9 files changed, 64 insertions, 65 deletions

diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 68ef5e5d1..bfba93190 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -412,6 +412,7 @@ telegram-desktop
 terasology
 thunderbird
 thunderbird-beta
+thunderbird-wayland
 tilp
 tor-browser-ar
 tor-browser-en
diff --git a/src/firejail/env.c b/src/firejail/env.c
index a09be8a77..fd4bfbd57 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -132,6 +132,10 @@ void env_defaults(void) {
         if (cfg.shell && setenv("SHELL", cfg.shell, 1) < 0)
                 errExit("setenv");
 
+        // spawn KIO slaves inside the sandbox
+        if (setenv("KDE_FORK_SLAVES", "1", 1) < 0)
+                errExit("setenv");
+
         // set prompt color to green
         int set_prompt = 0;
         if (checkcfg(CFG_FIREJAIL_PROMPT))
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index a4aa20667..c0072debe 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -540,6 +540,7 @@ uid_t pid_get_uid(pid_t pid);
 uid_t get_group_id(const char *group);
 int remove_overlay_directory(void);
 void flush_stdin(void);
+void create_empty_dir_as_user(const char *dir, mode_t mode);
 void create_empty_dir_as_root(const char *dir, mode_t mode);
 void create_empty_file_as_root(const char *dir, mode_t mode);
 int set_perms(const char *fname, uid_t uid, gid_t gid, mode_t mode);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 49074f525..c689a49fa 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -767,26 +767,7 @@ void fs_proc_sys_dev_boot(void) {
                         char *fnamegpg;
                         if (asprintf(&fnamegpg, "/run/user/%d/gnupg", getuid()) == -1)
                                 errExit("asprintf");
-                        if (stat(fnamegpg, &s) == -1) {
-                                pid_t child = fork();
-                                if (child < 0)
-                                        errExit("fork");
-                                if (child == 0) {
-                                        // drop privileges
-                                        drop_privs(0);
-                                        if (mkdir(fnamegpg, 0700) == 0) {
-                                                if (chmod(fnamegpg, 0700) == -1)
-                                                        {;} // do nothing
-                                        }
-#ifdef HAVE_GCOV
-                                        __gcov_flush();
-#endif
-                                        _exit(0);
-                                }
-                                // wait for the child to finish
-                                waitpid(child, NULL, 0);
-                                fs_logger2("create", fnamegpg);
-                        }
+                        create_empty_dir_as_user(fnamegpg, 0700);
                         if (stat(fnamegpg, &s) == 0)
                                 disable_file(BLACKLIST_FILE, fnamegpg);
                         free(fnamegpg);
@@ -795,26 +776,7 @@ void fs_proc_sys_dev_boot(void) {
                         char *fnamesysd;
                         if (asprintf(&fnamesysd, "/run/user/%d/systemd", getuid()) == -1)
                                 errExit("asprintf");
-                        if (stat(fnamesysd, &s) == -1) {
-                                pid_t child = fork();
-                                if (child < 0)
-                                        errExit("fork");
-                                if (child == 0) {
-                                        // drop privileges
-                                        drop_privs(0);
-                                        if (mkdir(fnamesysd, 0755) == 0) {
-                                                if (chmod(fnamesysd, 0755) == -1)
-                                                        {;} // do nothing
-                                        }
-#ifdef HAVE_GCOV
-                                        __gcov_flush();
-#endif
-                                        _exit(0);
-                                }
-                                // wait for the child to finish
-                                waitpid(child, NULL, 0);
-                                fs_logger2("create", fnamesysd);
-                        }
+                        create_empty_dir_as_user(fnamesysd, 0755);
                         if (stat(fnamesysd, &s) == 0)
                                 disable_file(BLACKLIST_FILE, fnamesysd);
                         free(fnamesysd);
@@ -924,31 +886,11 @@ char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
         }
         else {
                 // create ~/.firejail directory
-                pid_t child = fork();
-                if (child < 0)
-                        errExit("fork");
-                if (child == 0) {
-                        // drop privileges
-                        drop_privs(0);
-
-                        // create directory
-                        if (mkdir(dirname, 0700))
-                                errExit("mkdir");
-                        if (chmod(dirname, 0700) == -1)
-                                errExit("chmod");
-                        ASSERT_PERMS(dirname, getuid(), getgid(), 0700);
-#ifdef HAVE_GCOV
-                        __gcov_flush();
-#endif
-                        _exit(0);
-                }
-                // wait for the child to finish
-                waitpid(child, NULL, 0);
+                create_empty_dir_as_user(dirname, 0700);
                 if (stat(dirname, &s) == -1) {
-                        fprintf(stderr, "Error: cannot create ~/.firejail directory\n");
+                        fprintf(stderr, "Error: cannot create directory %s\n", dirname);
                         exit(1);
                 }
-                fs_logger2("create", dirname);
         }
         free(dirname);
 
diff --git a/src/firejail/macros.c b/src/firejail/macros.c
index 59b5db3d8..7e08ab340 100644
--- a/src/firejail/macros.c
+++ b/src/firejail/macros.c
@@ -229,6 +229,13 @@ char *expand_macros(const char *path) {
                         EUID_ROOT();
                 return new_name;
         }
+        else if (strncmp(path, "${RUNUSER}", 10) == 0) {
+                if (asprintf(&new_name, "/run/user/%u%s", getuid(), path + 10) == -1)
+                        errExit("asprintf");
+                if(called_as_root)
+                        EUID_ROOT();
+                return new_name;
+        }
         else {
                 char *directory = resolve_macro(path);
                 if (directory) {
@@ -260,6 +267,8 @@ void invalid_filename(const char *fname, int globbing) {
                 ptr = fname + 7;
         else if (strncmp(ptr, "${PATH}", 7) == 0)
                 ptr = fname + 7;
+        else if (strncmp(ptr, "${RUNUSER}", 10) == 0)
+                ptr = fname + 10;
         else {
                 int id = macro_id(fname);
                 if (id != -1)
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 5f5d94ddf..a6d619f38 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -141,6 +141,7 @@ int profile_check_conditional(char *ptr, int lineno, const char *fname) {
                 bool value;     // true if set
         } conditionals[] = {
                 {"HAS_APPIMAGE", strlen("HAS_APPIMAGE"), arg_appimage!=0},
+                {"HAS_NODBUS", strlen("HAS_NODBUS"), arg_nodbus!=0},
                 {"BROWSER_DISABLE_U2F", strlen("BROWSER_DISABLE_U2F"), checkcfg(CFG_BROWSER_DISABLE_U2F)!=0},
                 NULL
         }, *cond = conditionals;
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 47b237911..9af41ffe2 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -961,6 +961,42 @@ void flush_stdin(void) {
         }
 }
 
+void create_empty_dir_as_user(const char *dir, mode_t mode) {
+        assert(dir);
+        mode &= 07777;
+        struct stat s;
+
+        if (stat(dir, &s)) {
+                if (arg_debug)
+                        printf("Creating empty %s directory\n", dir);
+                pid_t child = fork();
+                if (child < 0)
+                        errExit("fork");
+                if (child == 0) {
+                        // drop privileges
+                        drop_privs(0);
+
+                        if (mkdir(dir, mode) == 0) {
+                                if (chmod(dir, mode) == -1)
+                                        {;} // do nothing
+                        }
+                        else if (errno != EEXIST && arg_debug) {
+                                char *str;
+                                if (asprintf(&str, "Directory %s not created", dir) == -1)
+                                        errExit("asprintf");
+                                perror(str);
+                        }
+#ifdef HAVE_GCOV
+                        __gcov_flush();
+#endif
+                        _exit(0);
+                }
+                waitpid(child, NULL, 0);
+                if (stat(dir, &s) == 0)
+                        fs_logger2("create", dir);
+        }
+}
+
 void create_empty_dir_as_root(const char *dir, mode_t mode) {
         assert(dir);
         mode &= 07777;
@@ -1262,4 +1298,4 @@ void enter_network_namespace(pid_t pid) {
                 fprintf(stderr, "Error: cannot join the network namespace\n");
                 exit(1);
         }
-}
\ No newline at end of file
+}
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index c30ab5956..a59ee3ffb 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -1171,8 +1171,13 @@ void x11_xorg(void) {
         char *dest;
         if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
-        if (lstat(dest, &s) == -1)
+        if (lstat(dest, &s) == -1) {
                 touch_file_as_user(dest, 0600);
+                if (stat(dest, &s) == -1) {
+                        fprintf(stderr, "Error: cannot create %s\n", dest);
+                        exit(1);
+                }
+        }
 
         // get a file descriptor for .Xauthority
         fd = safe_fd(dest, O_PATH|O_NOFOLLOW|O_CLOEXEC);
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 4e22796c9..dde815d05 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -94,7 +94,7 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir"
 
 This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line.
 
-Currently the only conditionals supported are HAS_APPIMAGE and BROWSER_DISABLE_U2F.
+Currently the only conditionals supported are HAS_APPIMAGE, HAS_NODBUS and BROWSER_DISABLE_U2F.
 
 The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines.