9 files changed, 43 insertions, 24 deletions

diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml
index 3324906f7..8b023c830 100644
--- a/.github/workflows/check-c.yml
+++ b/.github/workflows/check-c.yml
@@ -150,7 +150,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75
+      uses: github/codeql-action/init@b374143c1149a9115d881581d29b8390bbcbb59c
       with:
         languages: cpp
 
@@ -161,4 +161,4 @@ jobs:
       run: make -j "$(nproc)"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75
+      uses: github/codeql-action/analyze@b374143c1149a9115d881581d29b8390bbcbb59c
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml
index 4425af2b7..186e415d1 100644
--- a/.github/workflows/check-python.yml
+++ b/.github/workflows/check-python.yml
@@ -50,9 +50,9 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75
+      uses: github/codeql-action/init@b374143c1149a9115d881581d29b8390bbcbb59c
       with:
         languages: python
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75
+      uses: github/codeql-action/analyze@b374143c1149a9115d881581d29b8390bbcbb59c
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 13b4b2078..50e4854ac 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -411,6 +411,7 @@ blacklist ${HOME}/.config/com.github.bleakgrey.tootle
 blacklist ${HOME}/.config/com.lettura.dev
 blacklist ${HOME}/.config/corebird
 blacklist ${HOME}/.config/coyim
+blacklist ${HOME}/.config/curlrc
 blacklist ${HOME}/.config/d-feet
 blacklist ${HOME}/.config/darktable
 blacklist ${HOME}/.config/deadbeef
@@ -1219,6 +1220,7 @@ blacklist ${HOME}/Standard Notes Backups
 blacklist ${HOME}/TeamSpeak3-Client-linux_amd64
 blacklist ${HOME}/TeamSpeak3-Client-linux_x86
 blacklist ${HOME}/UpdateInfo
+blacklist ${HOME}/Zomboid
 blacklist ${HOME}/hyperrogue.ini
 blacklist ${HOME}/i2p
 blacklist ${HOME}/mps
diff --git a/etc/profile-a-l/curl.profile b/etc/profile-a-l/curl.profile
index 42ade7ce9..417abcc91 100644
--- a/etc/profile-a-l/curl.profile
+++ b/etc/profile-a-l/curl.profile
@@ -7,6 +7,7 @@ include curl.local
 # Persistent global definitions
 include globals.local
 
+noblacklist ${HOME}/.config/curlrc # since curl 7.73.0
 # curl 7.74.0 introduces experimental support for HSTS cache
 # https://daniel.haxx.se/blog/2020/11/03/hsts-your-curl/
 # Technically this file can be anywhere but let's assume users have it in ${HOME}/.curl-hsts.
diff --git a/etc/profile-a-l/fractal.profile b/etc/profile-a-l/fractal.profile
index fe0bc8756..d35055d43 100644
--- a/etc/profile-a-l/fractal.profile
+++ b/etc/profile-a-l/fractal.profile
@@ -23,6 +23,7 @@ include disable-xdg.inc
 mkdir ${HOME}/.cache/fractal
 whitelist ${HOME}/.cache/fractal
 whitelist ${DOWNLOADS}
+whitelist /usr/share/fractal
 include whitelist-common.inc
 include whitelist-runuser-common.inc
 include whitelist-usr-share-common.inc
diff --git a/etc/profile-m-z/obs.profile b/etc/profile-m-z/obs.profile
index 82e7a4137..dbcc07809 100644
--- a/etc/profile-m-z/obs.profile
+++ b/etc/profile-m-z/obs.profile
@@ -10,6 +10,9 @@ noblacklist ${MUSIC}
 noblacklist ${PICTURES}
 noblacklist ${VIDEOS}
 
+# Allow lua (blacklisted by disable-interpreters.inc)
+include allow-lua.inc
+
 # Allow python (blacklisted by disable-interpreters.inc)
 include allow-python2.inc
 include allow-python3.inc
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile
index 41de746dd..e0ced2030 100644
--- a/etc/profile-m-z/steam.profile
+++ b/etc/profile-m-z/steam.profile
@@ -44,6 +44,7 @@ noblacklist ${HOME}/.prey
 noblacklist ${HOME}/.steam
 noblacklist ${HOME}/.steampath
 noblacklist ${HOME}/.steampid
+noblacklist ${HOME}/Zomboid
 # needed for STEAM_RUNTIME_PREFER_HOST_LIBRARIES=1 to work
 noblacklist /sbin
 noblacklist /usr/sbin
@@ -95,6 +96,7 @@ mkdir ${HOME}/.paradoxinteractive
 mkdir ${HOME}/.paradoxlauncher
 mkdir ${HOME}/.prey
 mkdir ${HOME}/.steam
+mkdir ${HOME}/Zomboid
 mkfile ${HOME}/.steampath
 mkfile ${HOME}/.steampid
 whitelist ${HOME}/.config/Epic
@@ -136,6 +138,7 @@ whitelist ${HOME}/.prey
 whitelist ${HOME}/.steam
 whitelist ${HOME}/.steampath
 whitelist ${HOME}/.steampid
+whitelist ${HOME}/Zomboid
 include whitelist-common.inc
 include whitelist-var-common.inc
 
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 0b34c3019..d0b903fb4 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -974,18 +974,8 @@ int ll_write(const char *allowed_path);
 int ll_special(const char *allowed_path);
 int ll_exec(const char *allowed_path);
 int ll_basic_system(void);
-int ll_restrict(__u32 flags);
+int ll_restrict(uint32_t flags);
 void ll_add_profile(int type, const char *data);
-#else
-static inline int ll_get_fd(void) { return -1; }
-static inline int ll_is_supported(void) { return 0; }
-static inline int ll_read(...) { return 0; }
-static inline int ll_write(...) { return 0; }
-static inline int ll_special(...) { return 0; }
-static inline int ll_exec(...) { return 0; }
-static inline int ll_basic_system(void) { return 0; }
-static inline int ll_restrict(...) { return 0; }
-static inline void ll_add_profile(...) { return; }
 #endif /* HAVE_LANDLOCK */
 
 #endif
diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c
index 65a4cd8df..9cf5ec165 100644
--- a/src/firejail/landlock.c
+++ b/src/firejail/landlock.c
@@ -68,14 +68,16 @@ int ll_is_supported(void) {
                                          LANDLOCK_CREATE_RULESET_VERSION);
         if (ll_abi < 1) {
                 ll_abi = 0;
-                fprintf(stderr, "Warning: Landlock is disabled or not supported: %s, "
+                fprintf(stderr, "Warning: %s: Landlock is disabled or not supported: %s, "
                                 "ignoring landlock commands\n",
-                        strerror(errno));
+                        __func__, strerror(errno));
                 goto out;
         }
 
-        if (arg_debug)
-                printf("Detected Landlock ABI version %d\n", ll_abi);
+        if (arg_debug) {
+                fprintf(stderr, "%s: Detected Landlock ABI version %d\n",
+                        __func__, ll_abi);
+        }
 out:
         return ll_abi;
 }
@@ -100,9 +102,16 @@ static int ll_create_full_ruleset(void) {
                 LANDLOCK_ACCESS_FS_REMOVE_FILE |
                 LANDLOCK_ACCESS_FS_WRITE_FILE;
 
+        if (arg_debug) {
+                fprintf(stderr, "%s: Creating Landlock ruleset (abi=%d fs=%llx)\n",
+                        __func__, ll_abi, attr.handled_access_fs);
+        }
+
         int ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
         if (ruleset_fd < 0) {
-                fprintf(stderr, "Error: failed to create a Landlock ruleset: %s\n",
+                fprintf(stderr, "%s: Error: failed to create Landlock ruleset "
+                                "(abi=%d fs=%llx): %s\n",
+                        __func__, ll_abi, attr.handled_access_fs,
                         strerror(errno));
         }
         return ruleset_fd;
@@ -116,6 +125,11 @@ static int ll_fs(const char *allowed_path, const __u64 allowed_access,
         if (ll_ruleset_fd == -1)
                 ll_ruleset_fd = ll_create_full_ruleset();
 
+        if (arg_debug) {
+                fprintf(stderr, "%s: Adding Landlock rule (abi=%d fs=%llx) for %s\n",
+                        caller, ll_abi, allowed_access, allowed_path);
+        }
+
         int error;
         int allowed_fd = open(allowed_path, O_PATH | O_CLOEXEC);
         if (allowed_fd < 0) {
@@ -132,8 +146,10 @@ static int ll_fs(const char *allowed_path, const __u64 allowed_access,
         error = landlock_add_rule(ll_ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
                                   &target, 0);
         if (error) {
-                fprintf(stderr, "Error: %s: failed to add Landlock rule for %s: %s\n",
-                        caller, allowed_path, strerror(errno));
+                fprintf(stderr, "Error: %s: failed to add Landlock rule "
+                                "(abi=%d fs=%llx) for %s: %s\n",
+                        caller, ll_abi, allowed_access, allowed_path,
+                        strerror(errno));
         }
         close(allowed_fd);
         return error;
@@ -228,10 +244,13 @@ int ll_basic_system(void) {
         return error;
 }
 
-int ll_restrict(__u32 flags) {
+int ll_restrict(uint32_t flags) {
         if (!ll_is_supported())
                 return 0;
 
+        if (arg_debug)
+                fprintf(stderr, "%s: Starting Landlock restrict\n", __func__);
+
         int (*fnc[])(const char *) = {
                 ll_read,
                 ll_write,
@@ -263,7 +282,7 @@ int ll_restrict(__u32 flags) {
                 goto out;
         }
         if (arg_debug)
-                printf("%s: Enforcing Landlock\n", __func__);
+                fprintf(stderr, "%s: Enforcing Landlock\n", __func__);
 out:
         close(ll_ruleset_fd);
         return error;