18 files changed, 92 insertions, 54 deletions
diff --git a/src/faudit/main.c b/src/faudit/main.c
index 8ab0de5a6..57c709767 100644
--- a/src/faudit/main.c
+++ b/src/faudit/main.c
@@ -38,7 +38,7 @@ int main(int argc, char **argv) {
                int i;
                for (i = 1; i < argc; i++) {
-                        if (strcmp(argv[i], "syscall")) {
+                        if (strcmp(argv[i], "syscall") == 0) {
                                syscall_helper(argc, argv);
                                return 0;
                        }
diff --git a/src/faudit/syscall.c b/src/faudit/syscall.c
index 2925a6c30..9661f81e6 100644
--- a/src/faudit/syscall.c
+++ b/src/faudit/syscall.c
@@ -34,6 +34,9 @@ extern int pivot_root(const char *new_root, const char *put_old);
 void syscall_helper(int argc, char **argv) {
        (void) argc;
+        if (argc < 3)
+                return;
        if (strcmp(argv[2], "mount") == 0) {
                int rv = mount(NULL, NULL, NULL, 0, NULL);
                (void) rv;
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index e58c8ee52..c68db372b 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -1,5 +1,5 @@
 # /usr/lib/firejail/firecfg.config - firecfg utility configuration file
-# This is the list of programs in alfabetical order handled by firecfg utility
+# This is the list of programs in alphabetical order handled by firecfg utility
 #
 0ad
 2048-qt
@@ -23,6 +23,8 @@ bless
 blender
 brasero
 brave
+calibre
+catfish
 cherrytree
 chromium
 chromium-browser
@@ -39,6 +41,7 @@ darktable
 deadbeef
 deluge
 dia
+digikam
 dillo
 dino
 display
@@ -48,6 +51,7 @@ dolphin
 dosbox
 dragon
 dropbox
+ebook-viewer
 elinks
 empathy
 eog
@@ -70,6 +74,7 @@ galculator
 geany
 gedit
 geeqie
+ghb
 gimp
 gitter
 gjs
@@ -97,6 +102,8 @@ gpredict
 gthumb
 gucharmap
 gwenview
+handbrake
+handbrake-gtk
 hedgewars
 hexchat
 highlight
@@ -150,6 +157,7 @@ mediathekview
 meld
 midori
 mousepad
+mplayer
 mpv
 multimc5
 mumble
@@ -196,6 +204,7 @@ skanlite
 skype
 skypeforlinux
 slack
+smplayer
 soffice
 spectacle
 spotify
@@ -224,6 +233,7 @@ vlc
 vym
 w3m
 warzone2100
+waterfox
 weechat
 weechat-curses
 wesnot
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 976750f8f..0f7ab40ff 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -31,17 +31,19 @@
 static char *devloop = NULL;    // device file
 static char *mntdir = NULL;     // mount point in /tmp directory
+#ifdef LOOP_CTL_GET_FREE        // test for older kernels; this definition is found in /usr/include/linux/loop.h
 static void err_loop(void) {
        fprintf(stderr, "Error: cannot configure loopback device\n");
        exit(1);
 }
+#endif
 void appimage_set(const char *appimage) {
        assert(appimage);
        assert(devloop == NULL);        // don't call this twice!
        EUID_ASSERT();
-#ifdef LOOP_CTL_GET_FREE        // test for older kernels; this definition is found in /usr/include/linux/loop.h
+#ifdef LOOP_CTL_GET_FREE
        // check appimage file
        invalid_filename(appimage);
        if (access(appimage, R_OK) == -1) {
diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index d45ba20ce..ff4d3a9d7 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -248,10 +248,19 @@ void caps_print(void) {
        }
 }
+// drop discretionary access control capabilities for root sandboxes
+void caps_drop_dac_override(void) {
+        if (getuid() == 0) {
+                if (prctl(PR_CAPBSET_DROP, CAP_DAC_OVERRIDE, 0, 0, 0));
+                else if (arg_debug)
+                        printf("Drop CAP_DAC_OVERRIDE\n");
+                if (prctl(PR_CAPBSET_DROP, CAP_DAC_READ_SEARCH, 0, 0, 0));
+                else if (arg_debug)
+                        printf("Drop CAP_DAC_READ_SEARCH\n");
+        }
+}
-// enabled by default
 int caps_default_filter(void) {
        // drop capabilities
        if (prctl(PR_CAPBSET_DROP, CAP_SYS_MODULE, 0, 0, 0))
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 91b9c7be7..8bf2a75c3 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -500,6 +500,7 @@ void fs_dev_shm(void);
 void fs_private_dev(void);
 void fs_dev_disable_sound(void);
 void fs_dev_disable_3d(void);
+void fs_dev_disable_video(void);
 // fs_home.c
 // private mode (--private)
@@ -533,6 +534,7 @@ void caps_check_list(const char *clist, void (*callback)(int));
 void caps_drop_list(const char *clist);
 void caps_keep_list(const char *clist);
 void caps_print_filter(pid_t pid);
+void caps_drop_dac_override(void);
 // syscall.c
 const char *syscall_find_nr(int nr);
@@ -718,6 +720,7 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
 // programs
 #define PATH_FNET (LIBDIR "/firejail/fnet")
 #define PATH_FIREMON (PREFIX "/bin/firemon")
+#define PATH_FIREJAIL (PREFIX "/bin/firejail")
 #define PATH_FSECCOMP (LIBDIR "/firejail/fseccomp")
 #define PATH_FCOPY (LIBDIR "/firejail/fcopy")
 #define SBOX_STDIN_FILE "/run/firejail/mnt/sbox_stdin"
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 159c8e654..fdaa0b355 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -35,37 +35,37 @@ typedef struct {
        const char *dev_fname;
        const char *run_fname;
        int sound;
-        int video;
        int hw3d;
+        int video;
 } DevEntry;
 static DevEntry dev[] = {
-        {"/dev/snd", RUN_DEV_DIR "/snd", 1, 0}, // sound device
+        {"/dev/snd", RUN_DEV_DIR "/snd", 1, 0, 0},      // sound device
-        {"/dev/dri", RUN_DEV_DIR "/dri", 0, 1},         // 3d device
+        {"/dev/dri", RUN_DEV_DIR "/dri", 0, 1, 0},              // 3d device
-        {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", 0, 1},
+        {"/dev/nvidia0", RUN_DEV_DIR "/nvidia0", 0, 1, 0},
-        {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", 0, 1},
+        {"/dev/nvidia1", RUN_DEV_DIR "/nvidia1", 0, 1, 0},
-        {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", 0, 1},
+        {"/dev/nvidia2", RUN_DEV_DIR "/nvidia2", 0, 1, 0},
-        {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", 0, 1},
+        {"/dev/nvidia3", RUN_DEV_DIR "/nvidia3", 0, 1, 0},
-        {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", 0, 1},
+        {"/dev/nvidia4", RUN_DEV_DIR "/nvidia4", 0, 1, 0},
-        {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", 0, 1},
+        {"/dev/nvidia5", RUN_DEV_DIR "/nvidia5", 0, 1, 0},
-        {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", 0, 1},
+        {"/dev/nvidia6", RUN_DEV_DIR "/nvidia6", 0, 1, 0},
-        {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", 0, 1},
+        {"/dev/nvidia7", RUN_DEV_DIR "/nvidia7", 0, 1, 0},
-        {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", 0, 1},
+        {"/dev/nvidia8", RUN_DEV_DIR "/nvidia8", 0, 1, 0},
-        {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", 0, 1},
+        {"/dev/nvidia9", RUN_DEV_DIR "/nvidia9", 0, 1, 0},
-        {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", 0, 1},
+        {"/dev/nvidiactl", RUN_DEV_DIR "/nvidiactl", 0, 1, 0},
-        {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", 0, 1},
+        {"/dev/nvidia-modeset", RUN_DEV_DIR "/nvidia-modeset", 0, 1, 0},
-        {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", 0, 1},
+        {"/dev/nvidia-uvm", RUN_DEV_DIR "/nvidia-uvm", 0, 1, 0},
-        {"/dev/video0", RUN_DEV_DIR "/video0", 0, 1},
+        {"/dev/video0", RUN_DEV_DIR "/video0", 0, 0, 1}, // video camera devices
-        {"/dev/video1", RUN_DEV_DIR "/video1", 0, 1},
+        {"/dev/video1", RUN_DEV_DIR "/video1", 0, 0, 1},
-        {"/dev/video2", RUN_DEV_DIR "/video2", 0, 1},
+        {"/dev/video2", RUN_DEV_DIR "/video2", 0, 0, 1},
-        {"/dev/video3", RUN_DEV_DIR "/video3", 0, 1},
+        {"/dev/video3", RUN_DEV_DIR "/video3", 0, 0, 1},
-        {"/dev/video4", RUN_DEV_DIR "/video4", 0, 1},
+        {"/dev/video4", RUN_DEV_DIR "/video4", 0, 0, 1},
-        {"/dev/video5", RUN_DEV_DIR "/video5", 0, 1},
+        {"/dev/video5", RUN_DEV_DIR "/video5", 0, 0, 1},
-        {"/dev/video6", RUN_DEV_DIR "/video6", 0, 1},
+        {"/dev/video6", RUN_DEV_DIR "/video6", 0, 0, 1},
-        {"/dev/video7", RUN_DEV_DIR "/video7", 0, 1},
+        {"/dev/video7", RUN_DEV_DIR "/video7", 0, 0, 1},
-        {"/dev/video8", RUN_DEV_DIR "/video8", 0, 1},
+        {"/dev/video8", RUN_DEV_DIR "/video8", 0, 0, 1},
-        {"/dev/video9", RUN_DEV_DIR "/video9", 0, 1},
+        {"/dev/video9", RUN_DEV_DIR "/video9", 0, 0, 1},
-        {NULL, NULL, 0, 0}
+        {NULL, NULL, 0, 0, 0}
 };
 static void deventry_mount(void) {
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c
index 9452d162d..11e9eabf5 100644
--- a/src/firejail/fs_var.c
+++ b/src/firejail/fs_var.c
@@ -326,7 +326,8 @@ void fs_var_utmp(void) {
        endutent();
        // save new utmp file
-        fwrite(&u_boot, sizeof(u_boot), 1, fp);
+        int rv = fwrite(&u_boot, sizeof(u_boot), 1, fp);
+        (void) rv;
        SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH);
        fclose(fp);
diff --git a/src/firejail/join.c b/src/firejail/join.c
index b5b45a3bf..4c0537413 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -242,6 +242,9 @@ void join(pid_t pid, int argc, char **argv, int index) {
        if (child < 0)
                errExit("fork");
        if (child == 0) {
+                // drop discretionary access control capabilities for root sandboxes
+                caps_drop_dac_override();
+                
                // chroot into /proc/PID/root directory
                char *rootdir;
                if (asprintf(&rootdir, "/proc/%d/root", pid) == -1)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 95c325f9f..cff61f64a 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -2272,9 +2272,9 @@ int main(int argc, char **argv) {
                if (cfg.chrootdir) {
                        fwarning("default profile disabled by --chroot option\n");
                }
-                else if (arg_overlay) {
+//              else if (arg_overlay) {
-                        fwarning("default profile disabled by --overlay option\n");
+//                      fwarning("default profile disabled by --overlay option\n");
-                }
+//              }
                else {
                        // try to load a default profile
                        char *profile_name = DEFAULT_USER_PROFILE;
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index b37c5abf7..07c42006d 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -209,6 +209,11 @@ void run_no_sandbox(int argc, char **argv) {
                        break;
                }
        }
+        // if shell is /usr/bin/firejail, replace it with /bin/bash
+        if (strcmp(cfg.shell, PATH_FIREJAIL) == 0) {
+                cfg.shell = "/bin/bash";
+                prog_index = 0;
+        }
        if (prog_index == 0) {
                cfg.command_line = cfg.shell;
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c
index a9298a33f..ed885d3b1 100644
--- a/src/firejail/run_symlink.c
+++ b/src/firejail/run_symlink.c
@@ -86,10 +86,6 @@ void run_symlink(int argc, char **argv) {
        // start the argv[0] program in a new sandbox
-        char *firejail;
-        if (asprintf(&firejail, "%s/bin/firejail", PREFIX) == -1)
-                errExit("asprintf");
        // drop privileges
        if (setgid(getgid()) < 0)
                errExit("setgid/getgid");
@@ -98,7 +94,7 @@ void run_symlink(int argc, char **argv) {
        // run command
        char *a[3 + argc];
-        a[0] = firejail;
+        a[0] =PATH_FIREJAIL;
        a[1] = program;
        int i;
        for (i = 0; i < (argc - 1); i++) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 7f82e2253..4ee05d070 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -99,6 +99,9 @@ static void set_caps(void) {
                caps_keep_list(arg_caps_list);
        else if (arg_caps_default_filter)
                caps_default_filter();
+        
+        // drop discretionary access control capabilities for root sandboxes
+        caps_drop_dac_override();
 }
 void save_nogroups(void) {
@@ -896,8 +899,7 @@ int sandbox(void* sandbox_arg) {
        // set security filters
        //****************************
        // set capabilities
-//      if (!arg_noroot)
+        set_caps();
-                set_caps();
        // set rlimits
        set_rlimits();
@@ -989,10 +991,9 @@ int sandbox(void* sandbox_arg) {
                if (arg_apparmor) {
                        errno = 0;
                        if (aa_change_onexec("firejail-default")) {
-                                fprintf(stderr, "Error: cannot confine the application using AppArmor.\n");
+                                fwarning("Cannot confine the application using AppArmor.\n"
-                                fprintf(stderr, "Maybe firejail-default AppArmor profile is not loaded into the kernel.\n");
+                                        "Maybe firejail-default AppArmor profile is not loaded into the kernel.\n"
-                                fprintf(stderr, "As root, run \"aa-enforce firejail-default\" to load it.\n");
+                                        "As root, run \"aa-enforce firejail-default\" to load it.\n");
-                                exit(1);
                        }
                        else if (arg_debug)
                                printf("AppArmor enabled\n");
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 72a5874f8..15379215c 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -68,7 +68,7 @@ int seccomp_load(const char *fname) {
                goto errexit;
        unsigned short entries = (unsigned short) size / (unsigned short) sizeof(struct sock_filter);
        if (arg_debug)
-                printf("reading %d seccomp entries from %s\n", entries, fname);
+                printf("configuring %d seccomp entries from %s\n", entries, fname);
        // read filter
        struct sock_filter *filter = malloc(size);
@@ -205,6 +205,8 @@ int seccomp_filter_keep(void) {
                printf("seccomp filter configured\n");
+        if (arg_debug && access(PATH_FSECCOMP, X_OK) == 0)
+                sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FSECCOMP, "print", RUN_SECCOMP_CFG);
        return seccomp_load(RUN_SECCOMP_CFG);
 }
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 76930e1de..6f8298589 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -220,7 +220,7 @@ void usage(void) {
        printf("\tstart Mozilla Firefox\n");
        printf("    $ firejail --debug firefox\n");
        printf("\tdebug Firefox sandbox\n");
-        printf("    $ firejail --private --sna=8.8.8.8 firefox\n");
+        printf("    $ firejail --private --dns=8.8.8.8 firefox\n");
        printf("\tstart Firefox with a new, empty home directory, and a well-known DNS\n");
        printf("\tserver setting.\n");
        printf("    $ firejail --net=eth0 firefox\n");
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 5ce156603..79ebc3b1b 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -639,7 +639,7 @@ void x11_start_xpra(int argc, char **argv) {
        // build the start command
        char *server_argv[256] = {                // rest initialyzed to NULL
-                 "xpra", "start", display_str, "--no-daemon",
+                 "xpra", "start", display_str, "--no-daemon", "--use-display",
        };
        unsigned pos = 0;
        while (server_argv[pos] != NULL) pos++;
@@ -736,7 +736,7 @@ void x11_start_xpra(int argc, char **argv) {
        }
        // add a small delay, on some systems it takes some time for the server to start
-        sleep(1);
+        sleep(5);
        // check X11 socket
        char *fname;
diff --git a/src/ftee/main.c b/src/ftee/main.c
index 2628a77c5..6aede324c 100644
--- a/src/ftee/main.c
+++ b/src/ftee/main.c
@@ -129,7 +129,8 @@ static void log_write(const unsigned char *str, int len, const char *fname) {
                out_cnt = len;
        }
-        fwrite(str, len, 1, out_fp);
+        int rv = fwrite(str, len, 1, out_fp);
+        (void) rv;
        fflush(0);
 }
@@ -230,7 +231,8 @@ int main(int argc, char **argv) {
                if (n <= 0)
                        break;
-                fwrite(buf, n, 1, stdout);
+                int rv = fwrite(buf, n, 1, stdout);
+                (void) rv;
                log_write(buf, n, fname);
        }
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index cbffa9ce4..e4ef90944 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -407,6 +407,7 @@ Disable sound system.
 .TP
 \fBnovideo
 Disable video devices.
+.TP
 \fBno3d
 Disable 3D hardware acceleration.