1 files changed, 15 insertions, 15 deletions

diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index d843c74ae..082a0b306 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -28,7 +28,6 @@ static char *usage_str =
         "\n"
         "Options:\n"
         "    -- - signal the end of options and disables further option processing.\n"
-        "    --allow=filename - allow file system access.\n"
         "    --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n"
         "    --allusers - all user home directories are visible inside the sandbox.\n"
         "    --apparmor - enable AppArmor confinement.\n"
@@ -39,12 +38,13 @@ static char *usage_str =
 #endif
         "    --bind=dirname1,dirname2 - mount-bind dirname1 on top of dirname2.\n"
         "    --bind=filename1,filename2 - mount-bind filename1 on top of filename2.\n"
-        "    --build - build a profile for the application.\n"
-        "    --build=filename - build a profile for the application.\n"
+        "    --blacklist=filename - blacklist directory or file.\n"
+        "    --build - build a whitelisted profile for the application.\n"
+        "    --build=filename - build a whitelisted profile for the application.\n"
         "    --caps - enable default Linux capabilities filter.\n"
         "    --caps.drop=all - drop all capabilities.\n"
-        "    --caps.drop=capability,capability - drop capabilities.\n"
-        "    --caps.keep=capability,capability - allow capabilities.\n"
+        "    --caps.drop=capability,capability - blacklist capabilities filter.\n"
+        "    --caps.keep=capability,capability - whitelist capabilities filter.\n"
         "    --caps.print=name|pid - print the caps filter.\n"
 #ifdef HAVE_FILE_TRANSFER
         "    --cat=name|pid filename - print content of file from sandbox container.\n"
@@ -75,18 +75,17 @@ static char *usage_str =
         "    --dbus-user.talk=name - allow talking to name on the session DBus.\n"
 #endif
         "    --debug - print sandbox debug messages.\n"
-        "    --debug-allow - debug file system access.\n"
-        "    --debug-deny - debug file system access.\n"
+        "    --debug-blacklists - debug blacklisting.\n"
         "    --debug-caps - print all recognized capabilities.\n"
         "    --debug-errnos - print all recognized error numbers.\n"
         "    --debug-private-lib - debug for --private-lib option.\n"
         "    --debug-protocols - print all recognized protocols.\n"
         "    --debug-syscalls - print all recognized system calls.\n"
         "    --debug-syscalls32 - print all recognized 32 bit system calls.\n"
+        "    --debug-whitelists - debug whitelisting.\n"
 #ifdef HAVE_NETWORK
         "    --defaultgw=address - configure default gateway.\n"
 #endif
-        "    --deny=filename - deny access to directory or file.\n"
         "    --deterministic-exit-code - always exit with first child's status code.\n"
         "    --dns=address - set DNS server.\n"
         "    --dns.print=name|pid - print DNS configuration.\n"
@@ -153,8 +152,7 @@ static char *usage_str =
 #endif
         "    --nice=value - set nice value.\n"
         "    --no3d - disable 3D hardware acceleration.\n"
-        "    --noallow=filename - disable allow command for file or directory.\n"
-        "    --nodeny=filename - disable deny command for file or directory.\n"
+        "    --noblacklist=filename - disable blacklist for file or directory.\n"
         "    --nodbus - disable D-Bus access.\n"
         "    --nodvd - disable DVD and audio CD devices.\n"
         "    --noexec=filename - remount the file or directory noexec nosuid and nodev.\n"
@@ -169,6 +167,7 @@ static char *usage_str =
         "    --noautopulse - disable automatic ~/.config/pulse init.\n"
         "    --novideo - disable video devices.\n"
         "    --nou2f - disable U2F devices.\n"
+        "    --nowhitelist=filename - disable whitelist for file or directory.\n"
 #ifdef HAVE_OUTPUT
         "    --output=logfile - stdout logging and log rotation.\n"
         "    --output-stderr=logfile - stdout and stderr logging and log rotation.\n"
@@ -225,14 +224,14 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --scan - ARP-scan all the networks from inside a network namespace.\n"
 #endif
-        "    --seccomp - enable seccomp filter and drop the default syscalls.\n"
-        "    --seccomp=syscall,syscall,syscall - enable seccomp filter, drop the\n"
+        "    --seccomp - enable seccomp filter and apply the default blacklist.\n"
+        "    --seccomp=syscall,syscall,syscall - enable seccomp filter, blacklist the\n"
         "\tdefault syscall list and the syscalls specified by the command.\n"
         "    --seccomp.block-secondary - build only the native architecture filters.\n"
         "    --seccomp.drop=syscall,syscall,syscall - enable seccomp filter, and\n"
-        "\tdrop the syscalls specified by the command.\n"
+        "\tblacklist the syscalls specified by the command.\n"
         "    --seccomp.keep=syscall,syscall,syscall - enable seccomp filter, and\n"
-        "\tallow the syscalls specified by the command.\n"
+        "\twhitelist the syscalls specified by the command.\n"
         "    --seccomp.print=name|pid - print the seccomp filter for the sandbox\n"
         "\tidentified by name or PID.\n"
         "    --seccomp.32[.drop,.keep][=syscall] - like above but for 32 bit architecture.\n"
@@ -247,7 +246,7 @@ static char *usage_str =
         "    --top - monitor the most CPU-intensive sandboxes.\n"
         "    --trace - trace open, access and connect system calls.\n"
         "    --tracelog - add a syslog message for every access to files or\n"
-        "\tdirectories dropped by the security profile.\n"
+        "\tdirectories blacklisted by the security profile.\n"
         "    --tree - print a tree of all sandboxed processes.\n"
         "    --tunnel[=devname] - connect the sandbox to a tunnel created by\n"
         "\tfiretunnel utility.\n"
@@ -255,6 +254,7 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --veth-name=name - use this name for the interface connected to the bridge.\n"
 #endif
+        "    --whitelist=filename - whitelist directory or file.\n"
         "    --writable-etc - /etc directory is mounted read-write.\n"
         "    --writable-run-user - allow access to /run/user/$UID/systemd and\n"
         "\t/run/user/$UID/gnupg.\n"