8 files changed, 54 insertions, 5 deletions

diff --git a/etc/waterfox.profile b/etc/waterfox.profile
index 6520057b4..2322c1fae 100644
--- a/etc/waterfox.profile
+++ b/etc/waterfox.profile
@@ -11,7 +11,11 @@ noblacklist ~/.config/okularpartrc
 noblacklist ~/.config/okularrc
 noblacklist ~/.config/qpdfview
 noblacklist ~/.kde/share/apps/okular
+noblacklist ~/.kde/share/config/okularpartrc
+noblacklist ~/.kde/share/config/okularrc
 noblacklist ~/.kde4/share/apps/okular
+noblacklist ~/.kde4/share/config/okularpartrc
+noblacklist ~/.kde4/share/config/okularrc
 noblacklist ~/.local/share/gnome-shell/extensions
 noblacklist ~/.local/share/okular
 noblacklist ~/.local/share/qpdfview
@@ -39,7 +43,11 @@ whitelist ~/.config/pipelight-silverlight5.1
 whitelist ~/.config/pipelight-widevine
 whitelist ~/.config/qpdfview
 whitelist ~/.kde/share/apps/okular
+whitelist ~/.kde/share/config/okularpartrc
+whitelist ~/.kde/share/config/okularrc
 whitelist ~/.kde4/share/apps/okular
+whitelist ~/.kde4/share/config/okularpartrc
+whitelist ~/.kde4/share/config/okularrc
 whitelist ~/.keysnail.js
 whitelist ~/.lastpass
 whitelist ~/.local/share/gnome-shell/extensions
@@ -72,7 +80,6 @@ tracelog
 
 # private-bin waterfox,which,sh,dbus-launch,dbus-send,env
 private-dev
-# private-dev might prevent video calls going out
 # private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,waterfox,mime.types,mailcap,asound.conf,pulse
 private-tmp
 
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc
index d5d1c19ec..ddec19d27 100644
--- a/etc/whitelist-common.inc
+++ b/etc/whitelist-common.inc
@@ -11,6 +11,8 @@ whitelist ~/.config/user-dirs.dirs
 read-only ~/.config/user-dirs.dirs
 whitelist ~/.asoundrc
 whitelist ~/.config/Trolltech.conf
+whitelist ~/.local/share/mime
+whitelist ~/.drirc
 
 # fonts
 whitelist ~/.fonts
@@ -25,9 +27,11 @@ whitelist ~/.cache/fontconfig
 # gtk
 whitelist ~/.gtkrc
 whitelist ~/.gtkrc-2.0
+whitelist ~/.gtk-2.0
 whitelist ~/.config/gtk-2.0
 whitelist ~/.config/gtk-3.0
 whitelist ~/.themes
+whitelist ~/.local/share/themes
 whitelist ~/.kde/share/config/gtkrc
 whitelist ~/.kde/share/config/gtkrc-2.0
 whitelist ~/.gnome2
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index d87d1fc08..d0e236e61 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -356,3 +356,4 @@
 /etc/firejail/zathura.profile
 /etc/firejail/zoom.profile
 /etc/firejail/yandex-browser.profile
+/etc/firejail/itch.profile
diff --git a/platform/rpm/old-mkrpm.sh b/platform/rpm/old-mkrpm.sh
index 7d817c7e2..50f9f0512 100755
--- a/platform/rpm/old-mkrpm.sh
+++ b/platform/rpm/old-mkrpm.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-VERSION="0.9.50~rc1"
+VERSION="0.9.50"
 rm -fr ~/rpmbuild
 rm -f firejail-$VERSION-1.x86_64.rpm
 
@@ -28,6 +28,7 @@ install -m 644 /usr/lib/firejail/firecfg.config  firejail-$VERSION/usr/lib/firej
 #install -m 755 /usr/lib/firejail/fjclip.py  firejail-$VERSION/usr/lib/firejail/.
 #install -m 755 /usr/lib/firejail/fjdisplay.py  firejail-$VERSION/usr/lib/firejail/.
 #install -m 755 /usr/lib/firejail/fjresize.py  firejail-$VERSION/usr/lib/firejail/.
+install -m 755 /usr/lib/firejail/fldd  firejail-$VERSION/usr/lib/firejail/.
 install -m 755 /usr/lib/firejail/fnet  firejail-$VERSION/usr/lib/firejail/.
 install -m 755 /usr/lib/firejail/fseccomp  firejail-$VERSION/usr/lib/firejail/.
 install -m 755 /usr/lib/firejail/fshaper.sh  firejail-$VERSION/usr/lib/firejail/.
@@ -466,6 +467,9 @@ rm -rf %{buildroot}
 %{_sysconfdir}/%{name}/unknown-horizons.profile
 %{_sysconfdir}/%{name}/wireshark-gtk.profile
 %{_sysconfdir}/%{name}/wireshark-qt.profile
+%{_sysconfdir}/%{name}/itch.profile
+%{_sysconfdir}/%{name}/minetest.profile
+%{_sysconfdir}/%{name}/yandex-browser.profile
 
 
 
@@ -490,6 +494,7 @@ rm -rf %{buildroot}
 #/usr/lib/firejail/fjdisplay.py
 #/usr/lib/firejail/fjresize.py
 /usr/lib/firejail/fnet
+/usr/lib/firejail/fldd
 /usr/lib/firejail/fseccomp
 /usr/lib/firejail/seccomp
 /usr/lib/firejail/seccomp.64
@@ -514,7 +519,7 @@ rm -rf %{buildroot}
 chmod u+s /usr/bin/firejail
 
 %changelog
-* Mon Aug 28 2017  netblue30 <netblue30@yahoo.com> 0.9.50~rc1-1
+* Fri Sep 8 2017  netblue30 <netblue30@yahoo.com> 0.9.50-1
 
 * Mon Jun 12 2017  netblue30 <netblue30@yahoo.com> 0.9.48-1
 
diff --git a/src/fseccomp/syscall.c b/src/fseccomp/syscall.c
index d0692b2ef..69b6e5271 100644
--- a/src/fseccomp/syscall.c
+++ b/src/fseccomp/syscall.c
@@ -274,6 +274,9 @@ static const SyscallGroupList sysgroups[] = {
 #ifdef SYS_vserver
           "vserver"
 #endif
+#if !defined(SYS__sysctl) && !defined(SYS_afs_syscall) && !defined(SYS_bdflush) && !defined(SYS_break) && !defined(SYS_create_module) && !defined(SYS_ftime) && !defined(SYS_get_kernel_syms) && !defined(SYS_getpmsg) && !defined(SYS_gtty) && !defined(SYS_lock) && !defined(SYS_mpx) && !defined(SYS_prof) && !defined(SYS_profil) && !defined(SYS_putpmsg) && !defined(SYS_query_module) && !defined(SYS_security) && !defined(SYS_sgetmask) && !defined(SYS_ssetmask) && !defined(SYS_stty) && !defined(SYS_sysfs) && !defined(SYS_tuxcall) && !defined(SYS_ulimit) && !defined(SYS_uselib) && !defined(SYS_ustat) && !defined(SYS_vserver)
+          "__dummy_syscall__" // workaround for arm64 which doesn't have any of above defined and empty syscall lists are not allowed
+#endif
         },
         { .name = "@privileged", .list =
           "@clock,"
@@ -334,6 +337,9 @@ static const SyscallGroupList sysgroups[] = {
 #ifdef SYS_s390_mmio_write
           "s390_mmio_write"
 #endif
+#if !defined(SYS_ioperm) && !defined(SYS_iopl) && !defined(SYS_pciconfig_iobase) && !defined(SYS_pciconfig_read) && !defined(SYS_pciconfig_write) && !defined(SYS_s390_mmio_read) && !defined(SYS_s390_mmio_write)
+          "__dummy_syscall__" // workaround for s390x which doesn't have any of above defined and empty syscall lists are not allowed
+#endif
         },
         { .name = "@reboot", .list =
 #ifdef SYS_kexec_load
diff --git a/src/include/euid_common.h b/src/include/euid_common.h
index f343d77bb..4e6db514d 100644
--- a/src/include/euid_common.h
+++ b/src/include/euid_common.h
@@ -35,7 +35,7 @@ extern uid_t firejail_gid;
 
 static inline void EUID_ROOT(void) {
         int rv = seteuid(0);
-        rv = setegid(0);
+        rv |= setegid(0);
         (void) rv;
 }
 
diff --git a/src/include/seccomp.h b/src/include/seccomp.h
index 133b6ce72..b8bfce96b 100644
--- a/src/include/seccomp.h
+++ b/src/include/seccomp.h
@@ -149,9 +149,35 @@ struct seccomp_data {
 # define ARCH_NR        AUDIT_ARCH_S390
 # define ARCH_32        AUDIT_ARCH_S390
 # define ARCH_64        AUDIT_ARCH_S390X
+#elif defined(__sh64__) && __BYTE_ORDER == __BIG_ENDIAN
+# define ARCH_NR        AUDIT_ARCH_SH64
+# define ARCH_32        AUDIT_ARCH_SH
+# define ARCH_64        AUDIT_ARCH_SH64
+#elif defined(__sh64__) && __BYTE_ORDER == __LITTLE_ENDIAN
+# define ARCH_NR        AUDIT_ARCH_SHEL64
+# define ARCH_32        AUDIT_ARCH_SHEL
+# define ARCH_64        AUDIT_ARCH_SHEL64
+#elif defined(__sh__) && __BYTE_ORDER == __BIG_ENDIAN
+# define ARCH_NR        AUDIT_ARCH_SH
+# define ARCH_32        AUDIT_ARCH_SH
+# define ARCH_64        AUDIT_ARCH_SH64
+#elif defined(__sh__) && __BYTE_ORDER == __LITTLE_ENDIAN
+# define ARCH_NR        AUDIT_ARCH_SHEL
+# define ARCH_32        AUDIT_ARCH_SHEL
+# define ARCH_64        AUDIT_ARCH_SHEL64
+#elif defined(__sparc64__)
+# define ARCH_NR        AUDIT_ARCH_SPARC64
+# define ARCH_32        AUDIT_ARCH_SPARC
+# define ARCH_64        AUDIT_ARCH_SPARC64
+#elif defined(__sparc__)
+# define ARCH_NR        AUDIT_ARCH_SPARC
+# define ARCH_32        AUDIT_ARCH_SPARC
+# define ARCH_64        AUDIT_ARCH_SPARC64
 #else
 # warning "Platform does not support seccomp filter yet"
 # define ARCH_NR        0
+# define ARCH_32        0
+# define ARCH_64        0
 #endif
 
 #define VALIDATE_ARCHITECTURE \
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index a70f662fd..c9d57b87b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1131,7 +1131,7 @@ Disable whitelist for this directory or file.
 
 .TP
 \fB\-\-output=logfile
-stdout logging and log rotation. Copy stdout and stderr to logfile, and keep the size of the file under 500KB using log
+stdout logging and log rotation. Copy stdout to logfile, and keep the size of the file under 500KB using log
 rotation. Five files with prefixes .1 to .5 are used in rotation.
 .br