--ignore cleanup

5 files changed, 36 insertions, 40 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 9f7936174..471f2e55c 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -451,6 +451,7 @@ void fs_chroot(const char *rootdir);
 void fs_check_chroot_dir(const char *rootdir);
 void fs_private_tmp(void);
 void fs_private_cache(void);
+void fs_mnt(void);
 
 // profile.c
 // find and read the profile specified by name from dir directory
@@ -463,7 +464,7 @@ void profile_read(const char *fname);
 int profile_check_line(char *ptr, int lineno, const char *fname);
 // add a profile entry in cfg.profile list; use str to populate the list
 void profile_add(char *str);
-void fs_mnt(void);
+void profile_add_ignore(const char *str);
 
 // list.c
 void list(void);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 3e092a3cc..0651e2f0a 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1469,25 +1469,7 @@ int main(int argc, char **argv) {
                                 fprintf(stderr, "Error: please use --profile after --ignore\n");
                                 exit(1);
                         }
-
-                        if (*(argv[i] + 9) == '\0') {
-                                fprintf(stderr, "Error: invalid ignore option\n");
-                                exit(1);
-                        }
-
-                        // find an empty entry in profile_ignore array
-                        int j;
-                        for (j = 0; j < MAX_PROFILE_IGNORE; j++) {
-                                if (cfg.profile_ignore[j] == NULL)
-                                        break;
-                        }
-                        if (j >= MAX_PROFILE_IGNORE) {
-                                fprintf(stderr, "Error: maximum %d --ignore options are permitted\n", MAX_PROFILE_IGNORE);
-                                exit(1);
-                        }
-                        // ... and configure it
-                        else
-                                cfg.profile_ignore[j] = argv[i] + 9;
+                        profile_add_ignore(argv[i] + 9);
                 }
 #ifdef HAVE_CHROOT
                 else if (strncmp(argv[i], "--chroot=", 9) == 0) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 4b2fb3abd..60f3f86ee 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -87,6 +87,34 @@ static int is_in_ignore_list(char *ptr) {
         return 0;
 }
 
+void profile_add_ignore(const char *str) {
+        assert(str);
+        if (*str == '\0') {
+                fprintf(stderr, "Error: invalid ignore option\n");
+                exit(1);
+        }
+        char *ptr = strdup(str);
+        if (!ptr)
+                errExit("strdup");
+
+        // find an empty entry in profile_ignore array
+        int i;
+        for (i = 0; i < MAX_PROFILE_IGNORE; i++) {
+                if (cfg.profile_ignore[i] == NULL)
+                        break;
+        }
+        if (i >= MAX_PROFILE_IGNORE) {
+                fprintf(stderr, "Error: maximum %d --ignore options are permitted\n", MAX_PROFILE_IGNORE);
+                exit(1);
+        }
+        // ... and configure it
+        else {
+                cfg.profile_ignore[i] = strdup(str);
+                if (!cfg.profile_ignore[i])
+                        errExit("strdup");
+        }
+}
+
 
 // check profile line; if line == 0, this was generated from a command line option
 // return 1 if the command is to be added to the linked list of profile commands
@@ -99,25 +127,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
 
         if (strncmp(ptr, "ignore ", 7) == 0) {
-                char *str = strdup(ptr + 7);
-                if (*str == '\0') {
-                        fprintf(stderr, "Error: invalid ignore option\n");
-                        exit(1);
-                }
-                // find an empty entry in profile_ignore array
-                int j;
-                for (j = 0; j < MAX_PROFILE_IGNORE; j++) {
-                        if (cfg.profile_ignore[j] == NULL)
-                                break;
-                }
-                if (j >= MAX_PROFILE_IGNORE) {
-                        fprintf(stderr, "Error: maximum %d --ignore options are permitted\n", MAX_PROFILE_IGNORE);
-                        exit(1);
-                }
-                // ... and configure it
-                else
-                        cfg.profile_ignore[j] = str;
-
+                profile_add_ignore(ptr + 7);
                 return 0;
         }
 
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index e29cf4f4b..17562c503 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -113,6 +113,8 @@ Example: "nowhitelist ~/.config"
 Ignore command.
 
 Example: "ignore seccomp"
+.br
+Example: "ignore net ehh0"
 
 .TP
 \fBquiet
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index f29d9cddf..c6fd9cea5 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -509,7 +509,8 @@ Ignore command in profile file.
 Example:
 .br
 $ firejail \-\-ignore=shell --ignore=seccomp firefox
-
+.br
+$ firejail \-\-ignore="net eth0" firefox
 .TP
 \fB\-\-interface=interface
 Move interface in a new network namespace. Up to four --interface options can be specified.