profile build tool

3 files changed, 18 insertions, 1 deletions

diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c
index 76281a54d..dcd86e069 100644
--- a/src/fbuilder/build_fs.c
+++ b/src/fbuilder/build_fs.c
@@ -148,7 +148,11 @@ void build_etc(const char *fname) {
 //*******************************************
 static FileDB *var_out = NULL;
 static void var_callback(char *ptr) {
-        if (strncmp(ptr, "/var/lib/menu-xdg", 17) == 0)
+        if (strcmp(ptr, "/var/lib") == 0)
+                ;
+        else if (strcmp(ptr, "/var/cache") == 0)
+                ;
+        else if (strncmp(ptr, "/var/lib/menu-xdg", 17) == 0)
                 var_out = filedb_add(var_out, "/var/lib/menu-xdg");
         else if (strncmp(ptr, "/var/cache/fontconfig", 21) == 0)
                 var_out = filedb_add(var_out, "/var/cache/fontconfig");
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index fc7dbd69c..f09eb6416 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -44,6 +44,7 @@ void usage(void) {
         printf("    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n");
 #endif
         printf("    --blacklist=filename - blacklist directory or file.\n");
+        printf("    --build - build a whitelisted profile for the application.\n");
         printf("    -c - execute command and exit.\n");
         printf("    --caps - enable default Linux capabilities filter.\n");
         printf("    --caps.drop=all - drop all capabilities.\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 2dd3abbb7..36ae3166b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -154,6 +154,18 @@ $ firejail "\-\-blacklist=/home/username/My Virtual Machines"
 .br
 $ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines
 .TP
+\fB\-\-build
+The command builds a whitelisted profile. If /usr/bin/strace is installed on the system, it also
+builds a whitelisted seccomp profile. The program is run in a very relaxed sandbox,
+with only --caps.drop=all and --nonewprivs. Only programs that don't rise privileges are supported
+in order to allow strace to run. Chromium and Chromium-based browsers will not work.
+.br
+
+.br
+Example:
+.br
+$ firejail --build vlc ~/Videos/test.mp4
+.TP
 \fB\-c
 Execute command and exit.
 .TP