private-lib: support for /etc/firejail/firejail.config

4 files changed, 32 insertions, 15 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 50a96fc7a..7f371b299 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -324,6 +324,14 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        else if (strncmp(ptr, "private-lib ", 12) == 0) {
+                                if (strcmp(ptr + 12, "yes") == 0)
+                                        cfg_val[CFG_PRIVATE_LIB] = 1;
+                                else if (strcmp(ptr + 12, "no") == 0)
+                                        cfg_val[CFG_PRIVATE_LIB] = 0;
+                                else
+                                        goto errout;
+                        }
                         else if (strncmp(ptr, "chroot-desktop ", 15) == 0) {
                                 if (strcmp(ptr + 15, "yes") == 0)
                                         cfg_val[CFG_CHROOT_DESKTOP] = 1;
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 19edb40a0..8e47a72d5 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -708,6 +708,7 @@ enum {
         CFG_JOIN,
         CFG_ARP_PROBES,
         CFG_XPRA_ATTACH,
+        CFG_PRIVATE_LIB,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
diff --git a/src/firejail/main.c b/src/firejail/main.c
index ff57a5693..9cff080a0 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1631,15 +1631,19 @@ int main(int argc, char **argv) {
                         arg_private_bin = 1;
                 }
                 else if (strncmp(argv[i], "--private-lib", 13) == 0) {
-                        // extract private lib list (if any)
-                        if (argv[i][13] == '=') {
-                                if (cfg.lib_private_keep) {
-                                        if (argv[i][14] != '\0' && asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, argv[i] + 14) < 0)
-                                                errExit("asprintf");
-                                } else
-                                        cfg.lib_private_keep = argv[i] + 14;
+                        if (checkcfg(CFG_PRIVATE_LIB)) {
+                                // extract private lib list (if any)
+                                if (argv[i][13] == '=') {
+                                        if (cfg.lib_private_keep) {
+                                                if (argv[i][14] != '\0' && asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, argv[i] + 14) < 0)
+                                                        errExit("asprintf");
+                                        } else
+                                                cfg.lib_private_keep = argv[i] + 14;
+                                }
+                                arg_private_lib = 1;
                         }
-                        arg_private_lib = 1;
+                        else
+                                exit_err_feature("private-lib");
                 }
                 else if (strcmp(argv[i], "--private-tmp") == 0) {
                         arg_private_tmp = 1;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 972f5932d..708251b0b 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -862,15 +862,19 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /lib list of files
         if (strncmp(ptr, "private-lib", 11) == 0) {
-                if (ptr[11] == ' ') {
-                        if (cfg.lib_private_keep) {
-                                if (ptr[12] != '\0' && asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, ptr + 12) < 0)
-                                        errExit("asprintf");
-                        } else {
-                                cfg.lib_private_keep = ptr + 12;
+                if (checkcfg(CFG_PRIVATE_LIB)) {
+                        if (ptr[11] == ' ') {
+                                if (cfg.lib_private_keep) {
+                                        if (ptr[12] != '\0' && asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, ptr + 12) < 0)
+                                                errExit("asprintf");
+                                } else {
+                                        cfg.lib_private_keep = ptr + 12;
+                                }
                         }
+                        arg_private_lib = 1;
                 }
-                arg_private_lib = 1;
+                else
+                        warning_feature_disabled("private-lib");
                 return 0;
         }