51 files changed, 550 insertions, 320 deletions

diff --git a/src/fbuilder/build_bin.c b/src/fbuilder/build_bin.c
index 96bd351f3..9577042c4 100644
--- a/src/fbuilder/build_bin.c
+++ b/src/fbuilder/build_bin.c
@@ -83,11 +83,9 @@ static void process_bin(const char *fname) {
                         continue;
                 *ptr2 = '\0';
 
-                // skip strace
-                if (strcmp(ptr, "strace") == 0)
-                        continue;
-
-                bin_out = filedb_add(bin_out, ptr);
+                // skip strace and firejail (in case we hit a symlink in /usr/local/bin)
+                if (strcmp(ptr, "strace") && strcmp(ptr, "firejail"))
+                        bin_out = filedb_add(bin_out, ptr);
         }
 
         fclose(fp);
@@ -121,6 +119,5 @@ void build_bin(const char *fname, FILE *fp) {
                         ptr = ptr->next;
                 }
                 fprintf(fp, "\n");
-                fprintf(fp, "# private-lib\n");
         }
 }
diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c
index 495f71ab8..8700e0ba1 100644
--- a/src/fbuilder/build_fs.c
+++ b/src/fbuilder/build_fs.c
@@ -146,31 +146,49 @@ void build_etc(const char *fname, FILE *fp) {
 //*******************************************
 // var directory
 //*******************************************
+#if 0
+// todo: load the list from whitelist-var-common.inc
+static char *var_skip[] = {
+        "/var/lib/ca-certificates",
+        "/var/lib/dbus",
+        "/var/lib/menu-xdg",
+        "/var/lib/uim",
+        "/var/cache/fontconfig",
+        "/var/tmp",
+        "/var/run",
+        "/var/lock",
+        NULL
+};
+#endif
 static FileDB *var_out = NULL;
+static FileDB *var_skip = NULL;
 static void var_callback(char *ptr) {
-        if (strcmp(ptr, "/var/lib") == 0)
-                ;
-        else if (strcmp(ptr, "/var/cache") == 0)
-                ;
-        else if (strncmp(ptr, "/var/lib/menu-xdg", 17) == 0)
-                var_out = filedb_add(var_out, "/var/lib/menu-xdg");
-        else if (strncmp(ptr, "/var/cache/fontconfig", 21) == 0)
-                var_out = filedb_add(var_out, "/var/cache/fontconfig");
-        else
-                var_out = filedb_add(var_out, ptr);
+        // extract the directory:
+        assert(strncmp(ptr, "/var", 4) == 0);
+        char *p1 = ptr + 4;
+        if (*p1 != '/')
+                return;
+        p1++;
+
+        if (*p1 == '/') // double '/'
+                p1++;
+        if (*p1 == '\0')
+                return;
+
+        if (!filedb_find(var_skip, p1))
+                var_out = filedb_add(var_out, p1);
 }
 
 void build_var(const char *fname, FILE *fp) {
         assert(fname);
 
+        var_skip = filedb_load_whitelist(var_skip, "whitelist-var-common.inc", "whitelist /var/");
         process_files(fname, "/var", var_callback);
 
-        if (var_out == NULL) {
-                fprintf(fp, "blacklist /var\n");
-        } else {
-                filedb_print(var_out, "whitelist ", fp);
-                fprintf(fp, "include whitelist-var-common.inc\n");
-        }
+        // always whitelist /var
+        if (var_out)
+                filedb_print(var_out, "whitelist /var/", fp);
+        fprintf(fp, "include whitelist-var-common.inc\n");
 }
 
 
@@ -178,6 +196,7 @@ void build_var(const char *fname, FILE *fp) {
 // usr/share directory
 //*******************************************
 static FileDB *share_out = NULL;
+static FileDB *share_skip = NULL;
 static void share_callback(char *ptr) {
         // extract the directory:
         assert(strncmp(ptr, "/usr/share", 10) == 0);
@@ -195,21 +214,21 @@ static void share_callback(char *ptr) {
         if (p2)
                 *p2 = '\0';
 
-        // store the file
-        share_out = filedb_add(share_out, ptr);
+
+        if (!filedb_find(share_skip, p1))
+                share_out = filedb_add(share_out, p1);
 }
 
 void build_share(const char *fname, FILE *fp) {
         assert(fname);
 
+        share_skip = filedb_load_whitelist(share_skip, "whitelist-usr-share-common.inc", "whitelist /usr/share/");
         process_files(fname, "/usr/share", share_callback);
 
-        if (share_out == NULL) {
-                fprintf(fp, "blacklist /usr/share\n");
-        } else {
-                filedb_print(share_out, "whitelist ", fp);
-                fprintf(fp, "include whitelist-usr-share-common.inc\n");
-        }
+        // always whitelist /usr/share
+        if (share_out)
+                filedb_print(share_out, "whitelist /usr/share/", fp);
+        fprintf(fp, "include whitelist-usr-share-common.inc\n");
 }
 
 //*******************************************
@@ -220,6 +239,10 @@ static void tmp_callback(char *ptr) {
         // skip strace file
         if (strncmp(ptr, "/tmp/firejail-strace", 20) == 0)
                 return;
+        if (strncmp(ptr, "/tmp/runtime-", 13) == 0)
+                return;
+        if (strcmp(ptr, "/tmp") == 0)
+                return;
 
         tmp_out = filedb_add(tmp_out, ptr);
 }
@@ -232,8 +255,7 @@ void build_tmp(const char *fname, FILE *fp) {
         if (tmp_out == NULL)
                 fprintf(fp, "private-tmp\n");
         else {
-                fprintf(fp, "\n");
-                fprintf(fp, "# private-tmp\n");
+                fprintf(fp, "#private-tmp\n");
                 fprintf(fp, "# File accessed in /tmp directory:\n");
                 fprintf(fp, "# ");
                 FileDB *ptr = tmp_out;
@@ -249,40 +271,37 @@ void build_tmp(const char *fname, FILE *fp) {
 // dev directory
 //*******************************************
 static char *dev_skip[] = {
+        "/dev/stdin",
+        "/dev/stdout",
+        "/dev/stderr",
         "/dev/zero",
         "/dev/null",
         "/dev/full",
         "/dev/random",
+        "/dev/srandom",
         "/dev/urandom",
+        "/dev/sr0",
+        "/dev/cdrom",
+        "/dev/cdrw",
+        "/dev/dvd",
+        "/dev/dvdrw",
+        "/dev/fd",
+        "/dev/pts",
+        "/dev/ptmx",
+        "/dev/log",
+
+        "/dev/aload",   // old ALSA devices, not covered in private-dev
+        "/dev/dsp",             // old OSS device, deprecated
+
         "/dev/tty",
         "/dev/snd",
         "/dev/dri",
-        "/dev/pts",
-        "/dev/nvidia0",
-        "/dev/nvidia1",
-        "/dev/nvidia2",
-        "/dev/nvidia3",
-        "/dev/nvidia4",
-        "/dev/nvidia5",
-        "/dev/nvidia6",
-        "/dev/nvidia7",
-        "/dev/nvidia8",
-        "/dev/nvidia9",
-        "/dev/nvidiactl",
-        "/dev/nvidia-modeset",
-        "/dev/nvidia-uvm",
-        "/dev/video0",
-        "/dev/video1",
-        "/dev/video2",
-        "/dev/video3",
-        "/dev/video4",
-        "/dev/video5",
-        "/dev/video6",
-        "/dev/video7",
-        "/dev/video8",
-        "/dev/video9",
+        "/dev/nvidia",
+        "/dev/video",
         "/dev/dvb",
-        "/dev/sr0",
+        "/dev/hidraw",
+        "/dev/usb",
+        "/dev/input",
         NULL
 };
 
@@ -292,7 +311,7 @@ static void dev_callback(char *ptr) {
         int i = 0;
         int found = 0;
         while (dev_skip[i]) {
-                if (strcmp(ptr, dev_skip[i]) == 0) {
+                if (strncmp(ptr, dev_skip[i], strlen(dev_skip[i])) == 0) {
                         found = 1;
                         break;
                 }
@@ -310,9 +329,8 @@ void build_dev(const char *fname, FILE *fp) {
         if (dev_out == NULL)
                 fprintf(fp, "private-dev\n");
         else {
-                fprintf(fp, "\n");
-                fprintf(fp, "# private-dev\n");
-                fprintf(fp, "# This is the list of devices accessed (on top of regular private-dev devices:\n");
+                fprintf(fp, "#private-dev\n");
+                fprintf(fp, "# This is the list of devices accessed on top of regular private-dev devices:\n");
                 fprintf(fp, "# ");
                 FileDB *ptr = dev_out;
                 while (ptr) {
diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c
index 683009b71..b3ec6cffd 100644
--- a/src/fbuilder/build_home.c
+++ b/src/fbuilder/build_home.c
@@ -23,30 +23,6 @@
 static FileDB *db_skip = NULL;
 static FileDB *db_out = NULL;
 
-static void load_whitelist_common(void) {
-        FILE *fp = fopen(SYSCONFDIR "/whitelist-common.inc", "r");
-        if (!fp) {
-                fprintf(stderr, "Error: cannot open whitelist-common.inc\n");
-                exit(1);
-        }
-
-        char buf[MAX_BUF];
-        while (fgets(buf, MAX_BUF, fp)) {
-                if (strncmp(buf, "whitelist ${HOME}/", 18) != 0)
-                        continue;
-                char *fn = buf + 18;
-                char *ptr = strchr(buf, '\n');
-                if (!ptr)
-                        continue;
-                *ptr = '\0';
-
-                // add the file to skip list
-                db_skip = filedb_add(db_skip, fn);
-        }
-
-        fclose(fp);
-}
-
 void process_home(const char *fname, char *home, int home_len) {
         assert(fname);
         assert(home);
@@ -141,7 +117,7 @@ void process_home(const char *fname, char *home, int home_len) {
                 }
 
                 // skip files and directories in whitelist-common.inc
-                if (filedb_find(db_skip, toadd)) {
+                if (strlen(toadd) == 0 || filedb_find(db_skip, toadd)) {
                         if (dir)
                                 free(dir);
                         continue;
@@ -162,7 +138,7 @@ void build_home(const char *fname, FILE *fp) {
         assert(fname);
 
         // load whitelist common
-        load_whitelist_common();
+        db_skip = filedb_load_whitelist(db_skip, "whitelist-common.inc", "whitelist ${HOME}/");
 
         // find user home directory
         struct passwd *pw = getpwuid(getuid());
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index 96a83954d..1726b4dbb 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -141,6 +141,12 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
                 if (fp == stdout)
                         printf("--- Built profile beings after this line ---\n");
+                fprintf(fp, "# Save this file as \"application.profile\" (change \"application\" with the\n");
+                fprintf(fp, "# program name) in ~/.config/firejail directory. Firejail will find it\n");
+                fprintf(fp, "# automatically every time you sandbox your application.\n#\n");
+                fprintf(fp, "# Run \"firejail application\" to test it. In the file there are\n");
+                fprintf(fp, "# some other commands you can try. Enable them by removing the \"#\".\n\n");
+
                 fprintf(fp, "# Firejail profile for %s\n", argv[index]);
                 fprintf(fp, "# Persistent local customizations\n");
                 fprintf(fp, "#include %s.local\n", argv[index]);
@@ -148,56 +154,69 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
                 fprintf(fp, "#include globals.local\n");
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### basic blacklisting\n");
+                fprintf(fp, "### Basic Blacklisting ###\n");
+                fprintf(fp, "### Enable as many of them as you can! A very important one is\n");
+                fprintf(fp, "### \"disable-exec.inc\". This will make among other things your home\n");
+                fprintf(fp, "### and /tmp directories non-executable.\n");
                 fprintf(fp, "include disable-common.inc\n");
-                fprintf(fp, "# include disable-devel.inc\n");
-                fprintf(fp, "# include disable-exec.inc\n");
-                fprintf(fp, "# include disable-interpreters.inc\n");
+                fprintf(fp, "#include disable-devel.inc\n");
+                fprintf(fp, "#include disable-exec.inc\n");
+                fprintf(fp, "#include disable-interpreters.inc\n");
                 fprintf(fp, "include disable-passwdmgr.inc\n");
-                fprintf(fp, "# include disable-programs.inc\n");
-                fprintf(fp, "# include disable-xdg.inc\n");
+                fprintf(fp, "include disable-programs.inc\n");
+                fprintf(fp, "#include disable-shell.inc\n");
+                fprintf(fp, "#include disable-xdg.inc\n");
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### home directory whitelisting\n");
+                fprintf(fp, "### Home Directory Whitelisting ###\n");
+                fprintf(fp, "### If something goes wrong, this section is the first one to comment out.\n");
+                fprintf(fp, "### Instead, you'll have to relay on the basic blacklisting above.\n");
                 build_home(trace_output, fp);
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### filesystem\n");
-                fprintf(fp, "# /usr/share:\n");
+                fprintf(fp, "### Filesystem Whitelisting ###\n");
                 build_share(trace_output, fp);
-                fprintf(fp, "# /var:\n");
+                //todo: include whitelist-runuser-common.inc
                 build_var(trace_output, fp);
                 fprintf(fp, "\n");
-                fprintf(fp, "# $PATH:\n");
-                build_bin(trace_output, fp);
-                fprintf(fp, "# /dev:\n");
-                build_dev(trace_output, fp);
-                fprintf(fp, "# /etc:\n");
-                build_etc(trace_output, fp);
-                fprintf(fp, "# /tmp:\n");
-                build_tmp(trace_output, fp);
-                fprintf(fp, "\n");
 
-                fprintf(fp, "### security filters\n");
+                fprintf(fp, "#apparmor\n");
                 fprintf(fp, "caps.drop all\n");
+                fprintf(fp, "ipc-namespace\n");
+                fprintf(fp, "netfilter\n");
+                fprintf(fp, "#nodvd\n");
+                fprintf(fp, "#nogroups\n");
+                fprintf(fp, "#noinput\n");
                 fprintf(fp, "nonewprivs\n");
+                fprintf(fp, "noroot\n");
+                fprintf(fp, "#notv\n");
+                fprintf(fp, "#nou2f\n");
+                fprintf(fp, "#novideo\n");
+                build_protocol(trace_output, fp);
                 fprintf(fp, "seccomp\n");
                 if (!have_strace) {
-                        fprintf(fp, "# If you install strace on your system, Firejail will also create a\n");
-                        fprintf(fp, "# whitelisted seccomp filter.\n");
+                        fprintf(fp, "### If you install strace on your system, Firejail will also create a\n");
+                        fprintf(fp, "### whitelisted seccomp filter.\n");
                 }
                 else if (!have_yama_permission)
-                        fprintf(fp, "# Yama security module prevents creation of a whitelisted seccomp filter\n");
+                        fprintf(fp, "### Yama security module prevents creation of a whitelisted seccomp filter\n");
                 else
                         build_seccomp(strace_output, fp);
+                fprintf(fp, "shell none\n");
+                fprintf(fp, "#tracelog\n");
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### network\n");
-                build_protocol(trace_output, fp);
+                fprintf(fp, "#disable-mnt\n");
+                build_bin(trace_output, fp);
+                fprintf(fp, "#private-lib\n");
+                build_dev(trace_output, fp);
+                build_etc(trace_output, fp);
+                build_tmp(trace_output, fp);
                 fprintf(fp, "\n");
 
-                fprintf(fp, "### environment\n");
-                fprintf(fp, "shell none\n");
+                fprintf(fp, "#dbus-user none\n");
+                fprintf(fp, "#dbus-system none\n");
+                fprintf(fp, "#memory-deny-write-execute\n");
 
                 if (!arg_debug) {
                         unlink(trace_output);
diff --git a/src/fbuilder/fbuilder.h b/src/fbuilder/fbuilder.h
index 8d3621c02..08dd35e10 100644
--- a/src/fbuilder/fbuilder.h
+++ b/src/fbuilder/fbuilder.h
@@ -66,5 +66,6 @@ typedef struct filedb_t {
 FileDB *filedb_add(FileDB *head, const char *fname);
 FileDB *filedb_find(FileDB *head, const char *fname);
 void filedb_print(FileDB *head, const char *prefix, FILE *fp);
+FileDB *filedb_load_whitelist(FileDB *head, const char *fname, const char *prefix);
 
 #endif
diff --git a/src/fbuilder/filedb.c b/src/fbuilder/filedb.c
index 6e302a606..94a226cb7 100644
--- a/src/fbuilder/filedb.c
+++ b/src/fbuilder/filedb.c
@@ -20,7 +20,9 @@
 
 #include "fbuilder.h"
 
+// find exact name or an exact name in a parent directory
 FileDB *filedb_find(FileDB *head, const char *fname) {
+        assert(fname);
         FileDB *ptr = head;
         int found = 0;
         int len = strlen(fname);
@@ -52,6 +54,8 @@ FileDB *filedb_find(FileDB *head, const char *fname) {
 FileDB *filedb_add(FileDB *head, const char *fname) {
         assert(fname);
 
+        // todo: support fnames such as ${RUNUSER}/.mutter-Xwaylandauth.*
+
         // don't add it if it is already there or if the parent directory is already in the list
         if (filedb_find(head, fname))
                 return head;
@@ -70,9 +74,52 @@ FileDB *filedb_add(FileDB *head, const char *fname) {
 };
 
 void filedb_print(FileDB *head, const char *prefix, FILE *fp) {
+        assert(head);
+        assert(prefix);
+
         FileDB *ptr = head;
         while (ptr) {
-                fprintf(fp, "%s%s\n", prefix, ptr->fname);
+                if (fp)
+                        fprintf(fp, "%s%s\n", prefix, ptr->fname);
+                else
+                        printf("%s%s\n", prefix, ptr->fname);
                 ptr = ptr->next;
         }
 }
+
+FileDB *filedb_load_whitelist(FileDB *head, const char *fname, const char *prefix) {
+        assert(fname);
+        assert(prefix);
+        int len = strlen(prefix);
+        char *f;
+        if (asprintf(&f, "%s/%s", SYSCONFDIR, fname) == -1)
+                errExit("asprintf");
+        FILE *fp = fopen(f, "r");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot open whitelist-common.inc\n");
+                free(f);
+                exit(1);
+        }
+
+        char buf[MAX_BUF];
+        while (fgets(buf, MAX_BUF, fp)) {
+                if (strncmp(buf, prefix, len) != 0)
+                        continue;
+
+                char *fn = buf + len;
+                char *ptr = strchr(buf, '\n');
+                if (!ptr)
+                        continue;
+                *ptr = '\0';
+
+                // add the file to skip list
+                head = filedb_add(head, fn);
+        }
+
+        fclose(fp);
+        free(f);
+//printf("***************************************************\n");
+//filedb_print(head, prefix, NULL);
+//printf("***************************************************\n");
+        return head;
+}
diff --git a/src/fbuilder/main.c b/src/fbuilder/main.c
index f4917aefc..35ec49519 100644
--- a/src/fbuilder/main.c
+++ b/src/fbuilder/main.c
@@ -58,10 +58,16 @@ printf("\n");
                                 exit(1);
                         }
 
+                        // don't run if the file exists
+                        if (access(argv[i] + 8, F_OK) == 0) {
+                                fprintf(stderr, "Error: the profile file already exists. Please use a different file name.\n");
+                                exit(1);
+                        }
+
                         // check file access
                         fp = fopen(argv[i] + 8, "w");
                         if (!fp) {
-                                fprintf(stderr, "Error fbuild: cannot open profile file.\n");
+                                fprintf(stderr, "Error: cannot open profile file.\n");
                                 exit(1);
                         }
                         prof_file = 1;
@@ -69,7 +75,7 @@ printf("\n");
                 }
                 else {
                         if (*argv[i] == '-') {
-                                fprintf(stderr, "Error fbuilder: invalid program\n");
+                                fprintf(stderr, "Error: invalid program\n");
                                 usage();
                                 exit(1);
                         }
@@ -79,7 +85,7 @@ printf("\n");
         }
 
         if (prog_index == 0) {
-                fprintf(stderr, "Error fbuilder: program and arguments required\n");
+                fprintf(stderr, "Error : program and arguments required\n");
                 usage();
                 if (prof_file)
                         fclose(fp);
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index be50d5f44..474904ebf 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -74,6 +74,7 @@ autokey-run
 autokey-shell
 avidemux3_qt5
 aweather
+ballbuster
 baloo_file
 baloo_filemetadata_temp_extractor
 balsa
@@ -147,6 +148,7 @@ cmus
 code
 code-oss
 cola
+colorful
 com.github.bleakgrey.tootle
 com.github.dahenson.agenda
 com.github.johnfactotum.Foliate
@@ -236,6 +238,7 @@ ffplay
 ffprobe
 file-roller
 filezilla
+firedragon
 firefox
 firefox-beta
 firefox-developer-edition
@@ -293,6 +296,8 @@ git-cola
 github-desktop
 gitter
 # gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102
+gl-117
+glaxium
 globaltime
 gmpc
 gnome-2048
@@ -550,6 +555,7 @@ mypaint
 mypaint-ora-thumbnailer
 natron
 ncdu
+neochat
 neomutt
 netactview
 nethack
@@ -615,6 +621,7 @@ penguin-command
 photoflare
 picard
 pidgin
+pinball
 #ping - disabled until we fix  #1912
 pingus
 pinta
@@ -673,7 +680,6 @@ runenpass.sh
 sayonara
 scallion
 scorched3d
-scorched3d-wrapper
 scorchwentbonkers
 scribus
 sdat2img
@@ -867,7 +873,6 @@ xmr-stak
 xonotic
 xonotic-glx
 xonotic-sdl
-xonotic-sdl-wrapper
 xournal
 xournalpp
 xpdf
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 59758bf2d..6b9fed765 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -67,7 +67,7 @@ void appimage_set(const char *appimage) {
 
         // find or allocate a free loop device to use
         EUID_ROOT();
-        int cfd = open("/dev/loop-control", O_RDWR);
+        int cfd = open("/dev/loop-control", O_RDWR|O_CLOEXEC);
         if (cfd == -1)
                 err_loop();
         int devnr = ioctl(cfd, LOOP_CTL_GET_FREE);
@@ -78,7 +78,7 @@ void appimage_set(const char *appimage) {
                 errExit("asprintf");
 
         // associate loop device with appimage
-        int lfd = open(devloop, O_RDONLY);
+        int lfd = open(devloop, O_RDONLY|O_CLOEXEC);
         if (lfd == -1)
                 err_loop();
         if (ioctl(lfd, LOOP_SET_FD, ffd) == -1)
@@ -146,7 +146,7 @@ void appimage_mount(void) {
 void appimage_clear(void) {
         EUID_ROOT();
         if (devloop) {
-                int lfd = open(devloop, O_RDONLY);
+                int lfd = open(devloop, O_RDONLY|O_CLOEXEC);
                 if (lfd != -1) {
                         if (ioctl(lfd, LOOP_CLR_FD, 0) != -1)
                                 fmessage("AppImage detached\n");
diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c
index 1c952c0bc..a085f2c27 100644
--- a/src/firejail/bandwidth.c
+++ b/src/firejail/bandwidth.c
@@ -22,6 +22,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
+#include <errno.h>
 #include <net/if.h>
 #include "firejail.h"
 
@@ -119,26 +120,19 @@ static void bandwidth_create_run_file(pid_t pid) {
         if (asprintf(&fname, "%s/%d-bandwidth", RUN_FIREJAIL_BANDWIDTH_DIR, (int) pid) == -1)
                 errExit("asprintf");
 
-        // if the file already exists, do nothing
-        struct stat s;
-        if (stat(fname, &s) == 0) {
-                free(fname);
-                return;
-        }
-
         // create an empty file and set mod and ownership
-        /* coverity[toctou] */
-        FILE *fp = fopen(fname, "w");
-        if (fp) {
-                SET_PERMS_STREAM(fp, 0, 0, 0644);
-                fclose(fp);
-        }
-        else {
+        // if the file already exists, do nothing
+        FILE *fp = fopen(fname, "wxe");
+        free(fname);
+        if (!fp) {
+                if (errno == EEXIST)
+                        return;
                 fprintf(stderr, "Error: cannot create bandwidth file\n");
                 exit(1);
         }
 
-        free(fname);
+        SET_PERMS_STREAM(fp, 0, 0, 0644);
+        fclose(fp);
 }
 
 
@@ -148,7 +142,7 @@ void network_set_run_file(pid_t pid) {
                 errExit("asprintf");
 
         // create an empty file and set mod and ownership
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (fp) {
                 if (cfg.bridge0.configured)
                         fprintf(fp, "%s:%s\n", cfg.bridge0.dev, cfg.bridge0.devsandbox);
@@ -178,7 +172,7 @@ static void read_bandwidth_file(pid_t pid) {
         if (asprintf(&fname, "%s/%d-bandwidth", RUN_FIREJAIL_BANDWIDTH_DIR, (int) pid) == -1)
                 errExit("asprintf");
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp) {
                 char buf[1024];
                 while (fgets(buf, 1024,fp)) {
@@ -214,7 +208,7 @@ static void write_bandwidth_file(pid_t pid) {
         if (asprintf(&fname, "%s/%d-bandwidth", RUN_FIREJAIL_BANDWIDTH_DIR, (int) pid) == -1)
                 errExit("asprintf");
 
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (fp) {
                 IFBW *ptr = ifbw;
                 while (ptr) {
@@ -307,7 +301,7 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
                 char *fname;
                 if (asprintf(&fname, "%s/%d-netmap", RUN_FIREJAIL_NETWORK_DIR, (int) pid) == -1)
                         errExit("asprintf");
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 if (!fp) {
                         fprintf(stderr, "Error: cannot read network map file %s\n", fname);
                         exit(1);
diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index 597f9915b..5e02b99c2 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -389,7 +389,7 @@ static uint64_t extract_caps(int pid) {
                 errExit("asprintf");
 
         EUID_ROOT();    // grsecurity
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         EUID_USER();    // grsecurity
         if (!fp)
                 goto errexit;
diff --git a/src/firejail/cgroup.c b/src/firejail/cgroup.c
index 986b1157d..e7ffbca36 100644
--- a/src/firejail/cgroup.c
+++ b/src/firejail/cgroup.c
@@ -26,7 +26,7 @@ void save_cgroup(void) {
         if (cfg.cgroup == NULL)
                 return;
 
-        FILE *fp = fopen(RUN_CGROUP_CFG, "w");
+        FILE *fp = fopen(RUN_CGROUP_CFG, "wxe");
         if (fp) {
                 fprintf(fp, "%s", cfg.cgroup);
                 fflush(0);
@@ -48,7 +48,7 @@ void load_cgroup(const char *fname) {
         if (!fname)
                 return;
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp) {
                 char buf[MAXBUF];
                 if (fgets(buf, MAXBUF, fp)) {
@@ -91,19 +91,19 @@ void set_cgroup(const char *path) {
                 goto errout;
 
         // tasks file exists
-        struct stat s;
-        if (stat(path, &s) == -1)
+        FILE *fp = fopen(path, "ae");
+        if (!fp)
                 goto errout;
-
         // task file belongs to the user running the sandbox
+        int fd = fileno(fp);
+        if (fd == -1)
+                errExit("fileno");
+        struct stat s;
+        if (fstat(fd, &s) == -1)
+                errExit("fstat");
         if (s.st_uid != getuid() && s.st_gid != getgid())
                 goto errout2;
-
         // add the task to cgroup
-        /* coverity[toctou] */
-        FILE *fp = fopen(path,  "a");
-        if (!fp)
-                goto errout;
         pid_t pid = getpid();
         int rv = fprintf(fp, "%d\n", pid);
         (void) rv;
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index 8a6e47e17..614b144e5 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -60,7 +60,7 @@ int checkcfg(int val) {
 
                 // open configuration file
                 const char *fname = SYSCONFDIR "/firejail.config";
-                fp = fopen(fname, "r");
+                fp = fopen(fname, "re");
                 if (!fp) {
 #ifdef HAVE_GLOBALCFG
                         fprintf(stderr, "Error: Firejail configuration file %s not found\n", fname);
diff --git a/src/firejail/cpu.c b/src/firejail/cpu.c
index 3427e8ade..fe7258fb0 100644
--- a/src/firejail/cpu.c
+++ b/src/firejail/cpu.c
@@ -75,7 +75,7 @@ void save_cpu(void) {
         if (cfg.cpus == 0)
                 return;
 
-        FILE *fp = fopen(RUN_CPU_CFG, "w");
+        FILE *fp = fopen(RUN_CPU_CFG, "wxe");
         if (fp) {
                 fprintf(fp, "%x\n", cfg.cpus);
                 SET_PERMS_STREAM(fp, 0, 0, 0600);
@@ -91,7 +91,7 @@ void load_cpu(const char *fname) {
         if (!fname)
                 return;
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp) {
                 unsigned tmp;
                 int rv = fscanf(fp, "%x", &tmp);
@@ -139,7 +139,7 @@ static void print_cpu(int pid) {
         }
 
         EUID_ROOT();    // grsecurity
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         EUID_USER();    // grsecurity
         if (!fp) {
                 printf("  Error: cannot open %s\n", file);
diff --git a/src/firejail/dhcp.c b/src/firejail/dhcp.c
index bdbb338d5..5bcdcad37 100644
--- a/src/firejail/dhcp.c
+++ b/src/firejail/dhcp.c
@@ -93,7 +93,7 @@ static pid_t dhcp_read_pidfile(const Dhclient *client) {
         while (found == 0 && tries < 10) {
                 if (tries >= 1)
                         usleep(100000);
-                FILE *pidfile = fopen(client->pid_file, "r");
+                FILE *pidfile = fopen(client->pid_file, "re");
                 if (pidfile) {
                         long pid;
                         if (fscanf(pidfile, "%ld", &pid) == 1)
diff --git a/src/firejail/env.c b/src/firejail/env.c
index 03818df0b..f5e9dd980 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -59,12 +59,7 @@ void env_ibus_load(void) {
         if (asprintf(&dirname, "%s/.config/ibus/bus", cfg.homedir) == -1)
                 errExit("asprintf");
 
-        struct stat s;
-        if (stat(dirname, &s) == -1)
-                return;
-
         // find the file
-        /* coverity[toctou] */
         DIR *dir = opendir(dirname);
         if (!dir) {
                 free(dirname);
@@ -84,7 +79,7 @@ void env_ibus_load(void) {
                 char *fname;
                 if (asprintf(&fname, "%s/%s", dirname, entry->d_name) == -1)
                         errExit("asprintf");
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 free(fname);
                 if (!fp)
                         continue;
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 20de229df..1c1ad4e97 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -310,7 +310,6 @@ extern int arg_private_cwd;	// private working directory
 extern int arg_scan;            // arp-scan all interfaces
 extern int arg_whitelist;       // whitelist command
 extern int arg_nosound; // disable sound
-extern int arg_noautopulse; // disable automatic ~/.config/pulse init
 extern int arg_novideo; //disable video devices in /dev
 extern int arg_no3d;            // disable 3d hardware acceleration
 extern int arg_quiet;           // no output for scripting
@@ -319,6 +318,7 @@ extern int arg_join_filesystem;	// join only the mount namespace
 extern int arg_nice;            // nice value configured
 extern int arg_ipc;             // enable ipc namespace
 extern int arg_writable_etc;    // writable etc
+extern int arg_keep_config_pulse;       // disable automatic ~/.config/pulse init
 extern int arg_writable_var;    // writable var
 extern int arg_keep_var_tmp; // don't overwrite /var/tmp
 extern int arg_writable_run_user;       // writable /run/user
@@ -335,7 +335,8 @@ extern int arg_noprofile;	// use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;       // block writable and executable memory
 extern int arg_notv;    // --notv
 extern int arg_nodvd;   // --nodvd
-extern int arg_nou2f;   // --nou2f
+extern int arg_nou2f;   // --nou2f
+extern int arg_noinput; // --noinput
 extern int arg_deterministic_exit_code; // always exit with first child's exit status
 
 typedef enum {
@@ -565,6 +566,7 @@ void fs_dev_disable_video(void);
 void fs_dev_disable_tv(void);
 void fs_dev_disable_dvd(void);
 void fs_dev_disable_u2f(void);
+void fs_dev_disable_input(void);
 
 // fs_home.c
 // private mode (--private)
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index b2fa60f63..8c2870a4d 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -41,6 +41,7 @@ typedef enum {
         DEV_TV,
         DEV_DVD,
         DEV_U2F,
+        DEV_INPUT
 } DEV_TYPE;
 
 
@@ -89,6 +90,7 @@ static DevEntry dev[] = {
         {"/dev/hidraw8", RUN_DEV_DIR "/hidraw8", DEV_U2F},
         {"/dev/hidraw9", RUN_DEV_DIR "/hidraw9", DEV_U2F},
         {"/dev/usb", RUN_DEV_DIR "/usb", DEV_U2F},      // USB devices such as Yubikey, U2F
+        {"/dev/input", RUN_DEV_DIR "/input", DEV_INPUT},
         {NULL, NULL, DEV_NONE}
 };
 
@@ -103,7 +105,8 @@ static void deventry_mount(void) {
                             (dev[i].type == DEV_VIDEO && arg_novideo == 0) ||
                             (dev[i].type == DEV_TV && arg_notv == 0) ||
                             (dev[i].type == DEV_DVD && arg_nodvd == 0) ||
-                            (dev[i].type == DEV_U2F && arg_nou2f == 0)) {
+                            (dev[i].type == DEV_U2F && arg_nou2f == 0) ||
+                            (dev[i].type == DEV_INPUT && arg_noinput == 0)) {
 
                                 int dir = is_dir(dev[i].run_fname);
                                 if (arg_debug)
@@ -119,7 +122,7 @@ static void deventry_mount(void) {
                                                 i++;
                                                 continue;
                                         }
-                                        FILE *fp = fopen(dev[i].dev_fname, "w");
+                                        FILE *fp = fopen(dev[i].dev_fname, "we");
                                         if (fp) {
                                                 fprintf(fp, "\n");
                                                 SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode);
@@ -215,7 +218,7 @@ void fs_private_dev(void){
         struct stat s;
         if (stat("/dev/log", &s) == 0) {
                 have_devlog = 1;
-                FILE *fp = fopen(RUN_DEVLOG_FILE, "w");
+                FILE *fp = fopen(RUN_DEVLOG_FILE, "we");
                 if (!fp)
                         have_devlog = 0;
                 else {
@@ -236,7 +239,7 @@ void fs_private_dev(void){
 
         // bring back /dev/log
         if (have_devlog) {
-                FILE *fp = fopen("/dev/log", "w");
+                FILE *fp = fopen("/dev/log", "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         fclose(fp);
@@ -386,3 +389,12 @@ void fs_dev_disable_u2f(void) {
                 i++;
         }
 }
+
+void fs_dev_disable_input(void) {
+        int i = 0;
+        while (dev[i].dev_fname != NULL) {
+                if (dev[i].type == DEV_INPUT)
+                        disable_file_or_dir(dev[i].dev_fname);
+                i++;
+        }
+}
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index abec25d45..b0e1e1bf1 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -52,7 +52,7 @@ void fs_machineid(void) {
         mid.u8[8] = (mid.u8[8] & 0x3F) | 0x80;
 
         // write it in a file
-        FILE *fp = fopen(RUN_MACHINEID, "w");
+        FILE *fp = fopen(RUN_MACHINEID, "we");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%08x%08x%08x%08x\n", mid.u32[0], mid.u32[1], mid.u32[2], mid.u32[3]);
@@ -76,6 +76,44 @@ void fs_machineid(void) {
         }
 }
 
+// Duplicate directory structure from src to dst by creating empty directories.
+// The paths _must_ be identical after their respective prefixes.
+// When finished, dst will point to the target directory. That is, if
+// it starts out pointing to a file, it will instead be truncated so
+// that it contains the parent directory instead.
+static void build_dirs(char *src, char *dst, size_t src_prefix_len, size_t dst_prefix_len) {
+        char *p = src + src_prefix_len + 1;
+        char *q = dst + dst_prefix_len + 1;
+        char *r = dst + dst_prefix_len;
+        struct stat s;
+        bool last = false;
+        *r = '\0';
+        for (; !last; p++, q++) {
+                if (*p == '\0') {
+                        last = true;
+                }
+                if (*p == '\0' || (*p == '/' && *(p - 1) != '/')) {
+                        // We found a new component of our src path.
+                        // Null-terminate it temporarily here so that we can work
+                        // with it.
+                        *p = '\0';
+                        if (stat(src, &s) == 0 && S_ISDIR(s.st_mode)) {
+                                // Null-terminate the dst path and undo its previous
+                                // termination.
+                                *q = '\0';
+                                *r = '/';
+                                r = q;
+                                create_empty_dir_as_root(dst, s.st_mode);
+                        }
+                        if (!last) {
+                                // If we're not at the final terminating null, restore
+                                // the slash so that we can continue our traversal.
+                                *p = '/';
+                        }
+                }
+        }
+}
+
 // return 0 if file not found, 1 if found
 static int check_dir_or_file(const char *fname) {
         assert(fname);
@@ -103,7 +141,7 @@ errexit:
 static void duplicate(const char *fname, const char *private_dir, const char *private_run_dir) {
         assert(fname);
 
-        if (*fname == '~' || strchr(fname, '/') || strcmp(fname, "..") == 0) {
+        if (*fname == '~' || *fname == '/' || strncmp(fname, "..", 2) == 0) {
                 fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
@@ -119,21 +157,16 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
         }
 
         if (arg_debug)
-                printf("copying %s to private %s\n", src, private_dir);
+                printf("Copying %s to private %s\n", src, private_dir);
 
-        struct stat s;
-        if (stat(src, &s) == 0 && S_ISDIR(s.st_mode)) {
-                // create the directory in RUN_ETC_DIR
-                char *dirname;
-                if (asprintf(&dirname, "%s/%s", private_run_dir, fname) == -1)
-                        errExit("asprintf");
-                create_empty_dir_as_root(dirname, s.st_mode);
-                sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, src, dirname);
-                free(dirname);
-        }
-        else
-                sbox_run(SBOX_ROOT| SBOX_SECCOMP, 3, PATH_FCOPY, src, private_run_dir);
+        char *dst;
+        if (asprintf(&dst, "%s/%s", private_run_dir, fname) == -1)
+                errExit("asprintf");
+
+        build_dirs(src, dst, strlen(private_dir), strlen(private_run_dir));
+        sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FCOPY, src, dst);
 
+        free(dst);
         fs_logger2("clone", src);
         free(src);
 }
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index e3b044a3b..4bcefa443 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -130,7 +130,7 @@ static int store_xauthority(void) {
                 }
 
                 // create an empty file as root, and change ownership to user
-                FILE *fp = fopen(dest, "w");
+                FILE *fp = fopen(dest, "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, getuid(), getgid(), 0600);
@@ -178,7 +178,7 @@ static int store_asoundrc(void) {
                 }
 
                 // create an empty file as root, and change ownership to user
-                FILE *fp = fopen(dest, "w");
+                FILE *fp = fopen(dest, "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, getuid(), getgid(), 0644);
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index 8a3bb71ea..80046f7ae 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -47,11 +47,11 @@ void fs_hostname(const char *hostname) {
                         printf("Creating a new /etc/hosts file\n");
                 // copy /etc/host into our new file, and modify it on the fly
                 /* coverity[toctou] */
-                FILE *fp1 = fopen("/etc/hosts", "r");
+                FILE *fp1 = fopen("/etc/hosts", "re");
                 if (!fp1)
                         goto errexit;
 
-                FILE *fp2 = fopen(RUN_HOSTS_FILE, "w");
+                FILE *fp2 = fopen(RUN_HOSTS_FILE, "we");
                 if (!fp2) {
                         fclose(fp1);
                         goto errexit;
@@ -165,7 +165,7 @@ void fs_resolvconf(void) {
 
         if (arg_debug)
                 printf("Creating a new /etc/resolv.conf file\n");
-        FILE *fp = fopen("/etc/resolv.conf", "w");
+        FILE *fp = fopen("/etc/resolv.conf", "wxe");
         if (!fp) {
                 fprintf(stderr, "Error: cannot create /etc/resolv.conf file\n");
                 exit(1);
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index 85fb70854..5df356d04 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -221,7 +221,7 @@ void fslib_mount_libs(const char *full_path, unsigned user) {
         sbox_run(mask | SBOX_SECCOMP | SBOX_CAPS_NONE, 3, PATH_FLDD, full_path, RUN_LIB_FILE);
 
         // open the list of libraries and install them on by one
-        FILE *fp = fopen(RUN_LIB_FILE, "r");
+        FILE *fp = fopen(RUN_LIB_FILE, "re");
         if (!fp)
                 errExit("fopen");
 
diff --git a/src/firejail/fs_logger.c b/src/firejail/fs_logger.c
index 67ad4b52e..604e297b1 100644
--- a/src/firejail/fs_logger.c
+++ b/src/firejail/fs_logger.c
@@ -92,7 +92,7 @@ void fs_logger_print(void) {
         if (!head)
                 return;
 
-        FILE *fp = fopen(RUN_FSLOGGER_FILE, "a");
+        FILE *fp = fopen(RUN_FSLOGGER_FILE, "ae");
         if (!fp) {
                 perror("fopen");
                 return;
@@ -123,15 +123,8 @@ void fs_logger_print_log(pid_t pid) {
         // in case the pid is that of a firejail process, use the pid of the first child process
         pid = switch_to_child(pid);
 
-        // check privileges for non-root users
-        uid_t uid = getuid();
-        if (uid != 0) {
-                uid_t sandbox_uid = pid_get_uid(pid);
-                if (uid != sandbox_uid) {
-                        fprintf(stderr, "Error: permission denied\n");
-                        exit(1);
-                }
-        }
+        // exit if no permission to join the sandbox
+        check_join_permission(pid);
 
         // print RUN_FSLOGGER_FILE
         char *fname;
@@ -139,24 +132,16 @@ void fs_logger_print_log(pid_t pid) {
                 errExit("asprintf");
 
         EUID_ROOT();
-        struct stat s;
-        if (stat(fname, &s) == -1 || s.st_uid != 0) {
-                fprintf(stderr, "Error: Cannot access filesystem log\n");
-                exit(1);
-        }
-
-        /* coverity[toctou] */
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
+        free(fname);
         if (!fp) {
                 fprintf(stderr, "Error: Cannot open filesystem log\n");
                 exit(1);
         }
-
         char buf[MAXBUF];
         while (fgets(buf, MAXBUF, fp))
                 printf("%s", buf);
         fclose(fp);
-        free(fname);
 
         exit(0);
 }
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index 8f939b5f5..1fc38361e 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -33,8 +33,7 @@ void fs_trace_preload(void) {
         if (stat("/etc/ld.so.preload", &s)) {
                 if (arg_debug)
                         printf("Creating an empty /etc/ld.so.preload file\n");
-                /* coverity[toctou] */
-                FILE *fp = fopen("/etc/ld.so.preload", "w");
+                FILE *fp = fopen("/etc/ld.so.preload", "wxe");
                 if (!fp)
                         errExit("fopen");
                 SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
@@ -64,11 +63,11 @@ void fs_tracefile(void) {
         if (ftruncate(fd, 0) == -1)
                 errExit("ftruncate");
         EUID_ROOT();
-        FILE *fp = fopen(RUN_TRACE_FILE, "w");
+        FILE *fp = fopen(RUN_TRACE_FILE, "we");
         if (!fp)
                 errExit("fopen " RUN_TRACE_FILE);
         fclose(fp);
-        fs_logger2("touch ", arg_tracefile);
+        fs_logger2("touch", arg_tracefile);
         // mount using the symbolic link in /proc/self/fd
         if (arg_debug)
                 printf("Bind mount %s to %s\n", arg_tracefile, RUN_TRACE_FILE);
@@ -88,7 +87,7 @@ void fs_trace(void) {
         if (arg_debug)
                 printf("Create the new ld.so.preload file\n");
 
-        FILE *fp = fopen(RUN_LDPRELOAD_FILE, "w");
+        FILE *fp = fopen(RUN_LDPRELOAD_FILE, "we");
         if (!fp)
                 errExit("fopen");
         const char *prefix = RUN_FIREJAIL_LIB_DIR;
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c
index f07581cd8..bae3d6df0 100644
--- a/src/firejail/fs_var.c
+++ b/src/firejail/fs_var.c
@@ -127,7 +127,7 @@ void fs_var_log(void) {
 
                 // create an empty /var/log/wtmp file
                 /* coverity[toctou] */
-                FILE *fp = fopen("/var/log/wtmp", "w");
+                FILE *fp = fopen("/var/log/wtmp", "wxe");
                 if (fp) {
                         SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH);
                         fclose(fp);
@@ -135,7 +135,7 @@ void fs_var_log(void) {
                 fs_logger("touch /var/log/wtmp");
 
                 // create an empty /var/log/btmp file
-                fp = fopen("/var/log/btmp", "w");
+                fp = fopen("/var/log/btmp", "wxe");
                 if (fp) {
                         SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP);
                         fclose(fp);
@@ -158,8 +158,7 @@ void fs_var_lib(void) {
                 fs_logger("tmpfs /var/lib/dhcp");
 
                 // isc dhcp server requires a /var/lib/dhcp/dhcpd.leases file
-                FILE *fp = fopen("/var/lib/dhcp/dhcpd.leases", "w");
-
+                FILE *fp = fopen("/var/lib/dhcp/dhcpd.leases", "wxe");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, 0, 0, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
@@ -287,7 +286,7 @@ void fs_var_utmp(void) {
         if (stat(UTMP_FILE, &s) == 0)
                 utmp_group = s.st_gid;
         else {
-                fwarning("cannot find /var/run/utmp\n");
+                fwarning("cannot find %s\n", UTMP_FILE);
                 return;
         }
 
@@ -296,7 +295,7 @@ void fs_var_utmp(void) {
                 printf("Create the new utmp file\n");
 
         /* coverity[toctou] */
-        FILE *fp = fopen(RUN_UTMP_FILE, "w");
+        FILE *fp = fopen(RUN_UTMP_FILE, "we");
         if (!fp)
                 errExit("fopen");
 
@@ -323,5 +322,5 @@ void fs_var_utmp(void) {
                 printf("Mount the new utmp file\n");
         if (mount(RUN_UTMP_FILE, UTMP_FILE, NULL, MS_BIND|MS_NOSUID|MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
                 errExit("mount bind utmp");
-        fs_logger("create /var/run/utmp");
+        fs_logger2("create", UTMP_FILE);
 }
diff --git a/src/firejail/join.c b/src/firejail/join.c
index 1575a7469..bab4b830f 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -103,7 +103,7 @@ static void extract_x11_display(pid_t pid) {
         if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_X11_DIR, pid) == -1)
                 errExit("asprintf");
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         free(fname);
         if (!fp)
                 return;
@@ -219,7 +219,7 @@ static void extract_caps(pid_t pid) {
                 perror("asprintf");
                 exit(1);
         }
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         if (!fp)
                 goto errexit;
 
@@ -266,7 +266,7 @@ static void extract_user_namespace(pid_t pid) {
         char *uidmap;
         if (asprintf(&uidmap, "/proc/%u/uid_map", pid) == -1)
                 errExit("asprintf");
-        FILE *fp = fopen(uidmap, "r");
+        FILE *fp = fopen(uidmap, "re");
         if (!fp) {
                 free(uidmap);
                 return;
diff --git a/src/firejail/ls.c b/src/firejail/ls.c
index 63ef2309b..796c42290 100644
--- a/src/firejail/ls.c
+++ b/src/firejail/ls.c
@@ -221,7 +221,7 @@ void cat(const char *path) {
 
         if (arg_debug)
                 printf("cat %s\n", path);
-        FILE *fp = fopen(path, "r");
+        FILE *fp = fopen(path, "re");
         if (!fp) {
                 fprintf(stderr, "Error: cannot read %s\n", path);
                 exit(1);
diff --git a/src/firejail/macros.c b/src/firejail/macros.c
index 7f2f6dbf3..bcac1feb4 100644
--- a/src/firejail/macros.c
+++ b/src/firejail/macros.c
@@ -99,7 +99,7 @@ static char *resolve_xdg(const char *var) {
 
         if (asprintf(&fname, "%s/.config/user-dirs.dirs", cfg.homedir) == -1)
                 errExit("asprintf");
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (!fp) {
                 free(fname);
                 return NULL;
diff --git a/src/firejail/main.c b/src/firejail/main.c
index b3524fcf5..593835843 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -116,7 +116,6 @@ int arg_private_cwd = 0;			// private working directory
 int arg_scan = 0;                               // arp-scan all interfaces
 int arg_whitelist = 0;                          // whitelist command
 int arg_nosound = 0;                            // disable sound
-int arg_noautopulse = 0;                        // disable automatic ~/.config/pulse init
 int arg_novideo = 0;                    //disable video devices in /dev
 int arg_no3d;                                   // disable 3d hardware acceleration
 int arg_quiet = 0;                              // no output for scripting
@@ -125,6 +124,7 @@ int arg_join_filesystem = 0;			// join only the mount namespace
 int arg_nice = 0;                               // nice value configured
 int arg_ipc = 0;                                        // enable ipc namespace
 int arg_writable_etc = 0;                       // writable etc
+int arg_keep_config_pulse = 0;                  // disable automatic ~/.config/pulse init
 int arg_writable_var = 0;                       // writable var
 int arg_keep_var_tmp = 0;                       // don't overwrite /var/tmp
 int arg_writable_run_user = 0;                  // writable /run/user
@@ -143,6 +143,7 @@ int arg_memory_deny_write_execute = 0;		// block writable and executable memory
 int arg_notv = 0;       // --notv
 int arg_nodvd = 0; // --nodvd
 int arg_nou2f = 0; // --nou2f
+int arg_noinput = 0; // --noinput
 int arg_deterministic_exit_code = 0;    // always exit with first child's exit status
 DbusPolicy arg_dbus_user = DBUS_POLICY_ALLOW;   // --dbus-user
 DbusPolicy arg_dbus_system = DBUS_POLICY_ALLOW; // --dbus-system
@@ -534,7 +535,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 char *fname;
                 if (asprintf(&fname, RUN_FIREJAIL_PROFILE_DIR "/%d", pid) == -1)
                         errExit("asprintf");
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 if (!fp) {
                         fprintf(stderr, "Error: sandbox %s not found\n", argv[i] + 16);
                         exit(1);
@@ -1042,7 +1043,7 @@ int main(int argc, char **argv, char **envp) {
         preproc_build_firejail_dir();
         const char *container_name = env_get("container");
         if (!container_name || strcmp(container_name, "firejail")) {
-                lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+                lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
                 if (lockfd_directory != -1) {
                         int rv = fchown(lockfd_directory, 0, 0);
                         (void) rv;
@@ -1144,7 +1145,7 @@ int main(int argc, char **argv, char **envp) {
 
 #ifdef DEBUG_RESTRICTED_SHELL
                                 {EUID_ROOT();
-                                FILE *fp = fopen("/firelog", "w");
+                                FILE *fp = fopen("/firelog", "we");
                                 if (fp) {
                                         int i;
                                         fprintf(fp, "argc %d: ", argc);
@@ -1163,7 +1164,7 @@ int main(int argc, char **argv, char **envp) {
                                                     strncmp(argv[2], "scp ", 4) == 0) {
 #ifdef DEBUG_RESTRICTED_SHELL
                                                         {EUID_ROOT();
-                                                        FILE *fp = fopen("/firelog", "a");
+                                                        FILE *fp = fopen("/firelog", "ae");
                                                         if (fp) {
                                                                 fprintf(fp, "run without a sandbox\n");
                                                                 fclose(fp);
@@ -1196,7 +1197,7 @@ int main(int argc, char **argv, char **envp) {
 
 #ifdef DEBUG_RESTRICTED_SHELL
                         {EUID_ROOT();
-                        FILE *fp = fopen("/firelog", "a");
+                        FILE *fp = fopen("/firelog", "ae");
                         if (fp) {
                                 fprintf(fp, "fullargc %d: ",  fullargc);
                                 int i;
@@ -1218,7 +1219,7 @@ int main(int argc, char **argv, char **envp) {
 
 #ifdef DEBUG_RESTRICTED_SHELL
                         {EUID_ROOT();
-                        FILE *fp = fopen("/firelog", "a");
+                        FILE *fp = fopen("/firelog", "ae");
                         if (fp) {
                                 fprintf(fp, "argc %d: ", argc);
                                 int i;
@@ -1823,6 +1824,8 @@ int main(int argc, char **argv, char **envp) {
                                 exit(1);
                         }
                         arg_noprofile = 1;
+                        // force keep-config-pulse in order to keep ~/.config/pulse as is
+                        arg_keep_config_pulse = 1;
                 }
                 else if (strncmp(argv[i], "--ignore=", 9) == 0) {
                         if (custom_profile) {
@@ -1873,6 +1876,9 @@ int main(int argc, char **argv, char **envp) {
                         }
                         arg_writable_etc = 1;
                 }
+                else if (strcmp(argv[i], "--keep-config-pulse") == 0) {
+                        arg_keep_config_pulse = 1;
+                }
                 else if (strcmp(argv[i], "--writable-var") == 0) {
                         arg_writable_var = 1;
                 }
@@ -2075,7 +2081,7 @@ int main(int argc, char **argv, char **envp) {
                 else if (strcmp(argv[i], "--nosound") == 0)
                         arg_nosound = 1;
                 else if (strcmp(argv[i], "--noautopulse") == 0)
-                        arg_noautopulse = 1;
+                        arg_keep_config_pulse = 1;
                 else if (strcmp(argv[i], "--novideo") == 0)
                         arg_novideo = 1;
                 else if (strcmp(argv[i], "--no3d") == 0)
@@ -2086,6 +2092,8 @@ int main(int argc, char **argv, char **envp) {
                         arg_nodvd = 1;
                 else if (strcmp(argv[i], "--nou2f") == 0)
                         arg_nou2f = 1;
+                else if (strcmp(argv[i], "--noinput") == 0)
+                        arg_noinput = 1;
                 else if (strcmp(argv[i], "--nodbus") == 0) {
                         arg_dbus_user = DBUS_POLICY_BLOCK;
                         arg_dbus_system = DBUS_POLICY_BLOCK;
@@ -2847,7 +2855,7 @@ int main(int argc, char **argv, char **envp) {
         // check and assign an IP address - for macvlan it will be done again in the sandbox!
         if (any_bridge_configured()) {
                 EUID_ROOT();
-                lockfd_network = open(RUN_NETWORK_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+                lockfd_network = open(RUN_NETWORK_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
                 if (lockfd_network != -1) {
                         int rv = fchown(lockfd_network, 0, 0);
                         (void) rv;
@@ -2869,12 +2877,6 @@ int main(int argc, char **argv, char **envp) {
         }
         EUID_ASSERT();
 
-        // create the parent-child communication pipe
-        if (pipe(parent_to_child_fds) < 0)
-                errExit("pipe");
-        if (pipe(child_to_parent_fds) < 0)
-                errExit("pipe");
-
         if (arg_noroot && arg_overlay) {
                 fwarning("--overlay and --noroot are mutually exclusive, noroot disabled\n");
                 arg_noroot = 0;
@@ -2887,7 +2889,7 @@ int main(int argc, char **argv, char **envp) {
 
         // set name and x11 run files
         EUID_ROOT();
-        lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+        lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
         if (lockfd_directory != -1) {
                 int rv = fchown(lockfd_directory, 0, 0);
                 (void) rv;
@@ -2916,6 +2918,12 @@ int main(int argc, char **argv, char **envp) {
         }
 #endif
 
+        // create the parent-child communication pipe
+        if (pipe2(parent_to_child_fds, O_CLOEXEC) < 0)
+                errExit("pipe");
+        if (pipe2(child_to_parent_fds, O_CLOEXEC) < 0)
+                errExit("pipe");
+
         // clone environment
         int flags = CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWUTS | SIGCHLD;
 
diff --git a/src/firejail/network.c b/src/firejail/network.c
index f7142cefd..289e164c6 100644
--- a/src/firejail/network.c
+++ b/src/firejail/network.c
@@ -217,7 +217,7 @@ int net_add_route(uint32_t ip, uint32_t mask, uint32_t gw) {
 
 #define BUFSIZE 1024
 uint32_t network_get_defaultgw(void) {
-        FILE *fp = fopen("/proc/self/net/route", "r");
+        FILE *fp = fopen("/proc/self/net/route", "re");
         if (!fp)
                 errExit("fopen");
 
diff --git a/src/firejail/network_main.c b/src/firejail/network_main.c
index ee3c00872..d3e75bbed 100644
--- a/src/firejail/network_main.c
+++ b/src/firejail/network_main.c
@@ -292,7 +292,7 @@ void net_dns_print(pid_t pid) {
                         errExit("chdir");
 
                 // access /etc/resolv.conf
-                FILE *fp = fopen("/etc/resolv.conf", "r");
+                FILE *fp = fopen("/etc/resolv.conf", "re");
                 if (!fp) {
                         fprintf(stderr, "Error: cannot access /etc/resolv.conf\n");
                         exit(1);
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 60a82821e..0e153c47b 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -20,6 +20,7 @@
 #include "firejail.h"
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <errno.h>
 #include <unistd.h>
 #include <grp.h>
 
@@ -47,7 +48,7 @@ int check_namespace_virt(void) {
 
         // check PID 1 container environment variable
         EUID_ROOT();
-        FILE *fp = fopen("/proc/1/environ", "r");
+        FILE *fp = fopen("/proc/1/environ", "re");
         if (fp) {
                 int c = 0;
                 while (c != EOF) {
@@ -105,20 +106,15 @@ int check_kernel_procs(void) {
         // look at the first 10 processes
         // if a kernel process is found, return 1
         for (i = 1; i <= 10; i++) {
-                struct stat s;
                 char *fname;
                 if (asprintf(&fname, "/proc/%d/comm", i) == -1)
                         errExit("asprintf");
-                if (stat(fname, &s) == -1) {
-                        free(fname);
-                        continue;
-                }
 
                 // open file
-                /* coverity[toctou] */
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 if (!fp) {
-                        fwarning("cannot open %s\n", fname);
+                        if (errno != ENOENT)
+                                fwarning("cannot open %s\n", fname);
                         free(fname);
                         continue;
                 }
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index 7f602545d..1aafd1ca2 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -164,7 +164,7 @@ void preproc_clean_run(void) {
         int max_pids=32769;
         int start_pid = 100;
         // extract real max_pids
-        FILE *fp = fopen("/proc/sys/kernel/pid_max", "r");
+        FILE *fp = fopen("/proc/sys/kernel/pid_max", "re");
         if (fp) {
                 int val;
                 if (fscanf(fp, "%d", &val) == 1) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 351b760df..dd4506ac1 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -423,7 +423,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         else if (strcmp(ptr, "noautopulse") == 0) {
-                arg_noautopulse = 1;
+                arg_keep_config_pulse = 1;
                 return 0;
         }
         else if (strcmp(ptr, "notv") == 0) {
@@ -442,6 +442,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_no3d = 1;
                 return 0;
         }
+        else if (strcmp(ptr, "noinput") == 0) {
+                arg_noinput = 1;
+                return 0;
+        }
         else if (strcmp(ptr, "nodbus") == 0) {
 #ifdef HAVE_DBUSPROXY
                 arg_dbus_user = DBUS_POLICY_BLOCK;
@@ -1139,6 +1143,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_machineid = 1;
                 return 0;
         }
+
+        if (strcmp(ptr, "keep-config-pulse") == 0) {
+                arg_keep_config_pulse = 1;
+                return 0;
+        }
+
         // writable-var
         if (strcmp(ptr, "writable-var") == 0) {
                 arg_writable_var = 1;
@@ -1687,7 +1697,7 @@ void profile_read(const char *fname) {
         }
 
         // open profile file:
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp == NULL) {
                 fprintf(stderr, "Error: cannot open profile file %s\n", fname);
                 exit(1);
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index 926af7967..f21f8c96e 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -23,7 +23,7 @@
 
 void protocol_filter_save(void) {
         // save protocol filter configuration in PROTOCOL_CFG
-        FILE *fp = fopen(RUN_PROTOCOL_CFG, "w");
+        FILE *fp = fopen(RUN_PROTOCOL_CFG, "wxe");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s\n", cfg.protocol);
@@ -35,7 +35,7 @@ void protocol_filter_load(const char *fname) {
         assert(fname);
 
         // read protocol filter configuration from PROTOCOL_CFG
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (!fp)
                 return;
 
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index a50134893..1b01a71c6 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -106,7 +106,7 @@ void pulseaudio_init(void) {
                 errExit("asprintf");
         if (copy_file(PULSE_CLIENT_SYSCONF, pulsecfg, -1, -1, 0644)) // root needed
                 errExit("copy_file");
-        FILE *fp = fopen(pulsecfg, "a");
+        FILE *fp = fopen(pulsecfg, "ae");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s", "\nenable-shm = no\n");
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index 8368d84a1..53e395b89 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -183,10 +183,10 @@ static void sanitize_passwd(void) {
 
         // open files
         /* coverity[toctou] */
-        fpin = fopen("/etc/passwd", "r");
+        fpin = fopen("/etc/passwd", "re");
         if (!fpin)
                 goto errout;
-        fpout = fopen(RUN_PASSWD_FILE, "w");
+        fpout = fopen(RUN_PASSWD_FILE, "we");
         if (!fpout)
                 goto errout;
 
@@ -318,10 +318,10 @@ static void sanitize_group(void) {
 
         // open files
         /* coverity[toctou] */
-        fpin = fopen("/etc/group", "r");
+        fpin = fopen("/etc/group", "re");
         if (!fpin)
                 goto errout;
-        fpout = fopen(RUN_GROUP_FILE, "w");
+        fpout = fopen(RUN_GROUP_FILE, "we");
         if (!fpout)
                 goto errout;
 
diff --git a/src/firejail/restricted_shell.c b/src/firejail/restricted_shell.c
index ae453f4f1..ed66903b5 100644
--- a/src/firejail/restricted_shell.c
+++ b/src/firejail/restricted_shell.c
@@ -32,7 +32,7 @@ int restricted_shell(const char *user) {
         char *fname;
         if (asprintf(&fname, "%s/login.users", SYSCONFDIR) == -1)
                 errExit("asprintf");
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         free(fname);
         if (fp == NULL)
                 return 0;
@@ -96,7 +96,7 @@ int restricted_shell(const char *user) {
                                 fullargv[i] = ptr;
 #ifdef DEBUG_RESTRICTED_SHELL
                                 {EUID_ROOT();
-                                FILE *fp = fopen("/firelog", "a");
+                                FILE *fp = fopen("/firelog", "ae");
                                 if (fp) {
                                         fprintf(fp, "i %d ptr #%s#\n", i, fullargv[i]);
                                         fclose(fp);
diff --git a/src/firejail/run_files.c b/src/firejail/run_files.c
index cd44f745f..c28c3e01b 100644
--- a/src/firejail/run_files.c
+++ b/src/firejail/run_files.c
@@ -101,7 +101,7 @@ void set_name_run_file(pid_t pid) {
                 errExit("asprintf");
 
         // the file is deleted first
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (!fp) {
                 fprintf(stderr, "Error: cannot create %s\n", fname);
                 exit(1);
@@ -120,7 +120,7 @@ void set_x11_run_file(pid_t pid, int display) {
                 errExit("asprintf");
 
         // the file is deleted first
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (!fp) {
                 fprintf(stderr, "Error: cannot create %s\n", fname);
                 exit(1);
@@ -139,7 +139,7 @@ void set_profile_run_file(pid_t pid, const char *fname) {
 
         EUID_ROOT();
         // the file is deleted first
-        FILE *fp = fopen(runfile, "w");
+        FILE *fp = fopen(runfile, "we");
         if (!fp) {
                 fprintf(stderr, "Error: cannot create %s\n", runfile);
                 exit(1);
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 743d84b43..08f0f32c9 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -67,7 +67,7 @@ static void sandbox_handler(int sig){
                 if (asprintf(&monfile, "/proc/%d/cmdline", monitored_pid) == -1)
                         errExit("asprintf");
                 while (monsec) {
-                        FILE *fp = fopen(monfile, "r");
+                        FILE *fp = fopen(monfile, "re");
                         if (!fp)
                                 break;
 
@@ -162,7 +162,7 @@ static void save_nogroups(void) {
         if (arg_nogroups == 0)
                 return;
 
-        FILE *fp = fopen(RUN_GROUPS_CFG, "w");
+        FILE *fp = fopen(RUN_GROUPS_CFG, "wxe");
         if (fp) {
                 fprintf(fp, "\n");
                 SET_PERMS_STREAM(fp, 0, 0, 0644); // assume mode 0644
@@ -1015,7 +1015,7 @@ int sandbox(void* sandbox_arg) {
                 // disable /dev/snd
                 fs_dev_disable_sound();
         }
-        else if (!arg_noautopulse)
+        else if (!arg_keep_config_pulse)
                 pulseaudio_init();
 
         if (arg_no3d)
@@ -1033,6 +1033,9 @@ int sandbox(void* sandbox_arg) {
         if (arg_novideo)
                 fs_dev_disable_video();
 
+        if (arg_noinput)
+                fs_dev_disable_input();
+
         //****************************
         // set dns
         //****************************
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index f9c41f661..4a8dd1bf7 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -248,7 +248,9 @@ int sbox_run(unsigned filtermask, int num, ...) {
         va_start(valist, num);
 
         // build argument list
-        char **arg = malloc((num + 1) * sizeof(char *));
+        char **arg = calloc(num + 1, sizeof(char *));
+        if (!arg)
+                errExit("calloc");
         int i;
         for (i = 0; i < num; i++)
                 arg[i] = va_arg(valist, char *);
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 785c29517..9670fe816 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -86,7 +86,7 @@ int seccomp_install_filters(void) {
 static void seccomp_save_file_list(const char *fname) {
         assert(fname);
 
-        FILE *fp = fopen(RUN_SECCOMP_LIST, "a+");
+        FILE *fp = fopen(RUN_SECCOMP_LIST, "ae");
         if (!fp)
                 errExit("fopen");
 
@@ -99,7 +99,7 @@ static void seccomp_save_file_list(const char *fname) {
 #define MAXBUF 4096
 static int load_file_list_flag = 0;
 void seccomp_load_file_list(void) {
-        FILE *fp = fopen(RUN_SECCOMP_LIST, "r");
+        FILE *fp = fopen(RUN_SECCOMP_LIST, "re");
         if (!fp)
                 return; // no seccomp configuration whatsoever
 
@@ -122,7 +122,7 @@ int seccomp_load(const char *fname) {
         assert(fname);
 
         // open filter file
-        int fd = open(fname, O_RDONLY);
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
         if (fd == -1)
                 goto errexit;
 
@@ -438,7 +438,7 @@ void seccomp_print_filter(pid_t pid) {
         if (stat(fname, &s) == -1)
                 goto errexit;
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (!fp)
                 goto errexit;
         free(fname);
diff --git a/src/firejail/shutdown.c b/src/firejail/shutdown.c
index 8fb03d0a6..fbfe1765b 100644
--- a/src/firejail/shutdown.c
+++ b/src/firejail/shutdown.c
@@ -64,7 +64,7 @@ void shut(pid_t pid) {
                 monsec--;
 
                 EUID_ROOT();
-                FILE *fp = fopen(monfile, "r");
+                FILE *fp = fopen(monfile, "re");
                 EUID_USER();
                 if (!fp) {
                         killdone = 1;
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 397150158..888a6ffed 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -114,7 +114,8 @@ static char *usage_str =
         "    --join-network=name|pid - join the network namespace.\n"
 #endif
         "    --join-or-start=name|pid - join the sandbox or start a new one.\n"
-        "    --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n"
+        "    --keep-config-pulse - disable automatic ~/.config/pulse init.\n"
+        "    --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n"
         "    --keep-var-tmp - /var/tmp directory is untouched.\n"
         "    --list - list all sandboxes.\n"
 #ifdef HAVE_FILE_TRANSFER
@@ -154,6 +155,7 @@ static char *usage_str =
         "    --nodvd - disable DVD and audio CD devices.\n"
         "    --noexec=filename - remount the file or directory noexec nosuid and nodev.\n"
         "    --nogroups - disable supplementary groups.\n"
+        "    --noinput - disable input devices.\n"
         "    --nonewprivs - sets the NO_NEW_PRIVS prctl.\n"
         "    --noprofile - do not use a security profile.\n"
 #ifdef HAVE_USERNS
diff --git a/src/firejail/util.c b/src/firejail/util.c
index def635ea7..2731f61dc 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -298,14 +298,14 @@ int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, m
         assert(destname);
 
         // open source
-        int src = open(srcname, O_RDONLY);
+        int src = open(srcname, O_RDONLY|O_CLOEXEC);
         if (src < 0) {
                 fwarning("cannot open source file %s, file not copied\n", srcname);
                 return -1;
         }
 
         // open destination
-        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (dst < 0) {
                 fwarning("cannot open destination file %s, file not copied\n", destname);
                 close(src);
@@ -348,7 +348,7 @@ void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid
 
 void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode) {
         // open destination
-        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (dst < 0) {
                 fwarning("cannot open destination file %s, file not copied\n", destname);
                 return;
@@ -361,7 +361,7 @@ void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_
                 // drop privileges
                 drop_privs(0);
 
-                int src = open(srcname, O_RDONLY);
+                int src = open(srcname, O_RDONLY|O_CLOEXEC);
                 if (src < 0) {
                         fwarning("cannot open source file %s, file not copied\n", srcname);
                 } else {
@@ -626,7 +626,7 @@ int find_child(pid_t parent, pid_t *child) {
                         perror("asprintf");
                         exit(1);
                 }
-                FILE *fp = fopen(file, "r");
+                FILE *fp = fopen(file, "re");
                 if (!fp) {
                         free(file);
                         continue;
@@ -732,7 +732,7 @@ void update_map(char *mapping, char *map_file) {
                 if (mapping[j] == ',')
                         mapping[j] = '\n';
 
-        fd = open(map_file, O_RDWR);
+        fd = open(map_file, O_RDWR|O_CLOEXEC);
         if (fd == -1) {
                 fprintf(stderr, "Error: cannot open %s: %s\n", map_file, strerror(errno));
                 exit(EXIT_FAILURE);
@@ -752,9 +752,9 @@ void wait_for_other(int fd) {
         // wait for the parent to be initialized
         //****************************
         char childstr[BUFLEN + 1];
-        int newfd = dup(fd);
+        int newfd = fcntl(fd, F_DUPFD_CLOEXEC, 0);
         if (newfd == -1)
-                errExit("dup");
+                errExit("fcntl");
         FILE* stream;
         stream = fdopen(newfd, "r");
         *childstr = '\0';
@@ -801,9 +801,9 @@ void wait_for_other(int fd) {
 
 void notify_other(int fd) {
         FILE* stream;
-        int newfd = dup(fd);
+        int newfd = fcntl(fd, F_DUPFD_CLOEXEC, 0);
         if (newfd == -1)
-                errExit("dup");
+                errExit("fcntl");
         stream = fdopen(newfd, "w");
         fprintf(stream, "arg_noroot=%d\n", arg_noroot);
         fflush(stream);
@@ -821,7 +821,7 @@ uid_t pid_get_uid(pid_t pid) {
                 exit(1);
         }
         EUID_ROOT();                              // grsecurity fix
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         if (!fp) {
                 free(file);
                 fprintf(stderr, "Error: cannot open /proc file\n");
@@ -1031,8 +1031,7 @@ void create_empty_file_as_root(const char *fname, mode_t mode) {
                 if (arg_debug)
                         printf("Creating empty %s file\n", fname);
 
-                /* coverity[toctou] */
-                FILE *fp = fopen(fname, "w");
+                FILE *fp = fopen(fname, "wxe");
                 if (!fp)
                         errExit("fopen");
                 SET_PERMS_STREAM(fp, 0, 0, mode);
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index da0acc69c..257d376a1 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -84,7 +84,7 @@ int x11_display(void) {
 static int x11_abstract_sockets_present(void) {
 
         EUID_ROOT();                              // grsecurity fix
-        FILE *fp = fopen("/proc/net/unix", "r");
+        FILE *fp = fopen("/proc/net/unix", "re");
         if (!fp)
                 errExit("fopen");
         EUID_USER();
@@ -1363,7 +1363,7 @@ void fs_x11(void) {
         fs_logger("tmpfs /tmp/.X11-unix");
 
         // create an empty root-owned file which will have the desired socket bind-mounted over it
-        int fd = open(x11file, O_RDONLY|O_CREAT|O_EXCL, S_IRUSR | S_IWUSR);
+        int fd = open(x11file, O_RDONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWUSR);
         if (fd < 0)
                 errExit(x11file);
         close(fd);
diff --git a/src/firemon/firemon.c b/src/firemon/firemon.c
index 37870747d..6c34cd411 100644
--- a/src/firemon/firemon.c
+++ b/src/firemon/firemon.c
@@ -52,7 +52,7 @@ static void my_handler(int s){
 
         if (terminal_set)
                 tcsetattr(0, TCSANOW, &tlocal);
-        exit(0);
+        _exit(0);
 }
 
 // find the second child process for the specified pid
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index ee685da73..49be8d0b0 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -1,12 +1,78 @@
 .TH FIREJAIL-PROFILE 5 "MONTH YEAR" "VERSION" "firejail profiles man page"
 .SH NAME
-profile \- Security profile file syntax for Firejail
+profile \- Security profile file syntax, and information about building new application profiles.
 
-.SH USAGE
+.SH SYNOPSIS
+
+Using a specific profile:
+.PP
+.RS
+.TP
+\fBfirejail \-\-profile=filename.profile
+.br
+
+.br
+Example:
+.br
+$ firejail --profile=/etc/firejail/kdenlive.profile --appimage kdenlive.appimage
+.br
+
+.br
+.TP
+\fBfirejail \-\-profile=profile_name
+.br
+
+.br
+Example:
+.br
+$ firejail --profile=kdenlive --appimage kdenlive.appimage
+.br
+
+.br
+.RE
+.PP
+
+
+
+Building a profile manually:
+.PP
+.RS
+Start with the template in /usr/share/doc/firejail/profile.template and modify it in a text editor.
+To integrate the program in your desktop environment copy the profile file in ~/.config/firejail
+directory and run "sudo firecfg".
+.RE
+.PP
+
+Aliases and redirections:
+.PP
+.RS
+In some cases the same profile can be used for several applications.
+One such example is LibreOffice.
+Build a regular profile for the main application, and for the rest use
+/usr/share/doc/firejail/redirect_alias-profile.template.
+.RE
+.PP
+
+Running the profile builder:
+.PP
+.RS
 .TP
-firejail \-\-profile=filename.profile
+\fBfirejail \-\-build=appname.profile appname
+.br
+
+.br
+Example:
+.br
+$ firejail --build=blobby.profile blobby
+.br
+
+.br
+Run the program in "firejail \-\-build" and try to exercise as many program features as possible.
+The profile is extracted and saved in the current directory. Open it in a text editor and add or remove
+sandboxing options as necessary. Test again after modifying the profile. To integrate the program
+in your desktop environment copy the profile file in ~/.config/firejail directory and run "sudo firecfg".
 .RE
-firejail \-\-profile=profile_name
+.PP
 
 .SH DESCRIPTION
 Several command line options can be passed to the program using
@@ -205,6 +271,10 @@ Mount-bind file1 on top of file2. This option is only available when running as
 \fBdisable-mnt
 Disable /mnt, /media, /run/mount and /run/media access.
 .TP
+\fBkeep-config-pulse
+Disable automatic ~/.config/pulse init, for complex setups such as remote
+pulse servers or non-standard socket paths.
+.TP
 \fBkeep-dev-shm
 /dev/shm directory is untouched (even with private-dev).
 .TP
@@ -295,7 +365,9 @@ Use the options no3d, nodvd, nosound, notv, nou2f and novideo for additional res
 Build a new /etc in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
-the /etc directory.
+the /etc directory, and must not contain the / character
+(e.g., /etc/foo must be expressed as foo, but /etc/foo/bar --
+expressed as foo/bar -- is disallowed).
 All modifications are discarded when the sandbox is closed.
 #ifdef HAVE_PRIVATE_HOME
 .TP
@@ -319,14 +391,18 @@ This feature is still under development, see \fBman 1 firejail\fR for some examp
 Build a new /opt in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
-the /opt directory.
+the /opt directory, and must not contain the / character
+(e.g., /opt/foo must be expressed as foo, but /opt/foo/bar --
+expressed as foo/bar -- is disallowed).
 All modifications are discarded when the sandbox is closed.
 .TP
 \fBprivate-srv file,directory
 Build a new /srv in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
-the /srv directory.
+the /srv directory, and must not contain the / character
+(e.g., /srv/foo must be expressed as foo, but /srv/foo/bar --
+expressed as foo/bar -- is disallowed).
 All modifications are discarded when the sandbox is closed.
 .TP
 \fBprivate-tmp
@@ -646,9 +722,8 @@ name browser
 \fBno3d
 Disable 3D hardware acceleration.
 .TP
-\fBnoautopulse
-Disable automatic ~/.config/pulse init, for complex setups such as remote
-pulse servers or non-standard socket paths.
+\fBnoautopulse \fR(deprecated)
+See keep-config-pulse.
 .TP
 \fBnodvd
 Disable DVD and audio CD devices.
@@ -668,6 +743,9 @@ Disable U2F devices.
 \fBnovideo
 Disable video capture devices.
 .TP
+\fBnoinput
+Disable input devices.
+.TP
 \fBshell none
 Run the program directly, without a shell.
 
@@ -882,7 +960,21 @@ Join the sandbox identified by name or start a new one.
 Same as "firejail --join=sandboxname" command if sandbox with specified name exists, otherwise same as "name sandboxname".
 
 .SH FILES
-/etc/firejail/filename.profile, $HOME/.config/firejail/filename.profile
+.TP
+\fB/etc/firejail/appname.profile
+Global Firejail configuration consisting mainly of profiles for each application supported by default.
+
+.TP
+\fB$HOME/.config/firejail/appname.profile
+User application profiles, will take precedence over the global profiles.
+
+.TP
+\fB/usr/share/doc/firejail/profile.template
+Template for building new profiles.
+
+.TP
+\fB/usr/share/doc/firejail/redirect_alias-profile.template
+Template for aliasing/redirecting profiles.
 
 .SH LICENSE
 Firejail is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index f27379a2d..68aea5857 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1052,6 +1052,17 @@ Same as "firejail --join=name" if sandbox with specified name exists, otherwise
 Note that in contrary to other join options there is respective profile option.
 
 .TP
+\fB\-\-keep-config-pulse
+Disable automatic ~/.config/pulse init, for complex setups such as remote
+pulse servers or non-standard socket paths.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-keep-config-pulse firefox
+
+.TP
 \fB\-\-keep-dev-shm
 /dev/shm directory is untouched (even with --private-dev)
 .br
@@ -1460,15 +1471,8 @@ Example:
 $ firejail --no3d firefox
 
 .TP
-\fB\-\-noautopulse
-Disable automatic ~/.config/pulse init, for complex setups such as remote
-pulse servers or non-standard socket paths.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-noautopulse firefox
+\fB\-\-noautopulse \fR(deprecated)
+See --keep-config-pulse.
 
 .TP
 \fB\-\-noblacklist=dirname_or_filename
@@ -1515,6 +1519,15 @@ Example:
 .br
 $ firejail \-\-nodvd
 .TP
+\fB\-\-noinput
+Disable input devices.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-noinput
+.TP
 \fB\-\-noexec=dirname_or_filename
 Remount directory or file noexec, nodev and nosuid. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
 .br
@@ -1883,7 +1896,7 @@ $
 Build a new /etc in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
-the /etc directory.
+the /etc directory (e.g., /etc/foo must be expressed as foo).
 If no listed file is found, /etc directory will be empty.
 All modifications are discarded when the sandbox is closed.
 .br
@@ -1893,7 +1906,7 @@ Example:
 .br
 $ firejail --private-etc=group,hostname,localtime, \\
 .br
-nsswitch.conf,passwd,resolv.conf,default/motd-news
+nsswitch.conf,passwd,resolv.conf
 #ifdef HAVE_PRIVATE_HOME
 .TP
 \fB\-\-private-home=file,directory
@@ -1968,7 +1981,9 @@ $
 Build a new /opt in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
-the /opt directory.
+the /opt directory, and must not contain the / character
+(e.g., /opt/foo must be expressed as foo, but /opt/foo/bar --
+expressed as foo/bar -- is disallowed).
 If no listed file is found, /opt directory will be empty.
 All modifications are discarded when the sandbox is closed.
 .br
@@ -1983,7 +1998,9 @@ $ firejail --private-opt=firefox /opt/firefox/firefox
 Build a new /srv in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
-the /srv directory.
+the /srv directory, and must not contain the / character
+(e.g., /srv/foo must be expressed as foo, but /srv/foo/bar --
+expressed as srv/bar -- is disallowed).
 If no listed file is found, /srv directory will be empty.
 All modifications are discarded when the sandbox is closed.
 .br
diff --git a/src/profstats/main.c b/src/profstats/main.c
index 5035280b1..10e44bd65 100644
--- a/src/profstats/main.c
+++ b/src/profstats/main.c
@@ -46,6 +46,7 @@ static int cnt_whitelistusrshare = 0;	// include whitelist-usr-share-common.inc
 static int cnt_ssh = 0;
 static int cnt_mdwx = 0;
 static int cnt_whitelisthome = 0;
+static int cnt_noroot = 0;
 
 static int level = 0;
 static int arg_debug = 0;
@@ -65,6 +66,7 @@ static int arg_mdwx = 0;
 static int arg_dbus_system_none = 0;
 static int arg_dbus_user_none = 0;
 static int arg_whitelisthome = 0;
+static int arg_noroot = 0;
 
 
 static char *profile = NULL;
@@ -80,6 +82,7 @@ static void usage(void) {
         printf("   --dbus-user-none - profiles without  \"dbus-user none\"\n");
         printf("   --ssh - print profiles without \"include disable-common.inc\"\n");
         printf("   --noexec - print profiles without \"include disable-exec.inc\"\n");
+        printf("   --noroot - print profiles without \"noroot\"\n");
         printf("   --private-bin - print profiles without private-bin\n");
         printf("   --private-dev - print profiles without private-dev\n");
         printf("   --private-etc - print profiles without private-etc\n");
@@ -128,6 +131,8 @@ void process_file(const char *fname) {
                         cnt_caps++;
                 else if (strncmp(ptr, "include disable-exec.inc", 24) == 0)
                         cnt_noexec++;
+                else if (strncmp(ptr, "noroot", 6) == 0)
+                        cnt_noroot++;
                 else if (strncmp(ptr, "include whitelist-var-common.inc", 32) == 0)
                         cnt_whitelistvar++;
                 else if (strncmp(ptr, "include whitelist-runuser-common.inc", 36) == 0 ||
@@ -212,6 +217,8 @@ int main(int argc, char **argv) {
                         arg_mdwx = 1;
                 else if (strcmp(argv[i], "--noexec") == 0)
                         arg_noexec = 1;
+                else if (strcmp(argv[i], "--noroot") == 0)
+                        arg_noroot = 1;
                 else if (strcmp(argv[i], "--private-bin") == 0)
                         arg_privatebin = 1;
                 else if (strcmp(argv[i], "--private-dev") == 0)
@@ -256,6 +263,7 @@ int main(int argc, char **argv) {
                 int caps = cnt_caps;
                 int apparmor = cnt_apparmor;
                 int noexec = cnt_noexec;
+                int noroot = cnt_noroot;
                 int privatebin = cnt_privatebin;
                 int privatetmp = cnt_privatetmp;
                 int privatedev = cnt_privatedev;
@@ -313,6 +321,8 @@ int main(int argc, char **argv) {
                         printf("No seccomp found in %s\n", argv[i]);
                 if (arg_noexec && noexec == cnt_noexec)
                         printf("No include disable-exec.inc found in %s\n", argv[i]);
+                if (arg_noroot && noroot == cnt_noroot)
+                        printf("No noroot found in %s\n", argv[i]);
                 if (arg_privatedev && privatedev == cnt_privatedev)
                         printf("No private-dev found in %s\n", argv[i]);
                 if (arg_privatebin && privatebin == cnt_privatebin)
@@ -346,6 +356,7 @@ int main(int argc, char **argv) {
         printf("    seccomp\t\t\t%d\n", cnt_seccomp);
         printf("    capabilities\t\t%d\n", cnt_caps);
         printf("    noexec\t\t\t%d   (include disable-exec.inc)\n", cnt_noexec);
+        printf("    noroot\t\t\t%d\n", cnt_noroot);
         printf("    memory-deny-write-execute\t%d\n", cnt_mdwx);
         printf("    apparmor\t\t\t%d\n", cnt_apparmor);
         printf("    private-bin\t\t\t%d\n", cnt_privatebin);
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
index fd27bb35f..f1a19b86d 100644
--- a/src/zsh_completion/_firejail.in
+++ b/src/zsh_completion/_firejail.in
@@ -98,6 +98,7 @@ _firejail_args=(
     '*--ignore=-[ignore command in profile files]: :'
     '--ipc-namespace[enable a new IPC namespace]'
     '--join-or-start=-[join the sandbox or start a new one name|pid]: :_all_firejails'
+    '--keep-config-pulse[disable automatic ~/.config/pulse init]'
     '--keep-dev-shm[/dev/shm directory is untouched (even with --private-dev)]'
     '--keep-var-tmp[/var/tmp directory is untouched]'
     '--machine-id[preserve /etc/machine-id]'
@@ -116,6 +117,7 @@ _firejail_args=(
     '--nodvd[disable DVD and audio CD devices]'
     '*--noexec=-[remount the file or directory noexec nosuid and nodev]: :_files'
     '--nogroups[disable supplementary groups]'
+    '--noinput[disable input devices]'
     '--nonewprivs[sets the NO_NEW_PRIVS prctl]'
     '--nosound[disable sound system]'
     '--nou2f[disable U2F devices]'