Merge branch 'master' of https://github.com/netblue30/firejail

3 files changed, 11 insertions, 9 deletions

diff --git a/Makefile.in b/Makefile.in
index 9d21419bc..c6bacff31 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -217,12 +217,6 @@ deb: dist
 deb-apparmor: dist
         ./mkdeb-apparmor.sh $(NAME) $(VERSION)
 
-snap: all
-        cd platform/snap; ./snap.sh
-
-install-snap: snap
-        sudo snap remove faudit; sudo snap install faudit*.snap
-
 test-compile: dist
         cd test/compile; ./compile.sh $(NAME)-$(VERSION)
 
@@ -234,10 +228,10 @@ extras: all
         $(MAKE) -C extras/firetools
 
 cppcheck: clean
-        cppcheck -q --force --error-exitcode=1 --enable=warning,performance .
+        cppcheck --force --error-exitcode=1 --enable=warning,performance .
 
 scan-build: clean
-        scan-build make
+        NO_EXTRA_CFLAGS="yes" scan-build make
 
 
 #
diff --git a/etc/templates/syscalls.txt b/etc/templates/syscalls.txt
index 2464df9ee..30ad6feea 100644
--- a/etc/templates/syscalls.txt
+++ b/etc/templates/syscalls.txt
@@ -14,7 +14,7 @@ Hints for writing seccomp.drop lines
 @obsolete=_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver
 @resources=mbind,migrate_pages,move_pages,set_mempolicy
 
-@default=@cpu-emulation,@debug,@obsolete,@privileged,@resources,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,ioprio_set,io_setup,io_submit,kcmp,keyctl,mincore,name_to_handle_at,ni_syscall,open_by_handle_at,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice
+@default=@cpu-emulation,@debug,@obsolete,@privileged,@resources,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,name_to_handle_at,ni_syscall,open_by_handle_at,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice
 
 @default-nodebuggers=@default,personality,process_vm_readv,ptrace
 
@@ -41,3 +41,7 @@ Hints for writing seccomp.drop lines
 | @default-nodebuggers |
 +----------------------+
 
+
+@default without chroot: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,pivot_root,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
+
+@default-nodebuggers without chroot: @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
diff --git a/src/common.mk.in b/src/common.mk.in
index 1b6ad91a5..ff66c6748 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -32,4 +32,8 @@ BINOBJS =  $(foreach file, $(OBJS), $file)
 CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_FIRETUNNEL) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
+
+ifdef NO_EXTRA_CFLAGS
+else
 EXTRA_CFLAGS +=@EXTRA_CFLAGS@
+endif