11 files changed, 95 insertions, 22 deletions

diff --git a/README b/README
index 405eb5c4e..03b934a3e 100644
--- a/README
+++ b/README
@@ -351,6 +351,10 @@ SYN-cook (https://github.com/SYN-cook)
         - Engrampa profile
         - Scribus profile
         - autostart blacklist for KDE
+        - blacklist startup scripts
+startx2017 (https://github.com/startx2017)
+        - syscall list update
+        - enable/disable join support in /etc/firejail/firejail.config
 thewisenerd (https://github.com/thewisenerd)
         - allow multiple private-home commands
         - use $SHELL variable if the shell is not specified
diff --git a/RELNOTES b/RELNOTES
index ea09f17e4..61732c390 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -37,6 +37,7 @@ firejail (0.9.45) baseline; urgency=low
   * feature: allow tmpfs for regular users for files in home directory
   * feature: mount a tmpfs on top of ~/.cache directory by default
   * feature: config support to disable tmpfs mounting on ~/.cache (cache-tmpfs)
+  * feature: config support to disable join (join)
   * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire,
   * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
   * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 3bf609214..be3144133 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -7,19 +7,27 @@ blacklist-nolog ${HOME}/.history
 blacklist-nolog ${HOME}/.*_history
 blacklist-nolog ${HOME}/.bash_history
 blacklist ${HOME}/.local/share/systemd
+blacklist ${HOME}/.config/systemd
 blacklist-nolog ${HOME}/.adobe
 blacklist-nolog ${HOME}/.macromedia
 read-only ${HOME}/.local/share/applications
 
 # X11 session autostart
 blacklist ${HOME}/.xinitrc
+blacklist ${HOME}/.xserverrc
+blacklist /etc/X11/Xsession.d/
+blacklist ${HOME}/.Xsession
+blacklist ${HOME}/.xsession
+blacklist ${HOME}/.xsessionrc
 blacklist ${HOME}/.xprofile
+blacklist ${HOME}/.gnomerc
 blacklist ${HOME}/.config/autostart
 blacklist /etc/xdg/autostart
 blacklist ${HOME}/.kde4/Autostart
 blacklist ${HOME}/.kde4/share/autostart
 blacklist ${HOME}/.kde/Autostart
 blacklist ${HOME}/.kde/share/autostart
+blacklist ${HOME}/.local/share/autostart
 blacklist ${HOME}/.config/autostart-scripts
 blacklist ${HOME}/.config/plasma-workspace/shutdown
 blacklist ${HOME}/.config/plasma-workspace/env
@@ -27,8 +35,6 @@ blacklist ${HOME}/.config/lxsession/LXDE/autostart
 blacklist ${HOME}/.fluxbox/startup
 blacklist ${HOME}/.config/openbox/autostart
 blacklist ${HOME}/.config/openbox/environment
-blacklist ${HOME}/.gnomerc
-blacklist /etc/X11/Xsession.d/
 # blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs
 
 # VirtualBox
@@ -78,8 +84,6 @@ blacklist /etc/rc.local
 blacklist /etc/anacrontab
 
 # Startup files
-read-only ${HOME}/.xinitrc
-read-only ${HOME}/.xserverrc
 read-only ${HOME}/.antigen
 read-only ${HOME}/.bash_login
 read-only ${HOME}/.bashrc
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 90d0d5375..00c6e195a 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -42,8 +42,6 @@ blacklist ${HOME}/.config/ardour5
 blacklist ${HOME}/.config/arkrc
 blacklist ${HOME}/.config/atril
 blacklist ${HOME}/.config/audacious
-blacklist ${HOME}/.config/autostart
-blacklist ${HOME}/.config/autostart/dropbox.desktop
 blacklist ${HOME}/.config/aweather
 blacklist ${HOME}/.config/blender
 blacklist ${HOME}/.config/bless
diff --git a/etc/firefox.profile b/etc/firefox.profile
index dec44ca67..20acde62a 100644
--- a/etc/firefox.profile
+++ b/etc/firefox.profile
@@ -51,4 +51,4 @@ include /etc/firejail/whitelist-common.inc
 #private-bin firefox,which,sh,dbus-launch,dbus-send,env
 #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
 private-dev 
-#private-tmp
+private-tmp
diff --git a/etc/firejail.config b/etc/firejail.config
index 0887e05b5..1db734f77 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -43,6 +43,10 @@
 # that is partially under their control.  Default disabled.
 # force-nonewprivs no
 
+# Allow sandbox joining as a regular user, default enabled.
+# root user can always join sandboxes.
+# join yes
+
 # Enable or disable networking features, default enabled.
 # network yes
 
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 476ecbe10..67bcd996a 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -92,6 +92,15 @@ int checkcfg(int val) {
                                 else
                                         goto errout;
                         }
+                        // join
+                        else if (strncmp(ptr, "join ", 5) == 0) {
+                                if (strcmp(ptr + 5, "yes") == 0)
+                                        cfg_val[CFG_JOIN] = 1;
+                                else if (strcmp(ptr + 5, "no") == 0)
+                                        cfg_val[CFG_JOIN] = 0;
+                                else
+                                        goto errout;
+                        }
                         // x11
                         else if (strncmp(ptr, "x11 ", 4) == 0) {
                                 if (strcmp(ptr + 4, "yes") == 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index f85560588..dbb6c4d16 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -686,6 +686,7 @@ enum {
         CFG_FOLLOW_SYMLINK_PRIVATE_BIN,
         CFG_DISABLE_MNT,
         CFG_CACHE_TMPFS,
+        CFG_JOIN,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
diff --git a/src/firejail/main.c b/src/firejail/main.c
index db9a9c8cb..3dcc5c62d 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -615,23 +615,27 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
         }
 #endif
         else if (strncmp(argv[i], "--join=", 7) == 0) {
-                logargs(argc, argv);
-
-                if (arg_shell_none) {
-                        if (argc <= (i+1)) {
-                                fprintf(stderr, "Error: --shell=none set, but no command specified\n");
-                                exit(1);
+                if (checkcfg(CFG_JOIN) || getuid() == 0) {
+                        logargs(argc, argv);
+        
+                        if (arg_shell_none) {
+                                if (argc <= (i+1)) {
+                                        fprintf(stderr, "Error: --shell=none set, but no command specified\n");
+                                        exit(1);
+                                }
+                                cfg.original_program_index = i + 1;
                         }
-                        cfg.original_program_index = i + 1;
+        
+                        if (!cfg.shell && !arg_shell_none)
+                                cfg.shell = guess_shell();
+        
+                        // join sandbox by pid or by name
+                        pid_t pid = read_pid(argv[i] + 7);
+                        join(pid, argc, argv, i + 1);
+                        exit(0);
                 }
-
-                if (!cfg.shell && !arg_shell_none)
-                        cfg.shell = guess_shell();
-
-                // join sandbox by pid or by name
-                pid_t pid = read_pid(argv[i] + 7);
-                join(pid, argc, argv, i + 1);
-                exit(0);
+                else
+                        exit_err_feature("join");
 
         }
         else if (strncmp(argv[i], "--join-or-start=", 16) == 0) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index f26f8b06a..d1557e8b2 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -742,6 +742,20 @@ int sandbox(void* sandbox_arg) {
                 else {
                         // private-tmp is implemented as a whitelist
                         EUID_USER();
+                        // check XAUTHORITY file, KDE keeps it under /tmp
+                        char *xauth = getenv("XAUTHORITY");
+                        if (xauth) {
+                                char *rp = realpath(xauth, NULL);
+                                if (rp && strncmp(rp, "/tmp/", 5) == 0) {
+                                        char *cmd;
+                                        if (asprintf(&cmd, "whitelist %s", rp) == -1)
+                                                errExit("asprintf");
+                                        profile_add(cmd); // profile_add does not duplicate the string
+                                }
+                                if (rp)
+                                        free(rp);
+                        }
+                        // whitelist x11 directory
                         profile_add("whitelist /tmp/.X11-unix");
                         EUID_ROOT();
                 }
diff --git a/src/include/syscall.h b/src/include/syscall.h
index c49760703..8852fcbd5 100644
--- a/src/include/syscall.h
+++ b/src/include/syscall.h
@@ -1076,6 +1076,11 @@
         {"preadv", __NR_preadv},
 #endif
 #endif
+#ifdef SYS_preadv2
+#ifdef __NR_preadv2
+        {"preadv2", __NR_preadv2},
+#endif
+#endif
 #ifdef SYS_prlimit64
 #ifdef __NR_prlimit64
         {"prlimit64", __NR_prlimit64},
@@ -1126,6 +1131,11 @@
         {"pwritev", __NR_pwritev},
 #endif
 #endif
+#ifdef SYS_pwritev2
+#ifdef __NR_pwritev2
+        {"pwritev2", __NR_pwritev2},
+#endif
+#endif
 #ifdef SYS_query_module
 #ifdef __NR_query_module
         {"query_module", __NR_query_module},
@@ -1892,6 +1902,7 @@
 #endif
 #endif
 #endif
+//#endif
 #if defined __x86_64__ && defined __LP64__
 #ifdef SYS__sysctl
 #ifdef __NR__sysctl
@@ -2828,6 +2839,11 @@
         {"preadv", __NR_preadv},
 #endif
 #endif
+#ifdef SYS_preadv2
+#ifdef __NR_preadv2
+        {"preadv2", __NR_preadv2},
+#endif
+#endif
 #ifdef SYS_prlimit64
 #ifdef __NR_prlimit64
         {"prlimit64", __NR_prlimit64},
@@ -2868,6 +2884,11 @@
         {"pwritev", __NR_pwritev},
 #endif
 #endif
+#ifdef SYS_pwritev2
+#ifdef __NR_pwritev2
+        {"pwritev2", __NR_pwritev2},
+#endif
+#endif
 #ifdef SYS_query_module
 #ifdef __NR_query_module
         {"query_module", __NR_query_module},
@@ -3529,6 +3550,7 @@
 #endif
 #endif
 #endif
+//#endif
 #if defined __x86_64__ && defined __ILP32__
 #ifdef SYS_accept
 #ifdef __NR_accept
@@ -4430,6 +4452,11 @@
         {"preadv", __NR_preadv},
 #endif
 #endif
+#ifdef SYS_preadv2
+#ifdef __NR_preadv2
+        {"preadv2", __NR_preadv2},
+#endif
+#endif
 #ifdef SYS_prlimit64
 #ifdef __NR_prlimit64
         {"prlimit64", __NR_prlimit64},
@@ -4470,6 +4497,11 @@
         {"pwritev", __NR_pwritev},
 #endif
 #endif
+#ifdef SYS_pwritev2
+#ifdef __NR_pwritev2
+        {"pwritev2", __NR_pwritev2},
+#endif
+#endif
 #ifdef SYS_quotactl
 #ifdef __NR_quotactl
         {"quotactl", __NR_quotactl},
@@ -5111,3 +5143,5 @@
 #endif
 #endif
 #endif
+//#endif
+