Merge pull request #4771 from kmk3/revert-allow-deny-leftovers

Revert allow/deny leftovers

5 files changed, 15 insertions, 209 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index 0262db608..58e374b8b 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1574,7 +1574,6 @@ int main(int argc, char **argv, char **envp) {
                         profile_add(line);
                 }
 
-                // blacklist/deny
                 else if (strncmp(argv[i], "--blacklist=", 12) == 0) {
                         char *line;
                         if (asprintf(&line, "blacklist %s", argv[i] + 12) == -1)
@@ -1583,14 +1582,6 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL);      // will exit if something wrong
                         profile_add(line);
                 }
-                else if (strncmp(argv[i], "--deny=", 7) == 0) {
-                        char *line;
-                        if (asprintf(&line, "blacklist %s", argv[i] + 7) == -1)
-                                errExit("asprintf");
-
-                        profile_check_line(line, 0, NULL);      // will exit if something wrong
-                        profile_add(line);
-                }
                 else if (strncmp(argv[i], "--noblacklist=", 14) == 0) {
                         char *line;
                         if (asprintf(&line, "noblacklist %s", argv[i] + 14) == -1)
@@ -1599,16 +1590,6 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL);      // will exit if something wrong
                         profile_add(line);
                 }
-                else if (strncmp(argv[i], "--nodeny=", 9) == 0) {
-                        char *line;
-                        if (asprintf(&line, "noblacklist %s", argv[i] + 9) == -1)
-                                errExit("asprintf");
-
-                        profile_check_line(line, 0, NULL);      // will exit if something wrong
-                        profile_add(line);
-                }
-
-                // whitelist
                 else if (strncmp(argv[i], "--whitelist=", 12) == 0) {
                         char *line;
                         if (asprintf(&line, "whitelist %s", argv[i] + 12) == -1)
@@ -1617,14 +1598,6 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL);      // will exit if something wrong
                         profile_add(line);
                 }
-                else if (strncmp(argv[i], "--allow=", 8) == 0) {
-                        char *line;
-                        if (asprintf(&line, "whitelist %s", argv[i] + 8) == -1)
-                                errExit("asprintf");
-
-                        profile_check_line(line, 0, NULL);      // will exit if something wrong
-                        profile_add(line);
-                }
                 else if (strncmp(argv[i], "--nowhitelist=", 14) == 0) {
                         char *line;
                         if (asprintf(&line, "nowhitelist %s", argv[i] + 14) == -1)
@@ -1633,15 +1606,6 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL);      // will exit if something wrong
                         profile_add(line);
                 }
-                else if (strncmp(argv[i], "--noallow=", 10) == 0) {
-                        char *line;
-                        if (asprintf(&line, "nowhitelist %s", argv[i] + 10) == -1)
-                                errExit("asprintf");
-
-                        profile_check_line(line, 0, NULL);      // will exit if something wrong
-                        profile_add(line);
-                }
-
 
                 else if (strncmp(argv[i], "--mkdir=", 8) == 0) {
                         char *line;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 5e24591fa..9504b26de 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1752,44 +1752,6 @@ void profile_read(const char *fname) {
                         continue;
                 }
 
-                // translate allow/deny to whitelist/blacklist
-                if (strncmp(ptr, "allow ", 6) == 0) {
-                        char *tmp;
-                        if (asprintf(&tmp, "whitelist %s", ptr + 6) == -1)
-                                errExit("asprintf");
-                        free(ptr);
-                        ptr = tmp;
-                }
-                else if (strncmp(ptr, "deny ", 5) == 0) {
-                        char *tmp;
-                        if (asprintf(&tmp, "blacklist %s", ptr + 5) == -1)
-                                errExit("asprintf");
-                        free(ptr);
-                        ptr = tmp;
-                }
-                else if (strncmp(ptr, "deny-nolog ", 11) == 0) {
-                        char *tmp;
-                        if (asprintf(&tmp, "blacklist-nolog %s", ptr + 11) == -1)
-                                errExit("asprintf");
-                        free(ptr);
-                        ptr = tmp;
-                }
-                // translate noallow/nodeny to nowhitelist/noblacklist
-                else if (strncmp(ptr, "noallow ", 8) == 0) {
-                        char *tmp;
-                        if (asprintf(&tmp, "nowhitelist %s", ptr + 8) == -1)
-                                errExit("asprintf");
-                        free(ptr);
-                        ptr = tmp;
-                }
-                else if (strncmp(ptr, "nodeny ", 7) == 0) {
-                        char *tmp;
-                        if (asprintf(&tmp, "noblacklist %s", ptr + 7) == -1)
-                                errExit("asprintf");
-                        free(ptr);
-                        ptr = tmp;
-                }
-
                 // process quiet
                 // todo: a quiet in the profile file cannot be disabled by --ignore on command line
                 if (strcmp(ptr, "quiet") == 0) {
diff --git a/src/tools/profcleaner.c b/src/tools/profcleaner.c
deleted file mode 100644
index beff93199..000000000
--- a/src/tools/profcleaner.c
+++ /dev/null
@@ -1,75 +0,0 @@
-/*
- * Copyright (C) 2014-2021 Firejail Authors
- *
- * This file is part of firejail project
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License along
- * with this program; if not, write to the Free Software Foundation, Inc.,
- * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
-
-//*************************************************************
-// Small utility program to convert profiles from blacklist/whitelist to deny/allow
-// Compile:
-//       gcc -o profcleaner profcleaner.c
-// Usage:
-//       profcleaner *.profile
-//*************************************************************
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#define MAXBUF 4096
-
-int main(int argc, char **argv) {
-        printf("Usage: profcleaner files\n");
-        int i;
-
-        for (i = 1; i < argc; i++) {
-                FILE *fp = fopen(argv[i], "r");
-                if (!fp) {
-                        fprintf(stderr, "Error: cannot open %s\n", argv[i]);
-                        return 1;
-                }
-
-                FILE *fpout = fopen("profcleaner-tmp", "w");
-                if (!fpout) {
-                        fprintf(stderr, "Error: cannot open output file\n");
-                        return 1;
-                }
-
-                char buf[MAXBUF];
-                while (fgets(buf, MAXBUF, fp)) {
-                        if (strncmp(buf, "blacklist-nolog", 15) == 0)
-                                fprintf(fpout, "deny-nolog %s", buf + 15);
-                        else if (strncmp(buf, "blacklist", 9) == 0)
-                                fprintf(fpout, "deny %s", buf + 9);
-                        else if (strncmp(buf, "noblacklist", 11) == 0)
-                                fprintf(fpout, "nodeny %s", buf + 11);
-                        else if (strncmp(buf, "whitelist", 9) == 0)
-                                fprintf(fpout, "allow %s", buf + 9);
-                        else if (strncmp(buf, "nowhitelist", 11) == 0)
-                                fprintf(fpout, "noallow %s", buf + 11);
-                        else
-                                fprintf(fpout, "%s", buf);
-                }
-
-                fclose(fp);
-                fclose(fpout);
-                unlink(argv[i]);
-                rename("profcleaner-tmp", argv[i]);
-        }
-
-        return 0;
-}
diff --git a/src/tools/profcleaner.sh b/src/tools/profcleaner.sh
deleted file mode 100755
index 96402aed6..000000000
--- a/src/tools/profcleaner.sh
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2021 Firejail Authors
-#
-# This file is part of firejail project
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License as published by
-# the Free Software Foundation; either version 2 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License along
-# with this program; if not, write to the Free Software Foundation, Inc.,
-# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-
-if [[ $1 == --help ]]; then
-        cat <<-EOM
-        USAGE:
-          profcleaner.sh --help        Show this help message and exit
-          profcleaner.sh --system      Clean all profiles in /etc/firejail
-          profcleaner.sh --user        Clean all profiles in ~/.config/firejail
-          profcleaner.sh /path/to/profile1 /path/to/profile2 ...
-        EOM
-        exit 0
-fi
-
-if [[ $1 == --system ]]; then
-        profiles=(/etc/firejail/*.{inc,local,profile})
-elif [[ $1 == --user ]]; then
-        profiles=("$HOME"/.config/firejail/*.{inc,local,profile})
-else
-        profiles=("$@")
-fi
-
-sed -i -E \
-        -e "s/^(# |#)?(ignore )?blacklist/\1\2deny/" \
-        -e "s/^(# |#)?(ignore )?noblacklist/\1\2nodeny/" \
-        -e "s/^(# |#)?(ignore )?whitelist/\1\2allow/" \
-        -e "s/^(# |#)?(ignore )?nowhitelist/\1\2noallow/" \
-        "${profiles[@]}"
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
index 6ce71aed8..8c1d758cc 100644
--- a/src/zsh_completion/_firejail.in
+++ b/src/zsh_completion/_firejail.in
@@ -48,8 +48,8 @@ _firejail_args=(
     '*::arguments:_normal'
 
     '--appimage[sandbox an AppImage application]'
-    '--build[build a profile for the application and print it on stdout]'
-    '--build=-[build a profile for the application and save it]: :_files'
+    '--build[build a whitelisted profile for the application and print it on stdout]'
+    '--build=-[build a whitelisted profile for the application and save it]: :_files'
     # Ignore that you can do -? too as it's the only short option
     '--help[this help screen]'
     '--join=-[join the sandbox name|pid]: :_all_firejails'
@@ -66,14 +66,14 @@ _firejail_args=(
     '--ids-init[initialize IDS database]'
 
     '--debug[print sandbox debug messages]'
-    '--debug-allow[debug file system access]'
+    '--debug-blacklists[debug blacklisting]'
     '--debug-caps[print all recognized capabilities]'
-    '--debug-deny[debug file system access]'
     '--debug-errnos[print all recognized error numbers]'
     '--debug-private-lib[debug for --private-lib option]'
     '--debug-protocols[print all recognized protocols]'
     '--debug-syscalls[print all recognized system calls]'
     '--debug-syscalls32[print all recognized 32 bit system calls]'
+    '--debug-whitelists[debug whitelisting]'
 
     '--caps.print=-[print the caps filter name|pid]:firejail:_all_firejails'
     '--cpu.print=-[print the cpus in use name|pid]: :_all_firejails'
@@ -86,13 +86,13 @@ _firejail_args=(
     '--allusers[all user home directories are visible inside the sandbox]'
     # Should be _files, a comma and files or files -/
     '*--bind=-[mount-bind dirname1/filename1 on top of dirname2/filename2]: :(file1,file2 dir1,dir2)'
+    '*--blacklist=-[blacklist directory or file]: :_files'
     '--caps[enable default Linux capabilities filter]'
     '--caps.drop=all[drop all capabilities]'
     '*--caps.drop=-[drop capabilities: all|cap1,cap2,...]: :_caps'
     '*--caps.keep=-[keep capabilities: cap1,cap2,...]: :_caps'
     '--cgroup=-[place the sandbox in the specified control group]: :'
     '--cpu=-[set cpu affinity]: :->cpus'
-    '*--deny=-[deny access to directory or file]: :_files'
     "--deterministic-exit-code[always exit with first child's status code]"
     '--deterministic-shutdown[terminate orphan processes]'
     '*--dns=-[set DNS server]: :'
@@ -116,7 +116,7 @@ _firejail_args=(
     '--nice=-[set nice value]: :(1 10 15 20)'
     '--no3d[disable 3D hardware acceleration]'
     '--noautopulse[disable automatic ~/.config/pulse init]'
-    '--nodeny=-[disable deny command for file or directory]: :_files'
+    '--noblacklist=-[disable blacklist for file or directory]: :_files'
     '--nodbus[disable D-Bus access]'
     '--nodvd[disable DVD and audio CD devices]'
     '*--noexec=-[remount the file or directory noexec nosuid and nodev]: :_files'
@@ -147,13 +147,13 @@ _firejail_args=(
     '--rlimit-nproc=-[set the maximum number of processes that can be created for the real user ID of the calling process]: :'
     '--rlimit-sigpending=-[set the maximum number of pending signals for a process]: :'
     '*--rmenv=-[remove environment variable in the new sandbox]: :_values environment-variables $(env | cut -d= -f1)'
-    '--seccomp[enable seccomp filter and drop the default syscalls]: :'
-    '--seccomp=-[enable seccomp filter, drop the default syscall list and the syscalls specified by the command]: :->seccomp'
+    '--seccomp[enable seccomp filter and apply the default blacklist]: :'
+    '--seccomp=-[enable seccomp filter, blacklist the default syscall list and the syscalls specified by the command]: :->seccomp'
     '--seccomp.block-secondary[build only the native architecture filters]'
-    '*--seccomp.drop=-[enable seccomp filter, and drop the syscalls specified by the command]: :->seccomp'
-    '*--seccomp.keep=-[enable seccomp filter, and allow the syscalls specified by the command]: :->seccomp'
-    '*--seccomp.32.drop=-[enable seccomp filter, and drop the 32 bit syscalls specified by the command]: :'
-    '*--seccomp.32.keep=-[enable seccomp filter, and drop the 32 bit syscalls specified by the command]: :'
+    '*--seccomp.drop=-[enable seccomp filter, and blacklist the syscalls specified by the command]: :->seccomp'
+    '*--seccomp.keep=-[enable seccomp filter, and whitelist the syscalls specified by the command]: :->seccomp'
+    '*--seccomp.32.drop=-[enable seccomp filter, and blacklist the 32 bit syscalls specified by the command]: :'
+    '*--seccomp.32.keep=-[enable seccomp filter, and whitelist the 32 bit syscalls specified by the command]: :'
     # FIXME: Add errnos
     '--seccomp-error-action=-[change error code, kill process or log the attempt]: :(kill log)'
     '--shell=none[run the program directly without a user shell]'
@@ -161,7 +161,7 @@ _firejail_args=(
     '--timeout=-[kill the sandbox automatically after the time has elapsed]: :'
     #'(--tracelog)--trace[trace open, access and connect system calls]'
     '(--tracelog)--trace=-[trace open, access and connect system calls]: :_files'
-    '(--trace)--tracelog[add a syslog message for every access to files or directories dropped by the security profile]'
+    '(--trace)--tracelog[add a syslog message for every access to files or directories blacklisted by the security profile]'
     '(--private-etc)--writable-etc[/etc directory is mounted read-write]'
     '--writable-run-user[allow access to /run/user/$UID/systemd and /run/user/$UID/gnupg]'
     '--writable-var[/var directory is mounted read-write]'
@@ -255,8 +255,8 @@ _firejail_args=(
     '*--tmpfs=-[mount a tmpfs filesystem on directory dirname]: :_files -/'
 #endif
 
-    '*--noallow=-[disable allow command for file or directory]: :_files'
-    '*--allow=-[allow file system access]: :_files'
+    '*--nowhitelist=-[disable whitelist for file or directory]: :_files'
+    '*--whitelist=-[whitelist directory or file]: :_files'
 
 #ifdef HAVE_X11
     '--x11[enable X11 sandboxing. The software checks first if Xpra is installed, then it checks if Xephyr is installed. If all fails, it will attempt to use X11 security extension]'