6 files changed, 50 insertions, 2 deletions

diff --git a/RELNOTES b/RELNOTES
index 4bff6d092..37b4faf47 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -5,6 +5,7 @@ firejail (0.9.40-rc1) baseline; urgency=low
   * added --x11=xephyr option
   * added --cpu.print option
   * added filetransfer options --ls and --get
+  * added --writable-etc and --writable-var options
   * added mkdir, ipc-namespace, and nosound profile commands
   * added net iface, and iprange profile commands
   * --version also prints compile options
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 24ea53476..ece1eee4e 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -256,6 +256,8 @@ extern int arg_join_network;	// join only the network namespace
 extern int arg_join_filesystem; // join only the mount namespace
 extern int arg_nice;            // nice value configured
 extern int arg_ipc;             // enable ipc namespace
+extern int arg_writable_etc;    // writable etc
+extern int arg_writable_var;    // writable var
 
 extern int parent_to_child_fds[2];
 extern int child_to_parent_fds[2];
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 652f897d0..af1ddf93b 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -734,8 +734,10 @@ void fs_basic_fs(void) {
         fs_rdonly("/lib32");
         fs_rdonly("/libx32");
         fs_rdonly("/usr");
-        fs_rdonly("/etc");
-        fs_rdonly("/var");
+        if (!arg_writable_etc)
+                fs_rdonly("/etc");
+        if (!arg_writable_var)
+                fs_rdonly("/var");
 
         // update /var directory in order to support multiple sandboxes running on the same root directory
         if (!arg_private_dev)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 6b50b450c..27bd7c385 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -96,6 +96,8 @@ int arg_join_network = 0;			// join only the network namespace
 int arg_join_filesystem = 0;                    // join only the mount namespace
 int arg_nice = 0;                               // nice value configured
 int arg_ipc = 0;                                        // enable ipc namespace
+int arg_writable_etc = 0;                       // writable etc
+int arg_writable_var = 0;                       // writable var
 
 int parent_to_child_fds[2];
 int child_to_parent_fds[2];
@@ -1272,6 +1274,20 @@ int main(int argc, char **argv) {
 
                 }
 #endif
+                else if (strcmp(argv[i], "--writable-etc") == 0) {
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: --writable-etc is available only for root user\n");
+                                exit(1);
+                        }
+                        arg_writable_etc = 1;
+                }
+                else if (strcmp(argv[i], "--writable-var") == 0) {
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: --writable-var is available only for root user\n");
+                                exit(1);
+                        }
+                        arg_writable_var = 1;
+                }
                 else if (strcmp(argv[i], "--private") == 0)
                         arg_private = 1;
                 else if (strncmp(argv[i], "--private=", 10) == 0) {
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 539785f21..8b61629f4 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -246,6 +246,12 @@ void usage(void) {
         printf("    --user=new_user - switch the user before starting the sandbox.\n\n");
         printf("    --version - print program version and exit.\n\n");
         printf("    --whitelist=dirname_or_filename - whitelist directory or file.\n\n");
+        
+        printf("    --writable-etc - /etc directory is mounted read-write. This option is\n");
+        printf("\tavailable only when running the sandbox as root user.\n\n");
+        printf("    --writable-var - /var directory is mounted read-write. This option is\n");
+        printf("\tavailable only when running the sandbox as root user.\n\n");
+        
         printf("    --x11 - enable X11 server. The software checks first if Xpra is installed,\n");
         printf("\tthen it checks if Xephyr is installed.\n\n");
         printf("    --x11=xpra - enable Xpra X11 server.\n\n");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 23db832c1..14b3c6a60 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1462,6 +1462,27 @@ $ firejail \-\-whitelist=/tmp/.X11-unix --whitelist=/dev/null
 $ firejail "\-\-whitelist=/home/username/My Virtual Machines"
 
 .TP
+\fB\-\-writable-etc
+Mount /etc directory read-write. This option is available only when running the sandbox as root user
+.br
+
+.br
+Example:
+.br
+$ sudo firejail --writable-etc
+
+.TP
+\fB\-\-writable-var
+Mount /var directory read-write. This option is available only when running the sandbox as root user
+.br
+
+.br
+Example:
+.br
+$ sudo firejail --writable-var
+
+
+.TP
 \fB\-\-x11
 Start a new X11 server using Xpra or Xephyr and attach the sandbox to this server.
 The regular X11 server (display 0) is not visible in the sandbox. This prevents screenshot and keylogger