Merge pull request #1 from netblue30/master

merge upstream

28 files changed, 147 insertions, 22 deletions

diff --git a/README b/README
index 5dc50c9bf..751480868 100644
--- a/README
+++ b/README
@@ -97,6 +97,13 @@ valoq (https://github.com/valoq)
         - added skanlite, ssh-agent, transmission-cli, tracker, transmission-show, w3m, xfburn, xpra profiles
         - added wget profile
         - disable gnupg and systemd directories under /run/user
+eventyrer (https://github.com/eventyrer)
+        - update gnome-mplayer.profile
+thewisenerd (https://github.com/thewisenerd)
+        - allow multiple private-home commands
+        - use $SHELL variable if the shell is not specified
+SYN-cook (https://github.com/SYN-cook)
+        - keepass/keepassx browser fixes
 thewisenerd (https://github.com/thewisenerd)
         - appimage: pass commandline arguments
 KOLANICH (https://github.com/KOLANICH)
diff --git a/etc/7z.profile b/etc/7z.profile
index 0cb72ff8d..319126540 100644
--- a/etc/7z.profile
+++ b/etc/7z.profile
@@ -1,9 +1,14 @@
 # 7zip crompression tool profile
 quiet
 ignore noroot
+
 include /etc/firejail/default.profile
+
+blacklist /tmp/.X11-unix
+
 tracelog
 net none
 shell none
 private-dev
 nosound
+no3d
diff --git a/etc/atool.profile b/etc/atool.profile
index 3fbfb9fc7..578a88fc7 100644
--- a/etc/atool.profile
+++ b/etc/atool.profile
@@ -13,9 +13,12 @@ protocol unix
 seccomp
 netfilter
 net none
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin atool
 private-tmp
 private-dev
diff --git a/etc/cpio.profile b/etc/cpio.profile
index 519bd244c..cf89acdac 100644
--- a/etc/cpio.profile
+++ b/etc/cpio.profile
@@ -16,6 +16,7 @@ shell none
 tracelog
 net none
 nosound
+no3d
 
-
+blacklist /tmp/.X11-unix
 
diff --git a/etc/elinks.profile b/etc/elinks.profile
index df817ea56..ade15f203 100644
--- a/etc/elinks.profile
+++ b/etc/elinks.profile
@@ -11,12 +11,15 @@ nogroups
 nonewprivs
 noroot
 nosound
+no3d
 protocol unix,inet,inet6
 seccomp
 netfilter
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin elinks
 private-tmp
 private-dev
diff --git a/etc/exiftool.profile b/etc/exiftool.profile
index 384695473..1cae8c093 100644
--- a/etc/exiftool.profile
+++ b/etc/exiftool.profile
@@ -17,9 +17,12 @@ protocol unix
 seccomp
 netfilter
 net none
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin exiftool,perl
 private-tmp
 private-dev
diff --git a/etc/git.profile b/etc/git.profile
index d60e58c03..80e534e20 100644
--- a/etc/git.profile
+++ b/etc/git.profile
@@ -12,15 +12,17 @@ include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-passwdmgr.inc
 
-
 caps.drop all
 netfilter
 nogroups
 nonewprivs
 noroot
 nosound
+no3d
 protocol unix,inet,inet6
 seccomp
 shell none
 
+blacklist /tmp/.X11-unix
+
 private-dev
diff --git a/etc/gnome-mplayer.profile b/etc/gnome-mplayer.profile
index 1b0fc9807..488c7e0b8 100644
--- a/etc/gnome-mplayer.profile
+++ b/etc/gnome-mplayer.profile
@@ -12,6 +12,6 @@ protocol unix,inet,inet6
 seccomp
 shell none
 
-private-bin gnome-mplayer
+private-bin gnome-mplayer,mplayer
 private-dev
 private-tmp
diff --git a/etc/gpg-agent.profile b/etc/gpg-agent.profile
index b0ebdf43c..59c7383d7 100644
--- a/etc/gpg-agent.profile
+++ b/etc/gpg-agent.profile
@@ -14,9 +14,12 @@ nosound
 protocol unix
 seccomp
 netfilter
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin gpg-agent,gpg
 private-tmp
 private-dev
diff --git a/etc/gpg.profile b/etc/gpg.profile
index 31372eb90..d711c6f3e 100644
--- a/etc/gpg.profile
+++ b/etc/gpg.profile
@@ -15,9 +15,12 @@ protocol unix
 seccomp
 netfilter
 net none
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin gpg,gpg-agent
 private-tmp
 private-dev
diff --git a/etc/highlight.profile b/etc/highlight.profile
index f95f3924a..4bab18349 100644
--- a/etc/highlight.profile
+++ b/etc/highlight.profile
@@ -13,10 +13,14 @@ protocol unix
 seccomp
 netfilter
 net none
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 private-bin highlight
+# private-etc none
 private-tmp
 private-dev
 
diff --git a/etc/less.profile b/etc/less.profile
index 08758aead..c01dfc466 100644
--- a/etc/less.profile
+++ b/etc/less.profile
@@ -5,7 +5,10 @@ include /etc/firejail/default.profile
 
 net none
 nosound
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 private-dev
diff --git a/etc/lynx.profile b/etc/lynx.profile
index 6e150f62e..3e8d72103 100644
--- a/etc/lynx.profile
+++ b/etc/lynx.profile
@@ -9,12 +9,15 @@ nogroups
 nonewprivs
 noroot
 nosound
+no3d
 protocol unix,inet,inet6
 seccomp
 netfilter
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin lynx
 private-tmp
 private-dev
diff --git a/etc/mediainfo.profile b/etc/mediainfo.profile
index c07a9a9e8..65d12c49e 100644
--- a/etc/mediainfo.profile
+++ b/etc/mediainfo.profile
@@ -9,6 +9,7 @@ nogroups
 nonewprivs
 noroot
 nosound
+no3d
 protocol unix
 seccomp
 netfilter
@@ -16,6 +17,8 @@ net none
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 private-bin mediainfo
 private-tmp
 private-dev
diff --git a/etc/mutt.profile b/etc/mutt.profile
index 2718421c5..5a714de4a 100644
--- a/etc/mutt.profile
+++ b/etc/mutt.profile
@@ -33,8 +33,11 @@ nogroups
 nonewprivs
 noroot
 nosound
+no3d
 protocol unix,inet,inet6
 seccomp
 shell none
 
+blacklist /tmp/.X11-unix
+
 private-dev
diff --git a/etc/odt2txt.profile b/etc/odt2txt.profile
index 329275022..c4e28f70e 100644
--- a/etc/odt2txt.profile
+++ b/etc/odt2txt.profile
@@ -13,9 +13,12 @@ protocol unix
 seccomp
 netfilter
 net none
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 private-bin odt2txt
 private-tmp
 private-dev
diff --git a/etc/pdftotext.profile b/etc/pdftotext.profile
index 632c9d15e..fe9e9e3cd 100644
--- a/etc/pdftotext.profile
+++ b/etc/pdftotext.profile
@@ -13,9 +13,12 @@ protocol unix
 seccomp
 netfilter
 net none
+no3d
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 private-bin pdftotext
 private-tmp
 private-dev
diff --git a/etc/ssh-agent.profile b/etc/ssh-agent.profile
index 548ede37d..bea3a6061 100644
--- a/etc/ssh-agent.profile
+++ b/etc/ssh-agent.profile
@@ -12,5 +12,8 @@ caps.drop all
 netfilter
 nonewprivs
 noroot
+no3d
 protocol unix,inet,inet6
 seccomp
+
+blacklist /tmp/.X11-unix
diff --git a/etc/strings.profile b/etc/strings.profile
index 2b7724b11..2bbab1366 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -7,5 +7,6 @@ net none
 nosound
 shell none
 tracelog
-
 private-dev
+no3d
+blacklist /tmp/.X11-unix
diff --git a/etc/tracker.profile b/etc/tracker.profile
index 217631216..7f4f371eb 100644
--- a/etc/tracker.profile
+++ b/etc/tracker.profile
@@ -12,12 +12,15 @@ nogroups
 nonewprivs
 noroot
 nosound
+no3d
 protocol unix
 seccomp
 netfilter
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin tracker
 # private-tmp
 # private-dev
diff --git a/etc/w3m.profile b/etc/w3m.profile
index d765217cf..7ee91bb70 100644
--- a/etc/w3m.profile
+++ b/etc/w3m.profile
@@ -11,12 +11,15 @@ nogroups
 nonewprivs
 noroot
 nosound
+no3d
 protocol unix,inet,inet6
 seccomp
 netfilter
 shell none
 tracelog
 
+blacklist /tmp/.X11-unix
+
 # private-bin w3m
 private-tmp
 private-dev
diff --git a/etc/wget.profile b/etc/wget.profile
index d9bca2acc..ff4b92bae 100644
--- a/etc/wget.profile
+++ b/etc/wget.profile
@@ -10,10 +10,12 @@ nonewprivs
 noroot
 nogroups
 nosound
+no3d
 protocol unix,inet,inet6
 seccomp
 shell none
 
+blacklist /tmp/.X11-unix
 
 # private-bin wget
 # private-etc resolv.conf
diff --git a/etc/xpra.profile b/etc/xpra.profile
index 8584e4e5b..32be90b19 100644
--- a/etc/xpra.profile
+++ b/etc/xpra.profile
@@ -14,6 +14,8 @@ shell none
 seccomp
 protocol unix,inet,inet6
 
+# blacklist /tmp/.X11-unix
+
 # private-bin 
 private-dev
 private-tmp
diff --git a/src/firejail/cmdline.c b/src/firejail/cmdline.c
index dcb0a5424..a17758f8b 100644
--- a/src/firejail/cmdline.c
+++ b/src/firejail/cmdline.c
@@ -163,7 +163,7 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
         // the program should exit with an error before entering this function
         assert(index != -1);
 
-        unsigned argcount = argc - index;
+//      unsigned argcount = argc - index;
 
         int len1 = cmdline_length(argc, argv, index);  // length of argv w/o changes
         int len2 = cmdline_length(1, &argv[index], 0); // apptest.AppImage
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index b10858411..0970642db 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -95,9 +95,10 @@ static char *resolve_downloads(void) {
                                         if (asprintf(&fname, "%s/%s", cfg.homedir, ptr1) == -1)
                                                 errExit("asprintf");
                                         
-                                        if (stat(fname, &s) == -1)
+                                        if (stat(fname, &s) == -1) {
                                                 free(fname);
                                                 goto errout;
+                                        }
                                 
                                         char *rv;
                                         if (asprintf(&rv, "whitelist ~/%s", ptr + 24) == -1)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 15820f7dd..e70e20eec 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -754,12 +754,21 @@ static void delete_x11_file(pid_t pid) {
 
 char *guess_shell(void) {
         char *shell = NULL;
+        struct stat s;
+
+        shell = getenv("SHELL");
+        if (shell) {
+                // TODO: handle rogue shell variables?
+                if (stat(shell, &s) == 0 && access(shell, R_OK) == 0) {
+                        return shell;
+                }
+        }
+
         // shells in order of preference
         char *shells[] = {"/bin/bash", "/bin/csh", "/usr/bin/zsh", "/bin/sh", "/bin/ash", NULL };
 
         int i = 0;
         while (shells[i] != NULL) {
-                struct stat s;
                 // access call checks as real UID/GID, not as effective UID/GID
                 if (stat(shells[i], &s) == 0 && access(shells[i], R_OK) == 0) {
                         shell = shells[i];
@@ -1500,7 +1509,15 @@ int main(int argc, char **argv) {
                                 }
                                 
                                 // extract private home dirname
-                                cfg.home_private_keep = argv[i] + 15;
+                                if (*(argv[i] + 15) == '\0') {
+                                        fprintf(stderr, "Error: invalid private-home option\n");
+                                        exit(1);
+                                }
+                                if (cfg.home_private_keep) {
+                                        if ( asprintf(&cfg.home_private_keep, "%s,%s", cfg.home_private_keep, argv[i] + 15) < 0 )
+                                                errExit("asprintf");
+                                } else
+                                        cfg.home_private_keep = argv[i] + 15;
                                 arg_private = 1;
                         }
                         else
@@ -1517,38 +1534,54 @@ int main(int argc, char **argv) {
                         }
                         
                         // extract private etc list
-                        cfg.etc_private_keep = argv[i] + 14;
-                        if (*cfg.etc_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-etc option\n");
                                 exit(1);
                         }
+                        if (cfg.etc_private_keep) {
+                                if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.etc_private_keep = argv[i] + 14;
                         arg_private_etc = 1;
                 }
                 else if (strncmp(argv[i], "--private-opt=", 14) == 0) {
                         // extract private opt list
-                        cfg.opt_private_keep = argv[i] + 14;
-                        if (*cfg.opt_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-opt option\n");
                                 exit(1);
                         }
+                        if (cfg.opt_private_keep) {
+                                if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.opt_private_keep = argv[i] + 14;
                         arg_private_opt = 1;
                 }
                 else if (strncmp(argv[i], "--private-srv=", 14) == 0) {
                         // extract private srv list
-                        cfg.srv_private_keep = argv[i] + 14;
-                        if (*cfg.srv_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-etc option\n");
                                 exit(1);
                         }
+                        if (cfg.srv_private_keep) {
+                                if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.srv_private_keep = argv[i] + 14;
                         arg_private_srv = 1;
                 }
                 else if (strncmp(argv[i], "--private-bin=", 14) == 0) {
                         // extract private bin list
-                        cfg.bin_private_keep = argv[i] + 14;
-                        if (*cfg.bin_private_keep == '\0') {
+                        if (*(argv[i] + 14) == '\0') {
                                 fprintf(stderr, "Error: invalid private-bin option\n");
                                 exit(1);
                         }
+                        if (cfg.bin_private_keep) {
+                                if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, argv[i] + 14) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.bin_private_keep = argv[i] + 14;
                         arg_private_bin = 1;
                 }
                 else if (strcmp(argv[i], "--private-tmp") == 0) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index da3daf95a..fab4f1efa 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -179,7 +179,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         if (strncmp(ptr, "private-home ", 13) == 0) {
 #ifdef HAVE_PRIVATE_HOME
                 if (checkcfg(CFG_PRIVATE_HOME)) {
-                        cfg.home_private_keep = ptr + 13;
+                        if (cfg.home_private_keep) {
+                                if ( asprintf(&cfg.home_private_keep, "%s,%s", cfg.home_private_keep, ptr + 13) < 0 )
+                                        errExit("asprintf");
+                        } else
+                                cfg.home_private_keep = ptr + 13;
                         arg_private = 1;
                 }
                 else
@@ -748,7 +752,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
                         exit(1);
                 }
-                cfg.etc_private_keep = ptr + 12;
+                if (cfg.etc_private_keep) {
+                        if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.etc_private_keep = ptr + 12;
+                }
                 arg_private_etc = 1;
                 
                 return 0;
@@ -756,7 +765,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /opt list of files and directories
         if (strncmp(ptr, "private-opt ", 12) == 0) {
-                cfg.opt_private_keep = ptr + 12;
+                if (cfg.opt_private_keep) {
+                        if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.opt_private_keep = ptr + 12;
+                }
                 arg_private_opt = 1;
                 
                 return 0;
@@ -764,7 +778,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /srv list of files and directories
         if (strncmp(ptr, "private-srv ", 12) == 0) {
-                cfg.srv_private_keep = ptr + 12;
+                if (cfg.srv_private_keep) {
+                        if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.srv_private_keep = ptr + 12;
+                }
                 arg_private_srv = 1;
                 
                 return 0;
@@ -772,7 +791,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /bin list of files
         if (strncmp(ptr, "private-bin ", 12) == 0) {
-                cfg.bin_private_keep = ptr + 12;
+                if (cfg.bin_private_keep) {
+                        if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, ptr + 12) < 0 )
+                                errExit("asprintf");
+                } else {
+                        cfg.bin_private_keep = ptr + 12;
+                }
                 arg_private_bin = 1;
                 return 0;
         }
diff --git a/test/fs/whitelist-dev.exp b/test/fs/whitelist-dev.exp
index a2002bc0a..827f32126 100755
--- a/test/fs/whitelist-dev.exp
+++ b/test/fs/whitelist-dev.exp
@@ -33,7 +33,8 @@ sleep 1
 send -- "ls -l /dev | wc -l\r"
 expect {
         timeout {puts "TESTING ERROR 3\n";exit}
-        "13"
+        "13" {puts "OK\n"}
+        "12" {puts "OK\n"}
 }
 after 100
 send -- "exit\r"