void fs_basic_fs(void) {
	uid_t uid = getuid();

	// mount a new proc filesystem
	if (arg_debug)
		printf("Mounting /proc filesystem representing the PID namespace\n");
	if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
		errExit("mounting /proc");

	EUID_USER();
	if (arg_debug)
		printf("Basic read-only filesystem:\n");
	if (!arg_writable_etc) {
		fs_remount("/etc", MOUNT_READONLY, 1);
		if (uid)
			fs_remount("/etc", MOUNT_NOEXEC, 1);
	}
	if (!arg_writable_var) {
		fs_remount("/var", MOUNT_READONLY, 1);
		if (uid)
			fs_remount("/var", MOUNT_NOEXEC, 1);
	}
	fs_remount("/usr", MOUNT_READONLY, 1);
	fs_remount("/bin", MOUNT_READONLY, 1);
	fs_remount("/sbin", MOUNT_READONLY, 1);
	fs_remount("/lib", MOUNT_READONLY, 1);
	fs_remount("/lib64", MOUNT_READONLY, 1);
	fs_remount("/lib32", MOUNT_READONLY, 1);
	fs_remount("/libx32", MOUNT_READONLY, 1);
	EUID_ROOT();

	// update /var directory in order to support multiple sandboxes running on the same root directory
	fs_var_lock();
	if (!arg_keep_var_tmp)
	  fs_var_tmp();
	if (!arg_writable_var_log)
		fs_var_log();
	else
		fs_remount("/var/log", MOUNT_RDWR_NOCHECK, 0);

	fs_var_lib();
	fs_var_cache();
	fs_var_utmp();
	fs_machineid();

	// don't leak user information
	restrict_users();

	// when starting as root, firejail config is not disabled;
	if (uid)
		disable_config();
}
void fs_basic_fs(void) {
	uid_t uid = getuid();

	 
	if (arg_debug)
		printf("Mounting /proc filesystem representing the PID namespace\n");
	if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
		errExit("mounting /proc");

	EUID_USER();
	if (arg_debug)
		printf("Basic read-only filesystem:\n");
	if (!arg_writable_etc) {
		fs_remount("/etc", MOUNT_READONLY, 1);
		if (uid)
			fs_remount("/etc", MOUNT_NOEXEC, 1);
	}
	if (!arg_writable_var) {
		fs_remount("/var", MOUNT_READONLY, 1);
		if (uid)
			fs_remount("/var", MOUNT_NOEXEC, 1);
	}
	fs_remount("/usr", MOUNT_READONLY, 1);
	fs_remount("/bin", MOUNT_READONLY, 1);
	fs_remount("/sbin", MOUNT_READONLY, 1);
	fs_remount("/lib", MOUNT_READONLY, 1);
	fs_remount("/lib64", MOUNT_READONLY, 1);
	fs_remount("/lib32", MOUNT_READONLY, 1);
	fs_remount("/libx32", MOUNT_READONLY, 1);
	EUID_ROOT();

	 
	fs_var_lock();
	if (!arg_keep_var_tmp)
	  fs_var_tmp();
	if (!arg_writable_var_log)
		fs_var_log();
	else
		fs_remount("/var/log", MOUNT_RDWR_NOCHECK, 0);

	fs_var_lib();
	fs_var_cache();
	fs_var_utmp();
	fs_machineid();

	 
	restrict_users();

	 
	if (uid)
		disable_config();
}