fixes

18 files changed, 185 insertions, 184 deletions

diff --git a/src/firejail/cgroup.c b/src/firejail/cgroup.c
index aab7be0fd..186fe04a8 100644
--- a/src/firejail/cgroup.c
+++ b/src/firejail/cgroup.c
@@ -26,13 +26,13 @@ void save_cgroup(void) {
         if (cfg.cgroup == NULL)
                 return;
         
-        FILE *fp = fopen(CGROUP_CFG, "w");
+        FILE *fp = fopen(RUN_CGROUP_CFG, "w");
         if (fp) {
                 fprintf(fp, "%s", cfg.cgroup);
                 fflush(0);
                 if (fclose(fp))
                         goto errout;
-                if (chown(CGROUP_CFG, 0, 0) < 0)
+                if (chown(RUN_CGROUP_CFG, 0, 0) < 0)
                         errExit("chown");
         }
         else
diff --git a/src/firejail/cpu.c b/src/firejail/cpu.c
index 343bc8971..c7ef2f4b3 100644
--- a/src/firejail/cpu.c
+++ b/src/firejail/cpu.c
@@ -73,13 +73,13 @@ void save_cpu(void) {
         if (cfg.cpus == 0)
                 return;
 
-        FILE *fp = fopen(CPU_CFG, "w");
+        FILE *fp = fopen(RUN_CPU_CFG, "w");
         if (fp) {
                 fprintf(fp, "%x\n", cfg.cpus);
                 fclose(fp);
-                if (chmod(CPU_CFG, 0600) < 0)
+                if (chmod(RUN_CPU_CFG, 0600) < 0)
                         errExit("chmod");
-                if (chown(CPU_CFG, 0, 0) < 0)
+                if (chown(RUN_CPU_CFG, 0, 0) < 0)
                         errExit("chown");
         }
         else {
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 9ba3b78ab..3ede58df6 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -22,39 +22,40 @@
 #include "../include/common.h"
 
 // filesystem
-#define FIREJAIL_DIR    "/run/firejail"
-#define NETWORK_LOCK_FILE       "/run/firejail/firejail.lock"
-#define RO_DIR  "/run/firejail/firejail.ro.dir"
-#define RO_FILE "/run/firejail/firejail.ro.file"
-#define MNT_DIR "/run/firejail/mnt"     // a tmpfs is mounted on this directory before any of the files below are created
-#define SECCOMP_CFG     "/run/firejail/mnt/seccomp"
-#define CGROUP_CFG      "/run/firejail/mnt/cgroup"
-#define CPU_CFG "/run/firejail/mnt/cpu"
-#define GROUPS_CFG      "/run/firejail/mnt/groups"
-#define PROTOCOL_CFG    "/run/firejail/mnt/protocol"
-#define CP_COMMAND      "/run/firejail/mnt/cp"
-#define HOME_DIR        "/run/firejail/mnt/home"
-#define ETC_DIR "/run/firejail/mnt/etc"
-#define BIN_DIR "/run/firejail/mnt/bin"
-#define DRI_DIR "/run/firejail/mnt/dri"
-#define PULSE_DIR       "/run/firejail/mnt/pulse"
-#define DEVLOG_FILE     "/run/firejail/mnt/devlog"
-
-#define WHITELIST_HOME_DIR      "/run/firejail/mnt/orig-home"   // default home directory masking
-#define WHITELIST_HOME_USER_DIR "/run/firejail/mnt/orig-home-user"      // home directory whitelisting
-#define WHITELIST_TMP_DIR       "/run/firejail/mnt/orig-tmp"
-#define WHITELIST_MEDIA_DIR     "/run/firejail/mnt/orig-media"
-#define WHITELIST_VAR_DIR       "/run/firejail/mnt/orig-var"
-#define WHITELIST_DEV_DIR       "/run/firejail/mnt/orig-dev"
-#define WHITELIST_OPT_DIR       "/run/firejail/mnt/orig-opt"
-
-#define XAUTHORITY_FILE "/run/firejail/mnt/.Xauthority"
-#define HOSTNAME_FILE   "/run/firejail/mnt/hostname"
-#define RESOLVCONF_FILE "/run/firejail/mnt/resolv.conf"
-#define LDPRELOAD_FILE  "/run/firejail/mnt/ld.so.preload"
-#define UTMP_FILE               "/run/firejail/mnt/utmp"
-#define PASSWD_FILE             "/run/firejail/mnt/passwd"
-#define GROUP_FILE              "/run/firejail/mnt/group"
+#define RUN_FIREJAIL_DIR        "/run/firejail"
+#define RUN_NETWORK_LOCK_FILE   "/run/firejail/firejail.lock"
+#define RUN_RO_DIR      "/run/firejail/firejail.ro.dir"
+#define RUN_RO_FILE     "/run/firejail/firejail.ro.file"
+#define RUN_MNT_DIR     "/run/firejail/mnt"     // a tmpfs is mounted on this directory before any of the files below are created
+#define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp"
+#define RUN_CGROUP_CFG  "/run/firejail/mnt/cgroup"
+#define RUN_CPU_CFG     "/run/firejail/mnt/cpu"
+#define RUN_GROUPS_CFG  "/run/firejail/mnt/groups"
+#define RUN_PROTOCOL_CFG        "/run/firejail/mnt/protocol"
+#define RUN_CP_COMMAND  "/run/firejail/mnt/cp"
+#define RUN_HOME_DIR    "/run/firejail/mnt/home"
+#define RUN_ETC_DIR     "/run/firejail/mnt/etc"
+#define RUN_BIN_DIR     "/run/firejail/mnt/bin"
+#define RUN_DRI_DIR     "/run/firejail/mnt/dri"
+#define RUN_PULSE_DIR   "/run/firejail/mnt/pulse"
+#define RUN_DEVLOG_FILE "/run/firejail/mnt/devlog"
+
+#define RUN_WHITELIST_HOME_DIR  "/run/firejail/mnt/orig-home"   // default home directory masking
+#define RUN_WHITELIST_HOME_USER_DIR     "/run/firejail/mnt/orig-home-user"      // home directory whitelisting
+#define RUN_WHITELIST_TMP_DIR   "/run/firejail/mnt/orig-tmp"
+#define RUN_WHITELIST_MEDIA_DIR "/run/firejail/mnt/orig-media"
+#define RUN_WHITELIST_VAR_DIR   "/run/firejail/mnt/orig-var"
+#define RUN_WHITELIST_DEV_DIR   "/run/firejail/mnt/orig-dev"
+#define RUN_WHITELIST_OPT_DIR   "/run/firejail/mnt/orig-opt"
+
+#define RUN_XAUTHORITY_FILE     "/run/firejail/mnt/.Xauthority"
+#define RUN_HOSTNAME_FILE       "/run/firejail/mnt/hostname"
+#define RUN_HOSTS_FILE  "/run/firejail/mnt/hosts"
+#define RUN_RESOLVCONF_FILE     "/run/firejail/mnt/resolv.conf"
+#define RUN_LDPRELOAD_FILE      "/run/firejail/mnt/ld.so.preload"
+#define RUN_UTMP_FILE           "/run/firejail/mnt/utmp"
+#define RUN_PASSWD_FILE         "/run/firejail/mnt/passwd"
+#define RUN_GROUP_FILE          "/run/firejail/mnt/group"
 
 // profiles
 #define DEFAULT_USER_PROFILE    "generic"
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 5ddbcec34..e442bc705 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -30,12 +30,12 @@
 static void create_empty_dir(void) {
         struct stat s;
         
-        if (stat(RO_DIR, &s)) {
+        if (stat(RUN_RO_DIR, &s)) {
                 /* coverity[toctou] */
-                int rv = mkdir(RO_DIR, S_IRUSR | S_IXUSR);
+                int rv = mkdir(RUN_RO_DIR, S_IRUSR | S_IXUSR);
                 if (rv == -1)
                         errExit("mkdir");       
-                if (chown(RO_DIR, 0, 0) < 0)
+                if (chown(RUN_RO_DIR, 0, 0) < 0)
                         errExit("chown");
         }
 }
@@ -43,15 +43,15 @@ static void create_empty_dir(void) {
 static void create_empty_file(void) {
         struct stat s;
 
-        if (stat(RO_FILE, &s)) {
+        if (stat(RUN_RO_FILE, &s)) {
                 /* coverity[toctou] */
-                FILE *fp = fopen(RO_FILE, "w");
+                FILE *fp = fopen(RUN_RO_FILE, "w");
                 if (!fp)
                         errExit("fopen");
                 fclose(fp);
-                if (chown(RO_FILE, 0, 0) < 0)
+                if (chown(RUN_RO_FILE, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(RO_FILE, S_IRUSR) < 0)
+                if (chmod(RUN_RO_FILE, S_IRUSR) < 0)
                         errExit("chown");
         }
 }
@@ -60,21 +60,21 @@ static void create_empty_file(void) {
 void fs_build_firejail_dir(void) {
         struct stat s;
 
-        if (stat(FIREJAIL_DIR, &s)) {
+        if (stat(RUN_FIREJAIL_DIR, &s)) {
                 if (arg_debug)
-                        printf("Creating %s directory\n", FIREJAIL_DIR);
+                        printf("Creating %s directory\n", RUN_FIREJAIL_DIR);
                 /* coverity[toctou] */
-                int rv = mkdir(FIREJAIL_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                int rv = mkdir(RUN_FIREJAIL_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(FIREJAIL_DIR, 0, 0) < 0)
+                if (chown(RUN_FIREJAIL_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(FIREJAIL_DIR, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) < 0)
+                if (chmod(RUN_FIREJAIL_DIR, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) < 0)
                         errExit("chmod");
         }
         else { // check /tmp/firejail directory belongs to root end exit if doesn't!
                 if (s.st_uid != 0 || s.st_gid != 0) {
-                        fprintf(stderr, "Error: non-root %s directory, exiting...\n", FIREJAIL_DIR);
+                        fprintf(stderr, "Error: non-root %s directory, exiting...\n", RUN_FIREJAIL_DIR);
                         exit(1);
                 }
         }
@@ -96,16 +96,16 @@ void fs_build_mnt_dir(void) {
         fs_build_firejail_dir();
         
         // create /run/firejail/mnt directory
-        if (stat(MNT_DIR, &s)) {
+        if (stat(RUN_MNT_DIR, &s)) {
                 if (arg_debug)
-                        printf("Creating %s directory\n", MNT_DIR);
+                        printf("Creating %s directory\n", RUN_MNT_DIR);
                 /* coverity[toctou] */
-                int rv = mkdir(MNT_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                int rv = mkdir(RUN_MNT_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(MNT_DIR, 0, 0) < 0)
+                if (chown(RUN_MNT_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(MNT_DIR, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) < 0)
+                if (chmod(RUN_MNT_DIR, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) < 0)
                         errExit("chmod");
         }
 
@@ -113,8 +113,8 @@ void fs_build_mnt_dir(void) {
         if (!tmpfs_mounted) {
                 // mount tmpfs on top of /run/firejail/mnt
                 if (arg_debug)
-                        printf("Mounting tmpfs on %s directory\n", MNT_DIR);
-                if (mount("tmpfs", MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        printf("Mounting tmpfs on %s directory\n", RUN_MNT_DIR);
+                if (mount("tmpfs", RUN_MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
                         errExit("mounting /tmp/firejail/mnt");
                 tmpfs_mounted = 1;
         }
@@ -124,7 +124,7 @@ void fs_build_mnt_dir(void) {
 void fs_build_cp_command(void) {
         struct stat s;
         fs_build_mnt_dir();
-        if (stat(CP_COMMAND, &s)) {
+        if (stat(RUN_CP_COMMAND, &s)) {
                 char* fname = realpath("/bin/cp", NULL);
                 if (fname == NULL) {
                         fprintf(stderr, "Error: /bin/cp not found\n");
@@ -134,13 +134,13 @@ void fs_build_cp_command(void) {
                         fprintf(stderr, "Error: /bin/cp not found\n");
                         exit(1);
                 }
-                int rv = copy_file(fname, CP_COMMAND);
+                int rv = copy_file(fname, RUN_CP_COMMAND);
                 if (rv) {
                         fprintf(stderr, "Error: cannot access /bin/cp\n");
                         exit(1);
                 }
                 /* coverity[toctou] */
-                if (chmod(CP_COMMAND, 0755))
+                if (chmod(RUN_CP_COMMAND, 0755))
                         errExit("chmod");
                         
                 free(fname);
@@ -149,7 +149,7 @@ void fs_build_cp_command(void) {
 
 // delete the temporary cp command
 void fs_delete_cp_command(void) {
-        unlink(CP_COMMAND);
+        unlink(RUN_CP_COMMAND);
 }
 
 //***********************************************
@@ -205,11 +205,11 @@ static void disable_file(OPERATION op, const char *filename) {
                         if (arg_debug)
                                 printf("Disable %s\n", fname);
                         if (S_ISDIR(s.st_mode)) {
-                                if (mount(RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                                if (mount(RUN_RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
                                         errExit("disable file");
                         }
                         else {
-                                if (mount(RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                                if (mount(RUN_RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
                                         errExit("disable file");
                         }
                         last_disable = SUCCESSFUL;
@@ -649,7 +649,7 @@ void fs_overlayfs(void) {
         fs_build_mnt_dir();
 
         char *oroot;
-        if(asprintf(&oroot, "%s/oroot", MNT_DIR) == -1)
+        if(asprintf(&oroot, "%s/oroot", RUN_MNT_DIR) == -1)
                 errExit("asprintf");
         if (mkdir(oroot, S_IRWXU | S_IRWXG | S_IRWXO))
                 errExit("mkdir");
@@ -658,7 +658,7 @@ void fs_overlayfs(void) {
         if (chmod(oroot, S_IRWXU  | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH) < 0)
                 errExit("chmod");
 
-        char *basedir = MNT_DIR;
+        char *basedir = RUN_MNT_DIR;
         if (arg_overlay_keep) {
                 // set base for working and diff directories
                 basedir = cfg.overlay_dir;
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 0105716b2..38b9b06ca 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -137,7 +137,7 @@ static void duplicate(char *fname) {
         char *actual_path = realpath(full_path, NULL);
         if (actual_path) {
                 // copy the file
-                if (asprintf(&cmd, "%s -a %s %s/%s", CP_COMMAND, actual_path, BIN_DIR, fname) == -1)
+                if (asprintf(&cmd, "%s -a %s %s/%s", RUN_CP_COMMAND, actual_path, RUN_BIN_DIR, fname) == -1)
                         errExit("asprintf");
                 if (arg_debug)
                         printf("%s\n", cmd);
@@ -168,12 +168,12 @@ void fs_private_bin_list(void) {
 
         // create /tmp/firejail/mnt/bin directory
         fs_build_mnt_dir();
-        int rv = mkdir(BIN_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+        int rv = mkdir(RUN_BIN_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
         if (rv == -1)
                 errExit("mkdir");
-        if (chown(BIN_DIR, 0, 0) < 0)
+        if (chown(RUN_BIN_DIR, 0, 0) < 0)
                 errExit("chown");
-        if (chmod(BIN_DIR, 0755) < 0)
+        if (chmod(RUN_BIN_DIR, 0755) < 0)
                 errExit("chmod");
         
         // copy the list of files in the new etc directory
@@ -211,8 +211,8 @@ void fs_private_bin_list(void) {
         i = 0;
         while (paths[i]) {
                 if (arg_debug)
-                        printf("Mount-bind %s on top of %s\n", BIN_DIR, paths[i]);
-                if (mount(BIN_DIR, paths[i], NULL, MS_BIND|MS_REC, NULL) < 0)
+                        printf("Mount-bind %s on top of %s\n", RUN_BIN_DIR, paths[i]);
+                if (mount(RUN_BIN_DIR, paths[i], NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind");
                 i++;
         }
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 469cf48ab..86e0918e1 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -76,16 +76,16 @@ void fs_private_dev(void){
         fs_build_mnt_dir();
         if (have_dri) {
                 /* coverity[toctou] */
-                rv = mkdir(DRI_DIR, 0755);
+                rv = mkdir(RUN_DRI_DIR, 0755);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(DRI_DIR, 0, 0) < 0)
+                if (chown(RUN_DRI_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(DRI_DIR, 0755) < 0)
+                if (chmod(RUN_DRI_DIR, 0755) < 0)
                         errExit("chmod");
         
                 // keep a copy of /dev/dri under DRI_DIR
-                if (mount("/dev/dri", DRI_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount("/dev/dri", RUN_DRI_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mounting /dev/dri");
         }
         
@@ -93,13 +93,13 @@ void fs_private_dev(void){
         int have_devlog = 0;
         if (stat("/dev/log", &s) == 0) {
                 have_devlog = 1;
-                FILE *fp = fopen(DEVLOG_FILE, "w");
+                FILE *fp = fopen(RUN_DEVLOG_FILE, "w");
                 if (!fp)
                         have_devlog = 0;
                 else {
                         fprintf(fp, "\n");
                         fclose(fp);
-                        if (mount("/dev/log", DEVLOG_FILE, NULL, MS_BIND|MS_REC, NULL) < 0)
+                        if (mount("/dev/log", RUN_DEVLOG_FILE, NULL, MS_BIND|MS_REC, NULL) < 0)
                                 errExit("mounting /dev/log");
                 }
         }
@@ -114,7 +114,7 @@ void fs_private_dev(void){
                 if (fp) {
                         fprintf(fp, "\n");
                         fclose(fp);
-                        if (mount(DEVLOG_FILE, "/dev/log", NULL, MS_BIND|MS_REC, NULL) < 0)
+                        if (mount(RUN_DEVLOG_FILE, "/dev/log", NULL, MS_BIND|MS_REC, NULL) < 0)
                                 errExit("mounting /dev/log");
                 }
         }               
@@ -129,7 +129,7 @@ void fs_private_dev(void){
                         errExit("chown");
                 if (chmod("/dev/dri",0755) < 0)
                         errExit("chmod");
-                if (mount(DRI_DIR, "/dev/dri", NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount(RUN_DRI_DIR, "/dev/dri", NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mounting /dev/dri");
         }
         
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index f9088f1ba..28e337abc 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -76,7 +76,7 @@ static void duplicate(char *fname) {
         char *cmd;
 
         // copy the file - this code assumes ETC_DIR is actually MNT_DIR/etc
-        if (asprintf(&cmd, "%s -a --parents /etc/%s %s", CP_COMMAND, fname, MNT_DIR) == -1)
+        if (asprintf(&cmd, "%s -a --parents /etc/%s %s", RUN_CP_COMMAND, fname, RUN_MNT_DIR) == -1)
                 errExit("asprintf");
         if (arg_debug)
                 printf("%s\n", cmd);
@@ -98,12 +98,12 @@ void fs_private_etc_list(void) {
 
         // create /tmp/firejail/mnt/etc directory
         fs_build_mnt_dir();
-        int rv = mkdir(ETC_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+        int rv = mkdir(RUN_ETC_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
         if (rv == -1)
                 errExit("mkdir");
-        if (chown(ETC_DIR, 0, 0) < 0)
+        if (chown(RUN_ETC_DIR, 0, 0) < 0)
                 errExit("chown");
-        if (chmod(ETC_DIR, 0755) < 0)
+        if (chmod(RUN_ETC_DIR, 0755) < 0)
                 errExit("chmod");
         
         // copy the list of files in the new etc directory
@@ -138,8 +138,8 @@ void fs_private_etc_list(void) {
         waitpid(child, NULL, 0);
 
         if (arg_debug)
-                printf("Mount-bind %s on top of /etc\n", ETC_DIR);
-        if (mount(ETC_DIR, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0)
+                printf("Mount-bind %s on top of /etc\n", RUN_ETC_DIR);
+        if (mount(RUN_ETC_DIR, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind");
 
 }
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 63c03a8db..23f036bd7 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -113,7 +113,7 @@ static int store_xauthority(void) {
         fs_build_mnt_dir();
 
         char *src;
-        char *dest = XAUTHORITY_FILE;
+        char *dest = RUN_XAUTHORITY_FILE;
         if (asprintf(&src, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
         
@@ -132,7 +132,7 @@ static int store_xauthority(void) {
 
 static void copy_xauthority(void) {
         // copy XAUTHORITY_FILE in the new home directory
-        char *src = XAUTHORITY_FILE ;
+        char *src = RUN_XAUTHORITY_FILE ;
         char *dest;
         if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
@@ -370,7 +370,7 @@ static void duplicate(char *name) {
         }
 
         // copy the file
-        if (asprintf(&cmd, "%s -a --parents \"%s\" %s", CP_COMMAND, fname, HOME_DIR) == -1)
+        if (asprintf(&cmd, "%s -a --parents \"%s\" %s", RUN_CP_COMMAND, fname, RUN_HOME_DIR) == -1)
                 errExit("asprintf");
         if (arg_debug)
                 printf("%s\n", cmd);
@@ -405,12 +405,12 @@ void fs_private_home_list(void) {
 
         // create /tmp/firejail/mnt/home directory
         fs_build_mnt_dir();
-        int rv = mkdir(HOME_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+        int rv = mkdir(RUN_HOME_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
         if (rv == -1)
                 errExit("mkdir");
-        if (chown(HOME_DIR, u, g) < 0)
+        if (chown(RUN_HOME_DIR, u, g) < 0)
                 errExit("chown");
-        if (chmod(HOME_DIR, 0755) < 0)
+        if (chmod(RUN_HOME_DIR, 0755) < 0)
                 errExit("chmod");
         
         // copy the list of files in the new home directory
@@ -448,7 +448,7 @@ void fs_private_home_list(void) {
 
         // mount bind private_homedir on top of homedir
         char *newhome;
-        if (asprintf(&newhome, "%s%s", HOME_DIR, cfg.homedir) == -1)
+        if (asprintf(&newhome, "%s%s", RUN_HOME_DIR, cfg.homedir) == -1)
                 errExit("asprintf");
 
         if (arg_debug)
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index 5a79526b6..eb3861d1b 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -34,22 +34,22 @@ void fs_hostname(const char *hostname) {
                 if (arg_debug)
                         printf("Creating a new /etc/hostname file\n");
 
-                FILE *fp = fopen(HOSTNAME_FILE, "w");
+                FILE *fp = fopen(RUN_HOSTNAME_FILE, "w");
                 if (!fp) {
-                        fprintf(stderr, "Error: cannot create %s\n", HOSTNAME_FILE);
+                        fprintf(stderr, "Error: cannot create %s\n", RUN_HOSTNAME_FILE);
                         exit(1);
                 }
                 fprintf(fp, "%s\n", hostname);
                 fclose(fp);
                 
                 // mode and owner
-                if (chown(HOSTNAME_FILE, 0, 0) < 0)
+                if (chown(RUN_HOSTNAME_FILE, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(HOSTNAME_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
+                if (chmod(RUN_HOSTNAME_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
                         errExit("chmod");
                 
                 // bind-mount the file on top of /etc/hostname
-                if (mount(HOSTNAME_FILE, "/etc/hostname", NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount(RUN_HOSTNAME_FILE, "/etc/hostname", NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind /etc/hostname");
         }
         
@@ -64,9 +64,9 @@ void fs_hostname(const char *hostname) {
                         fprintf(stderr, "Error: cannot open /etc/hosts\n");
                         exit(1);
                 }
-                FILE *fp2 = fopen(HOSTNAME_FILE, "w");
+                FILE *fp2 = fopen(RUN_HOSTS_FILE, "w");
                 if (!fp2) {
-                        fprintf(stderr, "Error: cannot create %s\n", HOSTNAME_FILE);
+                        fprintf(stderr, "Error: cannot create %s\n", RUN_HOSTS_FILE);
                         exit(1);
                 }
                 
@@ -90,13 +90,13 @@ void fs_hostname(const char *hostname) {
                 fclose(fp2);
                 
                 // mode and owner
-                if (chown(HOSTNAME_FILE, 0, 0) < 0)
+                if (chown(RUN_HOSTS_FILE, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(HOSTNAME_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
+                if (chmod(RUN_HOSTS_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
                         errExit("chmod");
                 
                 // bind-mount the file on top of /etc/hostname
-                if (mount(HOSTNAME_FILE, "/etc/hosts", NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount(RUN_HOSTS_FILE, "/etc/hosts", NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind /etc/hosts");
         }
 }
@@ -112,9 +112,9 @@ void fs_resolvconf(void) {
         if (stat("/etc/resolv.conf", &s) == 0) {
                 if (arg_debug)
                         printf("Creating a new /etc/resolv.conf file\n");
-                FILE *fp = fopen(RESOLVCONF_FILE, "w");
+                FILE *fp = fopen(RUN_RESOLVCONF_FILE, "w");
                 if (!fp) {
-                        fprintf(stderr, "Error: cannot create %s\n", RESOLVCONF_FILE);
+                        fprintf(stderr, "Error: cannot create %s\n", RUN_RESOLVCONF_FILE);
                         exit(1);
                 }
                 
@@ -127,13 +127,13 @@ void fs_resolvconf(void) {
                 fclose(fp);
                 
                 // mode and owner
-                if (chown(RESOLVCONF_FILE, 0, 0) < 0)
+                if (chown(RUN_RESOLVCONF_FILE, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(RESOLVCONF_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
+                if (chmod(RUN_RESOLVCONF_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
                         errExit("chmod");
                 
                 // bind-mount the file on top of /etc/hostname
-                if (mount(RESOLVCONF_FILE, "/etc/resolv.conf", NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount(RUN_RESOLVCONF_FILE, "/etc/resolv.conf", NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind /etc/resolv.conf");
         }
         else {
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index 2b0f52a98..f4f5d3e81 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -53,20 +53,20 @@ void fs_trace(void) {
         if (arg_debug)
                 printf("Create the new ld.so.preload file\n");
 
-        FILE *fp = fopen(LDPRELOAD_FILE, "w");
+        FILE *fp = fopen(RUN_LDPRELOAD_FILE, "w");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s/firejail/libtrace.so\n", LIBDIR);
         fclose(fp);
-        if (chown(LDPRELOAD_FILE, 0, 0) < 0)
+        if (chown(RUN_LDPRELOAD_FILE, 0, 0) < 0)
                 errExit("chown");
-        if (chmod(LDPRELOAD_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
+        if (chmod(RUN_LDPRELOAD_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH ) < 0)
                 errExit("chmod");
         
         // mount the new preload file
         if (arg_debug)
                 printf("Mount the new ld.so.preload file\n");
-        if (mount(LDPRELOAD_FILE, "/etc/ld.so.preload", NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (mount(RUN_LDPRELOAD_FILE, "/etc/ld.so.preload", NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind ls.so.preload");
 }
 
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 9016e3923..a38539078 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -83,7 +83,7 @@ static void whitelist_path(ProfileEntry *entry) {
                         exit(1);
                 }
         
-                if (asprintf(&wfile, "%s/%s", WHITELIST_HOME_USER_DIR, fname) == -1)
+                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_HOME_USER_DIR, fname) == -1)
                         errExit("asprintf");
         }
         else if (entry->tmp_dir) {
@@ -93,7 +93,7 @@ static void whitelist_path(ProfileEntry *entry) {
                         exit(1);
                 }
         
-                if (asprintf(&wfile, "%s/%s", WHITELIST_TMP_DIR, fname) == -1)
+                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_TMP_DIR, fname) == -1)
                         errExit("asprintf");
         }
         else if (entry->media_dir) {
@@ -103,7 +103,7 @@ static void whitelist_path(ProfileEntry *entry) {
                         exit(1);
                 }
         
-                if (asprintf(&wfile, "%s/%s", WHITELIST_MEDIA_DIR, fname) == -1)
+                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_MEDIA_DIR, fname) == -1)
                         errExit("asprintf");
         }
         else if (entry->var_dir) {
@@ -113,7 +113,7 @@ static void whitelist_path(ProfileEntry *entry) {
                         exit(1);
                 }
         
-                if (asprintf(&wfile, "%s/%s", WHITELIST_VAR_DIR, fname) == -1)
+                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_VAR_DIR, fname) == -1)
                         errExit("asprintf");
         }
         else if (entry->dev_dir) {
@@ -123,7 +123,7 @@ static void whitelist_path(ProfileEntry *entry) {
                         exit(1);
                 }
         
-                if (asprintf(&wfile, "%s/%s", WHITELIST_DEV_DIR, fname) == -1)
+                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_DEV_DIR, fname) == -1)
                         errExit("asprintf");
         }
         else if (entry->opt_dir) {
@@ -133,7 +133,7 @@ static void whitelist_path(ProfileEntry *entry) {
                         exit(1);
                 }
         
-                if (asprintf(&wfile, "%s/%s", WHITELIST_OPT_DIR, fname) == -1)
+                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_OPT_DIR, fname) == -1)
                         errExit("asprintf");
         }
 
@@ -315,16 +315,16 @@ void fs_whitelist(void) {
 
         // /home/user
         if (home_dir) {
-                // keep a copy of real home dir in WHITELIST_HOME_USER_DIR
-                int rv = mkdir(WHITELIST_HOME_USER_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                // keep a copy of real home dir in RUN_WHITELIST_HOME_USER_DIR
+                int rv = mkdir(RUN_WHITELIST_HOME_USER_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(WHITELIST_HOME_USER_DIR, getuid(), getgid()) < 0)
+                if (chown(RUN_WHITELIST_HOME_USER_DIR, getuid(), getgid()) < 0)
                         errExit("chown");
-                if (chmod(WHITELIST_HOME_USER_DIR, 0755) < 0)
+                if (chmod(RUN_WHITELIST_HOME_USER_DIR, 0755) < 0)
                         errExit("chmod");
         
-                if (mount(cfg.homedir, WHITELIST_HOME_USER_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount(cfg.homedir, RUN_WHITELIST_HOME_USER_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind");
         
                 // mount a tmpfs and initialize /home/user
@@ -334,15 +334,15 @@ void fs_whitelist(void) {
         // /tmp mountpoint
         if (tmp_dir) {
                 // keep a copy of real /tmp directory in WHITELIST_TMP_DIR
-                int rv = mkdir(WHITELIST_TMP_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                int rv = mkdir(RUN_WHITELIST_TMP_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(WHITELIST_TMP_DIR, 0, 0) < 0)
+                if (chown(RUN_WHITELIST_TMP_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(WHITELIST_TMP_DIR, 0777) < 0)
+                if (chmod(RUN_WHITELIST_TMP_DIR, 0777) < 0)
                         errExit("chmod");
         
-                if (mount("/tmp", WHITELIST_TMP_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount("/tmp", RUN_WHITELIST_TMP_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind");
         
                 // mount tmpfs on /tmp
@@ -354,16 +354,16 @@ void fs_whitelist(void) {
         
         // /media mountpoint
         if (media_dir) {
-                // keep a copy of real /media directory in WHITELIST_MEDIA_DIR
-                int rv = mkdir(WHITELIST_MEDIA_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                // keep a copy of real /media directory in RUN_WHITELIST_MEDIA_DIR
+                int rv = mkdir(RUN_WHITELIST_MEDIA_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(WHITELIST_MEDIA_DIR, 0, 0) < 0)
+                if (chown(RUN_WHITELIST_MEDIA_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(WHITELIST_MEDIA_DIR, 0755) < 0)
+                if (chmod(RUN_WHITELIST_MEDIA_DIR, 0755) < 0)
                         errExit("chmod");
         
-                if (mount("/media", WHITELIST_MEDIA_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount("/media", RUN_WHITELIST_MEDIA_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind");
         
                 // mount tmpfs on /media
@@ -375,16 +375,16 @@ void fs_whitelist(void) {
 
         // /media mountpoint
         if (var_dir) {
-                // keep a copy of real /var directory in WHITELIST_VAR_DIR
-                int rv = mkdir(WHITELIST_VAR_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                // keep a copy of real /var directory in RUN_WHITELIST_VAR_DIR
+                int rv = mkdir(RUN_WHITELIST_VAR_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(WHITELIST_VAR_DIR, 0, 0) < 0)
+                if (chown(RUN_WHITELIST_VAR_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(WHITELIST_VAR_DIR, 0755) < 0)
+                if (chmod(RUN_WHITELIST_VAR_DIR, 0755) < 0)
                         errExit("chmod");
         
-                if (mount("/var", WHITELIST_VAR_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount("/var", RUN_WHITELIST_VAR_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind");
         
                 // mount tmpfs on /var
@@ -396,16 +396,16 @@ void fs_whitelist(void) {
 
         // /dev mountpoint
         if (dev_dir) {
-                // keep a copy of real /dev directory in WHITELIST_DEV_DIR
-                int rv = mkdir(WHITELIST_DEV_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                // keep a copy of real /dev directory in RUN_WHITELIST_DEV_DIR
+                int rv = mkdir(RUN_WHITELIST_DEV_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(WHITELIST_DEV_DIR, 0, 0) < 0)
+                if (chown(RUN_WHITELIST_DEV_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(WHITELIST_DEV_DIR, 0755) < 0)
+                if (chmod(RUN_WHITELIST_DEV_DIR, 0755) < 0)
                         errExit("chmod");
         
-                if (mount("/dev", WHITELIST_DEV_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount("/dev", RUN_WHITELIST_DEV_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind");
         
                 // mount tmpfs on /dev
@@ -417,16 +417,16 @@ void fs_whitelist(void) {
 
         // /opt mountpoint
         if (opt_dir) {
-                // keep a copy of real /opt directory in WHITELIST_DEV_DIR
-                int rv = mkdir(WHITELIST_OPT_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+                // keep a copy of real /opt directory in RUN_WHITELIST_DEV_DIR
+                int rv = mkdir(RUN_WHITELIST_OPT_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
                 if (rv == -1)
                         errExit("mkdir");
-                if (chown(WHITELIST_OPT_DIR, 0, 0) < 0)
+                if (chown(RUN_WHITELIST_OPT_DIR, 0, 0) < 0)
                         errExit("chown");
-                if (chmod(WHITELIST_OPT_DIR, 0755) < 0)
+                if (chmod(RUN_WHITELIST_OPT_DIR, 0755) < 0)
                         errExit("chmod");
         
-                if (mount("/opt", WHITELIST_OPT_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (mount("/opt", RUN_WHITELIST_OPT_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                         errExit("mount bind");
         
                 // mount tmpfs on /opt
@@ -468,15 +468,15 @@ void fs_whitelist(void) {
                 entry = entry->next;
         }
 
-        // mask the real home directory, currently mounted on WHITELIST_HOME_DIR
+        // mask the real home directory, currently mounted on RUN_WHITELIST_HOME_DIR
         if (home_dir) {
-                if (mount("tmpfs", WHITELIST_HOME_USER_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_HOME_USER_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
         }
         
-        // mask the real /tmp directory, currently mounted on WHITELIST_TMP_DIR
+        // mask the real /tmp directory, currently mounted on RUN_WHITELIST_TMP_DIR
         if (tmp_dir) {
-                if (mount("tmpfs", WHITELIST_TMP_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_TMP_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
         }
 
diff --git a/src/firejail/join.c b/src/firejail/join.c
index 64e092197..8b3c196c7 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -69,7 +69,7 @@ static void extract_command(int argc, char **argv, int index) {
 
 static void extract_nogroups(pid_t pid) {
         char *fname;
-        if (asprintf(&fname, "/proc/%d/root%s", pid, GROUPS_CFG) == -1)
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_GROUPS_CFG) == -1)
                 errExit("asprintf");
                 
         struct stat s;
@@ -82,7 +82,7 @@ static void extract_nogroups(pid_t pid) {
 
 static void extract_cpu(pid_t pid) {
         char *fname;
-        if (asprintf(&fname, "/proc/%d/root%s", pid, CPU_CFG) == -1)
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_CPU_CFG) == -1)
                 errExit("asprintf");
                 
         struct stat s;
@@ -96,7 +96,7 @@ static void extract_cpu(pid_t pid) {
 
 static void extract_cgroup(pid_t pid) {
         char *fname;
-        if (asprintf(&fname, "/proc/%d/root%s", pid, CGROUP_CFG) == -1)
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_CGROUP_CFG) == -1)
                 errExit("asprintf");
                 
         struct stat s;
@@ -281,7 +281,7 @@ void join(pid_t pid, const char *homedir, int argc, char **argv, int index) {
                         caps_set(caps);
 #ifdef HAVE_SECCOMP
                 // set protocol filter
-                protocol_filter_load(PROTOCOL_CFG);
+                protocol_filter_load(RUN_PROTOCOL_CFG);
                 if (cfg.protocol) {
                         protocol_filter();
                 }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 1495d7516..891653587 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1263,7 +1263,7 @@ int main(int argc, char **argv) {
 
         // check and assign an IP address - for macvlan it will be done again in the sandbox!
         if (any_bridge_configured()) {
-                lockfd = open(NETWORK_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+                lockfd = open(RUN_NETWORK_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
                 if (lockfd != -1) {
                         int rv = fchown(lockfd, 0, 0);
                         (void) rv;
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index 8ee5fd3b8..b5d50b4fc 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -261,16 +261,16 @@ void protocol_filter_save(void) {
         // save protocol filter configuration in PROTOCOL_CFG
         fs_build_mnt_dir();
 
-        FILE *fp = fopen(PROTOCOL_CFG, "w");
+        FILE *fp = fopen(RUN_PROTOCOL_CFG, "w");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s\n", cfg.protocol);
         fclose(fp);
 
-        if (chmod(PROTOCOL_CFG, 0600) < 0)
+        if (chmod(RUN_PROTOCOL_CFG, 0600) < 0)
                 errExit("chmod");
 
-        if (chown(PROTOCOL_CFG, 0, 0) < 0)
+        if (chown(RUN_PROTOCOL_CFG, 0, 0) < 0)
                 errExit("chown");
 
 }
@@ -354,7 +354,7 @@ void protocol_print_filter(pid_t pid) {
 
         // find the seccomp filter
         char *fname;
-        if (asprintf(&fname, "/proc/%d/root%s", pid, PROTOCOL_CFG) == -1)
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_PROTOCOL_CFG) == -1)
                 errExit("asprintf");
 
         struct stat s;
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index 0e1edea14..6ead5799c 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -38,11 +38,11 @@ static void disable_file(const char *path, const char *file) {
                 printf("Disable%s\n", fname);
                 
         if (S_ISDIR(s.st_mode)) {
-                if (mount(RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                if (mount(RUN_RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
                         errExit("disable file");
         }
         else {
-                if (mount(RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                if (mount(RUN_RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
                         errExit("disable file");
         }
 
@@ -92,16 +92,16 @@ void pulseaudio_init(void) {
          
         // create the new user pulseaudio directory
          fs_build_mnt_dir();
-        int rv = mkdir(PULSE_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
+        int rv = mkdir(RUN_PULSE_DIR, S_IRWXU | S_IRWXG | S_IRWXO);
         (void) rv; // in --chroot mode the directory canalready be there
-        if (chown(PULSE_DIR, getuid(), getgid()) < 0)
+        if (chown(RUN_PULSE_DIR, getuid(), getgid()) < 0)
                 errExit("chown");
-        if (chmod(PULSE_DIR, 0700) < 0)
+        if (chmod(RUN_PULSE_DIR, 0700) < 0)
                 errExit("chmod");
 
         // create the new client.conf file
         char *pulsecfg = NULL;
-        if (asprintf(&pulsecfg, "%s/client.conf", PULSE_DIR) == -1)
+        if (asprintf(&pulsecfg, "%s/client.conf", RUN_PULSE_DIR) == -1)
                 errExit("asprintf");
         if (copy_file("/etc/pulse/client.conf", pulsecfg))
                 errExit("copy_file");
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index d2d106f27..733dbef41 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -73,11 +73,11 @@ static void sanitize_home(void) {
         }
         
         fs_build_mnt_dir();
-        if (mkdir(WHITELIST_HOME_DIR, 0755) == -1)
+        if (mkdir(RUN_WHITELIST_HOME_DIR, 0755) == -1)
                 errExit("mkdir");
 
         // keep a copy of the user home directory
-        if (mount(cfg.homedir, WHITELIST_HOME_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (mount(cfg.homedir, RUN_WHITELIST_HOME_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind");
 
         // mount tmpfs in the new home
@@ -95,11 +95,11 @@ static void sanitize_home(void) {
                 errExit("chmod");
 
         // mount user home directory
-        if (mount(WHITELIST_HOME_DIR, cfg.homedir, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (mount(RUN_WHITELIST_HOME_DIR, cfg.homedir, NULL, MS_BIND|MS_REC, NULL) < 0)
                 errExit("mount bind");
 
         // mask home dir under /run
-        if (mount("tmpfs", WHITELIST_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+        if (mount("tmpfs", RUN_WHITELIST_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
                 errExit("mount tmpfs");
 }
 
@@ -118,7 +118,7 @@ static void sanitize_passwd(void) {
         fpin = fopen("/etc/passwd", "r");
         if (!fpin)
                 goto errout;
-        fpout = fopen(PASSWD_FILE, "w");
+        fpout = fopen(RUN_PASSWD_FILE, "w");
         if (!fpout)
                 goto errout;
         
@@ -172,13 +172,13 @@ static void sanitize_passwd(void) {
         }
         fclose(fpin);
         fclose(fpout);
-        if (chown(PASSWD_FILE, 0, 0) == -1)
+        if (chown(RUN_PASSWD_FILE, 0, 0) == -1)
                 errExit("chown");
-        if (chmod(PASSWD_FILE, 0644) == -1)
+        if (chmod(RUN_PASSWD_FILE, 0644) == -1)
                 errExit("chmod");
                 
         // mount-bind tne new password file
-        if (mount(PASSWD_FILE, "/etc/passwd", "none", MS_BIND, "mode=400,gid=0") < 0)
+        if (mount(RUN_PASSWD_FILE, "/etc/passwd", "none", MS_BIND, "mode=400,gid=0") < 0)
                 errExit("mount");
         
         return; 
@@ -249,7 +249,7 @@ static void sanitize_group(void) {
         fpin = fopen("/etc/group", "r");
         if (!fpin)
                 goto errout;
-        fpout = fopen(GROUP_FILE, "w");
+        fpout = fopen(RUN_GROUP_FILE, "w");
         if (!fpout)
                 goto errout;
         
@@ -298,13 +298,13 @@ static void sanitize_group(void) {
         }
         fclose(fpin);
         fclose(fpout);
-        if (chown(GROUP_FILE, 0, 0) == -1)
+        if (chown(RUN_GROUP_FILE, 0, 0) == -1)
                 errExit("chown");
-        if (chmod(GROUP_FILE, 0644) == -1)
+        if (chmod(RUN_GROUP_FILE, 0644) == -1)
                 errExit("chmod");
                 
         // mount-bind tne new group file
-        if (mount(GROUP_FILE, "/etc/group", "none", MS_BIND, "mode=400,gid=0") < 0)
+        if (mount(RUN_GROUP_FILE, "/etc/group", "none", MS_BIND, "mode=400,gid=0") < 0)
                 errExit("mount");
         
         return; 
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index dd444f0b9..2827ca9d3 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -48,11 +48,11 @@ void save_nogroups(void) {
         if (arg_nogroups == 0)
                 return;
 
-        FILE *fp = fopen(GROUPS_CFG, "w");
+        FILE *fp = fopen(RUN_GROUPS_CFG, "w");
         if (fp) {
                 fprintf(fp, "\n");
                 fclose(fp);
-                if (chown(GROUPS_CFG, 0, 0) < 0)
+                if (chown(RUN_GROUPS_CFG, 0, 0) < 0)
                         errExit("chown");
         }
         else {
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index a3efa54df..eb6e489dd 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -266,7 +266,7 @@ static void write_seccomp_file(void) {
         fs_build_mnt_dir();
         assert(sfilter);
 
-        int fd = open(SECCOMP_CFG, O_CREAT | O_WRONLY, S_IRUSR | S_IWUSR);
+        int fd = open(RUN_SECCOMP_CFG, O_CREAT | O_WRONLY, S_IRUSR | S_IWUSR);
         if (fd == -1)
                 errExit("open");
 
@@ -279,7 +279,7 @@ static void write_seccomp_file(void) {
                 exit(1);
         }
         close(fd);
-        if (chown(SECCOMP_CFG, 0, 0) < 0)
+        if (chown(RUN_SECCOMP_CFG, 0, 0) < 0)
                 errExit("chown");
 }
 
@@ -690,7 +690,7 @@ int seccomp_filter_errno(void) {
 
 void seccomp_set(void) {
         // read seccomp filter from  /tmp/firejail/mnt/seccomp
-        read_seccomp_file(SECCOMP_CFG);
+        read_seccomp_file(RUN_SECCOMP_CFG);
         
         // apply filter
         struct sock_fprog prog = {
@@ -751,7 +751,7 @@ void seccomp_print_filter(pid_t pid) {
 
         // find the seccomp filter
         char *fname;
-        if (asprintf(&fname, "/proc/%d/root%s", pid, SECCOMP_CFG) == -1)
+        if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_CFG) == -1)
                 errExit("asprintf");
 
         struct stat s;