6 files changed, 35 insertions, 20 deletions

diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 3f1591cbd..23b1e364a 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -423,6 +423,7 @@ kwrite
 leafpad
 # less - breaks man
 libreoffice
+librewolf
 liferea
 lightsoff
 lincity-ng
@@ -462,6 +463,7 @@ mate-calculator
 mate-color-select
 mate-dictionary
 mathematica
+matrix-mirage
 mattermost-desktop
 mcabber
 mediainfo
@@ -473,6 +475,8 @@ mencoder
 mendeleydesktop
 menulibre
 meteo-qt
+microsoft-edge
+microsoft-edge-dev
 midori
 min
 mindless
diff --git a/src/firejail/main.c b/src/firejail/main.c
index b8ed29ece..544bfe83a 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -867,7 +867,8 @@ char *guess_shell(void) {
         shell = getenv("SHELL");
         if (shell) {
                 invalid_filename(shell, 0); // no globbing
-                if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0)
+                if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0 &&
+                    strcmp(shell, PATH_FIREJAIL) != 0)
                         return shell;
         }
 
@@ -3029,8 +3030,15 @@ int main(int argc, char **argv, char **envp) {
                 ptr += strlen(ptr);
 
                 if (!arg_nogroups) {
+                        //  add firejail group
+                        gid_t g = get_group_id("firejail");
+                        if (g) {
+                                sprintf(ptr, "%d %d 1\n", g, g);
+                                ptr += strlen(ptr);
+                        }
+
                         //  add tty group
-                        gid_t g = get_group_id("tty");
+                        g = get_group_id("tty");
                         if (g) {
                                 sprintf(ptr, "%d %d 1\n", g, g);
                                 ptr += strlen(ptr);
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 01df77ee6..d7426f6ae 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -204,11 +204,12 @@ void run_no_sandbox(int argc, char **argv) {
                         break;
                 }
         }
-        // if shell is /usr/bin/firejail, replace it with /bin/bash
-        if (strcmp(cfg.shell, PATH_FIREJAIL) == 0) {
-                cfg.shell = "/bin/bash";
-                prog_index = 0;
-        }
+
+// if shell is /usr/bin/firejail, replace it with /bin/bash
+//      if (strcmp(cfg.shell, PATH_FIREJAIL) == 0) {
+//              cfg.shell = "/bin/bash";
+//              prog_index = 0;
+//      }
 
         if (prog_index == 0) {
                 cfg.command_line = cfg.shell;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index fe9d27ff1..1ee8cdfcb 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -756,6 +756,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                                 fprintf(stderr, "Error: invalid MAC address\n");
                                 exit(1);
                         }
+
+                        // check multicast address
+                        if (br->macsandbox[0] & 1) {
+                                fprintf(stderr, "Error: invalid MAC address (multicast)\n");
+                                exit(1);
+                        }
                 }
                 else
                         warning_feature_disabled("networking");
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 6cc1bc720..a3927cc88 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -29,7 +29,6 @@
 #include <sys/ioctl.h>
 #include <termios.h>
 #include <sys/wait.h>
-#include <sys/syscall.h>
 #include <limits.h>
 
 #include <fcntl.h>
@@ -37,6 +36,7 @@
 #define O_PATH 010000000
 #endif
 
+#include <sys/syscall.h>
 #ifdef __NR_openat2
 #include <linux/openat2.h>
 #endif
@@ -1013,12 +1013,8 @@ int create_empty_dir_as_user(const char *dir, mode_t mode) {
                                 if (chmod(dir, mode) == -1)
                                         {;} // do nothing
                         }
-                        else if (arg_debug) {
-                                char *str;
-                                if (asprintf(&str, "Directory %s not created", dir) == -1)
-                                        errExit("asprintf");
-                                perror(str);
-                        }
+                        else if (arg_debug)
+                                printf("Directory %s not created: %s\n", dir, strerror(errno));
 #ifdef HAVE_GCOV
                         __gcov_flush();
 #endif
@@ -1165,12 +1161,12 @@ void disable_file_path(const char *path, const char *file) {
 
 // open an existing file without following any symbolic link
 int safe_fd(const char *path, int flags) {
+        flags |= O_NOFOLLOW;
         assert(path);
         if (*path != '/' || strstr(path, "..")) {
                 fprintf(stderr, "Error: invalid path %s\n", path);
                 exit(1);
         }
-        flags |= O_NOFOLLOW;
         int fd = -1;
 
 #ifdef __NR_openat2 // kernel 5.6 or better
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 562b3eda3..347e2b31b 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -76,10 +76,10 @@ If an appropriate profile is not found, Firejail will use a default profile.
 The default profile is quite restrictive. In case the application doesn't work, use --noprofile option
 to disable it. For more information, please see \fBSECURITY PROFILES\fR section below.
 .PP
-If a program argument is not specified, Firejail starts /bin/bash shell.
+If a program argument is not specified, Firejail starts the user's preferred shell.
 Examples:
 .PP
-$ firejail [OPTIONS]                # starting a /bin/bash shell
+$ firejail [OPTIONS]                # starting the program specified in $SHELL, usually /bin/bash
 .PP
 $ firejail [OPTIONS] firefox        # starting Mozilla Firefox
 .PP
@@ -2476,7 +2476,7 @@ $ firejail \-\-shell=none script.sh
 \fB\-\-shell=program
 Set default user shell. Use this shell to run the application using \-c shell option.
 For example "firejail \-\-shell=/bin/dash firefox" will start Mozilla Firefox as "/bin/dash \-c firefox".
-By default Bash shell (/bin/bash) is used.
+By default the user's preferred shell is used.
 .br
 
 .br
@@ -3023,7 +3023,7 @@ We provide a tool that automates all this integration, please see \&\flfirecfg\f
 .SH EXAMPLES
 .TP
 \f\firejail
-Sandbox a regular /bin/bash session.
+Sandbox a regular shell session.
 .TP
 \f\firejail firefox
 Start Mozilla Firefox.
@@ -3043,7 +3043,7 @@ Start Firefox in a new network namespace. An IP address is
 assigned automatically.
 .TP
 \f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2
-Start a /bin/bash session in a new network namespace and connect it
+Start a shell session in a new network namespace and connect it
 to br0, br1, and br2 host bridge devices. IP addresses are assigned
 automatically for the interfaces connected to br1 and b2
 #endif