9 files changed, 27 insertions, 14 deletions

diff --git a/README b/README
index 08ccefc3b..1bf45250d 100644
--- a/README
+++ b/README
@@ -136,6 +136,7 @@ Anton Shestakov (https://github.com/antonv6)
         - add whitelist items for uim
         - allow /etc/vulkan in steam profile
         - allow ~/.cache/wine in lutris and wine profile
+        - support MangoHud in steam profile
 Antonio Russo (https://github.com/aerusso)
         - enumerate root directories in apparmor profile
         - fix join-or-start
@@ -520,6 +521,7 @@ Jan-Niclas (https://github.com/0x6a61)
         - fix Firefox 'Profile not found' - whitelist /run/user/xxx/firefox
 Jan Sonntag (https://github.com/jmetrius)
         - added OpenStego profile
+        - allow common access to EGL External platform configuration directory
 Jean Lucas (https://github.com/flacks)
         - fix Discord profile
         - add AnyDesk profile
diff --git a/RELNOTES b/RELNOTES
index 8fd438ad3..1d781fca9 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,5 +1,9 @@
 firejail (0.9.68rc2) baseline; urgency=low
   * work in progress
+  * security: on Ubuntu, the PPA is now recommended over the distro package
+    (see README.md) (#4748)
+  * security: bugfix: private-cwd leaks access to the entire filesystem
+    (#4780); reported by Hugo Osvaldo Barrera
   * exit code: distinguish fatal signals by adding 128 (#4533)
   * close file descriptors greater than 2 (--keep-fd) (#4845)
   * intrusion detection system (--ids-init, --ids-check)
@@ -7,7 +11,7 @@ firejail (0.9.68rc2) baseline; urgency=low
      --deterministic-shutdown) (#4635)
   * noprinters command (#4607 #4827)
   * network monitor (--nettrace)
-  * network locker (--netlock)
+  * network locker (--netlock) (#4848)
   * whitelist-ro profile command
   * AppImage support in --build command
   * build: firecfg.config is now installed to /etc/firejail/ (#4669)
@@ -15,10 +19,13 @@ firejail (0.9.68rc2) baseline; urgency=low
   * removed whitelist=yes/no in /etc/firejail/firejail.config
   * new condition: ALLOW_TRAY (#4510 #4599)
   * remove (some) environment variables with auth-tokens (#4157)
+  * bugfix: Fix sndio support (#4362 #4365)
   * bugfix: Error mounting tmpfs (MS_REMOUNT flag not being cleared) (#4387)
   * bugfix: --build clears the environment (#4460 #4467)
+  * bugfix: firejail hangs with net parameter (#3958 #4476)
   * bugfix: Firejail does not work with a custom hosts file (#2758 #4560)
   * bugfix: --tracelog and --trace override /etc/ld.so.preload (#4558 #4586)
+  * bugfix: PATH_MAX is undeclared on musl libc (#4578 #4579 #4583)
   * bugfix: Firejail rejects empty arguments (#4395)
   * bugfix: firecfg does not work with symlinks (discord.desktop) (#4235)
   * bugfix: Seccomp list output goes to stdout instead of stderr (#4328)
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 5a189559a..255da0fbd 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -286,6 +286,7 @@ blacklist ${HOME}/.config/LibreCAD
 blacklist ${HOME}/.config/Loop_Hero
 blacklist ${HOME}/.config/Luminance
 blacklist ${HOME}/.config/LyX
+blacklist ${HOME}/.config/MangoHud
 blacklist ${HOME}/.config/Mattermost
 blacklist ${HOME}/.config/Meltytech
 blacklist ${HOME}/.config/Mendeley Ltd.
diff --git a/etc/inc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc
index 0049ce804..b4e5ac5d9 100644
--- a/etc/inc/whitelist-usr-share-common.inc
+++ b/etc/inc/whitelist-usr-share-common.inc
@@ -12,6 +12,7 @@ whitelist /usr/share/cursors
 whitelist /usr/share/dconf
 whitelist /usr/share/distro-info
 whitelist /usr/share/drirc.d
+whitelist /usr/share/egl
 whitelist /usr/share/enchant
 whitelist /usr/share/enchant-2
 whitelist /usr/share/file
diff --git a/etc/profile-a-l/geeqie.profile b/etc/profile-a-l/geeqie.profile
index fbb509d89..b79a82c83 100644
--- a/etc/profile-a-l/geeqie.profile
+++ b/etc/profile-a-l/geeqie.profile
@@ -25,7 +25,8 @@ nosound
 notv
 nou2f
 novideo
-protocol unix
+# remove inet,inet6 to disable network access
+protocol unix,inet,inet6
 seccomp
 shell none
 
diff --git a/etc/profile-m-z/shellcheck.profile b/etc/profile-m-z/shellcheck.profile
index f2469048f..61fe534d6 100644
--- a/etc/profile-m-z/shellcheck.profile
+++ b/etc/profile-m-z/shellcheck.profile
@@ -50,5 +50,3 @@ private-tmp
 
 dbus-user none
 dbus-system none
-
-memory-deny-write-execute
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile
index b31818274..b0be8a517 100644
--- a/etc/profile-m-z/steam.profile
+++ b/etc/profile-m-z/steam.profile
@@ -8,6 +8,7 @@ include globals.local
 
 noblacklist ${HOME}/.config/Epic
 noblacklist ${HOME}/.config/Loop_Hero
+noblacklist ${HOME}/.config/MangoHud
 noblacklist ${HOME}/.config/ModTheSpire
 noblacklist ${HOME}/.config/RogueLegacy
 noblacklist ${HOME}/.config/RogueLegacyStorageContainer
@@ -55,6 +56,7 @@ include disable-programs.inc
 
 mkdir ${HOME}/.config/Epic
 mkdir ${HOME}/.config/Loop_Hero
+mkdir ${HOME}/.config/MangoHud
 mkdir ${HOME}/.config/ModTheSpire
 mkdir ${HOME}/.config/RogueLegacy
 mkdir ${HOME}/.config/unity3d
@@ -85,6 +87,7 @@ mkfile ${HOME}/.steampath
 mkfile ${HOME}/.steampid
 whitelist ${HOME}/.config/Epic
 whitelist ${HOME}/.config/Loop_Hero
+whitelist ${HOME}/.config/MangoHud
 whitelist ${HOME}/.config/ModTheSpire
 whitelist ${HOME}/.config/RogueLegacy
 whitelist ${HOME}/.config/RogueLegacyStorageContainer
@@ -162,3 +165,5 @@ private-tmp
 
 # dbus-user none
 # dbus-system none
+
+read-only ${HOME}/.config/MangoHud
diff --git a/src/fcopy/main.c b/src/fcopy/main.c
index 4be35e23f..c64d20127 100644
--- a/src/fcopy/main.c
+++ b/src/fcopy/main.c
@@ -402,15 +402,6 @@ static void duplicate_link(const char *src, const char *dest, struct stat *s) {
         gid_t gid = s->st_gid;
         mode_t mode = s->st_mode;
 
-        // NixOS problem #4887:
-        //      /etc/fonts is a double symlink to a directory - copy the files instead of copying the symlink
-        if (strcmp(src, "/etc/fonts") == 0) {
-                duplicate_dir(src, dest, s);
-                free(rsrc);
-                free(rdest);
-                return;
-        }
-
         // build destination file name
         char *name;
         //     char *ptr = strrchr(rsrc, '/');
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 786e0d360..deaee31bb 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -165,7 +165,14 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
                 errExit("asprintf");
 
         build_dirs(src, dst, strlen(private_dir), strlen(private_run_dir));
-        sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FCOPY, src, dst);
+
+        // follow links! this will make a copy of the file or directory pointed by the symlink
+        // this will solve problems such as NixOS #4887
+        // don't follow links to dynamic directories such as /proc
+        if (strcmp(src, "/etc/mtab") == 0)
+                sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FCOPY, src, dst);
+        else
+                sbox_run(SBOX_ROOT | SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", src, dst);
 
         free(dst);
         fs_logger2("clone", src);