Merge remote-tracking branch 'upstream/master'

26 files changed, 327 insertions, 731 deletions

diff --git a/README b/README
index 50bc00099..7599f4cf1 100644
--- a/README
+++ b/README
@@ -80,6 +80,8 @@ Fred-Barclay (https://github.com/Fred-Barclay)
         - evince profile enhancement
         - tightened Spotify profile
         - added xiphos and Tor Browser Bundle profiles
+BogDan Vatra (https://github.com/bog-dan-ro)
+        - zoom profile
 Impyy (https://github.com/Impyy)
         - added mumble profile
 valoq (https://github.com/valoq)
@@ -88,6 +90,8 @@ valoq (https://github.com/valoq)
         - added support for /srv in --whitelist feature
         - Eye of GNOME, Evolution, display (imagemagik) and Wire profiles
         - blacklist suid binaries in disable-common.inc
+        - fix man pages
+        - various profile improvements
 Vadim A. Misbakh-Soloviov (https://github.com/msva)
         - profile fixes
 Rafael Cavalcanti (https://github.com/rccavalcanti)
diff --git a/README.md b/README.md
index c6484d3b7..931b27ef3 100644
--- a/README.md
+++ b/README.md
@@ -52,5 +52,5 @@ Use this issue to request new profiles: https://github.com/netblue30/firejail/is
 
 `````
 ## New Profiles
-xiphos, Tor Browser Bundle, display (imagemagik), Wire, mumble
+xiphos, Tor Browser Bundle, display (imagemagik), Wire, mumble, zoom
 
diff --git a/etc/evince.profile b/etc/evince.profile
index 9a9113c70..cbb2083f4 100644
--- a/etc/evince.profile
+++ b/etc/evince.profile
@@ -6,7 +6,7 @@ include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
 netfilter
-net none
+#net none - creates some problems on some distributions
 nogroups
 nonewprivs
 noroot
diff --git a/etc/firefox.profile b/etc/firefox.profile
index 7875ca6b9..7862bd010 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -47,8 +47,7 @@ whitelist ~/.config/pipelight-silverlight5.1
 include /etc/firejail/whitelist-common.inc
 
 # experimental features
-
-private-bin firefox,which,sh,dbus-launch,dbus-send,env
-private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
+#private-bin firefox,which,sh,dbus-launch,dbus-send,env
+#private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
 private-dev
 private-tmp
diff --git a/etc/mupdf.profile b/etc/mupdf.profile
index 65e6a8978..e022866e8 100644
--- a/etc/mupdf.profile
+++ b/etc/mupdf.profile
@@ -16,7 +16,7 @@ net none
 shell none
 tracelog
 
-seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
+#seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsockname,getsockopt,lseek,lstat,mlock,mmap,mprotect,munmap,nanosleep,open,poll,prctl,read,recvfrom,recvmsg,restart_syscall,rt_sigaction,rt_sigprocmask,select,sendmsg,set_robust_list,set_tid_address,setresgid,setresuid,shmat,shmctl,shmget,shutdown,socket,stat,sysinfo,uname,unshare,wait4,write,writev
 
 private-bin mupdf
 private-tmp
diff --git a/etc/zoom.profile b/etc/zoom.profile
new file mode 100644
index 000000000..f5831dd88
--- /dev/null
+++ b/etc/zoom.profile
@@ -0,0 +1,23 @@
+# Firejail profile for zoom.us
+
+noblacklist ~/.config/zoomus.conf
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+
+
+# Whitelists
+
+mkdir ~/.zoom
+whitelist ~/.zoom
+
+
+caps.drop all
+netfilter
+nonewprivs
+noroot
+protocol unix,inet,inet6
+seccomp
+
+private-tmp
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index df660ab4f..ae8db5a67 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -171,3 +171,4 @@
 /etc/firejail/display.profile
 /etc/firejail/Wire.profile
 /etc/firejail/mumble.profile
+/etc/firejail/zoom.profile
diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c
index ab9714afe..512cc0b05 100644
--- a/src/firejail/bandwidth.c
+++ b/src/firejail/bandwidth.c
@@ -462,7 +462,7 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
         arg[1] = "-c";
         arg[2] = cmd;
         arg[3] = NULL;
-        assert(getenv("LD_PRELOAD") == NULL);   
+        clearenv();
         execvp(arg[0], arg);
         
         // it will never get here
diff --git a/src/firejail/errno.c b/src/firejail/errno.c
deleted file mode 100644
index 8215c99a1..000000000
--- a/src/firejail/errno.c
+++ /dev/null
@@ -1,207 +0,0 @@
-/*
- * Copyright (C) 2014-2016 Firejail Authors
- *
- * This file is part of firejail project
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-#ifdef HAVE_SECCOMP
-#include "firejail.h"
-#include <errno.h>
-//#include <attr/xattr.h>
-
-typedef struct {
-        char *name;
-        int nr;
-} ErrnoEntry;
-
-static ErrnoEntry errnolist[] = {
-//
-// code generated using tools/extract-errnos
-//
-        {"EPERM", EPERM},
-        {"ENOENT", ENOENT},
-        {"ESRCH", ESRCH},
-        {"EINTR", EINTR},
-        {"EIO", EIO},
-        {"ENXIO", ENXIO},
-        {"E2BIG", E2BIG},
-        {"ENOEXEC", ENOEXEC},
-        {"EBADF", EBADF},
-        {"ECHILD", ECHILD},
-        {"EAGAIN", EAGAIN},
-        {"ENOMEM", ENOMEM},
-        {"EACCES", EACCES},
-        {"EFAULT", EFAULT},
-        {"ENOTBLK", ENOTBLK},
-        {"EBUSY", EBUSY},
-        {"EEXIST", EEXIST},
-        {"EXDEV", EXDEV},
-        {"ENODEV", ENODEV},
-        {"ENOTDIR", ENOTDIR},
-        {"EISDIR", EISDIR},
-        {"EINVAL", EINVAL},
-        {"ENFILE", ENFILE},
-        {"EMFILE", EMFILE},
-        {"ENOTTY", ENOTTY},
-        {"ETXTBSY", ETXTBSY},
-        {"EFBIG", EFBIG},
-        {"ENOSPC", ENOSPC},
-        {"ESPIPE", ESPIPE},
-        {"EROFS", EROFS},
-        {"EMLINK", EMLINK},
-        {"EPIPE", EPIPE},
-        {"EDOM", EDOM},
-        {"ERANGE", ERANGE},
-        {"EDEADLK", EDEADLK},
-        {"ENAMETOOLONG", ENAMETOOLONG},
-        {"ENOLCK", ENOLCK},
-        {"ENOSYS", ENOSYS},
-        {"ENOTEMPTY", ENOTEMPTY},
-        {"ELOOP", ELOOP},
-        {"EWOULDBLOCK", EWOULDBLOCK},
-        {"ENOMSG", ENOMSG},
-        {"EIDRM", EIDRM},
-        {"ECHRNG", ECHRNG},
-        {"EL2NSYNC", EL2NSYNC},
-        {"EL3HLT", EL3HLT},
-        {"EL3RST", EL3RST},
-        {"ELNRNG", ELNRNG},
-        {"EUNATCH", EUNATCH},
-        {"ENOCSI", ENOCSI},
-        {"EL2HLT", EL2HLT},
-        {"EBADE", EBADE},
-        {"EBADR", EBADR},
-        {"EXFULL", EXFULL},
-        {"ENOANO", ENOANO},
-        {"EBADRQC", EBADRQC},
-        {"EBADSLT", EBADSLT},
-        {"EDEADLOCK", EDEADLOCK},
-        {"EBFONT", EBFONT},
-        {"ENOSTR", ENOSTR},
-        {"ENODATA", ENODATA},
-        {"ETIME", ETIME},
-        {"ENOSR", ENOSR},
-        {"ENONET", ENONET},
-        {"ENOPKG", ENOPKG},
-        {"EREMOTE", EREMOTE},
-        {"ENOLINK", ENOLINK},
-        {"EADV", EADV},
-        {"ESRMNT", ESRMNT},
-        {"ECOMM", ECOMM},
-        {"EPROTO", EPROTO},
-        {"EMULTIHOP", EMULTIHOP},
-        {"EDOTDOT", EDOTDOT},
-        {"EBADMSG", EBADMSG},
-        {"EOVERFLOW", EOVERFLOW},
-        {"ENOTUNIQ", ENOTUNIQ},
-        {"EBADFD", EBADFD},
-        {"EREMCHG", EREMCHG},
-        {"ELIBACC", ELIBACC},
-        {"ELIBBAD", ELIBBAD},
-        {"ELIBSCN", ELIBSCN},
-        {"ELIBMAX", ELIBMAX},
-        {"ELIBEXEC", ELIBEXEC},
-        {"EILSEQ", EILSEQ},
-        {"ERESTART", ERESTART},
-        {"ESTRPIPE", ESTRPIPE},
-        {"EUSERS", EUSERS},
-        {"ENOTSOCK", ENOTSOCK},
-        {"EDESTADDRREQ", EDESTADDRREQ},
-        {"EMSGSIZE", EMSGSIZE},
-        {"EPROTOTYPE", EPROTOTYPE},
-        {"ENOPROTOOPT", ENOPROTOOPT},
-        {"EPROTONOSUPPORT", EPROTONOSUPPORT},
-        {"ESOCKTNOSUPPORT", ESOCKTNOSUPPORT},
-        {"EOPNOTSUPP", EOPNOTSUPP},
-        {"EPFNOSUPPORT", EPFNOSUPPORT},
-        {"EAFNOSUPPORT", EAFNOSUPPORT},
-        {"EADDRINUSE", EADDRINUSE},
-        {"EADDRNOTAVAIL", EADDRNOTAVAIL},
-        {"ENETDOWN", ENETDOWN},
-        {"ENETUNREACH", ENETUNREACH},
-        {"ENETRESET", ENETRESET},
-        {"ECONNABORTED", ECONNABORTED},
-        {"ECONNRESET", ECONNRESET},
-        {"ENOBUFS", ENOBUFS},
-        {"EISCONN", EISCONN},
-        {"ENOTCONN", ENOTCONN},
-        {"ESHUTDOWN", ESHUTDOWN},
-        {"ETOOMANYREFS", ETOOMANYREFS},
-        {"ETIMEDOUT", ETIMEDOUT},
-        {"ECONNREFUSED", ECONNREFUSED},
-        {"EHOSTDOWN", EHOSTDOWN},
-        {"EHOSTUNREACH", EHOSTUNREACH},
-        {"EALREADY", EALREADY},
-        {"EINPROGRESS", EINPROGRESS},
-        {"ESTALE", ESTALE},
-        {"EUCLEAN", EUCLEAN},
-        {"ENOTNAM", ENOTNAM},
-        {"ENAVAIL", ENAVAIL},
-        {"EISNAM", EISNAM},
-        {"EREMOTEIO", EREMOTEIO},
-        {"EDQUOT", EDQUOT},
-        {"ENOMEDIUM", ENOMEDIUM},
-        {"EMEDIUMTYPE", EMEDIUMTYPE},
-        {"ECANCELED", ECANCELED},
-        {"ENOKEY", ENOKEY},
-        {"EKEYEXPIRED", EKEYEXPIRED},
-        {"EKEYREVOKED", EKEYREVOKED},
-        {"EKEYREJECTED", EKEYREJECTED},
-        {"EOWNERDEAD", EOWNERDEAD},
-        {"ENOTRECOVERABLE", ENOTRECOVERABLE},
-        {"ERFKILL", ERFKILL},
-        {"EHWPOISON", EHWPOISON},
-        {"ENOTSUP", ENOTSUP},
-#ifdef  ENOATTR
-        {"ENOATTR", ENOATTR},
-#endif  
-};
-
-int errno_highest_nr(void) {
-        int i, max = 0;
-        int elems = sizeof(errnolist) / sizeof(errnolist[0]);
-        for (i = 0; i < elems; i++) {
-                if (errnolist[i].nr > max)
-                        max = errnolist[i].nr;
-        }
-
-        return max;
-}
-
-int errno_find_name(const char *name) {
-        EUID_ASSERT();
-        
-        int i;
-        int elems = sizeof(errnolist) / sizeof(errnolist[0]);
-        for (i = 0; i < elems; i++) {
-                if (strcasecmp(name, errnolist[i].name) == 0)
-                        return errnolist[i].nr;
-        }
-
-        return -1;
-}
-
-char *errno_find_nr(int nr) {
-        int i;
-        int elems = sizeof(errnolist) / sizeof(errnolist[0]);
-        for (i = 0; i < elems; i++) {
-                if (nr == errnolist[i].nr)
-                        return errnolist[i].name;
-        }
-
-        return "unknown";
-}
-#endif // HAVE_SECCOMP
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index cf540ff91..56dbd6868 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -222,7 +222,6 @@ typedef struct config_t {
         char *seccomp_list;//  optional seccomp list on top of default filter
         char *seccomp_list_drop;        // seccomp drop list
         char *seccomp_list_keep;        // seccomp keep list
-        char **seccomp_list_errno;      // seccomp errno[nr] lists
         char *protocol;                 // protocol list
 
         // rlimits
@@ -496,12 +495,12 @@ void fs_private_home_list(void);
 
 
 // seccomp.c
+char *seccomp_check_list(const char *str);
 int seccomp_load(const char *fname);
 void seccomp_filter_32(void);
 void seccomp_filter_64(void);
 int seccomp_filter_drop(int enforce_seccomp);
 int seccomp_filter_keep(void);
-int seccomp_filter_errno(void);
 void seccomp_print_filter_name(const char *name);
 void seccomp_print_filter(pid_t pid);
 
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index d6fee0608..a3576e7c4 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -191,7 +191,7 @@ static void duplicate(char *fname) {
                                 char *f;
                                 if (asprintf(&f, "%s/%s", RUN_BIN_DIR, fname) == -1)
                                         errExit("asprintf");
-                                assert(getenv("LD_PRELOAD") == NULL);   
+                                clearenv();     
                                 execlp(RUN_CP_COMMAND, RUN_CP_COMMAND, "-a", actual_path, f, NULL);
                                 perror("execlp");
                                 _exit(1);
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 4f3417236..830de7c9f 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -105,7 +105,7 @@ static void duplicate(char *fname) {
                 char *f;
                 if (asprintf(&f, "/etc/%s", fname) == -1)
                         errExit("asprintf");
-                assert(getenv("LD_PRELOAD") == NULL);   
+                clearenv();     
                 execlp(RUN_CP_COMMAND, RUN_CP_COMMAND, "-a", "--parents", f, RUN_MNT_DIR, NULL);
                 perror("execlp");
                 _exit(1);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index fc86f9651..b6f3a7f59 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -851,9 +851,6 @@ int main(int argc, char **argv) {
         int custom_profile = 0; // custom profile loaded
         char *custom_profile_dir = NULL; // custom profile directory
         int arg_noprofile = 0; // use default.profile if none other found/specified
-#ifdef HAVE_SECCOMP
-        int highest_errno = errno_highest_nr();
-#endif
 
         // build /run/firejail directory structure
         preproc_build_firejail_dir();
@@ -1155,9 +1152,7 @@ int main(int argc, char **argv) {
                                         exit(1);
                                 }
                                 arg_seccomp = 1;
-                                cfg.seccomp_list = strdup(argv[i] + 10);
-                                if (!cfg.seccomp_list)
-                                        errExit("strdup");
+                                cfg.seccomp_list = seccomp_check_list(argv[i] + 10);
                         }
                         else {
                                 fprintf(stderr, "Error: seccomp feature is disabled in Firejail configuration file\n");
@@ -1171,9 +1166,7 @@ int main(int argc, char **argv) {
                                         exit(1);
                                 }
                                 arg_seccomp = 1;
-                                cfg.seccomp_list_drop = strdup(argv[i] + 15);
-                                if (!cfg.seccomp_list_drop)
-                                        errExit("strdup");
+                                cfg.seccomp_list_drop = seccomp_check_list(argv[i] + 15);
                         }
                         else {
                                 fprintf(stderr, "Error: seccomp feature is disabled in Firejail configuration file\n");
@@ -1187,43 +1180,7 @@ int main(int argc, char **argv) {
                                         exit(1);
                                 }
                                 arg_seccomp = 1;
-                                cfg.seccomp_list_keep = strdup(argv[i] + 15);
-                                if (!cfg.seccomp_list_keep)
-                                        errExit("strdup");
-                        }
-                        else {
-                                fprintf(stderr, "Error: seccomp feature is disabled in Firejail configuration file\n");
-                                exit(1);
-                        }
-                }
-                else if (strncmp(argv[i], "--seccomp.e", 11) == 0 && strchr(argv[i], '=')) {
-                        if (checkcfg(CFG_SECCOMP)) {
-                                if (arg_seccomp && !cfg.seccomp_list_errno) {
-                                        fprintf(stderr, "Error: seccomp already enabled\n");
-                                        exit(1);
-                                }
-                                char *eq = strchr(argv[i], '=');
-                                char *errnoname = strndup(argv[i] + 10, eq - (argv[i] + 10));
-                                int nr = errno_find_name(errnoname);
-                                if (nr == -1) {
-                                        fprintf(stderr, "Error: unknown errno %s\n", errnoname);
-                                        free(errnoname);
-                                        exit(1);
-                                }
-        
-                                if (!cfg.seccomp_list_errno)
-                                        cfg.seccomp_list_errno = calloc(highest_errno+1, sizeof(cfg.seccomp_list_errno[0]));
-        
-                                if (cfg.seccomp_list_errno[nr]) {
-                                        fprintf(stderr, "Error: errno %s already configured\n", errnoname);
-                                        free(errnoname);
-                                        exit(1);
-                                }
-                                arg_seccomp = 1;
-                                cfg.seccomp_list_errno[nr] = strdup(eq+1);
-                                if (!cfg.seccomp_list_errno[nr])
-                                        errExit("strdup");
-                                free(errnoname);
+                                cfg.seccomp_list_keep = seccomp_check_list(argv[i] + 15);
                         }
                         else {
                                 fprintf(stderr, "Error: seccomp feature is disabled in Firejail configuration file\n");
@@ -2606,13 +2563,6 @@ int main(int argc, char **argv) {
         waitpid(child, &status, 0);
 
         // free globals
-#ifdef HAVE_SECCOMP
-        if (cfg.seccomp_list_errno) {
-                for (i = 0; i < highest_errno; i++)
-                        free(cfg.seccomp_list_errno[i]);
-                free(cfg.seccomp_list_errno);
-        }
-#endif
         if (cfg.profile) {
                 ProfileEntry *prf = cfg.profile;
                 while (prf != NULL) {
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index efef45d90..1df4b7a0f 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -143,8 +143,7 @@ void netfilter(const char *fname) {
                 dup2(fd,STDIN_FILENO);
 
                 // wipe out environment variables
-                environ = NULL;
-                assert(getenv("LD_PRELOAD") == NULL);   
+                clearenv();     
                 execl(iptables_restore, iptables_restore, NULL);
                 perror("execl");
                 _exit(1);
@@ -258,8 +257,7 @@ void netfilter6(const char *fname) {
                 dup2(fd,STDIN_FILENO);
 
                 // wipe out environment variables
-                environ = NULL;
-                assert(getenv("LD_PRELOAD") == NULL);   
+                clearenv();     
                 execl(ip6tables_restore, ip6tables_restore, NULL);
                 perror("execl");
                 _exit(1);
@@ -273,7 +271,7 @@ void netfilter6(const char *fname) {
                 if (child < 0)
                         errExit("fork");
                 if (child == 0) {
-                        environ = NULL;
+                        clearenv();     
                         execl(ip6tables, ip6tables, "-vL", NULL);
                         perror("execl");
                         _exit(1);
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index f7d5e87e6..f3a7eb727 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -529,9 +529,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #ifdef HAVE_SECCOMP
                 if (checkcfg(CFG_SECCOMP)) {
                         arg_seccomp = 1;
-                        cfg.seccomp_list = strdup(ptr + 8);
-                        if (!cfg.seccomp_list)
-                                errExit("strdup");
+                        cfg.seccomp_list = seccomp_check_list(ptr + 8);
                 }
                 else
                         fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
@@ -545,9 +543,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #ifdef HAVE_SECCOMP
                 if (checkcfg(CFG_SECCOMP)) {
                         arg_seccomp = 1;
-                        cfg.seccomp_list_drop = strdup(ptr + 13);
-                        if (!cfg.seccomp_list_drop)
-                                errExit("strdup");
+                        cfg.seccomp_list_drop = seccomp_check_list(ptr + 13);
                 }
                 else
                         fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
@@ -560,9 +556,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #ifdef HAVE_SECCOMP
                 if (checkcfg(CFG_SECCOMP)) {
                         arg_seccomp = 1;
-                        cfg.seccomp_list_keep= strdup(ptr + 13);
-                        if (!cfg.seccomp_list_keep)
-                                errExit("strdup");
+                        cfg.seccomp_list_keep= seccomp_check_list(ptr + 13);
                 }
                 else
                         fprintf(stderr, "Warning: user seccomp feature is disabled in Firejail configuration file\n");
@@ -576,7 +570,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_caps_list = strdup(ptr + 10);
                 if (!arg_caps_list)
                         errExit("strdup");
-                // verify seccomp list and exit if problems
+                // verify caps list and exit if problems
                 if (caps_check_list(arg_caps_list, NULL))
                         exit(1);
                 return 0;
@@ -588,7 +582,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_caps_list = strdup(ptr + 10);
                 if (!arg_caps_list)
                         errExit("strdup");
-                // verify seccomp list and exit if problems
+                // verify caps list and exit if problems
                 if (caps_check_list(arg_caps_list, NULL))
                         exit(1);
                 return 0;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index e3c95283d..556cb1fca 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -847,8 +847,6 @@ assert(0);
         if (arg_seccomp == 1) {
                 if (cfg.seccomp_list_keep)
                         seccomp_filter_keep();
-                else if (cfg.seccomp_list_errno)
-                        seccomp_filter_errno(); 
                 else
                         seccomp_filter_drop(enforce_seccomp);
         }
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index a5a067090..b16736dee 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -136,6 +136,21 @@ int sbox_run(unsigned filter, int num, ...) {
         if (child < 0)
                 errExit("fork");
         if (child == 0) {
+                // clean the new process
+                clearenv();
+                int max = 20; // getdtablesize() is overkill for a firejail process
+                for (i = 3; i < max; i++)
+                        close(i); // close open files
+                int fd = open("/dev/null",O_RDWR, 0);
+                if (fd != -1) {
+                        dup2 (fd, STDIN_FILENO);
+                        if (fd > 2)
+                                close (fd);
+                }
+                else // the user could run the sandbox without /dev/null
+                        close(STDIN_FILENO);
+                umask(027);     
+
                 // apply filters
                 if (filter & SBOX_CAPS_NONE) {
                         caps_drop_all();
@@ -165,7 +180,7 @@ int sbox_run(unsigned filter, int num, ...) {
                 else if (filter & SBOX_USER)
                         drop_privs(1);
 
-                assert(getenv("LD_PRELOAD") == NULL);   
+                clearenv();
                 if (arg[0])     // get rid of scan-build warning
                         execvp(arg[0], arg);
                 else
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 74d29fc9d..20807f5b1 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -22,6 +22,34 @@
 #include "firejail.h"
 #include "../include/seccomp.h"
 
+char *seccomp_check_list(const char *str) {
+        assert(str);
+        if (strlen(str) == 0) {
+                fprintf(stderr, "Error: empty syscall lists are not allowed\n");
+                exit(1);
+        }
+        
+        int len = strlen(str) + 1;
+        char *rv = malloc(len);
+        if (!rv)
+                errExit("malloc");
+        memset(rv, 0, len);
+        
+        const char *ptr1 = str;
+        char *ptr2 = rv;
+        while (*ptr1 != '\0') {
+                if (isalnum(*ptr1) || *ptr1 == '_' || *ptr1 == ',' || *ptr1 == ':')
+                        *ptr2++ = *ptr1++;
+                else {
+                        fprintf(stderr, "Error: invalid syscall list\n");
+                        exit(1);
+                }
+        }
+                                                
+        return rv;
+}
+
+
 int seccomp_load(const char *fname) {
         assert(fname);
 
@@ -136,10 +164,6 @@ int seccomp_filter_drop(int enforce_seccomp) {
 #endif
                 if (arg_debug)
                         printf("Build default+drop seccomp filter\n");
-                if (strlen(cfg.seccomp_list) == 0) {
-                        fprintf(stderr, "Error: empty syscall lists are not allowed\n");
-                        exit(1);
-                }
                 
                 // build the seccomp filter as a regular user
                 int rv;
@@ -157,10 +181,6 @@ int seccomp_filter_drop(int enforce_seccomp) {
         else if (cfg.seccomp_list == NULL && cfg.seccomp_list_drop) {
                 if (arg_debug)
                         printf("Build drop seccomp filter\n");
-                if (strlen(cfg.seccomp_list_drop) == 0) {
-                        fprintf(stderr, "Error: empty syscall lists are not allowed\n");
-                        exit(1);
-                }
 
                 // build the seccomp filter as a regular user
                 int rv;
@@ -199,10 +219,6 @@ int seccomp_filter_drop(int enforce_seccomp) {
 int seccomp_filter_keep(void) {
         if (arg_debug)
                 printf("Build drop seccomp filter\n");
-        if (strlen(cfg.seccomp_list_keep) == 0) {
-                fprintf(stderr, "Error: empty syscall lists are not allowed\n");
-                exit(1);
-        }
         
         // build the seccomp filter as a regular user
         int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 4,
@@ -216,38 +232,6 @@ int seccomp_filter_keep(void) {
         return seccomp_load(RUN_SECCOMP_CFG);
 }
 
-// errno filter for seccomp option
-int seccomp_filter_errno(void) {
-#if 0 //todo: disabled temporarely, bring it back
-        int i;
-        int higest_errno = errno_highest_nr();
-        filter_init();
-
-        // apply errno list
-
-        for (i = 0; i < higest_errno; i++) {
-                if (cfg.seccomp_list_errno[i]) {
-                        if (syscall_check_list(cfg.seccomp_list_errno[i], filter_add_errno, i)) {
-                                fprintf(stderr, "Error: cannot load seccomp filter\n");
-                                exit(1);
-                        }
-                }
-        }
-
-        filter_end_blacklist();
-        if (arg_debug)
-                filter_debug();
-
-        // save seccomp filter in  /run/firejail/mnt/seccomp
-        // in order to use it in --join operations
-        write_seccomp_file();
-        return seccomp_load(RUN_SECCOMP_CFG);
-#else
-printf("*** --seccomp.<errno> is temporarily disabled, it will be brought back soon ***\n");
-        return 0;
-#endif  
-}
-
 void seccomp_print_filter_name(const char *name) {
         EUID_ASSERT();
         if (!name || strlen(name) == 0) {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 7db91b5a9..c8bed06e3 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -23,381 +23,190 @@ void usage(void) {
         printf("firejail - version %s\n\n", VERSION);
         printf("Firejail is a SUID sandbox program that reduces the risk of security breaches by\n");
         printf("restricting the running environment of untrusted applications using Linux\n");
-        printf("namespaces. It includes a sandbox profile for Mozilla Firefox.\n\n");
+        printf("namespaces.\n");
         printf("\n");
-        printf("Usage: firejail [options] [program and arguments]\n\n");
+        printf("Usage: firejail [options] [program and arguments]\n");
         printf("\n");
-        printf("Without any options, the sandbox consists of a filesystem chroot build from the\n");
-        printf("current system directories  mounted  read-only,  and  new PID and IPC\n");
-        printf("namespaces. If no program is specified as an argument, /bin/bash is started by\n");
-        printf("default in the sandbox.\n\n");
-        printf("\n");
-        printf("Options:\n\n");
-        printf("    -- - signal the end of options and disables further option processing.\n\n");
-        printf("    --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n\n");
-        printf("    --allusers - all user home directories are visible inside the sandbox.\n\n");
-        printf("    --apparmor - enable AppArmor confinement\n\n");
-        printf("    --appimage - sandbox an AppImage application\n\n");
-        printf("    --audit - audit the sandbox, see Audit section for more details\n\n");
-        printf("    --audit=test-program - audit the sandbox, see Audit section for more details\n\n");
+        printf("Options:\n");
+        printf("    -- - signal the end of options and disables further option processing.\n");
+        printf("    --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n");
+        printf("    --allusers - all user home directories are visible inside the sandbox.\n");
+        printf("    --apparmor - enable AppArmor confinement.\n");
+        printf("    --appimage - sandbox an AppImage application.\n");
+        printf("    --audit[=test-program] - audit the sandbox.\n");
 #ifdef HAVE_NETWORK     
-        printf("    --bandwidth=name|pid - set  bandwidth  limits  for  the sandbox identified\n");
-        printf("\tby name or PID, see Traffic Shaping section fo more details.\n\n");
+        printf("    --bandwidth=name|pid - set  bandwidth  limits\n");
 #endif
 #ifdef HAVE_BIND                
-        printf("    --bind=dirname1,dirname2 - mount-bind dirname1 on top of dirname2.\n\n");
-        printf("    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n\n");
+        printf("    --bind=dirname1,dirname2 - mount-bind dirname1 on top of dirname2.\n");
+        printf("    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n");
 #endif
-        printf("    --blacklist=dirname_or_filename - blacklist directory or file.\n\n");
-        printf("    -c - execute command and exit.\n\n");
-        printf("    --caps - enable default Linux capabilities filter.\n\n");
-        printf("    --caps.drop=all - drop all capabilities.\n\n");
-        printf("    --caps.drop=capability,capability - blacklist capabilities filter.\n\n");
-        printf("    --caps.keep=capability,capability - whitelist capabilities filter.\n\n");
-        printf("    --caps.print=name|pid - print the caps filter for the sandbox identified\n");
-        printf("\tby name or PID.\n\n");
+        printf("    --blacklist=filename - blacklist directory or file.\n");
+        printf("    -c - execute command and exit.\n");
+        printf("    --caps - enable default Linux capabilities filter.\n");
+        printf("    --caps.drop=all - drop all capabilities.\n");
+        printf("    --caps.drop=capability,capability - blacklist capabilities filter.\n");
+        printf("    --caps.keep=capability,capability - whitelist capabilities filter.\n");
+        printf("    --caps.print=name|pid - print the caps filter.\n");
         printf("    --cgroup=tasks-file - place the sandbox in the specified control group.\n");
-        printf("\ttasks-file is the full path of cgroup tasks file.\n\n");
 #ifdef HAVE_CHROOT              
-        printf("    --chroot=dirname - chroot into directory.\n\n");
+        printf("    --chroot=dirname - chroot into directory.\n");
 #endif
-        printf("    --cpu=cpu-number,cpu-number - set cpu affinity.\n\n");
-        printf("    --cpu.print=name|pid - print the cup in use by the sandbox identified\n");
-        printf("\tby name or PID.\n\n");
-        printf("    --csh - use /bin/csh as default shell.\n\n");
-        
-        printf("    --debug - print sandbox debug messages.\n\n");
-        printf("    --debug-blacklists - debug blacklisting.\n\n");
-        printf("    --debug-caps - print all recognized capabilities in the current Firejail\n");
-        printf("\tsoftware build.\n\n");
-        printf("    --debug-check-filename - debug filename checking.\n\n");
-        printf("    --debug-errnos - print all recognized error numbers in the current Firejail\n");
-        printf("\tsoftware build.\n\n");
-        printf("    --debug-protocols - print all recognized protocols in the current Firejail\n");
-        printf("\tsoftware build.\n\n");
-        printf("    --debug-syscalls - print all recognized system calls in the current Firejail\n");
-        printf("\tsoftware build.\n\n");
+        printf("    --cpu=cpu-number,cpu-number - set cpu affinity.\n");
+        printf("    --cpu.print=name|pid - print the cpus in use.\n");
+        printf("    --csh - use /bin/csh as default shell.\n");
+        printf("    --debug - print sandbox debug messages.\n");
+        printf("    --debug-blacklists - debug blacklisting.\n");
+        printf("    --debug-caps - print all recognized capabilities.\n");
+        printf("    --debug-check-filename - debug filename checking.\n");
+        printf("    --debug-errnos - print all recognized error numbers.\n");
+        printf("    --debug-protocols - print all recognized protocols.\n");
+        printf("    --debug-syscalls - print all recognized system calls.\n");
 #ifdef HAVE_WHITELIST   
-        printf("    --debug-whitelists - debug whitelisting.\n\n");
+        printf("    --debug-whitelists - debug whitelisting.\n");
 #endif
-
-
 #ifdef HAVE_NETWORK     
-        printf("    --defaultgw=address - use this address as default gateway in the new network\n");
-        printf("\tnamespace.\n\n");
+        printf("    --defaultgw=address - configure default gateway.\n");
 #endif
-        printf("    --dns=address - set a DNS server for the sandbox. Up to three DNS servers\n");
-        printf("\tcan be defined.\n\n");
-        printf("    --dns.print=name|pid - print DNS configuration for the sandbox identified\n");
-        printf("\tby name or PID.\n\n");
-        
-        printf("    --env=name=value - set environment variable in the new sandbox.\n\n");
-        printf("    --fs.print=name|pid - print the filesystem log for the sandbox identified\n");
-        printf("\tby name or PID.\n\n");
-        printf("    --get=name|pid filename - get a file from sandbox container.\n\n");
-        printf("    --help, -? - this help screen.\n\n");
-        printf("    --hostname=name - set sandbox hostname.\n\n");
-        printf("    --ignore=command - ignore command in profile files.\n\n");
+        printf("    --dns=address - set DNS server.\n");
+        printf("    --dns.print=name|pid - print DNS configuration.\n");
+        
+        printf("    --env=name=value - set environment variable.\n");
+        printf("    --fs.print=name|pid - print the filesystem log.\n");
+        printf("    --get=name|pid filename - get a file from sandbox container.\n");
+        printf("    --help, -? - this help screen.\n");
+        printf("    --hostname=name - set sandbox hostname.\n");
+        printf("    --ignore=command - ignore command in profile files.\n");
 #ifdef HAVE_NETWORK     
-        printf("    --interface=name - move interface in a new network namespace. Up to four\n");
-        printf("\t--interface options can be specified.\n\n");
-        printf("    --ip=address - set interface IP address.\n\n");
-        printf("    --ip=none - no IP address and no default gateway address are configured\n");
-        printf("\tin the new network namespace. Use this option in case you intend to\n");
-        printf("\tstart an external DHCP client in the sandbox.\n\n");
-        printf("    --ip6=address - set interface IPv6 address.\n\n");
-        printf("    --iprange=address,address - configure an IP address in this range.\n\n");
+        printf("    --interface=name - move interface in sandbox.\n");
+        printf("    --ip=address - set interface IP address.\n");
+        printf("    --ip=none - no IP address and no default gateway are configured.\n");
+        printf("    --ip6=address - set interface IPv6 address.\n");
+        printf("    --iprange=address,address - configure an IP address in this range.\n");
 #endif
-        printf("    --ipc-namespace - enable a new IPC namespace if the sandbox was started as\n");
-        printf("\tregular user. IPC namespace is enabled by default only if the sandbox\n");
-        printf("\tis started as root.\n\n");
-        printf("    --join=name|pid - join the sandbox identified by name or PID.\n\n");
-        printf("    --join-filesystem=name|pid - join the mount namespace of the sandbox\n");
-        printf("\tidentified by name or PID.\n\n");
+        printf("    --ipc-namespace - enable a new IPC namespace.\n");
+        printf("    --join=name|pid - join the sandbox.\n");
+        printf("    --join-filesystem=name|pid - join the mount namespace.\n");
 #ifdef HAVE_NETWORK     
-        printf("    --join-network=name|pid - join the network namespace of the sandbox\n");
-        printf("\tidentified by name or PID.\n\n");
+        printf("    --join-network=name|pid - join the network namespace.\n");
 #endif
-        printf("    --list - list all sandboxes.\n\n");
-        printf("    --ls=name|pid dir_or_filename - list files in sandbox container.\n\n");
+        printf("    --list - list all sandboxes.\n");
+        printf("    --ls=name|pid dir_or_filename - list files in sandbox container.\n");
 #ifdef HAVE_NETWORK     
-        printf("    --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n\n");
-        printf("    --mtu=number - set interface MTU.\n\n");
+        printf("    --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n");
+        printf("    --mtu=number - set interface MTU.\n");
 #endif
-        printf("    --name=name - set sandbox name.\n\n");
+        printf("    --name=name - set sandbox name.\n");
 #ifdef HAVE_NETWORK     
-        printf("    --net=bridgename - enable network namespaces and connect to this bridge\n");
-        printf("\tdevice. Up to four --net devices can be defined.\n\n");
-
+        printf("    --net=bridgename - enable network namespaces and connect to this bridge.\n");
         printf("    --net=ethernet_interface - enable network namespaces and connect to this\n");
-        printf("\tEthernet interface using the standard Linux macvlan driver. Up to four\n");
-        printf("\t--net devices can be defined.\n\n");
-        
-        printf("    --net=none - enable a new, unconnected network namespace.\n\n");
-
-        printf("    --netfilter - enable the default client network filter in the new\n");
-        printf("\tnetwork namespace.\n\n");
-        printf("    --netfilter=filename - enable the network filter specified by\n");
-        printf("\tfilename in the new network namespace. The filter file format\n");
-        printf("\tis the format of iptables-save and iptable-restore commands.\n\n");
-        printf("    --netfilter6=filename - enable the IPv6 network filter specified by\n");
-        printf("\tfilename in the new network namespace. The filter file format\n");
-        printf("\tis the format of ip6tables-save and ip6table-restore commands.\n\n");
-
-        printf("    --netstats - monitor network statistics for sandboxes creating a new\n");
-        printf("\tnetwork namespace.\n\n");
+        printf("\tEthernet interface.\n");
+        printf("    --net=none - enable a new, unconnected network namespace.\n");
+        printf("    --netfilter[=filename] - enable the default client network filter.\n");
+        printf("    --netfilter6=filename - enable the IPv6 network filter.\n");
+        printf("    --netstats - monitor network statistics.\n");
 #endif
-        printf("    --nice=value - set nice value.\n\n");
-        printf("    --no3d - disable 3D hardware acceleration.\n\n");
-        printf("    --noblacklist=dirname_or_filename - disable blacklist for directory or\n");
-        printf("\tfile.\n\n");
-        printf("    --noexec=dirname_of_filenam - remount the file or directory noexec\n");
-        printf("\tnosuid and nodev\n\n");
-        printf("    --nogroups - disable supplementary groups. Without this option,\n");
-        printf("\tsupplementary groups are enabled for the user starting the sandbox.\n");
-        printf("\tFor root, groups are always disabled.\n\n");
-
-        printf("    --noprofile - do not use a profile.  Profile priority is use the one\n");
-        printf("\tspecified on the command line, next try to find one that\n");
-        printf("\tmatches the command name, and lastly use %s.profile\n", DEFAULT_USER_PROFILE);
-        printf("\tif running as regular user or %s.profile if running as\n", DEFAULT_ROOT_PROFILE);
-        printf("\troot.\n\n");
+        printf("    --nice=value - set nice value.\n");
+        printf("    --no3d - disable 3D hardware acceleration.\n");
+        printf("    --noblacklist=filename - disable blacklist for file or directory .\n");
+        printf("    --noexec=filename - remount the file or directory noexec nosuid and nodev.\n");
+        printf("    --nogroups - disable supplementary groups.\n");
+        printf("    --noprofile - do not use a security profile.\n");
 #ifdef HAVE_USERNS                      
-        printf("    --noroot - install a user namespace with a single user - the current\n");
-        printf("\tuser. root user does not exist in the new namespace. This option\n");
-        printf("\tis not supported for --chroot and --overlay configurations.\n\n");
+        printf("    --noroot - install a user namespace with only the current user.\n");
 #endif
-        printf("    --nonewprivs - sets the NO_NEW_PRIVS prctl - the child processes\n");
-        printf("\tcannot gain privileges using execve(2); in particular, this prevents\n");
-        printf("\tgaining privileges by calling a suid binary\n\n");
-        printf("    --nosound - disable sound system.\n\n");
-                
-        printf("    --output=logfile - stdout logging and log rotation. Copy stdout and stderr\n");
-        printf("\tto logfile, and keep the size of the file under 500KB using log\n");
-        printf("\trotation. Five files with prefixes .1 to .5 are used in\n");
-        printf("\trotation.\n\n");
-        
+        printf("    --nonewprivs - sets the NO_NEW_PRIVS prctl.\n");
+        printf("    --output=logfile - stdout logging and log rotation.\n");
         printf("    --overlay - mount a filesystem overlay on top of the current filesystem.\n");
-        printf("\tThe upper filesystem layer is persistent, and stored in\n");
-        printf("\t$HOME/.firejail/<PID> directory. (OverlayFS support is required in\n");
-        printf("\tLinux kernel for this option to work). \n\n");
-
         printf("    --overlay-named=name - mount a filesystem overlay on top of the current\n");
-        printf("\tfilesystem. The upper filesystem layer is persistent, and stored in\n");
-        printf("\t$HOME/.firejail/<NAME> directory. (OverlayFS support is required in\n");
-        printf("\tLinux kernel for this option to work). \n\n");
-
-        printf("    --overlay-tmpfs - mount a filesystem overlay on top of the current\n");
-        printf("\tfilesystem. The upper layer is stored in a tmpfs filesystem,\n");
-        printf("\tand it is discarded when the sandbox is closed. (OverlayFS\n");
-        printf("\tsupport is required in Linux kernel for this option to work).\n\n");   
-        
-        printf("    --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n\n");
-
-        printf("    --private - mount new /root and /home/user directories in temporary\n");
-        printf("\tfilesystems. All modifications are discarded when the sandbox is\n");
-        printf("\tclosed.\n\n");
-        printf("    --private=directory - use directory as user home.\n\n");
+        printf("\tfilesystem, and store it in name directory.\n");
+        printf("    --overlay-tmpfs - mount a temporary filesystem overlay on top of the current\n");
+        printf("\tfilesystem.\n");   
+        printf("    --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n");
+        printf("    --private - temporary home directory.\n");
+        printf("    --private=directory - use directory as user home.\n");
         printf("    --private-home=file,directory - build a new user home in a temporary\n");
-        printf("\t\tfilesystem, and copy the files and directories in the list in\n");
-        printf("\t\tthe new home. All modifications are discarded when the sandbox\n");
-        printf("\t\tis closed.\n\n");
-
+        printf("\tfilesystem, and copy the files and directories in the list in\n");
+        printf("\tthe new home.\n");
         printf("    --private-bin=file,file - build a new /bin in a temporary filesystem,\n");
-        printf("\tand copy the programs in the list.\n\n");
-
+        printf("\tand copy the programs in the list.\n");
         printf("    --private-dev - create a new /dev directory. Only dri, null, full, zero,\n");
-        printf("\ttty, pst, ptms, random, snd, urandom, log and shm devices are available.\n\n");
-
+        printf("\ttty, pst, ptms, random, snd, urandom, log and shm devices are available.\n");
         printf("    --private-etc=file,directory - build a new /etc in a temporary\n");
         printf("\tfilesystem, and copy the files and directories in the list.\n");
-        printf("\tAll modifications are discarded when the sandbox is closed.\n\n");
-        
-        printf("    --private-tmp - mount a tmpfs on top of /tmp directory\n\n");
-        
-        printf("    --profile=filename - use a custom profile.\n\n");
-        printf("    --profile-path=directory - use this directory to look for profile files.\n\n");
-        
+        printf("    --private-tmp - mount a tmpfs on top of /tmp directory.\n");
+        printf("    --profile=filename - use a custom profile.\n");
+        printf("    --profile-path=directory - use this directory to look for profile files.\n");
         printf("    --protocol=protocol,protocol,protocol - enable protocol filter.\n");
-        printf("\tProtocol values: unix, inet, inet6, netlink, packet.\n\n");
-        printf("    --protocol.print=name|pid - print the protocol filter for the sandbox\n");
-        printf("\tidentified by name or PID.\n\n");
-        
-        printf("    --put=name|pid src-filename dest-filename - put a file in sandbox container.\n\n");
-        
-        printf("    --quiet - turn off Firejail's output.\n\n");
-        printf("    --read-only=dirname_or_filename - set directory or file read-only..\n\n");
-        printf("    --read-write=dirname_or_filename - set directory or file read-write..\n\n");
+        printf("    --protocol.print=name|pid - print the protocol filter.\n");
+        printf("    --put=name|pid src-filename dest-filename - put a file in sandbox container.\n");
+        printf("    --quiet - turn off Firejail's output.\n");
+        printf("    --read-only=filename - set directory or file read-only..\n");
+        printf("    --read-write=filename - set directory or file read-write..\n");
         printf("    --rlimit-fsize=number - set the maximum file size that can be created\n");
-        printf("\tby a process.\n\n");
+        printf("\tby a process.\n");
         printf("    --rlimit-nofile=number - set the maximum number of files that can be\n");
-        printf("\topened by a process.\n\n");
+        printf("\topened by a process.\n");
         printf("    --rlimit-nproc=number - set the maximum number of processes that can be\n");
-        printf("\tcreated for the real user ID of the calling process.\n\n");
+        printf("\tcreated for the real user ID of the calling process.\n");
         printf("    --rlimit-sigpending=number - set the maximum number of pending signals\n");
-        printf("\tfor a process.\n\n");
-        printf("    --rmenv=name - remove environment variable in the new sandbox.\n\n");
+        printf("\tfor a process.\n");
+        printf("    --rmenv=name - remove environment variable in the new sandbox.\n");
 #ifdef HAVE_NETWORK     
         printf("    --scan - ARP-scan all the networks from inside a network namespace.\n");
-        printf("\tThis makes it possible to detect macvlan kernel device drivers\n");
-        printf("\trunning on the current host.\n\n");
 #endif  
 #ifdef HAVE_SECCOMP
-        printf("    --seccomp - enable seccomp filter and apply the default blacklist.\n\n");
-        
+        printf("    --seccomp - enable seccomp filter and apply the default blacklist.\n");
         printf("    --seccomp=syscall,syscall,syscall - enable seccomp filter, blacklist the\n");
-        printf("\tdefault syscall list and the syscalls specified by the command.\n\n");
-        
+        printf("\tdefault syscall list and the syscalls specified by the command.\n");
         printf("    --seccomp.drop=syscall,syscall,syscall - enable seccomp filter, and\n");
-        printf("\tblacklist the syscalls specified by the command.\n\n");
-        
+        printf("\tblacklist the syscalls specified by the command.\n");
         printf("    --seccomp.keep=syscall,syscall,syscall - enable seccomp filter, and\n");
-        printf("\twhitelist the syscalls specified by the command.\n\n");
-        
+        printf("\twhitelist the syscalls specified by the command.\n");
         printf("    --seccomp.<errno>=syscall,syscall,syscall - enable seccomp filter, and\n");
-        printf("\treturn errno for the syscalls specified by the command.\n\n");
-        
+        printf("\treturn errno for the syscalls specified by the command.\n");
         printf("    --seccomp.print=name|pid - print the seccomp filter for the sandbox\n");
-        printf("\tidentified by name or PID.\n\n");
+        printf("\tidentified by name or PID.\n");
 #endif
-
-        printf("    --shell=none - run the program directly without a user shell.\n\n");
-        printf("    --shell=program - set default user shell.\n\n");
-        printf("    --shutdown=name|pid - shutdown the sandbox identified by name or PID.\n\n");
+        printf("    --shell=none - run the program directly without a user shell.\n");
+        printf("    --shell=program - set default user shell.\n");
+        printf("    --shutdown=name|pid - shutdown the sandbox identified by name or PID.\n");
         printf("    --tmpfs=dirname - mount a tmpfs filesystem on directory dirname.\n");
-        printf("\tThis option is available only when running the sandbox as root.\n\n");
-        printf("    --top - monitor the most CPU-intensive sandboxes.\n\n");
-        printf("    --trace - trace open, access and connect system calls.\n\n");
+        printf("    --top - monitor the most CPU-intensive sandboxes.\n");
+        printf("    --trace - trace open, access and connect system calls.\n");
         printf("    --tracelog - add a syslog message for every access to files or\n");
-        printf("\tdirectoires blacklisted by the security profile.\n\n");
-        printf("    --tree - print a tree of all sandboxed processes.\n\n");
-        printf("    --version - print program version and exit.\n\n");
+        printf("\tdirectoires blacklisted by the security profile.\n");
+        printf("    --tree - print a tree of all sandboxed processes.\n");
+        printf("    --version - print program version and exit.\n");
 #ifdef HAVE_NETWORK     
-        printf("    --veth-name=name - use this name for the interface connected to the bridge\n");
-        printf("\tfor --net=bridgename commands, instead of the default one.\n\n"); 
+        printf("    --veth-name=name - use this name for the interface connected to the bridge.\n"); 
 #endif  
 #ifdef HAVE_WHITELIST   
-        printf("    --whitelist=dirname_or_filename - whitelist directory or file.\n\n");
+        printf("    --whitelist=filename - whitelist directory or file.\n");
 #endif  
-        printf("    --writable-etc - /etc directory is mounted read-write.\n\n");
-        printf("    --writable-var - /var directory is mounted read-write.\n\n");
-        
+        printf("    --writable-etc - /etc directory is mounted read-write.\n");
+        printf("    --writable-var - /var directory is mounted read-write.\n");
         printf("    --x11 - enable X11 sandboxing. The software checks first if Xpra is\n");
         printf("\tinstalled, then it checks if Xephyr is installed. If all fails, it will\n");
-        printf("\tattempt to use X11 security extension.\n\n");
-        printf("    --x11=none - disable access to X11 sockets.\n\n");
-        printf("    --x11=xephyr - enable Xephyr X11 server. The window size is 800x600.\n\n");
-        printf("    --x11=xorg - enable X11 security extension.\n\n");
-        printf("    --x11=xpra - enable Xpra X11 server.\n\n");
-        printf("    --zsh - use /usr/bin/zsh as default shell.\n\n");
-        printf("\n");
-        printf("\n");
-
-
-#ifdef HAVE_NETWORK     
-        printf("Traffic Shaping\n\n");
-        
-        printf("Network bandwidth is an expensive resource shared among  all  sandboxes\n");
-        printf("running  on a system.  Traffic shaping allows the user to increase network\n");
-        printf("performance by controlling the amount of data that flows into and out of the\n");
-        printf("sandboxes. Firejail  implements  a simple rate-limiting shaper based on Linux\n");
-        printf("command tc. The shaper works at sandbox level, and can be used  only  for\n");
-        printf("sandboxes configured with new network namespaces.\n\n");
-
-        printf("Set rate-limits:\n");
-        printf("    firejail  --bandwidth={name|pid} set network-name down-speed up-speed\n\n");
-        printf("Clear rate-limits:\n");
-        printf("    firejail --bandwidth={name|pid} clear network-name\n\n");
-        printf("Status:\n");
-        printf("    firejail --bandwidth={name|pid} status\n\n");
-        printf("where:\n");
-            printf("    name - sandbox name\n");
-            printf("    pid - sandbox pid\n");
-            printf("    network-name - network name as used by --net option\n");
-            printf("    down-speed - download speed in KB/s (decimal kilobyte per second)\n");
-            printf("    up-speed - upload speed in KB/s (decimal kilobyte per second)\n");
-        printf("\n");
-        printf("Example:\n");
-            printf("    $ firejail --name=mybrowser --net=eth0 firefox &\n");
-            printf("    $ firejail --bandwidth=mybrowser set eth0 80 20\n");
-            printf("    $ firejail --bandwidth=mybrowser status\n");
-            printf("    $ firejail --bandwidth=mybrowser clear eth0\n");
-        printf("\n");
-        printf("\n");
-#endif
-
-        printf("Audit\n\n");
-        printf("Audit feature allows the user to point out gaps in security profiles. The\n");
-        printf("implementation replaces the program to be sandboxed with a test program. By\n");
-        printf("default, we use faudit program distributed with Firejail. A custom test program\n");
-        printf("can also be supplied by the user. Examples:\n\n");
-        printf("Running the default audit program:\n");
-        printf("    $ firejail --audit transmission-gtk\n\n");
-        printf("Running a custom audit program:\n");
-        printf("    $ firejail --audit=~/sandbox-test transmission-gtk\n\n");
-        printf("In the examples above, the sandbox configures transmission-gtk profile and\n");
-        printf("starts the test program. The real program, transmission-gtk, will not be\n");
-        printf("started.\n\n\n");
-        
-        printf("Monitoring\n\n");
-
-        printf("Option --list prints a list of all sandboxes. The format for each entry is as\n");
-        printf("follows:\n\n");
-        printf("    PID:USER:Command\n\n");
-
-        printf("Option --tree prints the tree of processes running in the sandbox. The format\n");
-        printf("for each process entry is as follows:\n\n");
-        printf("    PID:USER:Command\n\n");
-
-        printf("Option --top is similar to the UNIX top command, however it applies only to\n");
-        printf("sandboxes. Listed below are the available fields (columns) in alphabetical\n");
-        printf("order:\n\n");
-        printf("    Command - command used to start the sandbox.\n");
-        printf("    CPU%% - CPU usage, the sandbox share of the elapsed CPU time since the\n");
-        printf("\tlast screen update\n");
-        printf("    PID - Unique process ID for the task controlling the sandbox.\n");
-        printf("    Prcs - number of processes running in sandbox, including the controlling\n");
-        printf("\tprocess.\n");
-        printf("    RES - Resident Memory Size (KiB), sandbox non-swapped physical memory.\n");
-        printf("\tIt is a sum of the RES values for all processes running in the\n");
-        printf("\tsandbox.\n");
-        printf("    SHR - Shared Memory Size (KiB), it reflects memory shared with other\n");
-        printf("\tprocesses. It is a sum of the SHR values for all processes running\n");
-        printf("\tin the sandbox, including the controlling process.\n");
-        printf("    Uptime - sandbox running time in hours:minutes:seconds format.\n");
-        printf("    User - The owner of the sandbox.\n");
-        printf("\n");
-        printf("\n");
-        printf("Profile files\n\n");
-        printf("Several command line configuration options can be passed to the program using\n");
-        printf("profile files. Default Firejail profile files are stored in /etc/firejail\n");
-        printf("directory, user profile files are stored in ~/.config/firejail directory. See\n");
-        printf("man 5 firejail-profile for more information.\n\n");
-        printf("\n");
-        printf("Restricted shell\n\n");
-        printf("To  configure a restricted shell, replace /bin/bash with /usr/bin/firejail in\n");
-        printf("/etc/passwd file for each user that needs to  be  restricted.\n");
-        printf("Alternatively, you can specify /usr/bin/firejail  in adduser command:\n\n");
-        printf("   adduser --shell /usr/bin/firejail username\n\n");
-        printf("Arguments to be passed to firejail executable upon login are  declared  in\n");
-        printf("/etc/firejail/login.users file.\n\n");
+        printf("\tattempt to use X11 security extension.\n");
+        printf("    --x11=none - disable access to X11 sockets.\n");
+        printf("    --x11=xephyr - enable Xephyr X11 server. The window size is 800x600.\n");
+        printf("    --x11=xorg - enable X11 security extension.\n");
+        printf("    --x11=xpra - enable Xpra X11 server.\n");
+        printf("    --zsh - use /usr/bin/zsh as default shell.\n");
         printf("\n");
-        printf("Examples:\n\n");
-        printf("    $ firejail\n");
-        printf("\tstart a regular /bin/bash session in sandbox\n");
+        printf("Examples:\n");
         printf("    $ firejail firefox\n");
         printf("\tstart Mozilla Firefox\n");
         printf("    $ firejail --debug firefox\n");
         printf("\tdebug Firefox sandbox\n");
-        printf("    $ firejail --private firefox\n");
-        printf("\tstart Firefox with a new, empty home directory\n");
-        printf("    $ firejail --net=br0 ip=10.10.20.10\n");
-        printf("\tstart a /bin/bash session in a new network namespace; the session is\n");
-        printf("\tconnected to the main network using br0 bridge device, an IP address\n");
-        printf("\tof 10.10.20.10 is assigned to the sandbox\n");
-        printf("    $ firejail --net=br0 --net=br1 --net=br2\n");
-        printf("\tstart a /bin/bash session in a new network namespace and connect it\n");
-        printf("\tto br0, br1, and br2 host bridge devices\n");
+        printf("    $ firejail --private --sna=8.8.8.8 firefox\n");
+        printf("\tstart Firefox with a new, empty home directory, and a well-known DNS\n");
+        printf("\tserver setting.\n");
+        printf("    $ firejail --net=eth0 firefox\n");
+        printf("\tstart Firefox in a new network namespace\n");
+        printf("    $ firejail --x11=xorg firefox\n");
+        printf("\tstart Firefox and sandbox X11\n");
         printf("    $ firejail --list\n");
         printf("\tlist all running sandboxes\n");
         printf("\n");
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 6cba95501..ecab8880a 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -312,6 +312,7 @@ void x11_start_xephyr(int argc, char **argv) {
                 if (arg_debug)
                         printf("Starting xephyr...\n");
 
+                // running without privileges - see drop_privs call above
                 assert(getenv("LD_PRELOAD") == NULL);   
                 execvp(server_argv[0], server_argv);
                 perror("execvp");
@@ -354,6 +355,7 @@ void x11_start_xephyr(int argc, char **argv) {
                 if (!arg_quiet)
                         printf("\n*** Attaching to Xephyr display %d ***\n\n", display);
 
+                // running without privileges - see drop_privs call above
                 assert(getenv("LD_PRELOAD") == NULL);   
                 execvp(jail_argv[0], jail_argv);
                 perror("execvp");
@@ -434,6 +436,7 @@ void x11_start_xpra(int argc, char **argv) {
                         dup2(fd_null,2);
                 }
         
+                // running without privileges - see drop_privs call above
                 assert(getenv("LD_PRELOAD") == NULL);   
                 execvp(server_argv[0], server_argv);
                 perror("execvp");
@@ -481,6 +484,7 @@ void x11_start_xpra(int argc, char **argv) {
                 if (!arg_quiet)
                         printf("\n*** Attaching to xpra display %d ***\n\n", display);
 
+                // running without privileges - see drop_privs call above
                 assert(getenv("LD_PRELOAD") == NULL);   
                 execvp(attach_argv[0], attach_argv);
                 perror("execvp");
@@ -512,6 +516,7 @@ void x11_start_xpra(int argc, char **argv) {
         if (jail < 0)
                 errExit("fork");
         if (jail == 0) {
+                // running without privileges - see drop_privs call above
                 assert(getenv("LD_PRELOAD") == NULL);   
                 if (firejail_argv[0]) // shut up llvm scan-build
                         execvp(firejail_argv[0], firejail_argv);
@@ -539,6 +544,7 @@ void x11_start_xpra(int argc, char **argv) {
                                         dup2(fd_null,1);
                                         dup2(fd_null,2);
                                 }
+                                // running without privileges - see drop_privs call above
                                 assert(getenv("LD_PRELOAD") == NULL);   
                                 execvp(stop_argv[0], stop_argv);
                                 perror("execvp");
@@ -638,7 +644,7 @@ void x11_block(void) {
 
 void x11_xorg(void) {
 #ifdef HAVE_X11
-        // destination
+        // destination - create an empty ~/.Xauthotrity file if it doesn't exist already, and use it as a mount point
         char *dest;
         if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
@@ -652,47 +658,67 @@ void x11_xorg(void) {
                 fclose(fp);
         }
 
+        // check xauth utility is present in the system
         if (stat("/usr/bin/xauth", &s) == -1) {
                 fprintf(stderr, "Error: cannot find /usr/bin/xauth executable\n");
                 exit(1);
         }
 
+        // create a temporary .Xauthority file
+        char tmpfname[] = "/tmp/.tmpXauth-XXXXXX";
+        int fd = mkstemp(tmpfname);
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot create .Xauthority file\n");
+                exit(1);
+        }
+        close(fd);
+        if (chown(tmpfname, getuid(), getgid()) == -1)
+                errExit("chown");
+
         pid_t child = fork();
         if (child < 0)
                 errExit("fork");
         if (child == 0) {
-                // generate a new .Xauthority file
+                // generate the new .Xauthority file using xauth utility
                 if (arg_debug)
                         printf("Generating a new .Xauthority file\n");
-
-                // elevate privileges - files in /run/firejail/mnt directory belong to root
-                if (setreuid(0, 0) < 0)
-                        errExit("setreuid");
-                if (setregid(0, 0) < 0)
-                        errExit("setregid");
+                drop_privs(1);
 
                 char *display = getenv("DISPLAY");
                 if (!display)
                         display = ":0.0";
                 
-                assert(getenv("LD_PRELOAD") == NULL);   
-                execlp("/usr/bin/xauth", "/usr/bin/xauth", "-f", RUN_XAUTHORITY_SEC_FILE,
+                clearenv();
+                execlp("/usr/bin/xauth", "/usr/bin/xauth", "-f", tmpfname,
                         "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL); 
                 
                 _exit(0);
         }
+
         // wait for the child to finish
         waitpid(child, NULL, 0);
 
         // check the file was created and set mode and ownership
-        if (stat(RUN_XAUTHORITY_SEC_FILE, &s) == -1) {
+        if (stat(tmpfname, &s) == -1) {
                 fprintf(stderr, "Error: cannot create the new .Xauthority file\n");
                 exit(1);
         }
+        if (chown(tmpfname, getuid(), getgid()) == -1)
+                errExit("chown");
+        if (chmod(tmpfname, 0600) == -1)
+                errExit("chmod");
+        
+        // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted
+        // automatically when the sandbox is closed
+        if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) {
+                fprintf(stderr, "asdfdsfError: cannot create the new .Xauthority file\n");
+                exit(1);
+        }
         if (chown(RUN_XAUTHORITY_SEC_FILE, getuid(), getgid()) == -1)
                 errExit("chown");
         if (chmod(RUN_XAUTHORITY_SEC_FILE, 0600) == -1)
                 errExit("chmod");
+        unlink(tmpfname);
         
         // mount
         if (mount(RUN_XAUTHORITY_SEC_FILE, dest, "none", MS_BIND, "mode=0600") == -1) {
diff --git a/src/fnet/Makefile.in b/src/fnet/Makefile.in
index b515d2333..bba4406d4 100644
--- a/src/fnet/Makefile.in
+++ b/src/fnet/Makefile.in
@@ -33,8 +33,8 @@ LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/libnetlink.h
         $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
-fnet: $(OBJS) ../lib/libnetlink.o ../lib/common.o
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/libnetlink.o $(LIBS) $(EXTRA_LDFLAGS)
+fnet: $(OBJS) ../lib/libnetlink.o
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) ../lib/libnetlink.o $(LIBS)
 
 clean:; rm -f *.o fnet
 
diff --git a/src/fseccomp/Makefile.in b/src/fseccomp/Makefile.in
index 110d2c95f..1878ad2f3 100644
--- a/src/fseccomp/Makefile.in
+++ b/src/fseccomp/Makefile.in
@@ -33,8 +33,8 @@ LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
         $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@
 
-fseccomp: $(OBJS) ../lib/libnetlink.o ../lib/common.o
-        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+fseccomp: $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS)
 
 clean:; rm -f *.o fseccomp
 
diff --git a/src/fseccomp/main.c b/src/fseccomp/main.c
index 22b13bcd9..39e72fdf9 100644
--- a/src/fseccomp/main.c
+++ b/src/fseccomp/main.c
@@ -40,7 +40,7 @@ static void usage(void) {
 int main(int argc, char **argv) {
 #if 0
 {
-system("cat /proc/self/status");
+//system("cat /proc/self/status");
 int i;
 for (i = 0; i < argc; i++)
         printf("*%s* ", argv[i]);
diff --git a/src/fseccomp/protocol.c b/src/fseccomp/protocol.c
index 38c5f9d88..7bf560fe1 100644
--- a/src/fseccomp/protocol.c
+++ b/src/fseccomp/protocol.c
@@ -107,7 +107,7 @@ void protocol_build_filter(const char *prlist, const char *fname) {
         assert(fname);
 
 #ifndef SYS_socket
-        fprintf(stderr, "Warning: --protocol not supported on this platform\n");
+        fprintf(stderr, "Warning fseccomp: --protocol not supported on this platform\n");
         return;
 #else
         // build the filter
diff --git a/src/fseccomp/syscall.c b/src/fseccomp/syscall.c
index e2052efde..6696f2b11 100644
--- a/src/fseccomp/syscall.c
+++ b/src/fseccomp/syscall.c
@@ -67,12 +67,52 @@ void syscall_print(void) {
         printf("\n");
 }
 
+// allowed input:
+// - syscall
+// - syscall(error)
+static void syscall_process_name(const char *name, int *syscall_nr, int *error_nr) {
+        assert(name);
+        if (strlen(name) == 0)
+                goto error;
+        *error_nr = -1;
+        
+        // syntax check
+        char *str = strdup(name);
+        if (!str)
+                errExit("strdup");
+
+        char *syscall_name = str;
+        char *error_name = strchr(str, ':');
+        if (error_name) {
+                *error_name = '\0';
+                error_name++;
+        }
+        if (strlen(syscall_name) == 0) {
+                free(str);
+                goto error;
+        }
+
+        *syscall_nr = syscall_find_name(syscall_name);
+        if (error_name) {
+                *error_nr = errno_find_name(error_name);
+                if (*error_nr == -1)
+                        *syscall_nr = -1;
+        }
+
+        free(str);
+        return;
+        
+error:
+        fprintf(stderr, "Error fseccomp: invalid syscall list entry %s\n", name);
+        exit(1);
+}
+
 // return 1 if error, 0 if OK
 int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg), int fd, int arg) {
         // don't allow empty lists
         if (slist == NULL || *slist == '\0') {
-                fprintf(stderr, "Error: empty syscall lists are not allowed\n");
-                return -1;
+                fprintf(stderr, "Error fseccomp: empty syscall lists are not allowed\n");
+                exit(1);
         }
 
         // work on a copy of the string
@@ -80,29 +120,28 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall,
         if (!str)
                 errExit("strdup");
 
-        char *ptr = str;
-        char *start = str;
-        while (*ptr != '\0') {
-                if (islower(*ptr) || isdigit(*ptr) || *ptr == '_')
-                        ;
-                else if (*ptr == ',') {
-                        *ptr = '\0';
-                        int nr = syscall_find_name(start);
-                        if (nr == -1)
-                                fprintf(stderr, "Warning: syscall %s not found\n", start);
-                        else if (callback != NULL)
-                                callback(fd, nr, arg);
-                                
-                        start = ptr + 1;
-                }
-                ptr++;
+        char *ptr =strtok(str, ",");
+        if (ptr == NULL) {
+                fprintf(stderr, "Error fseccomp: empty syscall lists are not allowed\n");
+                exit(1);
         }
-        if (*start != '\0') {
-                int nr = syscall_find_name(start);
-                if (nr == -1)
-                        fprintf(stderr, "Warning: syscall %s not found\n", start);
-                else if (callback != NULL)
-                        callback(fd, nr, arg);
+
+        while (ptr) {
+printf("ptr %s\n", ptr);
+                
+                int syscall_nr;
+                int error_nr;
+                syscall_process_name(ptr, &syscall_nr, &error_nr);
+printf("%d, %d\n", syscall_nr, error_nr);               
+                if (syscall_nr == -1)
+                        fprintf(stderr, "Warning fseccomp: syscall %s not found\n", ptr);
+                else if (callback != NULL) {
+                        if (error_nr != -1)
+                                filter_add_errno(fd, syscall_nr, error_nr);
+                        else
+                                callback(fd, syscall_nr, arg);
+                }
+                ptr = strtok(NULL, ",");
         }
         
         free(str);
diff --git a/test/filters/seccomp-errno.exp b/test/filters/seccomp-errno.exp
index 4df1948be..c3af2fbe9 100755
--- a/test/filters/seccomp-errno.exp
+++ b/test/filters/seccomp-errno.exp
@@ -8,23 +8,23 @@ spawn $env(SHELL)
 match_max 100000
 
 send -- "touch seccomp-test-file\r"
-sleep 1
+after 100
 
-send --  "firejail --seccomp.enoent=unlinkat rm seccomp-test-file\r"
+send --  "firejail --seccomp=unlinkat:ENOENT rm seccomp-test-file\r"
 expect {
         timeout {puts "TESTING ERROR 0\n";exit}
         "No such file or directory"
 }
 sleep 1
 
-send --  "firejail --seccomp.enoent=unlinkat --debug rm seccomp-test-file\r"
+send --  "firejail --seccomp=unlinkat:ENOENT --debug rm seccomp-test-file\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}
         "unlinkat 2 ENOENT"
 }
 sleep 1
 
-send --  "firejail --seccomp.enoent=unlinkat,mkdir\r"
+send --  "firejail --seccomp=unlinkat:ENOENT,mkdir:ENOENT\r"
 expect {
         timeout {puts "TESTING ERROR 2\n";exit}
         "Child process initialized"
@@ -49,42 +49,6 @@ puts "\n"
 send -- "exit\r"
 sleep 1
 
-
-send --  "firejail --seccomp.enoent=unlinkat --seccomp.enoent=mkdir\r"
-expect {
-        timeout {puts "TESTING ERROR 5\n";exit}
-        "errno enoent already configured"
-}
-sleep 1
-
-send --  "firejail --seccomp.enoent=unlinkat --seccomp.eperm=mkdir\r"
-expect {
-        timeout {puts "TESTING ERROR 6\n";exit}
-        "Child process initialized"
-}
-sleep 1
-send -- "rm seccomp-test-file\r"
-expect {
-        timeout {puts "TESTING ERROR 7\n";exit}
-        "No such file or directory"
-}
-after 100
-puts "\n"
-
-send -- "mkdir seccomp-test-dir\r"
-expect {
-        timeout {puts "TESTING ERROR 8\n";exit}
-        "Operation not permitted"
-}
-after 100
-puts "\n"
-
-send -- "exit\r"
-sleep 1
-
-
-
-
 send -- "rm seccomp-test-file\r"
 after 100
 puts "all done\n"