bug: add support to remove /usr/local from private-bin list, issue 778

3 files changed, 17 insertions, 0 deletions

diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index fdd2b8edd..78c0e5c60 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -40,6 +40,7 @@ int checkcfg(int val) {
                         cfg_val[i] = 1; // most of them are enabled by default
                 cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
                 cfg_val[CFG_FORCE_NONEWPRIVS] = 0; // disabled by default
+                cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0; // disabled by default
                 
                 // open configuration file
                 char *fname;
@@ -258,6 +259,14 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        else if (strncmp(ptr, "private-bin-no-local ", 21) == 0) {
+                                if (strcmp(ptr + 21, "yes") == 0)
+                                        cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 1;
+                                else if (strcmp(ptr + 21, "no") == 0)
+                                        cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0;
+                                else
+                                        goto errout;
+                        }
                         else
                                 goto errout;
 
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 7043aa0ca..c0536502e 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -651,6 +651,7 @@ enum {
         CFG_OVERLAYFS,
         CFG_CHROOT_DESKTOP,
         CFG_PRIVATE_HOME,
+        CFG_PRIVATE_BIN_NO_LOCAL,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 6c4db57b4..40539305f 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -46,6 +46,13 @@ static char *check_dir_or_file(const char *name) {
         
         int i = 0;
         while (paths[i]) {
+                // private-bin-no-local can be disabled in /etc/firejail/firejail.config
+                if (checkcfg(CFG_PRIVATE_BIN_NO_LOCAL) && strstr(paths[i], "local/")) {
+                        i++;
+                        continue;
+                }
+                
+                // check file           
                 if (asprintf(&fname, "%s/%s", paths[i], name) == -1)
                         errExit("asprintf");
                 if (arg_debug)