opt-in: skip blacklisted files in private-etc - netblue30#5010, netbl…

…ue30#5230

etc/firejail.config

@@ -78,6 +78,9 @@
 # Enable or disable overlayfs features, default enabled.
 # overlayfs yes
 
+# Hide blacklisted files in /etc directory, default disabled.
+# etc-no-blacklisted no
+
 # Set the limit for file copy in several --private-* options. The size is set
 # in megabytes. By default we allow up to 500MB.
 # Note: the files are copied in RAM.

src/firejail/checkcfg.c

@@ -51,6 +51,7 @@ int checkcfg(int val) {
 			cfg_val[i] = 1; // most of them are enabled by default
 		cfg_val[CFG_RESTRICTED_NETWORK] = 0; // disabled by default
 		cfg_val[CFG_FORCE_NONEWPRIVS] = 0;
+		cfg_val[CFG_ETC_NO_BLACKLISTED] = 0;
 		cfg_val[CFG_PRIVATE_BIN_NO_LOCAL] = 0;
 		cfg_val[CFG_FIREJAIL_PROMPT] = 0;
 		cfg_val[CFG_DISABLE_MNT] = 0;
@@ -115,6 +116,7 @@ int checkcfg(int val) {
 			PARSE_YESNO(CFG_TRACELOG, "tracelog")
 			PARSE_YESNO(CFG_XEPHYR_WINDOW_TITLE, "xephyr-window-title")
 			PARSE_YESNO(CFG_OVERLAYFS, "overlayfs")
+			PARSE_YESNO(CFG_ETC_NO_BLACKLISTED, "etc-no-blacklisted")
 			PARSE_YESNO(CFG_PRIVATE_BIN, "private-bin")
 			PARSE_YESNO(CFG_PRIVATE_BIN_NO_LOCAL, "private-bin-no-local")
 			PARSE_YESNO(CFG_PRIVATE_CACHE, "private-cache")

src/firejail/firejail.h

@@ -811,6 +811,7 @@ enum {
 	CFG_FORCE_NONEWPRIVS,
 	CFG_XEPHYR_WINDOW_TITLE,
 	CFG_OVERLAYFS,
+	CFG_ETC_NO_BLACKLISTED,
 	CFG_PRIVATE_BIN,
 	CFG_PRIVATE_BIN_NO_LOCAL,
 	CFG_PRIVATE_CACHE,

src/firejail/fs.c

@@ -162,7 +162,7 @@ static void disable_file(OPERATION op, const char *filename) {
 				fs_logger2("blacklist-nolog", fname);
 
 			// files in /etc will be reprocessed during /etc rebuild
-			if (strncmp(fname, "/etc/", 5) == 0) {
+			if (checkcfg(CFG_ETC_NO_BLACKLISTED) && strncmp(fname, "/etc/", 5) == 0) {
 				ProfileEntry *prf = malloc(sizeof(ProfileEntry));
 				if (!prf)
 					errExit("malloc");