--private-tmp whitelists /tmp/.X11-unix directory

2 files changed, 18 insertions, 14 deletions

diff --git a/RELNOTES b/RELNOTES
index 0920691e7..17d488fac 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -2,6 +2,7 @@ firejail (0.9.43) baseline; urgency=low
   * development version
   * modifs: removed man firejail-config
   * modifs: make deb builds package based on the current configuration
+  * modifs: --private-tmp whitelists /tmp/.X11-unix directory
   * feature: blocking x11 (--x11=block)
   * feature: x11 xpra, x11 xephyr, x11 block profile commands
   * bugfixes
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 76efe996b..cc5483c08 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -593,8 +593,13 @@ int sandbox(void* sandbox_arg) {
                         fprintf(stderr, "Warning: private-tmp feature is disabled in chroot\n");
                 else if (arg_overlay)
                         fprintf(stderr, "Warning: private-tmp feature is disabled in overlay\n");
-                else
-                        fs_private_tmp();
+                else {
+                        // private-tmp is implemented as a whitelist
+                        EUID_USER();
+                        profile_add("whitelist /tmp/.X11-unix");
+                        EUID_ROOT();
+//                      fs_private_tmp();
+                }
         }
         
         //****************************
@@ -606,18 +611,16 @@ int sandbox(void* sandbox_arg) {
         //****************************
         // apply the profile file
         //****************************
-        if (cfg.profile) {
-                // apply all whitelist commands ... 
-                if (cfg.chrootdir)
-                        fprintf(stderr, "Warning: whitelist feature is disabled in chroot\n");
-                else if (arg_overlay)
-                        fprintf(stderr, "Warning: whitelist feature is disabled in overlay\n");
-                else
-                        fs_whitelist();
-                
-                // ... followed by blacklist commands
-                fs_blacklist();
-        }
+        // apply all whitelist commands ... 
+        if (cfg.chrootdir)
+                fprintf(stderr, "Warning: whitelist feature is disabled in chroot\n");
+        else if (arg_overlay)
+                fprintf(stderr, "Warning: whitelist feature is disabled in overlay\n");
+        else
+                fs_whitelist();
+        
+        // ... followed by blacklist commands
+        fs_blacklist();
         
         //****************************
         // install trace