3 files changed, 25 insertions, 0 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 14cad4190..4a59522bf 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -260,6 +260,7 @@ extern int arg_caps_keep;		// keep list
 extern char *arg_caps_list;             // optional caps list
 
 extern int arg_trace;           // syscall tracing support
+extern char *arg_tracefile;     // syscall tracing file
 extern int arg_tracelog;        // blacklist tracing support
 extern int arg_rlimit_cpu;      // rlimit cpu
 extern int arg_rlimit_nofile;   // rlimit nofile
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index 26dd5cb27..eac73a074 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -41,6 +41,25 @@ void fs_trace_preload(void) {
                 fclose(fp);
                 fs_logger("touch /etc/ld.so.preload");
         }
+        if (arg_tracefile) {
+                if (arg_debug)
+                        printf("Creating an empty trace log file: %s\n", arg_tracefile);
+                // create a bind mounted trace logfile that the sandbox can see
+                FILE *fp = fopen(arg_tracefile, "w");
+                if (!fp)
+                        errExit("fopen");
+                SET_PERMS_STREAM(fp, firejail_uid, firejail_gid, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+                fclose(fp);
+                fp = fopen(RUN_TRACE_FILE, "w");
+                if (!fp)
+                        errExit("fopen");
+                fclose(fp);
+                fs_logger2("touch ", arg_tracefile);
+                if (mount(arg_tracefile, RUN_TRACE_FILE, NULL, MS_BIND|MS_REC, NULL) < 0)
+                        errExit("mount bind " RUN_TRACE_FILE);
+                if (arg_debug)
+                        printf("Bind mount %s to %s\n", arg_tracefile, RUN_TRACE_FILE);
+        }
 }
 
 void fs_trace(void) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 9f44c6281..4c6d20626 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -80,6 +80,7 @@ int arg_caps_keep = 0;			// keep list
 char *arg_caps_list = NULL;                     // optional caps list
 
 int arg_trace = 0;                              // syscall tracing support
+char *arg_tracefile = NULL;                     // syscall tracing file
 int arg_tracelog = 0;                           // blacklist tracing support
 int arg_rlimit_cpu = 0;                         // rlimit max cpu time
 int arg_rlimit_nofile = 0;                      // rlimit nofile
@@ -1296,6 +1297,10 @@ int main(int argc, char **argv) {
                 }
                 else if (strcmp(argv[i], "--trace") == 0)
                         arg_trace = 1;
+                else if (strncmp(argv[i], "--trace=", 8) == 0) {
+                        arg_trace = 1;
+                        arg_tracefile = argv[i] + 8;
+                }
                 else if (strcmp(argv[i], "--tracelog") == 0)
                         arg_tracelog = 1;
                 else if (strncmp(argv[i], "--rlimit-cpu=", 13) == 0) {