11 files changed, 101 insertions, 6 deletions

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index dbc9929ca..5ee1cac9b 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -47,7 +47,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@2f58583a1b24a7d3c7034f6bf9fa506d23b1183b
+      uses: github/codeql-action/init@a3a6c128d771b6b9bdebb1c9d0583ebd2728a108
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -58,7 +58,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@2f58583a1b24a7d3c7034f6bf9fa506d23b1183b
+      uses: github/codeql-action/autobuild@a3a6c128d771b6b9bdebb1c9d0583ebd2728a108
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -72,4 +72,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@2f58583a1b24a7d3c7034f6bf9fa506d23b1183b
+      uses: github/codeql-action/analyze@a3a6c128d771b6b9bdebb1c9d0583ebd2728a108
diff --git a/README.md b/README.md
index 9b570d0bd..efcaf502d 100644
--- a/README.md
+++ b/README.md
@@ -233,6 +233,17 @@ Milestone page: https://github.com/netblue30/firejail/milestone/1
               $ firejail --oom=300 firefox
 `````
 
+### Guided configuration
+`````
+$ man firecfg
+[...]
+       --guide
+              Guided configuration for new users.
+
+              Example:
+              $ sudo firecfg --guide
+`````
+
 ### Profile Statistics
 
 A small tool to print profile statistics. Compile and install as usual. The tool is installed in /usr/lib/firejail directory.
diff --git a/configure b/configure
index 02c18e1b3..c7cc7cbee 100755
--- a/configure
+++ b/configure
@@ -658,6 +658,7 @@ PKG_CONFIG_LIBDIR
 PKG_CONFIG_PATH
 PKG_CONFIG
 HAVE_APPARMOR
+HAVE_IDS
 OBJEXT
 EXEEXT
 ac_ct_CC
@@ -709,6 +710,7 @@ ac_user_opts='
 enable_option_checking
 enable_analyzer
 enable_sanitizer
+enable_ids
 enable_apparmor
 enable_selinux
 enable_dbusproxy
@@ -1369,6 +1371,7 @@ Optional Features:
   --enable-analyzer       enable GCC static analyzer
   --enable-sanitizer=[address | memory | undefined]
                           enable a compiler-based sanitizer (debug)
+  --enable-ids            enable ids
   --enable-apparmor       enable apparmor
   --enable-selinux        SELinux labeling support
   --disable-dbusproxy     disable dbus proxy
@@ -3088,6 +3091,19 @@ fi
 
 fi
 
+HAVE_IDS=""
+
+# Check whether --enable-ids was given.
+if test "${enable_ids+set}" = set; then :
+  enableval=$enable_ids;
+fi
+
+if test "x$enable_ids" = "xyes"; then :
+
+        HAVE_IDS="-DHAVE_IDS"
+
+fi
+
 HAVE_APPARMOR=""
 
 # Check whether --enable-apparmor was given.
@@ -3639,6 +3655,7 @@ fi
 if test "x$enable_lts" = "xyes"; then :
 
         HAVE_LTS="-DHAVE_LTS"
+        HAVE_IDS=""
         HAVE_DBUSPROXY=""
         HAVE_OVERLAYFS=""
         HAVE_OUTPUT=""
@@ -5282,6 +5299,7 @@ Configuration options:
    allow tmpfs as regular user: $HAVE_USERTMPFS
    enable --ouput logging: $HAVE_OUTPUT
    Manpage support: $HAVE_MAN
+   IDS support: $HAVE_IDS
    firetunnel support: $HAVE_FIRETUNNEL
    busybox workaround: $BUSYBOX_WORKAROUND
    Spectre compiler patch: $HAVE_SPECTRE
diff --git a/configure.ac b/configure.ac
index 28e6b7837..8a9afe793 100644
--- a/configure.ac
+++ b/configure.ac
@@ -54,6 +54,14 @@ AS_IF([test "x$enable_sanitizer" != "xno" ],
         ], [AC_MSG_ERROR([sanitizer not supported: $enable_sanitizer])]
 )])
 
+HAVE_IDS=""
+AC_SUBST([HAVE_IDS])
+AC_ARG_ENABLE([ids],
+    [AS_HELP_STRING([--enable-ids], [enable ids])])
+AS_IF([test "x$enable_ids" = "xyes"], [
+        HAVE_IDS="-DHAVE_IDS"
+])
+
 HAVE_APPARMOR=""
 AC_SUBST([HAVE_APPARMOR])
 AC_ARG_ENABLE([apparmor],
@@ -249,6 +257,7 @@ AC_ARG_ENABLE([lts],
     [AS_HELP_STRING([--enable-lts], [enable long-term support software version (LTS)])])
 AS_IF([test "x$enable_lts" = "xyes"], [
         HAVE_LTS="-DHAVE_LTS"
+        HAVE_IDS=""
         HAVE_DBUSPROXY=""
         HAVE_OVERLAYFS=""
         HAVE_OUTPUT=""
@@ -300,6 +309,7 @@ Configuration options:
    allow tmpfs as regular user: $HAVE_USERTMPFS
    enable --ouput logging: $HAVE_OUTPUT
    Manpage support: $HAVE_MAN
+   IDS support: $HAVE_IDS
    firetunnel support: $HAVE_FIRETUNNEL
    busybox workaround: $BUSYBOX_WORKAROUND
    Spectre compiler patch: $HAVE_SPECTRE
diff --git a/etc/profile-a-l/git.profile b/etc/profile-a-l/git.profile
index b0318e4a3..4e71f0d5e 100644
--- a/etc/profile-a-l/git.profile
+++ b/etc/profile-a-l/git.profile
@@ -12,12 +12,19 @@ noblacklist ${HOME}/.config/nano
 noblacklist ${HOME}/.emacs
 noblacklist ${HOME}/.emacs.d
 noblacklist ${HOME}/.gitconfig
+noblacklist ${HOME}/.git-credential-cache
 noblacklist ${HOME}/.git-credentials
 noblacklist ${HOME}/.gnupg
 noblacklist ${HOME}/.nanorc
 noblacklist ${HOME}/.vim
 noblacklist ${HOME}/.viminfo
 
+# Allow environment variables (rmenv'ed by disable-common.inc)
+ignore rmenv GH_TOKEN
+ignore rmenv GITHUB_TOKEN
+ignore rmenv GH_ENTERPRISE_TOKEN
+ignore rmenv GITHUB_ENTERPRISE_TOKEN
+
 # Allow ssh (blacklisted by disable-common.inc)
 include allow-ssh.inc
 
diff --git a/src/common.mk.in b/src/common.mk.in
index 38c05bc69..64ed774ad 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -20,6 +20,7 @@ HAVE_APPARMOR=@HAVE_APPARMOR@
 HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
 HAVE_FIRETUNNEL=@HAVE_FIRETUNNEL@
 HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
+HAVE_IDS=@HAVE_IDS@
 HAVE_GCOV=@HAVE_GCOV@
 HAVE_SELINUX=@HAVE_SELINUX@
 HAVE_SUID=@HAVE_SUID@
@@ -38,7 +39,7 @@ BINOBJS =  $(foreach file, $(OBJS), $file)
 CFLAGS = @CFLAGS@
 CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
 CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"'   -DVARDIR='"/var/lib/firejail"'
-MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
+MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
 CFLAGS += $(MANFLAGS)
 CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security
 LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 8f8f5b6c3..e1acaf632 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -365,6 +365,14 @@ void print_compiletime_support(void) {
 #endif
                 );
 
+        printf("\t- IDS support is %s\n",
+#ifdef HAVE_IDS
+                "enabled"
+#else
+                "disabled"
+#endif
+                );
+
         printf("\t- networking support is %s\n",
 #ifdef HAVE_NETWORK
                 "enabled"
@@ -427,6 +435,4 @@ void print_compiletime_support(void) {
                 "disabled"
 #endif
                 );
-
-
 }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 1bcec667e..cbf9df79f 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1090,8 +1090,17 @@ int main(int argc, char **argv, char **envp) {
                 run_builder(argc, argv); // this function will not return
 
         // intrusion detection system
+#ifdef HAVE_IDS
         if (check_arg(argc, argv, "--ids-", 0)) // supports both --ids-init and --ids-check
                 run_ids(argc, argv); // this function will not return
+#else
+        if (check_arg(argc, argv, "--ids-", 0)) { // supports both --ids-init and --ids-check
+                fprintf(stderr, "Error: IDS features disabled in your Firejail build.\n"
+                        "\tTo enable it, configure your build system using --enable-ids.\n"
+                        "\tExample: ./configure --prefix=/usr --enable-ids\n\n");
+                exit(1);
+        }
+#endif
 
         EUID_ROOT();
 #ifndef HAVE_SUID
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt
index 189e9cc8d..280a4aff1 100644
--- a/src/man/firecfg.txt
+++ b/src/man/firecfg.txt
@@ -82,6 +82,16 @@ a long time ago, and the introduction of PID namespace in Linux kernel breaks th
 reportedly fixed in PulseAudio version 9. If you have sound problems on your system, run
 "firecfg --fix-sound" command in a terminal, followed by logout/login in order to apply the changes.
 .TP
+\fB\-\-guide
+Guided configuration for new users.
+.br
+
+.br
+Example:
+.br
+$ sudo firecfg --guide
+.br
+.TP
 \fB\-\-debug
 Print debug messages.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 366a4e061..420a96ab5 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -820,6 +820,7 @@ Example:
 .br
 $ firejail \-\-hosts-file=~/myhosts firefox
 
+#ifdef HAVE_IDS
 .TP
 \fB\-\-ids-check
 Check file hashes previously generated by \-\-ids-check. See INTRUSION DETECTION SYSTEM section for more details.
@@ -839,6 +840,7 @@ Initialize file hashes. See INTRUSION DETECTION SYSTEM section for more details.
 Example:
 .br
 $ firejail \-\-ids-init
+#endif
 
 .TP
 \fB\-\-ignore=command
@@ -3342,6 +3344,7 @@ $ firejail \-\-cat=mybrowser ~/.bashrc
 .br
 #endif
 
+#ifdef HAVE_IDS
 .SH INTRUSION DETECTION SYSTEM (IDS)
 The host-based intrusion detection system tracks down and audits user and system file modifications.
 The feature is configured using /etc/firejail/ids.config file, the checksums are stored in /var/lib/firejail/USERNAME.ids,
@@ -3399,6 +3402,7 @@ New files and deleted files are also flagged.
 
 Currently while scanning the file system, symbolic links are not followed, and files the user doesn't have read access to are silently dropped.
 The program can also be run as root (sudo firejail --ids-init/--ids-check).
+#endif
 
 .SH MONITORING
 Option \-\-list prints a list of all sandboxes. The format
diff --git a/test/compile/compile.sh b/test/compile/compile.sh
index 0a87913f1..6b994ba70 100755
--- a/test/compile/compile.sh
+++ b/test/compile/compile.sh
@@ -31,6 +31,7 @@ arr[15]="TEST 15: compile private-home disabled"
 arr[16]="TEST 16: compile disable manpages"
 arr[17]="TEST 17: disable tmpfs as regular user"
 arr[18]="TEST 18: disable private home"
+arr[18]="TEST 19: enable ids"
 
 # remove previous reports and output file
 cleanup() {
@@ -380,6 +381,23 @@ cp output-make om18
 rm output-configure output-make
 
 #*****************************************************************
+# TEST 19
+#*****************************************************************
+# - enable ids
+#*****************************************************************
+print_title "${arr[19]}"
+cd firejail
+make distclean
+./configure --prefix=/usr --enable-ids --enable-fatal-warnings 2>&1 | tee ../output-configure
+make -j4 2>&1 | tee ../output-make
+cd ..
+grep Warning output-configure output-make > ./report-test19
+grep Error output-configure output-make >> ./report-test19
+cp output-configure oc19
+cp output-make om19
+rm output-configure output-make
+
+#*****************************************************************
 # PRINT REPORTS
 #*****************************************************************
 echo
@@ -411,3 +429,4 @@ echo ${arr[15]}
 echo ${arr[16]}
 echo ${arr[17]}
 echo ${arr[18]}
+echo ${arr[19]}