4 files changed, 20 insertions, 5 deletions

diff --git a/etc/firefox.profile b/etc/firefox.profile
index 3fb56fd0e..7862bd010 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -48,6 +48,6 @@ include /etc/firejail/whitelist-common.inc
 
 # experimental features
 #private-bin firefox,which,sh,dbus-launch,dbus-send,env
-private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
+#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
 private-dev
 private-tmp
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index 65ca5c443..b16736dee 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -136,6 +136,21 @@ int sbox_run(unsigned filter, int num, ...) {
         if (child < 0)
                 errExit("fork");
         if (child == 0) {
+                // clean the new process
+                clearenv();
+                int max = 20; // getdtablesize() is overkill for a firejail process
+                for (i = 3; i < max; i++)
+                        close(i); // close open files
+                int fd = open("/dev/null",O_RDWR, 0);
+                if (fd != -1) {
+                        dup2 (fd, STDIN_FILENO);
+                        if (fd > 2)
+                                close (fd);
+                }
+                else // the user could run the sandbox without /dev/null
+                        close(STDIN_FILENO);
+                umask(027);     
+
                 // apply filters
                 if (filter & SBOX_CAPS_NONE) {
                         caps_drop_all();
diff --git a/src/fnet/Makefile.in b/src/fnet/Makefile.in
index b515d2333..bba4406d4 100644
--- a/src/fnet/Makefile.in
+++ b/src/fnet/Makefile.in
@@ -33,8 +33,8 @@ LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/libnetlink.h
         $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
-fnet: $(OBJS) ../lib/libnetlink.o ../lib/common.o
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/libnetlink.o $(LIBS) $(EXTRA_LDFLAGS)
+fnet: $(OBJS) ../lib/libnetlink.o
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/libnetlink.o $(LIBS)
 
 clean:; rm -f *.o fnet
 
diff --git a/src/fseccomp/Makefile.in b/src/fseccomp/Makefile.in
index 110d2c95f..1878ad2f3 100644
--- a/src/fseccomp/Makefile.in
+++ b/src/fseccomp/Makefile.in
@@ -33,8 +33,8 @@ LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
         $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
-fseccomp: $(OBJS) ../lib/libnetlink.o ../lib/common.o
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+fseccomp: $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS)
 
 clean:; rm -f *.o fseccomp