11 files changed, 7 insertions, 244 deletions

diff --git a/RELNOTES b/RELNOTES
index d751b2511..711977052 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -2,6 +2,7 @@ firejail (0.9.56~rc1) baseline; urgency=low
   * work in progress
   * modif: removed CFG_CHROOT_DESKTOP configuration option
   * modif: removed compile time --enable-network=restricted
+  * modif: removed compile time --disable-bind
   * modif: --net=none allowed even if networking was disabled at compile
      time or at run time
   * support wireless devices in --net option
diff --git a/configure b/configure
index 6e6f84256..cfcdae929 100755
--- a/configure
+++ b/configure
@@ -636,7 +636,6 @@ HAVE_X11
 HAVE_USERNS
 HAVE_NETWORK
 HAVE_GLOBALCFG
-HAVE_BIND
 HAVE_CHROOT
 HAVE_SECCOMP
 HAVE_PRIVATE_HOME
@@ -705,7 +704,6 @@ enable_overlayfs
 enable_private_home
 enable_seccomp
 enable_chroot
-enable_bind
 enable_globalcfg
 enable_network
 enable_userns
@@ -1352,7 +1350,6 @@ Optional Features:
   --disable-private-home  disable private home feature
   --disable-seccomp       disable seccomp
   --disable-chroot        disable chroot
-  --disable-bind          disable bind
   --disable-globalcfg     if the global config file firejail.cfg is not
                           present, continue the program using defaults
   --disable-network       disable network
@@ -3626,19 +3623,6 @@ if test "x$enable_chroot" != "xno"; then :
 
 fi
 
-HAVE_BIND=""
-# Check whether --enable-bind was given.
-if test "${enable_bind+set}" = set; then :
-  enableval=$enable_bind;
-fi
-
-if test "x$enable_bind" != "xno"; then :
-
-        HAVE_BIND="-DHAVE_BIND"
-
-
-fi
-
 HAVE_GLOBALCFG=""
 # Check whether --enable-globalcfg was given.
 if test "${enable_globalcfg+set}" = set; then :
@@ -5043,7 +5027,6 @@ echo "   <linux/seccomp.h>: $HAVE_SECCOMP_H"
 echo "   apparmor: $HAVE_APPARMOR"
 echo "   global config: $HAVE_GLOBALCFG"
 echo "   chroot: $HAVE_CHROOT"
-echo "   bind: $HAVE_BIND"
 echo "   network: $HAVE_NETWORK"
 echo "   user namespace: $HAVE_USERNS"
 echo "   X11 sandboxing support: $HAVE_X11"
diff --git a/configure.ac b/configure.ac
index 8c6459335..73736abc2 100644
--- a/configure.ac
+++ b/configure.ac
@@ -83,14 +83,6 @@ AS_IF([test "x$enable_chroot" != "xno"], [
         AC_SUBST(HAVE_CHROOT)
 ])
 
-HAVE_BIND=""
-AC_ARG_ENABLE([bind],
-    AS_HELP_STRING([--disable-bind], [disable bind]))
-AS_IF([test "x$enable_bind" != "xno"], [
-        HAVE_BIND="-DHAVE_BIND"
-        AC_SUBST(HAVE_BIND)
-])
-
 HAVE_GLOBALCFG=""
 AC_ARG_ENABLE([globalcfg],
     AS_HELP_STRING([--disable-globalcfg], [if the global config file firejail.cfg is not present, continue the program using defaults]))
@@ -207,7 +199,6 @@ echo "   <linux/seccomp.h>: $HAVE_SECCOMP_H"
 echo "   apparmor: $HAVE_APPARMOR"
 echo "   global config: $HAVE_GLOBALCFG"
 echo "   chroot: $HAVE_CHROOT"
-echo "   bind: $HAVE_BIND"
 echo "   network: $HAVE_NETWORK"
 echo "   user namespace: $HAVE_USERNS"
 echo "   X11 sandboxing support: $HAVE_X11"
diff --git a/src/common.mk.in b/src/common.mk.in
index fd9f2e5a5..7a2056e7b 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -11,7 +11,6 @@ NAME=@PACKAGE_NAME@
 HAVE_SECCOMP_H=@HAVE_SECCOMP_H@
 HAVE_SECCOMP=@HAVE_SECCOMP@
 HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_BIND=@HAVE_BIND@
 HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
 HAVE_NETWORK=@HAVE_NETWORK@
 HAVE_USERNS=@HAVE_USERNS@
@@ -29,7 +28,7 @@ C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
 
-CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_BIND) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
+CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"'  $(HAVE_GCOV) -DPREFIX='"$(prefix)"'  -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -pie -Wformat -Wformat-security
 LDFLAGS += -pie -Wl,-z,relro -Wl,-z,now -lpthread
 EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
 EXTRA_CFLAGS +=@EXTRA_CFLAGS@
diff --git a/src/firejail/arg-checking.txt b/src/firejail/arg-checking.txt
deleted file mode 100644
index cfed454f8..000000000
--- a/src/firejail/arg-checking.txt
+++ /dev/null
@@ -1,84 +0,0 @@
-arg checking:
-
-1. --output=filename
-        - not supported in profiles
-        - checking no "..",
-        - checking no link,
-        - checking no dir,
-        - checking same permissions,
-        - checking no hard links
-        - unit test
-
-2. --chroot=dirname
-        - not supported in profiles
-        - expand "~"
-        - checking no "..",
-        - checking is dir,
-        - checking no link
-        - checking directory structure
-        - unit test
-
-3. --bind=dirname1,dirname2, --bind=filename1,filenam2
-        - supported in profiles
-        - accepted only when running as root
-        - checking string chars
-        - checking no ".."
-        - unit test non root
-
-4. --tmpfs=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-5. --blacklist=filename, --blacklist=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-6. --read-only=filename, --read-only=dirname
-        - supported in profiles
-        - checking string chars
-        - checking no ".."
-        - unit test
-
-7. --profile=filename
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
-
-8. --private=dirname
-        - supported in profiles
-        - expand "~"
-        - check is dir
-        - check no link
-        - checking no ".."
-        - check same owner
-        - unit test
-
-9. --private-home=filelist
-        - supported in profiles
-        - checking no ".."
-        - checking file found
-        - checking same owner
-        - checking no link
-        - unit test
-
-10. --netfilter=filename
-        - supported in profiles
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
-
-11. --shell=filename
-        - not supported in profiles
-        - check access as real GID/UID
-        - checking no dir
-        - checking no link
-        - checking no ".."
-        - unit test
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 7483136f4..06820ce24 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -410,14 +410,6 @@ void print_compiletime_support(void) {
 #endif
                 );
 
-        printf("\t- bind support is %s\n",
-#ifdef HAVE_BIND
-                "enabled"
-#else
-                "disabled"
-#endif
-                );
-
         printf("\t- chroot support is %s\n",
 #ifdef HAVE_CHROOT
                 "enabled"
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 4faef025a..b3a8dcfd7 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1270,7 +1270,6 @@ int main(int argc, char **argv) {
                 //*************************************
                 else if (strcmp(argv[i], "--allusers") == 0)
                         arg_allusers = 1;
-#ifdef HAVE_BIND
                 else if (strncmp(argv[i], "--bind=", 7) == 0) {
                         if (checkcfg(CFG_BIND)) {
                                 char *line;
@@ -1283,7 +1282,6 @@ int main(int argc, char **argv) {
                         else
                                 exit_err_feature("bind");
                 }
-#endif
                 else if (strncmp(argv[i], "--tmpfs=", 8) == 0) {
                         char *line;
                         if (asprintf(&line, "tmpfs %s", argv[i] + 8) == -1)
diff --git a/src/firejail/network.txt b/src/firejail/network.txt
deleted file mode 100644
index 75bdc346d..000000000
--- a/src/firejail/network.txt
+++ /dev/null
@@ -1,95 +0,0 @@
-struct Bridge {
-        char *dev;              // bridge device name
-        uint32_t ip;            // bridge device IP address
-        uint32_t mask;          // bridge device mask
-        uint32_t ipsandbox      // sandbox interface IP address
-}
-
-net_configure_bridge(br, device) {
-        br->dev  = devname;
-        br->ip = extracted from kernel device - using net_get_if_addr() in network.c
-        br->mask = extracted from kernel device - using net_get_if_addr() in network.c
-        check available network range; /31 networks are not supported
-}
-
-net_configure_sandbox_ip(br) {
-        if br->ip_sandbox
-                check br->ipsandbox inside the bridge network
-                arp_check(br->ipsandbox)        // send an arp req to check if anybody else is using this address
-        else
-                br->ipsandbox = arp_assign();
-}
-
-net_configure_veth_pair {
-        create a veth pair
-        place one interface end in the bridge
-        place the other end in the namespace of the child process
-}
-
-net_bridge_wait_ip {
-        arp_check br->ipsandbox address to come up
-        wait for not more than 5 seconds
-}
-
-main() {
-
-        foreach argv[i] {
-                if --net
-                        br = next bridge available
-                        net_configure_bridge(br, device name from argv[i]);
-                else if --ip
-                        br = last bridge configured
-                        br->ipsandbox = ip address extracted from argv[i]
-                else if --defaultgw
-                        cfg.defaultgw = ip address extracted from argv[i]
-        }
-
-        net_check_cfg(); // check the validity of network configuration so far
-
-        if (any bridge configured) {
-                lock /var/lock/firejail.lock file
-                for each bridge
-                        net_configure_sandbox_ip(br)
-        }
-
-        clone (new network namespace if any bridge configured or --net=none)
-
-        if (any bridge configured) {
-                for each bridge
-                        net_configure_veth_pair
-        }
-
-        notify child init is done
-
-        if (any bridge configured) {
-                for each bridge
-                        net_bridge_wait_ip
-                unlock /var/lock/firejail.lock file
-        }
-
-        wait on child
-        exit
-}
-
-
-******************************************************
-* macvlan notes
-******************************************************
-Configure a macvlan interface
-
-# ip link add virtual0 link eth0 type macvlan mode bridge
-(you can configure it with # ifconfig virtual0 192.168.1.52/24 up)
-
-Create a new network namespace and move the interface in the new network namespace
-
-# ip netns add dummy0
-# ip link set virtual0 netns dummy0
-
-Join the namespace and configure the interfaces
-
-# ip netns exec dummy0 bash
-# ifconfig lo up
-# ifconfig virtual0 192.168.1.52/24
-
-Investigate ipvlan interface - added to linux kernel 3.19
-https://github.com/torvalds/linux/blob/master/Documentation/networking/ipvlan.txt
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 606378908..168d7e268 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1044,7 +1044,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // filesystem bind
         if (strncmp(ptr, "bind ", 5) == 0) {
-#ifdef HAVE_BIND
                 if (checkcfg(CFG_BIND)) {
                         if (getuid() != 0) {
                                 fprintf(stderr, "Error: --bind option is available only if running as root\n");
@@ -1077,7 +1076,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 }
                 else
                         warning_feature_disabled("bind");
-#endif
                 return 0;
         }
 
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 78cd30926..c8866da3a 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -37,10 +37,8 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --bandwidth=name|pid - set bandwidth limits.\n"
 #endif
-#ifdef HAVE_BIND
         "    --bind=dirname1,dirname2 - mount-bind dirname1 on top of dirname2.\n"
         "    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n"
-#endif
         "    --blacklist=filename - blacklist directory or file.\n"
         "    --build - build a whitelisted profile for the application.\n"
         "    --build=filename - build a whitelisted profile for the application.\n"
@@ -153,6 +151,7 @@ static char *usage_str =
         "    --overlay-clean - clean all overlays stored in $HOME/.firejail directory.\n"
         "    --private - temporary home directory.\n"
         "    --private=directory - use directory as user home.\n"
+        "    --private-cache - temporary ~/.cache directory.\n"
         "    --private-home=file,directory - build a new user home in a temporary\n"
         "\tfilesystem, and copy the files and directories in the list in\n"
         "\tthe new home.\n"
diff --git a/test/compile/compile.sh b/test/compile/compile.sh
index 9d35bbcde..adacab616 100755
--- a/test/compile/compile.sh
+++ b/test/compile/compile.sh
@@ -3,7 +3,7 @@
 arr[1]="TEST 1: standard compilation"
 arr[2]="TEST 2: compile seccomp disabled"
 arr[3]="TEST 3: compile chroot disabled"
-arr[4]="TEST 4: compile bind disabled"
+arr[4]="deprecated: TEST 4: compile bind disabled"
 arr[5]="TEST 5: compile user namespace disabled"
 arr[6]="TEST 6: compile network disabled"
 arr[7]="TEST 7: compile X11 disabled"
@@ -14,7 +14,7 @@ arr[11]="TEST 11: compile disable global config"
 arr[12]="TEST 12: compile apparmor"
 arr[13]="TEST 13: compile busybox"
 arr[14]="TEST 14: compile overlayfs disabled"
-arr[15]="TEST 15: compile apparmor enabled"
+arr[14]="TEST 15: compile private-home disabled"
 
 # remove previous reports and output file
 cleanup() {
@@ -108,24 +108,6 @@ cp output-make om3
 rm output-configure output-make
 
 #*****************************************************************
-# TEST 4
-#*****************************************************************
-# - disable bind configuration
-#*****************************************************************
-print_title "${arr[4]}"
-# seccomp
-cd firejail
-make distclean
-./configure --prefix=/usr --disable-bind  --enable-fatal-warnings 2>&1 | tee ../output-configure
-make -j4 2>&1 | tee ../output-make
-cd ..
-grep Warning output-configure output-make > ./report-test4
-grep Error output-configure output-make >> ./report-test4
-cp output-configure oc4
-cp output-make om4
-rm output-configure output-make
-
-#*****************************************************************
 # TEST 5
 #*****************************************************************
 # - disable user namespace configuration
@@ -292,13 +274,13 @@ rm output-configure output-make
 #*****************************************************************
 # TEST 15
 #*****************************************************************
-# - enable apparmor
+# - disable private home
 #*****************************************************************
 print_title "${arr[15]}"
 # seccomp
 cd firejail
 make distclean
-./configure --prefix=/usr --enable-apparmor --enable-fatal-warnings 2>&1 | tee ../output-configure
+./configure --prefix=/usr --disable-private-home --enable-fatal-warnings 2>&1 | tee ../output-configure
 make -j4 2>&1 | tee ../output-make
 cd ..
 grep Warning output-configure output-make > ./report-test15
@@ -307,7 +289,6 @@ cp output-configure oc15
 cp output-make om15
 rm output-configure output-make
 
-
 #*****************************************************************
 # PRINT REPORTS
 #*****************************************************************