fix caps.keep/dac-overwrite

onny · Sep 5, 2017 · b3f3992 · b3f3992
1 parent 1649708
commit b3f3992
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/README b/README
@@ -411,6 +411,8 @@ smithsohu (https://github.com/smitsohu)
  - fixed device discovery for simple-scan
  - add novideo support in many profiles
  - improve server profiles, harden musescore
+ - snap profile cleanup
+ - tighten some capability sets further
 soredake (https://github.com/soredake)
  - fix steam startup with >=llvm-4
 SpotComms (https://github.com/SpotComms)

diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
@@ -107,7 +107,9 @@ static void set_caps(void) {
  caps_default_filter();
 
  // drop discretionary access control capabilities for root sandboxes
- caps_drop_dac_override();
+ // if caps.keep, the user has to set it manually in the list
+ if (!arg_caps_keep)
+ caps_drop_dac_override();
 }
 
 void save_nogroups(void) {