10 files changed, 95 insertions, 58 deletions

diff --git a/RELNOTES b/RELNOTES
index f93237d43..788bfe407 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -2,8 +2,10 @@ firejail (0.9.41) baseline; urgency=low
   * work in progress...
   * AppImage support (--appimage)
   * Sandbox auditing support (--audit)
+  * Remove environment variable (--rmenv)
   * include /dev/snd in --private-dev
   * added mkfile profile command
+  * seccomp filter updated
   * compile time and run time support to disable whitelists
   * compile time support to disable global configuration file
   * some profiles have been converted to private-bin
diff --git a/src/firejail/env.c b/src/firejail/env.c
index 54a6b0036..1a6236407 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -27,12 +27,27 @@ typedef struct env_t {
         struct env_t *next;
         char *name;
         char *value;
+        ENV_OP op;
 } Env;
 static Env *envlist = NULL;
 
 static void env_add(Env *env) {
-        env->next = envlist;
-        envlist = env;
+        env->next = NULL;
+        
+        // add the new entry at the end of the list
+        if (envlist == NULL) {
+                envlist = env;
+                return;
+        }
+        
+        Env *ptr = envlist;
+        while (1) {
+                if (ptr->next == NULL) {
+                        ptr->next = env;
+                        break;
+                }
+                ptr = ptr->next;
+        }
 }
 
 // load IBUS env variables
@@ -87,7 +102,7 @@ void env_ibus_load(void) {
                         if (arg_debug)
                                 printf("%s\n", buf);
                         EUID_USER();
-                        env_store(buf);
+                        env_store(buf, SETENV);
                         EUID_ROOT();
                 }
 
@@ -126,7 +141,7 @@ void env_defaults(void) {
 }
 
 // parse and store the environment setting 
-void env_store(const char *str) {
+void env_store(const char *str, ENV_OP op) {
         EUID_ASSERT();
         assert(str);
         
@@ -134,11 +149,13 @@ void env_store(const char *str) {
         if (*str == '\0')
                 goto errexit;
         char *ptr = strchr(str, '=');
-        if (!ptr)
-                goto errexit;
-        ptr++;
-        if (*ptr == '\0')
-                goto errexit;
+        if (op == SETENV) {
+                if (!ptr)
+                        goto errexit;
+                ptr++;
+                if (*ptr == '\0')
+                        goto errexit;
+        }
 
         // build list entry
         Env *env = malloc(sizeof(Env));
@@ -148,10 +165,13 @@ void env_store(const char *str) {
         env->name = strdup(str);
         if (env->name == NULL)
                 errExit("strdup");
-        char *ptr2 = strchr(env->name, '=');
-        assert(ptr2);
-        *ptr2 = '\0';
-        env->value = ptr2 + 1;
+        if (op == SETENV) {
+                char *ptr2 = strchr(env->name, '=');
+                assert(ptr2);
+                *ptr2 = '\0';
+                env->value = ptr2 + 1;
+        }
+        env->op = op;
         
         // add entry to the list
         env_add(env);
@@ -167,8 +187,13 @@ void env_apply(void) {
         Env *env = envlist;
         
         while (env) {
-                if (setenv(env->name, env->value, 1) < 0)
-                        errExit("setenv");
+                if (env->op == SETENV) {
+                        if (setenv(env->name, env->value, 1) < 0)
+                                errExit("setenv");
+                }
+                else if (env->op == RMENV) {
+                        unsetenv(env->name);
+                }
                 env = env->next;
         }
 }
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 3d0e9a51b..590646f23 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -493,7 +493,12 @@ int check_kernel_procs(void);
 void run_no_sandbox(int argc, char **argv);
 
 // env.c
-void env_store(const char *str);
+typedef enum {
+        SETENV = 0,
+        RMENV
+} ENV_OP;
+
+void env_store(const char *str, ENV_OP op);
 void env_apply(void);
 void env_defaults(void);
 void env_ibus_load(void);
diff --git a/src/firejail/main.c b/src/firejail/main.c
index b1dd7d32c..a0225be15 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1465,7 +1465,9 @@ int main(int argc, char **argv) {
                         arg_nonewprivs = 1;
                 }
                 else if (strncmp(argv[i], "--env=", 6) == 0)
-                        env_store(argv[i] + 6);
+                        env_store(argv[i] + 6, SETENV);
+                else if (strncmp(argv[i], "--rmenv=", 8) == 0)
+                        env_store(argv[i] + 8, RMENV);
                 else if (strcmp(argv[i], "--nosound") == 0) {
                         arg_nosound = 1;
                 }
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index bb834bf19..1106ed84e 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -457,7 +457,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         }
         
         if (strncmp(ptr, "env ", 4) == 0) {
-                env_store(ptr + 4);
+                env_store(ptr + 4, SETENV);
+                return 0;
+        }
+        if (strncmp(ptr, "rmenv ", 6) == 0) {
+                env_store(ptr + 6, RMENV);
                 return 0;
         }
         
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 7108b5a05..efe24a211 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -334,12 +334,15 @@ void seccomp_filter_32(void) {
                 BLACKLIST(52), // umount2
                 BLACKLIST(26), // ptrace
                 BLACKLIST(283), // kexec_load
+                BLACKLIST(341), // name_to_handle_at
                 BLACKLIST(342), // open_by_handle_at
+                BLACKLIST(127), // create_module
                 BLACKLIST(128), // init_module
                 BLACKLIST(350), // finit_module
                 BLACKLIST(129), // delete_module
                 BLACKLIST(110), // iopl
                 BLACKLIST(101), // ioperm
+                BLACKLIST(289), // ioprio_set
                 BLACKLIST(87), // swapon
                 BLACKLIST(115), // swapoff
                 BLACKLIST(103), // syslog
@@ -376,6 +379,7 @@ void seccomp_filter_32(void) {
                 BLACKLIST(88), // reboot
                 BLACKLIST(169), // nfsservctl
                 BLACKLIST(130), // get_kernel_syms
+                
                 RETURN_ALLOW
         };
 
@@ -403,11 +407,14 @@ void seccomp_filter_64(void) {
                 BLACKLIST(101), // ptrace
                 BLACKLIST(246), // kexec_load
                 BLACKLIST(304), // open_by_handle_at
+                BLACKLIST(303), // name_to_handle_at
+                BLACKLIST(174), // create_module
                 BLACKLIST(175), // init_module
                 BLACKLIST(313), // finit_module
                 BLACKLIST(176), // delete_module
                 BLACKLIST(172), // iopl
                 BLACKLIST(173), // ioperm
+                BLACKLIST(251), // ioprio_set
                 BLACKLIST(167), // swapon
                 BLACKLIST(168), // swapoff
                 BLACKLIST(103), // syslog
@@ -445,6 +452,7 @@ void seccomp_filter_64(void) {
                 BLACKLIST(169), // reboot
                 BLACKLIST(180), // nfsservctl
                 BLACKLIST(177), // get_kernel_syms
+                
                 RETURN_ALLOW
         };
 
@@ -493,12 +501,18 @@ int seccomp_filter_drop(int enforce_seccomp) {
 #ifdef SYS_open_by_handle_at            
                 filter_add_blacklist(SYS_open_by_handle_at, 0);
 #endif
+#ifdef SYS_name_to_handle_at            
+                filter_add_blacklist(SYS_name_to_handle_at, 0);
+#endif
 #ifdef SYS_init_module          
                 filter_add_blacklist(SYS_init_module, 0);
 #endif
 #ifdef SYS_finit_module // introduced in 2013
                 filter_add_blacklist(SYS_finit_module, 0);
 #endif
+#ifdef SYS_create_module
+                filter_add_blacklist(SYS_create_module, 0);
+#endif
 #ifdef SYS_delete_module                
                 filter_add_blacklist(SYS_delete_module, 0);
 #endif
@@ -508,6 +522,9 @@ int seccomp_filter_drop(int enforce_seccomp) {
 #ifdef  SYS_ioperm      
                 filter_add_blacklist(SYS_ioperm, 0);
 #endif
+#ifdef  SYS_ioprio_set  
+                filter_add_blacklist(SYS_ioprio_set, 0);
+#endif
 #ifdef SYS_ni_syscall // new io permissions call on arm devices
                 filter_add_blacklist(SYS_ni_syscall, 0);
 #endif
@@ -648,6 +665,7 @@ int seccomp_filter_drop(int enforce_seccomp) {
 #ifdef SYS_get_kernel_syms
                 filter_add_blacklist(SYS_get_kernel_syms, 0);
 #endif
+
         }
 
         // default seccomp filter with additional drop list
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 1efc247b5..b67300618 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -208,6 +208,7 @@ void usage(void) {
         
         printf("    --quiet - turn off Firejail's output.\n\n");
         printf("    --read-only=dirname_or_filename - set directory or file read-only..\n\n");
+        printf("    --read-write=dirname_or_filename - set directory or file read-write..\n\n");
         printf("    --rlimit-fsize=number - set the maximum file size that can be created\n");
         printf("\tby a process.\n\n");
         printf("    --rlimit-nofile=number - set the maximum number of files that can be\n");
@@ -216,7 +217,7 @@ void usage(void) {
         printf("\tcreated for the real user ID of the calling process.\n\n");
         printf("    --rlimit-sigpending=number - set the maximum number of pending signals\n");
         printf("\tfor a process.\n\n");
-        printf("    --read-write=dirname_or_filename - set directory or file read-write..\n\n");
+        printf("    --rmenv=name - remove environment variable in the new sandbox.\n\n");
 #ifdef HAVE_NETWORK     
         printf("    --scan - ARP-scan all the networks from inside a network namespace.\n");
         printf("\tThis makes it possible to detect macvlan kernel device drivers\n");
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 9c416b0f3..98fa17908 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -224,15 +224,7 @@ first argument to socket system call. Recognized values: \fBunix\fR,
 \fBinet\fR, \fBinet6\fR, \fBnetlink\fR and \fBpacket\fR.
 .TP
 \fBseccomp
-Enable seccomp filter and blacklist the syscalls in the default list. The default list is as follows:
-mount, umount2, ptrace, kexec_load, kexec_file_load, open_by_handle_at, init_module, finit_module, delete_module,
-iopl, ioperm, swapon, swapoff, syslog, process_vm_readv, process_vm_writev,
-sysfs,_sysctl, adjtimex, clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init, kcmp,
-add_key, request_key, keyctl, uselib, acct, modify_ldt, pivot_root, io_setup,
-io_destroy, io_getevents, io_submit, io_cancel,
-remap_file_pages, mbind, get_mempolicy, set_mempolicy,
-migrate_pages, move_pages, vmsplice, perf_event_open, chroot,
-tuxcall, reboot, mfsservctl and get_kernel_syms.
+Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details.
 .TP
 \fBseccomp syscall,syscall,syscall
 Enable seccomp filter and blacklist the system calls in the list on top of default seccomp filter.
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index e915ab6cb..8d20cf36b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1172,6 +1172,15 @@ make the whitelist read-only. Example:
 $ firejail --whitelist=~/work --read-only=~ --read-only=~/work
 
 .TP
+\fB\-\-read-write=dirname_or_filename
+By default, the sandbox mounts system directories read-only.
+These directories are /etc, /var, /usr, /bin, /sbin, /lib, /lib32, /libx32 and /lib64. 
+Use this option to mount read-write files or directories inside the system directories.
+
+This option is available only to root user. It has no effect when --chroot or --overlay are also set. In these
+cases the system directories are mounted read-write.
+
+.TP
 \fB\-\-rlimit-fsize=number
 Set the maximum file size that can be created by a process.
 .TP
@@ -1185,13 +1194,14 @@ Set the maximum number of processes that can be created for the real user ID of
 Set the maximum number of pending signals for a process.
 
 .TP
-\fB\-\-read-write=dirname_or_filename
-By default, the sandbox mounts system directories read-only.
-These directories are /etc, /var, /usr, /bin, /sbin, /lib, /lib32, /libx32 and /lib64. 
-Use this option to mount read-write files or directories inside the system directories.
+\fB\-\-rmenv=name
+Remove environment variable in the new sandbox.
+.br
 
-This option is available only to root user. It has no effect when --chroot or --overlay are also set. In these
-cases the system directories are mounted read-write.
+.br
+Example:
+.br
+$ firejail \-\-rmenv=DBUS_SESSION_BUS_ADDRESS
 
 .TP
 \fB\-\-scan
@@ -1206,8 +1216,8 @@ $ firejail \-\-net=eth0 \-\-scan
 .TP
 \fB\-\-seccomp
 Enable seccomp filter and blacklist the syscalls in the default list. The default list is as follows:
-mount, umount2, ptrace, kexec_load, kexec_file_load, open_by_handle_at, init_module, finit_module, delete_module,
-iopl, ioperm, swapon, swapoff, syslog, process_vm_readv, process_vm_writev,
+mount, umount2, ptrace, kexec_load, kexec_file_load, name_to_handle_at, open_by_handle_at, create_module, init_module, finit_module, delete_module,
+iopl, ioperm, ioprio_set, swapon, swapoff, syslog, process_vm_readv, process_vm_writev,
 sysfs,_sysctl, adjtimex, clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init, kcmp,
 add_key, request_key, keyctl, uselib, acct, modify_ldt, pivot_root, io_setup,
 io_destroy, io_getevents, io_submit, io_cancel,
diff --git a/todo b/todo
index 0a76cd850..88baff216 100644
--- a/todo
+++ b/todo
@@ -161,25 +161,3 @@ To disable Vsync
 
 $ vblank_mode=0 glxgears
 
-18. Add nosound in all profiles with private-dev (including server.profile)
-test hedgewars!
-
-19. new syscalls:
-create_module
-name_to_handle_at
-ioprio_set, 
-
-???
-146     - sched_get_priority_max
-147     - sched_get_priority_min
-204     - sched_getaffinity
-315     - sched_getattr
-143     - sched_getparam
-145     - sched_getscheduler
-148     - sched_rr_get_interval
-203     - sched_setaffinity
-314     - sched_setattr
-142     - sched_setparam
-144     - sched_setscheduler
-24      - sched_yield
-