Merge branch 'master' of ssh://github.com/netblue30/firejail

6 files changed, 28 insertions, 37 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 4871ef031..af590e2e1 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -54,7 +54,7 @@ build_apparmor:
     script:
         - apt-get update -qq
         - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential lintian libapparmor-dev pkg-config gawk
-        - ./configure --prefix=/usr --enable-apparmor && make deb-apparmor && dpkg -i firejail*.deb
+        - ./configure && make deb-apparmor && dpkg -i firejail*.deb
         - command -V firejail && firejail --version
         - firejail --version | grep -F 'AppArmor support is enabled'
 
diff --git a/Makefile.in b/Makefile.in
index 0e80fb43a..7d961213a 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -222,7 +222,7 @@ deb: dist
         ./mkdeb.sh
 
 deb-apparmor: dist
-        ./mkdeb.sh -apparmor
+        ./mkdeb.sh -apparmor --enable-apparmor
 
 test-compile: dist
         cd test/compile; ./compile.sh $(NAME)-$(VERSION)
diff --git a/contrib/fj-mkdeb.py b/contrib/fj-mkdeb.py
index 60e25fd14..f6611bee8 100755
--- a/contrib/fj-mkdeb.py
+++ b/contrib/fj-mkdeb.py
@@ -3,9 +3,10 @@
 # Copyright (C) 2014-2022 Firejail Authors
 # License GPL v2
 
-# This script automates the workaround for https://github.com/netblue30/firejail/issues/772
+# This script automates the creation of a .deb package.  It was originally
+# created to work around https://github.com/netblue30/firejail/issues/772
 
-import os, shlex, subprocess, sys
+import os, subprocess, sys
 
 
 def run(srcdir, args):
@@ -15,35 +16,29 @@ def run(srcdir, args):
         print('Error: Not a firejail source tree?  Exiting.')
         return 1
 
-    dry_run = False
-    escaped_args = []
-    # We need to modify the list as we go.  So be sure to copy the list to be iterated!
+    # Ignore unsupported arguments.
     for a in args[:]:
         if a.startswith('--prefix'):
             # prefix should ALWAYS be /usr here.  Discard user-set values
             args.remove(a)
-        elif a == '--only-fix-mkdeb':
-            # for us, not configure
-            dry_run = True
-            args.remove(a)
-        else:
-            escaped_args.append(shlex.quote(a))
+
+    # Remove generated files.
+    distclean = subprocess.call(['make', 'distclean'])
+    if distclean != 0:
+        return distclean
 
     # Run configure to generate mkdeb.sh.
     first_config = subprocess.call(['./configure', '--prefix=/usr'] + args)
     if first_config != 0:
         return first_config
 
-    # Fix up dynamically-generated mkdeb.sh to include custom configure options.
-    with open('mkdeb.sh', 'rb') as f:
-        sh = str(f.read(), 'utf_8')
-    with open('mkdeb.sh', 'wb') as f:
-        f.write(bytes(sh.replace('./configure $CONFIG_ARGS',
-                                 './configure $CONFIG_ARGS ' + (' '.join(escaped_args))), 'utf_8'))
-
-    if dry_run: return 0
+    # Create the dist file used by mkdeb.sh.
+    make_dist = subprocess.call(['make', 'dist'])
+    if make_dist != 0:
+        return make_dist
 
-    return subprocess.call(['make', 'deb'])
+    # Run mkdeb.sh with the custom configure options.
+    return subprocess.call(['./mkdeb.sh'] + args)
 
 
 if __name__ == '__main__':
@@ -51,13 +46,12 @@ if __name__ == '__main__':
         print('''Build a .deb of firejail with custom configure options
 
 usage:
-{script} [--fj-src=SRCDIR] [--only-fix-mkdeb] [CONFIGURE_OPTIONS [...]]
+{script} [--fj-src=SRCDIR] [CONFIGURE_OPTIONS [...]]
 
  --fj-src=SRCDIR: manually specify the location of firejail source tree
                   as SRCDIR.  If not specified, looks in the parent directory
                   of the directory where this script is located, and then the
                   current working directory, in that order.
- --only-fix-mkdeb: don't run configure or make after modifying mkdeb.sh
  CONFIGURE_OPTIONS: arguments for configure
 '''.format(script=sys.argv[0]))
         sys.exit(0)
diff --git a/etc/profile-a-l/kate.profile b/etc/profile-a-l/kate.profile
index 8c340d536..9eadaec12 100644
--- a/etc/profile-a-l/kate.profile
+++ b/etc/profile-a-l/kate.profile
@@ -14,6 +14,7 @@ noblacklist ${HOME}/.config/katerc
 noblacklist ${HOME}/.config/kateschemarc
 noblacklist ${HOME}/.config/katesyntaxhighlightingrc
 noblacklist ${HOME}/.config/katevirc
+noblacklist ${HOME}/.config/kwinrc
 noblacklist ${HOME}/.local/share/kate
 noblacklist ${HOME}/.local/share/kxmlgui5/kate
 noblacklist ${HOME}/.local/share/kxmlgui5/katefiletree
@@ -22,6 +23,9 @@ noblacklist ${HOME}/.local/share/kxmlgui5/kateopenheaderplugin
 noblacklist ${HOME}/.local/share/kxmlgui5/katepart
 noblacklist ${HOME}/.local/share/kxmlgui5/kateproject
 noblacklist ${HOME}/.local/share/kxmlgui5/katesearch
+noblacklist /etc/profile.d
+
+include allow-common-devel.inc
 
 include disable-common.inc
 # include disable-devel.inc
@@ -48,7 +52,6 @@ novideo
 protocol unix
 seccomp
 shell none
-tracelog
 
 # private-bin kate,kbuildsycoca4,kdeinit4
 private-dev
diff --git a/etc/profile-m-z/seamonkey.profile b/etc/profile-m-z/seamonkey.profile
index e67e51620..5210a594c 100644
--- a/etc/profile-m-z/seamonkey.profile
+++ b/etc/profile-m-z/seamonkey.profile
@@ -7,6 +7,7 @@ include seamonkey.local
 include globals.local
 
 noblacklist ${HOME}/.cache/mozilla
+noblacklist ${HOME}/.gnupg
 noblacklist ${HOME}/.mozilla
 noblacklist ${HOME}/.local/share/pki
 noblacklist ${HOME}/.pki
@@ -17,6 +18,7 @@ include disable-interpreters.inc
 include disable-programs.inc
 
 mkdir ${HOME}/.cache/mozilla
+mkdir ${HOME}/.gnupg
 mkdir ${HOME}/.mozilla
 mkdir ${HOME}/.local/share/pki
 mkdir ${HOME}/.pki
@@ -26,6 +28,7 @@ whitelist ${HOME}/.cache/mozilla
 whitelist ${HOME}/.config/gnome-mplayer
 whitelist ${HOME}/.config/pipelight-silverlight5.1
 whitelist ${HOME}/.config/pipelight-widevine
+whitelist ${HOME}/.gnupg
 whitelist ${HOME}/.keysnail.js
 whitelist ${HOME}/.lastpass
 whitelist ${HOME}/.local/share/pki
@@ -53,3 +56,4 @@ tracelog
 
 disable-mnt
 # private-etc adobe,alternatives,asound.conf,ca-certificates,crypto-policies,firefox,fonts,group,gtk-2.0,hostname,hosts,iceweasel,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl
+writable-run-user
diff --git a/mkdeb.sh.in b/mkdeb.sh.in
index 6d6981417..79f8d748c 100755
--- a/mkdeb.sh.in
+++ b/mkdeb.sh.in
@@ -9,20 +9,10 @@
 set -e
 NAME=@PACKAGE_NAME@
 VERSION=@PACKAGE_VERSION@
-PACKAGE_TARNAME=@PACKAGE_TARNAME@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_SELINUX=@HAVE_SELINUX@
 EXTRA_VERSION=$1
 
-CONFIG_ARGS="--prefix=/usr"
-if [ -n "$HAVE_APPARMOR" ]; then
-    CONFIG_ARGS="$CONFIG_ARGS --enable-apparmor"
-fi
-if [ -n "$HAVE_SELINUX" ]; then
-    CONFIG_ARGS="$CONFIG_ARGS --enable-selinux"
-fi
+test "$#" -gt 0 && shift
 
-TOP="$PWD"
 CODE_ARCHIVE="$NAME-$VERSION.tar.xz"
 CODE_DIR="$NAME-$VERSION"
 INSTALL_DIR="${INSTALL_DIR}${CODE_DIR}/debian"
@@ -38,7 +28,7 @@ echo "*****************************************"
 tar -xJvf "$CODE_ARCHIVE"
 #mkdir -p "$INSTALL_DIR"
 cd "$CODE_DIR"
-./configure $CONFIG_ARGS
+./configure --prefix=/usr "$@"
 make -j2
 mkdir debian
 DESTDIR=debian make install-strip