18 files changed, 653 insertions, 169 deletions

diff --git a/src/etc-cleanup/Makefile b/src/etc-cleanup/Makefile
new file mode 100644
index 000000000..349da8821
--- /dev/null
+++ b/src/etc-cleanup/Makefile
@@ -0,0 +1,9 @@
+ROOT = ../..
+-include $(ROOT)/config.mk
+
+PROG = etc-cleanup
+TARGET = $(PROG)
+
+MOD_HDRS = ../include/etc-groups.h
+
+include $(ROOT)/src/prog.mk
diff --git a/src/etc-cleanup/main.c b/src/etc-cleanup/main.c
new file mode 100644
index 000000000..47fe1556b
--- /dev/null
+++ b/src/etc-cleanup/main.c
@@ -0,0 +1,255 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#include "../include/etc_groups.h"
+#include "../include/common.h"
+#include <stdarg.h>
+
+#define MAX_BUF 4098
+#define MAX_ARR 1024
+char *arr[MAX_ARR] = {NULL};
+int arr_cnt = 0;
+
+static int arr_tls_ca = 0;
+static int arr_x11 = 0;
+static int arr_games = 0;
+static char outbuf[256 * 1024];
+static char *outptr;
+static int arg_replace = 0;
+static int arg_debug = 0;
+
+void outprintf(char* fmt, ...) {
+        va_list args;
+        va_start(args,fmt);
+        outptr += vsprintf(outptr, fmt, args);
+        va_end(args);
+}
+
+
+
+static int arr_check(const char *fname, char **pptr) {
+        assert(fname);
+        assert(pptr);
+
+        while (*pptr != NULL) {
+                if (strcmp(fname, *pptr) == 0)
+                        return 1;
+                pptr++;
+        }
+
+        return 0;
+}
+
+
+
+static void arr_add(const char *fname) {
+        assert(fname);
+        assert(arr_cnt < MAX_ARR);
+
+        int i;
+        for (i = 0; i < arr_cnt; i++)
+                if (strcmp(arr[i], fname) == 0)
+                        return;
+
+        arr[arr_cnt] = strdup(fname);
+        if (!arr[arr_cnt])
+                errExit("strdup");
+        arr_cnt++;
+}
+
+int arr_cmp(const void *p1, const void *p2) {
+        char **ptr1 = (char **) p1;
+        char **ptr2 = (char **) p2;
+
+        return strcmp(*ptr1, *ptr2);
+}
+
+static void arr_sort(void) {
+        qsort(&arr[0], arr_cnt, sizeof(char *), arr_cmp);
+}
+
+static void arr_clean(void) {
+        int i;
+        for (i = 0; i < arr_cnt; i++) {
+                free(arr[i]);
+                arr[i] = NULL;
+        }
+
+        arr_cnt = 0;
+        arr_games = 0;
+        arr_tls_ca = 0;
+        arr_x11 = 0;
+}
+
+static char *arr_print(void) {
+        char *last_line = outptr;
+        outprintf("private-etc ");
+
+        if (arr_games)
+                outprintf("@games,");
+        if (arr_tls_ca)
+                outprintf("@tls-ca,");
+        if (arr_x11)
+                outprintf("@x11,");
+
+        int i;
+        for (i = 0; i < arr_cnt; i++)
+                outprintf("%s,", arr[i]);
+        if (*(outptr - 1) == ' ' || *(outptr - 1) == ',') {
+                outptr--;
+                *outptr = '\0';
+        }
+        outprintf("\n");
+
+        return last_line;
+}
+
+static void process_file(const char *fname) {
+        assert(fname);
+
+        FILE *fp = fopen(fname, "r");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot open %s file\n", fname);
+                exit(1);
+        }
+
+        outptr = outbuf;
+        *outptr = '\0';
+        arr_clean();
+
+        char line[MAX_BUF];
+        char orig_line[MAX_BUF];
+        int cnt = 0;
+        int print = 0;
+        while (fgets(line, MAX_BUF, fp)) {
+                cnt++;
+                if (strncmp(line, "private-etc", 11) != 0)  {
+                        outprintf("%s", line);
+                        continue;
+                }
+
+                strcpy(orig_line,line);
+                char *ptr = strchr(line, '\n');
+                if (ptr)
+                        *ptr = '\0';
+
+                ptr = line + 12;
+                while (*ptr == ' ' || *ptr == '\t')
+                        ptr++;
+
+                // check for blanks and tabs
+                char *ptr2 = ptr;
+                while (*ptr2 != '\0') {
+                        if (*ptr2 == ' ' || *ptr2 == '\t') {
+                                fprintf(stderr, "Error: invalid private-etc line %s:%d\n", fname, cnt);
+                                exit(1);
+                        }
+                        ptr2++;
+                }
+
+                ptr = strtok(ptr, ",");
+                while (ptr) {
+                        if (arg_debug)
+                                printf("%s\n", ptr);
+                        if (arr_check(ptr, &etc_list[0]));
+                        else if (arr_check(ptr, &etc_group_sound[0]));
+                        else if (arr_check(ptr, &etc_group_network[0]));
+                        else if (strcmp(ptr, "@games") == 0)
+                                arr_games = 1;
+                        else if (strcmp(ptr, "@tls-ca") == 0)
+                                arr_tls_ca = 1;
+                        else if (strcmp(ptr, "@x11") == 0)
+                                arr_x11 = 1;
+                        else if (arr_check(ptr, &etc_group_games[0]))
+                                arr_games = 1;
+                        else if (arr_check(ptr, &etc_group_tls_ca[0]))
+                                arr_tls_ca = 1;
+                        else if (arr_check(ptr, &etc_group_x11[0]))
+                                arr_x11 = 1;
+                        else
+                                arr_add(ptr);
+
+                        ptr = strtok(NULL, ",");
+                }
+
+                arr_sort();
+                char *last_line = arr_print();
+                if (strcmp(last_line, orig_line) == 0) {
+                        fclose(fp);
+                        return;
+                }
+                printf("\n********************\nfile: %s\n\nold: %s\nnew: %s\n", fname, orig_line, last_line);
+                print = 1;
+        }
+
+        fclose(fp);
+
+        if (print && arg_replace) {
+                fp = fopen(fname, "w");
+                if (!fp) {
+                        fprintf(stderr, "Error: cannot open profile file\n");
+                        exit(1);
+                }
+                fprintf(fp, "%s", outbuf);
+                fclose(fp);
+        }
+}
+
+static void usage(void) {
+        printf("usage: cleanup-etc [options] file.profile [file.profile]\n");
+        printf("Group and clean private-etc entries in one or more profile files.\n");
+        printf("Options:\n");
+        printf("   --debug - print debug messages\n");
+        printf("   -h, -?, --help - this help screen\n");
+        printf("   --replace - replace profile file\n");
+}
+
+int main(int argc, char **argv) {
+        if (argc < 2) {
+                fprintf(stderr, "Error: invalid number of parameters\n");
+                usage();
+                return 1;
+        }
+
+        int i;
+        for (i = 1; i < argc; i++) {
+                if (strcmp(argv[i], "-h") == 0 ||
+                     strcmp(argv[i], "-?") == 0 ||
+                     strcmp(argv[i], "--help") == 0) {
+                        usage();
+                        return 0;
+                }
+                else if (strcmp(argv[i], "--debug") == 0)
+                        arg_debug = 1;
+                else if (strcmp(argv[i], "--replace") == 0)
+                        arg_replace = 1;
+                else if (*argv[i] == '-') {
+                        fprintf(stderr, "Error: invalid program option %s\n", argv[i]);
+                        return 1;
+                }
+                else
+                        break;
+        }
+
+        for (; i < argc; i++)
+                process_file(argv[i]);
+
+        return 0;
+}
\ No newline at end of file
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 15169f983..db73dd1f6 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -479,6 +479,7 @@ lincity-ng
 links
 links2
 linphone
+linuxqq
 lmms
 lobase
 localc
@@ -518,6 +519,7 @@ matrix-mirage
 mattermost-desktop
 mcabber
 mcomix
+md5sum
 mediainfo
 mediathekview
 megaglest
@@ -693,6 +695,7 @@ qlipper
 qmmp
 qnapi
 qpdfview
+qq
 qt-faststart
 qtox
 quadrapassel
@@ -734,6 +737,11 @@ seahorse-tool
 seamonkey
 seamonkey-bin
 secret-tool
+sha1sum
+sha224sum
+sha256sum
+sha348sum
+sha512sum
 shellcheck
 shortwave
 shotcut
@@ -773,6 +781,7 @@ straw-viewer
 strings
 studio.sh
 subdownloader
+sum
 supertux2
 supertuxkart
 surf
diff --git a/src/firejail/Makefile b/src/firejail/Makefile
index 4e241af7e..47edc5ac6 100644
--- a/src/firejail/Makefile
+++ b/src/firejail/Makefile
@@ -13,7 +13,9 @@ MOD_HDRS = \
 ../include/seccomp.h \
 ../include/syscall_i386.h \
 ../include/syscall_x86_64.h \
-../include/firejail_user.h
+../include/firejail_user.h \
+../include/etc_groups.h
+
 
 MOD_OBJS = \
 ../lib/common.o \
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 4fe3a5974..a09158e9e 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -332,6 +332,7 @@ extern int arg_nice;		// nice value configured
 extern int arg_ipc;             // enable ipc namespace
 extern int arg_writable_etc;    // writable etc
 extern int arg_keep_config_pulse;       // disable automatic ~/.config/pulse init
+extern int arg_keep_shell_rc;   // do not copy shell configuration from /etc/skel
 extern int arg_writable_var;    // writable var
 extern int arg_keep_var_tmp; // don't overwrite /var/tmp
 extern int arg_writable_run_user;       // writable /run/user
@@ -693,11 +694,12 @@ void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, in
 void network_set_run_file(pid_t pid);
 
 // fs_etc.c
+char *fs_etc_build(char *str);
+void fs_resolvconf(void);
 void fs_machineid(void);
 void fs_private_dir_copy(const char *private_dir, const char *private_run_dir, const char *private_list);
 void fs_private_dir_mount(const char *private_dir, const char *private_run_dir);
 void fs_private_dir_list(const char *private_dir, const char *private_run_dir, const char *private_list);
-void fs_rebuild_etc(void);
 
 // no_sandbox.c
 int check_namespace_virt(void);
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index b44eb65ee..89a67f686 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -67,11 +67,8 @@ static void disable_file(OPERATION op, const char *filename) {
                 // they don't seem to like a uid of 0
                 // force mounting
                 int fd = open(filename, O_PATH|O_CLOEXEC);
-                if (fd < 0) {
-                        if (arg_debug)
-                                printf("Warning (blacklisting): cannot open %s: %s\n", filename, strerror(errno));
+                if (fd < 0)
                         return;
-                }
 
                 EUID_ROOT();
                 int err = bind_mount_path_to_fd(RUN_RO_DIR, fd);
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c
index 77fa00d6b..83f140d80 100644
--- a/src/firejail/fs_etc.c
+++ b/src/firejail/fs_etc.c
@@ -24,7 +24,126 @@
 #include <sys/types.h>
 #include <time.h>
 #include <unistd.h>
-#include <dirent.h>
+#include <glob.h>
+#include "../include/etc_groups.h"
+
+static int etc_cnt = 0;
+
+static void etc_copy_group(char **pptr) {
+        assert(pptr);
+
+        while (*pptr != NULL) {
+                etc_list[etc_cnt++] = *pptr;
+                etc_list[etc_cnt] = NULL;
+                pptr++;
+        }
+}
+
+static void etc_add(const char *file) {
+        assert(file);
+        if (etc_cnt >= ETC_MAX) {
+                fprintf(stderr, "Error: size of private_etc list exceeded (%d maximum)\n", ETC_MAX);
+                exit(1);
+        }
+
+        // look for file in the current list
+        int i;
+        for (i = 0; i < etc_cnt; i++) {
+                if (strcmp(file, etc_list[i]) == 0) {
+                        if (arg_debug)
+                                printf("private-etc arguments: skip %s\n", file);
+                        return;
+                }
+        }
+
+        char *ptr = strdup(file);
+        if (!ptr)
+                errExit("strdup");
+        etc_list[etc_cnt++] = ptr;
+        etc_list[etc_cnt] = NULL;
+}
+
+// str can be NULL
+char *fs_etc_build(char *str) {
+        while (etc_list[etc_cnt++]);
+        etc_cnt--;
+        if (!arg_nonetwork)
+                etc_copy_group(&etc_group_network[0]);
+        if (!arg_nosound)
+                etc_copy_group(&etc_group_sound[0]);
+
+        // parsing
+        if (str) {
+                char* ptr = strtok(str, ",");
+                while (ptr) {
+                        // look for standard groups
+                        if (strcmp(ptr, "@tls-ca") == 0)
+                                etc_copy_group(&etc_group_tls_ca[0]);
+                        if (strcmp(ptr, "@x11") == 0)
+                                etc_copy_group(&etc_group_x11[0]);
+                        if (strcmp(ptr, "@sound") == 0)
+                                etc_copy_group(&etc_group_sound[0]);
+                        if (strcmp(ptr, "@network") == 0)
+                                etc_copy_group(&etc_group_network[0]);
+                        if (strcmp(ptr, "@games") == 0)
+                                etc_copy_group(&etc_group_games[0]);
+                        else
+                                etc_add(ptr);
+                        ptr = strtok(NULL, ",");
+                }
+        }
+
+        // manufacture the new string
+        int len = 0;
+        int i;
+        for (i = 0; i < etc_cnt; i++)
+                len += strlen(etc_list[i]) + 1; // plus 1 for the trailing ','
+        char *rv = malloc(len + 1);
+        if (!rv)
+                errExit("malloc");
+        char *ptr = rv;
+        for (i = 0; i < etc_cnt; i++) {
+                sprintf(ptr, "%s,", etc_list[i]);
+                ptr += strlen(etc_list[i]) + 1;
+        }
+
+        return rv;
+}
+
+void fs_resolvconf(void) {
+        if (arg_debug)
+                printf("Creating a new /etc/resolv.conf file\n");
+        FILE *fp = fopen(RUN_RESOLVCONF_FILE, "wxe");
+        if (!fp) {
+                fprintf(stderr, "Error: cannot create /etc/resolv.conf file\n");
+                exit(1);
+        }
+
+        if (cfg.dns1) {
+                if (any_dhcp())
+                        fwarning("network setup uses DHCP, nameservers will likely be overwritten\n");
+                fprintf(fp, "nameserver %s\n", cfg.dns1);
+        }
+        if (cfg.dns2)
+                fprintf(fp, "nameserver %s\n", cfg.dns2);
+        if (cfg.dns3)
+                fprintf(fp, "nameserver %s\n", cfg.dns3);
+        if (cfg.dns4)
+                fprintf(fp, "nameserver %s\n", cfg.dns4);
+
+        // mode and owner
+        SET_PERMS_STREAM(fp, 0, 0, 0644);
+
+        fclose(fp);
+        selinux_relabel_path(RUN_RESOLVCONF_FILE, "/etc/resolv.conf");
+
+
+        if (mount(RUN_RESOLVCONF_FILE, "/etc/resolv.conf", "none", MS_BIND, "mode=644,gid=0") < 0)
+                errExit("mount");
+
+        fs_logger("create /etc/resolv.conf");
+}
+
 
 // spoof /etc/machine_id
 void fs_machineid(void) {
@@ -143,19 +262,11 @@ errexit:
 }
 
 static void duplicate(const char *fname, const char *private_dir, const char *private_run_dir) {
-        assert(fname);
-
-        if (*fname == '~' || *fname == '/' || strstr(fname, "..")) {
-                fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
-                exit(1);
-        }
-        invalid_filename(fname, 0); // no globbing
-
         char *src;
         if (asprintf(&src,  "%s/%s", private_dir, fname) == -1)
                 errExit("asprintf");
+
         if (check_dir_or_file(src) == 0) {
-                fwarning("skipping %s for private %s\n", fname, private_dir);
                 free(src);
                 return;
         }
@@ -169,8 +280,9 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
 
         build_dirs(src, dst, strlen(private_dir), strlen(private_run_dir));
 
-        // follow links! this will make a copy of the file or directory pointed by the symlink
+        // follow links by default, thus making a copy of the file or directory pointed by the symlink
         // this will solve problems such as NixOS #4887
+        //
         // don't follow links to dynamic directories such as /proc
         if (strcmp(src, "/etc/mtab") == 0)
                 sbox_run(SBOX_ROOT | SBOX_SECCOMP, 3, PATH_FCOPY, src, dst);
@@ -179,9 +291,38 @@ static void duplicate(const char *fname, const char *private_dir, const char *pr
 
         free(dst);
         fs_logger2("clone", src);
-        free(src);
 }
 
+static void duplicate_globbing(const char *fname, const char *private_dir, const char *private_run_dir) {
+        assert(fname);
+
+        if (*fname == '~' || *fname == '/' || strstr(fname, "..")) {
+                fprintf(stderr, "Error: \"%s\" is an invalid filename\n", fname);
+                exit(1);
+        }
+        invalid_filename(fname, 1); // no globbing
+
+        char *pattern;
+        if (asprintf(&pattern,  "%s/%s", private_dir, fname) == -1)
+                errExit("asprintf");
+
+        glob_t globbuf;
+        int globerr = glob(pattern, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf);
+        if (globerr) {
+                fprintf(stderr, "Error: failed to glob pattern %s\n", pattern);
+                exit(1);
+        }
+
+        size_t i;
+        int len = strlen(private_dir);
+        for (i = 0; i < globbuf.gl_pathc; i++) {
+                char *path = globbuf.gl_pathv[i];
+                duplicate(path + len + 1, private_dir, private_run_dir);
+        }
+
+        globfree(&globbuf);
+        free(pattern);
+}
 
 void fs_private_dir_copy(const char *private_dir, const char *private_run_dir, const char *private_list) {
         assert(private_dir);
@@ -221,10 +362,10 @@ void fs_private_dir_copy(const char *private_dir, const char *private_run_dir, c
                         fprintf(stderr, "Error: invalid private %s argument\n", private_dir);
                         exit(1);
                 }
-                duplicate(ptr, private_dir, private_run_dir);
+                duplicate_globbing(ptr, private_dir, private_run_dir);
 
                 while ((ptr = strtok(NULL, ",")) != NULL)
-                        duplicate(ptr, private_dir, private_run_dir);
+                        duplicate_globbing(ptr, private_dir, private_run_dir);
                 free(dlist);
                 fs_logger_print();
         }
@@ -262,127 +403,3 @@ void fs_private_dir_list(const char *private_dir, const char *private_run_dir, c
         fmessage("Private %s installed in %0.2f ms\n", private_dir, timetrace_end());
 }
 
-void fs_rebuild_etc(void) {
-        int have_dhcp = 1;
-        if (cfg.dns1 == NULL && !any_dhcp())
-                have_dhcp = 0;
-
-        if (arg_debug)
-                printf("rebuilding /etc directory\n");
-        if (mkdir(RUN_DNS_ETC, 0755))
-                errExit("mkdir");
-        selinux_relabel_path(RUN_DNS_ETC, "/etc");
-        fs_logger("tmpfs /etc");
-
-        DIR *dir = opendir("/etc");
-        if (!dir)
-                errExit("opendir");
-
-        struct stat s;
-        struct dirent *entry;
-        while ((entry = readdir(dir))) {
-                if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
-                        continue;
-
-                // skip files in cfg.profile_rebuild_etc list
-                // these files are already blacklisted
-                {
-                        ProfileEntry *prf = cfg.profile_rebuild_etc;
-                        int found = 0;
-                        while (prf) {
-                                if (strcmp(entry->d_name, prf->data + 5) == 0) { // 5 is strlen("/etc/")
-                                        found = 1;
-                                        break;
-                                }
-                                prf = prf->next;
-                        }
-                        if (found)
-                                continue;
-                }
-
-                // for resolv.conf we might have to  create a brand new file later
-                if (have_dhcp &&
-                    (strcmp(entry->d_name, "resolv.conf") == 0 ||
-                     strcmp(entry->d_name, "resolv.conf.dhclient-new") == 0))
-                        continue;
-//              printf("linking %s\n", entry->d_name);
-
-                char *src;
-                if (asprintf(&src, "/etc/%s", entry->d_name) == -1)
-                        errExit("asprintf");
-                if (stat(src, &s) != 0) {
-                        free(src);
-                        continue;
-                }
-
-                char *dest;
-                if (asprintf(&dest, "%s/%s", RUN_DNS_ETC, entry->d_name) == -1)
-                        errExit("asprintf");
-
-                int symlink_done = 0;
-                if (is_link(src)) {
-                        char *rp =realpath(src, NULL);
-                        if (rp == NULL) {
-                                free(src);
-                                free(dest);
-                                continue;
-                        }
-                        if (symlink(rp, dest))
-                                errExit("symlink");
-                        else
-                                symlink_done = 1;
-                }
-                else if (S_ISDIR(s.st_mode))
-                        create_empty_dir_as_root(dest, S_IRWXU);
-                else
-                        create_empty_file_as_root(dest, S_IRUSR | S_IWUSR);
-
-                // bind-mount src on top of dest
-                if (!symlink_done) {
-                        if (mount(src, dest, NULL, MS_BIND|MS_REC, NULL) < 0)
-                                errExit("mount bind mirroring /etc");
-                }
-                fs_logger2("clone", src);
-
-                free(src);
-                free(dest);
-        }
-        closedir(dir);
-
-        // mount bind our private etc directory on top of /etc
-        if (arg_debug)
-                printf("Mount-bind %s on top of /etc\n", RUN_DNS_ETC);
-        if (mount(RUN_DNS_ETC, "/etc", NULL, MS_BIND|MS_REC, NULL) < 0)
-                errExit("mount bind mirroring /etc");
-        fs_logger("mount /etc");
-
-        if (have_dhcp == 0)
-                return;
-
-        if (arg_debug)
-                printf("Creating a new /etc/resolv.conf file\n");
-        FILE *fp = fopen("/etc/resolv.conf", "wxe");
-        if (!fp) {
-                fprintf(stderr, "Error: cannot create /etc/resolv.conf file\n");
-                exit(1);
-        }
-
-        if (cfg.dns1) {
-                if (any_dhcp())
-                        fwarning("network setup uses DHCP, nameservers will likely be overwritten\n");
-                fprintf(fp, "nameserver %s\n", cfg.dns1);
-        }
-        if (cfg.dns2)
-                fprintf(fp, "nameserver %s\n", cfg.dns2);
-        if (cfg.dns3)
-                fprintf(fp, "nameserver %s\n", cfg.dns3);
-        if (cfg.dns4)
-                fprintf(fp, "nameserver %s\n", cfg.dns4);
-
-        // mode and owner
-        SET_PERMS_STREAM(fp, 0, 0, 0644);
-
-        fclose(fp);
-
-        fs_logger("create /etc/resolv.conf");
-}
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c
index 8c4cb3d4f..8e72f8687 100644
--- a/src/firejail/fs_home.c
+++ b/src/firejail/fs_home.c
@@ -361,7 +361,8 @@ void fs_private_homedir(void) {
         }
         EUID_USER();
 
-        skel(homedir);
+        if (!arg_keep_shell_rc)
+                skel(homedir);
         if (xflag)
                 copy_xauthority();
         if (aflag)
@@ -430,7 +431,8 @@ void fs_private(void) {
                 selinux_relabel_path(homedir, homedir);
         }
 
-        skel(homedir);
+        if (!arg_keep_shell_rc)
+                skel(homedir);
         if (xflag)
                 copy_xauthority();
         if (aflag)
@@ -682,7 +684,8 @@ void fs_private_home_list(void) {
                 errExit("mounting tmpfs");
         EUID_USER();
 
-        skel(homedir);
+        if (!arg_keep_shell_rc)
+                skel(homedir);
         if (xflag)
                 copy_xauthority();
         if (aflag)
diff --git a/src/firejail/main.c b/src/firejail/main.c
index 18e9ae651..8df6926ee 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -127,6 +127,7 @@ int arg_nice = 0;				// nice value configured
 int arg_ipc = 0;                                        // enable ipc namespace
 int arg_writable_etc = 0;                       // writable etc
 int arg_keep_config_pulse = 0;                  // disable automatic ~/.config/pulse init
+int arg_keep_shell_rc = 0;                      // do not copy shell configuration from /etc/skel
 int arg_writable_var = 0;                       // writable var
 int arg_keep_var_tmp = 0;                       // don't overwrite /var/tmp
 int arg_writable_run_user = 0;                  // writable /run/user
@@ -1975,6 +1976,9 @@ int main(int argc, char **argv, char **envp) {
                 else if (strcmp(argv[i], "--keep-config-pulse") == 0) {
                         arg_keep_config_pulse = 1;
                 }
+                else if (strcmp(argv[i], "--keep-shell-rc") == 0) {
+                        arg_keep_shell_rc = 1;
+                }
                 else if (strcmp(argv[i], "--writable-var") == 0) {
                         arg_writable_var = 1;
                 }
@@ -2044,6 +2048,17 @@ int main(int argc, char **argv, char **envp) {
                 else if (strcmp(argv[i], "--keep-dev-shm") == 0) {
                         arg_keep_dev_shm = 1;
                 }
+                else if (strcmp(argv[i], "--private-etc") == 0) {
+                        if (checkcfg(CFG_PRIVATE_ETC)) {
+                                if (arg_writable_etc) {
+                                        fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
+                                        exit(1);
+                                }
+                                arg_private_etc = 1;
+                        }
+                        else
+                                exit_err_feature("private-etc");
+                }
                 else if (strncmp(argv[i], "--private-etc=", 14) == 0) {
                         if (checkcfg(CFG_PRIVATE_ETC)) {
                                 if (arg_writable_etc) {
@@ -2161,11 +2176,24 @@ int main(int argc, char **argv, char **envp) {
                 // hostname, etc
                 //*************************************
                 else if (strncmp(argv[i], "--name=", 7) == 0) {
+                        int only_numbers = 1;
                         cfg.name = argv[i] + 7;
                         if (strlen(cfg.name) == 0) {
                                 fprintf(stderr, "Error: please provide a name for sandbox\n");
                                 return 1;
                         }
+                        const char *c = cfg.name;
+                        while (*c) {
+                                if (!isdigit(*c)) {
+                                        only_numbers = 0;
+                                        break;
+                                }
+                                ++c;
+                        }
+                        if (only_numbers) {
+                                fprintf(stderr, "Error: invalid sandbox name: it only contains digits\n");
+                                return 1;
+                        }
                 }
                 else if (strncmp(argv[i], "--hostname=", 11) == 0) {
                         cfg.hostname = argv[i] + 11;
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index acf206da6..3924465e4 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -326,11 +326,24 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
         }
         // sandbox name
         else if (strncmp(ptr, "name ", 5) == 0) {
+                int only_numbers = 1;
                 cfg.name = ptr + 5;
                 if (strlen(cfg.name) == 0) {
                         fprintf(stderr, "Error: invalid sandbox name\n");
                         exit(1);
                 }
+                const char *c = cfg.name;
+                while (*c) {
+                        if (!isdigit(*c)) {
+                                only_numbers = 0;
+                                break;
+                        }
+                        ++c;
+                }
+                if (only_numbers) {
+                        fprintf(stderr, "Error: invalid sandbox name: it only contains digits\n");
+                        exit(1);
+                }
                 return 0;
         }
         else if (strcmp(ptr, "ipc-namespace") == 0) {
@@ -1222,6 +1235,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        if (strcmp(ptr, "keep-shell-rc") == 0) {
+                arg_keep_shell_rc = 1;
+                return 0;
+        }
+
         // writable-var
         if (strcmp(ptr, "writable-var") == 0) {
                 arg_writable_var = 1;
@@ -1366,6 +1384,20 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        // private /etc without a list of files and directories
+        if (strcmp(ptr, "private-etc") == 0) {
+                if (checkcfg(CFG_PRIVATE_ETC)) {
+                        if (arg_writable_etc) {
+                                fprintf(stderr, "Error: --private-etc and --writable-etc are mutually exclusive\n");
+                                exit(1);
+                        }
+                        arg_private_etc = 1;
+                }
+                else
+                        warning_feature_disabled("private-etc");
+                return 0;
+        }
+
         // private /opt list of files and directories
         if (strncmp(ptr, "private-opt ", 12) == 0) {
                 if (checkcfg(CFG_PRIVATE_OPT)) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 77fe73174..ec3bc250e 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -580,8 +580,6 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
                         if (arg_debug)
                                 printf("Running %s command through %s\n", cfg.command_line, cfg.usershell);
                         arg[index++] = "-c";
-                        if (arg_doubledash)
-                                arg[index++] = "--";
                         arg[index++] = cfg.command_line;
                 }
                 else if (login_shell) {
@@ -1032,6 +1030,7 @@ int sandbox(void* sandbox_arg) {
                          * 3. mount RUN_ETC_DIR at /etc
                          */
                         timetrace_start();
+                        cfg.etc_private_keep = fs_etc_build(cfg.etc_private_keep);
                         fs_private_dir_copy("/etc", RUN_ETC_DIR, cfg.etc_private_keep);
 
                         if (umount2("/etc/group", MNT_DETACH) == -1)
@@ -1048,7 +1047,8 @@ int sandbox(void* sandbox_arg) {
 
                         // openSUSE configuration is split between /etc and /usr/etc
                         // process private-etc a second time
-                        fs_private_dir_list("/usr/etc", RUN_USR_ETC_DIR, cfg.etc_private_keep);
+                        if (access("/usr/etc", F_OK) == 0)
+                                fs_private_dir_list("/usr/etc", RUN_USR_ETC_DIR, cfg.etc_private_keep);
                 }
         }
 
@@ -1098,10 +1098,10 @@ int sandbox(void* sandbox_arg) {
                 fs_dev_disable_input();
 
         //****************************
-        // rebuild etc directory, set dns
+        // set DNS
         //****************************
-        if (!arg_writable_etc)
-                fs_rebuild_etc();
+        if (cfg.dns1 != NULL || any_dhcp())
+                fs_resolvconf();
 
         //****************************
         // start dhcp client
diff --git a/src/firejail/usage.c b/src/firejail/usage.c
index 0a4c8a483..e31293c66 100644
--- a/src/firejail/usage.c
+++ b/src/firejail/usage.c
@@ -30,10 +30,12 @@ static char *usage_str =
         "    -- - signal the end of options and disables further option processing.\n"
         "    --allow-debuggers - allow tools such as strace and gdb inside the sandbox.\n"
         "    --allusers - all user home directories are visible inside the sandbox.\n"
+#ifdef HAVE_APPARMOR
         "    --apparmor - enable AppArmor confinement with the default profile.\n"
         "    --apparmor=profile_name - enable AppArmor confinement with a\n"
         "\tcustom profile.\n"
         "    --apparmor.print=name|pid - print apparmor status.\n"
+#endif
         "    --appimage - sandbox an AppImage application.\n"
 #ifdef HAVE_NETWORK
         "    --bandwidth=name|pid - set bandwidth limits.\n"
@@ -127,6 +129,7 @@ static char *usage_str =
         "    --keep-config-pulse - disable automatic ~/.config/pulse init.\n"
         "    --keep-dev-shm - /dev/shm directory is untouched (even with --private-dev).\n"
         "    --keep-fd - inherit open file descriptors to sandbox.\n"
+        "    --keep-shell-rc - do not copy shell rc files from /etc/skel\n"
         "    --keep-var-tmp - /var/tmp directory is untouched.\n"
         "    --list - list all sandboxes.\n"
 #ifdef HAVE_FILE_TRANSFER
diff --git a/src/firejail/util.c b/src/firejail/util.c
index a01290cf2..b35225620 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -255,7 +255,6 @@ static void clean_supplementary_groups(gid_t gid) {
         return;
 
 clean_all:
-        fwarning("cleaning all supplementary groups\n");
         if (setgroups(0, NULL) < 0)
                 errExit("setgroups");
 }
diff --git a/src/include/etc_groups.h b/src/include/etc_groups.h
new file mode 100644
index 000000000..dca767934
--- /dev/null
+++ b/src/include/etc_groups.h
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2014-2022 Firejail Authors
+ *
+ * This file is part of firejail project
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+#ifndef ETC_GROUPS_H
+#define ETC_GROUPS_H
+#include <stddef.h>
+
+#define ETC_MAX 256
+
+// @default
+static char *etc_list[ETC_MAX + 1] = { // plus 1 for ending NULL pointer
+        "alternatives",
+        "fonts",
+        "group",
+        "ld.so.cache",
+        "ld.so.conf",
+        "ld.so.conf.d",
+        "ld.so.preload",
+        "locale",
+        "locale.alias",
+        "locale.conf",
+        "localtime",
+        "login.defs", // firejail reading UID/GID MIN and MAX at startup
+        "nsswitch.conf",
+        "passwd",
+        "selinux",
+        NULL
+};
+
+// @games
+static char *etc_group_games[] = {
+        "openal", // 3D sound
+        "timidity", // MIDI
+        "timidity.cfg",
+        "vulkan", // next generation OpenGL stack
+        NULL
+};
+
+// @network
+static char*etc_group_network[] = {
+        "hostname",
+        "hosts",
+        "protocols",
+        "resolv.conf",
+        NULL
+};
+
+// @sound
+static char *etc_group_sound[] = {
+        "alsa",
+        "asound.conf",
+        "machine-id", // required by PulseAudio
+        "pulse",
+        NULL
+};
+
+// @tls-ca
+static char *etc_group_tls_ca[] = {
+        "ca-certificates",
+        "crypto-policies",
+        "gcrypt", // GNU crypto library - contains hardware config for various encryption schemes
+                // and random number generators. The file is not installed by Debian.
+        "pki",
+        "ssl",
+        NULL
+};
+
+// @x11
+static char *etc_group_x11[] = {
+        "ati", // 3D
+        "dconf",
+        "drirc",
+        "gtk-2.0",
+        "gtk-3.0",
+        "kde4rc",
+        "kde5rc",
+        "machine-id", // QT dbus lib is crashing without it!
+        "nvidia", // 3D
+        "pango", // text rendering/internationalization
+        "Trolltech.conf", // old QT config file
+        "X11",
+        "xdg",
+        NULL
+};
+
+#endif
diff --git a/src/include/rundefs.h b/src/include/rundefs.h
index 079670f10..b3ad564ac 100644
--- a/src/include/rundefs.h
+++ b/src/include/rundefs.h
@@ -99,5 +99,7 @@
 #define RUN_UMASK_FILE                  RUN_MNT_DIR "/umask"
 #define RUN_JOIN_FILE                   RUN_MNT_DIR "/join"
 #define RUN_OVERLAY_ROOT                RUN_MNT_DIR "/oroot"
+#define RUN_RESOLVCONF_FILE             RUN_MNT_DIR "/resolv.conf"
+
 
 #endif
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 5b16179ac..3fa07d1ee 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -288,6 +288,9 @@ pulse servers or non-standard socket paths.
 \fBkeep-dev-shm
 /dev/shm directory is untouched (even with private-dev).
 .TP
+\fBkeep-shell-rc
+Do not copy shell rc files (such as ~/.bashrc and ~/.zshrc) from /etc/skel.
+.TP
 \fBkeep-var-tmp
 /var/tmp directory is untouched.
 .TP
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index e5020e37e..6068c9ff4 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -1224,6 +1224,14 @@ Example:
 $ firejail --keep-fd=3,4,5
 
 .TP
+\fB\-\-keep-shell-rc
+By default, when using a private home directory, firejail copies files from the
+system's user home template (/etc/skel) into it, which overrides attempts to
+whitelist the original files (such as ~/.bashrc and ~/.zshrc).
+This option disables this feature, and enables the user to whitelist the
+original files.
+
+.TP
 \fB\-\-keep-var-tmp
 /var/tmp directory is untouched.
 .br
@@ -1330,6 +1338,7 @@ $ firejail \-\-net=eth0 \-\-mtu=1492
 \fB\-\-name=name
 Set sandbox name. Several options, such as \-\-join and \-\-shutdown, can use
 this name to identify a sandbox.
+The name cannot contain only digits, as that is treated as a PID in the other options, such as in \-\-join.
 
 In case the name supplied by the user is already in use by another sandbox, Firejail will assign a
 new name as "name-PID", where PID is the process ID of the sandbox. This functionality
@@ -2127,22 +2136,32 @@ cdrom  cdrw  dri  dvd  dvdrw  full  log  null  ptmx  pts  random  shm  snd  sr0
 .br
 $
 .TP
-\fB\-\-private-etc=file,directory
-Build a new /etc in a temporary
-filesystem, and copy the files and directories in the list.
-The files and directories in the list must be expressed as relative to
-the /etc directory (e.g., /etc/foo must be expressed as foo).
-If no listed file is found, /etc directory will be empty.
-All modifications are discarded when the sandbox is closed.
-Multiple private-etc commands are allowed and they accumulate.
-.br
+\fB\-\-private-etc, \-\-private-etc=file,directory,@group
+The files installed by \-\-private-etc are copies of the original system files from /etc directory.
+By default, the command brings in a skeleton of files and directories used by most console tools:
 
-.br
-Example:
-.br
-$ firejail --private-etc=group,hostname,localtime, \\
-.br
-nsswitch.conf,passwd,resolv.conf
+$ firejail --private-etc dig debian.org
+
+For X11/GTK/QT/Gnome/KDE  programs add @x11 group as a parameter. Example:
+
+$ firejail --private-etc=@x11,gcrypt,python* gimp
+
+gcrypt and /etc/python* directories are not part of the generic @x11 group.
+File globbing is supported.
+
+For games, add @games group:
+
+$ firejail --private-etc=@games,@x11 warzone2100
+
+Sound and networking files are included automatically, unless \-\-nosound or \-\-net=none are specified.
+Files for encrypted TLS/SSL protocol are in @tls-ca group.
+
+$ firejail --private-etc=@tls-ca,wgetrc wget https://debian.org
+
+
+Note: The easiest way to extract the list of /etc files accessed by your program is using strace utility:
+
+$ strace /usr/bin/transmission-qt 2>&1 | grep open | grep etc
 #ifdef HAVE_PRIVATE_HOME
 .TP
 \fB\-\-private-home=file,directory
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in
index 2b67c2a00..37ce7055b 100644
--- a/src/zsh_completion/_firejail.in
+++ b/src/zsh_completion/_firejail.in
@@ -104,6 +104,7 @@ _firejail_args=(
     '--keep-config-pulse[disable automatic ~/.config/pulse init]'
     '--keep-dev-shm[/dev/shm directory is untouched (even with --private-dev)]'
     '--keep-fd[inherit open file descriptors to sandbox]: :'
+    '--keep-shell-rc[do not copy shell rc files from /etc/skel]'
     '--keep-var-tmp[/var/tmp directory is untouched]'
     '--machine-id[spoof /etc/machine-id with a random id]'
     '--memory-deny-write-execute[seccomp filter to block attempts to create memory mappings that are both writable and executable]'