23 files changed, 95 insertions, 41 deletions

diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
index bf58e1dff..86baecf2f 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.md
+++ b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -25,7 +25,7 @@ Steps to reproduce the behavior:
 
 **Environment**
  - Linux distribution and version (ie output of `lsb_release -a`, `screenfetch` or `cat /etc/os-release`)
- - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`) 
+ - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`)
 
 **Additional context**
 Other context about the problem like related errors to understand the problem.
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
index 1468ef898..d026b9356 100644
--- a/.github/workflows/build-extra.yml
+++ b/.github/workflows/build-extra.yml
@@ -1,6 +1,6 @@
 name: Build-extra CI
 
-on:   
+on:
   push:
     branches: [ master ]
     paths-ignore:
@@ -19,7 +19,7 @@ on:
       - RELNOTES
       - SECURITY.md
       - 'etc/**'
-        
+
 jobs:
   build-clang:
     if: ${{ ! contains(github.event.commits[0].message, '[skip ci]') }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 301c7fad2..d974d650e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -11,7 +11,7 @@ on:
     paths-ignore:
       - CONTRIBUTING.md
       - README
-      - README.md  
+      - README.md
       - RELNOTES
       - SECURITY.md
       - 'etc/**'
@@ -21,7 +21,7 @@ on:
     paths-ignore:
       - CONTRIBUTING.md
       - README
-      - README.md  
+      - README.md
       - RELNOTES
       - SECURITY.md
       - 'etc/**'
@@ -61,7 +61,7 @@ jobs:
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file. 
+        # By default, queries listed here will override any specified in a config file.
         # Prefix the list here with "+" to use these queries and those in the config file.
         # queries: ./path/to/local/query, your-org/your-repo/queries@main
 
diff --git a/.github/workflows/sort.yml b/.github/workflows/sort.yml
index 55ac065b6..878a5eb82 100644
--- a/.github/workflows/sort.yml
+++ b/.github/workflows/sort.yml
@@ -1,7 +1,7 @@
 name: sort.py
 
-on:    
-  push: 
+on:
+  push:
     branches: [ master ]
     paths:
       - 'etc/**'
diff --git a/README.md b/README.md
index 973c4dcbd..1d58fdce4 100644
--- a/README.md
+++ b/README.md
@@ -83,6 +83,35 @@ Backup Video Channel: https://www.bitchute.com/profile/JSBsA1aoQVfW/
 
 We take security bugs very seriously. If you believe you have found one, please report it by emailing us at netblue30@protonmail.com
 
+`````
+Security Adivsory - Feb 8, 2021
+
+Summary: A vulnerability resulting in root privilege escalation was discovered in
+Firejail's OverlayFS code,
+
+Versions affected: Firejail software versions starting with 0.9.30.
+Long Term Support (LTS) Firejail branch is not affected by this bug.
+
+Workaround: Disable overlayfs feature at runtime.
+In a text editor open /etc/firejail/firejail.config file, and set "overlayfs" entry to "no".
+
+      $ grep overlayfs /etc/firejail/firejail.config
+      # Enable or disable overlayfs features, default enabled.
+      overlayfs no
+
+Fix: The bug is fixed in Firejail version 0.9.64.4
+
+GitHub commit: (file configure.ac)
+https://github.com/netblue30/firejail/commit/97d8a03cad19501f017587cc4e47d8418273834b
+
+Credit:  Security researcher Roman Fiedler analyzed the code and discovered the vulnerability.
+Functional PoC exploit code was provided to Firejail development team.
+A description of the problem is here on Roman's blog:
+
+https://unparalleled.eu/publications/2021/advisory-unpar-2021-0.txt
+https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-local-root/
+`````
+
 ## Installing
 
 Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others.
diff --git a/RELNOTES b/RELNOTES
index 0e07e2d61..ce0bbeabb 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,7 +1,10 @@
 firejail (0.9.65) baseline; urgency=low
   * new profiles: vmware-view
- -- netblue30 <netblue30@yahoo.com>  Sat, 6 Feb 2021 09:00:00 -0500
+ -- netblue30 <netblue30@yahoo.com>  Tue, 9 Feb 2021 09:00:00 -0500
 
+firejail (0.9.64.4) baseline; urgency=low
+  * disabled overlayfs, pending multiple fixes (CVE-2021-26910)
+ -- netblue30 <netblue30@yahoo.com>  Sun, 7 Feb 2021 09:00:00 -0500
 
 firejail (0.9.64.2) baseline; urgency=low
   * allow --tmpfs inside $HOME for unprivileged users
diff --git a/etc/inc/archiver-common.inc b/etc/inc/archiver-common.inc
index 9812e3ebb..74b0b6ef6 100644
--- a/etc/inc/archiver-common.inc
+++ b/etc/inc/archiver-common.inc
@@ -6,20 +6,24 @@ include archiver-common.local
 
 blacklist ${RUNUSER}
 
-# WARNING:
-# Users can (un)restrict file access for **all** archivers by commenting/uncommenting the needed
-# include file(s) here or by putting those into archiver-common.local.
-# Another option is to do this **per archiver** in the relevant <archiver>.local.
-# Just beware that things tend to break when overtightening profiles. For example, because you only
-# need to (un)compress files in ${DOWNLOADS}, other applications may need access to ${HOME}/.local/share.
-
-# Uncomment the next line (or put it into your archiver-common.local) if you don't need to compress files in disable-common.inc.
+# WARNING: Users can (un)restrict file access for **all** archivers by
+# commenting/uncommenting the needed include file(s) here or by putting those
+# into archiver-common.local.
+#
+# Another option is to do this **per archiver** in the relevant
+# <archiver>.local. Just beware that things tend to break when overtightening
+# profiles. For example, because you only need to (un)compress files in
+# ${DOWNLOADS}, other applications may need access to ${HOME}/.local/share.
+
+# Uncomment the next line (or put it into your archiver-common.local) if you
+# don't need to compress files in disable-common.inc.
 #include disable-common.inc
 include disable-devel.inc
 include disable-exec.inc
 include disable-interpreters.inc
 include disable-passwdmgr.inc
-# Uncomment the next line (or put it into your archiver-common.local) if you don't need to compress files in disable-programs.inc.
+# Uncomment the next line (or put it into your archiver-common.local) if you
+# don't need to compress files in disable-programs.inc.
 #include disable-programs.inc
 include disable-shell.inc
 
diff --git a/etc/profile-a-l/7z.profile b/etc/profile-a-l/7z.profile
index 76492c339..b2294c070 100644
--- a/etc/profile-a-l/7z.profile
+++ b/etc/profile-a-l/7z.profile
@@ -7,5 +7,8 @@ include 7z.local
 # Persistent global definitions
 include globals.local
 
+# Included in archiver-common.inc
 ignore include disable-shell.inc
+
+# Redirect
 include archiver-common.inc
diff --git a/etc/profile-a-l/ar.profile b/etc/profile-a-l/ar.profile
index c2b215807..f99934e66 100644
--- a/etc/profile-a-l/ar.profile
+++ b/etc/profile-a-l/ar.profile
@@ -7,4 +7,5 @@ include ar.local
 # Persistent global definitions
 include globals.local
 
+# Redirect
 include archiver-common.inc
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile
index 34af47df2..6e0ecb012 100644
--- a/etc/profile-a-l/atool.profile
+++ b/etc/profile-a-l/atool.profile
@@ -9,10 +9,12 @@ include globals.local
 
 # Allow perl (blacklisted by disable-interpreters.inc)
 include allow-perl.inc
-include archiver-common.inc
 
 noroot
 
 # without login.defs atool complains and uses UID/GID 1000 by default
 private-etc alternatives,group,login.defs,passwd
 private-tmp
+
+# Redirect
+include archiver-common.inc
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile
index d755fd803..573776a71 100644
--- a/etc/profile-a-l/balsa.profile
+++ b/etc/profile-a-l/balsa.profile
@@ -61,7 +61,7 @@ shell none
 tracelog
 
 # disable-mnt
-# Add "pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg 
+# Add "pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg
 # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile.
 private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm
 private-cache
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile
index c37f4071e..fb4f643c8 100644
--- a/etc/profile-a-l/bsdtar.profile
+++ b/etc/profile-a-l/bsdtar.profile
@@ -6,6 +6,7 @@ include bsdtar.local
 # Persistent global definitions
 include globals.local
 
-include archiver-common.inc
-
 private-etc alternatives,group,localtime,passwd
+
+# Redirect
+include archiver-common.inc
diff --git a/etc/profile-a-l/calligragemini.profile b/etc/profile-a-l/calligragemini.profile
index 48527363d..006c307ab 100644
--- a/etc/profile-a-l/calligragemini.profile
+++ b/etc/profile-a-l/calligragemini.profile
@@ -5,8 +5,8 @@ include calligragemini.local
 # Persistent global definitions
 # added by included profile
 #include globals.local
-      
-noblacklist ${HOME}/.local/share/calligragemini      
-               
-# Redirect     
+
+noblacklist ${HOME}/.local/share/calligragemini
+
+# Redirect
 include calligra.profile
diff --git a/etc/profile-a-l/cpio.profile b/etc/profile-a-l/cpio.profile
index 785308ffd..0e0299655 100644
--- a/etc/profile-a-l/cpio.profile
+++ b/etc/profile-a-l/cpio.profile
@@ -10,4 +10,5 @@ include globals.local
 noblacklist /sbin
 noblacklist /usr/sbin
 
+# Redirect
 include archiver-common.inc
diff --git a/etc/profile-a-l/gzip.profile b/etc/profile-a-l/gzip.profile
index 9b59e57e7..035c6459c 100644
--- a/etc/profile-a-l/gzip.profile
+++ b/etc/profile-a-l/gzip.profile
@@ -7,7 +7,9 @@ include gzip.local
 # Persistent global definitions
 include globals.local
 
-# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
+# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop
+# all capabilities this is automatically read-only.
 noblacklist /var/lib/pacman
 
+# Redirect
 include archiver-common.inc
diff --git a/etc/profile-a-l/kdiff3.profile b/etc/profile-a-l/kdiff3.profile
index 8290e07f2..41840e3b0 100644
--- a/etc/profile-a-l/kdiff3.profile
+++ b/etc/profile-a-l/kdiff3.profile
@@ -19,7 +19,7 @@ include disable-passwdmgr.inc
 #include disable-programs.inc
 include disable-shell.inc
 include disable-xdg.inc
-           
+
 include whitelist-runuser-common.inc
 # Uncomment the next lines (or put it into your kdiff3.local) if you don't need to compare files in /usr/share.
 #include whitelist-usr-share-common.inc
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile
index 3ad779a12..365db64aa 100644
--- a/etc/profile-a-l/keepassxc.profile
+++ b/etc/profile-a-l/keepassxc.profile
@@ -31,9 +31,9 @@ include disable-shell.inc
 include disable-xdg.inc
 
 # You can enable whitelisting for keepassxc by uncommenting (or adding to you keepassxc.local) the following lines.
-# If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx
-#mkdir ${HOME}/Documents/KeePassXC
-#whitelist ${HOME}/Documents/KeePassXC
+# If you do so, you MUST store your database under ${DOCUMENTS}/KeePassXC/foo.kdbx
+#mkdir ${DOCUMENTS}/KeePassXC
+#whitelist ${DOCUMENTS}/KeePassXC
 # Needed for KeePassXC-Browser
 #mkfile ${HOME}/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json
 #whitelist ${HOME}/.config/BraveSoftware/Brave-Browser/NativeMessagingHosts/org.keepassxc.keepassxc_browser.json
diff --git a/etc/profile-m-z/Mathematica.profile b/etc/profile-m-z/Mathematica.profile
index c2734b1c1..0f79b6a97 100644
--- a/etc/profile-m-z/Mathematica.profile
+++ b/etc/profile-m-z/Mathematica.profile
@@ -16,10 +16,10 @@ include disable-programs.inc
 
 mkdir ${HOME}/.Mathematica
 mkdir ${HOME}/.Wolfram Research
-mkdir ${HOME}/Documents/Wolfram Mathematica
+mkdir ${DOCUMENTS}/Wolfram Mathematica
 whitelist ${HOME}/.Mathematica
 whitelist ${HOME}/.Wolfram Research
-whitelist ${HOME}/Documents/Wolfram Mathematica
+whitelist ${DOCUMENTS}/Wolfram Mathematica
 include whitelist-common.inc
 
 caps.drop all
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile
index f6efb0feb..9d7a23d43 100644
--- a/etc/profile-m-z/tar.profile
+++ b/etc/profile-m-z/tar.profile
@@ -7,13 +7,17 @@ include tar.local
 # Persistent global definitions
 include globals.local
 
-# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
-noblacklist /var/lib/pacman
-
+# Included in archiver-common.inc
 ignore include disable-shell.inc
-include archiver-common.inc
+
+# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop
+# all capabilities this is automatically read-only.
+noblacklist /var/lib/pacman
 
 private-etc alternatives,group,localtime,login.defs,passwd
 #private-lib libfakeroot,liblzma.so.*,libreadline.so.*
 # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
 writable-var
+
+# Redirect
+include archiver-common.inc
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile
index 9487f8e68..65f1a425a 100644
--- a/etc/profile-m-z/unrar.profile
+++ b/etc/profile-m-z/unrar.profile
@@ -7,8 +7,9 @@ include unrar.local
 # Persistent global definitions
 include globals.local
 
-include archiver-common.inc
-
 private-bin unrar
 private-etc alternatives,group,localtime,passwd
 private-tmp
+
+# Redirect
+include archiver-common.inc
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile
index 8da9ea820..c94416b87 100644
--- a/etc/profile-m-z/unzip.profile
+++ b/etc/profile-m-z/unzip.profile
@@ -10,6 +10,7 @@ include globals.local
 # GNOME Shell integration (chrome-gnome-shell)
 noblacklist ${HOME}/.local/share/gnome-shell
 
-include archiver-common.inc
-
 private-etc alternatives,group,localtime,passwd
+
+# Redirect
+include archiver-common.inc
diff --git a/etc/profile-m-z/xzdec.profile b/etc/profile-m-z/xzdec.profile
index 082392a08..c5e8d1631 100644
--- a/etc/profile-m-z/xzdec.profile
+++ b/etc/profile-m-z/xzdec.profile
@@ -7,4 +7,5 @@ include xzdec.local
 # Persistent global definitions
 include globals.local
 
+# Redirect
 include archiver-common.inc
diff --git a/etc/profile-m-z/zstd.profile b/etc/profile-m-z/zstd.profile
index 42749ba6d..07a75f97f 100644
--- a/etc/profile-m-z/zstd.profile
+++ b/etc/profile-m-z/zstd.profile
@@ -7,4 +7,5 @@ include zstd.local
 # Persistent global definitions
 include globals.local
 
+# Redirect
 include archiver-common.inc