Fixes the following "implicit declaration" warning (13 occurrences in
total) when building with gcov support:

    $ pacman -Q gcc10
    gcc10 1:10.2.0-3
    $ CC=gcc-10 && export CC
    $ ./configure --prefix=/usr --enable-apparmor --enable-gcov >/dev/null
    $ make >/dev/null
    appimage.c: In function ‘appimage_set’:
    appimage.c:140:2: warning: implicit declaration of function ‘__gcov_flush’ [-Wimplicit-function-declaration]
      140 |  __gcov_flush();
          |  ^~~~~~~~~~~~
    interface.c: In function ‘print_sandbox’:
    interface.c:149:3: warning: implicit declaration of function ‘__gcov_flush’ [-Wimplicit-function-declaration]
      149 |   __gcov_flush();
          |   ^~~~~~~~~~~~
    netstats.c: In function ‘netstats’:
    netstats.c:246:4: warning: implicit declaration of function ‘__gcov_flush’ [-Wimplicit-function-declaration]
      246 |    __gcov_flush();
          |    ^~~~~~~~~~~~
    [...]

Note: The commands above were executed from makepkg, while building
firejail-git from the AUR.

Note2: gcc-10 was used because the build fails with the current gcc
version (11.1.0) on Artix Linux.  The failure happens because
__gcov_flush was removed on gcc 11.1.0[1]; this will be addressed later.

Note3: The following command helped find the affected files:

    $ git grep -Fl __gcov -- src

[1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=811b7636cb8c10f1a550a76242b5666c7ae36da2

gcov: add missing gcov.h includes

…-common

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

* downgrade error to warning,
smiliar to read-write option;
this simplifies use of tmpfs
option in general purpose
profiles, for example we
don't need to worry about links
people put in their homedir

* update manpage

* firecfg.config alpine

* Create alpinef.profile

* Create alpine.profile

* disable-programs.inc alpine

* workaround in comment

* Update etc/profile-a-l/alpine.profile

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

* deactivating whitelists in ${HOME}

* comment

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

allow access to pkgconfig

Address netblue30#3872 with changes in pipewire for Firefox and Chromium

The build currently fails if gcov support is enabled:

    $ pacman -Q gcc
    gcc 11.1.0-1
    $ ./configure --prefix=/usr --enable-apparmor --enable-gcov >/dev/null
    $ make >/dev/null
    [...]
    netstats.c: In function ‘netstats’:
    netstats.c:250:25: warning: implicit declaration of function ‘__gcov_flush’; did you mean ‘__gcov_dump’? [-Wimplicit-function-declaration]
      250 |                         __gcov_flush();
          |                         ^~~~~~~~~~~~
          |                         __gcov_dump
    [...]
    /usr/bin/ld: netstats.o: in function `netstats':
    /tmp/firejail-git/src/firejail-git/src/firemon/netstats.c:250: undefined reference to `__gcov_flush'
    [...]
    collect2: error: ld returned 1 exit status
    make[1]: *** [Makefile:10: firemon] Error 1
    make: *** [Makefile:42: src/firemon/firemon] Error 2
    [...]

This happens because __gcov_flush was removed on gcc 11.1.0[1] [2] [3].
See the following gcc commits:

* d39f7dc8d5 ("Do locking for __gcov_dump and __gcov_reset as well.")
* c0532db47d ("Use __gcov_dump and __gcov_reset in execv and fork context.")
* 811b7636cb ("Remove __gcov_flush.")

Its implementation did the following[4]:

      __gcov_lock ();
      __gcov_dump_int ();
      __gcov_reset_int ();
      __gcov_unlock ();

As hinted in the commit messages above, the function is no longer needed
because locking is now done inside each of __gcov_dump and __gcov_reset.

So add an implementation of __gcov_flush (on a new gcov_wrapper.h file)
for gcc >= 11.1.0, which just calls __gcov_dump and then __gcov_reset.

Commands used to search and replace:

    $ git grep -Flz '#include <gcov.h>' -- '*.c' |
      xargs -0 -I '{}' sh -c \
      "printf '%s\n' \"\`sed 's|<gcov\\.h>|\"../include/gcov_wrapper.h\"|' '{}'\`\" >'{}'"

Note: This is the continuation of commit 31557e9 ("gcov: add missing
gcov.h includes") / PR netblue30#4360.

[1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=d39f7dc8d558ca31a661b02d08ff090ce65e6652
[2] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c0532db47d092430f8e8f497b2dc53343527bb13
[3] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=811b7636cb8c10f1a550a76242b5666c7ae36da2
[4] https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=libgcc/libgcov-interface.c;h=855e8612018d1c9caf90396a3271337aaefdb9b3#l86

Added on commit e770ab6 ("appimage: automatically detect profile").

* move everything related to modification
of the default seccomp filter from --seccomp
to --seccomp= entry

* update errno descriptions

fs_home.c: run more code with euid of the user

augment seccomp lists in firejail.config

gcov: fix build failure with gcc 11.1.0

remove kcmp from seccomp default drop list

Instead of wrapping every gcov function call in an ifdef.

Note: The usage of `((void)0)` is based on section 7.2 of the C99
standard (N1256)[1] [2]:

> 7.2 Diagnostics <assert.h>
>
> 1 The header <assert.h> defines the assert macro and refers to another
> macro,
>
>     NDEBUG
>
> which is not defined by <assert.h>. If NDEBUG is defined as a macro
> name at the point in the source file where <assert.h> is included, the
> assert macro is defined simply as
>
>     #define assert(ignore) ((void)0)

See also assert.h(0p) from POSIX.1-2017[3].

Note: This is a continuation of commit b408b20 ("gcov: fix build
failure with gcc 11.1.0") / PR netblue30#4373.

[1] http://www.open-std.org/JTC1/SC22/WG14/www/docs/n1256.pdf
[2] https://port70.net/~nsz/c/c99/n1256.html#7.2
[3] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/assert.h.html

rtv profile correction

gcov: use no-op functions if not enabled

Refactor bitwarden as electron redirect

…ail-git

Fix sndio support

…/noblacklist

profcleaner.c is just sed, I was wondering why we need C for that.

fe0f975 (move whitelist/blacklist to
allow/deny) is just a huge rename w/o effects to the profile. Ignoreing
it in git blame to see which commits actually added/changed a
allow/nodeny command.

Configure git to use .git-blame-ignore-revs:

    git config blame.ignoreRevsFile .git-blame-ignore-revs

Add new clion-eap profile
Fix broken clion profile

[skip ci]

…ams.inc

LC_ALL=C sort disable-programs.inc

Update Clion profile and Add Clion EAP profile

Exclude allow/deny move in profile from git blame

allow/deny in zsh completion

Create profcleaner.sh

See netblue30@00cb8b6#commitcomment-53262808

[skip ci]

… were blacklisted

Create whitelist-run-common.inc

Profile for Dev channel already exists. Profile for "standard" Edge does
as well but is a redirect to Dev profile

See
b9b65f6

Fixes netblue30#4409

This reverts commit fe0f975.

Note: This only reverts the changes from etc.

The 4 aliases introduced on commit 45f2ba5 are mere, well, aliases.
That is, they fail to address the different usability problems discussed
on [netblue30#3447][3447] and in fact only make things more confusing (as has
already been mentioned on [this][4379] and later comments).  The main
reason is that the aliases do not meaningfully map to the original
commands.  For example, the commands from each pair below seem like they
would do the exact same thing:

* `allow` and `nodeny`
* `deny` and `noallow`

Additionally, if these aliases are not the final commands, but only a
test/work-in-progress, then keeping the wide-scale search/replace
changes made on commit fe0f975 would only serve to cause confusion, as
users of firejail-git, contributors and downstream projects might start
changing the commands used on their profiles, only to later have to
change them again, potentially to completely different commands.

The sooner this is undone the better, as (besides the above reasons) the
more profile changes there are between the original commit and the
revert, the harder it is to e.g.: `git diff` versions of files across
the following revision ranges: before the commit, after the commit but
before the revert and after the revert.  Note: This is still the case
even if a commit is [ignored by `git blame`][4390].

So let us revert fe0f975 and only reapply similar large-scale changes
once we have discussed and settled on better commands.

How the revert was applied: Despite using the auto-generated message
from `git revert`, to ensure correctness and to avoid conflicts the
changes were reverted in different steps: Firstly, revert the files
which can be safely reverted directly ("filestorevert"):

    # Find out which files have been changed on fe0f975, but have not
    # been changed afterwards and list them on "filestorevert"
    git show --pretty='' --name-only fe0f975 -- etc | LC_ALL=C sort >allfiles
    git diff --name-only fe0f975..master -- etc | LC_ALL=C sort >filestoignore
    comm -2 -3 allfiles filestoignore >filestorevert

    # Note: There are 3 extra files on filestoignore because they were
    # added after commit fe0f975
    wc -l allfiles filestoignore filestorevert | head -n 3
    #   797 allfiles
    #     8 filestoignore
    #   792 filestorevert

    # Automatically revert files in "filestorevert"
    # See https://stackoverflow.com/a/23401018/10095231
    tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975 -- |
    git apply --reverse

    printf 'Total files reverted:\n'
    git diff --name-only | wc -l
    # 792

Secondly, do some search/replace on the rest:

    tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \
      -e 's/allow  /whitelist /' -e 's/noallow  /nowhitelist /' \
      -e 's/deny  /blacklist /' -e 's/nodeny  /noblacklist /' \
      -e 's/deny-nolog  /blacklist-nolog /'

    find etc -name '*.bak' -print0 | xargs -0 rm

Thirdly, verify the result.  The following command shows the difference
between all the changes in etc from before fe0f975 and this commit
(inclusive):

    git diff fe0f975~1 -- etc

From the output, it looks like all alias changes are fully reverted and
that the other changes to etc (from after fe0f975) remain, so the
revert seems to be done correctly.

[3447]: netblue30#3447
[4379]: netblue30#4379 (comment)
[4390]: netblue30#4390

Recently I have noticed these two-
- org.telegram.desktop.BaseGtkIntegration-0fe332cb424bfc37f394ccb976afec41
- org.telegram.desktop.GtkIntegration-0fe332cb424bfc37f394ccb976afec41
 & without dbus rule for these two, telegram isn't quiting.

Add ms-edge-beta paths to disable-programs.inc

Support firecfg

Adding to release notes (already added to README.md)

fixes a number of smaller issues:

* enable allow-debuggers option for Firejail login shells
* dhcp: noblacklist /sbin and /usr/sbin also when configuring a Firejail login shell
* don't print error when built with disable-suid: firejail --nonewprivs --quiet firejail
* don't process appimage option twice
* no unnecessary argument parsing when run via firecfg symbolic link
* process quiet option earlier, so it is available to init_cfg