private-lib

1 files changed, 38 insertions, 15 deletions

diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 690d0c1c1..4a396b809 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1272,32 +1272,55 @@ $ ls /bin
 bash  cat  ls  sed
 
 .TP
-\fB\-\-private-lib=file,file
-Build a new /lib in a temporary filesystem. For command to be executed,
-the shell (if \-\-shell=none is not used), and the listed libraries
-find out dynamic libraries and copy them to the /lib directory.
-If no listed file is found, /lib directory will be empty and no programs will be able to execute.
-The same directory is also bind-mounted over /lib64 and /usr/lib.
-All modifications are discarded when the sandbox is closed.
+\fB\-\-private-lib=file,directory
+This feature is currently under heavy development. Only amd64 platforms are supported at this moment.
+The idea is to build a new /lib in a temporary filesystem,
+with only the library files necessary to run the application.
+It could be as simple as:
 .br
 
 .br
-Example:
+$ firejail --private-lib galculator
+.br
+
+.br
+but it gets complicated really fast:
 .br
-$ firejail \-\-noprofile \-\-shell=none \-\-private-lib= \-\-private-bin=ls /bin/ls /lib /bin
+
+.br
+$ firejail --private-lib=x86_64-linux-gnu/xed,x86_64-linux-gnu/gdk-pixbuf-2.0,libenchant.so.1,librsvg-2.so.2 xed
 .br
-Parent pid 15733, child pid 15734
+
 .br
-Child process initialized in 69.61 ms
+The feature is integrated with \-\-private-bin:
+.br
+
 .br
-/bin:
+$ firejail --private-lib --private-bin=bash,ls,ps
 .br
-ls
+$ ls /lib
 .br
+ld-linux-x86-64.so.2 libgpg-error.so.0 libprocps.so.6 libsystemd.so.0
 .br
-/lib:
+libc.so.6 liblz4.so.1 libpthread.so.0 libtinfo.so.5
 .br
-ld-linux-x86-64.so.2  libc.so.6  libdl.so.2  libpcre.so.3  libpthread.so.0  libselinux.so.1
+libdl.so.2 liblzma.so.5 librt.so.1 x86_64-linux-gnu
+.br
+libgcrypt.so.20 libpcre.so.3 libselinux.so.1
+.br
+$ ps
+.br
+ PID TTY          TIME CMD
+.br
+    1 pts/0    00:00:00 firejail
+.br
+   45 pts/0    00:00:00 bash
+.br
+   48 pts/0    00:00:00 ps
+.br
+$ 
+.br
+
 
 .TP
 \fB\-\-private-dev