180 files changed, 10813 insertions, 3533 deletions

diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in
index f68edf380..ff411c807 100644
--- a/src/bash_completion/firejail.bash_completion.in
+++ b/src/bash_completion/firejail.bash_completion.in
@@ -5,7 +5,7 @@
 # http://bash-completion.alioth.debian.org
 #*******************************************************************
 
-__interfaces(){
+__interfaces() {
     cut -f 1 -d ':' /proc/net/dev | tail -n +3 | grep -v lo | xargs
 }
 
@@ -90,11 +90,11 @@ _firejail()
             _filedir
             return 0
             ;;
-         --net)
-                comps=$(__interfaces)
+        --net)
+            comps=$(__interfaces)
             COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
             return 0
-                ;;
+            ;;
     esac
 
     $split && return 0
diff --git a/src/common.mk.in b/src/common.mk.in
index b379aef7f..38c05bc69 100644
--- a/src/common.mk.in
+++ b/src/common.mk.in
@@ -15,7 +15,6 @@ HAVE_NETWORK=@HAVE_NETWORK@
 HAVE_USERNS=@HAVE_USERNS@
 HAVE_X11=@HAVE_X11@
 HAVE_FILE_TRANSFER=@HAVE_FILE_TRANSFER@
-HAVE_WHITELIST=@HAVE_WHITELIST@
 HAVE_GLOBALCFG=@HAVE_GLOBALCFG@
 HAVE_APPARMOR=@HAVE_APPARMOR@
 HAVE_OVERLAYFS=@HAVE_OVERLAYFS@
@@ -23,11 +22,13 @@ HAVE_FIRETUNNEL=@HAVE_FIRETUNNEL@
 HAVE_PRIVATE_HOME=@HAVE_PRIVATE_HOME@
 HAVE_GCOV=@HAVE_GCOV@
 HAVE_SELINUX=@HAVE_SELINUX@
+HAVE_SUID=@HAVE_SUID@
 HAVE_DBUSPROXY=@HAVE_DBUSPROXY@
 HAVE_USERTMPFS=@HAVE_USERTMPFS@
 HAVE_OUTPUT=@HAVE_OUTPUT@
 HAVE_LTS=@HAVE_LTS@
 HAVE_FORCE_NONEWPRIVS=@HAVE_FORCE_NONEWPRIVS@
+HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@
 
 H_FILE_LIST       = $(sort $(wildcard *.h))
 C_FILE_LIST       = $(sort $(wildcard *.c))
@@ -36,11 +37,11 @@ BINOBJS =  $(foreach file, $(OBJS), $file)
 
 CFLAGS = @CFLAGS@
 CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
-CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"'
-MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX) $(HAVE_FORCE_NONEWPRIVS)
+CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"'   -DVARDIR='"/var/lib/firejail"'
+MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES)
 CFLAGS += $(MANFLAGS)
 CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security
-LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now -lpthread
+LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now
 EXTRA_LDFLAGS +=@EXTRA_LDFLAGS@
 
 ifdef NO_EXTRA_CFLAGS
diff --git a/src/fbuilder/build_bin.c b/src/fbuilder/build_bin.c
index 9577042c4..041c52629 100644
--- a/src/fbuilder/build_bin.c
+++ b/src/fbuilder/build_bin.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c
index 8700e0ba1..4766337ff 100644
--- a/src/fbuilder/build_fs.c
+++ b/src/fbuilder/build_fs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -236,9 +236,6 @@ void build_share(const char *fname, FILE *fp) {
 //*******************************************
 static FileDB *tmp_out = NULL;
 static void tmp_callback(char *ptr) {
-        // skip strace file
-        if (strncmp(ptr, "/tmp/firejail-strace", 20) == 0)
-                return;
         if (strncmp(ptr, "/tmp/runtime-", 13) == 0)
                 return;
         if (strcmp(ptr, "/tmp") == 0)
diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c
index b3ec6cffd..d6d421259 100644
--- a/src/fbuilder/build_home.c
+++ b/src/fbuilder/build_home.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -68,6 +68,8 @@ void process_home(const char *fname, char *home, int home_len) {
                         ptr += 7;
                 else if (strncmp(ptr, "open /home", 10) == 0)
                         ptr += 5;
+                else if (strncmp(ptr, "opendir /home", 13) == 0)
+                        ptr += 8;
                 else
                         continue;
 
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c
index fb53f70a6..941f43562 100644
--- a/src/fbuilder/build_profile.c
+++ b/src/fbuilder/build_profile.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -22,22 +22,6 @@
 #include <sys/wait.h>
 
 #define TRACE_OUTPUT "/tmp/firejail-trace.XXXXXX"
-#define STRACE_OUTPUT "/tmp/firejail-strace.XXXXXX"
-
-/* static char *cmdlist[] = { */
-/*      "/usr/bin/firejail", */
-/*      "--quiet", */
-/*      "--output=" TRACE_OUTPUT, */
-/*      "--noprofile", */
-/*      "--caps.drop=all", */
-/*      "--nonewprivs", */
-/*      "--trace", */
-/*      "--shell=none", */
-/*      "/usr/bin/strace", // also used as a marker in build_profile() */
-/*      "-c", */
-/*      "-f", */
-/*      "-o" STRACE_OUTPUT, */
-/* }; */
 
 void build_profile(int argc, char **argv, int index, FILE *fp) {
         // next index is the application name
@@ -47,78 +31,42 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
         }
 
         char trace_output[] = "/tmp/firejail-trace.XXXXXX";
-        char strace_output[] = "/tmp/firejail-strace.XXXXXX";
-
         int tfile = mkstemp(trace_output);
-        int stfile = mkstemp(strace_output);
-        if(tfile == -1 || stfile == -1)
+        if(tfile == -1)
                 errExit("mkstemp");
-
-        // close the files, firejail/strace will overwrite them!
         close(tfile);
-        close(stfile);
-
 
         char *output;
-        char *stroutput;
         if(asprintf(&output,"--trace=%s",trace_output) == -1)
                 errExit("asprintf");
-        if(asprintf(&stroutput,"-o%s",strace_output) == -1)
-                errExit("asprintf");
-
-        char *cmdlist[] = {
-          BINDIR "/firejail",
-          "--quiet",
-          "--noprofile",
-          "--caps.drop=all",
-          "--nonewprivs",
-          output,
-          "--shell=none",
-          "/usr/bin/strace", // also used as a marker in build_profile()
-          "-c",
-          "-f",
-          stroutput,
-        };
-
-        // detect strace and check if Yama LSM allows us to use it
-        int have_strace = 0;
-        int have_yama_permission = 1;
-        if (access("/usr/bin/strace", X_OK) == 0) {
-                have_strace = 1;
-                FILE *ps = fopen("/proc/sys/kernel/yama/ptrace_scope", "r");
-                if (ps) {
-                        unsigned val;
-                        if (fscanf(ps, "%u", &val) == 1)
-                                have_yama_permission = (val < 2);
-                        fclose(ps);
-                }
-        }
 
         // calculate command length
-        unsigned len = (int) sizeof(cmdlist) / sizeof(char*) + argc - index + 1;
-        if (arg_debug)
-                printf("command len %d + %d + 1\n", (int) (sizeof(cmdlist) / sizeof(char*)), argc - index);
-        char *cmd[len];
-        cmd[0] = cmdlist[0];    // explicit assignment to clean scan-build error
+        unsigned len = 64;      // plenty of space for firejail command line
+        len += argc - index;    // program command line
+        len += 1;               // NULL
 
         // build command
-        // skip strace if not installed, or no permission to use it
-        int skip_strace = !(have_strace && have_yama_permission);
-        unsigned i = 0;
-        for (i = 0; i < (int) sizeof(cmdlist) / sizeof(char*); i++) {
-                if (skip_strace && strcmp(cmdlist[i], "/usr/bin/strace") == 0)
-                        break;
-                cmd[i] = cmdlist[i];
-        }
-
-        int i2 = index;
-        for (; i < (len - 1); i++, i2++)
-                cmd[i] = argv[i2];
-        assert(i < len);
-        cmd[i] = NULL;
+        char *cmd[len];
+        unsigned curr_len = 0;
+        cmd[curr_len++] = BINDIR "/firejail";
+        cmd[curr_len++] = "--quiet";
+        cmd[curr_len++] = "--noprofile";
+        cmd[curr_len++] = "--caps.drop=all";
+        cmd[curr_len++] = "--seccomp=!chroot";
+        cmd[curr_len++] = "--shell=none";
+        cmd[curr_len++] = output;
+        if (arg_appimage)
+                cmd[curr_len++] = "--appimage";
+
+        int i;
+        for (i = index; i < argc; i++)
+                cmd[curr_len++] = argv[i];
+
+        assert(curr_len < len);
+        cmd[curr_len] = NULL;
 
         if (arg_debug) {
-                for (i = 0; i < len; i++)
+                for (i = 0; cmd[i]; i++)
                         printf("%s%s\n", (i)?"\t":"", cmd[i]);
         }
 
@@ -140,14 +88,14 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
 
         if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
                 if (fp == stdout)
-                        printf("--- Built profile beings after this line ---\n");
+                        printf("--- Built profile begins after this line ---\n");
                 fprintf(fp, "# Save this file as \"application.profile\" (change \"application\" with the\n");
                 fprintf(fp, "# program name) in ~/.config/firejail directory. Firejail will find it\n");
                 fprintf(fp, "# automatically every time you sandbox your application.\n#\n");
                 fprintf(fp, "# Run \"firejail application\" to test it. In the file there are\n");
-                fprintf(fp, "# some other commands you can try. Enable them by removing the \"#\".\n");
+                fprintf(fp, "# some other commands you can try. Enable them by removing the \"#\".\n\n");
 
-                fprintf(fp, "\n# Firejail profile for %s\n", argv[index]);
+                fprintf(fp, "# Firejail profile for %s\n", argv[index]);
                 fprintf(fp, "# Persistent local customizations\n");
                 fprintf(fp, "#include %s.local\n", argv[index]);
                 fprintf(fp, "# Persistent global definitions\n");
@@ -158,58 +106,62 @@ void build_profile(int argc, char **argv, int index, FILE *fp) {
                 fprintf(fp, "### Enable as many of them as you can! A very important one is\n");
                 fprintf(fp, "### \"disable-exec.inc\". This will make among other things your home\n");
                 fprintf(fp, "### and /tmp directories non-executable.\n");
-                fprintf(fp, "include disable-common.inc\n");
-                fprintf(fp, "#include disable-devel.inc\n");
-                fprintf(fp, "#include disable-exec.inc\n");
-                fprintf(fp, "#include disable-interpreters.inc\n");
-                fprintf(fp, "include disable-passwdmgr.inc\n");
-                fprintf(fp, "include disable-programs.inc\n");
-                fprintf(fp, "#include disable-xdg.inc\n");
+                fprintf(fp, "include disable-common.inc\t# dangerous directories like ~/.ssh and ~/.gnupg\n");
+                fprintf(fp, "#include disable-devel.inc\t# development tools such as gcc and gdb\n");
+                fprintf(fp, "#include disable-exec.inc\t# non-executable directories such as /var, /tmp, and /home\n");
+                fprintf(fp, "#include disable-interpreters.inc\t# perl, python, lua etc.\n");
+                fprintf(fp, "include disable-programs.inc\t# user configuration for programs such as firefox, vlc etc.\n");
+                fprintf(fp, "#include disable-shell.inc\t# sh, bash, zsh etc.\n");
+                fprintf(fp, "#include disable-xdg.inc\t# standard user directories: Documents, Pictures, Videos, Music\n");
                 fprintf(fp, "\n");
 
                 fprintf(fp, "### Home Directory Whitelisting ###\n");
                 fprintf(fp, "### If something goes wrong, this section is the first one to comment out.\n");
                 fprintf(fp, "### Instead, you'll have to relay on the basic blacklisting above.\n");
                 build_home(trace_output, fp);
+                fprintf(fp, "\n");
 
-                fprintf(fp, "\n### The Rest of the Filesystem ###\n");
+                fprintf(fp, "### Filesystem Whitelisting ###\n");
                 build_share(trace_output, fp);
+                //todo: include whitelist-runuser-common.inc
                 build_var(trace_output, fp);
-                build_bin(trace_output, fp);
-                build_dev(trace_output, fp);
-                fprintf(fp, "#nodvd\n");
-                fprintf(fp, "#noinput\n");
-                fprintf(fp, "#notv\n");
-                fprintf(fp, "#nou2f\n");
-                fprintf(fp, "#novideo\n");
-                build_etc(trace_output, fp);
-                build_tmp(trace_output, fp);
+                fprintf(fp, "\n");
 
-                fprintf(fp, "\n### Security Filters ###\n");
-                fprintf(fp, "#apparmor\n");
+                fprintf(fp, "#apparmor\t# if you have AppArmor running, try this one!\n");
                 fprintf(fp, "caps.drop all\n");
+                fprintf(fp, "ipc-namespace\n");
                 fprintf(fp, "netfilter\n");
-                fprintf(fp, "#nogroups\n");
-                fprintf(fp, "#noroot\n");
+                fprintf(fp, "#no3d\t# disable 3D acceleration\n");
+                fprintf(fp, "#nodvd\t# disable DVD and CD devices\n");
+                fprintf(fp, "#nogroups\t# disable supplementary user groups\n");
+                fprintf(fp, "#noinput\t# disable input devices\n");
                 fprintf(fp, "nonewprivs\n");
+                fprintf(fp, "noroot\n");
+                fprintf(fp, "#notv\t# disable DVB TV devices\n");
+                fprintf(fp, "#nou2f\t# disable U2F devices\n");
+                fprintf(fp, "#novideo\t# disable video capture devices\n");
                 build_protocol(trace_output, fp);
+                fprintf(fp, "seccomp !chroot\t# allowing chroot, just in case this is an Electron app\n");
+                fprintf(fp, "shell none\n");
+                fprintf(fp, "tracelog\n");
+                fprintf(fp, "\n");
+
+                fprintf(fp, "#disable-mnt\t# no access to /mnt, /media, /run/mount and /run/media\n");
+                build_bin(trace_output, fp);
+                fprintf(fp, "#private-cache\t# run with an empty ~/.cache directory\n");
+                build_dev(trace_output, fp);
+                build_etc(trace_output, fp);
+                fprintf(fp, "#private-lib\n");
+                build_tmp(trace_output, fp);
+                fprintf(fp, "\n");
+
+                fprintf(fp, "#dbus-user none\n");
+                fprintf(fp, "#dbus-system none\n");
+                fprintf(fp, "\n");
+                fprintf(fp, "#memory-deny-write-execute\n");
 
-                fprintf(fp, "seccomp\n");
-                if (!have_strace) {
-                        fprintf(fp, "### If you install strace on your system, Firejail will also create a\n");
-                        fprintf(fp, "### whitelisted seccomp filter.\n");
-                }
-                else if (!have_yama_permission)
-                        fprintf(fp, "### Yama security module prevents creation of a whitelisted seccomp filter\n");
-                else
-                        build_seccomp(strace_output, fp);
-                fprintf(fp, "#shell none\n");
-                fprintf(fp, "#tracelog\n");
-
-                if (!arg_debug) {
+                if (!arg_debug)
                         unlink(trace_output);
-                        unlink(strace_output);
-                }
         }
         else {
                 fprintf(stderr, "Error: cannot run the sandbox\n");
diff --git a/src/fbuilder/build_seccomp.c b/src/fbuilder/build_seccomp.c
index dc3cce456..7b4727e1a 100644
--- a/src/fbuilder/build_seccomp.c
+++ b/src/fbuilder/build_seccomp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,6 +20,7 @@
 
 #include "fbuilder.h"
 
+#if 0
 void build_seccomp(const char *fname, FILE *fp) {
         assert(fname);
         assert(fp);
@@ -78,15 +79,17 @@ void build_seccomp(const char *fname, FILE *fp) {
 
         fclose(fp2);
 }
+#endif
 
 //***************************************
 // protocol
 //***************************************
-int unix_s = 0;
-int inet = 0;
-int inet6 = 0;
-int netlink = 0;
-int packet = 0;
+static int unix_s = 0;
+static int inet = 0;
+static int inet6 = 0;
+static int netlink = 0;
+static int packet = 0;
+static int bluetooth = 0;
 static void process_protocol(const char *fname) {
         assert(fname);
 
@@ -135,6 +138,8 @@ static void process_protocol(const char *fname) {
                         netlink = 1;
                 else if (strncmp(ptr, "AF_PACKET ", 10) == 0)
                         packet = 1;
+                else if (strncmp(ptr, "AF_BLUETOOTH ", 13) == 0)
+                        bluetooth = 1;
         }
 
         fclose(fp);
@@ -161,22 +166,22 @@ void build_protocol(const char *fname, FILE *fp) {
         }
 
         int net = 0;
-        if (unix_s || inet || inet6 || netlink || packet) {
+        if (unix_s || inet || inet6 || netlink || packet || bluetooth) {
                 fprintf(fp, "protocol ");
                 if (unix_s)
                         fprintf(fp, "unix,");
-                if (inet) {
-                        fprintf(fp, "inet,");
-                        net = 1;
-                }
-                if (inet6) {
-                        fprintf(fp, "inet6,");
+                if (inet || inet6) {
+                        fprintf(fp, "inet,inet6,");
                         net = 1;
                 }
                 if (netlink)
                         fprintf(fp, "netlink,");
                 if (packet) {
-                        fprintf(fp, "packet");
+                        fprintf(fp, "packet,");
+                        net = 1;
+                }
+                if (bluetooth) {
+                        fprintf(fp, "bluetooth");
                         net = 1;
                 }
                 fprintf(fp, "\n");
diff --git a/src/fbuilder/fbuilder.h b/src/fbuilder/fbuilder.h
index 08dd35e10..3e23d7854 100644
--- a/src/fbuilder/fbuilder.h
+++ b/src/fbuilder/fbuilder.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -31,6 +31,7 @@
 #define MAX_BUF 4096
 // main.c
 extern int arg_debug;
+extern int arg_appimage;
 
 // build_profile.c
 void build_profile(int argc, char **argv, int index, FILE *fp);
diff --git a/src/fbuilder/filedb.c b/src/fbuilder/filedb.c
index 94a226cb7..454b9f40b 100644
--- a/src/fbuilder/filedb.c
+++ b/src/fbuilder/filedb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fbuilder/main.c b/src/fbuilder/main.c
index f4917aefc..aa49b2489 100644
--- a/src/fbuilder/main.c
+++ b/src/fbuilder/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -19,6 +19,7 @@
 */
 #include "fbuilder.h"
 int arg_debug = 0;
+int arg_appimage = 0;
 
 static void usage(void) {
         printf("Firejail profile builder\n");
@@ -39,7 +40,7 @@ printf("\n");
         int i;
         int prog_index = 0;
         FILE *fp = stdout;
-        int prof_file = 0;
+        char *prof_file = NULL;
 
         // parse arguments and extract program index
         for (i = 1; i < argc; i++) {
@@ -49,6 +50,8 @@ printf("\n");
                 }
                 else if (strcmp(argv[i], "--debug") == 0)
                         arg_debug = 1;
+                else if (strcmp(argv[i], "--appimage") == 0)
+                        arg_appimage = 1;
                 else if (strcmp(argv[i], "--build") == 0)
                         ; // do nothing, this is passed down from firejail
                 else if (strncmp(argv[i], "--build=", 8) == 0) {
@@ -58,18 +61,23 @@ printf("\n");
                                 exit(1);
                         }
 
+                        // don't run if the file exists
+                        if (access(argv[i] + 8, F_OK) == 0) {
+                                fprintf(stderr, "Error: the profile file already exists. Please use a different file name.\n");
+                                exit(1);
+                        }
+
                         // check file access
                         fp = fopen(argv[i] + 8, "w");
                         if (!fp) {
-                                fprintf(stderr, "Error fbuild: cannot open profile file.\n");
+                                fprintf(stderr, "Error: cannot open profile file.\n");
                                 exit(1);
                         }
-                        prof_file = 1;
-                        // do nothing, this is passed down from firejail
+                        prof_file = argv[i] + 8;
                 }
                 else {
                         if (*argv[i] == '-') {
-                                fprintf(stderr, "Error fbuilder: invalid program\n");
+                                fprintf(stderr, "Error: invalid program\n");
                                 usage();
                                 exit(1);
                         }
@@ -79,10 +87,13 @@ printf("\n");
         }
 
         if (prog_index == 0) {
-                fprintf(stderr, "Error fbuilder: program and arguments required\n");
+                fprintf(stderr, "Error : program and arguments required\n");
                 usage();
-                if (prof_file)
+                if (prof_file) {
                         fclose(fp);
+                        int rv = unlink(prof_file);
+                        (void) rv;
+                }
                 exit(1);
         }
 
diff --git a/src/fbuilder/utils.c b/src/fbuilder/utils.c
index 52493f470..f89e69679 100644
--- a/src/fbuilder/utils.c
+++ b/src/fbuilder/utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fcopy/main.c b/src/fcopy/main.c
index 572e9f601..e56d853c8 100644
--- a/src/fcopy/main.c
+++ b/src/fcopy/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -19,11 +19,15 @@
  */
 
 #include "../include/common.h"
-#include <fcntl.h>
 #include <ftw.h>
 #include <errno.h>
 #include <pwd.h>
 
+#include <fcntl.h>
+#ifndef O_PATH
+#define O_PATH 010000000
+#endif
+
 #if HAVE_SELINUX
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -55,7 +59,7 @@ static void selinux_relabel_path(const char *path, const char *inside_path) {
         assert(path);
         assert(inside_path);
 #if HAVE_SELINUX
-        char procfs_path[64];
+        char procfs_path[64];
         char *fcon = NULL;
         int fd;
         struct stat st;
@@ -69,20 +73,24 @@ static void selinux_relabel_path(const char *path, const char *inside_path) {
         if (!label_hnd)
                 label_hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
 
+        if (!label_hnd)
+                errExit("selabel_open");
+
         /* Open the file as O_PATH, to pin it while we determine and adjust the label */
-        fd = open(path, O_NOFOLLOW|O_CLOEXEC|O_PATH);
+        fd = open(path, O_NOFOLLOW|O_CLOEXEC|O_PATH);
         if (fd < 0)
                 return;
         if (fstat(fd, &st) < 0)
                 goto close;
 
-        if (selabel_lookup_raw(label_hnd, &fcon, inside_path, st.st_mode)  == 0) {
+        if (selabel_lookup_raw(label_hnd, &fcon, inside_path, st.st_mode)  == 0) {
                 sprintf(procfs_path, "/proc/self/fd/%i", fd);
                 if (arg_debug)
                         printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon);
 
-                setfilecon_raw(procfs_path, fcon);
-        }
+                if (setfilecon_raw(procfs_path, fcon) != 0 && arg_debug)
+                        printf("Cannot relabel %s: %s\n", path, strerror(errno));
+        }
         freecon(fcon);
  close:
         close(fd);
@@ -192,7 +200,8 @@ static char *proc_pid_to_self(const char *target) {
 
         // check where /proc/self points to
         static const char proc_self[] = "/proc/self";
-        if (!(proc_pid = realpath(proc_self, NULL)))
+        proc_pid = realpath(proc_self, NULL);
+        if (proc_pid == NULL)
                 goto done;
 
         // redirect /proc/PID/xxx -> /proc/self/XXX
@@ -340,7 +349,7 @@ static char *check(const char *src) {
 
 errexit:
         free(rsrc);
-        fprintf(stderr, "Error fcopy: invalid file %s\n", src);
+        fprintf(stderr, "Error fcopy: invalid ownership for file %s\n", src);
         exit(1);
 }
 
@@ -463,18 +472,12 @@ int main(int argc, char **argv) {
         size_t len = strlen(src);
         while (len > 1 && src[len - 1] == '/')
                 src[--len] = '\0';
-        if (strcspn(src, "\\*&!?\"'<>%^(){}[];,") != len) {
-                fprintf(stderr, "Error fcopy: invalid source file name %s\n", src);
-                exit(1);
-        }
+        reject_meta_chars(src, 0);
 
         len = strlen(dest);
         while (len > 1 && dest[len - 1] == '/')
                 dest[--len] = '\0';
-        if (strcspn(dest, "\\*&!?\"'<>%^(){}[];,~") != len) {
-                fprintf(stderr, "Error fcopy: invalid dest file name %s\n", dest);
-                exit(1);
-        }
+        reject_meta_chars(dest, 0);
 
         // the destination should be a directory;
         struct stat s;
diff --git a/src/fids/Makefile.in b/src/fids/Makefile.in
new file mode 100644
index 000000000..5530bcee2
--- /dev/null
+++ b/src/fids/Makefile.in
@@ -0,0 +1,18 @@
+.PHONY: all
+all: fids
+
+include ../common.mk
+
+%.o : %.c $(H_FILE_LIST) ../include/common.h
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+
+#fseccomp: $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o
+fids: $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+
+.PHONY: clean
+clean:; rm -fr *.o fids *.gcov *.gcda *.gcno *.plist
+
+.PHONY: distclean
+distclean: clean
+        rm -fr Makefile
diff --git a/src/fids/blake2b.c b/src/fids/blake2b.c
new file mode 100644
index 000000000..ec7cf8602
--- /dev/null
+++ b/src/fids/blake2b.c
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+/* A simple unkeyed BLAKE2b Implementation based on the official reference
+ * from https://github.com/BLAKE2/BLAKE2.
+ *
+ * The original code was released under CC0 1.0 Universal license (Creative Commons),
+ * a public domain license.
+ */
+
+#include "fids.h"
+
+// little-endian vs big-endian is irrelevant since the checksum is calculated and checked on the same computer.
+static inline uint64_t load64( const void *src ) {
+        uint64_t w;
+        memcpy( &w, src, sizeof( w ) );
+        return w;
+}
+
+// mixing function
+#define ROTR64(x, y)  (((x) >> (y)) ^ ((x) << (64 - (y))))
+#define G(a, b, c, d, x, y) {   \
+                v[a] = v[a] + v[b] + x;         \
+                v[d] = ROTR64(v[d] ^ v[a], 32); \
+                v[c] = v[c] + v[d];             \
+                v[b] = ROTR64(v[b] ^ v[c], 24); \
+                v[a] = v[a] + v[b] + y;         \
+                v[d] = ROTR64(v[d] ^ v[a], 16); \
+                v[c] = v[c] + v[d];             \
+                v[b] = ROTR64(v[b] ^ v[c], 63); }
+
+// init vector
+static const uint64_t iv[8] = {
+        0x6A09E667F3BCC908, 0xBB67AE8584CAA73B,
+        0x3C6EF372FE94F82B, 0xA54FF53A5F1D36F1,
+        0x510E527FADE682D1, 0x9B05688C2B3E6C1F,
+        0x1F83D9ABFB41BD6B, 0x5BE0CD19137E2179
+};
+
+
+const uint8_t sigma[12][16] = {
+        { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
+        { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
+        { 11, 8, 12, 0, 5, 2, 15, 13, 10, 14, 3, 6, 7, 1, 9, 4 },
+        { 7, 9, 3, 1, 13, 12, 11, 14, 2, 6, 5, 10, 4, 0, 15, 8 },
+        { 9, 0, 5, 7, 2, 4, 10, 15, 14, 1, 11, 12, 6, 8, 3, 13 },
+        { 2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9 },
+        { 12, 5, 1, 15, 14, 13, 4, 10, 0, 7, 6, 3, 9, 2, 8, 11 },
+        { 13, 11, 7, 14, 12, 1, 3, 9, 5, 0, 15, 4, 8, 6, 2, 10 },
+        { 6, 15, 14, 9, 11, 3, 0, 8, 12, 2, 13, 7, 1, 4, 10, 5 },
+        { 10, 2, 8, 4, 7, 6, 1, 5, 15, 11, 9, 14, 3, 12, 13, 0 },
+        { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
+        { 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 }
+};
+
+// blake2b context
+typedef struct {
+        uint8_t b[128];                     // input buffer
+        uint64_t h[8];                      // chained state
+        uint64_t t[2];                      // total number of bytes
+        size_t c;                           // pointer for b[]
+        size_t outlen;                      // digest size
+} CTX;
+
+// compress function
+static void compress(CTX *ctx, int last) {
+        uint64_t m[16];
+        uint64_t v[16];
+        size_t i;
+
+        for (i = 0; i < 16; i++)
+                m[i] = load64(&ctx->b[8 * i]);
+
+        for (i = 0; i < 8; i++) {
+                v[i] = ctx->h[i];
+                v[i + 8] = iv[i];
+        }
+
+        v[12] ^= ctx->t[0];
+        v[13] ^= ctx->t[1];
+        if (last)
+                v[14] = ~v[14];
+
+        for (i = 0; i < 12; i++) {
+                G( 0, 4,  8, 12, m[sigma[i][ 0]], m[sigma[i][ 1]]);
+                G( 1, 5,  9, 13, m[sigma[i][ 2]], m[sigma[i][ 3]]);
+                G( 2, 6, 10, 14, m[sigma[i][ 4]], m[sigma[i][ 5]]);
+                G( 3, 7, 11, 15, m[sigma[i][ 6]], m[sigma[i][ 7]]);
+                G( 0, 5, 10, 15, m[sigma[i][ 8]], m[sigma[i][ 9]]);
+                G( 1, 6, 11, 12, m[sigma[i][10]], m[sigma[i][11]]);
+                G( 2, 7,  8, 13, m[sigma[i][12]], m[sigma[i][13]]);
+                G( 3, 4,  9, 14, m[sigma[i][14]], m[sigma[i][15]]);
+        }
+
+        for( i = 0; i < 8; ++i )
+                ctx->h[i] ^= v[i] ^ v[i + 8];
+}
+
+static int init(CTX *ctx, size_t outlen) {      // (keylen=0: no key)
+        size_t i;
+
+        if (outlen == 0 || outlen > 64)
+                return -1;
+
+        for (i = 0; i < 8; i++)
+                ctx->h[i] = iv[i];
+        ctx->h[0] ^= 0x01010000  ^ outlen;
+
+        ctx->t[0] = 0;
+        ctx->t[1] = 0;
+        ctx->c = 0;
+        ctx->outlen = outlen;
+
+        return 0;
+}
+
+static void update(CTX *ctx, const void *in, size_t inlen) {
+        size_t i;
+
+        for (i = 0; i < inlen; i++) {
+                if (ctx->c == 128) {
+                        ctx->t[0] += ctx->c;
+                        if (ctx->t[0] < ctx->c)
+                                ctx->t[1]++;
+                        compress(ctx, 0);
+                        ctx->c = 0;
+                }
+                ctx->b[ctx->c++] = ((const uint8_t *) in)[i];
+        }
+}
+
+static void final(CTX *ctx, void *out) {
+        size_t i;
+
+        ctx->t[0] += ctx->c;
+        if (ctx->t[0] < ctx->c)
+                ctx->t[1]++;
+
+        while (ctx->c < 128)
+                ctx->b[ctx->c++] = 0;
+        compress(ctx, 1);
+
+        for (i = 0; i < ctx->outlen; i++) {
+                ((uint8_t *) out)[i] =
+                        (ctx->h[i >> 3] >> (8 * (i & 7))) & 0xFF;
+        }
+}
+
+// public function
+int blake2b(void *out, size_t outlen, const void *in, size_t inlen) {
+        CTX ctx;
+
+        if (init(&ctx, outlen))
+                return -1;
+        update(&ctx, in, inlen);
+        final(&ctx, out);
+
+        return 0;
+}
diff --git a/src/fids/config b/src/fids/config
new file mode 100644
index 000000000..c18c97260
--- /dev/null
+++ b/src/fids/config
@@ -0,0 +1,16 @@
+/bin
+/sbin
+/usr/bin
+/usr/sbin
+/usr/games
+/opt
+/usr/share/ca-certificates
+
+
+/home/netblue/.bashrc
+/home/netblue/.config/firejail
+/home/netblue/.config/autostart
+/home/netblue/Desktop/*.desktop
+/home/netblue/.ssh
+/home/netblue/.gnupg
+
diff --git a/src/fids/db.c b/src/fids/db.c
new file mode 100644
index 000000000..e8dfab1ac
--- /dev/null
+++ b/src/fids/db.c
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include"fids.h"
+
+typedef struct db_t {
+        struct db_t *next;
+        char *fname;
+        char *checksum;
+        char *mode;
+        int checked;
+} DB;
+
+#define MAXBUF 4096
+static DB *database[HASH_MAX] = {NULL};
+
+// djb2 hash function by Dan Bernstein
+static unsigned hash(const char *str) {
+        unsigned long hash = 5381;
+        int c;
+
+        while ((c = *str++) != '\0')
+                hash = ((hash << 5) + hash) + c; /* hash * 33 + c */
+
+        return hash & (HASH_MAX - 1);
+}
+
+#if 0
+// for testing the hash table
+static void db_print(void) {
+        int i;
+        for (i = 0; i < HASH_MAX; i++) {
+                int cnt = 0;
+                DB *ptr = database[i];
+                while (ptr) {
+                        cnt++;
+                        ptr = ptr->next;
+                }
+                printf("%d ", cnt);
+                fflush(0);
+        }
+        printf("\n");
+}
+#endif
+
+static void db_add(const char *fname, const char *checksum, const char *mode) {
+        DB *ptr = malloc(sizeof(DB));
+        if (!ptr)
+                errExit("malloc");
+        ptr->fname = strdup(fname);
+        ptr->checksum = strdup(checksum);
+        ptr->mode = strdup(mode);
+        ptr->checked = 0;
+        if (!ptr->fname || !ptr->checksum || !ptr->mode)
+                errExit("strdup");
+
+        unsigned h = hash(fname);
+        ptr->next = database[h];
+        database[h] = ptr;
+}
+
+void db_check(const char *fname, const char *checksum, const char *mode) {
+        assert(fname);
+        assert(checksum);
+        assert(mode);
+
+        unsigned h =hash(fname);
+        DB *ptr = database[h];
+        while (ptr) {
+                if (strcmp(fname, ptr->fname) == 0) {
+                        ptr->checked = 1;
+                        break;
+                }
+                ptr = ptr->next;
+        }
+
+        if (ptr ) {
+                if (strcmp(checksum, ptr->checksum)) {
+                        f_modified++;
+                        fprintf(stderr, "\nWarning: modified %s\n", fname);
+                }
+                if (strcmp(mode, ptr->mode)) {
+                        f_permissions++;
+                        fprintf(stderr, "\nWarning: permissions %s: old %s, new %s\n",
+                                fname, ptr->mode, mode);
+                }
+        }
+        else {
+                f_new++;
+                fprintf(stderr, "\nWarning: new file %s\n", fname);
+        }
+}
+
+void db_missing(void) {
+        int i;
+        for (i = 0; i < HASH_MAX; i++) {
+                DB *ptr = database[i];
+                while (ptr) {
+                        if (!ptr->checked) {
+                                f_removed++;
+                                fprintf(stderr, "Warning: removed %s\n", ptr->fname);
+                        }
+                        ptr = ptr->next;
+                }
+        }
+}
+
+// return 0 if ok, 1 if error
+int db_init(void) {
+        char buf[MAXBUF];
+        while(fgets(buf, MAXBUF, stdin)) {
+                // split - tab separated
+
+                char *mode = buf;
+                char *ptr = strchr(buf, '\t');
+                if (!ptr)
+                        goto errexit;
+                *ptr = '\0';
+
+                char *checksum = ptr + 1;
+                ptr = strchr(checksum, '\t');
+                if (!ptr)
+                        goto errexit;
+                *ptr = '\0';
+
+                char *fname = ptr + 1;
+                ptr = strchr(fname, '\n');
+                if (!ptr)
+                        goto errexit;
+                *ptr = '\0';
+
+                db_add(fname, checksum, mode);
+        }
+//      db_print();
+
+        return 0;
+
+errexit:
+        fprintf(stderr, "Error fids: database corrupted\n");
+        exit(1);
+}
+
diff --git a/src/fids/db_exclude.c b/src/fids/db_exclude.c
new file mode 100644
index 000000000..cfb37219c
--- /dev/null
+++ b/src/fids/db_exclude.c
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include"fids.h"
+
+typedef struct db_exclude_t {
+        struct db_exclude_t *next;
+        char *fname;
+        int len;
+} DB_EXCLUDE;
+static DB_EXCLUDE *database = NULL;
+
+void db_exclude_add(const char *fname) {
+        assert(fname);
+
+        DB_EXCLUDE *ptr = malloc(sizeof(DB_EXCLUDE));
+        if (!ptr)
+                errExit("malloc");
+
+        ptr->fname = strdup(fname);
+        if (!ptr->fname)
+                errExit("strdup");
+        ptr->len = strlen(fname);
+        ptr->next = database;
+        database = ptr;
+}
+
+int db_exclude_check(const char *fname) {
+        assert(fname);
+
+        DB_EXCLUDE *ptr = database;
+        while (ptr != NULL) {
+                if (strncmp(fname, ptr->fname, ptr->len) == 0)
+                        return 1;
+                ptr = ptr->next;
+        }
+
+        return 0;
+}
+
diff --git a/src/fids/fids.h b/src/fids/fids.h
new file mode 100644
index 000000000..93ae106a1
--- /dev/null
+++ b/src/fids/fids.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#ifndef FIDS_H
+#define FIDS_H
+
+#include "../include/common.h"
+
+// main.c
+#define MAX_DIR_LEVEL 20        // max directory tree depth
+#define MAX_INCLUDE_LEVEL 10    // max include level for config files
+extern int f_scanned;
+extern int f_modified;
+extern int f_new;
+extern int f_removed;
+extern int f_permissions;
+
+// db.c
+#define HASH_MAX 2048   // power of 2
+int db_init(void);
+void db_check(const char *fname, const char *checksum, const char *mode);
+void db_missing(void);
+
+// db_exclude.c
+void db_exclude_add(const char *fname);
+int db_exclude_check(const char *fname);
+
+
+// blake2b.c
+//#define KEY_SIZE 128 // key size in bytes
+#define KEY_SIZE 256
+//#define KEY_SIZE 512
+int blake2b(void *out, size_t outlen, const void *in, size_t inlen);
+
+#endif
diff --git a/src/fids/main.c b/src/fids/main.c
new file mode 100644
index 000000000..e6be365d1
--- /dev/null
+++ b/src/fids/main.c
@@ -0,0 +1,378 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fids.h"
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+#include <dirent.h>
+#include <glob.h>
+
+#define MAXBUF 4096
+
+static int dir_level = 1;
+static int include_level = 0;
+int arg_init = 0;
+int arg_check = 0;
+char *arg_homedir = NULL;
+char *arg_dbfile = NULL;
+
+int f_scanned = 0;
+int f_modified = 0;
+int f_new = 0;
+int f_removed = 0;
+int f_permissions = 0;
+
+
+
+static inline int is_dir(const char *fname) {
+        assert(fname);
+
+        struct stat s;
+        if (stat(fname, &s) == 0) {
+                if (S_ISDIR(s.st_mode))
+                        return 1;
+        }
+        return 0;
+}
+
+static inline int is_link(const char *fname) {
+        assert(fname);
+
+        char c;
+        ssize_t rv = readlink(fname, &c, 1);
+        return (rv != -1);
+}
+
+// mode is an array of 10 chars or more
+static inline void file_mode(const char *fname, char *mode) {
+        assert(fname);
+        assert(mode);
+
+        struct stat s;
+        if (stat(fname, &s)) {
+                *mode = '\0';
+                return;
+        }
+
+        sprintf(mode, (s.st_mode & S_IRUSR) ? "r" : "-");
+        sprintf(mode + 1, (s.st_mode & S_IWUSR) ? "w" : "-");
+        sprintf(mode + 2, (s.st_mode & S_IXUSR) ? "x" : "-");
+        sprintf(mode + 3, (s.st_mode & S_IRGRP) ? "r" : "-");
+        sprintf(mode + 4, (s.st_mode & S_IWGRP) ? "w" : "-");
+        sprintf(mode + 5, (s.st_mode & S_IXGRP) ? "x" : "-");
+        sprintf(mode + 6, (s.st_mode & S_IROTH) ? "r" : "-");
+        sprintf(mode + 7, (s.st_mode & S_IWOTH) ? "w" : "-");
+        sprintf(mode + 8, (s.st_mode & S_IXOTH) ? "x" : "-");
+}
+
+
+static void file_checksum(const char *fname) {
+        assert(fname);
+
+        int fd = open(fname, O_RDONLY);
+        if (fd == -1)
+                return;
+
+        off_t size = lseek(fd, 0, SEEK_END);
+        if (size < 0) {
+                close(fd);
+                return;
+        }
+
+        char *content = "empty";
+        int mmapped = 0;
+        if (size == 0) {
+                // empty files don't mmap - use "empty" string as the file content
+                size = 6; // strlen("empty") + 1
+        }
+        else {
+                content = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
+                close(fd);
+                mmapped = 1;
+        }
+
+        unsigned char checksum[KEY_SIZE / 8];
+        blake2b(checksum, sizeof(checksum), content, size);
+        if (mmapped)
+                munmap(content, size);
+
+        // calculate blake2 checksum
+        char str_checksum[(KEY_SIZE / 8) * 2 + 1];
+        int long unsigned i;
+        char *ptr = str_checksum;
+        for (i = 0; i < sizeof(checksum); i++, ptr += 2)
+                sprintf(ptr, "%02x", (unsigned char ) checksum[i]);
+
+        // build permissions string
+        char mode[10];
+        file_mode(fname, mode);
+
+        if (arg_init)
+                printf("%s\t%s\t%s\n", mode, str_checksum, fname);
+        else if (arg_check)
+                db_check(fname, str_checksum, mode);
+        else
+                assert(0);
+
+        f_scanned++;
+        if (f_scanned % 500 == 0)
+                fprintf(stderr, "%d ", f_scanned);
+        fflush(0);
+}
+
+void list_directory(const char *fname) {
+        assert(fname);
+        if (dir_level > MAX_DIR_LEVEL) {
+                fprintf(stderr, "Warning fids: maximum depth level exceeded for %s\n", fname);
+                return;
+        }
+
+        if (db_exclude_check(fname))
+                return;
+
+        if (is_link(fname))
+                return;
+
+        if (!is_dir(fname)) {
+                file_checksum(fname);
+                return;
+        }
+
+        DIR *dir;
+        struct dirent *entry;
+
+        if (!(dir = opendir(fname)))
+                return;
+
+        dir_level++;
+        while ((entry = readdir(dir)) != NULL) {
+                if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
+                        continue;
+                char *path;
+                if (asprintf(&path, "%s/%s", fname, entry->d_name) == -1)
+                        errExit("asprintf");
+                list_directory(path);
+                free(path);
+        }
+        closedir(dir);
+        dir_level--;
+}
+
+void globbing(const char *fname) {
+        assert(fname);
+
+        // filter top directory
+        if (strcmp(fname, "/") == 0)
+                return;
+
+        glob_t globbuf;
+        int globerr = glob(fname, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf);
+        if (globerr) {
+                fprintf(stderr, "Error fids: failed to glob pattern %s\n", fname);
+                exit(1);
+        }
+
+        long unsigned i;
+        for (i = 0; i < globbuf.gl_pathc; i++) {
+                char *path = globbuf.gl_pathv[i];
+                assert(path);
+
+                list_directory(path);
+        }
+
+        globfree(&globbuf);
+}
+
+static void process_config(const char *fname) {
+        assert(fname);
+
+        if (++include_level >= MAX_INCLUDE_LEVEL) {
+                fprintf(stderr, "Error ids: maximum include level for config files exceeded\n");
+                exit(1);
+        }
+
+        fprintf(stderr, "Opening config file %s\n", fname);
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
+        if (fd < 0) {
+                if (include_level == 1) {
+                        fprintf(stderr, "Error ids: cannot open config file %s\n", fname);
+                        exit(1);
+                }
+                return;
+        }
+
+        // make sure the file is owned by root
+        struct stat s;
+        if (fstat(fd, &s)) {
+                fprintf(stderr, "Error ids: cannot stat config file %s\n", fname);
+                exit(1);
+        }
+        if (s.st_uid || s.st_gid) {
+                fprintf(stderr, "Error ids: config file not owned by root\n");
+                exit(1);
+        }
+
+        fprintf(stderr, "Loading config file %s\n", fname);
+        FILE *fp = fdopen(fd, "r");
+        if (!fp) {
+                fprintf(stderr, "Error fids: cannot open config file %s\n", fname);
+                exit(1);
+        }
+
+        char buf[MAXBUF];
+        int line = 0;
+        while (fgets(buf, MAXBUF, fp)) {
+                line++;
+
+                // trim \n
+                char *ptr = strchr(buf, '\n');
+                if (ptr)
+                        *ptr = '\0';
+
+                // comments
+                ptr = strchr(buf, '#');
+                if (ptr)
+                        *ptr = '\0';
+
+                // empty space
+                ptr = buf;
+                while (*ptr == ' ' || *ptr == '\t')
+                        ptr++;
+                char *start = ptr;
+
+                // empty line
+                if (*start == '\0')
+                        continue;
+
+                // trailing spaces
+                ptr = start + strlen(start);
+                ptr--;
+                while (*ptr == ' ' || *ptr == '\t')
+                        *ptr-- = '\0';
+
+                // replace ${HOME}
+                if (strncmp(start, "include", 7) == 0) {
+                        ptr = start + 7;
+                        if ((*ptr != ' ' && *ptr != '\t') || *ptr == '\0') {
+                                fprintf(stderr, "Error fids: invalid line %d in %s\n", line, fname);
+                                exit(1);
+                        }
+                        while (*ptr == ' ' || *ptr == '\t')
+                                ptr++;
+
+                        if (*ptr == '/')
+                                process_config(ptr);
+                        else {
+                                // assume the file is in /etc/firejail
+                                char *tmp;
+                                if (asprintf(&tmp, "/etc/firejail/%s", ptr) == -1)
+                                        errExit("asprintf");
+                                process_config(tmp);
+                                free(tmp);
+                        }
+                }
+                else if (*start == '!') {
+                        // exclude file or dir
+                        start++;
+                        if (strncmp(start, "${HOME}", 7))
+                                db_exclude_add(start);
+                        else {
+                                char *fname;
+                                if (asprintf(&fname, "%s%s", arg_homedir, start + 7) == -1)
+                                        errExit("asprintf");
+                                db_exclude_add(fname);
+                                free(fname);
+                        }
+                }
+                else if (strncmp(start, "${HOME}", 7))
+                        globbing(start);
+                else {
+                        char *fname;
+                        if (asprintf(&fname, "%s%s", arg_homedir, start + 7) == -1)
+                                errExit("asprintf");
+                        globbing(fname);
+                        free(fname);
+                }
+        }
+
+        fclose(fp);
+        include_level--;
+}
+
+
+
+void usage(void) {
+        printf("Usage: fids [--help|-h|-?] --init|--check homedir\n");
+}
+
+int main(int argc, char **argv) {
+        int i;
+        for (i = 1; i < argc; i++) {
+                if (strcmp(argv[i], "-h") == 0 ||
+                    strcmp(argv[i], "-?") == 0 ||
+                    strcmp(argv[i], "--help") == 0) {
+                        usage();
+                        return 0;
+                }
+                else if (strcmp(argv[i], "--init") == 0)
+                        arg_init = 1;
+                else if (strcmp(argv[i], "--check") == 0)
+                        arg_check = 1;
+                else if (strncmp(argv[i], "--", 2) == 0) {
+                        fprintf(stderr, "Error fids: invalid argument %s\n", argv[i]);
+                        exit(1);
+                }
+        }
+
+        if (argc != 3) {
+                fprintf(stderr, "Error fids: invalid number of arguments\n");
+                exit(1);
+        }
+        arg_homedir = argv[2];
+
+        int op = arg_check + arg_init;
+        if (op == 0 || op == 2) {
+                fprintf(stderr, "Error fids: use either --init or --check\n");
+                exit(1);
+        }
+
+        if (arg_init) {
+                process_config(SYSCONFDIR"/ids.config");
+                fprintf(stderr, "\n%d files scanned\n", f_scanned);
+                fprintf(stderr, "IDS database initialized\n");
+        }
+        else if (arg_check) {
+                if (db_init()) {
+                        fprintf(stderr, "Error: IDS database not initialized, please run \"firejail --ids-init\"\n");
+                        exit(1);
+                }
+
+                process_config(SYSCONFDIR"/ids.config");
+                fprintf(stderr, "\n%d files scanned: modified %d, permissions %d, new %d, removed %d\n",
+                        f_scanned, f_modified, f_permissions, f_new, f_removed);
+                db_missing();
+        }
+        else
+                assert(0);
+
+        return 0;
+}
diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c
index 06b0a117f..408662907 100644
--- a/src/firecfg/desktop_files.c
+++ b/src/firecfg/desktop_files.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -24,11 +24,16 @@
 static int check_profile(const char *name, const char *homedir) {
         // build profile name
         char *profname1;
+#ifndef HAVE_ONLY_SYSCFG_PROFILES
         char *profname2;
+#endif
         if (asprintf(&profname1, "%s/%s.profile", SYSCONFDIR, name) == -1)
                 errExit("asprintf");
+
+#ifndef HAVE_ONLY_SYSCFG_PROFILES
         if (asprintf(&profname2, "%s/.config/firejail/%s.profile", homedir, name) == -1)
                 errExit("asprintf");
+#endif
 
         int rv = 0;
         if (access(profname1, R_OK) == 0) {
@@ -36,14 +41,18 @@ static int check_profile(const char *name, const char *homedir) {
                         printf("found %s\n", profname1);
                 rv = 1;
         }
+#ifndef HAVE_ONLY_SYSCFG_PROFILES
         else if (access(profname2, R_OK) == 0) {
                 if (arg_debug)
                         printf("found %s\n", profname2);
                 rv = 1;
         }
+#endif
 
         free(profname1);
+#ifndef HAVE_ONLY_SYSCFG_PROFILES
         free(profname2);
+#endif
         return rv;
 }
 
@@ -168,9 +177,9 @@ void fix_desktop_files(char *homedir) {
 
                 char *filename = entry->d_name;
 
-                // skip links
-                if (is_link(filename))
-                        continue;
+                // skip links - Discord on Arch #4235 seems to be a symlink to /opt directory
+//              if (is_link(filename))
+//                      continue;
 
                 // no profile in /etc/firejail, no desktop file fixing
                 if (!have_profile(filename, homedir))
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 474904ebf..618093193 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -1,8 +1,8 @@
-# /usr/lib/firejail/firecfg.config - firecfg utility configuration file
+# /etc/firejail/firecfg.config - firecfg utility configuration file
 # This is the list of programs in alphabetical order handled by firecfg utility
 #
-#qemu-system-x86_64
 0ad
+1password
 2048-qt
 Books
 Builder
@@ -38,13 +38,15 @@ abrowser
 akonadi_control
 akregator
 alacarte
+alpine
+alpinef
 amarok
 amule
 amuled
 android-studio
 anydesk
-apostrophe
 apktool
+apostrophe
 # ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 arch-audit
 archaudit-report
@@ -92,6 +94,7 @@ bleachbit
 blender
 blender-2.8
 bless
+blobby
 blobwars
 bluefish
 bnox
@@ -107,6 +110,7 @@ brave-browser-stable
 # bzcat - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 bzflag
 # bzip2 - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
+cachy-browser
 calibre
 calligra
 calligraauthor
@@ -136,23 +140,27 @@ clamdscan
 clamdtop
 clamscan
 clamtk
-claws-mail
 clawsker
+claws-mail
 clementine
 clion
-clipit
+clion-eap
 clipgrab
+clipit
 cliqz
 clocks
 cmus
 code
 code-oss
+codium
+cointop
 cola
 colorful
 com.github.bleakgrey.tootle
 com.github.dahenson.agenda
 com.github.johnfactotum.Foliate
 com.github.phase1geo.minder
+com.github.tchx84.Flatseal
 com.gitlab.newsflash
 conkeror
 conky
@@ -167,12 +175,14 @@ cvlc
 cyberfox
 darktable
 dconf-editor
+ddgr
 ddgtk
 deadbeef
 deluge
 desktopeditors
 devhelp
 dex2jar
+d-feet
 dia
 dig
 digikam
@@ -186,7 +196,6 @@ display-im6.q16
 dnox
 dnscrypt-proxy
 dnsmasq
-dolphin
 dolphin-emu
 dooble
 dooble-qt4
@@ -195,13 +204,12 @@ dragon
 drawio
 drill
 dropbox
-d-feet
 easystroke
-ebook-viewer
 ebook-convert
 ebook-edit
 ebook-meta
 ebook-polish
+ebook-viewer
 electron-mail
 electrum
 element-desktop
@@ -251,8 +259,8 @@ flacsplt
 flameshot
 flashpeak-slimjet
 flowblade
-font-manager
 fontforge
+font-manager
 fossamail
 four-in-a-row
 fractal
@@ -271,9 +279,12 @@ freetube
 freshclam
 frogatto
 frozen-bubble
+ftp
+funnyboat
 gajim
 gajim-history-manager
 galculator
+gallery-dl
 gapplication
 gcalccmd
 gcloud
@@ -291,8 +302,8 @@ gimp-2.10
 gimp-2.8
 gist
 gist-paste
-gitg
 git-cola
+gitg
 github-desktop
 gitter
 # gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102
@@ -342,6 +353,7 @@ gnome-weather
 gnote
 gnubik
 godot
+goldendict
 goobox
 google-chrome
 google-chrome-beta
@@ -350,6 +362,7 @@ google-chrome-unstable
 google-earth
 google-earth-pro
 google-play-music-desktop-player
+googler
 gpa
 gpicview
 gpredict
@@ -357,10 +370,11 @@ gradio
 gramps
 gravity-beams-and-evaporating-stars
 gthumb
-gtk-straw-viewer
-gtk-youtube-viewer
 gtk2-youtube-viewer
 gtk3-youtube-viewer
+gtk-pipe-viewer
+gtk-straw-viewer
+gtk-youtube-viewer
 guayadeque
 gucharmap
 gummi
@@ -386,9 +400,11 @@ idea.sh
 imagej
 img2txt
 impressive
+imv
 inkscape
 inkview
 inox
+io.github.lainsce.Notejot
 ipcalc
 ipcalc-ng
 iridium
@@ -443,13 +459,16 @@ kube
 kwrite
 leafpad
 # less - breaks man
+librecad
 libreoffice
 librewolf
 librewolf-nightly
+lifeograph
 liferea
 lightsoff
 lincity-ng
 links
+links2
 linphone
 lmms
 lobase
@@ -489,6 +508,7 @@ mathematica
 matrix-mirage
 mattermost-desktop
 mcabber
+mcomix
 mediainfo
 mediathekview
 megaglest
@@ -499,6 +519,7 @@ mendeleydesktop
 menulibre
 meteo-qt
 microsoft-edge
+microsoft-edge-beta
 microsoft-edge-dev
 midori
 min
@@ -515,8 +536,8 @@ mp3splt-gtk
 mp3wrap
 mpDris2
 mpg123
-mpg123.bin
 mpg123-alsa
+mpg123.bin
 mpg123-id3dump
 mpg123-jack
 mpg123-nas
@@ -555,6 +576,7 @@ mypaint
 mypaint-ora-thumbnailer
 natron
 ncdu
+ncdu2
 neochat
 neomutt
 netactview
@@ -575,6 +597,7 @@ nitroshare-nmh
 nitroshare-send
 nitroshare-ui
 nomacs
+notable
 nslookup
 nuclear
 nylas
@@ -585,22 +608,26 @@ odt2txt
 oggsplt
 okular
 onboard
+onionshare
+onionshare-cli
 onionshare-gui
 ooffice
 ooviewdoc
-open-invaders
 openarena
 openarena_ded
 opencity
 openclonk
+open-invaders
 openmw
 openmw-launcher
 openoffice.org
 openshot
 openshot-qt
+openstego
 openttd
 opera
 opera-beta
+opera-developer
 orage
 ostrichriders
 otter-browser
@@ -626,6 +653,7 @@ pinball
 pingus
 pinta
 pioneer
+pipe-viewer
 pithos
 pitivi
 pix
@@ -648,7 +676,9 @@ pybitmessage
 # pycharm-professional
 # pzstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 qbittorrent
+qcomicbook
 qemu-launcher
+#qemu-system-x86_64
 qgis
 qlipper
 qmmp
@@ -662,11 +692,14 @@ quaternion
 quiterss
 qupzilla
 qutebrowser
+raincat
 rambox
 redeclipse
+rednotebook
 redshift
 regextester
 remmina
+retroarch
 rhythmbox
 rhythmbox-client
 ricochet
@@ -675,6 +708,7 @@ riot-web
 ripperx
 ristretto
 rocketchat
+rpcs3
 rtorrent
 runenpass.sh
 sayonara
@@ -683,6 +717,7 @@ scorched3d
 scorchwentbonkers
 scribus
 sdat2img
+seafile-applet
 seahorse
 seahorse-adventures
 seahorse-daemon
@@ -710,8 +745,8 @@ smuxi-frontend-gnome
 snox
 soffice
 sol
-sound-juicer
 soundconverter
+sound-juicer
 spectacle
 spectral
 spotify
@@ -745,6 +780,7 @@ teamspeak3
 teeworlds
 telegram
 telegram-desktop
+telnet
 terasology
 textmaker18
 textmaker18free
@@ -753,6 +789,7 @@ thunderbird-beta
 thunderbird-wayland
 tilp
 tor-browser
+torbrowser
 tor-browser-ar
 tor-browser-ca
 tor-browser-cs
@@ -774,6 +811,7 @@ tor-browser-it
 tor-browser-ja
 tor-browser-ka
 tor-browser-ko
+torbrowser-launcher
 tor-browser-nb
 tor-browser-nl
 tor-browser-pl
@@ -784,7 +822,6 @@ tor-browser-tr
 tor-browser-vi
 tor-browser-zh-cn
 tor-browser-zh-tw
-torbrowser-launcher
 torcs
 totem
 tracker
@@ -844,6 +881,7 @@ weechat
 weechat-curses
 wesnoth
 wget
+wget2
 whalebird
 whois
 widelands
@@ -852,10 +890,10 @@ wire-desktop
 wireshark
 wireshark-gtk
 wireshark-qt
+wordwarvi
 wpp
 wps
 wpspdf
-wordwarvi
 x2goclient
 xbill
 xcalc
@@ -868,6 +906,7 @@ xfce4-notes
 xfce4-screenshooter
 xiphos
 xlinks
+xlinks2
 xmms
 xmr-stak
 xonotic
@@ -889,13 +928,15 @@ yelp
 youtube
 youtube-dl
 youtube-dl-gui
-youtube-viewer
 youtubemusic-nativefier
+youtube-viewer
+yt-dlp
 ytmdesktop
 zaproxy
 zart
 zathura
 zeal
+zim
 zoom
 # zpaq - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
 # zstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095)
diff --git a/src/firecfg/firecfg.h b/src/firecfg/firecfg.h
index 15826cf37..f54bfd5b5 100644
--- a/src/firecfg/firecfg.h
+++ b/src/firecfg/firecfg.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firecfg/main.c b/src/firecfg/main.c
index 363000e15..2f346fecd 100644
--- a/src/firecfg/main.c
+++ b/src/firecfg/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -171,17 +171,17 @@ static void set_file(const char *name, const char *firejail_exec) {
         free(fname);
 }
 
-// parse /usr/lib/firejail/firecfg.cfg file
+// parse /etc/firejail/firecfg.config file
 static void set_links_firecfg(void) {
         char *cfgfile;
-        if (asprintf(&cfgfile, "%s/firejail/firecfg.config", LIBDIR) == -1)
+        if (asprintf(&cfgfile, "%s/firecfg.config", SYSCONFDIR) == -1)
                 errExit("asprintf");
 
         char *firejail_exec;
         if (asprintf(&firejail_exec, "%s/bin/firejail", PREFIX) == -1)
                 errExit("asprintf");
 
-        // parse /usr/lib/firejail/firecfg.cfg file
+        // parse /etc/firejail/firecfg.config file
         FILE *fp = fopen(cfgfile, "r");
         if (!fp) {
                 perror("fopen");
@@ -440,7 +440,7 @@ int main(int argc, char **argv) {
         // clear all symlinks
         clean();
 
-        // set new symlinks based on /usr/lib/firejail/firecfg.cfg
+        // set new symlinks based on /etc/firejail/firecfg.config
         set_links_firecfg();
 
         if (getuid() == 0) {
diff --git a/src/firecfg/sound.c b/src/firecfg/sound.c
index e3fcdbd83..9d04c951b 100644
--- a/src/firecfg/sound.c
+++ b/src/firecfg/sound.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firecfg/util.c b/src/firecfg/util.c
index 14d90b549..4697e7dd9 100644
--- a/src/firecfg/util.c
+++ b/src/firecfg/util.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index 59758bf2d..479473572 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -21,6 +21,7 @@
 // sudo mount -o loop krita-3.0-x86_64.appimage mnt
 
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/mount.h>
@@ -30,6 +31,7 @@
 
 static char *devloop = NULL;    // device file
 static long unsigned size = 0;  // offset into appimage file
+#define MAXBUF 4096
 
 #ifdef LOOP_CTL_GET_FREE        // test for older kernels; this definition is found in /usr/include/linux/loop.h
 static void err_loop(void) {
@@ -38,6 +40,36 @@ static void err_loop(void) {
 }
 #endif
 
+// return 1 if found
+int appimage_find_profile(const char *archive) {
+        assert(archive);
+        assert(strlen(archive));
+
+        // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config
+        FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot find %s, firejail is not correctly installed\n", SYSCONFDIR "/firecfg.config");
+                exit(1);
+        }
+        char buf[MAXBUF];
+        while (fgets(buf, MAXBUF, fp)) {
+                if (*buf == '#')
+                        continue;
+                char *ptr = strchr(buf, '\n');
+                if (ptr)
+                        *ptr = '\0';
+                if (strcasestr(archive, buf)) {
+                        fclose(fp);
+                        return profile_find_firejail(buf, 1);
+                }
+        }
+
+        fclose(fp);
+        return 0;
+
+}
+
+
 void appimage_set(const char *appimage) {
         assert(appimage);
         assert(devloop == NULL);        // don't call this twice!
@@ -67,7 +99,7 @@ void appimage_set(const char *appimage) {
 
         // find or allocate a free loop device to use
         EUID_ROOT();
-        int cfd = open("/dev/loop-control", O_RDWR);
+        int cfd = open("/dev/loop-control", O_RDWR|O_CLOEXEC);
         if (cfd == -1)
                 err_loop();
         int devnr = ioctl(cfd, LOOP_CTL_GET_FREE);
@@ -78,7 +110,7 @@ void appimage_set(const char *appimage) {
                 errExit("asprintf");
 
         // associate loop device with appimage
-        int lfd = open(devloop, O_RDONLY);
+        int lfd = open(devloop, O_RDONLY|O_CLOEXEC);
         if (lfd == -1)
                 err_loop();
         if (ioctl(lfd, LOOP_SET_FD, ffd) == -1)
@@ -109,9 +141,8 @@ void appimage_set(const char *appimage) {
 
         if (cfg.cwd)
                 env_store_name_val("OWD", cfg.cwd, SETENV);
-#ifdef HAVE_GCOV
+
         __gcov_flush();
-#endif
 #else
         fprintf(stderr, "Error: /dev/loop-control interface is not supported by your kernel\n");
         exit(1);
@@ -146,7 +177,7 @@ void appimage_mount(void) {
 void appimage_clear(void) {
         EUID_ROOT();
         if (devloop) {
-                int lfd = open(devloop, O_RDONLY);
+                int lfd = open(devloop, O_RDONLY|O_CLOEXEC);
                 if (lfd != -1) {
                         if (ioctl(lfd, LOOP_CLR_FD, 0) != -1)
                                 fmessage("AppImage detached\n");
diff --git a/src/firejail/appimage_size.c b/src/firejail/appimage_size.c
index 43ca501da..4f8c7a7aa 100644
--- a/src/firejail/appimage_size.c
+++ b/src/firejail/appimage_size.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firejail/arp.c b/src/firejail/arp.c
index 1e9641097..cbd80dee0 100644
--- a/src/firejail/arp.c
+++ b/src/firejail/arp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,6 +20,7 @@
 #include "firejail.h"
 #include <sys/socket.h>
 #include <sys/ioctl.h>
+#include <sys/time.h>
 #include <linux/if_ether.h>                       //TCP/IP Protocol Suite for Linux
 #include <net/if.h>
 #include <netinet/in.h>
@@ -188,9 +189,14 @@ int arp_check(const char *dev, uint32_t destaddr) {
         FD_SET(sock, &fds);
         int maxfd = sock;
         struct timeval ts;
-        ts.tv_sec = 0; // 0.5 seconds wait time
-        ts.tv_usec = 500000;
+        gettimeofday(&ts, NULL);
+        double timerend = ts.tv_sec + ts.tv_usec / 1000000.0 + 0.5;
         while (1) {
+                gettimeofday(&ts, NULL);
+                double now = ts.tv_sec + ts.tv_usec / 1000000.0;
+                double timeout = timerend - now;
+                ts.tv_sec = timeout;
+                ts.tv_usec = (timeout - ts.tv_sec) * 1000000;
                 int nready = select(maxfd + 1,  &fds, (fd_set *) 0, (fd_set *) 0, &ts);
                 if (nready < 0)
                         errExit("select");
@@ -201,8 +207,8 @@ int arp_check(const char *dev, uint32_t destaddr) {
                         }
                         if (sendto (sock, frame, 14 + sizeof(ArpHdr), 0, (struct sockaddr *) &addr, sizeof (addr)) <= 0)
                                 errExit("send");
-                        ts.tv_sec = 0; // 0.5 seconds wait time
-                        ts.tv_usec = 500000;
+                        gettimeofday(&ts, NULL);
+                        timerend = ts.tv_sec + ts.tv_usec / 1000000.0 + 0.5;
                         fflush(0);
                 }
                 else {
@@ -277,7 +283,7 @@ static uint32_t arp_random(const char *dev, Bridge *br) {
         int i = 0;
         for (i = 0; i < 10; i++) {
                 dest = start + ((uint32_t) rand()) % range;
-                if (dest == ifip)       // do not allow the interface address
+                if (dest == ifip || dest == cfg.defaultgw)      // do not allow the interface address or the default gateway
                         continue;               // try again
 
                 // if we've made it up to here, we have a valid address
@@ -325,7 +331,7 @@ static uint32_t arp_sequential(const char *dev, Bridge *br) {
 
         // loop through addresses and stop as soon as you find an unused one
         while (dest <= last) {
-                if (dest == ifip) {
+                if (dest == ifip || dest == cfg.defaultgw) {
                         dest++;
                         continue;
                 }
diff --git a/src/firejail/bandwidth.c b/src/firejail/bandwidth.c
index 1c952c0bc..fa9d3a940 100644
--- a/src/firejail/bandwidth.c
+++ b/src/firejail/bandwidth.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -22,6 +22,7 @@
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
+#include <errno.h>
 #include <net/if.h>
 #include "firejail.h"
 
@@ -119,26 +120,19 @@ static void bandwidth_create_run_file(pid_t pid) {
         if (asprintf(&fname, "%s/%d-bandwidth", RUN_FIREJAIL_BANDWIDTH_DIR, (int) pid) == -1)
                 errExit("asprintf");
 
-        // if the file already exists, do nothing
-        struct stat s;
-        if (stat(fname, &s) == 0) {
-                free(fname);
-                return;
-        }
-
         // create an empty file and set mod and ownership
-        /* coverity[toctou] */
-        FILE *fp = fopen(fname, "w");
-        if (fp) {
-                SET_PERMS_STREAM(fp, 0, 0, 0644);
-                fclose(fp);
-        }
-        else {
+        // if the file already exists, do nothing
+        FILE *fp = fopen(fname, "wxe");
+        free(fname);
+        if (!fp) {
+                if (errno == EEXIST)
+                        return;
                 fprintf(stderr, "Error: cannot create bandwidth file\n");
                 exit(1);
         }
 
-        free(fname);
+        SET_PERMS_STREAM(fp, 0, 0, 0644);
+        fclose(fp);
 }
 
 
@@ -148,7 +142,7 @@ void network_set_run_file(pid_t pid) {
                 errExit("asprintf");
 
         // create an empty file and set mod and ownership
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (fp) {
                 if (cfg.bridge0.configured)
                         fprintf(fp, "%s:%s\n", cfg.bridge0.dev, cfg.bridge0.devsandbox);
@@ -178,7 +172,7 @@ static void read_bandwidth_file(pid_t pid) {
         if (asprintf(&fname, "%s/%d-bandwidth", RUN_FIREJAIL_BANDWIDTH_DIR, (int) pid) == -1)
                 errExit("asprintf");
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp) {
                 char buf[1024];
                 while (fgets(buf, 1024,fp)) {
@@ -214,7 +208,7 @@ static void write_bandwidth_file(pid_t pid) {
         if (asprintf(&fname, "%s/%d-bandwidth", RUN_FIREJAIL_BANDWIDTH_DIR, (int) pid) == -1)
                 errExit("asprintf");
 
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (fp) {
                 IFBW *ptr = ifbw;
                 while (ptr) {
@@ -307,7 +301,7 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
                 char *fname;
                 if (asprintf(&fname, "%s/%d-netmap", RUN_FIREJAIL_NETWORK_DIR, (int) pid) == -1)
                         errExit("asprintf");
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 if (!fp) {
                         fprintf(stderr, "Error: cannot read network map file %s\n", fname);
                         exit(1);
diff --git a/src/firejail/caps.c b/src/firejail/caps.c
index 597f9915b..c5c06c675 100644
--- a/src/firejail/caps.c
+++ b/src/firejail/caps.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -389,7 +389,7 @@ static uint64_t extract_caps(int pid) {
                 errExit("asprintf");
 
         EUID_ROOT();    // grsecurity
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         EUID_USER();    // grsecurity
         if (!fp)
                 goto errexit;
diff --git a/src/firejail/cgroup.c b/src/firejail/cgroup.c
index 986b1157d..f1e16187f 100644
--- a/src/firejail/cgroup.c
+++ b/src/firejail/cgroup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,7 +18,9 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firejail.h"
-#include <sys/stat.h>
+#include "../include/gcov_wrapper.h"
+#include <sys/wait.h>
+#include <errno.h>
 
 #define MAXBUF 4096
 
@@ -26,7 +28,7 @@ void save_cgroup(void) {
         if (cfg.cgroup == NULL)
                 return;
 
-        FILE *fp = fopen(RUN_CGROUP_CFG, "w");
+        FILE *fp = fopen(RUN_CGROUP_CFG, "wxe");
         if (fp) {
                 fprintf(fp, "%s", cfg.cgroup);
                 fflush(0);
@@ -48,7 +50,7 @@ void load_cgroup(const char *fname) {
         if (!fname)
                 return;
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp) {
                 char buf[MAXBUF];
                 if (fgets(buf, MAXBUF, fp)) {
@@ -68,52 +70,63 @@ errout:
                 fclose(fp);
 }
 
+static int is_cgroup_path(const char *fname) {
+        // path starts with /sys/fs/cgroup
+        if (strncmp(fname, "/sys/fs/cgroup", 14) != 0)
+                return 0;
 
-void set_cgroup(const char *path) {
-        EUID_ASSERT();
+        // no .. traversal
+        char *ptr = strstr(fname, "..");
+        if (ptr)
+                return 0;
 
-        invalid_filename(path, 0); // no globbing
+        return 1;
+}
 
-        // path starts with /sys/fs/cgroup
-        if (strncmp(path, "/sys/fs/cgroup", 14) != 0)
-                goto errout;
+void check_cgroup_file(const char *fname) {
+        assert(fname);
+        invalid_filename(fname, 0); // no globbing
 
-        // path ends in tasks
-        char *ptr = strstr(path, "tasks");
-        if (!ptr)
-                goto errout;
-        if (*(ptr + 5) != '\0')
+        if (!is_cgroup_path(fname))
                 goto errout;
 
-        // no .. traversal
-        ptr = strstr(path, "..");
-        if (ptr)
+        const char *base = gnu_basename(fname);
+        if (strcmp(base, "tasks") != 0 &&  // cgroup v1
+            strcmp(base, "cgroup.procs") != 0)
                 goto errout;
 
-        // tasks file exists
-        struct stat s;
-        if (stat(path, &s) == -1)
-                goto errout;
+        if (access(fname, W_OK) == 0)
+                return;
 
-        // task file belongs to the user running the sandbox
-        if (s.st_uid != getuid() && s.st_gid != getgid())
-                goto errout2;
+errout:
+        fprintf(stderr, "Error: invalid cgroup\n");
+        exit(1);
+}
+
+static void do_set_cgroup(const char *fname, pid_t pid) {
+        FILE *fp = fopen(fname, "ae");
+        if (!fp) {
+                fwarning("cannot open %s for writing: %s\n", fname, strerror(errno));
+                return;
+        }
 
-        // add the task to cgroup
-        /* coverity[toctou] */
-        FILE *fp = fopen(path,  "a");
-        if (!fp)
-                goto errout;
-        pid_t pid = getpid();
         int rv = fprintf(fp, "%d\n", pid);
         (void) rv;
         fclose(fp);
-        return;
+}
 
-errout:
-        fprintf(stderr, "Error: invalid cgroup\n");
-        exit(1);
-errout2:
-        fprintf(stderr, "Error: you don't have permissions to use this control group\n");
-        exit(1);
+void set_cgroup(const char *fname, pid_t pid) {
+        pid_t child = fork();
+        if (child < 0)
+                errExit("fork");
+        if (child == 0) {
+                drop_privs(0);
+
+                do_set_cgroup(fname, pid);
+
+                __gcov_flush();
+
+                _exit(0);
+        }
+        waitpid(child, NULL, 0);
 }
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c
index e1613b325..6fc70318b 100644
--- a/src/firejail/checkcfg.c
+++ b/src/firejail/checkcfg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -35,6 +35,8 @@ char *xvfb_extra_params = "";
 char *netfilter_default = NULL;
 unsigned long join_timeout = 5000000; // microseconds
 char *config_seccomp_error_action_str = "EPERM";
+char *config_seccomp_filter_add = NULL;
+char **whitelist_reject_topdirs = NULL;
 
 int checkcfg(int val) {
         assert(val < CFG_MAX);
@@ -56,10 +58,11 @@ int checkcfg(int val) {
                 cfg_val[CFG_XPRA_ATTACH] = 0;
                 cfg_val[CFG_SECCOMP_ERROR_ACTION] = -1;
                 cfg_val[CFG_BROWSER_ALLOW_DRM] = 0;
+                cfg_val[CFG_ALLOW_TRAY] = 0;
 
                 // open configuration file
                 const char *fname = SYSCONFDIR "/firejail.config";
-                fp = fopen(fname, "r");
+                fp = fopen(fname, "re");
                 if (!fp) {
 #ifdef HAVE_GLOBALCFG
                         fprintf(stderr, "Error: Firejail configuration file %s not found\n", fname);
@@ -102,22 +105,25 @@ int checkcfg(int val) {
                         PARSE_YESNO(CFG_USERNS, "userns")
                         PARSE_YESNO(CFG_CHROOT, "chroot")
                         PARSE_YESNO(CFG_FIREJAIL_PROMPT, "firejail-prompt")
-                        PARSE_YESNO(CFG_FOLLOW_SYMLINK_AS_USER, "follow-symlink-as-user")
                         PARSE_YESNO(CFG_FORCE_NONEWPRIVS, "force-nonewprivs")
                         PARSE_YESNO(CFG_SECCOMP, "seccomp")
-                        PARSE_YESNO(CFG_WHITELIST, "whitelist")
                         PARSE_YESNO(CFG_NETWORK, "network")
                         PARSE_YESNO(CFG_RESTRICTED_NETWORK, "restricted-network")
                         PARSE_YESNO(CFG_XEPHYR_WINDOW_TITLE, "xephyr-window-title")
                         PARSE_YESNO(CFG_OVERLAYFS, "overlayfs")
-                        PARSE_YESNO(CFG_PRIVATE_HOME, "private-home")
+                        PARSE_YESNO(CFG_PRIVATE_BIN, "private-bin")
+                        PARSE_YESNO(CFG_PRIVATE_BIN_NO_LOCAL, "private-bin-no-local")
                         PARSE_YESNO(CFG_PRIVATE_CACHE, "private-cache")
+                        PARSE_YESNO(CFG_PRIVATE_ETC, "private-etc")
+                        PARSE_YESNO(CFG_PRIVATE_HOME, "private-home")
                         PARSE_YESNO(CFG_PRIVATE_LIB, "private-lib")
-                        PARSE_YESNO(CFG_PRIVATE_BIN_NO_LOCAL, "private-bin-no-local")
+                        PARSE_YESNO(CFG_PRIVATE_OPT, "private-opt")
+                        PARSE_YESNO(CFG_PRIVATE_SRV, "private-srv")
                         PARSE_YESNO(CFG_DISABLE_MNT, "disable-mnt")
                         PARSE_YESNO(CFG_XPRA_ATTACH, "xpra-attach")
                         PARSE_YESNO(CFG_BROWSER_DISABLE_U2F, "browser-disable-u2f")
                         PARSE_YESNO(CFG_BROWSER_ALLOW_DRM, "browser-allow-drm")
+                        PARSE_YESNO(CFG_ALLOW_TRAY, "allow-tray")
 #undef PARSE_YESNO
 
                         // netfilter
@@ -130,8 +136,7 @@ int checkcfg(int val) {
                                         *end = '\0';
 
                                 // is the file present?
-                                struct stat s;
-                                if (stat(fname, &s) == -1) {
+                                if (access(fname, F_OK) == -1) {
                                         fprintf(stderr, "Error: netfilter-default file %s not available\n", fname);
                                         exit(1);
                                 }
@@ -222,6 +227,10 @@ int checkcfg(int val) {
                         else if (strncmp(ptr, "join-timeout ", 13) == 0)
                                 join_timeout = strtoul(ptr + 13, NULL, 10) * 1000000; // seconds to microseconds
 
+                        // add rules to default seccomp filter
+                        else if (strncmp(ptr, "seccomp-filter-add ", 19) == 0)
+                                config_seccomp_filter_add = seccomp_check_list(ptr + 19);
+
                         // seccomp error action
                         else if (strncmp(ptr, "seccomp-error-action ", 21) == 0) {
                                 if (strcmp(ptr + 21, "kill") == 0)
@@ -238,6 +247,31 @@ int checkcfg(int val) {
                                         errExit("strdup");
                         }
 
+                        else if (strncmp(ptr, "whitelist-disable-topdir ", 25) == 0) {
+                                char *str = strdup(ptr + 25);
+                                if (!str)
+                                        errExit("strdup");
+
+                                size_t cnt = 0;
+                                size_t sz = 4;
+                                whitelist_reject_topdirs = malloc(sz * sizeof(char *));
+                                if (!whitelist_reject_topdirs)
+                                        errExit("malloc");
+
+                                char *tok = strtok(str, ",");
+                                while (tok) {
+                                        whitelist_reject_topdirs[cnt++] = tok;
+                                        if (cnt >= sz) {
+                                                sz *= 2;
+                                                whitelist_reject_topdirs = realloc(whitelist_reject_topdirs, sz * sizeof(char *));
+                                                if (!whitelist_reject_topdirs)
+                                                        errExit("realloc");
+                                        }
+                                        tok = strtok(NULL, ",");
+                                }
+                                whitelist_reject_topdirs[cnt] = NULL;
+                        }
+
                         else
                                 goto errout;
 
@@ -269,7 +303,7 @@ errout:
 
 void print_compiletime_support(void) {
         printf("Compile time support:\n");
-        printf("\t- Always force nonewprivs support is %s\n",
+        printf("\t- always force nonewprivs support is %s\n",
 #ifdef HAVE_FORCE_NONEWPRIVS
                 "enabled"
 #else
@@ -309,14 +343,6 @@ void print_compiletime_support(void) {
 #endif
                 );
 
-        printf("\t- file and directory whitelisting support is %s\n",
-#ifdef HAVE_WHITELIST
-                "enabled"
-#else
-                "disabled"
-#endif
-                );
-
         printf("\t- file transfer support is %s\n",
 #ifdef HAVE_FILE_TRANSFER
                 "enabled"
diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c
index d7e96cf4c..551948318 100644
--- a/src/firejail/chroot.c
+++ b/src/firejail/chroot.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,6 +20,7 @@
 
 #ifdef HAVE_CHROOT
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/mount.h>
 #include <sys/sendfile.h>
 #include <errno.h>
@@ -29,7 +30,6 @@
 #define O_PATH 010000000
 #endif
 
-
 // exit if error
 void fs_check_chroot_dir(void) {
         EUID_ASSERT();
@@ -86,7 +86,7 @@ static void update_file(int parentfd, const char *relpath) {
         if (arg_debug)
                 printf("Updating chroot /%s\n", relpath);
         unlinkat(parentfd, relpath, 0);
-        int out = openat(parentfd, relpath, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+        int out = openat(parentfd, relpath, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (out == -1) {
                 close(in);
                 goto errout;
@@ -131,9 +131,9 @@ void fs_chroot(const char *rootdir) {
         assert(rootdir);
 
         // fails if there is any symlink or if rootdir is not a directory
-        int parentfd = safe_fd(rootdir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        int parentfd = safer_openat(-1, rootdir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (parentfd == -1)
-                errExit("safe_fd");
+                errExit("safer_openat");
         // rootdir has to be owned by root and is not allowed to be generally writable,
         // this also excludes /tmp and friends
         struct stat s;
@@ -163,12 +163,8 @@ void fs_chroot(const char *rootdir) {
         int fd = openat(parentfd, "dev", O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
                 errExit("open");
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount("/dev", proc, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_path_to_fd("/dev", fd))
                 errExit("mounting /dev");
-        free(proc);
         close(fd);
 
 #ifdef HAVE_X11
@@ -192,11 +188,8 @@ void fs_chroot(const char *rootdir) {
                 fd = openat(parentfd, "tmp/.X11-unix", O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
                 if (fd == -1)
                         errExit("open");
-                if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                        errExit("asprintf");
-                if (mount("/tmp/.X11-unix", proc, NULL, MS_BIND|MS_REC, NULL) < 0)
+                if (bind_mount_path_to_fd("/tmp/.X11-unix", fd))
                         errExit("mounting /tmp/.X11-unix");
-                free(proc);
                 close(fd);
         }
 #endif // HAVE_X11
@@ -215,29 +208,21 @@ void fs_chroot(const char *rootdir) {
 
                 if (arg_debug)
                         printf("Mounting %s on chroot %s\n", orig_pulse, orig_pulse);
-                int src = safe_fd(orig_pulse, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+                int src = safer_openat(-1, orig_pulse, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
                 if (src == -1) {
                         fprintf(stderr, "Error: cannot open %s\n", orig_pulse);
                         exit(1);
                 }
-                int dst = safe_fd(pulse, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+                int dst = safer_openat(-1, pulse, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
                 if (dst == -1) {
                         fprintf(stderr, "Error: cannot open %s\n", pulse);
                         exit(1);
                 }
-                free(pulse);
-
-                char *proc_src, *proc_dst;
-                if (asprintf(&proc_src, "/proc/self/fd/%d", src) == -1)
-                        errExit("asprintf");
-                if (asprintf(&proc_dst, "/proc/self/fd/%d", dst) == -1)
-                        errExit("asprintf");
-                if (mount(proc_src, proc_dst, NULL, MS_BIND|MS_REC, NULL) < 0)
-                        errExit("mount bind");
-                free(proc_src);
-                free(proc_dst);
+                if (bind_mount_by_fd(src, dst))
+                        errExit("mounting pulseaudio");
                 close(src);
                 close(dst);
+                free(pulse);
 
                 // update /etc/machine-id in chroot
                 update_file(parentfd, "etc/machine-id");
@@ -256,11 +241,8 @@ void fs_chroot(const char *rootdir) {
         fd = openat(parentfd, &RUN_FIREJAIL_LIB_DIR[1], O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
                 errExit("open");
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(RUN_FIREJAIL_LIB_DIR, proc, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_path_to_fd(RUN_FIREJAIL_LIB_DIR, fd))
                 errExit("mount bind");
-        free(proc);
         close(fd);
 
         // create /run/firejail/mnt directory in chroot
@@ -271,29 +253,22 @@ void fs_chroot(const char *rootdir) {
         fd = openat(parentfd, &RUN_MNT_DIR[1], O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
                 errExit("open");
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(RUN_MNT_DIR, proc, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_path_to_fd(RUN_MNT_DIR, fd))
                 errExit("mount bind");
-        free(proc);
         close(fd);
 
         // update chroot resolv.conf
         update_file(parentfd, "etc/resolv.conf");
 
-#ifdef HAVE_GCOV
         __gcov_flush();
-#endif
+
         // create /run/firejail/mnt/oroot
         char *oroot = RUN_OVERLAY_ROOT;
         if (mkdir(oroot, 0755) == -1)
                 errExit("mkdir");
         // mount the chroot dir on top of /run/firejail/mnt/oroot in order to reuse the apparmor rules for overlay
-        if (asprintf(&proc, "/proc/self/fd/%d", parentfd) == -1)
-                errExit("asprintf");
-        if (mount(proc, oroot, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_fd_to_path(parentfd, oroot))
                 errExit("mounting rootdir oroot");
-        free(proc);
         close(parentfd);
         // chroot into the new directory
         if (arg_debug)
diff --git a/src/firejail/cmdline.c b/src/firejail/cmdline.c
index f902c4e1c..6f7739da0 100644
--- a/src/firejail/cmdline.c
+++ b/src/firejail/cmdline.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -26,7 +26,7 @@
 #include <assert.h>
 #include <errno.h>
 
-static int cmdline_length(int argc, char **argv, int index) {
+static int cmdline_length(int argc, char **argv, int index, bool want_extra_quotes) {
         assert(index != -1);
 
         unsigned i,j;
@@ -46,10 +46,11 @@ static int cmdline_length(int argc, char **argv, int index) {
                                         len += 3;
                                 in_quotes = false;
                         } else {
-                                if (!in_quotes)
+                                if (!in_quotes && want_extra_quotes)
                                         len++;
                                 len++;
-                                in_quotes = true;
+                                if (want_extra_quotes)
+                                        in_quotes = true;
                         }
                 }
                 if (in_quotes) {
@@ -64,7 +65,7 @@ static int cmdline_length(int argc, char **argv, int index) {
         return len;
 }
 
-static void quote_cmdline(char *command_line, char *window_title, int len, int argc, char **argv, int index) {
+static void quote_cmdline(char *command_line, char *window_title, int len, int argc, char **argv, int index, bool want_extra_quotes) {
         assert(index != -1);
 
         unsigned i,j;
@@ -103,14 +104,15 @@ static void quote_cmdline(char *command_line, char *window_title, int len, int a
                         // anything other
                         else
                         {
-                                if (!in_quotes) {
+                                if (!in_quotes && want_extra_quotes) {
                                         // open quotes
                                         ptr1[0] = '\'';
                                         ptr1++;
                                 }
                                 ptr1[0] = argv[i + index][j];
                                 ptr1++;
-                                in_quotes = true;
+                                if (want_extra_quotes)
+                                        in_quotes = true;
                         }
                 }
                 // close quotes
@@ -134,12 +136,12 @@ static void quote_cmdline(char *command_line, char *window_title, int len, int a
         assert((unsigned) len == strlen(command_line));
 }
 
-void build_cmdline(char **command_line, char **window_title, int argc, char **argv, int index) {
+void build_cmdline(char **command_line, char **window_title, int argc, char **argv, int index, bool want_extra_quotes) {
         // index == -1 could happen if we have --shell=none and no program was specified
         // the program should exit with an error before entering this function
         assert(index != -1);
 
-        int len = cmdline_length(argc, argv, index);
+        int len = cmdline_length(argc, argv, index, want_extra_quotes);
         if (len > ARG_MAX) {
                 errno = E2BIG;
                 errExit("cmdline_length");
@@ -152,7 +154,7 @@ void build_cmdline(char **command_line, char **window_title, int argc, char **ar
         if (!*window_title)
                         errExit("malloc");
 
-        quote_cmdline(*command_line, *window_title, len, argc, argv, index);
+        quote_cmdline(*command_line, *window_title, len, argc, argv, index, want_extra_quotes);
 
         if (arg_debug)
                 printf("Building quoted command line: %s\n", *command_line);
@@ -161,17 +163,17 @@ void build_cmdline(char **command_line, char **window_title, int argc, char **ar
         assert(*window_title);
 }
 
-void build_appimage_cmdline(char **command_line, char **window_title, int argc, char **argv, int index) {
+void build_appimage_cmdline(char **command_line, char **window_title, int argc, char **argv, int index, bool want_extra_quotes) {
         // index == -1 could happen if we have --shell=none and no program was specified
         // the program should exit with an error before entering this function
         assert(index != -1);
 
         char *apprun_path = RUN_FIREJAIL_APPIMAGE_DIR "/AppRun";
 
-        int len1 = cmdline_length(argc, argv, index);  // length of argv w/o changes
-        int len2 = cmdline_length(1, &argv[index], 0); // apptest.AppImage
-        int len3 = cmdline_length(1, &apprun_path, 0); // /run/firejail/appimage/AppRun
-        int len4 = (len1 - len2 + len3) + 1;           // apptest.AppImage is replaced by /path/to/AppRun
+        int len1 = cmdline_length(argc, argv, index, want_extra_quotes);  // length of argv w/o changes
+        int len2 = cmdline_length(1, &argv[index], 0, want_extra_quotes); // apptest.AppImage
+        int len3 = cmdline_length(1, &apprun_path, 0, want_extra_quotes); // /run/firejail/appimage/AppRun
+        int len4 = (len1 - len2 + len3) + 1;                              // apptest.AppImage is replaced by /path/to/AppRun
 
         if (len4 > ARG_MAX) {
                 errno = E2BIG;
@@ -187,7 +189,7 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
                         errExit("malloc");
 
         // run default quote_cmdline
-        quote_cmdline(command_line_tmp, *window_title, len1, argc, argv, index);
+        quote_cmdline(command_line_tmp, *window_title, len1, argc, argv, index, want_extra_quotes);
 
         assert(command_line_tmp);
         assert(*window_title);
diff --git a/src/firejail/cpu.c b/src/firejail/cpu.c
index 3427e8ade..1ec510456 100644
--- a/src/firejail/cpu.c
+++ b/src/firejail/cpu.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -75,7 +75,7 @@ void save_cpu(void) {
         if (cfg.cpus == 0)
                 return;
 
-        FILE *fp = fopen(RUN_CPU_CFG, "w");
+        FILE *fp = fopen(RUN_CPU_CFG, "wxe");
         if (fp) {
                 fprintf(fp, "%x\n", cfg.cpus);
                 SET_PERMS_STREAM(fp, 0, 0, 0600);
@@ -91,7 +91,7 @@ void load_cpu(const char *fname) {
         if (!fname)
                 return;
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp) {
                 unsigned tmp;
                 int rv = fscanf(fp, "%x", &tmp);
@@ -139,7 +139,7 @@ static void print_cpu(int pid) {
         }
 
         EUID_ROOT();    // grsecurity
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         EUID_USER();    // grsecurity
         if (!fp) {
                 printf("  Error: cannot open %s\n", file);
diff --git a/src/firejail/dbus.c b/src/firejail/dbus.c
index 658b84537..66738bd4b 100644
--- a/src/firejail/dbus.c
+++ b/src/firejail/dbus.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -180,7 +180,7 @@ static void dbus_check_bus_profile(char const *prefix, DbusPolicy *policy) {
                 }
         }
 
-        if (num_matches > 0) {
+        if (num_matches > 0 && !arg_quiet) {
                 assert(first_match != NULL);
                 if (num_matches == 1) {
                         fprintf(stderr, "Ignoring \"%s\".\n", first_match);
@@ -258,12 +258,8 @@ static char *find_user_socket_by_format(char *format) {
         if (asprintf(&dbus_user_socket, format, (int) getuid()) == -1)
                 errExit("asprintf");
         struct stat s;
-        if (stat(dbus_user_socket, &s) == -1) {
-                if (errno == ENOENT)
-                        goto fail;
-                return NULL;
-                errExit("stat");
-        }
+        if (lstat(dbus_user_socket, &s) == -1)
+                goto fail;
         if (!S_ISSOCK(s.st_mode))
                 goto fail;
         return dbus_user_socket;
@@ -301,11 +297,12 @@ void dbus_proxy_start(void) {
         if (dbus_proxy_pid == -1)
                 errExit("fork");
         if (dbus_proxy_pid == 0) {
-                int i;
-                for (i = STDERR_FILENO + 1; i < FIREJAIL_MAX_FD; i++) {
-                        if (i != status_pipe[1] && i != args_pipe[0])
-                                close(i); // close open files
-                }
+                // close open files
+                int keep[2];
+                keep[0] = status_pipe[1];
+                keep[1] = args_pipe[0];
+                close_all(keep, ARRAY_SIZE(keep));
+
                 if (arg_dbus_log_file != NULL) {
                         int output_fd = creat(arg_dbus_log_file, 0666);
                         if (output_fd < 0)
@@ -416,7 +413,7 @@ void dbus_proxy_stop(void) {
 }
 
 static void socket_overlay(char *socket_path, char *proxy_path) {
-        int fd = safe_fd(proxy_path, O_PATH | O_NOFOLLOW | O_CLOEXEC);
+        int fd = safer_openat(-1, proxy_path, O_PATH | O_NOFOLLOW | O_CLOEXEC);
         if (fd == -1)
                 errExit("opening DBus proxy socket");
         struct stat s;
@@ -426,12 +423,8 @@ static void socket_overlay(char *socket_path, char *proxy_path) {
                 errno = ENOTSOCK;
                 errExit("mounting DBus proxy socket");
         }
-        char *proxy_fd_path;
-        if (asprintf(&proxy_fd_path, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(proxy_path, socket_path, NULL, MS_BIND | MS_REC, NULL) == -1)
+        if (bind_mount_fd_to_path(fd, socket_path))
                 errExit("mount bind");
-        free(proxy_fd_path);
         close(fd);
 }
 
@@ -478,7 +471,7 @@ void dbus_apply_policy(void) {
         create_empty_dir_as_root(RUN_DBUS_DIR, 0755);
 
         if (arg_dbus_user != DBUS_POLICY_ALLOW) {
-                create_empty_file_as_root(RUN_DBUS_USER_SOCKET, 0700);
+                create_empty_file_as_root(RUN_DBUS_USER_SOCKET, 0600);
 
                 if (arg_dbus_user == DBUS_POLICY_FILTER) {
                         assert(dbus_user_proxy_socket != NULL);
@@ -517,7 +510,7 @@ void dbus_apply_policy(void) {
         }
 
         if (arg_dbus_system != DBUS_POLICY_ALLOW) {
-                create_empty_file_as_root(RUN_DBUS_SYSTEM_SOCKET, 0700);
+                create_empty_file_as_root(RUN_DBUS_SYSTEM_SOCKET, 0600);
 
                 if (arg_dbus_system == DBUS_POLICY_FILTER) {
                         assert(dbus_system_proxy_socket != NULL);
diff --git a/src/firejail/dhcp.c b/src/firejail/dhcp.c
index bdbb338d5..fb66d74ff 100644
--- a/src/firejail/dhcp.c
+++ b/src/firejail/dhcp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -93,7 +93,7 @@ static pid_t dhcp_read_pidfile(const Dhclient *client) {
         while (found == 0 && tries < 10) {
                 if (tries >= 1)
                         usleep(100000);
-                FILE *pidfile = fopen(client->pid_file, "r");
+                FILE *pidfile = fopen(client->pid_file, "re");
                 if (pidfile) {
                         long pid;
                         if (fscanf(pidfile, "%ld", &pid) == 1)
@@ -153,19 +153,13 @@ void dhcp_start(void) {
         if (!any_dhcp())
                 return;
 
-        char *dhclient_path = RUN_MNT_DIR "/dhclient";;
+        char *dhclient_path = RUN_MNT_DIR "/dhclient";
         struct stat s;
         if (stat(dhclient_path, &s) == -1) {
-                dhclient_path = "/usr/sbin/dhclient";
-                if (stat(dhclient_path, &s) == -1) {
-                        fprintf(stderr, "Error: dhclient was not found.\n");
-                        exit(1);
-                }
+                fprintf(stderr, "Error: %s was not found.\n", dhclient_path);
+                exit(1);
         }
 
-        sbox_run(SBOX_ROOT| SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", dhclient_path, RUN_MNT_DIR);
-        dhclient_path = RUN_MNT_DIR "/dhclient";
-
         EUID_ROOT();
         if (mkdir(RUN_DHCLIENT_DIR, 0700))
                 errExit("mkdir");
diff --git a/src/firejail/env.c b/src/firejail/env.c
index 03818df0b..963288459 100644
--- a/src/firejail/env.c
+++ b/src/firejail/env.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -22,6 +22,7 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <dirent.h>
+#include <limits.h>
 
 typedef struct env_t {
         struct env_t *next;
@@ -59,12 +60,7 @@ void env_ibus_load(void) {
         if (asprintf(&dirname, "%s/.config/ibus/bus", cfg.homedir) == -1)
                 errExit("asprintf");
 
-        struct stat s;
-        if (stat(dirname, &s) == -1)
-                return;
-
         // find the file
-        /* coverity[toctou] */
         DIR *dir = opendir(dirname);
         if (!dir) {
                 free(dirname);
@@ -84,7 +80,7 @@ void env_ibus_load(void) {
                 char *fname;
                 if (asprintf(&fname, "%s/%s", dirname, entry->d_name) == -1)
                         errExit("asprintf");
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 free(fname);
                 if (!fp)
                         continue;
@@ -267,7 +263,7 @@ static const char * const env_whitelist[] = {
         "LANG",
         "LANGUAGE",
         "LC_MESSAGES",
-        "PATH",
+        // "PATH",
         "DISPLAY"       // required by X11
 };
 
@@ -316,6 +312,10 @@ void env_apply_whitelist(void) {
                 errExit("clearenv");
 
         env_apply_list(env_whitelist, ARRAY_SIZE(env_whitelist));
+
+        // hardcoding PATH
+        if (setenv("PATH", "/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin", 1) < 0)
+                errExit("setenv");
 }
 
 // Filter env variables for a sbox app
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index e07035ae6..316518534 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -22,6 +22,7 @@
 #include "../include/common.h"
 #include "../include/euid_common.h"
 #include "../include/rundefs.h"
+#include <linux/limits.h> // Note: Plain limits.h may break ARG_MAX (see #4583)
 #include <stdarg.h>
 #include <sys/stat.h>
 
@@ -45,6 +46,15 @@
                 assert(s.st_gid == gid);\
                 assert((s.st_mode & 07777) == (mode));\
         } while (0)
+#define ASSERT_PERMS_AS_USER(file, uid, gid, mode) \
+        do { \
+                assert(file);\
+                struct stat s;\
+                if (stat_as_user(file, &s) == -1) errExit("stat");\
+                assert(s.st_uid == uid);\
+                assert(s.st_gid == gid);\
+                assert((s.st_mode & 07777) == (mode));\
+        } while (0)
 #define ASSERT_PERMS_FD(fd, uid, gid, mode) \
         do { \
                 struct stat s;\
@@ -122,26 +132,22 @@ typedef struct interface_t {
         uint8_t configured;
 } Interface;
 
+typedef struct topdir_t {
+        char *path;
+        int fd;
+} TopDir;
+
 typedef struct profile_entry_t {
         struct profile_entry_t *next;
         char *data;     // command
 
         // whitelist command parameters
-        char *link;     // link name - set if the file is a link
-        enum {
-                WLDIR_HOME = 1, // whitelist in home directory
-                WLDIR_TMP,      // whitelist in /tmp directory
-                WLDIR_MEDIA,    // whitelist in /media directory
-                WLDIR_MNT,      // whitelist in /mnt directory
-                WLDIR_VAR,      // whitelist in /var directory
-                WLDIR_DEV,      // whitelist in /dev directory
-                WLDIR_OPT,      // whitelist in /opt directory
-                WLDIR_SRV,      // whitelist in /srv directory
-                WLDIR_ETC,      // whitelist in /etc directory
-                WLDIR_SHARE,    // whitelist in /usr/share directory
-                WLDIR_MODULE,   // whitelist in /sys/module directory
-                WLDIR_RUN       // whitelist in /run/user/$uid directory
-        } wldir;
+        struct wparam_t {
+                char *file;             // resolved file path
+                char *link;             // link path
+                TopDir *top;    // top level directory
+        } *wparam;
+
 } ProfileEntry;
 
 typedef struct config_t {
@@ -151,8 +157,11 @@ typedef struct config_t {
 
         // filesystem
         ProfileEntry *profile;
+        ProfileEntry *profile_rebuild_etc;      // blacklist files in /etc directory used by fs_rebuild_etc()
+
 #define MAX_PROFILE_IGNORE 32
         char *profile_ignore[MAX_PROFILE_IGNORE];
+        char *keep_fd;          // inherit file descriptors to sandbox
         char *chrootdir;        // chroot directory
         char *home_private;     // private home directory
         char *home_private_keep;        // keep list for private home directory
@@ -314,15 +323,16 @@ extern int arg_private_cwd;	// private working directory
 extern int arg_scan;            // arp-scan all interfaces
 extern int arg_whitelist;       // whitelist command
 extern int arg_nosound; // disable sound
-extern int arg_noautopulse; // disable automatic ~/.config/pulse init
 extern int arg_novideo; //disable video devices in /dev
 extern int arg_no3d;            // disable 3d hardware acceleration
+extern int arg_noprinters;      // disable printers
 extern int arg_quiet;           // no output for scripting
 extern int arg_join_network;    // join only the network namespace
 extern int arg_join_filesystem; // join only the mount namespace
 extern int arg_nice;            // nice value configured
 extern int arg_ipc;             // enable ipc namespace
 extern int arg_writable_etc;    // writable etc
+extern int arg_keep_config_pulse;       // disable automatic ~/.config/pulse init
 extern int arg_writable_var;    // writable var
 extern int arg_keep_var_tmp; // don't overwrite /var/tmp
 extern int arg_writable_run_user;       // writable /run/user
@@ -333,7 +343,7 @@ extern int arg_allow_debuggers;	// allow debuggers
 extern int arg_x11_block;       // block X11
 extern int arg_x11_xorg;        // use X11 security extension
 extern int arg_allusers;        // all user home directories visible
-extern int arg_machineid;       // preserve /etc/machine-id
+extern int arg_machineid;       // spoof /etc/machine-id
 extern int arg_disable_mnt;     // disable /mnt and /media
 extern int arg_noprofile;       // use default.profile if none other found/specified
 extern int arg_memory_deny_write_execute;       // block writable and executable memory
@@ -342,6 +352,8 @@ extern int arg_nodvd;	// --nodvd
 extern int arg_nou2f;   // --nou2f
 extern int arg_noinput; // --noinput
 extern int arg_deterministic_exit_code; // always exit with first child's exit status
+extern int arg_deterministic_shutdown;  // shut down the sandbox if first child dies
+extern int arg_keep_fd_all;     // inherit all file descriptors to sandbox
 
 typedef enum {
         DBUS_POLICY_ALLOW,      // Allow unrestricted access to the bus
@@ -353,6 +365,7 @@ extern DbusPolicy arg_dbus_system; // --dbus-system
 extern int arg_dbus_log_user;
 extern int arg_dbus_log_system;
 extern const char *arg_dbus_log_file;
+extern int arg_tab;
 
 extern int login_shell;
 extern int parent_to_child_fds[2];
@@ -426,13 +439,15 @@ void fs_proc_sys_dev_boot(void);
 void disable_config(void);
 // build a basic read-only filesystem
 void fs_basic_fs(void);
-// mount overlayfs on top of / directory
-char *fs_check_overlay_dir(const char *subdirname, int allow_reuse);
-void fs_overlayfs(void);
 void fs_private_tmp(void);
 void fs_private_cache(void);
 void fs_mnt(const int enforce);
 
+// fs_overlayfs.c
+char *fs_check_overlay_dir(const char *subdirname, int allow_reuse);
+void fs_overlayfs(void);
+int remove_overlay_directory(void);
+
 // chroot.c
 // chroot into an existing directory; mount existing /dev and update /etc/resolv.conf
 void fs_check_chroot_dir(void);
@@ -493,7 +508,9 @@ int macro_id(const char *name);
 void errLogExit(char* fmt, ...) __attribute__((noreturn));
 void fwarning(char* fmt, ...);
 void fmessage(char* fmt, ...);
-void drop_privs(int nogroups);
+long long unsigned parse_arg_size(char *str);
+int check_can_drop_all_groups();
+void drop_privs(int force_nogroups);
 int mkpath_as_root(const char* path);
 void extract_command_name(int index, char **argv);
 void logsignal(int s);
@@ -502,11 +519,15 @@ void logargs(int argc, char **argv) ;
 void logerr(const char *msg);
 void set_nice(int inc);
 int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
-void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
+void copy_file_as_user(const char *srcname, const char *destname, mode_t mode);
 void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode);
 void touch_file_as_user(const char *fname, mode_t mode);
 int is_dir(const char *fname);
 int is_link(const char *fname);
+char *realpath_as_user(const char *fname);
+ssize_t readlink_as_user(const char *fname, char *buf, size_t sz);
+int stat_as_user(const char *fname, struct stat *s);
+int lstat_as_user(const char *fname, struct stat *s);
 void trim_trailing_slash_or_dot(char *path);
 char *line_remove_spaces(const char *buf);
 char *split_comma(char *str);
@@ -518,8 +539,7 @@ void update_map(char *mapping, char *map_file);
 void wait_for_other(int fd);
 void notify_other(int fd);
 uid_t pid_get_uid(pid_t pid);
-uid_t get_group_id(const char *group);
-int remove_overlay_directory(void);
+gid_t get_group_id(const char *groupname);
 void flush_stdin(void);
 int create_empty_dir_as_user(const char *dir, mode_t mode);
 void create_empty_dir_as_root(const char *dir, mode_t mode);
@@ -529,12 +549,17 @@ void mkdir_attr(const char *fname, mode_t mode, uid_t uid, gid_t gid);
 unsigned extract_timeout(const char *str);
 void disable_file_or_dir(const char *fname);
 void disable_file_path(const char *path, const char *file);
-int safe_fd(const char *path, int flags);
+int safer_openat(int dirfd, const char *path, int flags);
+int remount_by_fd(int dst, unsigned long mountflags);
+int bind_mount_by_fd(int src, int dst);
+int bind_mount_path_to_fd(const char *srcname, int dst);
+int bind_mount_fd_to_path(int src, const char *destname);
+void close_all(int *keep_list, size_t sz);
 int has_handler(pid_t pid, int signal);
 void enter_network_namespace(pid_t pid);
 int read_pid(const char *name, pid_t *pid);
 pid_t require_pid(const char *name);
-void check_homedir(void);
+void check_homedir(const char *dir);
 
 // Get info regarding the last kernel mount operation from /proc/self/mountinfo
 // The return value points to a static area, and will be overwritten by subsequent calls.
@@ -548,8 +573,8 @@ typedef struct {
 
 // mountinfo.c
 MountData *get_last_mount(void);
-int get_mount_id(const char *path);
-char **build_mount_array(const int mount_id, const char *path);
+int get_mount_id(int fd);
+char **build_mount_array(const int mountid, const char *path);
 
 // fs_var.c
 void fs_var_log(void);  // mounting /var/log
@@ -606,13 +631,13 @@ void caps_print_filter(pid_t pid) __attribute__((noreturn));
 void caps_drop_dac_override(void);
 
 // fs_trace.c
-void fs_trace_preload(void);
+void fs_trace_touch_preload(void);
+void fs_trace_touch_or_store_preload(void);
 void fs_tracefile(void);
 void fs_trace(void);
 
 // fs_hostname.c
 void fs_hostname(const char *hostname);
-void fs_resolvconf(void);
 char *fs_check_hosts_file(const char *fname);
 void fs_store_hosts_file(void);
 void fs_mount_hosts_file(void);
@@ -630,12 +655,15 @@ void cpu_print_filter(pid_t pid) __attribute__((noreturn));
 // cgroup.c
 void save_cgroup(void);
 void load_cgroup(const char *fname);
-void set_cgroup(const char *path);
+void check_cgroup_file(const char *fname);
+void set_cgroup(const char *fname, pid_t pid);
 
 // output.c
 void check_output(int argc, char **argv);
 
 // netfilter.c
+void netfilter_netlock(pid_t pid);
+void netfilter_trace(pid_t pid);
 void check_netfilter_file(const char *fname);
 void netfilter(const char *fname);
 void netfilter6(const char *fname);
@@ -655,6 +683,7 @@ void fs_machineid(void);
 void fs_private_dir_copy(const char *private_dir, const char *private_run_dir, const char *private_list);
 void fs_private_dir_mount(const char *private_dir, const char *private_run_dir);
 void fs_private_dir_list(const char *private_dir, const char *private_run_dir, const char *private_list);
+void fs_rebuild_etc(void);
 
 // no_sandbox.c
 int check_namespace_virt(void);
@@ -682,6 +711,7 @@ void env_ibus_load(void);
 void fs_whitelist(void);
 
 // pulseaudio.c
+void pipewire_disable(void);
 void pulseaudio_init(void);
 void pulseaudio_disable(void);
 
@@ -689,6 +719,8 @@ void pulseaudio_disable(void);
 void fs_private_bin_list(void);
 
 // fs_lib.c
+int is_firejail_link(const char *fname);
+char *find_in_path(const char *program);
 void fs_private_lib(void);
 
 // protocol.c
@@ -763,27 +795,30 @@ enum {
         CFG_NETWORK,
         CFG_RESTRICTED_NETWORK,
         CFG_FORCE_NONEWPRIVS,
-        CFG_WHITELIST,
         CFG_XEPHYR_WINDOW_TITLE,
         CFG_OVERLAYFS,
-        CFG_PRIVATE_HOME,
+        CFG_PRIVATE_BIN,
         CFG_PRIVATE_BIN_NO_LOCAL,
+        CFG_PRIVATE_CACHE,
+        CFG_PRIVATE_ETC,
+        CFG_PRIVATE_HOME,
+        CFG_PRIVATE_LIB,
+        CFG_PRIVATE_OPT,
+        CFG_PRIVATE_SRV,
         CFG_FIREJAIL_PROMPT,
-        CFG_FOLLOW_SYMLINK_AS_USER,
         CFG_DISABLE_MNT,
         CFG_JOIN,
         CFG_ARP_PROBES,
         CFG_XPRA_ATTACH,
         CFG_BROWSER_DISABLE_U2F,
         CFG_BROWSER_ALLOW_DRM,
-        CFG_PRIVATE_LIB,
         CFG_APPARMOR,
         CFG_DBUS,
-        CFG_PRIVATE_CACHE,
         CFG_CGROUP,
         CFG_NAME_CHANGE,
         CFG_SECCOMP_ERROR_ACTION,
         // CFG_FILE_COPY_LIMIT - file copy limit handled using setenv/getenv
+        CFG_ALLOW_TRAY,
         CFG_MAX // this should always be the last entry
 };
 extern char *xephyr_screen;
@@ -794,11 +829,14 @@ extern char *xvfb_extra_params;
 extern char *netfilter_default;
 extern unsigned long join_timeout;
 extern char *config_seccomp_error_action_str;
+extern char *config_seccomp_filter_add;
+extern char **whitelist_reject_topdirs;
 
 int checkcfg(int val);
 void print_compiletime_support(void);
 
 // appimage.c
+int appimage_find_profile(const char *archive);
 void appimage_set(const char *appimage_path);
 void appimage_mount(void);
 void appimage_clear(void);
@@ -807,15 +845,14 @@ void appimage_clear(void);
 long unsigned int appimage2_size(int fd);
 
 // cmdline.c
-void build_cmdline(char **command_line, char **window_title, int argc, char **argv, int index);
-void build_appimage_cmdline(char **command_line, char **window_title, int argc, char **argv, int index);
+void build_cmdline(char **command_line, char **window_title, int argc, char **argv, int index, bool want_extra_quotes);
+void build_appimage_cmdline(char **command_line, char **window_title, int argc, char **argv, int index, bool want_extra_quotes);
 
 // sbox.c
 // programs
 #define PATH_FNET_MAIN (LIBDIR "/firejail/fnet")                // when called from main thread
 #define PATH_FNET (RUN_FIREJAIL_LIB_DIR "/fnet")        // when called from sandbox thread
 
-//#define PATH_FNETFILTER (LIBDIR "/firejail/fnetfilter")
 #define PATH_FNETFILTER (RUN_FIREJAIL_LIB_DIR "/fnetfilter")
 
 #define PATH_FIREMON (PREFIX "/bin/firemon")
@@ -828,17 +865,16 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
 // it is also run from inside the sandbox by --debug; in this case we do an access(filename, X_OK) test first
 #define PATH_FSEC_PRINT (LIBDIR "/firejail/fsec-print")
 
-//#define PATH_FSEC_OPTIMIZE (LIBDIR "/firejail/fsec-optimize")
 #define PATH_FSEC_OPTIMIZE (RUN_FIREJAIL_LIB_DIR "/fsec-optimize")
 
-//#define PATH_FCOPY (LIBDIR "/firejail/fcopy")
 #define PATH_FCOPY (RUN_FIREJAIL_LIB_DIR "/fcopy")
 
 #define SBOX_STDIN_FILE "/run/firejail/mnt/sbox_stdin"
 
-//#define PATH_FLDD (LIBDIR "/firejail/fldd")
 #define PATH_FLDD (RUN_FIREJAIL_LIB_DIR "/fldd")
 
+#define PATH_FIDS (LIBDIR "/firejail/fids")
+
 // bitmapped filters for sbox_run
 #define SBOX_ROOT (1 << 0)                      // run the sandbox as root
 #define SBOX_USER (1 << 1)                      // run the sandbox as a regular user
@@ -850,7 +886,6 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc,
 #define SBOX_CAPS_HIDEPID (1 << 7)      // hidepid caps filter for running firemon
 #define SBOX_CAPS_NET_SERVICE (1 << 8) // caps filter for programs running network services
 #define SBOX_KEEP_FDS (1 << 9) // keep file descriptors open
-#define FIREJAIL_MAX_FD 20 // getdtablesize() is overkill for a firejail process
 
 // run sbox
 int sbox_run(unsigned filter, int num, ...);
@@ -883,4 +918,7 @@ void dhcp_start(void);
 // selinux.c
 void selinux_relabel_path(const char *path, const char *inside_path);
 
+// ids.c
+void run_ids(int argc, char **argv);
+
 #endif
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index fc67a15f3..c03cd7a12 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,11 +18,9 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/mount.h>
-#include <sys/stat.h>
 #include <sys/statvfs.h>
-#include <sys/wait.h>
-#include <linux/limits.h>
 #include <fnmatch.h>
 #include <glob.h>
 #include <dirent.h>
@@ -34,7 +32,7 @@
 #endif
 
 #define MAX_BUF 4096
-#define EMPTY_STRING ("")
+
 // check noblacklist statements not matched by a proper blacklist in disable-*.inc files
 //#define TEST_NO_BLACKLIST_MATCHING
 
@@ -54,16 +52,10 @@ static char *opstr[] = {
         [MOUNT_RDWR_NOCHECK] = "read-write",
 };
 
-typedef enum {
-        UNSUCCESSFUL,
-        SUCCESSFUL
-} LAST_DISABLE_OPERATION;
-LAST_DISABLE_OPERATION last_disable = UNSUCCESSFUL;
-
 static void disable_file(OPERATION op, const char *filename) {
         assert(filename);
         assert(op <OPERATION_MAX);
-        last_disable = UNSUCCESSFUL;
+        EUID_ASSERT();
 
         // Resolve all symlinks
         char* fname = realpath(filename, NULL);
@@ -71,20 +63,24 @@ static void disable_file(OPERATION op, const char *filename) {
                 return;
         }
         if (fname == NULL && errno == EACCES) {
-                if (arg_debug)
-                        printf("Debug: no access to file %s, forcing mount\n", filename);
                 // realpath and stat functions will fail on FUSE filesystems
                 // they don't seem to like a uid of 0
                 // force mounting
-                int rv = mount(RUN_RO_DIR, filename, "none", MS_BIND, "mode=400,gid=0");
-                if (rv == 0)
-                        last_disable = SUCCESSFUL;
-                else {
-                        rv = mount(RUN_RO_FILE, filename, "none", MS_BIND, "mode=400,gid=0");
-                        if (rv == 0)
-                                last_disable = SUCCESSFUL;
+                int fd = open(filename, O_PATH|O_CLOEXEC);
+                if (fd < 0) {
+                        if (arg_debug)
+                                printf("Warning (blacklisting): cannot open %s: %s\n", filename, strerror(errno));
+                        return;
                 }
-                if (last_disable == SUCCESSFUL) {
+
+                EUID_ROOT();
+                int err = bind_mount_path_to_fd(RUN_RO_DIR, fd);
+                if (err != 0)
+                        err = bind_mount_path_to_fd(RUN_RO_FILE, fd);
+                EUID_USER();
+                close(fd);
+
+                if (err == 0) {
                         if (arg_debug)
                                 printf("Disable %s\n", filename);
                         if (op == BLACKLIST_FILE)
@@ -92,31 +88,39 @@ static void disable_file(OPERATION op, const char *filename) {
                         else
                                 fs_logger2("blacklist-nolog", filename);
                 }
-                else {
-                        if (arg_debug)
-                                printf("Warning (blacklisting): %s is an invalid file, skipping...\n", filename);
-                }
+                else if (arg_debug)
+                        printf("Warning (blacklisting): cannot mount on %s\n", filename);
 
                 return;
         }
 
-        // if the file is not present, do nothing
-        struct stat s;
-        if (fname == NULL)
+        assert(fname);
+        // check for firejail executable
+        // we might have a file found in ${PATH} pointing to /usr/bin/firejail
+        // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird
+        //     and expects Firefox to open in the same sandbox
+        if (strcmp(BINDIR "/firejail", fname) == 0) {
+                free(fname);
                 return;
-        if (stat(fname, &s) == -1) {
+        }
+
+        // if the file is not present, do nothing
+        int fd = open(fname, O_PATH|O_CLOEXEC);
+        if (fd < 0) {
                 if (arg_debug)
-                        fwarning("%s does not exist, skipping...\n", fname);
+                        printf("Warning (blacklisting): cannot open %s: %s\n", fname, strerror(errno));
                 free(fname);
                 return;
         }
 
-        // check for firejail executable
-        // we migth have a file found in ${PATH} pointing to /usr/bin/firejail
-        // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird
-        //     and expects Firefox to open in the same sandbox
-        if (strcmp(BINDIR "/firejail", fname) == 0)
+        struct stat s;
+        if (fstat(fd, &s) < 0) {
+                if (arg_debug)
+                        printf("Warning (blacklisting): cannot stat %s: %s\n", fname, strerror(errno));
+                free(fname);
+                close(fd);
                 return;
+        }
 
         // modify the file
         if (op == BLACKLIST_FILE || op == BLACKLIST_NOLOG) {
@@ -141,44 +145,64 @@ static void disable_file(OPERATION op, const char *filename) {
                                         printf(" - no logging\n");
                         }
 
+                        EUID_ROOT();
                         if (S_ISDIR(s.st_mode)) {
-                                if (mount(RUN_RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                                if (bind_mount_path_to_fd(RUN_RO_DIR, fd) < 0)
                                         errExit("disable file");
                         }
                         else {
-                                if (mount(RUN_RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
+                                if (bind_mount_path_to_fd(RUN_RO_FILE, fd) < 0)
                                         errExit("disable file");
                         }
-                        last_disable = SUCCESSFUL;
+                        EUID_USER();
+
                         if (op == BLACKLIST_FILE)
                                 fs_logger2("blacklist", fname);
                         else
                                 fs_logger2("blacklist-nolog", fname);
+
+                        // files in /etc will be reprocessed during /etc rebuild
+                        if (strncmp(fname, "/etc/", 5) == 0) {
+                                ProfileEntry *prf = malloc(sizeof(ProfileEntry));
+                                if (!prf)
+                                        errExit("malloc");
+                                memset(prf, 0, sizeof(ProfileEntry));
+                                prf->data = strdup(fname);
+                                if (!prf->data)
+                                        errExit("strdup");
+                                prf->next = cfg.profile_rebuild_etc;
+                                cfg.profile_rebuild_etc = prf;
+                        }
                 }
         }
         else if (op == MOUNT_READONLY || op == MOUNT_RDWR || op == MOUNT_NOEXEC) {
                 fs_remount_rec(fname, op);
-                // todo: last_disable = SUCCESSFUL;
         }
         else if (op == MOUNT_TMPFS) {
-                if (S_ISDIR(s.st_mode)) {
-                        if (getuid()) {
-                                if (strncmp(cfg.homedir, fname, strlen(cfg.homedir)) != 0 ||
-                                    fname[strlen(cfg.homedir)] != '/') {
-                                        fprintf(stderr, "Error: tmpfs outside $HOME is only available for root\n");
-                                        exit(1);
-                                }
+                if (!S_ISDIR(s.st_mode)) {
+                        fwarning("%s is not a directory; cannot mount a tmpfs on top of it.\n", fname);
+                        goto out;
+                }
+
+                uid_t uid = getuid();
+                if (uid != 0) {
+                        // only user owned directories in user home
+                        if (s.st_uid != uid ||
+                            strncmp(cfg.homedir, fname, strlen(cfg.homedir)) != 0 ||
+                            fname[strlen(cfg.homedir)] != '/') {
+                                fwarning("you are not allowed to mount a tmpfs on %s\n", fname);
+                                goto out;
                         }
-                        fs_tmpfs(fname, getuid());
-                        selinux_relabel_path(fname, fname);
-                        last_disable = SUCCESSFUL;
                 }
-                else
-                        fwarning("%s is not a directory; cannot mount a tmpfs on top of it.\n", fname);
+
+                fs_tmpfs(fname, uid);
+                selinux_relabel_path(fname, fname);
         }
         else
                 assert(0);
 
+out:
+        close(fd);
         free(fname);
 }
 
@@ -191,6 +215,7 @@ static int *nbcheck = NULL;
 // Treat pattern as a shell glob pattern and blacklist matching files
 static void globbing(OPERATION op, const char *pattern, const char *noblacklist[], size_t noblacklist_len) {
         assert(pattern);
+        EUID_ASSERT();
 
 #ifdef TEST_NO_BLACKLIST_MATCHING
         if (nbcheck_start == 0) {
@@ -253,6 +278,8 @@ static void globbing(OPERATION op, const char *pattern, const char *noblacklist[
 
 // blacklist files or directories by mounting empty files on top of them
 void fs_blacklist(void) {
+        EUID_ASSERT();
+
         ProfileEntry *entry = cfg.profile;
         if (!entry)
                 return;
@@ -294,11 +321,13 @@ void fs_blacklist(void) {
                         if (arg_debug)
                                 printf("Mount-bind %s on top of %s\n", dname1, dname2);
                         // preserve dname2 mode and ownership
+                        // EUID_ROOT(); - option not accessible to non-root users
                         if (mount(dname1, dname2, NULL, MS_BIND|MS_REC, NULL) < 0)
                                 errExit("mount bind");
                         /* coverity[toctou] */
                         if (set_perms(dname2,  s.st_uid, s.st_gid,s.st_mode))
                                 errExit("set_perms");
+                        // EUID_USER();
 
                         entry = entry->next;
                         continue;
@@ -376,16 +405,12 @@ void fs_blacklist(void) {
                         op = MOUNT_TMPFS;
                 }
                 else if (strncmp(entry->data, "mkdir ", 6) == 0) {
-                        EUID_USER();
                         fs_mkdir(entry->data + 6);
-                        EUID_ROOT();
                         entry = entry->next;
                         continue;
                 }
                 else if (strncmp(entry->data, "mkfile ", 7) == 0) {
-                        EUID_USER();
                         fs_mkfile(entry->data + 7);
-                        EUID_ROOT();
                         entry = entry->next;
                         continue;
                 }
@@ -449,11 +474,12 @@ void fs_blacklist(void) {
 
 // mount a writable tmpfs on directory; requires a resolved path
 void fs_tmpfs(const char *dir, unsigned check_owner) {
+        EUID_ASSERT();
         assert(dir);
         if (arg_debug)
                 printf("Mounting tmpfs on %s, check owner: %s\n", dir, (check_owner)? "yes": "no");
         // get a file descriptor for dir, fails if there is any symlink
-        int fd = safe_fd(dir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        int fd = safer_openat(-1, dir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
                 errExit("while opening directory");
         struct stat s;
@@ -471,13 +497,15 @@ void fs_tmpfs(const char *dir, unsigned check_owner) {
         struct statvfs buf;
         if (fstatvfs(fd, &buf) == -1)
                 errExit("fstatvfs");
-        unsigned long flags = buf.f_flag & ~(MS_RDONLY|MS_BIND);
+        unsigned long flags = buf.f_flag & ~(MS_RDONLY|MS_BIND|MS_REMOUNT);
         // mount via the symbolic link in /proc/self/fd
         char *proc;
         if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
                 errExit("asprintf");
+        EUID_ROOT();
         if (mount("tmpfs", proc, "tmpfs", flags|MS_NOSUID|MS_NODEV, options) < 0)
                 errExit("mounting tmpfs");
+        EUID_USER();
         // check the last mount operation
         MountData *mdata = get_last_mount();
         if (strcmp(mdata->fstype, "tmpfs") != 0 || strcmp(mdata->dir, dir) != 0)
@@ -490,38 +518,42 @@ void fs_tmpfs(const char *dir, unsigned check_owner) {
 
 // remount path, preserving other mount flags; requires a resolved path
 static void fs_remount_simple(const char *path, OPERATION op) {
+        EUID_ASSERT();
         assert(path);
 
         // open path without following symbolic links
-        int fd1 = safe_fd(path, O_PATH|O_NOFOLLOW|O_CLOEXEC);
-        if (fd1 == -1)
+        int fd = safer_openat(-1, path, O_PATH|O_NOFOLLOW|O_CLOEXEC);
+        if (fd < 0)
                 goto out;
-        struct stat s1;
-        if (fstat(fd1, &s1) == -1) {
+
+        struct stat s;
+        if (fstat(fd, &s) < 0) {
                 // fstat can fail with EACCES if path is a FUSE mount,
                 // mounted without 'allow_root' or 'allow_other'
                 if (errno != EACCES)
                         errExit("fstat");
-                close(fd1);
+                close(fd);
                 goto out;
         }
         // get mount flags
         struct statvfs buf;
-        if (fstatvfs(fd1, &buf) == -1)
-                errExit("fstatvfs");
+        if (fstatvfs(fd, &buf) < 0) {
+                close(fd);
+                goto out;
+        }
         unsigned long flags = buf.f_flag;
 
         // read-write option
         if (op == MOUNT_RDWR || op == MOUNT_RDWR_NOCHECK) {
                 // nothing to do if there is no read-only flag
                 if ((flags & MS_RDONLY) == 0) {
-                        close(fd1);
+                        close(fd);
                         return;
                 }
                 // allow only user owned directories, except the user is root
-                if (op != MOUNT_RDWR_NOCHECK && getuid() != 0 && s1.st_uid != getuid()) {
+                if (op != MOUNT_RDWR_NOCHECK && getuid() != 0 && s.st_uid != getuid()) {
                         fwarning("you are not allowed to change %s to read-write\n", path);
-                        close(fd1);
+                        close(fd);
                         return;
                 }
                 flags &= ~MS_RDONLY;
@@ -530,7 +562,7 @@ static void fs_remount_simple(const char *path, OPERATION op) {
         else if (op == MOUNT_NOEXEC) {
                 // nothing to do if path is mounted noexec already
                 if ((flags & (MS_NOEXEC|MS_NODEV|MS_NOSUID)) == (MS_NOEXEC|MS_NODEV|MS_NOSUID)) {
-                        close(fd1);
+                        close(fd);
                         return;
                 }
                 flags |= MS_NOEXEC|MS_NODEV|MS_NOSUID;
@@ -539,7 +571,7 @@ static void fs_remount_simple(const char *path, OPERATION op) {
         else if (op == MOUNT_READONLY) {
                 // nothing to do if path is mounted read-only already
                 if ((flags & MS_RDONLY) == MS_RDONLY) {
-                        close(fd1);
+                        close(fd);
                         return;
                 }
                 flags |= MS_RDONLY;
@@ -549,29 +581,37 @@ static void fs_remount_simple(const char *path, OPERATION op) {
 
         if (arg_debug)
                 printf("Mounting %s %s\n", opstr[op], path);
+
+        // make path a mount point:
         // mount --bind path path
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd1) == -1)
-                errExit("asprintf");
-        if (mount(proc, proc, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mount");
-        free(proc);
+        EUID_ROOT();
+        int err = bind_mount_by_fd(fd, fd);
+        EUID_USER();
+        if (err) {
+                close(fd);
+                goto out;
+        }
 
-        // mount --bind -o remount,ro path
-        // need to open path again without following symbolic links
-        int fd2 = safe_fd(path, O_PATH|O_NOFOLLOW|O_CLOEXEC);
-        if (fd2 == -1)
-                errExit("open");
+        // remount the mount point
+        // need to open path again
+        int fd2 = safer_openat(-1, path, O_PATH|O_NOFOLLOW|O_CLOEXEC);
+        close(fd); // earliest timepoint to close fd
+        if (fd2 < 0)
+                goto out;
+
+        // device and inode number should be the same
         struct stat s2;
-        if (fstat(fd2, &s2) == -1)
+        if (fstat(fd2, &s2) < 0)
                 errExit("fstat");
-        // device and inode number should be the same
-        if (s1.st_dev != s2.st_dev || s1.st_ino != s2.st_ino)
+        if (s.st_dev != s2.st_dev || s.st_ino != s2.st_ino)
                 errLogExit("invalid %s mount", opstr[op]);
-        if (asprintf(&proc, "/proc/self/fd/%d", fd2) == -1)
-                errExit("asprintf");
-        if (mount(NULL, proc, NULL, flags|MS_BIND|MS_REMOUNT, NULL) < 0)
-                errExit("mount");
+
+        EUID_ROOT();
+        err = remount_by_fd(fd2, flags);
+        EUID_USER();
+        close(fd2);
+        if (err)
+                goto out;
 
         // run a sanity check on /proc/self/mountinfo and confirm that target of the last
         // mount operation was path; if there are other mount points contained inside path,
@@ -582,10 +622,8 @@ static void fs_remount_simple(const char *path, OPERATION op) {
            (*(mptr->dir + len) != '\0' && *(mptr->dir + len) != '/'))
            && strcmp(path, "/") != 0) // support read-only=/
                 errLogExit("invalid %s mount", opstr[op]);
+
         fs_logger2(opstr[op], path);
-        free(proc);
-        close(fd1);
-        close(fd2);
         return;
 
 out:
@@ -593,38 +631,37 @@ out:
 }
 
 // remount recursively; requires a resolved path
-static void fs_remount_rec(const char *dir, OPERATION op) {
-        assert(dir);
-        struct stat s;
-        if (stat(dir, &s) != 0)
-                return;
-        if (!S_ISDIR(s.st_mode)) {
-                // no need to search in /proc/self/mountinfo for submounts if not a directory
-                fs_remount_simple(dir, op);
+static void fs_remount_rec(const char *path, OPERATION op) {
+        EUID_ASSERT();
+        assert(op < OPERATION_MAX);
+        assert(path);
+
+        // no need to search /proc/self/mountinfo for submounts if not a directory
+        int fd = open(path, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        if (fd < 0) {
+                fs_remount_simple(path, op);
                 return;
         }
-        // get mount point of the directory
-        int mountid = get_mount_id(dir);
-        if (mountid == -1)
-                return;
-        if (mountid == -2) {
-                // falling back to a simple remount on old kernels
-                static int mount_warning = 0;
-                if (!mount_warning) {
-                        fwarning("read-only, read-write and noexec options are not applied recursively\n");
-                        mount_warning = 1;
-                }
-                fs_remount_simple(dir, op);
+
+        // get mount id of the directory
+        int mountid = get_mount_id(fd);
+        close(fd);
+        if (mountid < 0) {
+                // falling back to a simple remount
+                fwarning("%s %s not applied recursively\n", opstr[op], path);
+                fs_remount_simple(path, op);
                 return;
         }
+
         // build array with all mount points that need to get remounted
-        char **arr = build_mount_array(mountid, dir);
-        assert(arr);
+        char **arr = build_mount_array(mountid, path);
+        if (!arr)
+                return;
         // remount
-        char **tmp = arr;
-        while (*tmp) {
-                fs_remount_simple(*tmp, op);
-                free(*tmp++);
+        int i;
+        for (i = 0; arr[i]; i++) {
+                fs_remount_simple(arr[i], op);
+                free(arr[i]);
         }
         free(arr);
 }
@@ -632,6 +669,14 @@ static void fs_remount_rec(const char *dir, OPERATION op) {
 // resolve a path and remount it
 void fs_remount(const char *path, OPERATION op, int rec) {
         assert(path);
+
+        int called_as_root = 0;
+        if (geteuid() == 0)
+                called_as_root = 1;
+
+        if (called_as_root)
+                EUID_USER();
+
         char *rpath = realpath(path, NULL);
         if (rpath) {
                 if (rec)
@@ -640,10 +685,14 @@ void fs_remount(const char *path, OPERATION op, int rec) {
                         fs_remount_simple(rpath, op);
                 free(rpath);
         }
+
+        if (called_as_root)
+                EUID_ROOT();
 }
 
 // Disable /mnt, /media, /run/mount and /run/media access
 void fs_mnt(const int enforce) {
+        EUID_USER();
         if (enforce) {
                 // disable-mnt set in firejail.config
                 // overriding with noblacklist is not possible in this case
@@ -653,13 +702,12 @@ void fs_mnt(const int enforce) {
                 disable_file(BLACKLIST_FILE, "/run/media");
         }
         else {
-                EUID_USER();
                 profile_add("blacklist /mnt");
                 profile_add("blacklist /media");
                 profile_add("blacklist /run/mount");
                 profile_add("blacklist /run/media");
-                EUID_ROOT();
         }
+        EUID_ROOT();
 }
 
 
@@ -674,7 +722,6 @@ void fs_proc_sys_dev_boot(void) {
                 errExit("mounting /proc/sys");
         fs_logger("read-only /proc/sys");
 
-
         /* Mount a version of /sys that describes the network namespace */
         if (arg_debug)
                 printf("Remounting /sys directory\n");
@@ -689,13 +736,13 @@ void fs_proc_sys_dev_boot(void) {
         else
                 fs_logger("remount /sys");
 
+        EUID_USER();
+
         disable_file(BLACKLIST_FILE, "/sys/firmware");
         disable_file(BLACKLIST_FILE, "/sys/hypervisor");
         { // allow user access to some directories in /sys/ by specifying 'noblacklist' option
-                EUID_USER();
                 profile_add("blacklist /sys/fs");
                 profile_add("blacklist /sys/module");
-                EUID_ROOT();
         }
         disable_file(BLACKLIST_FILE, "/sys/power");
         disable_file(BLACKLIST_FILE, "/sys/kernel/debug");
@@ -739,12 +786,8 @@ void fs_proc_sys_dev_boot(void) {
         // disable /dev/port
         disable_file(BLACKLIST_FILE, "/dev/port");
 
-
-
         // disable various ipc sockets in /run/user
         if (!arg_writable_run_user) {
-                struct stat s;
-
                 char *fname;
                 if (asprintf(&fname, "/run/user/%d", getuid()) == -1)
                         errExit("asprintf");
@@ -755,8 +798,7 @@ void fs_proc_sys_dev_boot(void) {
                                 errExit("asprintf");
                         if (create_empty_dir_as_user(fnamegpg, 0700))
                                 fs_logger2("create", fnamegpg);
-                        if (stat(fnamegpg, &s) == 0)
-                                disable_file(BLACKLIST_FILE, fnamegpg);
+                        disable_file(BLACKLIST_FILE, fnamegpg);
                         free(fnamegpg);
 
                         // disable /run/user/{uid}/systemd
@@ -765,8 +807,7 @@ void fs_proc_sys_dev_boot(void) {
                                 errExit("asprintf");
                         if (create_empty_dir_as_user(fnamesysd, 0755))
                                 fs_logger2("create", fnamesysd);
-                        if (stat(fnamesysd, &s) == 0)
-                                disable_file(BLACKLIST_FILE, fnamesysd);
+                        disable_file(BLACKLIST_FILE, fnamesysd);
                         free(fnamesysd);
                 }
                 free(fname);
@@ -777,35 +818,32 @@ void fs_proc_sys_dev_boot(void) {
                 disable_file(BLACKLIST_FILE, "/dev/kmsg");
                 disable_file(BLACKLIST_FILE, "/proc/kmsg");
         }
+
+        EUID_ROOT();
 }
 
 // disable firejail configuration in ~/.config/firejail
 void disable_config(void) {
-        struct stat s;
-
+        EUID_USER();
+#ifndef HAVE_ONLY_SYSCFG_PROFILES
         char *fname;
         if (asprintf(&fname, "%s/.config/firejail", cfg.homedir) == -1)
                 errExit("asprintf");
-        if (stat(fname, &s) == 0)
-                disable_file(BLACKLIST_FILE, fname);
+        disable_file(BLACKLIST_FILE, fname);
         free(fname);
+#endif
 
         // disable run time information
-        if (stat(RUN_FIREJAIL_NETWORK_DIR, &s) == 0)
-                disable_file(BLACKLIST_FILE, RUN_FIREJAIL_NETWORK_DIR);
-        if (stat(RUN_FIREJAIL_BANDWIDTH_DIR, &s) == 0)
-                disable_file(BLACKLIST_FILE, RUN_FIREJAIL_BANDWIDTH_DIR);
-        if (stat(RUN_FIREJAIL_NAME_DIR, &s) == 0)
-                disable_file(BLACKLIST_FILE, RUN_FIREJAIL_NAME_DIR);
-        if (stat(RUN_FIREJAIL_PROFILE_DIR, &s) == 0)
-                disable_file(BLACKLIST_FILE, RUN_FIREJAIL_PROFILE_DIR);
-        if (stat(RUN_FIREJAIL_X11_DIR, &s) == 0)
-                disable_file(BLACKLIST_FILE, RUN_FIREJAIL_X11_DIR);
+        disable_file(BLACKLIST_FILE, RUN_FIREJAIL_NETWORK_DIR);
+        disable_file(BLACKLIST_FILE, RUN_FIREJAIL_BANDWIDTH_DIR);
+        disable_file(BLACKLIST_FILE, RUN_FIREJAIL_NAME_DIR);
+        disable_file(BLACKLIST_FILE, RUN_FIREJAIL_PROFILE_DIR);
+        disable_file(BLACKLIST_FILE, RUN_FIREJAIL_X11_DIR);
+        EUID_ROOT();
 }
 
 
 // build a basic read-only filesystem
-// top level directories could be links, run no after-mount checks
 void fs_basic_fs(void) {
         uid_t uid = getuid();
 
@@ -815,6 +853,7 @@ void fs_basic_fs(void) {
         if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
                 errExit("mounting /proc");
 
+        EUID_USER();
         if (arg_debug)
                 printf("Basic read-only filesystem:\n");
         if (!arg_writable_etc) {
@@ -834,6 +873,7 @@ void fs_basic_fs(void) {
         fs_remount("/lib64", MOUNT_READONLY, 1);
         fs_remount("/lib32", MOUNT_READONLY, 1);
         fs_remount("/libx32", MOUNT_READONLY, 1);
+        EUID_ROOT();
 
         // update /var directory in order to support multiple sandboxes running on the same root directory
         fs_var_lock();
@@ -858,369 +898,9 @@ void fs_basic_fs(void) {
 }
 
 
-
-#ifdef HAVE_OVERLAYFS
-char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
-        assert(subdirname);
-        struct stat s;
-        char *dirname;
-
-        if (asprintf(&dirname, "%s/.firejail", cfg.homedir) == -1)
-                errExit("asprintf");
-        // check if ~/.firejail already exists
-        if (lstat(dirname, &s) == 0) {
-                if (!S_ISDIR(s.st_mode)) {
-                        if (S_ISLNK(s.st_mode))
-                                fprintf(stderr, "Error: %s is a symbolic link\n", dirname);
-                        else
-                                fprintf(stderr, "Error: %s is not a directory\n", dirname);
-                        exit(1);
-                }
-                if (s.st_uid != getuid()) {
-                        fprintf(stderr, "Error: %s is not owned by the current user\n", dirname);
-                        exit(1);
-                }
-        }
-        else {
-                // create ~/.firejail directory
-                create_empty_dir_as_user(dirname, 0700);
-                if (stat(dirname, &s) == -1) {
-                        fprintf(stderr, "Error: cannot create directory %s\n", dirname);
-                        exit(1);
-                }
-        }
-        free(dirname);
-
-        // check overlay directory
-        if (asprintf(&dirname, "%s/.firejail/%s", cfg.homedir, subdirname) == -1)
-                errExit("asprintf");
-        if (lstat(dirname, &s) == 0) {
-                if (!S_ISDIR(s.st_mode)) {
-                        if (S_ISLNK(s.st_mode))
-                                fprintf(stderr, "Error: %s is a symbolic link\n", dirname);
-                        else
-                                fprintf(stderr, "Error: %s is not a directory\n", dirname);
-                        exit(1);
-                }
-                if (s.st_uid != 0) {
-                        fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", dirname);
-                        exit(1);
-                }
-                if (allow_reuse == 0) {
-                        fprintf(stderr, "Error: overlay directory exists, but reuse is not allowed\n");
-                        exit(1);
-                }
-        }
-
-        return dirname;
-}
-
-
-
-// mount overlayfs on top of / directory
-// mounting an overlay and chrooting into it:
-//
-// Old Ubuntu kernel
-// # cd ~
-// # mkdir -p overlay/root
-// # mkdir -p overlay/diff
-// # mount -t overlayfs -o lowerdir=/,upperdir=/root/overlay/diff overlayfs /root/overlay/root
-// # chroot /root/overlay/root
-// to shutdown, first exit the chroot and then  unmount the overlay
-// # exit
-// # umount /root/overlay/root
-//
-// Kernels 3.18+
-// # cd ~
-// # mkdir -p overlay/root
-// # mkdir -p overlay/diff
-// # mkdir -p overlay/work
-// # mount -t overlay -o lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work overlay /root/overlay/root
-// # cat /etc/mtab | grep overlay
-// /root/overlay /root/overlay/root overlay rw,relatime,lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work 0 0
-// # chroot /root/overlay/root
-// to shutdown, first exit the chroot and then  unmount the overlay
-// # exit
-// # umount /root/overlay/root
-
-
-// to do: fix the code below; also, it might work without /dev, but consider keeping /dev/shm; add locking mechanism for overlay-clean
-#include <sys/utsname.h>
-void fs_overlayfs(void) {
-        struct stat s;
-
-        // check kernel version
-        struct utsname u;
-        int rv = uname(&u);
-        if (rv != 0)
-                errExit("uname");
-        int major;
-        int minor;
-        if (2 != sscanf(u.release, "%d.%d", &major, &minor)) {
-                fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version);
-                exit(1);
-        }
-
-        if (arg_debug)
-                printf("Linux kernel version %d.%d\n", major, minor);
-        int oldkernel = 0;
-        if (major < 3) {
-                fprintf(stderr, "Error: minimum kernel version required 3.x\n");
-                exit(1);
-        }
-        if (major == 3 && minor < 18)
-                oldkernel = 1;
-
-        // mounting an overlayfs on top of / seems to be broken for kernels > 4.19
-        // we disable overlayfs for now, pending fixing
-        if (major >= 4 &&minor >= 19) {
-                fprintf(stderr, "Error: OverlayFS disabled for Linux kernels 4.19 and newer, pending fixing.\n");
-                exit(1);
-        }
-
-        char *oroot = RUN_OVERLAY_ROOT;
-        mkdir_attr(oroot, 0755, 0, 0);
-
-        // set base for working and diff directories
-        char *basedir = RUN_MNT_DIR;
-        int basefd = -1;
-
-        if (arg_overlay_keep) {
-                basedir = cfg.overlay_dir;
-                assert(basedir);
-                // get a file descriptor for ~/.firejail, fails if there is any symlink
-                char *firejail;
-                if (asprintf(&firejail, "%s/.firejail", cfg.homedir) == -1)
-                        errExit("asprintf");
-                int fd = safe_fd(firejail, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-                if (fd == -1)
-                        errExit("safe_fd");
-                free(firejail);
-                // create basedir if it doesn't exist
-                // the new directory will be owned by root
-                const char *dirname = gnu_basename(basedir);
-                if (mkdirat(fd, dirname, 0755) == -1 && errno != EEXIST) {
-                        perror("mkdir");
-                        fprintf(stderr, "Error: cannot create overlay directory %s\n", basedir);
-                        exit(1);
-                }
-                // open basedir
-                basefd = openat(fd, dirname, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-                close(fd);
-        }
-        else {
-                basefd = open(basedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-        }
-        if (basefd == -1) {
-                perror("open");
-                fprintf(stderr, "Error: cannot open overlay directory %s\n", basedir);
-                exit(1);
-        }
-
-        // confirm once more base is owned by root
-        if (fstat(basefd, &s) == -1)
-                errExit("fstat");
-        if (s.st_uid != 0) {
-                fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", basedir);
-                exit(1);
-        }
-        // confirm permissions of base are 0755
-        if (((S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH) & s.st_mode) != (S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH)) {
-                fprintf(stderr, "Error: invalid permissions on overlay directory %s\n", basedir);
-                exit(1);
-        }
-
-        // create diff and work directories inside base
-        // no need to check arg_overlay_reuse
-        char *odiff;
-        if (asprintf(&odiff, "%s/odiff", basedir) == -1)
-                errExit("asprintf");
-        // the new directory will be owned by root
-        if (mkdirat(basefd, "odiff", 0755) == -1 && errno != EEXIST) {
-                perror("mkdir");
-                fprintf(stderr, "Error: cannot create overlay directory %s\n", odiff);
-                exit(1);
-        }
-        ASSERT_PERMS(odiff, 0, 0, 0755);
-
-        char *owork;
-        if (asprintf(&owork, "%s/owork", basedir) == -1)
-                errExit("asprintf");
-        // the new directory will be owned by root
-        if (mkdirat(basefd, "owork", 0755) == -1 && errno != EEXIST) {
-                perror("mkdir");
-                fprintf(stderr, "Error: cannot create overlay directory %s\n", owork);
-                exit(1);
-        }
-        ASSERT_PERMS(owork, 0, 0, 0755);
-
-        // mount overlayfs
-        if (arg_debug)
-                printf("Mounting OverlayFS\n");
-        char *option;
-        if (oldkernel) { // old Ubuntu/OpenSUSE kernels
-                if (arg_overlay_keep) {
-                        fprintf(stderr, "Error: option --overlay= not available for kernels older than 3.18\n");
-                        exit(1);
-                }
-                if (asprintf(&option, "lowerdir=/,upperdir=%s", odiff) == -1)
-                        errExit("asprintf");
-                if (mount("overlayfs", oroot, "overlayfs", MS_MGC_VAL, option) < 0)
-                        errExit("mounting overlayfs");
-        }
-        else { // kernel 3.18 or newer
-                if (asprintf(&option, "lowerdir=/,upperdir=%s,workdir=%s", odiff, owork) == -1)
-                        errExit("asprintf");
-                if (mount("overlay", oroot, "overlay", MS_MGC_VAL, option) < 0) {
-                        fprintf(stderr, "Debug: running on kernel version %d.%d\n", major, minor);
-                        errExit("mounting overlayfs");
-                }
-
-                //***************************
-                // issue #263 start code
-                // My setup has a separate mount point for /home. When the overlay is mounted,
-                // the overlay does not contain the original /home contents.
-                // I added code to create a second overlay for /home if the overlay home dir is empty and this seems to work
-                // @dshmgh, Jan 2016
-                {
-                        char *overlayhome;
-                        struct stat s;
-                        char *hroot;
-                        char *hdiff;
-                        char *hwork;
-
-                        // dons add debug
-                        if (arg_debug) printf ("DEBUG: chroot dirs are oroot %s  odiff %s  owork %s\n",oroot,odiff,owork);
-
-                        // BEFORE NEXT, WE NEED TO TEST IF /home has any contents or do we need to mount it?
-                        // must create var for oroot/cfg.homedir
-                        if (asprintf(&overlayhome, "%s%s", oroot, cfg.homedir) == -1)
-                                errExit("asprintf");
-                        if (arg_debug) printf ("DEBUG: overlayhome var holds ##%s##\n", overlayhome);
-
-                        // if no homedir in overlay -- create another overlay for /home
-                        if (stat(cfg.homedir, &s) == 0 && stat(overlayhome, &s) == -1) {
-
-                                // no need to check arg_overlay_reuse
-                                if (asprintf(&hdiff, "%s/hdiff", basedir) == -1)
-                                        errExit("asprintf");
-                                // the new directory will be owned by root
-                                if (mkdirat(basefd, "hdiff", 0755) == -1 && errno != EEXIST) {
-                                        perror("mkdir");
-                                        fprintf(stderr, "Error: cannot create overlay directory %s\n", hdiff);
-                                        exit(1);
-                                }
-                                ASSERT_PERMS(hdiff, 0, 0, 0755);
-
-                                // no need to check arg_overlay_reuse
-                                if (asprintf(&hwork, "%s/hwork", basedir) == -1)
-                                        errExit("asprintf");
-                                // the new directory will be owned by root
-                                if (mkdirat(basefd, "hwork", 0755) == -1 && errno != EEXIST) {
-                                        perror("mkdir");
-                                        fprintf(stderr, "Error: cannot create overlay directory %s\n", hwork);
-                                        exit(1);
-                                }
-                                ASSERT_PERMS(hwork, 0, 0, 0755);
-
-                                // no homedir in overlay so now mount another overlay for /home
-                                if (asprintf(&hroot, "%s/home", oroot) == -1)
-                                        errExit("asprintf");
-                                if (asprintf(&option, "lowerdir=/home,upperdir=%s,workdir=%s", hdiff, hwork) == -1)
-                                        errExit("asprintf");
-                                if (mount("overlay", hroot, "overlay", MS_MGC_VAL, option) < 0)
-                                        errExit("mounting overlayfs for mounted home directory");
-
-                                printf("OverlayFS for /home configured in %s directory\n", basedir);
-                                free(hroot);
-                                free(hdiff);
-                                free(hwork);
-
-                        } // stat(overlayhome)
-                        free(overlayhome);
-                }
-                // issue #263 end code
-                //***************************
-        }
-        fmessage("OverlayFS configured in %s directory\n", basedir);
-        close(basefd);
-
-        // /dev, /run and /tmp are not covered by the overlay
-        // mount-bind dev directory
-        if (arg_debug)
-                printf("Mounting /dev\n");
-        char *dev;
-        if (asprintf(&dev, "%s/dev", oroot) == -1)
-                errExit("asprintf");
-        if (mount("/dev", dev, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mounting /dev");
-        fs_logger("whitelist /dev");
-
-        // mount-bind run directory
-        if (arg_debug)
-                printf("Mounting /run\n");
-        char *run;
-        if (asprintf(&run, "%s/run", oroot) == -1)
-                errExit("asprintf");
-        if (mount("/run", run, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mounting /run");
-        fs_logger("whitelist /run");
-
-        // mount-bind tmp directory
-        if (arg_debug)
-                printf("Mounting /tmp\n");
-        char *tmp;
-        if (asprintf(&tmp, "%s/tmp", oroot) == -1)
-                errExit("asprintf");
-        if (mount("/tmp", tmp, NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mounting /tmp");
-        fs_logger("whitelist /tmp");
-
-        // chroot in the new filesystem
-#ifdef HAVE_GCOV
-        __gcov_flush();
-#endif
-        if (chroot(oroot) == -1)
-                errExit("chroot");
-
-        // mount a new proc filesystem
-        if (arg_debug)
-                printf("Mounting /proc filesystem representing the PID namespace\n");
-        if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
-                errExit("mounting /proc");
-
-        // update /var directory in order to support multiple sandboxes running on the same root directory
-//      if (!arg_private_dev)
-//              fs_dev_shm();
-        fs_var_lock();
-        if (!arg_keep_var_tmp)
-                fs_var_tmp();
-        if (!arg_writable_var_log)
-                fs_var_log();
-        fs_var_lib();
-        fs_var_cache();
-        fs_var_utmp();
-        fs_machineid();
-
-        // don't leak user information
-        restrict_users();
-
-        // when starting as root, firejail config is not disabled;
-        if (getuid() != 0)
-                disable_config();
-
-        // cleanup and exit
-        free(option);
-        free(odiff);
-        free(owork);
-        free(dev);
-        free(run);
-        free(tmp);
-}
-#endif
-
 // this function is called from sandbox.c before blacklist/whitelist functions
 void fs_private_tmp(void) {
+        EUID_ASSERT();
         if (arg_debug)
                 printf("Generate private-tmp whitelist commands\n");
 
@@ -1241,8 +921,10 @@ void fs_private_tmp(void) {
 
         // whitelist x11 directory
         profile_add("whitelist /tmp/.X11-unix");
-        // read-only x11 directory
-        profile_add("read-only /tmp/.X11-unix");
+        profile_add("read-only /tmp/.X11-unix");
+
+        // whitelist sndio directory
+        profile_add("whitelist /tmp/sndio");
 
         // whitelist any pulse* file in /tmp directory
         // some distros use PulseAudio sockets under /tmp instead of the socket in /urn/user
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c
index 61398f12b..2b0b3003e 100644
--- a/src/firejail/fs_bin.c
+++ b/src/firejail/fs_bin.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -41,9 +41,9 @@ static char *paths[] = {
 
 // return 1 if found, 0 if not found
 static char *check_dir_or_file(const char *name) {
+        EUID_ASSERT();
         assert(name);
         struct stat s;
-        char *fname = NULL;
 
         int i = 0;
         while (paths[i]) {
@@ -54,50 +54,34 @@ static char *check_dir_or_file(const char *name) {
                 }
 
                 // check file
+                char *fname;
                 if (asprintf(&fname, "%s/%s", paths[i], name) == -1)
                         errExit("asprintf");
                 if (arg_debug)
                         printf("Checking %s/%s\n", paths[i], name);
-                if (stat(fname, &s) == 0 && !S_ISDIR(s.st_mode)) { // do not allow directories
-                        // check symlink to firejail executable in /usr/local/bin
-                        if (strcmp(paths[i], "/usr/local/bin") == 0 && is_link(fname)) {
-                                /* coverity[toctou] */
-                                char *actual_path = realpath(fname, NULL);
-                                if (actual_path) {
-                                        char *ptr = strstr(actual_path, "/firejail");
-                                        if (ptr && strlen(ptr) == strlen("/firejail")) {
-                                                if (arg_debug)
-                                                        printf("firejail exec symlink detected\n");
-                                                free(actual_path);
-                                                free(fname);
-                                                fname = NULL;
-                                                i++;
-                                                continue;
-                                        }
-                                        free(actual_path);
-                                }
-
-                        }
+                if (stat(fname, &s) == 0 &&
+                    !S_ISDIR(s.st_mode) &&      // do not allow directories
+                    !is_firejail_link(fname)) { // skip symlinks to firejail executable, as created by firecfg
+                        free(fname);
                         break; // file found
                 }
 
                 free(fname);
-                fname = NULL;
                 i++;
         }
 
-        if (!fname) {
+        if (!paths[i]) {
                 if (arg_debug)
                         fwarning("file %s not found\n", name);
                 return NULL;
         }
 
-        free(fname);
         return paths[i];
 }
 
 // return 1 if the file is in paths[]
 static int valid_full_path_file(const char *name) {
+        EUID_ASSERT();
         assert(name);
 
         if (*name != '/')
@@ -149,6 +133,7 @@ static void report_duplication(const char *fname) {
 }
 
 static void duplicate(char *fname) {
+        EUID_ASSERT();
         assert(fname);
 
         if (*fname == '~' || strstr(fname, "..")) {
@@ -220,6 +205,7 @@ static void duplicate(char *fname) {
 }
 
 static void globbing(char *fname) {
+        EUID_ASSERT();
         assert(fname);
 
         // go directly to duplicate() if no globbing char is present - see man 7 glob
@@ -256,6 +242,9 @@ static void globbing(char *fname) {
                         // testing for GLOB_NOCHECK - no pattern matched returns the original pattern
                         if (strcmp(globbuf.gl_pathv[j], pattern) == 0)
                                 continue;
+                        // skip symlinks to firejail executable, as created by firecfg
+                        if (is_firejail_link(globbuf.gl_pathv[j]))
+                                continue;
 
                         duplicate(globbuf.gl_pathv[j]);
                 }
@@ -267,6 +256,7 @@ static void globbing(char *fname) {
 }
 
 void fs_private_bin_list(void) {
+        EUID_ASSERT();
         char *private_list = cfg.bin_private_keep;
         assert(private_list);
 
@@ -274,7 +264,9 @@ void fs_private_bin_list(void) {
         timetrace_start();
 
         // create /run/firejail/mnt/bin directory
+        EUID_ROOT();
         mkdir_attr(RUN_BIN_DIR, 0755, 0, 0);
+        EUID_USER();
 
         if (arg_debug)
                 printf("Copying files in the new bin directory\n");
@@ -293,9 +285,9 @@ void fs_private_bin_list(void) {
         while ((ptr = strtok(NULL, ",")) != NULL)
                 globbing(ptr);
         free(dlist);
-        fs_logger_print();
 
         // mount-bind
+        EUID_ROOT();
         int i = 0;
         while (paths[i]) {
                 struct stat s;
@@ -309,6 +301,9 @@ void fs_private_bin_list(void) {
                 }
                 i++;
         }
+        fs_logger_print();
+        EUID_USER();
+
         selinux_relabel_path(RUN_BIN_DIR, "/bin");
         fmessage("%d %s installed in %0.2f ms\n", prog_cnt, (prog_cnt == 1)? "program": "programs", timetrace_end());
 }
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c
index 2f0067c93..a6fbbb89a 100644
--- a/src/firejail/fs_dev.c
+++ b/src/firejail/fs_dev.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,7 +20,6 @@
 #include "firejail.h"
 #include <sys/mount.h>
 #include <sys/stat.h>
-#include <linux/limits.h>
 #include <glob.h>
 #include <dirent.h>
 #include <fcntl.h>
@@ -122,7 +121,7 @@ static void deventry_mount(void) {
                                                 i++;
                                                 continue;
                                         }
-                                        FILE *fp = fopen(dev[i].dev_fname, "w");
+                                        FILE *fp = fopen(dev[i].dev_fname, "we");
                                         if (fp) {
                                                 fprintf(fp, "\n");
                                                 SET_PERMS_STREAM(fp, s.st_uid, s.st_gid, s.st_mode);
@@ -187,8 +186,10 @@ static void mount_dev_shm(void) {
 static void process_dev_shm(void) {
         // Jack audio keeps an Unix socket under (/dev/shm/jack_default_1000_0 or /dev/shm/jack/...)
         // looking for jack socket
+        EUID_USER();
         glob_t globbuf;
         int globerr = glob(RUN_DEV_DIR "/shm/jack*", GLOB_NOSORT, NULL, &globbuf);
+        EUID_ROOT();
         if (globerr && !arg_keep_dev_shm) {
                 empty_dev_shm();
                 return;
@@ -218,7 +219,7 @@ void fs_private_dev(void){
         struct stat s;
         if (stat("/dev/log", &s) == 0) {
                 have_devlog = 1;
-                FILE *fp = fopen(RUN_DEVLOG_FILE, "w");
+                FILE *fp = fopen(RUN_DEVLOG_FILE, "we");
                 if (!fp)
                         have_devlog = 0;
                 else {
@@ -239,7 +240,7 @@ void fs_private_dev(void){
 
         // bring back /dev/log
         if (have_devlog) {
-                FILE *fp = fopen("/dev/log", "w");
+                FILE *fp = fopen("/dev/log", "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         fclose(fp);
@@ -328,8 +329,10 @@ void fs_dev_disable_sound(void) {
         }
 
         // disable all jack sockets in /dev/shm
+        EUID_USER();
         glob_t globbuf;
         int globerr = glob("/dev/shm/jack*", GLOB_NOSORT, NULL, &globbuf);
+        EUID_ROOT();
         if (globerr)
                 return;
 
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 8cb25a1ff..deaee31bb 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -24,6 +24,7 @@
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
+#include <dirent.h>
 
 // spoof /etc/machine_id
 void fs_machineid(void) {
@@ -52,7 +53,7 @@ void fs_machineid(void) {
         mid.u8[8] = (mid.u8[8] & 0x3F) | 0x80;
 
         // write it in a file
-        FILE *fp = fopen(RUN_MACHINEID, "w");
+        FILE *fp = fopen(RUN_MACHINEID, "we");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%08x%08x%08x%08x\n", mid.u32[0], mid.u32[1], mid.u32[2], mid.u32[3]);
@@ -141,7 +142,7 @@ errexit:
 static void duplicate(const char *fname, const char *private_dir, const char *private_run_dir) {
         assert(fname);
 
-        if (*fname == '~' || *fname == '/' || strncmp(fname, "..", 2) == 0) {
+        if (*fname == '~' || *fname == '/' || strstr(fname, "..")) {
                 fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
                 exit(1);
         }
@@ -164,7 +165,14 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
                 errExit("asprintf");
 
         build_dirs(src, dst, strlen(private_dir), strlen(private_run_dir));
-        sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FCOPY, src, dst);
+
+        // follow links! this will make a copy of the file or directory pointed by the symlink
+        // this will solve problems such as NixOS #4887
+        // don't follow links to dynamic directories such as /proc
+        if (strcmp(src, "/etc/mtab") == 0)
+                sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FCOPY, src, dst);
+        else
+                sbox_run(SBOX_ROOT | SBOX_SECCOMP, 4, PATH_FCOPY, "--follow-link", src, dst);
 
         free(dst);
         fs_logger2("clone", src);
@@ -250,3 +258,128 @@ void fs_private_dir_list(const char *private_dir, const char *private_run_dir, c
         fs_private_dir_mount(private_dir, private_run_dir);
         fmessage("Private %s installed in %0.2f ms\n", private_dir, timetrace_end());
 }
+
+void fs_rebuild_etc(void) {
+        int have_dhcp = 1;
+        if (cfg.dns1 == NULL && !any_dhcp())
+                have_dhcp = 0;
+
+        if (arg_debug)
+                printf("rebuilding /etc directory\n");
+        if (mkdir(RUN_DNS_ETC, 0755))
+                errExit("mkdir");
+        selinux_relabel_path(RUN_DNS_ETC, "/etc");
+        fs_logger("tmpfs /etc");
+
+        DIR *dir = opendir("/etc");
+        if (!dir)
+                errExit("opendir");
+
+        struct stat s;
+        struct dirent *entry;
+        while ((entry = readdir(dir))) {
+                if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
+                        continue;
+
+                // skip files in cfg.profile_rebuild_etc list
+                // these files are already blacklisted
+                {
+                        ProfileEntry *prf = cfg.profile_rebuild_etc;
+                        int found = 0;
+                        while (prf) {
+                                if (strcmp(entry->d_name, prf->data + 5) == 0) { // 5 is strlen("/etc/")
+                                        found = 1;
+                                        break;
+                                }
+                                prf = prf->next;
+                        }
+                        if (found)
+                                continue;
+                }
+
+                // for resolv.conf we might have to  create a brand new file later
+                if (have_dhcp &&
+                    (strcmp(entry->d_name, "resolv.conf") == 0 ||
+                     strcmp(entry->d_name, "resolv.conf.dhclient-new") == 0))
+                        continue;
+//              printf("linking %s\n", entry->d_name);
+
+                char *src;
+                if (asprintf(&src, "/etc/%s", entry->d_name) == -1)
+                        errExit("asprintf");
+                if (stat(src, &s) != 0) {
+                        free(src);
+                        continue;
+                }
+
+                char *dest;
+                if (asprintf(&dest, "%s/%s", RUN_DNS_ETC, entry->d_name) == -1)
+                        errExit("asprintf");
+
+                int symlink_done = 0;
+                if (is_link(src)) {
+                        char *rp =realpath(src, NULL);
+                        if (rp == NULL) {
+                                free(src);
+                                free(dest);
+                                continue;
+                        }
+                        if (symlink(rp, dest))
+                                errExit("symlink");
+                        else
+                                symlink_done = 1;
+                }
+                else if (S_ISDIR(s.st_mode))
+                        create_empty_dir_as_root(dest, s.st_mode);
+                else
+                        create_empty_file_as_root(dest, s.st_mode);
+
+                // bind-mount src on top of dest
+                if (!symlink_done) {
+                        if (mount(src, dest, NULL, MS_BIND|MS_REC, NULL) < 0)
+                                errExit("mount bind mirroring /etc");
+                }
+                fs_logger2("clone", src);
+
+                free(src);
+                free(dest);
+        }
+        closedir(dir);
+
+        // mount bind our private etc directory on top of /etc
+        if (arg_debug)
+                printf("Mount-bind %s on top of /etc\n", RUN_DNS_ETC);
+        if (mount(RUN_DNS_ETC, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mount bind mirroring /etc");
+        fs_logger("mount /etc");
+
+        if (have_dhcp == 0)
+                return;
+
+        if (arg_debug)
+                printf("Creating a new /etc/resolv.conf file\n");
+        FILE *fp = fopen("/etc/resolv.conf", "wxe");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot create /etc/resolv.conf file\n");
+                exit(1);
+        }
+
+        if (cfg.dns1) {
+                if (any_dhcp())
+                        fwarning("network setup uses DHCP, nameservers will likely be overwritten\n");
+                fprintf(fp, "nameserver %s\n", cfg.dns1);
+        }
+        if (cfg.dns2)
+                fprintf(fp, "nameserver %s\n", cfg.dns2);
+        if (cfg.dns3)
+                fprintf(fp, "nameserver %s\n", cfg.dns3);
+        if (cfg.dns4)
+                fprintf(fp, "nameserver %s\n", cfg.dns4);
+
+        // mode and owner
+        SET_PERMS_STREAM(fp, 0, 0, 0644);
+
+        fclose(fp);
+
+        fs_logger("create /etc/resolv.conf");
+}
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 46f32d7ad..061461590 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -19,7 +19,6 @@
 */
 #include "firejail.h"
 #include <sys/mount.h>
-#include <linux/limits.h>
 #include <dirent.h>
 #include <errno.h>
 #include <sys/stat.h>
@@ -34,24 +33,48 @@
 #define O_PATH 010000000
 #endif
 
-static void skel(const char *homedir, uid_t u, gid_t g) {
+static void disable_tab_completion(const char *homedir) {
+        if (arg_tab)
+                return;
+
         char *fname;
+        if (asprintf(&fname, "%s/.inputrc", homedir) == -1)
+                errExit("asprintf");
+
+        // don't create a new one if we already have it
+        if (access(fname, F_OK)) {
+                FILE *fp = fopen(fname, "w");
+                if (!fp)
+                        errExit("fopen");
+                fprintf(fp, "set disable-completion on\n");
+                fclose(fp);
+                if (chmod(fname, 0644))
+                        errExit("chmod");
+        }
+        free(fname);
+}
+
+
+static void skel(const char *homedir) {
+        EUID_ASSERT();
+        char *fname;
+
+        disable_tab_completion(homedir);
 
         // zsh
         if (!arg_shell_none && (strcmp(cfg.shell,"/usr/bin/zsh") == 0 || strcmp(cfg.shell,"/bin/zsh") == 0)) {
                 // copy skel files
                 if (asprintf(&fname, "%s/.zshrc", homedir) == -1)
                         errExit("asprintf");
-                struct stat s;
                 // don't copy it if we already have the file
-                if (stat(fname, &s) == 0)
+                if (access(fname, F_OK) == 0)
                         return;
-                if (is_link(fname)) { // stat on dangling symlinks fails, try again using lstat
+                if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat
                         fprintf(stderr, "Error: invalid %s file\n", fname);
                         exit(1);
                 }
-                if (stat("/etc/skel/.zshrc", &s) == 0) {
-                        copy_file_as_user("/etc/skel/.zshrc", fname, u, g, 0644); // regular user
+                if (access("/etc/skel/.zshrc", R_OK) == 0) {
+                        copy_file_as_user("/etc/skel/.zshrc", fname, 0644); // regular user
                         fs_logger("clone /etc/skel/.zshrc");
                         fs_logger2("clone", fname);
                 }
@@ -67,17 +90,15 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
                 // copy skel files
                 if (asprintf(&fname, "%s/.cshrc", homedir) == -1)
                         errExit("asprintf");
-                struct stat s;
-
                 // don't copy it if we already have the file
-                if (stat(fname, &s) == 0)
+                if (access(fname, F_OK) == 0)
                         return;
-                if (is_link(fname)) { // stat on dangling symlinks fails, try again using lstat
+                if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat
                         fprintf(stderr, "Error: invalid %s file\n", fname);
                         exit(1);
                 }
-                if (stat("/etc/skel/.cshrc", &s) == 0) {
-                        copy_file_as_user("/etc/skel/.cshrc", fname, u, g, 0644); // regular user
+                if (access("/etc/skel/.cshrc", R_OK) == 0) {
+                        copy_file_as_user("/etc/skel/.cshrc", fname, 0644); // regular user
                         fs_logger("clone /etc/skel/.cshrc");
                         fs_logger2("clone", fname);
                 }
@@ -93,16 +114,15 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
                 // copy skel files
                 if (asprintf(&fname, "%s/.bashrc", homedir) == -1)
                         errExit("asprintf");
-                struct stat s;
                 // don't copy it if we already have the file
-                if (stat(fname, &s) == 0)
+                if (access(fname, F_OK) == 0)
                         return;
-                if (is_link(fname)) { // stat on dangling symlinks fails, try again using lstat
+                if (is_link(fname)) { // access(3) on dangling symlinks fails, try again using lstat
                         fprintf(stderr, "Error: invalid %s file\n", fname);
                         exit(1);
                 }
-                if (stat("/etc/skel/.bashrc", &s) == 0) {
-                        copy_file_as_user("/etc/skel/.bashrc", fname, u, g, 0644); // regular user
+                if (access("/etc/skel/.bashrc", R_OK) == 0) {
+                        copy_file_as_user("/etc/skel/.bashrc", fname, 0644); // regular user
                         fs_logger("clone /etc/skel/.bashrc");
                         fs_logger2("clone", fname);
                 }
@@ -112,6 +132,7 @@ static void skel(const char *homedir, uid_t u, gid_t g) {
 }
 
 static int store_xauthority(void) {
+        EUID_ASSERT();
         if (arg_x11_block)
                 return 0;
 
@@ -122,15 +143,16 @@ static int store_xauthority(void) {
                 errExit("asprintf");
 
         struct stat s;
-        if (stat(src, &s) == 0) {
-                if (is_link(src)) {
+        if (lstat(src, &s) == 0) {
+                if (S_ISLNK(s.st_mode)) {
                         fwarning("invalid .Xauthority file\n");
                         free(src);
                         return 0;
                 }
 
                 // create an empty file as root, and change ownership to user
-                FILE *fp = fopen(dest, "w");
+                EUID_ROOT();
+                FILE *fp = fopen(dest, "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, getuid(), getgid(), 0600);
@@ -138,10 +160,11 @@ static int store_xauthority(void) {
                 }
                 else
                         errExit("fopen");
+                EUID_USER();
 
-                copy_file_as_user(src, dest, getuid(), getgid(), 0600); // regular user
-                fs_logger2("clone", dest);
+                copy_file_as_user(src, dest, 0600); // regular user
                 selinux_relabel_path(dest, src);
+                fs_logger2("clone", dest);
                 free(src);
                 return 1; // file copied
         }
@@ -151,6 +174,7 @@ static int store_xauthority(void) {
 }
 
 static int store_asoundrc(void) {
+        EUID_ASSERT();
         if (arg_nosound)
                 return 0;
 
@@ -161,11 +185,11 @@ static int store_asoundrc(void) {
                 errExit("asprintf");
 
         struct stat s;
-        if (stat(src, &s) == 0) {
-                if (is_link(src)) {
+        if (lstat(src, &s) == 0) {
+                if (S_ISLNK(s.st_mode)) {
                         // make sure the real path of the file is inside the home directory
                         /* coverity[toctou] */
-                        char* rp = realpath(src, NULL);
+                        char *rp = realpath(src, NULL);
                         if (!rp) {
                                 fprintf(stderr, "Error: Cannot access %s\n", src);
                                 exit(1);
@@ -178,7 +202,8 @@ static int store_asoundrc(void) {
                 }
 
                 // create an empty file as root, and change ownership to user
-                FILE *fp = fopen(dest, "w");
+                EUID_ROOT();
+                FILE *fp = fopen(dest, "we");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, getuid(), getgid(), 0644);
@@ -186,10 +211,11 @@ static int store_asoundrc(void) {
                 }
                 else
                         errExit("fopen");
+                EUID_USER();
 
-                copy_file_as_user(src, dest, getuid(), getgid(), 0644); // regular user
-                selinux_relabel_path(dest, src);
+                copy_file_as_user(src, dest, 0644); // regular user
                 fs_logger2("clone", dest);
+                selinux_relabel_path(dest, src);
                 free(src);
                 return 1; // file copied
         }
@@ -199,6 +225,7 @@ static int store_asoundrc(void) {
 }
 
 static void copy_xauthority(void) {
+        EUID_ASSERT();
         // copy XAUTHORITY_FILE in the new home directory
         char *src = RUN_XAUTHORITY_FILE ;
         char *dest;
@@ -211,16 +238,18 @@ static void copy_xauthority(void) {
                 exit(1);
         }
 
-        copy_file_as_user(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR); // regular user
-        selinux_relabel_path(dest, src);
+        copy_file_as_user(src, dest, S_IRUSR | S_IWUSR); // regular user
         fs_logger2("clone", dest);
+        selinux_relabel_path(dest, dest);
         free(dest);
 
-        // delete the temporary file
-        unlink(src);
+        EUID_ROOT();
+        unlink(src); // delete the temporary file
+        EUID_USER();
 }
 
 static void copy_asoundrc(void) {
+        EUID_ASSERT();
         // copy ASOUNDRC_FILE in the new home directory
         char *src = RUN_ASOUNDRC_FILE ;
         char *dest;
@@ -233,12 +262,14 @@ static void copy_asoundrc(void) {
                 exit(1);
         }
 
-        copy_file_as_user(src, dest, getuid(), getgid(), S_IRUSR | S_IWUSR); // regular user
+        copy_file_as_user(src, dest, S_IRUSR | S_IWUSR); // regular user
         fs_logger2("clone", dest);
+        selinux_relabel_path(dest, dest);
         free(dest);
 
-        // delete the temporary file
-        unlink(src);
+        EUID_ROOT();
+        unlink(src); // delete the temporary file
+        EUID_USER();
 }
 
 // private mode (--private=homedir):
@@ -251,21 +282,22 @@ void fs_private_homedir(void) {
         char *private_homedir = cfg.home_private;
         assert(homedir);
         assert(private_homedir);
+        EUID_ASSERT();
+
+        uid_t u = getuid();
+        // gid_t g = getgid();
 
         int xflag = store_xauthority();
         int aflag = store_asoundrc();
 
-        uid_t u = getuid();
-        gid_t g = getgid();
-
         // mount bind private_homedir on top of homedir
         if (arg_debug)
                 printf("Mount-bind %s on top of %s\n", private_homedir, homedir);
         // get file descriptors for homedir and private_homedir, fails if there is any symlink
-        int src = safe_fd(private_homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        int src = safer_openat(-1, private_homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (src == -1)
                 errExit("opening private directory");
-        int dst = safe_fd(homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        int dst = safer_openat(-1, homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (dst == -1)
                 errExit("opening home directory");
         // both mount source and target should be owned by the user
@@ -286,17 +318,11 @@ void fs_private_homedir(void) {
                 exit(1);
         }
         // mount via the links in /proc/self/fd
-        char *proc_src, *proc_dst;
-        if (asprintf(&proc_src, "/proc/self/fd/%d", src) == -1)
-                errExit("asprintf");
-        if (asprintf(&proc_dst, "/proc/self/fd/%d", dst) == -1)
-                errExit("asprintf");
-        if (mount(proc_src, proc_dst, NULL, MS_NOSUID | MS_NODEV | MS_BIND | MS_REC, NULL) < 0)
+        EUID_ROOT();
+        if (bind_mount_by_fd(src, dst))
                 errExit("mount bind");
-        free(proc_src);
-        free(proc_dst);
-        close(src);
-        close(dst);
+        EUID_USER();
+
         // check /proc/self/mountinfo to confirm the mount is ok
         MountData *mptr = get_last_mount();
         size_t len = strlen(homedir);
@@ -304,6 +330,8 @@ void fs_private_homedir(void) {
            (*(mptr->dir + len) != '\0' && *(mptr->dir + len) != '/'))
                 errLogExit("invalid private mount");
 
+        close(src);
+        close(dst);
         fs_logger3("mount-bind", private_homedir, homedir);
         fs_logger2("whitelist", homedir);
 // preserve mode and ownership
@@ -312,6 +340,7 @@ void fs_private_homedir(void) {
 //      if (chmod(homedir, s.st_mode) == -1)
 //              errExit("mount-bind chmod");
 
+        EUID_ROOT();
         if (u != 0) {
                 // mask /root
                 if (arg_debug)
@@ -330,8 +359,9 @@ void fs_private_homedir(void) {
                 selinux_relabel_path("/home", "/home");
                 fs_logger("tmpfs /home");
         }
+        EUID_USER();
 
-        skel(homedir, u, g);
+        skel(homedir);
         if (xflag)
                 copy_xauthority();
         if (aflag)
@@ -346,12 +376,15 @@ void fs_private_homedir(void) {
 void fs_private(void) {
         char *homedir = cfg.homedir;
         assert(homedir);
+        EUID_ASSERT();
+
         uid_t u = getuid();
         gid_t g = getgid();
 
         int xflag = store_xauthority();
         int aflag = store_asoundrc();
 
+        EUID_ROOT();
         // mask /root
         if (arg_debug)
                 printf("Mounting a new /root directory\n");
@@ -369,12 +402,14 @@ void fs_private(void) {
                 selinux_relabel_path("/home", "/home");
                 fs_logger("tmpfs /home");
         }
+        EUID_USER();
 
         if (u != 0) {
                 if (!arg_allusers && strncmp(homedir, "/home/", 6) == 0) {
                         // create new empty /home/user directory
                         if (arg_debug)
                                 printf("Create a new user directory\n");
+                        EUID_ROOT();
                         if (mkdir(homedir, S_IRWXU) == -1) {
                                 if (mkpath_as_root(homedir) == -1)
                                         errExit("mkpath");
@@ -383,7 +418,7 @@ void fs_private(void) {
                         }
                         if (chown(homedir, u, g) < 0)
                                 errExit("chown");
-
+                        EUID_USER();
                         fs_logger2("mkdir", homedir);
                         fs_logger2("tmpfs", homedir);
                 }
@@ -395,7 +430,7 @@ void fs_private(void) {
                 selinux_relabel_path(homedir, homedir);
         }
 
-        skel(homedir, u, g);
+        skel(homedir);
         if (xflag)
                 copy_xauthority();
         if (aflag)
@@ -420,24 +455,40 @@ void fs_check_private_dir(void) {
 }
 
 // check new private working directory (--private-cwd= option) - exit if it fails
+// for testing:
+//    $ firejail --private --private-cwd=. --noprofile ls
+//      issue #4780: exposes full home directory, not the --private one
+//   $ firejail --private-cwd=.. --noprofile ls  -> error: full dir path required
+//   $ firejail --private-cwd=/etc --noprofile ls  -> OK
+//   $ firejail --private-cwd=FULL-SYMLINK-PATH  --noprofile ls  -> error: no symlinks
+//   $ firejail --private --private-cwd="${HOME}" --noprofile ls -al  --> OK
+//   $ firejail --private --private-cwd='${HOME}' --noprofile ls -al  --> OK
+//   $ firejail --private-cwd  --> OK: should go in top of the home dir
+//   profile with "private-cwd ${HOME}
 void fs_check_private_cwd(const char *dir) {
         EUID_ASSERT();
         invalid_filename(dir, 0); // no globbing
+        if (strcmp(dir, ".") == 0)
+                goto errout;
 
         // Expand the working directory
         cfg.cwd = expand_macros(dir);
 
         // realpath/is_dir not used because path may not exist outside of jail
-        if (strstr(cfg.cwd, "..")) {
-                fprintf(stderr, "Error: invalid private working directory\n");
-                exit(1);
-        }
+        if (strstr(cfg.cwd, "..") || *cfg.cwd != '/')
+                goto errout;
+
+        return;
+errout:
+        fprintf(stderr, "Error: invalid private working directory\n");
+        exit(1);
 }
 
 //***********************************************************************************
 // --private-home
 //***********************************************************************************
 static char *check_dir_or_file(const char *name) {
+        EUID_ASSERT();
         assert(name);
 
         // basic checks
@@ -498,6 +549,7 @@ errexit:
 }
 
 static void duplicate(char *name) {
+        EUID_ASSERT();
         char *fname = check_dir_or_file(name);
 
         if (arg_debug)
@@ -535,28 +587,32 @@ static void duplicate(char *name) {
 //      set skel files,
 //      restore .Xauthority
 void fs_private_home_list(void) {
-        timetrace_start();
-
         char *homedir = cfg.homedir;
         char *private_list = cfg.home_private_keep;
         assert(homedir);
         assert(private_list);
+        EUID_ASSERT();
 
-        int xflag = store_xauthority();
-        int aflag = store_asoundrc();
+        timetrace_start();
 
         uid_t uid = getuid();
         gid_t gid = getgid();
 
+        int xflag = store_xauthority();
+        int aflag = store_asoundrc();
+
+        EUID_ROOT();
         // create /run/firejail/mnt/home directory
         mkdir_attr(RUN_HOME_DIR, 0755, uid, gid);
         selinux_relabel_path(RUN_HOME_DIR, homedir);
-        fs_logger_print();      // save the current log
 
-        if (arg_debug)
-                printf("Copying files in the new home:\n");
+        // save the current log
+        fs_logger_print();
+        EUID_USER();
 
         // copy the list of files in the new home directory
+        if (arg_debug)
+                printf("Copying files in the new home:\n");
         char *dlist = strdup(cfg.home_private_keep);
         if (!dlist)
                 errExit("strdup");
@@ -576,7 +632,7 @@ void fs_private_home_list(void) {
         if (arg_debug)
                 printf("Mount-bind %s on top of %s\n", RUN_HOME_DIR, homedir);
 
-        int fd = safe_fd(homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        int fd = safer_openat(-1, homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
                 errExit("opening home directory");
         // home directory should be owned by the user
@@ -589,24 +645,19 @@ void fs_private_home_list(void) {
                 exit(1);
         }
         // mount using the file descriptor
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(RUN_HOME_DIR, proc, NULL, MS_BIND|MS_REC, NULL) < 0)
+        EUID_ROOT();
+        if (bind_mount_path_to_fd(RUN_HOME_DIR, fd))
                 errExit("mount bind");
-        free(proc);
+        EUID_USER();
         close(fd);
+
         // check /proc/self/mountinfo to confirm the mount is ok
         MountData *mptr = get_last_mount();
         if (strcmp(mptr->dir, homedir) != 0 || strcmp(mptr->fstype, "tmpfs") != 0)
                 errLogExit("invalid private-home mount");
         fs_logger2("tmpfs", homedir);
 
-        // mask RUN_HOME_DIR, it is writable and not noexec
-        if (mount("tmpfs", RUN_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                errExit("mounting tmpfs");
-        fs_logger2("tmpfs", RUN_HOME_DIR);
-
+        EUID_ROOT();
         if (uid != 0) {
                 // mask /root
                 if (arg_debug)
@@ -626,7 +677,12 @@ void fs_private_home_list(void) {
                 fs_logger("tmpfs /home");
         }
 
-        skel(homedir, uid, gid);
+        // mask RUN_HOME_DIR, it is writable and not noexec
+        if (mount("tmpfs", RUN_HOME_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
+                errExit("mounting tmpfs");
+        EUID_USER();
+
+        skel(homedir);
         if (xflag)
                 copy_xauthority();
         if (aflag)
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c
index 8a3bb71ea..dca394865 100644
--- a/src/firejail/fs_hostname.c
+++ b/src/firejail/fs_hostname.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,7 +20,6 @@
 #include "firejail.h"
 #include <sys/mount.h>
 #include <sys/stat.h>
-#include <linux/limits.h>
 #include <glob.h>
 #include <dirent.h>
 #include <fcntl.h>
@@ -33,7 +32,7 @@ void fs_hostname(const char *hostname) {
                 if (arg_debug)
                         printf("Creating a new /etc/hostname file\n");
 
-                create_empty_file_as_root(RUN_HOSTNAME_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+                create_empty_file_as_root(RUN_HOSTNAME_FILE, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
 
                 // bind-mount the file on top of /etc/hostname
                 if (mount(RUN_HOSTNAME_FILE, "/etc/hostname", NULL, MS_BIND|MS_REC, NULL) < 0)
@@ -47,11 +46,11 @@ void fs_hostname(const char *hostname) {
                         printf("Creating a new /etc/hosts file\n");
                 // copy /etc/host into our new file, and modify it on the fly
                 /* coverity[toctou] */
-                FILE *fp1 = fopen("/etc/hosts", "r");
+                FILE *fp1 = fopen("/etc/hosts", "re");
                 if (!fp1)
                         goto errexit;
 
-                FILE *fp2 = fopen(RUN_HOSTS_FILE, "w");
+                FILE *fp2 = fopen(RUN_HOSTS_FILE, "we");
                 if (!fp2) {
                         fclose(fp1);
                         goto errexit;
@@ -75,7 +74,7 @@ void fs_hostname(const char *hostname) {
                 }
                 fclose(fp1);
                 // mode and owner
-                SET_PERMS_STREAM(fp2, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+                SET_PERMS_STREAM(fp2, 0, 0, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
                 fclose(fp2);
 
                 // bind-mount the file on top of /etc/hostname
@@ -88,118 +87,11 @@ errexit:
         exit(1);
 }
 
-void fs_resolvconf(void) {
-        if (cfg.dns1 == NULL && !any_dhcp())
-                return;
-
-        if (arg_debug)
-                printf("mirroring /etc directory\n");
-        if (mkdir(RUN_DNS_ETC, 0755))
-                errExit("mkdir");
-        selinux_relabel_path(RUN_DNS_ETC, "/etc");
-        fs_logger("tmpfs /etc");
-
-        DIR *dir = opendir("/etc");
-        if (!dir)
-                errExit("opendir");
-
-        struct stat s;
-        struct dirent *entry;
-        while ((entry = readdir(dir))) {
-                if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
-                        continue;
-                // for resolv.conf we create a brand new file
-                if (strcmp(entry->d_name, "resolv.conf") == 0 ||
-        strcmp(entry->d_name, "resolv.conf.dhclient-new") == 0)
-                        continue;
-//              printf("linking %s\n", entry->d_name);
-
-                char *src;
-                if (asprintf(&src, "/etc/%s", entry->d_name) == -1)
-                        errExit("asprintf");
-                if (stat(src, &s) != 0) {
-                        free(src);
-                        continue;
-                }
-
-                char *dest;
-                if (asprintf(&dest, "%s/%s", RUN_DNS_ETC, entry->d_name) == -1)
-                        errExit("asprintf");
-
-                int symlink_done = 0;
-                if (is_link(src)) {
-                        char *rp =realpath(src, NULL);
-                        if (rp == NULL) {
-                                free(src);
-                                free(dest);
-                                continue;
-                        }
-                        if (symlink(rp, dest))
-                                errExit("symlink");
-                        else
-                                symlink_done = 1;
-                }
-                else if (S_ISDIR(s.st_mode))
-                        create_empty_dir_as_root(dest, s.st_mode);
-                else
-                        create_empty_file_as_root(dest, s.st_mode);
-
-                // bind-mount src on top of dest
-                if (!symlink_done) {
-                        if (mount(src, dest, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind mirroring /etc");
-                }
-                fs_logger2("clone", src);
-
-                free(src);
-                free(dest);
-        }
-        closedir(dir);
-
-        // mount bind our private etc directory on top of /etc
-        if (arg_debug)
-                printf("Mount-bind %s on top of /etc\n", RUN_DNS_ETC);
-        if (mount(RUN_DNS_ETC, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mount bind mirroring /etc");
-        fs_logger("mount /etc");
-
-        if (arg_debug)
-                printf("Creating a new /etc/resolv.conf file\n");
-        FILE *fp = fopen("/etc/resolv.conf", "w");
-        if (!fp) {
-                fprintf(stderr, "Error: cannot create /etc/resolv.conf file\n");
-                exit(1);
-        }
-
-        if (cfg.dns1) {
-                if (any_dhcp())
-                        fwarning("network setup uses DHCP, nameservers will likely be overwritten\n");
-                fprintf(fp, "nameserver %s\n", cfg.dns1);
-        }
-        if (cfg.dns2)
-                fprintf(fp, "nameserver %s\n", cfg.dns2);
-        if (cfg.dns3)
-                fprintf(fp, "nameserver %s\n", cfg.dns3);
-        if (cfg.dns4)
-                fprintf(fp, "nameserver %s\n", cfg.dns4);
-
-        // mode and owner
-        SET_PERMS_STREAM(fp, 0, 0, 0644);
-
-        fclose(fp);
-
-        fs_logger("create /etc/resolv.conf");
-}
-
 char *fs_check_hosts_file(const char *fname) {
         assert(fname);
         invalid_filename(fname, 0); // no globbing
         char *rv = expand_macros(fname);
 
-        // no a link
-        if (is_link(rv))
-                goto errexit;
-
         // the user has read access to the file
         if (access(rv, R_OK))
                 goto errexit;
@@ -222,9 +114,6 @@ void fs_mount_hosts_file(void) {
         struct stat s;
         if (stat("/etc/hosts", &s) == -1)
                 goto errexit;
-        // not a link
-        if (is_link("/etc/hosts"))
-                goto errexit;
         // owned by root
         if (s.st_uid != 0)
                 goto errexit;
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c
index 85fb70854..848691a56 100644
--- a/src/firejail/fs_lib.c
+++ b/src/firejail/fs_lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -61,17 +61,31 @@ static int valid_full_path(const char *full_path) {
         return 0;
 }
 
+// return 1 if symlink to firejail executable
+int is_firejail_link(const char *fname) {
+        EUID_ASSERT();
+
+        if (!is_link(fname))
+                return 0;
+
+        char *rp = realpath(fname, NULL);
+        if (!rp)
+                return 0;
+
+        int rv = 0;
+        const char *base = gnu_basename(rp);
+        if (strcmp(base, "firejail") == 0)
+                rv = 1;
+
+        free(rp);
+        return rv;
+}
+
 char *find_in_path(const char *program) {
         EUID_ASSERT();
         if (arg_debug)
                 printf("Searching $PATH for %s\n", program);
 
-        char self[MAXBUF];
-        ssize_t len = readlink("/proc/self/exe", self, MAXBUF - 1);
-        if (len < 0)
-                errExit("readlink");
-        self[len] = '\0';
-
         const char *path = env_get("PATH");
         if (!path)
                 return NULL;
@@ -88,18 +102,12 @@ char *find_in_path(const char *program) {
                 if (arg_debug)
                         printf("trying #%s#\n", fname);
                 struct stat s;
-                if (stat(fname, &s) == 0) {
-                        // but skip links created by firecfg
-                        char *rp = realpath(fname, NULL);
-                        if (!rp)
-                                errExit("realpath");
-                        if (strcmp(self, rp) != 0) {
-                                free(rp);
-                                free(dup);
-                                return fname;
-                        }
-                        free(rp);
+                if (stat(fname, &s) == 0 &&
+                    !is_firejail_link(fname)) { // skip links created by firecfg
+                        free(dup);
+                        return fname;
                 }
+
                 free(fname);
                 tok = strtok(NULL, ":");
         }
@@ -178,8 +186,7 @@ void fslib_mount(const char *full_path) {
 
         if (*full_path == '\0' ||
             !valid_full_path(full_path) ||
-            access(full_path, F_OK) != 0 ||
-            stat(full_path, &s) != 0 ||
+            stat_as_user(full_path, &s) != 0 ||
             s.st_uid != 0)
                 return;
 
@@ -196,6 +203,11 @@ void fslib_mount_libs(const char *full_path, unsigned user) {
         assert(full_path);
         // if library/executable does not exist or the user does not have read access to it
         // print a warning and exit the function.
+        if (access(full_path, F_OK)) {
+                if (arg_debug || arg_debug_private_lib)
+                        printf("Cannot find %s, skipping...\n", full_path);
+                return;
+        }
         if (user && access(full_path, R_OK)) {
                 if (arg_debug || arg_debug_private_lib)
                         printf("Cannot read %s, skipping...\n", full_path);
@@ -203,7 +215,7 @@ void fslib_mount_libs(const char *full_path, unsigned user) {
         }
 
         if (arg_debug || arg_debug_private_lib)
-                printf("    fslib_mount_libs %s (parse as %s)\n", full_path, user ? "user" : "root");
+                printf("    fslib_mount_libs %s\n", full_path);
         // create an empty RUN_LIB_FILE and allow the user to write to it
         unlink(RUN_LIB_FILE);                     // in case is there
         create_empty_file_as_root(RUN_LIB_FILE, 0644);
@@ -212,7 +224,7 @@ void fslib_mount_libs(const char *full_path, unsigned user) {
 
         // run fldd to extract the list of files
         if (arg_debug || arg_debug_private_lib)
-                printf("    running fldd %s\n", full_path);
+                printf("    running fldd %s as %s\n", full_path, user ? "user" : "root");
         unsigned mask;
         if (user)
                 mask = SBOX_USER;
@@ -221,7 +233,7 @@ void fslib_mount_libs(const char *full_path, unsigned user) {
         sbox_run(mask | SBOX_SECCOMP | SBOX_CAPS_NONE, 3, PATH_FLDD, full_path, RUN_LIB_FILE);
 
         // open the list of libraries and install them on by one
-        FILE *fp = fopen(RUN_LIB_FILE, "r");
+        FILE *fp = fopen(RUN_LIB_FILE, "re");
         if (!fp)
                 errExit("fopen");
 
@@ -246,7 +258,7 @@ static void load_library(const char *fname) {
 
         // existing file owned by root
         struct stat s;
-        if (!access(fname, F_OK) && stat(fname, &s) == 0 && s.st_uid == 0) {
+        if (stat_as_user(fname, &s) == 0 && s.st_uid == 0) {
                 // load directories, regular 64 bit libraries, and 64 bit executables
                 if (S_ISDIR(s.st_mode))
                         fslib_mount(fname);
@@ -264,9 +276,9 @@ static void install_list_entry(const char *lib) {
         assert(lib);
 
         // filename check
-        int len = strlen(lib);
-        if (strcspn(lib, "\\&!?\"'<>%^(){}[];,") != (size_t)len ||
-        strstr(lib, "..")) {
+        reject_meta_chars(lib, 1);
+
+        if (strstr(lib, "..")) {
                 fprintf(stderr, "Error: \"%s\" is an invalid library\n", lib);
                 exit(1);
         }
@@ -286,19 +298,21 @@ static void install_list_entry(const char *lib) {
 #define DO_GLOBBING
 #ifdef DO_GLOBBING
                 // globbing
+                EUID_USER();
                 glob_t globbuf;
                 int globerr = glob(fname, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf);
                 if (globerr) {
                         fprintf(stderr, "Error: failed to glob private-lib pattern %s\n", fname);
                         exit(1);
                 }
+                EUID_ROOT();
                 size_t j;
                 for (j = 0; j < globbuf.gl_pathc; j++) {
                         assert(globbuf.gl_pathv[j]);
 //printf("glob %s\n", globbuf.gl_pathv[j]);
                         // GLOB_NOCHECK - no pattern matched returns the original pattern; try to load it anyway
 
-                        // foobar/* includes foobar/. and foobar/..
+                        // foobar/* expands to foobar/. and foobar/..
                         const char *base = gnu_basename(globbuf.gl_pathv[j]);
                         if (strcmp(base, ".") == 0 || strcmp(base, "..") == 0)
                                 continue;
diff --git a/src/firejail/fs_lib2.c b/src/firejail/fs_lib2.c
index c69bf7c98..aefd38e3c 100644
--- a/src/firejail/fs_lib2.c
+++ b/src/firejail/fs_lib2.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -143,7 +143,7 @@ static void fdir(void) {
                 NULL,
         };
 
-        // need to parse as root user, unprivileged users have no read permission on executables
+        // need to parse as root user, unprivileged users have no read permission on some of these binaries
         int i;
         for (i = 0; fbin[i]; i++)
                 fslib_mount_libs(fbin[i], 0);
@@ -153,7 +153,9 @@ void fslib_install_firejail(void) {
         timetrace_start();
         // bring in firejail executable libraries, in case we are redirected here
         // by a firejail symlink from /usr/local/bin/firejail
-        fslib_mount_libs(PATH_FIREJAIL, 1); // parse as user
+        // fldd might have no read permission on the firejail executable
+        // parse as root in order to support these setups
+        fslib_mount_libs(PATH_FIREJAIL, 0);
 
         // bring in firejail directory
         fdir();
diff --git a/src/firejail/fs_logger.c b/src/firejail/fs_logger.c
index 67ad4b52e..06f03dac5 100644
--- a/src/firejail/fs_logger.c
+++ b/src/firejail/fs_logger.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -92,7 +92,7 @@ void fs_logger_print(void) {
         if (!head)
                 return;
 
-        FILE *fp = fopen(RUN_FSLOGGER_FILE, "a");
+        FILE *fp = fopen(RUN_FSLOGGER_FILE, "ae");
         if (!fp) {
                 perror("fopen");
                 return;
@@ -123,15 +123,8 @@ void fs_logger_print_log(pid_t pid) {
         // in case the pid is that of a firejail process, use the pid of the first child process
         pid = switch_to_child(pid);
 
-        // check privileges for non-root users
-        uid_t uid = getuid();
-        if (uid != 0) {
-                uid_t sandbox_uid = pid_get_uid(pid);
-                if (uid != sandbox_uid) {
-                        fprintf(stderr, "Error: permission denied\n");
-                        exit(1);
-                }
-        }
+        // exit if no permission to join the sandbox
+        check_join_permission(pid);
 
         // print RUN_FSLOGGER_FILE
         char *fname;
@@ -139,24 +132,16 @@ void fs_logger_print_log(pid_t pid) {
                 errExit("asprintf");
 
         EUID_ROOT();
-        struct stat s;
-        if (stat(fname, &s) == -1 || s.st_uid != 0) {
-                fprintf(stderr, "Error: Cannot access filesystem log\n");
-                exit(1);
-        }
-
-        /* coverity[toctou] */
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
+        free(fname);
         if (!fp) {
                 fprintf(stderr, "Error: Cannot open filesystem log\n");
                 exit(1);
         }
-
         char buf[MAXBUF];
         while (fgets(buf, MAXBUF, fp))
                 printf("%s", buf);
         fclose(fp);
-        free(fname);
 
         exit(0);
 }
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c
index 8cfeea582..30dbd8e9b 100644
--- a/src/firejail/fs_mkdir.c
+++ b/src/firejail/fs_mkdir.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,6 +18,7 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <unistd.h>
@@ -25,7 +26,6 @@
 #include <sys/wait.h>
 #include <string.h>
 
-
 static void check(const char *fname) {
         // manufacture /run/user directory
         char *runuser;
@@ -95,9 +95,9 @@ void fs_mkdir(const char *name) {
 
                 // create directory
                 mkdir_recursive(expanded);
-#ifdef HAVE_GCOV
+
                 __gcov_flush();
-#endif
+
                 _exit(0);
         }
         // wait for the child to finish
diff --git a/src/firejail/fs_overlayfs.c b/src/firejail/fs_overlayfs.c
new file mode 100644
index 000000000..167a7e28b
--- /dev/null
+++ b/src/firejail/fs_overlayfs.c
@@ -0,0 +1,470 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifdef HAVE_OVERLAYFS
+#include "firejail.h"
+#include "../include/gcov_wrapper.h"
+#include <sys/mount.h>
+#include <sys/wait.h>
+#include <ftw.h>
+#include <errno.h>
+
+#include <fcntl.h>
+#ifndef O_PATH
+#define O_PATH 010000000
+#endif
+
+
+char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) {
+        assert(subdirname);
+        EUID_ASSERT();
+        struct stat s;
+        char *dirname;
+
+        if (asprintf(&dirname, "%s/.firejail", cfg.homedir) == -1)
+                errExit("asprintf");
+        // check if ~/.firejail already exists
+        if (lstat(dirname, &s) == 0) {
+                if (!S_ISDIR(s.st_mode)) {
+                        if (S_ISLNK(s.st_mode))
+                                fprintf(stderr, "Error: %s is a symbolic link\n", dirname);
+                        else
+                                fprintf(stderr, "Error: %s is not a directory\n", dirname);
+                        exit(1);
+                }
+                if (s.st_uid != getuid()) {
+                        fprintf(stderr, "Error: %s is not owned by the current user\n", dirname);
+                        exit(1);
+                }
+        }
+        else {
+                // create ~/.firejail directory
+                create_empty_dir_as_user(dirname, 0700);
+                if (stat(dirname, &s) == -1) {
+                        fprintf(stderr, "Error: cannot create directory %s\n", dirname);
+                        exit(1);
+                }
+        }
+        free(dirname);
+
+        // check overlay directory
+        if (asprintf(&dirname, "%s/.firejail/%s", cfg.homedir, subdirname) == -1)
+                errExit("asprintf");
+        if (lstat(dirname, &s) == 0) {
+                if (!S_ISDIR(s.st_mode)) {
+                        if (S_ISLNK(s.st_mode))
+                                fprintf(stderr, "Error: %s is a symbolic link\n", dirname);
+                        else
+                                fprintf(stderr, "Error: %s is not a directory\n", dirname);
+                        exit(1);
+                }
+                if (s.st_uid != 0) {
+                        fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", dirname);
+                        exit(1);
+                }
+                if (allow_reuse == 0) {
+                        fprintf(stderr, "Error: overlay directory exists, but reuse is not allowed\n");
+                        exit(1);
+                }
+        }
+
+        return dirname;
+}
+
+
+// mount overlayfs on top of / directory
+// mounting an overlay and chrooting into it:
+//
+// Old Ubuntu kernel
+// # cd ~
+// # mkdir -p overlay/root
+// # mkdir -p overlay/diff
+// # mount -t overlayfs -o lowerdir=/,upperdir=/root/overlay/diff overlayfs /root/overlay/root
+// # chroot /root/overlay/root
+// to shutdown, first exit the chroot and then  unmount the overlay
+// # exit
+// # umount /root/overlay/root
+//
+// Kernels 3.18+
+// # cd ~
+// # mkdir -p overlay/root
+// # mkdir -p overlay/diff
+// # mkdir -p overlay/work
+// # mount -t overlay -o lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work overlay /root/overlay/root
+// # cat /etc/mtab | grep overlay
+// /root/overlay /root/overlay/root overlay rw,relatime,lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work 0 0
+// # chroot /root/overlay/root
+// to shutdown, first exit the chroot and then  unmount the overlay
+// # exit
+// # umount /root/overlay/root
+
+// to do: fix the code below
+#include <sys/utsname.h>
+void fs_overlayfs(void) {
+        struct stat s;
+
+        // check kernel version
+        struct utsname u;
+        int rv = uname(&u);
+        if (rv != 0)
+                errExit("uname");
+        int major;
+        int minor;
+        if (2 != sscanf(u.release, "%d.%d", &major, &minor)) {
+                fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version);
+                exit(1);
+        }
+
+        if (arg_debug)
+                printf("Linux kernel version %d.%d\n", major, minor);
+        int oldkernel = 0;
+        if (major < 3) {
+                fprintf(stderr, "Error: minimum kernel version required 3.x\n");
+                exit(1);
+        }
+        if (major == 3 && minor < 18)
+                oldkernel = 1;
+
+        // mounting an overlayfs on top of / seems to be broken for kernels > 4.19
+        // we disable overlayfs for now, pending fixing
+        if (major >= 4 &&minor >= 19) {
+                fprintf(stderr, "Error: OverlayFS disabled for Linux kernels 4.19 and newer, pending fixing.\n");
+                exit(1);
+        }
+
+        char *oroot = RUN_OVERLAY_ROOT;
+        mkdir_attr(oroot, 0755, 0, 0);
+
+        // set base for working and diff directories
+        char *basedir = RUN_MNT_DIR;
+        int basefd = -1;
+
+        if (arg_overlay_keep) {
+                basedir = cfg.overlay_dir;
+                assert(basedir);
+                // get a file descriptor for ~/.firejail, fails if there is any symlink
+                char *firejail;
+                if (asprintf(&firejail, "%s/.firejail", cfg.homedir) == -1)
+                        errExit("asprintf");
+                int fd = safer_openat(-1, firejail, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+                if (fd == -1)
+                        errExit("safer_openat");
+                free(firejail);
+                // create basedir if it doesn't exist
+                // the new directory will be owned by root
+                const char *dirname = gnu_basename(basedir);
+                if (mkdirat(fd, dirname, 0755) == -1 && errno != EEXIST) {
+                        perror("mkdir");
+                        fprintf(stderr, "Error: cannot create overlay directory %s\n", basedir);
+                        exit(1);
+                }
+                // open basedir
+                basefd = openat(fd, dirname, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+                close(fd);
+        }
+        else {
+                basefd = open(basedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        }
+        if (basefd == -1) {
+                perror("open");
+                fprintf(stderr, "Error: cannot open overlay directory %s\n", basedir);
+                exit(1);
+        }
+
+        // confirm once more base is owned by root
+        if (fstat(basefd, &s) == -1)
+                errExit("fstat");
+        if (s.st_uid != 0) {
+                fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", basedir);
+                exit(1);
+        }
+        // confirm permissions of base are 0755
+        if (((S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH) & s.st_mode) != (S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH)) {
+                fprintf(stderr, "Error: invalid permissions on overlay directory %s\n", basedir);
+                exit(1);
+        }
+
+        // create diff and work directories inside base
+        // no need to check arg_overlay_reuse
+        char *odiff;
+        if (asprintf(&odiff, "%s/odiff", basedir) == -1)
+                errExit("asprintf");
+        // the new directory will be owned by root
+        if (mkdirat(basefd, "odiff", 0755) == -1 && errno != EEXIST) {
+                perror("mkdir");
+                fprintf(stderr, "Error: cannot create overlay directory %s\n", odiff);
+                exit(1);
+        }
+        ASSERT_PERMS(odiff, 0, 0, 0755);
+
+        char *owork;
+        if (asprintf(&owork, "%s/owork", basedir) == -1)
+                errExit("asprintf");
+        // the new directory will be owned by root
+        if (mkdirat(basefd, "owork", 0755) == -1 && errno != EEXIST) {
+                perror("mkdir");
+                fprintf(stderr, "Error: cannot create overlay directory %s\n", owork);
+                exit(1);
+        }
+        ASSERT_PERMS(owork, 0, 0, 0755);
+
+        // mount overlayfs
+        if (arg_debug)
+                printf("Mounting OverlayFS\n");
+        char *option;
+        if (oldkernel) { // old Ubuntu/OpenSUSE kernels
+                if (arg_overlay_keep) {
+                        fprintf(stderr, "Error: option --overlay= not available for kernels older than 3.18\n");
+                        exit(1);
+                }
+                if (asprintf(&option, "lowerdir=/,upperdir=%s", odiff) == -1)
+                        errExit("asprintf");
+                if (mount("overlayfs", oroot, "overlayfs", MS_MGC_VAL, option) < 0)
+                        errExit("mounting overlayfs");
+        }
+        else { // kernel 3.18 or newer
+                if (asprintf(&option, "lowerdir=/,upperdir=%s,workdir=%s", odiff, owork) == -1)
+                        errExit("asprintf");
+                if (mount("overlay", oroot, "overlay", MS_MGC_VAL, option) < 0) {
+                        fprintf(stderr, "Debug: running on kernel version %d.%d\n", major, minor);
+                        errExit("mounting overlayfs");
+                }
+
+                //***************************
+                // issue #263 start code
+                // My setup has a separate mount point for /home. When the overlay is mounted,
+                // the overlay does not contain the original /home contents.
+                // I added code to create a second overlay for /home if the overlay home dir is empty and this seems to work
+                // @dshmgh, Jan 2016
+                {
+                        char *overlayhome;
+                        struct stat s;
+                        char *hroot;
+                        char *hdiff;
+                        char *hwork;
+
+                        // dons add debug
+                        if (arg_debug) printf ("DEBUG: chroot dirs are oroot %s  odiff %s  owork %s\n",oroot,odiff,owork);
+
+                        // BEFORE NEXT, WE NEED TO TEST IF /home has any contents or do we need to mount it?
+                        // must create var for oroot/cfg.homedir
+                        if (asprintf(&overlayhome, "%s%s", oroot, cfg.homedir) == -1)
+                                errExit("asprintf");
+                        if (arg_debug) printf ("DEBUG: overlayhome var holds ##%s##\n", overlayhome);
+
+                        // if no homedir in overlay -- create another overlay for /home
+                        if (stat(cfg.homedir, &s) == 0 && stat(overlayhome, &s) == -1) {
+
+                                // no need to check arg_overlay_reuse
+                                if (asprintf(&hdiff, "%s/hdiff", basedir) == -1)
+                                        errExit("asprintf");
+                                // the new directory will be owned by root
+                                if (mkdirat(basefd, "hdiff", 0755) == -1 && errno != EEXIST) {
+                                        perror("mkdir");
+                                        fprintf(stderr, "Error: cannot create overlay directory %s\n", hdiff);
+                                        exit(1);
+                                }
+                                ASSERT_PERMS(hdiff, 0, 0, 0755);
+
+                                // no need to check arg_overlay_reuse
+                                if (asprintf(&hwork, "%s/hwork", basedir) == -1)
+                                        errExit("asprintf");
+                                // the new directory will be owned by root
+                                if (mkdirat(basefd, "hwork", 0755) == -1 && errno != EEXIST) {
+                                        perror("mkdir");
+                                        fprintf(stderr, "Error: cannot create overlay directory %s\n", hwork);
+                                        exit(1);
+                                }
+                                ASSERT_PERMS(hwork, 0, 0, 0755);
+
+                                // no homedir in overlay so now mount another overlay for /home
+                                if (asprintf(&hroot, "%s/home", oroot) == -1)
+                                        errExit("asprintf");
+                                if (asprintf(&option, "lowerdir=/home,upperdir=%s,workdir=%s", hdiff, hwork) == -1)
+                                        errExit("asprintf");
+                                if (mount("overlay", hroot, "overlay", MS_MGC_VAL, option) < 0)
+                                        errExit("mounting overlayfs for mounted home directory");
+
+                                printf("OverlayFS for /home configured in %s directory\n", basedir);
+                                free(hroot);
+                                free(hdiff);
+                                free(hwork);
+
+                        } // stat(overlayhome)
+                        free(overlayhome);
+                }
+                // issue #263 end code
+                //***************************
+        }
+        fmessage("OverlayFS configured in %s directory\n", basedir);
+        close(basefd);
+
+        // /dev, /run and /tmp are not covered by the overlay
+        // mount-bind dev directory
+        if (arg_debug)
+                printf("Mounting /dev\n");
+        char *dev;
+        if (asprintf(&dev, "%s/dev", oroot) == -1)
+                errExit("asprintf");
+        if (mount("/dev", dev, NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mounting /dev");
+        fs_logger("whitelist /dev");
+
+        // mount-bind run directory
+        if (arg_debug)
+                printf("Mounting /run\n");
+        char *run;
+        if (asprintf(&run, "%s/run", oroot) == -1)
+                errExit("asprintf");
+        if (mount("/run", run, NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mounting /run");
+        fs_logger("whitelist /run");
+
+        // mount-bind tmp directory
+        if (arg_debug)
+                printf("Mounting /tmp\n");
+        char *tmp;
+        if (asprintf(&tmp, "%s/tmp", oroot) == -1)
+                errExit("asprintf");
+        if (mount("/tmp", tmp, NULL, MS_BIND|MS_REC, NULL) < 0)
+                errExit("mounting /tmp");
+        fs_logger("whitelist /tmp");
+
+        // chroot in the new filesystem
+        __gcov_flush();
+
+        if (chroot(oroot) == -1)
+                errExit("chroot");
+
+        // mount a new proc filesystem
+        if (arg_debug)
+                printf("Mounting /proc filesystem representing the PID namespace\n");
+        if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
+                errExit("mounting /proc");
+
+        // update /var directory in order to support multiple sandboxes running on the same root directory
+//      if (!arg_private_dev)
+//              fs_dev_shm();
+        fs_var_lock();
+        if (!arg_keep_var_tmp)
+                fs_var_tmp();
+        if (!arg_writable_var_log)
+                fs_var_log();
+        fs_var_lib();
+        fs_var_cache();
+        fs_var_utmp();
+        fs_machineid();
+
+        // don't leak user information
+        restrict_users();
+
+        // when starting as root, firejail config is not disabled;
+        if (getuid() != 0)
+                disable_config();
+
+        // cleanup and exit
+        free(option);
+        free(odiff);
+        free(owork);
+        free(dev);
+        free(run);
+        free(tmp);
+}
+
+
+static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) {
+        (void) sb;
+        (void) typeflag;
+        (void) ftwbuf;
+        assert(fpath);
+
+        if (strcmp(fpath, ".") == 0)    // rmdir would fail with EINVAL
+                return 0;
+
+        if (remove(fpath)) {    // removes the link not the actual file
+                fprintf(stderr, "Error: cannot remove file: %s\n", strerror(errno));
+                exit(1);
+        }
+
+        return 0;
+}
+
+int remove_overlay_directory(void) {
+        EUID_ASSERT();
+        sleep(1);
+
+        char *path;
+        if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1)
+                errExit("asprintf");
+
+        if (access(path, F_OK) == 0) {
+                pid_t child = fork();
+                if (child < 0)
+                        errExit("fork");
+                if (child == 0) {
+                        // open ~/.firejail
+                        int fd = safer_openat(-1, path, O_PATH|O_NOFOLLOW|O_CLOEXEC);
+                        if (fd == -1) {
+                                fprintf(stderr, "Error: cannot open %s\n", path);
+                                exit(1);
+                        }
+                        struct stat s;
+                        if (fstat(fd, &s) == -1)
+                                errExit("fstat");
+                        if (!S_ISDIR(s.st_mode)) {
+                                if (S_ISLNK(s.st_mode))
+                                        fprintf(stderr, "Error: %s is a symbolic link\n", path);
+                                else
+                                        fprintf(stderr, "Error: %s is not a directory\n", path);
+                                exit(1);
+                        }
+                        if (s.st_uid != getuid()) {
+                                fprintf(stderr, "Error: %s is not owned by the current user\n", path);
+                                exit(1);
+                        }
+                        // chdir to ~/.firejail
+                        if (fchdir(fd) == -1)
+                                errExit("fchdir");
+                        close(fd);
+
+                        EUID_ROOT();
+                        // FTW_PHYS - do not follow symbolic links
+                        if (nftw(".", remove_callback, 64, FTW_DEPTH | FTW_PHYS) == -1)
+                                errExit("nftw");
+
+                        EUID_USER();
+                        // remove ~/.firejail
+                        if (rmdir(path) == -1)
+                                errExit("rmdir");
+
+                        __gcov_flush();
+
+                        _exit(0);
+                }
+                // wait for the child to finish
+                waitpid(child, NULL, 0);
+                // check if ~/.firejail was deleted
+                if (access(path, F_OK) == 0)
+                        return 1;
+        }
+        return 0;
+}
+
+#endif // HAVE_OVERLAYFS
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c
index 8f939b5f5..4cecea9ce 100644
--- a/src/firejail/fs_trace.c
+++ b/src/firejail/fs_trace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,26 +20,31 @@
 #include "firejail.h"
 #include <sys/mount.h>
 #include <sys/stat.h>
-#include <linux/limits.h>
 #include <glob.h>
 #include <dirent.h>
 #include <fcntl.h>
 #include <pwd.h>
 
-void fs_trace_preload(void) {
+// create an empty /etc/ld.so.preload
+void fs_trace_touch_preload(void) {
+        create_empty_file_as_root("/etc/ld.so.preload", S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+}
+
+void fs_trace_touch_or_store_preload(void) {
         struct stat s;
 
-        // create an empty /etc/ld.so.preload
-        if (stat("/etc/ld.so.preload", &s)) {
-                if (arg_debug)
-                        printf("Creating an empty /etc/ld.so.preload file\n");
-                /* coverity[toctou] */
-                FILE *fp = fopen("/etc/ld.so.preload", "w");
-                if (!fp)
-                        errExit("fopen");
-                SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
-                fclose(fp);
-                fs_logger("touch /etc/ld.so.preload");
+        if (stat("/etc/ld.so.preload", &s) != 0) {
+                fs_trace_touch_preload();
+                return;
+        }
+
+        if (s.st_size == 0)
+                return;
+
+        // create a copy of /etc/ld.so.preload
+        if (copy_file("/etc/ld.so.preload", RUN_LDPRELOAD_FILE, 0, 0, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) {
+                fprintf(stderr, "Error: cannot copy /etc/ld.so.preload file\n");
+                exit(1);
         }
 }
 
@@ -48,7 +53,7 @@ void fs_tracefile(void) {
         if (arg_debug)
                 printf("Creating an empty trace log file: %s\n", arg_tracefile);
         EUID_USER();
-        int fd = open(arg_tracefile, O_CREAT|O_WRONLY|O_CLOEXEC, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+        int fd = open(arg_tracefile, O_CREAT|O_WRONLY|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (fd == -1) {
                 perror("open");
                 fprintf(stderr, "Error: cannot open trace log file %s for writing\n", arg_tracefile);
@@ -64,20 +69,16 @@ void fs_tracefile(void) {
         if (ftruncate(fd, 0) == -1)
                 errExit("ftruncate");
         EUID_ROOT();
-        FILE *fp = fopen(RUN_TRACE_FILE, "w");
+        FILE *fp = fopen(RUN_TRACE_FILE, "we");
         if (!fp)
                 errExit("fopen " RUN_TRACE_FILE);
         fclose(fp);
-        fs_logger2("touch ", arg_tracefile);
+        fs_logger2("touch", arg_tracefile);
         // mount using the symbolic link in /proc/self/fd
         if (arg_debug)
                 printf("Bind mount %s to %s\n", arg_tracefile, RUN_TRACE_FILE);
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(proc, RUN_TRACE_FILE, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_fd_to_path(fd, RUN_TRACE_FILE))
                 errExit("mount bind " RUN_TRACE_FILE);
-        free(proc);
         close(fd);
         // now that RUN_TRACE_FILE is user-writable, mount it noexec
         fs_remount(RUN_TRACE_FILE, MOUNT_NOEXEC, 0);
@@ -88,7 +89,7 @@ void fs_trace(void) {
         if (arg_debug)
                 printf("Create the new ld.so.preload file\n");
 
-        FILE *fp = fopen(RUN_LDPRELOAD_FILE, "w");
+        FILE *fp = fopen(RUN_LDPRELOAD_FILE, "ae");
         if (!fp)
                 errExit("fopen");
         const char *prefix = RUN_FIREJAIL_LIB_DIR;
@@ -105,7 +106,7 @@ void fs_trace(void) {
                 fmessage("Post-exec seccomp protector enabled\n");
         }
 
-        SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+        SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         fclose(fp);
 
         // mount the new preload file
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c
index f07581cd8..9523875d7 100644
--- a/src/firejail/fs_var.c
+++ b/src/firejail/fs_var.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,7 +20,6 @@
 #include "firejail.h"
 #include <sys/mount.h>
 #include <sys/stat.h>
-#include <linux/limits.h>
 #include <glob.h>
 #include <dirent.h>
 #include <fcntl.h>
@@ -127,17 +126,17 @@ void fs_var_log(void) {
 
                 // create an empty /var/log/wtmp file
                 /* coverity[toctou] */
-                FILE *fp = fopen("/var/log/wtmp", "w");
+                FILE *fp = fopen("/var/log/wtmp", "wxe");
                 if (fp) {
-                        SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH);
+                        SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH);
                         fclose(fp);
                 }
                 fs_logger("touch /var/log/wtmp");
 
                 // create an empty /var/log/btmp file
-                fp = fopen("/var/log/btmp", "w");
+                fp = fopen("/var/log/btmp", "wxe");
                 if (fp) {
-                        SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP);
+                        SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP);
                         fclose(fp);
                 }
                 fs_logger("touch /var/log/btmp");
@@ -158,8 +157,7 @@ void fs_var_lib(void) {
                 fs_logger("tmpfs /var/lib/dhcp");
 
                 // isc dhcp server requires a /var/lib/dhcp/dhcpd.leases file
-                FILE *fp = fopen("/var/lib/dhcp/dhcpd.leases", "w");
-
+                FILE *fp = fopen("/var/lib/dhcp/dhcpd.leases", "wxe");
                 if (fp) {
                         fprintf(fp, "\n");
                         SET_PERMS_STREAM(fp, 0, 0, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
@@ -287,7 +285,7 @@ void fs_var_utmp(void) {
         if (stat(UTMP_FILE, &s) == 0)
                 utmp_group = s.st_gid;
         else {
-                fwarning("cannot find /var/run/utmp\n");
+                fwarning("cannot find %s\n", UTMP_FILE);
                 return;
         }
 
@@ -296,7 +294,7 @@ void fs_var_utmp(void) {
                 printf("Create the new utmp file\n");
 
         /* coverity[toctou] */
-        FILE *fp = fopen(RUN_UTMP_FILE, "w");
+        FILE *fp = fopen(RUN_UTMP_FILE, "we");
         if (!fp)
                 errExit("fopen");
 
@@ -315,7 +313,7 @@ void fs_var_utmp(void) {
         // save new utmp file
         int rv = fwrite(&u_boot, sizeof(u_boot), 1, fp);
         (void) rv;
-        SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH);
+        SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH);
         fclose(fp);
 
         // mount the new utmp file
@@ -323,5 +321,9 @@ void fs_var_utmp(void) {
                 printf("Mount the new utmp file\n");
         if (mount(RUN_UTMP_FILE, UTMP_FILE, NULL, MS_BIND|MS_NOSUID|MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0)
                 errExit("mount bind utmp");
-        fs_logger("create /var/run/utmp");
+        fs_logger2("create", UTMP_FILE);
+
+        // blacklist RUN_UTMP_FILE
+        if (mount(RUN_RO_FILE, RUN_UTMP_FILE, NULL, MS_BIND, "mode=400,gid=0") < 0)
+                errExit("mount bind");
 }
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c
index 698d47b69..3377b2592 100644
--- a/src/firejail/fs_whitelist.c
+++ b/src/firejail/fs_whitelist.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -16,63 +16,70 @@
  * You should have received a copy of the GNU General Public License along
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-*/
+ */
 #include "firejail.h"
 #include <sys/mount.h>
 #include <sys/stat.h>
-#include <linux/limits.h>
 #include <fnmatch.h>
 #include <glob.h>
-#include <dirent.h>
 #include <errno.h>
 
 #include <fcntl.h>
 #ifndef O_PATH
-# define O_PATH 010000000
+#define O_PATH 010000000
 #endif
 
+#define TOP_MAX 64 // maximum number of top level directories
+
 // mountinfo functionality test;
 // 1. enable TEST_MOUNTINFO definition
 // 2. run firejail --whitelist=/any/directory
 //#define TEST_MOUNTINFO
 
-#define EMPTY_STRING ("")
-static size_t homedir_len; // cache length of homedir string
-static size_t runuser_len; // cache length of runuser string
-static char *runuser;
+static size_t homedir_len = 0; // cache length of homedir string
+static size_t runuser_len = 0; // cache length of runuser string
+static char *runuser = NULL;
 
 
-static int mkpath(const char* path, mode_t mode) {
-        assert(path && *path);
-        mode |= 0111;
 
-        // create directories with uid/gid as root, or as current user if inside home or run/user/$uid directory
-        int userprivs = 0;
-        if ((strncmp(path, cfg.homedir, homedir_len) == 0 && path[homedir_len] == '/') ||
-            (strncmp(path, runuser, runuser_len) == 0 && path[runuser_len] == '/')) {
-                EUID_USER();
-                userprivs = 1;
+static void whitelist_error(const char *path) {
+        assert(path);
+
+        fprintf(stderr, "Error: invalid whitelist path %s\n", path);
+        exit(1);
+}
+
+static int whitelist_mkpath(const char *parentdir, const char *relpath, mode_t mode) {
+        // starting from top level directory
+        int parentfd = safer_openat(-1, parentdir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        if (parentfd < 0)
+                errExit("open");
+
+        // top level directory mount id
+        int mountid = get_mount_id(parentfd);
+        if (mountid < 0) {
+                close(parentfd);
+                return -1;
         }
 
         // work on a copy of the path
-        char *dup = strdup(path);
+        char *dup = strdup(relpath);
         if (!dup)
                 errExit("strdup");
 
-        // don't create the last path element
+        // only create leading directories, don't create the file
         char *p = strrchr(dup, '/');
-        assert(p);
+        if (!p) { // nothing to do
+                free(dup);
+                return parentfd;
+        }
         *p = '\0';
 
-        int parentfd = open("/", O_PATH|O_DIRECTORY|O_CLOEXEC);
-        if (parentfd == -1)
-                errExit("open");
-
         // traverse the path, return -1 if a symlink is encountered
-        int done = 0;
         int fd = -1;
+        int done = 0;
         char *tok = strtok(dup, "/");
-        assert(tok); // path is no top level directory
+        assert(tok);
         while (tok) {
                 // create the directory if necessary
                 if (mkdirat(parentfd, tok, mode) == -1) {
@@ -81,9 +88,6 @@ static int mkpath(const char* path, mode_t mode) {
                                         perror("mkdir");
                                 close(parentfd);
                                 free(dup);
-                                if (userprivs) {
-                                        EUID_ROOT();
-                                }
                                 return -1;
                         }
                 }
@@ -96,9 +100,15 @@ static int mkpath(const char* path, mode_t mode) {
                                 perror("open");
                         close(parentfd);
                         free(dup);
-                        if (userprivs) {
-                                EUID_ROOT();
-                        }
+                        return -1;
+                }
+                // different mount id indicates earlier whitelist mount
+                if (get_mount_id(fd) != mountid) {
+                        if (arg_debug || arg_debug_whitelists)
+                                printf("Debug %d: whitelisted already\n", __LINE__);
+                        close(parentfd);
+                        close(fd);
+                        free(dup);
                         return -1;
                 }
                 // move on to next path segment
@@ -107,199 +117,110 @@ static int mkpath(const char* path, mode_t mode) {
                 tok = strtok(NULL, "/");
         }
 
-        if (done)
-                fs_logger2("mkpath", path);
+        if (done) {
+                char *abspath;
+                if (asprintf(&abspath, "%s/%s", parentdir, relpath) < 0)
+                        errExit("asprintf");
+                fs_logger2("mkpath", abspath);
+                free(abspath);
+        }
 
         free(dup);
-        if (userprivs) {
-                EUID_ROOT();
-        }
         return fd;
 }
 
-static void whitelist_path(ProfileEntry *entry) {
-        assert(entry);
-        const char *path = entry->data + 10;
-        const char *fname;
-        char *wfile = NULL;
-
-        if (entry->wldir == WLDIR_HOME) {
-                if (strncmp(path, cfg.homedir, homedir_len) != 0 || path[homedir_len] != '/')
-                        // either symlink pointing outside home directory
-                        // or entire home directory, skip the mount
-                        return;
-
-                fname = path + homedir_len + 1; // strlen("/home/user/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_HOME_USER_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_TMP) {
-                fname = path + 5; // strlen("/tmp/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_TMP_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_MEDIA) {
-                fname = path + 7; // strlen("/media/")
+static void whitelist_file(const TopDir * const top, const char *path) {
+        EUID_ASSERT();
+        assert(top && path);
 
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_MEDIA_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_MNT) {
-                fname = path + 5; // strlen("/mnt/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_MNT_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_VAR) {
-                if (strncmp(path, "/var/", 5) != 0)
-                        // symlink pointing outside /var, skip the mount
-                        return;
-
-                fname = path + 5; // strlen("/var/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_VAR_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_DEV) {
-                if (strncmp(path, "/dev/", 5) != 0)
-                        // symlink pointing outside /dev, skip the mount
-                        return;
-
-                fname = path + 5; // strlen("/dev/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_DEV_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_OPT) {
-                fname = path + 5; // strlen("/opt/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_OPT_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_SRV) {
-                fname = path + 5; // strlen("/srv/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_SRV_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_ETC) {
-                if (strncmp(path, "/etc/", 5) != 0)
-                        // symlink pointing outside /etc, skip the mount
-                        return;
-
-                fname = path + 5; // strlen("/etc/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_ETC_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_SHARE) {
-                fname = path + 11; // strlen("/usr/share/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_SHARE_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_MODULE) {
-                fname = path + 12; // strlen("/sys/module/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_MODULE_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        else if (entry->wldir == WLDIR_RUN) {
-                fname = path + runuser_len + 1; // strlen("/run/user/$uid/")
-
-                if (asprintf(&wfile, "%s/%s", RUN_WHITELIST_RUN_USER_DIR, fname) == -1)
-                        errExit("asprintf");
-        }
-        assert(wfile);
-
-        if (arg_debug || arg_debug_whitelists)
-                printf("Whitelisting %s\n", path);
-
-        // confirm again the mount source exists and there is no symlink
-        struct stat wfilestat;
-        EUID_USER();
-        int fd = safe_fd(wfile, O_PATH|O_NOFOLLOW|O_CLOEXEC);
-        EUID_ROOT();
+        // check if path is inside top level directory
+        size_t top_pathlen = strlen(top->path);
+        if (strncmp(top->path, path, top_pathlen) != 0 || path[top_pathlen] != '/')
+                return;
+        const char *relpath = path + top_pathlen + 1;
+
+        // open mount source, using a file descriptor that refers to the
+        // top level directory
+        // as the top level directory was opened before mounting the tmpfs
+        // we still have full access to all directory contents
+        // take care to not follow symbolic links (top->fd was obtained without
+        // following a link, too)
+        int fd = safer_openat(top->fd, relpath, O_PATH|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1) {
                 if (arg_debug || arg_debug_whitelists)
-                        printf("Debug %d: skip whitelisting of %s\n", __LINE__, path);
-                free(wfile);
+                        printf("Debug %d: skip whitelist %s\n", __LINE__, path);
                 return;
         }
-        if (fstat(fd, &wfilestat) == -1)
+        struct stat s;
+        if (fstat(fd, &s) == -1)
                 errExit("fstat");
-        close(fd);
-        if (S_ISLNK(wfilestat.st_mode)) {
+        if (S_ISLNK(s.st_mode)) {
                 if (arg_debug || arg_debug_whitelists)
-                        printf("Debug %d: skip whitelisting of %s\n", __LINE__, path);
-                free(wfile);
+                        printf("Debug %d: skip whitelist %s\n", __LINE__, path);
+                close(fd);
                 return;
         }
 
-        // create path of the mount target if necessary
-        int fd2 = mkpath(path, 0755);
+        // now modify the tmpfs:
+        // create mount target as root, except if inside home or run/user/$UID directory
+        if (strcmp(top->path, cfg.homedir) != 0 &&
+            strcmp(top->path, runuser) != 0)
+                EUID_ROOT();
+
+        // create path of the mount target
+        int fd2 = whitelist_mkpath(top->path, relpath, 0755);
         if (fd2 == -1) {
-                // something went wrong during path creation or a symlink was found;
-                // if there is a symlink somewhere in the path of the mount target,
-                // assume the file is whitelisted already
                 if (arg_debug || arg_debug_whitelists)
-                        printf("Debug %d: skip whitelisting of %s\n", __LINE__, path);
-                free(wfile);
+                        printf("Debug %d: skip whitelist %s\n", __LINE__, path);
+                close(fd);
+                EUID_USER();
                 return;
         }
 
         // get file name of the mount target
-        const char *file = gnu_basename(path);
+        const char *file = gnu_basename(relpath);
 
-        // create the mount target if necessary and open it, a symlink is rejected
+        // create mount target itself if necessary
+        // and open it, a symlink is not allowed
         int fd3 = -1;
-        if (S_ISDIR(wfilestat.st_mode)) {
-                // directory foo can exist already:
-                // firejail --whitelist=/foo/bar --whitelist=/foo
+        if (S_ISDIR(s.st_mode)) {
+                // directory bar can exist already:
+                // firejail --whitelist=/foo/bar/baz --whitelist=/foo/bar
                 if (mkdirat(fd2, file, 0755) == -1 && errno != EEXIST) {
                         if (arg_debug || arg_debug_whitelists) {
                                 perror("mkdir");
-                                printf("Debug %d: skip whitelisting of %s\n", __LINE__, path);
+                                printf("Debug %d: skip whitelist %s\n", __LINE__, path);
                         }
+                        close(fd);
                         close(fd2);
-                        free(wfile);
+                        EUID_USER();
                         return;
                 }
                 fd3 = openat(fd2, file, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         }
-        else {
-                // create an empty file, fails with EEXIST if it is whitelisted already:
-                // firejail --whitelist=/foo --whitelist=/foo/bar
+        else
+                // create an empty file
+                // fails with EEXIST if it is whitelisted already
                 fd3 = openat(fd2, file, O_RDONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR|S_IWUSR);
-        }
 
         if (fd3 == -1) {
-                if (arg_debug || arg_debug_whitelists) {
-                        if (errno != EEXIST) {
-                                perror("open");
-                                printf("Debug %d: skip whitelisting of %s\n", __LINE__, path);
-                        }
+                if (errno != EEXIST && (arg_debug || arg_debug_whitelists)) {
+                        perror("open");
+                        printf("Debug %d: skip whitelist %s\n", __LINE__, path);
                 }
+                close(fd);
                 close(fd2);
-                free(wfile);
+                EUID_USER();
                 return;
         }
         close(fd2);
 
-        fs_logger2("whitelist", path);
-
-        // in order to make this mount resilient against symlink attacks, use
-        // a magic link in /proc/self/fd instead of mounting on path directly
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd3) == -1)
-                errExit("asprintf");
-        if (mount(wfile, proc, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (arg_debug || arg_debug_whitelists)
+                printf("Whitelisting %s\n", path);
+        EUID_ROOT();
+        if (bind_mount_by_fd(fd, fd3))
                 errExit("mount bind");
-        free(proc);
-        close(fd3);
-
+        EUID_USER();
         // check the last mount operation
         MountData *mptr = get_last_mount(); // will do exit(1) if the mount cannot be found
 #ifdef TEST_MOUNTINFO
@@ -316,37 +237,54 @@ static void whitelist_path(ProfileEntry *entry) {
         //  - there should be more than one '/' char in dest string
         if (mptr->dir == strrchr(mptr->dir, '/'))
                 errLogExit("invalid whitelist mount");
-        // confirm the right file was mounted by comparing device and inode numbers
-        int fd4 = safe_fd(path, O_PATH|O_NOFOLLOW|O_CLOEXEC);
-        if (fd4 == -1)
-                errExit("safe_fd");
-        struct stat s;
-        if (fstat(fd4, &s) == -1)
-                errExit("fstat");
-        if (s.st_dev != wfilestat.st_dev || s.st_ino != wfilestat.st_ino)
-                errLogExit("invalid whitelist mount");
-        close(fd4);
-
-        free(wfile);
-        return;
+        close(fd);
+        close(fd3);
+        fs_logger2("whitelist", path);
 }
 
-static void whitelist_home(int topdir) {
-        ProfileEntry entry;
-        memset(&entry, 0, sizeof(entry));
-        char *cmd;
-        if (asprintf(&cmd, "whitelist %s", cfg.homedir) == -1)
-                errExit("asprintf");
-        entry.data = cmd;
-        entry.wldir = topdir;
-        // creates path owned by root, except homedir is inside /run/user/$uid
-        // does nothing if homedir does not exist
-        whitelist_path(&entry);
-        free(cmd);
-}
+static void whitelist_symlink(const TopDir * const top, const char *link, const char *target) {
+        EUID_ASSERT();
+        assert(top && link && target);
+
+        // confirm link is inside top level directory
+        // this should never fail
+        size_t top_pathlen = strlen(top->path);
+        assert(strncmp(top->path, link, top_pathlen) == 0 && link[top_pathlen] == '/');
+
+        const char *relpath = link + top_pathlen + 1;
+
+        // create link as root, except if inside home or run/user/$UID directory
+        if (strcmp(top->path, cfg.homedir) != 0 &&
+            strcmp(top->path, runuser) != 0)
+                EUID_ROOT();
 
+        int fd = whitelist_mkpath(top->path, relpath, 0755);
+        if (fd == -1) {
+                if (arg_debug || arg_debug_whitelists)
+                        printf("Debug %d: cannot create symbolic link %s\n", __LINE__, link);
+                EUID_USER();
+                return;
+        }
+
+        // get file name of symlink
+        const char *file = gnu_basename(relpath);
+
+        // create the link
+        if (symlinkat(target, fd, file) == -1) {
+                if (arg_debug || arg_debug_whitelists) {
+                        perror("symlink");
+                        printf("Debug %d: cannot create symbolic link %s\n", __LINE__, link);
+                }
+        }
+        else if (arg_debug || arg_debug_whitelists)
+                printf("Created symbolic link %s -> %s\n", link, target);
+
+        close(fd);
+        EUID_USER();
+}
 
 static void globbing(const char *pattern) {
+        EUID_ASSERT();
         assert(pattern);
 
         // globbing
@@ -363,6 +301,11 @@ static void globbing(const char *pattern) {
                 // testing for GLOB_NOCHECK - no pattern matched returns the original pattern
                 if (strcmp(globbuf.gl_pathv[i], pattern) == 0)
                         continue;
+                // foo/* expands to foo/. and foo/..
+                const char *base = gnu_basename(globbuf.gl_pathv[i]);
+                if (strcmp(base, ".") == 0 ||
+                    strcmp(base, "..") == 0)
+                        continue;
 
                 // build the new profile command
                 char *newcmd;
@@ -378,8 +321,237 @@ static void globbing(const char *pattern) {
         globfree(&globbuf);
 }
 
+// mount tmpfs on all top level directories
+static void tmpfs_topdirs(const TopDir * const topdirs) {
+        int tmpfs_home = 0;
+        int tmpfs_runuser = 0;
+
+        int i;
+        for (i = 0; i < TOP_MAX && topdirs[i].path; i++) {
+                // do nested top level directories last
+                // this way '--whitelist=nested_top_level_dir'
+                // yields the full, unmodified directory
+                // instead of the tmpfs
+                if (strcmp(topdirs[i].path, cfg.homedir) == 0) {
+                        tmpfs_home = 1;
+                        continue;
+                }
+                if (strcmp(topdirs[i].path, runuser) == 0) {
+                        tmpfs_runuser = 1;
+                        continue;
+                }
+
+                // special case /run
+                // open /run/firejail, so it can be restored right after mounting the tmpfs
+                int fd = -1;
+                if (strcmp(topdirs[i].path, "/run") == 0) {
+                        fd = open(RUN_FIREJAIL_DIR, O_PATH|O_CLOEXEC);
+                        if (fd == -1)
+                                errExit("open");
+                }
+
+                // mount tmpfs
+                fs_tmpfs(topdirs[i].path, 0);
+                selinux_relabel_path(topdirs[i].path, topdirs[i].path);
+
+                // init tmpfs
+                if (strcmp(topdirs[i].path, "/run") == 0) {
+                        // restore /run/firejail directory
+                        EUID_ROOT();
+                        mkdir_attr(RUN_FIREJAIL_DIR, 0755, 0, 0);
+                        if (bind_mount_fd_to_path(fd, RUN_FIREJAIL_DIR))
+                                errExit("mount bind");
+                        EUID_USER();
+                        close(fd);
+                        fs_logger2("whitelist", RUN_FIREJAIL_DIR);
+
+                        // restore /run/user/$UID directory
+                        whitelist_file(&topdirs[i], runuser);
+                }
+                else if (strcmp(topdirs[i].path, "/tmp") == 0) {
+                        // fix pam-tmpdir (#2685)
+                        const char *env = env_get("TMP");
+                        if (env) {
+                                // we allow TMP env set as /tmp/user/$UID and /tmp/$UID - see #4151
+                                char *pamtmpdir1;
+                                if (asprintf(&pamtmpdir1, "/tmp/user/%u", getuid()) == -1)
+                                        errExit("asprintf");
+                                char *pamtmpdir2;
+                                if (asprintf(&pamtmpdir2, "/tmp/%u", getuid()) == -1)
+                                        errExit("asprintf");
+                                if (strcmp(env, pamtmpdir1) == 0) {
+                                        // create empty user-owned /tmp/user/$UID directory
+                                        EUID_ROOT();
+                                        mkdir_attr("/tmp/user", 0755, 0, 0);
+                                        selinux_relabel_path("/tmp/user", "/tmp/user");
+                                        fs_logger("mkdir /tmp/user");
+                                        mkdir_attr(pamtmpdir1, 0700, getuid(), 0);
+                                        selinux_relabel_path(pamtmpdir1, pamtmpdir1);
+                                        fs_logger2("mkdir", pamtmpdir1);
+                                        EUID_USER();
+                                }
+                                else if (strcmp(env, pamtmpdir2) == 0) {
+                                        // create empty user-owned /tmp/$UID directory
+                                        EUID_ROOT();
+                                        mkdir_attr(pamtmpdir2, 0700, getuid(), 0);
+                                        selinux_relabel_path(pamtmpdir2, pamtmpdir2);
+                                        fs_logger2("mkdir", pamtmpdir2);
+                                        EUID_USER();
+                                }
+                                free(pamtmpdir1);
+                                free(pamtmpdir2);
+                        }
+                }
+
+                // restore user home directory if it is masked by the tmpfs
+                // creates path owned by root
+                // does nothing if user home directory doesn't exist
+                whitelist_file(&topdirs[i], cfg.homedir);
+        }
+
+        // user home directory
+        if (tmpfs_home)
+                fs_private(); // checks owner if outside /home
+
+        // /run/user/$UID directory
+        if (tmpfs_runuser) {
+                fs_tmpfs(runuser, 0);
+                selinux_relabel_path(runuser, runuser);
+        }
+}
+
+static int reject_topdir(const char *dir) {
+        if (!whitelist_reject_topdirs)
+                return 0;
+
+        size_t i;
+        for (i = 0; whitelist_reject_topdirs[i]; i++) {
+                if (strcmp(dir, whitelist_reject_topdirs[i]) == 0)
+                        return 1;
+        }
+        return 0;
+}
+
+// keep track of whitelist top level directories by adding them to an array
+// open each directory
+static TopDir *add_topdir(const char *dir, TopDir *topdirs, const char *path) {
+        EUID_ASSERT();
+        assert(dir && path);
+
+        // /proc and /sys are not allowed
+        if (strcmp(dir, "/") == 0 ||
+            strcmp(dir, "/proc") == 0 ||
+            strcmp(dir, "/sys") == 0)
+                whitelist_error(path);
+
+        // whitelisting home directory is disabled if --private option is present
+        if (arg_private && strcmp(dir, cfg.homedir) == 0) {
+                if (arg_debug || arg_debug_whitelists)
+                        printf("Debug %d: skip %s - a private home dir is configured!\n", __LINE__, path);
+                return NULL;
+        }
+
+        // do nothing if directory doesn't exist
+        struct stat s;
+        if (lstat(dir, &s) != 0) {
+                if (arg_debug || arg_debug_whitelists)
+                        printf("Cannot access whitelist top level directory %s: %s\n", dir, strerror(errno));
+                return NULL;
+        }
+        // do nothing if directory is a link
+        if (!S_ISDIR(s.st_mode)) {
+                if (S_ISLNK(s.st_mode)) {
+                        fwarning("skipping whitelist %s because %s is a symbolic link\n", path, dir);
+                        return NULL;
+                }
+                whitelist_error(path);
+        }
+        // do nothing if directory is disabled by administrator
+        if (reject_topdir(dir)) {
+                fmessage("Whitelist top level directory %s is disabled in Firejail configuration file\n", dir);
+                return NULL;
+        }
+
+        // add directory to array
+        if (arg_debug || arg_debug_whitelists)
+                printf("Adding whitelist top level directory %s\n", dir);
+        static int cnt = 0;
+        if (cnt >= TOP_MAX) {
+                fprintf(stderr, "Error: too many whitelist top level directories\n");
+                exit(1);
+        }
+        TopDir *rv = topdirs + cnt;
+        cnt++;
+
+        rv->path = strdup(dir);
+        if (!rv->path)
+                errExit("strdup");
+
+        // open the directory, don't follow symbolic links
+        rv->fd = safer_openat(-1, dir, O_PATH|O_NOFOLLOW|O_DIRECTORY|O_CLOEXEC);
+        if (rv->fd == -1) {
+                fprintf(stderr, "Error: cannot open %s\n", dir);
+                exit(1);
+        }
+
+        return rv;
+}
+
+static TopDir *have_topdir(const char *dir, TopDir *topdirs) {
+        assert(dir);
+
+        int i;
+        for (i = 0; i < TOP_MAX; i++) {
+                TopDir *rv = topdirs + i;
+                if (!rv->path)
+                        break;
+                if (strcmp(dir, rv->path) == 0)
+                        return rv;
+        }
+        return NULL;
+}
+
+static char *extract_topdir(const char *path) {
+        assert(path);
+
+        char *dup = strdup(path);
+        if (!dup)
+                errExit("strdup");
+
+        // user home directory can be anywhere; disconnect user home
+        // whitelisting from top level directory whitelisting
+        // by treating user home as separate whitelist top level directory
+        if (strncmp(dup, cfg.homedir, homedir_len) == 0 && dup[homedir_len] == '/')
+                dup[homedir_len] = '\0';
+        // /run/user/$UID is treated as top level directory
+        else if (strncmp(dup, runuser, runuser_len) == 0 && dup[runuser_len] == '/')
+                dup[runuser_len] = '\0';
+        // whitelisting in /sys is not allowed, but /sys/module is an exception
+        // and is treated as top level directory here
+        else if (strncmp(dup, "/sys/module", 11) == 0 && dup[11] == '/')
+                dup[11] = '\0';
+        // treat /usr subdirectories as top level directories
+        else if (strncmp(dup, "/usr/", 5) == 0) {
+                char *p = strchr(dup+5, '/');
+                if (!p)
+                        whitelist_error(path);
+                *p = '\0';
+        }
+        // all other top level directories
+        else {
+                assert(dup[0] == '/');
+                char *p = strchr(dup+1, '/');
+                if (!p)
+                        whitelist_error(path);
+                *p = '\0';
+        }
+
+        return dup;
+}
 
 void fs_whitelist(void) {
+        EUID_ASSERT();
+
         ProfileEntry *entry = cfg.profile;
         if (!entry)
                 return;
@@ -389,29 +561,17 @@ void fs_whitelist(void) {
         runuser_len = strlen(runuser);
         homedir_len = strlen(cfg.homedir);
 
-        char *new_name = NULL;
-        int home_dir = 0;       // /home/user directory flag
-        int tmp_dir = 0;        // /tmp directory flag
-        int media_dir = 0;      // /media directory flag
-        int mnt_dir = 0;        // /mnt directory flag
-        int var_dir = 0;                // /var directory flag
-        int dev_dir = 0;                // /dev directory flag
-        int opt_dir = 0;                // /opt directory flag
-        int srv_dir = 0;                // /srv directory flag
-        int etc_dir = 0;                // /etc directory flag
-        int share_dir = 0;                // /usr/share directory flag
-        int module_dir = 0;                // /sys/module directory flag
-        int run_dir = 0;                // /run/user/$uid directory flag
-
         size_t nowhitelist_c = 0;
         size_t nowhitelist_m = 32;
         char **nowhitelist = calloc(nowhitelist_m, sizeof(*nowhitelist));
         if (nowhitelist == NULL)
-                errExit("failed allocating memory for nowhitelist entries");
+                errExit("calloc");
+
+        TopDir *topdirs = calloc(TOP_MAX, sizeof(*topdirs));
+        if (topdirs == NULL)
+                errExit("calloc");
 
         // verify whitelist files, extract symbolic links, etc.
-        EUID_USER();
-        struct stat s;
         while (entry) {
                 int nowhitelist_flag = 0;
 
@@ -424,48 +584,76 @@ void fs_whitelist(void) {
                         entry = entry->next;
                         continue;
                 }
-                char *dataptr = (nowhitelist_flag)? entry->data + 12: entry->data + 10;
-
-                // replace ~/ or ${HOME} into /home/username or resolve macro
-                new_name = expand_macros(dataptr);
-                assert(new_name);
-
-                // mount empty home directory if resolving the macro was not successful
-                if (is_macro(new_name) && macro_id(new_name) > -1) {
-                        // no warning if home does not exist (e.g. in a chroot)
-                        if (stat(cfg.homedir, &s) == 0 && !nowhitelist_flag && !arg_private) {
-                                home_dir = 1;
-                                if (!arg_quiet) {
-                                        fprintf(stderr, "***\n");
-                                        fprintf(stderr, "*** Warning: cannot whitelist %s directory\n", new_name);
-                                        fprintf(stderr, "*** Any file saved in this directory will be lost when the sandbox is closed.\n");
-                                        fprintf(stderr, "***\n");
-                                }
+                if (arg_debug || arg_debug_whitelists)
+                        printf("Debug %d: %s\n", __LINE__, entry->data);
+
+                const char *dataptr = (nowhitelist_flag)? entry->data + 12: entry->data + 10;
+
+                // replace ~ into /home/username or resolve macro
+                char *expanded = expand_macros(dataptr);
+
+                // check if respolving the macro was successful
+                if (is_macro(expanded) && macro_id(expanded) > -1) {
+                        if (!nowhitelist_flag && (have_topdir(cfg.homedir, topdirs) || add_topdir(cfg.homedir, topdirs, expanded)) && !arg_quiet) {
+                                fprintf(stderr, "***\n");
+                                fprintf(stderr, "*** Warning: cannot whitelist %s directory\n", expanded);
+                                fprintf(stderr, "*** Any file saved in this directory will be lost when the sandbox is closed.\n");
+                                fprintf(stderr, "***\n");
                         }
-                        entry->data = EMPTY_STRING;
                         entry = entry->next;
-                        free(new_name);
+                        free(expanded);
                         continue;
                 }
 
-                // remove trailing slashes and single dots
-                if (!nowhitelist_flag)
-                        trim_trailing_slash_or_dot(new_name);
+                if (arg_debug || arg_debug_whitelists)
+                        printf("Debug %d: expanded: %s\n", __LINE__, expanded);
+
+                // path should be absolute at this point
+                if (expanded[0] != '/')
+                        whitelist_error(expanded);
+
+                // sane pathname
+                char *new_name = clean_pathname(expanded);
+                free(expanded);
 
                 if (arg_debug || arg_debug_whitelists)
-                        fprintf(stderr, "Debug %d: new_name #%s#, %s\n", __LINE__, new_name, (nowhitelist_flag)? "nowhitelist": "whitelist");
+                        printf("Debug %d: new_name: %s\n", __LINE__, new_name);
+
+                if (strstr(new_name, ".."))
+                        whitelist_error(new_name);
 
-                // valid path referenced to filesystem root
-                if (*new_name != '/') {
+                TopDir *current_top = NULL;
+                if (!nowhitelist_flag) {
+                        // extract whitelist top level directory
+                        char *dir = extract_topdir(new_name);
                         if (arg_debug || arg_debug_whitelists)
-                                fprintf(stderr, "Debug %d: \n", __LINE__);
-                        goto errexit;
+                                printf("Debug %d: dir: %s\n", __LINE__, dir);
+
+                        // check if this top level directory has been processed already
+                        current_top = have_topdir(dir, topdirs);
+                        if (!current_top) { // got new top level directory
+                                current_top = add_topdir(dir, topdirs, new_name);
+                                if (!current_top) { // skip this command, top level directory not valid
+                                        entry = entry->next;
+                                        free(new_name);
+                                        free(dir);
+                                        continue;
+                                }
+                        }
+                        free(dir);
+                }
+
+                // /run/firejail directory is internal and not allowed
+                if (strncmp(new_name, RUN_FIREJAIL_DIR, strlen(RUN_FIREJAIL_DIR)) == 0) {
+                        entry = entry->next;
+                        free(new_name);
+                        continue;
                 }
 
-                // extract the absolute path of the file
+                // extract resolved path of the file
                 // realpath function will fail with ENOENT if the file is not found or with EACCES if user has no permission
                 // special processing for /dev/fd, /dev/stdin, /dev/stdout and /dev/stderr
-                char *fname;
+                char *fname = NULL;
                 if (strcmp(new_name, "/dev/fd") == 0)
                         fname = strdup("/proc/self/fd");
                 else if (strcmp(new_name, "/dev/stdin") == 0)
@@ -477,60 +665,34 @@ void fs_whitelist(void) {
                 else
                         fname = realpath(new_name, NULL);
 
-                // if this is not a real path, let's try globbing
-                // mark this entry as EMPTY_STRING and push the new paths at the end of profile entry list
-                // the new profile entries will be processed in this loop
-                // currently there is no globbing support for nowhitelist
-                if (!fname && !nowhitelist_flag)
-                        globbing(new_name);
-
                 if (!fname) {
-                        // file not found, blank the entry in the list and continue
                         if (arg_debug || arg_debug_whitelists) {
-                                printf("Removed whitelist/nowhitelist path: %s\n", entry->data);
-                                printf("\texpanded: %s\n", new_name);
-                                printf("\treal path: (null)\n");
-                                printf("\t");fflush(0);
-                                perror("realpath");
+                                printf("Removed path: %s\n", entry->data);
+                                printf("\tnew_name: %s\n", new_name);
+                                printf("\trealpath: (null)\n");
+                                printf("\t%s\n", strerror(errno));
                         }
 
-                        // if 1 the file was not found; mount an empty directory
                         if (!nowhitelist_flag) {
-                                if (strncmp(new_name, cfg.homedir, homedir_len) == 0 && new_name[homedir_len] == '/') {
-                                        if(!arg_private)
-                                                home_dir = 1;
-                                }
-                                else if (strncmp(new_name, "/tmp/", 5) == 0)
-                                        tmp_dir = 1;
-                                else if (strncmp(new_name, "/media/", 7) == 0)
-                                        media_dir = 1;
-                                else if (strncmp(new_name, "/mnt/", 5) == 0)
-                                        mnt_dir = 1;
-                                else if (strncmp(new_name, "/var/", 5) == 0)
-                                        var_dir = 1;
-                                else if (strncmp(new_name, "/dev/", 5) == 0)
-                                        dev_dir = 1;
-                                else if (strncmp(new_name, "/opt/", 5) == 0)
-                                        opt_dir = 1;
-                                else if (strncmp(new_name, "/srv/", 5) == 0)
-                                        srv_dir = 1;
-                                else if (strncmp(new_name, "/etc/", 5) == 0)
-                                        etc_dir = 1;
-                                else if (strncmp(new_name, "/usr/share/", 11) == 0)
-                                        share_dir = 1;
-                                else if (strncmp(new_name, "/sys/module/", 12) == 0)
-                                        module_dir = 1;
-                                else if (strncmp(new_name, runuser, runuser_len) == 0 && new_name[runuser_len] == '/')
-                                        run_dir = 1;
+                                // if this is not a real path, let's try globbing
+                                // push the new paths at the end of profile entry list
+                                // the new profile entries will be processed in this loop
+                                // currently there is no globbing support for nowhitelist
+                                globbing(new_name);
                         }
 
-                        entry->data = EMPTY_STRING;
                         entry = entry->next;
                         free(new_name);
                         continue;
                 }
-                else if (arg_debug_whitelists)
-                        printf("real path %s\n", fname);
+
+                // /run/firejail directory is internal and not allowed
+                if (strncmp(fname, RUN_FIREJAIL_DIR, strlen(RUN_FIREJAIL_DIR)) == 0) {
+                        entry = entry->next;
+                        free(new_name);
+                        free(fname);
+                        continue;
+                }
 
                 if (nowhitelist_flag) {
                         // store the path in nowhitelist array
@@ -544,175 +706,12 @@ void fs_whitelist(void) {
                                         errExit("failed increasing memory for nowhitelist entries");
                         }
                         nowhitelist[nowhitelist_c++] = fname;
-                        entry->data = EMPTY_STRING;
                         entry = entry->next;
                         free(new_name);
                         continue;
                 }
-
-                // check for supported directories
-                if (strncmp(new_name, cfg.homedir, homedir_len) == 0 && new_name[homedir_len] == '/') {
-                        // whitelisting home directory is disabled if --private option is present
-                        if (arg_private) {
-                                if (arg_debug || arg_debug_whitelists)
-                                        printf("\"%s\" disabled by --private\n", entry->data);
-
-                                entry->data = EMPTY_STRING;
-                                entry = entry->next;
-                                free(fname);
-                                free(new_name);
-                                continue;
-                        }
-
-                        entry->wldir = WLDIR_HOME;
-                        home_dir = 1;
-                        if (arg_debug || arg_debug_whitelists)
-                                fprintf(stderr, "Debug %d: fname #%s#, cfg.homedir #%s#\n",
-                                        __LINE__, fname, cfg.homedir);
-
-                        // both path and absolute path are in user home,
-                        // if not check if the symlink destination is owned by the user
-                        if (strncmp(fname, cfg.homedir, homedir_len) != 0 || fname[homedir_len] != '/') {
-                                if (checkcfg(CFG_FOLLOW_SYMLINK_AS_USER)) {
-                                        if (stat(fname, &s) == 0 && s.st_uid != getuid()) {
-                                                free(fname);
-                                                goto errexit;
-                                        }
-                                }
-                        }
-                }
-                else if (strncmp(new_name, "/tmp/", 5) == 0) {
-                        entry->wldir = WLDIR_TMP;
-                        tmp_dir = 1;
-
-                        // both path and absolute path are under /tmp
-                        if (strncmp(fname, "/tmp/", 5) != 0) {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
-                else if (strncmp(new_name, "/media/", 7) == 0) {
-                        entry->wldir = WLDIR_MEDIA;
-                        media_dir = 1;
-                        // both path and absolute path are under /media
-                        if (strncmp(fname, "/media/", 7) != 0) {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
-                else if (strncmp(new_name, "/mnt/", 5) == 0) {
-                        entry->wldir = WLDIR_MNT;
-                        mnt_dir = 1;
-                        // both path and absolute path are under /mnt
-                        if (strncmp(fname, "/mnt/", 5) != 0) {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
-                else if (strncmp(new_name, "/var/", 5) == 0) {
-                        entry->wldir = WLDIR_VAR;
-                        var_dir = 1;
-                        // both path and absolute path are under /var
-                        // exceptions: /var/tmp, /var/run and /var/lock
-                        if (strcmp(new_name, "/var/run")== 0 && strcmp(fname, "/run") == 0);
-                        else if (strcmp(new_name, "/var/lock")== 0 && strcmp(fname, "/run/lock") == 0);
-                        else if (strcmp(new_name, "/var/tmp")== 0 && strcmp(fname, "/tmp") == 0);
-                        else {
-                                // both path and absolute path are under /var
-                                if (strncmp(fname, "/var/", 5) != 0) {
-                                        free(fname);
-                                        goto errexit;
-                                }
-                        }
-                }
-                else if (strncmp(new_name, "/dev/", 5) == 0) {
-                        entry->wldir = WLDIR_DEV;
-                        dev_dir = 1;
-                        // special handling for /dev/shm
-                        // on some platforms (Debian wheezy, Ubuntu 14.04), it is a symlink to /run/shm
-                        if (strcmp(new_name, "/dev/shm") == 0 && strcmp(fname, "/run/shm") == 0);
-                        // special handling for /dev/log, which can be a symlink to /run/systemd/journal/dev-log
-                        else if (strcmp(new_name, "/dev/log") == 0 && strcmp(fname, "/run/systemd/journal/dev-log") == 0);
-                        // special processing for /proc/self/fd files
-                        else if (strcmp(new_name, "/dev/fd") == 0 && strcmp(fname, "/proc/self/fd") == 0);
-                        else if (strcmp(new_name, "/dev/stdin") == 0 && strcmp(fname, "/proc/self/fd/0") == 0);
-                        else if (strcmp(new_name, "/dev/stdout") == 0 && strcmp(fname, "/proc/self/fd/1") == 0);
-                        else if (strcmp(new_name, "/dev/stderr") == 0 && strcmp(fname, "/proc/self/fd/2") == 0);
-                        else {
-                                // both path and absolute path are under /dev
-                                if (strncmp(fname, "/dev/", 5) != 0) {
-                                        free(fname);
-                                        goto errexit;
-                                }
-                        }
-                }
-                else if (strncmp(new_name, "/opt/", 5) == 0) {
-                        entry->wldir = WLDIR_OPT;
-                        opt_dir = 1;
-                        // both path and absolute path are under /dev
-                        if (strncmp(fname, "/opt/", 5) != 0) {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
-                else if (strncmp(new_name, "/srv/", 5) == 0) {
-                        entry->wldir = WLDIR_SRV;
-                        srv_dir = 1;
-                        // both path and absolute path are under /srv
-                        if (strncmp(fname, "/srv/", 5) != 0) {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
-                else if (strncmp(new_name, "/etc/", 5) == 0) {
-                        entry->wldir = WLDIR_ETC;
-                        etc_dir = 1;
-                        // special handling for some of the symlinks
-                        if (strcmp(new_name, "/etc/localtime") == 0);
-                        else if (strcmp(new_name, "/etc/mtab") == 0);
-                        else if (strcmp(new_name, "/etc/os-release") == 0);
-                        // both path and absolute path are under /etc
-                        else {
-                                if (strncmp(fname, "/etc/", 5) != 0) {
-                                        free(fname);
-                                        goto errexit;
-                                }
-                        }
-                }
-                else if (strncmp(new_name, "/usr/share/", 11) == 0) {
-                        entry->wldir = WLDIR_SHARE;
-                        share_dir = 1;
-                        // both path and absolute path are under /etc
-                        if (strncmp(fname, "/usr/share/", 11) != 0) {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
-                else if (strncmp(new_name, "/sys/module/", 12) == 0) {
-                        entry->wldir = WLDIR_MODULE;
-                        module_dir = 1;
-                        // both path and absolute path are under /sys/module
-                        if (strncmp(fname, "/sys/module/", 12) != 0) {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
-                else if (strncmp(new_name, runuser, runuser_len) == 0 && new_name[runuser_len] == '/') {
-                        entry->wldir = WLDIR_RUN;
-                        run_dir = 1;
-                        // both path and absolute path are under /run/user/$uid
-                        if (strncmp(fname, runuser, runuser_len) != 0 || fname[runuser_len] != '/') {
-                                free(fname);
-                                goto errexit;
-                        }
-                }
                 else {
-                        free(fname);
-                        goto errexit;
-                }
-
-                // check if the path is in nowhitelist array
-                if (nowhitelist_flag == 0) {
+                        // check if the path is in nowhitelist array
                         size_t i;
                         int found = 0;
                         for (i = 0; i < nowhitelist_c; i++) {
@@ -726,494 +725,70 @@ void fs_whitelist(void) {
                         if (found) {
                                 if (arg_debug || arg_debug_whitelists)
                                         printf("Skip nowhitelisted path %s\n", fname);
-                                entry->data = EMPTY_STRING;
                                 entry = entry->next;
-                                free(fname);
                                 free(new_name);
+                                free(fname);
                                 continue;
                         }
                 }
 
-                // mark symbolic links
-                if (is_link(new_name))
-                        entry->link = new_name;
-                else {
-                        free(new_name);
-                        entry->link = NULL;
-                }
-
-                // change file name in entry->data
-                if (strcmp(fname, entry->data + 10) != 0) {
-                        char *newdata;
-                        if (asprintf(&newdata, "whitelist %s", fname) == -1)
-                                errExit("asprintf");
-                        entry->data = newdata;
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Replaced whitelist path: %s\n", entry->data);
-                }
-                free(fname);
-                entry = entry->next;
-        }
-
-        // release nowhitelist memory
-        assert(nowhitelist);
-        free(nowhitelist);
-
-        EUID_ROOT();
-        // /tmp mountpoint
-        if (tmp_dir) {
-                // check if /tmp directory exists
-                if (stat("/tmp", &s) == 0) {
-                        // keep a copy of real /tmp directory in RUN_WHITELIST_TMP_DIR
-                        mkdir_attr(RUN_WHITELIST_TMP_DIR, 1777, 0, 0);
-                        if (mount("/tmp", RUN_WHITELIST_TMP_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /tmp
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /tmp directory\n");
-                        if (mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=1777,gid=0") < 0)
-                                errExit("mounting tmpfs on /tmp");
-                        selinux_relabel_path("/tmp", "/tmp");
-                        fs_logger("tmpfs /tmp");
-
-                        // pam-tmpdir - issue #2685
-                        const char *env = env_get("TMP");
-                        if (env) {
-                                char *pamtmpdir;
-                                if (asprintf(&pamtmpdir, "/tmp/user/%u", getuid()) == -1)
-                                        errExit("asprintf");
-                                if (strcmp(env, pamtmpdir) == 0) {
-                                        // create empty user-owned /tmp/user/$uid directory
-                                        mkdir_attr("/tmp/user", 0711, 0, 0);
-                                        selinux_relabel_path("/tmp/user", "/tmp/user");
-                                        fs_logger("mkdir /tmp/user");
-                                        mkdir_attr(pamtmpdir, 0700, getuid(), 0);
-                                        selinux_relabel_path(pamtmpdir, pamtmpdir);
-                                        fs_logger2("mkdir", pamtmpdir);
-                                }
-                                free(pamtmpdir);
-                        }
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/tmp/", 5) == 0)
-                                whitelist_home(WLDIR_TMP);
-                }
-                else
-                        tmp_dir = 0;
-        }
-
-        // /media mountpoint
-        if (media_dir) {
-                // some distros don't have a /media directory
-                if (stat("/media", &s) == 0) {
-                        // keep a copy of real /media directory in RUN_WHITELIST_MEDIA_DIR
-                        mkdir_attr(RUN_WHITELIST_MEDIA_DIR, 0755, 0, 0);
-                        if (mount("/media", RUN_WHITELIST_MEDIA_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /media
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /media directory\n");
-                        if (mount("tmpfs", "/media", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /media");
-                        selinux_relabel_path("/media", "/media");
-                        fs_logger("tmpfs /media");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/media/", 7) == 0)
-                                whitelist_home(WLDIR_MEDIA);
-                }
-                else
-                        media_dir = 0;
-        }
-
-        // /mnt mountpoint
-        if (mnt_dir) {
-                // check if /mnt directory exists
-                if (stat("/mnt", &s) == 0) {
-                        // keep a copy of real /mnt directory in RUN_WHITELIST_MNT_DIR
-                        mkdir_attr(RUN_WHITELIST_MNT_DIR, 0755, 0, 0);
-                        if (mount("/mnt", RUN_WHITELIST_MNT_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /mnt
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /mnt directory\n");
-                        if (mount("tmpfs", "/mnt", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /mnt");
-                        selinux_relabel_path("/mnt", "/mnt");
-                        fs_logger("tmpfs /mnt");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/mnt/", 5) == 0)
-                                whitelist_home(WLDIR_MNT);
-                }
-                else
-                        mnt_dir = 0;
-        }
-
-        // /var mountpoint
-        if (var_dir) {
-                // check if /var directory exists
-                if (stat("/var", &s) == 0) {
-                        // keep a copy of real /var directory in RUN_WHITELIST_VAR_DIR
-                        mkdir_attr(RUN_WHITELIST_VAR_DIR, 0755, 0, 0);
-                        if (mount("/var", RUN_WHITELIST_VAR_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
+                // attach whitelist parameters to profile entry
+                entry->wparam = calloc(1, sizeof(struct wparam_t));
+                if (!entry->wparam)
+                        errExit("calloc");
 
-                        // mount tmpfs on /var
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /var directory\n");
-                        if (mount("tmpfs", "/var", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /var");
-                        selinux_relabel_path("/var", "/var");
-                        fs_logger("tmpfs /var");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/var/", 5) == 0)
-                                whitelist_home(WLDIR_VAR);
-                }
-                else
-                        var_dir = 0;
-        }
-
-        // /dev mountpoint
-        if (dev_dir) {
-                // check if /dev directory exists
-                if (stat("/dev", &s) == 0) {
-                        // keep a copy of real /dev directory in RUN_WHITELIST_DEV_DIR
-                        mkdir_attr(RUN_WHITELIST_DEV_DIR, 0755, 0, 0);
-                        if (mount("/dev", RUN_WHITELIST_DEV_DIR, NULL, MS_BIND|MS_REC,  "mode=755,gid=0") < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /dev
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /dev directory\n");
-                        if (mount("tmpfs", "/dev", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /dev");
-                        selinux_relabel_path("/dev", "/dev");
-                        fs_logger("tmpfs /dev");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/dev/", 5) == 0)
-                                whitelist_home(WLDIR_DEV);
-                }
-                else
-                        dev_dir = 0;
-        }
-
-        // /opt mountpoint
-        if (opt_dir) {
-                // check if /opt directory exists
-                if (stat("/opt", &s) == 0) {
-                        // keep a copy of real /opt directory in RUN_WHITELIST_OPT_DIR
-                        mkdir_attr(RUN_WHITELIST_OPT_DIR, 0755, 0, 0);
-                        if (mount("/opt", RUN_WHITELIST_OPT_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /opt
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /opt directory\n");
-                        if (mount("tmpfs", "/opt", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /opt");
-                        selinux_relabel_path("/opt", "/opt");
-                        fs_logger("tmpfs /opt");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/opt/", 5) == 0)
-                                whitelist_home(WLDIR_OPT);
-                }
-                else
-                        opt_dir = 0;
-        }
-
-        // /srv mountpoint
-        if (srv_dir) {
-                // check if /srv directory exists
-                if (stat("/srv", &s) == 0) {
-                        // keep a copy of real /srv directory in RUN_WHITELIST_SRV_DIR
-                        mkdir_attr(RUN_WHITELIST_SRV_DIR, 0755, 0, 0);
-                        if (mount("/srv", RUN_WHITELIST_SRV_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /srv
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /srv directory\n");
-                        if (mount("tmpfs", "/srv", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /srv");
-                        selinux_relabel_path("/srv", "/srv");
-                        fs_logger("tmpfs /srv");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/srv/", 5) == 0)
-                                whitelist_home(WLDIR_SRV);
-                }
-                else
-                        srv_dir = 0;
-        }
-
-        // /etc mountpoint
-        if (etc_dir) {
-                // check if /etc directory exists
-                if (stat("/etc", &s) == 0) {
-                        // keep a copy of real /etc directory in RUN_WHITELIST_ETC_DIR
-                        mkdir_attr(RUN_WHITELIST_ETC_DIR, 0755, 0, 0);
-                        if (mount("/etc", RUN_WHITELIST_ETC_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /etc
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /etc directory\n");
-                        if (mount("tmpfs", "/etc", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /etc");
-                        selinux_relabel_path("/etc", "/etc");
-                        fs_logger("tmpfs /etc");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/etc/", 5) == 0)
-                                whitelist_home(WLDIR_ETC);
-                }
-                else
-                        etc_dir = 0;
-        }
-
-        // /usr/share mountpoint
-        if (share_dir) {
-                // check if /usr/share directory exists
-                if (stat("/usr/share", &s) == 0) {
-                        // keep a copy of real /usr/share directory in RUN_WHITELIST_ETC_DIR
-                        mkdir_attr(RUN_WHITELIST_SHARE_DIR, 0755, 0, 0);
-                        if (mount("/usr/share", RUN_WHITELIST_SHARE_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-
-                        // mount tmpfs on /srv
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /usr/share directory\n");
-                        if (mount("tmpfs", "/usr/share", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /usr/share");
-                        selinux_relabel_path("/usr/share", "/usr/share");
-                        fs_logger("tmpfs /usr/share");
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, "/usr/share/", 11) == 0)
-                                whitelist_home(WLDIR_SHARE);
-                }
-                else
-                        share_dir = 0;
-        }
-
-        // /sys/module mountpoint
-        if (module_dir) {
-                // check if /sys/module directory exists
-                if (stat("/sys/module", &s) == 0) {
-                        // keep a copy of real /sys/module directory in RUN_WHITELIST_MODULE_DIR
-                        mkdir_attr(RUN_WHITELIST_MODULE_DIR, 0755, 0, 0);
-                        if (mount("/sys/module", RUN_WHITELIST_MODULE_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
+                assert(current_top);
+                entry->wparam->top = current_top;
+                entry->wparam->file = fname;
 
-                        // mount tmpfs on /sys/module
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on /sys/module directory\n");
-                        if (mount("tmpfs", "/sys/module", "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                                errExit("mounting tmpfs on /sys/module");
-                        selinux_relabel_path("/sys/module", "/sys/module");
-                        fs_logger("tmpfs /sys/module");
-                }
+                // mark link
+                if (is_link(new_name))
+                        entry->wparam->link = new_name;
                 else
-                        module_dir = 0;
-        }
-
-        // /run/user/$uid mountpoint
-        if (run_dir) {
-                // check if /run/user/$uid directory exists
-                if (stat(runuser, &s) == 0) {
-                        // keep a copy of real /run/user/$uid directory in RUN_WHITELIST_RUN_USER_DIR
-                        mkdir_attr(RUN_WHITELIST_RUN_USER_DIR, 0700, getuid(), getgid());
-                        if (mount(runuser, RUN_WHITELIST_RUN_USER_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
+                        free(new_name);
 
-                        // mount tmpfs on /run/user/$uid
-                        if (arg_debug || arg_debug_whitelists)
-                                printf("Mounting tmpfs on %s directory\n", runuser);
-                        char *options;
-                        if (asprintf(&options, "mode=700,uid=%u,gid=%u", getuid(), getgid()) == -1)
-                                errExit("asprintf");
-                        if (mount("tmpfs", runuser, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME, options) < 0)
-                                errExit("mounting tmpfs on /run/user/<uid>");
-                        selinux_relabel_path(runuser, runuser);
-                        free(options);
-                        fs_logger2("tmpfs", runuser);
-
-                        // autowhitelist home directory if it is masked by the tmpfs
-                        if (strncmp(cfg.homedir, runuser, runuser_len) == 0 && cfg.homedir[runuser_len] == '/')
-                                whitelist_home(WLDIR_RUN);
-                }
-                else
-                        run_dir = 0;
+                entry = entry->next;
         }
 
-        // home mountpoint
-        if (home_dir) {
-                // check if home directory exists
-                if (stat(cfg.homedir, &s) == 0) {
-                        // keep a copy of real home dir in RUN_WHITELIST_HOME_USER_DIR
-                        mkdir_attr(RUN_WHITELIST_HOME_USER_DIR, 0755, getuid(), getgid());
-                        int fd = safe_fd(cfg.homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-                        if (fd == -1)
-                                errExit("safe_fd");
-                        char *proc;
-                        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                                errExit("asprintf");
-                        if (mount(proc, RUN_WHITELIST_HOME_USER_DIR, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind");
-                        free(proc);
-                        close(fd);
-
-                        // mount a tmpfs and initialize home directory
-                        fs_private();
-                }
-                else
-                        home_dir = 0;
-        }
+        // mount tmpfs on all top level directories
+        tmpfs_topdirs(topdirs);
 
         // go through profile rules again, and interpret whitelist commands
         entry = cfg.profile;
         while (entry) {
-                // handle only whitelist commands
-                if (strncmp(entry->data, "whitelist ", 10)) {
-                        entry = entry->next;
-                        continue;
-                }
-
-//printf("here %d#%s#\n", __LINE__, entry->data);
-                // whitelist the real file
-                whitelist_path(entry);
-
-                // create the link if any
-                if (entry->link) {
-                        // if the link is already there, do not bother
-                        if (lstat(entry->link, &s) != 0) {
-                                // create the path if necessary
-                                // entry->link has no trailing slashes or single dots
-                                int fd = mkpath(entry->link, 0755);
-                                if (fd == -1) {
-                                        if (arg_debug || arg_debug_whitelists)
-                                                printf("Debug %d: cannot create symbolic link %s\n", __LINE__, entry->link);
-                                        free(entry->link);
-                                        entry->link = NULL;
-                                        entry = entry->next;
-                                        continue;
-                                }
-                                // get file name of symlink
-                                const char *file = gnu_basename(entry->link);
-                                // create the link
-                                int rv = symlinkat(entry->data + 10, fd, file);
-                                if (rv) {
-                                        if (arg_debug || arg_debug_whitelists) {
-                                                perror("symlink");
-                                                printf("Debug %d: cannot create symbolic link %s\n", __LINE__, entry->link);
-                                        }
-                                }
-                                else if (arg_debug || arg_debug_whitelists)
-                                        printf("Created symbolic link %s -> %s\n", entry->link, entry->data + 10);
-                                close(fd);
+                if (entry->wparam) {
+                        char *file = entry->wparam->file;
+                        char *link = entry->wparam->link;
+                        const TopDir * const current_top = entry->wparam->top;
+
+                        // top level directories of link and file can differ
+                        // will whitelist the file only if it is in same top level directory
+                        whitelist_file(current_top, file);
+
+                        // create the link if any
+                        if (link) {
+                                whitelist_symlink(current_top, link, file);
+                                free(link);
                         }
-                        free(entry->link);
-                        entry->link = NULL;
+
+                        free(file);
+                        free(entry->wparam);
+                        entry->wparam = NULL;
                 }
 
                 entry = entry->next;
         }
 
-        // mask the real home directory, currently mounted on RUN_WHITELIST_HOME_DIR
-        if (home_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_HOME_USER_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_HOME_USER_DIR);
-        }
-
-        // mask the real /tmp directory, currently mounted on RUN_WHITELIST_TMP_DIR
-        if (tmp_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_TMP_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_TMP_DIR);
-        }
-
-        // mask the real /var directory, currently mounted on RUN_WHITELIST_VAR_DIR
-        if (var_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_VAR_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_VAR_DIR);
-        }
-
-        // mask the real /opt directory, currently mounted on RUN_WHITELIST_OPT_DIR
-        if (opt_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_OPT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_OPT_DIR);
-        }
-
-        // mask the real /dev directory, currently mounted on RUN_WHITELIST_DEV_DIR
-        if (dev_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_DEV_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_DEV_DIR);
-        }
-
-        // mask the real /media directory, currently mounted on RUN_WHITELIST_MEDIA_DIR
-        if (media_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_MEDIA_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_MEDIA_DIR);
-        }
-
-        // mask the real /mnt directory, currently mounted on RUN_WHITELIST_MNT_DIR
-        if (mnt_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_MNT_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_MNT_DIR);
-        }
-
-        // mask the real /srv directory, currently mounted on RUN_WHITELIST_SRV_DIR
-        if (srv_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_SRV_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_SRV_DIR);
-        }
-
-        // mask the real /etc directory, currently mounted on RUN_WHITELIST_ETC_DIR
-        if (etc_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_ETC_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_ETC_DIR);
-        }
-
-        // mask the real /usr/share directory, currently mounted on RUN_WHITELIST_SHARE_DIR
-        if (share_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_SHARE_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_SHARE_DIR);
-        }
-
-        // mask the real /sys/module directory, currently mounted on RUN_WHITELIST_MODULE_DIR
-        if (module_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_MODULE_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_MODULE_DIR);
-        }
+        // release resources
+        size_t i;
+        for (i = 0; i < nowhitelist_c; i++)
+                free(nowhitelist[i]);
+        free(nowhitelist);
 
-        // mask the real /run/user/$uid directory, currently mounted on RUN_WHITELIST_RUN_USER_DIR
-        if (run_dir) {
-                if (mount("tmpfs", RUN_WHITELIST_RUN_USER_DIR, "tmpfs", MS_NOSUID | MS_STRICTATIME,  "mode=755,gid=0") < 0)
-                        errExit("mount tmpfs");
-                fs_logger2("tmpfs", RUN_WHITELIST_RUN_USER_DIR);
+        for (i = 0; i < TOP_MAX && topdirs[i].path; i++) {
+                free(topdirs[i].path);
+                close(topdirs[i].fd);
         }
-
+        free(topdirs);
         free(runuser);
-        return;
-
-errexit:
-        fprintf(stderr, "Error: invalid whitelist path %s\n", new_name);
-        exit(1);
 }
diff --git a/src/firejail/ids.c b/src/firejail/ids.c
new file mode 100644
index 000000000..fdb78d6e6
--- /dev/null
+++ b/src/firejail/ids.c
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+#include "firejail.h"
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+
+
+static void ids_init(void) {
+        // store checksums as root in /var/lib/firejail/${USERNAME}.ids
+        char *fname;
+        if (asprintf(&fname, VARDIR"/%s.ids", cfg.username) == -1)
+                errExit("asprintf");
+
+        int rv = unlink(fname);
+        (void) rv;
+        int fd = open(fname, O_CREAT | O_TRUNC | O_WRONLY, 0600);
+        if (fd < 0) {
+                fprintf(stderr, "Error: cannot create %s\n", fname);
+                exit(1);
+        }
+
+        // redirect output
+        close(STDOUT_FILENO);
+        if (dup(fd) != STDOUT_FILENO)
+                errExit("dup");
+        close(fd);
+
+        sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FIDS, "--init", cfg.homedir);
+}
+
+static void ids_check(void) {
+        // store checksums as root in /var/lib/firejail/${USERNAME}.ids
+        char *fname;
+        if (asprintf(&fname, VARDIR"/%s.ids", cfg.username) == -1)
+                errExit("asprintf");
+
+        int fd = open(fname, O_RDONLY);
+        if (fd < 0) {
+                fprintf(stderr, "Error: cannot open %s\n", fname);
+                exit(1);
+        }
+
+        // redirect input
+        close(STDIN_FILENO);
+        if (dup(fd) != STDIN_FILENO)
+                errExit("dup");
+        close(fd);
+
+        sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP| SBOX_ALLOW_STDIN, 3, PATH_FIDS, "--check", cfg.homedir);
+}
+
+void run_ids(int argc, char **argv) {
+        if (argc != 2) {
+                fprintf(stderr, "Error: only one IDS command expected\n");
+                exit(1);
+        }
+
+        EUID_ROOT();
+        struct stat s;
+        if (stat(VARDIR, &s)) // /var/lib/firejail
+                create_empty_dir_as_root(VARDIR, 0700);
+
+        if (strcmp(argv[1], "--ids-init") == 0)
+                ids_init();
+        else if (strcmp(argv[1], "--ids-check") == 0)
+                ids_check();
+        else
+                fprintf(stderr, "Error: unrecognized IDS command\n");
+
+        exit(0);
+}
diff --git a/src/firejail/join.c b/src/firejail/join.c
index 1575a7469..5d73f71be 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -45,7 +45,7 @@ static unsigned display = 0;
 static void signal_handler(int sig){
         flush_stdin();
 
-        exit(sig);
+        exit(128 + sig);
 }
 
 static void install_handler(void) {
@@ -103,7 +103,7 @@ static void extract_x11_display(pid_t pid) {
         if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_X11_DIR, pid) == -1)
                 errExit("asprintf");
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         free(fname);
         if (!fp)
                 return;
@@ -147,7 +147,7 @@ static void extract_command(int argc, char **argv, int index) {
         }
 
         // build command
-        build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, index);
+        build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, index, true);
 }
 
 static void extract_nogroups(pid_t pid) {
@@ -219,7 +219,7 @@ static void extract_caps(pid_t pid) {
                 perror("asprintf");
                 exit(1);
         }
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         if (!fp)
                 goto errexit;
 
@@ -266,7 +266,7 @@ static void extract_user_namespace(pid_t pid) {
         char *uidmap;
         if (asprintf(&uidmap, "/proc/%u/uid_map", pid) == -1)
                 errExit("asprintf");
-        FILE *fp = fopen(uidmap, "r");
+        FILE *fp = fopen(uidmap, "re");
         if (!fp) {
                 free(uidmap);
                 return;
@@ -315,6 +315,11 @@ static int open_shell(void) {
                 fprintf(stderr, "Error: cannot open shell %s\n", cfg.shell);
                 exit(1);
         }
+
+        // pass file descriptor through to the final fexecve
+        if (asprintf(&cfg.keep_fd, "%s,%d", cfg.keep_fd ? cfg.keep_fd : "", fd) == -1)
+                errExit("asprintf");
+
         return fd;
 }
 
@@ -431,7 +436,7 @@ void join(pid_t pid, int argc, char **argv, int index) {
 
         // set cgroup
         if (cfg.cgroup) // not available for uid 0
-                set_cgroup(cfg.cgroup);
+                set_cgroup(cfg.cgroup, getpid());
 
         // join namespaces
         if (arg_join_network) {
@@ -536,7 +541,6 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
 
 #ifdef HAVE_APPARMOR
-                // add apparmor confinement after the execve
                 set_apparmor();
 #endif
 
@@ -552,10 +556,6 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 if (cfg.cpus)   // not available for uid 0
                         set_cpu_affinity();
 
-                // set nice value
-                if (arg_nice)
-                        set_nice(cfg.nice);
-
                 // add x11 display
                 if (display) {
                         char *display_str;
@@ -596,15 +596,17 @@ void join(pid_t pid, int argc, char **argv, int index) {
 
         // end of signal-safe code
         //*****************************
-        flush_stdin();
 
         if (WIFEXITED(status)) {
+                // if we had a proper exit, return that exit status
                 status = WEXITSTATUS(status);
         } else if (WIFSIGNALED(status)) {
-                status = WTERMSIG(status);
+                // distinguish fatal signals by adding 128
+                status = 128 + WTERMSIG(status);
         } else {
-                status = 0;
+                status = -1;
         }
 
+        flush_stdin();
         exit(status);
 }
diff --git a/src/firejail/ls.c b/src/firejail/ls.c
index 63ef2309b..4156a7b25 100644
--- a/src/firejail/ls.c
+++ b/src/firejail/ls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -19,6 +19,7 @@
 */
 
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
@@ -45,7 +46,8 @@ static void print_file_or_dir(const char *path, const char *fname) {
         struct stat s;
         if (stat(name, &s) == -1) {
                 if (lstat(name, &s) == -1) {
-                        printf("Error: cannot access %s\n", name);
+                        printf("Error: cannot access %s\n", do_replace_cntrl_chars(name, '?'));
+                        free(name);
                         return;
                 }
         }
@@ -150,12 +152,17 @@ static void print_file_or_dir(const char *path, const char *fname) {
         if (allocated)
                 free(groupname);
 
+        // file size
         char *sz;
         if (asprintf(&sz, "%d", (int) s.st_size) == -1)
                 errExit("asprintf");
-        printf("%11.10s %s\n", sz, fname);
-        free(sz);
 
+        // file name
+        char *fname_print = replace_cntrl_chars(fname, '?');
+
+        printf("%11.10s %s\n", sz, fname_print);
+        free(sz);
+        free(fname_print);
 }
 
 static void print_directory(const char *path) {
@@ -191,13 +198,15 @@ void ls(const char *path) {
                 fprintf(stderr, "Error: cannot access %s\n", path);
                 exit(1);
         }
+
+        // debug doesn't filter control characters currently
         if (arg_debug)
                 printf("ls %s\n", rp);
 
         // list directory contents
         struct stat s;
         if (stat(rp, &s) == -1) {
-                fprintf(stderr, "Error: cannot access %s\n", rp);
+                fprintf(stderr, "Error: cannot access %s\n", do_replace_cntrl_chars(rp, '?'));
                 exit(1);
         }
         if (S_ISDIR(s.st_mode))
@@ -221,7 +230,7 @@ void cat(const char *path) {
 
         if (arg_debug)
                 printf("cat %s\n", path);
-        FILE *fp = fopen(path, "r");
+        FILE *fp = fopen(path, "re");
         if (!fp) {
                 fprintf(stderr, "Error: cannot read %s\n", path);
                 exit(1);
@@ -236,13 +245,13 @@ void cat(const char *path) {
                 fprintf(stderr, "Error: %s is not a regular file\n", path);
                 exit(1);
         }
-        bool tty = isatty(STDOUT_FILENO);
+        int tty = isatty(STDOUT_FILENO);
 
         int c;
         while ((c = fgetc(fp)) != EOF) {
                 // file is untrusted
                 // replace control characters when printing to a terminal
-                if (tty && c != '\t' && c != '\n' && iscntrl((unsigned char) c))
+                if (tty && iscntrl((unsigned char) c) && c != '\t' && c != '\n')
                         c = '?';
                 fputc(c, stdout);
         }
@@ -304,7 +313,7 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                 }
                 // create destination file if necessary
                 EUID_ASSERT();
-                int fd = open(dest_fname, O_WRONLY|O_CREAT|O_CLOEXEC, S_IRUSR | S_IWRITE);
+                int fd = open(dest_fname, O_WRONLY|O_CREAT|O_CLOEXEC, S_IRUSR | S_IWUSR);
                 if (fd == -1) {
                         fprintf(stderr, "Error: cannot open %s for writing\n", dest_fname);
                         exit(1);
@@ -324,7 +333,6 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                 // redirection
                 if (dup2(fd, STDOUT_FILENO) == -1)
                         errExit("dup2");
-                assert(fd != STDOUT_FILENO);
                 close(fd);
                 op = SANDBOX_FS_CAT;
         }
@@ -349,9 +357,8 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                         ls(fname1);
                 else
                         cat(fname1);
-#ifdef HAVE_GCOV
+
                 __gcov_flush();
-#endif
         }
         // get file from host and store it in the sandbox
         else if (op == SANDBOX_FS_PUT && path2) {
@@ -383,9 +390,9 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                         // copy the file
                         if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600)) // already a regular user
                                 _exit(1);
-#ifdef HAVE_GCOV
+
                         __gcov_flush();
-#endif
+
                         _exit(0);
                 }
 
@@ -415,9 +422,9 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) {
                         // copy the file
                         if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600)) // already a regular user
                                 _exit(1);
-#ifdef HAVE_GCOV
+
                         __gcov_flush();
-#endif
+
                         _exit(0);
                 }
 
diff --git a/src/firejail/macros.c b/src/firejail/macros.c
index 7f2f6dbf3..3f9460041 100644
--- a/src/firejail/macros.c
+++ b/src/firejail/macros.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -22,9 +22,11 @@
 #define MAXBUF 4098
 
 typedef struct macro_t {
-        char *name;     // macro name
+        char *name;             // macro name
         char *xdg;              // xdg line in ~/.config/user-dirs.dirs
-#define MAX_TRANSLATIONS 3      // several translations in case ~/.config/user-dirs.dirs not found
+        // several translations in case ~/.config/user-dirs.dirs not found
+        // covered currently: English, Russian, French, Italian, Spanish, Portuguese, German
+#define MAX_TRANSLATIONS 7
         char *translation[MAX_TRANSLATIONS];
 } Macro;
 
@@ -32,37 +34,37 @@ Macro macro[] = {
         {
                 "${DOWNLOADS}",
                 "XDG_DOWNLOAD_DIR=\"$HOME/",
-                { "Downloads", "Загрузки", "Téléchargement" }
+                {"Downloads", "Загрузки", "Téléchargement", "Scaricati", "Descargas"}
         },
 
         {
                 "${MUSIC}",
                 "XDG_MUSIC_DIR=\"$HOME/",
-                {"Music", "Музыка", "Musique"}
+                {"Music", "Музыка", "Musique", "Musica", "Música", "Musik"}
         },
 
         {
                 "${VIDEOS}",
                 "XDG_VIDEOS_DIR=\"$HOME/",
-                {"Videos", "Видео", "Vidéos"}
+                {"Videos", "Видео", "Vidéos", "Video", "Vídeos"}
         },
 
         {
                 "${PICTURES}",
                 "XDG_PICTURES_DIR=\"$HOME/",
-                {"Pictures", "Изображения", "Photos"}
+                {"Pictures", "Изображения", "Photos", "Immagini", "Imágenes", "Imagens", "Bilder"}
         },
 
         {
                 "${DESKTOP}",
                 "XDG_DESKTOP_DIR=\"$HOME/",
-                {"Desktop", "Рабочий стол", "Bureau"}
+                {"Desktop", "Рабочий стол", "Bureau", "Scrivania", "Escritorio", "Área de trabalho", "Schreibtisch"}
         },
 
         {
                 "${DOCUMENTS}",
                 "XDG_DOCUMENTS_DIR=\"$HOME/",
-                {"Documents", "Документы", "Documents"}
+                {"Documents", "Документы", "Documenti", "Documentos", "Dokumente"}
         },
 
         { 0 }
@@ -99,7 +101,7 @@ static char *resolve_xdg(const char *var) {
 
         if (asprintf(&fname, "%s/.config/user-dirs.dirs", cfg.homedir) == -1)
                 errExit("asprintf");
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (!fp) {
                 free(fname);
                 return NULL;
@@ -149,11 +151,12 @@ static char *resolve_xdg(const char *var) {
 
 // returns mallocated memory
 static char *resolve_hardcoded(char *entries[]) {
+        EUID_ASSERT();
         char *fname;
         struct stat s;
 
         int i = 0;
-        while (entries[i] != NULL) {
+        while (i < MAX_TRANSLATIONS && entries[i] != NULL) {
                 if (asprintf(&fname, "%s/%s", cfg.homedir, entries[i]) == -1)
                         errExit("asprintf");
 
@@ -262,28 +265,6 @@ char *expand_macros(const char *path) {
         return rv;
 }
 
-// replace control characters with a '?'
-static char *fix_control_chars(const char *fname) {
-        assert(fname);
-
-        size_t len = strlen(fname);
-        char *rv = malloc(len + 1);
-        if (!rv)
-                errExit("malloc");
-
-        size_t i = 0;
-        while (fname[i] != '\0') {
-                if (iscntrl((unsigned char) fname[i]))
-                        rv[i] = '?';
-                else
-                        rv[i] = fname[i];
-                i++;
-        }
-        rv[i] = '\0';
-
-        return rv;
-}
-
 void invalid_filename(const char *fname, int globbing) {
 //      EUID_ASSERT();
         assert(fname);
@@ -301,24 +282,5 @@ void invalid_filename(const char *fname, int globbing) {
                         return;
         }
 
-        size_t i = 0;
-        while (ptr[i] != '\0') {
-                if (iscntrl((unsigned char) ptr[i])) {
-                        char *new = fix_control_chars(fname);
-                        fprintf(stderr, "Error: \"%s\" is an invalid filename: no control characters allowed\n", new);
-                        exit(1);
-                }
-                i++;
-        }
-
-        char *reject;
-        if (globbing)
-                reject = "\\&!\"'<>%^{};,"; // file globbing ('*?[]') is allowed
-        else
-                reject = "\\&!?\"'<>%^{};,*[]";
-        char *c = strpbrk(ptr, reject);
-        if (c) {
-                fprintf(stderr, "Error: \"%s\" is an invalid filename: rejected character: \"%c\"\n", fname, *c);
-                exit(1);
-        }
+        reject_meta_chars(ptr, globbing);
 }
diff --git a/src/firejail/main.c b/src/firejail/main.c
index d6de6d997..4b01ea0a5 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,6 +20,7 @@
 #include "firejail.h"
 #include "../include/pid.h"
 #include "../include/firejail_user.h"
+#include "../include/gcov_wrapper.h"
 #include "../include/syscall.h"
 #include "../include/seccomp.h"
 #define _GNU_SOURCE
@@ -31,7 +32,8 @@
 #include <dirent.h>
 #include <pwd.h>
 #include <errno.h>
-//#include <limits.h>
+
+#include <limits.h>
 #include <sys/file.h>
 #include <sys/prctl.h>
 #include <signal.h>
@@ -116,15 +118,16 @@ int arg_private_cwd = 0;			// private working directory
 int arg_scan = 0;                               // arp-scan all interfaces
 int arg_whitelist = 0;                          // whitelist command
 int arg_nosound = 0;                            // disable sound
-int arg_noautopulse = 0;                        // disable automatic ~/.config/pulse init
 int arg_novideo = 0;                    //disable video devices in /dev
 int arg_no3d;                                   // disable 3d hardware acceleration
+int arg_noprinters = 0;                         // disable printers
 int arg_quiet = 0;                              // no output for scripting
 int arg_join_network = 0;                       // join only the network namespace
 int arg_join_filesystem = 0;                    // join only the mount namespace
 int arg_nice = 0;                               // nice value configured
 int arg_ipc = 0;                                        // enable ipc namespace
 int arg_writable_etc = 0;                       // writable etc
+int arg_keep_config_pulse = 0;                  // disable automatic ~/.config/pulse init
 int arg_writable_var = 0;                       // writable var
 int arg_keep_var_tmp = 0;                       // don't overwrite /var/tmp
 int arg_writable_run_user = 0;                  // writable /run/user
@@ -135,7 +138,7 @@ int arg_allow_debuggers = 0;			// allow debuggers
 int arg_x11_block = 0;                          // block X11
 int arg_x11_xorg = 0;                           // use X11 security extension
 int arg_allusers = 0;                           // all user home directories visible
-int arg_machineid = 0;                          // preserve /etc/machine-id
+int arg_machineid = 0;                          // spoof /etc/machine-id
 int arg_allow_private_blacklist = 0;            // blacklist things in private directories
 int arg_disable_mnt = 0;                        // disable /mnt and /media
 int arg_noprofile = 0; // use default.profile if none other found/specified
@@ -145,11 +148,14 @@ int arg_nodvd = 0; // --nodvd
 int arg_nou2f = 0; // --nou2f
 int arg_noinput = 0; // --noinput
 int arg_deterministic_exit_code = 0;    // always exit with first child's exit status
+int arg_deterministic_shutdown = 0;     // shut down the sandbox if first child dies
+int arg_keep_fd_all = 0;                // inherit all file descriptors to sandbox
 DbusPolicy arg_dbus_user = DBUS_POLICY_ALLOW;   // --dbus-user
 DbusPolicy arg_dbus_system = DBUS_POLICY_ALLOW; // --dbus-system
 const char *arg_dbus_log_file = NULL;
 int arg_dbus_log_user = 0;
 int arg_dbus_log_system = 0;
+int arg_tab = 0;
 int login_shell = 0;
 
 int parent_to_child_fds[2];
@@ -188,13 +194,15 @@ static void my_handler(int s) {
         logsignal(s);
 
         if (waitpid(child, NULL, WNOHANG) == 0) {
-                if (has_handler(child, s)) // signals are not delivered if there is no handler yet
+                // child is pid 1 of a pid namespace:
+                // signals are not delivered if there is no handler yet
+                if (has_handler(child, s))
                         kill(child, s);
                 else
                         kill(child, SIGKILL);
                 waitpid(child, NULL, 0);
         }
-        myexit(s);
+        myexit(128 + s);
 }
 
 static void install_handler(void) {
@@ -259,8 +267,8 @@ static void init_cfg(int argc, char **argv) {
                 fprintf(stderr, "Error: user %s doesn't have a user directory assigned\n", cfg.username);
                 exit(1);
         }
+        check_homedir(pw->pw_dir);
         cfg.homedir = clean_pathname(pw->pw_dir);
-        check_homedir();
 
         // initialize random number generator
         sandbox_pid = getpid();
@@ -402,6 +410,23 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
         }
 #endif
 #ifdef HAVE_NETWORK
+        else if (strcmp(argv[i], "--nettrace") == 0) {
+                if (checkcfg(CFG_NETWORK)) {
+                        netfilter_trace(0);
+                }
+                else
+                        exit_err_feature("networking");
+                exit(0);
+        }
+        else if (strncmp(argv[i], "--nettrace=", 11) == 0) {
+                if (checkcfg(CFG_NETWORK)) {
+                        pid_t pid = require_pid(argv[i] + 11);
+                        netfilter_trace(pid);
+                }
+                else
+                        exit_err_feature("networking");
+                exit(0);
+        }
         else if (strncmp(argv[i], "--bandwidth=", 12) == 0) {
                 if (checkcfg(CFG_NETWORK)) {
                         logargs(argc, argv);
@@ -535,7 +560,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
                 char *fname;
                 if (asprintf(&fname, RUN_FIREJAIL_PROFILE_DIR "/%d", pid) == -1)
                         errExit("asprintf");
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 if (!fp) {
                         fprintf(stderr, "Error: sandbox %s not found\n", argv[i] + 16);
                         exit(1);
@@ -862,13 +887,12 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
 char *guess_shell(void) {
         const char *shell;
         char *retval;
-        struct stat s;
 
         shell = env_get("SHELL");
         if (shell) {
                 invalid_filename(shell, 0); // no globbing
-                if (!is_dir(shell) && strstr(shell, "..") == NULL && stat(shell, &s) == 0 && access(shell, X_OK) == 0 &&
-                    strcmp(shell, PATH_FIREJAIL) != 0)
+                if (access(shell, X_OK) == 0 && !is_dir(shell) && strstr(shell, "..") == NULL &&
+                    strcmp(gnu_basename(shell), "firejail") != 0)
                         goto found;
         }
 
@@ -878,12 +902,15 @@ char *guess_shell(void) {
         int i = 0;
         while (shells[i] != NULL) {
                 // access call checks as real UID/GID, not as effective UID/GID
-                if (stat(shells[i], &s) == 0 && access(shells[i], X_OK) == 0) {
+                if (access(shells[i], X_OK) == 0) {
                         shell = shells[i];
-                        break;
+                        goto found;
                 }
                 i++;
         }
+
+        return NULL;
+
  found:
         retval = strdup(shell);
         if (!retval)
@@ -929,12 +956,14 @@ static void run_builder(int argc, char **argv) {
         if (setresuid(-1, getuid(), getuid()) != 0)
                 errExit("setresuid");
 
+        if (env_get("LD_PRELOAD") != NULL)
+                fprintf(stderr, "run_builder: LD_PRELOAD is: '%s'\n", env_get("LD_PRELOAD"));
         assert(env_get("LD_PRELOAD") == NULL);
         assert(getenv("LD_PRELOAD") == NULL);
         umask(orig_umask);
 
-        // restore some environment variables
-        env_apply_whitelist_sbox();
+        // restore original environment variables
+        env_apply_all();
 
         argv[0] = LIBDIR "/firejail/fbuilder";
         execvp(argv[0], argv);
@@ -961,7 +990,7 @@ void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, b
 static int check_postexec(const char *list) {
         char *prelist, *postlist;
 
-        if (list) {
+        if (list && list[0]) {
                 syscalls_in_list(list, "@default-keep", -1, &prelist, &postlist, true);
                 if (postlist)
                         return 1;
@@ -980,125 +1009,64 @@ int main(int argc, char **argv, char **envp) {
         int option_cgroup = 0;
         int custom_profile = 0; // custom profile loaded
         int arg_caps_cmdline = 0;       // caps requested on command line (used to break out of --chroot)
+        int arg_netlock = 0;
         char **ptr;
 
+
         // sanitize the umask
         orig_umask = umask(022);
 
-        // check standard streams before printing anything
-        fix_std_streams();
-
         // drop permissions by default and rise them when required
         EUID_INIT();
         EUID_USER();
 
+        // check standard streams before opening any file
+        fix_std_streams();
+
         // argument count should be larger than 0
         if (argc == 0 || !argv || strlen(argv[0]) == 0) {
                 fprintf(stderr, "Error: argv is invalid\n");
                 exit(1);
         } else if (argc >= MAX_ARGS) {
-                fprintf(stderr, "Error: too many arguments\n");
+                fprintf(stderr, "Error: too many arguments: argc (%d) >= MAX_ARGS (%d)\n", argc, MAX_ARGS);
                 exit(1);
         }
 
+        // sanity check for arguments
+        for (i = 0; i < argc; i++) {
+//              if (*argv[i] == 0) { // see #4395 - bug reported by Debian
+//                      fprintf(stderr, "Error: too short arguments: argv[%d] is empty\n", i);
+//                      exit(1);
+//              }
+                if (strlen(argv[i]) >= MAX_ARG_LEN) {
+                        fprintf(stderr, "Error: too long arguments: argv[%d] len (%zu) >= MAX_ARG_LEN (%d)\n", i, strlen(argv[i]), MAX_ARG_LEN);
+                        exit(1);
+                }
+        }
+
         // Stash environment variables
         for (i = 0, ptr = envp; ptr && *ptr && i < MAX_ENVS; i++, ptr++)
                 env_store(*ptr, SETENV);
 
         // sanity check for environment variables
         if (i >= MAX_ENVS) {
-                fprintf(stderr, "Error: too many environment variables\n");
+                fprintf(stderr, "Error: too many environment variables: >= MAX_ENVS (%d)\n", MAX_ENVS);
                 exit(1);
         }
 
-        // sanity check for arguments
-        for (i = 0; i < argc; i++) {
-                if (*argv[i] == 0) {
-                        fprintf(stderr, "Error: too short arguments\n");
-                        exit(1);
-                }
-                if (strlen(argv[i]) >= MAX_ARG_LEN) {
-                        fprintf(stderr, "Error: too long arguments\n");
-                        exit(1);
-                }
-        }
-
         // Reapply a minimal set of environment variables
         env_apply_whitelist();
 
-        // check if the user is allowed to use firejail
-        init_cfg(argc, argv);
-
-        // get starting timestamp, process --quiet
-        timetrace_start();
+        // process --quiet
         const char *env_quiet = env_get("FIREJAIL_QUIET");
         if (check_arg(argc, argv, "--quiet", 1) || (env_quiet && strcmp(env_quiet, "yes") == 0))
                 arg_quiet = 1;
 
-        // cleanup at exit
-        EUID_ROOT();
-        atexit(clear_atexit);
-
-        // build /run/firejail directory structure
-        preproc_build_firejail_dir();
-        const char *container_name = env_get("container");
-        if (!container_name || strcmp(container_name, "firejail")) {
-                lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
-                if (lockfd_directory != -1) {
-                        int rv = fchown(lockfd_directory, 0, 0);
-                        (void) rv;
-                        flock(lockfd_directory, LOCK_EX);
-                }
-                preproc_clean_run();
-                flock(lockfd_directory, LOCK_UN);
-                close(lockfd_directory);
-        }
-        EUID_USER();
-
-        // --ip=dhcp - we need access to /sbin and /usr/sbin directories in order to run ISC DHCP client (dhclient)
-        // these paths are disabled in disable-common.inc
-        if ((i = check_arg(argc, argv, "--ip", 0)) != 0) {
-                if (strncmp(argv[i] + 4, "=dhcp", 5) == 0) {
-                        profile_add("noblacklist /sbin");
-                        profile_add("noblacklist /usr/sbin");
-                }
-        }
-
-        // for appimages we need to remove "include disable-shell.inc from the profile
-        // a --profile command can show up before --appimage
-        if (check_arg(argc, argv, "--appimage", 1))
-                arg_appimage = 1;
-
-        // process allow-debuggers
-        if (check_arg(argc, argv, "--allow-debuggers", 1)) {
-                // check kernel version
-                struct utsname u;
-                int rv = uname(&u);
-                if (rv != 0)
-                        errExit("uname");
-                int major;
-                int minor;
-                if (2 != sscanf(u.release, "%d.%d", &major, &minor)) {
-                        fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version);
-                        exit(1);
-                }
-                if (major < 4 || (major == 4 && minor < 8)) {
-                        fprintf(stderr, "Error: --allow-debuggers is disabled on Linux kernels prior to 4.8. "
-                                "A bug in ptrace call allows a full bypass of the seccomp filter. "
-                                "Your current kernel version is %d.%d.\n", major, minor);
-                        exit(1);
-                }
-
-                arg_allow_debuggers = 1;
-                char *cmd = strdup("noblacklist ${PATH}/strace");
-                if (!cmd)
-                        errExit("strdup");
-                profile_add(cmd);
-        }
+        // check if the user is allowed to use firejail
+        init_cfg(argc, argv);
 
-        // profile builder
-        if (check_arg(argc, argv, "--build", 0)) // supports both --build and --build=filename
-                run_builder(argc, argv); // this function will not return
+        // get starting timestamp
+        timetrace_start();
 
         // check argv[0] symlink wrapper if this is not a login shell
         if (*argv[0] != '-')
@@ -1123,15 +1091,44 @@ int main(int argc, char **argv, char **envp) {
                         __builtin_unreachable();
                 }
         }
-        EUID_ASSERT();
 
+        // profile builder
+        if (check_arg(argc, argv, "--build", 0)) // supports both --build and --build=filename
+                run_builder(argc, argv); // this function will not return
+
+        // intrusion detection system
+        if (check_arg(argc, argv, "--ids-", 0)) // supports both --ids-init and --ids-check
+                run_ids(argc, argv); // this function will not return
 
-        // check firejail directories
         EUID_ROOT();
-        delete_run_files(sandbox_pid);
+#ifndef HAVE_SUID
+        if (geteuid() != 0) {
+                fprintf(stderr, "Error: Firejail needs to be SUID.\n");
+                fprintf(stderr, "Assuming firejail is installed in /usr/bin, execute the following command as root:\n");
+                fprintf(stderr, "  chmod u+s /usr/bin/firejail\n");
+        }
+#endif
+
+        // build /run/firejail directory structure
+        preproc_build_firejail_dir();
+        const char *container_name = env_get("container");
+        if (!container_name || strcmp(container_name, "firejail")) {
+                lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
+                if (lockfd_directory != -1) {
+                        int rv = fchown(lockfd_directory, 0, 0);
+                        (void) rv;
+                        flock(lockfd_directory, LOCK_EX);
+                }
+                preproc_clean_run();
+                flock(lockfd_directory, LOCK_UN);
+                close(lockfd_directory);
+        }
+
+        delete_run_files(getpid());
+        atexit(clear_atexit);
         EUID_USER();
 
-        //check if the parent is sshd daemon
+        // check if the parent is sshd daemon
         int parent_sshd = 0;
         {
                 pid_t ppid = getppid();
@@ -1145,7 +1142,7 @@ int main(int argc, char **argv, char **envp) {
 
 #ifdef DEBUG_RESTRICTED_SHELL
                                 {EUID_ROOT();
-                                FILE *fp = fopen("/firelog", "w");
+                                FILE *fp = fopen("/firelog", "we");
                                 if (fp) {
                                         int i;
                                         fprintf(fp, "argc %d: ", argc);
@@ -1164,7 +1161,7 @@ int main(int argc, char **argv, char **envp) {
                                                     strncmp(argv[2], "scp ", 4) == 0) {
 #ifdef DEBUG_RESTRICTED_SHELL
                                                         {EUID_ROOT();
-                                                        FILE *fp = fopen("/firelog", "a");
+                                                        FILE *fp = fopen("/firelog", "ae");
                                                         if (fp) {
                                                                 fprintf(fp, "run without a sandbox\n");
                                                                 fclose(fp);
@@ -1188,7 +1185,8 @@ int main(int argc, char **argv, char **envp) {
         }
         EUID_ASSERT();
 
-        // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users
+        // is this a login shell, or a command passed by sshd,
+        // insert command line options from /etc/firejail/login.users
         if (*argv[0] == '-' || parent_sshd) {
                 if (argc == 1)
                         login_shell = 1;
@@ -1197,7 +1195,7 @@ int main(int argc, char **argv, char **envp) {
 
 #ifdef DEBUG_RESTRICTED_SHELL
                         {EUID_ROOT();
-                        FILE *fp = fopen("/firelog", "a");
+                        FILE *fp = fopen("/firelog", "ae");
                         if (fp) {
                                 fprintf(fp, "fullargc %d: ",  fullargc);
                                 int i;
@@ -1219,7 +1217,7 @@ int main(int argc, char **argv, char **envp) {
 
 #ifdef DEBUG_RESTRICTED_SHELL
                         {EUID_ROOT();
-                        FILE *fp = fopen("/firelog", "a");
+                        FILE *fp = fopen("/firelog", "ae");
                         if (fp) {
                                 fprintf(fp, "argc %d: ", argc);
                                 int i;
@@ -1240,6 +1238,47 @@ int main(int argc, char **argv, char **envp) {
 #endif
         EUID_ASSERT();
 
+        // --ip=dhcp - we need access to /sbin and /usr/sbin directories in order to run ISC DHCP client (dhclient)
+        // these paths are disabled in disable-common.inc
+        if ((i = check_arg(argc, argv, "--ip", 0)) != 0) {
+                if (strncmp(argv[i] + 4, "=dhcp", 5) == 0) {
+                        profile_add("noblacklist /sbin");
+                        profile_add("noblacklist /usr/sbin");
+                }
+        }
+
+        // process allow-debuggers
+        if (check_arg(argc, argv, "--allow-debuggers", 1)) {
+                // check kernel version
+                struct utsname u;
+                int rv = uname(&u);
+                if (rv != 0)
+                        errExit("uname");
+                int major;
+                int minor;
+                if (2 != sscanf(u.release, "%d.%d", &major, &minor)) {
+                        fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version);
+                        exit(1);
+                }
+                if (major < 4 || (major == 4 && minor < 8)) {
+                        fprintf(stderr, "Error: --allow-debuggers is disabled on Linux kernels prior to 4.8. "
+                                "A bug in ptrace call allows a full bypass of the seccomp filter. "
+                                "Your current kernel version is %d.%d.\n", major, minor);
+                        exit(1);
+                }
+
+                arg_allow_debuggers = 1;
+                char *cmd = strdup("noblacklist ${PATH}/strace");
+                if (!cmd)
+                        errExit("strdup");
+                profile_add(cmd);
+        }
+
+        // for appimages we need to remove "include disable-shell.inc from the profile
+        // a --profile command can show up before --appimage
+        if (check_arg(argc, argv, "--appimage", 1))
+                arg_appimage = 1;
+
         // check for force-nonewprivs in /etc/firejail/firejail.config file
         if (checkcfg(CFG_FORCE_NONEWPRIVS))
                 arg_nonewprivs = 1;
@@ -1248,8 +1287,10 @@ int main(int argc, char **argv, char **envp) {
         for (i = 1; i < argc; i++) {
                 run_cmd_and_exit(i, argc, argv); // will exit if the command is recognized
 
-                if (strcmp(argv[i], "--debug") == 0 && !arg_quiet)
+                if (strcmp(argv[i], "--debug") == 0) {
                         arg_debug = 1;
+                        arg_quiet = 0;
+                }
                 else if (strcmp(argv[i], "--debug-blacklists") == 0)
                         arg_debug_blacklists = 1;
                 else if (strcmp(argv[i], "--debug-whitelists") == 0)
@@ -1257,8 +1298,8 @@ int main(int argc, char **argv, char **envp) {
                 else if (strcmp(argv[i], "--debug-private-lib") == 0)
                         arg_debug_private_lib = 1;
                 else if (strcmp(argv[i], "--quiet") == 0) {
-                        arg_quiet = 1;
-                        arg_debug = 0;
+                        if (!arg_debug)
+                                arg_quiet = 1;
                 }
                 else if (strcmp(argv[i], "--allow-debuggers") == 0) {
                         // already handled
@@ -1480,8 +1521,11 @@ int main(int argc, char **argv, char **envp) {
                         arg_rlimit_nproc = 1;
                 }
                 else if (strncmp(argv[i], "--rlimit-fsize=", 15) == 0) {
-                        check_unsigned(argv[i] + 15, "Error: invalid rlimit");
-                        sscanf(argv[i] + 15, "%llu", &cfg.rlimit_fsize);
+                        cfg.rlimit_fsize = parse_arg_size(argv[i] + 15);
+                        if (cfg.rlimit_fsize == 0) {
+                                perror("Error: invalid rlimit-fsize. Only use positive numbers and k, m or g suffix.");
+                                exit(1);
+                        }
                         arg_rlimit_fsize = 1;
                 }
                 else if (strncmp(argv[i], "--rlimit-sigpending=", 20) == 0) {
@@ -1490,8 +1534,11 @@ int main(int argc, char **argv, char **envp) {
                         arg_rlimit_sigpending = 1;
                 }
                 else if (strncmp(argv[i], "--rlimit-as=", 12) == 0) {
-                        check_unsigned(argv[i] + 12, "Error: invalid rlimit");
-                        sscanf(argv[i] + 12, "%llu", &cfg.rlimit_as);
+                        cfg.rlimit_as = parse_arg_size(argv[i] + 12);
+                        if (cfg.rlimit_as == 0) {
+                                perror("Error: invalid rlimit-as. Only use positive numbers and k, m or g suffix.");
+                                exit(1);
+                        }
                         arg_rlimit_as = 1;
                 }
                 else if (strncmp(argv[i], "--ipc-namespace", 15) == 0)
@@ -1507,15 +1554,16 @@ int main(int argc, char **argv, char **envp) {
                 else if (strncmp(argv[i], "--cgroup=", 9) == 0) {
                         if (checkcfg(CFG_CGROUP)) {
                                 if (option_cgroup) {
-                                        fprintf(stderr, "Error: only a cgroup can be defined\n");
+                                        fprintf(stderr, "Error: only one cgroup can be defined\n");
                                         exit(1);
                                 }
-
-                                option_cgroup = 1;
                                 cfg.cgroup = strdup(argv[i] + 9);
                                 if (!cfg.cgroup)
                                         errExit("strdup");
-                                set_cgroup(cfg.cgroup);
+
+                                check_cgroup_file(cfg.cgroup);
+                                set_cgroup(cfg.cgroup, getpid());
+                                option_cgroup = 1;
                         }
                         else
                                 exit_err_feature("cgroup");
@@ -1546,6 +1594,7 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL);      // will exit if something wrong
                         profile_add(line);
                 }
+
                 else if (strncmp(argv[i], "--blacklist=", 12) == 0) {
                         char *line;
                         if (asprintf(&line, "blacklist %s", argv[i] + 12) == -1)
@@ -1562,19 +1611,13 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL);      // will exit if something wrong
                         profile_add(line);
                 }
-
-#ifdef HAVE_WHITELIST
                 else if (strncmp(argv[i], "--whitelist=", 12) == 0) {
-                        if (checkcfg(CFG_WHITELIST)) {
-                                char *line;
-                                if (asprintf(&line, "whitelist %s", argv[i] + 12) == -1)
-                                        errExit("asprintf");
+                        char *line;
+                        if (asprintf(&line, "whitelist %s", argv[i] + 12) == -1)
+                                errExit("asprintf");
 
-                                profile_check_line(line, 0, NULL);      // will exit if something wrong
-                                profile_add(line);
-                        }
-                        else
-                                exit_err_feature("whitelist");
+                        profile_check_line(line, 0, NULL);      // will exit if something wrong
+                        profile_add(line);
                 }
                 else if (strncmp(argv[i], "--nowhitelist=", 14) == 0) {
                         char *line;
@@ -1584,7 +1627,7 @@ int main(int argc, char **argv, char **envp) {
                         profile_check_line(line, 0, NULL);      // will exit if something wrong
                         profile_add(line);
                 }
-#endif
+
                 else if (strncmp(argv[i], "--mkdir=", 8) == 0) {
                         char *line;
                         if (asprintf(&line, "mkdir %s", argv[i] + 8) == -1)
@@ -1824,6 +1867,8 @@ int main(int argc, char **argv, char **envp) {
                                 exit(1);
                         }
                         arg_noprofile = 1;
+                        // force keep-config-pulse in order to keep ~/.config/pulse as is
+                        arg_keep_config_pulse = 1;
                 }
                 else if (strncmp(argv[i], "--ignore=", 9) == 0) {
                         if (custom_profile) {
@@ -1832,6 +1877,14 @@ int main(int argc, char **argv, char **envp) {
                         }
                         profile_add_ignore(argv[i] + 9);
                 }
+                else if (strncmp(argv[i], "--keep-fd=", 10) == 0) {
+                        if (strcmp(argv[i] + 10, "all") == 0)
+                                arg_keep_fd_all = 1;
+                        else {
+                                const char *add = argv[i] + 10;
+                                profile_list_augment(&cfg.keep_fd, add);
+                        }
+                }
 #ifdef HAVE_CHROOT
                 else if (strncmp(argv[i], "--chroot=", 9) == 0) {
                         if (checkcfg(CFG_CHROOT)) {
@@ -1874,6 +1927,9 @@ int main(int argc, char **argv, char **envp) {
                         }
                         arg_writable_etc = 1;
                 }
+                else if (strcmp(argv[i], "--keep-config-pulse") == 0) {
+                        arg_keep_config_pulse = 1;
+                }
                 else if (strcmp(argv[i], "--writable-var") == 0) {
                         arg_writable_var = 1;
                 }
@@ -1944,61 +2000,77 @@ int main(int argc, char **argv, char **envp) {
                         arg_keep_dev_shm = 1;
                 }
                 else if (strncmp(argv[i], "--private-etc=", 14) == 0) {
-                        if (arg_writable_etc) {
-                                fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
-                                exit(1);
-                        }
+                        if (checkcfg(CFG_PRIVATE_ETC)) {
+                                if (arg_writable_etc) {
+                                        fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
+                                        exit(1);
+                                }
 
-                        // extract private etc list
-                        if (*(argv[i] + 14) == '\0') {
-                                fprintf(stderr, "Error: invalid private-etc option\n");
-                                exit(1);
+                                // extract private etc list
+                                if (*(argv[i] + 14) == '\0') {
+                                        fprintf(stderr, "Error: invalid private-etc option\n");
+                                        exit(1);
+                                }
+                                if (cfg.etc_private_keep) {
+                                        if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, argv[i] + 14) < 0 )
+                                                errExit("asprintf");
+                                } else
+                                        cfg.etc_private_keep = argv[i] + 14;
+                                arg_private_etc = 1;
                         }
-                        if (cfg.etc_private_keep) {
-                                if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, argv[i] + 14) < 0 )
-                                        errExit("asprintf");
-                        } else
-                                cfg.etc_private_keep = argv[i] + 14;
-                        arg_private_etc = 1;
+                        else
+                                exit_err_feature("private-etc");
                 }
                 else if (strncmp(argv[i], "--private-opt=", 14) == 0) {
-                        // extract private opt list
-                        if (*(argv[i] + 14) == '\0') {
-                                fprintf(stderr, "Error: invalid private-opt option\n");
-                                exit(1);
+                        if (checkcfg(CFG_PRIVATE_OPT)) {
+                                // extract private opt list
+                                if (*(argv[i] + 14) == '\0') {
+                                        fprintf(stderr, "Error: invalid private-opt option\n");
+                                        exit(1);
+                                }
+                                if (cfg.opt_private_keep) {
+                                        if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, argv[i] + 14) < 0 )
+                                                errExit("asprintf");
+                                } else
+                                        cfg.opt_private_keep = argv[i] + 14;
+                                arg_private_opt = 1;
                         }
-                        if (cfg.opt_private_keep) {
-                                if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, argv[i] + 14) < 0 )
-                                        errExit("asprintf");
-                        } else
-                                cfg.opt_private_keep = argv[i] + 14;
-                        arg_private_opt = 1;
+                        else
+                                exit_err_feature("private-opt");
                 }
                 else if (strncmp(argv[i], "--private-srv=", 14) == 0) {
-                        // extract private srv list
-                        if (*(argv[i] + 14) == '\0') {
-                                fprintf(stderr, "Error: invalid private-srv option\n");
-                                exit(1);
+                        if (checkcfg(CFG_PRIVATE_SRV)) {
+                                // extract private srv list
+                                if (*(argv[i] + 14) == '\0') {
+                                        fprintf(stderr, "Error: invalid private-srv option\n");
+                                        exit(1);
+                                }
+                                if (cfg.srv_private_keep) {
+                                        if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, argv[i] + 14) < 0 )
+                                                errExit("asprintf");
+                                } else
+                                        cfg.srv_private_keep = argv[i] + 14;
+                                arg_private_srv = 1;
                         }
-                        if (cfg.srv_private_keep) {
-                                if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, argv[i] + 14) < 0 )
-                                        errExit("asprintf");
-                        } else
-                                cfg.srv_private_keep = argv[i] + 14;
-                        arg_private_srv = 1;
+                        else
+                                exit_err_feature("private-srv");
                 }
                 else if (strncmp(argv[i], "--private-bin=", 14) == 0) {
-                        // extract private bin list
-                        if (*(argv[i] + 14) == '\0') {
-                                fprintf(stderr, "Error: invalid private-bin option\n");
-                                exit(1);
+                        if (checkcfg(CFG_PRIVATE_BIN)) {
+                                // extract private bin list
+                                if (*(argv[i] + 14) == '\0') {
+                                        fprintf(stderr, "Error: invalid private-bin option\n");
+                                        exit(1);
+                                }
+                                if (cfg.bin_private_keep) {
+                                        if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, argv[i] + 14) < 0 )
+                                                errExit("asprintf");
+                                } else
+                                        cfg.bin_private_keep = argv[i] + 14;
+                                arg_private_bin = 1;
                         }
-                        if (cfg.bin_private_keep) {
-                                if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, argv[i] + 14) < 0 )
-                                        errExit("asprintf");
-                        } else
-                                cfg.bin_private_keep = argv[i] + 14;
-                        arg_private_bin = 1;
+                        else
+                                exit_err_feature("private-bin");
                 }
                 else if (strncmp(argv[i], "--private-lib", 13) == 0) {
                         if (checkcfg(CFG_PRIVATE_LIB)) {
@@ -2076,11 +2148,16 @@ int main(int argc, char **argv, char **envp) {
                 else if (strcmp(argv[i], "--nosound") == 0)
                         arg_nosound = 1;
                 else if (strcmp(argv[i], "--noautopulse") == 0)
-                        arg_noautopulse = 1;
+                        arg_keep_config_pulse = 1;
                 else if (strcmp(argv[i], "--novideo") == 0)
                         arg_novideo = 1;
                 else if (strcmp(argv[i], "--no3d") == 0)
                         arg_no3d = 1;
+                else if (strcmp(argv[i], "--noprinters") == 0) {
+                        arg_noprinters = 1;
+                        profile_add("blacklist /dev/lp*");
+                        profile_add("blacklist /run/cups/cups.sock");
+                }
                 else if (strcmp(argv[i], "--notv") == 0)
                         arg_notv = 1;
                 else if (strcmp(argv[i], "--nodvd") == 0)
@@ -2253,6 +2330,21 @@ int main(int argc, char **argv, char **envp) {
                         continue;
                 }
 #ifdef HAVE_NETWORK
+                else if (strcmp(argv[i], "--netlock") == 0) {
+                        if (checkcfg(CFG_NETWORK))
+                                arg_netlock = 1;
+                        else
+                                exit_err_feature("networking");
+                }
+                else if (strncmp(argv[i], "--netlock=", 10) == 0) {
+                        if (checkcfg(CFG_NETWORK)) {
+                                pid_t pid = require_pid(argv[i] + 10);
+                                netfilter_netlock(pid);
+                        }
+                        else
+                                exit_err_feature("networking");
+                        exit(0);
+                }
                 else if (strncmp(argv[i], "--interface=", 12) == 0) {
                         if (checkcfg(CFG_NETWORK)) {
                                 // checks
@@ -2558,7 +2650,7 @@ int main(int argc, char **argv, char **envp) {
                         else if (cfg.dns4 == NULL)
                                 cfg.dns4 = dns;
                         else {
-                                fwarning("Warning: up to 4 DNS servers can be specified, %s ignored\n", dns);
+                                fwarning("up to 4 DNS servers can be specified, %s ignored\n", dns);
                                 free(dns);
                         }
                 }
@@ -2579,6 +2671,15 @@ int main(int argc, char **argv, char **envp) {
                         if (checkcfg(CFG_NETWORK)) {
                                 arg_netfilter = 1;
                                 arg_netfilter_file = argv[i] + 12;
+
+                                // expand tilde
+                                if (*arg_netfilter_file == '~') {
+                                        char *tmp;
+                                        if (asprintf(&tmp, "%s%s", cfg.homedir, arg_netfilter_file + 1) == -1)
+                                                errExit("asprintf");
+                                        arg_netfilter_file = tmp;
+                                }
+
                                 check_netfilter_file(arg_netfilter_file);
                         }
                         else
@@ -2589,6 +2690,15 @@ int main(int argc, char **argv, char **envp) {
                         if (checkcfg(CFG_NETWORK)) {
                                 arg_netfilter6 = 1;
                                 arg_netfilter6_file = argv[i] + 13;
+
+                                // expand tilde
+                                if (*arg_netfilter6_file == '~') {
+                                        char *tmp;
+                                        if (asprintf(&tmp, "%s%s", cfg.homedir, arg_netfilter6_file + 1) == -1)
+                                                errExit("asprintf");
+                                        arg_netfilter6_file = tmp;
+                                }
+
                                 check_netfilter_file(arg_netfilter6_file);
                         }
                         else
@@ -2609,8 +2719,9 @@ int main(int argc, char **argv, char **envp) {
                 //*************************************
                 else if (strncmp(argv[i], "--timeout=", 10) == 0)
                         cfg.timeout = extract_timeout(argv[i] + 10);
-                else if (strcmp(argv[i], "--appimage") == 0)
-                        arg_appimage = 1;
+                else if (strcmp(argv[i], "--appimage") == 0) {
+                        // already handled
+                }
                 else if (strcmp(argv[i], "--shell=none") == 0) {
                         arg_shell_none = 1;
                         if (cfg.shell) {
@@ -2685,6 +2796,11 @@ int main(int argc, char **argv, char **envp) {
                 else if (strcmp(argv[i], "--deterministic-exit-code") == 0) {
                         arg_deterministic_exit_code = 1;
                 }
+                else if (strcmp(argv[i], "--deterministic-shutdown") == 0) {
+                        arg_deterministic_shutdown = 1;
+                }
+                else if (strcmp(argv[i], "--tab") == 0)
+                        arg_tab = 1;
                 else {
                         // double dash - positional params to follow
                         if (strcmp(argv[i], "--") == 0) {
@@ -2786,6 +2902,11 @@ int main(int argc, char **argv, char **envp) {
         // build the sandbox command
         if (prog_index == -1 && cfg.shell) {
                 assert(cfg.command_line == NULL); // runs cfg.shell
+                if (arg_appimage) {
+                        fprintf(stderr, "Error: no appimage archive specified\n");
+                        exit(1);
+                }
+
                 cfg.window_title = cfg.shell;
                 cfg.command_name = cfg.shell;
         }
@@ -2793,10 +2914,11 @@ int main(int argc, char **argv, char **envp) {
                 if (arg_debug)
                         printf("Configuring appimage environment\n");
                 appimage_set(cfg.command_name);
-                build_appimage_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
+                build_appimage_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index, true);
         }
         else {
-                build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
+                // Only add extra quotes if we were not launched by sshd.
+                build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index, !parent_sshd);
         }
 /*      else {
                 fprintf(stderr, "Error: command must be specified when --shell=none used.\n");
@@ -2810,7 +2932,13 @@ int main(int argc, char **argv, char **envp) {
 
         // load the profile
         if (!arg_noprofile && !custom_profile) {
-                custom_profile = profile_find_firejail(cfg.command_name, 1);
+                if (arg_appimage) {
+                        custom_profile = appimage_find_profile(cfg.command_name);
+                        // disable shell=* for appimages
+                        arg_shell_none = 0;
+                }
+                else
+                        custom_profile = profile_find_firejail(cfg.command_name, 1);
         }
 
         // use default.profile as the default
@@ -2824,7 +2952,7 @@ int main(int argc, char **argv, char **envp) {
                 custom_profile = profile_find_firejail(profile_name, 1);
 
                 if (!custom_profile) {
-                        fprintf(stderr, "Error: no default.profile installed\n");
+                        fprintf(stderr, "Error: no %s installed\n", profile_name);
                         exit(1);
                 }
 
@@ -2840,6 +2968,15 @@ int main(int argc, char **argv, char **envp) {
         // check network configuration options - it will exit if anything went wrong
         net_check_cfg();
 
+        // customization of default seccomp filter
+        if (config_seccomp_filter_add) {
+                if (arg_seccomp && !cfg.seccomp_list_keep && !cfg.seccomp_list_drop)
+                        profile_list_augment(&cfg.seccomp_list, config_seccomp_filter_add);
+
+                if (arg_seccomp32 && !cfg.seccomp_list_keep32 && !cfg.seccomp_list_drop32)
+                        profile_list_augment(&cfg.seccomp_list32, config_seccomp_filter_add);
+        }
+
         if (arg_seccomp)
                 arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop);
 
@@ -2850,7 +2987,7 @@ int main(int argc, char **argv, char **envp) {
         // check and assign an IP address - for macvlan it will be done again in the sandbox!
         if (any_bridge_configured()) {
                 EUID_ROOT();
-                lockfd_network = open(RUN_NETWORK_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+                lockfd_network = open(RUN_NETWORK_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
                 if (lockfd_network != -1) {
                         int rv = fchown(lockfd_network, 0, 0);
                         (void) rv;
@@ -2872,12 +3009,6 @@ int main(int argc, char **argv, char **envp) {
         }
         EUID_ASSERT();
 
-        // create the parent-child communication pipe
-        if (pipe(parent_to_child_fds) < 0)
-                errExit("pipe");
-        if (pipe(child_to_parent_fds) < 0)
-                errExit("pipe");
-
         if (arg_noroot && arg_overlay) {
                 fwarning("--overlay and --noroot are mutually exclusive, noroot disabled\n");
                 arg_noroot = 0;
@@ -2890,7 +3021,7 @@ int main(int argc, char **argv, char **envp) {
 
         // set name and x11 run files
         EUID_ROOT();
-        lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT, S_IRUSR | S_IWUSR);
+        lockfd_directory = open(RUN_DIRECTORY_LOCK_FILE, O_WRONLY | O_CREAT | O_CLOEXEC, S_IRUSR | S_IWUSR);
         if (lockfd_directory != -1) {
                 int rv = fchown(lockfd_directory, 0, 0);
                 (void) rv;
@@ -2919,6 +3050,12 @@ int main(int argc, char **argv, char **envp) {
         }
 #endif
 
+        // create the parent-child communication pipe
+        if (pipe2(parent_to_child_fds, O_CLOEXEC) < 0)
+                errExit("pipe");
+        if (pipe2(child_to_parent_fds, O_CLOEXEC) < 0)
+                errExit("pipe");
+
         // clone environment
         int flags = CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWUTS | SIGCHLD;
 
@@ -2975,9 +3112,9 @@ int main(int argc, char **argv, char **envp) {
                         network_main(child);
                         if (arg_debug)
                                 printf("Host network configured\n");
-#ifdef HAVE_GCOV
+
                         __gcov_flush();
-#endif
+
                         _exit(0);
                 }
 
@@ -2987,100 +3124,163 @@ int main(int argc, char **argv, char **envp) {
         }
         EUID_ASSERT();
 
-        // close each end of the unused pipes
-        close(parent_to_child_fds[0]);
-        close(child_to_parent_fds[1]);
+        // close each end of the unused pipes
+        close(parent_to_child_fds[0]);
+        close(child_to_parent_fds[1]);
 
         // notify child that base setup is complete
-        notify_other(parent_to_child_fds[1]);
+        notify_other(parent_to_child_fds[1]);
 
-        // wait for child to create new user namespace with CLONE_NEWUSER
-        wait_for_other(child_to_parent_fds[0]);
-        close(child_to_parent_fds[0]);
+        // wait for child to create new user namespace with CLONE_NEWUSER
+        wait_for_other(child_to_parent_fds[0]);
+        close(child_to_parent_fds[0]);
 
-        if (arg_noroot) {
-                // update the UID and GID maps in the new child user namespace
+        if (arg_noroot) {
+                // update the UID and GID maps in the new child user namespace
                 // uid
-                char *map_path;
-                if (asprintf(&map_path, "/proc/%d/uid_map", child) == -1)
-                        errExit("asprintf");
-
-                char *map;
-                uid_t uid = getuid();
-                if (asprintf(&map, "%d %d 1", uid, uid) == -1)
-                        errExit("asprintf");
-                EUID_ROOT();
-                update_map(map, map_path);
-                EUID_USER();
-                free(map);
-                free(map_path);
-
-                // gid file
+                char *map_path;
+                if (asprintf(&map_path, "/proc/%d/uid_map", child) == -1)
+                        errExit("asprintf");
+
+                char *map;
+                uid_t uid = getuid();
+                if (asprintf(&map, "%d %d 1", uid, uid) == -1)
+                        errExit("asprintf");
+                EUID_ROOT();
+                update_map(map, map_path);
+                EUID_USER();
+                free(map);
+                free(map_path);
+
+                // gid file
                 if (asprintf(&map_path, "/proc/%d/gid_map", child) == -1)
                         errExit("asprintf");
-                char gidmap[1024];
-                char *ptr = gidmap;
-                *ptr = '\0';
-
-                // add user group
-                gid_t gid = getgid();
-                sprintf(ptr, "%d %d 1\n", gid, gid);
-                ptr += strlen(ptr);
-
-                if (!arg_nogroups) {
-                        //  add firejail group
-                        gid_t g = get_group_id("firejail");
-                        if (g) {
-                                sprintf(ptr, "%d %d 1\n", g, g);
-                                ptr += strlen(ptr);
-                        }
-
-                        //  add tty group
-                        g = get_group_id("tty");
-                        if (g) {
-                                sprintf(ptr, "%d %d 1\n", g, g);
-                                ptr += strlen(ptr);
-                        }
-
-                        //  add audio group
-                        g = get_group_id("audio");
-                        if (g) {
-                                sprintf(ptr, "%d %d 1\n", g, g);
-                                ptr += strlen(ptr);
-                        }
-
-                        //  add video group
-                        g = get_group_id("video");
-                        if (g) {
-                                sprintf(ptr, "%d %d 1\n", g, g);
-                                ptr += strlen(ptr);
-                        }
-
-                        //  add games group
-                        g = get_group_id("games");
-                        if (g) {
-                                sprintf(ptr, "%d %d 1\n", g, g);
-                        }
-                 }
-
-                EUID_ROOT();
-                update_map(gidmap, map_path);
-                EUID_USER();
-                free(map_path);
-        }
+                char gidmap[1024];
+                char *ptr = gidmap;
+                *ptr = '\0';
+
+                // add user group
+                gid_t gid = getgid();
+                sprintf(ptr, "%d %d 1\n", gid, gid);
+                ptr += strlen(ptr);
+
+                gid_t g;
+                if (!arg_nogroups || !check_can_drop_all_groups()) {
+                        // add audio group
+                        if (!arg_nosound) {
+                                g = get_group_id("audio");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                        }
+
+                        // add video group
+                        if (!arg_novideo) {
+                                g = get_group_id("video");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                        }
+
+                        // add render/vglusers group
+                        if (!arg_no3d) {
+                                g = get_group_id("render");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                                g = get_group_id("vglusers");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                        }
+
+                        // add lp group
+                        if (!arg_noprinters) {
+                                g = get_group_id("lp");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                        }
+
+                        // add cdrom/optical groups
+                        if (!arg_nodvd) {
+                                g = get_group_id("cdrom");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                                g = get_group_id("optical");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                        }
+
+                        // add input group
+                        if (!arg_noinput) {
+                                g = get_group_id("input");
+                                if (g) {
+                                        sprintf(ptr, "%d %d 1\n", g, g);
+                                        ptr += strlen(ptr);
+                                }
+                        }
+                }
+
+                if (!arg_nogroups) {
+                        // add firejail group
+                        g = get_group_id("firejail");
+                        if (g) {
+                                sprintf(ptr, "%d %d 1\n", g, g);
+                                ptr += strlen(ptr);
+                        }
+
+                        // add tty group
+                        g = get_group_id("tty");
+                        if (g) {
+                                sprintf(ptr, "%d %d 1\n", g, g);
+                                ptr += strlen(ptr);
+                        }
+
+                        // add games group
+                        g = get_group_id("games");
+                        if (g) {
+                                sprintf(ptr, "%d %d 1\n", g, g);
+                        }
+                }
+
+                EUID_ROOT();
+                update_map(gidmap, map_path);
+                EUID_USER();
+                free(map_path);
+        }
         EUID_ASSERT();
 
-        // notify child that UID/GID mapping is complete
-        notify_other(parent_to_child_fds[1]);
-        close(parent_to_child_fds[1]);
+        // notify child that UID/GID mapping is complete
+        notify_other(parent_to_child_fds[1]);
+        close(parent_to_child_fds[1]);
 
-        EUID_ROOT();
+        EUID_ROOT();
         if (lockfd_network != -1) {
                 flock(lockfd_network, LOCK_UN);
                 close(lockfd_network);
         }
         EUID_USER();
 
+        // lock netfilter firewall
+        if (arg_netlock) {
+                char *cmd;
+                if (asprintf(&cmd, "firejail --netlock=%d&", getpid()) == -1)
+                        errExit("asprintf");
+                int rv = system(cmd);
+                (void) rv;
+                free(cmd);
+        }
+
         int status = 0;
         //*****************************
         // following code is signal-safe
@@ -3098,35 +3298,16 @@ int main(int argc, char **argv, char **envp) {
         // end of signal-safe code
         //*****************************
 
-#if 0
-// at this point the sandbox was closed and we are on our way out
-// it would make sense to move this before waitpid above to free some memory
-// crash for now as of issue #3662 from dhcp code
-        // free globals
-        if (cfg.profile) {
-                ProfileEntry *prf = cfg.profile;
-                while (prf != NULL) {
-                        ProfileEntry *next = prf->next;
-printf("data #%s#\n", prf->data);
-                        if (prf->data)
-                                free(prf->data);
-printf("link #%s#\n", prf->link);
-                        if (prf->link)
-                                free(prf->link);
-                        free(prf);
-                        prf = next;
-                }
-        }
-#endif
 
 
         if (WIFEXITED(status)){
                 myexit(WEXITSTATUS(status));
         } else if (WIFSIGNALED(status)) {
-                myexit(WTERMSIG(status));
+                // distinguish fatal signals by adding 128
+                myexit(128 + WTERMSIG(status));
         } else {
-                myexit(0);
+                myexit(1);
         }
 
-        return 0;
+        return 1;
 }
diff --git a/src/firejail/mountinfo.c b/src/firejail/mountinfo.c
index a700729d3..56c0bda30 100644
--- a/src/firejail/mountinfo.c
+++ b/src/firejail/mountinfo.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -19,10 +19,11 @@
 */
 
 #include "firejail.h"
+#include <errno.h>
 
 #include <fcntl.h>
 #ifndef O_PATH
-# define O_PATH 010000000
+#define O_PATH 010000000
 #endif
 
 #define MAX_BUF 4096
@@ -32,43 +33,38 @@ static MountData mdata;
 
 
 // Convert octal escape sequence to decimal value
-static int read_oct(const char *path) {
-        int dec = 0;
-        int digit, i;
-        // there are always exactly three octal digits
-        for (i = 1; i < 4; i++) {
-                digit = *(path + i);
-                if (digit < '0' || digit > '7') {
-                        fprintf(stderr, "Error: cannot read /proc/self/mountinfo\n");
-                        exit(1);
-                }
-                dec = (dec << 3) + (digit - '0');
-        }
-        return dec;
+static unsigned read_oct(char *s) {
+        assert(s[0] == '\\');
+        s++;
+
+        int i;
+        for (i = 0; i < 3; i++)
+                assert(s[i] >= '0' && s[i] <= '7');
+
+        return ((s[0] - '0') << 6 |
+                (s[1] - '0') << 3 |
+                (s[2] - '0') << 0);
 }
 
 // Restore empty spaces in pathnames extracted from /proc/self/mountinfo
 static void unmangle_path(char *path) {
-        char *p = strchr(path, '\\');
-        if (p && read_oct(p) == ' ') {
-                *p = ' ';
-                int i = 3;
-                do {
-                        p++;
-                        if (*(p + i) == '\\' && read_oct(p + i) == ' ') {
-                                *p = ' ';
-                                i += 3;
-                        }
-                        else
-                                *p = *(p + i);
-                } while (*p);
-        }
+        char *r = strchr(path, '\\');
+        if (!r)
+                return;
+
+        char *w = r;
+        do {
+                while (*r == '\\') {
+                        *w++ = read_oct(r);
+                        r += 4;
+                }
+                *w++ = *r;
+        } while (*r++);
 }
 
 // Parse a line from /proc/self/mountinfo,
 // the function does an exit(1) if anything goes wrong.
 static void parse_line(char *line, MountData *output) {
-        assert(line && output);
         memset(output, 0, sizeof(*output));
         // extract mount id, filesystem name, directory and filesystem types
         // examples:
@@ -86,8 +82,6 @@ static void parse_line(char *line, MountData *output) {
         char *ptr = strtok(line, " ");
         if (!ptr)
                 goto errexit;
-        if (ptr != line)
-                goto errexit;
         output->mountid = atoi(ptr);
         int cnt = 1;
 
@@ -108,10 +102,9 @@ static void parse_line(char *line, MountData *output) {
         ptr = strtok(NULL, " ");
         if (!ptr)
                 goto errexit;
-        output->fstype = ptr++;
+        output->fstype = ptr;
 
-
-        if (output->mountid == 0 ||
+        if (output->mountid < 0 ||
             output->fsname == NULL ||
             output->dir == NULL ||
             output->fstype == NULL)
@@ -151,108 +144,118 @@ MountData *get_last_mount(void) {
         return &mdata;
 }
 
-// Extract the mount id from /proc/self/fdinfo and return it.
-int get_mount_id(const char *path) {
-        assert(path);
+// Returns mount id, or -1 if fd refers to a procfs or sysfs file
+static int get_mount_id_from_handle(int fd) {
+        char *proc;
+        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
+                errExit("asprintf");
+
+        struct file_handle *fh = malloc(sizeof *fh);
+        if (!fh)
+                errExit("malloc");
+        fh->handle_bytes = 0;
+
+        int rv = -1;
+        int tmp;
+        if (name_to_handle_at(-1, proc, fh, &tmp, AT_SYMLINK_FOLLOW) != -1) {
+                fprintf(stderr, "Error: unexpected result from name_to_handle_at\n");
+                exit(1);
+        }
+        if (errno == EOVERFLOW && fh->handle_bytes)
+                rv = tmp;
 
-        int fd = open(path, O_PATH|O_CLOEXEC);
-        if (fd == -1)
-                return -1;
+        free(proc);
+        free(fh);
+        return rv;
+}
 
-        char *fdinfo;
-        if (asprintf(&fdinfo, "/proc/self/fdinfo/%d", fd) == -1)
+// Returns mount id, or -1 on kernels < 3.15
+static int get_mount_id_from_fdinfo(int fd) {
+        char *proc;
+        if (asprintf(&proc, "/proc/self/fdinfo/%d", fd) == -1)
                 errExit("asprintf");
-        FILE *fp = fopen(fdinfo, "re");
-        free(fdinfo);
-        if (!fp)
-                goto errexit;
 
-        // read the file
+        int called_as_root = 0;
+        if (geteuid() == 0)
+                called_as_root = 1;
+
+        if (called_as_root == 0)
+                EUID_ROOT();
+
+        FILE *fp = fopen(proc, "re");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot read proc file\n");
+                exit(1);
+        }
+
+        if (called_as_root == 0)
+                EUID_USER();
+
+        int rv = -1;
         char buf[MAX_BUF];
-        if (fgets(buf, MAX_BUF, fp) == NULL)
-                goto errexit;
-        do {
-                if (strncmp(buf, "mnt_id:", 7) == 0) {
-                        char *ptr = buf + 7;
-                        while (*ptr != '\0' && (*ptr == ' ' || *ptr == '\t')) {
-                                ptr++;
-                        }
-                        if (*ptr == '\0')
-                                goto errexit;
-                        fclose(fp);
-                        close(fd);
-                        return atoi(ptr);
-                }
-        } while (fgets(buf, MAX_BUF, fp));
+        while (fgets(buf, MAX_BUF, fp)) {
+                if (sscanf(buf, "mnt_id: %d", &rv) == 1)
+                                break;
+        }
 
-        // fallback, kernels older than 3.15 don't expose the mount id in this place
+        free(proc);
         fclose(fp);
-        close(fd);
-        return -2;
+        return rv;
+}
 
-errexit:
-        fprintf(stderr, "Error: cannot read proc file\n");
-        exit(1);
+int get_mount_id(int fd) {
+        int rv = get_mount_id_from_handle(fd);
+        if (rv < 0)
+                rv = get_mount_id_from_fdinfo(fd);
+        return rv;
 }
 
 // Check /proc/self/mountinfo if path contains any mounts points.
 // Returns an array that can be iterated over for recursive remounting.
-char **build_mount_array(const int mount_id, const char *path) {
+char **build_mount_array(const int mountid, const char *path) {
         assert(path);
 
-        // open /proc/self/mountinfo
         FILE *fp = fopen("/proc/self/mountinfo", "re");
         if (!fp) {
                 fprintf(stderr, "Error: cannot read /proc/self/mountinfo\n");
                 exit(1);
         }
 
-        // array to be returned
-        size_t cnt = 0;
+        // try to find line with mount id
+        int found = 0;
+        MountData mntp;
+        char line[MAX_BUF];
+        while (fgets(line, MAX_BUF, fp)) {
+                parse_line(line, &mntp);
+                if (mntp.mountid == mountid) {
+                        found = 1;
+                        break;
+                }
+        }
+
+        if (!found) {
+                fclose(fp);
+                return NULL;
+        }
+
+        // allocate array
         size_t size = 32;
         char **rv = malloc(size * sizeof(*rv));
         if (!rv)
                 errExit("malloc");
 
-        // read /proc/self/mountinfo
-        size_t pathlen = strlen(path);
-        char buf[MAX_BUF];
-        MountData mntp;
-        int found = 0;
+        // add directory itself
+        size_t cnt = 0;
+        rv[cnt] = strdup(path);
+        if (rv[cnt] == NULL)
+                errExit("strdup");
 
-        if (fgets(buf, MAX_BUF, fp) == NULL) {
-                fprintf(stderr, "Error: cannot read /proc/self/mountinfo\n");
-                exit(1);
-        }
-        do {
-                parse_line(buf, &mntp);
-                // find mount point with mount id
-                if (!found) {
-                        if (mntp.mountid == mount_id) {
-                                // give up if mount id has been reassigned,
-                                // don't remount blacklisted path
-                                if (strncmp(mntp.dir, path, strlen(mntp.dir)) ||
-                                    strstr(mntp.fsname, "firejail.ro.dir") ||
-                                    strstr(mntp.fsname, "firejail.ro.file"))
-                                            break;
-
-                                rv[cnt] = strdup(path);
-                                if (rv[cnt] == NULL)
-                                        errExit("strdup");
-                                cnt++;
-                                found = 1;
-                                continue;
-                        }
-                        continue;
-                }
-                // from here on add all mount points below path,
-                // don't remount blacklisted paths
-                if (strncmp(mntp.dir, path, pathlen) == 0 &&
-                    mntp.dir[pathlen] == '/' &&
-                    strstr(mntp.fsname, "firejail.ro.dir") == NULL &&
-                    strstr(mntp.fsname, "firejail.ro.file") == NULL) {
-
-                        if (cnt == size) {
+        // and add all following mountpoints contained in this directory
+        size_t pathlen = strlen(path);
+        while (fgets(line, MAX_BUF, fp)) {
+                parse_line(line, &mntp);
+                if (strncmp(mntp.dir, path, pathlen) == 0 && mntp.dir[pathlen] == '/') {
+                        if (++cnt == size) {
                                 size *= 2;
                                 rv = realloc(rv, size * sizeof(*rv));
                                 if (!rv)
@@ -261,18 +264,17 @@ char **build_mount_array(const int mount_id, const char *path) {
                         rv[cnt] = strdup(mntp.dir);
                         if (rv[cnt] == NULL)
                                 errExit("strdup");
-                        cnt++;
                 }
-        } while (fgets(buf, MAX_BUF, fp));
+        }
+        fclose(fp);
 
-        if (cnt == size) {
-                size++;
+        // end of array
+        if (++cnt == size) {
+                ++size;
                 rv = realloc(rv, size * sizeof(*rv));
                 if (!rv)
                         errExit("realloc");
         }
-        rv[cnt] = NULL; // end of the array
-
-        fclose(fp);
+        rv[cnt] = NULL;
         return rv;
 }
diff --git a/src/firejail/netfilter.c b/src/firejail/netfilter.c
index fc79dddec..5b49fe19a 100644
--- a/src/firejail/netfilter.c
+++ b/src/firejail/netfilter.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -24,6 +24,96 @@
 #include <sys/wait.h>
 #include <fcntl.h>
 
+void netfilter_netlock(pid_t pid) {
+        EUID_ASSERT();
+
+        // give the sandbox a chance to start up before entering the network namespace
+        sleep(1);
+        enter_network_namespace(pid);
+
+        char *flog;
+        if (asprintf(&flog, "/run/firejail/network/%d-netlock", getpid()) == -1)
+                errExit("asprintf");
+        FILE *fp = fopen(flog, "w");
+        if (!fp)
+                errExit("fopen");
+        fclose(fp);
+
+        // try to find a X terminal
+        char *terminal = NULL;
+        if (access("/usr/bin/xterm", X_OK) == 0)
+                terminal = "/usr/bin/xterm";
+        else if (access("/usr/bin/lxterminal", X_OK) == 0)
+                terminal = "/usr/bin/lxterminal";
+        else if (access("/usr/bin/xfce4-terminal", X_OK) == 0)
+                terminal = "/usr/bin/xfce4-terminal";
+        else if (access("/usr/bin/konsole", X_OK) == 0)
+                terminal = "/usr/bin/konsole";
+// problem: newer gnome-terminal versions don't support -e command line option???
+// same for mate-terminal
+
+        if (isatty(STDIN_FILENO))
+                terminal = NULL;
+
+        if (terminal) {
+                pid_t p = fork();
+                if (p == -1)
+                        ; // run without terminal logger
+                else if (p == 0) { // child
+                        drop_privs(0);
+
+                        char *cmd;
+                        if (asprintf(&cmd, "%s -e \"%s/firejail/fnettrace --tail --log=%s\"", terminal, LIBDIR, flog) == -1)
+                                errExit("asprintf");
+                        int rv = system(cmd);
+                        (void) rv;
+                        exit(0);
+                }
+        }
+
+        char *cmd;
+        if (asprintf(&cmd, "%s/firejail/fnettrace --netfilter --log=%s", LIBDIR, flog) == -1)
+                errExit("asprintf");
+        free(flog);
+
+        //************************
+        // build command
+        //************************
+        char *arg[4];
+        arg[0] = "/bin/sh";
+        arg[1] = "-c";
+        arg[2] = cmd;
+        arg[3] = NULL;
+        clearenv();
+        sbox_exec_v(SBOX_ROOT | SBOX_CAPS_NETWORK | SBOX_SECCOMP, arg);
+        // it will never get here!!
+}
+
+void netfilter_trace(pid_t pid) {
+        EUID_ASSERT();
+
+        // a pid of 0 means the main system network namespace
+        if (pid)
+                enter_network_namespace(pid);
+
+        char *cmd;
+        if (asprintf(&cmd, "%s/firejail/fnettrace", LIBDIR) == -1)
+                errExit("asprintf");
+
+        //************************
+        // build command
+        //************************
+        char *arg[4];
+        arg[0] = "/bin/sh";
+        arg[1] = "-c";
+        arg[2] = cmd;
+        arg[3] = NULL;
+
+        clearenv();
+        sbox_exec_v(SBOX_ROOT | SBOX_CAPS_NETWORK | SBOX_SECCOMP, arg);
+        // it will never get here!!
+}
+
 void check_netfilter_file(const char *fname) {
         EUID_ASSERT();
 
diff --git a/src/firejail/netns.c b/src/firejail/netns.c
index b5d6fb636..c72c009ae 100644
--- a/src/firejail/netns.c
+++ b/src/firejail/netns.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020-2021 Firejail Authors
+ * Copyright (C) 2020-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firejail/network.c b/src/firejail/network.c
index f7142cefd..e631745fb 100644
--- a/src/firejail/network.c
+++ b/src/firejail/network.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -217,7 +217,7 @@ int net_add_route(uint32_t ip, uint32_t mask, uint32_t gw) {
 
 #define BUFSIZE 1024
 uint32_t network_get_defaultgw(void) {
-        FILE *fp = fopen("/proc/self/net/route", "r");
+        FILE *fp = fopen("/proc/self/net/route", "re");
         if (!fp)
                 errExit("fopen");
 
diff --git a/src/firejail/network_main.c b/src/firejail/network_main.c
index ee3c00872..dd66ecc55 100644
--- a/src/firejail/network_main.c
+++ b/src/firejail/network_main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -292,7 +292,7 @@ void net_dns_print(pid_t pid) {
                         errExit("chdir");
 
                 // access /etc/resolv.conf
-                FILE *fp = fopen("/etc/resolv.conf", "r");
+                FILE *fp = fopen("/etc/resolv.conf", "re");
                 if (!fp) {
                         fprintf(stderr, "Error: cannot access /etc/resolv.conf\n");
                         exit(1);
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c
index 60a82821e..c57d397ef 100644
--- a/src/firejail/no_sandbox.c
+++ b/src/firejail/no_sandbox.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -20,6 +20,7 @@
 #include "firejail.h"
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <errno.h>
 #include <unistd.h>
 #include <grp.h>
 
@@ -47,7 +48,8 @@ int check_namespace_virt(void) {
 
         // check PID 1 container environment variable
         EUID_ROOT();
-        FILE *fp = fopen("/proc/1/environ", "r");
+        FILE *fp = fopen("/proc/1/environ", "re");
+        EUID_USER();
         if (fp) {
                 int c = 0;
                 while (c != EOF) {
@@ -68,7 +70,6 @@ int check_namespace_virt(void) {
                                 // found it
                                 if (is_container(buf + 10)) {
                                         fclose(fp);
-                                        EUID_USER();
                                         return 1;
                                 }
                         }
@@ -78,7 +79,6 @@ int check_namespace_virt(void) {
                 fclose(fp);
         }
 
-        EUID_USER();
         return 0;
 }
 
@@ -105,20 +105,15 @@ int check_kernel_procs(void) {
         // look at the first 10 processes
         // if a kernel process is found, return 1
         for (i = 1; i <= 10; i++) {
-                struct stat s;
                 char *fname;
                 if (asprintf(&fname, "/proc/%d/comm", i) == -1)
                         errExit("asprintf");
-                if (stat(fname, &s) == -1) {
-                        free(fname);
-                        continue;
-                }
 
                 // open file
-                /* coverity[toctou] */
-                FILE *fp = fopen(fname, "r");
+                FILE *fp = fopen(fname, "re");
                 if (!fp) {
-                        fwarning("cannot open %s\n", fname);
+                        if (errno != ENOENT)
+                                fwarning("cannot open %s\n", fname);
                         free(fname);
                         continue;
                 }
@@ -208,7 +203,7 @@ void run_no_sandbox(int argc, char **argv) {
                 // force --shell=none in order to not break firecfg symbolic links
                 arg_shell_none = 1;
 
-                build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index);
+                build_cmdline(&cfg.command_line, &cfg.window_title, argc, argv, prog_index, true);
         }
 
         fwarning("an existing sandbox was detected. "
diff --git a/src/firejail/output.c b/src/firejail/output.c
index 835dff2db..f9df9f3d4 100644
--- a/src/firejail/output.c
+++ b/src/firejail/output.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -50,13 +50,21 @@ void check_output(int argc, char **argv) {
         if (!outindex)
                 return;
 
-
-        // check filename
         drop_privs(0);
         char *outfile = argv[outindex];
         outfile += (enable_stderr)? 16:9;
+
+        // check filename
         invalid_filename(outfile, 0); // no globbing
 
+        // expand user home directory
+        if (outfile[0] == '~') {
+                char *full;
+                if (asprintf(&full, "%s%s", cfg.homedir, outfile + 1) == -1)
+                        errExit("asprintf");
+                outfile = full;
+        }
+
         // do not accept directories, links, and files with ".."
         if (strstr(outfile, "..") || is_link(outfile) || is_dir(outfile)) {
                 fprintf(stderr, "Error: invalid output file. Links, directories and files with \"..\" are not allowed.\n");
diff --git a/src/firejail/paths.c b/src/firejail/paths.c
index b800fa944..6d62c9004 100644
--- a/src/firejail/paths.c
+++ b/src/firejail/paths.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -136,7 +136,7 @@ int program_in_path(const char *program) {
                         // ('x' permission means something different for directories).
                         // exec follows symlinks, so use stat, not lstat.
                         struct stat st;
-                        if (stat(scratch, &st)) {
+                        if (stat_as_user(scratch, &st)) {
                                 perror(scratch);
                                 exit(1);
                         }
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c
index 7f602545d..da50e9a82 100644
--- a/src/firejail/preproc.c
+++ b/src/firejail/preproc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -164,7 +164,7 @@ void preproc_clean_run(void) {
         int max_pids=32769;
         int start_pid = 100;
         // extract real max_pids
-        FILE *fp = fopen("/proc/sys/kernel/pid_max", "r");
+        FILE *fp = fopen("/proc/sys/kernel/pid_max", "re");
         if (fp) {
                 int val;
                 if (fscanf(fp, "%d", &val) == 1) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 2ea32b665..5bc77263a 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,10 +18,12 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include "../include/seccomp.h"
 #include "../include/syscall.h"
 #include <dirent.h>
 #include <sys/stat.h>
+
 extern char *xephyr_screen;
 
 #define MAX_READ 8192                             // line buffer for profile files
@@ -70,6 +72,7 @@ static int profile_find(const char *name, const char *dir, int add_ext) {
 // search and read the profile specified by name from firejail directories
 // return  1 if a profile was found
 int profile_find_firejail(const char *name, int add_ext) {
+#ifndef HAVE_ONLY_SYSCFG_PROFILES
         // look for a profile in ~/.config/firejail directory
         char *usercfgdir;
         if (asprintf(&usercfgdir, "%s/.config/firejail", cfg.homedir) == -1)
@@ -82,6 +85,9 @@ int profile_find_firejail(const char *name, int add_ext) {
                 rv = profile_find(name, SYSCONFDIR, add_ext);
 
         return rv;
+#else
+        return profile_find(name, SYSCONFDIR, add_ext);
+#endif
 }
 
 //***************************************************
@@ -173,6 +179,10 @@ static int check_allow_drm(void) {
         return checkcfg(CFG_BROWSER_ALLOW_DRM) != 0;
 }
 
+static int check_allow_tray(void) {
+        return checkcfg(CFG_ALLOW_TRAY) != 0;
+}
+
 Cond conditionals[] = {
         {"HAS_APPIMAGE", check_appimage},
         {"HAS_NET", check_netoptions},
@@ -182,6 +192,7 @@ Cond conditionals[] = {
         {"HAS_X11", check_x11},
         {"BROWSER_DISABLE_U2F", check_disable_u2f},
         {"BROWSER_ALLOW_DRM", check_allow_drm},
+        {"ALLOW_TRAY", check_allow_tray},
         { NULL, NULL }
 };
 
@@ -283,6 +294,15 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        if (strncmp(ptr, "keep-fd ", 8) == 0) {
+                if (strcmp(ptr + 8, "all") == 0)
+                        arg_keep_fd_all = 1;
+                else {
+                        const char *add = ptr + 8;
+                        profile_list_augment(&cfg.keep_fd, add);
+                }
+                return 0;
+        }
         if (strncmp(ptr, "xephyr-screen ", 14) == 0) {
 #ifdef HAVE_X11
                 if (checkcfg(CFG_X11)) {
@@ -373,6 +393,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #endif
                 return 0;
         }
+        else if (strcmp(ptr, "tab") == 0) {
+                arg_tab = 1;
+                return 0;
+        }
         else if (strcmp(ptr, "private-cwd") == 0) {
                 cfg.cwd = NULL;
                 arg_private_cwd = 1;
@@ -409,13 +433,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         else if (strcmp(ptr, "nogroups") == 0) {
-                // nvidia cards require video group; disable nogroups
-                if (access("/dev/nvidiactl", R_OK) == 0 && arg_no3d == 0) {
-                        fwarning("Warning: NVIDIA card detected, nogroups command disabled\n");
-                        arg_nogroups = 0;
-                }
-                else
-                        arg_nogroups = 1;
+                arg_nogroups = 1;
                 return 0;
         }
         else if (strcmp(ptr, "nosound") == 0) {
@@ -423,7 +441,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
         else if (strcmp(ptr, "noautopulse") == 0) {
-                arg_noautopulse = 1;
+                arg_keep_config_pulse = 1;
                 return 0;
         }
         else if (strcmp(ptr, "notv") == 0) {
@@ -442,6 +460,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_no3d = 1;
                 return 0;
         }
+        else if (strcmp(ptr, "noprinters") == 0) {
+                arg_noprinters = 1;
+                profile_add("blacklist /dev/lp*");
+                profile_add("blacklist /run/cups/cups.sock");
+                return 0;
+        }
         else if (strcmp(ptr, "noinput") == 0) {
                 arg_noinput = 1;
                 return 0;
@@ -628,7 +652,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 #endif
                 return 0;
         }
-        else if (strncmp(ptr, "netns  ", 6) == 0) {
+        else if (strncmp(ptr, "netns ", 6) == 0) {
 #ifdef HAVE_NETWORK
                 if (checkcfg(CFG_NETWORK)) {
                         arg_netns = ptr + 6;
@@ -979,10 +1003,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         warning_feature_disabled("seccomp");
                 return 0;
         }
-        if (strncmp(ptr, "seccomp.32.drop ", 13) == 0) {
+        if (strncmp(ptr, "seccomp.32.drop ", 16) == 0) {
                 if (checkcfg(CFG_SECCOMP)) {
                         arg_seccomp32 = 1;
-                        cfg.seccomp_list_drop32 = seccomp_check_list(ptr + 13);
+                        cfg.seccomp_list_drop32 = seccomp_check_list(ptr + 16);
                 }
                 else
                         warning_feature_disabled("seccomp");
@@ -999,10 +1023,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         warning_feature_disabled("seccomp");
                 return 0;
         }
-        if (strncmp(ptr, "seccomp.32.keep ", 13) == 0) {
+        if (strncmp(ptr, "seccomp.32.keep ", 16) == 0) {
                 if (checkcfg(CFG_SECCOMP)) {
                         arg_seccomp32 = 1;
-                        cfg.seccomp_list_keep32 = seccomp_check_list(ptr + 13);
+                        cfg.seccomp_list_keep32 = seccomp_check_list(ptr + 16);
                 }
                 else
                         warning_feature_disabled("seccomp");
@@ -1099,7 +1123,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 else if (cfg.dns4 == NULL)
                         cfg.dns4 = dns;
                 else {
-                        fwarning("Warning: up to 4 DNS servers can be specified, %s ignored\n", dns);
+                        fwarning("up to 4 DNS servers can be specified, %s ignored\n", dns);
                         free(dns);
                 }
                 return 0;
@@ -1122,8 +1146,14 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // cgroup
         if (strncmp(ptr, "cgroup ", 7) == 0) {
-                if (checkcfg(CFG_CGROUP))
-                        set_cgroup(ptr + 7);
+                if (checkcfg(CFG_CGROUP)) {
+                        cfg.cgroup = strdup(ptr + 7);
+                        if (!cfg.cgroup)
+                                errExit("strdup");
+
+                        check_cgroup_file(cfg.cgroup);
+                        set_cgroup(cfg.cgroup, getpid());
+                }
                 else
                         warning_feature_disabled("cgroup");
                 return 0;
@@ -1143,6 +1173,12 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 arg_machineid = 1;
                 return 0;
         }
+
+        if (strcmp(ptr, "keep-config-pulse") == 0) {
+                arg_keep_config_pulse = 1;
+                return 0;
+        }
+
         // writable-var
         if (strcmp(ptr, "writable-var") == 0) {
                 arg_writable_var = 1;
@@ -1269,56 +1305,69 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
 
         // private /etc list of files and directories
         if (strncmp(ptr, "private-etc ", 12) == 0) {
-                if (arg_writable_etc) {
-                        fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
-                        exit(1);
-                }
-                if (cfg.etc_private_keep) {
-                        if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, ptr + 12) < 0 )
-                                errExit("asprintf");
-                } else {
-                        cfg.etc_private_keep = ptr + 12;
+                if (checkcfg(CFG_PRIVATE_ETC)) {
+                        if (arg_writable_etc) {
+                                fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
+                                exit(1);
+                        }
+                        if (cfg.etc_private_keep) {
+                                if ( asprintf(&cfg.etc_private_keep, "%s,%s", cfg.etc_private_keep, ptr + 12) < 0 )
+                                        errExit("asprintf");
+                        } else {
+                                cfg.etc_private_keep = ptr + 12;
+                        }
+                        arg_private_etc = 1;
                 }
-                arg_private_etc = 1;
-
+                else
+                        warning_feature_disabled("private-etc");
                 return 0;
         }
 
         // private /opt list of files and directories
         if (strncmp(ptr, "private-opt ", 12) == 0) {
-                if (cfg.opt_private_keep) {
-                        if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, ptr + 12) < 0 )
-                                errExit("asprintf");
-                } else {
-                        cfg.opt_private_keep = ptr + 12;
+                if (checkcfg(CFG_PRIVATE_OPT)) {
+                        if (cfg.opt_private_keep) {
+                                if ( asprintf(&cfg.opt_private_keep, "%s,%s", cfg.opt_private_keep, ptr + 12) < 0 )
+                                        errExit("asprintf");
+                        } else {
+                                cfg.opt_private_keep = ptr + 12;
+                        }
+                        arg_private_opt = 1;
                 }
-                arg_private_opt = 1;
-
+                else
+                        warning_feature_disabled("private-opt");
                 return 0;
         }
 
         // private /srv list of files and directories
         if (strncmp(ptr, "private-srv ", 12) == 0) {
-                if (cfg.srv_private_keep) {
-                        if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, ptr + 12) < 0 )
-                                errExit("asprintf");
-                } else {
-                        cfg.srv_private_keep = ptr + 12;
+                if (checkcfg(CFG_PRIVATE_SRV)) {
+                        if (cfg.srv_private_keep) {
+                                if ( asprintf(&cfg.srv_private_keep, "%s,%s", cfg.srv_private_keep, ptr + 12) < 0 )
+                                        errExit("asprintf");
+                        } else {
+                                cfg.srv_private_keep = ptr + 12;
+                        }
+                        arg_private_srv = 1;
                 }
-                arg_private_srv = 1;
-
+                else
+                        warning_feature_disabled("private-srv");
                 return 0;
         }
 
         // private /bin list of files
         if (strncmp(ptr, "private-bin ", 12) == 0) {
-                if (cfg.bin_private_keep) {
-                        if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, ptr + 12) < 0 )
-                                errExit("asprintf");
-                } else {
-                        cfg.bin_private_keep = ptr + 12;
+                if (checkcfg(CFG_PRIVATE_BIN)) {
+                        if (cfg.bin_private_keep) {
+                                if ( asprintf(&cfg.bin_private_keep, "%s,%s", cfg.bin_private_keep, ptr + 12) < 0 )
+                                        errExit("asprintf");
+                        } else {
+                                cfg.bin_private_keep = ptr + 12;
+                        }
+                        arg_private_bin = 1;
                 }
-                arg_private_bin = 1;
+                else
+                        warning_feature_disabled("private-bin");
                 return 0;
         }
 
@@ -1486,8 +1535,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         arg_rlimit_nproc = 1;
                 }
                 else if (strncmp(ptr, "rlimit-fsize ", 13) == 0) {
-                        check_unsigned(ptr + 13, "Error: invalid rlimit in profile file: ");
-                        sscanf(ptr + 13, "%llu", &cfg.rlimit_fsize);
+                        cfg.rlimit_fsize = parse_arg_size(ptr + 13);
+                        if (cfg.rlimit_fsize == 0) {
+                                perror("Error: invalid rlimit-fsize in profile file. Only use positive numbers and k, m or g suffix.");
+                                exit(1);
+                        }
                         arg_rlimit_fsize = 1;
                 }
                 else if (strncmp(ptr, "rlimit-sigpending ", 18) == 0) {
@@ -1496,8 +1548,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                         arg_rlimit_sigpending = 1;
                 }
                 else if (strncmp(ptr, "rlimit-as ", 10) == 0) {
-                        check_unsigned(ptr + 10, "Error: invalid rlimit in profile file: ");
-                        sscanf(ptr + 10, "%llu", &cfg.rlimit_as);
+                        cfg.rlimit_as = parse_arg_size(ptr + 10);
+                        if (cfg.rlimit_as == 0) {
+                                perror("Error: invalid rlimit-as in profile file. Only use positive numbers and k, m or g suffix.");
+                                exit(1);
+                        }
                         arg_rlimit_as = 1;
                 }
                 else {
@@ -1554,6 +1609,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        if (strcmp(ptr, "deterministic-shutdown") == 0) {
+                arg_deterministic_shutdown = 1;
+                return 0;
+        }
+
         // rest of filesystem
         if (strncmp(ptr, "blacklist ", 10) == 0)
                 ptr += 10;
@@ -1562,22 +1622,8 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         else if (strncmp(ptr, "noblacklist ", 12) == 0)
                 ptr += 12;
         else if (strncmp(ptr, "whitelist ", 10) == 0) {
-#ifdef HAVE_WHITELIST
-                if (checkcfg(CFG_WHITELIST)) {
-                        arg_whitelist = 1;
-                        ptr += 10;
-                }
-                else {
-                        static int whitelist_warning_printed = 0;
-                        if (!whitelist_warning_printed) {
-                                warning_feature_disabled("whitelist");
-                                whitelist_warning_printed = 1;
-                        }
-                        return 0;
-                }
-#else
-                return 0;
-#endif
+                arg_whitelist = 1;
+                ptr += 10;
         }
         else if (strncmp(ptr, "nowhitelist ", 12) == 0)
                 ptr += 12;
@@ -1691,7 +1737,7 @@ void profile_read(const char *fname) {
         }
 
         // open profile file:
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (fp == NULL) {
                 fprintf(stderr, "Error: cannot open profile file %s\n", fname);
                 exit(1);
@@ -1708,13 +1754,29 @@ void profile_read(const char *fname) {
         int lineno = 0;
         while (fgets(buf, MAX_READ, fp)) {
                 ++lineno;
+
+                // remove comments
+                char *ptr = strchr(buf, '#');
+                if (ptr)
+                        *ptr = '\0';
+
                 // remove empty space - ptr in allocated memory
-                char *ptr = line_remove_spaces(buf);
+                ptr = line_remove_spaces(buf);
                 if (ptr == NULL)
                         continue;
+                if (*ptr == '\0') {
+                        free(ptr);
+                        continue;
+                }
 
-                // comments
-                if (*ptr == '#' || *ptr == '\0') {
+                if (strncmp(ptr, "whitelist-ro ", 13) == 0) {
+                        char *whitelist, *readonly;
+                        if (asprintf(&whitelist, "whitelist %s", ptr + 13) == -1)
+                                errExit("asprintf");
+                        profile_add(whitelist);
+                        if (asprintf(&readonly, "read-only %s", ptr + 13) == -1)
+                                errExit("asprintf");
+                        profile_add(readonly);
                         free(ptr);
                         continue;
                 }
@@ -1724,7 +1786,7 @@ void profile_read(const char *fname) {
                 if (strcmp(ptr, "quiet") == 0) {
                         if (is_in_ignore_list(ptr))
                                 arg_quiet = 0;
-                        else
+                        else if (!arg_debug)
                                 arg_quiet = 1;
                         free(ptr);
                         continue;
@@ -1771,9 +1833,8 @@ void profile_read(const char *fname) {
 //              else {
 //                      free(ptr);
 //              }
-#ifdef HAVE_GCOV
+
                 __gcov_flush();
-#endif
         }
         fclose(fp);
 }
@@ -1884,7 +1945,7 @@ char *profile_list_compress(char *list)
                         /* Include non-empty item */
                         if (!*item)
                                 in[i] = 0;
-                        /* Remove all allready included items */
+                        /* Remove all already included items */
                         for (k = 0; k < i; ++k)
                                 in[k] = 0;
                         break;
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c
index 926af7967..37e541f50 100644
--- a/src/firejail/protocol.c
+++ b/src/firejail/protocol.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -23,7 +23,7 @@
 
 void protocol_filter_save(void) {
         // save protocol filter configuration in PROTOCOL_CFG
-        FILE *fp = fopen(RUN_PROTOCOL_CFG, "w");
+        FILE *fp = fopen(RUN_PROTOCOL_CFG, "wxe");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s\n", cfg.protocol);
@@ -35,7 +35,7 @@ void protocol_filter_load(const char *fname) {
         assert(fname);
 
         // read protocol filter configuration from PROTOCOL_CFG
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         if (!fp)
                 return;
 
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c
index 4b9203c36..320668bf9 100644
--- a/src/firejail/pulseaudio.c
+++ b/src/firejail/pulseaudio.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -25,6 +25,7 @@
 #include <dirent.h>
 #include <errno.h>
 #include <sys/wait.h>
+#include <glob.h>
 
 #include <fcntl.h>
 #ifndef O_PATH
@@ -33,6 +34,59 @@
 
 #define PULSE_CLIENT_SYSCONF "/etc/pulse/client.conf"
 
+
+
+static void disable_rundir_pipewire(const char *path) {
+        assert(path);
+
+        // globbing for path/pipewire-*
+        char *pattern;
+        if (asprintf(&pattern, "%s/pipewire-*", path) == -1)
+                errExit("asprintf");
+
+        glob_t globbuf;
+        int globerr = glob(pattern, GLOB_NOCHECK | GLOB_NOSORT, NULL, &globbuf);
+        if (globerr) {
+                fprintf(stderr, "Error: failed to glob pattern %s\n", pattern);
+                exit(1);
+        }
+
+        size_t i;
+        for (i = 0; i < globbuf.gl_pathc; i++) {
+                char *dir = globbuf.gl_pathv[i];
+                assert(dir);
+
+                // don't disable symlinks - disable_file_or_dir will bind-mount an empty directory on top of it!
+                if (is_link(dir))
+                        continue;
+                disable_file_or_dir(dir);
+        }
+        globfree(&globbuf);
+        free(pattern);
+}
+
+
+
+// disable pipewire socket
+void pipewire_disable(void) {
+        if (arg_debug)
+                printf("disable pipewire\n");
+        // blacklist user config directory
+        disable_file_path(cfg.homedir, ".config/pipewire");
+
+        // blacklist pipewire in XDG_RUNTIME_DIR
+        const char *name = env_get("XDG_RUNTIME_DIR");
+        if (name)
+                disable_rundir_pipewire(name);
+
+        // try the default location anyway
+        char *path;
+        if (asprintf(&path, "/run/user/%d", getuid()) == -1)
+                errExit("asprintf");
+        disable_rundir_pipewire(path);
+        free(path);
+}
+
 // disable pulseaudio socket
 void pulseaudio_disable(void) {
         if (arg_debug)
@@ -75,38 +129,41 @@ void pulseaudio_disable(void) {
         closedir(dir);
 }
 
-static void pulseaudio_fallback(const char *path) {
-        assert(path);
-
-        fmessage("Cannot mount tmpfs on %s/.config/pulse\n", cfg.homedir);
-        env_store_name_val("PULSE_CLIENTCONFIG", path, SETENV);
-}
-
 // disable shm in pulseaudio (issue #69)
 void pulseaudio_init(void) {
-        struct stat s;
-
         // do we have pulseaudio in the system?
-        if (stat(PULSE_CLIENT_SYSCONF, &s) == -1) {
+        if (access(PULSE_CLIENT_SYSCONF, R_OK)) {
                 if (arg_debug)
-                        printf("%s not found\n", PULSE_CLIENT_SYSCONF);
+                        printf("Cannot read %s\n", PULSE_CLIENT_SYSCONF);
                 return;
         }
 
+        // create ~/.config/pulse directory if not present
+        char *homeusercfg = NULL;
+        if (asprintf(&homeusercfg, "%s/.config", cfg.homedir) == -1)
+                errExit("asprintf");
+        if (create_empty_dir_as_user(homeusercfg, 0700))
+                fs_logger2("create", homeusercfg);
+
+        free(homeusercfg);
+        if (asprintf(&homeusercfg, "%s/.config/pulse", cfg.homedir) == -1)
+                errExit("asprintf");
+        if (create_empty_dir_as_user(homeusercfg, 0700))
+                fs_logger2("create", homeusercfg);
+
         // create the new user pulseaudio directory
+        // that will be mounted over ~/.config/pulse
         if (mkdir(RUN_PULSE_DIR, 0700) == -1)
                 errExit("mkdir");
-        selinux_relabel_path(RUN_PULSE_DIR, RUN_PULSE_DIR);
-        // mount it nosuid, noexec, nodev
+        selinux_relabel_path(RUN_PULSE_DIR, homeusercfg);
         fs_remount(RUN_PULSE_DIR, MOUNT_NOEXEC, 0);
-
         // create the new client.conf file
         char *pulsecfg = NULL;
         if (asprintf(&pulsecfg, "%s/client.conf", RUN_PULSE_DIR) == -1)
                 errExit("asprintf");
         if (copy_file(PULSE_CLIENT_SYSCONF, pulsecfg, -1, -1, 0644)) // root needed
                 errExit("copy_file");
-        FILE *fp = fopen(pulsecfg, "a");
+        FILE *fp = fopen(pulsecfg, "ae");
         if (!fp)
                 errExit("fopen");
         fprintf(fp, "%s", "\nenable-shm = no\n");
@@ -116,37 +173,14 @@ void pulseaudio_init(void) {
         if (set_perms(RUN_PULSE_DIR, getuid(), getgid(), 0700))
                 errExit("set_perms");
 
-        // create ~/.config/pulse directory if not present
-        char *homeusercfg = NULL;
-        if (asprintf(&homeusercfg, "%s/.config", cfg.homedir) == -1)
-                errExit("asprintf");
-        if (create_empty_dir_as_user(homeusercfg, 0700))
-                fs_logger2("create", homeusercfg);
-
-        free(homeusercfg);
-        if (asprintf(&homeusercfg, "%s/.config/pulse", cfg.homedir) == -1)
-                errExit("asprintf");
-        if (create_empty_dir_as_user(homeusercfg, 0700))
-                fs_logger2("create", homeusercfg);
-
         // if ~/.config/pulse exists and there are no symbolic links, mount the new directory
         // else set environment variable
-        int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        EUID_USER();
+        int fd = safer_openat(-1, homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        EUID_ROOT();
         if (fd == -1) {
-                pulseaudio_fallback(pulsecfg);
-                goto out;
-        }
-        // confirm the actual mount destination is owned by the user
-        if (fstat(fd, &s) == -1) { // FUSE
-                if (errno != EACCES)
-                        errExit("fstat");
-                close(fd);
-                pulseaudio_fallback(pulsecfg);
-                goto out;
-        }
-        if (s.st_uid != getuid()) {
-                close(fd);
-                pulseaudio_fallback(pulsecfg);
+                fwarning("not mounting tmpfs on %s\n", homeusercfg);
+                env_store_name_val("PULSE_CLIENTCONFIG", pulsecfg, SETENV);
                 goto out;
         }
         // preserve a read-only mount
@@ -158,17 +192,13 @@ void pulseaudio_init(void) {
         // mount via the link in /proc/self/fd
         if (arg_debug)
                 printf("Mounting %s on %s\n", RUN_PULSE_DIR, homeusercfg);
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(RUN_PULSE_DIR, proc, "none", MS_BIND, NULL) < 0)
+        if (bind_mount_path_to_fd(RUN_PULSE_DIR, fd))
                 errExit("mount pulseaudio");
         // check /proc/self/mountinfo to confirm the mount is ok
         MountData *mptr = get_last_mount();
         if (strcmp(mptr->dir, homeusercfg) != 0 || strcmp(mptr->fstype, "tmpfs") != 0)
                 errLogExit("invalid pulseaudio mount");
         fs_logger2("tmpfs", homeusercfg);
-        free(proc);
         close(fd);
 
         char *p;
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c
index a0ca4c02c..447d7b663 100644
--- a/src/firejail/restrict_users.c
+++ b/src/firejail/restrict_users.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -21,7 +21,6 @@
 #include "../include/firejail_user.h"
 #include <sys/mount.h>
 #include <sys/stat.h>
-#include <linux/limits.h>
 #include <fnmatch.h>
 #include <glob.h>
 #include <dirent.h>
@@ -73,7 +72,7 @@ static void sanitize_home(void) {
         if (arg_debug)
                 printf("Cleaning /home directory\n");
         // open user home directory in order to keep it around
-        int fd = safe_fd(cfg.homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        int fd = safer_openat(-1, cfg.homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
         if (fd == -1)
                 goto errout;
         if (fstat(fd, &s) == -1) { // FUSE
@@ -104,12 +103,8 @@ static void sanitize_home(void) {
         selinux_relabel_path(cfg.homedir, cfg.homedir);
 
         // bring back real user home directory
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(proc, cfg.homedir, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_fd_to_path(fd, cfg.homedir))
                 errExit("mount bind");
-        free(proc);
         close(fd);
 
         if (!arg_private)
@@ -154,12 +149,8 @@ static void sanitize_run(void) {
         selinux_relabel_path(runuser, runuser);
 
         // bring back real run/user/$UID directory
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(proc, runuser, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_fd_to_path(fd, runuser))
                 errExit("mount bind");
-        free(proc);
         close(fd);
 
         fs_logger2("whitelist", runuser);
@@ -183,10 +174,10 @@ static void sanitize_passwd(void) {
 
         // open files
         /* coverity[toctou] */
-        fpin = fopen("/etc/passwd", "r");
+        fpin = fopen("/etc/passwd", "re");
         if (!fpin)
                 goto errout;
-        fpout = fopen(RUN_PASSWD_FILE, "w");
+        fpout = fopen(RUN_PASSWD_FILE, "we");
         if (!fpout)
                 goto errout;
 
@@ -246,6 +237,11 @@ static void sanitize_passwd(void) {
         // mount-bind tne new password file
         if (mount(RUN_PASSWD_FILE, "/etc/passwd", "none", MS_BIND, "mode=400,gid=0") < 0)
                 errExit("mount");
+
+        // blacklist RUN_PASSWD_FILE
+        if (mount(RUN_RO_FILE, RUN_PASSWD_FILE, "none", MS_BIND, "mode=400,gid=0") < 0)
+                errExit("mount");
+
         fs_logger("create /etc/passwd");
 
         return;
@@ -318,10 +314,10 @@ static void sanitize_group(void) {
 
         // open files
         /* coverity[toctou] */
-        fpin = fopen("/etc/group", "r");
+        fpin = fopen("/etc/group", "re");
         if (!fpin)
                 goto errout;
-        fpout = fopen(RUN_GROUP_FILE, "w");
+        fpout = fopen(RUN_GROUP_FILE, "we");
         if (!fpout)
                 goto errout;
 
@@ -376,6 +372,11 @@ static void sanitize_group(void) {
         // mount-bind tne new group file
         if (mount(RUN_GROUP_FILE, "/etc/group", "none", MS_BIND, "mode=400,gid=0") < 0)
                 errExit("mount");
+
+        // blacklist RUN_GROUP_FILE
+        if (mount(RUN_RO_FILE, RUN_GROUP_FILE, "none", MS_BIND, "mode=400,gid=0") < 0)
+                errExit("mount");
+
         fs_logger("create /etc/group");
 
         return;
diff --git a/src/firejail/restricted_shell.c b/src/firejail/restricted_shell.c
index ae453f4f1..c1340cae1 100644
--- a/src/firejail/restricted_shell.c
+++ b/src/firejail/restricted_shell.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -32,7 +32,7 @@ int restricted_shell(const char *user) {
         char *fname;
         if (asprintf(&fname, "%s/login.users", SYSCONFDIR) == -1)
                 errExit("asprintf");
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fopen(fname, "re");
         free(fname);
         if (fp == NULL)
                 return 0;
@@ -96,7 +96,7 @@ int restricted_shell(const char *user) {
                                 fullargv[i] = ptr;
 #ifdef DEBUG_RESTRICTED_SHELL
                                 {EUID_ROOT();
-                                FILE *fp = fopen("/firelog", "a");
+                                FILE *fp = fopen("/firelog", "ae");
                                 if (fp) {
                                         fprintf(fp, "i %d ptr #%s#\n", i, fullargv[i]);
                                         fclose(fp);
diff --git a/src/firejail/rlimit.c b/src/firejail/rlimit.c
index 78f00bc63..b10d2c528 100644
--- a/src/firejail/rlimit.c
+++ b/src/firejail/rlimit.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,6 +18,7 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/time.h>
 #include <sys/resource.h>
 
@@ -33,9 +34,9 @@ void set_rlimits(void) {
                 // set the new limit
                 rl.rlim_cur = (rlim_t) cfg.rlimit_cpu;
                 rl.rlim_max = (rlim_t) cfg.rlimit_cpu;
-#ifdef HAVE_GCOV
+
                 __gcov_dump();
-#endif
+
                 if (setrlimit(RLIMIT_CPU, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -50,9 +51,10 @@ void set_rlimits(void) {
                 // set the new limit
                 rl.rlim_cur = (rlim_t) cfg.rlimit_nofile;
                 rl.rlim_max = (rlim_t) cfg.rlimit_nofile;
-#ifdef HAVE_GCOV        // gcov-instrumented programs might crash at this point
+
+                // gcov-instrumented programs might crash at this point
                 __gcov_dump();
-#endif
+
                 if (setrlimit(RLIMIT_NOFILE, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -67,9 +69,9 @@ void set_rlimits(void) {
                 // set the new limit
                 rl.rlim_cur = (rlim_t) cfg.rlimit_nproc;
                 rl.rlim_max = (rlim_t) cfg.rlimit_nproc;
-#ifdef HAVE_GCOV
+
                 __gcov_dump();
-#endif
+
                 if (setrlimit(RLIMIT_NPROC, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -84,9 +86,9 @@ void set_rlimits(void) {
                 // set the new limit
                 rl.rlim_cur = (rlim_t) cfg.rlimit_fsize;
                 rl.rlim_max = (rlim_t) cfg.rlimit_fsize;
-#ifdef HAVE_GCOV
+
                 __gcov_dump();
-#endif
+
                 if (setrlimit(RLIMIT_FSIZE, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -101,9 +103,9 @@ void set_rlimits(void) {
                 // set the new limit
                 rl.rlim_cur = (rlim_t) cfg.rlimit_sigpending;
                 rl.rlim_max = (rlim_t) cfg.rlimit_sigpending;
-#ifdef HAVE_GCOV
+
                 __gcov_dump();
-#endif
+
                 if (setrlimit(RLIMIT_SIGPENDING, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
@@ -118,9 +120,9 @@ void set_rlimits(void) {
                 // set the new limit
                 rl.rlim_cur = (rlim_t) cfg.rlimit_as;
                 rl.rlim_max = (rlim_t) cfg.rlimit_as;
-#ifdef HAVE_GCOV
+
                 __gcov_dump();
-#endif
+
                 if (setrlimit(RLIMIT_AS, &rl) == -1)
                         errExit("setrlimit");
                 if (arg_debug)
diff --git a/src/firejail/run_files.c b/src/firejail/run_files.c
index cd44f745f..c971a4f53 100644
--- a/src/firejail/run_files.c
+++ b/src/firejail/run_files.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -101,7 +101,7 @@ void set_name_run_file(pid_t pid) {
                 errExit("asprintf");
 
         // the file is deleted first
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (!fp) {
                 fprintf(stderr, "Error: cannot create %s\n", fname);
                 exit(1);
@@ -120,7 +120,7 @@ void set_x11_run_file(pid_t pid, int display) {
                 errExit("asprintf");
 
         // the file is deleted first
-        FILE *fp = fopen(fname, "w");
+        FILE *fp = fopen(fname, "we");
         if (!fp) {
                 fprintf(stderr, "Error: cannot create %s\n", fname);
                 exit(1);
@@ -139,7 +139,7 @@ void set_profile_run_file(pid_t pid, const char *fname) {
 
         EUID_ROOT();
         // the file is deleted first
-        FILE *fp = fopen(runfile, "w");
+        FILE *fp = fopen(runfile, "we");
         if (!fp) {
                 fprintf(stderr, "Error: cannot create %s\n", runfile);
                 exit(1);
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c
index 77fac5438..e2847aea6 100644
--- a/src/firejail/run_symlink.c
+++ b/src/firejail/run_symlink.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -22,7 +22,6 @@
 #include <sys/stat.h>
 #include <unistd.h>
 
-extern char *find_in_path(const char *program);
 
 void run_symlink(int argc, char **argv, int run_as_is) {
         EUID_ASSERT();
@@ -77,6 +76,8 @@ void run_symlink(int argc, char **argv, int run_as_is) {
                 a[i + 2] = argv[i + 1];
         }
         a[i + 2] = NULL;
+        if (env_get("LD_PRELOAD") != NULL)
+                fprintf(stderr, "run_symlink: LD_PRELOAD is: '%s'\n", env_get("LD_PRELOAD"));
         assert(env_get("LD_PRELOAD") == NULL);
         assert(getenv("LD_PRELOAD") == NULL);
         execvp(a[0], a);
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 3af828ede..96407d081 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -19,6 +19,7 @@
 */
 
 #include "firejail.h"
+#include "../include/gcov_wrapper.h"
 #include "../include/seccomp.h"
 #include <sys/mman.h>
 #include <sys/mount.h>
@@ -49,7 +50,6 @@
 #include <sys/apparmor.h>
 #endif
 
-
 static int force_nonewprivs = 0;
 
 static int monitored_pid = 0;
@@ -67,7 +67,7 @@ static void sandbox_handler(int sig){
                 if (asprintf(&monfile, "/proc/%d/cmdline", monitored_pid) == -1)
                         errExit("asprintf");
                 while (monsec) {
-                        FILE *fp = fopen(monfile, "r");
+                        FILE *fp = fopen(monfile, "re");
                         if (!fp)
                                 break;
 
@@ -87,9 +87,9 @@ static void sandbox_handler(int sig){
 
         // broadcast a SIGKILL
         kill(-1, SIGKILL);
-        flush_stdin();
 
-        exit(sig);
+        flush_stdin();
+        exit(128 + sig);
 }
 
 static void install_handler(void) {
@@ -162,7 +162,7 @@ static void save_nogroups(void) {
         if (arg_nogroups == 0)
                 return;
 
-        FILE *fp = fopen(RUN_GROUPS_CFG, "w");
+        FILE *fp = fopen(RUN_GROUPS_CFG, "wxe");
         if (fp) {
                 fprintf(fp, "\n");
                 SET_PERMS_STREAM(fp, 0, 0, 0644); // assume mode 0644
@@ -204,7 +204,7 @@ static void save_umask(void) {
 }
 
 static char *create_join_file(void) {
-        int fd = open(RUN_JOIN_FILE, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH);
+        int fd = open(RUN_JOIN_FILE, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (fd == -1)
                 errExit("open");
         if (ftruncate(fd, 1) == -1)
@@ -227,7 +227,7 @@ static void sandbox_if_up(Bridge *br) {
         if (br->arg_ip_none == 1);      // do nothing
         else if (br->arg_ip_none == 0 && br->macvlan == 0) {
                 if (br->ipsandbox == br->ip) {
-                        fprintf(stderr, "Error: %d.%d.%d.%d is interface %s address.\n", PRINT_IP(br->ipsandbox), br->dev);
+                        fprintf(stderr, "Error: %d.%d.%d.%d is interface %s address, exiting...\n", PRINT_IP(br->ipsandbox), br->dev);
                         exit(1);
                 }
 
@@ -245,13 +245,17 @@ static void sandbox_if_up(Bridge *br) {
                         br->ipsandbox = arp_assign(dev, br); //br->ip, br->mask);
                 else {
                         if (br->ipsandbox == br->ip) {
-                                fprintf(stderr, "Error: %d.%d.%d.%d is interface %s address.\n", PRINT_IP(br->ipsandbox), br->dev);
+                                fprintf(stderr, "Error: %d.%d.%d.%d is interface %s address, exiting...\n", PRINT_IP(br->ipsandbox), br->dev);
+                                exit(1);
+                        }
+                        if (br->ipsandbox == cfg.defaultgw) {
+                                fprintf(stderr, "Error: %d.%d.%d.%d is the default gateway, exiting...\n", PRINT_IP(br->ipsandbox));
                                 exit(1);
                         }
 
                         uint32_t rv = arp_check(dev, br->ipsandbox);
                         if (rv) {
-                                fprintf(stderr, "Error: the address %d.%d.%d.%d is already in use.\n", PRINT_IP(br->ipsandbox));
+                                fprintf(stderr, "Error: the address %d.%d.%d.%d is already in use, exiting...\n", PRINT_IP(br->ipsandbox));
                                 exit(1);
                         }
                 }
@@ -352,6 +356,15 @@ static int monitor_application(pid_t app_pid) {
                 if (arg_debug)
                         printf("Sandbox monitor: waitpid %d retval %d status %d\n", monitored_pid, rv, status);
 
+                if (arg_deterministic_shutdown) {
+                        if (arg_debug)
+                                printf("Sandbox monitor: monitored process died, shut down the sandbox\n");
+                        kill(-1, SIGTERM);
+                        usleep(100000);
+                        kill(-1, SIGKILL);
+                        break;
+                }
+
                 DIR *dir;
                 if (!(dir = opendir("/proc"))) {
                         // sleep 2 seconds and try again
@@ -373,18 +386,6 @@ static int monitor_application(pid_t app_pid) {
                         if ((pid_t) pid == dhclient4_pid || (pid_t) pid == dhclient6_pid)
                                 continue;
 
-                        // todo: make this generic
-                        // Dillo browser leaves a dpid process running, we need to shut it down
-                        int found = 0;
-                        if (strcmp(cfg.command_name, "dillo") == 0) {
-                                char *pidname = pid_proc_comm(pid);
-                                if (pidname && strcmp(pidname, "dpid") == 0)
-                                        found = 1;
-                                free(pidname);
-                        }
-                        if (found)
-                                break;
-
                         monitored_pid = pid;
                         break;
                 }
@@ -403,7 +404,6 @@ static void print_time(void) {
         fmessage("Child process initialized in %.02f ms\n", delta);
 }
 
-
 // check execute permissions for the program
 // this is done typically by the shell
 // we are here because of --shell=none
@@ -460,10 +460,42 @@ static int ok_to_run(const char *program) {
         return 0;
 }
 
+static void close_file_descriptors(void) {
+        if (arg_keep_fd_all)
+                return;
+
+        if (arg_debug)
+                printf("Closing non-standard file descriptors\n");
+
+        if (!cfg.keep_fd) {
+                close_all(NULL, 0);
+                return;
+        }
+
+        size_t sz = 0;
+        int *keep = str_to_int_array(cfg.keep_fd, &sz);
+        if (!keep) {
+                fprintf(stderr, "Error: invalid keep-fd option\n");
+                exit(1);
+        }
+        close_all(keep, sz);
+        free(keep);
+}
+
+
 void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
-        // set environment
-        if (no_sandbox == 0)
+        if (no_sandbox == 0) {
+                close_file_descriptors();
+
+                // set nice and rlimits
+                if (arg_nice)
+                        set_nice(cfg.nice);
+                set_rlimits();
+
                 env_defaults();
+        }
+
+        // set environment
         env_apply_all();
 
         // restore original umask
@@ -500,9 +532,8 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
                         exit(1);
                 }
 
-#ifdef HAVE_GCOV
                 __gcov_dump();
-#endif
+
                 seccomp_install_filters();
 
                 if (set_sandbox_status)
@@ -556,9 +587,8 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
                 if (!arg_command && !arg_quiet)
                         print_time();
 
-#ifdef HAVE_GCOV
                 __gcov_dump();
-#endif
+
                 seccomp_install_filters();
 
                 if (set_sandbox_status)
@@ -796,7 +826,7 @@ int sandbox(void* sandbox_arg) {
 
         // trace pre-install
         if (need_preload)
-                fs_trace_preload();
+                fs_trace_touch_or_store_preload();
 
         // store hosts file
         if (cfg.hosts_file)
@@ -812,8 +842,11 @@ int sandbox(void* sandbox_arg) {
                 //****************************
                 // trace pre-install, this time inside chroot
                 //****************************
-                if (need_preload)
-                        fs_trace_preload();
+                if (need_preload) {
+                        int rv = unlink(RUN_LDPRELOAD_FILE);
+                        (void) rv;
+                        fs_trace_touch_or_store_preload();
+                }
         }
         else
 #endif
@@ -833,6 +866,7 @@ int sandbox(void* sandbox_arg) {
         // private mode
         //****************************
         if (arg_private) {
+                EUID_USER();
                 if (cfg.home_private) { // --private=
                         if (cfg.chrootdir)
                                 fwarning("private=directory feature is disabled in chroot\n");
@@ -851,6 +885,7 @@ int sandbox(void* sandbox_arg) {
                 }
                 else // --private
                         fs_private();
+                EUID_ROOT();
         }
 
         if (arg_private_dev)
@@ -883,16 +918,16 @@ int sandbox(void* sandbox_arg) {
                 else if (arg_overlay)
                         fwarning("private-bin feature is disabled in overlay\n");
                 else {
+                        EUID_USER();
                         // for --x11=xorg we need to add xauth command
                         if (arg_x11_xorg) {
-                                EUID_USER();
                                 char *tmp;
                                 if (asprintf(&tmp, "%s,xauth", cfg.bin_private_keep) == -1)
                                         errExit("asprintf");
                                 cfg.bin_private_keep = tmp;
-                                EUID_ROOT();
                         }
                         fs_private_bin_list();
+                        EUID_ROOT();
                 }
         }
 
@@ -988,7 +1023,7 @@ int sandbox(void* sandbox_arg) {
 
                         // create /etc/ld.so.preload file again
                         if (need_preload)
-                                fs_trace_preload();
+                                fs_trace_touch_preload();
 
                         // openSUSE configuration is split between /etc and /usr/etc
                         // process private-etc a second time
@@ -1000,10 +1035,12 @@ int sandbox(void* sandbox_arg) {
         // apply the profile file
         //****************************
         // apply all whitelist commands ...
+        EUID_USER();
         fs_whitelist();
 
         // ... followed by blacklist commands
         fs_blacklist(); // mkdir and mkfile are processed all over again
+        EUID_ROOT();
 
         //****************************
         // nosound/no3d/notv/novideo and fix for pulseaudio 7.0
@@ -1012,10 +1049,13 @@ int sandbox(void* sandbox_arg) {
                 // disable pulseaudio
                 pulseaudio_disable();
 
+                // disable pipewire
+                pipewire_disable();
+
                 // disable /dev/snd
                 fs_dev_disable_sound();
         }
-        else if (!arg_noautopulse)
+        else if (!arg_keep_config_pulse)
                 pulseaudio_init();
 
         if (arg_no3d)
@@ -1039,7 +1079,7 @@ int sandbox(void* sandbox_arg) {
         //****************************
         // set dns
         //****************************
-        fs_resolvconf();
+        fs_rebuild_etc();
 
         //****************************
         // start dhcp client
@@ -1052,6 +1092,11 @@ int sandbox(void* sandbox_arg) {
         EUID_USER();
         int cwd = 0;
         if (cfg.cwd) {
+                if (is_link(cfg.cwd)) {
+                        fprintf(stderr, "Error: unable to enter private working directory: %s\n", cfg.cwd);
+                        exit(1);
+                }
+
                 if (chdir(cfg.cwd) == 0)
                         cwd = 1;
                 else if (arg_private_cwd) {
@@ -1219,7 +1264,7 @@ int sandbox(void* sandbox_arg) {
         //****************************************
         // drop privileges
         //****************************************
-        drop_privs(arg_nogroups);
+        drop_privs(0);
 
         // kill the sandbox in case the parent died
         prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
@@ -1239,28 +1284,25 @@ int sandbox(void* sandbox_arg) {
 
         if (app_pid == 0) {
 #ifdef HAVE_APPARMOR
-                // add apparmor confinement after the execve
                 set_apparmor();
 #endif
-
-                // set nice and rlimits
-                if (arg_nice)
-                        set_nice(cfg.nice);
-                set_rlimits();
-
                 start_application(0, -1, set_sandbox_status);
         }
 
         munmap(set_sandbox_status, 1);
 
         int status = monitor_application(app_pid);      // monitor application
-        flush_stdin();
 
         if (WIFEXITED(status)) {
                 // if we had a proper exit, return that exit status
-                return WEXITSTATUS(status);
+                status = WEXITSTATUS(status);
+        } else if (WIFSIGNALED(status)) {
+                // distinguish fatal signals by adding 128
+                status = 128 + WTERMSIG(status);
         } else {
-                // something else went wrong!
-                return -1;
+                status = -1;
         }
+
+        flush_stdin();
+        return status;
 }
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c
index f9c41f661..a37943940 100644
--- a/src/firejail/sbox.c
+++ b/src/firejail/sbox.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -23,6 +23,7 @@
 #include <unistd.h>
 #include <net/if.h>
 #include <stdarg.h>
+#include <sys/resource.h>
 #include <sys/wait.h>
 #include "../include/seccomp.h"
 
@@ -72,11 +73,8 @@ static int __attribute__((noreturn)) sbox_do_exec_v(unsigned filtermask, char *
         }
 
         // close all other file descriptors
-        if ((filtermask & SBOX_KEEP_FDS) == 0) {
-                int i;
-                for (i = 3; i < FIREJAIL_MAX_FD; i++)
-                        close(i); // close open files
-        }
+        if ((filtermask & SBOX_KEEP_FDS) == 0)
+                close_all(NULL, 0);
 
         umask(027);
 
@@ -206,6 +204,11 @@ static int __attribute__((noreturn)) sbox_do_exec_v(unsigned filtermask, char *
         if (filtermask & SBOX_USER)
                 drop_privs(1);
         else if (filtermask & SBOX_ROOT) {
+                // https://seclists.org/oss-sec/2021/q4/43
+                struct rlimit tozero = { .rlim_cur = 0, .rlim_max = 0 };
+                if (setrlimit(RLIMIT_CORE, &tozero))
+                        errExit("setrlimit");
+
                 // elevate privileges in order to get grsecurity working
                 if (setreuid(0, 0))
                         errExit("setreuid");
@@ -248,7 +251,9 @@ int sbox_run(unsigned filtermask, int num, ...) {
         va_start(valist, num);
 
         // build argument list
-        char **arg = malloc((num + 1) * sizeof(char *));
+        char **arg = calloc(num + 1, sizeof(char *));
+        if (!arg)
+                errExit("calloc");
         int i;
         for (i = 0; i < num; i++)
                 arg[i] = va_arg(valist, char *);
@@ -263,7 +268,6 @@ int sbox_run(unsigned filtermask, int num, ...) {
 }
 
 int sbox_run_v(unsigned filtermask, char * const arg[]) {
-        EUID_ROOT();
         assert(arg);
 
         if (arg_debug) {
@@ -283,6 +287,7 @@ int sbox_run_v(unsigned filtermask, char * const arg[]) {
         if (child < 0)
                 errExit("fork");
         if (child == 0) {
+                EUID_ROOT();
                 sbox_do_exec_v(filtermask, arg);
         }
 
@@ -290,8 +295,9 @@ int sbox_run_v(unsigned filtermask, char * const arg[]) {
         if (waitpid(child, &status, 0) == -1 ) {
                 errExit("waitpid");
         }
-        if (WIFEXITED(status) && WEXITSTATUS(status) != 0) {
-                fprintf(stderr, "Error: failed to run %s\n", arg[0]);
+        if (WIFSIGNALED(status) ||
+           (WIFEXITED(status) && WEXITSTATUS(status) != 0)) {
+                fprintf(stderr, "Error: failed to run %s, exiting...\n", arg[0]);
                 exit(1);
         }
 
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c
index 785c29517..0cd6ac7ec 100644
--- a/src/firejail/seccomp.c
+++ b/src/firejail/seccomp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -86,7 +86,7 @@ int seccomp_install_filters(void) {
 static void seccomp_save_file_list(const char *fname) {
         assert(fname);
 
-        FILE *fp = fopen(RUN_SECCOMP_LIST, "a+");
+        FILE *fp = fopen(RUN_SECCOMP_LIST, "ae");
         if (!fp)
                 errExit("fopen");
 
@@ -99,7 +99,7 @@ static void seccomp_save_file_list(const char *fname) {
 #define MAXBUF 4096
 static int load_file_list_flag = 0;
 void seccomp_load_file_list(void) {
-        FILE *fp = fopen(RUN_SECCOMP_LIST, "r");
+        FILE *fp = fopen(RUN_SECCOMP_LIST, "re");
         if (!fp)
                 return; // no seccomp configuration whatsoever
 
@@ -122,7 +122,7 @@ int seccomp_load(const char *fname) {
         assert(fname);
 
         // open filter file
-        int fd = open(fname, O_RDONLY);
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
         if (fd == -1)
                 goto errexit;
 
@@ -208,7 +208,8 @@ int seccomp_filter_drop(bool native) {
         //      - seccomp
         if (cfg.seccomp_list_drop == NULL) {
                 // default seccomp if error action is not changed
-                if (cfg.seccomp_list == NULL && arg_seccomp_error_action == DEFAULT_SECCOMP_ERROR_ACTION) {
+                if ((cfg.seccomp_list == NULL || cfg.seccomp_list[0] == '\0')
+                    && arg_seccomp_error_action == DEFAULT_SECCOMP_ERROR_ACTION) {
                         if (arg_seccomp_block_secondary)
                                 seccomp_filter_block_secondary();
                         else {
@@ -261,7 +262,7 @@ int seccomp_filter_drop(bool native) {
                         }
 
                         // build the seccomp filter as a regular user
-                        if (list)
+                        if (list && list[0])
                                 if (arg_allow_debuggers)
                                         rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7,
                                                       PATH_FSECCOMP, command, "drop", filter, postexec_filter, list, "allow-debuggers");
@@ -434,11 +435,11 @@ void seccomp_print_filter(pid_t pid) {
         if (asprintf(&fname, "/proc/%d/root%s", pid, RUN_SECCOMP_LIST) == -1)
                 errExit("asprintf");
 
-        struct stat s;
-        if (stat(fname, &s) == -1)
+        int fd = open(fname, O_RDONLY|O_CLOEXEC);
+        if (fd < 0)
                 goto errexit;
 
-        FILE *fp = fopen(fname, "r");
+        FILE *fp = fdopen(fd, "r");
         if (!fp)
                 goto errexit;
         free(fname);
diff --git a/src/firejail/selinux.c b/src/firejail/selinux.c
index 06189d7f6..0348cef4b 100644
--- a/src/firejail/selinux.c
+++ b/src/firejail/selinux.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2020-2021 Firejail and systemd authors
+ * Copyright (C) 2020-2022 Firejail and systemd authors
  *
  * This file is part of firejail project, from systemd selinux-util.c
  *
@@ -19,10 +19,14 @@
 */
 #if HAVE_SELINUX
 #include "firejail.h"
-
 #include <sys/types.h>
 #include <sys/stat.h>
+#include <errno.h>
+
 #include <fcntl.h>
+#ifndef O_PATH
+#define O_PATH 010000000
+#endif
 
 #include <selinux/context.h>
 #include <selinux/label.h>
@@ -52,8 +56,19 @@ void selinux_relabel_path(const char *path, const char *inside_path)
         if (!label_hnd)
                 errExit("selabel_open");
 
-        /* Open the file as O_PATH, to pin it while we determine and adjust the label */
-        fd = open(path, O_NOFOLLOW|O_CLOEXEC|O_PATH);
+        /* Open the file as O_PATH, to pin it while we determine and adjust the label
+         * Defeat symlink races by not allowing symbolic links */
+        int called_as_root = 0;
+        if (geteuid() == 0)
+                called_as_root = 1;
+        if (called_as_root)
+                EUID_USER();
+
+        fd = safer_openat(-1, path, O_NOFOLLOW|O_CLOEXEC|O_PATH);
+
+        if (called_as_root)
+                EUID_ROOT();
+
         if (fd < 0)
                 return;
         if (fstat(fd, &st) < 0)
@@ -64,8 +79,16 @@ void selinux_relabel_path(const char *path, const char *inside_path)
                 if (arg_debug)
                         printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon);
 
-                setfilecon_raw(procfs_path, fcon);
+                if (!called_as_root)
+                        EUID_ROOT();
+
+                if (setfilecon_raw(procfs_path, fcon) != 0 && arg_debug)
+                        printf("Cannot relabel %s: %s\n", path, strerror(errno));
+
+                if (!called_as_root)
+                        EUID_USER();
         }
+
         freecon(fcon);
  close:
         close(fd);
diff --git a/src/firejail/shutdown.c b/src/firejail/shutdown.c
index 8fb03d0a6..44fdd58ab 100644
--- a/src/firejail/shutdown.c
+++ b/src/firejail/shutdown.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -36,8 +36,10 @@ void shut(pid_t pid) {
                 }
                 free(comm);
         }
-        else
-                errExit("/proc/PID/comm");
+        else {
+                fprintf(stderr, "Error: cannot find process %d\n", pid);
+                exit(1);
+        }
 
         // check privileges for non-root users
         uid_t uid = getuid();
@@ -64,7 +66,7 @@ void shut(pid_t pid) {
                 monsec--;
 
                 EUID_ROOT();
-                FILE *fp = fopen(monfile, "r");
+                FILE *fp = fopen(monfile, "re");
                 EUID_USER();
                 if (!fp) {
                         killdone = 1;
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 397150158..2dd913b5e 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -58,16 +58,18 @@ static char *usage_str =
 #ifdef HAVE_DBUSPROXY
         "    --dbus-log=file - set DBus log file location.\n"
         "    --dbus-system=filter|none - set system DBus access policy.\n"
-        "    --dbus-system.broadcast=rule - allow signals on the system DBus according to rule.\n"
+        "    --dbus-system.broadcast=rule - allow signals on the system DBus according\n"
+        "\tto rule.\n"
         "    --dbus-system.call=rule - allow calls on the system DBus according to rule.\n"
-        "    --dbus-system.log - turn on logging for the system DBus."
+        "    --dbus-system.log - turn on logging for the system DBus.\n"
         "    --dbus-system.own=name - allow ownership of name on the system DBus.\n"
         "    --dbus-system.see=name - allow seeing name on the system DBus.\n"
         "    --dbus-system.talk=name - allow talking to name on the system DBus.\n"
         "    --dbus-user=filter|none - set session DBus access policy.\n"
-        "    --dbus-user.broadcast=rule - allow signals on the session DBus according to rule.\n"
+        "    --dbus-user.broadcast=rule - allow signals on the session DBus according\n"
+        "\tto rule.\n"
         "    --dbus-user.call=rule - allow calls on the session DBus according to rule.\n"
-        "    --dbus-user.log - turn on logging for the user DBus."
+        "    --dbus-user.log - turn on logging for the user DBus.\n"
         "    --dbus-user.own=name - allow ownership of name on the session DBus.\n"
         "    --dbus-user.see=name - allow seeing name on the session DBus.\n"
         "    --dbus-user.talk=name - allow talking to name on the session DBus.\n"
@@ -80,13 +82,12 @@ static char *usage_str =
         "    --debug-protocols - print all recognized protocols.\n"
         "    --debug-syscalls - print all recognized system calls.\n"
         "    --debug-syscalls32 - print all recognized 32 bit system calls.\n"
-#ifdef HAVE_WHITELIST
         "    --debug-whitelists - debug whitelisting.\n"
-#endif
 #ifdef HAVE_NETWORK
         "    --defaultgw=address - configure default gateway.\n"
 #endif
         "    --deterministic-exit-code - always exit with first child's status code.\n"
+        "    --deterministic-shutdown - terminate orphan processes.\n"
         "    --dns=address - set DNS server.\n"
         "    --dns.print=name|pid - print DNS configuration.\n"
         "    --env=name=value - set environment variable.\n"
@@ -97,6 +98,8 @@ static char *usage_str =
         "    --help, -? - this help screen.\n"
         "    --hostname=name - set sandbox hostname.\n"
         "    --hosts-file=file - use file as /etc/hosts.\n"
+        "    --ids-check - verify file system.\n"
+        "    --ids-init - initialize IDS database.\n"
         "    --ignore=command - ignore command in profile files.\n"
 #ifdef HAVE_NETWORK
         "    --interface=name - move interface in sandbox.\n"
@@ -114,7 +117,9 @@ static char *usage_str =
         "    --join-network=name|pid - join the network namespace.\n"
 #endif
         "    --join-or-start=name|pid - join the sandbox or start a new one.\n"
-        "    --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n"
+        "    --keep-config-pulse - disable automatic ~/.config/pulse init.\n"
+        "    --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n"
+        "    --keep-fd - inherit open file descriptors to sandbox.\n"
         "    --keep-var-tmp - /var/tmp directory is untouched.\n"
         "    --list - list all sandboxes.\n"
 #ifdef HAVE_FILE_TRANSFER
@@ -123,7 +128,7 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --mac=xx:xx:xx:xx:xx:xx - set interface MAC address.\n"
 #endif
-        "    --machine-id - preserve /etc/machine-id\n"
+        "    --machine-id - spoof /etc/machine-id with a random id\n"
         "    --memory-deny-write-execute - seccomp filter to block attempts to create\n"
         "\tmemory mappings that are both writable and executable.\n"
         "    --mkdir=dirname - create a directory.\n"
@@ -142,10 +147,12 @@ static char *usage_str =
         "    --netfilter.print=name|pid - print the firewall.\n"
         "    --netfilter6=filename - enable IPv6 firewall.\n"
         "    --netfilter6.print=name|pid - print the IPv6 firewall.\n"
-        "    --netmask=address - define a network mask when dealing with unconfigured"
-        "\tparrent interfaces.\n"
+        "    --netlock - enable the network locking feature\n"
+        "    --netmask=address - define a network mask when dealing with unconfigured\n"
+        "\tparent interfaces.\n"
         "    --netns=name - Run the program in a named, persistent network namespace.\n"
         "    --netstats - monitor network statistics.\n"
+        "    --nettrace - monitor TCP and UDP traffic coming into the sandbox.\n"
 #endif
         "    --nice=value - set nice value.\n"
         "    --no3d - disable 3D hardware acceleration.\n"
@@ -154,7 +161,9 @@ static char *usage_str =
         "    --nodvd - disable DVD and audio CD devices.\n"
         "    --noexec=filename - remount the file or directory noexec nosuid and nodev.\n"
         "    --nogroups - disable supplementary groups.\n"
+        "    --noinput - disable input devices.\n"
         "    --nonewprivs - sets the NO_NEW_PRIVS prctl.\n"
+        "    --noprinters - disable printers.\n"
         "    --noprofile - do not use a security profile.\n"
 #ifdef HAVE_USERNS
         "    --noroot - install a user namespace with only the current user.\n"
@@ -236,6 +245,8 @@ static char *usage_str =
         "    --shell=none - run the program directly without a user shell.\n"
         "    --shell=program - set default user shell.\n"
         "    --shutdown=name|pid - shutdown the sandbox identified by name or PID.\n"
+        "    --tab - enable shell tab completion in sandboxes using private or\n"
+        "\twhitelisted home directories.\n"
         "    --timeout=hh:mm:ss - kill the sandbox automatically after the time\n"
         "\thas elapsed.\n"
         "    --tmpfs=dirname - mount a tmpfs filesystem on directory dirname.\n"
@@ -250,9 +261,7 @@ static char *usage_str =
 #ifdef HAVE_NETWORK
         "    --veth-name=name - use this name for the interface connected to the bridge.\n"
 #endif
-#ifdef HAVE_WHITELIST
         "    --whitelist=filename - whitelist directory or file.\n"
-#endif
         "    --writable-etc - /etc directory is mounted read-write.\n"
         "    --writable-run-user - allow access to /run/user/$UID/systemd and\n"
         "\t/run/user/$UID/gnupg.\n"
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 2ad85acd6..109105630 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -19,8 +19,7 @@
  */
 #define _XOPEN_SOURCE 500
 #include "firejail.h"
-#include <ftw.h>
-#include <sys/stat.h>
+#include "../include/gcov_wrapper.h"
 #include <sys/mount.h>
 #include <syslog.h>
 #include <errno.h>
@@ -46,6 +45,44 @@
 #define EMPTY_STRING ("")
 
 
+long long unsigned parse_arg_size(char *str) {
+        long long unsigned result = 0;
+        int len = strlen(str);
+        sscanf(str, "%llu", &result);
+
+        char suffix = *(str + len - 1);
+        if (!isdigit(suffix) && (suffix == 'k' || suffix == 'm' || suffix == 'g')) {
+                len -= 1;
+        }
+
+        /* checks for is value valid positive number */
+        for (int i = 0; i < len; i++) {
+                if (!isdigit(*(str+i))) {
+                        return 0;
+                }
+        }
+
+        if (isdigit(suffix))
+                return result;
+
+        switch (suffix) {
+        case 'k':
+                result *= 1024;
+                break;
+        case 'm':
+                result *= 1024 * 1024;
+                break;
+        case 'g':
+                result *= 1024 * 1024 * 1024;
+                break;
+        default:
+                result = 0;
+                break;
+        }
+
+        return result;
+}
+
 // send the error to /var/log/auth.log and exit after a small delay
 void errLogExit(char* fmt, ...) {
         va_list args;
@@ -66,6 +103,72 @@ void errLogExit(char* fmt, ...) {
         exit(1);
 }
 
+// Returns whether all supplementary groups can be safely dropped
+int check_can_drop_all_groups() {
+        static int can_drop_all_groups = -1;
+
+        // Avoid needlessly checking (and printing) things twice
+        if (can_drop_all_groups != -1)
+                goto out;
+
+        // nvidia cards require video group; ignore nogroups
+        if (access("/dev/nvidiactl", R_OK) == 0 && arg_no3d == 0) {
+                fwarning("NVIDIA card detected, nogroups command ignored\n");
+                can_drop_all_groups = 0;
+                goto out;
+        }
+
+        /* When we are not sure that the system has working seat-based ACLs
+         * (e.g.: probably yes on (e)udev + (e)logind, probably not on eudev +
+         * seatd), supplementary groups (e.g.: audio and input) might be needed
+         * to avoid breakage (e.g.: audio or gamepads not working).  See #4600
+         * and #4603.
+         */
+        if (access("/run/systemd/seats/", F_OK) != 0) {
+                // TODO: wrc causes this to be printed even with (e)logind (see #4930)
+                //fwarning("logind not detected, nogroups command ignored\n");
+                can_drop_all_groups = 0;
+                goto out;
+        }
+
+        if (arg_debug)
+                fprintf(stderr, "nogroups command not ignored\n");
+        can_drop_all_groups = 1;
+
+out:
+        return can_drop_all_groups;
+}
+
+static int find_group(gid_t group, const gid_t *groups, int ngroups) {
+        int i;
+        for (i = 0; i < ngroups; i++) {
+                if (group == groups[i])
+                        return i;
+        }
+
+        return -1;
+}
+
+// Gets group from "groupname" and adds it to "new_groups" if it exists on
+// "groups".  Always returns the current value of new_ngroups.
+static int copy_group_ifcont(const char *groupname,
+                             const gid_t *groups, int ngroups,
+                             gid_t *new_groups, int *new_ngroups, int new_sz) {
+        if (*new_ngroups >= new_sz) {
+                errno = ERANGE;
+                goto out;
+        }
+
+        gid_t g = get_group_id(groupname);
+        if (g && find_group(g, groups, ngroups) >= 0) {
+                new_groups[*new_ngroups] = g;
+                (*new_ngroups)++;
+        }
+
+out:
+        return *new_ngroups;
+}
+
 static void clean_supplementary_groups(gid_t gid) {
         assert(cfg.username);
         gid_t groups[MAX_GROUPS];
@@ -74,35 +177,60 @@ static void clean_supplementary_groups(gid_t gid) {
         if (rv == -1)
                 goto clean_all;
 
+        if (arg_nogroups && check_can_drop_all_groups())
+                goto clean_all;
+
         // clean supplementary group list
-        // allow only firejail, tty, audio, video, games
         gid_t new_groups[MAX_GROUPS];
         int new_ngroups = 0;
         char *allowed[] = {
                 "firejail",
                 "tty",
-                "audio",
-                "video",
                 "games",
                 NULL
         };
 
         int i = 0;
         while (allowed[i]) {
-                gid_t g = get_group_id(allowed[i]);
-                if (g) {
-                        int j;
-                        for (j = 0; j < ngroups; j++) {
-                                if (g == groups[j]) {
-                                        new_groups[new_ngroups] = g;
-                                        new_ngroups++;
-                                        break;
-                                }
-                        }
-                }
+                copy_group_ifcont(allowed[i], groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
                 i++;
         }
 
+        if (!arg_nosound) {
+                copy_group_ifcont("audio", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
+        if (!arg_novideo) {
+                copy_group_ifcont("video", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
+        if (!arg_no3d) {
+                copy_group_ifcont("render", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+                copy_group_ifcont("vglusers", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
+        if (!arg_noprinters) {
+                copy_group_ifcont("lp", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
+        if (!arg_nodvd) {
+                copy_group_ifcont("cdrom", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+                copy_group_ifcont("optical", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
+        if (!arg_noinput) {
+                copy_group_ifcont("input", groups, ngroups,
+                                  new_groups, &new_ngroups, MAX_GROUPS);
+        }
+
         if (new_ngroups) {
                 rv = setgroups(new_ngroups, new_groups);
                 if (rv)
@@ -128,21 +256,22 @@ clean_all:
 
 
 // drop privileges
-// - for root group or if nogroups is set, supplementary groups are not configured
-void drop_privs(int nogroups) {
+// - for root group or if force_nogroups is set, supplementary groups are not configured
+void drop_privs(int force_nogroups) {
         gid_t gid = getgid();
         if (arg_debug)
-                printf("Drop privileges: pid %d, uid %d, gid %d, nogroups %d\n",  getpid(), getuid(), gid, nogroups);
+                printf("Drop privileges: pid %d, uid %d, gid %d, force_nogroups %d\n",
+                       getpid(), getuid(), gid, force_nogroups);
 
         // configure supplementary groups
         EUID_ROOT();
-        if (gid == 0 || nogroups) {
+        if (gid == 0 || force_nogroups) {
                 if (setgroups(0, NULL) < 0)
                         errExit("setgroups");
                 if (arg_debug)
                         printf("No supplementary groups\n");
         }
-        else if (arg_noroot)
+        else if (arg_noroot || arg_nogroups)
                 clean_supplementary_groups(gid);
 
         // set uid/gid
@@ -298,14 +427,14 @@ int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, m
         assert(destname);
 
         // open source
-        int src = open(srcname, O_RDONLY);
+        int src = open(srcname, O_RDONLY|O_CLOEXEC);
         if (src < 0) {
                 fwarning("cannot open source file %s, file not copied\n", srcname);
                 return -1;
         }
 
         // open destination
-        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (dst < 0) {
                 fwarning("cannot open destination file %s, file not copied\n", destname);
                 close(src);
@@ -325,7 +454,7 @@ int copy_file(const char *srcname, const char *destname, uid_t uid, gid_t gid, m
 }
 
 // return -1 if error, 0 if no error
-void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode) {
+void copy_file_as_user(const char *srcname, const char *destname, mode_t mode) {
         pid_t child = fork();
         if (child < 0)
                 errExit("fork");
@@ -333,13 +462,13 @@ void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid
                 // drop privileges
                 drop_privs(0);
 
-                // copy, set permissions and ownership
-                int rv = copy_file(srcname, destname, uid, gid, mode); // already a regular user
+                // copy, set permissions
+                int rv = copy_file(srcname, destname, -1, -1, mode); // already a regular user
                 if (rv)
                         fwarning("cannot copy %s\n", srcname);
-#ifdef HAVE_GCOV
+
                 __gcov_flush();
-#endif
+
                 _exit(0);
         }
         // wait for the child to finish
@@ -348,7 +477,7 @@ void copy_file_as_user(const char *srcname, const char *destname, uid_t uid, gid
 
 void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_t uid, gid_t gid, mode_t mode) {
         // open destination
-        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
+        int dst = open(destname, O_CREAT|O_WRONLY|O_TRUNC|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
         if (dst < 0) {
                 fwarning("cannot open destination file %s, file not copied\n", destname);
                 return;
@@ -361,7 +490,7 @@ void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_
                 // drop privileges
                 drop_privs(0);
 
-                int src = open(srcname, O_RDONLY);
+                int src = open(srcname, O_RDONLY|O_CLOEXEC);
                 if (src < 0) {
                         fwarning("cannot open source file %s, file not copied\n", srcname);
                 } else {
@@ -371,9 +500,9 @@ void copy_file_from_user_to_root(const char *srcname, const char *destname, uid_
                         close(src);
                 }
                 close(dst);
-#ifdef HAVE_GCOV
+
                 __gcov_flush();
-#endif
+
                 _exit(0);
         }
         // wait for the child to finish
@@ -394,17 +523,17 @@ void touch_file_as_user(const char *fname, mode_t mode) {
                 // drop privileges
                 drop_privs(0);
 
-                FILE *fp = fopen(fname, "wx");
-                if (fp) {
-                        fprintf(fp, "\n");
-                        SET_PERMS_STREAM(fp, -1, -1, mode);
-                        fclose(fp);
+                int fd = open(fname, O_RDONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWUSR);
+                if (fd > -1) {
+                        int err = fchmod(fd, mode);
+                        (void) err;
+                        close(fd);
                 }
                 else
                         fwarning("cannot create %s\n", fname);
-#ifdef HAVE_GCOV
+
                 __gcov_flush();
-#endif
+
                 _exit(0);
         }
         // wait for the child to finish
@@ -421,14 +550,14 @@ int is_dir(const char *fname) {
         int rv;
         struct stat s;
         if (fname[strlen(fname) - 1] == '/')
-                rv = stat(fname, &s);
+                rv = stat_as_user(fname, &s);
         else {
                 char *tmp;
                 if (asprintf(&tmp, "%s/", fname) == -1) {
                         fprintf(stderr, "Error: cannot allocate memory, %s:%d\n", __FILE__, __LINE__);
                         errExit("asprintf");
                 }
-                rv = stat(tmp, &s);
+                rv = stat_as_user(tmp, &s);
                 free(tmp);
         }
 
@@ -447,18 +576,91 @@ int is_link(const char *fname) {
         if (*fname == '\0')
                 return 0;
 
-        char *dup = strdup(fname);
-        if (!dup)
+        // remove trailing '/' if any
+        char *tmp = strdup(fname);
+        if (!tmp)
                 errExit("strdup");
-        trim_trailing_slash_or_dot(dup);
+        trim_trailing_slash_or_dot(tmp);
 
         char c;
-        ssize_t rv = readlink(dup, &c, 1);
+        ssize_t rv = readlink_as_user(tmp, &c, 1);
+        free(tmp);
 
-        free(dup);
         return (rv != -1);
 }
 
+char *realpath_as_user(const char *fname) {
+        assert(fname);
+
+        int called_as_root = 0;
+        if (geteuid() == 0)
+                called_as_root = 1;
+
+        if (called_as_root)
+                EUID_USER();
+
+        char *rv = realpath(fname, NULL);
+
+        if (called_as_root)
+                EUID_ROOT();
+
+        return rv;
+}
+
+ssize_t readlink_as_user(const char *fname, char *buf, size_t sz) {
+        assert(fname && buf && sz);
+
+        int called_as_root = 0;
+        if (geteuid() == 0)
+                called_as_root = 1;
+
+        if (called_as_root)
+                EUID_USER();
+
+        ssize_t rv = readlink(fname, buf, sz);
+
+        if (called_as_root)
+                EUID_ROOT();
+
+        return rv;
+}
+
+int stat_as_user(const char *fname, struct stat *s) {
+        assert(fname);
+
+        int called_as_root = 0;
+        if (geteuid() == 0)
+                called_as_root = 1;
+
+        if (called_as_root)
+                EUID_USER();
+
+        int rv = stat(fname, s);
+
+        if (called_as_root)
+                EUID_ROOT();
+
+        return rv;
+}
+
+int lstat_as_user(const char *fname, struct stat *s) {
+        assert(fname);
+
+        int called_as_root = 0;
+        if (geteuid() == 0)
+                called_as_root = 1;
+
+        if (called_as_root)
+                EUID_USER();
+
+        int rv = lstat(fname, s);
+
+        if (called_as_root)
+                EUID_ROOT();
+
+        return rv;
+}
+
 // remove all slashes and single dots from the end of a path
 // for example /foo/bar///././. -> /foo/bar
 void trim_trailing_slash_or_dot(char *path) {
@@ -544,11 +746,13 @@ char *split_comma(char *str) {
 }
 
 
-// remove consecutive and trailing slashes
-// and return allocated memory
-// e.g. /home//user/ -> /home/user
+// simplify absolute path by removing
+// 1) consecutive and trailing slashes, and
+// 2) segments with a single dot
+// for example /foo//./bar/ -> /foo/bar
 char *clean_pathname(const char *path) {
-        assert(path);
+        assert(path && path[0] == '/');
+
         size_t len = strlen(path);
         char *rv = malloc(len + 1);
         if (!rv)
@@ -557,15 +761,23 @@ char *clean_pathname(const char *path) {
         size_t i = 0;
         size_t j = 0;
         while (path[i]) {
-                while (path[i] == '/' && path[i+1] == '/')
-                        i++;
+                if (path[i] == '/') {
+                        while (path[i+1] == '/' ||
+                              (path[i+1] == '.' && path[i+2] == '/'))
+                                i++;
+                }
+
                 rv[j++] = path[i++];
         }
         rv[j] = '\0';
 
+        // remove a trailing dot
+        if (j > 1 && rv[j - 1] == '.' && rv[j - 2] == '/')
+                rv[--j] = '\0';
+
         // remove a trailing slash
         if (j > 1 && rv[j - 1] == '/')
-                rv[j - 1] = '\0';
+                rv[--j] = '\0';
 
         return rv;
 }
@@ -616,7 +828,7 @@ int find_child(pid_t parent, pid_t *child) {
                         perror("asprintf");
                         exit(1);
                 }
-                FILE *fp = fopen(file, "r");
+                FILE *fp = fopen(file, "re");
                 if (!fp) {
                         free(file);
                         continue;
@@ -637,9 +849,11 @@ int find_child(pid_t parent, pid_t *child) {
                                 if (parent == atoi(ptr)) {
                                         // we don't want /usr/bin/xdg-dbus-proxy!
                                         char *cmdline = pid_proc_cmdline(pid);
-                                        if (strncmp(cmdline, XDG_DBUS_PROXY_PATH, strlen(XDG_DBUS_PROXY_PATH)) != 0)
-                                                *child = pid;
-                                        free(cmdline);
+                                        if (cmdline) {
+                                                if (strncmp(cmdline, XDG_DBUS_PROXY_PATH, strlen(XDG_DBUS_PROXY_PATH)) != 0)
+                                                        *child = pid;
+                                                free(cmdline);
+                                        }
                                 }
                                 break;            // stop reading the file
                         }
@@ -722,7 +936,7 @@ void update_map(char *mapping, char *map_file) {
                 if (mapping[j] == ',')
                         mapping[j] = '\n';
 
-        fd = open(map_file, O_RDWR);
+        fd = open(map_file, O_RDWR|O_CLOEXEC);
         if (fd == -1) {
                 fprintf(stderr, "Error: cannot open %s: %s\n", map_file, strerror(errno));
                 exit(EXIT_FAILURE);
@@ -742,9 +956,9 @@ void wait_for_other(int fd) {
         // wait for the parent to be initialized
         //****************************
         char childstr[BUFLEN + 1];
-        int newfd = dup(fd);
+        int newfd = fcntl(fd, F_DUPFD_CLOEXEC, 0);
         if (newfd == -1)
-                errExit("dup");
+                errExit("fcntl");
         FILE* stream;
         stream = fdopen(newfd, "r");
         *childstr = '\0';
@@ -791,9 +1005,9 @@ void wait_for_other(int fd) {
 
 void notify_other(int fd) {
         FILE* stream;
-        int newfd = dup(fd);
+        int newfd = fcntl(fd, F_DUPFD_CLOEXEC, 0);
         if (newfd == -1)
-                errExit("dup");
+                errExit("fcntl");
         stream = fdopen(newfd, "w");
         fprintf(stream, "arg_noroot=%d\n", arg_noroot);
         fflush(stream);
@@ -811,7 +1025,7 @@ uid_t pid_get_uid(pid_t pid) {
                 exit(1);
         }
         EUID_ROOT();                              // grsecurity fix
-        FILE *fp = fopen(file, "r");
+        FILE *fp = fopen(file, "re");
         if (!fp) {
                 free(file);
                 fprintf(stderr, "Error: cannot open /proc file\n");
@@ -845,12 +1059,9 @@ uid_t pid_get_uid(pid_t pid) {
 }
 
 
-
-
-uid_t get_group_id(const char *group) {
-        // find tty group id
+gid_t get_group_id(const char *groupname) {
         gid_t gid = 0;
-        struct group *g = getgrnam(group);
+        struct group *g = getgrnam(groupname);
         if (g)
                 gid = g->gr_gid;
 
@@ -858,84 +1069,6 @@ uid_t get_group_id(const char *group) {
 }
 
 
-static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) {
-        (void) sb;
-        (void) typeflag;
-        (void) ftwbuf;
-        assert(fpath);
-
-        if (strcmp(fpath, ".") == 0)
-                return 0;
-
-        if (remove(fpath)) {    // removes the link not the actual file
-                perror("remove");
-                fprintf(stderr, "Error: cannot remove file from user .firejail directory: %s\n", fpath);
-                exit(1);
-        }
-
-        return 0;
-}
-
-
-int remove_overlay_directory(void) {
-        EUID_ASSERT();
-        struct stat s;
-        sleep(1);
-
-        char *path;
-        if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1)
-                errExit("asprintf");
-
-        if (lstat(path, &s) == 0) {
-                // deal with obvious problems such as symlinks and root ownership
-                if (!S_ISDIR(s.st_mode)) {
-                        if (S_ISLNK(s.st_mode))
-                                fprintf(stderr, "Error: %s is a symbolic link\n", path);
-                        else
-                                fprintf(stderr, "Error: %s is not a directory\n", path);
-                        exit(1);
-                }
-                if (s.st_uid != getuid()) {
-                        fprintf(stderr, "Error: %s is not owned by the current user\n", path);
-                        exit(1);
-                }
-
-                pid_t child = fork();
-                if (child < 0)
-                        errExit("fork");
-                if (child == 0) {
-                        // open ~/.firejail, fails if there is any symlink
-                        int fd = safe_fd(path, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-                        if (fd == -1)
-                                errExit("safe_fd");
-                        // chdir to ~/.firejail
-                        if (fchdir(fd) == -1)
-                                errExit("fchdir");
-                        close(fd);
-
-                        EUID_ROOT();
-                        // FTW_PHYS - do not follow symbolic links
-                        if (nftw(".", remove_callback, 64, FTW_DEPTH | FTW_PHYS) == -1)
-                                errExit("nftw");
-
-                        EUID_USER();
-                        // remove ~/.firejail
-                        if (rmdir(path) == -1)
-                                errExit("rmdir");
-#ifdef HAVE_GCOV
-                        __gcov_flush();
-#endif
-                        _exit(0);
-                }
-                // wait for the child to finish
-                waitpid(child, NULL, 0);
-                // check if ~/.firejail was deleted
-                if (stat(path, &s) == 0)
-                        return 1;
-        }
-        return 0;
-}
-
 // flush stdin if it is connected to a tty and has input
 void flush_stdin(void) {
         if (!isatty(STDIN_FILENO))
@@ -963,33 +1096,34 @@ void flush_stdin(void) {
 int create_empty_dir_as_user(const char *dir, mode_t mode) {
         assert(dir);
         mode &= 07777;
-        struct stat s;
 
-        if (stat(dir, &s)) {
+        if (access(dir, F_OK) == 0)
+                return 0;
+
+        pid_t child = fork();
+        if (child < 0)
+                errExit("fork");
+        if (child == 0) {
+                // drop privileges
+                drop_privs(0);
+
                 if (arg_debug)
                         printf("Creating empty %s directory\n", dir);
-                pid_t child = fork();
-                if (child < 0)
-                        errExit("fork");
-                if (child == 0) {
-                        // drop privileges
-                        drop_privs(0);
-
-                        if (mkdir(dir, mode) == 0) {
-                                if (chmod(dir, mode) == -1)
-                                        {;} // do nothing
-                        }
-                        else if (arg_debug)
-                                printf("Directory %s not created: %s\n", dir, strerror(errno));
-#ifdef HAVE_GCOV
-                        __gcov_flush();
-#endif
-                        _exit(0);
+                if (mkdir(dir, mode) == 0) {
+                        int err = chmod(dir, mode);
+                        (void) err;
                 }
-                waitpid(child, NULL, 0);
-                if (stat(dir, &s) == 0)
-                        return 1;
+                else if (arg_debug)
+                        printf("Directory %s not created: %s\n", dir, strerror(errno));
+
+                __gcov_flush();
+
+                _exit(0);
         }
+        waitpid(child, NULL, 0);
+
+        if (access(dir, F_OK) == 0)
+                return 1;
         return 0;
 }
 
@@ -1020,9 +1154,10 @@ void create_empty_file_as_root(const char *fname, mode_t mode) {
         if (stat(fname, &s)) {
                 if (arg_debug)
                         printf("Creating empty %s file\n", fname);
-
                 /* coverity[toctou] */
-                FILE *fp = fopen(fname, "w");
+                // don't fail if file already exists. This can be the case in a race
+                // condition, when two jails launch at the same time. Compare to #1013
+                FILE *fp = fopen(fname, "we");
                 if (!fp)
                         errExit("fopen");
                 SET_PERMS_STREAM(fp, 0, 0, mode);
@@ -1097,20 +1232,35 @@ unsigned extract_timeout(const char *str) {
 }
 
 void disable_file_or_dir(const char *fname) {
+        assert(geteuid() == 0);
+        assert(fname);
+
+        EUID_USER();
+        int fd = open(fname, O_PATH|O_CLOEXEC);
+        EUID_ROOT();
+        if (fd < 0)
+                return;
+
         struct stat s;
-        if (stat(fname, &s) != -1) {
-                if (arg_debug)
-                        printf("blacklist %s\n", fname);
-                if (is_dir(fname)) {
-                        if (mount(RUN_RO_DIR, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
-                                errExit("disable directory");
-                }
-                else {
-                        if (mount(RUN_RO_FILE, fname, "none", MS_BIND, "mode=400,gid=0") < 0)
-                                errExit("disable file");
-                }
-                fs_logger2("blacklist", fname);
+        if (fstat(fd, &s) < 0) { // FUSE
+                if (errno != EACCES)
+                        errExit("fstat");
+                close(fd);
+                return;
+        }
+
+        if (arg_debug)
+                printf("blacklist %s\n", fname);
+        if (S_ISDIR(s.st_mode)) {
+                if (bind_mount_path_to_fd(RUN_RO_DIR, fd) < 0)
+                        errExit("disable directory");
         }
+        else {
+                if (bind_mount_path_to_fd(RUN_RO_FILE, fd) < 0)
+                        errExit("disable file");
+        }
+        close(fd);
+        fs_logger2("blacklist", fname);
 }
 
 void disable_file_path(const char *path, const char *file) {
@@ -1126,13 +1276,13 @@ void disable_file_path(const char *path, const char *file) {
 }
 
 // open an existing file without following any symbolic link
-int safe_fd(const char *path, int flags) {
+// relative paths are interpreted relative to dirfd
+// ignore dirfd if path is absolute
+// https://web.archive.org/web/20180419120236/https://blogs.gnome.org/jamesh/2018/04/19/secure-mounts
+int safer_openat(int dirfd, const char *path, int flags) {
+        assert(path && path[0]);
         flags |= O_NOFOLLOW;
-        assert(path);
-        if (*path != '/' || strstr(path, "..")) {
-                fprintf(stderr, "Error: invalid path %s\n", path);
-                exit(1);
-        }
+
         int fd = -1;
 
 #ifdef __NR_openat2 // kernel 5.6 or better
@@ -1140,7 +1290,7 @@ int safe_fd(const char *path, int flags) {
         memset(&oh, 0, sizeof(oh));
         oh.flags = flags;
         oh.resolve = RESOLVE_NO_SYMLINKS;
-        fd = syscall(__NR_openat2, -1, path, &oh, sizeof(struct open_how));
+        fd = syscall(__NR_openat2, dirfd, path, &oh, sizeof(struct open_how));
         if (fd != -1 || errno != ENOSYS)
                 return fd;
 #endif
@@ -1151,18 +1301,23 @@ int safe_fd(const char *path, int flags) {
         if (!dup)
                 errExit("strdup");
         char *tok = strtok(dup, "/");
-        if (!tok) { // root directory
+        if (!tok) { // nothing to do, path is the root directory
                 free(dup);
-                return open("/", flags);
+                return openat(dirfd, path, flags);
         }
         char *last_tok = EMPTY_STRING;
-        int parentfd = open("/", O_PATH|O_CLOEXEC);
+
+        int parentfd;
+        if (path[0] == '/')
+                parentfd = open("/", O_PATH|O_CLOEXEC);
+        else
+                parentfd = fcntl(dirfd, F_DUPFD_CLOEXEC, 0);
         if (parentfd == -1)
-                errExit("open");
+                errExit("open/fcntl");
 
-        while(1) {
+        while (1) {
                 // open path component, assuming it is a directory; this fails with ENOTDIR if it is a symbolic link
-                // if token is a single dot, the previous directory is reopened
+                // if token is a single dot, the directory referred to by parentfd is reopened
                 fd = openat(parentfd, tok, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
                 if (fd == -1) {
                         // if the following token is NULL, the current token is the final path component
@@ -1192,6 +1347,106 @@ int safe_fd(const char *path, int flags) {
         return fd;
 }
 
+int remount_by_fd(int dst, unsigned long mountflags) {
+        char *proc;
+        if (asprintf(&proc, "/proc/self/fd/%d", dst) < 0)
+                errExit("asprintf");
+
+        int rv = mount(NULL, proc, NULL, mountflags|MS_BIND|MS_REMOUNT, NULL);
+        if (rv < 0 && arg_debug)
+                printf("Failed mount: %s\n", strerror(errno));
+
+        free(proc);
+        return rv;
+}
+
+int bind_mount_by_fd(int src, int dst) {
+        char *proc_src, *proc_dst;
+        if (asprintf(&proc_src, "/proc/self/fd/%d", src) < 0 ||
+            asprintf(&proc_dst, "/proc/self/fd/%d", dst) < 0)
+                errExit("asprintf");
+
+        int rv = mount(proc_src, proc_dst, NULL, MS_BIND|MS_REC, NULL);
+        if (rv < 0 && arg_debug)
+                printf("Failed mount: %s\n", strerror(errno));
+
+        free(proc_src);
+        free(proc_dst);
+        return rv;
+}
+
+int bind_mount_fd_to_path(int src, const char *destname) {
+        char *proc;
+        if (asprintf(&proc, "/proc/self/fd/%d", src) < 0)
+                errExit("asprintf");
+
+        int rv = mount(proc, destname, NULL, MS_BIND|MS_REC, NULL);
+        if (rv < 0 && arg_debug)
+                printf("Failed mount: %s\n", strerror(errno));
+
+        free(proc);
+        return rv;
+}
+
+int bind_mount_path_to_fd(const char *srcname, int dst) {
+        char *proc;
+        if (asprintf(&proc, "/proc/self/fd/%d", dst) < 0)
+                errExit("asprintf");
+
+        int rv = mount(srcname, proc, NULL, MS_BIND|MS_REC, NULL);
+        if (rv < 0 && arg_debug)
+                printf("Failed mount: %s\n", strerror(errno));
+
+        free(proc);
+        return rv;
+}
+
+void close_all(int *keep_list, size_t sz) {
+        DIR *dir;
+        if (!(dir = opendir("/proc/self/fd"))) {
+                // sleep 2 seconds and try again
+                sleep(2);
+                if (!(dir = opendir("/proc/self/fd"))) {
+                        fprintf(stderr, "Error: cannot open /proc/self/fd directory\n");
+                        exit(1);
+                }
+        }
+        struct dirent *entry;
+        while ((entry = readdir(dir)) != NULL) {
+                if (strcmp(entry->d_name, ".") == 0 ||
+                    strcmp(entry->d_name, "..") == 0)
+                        continue;
+
+                int fd = atoi(entry->d_name);
+
+                // don't close standard streams
+                if (fd == STDIN_FILENO ||
+                    fd == STDOUT_FILENO ||
+                    fd == STDERR_FILENO)
+                        continue;
+
+                if (fd == dirfd(dir))
+                        continue; // just postponed
+
+                // dont't close file descriptors in keep list
+                int keep = 0;
+                if (keep_list) {
+                        size_t i;
+                        for (i = 0; i < sz; i++) {
+                                if (keep_list[i] == fd) {
+                                        keep = 1;
+                                        break;
+                                }
+                        }
+                }
+                if (keep)
+                        continue;
+
+                close(fd);
+        }
+        closedir(dir);
+}
+
 int has_handler(pid_t pid, int signal) {
         if (signal > 0 && signal <= SIGRTMAX) {
                 char *fname;
@@ -1293,25 +1548,22 @@ pid_t require_pid(const char *name) {
 // return 1 if there is a link somewhere in path of directory
 static int has_link(const char *dir) {
         assert(dir);
-        int fd = safe_fd(dir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
-        if (fd == -1) {
-                if ((errno == ELOOP || errno == ENOTDIR) && is_dir(dir))
-                        return 1;
-        }
-        else
+        int fd = safer_openat(-1, dir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC);
+        if (fd != -1)
                 close(fd);
+        else if (errno == ELOOP || (errno == ENOTDIR && is_dir(dir)))
+                return 1;
         return 0;
 }
 
-void check_homedir(void) {
-        assert(cfg.homedir);
-        if (cfg.homedir[0] != '/') {
-                fprintf(stderr, "Error: invalid user directory \"%s\"\n", cfg.homedir);
+void check_homedir(const char *dir) {
+        assert(dir);
+        if (dir[0] != '/') {
+                fprintf(stderr, "Error: invalid user directory \"%s\"\n", dir);
                 exit(1);
         }
         // symlinks are rejected in many places
-        if (has_link(cfg.homedir)) {
-                fprintf(stderr, "No full support for symbolic links in path of user directory.\n"
+        if (has_link(dir))
+                fmessage("No full support for symbolic links in path of user directory.\n"
                         "Please provide resolved path in password database (/etc/passwd).\n\n");
-        }
 }
diff --git a/src/firejail/x11.c b/src/firejail/x11.c
index 1dabf272e..f173b6672 100644
--- a/src/firejail/x11.c
+++ b/src/firejail/x11.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -84,7 +84,7 @@ int x11_display(void) {
 static int x11_abstract_sockets_present(void) {
 
         EUID_ROOT();                              // grsecurity fix
-        FILE *fp = fopen("/proc/net/unix", "r");
+        FILE *fp = fopen("/proc/net/unix", "re");
         if (!fp)
                 errExit("fopen");
         EUID_USER();
@@ -204,7 +204,6 @@ static int random_display_number(void) {
 void x11_start_xvfb(int argc, char **argv) {
         EUID_ASSERT();
         int i;
-        struct stat s;
         pid_t jail = 0;
         pid_t server = 0;
 
@@ -348,7 +347,7 @@ void x11_start_xvfb(int argc, char **argv) {
         // wait for x11 server to start
         while (++n < 10) {
                 sleep(1);
-                if (stat(fname, &s) == 0)
+                if (access(fname, F_OK) == 0)
                         break;
         };
 
@@ -427,7 +426,6 @@ static char *extract_setting(int argc, char **argv, const char *argument) {
 void x11_start_xephyr(int argc, char **argv) {
         EUID_ASSERT();
         int i;
-        struct stat s;
         pid_t jail = 0;
         pid_t server = 0;
 
@@ -586,7 +584,7 @@ void x11_start_xephyr(int argc, char **argv) {
         // wait for x11 server to start
         while (++n < 10) {
                 sleep(1);
-                if (stat(fname, &s) == 0)
+                if (access(fname, F_OK) == 0)
                         break;
         };
 
@@ -701,7 +699,6 @@ static char * get_title_arg_str() {
 static void __attribute__((noreturn)) x11_start_xpra_old(int argc, char **argv, int display, char *display_str) {
         EUID_ASSERT();
         int i;
-        struct stat s;
         pid_t client = 0;
         pid_t server = 0;
 
@@ -818,7 +815,7 @@ static void __attribute__((noreturn)) x11_start_xpra_old(int argc, char **argv,
         // wait for x11 server to start
         while (++n < 10) {
                 sleep(1);
-                if (stat(fname, &s) == 0)
+                if (access(fname, F_OK) == 0)
                         break;
         }
 
@@ -1207,14 +1204,13 @@ void x11_xorg(void) {
         fmessage("Generating a new .Xauthority file\n");
         mkdir_attr(RUN_XAUTHORITY_SEC_DIR, 0700, getuid(), getgid());
         // create new Xauthority file in RUN_XAUTHORITY_SEC_DIR
+        EUID_USER();
         char tmpfname[] = RUN_XAUTHORITY_SEC_DIR "/.Xauth-XXXXXX";
         int fd = mkstemp(tmpfname);
         if (fd == -1) {
                 fprintf(stderr, "Error: cannot create .Xauthority file\n");
                 exit(1);
         }
-        if (fchown(fd, getuid(), getgid()) == -1)
-                errExit("chown");
         close(fd);
 
         // run xauth
@@ -1224,24 +1220,22 @@ void x11_xorg(void) {
         else
                 sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, RUN_XAUTH_FILE, "-f", tmpfname,
                         "generate", display, "MIT-MAGIC-COOKIE-1", "untrusted");
-        // remove xauth copy
-        unlink(RUN_XAUTH_FILE);
 
         // ensure there is already a file ~/.Xauthority, so that bind-mount below will work.
         char *dest;
         if (asprintf(&dest, "%s/.Xauthority", cfg.homedir) == -1)
                 errExit("asprintf");
-        if (lstat(dest, &s) == -1) {
+        if (access(dest, F_OK) == -1) {
                 touch_file_as_user(dest, 0600);
-                if (stat(dest, &s) == -1) {
+                if (access(dest, F_OK) == -1) {
                         fprintf(stderr, "Error: cannot create %s\n", dest);
                         exit(1);
                 }
         }
         // get a file descriptor for ~/.Xauthority
-        int dst = safe_fd(dest, O_PATH|O_NOFOLLOW|O_CLOEXEC);
+        int dst = safer_openat(-1, dest, O_PATH|O_NOFOLLOW|O_CLOEXEC);
         if (dst == -1)
-                errExit("safe_fd");
+                errExit("safer_openat");
         // check if the actual mount destination is a user owned regular file
         if (fstat(dst, &s) == -1)
                 errExit("fstat");
@@ -1263,9 +1257,9 @@ void x11_xorg(void) {
         fs_remount(RUN_XAUTHORITY_SEC_DIR, MOUNT_NOEXEC, 0);
 
         // get a file descriptor for the new Xauthority file
-        int src = safe_fd(tmpfname, O_PATH|O_NOFOLLOW|O_CLOEXEC);
+        int src = safer_openat(-1, tmpfname, O_PATH|O_NOFOLLOW|O_CLOEXEC);
         if (src == -1)
-                errExit("safe_fd");
+                errExit("safer_openat");
         if (fstat(src, &s) == -1)
                 errExit("fstat");
         if (!S_ISREG(s.st_mode)) {
@@ -1276,21 +1270,16 @@ void x11_xorg(void) {
         // mount via the link in /proc/self/fd
         if (arg_debug)
                 printf("Mounting %s on %s\n", tmpfname, dest);
-        char *proc_src, *proc_dst;
-        if (asprintf(&proc_src, "/proc/self/fd/%d", src) == -1)
-                errExit("asprintf");
-        if (asprintf(&proc_dst, "/proc/self/fd/%d", dst) == -1)
-                errExit("asprintf");
-        if (mount(proc_src, proc_dst, NULL, MS_BIND, NULL) == -1) {
+        EUID_ROOT();
+        if (bind_mount_by_fd(src, dst)) {
                 fprintf(stderr, "Error: cannot mount the new .Xauthority file\n");
                 exit(1);
         }
+        EUID_USER();
         // check /proc/self/mountinfo to confirm the mount is ok
         MountData *mptr = get_last_mount();
         if (strcmp(mptr->dir, dest) != 0 || strcmp(mptr->fstype, "tmpfs") != 0)
                 errLogExit("invalid .Xauthority mount");
-        free(proc_src);
-        free(proc_dst);
         close(src);
         close(dst);
 
@@ -1301,8 +1290,11 @@ void x11_xorg(void) {
         if (envar) {
                 char *rp = realpath(envar, NULL);
                 if (rp) {
-                        if (strcmp(rp, dest) != 0)
+                        if (strcmp(rp, dest) != 0) {
+                                EUID_ROOT();
                                 disable_file_or_dir(rp);
+                                EUID_USER();
+                        }
                         free(rp);
                 }
         }
@@ -1311,9 +1303,13 @@ void x11_xorg(void) {
         free(dest);
 
         // mask RUN_XAUTHORITY_SEC_DIR
+        EUID_ROOT();
         if (mount("tmpfs", RUN_XAUTHORITY_SEC_DIR, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME,  "mode=755,gid=0") < 0)
                 errExit("mounting tmpfs");
         fs_logger2("tmpfs", RUN_XAUTHORITY_SEC_DIR);
+
+        // cleanup
+        unlink(RUN_XAUTH_FILE);
 #endif
 }
 
@@ -1327,7 +1323,7 @@ void fs_x11(void) {
         struct stat s1, s2;
         if (stat("/tmp", &s1) != 0 || lstat("/tmp/.X11-unix", &s2) != 0)
                 return;
-        if ((s1.st_mode & S_ISVTX) == 0) {
+        if ((s1.st_mode & S_ISVTX) != S_ISVTX) {
                 fwarning("cannot mask X11 sockets: sticky bit not set on /tmp directory\n");
                 return;
         }
@@ -1335,68 +1331,46 @@ void fs_x11(void) {
                 fwarning("cannot mask X11 sockets: /tmp/.X11-unix not owned by root user\n");
                 return;
         }
+
+        // the mount source is under control of the user, so be careful and
+        // mount without following symbolic links, using a file descriptor
         char *x11file;
         if (asprintf(&x11file, "/tmp/.X11-unix/X%d", display) == -1)
                 errExit("asprintf");
-        struct stat x11stat;
-        if (lstat(x11file, &x11stat) != 0 || !S_ISSOCK(x11stat.st_mode)) {
+        int src = open(x11file, O_PATH|O_NOFOLLOW|O_CLOEXEC);
+        if (src < 0) {
+                free(x11file);
+                return;
+        }
+        struct stat s3;
+        if (fstat(src, &s3) < 0)
+                errExit("fstat");
+        if (!S_ISSOCK(s3.st_mode)) {
+                close(src);
                 free(x11file);
                 return;
         }
 
         if (arg_debug || arg_debug_whitelists)
                 fprintf(stderr, "Masking all X11 sockets except %s\n", x11file);
-
-        // Move the real /tmp/.X11-unix to a scratch location
-        // so we can still access x11file after we mount a
-        // tmpfs over /tmp/.X11-unix.
-        if (mkdir(RUN_WHITELIST_X11_DIR, 0700) == -1)
-                errExit("mkdir");
-        if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0)
-                errExit("mount bind");
-
         // This directory must be mode 1777
         if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs",
                 MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME,
                 "mode=1777,uid=0,gid=0") < 0)
                 errExit("mounting tmpfs on /tmp/.X11-unix");
+        selinux_relabel_path("/tmp/.X11-unix", "/tmp/.X11-unix");
         fs_logger("tmpfs /tmp/.X11-unix");
 
         // create an empty root-owned file which will have the desired socket bind-mounted over it
-        int fd = open(x11file, O_RDONLY|O_CREAT|O_EXCL, S_IRUSR | S_IWUSR);
-        if (fd < 0)
-                errExit(x11file);
-        close(fd);
+        int dst = open(x11file, O_RDONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWUSR);
+        if (dst < 0)
+                errExit("open");
 
-        // the mount source is under control of the user, so be careful and
-        // mount without following symbolic links, using a file descriptor
-        char *wx11file;
-        if (asprintf(&wx11file, "%s/X%d", RUN_WHITELIST_X11_DIR, display) == -1)
-                errExit("asprintf");
-        fd = safe_fd(wx11file, O_PATH|O_NOFOLLOW|O_CLOEXEC);
-        if (fd == -1)
-                errExit("opening X11 socket");
-        // confirm once more we are mounting a socket
-        if (fstat(fd, &x11stat) == -1)
-                errExit("fstat");
-        if (!S_ISSOCK(x11stat.st_mode)) {
-                errno = ENOTSOCK;
-                errExit("mounting X11 socket");
-        }
-        char *proc;
-        if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1)
-                errExit("asprintf");
-        if (mount(proc, x11file, NULL, MS_BIND|MS_REC, NULL) < 0)
+        if (bind_mount_by_fd(src, dst))
                 errExit("mount bind");
+        close(src);
+        close(dst);
         fs_logger2("whitelist", x11file);
-        close(fd);
-        free(proc);
-
-        // block access to RUN_WHITELIST_X11_DIR
-        if (mount(RUN_RO_DIR, RUN_WHITELIST_X11_DIR, 0, MS_BIND, 0) < 0)
-                errExit("mount");
-        fs_logger2("blacklist", RUN_WHITELIST_X11_DIR);
-        free(wx11file);
         free(x11file);
 #endif
 }
diff --git a/src/firemon/apparmor.c b/src/firemon/apparmor.c
index eb810a9e7..7103ab7af 100644
--- a/src/firemon/apparmor.c
+++ b/src/firemon/apparmor.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/arp.c b/src/firemon/arp.c
index 1a69a67b1..1a01da016 100644
--- a/src/firemon/arp.c
+++ b/src/firemon/arp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/caps.c b/src/firemon/caps.c
index c0f305a5d..045cd1968 100644
--- a/src/firemon/caps.c
+++ b/src/firemon/caps.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/cgroup.c b/src/firemon/cgroup.c
index 97ba591a6..7ef76fa46 100644
--- a/src/firemon/cgroup.c
+++ b/src/firemon/cgroup.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/cpu.c b/src/firemon/cpu.c
index 91b455941..31e4eb7fd 100644
--- a/src/firemon/cpu.c
+++ b/src/firemon/cpu.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/firemon.c b/src/firemon/firemon.c
index 37870747d..91406d6a7 100644
--- a/src/firemon/firemon.c
+++ b/src/firemon/firemon.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -52,7 +52,7 @@ static void my_handler(int s){
 
         if (terminal_set)
                 tcsetattr(0, TCSANOW, &tlocal);
-        exit(0);
+        _exit(0);
 }
 
 // find the second child process for the specified pid
diff --git a/src/firemon/firemon.h b/src/firemon/firemon.h
index 5252ad34f..2fa294e8d 100644
--- a/src/firemon/firemon.h
+++ b/src/firemon/firemon.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/interface.c b/src/firemon/interface.c
index e04b6f431..f57616ed7 100644
--- a/src/firemon/interface.c
+++ b/src/firemon/interface.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,6 +18,7 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firemon.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <netdb.h>
@@ -145,9 +146,9 @@ static void print_sandbox(pid_t pid) {
                 if (rv)
                         return;
                 net_ifprint();
-#ifdef HAVE_GCOV
+
                 __gcov_flush();
-#endif
+
                 _exit(0);
         }
 
diff --git a/src/firemon/list.c b/src/firemon/list.c
index 51099a75c..d066c7a5f 100644
--- a/src/firemon/list.c
+++ b/src/firemon/list.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/netstats.c b/src/firemon/netstats.c
index 850959eb3..0a1b7e0c4 100644
--- a/src/firemon/netstats.c
+++ b/src/firemon/netstats.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,6 +18,7 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firemon.h"
+#include "../include/gcov_wrapper.h"
 #include <termios.h>
 #include <sys/ioctl.h>
 #include <sys/types.h>
@@ -242,8 +243,7 @@ void netstats(void) {
                                 print_proc(i, itv, col);
                         }
                 }
-#ifdef HAVE_GCOV
-                        __gcov_flush();
-#endif
+
+                __gcov_flush();
         }
 }
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c
index 8085d2d29..ccc1ba1c6 100644
--- a/src/firemon/procevent.c
+++ b/src/firemon/procevent.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,6 +18,7 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firemon.h"
+#include "../include/gcov_wrapper.h"
 #include <sys/socket.h>
 #include <linux/connector.h>
 #include <linux/netlink.h>
@@ -230,9 +231,7 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my
         tv.tv_usec = 0;
 
         while (1) {
-#ifdef HAVE_GCOV
                 __gcov_flush();
-#endif
 
 #define BUFFSIZE 4096
                 char __attribute__ ((aligned(NLMSG_ALIGNTO)))buf[BUFFSIZE];
diff --git a/src/firemon/route.c b/src/firemon/route.c
index 9cf5054b2..86f4d85ae 100644
--- a/src/firemon/route.c
+++ b/src/firemon/route.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/seccomp.c b/src/firemon/seccomp.c
index 04111b6c0..ba0017eff 100644
--- a/src/firemon/seccomp.c
+++ b/src/firemon/seccomp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/top.c b/src/firemon/top.c
index a25e3c0d8..2bfa63380 100644
--- a/src/firemon/top.c
+++ b/src/firemon/top.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,6 +18,7 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #include "firemon.h"
+#include "../include/gcov_wrapper.h"
 #include <termios.h>
 #include <sys/ioctl.h>
 #include <sys/types.h>
@@ -326,8 +327,7 @@ void top(void) {
                         }
                 }
                 head_print(col, row);
-#ifdef HAVE_GCOV
-                        __gcov_flush();
-#endif
+
+                __gcov_flush();
         }
 }
diff --git a/src/firemon/tree.c b/src/firemon/tree.c
index 899214b9f..7ad413772 100644
--- a/src/firemon/tree.c
+++ b/src/firemon/tree.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/firemon/usage.c b/src/firemon/usage.c
index baaef3111..c6a664790 100644
--- a/src/firemon/usage.c
+++ b/src/firemon/usage.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -38,12 +38,12 @@ static char *help_str =
         "\t--name=name - print information only about named sandbox.\n\n"
         "\t--netstats - monitor network statistics for sandboxes creating a new\n"
         "\t\tnetwork namespace.\n\n"
-        "\t--nowrap - enable line wrapping in terminals.\n\n"
         "\t--route - print route table for each sandbox.\n\n"
         "\t--seccomp - print seccomp configuration for each sandbox.\n\n"
         "\t--tree - print a tree of all sandboxed processes.\n\n"
         "\t--top - monitor the most CPU-intensive sandboxes.\n\n"
         "\t--version - print program version and exit.\n\n"
+        "\t--wrap - enable line wrapping in terminals.\n\n"
         "\t--x11 - print X11 display number.\n\n"
 
         "Without any options, firemon monitors all fork, exec, id change, and exit\n"
diff --git a/src/firemon/x11.c b/src/firemon/x11.c
index 97e24b2d2..16ee0a2d6 100644
--- a/src/firemon/x11.c
+++ b/src/firemon/x11.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fldd/main.c b/src/fldd/main.c
index 9d91557c1..898e0f36a 100644
--- a/src/fldd/main.c
+++ b/src/fldd/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -261,12 +261,21 @@ static void walk_directory(const char *dirname) {
 
                         // check directory
                         // entry->d_type field is supported  in glibc since version 2.19 (Feb 2014)
-                        // we'll use stat to check for directories
+                        // we'll use stat to check for directories using the real path
+                        // (sometimes the path is a double symlink to a real file and stat would fail)
+                        char *rpath = realpath(path, NULL);
+                        if (!rpath) {
+                                free(path);
+                                continue;
+                        }
+                        free(path);
+
                         struct stat s;
-                        if (stat(path, &s) == -1)
+                        if (stat(rpath, &s) == -1)
                                 errExit("stat");
                         if (S_ISDIR(s.st_mode))
-                                walk_directory(path);
+                                walk_directory(rpath);
+                        free(rpath);
                 }
                 closedir(dir);
         }
diff --git a/src/fnet/arp.c b/src/fnet/arp.c
index 59798d32d..ed110c271 100644
--- a/src/fnet/arp.c
+++ b/src/fnet/arp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fnet/fnet.h b/src/fnet/fnet.h
index c0154b53e..41db5aa1b 100644
--- a/src/fnet/fnet.h
+++ b/src/fnet/fnet.h
@@ -1,5 +1,5 @@
  /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fnet/interface.c b/src/fnet/interface.c
index 91d91360d..072dbf381 100644
--- a/src/fnet/interface.c
+++ b/src/fnet/interface.c
@@ -1,5 +1,5 @@
  /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fnet/main.c b/src/fnet/main.c
index df8f7226c..d39fcfc84 100644
--- a/src/fnet/main.c
+++ b/src/fnet/main.c
@@ -1,5 +1,5 @@
  /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fnet/veth.c b/src/fnet/veth.c
index e09b1b1c5..bd6e33583 100644
--- a/src/fnet/veth.c
+++ b/src/fnet/veth.c
@@ -26,7 +26,7 @@
  *
  */
  /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fnetfilter/main.c b/src/fnetfilter/main.c
index 979f082d0..a89e12933 100644
--- a/src/fnetfilter/main.c
+++ b/src/fnetfilter/main.c
@@ -1,5 +1,5 @@
  /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -187,10 +187,9 @@ printf("\n");
         char *command = (argc == 3)? argv[1]: NULL;
 //printf("command %s\n", command);
 //printf("destfile %s\n", destfile);
+
         // destfile is a real filename
-        int len = strlen(destfile);
-        if (strcspn(destfile, "\\&!?\"'<>%^(){};,*[]") != (size_t)len)
-                err_exit_cannot_open_file(destfile);
+        reject_meta_chars(destfile, 0);
 
         // handle default config (command = NULL, destfile)
         if (command == NULL) {
diff --git a/src/fnettrace/Makefile.in b/src/fnettrace/Makefile.in
new file mode 100644
index 000000000..755ddcc3a
--- /dev/null
+++ b/src/fnettrace/Makefile.in
@@ -0,0 +1,17 @@
+.PHONY: all
+all: fnettrace
+
+include ../common.mk
+
+%.o : %.c $(H_FILE_LIST)
+        $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
+
+fnettrace: $(OBJS)
+        $(CC)  $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS)
+
+.PHONY: clean
+clean:; rm -fr *.o fnettrace *.gcov *.gcda *.gcno *.plist
+
+.PHONY: distclean
+distclean: clean
+        rm -fr Makefile
diff --git a/src/fnettrace/fnettrace.h b/src/fnettrace/fnettrace.h
new file mode 100644
index 000000000..b30a9f10d
--- /dev/null
+++ b/src/fnettrace/fnettrace.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#ifndef FNETTRACE_H
+#define FNETTRACE_H
+
+#include "../include/common.h"
+#include <unistd.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <time.h>
+#include <stdarg.h>
+#include <fcntl.h>
+#include <sys/mman.h>
+
+
+//#define DEBUG 1
+
+#define NETLOCK_INTERVAL 60     // seconds
+#define DISPLAY_INTERVAL 2      // seconds
+#define DISPLAY_TTL 4           // display intervals (4 * 2 seconds)
+#define DISPLAY_BW_UNITS 20     // length of the bandwidth bar
+
+
+static inline void ansi_topleft(void) {
+        char str[] = {0x1b, '[', '1', ';',  '1', 'H', '\0'};
+        printf("%s", str);
+        fflush(0);
+}
+
+static inline void ansi_clrscr(void) {
+        ansi_topleft();
+        char str[] = {0x1b, '[', '0', 'J', '\0'};
+        printf("%s", str);
+        fflush(0);
+}
+
+static inline uint8_t hash(uint32_t ip) {
+        uint8_t *ptr = (uint8_t *) &ip;
+        // simple byte xor
+        return *ptr ^ *(ptr + 1) ^ *(ptr + 2) ^ *(ptr + 3);
+}
+
+// main.c
+void logprintf(char* fmt, ...);
+
+// hostnames.c
+extern int geoip_calls;
+void load_hostnames(const char *fname);
+char* retrieve_hostname(uint32_t ip);
+
+// tail.c
+void tail(const char *logfile);
+
+#endif
\ No newline at end of file
diff --git a/src/fnettrace/hostnames.c b/src/fnettrace/hostnames.c
new file mode 100644
index 000000000..dd92070bf
--- /dev/null
+++ b/src/fnettrace/hostnames.c
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fnettrace.h"
+#include "radix.h"
+#define MAXBUF 1024
+
+int geoip_calls = 0;
+static int geoip_not_found = 0;
+static char buf[MAXBUF];
+
+char *retrieve_hostname(uint32_t ip) {
+        if (geoip_not_found)
+                return NULL;
+        geoip_calls++;
+
+        char *rv = NULL;
+        char *cmd;
+        if (asprintf(&cmd, "/usr/bin/geoiplookup %d.%d.%d.%d", PRINT_IP(ip)) == -1)
+                errExit("asprintf");
+
+        FILE *fp = popen(cmd, "r");
+        if (fp) {
+                char *ptr;
+                 if (fgets(buf, MAXBUF, fp)) {
+                        ptr = strchr(buf, '\n');
+                        if (ptr)
+                                *ptr = '\0';
+                        if (strncmp(buf, "GeoIP Country Edition:", 22) == 0) {
+                                ptr = buf + 22;
+                                if (*ptr == ' ' && *(ptr + 3) == ',' &&  *(ptr + 4) == ' ') {
+                                        rv = ptr + 5;
+                                        rv = radix_add(ip, 0xffffffff, rv);
+                                }
+                        }
+                }
+                fclose(fp);
+                return rv;
+        }
+        else
+                geoip_not_found = 1;
+
+        free(cmd);
+
+        return NULL;
+}
+
+void load_hostnames(const char *fname) {
+        assert(fname);
+        FILE *fp = fopen(fname, "r");
+        if (!fp) {
+                fprintf(stderr, "Warning: cannot find %s file\n", fname);
+                return;
+        }
+
+        char buf[MAXBUF];
+        int line = 0;
+        while (fgets(buf, MAXBUF, fp)) {
+                line++;
+
+                // skip empty spaces
+                char *start = buf;
+                while (*start == ' ' || *start == '\t')
+                        start++;
+                // comments
+                if (*start == '#')
+                        continue;
+                char *end = strchr(start, '#');
+                if (end)
+                        *end = '\0';
+
+                // end
+                end = strchr(start, '\n');
+                if (end)
+                        *end = '\0';
+                end = start + strlen(start);
+                if (end == start)       // empty line
+                        continue;
+
+                // line format: 1.2.3.4/32 name_without_empty_spaces
+                // a single empty space between address and name
+                end = strchr(start, ' ');
+                if (!end)
+                        goto errexit;
+                *end = '\0';
+                end++;
+                if (*end == '\0')
+                        goto errexit;
+
+                uint32_t ip;
+                uint32_t mask;
+                if (atocidr(start, &ip, &mask)) {
+                        fprintf(stderr, "Error: invalid CIDR address\n");
+                        goto errexit;
+                }
+
+                radix_add(ip, mask, end);
+        }
+
+        fclose(fp);
+        return;
+
+
+errexit:
+        fprintf(stderr, "Error: invalid line %d in file %s\n", line, fname);
+        exit(1);
+}
+
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c
new file mode 100644
index 000000000..31d49d839
--- /dev/null
+++ b/src/fnettrace/main.c
@@ -0,0 +1,665 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fnettrace.h"
+#include "radix.h"
+#include <sys/ioctl.h>
+#define MAX_BUF_SIZE (64 * 1024)
+
+static int arg_netfilter = 0;
+static int arg_tail = 0;
+static char *arg_log = NULL;
+
+typedef struct hnode_t {
+        struct hnode_t *hnext;  // used for hash table and unused linked list
+        struct hnode_t *dnext;  // used to display stremas on the screen
+        uint32_t ip_src;
+        uint32_t  bytes;        // number of bytes received in the last display interval
+        uint16_t port_src;
+        uint8_t protocol;
+        // the firewall is build based on source address, and in the linked list
+        // we have elements with the same address but different ports
+        uint8_t ip_instance;
+        char *hostname;
+        int ttl;
+} HNode;
+
+// hash table
+#define HMAX 256
+HNode *htable[HMAX] = {NULL};
+// display linked list
+HNode *dlist = NULL;
+
+
+// speed up malloc/free
+#define HNODE_MAX_MALLOC 16
+static HNode *hnode_unused = NULL;
+HNode *hmalloc(void) {
+        if (hnode_unused == NULL) {
+                hnode_unused = malloc(sizeof(HNode) * HNODE_MAX_MALLOC);
+                if (!hnode_unused)
+                        errExit("malloc");
+                memset(hnode_unused, 0, sizeof(HNode) * HNODE_MAX_MALLOC);
+                HNode *ptr = hnode_unused;
+                int i;
+                for ( i = 1; i < HNODE_MAX_MALLOC; i++, ptr++)
+                        ptr->hnext = hnode_unused + i;
+        }
+
+        HNode *rv = hnode_unused;
+        hnode_unused = hnode_unused->hnext;
+        return rv;
+}
+
+void hfree(HNode *ptr) {
+        assert(ptr);
+        memset(ptr, 0, sizeof(HNode));
+        ptr->hnext = hnode_unused;
+        hnode_unused = ptr;
+}
+
+
+static void hnode_add(uint32_t ip_src, uint8_t protocol, uint16_t port_src, uint32_t bytes) {
+        uint8_t h = hash(ip_src);
+
+        // find
+        int ip_instance = 0;
+        HNode *ptr = htable[h];
+        while (ptr) {
+                if (ptr->ip_src == ip_src) {
+                        ip_instance++;
+                        if (ptr->port_src == port_src && ptr->protocol == protocol) {
+                                ptr->bytes += bytes;
+                                return;
+                        }
+                }
+                ptr = ptr->hnext;
+        }
+
+#ifdef DEBUG
+        printf("malloc %d.%d.%d.%d\n", PRINT_IP(ip_src));
+#endif
+        HNode *hnew = hmalloc();
+        assert(hnew);
+        hnew->hostname = NULL;
+        hnew->ip_src = ip_src;
+        hnew->port_src = port_src;
+        hnew->protocol = protocol;
+        hnew->hnext = NULL;
+        hnew->bytes = bytes;
+        hnew->ip_instance = ip_instance + 1;
+        hnew->ttl = DISPLAY_TTL;
+        if (htable[h] == NULL)
+                htable[h] = hnew;
+        else {
+                hnew->hnext = htable[h];
+                htable[h] = hnew;
+        }
+
+        // add to the end of list
+        hnew->dnext = NULL;
+        if (dlist == NULL)
+                dlist = hnew;
+        else {
+                ptr = dlist;
+                while (ptr->dnext != NULL)
+                        ptr = ptr->dnext;
+                ptr->dnext = hnew;
+        }
+
+        if (arg_netfilter)
+                logprintf(" %d.%d.%d.%d ", PRINT_IP(hnew->ip_src));
+}
+
+static void hnode_free(HNode *elem) {
+        assert(elem);
+#ifdef DEBUG
+        printf("free %d.%d.%d.%d\n", PRINT_IP(elem->ip_src));
+#endif
+
+        uint8_t h = hash(elem->ip_src);
+        HNode *ptr = htable[h];
+        assert(ptr);
+
+        HNode *prev = NULL;
+        while (ptr != elem) {
+                prev = ptr;
+                ptr = ptr->hnext;
+        }
+        if (prev == NULL)
+                htable[h] = elem->hnext;
+        else
+                prev->hnext = elem->hnext;
+        hfree(elem);
+}
+
+#ifdef DEBUG
+static void debug_dlist(void) {
+        HNode *ptr = dlist;
+        while (ptr) {
+                printf("dlist %d.%d.%d.%d:%d\n", PRINT_IP(ptr->ip_src), ptr->port_src);
+                ptr = ptr->dnext;
+        }
+}
+static void debug_hnode(void) {
+        int i;
+        for (i = 0; i < HMAX; i++) {
+                HNode *ptr = htable[i];
+                while (ptr) {
+                        printf("hnode (%d) %d.%d.%d.%d:%d\n", i, PRINT_IP(ptr->ip_src), ptr->port_src);
+                        ptr = ptr->hnext;
+                }
+        }
+}
+#endif
+
+static char *bw_line[DISPLAY_BW_UNITS + 1] = { NULL };
+
+static char *print_bw(unsigned units) {
+        if (units > DISPLAY_BW_UNITS)
+                units = DISPLAY_BW_UNITS ;
+
+        if (bw_line[units] == NULL) {
+                char *ptr = malloc(DISPLAY_BW_UNITS + 2);
+                if (!ptr)
+                        errExit("malloc");
+                bw_line[units] = ptr;
+
+                unsigned i;
+                for (i = 0; i < DISPLAY_BW_UNITS; i++, ptr++)
+                        sprintf(ptr, "%s", (i < units)? "*": " ");
+                sprintf(ptr, "%s", " ");
+        }
+
+        return bw_line[units];
+}
+
+#define LINE_MAX 200
+static inline void adjust_line(char *str, int len, int cols) {
+        if (len > LINE_MAX) // functions such as snprintf truncate the string, and return the length of the untruncated string
+                len = LINE_MAX;
+        if (cols > 4 && len > cols) {
+                str[cols] = '\0';
+                str[cols- 1] = '\n';
+        }
+}
+
+#define BWMAX_CNT 8
+static unsigned adjust_bandwidth(unsigned bw) {
+        static unsigned array[BWMAX_CNT] = {0};
+        static int instance = 0;
+
+        array[instance] = bw;
+        int i;
+        unsigned sum = 0;
+        unsigned max = 0;
+        for ( i = 0; i < BWMAX_CNT; i++) {
+                sum += array[i];
+                max = (max > array[i])? max: array[i];
+        }
+        sum /= BWMAX_CNT;
+
+        if (++instance >= BWMAX_CNT)
+                instance = 0;
+
+        return (max < (sum / 2))? sum: max;
+}
+
+static void hnode_print(unsigned bw) {
+        assert(!arg_netfilter);
+        bw = (bw < 1024 * DISPLAY_INTERVAL)? 1024 * DISPLAY_INTERVAL: bw;
+#ifdef DEBUG
+        printf("*********************\n");
+        debug_dlist();
+        printf("-----------------------------\n");
+        debug_hnode();
+        printf("*********************\n");
+#else
+        ansi_clrscr();
+#endif
+
+        // get terminal size
+        struct winsize sz;
+        int cols = 80;
+        if (isatty(STDIN_FILENO)) {
+                if (!ioctl(0, TIOCGWINSZ, &sz))
+                        cols  = sz.ws_col;
+        }
+        if (cols > LINE_MAX)
+                cols = LINE_MAX;
+        char line[LINE_MAX + 1];
+
+        // print stats line
+        bw = adjust_bandwidth(bw);
+        char stats[31];
+        if (bw > (1024 * 1024 * DISPLAY_INTERVAL))
+                sprintf(stats, "%u MB/s ", bw / (1024 * 1024 * DISPLAY_INTERVAL));
+        else
+                sprintf(stats, "%u KB/s ", bw / (1024 * DISPLAY_INTERVAL));
+        int len = snprintf(line, LINE_MAX, "%32s geoip %d, IP database %d\n", stats, geoip_calls, radix_nodes);
+        adjust_line(line, len, cols);
+        printf("%s", line);
+
+        HNode *ptr = dlist;
+        HNode *prev = NULL;
+        while (ptr) {
+                HNode *next = ptr->dnext;
+                if (--ptr->ttl > 0) {
+                        char bytes[11];
+                        if (ptr->bytes > (DISPLAY_INTERVAL * 1024 * 1024 * 2)) // > 2 MB/second
+                                snprintf(bytes, 11, "%u MB/s",
+                                        (unsigned) (ptr->bytes / (DISPLAY_INTERVAL * 1024* 1024)));
+                        else if (ptr->bytes > (DISPLAY_INTERVAL * 1024 * 2)) // > 2 KB/second
+                                snprintf(bytes, 11, "%u KB/s",
+                                        (unsigned) (ptr->bytes / (DISPLAY_INTERVAL * 1024)));
+                        else
+                                snprintf(bytes, 11, "%u B/s ", (unsigned) (ptr->bytes / DISPLAY_INTERVAL));
+
+                        if (!ptr->hostname)
+                                ptr->hostname = radix_longest_prefix_match(ptr->ip_src);
+                        if (!ptr->hostname)
+                                ptr->hostname = retrieve_hostname(ptr->ip_src);
+                        if (!ptr->hostname)
+                                ptr->hostname = " ";
+
+                        unsigned bwunit = bw / DISPLAY_BW_UNITS;
+                        char *bwline;
+                        if (bwunit == 0)
+                                bwline = print_bw(0);
+                        else
+                                bwline = print_bw(ptr->bytes / bwunit);
+
+                        char *protocol = "";
+                        if (ptr->port_src == 80)
+                                protocol = "(HTTP)";
+                        else if (ptr->port_src == 853)
+                                protocol = "(DoT)";
+                        else if (ptr->protocol == 0x11)
+                                protocol = "(UDP)";
+/*
+                        else (ptr->port_src == 443)
+                                protocol = "TLS";
+                        else if (ptr->port_src == 53)
+                                protocol = "DNS";
+*/
+
+                        len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d:%u%s %s\n",
+                                bytes, bwline, PRINT_IP(ptr->ip_src), ptr->port_src, protocol, ptr->hostname);
+                        adjust_line(line, len, cols);
+                        printf("%s", line);
+
+                        if (ptr->bytes)
+                                ptr->ttl = DISPLAY_TTL;
+                        ptr->bytes = 0;
+                        prev = ptr;
+                }
+                else {
+                        // free the element
+                        if (prev == NULL)
+                                dlist = next;
+                        else
+                                prev->dnext = next;
+                        hnode_free(ptr);
+                }
+
+                ptr = next;
+        }
+
+#ifdef DEBUG
+        {
+                int cnt = 0;
+                HNode *ptr = hnode_unused;
+                while (ptr) {
+                        cnt++;
+                        ptr = ptr->hnext;
+                }
+                printf("hnode unused %d\n", cnt);
+        }
+#endif
+}
+
+static void run_trace(void) {
+        if (arg_netfilter)
+                logprintf("accumulating traffic for %d seconds\n", NETLOCK_INTERVAL);
+
+        // trace only rx ipv4 tcp and upd
+        int s1 = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
+        int s2 = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);
+        if (s1 < 0 || s2 < 0)
+                errExit("socket");
+
+        unsigned start = time(NULL);
+        unsigned last_print_traces = 0;
+        unsigned last_print_remaining = 0;
+        unsigned char buf[MAX_BUF_SIZE];
+        unsigned bw = 0; // bandwidth calculations
+        while (1) {
+                unsigned end = time(NULL);
+                if (arg_netfilter && end - start >= NETLOCK_INTERVAL)
+                        break;
+                if (end % DISPLAY_INTERVAL == 1 && last_print_traces != end) { // first print after 1 second
+                        if (!arg_netfilter)
+                                hnode_print(bw);
+                        last_print_traces = end;
+                        bw = 0;
+                }
+                if (arg_netfilter && last_print_remaining != end) {
+                        logprintf(".");
+                        fflush(0);
+                        last_print_remaining = end;
+                }
+
+                fd_set rfds;
+                FD_ZERO(&rfds);
+                FD_SET(s1, &rfds);
+                FD_SET(s2, &rfds);
+                int maxfd = (s1 > s2) ? s1 : s2;
+                 maxfd++;
+                struct timeval tv;
+                tv.tv_sec = 1;
+                tv.tv_usec = 0;
+                int rv = select(maxfd, &rfds, NULL, NULL, &tv);
+                if (rv < 0)
+                        errExit("select");
+                else if (rv == 0)
+                        continue;
+
+                int sock = (FD_ISSET(s1, &rfds)) ? s1 : s2;
+
+                unsigned bytes = recvfrom(sock, buf, MAX_BUF_SIZE, 0, NULL, NULL);
+                if (bytes >= 20) { // size of IP header
+#ifdef DEBUG
+                        {
+                                uint32_t ip_src;
+                                memcpy(&ip_src, buf + 12, 4);
+                                ip_src = ntohl(ip_src);
+
+                                uint32_t ip_dst;
+                                memcpy(&ip_dst, buf + 16, 4);
+                                ip_dst = ntohl(ip_dst);
+                                printf("%d.%d.%d.%d -> %d.%d.%d.%d, %u bytes\n", PRINT_IP(ip_src), PRINT_IP(ip_dst), bytes);
+                        }
+#endif
+                        // filter out loopback traffic
+                        if (buf[12] != 127 && buf[16] != 127) {
+                                bw += bytes + 14; // assume a 14 byte Ethernet layer
+
+                                uint32_t ip_src;
+                                memcpy(&ip_src, buf + 12, 4);
+                                ip_src = ntohl(ip_src);
+
+                                uint8_t hlen = (buf[0] & 0x0f) * 4;
+                                uint16_t port_src;
+                                memcpy(&port_src, buf + hlen, 2);
+                                port_src = ntohs(port_src);
+
+                                hnode_add(ip_src, buf[9], port_src, bytes + 14);
+                        }
+                }
+        }
+
+        close(s1);
+        close(s2);
+}
+
+static char *filter_start =
+        "*filter\n"
+        ":INPUT DROP [0:0]\n"
+        ":FORWARD DROP [0:0]\n"
+        ":OUTPUT DROP [0:0]\n";
+
+// return 1 if error
+static int print_filter(FILE *fp) {
+        if (dlist == NULL)
+                return 1;
+        fprintf(fp, "%s\n", filter_start);
+        fprintf(fp, "-A INPUT -s 127.0.0.0/8 -j ACCEPT\n");
+        fprintf(fp, "-A OUTPUT -d 127.0.0.0/8 -j ACCEPT\n");
+        fprintf(fp, "\n");
+
+        int i;
+        for (i = 0; i < HMAX; i++) {
+                HNode *ptr = htable[i];
+                while (ptr) {
+                        // filter rules are targeting ip address, the port number is disregarded,
+                        // so we look only at the first instance of an address
+                        if (ptr->ip_instance == 1) {
+                                char *protocol = (ptr->protocol == 6)? "tcp": "udp";
+                                fprintf(fp, "-A INPUT -s %d.%d.%d.%d -p %s  -j ACCEPT\n",
+                                        PRINT_IP(ptr->ip_src),
+                                        protocol);
+                                fprintf(fp, "-A OUTPUT -d %d.%d.%d.%d -p %s  -j ACCEPT\n",
+                                        PRINT_IP(ptr->ip_src),
+                                        protocol);
+                                fprintf(fp, "\n");
+                        }
+                        ptr = ptr->hnext;
+                }
+        }
+        fprintf(fp, "COMMIT\n");
+
+        return 0;
+}
+
+static char *flush_rules[] = {
+        "-P INPUT ACCEPT",
+//      "-P FORWARD DENY",
+        "-P OUTPUT ACCEPT",
+        "-F",
+        "-X",
+//      "-t nat -F",
+//      "-t nat -X",
+//      "-t mangle -F",
+//      "-t mangle -X",
+//      "iptables -t raw -F",
+//      "-t raw -X",
+        NULL
+};
+
+static void deploy_netfilter(void) {
+        int rv;
+        char *cmd;
+        int i;
+
+        if (dlist == NULL) {
+                logprintf("Sorry, no network traffic was detected. The firewall was not configured.\n");
+                return;
+        }
+        // find iptables command
+        char *iptables = NULL;
+        char *iptables_restore = NULL;
+        if (access("/sbin/iptables", X_OK) == 0) {
+                iptables = "/sbin/iptables";
+                iptables_restore = "/sbin/iptables-restore";
+        }
+        else if (access("/usr/sbin/iptables", X_OK) == 0) {
+                iptables = "/usr/sbin/iptables";
+                iptables_restore = "/usr/sbin/iptables-restore";
+        }
+        if (iptables == NULL || iptables_restore == NULL) {
+                fprintf(stderr, "Error: iptables command not found, netfilter not configured\n");
+                exit(1);
+        }
+
+        // flush all netfilter rules
+        i = 0;
+        while (flush_rules[i]) {
+                char *cmd;
+                if (asprintf(&cmd, "%s %s", iptables, flush_rules[i]) == -1)
+                        errExit("asprintf");
+                int rv = system(cmd);
+                (void) rv;
+                free(cmd);
+                i++;
+        }
+
+        // create temporary file
+        char fname[] = "/tmp/firejail-XXXXXX";
+        int fd = mkstemp(fname);
+        if (fd == -1) {
+                fprintf(stderr, "Error: cannot create temporary configuration file\n");
+                exit(1);
+        }
+
+        FILE* fp = fdopen(fd, "w");
+        if (!fp) {
+                rv = unlink(fname);
+                (void) rv;
+                fprintf(stderr, "Error: cannot create temporary configuration file\n");
+                exit(1);
+        }
+        print_filter(fp);
+        fclose(fp);
+
+        logprintf("\n\n");
+        logprintf(">>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
+        if (asprintf(&cmd, "cat %s >> %s", fname, arg_log) == -1)
+                errExit("asprintf");
+        rv = system(cmd);
+        (void) rv;
+        free(cmd);
+
+        if (asprintf(&cmd, "cat %s", fname) == -1)
+                errExit("asprintf");
+        rv = system(cmd);
+        (void) rv;
+        free(cmd);
+        logprintf("<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<\n");
+
+        // configuring
+        if (asprintf(&cmd, "%s %s", iptables_restore, fname) == -1)
+                errExit("asprintf");
+        rv = system(cmd);
+        if (rv)
+                fprintf(stdout, "Warning: possible netfilter problem!");
+        free(cmd);
+
+        rv = unlink(fname);
+        (void) rv;
+        logprintf("\nfirewall deployed\n");
+}
+
+void logprintf(char* fmt, ...) {
+        if (!arg_log)
+                return;
+
+        FILE *fp = fopen(arg_log, "a");
+        if (fp) { // disregard if error
+                va_list args;
+                va_start(args,fmt);
+                vfprintf(fp, fmt, args);
+                va_end(args);
+                fclose(fp);
+        }
+
+        va_list args;
+        va_start(args,fmt);
+        vfprintf(stdout, fmt, args);
+        va_end(args);
+}
+
+static void usage(void) {
+        printf("Usage: fnettrace [OPTIONS]\n");
+        printf("Options:\n");
+        printf("   --help, -? - this help screen\n");
+        printf("   --log=filename - netlocker logfile\n");
+        printf("   --netfilter - build the firewall rules and commit them.\n");
+        printf("   --tail - \"tail -f\" functionality\n");
+        printf("Examples:\n");
+        printf("   # fnettrace                              - traffic trace\n");
+        printf("   # fnettrace --netfilter --log=logfile    - netlocker, dump output in logfile\n");
+        printf("   # fnettrace --tail --log=logifile        - similar to \"tail -f logfile\"\n");
+        printf("\n");
+}
+
+int main(int argc, char **argv) {
+        int i;
+
+#ifdef DEBUG
+        // radix test
+        radix_add(0x09000000, 0xff000000, "IBM");
+        radix_add(0x09090909, 0xffffffff, "Quad9 DNS");
+        radix_add(0x09000000, 0xff000000, "IBM");
+        printf("This test should print \"IBM, Quad9 DNS, IBM\"\n");
+        char *name = radix_longest_prefix_match(0x09040404);
+        printf("%s, ", name);
+        name = radix_longest_prefix_match(0x09090909);
+        printf("%s, ", name);
+        name = radix_longest_prefix_match(0x09322209);
+        printf("%s\n", name);
+#endif
+
+        for (i = 1; i < argc; i++) {
+                if (strcmp(argv[i], "--help") == 0 || strcmp(argv[i], "-?") == 0) {
+                        usage();
+                        return 0;
+                }
+                else if (strcmp(argv[i], "--netfilter") == 0)
+                        arg_netfilter = 1;
+                else if (strcmp(argv[i], "--tail") == 0)
+                        arg_tail = 1;
+                else if (strncmp(argv[i], "--log=", 6) == 0)
+                        arg_log = argv[i] + 6;
+                else {
+                        fprintf(stderr, "Error: invalid argument\n");
+                        return 1;
+                }
+        }
+
+        // tail
+        if (arg_tail) {
+                if (!arg_log) {
+                        fprintf(stderr, "Error: no log file\n");
+                        usage();
+                        exit(1);
+                }
+
+                tail(arg_log);
+                sleep(5);
+                exit(0);
+        }
+
+        if (getuid() != 0) {
+                fprintf(stderr, "Error: you need to be root to run this program\n");
+                return 1;
+        }
+
+        ansi_clrscr();
+        if (arg_netfilter)
+                logprintf("starting network lockdown\n");
+        else  {
+                char *fname = LIBDIR "/firejail/static-ip-map";
+                load_hostnames(fname);
+        }
+
+        run_trace();
+        if (arg_netfilter) {
+                // TCP path MTU discovery will not work properly since the firewall drops all ICMP packets
+                // Instead, we use iPacketization Layer PMTUD (RFC 4821) support in Linux kernel
+                int rv = system("echo 1 > /proc/sys/net/ipv4/tcp_mtu_probing");
+                (void) rv;
+
+                deploy_netfilter();
+                sleep(3);
+                if (arg_log)
+                        unlink(arg_log);
+        }
+
+        return 0;
+}
diff --git a/src/fnettrace/radix.c b/src/fnettrace/radix.c
new file mode 100644
index 000000000..c9493717d
--- /dev/null
+++ b/src/fnettrace/radix.c
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include <assert.h>
+#include "radix.h"
+#include "fnettrace.h"
+
+typedef struct rnode_t {
+        struct rnode_t *zero;
+        struct rnode_t *one;
+        char *name;
+} RNode;
+
+RNode *head = 0;
+int radix_nodes = 0;
+
+// get rid of the malloc overhead
+#define RNODE_MAX_MALLOC 128
+static RNode *rnode_unused = NULL;
+static int rnode_malloc_cnt = 0;
+static RNode *rmalloc(void) {
+        if (rnode_unused == NULL || rnode_malloc_cnt >= RNODE_MAX_MALLOC) {
+                rnode_unused = malloc(sizeof(RNode) * RNODE_MAX_MALLOC);
+                if (!rnode_unused)
+                        errExit("malloc");
+                memset(rnode_unused, 0, sizeof(RNode) * RNODE_MAX_MALLOC);
+                rnode_malloc_cnt = 0;
+        }
+
+        rnode_malloc_cnt++;
+        return rnode_unused + rnode_malloc_cnt - 1;
+}
+
+
+static inline char *duplicate_name(const char *name) {
+        assert(name);
+
+        if (strcmp(name, "United States") == 0)
+                return "United States";
+        else if (strcmp(name, "Amazon") == 0)
+                return "Amazon";
+        return strdup(name);
+}
+
+static inline RNode *addOne(RNode *ptr, char *name) {
+        assert(ptr);
+        if (ptr->one)
+                return ptr->one;
+        RNode *node = rmalloc();
+        assert(node);
+        if (name) {
+                node->name = duplicate_name(name);
+                if (!node->name)
+                        errExit("duplicate name");
+        }
+
+        ptr->one = node;
+        return node;
+}
+
+static inline RNode *addZero(RNode *ptr, char *name) {
+        assert(ptr);
+        if (ptr->zero)
+                return ptr->zero;
+        RNode *node = rmalloc();
+        assert(node);
+        if (name) {
+                node->name = duplicate_name(name);
+                if (!node->name)
+                        errExit("duplicate name");
+        }
+
+        ptr->zero = node;
+        return node;
+}
+
+
+// add to radix tree
+char *radix_add(uint32_t ip, uint32_t mask, char *name) {
+        assert(name);
+        uint32_t m = 0x80000000;
+        uint32_t lastm = 0;
+        if (head == 0) {
+                head = malloc(sizeof(RNode));
+                memset(head, 0, sizeof(RNode));
+        }
+        RNode *ptr = head;
+        radix_nodes++;
+
+        int i;
+        for (i = 0; i < 32; i++, m >>= 1) {
+                if (!(m & mask))
+                        break;
+
+                lastm |= m;
+                int valid = (lastm == mask)? 1: 0;
+                if (m & ip)
+                        ptr = addOne(ptr, (valid)? name: NULL);
+                else
+                        ptr = addZero(ptr, (valid)? name: NULL);
+        }
+        assert(ptr);
+        if (!ptr->name) {
+                ptr->name = duplicate_name(name);
+                if (!ptr->name)
+                        errExit("duplicate_name");
+        }
+
+        return ptr->name;
+}
+
+// find last match
+char *radix_longest_prefix_match(uint32_t ip) {
+        if (!head)
+                return NULL;
+
+        uint32_t m = 0x80000000;
+        RNode *ptr = head;
+        RNode *rv = NULL;
+
+        int i;
+        for (i = 0; i < 32; i++, m >>= 1) {
+                if (m & ip)
+                        ptr = ptr->one;
+                else
+                        ptr = ptr->zero;
+                if (!ptr)
+                        break;
+                if (ptr->name)
+                        rv = ptr;
+        }
+
+        return (rv)? rv->name: NULL;
+}
+
diff --git a/src/fnettrace/radix.h b/src/fnettrace/radix.h
new file mode 100644
index 000000000..c22c5c547
--- /dev/null
+++ b/src/fnettrace/radix.h
@@ -0,0 +1,27 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#ifndef RADIX_H
+#define RADIX_H
+
+extern int radix_nodes;
+char *radix_longest_prefix_match(uint32_t ip);
+char *radix_add(uint32_t ip, uint32_t mask, char *name);
+
+#endif
\ No newline at end of file
diff --git a/src/fnettrace/static-ip-map b/src/fnettrace/static-ip-map
new file mode 100644
index 000000000..e24ecf218
--- /dev/null
+++ b/src/fnettrace/static-ip-map
@@ -0,0 +1,4044 @@
+#
+# Copyright (C) 2014-2022 Firejail Authors
+#
+# This file is part of firejail project
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License along
+# with this program; if not, write to the Free Software Foundation, Inc.,
+# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+#
+# Static Internet Map
+#
+# Unfortunately we cannot do a hostname lookup. This will leak a lot of
+# information about what network resources we access.
+# A static map, helped out by geoip package available on all Linux distros,
+# will have to do it for now!
+#
+# Format:
+#       CIDR-IPv4-address-range hostname
+#       a single space between address and hostname
+#       use '#' for comments
+#       example: 9.9.9.0/24 Quad9 DNS
+#
+#
+
+# local network addresses
+192.168.0.0/16 local network
+10.0.0.0/8 local network
+172.16.0.0/16 local network
+
+#  huge address ranges
+6.0.0.0/8 US Army
+7.0.0.0/8 US Army
+9.0.0.0/8 IBM
+11.0.0.0/8 US Army
+17.0.0.0/8 Apple
+19.0.0.0/8 Ford
+21.0.0.0/8 US Army
+22.0.0.0/8 US Army
+26.0.0.0/8 US Army
+28.0.0.0/8 US Army
+29.0.0.0/8 US Army
+30.0.0.0/8 US Army
+33.0.0.0/8 US Army
+48.0.0.0/8 Prudential US
+55.0.0.0/8 US Army
+56.0.0.0/8 US Postal Service
+214.0.0.0/8     US Army
+215.0.0.0/8 US Army
+
+# whois/DNS
+1.1.1.0/24 Cloudflare DNS
+1.0.0.0/24 Cloudflare DNS
+8.8.4.0/24 Google DNS
+8.8.8.0/24 Google DNS
+9.9.9.0/24 Quad9 DNS
+45.90.28.0/22 NextDNS
+149.112.112.0/24 Quad9 DNS
+149.112.120.0/21 CIRA DNS Canada
+176.103.128.0/19 Adguard DNS
+185.228.168.0/24 Cleanbrowsing DNS
+193.0.0.0/21 whois.ripe.net Netherlands
+199.5.26.0/24 whois.arin.net US
+199.15.80.0/21 whois.publicinterestregistry.net Canada
+199.15.88.0/24 whois.publicinterestregistry.net Canada
+199.71.0.0/24 whois.arin.net US
+199.212.0.0/24 whois.arin.net US
+200.3.12.0/22 whois.lacnic.net Uruguay
+201.159.220.0/22 whois.lacnic.net Ecuador
+
+# some popular websites
+31.13.24.0/21 Facebook
+31.13.64.0/18 Facebook
+64.63.0.0/18 Twitter
+69.171.224.0/19 Facebook
+104.244.40.0/21 Twitter
+129.134.0.0/16 Facebook
+140.82.112.0/20 GitHub
+157.240.0.0/16 Facebook
+185.199.108.0/22 GitHub
+188.64.224.0/21 Twitter
+192.0.64.0/18 Wordpress
+199.16.156.0/22 Twitter
+199.59.148.0/22 Twitter
+208.80.152.0/22 Wikipedia
+
+# Akamai
+23.0.0.0/12 Akamai
+23.32.0.0/11 Akamai
+23.64.0.0/14 Akamai
+23.72.0.0/13 Akamai
+23.192.0.0/11 Akamai
+72.246.0.0/15 Akamai
+96.6.0.0/15 Akamai
+96.16.0.0/15 Akamai
+104.64.0.0/10 Akamai
+184.24.0.0/13 Akamai
+184.50.0.0/15 Akamai
+184.84.0.0/14 Akamai
+
+# Fastly
+23.235.32.0/20 Fastly
+43.249.72.0/22 Fastly
+103.244.50.0/24 Fastly
+103.245.222.0/23 Fastly
+103.245.224.0/24 Fastly
+104.156.80.0/20 Fastly
+146.75.0.0/16 Fastly
+151.101.0.0/16 Fastly
+157.52.64.0/18 Fastly
+167.82.0.0/17 Fastly
+167.82.128.0/20 Fastly
+167.82.160.0/20 Fastly
+167.82.224.0/20 Fastly
+172.111.64.0/18 Fastly
+185.31.16.0/22 Fastly
+199.27.72.0/21 Fastly
+199.232.0.0/16 Fastly
+
+# MCI/Verizon
+72.21.80.0/20 MCI
+108.29.0.0/16 MCI
+108.30.0.0/16 MCI
+108.31.0.0/16 MCI
+108.3.128.0/17 MCI
+108.32.0.0/17 MCI
+108.32.128.0/17 MCI
+108.33.254.0/24 MCI
+108.33.255.0/24 MCI
+108.34.128.0/17 MCI
+108.34.16.0/20 MCI
+108.34.32.0/19 MCI
+108.34.64.0/18 MCI
+108.35.0.0/16 MCI
+108.36.0.0/16 MCI
+108.3.64.0/18 MCI
+108.37.0.0/16 MCI
+108.39.0.0/17 MCI
+108.39.128.0/17 MCI
+108.40.0.0/17 MCI
+108.4.0.0/17 MCI
+108.41.0.0/16 MCI
+108.4.128.0/19 MCI
+108.4.160.0/19 MCI
+108.4.192.0/18 MCI
+108.44.0.0/18 MCI
+108.44.128.0/17 MCI
+108.44.64.0/18 MCI
+108.45.0.0/16 MCI
+108.46.0.0/16 MCI
+192.229.128.0/17 MCI
+
+# Microsoft
+40.76.0.0/14 Microsoft
+40.96.0.0/12 Microsoft
+40.112.0.0/13 Microsoft
+40.124.0.0/16 Microsoft
+40.74.0.0/15 Microsoft
+40.80.0.0/12 Microsoft
+40.120.0.0/14 Microsoft
+40.125.0.0/17 Microsoft
+52.145.0.0/16 Microsoft
+52.148.0.0/14 Microsoft
+52.152.0.0/13 Microsoft
+52.146.0.0/15 Microsoft
+52.160.0.0/11 Microsoft
+
+# Yahoo
+63.250.192.0/19 Yahoo
+66.196.64.0/18 Yahoo
+67.195.0.0/16 Yahoo
+69.147.64.0/18 Yahoo
+76.13.0.0/16 Yahoo
+98.136.0.0/14 Yahoo
+206.190.32.0/19 Yahoo
+209.73.160.0/19 Yahoo
+209.191.64.0/18 Yahoo
+216.115.96.0/20 Yahoo
+
+# Google
+# from https://support.google.com/a/answer/10026322?hl=en
+# last update January 5, 2022
+8.34.208.0/20 Google
+8.35.192.0/20 Google
+23.236.48.0/20 Google
+23.251.128.0/19 Google
+34.64.0.0/10 Google
+34.128.0.0/10 Google
+35.184.0.0/13 Google
+35.192.0.0/14 Google
+35.196.0.0/15 Google
+35.198.0.0/16 Google
+35.199.0.0/17 Google
+35.199.128.0/18 Google
+35.200.0.0/13 Google
+35.208.0.0/12 Google
+35.224.0.0/12 Google
+35.240.0.0/13 Google
+64.15.112.0/20 Google
+64.233.160.0/19 Google
+66.102.0.0/20 Google
+66.249.64.0/19 Google
+70.32.128.0/19 Google
+72.14.192.0/18 Google
+74.114.24.0/21 Google
+74.125.0.0/16 Google
+104.154.0.0/15 Google
+104.196.0.0/14 Google
+104.237.160.0/19 Google
+107.167.160.0/19 Google
+107.178.192.0/18 Google
+108.59.80.0/20 Google
+108.170.192.0/18 Google
+108.177.0.0/17 Google
+130.211.0.0/16 Google
+136.112.0.0/12 Google
+142.250.0.0/15 Google
+146.148.0.0/17 Google
+162.216.148.0/22 Google
+162.222.176.0/21 Google
+172.110.32.0/21 Google
+172.217.0.0/16 Google
+172.253.0.0/16 Google
+173.194.0.0/16 Google
+173.255.112.0/20 Google
+192.158.28.0/22 Google
+192.178.0.0/15 Google
+193.186.4.0/24 Google
+199.36.154.0/23 Google
+199.36.156.0/24 Google
+199.192.112.0/22 Google
+199.223.232.0/21 Google
+207.223.160.0/20 Google
+208.65.152.0/22 Google
+208.68.108.0/22 Google
+208.81.188.0/22 Google
+208.117.224.0/19 Google
+209.85.128.0/17 Google
+216.58.192.0/19 Google
+216.73.80.0/20 Google
+216.239.32.0/19 Google
+
+
+#Cloudflare
+# from https://www.cloudflare.com/ips/
+# update April 8, 2021
+103.21.244.0/22 Cloudflare
+103.22.200.0/22 Cloudflare
+103.31.4.0/22 Cloudflare
+104.16.0.0/13 Cloudflare
+104.24.0.0/14 Cloudflare
+108.162.192.0/18 Cloudflare
+131.0.72.0/22 Cloudflare
+141.101.64.0/18 Cloudflare
+162.158.0.0/15 Cloudflare
+172.64.0.0/13 Cloudflare
+173.245.48.0/20 Cloudflare
+188.114.96.0/20 Cloudflare
+190.93.240.0/20 Cloudflare
+197.234.240.0/22 Cloudflare
+198.41.128.0/17 Cloudflare
+
+# Amazon
+# from https://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html
+# update January 6, 2022
+3.0.0.0/15 Amazon
+3.2.0.0/24 Amazon
+3.2.2.0/24 Amazon
+3.2.3.0/24 Amazon
+3.2.8.0/21 Amazon
+3.3.0.0/23 Amazon
+3.3.5.0/24 Amazon
+3.3.6.0/23 Amazon
+3.3.8.0/21 Amazon
+3.3.16.0/21 Amazon
+3.3.24.0/22 Amazon
+3.3.28.0/22 Amazon
+3.4.0.0/24 Amazon
+3.4.1.0/24 Amazon
+3.4.2.0/24 Amazon
+3.4.3.0/24 Amazon
+3.4.4.0/24 Amazon
+3.4.6.0/24 Amazon
+3.4.7.0/24 Amazon
+3.4.16.0/21 Amazon
+3.4.24.0/21 Amazon
+3.5.0.0/19 Amazon
+3.5.32.0/22 Amazon
+3.5.36.0/22 Amazon
+3.5.40.0/22 Amazon
+3.5.44.0/22 Amazon
+3.5.48.0/22 Amazon
+3.5.52.0/22 Amazon
+3.5.64.0/21 Amazon
+3.5.72.0/23 Amazon
+3.5.76.0/22 Amazon
+3.5.80.0/21 Amazon
+3.5.128.0/22 Amazon
+3.5.132.0/23 Amazon
+3.5.134.0/23 Amazon
+3.5.136.0/22 Amazon
+3.5.140.0/22 Amazon
+3.5.144.0/23 Amazon
+3.5.146.0/23 Amazon
+3.5.148.0/22 Amazon
+3.5.152.0/21 Amazon
+3.5.160.0/22 Amazon
+3.5.164.0/22 Amazon
+3.5.168.0/23 Amazon
+3.5.208.0/22 Amazon
+3.5.212.0/23 Amazon
+3.5.216.0/22 Amazon
+3.5.220.0/22 Amazon
+3.5.224.0/22 Amazon
+3.5.228.0/22 Amazon
+3.5.232.0/22 Amazon
+3.5.236.0/22 Amazon
+3.5.240.0/22 Amazon
+3.5.244.0/22 Amazon
+3.5.248.0/22 Amazon
+3.5.252.0/22 Amazon
+3.6.0.0/15 Amazon
+3.8.0.0/14 Amazon
+3.12.0.0/16 Amazon
+3.13.0.0/16 Amazon
+3.14.0.0/15 Amazon
+3.16.0.0/14 Amazon
+3.20.0.0/14 Amazon
+3.24.0.0/14 Amazon
+3.28.0.0/15 Amazon
+3.30.0.0/15 Amazon
+3.32.0.0/16 Amazon
+3.33.34.0/24 Amazon
+3.33.35.0/24 Amazon
+3.33.128.0/17 Amazon
+3.34.0.0/15 Amazon
+3.36.0.0/14 Amazon
+3.48.0.0/12 Amazon
+3.64.0.0/12 Amazon
+3.80.0.0/12 Amazon
+3.96.0.0/15 Amazon
+3.98.0.0/15 Amazon
+3.100.0.0/16 Amazon
+3.101.0.0/16 Amazon
+3.104.0.0/14 Amazon
+3.108.0.0/14 Amazon
+3.112.0.0/14 Amazon
+3.116.0.0/14 Amazon
+3.120.0.0/14 Amazon
+3.124.0.0/14 Amazon
+3.128.0.0/15 Amazon
+3.130.0.0/16 Amazon
+3.131.0.0/16 Amazon
+3.132.0.0/14 Amazon
+3.136.0.0/13 Amazon
+3.144.0.0/13 Amazon
+3.152.0.0/13 Amazon
+3.208.0.0/12 Amazon
+3.224.0.0/12 Amazon
+3.240.0.0/13 Amazon
+3.248.0.0/13 Amazon
+13.32.0.0/15 Amazon
+13.34.0.128/27 Amazon
+13.34.0.160/27 Amazon
+13.34.1.0/27 Amazon
+13.34.1.32/27 Amazon
+13.34.3.128/27 Amazon
+13.34.3.160/27 Amazon
+13.34.3.192/27 Amazon
+13.34.3.224/27 Amazon
+13.34.4.64/27 Amazon
+13.34.4.96/27 Amazon
+13.34.5.12/32 Amazon
+13.34.5.13/32 Amazon
+13.34.5.14/32 Amazon
+13.34.5.15/32 Amazon
+13.34.5.16/32 Amazon
+13.34.5.17/32 Amazon
+13.34.5.44/32 Amazon
+13.34.5.45/32 Amazon
+13.34.5.46/32 Amazon
+13.34.5.47/32 Amazon
+13.34.5.48/32 Amazon
+13.34.5.49/32 Amazon
+13.34.5.78/32 Amazon
+13.34.5.79/32 Amazon
+13.34.5.80/32 Amazon
+13.34.5.81/32 Amazon
+13.34.5.110/32 Amazon
+13.34.5.111/32 Amazon
+13.34.5.112/32 Amazon
+13.34.5.113/32 Amazon
+13.34.5.128/27 Amazon
+13.34.5.160/27 Amazon
+13.34.5.192/27 Amazon
+13.34.5.224/27 Amazon
+13.34.6.192/27 Amazon
+13.34.6.224/27 Amazon
+13.34.7.64/27 Amazon
+13.34.7.96/27 Amazon
+13.34.8.64/27 Amazon
+13.34.8.96/27 Amazon
+13.34.9.0/27 Amazon
+13.34.9.32/27 Amazon
+13.34.10.128/27 Amazon
+13.34.10.160/27 Amazon
+13.34.11.0/27 Amazon
+13.34.11.32/27 Amazon
+13.34.11.128/27 Amazon
+13.34.11.160/27 Amazon
+13.34.12.64/27 Amazon
+13.34.12.96/27 Amazon
+13.34.12.192/27 Amazon
+13.34.12.242/32 Amazon
+13.34.12.243/32 Amazon
+13.34.12.244/32 Amazon
+13.34.12.245/32 Amazon
+13.34.13.18/32 Amazon
+13.34.13.19/32 Amazon
+13.34.13.20/32 Amazon
+13.34.13.21/32 Amazon
+13.34.13.50/32 Amazon
+13.34.13.51/32 Amazon
+13.34.13.52/32 Amazon
+13.34.13.53/32 Amazon
+13.34.14.128/27 Amazon
+13.34.14.160/27 Amazon
+13.34.14.192/27 Amazon
+13.34.14.224/27 Amazon
+13.34.15.0/27 Amazon
+13.34.15.32/27 Amazon
+13.34.16.64/27 Amazon
+13.34.16.96/27 Amazon
+13.34.16.192/27 Amazon
+13.34.17.24/29 Amazon
+13.34.17.64/27 Amazon
+13.34.17.96/27 Amazon
+13.34.18.192/27 Amazon
+13.34.18.224/27 Amazon
+13.34.19.192/27 Amazon
+13.34.19.224/27 Amazon
+13.34.20.0/27 Amazon
+13.34.20.32/27 Amazon
+13.34.20.64/27 Amazon
+13.34.20.96/27 Amazon
+13.34.21.64/27 Amazon
+13.34.21.96/27 Amazon
+13.34.22.88/29 Amazon
+13.34.22.160/27 Amazon
+13.34.22.192/27 Amazon
+13.34.22.224/27 Amazon
+13.34.23.0/27 Amazon
+13.34.23.32/27 Amazon
+13.34.23.64/27 Amazon
+13.34.23.96/27 Amazon
+13.34.23.128/27 Amazon
+13.34.23.160/27 Amazon
+13.34.23.192/27 Amazon
+13.34.23.224/27 Amazon
+13.34.24.64/27 Amazon
+13.34.24.96/27 Amazon
+13.34.24.128/27 Amazon
+13.34.24.160/27 Amazon
+13.34.24.192/27 Amazon
+13.34.25.64/27 Amazon
+13.34.25.96/27 Amazon
+13.34.25.128/27 Amazon
+13.34.25.160/27 Amazon
+13.34.25.192/27 Amazon
+13.34.25.248/29 Amazon
+13.34.26.0/27 Amazon
+13.34.26.32/27 Amazon
+13.34.26.64/27 Amazon
+13.34.26.96/27 Amazon
+13.34.26.128/27 Amazon
+13.34.26.160/27 Amazon
+13.34.26.192/27 Amazon
+13.34.26.224/27 Amazon
+13.34.27.16/32 Amazon
+13.34.27.17/32 Amazon
+13.34.27.32/27 Amazon
+13.34.27.64/27 Amazon
+13.34.27.96/27 Amazon
+13.34.27.128/27 Amazon
+13.34.28.0/27 Amazon
+13.34.28.32/27 Amazon
+13.34.28.64/27 Amazon
+13.34.28.96/27 Amazon
+13.34.28.128/27 Amazon
+13.34.28.160/27 Amazon
+13.34.28.192/27 Amazon
+13.34.28.224/27 Amazon
+13.34.29.0/27 Amazon
+13.34.29.32/27 Amazon
+13.34.29.64/27 Amazon
+13.34.29.96/27 Amazon
+13.34.29.128/27 Amazon
+13.34.29.160/27 Amazon
+13.34.29.192/27 Amazon
+13.34.29.224/27 Amazon
+13.34.30.0/27 Amazon
+13.34.30.32/27 Amazon
+13.34.30.64/27 Amazon
+13.34.30.96/27 Amazon
+13.34.30.128/27 Amazon
+13.34.30.160/27 Amazon
+13.34.30.192/27 Amazon
+13.34.30.224/27 Amazon
+13.34.31.0/27 Amazon
+13.34.31.32/27 Amazon
+13.34.31.64/27 Amazon
+13.34.31.96/27 Amazon
+13.34.31.128/27 Amazon
+13.34.31.160/27 Amazon
+13.34.31.192/27 Amazon
+13.34.31.224/27 Amazon
+13.34.32.0/27 Amazon
+13.34.32.32/27 Amazon
+13.34.32.64/27 Amazon
+13.34.32.96/27 Amazon
+13.34.32.128/27 Amazon
+13.34.32.160/27 Amazon
+13.34.33.0/27 Amazon
+13.34.33.32/27 Amazon
+13.34.33.64/27 Amazon
+13.34.33.96/27 Amazon
+13.34.33.128/27 Amazon
+13.34.33.160/27 Amazon
+13.34.33.192/27 Amazon
+13.34.33.224/27 Amazon
+13.34.34.0/27 Amazon
+13.34.34.32/27 Amazon
+13.34.34.64/27 Amazon
+13.34.34.96/27 Amazon
+13.34.34.128/27 Amazon
+13.34.34.160/27 Amazon
+13.34.34.192/27 Amazon
+13.34.34.224/27 Amazon
+13.34.35.0/27 Amazon
+13.34.35.32/27 Amazon
+13.34.35.64/27 Amazon
+13.34.35.96/27 Amazon
+13.34.35.128/27 Amazon
+13.34.35.160/27 Amazon
+13.34.35.192/27 Amazon
+13.34.35.224/27 Amazon
+13.34.36.0/27 Amazon
+13.34.36.32/27 Amazon
+13.34.36.64/27 Amazon
+13.34.36.96/27 Amazon
+13.34.36.128/27 Amazon
+13.34.36.160/27 Amazon
+13.34.36.192/27 Amazon
+13.34.36.224/27 Amazon
+13.34.37.0/27 Amazon
+13.34.37.32/27 Amazon
+13.34.37.64/27 Amazon
+13.34.37.96/27 Amazon
+13.34.37.128/27 Amazon
+13.34.37.160/27 Amazon
+13.34.37.192/27 Amazon
+13.34.37.224/27 Amazon
+13.34.38.0/27 Amazon
+13.34.38.32/27 Amazon
+13.34.38.64/27 Amazon
+13.34.38.96/27 Amazon
+13.34.38.128/27 Amazon
+13.34.38.160/27 Amazon
+13.34.39.0/27 Amazon
+13.34.39.32/27 Amazon
+13.34.39.64/27 Amazon
+13.34.39.96/27 Amazon
+13.34.39.128/27 Amazon
+13.34.39.160/27 Amazon
+13.34.39.192/27 Amazon
+13.34.39.224/27 Amazon
+13.34.40.0/27 Amazon
+13.34.40.32/27 Amazon
+13.34.40.64/27 Amazon
+13.34.40.96/27 Amazon
+13.34.40.128/27 Amazon
+13.34.40.160/27 Amazon
+13.34.40.192/27 Amazon
+13.34.40.224/27 Amazon
+13.34.41.0/27 Amazon
+13.34.41.32/27 Amazon
+13.34.41.64/27 Amazon
+13.34.41.96/27 Amazon
+13.34.41.128/27 Amazon
+13.34.41.160/27 Amazon
+13.34.41.192/27 Amazon
+13.34.41.224/27 Amazon
+13.34.42.0/27 Amazon
+13.34.42.32/27 Amazon
+13.34.42.64/27 Amazon
+13.34.42.96/27 Amazon
+13.34.42.128/27 Amazon
+13.34.42.160/27 Amazon
+13.34.42.192/27 Amazon
+13.34.42.224/27 Amazon
+13.34.43.0/27 Amazon
+13.34.43.32/27 Amazon
+13.34.43.64/27 Amazon
+13.34.43.96/27 Amazon
+13.34.43.128/27 Amazon
+13.34.43.160/27 Amazon
+13.34.43.192/27 Amazon
+13.34.43.224/27 Amazon
+13.34.44.0/27 Amazon
+13.34.44.32/27 Amazon
+13.34.44.64/27 Amazon
+13.34.44.96/27 Amazon
+13.34.44.128/27 Amazon
+13.34.44.160/27 Amazon
+13.34.44.192/27 Amazon
+13.34.44.224/27 Amazon
+13.34.45.0/27 Amazon
+13.34.45.32/27 Amazon
+13.34.45.64/27 Amazon
+13.34.45.96/27 Amazon
+13.34.45.128/27 Amazon
+13.34.45.160/27 Amazon
+13.34.45.192/27 Amazon
+13.34.45.224/27 Amazon
+13.34.46.0/27 Amazon
+13.34.46.32/27 Amazon
+13.34.46.64/27 Amazon
+13.34.46.96/27 Amazon
+13.34.46.128/27 Amazon
+13.34.46.160/27 Amazon
+13.34.46.192/27 Amazon
+13.34.46.224/27 Amazon
+13.34.47.0/27 Amazon
+13.34.47.32/27 Amazon
+13.34.47.64/27 Amazon
+13.34.47.96/27 Amazon
+13.34.47.128/27 Amazon
+13.34.47.160/27 Amazon
+13.34.47.192/27 Amazon
+13.34.47.224/27 Amazon
+13.34.48.0/27 Amazon
+13.34.48.32/27 Amazon
+13.34.48.64/27 Amazon
+13.34.48.96/27 Amazon
+13.34.48.128/27 Amazon
+13.34.48.160/27 Amazon
+13.34.48.192/27 Amazon
+13.34.48.224/27 Amazon
+13.34.49.0/27 Amazon
+13.34.49.32/27 Amazon
+13.34.49.64/27 Amazon
+13.34.49.96/27 Amazon
+13.34.49.128/27 Amazon
+13.34.49.160/27 Amazon
+13.34.49.192/27 Amazon
+13.34.49.224/27 Amazon
+13.34.50.0/27 Amazon
+13.34.50.32/27 Amazon
+13.34.50.64/27 Amazon
+13.34.50.96/27 Amazon
+13.34.50.128/27 Amazon
+13.34.50.160/27 Amazon
+13.34.50.192/27 Amazon
+13.34.50.224/27 Amazon
+13.34.51.0/27 Amazon
+13.34.51.32/27 Amazon
+13.34.51.64/27 Amazon
+13.34.51.96/27 Amazon
+13.34.51.128/27 Amazon
+13.34.51.160/27 Amazon
+13.34.51.192/27 Amazon
+13.34.51.224/27 Amazon
+13.34.52.0/27 Amazon
+13.34.52.32/27 Amazon
+13.34.52.64/27 Amazon
+13.34.52.96/27 Amazon
+13.34.52.128/27 Amazon
+13.34.52.160/27 Amazon
+13.34.52.192/27 Amazon
+13.34.52.224/27 Amazon
+13.34.53.0/27 Amazon
+13.34.53.32/27 Amazon
+13.34.53.64/27 Amazon
+13.34.53.96/27 Amazon
+13.34.53.128/27 Amazon
+13.34.53.160/27 Amazon
+13.34.53.192/27 Amazon
+13.34.53.224/27 Amazon
+13.34.54.0/27 Amazon
+13.34.54.32/27 Amazon
+13.34.54.64/27 Amazon
+13.34.54.96/27 Amazon
+13.34.54.128/27 Amazon
+13.34.54.160/27 Amazon
+13.34.54.192/27 Amazon
+13.34.54.224/27 Amazon
+13.34.55.0/27 Amazon
+13.34.55.32/27 Amazon
+13.34.55.64/27 Amazon
+13.34.55.96/27 Amazon
+13.34.55.128/27 Amazon
+13.34.55.160/27 Amazon
+13.34.55.192/27 Amazon
+13.34.55.224/27 Amazon
+13.34.56.0/27 Amazon
+13.34.56.32/27 Amazon
+13.34.56.64/27 Amazon
+13.34.56.96/27 Amazon
+13.34.56.128/27 Amazon
+13.34.56.160/27 Amazon
+13.34.56.192/27 Amazon
+13.34.56.224/27 Amazon
+13.34.57.0/27 Amazon
+13.34.57.32/27 Amazon
+13.34.57.64/27 Amazon
+13.34.57.96/27 Amazon
+13.34.57.128/27 Amazon
+13.34.57.160/27 Amazon
+13.34.57.192/27 Amazon
+13.34.57.224/27 Amazon
+13.34.58.0/27 Amazon
+13.34.58.32/27 Amazon
+13.34.58.64/27 Amazon
+13.34.58.96/27 Amazon
+13.34.58.128/27 Amazon
+13.34.58.160/27 Amazon
+13.34.58.192/27 Amazon
+13.34.58.224/27 Amazon
+13.34.59.0/27 Amazon
+13.34.59.32/27 Amazon
+13.34.59.64/27 Amazon
+13.34.59.96/27 Amazon
+13.34.59.128/27 Amazon
+13.34.59.160/27 Amazon
+13.34.59.192/27 Amazon
+13.34.59.224/27 Amazon
+13.34.60.0/27 Amazon
+13.34.60.32/27 Amazon
+13.34.60.64/27 Amazon
+13.34.60.96/27 Amazon
+13.34.60.128/27 Amazon
+13.34.60.160/27 Amazon
+13.34.60.192/27 Amazon
+13.34.60.224/27 Amazon
+13.34.61.0/27 Amazon
+13.34.61.32/27 Amazon
+13.34.61.64/27 Amazon
+13.34.61.96/27 Amazon
+13.34.61.128/27 Amazon
+13.34.61.160/27 Amazon
+13.34.61.192/27 Amazon
+13.34.61.224/27 Amazon
+13.34.62.0/27 Amazon
+13.34.62.32/27 Amazon
+13.34.62.128/27 Amazon
+13.34.62.160/27 Amazon
+13.34.62.192/27 Amazon
+13.34.62.224/27 Amazon
+13.34.63.0/27 Amazon
+13.34.63.32/27 Amazon
+13.34.63.64/27 Amazon
+13.34.63.96/27 Amazon
+13.34.63.128/27 Amazon
+13.34.63.160/27 Amazon
+13.35.0.0/16 Amazon
+13.36.0.0/14 Amazon
+13.40.0.0/14 Amazon
+13.44.0.0/14 Amazon
+13.48.0.0/15 Amazon
+13.50.0.0/16 Amazon
+13.51.0.0/16 Amazon
+13.52.0.0/16 Amazon
+13.53.0.0/16 Amazon
+13.54.0.0/15 Amazon
+13.56.0.0/16 Amazon
+13.57.0.0/16 Amazon
+13.58.0.0/15 Amazon
+13.112.0.0/14 Amazon
+13.124.0.0/16 Amazon
+13.125.0.0/16 Amazon
+13.126.0.0/15 Amazon
+13.200.0.0/13 Amazon
+13.208.0.0/16 Amazon
+13.209.0.0/16 Amazon
+13.210.0.0/15 Amazon
+13.212.0.0/15 Amazon
+13.214.0.0/15 Amazon
+13.224.0.0/14 Amazon
+13.228.0.0/15 Amazon
+13.230.0.0/15 Amazon
+13.232.0.0/14 Amazon
+13.236.0.0/14 Amazon
+13.244.0.0/15 Amazon
+13.246.0.0/16 Amazon
+13.247.0.0/16 Amazon
+13.248.0.0/20 Amazon
+13.248.16.0/21 Amazon
+13.248.24.0/22 Amazon
+13.248.28.0/22 Amazon
+13.248.32.0/20 Amazon
+13.248.48.0/21 Amazon
+13.248.56.0/22 Amazon
+13.248.60.0/22 Amazon
+13.248.64.0/24 Amazon
+13.248.65.0/24 Amazon
+13.248.66.0/24 Amazon
+13.248.67.0/24 Amazon
+13.248.68.0/24 Amazon
+13.248.69.0/24 Amazon
+13.248.70.0/24 Amazon
+13.248.71.0/24 Amazon
+13.248.96.0/24 Amazon
+13.248.97.0/24 Amazon
+13.248.98.0/24 Amazon
+13.248.99.0/24 Amazon
+13.248.100.0/24 Amazon
+13.248.101.0/24 Amazon
+13.248.102.0/24 Amazon
+13.248.103.0/24 Amazon
+13.248.104.0/24 Amazon
+13.248.105.0/24 Amazon
+13.248.106.0/24 Amazon
+13.248.107.0/24 Amazon
+13.248.108.0/24 Amazon
+13.248.109.0/24 Amazon
+13.248.111.0/24 Amazon
+13.248.112.0/24 Amazon
+13.248.113.0/24 Amazon
+13.248.114.0/24 Amazon
+13.248.115.0/24 Amazon
+13.248.116.0/24 Amazon
+13.248.117.0/24 Amazon
+13.248.118.0/24 Amazon
+13.248.119.0/24 Amazon
+13.248.120.0/24 Amazon
+13.248.121.0/24 Amazon
+13.248.122.0/24 Amazon
+13.248.123.0/24 Amazon
+13.248.124.0/24 Amazon
+13.248.125.0/24 Amazon
+13.248.126.0/24 Amazon
+13.248.127.0/24 Amazon
+13.248.128.0/17 Amazon
+13.249.0.0/16 Amazon
+13.250.0.0/15 Amazon
+15.152.0.0/16 Amazon
+15.156.0.0/15 Amazon
+15.158.0.0/16 Amazon
+15.160.0.0/16 Amazon
+15.161.0.0/16 Amazon
+15.164.0.0/15 Amazon
+15.168.0.0/16 Amazon
+15.177.0.0/18 Amazon
+15.177.64.0/23 Amazon
+15.177.66.0/23 Amazon
+15.177.68.0/23 Amazon
+15.177.70.0/23 Amazon
+15.177.72.0/24 Amazon
+15.177.73.0/24 Amazon
+15.177.74.0/24 Amazon
+15.177.75.0/24 Amazon
+15.177.76.0/24 Amazon
+15.177.77.0/24 Amazon
+15.177.78.0/24 Amazon
+15.177.79.0/24 Amazon
+15.177.80.0/24 Amazon
+15.177.81.0/24 Amazon
+15.177.82.0/24 Amazon
+15.177.83.0/24 Amazon
+15.177.84.0/24 Amazon
+15.177.85.0/24 Amazon
+15.177.86.0/24 Amazon
+15.177.87.0/24 Amazon
+15.177.88.0/24 Amazon
+15.177.89.0/24 Amazon
+15.177.90.0/24 Amazon
+15.177.91.0/24 Amazon
+15.177.92.0/24 Amazon
+15.181.0.0/20 Amazon
+15.181.16.0/20 Amazon
+15.181.32.0/21 Amazon
+15.181.40.0/21 Amazon
+15.181.48.0/20 Amazon
+15.181.64.0/20 Amazon
+15.181.80.0/20 Amazon
+15.181.96.0/20 Amazon
+15.181.112.0/22 Amazon
+15.181.116.0/22 Amazon
+15.181.120.0/21 Amazon
+15.181.128.0/20 Amazon
+15.181.144.0/20 Amazon
+15.181.160.0/20 Amazon
+15.181.176.0/20 Amazon
+15.181.192.0/19 Amazon
+15.181.224.0/21 Amazon
+15.181.232.0/21 Amazon
+15.181.240.0/24 Amazon
+15.181.241.0/24 Amazon
+15.181.242.0/24 Amazon
+15.181.243.0/24 Amazon
+15.181.244.0/24 Amazon
+15.181.245.0/24 Amazon
+15.181.246.0/24 Amazon
+15.181.247.0/24 Amazon
+15.181.248.0/24 Amazon
+15.181.249.0/24 Amazon
+15.181.250.0/24 Amazon
+15.181.251.0/24 Amazon
+15.181.252.0/24 Amazon
+15.181.253.0/24 Amazon
+15.181.254.0/24 Amazon
+15.184.0.0/16 Amazon
+15.185.0.0/16 Amazon
+15.188.0.0/16 Amazon
+15.191.0.0/16 Amazon
+15.193.0.0/19 Amazon
+15.197.0.0/23 Amazon
+15.197.2.0/24 Amazon
+15.197.3.0/24 Amazon
+15.197.4.0/22 Amazon
+15.197.8.0/22 Amazon
+15.197.12.0/22 Amazon
+15.197.16.0/23 Amazon
+15.197.18.0/23 Amazon
+15.197.20.0/22 Amazon
+15.197.24.0/22 Amazon
+15.197.28.0/23 Amazon
+15.197.30.0/23 Amazon
+15.197.32.0/23 Amazon
+15.197.128.0/17 Amazon
+15.200.0.0/16 Amazon
+15.205.0.0/16 Amazon
+15.206.0.0/15 Amazon
+15.220.0.0/20 Amazon
+15.220.16.0/20 Amazon
+15.220.220.0/23 Amazon
+15.220.222.0/23 Amazon
+15.220.224.0/23 Amazon
+15.220.226.0/24 Amazon
+15.220.250.0/23 Amazon
+15.220.252.0/22 Amazon
+15.221.0.0/24 Amazon
+15.221.1.0/24 Amazon
+15.221.2.0/24 Amazon
+15.221.3.0/24 Amazon
+15.221.4.0/23 Amazon
+15.221.6.0/24 Amazon
+15.221.7.0/24 Amazon
+15.221.8.0/21 Amazon
+15.221.16.0/22 Amazon
+15.221.20.0/22 Amazon
+15.221.24.0/21 Amazon
+15.221.33.0/24 Amazon
+15.221.34.0/24 Amazon
+15.221.35.0/24 Amazon
+15.221.36.0/22 Amazon
+15.221.40.0/21 Amazon
+15.221.48.0/24 Amazon
+15.221.49.0/24 Amazon
+15.221.50.0/24 Amazon
+15.221.51.0/24 Amazon
+15.221.52.0/24 Amazon
+15.221.53.0/24 Amazon
+15.222.0.0/15 Amazon
+15.228.0.0/15 Amazon
+15.230.0.4/32 Amazon
+15.230.0.5/32 Amazon
+15.230.0.6/31 Amazon
+15.230.0.12/31 Amazon
+15.230.0.14/32 Amazon
+15.230.4.19/32 Amazon
+15.230.4.152/31 Amazon
+15.230.4.154/31 Amazon
+15.230.4.156/31 Amazon
+15.230.4.158/31 Amazon
+15.230.4.160/31 Amazon
+15.230.4.162/31 Amazon
+15.230.4.176/28 Amazon
+15.230.5.0/24 Amazon
+15.230.6.0/24 Amazon
+15.230.14.12/32 Amazon
+15.230.14.18/31 Amazon
+15.230.14.20/31 Amazon
+15.230.14.252/31 Amazon
+15.230.16.0/32 Amazon
+15.230.16.12/32 Amazon
+15.230.16.17/32 Amazon
+15.230.16.18/31 Amazon
+15.230.16.20/31 Amazon
+15.230.16.252/31 Amazon
+15.230.18.0/24 Amazon
+15.230.21.0/24 Amazon
+15.230.22.0/24 Amazon
+15.230.23.0/24 Amazon
+15.230.24.0/22 Amazon
+15.230.28.0/24 Amazon
+15.230.29.0/24 Amazon
+15.230.30.0/24 Amazon
+15.230.31.0/24 Amazon
+15.230.32.0/24 Amazon
+15.230.35.0/24 Amazon
+15.230.36.0/23 Amazon
+15.230.38.0/24 Amazon
+15.230.39.0/31 Amazon
+15.230.39.2/31 Amazon
+15.230.39.4/31 Amazon
+15.230.39.6/31 Amazon
+15.230.39.8/31 Amazon
+15.230.39.10/31 Amazon
+15.230.39.12/31 Amazon
+15.230.39.14/31 Amazon
+15.230.39.16/31 Amazon
+15.230.39.18/31 Amazon
+15.230.39.20/31 Amazon
+15.230.39.22/31 Amazon
+15.230.39.24/31 Amazon
+15.230.39.26/31 Amazon
+15.230.39.28/31 Amazon
+15.230.39.30/31 Amazon
+15.230.39.32/31 Amazon
+15.230.39.34/31 Amazon
+15.230.39.36/31 Amazon
+15.230.39.38/31 Amazon
+15.230.39.40/31 Amazon
+15.230.39.42/31 Amazon
+15.230.39.44/31 Amazon
+15.230.39.46/31 Amazon
+15.230.39.48/31 Amazon
+15.230.39.50/31 Amazon
+15.230.39.52/31 Amazon
+15.230.39.54/31 Amazon
+15.230.39.56/31 Amazon
+15.230.39.58/31 Amazon
+15.230.39.60/31 Amazon
+15.230.39.62/31 Amazon
+15.230.39.64/31 Amazon
+15.230.39.66/31 Amazon
+15.230.39.68/31 Amazon
+15.230.39.70/31 Amazon
+15.230.39.72/31 Amazon
+15.230.39.74/31 Amazon
+15.230.39.76/31 Amazon
+15.230.39.78/31 Amazon
+15.230.39.80/31 Amazon
+15.230.39.82/31 Amazon
+15.230.39.84/31 Amazon
+15.230.39.86/31 Amazon
+15.230.39.88/31 Amazon
+15.230.39.90/31 Amazon
+15.230.39.92/31 Amazon
+15.230.39.94/31 Amazon
+15.230.39.96/31 Amazon
+15.230.39.98/31 Amazon
+15.230.39.100/31 Amazon
+15.230.39.102/31 Amazon
+15.230.39.104/31 Amazon
+15.230.39.106/31 Amazon
+15.230.39.108/31 Amazon
+15.230.39.110/31 Amazon
+15.230.39.112/31 Amazon
+15.230.39.114/31 Amazon
+15.230.39.116/31 Amazon
+15.230.39.118/31 Amazon
+15.230.39.120/31 Amazon
+15.230.39.122/31 Amazon
+15.230.39.124/31 Amazon
+15.230.39.126/31 Amazon
+15.230.39.128/31 Amazon
+15.230.39.130/31 Amazon
+15.230.39.132/31 Amazon
+15.230.39.134/31 Amazon
+15.230.39.136/31 Amazon
+15.230.39.138/31 Amazon
+15.230.39.140/31 Amazon
+15.230.39.142/31 Amazon
+15.230.39.144/31 Amazon
+15.230.39.146/31 Amazon
+15.230.39.148/31 Amazon
+15.230.39.150/31 Amazon
+15.230.39.152/31 Amazon
+15.230.39.154/31 Amazon
+15.230.39.156/31 Amazon
+15.230.39.158/31 Amazon
+15.230.39.160/31 Amazon
+15.230.39.162/31 Amazon
+15.230.39.164/31 Amazon
+15.230.39.166/31 Amazon
+15.230.39.168/31 Amazon
+15.230.39.170/31 Amazon
+15.230.39.172/31 Amazon
+15.230.39.174/31 Amazon
+15.230.39.176/31 Amazon
+15.230.39.178/31 Amazon
+15.230.39.180/31 Amazon
+15.230.39.182/31 Amazon
+15.230.39.184/31 Amazon
+15.230.39.186/31 Amazon
+15.230.39.188/31 Amazon
+15.230.39.190/31 Amazon
+15.230.39.192/31 Amazon
+15.230.39.194/31 Amazon
+15.230.39.196/31 Amazon
+15.230.39.198/31 Amazon
+15.230.39.200/31 Amazon
+15.230.39.202/31 Amazon
+15.230.39.204/31 Amazon
+15.230.39.206/31 Amazon
+15.230.39.208/31 Amazon
+15.230.39.210/31 Amazon
+15.230.39.212/31 Amazon
+15.230.39.214/31 Amazon
+15.230.39.216/31 Amazon
+15.230.39.218/31 Amazon
+15.230.39.220/31 Amazon
+15.230.39.222/31 Amazon
+15.230.39.224/31 Amazon
+15.230.39.226/31 Amazon
+15.230.39.228/31 Amazon
+15.230.39.230/31 Amazon
+15.230.39.232/31 Amazon
+15.230.39.234/31 Amazon
+15.230.39.236/31 Amazon
+15.230.39.238/31 Amazon
+15.230.39.240/31 Amazon
+15.230.39.242/31 Amazon
+15.230.39.244/31 Amazon
+15.230.39.246/31 Amazon
+15.230.39.248/31 Amazon
+15.230.39.250/31 Amazon
+15.230.39.252/31 Amazon
+15.230.39.254/31 Amazon
+15.230.40.0/24 Amazon
+15.230.41.0/24 Amazon
+15.230.42.0/24 Amazon
+15.230.43.0/24 Amazon
+15.230.49.0/24 Amazon
+15.230.50.0/24 Amazon
+15.230.51.0/24 Amazon
+15.230.52.0/24 Amazon
+15.230.53.0/24 Amazon
+15.230.54.0/24 Amazon
+15.230.55.0/24 Amazon
+15.230.56.0/24 Amazon
+15.230.57.0/24 Amazon
+15.230.58.0/24 Amazon
+15.230.59.0/24 Amazon
+15.230.60.0/24 Amazon
+15.230.61.0/24 Amazon
+15.230.64.192/26 Amazon
+15.230.65.0/26 Amazon
+15.230.65.64/26 Amazon
+15.230.65.128/25 Amazon
+15.230.66.0/25 Amazon
+15.230.66.128/25 Amazon
+15.230.67.0/26 Amazon
+15.230.67.64/26 Amazon
+15.230.67.128/26 Amazon
+15.230.67.192/26 Amazon
+15.230.68.0/26 Amazon
+15.230.68.64/26 Amazon
+15.230.68.128/26 Amazon
+15.230.68.192/26 Amazon
+15.230.69.0/26 Amazon
+15.230.69.64/26 Amazon
+15.230.69.128/26 Amazon
+15.230.69.192/26 Amazon
+15.230.70.0/26 Amazon
+15.230.70.64/26 Amazon
+15.230.70.128/26 Amazon
+15.230.70.192/26 Amazon
+15.230.71.0/26 Amazon
+15.230.71.64/26 Amazon
+15.230.71.128/26 Amazon
+15.230.71.192/26 Amazon
+15.230.72.0/26 Amazon
+15.230.72.64/26 Amazon
+15.230.72.128/26 Amazon
+15.230.72.192/26 Amazon
+15.230.73.0/26 Amazon
+15.230.73.64/26 Amazon
+15.230.73.128/26 Amazon
+15.230.73.192/26 Amazon
+15.230.74.0/26 Amazon
+15.230.74.64/26 Amazon
+15.230.74.128/26 Amazon
+15.230.74.192/26 Amazon
+15.230.75.0/26 Amazon
+15.230.75.64/26 Amazon
+15.230.75.128/26 Amazon
+15.230.75.192/26 Amazon
+15.230.76.0/26 Amazon
+15.230.76.64/26 Amazon
+15.230.76.128/26 Amazon
+15.230.76.192/26 Amazon
+15.230.77.0/26 Amazon
+15.230.77.64/26 Amazon
+15.230.77.128/26 Amazon
+15.230.77.192/26 Amazon
+15.230.78.0/26 Amazon
+15.230.78.64/26 Amazon
+15.230.78.128/26 Amazon
+15.230.78.192/26 Amazon
+15.230.79.0/26 Amazon
+15.230.79.64/26 Amazon
+15.230.79.128/26 Amazon
+15.230.80.0/24 Amazon
+15.230.81.0/24 Amazon
+15.230.82.0/24 Amazon
+15.230.83.0/24 Amazon
+15.230.84.0/24 Amazon
+15.230.85.0/24 Amazon
+15.230.86.0/24 Amazon
+15.230.87.0/24 Amazon
+15.230.88.0/24 Amazon
+15.230.89.0/24 Amazon
+15.230.90.0/24 Amazon
+15.230.91.0/24 Amazon
+15.230.92.0/24 Amazon
+15.230.93.0/24 Amazon
+15.230.94.0/24 Amazon
+15.230.129.0/24 Amazon
+15.230.130.0/24 Amazon
+15.230.131.0/32 Amazon
+15.230.131.1/32 Amazon
+15.230.131.2/32 Amazon
+15.230.131.3/32 Amazon
+15.230.131.4/32 Amazon
+15.230.131.5/32 Amazon
+15.230.131.6/32 Amazon
+15.230.131.7/32 Amazon
+15.230.131.8/32 Amazon
+15.230.131.9/32 Amazon
+15.230.131.10/31 Amazon
+15.230.131.12/31 Amazon
+15.230.131.14/32 Amazon
+15.230.131.15/32 Amazon
+15.230.131.16/28 Amazon
+15.230.131.32/28 Amazon
+15.230.131.48/28 Amazon
+15.230.131.64/28 Amazon
+15.230.131.80/28 Amazon
+15.230.131.96/28 Amazon
+15.230.131.112/28 Amazon
+15.230.131.128/28 Amazon
+15.230.131.144/28 Amazon
+15.230.131.160/31 Amazon
+15.230.131.162/31 Amazon
+15.230.131.164/31 Amazon
+15.230.131.166/31 Amazon
+15.230.131.168/31 Amazon
+15.230.131.170/31 Amazon
+15.230.131.172/31 Amazon
+15.230.131.174/31 Amazon
+15.230.132.0/24 Amazon
+15.230.133.0/28 Amazon
+15.230.133.16/32 Amazon
+15.230.133.17/32 Amazon
+15.230.133.18/31 Amazon
+15.230.133.20/31 Amazon
+15.230.133.22/31 Amazon
+15.230.133.24/32 Amazon
+15.230.133.26/31 Amazon
+15.230.133.28/31 Amazon
+15.230.134.0/24 Amazon
+15.230.135.0/24 Amazon
+15.230.136.0/24 Amazon
+15.230.137.0/24 Amazon
+15.230.138.0/24 Amazon
+15.230.140.0/24 Amazon
+15.230.141.0/24 Amazon
+15.230.142.0/24 Amazon
+15.230.143.0/24 Amazon
+15.230.144.0/24 Amazon
+15.230.145.0/24 Amazon
+15.230.148.0/24 Amazon
+15.230.149.0/31 Amazon
+15.230.149.2/31 Amazon
+15.230.149.4/31 Amazon
+15.230.149.8/31 Amazon
+15.230.149.10/32 Amazon
+15.230.149.11/32 Amazon
+15.230.150.0/23 Amazon
+15.230.152.0/24 Amazon
+15.230.153.0/24 Amazon
+15.230.154.0/23 Amazon
+15.230.156.0/24 Amazon
+15.230.157.0/24 Amazon
+15.230.158.0/23 Amazon
+15.230.160.0/24 Amazon
+15.230.161.0/24 Amazon
+15.230.162.0/24 Amazon
+15.230.163.0/24 Amazon
+15.230.164.0/24 Amazon
+15.230.165.0/24 Amazon
+15.230.166.0/24 Amazon
+15.230.170.0/23 Amazon
+15.230.173.0/24 Amazon
+15.230.174.0/24 Amazon
+15.230.176.0/24 Amazon
+15.230.177.0/31 Amazon
+15.230.177.2/31 Amazon
+15.230.178.0/24 Amazon
+15.230.179.0/29 Amazon
+15.230.179.8/29 Amazon
+15.230.179.16/29 Amazon
+15.230.181.0/24 Amazon
+15.230.182.0/24 Amazon
+15.230.183.0/24 Amazon
+15.230.184.0/24 Amazon
+15.230.185.0/24 Amazon
+15.230.186.0/24 Amazon
+15.230.188.0/25 Amazon
+15.230.188.128/25 Amazon
+15.230.189.0/25 Amazon
+15.230.189.128/25 Amazon
+15.230.190.0/25 Amazon
+15.230.190.128/25 Amazon
+15.230.192.0/24 Amazon
+15.230.193.0/24 Amazon
+15.230.195.0/24 Amazon
+15.230.196.0/24 Amazon
+15.230.197.0/24 Amazon
+15.230.198.0/24 Amazon
+15.230.199.0/28 Amazon
+15.230.200.0/24 Amazon
+15.230.201.0/24 Amazon
+15.230.202.0/30 Amazon
+15.230.203.0/24 Amazon
+15.230.204.0/32 Amazon
+15.230.204.1/32 Amazon
+15.230.204.2/32 Amazon
+15.230.204.3/32 Amazon
+15.230.205.0/24 Amazon
+15.230.206.0/24 Amazon
+15.230.207.0/24 Amazon
+15.231.0.0/16 Amazon
+15.236.0.0/15 Amazon
+15.248.8.0/22 Amazon
+15.248.16.0/22 Amazon
+15.248.20.0/22 Amazon
+15.248.24.0/22 Amazon
+15.248.28.0/22 Amazon
+15.248.32.0/22 Amazon
+15.248.36.0/22 Amazon
+15.248.40.0/22 Amazon
+15.251.0.0/32 Amazon
+15.251.0.1/32 Amazon
+15.251.0.2/32 Amazon
+15.251.0.3/32 Amazon
+15.251.0.4/32 Amazon
+15.251.0.5/32 Amazon
+15.251.0.6/32 Amazon
+15.251.0.7/32 Amazon
+15.251.0.8/32 Amazon
+15.251.0.9/32 Amazon
+15.251.0.10/32 Amazon
+15.251.0.11/32 Amazon
+15.251.0.12/32 Amazon
+15.251.0.13/32 Amazon
+15.251.0.14/32 Amazon
+15.251.0.15/32 Amazon
+15.253.0.0/16 Amazon
+15.254.0.0/16 Amazon
+16.12.0.0/23 Amazon
+16.12.2.0/24 Amazon
+16.12.4.0/23 Amazon
+16.12.6.0/23 Amazon
+16.12.8.0/24 Amazon
+16.16.0.0/16 Amazon
+16.50.0.0/15 Amazon
+16.62.0.0/15 Amazon
+16.162.0.0/15 Amazon
+16.168.0.0/15 Amazon
+16.170.0.0/15 Amazon
+18.60.0.0/15 Amazon
+18.64.0.0/14 Amazon
+18.100.0.0/15 Amazon
+18.102.0.0/16 Amazon
+18.116.0.0/14 Amazon
+18.130.0.0/16 Amazon
+18.132.0.0/14 Amazon
+18.136.0.0/16 Amazon
+18.138.0.0/15 Amazon
+18.140.0.0/15 Amazon
+18.142.0.0/15 Amazon
+18.144.0.0/15 Amazon
+18.148.0.0/14 Amazon
+18.153.0.0/16 Amazon
+18.156.0.0/14 Amazon
+18.162.0.0/16 Amazon
+18.163.0.0/16 Amazon
+18.166.0.0/15 Amazon
+18.168.0.0/14 Amazon
+18.175.0.0/16 Amazon
+18.176.0.0/15 Amazon
+18.178.0.0/16 Amazon
+18.179.0.0/16 Amazon
+18.180.0.0/15 Amazon
+18.182.0.0/16 Amazon
+18.183.0.0/16 Amazon
+18.184.0.0/15 Amazon
+18.186.0.0/15 Amazon
+18.188.0.0/16 Amazon
+18.189.0.0/16 Amazon
+18.190.0.0/16 Amazon
+18.191.0.0/16 Amazon
+18.192.0.0/15 Amazon
+18.194.0.0/15 Amazon
+18.196.0.0/15 Amazon
+18.198.0.0/15 Amazon
+18.200.0.0/16 Amazon
+18.201.0.0/16 Amazon
+18.202.0.0/15 Amazon
+18.204.0.0/14 Amazon
+18.208.0.0/13 Amazon
+18.216.0.0/14 Amazon
+18.220.0.0/14 Amazon
+18.224.0.0/14 Amazon
+18.228.0.0/16 Amazon
+18.229.0.0/16 Amazon
+18.230.0.0/16 Amazon
+18.231.0.0/16 Amazon
+18.232.0.0/14 Amazon
+18.236.0.0/15 Amazon
+18.246.0.0/16 Amazon
+18.252.0.0/16 Amazon
+18.253.0.0/16 Amazon
+18.254.0.0/16 Amazon
+23.20.0.0/14 Amazon
+27.0.0.0/22 Amazon
+34.192.0.0/12 Amazon
+34.208.0.0/12 Amazon
+34.224.0.0/12 Amazon
+34.240.0.0/13 Amazon
+34.248.0.0/13 Amazon
+35.71.64.0/22 Amazon
+35.71.96.0/24 Amazon
+35.71.97.0/24 Amazon
+35.71.128.0/17 Amazon
+35.72.0.0/13 Amazon
+35.80.0.0/12 Amazon
+35.96.0.0/12 Amazon
+35.152.0.0/16 Amazon
+35.153.0.0/16 Amazon
+35.154.0.0/16 Amazon
+35.155.0.0/16 Amazon
+35.156.0.0/14 Amazon
+35.160.0.0/13 Amazon
+35.168.0.0/13 Amazon
+35.176.0.0/15 Amazon
+35.178.0.0/15 Amazon
+35.180.0.0/16 Amazon
+35.181.0.0/16 Amazon
+35.182.0.0/15 Amazon
+36.103.232.0/25 Amazon
+36.103.232.128/26 Amazon
+43.192.0.0/15 Amazon
+43.194.0.0/16 Amazon
+43.195.0.0/16 Amazon
+43.196.0.0/15 Amazon
+43.198.0.0/15 Amazon
+43.200.0.0/14 Amazon
+43.204.0.0/15 Amazon
+43.206.0.0/15 Amazon
+43.224.76.0/30 Amazon
+43.224.76.4/30 Amazon
+43.224.76.8/30 Amazon
+43.224.76.12/30 Amazon
+43.224.76.16/30 Amazon
+43.224.76.20/30 Amazon
+43.224.76.24/30 Amazon
+43.224.76.28/30 Amazon
+43.224.76.32/30 Amazon
+43.224.76.36/30 Amazon
+43.224.76.40/30 Amazon
+43.224.76.44/30 Amazon
+43.224.76.48/30 Amazon
+43.224.76.52/30 Amazon
+43.224.76.56/30 Amazon
+43.224.76.60/30 Amazon
+43.224.76.64/30 Amazon
+43.224.76.68/30 Amazon
+43.224.76.72/30 Amazon
+43.224.76.76/30 Amazon
+43.224.76.80/30 Amazon
+43.224.76.84/30 Amazon
+43.224.76.88/30 Amazon
+43.224.76.92/30 Amazon
+43.224.76.96/30 Amazon
+43.224.76.100/30 Amazon
+43.224.76.104/30 Amazon
+43.224.76.108/30 Amazon
+43.224.76.112/30 Amazon
+43.224.76.116/30 Amazon
+43.224.76.120/30 Amazon
+43.224.76.124/30 Amazon
+43.224.76.128/30 Amazon
+43.224.76.132/30 Amazon
+43.224.76.136/30 Amazon
+43.224.76.140/30 Amazon
+43.224.76.144/30 Amazon
+43.224.76.148/30 Amazon
+43.224.76.152/30 Amazon
+43.224.76.156/30 Amazon
+43.224.76.160/30 Amazon
+43.224.76.164/30 Amazon
+43.224.76.168/30 Amazon
+43.224.76.172/30 Amazon
+43.224.76.176/30 Amazon
+43.224.76.180/30 Amazon
+43.224.76.184/30 Amazon
+43.224.76.188/30 Amazon
+43.224.76.192/30 Amazon
+43.224.76.196/30 Amazon
+43.224.76.200/30 Amazon
+43.224.76.204/30 Amazon
+43.224.76.208/30 Amazon
+43.224.76.212/30 Amazon
+43.224.76.216/30 Amazon
+43.224.76.220/30 Amazon
+43.224.76.224/30 Amazon
+43.224.76.228/30 Amazon
+43.224.76.232/30 Amazon
+43.224.76.236/30 Amazon
+43.224.76.240/30 Amazon
+43.224.76.244/30 Amazon
+43.224.76.248/30 Amazon
+43.224.77.0/29 Amazon
+43.224.77.8/29 Amazon
+43.224.77.24/30 Amazon
+43.224.77.28/30 Amazon
+43.224.77.32/30 Amazon
+43.224.77.36/30 Amazon
+43.224.77.40/30 Amazon
+43.224.77.44/30 Amazon
+43.224.77.76/30 Amazon
+43.224.77.80/30 Amazon
+43.224.77.84/30 Amazon
+43.224.77.88/30 Amazon
+43.224.77.92/30 Amazon
+43.224.77.96/30 Amazon
+43.224.77.100/30 Amazon
+43.224.77.104/30 Amazon
+43.224.77.108/30 Amazon
+43.224.77.112/30 Amazon
+43.224.77.116/30 Amazon
+43.224.77.120/30 Amazon
+43.224.77.124/30 Amazon
+43.224.77.128/30 Amazon
+43.224.77.132/30 Amazon
+43.224.77.136/30 Amazon
+43.224.77.140/30 Amazon
+43.224.77.144/30 Amazon
+43.224.77.148/30 Amazon
+43.224.77.152/30 Amazon
+43.224.77.156/30 Amazon
+43.224.77.168/30 Amazon
+43.224.77.172/30 Amazon
+43.224.77.176/30 Amazon
+43.224.77.180/30 Amazon
+43.224.77.184/30 Amazon
+43.224.77.188/30 Amazon
+43.224.77.192/30 Amazon
+43.224.77.208/30 Amazon
+43.224.77.212/30 Amazon
+43.224.79.26/31 Amazon
+43.224.79.28/31 Amazon
+43.224.79.30/31 Amazon
+43.224.79.32/31 Amazon
+43.224.79.34/31 Amazon
+43.224.79.36/31 Amazon
+43.224.79.38/31 Amazon
+43.224.79.40/31 Amazon
+43.224.79.42/31 Amazon
+43.224.79.44/31 Amazon
+43.224.79.46/31 Amazon
+43.224.79.48/31 Amazon
+43.224.79.50/31 Amazon
+43.224.79.52/31 Amazon
+43.224.79.54/31 Amazon
+43.224.79.56/31 Amazon
+43.224.79.58/31 Amazon
+43.224.79.60/31 Amazon
+43.224.79.62/31 Amazon
+43.224.79.64/31 Amazon
+43.224.79.66/31 Amazon
+43.224.79.68/31 Amazon
+43.224.79.70/31 Amazon
+43.224.79.72/31 Amazon
+43.224.79.74/31 Amazon
+43.224.79.76/31 Amazon
+43.224.79.78/31 Amazon
+43.224.79.80/31 Amazon
+43.224.79.82/31 Amazon
+43.224.79.84/31 Amazon
+43.224.79.90/31 Amazon
+43.224.79.92/31 Amazon
+43.224.79.94/31 Amazon
+43.224.79.96/31 Amazon
+43.224.79.98/31 Amazon
+43.224.79.100/31 Amazon
+43.224.79.102/31 Amazon
+43.224.79.104/31 Amazon
+43.224.79.106/31 Amazon
+43.224.79.108/31 Amazon
+43.224.79.110/31 Amazon
+43.224.79.112/31 Amazon
+43.224.79.114/31 Amazon
+43.224.79.116/31 Amazon
+43.224.79.118/31 Amazon
+43.224.79.120/31 Amazon
+43.224.79.122/31 Amazon
+43.224.79.124/31 Amazon
+43.224.79.126/31 Amazon
+43.224.79.128/31 Amazon
+43.224.79.130/31 Amazon
+43.224.79.136/31 Amazon
+43.224.79.138/31 Amazon
+43.224.79.140/31 Amazon
+43.224.79.142/31 Amazon
+43.224.79.144/31 Amazon
+43.224.79.154/31 Amazon
+43.224.79.156/31 Amazon
+43.224.79.158/31 Amazon
+43.224.79.160/31 Amazon
+43.224.79.162/31 Amazon
+43.224.79.164/31 Amazon
+43.224.79.166/31 Amazon
+43.224.79.168/31 Amazon
+43.224.79.174/31 Amazon
+43.224.79.176/31 Amazon
+43.224.79.178/31 Amazon
+43.224.79.180/31 Amazon
+43.224.79.182/31 Amazon
+43.224.79.184/31 Amazon
+43.224.79.186/31 Amazon
+43.224.79.188/31 Amazon
+43.224.79.190/31 Amazon
+43.224.79.192/31 Amazon
+43.224.79.194/31 Amazon
+43.224.79.196/31 Amazon
+43.224.79.198/31 Amazon
+43.224.79.200/31 Amazon
+43.224.79.202/31 Amazon
+43.224.79.204/31 Amazon
+43.224.79.206/31 Amazon
+43.224.79.208/31 Amazon
+43.224.79.210/31 Amazon
+43.224.79.212/31 Amazon
+43.224.79.214/31 Amazon
+43.224.79.216/31 Amazon
+43.224.79.218/31 Amazon
+43.224.79.220/31 Amazon
+43.224.79.222/31 Amazon
+43.224.79.224/31 Amazon
+43.224.79.226/31 Amazon
+43.224.79.228/31 Amazon
+43.224.79.230/31 Amazon
+43.224.79.232/31 Amazon
+43.224.79.234/31 Amazon
+43.224.79.236/31 Amazon
+43.224.79.238/31 Amazon
+43.224.79.240/31 Amazon
+43.224.79.242/31 Amazon
+43.224.79.244/31 Amazon
+43.224.79.246/31 Amazon
+43.224.79.248/31 Amazon
+43.224.79.250/31 Amazon
+43.224.79.252/31 Amazon
+43.224.79.254/31 Amazon
+43.249.45.0/24 Amazon
+43.249.46.0/24 Amazon
+43.249.47.0/24 Amazon
+43.250.192.0/24 Amazon
+43.250.193.0/24 Amazon
+44.192.0.0/11 Amazon
+44.224.0.0/11 Amazon
+46.51.128.0/18 Amazon
+46.51.192.0/20 Amazon
+46.51.208.0/22 Amazon
+46.51.216.0/21 Amazon
+46.51.224.0/19 Amazon
+46.137.0.0/17 Amazon
+46.137.128.0/18 Amazon
+46.137.192.0/19 Amazon
+46.137.224.0/19 Amazon
+50.16.0.0/15 Amazon
+50.18.0.0/16 Amazon
+50.19.0.0/16 Amazon
+50.112.0.0/16 Amazon
+51.20.0.0/14 Amazon
+52.0.0.0/15 Amazon
+52.2.0.0/15 Amazon
+52.4.0.0/14 Amazon
+52.8.0.0/16 Amazon
+52.9.0.0/16 Amazon
+52.10.0.0/15 Amazon
+52.12.0.0/15 Amazon
+52.14.0.0/16 Amazon
+52.15.0.0/16 Amazon
+52.16.0.0/15 Amazon
+52.18.0.0/15 Amazon
+52.20.0.0/14 Amazon
+52.24.0.0/14 Amazon
+52.28.0.0/16 Amazon
+52.29.0.0/16 Amazon
+52.30.0.0/15 Amazon
+52.32.0.0/14 Amazon
+52.36.0.0/14 Amazon
+52.40.0.0/14 Amazon
+52.44.0.0/15 Amazon
+52.46.0.0/18 Amazon
+52.46.64.0/20 Amazon
+52.46.80.0/21 Amazon
+52.46.88.0/22 Amazon
+52.46.92.0/22 Amazon
+52.46.96.0/19 Amazon
+52.46.128.0/19 Amazon
+52.46.164.0/23 Amazon
+52.46.166.0/23 Amazon
+52.46.168.0/23 Amazon
+52.46.170.0/23 Amazon
+52.46.172.0/22 Amazon
+52.46.176.0/22 Amazon
+52.46.180.0/22 Amazon
+52.46.184.0/22 Amazon
+52.46.188.24/30 Amazon
+52.46.188.28/30 Amazon
+52.46.188.36/30 Amazon
+52.46.188.40/30 Amazon
+52.46.188.44/30 Amazon
+52.46.188.48/30 Amazon
+52.46.188.52/30 Amazon
+52.46.188.56/30 Amazon
+52.46.188.60/30 Amazon
+52.46.188.64/30 Amazon
+52.46.188.68/30 Amazon
+52.46.188.72/30 Amazon
+52.46.188.76/30 Amazon
+52.46.188.80/30 Amazon
+52.46.188.84/30 Amazon
+52.46.188.88/30 Amazon
+52.46.188.92/30 Amazon
+52.46.188.96/30 Amazon
+52.46.188.108/30 Amazon
+52.46.188.120/30 Amazon
+52.46.188.132/30 Amazon
+52.46.188.136/30 Amazon
+52.46.188.140/30 Amazon
+52.46.188.144/30 Amazon
+52.46.188.148/30 Amazon
+52.46.188.152/30 Amazon
+52.46.188.156/30 Amazon
+52.46.188.160/30 Amazon
+52.46.188.164/30 Amazon
+52.46.188.168/30 Amazon
+52.46.188.172/30 Amazon
+52.46.188.176/30 Amazon
+52.46.188.180/30 Amazon
+52.46.188.184/30 Amazon
+52.46.188.188/30 Amazon
+52.46.188.192/30 Amazon
+52.46.188.204/30 Amazon
+52.46.188.208/30 Amazon
+52.46.188.216/30 Amazon
+52.46.188.224/30 Amazon
+52.46.188.228/30 Amazon
+52.46.188.232/30 Amazon
+52.46.188.236/30 Amazon
+52.46.188.240/30 Amazon
+52.46.188.244/30 Amazon
+52.46.188.248/30 Amazon
+52.46.188.252/30 Amazon
+52.46.189.0/30 Amazon
+52.46.189.4/30 Amazon
+52.46.189.8/30 Amazon
+52.46.189.12/30 Amazon
+52.46.189.16/30 Amazon
+52.46.189.32/30 Amazon
+52.46.189.36/30 Amazon
+52.46.189.40/30 Amazon
+52.46.189.44/30 Amazon
+52.46.189.48/30 Amazon
+52.46.189.52/30 Amazon
+52.46.189.56/30 Amazon
+52.46.189.60/30 Amazon
+52.46.189.64/30 Amazon
+52.46.189.68/30 Amazon
+52.46.189.72/30 Amazon
+52.46.189.76/30 Amazon
+52.46.189.80/30 Amazon
+52.46.189.84/30 Amazon
+52.46.189.88/30 Amazon
+52.46.189.92/30 Amazon
+52.46.189.96/30 Amazon
+52.46.189.100/30 Amazon
+52.46.189.104/30 Amazon
+52.46.189.108/30 Amazon
+52.46.189.112/30 Amazon
+52.46.189.124/30 Amazon
+52.46.189.128/30 Amazon
+52.46.189.132/30 Amazon
+52.46.189.136/30 Amazon
+52.46.189.140/30 Amazon
+52.46.189.156/30 Amazon
+52.46.189.160/30 Amazon
+52.46.189.168/30 Amazon
+52.46.189.172/30 Amazon
+52.46.189.176/30 Amazon
+52.46.189.180/30 Amazon
+52.46.189.192/30 Amazon
+52.46.189.196/30 Amazon
+52.46.189.200/30 Amazon
+52.46.189.204/30 Amazon
+52.46.189.216/30 Amazon
+52.46.189.220/30 Amazon
+52.46.189.224/30 Amazon
+52.46.189.228/30 Amazon
+52.46.189.240/30 Amazon
+52.46.189.244/30 Amazon
+52.46.189.248/30 Amazon
+52.46.189.252/30 Amazon
+52.46.190.0/30 Amazon
+52.46.190.4/30 Amazon
+52.46.190.8/30 Amazon
+52.46.190.12/30 Amazon
+52.46.190.32/30 Amazon
+52.46.190.36/30 Amazon
+52.46.190.40/30 Amazon
+52.46.190.44/30 Amazon
+52.46.190.52/30 Amazon
+52.46.190.56/30 Amazon
+52.46.190.60/30 Amazon
+52.46.190.64/30 Amazon
+52.46.190.68/30 Amazon
+52.46.190.72/30 Amazon
+52.46.190.76/30 Amazon
+52.46.190.92/30 Amazon
+52.46.190.96/30 Amazon
+52.46.190.100/30 Amazon
+52.46.190.104/30 Amazon
+52.46.190.108/30 Amazon
+52.46.190.120/30 Amazon
+52.46.190.124/30 Amazon
+52.46.190.144/30 Amazon
+52.46.190.148/30 Amazon
+52.46.190.152/30 Amazon
+52.46.190.164/30 Amazon
+52.46.190.168/30 Amazon
+52.46.190.180/31 Amazon
+52.46.190.182/31 Amazon
+52.46.190.188/31 Amazon
+52.46.190.190/31 Amazon
+52.46.190.192/31 Amazon
+52.46.190.202/31 Amazon
+52.46.190.204/31 Amazon
+52.46.190.206/31 Amazon
+52.46.190.208/31 Amazon
+52.46.190.210/31 Amazon
+52.46.190.212/31 Amazon
+52.46.190.214/31 Amazon
+52.46.190.216/31 Amazon
+52.46.190.222/31 Amazon
+52.46.190.224/31 Amazon
+52.46.190.226/31 Amazon
+52.46.190.228/31 Amazon
+52.46.190.230/31 Amazon
+52.46.190.232/31 Amazon
+52.46.190.234/31 Amazon
+52.46.190.236/31 Amazon
+52.46.190.238/31 Amazon
+52.46.190.240/31 Amazon
+52.46.190.242/31 Amazon
+52.46.190.244/31 Amazon
+52.46.190.254/31 Amazon
+52.46.191.0/31 Amazon
+52.46.191.2/31 Amazon
+52.46.191.4/31 Amazon
+52.46.191.6/31 Amazon
+52.46.191.8/31 Amazon
+52.46.191.10/31 Amazon
+52.46.191.12/31 Amazon
+52.46.191.18/31 Amazon
+52.46.191.20/31 Amazon
+52.46.191.22/31 Amazon
+52.46.191.24/31 Amazon
+52.46.191.26/31 Amazon
+52.46.191.28/31 Amazon
+52.46.191.34/31 Amazon
+52.46.191.36/31 Amazon
+52.46.191.42/31 Amazon
+52.46.191.44/31 Amazon
+52.46.191.46/31 Amazon
+52.46.191.48/31 Amazon
+52.46.191.52/31 Amazon
+52.46.191.54/31 Amazon
+52.46.191.60/31 Amazon
+52.46.191.62/31 Amazon
+52.46.191.64/31 Amazon
+52.46.191.66/31 Amazon
+52.46.191.68/31 Amazon
+52.46.191.70/31 Amazon
+52.46.191.72/31 Amazon
+52.46.191.76/31 Amazon
+52.46.191.78/31 Amazon
+52.46.191.80/31 Amazon
+52.46.191.82/31 Amazon
+52.46.191.84/31 Amazon
+52.46.191.86/31 Amazon
+52.46.191.88/31 Amazon
+52.46.191.90/31 Amazon
+52.46.191.92/31 Amazon
+52.46.191.94/31 Amazon
+52.46.191.96/31 Amazon
+52.46.191.98/31 Amazon
+52.46.191.100/31 Amazon
+52.46.191.102/31 Amazon
+52.46.191.104/31 Amazon
+52.46.191.106/31 Amazon
+52.46.191.108/31 Amazon
+52.46.191.110/31 Amazon
+52.46.191.120/31 Amazon
+52.46.191.122/31 Amazon
+52.46.191.124/31 Amazon
+52.46.191.126/31 Amazon
+52.46.191.128/31 Amazon
+52.46.191.130/31 Amazon
+52.46.191.132/31 Amazon
+52.46.191.134/31 Amazon
+52.46.191.136/31 Amazon
+52.46.191.140/31 Amazon
+52.46.191.142/31 Amazon
+52.46.191.144/31 Amazon
+52.46.191.148/31 Amazon
+52.46.191.150/31 Amazon
+52.46.191.152/31 Amazon
+52.46.191.156/31 Amazon
+52.46.191.158/31 Amazon
+52.46.191.164/31 Amazon
+52.46.191.166/31 Amazon
+52.46.191.168/31 Amazon
+52.46.191.170/31 Amazon
+52.46.191.172/31 Amazon
+52.46.191.174/31 Amazon
+52.46.191.176/31 Amazon
+52.46.191.178/31 Amazon
+52.46.191.180/31 Amazon
+52.46.191.182/31 Amazon
+52.46.191.184/31 Amazon
+52.46.191.186/31 Amazon
+52.46.191.188/31 Amazon
+52.46.191.190/31 Amazon
+52.46.191.192/31 Amazon
+52.46.191.194/31 Amazon
+52.46.191.200/31 Amazon
+52.46.191.202/31 Amazon
+52.46.191.210/31 Amazon
+52.46.191.212/31 Amazon
+52.46.191.214/31 Amazon
+52.46.191.216/31 Amazon
+52.46.191.218/31 Amazon
+52.46.191.220/31 Amazon
+52.46.191.222/31 Amazon
+52.46.191.224/31 Amazon
+52.46.191.226/31 Amazon
+52.46.191.228/31 Amazon
+52.46.191.230/31 Amazon
+52.46.191.232/31 Amazon
+52.46.191.234/31 Amazon
+52.46.191.236/31 Amazon
+52.46.191.238/31 Amazon
+52.46.191.240/31 Amazon
+52.46.192.0/20 Amazon
+52.46.208.0/21 Amazon
+52.46.216.0/22 Amazon
+52.46.220.0/22 Amazon
+52.46.224.0/20 Amazon
+52.46.240.0/22 Amazon
+52.46.249.0/24 Amazon
+52.46.250.0/23 Amazon
+52.46.252.0/22 Amazon
+52.47.0.0/16 Amazon
+52.48.0.0/14 Amazon
+52.52.0.0/15 Amazon
+52.54.0.0/15 Amazon
+52.56.0.0/16 Amazon
+52.57.0.0/16 Amazon
+52.58.0.0/15 Amazon
+52.60.0.0/16 Amazon
+52.61.0.0/16 Amazon
+52.62.0.0/15 Amazon
+52.64.0.0/17 Amazon
+52.64.128.0/17 Amazon
+52.65.0.0/16 Amazon
+52.66.0.0/16 Amazon
+52.67.0.0/16 Amazon
+52.68.0.0/15 Amazon
+52.70.0.0/15 Amazon
+52.72.0.0/15 Amazon
+52.74.0.0/16 Amazon
+52.75.0.0/16 Amazon
+52.76.0.0/17 Amazon
+52.76.128.0/17 Amazon
+52.77.0.0/16 Amazon
+52.78.0.0/16 Amazon
+52.79.0.0/16 Amazon
+52.80.0.0/16 Amazon
+52.81.0.0/16 Amazon
+52.82.0.0/17 Amazon
+52.82.128.0/19 Amazon
+52.82.160.0/22 Amazon
+52.82.164.0/22 Amazon
+52.82.168.0/24 Amazon
+52.82.169.0/28 Amazon
+52.82.169.16/28 Amazon
+52.82.176.0/22 Amazon
+52.82.180.0/22 Amazon
+52.82.184.0/23 Amazon
+52.82.187.0/24 Amazon
+52.82.188.0/22 Amazon
+52.82.192.0/18 Amazon
+52.83.0.0/16 Amazon
+52.84.0.0/15 Amazon
+52.86.0.0/15 Amazon
+52.88.0.0/15 Amazon
+52.90.0.0/15 Amazon
+52.92.0.0/17 Amazon
+52.92.128.0/17 Amazon
+52.93.0.0/24 Amazon
+52.93.1.0/24 Amazon
+52.93.2.0/24 Amazon
+52.93.3.0/24 Amazon
+52.93.4.0/24 Amazon
+52.93.5.0/24 Amazon
+52.93.8.0/22 Amazon
+52.93.12.12/32 Amazon
+52.93.12.13/32 Amazon
+52.93.14.18/32 Amazon
+52.93.14.19/32 Amazon
+52.93.16.0/24 Amazon
+52.93.17.0/24 Amazon
+52.93.18.178/32 Amazon
+52.93.18.179/32 Amazon
+52.93.19.236/32 Amazon
+52.93.19.237/32 Amazon
+52.93.20.0/24 Amazon
+52.93.21.14/32 Amazon
+52.93.21.15/32 Amazon
+52.93.32.176/32 Amazon
+52.93.32.179/32 Amazon
+52.93.32.180/32 Amazon
+52.93.34.40/32 Amazon
+52.93.34.42/32 Amazon
+52.93.34.56/32 Amazon
+52.93.34.57/32 Amazon
+52.93.34.120/31 Amazon
+52.93.34.122/31 Amazon
+52.93.34.124/31 Amazon
+52.93.34.126/31 Amazon
+52.93.35.212/32 Amazon
+52.93.35.213/32 Amazon
+52.93.37.222/32 Amazon
+52.93.37.223/32 Amazon
+52.93.38.0/24 Amazon
+52.93.43.0/24 Amazon
+52.93.48.0/24 Amazon
+52.93.50.128/32 Amazon
+52.93.50.129/32 Amazon
+52.93.50.130/32 Amazon
+52.93.50.131/32 Amazon
+52.93.50.132/31 Amazon
+52.93.50.134/31 Amazon
+52.93.50.136/31 Amazon
+52.93.50.138/31 Amazon
+52.93.50.140/31 Amazon
+52.93.50.142/31 Amazon
+52.93.50.144/31 Amazon
+52.93.50.146/31 Amazon
+52.93.50.148/31 Amazon
+52.93.50.150/31 Amazon
+52.93.50.152/31 Amazon
+52.93.50.154/31 Amazon
+52.93.50.156/31 Amazon
+52.93.50.158/31 Amazon
+52.93.50.160/31 Amazon
+52.93.50.162/31 Amazon
+52.93.50.164/31 Amazon
+52.93.50.166/31 Amazon
+52.93.50.168/31 Amazon
+52.93.50.170/31 Amazon
+52.93.50.172/31 Amazon
+52.93.50.174/31 Amazon
+52.93.50.176/31 Amazon
+52.93.50.178/31 Amazon
+52.93.50.180/31 Amazon
+52.93.50.182/31 Amazon
+52.93.50.184/31 Amazon
+52.93.50.186/31 Amazon
+52.93.50.188/31 Amazon
+52.93.50.190/31 Amazon
+52.93.50.192/31 Amazon
+52.93.50.194/31 Amazon
+52.93.51.28/32 Amazon
+52.93.51.29/32 Amazon
+52.93.55.144/31 Amazon
+52.93.55.146/31 Amazon
+52.93.55.148/31 Amazon
+52.93.55.152/31 Amazon
+52.93.55.154/31 Amazon
+52.93.55.156/31 Amazon
+52.93.55.158/31 Amazon
+52.93.55.160/31 Amazon
+52.93.55.162/31 Amazon
+52.93.55.164/31 Amazon
+52.93.55.166/31 Amazon
+52.93.56.0/24 Amazon
+52.93.57.0/24 Amazon
+52.93.58.32/28 Amazon
+52.93.59.0/24 Amazon
+52.93.60.0/24 Amazon
+52.93.62.0/24 Amazon
+52.93.63.0/24 Amazon
+52.93.64.0/24 Amazon
+52.93.66.0/24 Amazon
+52.93.67.0/24 Amazon
+52.93.69.0/24 Amazon
+52.93.71.37/32 Amazon
+52.93.73.0/26 Amazon
+52.93.75.0/24 Amazon
+52.93.76.0/24 Amazon
+52.93.78.0/24 Amazon
+52.93.80.0/24 Amazon
+52.93.81.0/24 Amazon
+52.93.87.96/27 Amazon
+52.93.91.96/32 Amazon
+52.93.91.97/32 Amazon
+52.93.91.98/32 Amazon
+52.93.91.99/32 Amazon
+52.93.91.100/32 Amazon
+52.93.91.101/32 Amazon
+52.93.91.102/32 Amazon
+52.93.91.103/32 Amazon
+52.93.91.104/32 Amazon
+52.93.91.105/32 Amazon
+52.93.91.106/32 Amazon
+52.93.91.107/32 Amazon
+52.93.91.108/32 Amazon
+52.93.91.109/32 Amazon
+52.93.91.110/32 Amazon
+52.93.91.111/32 Amazon
+52.93.91.112/32 Amazon
+52.93.91.113/32 Amazon
+52.93.91.114/32 Amazon
+52.93.91.115/32 Amazon
+52.93.92.64/31 Amazon
+52.93.92.66/31 Amazon
+52.93.92.68/31 Amazon
+52.93.92.70/31 Amazon
+52.93.92.72/31 Amazon
+52.93.92.74/31 Amazon
+52.93.96.0/24 Amazon
+52.93.97.0/24 Amazon
+52.93.98.0/24 Amazon
+52.93.99.0/24 Amazon
+52.93.112.0/24 Amazon
+52.93.120.176/32 Amazon
+52.93.120.177/32 Amazon
+52.93.120.178/32 Amazon
+52.93.120.179/32 Amazon
+52.93.121.187/32 Amazon
+52.93.121.188/32 Amazon
+52.93.121.189/32 Amazon
+52.93.121.190/32 Amazon
+52.93.121.195/32 Amazon
+52.93.121.196/32 Amazon
+52.93.121.197/32 Amazon
+52.93.121.198/32 Amazon
+52.93.122.131/32 Amazon
+52.93.122.202/32 Amazon
+52.93.122.203/32 Amazon
+52.93.122.218/32 Amazon
+52.93.122.255/32 Amazon
+52.93.123.6/32 Amazon
+52.93.123.11/32 Amazon
+52.93.123.98/32 Amazon
+52.93.123.99/32 Amazon
+52.93.123.136/32 Amazon
+52.93.123.255/32 Amazon
+52.93.124.14/32 Amazon
+52.93.124.15/32 Amazon
+52.93.124.96/32 Amazon
+52.93.124.97/32 Amazon
+52.93.124.210/32 Amazon
+52.93.124.211/32 Amazon
+52.93.124.212/32 Amazon
+52.93.124.213/32 Amazon
+52.93.125.42/32 Amazon
+52.93.125.43/32 Amazon
+52.93.126.76/32 Amazon
+52.93.126.122/32 Amazon
+52.93.126.123/32 Amazon
+52.93.126.132/32 Amazon
+52.93.126.133/32 Amazon
+52.93.126.134/32 Amazon
+52.93.126.135/32 Amazon
+52.93.126.136/32 Amazon
+52.93.126.137/32 Amazon
+52.93.126.138/32 Amazon
+52.93.126.139/32 Amazon
+52.93.126.144/32 Amazon
+52.93.126.145/32 Amazon
+52.93.126.146/32 Amazon
+52.93.126.147/32 Amazon
+52.93.126.198/32 Amazon
+52.93.126.199/32 Amazon
+52.93.126.204/32 Amazon
+52.93.126.205/32 Amazon
+52.93.126.206/32 Amazon
+52.93.126.207/32 Amazon
+52.93.126.212/32 Amazon
+52.93.126.213/32 Amazon
+52.93.126.214/32 Amazon
+52.93.126.215/32 Amazon
+52.93.126.234/32 Amazon
+52.93.126.235/32 Amazon
+52.93.126.244/32 Amazon
+52.93.126.245/32 Amazon
+52.93.126.250/32 Amazon
+52.93.126.251/32 Amazon
+52.93.127.17/32 Amazon
+52.93.127.18/32 Amazon
+52.93.127.19/32 Amazon
+52.93.127.24/32 Amazon
+52.93.127.25/32 Amazon
+52.93.127.26/32 Amazon
+52.93.127.27/32 Amazon
+52.93.127.68/32 Amazon
+52.93.127.69/32 Amazon
+52.93.127.70/32 Amazon
+52.93.127.71/32 Amazon
+52.93.127.92/32 Amazon
+52.93.127.93/32 Amazon
+52.93.127.94/32 Amazon
+52.93.127.95/32 Amazon
+52.93.127.96/32 Amazon
+52.93.127.97/32 Amazon
+52.93.127.98/32 Amazon
+52.93.127.99/32 Amazon
+52.93.127.100/32 Amazon
+52.93.127.101/32 Amazon
+52.93.127.102/32 Amazon
+52.93.127.103/32 Amazon
+52.93.127.104/32 Amazon
+52.93.127.105/32 Amazon
+52.93.127.106/32 Amazon
+52.93.127.107/32 Amazon
+52.93.127.108/32 Amazon
+52.93.127.109/32 Amazon
+52.93.127.110/32 Amazon
+52.93.127.111/32 Amazon
+52.93.127.112/32 Amazon
+52.93.127.113/32 Amazon
+52.93.127.114/32 Amazon
+52.93.127.115/32 Amazon
+52.93.127.116/32 Amazon
+52.93.127.117/32 Amazon
+52.93.127.118/32 Amazon
+52.93.127.119/32 Amazon
+52.93.127.120/32 Amazon
+52.93.127.121/32 Amazon
+52.93.127.122/32 Amazon
+52.93.127.123/32 Amazon
+52.93.127.124/32 Amazon
+52.93.127.125/32 Amazon
+52.93.127.126/32 Amazon
+52.93.127.127/32 Amazon
+52.93.127.128/32 Amazon
+52.93.127.129/32 Amazon
+52.93.127.130/32 Amazon
+52.93.127.131/32 Amazon
+52.93.127.132/32 Amazon
+52.93.127.133/32 Amazon
+52.93.127.138/32 Amazon
+52.93.127.139/32 Amazon
+52.93.127.146/32 Amazon
+52.93.127.147/32 Amazon
+52.93.127.148/32 Amazon
+52.93.127.149/32 Amazon
+52.93.127.152/32 Amazon
+52.93.127.153/32 Amazon
+52.93.127.154/32 Amazon
+52.93.127.155/32 Amazon
+52.93.127.156/32 Amazon
+52.93.127.157/32 Amazon
+52.93.127.158/32 Amazon
+52.93.127.159/32 Amazon
+52.93.127.160/32 Amazon
+52.93.127.161/32 Amazon
+52.93.127.162/32 Amazon
+52.93.127.163/32 Amazon
+52.93.127.164/32 Amazon
+52.93.127.165/32 Amazon
+52.93.127.166/32 Amazon
+52.93.127.167/32 Amazon
+52.93.127.168/32 Amazon
+52.93.127.169/32 Amazon
+52.93.127.172/32 Amazon
+52.93.127.173/32 Amazon
+52.93.127.174/32 Amazon
+52.93.127.175/32 Amazon
+52.93.127.176/32 Amazon
+52.93.127.177/32 Amazon
+52.93.127.178/32 Amazon
+52.93.127.179/32 Amazon
+52.93.127.180/32 Amazon
+52.93.127.181/32 Amazon
+52.93.127.182/32 Amazon
+52.93.127.183/32 Amazon
+52.93.127.184/32 Amazon
+52.93.127.185/32 Amazon
+52.93.127.194/32 Amazon
+52.93.127.195/32 Amazon
+52.93.127.196/32 Amazon
+52.93.127.197/32 Amazon
+52.93.127.198/32 Amazon
+52.93.127.199/32 Amazon
+52.93.127.200/32 Amazon
+52.93.127.201/32 Amazon
+52.93.127.202/32 Amazon
+52.93.127.203/32 Amazon
+52.93.127.204/32 Amazon
+52.93.127.205/32 Amazon
+52.93.127.206/32 Amazon
+52.93.127.207/32 Amazon
+52.93.127.216/32 Amazon
+52.93.127.217/32 Amazon
+52.93.127.218/32 Amazon
+52.93.127.219/32 Amazon
+52.93.127.220/32 Amazon
+52.93.127.221/32 Amazon
+52.93.127.232/32 Amazon
+52.93.127.237/32 Amazon
+52.93.127.238/32 Amazon
+52.93.127.239/32 Amazon
+52.93.127.244/32 Amazon
+52.93.127.245/32 Amazon
+52.93.127.246/32 Amazon
+52.93.127.247/32 Amazon
+52.93.127.248/32 Amazon
+52.93.127.249/32 Amazon
+52.93.127.250/32 Amazon
+52.93.127.251/32 Amazon
+52.93.127.252/32 Amazon
+52.93.127.253/32 Amazon
+52.93.127.254/32 Amazon
+52.93.127.255/32 Amazon
+52.93.129.95/32 Amazon
+52.93.131.217/32 Amazon
+52.93.133.127/32 Amazon
+52.93.133.129/32 Amazon
+52.93.133.131/32 Amazon
+52.93.133.133/32 Amazon
+52.93.133.153/32 Amazon
+52.93.133.155/32 Amazon
+52.93.133.175/32 Amazon
+52.93.133.177/32 Amazon
+52.93.133.179/32 Amazon
+52.93.133.181/32 Amazon
+52.93.134.181/32 Amazon
+52.93.135.195/32 Amazon
+52.93.137.0/24 Amazon
+52.93.138.252/32 Amazon
+52.93.138.253/32 Amazon
+52.93.139.252/32 Amazon
+52.93.139.253/32 Amazon
+52.93.141.212/32 Amazon
+52.93.141.213/32 Amazon
+52.93.141.214/31 Amazon
+52.93.141.216/31 Amazon
+52.93.141.218/31 Amazon
+52.93.141.220/31 Amazon
+52.93.141.222/31 Amazon
+52.93.141.224/31 Amazon
+52.93.141.226/31 Amazon
+52.93.141.228/31 Amazon
+52.93.141.230/31 Amazon
+52.93.141.232/31 Amazon
+52.93.141.234/31 Amazon
+52.93.141.236/31 Amazon
+52.93.141.238/31 Amazon
+52.93.141.240/31 Amazon
+52.93.141.242/31 Amazon
+52.93.141.244/31 Amazon
+52.93.146.5/32 Amazon
+52.93.149.0/24 Amazon
+52.93.150.0/24 Amazon
+52.93.151.0/24 Amazon
+52.93.153.80/32 Amazon
+52.93.153.148/32 Amazon
+52.93.153.149/32 Amazon
+52.93.153.168/32 Amazon
+52.93.153.169/32 Amazon
+52.93.153.170/32 Amazon
+52.93.153.171/32 Amazon
+52.93.153.172/32 Amazon
+52.93.153.173/32 Amazon
+52.93.153.174/32 Amazon
+52.93.153.175/32 Amazon
+52.93.153.176/32 Amazon
+52.93.153.177/32 Amazon
+52.93.153.178/32 Amazon
+52.93.153.179/32 Amazon
+52.93.156.0/22 Amazon
+52.93.178.128/32 Amazon
+52.93.178.129/32 Amazon
+52.93.178.130/32 Amazon
+52.93.178.131/32 Amazon
+52.93.178.132/32 Amazon
+52.93.178.133/32 Amazon
+52.93.178.134/32 Amazon
+52.93.178.135/32 Amazon
+52.93.178.136/32 Amazon
+52.93.178.137/32 Amazon
+52.93.178.138/32 Amazon
+52.93.178.139/32 Amazon
+52.93.178.140/32 Amazon
+52.93.178.141/32 Amazon
+52.93.178.142/32 Amazon
+52.93.178.143/32 Amazon
+52.93.178.144/32 Amazon
+52.93.178.145/32 Amazon
+52.93.178.146/32 Amazon
+52.93.178.147/32 Amazon
+52.93.178.148/32 Amazon
+52.93.178.149/32 Amazon
+52.93.178.150/32 Amazon
+52.93.178.151/32 Amazon
+52.93.178.152/32 Amazon
+52.93.178.153/32 Amazon
+52.93.178.154/32 Amazon
+52.93.178.155/32 Amazon
+52.93.178.156/32 Amazon
+52.93.178.157/32 Amazon
+52.93.178.158/32 Amazon
+52.93.178.159/32 Amazon
+52.93.178.160/32 Amazon
+52.93.178.161/32 Amazon
+52.93.178.162/32 Amazon
+52.93.178.163/32 Amazon
+52.93.178.164/32 Amazon
+52.93.178.165/32 Amazon
+52.93.178.166/32 Amazon
+52.93.178.167/32 Amazon
+52.93.178.168/32 Amazon
+52.93.178.169/32 Amazon
+52.93.178.170/32 Amazon
+52.93.178.171/32 Amazon
+52.93.178.172/32 Amazon
+52.93.178.173/32 Amazon
+52.93.178.174/32 Amazon
+52.93.178.175/32 Amazon
+52.93.178.176/32 Amazon
+52.93.178.177/32 Amazon
+52.93.178.178/32 Amazon
+52.93.178.179/32 Amazon
+52.93.178.180/32 Amazon
+52.93.178.181/32 Amazon
+52.93.178.182/32 Amazon
+52.93.178.183/32 Amazon
+52.93.178.184/32 Amazon
+52.93.178.185/32 Amazon
+52.93.178.186/32 Amazon
+52.93.178.187/32 Amazon
+52.93.178.188/32 Amazon
+52.93.178.189/32 Amazon
+52.93.178.190/32 Amazon
+52.93.178.191/32 Amazon
+52.93.178.192/32 Amazon
+52.93.178.193/32 Amazon
+52.93.178.194/32 Amazon
+52.93.178.195/32 Amazon
+52.93.178.196/32 Amazon
+52.93.178.197/32 Amazon
+52.93.178.198/32 Amazon
+52.93.178.199/32 Amazon
+52.93.178.200/32 Amazon
+52.93.178.201/32 Amazon
+52.93.178.202/32 Amazon
+52.93.178.203/32 Amazon
+52.93.178.204/32 Amazon
+52.93.178.205/32 Amazon
+52.93.178.206/32 Amazon
+52.93.178.207/32 Amazon
+52.93.178.208/32 Amazon
+52.93.178.209/32 Amazon
+52.93.178.210/32 Amazon
+52.93.178.211/32 Amazon
+52.93.178.212/32 Amazon
+52.93.178.213/32 Amazon
+52.93.178.214/32 Amazon
+52.93.178.215/32 Amazon
+52.93.178.216/32 Amazon
+52.93.178.217/32 Amazon
+52.93.178.218/32 Amazon
+52.93.178.219/32 Amazon
+52.93.178.220/32 Amazon
+52.93.178.221/32 Amazon
+52.93.178.222/32 Amazon
+52.93.178.223/32 Amazon
+52.93.178.224/32 Amazon
+52.93.178.225/32 Amazon
+52.93.178.226/32 Amazon
+52.93.178.227/32 Amazon
+52.93.178.228/32 Amazon
+52.93.178.229/32 Amazon
+52.93.178.230/32 Amazon
+52.93.178.231/32 Amazon
+52.93.178.232/32 Amazon
+52.93.178.233/32 Amazon
+52.93.178.234/32 Amazon
+52.93.178.235/32 Amazon
+52.93.193.192/32 Amazon
+52.93.193.193/32 Amazon
+52.93.193.194/32 Amazon
+52.93.193.195/32 Amazon
+52.93.193.196/32 Amazon
+52.93.193.197/32 Amazon
+52.93.193.198/32 Amazon
+52.93.193.199/32 Amazon
+52.93.193.200/32 Amazon
+52.93.193.201/32 Amazon
+52.93.193.202/32 Amazon
+52.93.193.203/32 Amazon
+52.93.198.0/25 Amazon
+52.93.229.148/32 Amazon
+52.93.229.149/32 Amazon
+52.93.236.0/24 Amazon
+52.93.237.0/24 Amazon
+52.93.240.146/31 Amazon
+52.93.240.148/31 Amazon
+52.93.240.150/31 Amazon
+52.93.240.152/31 Amazon
+52.93.240.154/31 Amazon
+52.93.240.156/31 Amazon
+52.93.240.158/31 Amazon
+52.93.240.160/31 Amazon
+52.93.240.162/31 Amazon
+52.93.240.164/31 Amazon
+52.93.240.166/31 Amazon
+52.93.240.168/31 Amazon
+52.93.240.170/31 Amazon
+52.93.240.172/31 Amazon
+52.93.240.174/31 Amazon
+52.93.240.176/31 Amazon
+52.93.240.178/31 Amazon
+52.93.240.180/31 Amazon
+52.93.240.182/31 Amazon
+52.93.240.184/31 Amazon
+52.93.240.186/31 Amazon
+52.93.240.188/31 Amazon
+52.93.240.190/31 Amazon
+52.93.240.192/31 Amazon
+52.93.240.194/31 Amazon
+52.93.240.196/31 Amazon
+52.93.240.198/31 Amazon
+52.93.240.200/31 Amazon
+52.93.240.202/31 Amazon
+52.93.240.204/31 Amazon
+52.93.245.0/24 Amazon
+52.93.247.0/25 Amazon
+52.93.248.0/24 Amazon
+52.93.249.0/24 Amazon
+52.93.250.0/23 Amazon
+52.93.254.0/24 Amazon
+52.94.0.0/22 Amazon
+52.94.4.0/24 Amazon
+52.94.5.0/24 Amazon
+52.94.6.0/24 Amazon
+52.94.7.0/24 Amazon
+52.94.8.0/24 Amazon
+52.94.9.0/24 Amazon
+52.94.10.0/24 Amazon
+52.94.11.0/24 Amazon
+52.94.12.0/24 Amazon
+52.94.13.0/24 Amazon
+52.94.14.0/24 Amazon
+52.94.15.0/24 Amazon
+52.94.16.0/24 Amazon
+52.94.17.0/24 Amazon
+52.94.18.0/24 Amazon
+52.94.19.0/24 Amazon
+52.94.20.0/24 Amazon
+52.94.22.0/24 Amazon
+52.94.23.0/24 Amazon
+52.94.24.0/23 Amazon
+52.94.26.0/23 Amazon
+52.94.28.0/23 Amazon
+52.94.30.0/24 Amazon
+52.94.32.0/20 Amazon
+52.94.48.0/20 Amazon
+52.94.64.0/22 Amazon
+52.94.68.0/24 Amazon
+52.94.69.0/24 Amazon
+52.94.72.0/22 Amazon
+52.94.76.0/22 Amazon
+52.94.80.0/20 Amazon
+52.94.96.0/20 Amazon
+52.94.112.0/22 Amazon
+52.94.116.0/22 Amazon
+52.94.120.0/22 Amazon
+52.94.124.0/22 Amazon
+52.94.128.0/22 Amazon
+52.94.132.0/22 Amazon
+52.94.136.0/21 Amazon
+52.94.148.0/22 Amazon
+52.94.152.3/32 Amazon
+52.94.152.9/32 Amazon
+52.94.152.11/32 Amazon
+52.94.152.12/32 Amazon
+52.94.152.44/32 Amazon
+52.94.152.60/32 Amazon
+52.94.152.61/32 Amazon
+52.94.152.62/32 Amazon
+52.94.152.63/32 Amazon
+52.94.152.64/32 Amazon
+52.94.152.65/32 Amazon
+52.94.152.66/32 Amazon
+52.94.152.67/32 Amazon
+52.94.152.68/32 Amazon
+52.94.152.69/32 Amazon
+52.94.160.0/20 Amazon
+52.94.176.0/20 Amazon
+52.94.192.0/22 Amazon
+52.94.196.0/24 Amazon
+52.94.197.0/24 Amazon
+52.94.198.0/28 Amazon
+52.94.198.16/28 Amazon
+52.94.198.32/28 Amazon
+52.94.198.48/28 Amazon
+52.94.198.64/28 Amazon
+52.94.198.80/28 Amazon
+52.94.198.96/28 Amazon
+52.94.198.112/28 Amazon
+52.94.198.128/28 Amazon
+52.94.198.144/28 Amazon
+52.94.199.0/24 Amazon
+52.94.200.0/24 Amazon
+52.94.201.0/26 Amazon
+52.94.204.0/23 Amazon
+52.94.206.0/23 Amazon
+52.94.208.0/21 Amazon
+52.94.216.0/21 Amazon
+52.94.224.0/20 Amazon
+52.94.240.0/22 Amazon
+52.94.244.0/22 Amazon
+52.94.248.0/28 Amazon
+52.94.248.16/28 Amazon
+52.94.248.32/28 Amazon
+52.94.248.48/28 Amazon
+52.94.248.64/28 Amazon
+52.94.248.80/28 Amazon
+52.94.248.96/28 Amazon
+52.94.248.112/28 Amazon
+52.94.248.128/28 Amazon
+52.94.248.144/28 Amazon
+52.94.248.160/28 Amazon
+52.94.248.176/28 Amazon
+52.94.248.192/28 Amazon
+52.94.248.208/28 Amazon
+52.94.248.224/28 Amazon
+52.94.249.32/28 Amazon
+52.94.249.48/28 Amazon
+52.94.249.64/28 Amazon
+52.94.249.80/28 Amazon
+52.94.249.96/28 Amazon
+52.94.249.112/28 Amazon
+52.94.249.128/28 Amazon
+52.94.249.144/28 Amazon
+52.94.249.160/28 Amazon
+52.94.249.176/28 Amazon
+52.94.249.192/28 Amazon
+52.94.249.208/28 Amazon
+52.94.249.224/28 Amazon
+52.94.249.240/28 Amazon
+52.94.250.0/28 Amazon
+52.94.250.16/28 Amazon
+52.94.252.0/23 Amazon
+52.94.254.0/23 Amazon
+52.95.0.0/20 Amazon
+52.95.16.0/21 Amazon
+52.95.24.0/22 Amazon
+52.95.28.0/24 Amazon
+52.95.29.0/26 Amazon
+52.95.30.0/23 Amazon
+52.95.34.0/24 Amazon
+52.95.35.0/24 Amazon
+52.95.36.0/22 Amazon
+52.95.40.0/24 Amazon
+52.95.41.0/24 Amazon
+52.95.42.0/24 Amazon
+52.95.48.0/22 Amazon
+52.95.52.0/22 Amazon
+52.95.56.0/22 Amazon
+52.95.60.0/24 Amazon
+52.95.61.0/24 Amazon
+52.95.62.0/24 Amazon
+52.95.63.0/24 Amazon
+52.95.64.0/20 Amazon
+52.95.80.0/20 Amazon
+52.95.96.0/22 Amazon
+52.95.100.0/22 Amazon
+52.95.104.0/22 Amazon
+52.95.108.0/23 Amazon
+52.95.110.0/24 Amazon
+52.95.111.0/24 Amazon
+52.95.112.0/20 Amazon
+52.95.128.0/21 Amazon
+52.95.136.0/23 Amazon
+52.95.138.0/24 Amazon
+52.95.139.0/24 Amazon
+52.95.140.0/23 Amazon
+52.95.142.0/23 Amazon
+52.95.144.0/24 Amazon
+52.95.145.0/24 Amazon
+52.95.146.0/23 Amazon
+52.95.148.0/23 Amazon
+52.95.150.0/24 Amazon
+52.95.151.0/24 Amazon
+52.95.152.0/23 Amazon
+52.95.154.0/23 Amazon
+52.95.156.0/24 Amazon
+52.95.157.0/24 Amazon
+52.95.158.0/23 Amazon
+52.95.160.0/23 Amazon
+52.95.162.0/24 Amazon
+52.95.163.0/24 Amazon
+52.95.164.0/23 Amazon
+52.95.166.0/23 Amazon
+52.95.168.0/24 Amazon
+52.95.169.0/24 Amazon
+52.95.170.0/23 Amazon
+52.95.172.0/23 Amazon
+52.95.174.0/24 Amazon
+52.95.175.0/24 Amazon
+52.95.176.0/24 Amazon
+52.95.177.0/24 Amazon
+52.95.178.0/23 Amazon
+52.95.180.0/24 Amazon
+52.95.181.0/24 Amazon
+52.95.182.0/23 Amazon
+52.95.184.0/23 Amazon
+52.95.186.0/24 Amazon
+52.95.187.0/24 Amazon
+52.95.188.0/23 Amazon
+52.95.190.0/24 Amazon
+52.95.192.0/20 Amazon
+52.95.208.0/22 Amazon
+52.95.212.0/22 Amazon
+52.95.216.0/22 Amazon
+52.95.224.0/24 Amazon
+52.95.225.0/24 Amazon
+52.95.226.0/24 Amazon
+52.95.227.0/24 Amazon
+52.95.228.0/24 Amazon
+52.95.229.0/24 Amazon
+52.95.230.0/24 Amazon
+52.95.235.0/24 Amazon
+52.95.239.0/24 Amazon
+52.95.240.0/24 Amazon
+52.95.241.0/24 Amazon
+52.95.242.0/24 Amazon
+52.95.243.0/24 Amazon
+52.95.244.0/24 Amazon
+52.95.245.0/24 Amazon
+52.95.246.0/24 Amazon
+52.95.247.0/24 Amazon
+52.95.248.0/24 Amazon
+52.95.249.0/24 Amazon
+52.95.250.0/24 Amazon
+52.95.251.0/24 Amazon
+52.95.252.0/24 Amazon
+52.95.253.0/24 Amazon
+52.95.254.0/24 Amazon
+52.95.255.0/28 Amazon
+52.95.255.16/28 Amazon
+52.95.255.32/28 Amazon
+52.95.255.48/28 Amazon
+52.95.255.64/28 Amazon
+52.95.255.80/28 Amazon
+52.95.255.96/28 Amazon
+52.95.255.112/28 Amazon
+52.95.255.128/28 Amazon
+52.95.255.144/28 Amazon
+52.119.128.0/20 Amazon
+52.119.144.0/21 Amazon
+52.119.152.0/22 Amazon
+52.119.156.0/22 Amazon
+52.119.160.0/20 Amazon
+52.119.176.0/21 Amazon
+52.119.184.0/22 Amazon
+52.119.188.0/22 Amazon
+52.119.192.0/22 Amazon
+52.119.196.0/22 Amazon
+52.119.205.0/24 Amazon
+52.119.206.0/23 Amazon
+52.119.208.0/23 Amazon
+52.119.210.0/23 Amazon
+52.119.212.0/23 Amazon
+52.119.214.0/23 Amazon
+52.119.216.0/21 Amazon
+52.119.224.0/21 Amazon
+52.119.232.0/21 Amazon
+52.119.240.0/21 Amazon
+52.119.248.0/24 Amazon
+52.119.249.0/24 Amazon
+52.119.252.0/22 Amazon
+52.124.128.0/17 Amazon
+52.144.133.32/27 Amazon
+52.144.192.0/26 Amazon
+52.144.192.64/26 Amazon
+52.144.192.128/26 Amazon
+52.144.192.192/26 Amazon
+52.144.193.0/26 Amazon
+52.144.193.64/26 Amazon
+52.144.193.128/26 Amazon
+52.144.194.0/26 Amazon
+52.144.194.64/26 Amazon
+52.144.194.128/26 Amazon
+52.144.194.192/26 Amazon
+52.144.195.0/26 Amazon
+52.144.196.192/26 Amazon
+52.144.197.128/26 Amazon
+52.144.197.192/26 Amazon
+52.144.199.128/26 Amazon
+52.144.200.64/26 Amazon
+52.144.200.128/26 Amazon
+52.144.201.64/26 Amazon
+52.144.201.128/26 Amazon
+52.144.205.0/26 Amazon
+52.144.208.0/31 Amazon
+52.144.208.2/31 Amazon
+52.144.208.64/26 Amazon
+52.144.208.128/26 Amazon
+52.144.208.192/26 Amazon
+52.144.209.0/26 Amazon
+52.144.209.64/26 Amazon
+52.144.209.128/26 Amazon
+52.144.209.192/26 Amazon
+52.144.210.0/26 Amazon
+52.144.210.64/26 Amazon
+52.144.210.128/26 Amazon
+52.144.210.192/26 Amazon
+52.144.211.0/26 Amazon
+52.144.211.64/26 Amazon
+52.144.211.128/26 Amazon
+52.144.211.192/31 Amazon
+52.144.211.194/31 Amazon
+52.144.211.196/31 Amazon
+52.144.211.198/31 Amazon
+52.144.211.200/31 Amazon
+52.144.211.202/31 Amazon
+52.144.212.64/26 Amazon
+52.144.212.192/26 Amazon
+52.144.213.64/26 Amazon
+52.144.214.128/26 Amazon
+52.144.215.0/31 Amazon
+52.144.215.2/31 Amazon
+52.144.215.192/31 Amazon
+52.144.215.194/31 Amazon
+52.144.215.196/31 Amazon
+52.144.215.198/31 Amazon
+52.144.215.200/31 Amazon
+52.144.215.202/31 Amazon
+52.144.216.0/31 Amazon
+52.144.216.2/31 Amazon
+52.144.216.4/31 Amazon
+52.144.216.6/31 Amazon
+52.144.216.8/31 Amazon
+52.144.216.10/31 Amazon
+52.144.218.0/26 Amazon
+52.144.218.64/26 Amazon
+52.144.223.64/26 Amazon
+52.144.223.128/26 Amazon
+52.144.224.64/26 Amazon
+52.144.224.128/26 Amazon
+52.144.224.192/26 Amazon
+52.144.225.0/26 Amazon
+52.144.225.64/26 Amazon
+52.144.225.128/26 Amazon
+52.144.227.64/26 Amazon
+52.144.227.192/26 Amazon
+52.144.228.0/31 Amazon
+52.144.228.2/31 Amazon
+52.144.228.64/26 Amazon
+52.144.228.128/26 Amazon
+52.144.228.192/26 Amazon
+52.144.229.0/26 Amazon
+52.144.229.64/26 Amazon
+52.144.230.0/26 Amazon
+52.144.231.64/26 Amazon
+52.144.233.64/31 Amazon
+52.144.233.66/31 Amazon
+52.144.233.68/31 Amazon
+52.144.233.70/31 Amazon
+52.144.233.128/31 Amazon
+52.144.233.130/31 Amazon
+52.144.233.132/31 Amazon
+52.144.233.134/31 Amazon
+52.144.233.192/26 Amazon
+52.192.0.0/15 Amazon
+52.194.0.0/15 Amazon
+52.196.0.0/14 Amazon
+52.200.0.0/13 Amazon
+52.208.0.0/13 Amazon
+52.216.0.0/15 Amazon
+52.218.0.0/17 Amazon
+52.218.128.0/17 Amazon
+52.219.0.0/20 Amazon
+52.219.16.0/22 Amazon
+52.219.24.0/21 Amazon
+52.219.32.0/21 Amazon
+52.219.40.0/22 Amazon
+52.219.44.0/22 Amazon
+52.219.56.0/22 Amazon
+52.219.60.0/23 Amazon
+52.219.62.0/23 Amazon
+52.219.64.0/22 Amazon
+52.219.68.0/22 Amazon
+52.219.72.0/22 Amazon
+52.219.80.0/20 Amazon
+52.219.96.0/20 Amazon
+52.219.112.0/21 Amazon
+52.219.120.0/22 Amazon
+52.219.124.0/22 Amazon
+52.219.128.0/22 Amazon
+52.219.132.0/22 Amazon
+52.219.136.0/22 Amazon
+52.219.140.0/24 Amazon
+52.219.141.0/24 Amazon
+52.219.142.0/24 Amazon
+52.219.143.0/24 Amazon
+52.219.144.0/22 Amazon
+52.219.148.0/23 Amazon
+52.219.152.0/22 Amazon
+52.219.156.0/22 Amazon
+52.219.160.0/23 Amazon
+52.219.164.0/22 Amazon
+52.219.168.0/24 Amazon
+52.219.169.0/24 Amazon
+52.219.170.0/23 Amazon
+52.219.172.0/22 Amazon
+52.219.176.0/22 Amazon
+52.219.180.0/22 Amazon
+52.219.184.0/21 Amazon
+52.219.192.0/23 Amazon
+52.219.194.0/24 Amazon
+52.219.195.0/24 Amazon
+52.219.196.0/22 Amazon
+52.219.200.0/24 Amazon
+52.219.202.0/23 Amazon
+52.219.204.0/22 Amazon
+52.220.0.0/15 Amazon
+52.222.0.0/17 Amazon
+52.222.128.0/17 Amazon
+52.223.0.0/17 Amazon
+54.64.0.0/15 Amazon
+54.66.0.0/16 Amazon
+54.67.0.0/16 Amazon
+54.68.0.0/14 Amazon
+54.72.0.0/15 Amazon
+54.74.0.0/15 Amazon
+54.76.0.0/15 Amazon
+54.78.0.0/16 Amazon
+54.79.0.0/16 Amazon
+54.80.0.0/13 Amazon
+54.88.0.0/14 Amazon
+54.92.0.0/17 Amazon
+54.92.128.0/17 Amazon
+54.93.0.0/16 Amazon
+54.94.0.0/16 Amazon
+54.95.0.0/16 Amazon
+54.144.0.0/14 Amazon
+54.148.0.0/15 Amazon
+54.150.0.0/16 Amazon
+54.151.0.0/17 Amazon
+54.151.128.0/17 Amazon
+54.152.0.0/16 Amazon
+54.153.0.0/17 Amazon
+54.153.128.0/17 Amazon
+54.154.0.0/16 Amazon
+54.155.0.0/16 Amazon
+54.156.0.0/14 Amazon
+54.160.0.0/13 Amazon
+54.168.0.0/16 Amazon
+54.169.0.0/16 Amazon
+54.170.0.0/15 Amazon
+54.172.0.0/15 Amazon
+54.174.0.0/15 Amazon
+54.176.0.0/15 Amazon
+54.178.0.0/16 Amazon
+54.179.0.0/16 Amazon
+54.180.0.0/15 Amazon
+54.182.0.0/16 Amazon
+54.183.0.0/16 Amazon
+54.184.0.0/13 Amazon
+54.192.0.0/16 Amazon
+54.193.0.0/16 Amazon
+54.194.0.0/15 Amazon
+54.196.0.0/15 Amazon
+54.198.0.0/16 Amazon
+54.199.0.0/16 Amazon
+54.200.0.0/15 Amazon
+54.202.0.0/15 Amazon
+54.204.0.0/15 Amazon
+54.206.0.0/16 Amazon
+54.207.0.0/16 Amazon
+54.208.0.0/15 Amazon
+54.210.0.0/15 Amazon
+54.212.0.0/15 Amazon
+54.214.0.0/16 Amazon
+54.215.0.0/16 Amazon
+54.216.0.0/15 Amazon
+54.218.0.0/16 Amazon
+54.219.0.0/16 Amazon
+54.220.0.0/16 Amazon
+54.221.0.0/16 Amazon
+54.222.0.0/19 Amazon
+54.222.32.0/22 Amazon
+54.222.36.0/22 Amazon
+54.222.48.0/22 Amazon
+54.222.52.0/22 Amazon
+54.222.57.0/24 Amazon
+54.222.58.0/28 Amazon
+54.222.58.32/28 Amazon
+54.222.58.48/28 Amazon
+54.222.59.0/24 Amazon
+54.222.64.0/23 Amazon
+54.222.66.0/23 Amazon
+54.222.68.0/23 Amazon
+54.222.70.0/24 Amazon
+54.222.71.0/24 Amazon
+54.222.76.0/22 Amazon
+54.222.80.0/21 Amazon
+54.222.128.0/17 Amazon
+54.223.0.0/16 Amazon
+54.224.0.0/15 Amazon
+54.226.0.0/15 Amazon
+54.228.0.0/16 Amazon
+54.229.0.0/16 Amazon
+54.230.0.0/17 Amazon
+54.230.128.0/18 Amazon
+54.230.192.0/21 Amazon
+54.230.200.0/21 Amazon
+54.230.208.0/20 Amazon
+54.230.224.0/19 Amazon
+54.231.0.0/16 Amazon
+54.232.0.0/16 Amazon
+54.233.0.0/18 Amazon
+54.233.64.0/18 Amazon
+54.233.128.0/17 Amazon
+54.234.0.0/15 Amazon
+54.236.0.0/15 Amazon
+54.238.0.0/16 Amazon
+54.239.0.0/28 Amazon
+54.239.0.16/28 Amazon
+54.239.0.32/28 Amazon
+54.239.0.48/28 Amazon
+54.239.0.64/28 Amazon
+54.239.0.80/28 Amazon
+54.239.0.96/28 Amazon
+54.239.0.112/28 Amazon
+54.239.0.128/28 Amazon
+54.239.0.144/28 Amazon
+54.239.0.160/28 Amazon
+54.239.0.176/28 Amazon
+54.239.0.192/28 Amazon
+54.239.0.208/28 Amazon
+54.239.0.224/28 Amazon
+54.239.0.240/28 Amazon
+54.239.1.0/28 Amazon
+54.239.1.16/28 Amazon
+54.239.1.32/28 Amazon
+54.239.1.48/28 Amazon
+54.239.1.64/28 Amazon
+54.239.1.80/28 Amazon
+54.239.1.96/28 Amazon
+54.239.1.112/28 Amazon
+54.239.1.128/28 Amazon
+54.239.1.144/28 Amazon
+54.239.1.160/28 Amazon
+54.239.1.176/28 Amazon
+54.239.1.192/28 Amazon
+54.239.1.208/28 Amazon
+54.239.1.224/28 Amazon
+54.239.2.0/23 Amazon
+54.239.4.0/22 Amazon
+54.239.8.0/21 Amazon
+54.239.16.0/20 Amazon
+54.239.32.0/21 Amazon
+54.239.40.152/29 Amazon
+54.239.48.0/22 Amazon
+54.239.52.0/23 Amazon
+54.239.54.0/23 Amazon
+54.239.56.0/21 Amazon
+54.239.64.0/21 Amazon
+54.239.96.0/24 Amazon
+54.239.98.0/24 Amazon
+54.239.99.0/24 Amazon
+54.239.100.0/23 Amazon
+54.239.102.162/31 Amazon
+54.239.102.232/31 Amazon
+54.239.102.234/31 Amazon
+54.239.102.236/31 Amazon
+54.239.104.0/23 Amazon
+54.239.106.0/23 Amazon
+54.239.108.0/22 Amazon
+54.239.112.0/24 Amazon
+54.239.113.0/24 Amazon
+54.239.115.0/25 Amazon
+54.239.116.0/22 Amazon
+54.239.120.0/21 Amazon
+54.239.128.0/18 Amazon
+54.239.192.0/19 Amazon
+54.240.17.0/24 Amazon
+54.240.128.0/18 Amazon
+54.240.192.0/22 Amazon
+54.240.196.0/24 Amazon
+54.240.197.0/24 Amazon
+54.240.198.0/24 Amazon
+54.240.199.0/24 Amazon
+54.240.200.0/24 Amazon
+54.240.202.0/24 Amazon
+54.240.203.0/24 Amazon
+54.240.204.0/22 Amazon
+54.240.208.0/22 Amazon
+54.240.212.0/22 Amazon
+54.240.216.0/22 Amazon
+54.240.220.0/22 Amazon
+54.240.225.0/24 Amazon
+54.240.226.0/24 Amazon
+54.240.227.0/24 Amazon
+54.240.228.0/23 Amazon
+54.240.230.0/23 Amazon
+54.240.232.0/22 Amazon
+54.240.236.1/32 Amazon
+54.240.236.2/32 Amazon
+54.240.236.5/32 Amazon
+54.240.236.6/32 Amazon
+54.240.236.9/32 Amazon
+54.240.236.10/32 Amazon
+54.240.236.13/32 Amazon
+54.240.236.14/32 Amazon
+54.240.236.17/32 Amazon
+54.240.236.18/32 Amazon
+54.240.236.21/32 Amazon
+54.240.236.22/32 Amazon
+54.240.236.25/32 Amazon
+54.240.236.26/32 Amazon
+54.240.236.29/32 Amazon
+54.240.236.30/32 Amazon
+54.240.236.33/32 Amazon
+54.240.236.34/32 Amazon
+54.240.236.37/32 Amazon
+54.240.236.38/32 Amazon
+54.240.236.41/32 Amazon
+54.240.236.42/32 Amazon
+54.240.236.45/32 Amazon
+54.240.236.46/32 Amazon
+54.240.236.49/32 Amazon
+54.240.236.50/32 Amazon
+54.240.236.53/32 Amazon
+54.240.236.54/32 Amazon
+54.240.236.57/32 Amazon
+54.240.236.58/32 Amazon
+54.240.236.61/32 Amazon
+54.240.236.62/32 Amazon
+54.240.236.65/32 Amazon
+54.240.236.66/32 Amazon
+54.240.236.69/32 Amazon
+54.240.236.70/32 Amazon
+54.240.236.73/32 Amazon
+54.240.236.74/32 Amazon
+54.240.236.77/32 Amazon
+54.240.236.78/32 Amazon
+54.240.236.81/32 Amazon
+54.240.236.82/32 Amazon
+54.240.236.85/32 Amazon
+54.240.236.86/32 Amazon
+54.240.236.89/32 Amazon
+54.240.236.90/32 Amazon
+54.240.236.93/32 Amazon
+54.240.236.94/32 Amazon
+54.240.241.0/24 Amazon
+54.240.244.0/22 Amazon
+54.240.248.0/21 Amazon
+54.241.0.0/16 Amazon
+54.242.0.0/15 Amazon
+54.244.0.0/16 Amazon
+54.245.0.0/16 Amazon
+54.246.0.0/16 Amazon
+54.247.0.0/16 Amazon
+54.248.0.0/15 Amazon
+54.250.0.0/16 Amazon
+54.251.0.0/16 Amazon
+54.252.0.0/16 Amazon
+54.253.0.0/16 Amazon
+54.254.0.0/16 Amazon
+54.255.0.0/16 Amazon
+58.254.138.0/25 Amazon
+58.254.138.128/26 Amazon
+63.32.0.0/14 Amazon
+63.246.112.0/24 Amazon
+63.246.113.0/24 Amazon
+63.246.114.0/23 Amazon
+63.246.119.0/24 Amazon
+64.187.128.0/20 Amazon
+64.252.64.0/18 Amazon
+64.252.128.0/18 Amazon
+65.0.0.0/14 Amazon
+65.8.0.0/16 Amazon
+65.9.0.0/17 Amazon
+65.9.128.0/18 Amazon
+67.202.0.0/18 Amazon
+67.220.224.0/20 Amazon
+67.220.240.0/20 Amazon
+68.66.112.0/20 Amazon
+68.79.0.0/18 Amazon
+69.107.3.176/29 Amazon
+69.107.3.184/29 Amazon
+69.107.6.112/29 Amazon
+69.107.6.120/29 Amazon
+69.107.6.160/29 Amazon
+69.107.6.168/29 Amazon
+69.107.6.200/29 Amazon
+69.107.6.208/29 Amazon
+69.107.6.216/29 Amazon
+69.107.6.224/29 Amazon
+69.107.7.0/29 Amazon
+69.107.7.8/29 Amazon
+69.107.7.16/29 Amazon
+69.107.7.32/29 Amazon
+69.107.7.40/29 Amazon
+69.107.7.48/29 Amazon
+69.107.7.56/29 Amazon
+69.107.7.64/29 Amazon
+69.107.7.72/29 Amazon
+69.107.7.80/29 Amazon
+69.107.7.88/29 Amazon
+69.107.7.96/29 Amazon
+69.107.7.104/29 Amazon
+69.107.7.112/29 Amazon
+69.107.7.120/29 Amazon
+69.107.7.128/29 Amazon
+69.107.7.136/29 Amazon
+69.230.192.0/18 Amazon
+69.231.128.0/18 Amazon
+69.234.192.0/18 Amazon
+69.235.128.0/18 Amazon
+70.132.0.0/18 Amazon
+70.224.192.0/18 Amazon
+70.232.64.0/20 Amazon
+70.232.80.0/21 Amazon
+70.232.88.0/22 Amazon
+70.232.92.0/22 Amazon
+70.232.96.0/20 Amazon
+70.232.112.0/21 Amazon
+70.232.120.0/22 Amazon
+70.232.124.0/22 Amazon
+71.131.192.0/18 Amazon
+71.132.0.0/18 Amazon
+71.137.0.0/22 Amazon
+71.137.4.0/24 Amazon
+71.137.8.0/22 Amazon
+71.152.0.0/17 Amazon
+72.21.192.0/19 Amazon
+72.41.0.0/20 Amazon
+72.44.32.0/19 Amazon
+75.2.0.0/17 Amazon
+75.101.128.0/17 Amazon
+76.223.0.0/17 Amazon
+79.125.0.0/17 Amazon
+87.238.80.0/21 Amazon
+96.127.0.0/17 Amazon
+99.77.0.0/20 Amazon
+99.77.16.0/21 Amazon
+99.77.24.0/22 Amazon
+99.77.28.0/22 Amazon
+99.77.32.0/20 Amazon
+99.77.48.0/21 Amazon
+99.77.56.0/21 Amazon
+99.77.128.0/18 Amazon
+99.77.247.0/24 Amazon
+99.77.250.0/24 Amazon
+99.77.253.0/24 Amazon
+99.77.254.0/24 Amazon
+99.78.128.0/20 Amazon
+99.78.144.0/21 Amazon
+99.78.152.0/22 Amazon
+99.78.156.0/22 Amazon
+99.78.160.0/21 Amazon
+99.78.168.0/23 Amazon
+99.78.170.0/23 Amazon
+99.78.172.0/24 Amazon
+99.78.176.0/21 Amazon
+99.78.184.0/22 Amazon
+99.78.188.0/22 Amazon
+99.78.192.0/22 Amazon
+99.78.196.0/22 Amazon
+99.78.208.0/22 Amazon
+99.78.212.0/22 Amazon
+99.78.216.0/22 Amazon
+99.78.220.0/22 Amazon
+99.78.228.0/22 Amazon
+99.78.232.0/21 Amazon
+99.78.240.0/20 Amazon
+99.79.0.0/16 Amazon
+99.80.0.0/15 Amazon
+99.82.128.0/20 Amazon
+99.82.144.0/21 Amazon
+99.82.152.0/22 Amazon
+99.82.156.0/22 Amazon
+99.82.160.0/24 Amazon
+99.82.161.0/24 Amazon
+99.82.162.0/24 Amazon
+99.82.163.0/24 Amazon
+99.82.164.0/24 Amazon
+99.82.165.0/24 Amazon
+99.82.166.0/24 Amazon
+99.82.167.0/24 Amazon
+99.82.168.0/24 Amazon
+99.82.169.0/24 Amazon
+99.82.170.0/24 Amazon
+99.82.171.0/24 Amazon
+99.82.172.0/24 Amazon
+99.82.173.0/24 Amazon
+99.82.174.0/24 Amazon
+99.82.175.0/24 Amazon
+99.82.176.0/21 Amazon
+99.82.184.0/22 Amazon
+99.82.188.0/22 Amazon
+99.83.64.0/21 Amazon
+99.83.72.0/22 Amazon
+99.83.76.0/22 Amazon
+99.83.80.0/22 Amazon
+99.83.84.0/22 Amazon
+99.83.88.0/21 Amazon
+99.83.96.0/24 Amazon
+99.83.97.0/24 Amazon
+99.83.98.0/24 Amazon
+99.83.99.0/24 Amazon
+99.83.100.0/24 Amazon
+99.83.101.0/24 Amazon
+99.83.112.0/21 Amazon
+99.83.120.0/22 Amazon
+99.83.128.0/17 Amazon
+99.84.0.0/16 Amazon
+99.86.0.0/16 Amazon
+99.87.0.0/22 Amazon
+99.87.4.0/22 Amazon
+99.87.8.0/21 Amazon
+99.87.16.0/20 Amazon
+99.87.32.0/22 Amazon
+99.150.0.0/21 Amazon
+99.150.8.0/21 Amazon
+99.150.16.0/21 Amazon
+99.150.24.0/21 Amazon
+99.150.32.0/21 Amazon
+99.150.40.0/21 Amazon
+99.150.48.0/21 Amazon
+99.150.56.0/21 Amazon
+99.150.64.0/21 Amazon
+99.150.72.0/21 Amazon
+99.150.80.0/21 Amazon
+99.150.88.0/21 Amazon
+99.150.96.0/21 Amazon
+99.150.104.0/21 Amazon
+99.150.112.0/21 Amazon
+99.150.120.0/21 Amazon
+99.151.64.0/21 Amazon
+99.151.72.0/21 Amazon
+99.151.80.0/21 Amazon
+99.151.88.0/21 Amazon
+99.151.96.0/21 Amazon
+99.151.104.0/21 Amazon
+99.151.112.0/21 Amazon
+99.151.120.0/21 Amazon
+99.151.128.0/21 Amazon
+99.151.136.0/21 Amazon
+99.151.144.0/21 Amazon
+100.20.0.0/14 Amazon
+100.24.0.0/13 Amazon
+103.4.8.0/21 Amazon
+103.8.172.0/22 Amazon
+103.246.148.0/23 Amazon
+103.246.150.0/23 Amazon
+104.255.56.11/32 Amazon
+104.255.56.12/32 Amazon
+104.255.59.81/32 Amazon
+104.255.59.82/32 Amazon
+104.255.59.83/32 Amazon
+104.255.59.85/32 Amazon
+104.255.59.86/32 Amazon
+104.255.59.87/32 Amazon
+104.255.59.88/32 Amazon
+104.255.59.91/32 Amazon
+104.255.59.101/32 Amazon
+104.255.59.102/32 Amazon
+104.255.59.103/32 Amazon
+104.255.59.104/32 Amazon
+104.255.59.105/32 Amazon
+104.255.59.106/32 Amazon
+104.255.59.114/32 Amazon
+104.255.59.115/32 Amazon
+104.255.59.118/32 Amazon
+104.255.59.119/32 Amazon
+104.255.59.122/32 Amazon
+104.255.59.130/32 Amazon
+104.255.59.131/32 Amazon
+104.255.59.132/32 Amazon
+104.255.59.133/32 Amazon
+104.255.59.134/32 Amazon
+104.255.59.135/32 Amazon
+104.255.59.136/32 Amazon
+104.255.59.137/32 Amazon
+104.255.59.138/32 Amazon
+104.255.59.139/32 Amazon
+107.20.0.0/14 Amazon
+107.176.0.0/15 Amazon
+108.128.0.0/13 Amazon
+108.136.0.0/15 Amazon
+108.138.0.0/15 Amazon
+108.156.0.0/14 Amazon
+108.166.224.0/21 Amazon
+108.166.232.0/21 Amazon
+108.166.240.0/21 Amazon
+108.166.248.0/21 Amazon
+108.175.48.0/22 Amazon
+108.175.52.0/22 Amazon
+108.175.56.0/22 Amazon
+108.175.60.0/22 Amazon
+116.129.226.0/25 Amazon
+116.129.226.128/26 Amazon
+118.193.97.64/26 Amazon
+118.193.97.128/25 Amazon
+119.147.182.0/25 Amazon
+119.147.182.128/26 Amazon
+120.52.12.64/26 Amazon
+120.52.22.96/27 Amazon
+120.52.39.128/27 Amazon
+120.52.153.192/26 Amazon
+120.232.236.0/25 Amazon
+120.232.236.128/26 Amazon
+120.253.240.192/26 Amazon
+120.253.241.160/27 Amazon
+120.253.245.128/26 Amazon
+120.253.245.192/27 Amazon
+122.248.192.0/18 Amazon
+130.176.0.0/17 Amazon
+130.176.128.0/18 Amazon
+130.176.192.0/19 Amazon
+130.176.224.0/20 Amazon
+130.176.254.0/24 Amazon
+130.176.255.0/24 Amazon
+140.179.0.0/16 Amazon
+142.4.160.0/29 Amazon
+142.4.160.8/29 Amazon
+142.4.160.16/29 Amazon
+142.4.160.24/29 Amazon
+142.4.160.32/29 Amazon
+142.4.160.40/29 Amazon
+142.4.160.48/29 Amazon
+142.4.160.56/29 Amazon
+142.4.160.64/29 Amazon
+142.4.160.72/29 Amazon
+142.4.160.80/29 Amazon
+142.4.160.88/29 Amazon
+142.4.160.96/29 Amazon
+142.4.160.104/29 Amazon
+142.4.160.112/29 Amazon
+143.204.0.0/16 Amazon
+144.220.0.0/16 Amazon
+150.222.0.16/32 Amazon
+150.222.0.17/32 Amazon
+150.222.0.18/32 Amazon
+150.222.0.19/32 Amazon
+150.222.2.0/24 Amazon
+150.222.3.176/32 Amazon
+150.222.3.177/32 Amazon
+150.222.3.178/32 Amazon
+150.222.3.179/32 Amazon
+150.222.3.180/32 Amazon
+150.222.3.181/32 Amazon
+150.222.3.182/32 Amazon
+150.222.3.183/32 Amazon
+150.222.3.184/32 Amazon
+150.222.3.185/32 Amazon
+150.222.3.186/32 Amazon
+150.222.3.187/32 Amazon
+150.222.3.188/32 Amazon
+150.222.3.189/32 Amazon
+150.222.3.190/32 Amazon
+150.222.3.191/32 Amazon
+150.222.3.192/31 Amazon
+150.222.3.194/31 Amazon
+150.222.3.196/31 Amazon
+150.222.3.198/31 Amazon
+150.222.3.200/31 Amazon
+150.222.3.202/31 Amazon
+150.222.3.204/31 Amazon
+150.222.3.206/31 Amazon
+150.222.3.208/31 Amazon
+150.222.3.210/31 Amazon
+150.222.3.212/31 Amazon
+150.222.3.214/31 Amazon
+150.222.3.216/31 Amazon
+150.222.3.218/31 Amazon
+150.222.3.220/31 Amazon
+150.222.3.222/31 Amazon
+150.222.3.224/31 Amazon
+150.222.3.226/31 Amazon
+150.222.3.228/31 Amazon
+150.222.3.230/31 Amazon
+150.222.3.232/31 Amazon
+150.222.3.234/31 Amazon
+150.222.3.236/31 Amazon
+150.222.3.238/31 Amazon
+150.222.3.240/31 Amazon
+150.222.3.242/31 Amazon
+150.222.3.244/31 Amazon
+150.222.3.246/31 Amazon
+150.222.3.248/31 Amazon
+150.222.3.250/31 Amazon
+150.222.3.252/31 Amazon
+150.222.3.254/31 Amazon
+150.222.5.0/24 Amazon
+150.222.6.0/24 Amazon
+150.222.7.0/24 Amazon
+150.222.10.0/24 Amazon
+150.222.11.0/31 Amazon
+150.222.11.74/31 Amazon
+150.222.11.76/31 Amazon
+150.222.11.78/31 Amazon
+150.222.11.80/31 Amazon
+150.222.11.84/31 Amazon
+150.222.11.86/31 Amazon
+150.222.11.88/31 Amazon
+150.222.11.90/31 Amazon
+150.222.11.92/31 Amazon
+150.222.11.94/31 Amazon
+150.222.11.96/31 Amazon
+150.222.12.0/24 Amazon
+150.222.13.0/24 Amazon
+150.222.14.72/31 Amazon
+150.222.15.124/32 Amazon
+150.222.15.125/32 Amazon
+150.222.15.126/32 Amazon
+150.222.15.127/32 Amazon
+150.222.15.128/31 Amazon
+150.222.15.130/31 Amazon
+150.222.28.17/32 Amazon
+150.222.28.18/31 Amazon
+150.222.28.104/32 Amazon
+150.222.28.105/32 Amazon
+150.222.28.106/31 Amazon
+150.222.28.108/31 Amazon
+150.222.28.110/31 Amazon
+150.222.28.112/31 Amazon
+150.222.28.114/31 Amazon
+150.222.28.116/31 Amazon
+150.222.28.118/31 Amazon
+150.222.28.120/31 Amazon
+150.222.28.122/31 Amazon
+150.222.28.124/31 Amazon
+150.222.28.126/31 Amazon
+150.222.28.128/31 Amazon
+150.222.28.130/31 Amazon
+150.222.28.132/31 Amazon
+150.222.28.134/31 Amazon
+150.222.28.136/31 Amazon
+150.222.28.138/31 Amazon
+150.222.28.140/31 Amazon
+150.222.28.142/31 Amazon
+150.222.66.0/24 Amazon
+150.222.67.0/24 Amazon
+150.222.69.0/24 Amazon
+150.222.70.0/24 Amazon
+150.222.71.0/24 Amazon
+150.222.72.0/24 Amazon
+150.222.73.0/24 Amazon
+150.222.74.0/24 Amazon
+150.222.75.0/24 Amazon
+150.222.76.0/24 Amazon
+150.222.77.0/24 Amazon
+150.222.78.0/24 Amazon
+150.222.79.0/24 Amazon
+150.222.80.0/24 Amazon
+150.222.81.0/24 Amazon
+150.222.82.0/24 Amazon
+150.222.83.0/24 Amazon
+150.222.84.0/24 Amazon
+150.222.85.0/24 Amazon
+150.222.87.0/24 Amazon
+150.222.88.0/24 Amazon
+150.222.89.0/24 Amazon
+150.222.90.0/24 Amazon
+150.222.91.0/24 Amazon
+150.222.92.0/22 Amazon
+150.222.96.0/24 Amazon
+150.222.97.0/24 Amazon
+150.222.98.0/24 Amazon
+150.222.99.0/24 Amazon
+150.222.100.0/24 Amazon
+150.222.101.0/24 Amazon
+150.222.102.0/24 Amazon
+150.222.104.0/24 Amazon
+150.222.105.0/24 Amazon
+150.222.106.0/24 Amazon
+150.222.108.0/24 Amazon
+150.222.109.0/24 Amazon
+150.222.110.0/24 Amazon
+150.222.112.0/24 Amazon
+150.222.113.0/24 Amazon
+150.222.114.0/24 Amazon
+150.222.115.0/24 Amazon
+150.222.116.0/24 Amazon
+150.222.117.0/24 Amazon
+150.222.118.0/24 Amazon
+150.222.119.0/24 Amazon
+150.222.120.20/31 Amazon
+150.222.120.62/31 Amazon
+150.222.120.224/31 Amazon
+150.222.120.226/31 Amazon
+150.222.120.228/31 Amazon
+150.222.120.230/31 Amazon
+150.222.120.232/31 Amazon
+150.222.120.234/31 Amazon
+150.222.120.240/31 Amazon
+150.222.120.242/31 Amazon
+150.222.120.244/31 Amazon
+150.222.120.246/31 Amazon
+150.222.120.248/31 Amazon
+150.222.120.250/31 Amazon
+150.222.120.252/32 Amazon
+150.222.120.255/32 Amazon
+150.222.121.0/24 Amazon
+150.222.122.92/31 Amazon
+150.222.122.94/31 Amazon
+150.222.122.96/31 Amazon
+150.222.122.98/31 Amazon
+150.222.122.100/31 Amazon
+150.222.122.102/31 Amazon
+150.222.122.104/31 Amazon
+150.222.122.106/31 Amazon
+150.222.122.108/31 Amazon
+150.222.122.110/31 Amazon
+150.222.122.112/31 Amazon
+150.222.122.114/31 Amazon
+150.222.122.116/31 Amazon
+150.222.129.19/32 Amazon
+150.222.129.20/31 Amazon
+150.222.129.62/31 Amazon
+150.222.129.64/31 Amazon
+150.222.129.66/31 Amazon
+150.222.129.69/32 Amazon
+150.222.129.110/31 Amazon
+150.222.129.112/31 Amazon
+150.222.129.114/31 Amazon
+150.222.129.116/31 Amazon
+150.222.129.118/31 Amazon
+150.222.129.120/31 Amazon
+150.222.129.122/31 Amazon
+150.222.129.124/31 Amazon
+150.222.129.126/31 Amazon
+150.222.129.128/31 Amazon
+150.222.129.130/31 Amazon
+150.222.129.132/31 Amazon
+150.222.129.134/31 Amazon
+150.222.129.136/31 Amazon
+150.222.129.138/31 Amazon
+150.222.129.140/31 Amazon
+150.222.129.142/31 Amazon
+150.222.129.144/31 Amazon
+150.222.129.146/31 Amazon
+150.222.129.152/31 Amazon
+150.222.129.154/31 Amazon
+150.222.129.156/31 Amazon
+150.222.129.158/31 Amazon
+150.222.129.240/31 Amazon
+150.222.129.242/31 Amazon
+150.222.129.244/31 Amazon
+150.222.129.246/31 Amazon
+150.222.129.248/31 Amazon
+150.222.129.250/31 Amazon
+150.222.129.252/32 Amazon
+150.222.129.255/32 Amazon
+150.222.133.0/24 Amazon
+150.222.134.0/24 Amazon
+150.222.135.0/24 Amazon
+150.222.136.0/24 Amazon
+150.222.138.0/24 Amazon
+150.222.139.116/30 Amazon
+150.222.139.120/30 Amazon
+150.222.139.124/30 Amazon
+150.222.140.0/24 Amazon
+150.222.141.0/24 Amazon
+150.222.142.0/24 Amazon
+150.222.143.0/24 Amazon
+150.222.164.208/31 Amazon
+150.222.164.210/32 Amazon
+150.222.164.211/32 Amazon
+150.222.164.220/31 Amazon
+150.222.164.222/32 Amazon
+150.222.176.0/22 Amazon
+150.222.180.0/24 Amazon
+150.222.196.0/24 Amazon
+150.222.199.0/25 Amazon
+150.222.202.0/24 Amazon
+150.222.203.0/24 Amazon
+150.222.204.0/24 Amazon
+150.222.205.0/24 Amazon
+150.222.206.0/24 Amazon
+150.222.207.0/24 Amazon
+150.222.208.64/32 Amazon
+150.222.208.65/32 Amazon
+150.222.208.66/31 Amazon
+150.222.208.68/31 Amazon
+150.222.208.70/31 Amazon
+150.222.208.72/31 Amazon
+150.222.208.74/31 Amazon
+150.222.208.76/31 Amazon
+150.222.208.78/31 Amazon
+150.222.208.80/31 Amazon
+150.222.208.82/31 Amazon
+150.222.208.84/31 Amazon
+150.222.208.86/31 Amazon
+150.222.208.88/31 Amazon
+150.222.208.90/31 Amazon
+150.222.208.92/31 Amazon
+150.222.208.94/31 Amazon
+150.222.208.96/31 Amazon
+150.222.210.0/24 Amazon
+150.222.212.0/24 Amazon
+150.222.213.40/32 Amazon
+150.222.213.41/32 Amazon
+150.222.214.0/24 Amazon
+150.222.215.0/24 Amazon
+150.222.217.17/32 Amazon
+150.222.217.226/31 Amazon
+150.222.217.228/30 Amazon
+150.222.217.232/31 Amazon
+150.222.217.234/31 Amazon
+150.222.217.248/31 Amazon
+150.222.217.250/31 Amazon
+150.222.218.0/24 Amazon
+150.222.219.0/24 Amazon
+150.222.220.0/24 Amazon
+150.222.221.0/24 Amazon
+150.222.222.0/24 Amazon
+150.222.223.0/24 Amazon
+150.222.224.0/24 Amazon
+150.222.226.0/24 Amazon
+150.222.227.0/24 Amazon
+150.222.228.0/24 Amazon
+150.222.229.0/24 Amazon
+150.222.230.92/32 Amazon
+150.222.230.93/32 Amazon
+150.222.230.94/31 Amazon
+150.222.230.96/31 Amazon
+150.222.230.98/31 Amazon
+150.222.230.100/31 Amazon
+150.222.230.102/31 Amazon
+150.222.230.104/31 Amazon
+150.222.230.106/31 Amazon
+150.222.230.108/31 Amazon
+150.222.230.110/31 Amazon
+150.222.230.112/31 Amazon
+150.222.230.114/31 Amazon
+150.222.230.116/31 Amazon
+150.222.230.118/31 Amazon
+150.222.230.120/31 Amazon
+150.222.230.122/31 Amazon
+150.222.230.124/31 Amazon
+150.222.231.0/24 Amazon
+150.222.232.51/32 Amazon
+150.222.232.88/32 Amazon
+150.222.232.94/31 Amazon
+150.222.232.96/28 Amazon
+150.222.232.112/31 Amazon
+150.222.232.114/31 Amazon
+150.222.232.116/31 Amazon
+150.222.232.118/31 Amazon
+150.222.232.120/31 Amazon
+150.222.233.0/24 Amazon
+150.222.234.0/32 Amazon
+150.222.234.1/32 Amazon
+150.222.234.2/32 Amazon
+150.222.234.3/32 Amazon
+150.222.234.4/32 Amazon
+150.222.234.5/32 Amazon
+150.222.234.6/31 Amazon
+150.222.234.8/31 Amazon
+150.222.234.10/31 Amazon
+150.222.234.12/31 Amazon
+150.222.234.14/31 Amazon
+150.222.234.16/31 Amazon
+150.222.234.18/31 Amazon
+150.222.234.20/31 Amazon
+150.222.234.22/31 Amazon
+150.222.234.24/31 Amazon
+150.222.234.26/31 Amazon
+150.222.234.28/31 Amazon
+150.222.234.30/31 Amazon
+150.222.234.32/31 Amazon
+150.222.234.34/31 Amazon
+150.222.234.36/31 Amazon
+150.222.234.38/31 Amazon
+150.222.234.40/31 Amazon
+150.222.234.42/31 Amazon
+150.222.234.44/31 Amazon
+150.222.234.46/31 Amazon
+150.222.234.48/31 Amazon
+150.222.234.50/31 Amazon
+150.222.234.52/31 Amazon
+150.222.234.54/31 Amazon
+150.222.234.56/31 Amazon
+150.222.234.58/31 Amazon
+150.222.234.60/31 Amazon
+150.222.234.62/31 Amazon
+150.222.234.64/31 Amazon
+150.222.234.66/31 Amazon
+150.222.234.68/31 Amazon
+150.222.234.70/31 Amazon
+150.222.234.72/31 Amazon
+150.222.234.74/31 Amazon
+150.222.234.76/31 Amazon
+150.222.234.78/31 Amazon
+150.222.234.80/31 Amazon
+150.222.234.82/31 Amazon
+150.222.234.84/31 Amazon
+150.222.234.86/31 Amazon
+150.222.234.96/31 Amazon
+150.222.234.98/31 Amazon
+150.222.234.100/31 Amazon
+150.222.234.102/32 Amazon
+150.222.234.103/32 Amazon
+150.222.234.104/31 Amazon
+150.222.234.106/31 Amazon
+150.222.234.108/31 Amazon
+150.222.234.110/31 Amazon
+150.222.234.112/31 Amazon
+150.222.234.114/31 Amazon
+150.222.234.116/31 Amazon
+150.222.234.118/31 Amazon
+150.222.234.120/31 Amazon
+150.222.234.122/31 Amazon
+150.222.234.124/31 Amazon
+150.222.234.126/31 Amazon
+150.222.234.128/31 Amazon
+150.222.234.130/31 Amazon
+150.222.234.132/31 Amazon
+150.222.234.134/31 Amazon
+150.222.234.136/31 Amazon
+150.222.234.138/31 Amazon
+150.222.234.140/31 Amazon
+150.222.234.142/31 Amazon
+150.222.235.0/24 Amazon
+150.222.236.0/24 Amazon
+150.222.237.0/24 Amazon
+150.222.239.0/24 Amazon
+150.222.240.131/32 Amazon
+150.222.240.135/32 Amazon
+150.222.240.137/32 Amazon
+150.222.240.161/32 Amazon
+150.222.240.207/32 Amazon
+150.222.240.237/32 Amazon
+150.222.240.245/32 Amazon
+150.222.240.247/32 Amazon
+150.222.240.249/32 Amazon
+150.222.240.251/32 Amazon
+150.222.242.84/31 Amazon
+150.222.242.97/32 Amazon
+150.222.242.99/32 Amazon
+150.222.242.214/31 Amazon
+150.222.242.227/32 Amazon
+150.222.242.229/32 Amazon
+150.222.242.231/32 Amazon
+150.222.242.233/32 Amazon
+150.222.243.9/32 Amazon
+150.222.243.11/32 Amazon
+150.222.243.13/32 Amazon
+150.222.243.15/32 Amazon
+150.222.243.17/32 Amazon
+150.222.243.19/32 Amazon
+150.222.243.33/32 Amazon
+150.222.243.35/32 Amazon
+150.222.243.37/32 Amazon
+150.222.243.39/32 Amazon
+150.222.243.41/32 Amazon
+150.222.243.43/32 Amazon
+150.222.243.45/32 Amazon
+150.222.243.47/32 Amazon
+150.222.243.51/32 Amazon
+150.222.243.53/32 Amazon
+150.222.243.55/32 Amazon
+150.222.243.57/32 Amazon
+150.222.243.59/32 Amazon
+150.222.243.177/32 Amazon
+150.222.244.35/32 Amazon
+150.222.244.37/32 Amazon
+150.222.245.122/31 Amazon
+150.222.252.244/31 Amazon
+150.222.252.246/31 Amazon
+150.222.252.248/31 Amazon
+150.222.252.250/31 Amazon
+157.175.0.0/16 Amazon
+157.241.0.0/16 Amazon
+160.1.0.0/16 Amazon
+161.188.128.0/23 Amazon
+161.188.130.0/23 Amazon
+161.188.132.0/23 Amazon
+161.188.134.0/23 Amazon
+161.188.136.0/23 Amazon
+161.188.138.0/23 Amazon
+161.188.140.0/23 Amazon
+161.188.142.0/23 Amazon
+161.188.144.0/23 Amazon
+161.188.146.0/23 Amazon
+161.188.148.0/23 Amazon
+161.188.150.0/23 Amazon
+161.188.152.0/23 Amazon
+161.188.154.0/23 Amazon
+161.188.156.0/23 Amazon
+161.188.158.0/23 Amazon
+161.188.160.0/23 Amazon
+161.189.0.0/16 Amazon
+162.213.232.0/24 Amazon
+162.213.233.0/24 Amazon
+162.213.234.0/23 Amazon
+162.222.148.0/22 Amazon
+162.250.236.0/24 Amazon
+162.250.237.0/24 Amazon
+162.250.238.0/23 Amazon
+172.96.97.0/24 Amazon
+172.96.98.0/24 Amazon
+172.96.110.0/24 Amazon
+174.129.0.0/16 Amazon
+175.41.128.0/18 Amazon
+175.41.192.0/18 Amazon
+176.32.64.0/19 Amazon
+176.32.96.0/21 Amazon
+176.32.104.0/21 Amazon
+176.32.112.0/21 Amazon
+176.32.120.0/22 Amazon
+176.32.124.128/25 Amazon
+176.32.125.0/25 Amazon
+176.32.125.128/26 Amazon
+176.32.125.192/27 Amazon
+176.32.125.224/31 Amazon
+176.32.125.226/31 Amazon
+176.32.125.228/31 Amazon
+176.32.125.230/31 Amazon
+176.32.125.232/31 Amazon
+176.32.125.234/31 Amazon
+176.32.125.236/31 Amazon
+176.32.125.238/31 Amazon
+176.32.125.240/31 Amazon
+176.32.125.242/31 Amazon
+176.32.125.244/31 Amazon
+176.32.125.246/31 Amazon
+176.32.125.248/31 Amazon
+176.32.125.250/31 Amazon
+176.32.125.252/31 Amazon
+176.32.125.254/31 Amazon
+176.34.0.0/19 Amazon
+176.34.32.0/19 Amazon
+176.34.64.0/18 Amazon
+176.34.128.0/17 Amazon
+177.71.128.0/17 Amazon
+177.72.240.0/21 Amazon
+178.236.0.0/20 Amazon
+180.163.57.0/25 Amazon
+180.163.57.128/26 Amazon
+184.72.0.0/18 Amazon
+184.72.64.0/18 Amazon
+184.72.128.0/17 Amazon
+184.73.0.0/16 Amazon
+184.169.128.0/17 Amazon
+185.48.120.0/22 Amazon
+185.143.16.0/24 Amazon
+195.17.0.0/24 Amazon
+198.99.2.0/24 Amazon
+199.127.232.0/22 Amazon
+203.83.220.0/22 Amazon
+204.45.0.0/16 Amazon
+204.236.128.0/18 Amazon
+204.236.192.0/18 Amazon
+204.246.160.0/22 Amazon
+204.246.164.0/22 Amazon
+204.246.168.0/22 Amazon
+204.246.172.0/24 Amazon
+204.246.173.0/24 Amazon
+204.246.174.0/23 Amazon
+204.246.176.0/20 Amazon
+205.251.192.0/21 Amazon
+205.251.200.0/21 Amazon
+205.251.208.0/20 Amazon
+205.251.224.0/22 Amazon
+205.251.228.0/22 Amazon
+205.251.232.0/22 Amazon
+205.251.236.0/22 Amazon
+205.251.240.0/22 Amazon
+205.251.244.0/23 Amazon
+205.251.246.0/24 Amazon
+205.251.247.0/24 Amazon
+205.251.248.0/24 Amazon
+205.251.249.0/24 Amazon
+205.251.250.0/23 Amazon
+205.251.252.0/23 Amazon
+205.251.254.0/24 Amazon
+207.171.160.0/20 Amazon
+207.171.176.0/20 Amazon
+208.86.88.0/23 Amazon
+208.86.90.0/23 Amazon
+208.110.48.0/20 Amazon
+209.54.176.0/21 Amazon
+209.54.184.0/21 Amazon
+216.137.32.0/19 Amazon
+216.182.224.0/21 Amazon
+216.182.232.0/22 Amazon
+216.182.236.0/23 Amazon
+216.182.238.0/23 Amazon
+223.71.11.0/27 Amazon
+223.71.71.96/27 Amazon
+223.71.71.128/25 Amazon
diff --git a/src/fnettrace/tail.c b/src/fnettrace/tail.c
new file mode 100644
index 000000000..a910788d6
--- /dev/null
+++ b/src/fnettrace/tail.c
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "fnettrace.h"
+
+void tail(const char *logfile) {
+        assert(logfile);
+
+        // wait for no more than 5 seconds for the logfile to appear in the filesystem
+        int cnt = 5;
+        while (access(logfile, R_OK) && cnt > 0)
+                cnt--;
+        if (cnt == 0)
+                exit(1);
+
+        off_t last_size = 0;
+
+        while (1) {
+                int fd = open(logfile, O_RDONLY);
+                if (fd == -1)
+                        return;
+
+                off_t size = lseek(fd, 0, SEEK_END);
+                if (size < 0) {
+                        close(fd);
+                        return;
+                }
+
+                char *content = NULL;
+                int mmapped = 0;
+                if (size && size != last_size) {
+                        content = mmap(NULL, size, PROT_READ, MAP_PRIVATE, fd, 0);
+                        close(fd);
+                        if (content != MAP_FAILED)
+                                mmapped = 1;
+                }
+
+                if (mmapped) {
+                        printf("%.*s", (int) (size - last_size), content + last_size);
+                        fflush(0);
+                        munmap(content, size);
+                        last_size = size;
+                }
+
+                sleep(1);
+        }
+}
diff --git a/src/fsec-optimize/fsec_optimize.h b/src/fsec-optimize/fsec_optimize.h
index fc9dd7db8..2a77f69aa 100644
--- a/src/fsec-optimize/fsec_optimize.h
+++ b/src/fsec-optimize/fsec_optimize.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fsec-optimize/main.c b/src/fsec-optimize/main.c
index 84bf2d4f9..ec3420e16 100644
--- a/src/fsec-optimize/main.c
+++ b/src/fsec-optimize/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fsec-optimize/optimizer.c b/src/fsec-optimize/optimizer.c
index 4c02de59d..20333a8a8 100644
--- a/src/fsec-optimize/optimizer.c
+++ b/src/fsec-optimize/optimizer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fsec-print/fsec_print.h b/src/fsec-print/fsec_print.h
index 75a82c11a..a754e2295 100644
--- a/src/fsec-print/fsec_print.h
+++ b/src/fsec-print/fsec_print.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fsec-print/main.c b/src/fsec-print/main.c
index 5bca93d50..039377999 100644
--- a/src/fsec-print/main.c
+++ b/src/fsec-print/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fsec-print/print.c b/src/fsec-print/print.c
index 143a7a53e..f6af20f04 100644
--- a/src/fsec-print/print.c
+++ b/src/fsec-print/print.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fseccomp/fseccomp.h b/src/fseccomp/fseccomp.h
index 97eac9ed8..65337da2a 100644
--- a/src/fseccomp/fseccomp.h
+++ b/src/fseccomp/fseccomp.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fseccomp/main.c b/src/fseccomp/main.c
index 326c29a44..48665ab71 100644
--- a/src/fseccomp/main.c
+++ b/src/fseccomp/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fseccomp/protocol.c b/src/fseccomp/protocol.c
index 48dda61dd..25742c173 100644
--- a/src/fseccomp/protocol.c
+++ b/src/fseccomp/protocol.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fseccomp/seccomp.c b/src/fseccomp/seccomp.c
index 99e671799..49b789755 100644
--- a/src/fseccomp/seccomp.c
+++ b/src/fseccomp/seccomp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fseccomp/seccomp_file.c b/src/fseccomp/seccomp_file.c
index 846c7f335..ee18ca74f 100644
--- a/src/fseccomp/seccomp_file.c
+++ b/src/fseccomp/seccomp_file.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fseccomp/seccomp_secondary.c b/src/fseccomp/seccomp_secondary.c
index 540892026..d4ccd96b2 100644
--- a/src/fseccomp/seccomp_secondary.c
+++ b/src/fseccomp/seccomp_secondary.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/fshaper/fshaper.sh b/src/fshaper/fshaper.sh
index f9a6c4f06..a8379612d 100755
--- a/src/fshaper/fshaper.sh
+++ b/src/fshaper/fshaper.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # This file is part of Firejail project
-# Copyright (C) 2014-2021 Firejail Authors
+# Copyright (C) 2014-2022 Firejail Authors
 # License GPL v2
 
 TCFILE=""
diff --git a/src/ftee/ftee.h b/src/ftee/ftee.h
index a556efb75..458308a4c 100644
--- a/src/ftee/ftee.h
+++ b/src/ftee/ftee.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/ftee/main.c b/src/ftee/main.c
index 4d447f2c4..d408566fa 100644
--- a/src/ftee/main.c
+++ b/src/ftee/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/include/common.h b/src/include/common.h
index 5bcbaad88..c9640435a 100644
--- a/src/include/common.h
+++ b/src/include/common.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -73,6 +73,25 @@ static inline int atoip(const char *str, uint32_t *ip) {
         return 0;
 }
 
+// read an IPv4 address in CIDR format, for example 192.168.1.0/24
+static inline int atocidr(const char *str, uint32_t *ip, uint32_t *mask) {
+        unsigned a, b, c, d, e;
+
+        // extract ip
+        int rv = sscanf(str, "%u.%u.%u.%u/%u", &a, &b, &c, &d, &e);
+        if (rv != 5 || a > 255 || b > 255 || c > 255 || d > 255 || e > 32)
+                return 1;
+        *ip = a * 0x1000000 + b * 0x10000 + c * 0x100 + d;
+
+        // extract mask
+        uint32_t tmp;
+        unsigned i;
+        for (i = 0, *mask = 0, tmp = 0x80000000; i < e; i++, tmp >>= 1) {
+                *mask |= tmp;
+        }
+        return 0;
+}
+
 // verify an ip address is in the network range given by ifip and mask
 static inline char *in_netrange(uint32_t ip, uint32_t ifip, uint32_t ifmask) {
         if ((ip & ifmask) != (ifip & ifmask))
@@ -121,6 +140,12 @@ char *pid_proc_comm(const pid_t pid);
 char *pid_proc_cmdline(const pid_t pid);
 int pid_proc_cmdline_x11_xpra_xephyr(const pid_t pid);
 int pid_hidepid(void);
+char *do_replace_cntrl_chars(char *str, char c);
+char *replace_cntrl_chars(const char *str, char c);
+int has_cntrl_chars(const char *str);
+void reject_cntrl_chars(const char *fname);
+void reject_meta_chars(const char *fname, int globbing);
 void warn_dumpable(void);
 const char *gnu_basename(const char *path);
+int *str_to_int_array(const char *str, size_t *sz);
 #endif
diff --git a/src/include/euid_common.h b/src/include/euid_common.h
index 8d8dd95f6..f40cbb9de 100644
--- a/src/include/euid_common.h
+++ b/src/include/euid_common.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/include/firejail_user.h b/src/include/firejail_user.h
index cf17fa0cf..6cf895db8 100644
--- a/src/include/firejail_user.h
+++ b/src/include/firejail_user.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/include/gcov_wrapper.h b/src/include/gcov_wrapper.h
new file mode 100644
index 000000000..144181ca0
--- /dev/null
+++ b/src/include/gcov_wrapper.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef GCOV_WRAPPER_H
+#define GCOV_WRAPPER_H
+
+#ifdef HAS_GCOV
+#include <gcov.h>
+
+/*
+ * __gcov_flush was removed on gcc 11.1.0 (as it's no longer needed), but it
+ * appears to be the safe/"correct" way to do things on previous versions (as
+ * it ensured proper locking, which is now done elsewhere).  Thus, keep using
+ * it in the code and ensure that it exists, in order to support gcc <11.1.0
+ * and gcc >=11.1.0, respectively.
+ */
+#if __GNUC__ > 11 || (__GNUC__ == 11 && __GNUC_MINOR__ >= 1)
+static void __gcov_flush(void) {
+       __gcov_dump();
+       __gcov_reset();
+}
+#endif
+#else
+#define __gcov_dump() ((void)0)
+#define __gcov_reset() ((void)0)
+#define __gcov_flush() ((void)0)
+#endif /* HAS_GCOV */
+
+#endif /* GCOV_WRAPPER_H */
diff --git a/src/include/ldd_utils.h b/src/include/ldd_utils.h
index ffd6e189f..e9dac1171 100644
--- a/src/include/ldd_utils.h
+++ b/src/include/ldd_utils.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/include/pid.h b/src/include/pid.h
index 17e51f660..7e235b713 100644
--- a/src/include/pid.h
+++ b/src/include/pid.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/include/rundefs.h b/src/include/rundefs.h
index d14f6782f..4ba3e27f4 100644
--- a/src/include/rundefs.h
+++ b/src/include/rundefs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -79,24 +79,8 @@
 #define PATH_SECCOMP_MDWX_32            LIBDIR "/firejail/seccomp.mdwx.32"
 #define PATH_SECCOMP_BLOCK_SECONDARY    LIBDIR "/firejail/seccomp.block_secondary"      // secondary arch blocking filter built during make
 
-
 #define RUN_DEV_DIR                     RUN_MNT_DIR "/dev"
 #define RUN_DEVLOG_FILE                 RUN_MNT_DIR "/devlog"
-
-#define RUN_WHITELIST_X11_DIR           RUN_MNT_DIR "/orig-x11"
-#define RUN_WHITELIST_HOME_USER_DIR     RUN_MNT_DIR "/orig-home-user"           // home directory whitelisting
-#define RUN_WHITELIST_RUN_USER_DIR      RUN_MNT_DIR "/orig-run-user"            // run directory whitelisting
-#define RUN_WHITELIST_TMP_DIR           RUN_MNT_DIR "/orig-tmp"
-#define RUN_WHITELIST_MEDIA_DIR         RUN_MNT_DIR "/orig-media"
-#define RUN_WHITELIST_MNT_DIR           RUN_MNT_DIR "/orig-mnt"
-#define RUN_WHITELIST_VAR_DIR           RUN_MNT_DIR "/orig-var"
-#define RUN_WHITELIST_DEV_DIR           RUN_MNT_DIR "/orig-dev"
-#define RUN_WHITELIST_OPT_DIR           RUN_MNT_DIR "/orig-opt"
-#define RUN_WHITELIST_SRV_DIR           RUN_MNT_DIR "/orig-srv"
-#define RUN_WHITELIST_ETC_DIR           RUN_MNT_DIR "/orig-etc"
-#define RUN_WHITELIST_SHARE_DIR         RUN_MNT_DIR "/orig-share"
-#define RUN_WHITELIST_MODULE_DIR        RUN_MNT_DIR "/orig-module"
-
 #define RUN_XAUTHORITY_FILE             RUN_MNT_DIR "/.Xauthority"              // private options
 #define RUN_XAUTH_FILE                  RUN_MNT_DIR "/xauth"                    // x11=xorg
 #define RUN_XAUTHORITY_SEC_DIR          RUN_MNT_DIR "/.sec.Xauthority"          // x11=xorg
diff --git a/src/include/seccomp.h b/src/include/seccomp.h
index 43bb73a04..9dbe25bfa 100644
--- a/src/include/seccomp.h
+++ b/src/include/seccomp.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/include/syscall.h b/src/include/syscall.h
index 015dd01b9..68be16a04 100644
--- a/src/include/syscall.h
+++ b/src/include/syscall.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/jailtest/Makefile.in b/src/jailcheck/Makefile.in
index 6306d24ec..d218c1f90 100644
--- a/src/jailtest/Makefile.in
+++ b/src/jailcheck/Makefile.in
@@ -1,16 +1,16 @@
 .PHONY: all
-all: jailtest
+all: jailcheck
 
 include ../common.mk
 
 %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/pid.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 
-jailtest: $(OBJS)
+jailcheck: $(OBJS)
         $(CC)  $(LDFLAGS) -o $@ $(OBJS)  ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS)
 
 .PHONY: clean
-clean:; rm -fr *.o jailtest *.gcov *.gcda *.gcno *.plist
+clean:; rm -fr *.o jailcheck *.gcov *.gcda *.gcno *.plist
 
 .PHONY: distclean
 distclean: clean
diff --git a/src/jailtest/access.c b/src/jailcheck/access.c
index 4e737dc7a..3e99b0b52 100644
--- a/src/jailtest/access.c
+++ b/src/jailcheck/access.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 #include <dirent.h>
 #include <sys/wait.h>
 
@@ -36,7 +36,7 @@ void access_setup(const char *directory) {
         assert(user_home_dir);
 
         if (files_cnt >= MAX_TEST_FILES) {
-                fprintf(stderr, "Error: maximum number of test directories exceded\n");
+                fprintf(stderr, "Error: maximum number of test directories exceeded\n");
                 exit(1);
         }
 
@@ -74,7 +74,7 @@ void access_setup(const char *directory) {
 
         // create a test file
         char *test_file;
-        if (asprintf(&test_file, "%s/jailtest-access-%d", path, getpid()) == -1)
+        if (asprintf(&test_file, "%s/jailcheck-access-%d", path, getpid()) == -1)
                 errExit("asprintf");
 
         FILE *fp = fopen(test_file, "w");
diff --git a/src/jailtest/apparmor.c b/src/jailcheck/apparmor.c
index 9ddfea3de..521ce047e 100644
--- a/src/jailtest/apparmor.c
+++ b/src/jailcheck/apparmor.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 
 #ifdef HAVE_APPARMOR
 #include <sys/apparmor.h>
diff --git a/src/jailtest/jailtest.h b/src/jailcheck/jailcheck.h
index 0c4883061..2d25ee8ce 100644
--- a/src/jailtest/jailtest.h
+++ b/src/jailcheck/jailcheck.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,8 +17,8 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#ifndef JAILTEST_H
-#define JAILTEST_H
+#ifndef JAILCHECK_H
+#define JAILCHECK_H
 
 #include "../include/common.h"
 
@@ -53,10 +53,12 @@ void apparmor_test(pid_t pid);
 // seccomp.c
 void seccomp_test(pid_t pid);
 
+// network.c
+void network_test(void);
 // utils.c
 char *get_sudo_user(void);
 char *get_homedir(const char *user, uid_t *uid, gid_t *gid);
 int find_child(pid_t pid);
 pid_t switch_to_child(pid_t pid);
 
-#endif
\ No newline at end of file
+#endif
diff --git a/src/jailtest/main.c b/src/jailcheck/main.c
index 3369dca39..04fc3a6af 100644
--- a/src/jailtest/main.c
+++ b/src/jailcheck/main.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 #include "../include/firejail_user.h"
 #include "../include/pid.h"
 #include <sys/wait.h>
@@ -30,7 +30,7 @@ char *user_run_dir = NULL;
 int arg_debug = 0;
 
 static char *usage_str =
-        "Usage: jailtest [options] directory [directory]\n\n"
+        "Usage: jailcheck [options] directory [directory]\n\n"
         "Options:\n"
         "   --debug - print debug messages.\n"
         "   --help, -? - this help screen.\n"
@@ -157,6 +157,7 @@ int main(int argc, char **argv) {
                         seccomp_test(pid);
                         fflush(0);
 
+                        // filesystem tests
                         pid_t child = fork();
                         if (child == -1)
                                 errExit("fork");
@@ -185,6 +186,28 @@ int main(int argc, char **argv) {
                         }
                         int status;
                         wait(&status);
+
+                        // network test
+                        child = fork();
+                        if (child == -1)
+                                errExit("fork");
+                        if (child == 0) {
+                                int rv = join_namespace(pid, "net");
+                                if (rv == 0)
+                                        network_test();
+                                else {
+                                        printf("   Error: I cannot join the process network stack\n");
+                                        exit(1);
+                                }
+
+                                // drop privileges in order not to trigger cleanup()
+                                if (setgid(user_gid) != 0)
+                                        errExit("setgid");
+                                if (setuid(user_uid) != 0)
+                                        errExit("setuid");
+                                return 0;
+                        }
+                        wait(&status);
                 }
         }
 
diff --git a/src/jailcheck/network.c b/src/jailcheck/network.c
new file mode 100644
index 000000000..8f70c6ff0
--- /dev/null
+++ b/src/jailcheck/network.c
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+#include "jailcheck.h"
+#include <netdb.h>
+#include <arpa/inet.h>
+#include <ifaddrs.h>
+#include <net/if.h>
+#include <linux/connector.h>
+#include <linux/netlink.h>
+#include <linux/if_link.h>
+#include <linux/sockios.h>
+#include <sys/ioctl.h>
+
+
+void network_test(void) {
+        // I am root running in a network namespace
+        struct ifaddrs *ifaddr, *ifa;
+        int found = 0;
+
+        // walk through the linked list
+        if (getifaddrs(&ifaddr) == -1)
+                errExit("getifaddrs");
+        for (ifa = ifaddr; ifa != NULL; ifa = ifa->ifa_next) {
+                if (strcmp(ifa->ifa_name, "lo") == 0)
+                        continue;
+
+                found = 1;
+                break;
+        }
+
+        freeifaddrs(ifaddr);
+
+        if (found)
+                printf("   Networking: enabled\n");
+        else
+                printf("   Networking: disabled\n");
+}
+
+
+
diff --git a/src/jailtest/noexec.c b/src/jailcheck/noexec.c
index 4347b7eef..4cf5dabde 100644
--- a/src/jailtest/noexec.c
+++ b/src/jailcheck/noexec.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 #include <sys/wait.h>
 #include <sys/stat.h>
 #include <fcntl.h>
@@ -67,7 +67,7 @@ void noexec_test(const char *path) {
                 return;
 
         char *fname;
-        if (asprintf(&fname, "%s/jailtest-noexec-%d", path, getpid()) == -1)
+        if (asprintf(&fname, "%s/jailcheck-noexec-%d", path, getpid()) == -1)
                 errExit("asprintf");
 
         pid_t child = fork();
@@ -110,4 +110,4 @@ void noexec_test(const char *path) {
         wait(&status);
         int rv = unlink(fname);
         (void) rv;
-}
\ No newline at end of file
+}
diff --git a/src/jailtest/seccomp.c b/src/jailcheck/seccomp.c
index 2cecb4b4d..ac8064f0b 100644
--- a/src/jailtest/seccomp.c
+++ b/src/jailcheck/seccomp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 #define MAXBUF 4096
 
 void seccomp_test(pid_t pid) {
diff --git a/src/jailtest/sysfiles.c b/src/jailcheck/sysfiles.c
index 7e4709453..0df95d496 100644
--- a/src/jailtest/sysfiles.c
+++ b/src/jailcheck/sysfiles.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 #include <dirent.h>
 #include <sys/wait.h>
 
@@ -34,7 +34,7 @@ void sysfiles_setup(const char *file) {
         assert(file);
 
         if (files_cnt >= MAX_TEST_FILES) {
-                fprintf(stderr, "Error: maximum number of system test files exceded\n");
+                fprintf(stderr, "Error: maximum number of system test files exceeded\n");
                 exit(1);
         }
 
diff --git a/src/jailtest/utils.c b/src/jailcheck/utils.c
index 41c21b753..65431e2e1 100644
--- a/src/jailtest/utils.c
+++ b/src/jailcheck/utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 #include "../include/pid.h"
 #include <errno.h>
 #include <pwd.h>
diff --git a/src/jailtest/virtual.c b/src/jailcheck/virtual.c
index fcdcf9720..93172d65c 100644
--- a/src/jailtest/virtual.c
+++ b/src/jailcheck/virtual.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,7 +17,7 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include "jailtest.h"
+#include "jailcheck.h"
 #include <dirent.h>
 #include <sys/wait.h>
 
@@ -43,7 +43,7 @@ void virtual_setup(const char *directory) {
 
         // create a test file
         char *test_file;
-        if (asprintf(&test_file, "%s/jailtest-private-%d", directory, getpid()) == -1)
+        if (asprintf(&test_file, "%s/jailcheck-private-%d", directory, getpid()) == -1)
                 errExit("asprintf");
 
         FILE *fp = fopen(test_file, "w");
diff --git a/src/lib/common.c b/src/lib/common.c
index f1bd7a6fe..8e84fab26 100644
--- a/src/lib/common.c
+++ b/src/lib/common.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -31,6 +31,7 @@
 #include <dirent.h>
 #include <string.h>
 #include <time.h>
+#include <limits.h>
 #include "../include/common.h"
 #define BUFLEN 4096
 
@@ -320,6 +321,115 @@ const char *gnu_basename(const char *path) {
         return last_slash+1;
 }
 
+char *do_replace_cntrl_chars(char *str, char c) {
+        if (str) {
+                size_t i;
+                for (i = 0; str[i]; i++) {
+                        if (iscntrl((unsigned char) str[i]))
+                                str[i] = c;
+                }
+        }
+        return str;
+}
+
+char *replace_cntrl_chars(const char *str, char c) {
+        assert(str);
+
+        char *rv = strdup(str);
+        if (!rv)
+                errExit("strdup");
+
+        do_replace_cntrl_chars(rv, c);
+        return rv;
+}
+
+int has_cntrl_chars(const char *str) {
+        assert(str);
+
+        size_t i;
+        for (i = 0; str[i]; i++) {
+                if (iscntrl((unsigned char) str[i]))
+                        return 1;
+        }
+        return 0;
+}
+
+void reject_cntrl_chars(const char *fname) {
+        assert(fname);
+
+        if (has_cntrl_chars(fname)) {
+                char *fname_print = replace_cntrl_chars(fname, '?');
+
+                fprintf(stderr, "Error: \"%s\" is an invalid filename: no control characters are allowed\n", fname_print);
+                exit(1);
+        }
+}
+
+void reject_meta_chars(const char *fname, int globbing) {
+        assert(fname);
+
+        reject_cntrl_chars(fname);
+
+        const char *reject = "\\&!?\"<>%^{};,*[]";
+        if (globbing)
+                reject = "\\&!\"<>%^{};,"; // file globbing ('*?[]') is allowed
+
+        const char *c = strpbrk(fname, reject);
+        if (c) {
+                fprintf(stderr, "Error: \"%s\" is an invalid filename: rejected character: \"%c\"\n", fname, *c);
+                exit(1);
+        }
+}
+
+// takes string with comma separated int values, returns int array
+int *str_to_int_array(const char *str, size_t *sz) {
+        assert(str && sz);
+
+        size_t curr_sz = 0;
+        size_t arr_sz = 16;
+        int *rv = malloc(arr_sz * sizeof(int));
+        if (!rv)
+                errExit("malloc");
+
+        char *dup = strdup(str);
+        if (!dup)
+                errExit("strdup");
+        char *tok = strtok(dup, ",");
+        if (!tok) {
+                free(dup);
+                free(rv);
+                goto errout;
+        }
+
+        while (tok) {
+                char *end;
+                long val = strtol(tok, &end, 10);
+                if (end == tok || *end != '\0' || val < INT_MIN || val > INT_MAX) {
+                        free(dup);
+                        free(rv);
+                        goto errout;
+                }
+
+                if (curr_sz == arr_sz) {
+                        arr_sz *= 2;
+                        rv = realloc(rv, arr_sz * sizeof(int));
+                        if (!rv)
+                                errExit("realloc");
+                }
+                rv[curr_sz++] = val;
+
+                tok = strtok(NULL, ",");
+        }
+        free(dup);
+
+        *sz = curr_sz;
+        return rv;
+
+errout:
+        *sz = 0;
+        return NULL;
+}
+
 //**************************
 // time trace based on getticks function
 //**************************
diff --git a/src/lib/errno.c b/src/lib/errno.c
index 9edb44c22..b666c5646 100644
--- a/src/lib/errno.c
+++ b/src/lib/errno.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/lib/firejail_user.c b/src/lib/firejail_user.c
index d6a3c71ab..bf338ee43 100644
--- a/src/lib/firejail_user.c
+++ b/src/lib/firejail_user.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/lib/ldd_utils.c b/src/lib/ldd_utils.c
index cd60d74e4..bc4f7cf9c 100644
--- a/src/lib/ldd_utils.c
+++ b/src/lib/ldd_utils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -50,7 +50,7 @@ int is_lib_64(const char *exe) {
         unsigned char buf[EI_NIDENT];
         ssize_t len = 0;
         while (len < EI_NIDENT) {
-                ssize_t sz = read(fd, buf, EI_NIDENT);
+                ssize_t sz = read(fd, buf + len, EI_NIDENT - len);
                 if (sz <= 0)
                         goto doexit;
                 len += sz;
diff --git a/src/lib/pid.c b/src/lib/pid.c
index ca62aaa42..ad6403f65 100644
--- a/src/lib/pid.c
+++ b/src/lib/pid.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/lib/syscall.c b/src/lib/syscall.c
index b3131ac17..a17f6423a 100644
--- a/src/lib/syscall.c
+++ b/src/lib/syscall.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -253,9 +253,6 @@ static const SyscallGroupList sysgroups[] = {
 #ifdef SYS_fanotify_init
           "fanotify_init,"
 #endif
-#ifdef SYS_kcmp
-          "kcmp,"
-#endif
 #ifdef SYS_add_key
           "add_key,"
 #endif
@@ -1681,14 +1678,14 @@ void syscalls_in_list(const char *list, const char *slist, int fd, char **prelis
         sl.postlist = NULL;
         syscall_check_list(list, syscall_in_list, 0, 0, &sl, native);
         if (!arg_quiet) {
-                printf("Seccomp list in: %s,", list);
+                fprintf(stderr, "Seccomp list in: %s,", list);
                 if (sl.slist)
-                        printf(" check list: %s,", sl.slist);
+                        fprintf(stderr, " check list: %s,", sl.slist);
                 if (sl.prelist)
-                        printf(" prelist: %s,", sl.prelist);
+                        fprintf(stderr, " prelist: %s,", sl.prelist);
                 if (sl.postlist)
-                        printf(" postlist: %s", sl.postlist);
-                printf("\n");
+                        fprintf(stderr, " postlist: %s", sl.postlist);
+                fprintf(stderr, "\n");
         }
         *prelist = sl.prelist;
         *postlist = sl.postlist;
diff --git a/src/libpostexecseccomp/libpostexecseccomp.c b/src/libpostexecseccomp/libpostexecseccomp.c
index 1d1eb283b..e2339547e 100644
--- a/src/libpostexecseccomp/libpostexecseccomp.c
+++ b/src/libpostexecseccomp/libpostexecseccomp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/libtrace/libtrace.c b/src/libtrace/libtrace.c
index d88512b0a..c0832cbde 100644
--- a/src/libtrace/libtrace.c
+++ b/src/libtrace/libtrace.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -18,12 +18,12 @@
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
 #define _GNU_SOURCE
+#include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <dlfcn.h>
 #include <sys/types.h>
-#include <limits.h>
 #include <unistd.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
@@ -706,10 +706,14 @@ __attribute__((constructor))
 static void log_exec(int argc, char** argv) {
         (void) argc;
         (void) argv;
-        static char buf[PATH_MAX + 1];
-        int rv = readlink("/proc/self/exe", buf, PATH_MAX);
-        if (rv != -1) {
-                buf[rv] = '\0'; // readlink does not add a '\0' at the end
+        char *buf = realpath("/proc/self/exe", NULL);
+        if (buf == NULL) {
+                if (errno == ENOMEM) {
+                        tprintf(ftty, "realpath: %s\n", strerror(errno));
+                        exit(1);
+                }
+        } else {
                 tprintf(ftty, "%u:%s:exec %s:0\n", mypid, myname, buf);
+                free(buf);
         }
 }
diff --git a/src/libtracelog/libtracelog.c b/src/libtracelog/libtracelog.c
index b946cc889..760ac7612 100644
--- a/src/libtracelog/libtracelog.c
+++ b/src/libtracelog/libtracelog.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/man/Makefile.in b/src/man/Makefile.in
index 3711d5cec..fbd2d795e 100644
--- a/src/man/Makefile.in
+++ b/src/man/Makefile.in
@@ -1,5 +1,5 @@
 .PHONY: all
-all: firecfg.man firejail.man firejail-login.man firejail-users.man firejail-profile.man firemon.man jailtest.man
+all: firecfg.man firejail.man firejail-login.man firejail-users.man firejail-profile.man firemon.man jailcheck.man
 
 include ../common.mk
 
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt
index dbb9397c6..189e9cc8d 100644
--- a/src/man/firecfg.txt
+++ b/src/man/firecfg.txt
@@ -27,7 +27,7 @@ desktop managers are supported in this moment
 To set it up, run "sudo firecfg" after installing Firejail software.
 The same command should also be run after
 installing new programs. If the program is supported by Firejail, the symbolic link in /usr/local/bin
-will be created. For a full list of programs supported by default run "cat /usr/lib/firejail/firecfg.config".
+will be created. For a full list of programs supported by default run "cat /etc/firejail/firecfg.config".
 
 For user-driven manual integration, see \fBDESKTOP INTEGRATION\fR section in \fBman 1 firejail\fR.
 .SH DEFAULT ACTIONS
@@ -135,4 +135,4 @@ Homepage: https://firejail.wordpress.com
 .BR firejail-profile (5),
 .BR firejail-login (5),
 .BR firejail-users (5),
-.BR jailtest (1)
+.BR jailcheck (1)
diff --git a/src/man/firejail-login.txt b/src/man/firejail-login.txt
index 1b8a4931c..05afd55b5 100644
--- a/src/man/firejail-login.txt
+++ b/src/man/firejail-login.txt
@@ -39,4 +39,4 @@ Homepage: https://firejail.wordpress.com
 .BR firecfg (1),
 .BR firejail-profile (5),
 .BR firejail-users (5),
-.BR jailtest (1)
+.BR jailcheck (1)
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 9d11add06..e962e18da 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -1,18 +1,84 @@
 .TH FIREJAIL-PROFILE 5 "MONTH YEAR" "VERSION" "firejail profiles man page"
 .SH NAME
-profile \- Security profile file syntax for Firejail
+profile \- Security profile file syntax, and information about building new application profiles.
 
-.SH USAGE
+.SH SYNOPSIS
+
+Using a specific profile:
+.PP
+.RS
 .TP
-firejail \-\-profile=filename.profile
+\fBfirejail \-\-profile=filename.profile
+.br
+
+.br
+Example:
+.br
+$ firejail --profile=/etc/firejail/kdenlive.profile --appimage kdenlive.appimage
+.br
+
+.br
+.TP
+\fBfirejail \-\-profile=profile_name
+.br
+
+.br
+Example:
+.br
+$ firejail --profile=kdenlive --appimage kdenlive.appimage
+.br
+
+.br
+.RE
+.PP
+
+
+
+Building a profile manually:
+.PP
+.RS
+Start with the template in /usr/share/doc/firejail/profile.template and modify it in a text editor.
+To integrate the program in your desktop environment copy the profile file in ~/.config/firejail
+directory and run "sudo firecfg".
 .RE
-firejail \-\-profile=profile_name
+.PP
+
+Aliases and redirections:
+.PP
+.RS
+In some cases the same profile can be used for several applications.
+One such example is LibreOffice.
+Build a regular profile for the main application, and for the rest use
+/usr/share/doc/firejail/redirect_alias-profile.template.
+.RE
+.PP
+
+Running the profile builder:
+.PP
+.RS
+.TP
+\fBfirejail \-\-build=appname.profile appname
+.br
+
+.br
+Example:
+.br
+$ firejail --build=blobby.profile blobby
+.br
+
+.br
+Run the program in "firejail \-\-build" and try to exercise as many program features as possible.
+The profile is extracted and saved in the current directory. Open it in a text editor and add or remove
+sandboxing options as necessary. Test again after modifying the profile. To integrate the program
+in your desktop environment copy the profile file in ~/.config/firejail directory and run "sudo firecfg".
+.RE
+.PP
 
 .SH DESCRIPTION
 Several command line options can be passed to the program using
 profile files. Firejail chooses the profile file as follows:
 
-\fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in  /etc/firejail directory. Profile names do not include the .profile suffix.
+\fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix.
 Example:
 .PP
 .RS
@@ -94,6 +160,11 @@ Example: "blacklist ~/My Virtual Machines"
 
 .TP
 \fB# this is a comment
+Example:
+
+# disable networking
+.br
+net none # this command creates an empty network namespace
 
 .TP
 \fB?CONDITIONAL: profile line
@@ -103,7 +174,7 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir"
 
 This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line.
 
-Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS, HAS_NOSOUND, HAS_PRIVATE and HAS_X11. The conditionals BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM
+Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS, HAS_NOSOUND, HAS_PRIVATE and HAS_X11. The conditionals ALLOW_TRAY, BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM
 can be enabled or disabled globally in Firejail's configuration file.
 
 The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines.
@@ -205,6 +276,10 @@ Mount-bind file1 on top of file2. This option is only available when running as
 \fBdisable-mnt
 Disable /mnt, /media, /run/mount and /run/media access.
 .TP
+\fBkeep-config-pulse
+Disable automatic ~/.config/pulse init, for complex setups such as remote
+pulse servers or non-standard socket paths.
+.TP
 \fBkeep-dev-shm
 /dev/shm directory is untouched (even with private-dev).
 .TP
@@ -249,16 +324,16 @@ Remount the file or the directory noexec, nodev and nosuid.
 #ifdef HAVE_OVERLAYFS
 .TP
 \fBoverlay
-Mount  a  filesystem  overlay  on top of the current filesystem.
-The overlay is stored in $HOME/.firejail/<PID>  directory.
+Mount a filesystem overlay on top of the current filesystem.
+The overlay is stored in $HOME/.firejail/<PID> directory.
 .TP
 \fBoverlay-named name
-Mount  a  filesystem  overlay  on top of the current filesystem.
-The overlay is stored in $HOME/.firejail/name  directory.
+Mount a filesystem overlay on top of the current filesystem.
+The overlay is stored in $HOME/.firejail/name directory.
 .TP
 \fBoverlay-tmpfs
-Mount  a  filesystem  overlay  on top of the current filesystem.
-All filesystem  modifications are discarded when the sandbox is closed.
+Mount a filesystem overlay on top of the current filesystem.
+All filesystem modifications are discarded when the sandbox is closed.
 #endif
 .TP
 \fBprivate
@@ -274,6 +349,7 @@ Build a new /bin in a temporary filesystem, and copy the programs in the list.
 The files in the list must be expressed as relative to the /bin,
 /sbin, /usr/bin, /usr/sbin, or /usr/local/bin directories.
 The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin.
+Multiple private-bin commands are allowed and they accumulate.
 .TP
 \fBprivate-cache
 Mount an empty temporary filesystem on top of the .cache directory in user home. All
@@ -283,7 +359,7 @@ modifications are discarded when the sandbox is closed.
 Set working directory inside jail to the home directory, and failing that, the root directory.
 .TP
 \fBprivate-cwd directory
-Set working directory inside the jail.
+Set working directory inside the jail. Full directory path is required. Symbolic links are not allowed.
 .TP
 \fBprivate-dev
 Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx,
@@ -299,6 +375,7 @@ the /etc directory, and must not contain the / character
 (e.g., /etc/foo must be expressed as foo, but /etc/foo/bar --
 expressed as foo/bar -- is disallowed).
 All modifications are discarded when the sandbox is closed.
+Multiple private-etc commands are allowed and they accumulate.
 #ifdef HAVE_PRIVATE_HOME
 .TP
 \fBprivate-home file,directory
@@ -345,7 +422,7 @@ Make directory or file read-only.
 Make directory or file read-write.
 .TP
 \fBtmpfs directory
-Mount an empty tmpfs filesystem on top of directory. This option is available only when running the sandbox as root.
+Mount an empty tmpfs filesystem on top of directory. Directories outside user home or not owned by the user are not allowed. Sandboxes running as root are exempt from these restrictions.
 .TP
 \fBtracelog
 Blacklist violations logged to syslog.
@@ -353,13 +430,19 @@ Blacklist violations logged to syslog.
 \fBwhitelist file_or_directory
 Whitelist directory or file. A temporary file system is mounted on the top directory, and the
 whitelisted files are mount-binded inside. Modifications to whitelisted files are persistent,
-everything else is discarded when the sandbox is closed. The top directory could be
-user home, /dev, /etc, /media, /mnt, /opt, /srv, /sys/module, /usr/share, /var, and /tmp.
+everything else is discarded when the sandbox is closed. The top directory can be
+all directories in / (except /proc and /sys), /sys/module, /run/user/$UID, $HOME and
+all directories in /usr.
 .br
 
 .br
 Symbolic link handling: with the exception of user home, both the link and the real file should be in
 the same top directory. For user home, both the link and the real file should be owned by the user.
+
+.TP
+\fBwhitelist-ro file_or_directory
+Equivalent to "whitelist file_or_directory" followed by "read-only file_or_directory"
+
 .TP
 \fBwritable-etc
 Mount /etc directory read-write.
@@ -408,17 +491,21 @@ Sets the NO_NEW_PRIVS prctl.  This ensures that child processes
 cannot acquire new privileges using execve(2);  in particular,
 this means that calling a suid binary (or one with file capabilities)
 does not result in an increase of privilege.
+.TP
+\fBnoprinters
+Disable printers.
 #ifdef HAVE_USERNS
 .TP
 \fBnoroot
-Use this command  to enable an user namespace. The namespace has only one user, the current user.
+Use this command to enable an user namespace. The namespace has only one user, the current user.
 There is no root account (uid 0) defined in the namespace.
 #endif
 .TP
 \fBprotocol protocol1,protocol2,protocol3
-Enable protocol filter. The filter is based on seccomp and  checks the
+Enable protocol filter. The filter is based on seccomp and checks the
 first argument to socket system call. Recognized values: \fBunix\fR,
-\fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR.
+\fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR, and \fBbluetooth\fR.
+Multiple protocol commands are allowed.
 .TP
 \fBseccomp
 Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details.
@@ -530,7 +617,7 @@ Allow the application to see but not talk to the name org.freedesktop.Notificati
 Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
 .TP
 \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
-Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
+Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
 .TP
 \fBdbus-user filter
 Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands.
@@ -640,6 +727,11 @@ env CFLAGS="-W -Wall -Werror"
 .TP
 \fBipc-namespace
 Enable IPC namespace.
+
+.TP
+\fBkeep-fd
+Inherit open file descriptors to sandbox.
+
 .TP
 \fBname sandboxname
 Set sandbox name. Example:
@@ -652,9 +744,8 @@ name browser
 \fBno3d
 Disable 3D hardware acceleration.
 .TP
-\fBnoautopulse
-Disable automatic ~/.config/pulse init, for complex setups such as remote
-pulse servers or non-standard socket paths.
+\fBnoautopulse \fR(deprecated)
+See keep-config-pulse.
 .TP
 \fBnodvd
 Disable DVD and audio CD devices.
@@ -662,6 +753,9 @@ Disable DVD and audio CD devices.
 \fBnogroups
 Disable supplementary user groups
 .TP
+\fBnoinput
+Disable input devices.
+.TP
 \fBnosound
 Disable sound system.
 .TP
@@ -674,8 +768,8 @@ Disable U2F devices.
 \fBnovideo
 Disable video capture devices.
 .TP
-\fBnoinput
-Disable input devices.
+\fBmachine-id
+Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox.
 .TP
 \fBshell none
 Run the program directly, without a shell.
@@ -795,8 +889,8 @@ a DHCP client and releasing the lease manually.
 
 .TP
 \fBiprange address,address
-Assign  an  IP address in the provided range to the last network
-interface defined by  a  net command.  A  default  gateway  is assigned by default.
+Assign an IP address in the provided range to the last network
+interface defined by a net command.  A default gateway is assigned by default.
 .br
 
 .br
@@ -814,10 +908,6 @@ iprange 192.168.1.150,192.168.1.160
 Assign MAC addresses to the last network interface defined by a net command.
 
 .TP
-\fBmachine-id
-Spoof id number in /etc/machine-id file - a new random id is generated inside the sandbox.
-
-.TP
 \fBmtu number
 Assign a MTU value to the last network interface defined by a net command.
 
@@ -880,18 +970,37 @@ be created and configured using "ip netns".
 Use this name for the interface connected to the bridge for --net=bridge_interface commands,
 instead of the default one.
 #endif
+
 .SH Other
 .TP
 \fBdeterministic-exit-code
 Always exit firejail with the first child's exit status. The default behavior is to use the exit status of the final child to exit, which can be nondeterministic.
 
 .TP
+\fBdeterministic-shutdown
+Always shut down the sandbox after the first child has terminated. The default behavior is to keep the sandbox alive as long as it contains running processes.
+
+.TP
 \fBjoin-or-start sandboxname
 Join the sandbox identified by name or start a new one.
 Same as "firejail --join=sandboxname" command if sandbox with specified name exists, otherwise same as "name sandboxname".
 
 .SH FILES
-/etc/firejail/filename.profile, $HOME/.config/firejail/filename.profile
+.TP
+\fB/etc/firejail/appname.profile
+Global Firejail configuration consisting mainly of profiles for each application supported by default.
+
+.TP
+\fB$HOME/.config/firejail/appname.profile
+User application profiles, will take precedence over the global profiles.
+
+.TP
+\fB/usr/share/doc/firejail/profile.template
+Template for building new profiles.
+
+.TP
+\fB/usr/share/doc/firejail/redirect_alias-profile.template
+Template for aliasing/redirecting profiles.
 
 .SH LICENSE
 Firejail is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
@@ -903,7 +1012,7 @@ Homepage: https://firejail.wordpress.com
 .BR firecfg (1),
 .BR firejail-login (5),
 .BR firejail-users (5),
-.BR jailtest (1)
+.BR jailcheck (1)
 
 .UR https://github.com/netblue30/firejail/wiki/Creating-Profiles
 .UE
diff --git a/src/man/firejail-users.txt b/src/man/firejail-users.txt
index c5a9c1848..e3cce7ed5 100644
--- a/src/man/firejail-users.txt
+++ b/src/man/firejail-users.txt
@@ -59,4 +59,4 @@ Homepage: https://firejail.wordpress.com
 .BR firecfg (1),
 .BR firejail-profile (5),
 .BR firejail-login (5),
-.BR jailtest (1)
+.BR jailcheck (1)
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 23ec23fb1..f9deaeaa4 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -45,7 +45,7 @@ firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-deb
 #ifdef HAVE_LTS
 This is Firejail long-term support (LTS), an enterprise focused version of the software,
 LTS is usually supported for two or three years.
-During this time  only bugs and the occasional documentation problems are fixed.
+During this time only bugs and the occasional documentation problems are fixed.
 The attack surface of the SUID executable was greatly reduced by removing some of the features.
 .br
 
@@ -109,7 +109,7 @@ ptrace system call allows a full bypass of the seccomp filter.
 .br
 Example:
 .br
-$ firejail  --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox
+$ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox
 .TP
 \fB\-\-allusers
 All directories under /home are visible inside the sandbox. By default, only current user home directory is visible.
@@ -147,12 +147,12 @@ private-bin and private-lib are disabled by default when running appimages.
 .br
 Example:
 .br
-$ firejail --appimage krita-3.0-x86_64.appimage
+$ firejail --appimage --profile=krita krita-3.0-x86_64.appimage
 .br
-$ firejail --appimage --private krita-3.0-x86_64.appimage
+$ firejail --appimage --private --profile=krita krita-3.0-x86_64.appimage
 .br
 #ifdef HAVE_X11
-$ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
+$ firejail --appimage --net=none --x11 --profile=krita krita-3.0-x86_64.appimage
 #endif
 .TP
 #ifdef HAVE_NETWORK
@@ -185,10 +185,7 @@ $ firejail "\-\-blacklist=/home/username/My Virtual Machines"
 $ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines
 .TP
 \fB\-\-build
-The command builds a whitelisted profile. The profile is printed on the screen. If /usr/bin/strace is installed on the system, it also
-builds a whitelisted seccomp profile. The program is run in a very relaxed sandbox,
-with only --caps.drop=all and --nonewprivs. Programs that raise user privileges are not supported
-in order to allow strace to run. Chromium and Chromium-based browsers will not work.
+The command builds a whitelisted profile. The profile is printed on the screen. The program is run in a very relaxed sandbox, with only --caps.drop=all and --nonewprivs. Programs that raise user privileges are not supported.
 .br
 
 .br
@@ -197,10 +194,8 @@ Example:
 $ firejail --build vlc ~/Videos/test.mp4
 .TP
 \fB\-\-build=profile-file
-The command builds a whitelisted profile, and saves it in profile-file. If /usr/bin/strace is installed on the system, it also
-builds a whitelisted seccomp profile. The program is run in a very relaxed sandbox,
-with only --caps.drop=all and --nonewprivs. Programs that raise user privileges are not supported
-in order to allow strace to run. Chromium and Chromium-based browsers will not work.
+The command builds a whitelisted profile, and saves it in profile-file. The program is run in a very relaxed sandbox,
+with only --caps.drop=all and --nonewprivs. Programs that raise user privileges are not supported.
 .br
 
 .br
@@ -290,8 +285,8 @@ $ firejail \-\-caps.print=3272
 Print content of file from sandbox container, see FILE TRANSFER section for more details.
 #endif
 .TP
-\fB\-\-cgroup=tasks-file
-Place the sandbox in the specified control group. tasks-file is the full path of cgroup tasks file.
+\fB\-\-cgroup=file
+Place the sandbox in the specified control group. file is the full path of a tasks or cgroup.procs file.
 .br
 
 .br
@@ -310,6 +305,11 @@ regular user, nonewprivs and a default capabilities filter are enabled.
 Example:
 .br
 $ firejail \-\-chroot=/media/ubuntu warzone2100
+.br
+
+.br
+For automatic mounting of X11 and PulseAudio sockets set environment variables
+FIREJAIL_CHROOT_X11 and FIREJAIL_CHROOT_PULSE.
 #endif
 .TP
 \fB\-\-cpu=cpu-number,cpu-number,cpu-number
@@ -701,6 +701,12 @@ $ firejail \-\-net=eth0 \-\-defaultgw=10.10.20.1 firefox
 \fB\-\-deterministic-exit-code
 Always exit firejail with the first child's exit status. The default behavior is to use the exit status of the final child to exit, which can be nondeterministic.
 .br
+
+.TP
+\fB\-\-deterministic-shutdown
+Always shut down the sandbox after the first child has terminated. The default behavior is to keep the sandbox alive as long as it contains running processes.
+.br
+
 .TP
 \fB\-\-disable-mnt
 Blacklist /mnt, /media, /run/mount and /run/media access.
@@ -810,6 +816,26 @@ Example:
 $ firejail \-\-hosts-file=~/myhosts firefox
 
 .TP
+\fB\-\-ids-check
+Check file hashes previously generated by \-\-ids-check. See INTRUSION DETECTION SYSTEM section for more details.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-ids-check
+
+.TP
+\fB\-\-ids-init
+Initialize file hashes. See INTRUSION DETECTION SYSTEM section for more details.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-ids-init
+
+.TP
 \fB\-\-ignore=command
 Ignore command in profile file.
 .br
@@ -947,7 +973,7 @@ $ firejail \-\-net=eth0 \-\-\iprange=192.168.1.100,192.168.1.150
 
 .TP
 \fB\-\-ipc-namespace
-Enable  a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default
+Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default
 for sandboxes started as root.
 .br
 
@@ -1014,7 +1040,7 @@ $ sudo firejail --join-network=browser /sbin/iptables -vL
 .br
 
 .br
-# verify  IP addresses
+# verify IP addresses
 .br
 $ sudo firejail --join-network=browser ip addr
 .br
@@ -1052,6 +1078,17 @@ Same as "firejail --join=name" if sandbox with specified name exists, otherwise
 Note that in contrary to other join options there is respective profile option.
 
 .TP
+\fB\-\-keep-config-pulse
+Disable automatic ~/.config/pulse init, for complex setups such as remote
+pulse servers or non-standard socket paths.
+.br
+
+.br
+Example:
+.br
+$ firejail \-\-keep-config-pulse firefox
+
+.TP
 \fB\-\-keep-dev-shm
 /dev/shm directory is untouched (even with --private-dev)
 .br
@@ -1062,6 +1099,26 @@ Example:
 $ firejail --keep-dev-shm --private-dev
 
 .TP
+\fB\-\-keep-fd=all
+Inherit all open file descriptors to the sandbox. By default only file descriptors 0, 1 and 2 are inherited to the sandbox, and all other file descriptors are closed.
+.br
+
+.br
+Example:
+.br
+$ firejail --keep-fd=all
+
+.TP
+\fB\-\-keep-fd=file_descriptor
+Don't close specified open file descriptors. By default only file descriptors 0, 1 and 2 are inherited to the sandbox, and all other file descriptors are closed.
+.br
+
+.br
+Example:
+.br
+$ firejail --keep-fd=3,4,5
+
+.TP
 \fB\-\-keep-var-tmp
 /var/tmp directory is untouched.
 .br
@@ -1214,7 +1271,7 @@ $ firejail \-\-net=br0 \-\-net=br1
 .TP
 \fB\-\-net=ethernet_interface|wireless_interface
 Enable a new network namespace and connect it
-to this ethernet interface using the standard Linux macvlan|ipvaln
+to this ethernet interface using the standard Linux macvlan|ipvlan
 driver. Unless specified with option \-\-ip and \-\-defaultgw, an
 IP address and a default gateway will be assigned automatically
 to the sandbox. The IP address is verified using ARP before
@@ -1401,6 +1458,30 @@ $ firejail --name=browser --net=eth0 --netfilter firefox &
 $ firejail --netfilter6.print=browser
 
 .TP
+\fB\-\-netlock
+Several type of programs (email clients, multiplayer games etc.) talk to a very small
+number of IP addresses. But the best example is tor browser. It only talks to a guard node,
+and there are two or three more on standby in case the main one fails.
+During startup, the browser contacts all of them, after that it keeps talking to the main
+one... for weeks!
+
+Use the network locking feature to build and deploy a custom network firewall in your sandbox.
+The firewall allows only the traffic to the IP addresses detected during the program
+startup. Traffic to any other address is quietly dropped. By default the network monitoring
+time is one minute.
+
+A network namespace (\-\-net=eth0) is required for this feature to work. Example:
+.br
+
+.br
+$ firejail --net=eth0 --netlock \\
+.br
+--private=~/tor-browser_en-US ./start-tor-browser.desktop
+.br
+
+.br
+
+.TP
 \fB\-\-netmask=address
 Use this option when you want to assign an IP address in a new namespace and
 the parent interface specified by --net is not configured. An IP address and
@@ -1437,6 +1518,40 @@ PID  User    RX(KB/s) TX(KB/s) Command
 1294 netblue 53.355   1.473    firejail \-\-net=eth0 firefox
 .br
 7383 netblue 9.045    0.112    firejail \-\-net=eth0 transmission
+.TP
+\fB\-\-nettrace[=name|pid]
+Monitor TCP and UDP traffic coming into the sandbox specified by name or pid. Only networked sandboxes
+created with \-\-net are supported.
+.br
+
+.br
+Without a name/pid, Firejail will monitor the main system network namespace.
+.br
+
+.br
+ $ firejail --nettrace=browser
+.br
+
+.br
+                        95 KB/s  geoip 457, IP database 4436
+.br
+   52 KB/s ***********           64.222.84.207:443 United States
+.br
+   33 KB/s *******               89.147.74.105:63930 Hungary
+.br
+    0 B/s                        45.90.28.0:443 NextDNS
+.br
+    0 B/s                        94.70.122.176:52309(UDP) Greece
+.br
+  339 B/s                        104.26.7.35:443 Cloudflare
+.br
+
+.br
+If /usr/bin/geoiplookup is installed (geoip-bin package in Debian),
+the country the IP address originates from is added to the trace.
+We also use the static IP map in /etc/firejail/hostnames
+to print the domain names for some of the more common websites and cloud platforms.
+No external services are contacted for reverse IP lookup.
 #endif
 .TP
 \fB\-\-nice=value
@@ -1460,15 +1575,8 @@ Example:
 $ firejail --no3d firefox
 
 .TP
-\fB\-\-noautopulse
-Disable automatic ~/.config/pulse init, for complex setups such as remote
-pulse servers or non-standard socket paths.
-.br
-
-.br
-Example:
-.br
-$ firejail \-\-noautopulse firefox
+\fB\-\-noautopulse \fR(deprecated)
+See --keep-config-pulse.
 
 .TP
 \fB\-\-noblacklist=dirname_or_filename
@@ -1576,6 +1684,10 @@ does not result in an increase of privilege. This option
 is enabled by default if seccomp filter is activated.
 
 .TP
+\fB\-\-noprinters
+Disable printers.
+
+.TP
 \fB\-\-noprofile
 Do not use a security profile.
 .br
@@ -1797,8 +1909,9 @@ The files in the list must be expressed as relative to the /bin,
 /sbin, /usr/bin, /usr/sbin, or /usr/local/bin directories.
 If no listed files are found, /bin directory will be empty.
 The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin.
-All modifications are discarded when the sandbox is closed. File globbing is supported,
-see \fBFILE GLOBBING\fR section for more details.
+All modifications are discarded when the sandbox is closed.
+Multiple private-bin commands are allowed and they accumulate.
+File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
 .br
 
 .br
@@ -1828,7 +1941,6 @@ $ firejail \-\-private-cache openbox
 .TP
 \fB\-\-private-cwd
 Set working directory inside jail to the home directory, and failing that, the root directory.
-.br
 Does not impact working directory of profile include paths.
 .br
 
@@ -1849,7 +1961,7 @@ $ pwd
 .TP
 \fB\-\-private-cwd=directory
 Set working directory inside the jail.
-.br
+Full directory path is required. Symbolic links are not allowed.
 Does not impact working directory of profile include paths.
 .br
 
@@ -1892,11 +2004,10 @@ $
 Build a new /etc in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
-the /etc directory, and must not contain the / character
-(e.g., /etc/foo must be expressed as foo, but /etc/foo/bar --
-expressed as foo/bar -- is disallowed).
+the /etc directory (e.g., /etc/foo must be expressed as foo).
 If no listed file is found, /etc directory will be empty.
 All modifications are discarded when the sandbox is closed.
+Multiple private-etc commands are allowed and they accumulate.
 .br
 
 .br
@@ -1997,7 +2108,7 @@ Build a new /srv in a temporary
 filesystem, and copy the files and directories in the list.
 The files and directories in the list must be expressed as relative to
 the /srv directory, and must not contain the / character
-(e.g., /opt/srv must be expressed as foo, but /srv/foo/bar --
+(e.g., /srv/foo must be expressed as foo, but /srv/foo/bar --
 expressed as srv/bar -- is disallowed).
 If no listed file is found, /srv directory will be empty.
 All modifications are discarded when the sandbox is closed.
@@ -2055,7 +2166,7 @@ $ firejail \-\-profile.print=browser
 .TP
 \fB\-\-protocol=protocol,protocol,protocol
 Enable protocol filter. The filter is based on seccomp and checks the first argument to socket system call.
-Recognized values: unix, inet, inet6, netlink, packet and bluetooth. This option is not supported for i386 architecture.
+Recognized values: unix, inet, inet6, netlink, packet, and bluetooth. This option is not supported for i386 architecture.
 .br
 
 .br
@@ -2127,11 +2238,12 @@ $ firejail --read-only=~/test --read-write=~/test/a
 .TP
 \fB\-\-rlimit-as=number
 Set the maximum size of the process's virtual memory (address space) in bytes.
+Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024).
 
 .TP
 \fB\-\-rlimit-cpu=number
 Set the maximum limit, in seconds, for the amount of CPU time each
-sandboxed process  can consume. When the limit is reached, the processes are killed.
+sandboxed process can consume. When the limit is reached, the processes are killed.
 
 The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds
 the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps
@@ -2140,6 +2252,7 @@ track of CPU seconds for each process independently.
 .TP
 \fB\-\-rlimit-fsize=number
 Set the maximum file size that can be created by a process.
+Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024).
 .TP
 \fB\-\-rlimit-nofile=number
 Set the maximum number of files that can be opened by a process.
@@ -2174,7 +2287,7 @@ $ firejail \-\-net=eth0 \-\-scan
 .TP
 \fB\-\-seccomp
 Enable seccomp filter and blacklist the syscalls in the default list,
-which is  @default-nodebuggers unless allow-debuggers is specified,
+which is @default-nodebuggers unless \-\-allow-debuggers is specified,
 then it is @default.
 
 .br
@@ -2185,18 +2298,18 @@ system call groups are defined: @aio, @basic-io, @chown, @clock,
 @network-io, @obsolete, @privileged, @process, @raw-io, @reboot,
 @resources, @setuid, @swap, @sync, @system-service and @timer.
 More information about groups can be found in /usr/share/doc/firejail/syscalls.txt
+.br
 
-In addition, a system call can be specified by its number instead of
-name with prefix $, so for example $165 would be equal to mount on i386.
-Exceptions can be allowed with prefix !.
+.br
+The default list can be customized, see \-\-seccomp= for a description.
+It can be customized also globally in /etc/firejail/firejail.config file.
+.br
 
 .br
 System architecture is strictly imposed only if flag
 \-\-seccomp.block-secondary is used. The filter is applied at run time
 only if the correct architecture was detected. For the case of I386
-and AMD64 both 32-bit and 64-bit filters are installed. On a 64 bit
-architecture, an additional filter for 32 bit system calls can be
-installed with \-\-seccomp.32.
+and AMD64 both 32-bit and 64-bit filters are installed.
 .br
 
 .br
@@ -2207,11 +2320,14 @@ Firejail will print seccomp violations to the audit log if the kernel was compil
 Example:
 .br
 $ firejail \-\-seccomp
+
+
 .TP
 \fB\-\-seccomp=syscall,@group,!syscall2
-Enable seccomp filter, whitelist "syscall2", but blacklist the default
-list and the syscalls or syscall groups specified by the
-command.
+Enable seccomp filter, blacklist the default list and the syscalls or syscall groups
+specified by the command, but don't blacklist "syscall2". On a 64 bit
+architecture, an additional filter for 32 bit system calls can be
+installed with \-\-seccomp.32.
 .br
 
 .br
@@ -2221,6 +2337,13 @@ $ firejail \-\-seccomp=utime,utimensat,utimes firefox
 .br
 $ firejail \-\-seccomp=@clock,mkdir,unlinkat transmission-gtk
 .br
+$ firejail '\-\-seccomp=@ipc,!pipe,!pipe2' audacious
+.br
+
+.br
+Syscalls can be specified by their number if prefix $ is added,
+so for example $165 would be equal to mount on i386.
+.br
 
 .br
 Instead of dropping the syscall by returning EPERM, another error
@@ -2233,6 +2356,7 @@ by using \fBsyscall:kill\fR syntax, or the attempt may be logged with
 
 .br
 Example:
+.br
 $ firejail \-\-seccomp=unlinkat:ENOENT,utimensat,utimes
 .br
 Parent pid 10662, child pid 10663
@@ -2241,9 +2365,13 @@ Child process initialized
 .br
 $ touch testfile
 .br
+$ ls testfile
+.br
+testfile
+.br
 $ rm testfile
 .br
-rm: cannot remove `testfile': Operation not permitted
+rm: cannot remove `testfile': No such file or directory
 .br
 
 .br
@@ -2256,7 +2384,7 @@ filters.
 .br
 Example:
 .br
-$ firejail \-\-noprofile \-\-shell=none \-\-seccomp=execve bash
+$ firejail \-\-noprofile \-\-shell=none \-\-seccomp=execve sh
 .br
 Parent pid 32751, child pid 32752
 .br
@@ -2268,8 +2396,7 @@ Child process initialized in 46.44 ms
 .br
 $ ls
 .br
-Bad system call
-.br
+Operation not permitted
 
 .TP
 \fB\-\-seccomp.block-secondary
@@ -2313,15 +2440,15 @@ Child process initialized
 .br
 $ touch testfile
 .br
+$ ls testfile
+.br
+testfile
+.br
 $ rm testfile
 .br
-rm: cannot remove `testfile': Operation not permitted
+rm: cannot remove `testfile': No such file or directory
 .br
 
-
-
-
-
 .TP
 \fB\-\-seccomp.keep=syscall,@group,!syscall2
 Enable seccomp filter, blacklist all syscall not listed and "syscall2".
@@ -2556,6 +2683,13 @@ $ firejail \-\-list
 .br
 $ firejail \-\-shutdown=3272
 .TP
+\fB\-\-tab
+Enable shell tab completion in sandboxes using private or whitelisted home directories.
+.br
+
+.br
+$ firejail \-\-private --tab
+.TP
 \fB\-\-timeout=hh:mm:ss
 Kill the sandbox automatically after the time has elapsed. The time is specified in hours/minutes/seconds format.
 .br
@@ -2564,14 +2698,13 @@ Kill the sandbox automatically after the time has elapsed. The time is specified
 $ firejail \-\-timeout=01:30:00 firefox
 .TP
 \fB\-\-tmpfs=dirname
-Mount a writable tmpfs filesystem on directory dirname. This option is available only when running the sandbox as root.
-File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
+Mount a writable tmpfs filesystem on directory dirname. Directories outside user home or not owned by the user are not allowed. Sandboxes running as root are exempt from these restrictions. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
 .br
 
 .br
 Example:
 .br
-# firejail \-\-tmpfs=/var
+$ firejail \-\-tmpfs=~/.local/share
 .TP
 \fB\-\-top
 Monitor the most CPU-intensive sandboxes, see \fBMONITORING\fR section for more details.
@@ -2721,8 +2854,9 @@ $ firejail \-\-net=br0 --veth-name=if0
 \fB\-\-whitelist=dirname_or_filename
 Whitelist directory or file. A temporary file system is mounted on the top directory, and the
 whitelisted files are mount-binded inside. Modifications to whitelisted files are persistent,
-everything else is discarded when the sandbox is closed. The top directory could be
-user home, /dev, /etc, /media, /mnt, /opt, /run/user/$UID, /srv, /sys/module, /tmp, /usr/share and /var.
+everything else is discarded when the sandbox is closed. The top directory can be
+all directories in / (except /proc and /sys), /sys/module, /run/user/$UID, $HOME and
+all directories in /usr.
 .br
 
 .br
@@ -2848,7 +2982,7 @@ and it is installed by default on most Linux distributions. It provides support
 connection model. Untrusted clients are restricted in certain ways to prevent them from reading window
 contents of other clients, stealing input events, etc.
 
-The untrusted mode has several limitations. A lot of regular programs  assume they are a trusted X11 clients
+The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients
 and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples.
 Firefox and transmission-gtk seem to be working fine.
 A network namespace is not required for this option.
@@ -3179,6 +3313,65 @@ $ firejail \-\-put=mybrowser xpra-clipboard.png ~/Downloads/xpra-clipboard.png
 $ firejail \-\-cat=mybrowser ~/.bashrc
 .br
 #endif
+
+.SH INTRUSION DETECTION SYSTEM (IDS)
+The host-based intrusion detection system tracks down and audits user and system file modifications.
+The feature is configured using /etc/firejail/ids.config file, the checksums are stored in /var/lib/firejail/USERNAME.ids,
+where USERNAME is the name of the current user. We use BLAKE2 cryptographic function for hashing.
+
+As a regular user, initialize the database:
+.br
+
+.br
+$ firejail --ids-init
+.br
+Opening config file /etc/firejail/ids.config
+.br
+Loading config file /etc/firejail/ids.config
+.br
+Opening config file /etc/firejail/ids.config.local
+.br
+500 1000 1500 2000
+.br
+2466 files scanned
+.br
+IDS database initialized
+.br
+
+.br
+The default configuration targets several system executables in directories such as /bin, /sbin, /usr/bin, /usr/sbin, and several critical config files in user home directory
+such as ~/.bashrc, ~/.xinitrc, and ~/.config/autostart. Several system config files in /etc directory are also hashed.
+.br
+
+.br
+Run --ids-check to audit the system:
+.br
+
+.br
+$ firejail --ids-check
+.br
+Opening config file /etc/firejail/ids.config
+.br
+Loading config file /etc/firejail/ids.config
+.br
+Opening config file /etc/firejail/ids.config.local
+.br
+500 1000 1500
+.br
+Warning: modified /home/netblue/.bashrc
+.br
+2000
+.br
+2466 files scanned: modified 1, permissions 0, new 0, removed 0
+.br
+
+.br
+The program will print the files that have been modified since the database was created, or the files with different access permissions.
+New files and deleted files are also flagged.
+
+Currently while scanning the file system, symbolic links are not followed, and files the user doesn't have read access to are silently dropped.
+The program can also be run as root (sudo firejail --ids-init/--ids-check).
+
 .SH MONITORING
 Option \-\-list prints a list of all sandboxes. The format
 for each process entry is as follows:
@@ -3239,7 +3432,7 @@ The owner of the sandbox.
 .SH RESTRICTED SHELL
 To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in
 /etc/passwd file for each user that needs to be restricted. Alternatively,
-you can specify /usr/bin/firejail  in adduser command:
+you can specify /usr/bin/firejail in adduser command:
 
 adduser \-\-shell /usr/bin/firejail username
 
@@ -3249,7 +3442,7 @@ Additional arguments passed to firejail executable upon login are declared in /e
 Several command line options can be passed to the program using
 profile files. Firejail chooses the profile file as follows:
 
-1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in  /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME.
+1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME.
 Example:
 .PP
 .RS
@@ -3365,7 +3558,7 @@ Homepage: https://firejail.wordpress.com
 .BR firejail-profile (5),
 .BR firejail-login (5),
 .BR firejail-users (5),
-.BR jailtest (1)
+.BR jailcheck (1)
 
 .UR https://github.com/netblue30/firejail/wiki
 .UE ,
diff --git a/src/man/firemon.txt b/src/man/firemon.txt
index 64f15a1f0..c4e6e15b3 100644
--- a/src/man/firemon.txt
+++ b/src/man/firemon.txt
@@ -56,7 +56,7 @@ Print route table for each sandbox.
 Print seccomp configuration for each sandbox.
 .TP
 \fB\-\-top
-Monitor the most CPU-intensive sandboxes. This command  is similar to
+Monitor the most CPU-intensive sandboxes. This command is similar to
 the regular UNIX top command, however it applies only to sandboxes.
 .TP
 \fB\-\-tree
@@ -120,4 +120,4 @@ Homepage: https://firejail.wordpress.com
 .BR firejail-profile (5),
 .BR firejail-login (5),
 .BR firejail-users (5),
-.BR jailtest (1)
+.BR jailcheck (1)
diff --git a/src/man/jailtest.txt b/src/man/jailcheck.txt
index b52fc5eed..483f47fb9 100644
--- a/src/man/jailtest.txt
+++ b/src/man/jailcheck.txt
@@ -1,29 +1,30 @@
-.TH JAILTEST 1 "MONTH YEAR" "VERSION" "JAILTEST man page"
+.TH JAILCHECK 1 "MONTH YEAR" "VERSION" "JAILCHECK man page"
 .SH NAME
-jailtest \- Simple utility program to test running sandboxes
+jailcheck \- Simple utility program to test running sandboxes
 .SH SYNOPSIS
-sudo jailtest [OPTIONS] [directory]
+sudo jailcheck [OPTIONS] [directory]
 .SH DESCRIPTION
-WORK IN PROGRESS!
-jailtest attaches itself to all sandboxes started by the user and performs some basic tests
+jailcheck attaches itself to all sandboxes started by the user and performs some basic tests
 on the sandbox filesystem:
 .TP
 \fB1. Virtual directories
-jailtest extracts a list with the main virtual directories installed by the sandbox.
+jailcheck extracts a list with the main virtual directories installed by the sandbox.
 These directories are build by firejail at startup using --private* and --whitelist commands.
 .TP
 \fB2. Noexec test
-jailtest inserts executable programs in /home/username, /tmp, and /var/tmp directories
+jailcheck inserts executable programs in /home/username, /tmp, and /var/tmp directories
 and tries to run them from inside the sandbox, thus testing if the directory is executable or not.
 .TP
 \fB3. Read access test
-jailtest creates test files in the directories specified by the user and tries to read
+jailcheck creates test files in the directories specified by the user and tries to read
 them from inside the sandbox.
 .TP
 \fB4. AppArmor test
 .TP
 \fB5. Seccomp test
 .TP
+\fB6. Networking test
+.TP
 The program is started as root using sudo.
 
 .SH OPTIONS
@@ -49,7 +50,7 @@ It is followed by relevant sandbox information, such as the virtual directories
 
 .SH EXAMPLE
 
-$ sudo jailtest
+$ sudo jailcheck
 .br
 2014:netblue::firejail /usr/bin/gimp
 .br
@@ -57,6 +58,8 @@ $ sudo jailtest
 .br
    Warning: I can run programs in /home/netblue
 .br
+   Networking: disabled
+.br
 
 .br
 2055:netblue::firejail /usr/bin/ssh -X netblue@x.y.z.net
@@ -65,12 +68,16 @@ $ sudo jailtest
 .br
    Warning: I can read ~/.ssh
 .br
+   Networking: enabled
+.br
 
 .br
 2186:netblue:libreoffice:firejail --appimage /opt/LibreOffice-fresh.appimage
 .br
    Virtual dirs: /tmp, /var/tmp, /dev,
 .br
+   Networking: enabled
+.br
 
 .br
 26090:netblue::/usr/bin/firejail /opt/firefox/firefox
@@ -79,6 +86,8 @@ $ sudo jailtest
 .br
                  /run/user/1000,
 .br
+   Networking: enabled
+.br
 
 .br
 26160:netblue:tor:firejail --private=~/tor-browser_en-US ./start-tor
@@ -91,6 +100,8 @@ $ sudo jailtest
 .br
    Warning: I can run programs in /home/netblue
 .br
+   Networking: enabled
+.br
 
 
 .SH LICENSE
diff --git a/src/man/preproc.awk b/src/man/preproc.awk
index 1ce5c82de..d3a2b71c9 100755
--- a/src/man/preproc.awk
+++ b/src/man/preproc.awk
@@ -1,6 +1,6 @@
 #!/usr/bin/gawk -E
 
-# Copyright (c) 2019-2021 rusty-snake
+# Copyright (c) 2019-2022 rusty-snake
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
diff --git a/src/profstats/Makefile.in b/src/profstats/Makefile.in
index e025f5939..fa1b4f200 100644
--- a/src/profstats/Makefile.in
+++ b/src/profstats/Makefile.in
@@ -3,7 +3,7 @@ all: profstats
 
 include ../common.mk
 
-%.o : %.c $(H_FILE_LIST)
+%.o : %.c $(H_FILE_LIST) ../include/common.h
         $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@
 
 profstats: $(OBJS)
diff --git a/src/profstats/main.c b/src/profstats/main.c
index 5035280b1..595a94c11 100644
--- a/src/profstats/main.c
+++ b/src/profstats/main.c
@@ -1,5 +1,5 @@
  /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
@@ -17,10 +17,8 @@
  * with this program; if not, write to the Free Software Foundation, Inc.,
  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <assert.h>
+
+#include "../include/common.h"
 
 #define MAXBUF 2048
 // stats
@@ -46,6 +44,7 @@ static int cnt_whitelistusrshare = 0;	// include whitelist-usr-share-common.inc
 static int cnt_ssh = 0;
 static int cnt_mdwx = 0;
 static int cnt_whitelisthome = 0;
+static int cnt_noroot = 0;
 
 static int level = 0;
 static int arg_debug = 0;
@@ -65,27 +64,31 @@ static int arg_mdwx = 0;
 static int arg_dbus_system_none = 0;
 static int arg_dbus_user_none = 0;
 static int arg_whitelisthome = 0;
-
+static int arg_noroot = 0;
+static int arg_print_blacklist = 0;
+static int arg_print_whitelist = 0;
 
 static char *profile = NULL;
 
-
 static void usage(void) {
-        printf("proftool - print profile statistics\n");
-        printf("Usage: proftool [options] file[s]\n");
+        printf("profstats - print profile statistics\n");
+        printf("Usage: profstats [options] file[s]\n");
         printf("Options:\n");
         printf("   --apparmor - print profiles without apparmor\n");
         printf("   --caps - print profiles without caps\n");
-        printf("   --dbus-system-none - profiles without  \"dbus-system none\"\n");
-        printf("   --dbus-user-none - profiles without  \"dbus-user none\"\n");
+        printf("   --dbus-system-none - print profiles without \"dbus-system none\"\n");
+        printf("   --dbus-user-none - print profiles without \"dbus-user none\"\n");
         printf("   --ssh - print profiles without \"include disable-common.inc\"\n");
         printf("   --noexec - print profiles without \"include disable-exec.inc\"\n");
+        printf("   --noroot - print profiles without \"noroot\"\n");
         printf("   --private-bin - print profiles without private-bin\n");
         printf("   --private-dev - print profiles without private-dev\n");
         printf("   --private-etc - print profiles without private-etc\n");
         printf("   --private-tmp - print profiles without private-tmp\n");
+        printf("   --print-blacklist - print all --blacklist for a profile\n");
+        printf("   --print-whitelist - print all --private and --whitelist for a profile\n");
         printf("   --seccomp - print profiles without seccomp\n");
-        printf("   --memory-deny-write-execute - profile without \"memory-deny-write-execute\"\n");
+        printf("   --memory-deny-write-execute - print profiles without \"memory-deny-write-execute\"\n");
         printf("   --whitelist-home - print profiles whitelisting home directory\n");
         printf("   --whitelist-var - print profiles without \"include whitelist-var-common.inc\"\n");
         printf("   --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\" or \"blacklist ${RUNUSER}\"\n");
@@ -94,8 +97,9 @@ static void usage(void) {
         printf("\n");
 }
 
-void process_file(const char *fname) {
+static void process_file(char *fname) {
         assert(fname);
+        char *tmpfname = NULL;
 
         if (arg_debug)
                 printf("processing #%s#\n", fname);
@@ -104,9 +108,19 @@ void process_file(const char *fname) {
 
         FILE *fp = fopen(fname, "r");
         if (!fp) {
-                fprintf(stderr, "Warning: cannot open %s, while processing %s\n", fname, profile);
-                level--;
-                return;
+                // the file was not found in the current directory
+                // look for it in /etc/firejail directory
+                if (asprintf(&tmpfname, "%s/%s", SYSCONFDIR, fname) == -1)
+                        errExit("asprintf");
+
+                fp = fopen(tmpfname, "r");
+                if (!fp) {
+                        fprintf(stderr, "Warning: cannot open %s or %s, while processing %s\n", fname, tmpfname, profile);
+                        free(tmpfname);
+                        level--;
+                        return;
+                }
+                fname = tmpfname;
         }
 
         int have_include_local = 0;
@@ -122,12 +136,26 @@ void process_file(const char *fname) {
                 if (*ptr == '\n' || *ptr == '#')
                         continue;
 
+                if (arg_print_blacklist) {
+                        if (strncmp(ptr, "blacklist", 9) == 0 ||
+                            strncmp(ptr, "noblacklist", 11) == 0)
+                                printf("%s: %s\n", fname, ptr);
+                }
+                else if (arg_print_whitelist) {
+                        if (strncmp(ptr, "whitelist", 9) == 0 ||
+                            strncmp(ptr, "nowhitelist", 11) == 0 ||
+                            strncmp(ptr, "private", 7) == 0)
+                                printf("%s: %s\n", fname, ptr);
+                }
+
                 if (strncmp(ptr, "seccomp", 7) == 0)
                         cnt_seccomp++;
                 else if (strncmp(ptr, "caps", 4) == 0)
                         cnt_caps++;
                 else if (strncmp(ptr, "include disable-exec.inc", 24) == 0)
                         cnt_noexec++;
+                else if (strncmp(ptr, "noroot", 6) == 0)
+                        cnt_noroot++;
                 else if (strncmp(ptr, "include whitelist-var-common.inc", 32) == 0)
                         cnt_whitelistvar++;
                 else if (strncmp(ptr, "include whitelist-runuser-common.inc", 36) == 0 ||
@@ -185,6 +213,8 @@ void process_file(const char *fname) {
         if (!have_include_local)
                 printf("No include .local found in %s\n", fname);
         level--;
+        if (tmpfname)
+                free(tmpfname);
 }
 
 int main(int argc, char **argv) {
@@ -212,6 +242,8 @@ int main(int argc, char **argv) {
                         arg_mdwx = 1;
                 else if (strcmp(argv[i], "--noexec") == 0)
                         arg_noexec = 1;
+                else if (strcmp(argv[i], "--noroot") == 0)
+                        arg_noroot = 1;
                 else if (strcmp(argv[i], "--private-bin") == 0)
                         arg_privatebin = 1;
                 else if (strcmp(argv[i], "--private-dev") == 0)
@@ -220,6 +252,10 @@ int main(int argc, char **argv) {
                         arg_privatetmp = 1;
                 else if (strcmp(argv[i], "--private-etc") == 0)
                         arg_privateetc = 1;
+                else if (strcmp(argv[i], "--print-blacklist") == 0)
+                        arg_print_blacklist = 1;
+                else if (strcmp(argv[i], "--print-whitelist") == 0)
+                        arg_print_whitelist = 1;
                 else if (strcmp(argv[i], "--whitelist-home") == 0)
                         arg_whitelisthome = 1;
                 else if (strcmp(argv[i], "--whitelist-var") == 0)
@@ -256,6 +292,7 @@ int main(int argc, char **argv) {
                 int caps = cnt_caps;
                 int apparmor = cnt_apparmor;
                 int noexec = cnt_noexec;
+                int noroot = cnt_noroot;
                 int privatebin = cnt_privatebin;
                 int privatetmp = cnt_privatetmp;
                 int privatedev = cnt_privatedev;
@@ -313,6 +350,8 @@ int main(int argc, char **argv) {
                         printf("No seccomp found in %s\n", argv[i]);
                 if (arg_noexec && noexec == cnt_noexec)
                         printf("No include disable-exec.inc found in %s\n", argv[i]);
+                if (arg_noroot && noroot == cnt_noroot)
+                        printf("No noroot found in %s\n", argv[i]);
                 if (arg_privatedev && privatedev == cnt_privatedev)
                         printf("No private-dev found in %s\n", argv[i]);
                 if (arg_privatebin && privatebin == cnt_privatebin)
@@ -337,6 +376,9 @@ int main(int argc, char **argv) {
                 assert(level == 0);
         }
 
+        if (arg_print_blacklist || arg_print_whitelist)
+                return 0;
+
         printf("\n");
         printf("Stats:\n");
         printf("    profiles\t\t\t%d\n", cnt_profiles);
@@ -346,6 +388,7 @@ int main(int argc, char **argv) {
         printf("    seccomp\t\t\t%d\n", cnt_seccomp);
         printf("    capabilities\t\t%d\n", cnt_caps);
         printf("    noexec\t\t\t%d   (include disable-exec.inc)\n", cnt_noexec);
+        printf("    noroot\t\t\t%d\n", cnt_noroot);
         printf("    memory-deny-write-execute\t%d\n", cnt_mdwx);
         printf("    apparmor\t\t\t%d\n", cnt_apparmor);
         printf("    private-bin\t\t\t%d\n", cnt_privatebin);
diff --git a/src/tools/check-caps.sh b/src/tools/check-caps.sh
index b7026b1cd..62c3b9066 100755
--- a/src/tools/check-caps.sh
+++ b/src/tools/check-caps.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # This file is part of Firejail project
-# Copyright (C) 2014-2021 Firejail Authors
+# Copyright (C) 2014-2022 Firejail Authors
 # License GPL v2
 
 if [ $# -eq 0 ]
diff --git a/src/tools/extract_caps.c b/src/tools/extract_caps.c
index 8da9c452b..5e5b3cdc6 100644
--- a/src/tools/extract_caps.c
+++ b/src/tools/extract_caps.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/tools/extract_errnos.sh b/src/tools/extract_errnos.sh
index 34c416b04..bb430b3e1 100644
--- a/src/tools/extract_errnos.sh
+++ b/src/tools/extract_errnos.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # This file is part of Firejail project
-# Copyright (C) 2014-2021 Firejail Authors
+# Copyright (C) 2014-2022 Firejail Authors
 # License GPL v2
 
 echo -e "#include <errno.h>\n#include <attr/xattr.h>" | \
diff --git a/src/tools/extract_seccomp.c b/src/tools/extract_seccomp.c
index b5f92d2df..6b644796b 100644
--- a/src/tools/extract_seccomp.c
+++ b/src/tools/extract_seccomp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/tools/extract_syscalls.c b/src/tools/extract_syscalls.c
index 9159b6576..f77a84123 100644
--- a/src/tools/extract_syscalls.c
+++ b/src/tools/extract_syscalls.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/tools/mkcoverit.sh b/src/tools/mkcoverit.sh
index 86d798a11..c7a57cd21 100755
--- a/src/tools/mkcoverit.sh
+++ b/src/tools/mkcoverit.sh
@@ -1,6 +1,6 @@
 #!/bin/bash
 # This file is part of Firejail project
-# Copyright (C) 2014-2021 Firejail Authors
+# Copyright (C) 2014-2022 Firejail Authors
 # License GPL v2
 
 # unpack firejail archive
diff --git a/src/tools/testuid.c b/src/tools/testuid.c
index a18d57d5e..1bc617522 100644
--- a/src/tools/testuid.c
+++ b/src/tools/testuid.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/tools/ttytest.c b/src/tools/ttytest.c
index 0f72753bc..9e40d289a 100644
--- a/src/tools/ttytest.c
+++ b/src/tools/ttytest.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/tools/unixsocket.c b/src/tools/unixsocket.c
index c4ecabca7..bd638269d 100644
--- a/src/tools/unixsocket.c
+++ b/src/tools/unixsocket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2014-2021 Firejail Authors
+ * Copyright (C) 2014-2022 Firejail Authors
  *
  * This file is part of firejail project
  *
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
index fd27bb35f..f7cd3cdff 100644
--- a/src/zsh_completion/_firejail.in
+++ b/src/zsh_completion/_firejail.in
@@ -62,6 +62,9 @@ _firejail_args=(
     '--tree[print a tree of all sandboxed processes]'
     '--version[print program version and exit]'
 
+    '--ids-check[verify file system]'
+    '--ids-init[initialize IDS database]'
+
     '--debug[print sandbox debug messages]'
     '--debug-blacklists[debug blacklisting]'
     '--debug-caps[print all recognized capabilities]'
@@ -91,6 +94,7 @@ _firejail_args=(
     '--cgroup=-[place the sandbox in the specified control group]: :'
     '--cpu=-[set cpu affinity]: :->cpus'
     "--deterministic-exit-code[always exit with first child's status code]"
+    '--deterministic-shutdown[terminate orphan processes]'
     '*--dns=-[set DNS server]: :'
     '*--env=-[set environment variable]: :'
     '--hostname=-[set sandbox hostname]: :'
@@ -98,9 +102,11 @@ _firejail_args=(
     '*--ignore=-[ignore command in profile files]: :'
     '--ipc-namespace[enable a new IPC namespace]'
     '--join-or-start=-[join the sandbox or start a new one name|pid]: :_all_firejails'
+    '--keep-config-pulse[disable automatic ~/.config/pulse init]'
     '--keep-dev-shm[/dev/shm directory is untouched (even with --private-dev)]'
+    '--keep-fd[inherit open file descriptors to sandbox]'
     '--keep-var-tmp[/var/tmp directory is untouched]'
-    '--machine-id[preserve /etc/machine-id]'
+    '--machine-id[spoof /etc/machine-id with a random id]'
     '--memory-deny-write-execute[seccomp filter to block attempts to create memory mappings that are both writable and executable]'
     '*--mkdir=-[create a directory]:'
     '*--mkfile=-[create a file]:'
@@ -116,7 +122,9 @@ _firejail_args=(
     '--nodvd[disable DVD and audio CD devices]'
     '*--noexec=-[remount the file or directory noexec nosuid and nodev]: :_files'
     '--nogroups[disable supplementary groups]'
+    '--noinput[disable input devices]'
     '--nonewprivs[sets the NO_NEW_PRIVS prctl]'
+    '--noprinters[disable printers]'
     '--nosound[disable sound system]'
     '--nou2f[disable U2F devices]'
     '--novideo[disable video devices]'
@@ -213,7 +221,7 @@ _firejail_args=(
     '--netfilter.print=-[print the firewall name|pid]: :_all_firejails'
     '--netfilter6=-[enable IPv6 firewall]: :'
     '--netfilter6.print=-[print the IPv6 firewall name|pid]: :_all_firejails'
-    '--netmask=-[define a network mask when dealing with unconfigured parrent interfaces]: :'
+    '--netmask=-[define a network mask when dealing with unconfigured parent interfaces]: :'
     '--netns=-[Run the program in a named, persistent network namespace]: :'
     '--netstats[monitor network statistics]'
     '--interface=-[move interface in sandbox]: :'
@@ -249,10 +257,8 @@ _firejail_args=(
     '*--tmpfs=-[mount a tmpfs filesystem on directory dirname]: :_files -/'
 #endif
 
-#ifdef HAVE_WHITELIST
     '*--nowhitelist=-[disable whitelist for file or directory]: :_files'
     '*--whitelist=-[whitelist directory or file]: :_files'
-#endif
 
 #ifdef HAVE_X11
     '--x11[enable X11 sandboxing. The software checks first if Xpra is installed, then it checks if Xephyr is installed. If all fails, it will attempt to use X11 security extension]'