added support to disable apparmor globally in /etc/firejail/firejail.config

4 files changed, 13 insertions, 1 deletions

diff --git a/etc/firejail.config b/etc/firejail.config
index 6fd5f1b06..ade3e3c84 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -2,6 +2,8 @@
 # keyword-argument pairs, one per line. Most features are enabled by default.
 # Use 'yes' or 'no' as configuration values.
 
+# Enable AppArmor functionality, default enabled.
+# apparmor yes
 
 # Number of ARP probes sent when assigning an IP address for --net option,
 # default 2. This is a partial implementation of RFC 5227. A 0.5 seconds
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 2629fb3ec..0d77c199b 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -103,6 +103,15 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // apparmor
+                        else if (strncmp(ptr, "apparmor ", 9) == 0) {
+                                if (strcmp(ptr + 9, "yes") == 0)
+                                        cfg_val[CFG_APPARMOR] = 1;
+                                else if (strcmp(ptr + 9, "no") == 0)
+                                        cfg_val[CFG_APPARMOR] = 0;
+                                else
+                                        goto errout;
+                        }
                         // bind
                         else if (strncmp(ptr, "bind ", 5) == 0) {
                                 if (strcmp(ptr + 5, "yes") == 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index e8dc390d4..ca3b73ffc 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -742,6 +742,7 @@ enum {
         CFG_ARP_PROBES,
         CFG_XPRA_ATTACH,
         CFG_PRIVATE_LIB,
+        CFG_APPARMOR,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 47bb94a52..503d822a9 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -1065,7 +1065,7 @@ int sandbox(void* sandbox_arg) {
 
         if (app_pid == 0) {
 #ifdef HAVE_APPARMOR
-                if (arg_apparmor) {
+                if (checkcfg(CFG_APPARMOR) && arg_apparmor) {
                         errno = 0;
                         if (aa_change_onexec("firejail-default")) {
                                 fwarning("Cannot confine the application using AppArmor.\n"