feature: add notpm command & keep tpm devices in private-dev (#6390)

An ssh private key may be stored in a Trusted Platform Module (TPM)
device and `private-dev` in ssh.profile currently breaks this use-case,
as it does not keep tpm devices (see #6379).

So add a new `notpm` command and keep tpm devices in /dev by default
with `private-dev` unless `notpm` is used.

1 files changed, 14 insertions, 4 deletions

diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in
index 76f0e29ab..f14eb6ec0 100644
--- a/src/man/firejail.1.in
+++ b/src/man/firejail.1.in
@@ -1919,6 +1919,16 @@ Example:
 $ firejail \-\-nosound firefox
 
 .TP
+\fB\-\-notpm
+Disable Trusted Platform Module (TPM) devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-notpm
+
+.TP
 \fB\-\-notv
 Disable DVB (Digital Video Broadcasting) TV devices.
 .br
@@ -2173,10 +2183,10 @@ $ pwd
 .TP
 \fB\-\-private-dev
 Create a new /dev directory.
-Only disc, dri, dvb, full, hidraw, log, null, ptmx, pts, random, shm, snd, tty,
-urandom, usb, video and zero devices are available.
-Use the options \-\-no3d, \-\-nodvd, \-\-nosound, \-\-notv, \-\-nou2f and
-\-\-novideo for additional restrictions.
+Only disc, dri, dvb, full, hidraw, log, null, ptmx, pts, random, shm, snd, tpm,
+tty, urandom, usb, video and zero devices are available.
+Use the options \-\-no3d, \-\-nodvd, \-\-nosound, \-\-notpm, \-\-notv,
+\-\-nou2f and \-\-novideo for additional restrictions.
 .br
 
 .br