cleanup

3 files changed, 34 insertions, 2 deletions

diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index 5f730afef..8e75277c2 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -74,6 +74,11 @@ static struct sock_filter *find_protocol_domain(const char *p) {
 
 // --debug-protocols
 void protocol_list(void) {
+#ifndef SYS_socket
+        fprintf(stderr, "Warning: --protocol not supported on this platform\n");
+        return;
+#endif
+
         int i = 0;
         while (protocol[i] != NULL) {
                 printf("%s, ", protocol[i]);
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index d3cad1e63..c829b94f2 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -70,6 +70,8 @@ void usage(void) {
         printf("\t\tFirejail software build and exit.\n\n");
         printf("\t--debug-errnos - print all recognized error numbres in the current\n");
         printf("\t\tFirejail software build and exit.\n\n");
+        printf("\t--debug-protocols - print all recognized protocols in the current\n");
+        printf("\t\tFirejail software build and exit.\n\n");
         printf("\t--debug-syscalls - print all recognized system calls in the current\n");
         printf("\t\tFirejail software build and exit.\n\n");
         printf("\t--defaultgw=address - use this address as default gateway in the new\n");
@@ -192,6 +194,10 @@ void usage(void) {
         printf("\t\tAll modifications are discarded when the sandbox is closed.\n\n");
         
         printf("\t--profile=filename - use a custom profile.\n\n");
+        
+        printf("\t--protocol=protocol,protocol,protocol - enable protocol filter.\n");
+        printf("\t\tProtocol values: unix, inet, inet6, netlink, packet.\n\n");
+        
         printf("\t--quiet - turn off Firejail's output.\n\n");
         printf("\t--read-only=dirname_or_filename - set directory or file read-only.\n\n");
         printf("\t--rlimit-fsize=number - set the maximum file size that can be created\n");
@@ -218,7 +224,8 @@ void usage(void) {
         printf("\t\tkeyctl, uselib, acct, modify_ldt, pivot_root, io_setup,\n");
         printf("\t\tio_destroy, io_getevents, io_submit, io_cancel,\n");
         printf("\t\tremap_file_pages, mbind, get_mempolicy, set_mempolicy,\n");
-        printf("\t\tmigrate_pages, move_pages, vmsplice, and perf_event_open.\n\n");
+        printf("\t\tmigrate_pages, move_pages, vmsplice, perf_event_open and\n");
+        printf("\t\tkexec_file_load.\n\n");
         
         printf("\t--seccomp=syscall,syscall,syscall - enable seccomp filter, blacklist the\n");
         printf("\t\tdefault syscall list and the syscalls specified by the command.\n\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 12c32f4c7..52b75afaa 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -23,7 +23,7 @@ firejail {\-\-list | \-\-netstats | \-\-top | \-\-tree}
 Miscellaneous:
 .PP
 .RS
-firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-help | \-\-version}
+firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-debug-protocols | \-\-help | \-\-version}
 .RE
 .SH DESCRIPTION
 Firejail is a SUID sandbox program that reduces the risk of security breaches by
@@ -258,6 +258,15 @@ Example:
 .br
 $ firejail \-\-debug-errnos
 .TP
+\fB\-\-debug-protocols
+Print all recognized protocols in the current Firejail software build and exit.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-debug-protocols
+.TP
 \fB\-\-debug-syscalls
 Print all recognized system calls in the current Firejail software build and exit.
 .br
@@ -842,6 +851,17 @@ For more information, see SECURITY PROFILES section below.
 Example:
 .br
 $ firejail \-\-profile=myprofile
+
+.TP
+\fB\-\-protocol=protocol,protocol,protocol
+Enable protocol filter. The filter is based on seccomp and the first argument to socket system call.
+Recognized values: unix, inet, inet6, netlink and packet.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-protocol=unix,inet,inet6 firefox
 .TP
 \fB\-\-quiet
 Turn off Firejail's output.