23 files changed, 114 insertions, 30 deletions

diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
index 76e12116b..ccc5c9bf7 100644
--- a/.github/workflows/build-extra.yml
+++ b/.github/workflows/build-extra.yml
@@ -44,7 +44,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 34545f3b2..e7752f3d3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -60,7 +60,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml
index cfdcc4397..a0b7245e5 100644
--- a/.github/workflows/check-c.yml
+++ b/.github/workflows/check-c.yml
@@ -46,7 +46,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -79,7 +79,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -109,7 +109,7 @@ jobs:
     timeout-minutes: 10
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -143,7 +143,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         disable-sudo: true
         egress-policy: block
diff --git a/.github/workflows/check-profiles.yml b/.github/workflows/check-profiles.yml
index c9d3b037e..38cb1f29b 100644
--- a/.github/workflows/check-profiles.yml
+++ b/.github/workflows/check-profiles.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         disable-sudo: true
         egress-policy: block
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml
index 2a8e82a62..838414498 100644
--- a/.github/workflows/check-python.yml
+++ b/.github/workflows/check-python.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         disable-sudo: true
         egress-policy: block
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 3d8de04f7..6e0fe73d2 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: 5
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 4de44c2c6..c1ee00934 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -54,7 +54,7 @@ jobs:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -103,7 +103,7 @@ jobs:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -143,7 +143,7 @@ jobs:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -183,7 +183,7 @@ jobs:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
@@ -225,7 +225,7 @@ jobs:
       SHELL: /bin/bash
     steps:
     - name: Harden Runner
-      uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10
+      uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6
       with:
         egress-policy: block
         allowed-endpoints: >
diff --git a/README b/README
index b55cf3ef8..d64554f9a 100644
--- a/README
+++ b/README
@@ -171,7 +171,7 @@ aoand (https://github.com/aoand)
 Arne Welzel (https://github.com/awelzel)
         - ignore SIGTTOU during flush_stdin()
 archaon616 (https://github.com/archaon616)
-        - steam.profile: Allow Factorio
+        - steam.profile: allow Factorio, Zomboid
 Atrate (https://github.com/Atrate)
         - BetterDiscord support
 Austin Morton (https://github.com/apmorton)
@@ -326,6 +326,8 @@ curiosityseeker (https://github.com/curiosityseeker - new)
         - fixed conky profile
         - thunderbird.profile: harden and enable the rules necessary to make
           Firefox open links
+D357R0Y3R (https://github.com/D357R0Y3R)
+        - added floorp to firejail.config
 da2x (https://github.com/da2x)
         - matched RPM license tag
 Daan Bakker (https://github.com/dbakker)
@@ -371,6 +373,8 @@ DiGitHubCap (https://github.com/DiGitHubCap)
         - fix qt5ct colour schemes and QSS
 Dieter Plaetinck (https://github.com/Dieterbe)
         - qutebrowser: update MPRIS name for qutebrowser-qt6
+        - fix email-common.profile
+        - fix claws-mail profile
 Disconnect3d (https://github.com/disconnect3d)
         - code cleanup
 dm9pZCAq (https://github.com/dm9pZCAq)
@@ -408,13 +412,18 @@ Fabian Würfl (https://github.com/BafDyce)
         - Liferea profile
 Felipe Barriga Richards (https://github.com/fbarriga)
         - --private-etc fix
+Felix Pehla (https://github.com/FelixPehla)
+        - fix fractal profile
 fenuks (https://github.com/fenuks)
         - fix sound in games using FMOD
         - allow /opt/tor-browser for Tor Browser profile
 fkrone (https://github.com/fkrone)
         - fix Zoom profile
 Fidel Ramos (https://github.com/haplo)
-        - Ledger Live profile
+        - added Ledger Live profile
+        - fixed geeqie profile
+        - added rawtherapee profile
+        - added electron-cache profile
 Florian Begusch (https://github.com/florianbegusch)
         - (la)tex profiles
         - fixed transmission-common.profile
@@ -567,6 +576,9 @@ Haowei Yu (https://github.com/sfc-gh-hyu)
 Icaro Perseo (https://github.com/icaroperseo)
         - Icecat profile
         - several profile fixes
+Ilya Pankratov (https://github.com/i-pankrat)
+        - profstats fix
+        - fix various memory resource leaks
 Igor Bukanov (https://github.com/ibukanov)
         - found/fiixed privilege escalation in --hosts-file option
 iiotx (https://github.com/iiotx)
@@ -739,6 +751,8 @@ Liorst4 (https://github.com/Liorst4)
         - minetest fixes
 Lockdis (https://github.com/Lockdis)
         - Added crow, nyx, and google-earth-pro profiles
+luca0N (https://github.com/luca0N)
+        - fixed crawl profile
 Lukáš Krejčí (https://github.com/lskrejci)
         - fixed parsing of --keep-var-tmp
 luzpaz (https://github.com/luzpaz)
@@ -794,6 +808,8 @@ Michael Haas (https://github.com/mhaas)
         - bugfixes
 Michael Hoffmann (https://github.com/brisad)
         - added support for subdirs in private-etc
+Michele Sorcinelli (https://github.com/michelesr)
+        - fix ssh profile
 Mike Frysinger (vapier@gentoo.org)
         - Gentoo compile patch
 minus7 (https://github.com/minus7)
@@ -855,6 +871,7 @@ nolanl (https://github.com/nolanl)
 nutta-git (https://github.com/nutta-git)
         - steam.profile: allow process_vm_readv syscall
         - lutris.profile: allow more syscalls
+        - steam.profile: update novideo comment for webcam motion trackers
 nyancat18 (https://github.com/nyancat18)
         - added ardour4, dooble, karbon, krita profiles
 nya1 (https://github.com/nya1)
@@ -949,6 +966,8 @@ pszxzsd (https://github.com/pszxzsd)
         -uGet profile
 pwnage-pineapple (https://github.com/pwnage-pineapple)
         - update Okular profile
+qdii (https://github.com/qdii)
+        - added notpm command & keep tpm devices in private-dev
 Quentin Retornaz (https://github.com/qretornaz-adapei42)
         - microsoft-edge profiles fixes
 Quentin Minster (https://github.com/laomaiweng)
@@ -1003,6 +1022,8 @@ rootalc (https://github.com/rootalc)
         - add nolocal6.net filter
 Ruan (https://github.com/ruany)
         - fixed hexchat profile
+RundownRhino (https://github.com/RundownRhino)
+        - firefox profile fix
 rusty-snake (https://github.com/rusty-snake)
         - added profiles: thunderbird-wayland, supertuxkart, ghostwriter
         - added profiles: klavaro, mypaint, mypaint-ora-thumbnailer, nano
@@ -1040,18 +1061,17 @@ Serphentas (https://github.com/Serphentas)
         - add Paradox Launcher to Steam profile
 Slava Monich (https://github.com/monich)
         - added configure option to disable man pages
-Tobias Schmidl (https://github.com/schtobia)
-        - added profile for webui-aria2
 Simon Peter (https://github.com/probonopd)
         - set $APPIMAGE and $APPDIR environment variables
         - AppImage version detection
         - Leafppad type v1 and v2 appimage packages in test/appimage
         - GitHub/Travis CI integration
+Simo Piiroinen (https://github.com/spiiroin)
+        - Jolla/SailfishOS patches
+        - fix startup race condition for /run/firejail directory
 sinkuu (https://github.com/sinkuu)
         - blacklisting kwalletd
         - fix symlink invocation for programs placing symlinks in $PATH
-Simo Piiroinen (https://github.com/spiiroin)
-        - Jolla/SailfishOS patches
 slowpeek (https://github.com/slowpeek)
         - refine appimage example in docs
         - allow resolution of .local names with avahi-daemon in the apparmor profile
@@ -1059,6 +1079,9 @@ slowpeek (https://github.com/slowpeek)
         - make appimage examples consistent with --appimage option short description
         - blacklist google-drive-ocamlfuse config
         - blacklist sendgmail config
+Shahriar Heidrich (https://github.com/smheidrich)
+        - fix manpages
+        - fix i3 profile and disable-programs.profile
 smitsohu (https://github.com/smitsohu)
         - read-only kde4 services directory
         - enhanced mediathekview profile
@@ -1187,6 +1210,8 @@ Tomasz Jan Góralczyk (https://github.com/tjg)
         - fixed Steam profile
 Tomi Leppänen (https://github.com/Tomin1)
         - Jolla/SailfishOS patches
+Tobias Schmidl (https://github.com/schtobia)
+        - added profile for webui-aria2
 Topi Miettinen (https://github.com/topimiettinen)
         - improved seccomp printing
         - improve mount handling, fix /run/user handling
@@ -1201,6 +1226,8 @@ Ted Robertson (https://github.com/tredondo)
         - various documentation fixes
         - blacklist Exodus wallet
         - blacklist monero-project directory
+tools200ms (https://github.com/tools200ms)
+        - fixed allow-ssh.inc
 Tus1688 (https://github.com/Tus1688)
         - added neovim profile
 user1024 (user1024@tut.by)
diff --git a/RELNOTES b/RELNOTES
index 2e1fbf0b5..5b759b4e8 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -17,6 +17,7 @@ firejail (0.9.73) baseline; urgency=low
   * feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200
     #6228 #6260 #6302 #6305)
   * feature: add support for comm, coredump, and prctl procevents in firemon
+  * feature: add notpm command & keep tpm devices in private-dev (#6379 #6390)
   * modif: Stop forwarding own double-dash to the shell (#5599 #5600)
   * modif: Prevent sandbox name (--name=) and host name (--hostname=)
     from containing only digits (#5578 #5741)
@@ -31,7 +32,8 @@ firejail (0.9.73) baseline; urgency=low
   * modif: drop deprecated 'shell' option references (#5894)
   * modif: keep pipewire group unless nosound is used (#5992 #5993)
   * modif: fcopy: Use lstat when copying directory (#5957)
-  * modif: populate /run/firejail while holding flock (#6307)
+  * modif: private-dev: keep /dev/kfd unless no3d is used (#6380)
+  * modif: keep /sys/module/nvidia* if prop driver and no no3d (#6372 #6387)
   * removal: LTS and FIRETUNNEL support
   * bugfix: fix --hostname and --hosts-file commands
   * bugfix: fix examples in firejail-local AppArmor profile (#5717)
@@ -40,6 +42,7 @@ firejail (0.9.73) baseline; urgency=low
     (#5965 #5976)
   * bugfix: firejail --ls reports wrong file sizes for large files (#5982
     #6086)
+  * bugfix: fix startup race condition for /run/firejail directory (#6307)
   * bugfix: fix various resource leaks (#6367)
   * bugfix: profstats: fix restrict-namespaces max count (#6369)
   * build: auto-generate syntax files (#5627)
@@ -104,6 +107,8 @@ firejail (0.9.73) baseline; urgency=low
   * docs: add uninstall instructions to README.md (#5812)
   * docs: add precedence info to manpage & fix noblacklist example (#6358
     #6359)
+  * docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382)
+  * docs: man: format and sort some private- items (#6398)
   * legal: selinux.c: Split Copyright notice & use same license as upstream
     (#5667)
   * profiles: qutebrowser: fix links not opening in the existing instance
diff --git a/contrib/syntax/lists/profile_commands_arg0.list b/contrib/syntax/lists/profile_commands_arg0.list
index 0ac70e5cf..13adfeddc 100644
--- a/contrib/syntax/lists/profile_commands_arg0.list
+++ b/contrib/syntax/lists/profile_commands_arg0.list
@@ -27,6 +27,7 @@ nonewprivs
 noprinters
 noroot
 nosound
+notpm
 notv
 nou2f
 novideo
diff --git a/etc/profile-a-l/default.profile b/etc/profile-a-l/default.profile
index b0ae2d49f..659d9755e 100644
--- a/etc/profile-a-l/default.profile
+++ b/etc/profile-a-l/default.profile
@@ -37,6 +37,7 @@ noinput
 nonewprivs
 noroot
 #nosound
+#notpm
 notv
 #nou2f
 novideo
diff --git a/etc/templates/profile.template b/etc/templates/profile.template
index 459baf51a..d7c170303 100644
--- a/etc/templates/profile.template
+++ b/etc/templates/profile.template
@@ -175,6 +175,7 @@ include globals.local
 #noprinters
 #noroot
 #nosound
+#notpm
 #notv
 #nou2f
 #novideo
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index ab6eaf1dd..089dff663 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -138,6 +138,7 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
                 fprintf(fp, "#noinput\t# disable input devices\n");
                 fprintf(fp, "nonewprivs\n");
                 fprintf(fp, "noroot\n");
+                fprintf(fp, "#notpm\t# disable TPM devices\n");
                 fprintf(fp, "#notv\t# disable DVB TV devices\n");
                 fprintf(fp, "#nou2f\t# disable U2F devices\n");
                 fprintf(fp, "#novideo\t# disable video capture devices\n");
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 736af018d..8683e0f77 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -368,6 +368,7 @@ extern int arg_noprofile;	// use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;       // block writable and executable memory
 extern int arg_notv;    // --notv
 extern int arg_nodvd;   // --nodvd
+extern int arg_notpm;   // --notpm
 extern int arg_nou2f;   // --nou2f
 extern int arg_noinput; // --noinput
 extern int arg_deterministic_exit_code; // always exit with first child's exit status
@@ -646,6 +647,7 @@ void fs_dev_disable_3d(void);
 void fs_dev_disable_video(void);
 void fs_dev_disable_tv(void);
 void fs_dev_disable_dvd(void);
+void fs_dev_disable_tpm(void);
 void fs_dev_disable_u2f(void);
 void fs_dev_disable_input(void);
 
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index e8e486f12..34a26464a 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -39,6 +39,7 @@ typedef enum {
         DEV_VIDEO,
         DEV_TV,
         DEV_DVD,
+        DEV_TPM,
         DEV_U2F,
         DEV_INPUT
 } DEV_TYPE;
@@ -79,6 +80,12 @@ static DevEntry dev[] = {
         {"/dev/video9", RUN_DEV_DIR "/video9", DEV_VIDEO},
         {"/dev/dvb", RUN_DEV_DIR "/dvb", DEV_TV}, // DVB (Digital Video Broadcasting) - TV device
         {"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players
+        {"/dev/tpm0", RUN_DEV_DIR "/tpm0", DEV_TPM}, // TPM (Trusted Platform Module) devices
+        {"/dev/tpm1", RUN_DEV_DIR "/tpm1", DEV_TPM},
+        {"/dev/tpm2", RUN_DEV_DIR "/tpm2", DEV_TPM},
+        {"/dev/tpm3", RUN_DEV_DIR "/tpm3", DEV_TPM},
+        {"/dev/tpm4", RUN_DEV_DIR "/tpm4", DEV_TPM},
+        {"/dev/tpm5", RUN_DEV_DIR "/tpm5", DEV_TPM},
         {"/dev/hidraw0", RUN_DEV_DIR "/hidraw0", DEV_U2F},
         {"/dev/hidraw1", RUN_DEV_DIR "/hidraw1", DEV_U2F},
         {"/dev/hidraw2", RUN_DEV_DIR "/hidraw2", DEV_U2F},
@@ -105,6 +112,7 @@ static void deventry_mount(void) {
                             (dev[i].type == DEV_VIDEO && arg_novideo == 0) ||
                             (dev[i].type == DEV_TV && arg_notv == 0) ||
                             (dev[i].type == DEV_DVD && arg_nodvd == 0) ||
+                            (dev[i].type == DEV_TPM && arg_notpm == 0) ||
                             (dev[i].type == DEV_U2F && arg_nou2f == 0) ||
                             (dev[i].type == DEV_INPUT && arg_noinput == 0)) {
 
@@ -384,6 +392,15 @@ void fs_dev_disable_dvd(void) {
         }
 }
 
+void fs_dev_disable_tpm(void) {
+        int i = 0;
+        while (dev[i].dev_fname != NULL) {
+                if (dev[i].type == DEV_TPM)
+                        disable_file_or_dir(dev[i].dev_fname);
+                i++;
+        }
+}
+
 void fs_dev_disable_u2f(void) {
         int i = 0;
         while (dev[i].dev_fname != NULL) {
diff --git a/src/firejail/main.c b/src/firejail/main.c
index acbb4bf38..27ae68eb0 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -155,6 +155,7 @@ int arg_noprofile = 0; // use default.profile if none other found/specified
 int arg_memory_deny_write_execute = 0;          // block writable and executable memory
 int arg_notv = 0;       // --notv
 int arg_nodvd = 0; // --nodvd
+int arg_notpm = 0; // --notpm
 int arg_nou2f = 0; // --nou2f
 int arg_noinput = 0; // --noinput
 int arg_deterministic_exit_code = 0;    // always exit with first child's exit status
@@ -2209,6 +2210,8 @@ int main(int argc, char **argv, char **envp) {
                         arg_notv = 1;
                 else if (strcmp(argv[i], "--nodvd") == 0)
                         arg_nodvd = 1;
+                else if (strcmp(argv[i], "--notpm") == 0)
+                        arg_notpm = 1;
                 else if (strcmp(argv[i], "--nou2f") == 0)
                         arg_nou2f = 1;
                 else if (strcmp(argv[i], "--noinput") == 0)
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 4c6830250..1bb008f5f 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -618,6 +618,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #endif
                 return 1;
         }
+        else if (strcmp(ptr, "notpm") == 0) {
+                arg_notpm = 1;
+                return 0;
+        }
         else if (strcmp(ptr, "nou2f") == 0) {
                 arg_nou2f = 1;
                 return 0;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 9e2b10d9c..57c90d489 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -1101,6 +1101,9 @@ int sandbox(void* sandbox_arg) {
         if (arg_nodvd)
                 fs_dev_disable_dvd();
 
+        if (arg_notpm)
+                fs_dev_disable_tpm();
+
         if (arg_nou2f)
                 fs_dev_disable_u2f();
 
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 248b35853..01a7330fd 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -189,8 +189,8 @@ static const char *const usage_str =
         "    --noroot - install a user namespace with only the current user.\n"
 #endif
         "    --nosound - disable sound system.\n"
-        "    --noautopulse - disable automatic ~/.config/pulse init.\n"
         "    --novideo - disable video devices.\n"
+        "    --notpm - disable TPM devices.\n"
         "    --nou2f - disable U2F devices.\n"
         "    --nowhitelist=filename - disable whitelist for file or directory.\n"
         "    --oom=value - configure OutOfMemory killer for the sandbox\n"
diff --git a/src/include/etc_groups.h b/src/include/etc_groups.h
index 359dd5656..491dc18c8 100644
--- a/src/include/etc_groups.h
+++ b/src/include/etc_groups.h
@@ -70,6 +70,7 @@ static char *etc_group_sound[] = {
         "alsa",
         "asound.conf",
         "machine-id", // required by PulseAudio
+        "pipewire",
         "pulse",
         NULL
 };
diff --git a/src/man/firejail-profile.5.in b/src/man/firejail-profile.5.in
index 8c039eb46..89784a984 100644
--- a/src/man/firejail-profile.5.in
+++ b/src/man/firejail-profile.5.in
@@ -382,9 +382,11 @@ Set working directory inside jail to the home directory, and failing that, the r
 Set working directory inside the jail. Full directory path is required. Symbolic links are not allowed.
 .TP
 \fBprivate-dev
-Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx,
-random, snd, urandom, video, log, shm and usb devices are available.
-Use the options no3d, nodvd, nosound, notv, nou2f and novideo for additional restrictions.
+Create a new /dev directory.
+Only disc, dri, dvb, full, hidraw, log, null, ptmx, pts, random, shm, snd, tpm,
+tty, urandom, usb, video and zero devices are available.
+Use the options no3d, nodvd, nosound, notpm, notv, nou2f and novideo for
+additional restrictions.
 
 .TP
 \fBprivate-etc file,directory
@@ -817,6 +819,9 @@ Disable input devices.
 \fBnosound
 Disable sound system.
 .TP
+\fBnotpm
+Disable Trusted Platform Module (TPM) devices.
+.TP
 \fBnotv
 Disable DVB (Digital Video Broadcasting) TV devices.
 .TP
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in
index fa2329d67..f14eb6ec0 100644
--- a/src/man/firejail.1.in
+++ b/src/man/firejail.1.in
@@ -1919,6 +1919,16 @@ Example:
 $ firejail \-\-nosound firefox
 
 .TP
+\fB\-\-notpm
+Disable Trusted Platform Module (TPM) devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-notpm
+
+.TP
 \fB\-\-notv
 Disable DVB (Digital Video Broadcasting) TV devices.
 .br
@@ -2108,7 +2118,7 @@ File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
 .br
 Example:
 .br
-$ firejail \-\-private-bin=bash,sed,ls,cat
+$ firejail \-\-private-bin=bash,cat,ls,sed
 .br
 Parent pid 20841, child pid 20842
 .br
@@ -2172,8 +2182,11 @@ $ pwd
 
 .TP
 \fB\-\-private-dev
-Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log, shm and usb devices are available.
-Use the options --no3d, --nodvd, --nosound, --notv, --nou2f and --novideo for additional restrictions.
+Create a new /dev directory.
+Only disc, dri, dvb, full, hidraw, log, null, ptmx, pts, random, shm, snd, tpm,
+tty, urandom, usb, video and zero devices are available.
+Use the options \-\-no3d, \-\-nodvd, \-\-nosound, \-\-notpm, \-\-notv,
+\-\-nou2f and \-\-novideo for additional restrictions.
 .br
 
 .br
@@ -2191,7 +2204,7 @@ cdrom  cdrw  dri  dvd  dvdrw  full  log  null  ptmx  pts  random  shm  snd  sr0
 .br
 $
 .TP
-\fB\-\-private-etc, \-\-private-etc=file,directory,@group
+\fB\-\-private-etc, \-\-private-etc=@group,file,directory
 The files installed by \-\-private-etc are copies of the original system files from /etc directory.
 By default, the command brings in a skeleton of files and directories used by most console tools:
 
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
index 15e9a5111..ecfe2ffdf 100644
--- a/src/zsh_completion/_firejail.in
+++ b/src/zsh_completion/_firejail.in
@@ -124,7 +124,6 @@ _firejail_args=(
     # many would enjoy getting a list from -20..20
     '--nice=-[set nice value]: :(1 10 15 20)'
     '--no3d[disable 3D hardware acceleration]'
-    '--noautopulse[disable automatic ~/.config/pulse init]'
     '--noblacklist=-[disable blacklist for file or directory]: :_files'
     '--nodbus[disable D-Bus access]'
     '--nodvd[disable DVD and audio CD devices]'
@@ -134,6 +133,7 @@ _firejail_args=(
     '--nonewprivs[sets the NO_NEW_PRIVS prctl]'
     '--noprinters[disable printers]'
     '--nosound[disable sound system]'
+    '--notpm[disable TPM devices]'
     '--nou2f[disable U2F devices]'
     '--novideo[disable video devices]'
     '--private[temporary home directory]'