aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/firejail/fs_whitelist.c3
-rw-r--r--src/man/firejail.txt7
2 files changed, 2 insertions, 8 deletions
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index e3668140d..f94040d0f 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -401,9 +401,6 @@ void fs_whitelist(void) {
401 struct stat s; 401 struct stat s;
402 if (stat(fname, &s) == 0 && s.st_uid != getuid()) 402 if (stat(fname, &s) == 0 && s.st_uid != getuid())
403 goto errexit; 403 goto errexit;
404
405 // set nonewprivs
406 arg_nonewprivs = 1;
407 } 404 }
408 } 405 }
409 else if (strncmp(new_name, "/tmp/", 5) == 0) { 406 else if (strncmp(new_name, "/tmp/", 5) == 0) {
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 65744235e..2ddbc9f88 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -947,11 +947,8 @@ $
947Sets the NO_NEW_PRIVS prctl. This ensures that child processes 947Sets the NO_NEW_PRIVS prctl. This ensures that child processes
948cannot acquire new privileges using execve(2); in particular, 948cannot acquire new privileges using execve(2); in particular,
949this means that calling a suid binary (or one with file capabilities) 949this means that calling a suid binary (or one with file capabilities)
950does not result in an increase of privilege. 950does not result in an increase of privilege. This option
951 951is enabled by default if seccomp filter is activated.
952--nonewprivs is enabled by default if seccomp filter is activated, or if a
953symbolic link in user home directory pointing outside user home
954is whitelisted.
955 952
956.TP 953.TP
957\fB\-\-nosound 954\fB\-\-nosound