support to disable enforcing firejail.config

7 files changed, 41 insertions, 18 deletions

diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in
index a8af1a4e0..21f415ba5 100644
--- a/src/firejail/Makefile.in
+++ b/src/firejail/Makefile.in
@@ -17,13 +17,13 @@ HAVE_USERNS=@HAVE_USERNS@
 HAVE_X11=@HAVE_X11@
 HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
 HAVE_WHITELIST=@HAVE_WHITELIST@
-
+HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
 
 H_FILE_LIST       = $(sort $(wildcard *.[h]))
 C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_SECCOMP) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/libnetlink.h ../include/pid.h
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index a69c2831e..6636e7efe 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -48,8 +48,13 @@ int checkcfg(int val) {
 
                 FILE *fp = fopen(fname, "r");
                 if (!fp) {
+#ifdef HAVE_GLOBALCFG                   
                         fprintf(stderr, "Warning: Firejail configuration file %s not found\n", fname);
                         exit(1);
+#else
+                        initialized = 1;
+                        return  cfg_val[val];
+#endif  
                 }
                 
                 // read configuration file
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 8cae9191c..acc03e412 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -652,26 +652,27 @@ void fs_proc_sys_dev_boot(void) {
 // disable firejail configuration in /etc/firejail and in ~/.config/firejail
 static void disable_firejail_config(void) {
         struct stat s;
-        if (stat("/etc/firejail", &s) == 0)
-                disable_file(BLACKLIST_FILE, "/etc/firejail");
+//      if (stat("/etc/firejail", &s) == 0)
+//              disable_file(BLACKLIST_FILE, "/etc/firejail");
 
         char *fname;
         if (asprintf(&fname, "%s/.config/firejail", cfg.homedir) == -1)
                 errExit("asprintf");
         if (stat(fname, &s) == 0)
                 disable_file(BLACKLIST_FILE, fname);
+        free(fname);
         
-        if (stat("/usr/local/etc/firejail", &s) == 0)
-                disable_file(BLACKLIST_FILE, "/usr/local/etc/firejail");
-
-        if (strcmp(PREFIX, "/usr/local")) {
-                if (asprintf(&fname, "%s/etc/firejail", PREFIX) == -1)
-                        errExit("asprintf");
-                if (stat(fname, &s) == 0)
-                        disable_file(BLACKLIST_FILE, fname);
-        }
+//      if (stat("/usr/local/etc/firejail", &s) == 0)
+//              disable_file(BLACKLIST_FILE, "/usr/local/etc/firejail");
+//
+//      if (strcmp(PREFIX, "/usr/local")) {
+//              if (asprintf(&fname, "%s/etc/firejail", PREFIX) == -1)
+//                      errExit("asprintf");
+//              if (stat(fname, &s) == 0)
+//                      disable_file(BLACKLIST_FILE, fname);
+//              free(fname);
+//      }
         
-        free(fname);
         
         // disable run time information
         if (stat(RUN_FIREJAIL_NETWORK_DIR, &s) == 0)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index d027eb697..423df3752 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -854,7 +854,7 @@ int main(int argc, char **argv) {
         
         
         // check for force-nonewprivs in /etc/firejail/firejail.config file
-        if (!option_force && checkcfg(CFG_FORCE_NONEWPRIVS))
+        if (checkcfg(CFG_FORCE_NONEWPRIVS))
                 arg_nonewprivs = 1;
         
         // parse arguments
diff --git a/src/include/euid_common.h b/src/include/euid_common.h
index f07cf2868..b6d341bf4 100644
--- a/src/include/euid_common.h
+++ b/src/include/euid_common.h
@@ -36,12 +36,12 @@ extern uid_t firejail_uid;
 
 static inline void EUID_ROOT(void) {
         if (seteuid(0) == -1)
-                fprintf(stderr, "Error: cannot switch euid to root\n");
+                fprintf(stderr, "Warning: cannot switch euid to root\n");
 }
 
 static inline void EUID_USER(void) {
         if (seteuid(firejail_uid) == -1)
-                fprintf(stderr, "Error: cannot switch euid to user\n");
+                fprintf(stderr, "Warning: cannot switch euid to user\n");
 }
 
 static inline void EUID_PRINT(void) {
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt
index e2e4229b0..c12bf7731 100644
--- a/src/man/firecfg.txt
+++ b/src/man/firecfg.txt
@@ -10,7 +10,7 @@ sandbox applications automatically, just by clicking on a regular desktop
 menus and icons.
 
 The symbolic links are placed in /usr/local/bin. For more information, see
-DESKTOP INTEGRATION section in man 1 firejail.
+\fBDESKTOP INTEGRATION\fR section in \fBman 1 firejail\fR.
 
 .SH OPTIONS
 .TP
diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt
index 6a66c7f75..bc29dc977 100644
--- a/src/man/firejail-config.txt
+++ b/src/man/firejail-config.txt
@@ -74,6 +74,23 @@ xephyr-screen 1024x768
 .br
 xephyr-screen 1280x1024
 
+.TP
+\fBxephyr-window-title
+Firejail window title in Xephry, default enabled.
+
+.TP
+\fBxephyr-extra-params
+Xephyr command extra parameters. None by default, and the declaration is commented out. Examples:
+.br
+
+.br
+xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev
+.br
+xephyr-extra-params -grayscale
+
+.SH COMPILE TIME CONFIGURATION
+Most of the features described in this file can also be configured at compile time, please run \fB./configure --help\fR for more details.
+
 .SH FILES
 /etc/firejail/firejail.config