53 files changed, 1246 insertions, 391 deletions

diff --git a/README b/README
index 71e329792..17d5f1b3e 100644
--- a/README
+++ b/README
@@ -126,6 +126,7 @@ Zack Weinberg (https://github.com/zackw)
         - rework fcopy, --follow-link support in fcopy
         - follow link support in --private-bin
         - wait_for_other function rewrite
+        - xvfb X11 server support
 Austin S. Hemmelgarn (https://github.com/Ferroin)
         - unbound profile update
 Igor Bukanov (https://github.com/ibukanov)
@@ -154,6 +155,7 @@ SYN-cook (https://github.com/SYN-cook)
         - disable-common.inc fixes
         - blacklist GNOME keyring and Konqueror
         - fixed Keepass(x) profiles
+        - Engrampa profile
 thewisenerd (https://github.com/thewisenerd)
         - appimage: pass commandline arguments
 KOLANICH (https://github.com/KOLANICH)
diff --git a/README.md b/README.md
index 687877c73..62cb0daaf 100644
--- a/README.md
+++ b/README.md
@@ -145,6 +145,46 @@ Added AppImage type 2 support, and support for passing command line arguments to
 
               $ firejail --git-uninstall
 
+       --x11=xvfb
+              Start  Xvfb  X11  server  and attach the sandbox to this server.
+              Xvfb, short for X virtual framebuffer,  performs  all  graphical
+              operations  in memory without showing any screen output. Xvfb is
+              mainly used for remote access and software testing  on  headless
+              servers.
+
+              On Debian platforms Xvfb is installed with the command sudo apt-
+              get install xvfb.  This feature is not available when running as
+              root.
+
+              Example: remote VNC access
+
+              On  the  server we start a sandbox using Xvfb and openbox window
+              manager. The default size of Xvfb screen is 800x600 - it can  be
+              changed  in  /etc/firejail/firejail.config  (xvfb-screen).  Some
+              sort of networking (--net) is required in order to  isolate  the
+              abstract sockets used by other X servers.
+
+              $ firejail --net=none --x11=xvfb openbox
+
+              *** Attaching to Xvfb display 792 ***
+
+              Reading profile /etc/firejail/openbox.profile
+              Reading profile /etc/firejail/disable-common.inc
+              Reading profile /etc/firejail/disable-common.local
+              Parent pid 5400, child pid 5401
+
+              On  the  server  we also start a VNC server and attach it to the
+              display handled by our Xvfb server (792).
+
+              $ x11vnc -display :792
+
+              On the client machine we start a VNC viewer and use it  to  con‐
+              nect to our server:
+
+              $ vncviewer
+
+       --nowhitelist=dirname_or_filename
+              Disable whitelist for this directory or file.
 
 `````
 ## New Profiles
@@ -155,4 +195,4 @@ goobox, gpa, gpg, gpg-agent, highlight, img2txt, k3b, kate, lynx, mediainfo, nau
 simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget,
 xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5,
 PDFSam, Pithos, Xonotic, wireshark, keepassx2, QupZilla, FossaMail, Uzbl browser, xmms, iridium browser,
-Kino, Thunar
+Kino, Thunar, Geeqie, Engrampa
diff --git a/RELNOTES b/RELNOTES
index 54078875b..122d5cfbe 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -13,8 +13,6 @@ firejail (0.9.45) baseline; urgency=low
   * security: split seccomp filter code configuration in a separate executable
   * security: split file copying in private option in a separate executable
   * security: root exploit found by Sebastian Krahmer (CVE-2017-5180)
-  * security: ~/.pki directory whitelisted and later blacklisted. This affects 
-    most browsers, and disables the custom certificates installed by the user.
   * feature: disable gnupg and systemd directories under /run/user
   * feature: test coverage (gcov) support
   * feature: allow root user access to /dev/shm (--noblacklist=/dev/shm)
@@ -31,12 +29,20 @@ firejail (0.9.45) baseline; urgency=low
   * feature: added a number o Python scripts for handling sandboxes
   * feature: allow local customization using .local files under /etc/firejail
   * feature: follow-symlink-as-user runtime config option in /etc/firejail/firejail.config
+  * feature: follow-symlink-private-bin option in /etc/firejail/firejail.config
+  * feature: xvfb X11 server support (--x11=xvfb)
+  * feature: allow /tmp directory in mkdir and mkfile profile commands
+  * feature: implemented --noblacklist command, profile support
+  * feature: config support to disable access to /mnt and /media (disable-mnt)
+  * feature: allow tmpfs for regular users for files in home directory
+  * feature: mount a tmpfs on top of ~/.cache directory by default
+  * feature: config support to disable tmpfs mounting on ~/.cache (cache-tmpfs)
   * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire,
   * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
   * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
   * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos,
   * new profies: Xonotic, wireshark, keepassx2, QupZilla, FossaMail,
-  * new profiles: Uzbl browser, iridium browser, Thunar
+  * new profiles: Uzbl browser, iridium browser, Thunar, Geeqie, Engrampa
   * bugfixes
  -- netblue30 <netblue30@yahoo.com>  Sun, 23 Oct 2016 08:00:00 -0500
 
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 00473de95..a5c7502db 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -30,6 +30,7 @@ blacklist ${HOME}/.cache/darktable
 blacklist ${HOME}/.cache/epiphany
 blacklist ${HOME}/.cache/evolution
 blacklist ${HOME}/.cache/gajim
+blacklist ${HOME}/.cache/geeqie
 blacklist ${HOME}/.cache/google-chrome
 blacklist ${HOME}/.cache/google-chrome-beta
 blacklist ${HOME}/.cache/google-chrome-unstable
@@ -103,6 +104,7 @@ blacklist ${HOME}/.config/evolution
 blacklist ${HOME}/.config/filezilla
 blacklist ${HOME}/.config/flowblade
 blacklist ${HOME}/.config/gajim
+blacklist ${HOME}/.config/geeqie
 blacklist ${HOME}/.config/gedit
 blacklist ${HOME}/.config/google-chrome
 blacklist ${HOME}/.config/google-chrome-beta
@@ -221,6 +223,7 @@ blacklist ${HOME}/.local/share/epiphany
 blacklist ${HOME}/.local/share/evolution
 blacklist ${HOME}/.local/share/feral-interactive
 blacklist ${HOME}/.local/share/gajim
+blacklist ${HOME}/.local/share/geeqie
 blacklist ${HOME}/.local/share/gnome-2048
 blacklist ${HOME}/.local/share/gnome-chess
 blacklist ${HOME}/.local/share/gnome-music
@@ -284,6 +287,7 @@ blacklist ${HOME}/.weechat
 blacklist ${HOME}/.wine
 blacklist ${HOME}/.wine64
 blacklist ${HOME}/.xiphos
+blacklist ${HOME}/.xmms
 blacklist ${HOME}/.xonotic
 blacklist ${HOME}/.xpdfrc
 blacklist ${HOME}/.zoom
diff --git a/etc/engrampa.profile b/etc/engrampa.profile
index b30b53085..da4872ca0 100644
--- a/etc/engrampa.profile
+++ b/etc/engrampa.profile
@@ -13,7 +13,6 @@ nogroups
 nonewprivs
 noroot
 nosound
-no3d
 protocol unix
 seccomp
 netfilter
diff --git a/etc/firefox.profile b/etc/firefox.profile
index e323cac91..e2cfb9138 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -54,5 +54,5 @@ include /etc/firejail/whitelist-common.inc
 # experimental features
 #private-bin firefox,which,sh,dbus-launch,dbus-send,env
 #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
-private-dev
-private-tmp
+private-dev 
+#private-tmp
diff --git a/etc/firejail.config b/etc/firejail.config
index 766802a7d..0887e05b5 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -6,6 +6,9 @@
 # Enable or disable bind support, default enabled.
 # bind yes
 
+# Enable mounting a tmpfs on top of ~/.cache directory, default enabled.
+# cache-tmpfs yes
+
 # Enable or disable chroot support, default enabled.
 # chroot yes
 
@@ -14,6 +17,10 @@
 # and it will harden the rest of the chroot tree.
 # chroot-desktop yes
 
+# Disable /mnt, /media, /run/mount and /run/media access. By default access
+# to these directories is enabled.
+# disable-mnt no
+
 # Enable or disable file transfer support, default enabled.
 # file-transfer yes
 
@@ -26,6 +33,10 @@
 # Enabled by default
 # follow-symlink-as-user yes
 
+# Follow symlink for private-bin command.
+# Disabled by default
+# follow-symlink-private-bin no
+
 # Force use of nonewprivs.  This mitigates the possibility of
 # a user abusing firejail's features to trick a privileged (suid
 # or file capabilities) process into loading code or configuration
diff --git a/etc/geeqie.profile b/etc/geeqie.profile
new file mode 100644
index 000000000..57f942a50
--- /dev/null
+++ b/etc/geeqie.profile
@@ -0,0 +1,27 @@
+# This file is overwritten during software install.
+# Persistent customizations should go in a .local file.
+include /etc/firejail/geeqie.local
+
+# Firejail profile for Geeqie
+noblacklist ~/.cache/geeqie
+noblacklist ~/.config/geeqie
+noblacklist ~/.local/share/geeqie
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-passwdmgr.inc
+
+caps.drop all
+nogroups
+nonewprivs
+noroot
+protocol unix
+seccomp
+nosound
+
+private-dev
+
+#Experimental:
+shell none
+#private-bin geeqie
+#private-etc X11
diff --git a/etc/vlc.profile b/etc/vlc.profile
index 9d1cdb4c8..0c96f0108 100644
--- a/etc/vlc.profile
+++ b/etc/vlc.profile
@@ -20,5 +20,5 @@ seccomp
 shell none
 
 private-bin vlc,cvlc,nvlc,rvlc,qvlc,svlc
-private-dev
+# private-dev
 private-tmp
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index edaf1781b..c4868981b 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -249,3 +249,5 @@
 /etc/firejail/kino.profile
 /etc/firejail/Thunar.profile
 /etc/firejail/thunar.profile
+/etc/firejail/geeqie.profile
+/etc/firejail/engrampa.profile
diff --git a/src/bash_completion/firejail.bash_completion b/src/bash_completion/firejail.bash_completion
index 0f71c74dc..38548c42b 100644
--- a/src/bash_completion/firejail.bash_completion
+++ b/src/bash_completion/firejail.bash_completion
@@ -43,10 +43,18 @@ _firejail()
             _filedir
             return 0
             ;;
+        --noblacklist)
+            _filedir
+            return 0
+            ;;
         --whitelist)
             _filedir
             return 0
             ;;
+        --nowhitelist)
+            _filedir
+            return 0
+            ;;
        --read-only)
             _filedir
             return 0
diff --git a/src/faudit/seccomp.c b/src/faudit/seccomp.c
index fe814598b..1c188aa45 100644
--- a/src/faudit/seccomp.c
+++ b/src/faudit/seccomp.c
@@ -54,7 +54,7 @@ void seccomp_test(void) {
                 printf("BAD: seccomp disabled. Use \"firejail --seccomp\" to enable it.\n");
         }
         else if (seccomp_status == 1)
-                printf("GOOD: seccomp strict mode - only  read, write, _exit, and sigreturn are allowd.\n");
+                printf("GOOD: seccomp strict mode - only  read, write, _exit, and sigreturn are allowed.\n");
         else if (seccomp_status == 2) {
                 printf("GOOD: seccomp BPF enabled.\n");
 
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 7c959cd04..3c1ecc573 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -113,6 +113,7 @@ dolphin
 dragon
 exiftool
 feh
+geeqie
 gjs
 gnome-books
 gnome-clocks
diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index 521187e3a..30693f7a0 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -183,8 +183,10 @@ static int caps_find_name(const char *name) {
 // return 1 if error, 0 if OK
 void caps_check_list(const char *clist, void (*callback)(int)) {
         // don't allow empty lists
-        if (clist == NULL || *clist == '\0')
-                goto errexit;
+        if (clist == NULL || *clist == '\0') {
+                fprintf(stderr, "Error: empty capabilities list\n");
+                exit(1);
+        }
 
         // work on a copy of the string
         char *str = strdup(clist);
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index dff892ea3..476ecbe10 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -27,6 +27,8 @@ static int initialized = 0;
 static int cfg_val[CFG_MAX];
 char *xephyr_screen = "800x600";
 char *xephyr_extra_params = "";
+char *xvfb_screen = "800x600x24";
+char *xvfb_extra_params = "";
 char *netfilter_default = NULL;
 
 int checkcfg(int val) {
@@ -41,9 +43,11 @@ int checkcfg(int val) {
                 for (i = 0; i < CFG_MAX; i++)
                         cfg_val[i] = 1; // most of them are enabled by default
                 cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
-                cfg_val[CFG_FORCE_NONEWPRIVS] = 0; // disabled by default
-                cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0; // disabled by default
-                cfg_val[CFG_FIREJAIL_PROMPT] = 0; // disabled by default
+                cfg_val[CFG_FORCE_NONEWPRIVS] = 0;
+                cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0;
+                cfg_val[CFG_FIREJAIL_PROMPT] = 0;
+                cfg_val[CFG_FOLLOW_SYMLINK_PRIVATE_BIN] = 0;
+                cfg_val[CFG_DISABLE_MNT] = 0;
                 
                 // open configuration file
                 const char *fname = SYSCONFDIR "/firejail.config";
@@ -70,8 +74,17 @@ int checkcfg(int val) {
                         if (!ptr)
                                 continue;
                         
+                        // mount tmpfs on top of ~/.cache directory
+                        if (strncmp(ptr, "cache-tmpfs ", 12) == 0) {
+                                if (strcmp(ptr + 12, "yes") == 0)
+                                        cfg_val[CFG_CACHE_TMPFS] = 1;
+                                else if (strcmp(ptr + 12, "no") == 0)
+                                        cfg_val[CFG_CACHE_TMPFS] = 0;
+                                else
+                                        goto errout;
+                        }
                         // file transfer        
-                        if (strncmp(ptr, "file-transfer ", 14) == 0) {
+                        else if (strncmp(ptr, "file-transfer ", 14) == 0) {
                                 if (strcmp(ptr + 14, "yes") == 0)
                                         cfg_val[CFG_FILE_TRANSFER] = 1;
                                 else if (strcmp(ptr + 14, "no") == 0)
@@ -133,6 +146,15 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // follow symlink in private-bin command
+                        else if (strncmp(ptr, "follow-symlink-private-bin ", 27) == 0) {
+                                if (strcmp(ptr + 27, "yes") == 0)
+                                        cfg_val[CFG_FOLLOW_SYMLINK_PRIVATE_BIN] = 1;
+                                else if (strcmp(ptr + 27, "no") == 0)
+                                        cfg_val[CFG_FOLLOW_SYMLINK_PRIVATE_BIN] = 0;
+                                else
+                                        goto errout;
+                        }
                         // nonewprivs
                         else if (strncmp(ptr, "force-nonewprivs ", 17) == 0) {
                                 if (strcmp(ptr + 17, "yes") == 0)
@@ -234,6 +256,28 @@ int checkcfg(int val) {
                                         errExit("strdup");
                         }
                         
+                        // Xvfb screen size
+                        else if (strncmp(ptr, "xvfb-screen ", 12) == 0) {
+                                // expecting three numbers separated by x's
+                                unsigned int n1;
+                                unsigned int n2;
+                                unsigned int n3;
+                                int rv = sscanf(ptr + 12, "%ux%ux%u", &n1, &n2, &n3);
+                                if (rv != 3)
+                                        goto errout;
+                                if (asprintf(&xvfb_screen, "%ux%ux%u", n1, n2, n3) == -1)
+                                        errExit("asprintf");
+                        }
+
+                        // Xvfb extra parameters
+                        else if (strncmp(ptr, "xvfb-extra-params ", 18) == 0) {
+                                if (*xvfb_extra_params != '\0')
+                                        goto errout;
+                                xvfb_extra_params = strdup(ptr + 18);
+                                if (!xvfb_extra_params)
+                                        errExit("strdup");
+                        }
+                        
                         // quiet by default
                         else if (strncmp(ptr, "quiet-by-default ", 17) == 0) {
                                 if (strcmp(ptr + 17, "yes") == 0)
@@ -280,6 +324,14 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        else if (strncmp(ptr, "disable-mnt ", 12) == 0) {
+                                if (strcmp(ptr + 12, "yes") == 0)
+                                        cfg_val[CFG_DISABLE_MNT] = 1;
+                                else if (strcmp(ptr + 12, "no") == 0)
+                                        cfg_val[CFG_DISABLE_MNT] = 0;
+                                else
+                                        goto errout;
+                        }
                         else
                                 goto errout;
 
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index fbf83abb3..fa6ba5c6a 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -419,6 +419,7 @@ void profile_read(const char *fname);
 int profile_check_line(char *ptr, int lineno, const char *fname);
 // add a profile entry in cfg.profile list; use str to populate the list
 void profile_add(char *str);
+void fs_mnt(void);
 
 // list.c
 void list(void);
@@ -644,13 +645,13 @@ void fs_mkdir(const char *name);
 void fs_mkfile(const char *name);
 
 // x11.c
-extern int mask_x11_abstract_socket;
 void fs_x11(void);
 int x11_display(void);
 void x11_start(int argc, char **argv);
 void x11_start_xpra(int argc, char **argv);
 void x11_start_xephyr(int argc, char **argv);
 void x11_block(void);
+void x11_start_xvfb(int argc, char **argv);
 
 // ls.c
 enum {
@@ -681,10 +682,15 @@ enum {
         CFG_PRIVATE_BIN_NO_LOCAL,
         CFG_FIREJAIL_PROMPT,
         CFG_FOLLOW_SYMLINK_AS_USER,
+        CFG_FOLLOW_SYMLINK_PRIVATE_BIN,
+        CFG_DISABLE_MNT,
+        CFG_CACHE_TMPFS,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
 extern char *xephyr_extra_params;
+extern char *xvfb_screen;
+extern char *xvfb_extra_params;
 extern char *netfilter_default;
 int checkcfg(int val);
 void print_compiletime_support(void);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index c386f70cf..3413febcb 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -255,7 +255,9 @@ void fs_blacklist(void) {
                 char *ptr;
 
                 // whitelist commands handled by fs_whitelist()
-                if (strncmp(entry->data, "whitelist ", 10) == 0 || *entry->data == '\0') {
+                if (strncmp(entry->data, "whitelist ", 10) == 0 || 
+                    strncmp(entry->data, "nowhitelist ", 12) == 0 ||
+                   *entry->data == '\0') {
                         entry = entry->next;
                         continue;
                 }
@@ -469,7 +471,24 @@ void fs_noexec(const char *dir) {
         }
 }
 
+// Disable /mnt, /media, /run/mount and /run/media access
+void fs_mnt(void) {
+        disable_file(BLACKLIST_FILE, "/mnt");
+        disable_file(BLACKLIST_FILE, "/media");
+        disable_file(BLACKLIST_FILE, "/run/mount");
+        disable_file(BLACKLIST_FILE, "//run/media");
+}
+
 
+void fs_cache(void) {
+        if (arg_debug)
+                printf("Deploy ~/.cache tmpfs\n");
+        char *cache;
+        if (asprintf(&cache, "%s/.cache", cfg.homedir) == -1)
+                errExit("asprintf");
+        disable_file(MOUNT_TMPFS, cache);
+        free(cache);
+}
 
 // mount /proc and /sys directories
 void fs_proc_sys_dev_boot(void) {
@@ -1084,7 +1103,6 @@ void fs_check_chroot_dir(const char *rootdir) {
 
         // check x11 socket directory
         if (getenv("FIREJAIL_X11")) {
-                mask_x11_abstract_socket = 1;
                 char *name;
                 if (asprintf(&name, "%s/tmp/.X11-unix", rootdir) == -1)
                         errExit("asprintf");
@@ -1117,7 +1135,6 @@ void fs_chroot(const char *rootdir) {
                 
                 // x11
                 if (getenv("FIREJAIL_X11")) {
-                        mask_x11_abstract_socket = 1;
                         char *newx11;
                         if (asprintf(&newx11, "%s/tmp/.X11-unix", rootdir) == -1)
                                 errExit("asprintf");
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 3473fca4c..73edd2ef9 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -111,7 +111,10 @@ static void duplicate(char *fname) {
                 errExit("asprintf");
         
         // copy the file
-        sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", full_path, RUN_BIN_DIR);
+        if (checkcfg(CFG_FOLLOW_SYMLINK_PRIVATE_BIN))
+                sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", full_path, RUN_BIN_DIR);
+        else
+                sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, full_path, RUN_BIN_DIR);
         fs_logger2("clone", fname);
         free(full_path);
 }
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c
index a0bda7443..f90b7df60 100644
--- a/src/firejail/fs_mkdir.c
+++ b/src/firejail/fs_mkdir.c
@@ -61,8 +61,9 @@ void fs_mkdir(const char *name) {
         // check directory name
         invalid_filename(name);
         char *expanded = expand_home(name, cfg.homedir);
-        if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0) {
-                fprintf(stderr, "Error: only directories in user home are supported by mkdir\n");
+        if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 &&
+            strncmp(expanded, "/tmp", 4) != 0) {
+                fprintf(stderr, "Error: only directories in user home or /tmp are supported by mkdir\n");
                 exit(1);
         }
 
@@ -100,8 +101,9 @@ void fs_mkfile(const char *name) {
         // check file name
         invalid_filename(name);
         char *expanded = expand_home(name, cfg.homedir);
-        if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0) {
-                fprintf(stderr, "Error: only files in user home are supported by mkfile\n");
+        if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 &&
+            strncmp(expanded, "/tmp", 4) != 0) {
+                fprintf(stderr, "Error: only files in user home or /tmp are supported by mkfile\n");
                 exit(1);
         }
 
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 1794e4b35..7ad5ffeb8 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -35,7 +35,7 @@ static char *dentry[] = {
 };
 
 #define MAXBUF 4098
-static char *resolve_downloads(void) {
+static char *resolve_downloads(int nowhitelist_flag) {
         char *fname;
         struct stat s;
 
@@ -50,8 +50,14 @@ static char *resolve_downloads(void) {
                                 printf("Downloads directory resolved as \"%s\"\n", fname);
                         
                         char *rv;
-                        if (asprintf(&rv, "whitelist ~/%s", dentry[i]) == -1)
-                                errExit("asprintf");
+                        if (nowhitelist_flag) {
+                                if (asprintf(&rv, "nowhitelist ~/%s", dentry[i]) == -1)
+                                        errExit("asprintf");
+                        }
+                        else {
+                                if (asprintf(&rv, "whitelist ~/%s", dentry[i]) == -1)
+                                        errExit("asprintf");
+                        }
                         free(fname);
                         return rv;
                 }
@@ -101,8 +107,14 @@ static char *resolve_downloads(void) {
                                         }
                                 
                                         char *rv;
-                                        if (asprintf(&rv, "whitelist ~/%s", ptr + 24) == -1)
-                                                errExit("asprintf");
+                                        if (nowhitelist_flag) {
+                                                if (asprintf(&rv, "nowhitelist ~/%s", ptr + 24) == -1)
+                                                        errExit("asprintf");
+                                        }
+                                        else {
+                                                if (asprintf(&rv, "whitelist ~/%s", ptr + 24) == -1)
+                                                        errExit("asprintf");
+                                        }
                                         return rv;
                                 }
                                 else
@@ -309,38 +321,54 @@ void fs_whitelist(void) {
         int var_dir = 0;                // /var directory flag
         int dev_dir = 0;                // /dev directory flag
         int opt_dir = 0;                // /opt directory flag
-        int srv_dir = 0;                // /srv directory flag
+        int srv_dir = 0;                // /srv directory flag
+
+        size_t nowhitelist_c = 0;
+        size_t nowhitelist_m = 32;
+        char **nowhitelist = calloc(nowhitelist_m, sizeof(*nowhitelist));
+        if (nowhitelist == NULL)
+                errExit("failed allocating memory for nowhitelist entries");
+        
         // verify whitelist files, extract symbolic links, etc.
         while (entry) {
-                // handle only whitelist commands
-                if (strncmp(entry->data, "whitelist ", 10)) {
+                int nowhitelist_flag = 0;
+        
+                // handle only whitelist and nowhitelist commands
+                if (strncmp(entry->data, "whitelist ", 10) == 0)
+                        nowhitelist_flag = 0;
+                else if (strncmp(entry->data, "nowhitelist ", 12) == 0)
+                        nowhitelist_flag = 1;
+                else {
                         entry = entry->next;
                         continue;
                 }
+                char *dataptr = (nowhitelist_flag)? entry->data + 12: entry->data + 10;
 
                 // resolve ${DOWNLOADS}
-                if (strcmp(entry->data + 10, "${DOWNLOADS}") == 0) {
-                        char *tmp = resolve_downloads();
-                        if (tmp)
+                if (strcmp(dataptr, "${DOWNLOADS}") == 0) {
+                        char *tmp = resolve_downloads(nowhitelist_flag);
+                        if (tmp) {
                                 entry->data = tmp;
+                                dataptr = (nowhitelist_flag)? entry->data + 12: entry->data + 10;
+                        }
                         else {
+                                if (!nowhitelist_flag) {
+                                        fprintf(stderr, "***\n");
+                                        fprintf(stderr, "*** Warning: cannot whitelist Downloads directory\n");
+                                        fprintf(stderr, "*** \tAny file saved will be lost when the sandbox is closed.\n");
+                                        fprintf(stderr, "*** \tPlease create a proper Downloads directory for your application.\n");
+                                        fprintf(stderr, "***\n");
+                                }
                                 *entry->data = '\0';
-                                fprintf(stderr, "***\n");
-                                fprintf(stderr, "*** Warning: cannot whitelist Downloads directory\n");
-                                fprintf(stderr, "*** \tAny file saved will be lost when the sandbox is closed.\n");
-                                fprintf(stderr, "*** \tPlease create a proper Downloads directory for your application.\n");
-                                fprintf(stderr, "***\n");
                                 continue;
                         }
                 }
 
                 // replace ~/ or ${HOME} into /home/username
-//              if (new_name)
-//                      free(new_name);
-                new_name = expand_home(entry->data + 10, cfg.homedir);
+                new_name = expand_home(dataptr, cfg.homedir);
                 assert(new_name);
                 if (arg_debug)
-                        fprintf(stderr, "Debug %d: new_name #%s#\n", __LINE__, new_name);
+                        fprintf(stderr, "Debug %d: new_name #%s#, %s\n", __LINE__, new_name, (nowhitelist_flag)? "nowhitelist": "whitelist");
 
                 // valid path referenced to filesystem root
                 if (*new_name != '/') {
@@ -356,37 +384,56 @@ void fs_whitelist(void) {
                 if (!fname) {
                         // file not found, blank the entry in the list and continue
                         if (arg_debug || arg_debug_whitelists) {
-                                printf("Removed whitelist path: %s\n", entry->data);
+                                printf("Removed whitelist/nowhitelist path: %s\n", entry->data);
                                 printf("\texpanded: %s\n", new_name);
                                 printf("\treal path: (null)\n");
                                 printf("\t");fflush(0);
                                 perror("realpath");
                         }
-                        *entry->data = '\0';
 
                         // if 1 the file was not found; mount an empty directory
-                        if (strncmp(new_name, cfg.homedir, strlen(cfg.homedir)) == 0) {
-                                if(!arg_private)
-                                        home_dir = 1;
+                        if (!nowhitelist_flag) {
+                                if (strncmp(new_name, cfg.homedir, strlen(cfg.homedir)) == 0) {
+                                        if(!arg_private)
+                                                home_dir = 1;
+                                }
+                                else if (strncmp(new_name, "/tmp/", 5) == 0)
+                                        tmp_dir = 1;
+                                else if (strncmp(new_name, "/media/", 7) == 0)
+                                        media_dir = 1;
+                                else if (strncmp(new_name, "/mnt/", 5) == 0)
+                                        mnt_dir = 1;
+                                else if (strncmp(new_name, "/var/", 5) == 0)
+                                        var_dir = 1;
+                                else if (strncmp(new_name, "/dev/", 5) == 0)
+                                        dev_dir = 1;
+                                else if (strncmp(new_name, "/opt/", 5) == 0)
+                                        opt_dir = 1;
+                                else if (strncmp(new_name, "/srv/", 5) == 0)
+                                        opt_dir = 1;
                         }
-                        else if (strncmp(new_name, "/tmp/", 5) == 0)
-                                tmp_dir = 1;
-                        else if (strncmp(new_name, "/media/", 7) == 0)
-                                media_dir = 1;
-                        else if (strncmp(new_name, "/mnt/", 5) == 0)
-                                mnt_dir = 1;
-                        else if (strncmp(new_name, "/var/", 5) == 0)
-                                var_dir = 1;
-                        else if (strncmp(new_name, "/dev/", 5) == 0)
-                                dev_dir = 1;
-                        else if (strncmp(new_name, "/opt/", 5) == 0)
-                                opt_dir = 1;
-                        else if (strncmp(new_name, "/srv/", 5) == 0)
-                                opt_dir = 1;
                         
+                        *entry->data = '\0';
+                        continue;
+                }
+                
+                if (nowhitelist_flag) {
+                        // store the path in nowhitelist array
+                        if (arg_debug || arg_debug_whitelists)
+                                printf("Storing nowhitelist %s\n", fname);
+                                
+                        if (nowhitelist_c >= nowhitelist_m) {
+                                nowhitelist_m *= 2;
+                                nowhitelist = realloc(nowhitelist, sizeof(*nowhitelist) * nowhitelist_m);
+                                if (nowhitelist == NULL)
+                                        errExit("failed increasing memory for nowhitelist entries");
+                        }
+                        nowhitelist[nowhitelist_c++] = fname;
+                        *entry->data = 0;
                         continue;
                 }
                 
+                
                 // check for supported directories
                 if (strncmp(new_name, cfg.homedir, strlen(cfg.homedir)) == 0) {
                         // whitelisting home directory is disabled if --private option is present
@@ -479,6 +526,27 @@ void fs_whitelist(void) {
                         goto errexit;
                 }
 
+                // check if the path is in nowhitelist array
+                if (nowhitelist_flag == 0) {
+                        size_t i;
+                        int found = 0;
+                        for (i = 0; i < nowhitelist_c; i++) {
+                                if (nowhitelist[i] == NULL)
+                                        break;
+                                if (strcmp(nowhitelist[i], fname) == 0) {
+                                        found = 1;
+                                        break;
+                                }
+                        }
+                        if (found) {
+                                if (arg_debug || arg_debug_whitelists)
+                                        printf("Skip nowhitelisted path %s\n", fname);
+                                *entry->data = 0;
+                                free(fname);
+                                continue;
+                        }
+                }       
+
                 // mark symbolic links
                 if (is_link(new_name))
                         entry->link = new_name;
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 310795abf..aead29957 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -349,6 +349,14 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 else
                         exit_err_feature("x11");
         }
+        else if (strcmp(argv[i], "--x11=xvfb") == 0) {
+                if (checkcfg(CFG_X11)) {
+                        x11_start_xvfb(argc, argv);
+                        exit(0);
+                }
+                else
+                        exit_err_feature("x11");
+        }
 #endif
 #ifdef HAVE_NETWORK     
         else if (strncmp(argv[i], "--bandwidth=", 12) == 0) {
@@ -1261,6 +1269,14 @@ int main(int argc, char **argv) {
                         else
                                 exit_err_feature("whitelist");
                 }
+                else if (strncmp(argv[i], "--nowhitelist=", 14) == 0) {
+                        char *line;
+                        if (asprintf(&line, "nowhitelist %s", argv[i] + 14) == -1)
+                                errExit("asprintf");
+                        
+                        profile_check_line(line, 0, NULL);      // will exit if something wrong
+                        profile_add(line);
+                }
 #endif          
 
                 else if (strncmp(argv[i], "--read-only=", 12) == 0) {
@@ -2182,10 +2198,6 @@ int main(int argc, char **argv) {
                         fprintf(stderr, "Warning: --trace and --tracelog are mutually exclusive; --tracelog disabled\n");
         }
         
-        // disable x11 abstract socket
-        if (getenv("FIREJAIL_X11"))
-                mask_x11_abstract_socket = 1;
-        
         // check user namespace (--noroot) options
         if (arg_noroot) {
                 if (arg_overlay) {
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 1828405db..7cca6b291 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -171,7 +171,7 @@ void run_no_sandbox(int argc, char **argv) {
                     strcmp(argv[i], "--zsh") == 0 ||
                     strcmp(argv[i], "--shell=none") == 0 ||
                     strncmp(argv[i], "--shell=", 8) == 0)
-                        fprintf(stderr, "Warning: shell-related command line options are disregarded - using SHELL environment variable");
+                        fprintf(stderr, "Warning: shell-related command line options are disregarded - using SHELL environment variable\n");
         }
 
         // use $SHELL to get shell used in sandbox
diff --git a/src/firejail/output.c b/src/firejail/output.c
index 4872c57ba..cea4f4e28 100644
--- a/src/firejail/output.c
+++ b/src/firejail/output.c
@@ -26,50 +26,45 @@ void check_output(int argc, char **argv) {
         EUID_ASSERT();
         
         int i;
-        char *outfile = NULL;
+        int outindex = 0;
 
-        int found = 0;
         for (i = 1; i < argc; i++) {
                 if (strncmp(argv[i], "--output=", 9) == 0) {
-                        found = 1;
-                        invalid_filename(argv[i] + 9);
-                        outfile = argv[i] + 9;
-
-                        // do not accept directories, links, and files with ".."
-                        if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
-                                fprintf(stderr, "Error: invalid output file. Links, directories and files with \"..\" are not allowed.\n");
-                                exit(1);
-                        }
-                        
-                        struct stat s;
-                        if (stat(outfile, &s) == 0) {
-                                // check permissions
-                                if (s.st_uid != getuid() || s.st_gid != getgid()) {
-                                        fprintf(stderr, "Error: the output file needs to be owned by the current user.\n");
-                                        exit(1);
-                                }
-                                
-                                // check hard links
-                                if (s.st_nlink != 1) {
-                                        fprintf(stderr, "Error: no hard links allowed.\n");
-                                        exit(1);
-                                }
-                        }
-
-                        /* coverity[toctou] */
-                        FILE *fp = fopen(outfile, "a");
-                        if (!fp) {
-                                fprintf(stderr, "Error: cannot open output file %s\n", outfile);
-                                exit(1);
-                        }
-                        fclose(fp);
+                        outindex = i;
                         break;
                 }
         }
-        if (!found)
+        if (!outindex)
                 return;
 
 
+        // check filename
+        drop_privs(0);
+        char *outfile = NULL;
+        invalid_filename(argv[outindex] + 9);
+        outfile = argv[outindex] + 9;
+
+        // do not accept directories, links, and files with ".."
+        if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
+                fprintf(stderr, "Error: invalid output file. Links, directories and files with \"..\" are not allowed.\n");
+                exit(1);
+        }
+        
+        struct stat s;
+        if (stat(outfile, &s) == 0) {
+                // check permissions
+                if (s.st_uid != getuid() || s.st_gid != getgid()) {
+                        fprintf(stderr, "Error: the output file needs to be owned by the current user.\n");
+                        exit(1);
+                }
+                
+                // check hard links
+                if (s.st_nlink != 1) {
+                        fprintf(stderr, "Error: no hard links allowed.\n");
+                        exit(1);
+                }
+        }
+
         // build the new command line
         int len = 0;
         for (i = 0; i < argc; i++) {
@@ -90,7 +85,6 @@ void check_output(int argc, char **argv) {
         sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile);
 
         // run command
-        drop_privs(0);
         char *a[4];
         a[0] = "/bin/bash";
         a[1] = "-c";
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 5684a2d95..00dd87dad 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -696,7 +696,6 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
                         if (x11env && strcmp(x11env, "yes") == 0) {
-                                mask_x11_abstract_socket = 1;
                                 return 0;
                         }
                         else {
@@ -720,12 +719,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #endif
                 return 0;
         }
+        
         if (strcmp(ptr, "x11 xpra") == 0) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
                         if (x11env && strcmp(x11env, "yes") == 0) {
-                                mask_x11_abstract_socket = 1;
                                 return 0;
                         }
                         else {
@@ -740,12 +739,30 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         
+        if (strcmp(ptr, "x11 xvfb") == 0) {
+#ifdef HAVE_X11
+                if (checkcfg(CFG_X11)) {
+                        char *x11env = getenv("FIREJAIL_X11");
+                        if (x11env && strcmp(x11env, "yes") == 0) {
+                                return 0;
+                        }
+                        else {
+                                // start x11
+                                x11_start_xvfb(cfg.original_argc, cfg.original_argv);
+                                exit(0);
+                        }
+                }
+                else
+                        warning_feature_disabled("x11");
+#endif
+                return 0;
+        }
+
         if (strcmp(ptr, "x11") == 0) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
                         char *x11env = getenv("FIREJAIL_X11");
                         if (x11env && strcmp(x11env, "yes") == 0) {
-                                mask_x11_abstract_socket = 1;
                                 return 0;
                         }
                         else {
@@ -943,6 +960,8 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
 #endif
         }
+        else if (strncmp(ptr, "nowhitelist ", 12) == 0)
+                ptr += 12;
         else if (strncmp(ptr, "read-only ", 10) == 0)
                 ptr += 10;
         else if (strncmp(ptr, "read-write ", 11) == 0)
@@ -951,8 +970,19 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 ptr += 7;
         else if (strncmp(ptr, "tmpfs ", 6) == 0) {
                 if (getuid() != 0) {
-                        fprintf(stderr, "Error: tmpfs available only when running the sandbox as root\n");
-                        exit(1);
+                        // allow a non-root user  to mount tmpfs in user home directory, links are not allowed
+                        invalid_filename(ptr + 6);
+                        char *newfname = expand_home(ptr + 6, cfg.homedir);
+                        assert(newfname);
+                        if (is_link(newfname)) {
+                                fprintf(stderr, "Error: for regular user, tmpfs is not available for symbolic links\n");
+                                exit(1);        
+                        }
+                        if (strncmp(newfname, cfg.homedir, strlen(cfg.homedir)) != 0) {
+                                fprintf(stderr, "Error: for regular user, tmpfs is available only for files in user home directory\n");
+                                exit(1);        
+                        }
+                        free(newfname);
                 }
                 ptr += 6;
         }
@@ -1025,7 +1055,8 @@ void profile_read(const char *fname) {
         }
         if (access(fname, R_OK)) {
                 // if the file ends in ".local", do not exit
-                char *ptr = strstr(fname, ".local");
+                const char *base = gnu_basename(fname);
+                char *ptr = strstr(base, ".local");
                 if (ptr && strlen(ptr) == 6)
                         return;
                 
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 84ee5ee11..f26f8b06a 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -208,6 +208,11 @@ static int monitor_application(pid_t app_pid) {
                 while(rv != monitored_pid);
                 if (arg_debug)
                         printf("Sandbox monitor: waitpid %u retval %d status %d\n", monitored_pid, rv, status);
+                if (rv == -1) { // we can get here if we have processes joining the sandbox (ECHILD)
+                        if (arg_debug)
+                                perror("waitpid");
+                        sleep(1);
+                }
 
                 // if /proc is not remounted, we cannot check /proc directory,
                 // for now we just get out of here
@@ -759,12 +764,25 @@ int sandbox(void* sandbox_arg) {
                 netns_mounts(arg_netns);
         
         //****************************
-        // update /proc, /sys, /dev, /boot directorymy
+        // update /proc, /sys, /dev, /boot directory
         //****************************
         if (checkcfg(CFG_REMOUNT_PROC_SYS))
                 fs_proc_sys_dev_boot();
         
         //****************************
+        // handle /mnt and /media
+        //****************************
+        if (checkcfg(CFG_DISABLE_MNT))
+                fs_mnt();
+
+        //****************************
+        // deploy a tmpfs on ~/.cache directory
+        //****************************
+        if (checkcfg(CFG_CACHE_TMPFS))
+                fs_cache();
+
+
+        //****************************
         // apply the profile file
         //****************************
         // apply all whitelist commands ... 
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index ae3993aec..9c91b4630 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -127,6 +127,7 @@ void usage(void) {
         printf("    --noroot - install a user namespace with only the current user.\n");
 #endif
         printf("    --nonewprivs - sets the NO_NEW_PRIVS prctl.\n");
+        printf("    --nowhitelist=filename - disable whitelist for file or directory .\n");
         printf("    --output=logfile - stdout logging and log rotation.\n");
         printf("    --overlay - mount a filesystem overlay on top of the current filesystem.\n");
         printf("    --overlay-named=name - mount a filesystem overlay on top of the current\n");
@@ -205,6 +206,7 @@ void usage(void) {
         printf("    --x11=xephyr - enable Xephyr X11 server. The window size is 800x600.\n");
         printf("    --x11=xorg - enable X11 security extension.\n");
         printf("    --x11=xpra - enable Xpra X11 server.\n");
+        printf("    --x11=xvfb - enable Xvfb X11 server.\n");
         printf("    --zsh - use /usr/bin/zsh as default shell.\n");
         printf("\n");
         printf("Examples:\n");
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 5bbc327a6..b72b46f0d 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -31,46 +31,45 @@
 #include <sys/wait.h>
 #include <errno.h>
 #include <limits.h>
-int mask_x11_abstract_socket = 0;
-
 
 // Parse the DISPLAY environment variable and return a display number.
 // Returns -1 if DISPLAY is not set, or is set to anything other than :ddd.
 int x11_display(void) {
-        const char *display_str = getenv("DISPLAY");
-        char *endp;
-        unsigned long display;
-
-        if (!display_str) {
-                if (arg_debug)
-                        fputs("DISPLAY is not set\n", stderr);
-                return -1;
-        }
-
-        if (display_str[0] != ':' || display_str[1] < '0' || display_str[1] > '9') {
-                if (arg_debug)
-                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
-                return -1;
-        }
-
-        errno = 0;
-        display = strtoul(display_str+1, &endp, 10);
-        if (endp == display_str+1 || (*endp != '\0' && *endp != '.')) { // handling DISPLAY=:0 and also :0.0
-                if (arg_debug)
-                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
-                return -1;
-        }
-        if (errno || display > (unsigned long)INT_MAX) {
-                if (arg_debug)
-                        fprintf(stderr, "display number %s is outside the valid range\n",
-                                display_str+1);
-                return -1;
-        }
-
-        if (arg_debug)
-                fprintf(stderr, "DISPLAY=%s parsed as %lu\n", display_str, display);
-
-        return (int)display;
+        const char *display_str = getenv("DISPLAY");
+        char *endp;
+        unsigned long display;
+
+        if (!display_str) {
+                if (arg_debug)
+                        fputs("DISPLAY is not set\n", stderr);
+                return -1;
+        }
+
+        if (display_str[0] != ':' || display_str[1] < '0' || display_str[1] > '9') {
+                if (arg_debug)
+                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
+                return -1;
+        }
+
+        errno = 0;
+        display = strtoul(display_str+1, &endp, 10);
+        // handling DISPLAY=:0 and also :0.0
+        if (endp == display_str+1 || (*endp != '\0' && *endp != '.')) {
+                if (arg_debug)
+                        fprintf(stderr, "unsupported DISPLAY form '%s'\n", display_str);
+                return -1;
+        }
+        if (errno || display > (unsigned long)INT_MAX) {
+                if (arg_debug)
+                        fprintf(stderr, "display number %s is outside the valid range\n",
+                                display_str+1);
+                return -1;
+        }
+
+        if (arg_debug)
+                fprintf(stderr, "DISPLAY=%s parsed as %lu\n", display_str, display);
+
+        return (int)display;
 }
 
 
@@ -78,34 +77,34 @@ int x11_display(void) {
 // check for X11 abstract sockets
 static int x11_abstract_sockets_present(void) {
 
-        EUID_ROOT(); // grsecurity fix
+        EUID_ROOT();                              // grsecurity fix
         FILE *fp = fopen("/proc/net/unix", "r");
         if (!fp)
                 errExit("fopen");
         EUID_USER();
 
         char *linebuf = 0;
-        size_t bufsz = 0;
-        int found = 0;
-        errno = 0;
+        size_t bufsz = 0;
+        int found = 0;
+        errno = 0;
 
         for (;;) {
-                if (getline(&linebuf, &bufsz, fp) == -1) {
-                        if (errno)
-                                errExit("getline");
-                        break;
-                }
-                // The last space-separated field in 'linebuf' is the
-                // pathname of the socket.  Abstract sockets' pathnames
-                // all begin with '@/', normal ones begin with '/'.
-                char *p = strrchr(linebuf, ' ');
-                if (!p) {
-                        fputs("error parsing /proc/net/unix\n", stderr);
-                        exit(1);
-                }
-                if (strncmp(p+1, "@/tmp/.X11-unix/", 16) == 0) {
-                        found = 1;
-                        break;
+                if (getline(&linebuf, &bufsz, fp) == -1) {
+                        if (errno)
+                                errExit("getline");
+                        break;
+                }
+                // The last space-separated field in 'linebuf' is the
+                // pathname of the socket.  Abstract sockets' pathnames
+                // all begin with '@/', normal ones begin with '/'.
+                char *p = strrchr(linebuf, ' ');
+                if (!p) {
+                        fputs("error parsing /proc/net/unix\n", stderr);
+                        exit(1);
+                }
+                if (strncmp(p+1, "@/tmp/.X11-unix/", 16) == 0) {
+                        found = 1;
+                        break;
                 }
         }
 
@@ -114,94 +113,289 @@ static int x11_abstract_sockets_present(void) {
         return found;
 }
 
+
 // Choose a random, unallocated display number.  This has an inherent
 // and unavoidable TOCTOU race, since we cannot create either the
 // socket or a lockfile ourselves.
 static int random_display_number(void) {
-        int display;
-        int found = 0;
+        int display;
+        int found = 0;
         int i;
 
-        struct sockaddr_un sa;
-        // The -1 here is because we need space to inject a
-        // leading nul byte.
-        int sun_pathmax = (int)(sizeof sa.sun_path - 1);
-        assert((size_t)sun_pathmax == sizeof sa.sun_path - 1);
-        int sun_pathlen;
+        struct sockaddr_un sa;
+        // The -1 here is because we need space to inject a
+        // leading nul byte.
+        int sun_pathmax = (int)(sizeof sa.sun_path - 1);
+        assert((size_t)sun_pathmax == sizeof sa.sun_path - 1);
+        int sun_pathlen;
 
-        int sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
-        if (sockfd == -1)
-                errExit("socket");
+        int sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+        if (sockfd == -1)
+                errExit("socket");
 
         for (i = 0; i < 100; i++) {
-                // We try display numbers in the range 21 through 1000.
-                // Normal X servers typically use displays in the 0-10 range;
-                // ssh's X11 forwarding uses 10-20, and login screens
-                // (e.g. gdm3) may use displays above 1000.
-                display = rand() % 979 + 21;
-
-                // The display number might be claimed by a server listening
-                // in _either_ the normal or the abstract namespace; they
-                // don't necessarily do both.  The easiest way to check is
-                // to try to connect, both ways.
-                memset(&sa, 0, sizeof sa);
-                sa.sun_family = AF_UNIX;
-                sun_pathlen = snprintf(sa.sun_path, sun_pathmax,
-                                       "/tmp/.X11-unix/X%d", display);
-                if (sun_pathlen >= sun_pathmax) {
-                        fprintf(stderr, "sun_path too small for display :%d"
-                                " (only %d bytes usable)\n", display, sun_pathmax);
-                        exit(1);
-                }
-
-                if (connect(sockfd, (struct sockaddr *)&sa,
-                            offsetof(struct sockaddr_un, sun_path) + sun_pathlen + 1) == 0) {
-                        close(sockfd);
-                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
-                        if (sockfd == -1)
-                                errExit("socket");
-                        continue;
-                }
-                if (errno != ECONNREFUSED && errno != ENOENT)
-                        errExit("connect");
-
-                // Name not claimed in the normal namespace; now try it
-                // in the abstract namespace.  Note that abstract-namespace
-                // names are NOT nul-terminated; they extend to the length
-                // specified as the third argument to 'connect'.
-                memmove(sa.sun_path + 1, sa.sun_path, sun_pathlen + 1);
-                sa.sun_path[0] = '\0';
-                if (connect(sockfd, (struct sockaddr *)&sa,
-                            offsetof(struct sockaddr_un, sun_path) + 1 + sun_pathlen) == 0) {
-                        close(sockfd);
-                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
-                        if (sockfd == -1)
-                                errExit("socket");
-                        continue;
-                }
-                if (errno != ECONNREFUSED && errno != ENOENT)
-                        errExit("connect");
-
-                // This display number is unclaimed.  Of course, it could
-                // be claimed before we get around to doing it...
-                found = 1;
-                break;
-        }
-        close(sockfd);
+                // We try display numbers in the range 21 through 1000.
+                // Normal X servers typically use displays in the 0-10 range;
+                // ssh's X11 forwarding uses 10-20, and login screens
+                // (e.g. gdm3) may use displays above 1000.
+                display = rand() % 979 + 21;
+
+                // The display number might be claimed by a server listening
+                // in _either_ the normal or the abstract namespace; they
+                // don't necessarily do both.  The easiest way to check is
+                // to try to connect, both ways.
+                memset(&sa, 0, sizeof sa);
+                sa.sun_family = AF_UNIX;
+                sun_pathlen = snprintf(sa.sun_path, sun_pathmax,
+                        "/tmp/.X11-unix/X%d", display);
+                if (sun_pathlen >= sun_pathmax) {
+                        fprintf(stderr, "sun_path too small for display :%d"
+                                " (only %d bytes usable)\n", display, sun_pathmax);
+                        exit(1);
+                }
+
+                if (connect(sockfd, (struct sockaddr *)&sa,
+                offsetof(struct sockaddr_un, sun_path) + sun_pathlen + 1) == 0) {
+                        close(sockfd);
+                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+                        if (sockfd == -1)
+                                errExit("socket");
+                        continue;
+                }
+                if (errno != ECONNREFUSED && errno != ENOENT)
+                        errExit("connect");
+
+                // Name not claimed in the normal namespace; now try it
+                // in the abstract namespace.  Note that abstract-namespace
+                // names are NOT nul-terminated; they extend to the length
+                // specified as the third argument to 'connect'.
+                memmove(sa.sun_path + 1, sa.sun_path, sun_pathlen + 1);
+                sa.sun_path[0] = '\0';
+                if (connect(sockfd, (struct sockaddr *)&sa,
+                offsetof(struct sockaddr_un, sun_path) + 1 + sun_pathlen) == 0) {
+                        close(sockfd);
+                        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+                        if (sockfd == -1)
+                                errExit("socket");
+                        continue;
+                }
+                if (errno != ECONNREFUSED && errno != ENOENT)
+                        errExit("connect");
+
+                // This display number is unclaimed.  Of course, it could
+                // be claimed before we get around to doing it...
+                found = 1;
+                break;
+        }
+        close(sockfd);
 
         if (!found) {
-                fputs("Error: cannot find an unallocated X11 display number, "
-                      "exiting...\n", stderr);
+                fputs("Error: cannot find an unallocated X11 display number, "
+                        "exiting...\n", stderr);
                 exit(1);
         }
         return display;
 }
 #endif
 
+#ifdef HAVE_X11
+void x11_start_xvfb(int argc, char **argv) {
+        EUID_ASSERT();
+        int i;
+        struct stat s;
+        pid_t jail = 0;
+        pid_t server = 0;
 
+        setenv("FIREJAIL_X11", "yes", 1);
+
+        // mever try to run X servers as root!!!
+        if (getuid() == 0) {
+                fprintf(stderr, "Error: X11 sandboxing is not available when running as root\n");
+                exit(1);
+        }
+        drop_privs(0);
+
+        // check xephyr
+        if (!program_in_path("Xvfb")) {
+                fprintf(stderr, "\nError: Xvfb program was not found in /usr/bin directory, please install it:\n");
+                fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xvfb\n");
+                fprintf(stderr, "   Arch: sudo pacman -S xorg-server-xvfb\n");
+                exit(0);
+        }
+
+        int display = random_display_number();
+        char *display_str;
+        if (asprintf(&display_str, ":%d", display) == -1)
+                errExit("asprintf");
+
+        assert(xvfb_screen);
+
+        char *server_argv[256] = {                // rest initialyzed to NULL
+                "Xvfb", display_str, "-screen", "0", xvfb_screen
+        };
+        unsigned pos = 0;
+        while (server_argv[pos] != NULL) pos++;
+        assert(xvfb_extra_params);                // should be "" if empty
+
+        // parse xvfb_extra_params
+        // very basic quoting support
+        char *temp = strdup(xephyr_extra_params);
+        if (*xephyr_extra_params != '\0') {
+                if (!temp)
+                        errExit("strdup");
+                bool dquote = false;
+                bool squote = false;
+                for (i = 0; i < (int) strlen(xvfb_extra_params); i++) {
+                        if (temp[i] == '\"') {
+                                dquote = !dquote;
+                                                  // replace closing quote by \0
+                                if (dquote) temp[i] = '\0';
+                        }
+                        if (temp[i] == '\'') {
+                                squote = !squote;
+                                                  // replace closing quote by \0
+                                if (squote) temp[i] = '\0';
+                        }
+                        if (!dquote && !squote && temp[i] == ' ') temp[i] = '\0';
+                        if (dquote && squote) {
+                                fprintf(stderr, "Error: mixed quoting found while parsing xvfb_extra_params\n");
+                                exit(1);
+                        }
+                }
+                if (dquote) {
+                        fprintf(stderr, "Error: unclosed quote found while parsing xephyr_extra_params\n");
+                        exit(1);
+                }
+
+                for (i = 0; i < (int) strlen(xvfb_extra_params)-1; i++) {
+                        if (pos >= (sizeof(server_argv)/sizeof(*server_argv)) - 2) {
+                                fprintf(stderr, "Error: arg count limit exceeded while parsing xvfb_extra_params\n");
+                                exit(1);
+                        }
+                        if (temp[i] == '\0' && (temp[i+1] == '\"' || temp[i+1] == '\'')) server_argv[pos++] = temp + i + 2;
+                        else if (temp[i] == '\0' && temp[i+1] != '\0') server_argv[pos++] = temp + i + 1;
+                }
+        }
+
+        server_argv[pos++] = NULL;
+
+        assert(pos < (sizeof(server_argv)/sizeof(*server_argv))); // no overrun
+        assert(server_argv[pos-1] == NULL);       // last element is null
+
+        if (arg_debug) {
+                size_t i = 0;
+                printf("xvfb server:");
+                while (server_argv[i]!=NULL) {
+                        printf(" \"%s\"", server_argv[i]);
+                        i++;
+                }
+                putchar('\n');
+        }
+
+        // remove --x11 arg
+        char *jail_argv[argc+2];
+        int j = 0;
+        for (i = 0; i < argc; i++) {
+                if (strncmp(argv[i], "--x11", 5) == 0)
+                        continue;
+                jail_argv[j] = argv[i];
+                j++;
+        }
+        jail_argv[j] = NULL;
+
+        assert(j < argc+2);                       // no overrun
+
+        if (arg_debug) {
+                size_t i = 0;
+                printf("xvfb client:");
+                while (jail_argv[i]!=NULL) {
+                        printf(" \"%s\"", jail_argv[i]);
+                        i++;
+                }
+                putchar('\n');
+        }
+
+        server = fork();
+        if (server < 0)
+                errExit("fork");
+        if (server == 0) {
+                if (arg_debug)
+                        printf("Starting xvfb...\n");
+
+                // running without privileges - see drop_privs call above
+                assert(getenv("LD_PRELOAD") == NULL);
+                execvp(server_argv[0], server_argv);
+                perror("execvp");
+                _exit(1);
+        }
+
+        if (arg_debug)
+                printf("xephyr server pid %d\n", server);
+
+        // check X11 socket
+        char *fname;
+        if (asprintf(&fname, "/tmp/.X11-unix/X%d", display) == -1)
+                errExit("asprintf");
+        int n = 0;
+        // wait for x11 server to start
+        while (++n < 10) {
+                sleep(1);
+                if (stat(fname, &s) == 0)
+                        break;
+        };
+
+        if (n == 10) {
+                fprintf(stderr, "Error: failed to start xephyr\n");
+                exit(1);
+        }
+        free(fname);
+
+        if (arg_debug) {
+                printf("X11 sockets: "); fflush(0);
+                int rv = system("ls /tmp/.X11-unix");
+                (void) rv;
+        }
+
+        setenv("DISPLAY", display_str, 1);
+        // run attach command
+        jail = fork();
+        if (jail < 0)
+                errExit("fork");
+        if (jail == 0) {
+                if (!arg_quiet)
+                        printf("\n*** Attaching to Xvfb display %d ***\n\n", display);
+
+                // running without privileges - see drop_privs call above
+                assert(getenv("LD_PRELOAD") == NULL);
+                execvp(jail_argv[0], jail_argv);
+                perror("execvp");
+                _exit(1);
+        }
+
+        // cleanup
+        free(display_str);
+        free(temp);
+
+        // wait for either server or jail termination
+        pid_t pid = wait(NULL);
+
+        // see which process terminated and kill other
+        if (pid == server) {
+                kill(jail, SIGTERM);
+        }
+        else if (pid == jail) {
+                kill(server, SIGTERM);
+        }
+
+        // without this closing Xephyr window may mess your terminal:
+        // "monitoring" process will release terminal before
+        // jail process ends and releases terminal
+        wait(NULL);                               // fulneral
+
+        exit(0);
+}
 
 
-#ifdef HAVE_X11
 //$ Xephyr -ac -br -noreset -screen 800x600 :22 &
 //$ DISPLAY=:22 firejail --net=eth0 --blacklist=/tmp/.X11-unix/x0 firefox
 void x11_start_xephyr(int argc, char **argv) {
@@ -210,7 +404,7 @@ void x11_start_xephyr(int argc, char **argv) {
         struct stat s;
         pid_t jail = 0;
         pid_t server = 0;
-        
+
         setenv("FIREJAIL_X11", "yes", 1);
 
         // unfortunately, xephyr does a number of weird things when started by root user!!!
@@ -227,14 +421,16 @@ void x11_start_xephyr(int argc, char **argv) {
                 fprintf(stderr, "   Arch: sudo pacman -S xorg-server-xephyr\n");
                 exit(0);
         }
-        
+
         int display = random_display_number();
         char *display_str;
         if (asprintf(&display_str, ":%d", display) == -1)
                 errExit("asprintf");
 
         assert(xephyr_screen);
-        char *server_argv[256] = { "Xephyr", "-ac", "-br", "-noreset", "-screen", xephyr_screen }; // rest initialyzed to NULL
+        char *server_argv[256] = {                // rest initialyzed to NULL
+                "Xephyr", "-ac", "-br", "-noreset", "-screen", xephyr_screen
+        };
         unsigned pos = 0;
         while (server_argv[pos] != NULL) pos++;
         if (checkcfg(CFG_XEPHYR_WINDOW_TITLE)) {
@@ -242,7 +438,7 @@ void x11_start_xephyr(int argc, char **argv) {
                 server_argv[pos++] = "firejail x11 sandbox";
         }
 
-        assert(xephyr_extra_params); // should be "" if empty
+        assert(xephyr_extra_params);              // should be "" if empty
 
         // parse xephyr_extra_params
         // very basic quoting support
@@ -255,11 +451,13 @@ void x11_start_xephyr(int argc, char **argv) {
                 for (i = 0; i < (int) strlen(xephyr_extra_params); i++) {
                         if (temp[i] == '\"') {
                                 dquote = !dquote;
-                                if (dquote) temp[i] = '\0'; // replace closing quote by \0
+                                                  // replace closing quote by \0
+                                if (dquote) temp[i] = '\0';
                         }
                         if (temp[i] == '\'') {
                                 squote = !squote;
-                                if (squote) temp[i] = '\0'; // replace closing quote by \0
+                                                  // replace closing quote by \0
+                                if (squote) temp[i] = '\0';
                         }
                         if (!dquote && !squote && temp[i] == ' ') temp[i] = '\0';
                         if (dquote && squote) {
@@ -281,13 +479,14 @@ void x11_start_xephyr(int argc, char **argv) {
                         else if (temp[i] == '\0' && temp[i+1] != '\0') server_argv[pos++] = temp + i + 1;
                 }
         }
-        
+
         server_argv[pos++] = display_str;
         server_argv[pos++] = NULL;
 
-        assert(pos < (sizeof(server_argv)/sizeof(*server_argv))); // no overrun
-        assert(server_argv[pos-1] == NULL); // last element is null
-        
+                                                  // no overrun
+        assert(pos < (sizeof(server_argv)/sizeof(*server_argv)));
+        assert(server_argv[pos-1] == NULL);       // last element is null
+
         if (arg_debug) {
                 size_t i = 0;
                 printf("xephyr server:");
@@ -302,18 +501,14 @@ void x11_start_xephyr(int argc, char **argv) {
         char *jail_argv[argc+2];
         int j = 0;
         for (i = 0; i < argc; i++) {
-                if (strcmp(argv[i], "--x11") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xpra") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xephyr") == 0)
+                if (strncmp(argv[i], "--x11", 5) == 0)
                         continue;
                 jail_argv[j] = argv[i];
                 j++;
         }
         jail_argv[j] = NULL;
 
-        assert(j < argc+2); // no overrun
+        assert(j < argc+2);                       // no overrun
 
         if (arg_debug) {
                 size_t i = 0;
@@ -324,7 +519,7 @@ void x11_start_xephyr(int argc, char **argv) {
                 }
                 putchar('\n');
         }
-        
+
         server = fork();
         if (server < 0)
                 errExit("fork");
@@ -333,7 +528,7 @@ void x11_start_xephyr(int argc, char **argv) {
                         printf("Starting xephyr...\n");
 
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(server_argv[0], server_argv);
                 perror("execvp");
                 _exit(1);
@@ -353,17 +548,17 @@ void x11_start_xephyr(int argc, char **argv) {
                 if (stat(fname, &s) == 0)
                         break;
         };
-        
+
         if (n == 10) {
                 fprintf(stderr, "Error: failed to start xephyr\n");
                 exit(1);
         }
         free(fname);
-        
+
         if (arg_debug) {
-                printf("X11 sockets: "); fflush(0);
-                int rv = system("ls /tmp/.X11-unix");
-                (void) rv;
+                printf("X11 sockets: "); fflush(0);
+                int rv = system("ls /tmp/.X11-unix");
+                (void) rv;
         }
 
         setenv("DISPLAY", display_str, 1);
@@ -376,7 +571,7 @@ void x11_start_xephyr(int argc, char **argv) {
                         printf("\n*** Attaching to Xephyr display %d ***\n\n", display);
 
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(jail_argv[0], jail_argv);
                 perror("execvp");
                 _exit(1);
@@ -392,25 +587,27 @@ void x11_start_xephyr(int argc, char **argv) {
         // see which process terminated and kill other
         if (pid == server) {
                 kill(jail, SIGTERM);
-        } else if (pid == jail) {
+        }
+        else if (pid == jail) {
                 kill(server, SIGTERM);
         }
 
         // without this closing Xephyr window may mess your terminal:
         // "monitoring" process will release terminal before
         // jail process ends and releases terminal
-        wait(NULL); // fulneral
+        wait(NULL);                               // fulneral
 
         exit(0);
 }
 
+
 void x11_start_xpra(int argc, char **argv) {
         EUID_ASSERT();
         int i;
         struct stat s;
         pid_t client = 0;
         pid_t server = 0;
-        
+
         setenv("FIREJAIL_X11", "yes", 1);
 
         // unfortunately, xpra does a number of weird things when started by root user!!!
@@ -426,7 +623,7 @@ void x11_start_xpra(int argc, char **argv) {
                 fprintf(stderr, "   Debian/Ubuntu/Mint: sudo apt-get install xpra\n");
                 exit(0);
         }
-        
+
         int display = random_display_number();
         char *display_str;
         if (asprintf(&display_str, ":%d", display) == -1)
@@ -455,9 +652,9 @@ void x11_start_xpra(int argc, char **argv) {
                         dup2(fd_null,1);
                         dup2(fd_null,2);
                 }
-        
+
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(server_argv[0], server_argv);
                 perror("execvp");
                 _exit(1);
@@ -477,18 +674,18 @@ void x11_start_xpra(int argc, char **argv) {
                 if (stat(fname, &s) == 0)
                         break;
         }
-        
+
         if (n == 10) {
                 fprintf(stderr, "Error: failed to start xpra\n");
                 exit(1);
         }
         free(fname);
-        
+
         if (arg_debug) {
-                printf("X11 sockets: "); fflush(0);
-                int rv = system("ls /tmp/.X11-unix");
-                (void) rv;
-        }
+                printf("X11 sockets: "); fflush(0);
+                int rv = system("ls /tmp/.X11-unix");
+                (void) rv;
+        }
 
         // build attach command
         char *attach_argv[] = { "xpra", "--title=\"firejail x11 sandbox\"", "attach", display_str, NULL };
@@ -508,7 +705,7 @@ void x11_start_xpra(int argc, char **argv) {
                         printf("\n*** Attaching to xpra display %d ***\n\n", display);
 
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
+                assert(getenv("LD_PRELOAD") == NULL);
                 execvp(attach_argv[0], attach_argv);
                 perror("execvp");
                 _exit(1);
@@ -520,11 +717,7 @@ void x11_start_xpra(int argc, char **argv) {
         char *firejail_argv[argc+2];
         int pos = 0;
         for (i = 0; i < argc; i++) {
-                if (strcmp(argv[i], "--x11") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xpra") == 0)
-                        continue;
-                if (strcmp(argv[i], "--x11=xephyr") == 0)
+                if (strncmp(argv[i], "--x11", 5) == 0)
                         continue;
                 firejail_argv[pos] = argv[i];
                 pos++;
@@ -540,8 +733,8 @@ void x11_start_xpra(int argc, char **argv) {
                 errExit("fork");
         if (jail == 0) {
                 // running without privileges - see drop_privs call above
-                assert(getenv("LD_PRELOAD") == NULL);   
-                if (firejail_argv[0]) // shut up llvm scan-build
+                assert(getenv("LD_PRELOAD") == NULL);
+                if (firejail_argv[0])             // shut up llvm scan-build
                         execvp(firejail_argv[0], firejail_argv);
                 perror("execvp");
                 exit(1);
@@ -550,8 +743,8 @@ void x11_start_xpra(int argc, char **argv) {
         if (!arg_quiet)
                 printf("Xpra server pid %d, xpra client pid %d, jail %d\n", server, client, jail);
 
-        sleep(1); // let jail start
-
+        sleep(1); // adding a delay in order to let the server start
+        
         // wait for jail or server to end
         while (1) {
                 pid_t pid = wait(NULL);
@@ -568,7 +761,7 @@ void x11_start_xpra(int argc, char **argv) {
                                         dup2(fd_null,2);
                                 }
                                 // running without privileges - see drop_privs call above
-                                assert(getenv("LD_PRELOAD") == NULL);   
+                                assert(getenv("LD_PRELOAD") == NULL);
                                 execvp(stop_argv[0], stop_argv);
                                 perror("execvp");
                                 _exit(1);
@@ -588,7 +781,7 @@ void x11_start_xpra(int argc, char **argv) {
                                 else
                                         printf("xpra server successfully stopped in %d secs\n", n);
                         }
-                        
+
                         // kill xpra server and xpra client
                         kill(client, SIGTERM);
                         kill(server, SIGTERM);
@@ -604,6 +797,7 @@ void x11_start_xpra(int argc, char **argv) {
         }
 }
 
+
 void x11_start(int argc, char **argv) {
         EUID_ASSERT();
 
@@ -628,7 +822,7 @@ void x11_start(int argc, char **argv) {
 #endif
 
 // Porting notes:
-// 
+//
 // 1. merge #1100 from zackw:
 //     Attempting to run xauth -f directly on a file in /run/firejail/mnt/ directory fails on Debian 8
 //     with this message:
@@ -653,7 +847,7 @@ void x11_xorg(void) {
         struct stat s;
         if (stat("/usr/bin/xauth", &s) == -1) {
                 fprintf(stderr, "Error: xauth utility not found in PATH.  Please install it:\n"
-                                "   Debian/Ubuntu/Mint: sudo apt-get install xauth\n");
+                        "   Debian/Ubuntu/Mint: sudo apt-get install xauth\n");
                 exit(1);
         }
         if (s.st_uid != 0 && s.st_gid != 0) {
@@ -695,8 +889,8 @@ void x11_xorg(void) {
                 __gcov_flush();
 #endif
                 execlp("/usr/bin/xauth", "/usr/bin/xauth", "-v", "-f", tmpfname,
-                        "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL); 
-                
+                        "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted", NULL);
+
                 _exit(127);
         }
 
@@ -705,16 +899,19 @@ void x11_xorg(void) {
         if (waitpid(child, &status, 0) != child)
                 errExit("waitpid");
         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
-                 /* success */
-        } else if (WIFEXITED(status)) {
+                /* success */
+        }
+        else if (WIFEXITED(status)) {
                 fprintf(stderr, "Failed to create untrusted X cookie: xauth: exit %d\n",
                         WEXITSTATUS(status));
                 exit(1);
-        } else if (WIFSIGNALED(status)) {
+        }
+        else if (WIFSIGNALED(status)) {
                 fprintf(stderr, "Failed to create untrusted X cookie: xauth: %s\n",
                         strsignal(WTERMSIG(status)));
                 exit(1);
-        } else {
+        }
+        else {
                 fprintf(stderr, "Failed to create untrusted X cookie: "
                         "xauth: un-decodable exit status %04x\n", status);
                 exit(1);
@@ -728,10 +925,11 @@ void x11_xorg(void) {
         }
         if (set_perms(tmpfname, getuid(), getgid(), 0600))
                 errExit("set_perms");
-        
+
         // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted
         // automatically when the sandbox is closed (rename doesn't work)
-        if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) { // root needed
+                                                  // root needed
+        if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) {
                 fprintf(stderr, "Error: cannot create the new .Xauthority file\n");
                 exit(1);
         }
@@ -740,7 +938,6 @@ void x11_xorg(void) {
         /* coverity[toctou] */
         unlink(tmpfname);
         umount("/tmp");
-        
 
         // Ensure there is already a file in the usual location, so that bind-mount below will work.
         // todo: fix TOCTOU races, currently managed by imposing /usr/bin/xauth as executable
@@ -765,9 +962,10 @@ void x11_xorg(void) {
         if (set_perms(dest, getuid(), getgid(), 0600))
                 errExit("set_perms");
         free(dest);
-#endif  
+#endif
 }
 
+
 void fs_x11(void) {
 #ifdef HAVE_X11
         int display = x11_display();
@@ -786,63 +984,62 @@ void fs_x11(void) {
         if (arg_debug || arg_debug_whitelists)
                 fprintf(stderr, "Masking all X11 sockets except %s\n", x11file);
 
-               // Move the real /tmp/.X11-unix to a scratch location
-                // so we can still access x11file after we mount a
-                // tmpfs over /tmp/.X11-unix.
-                int rv = mkdir(RUN_WHITELIST_X11_DIR, 0700);
-                if (rv == -1)
-                        errExit("mkdir");
-                if (set_perms(RUN_WHITELIST_X11_DIR, 0, 0, 0700))
-                        errExit("set_perms");
-
-                if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
-                        errExit("mount bind");
-
-                // This directory must be mode 1777, or Xlib will barf.
-                if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
-                          MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,
-                          "mode=1777,uid=0,gid=0") < 0)
-                        errExit("mounting tmpfs on /tmp/.X11-unix");
-                fs_logger("tmpfs /tmp/.X11-unix");
-
-                // create an empty file which will have the desired socket bind-mounted over it
-                int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT);
-                if (fd < 0)
-                        errExit(x11file);
-                if (fchown(fd, x11stat.st_uid, x11stat.st_gid))
-                        errExit("fchown");
-                close(fd);
-
-                // do the mount
-                char *wx11file;
-                if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
-                        errExit("asprintf");
-                if (mount(wx11file, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
-                        errExit("mount bind");
-                fs_logger2("whitelist", x11file);
-
-                free(x11file);
-                free(wx11file);
-
-                // block access to RUN_WHITELIST_X11_DIR
-                if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, 0, MS_BIND, 0) < 0)
-                        errExit("mount");
-                fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
+        // Move the real /tmp/.X11-unix to a scratch location
+        // so we can still access x11file after we mount a
+        // tmpfs over /tmp/.X11-unix.
+        int rv = mkdir(RUN_WHITELIST_X11_DIR, 0700);
+        if (rv == -1)
+                errExit("mkdir");
+        if (set_perms(RUN_WHITELIST_X11_DIR, 0, 0, 0700))
+                errExit("set_perms");
+
+        if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
+                errExit("mount bind");
+
+        // This directory must be mode 1777, or Xlib will barf.
+        if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
+                MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,
+                "mode=1777,uid=0,gid=0") < 0)
+                errExit("mounting tmpfs on /tmp/.X11-unix");
+        fs_logger("tmpfs /tmp/.X11-unix");
+
+        // create an empty file which will have the desired socket bind-mounted over it
+        int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT);
+        if (fd < 0)
+                errExit(x11file);
+        if (fchown(fd, x11stat.st_uid, x11stat.st_gid))
+                errExit("fchown");
+        close(fd);
+
+        // do the mount
+        char *wx11file;
+        if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
+                errExit("asprintf");
+        if (mount(wx11file, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mount bind");
+        fs_logger2("whitelist", x11file);
+
+        free(x11file);
+        free(wx11file);
+
+        // block access to RUN_WHITELIST_X11_DIR
+        if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, 0, MS_BIND, 0) < 0)
+                errExit("mount");
+        fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
 #endif
 }
 
+
 void x11_block(void) {
 #ifdef HAVE_X11
-        mask_x11_abstract_socket = 1;
-
         // check abstract socket presence and network namespace options
         if ((!arg_nonetwork && !cfg.bridge0.configured && !cfg.interface0.configured)
-                && x11_abstract_sockets_present()) {
+        && x11_abstract_sockets_present()) {
                 fprintf(stderr, "ERROR: --x11=none specified, but abstract X11 socket still accessible.\n"
-                                                "Additional setup required. To block abstract X11 socket you can either:\n"
-                                                " * use network namespace in firejail (--net=none, --net=...)\n"
-                                                " * add \"-nolisten local\" to xserver options\n"
-                                                "   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)\n");
+                        "Additional setup required. To block abstract X11 socket you can either:\n"
+                        " * use network namespace in firejail (--net=none, --net=...)\n"
+                        " * add \"-nolisten local\" to xserver options\n"
+                        "   (eg. to your display manager config, or /etc/X11/xinit/xserverrc)\n");
                 exit(1);
         }
 
@@ -867,4 +1064,3 @@ void x11_block(void) {
         env_store("XAUTHORITY", RMENV);
 #endif
 }
-
diff --git a/src/firemon/arp.c b/src/firemon/arp.c
index cef48fb0d..d30983e4a 100644
--- a/src/firemon/arp.c
+++ b/src/firemon/arp.c
@@ -80,7 +80,7 @@ void arp(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1) {
                                 char *fname;
diff --git a/src/firemon/caps.c b/src/firemon/caps.c
index 8837c9ee7..a13b784a2 100644
--- a/src/firemon/caps.c
+++ b/src/firemon/caps.c
@@ -38,9 +38,7 @@ static void print_caps(int pid) {
                 if (strncmp(buf, "CapBnd:", 7) == 0) {
                         printf("  %s", buf);
                         fflush(0);
-                        free(file);
-                        fclose(fp);
-                        return;
+                        break;
                 }
         }
         fclose(fp);
@@ -55,7 +53,7 @@ void caps(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_caps(child);
diff --git a/src/firemon/cgroup.c b/src/firemon/cgroup.c
index bbb28f619..48427210b 100644
--- a/src/firemon/cgroup.c
+++ b/src/firemon/cgroup.c
@@ -52,7 +52,7 @@ void cgroup(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_cgroup(child);
diff --git a/src/firemon/cpu.c b/src/firemon/cpu.c
index 47c935686..2a6979573 100644
--- a/src/firemon/cpu.c
+++ b/src/firemon/cpu.c
@@ -39,9 +39,7 @@ static void print_cpu(int pid) {
                 if (strncmp(buf, "Cpus_allowed_list:", 18) == 0) {
                         printf("  %s", buf);
                         fflush(0);
-                        free(file);
-                        fclose(fp);
-                        return;
+                        break;
                 }
         }
         fclose(fp);
@@ -56,7 +54,7 @@ void cpu(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_cpu(child);
diff --git a/src/firemon/interface.c b/src/firemon/interface.c
index ba3c9fceb..77dd1f277 100644
--- a/src/firemon/interface.c
+++ b/src/firemon/interface.c
@@ -163,7 +163,7 @@ void interface(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1) {
                                 print_sandbox(child);
diff --git a/src/firemon/list.c b/src/firemon/list.c
index 1df737e8c..2152df31f 100644
--- a/src/firemon/list.c
+++ b/src/firemon/list.c
@@ -26,7 +26,7 @@ void list(void) {
         int i;
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1)
-                        pid_print_list(i, 0);
+                        pid_print_list(i, arg_nowrap);
         }
 }
 
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c
index ebcb7a72c..378bdefe9 100644
--- a/src/firemon/procevent.c
+++ b/src/firemon/procevent.c
@@ -150,10 +150,8 @@ doexit:
 static int procevent_netlink_setup(void) {
         // open socket for process event connector
         int sock;
-        if ((sock = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR)) < 0) {
-                fprintf(stderr, "Error: cannot open netlink socket\n");
-                exit(1);
-        }
+        if ((sock = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR)) < 0)
+                goto errexit;
 
         // bind socket
         struct sockaddr_nl addr;
@@ -161,10 +159,8 @@ static int procevent_netlink_setup(void) {
         addr.nl_pid = getpid();
         addr.nl_family = AF_NETLINK;
         addr.nl_groups = CN_IDX_PROC;
-        if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
-                fprintf(stderr, "Error: cannot bind to netlink socket\n");
-                exit(1);
-        }
+        if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0)
+                goto errexit;
 
         // send monitoring message
         struct nlmsghdr nlmsghdr;
@@ -189,12 +185,13 @@ static int procevent_netlink_setup(void) {
         iov[2].iov_base = &op;
         iov[2].iov_len = sizeof(op);
 
-        if (writev(sock, iov, 3) == -1) {
-                fprintf(stderr, "Error: cannot write to netlink socket\n");
-                exit(1);
-        }
+        if (writev(sock, iov, 3) == -1)
+                goto errexit;
         
         return sock;
+errexit:
+        fprintf(stderr, "Error: netlink socket problem\n");
+        exit(1);
 }
 
 
diff --git a/src/firemon/route.c b/src/firemon/route.c
index dff594431..145daa152 100644
--- a/src/firemon/route.c
+++ b/src/firemon/route.c
@@ -189,7 +189,7 @@ void route(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1) {
                                 char *fname;
diff --git a/src/firemon/seccomp.c b/src/firemon/seccomp.c
index d50692b37..e530fa1c3 100644
--- a/src/firemon/seccomp.c
+++ b/src/firemon/seccomp.c
@@ -37,9 +37,7 @@ static void print_seccomp(int pid) {
                 if (strncmp(buf, "Seccomp:", 8) == 0) {
                         printf("  %s", buf);
                         fflush(0);
-                        fclose(fp);
-                        free(file);
-                        return;
+                        break;
                 }
         }
         fclose(fp);
@@ -54,7 +52,7 @@ void seccomp(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         int child = find_child(i);
                         if (child != -1)
                                 print_seccomp(child);
diff --git a/src/firemon/usage.c b/src/firemon/usage.c
index 1768237b3..20f2c071b 100644
--- a/src/firemon/usage.c
+++ b/src/firemon/usage.c
@@ -37,6 +37,7 @@ void usage(void) {
         printf("\t--name=name - print information only about named sandbox.\n\n");
         printf("\t--netstats - monitor network statistics for sandboxes creating a new\n");
         printf("\t\tnetwork namespace.\n\n");
+        printf("\t--nowrap - enable line wrapping in terminals.\n\n");
         printf("\t--route - print route table for each sandbox.\n\n");
         printf("\t--seccomp - print seccomp configuration for each sandbox.\n\n");
         printf("\t--tree - print a tree of all sandboxed processes.\n\n");
diff --git a/src/firemon/x11.c b/src/firemon/x11.c
index 97cfffe64..c923c8ef8 100644
--- a/src/firemon/x11.c
+++ b/src/firemon/x11.c
@@ -30,7 +30,7 @@ void x11(pid_t pid, int print_procs) {
         for (i = 0; i < max_pids; i++) {
                 if (pids[i].level == 1) {
                         if (print_procs || pid == 0)
-                                pid_print_list(i, 0);
+                                pid_print_list(i, arg_nowrap);
                         
                         char *x11file;
                         // todo: use macro from src/firejail/firejail.h for /run/firejail/x11 directory
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index aa1aec567..76cd4d4fa 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -103,6 +103,12 @@ If the file name matches file_name, the file will not be blacklisted in any blac
 Example: "noblacklist ${HOME}/.mozilla"
 
 .TP
+\fBnowhitelist file_name
+If the file name matches file_name, the file will not be whitelisted in any whitelist commands that follow.
+
+Example: "nowhitelist ~/.config"
+
+.TP
 \fBignore
 Ignore command.
 
@@ -156,7 +162,7 @@ Mount-bind directory1 on top of directory2. This option is only available when r
 Mount-bind file1 on top of file2. This option is only available when running as root.
 .TP
 \fBmkdir directory
-Create a directory in user home before the sandbox is started.
+Create a directory in user home or under /tmp before the sandbox is started.
 The directory is created if it doesn't already exist.
 .br
 
@@ -177,8 +183,8 @@ mkdir ~/.cache/mozilla/firefox
 whitelist ~/.cache/mozilla/firefox
 .TP
 \fBmkfile file
-Similar to mkdir, this command creates a file in user home before the sandbox is started.
-The file is created if it doesn't already exist, but it's target directory has to exist.
+Similar to mkdir, this command creates a file in user home or under /tmp before the sandbox is started.
+The file is created if it doesn't already exist.
 .TP
 \fBnoexec file_or_directory
 Remount the file or the directory noexec, nodev and nosuid.
@@ -310,13 +316,16 @@ Remove DISPLAY and XAUTHORITY environment variables.
 Stop with error message if X11 abstract socket will be accessible in jail.
 .TP
 \fBx11 xephyr
-Enable X11 sandboxing with xephyr.
+Enable X11 sandboxing with Xephyr server.
 .TP
 \fBx11 xorg
 Enable X11 sandboxing with X11 security extension.
 .TP
 \fBx11 xpra
-Enable X11 sandboxing with xpra.
+Enable X11 sandboxing with Xpra server.
+.TP
+\fBx11 xvfb
+Enable X11 sandboxing with Xvfb server.
 
 .SH Resource limits, CPU affinity, Control Groups
 These profile entries define the limits on system resources (rlimits) for the processes inside the sandbox.
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index f978661dc..f603daecb 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1067,6 +1067,10 @@ Example:
 $ firejail \-\-nosound firefox
 
 .TP
+\fB\-\-nowhitelist=dirname_or_filename
+Disable whitelist for this directory or file.
+
+.TP
 \fB\-\-output=logfile
 stdout logging and log rotation. Copy stdout and stderr to logfile, and keep the size of the file under 500KB using log
 rotation. Five files with prefixes .1 to .5 are used in rotation.
@@ -1772,17 +1776,17 @@ $ sudo firejail --writable-var-log
 
 .TP
 \fB\-\-x11
-Sandbox the application using Xpra, Xephyr or Xorg security extension.
+Sandbox the application using Xpra, Xephyr, Xvfb or Xorg security extension.
 The sandbox will prevents screenshot and keylogger applications started inside the sandbox from accessing
 clients running outside the sandbox.
 Firejail will try first Xpra, and if Xpra is not installed on the system, it will try to find Xephyr.
-If all fails, Firejail will not attempt to use X11 security extension.
+If all fails, Firejail will not attempt to use Xvfb or X11 security extension. 
 .br
 
 .br
-Xpra and Xephyr modes require a network namespace to be instantiated in order to disable
+Xpra, Xephyr and Xvfb modes require a network namespace to be instantiated in order to disable
 X11 abstract Unix socket. If this is not possible, the user can disable the abstract socket
-by adding "-nolisten local" on Xorg command line.
+by adding "-nolisten local" on Xorg command line at system level.
 .br
 
 .br
@@ -1859,6 +1863,68 @@ Example:
 .br
 $ firejail \-\-x11=xpra --net=eth0 firefox
 
+
+.TP
+\fB\-\-x11=xvfb
+Start Xvfb X11 server and attach the sandbox to this server. 
+Xvfb, short for X virtual framebuffer, performs all graphical operations in memory 
+without showing any screen output. Xvfb is mainly used for remote access and software 
+testing on headless servers.
+.br
+
+.br
+On Debian platforms Xvfb is installed with the command \fBsudo apt-get install xvfb\fR.
+This feature is not available when running as root.
+.br
+
+.br
+Example: remote VNC access
+.br
+
+.br
+On the server we start a sandbox using Xvfb and openbox
+window manager. The default size of Xvfb screen is 800x600 - it can be changed
+in /etc/firejail/firejail.config (xvfb-screen). Some sort of networking (--net) is required
+in order to isolate the abstract sockets used by other X servers.
+.br
+
+.br
+$ firejail --net=none --x11=xvfb openbox
+.br
+
+.br
+*** Attaching to Xvfb display 792 ***
+.br
+
+.br
+Reading profile /etc/firejail/openbox.profile
+.br
+Reading profile /etc/firejail/disable-common.inc
+.br
+Reading profile /etc/firejail/disable-common.local
+.br
+Parent pid 5400, child pid 5401
+.br
+
+.br
+On the server we also start a VNC server and attach it to the display handled by our
+Xvfb server (792).
+.br
+
+.br
+$ x11vnc -display :792
+.br
+
+.br
+On the client machine we start a VNC viewer and use it to connect to our server:
+.br
+
+.br
+$ vncviewer
+.br
+
+
+
 .TP
 \fB\-\-zsh
 Use /usr/bin/zsh as default user shell.
diff --git a/src/man/firemon.txt b/src/man/firemon.txt
index bd84401af..ecb626fc6 100644
--- a/src/man/firemon.txt
+++ b/src/man/firemon.txt
@@ -37,6 +37,9 @@ Print information only about named sandbox.
 \fB\-\-netstats
 Monitor network statistics for sandboxes creating a new network namespace.
 .TP
+\fB\-\-nowrap
+Enable line wrapping in terminals. By default the lines are trimmed.
+.TP
 \fB\-\-route
 Print route table for each sandbox.
 .TP
diff --git a/test/apps-x11-xorg/firefox.exp b/test/apps-x11-xorg/firefox.exp
index 4da9e5a16..4fd17caa6 100755
--- a/test/apps-x11-xorg/firefox.exp
+++ b/test/apps-x11-xorg/firefox.exp
@@ -41,7 +41,7 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
-send -- "firemon --seccomp\r"
+send -- "firemon --seccomp --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit}
@@ -61,7 +61,7 @@ expect {
         "name=blablabla"
 }
 sleep 1
-send -- "firemon --caps\r"
+send -- "firemon --caps --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         " firefox" {puts "firefox detected\n";}
diff --git a/test/apps-x11-xorg/icedove.exp b/test/apps-x11-xorg/icedove.exp
index ce1d38222..8f6722cd7 100755
--- a/test/apps-x11-xorg/icedove.exp
+++ b/test/apps-x11-xorg/icedove.exp
@@ -38,7 +38,7 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
-send -- "firemon --seccomp\r"
+send -- "firemon --seccomp --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit}
@@ -57,7 +57,7 @@ expect {
         "name=blablabla"
 }
 sleep 2
-send -- "firemon --caps\r"
+send -- "firemon --caps --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         ":firejail"
diff --git a/test/apps-x11-xorg/transmission-gtk.exp b/test/apps-x11-xorg/transmission-gtk.exp
index c6d9ba13a..3eb537c1b 100755
--- a/test/apps-x11-xorg/transmission-gtk.exp
+++ b/test/apps-x11-xorg/transmission-gtk.exp
@@ -38,7 +38,7 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
-send -- "firemon --seccomp\r"
+send -- "firemon --seccomp --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 5\n";exit}
         "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit}
@@ -57,7 +57,7 @@ expect {
         "name=blablabla"
 }
 sleep 1
-send -- "firemon --caps\r"
+send -- "firemon --caps --nowrap\r"
 expect {
         timeout {puts "TESTING ERROR 6\n";exit}
         ":firejail"
diff --git a/test/environment/nice.exp b/test/environment/nice.exp
index 2c00d1485..50e789c9e 100755
--- a/test/environment/nice.exp
+++ b/test/environment/nice.exp
@@ -77,7 +77,48 @@ expect {
         "top"
 }
 
+sleep 1
+send -- "exit\r"
+after 100
+
+
+# negative nice value should result in nice=0
+send -- "firejail --nice=-5\r"
+expect {
+        timeout {puts "TESTING ERROR 17\n";exit}
+        "Child process initialized"
+}
+sleep 1
+
+send -- "top -b -n 1\r"
+expect {
+        timeout {puts "TESTING ERROR 18\n";exit}
+        $env(USER)
+}
+expect {
+        timeout {puts "TESTING ERROR 19\n";exit}
+        "0"
+}
+expect {
+        timeout {puts "TESTING ERROR 20\n";exit}
+        "bash"
+}
+expect {
+        timeout {puts "TESTING ERROR 21\n";exit}
+        $env(USER)
+}
+expect {
+        timeout {puts "TESTING ERROR 22\n";exit}
+        "0"
+}
+expect {
+        timeout {puts "TESTING ERROR 23\n";exit}
+        "top"
+}
 
+sleep 1
+send -- "exit\r"
+after 100
 
 puts "\nall done\n"
 
diff --git a/test/environment/output.exp b/test/environment/output.exp
index 10c325832..d175ddae2 100755
--- a/test/environment/output.exp
+++ b/test/environment/output.exp
@@ -61,5 +61,27 @@ expect {
 }
 after 100
 send -- "rm -f logfile*\r"
+
+
+send -- "firejail --output=../logfile -- ./output.sh\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "invalid output file"
+}
+after 100
+
+send -- "firejail --output=/etc -- ./output.sh\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "invalid output file"
+}
+after 100
+
+send -- "firejail --output=/etc/firejail/zoom.profile -- ./output.sh\r"
+expect {
+        timeout {puts "TESTING ERROR 10\n";exit}
+        "the output file needs to be owned by the current user"
+}
+
 after 100
 puts "\nall done\n"
diff --git a/test/filters/debug.exp b/test/filters/debug.exp
new file mode 100755
index 000000000..493022c05
--- /dev/null
+++ b/test/filters/debug.exp
@@ -0,0 +1,45 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2017 Firejail Authors
+# License GPL v2
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --debug-syscalls\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "set_mempolicy"
+}
+after 100
+
+send --  "firejail --debug-syscalls\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "setitimer"
+}
+after 100
+
+send --  "firejail --debug-errnos\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "EBADMSG"
+}
+after 100
+
+send --  "firejail --debug-errnos\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "ELIBMAX"
+}
+after 100
+
+send --  "firejail --debug-protocols\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "unix, inet, inet6, netlink, packet"
+}
+after 100
+
+puts "all done\n"
diff --git a/test/filters/filters.sh b/test/filters/filters.sh
index 73e0e4d5c..4996e6d66 100755
--- a/test/filters/filters.sh
+++ b/test/filters/filters.sh
@@ -6,6 +6,9 @@
 export MALLOC_CHECK_=3
 export MALLOC_PERTURB_=$(($RANDOM % 255 + 1))
 
+echo "TESTING: debug options (test/filters/debug.exp)"
+./debug.exp
+
 echo "TESTING: noroot (test/filters/noroot.exp)"
 ./noroot.exp
 
diff --git a/test/fs/whitelist.exp b/test/fs/whitelist.exp
index 20492c739..8ebad48f0 100755
--- a/test/fs/whitelist.exp
+++ b/test/fs/whitelist.exp
@@ -161,7 +161,7 @@ expect {
 }
 expect {
         timeout {puts "TESTING ERROR 31\n";exit}
-        "exiting"
+        "cannot sync with peer"
 }
 sleep 1
 
diff --git a/test/root/checkcfg.exp b/test/root/checkcfg.exp
new file mode 100755
index 000000000..e1ec6cf79
--- /dev/null
+++ b/test/root/checkcfg.exp
@@ -0,0 +1,106 @@
+#!/usr/bin/expect -f
+# This file is part of Firejail project
+# Copyright (C) 2014-2017 Firejail Authors
+# License GPL v2
+
+set timeout 10
+cd /home
+spawn $env(SHELL)
+match_max 100000
+
+send --  "firejail --noprofile --overlay\r"
+expect {
+        timeout {puts "TESTING ERROR 0\n";exit}
+        "Child process initialized"
+}
+sleep 2
+
+send -- "rm /etc/firejail/firejail.config\r"
+after 100
+
+send --  "firejail\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "firejail.config not found"
+}
+
+# seccomp
+send --  "echo \"seccomp no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --seccomp --force\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "seccomp feature is disabled in Firejail configuration file\r"
+}
+send --  "exit\r"
+after 100
+
+# whitelist
+send --  "echo \"whitelist no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --whitelist=~/.config --force\r"
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "whitelist feature is disabled in Firejail configuration file\r"
+}
+
+# network
+send --  "echo \"network no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --net=eth0 --force\r"
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "networking feature is disabled in Firejail configuration file\r"
+}
+
+# bind
+send --  "echo \"bind no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --bind=/tmp,/var/tmp --force\r"
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "bind feature is disabled in Firejail configuration file\r"
+}
+
+# overlay
+send --  "echo \"overlayfs no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --overlay --force\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "overlayfs feature is disabled in Firejail configuration file\r"
+}
+
+# private-home
+send --  "echo \"private-home no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --private-home=/tmp --force\r"
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "private-home feature is disabled in Firejail configuration file\r"
+}
+
+# chroot
+send --  "echo \"chroot no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --chroot=/tmp --force\r"
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "chroot feature is disabled in Firejail configuration file\r"
+}
+
+# userns
+send --  "echo \"userns no\" > /etc/firejail/firejail.config\r"
+after 100
+send --  "firejail --noprofile --noroot --force\r"
+expect {
+        timeout {puts "TESTING ERROR 9\n";exit}
+        "noroot feature is disabled in Firejail configuration file\r"
+}
+
+send --  "exit\r"
+after 100
+
+
+after 100
+puts "\nall done\n"
diff --git a/test/root/git.exp b/test/root/git.exp
new file mode 100755
index 000000000..c5ddeee89
--- /dev/null
+++ b/test/root/git.exp
@@ -0,0 +1,51 @@
+#!/usr/bin/expect -f
+
+set timeout 10
+spawn $env(SHELL)
+match_max 100000
+
+
+
+send -- "firejail --version\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "git install support is disabled" { puts "TESTING: git support not available in current build\n"; exit}
+        "git install support is enabled" { puts "git support available\n"}
+}
+
+set timeout 120
+send -- "firejail --git-install\r"
+expect {
+        timeout {puts "TESTING ERROR 2\n";exit}
+        "Cloning into"
+}
+expect {
+        timeout {puts "TESTING ERROR 3\n";exit}
+        "Configuration options"
+}
+expect {
+        timeout {puts "TESTING ERROR 4\n";exit}
+        "src/fseccomp/fseccomp default seccomp"
+}
+expect {
+        timeout {puts "TESTING ERROR 5\n";exit}
+        "Mainline git Firejail version was installed in"
+}
+after 100
+
+send -- "firejail --git-uninstall\r"
+expect {
+        timeout {puts "TESTING ERROR 6\n";exit}
+        "Cloning into"
+}
+expect {
+        timeout {puts "TESTING ERROR 7\n";exit}
+        "Configuration options"
+}
+expect {
+        timeout {puts "TESTING ERROR 8\n";exit}
+        "Firejail mainline git version uninstalled from"
+}
+after 100
+
+puts "\nall done\n"
diff --git a/test/root/root.sh b/test/root/root.sh
index 9764b3804..e23499d2a 100755
--- a/test/root/root.sh
+++ b/test/root/root.sh
@@ -62,6 +62,9 @@ echo "TESTING: fs whitelist mnt, opt, media (test/root/whitelist-mnt.exp)"
 echo "TESTING: join (test/root/join.exp)"
 ./join.exp
 
+echo "TESTING: git-install (test/root/git.exp)"
+./git.exp
+
 #********************************
 # seccomp
 #********************************
@@ -77,6 +80,9 @@ echo "TESTING: seccomp chown (test/root/seccomp-chown.exp)"
 #********************************
 # command line options
 #********************************
+echo "TESTING: firejail configuration (test/root/checkcfg.exp)"
+./checkcfg.exp
+
 echo "TESTING: tmpfs (test/root/option_tmpfs.exp)"
 ./option_tmpfs.exp
 
diff --git a/test/utils/join.exp b/test/utils/join.exp
index b74b0b17a..d5c421676 100755
--- a/test/utils/join.exp
+++ b/test/utils/join.exp
@@ -16,6 +16,14 @@ expect {
 sleep 2
 
 spawn $env(SHELL)
+send --  "firejail --shell=none --join=jointesting\r"
+expect {
+        timeout {puts "TESTING ERROR 1\n";exit}
+        "shell=none set, but no command specified"
+}
+after 100
+
+
 send --  "firejail --join=jointesting\r"
 expect {
         timeout {puts "TESTING ERROR 1\n";exit}