From 82c353409ab09554c2a4f3517f8e654725d8da46 Mon Sep 17 00:00:00 2001 From: netblue30 Date: Wed, 27 Jul 2016 17:53:09 -0400 Subject: symlink whitelist fix --- src/firejail/fs_whitelist.c | 3 +++ src/man/firejail.txt | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c index f94040d0f..e3668140d 100644 --- a/src/firejail/fs_whitelist.c +++ b/src/firejail/fs_whitelist.c @@ -401,6 +401,9 @@ void fs_whitelist(void) { struct stat s; if (stat(fname, &s) == 0 && s.st_uid != getuid()) goto errexit; + + // set nonewprivs + arg_nonewprivs = 1; } } else if (strncmp(new_name, "/tmp/", 5) == 0) { diff --git a/src/man/firejail.txt b/src/man/firejail.txt index d8bd34f10..65744235e 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt @@ -949,6 +949,10 @@ cannot acquire new privileges using execve(2); in particular, this means that calling a suid binary (or one with file capabilities) does not result in an increase of privilege. +--nonewprivs is enabled by default if seccomp filter is activated, or if a +symbolic link in user home directory pointing outside user home +is whitelisted. + .TP \fB\-\-nosound Disable sound system. -- cgit v1.2.3-54-g00ecf