Code: static int store_xauthority(void) {
	fs_build_mnt_dir();

	char *src;
	char *dest = RUN_XAUTHORITY_FILE;
	FILE *fp = fopen(dest, "w");
	if (fp) {
		fprintf(fp, "\n");
		SET_PERMS_STREAM(fp, getuid(), getgid(), 0600);
		fclose(fp);
	}
	
	if (asprintf(&src, "%s/.Xauthority", cfg.homedir) == -1)
		errExit("asprintf");
	
	struct stat s;
	if (stat(src, &s) == 0) {
		if (is_link(src)) {
			fprintf(stderr, "Warning: invalid .Xauthority file\n");
 			return 0;
 		}
 
		pid_t child = fork();
		if (child < 0)
			errExit("fork");
		if (child == 0) {
			drop_privs(0);
			int rv = copy_file(src, dest, getuid(), getgid(), 0600);
			if (rv)
				fprintf(stderr, "Warning: cannot transfer .Xauthority in private home directory\n");
			else {
				fs_logger2("clone", dest);
			}
			_exit(0);
		}
		waitpid(child, NULL, 0);
 		return 1; // file copied
 	}
 	
	return 0;
}

Vulnerability Type: 
CWE ID: CWE-269
Summary: Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent accessing user files with an euid of zero, which allows local users to conduct sandbox-escape attacks via vectors involving a symlink and the --private option. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-5180.
Commit Message: replace copy_file with copy_file_as_user