Firejail: [enhancement] Allow more fine-grained ignore predicates

[chiraag-nataraj]

So right now, the way ignore works is that you use ignore <predicate> and it ignores all predicates of that type. I'm wondering if we can fine-tune this a bit to select which specific instance of the predicate to ignore. As an example, in my profiles, I have a common.inc which does most of the common stuff. But occasionally, I need to ignore one or two predicates (otherwise the program will break). Two predicates I have in this file are noexec ${HOME} and noexec /tmp. I want to ignore noexec /tmp while preserving noexec ${HOME}. Of course, one way would be to split this up into two different files (or more) to allow more granularity in my imports. But the nice thing about the current system is that I just have one import command which is easy to remember. @netblue30, what would it take to ignore a specific instance of a predicate instead of every instance?

[netblue30]

I kind of run into this problem all the time with the networking commands when I move profiles from one computer to another. The code for ignore is in profile.c. It is something very simple in this moment, if you have an idea we can expand it.

[chiraag-nataraj]

@netblue30 How about matching the full line rather than just the predicate itself? That way, you can select specific instances of the predicate to ignore. If only the predicate is given, all instances are ignored (as is the current behavior).

[netblue30]

What if we add another option, --ignore-match? We can add it on top of the regular ignore code, and if we need we can always add more similar options.

[chiraag-nataraj]

That seems like an okay idea. Personally, I don't see why we can't change the behavior of the current ignore predicate, but if this seems like a better idea to you, let's go with it :)

[startx2017]

I'll take over and implement it, unless you guys have already something going.

[startx2017]

Funny, the current code already allows ignoring full profile lines. Example:
firejail --ignore="net eth0" program firejail --ignore="blacklist /dev/null" program
In profile file use
ignore net eth0 ignore blacklist /dev/null
I'll modify man pages.

[chiraag-nataraj]

@startx2017 Oh man...let me try this now.

[chiraag-nataraj]

Oh man, it _does_ work! Awesome.