34 files changed, 205 insertions, 129 deletions

diff --git a/.gitignore b/.gitignore
index 756918943..70dba09b2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,6 +13,8 @@
 Makefile
 autom4te.cache/
 config.log
+config.mk
+config.sh
 config.status
 firejail-*.tar.xz
 firejail-login.5
diff --git a/Makefile.in b/Makefile.in
index f788435c0..4d9983672 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,20 +1,4 @@
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-bindir=@bindir@
-libdir=@libdir@
-datarootdir=@datarootdir@
-mandir=@mandir@
-sysconfdir=@sysconfdir@
-
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-PACKAGE_TARNAME=@PACKAGE_TARNAME@
-DOCDIR=@docdir@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_CONTRIB_INSTALL=@HAVE_CONTRIB_INSTALL@
-BUSYBOX_WORKAROUND=@BUSYBOX_WORKAROUND@
-HAVE_SUID=@HAVE_SUID@
-HAVE_MAN=@HAVE_MAN@
+include config.mk
 
 ifneq ($(HAVE_MAN),no)
 MAN_TARGET = man
@@ -101,7 +85,7 @@ distclean: clean
                 $(MAKE) -C $$dir distclean; \
         done
         $(MAKE) -C test distclean
-        rm -fr Makefile autom4te.cache config.log config.status config.h src/common.mk mkdeb.sh
+        rm -fr Makefile autom4te.cache config.log config.mk config.sh config.status src/common.mk mkdeb.sh
 
 realinstall:
         # firejail executable
@@ -203,19 +187,39 @@ uninstall:
         rm -f $(DESTDIR)$(datarootdir)/bash-completion/completions/firecfg
         @echo "If you want to install a different version of firejail, you might also need to run 'rm -fr $(DESTDIR)$(sysconfdir)/firejail', see #2038."
 
-DISTFILES = "src etc m4 platform contrib configure configure.ac Makefile.in install.sh mkman.sh mketc.sh mkdeb.sh.in COPYING README RELNOTES"
-DISTFILES_TEST = "test/Makefile.in test/apps test/apps-x11 test/apps-x11-xorg test/root test/private-lib test/fnetfilter test/fcopy test/environment test/profiles test/utils test/compile test/filters test/network test/fs test/sysutils test/chroot"
+DISTFILES = \
+COPYING \
+Makefile.in \
+README \
+RELNOTES \
+config.mk.in \
+config.sh.in \
+configure \
+configure.ac \
+contrib \
+etc \
+install.sh \
+m4 \
+mkdeb.sh.in \
+mketc.sh \
+mkman.sh \
+platform \
+src
+
+DISTFILES_TEST = test/Makefile.in test/apps test/apps-x11 test/apps-x11-xorg test/root test/private-lib test/fnetfilter test/fcopy test/environment test/profiles test/utils test/compile test/filters test/network test/fs test/sysutils test/chroot
 
 dist:
+        mv config.sh config.sh.old
         mv config.status config.status.old
         mv mkdeb.sh mkdeb.sh.old
         make distclean
         mv mkdeb.sh.old mkdeb.sh
         mv config.status.old config.status
+        mv config.sh.old config.sh
         rm -fr $(NAME)-$(VERSION) $(NAME)-$(VERSION).tar.xz
         mkdir -p $(NAME)-$(VERSION)/test
-        cp -a "$(DISTFILES)" $(NAME)-$(VERSION)
-        cp -a "$(DISTFILES_TEST)" $(NAME)-$(VERSION)/test
+        cp -a $(DISTFILES) $(NAME)-$(VERSION)
+        cp -a $(DISTFILES_TEST) $(NAME)-$(VERSION)/test
         rm -rf $(NAME)-$(VERSION)/src/tools
         find $(NAME)-$(VERSION) -name .svn -delete
         tar -cJvf $(NAME)-$(VERSION).tar.xz $(NAME)-$(VERSION)
diff --git a/config.mk.in b/config.mk.in
new file mode 100644
index 000000000..e76b7ac34
--- /dev/null
+++ b/config.mk.in
@@ -0,0 +1,58 @@
+# Configure-time variable definitions and any other common definition that can
+# be safely included by all makefiles.
+#
+# Note: Do not define any targets on this file, as that could potentially end
+# up overriding the includer's intended default target (which by default is the
+# first target encountered).
+
+CC=@CC@
+prefix=@prefix@
+exec_prefix=@exec_prefix@
+bindir=@bindir@
+libdir=@libdir@
+datarootdir=@datarootdir@
+mandir=@mandir@
+sysconfdir=@sysconfdir@
+
+VERSION=@PACKAGE_VERSION@
+NAME=@PACKAGE_NAME@
+PACKAGE_TARNAME=@PACKAGE_TARNAME@
+DOCDIR=@docdir@
+HAVE_APPARMOR=@HAVE_APPARMOR@
+HAVE_CONTRIB_INSTALL=@HAVE_CONTRIB_INSTALL@
+BUSYBOX_WORKAROUND=@BUSYBOX_WORKAROUND@
+HAVE_SUID=@HAVE_SUID@
+HAVE_MAN=@HAVE_MAN@
+
+HAVE_CHROOT=@HAVE_CHROOT@
+HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
+HAVE_NETWORK=@HAVE_NETWORK@
+HAVE_USERNS=@HAVE_USERNS@
+HAVE_X11=@HAVE_X11@
+HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
+HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
+HAVE_APPARMOR=@HAVE_APPARMOR@
+HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
+HAVE_FIRETUNNEL=@HAVE_FIRETUNNEL@
+HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
+HAVE_IDS=@HAVE_IDS@
+HAVE_GCOV=@HAVE_GCOV@
+HAVE_SELINUX=@HAVE_SELINUX@
+HAVE_SUID=@HAVE_SUID@
+HAVE_DBUSPROXY=@HAVE_DBUSPROXY@
+HAVE_USERTMPFS=@HAVE_USERTMPFS@
+HAVE_OUTPUT=@HAVE_OUTPUT@
+HAVE_LTS=@HAVE_LTS@
+HAVE_FORCE_NONEWPRIVS=@HAVE_FORCE_NONEWPRIVS@
+HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@
+
+MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
+
+CFLAGS=@CFLAGS@
+
+ifdef NO_EXTRA_CFLAGS
+else
+EXTRA_CFLAGS +=@EXTRA_CFLAGS@
+endif
+
+EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
diff --git a/config.sh.in b/config.sh.in
new file mode 100644
index 000000000..28251b3d5
--- /dev/null
+++ b/config.sh.in
@@ -0,0 +1,2 @@
+NAME=@PACKAGE_NAME@
+VERSION=@PACKAGE_VERSION@
diff --git a/configure b/configure
index c4fd7804f..2dffacc32 100755
--- a/configure
+++ b/configure
@@ -3236,8 +3236,8 @@ if test "x$enable_apparmor" = "xyes"; then :
         HAVE_APPARMOR="-DHAVE_APPARMOR"
 
 pkg_failed=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for libapparmor" >&5
-$as_echo_n "checking for libapparmor... " >&6; }
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for AA" >&5
+$as_echo_n "checking for AA... " >&6; }
 
 if test -n "$AA_CFLAGS"; then
     pkg_cv_AA_CFLAGS="$AA_CFLAGS"
@@ -3277,7 +3277,7 @@ fi
 
 
 if test $pkg_failed = yes; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
 
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
@@ -3304,7 +3304,7 @@ Alternatively, you may set the environment variables AA_CFLAGS
 and AA_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
-        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
         { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
@@ -4087,7 +4087,7 @@ fi
 
 ac_config_files="$ac_config_files mkdeb.sh"
 
-ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/fzenity/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile"
+ac_config_files="$ac_config_files Makefile config.mk config.sh src/bash_completion/Makefile src/common.mk src/fbuilder/Makefile src/fcopy/Makefile src/fids/Makefile src/firecfg/Makefile src/firejail/Makefile src/firemon/Makefile src/fldd/Makefile src/fnet/Makefile src/fnetfilter/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile src/fnettrace/Makefile src/fsec-optimize/Makefile src/fsec-print/Makefile src/fseccomp/Makefile src/ftee/Makefile src/fzenity/Makefile src/jailcheck/Makefile src/lib/Makefile src/libpostexecseccomp/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/man/Makefile src/profstats/Makefile src/zsh_completion/Makefile test/Makefile"
 
 cat >confcache <<\_ACEOF
 # This file is a shell script that caches the results of configure
@@ -4797,34 +4797,36 @@ do
   case $ac_config_target in
     "mkdeb.sh") CONFIG_FILES="$CONFIG_FILES mkdeb.sh" ;;
     "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
+    "config.mk") CONFIG_FILES="$CONFIG_FILES config.mk" ;;
+    "config.sh") CONFIG_FILES="$CONFIG_FILES config.sh" ;;
+    "src/bash_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/bash_completion/Makefile" ;;
     "src/common.mk") CONFIG_FILES="$CONFIG_FILES src/common.mk" ;;
-    "src/lib/Makefile") CONFIG_FILES="$CONFIG_FILES src/lib/Makefile" ;;
+    "src/fbuilder/Makefile") CONFIG_FILES="$CONFIG_FILES src/fbuilder/Makefile" ;;
     "src/fcopy/Makefile") CONFIG_FILES="$CONFIG_FILES src/fcopy/Makefile" ;;
-    "src/fnet/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnet/Makefile" ;;
+    "src/fids/Makefile") CONFIG_FILES="$CONFIG_FILES src/fids/Makefile" ;;
+    "src/firecfg/Makefile") CONFIG_FILES="$CONFIG_FILES src/firecfg/Makefile" ;;
     "src/firejail/Makefile") CONFIG_FILES="$CONFIG_FILES src/firejail/Makefile" ;;
-    "src/fnetfilter/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnetfilter/Makefile" ;;
     "src/firemon/Makefile") CONFIG_FILES="$CONFIG_FILES src/firemon/Makefile" ;;
-    "src/libtrace/Makefile") CONFIG_FILES="$CONFIG_FILES src/libtrace/Makefile" ;;
-    "src/libtracelog/Makefile") CONFIG_FILES="$CONFIG_FILES src/libtracelog/Makefile" ;;
-    "src/firecfg/Makefile") CONFIG_FILES="$CONFIG_FILES src/firecfg/Makefile" ;;
-    "src/fbuilder/Makefile") CONFIG_FILES="$CONFIG_FILES src/fbuilder/Makefile" ;;
-    "src/fsec-print/Makefile") CONFIG_FILES="$CONFIG_FILES src/fsec-print/Makefile" ;;
-    "src/ftee/Makefile") CONFIG_FILES="$CONFIG_FILES src/ftee/Makefile" ;;
-    "src/fseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/fseccomp/Makefile" ;;
     "src/fldd/Makefile") CONFIG_FILES="$CONFIG_FILES src/fldd/Makefile" ;;
-    "src/libpostexecseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/libpostexecseccomp/Makefile" ;;
+    "src/fnet/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnet/Makefile" ;;
+    "src/fnetfilter/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnetfilter/Makefile" ;;
+    "src/fnettrace-dns/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace-dns/Makefile" ;;
+    "src/fnettrace-sni/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace-sni/Makefile" ;;
+    "src/fnettrace/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace/Makefile" ;;
     "src/fsec-optimize/Makefile") CONFIG_FILES="$CONFIG_FILES src/fsec-optimize/Makefile" ;;
+    "src/fsec-print/Makefile") CONFIG_FILES="$CONFIG_FILES src/fsec-print/Makefile" ;;
+    "src/fseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/fseccomp/Makefile" ;;
+    "src/ftee/Makefile") CONFIG_FILES="$CONFIG_FILES src/ftee/Makefile" ;;
     "src/fzenity/Makefile") CONFIG_FILES="$CONFIG_FILES src/fzenity/Makefile" ;;
-    "src/profstats/Makefile") CONFIG_FILES="$CONFIG_FILES src/profstats/Makefile" ;;
+    "src/jailcheck/Makefile") CONFIG_FILES="$CONFIG_FILES src/jailcheck/Makefile" ;;
+    "src/lib/Makefile") CONFIG_FILES="$CONFIG_FILES src/lib/Makefile" ;;
+    "src/libpostexecseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/libpostexecseccomp/Makefile" ;;
+    "src/libtrace/Makefile") CONFIG_FILES="$CONFIG_FILES src/libtrace/Makefile" ;;
+    "src/libtracelog/Makefile") CONFIG_FILES="$CONFIG_FILES src/libtracelog/Makefile" ;;
     "src/man/Makefile") CONFIG_FILES="$CONFIG_FILES src/man/Makefile" ;;
+    "src/profstats/Makefile") CONFIG_FILES="$CONFIG_FILES src/profstats/Makefile" ;;
     "src/zsh_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/zsh_completion/Makefile" ;;
-    "src/bash_completion/Makefile") CONFIG_FILES="$CONFIG_FILES src/bash_completion/Makefile" ;;
     "test/Makefile") CONFIG_FILES="$CONFIG_FILES test/Makefile" ;;
-    "src/jailcheck/Makefile") CONFIG_FILES="$CONFIG_FILES src/jailcheck/Makefile" ;;
-    "src/fids/Makefile") CONFIG_FILES="$CONFIG_FILES src/fids/Makefile" ;;
-    "src/fnettrace/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace/Makefile" ;;
-    "src/fnettrace-dns/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace-dns/Makefile" ;;
-    "src/fnettrace-sni/Makefile") CONFIG_FILES="$CONFIG_FILES src/fnettrace-sni/Makefile" ;;
 
   *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;;
   esac
diff --git a/configure.ac b/configure.ac
index ec7835013..cb20589cb 100644
--- a/configure.ac
+++ b/configure.ac
@@ -283,11 +283,39 @@ if test "$prefix" = /usr; then
 fi
 
 AC_CONFIG_FILES([mkdeb.sh], [chmod +x mkdeb.sh])
-AC_CONFIG_FILES([Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile \
-src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \
-src/ftee/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile \
-src/fzenity/Makefile src/profstats/Makefile src/man/Makefile src/zsh_completion/Makefile src/bash_completion/Makefile test/Makefile \
-src/jailcheck/Makefile src/fids/Makefile src/fnettrace/Makefile src/fnettrace-dns/Makefile src/fnettrace-sni/Makefile])
+AC_CONFIG_FILES([
+Makefile
+config.mk
+config.sh
+src/bash_completion/Makefile
+src/common.mk
+src/fbuilder/Makefile
+src/fcopy/Makefile
+src/fids/Makefile
+src/firecfg/Makefile
+src/firejail/Makefile
+src/firemon/Makefile
+src/fldd/Makefile
+src/fnet/Makefile
+src/fnetfilter/Makefile
+src/fnettrace-dns/Makefile
+src/fnettrace-sni/Makefile
+src/fnettrace/Makefile
+src/fsec-optimize/Makefile
+src/fsec-print/Makefile
+src/fseccomp/Makefile
+src/ftee/Makefile
+src/fzenity/Makefile
+src/jailcheck/Makefile
+src/lib/Makefile
+src/libpostexecseccomp/Makefile
+src/libtrace/Makefile
+src/libtracelog/Makefile
+src/man/Makefile
+src/profstats/Makefile
+src/zsh_completion/Makefile
+test/Makefile
+])
 AC_OUTPUT
 
 cat <<EOF
diff --git a/mkdeb.sh.in b/mkdeb.sh.in
index 79f8d748c..a98261ba6 100755
--- a/mkdeb.sh.in
+++ b/mkdeb.sh.in
@@ -7,8 +7,9 @@
 # a code archive should already be available
 
 set -e
-NAME=@PACKAGE_NAME@
-VERSION=@PACKAGE_VERSION@
+
+. "$(dirname "$0")/config.sh"
+
 EXTRA_VERSION=$1
 
 test "$#" -gt 0 && shift
diff --git a/src/bash_completion/Makefile.in b/src/bash_completion/Makefile.in
index f7db9e6b4..69f35e7ae 100644
--- a/src/bash_completion/Makefile.in
+++ b/src/bash_completion/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: firejail.bash_completion
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/config.mk
 
 firejail.bash_completion: firejail.bash_completion.in
         gawk -f ../man/preproc.awk -- $(MANFLAGS) < $< > $@.tmp
diff --git a/src/common.mk.in b/src/common.mk.in
index 64ed774ad..2b87c33f0 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -1,51 +1,16 @@
-# common definitions for all makefiles
+# Common definitions for building C programs and non-shared objects.
+#
+# Note: "ROOT" must be defined before including this file.
 
-CC=@CC@
-prefix=@prefix@
-exec_prefix=@exec_prefix@
-bindir=@bindir@
-libdir=@libdir@
-sysconfdir=@sysconfdir@
-
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_CHROOT=@HAVE_CHROOT@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
-HAVE_NETWORK=@HAVE_NETWORK@
-HAVE_USERNS=@HAVE_USERNS@
-HAVE_X11=@HAVE_X11@
-HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
-HAVE_APPARMOR=@HAVE_APPARMOR@
-HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
-HAVE_FIRETUNNEL=@HAVE_FIRETUNNEL@
-HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
-HAVE_IDS=@HAVE_IDS@
-HAVE_GCOV=@HAVE_GCOV@
-HAVE_SELINUX=@HAVE_SELINUX@
-HAVE_SUID=@HAVE_SUID@
-HAVE_DBUSPROXY=@HAVE_DBUSPROXY@
-HAVE_USERTMPFS=@HAVE_USERTMPFS@
-HAVE_OUTPUT=@HAVE_OUTPUT@
-HAVE_LTS=@HAVE_LTS@
-HAVE_FORCE_NONEWPRIVS=@HAVE_FORCE_NONEWPRIVS@
-HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@
+include $(ROOT)/config.mk
 
 H_FILE_LIST       = $(sort $(wildcard *.h))
 C_FILE_LIST       = $(sort $(wildcard *.c))
 OBJS = $(C_FILE_LIST:.c=.o)
 BINOBJS =  $(foreach file, $(OBJS), $file)
 
-CFLAGS = @CFLAGS@
 CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
 CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"'   -DVARDIR='"/var/lib/firejail"'
-MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_IDS) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
 CFLAGS += $(MANFLAGS)
 CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security
 LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
-EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
-
-ifdef NO_EXTRA_CFLAGS
-else
-EXTRA_CFLAGS +=@EXTRA_CFLAGS@
-endif
diff --git a/src/fbuilder/Makefile.in b/src/fbuilder/Makefile.in
index 6eaee284b..060f97493 100644
--- a/src/fbuilder/Makefile.in
+++ b/src/fbuilder/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fbuilder
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fcopy/Makefile.in b/src/fcopy/Makefile.in
index e19f5d3b5..a2a4172a9 100644
--- a/src/fcopy/Makefile.in
+++ b/src/fcopy/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fcopy
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fids/Makefile.in b/src/fids/Makefile.in
index 5530bcee2..8aac55419 100644
--- a/src/fids/Makefile.in
+++ b/src/fids/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fids
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/firecfg/Makefile.in b/src/firecfg/Makefile.in
index 43329be46..d112cc40a 100644
--- a/src/firecfg/Makefile.in
+++ b/src/firecfg/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: firecfg
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/libnetlink.h ../include/firejail_user.h ../include/pid.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in
index 793d2cdd1..0dec3da98 100644
--- a/src/firejail/Makefile.in
+++ b/src/firejail/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: firejail
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/rundefs.h ../include/common.h ../include/ldd_utils.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall_i386.h ../include/syscall_x86_64.h ../include/firejail_user.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/firemon/Makefile.in b/src/firemon/Makefile.in
index a1b6692aa..6ac0cfff1 100644
--- a/src/firemon/Makefile.in
+++ b/src/firemon/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: firemon
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/pid.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fldd/Makefile.in b/src/fldd/Makefile.in
index ba87d16cd..f3842cbee 100644
--- a/src/fldd/Makefile.in
+++ b/src/fldd/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fldd
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h ../include/ldd_utils.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fnet/Makefile.in b/src/fnet/Makefile.in
index 7447c6d3f..3d70e50bf 100644
--- a/src/fnet/Makefile.in
+++ b/src/fnet/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fnet
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/libnetlink.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fnetfilter/Makefile.in b/src/fnetfilter/Makefile.in
index 825262482..32b4bbada 100644
--- a/src/fnetfilter/Makefile.in
+++ b/src/fnetfilter/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fnetfilter
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fnettrace-dns/Makefile.in b/src/fnettrace-dns/Makefile.in
index 6c11e5bc8..7cafe6907 100644
--- a/src/fnettrace-dns/Makefile.in
+++ b/src/fnettrace-dns/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fnettrace-dns
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST)
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fnettrace-sni/Makefile.in b/src/fnettrace-sni/Makefile.in
index 9fe954874..9349d06f8 100644
--- a/src/fnettrace-sni/Makefile.in
+++ b/src/fnettrace-sni/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fnettrace-sni
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST)
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fnettrace/Makefile.in b/src/fnettrace/Makefile.in
index 755ddcc3a..a7b93194a 100644
--- a/src/fnettrace/Makefile.in
+++ b/src/fnettrace/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fnettrace
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST)
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fsec-optimize/Makefile.in b/src/fsec-optimize/Makefile.in
index a2187e89c..cfd876953 100644
--- a/src/fsec-optimize/Makefile.in
+++ b/src/fsec-optimize/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fsec-optimize
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fsec-print/Makefile.in b/src/fsec-print/Makefile.in
index 824fb5daf..d07c42405 100644
--- a/src/fsec-print/Makefile.in
+++ b/src/fsec-print/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fsec-print
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fseccomp/Makefile.in b/src/fseccomp/Makefile.in
index 41abfce17..140a56ab0 100644
--- a/src/fseccomp/Makefile.in
+++ b/src/fseccomp/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fseccomp
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/ftee/Makefile.in b/src/ftee/Makefile.in
index 05caf81be..f9ad78de2 100644
--- a/src/ftee/Makefile.in
+++ b/src/ftee/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: ftee
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST)
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/fzenity/Makefile.in b/src/fzenity/Makefile.in
index d9f976165..6b7ce0874 100644
--- a/src/fzenity/Makefile.in
+++ b/src/fzenity/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: fzenity
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/jailcheck/Makefile.in b/src/jailcheck/Makefile.in
index d218c1f90..cf619ad1e 100644
--- a/src/jailcheck/Makefile.in
+++ b/src/jailcheck/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: jailcheck
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/pid.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/lib/Makefile.in b/src/lib/Makefile.in
index 49c8057b3..330a47892 100644
--- a/src/lib/Makefile.in
+++ b/src/lib/Makefile.in
@@ -1,4 +1,5 @@
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 .PHONY: all
 all: $(OBJS)
diff --git a/src/libpostexecseccomp/Makefile.in b/src/libpostexecseccomp/Makefile.in
index c08ae78ce..6f354757c 100644
--- a/src/libpostexecseccomp/Makefile.in
+++ b/src/libpostexecseccomp/Makefile.in
@@ -1,8 +1,5 @@
-CC=@CC@
-PREFIX=@prefix@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
+ROOT = ../..
+include $(ROOT)/config.mk
 
 H_FILE_LIST       = $(sort $(wildcard *.h))
 C_FILE_LIST       = $(sort $(wildcard *.c))
diff --git a/src/libtrace/Makefile.in b/src/libtrace/Makefile.in
index 804671ee2..ced036865 100644
--- a/src/libtrace/Makefile.in
+++ b/src/libtrace/Makefile.in
@@ -1,8 +1,5 @@
-CC=@CC@
-PREFIX=@prefix@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
+ROOT = ../..
+include $(ROOT)/config.mk
 
 H_FILE_LIST       = $(sort $(wildcard *.h))
 C_FILE_LIST       = $(sort $(wildcard *.c))
diff --git a/src/libtracelog/Makefile.in b/src/libtracelog/Makefile.in
index aea1b11f2..52d4bcb08 100644
--- a/src/libtracelog/Makefile.in
+++ b/src/libtracelog/Makefile.in
@@ -1,8 +1,5 @@
-CC=@CC@
-PREFIX=@prefix@
-VERSION=@PACKAGE_VERSION@
-NAME=@PACKAGE_NAME@
-HAVE_FATAL_WARNINGS=@HAVE_FATAL_WARNINGS@
+ROOT = ../..
+include $(ROOT)/config.mk
 
 H_FILE_LIST       = $(sort $(wildcard *.h))
 C_FILE_LIST       = $(sort $(wildcard *.c))
diff --git a/src/man/Makefile.in b/src/man/Makefile.in
index fbd2d795e..a63f9d28e 100644
--- a/src/man/Makefile.in
+++ b/src/man/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: firecfg.man firejail.man firejail-login.man firejail-users.man firejail-profile.man firemon.man jailcheck.man
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/config.mk
 
 %.man: %.txt
         gawk -f ./preproc.awk -- $(MANFLAGS) < $< > $@
diff --git a/src/profstats/Makefile.in b/src/profstats/Makefile.in
index fa1b4f200..394f30fda 100644
--- a/src/profstats/Makefile.in
+++ b/src/profstats/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: profstats
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/src/common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
diff --git a/src/zsh_completion/Makefile.in b/src/zsh_completion/Makefile.in
index a83cccf6c..fceab1d00 100644
--- a/src/zsh_completion/Makefile.in
+++ b/src/zsh_completion/Makefile.in
@@ -1,7 +1,8 @@
 .PHONY: all
 all: _firejail
 
-include ../common.mk
+ROOT = ../..
+include $(ROOT)/config.mk
 
 _firejail: _firejail.in
         gawk -f ../man/preproc.awk -- $(MANFLAGS) < $< > $@.tmp