2 files changed, 79 insertions, 4 deletions

diff --git a/etc/k3b.profile b/etc/k3b.profile
index 68b825c5e..35b27a183 100644
--- a/etc/k3b.profile
+++ b/etc/k3b.profile
@@ -3,23 +3,24 @@
 include /etc/firejail/k3b.local
 
 # k3b profile
+noblacklist ~/.kde4/share/config/k3brc
+noblacklist ~/.kde/share/config/k3brc
+noblacklist ~/.config/k3brc
 include /etc/firejail/disable-common.inc
 include /etc/firejail/disable-programs.inc
 include /etc/firejail/disable-devel.inc
 include /etc/firejail/disable-passwdmgr.inc
 
 caps.drop all
-netfilter
-nogroups
+no3d
 nonewprivs
 noroot
 nosound
 shell none
 seccomp
 protocol unix
+tracelog
 
 # private-bin 
-# private-dev
 # private-tmp
 # private-etc
-
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 172aff121..c515accc0 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -830,6 +830,80 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+
+#ifdef HAVE_OVERLAYFS
+        if (strncmp(ptr, "overlay-named ", 14) == 0) {
+                if (checkcfg(CFG_OVERLAYFS)) {
+                        if (cfg.chrootdir) {
+                                fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
+                                exit(1);
+                        }
+                        struct stat s;
+                        if (stat("/proc/sys/kernel/grsecurity", &s) == 0) {
+                                fprintf(stderr, "Error: --overlay option is not available on Grsecurity systems\n");
+                                exit(1);
+                        }
+                        arg_overlay = 1;
+                        arg_overlay_keep = 1;
+                        arg_overlay_reuse = 1;
+
+                        char *subdirname = ptr + 14;
+                        if (subdirname == '\0') {
+                                fprintf(stderr, "Error: invalid overlay option\n");
+                                exit(1);
+                        }
+
+                        // check name
+                        invalid_filename(subdirname);
+                        if (strstr(subdirname, "..") || strstr(subdirname, "/")) {
+                                fprintf(stderr, "Error: invalid overlay name\n");
+                                exit(1);
+                        }
+                        cfg.overlay_dir = fs_check_overlay_dir(subdirname, arg_overlay_reuse);
+                }
+
+                return 0;
+        } else if (strcmp(ptr, "overlay-tmpfs") == 0) {
+                if (checkcfg(CFG_OVERLAYFS)) {
+                        if (cfg.chrootdir) {
+                                fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
+                                exit(1);
+                        }
+                        struct stat s;
+                        if (stat("/proc/sys/kernel/grsecurity", &s) == 0) {
+                                fprintf(stderr, "Error: --overlay option is not available on Grsecurity systems\n");
+                                exit(1);
+                        }
+                        arg_overlay = 1;
+
+                        return 0;
+                }
+        } else if (strcmp(ptr, "overlay") == 0) {
+                if (checkcfg(CFG_OVERLAYFS)) {
+                        if (cfg.chrootdir) {
+                                fprintf(stderr, "Error: --overlay and --chroot options are mutually exclusive\n");
+                                exit(1);
+                        }
+                        struct stat s;
+                        if (stat("/proc/sys/kernel/grsecurity", &s) == 0) {
+                                fprintf(stderr, "Error: --overlay option is not available on Grsecurity systems\n");
+                                exit(1);
+                        }
+                        arg_overlay = 1;
+                        arg_overlay_keep = 1;
+
+                        char *subdirname;
+                        if (asprintf(&subdirname, "%d", getpid()) == -1)
+                                errExit("asprintf");
+                        cfg.overlay_dir = fs_check_overlay_dir(subdirname, arg_overlay_reuse);
+
+                        free(subdirname);
+
+                        return 0;
+                }
+        }
+#endif
+
         // filesystem bind
         if (strncmp(ptr, "bind ", 5) == 0) {
 #ifdef HAVE_BIND