Implement a `whitelist-ro` command

This is a shortcut to:

  whitelist $PATH
  read-only $PATH

Ideally, a great deal of usages of `whitelist` should be replaced with
this instead.

1 files changed, 11 insertions, 0 deletions

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 756b370aa..7757c1814 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1789,6 +1789,17 @@ void profile_read(const char *fname) {
                         free(ptr);
                         ptr = tmp;
                 }
+                else if (strncmp(ptr, "whitelist-ro ", 13) == 0) {
+                        char *whitelist, *readonly;
+                        if (asprintf(&whitelist, "whitelist %s", ptr + 13) == -1)
+                                errExit("asprintf");
+                        profile_add(whitelist);
+                        if (asprintf(&readonly, "read-only %s", ptr + 13) == -1)
+                                errExit("asprintf");
+                        profile_add(readonly);
+                        free(ptr);
+                        continue;
+                }
 
                 // process quiet
                 // todo: a quiet in the profile file cannot be disabled by --ignore on command line