39 files changed, 267 insertions, 140 deletions

diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
index 6c2905e43..918c879ad 100644
--- a/.github/workflows/build-extra.yml
+++ b/.github/workflows/build-extra.yml
@@ -41,9 +41,10 @@ permissions:  # added using https://github.com/step-security/secure-workflows
 jobs:
   build-clang:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ae1aef039..df706c898 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -57,9 +57,10 @@ permissions:  # added using https://github.com/step-security/secure-workflows
 jobs:
   build:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml
index 16e034d48..b1bda3bd4 100644
--- a/.github/workflows/check-c.yml
+++ b/.github/workflows/check-c.yml
@@ -43,9 +43,10 @@ permissions:  # added using https://github.com/step-security/secure-workflows
 jobs:
   scan-build:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -74,9 +75,10 @@ jobs:
 
   cppcheck:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -101,9 +103,10 @@ jobs:
   # scan all files also with older cppcheck version from ubuntu 20.04.
   cppcheck_old:
     runs-on: ubuntu-20.04
+    timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -129,10 +132,11 @@ jobs:
       contents: read
       security-events: write
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         disable-sudo: true
         egress-policy: block
@@ -150,7 +154,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b7bf0a3ed3ecfa44160715d7c442788f65f0f923
+      uses: github/codeql-action/init@e8893c57a1f3a2b659b6b55564fdfdbbd2982911
       with:
         languages: cpp
 
@@ -161,4 +165,4 @@ jobs:
       run: make -j "$(nproc)"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b7bf0a3ed3ecfa44160715d7c442788f65f0f923
+      uses: github/codeql-action/analyze@e8893c57a1f3a2b659b6b55564fdfdbbd2982911
diff --git a/.github/workflows/check-profiles.yml b/.github/workflows/check-profiles.yml
index 0185376a4..b116c9773 100644
--- a/.github/workflows/check-profiles.yml
+++ b/.github/workflows/check-profiles.yml
@@ -29,9 +29,11 @@ permissions:  # added using https://github.com/step-security/secure-workflows
 jobs:
   profile-checks:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         disable-sudo: true
         egress-policy: block
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml
index 76eaa584e..2442ae2a0 100644
--- a/.github/workflows/check-python.yml
+++ b/.github/workflows/check-python.yml
@@ -27,10 +27,11 @@ jobs:
       contents: read
       security-events: write
     runs-on: ubuntu-latest
+    timeout-minutes: 10
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         disable-sudo: true
         egress-policy: block
@@ -50,9 +51,9 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@b7bf0a3ed3ecfa44160715d7c442788f65f0f923
+      uses: github/codeql-action/init@e8893c57a1f3a2b659b6b55564fdfdbbd2982911
       with:
         languages: python
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@b7bf0a3ed3ecfa44160715d7c442788f65f0f923
+      uses: github/codeql-action/analyze@e8893c57a1f3a2b659b6b55564fdfdbbd2982911
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index f3c512c3e..32287ee09 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -21,9 +21,10 @@ permissions:  # added using https://github.com/step-security/secure-workflows
 jobs:
   codespell:
     runs-on: ubuntu-22.04
+    timeout-minutes: 5
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0a6069a5c..c76401022 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -49,11 +49,12 @@ permissions:  # added using https://github.com/step-security/secure-workflows
 jobs:
   test-main:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     env:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -96,11 +97,12 @@ jobs:
 
   test-fs:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     env:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -134,11 +136,12 @@ jobs:
 
   test-environment:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     env:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -172,11 +175,12 @@ jobs:
 
   test-utils:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     env:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -212,11 +216,12 @@ jobs:
 
   test-network:
     runs-on: ubuntu-22.04
+    timeout-minutes: 10
     env:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895
+      uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.gitignore b/.gitignore
index 3413abd55..5e126990f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,6 +5,7 @@
 *.swp
 *.deb
 *.rpm
+*.tar.xz
 *.gcda
 *.gcno
 *.gz
@@ -20,7 +21,6 @@ config.status
 contrib/syntax/files/example
 contrib/syntax/files/firejail-profile.lang
 contrib/syntax/files/firejail.vim
-firejail-*.tar.xz
 src/fnettrace-dns/fnettrace-dns
 src/fnettrace-sni/fnettrace-sni
 src/fnettrace-icmp/fnettrace-icmp
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index cb88c0263..33835ba71 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -8,6 +8,7 @@
 
 build_ubuntu_package:
     image: ubuntu:rolling
+    timeout: 10 minutes
     variables:
         DEBIAN_FRONTEND: noninteractive
     script:
@@ -24,6 +25,7 @@ build_ubuntu_package:
 
 build_debian_package:
     image: debian:buster
+    timeout: 10 minutes
     variables:
         DEBIAN_FRONTEND: noninteractive
     script:
@@ -40,28 +42,31 @@ build_debian_package:
 
 build_redhat_package:
     image: almalinux:latest
+    timeout: 10 minutes
     script:
         - dnf update -y
         - dnf install -y rpm-build gcc make
         - ./ci/printenv.sh
-        - ./configure --prefix=/usr || (cat config.log; exit 1)
+        - ./configure || (cat config.log; exit 1)
         - make rpms
         - rpm -i firejail*.rpm
         - command -V firejail && firejail --version
 
 build_fedora_package:
     image: fedora:latest
+    timeout: 10 minutes
     script:
         - dnf update -y
         - dnf install -y rpm-build gcc make
         - ./ci/printenv.sh
-        - ./configure --prefix=/usr || (cat config.log; exit 1)
+        - ./configure || (cat config.log; exit 1)
         - make rpms
         - rpm -i firejail*.rpm
         - command -V firejail && firejail --version
 
 build_src_package:
     image: alpine:latest
+    timeout: 10 minutes
     script:
         - apk update
         - apk upgrade
@@ -74,6 +79,7 @@ build_src_package:
 
 build_no_apparmor:
     image: ubuntu:latest
+    timeout: 10 minutes
     variables:
         DEBIAN_FRONTEND: noninteractive
     script:
@@ -92,6 +98,7 @@ build_no_apparmor:
 
 debian_ci:
     image: registry.salsa.debian.org/salsa-ci-team/ci-image-git-buildpackage:latest
+    timeout: 10 minutes
     variables:
         DEBFULLNAME: "$GITLAB_USER_NAME"
         DEBEMAIL: "$GITLAB_USER_EMAIL"
diff --git a/Makefile b/Makefile
index 5b9335127..808a9beac 100644
--- a/Makefile
+++ b/Makefile
@@ -173,21 +173,10 @@ clean:
         $(MAKE) -C src/man clean
         $(MAKE) -C test clean
         rm -f $(SECCOMP_FILTERS)
-        rm -f firejail*.rpm
         rm -f $(SYNTAX_FILES)
-        rm -f src/fnettrace/static-ip-map
-        rm -f test/utils/index.html*
-        rm -f test/utils/wget-log
-        rm -f test/utils/firejail-test-file*
-        rm -f test/utils/lstesting
-        rm -f test/environment/index.html*
-        rm -f test/environment/wget-log*
-        rm -fr test/environment/-testdir
-        rm -f test/environment/logfile*
-        rm -f test/environment/index.html
-        rm -f test/environment/wget-log
-        rm -f test/sysutils/firejail_t*
-        cd test/compile; ./compile.sh --clean; cd ../..
+        rm -fr ./$(TARNAME)-$(VERSION) ./$(TARNAME)-$(VERSION).tar.xz
+        rm -f ./$(TARNAME)*.deb
+        rm -f ./$(TARNAME)*.rpm
 
 .PHONY: distclean
 distclean: clean
@@ -339,7 +328,6 @@ DISTFILES_TEST = \
 
 .PHONY: dist
 dist: clean config.mk
-        rm -fr $(TARNAME)-$(VERSION) $(TARNAME)-$(VERSION).tar.xz
         mkdir -p $(TARNAME)-$(VERSION)/test
         cp -a $(DISTFILES) $(TARNAME)-$(VERSION)
         cp -a $(DISTFILES_TEST) $(TARNAME)-$(VERSION)/test
@@ -380,8 +368,8 @@ scan-build: clean
 .PHONY: codespell
 codespell:
         @printf 'Running %s...\n' $@
-        @codespell --ignore-regex 'UE|als|chage|creat|doas|ether|isplay|readby|[Ss]hotcut' \
-          -S *.gz,*.o,*.so \
+        @codespell --ignore-regex 'Manuel|UE|als|chage|creat|doas|ether|isplay|readby|[Ss]hotcut' \
+          -S *.d,*.gz,*.o,*.so \
           -S COPYING,m4 \
           -S ./contrib/syscalls.sh \
           .
diff --git a/RELNOTES b/RELNOTES
index e1b0a6107..c9e599394 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,5 +1,6 @@
 firejail (0.9.73) baseline; urgency=low
   * work in progress
+  * security: fix sscanf rv checks (CodeQL) (#6184)
   * feature: Add "keep-shell-rc" command and option (#1127 #5634)
   * feature: Print the argument when failing with "too long arguments" (#5677)
   * feature: a random hostname is assigned to each sandbox unless
@@ -13,7 +14,7 @@ firejail (0.9.73) baseline; urgency=low
     #6153)
   * feature: expand simple macros in more commands (--chroot= --netfilter=
     --netfilter6= --trace=) (#6032 #6109)
-  * feature: add Landlock support (#5269 #6078 #6115 #6125)
+  * feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200)
   * modif: Stop forwarding own double-dash to the shell (#5599 #5600)
   * modif: Prevent sandbox name (--name=) and host name (--hostname=)
     from containing only digits (#5578 #5741)
@@ -23,7 +24,7 @@ firejail (0.9.73) baseline; urgency=low
   * modif: remove firemon --interface option (duplicating --net.print option)
   * modif: make private-lib a configure-time option, disabled by default (see
     --enable-private-lib) (#5727 #5732)
-  * modif: Improve --version/--help & print version on startup (#5829)
+  * modif: Improve --version/--help & print version on startup (#5829 #6172)
   * modif: improve errExit error messages (#5871)
   * modif: drop deprecated 'shell' option references (#5894)
   * modif: keep pipewire group unless nosound is used (#5992 #5993)
@@ -59,6 +60,8 @@ firejail (0.9.73) baseline; urgency=low
   * build: use CPPFLAGS instead of INCLUDE in compile targets (#6159)
   * build: use full paths on compile/link targets (#6158)
   * build: automatically generate header dependencies (#6164)
+  * build: improve main clean target (#6186)
+  * build: mkrpm.sh improvements (#6196)
   * ci: always update the package db before installing packages (#5742)
   * ci: fix codeql unable to download its own bundle (#5783)
   * ci: split configure/build/install commands on gitlab (#5784)
@@ -71,6 +74,7 @@ firejail (0.9.73) baseline; urgency=low
   * ci: fix dependabot duplicated workflow runs (#5984)
   * ci: allow running workflows manually (#6026)
   * ci: re-enable sort.py (#6104)
+  * ci: add timeout limits (#6178)
   * contrib/syntax: remove 'text/plain' from firejail-profile.lang.in (#6057
     #6059)
   * contrib/vim: match profile files more broadly (#5850)
@@ -266,7 +270,7 @@ firejail (0.9.68) baseline; urgency=low
  -- netblue30 <netblue30@yahoo.com>  Sun, 6 Feb 2022 09:00:00 -0500
 
 firejail (0.9.66) baseline; urgency=low
-  * deprecated --audit options, relpaced by jailcheck utility
+  * deprecated --audit options, replaced by jailcheck utility
   * deprecated follow-symlink-as-user from firejail.config
   * new firejail.config settings: private-bin, private-etc
   * new firejail.config settings: private-opt, private-srv
diff --git a/contrib/syntax/lists/profile_commands_arg1.list b/contrib/syntax/lists/profile_commands_arg1.list
index e76b6ef40..8d5cae7f2 100644
--- a/contrib/syntax/lists/profile_commands_arg1.list
+++ b/contrib/syntax/lists/profile_commands_arg1.list
@@ -30,8 +30,9 @@ iprange
 join-or-start
 keep-fd
 landlock.execute
+landlock.makedev
+landlock.makeipc
 landlock.read
-landlock.special
 landlock.write
 mac
 mkdir
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index eb4d21675..f3b44ac3e 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -78,6 +78,7 @@ blacklist ${HOME}/.cache/PawelStolowski
 blacklist ${HOME}/.cache/Psi
 blacklist ${HOME}/.cache/QuiteRss
 blacklist ${HOME}/.cache/Quotient/quaternion
+blacklist ${HOME}/.cache/RawTherapee
 blacklist ${HOME}/.cache/Shortwave
 blacklist ${HOME}/.cache/Tox
 blacklist ${HOME}/.cache/Zeal
@@ -335,6 +336,7 @@ blacklist ${HOME}/.config/QuiteRssrc
 blacklist ${HOME}/.config/Quotient
 blacklist ${HOME}/.config/RSS Guard 4
 blacklist ${HOME}/.config/Rambox
+blacklist ${HOME}/.config/RawTherapee
 blacklist ${HOME}/.config/Riot
 blacklist ${HOME}/.config/Rocket.Chat
 blacklist ${HOME}/.config/RogueLegacy
diff --git a/etc/inc/landlock-common.inc b/etc/inc/landlock-common.inc
index ebe9f98dc..694d447b5 100644
--- a/etc/inc/landlock-common.inc
+++ b/etc/inc/landlock-common.inc
@@ -4,7 +4,7 @@ include landlock-common.local
 
 landlock.read /          # whole system read
 landlock.read /proc
-landlock.special /       # sockets etc.
+landlock.makeipc /       # sockets etc.
 
 # write access
 landlock.write ${HOME}
diff --git a/etc/profile-a-l/crawl.profile b/etc/profile-a-l/crawl.profile
index 7df7b4480..9545fb8bc 100644
--- a/etc/profile-a-l/crawl.profile
+++ b/etc/profile-a-l/crawl.profile
@@ -8,6 +8,9 @@ include globals.local
 
 noblacklist ${HOME}/.crawl
 
+# Allow lua (blacklisted by disable-interpreters.inc)
+include allow-lua.inc
+
 include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
diff --git a/etc/profile-a-l/enchant-lsmod-2.profile b/etc/profile-a-l/enchant-lsmod-2.profile
index a7199955e..3fe9e94c0 100644
--- a/etc/profile-a-l/enchant-lsmod-2.profile
+++ b/etc/profile-a-l/enchant-lsmod-2.profile
@@ -7,4 +7,4 @@ include enchant-lsmod-2.local
 #include globals.local
 
 # Redirect
-include enchant.profile
+include enchant-2.profile
diff --git a/etc/profile-a-l/geeqie.profile b/etc/profile-a-l/geeqie.profile
index 6cd28f25d..beffb28e3 100644
--- a/etc/profile-a-l/geeqie.profile
+++ b/etc/profile-a-l/geeqie.profile
@@ -10,6 +10,9 @@ noblacklist ${HOME}/.cache/geeqie
 noblacklist ${HOME}/.config/geeqie
 noblacklist ${HOME}/.local/share/geeqie
 
+# Allow lua (blacklisted by disable-interpreters.inc)
+include allow-lua.inc
+
 # Allow perl (blacklisted by disable-interpreters.inc)
 include allow-perl.inc
 
diff --git a/etc/profile-a-l/gnome-keyring-daemon.profile b/etc/profile-a-l/gnome-keyring-daemon.profile
new file mode 100644
index 000000000..41ea136a6
--- /dev/null
+++ b/etc/profile-a-l/gnome-keyring-daemon.profile
@@ -0,0 +1,62 @@
+# Firejail profile for gnome-keyring-daemon
+# Description: Stores passwords and encryption keys
+# This file is overwritten after every install/update
+quiet
+# Persistent local customizations
+include gnome-keyring-daemon.local
+# Persistent global definitions
+include globals.local
+
+blacklist /tmp/.X11-unix
+blacklist ${RUNUSER}/wayland-*
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-programs.inc
+#include disable-X11.inc # x11 none
+include disable-xdg.inc
+
+whitelist ${RUNUSER}/gnupg
+whitelist ${RUNUSER}/keyring
+whitelist /usr/share/gnupg
+whitelist /usr/share/gnupg2
+include whitelist-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+apparmor
+caps.drop all
+ipc-namespace
+machine-id
+netfilter
+no3d
+nodvd
+nogroups
+noinput
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6
+seccomp
+seccomp.block-secondary
+tracelog
+x11 none
+
+disable-mnt
+#private-bin gnome-keyrin*,secret-tool
+private-cache
+private-dev
+#private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security
+private-tmp
+
+#dbus-user none
+dbus-system none
+
+memory-deny-write-execute
+restrict-namespaces
diff --git a/etc/profile-a-l/gnome-keyring.profile b/etc/profile-a-l/gnome-keyring.profile
index aa0a7f4cc..287c6dcf9 100644
--- a/etc/profile-a-l/gnome-keyring.profile
+++ b/etc/profile-a-l/gnome-keyring.profile
@@ -1,62 +1,17 @@
 # Firejail profile for gnome-keyring
 # Description: Stores passwords and encryption keys
 # This file is overwritten after every install/update
-quiet
 # Persistent local customizations
 include gnome-keyring.local
 # Persistent global definitions
-include globals.local
+# added by included profile
+#include globals.local
 
 noblacklist ${HOME}/.gnupg
 
-include disable-common.inc
-include disable-devel.inc
-include disable-exec.inc
-include disable-interpreters.inc
-include disable-programs.inc
-include disable-xdg.inc
-
 mkdir ${HOME}/.gnupg
 whitelist ${HOME}/.gnupg
 whitelist ${DOWNLOADS}
-whitelist ${RUNUSER}/gnupg
-whitelist ${RUNUSER}/keyring
-whitelist /usr/share/gnupg
-whitelist /usr/share/gnupg2
-include whitelist-common.inc
-include whitelist-runuser-common.inc
-include whitelist-usr-share-common.inc
-include whitelist-var-common.inc
-
-apparmor
-caps.drop all
-ipc-namespace
-machine-id
-netfilter
-no3d
-nodvd
-nogroups
-noinput
-nonewprivs
-noroot
-nosound
-notv
-nou2f
-novideo
-protocol unix,inet,inet6
-seccomp
-seccomp.block-secondary
-tracelog
-
-disable-mnt
-#private-bin gnome-keyrin*,secret-tool
-private-cache
-private-dev
-#private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security
-private-tmp
-
-#dbus-user none
-dbus-system none
 
-memory-deny-write-execute
-restrict-namespaces
+# Redirect
+include gnome-keyring-daemon.profile
diff --git a/etc/profile-m-z/rawtherapee.profile b/etc/profile-m-z/rawtherapee.profile
new file mode 100644
index 000000000..0cf946eec
--- /dev/null
+++ b/etc/profile-m-z/rawtherapee.profile
@@ -0,0 +1,39 @@
+# Firejail profile for rawtherapee
+# Description: Free cross-platform raw image processing program
+# This file is overwritten after every install/update
+# Persistent local customizations
+include rawtherapee.local
+# Persistent global definitions
+include globals.local
+
+noblacklist ${HOME}/.cache/RawTherapee
+noblacklist ${HOME}/.config/RawTherapee
+noblacklist ${PICTURES}
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-programs.inc
+include disable-shell.inc
+include disable-xdg.inc
+
+caps.drop all
+netfilter
+nodvd
+nogroups
+noinput
+nonewprivs
+noroot
+nosound
+notv
+nou2f
+novideo
+protocol unix,inet,inet6
+seccomp
+
+private-bin rawtherapee
+private-dev
+private-tmp
+
+restrict-namespaces
diff --git a/etc/profile-m-z/tesseract.profile b/etc/profile-m-z/tesseract.profile
index c0293406d..5d2ea4ae6 100644
--- a/etc/profile-m-z/tesseract.profile
+++ b/etc/profile-m-z/tesseract.profile
@@ -1,6 +1,7 @@
 # Firejail profile for tesseract
 # Description: An OCR program
 # This file is overwritten after every install/update
+quiet
 # Persistent local customizations
 include tesseract.local
 # Persistent global definitions
diff --git a/etc/templates/profile.template b/etc/templates/profile.template
index 8882c9012..0e6a5734e 100644
--- a/etc/templates/profile.template
+++ b/etc/templates/profile.template
@@ -140,7 +140,8 @@ include globals.local
 # Landlock commands
 ##landlock.read PATH
 ##landlock.write PATH
-##landlock.special PATH
+##landlock.makeipc PATH
+##landlock.makedev PATH
 ##landlock.execute PATH
 #include landlock-common.inc
 
diff --git a/platform/debian/control.amd64 b/platform/debian/control.amd64
index f666200d5..59776d325 100644
--- a/platform/debian/control.amd64
+++ b/platform/debian/control.amd64
@@ -8,7 +8,7 @@ Suggests: python, python3
 Section: admin
 Priority: optional
 Homepage: https://github.com/netblue30/firejail
-Description: Linux namepaces sandbox program.
+Description: Linux namespaces sandbox program.
  Firejail  is  a  SUID sandbox program that reduces the risk of security
  breaches by restricting the running environment of untrusted applications
  using Linux namespaces and seccmp-bpf. It includes sandbox profiles for
diff --git a/platform/debian/control.i386 b/platform/debian/control.i386
index ab9e0fc52..3d3f217c9 100644
--- a/platform/debian/control.i386
+++ b/platform/debian/control.i386
@@ -8,7 +8,7 @@ Suggests: python, python3
 Section: admin
 Priority: optional
 Homepage: https://github.com/netblue30/firejail
-Description: Linux namepaces sandbox program.
+Description: Linux namespaces sandbox program.
  Firejail  is  a  SUID sandbox program that reduces the risk of security
  breaches by restricting the running environment of untrusted applications
  using Linux namespaces and seccmp-bpf. It includes sandbox profiles for
diff --git a/platform/rpm/mkrpm.sh b/platform/rpm/mkrpm.sh
index 7fbc35575..0221fa607 100755
--- a/platform/rpm/mkrpm.sh
+++ b/platform/rpm/mkrpm.sh
@@ -8,6 +8,8 @@
 # Builds rpms in a temporary directory then places the result in the
 # current working directory.
 
+set -e
+
 # shellcheck source=config.sh
 . "$(dirname "$0")/../../config.sh" || exit 1
 
@@ -36,9 +38,9 @@ trap cleanup EXIT
 
 # Create the spec file
 tmp_spec_file="${tmpdir}/SPECS/${name}.spec"
-sed -e "s/__NAME__/${name}/g" \
-    -e "s/__VERSION__/${version}/g" \
-    -e "s/__CONFIG_OPT__/${config_opt}/g" \
+sed -e "s|__NAME__|${name}|g" \
+    -e "s|__VERSION__|${version}|g" \
+    -e "s|__CONFIG_OPT__|${config_opt}|g" \
     "platform/rpm/${name}.spec" >"${tmp_spec_file}"
 # FIXME: We could parse RELNOTES and create a %changelog section here
 
@@ -47,7 +49,7 @@ tar --exclude='./.git*' --transform "s/^./${name}-${version}/" \
     -czf "${tmpdir}/SOURCES/${name}-${version}.tar.gz" .
 
 # Build the files (rpm, debug rpm and source rpm)
-rpmbuild --quiet --define "_topdir ${tmpdir}" -ba "${tmp_spec_file}"
+rpmbuild --define "_topdir ${tmpdir}" -ba "${tmp_spec_file}"
 
 # Copy the results to cwd
 mv "${tmpdir}/SRPMS"/*.rpm "${tmpdir}/RPMS"/*/*rpm .
diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in
index 76667ca0c..6c985bc6e 100644
--- a/src/bash_completion/firejail.bash_completion.in
+++ b/src/bash_completion/firejail.bash_completion.in
@@ -53,7 +53,11 @@ _firejail()
             _filedir
             return 0
             ;;
-        --landlock.special)
+        --landlock.makeipc)
+            _filedir
+            return 0
+            ;;
+        --landlock.makedev)
             _filedir
             return 0
             ;;
diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c
index ecb18a60e..1895e437b 100644
--- a/src/firecfg/desktop_files.c
+++ b/src/firecfg/desktop_files.c
@@ -57,7 +57,7 @@ static int check_profile(const char *name, const char *homedir) {
 }
 
 
-// look for a profile file in /etc/firejail diectory and in homedir/.config/firejail directory
+// look for a profile file in /etc/firejail and ~/.config/firejail
 static int have_profile(const char *filename, const char *homedir) {
         assert(filename);
         assert(homedir);
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index f007638f8..abaec3036 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -342,6 +342,9 @@ gnome-contacts
 gnome-documents
 gnome-font-viewer
 gnome-hexgl
+gnome-keyring
+gnome-keyring-3
+gnome-keyring-daemon
 gnome-klotski
 gnome-latex
 gnome-logs
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index d76a6c0ee..2122649cf 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -154,9 +154,10 @@ typedef struct landlock_entry_t {
         struct landlock_entry_t *next;
 #define LL_READ 0
 #define LL_WRITE 1
-#define LL_SPECIAL 2
-#define LL_EXEC 3
-#define LL_MAX 4
+#define LL_MAKEIPC 2
+#define LL_MAKEDEV 3
+#define LL_EXEC 4
+#define LL_MAX 5
         int type;
         char *data;
 } LandlockEntry;
@@ -492,7 +493,7 @@ void tree(void);
 void top(void);
 
 // usage.c
-void print_version(void);
+void print_version(FILE *stream);
 void print_version_full(void);
 void usage(void);
 
diff --git a/src/firejail/landlock.c b/src/firejail/landlock.c
index 77149a134..ce222624b 100644
--- a/src/firejail/landlock.c
+++ b/src/firejail/landlock.c
@@ -83,7 +83,7 @@ out:
 }
 
 static int ll_create_full_ruleset(void) {
-        struct landlock_ruleset_attr attr;
+        struct landlock_ruleset_attr attr = {0};
         attr.handled_access_fs =
                 LANDLOCK_ACCESS_FS_EXECUTE |
                 LANDLOCK_ACCESS_FS_MAKE_BLOCK |
@@ -106,7 +106,7 @@ static int ll_create_full_ruleset(void) {
 
         int ruleset_fd = landlock_create_ruleset(&attr, sizeof(attr), 0);
         if (ruleset_fd < 0) {
-                fprintf(stderr, "%s: Error: failed to create Landlock ruleset "
+                fprintf(stderr, "Error: %s: failed to create Landlock ruleset "
                                 "(abi=%d fs=%llx): %s\n",
                         __func__, ll_abi, attr.handled_access_fs,
                         strerror(errno));
@@ -115,7 +115,7 @@ static int ll_create_full_ruleset(void) {
 }
 
 static void _ll_fs(const char *allowed_path, const __u64 allowed_access,
-                  const char *caller) {
+                   const char *caller) {
         if (ll_ruleset_fd == -1)
                 ll_ruleset_fd = ll_create_full_ruleset();
 
@@ -133,7 +133,7 @@ static void _ll_fs(const char *allowed_path, const __u64 allowed_access,
                 return;
         }
 
-        struct landlock_path_beneath_attr target;
+        struct landlock_path_beneath_attr target = {0};
         target.parent_fd = allowed_fd;
         target.allowed_access = allowed_access;
         int error = landlock_add_rule(ll_ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,
@@ -148,7 +148,7 @@ static void _ll_fs(const char *allowed_path, const __u64 allowed_access,
 }
 
 static void ll_fs(const char *allowed_path, const __u64 allowed_access,
-                 const char *caller) {
+                  const char *caller) {
         char *expanded_path;
 
         // ${PATH} macro is not included by default in expand_macros()
@@ -194,16 +194,22 @@ static void ll_write(const char *allowed_path) {
         ll_fs(allowed_path, allowed_access, __func__);
 }
 
-static void ll_special(const char *allowed_path) {
+static void ll_makeipc(const char *allowed_path) {
         __u64 allowed_access =
-                LANDLOCK_ACCESS_FS_MAKE_BLOCK |
-                LANDLOCK_ACCESS_FS_MAKE_CHAR |
                 LANDLOCK_ACCESS_FS_MAKE_FIFO |
                 LANDLOCK_ACCESS_FS_MAKE_SOCK;
 
         ll_fs(allowed_path, allowed_access, __func__);
 }
 
+static void ll_makedev(const char *allowed_path) {
+        __u64 allowed_access =
+                LANDLOCK_ACCESS_FS_MAKE_BLOCK |
+                LANDLOCK_ACCESS_FS_MAKE_CHAR;
+
+        ll_fs(allowed_path, allowed_access, __func__);
+}
+
 static void ll_exec(const char *allowed_path) {
         __u64 allowed_access =
                 LANDLOCK_ACCESS_FS_EXECUTE;
@@ -223,7 +229,8 @@ int ll_restrict(uint32_t flags) {
         void (*fnc[])(const char *) = {
                 ll_read,
                 ll_write,
-                ll_special,
+                ll_makeipc,
+                ll_makedev,
                 ll_exec,
                 NULL
         };
diff --git a/src/firejail/main.c b/src/firejail/main.c
index cc5345ee0..4d8ea20c3 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1509,8 +1509,10 @@ int main(int argc, char **argv, char **envp) {
                         ll_add_profile(LL_READ, argv[i] + 16);
                 else if (strncmp(argv[i], "--landlock.write=", 17) == 0)
                         ll_add_profile(LL_WRITE, argv[i] + 17);
-                else if (strncmp(argv[i], "--landlock.special=", 19) == 0)
-                        ll_add_profile(LL_SPECIAL, argv[i] + 19);
+                else if (strncmp(argv[i], "--landlock.makeipc=", 19) == 0)
+                        ll_add_profile(LL_MAKEIPC, argv[i] + 19);
+                else if (strncmp(argv[i], "--landlock.makedev=", 19) == 0)
+                        ll_add_profile(LL_MAKEDEV, argv[i] + 19);
                 else if (strncmp(argv[i], "--landlock.execute=", 19) == 0)
                         ll_add_profile(LL_EXEC, argv[i] + 19);
 #endif
@@ -2957,10 +2959,10 @@ int main(int argc, char **argv, char **envp) {
         }
         EUID_ASSERT();
 
-        // Note: Only attempt to print non-debug information to stdout after
-        // all profiles have been loaded (because a profile may set arg_quiet)
+        // Note: Only attempt to print non-debug information after all profiles
+        // have been loaded (because a profile may set arg_quiet)
         if (!arg_quiet)
-                print_version();
+                print_version(stderr);
 
         // block X11 sockets
         if (arg_x11_block)
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index c0abc3398..a5a8393e9 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1086,8 +1086,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 ll_add_profile(LL_WRITE, ptr + 15);
                 return 0;
         }
-        if (strncmp(ptr, "landlock.special ", 17) == 0) {
-                ll_add_profile(LL_SPECIAL, ptr + 17);
+        if (strncmp(ptr, "landlock.makeipc ", 17) == 0) {
+                ll_add_profile(LL_MAKEIPC, ptr + 17);
+                return 0;
+        }
+        if (strncmp(ptr, "landlock.makedev ", 17) == 0) {
+                ll_add_profile(LL_MAKEDEV, ptr + 17);
                 return 0;
         }
         if (strncmp(ptr, "landlock.execute ", 17) == 0) {
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index 741e908ed..e258f6204 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -210,9 +210,9 @@ static void sanitize_passwd(void) {
                         goto errout;
 
                 // process uid
-                int uid;
+                int uid = -1;
                 int rv = sscanf(ptr, "%d:", &uid);
-                if (rv == 0 || uid < 0)
+                if (rv != 1 || uid < 0)
                         goto errout;
                 assert(uid_min);
                 if (uid < uid_min || uid == 65534) { // on Debian platforms user nobody is 65534
@@ -349,9 +349,9 @@ static void sanitize_group(void) {
                         goto errout;
 
                 // process uid
-                int gid;
+                int gid = -1;
                 int rv = sscanf(ptr, "%d:", &gid);
-                if (rv == 0 || gid < 0)
+                if (rv != 1 || gid < 0)
                         goto errout;
                 assert(gid_min);
                 if (gid < gid_min || gid == 65534) { // on Debian platforms 65534 is group nogroup
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index beedb3ce2..c62e8c369 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -137,7 +137,8 @@ static const char *const usage_str =
         "    --landlock.enforce - enforce the Landlock ruleset.\n"
         "    --landlock.read=path - add a read access rule for the path to the Landlock ruleset.\n"
         "    --landlock.write=path - add a write access rule for the path to the Landlock ruleset.\n"
-        "    --landlock.special=path - add an access rule for the path to the Landlock ruleset for creating block/char devices, named pipes and sockets.\n"
+        "    --landlock.makeipc=path - add an access rule for the path to the Landlock ruleset for creating named pipes and sockets.\n"
+        "    --landlock.makedev=path - add an access rule for the path to the Landlock ruleset for creating block/char devices.\n"
         "    --landlock.execute=path - add an execute access rule for the path to the Landlock ruleset.\n"
 #endif
         "    --list - list all sandboxes.\n"
@@ -320,16 +321,16 @@ static const char *const usage_str =
         "License GPL version 2 or later\n"
         "Homepage: https://firejail.wordpress.com\n";
 
-void print_version(void) {
-        printf("firejail version %s\n\n", VERSION);
+void print_version(FILE *stream) {
+        fprintf(stream, "firejail version %s\n\n", VERSION);
 }
 
 void print_version_full(void) {
-        print_version();
+        print_version(stdout);
         print_compiletime_support();
 }
 
 void usage(void) {
-        print_version();
+        print_version(stdout);
         puts(usage_str);
 }
diff --git a/src/fnettrace/Makefile b/src/fnettrace/Makefile
index 2ad296d1d..1c62f43bc 100644
--- a/src/fnettrace/Makefile
+++ b/src/fnettrace/Makefile
@@ -7,8 +7,10 @@ MOD_DIR = $(ROOT)/src/$(MOD)
 PROG = $(MOD_DIR)/$(MOD)
 TARGET = $(PROG)
 
+CLEANFILES += static-ip-map
+
 include $(ROOT)/src/prog.mk
 
 all: $(TARGET) static-ip-map
 static-ip-map: static-ip-map.txt $(PROG)
-        ./$(PROG) --squash-map=static-ip-map.txt > static-ip-map
+        ./$(PROG) --squash-map=static-ip-map.txt 2>&1 >static-ip-map
diff --git a/src/man/firejail-profile.5.in b/src/man/firejail-profile.5.in
index e1d7fde94..b6672c16b 100644
--- a/src/man/firejail-profile.5.in
+++ b/src/man/firejail-profile.5.in
@@ -522,10 +522,15 @@ rule for path.
 Create a Landlock ruleset (if it doesn't already exist) and add a write access
 rule for path.
 .TP
-\fBlandlock.special path
+\fBlandlock.makeipc path
 Create a Landlock ruleset (if it doesn't already exist) and add a rule that
-allows the creation of block devices, character devices, named pipes (FIFOs)
-and Unix domain sockets beneath given path.
+allows the creation of named pipes (FIFOs) and Unix domain sockets beneath
+the given path.
+.TP
+\fBlandlock.makedev path
+Create a Landlock ruleset (if it doesn't already exist) and add a rule that
+allows the creation of block devices and character devices beneath the given
+path.
 .TP
 \fBlandlock.execute path
 Create a Landlock ruleset (if it doesn't already exist) and add an execution
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in
index ccc9a50a5..6548b8e5d 100644
--- a/src/man/firejail.1.in
+++ b/src/man/firejail.1.in
@@ -1249,10 +1249,15 @@ rule for path.
 Create a Landlock ruleset (if it doesn't already exist) and add a write access
 rule for path.
 .TP
-\fB\-\-landlock.special=path
+\fB\-\-landlock.makeipc=path
 Create a Landlock ruleset (if it doesn't already exist) and add a rule that
-allows the creation of block devices, character devices, named pipes (FIFOs)
-and Unix domain sockets beneath given path.
+allows the creation of named pipes (FIFOs) and Unix domain sockets beneath
+the given path.
+.TP
+\fB\-\-landlock.makedev=path
+Create a Landlock ruleset (if it doesn't already exist) and add a rule that
+allows the creation of block devices and character devices beneath the given
+path.
 .TP
 \fB\-\-landlock.execute=path
 Create a Landlock ruleset (if it doesn't already exist) and add an execution
@@ -1264,7 +1269,6 @@ Example:
 .br
 $ firejail \-\-landlock.read=/ \-\-landlock.write=/home
 \-\-landlock.execute=/usr \-\-landlock.enforce
-.PP
 #endif
 .TP
 \fB\-\-list
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
index c4056b902..45f24d5f3 100644
--- a/src/zsh_completion/_firejail.in
+++ b/src/zsh_completion/_firejail.in
@@ -110,7 +110,8 @@ _firejail_args=(
     '--landlock.enforce[enforce the Landlock ruleset]'
     '--landlock.read=-[add a read access rule for the path to the Landlock ruleset]: :_files'
     '--landlock.write=-[add a write access rule for the path to the Landlock ruleset]: :_files'
-    '--landlock.special=-[add an access rule for the path to the Landlock ruleset for creating block/char devices, named pipes and sockets]: :_files'
+    '--landlock.makeipc=-[add an access rule for the path to the Landlock ruleset for creating named pipes and sockets]: :_files'
+    '--landlock.makedev=-[add an access rule for the path to the Landlock ruleset for creating block/char devices]: :_files'
     '--landlock.execute=-[add an execute access rule for the path to the Landlock ruleset]: :_files'
 #endif
     '--machine-id[spoof /etc/machine-id with a random id]'
diff --git a/test/Makefile b/test/Makefile
index d7b1bac7a..52fada86c 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -12,3 +12,13 @@ $(TESTS):
 .PHONY: clean
 clean:
         for test in $(TESTS); do rm -f "$$test/$$test.log"; done
+        rm -fr environment/-testdir
+        rm -f environment/index.html*
+        rm -f environment/logfile*
+        rm -f environment/wget-log*
+        rm -f sysutils/firejail_t*
+        rm -f utils/firejail-test-file*
+        rm -f utils/index.html*
+        rm -f utils/lstesting
+        rm -f utils/wget-log
+        cd compile && (./compile.sh --clean || true)