memory-deny-write-execute

4 files changed, 14 insertions, 0 deletions

diff --git a/README.md b/README.md
index eb3ef6aae..6cac86da1 100644
--- a/README.md
+++ b/README.md
@@ -134,6 +134,12 @@ Check the status of the latest build here: https://travis-ci.org/netblue30/firej
               Example:
               $ firejail --nodvd
 
+      --memory-deny-write-execute
+              Install a seccomp filter to block  attempts  to  create  memory
+              mappings  that are both writable and executable, to change map‐
+              pings to be executable or to create executable shared memory.
+
+
 `````
 
 ## /etc/firejail/firejail.config
diff --git a/RELNOTES b/RELNOTES
index a46870b2f..02848ca82 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -3,6 +3,7 @@ firejail (0.9.49) baseline; urgency=low
   * modif: --output split in two commands, --output and --output-stderr
   * feature: per-profile disable-mnt (--disable-mnt)
   * feature: per-profile support to set X11 Xephyr screen size (--xephyr-screen)
+  * feature: --memory-deny-write-execute seccomp feature
   * enhancement: /proc/sys mounting
   * enhancement: default seccomp list update
   * enhancement: rework IP address assingment for --net options
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile
index 02e9a5052..5351a1efa 100644
--- a/etc/transmission-qt.profile
+++ b/etc/transmission-qt.profile
@@ -35,3 +35,5 @@ tracelog
 private-bin transmission-qt
 private-dev
 private-tmp
+
+memory-deny-write-execute
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 5bd4f6ef8..9dafb3c65 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -312,6 +312,11 @@ Enable seccomp filter and blacklist  the system calls in the list.
 \fBseccomp.keep syscall,syscall,syscall
 Enable seccomp filter and whitelist the system calls in the list.
 .TP
+\fBmemory-deny-write-execute
+Install a seccomp filter to block attempts to create memory mappings
+that are both writable and executable, to change mappings to be
+executable or to create executable shared memory.
+.TP
 \fBnonewprivs
 Sets the NO_NEW_PRIVS prctl.  This ensures that child processes
 cannot acquire new privileges using execve(2);  in particular,