100755
--- a/test/network/network.sh
+++ b/test/network/network.sh
@@ -11,6 +11,9 @@ sudo ./configure
 echo "TESTING: firemon interface (firemon-interfaces.exp)"
 sudo ./firemon-interfaces.exp
 
+echo "TESTING: netns (netns.exp)"
+./netns.exp
+
 echo "TESTING: print dns (dns-print.exp)"
 ./dns-print.exp