3 files changed, 19 insertions, 2 deletions

diff --git a/RELNOTES b/RELNOTES
index c0fb8b20b..7aeac4f8d 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,7 +1,10 @@
 firejail (0.9.45) baseline; urgency=low
   * development version, work in progress
- -- netblue30 <netblue30@yahoo.com>  Sun, 23 Oct 2016 08:00:00 -0500
+  * security: overwrite /etc/resolv.conf found by Martin Carpenter
+  * feature: split most of networking code in a separate executable
   * new profiles: xiphos, Tor Browser Bundle
+  * bugfixes
+ -- netblue30 <netblue30@yahoo.com>  Sun, 23 Oct 2016 08:00:00 -0500
 
 firejail (0.9.44) baseline; urgency=low
   * CVE-2016-7545 submitted by Aleksey Manevich
diff --git a/src/firejail/main.c b/src/firejail/main.c
index b5a97c71e..f41d5fcd3 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1605,6 +1605,14 @@ int main(int argc, char **argv) {
                                         return 1;
                                 }
                                 
+                                // don't allow "--chroot=/"
+                                char *rpath = realpath(cfg.chrootdir, NULL);
+                                if (rpath == NULL || strcmp(rpath, "/") == 0) {
+                                        fprintf(stderr, "Error: invalid chroot directory\n");
+                                        exit(1);
+                                }
+                                free(rpath);
+                                
                                 // check chroot directory structure
                                 if (fs_check_chroot_dir(cfg.chrootdir)) {
                                         fprintf(stderr, "Error: invalid chroot\n");
diff --git a/src/firejail/util.c b/src/firejail/util.c
index f38b02fd0..4b2e09953 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -171,11 +171,17 @@ void logerr(const char *msg) {
 }
 
 
-// return -1 if error, 0 if no error
+// return -1 if error, 0 if no error; if destname already exists, return error
 int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode) {
         assert(srcname);
         assert(destname);
 
+        struct stat s;
+        if (stat(destname, &s) == 0) {
+                fprintf(stderr, "Error: file %s already exists\n", destname);
+                return -1;
+        }
+
         // open source
         int src = open(srcname, O_RDONLY);
         if (src < 0) {