13 files changed, 427 insertions, 335 deletions

diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 3c42567d4..dd056553e 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -1,15 +1,16 @@
 # /usr/lib/firejail/firecfg.config - firecfg utility configuration file
 # This is the list of programs in alphabetical order handled by firecfg utility
 #
-# Cryptocat is added but commented since isn't installed to a */bin... keep an eye on this
 #qemu-system-x86_64
 0ad
 2048-qt
+Cryptocat
 Cyberfox
 Discord
 DiscordCanary
 FossaMail
 Fritzing
+Gitter
 JDownloader
 Mathematica
 Natron
@@ -33,13 +34,14 @@ archaudit-report
 ardour4
 ardour5
 arduino
+aria2c
 ark
 arm
 artha
-# atom
-# atom-beta
 assogiate
 asunder
+# atom
+# atom-beta
 atool
 atril
 atril-previewer
@@ -54,6 +56,7 @@ baobab
 basilisk
 beaker
 bibletime
+bitcoin-qt
 bitlbee
 bleachbit
 blender
@@ -76,6 +79,8 @@ calligrasheets
 calligrastage
 calligrawords
 catfish
+celluloid
+checkbashisms
 cherrytree
 chromium
 chromium-browser
@@ -88,20 +93,24 @@ clamtk
 claws-mail
 clawsker
 clementine
+clion
 clipit
 cliqz
 cmus
 code
+code-oss
 conkeror
 conky
 corebird
 crow
+cryptocat
 cvlc
 cyberfox
 darktable
 dconf-editor
 deadbeef
 deluge
+devhelp
 dex2jar
 dia
 dig
@@ -120,6 +129,7 @@ dooble-qt4
 dosbox
 dragon
 dropbox
+d-feet
 easystroke
 ebook-viewer
 electrum
@@ -147,9 +157,13 @@ fbreader
 feedreader
 feh
 ffmpeg
+ffmpegthumbnailer
+ffplay
+ffprobe
 file-roller
 filezilla
 firefox
+firefox-beta
 firefox-developer-edition
 firefox-esr
 firefox-nightly
@@ -159,18 +173,22 @@ flashpeak-slimjet
 flowblade
 font-manager
 fontforge
+fossamail
 franz
 freecad
 freecadcmd
 freshclam
 frozen-bubble
 gajim
+gajim-history-manager
 galculator
+gcalccmd
 gcloud
 gconf-editor
 geany
 geary
 gedit
+geekbench
 geeqie
 ghb
 ghostwriter
@@ -183,8 +201,8 @@ gitter
 gjs
 globaltime
 gnome-2048
-gnome-builder
 gnome-books
+gnome-builder
 gnome-calculator
 gnome-chess
 gnome-clocks
@@ -196,8 +214,11 @@ gnome-maps
 gnome-mplayer
 gnome-mpv
 gnome-music
+gnome-nettool
 gnome-photos
 gnome-recipes
+gnome-schedule
+gnome-system-log
 gnome-twitch
 gnome-weather
 goobox
@@ -284,6 +305,7 @@ lximage-qt
 lxmusic
 lynx
 macrofusion
+masterpdfeditor
 masterpdfeditor4
 masterpdfeditor5
 mate-calc
@@ -295,6 +317,7 @@ mcabber
 mediainfo
 mediathekview
 meld
+mencoder
 mendeleydesktop
 midori
 min
@@ -321,12 +344,17 @@ mutt
 mypaint
 mypaint-ora-thumbnailer
 natron
-#nautilus - removed in order to let the application start in a new sandbox when clicking on icons in the file manager
 ncdu
+netactview
+nethack
 netsurf
 neverball
 nheko
 nitroshare
+nitroshare-cli
+nitroshare-nmh
+nitroshare-send
+nitroshare-ui
 nylas
 nyx
 obs
@@ -343,6 +371,7 @@ orage
 palemoon
 parole
 patch
+pavucontrol
 pdfchain
 pdfmod
 pdfsam
@@ -360,6 +389,7 @@ playonlinux
 pluma
 polari
 ppsspp
+pragha
 psi-plus
 pybitmessage
 # pycharm-community - FB note: may enable later
@@ -369,6 +399,7 @@ qemu-launcher
 qlipper
 qmmp
 qpdfview
+qt-faststart
 qtox
 quassel
 quiterss
@@ -376,6 +407,8 @@ qupzilla
 qutebrowser
 rambox
 redeclipse
+redshift
+regextester
 remmina
 rhythmbox
 ricochet
@@ -389,13 +422,17 @@ sayonara
 scallion
 scribus
 sdat2img
+seahorse
+seahorse-tool
 seamonkey
 seamonkey-bin
+secret-tool
 shellcheck
 shotcut
 signal-desktop
 silentarmy
 simple-scan
+simplescreenrecorder
 simutrans
 skanlite
 skype
@@ -403,8 +440,9 @@ skypeforlinux
 slack
 smplayer
 smtube
-sol
+snox
 soffice
+sol
 soundconverter
 spotify
 sqlitebrowser
@@ -416,12 +454,15 @@ steam
 steam-native
 stellarium
 strings
+studio.sh
 subdownloader
 supertux2
 supertuxkart
 surf
 sylpheed
 synfigstudio
+sysprof
+sysprof-cli
 teamspeak3
 telegram
 telegram-desktop
@@ -464,9 +505,16 @@ tor-browser-zh-tw
 torbrowser-launcher
 totem
 tracker
+transgui
 transmission-cli
+transmission-create
+transmission-daemon
+transmission-edit
 transmission-gtk
 transmission-qt
+transmission-remote
+transmission-remote-cli
+transmission-remote-gtk
 transmission-show
 truecraft
 tuxguitar
@@ -505,6 +553,7 @@ xchat
 xed
 xfburn
 xfce4-dict
+xfce4-mixer
 xfce4-notes
 xiphos
 xmms
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 1372c3ca3..01ddf2a14 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -78,6 +78,7 @@
 #define RUN_WHITELIST_HOME_DIR  "/run/firejail/mnt/orig-home"   // default home directory masking
 #define RUN_WHITELIST_RUN_DIR   "/run/firejail/mnt/orig-run"    // default run directory masking
 #define RUN_WHITELIST_HOME_USER_DIR     "/run/firejail/mnt/orig-home-user"      // home directory whitelisting
+#define RUN_WHITELIST_RUN_USER_DIR      "/run/firejail/mnt/orig-run-user"       // run directory whitelisting
 #define RUN_WHITELIST_TMP_DIR   "/run/firejail/mnt/orig-tmp"
 #define RUN_WHITELIST_MEDIA_DIR "/run/firejail/mnt/orig-media"
 #define RUN_WHITELIST_MNT_DIR   "/run/firejail/mnt/orig-mnt"
@@ -211,6 +212,7 @@ typedef struct profile_entry_t {
         unsigned etc_dir:1;     // whitelist in /etc directory
         unsigned share_dir:1;   // whitelist in /usr/share directory
         unsigned module_dir:1;  // whitelist in /sys/module directory
+        unsigned run_dir:1;     // whitelist in /run/user/$uid directory
 }ProfileEntry;
 
 typedef struct config_t {
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 4872d6cd9..bd036908a 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -228,7 +228,7 @@ void fs_private_dev(void){
         }
 
         // mount tmpfs on top of /dev
-        if (mount("tmpfs", "/dev", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+        if (mount("tmpfs", "/dev", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                 errExit("mounting /dev");
         fs_logger("tmpfs /dev");
 
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 7746aa44b..e35bf073d 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -270,7 +270,7 @@ void fs_private_homedir(void) {
                 // mask /root
                 if (arg_debug)
                         printf("Mounting a new /root directory\n");
-                if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME | MS_REC,  "mode=700,gid=0") < 0)
+                if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME,  "mode=700,gid=0") < 0)
                         errExit("mounting home directory");
                 fs_logger("tmpfs /root");
         }
@@ -278,7 +278,7 @@ void fs_private_homedir(void) {
                 // mask /home
                 if (arg_debug)
                         printf("Mounting a new /home directory\n");
-                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting home directory");
                 fs_logger("tmpfs /home");
         }
@@ -313,7 +313,7 @@ void fs_private(void) {
         else {
                 if (arg_allusers)
                         fwarning("--allusers disabled by --private or --whitelist\n");
-                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting home directory");
                 fs_logger("tmpfs /home");
         }
@@ -321,7 +321,7 @@ void fs_private(void) {
         // mask /root
         if (arg_debug)
                 printf("Mounting a new /root directory\n");
-        if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME | MS_REC,  "mode=700,gid=0") < 0)
+        if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME,  "mode=700,gid=0") < 0)
                 errExit("mounting root directory");
         fs_logger("tmpfs /root");
 
@@ -517,14 +517,14 @@ void fs_private_home_list(void) {
                 // mask /root
                 if (arg_debug)
                         printf("Mounting a new /root directory\n");
-                if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=700,gid=0") < 0)
+                if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=700,gid=0") < 0)
                         errExit("mounting home directory");
         }
         else {
                 // mask /home
                 if (arg_debug)
                         printf("Mounting a new /home directory\n");
-                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting home directory");
         }
 
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c
index 5b872ad75..75369b47c 100644
--- a/src/firejail/fs_var.c
+++ b/src/firejail/fs_var.c
@@ -118,7 +118,7 @@ void fs_var_log(void) {
                 // mount a tmpfs on top of /var/log
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/log\n");
-                if (mount("tmpfs", "/var/log", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var/log", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /var/log");
                 fs_logger("tmpfs /var/log");
 
@@ -153,7 +153,7 @@ void fs_var_lib(void) {
         if (stat("/var/lib/dhcp", &s) == 0) {
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/lib/dhcp\n");
-                if (mount("tmpfs", "/var/lib/dhcp", "tmpfs", MS_NOSUID |  MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var/lib/dhcp", "tmpfs", MS_NOSUID |  MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /var/lib/dhcp");
                 fs_logger("tmpfs /var/lib/dhcp");
 
@@ -172,7 +172,7 @@ void fs_var_lib(void) {
         if (stat("/var/lib/nginx", &s) == 0) {
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/lib/nginx\n");
-                if (mount("tmpfs", "/var/lib/nginx", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var/lib/nginx", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /var/lib/nginx");
                 fs_logger("tmpfs /var/lib/nginx");
         }
@@ -181,7 +181,7 @@ void fs_var_lib(void) {
         if (stat("/var/lib/snmp", &s) == 0) {
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/lib/snmp\n");
-                if (mount("tmpfs", "/var/lib/snmp", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var/lib/snmp", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /var/lib/snmp");
                 fs_logger("tmpfs /var/lib/snmp");
         }
@@ -190,7 +190,7 @@ void fs_var_lib(void) {
         if (stat("/var/lib/sudo", &s) == 0) {
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/lib/sudo\n");
-                if (mount("tmpfs", "/var/lib/sudo", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var/lib/sudo", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /var/lib/sudo");
                 fs_logger("tmpfs /var/lib/sudo");
         }
@@ -202,7 +202,7 @@ void fs_var_cache(void) {
         if (stat("/var/cache/apache2", &s) == 0) {
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/cache/apache2\n");
-                if (mount("tmpfs", "/var/cache/apache2", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var/cache/apache2", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /var/cache/apache2");
                 fs_logger("tmpfs /var/cache/apache2");
         }
@@ -210,7 +210,7 @@ void fs_var_cache(void) {
         if (stat("/var/cache/lighttpd", &s) == 0) {
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/cache/lighttpd\n");
-                if (mount("tmpfs", "/var/cache/lighttpd", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var/cache/lighttpd", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /var/cache/lighttpd");
                 fs_logger("tmpfs /var/cache/lighttpd");
 
@@ -250,7 +250,7 @@ void fs_var_lock(void) {
         if (is_dir("/var/lock")) {
                 if (arg_debug)
                         printf("Mounting tmpfs on /var/lock\n");
-                if (mount("tmpfs", "/var/lock", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=1777,gid=0") < 0)
+                if (mount("tmpfs", "/var/lock", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=1777,gid=0") < 0)
                         errExit("mounting /lock");
                 fs_logger("tmpfs /var/lock");
         }
@@ -266,7 +266,7 @@ void fs_var_tmp(void) {
                 if (!is_link("/var/tmp")) {
                         if (arg_debug)
                                 printf("Mounting tmpfs on /var/tmp\n");
-                        if (mount("tmpfs", "/var/tmp", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=1777,gid=0") < 0)
+                        if (mount("tmpfs", "/var/tmp", "tmpfs", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,  "mode=1777,gid=0") < 0)
                                 errExit("mounting /var/tmp");
                         fs_logger("tmpfs /var/tmp");
                 }
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 6cd445433..d128065d3 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -33,19 +33,20 @@
 //#define TEST_MOUNTINFO
 
 #define EMPTY_STRING ("")
-#define MAXBUF 4098
 static size_t homedir_len; // cache length of homedir string
+static size_t runuser_len; // cache length of runuser string
+static char *runuser;
 
 
 static int mkpath(const char* path, mode_t mode) {
         assert(path && *path);
         mode |= 0111;
 
-        // create directories with uid/gid as root or as current user if inside home directory
-        int userhome = 0;
-        if (strncmp(path, cfg.homedir, homedir_len) == 0) {
+        // create directories with uid/gid as root or as current user if inside home or run directory
+        int userprivs = 0;
+        if (strncmp(path, cfg.homedir, homedir_len) == 0 || strncmp(path, runuser, runuser_len) == 0) {
                 EUID_USER();
-                userhome = 1;
+                userprivs = 1;
         }
 
         // work on a copy of the path
@@ -68,11 +69,6 @@ static int mkpath(const char* path, mode_t mode) {
         char *tok = strtok(dup, "/");
         assert(tok); // path is no top level directory
         while (tok) {
-                // skip all instances of "/./"
-                if (strcmp(tok, ".") == 0) {
-                        tok = strtok(NULL, "/");
-                        continue;
-                }
                 // create the directory if necessary
                 if (mkdirat(parentfd, tok, mode) == -1) {
                         if (errno != EEXIST) {
@@ -80,7 +76,7 @@ static int mkpath(const char* path, mode_t mode) {
                                         perror("mkdir");
                                 close(parentfd);
                                 free(dup);
-                                if (userhome) {
+                                if (userprivs) {
                                         EUID_ROOT();
                                 }
                                 return -1;
@@ -95,7 +91,7 @@ static int mkpath(const char* path, mode_t mode) {
                                 perror("open");
                         close(parentfd);
                         free(dup);
-                        if (userhome) {
+                        if (userprivs) {
                                 EUID_ROOT();
                         }
                         return -1;
@@ -110,7 +106,7 @@ static int mkpath(const char* path, mode_t mode) {
                 fs_logger2("mkpath", path);
 
         free(dup);
-        if (userhome) {
+        if (userprivs) {
                 EUID_ROOT();
         }
         return fd;
@@ -205,6 +201,12 @@ static void whitelist_path(ProfileEntry *entry) {
                 if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_MODULE_DIR, fname) == -1)
                         errExit("asprintf");
         }
+        else if (entry->run_dir) {
+                fname = path + runuser_len + 1; // strlen("/run/user/$uid/")
+
+                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_RUN_USER_DIR, fname) == -1)
+                        errExit("asprintf");
+        }
         assert(wfile);
 
         if (arg_debug || arg_debug_whitelists)
@@ -331,7 +333,11 @@ void fs_whitelist(void) {
         if (!entry)
                 return;
 
+        if (asprintf(&runuser, "/run/user/%u", getuid()) == -1)
+                errExit("asprintf");
+        runuser_len = strlen(runuser);
         homedir_len = strlen(cfg.homedir);
+
         char *new_name = NULL;
         int home_dir = 0;       // /home/user directory flag
         int tmp_dir = 0;        // /tmp directory flag
@@ -344,6 +350,7 @@ void fs_whitelist(void) {
         int etc_dir = 0;                // /etc directory flag
         int share_dir = 0;                // /usr/share directory flag
         int module_dir = 0;                // /sys/module directory flag
+        int run_dir = 0;                // /run/user/$uid directory flag
 
         size_t nowhitelist_c = 0;
         size_t nowhitelist_m = 32;
@@ -455,6 +462,8 @@ void fs_whitelist(void) {
                                         share_dir = 1;
                                 else if (strncmp(new_name, "/sys/module/", 12) == 0)
                                         module_dir = 1;
+                                else if (strncmp(new_name, runuser, runuser_len) == 0 && new_name[runuser_len] == '/')
+                                        run_dir = 1;
                         }
 
                         entry->data = EMPTY_STRING;
@@ -630,6 +639,15 @@ void fs_whitelist(void) {
                                 goto errexit;
                         }
                 }
+                else if (strncmp(new_name, runuser, runuser_len) == 0 && new_name[runuser_len] == '/') {
+                        entry->run_dir = 1;
+                        run_dir = 1;
+                        // both path and absolute path are under /run/user/$uid
+                        if (strncmp(fname, runuser, runuser_len) != 0 || fname[runuser_len] != '/') {
+                                free(fname);
+                                goto errexit;
+                        }
+                }
                 else {
                         free(fname);
                         goto errexit;
@@ -710,7 +728,7 @@ void fs_whitelist(void) {
                 // mount tmpfs on /tmp
                 if (arg_debug || arg_debug_whitelists)
                         printf("Mounting tmpfs on /tmp directory\n");
-                if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=1777,gid=0") < 0)
+                if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=1777,gid=0") < 0)
                         errExit("mounting tmpfs on /tmp");
                 fs_logger("tmpfs /tmp");
         }
@@ -727,7 +745,7 @@ void fs_whitelist(void) {
                         // mount tmpfs on /media
                         if (arg_debug || arg_debug_whitelists)
                                 printf("Mounting tmpfs on /media directory\n");
-                        if (mount("tmpfs", "/media", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/media", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mounting tmpfs on /media");
                         fs_logger("tmpfs /media");
                 }
@@ -747,7 +765,7 @@ void fs_whitelist(void) {
                         // mount tmpfs on /mnt
                         if (arg_debug || arg_debug_whitelists)
                                 printf("Mounting tmpfs on /mnt directory\n");
-                        if (mount("tmpfs", "/mnt", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/mnt", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mounting tmpfs on /mnt");
                         fs_logger("tmpfs /mnt");
                 }
@@ -766,7 +784,7 @@ void fs_whitelist(void) {
                 // mount tmpfs on /var
                 if (arg_debug || arg_debug_whitelists)
                         printf("Mounting tmpfs on /var directory\n");
-                if (mount("tmpfs", "/var", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/var", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting tmpfs on /var");
                 fs_logger("tmpfs /var");
         }
@@ -781,7 +799,7 @@ void fs_whitelist(void) {
                 // mount tmpfs on /dev
                 if (arg_debug || arg_debug_whitelists)
                         printf("Mounting tmpfs on /dev directory\n");
-                if (mount("tmpfs", "/dev", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", "/dev", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting tmpfs on /dev");
                 fs_logger("tmpfs /dev");
         }
@@ -798,7 +816,7 @@ void fs_whitelist(void) {
                         // mount tmpfs on /opt
                         if (arg_debug || arg_debug_whitelists)
                                 printf("Mounting tmpfs on /opt directory\n");
-                        if (mount("tmpfs", "/opt", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/opt", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mounting tmpfs on /opt");
                         fs_logger("tmpfs /opt");
                 }
@@ -818,7 +836,7 @@ void fs_whitelist(void) {
                         // mount tmpfs on /srv
                         if (arg_debug || arg_debug_whitelists)
                                 printf("Mounting tmpfs on /srv directory\n");
-                        if (mount("tmpfs", "/srv", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/srv", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mounting tmpfs on /srv");
                         fs_logger("tmpfs /srv");
                 }
@@ -838,7 +856,7 @@ void fs_whitelist(void) {
                         // mount tmpfs on /srv
                         if (arg_debug || arg_debug_whitelists)
                                 printf("Mounting tmpfs on /etc directory\n");
-                        if (mount("tmpfs", "/etc", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/etc", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mounting tmpfs on /etc");
                         fs_logger("tmpfs /etc");
                 }
@@ -858,7 +876,7 @@ void fs_whitelist(void) {
                         // mount tmpfs on /srv
                         if (arg_debug || arg_debug_whitelists)
                                 printf("Mounting tmpfs on /usr/share directory\n");
-                        if (mount("tmpfs", "/usr/share", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/usr/share", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mounting tmpfs on /usr/share");
                         fs_logger("tmpfs /usr/share");
                 }
@@ -878,7 +896,7 @@ void fs_whitelist(void) {
                         // mount tmpfs on /sys/module
                         if (arg_debug || arg_debug_whitelists)
                                 printf("Mounting tmpfs on /sys/module directory\n");
-                        if (mount("tmpfs", "/sys/module", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/sys/module", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mounting tmpfs on /sys/module");
                         fs_logger("tmpfs /sys/module");
                 }
@@ -886,6 +904,30 @@ void fs_whitelist(void) {
                         module_dir = 0;
         }
 
+        // /run/user mountpoint
+        if (run_dir) {
+                // check if /run/user/$uid directory exists
+                if (stat(runuser, &s) == 0) {
+                        // keep a copy of real /run/user/$uid directory in RUN_WHITELIST_RUN_USER_DIR
+                        mkdir_attr(RUN_WHITELIST_RUN_USER_DIR, 0700, getuid(), getgid());
+                        if (mount(runuser, RUN_WHITELIST_RUN_USER_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
+                                errExit("mount bind");
+
+                        // mount tmpfs on /run/user/$uid
+                        if (arg_debug || arg_debug_whitelists)
+                                printf("Mounting tmpfs on %s directory\n", runuser);
+                        char *options;
+                        if (asprintf(&options, "mode=700,uid=%u,gid=%u", getuid(), getgid()) == -1)
+                                errExit("asprintf");
+                        if (mount("tmpfs", runuser, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME, options) < 0)
+                                errExit("mounting tmpfs on /run/user/<uid>");
+                        free(options);
+                        fs_logger2("tmpfs", runuser);
+                }
+                else
+                        run_dir = 0;
+        }
+
 
         // go through profile rules again, and interpret whitelist commands
         entry = cfg.profile;
@@ -937,81 +979,89 @@ void fs_whitelist(void) {
 
         // mask the real home directory, currently mounted on RUN_WHITELIST_HOME_DIR
         if (home_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_HOME_USER_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_HOME_USER_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_HOME_USER_DIR);
         }
 
         // mask the real /tmp directory, currently mounted on RUN_WHITELIST_TMP_DIR
         if (tmp_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_TMP_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_TMP_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_TMP_DIR);
         }
 
         // mask the real /var directory, currently mounted on RUN_WHITELIST_VAR_DIR
         if (var_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_VAR_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_VAR_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_VAR_DIR);
         }
 
         // mask the real /opt directory, currently mounted on RUN_WHITELIST_OPT_DIR
         if (opt_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_OPT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_OPT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_OPT_DIR);
         }
 
         // mask the real /dev directory, currently mounted on RUN_WHITELIST_DEV_DIR
         if (dev_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_DEV_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_DEV_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_DEV_DIR);
         }
 
         // mask the real /media directory, currently mounted on RUN_WHITELIST_MEDIA_DIR
         if (media_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_MEDIA_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_MEDIA_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_MEDIA_DIR);
         }
 
         // mask the real /mnt directory, currently mounted on RUN_WHITELIST_MNT_DIR
         if (mnt_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_MNT_DIR);
         }
 
         // mask the real /srv directory, currently mounted on RUN_WHITELIST_SRV_DIR
         if (srv_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_SRV_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_SRV_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_SRV_DIR);
         }
 
         // mask the real /etc directory, currently mounted on RUN_WHITELIST_ETC_DIR
         if (etc_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_ETC_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_ETC_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_ETC_DIR);
         }
 
         // mask the real /usr/share directory, currently mounted on RUN_WHITELIST_SHARE_DIR
         if (share_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_SHARE_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_SHARE_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_SHARE_DIR);
         }
 
         // mask the real /sys/module directory, currently mounted on RUN_WHITELIST_MODULE_DIR
         if (module_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_MODULE_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_WHITELIST_MODULE_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mount tmpfs");
                 fs_logger2("tmpfs", RUN_WHITELIST_MODULE_DIR);
         }
 
+        // mask the real /run/user/$uid directory, currently mounted on RUN_WHITELIST_MODULE_DIR
+        if (run_dir) {
+                if (mount("tmpfs", RUN_WHITELIST_RUN_USER_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
+                        errExit("mount tmpfs");
+                fs_logger2("tmpfs", RUN_WHITELIST_RUN_USER_DIR);
+        }
+
+        free(runuser);
         return;
 
 errexit:
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index 905cc0f15..2effebbaa 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -80,7 +80,7 @@ void preproc_mount_mnt_dir(void) {
         if (!tmpfs_mounted) {
                 if (arg_debug)
                         printf("Mounting tmpfs on %s directory\n", RUN_MNT_DIR);
-                if (mount("tmpfs", RUN_MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                if (mount("tmpfs", RUN_MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                         errExit("mounting /run/firejail/mnt");
                 tmpfs_mounted = 1;
                 fs_logger2("tmpfs", RUN_MNT_DIR);
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index c163133c3..667b03652 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -241,9 +241,6 @@ error:
 // return 1 if the command is to be added to the linked list of profile commands
 // return 0 if the command was already executed inside the function
 int profile_check_line(char *ptr, int lineno, const char *fname) {
-#ifdef HAVE_WHITELIST
-        static int whitelist_warning_printed = 0;
-#endif
         EUID_ASSERT();
 
         // check and process conditional profile lines
@@ -858,8 +855,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         cfg.dns4 = dns;
                 else {
                         fprintf(stderr, "Error: up to 4 DNS servers can be specified\n");
-                        free(dns);
-                        return 1;
+                        exit(1);
                 }
                 return 0;
         }
@@ -1314,6 +1310,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         ptr += 10;
                 }
                 else {
+                        static int whitelist_warning_printed = 0;
                         if (!whitelist_warning_printed) {
                                 warning_feature_disabled("whitelist");
                                 whitelist_warning_printed = 1;
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index 7778d7ed8..5c5ace90b 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -83,7 +83,7 @@ static void sanitize_home(void) {
                 errExit("mount bind");
 
         // mount tmpfs in the new home
-        if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+        if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                 errExit("mount tmpfs");
         fs_logger("tmpfs /home");
 
@@ -105,7 +105,7 @@ static void sanitize_home(void) {
                 errExit("mount bind");
 
         // mask home dir under /run
-        if (mount("tmpfs", RUN_WHITELIST_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+        if (mount("tmpfs", RUN_WHITELIST_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                 errExit("mount tmpfs");
         fs_logger2("tmpfs", RUN_WHITELIST_HOME_DIR);
         if (!arg_private)
@@ -138,7 +138,7 @@ static void sanitize_run(void) {
                 errExit("mount bind");
 
         // mount tmpfs on /run/user
-        if (mount("tmpfs", "/run/user", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+        if (mount("tmpfs", "/run/user", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                 errExit("mount tmpfs");
         fs_logger("tmpfs /run/user");
 
@@ -156,7 +156,7 @@ static void sanitize_run(void) {
                 errExit("mount bind");
 
         // mask mirrored /run/user/$UID directory
-        if (mount("tmpfs", RUN_WHITELIST_RUN_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+        if (mount("tmpfs", RUN_WHITELIST_RUN_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                 errExit("mount tmpfs");
         fs_logger2("tmpfs", RUN_WHITELIST_RUN_DIR);
 
@@ -398,7 +398,7 @@ void restrict_users(void) {
                 else {
                         // user has the home directory outside /home
                         // mount tmpfs on top of /home in order to hide it
-                        if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME | MS_REC,  "mode=755,gid=0") < 0)
+                        if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                                 errExit("mount tmpfs");
                         fs_logger("tmpfs /home");
                 }
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 0e869ef7a..dd298a31a 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -1163,11 +1163,6 @@ int safe_fd(const char *path, int flags) {
         char *tok = strtok(dup, "/");
         assert(tok);
         while (tok) {
-                // skip all "/./"
-                if (strcmp(tok, ".") == 0) {
-                        tok = strtok(NULL, "/");
-                        continue;
-                }
                 // open the element, assuming it is a directory; this fails with ENOTDIR if it is a symbolic link
                 fd = openat(parentfd, tok, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
                 if (fd == -1) {
@@ -1267,7 +1262,7 @@ int invalid_sandbox(const pid_t pid) {
 }
 
 int has_handler(pid_t pid, int signal) {
-        if (signal > 0) {
+        if (signal > 0 && signal <= SIGRTMAX) {
                 char *fname;
                 if (asprintf(&fname, "/proc/%d/status", pid) == -1)
                         errExit("asprintf");
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 63b36053b..b0ed10b30 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -1099,7 +1099,7 @@ void x11_xorg(void) {
         }
 
         // temporarily mount a tempfs on top of /tmp directory
-        if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_STRICTATIME | MS_REC,  "mode=1777,gid=0") < 0)
+        if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=1777,gid=0") < 0)
                 errExit("mounting /tmp");
 
         // create the temporary .Xauthority file
@@ -1253,7 +1253,7 @@ void fs_x11(void) {
 
         // This directory must be mode 1777, or Xlib will barf.
         if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
-                MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME | MS_REC,
+                MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,
                 "mode=1777,uid=0,gid=0") < 0)
                 errExit("mounting tmpfs on /tmp/.X11-unix");
         fs_logger("tmpfs /tmp/.X11-unix");
diff --git a/src/fseccomp/seccomp.c b/src/fseccomp/seccomp.c
index fc0299a34..2a719725e 100644
--- a/src/fseccomp/seccomp.c
+++ b/src/fseccomp/seccomp.c
@@ -258,6 +258,14 @@ void memory_deny_write_execute(const char *fname) {
                 BPF_STMT(BPF_ALU+BPF_AND+BPF_K, SHM_EXEC),
                 BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SHM_EXEC, 0, 1),
                 KILL_PROCESS,
+                RETURN_ALLOW,
+#endif
+#ifdef SYS_memfd_create
+                // block memfd_create as it can be used to create
+                // arbitrary memory contents which can be later mapped
+                // as executable
+                BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_memfd_create, 0, 1),
+                KILL_PROCESS,
                 RETURN_ALLOW
 #endif
         };
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 052aeb56b..8f5aa777f 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -99,33 +99,33 @@ $ firejail --allusers
 \fB\-\-apparmor
 Enable AppArmor confinement. For more information, please see \fBAPPARMOR\fR section below.
 .TP
-\fB\-\-appimage
-Sandbox an AppImage (https://appimage.org/) application. If the sandbox is started
-as a regular user, nonewprivs and a default capabilities filter are enabled.
+\fB\-\-apparmor.print=name|pid
+Print the AppArmor confinement status for the sandbox identified by name or by PID.
 .br
 
 .br
 Example:
 .br
-$ firejail --appimage krita-3.0-x86_64.appimage
+$ firejail \-\-apparmor.print=browser
 .br
-$ firejail --appimage --private krita-3.0-x86_64.appimage
+5074:netblue:/usr/bin/firejail /usr/bin/firefox-esr
 .br
-$ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
+  AppArmor: firejail-default enforce
 
 .TP
-\fB\-\-apparmor.print=name|pid
-Print the AppArmor confinement status for the sandbox identified by name or by PID.
+\fB\-\-appimage
+Sandbox an AppImage (https://appimage.org/) application. If the sandbox is started
+as a regular user, nonewprivs and a default capabilities filter are enabled.
 .br
 
 .br
 Example:
 .br
-$ firejail \-\-apparmor.print=browser
+$ firejail --appimage krita-3.0-x86_64.appimage
 .br
-5074:netblue:/usr/bin/firejail /usr/bin/firefox-esr
+$ firejail --appimage --private krita-3.0-x86_64.appimage
 .br
-  AppArmor: firejail-default enforce
+$ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
 
 .TP
 \fB\-\-audit
@@ -701,10 +701,6 @@ Example:
 $ firejail --keep-var-tmp
 
 .TP
-\fB\-\-ls=name|pid dir_or_filename
-List files in sandbox container, see \fBFILE TRANSFER\fR section for more details.
-
-.TP
 \fB\-\-list
 List all sandboxes, see \fBMONITORING\fR section for more details.
 .br
@@ -720,7 +716,10 @@ $ firejail \-\-list
 .br
 7064:netblue::firejail \-\-noroot xterm
 .br
-$
+.TP
+\fB\-\-ls=name|pid dir_or_filename
+List files in sandbox container, see \fBFILE TRANSFER\fR section for more details.
+
 .TP
 \fB\-\-mac=address
 Assign MAC addresses to the last network interface defined by a \-\-net option. This option
@@ -735,6 +734,7 @@ $ firejail \-\-net=eth0 \-\-mac=00:11:22:33:44:55 firefox
 .TP
 \fB\-\-machine-id
 Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox.
+Note that this breaks audio support. Enable it when sound is not required.
 .br
 
 .br
@@ -747,8 +747,8 @@ $ firejail \-\-machine-id
 Install a seccomp filter to block attempts to create memory mappings
 that are both writable and executable, to change mappings to be
 executable, or to create executable shared memory. The filter examines
-the arguments of mmap, mmap2, mprotect, pkey_mprotect and shmat system
-calls and kills the process if necessary.
+the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create and
+shmat system calls and kills the process if necessary.
 .br
 
 .br
@@ -814,6 +814,24 @@ $ sudo ifconfig br1 10.10.30.1/24
 $ firejail \-\-net=br0 \-\-net=br1
 
 .TP
+\fB\-\-net=none
+Enable a new, unconnected network namespace. The only interface
+available in the new namespace is a new loopback interface (lo).
+Use this option to deny
+network access to programs that don't really need network access.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-net=none vlc
+.br
+
+.br
+Note: \-\-net=none can crash the application on some platforms.
+In these cases, it can be replaced with \-\-protocol=unix.
+
+.TP
 \fB\-\-net=ethernet_interface|wireless_interface
 Enable a new network namespace and connect it
 to this ethernet interface using the standard Linux macvlan|ipvaln
@@ -847,24 +865,6 @@ Example:
 $ firejail \-\-net=tap0 \-\-ip=10.10.20.80 \-\-netmask=255.255.255.0 \-\-defaultgw=10.10.20.1 firefox
 
 .TP
-\fB\-\-net=none
-Enable a new, unconnected network namespace. The only interface
-available in the new namespace is a new loopback interface (lo).
-Use this option to deny
-network access to programs that don't really need network access.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-net=none vlc
-.br
-
-.br
-Note: \-\-net=none can crash the application on some platforms.
-In these cases, it can be replaced with \-\-protocol=unix.
-
-.TP
 \fB\-\-net.print=name|pid
 If a new network namespace is enabled, print network interface configuration for the sandbox specified by name or PID. Example:
 .br
@@ -1067,6 +1067,17 @@ Example:
 $ firejail --no3d firefox
 
 .TP
+\fB\-\-noautopulse
+Disable automatic ~/.config/pulse init, for complex setups such as remote
+pulse servers or non-standard socket paths.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-noautopulse firefox
+
+.TP
 \fB\-\-noblacklist=dirname_or_filename
 Disable blacklist for this directory or file.
 .br
@@ -1156,6 +1167,14 @@ uid=1000(netblue) gid=1000(netblue) groups=1000(netblue)
 $
 
 .TP
+\fB\-\-nonewprivs
+Sets the NO_NEW_PRIVS prctl.  This ensures that child processes
+cannot acquire new privileges using execve(2);  in particular,
+this means that calling a suid binary (or one with file capabilities)
+does not result in an increase of privilege. This option
+is enabled by default if seccomp filter is activated.
+
+.TP
 \fB\-\-noprofile
 Do not use a security profile.
 .br
@@ -1208,14 +1227,6 @@ ping: icmp open socket: Operation not permitted
 $
 
 .TP
-\fB\-\-nonewprivs
-Sets the NO_NEW_PRIVS prctl.  This ensures that child processes
-cannot acquire new privileges using execve(2);  in particular,
-this means that calling a suid binary (or one with file capabilities)
-does not result in an increase of privilege. This option
-is enabled by default if seccomp filter is activated.
-
-.TP
 \fB\-\-nosound
 Disable sound system.
 .br
@@ -1226,17 +1237,6 @@ Example:
 $ firejail \-\-nosound firefox
 
 .TP
-\fB\-\-noautopulse
-Disable automatic ~/.config/pulse init, for complex setups such as remote
-pulse servers or non-standard socket paths.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-noautopulse firefox
-
-.TP
 \fB\-\-notv
 Disable DVB (Digital Video Broadcasting) TV devices.
 .br
@@ -1316,6 +1316,16 @@ Example:
 $ firejail \-\-overlay firefox
 
 .TP
+\fB\-\-overlay-clean
+Clean all overlays stored in $HOME/.firejail directory.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-overlay-clean
+
+.TP
 \fB\-\-overlay-named=name
 Mount a filesystem overlay on top of the current filesystem.  Unlike the regular filesystem container,
 the system directories are mounted read-write. All filesystem modifications go into the overlay.
@@ -1354,16 +1364,6 @@ Example:
 $ firejail \-\-overlay-tmpfs firefox
 
 .TP
-\fB\-\-overlay-clean
-Clean all overlays stored in $HOME/.firejail directory.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-overlay-clean
-
-.TP
 \fB\-\-private
 Mount new /root and /home/user directories in temporary
 filesystems. All modifications are discarded when the sandbox is
@@ -1374,6 +1374,7 @@ closed.
 Example:
 .br
 $ firejail \-\-private firefox
+
 .TP
 \fB\-\-private=directory
 Use directory as user home.
@@ -1385,17 +1386,26 @@ Example:
 $ firejail \-\-private=/home/netblue/firefox-home firefox
 
 .TP
-\fB\-\-private-home=file,directory
-Build a new user home in a temporary
-filesystem, and copy the files and directories in the list in the
-new home. All modifications are discarded when the sandbox is
-closed.
+\fB\-\-private-bin=file,file
+Build a new /bin in a temporary filesystem, and copy the programs in the list.
+If no listed file is found, /bin directory will be empty.
+The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin.
+All modifications are discarded when the sandbox is closed. File globbing is supported,
+see \fBFILE GLOBBING\fR section for more details.
 .br
 
 .br
 Example:
 .br
-$ firejail \-\-private-home=.mozilla firefox
+$ firejail \-\-private-bin=bash,sed,ls,cat
+.br
+Parent pid 20841, child pid 20842
+.br
+Child process initialized
+.br
+$ ls /bin
+.br
+bash  cat  ls  sed
 
 .TP
 \fB\-\-private-cache
@@ -1409,26 +1419,51 @@ Example:
 $ firejail \-\-private-cache openbox
 
 .TP
-\fB\-\-private-bin=file,file
-Build a new /bin in a temporary filesystem, and copy the programs in the list.
-If no listed file is found, /bin directory will be empty.
-The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin.
-All modifications are discarded when the sandbox is closed. File globbing is supported,
-see \fBFILE GLOBBING\fR section for more details.
+\fB\-\-private-dev
+Create a new /dev directory. Only disc, dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available.
 .br
 
 .br
 Example:
 .br
-$ firejail \-\-private-bin=bash,sed,ls,cat
+$ firejail \-\-private-dev
 .br
-Parent pid 20841, child pid 20842
+Parent pid 9887, child pid 9888
 .br
 Child process initialized
 .br
-$ ls /bin
+$ ls /dev
+.br
+cdrom  cdrw  dri  dvd  dvdrw  full  log  null  ptmx  pts  random  shm  snd  sr0  tty  urandom  zero
+.br
+$
+.TP
+\fB\-\-private-etc=file,directory
+Build a new /etc in a temporary
+filesystem, and copy the files and directories in the list.
+If no listed file is found, /etc directory will be empty.
+All modifications are discarded when the sandbox is closed.
 .br
-bash  cat  ls  sed
+
+.br
+Example:
+.br
+$ firejail --private-etc=group,hostname,localtime, \\
+.br
+nsswitch.conf,passwd,resolv.conf
+
+.TP
+\fB\-\-private-home=file,directory
+Build a new user home in a temporary
+filesystem, and copy the files and directories in the list in the
+new home. All modifications are discarded when the sandbox is
+closed.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-private-home=.mozilla firefox
 
 .TP
 \fB\-\-private-lib=file,directory
@@ -1480,41 +1515,6 @@ $ ps
 $
 .br
 
-
-.TP
-\fB\-\-private-dev
-Create a new /dev directory. Only disc, dri, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log and shm devices are available.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-private-dev
-.br
-Parent pid 9887, child pid 9888
-.br
-Child process initialized
-.br
-$ ls /dev
-.br
-cdrom  cdrw  dri  dvd  dvdrw  full  log  null  ptmx  pts  random  shm  snd  sr0  tty  urandom  zero
-.br
-$
-.TP
-\fB\-\-private-etc=file,directory
-Build a new /etc in a temporary
-filesystem, and copy the files and directories in the list.
-If no listed file is found, /etc directory will be empty.
-All modifications are discarded when the sandbox is closed.
-.br
-
-.br
-Example:
-.br
-$ firejail --private-etc=group,hostname,localtime, \\
-.br
-nsswitch.conf,passwd,resolv.conf
-
 .TP
 \fB\-\-private-opt=file,directory
 Build a new /opt in a temporary
@@ -1637,16 +1637,6 @@ Example:
 .br
 $ firejail \-\-read-only=~/.mozilla firefox
 .br
-
-.br
-A short note about mixing \-\-whitelist and \-\-read-only options. Whitelisted directories
-should be made read-only independently. Making a parent directory read-only, will not
-make the whitelist read-only. Example:
-.br
-
-.br
-$ firejail --whitelist=~/work --read-only=~ --read-only=~/work
-
 .TP
 \fB\-\-read-write=dirname_or_filename
 Set directory or file read-write. Only files or directories belonging to the current user are allowed for
@@ -2210,7 +2200,7 @@ $ firejail \-\-net=br0 --veth-name=if0
 Whitelist directory or file. A temporary file system is mounted on the top directory, and the
 whitelisted files are mount-binded inside. Modifications to whitelisted files are persistent,
 everything else is discarded when the sandbox is closed. The top directory could be
-user home, /dev, /etc, /media, /mnt, /opt, /srv, /sys/module, /usr/share, /var, and /tmp.
+user home, /dev, /etc, /media, /mnt, /opt, /run/user/$UID, /srv, /sys/module, /tmp, /usr/share and /var.
 .br
 
 .br
@@ -2430,6 +2420,69 @@ Example:
 $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox
 .br
 
+.SH APPARMOR
+.TP
+AppArmor support is disabled by default at compile time. Use --enable-apparmor configuration option to enable it:
+.br
+
+.br
+$ ./configure --prefix=/usr --enable-apparmor
+.TP
+During software install, a generic AppArmor profile file, firejail-default, is placed in /etc/apparmor.d directory. The local customizations must be placed in /etc/apparmor.d/local/firejail-local. The profile needs to be loaded into the kernel by reloading apparmor.service, rebooting the system or running the following command as root:
+.br
+
+.br
+# apparmor_parser -r /etc/apparmor.d/firejail-default
+.TP
+The installed profile is supplemental for main firejail functions and among other things does the following:
+.br
+
+.br
+- Disable ptrace. With ptrace it is possible to inspect and hijack running programs. Usually this is needed only for debugging. You should have no problems running Chromium or Firefox. This feature is available only on Ubuntu kernels.
+.br
+
+.br
+- Whitelist write access to several files under /run, /proc and /sys.
+.br
+
+.br
+- Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Those paths are available as read-only. Running programs and scripts from user home or other directories writable by the user is not allowed.
+.br
+
+.br
+- Prevent using non-standard network sockets. Only unix, inet, inet6, netlink, raw and packet are allowed.
+.br
+
+.br
+- Deny access to known sensitive paths like .snapshots.
+
+.TP
+To enable AppArmor confinement on top of your current Firejail security features, pass \fB\-\-apparmor\fR flag to Firejail command line. You can also include \fBapparmor\fR command in a Firejail profile file. Example:
+.br
+
+.br
+$ firejail --apparmor firefox
+
+.SH AUDIT
+Audit feature allows the user to point out gaps in security profiles. The
+implementation replaces the program to be sandboxed with a test program. By
+default, we use faudit program distributed with Firejail. A custom test program
+can also be supplied by the user. Examples:
+
+Running the default audit program:
+.br
+        $ firejail --audit transmission-gtk
+
+Running a custom audit program:
+.br
+        $ firejail --audit=~/sandbox-test transmission-gtk
+
+In the examples above, the sandbox configures transmission-gtk profile and
+starts the test program. The real program, transmission-gtk, will not be
+started.
+
+Limitations: audit feature is not implemented for --x11 commands.
+
 .SH DESKTOP INTEGRATION
 A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox.
 The symbolic link should be placed in the first $PATH position. On most systems, a good place
@@ -2485,6 +2538,35 @@ $ firejail --tree
 
 We provide a tool that automates all this integration, please see \fBman 1 firecfg\fR for more details.
 
+.SH EXAMPLES
+.TP
+\f\firejail
+Sandbox a regular /bin/bash session.
+.TP
+\f\firejail firefox
+Start Mozilla Firefox.
+.TP
+\f\firejail \-\-debug firefox
+Debug Firefox sandbox.
+.TP
+\f\firejail \-\-private firefox
+Start Firefox with a new, empty home directory.
+.TP
+\f\firejail --net=none vlc
+Start VLC in an unconnected network namespace.
+.TP
+\f\firejail \-\-net=eth0 firefox
+Start Firefox in a new network namespace. An IP address is
+assigned automatically.
+.TP
+\f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2
+Start a /bin/bash session in a new network namespace and connect it
+to br0, br1, and br2 host bridge devices. IP addresses are assigned
+automatically for the interfaces connected to br1 and b2
+.TP
+\f\firejail \-\-list
+List all sandboxed processes.
+
 .SH FILE GLOBBING
 .TP
 Globbing is the operation that expands a wildcard pattern into the list of pathnames matching the pattern. Matching is defined by:
@@ -2519,49 +2601,6 @@ $ firejail --blacklist=~/dir[1234]
 $ firejail --read-only=~/dir[1-4]
 .br
 
-.SH APPARMOR
-.TP
-AppArmor support is disabled by default at compile time. Use --enable-apparmor configuration option to enable it:
-.br
-
-.br
-$ ./configure --prefix=/usr --enable-apparmor
-.TP
-During software install, a generic AppArmor profile file, firejail-default, is placed in /etc/apparmor.d directory. The local customizations must be placed in /etc/apparmor.d/local/firejail-local. The profile needs to be loaded into the kernel by reloading apparmor.service, rebooting the system or running the following command as root:
-.br
-
-.br
-# apparmor_parser -r /etc/apparmor.d/firejail-default
-.TP
-The installed profile is supplemental for main firejail functions and among other things does the following:
-.br
-
-.br
-- Disable ptrace. With ptrace it is possible to inspect and hijack running programs. Usually this is needed only for debugging. You should have no problems running Chromium or Firefox. This feature is available only on Ubuntu kernels.
-.br
-
-.br
-- Whitelist write access to several files under /run, /proc and /sys.
-.br
-
-.br
-- Allow running programs only from well-known system paths, such as /bin, /sbin, /usr/bin etc. Those paths are available as read-only. Running programs and scripts from user home or other directories writable by the user is not allowed.
-.br
-
-.br
-- Prevent using non-standard network sockets. Only unix, inet, inet6, netlink, raw and packet are allowed.
-.br
-
-.br
-- Deny access to known sensitive paths like .snapshots.
-
-.TP
-To enable AppArmor confinement on top of your current Firejail security features, pass \fB\-\-apparmor\fR flag to Firejail command line. You can also include \fBapparmor\fR command in a Firejail profile file. Example:
-.br
-
-.br
-$ firejail --apparmor firefox
-
 .SH FILE TRANSFER
 These features allow the user to inspect the filesystem container of an existing sandbox
 and transfer files from the container to the host filesystem.
@@ -2610,68 +2649,6 @@ $ firejail \-\-get=mybrowser ~/Downloads/xpra-clipboard.png
 $ firejail \-\-put=mybrowser xpra-clipboard.png ~/Downloads/xpra-clipboard.png
 .br
 
-.SH TRAFFIC SHAPING
-Network bandwidth is an expensive resource shared among all sandboxes running on a system.
-Traffic shaping allows the user to increase network performance by controlling
-the amount of data that flows into and out of the sandboxes.
-
-Firejail implements a simple rate-limiting shaper based on Linux command tc.
-The shaper works at sandbox level, and can be used only for sandboxes configured with new network namespaces.
-
-Set rate-limits:
-
-        $ firejail --bandwidth=name|pid set network download upload
-
-Clear rate-limits:
-
-        $ firejail --bandwidth=name|pid clear network
-
-Status:
-
-        $ firejail --bandwidth=name|pid status
-
-where:
-.br
-        name - sandbox name
-.br
-        pid - sandbox pid
-.br
-        network - network interface as used by \-\-net option
-.br
-        download - download speed in KB/s (kilobyte per second)
-.br
-        upload - upload speed in KB/s (kilobyte per second)
-
-Example:
-.br
-        $ firejail \-\-name=mybrowser \-\-net=eth0 firefox &
-.br
-        $ firejail \-\-bandwidth=mybrowser set eth0 80 20
-.br
-        $ firejail \-\-bandwidth=mybrowser status
-.br
-        $ firejail \-\-bandwidth=mybrowser clear eth0
-
-.SH AUDIT
-Audit feature allows the user to point out gaps in security profiles. The
-implementation replaces the program to be sandboxed with a test program. By
-default, we use faudit program distributed with Firejail. A custom test program
-can also be supplied by the user. Examples:
-
-Running the default audit program:
-.br
-        $ firejail --audit transmission-gtk
-
-Running a custom audit program:
-.br
-        $ firejail --audit=~/sandbox-test transmission-gtk
-
-In the examples above, the sandbox configures transmission-gtk profile and
-starts the test program. The real program, transmission-gtk, will not be
-started.
-
-Limitations: audit feature is not implemented for --x11 commands.
-
 .SH MONITORING
 Option \-\-list prints a list of all sandboxes. The format
 for each process entry is as follows:
@@ -2807,34 +2784,48 @@ adduser \-\-shell /usr/bin/firejail username
 
 Additional arguments passed to firejail executable upon login are declared in /etc/firejail/login.users file.
 
-.SH EXAMPLES
-.TP
-\f\firejail
-Sandbox a regular /bin/bash session.
-.TP
-\f\firejail firefox
-Start Mozilla Firefox.
-.TP
-\f\firejail \-\-debug firefox
-Debug Firefox sandbox.
-.TP
-\f\firejail \-\-private firefox
-Start Firefox with a new, empty home directory.
-.TP
-\f\firejail --net=none vlc
-Start VLC in an unconnected network namespace.
-.TP
-\f\firejail \-\-net=eth0 firefox
-Start Firefox in a new network namespace. An IP address is
-assigned automatically.
-.TP
-\f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2
-Start a /bin/bash session in a new network namespace and connect it
-to br0, br1, and br2 host bridge devices. IP addresses are assigned
-automatically for the interfaces connected to br1 and b2
-.TP
-\f\firejail \-\-list
-List all sandboxed processes.
+.SH TRAFFIC SHAPING
+Network bandwidth is an expensive resource shared among all sandboxes running on a system.
+Traffic shaping allows the user to increase network performance by controlling
+the amount of data that flows into and out of the sandboxes.
+
+Firejail implements a simple rate-limiting shaper based on Linux command tc.
+The shaper works at sandbox level, and can be used only for sandboxes configured with new network namespaces.
+
+Set rate-limits:
+
+        $ firejail --bandwidth=name|pid set network download upload
+
+Clear rate-limits:
+
+        $ firejail --bandwidth=name|pid clear network
+
+Status:
+
+        $ firejail --bandwidth=name|pid status
+
+where:
+.br
+        name - sandbox name
+.br
+        pid - sandbox pid
+.br
+        network - network interface as used by \-\-net option
+.br
+        download - download speed in KB/s (kilobyte per second)
+.br
+        upload - upload speed in KB/s (kilobyte per second)
+
+Example:
+.br
+        $ firejail \-\-name=mybrowser \-\-net=eth0 firefox &
+.br
+        $ firejail \-\-bandwidth=mybrowser set eth0 80 20
+.br
+        $ firejail \-\-bandwidth=mybrowser status
+.br
+        $ firejail \-\-bandwidth=mybrowser clear eth0
+
 .SH LICENSE
 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
 .PP