3 files changed, 124 insertions, 16 deletions

diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 4fc710f39..c7c8fd9fa 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -132,12 +132,99 @@ void profile_add_ignore(const char *str) {
 }
 
 
+int profile_check_conditional(char *ptr, int lineno, const char *fname) {
+        struct cond_t {
+                char *name;     // conditional name
+                size_t len;     // length of name
+                bool value;     // true if set
+        } conditionals[] = {
+                {"HAS_APPIMAGE", strlen("HAS_APPIMAGE"), arg_appimage!=0},
+                NULL
+        }, *cond = conditionals;
+        char *tmp = ptr, *msg = NULL;
+
+        if (*ptr++ != '?')
+                return 1;
+
+        while (cond->name) {
+                // continue if not this conditional
+                if (strncmp(ptr, cond->name, cond->len) != 0) {
+                        cond++;
+                        continue;
+                }
+                ptr += cond->len;
+
+                if (*ptr == ' ')
+                        ptr++;
+                if (*ptr++ != ':') {
+                        msg = "invalid syntax: colon must come after conditional";
+                        ptr = tmp;
+                        goto error;
+                }
+                if (*ptr == '\0') {
+                        msg = "invalid conditional line: no profile line after conditional";
+                        ptr = tmp;
+                        goto error;
+                }
+                if (*ptr == ' ')
+                        ptr++;
+
+                // if set, continue processing statement in caller
+                if (cond->value) {
+                        // move ptr to start of profile line
+                        ptr = strdup(ptr);
+                        if (!ptr)
+                                errExit("strdup");
+
+                        // check that the profile line does not contain either
+                        // quiet or include directives
+                        if ((strncmp(ptr, "quiet", 5) == 0) ||
+                            (strncmp(ptr, "include", 7) == 0)) {
+                                msg = "invalid profile line: quiet and include not allowed in conditionals";
+                                ptr = tmp;
+                                goto error;
+                        }
+                        free(tmp);
+
+                        // verify syntax, exit in case of error
+                        if (profile_check_line(ptr, lineno, fname))
+                                profile_add(ptr);
+                }
+                // tell caller to ignore
+                return 0;
+        }
+
+        tmp = ptr;
+        // get the conditional used
+        while (*tmp != ':' && *tmp != '\0')
+                tmp++;
+        *tmp = '\0';
+
+        // this was a '?' prefix, but didn't match any of the conditionals
+        msg = "invalid/unsupported conditional";
+
+error:
+        fprintf(stderr, "Error: %s (\"%s\"", msg, ptr);
+        if (lineno == 0) ;
+        else if (fname != NULL)
+                fprintf(stderr, " on line %d in %s", lineno, fname);
+        else
+                fprintf(stderr, " on line %d in the custom profile", lineno);
+        fprintf(stderr, ")\n");
+        exit(1);
+}
+
+
 // check profile line; if line == 0, this was generated from a command line option
 // return 1 if the command is to be added to the linked list of profile commands
 // return 0 if the command was already executed inside the function
 int profile_check_line(char *ptr, int lineno, const char *fname) {
         EUID_ASSERT();
 
+        // check and process conditional profile lines
+        if (profile_check_conditional(ptr, lineno, fname) == 0)
+                return 0;
+
         // check ignore list
         if (is_in_ignore_list(ptr))
                 return 0;
@@ -1280,7 +1367,7 @@ void profile_read(const char *fname) {
                 if (ptr && strlen(ptr) == 6)
                         return;
 
-                fprintf(stderr, "Error: cannot access profile file\n");
+                fprintf(stderr, "Error: cannot access profile file: %s\n", fname);
                 exit(1);
         }
 
@@ -1342,17 +1429,22 @@ void profile_read(const char *fname) {
                 if (strncmp(ptr, "include ", 8) == 0) {
                         include_level++;
 
-                        // extract profile filename and new skip params
-                        char *newprofile = ptr + 8; // profile name
+                        // expand macros in front of the include profile file
+                        char *newprofile = expand_macros(ptr + 8);
 
-                        // expand ${HOME}/ in front of the new profile file
-                        char *newprofile2 = expand_macros(newprofile);
+                        char *ptr2 = newprofile;
+                        while (*ptr2 != '/' && *ptr2 != '\0')
+                                ptr2++;
+                        // profile path contains no / chars, do a search
+                        if (*ptr2 == '\0') {
+                                profile_find_firejail(newprofile, 0);
+                        }
+                        else {
+                                profile_read(newprofile);
+                        }
 
-                        // recursivity
-                        profile_read((newprofile2)? newprofile2:newprofile);
                         include_level--;
-                        if (newprofile2)
-                                free(newprofile2);
+                        free(newprofile);
                         free(ptr);
                         continue;
                 }
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 5daca8abd..e26b5f989 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -27,7 +27,7 @@ Reading profile /home/netblue/icecat.profile
 .RS
 $ firejail --profile=icecat icecat-wrapper.sh
 .br
-Reading profile /home/netblue/icecat.profile
+Reading profile /etc/firejail/icecat.profile
 .br
 [...]
 .RE
@@ -87,6 +87,18 @@ Example: "blacklist ~/My Virtual Machines"
 \fB# this is a comment
 
 .TP
+\fB?CONDITIONAL: profile line
+Conditionally add profile line.
+
+Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir"
+
+This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line.
+
+Currently the only conditional supported is HAS_APPIMAGE.
+
+The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines.
+
+.TP
 \fBinclude other.profile
 Include other.profile file.
 
@@ -101,6 +113,10 @@ Example: "include ${HOME}/myprofiles/profile1" will load "~/myprofiles/profile1"
 
 Example: "include ${CFG}/firefox.profile" will load "/etc/firejail/firefox.profile" file.
 
+The file name may also be just the name without the leading directory components.  In this case, first the user config directory (${HOME}/.config/firejail) is searched for the file name and if not found then the system configuration directory is search for the file name.  Note: Unlike the \-\-profile option which takes a profile name without the '.profile' suffix, include must be given the full file name.
+
+Example: "include firefox.profile" will load "${HOME}/.config/firejail/firefox.profile" file and if it does not exist "${CFG}/firefox.profile" will be loaded.
+
 System configuration files in ${CFG} are overwritten during software installation.
 Persistent configuration at system level is handled in ".local" files. For every
 profile file in ${CFG} directory, the user can create a corresponding .local file
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 5a374ac55..f7d18536d 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -395,7 +395,7 @@ $ firejail \-\-net=eth0 \-\-defaultgw=10.10.20.1 firefox
 
 .TP
 \fB\-\-disable-mnt
-Disable /mnt, /media, /run/mount and /run/media access.
+Blacklist /mnt, /media, /run/mount and /run/media access.
 .br
 
 .br
@@ -1681,12 +1681,12 @@ Enable seccomp filter and blacklist the syscalls in the default list (@default).
 _sysctl, acct, add_key, adjtimex, afs_syscall, bdflush, bpf, break, chroot, clock_adjtime, clock_settime,
 create_module, delete_module, fanotify_init, finit_module, ftime, get_kernel_syms, getpmsg, gtty, init_module,
 io_cancel, io_destroy, io_getevents, io_setup, io_submit, ioperm, iopl, ioprio_set, kcmp, kexec_file_load,
-kexec_load, keyctl, lock, lookup_dcookie, mbind, mfsservctl, migrate_pages, modify_ldt, mount, move_pages, mpx,
-name_to_handle_at, open_by_handle_at, pciconfig_iobase, pciconfig_read, pciconfig_write, perf_event_open,
-personality, pivot_root, process_vm_readv, process_vm_writev, process_vm_writev, prof, profil, ptrace, putpmsg,
+kexec_load, keyctl, lock, lookup_dcookie, mbind, migrate_pages, modify_ldt, mount, move_pages, mpx,
+name_to_handle_at, nfsservctl, ni_syscall, open_by_handle_at, pciconfig_iobase, pciconfig_read, pciconfig_write, perf_event_open,
+personality, pivot_root, process_vm_readv, process_vm_writev, prof, profil, ptrace, putpmsg,
 query_module, reboot, remap_file_pages, request_key, rtas, s390_mmio_read, s390_mmio_write, s390_runtime_instr,
 security, set_mempolicy, setdomainname, sethostname, settimeofday, sgetmask, ssetmask, stime, stty, subpage_prot,
-swapoff, swapon, switch_endian, sysfs, syslog, tuxcall, ulimit, umount, umount2, uselib, userfaultfd, ustat, vhangup,
+swapoff, swapon, switch_endian, sys_debug_setcontext, sysfs, syslog, tuxcall, ulimit, umount, umount2, uselib, userfaultfd, ustat, vhangup,
 vm86, vm86old, vmsplice and vserver.
 
 .br
@@ -2716,7 +2716,7 @@ Reading profile /home/netblue/icecat.profile
 .RS
 $ firejail --profile=icecat icecat-wrapper.sh
 .br
-Reading profile /home/netblue/icecat.profile
+Reading profile /etc/firejail/icecat.profile
 .br
 [...]
 .RE