removed --disable-bind configuration option; some ohter minor cleanup

7 files changed, 2 insertions, 195 deletions

diff --git a/src/common.mk.in b/src/common.mk.in
index fd9f2e5a5..7a2056e7b 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -11,7 +11,6 @@ NAME=@PACKAGE_NAME@
 HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
 HAVE_SECCOMP=@HAVE_SECCOMP@
 HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
 HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
 HAVE_NETWORK=@HAVE_NETWORK@
 HAVE_USERNS=@HAVE_USERNS@
@@ -29,7 +28,7 @@ C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
 
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
 EXTRA_CFLAGS +=@EXTRA_CFLAGS@
diff --git a/src/firejail/arg-checking.txt b/src/firejail/arg-checking.txt
deleted file mode 100644
index cfed454f8..000000000
--- a/src/firejail/arg-checking.txt
+++ /dev/null
@@ -1,84 +0,0 @@
-arg checking:
-
-1. --output=filename
-        - not supported in profiles
-        - checking no "..",
-        - checking no link,
-        - checking no dir,
-        - checking same permissions,
-        - checking no hard links
-        - unit test
-
-2. --chroot=dirname
-        - not supported in profiles
-        - expand "~"
-        - checking no "..",
-        - checking is dir,
-        - checking no link
-        - checking directory structure
-        - unit test
-
-3. --bind=dirname1,dirname2, --bind=filename1,filenam2
-        - supported in profiles
-        - accepted only when running as root
-        - checking string chars
-        - checking no ".."
-        - unit test non root
-
-4. --tmpfs=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-5. --blacklist=filename, --blacklist=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-6. --read-only=filename, --read-only=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-7. --profile=filename
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
-
-8. --private=dirname
-        - supported in profiles
-        - expand "~"
-        - check is dir
-        - check no link
-        - checking no ".."
-        - check same owner
-        - unit test
-
-9. --private-home=filelist
-        - supported in profiles
-        - checking no ".."
-        - checking file found
-        - checking same owner
-        - checking no link
-        - unit test
-
-10. --netfilter=filename
-        - supported in profiles
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
-
-11. --shell=filename
-        - not supported in profiles
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 7483136f4..06820ce24 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -410,14 +410,6 @@ void print_compiletime_support(void) {
 #endif
                 );
 
-        printf("\t- bind support is %s\n",
-#ifdef HAVE_BIND
-                "enabled"
-#else
-                "disabled"
-#endif
-                );
-
         printf("\t- chroot support is %s\n",
 #ifdef HAVE_CHROOT
                 "enabled"
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 4faef025a..b3a8dcfd7 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1270,7 +1270,6 @@ int main(int argc, char **argv) {
                 //*************************************
                 else if (strcmp(argv[i], "--allusers") == 0)
                         arg_allusers = 1;
-#ifdef HAVE_BIND
                 else if (strncmp(argv[i], "--bind=", 7) == 0) {
                         if (checkcfg(CFG_BIND)) {
                                 char *line;
@@ -1283,7 +1282,6 @@ int main(int argc, char **argv) {
                         else
                                 exit_err_feature("bind");
                 }
-#endif
                 else if (strncmp(argv[i], "--tmpfs=", 8) == 0) {
                         char *line;
                         if (asprintf(&line, "tmpfs %s", argv[i] + 8) == -1)
diff --git a/src/firejail/network.txt b/src/firejail/network.txt
deleted file mode 100644
index 75bdc346d..000000000
--- a/src/firejail/network.txt
+++ /dev/null
@@ -1,95 +0,0 @@
-struct Bridge {
-        char *dev;              // bridge device name
-        uint32_t ip;            // bridge device IP address
-        uint32_t mask;          // bridge device mask
-        uint32_t ipsandbox      // sandbox interface IP address
-}
-
-net_configure_bridge(br, device) {
-        br->dev  = devname;
-        br->ip = extracted from kernel device - using net_get_if_addr() in network.c
-        br->mask = extracted from kernel device - using net_get_if_addr() in network.c
-        check available network range; /31 networks are not supported
-}
-
-net_configure_sandbox_ip(br) {
-        if br->ip_sandbox
-                check br->ipsandbox inside the bridge network
-                arp_check(br->ipsandbox)        // send an arp req to check if anybody else is using this address
-        else
-                br->ipsandbox = arp_assign();
-}
-
-net_configure_veth_pair {
-        create a veth pair
-        place one interface end in the bridge
-        place the other end in the namespace of the child process
-}
-
-net_bridge_wait_ip {
-        arp_check br->ipsandbox address to come up
-        wait for not more than 5 seconds
-}
-
-main() {
-
-        foreach argv[i] {
-                if --net
-                        br = next bridge available
-                        net_configure_bridge(br, device name from argv[i]);
-                else if --ip
-                        br = last bridge configured
-                        br->ipsandbox = ip address extracted from argv[i]
-                else if --defaultgw
-                        cfg.defaultgw = ip address extracted from argv[i]
-        }
-
-        net_check_cfg(); // check the validity of network configuration so far
-
-        if (any bridge configured) {
-                lock /var/lock/firejail.lock file
-                for each bridge
-                        net_configure_sandbox_ip(br)
-        }
-
-        clone (new network namespace if any bridge configured or --net=none)
-
-        if (any bridge configured) {
-                for each bridge
-                        net_configure_veth_pair
-        }
-
-        notify child init is done
-
-        if (any bridge configured) {
-                for each bridge
-                        net_bridge_wait_ip
-                unlock /var/lock/firejail.lock file
-        }
-
-        wait on child
-        exit
-}
-
-
-******************************************************
-* macvlan notes
-******************************************************
-Configure a macvlan interface
-
-# ip link add virtual0 link eth0 type macvlan mode bridge
-(you can configure it with # ifconfig virtual0 192.168.1.52/24 up)
-
-Create a new network namespace and move the interface in the new network namespace
-
-# ip netns add dummy0
-# ip link set virtual0 netns dummy0
-
-Join the namespace and configure the interfaces
-
-# ip netns exec dummy0 bash
-# ifconfig lo up
-# ifconfig virtual0 192.168.1.52/24
-
-Investigate ipvlan interface - added to linux kernel 3.19
-https://github.com/torvalds/linux/blob/master/Documentation/networking/ipvlan.txt
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 606378908..168d7e268 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1044,7 +1044,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // filesystem bind
         if (strncmp(ptr, "bind ", 5) == 0) {
-#ifdef HAVE_BIND
                 if (checkcfg(CFG_BIND)) {
                         if (getuid() != 0) {
                                 fprintf(stderr, "Error: --bind option is available only if running as root\n");
@@ -1077,7 +1076,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 else
                         warning_feature_disabled("bind");
-#endif
                 return 0;
         }
 
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 78cd30926..c8866da3a 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -37,10 +37,8 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --bandwidth=name|pid - set bandwidth limits.\n"
 #endif
-#ifdef HAVE_BIND
         "    --bind=dirname1,dirname2 - mount-bind dirname1 on top of dirname2.\n"
         "    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n"
-#endif
         "    --blacklist=filename - blacklist directory or file.\n"
         "    --build - build a whitelisted profile for the application.\n"
         "    --build=filename - build a whitelisted profile for the application.\n"
@@ -153,6 +151,7 @@ static char *usage_str =
         "    --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n"
         "    --private - temporary home directory.\n"
         "    --private=directory - use directory as user home.\n"
+        "    --private-cache - temporary ~/.cache directory.\n"
         "    --private-home=file,directory - build a new user home in a temporary\n"
         "\tfilesystem, and copy the files and directories in the list in\n"
         "\tthe new home.\n"