12 files changed, 438 insertions, 139 deletions

diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
index 4f5fc5049..27f11459c 100644
--- a/.github/workflows/build-extra.yml
+++ b/.github/workflows/build-extra.yml
@@ -30,7 +30,7 @@ jobs:
   build-clang:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: configure
       run: CC=clang-11 ./configure --enable-fatal-warnings
     - name: make
@@ -38,7 +38,7 @@ jobs:
   scan-build:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: install clang-tools-11
       run: sudo apt-get install clang-tools-11
     - name: configure
@@ -48,7 +48,7 @@ jobs:
   cppcheck:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: install cppcheck
       run: sudo apt-get install cppcheck
     - name: cppcheck
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4d54b5178..faea6970f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,7 +22,9 @@ jobs:
   build_and_test:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
+    - name: update package information
+      run: sudo apt-get update
     - name: install dependencies
       run: sudo apt-get install gcc-11 libapparmor-dev libselinux1-dev expect xzdec
     - name: configure
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 69fc8834b..95f00a34e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -43,7 +43,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
+      uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/profile-checks.yml
index 59997db2f..9138e8a57 100644
--- a/.github/workflows/profile-checks.yml
+++ b/.github/workflows/profile-checks.yml
@@ -20,7 +20,7 @@ jobs:
   profile-checks:
     runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
+    - uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b
     - name: sort.py
       run: ./ci/check/profiles/sort.py etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile
     - name: private-etc-always-required.sh
diff --git a/Makefile.in b/Makefile.in
index 9b1ecc4ad..945e30e84 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -27,7 +27,7 @@ COMPLETIONDIRS = src/zsh_completion src/bash_completion
 all: all_items mydirs $(MAN_TARGET) filters
 APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats src/jailcheck/jailcheck
 SBOX_APPS = src/fbuilder/fbuilder src/ftee/ftee src/fids/fids
-SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter
+SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter src/fzenity/fzenity
 SBOX_APPS_NON_DUMPABLE += src/fsec-optimize/fsec-optimize src/fsec-print/fsec-print src/fseccomp/fseccomp
 SBOX_APPS_NON_DUMPABLE += src/fnettrace/fnettrace src/fnettrace-dns/fnettrace-dns src/fnettrace-sni/fnettrace-sni
 MYDIRS = src/lib $(MAN_SRC) $(COMPLETIONDIRS)
@@ -118,6 +118,7 @@ endif
         install -m 0755 src/jailcheck/jailcheck $(DESTDIR)$(bindir)
         # libraries and plugins
         install -m 0755 -d $(DESTDIR)$(libdir)/firejail
+        install -m 0755 -t $(DESTDIR)$(libdir)/firejail src/firecfg/firejail-welcome.sh
         install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS)
         install -m 0755 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS)
         install -m 0755 -t $(DESTDIR)$(libdir)/firejail src/profstats/profstats
diff --git a/configure b/configure
index f0a678473..91d247e65 100755
--- a/configure
+++ b/configure
@@ -4288,7 +4288,7 @@ fi
 
 ac_config_files="$ac_config_files mkdeb.sh"
 
-ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile"
+ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/fzenity/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile"
 
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -5016,6 +5016,7 @@ do
     "src/fldd/Makefile") CONFIG_FILES="$CONFIG_FILES src/fldd/Makefile" ;;
     "src/libpostexecseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/libpostexecseccomp/Makefile" ;;
     "src/fsec-optimize/Makefile") CONFIG_FILES="$CONFIG_FILES src/fsec-optimize/Makefile" ;;
+    "src/fzenity/Makefile") CONFIG_FILES="$CONFIG_FILES src/fzenity/Makefile" ;;
     "src/profstats/Makefile") CONFIG_FILES="$CONFIG_FILES src/profstats/Makefile" ;;
     "src/man/Makefile") CONFIG_FILES="$CONFIG_FILES src/man/Makefile" ;;
     "src/zsh_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/zsh_completion/Makefile" ;;
diff --git a/configure.ac b/configure.ac
index 071dea228..4066618e0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -279,7 +279,7 @@ AC_CONFIG_FILES([mkdeb.sh], [chmod +x mkdeb.sh])
 AC_CONFIG_FILES([Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile \
 src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \
 src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile \
-src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile \
+src/fzenity/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile \
 src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile])
 AC_OUTPUT
 
diff --git a/contrib/firejail-welcome.sh b/contrib/firejail-welcome.sh
deleted file mode 100755
index c9b6c450b..000000000
--- a/contrib/firejail-welcome.sh
+++ /dev/null
@@ -1,128 +0,0 @@
-#!/bin/bash
-
-# This file is part of Firejail project
-# Copyright (C) 2020-2022 Firejail Authors
-# License GPL v2
-
-if ! command -v zenity >/dev/null; then
-        echo "Please install zenity."
-        exit 1
-fi
-if ! command -v sudo >/dev/null; then
-        echo "Please install sudo."
-        exit 1
-fi
-
-export LANG=en_US.UTF8
-
-zenity --title=firejail-welcome.sh --text-info --width=750 --height=500 <<EOM
-Welcome to firejail!
-
-This is a quick setup guide for newbies.
-
-Profiles for programs can be found in /etc/firejail. Own customizations should go in a file named
-<profile-name>.local in ~/.config/firejal.
-
-Firejail's own configuration can be found at /etc/firejail/firejail.config.
-
-Please note that running this script a second time can set new options, but does not unset options
-set in a previous run.
-
-Website: https://firejail.wordpress.com
-Bug-Tracker: https://github.com/netblue30/firejail/issues
-Documentation:
-- https://github.com/netblue30/firejail/wiki
-- https://github.com/netblue30/firejail/wiki/Frequently-Asked-Questions
-- https://firejail.wordpress.com/documentation-2
-- man:firejail(1) and man:firejail-profile(5)
-
-PS: If you have any improvements for this script, open an issue or pull request.
-EOM
-[[ $? -eq 1 ]] && exit 0
-
-sed_scripts=()
-
-read -r -d $'\0' MSG_Q_BROWSER_DISABLE_U2F <<EOM
-<big><b>Should browsers be allowed to access u2f hardware?</b></big>
-EOM
-
-read -r -d $'\0' MSG_Q_BROWSER_ALLOW_DRM <<EOM
-<big><b>Should browsers be able to play DRM content?</b></big>
-
-\$HOME is noexec,nodev,nosuid by default for the most sandboxes. This means that executing programs which are located in \$HOME,
-is forbidden, the setuid attribute on files is ignored and device files inside \$HOME don't work. Browsers install proprietary
-DRM plug-ins such as Widevine under \$HOME by default. In order to use them, \$HOME must be mounted exec inside the sandbox to
-allow their execution. Clearly, this may help an attacker to start malicious code.
-
-NOTE: Other software written in an interpreter language such as bash, python or java can always be started from \$HOME.
-
-HINT: If <tt>/home</tt> has its own partition, you can mount it <tt>nodev,nosuid</tt> for all programs.
-EOM
-
-read -r -d $'\0' MSG_L_ADVANCED_OPTIONS <<EOM
-You maybe want to set some of these advanced options.
-EOM
-
-read -r -d $'\0' MSG_Q_RUN_FIRECFG <<EOM
-<big><b>Should most programs be started in firejail by default?</b></big>
-EOM
-
-read -r -d $'\0' MSG_I_ROOT_REQUIRED <<EOM
-In order to apply these changes, root privileges are required.
-You will now be asked to enter your password.
-EOM
-
-read -r -d $'\0' MSG_I_FINISH <<EOM
-🥳
-EOM
-
-if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_BROWSER_DISABLE_U2F"; then
-        sed_scripts+=("-e s/# browser-disable-u2f yes/browser-disable-u2f no/")
-fi
-
-if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_BROWSER_ALLOW_DRM"; then
-        sed_scripts+=("-e s/# browser-allow-drm no/browser-allow-drm yes/")
-fi
-
-advanced_options=$(zenity --title=firejail-welcome.sh --list --width=800 --height=200 \
-        --text="$MSG_L_ADVANCED_OPTIONS" --multiple --checklist --separator=" " \
-        --column="" --column=Option --column=Description <<EOM
-
-force-nonewprivs
-Always set nonewprivs, this is a strong mitigation against exploits in firejail. However some programs like chromium or wireshark maybe don't work anymore.
-
-restricted-network
-Restrict all network related commands except 'net none' to root only.
-
-seccomp-error-action=kill
-Kill programs which violate seccomp rules (default: return a error).
-EOM
-)
-
-if [[ $advanced_options == *force-nonewprivs* ]]; then
-        sed_scripts+=("-e s/# force-nonewprivs no/force-nonewprivs yes/")
-fi
-if [[ $advanced_options == *restricted-network* ]]; then
-        sed_scripts+=("-e s/# restricted-network no/restricted-network yes/")
-fi
-if [[ $advanced_options == *seccomp-error-action=kill* ]]; then
-        sed_scripts+=("-e s/# seccomp-error-action EPERM/seccomp-error-action kill/")
-fi
-
-if zenity --title=firejail-welcome.sh --question --ellipsize --text="$MSG_Q_RUN_FIRECFG"; then
-        run_firecfg=true
-fi
-
-zenity --title=firejail-welcome.sh --info --ellipsize --text="$MSG_I_ROOT_REQUIRED"
-
-passwd=$(zenity --title=firejail-welcome.sh --password --cancel-label=OK)
-if [[ -n "${sed_scripts[*]}" ]]; then
-        sudo -S -p "" -- sed -i "${sed_scripts[@]}" /etc/firejail/firejail.config <<<"$passwd" || { zenity --title=firejail-welcome.sh --error; exit 1; };
-fi
-if [[ "$run_firecfg" == "true" ]]; then
-        sudo -S -p "" -- firecfg <<<"$passwd" || { zenity --title=firejail-welcome.sh --error; exit 1; };
-fi
-sudo -k
-unset passwd
-
-zenity --title=firejail-welcome.sh --info --icon-name=security-medium-symbolic --text="$MSG_I_FINISH"
diff --git a/src/firecfg/firejail-welcome.sh b/src/firecfg/firejail-welcome.sh
new file mode 100755
index 000000000..a7e74ebc3
--- /dev/null
+++ b/src/firecfg/firejail-welcome.sh
@@ -0,0 +1,204 @@
+#!/bin/bash
+
+# This file is part of Firejail project
+# Copyright (C) 2020-2022 Firejail Authors
+# License GPL v2
+#
+# Usage: firejail-welcome PROGRAM SYSCONFDIR USER_NAME
+# where PROGRAM is detected and driven by firecfg.
+# SYSCONFDIR is most of the time /etc/firejail.
+#
+# The plan is to go with zenity by default. If zenity is not installed
+# we will provide a console-only replacement in /usr/lib/firejail/fzenity
+#
+
+if ! command -v "$1" >/dev/null; then
+        echo "Please install $1."
+        exit 1
+fi
+
+PROGRAM="sudo -u $3 $1"
+SYSCONFDIR=$2
+export LANG=en_US.UTF8
+
+TITLE="Firejail Configuration Guide"
+sed_scripts=()
+run_firecfg=false
+enable_u2f=false
+enable_drm=false
+enable_seccomp_kill=false
+enable_restricted_net=false
+enable_nonewprivs=false
+
+#******************************************************
+# Intro
+#******************************************************
+read -r -d $'\0' MSG_INTRO <<EOM
+<big><b>Welcome to Firejail!</b></big>
+
+This guide will walk you through some of the most common sandbox customizations.
+At the end of the guide you'll have the option to save your changes in Firejail's
+global config file at <b>/etc/firejail/firejail.config</b>. A copy of the original file is saved
+as <b>/etc/firejal/firejail.config-</b>.
+
+Please note that running this script a second time can set new options, but does
+not clear options set in a previous run.
+
+Press OK to continue, or close this window to stop the program.
+
+EOM
+$PROGRAM --title="$TITLE" --info --width=600 --height=40 --text="$MSG_INTRO"
+[[ $? -eq 1 ]] && exit 0
+
+#******************************************************
+# symlinks
+#******************************************************
+read -r -d $'\0' MSG_Q_RUN_FIRECFG <<EOM
+<big><b>Should most programs be sandboxed by default?</b></big>
+
+Currently, Firejail recognizes more than 1000 regular desktop programs. These programs
+can be sandboxed automatically when you start them.
+
+EOM
+
+if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_RUN_FIRECFG"; then
+        run_firecfg=true
+fi
+
+#******************************************************
+# U2F
+#******************************************************
+read -r -d $'\0' MSG_Q_BROWSER_DISABLE_U2F <<EOM
+<big><b>Should browsers be allowed to access u2f hardware?</b></big>
+
+Universal Two-Factor (U2F) devices are used as a password store for online
+accounts. These devices usually come in a form of a USB key.
+
+EOM
+
+if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_BROWSER_DISABLE_U2F"; then
+        enable_u2f=true
+        sed_scripts+=("-e s/# browser-disable-u2f yes/browser-disable-u2f no/")
+fi
+
+#******************************************************
+# DRM
+#******************************************************
+read -r -d $'\0' MSG_Q_BROWSER_ALLOW_DRM <<EOM
+<big><b>Should browsers be able to play DRM content?</b></big>
+
+The home directory is <tt>noexec,nodev,nosuid</tt> by default for most applications.
+This means that executing programs located in your home directory is forbidden.
+
+Browsers install proprietary DRM plug-ins such as Widevine in your home directory.
+In order to use them, your home must be mounted <tt>exec</tt> inside the sandbox. This
+may give the people developing and distributing the plug-in access to your private
+data.
+
+NOTE: Software written in an interpreted language such as bash, python or java can
+always be started from home directory.
+
+HINT: If <tt>/home</tt> has its own partition, you can mount it <tt>nodev,nosuid</tt> for all programs.
+
+EOM
+
+if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_BROWSER_ALLOW_DRM"; then
+        enable_drm=true
+        sed_scripts+=("-e s/# browser-allow-drm no/browser-allow-drm yes/")
+fi
+
+#******************************************************
+# nonewprivs
+#******************************************************
+read -r -d $'\0' MSG_Q_NONEWPRIVS <<EOM
+<big><b>Should we force nonweprivs by default?</b></big>
+
+nonewprivs is a Linux kernel feature that prevents programs from rising privileges.
+It is also a strong mitigation against exploits in Firejail. However, some programs
+like chromium, wireshark, or even ping might not work.
+
+NOTE: seccomp enables nonewprivs automatically. Most applications supported by
+default by Firejail are using seccomp.
+
+EOM
+
+if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_NONEWPRIVS"; then
+        enable_nonewprivs=true
+        sed_scripts+=("-e s/# force-nonewprivs no/force-nonewprivs yes/")
+fi
+
+#******************************************************
+# restricted network
+#******************************************************
+read -r -d $'\0' MSG_Q_NETWORK <<EOM
+<big><b>Should we restrict network functionality?</b></big>
+
+Restrict all network related commands except '<tt>net none</tt>' to root only.
+
+EOM
+
+if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_NETWORK"; then
+        enable_restricted_net=true
+        sed_scripts+=("-e s/# restricted-network no/restricted-network yes/")
+fi
+
+#******************************************************
+# seccomp kill
+#******************************************************
+read -r -d $'\0' MSG_Q_SECCOMP <<EOM
+<big><b>Should we kill programs that violate seccomp rules?</b></big>
+
+By default seccomp prevents the program from running the syscall and returns an error.
+
+EOM
+
+if $PROGRAM --title="$TITLE" --question --ellipsize --text="$MSG_Q_SECCOMP"; then
+        enable_seccomp_kill=true
+        sed_scripts+=("-e s/# seccomp-error-action EPERM/seccomp-error-action kill/")
+fi
+
+#******************************************************
+# root
+#******************************************************
+read -r -d $'\0' MSG_RUN <<EOM
+Now, I will apply the changes. This is what I will do:
+
+
+EOM
+MSG_RUN+="\n\n"
+if [[ "$run_firecfg" == "true" ]]; then
+        MSG_RUN+="     * enable Firejail for all recognized programs\n"
+fi
+if [[ "$enable_u2f" == "true" ]]; then
+        MSG_RUN+="     * allow browsers to access U2F devices\n"
+fi
+if [[ "$enable_drm" == "true" ]]; then
+        MSG_RUN+="     * allow browsers to play DRM content\n"
+fi
+if [[ "$enable_nonewprivs" == "true" ]]; then
+        MSG_RUN+="     * enable nonewprivs globally\n"
+fi
+if [[ "$enable_restricted_net" == "true" ]]; then
+        MSG_RUN+="     * restrict networking features\n"
+fi
+if [[ "$enable_seccomp_kill" == "true" ]]; then
+        MSG_RUN+="     * enable seccomp kill\n"
+fi
+MSG_RUN+="\n\nPress OK to continue, or close this window to stop the program."
+
+$PROGRAM --title="$TITLE" --info --width=600 --height=40 --text="$MSG_RUN"
+[[ $? -eq 1 ]] && exit 0
+
+if [[ -n "${sed_scripts[*]}" ]]; then
+        cp "$SYSCONFDIR"/firejail.config "$SYSCONFDIR"/firejail.config-
+        sed -i "${sed_scripts[@]}" "$SYSCONFDIR"/firejail.config
+fi
+if [[ "$run_firecfg" == "true" ]]; then
+        # return 55 to inform firecfg symlinks are desired
+        exit 55
+fi
+
+#******************************************************
+# all done
+#******************************************************
+exit 0
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index 2f346fecd..07e30415b 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -22,6 +22,7 @@
 #include "../include/firejail_user.h"
 int arg_debug = 0;
 char *arg_bindir = "/usr/local/bin";
+int arg_guide = 0;
 
 static char *usage_str =
         "Firecfg is the desktop configuration utility for Firejail software. The utility\n"
@@ -37,6 +38,7 @@ static char *usage_str =
         "   --debug - print debug messages.\n\n"
         "   --fix - fix .desktop files.\n\n"
         "   --fix-sound - create ~/.config/pulse/client.conf file.\n\n"
+        "   --guide - guided configuration for new users.\n\n"
         "   --help, -? - this help screen.\n\n"
         "   --list - list all firejail symbolic links.\n\n"
         "   --version - print program version and exit.\n\n"
@@ -373,6 +375,9 @@ int main(int argc, char **argv) {
                         fix_desktop_files(home);
                         return 0;
                 }
+                else if (strcmp(argv[i], "--guide") == 0) {
+                        arg_guide = 1;
+                }
                 else if (strcmp(argv[i], "--list") == 0) {
                         list();
                         return 0;
@@ -437,6 +442,29 @@ int main(int argc, char **argv) {
                 umask(orig_umask);
         }
 
+        if (arg_guide) {
+                char *cmd;
+if (arg_debug) {
+                if (asprintf(&cmd, "sudo %s/firejail/firejail-welcome.sh /usr/lib/firejail/fzenity %s %s", LIBDIR, SYSCONFDIR, user) == -1)
+                        errExit("asprintf");
+}
+else {
+                if (asprintf(&cmd, "sudo %s/firejail/firejail-welcome.sh /usr/bin/zenity %s %s", LIBDIR, SYSCONFDIR, user) == -1)
+                        errExit("asprintf");
+}
+                int status = system(cmd);
+                if (status == -1) {
+                        fprintf(stderr, "Error: cannot run firejail-welcome.sh\n");
+                        exit(1);
+                }
+                free(cmd);
+
+                // the last 8 bits of the status is the return value of the command executed by system()
+                // firejail-welcome.sh returns 55 if setting sysmlinks is required
+                if (WEXITSTATUS(status)  != 55)
+                        return 0;
+        }
+
         // clear all symlinks
         clean();
 
@@ -468,8 +496,6 @@ int main(int argc, char **argv) {
 #endif
         }
 
-
-
         // set new symlinks based on ~/.config/firejail directory
         set_links_homedir(home);
 
diff --git a/src/fzenity/Makefile.in b/src/fzenity/Makefile.in
new file mode 100644
index 000000000..d9f976165
--- /dev/null
+++ b/src/fzenity/Makefile.in
@@ -0,0 +1,17 @@
+.PHONY: all
+all: fzenity
+
+include ../common.mk
+
+%.o : %.c $(H_FILE_LIST) ../include/common.h
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+
+fzenity: $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+
+.PHONY: clean
+clean:; rm -fr *.o fzenity *.gcov *.gcda *.gcno *.plist
+
+.PHONY: distclean
+distclean: clean
+        rm -fr Makefile
diff --git a/src/fzenity/main.c b/src/fzenity/main.c
new file mode 100644
index 000000000..4a0d3abac
--- /dev/null
+++ b/src/fzenity/main.c
@@ -0,0 +1,176 @@
+#include "../include/common.h"
+#include <sys/ioctl.h>
+
+static char *arg_title = NULL;
+static char *arg_text = NULL;
+static int arg_info = 0;
+static int arg_question = 0;
+
+static inline void ansi_topleft(void) {
+        char str[] = {0x1b, '[', '1', ';',  '1', 'H', '\0'};
+        printf("%s", str);
+        fflush(0);
+}
+
+static inline void ansi_clrscr(void) {
+        ansi_topleft();
+        char str[] = {0x1b, '[', '0', 'J', '\0'};
+        printf("%s", str);
+        fflush(0);
+}
+
+char *remove_markup(char *in) {
+        char *out = malloc(strlen(in) + 1);
+        if (!out)
+                errExit("malloc");
+        memset(out, 0, strlen(in) + 1);
+
+        char *ptr = in;
+        char *outptr = out;
+        while (*ptr != '\0') {
+                // skip <> markup
+                if (*ptr == '<') {
+                        while (*ptr != '\0' && *ptr != '>')
+                                ptr++;
+                        if (*ptr == '\0') {
+                                fprintf(stderr, "Error: invalid markup\n");
+                                exit(0);
+                        }
+                        ptr++;
+                }
+                // replace literal \n with char '\n'
+                else if (*ptr == '\\' && *(ptr + 1) == 'n') {
+                        ptr += 2;
+                        *outptr++ = '\n';
+                        continue;
+                }
+                // replace '/n' with ' '
+                else if (*ptr == '\n') {
+                        if (*(ptr + 1) == '\n') {
+                                *outptr++ = '\n';
+                                *outptr++ = '\n';
+                                ptr += 2;
+                        }
+                        else {
+                                *outptr++ = ' ';
+                                ptr++;
+                        }
+                }
+                else
+                        *outptr++ = *ptr++;
+        }
+
+        return out;
+}
+
+char *print_line(char *in, int col) {
+        char *ptr = in;
+        int i = 0;
+        while (*ptr !=  '\n' && *ptr != '\0' && i < col) {
+                ptr++;
+                i++;
+        }
+
+        if (*ptr == '\n') {
+                *ptr++ = '\0';
+                printf("%s\n", in);
+                return ptr++;
+        }
+        else if (i == col) {
+                while (*ptr != ' ' && ptr != in)
+                        ptr--;
+                *ptr++ = '\0';
+                printf("%s\n", in);
+                return ptr;
+        }
+        assert(0);
+        return NULL;
+}
+
+void paginate(char *in) {
+        struct winsize w;
+        int col = 80;
+        if (ioctl(0, TIOCGWINSZ, &w) == 0)
+                col = w.ws_col;
+
+        char *ptr = in;
+        while (*ptr != '\0') {
+                if (strlen(ptr) < col) {
+                        printf("%s", ptr);
+                        return;
+                }
+                ptr =print_line(ptr, col);
+        }
+
+        return;
+}
+
+static void info(void) {
+        ansi_clrscr();
+        if (arg_text == NULL) {
+                fprintf(stderr, "Error: --text argument required\n");
+                exit(1);
+        }
+
+        if (arg_title)
+                printf("%s\n\n", arg_title);
+
+        char *ptr = strstr(arg_text, "Press OK to continue");
+        if (ptr)
+                *ptr = '\0';
+        char *out = remove_markup(arg_text);
+        paginate(out);
+        free(out);
+
+        printf("\nContinue? (Y/N): ");
+
+        int c = getchar();
+        if (c == 'y' || c == 'Y')
+                exit(0);
+        exit(1);
+}
+
+static void question(void) {
+        ansi_clrscr();
+        if (arg_text == NULL) {
+                fprintf(stderr, "Error: --text argument required\n");
+                exit(1);
+        }
+
+        if (arg_title)
+                printf("%s\n\n", arg_title);
+
+        char *ptr = strstr(arg_text, "Press OK to continue");
+        if (ptr)
+                *ptr = '\0';
+        char *out = remove_markup(arg_text);
+        paginate(out);
+        free(out);
+
+        printf("\n\n(Y/N): ");
+
+        int c = getchar();
+        if (c == 'y' || c == 'Y')
+                exit(0);
+        exit(1);
+}
+
+int main(int argc, char **argv) {
+        int i;
+        for (i = 1; i < argc; i++) {
+//printf("argv %d: #%s#\n", i, argv[i]);
+                if (strcmp(argv[i], "--info") == 0)
+                        arg_info = 1;
+                else if (strcmp(argv[i], "--question") == 0)
+                        arg_question = 1;
+                else if (strncmp(argv[i], "--text=", 7) == 0)
+                        arg_text = argv[i] + 7;
+        }
+
+        if (arg_question)
+                question();
+        else if (arg_info)
+                info();
+
+        return 0;
+}