7 files changed, 44 insertions, 25 deletions

diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index c909e6903..dd876c87c 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -75,6 +75,7 @@ unbound
 # emulators/compatibility layers
 mupen64plus
 wine
+dosbox
 
 # games
 0ad
diff --git a/src/firejail/env.c b/src/firejail/env.c
index 2cc65e464..88cd6918d 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -135,7 +135,8 @@ void env_defaults(void) {
         }
 
         // set the window title
-        printf("\033]0;firejail %s\007", cfg.window_title);
+        if (!arg_quiet)
+                printf("\033]0;firejail %s\007", cfg.window_title);
         fflush(0);
 }
 
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 33037da29..11e626b6e 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -554,24 +554,30 @@ void fs_whitelist(void) {
         
         // /media mountpoint
         if (media_dir) {
-                // keep a copy of real /media directory in RUN_WHITELIST_MEDIA_DIR
-                int rv = mkdir(RUN_WHITELIST_MEDIA_DIR, 0755);
-                if (rv == -1)
-                        errExit("mkdir");
-                if (chown(RUN_WHITELIST_MEDIA_DIR, 0, 0) < 0)
-                        errExit("chown");
-                if (chmod(RUN_WHITELIST_MEDIA_DIR, 0755) < 0)
-                        errExit("chmod");
+                // some distros don't have a /media directory
+                struct stat s;
+                if (stat("/media", &s) == 0) {
+                        // keep a copy of real /media directory in RUN_WHITELIST_MEDIA_DIR
+                        int rv = mkdir(RUN_WHITELIST_MEDIA_DIR, 0755);
+                        if (rv == -1)
+                                errExit("mkdir");
+                        if (chown(RUN_WHITELIST_MEDIA_DIR, 0, 0) < 0)
+                                errExit("chown");
+                        if (chmod(RUN_WHITELIST_MEDIA_DIR, 0755) < 0)
+                                errExit("chmod");
         
-                if (mount("/media", RUN_WHITELIST_MEDIA_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                        errExit("mount bind");
+                        if (mount("/media", RUN_WHITELIST_MEDIA_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                                errExit("mount bind");
         
-                // mount tmpfs on /media
-                if (arg_debug || arg_debug_whitelists)
-                        printf("Mounting tmpfs on /media directory\n");
-                if (mount("tmpfs", "/media", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
-                        errExit("mounting tmpfs on /media");
-                fs_logger("tmpfs /media");
+                        // mount tmpfs on /media
+                        if (arg_debug || arg_debug_whitelists)
+                                printf("Mounting tmpfs on /media directory\n");
+                        if (mount("tmpfs", "/media", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                                errExit("mounting tmpfs on /media");
+                        fs_logger("tmpfs /media");
+                }
+                else
+                        media_dir = 0;
         }
 
         // /var mountpoint
diff --git a/src/firejail/join.c b/src/firejail/join.c
index 948c7ef71..414b899ce 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -309,14 +309,15 @@ void join(pid_t pid, int argc, char **argv, int index) {
                                 printf("Joining user namespace\n");
                         if (join_namespace(1, "user"))
                                 exit(1);
+
+                        // user namespace resets capabilities
+                        // set caps filter
+                        if (apply_caps == 1)    // not available for uid 0
+                                caps_set(caps);
                 }
                 else 
                         drop_privs(arg_nogroups);       // nogroups not available for uid 0
 
-                // user namespace resets capabilities
-                // set caps filter
-                if (apply_caps == 1)    // not available for uid 0
-                        caps_set(caps);
 
                 // set prompt color to green
                 char *prompt = getenv("FIREJAIL_PROMPT");
diff --git a/src/firejail/main.c b/src/firejail/main.c
index dbb92a899..501bccff2 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -46,6 +46,7 @@ printf("time %s:%d %u\n", __FILE__, __LINE__, (uint32_t) systick);
 #endif
 
 uid_t firejail_uid = 0;
+gid_t firejail_gid = 0;
 
 #define STACK_SIZE (1024 * 1024)
 static char child_stack[STACK_SIZE];            // space for child's stack
@@ -606,6 +607,9 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                                 exit(1);
                         }
                         
+                        if (!cfg.shell && !arg_shell_none)
+                                cfg.shell = guess_shell();
+
                         // join sandbox by pid or by name
                         pid_t pid;
                         if (read_pid(argv[i] + 15, &pid) == 0)          
@@ -629,6 +633,9 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                         exit(1);
                 }
                 
+                if (!cfg.shell && !arg_shell_none)
+                        cfg.shell = guess_shell();
+
                 // join sandbox by pid or by name
                 pid_t pid;
                 if (read_pid(argv[i] + 18, &pid) == 0)          
diff --git a/src/include/euid_common.h b/src/include/euid_common.h
index de5572fb1..752df5fff 100644
--- a/src/include/euid_common.h
+++ b/src/include/euid_common.h
@@ -31,6 +31,7 @@
 }
 
 extern uid_t firejail_uid;
+extern uid_t firejail_gid;
 
 
 
@@ -44,16 +45,18 @@ static inline void EUID_ROOT(void) {
 static inline void EUID_USER(void) {
         if (seteuid(firejail_uid) == -1)
                 errExit("seteuid");
-        if (setegid(firejail_uid) == -1)
+        if (setegid(firejail_gid) == -1)
                 errExit("setegid");
 }
 
 static inline void EUID_PRINT(void) {
         printf("debug: uid %d, euid %d\n", getuid(), geteuid());
+        printf("debug: gid %d, egid %d\n", getgid(), getegid());
 }
 
 static inline void EUID_INIT(void) {
         firejail_uid = getuid();
+        firejail_gid = getgid();
 }
 
 #endif
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 35b84b981..dbb0df233 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -578,19 +578,19 @@ $ firejail --net=eth0 --name=browser firefox &
 .br
 # change netfilter configuration
 .br
-$ sudo firejail --join-network=browser "cat /etc/firejail/nolocal.net | /sbin/iptables-restore"
+$ sudo firejail --join-network=browser bash -c "cat /etc/firejail/nolocal.net | /sbin/iptables-restore"
 .br
 
 .br
 # verify netfilter configuration
 .br
-$ sudo firejail --join-network=browser "/sbin/iptables -vL"
+$ sudo firejail --join-network=browser /sbin/iptables -vL
 .br
 
 .br
 # verify  IP addresses
 .br
-$ sudo firejail --join-network=browser "ip addr"
+$ sudo firejail --join-network=browser ip addr
 .br
 Switching to pid 1932, the first child process inside the sandbox
 .br