Operation not permitted when calling clone() in main() in main.c:

[myanowitz]

I have firejail version 0.9.65 installed and Ubuntu 18.04 installed.

I am calling main() (renamed) in main.c in the firejail source code. I am trying some simple unit tests
but when it gets down to the call to clone() near the end of main(), I get “Operation not permitted”. I can run
if I sudo to root, but not as a regular user.
I can also run the same firejail command from the command line successfully.

What do I need to change to enable this to work for a normal user?

For example, this works ok:

sudo ./firejail_tests
[sudo] password for : 
Running main() from ./googletest-src/googletest/src/gtest_main.cc
[==========] Running 9 tests from 1 test case.
[----------] Global test environment set-up.
[----------] 9 tests from Firejail
[ RUN      ] Firejail.empty
argc      argv
=============================================================
0     firejail
1     --noprofile
2     pwd
Parent pid 86333, child pid 86334
The new log directory is /proc/86334/root/var/log
Child process initialized in 416.06 ms
./platform

Parent is shutting down, bye...

But when run as a regular user (who may not know root's password) I get:

./firejail_tests
Running main() from ./googletest-src/googletest/src/gtest_main.cc
[==========] Running 9 tests from 1 test case.
[----------] Global test environment set-up.
[----------] 9 tests from Firejail
[ RUN      ] Firejail.empty
argc      argv
=============================================================
0     firejail
1     --noprofile
2     pwd
Error clone: ./libfirejail/firejail/main.c:3276 SetupFirejail: Operation not permitted
Parent pid 86328, child pid 4294967295
Error setreuid: ./libfirejail/firejail/main.c:3294 SetupFirejail: Operation not permitted
Error setregid: ./libfirejail/firejail/main.c:3296 SetupFirejail: Operation not permitted

[rusty-snake]

From clone(2):

       EPERM  CLONE_NEWCGROUP, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWNS, CLONE_NEWPID, or CLONE_NEWUTS was specified  by  an  un‐
              privileged process (process without CAP_SYS_ADMIN).

       EPERM  CLONE_PID was specified by a process other than process 0.  (This error occurs only on Linux 2.5.15 and earlier.)

       EPERM  CLONE_NEWUSER  was  specified in the flags mask, but either the effective user ID or the effective group ID of the
              caller does not have a mapping in the parent namespace (see user_namespaces(7)).

       EPERM (since Linux 3.9)
              CLONE_NEWUSER was specified in the flags mask and the caller is in a chroot environment (i.e., the  caller's  root
              directory does not match the root directory of the mount namespace in which it resides).

       EPERM (clone3() only)
              set_tid_size  was  greater than zero, and the caller lacks the CAP_SYS_ADMIN capability in one or more of the user
              namespaces that own the corresponding PID namespaces.

Firejails code does not work as regular user, you need to start main with euid==0.

OT: Could we make firejail work with setcap SETUID SETGID SYS_ADMIN?