Merge branch 'master' of ssh://github.com/netblue30/firejail

15 files changed, 103 insertions, 16 deletions

diff --git a/Makefile b/Makefile
index 53b57a0e1..fdf83beb4 100644
--- a/Makefile
+++ b/Makefile
@@ -362,7 +362,7 @@ scan-build: clean
 
 .PHONY: codespell
 codespell: clean
-        codespell --ignore-regex "UE|creat|shotcut|ether" src test
+        codespell --ignore-regex "UE|creat|doas|shotcut|ether" src test
 
 .PHONY: print-env
 print-env:
diff --git a/etc/ids.config b/etc/ids.config
index 880ec6ab5..4b75c701c 100644
--- a/etc/ids.config
+++ b/etc/ids.config
@@ -139,6 +139,7 @@ ${HOME}/.local/share/autostart
 /etc/security
 /etc/selinux
 /etc/shadow*
+/etc/sudo*.conf
 /etc/sudoers*
 /etc/tripwire
 ${HOME}/.config/firejail
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index 4277100ce..ce4f08958 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -416,6 +416,7 @@ blacklist /tmp/ssh-*
 # top secret
 blacklist /.fscrypt
 blacklist /etc/davfs2/secrets
+blacklist /etc/doas.conf
 blacklist /etc/group+
 blacklist /etc/group-
 blacklist /etc/gshadow
@@ -428,6 +429,8 @@ blacklist /etc/shadow+
 blacklist /etc/shadow-
 blacklist /etc/ssh
 blacklist /etc/ssh/*
+blacklist /etc/sudo*.conf
+blacklist /etc/sudoers*
 blacklist /home/.ecryptfs
 blacklist /home/.fscrypt
 blacklist ${HOME}/*.kdb
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index b4a01638f..f95ddf2fa 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -329,6 +329,7 @@ blacklist ${HOME}/.config/Qlipper
 blacklist ${HOME}/.config/QuiteRss
 blacklist ${HOME}/.config/QuiteRssrc
 blacklist ${HOME}/.config/Quotient
+blacklist ${HOME}/.config/RSS Guard 4
 blacklist ${HOME}/.config/Rambox
 blacklist ${HOME}/.config/Riot
 blacklist ${HOME}/.config/Rocket.Chat
@@ -432,6 +433,7 @@ blacklist ${HOME}/.config/equalx
 blacklist ${HOME}/.config/evince
 blacklist ${HOME}/.config/evolution
 blacklist ${HOME}/.config/falkon
+blacklist ${HOME}/.config/feh
 blacklist ${HOME}/.config/filezilla
 blacklist ${HOME}/.config/flameshot
 blacklist ${HOME}/.config/flaska.net
diff --git a/etc/profile-a-l/bleachbit.profile b/etc/profile-a-l/bleachbit.profile
index 45ae345c3..52d970d89 100644
--- a/etc/profile-a-l/bleachbit.profile
+++ b/etc/profile-a-l/bleachbit.profile
@@ -7,6 +7,9 @@ include bleachbit.local
 # Persistent global definitions
 include globals.local
 
+# Necessary for BleachBit to erase Trash contents.
+noblacklist ${HOME}/.local/share/Trash
+
 # Allow python (blacklisted by disable-interpreters.inc)
 include allow-python2.inc
 include allow-python3.inc
diff --git a/etc/profile-a-l/feh.profile b/etc/profile-a-l/feh.profile
index 82b3f7645..2efd10ba2 100644
--- a/etc/profile-a-l/feh.profile
+++ b/etc/profile-a-l/feh.profile
@@ -7,23 +7,33 @@ include feh.local
 # Persistent global definitions
 include globals.local
 
+noblacklist ${HOME}/.config/feh
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
 include disable-interpreters.inc
+include disable-proc.inc
 include disable-programs.inc
 include disable-shell.inc
 
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+
 # Add the next line to your feh.local to enable network access.
 #include feh-network.inc.profile
 
+apparmor
 caps.drop all
+ipc-namespace
+machine-id
 net none
 no3d
 nodvd
 nogroups
 noinput
 nonewprivs
+noprinters
 noroot
 nosound
 notv
@@ -31,6 +41,8 @@ nou2f
 novideo
 protocol unix
 seccomp
+seccomp.block-secondary
+tracelog
 
 private-bin feh,jpegexiforient,jpegtran
 private-cache
diff --git a/etc/profile-m-z/rssguard.profile b/etc/profile-m-z/rssguard.profile
new file mode 100644
index 000000000..81381c205
--- /dev/null
+++ b/etc/profile-m-z/rssguard.profile
@@ -0,0 +1,58 @@
+# Firejail profile for rssguard
+# Description: Simple (yet powerful) Qt feed reader
+# This file is overwritten after every install/update
+# Persistent local customizations
+include rssguard.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.config/RSS Guard 4
+
+include allow-nodejs.inc
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-proc.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+mkdir ${HOME}/.config/RSS Guard 4
+whitelist ${HOME}/.config/RSS Guard 4
+whitelist ${DOWNLOADS}
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+netfilter
+# no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noroot
+# nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6,netlink
+seccomp
+seccomp.block-secondary
+tracelog
+
+disable-mnt
+private-bin node,rssguard
+private-dev
+private-etc @network,@sound,@tls-ca,@x11,mime.types
+private-tmp
+
+dbus-user none
+dbus-system none
+
+restrict-namespaces
diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c
index 963e05ff3..7ac60f70c 100644
--- a/src/firecfg/desktop_files.c
+++ b/src/firecfg/desktop_files.c
@@ -108,7 +108,7 @@ static int have_profile(const char *filename, const char *homedir) {
         return rv;
 }
 
-void fix_desktop_files(char *homedir) {
+void fix_desktop_files(const char *homedir) {
         assert(homedir);
         struct stat sb;
 
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index dac5794b4..2755968c9 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -734,6 +734,7 @@ ripperx
 ristretto
 rocketchat
 rpcs3
+rssguard
 rtorrent
 runenpass.sh
 sayonara
diff --git a/src/firecfg/firecfg.h b/src/firecfg/firecfg.h
index 825bf8d03..8f74a1198 100644
--- a/src/firecfg/firecfg.h
+++ b/src/firecfg/firecfg.h
@@ -49,6 +49,6 @@ int is_link(const char *fname);
 void sound(void);
 
 // desktop_files.c
-void fix_desktop_files(char *homedir);
+void fix_desktop_files(const char *homedir);
 
 #endif
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index da962c35d..4ec81c5b3 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -288,8 +288,11 @@ static void set_links_homedir(const char *homedir) {
         free(firejail_exec);
 }
 
-static char *get_user(void) {
-        char *user = getenv("SUDO_USER");
+static const char *get_sudo_user(void) {
+        const char *doas_user = getenv("DOAS_USER");
+        const char *sudo_user = getenv("SUDO_USER");
+        const char *user = doas_user ? doas_user : sudo_user;
+
         if (!user) {
                 user = getpwuid(getuid())->pw_name;
                 if (!user) {
@@ -301,13 +304,13 @@ static char *get_user(void) {
         return user;
 }
 
-static char *get_homedir(const char *user, uid_t *uid, gid_t *gid) {
+static const char *get_homedir(const char *user, uid_t *uid, gid_t *gid) {
         // find home directory
         struct passwd *pw = getpwnam(user);
         if (!pw)
                 goto errexit;
 
-        char *home = pw->pw_dir;
+        const char *home = pw->pw_dir;
         if (!home)
                 goto errexit;
 
@@ -326,12 +329,11 @@ int main(int argc, char **argv) {
         int bindir_set = 0;
 
         // user setup
-        char *user = get_user();
+        const char *user = get_sudo_user();
         assert(user);
         uid_t uid;
         gid_t gid;
-        char *home = get_homedir(user, &uid, &gid);
-
+        const char *home = get_homedir(user, &uid, &gid);
 
         // check for --bindir
         for (i = 1; i < argc; i++) {
diff --git a/src/jailcheck/main.c b/src/jailcheck/main.c
index 27da309ea..6cc5cf904 100644
--- a/src/jailcheck/main.c
+++ b/src/jailcheck/main.c
@@ -86,7 +86,7 @@ int main(int argc, char **argv) {
 
         // user setup
         if (getuid() != 0) {
-                fprintf(stderr, "Error: you need to be root (via sudo) to run this program\n");
+                fprintf(stderr, "Error: you need to be root (via sudo or doas) to run this program\n");
                 exit(1);
         }
         user_name = get_sudo_user();
@@ -120,6 +120,7 @@ int main(int argc, char **argv) {
         // basic sysfiles
         sysfiles_setup("/etc/shadow");
         sysfiles_setup("/etc/gshadow");
+        sysfiles_setup("/usr/bin/doas");
         sysfiles_setup("/usr/bin/mount");
         sysfiles_setup("/usr/bin/su");
         sysfiles_setup("/usr/bin/ksu");
diff --git a/src/jailcheck/utils.c b/src/jailcheck/utils.c
index 97fe8833b..930820604 100644
--- a/src/jailcheck/utils.c
+++ b/src/jailcheck/utils.c
@@ -26,7 +26,10 @@
 #define BUFLEN 4096
 
 char *get_sudo_user(void) {
-        char *user = getenv("SUDO_USER");
+        char *doas_user = getenv("DOAS_USER");
+        char *sudo_user = getenv("SUDO_USER");
+        char *user = doas_user ? doas_user : sudo_user;
+
         if (!user) {
                 user = getpwuid(getuid())->pw_name;
                 if (!user) {
diff --git a/src/man/firecfg.1.in b/src/man/firecfg.1.in
index 42add6a41..a85fbc5da 100644
--- a/src/man/firecfg.1.in
+++ b/src/man/firecfg.1.in
@@ -23,7 +23,9 @@ The integration covers:
 - programs started by clicking on file icons in file manager - only Cinnamon, KDE, LXDE/LXQT, MATE and XFCE
 desktop managers are supported in this moment
 .RE
-
+.PP
+Note: The examples use \fBsudo\fR, but \fBdoas\fR is also supported.
+.PP
 To set it up, run "sudo firecfg" after installing Firejail software.
 The same command should also be run after
 installing new programs. If the program is supported by Firejail, the symbolic link in /usr/local/bin
diff --git a/src/man/jailcheck.1.in b/src/man/jailcheck.1.in
index e889ea91b..eea5987b7 100644
--- a/src/man/jailcheck.1.in
+++ b/src/man/jailcheck.1.in
@@ -24,9 +24,8 @@ them from inside the sandbox.
 \fB5. Seccomp test
 .TP
 \fB6. Networking test
-.TP
-The program is started as root using sudo.
-
+.PP
+The program should be started using \fBsudo\fR or \fBdoas\fR.
 .SH OPTIONS
 .TP
 \fB\-\-debug