1 files changed, 14 insertions, 9 deletions

diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index b0c12ee11..500850413 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1782,7 +1782,8 @@ system call groups are defined: @aio, @basic-io, @chown, @clock,
 @network-io, @obsolete, @privileged, @process, @raw-io, @reboot,
 @resources, @setuid, @swap, @sync, @system-service and @timer. In addition, a
 system call can be specified by its number instead of name with prefix
-$, so for example $165 would be equal to mount on i386.
+$, so for example $165 would be equal to mount on i386. Exceptions
+can be allowed with prefix !.
 
 .br
 System architecture is strictly imposed only if flag
@@ -1800,8 +1801,10 @@ Example:
 .br
 $ firejail \-\-seccomp
 .TP
-\fB\-\-seccomp=syscall,@group
-Enable seccomp filter, blacklist the default list (@default) and the syscalls or syscall groups specified by the command.
+\fB\-\-seccomp=syscall,@group,!syscall2
+Enable seccomp filter, whitelist "syscall2", but blacklist the default
+list (@default) and the syscalls or syscall groups specified by the
+command.
 .br
 
 .br
@@ -1865,8 +1868,9 @@ domain with personality(2) system call.
 .br
 
 .TP
-\fB\-\-seccomp.drop=syscall,@group
-Enable seccomp filter, and blacklist the syscalls or the syscall groups specified by the command.
+\fB\-\-seccomp.drop=syscall,@group,!syscall2
+Enable seccomp filter, whitelist "syscall2" but blacklist the
+syscalls or the syscall groups specified by the command.
 .br
 
 .br
@@ -1901,10 +1905,11 @@ rm: cannot remove `testfile': Operation not permitted
 
 
 .TP
-\fB\-\-seccomp.keep=syscall,syscall,syscall
-Enable seccomp filter, and whitelist the syscalls specified by the
-command. The system calls needed by Firejail (group @default-keep:
-prctl, execve) are handled with the preload library.
+\fB\-\-seccomp.keep=syscall,@group,!syscall2
+Enable seccomp filter, blacklist "syscall2" but whitelist the
+syscalls or the syscall groups specified by the command. The system
+calls needed by Firejail (group @default-keep: prctl, execve) are
+handled with the preload library.
 .br
 
 .br