diff --git a/RELNOTES b/RELNOTES
index c0fb8b20b0c..7aeac4f8dd5 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,7 +1,10 @@
 firejail (0.9.45) baseline; urgency=low
   * development version, work in progress
- -- netblue30 <netblue30@yahoo.com>  Sun, 23 Oct 2016 08:00:00 -0500
+  * security: overwrite /etc/resolv.conf found by Martin Carpenter
+  * feature: split most of networking code in a separate executable
   * new profiles: xiphos, Tor Browser Bundle
+  * bugfixes
+ -- netblue30 <netblue30@yahoo.com>  Sun, 23 Oct 2016 08:00:00 -0500
 
 firejail (0.9.44) baseline; urgency=low
   * CVE-2016-7545 submitted by Aleksey Manevich
diff --git a/src/firejail/main.c b/src/firejail/main.c
index b5a97c71e4b..f41d5fcd312 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1605,6 +1605,14 @@ int main(int argc, char **argv) {
 					return 1;
 				}
 				
+				// don't allow "--chroot=/"
+				char *rpath = realpath(cfg.chrootdir, NULL);
+				if (rpath == NULL || strcmp(rpath, "/") == 0) {
+					fprintf(stderr, "Error: invalid chroot directory\n");
+					exit(1);
+				}
+				free(rpath);
+				
 				// check chroot directory structure
 				if (fs_check_chroot_dir(cfg.chrootdir)) {
 					fprintf(stderr, "Error: invalid chroot\n");
diff --git a/src/firejail/util.c b/src/firejail/util.c
index f38b02fd095..4b2e09953a1 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -171,11 +171,17 @@ void logerr(const char *msg) {
 }
 
 
-// return -1 if error, 0 if no error
+// return -1 if error, 0 if no error; if destname already exists, return error
 int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode) {
 	assert(srcname);
 	assert(destname);
 
+	struct stat s;
+	if (stat(destname, &s) == 0) {
+		fprintf(stderr, "Error: file %s already exists\n", destname);
+		return -1;
+	}
+
 	// open source
 	int src = open(srcname, O_RDONLY);
 	if (src < 0) {