6 files changed, 53 insertions, 42 deletions

diff --git a/etc/inc/archiver-common.inc b/etc/inc/archiver-common.inc
index 2c5e4d8bf..9812e3ebb 100644
--- a/etc/inc/archiver-common.inc
+++ b/etc/inc/archiver-common.inc
@@ -6,12 +6,21 @@ include archiver-common.local
 
 blacklist ${RUNUSER}
 
-include disable-common.inc
+# WARNING:
+# Users can (un)restrict file access for **all** archivers by commenting/uncommenting the needed
+# include file(s) here or by putting those into archiver-common.local.
+# Another option is to do this **per archiver** in the relevant <archiver>.local.
+# Just beware that things tend to break when overtightening profiles. For example, because you only
+# need to (un)compress files in ${DOWNLOADS}, other applications may need access to ${HOME}/.local/share.
+
+# Uncomment the next line (or put it into your archiver-common.local) if you don't need to compress files in disable-common.inc.
+#include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
-include disable-programs.inc
+# Uncomment the next line (or put it into your archiver-common.local) if you don't need to compress files in disable-programs.inc.
+#include disable-programs.inc
 include disable-shell.inc
 
 apparmor
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index 2b56bb5be..d88506d90 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -517,16 +517,19 @@ blacklist /proc/config.gz
 blacklist ${PATH}/dig
 blacklist ${PATH}/dlint
 blacklist ${PATH}/dns2tcp
+blacklist ${PATH}/dnssec-*
 blacklist ${PATH}/dnswalk
 blacklist ${PATH}/drill
 blacklist ${PATH}/host
 blacklist ${PATH}/iodine
 blacklist ${PATH}/kdig
+blacklist ${PATH}/khost
 blacklist ${PATH}/knsupdate
 blacklist ${PATH}/ldns-*
 blacklist ${PATH}/ldnsd
 blacklist ${PATH}/nslookup
 blacklist ${PATH}/resolvectl
+blacklist ${PATH}/unbound-host
 
 # rest of ${RUNUSER}
 blacklist ${RUNUSER}/*.lock
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index af891d61f..8c7c19203 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -360,43 +360,38 @@ void fs_private(void) {
         selinux_relabel_path("/root", "/root");
         fs_logger("tmpfs /root");
 
-        if (arg_allusers) {
-                if (u != 0)
-                        // mask user home directory
-                        // the directory should be owned by the current user
-                        fs_tmpfs(homedir, 1);
-        }
-        else { // mask /home
+        // mask /home
+        if (!arg_allusers) {
                 if (arg_debug)
                         printf("Mounting a new /home directory\n");
                 if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /home directory");
                 selinux_relabel_path("/home", "/home");
                 fs_logger("tmpfs /home");
+        }
 
-                if (u != 0) {
-                        if (strncmp(homedir, "/home/", 6) == 0) {
-                                // create /home/user
-                                if (arg_debug)
-                                        printf("Create a new user directory\n");
-                                if (mkdir(homedir, S_IRWXU) == -1) {
-                                        if (mkpath_as_root(homedir) == -1)
-                                                errExit("mkpath");
-                                        if (mkdir(homedir, S_IRWXU) == -1 && errno != EEXIST)
-                                                errExit("mkdir");
-                                }
-                                if (chown(homedir, u, g) < 0)
-                                        errExit("chown");
-
-                                selinux_relabel_path(homedir, homedir);
-                                fs_logger2("mkdir", homedir);
-                                fs_logger2("tmpfs", homedir);
+        if (u != 0) {
+                if (!arg_allusers && strncmp(homedir, "/home/", 6) == 0) {
+                        // create new empty /home/user directory
+                        if (arg_debug)
+                                printf("Create a new user directory\n");
+                        if (mkdir(homedir, S_IRWXU) == -1) {
+                                if (mkpath_as_root(homedir) == -1)
+                                        errExit("mkpath");
+                                if (mkdir(homedir, S_IRWXU) == -1)
+                                        errExit("mkdir");
                         }
-                        else
-                                // mask user home directory
-                                // the directory should be owned by the current user
-                                fs_tmpfs(homedir, 1);
+                        if (chown(homedir, u, g) < 0)
+                                errExit("chown");
+
+                        selinux_relabel_path(homedir, homedir);
+                        fs_logger2("mkdir", homedir);
+                        fs_logger2("tmpfs", homedir);
                 }
+                else
+                        // mask user home directory
+                        // the directory should be owned by the current user
+                        fs_tmpfs(homedir, 1);
         }
 
         skel(homedir, u, g);
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index 84cbb1977..a5c924a70 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -31,6 +31,8 @@
 #define O_PATH 010000000
 #endif
 
+#define PULSE_CLIENT_SYSCONF "/etc/pulse/client.conf"
+
 // disable pulseaudio socket
 void pulseaudio_disable(void) {
         if (arg_debug)
@@ -73,8 +75,8 @@ void pulseaudio_disable(void) {
         closedir(dir);
 }
 
-static void pulseaudio_set_environment(const char *path) {
-        assert(path);
+static void pulseaudio_fallback(const char *path) {
+        fmessage("Cannot mount tmpfs on %s/.config/pulse\n", cfg.homedir);
         if (setenv("PULSE_CLIENTCONFIG", path, 1) < 0)
                 errExit("setenv");
 }
@@ -84,9 +86,9 @@ void pulseaudio_init(void) {
         struct stat s;
 
         // do we have pulseaudio in the system?
-        if (stat("/etc/pulse/client.conf", &s) == -1) {
+        if (stat(PULSE_CLIENT_SYSCONF, &s) == -1) {
                 if (arg_debug)
-                        printf("/etc/pulse/client.conf not found\n");
+                        printf("%s not found\n", PULSE_CLIENT_SYSCONF);
                 return;
         }
 
@@ -101,7 +103,7 @@ void pulseaudio_init(void) {
         char *pulsecfg = NULL;
         if (asprintf(&pulsecfg, "%s/client.conf", RUN_PULSE_DIR) == -1)
                 errExit("asprintf");
-        if (copy_file("/etc/pulse/client.conf", pulsecfg, -1, -1, 0644)) // root needed
+        if (copy_file(PULSE_CLIENT_SYSCONF, pulsecfg, -1, -1, 0644)) // root needed
                 errExit("copy_file");
         FILE *fp = fopen(pulsecfg, "a");
         if (!fp)
@@ -126,11 +128,11 @@ void pulseaudio_init(void) {
         if (create_empty_dir_as_user(homeusercfg, 0700))
                 fs_logger2("create", homeusercfg);
 
-        // if ~/.config/pulse now exists and there are no symbolic links, mount the new directory
+        // if ~/.config/pulse exists and there are no symbolic links, mount the new directory
         // else set environment variable
         int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1) {
-                pulseaudio_set_environment(pulsecfg);
+                pulseaudio_fallback(pulsecfg);
                 goto out;
         }
         // confirm the actual mount destination is owned by the user
@@ -138,12 +140,12 @@ void pulseaudio_init(void) {
                 if (errno != EACCES)
                         errExit("fstat");
                 close(fd);
-                pulseaudio_set_environment(pulsecfg);
+                pulseaudio_fallback(pulsecfg);
                 goto out;
         }
         if (s.st_uid != getuid()) {
                 close(fd);
-                pulseaudio_set_environment(pulsecfg);
+                pulseaudio_fallback(pulsecfg);
                 goto out;
         }
         // preserve a read-only mount
@@ -171,8 +173,9 @@ void pulseaudio_init(void) {
         char *p;
         if (asprintf(&p, "%s/client.conf", homeusercfg) == -1)
                 errExit("asprintf");
+        if (setenv("PULSE_CLIENTCONFIG", p, 1) < 0)
+                errExit("setenv");
         fs_logger2("create", p);
-        pulseaudio_set_environment(p);
         free(p);
 
         // RUN_PULSE_DIR not needed anymore, mask it
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 5c7b5e556..5115191ea 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -141,7 +141,7 @@ void set_apparmor(void) {
 }
 #endif
 
-void seccomp_debug(void) {
+static void seccomp_debug(void) {
         if (arg_debug == 0)
                 return;
 
diff --git a/src/firejail/util.c b/src/firejail/util.c
index e8b35a64b..6cc1bc720 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -75,10 +75,11 @@ static void clean_supplementary_groups(gid_t gid) {
                 goto clean_all;
 
         // clean supplementary group list
-        // allow only tty, audio, video, games
+        // allow only firejail, tty, audio, video, games
         gid_t new_groups[MAX_GROUPS];
         int new_ngroups = 0;
         char *allowed[] = {
+                "firejail",
                 "tty",
                 "audio",
                 "video",