9 files changed, 118 insertions, 46 deletions

diff --git a/README b/README
index d84c36fa1..9ca6e6f60 100644
--- a/README
+++ b/README
@@ -656,6 +656,7 @@ Veeti Paananen (https://github.com/veeti)
 veloute (https://github.com/veloute)
         - added standardnotes profile
         - added flameshot profile
+        - added jdownloader profile
 Vincent43 (https://github.com/Vincent43)
         - apparmor enhancements
 vismir2 (https://github.com/vismir2)
diff --git a/README.md b/README.md
index 89b85a09a..18cdeb407 100644
--- a/README.md
+++ b/README.md
@@ -167,4 +167,4 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
 ## New profiles
 Microsoft Office Online, riot-desktop, gnome-mpv, snox, gradio, standardnotes-desktop,
 shellcheck, patch, flameshot, rview, rvim, vimcat, vimdiff, vimpager, vimtutor,
-xxd, Beaker, electrum, clamtk, pybitmessage, dig, whois
+xxd, Beaker, electrum, clamtk, pybitmessage, dig, whois, jdownloader
diff --git a/RELNOTES b/RELNOTES
index 74c7551f5..7d78aab58 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -19,7 +19,8 @@ firejail (0.9.56~rc1) baseline; urgency=low
   * new profiles: ms-skype, ms-word, riot-desktop, gnome-mpv, snox, gradio,
   * new profiles: standardnotes-desktop, shellcheck, patch, flameshot,
   * new profiles: rview, rvim, vimcat, vimdiff, vimpager, vimtutor, xxd,
-  * new profiles: Beaker, electrum, clamtk, pybitmessage, dig, whois
+  * new profiles: Beaker, electrum, clamtk, pybitmessage, dig, whois,
+  * new profiles: jdownloader
  -- netblue30 <netblue30@yahoo.com>  Sat, 11 Aug 2018 08:00:00 -0500
 
 firejail (0.9.54) baseline; urgency=low
diff --git a/etc/JDownloader.profile b/etc/JDownloader.profile
new file mode 100644
index 000000000..659a41603
--- /dev/null
+++ b/etc/JDownloader.profile
@@ -0,0 +1,51 @@
+# Firejail profile for JDownloader
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/JDownloader.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+noblacklist ${HOME}/.jd
+
+# Allow access to java
+noblacklist ${PATH}/java
+noblacklist /usr/lib/java
+noblacklist /etc/java
+noblacklist /usr/share/java
+
+include /etc/firejail/disable-common.inc
+include /etc/firejail/disable-devel.inc
+include /etc/firejail/disable-interpreters.inc
+include /etc/firejail/disable-passwdmgr.inc
+include /etc/firejail/disable-programs.inc
+include /etc/firejail/disable-xdg.inc
+
+mkdir ${HOME}/.jd
+whitelist ${HOME}/.jd
+whitelist ${DOWNLOADS}
+include /etc/firejail/whitelist-common.inc
+include /etc/firejail/whitelist-var-common.inc
+
+caps.drop all
+ipc-namespace
+netfilter
+no3d
+nodbus
+nodvd
+nogroups
+nonewprivs
+noroot
+nosound
+notv
+novideo
+protocol unix,inet,inet6
+seccomp
+shell none
+
+private-cache
+private-dev
+private-tmp
+
+noexec ${HOME}
+noexec /tmp
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index d685fceed..1213e4f24 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -287,6 +287,7 @@ blacklist ${HOME}/.inkscape
 blacklist ${HOME}/.jack-server
 blacklist ${HOME}/.jack-settings
 blacklist ${HOME}/.java
+blacklist ${HOME}/.jd
 blacklist ${HOME}/.jitsi
 blacklist ${HOME}/.kde/share/apps/digikam
 blacklist ${HOME}/.kde/share/apps/gwenview
diff --git a/etc/jdownloader.profile b/etc/jdownloader.profile
new file mode 100644
index 000000000..dbcc85e8d
--- /dev/null
+++ b/etc/jdownloader.profile
@@ -0,0 +1,10 @@
+# Firejail profile for jdownloader
+# This file is overwritten after every install/update
+# Persistent local customizations
+include /etc/firejail/jdownloader.local
+# Persistent global definitions
+include /etc/firejail/globals.local
+
+
+# Redirect
+include /etc/firejail/JDownloader.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 5ae1c28cd..676c2d90a 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -10,6 +10,7 @@ Discord
 DiscordCanary
 FossaMail
 Fritzing
+JDownloader
 Mathematica
 Natron
 Telegram
@@ -218,6 +219,7 @@ inox
 iridium
 iridium-browser
 jd-gui
+jdownloader
 jitsi
 k3b
 kaffeine
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 09c26fc92..fa3b3da0a 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1160,7 +1160,7 @@ void fs_check_chroot_dir(const char *rootdir) {
         if (asprintf(&overlay, "%s/.firejail", cfg.homedir) == -1)
                 errExit("asprintf");
         if (strncmp(rootdir, overlay, strlen(overlay)) == 0) {
-                fprintf(stderr, "Error: invalid chroot directory %s\n", rootdir);
+                fprintf(stderr, "Error: invalid chroot directory: no directories in ~/.firejail are allowed\n");
                 exit(1);
         }
         free(overlay);
@@ -1171,7 +1171,7 @@ void fs_check_chroot_dir(const char *rootdir) {
                 fprintf(stderr, "Error: invalid chroot directory %s\n", rootdir);
                 exit(1);
         }
-        // rootdir has to be owned by root and is not allowed to be world-writable;
+        // rootdir has to be owned by root and is not allowed to be generally writable,
         // this also excludes /tmp, /var/tmp and such
         if (fstat(parentfd, &s) == -1)
                 errExit("fstat");
@@ -1179,8 +1179,8 @@ void fs_check_chroot_dir(const char *rootdir) {
                 fprintf(stderr, "Error: chroot directory should be owned by root\n");
                 exit(1);
         }
-        if ((S_IWOTH & s.st_mode) != 0) {
-                fprintf(stderr, "Error: chroot directory should not be world-writable\n");
+        if (((S_IWGRP|S_IWOTH) & s.st_mode) != 0) {
+                fprintf(stderr, "Error: only root user should be given write permission on chroot directory\n");
                 exit(1);
         }
 
@@ -1252,8 +1252,8 @@ void fs_check_chroot_dir(const char *rootdir) {
                 fprintf(stderr, "Error: chroot /etc should be a directory owned by root\n");
                 exit(1);
         }
-        if ((S_IWOTH & s.st_mode) != 0) {
-                fprintf(stderr, "Error: chroot /etc should not be world-writable\n");
+        if (((S_IWGRP|S_IWOTH) & s.st_mode) != 0) {
+                fprintf(stderr, "Error: only root user should be given write permission on chroot /etc\n");
                 exit(1);
         }
         close(fd);
@@ -1346,8 +1346,8 @@ void fs_chroot(const char *rootdir) {
                         fprintf(stderr, "Error: chroot /run should be a directory owned by root\n");
                         exit(1);
                 }
-                if ((S_IWOTH & s.st_mode) != 0) {
-                        fprintf(stderr, "Error: chroot /run should not be world-writable\n");
+                if (((S_IWGRP|S_IWOTH) & s.st_mode) != 0) {
+                        fprintf(stderr, "Error: only root user should be given write permission on chroot /run\n");
                         exit(1);
                 }
         }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index b5d46808a..3f8640e9a 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -860,6 +860,8 @@ int main(int argc, char **argv) {
         int lockfd_directory = -1;
         int option_cgroup = 0;
         int custom_profile = 0; // custom profile loaded
+        int arg_seccomp_cmdline = 0;    // seccomp requested on command line (used to break --chroot)
+        int arg_caps_cmdline = 0;       // seccomp requested on command line (used to break --chroot)
 
         // drop permissions by default and rise them when required
         EUID_INIT();
@@ -1144,6 +1146,7 @@ int main(int argc, char **argv) {
                                 }
                                 arg_seccomp = 1;
                                 cfg.seccomp_list = seccomp_check_list(argv[i] + 10);
+                                arg_seccomp_cmdline = 1;
                         }
                         else
                                 exit_err_feature("seccomp");
@@ -1156,6 +1159,7 @@ int main(int argc, char **argv) {
                                 }
                                 arg_seccomp = 1;
                                 cfg.seccomp_list_drop = seccomp_check_list(argv[i] + 15);
+                                arg_seccomp_cmdline = 1;
                         }
                         else
                                 exit_err_feature("seccomp");
@@ -1168,6 +1172,7 @@ int main(int argc, char **argv) {
                                 }
                                 arg_seccomp = 1;
                                 cfg.seccomp_list_keep = seccomp_check_list(argv[i] + 15);
+                                arg_seccomp_cmdline = 1;
                         }
                         else
                                 exit_err_feature("seccomp");
@@ -1186,8 +1191,10 @@ int main(int argc, char **argv) {
                                 exit_err_feature("seccomp");
                 }
 #endif
-                else if (strcmp(argv[i], "--caps") == 0)
+                else if (strcmp(argv[i], "--caps") == 0) {
                         arg_caps_default_filter = 1;
+                        arg_caps_cmdline = 1;
+                }
                 else if (strcmp(argv[i], "--caps.drop=all") == 0)
                         arg_caps_drop_all = 1;
                 else if (strncmp(argv[i], "--caps.drop=", 12) == 0) {
@@ -1197,6 +1204,7 @@ int main(int argc, char **argv) {
                                 errExit("strdup");
                         // verify caps list and exit if problems
                         caps_check_list(arg_caps_list, NULL);
+                        arg_caps_cmdline = 1;
                 }
                 else if (strncmp(argv[i], "--caps.keep=", 12) == 0) {
                         arg_caps_keep = 1;
@@ -1205,9 +1213,8 @@ int main(int argc, char **argv) {
                                 errExit("strdup");
                         // verify caps list and exit if problems
                         caps_check_list(arg_caps_list, NULL);
+                        arg_caps_cmdline = 1;
                 }
-
-
                 else if (strcmp(argv[i], "--trace") == 0)
                         arg_trace = 1;
                 else if (strcmp(argv[i], "--tracelog") == 0)
@@ -2218,6 +2225,14 @@ int main(int argc, char **argv) {
         }
         EUID_ASSERT();
 
+        // exit for --chroot sandboxes when secomp or caps are explicitly specified on command line
+        if (getuid() != 0 && cfg.chrootdir && (arg_seccomp_cmdline || arg_caps_cmdline)) {
+                fprintf(stderr, "Error: for chroot sandboxes, default seccomp and capabilities filters are\n"
+                        "enabled by default. Please remove all --seccomp and --caps options from the\n"
+                        "command line.\n");
+                exit(1);
+        }
+
         // prog_index could still be -1 if no program was specified
         if (prog_index == -1 && arg_shell_none) {
                 fprintf(stderr, "Error: shell=none configured, but no program specified\n");
@@ -2232,12 +2247,12 @@ int main(int argc, char **argv) {
         // check user namespace (--noroot) options
         if (arg_noroot) {
                 if (arg_overlay) {
-                        fprintf(stderr, "Error: --overlay and --noroot are mutually exclusive.\n");
-                        exit(1);
+                        fwarning("--overlay and --noroot are mutually exclusive, --noroot disabled...\n");
+                        arg_noroot = 0;
                 }
                 else if (cfg.chrootdir) {
-                        fprintf(stderr, "Error: --chroot and --noroot are mutually exclusive.\n");
-                        exit(1);
+                        fwarning("--chroot and --noroot are mutually exclusive, --noroot disabled...\n");
+                        arg_noroot = 0;
                 }
         }
 
@@ -2311,39 +2326,30 @@ int main(int argc, char **argv) {
 
         // use default.profile as the default
         if (!custom_profile && !arg_noprofile) {
-                if (cfg.chrootdir) {
-                        fwarning("default profile disabled by --chroot option\n");
-                }
-//              else if (arg_overlay) {
-//                      fwarning("default profile disabled by --overlay option\n");
-//              }
-                else {
-                        // try to load a default profile
-                        char *profile_name = DEFAULT_USER_PROFILE;
-                        if (getuid() == 0)
-                                profile_name = DEFAULT_ROOT_PROFILE;
-                        if (arg_debug)
-                                printf("Attempting to find %s.profile...\n", profile_name);
-
-                        // look for the profile in ~/.config/firejail directory
-                        char *usercfgdir;
-                        if (asprintf(&usercfgdir, "%s/.config/firejail", cfg.homedir) == -1)
-                                errExit("asprintf");
-                        custom_profile = profile_find(profile_name, usercfgdir);
-                        free(usercfgdir);
+                char *profile_name = DEFAULT_USER_PROFILE;
+                if (getuid() == 0)
+                        profile_name = DEFAULT_ROOT_PROFILE;
+                if (arg_debug)
+                        printf("Attempting to find %s.profile...\n", profile_name);
 
-                        if (!custom_profile)
-                                // look for the profile in /etc/firejail directory
-                                custom_profile = profile_find(profile_name, SYSCONFDIR);
+                // look for the profile in ~/.config/firejail directory
+                char *usercfgdir;
+                if (asprintf(&usercfgdir, "%s/.config/firejail", cfg.homedir) == -1)
+                        errExit("asprintf");
+                custom_profile = profile_find(profile_name, usercfgdir);
+                free(usercfgdir);
 
-                        if (!custom_profile) {
-                                fprintf(stderr, "Error: no default.profile installed\n");
-                                exit(1);
-                        }
+                if (!custom_profile)
+                        // look for the profile in /etc/firejail directory
+                        custom_profile = profile_find(profile_name, SYSCONFDIR);
 
-                        if (custom_profile)
-                                fmessage("\n** Note: you can use --noprofile to disable %s.profile **\n\n", profile_name);
+                if (!custom_profile) {
+                        fprintf(stderr, "Error: no default.profile installed\n");
+                        exit(1);
                 }
+
+                if (custom_profile)
+                        fmessage("\n** Note: you can use --noprofile to disable %s.profile **\n\n", profile_name);
         }
         EUID_ASSERT();