1 files changed, 22 insertions, 20 deletions

diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 2093a4ed3..b4f3021c7 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -28,6 +28,7 @@ static char *usage_str =
         "\n"
         "Options:\n"
         "    -- - signal the end of options and disables further option processing.\n"
+        "    --allow=filename - allow file system access.\n"
         "    --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n"
         "    --allusers - all user home directories are visible inside the sandbox.\n"
         "    --apparmor - enable AppArmor confinement.\n"
@@ -38,13 +39,12 @@ static char *usage_str =
 #endif
         "    --bind=dirname1,dirname2 - mount-bind dirname1 on top of dirname2.\n"
         "    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n"
-        "    --blacklist=filename - blacklist directory or file.\n"
-        "    --build - build a whitelisted profile for the application.\n"
-        "    --build=filename - build a whitelisted profile for the application.\n"
+        "    --build - build a profile for the application.\n"
+        "    --build=filename - build a profile for the application.\n"
         "    --caps - enable default Linux capabilities filter.\n"
         "    --caps.drop=all - drop all capabilities.\n"
-        "    --caps.drop=capability,capability - blacklist capabilities filter.\n"
-        "    --caps.keep=capability,capability - whitelist capabilities filter.\n"
+        "    --caps.drop=capability,capability - drop capabilities.\n"
+        "    --caps.keep=capability,capability - allow capabilities.\n"
         "    --caps.print=name|pid - print the caps filter.\n"
 #ifdef HAVE_FILE_TRANSFER
         "    --cat=name|pid filename - print content of file from sandbox container.\n"
@@ -58,32 +58,35 @@ static char *usage_str =
 #ifdef HAVE_DBUSPROXY
         "    --dbus-log=file - set DBus log file location.\n"
         "    --dbus-system=filter|none - set system DBus access policy.\n"
-        "    --dbus-system.broadcast=rule - allow signals on the system DBus according to rule.\n"
+        "    --dbus-system.broadcast=rule - allow signals on the system DBus according\n"
+        "\tto rule.\n"
         "    --dbus-system.call=rule - allow calls on the system DBus according to rule.\n"
-        "    --dbus-system.log - turn on logging for the system DBus."
+        "    --dbus-system.log - turn on logging for the system DBus.\n"
         "    --dbus-system.own=name - allow ownership of name on the system DBus.\n"
         "    --dbus-system.see=name - allow seeing name on the system DBus.\n"
         "    --dbus-system.talk=name - allow talking to name on the system DBus.\n"
         "    --dbus-user=filter|none - set session DBus access policy.\n"
-        "    --dbus-user.broadcast=rule - allow signals on the session DBus according to rule.\n"
+        "    --dbus-user.broadcast=rule - allow signals on the session DBus according\n"
+        "\tto rule.\n"
         "    --dbus-user.call=rule - allow calls on the session DBus according to rule.\n"
-        "    --dbus-user.log - turn on logging for the user DBus."
+        "    --dbus-user.log - turn on logging for the user DBus.\n"
         "    --dbus-user.own=name - allow ownership of name on the session DBus.\n"
         "    --dbus-user.see=name - allow seeing name on the session DBus.\n"
         "    --dbus-user.talk=name - allow talking to name on the session DBus.\n"
 #endif
         "    --debug - print sandbox debug messages.\n"
-        "    --debug-blacklists - debug blacklisting.\n"
+        "    --debug-allow - debug file system access.\n"
+        "    --debug-deny - debug file system access.\n"
         "    --debug-caps - print all recognized capabilities.\n"
         "    --debug-errnos - print all recognized error numbers.\n"
         "    --debug-private-lib - debug for --private-lib option.\n"
         "    --debug-protocols - print all recognized protocols.\n"
         "    --debug-syscalls - print all recognized system calls.\n"
         "    --debug-syscalls32 - print all recognized 32 bit system calls.\n"
-        "    --debug-whitelists - debug whitelisting.\n"
 #ifdef HAVE_NETWORK
         "    --defaultgw=address - configure default gateway.\n"
 #endif
+        "    --deny=filename - deny access to directory or file.\n"
         "    --deterministic-exit-code - always exit with first child's status code.\n"
         "    --dns=address - set DNS server.\n"
         "    --dns.print=name|pid - print DNS configuration.\n"
@@ -141,14 +144,15 @@ static char *usage_str =
         "    --netfilter.print=name|pid - print the firewall.\n"
         "    --netfilter6=filename - enable IPv6 firewall.\n"
         "    --netfilter6.print=name|pid - print the IPv6 firewall.\n"
-        "    --netmask=address - define a network mask when dealing with unconfigured"
+        "    --netmask=address - define a network mask when dealing with unconfigured\n"
         "\tparrent interfaces.\n"
         "    --netns=name - Run the program in a named, persistent network namespace.\n"
         "    --netstats - monitor network statistics.\n"
 #endif
         "    --nice=value - set nice value.\n"
         "    --no3d - disable 3D hardware acceleration.\n"
-        "    --noblacklist=filename - disable blacklist for file or directory.\n"
+        "    --noallow=filename - disable allow command for file or directory.\n"
+        "    --nodeny=filename - disable deny command for file or directory.\n"
         "    --nodbus - disable D-Bus access.\n"
         "    --nodvd - disable DVD and audio CD devices.\n"
         "    --noexec=filename - remount the file or directory noexec nosuid and nodev.\n"
@@ -163,7 +167,6 @@ static char *usage_str =
         "    --noautopulse - disable automatic ~/.config/pulse init.\n"
         "    --novideo - disable video devices.\n"
         "    --nou2f - disable U2F devices.\n"
-        "    --nowhitelist=filename - disable whitelist for file or directory.\n"
 #ifdef HAVE_OUTPUT
         "    --output=logfile - stdout logging and log rotation.\n"
         "    --output-stderr=logfile - stdout and stderr logging and log rotation.\n"
@@ -220,14 +223,14 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --scan - ARP-scan all the networks from inside a network namespace.\n"
 #endif
-        "    --seccomp - enable seccomp filter and apply the default blacklist.\n"
-        "    --seccomp=syscall,syscall,syscall - enable seccomp filter, blacklist the\n"
+        "    --seccomp - enable seccomp filter and drop the default syscalls.\n"
+        "    --seccomp=syscall,syscall,syscall - enable seccomp filter, drop the\n"
         "\tdefault syscall list and the syscalls specified by the command.\n"
         "    --seccomp.block-secondary - build only the native architecture filters.\n"
         "    --seccomp.drop=syscall,syscall,syscall - enable seccomp filter, and\n"
-        "\tblacklist the syscalls specified by the command.\n"
+        "\tdrop the syscalls specified by the command.\n"
         "    --seccomp.keep=syscall,syscall,syscall - enable seccomp filter, and\n"
-        "\twhitelist the syscalls specified by the command.\n"
+        "\tallow the syscalls specified by the command.\n"
         "    --seccomp.print=name|pid - print the seccomp filter for the sandbox\n"
         "\tidentified by name or PID.\n"
         "    --seccomp.32[.drop,.keep][=syscall] - like above but for 32 bit architecture.\n"
@@ -242,7 +245,7 @@ static char *usage_str =
         "    --top - monitor the most CPU-intensive sandboxes.\n"
         "    --trace - trace open, access and connect system calls.\n"
         "    --tracelog - add a syslog message for every access to files or\n"
-        "\tdirectories blacklisted by the security profile.\n"
+        "\tdirectories dropped by the security profile.\n"
         "    --tree - print a tree of all sandboxed processes.\n"
         "    --tunnel[=devname] - connect the sandbox to a tunnel created by\n"
         "\tfiretunnel utility.\n"
@@ -250,7 +253,6 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --veth-name=name - use this name for the interface connected to the bridge.\n"
 #endif
-        "    --whitelist=filename - whitelist directory or file.\n"
         "    --writable-etc - /etc directory is mounted read-write.\n"
         "    --writable-run-user - allow access to /run/user/$UID/systemd and\n"
         "\t/run/user/$UID/gnupg.\n"