added netfilter-default config option in /etc/firejail/firejail.config

6 files changed, 37 insertions, 2 deletions

diff --git a/RELNOTES b/RELNOTES
index be65b9fca..4a6ae81ed 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,4 +1,4 @@
-firejail (0.9.42~rc1) baseline; urgency=low
+firejail (0.9.42~rc2) baseline; urgency=low
   * deprecated --user option, please use "sudo -u username firejail" instead
   * --read-write option rework
   * allow symlinks in home directory for --whitelist option
@@ -12,6 +12,7 @@ firejail (0.9.42~rc1) baseline; urgency=low
   * seccomp filter updated
   * compile time and run time support to disable whitelists
   * compile time support to disable global configuration file
+  * added netfilter-default config option in /etc/firejail/firejail.config
   * new profiles: Gitter, gThumb, mpv, Franz messenger, LibreOffice
   * new profiles: pix, audacity, strings, xz, xzdec, gzip, cpio, less
   * new profiles: Atom Beta, Atom, jitsi, eom
diff --git a/etc/firejail.config b/etc/firejail.config
index 59bbd77a5..20c4d7a5f 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -27,6 +27,13 @@
 # --netfilter only to root user. Regular users are only allowed --net=none.
 # restricted-network no
 
+# Change default netfilter configuration. When using --netfilter option without
+# a file argument, the default filter is hardcoded (see man 1 firejail). This
+# configuration entry allows the user to change the default by specifying
+# a file containing the filter configuration. The filter file format is the
+# format of  iptables-save  and iptable-restore commands. Example:
+# netfilter-default /etc/iptables.iptables.rules
+
 # Enable or disable seccomp support, default enabled.
 # seccomp yes
 
diff --git a/etc/nolocal.net b/etc/nolocal.net
index 9c0c6e125..9fa785450 100644
--- a/etc/nolocal.net
+++ b/etc/nolocal.net
@@ -4,7 +4,8 @@
 :OUTPUT ACCEPT [0:0]
 
 ###################################################################
-# Client filter rejecting local network traffic, with the exception of DNS traffic
+# Client filter rejecting local network traffic, with the exception of
+# DNS traffic
 #
 # Usage:
 #     firejail --net=eth0 --netfilter=/etc/firejail/nolocal.net firefox
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 6636e7efe..6929988ae 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -26,6 +26,7 @@ static int initialized = 0;
 static int cfg_val[CFG_MAX];
 char *xephyr_screen = "800x600";
 char *xephyr_extra_params = "";
+char *netfilter_default = NULL;
 
 int checkcfg(int val) {
         EUID_ASSERT();
@@ -159,6 +160,28 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // netfilter
+                        else if (strncmp(ptr, "netfilter-default ", 18) == 0) {
+                                char *fname = ptr + 18;
+                                while (*fname == ' ' || *fname == '\t')
+                                        ptr++;
+                                char *end = strchr(fname, ' ');
+                                if (end)
+                                        *end = '\0';
+                                
+                                // is the file present?
+                                struct stat s;
+                                if (stat(fname, &s) == -1) {
+                                        fprintf(stderr, "Error: netfilter-default file %s not available\n", fname);
+                                        exit(1);
+                                }
+                                
+                                netfilter_default = strdup(fname);
+                                if (!netfilter_default)
+                                        errExit("strdup");
+                                if (arg_debug)
+                                        printf("netfilter default file %s\n", fname);
+                        }
                         
                         // Xephyr screen size
                         else if (strncmp(ptr, "xephyr-screen ", 14) == 0) {
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 29bb6c494..7a538327d 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -582,6 +582,7 @@ void sandboxfs(int op, pid_t pid, const char *patqh);
 #define CFG_MAX 11 // this should always be the last entry
 extern char *xephyr_screen;
 extern char *xephyr_extra_params;
+extern char *netfilter_default;
 int checkcfg(int val);
 
 // appimage.c
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index 71abfb53d..b50d61039 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -66,6 +66,8 @@ void netfilter(const char *fname) {
 
         // custom filter
         int allocated = 0;
+        if (netfilter_default)
+                fname = netfilter_default;
         if (fname) {
                 // buffer the filter
                 struct stat s;