--notv for #1446

7 files changed, 80 insertions, 46 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 86f730aa0..bb16ea42b 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -360,6 +360,7 @@ extern int arg_machineid;	// preserve /etc/machine-id
 extern int arg_disable_mnt;     // disable /mnt and /media
 extern int arg_noprofile;       // use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;       // block writable and executable memory
+extern int arg_notv;    // --notv
 
 extern int login_shell;
 extern int parent_to_child_fds[2];
@@ -512,6 +513,7 @@ void fs_private_dev(void);
 void fs_dev_disable_sound(void);
 void fs_dev_disable_3d(void);
 void fs_dev_disable_video(void);
+void fs_dev_disable_tv(void);
 
 // fs_home.c
 // private mode (--private)
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 86ff0d4f9..45f4bcc1c 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -31,42 +31,50 @@
 #include <sys/sysmacros.h>
 #include <sys/types.h>
 
+// device type
+typedef enum {
+        DEV_NONE = 0,
+        DEV_SOUND,
+        DEV_3D,
+        DEV_VIDEO,
+        DEV_TV,
+} DEV_TYPE;
+
+
 typedef struct {
         const char *dev_fname;
         const char *run_fname;
-        int sound;
-        int hw3d;
-        int video;
+        DEV_TYPE  type;
 } DevEntry;
 
 static DevEntry dev[] = {
-        {"/dev/snd", RUN_DEV_DIR "/snd", 1, 0, 0},      // sound device
-        {"/dev/dri", RUN_DEV_DIR "/dri", 0, 1, 0},              // 3d device
-        {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", 0, 1, 0},
-        {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", 0, 1, 0},
-        {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", 0, 1, 0},
-        {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", 0, 1, 0},
-        {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", 0, 1, 0},
-        {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", 0, 1, 0},
-        {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", 0, 1, 0},
-        {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", 0, 1, 0},
-        {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", 0, 1, 0},
-        {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", 0, 1, 0},
-        {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", 0, 1, 0},
-        {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", 0, 1, 0},
-        {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", 0, 1, 0},
-        {"/dev/video0", RUN_DEV_DIR "/video0", 0, 0, 1}, // video camera devices
-        {"/dev/video1", RUN_DEV_DIR "/video1", 0, 0, 1},
-        {"/dev/video2", RUN_DEV_DIR "/video2", 0, 0, 1},
-        {"/dev/video3", RUN_DEV_DIR "/video3", 0, 0, 1},
-        {"/dev/video4", RUN_DEV_DIR "/video4", 0, 0, 1},
-        {"/dev/video5", RUN_DEV_DIR "/video5", 0, 0, 1},
-        {"/dev/video6", RUN_DEV_DIR "/video6", 0, 0, 1},
-        {"/dev/video7", RUN_DEV_DIR "/video7", 0, 0, 1},
-        {"/dev/video8", RUN_DEV_DIR "/video8", 0, 0, 1},
-        {"/dev/video9", RUN_DEV_DIR "/video9", 0, 0, 1},
-        {"/dev/dvb", RUN_DEV_DIR "/dvb", 0, 0, 0}, // DVB (Digital Video Brodcasting) - TV device
-        {NULL, NULL, 0, 0, 0}
+        {"/dev/snd", RUN_DEV_DIR "/snd", DEV_SOUND},    // sound device
+        {"/dev/dri", RUN_DEV_DIR "/dri", DEV_3D},               // 3d device
+        {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", DEV_3D},
+        {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", DEV_3D},
+        {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", DEV_3D},
+        {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", DEV_3D},
+        {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", DEV_3D},
+        {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", DEV_3D},
+        {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", DEV_3D},
+        {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", DEV_3D},
+        {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", DEV_3D},
+        {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", DEV_3D},
+        {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", DEV_3D},
+        {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", DEV_3D},
+        {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", DEV_3D},
+        {"/dev/video0", RUN_DEV_DIR "/video0", DEV_VIDEO}, // video camera devices
+        {"/dev/video1", RUN_DEV_DIR "/video1", DEV_VIDEO},
+        {"/dev/video2", RUN_DEV_DIR "/video2", DEV_VIDEO},
+        {"/dev/video3", RUN_DEV_DIR "/video3", DEV_VIDEO},
+        {"/dev/video4", RUN_DEV_DIR "/video4", DEV_VIDEO},
+        {"/dev/video5", RUN_DEV_DIR "/video5", DEV_VIDEO},
+        {"/dev/video6", RUN_DEV_DIR "/video6", DEV_VIDEO},
+        {"/dev/video7", RUN_DEV_DIR "/video7", DEV_VIDEO},
+        {"/dev/video8", RUN_DEV_DIR "/video8", DEV_VIDEO},
+        {"/dev/video9", RUN_DEV_DIR "/video9", DEV_VIDEO},
+        {"/dev/dvb", RUN_DEV_DIR "/dvb", DEV_TV}, // DVB (Digital Video Brodcasting) - TV device
+        {NULL, NULL, DEV_NONE}
 };
 
 static void deventry_mount(void) {
@@ -295,7 +303,7 @@ static void disable_file_or_dir(const char *fname) {
 void fs_dev_disable_sound(void) {
         int i = 0;
         while (dev[i].dev_fname != NULL) {
-                if (dev[i].sound)
+                if (dev[i].type == DEV_SOUND)
                         disable_file_or_dir(dev[i].dev_fname);
                 i++;
         }
@@ -304,7 +312,7 @@ void fs_dev_disable_sound(void) {
 void fs_dev_disable_video(void) {
         int i = 0;
         while (dev[i].dev_fname != NULL) {
-                if (dev[i].video)
+                if (dev[i].type == DEV_VIDEO)
                         disable_file_or_dir(dev[i].dev_fname);
                 i++;
         }
@@ -313,7 +321,16 @@ void fs_dev_disable_video(void) {
 void fs_dev_disable_3d(void) {
         int i = 0;
         while (dev[i].dev_fname != NULL) {
-                if (dev[i].hw3d)
+                if (dev[i].type == DEV_3D)
+                        disable_file_or_dir(dev[i].dev_fname);
+                i++;
+        }
+}
+
+void fs_dev_disable_tv(void) {
+        int i = 0;
+        while (dev[i].dev_fname != NULL) {
+                if (dev[i].type == DEV_TV)
                         disable_file_or_dir(dev[i].dev_fname);
                 i++;
         }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9cff080a0..3718c82ff 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -112,7 +112,7 @@ int arg_writable_var_log = 0;		// writable /var/log
 int arg_disable_mnt = 0;                        // disable /mnt and /media
 int arg_noprofile = 0; // use default.profile if none other found/specified
 int arg_memory_deny_write_execute = 0;          // block writable and executable memory
-
+int arg_notv = 0;       // --notv
 int login_shell = 0;
 
 
@@ -1676,22 +1676,20 @@ int main(int argc, char **argv) {
                                 exit_err_feature("noroot");
                 }
 #endif
-                else if (strcmp(argv[i], "--nonewprivs") == 0) {
+                else if (strcmp(argv[i], "--nonewprivs") == 0)
                         arg_nonewprivs = 1;
-                }
                 else if (strncmp(argv[i], "--env=", 6) == 0)
                         env_store(argv[i] + 6, SETENV);
                 else if (strncmp(argv[i], "--rmenv=", 8) == 0)
                         env_store(argv[i] + 8, RMENV);
-                else if (strcmp(argv[i], "--nosound") == 0) {
+                else if (strcmp(argv[i], "--nosound") == 0)
                         arg_nosound = 1;
-                }
-                else if (strcmp(argv[i], "--novideo") == 0) {
+                else if (strcmp(argv[i], "--novideo") == 0)
                         arg_novideo = 1;
-                }
-                else if (strcmp(argv[i], "--no3d") == 0) {
+                else if (strcmp(argv[i], "--no3d") == 0)
                         arg_no3d = 1;
-                }
+                else if (strcmp(argv[i], "--notv") == 0)
+                        arg_notv = 1;
 
                 //*************************************
                 // network
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 708251b0b..54670483f 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -225,6 +225,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_nosound = 1;
                 return 0;
         }
+        else if (strcmp(ptr, "notv") == 0) {
+                arg_notv = 1;
+                return 0;
+        }
         else if (strcmp(ptr, "novideo") == 0) {
                 arg_novideo = 1;
                 return 0;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 6c0fdebe3..4af8b747b 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -876,7 +876,7 @@ int sandbox(void* sandbox_arg) {
         fs_blacklist(); // mkdir and mkfile are processed all over again
 
         //****************************
-        // nosound/no3d and fix for pulseaudio 7.0
+        // nosound/no3d/notv/novideo and fix for pulseaudio 7.0
         //****************************
         if (arg_nosound) {
                 // disable pulseaudio
@@ -891,9 +891,9 @@ int sandbox(void* sandbox_arg) {
         if (arg_no3d)
                 fs_dev_disable_3d();
 
-        //****************************
-        // novideo
-        //****************************
+        if (arg_notv)
+                fs_dev_disable_tv();
+
         if (arg_novideo) {
                 // disable /dev/video*
                 fs_dev_disable_video();
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index f446f37b8..665f4405b 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -423,6 +423,9 @@ Enable IPC namespace.
 \fBnosound
 Disable sound system.
 .TP
+\fBnotv
+Disable DVB (Digital Video Brodcasting) TV devices.
+.TP
 \fBnovideo
 Disable video devices.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index bf18167b2..b0746030b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1084,6 +1084,16 @@ Example:
 $ firejail \-\-nosound firefox
 
 .TP
+\fB\-\-notv
+Disable DVB (Digital Video Brodcasting) TV devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-notv vlc
+
+.TP
 \fB\-\-novideo
 Disable video devices.
 .br