diff --git a/src/firejail/main.c b/src/firejail/main.c index eca2846e2b0..c10ad17a56c 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c @@ -3144,17 +3144,21 @@ int main(int argc, char **argv, char **envp) { } // add audio group - g = get_group_id("audio"); - if (g) { - sprintf(ptr, "%d %d 1\n", g, g); - ptr += strlen(ptr); + if (!arg_nosound) { + g = get_group_id("audio"); + if (g) { + sprintf(ptr, "%d %d 1\n", g, g); + ptr += strlen(ptr); + } } // add video group - g = get_group_id("video"); - if (g) { - sprintf(ptr, "%d %d 1\n", g, g); - ptr += strlen(ptr); + if (!arg_novideo) { + g = get_group_id("video"); + if (g) { + sprintf(ptr, "%d %d 1\n", g, g); + ptr += strlen(ptr); + } } // add games group diff --git a/src/firejail/util.c b/src/firejail/util.c index 5bb5c257ba8..969578aeb4a 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c @@ -142,14 +142,11 @@ static void clean_supplementary_groups(gid_t gid) { goto clean_all; // clean supplementary group list - // allow only firejail, tty, audio, video, games gid_t new_groups[MAX_GROUPS]; int new_ngroups = 0; char *allowed[] = { "firejail", "tty", - "audio", - "video", "games", NULL }; @@ -161,6 +158,16 @@ static void clean_supplementary_groups(gid_t gid) { i++; } + if (!arg_nosound) { + copy_group_ifcont("audio", groups, ngroups, + new_groups, &new_ngroups, MAX_GROUPS); + } + + if (!arg_novideo) { + copy_group_ifcont("video", groups, ngroups, + new_groups, &new_ngroups, MAX_GROUPS); + } + if (new_ngroups) { rv = setgroups(new_ngroups, new_groups); if (rv)