1 files changed, 50 insertions, 12 deletions

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 493877db3..e56526f34 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -386,7 +386,7 @@ static void enforce_filters(void) {
         }
         
         // disable all capabilities
-        if (arg_caps_default_filter || arg_caps_list)
+        if (arg_caps_default_filter || arg_caps_list && !arg_quiet)
                 fprintf(stderr, "Warning: all capabilities disabled for a regular user in chroot\n");
         arg_caps_drop_all = 1;
         
@@ -467,6 +467,11 @@ int sandbox(void* sandbox_arg) {
                 if (arg_debug)
                         printf("Network namespace enabled, only loopback interface available\n");
         }
+        else if (arg_netns) {
+                netns(arg_netns);
+                if (arg_debug)
+                        printf("Network namespace '%s' activated\n", arg_netns);
+        }
         else if (any_bridge_configured() || any_interface_configured()) {
                 // configure lo and eth0...eth3
                 net_if_up("lo");
@@ -515,7 +520,8 @@ int sandbox(void* sandbox_arg) {
                 if (cfg.defaultgw) {
                         // set the default route
                         if (net_add_route(0, 0, cfg.defaultgw)) {
-                                fprintf(stderr, "Warning: cannot configure default route\n");
+                                if (!arg_quiet)
+                                        fprintf(stderr, "Warning: cannot configure default route\n");
                                 gw_cfg_failed = 1;
                         }
                 }
@@ -582,6 +588,10 @@ int sandbox(void* sandbox_arg) {
         if (arg_trace || arg_tracelog || mask_x11_abstract_socket)
                 fs_trace_preload();
 
+        // store hosts file
+        if (cfg.hosts_file)
+                fs_store_hosts_file();
+
         //****************************
         // configure filesystem
         //****************************
@@ -620,19 +630,29 @@ int sandbox(void* sandbox_arg) {
 #ifdef HAVE_OVERLAYFS
         if (arg_overlay)        {
                 fs_overlayfs();
+
+//todo - bring it back for overlay-named
+#if 0           
+                fs_overlayfs();
+                // force caps and seccomp if not started as root
+                if (getuid() != 0) {
+                        enforce_filters();
+#ifdef HAVE_SECCOMP
+                        enforce_seccomp = 1;
+#endif
+                }
+                else
+                        arg_seccomp = 1;
+#endif          
+                
+                
+                
         }
         else
 #endif
                 fs_basic_fs();
         
         //****************************
-        // set hostname in /etc/hostname
-        //****************************
-        if (cfg.hostname) {
-                fs_hostname(cfg.hostname);
-        }
-        
-        //****************************
         // private mode
         //****************************
         if (arg_private) {
@@ -729,6 +749,22 @@ int sandbox(void* sandbox_arg) {
                         EUID_ROOT();
                 }
         }
+
+        
+        //****************************
+        // hosts and hostname
+        //****************************
+        if (cfg.hostname)
+                fs_hostname(cfg.hostname);
+
+        if (cfg.hosts_file)
+                fs_mount_hosts_file();
+
+        //****************************
+        // /etc overrides from the network namespace
+        //****************************
+        if (arg_netns)
+                netns_mounts(arg_netns);
         
         //****************************
         // update /proc, /sys, /dev, /boot directorymy
@@ -812,7 +848,8 @@ int sandbox(void* sandbox_arg) {
                 int rv = nice(cfg.nice);
                 (void) rv;
                 if (errno) {
-                        fprintf(stderr, "Warning: cannot set nice value\n");
+                        if (!arg_quiet)
+                                fprintf(stderr, "Warning: cannot set nice value\n");
                         errno = 0;
                 }
         }
@@ -868,7 +905,8 @@ int sandbox(void* sandbox_arg) {
         if (arg_noroot) {
                 int rv = unshare(CLONE_NEWUSER);
                 if (rv == -1) {
-                        fprintf(stderr, "Warning: cannot create a new user namespace, going forward without it...\n");
+                        if (!arg_quiet)
+                                fprintf(stderr, "Warning: cannot create a new user namespace, going forward without it...\n");
                         drop_privs(arg_nogroups);
                         arg_noroot = 0;
                 }
@@ -899,7 +937,7 @@ int sandbox(void* sandbox_arg) {
         if (arg_nonewprivs) {
                 int no_new_privs = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 
-                if(no_new_privs != 0)
+                if(no_new_privs != 0 && !arg_quiet)
                         fprintf(stderr, "Warning: NO_NEW_PRIVS disabled, it requires a Linux kernel version 3.5 or newer.\n");
                 else if (arg_debug)
                         printf("NO_NEW_PRIVS set\n");