From 1c0428dba28299b66380c8c05770d6619383d758 Mon Sep 17 00:00:00 2001
From: The Fox in the Shell <KellerFuchs@hashbang.sh>
Date: Wed, 25 May 2016 14:59:30 +0200
Subject: Add force-nonewprivs setting

---
 src/firejail/checkcfg.c     | 11 +++++++++++
 src/firejail/firejail.h     |  3 ++-
 src/firejail/sandbox.c      |  2 +-
 src/man/firejail-config.txt |  8 ++++++++
 4 files changed, 22 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 430b0c5a6..4fdbe1897 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -36,7 +36,9 @@ int checkcfg(int val) {
 		int i;
 		for (i = 0; i < CFG_MAX; i++)
 			cfg_val[i] = 1; // most of them are enabled by default
+
 		cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
+		cfg_val[CFG_FORCE_NONEWPRIVS  ] = 0; // disabled by default
 		
 		// open configuration file
 		char *fname;
@@ -106,6 +108,15 @@ int checkcfg(int val) {
 				else
 					goto errout;
 			}
+			// nonewprivs
+			else if (strncmp(ptr, "force-nonewprivs ", 17) == 0) {
+				if (strcmp(ptr + 17, "yes") == 0)
+					cfg_val[CFG_SECCOMP] = 1;
+				else if (strcmp(ptr + 17, "no") == 0)
+					cfg_val[CFG_SECCOMP] = 0;
+				else
+					goto errout;
+			}
 			// seccomp
 			else if (strncmp(ptr, "seccomp ", 8) == 0) {
 				if (strcmp(ptr + 8, "yes") == 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index c9c090a97..661073730 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -566,7 +566,8 @@ void sandboxfs(int op, pid_t pid, const char *patqh);
 #define CFG_SECCOMP 5
 #define CFG_NETWORK 6
 #define CFG_RESTRICTED_NETWORK 7
-#define CFG_MAX 8 // this should always be the last entry
+#define CFG_FORCE_NONEWPRIVS 8
+#define CFG_MAX 9 // this should always be the last entry
 int checkcfg(int val);
 
 // fs_rdwr.c
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 843c1efe5..6133a610d 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -750,7 +750,7 @@ int sandbox(void* sandbox_arg) {
 	//****************************************
 	// Set NO_NEW_PRIVS if desired
 	//****************************************
-	if (arg_nonewprivs) {
+	if (arg_nonewprivs || checkcfg(CFG_FORCE_NONEWPRIVS)) {
 		int no_new_privs = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
 
 		if(no_new_privs != 0)
diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt
index fcf4109ee..dcede2ec6 100644
--- a/src/man/firejail-config.txt
+++ b/src/man/firejail-config.txt
@@ -48,6 +48,14 @@ Enable or disable user namespace support, default enabled.
 \fBx11
 Enable or disable X11 sandboxing support, default enabled.
 
+.TP
+\fBforce-nonewprivs
+Force use of nonewprivs.  This mitigates the possibility of
+a user abusing firejail's features to trick a privileged (suid
+or file capabilities) process into loading code or configuration
+that is partially under their control.  Default disabled.
+
+
 .TP
 \fBxephyr-screen
 Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for
-- 
cgit v1.2.3-70-g09d2