13 files changed, 265 insertions, 117 deletions

diff --git a/src/fcopy/main.c b/src/fcopy/main.c
index b1e2813db..a4f5ace11 100644
--- a/src/fcopy/main.c
+++ b/src/fcopy/main.c
@@ -41,7 +41,7 @@ static void copy_file(const char *srcname, const char *destname, mode_t mode, ui
         // open source
         int src = open(srcname, O_RDONLY);
         if (src < 0) {
-                fprintf(stderr, "Warning: cannot open %s, file not copied\n", srcname);
+                fprintf(stderr, "Warning fcopy: cannot open %s, file not copied\n", srcname);
                 return;
         }
 
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index fe65a5077..4e4e5488a 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -184,8 +184,6 @@ eog
 # other
 atom
 atom-beta
-gpa
-gpg
 ranger
 keepass
 keepass2
diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c
index 5e9002f22..84c9dc53a 100644
--- a/src/firejail/bandwidth.c
+++ b/src/firejail/bandwidth.c
@@ -435,15 +435,8 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
         if (setregid(0, 0))
                 errExit("setregid");
 
-        if (!cfg.shell)
-                cfg.shell = guess_shell();
-        if (!cfg.shell) {
-                fprintf(stderr, "Error: no POSIX shell found, please use --shell command line option\n");
-                exit(1);
-        }
-
         char *arg[4];
-        arg[0] = cfg.shell;
+        arg[0] = "/bin/sh";
         arg[1] = "-c";
         arg[2] = cmd;
         arg[3] = NULL;
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 36cf47435..586cfd65e 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -403,7 +403,7 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse);
 void fs_overlayfs(void);
 // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf
 void fs_chroot(const char *rootdir);
-int fs_check_chroot_dir(const char *rootdir);
+void fs_check_chroot_dir(const char *rootdir);
 
 // profile.c
 // find and read the profile specified by name from dir directory
@@ -450,6 +450,8 @@ void logmsg(const char *msg);
 void logargs(int argc, char **argv) ;
 void logerr(const char *msg);
 int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
+void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
+void touch_file_as_user(const char *fname, uid_t uid, gid_t gid, mode_t mode);
 int is_dir(const char *fname);
 int is_link(const char *fname);
 char *line_remove_spaces(const char *buf);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index e2fc09533..d7764accd 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -994,20 +994,25 @@ void fs_overlayfs(void) {
 
 #ifdef HAVE_CHROOT              
 // return 1 if error
-int fs_check_chroot_dir(const char *rootdir) {
+void fs_check_chroot_dir(const char *rootdir) {
         EUID_ASSERT();
         assert(rootdir);
         struct stat s;
         char *name;
 
+        if (strcmp(rootdir, "/tmp") == 0 || strcmp(rootdir, "/var/tmp") == 0) {
+                fprintf(stderr, "Error: invalid chroot directory\n");
+                exit(1);
+        }
+
         // rootdir has to be owned by root
         if (stat(rootdir, &s) != 0) {
                 fprintf(stderr, "Error: cannot find chroot directory\n");
-                return 1;
+                exit(1);
         }
         if (s.st_uid != 0) {
                 fprintf(stderr, "Error: chroot directory should be owned by root\n");
-                return 1;
+                exit(1);
         }
 
         // check /dev
@@ -1015,7 +1020,11 @@ int fs_check_chroot_dir(const char *rootdir) {
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /dev in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /dev directory should be owned by root\n");
+                exit(1);
         }
         free(name);
 
@@ -1024,7 +1033,11 @@ int fs_check_chroot_dir(const char *rootdir) {
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /var/tmp in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /var/tmp directory should be owned by root\n");
+                exit(1);
         }
         free(name);
         
@@ -1033,7 +1046,11 @@ int fs_check_chroot_dir(const char *rootdir) {
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /proc in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /proc directory should be owned by root\n");
+                exit(1);
         }
         free(name);
         
@@ -1042,18 +1059,41 @@ int fs_check_chroot_dir(const char *rootdir) {
                 errExit("asprintf");
         if (stat(name, &s) == -1) {
                 fprintf(stderr, "Error: cannot find /tmp in chroot directory\n");
-                return 1;
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /tmp directory should be owned by root\n");
+                exit(1);
         }
         free(name);
 
-        // check /bin/bash
-//      if (asprintf(&name, "%s/bin/bash", rootdir) == -1)
-//              errExit("asprintf");
-//      if (stat(name, &s) == -1) {
-//              fprintf(stderr, "Error: cannot find /bin/bash in chroot directory\n");
-//              return 1;
-//      }
-//      free(name);
+        // check /etc
+        if (asprintf(&name, "%s/etc", rootdir) == -1)
+                errExit("asprintf");
+        if (stat(name, &s) == -1) {
+                fprintf(stderr, "Error: cannot find /etc in chroot directory\n");
+                exit(1);
+        }
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: chroot /etc directory should be owned by root\n");
+                exit(1);
+        }
+        free(name);
+
+        // check /etc/resolv.conf
+        if (asprintf(&name, "%s/etc/resolv.conf", rootdir) == -1)
+                errExit("asprintf");
+        if (stat(name, &s) == 0) {
+                if (s.st_uid != 0) {
+                        fprintf(stderr, "Error: chroot /etc/resolv.conf should be owned by root\n");
+                        exit(1);
+                }
+        }
+        if (is_link(name)) {
+                fprintf(stderr, "Error: invalid %s file\n", name);
+                exit(1);
+        }
+        free(name);
 
         // check x11 socket directory
         if (getenv("FIREJAIL_X11")) {
@@ -1063,12 +1103,14 @@ int fs_check_chroot_dir(const char *rootdir) {
                         errExit("asprintf");
                 if (stat(name, &s) == -1) {
                         fprintf(stderr, "Error: cannot find /tmp/.X11-unix in chroot directory\n");
-                        return 1;
+                        exit(1);
+                }
+                if (s.st_uid != 0) {
+                        fprintf(stderr, "Error: chroot /tmp/.X11-unix directory should be owned by root\n");
+                        exit(1);
                 }
                 free(name);
         }
-        
-        return 0;       
 }
 
 // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf
@@ -1129,7 +1171,7 @@ void fs_chroot(const char *rootdir) {
                         fprintf(stderr, "Error: invalid %s file\n", fname);
                         exit(1);
                 }
-                if (copy_file("/etc/resolv.conf", fname, 0, 0, 0644) == -1)
+                if (copy_file("/etc/resolv.conf", fname, 0, 0, 0644) == -1) // root needed
                         fprintf(stderr, "Warning: /etc/resolv.conf not initialized\n");
         }
         
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 0872bf0d0..8a52314ed 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -42,19 +42,17 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
                 // don't copy it if we already have the file
                 if (stat(fname, &s) == 0)
                         return;
+                if (is_link(fname)) { // stat on dangling symlinks fails, try again using lstat
+                        fprintf(stderr, "Error: invalid %s file\n", fname);
+                        exit(1);
+                }
                 if (stat("/etc/skel/.zshrc", &s) == 0) {
-                        if (copy_file("/etc/skel/.zshrc", fname, u, g, 0644) == 0) {
-                                fs_logger("clone /etc/skel/.zshrc");
-                        }
+                        copy_file_as_user("/etc/skel/.zshrc", fname, u, g, 0644); // regular user
+                        fs_logger("clone /etc/skel/.zshrc");
                 }
-                else { // 
-                        FILE *fp = fopen(fname, "w");
-                        if (fp) {
-                                fprintf(fp, "\n");
-                                SET_PERMS_STREAM(fp, u, g, S_IRUSR | S_IWUSR);
-                                fclose(fp);
-                                fs_logger2("touch", fname);
-                        }
+                else {
+                        touch_file_as_user(fname, u, g, 0644);
+                        fs_logger2("touch", fname);
                 }
                 free(fname);
         }
@@ -64,23 +62,21 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
                 if (asprintf(&fname, "%s/.cshrc", homedir) == -1)
                         errExit("asprintf");
                 struct stat s;
+                
                 // don't copy it if we already have the file
                 if (stat(fname, &s) == 0)
                         return;
+                if (is_link(fname)) { // stat on dangling symlinks fails, try again using lstat
+                        fprintf(stderr, "Error: invalid %s file\n", fname);
+                        exit(1);
+                }
                 if (stat("/etc/skel/.cshrc", &s) == 0) {
-                        if (copy_file("/etc/skel/.cshrc", fname, u, g, 0644) == 0) {
-                                fs_logger("clone /etc/skel/.cshrc");
-                        }
+                        copy_file_as_user("/etc/skel/.cshrc", fname, u, g, 0644); // regular user
+                        fs_logger("clone /etc/skel/.cshrc");
                 }
-                else { // 
-                        /* coverity[toctou] */
-                        FILE *fp = fopen(fname, "w");
-                        if (fp) {
-                                fprintf(fp, "\n");
-                                SET_PERMS_STREAM(fp, u, g, S_IRUSR | S_IWUSR);
-                                fclose(fp);
-                                fs_logger2("touch", fname);
-                        }
+                else {
+                        touch_file_as_user(fname, u, g, 0644);
+                        fs_logger2("touch", fname);
                 }
                 free(fname);
         }
@@ -93,10 +89,13 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
                 // don't copy it if we already have the file
                 if (stat(fname, &s) == 0) 
                         return;
+                if (is_link(fname)) { // stat on dangling symlinks fails, try again using lstat
+                        fprintf(stderr, "Error: invalid %s file\n", fname);
+                        exit(1);
+                }
                 if (stat("/etc/skel/.bashrc", &s) == 0) {
-                        if (copy_file("/etc/skel/.bashrc", fname, u, g, 0644) == 0) {
-                                fs_logger("clone /etc/skel/.bashrc");
-                        }
+                        copy_file_as_user("/etc/skel/.bashrc", fname, u, g, 0644); // regular user
+                        fs_logger("clone /etc/skel/.bashrc");
                 }
                 free(fname);
         }
@@ -106,6 +105,14 @@ static int store_xauthority(void) {
         // put a copy of .Xauthority in XAUTHORITY_FILE
         char *src;
         char *dest = RUN_XAUTHORITY_FILE;
+        // create an empty file as root, and change ownership to user
+        FILE *fp = fopen(dest, "w");
+        if (fp) {
+                fprintf(fp, "\n");
+                SET_PERMS_STREAM(fp, getuid(), getgid(), 0600);
+                fclose(fp);
+        }
+        
         if (asprintf(&src, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
         
@@ -115,12 +122,9 @@ static int store_xauthority(void) {
                         fprintf(stderr, "Warning: invalid .Xauthority file\n");
                         return 0;
                 }
-                        
-                int rv = copy_file(src, dest, -1, -1, 0600);
-                if (rv) {
-                        fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
-                        return 0;
-                }
+
+                copy_file_as_user(src, dest, getuid(), getgid(), 0600); // regular user
+                fs_logger2("clone", dest);
                 return 1; // file copied
         }
         
@@ -128,8 +132,17 @@ static int store_xauthority(void) {
 }
 
 static int store_asoundrc(void) {
+        // put a copy of .Xauthority in XAUTHORITY_FILE
         char *src;
         char *dest = RUN_ASOUNDRC_FILE;
+        // create an empty file as root, and change ownership to user
+        FILE *fp = fopen(dest, "w");
+        if (fp) {
+                fprintf(fp, "\n");
+                SET_PERMS_STREAM(fp, getuid(), getgid(), 0644);
+                fclose(fp);
+        }
+        
         if (asprintf(&src, "%s/.asoundrc", cfg.homedir) == -1)
                 errExit("asprintf");
         
@@ -150,11 +163,8 @@ static int store_asoundrc(void) {
                         free(rp);
                 }
 
-                int rv = copy_file(src, dest, -1, -1, -0644);
-                if (rv) {
-                        fprintf(stderr, "Warning: cannot transfer .asoundrc in private home directory\n");
-                        return 0;
-                }
+                copy_file_as_user(src, dest, getuid(), getgid(), 0644); // regular user
+                fs_logger2("clone", dest);
                 return 1; // file copied
         }
         
@@ -167,13 +177,15 @@ static void copy_xauthority(void) {
         char *dest;
         if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
-        // copy, set permissions and ownership
-        int rv = copy_file(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR);
-        if (rv)
-                fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
-        else {
-                fs_logger2("clone", dest);
+        
+        // if destination is a symbolic link, exit the sandbox!!!
+        if (is_link(dest)) {
+                fprintf(stderr, "Error: %s is a symbolic link\n", dest);
+                exit(1);
         }
+
+        copy_file_as_user(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR); // regular user
+        fs_logger2("clone", dest);
         
         // delete the temporary file
         unlink(src);
@@ -185,14 +197,16 @@ static void copy_asoundrc(void) {
         char *dest;
         if (asprintf(&dest, "%s/.asoundrc", cfg.homedir) == -1)
                 errExit("asprintf");
-        // copy, set permissions and ownership
-        int rv = copy_file(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR);
-        if (rv)
-                fprintf(stderr, "Warning: cannot transfer .asoundrc in private home directory\n");
-        else {
-                fs_logger2("clone", dest);
+        
+        // if destination is a symbolic link, exit the sandbox!!!
+        if (is_link(dest)) {
+                fprintf(stderr, "Error: %s is a symbolic link\n", dest);
+                exit(1);
         }
 
+        copy_file_as_user(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR); // regular user
+        fs_logger2("clone", dest);
+
         // delete the temporary file
         unlink(src);
 }
diff --git a/src/firejail/ls.c b/src/firejail/ls.c
index 77eb35f97..1af56751a 100644
--- a/src/firejail/ls.c
+++ b/src/firejail/ls.c
@@ -336,7 +336,7 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                         drop_privs(0);
                         
                         // copy the file
-                        if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600))
+                        if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600)) // already a regular user
                                 _exit(1);
 #ifdef HAVE_GCOV
                         __gcov_flush();
@@ -362,7 +362,7 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                         drop_privs(0);
                         
                         // copy the file
-                        if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600))
+                        if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600)) // already a regular user
                                 _exit(1);
 #ifdef HAVE_GCOV
                         __gcov_flush();
@@ -411,7 +411,7 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                         drop_privs(0);
                         
                         // copy the file
-                        if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600))
+                        if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600)) // already a regular user
                                 _exit(1);
 #ifdef HAVE_GCOV
                         __gcov_flush();
@@ -443,7 +443,7 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                         drop_privs(0);
                         
                         // copy the file
-                        if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600))
+                        if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600)) // already a regular user
                                 _exit(1);
 #ifdef HAVE_GCOV
                         __gcov_flush();
diff --git a/src/firejail/main.c b/src/firejail/main.c
index e70e20eec..84bf5e8e6 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -35,6 +35,7 @@
 #include <signal.h>
 #include <time.h>
 #include <net/if.h>
+#include <sys/utsname.h>
 
 #if 0
 #include <sys/times.h>
@@ -817,8 +818,27 @@ int main(int argc, char **argv) {
         
         if (check_arg(argc, argv, "--quiet"))
                 arg_quiet = 1;
-        if (check_arg(argc, argv, "--allow-debuggers"))
+        if (check_arg(argc, argv, "--allow-debuggers")) {
+                // check kernel version
+                struct utsname u;
+                int rv = uname(&u);
+                if (rv != 0)
+                        errExit("uname");
+                int major;
+                int minor;
+                if (2 != sscanf(u.release, "%d.%d", &major, &minor)) {
+                        fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version);
+                        exit(1);
+                }
+                if (major < 4 || (major == 4 && minor < 8)) {
+                        fprintf(stderr, "Error: --allow-debuggers is disabled on Linux kernels prior to 4.8. "
+                                "A bug in ptrace call allows a full bypass of the seccomp filter. "
+                                "Your current kernel version is %d.%d.\n", major, minor);
+                        exit(1);
+                }
+
                 arg_allow_debuggers = 1;
+        }
 
         // drop permissions by default and rise them when required
         EUID_INIT();
@@ -1448,13 +1468,10 @@ int main(int argc, char **argv) {
                                         fprintf(stderr, "Error: invalid chroot directory\n");
                                         exit(1);
                                 }
-                                free(rpath);
+                                cfg.chrootdir = rpath;
                                 
                                 // check chroot directory structure
-                                if (fs_check_chroot_dir(cfg.chrootdir)) {
-                                        fprintf(stderr, "Error: invalid chroot\n");
-                                        exit(1);
-                                }
+                                fs_check_chroot_dir(cfg.chrootdir);
                         }
                         else
                                 exit_err_feature("chroot");
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index d2db7d3dd..e17f39caa 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -76,12 +76,12 @@ void preproc_mount_mnt_dir(void) {
                 fs_logger2("tmpfs", RUN_MNT_DIR);
                 
                 //copy defaultl seccomp files
-                copy_file(PATH_SECCOMP_I386, RUN_SECCOMP_I386, getuid(), getgid(), 0644);
-                copy_file(PATH_SECCOMP_AMD64, RUN_SECCOMP_AMD64, getuid(), getgid(), 0644);
+                copy_file(PATH_SECCOMP_I386, RUN_SECCOMP_I386, getuid(), getgid(), 0644); // root needed
+                copy_file(PATH_SECCOMP_AMD64, RUN_SECCOMP_AMD64, getuid(), getgid(), 0644); // root needed
                 if (arg_allow_debuggers)
-                        copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644);
+                        copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed
                 else
-                        copy_file(PATH_SECCOMP_DEFAULT, RUN_SECCOMP_CFG, getuid(), getgid(), 0644);
+                        copy_file(PATH_SECCOMP_DEFAULT, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed
                         
                 // as root, create an empty RUN_SECCOMP_PROTOCOL file
                 create_empty_file_as_root(RUN_SECCOMP_PROTOCOL, 0644);
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index f890dd534..4ec84ec61 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -22,6 +22,7 @@
 #include <sys/stat.h>
 #include <sys/mount.h>
 #include <dirent.h>
+#include <sys/wait.h>
 
 static void disable_file(const char *path, const char *file) {
         assert(file);
@@ -113,7 +114,7 @@ void pulseaudio_init(void) {
         char *pulsecfg = NULL;
         if (asprintf(&pulsecfg, "%s/client.conf", RUN_PULSE_DIR) == -1)
                 errExit("asprintf");
-        if (copy_file("/etc/pulse/client.conf", pulsecfg, -1, -1, 0644))
+        if (copy_file("/etc/pulse/client.conf", pulsecfg, -1, -1, 0644)) // root needed
                 errExit("copy_file");
         FILE *fp = fopen(pulsecfg, "a+");
         if (!fp)
@@ -127,21 +128,63 @@ void pulseaudio_init(void) {
         if (asprintf(&dir1, "%s/.config", cfg.homedir) == -1)
                 errExit("asprintf");
         if (stat(dir1, &s) == -1) {
-                int rv = mkdir(dir1, 0755);
-                if (rv == 0) {
-                        if (set_perms(dir1, getuid(), getgid(), 0755))
-                                {;} // do nothing
+                pid_t child = fork();
+                if (child < 0)
+                        errExit("fork");
+                if (child == 0) {
+                        // drop privileges
+                        drop_privs(0);
+        
+                        int rv = mkdir(dir1, 0755);
+                        if (rv == 0) {
+                                if (set_perms(dir1, getuid(), getgid(), 0755))
+                                        {;} // do nothing
+                        }
+#ifdef HAVE_GCOV
+                        __gcov_flush();
+#endif
+                        _exit(0);
+                }
+                // wait for the child to finish
+                waitpid(child, NULL, 0);
+        }
+        else {
+                // make sure the directory is owned by the user
+                if (s.st_uid != getuid()) {
+                        fprintf(stderr, "Error: user .config directory is not owned by the current user\n");
+                        exit(1);
                 }
         }
         free(dir1);
+        
         if (asprintf(&dir1, "%s/.config/pulse", cfg.homedir) == -1)
                 errExit("asprintf");
         if (stat(dir1, &s) == -1) {
-                /* coverity[toctou] */
-                int rv = mkdir(dir1, 0700);
-                if (rv == 0) {
-                        if (set_perms(dir1, getuid(), getgid(), 0700))
-                                {;} // do nothing
+                pid_t child = fork();
+                if (child < 0)
+                        errExit("fork");
+                if (child == 0) {
+                        // drop privileges
+                        drop_privs(0);
+        
+                        int rv = mkdir(dir1, 0700);
+                        if (rv == 0) {
+                                if (set_perms(dir1, getuid(), getgid(), 0700))
+                                        {;} // do nothing
+                        }
+#ifdef HAVE_GCOV
+                        __gcov_flush();
+#endif
+                        _exit(0);
+                }
+                // wait for the child to finish
+                waitpid(child, NULL, 0);
+        }
+        else {
+                // make sure the directory is owned by the user
+                if (s.st_uid != getuid()) {
+                        fprintf(stderr, "Error: user .config/pulse directory is not owned by the current user\n");
+                        exit(1);
                 }
         }
         free(dir1);
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 50fcd6ed0..493877db3 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -616,19 +616,10 @@ int sandbox(void* sandbox_arg) {
                         fs_trace_preload();
         }
         else 
-#endif          
+#endif
 #ifdef HAVE_OVERLAYFS
         if (arg_overlay)        {
                 fs_overlayfs();
-                // force caps and seccomp if not started as root
-                if (getuid() != 0) {
-                        enforce_filters();
-#ifdef HAVE_SECCOMP
-                        enforce_seccomp = 1;
-#endif
-                }
-                else
-                        arg_seccomp = 1;
         }
         else
 #endif
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 75f2acdb9..763e6b58b 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -28,6 +28,7 @@
 #include <grp.h>
 #include <sys/ioctl.h>
 #include <termios.h>
+#include <sys/wait.h>
 
 #define MAX_GROUPS 1024
 // drop privileges
@@ -177,14 +178,14 @@ int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, m
         // open source
         int src = open(srcname, O_RDONLY);
         if (src < 0) {
-                fprintf(stderr, "Warning: cannot open %s, file not copied\n", srcname);
+                fprintf(stderr, "Warning: cannot open source file %s, file not copied\n", srcname);
                 return -1;
         }
 
         // open destination
         int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (dst < 0) {
-                fprintf(stderr, "Warning: cannot open %s, file not copied\n", destname);
+                fprintf(stderr, "Warning: cannot open destination file %s, file not copied\n", destname);
                 close(src);
                 return -1;
         }
@@ -218,6 +219,51 @@ int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, m
         return 0;
 }
 
+// return -1 if error, 0 if no error
+void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode) {
+        pid_t child = fork();
+        if (child < 0)
+                errExit("fork");
+        if (child == 0) {
+                // drop privileges
+                drop_privs(0);
+
+                // copy, set permissions and ownership
+                int rv = copy_file(srcname, destname, uid, gid, mode); // already a regular user
+                if (rv)
+                        fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
+#ifdef HAVE_GCOV
+                __gcov_flush();
+#endif
+                _exit(0);
+        }
+        // wait for the child to finish
+        waitpid(child, NULL, 0);
+}
+
+// return -1 if error, 0 if no error
+void touch_file_as_user(const char *fname, uid_t uid, gid_t gid, mode_t mode) {
+        pid_t child = fork();
+        if (child < 0)
+                errExit("fork");
+        if (child == 0) {
+                // drop privileges
+                drop_privs(0);
+
+                FILE *fp = fopen(fname, "w");
+                if (fp) {
+                        fprintf(fp, "\n");
+                        SET_PERMS_STREAM(fp, uid, gid, mode);
+                        fclose(fp);
+                }
+#ifdef HAVE_GCOV
+                __gcov_flush();
+#endif
+                _exit(0);
+        }
+        // wait for the child to finish
+        waitpid(child, NULL, 0);
+}
 
 // return 1 if the file is a directory
 int is_dir(const char *fname) {
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 60c21cbc1..69d28c788 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -76,7 +76,9 @@ $ firejail [OPTIONS] firefox        # starting Mozilla Firefox
 Signal the end of options and disables further option processing.
 .TP
 \fB\-\-allow-debuggers
-Allow tools such as strace and gdb inside the sandbox.
+Allow tools such as strace and gdb inside the sandbox. This option is only available
+when running on Linux kernels 4.8 or newer - a kernel bug in ptrace system call allows a full
+bypass of the seccomp filter.
 .br
 
 .br