add switch to disable/enable private-cache

6 files changed, 23 insertions, 3 deletions

diff --git a/etc/firejail.config b/etc/firejail.config
index 1f47f77d0..91a03f095 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -59,6 +59,9 @@
 # Enable or disable private-home feature, default enabled
 # private-home yes
 
+# Enable or disable private-cache feature, default enabled
+# private-cache yes
+
 # Enable or disable private-lib feature, default enabled
 # private-lib yes
 
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 06820ce24..50f952e91 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -323,6 +323,14 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        else if (strncmp(ptr, "private-cache ", 14) == 0) {
+                                if (strcmp(ptr + 14, "yes") == 0)
+                                        cfg_val[CFG_PRIVATE_CACHE] = 1;
+                                else if (strcmp(ptr + 14, "no") == 0)
+                                        cfg_val[CFG_PRIVATE_CACHE] = 0;
+                                else
+                                        goto errout;
+                        }
                         else if (strncmp(ptr, "private-lib ", 12) == 0) {
                                 if (strcmp(ptr + 12, "yes") == 0)
                                         cfg_val[CFG_PRIVATE_LIB] = 1;
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 051456539..389bdbbcb 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -724,6 +724,7 @@ void x11_start_xpra(int argc, char **argv);
 void x11_start_xephyr(int argc, char **argv);
 void x11_block(void);
 void x11_start_xvfb(int argc, char **argv);
+void x11_xorg(void);
 
 // ls.c
 enum {
@@ -760,6 +761,7 @@ enum {
         CFG_PRIVATE_LIB,
         CFG_APPARMOR,
         CFG_DBUS,
+        CFG_PRIVATE_CACHE,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
@@ -770,7 +772,6 @@ extern char *xvfb_extra_params;
 extern char *netfilter_default;
 int checkcfg(int val);
 void print_compiletime_support(void);
-void x11_xorg(void);
 
 // appimage.c
 void appimage_set(const char *appimage_path);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index fa3b3da0a..707817b1c 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1497,6 +1497,8 @@ void fs_private_cache(void) {
                 return;
         }
 
+        if (arg_debug)
+                printf("Mounting tmpfs on %s\n", cache);
         // get a file descriptor for ~/.cache, fails if there is any symlink
         int fd = safe_fd(cache, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index da052320c..7c44aca95 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1702,7 +1702,10 @@ int main(int argc, char **argv) {
                         arg_private_tmp = 1;
                 }
                 else if (strcmp(argv[i], "--private-cache") == 0) {
-                        arg_private_cache = 1;
+                        if (checkcfg(CFG_PRIVATE_CACHE))
+                                arg_private_cache = 1;
+                        else
+                                exit_err_feature("private-cache");
                 }
 
                 //*************************************
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index bc5915d46..db58d2e0b 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -225,7 +225,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         else if (strcmp(ptr, "private-cache") == 0) {
-                arg_private_cache = 1;
+                if (checkcfg(CFG_PRIVATE_CACHE))
+                        arg_private_cache = 1;
+                else
+                        warning_feature_disabled("private-cache");
                 return 0;
         }
         else if (strcmp(ptr, "private-dev") == 0) {