added netfilter-default config option in /etc/firejail/firejail.config

3 files changed, 26 insertions, 0 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 6636e7efe..6929988ae 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -26,6 +26,7 @@ static int initialized = 0;
 static int cfg_val[CFG_MAX];
 char *xephyr_screen = "800x600";
 char *xephyr_extra_params = "";
+char *netfilter_default = NULL;
 
 int checkcfg(int val) {
         EUID_ASSERT();
@@ -159,6 +160,28 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // netfilter
+                        else if (strncmp(ptr, "netfilter-default ", 18) == 0) {
+                                char *fname = ptr + 18;
+                                while (*fname == ' ' || *fname == '\t')
+                                        ptr++;
+                                char *end = strchr(fname, ' ');
+                                if (end)
+                                        *end = '\0';
+                                
+                                // is the file present?
+                                struct stat s;
+                                if (stat(fname, &s) == -1) {
+                                        fprintf(stderr, "Error: netfilter-default file %s not available\n", fname);
+                                        exit(1);
+                                }
+                                
+                                netfilter_default = strdup(fname);
+                                if (!netfilter_default)
+                                        errExit("strdup");
+                                if (arg_debug)
+                                        printf("netfilter default file %s\n", fname);
+                        }
                         
                         // Xephyr screen size
                         else if (strncmp(ptr, "xephyr-screen ", 14) == 0) {
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 29bb6c494..7a538327d 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -582,6 +582,7 @@ void sandboxfs(int op, pid_t pid, const char *patqh);
 #define CFG_MAX 11 // this should always be the last entry
 extern char *xephyr_screen;
 extern char *xephyr_extra_params;
+extern char *netfilter_default;
 int checkcfg(int val);
 
 // appimage.c
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index 71abfb53d..b50d61039 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -66,6 +66,8 @@ void netfilter(const char *fname) {
 
         // custom filter
         int allocated = 0;
+        if (netfilter_default)
+                fname = netfilter_default;
         if (fname) {
                 // buffer the filter
                 struct stat s;