1 files changed, 64 insertions, 3 deletions

diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 60c21cbc1..f978661dc 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -76,7 +76,9 @@ $ firejail [OPTIONS] firefox        # starting Mozilla Firefox
 Signal the end of options and disables further option processing.
 .TP
 \fB\-\-allow-debuggers
-Allow tools such as strace and gdb inside the sandbox.
+Allow tools such as strace and gdb inside the sandbox. This option is only available
+when running on Linux kernels 4.8 or newer - a kernel bug in ptrace system call allows a full
+bypass of the seccomp filter.
 .br
 
 .br
@@ -190,7 +192,7 @@ Define a custom blacklist Linux capabilities filter.
 .br
 Example:
 .br
-$ firejail \-\-caps.keep=net_broadcast,net_admin,net_raw
+$ firejail \-\-caps.drop=net_broadcast,net_admin,net_raw
 
 .TP
 \fB\-\-caps.keep=capability,capability,capability
@@ -451,6 +453,39 @@ $ firejail \-\-fs.print=3272
 \fB\-\-get=name|pid filename
 Get a file from sandbox container, see \fBFILE TRANSFER\fR section for more details.
 
+
+.TP
+\fB\-\-git-install
+Download, compile and install mainline git version of Firejail from the official repository on GitHub.
+The software is installed in /usr/local/bin, and takes precedence over the (old) version
+installed in /usr/bin. If for any reason the new version doesn't work, the user can uninstall it
+using \-\-git-uninstall command and revert to the old version.
+.br
+
+.br
+Prerequisites: git and compile support are required for this command to work. On Debian/Ubuntu
+systems this support is installed using "sudo apt-get install build-essential git".
+.br
+
+.br
+Example:
+.br
+
+.br
+$ firejail \-\-git-install
+
+.TP
+\fB\-\-git-uninstall
+Remove the Firejail version previously installed in /usr/local/bin using \-\-git-install command.
+.br
+
+.br
+Example:
+.br
+
+.br
+$ firejail \-\-git-uninstall
+
 .TP
 \fB\-?\fR, \fB\-\-help\fR
 Print options end exit.
@@ -467,6 +502,16 @@ Example:
 $ firejail \-\-hostname=officepc firefox
 
 .TP
+\fB\-\-hosts-file=file
+Use file as /etc/hosts.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-hosts-file=~/myhosts firefox
+
+.TP
 \fB\-\-ignore=command
 Ignore command in profile file.
 .br
@@ -676,7 +721,7 @@ $ firejail \-\-net=eth0 \-\-mac=00:11:22:33:44:55 firefox
 
 .TP
 \fB\-\-machine-id
-Preserve id number in /etc/machine-id file. By default a new random id is generated inside the sandbox.
+Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox.
 .br
 
 .br
@@ -759,6 +804,11 @@ Example:
 $ firejail \-\-net=none vlc
 
 .TP
+\fB\-\-netns=name
+Run the program in a named, persistent network namespace.  These can
+be created and configured using "ip netns".
+
+.TP
 \fB\-\-netfilter
 Enable a default client network filter in the new network namespace.
 New network namespaces are created using \-\-net option. If a new network namespaces is not created,
@@ -1708,6 +1758,17 @@ Example:
 .br
 $ sudo firejail --writable-var
 
+.TP
+\fB\-\-writable-var-log
+Use the real /var/log directory, not a clone. By default, a tmpfs is mounted on top of /var/log
+directory, and a skeleton filesystem is created based on the original /var/log.
+.br
+
+.br
+Example:
+.br
+$ sudo firejail --writable-var-log
+
 
 .TP
 \fB\-\-x11