5 files changed, 58 insertions, 16 deletions

diff --git a/RELNOTES b/RELNOTES
index ba90eaece..ef95a1bc0 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -30,6 +30,7 @@ firejail (0.9.46-rc1) baseline; urgency=low
   * feature: config support to disable join (join)
   * feature: disabled Go, Rust, and OpenSSL in disable-devel.conf
   * feature: support overlay, overlay-named and overlay-tmpfs in profile files
+  * feature: allow PulseAudio sockets in --private-tmp
   * new profiles: xiphos, Tor Browser Bundle, display (imagemagick), Wire,
   * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
   * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 8831d07f0..09fadcf34 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -408,6 +408,7 @@ void fs_overlayfs(void);
 // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf
 void fs_chroot(const char *rootdir);
 void fs_check_chroot_dir(const char *rootdir);
+void fs_private_tmp(void);
 
 // profile.c
 // find and read the profile specified by name from dir directory
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 025e715e6..ac68e7738 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1214,4 +1214,46 @@ void fs_chroot(const char *rootdir) {
 }
 #endif
 
+// this function is called from sandbox.c before blacklist/whitelist functions
+void fs_private_tmp(void) {
+        // check XAUTHORITY file, KDE keeps it under /tmp
+        char *xauth = getenv("XAUTHORITY");
+        if (xauth) {
+                char *rp = realpath(xauth, NULL);
+                if (rp && strncmp(rp, "/tmp/", 5) == 0) {
+                        char *cmd;
+                        if (asprintf(&cmd, "whitelist %s", rp) == -1)
+                                errExit("asprintf");
+                        profile_add(cmd); // profile_add does not duplicate the string
+                }
+                if (rp)
+                        free(rp);
+        }
+        
+        // whitelist x11 directory
+        profile_add("whitelist /tmp/.X11-unix");
+        
+        // whitelist any pulse* file in /tmp directory
+        // some distros use PulseAudio sockets under /tmp instead of the socket in /urn/user
+        DIR *dir;
+        if (!(dir = opendir("/tmp"))) {
+                // sleep 2 seconds and try again
+                sleep(2);
+                if (!(dir = opendir("/tmp"))) {
+                        return;
+                }
+        }
 
+        struct dirent *entry;
+        while ((entry = readdir(dir))) {
+                if (strncmp(entry->d_name, "pulse-", 6) == 0) {
+                        char *cmd;
+                        if (asprintf(&cmd, "whitelist /tmp/%s", entry->d_name) == -1)
+                                errExit("asprintf");
+                        profile_add(cmd); // profile_add does not duplicate the string
+                }
+        }
+        closedir(dir);
+
+
+}
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 35ca4ff2d..e6deddac5 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -741,21 +741,7 @@ int sandbox(void* sandbox_arg) {
                 else {
                         // private-tmp is implemented as a whitelist
                         EUID_USER();
-                        // check XAUTHORITY file, KDE keeps it under /tmp
-                        char *xauth = getenv("XAUTHORITY");
-                        if (xauth) {
-                                char *rp = realpath(xauth, NULL);
-                                if (rp && strncmp(rp, "/tmp/", 5) == 0) {
-                                        char *cmd;
-                                        if (asprintf(&cmd, "whitelist %s", rp) == -1)
-                                                errExit("asprintf");
-                                        profile_add(cmd); // profile_add does not duplicate the string
-                                }
-                                if (rp)
-                                        free(rp);
-                        }
-                        // whitelist x11 directory
-                        profile_add("whitelist /tmp/.X11-unix");
+                        fs_private_tmp();
                         EUID_ROOT();
                 }
         }
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index c481da8d2..bc4c3f19a 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1278,13 +1278,25 @@ Example:
 
 .TP
 \fB\-\-private-tmp
-Mount an empty temporary filesystem on top of /tmp directory whitelisting /tmp/.X11-unix.
+Mount an empty temporary filesystem on top of /tmp directory whitelisting X11 and PulseAudio sockets.
 .br
 
 .br
 Example:
 .br
 $ firejail \-\-private-tmp
+.br
+$ ls -al /tmp
+.br
+drwxrwxrwt  4 nobody nogroup   80 Apr 30 11:46 .
+.br
+drwxr-xr-x 30 nobody nogroup 4096 Apr 26 22:18 ..
+.br
+drwx------  2 nobody nogroup 4096 Apr 30 10:52 pulse-PKdhtXMmr18n
+.br
+drwxrwxrwt  2 nobody nogroup 4096 Apr 30 10:52 .X11-unix
+.br
+
 
 .TP
 \fB\-\-profile=filename