1 files changed, 45 insertions, 2 deletions

diff --git a/etc/firejail.config b/etc/firejail.config
index 41cd08e68..2ea767f37 100644
--- a/etc/firejail.config
+++ b/etc/firejail.config
@@ -9,24 +9,60 @@
 # Enable or disable chroot support, default enabled.
 # chroot yes
 
+# Use chroot for desktop programs, default enabled. The sandbox will have full
+# access to system's /dev directory in order to allow video acceleration,
+# and it will harden the rest of the chroot tree.
+# chroot-desktop yes
+
 # Enable or disable file transfer support, default enabled.
 # file-transfer yes
 
+# Force use of nonewprivs.  This mitigates the possibility of
+# a user abusing firejail's features to trick a privileged (suid
+# or file capabilities) process into loading code or configuration
+# that is partially under their control.  Default disabled.
+# force-nonewprivs no
+
 # Enable or disable networking features, default enabled.
 # network yes
 
+# Enable or disable overlayfs features, default enabled.
+# overlayfs yes
+
+# Remove /usr/local directories from private-bin list, default disabled.
+# private-bin-no-local no
+
+# Enable or disable private-home feature, default enabled
+# private-home yes
+
+# Enable --quiet as default every time the sandbox is started. Default disabled.
+# quiet-by-default no
+
+# Remount /proc and /sys inside the sandbox, default enabled.
+# remount-proc-sys yes
+
 # Enable or disable restricted network support, default disabled. If enabled,
 # networking features should also be enabled (network yes).
-# Restricted networking grants access to --interface and --net=ethXXX
-# only to root user. Regular users are only allowed --net=none.
+# Restricted networking grants access to --interface, --net=ethXXX and
+# --netfilter only to root user. Regular users are only allowed --net=none.
 # restricted-network no
 
+# Change default netfilter configuration. When using --netfilter option without
+# a file argument, the default filter is hardcoded (see man 1 firejail). This
+# configuration entry allows the user to change the default by specifying
+# a file containing the filter configuration. The filter file format is the
+# format of  iptables-save  and iptable-restore commands. Example:
+# netfilter-default /etc/iptables.iptables.rules
+
 # Enable or disable seccomp support, default enabled.
 # seccomp yes
 
 # Enable or disable user namespace support, default enabled.
 # userns yes
 
+# Enable or disable whitelisting support, default enabled.
+# whitelist yes
+
 # Enable or disable X11 sandboxing support, default enabled.
 # x11 yes
 
@@ -36,3 +72,10 @@
 # xephyr-screen 800x600
 # xephyr-screen 1024x768
 # xephyr-screen 1280x1024
+
+# Firejail window title in Xephyr, default enabled.
+# xephyr-window-title yes
+
+# Xephyr command extra parameters. None by default, and the declaration is commented out.
+# xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev
+# xephyr-extra-params -grayscale