6 files changed, 13 insertions, 15 deletions

diff --git a/src/firejail/env.c b/src/firejail/env.c
index f5e9dd980..ad16de037 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -262,7 +262,7 @@ static const char * const env_whitelist[] = {
         "LANG",
         "LANGUAGE",
         "LC_MESSAGES",
-        "PATH",
+        // "PATH",
         "DISPLAY"       // required by X11
 };
 
@@ -311,6 +311,10 @@ void env_apply_whitelist(void) {
                 errExit("clearenv");
 
         env_apply_list(env_whitelist, ARRAY_SIZE(env_whitelist));
+
+        // hardcoding PATH
+        if (setenv("PATH", "/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin", 1) < 0)
+                errExit("setenv");
 }
 
 // Filter env variables for a sbox app
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 5ac2da164..dd4c2139d 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -108,7 +108,7 @@ static void disable_file(OPERATION op, const char *filename) {
         }
 
         // check for firejail executable
-        // we migth have a file found in ${PATH} pointing to /usr/bin/firejail
+        // we might have a file found in ${PATH} pointing to /usr/bin/firejail
         // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird
         //     and expects Firefox to open in the same sandbox
         if (strcmp(BINDIR "/firejail", fname) == 0) {
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index 1a9a78ceb..7d320e90b 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -93,10 +93,6 @@ char *fs_check_hosts_file(const char *fname) {
         invalid_filename(fname, 0); // no globbing
         char *rv = expand_macros(fname);
 
-        // no a link
-        if (is_link(rv))
-                goto errexit;
-
         // the user has read access to the file
         if (access(rv, R_OK))
                 goto errexit;
@@ -119,9 +115,6 @@ void fs_mount_hosts_file(void) {
         struct stat s;
         if (stat("/etc/hosts", &s) == -1)
                 goto errexit;
-        // not a link
-        if (is_link("/etc/hosts"))
-                goto errexit;
         // owned by root
         if (s.st_uid != 0)
                 goto errexit;
diff --git a/src/firejail/join.c b/src/firejail/join.c
index 99fbfdd0a..a869f6b64 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -551,10 +551,6 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 if (cfg.cpus)   // not available for uid 0
                         set_cpu_affinity();
 
-                // set nice value
-                if (arg_nice)
-                        set_nice(cfg.nice);
-
                 // add x11 display
                 if (display) {
                         char *display_str;
@@ -573,6 +569,11 @@ void join(pid_t pid, int argc, char **argv, int index) {
                         dbus_set_system_bus_env();
 #endif
 
+                // set nice and rlimits
+                if (arg_nice)
+                        set_nice(cfg.nice);
+                set_rlimits();
+
                 start_application(0, shfd, NULL);
 
                 __builtin_unreachable();
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index b7c7185a6..059100fcb 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1938,7 +1938,7 @@ char *profile_list_compress(char *list)
                         /* Include non-empty item */
                         if (!*item)
                                 in[i] = 0;
-                        /* Remove all allready included items */
+                        /* Remove all already included items */
                         for (k = 0; k < i; ++k)
                                 in[k] = 0;
                         break;
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index d0d3c25e8..a768829a1 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -606,7 +606,7 @@ Allow the application to see but not talk to the name org.freedesktop.Notificati
 Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
 .TP
 \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
-Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
+Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
 .TP
 \fBdbus-user filter
 Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands.