1 files changed, 19 insertions, 0 deletions

diff --git a/src/firejail/main.c b/src/firejail/main.c
index c055a1537..ff57a5693 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -85,6 +85,7 @@ int arg_private_opt = 0;			// private opt directory
 int arg_private_srv = 0;                        // private srv directory
 int arg_private_bin = 0;                        // private bin directory
 int arg_private_tmp = 0;                        // private tmp directory
+int arg_private_lib = 0;                        // private lib directory
 int arg_scan = 0;                               // arp-scan all interfaces
 int arg_whitelist = 0;                          // whitelist commad
 int arg_nosound = 0;                            // disable sound
@@ -110,6 +111,7 @@ int arg_allow_private_blacklist = 0; 		// blacklist things in private directorie
 int arg_writable_var_log = 0;           // writable /var/log
 int arg_disable_mnt = 0;                        // disable /mnt and /media
 int arg_noprofile = 0; // use default.profile if none other found/specified
+int arg_memory_deny_write_execute = 0;          // block writable and executable memory
 
 int login_shell = 0;
 
@@ -1144,6 +1146,12 @@ int main(int argc, char **argv) {
                         else
                                 exit_err_feature("seccomp");
                 }
+                else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) {
+                        if (checkcfg(CFG_SECCOMP))
+                                arg_memory_deny_write_execute = 1;
+                        else
+                                exit_err_feature("seccomp");
+                }
 #endif
                 else if (strcmp(argv[i], "--caps") == 0)
                         arg_caps_default_filter = 1;
@@ -1622,6 +1630,17 @@ int main(int argc, char **argv) {
                                 cfg.bin_private_keep = argv[i] + 14;
                         arg_private_bin = 1;
                 }
+                else if (strncmp(argv[i], "--private-lib", 13) == 0) {
+                        // extract private lib list (if any)
+                        if (argv[i][13] == '=') {
+                                if (cfg.lib_private_keep) {
+                                        if (argv[i][14] != '\0' && asprintf(&cfg.lib_private_keep, "%s,%s", cfg.lib_private_keep, argv[i] + 14) < 0)
+                                                errExit("asprintf");
+                                } else
+                                        cfg.lib_private_keep = argv[i] + 14;
+                        }
+                        arg_private_lib = 1;
+                }
                 else if (strcmp(argv[i], "--private-tmp") == 0) {
                         arg_private_tmp = 1;
                 }