6 files changed, 29 insertions, 3 deletions

diff --git a/etc/firejail.config b/etc/firejail.config
index c671efef9..4b59f8955 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -101,6 +101,10 @@
 # Enable or disable seccomp support, default enabled.
 # seccomp yes
 
+# Add rules to the default seccomp filter. Same syntax as for --seccomp=
+# None by default; this is an example.
+# seccomp-filter-add !chroot,kcmp,mincore
+
 # Seccomp error action, kill, log or errno (EPERM, ENOSYS etc)
 # seccomp-error-action EPERM
 
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 6726abdc8..12b5fc683 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -35,6 +35,7 @@ char *xvfb_extra_params = "";
 char *netfilter_default = NULL;
 unsigned long join_timeout = 5000000; // microseconds
 char *config_seccomp_error_action_str = "EPERM";
+char *config_seccomp_filter_add = NULL;
 char **whitelist_reject_topdirs = NULL;
 
 int checkcfg(int val) {
@@ -222,6 +223,10 @@ int checkcfg(int val) {
                         else if (strncmp(ptr, "join-timeout ", 13) == 0)
                                 join_timeout = strtoul(ptr + 13, NULL, 10) * 1000000; // seconds to microseconds
 
+                        // add rules to default seccomp filter
+                        else if (strncmp(ptr, "seccomp-filter-add ", 19) == 0)
+                                config_seccomp_filter_add = seccomp_check_list(ptr + 19);
+
                         // seccomp error action
                         else if (strncmp(ptr, "seccomp-error-action ", 21) == 0) {
                                 if (strcmp(ptr + 21, "kill") == 0)
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 1da70fd54..60d178f1e 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -789,6 +789,7 @@ extern char *xvfb_extra_params;
 extern char *netfilter_default;
 extern unsigned long join_timeout;
 extern char *config_seccomp_error_action_str;
+extern char *config_seccomp_filter_add;
 extern char **whitelist_reject_topdirs;
 
 int checkcfg(int val);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 089d80a68..d46a56627 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -961,7 +961,7 @@ void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, b
 static int check_postexec(const char *list) {
         char *prelist, *postlist;
 
-        if (list) {
+        if (list && list[0]) {
                 syscalls_in_list(list, "@default-keep", -1, &prelist, &postlist, true);
                 if (postlist)
                         return 1;
@@ -2855,6 +2855,15 @@ int main(int argc, char **argv, char **envp) {
         // check network configuration options - it will exit if anything went wrong
         net_check_cfg();
 
+        // customization of default seccomp filter
+        if (config_seccomp_filter_add) {
+                if (arg_seccomp && !cfg.seccomp_list_keep && !cfg.seccomp_list_drop)
+                        profile_list_augment(&cfg.seccomp_list, config_seccomp_filter_add);
+
+                if (arg_seccomp32 && !cfg.seccomp_list_keep32 && !cfg.seccomp_list_drop32)
+                        profile_list_augment(&cfg.seccomp_list32, config_seccomp_filter_add);
+        }
+
         if (arg_seccomp)
                 arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop);
 
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 9670fe816..3d9bf9082 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -208,7 +208,8 @@ int seccomp_filter_drop(bool native) {
         //      - seccomp
         if (cfg.seccomp_list_drop == NULL) {
                 // default seccomp if error action is not changed
-                if (cfg.seccomp_list == NULL && arg_seccomp_error_action == DEFAULT_SECCOMP_ERROR_ACTION) {
+                if ((cfg.seccomp_list == NULL || cfg.seccomp_list[0] == '\0')
+                    && arg_seccomp_error_action == DEFAULT_SECCOMP_ERROR_ACTION) {
                         if (arg_seccomp_block_secondary)
                                 seccomp_filter_block_secondary();
                         else {
@@ -261,7 +262,7 @@ int seccomp_filter_drop(bool native) {
                         }
 
                         // build the seccomp filter as a regular user
-                        if (list)
+                        if (list && list[0])
                                 if (arg_allow_debuggers)
                                         rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7,
                                                       PATH_FSECCOMP, command, "drop", filter, postexec_filter, list, "allow-debuggers");
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 3212a88e4..7d7a1eb31 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -2209,6 +2209,12 @@ Firejail will print seccomp violations to the audit log if the kernel was compil
 Example:
 .br
 $ firejail \-\-seccomp
+.br
+
+.br
+The default list can be customized, see \-\-seccomp= for a description. It can be customized
+also globally in /etc/firejail/firejail.config file.
+
 .TP
 \fB\-\-seccomp=syscall,@group,!syscall2
 Enable seccomp filter, whitelist "syscall2", but blacklist the default