Allow passing in a netfilter configuration via the command line

[legoktm]

Please correct me if I'm wrong, but as I understand it from the man page, currently the netfilter configuration has to be saved in a file, and that is provided as a command-line argument.

For my use in MediaWiki, I'd like to be able to create dynamic netfilter configurations based on different configuration settings the user has provided (port numbers). Ideally I'd be able to pass in the configuration as a command-line option to firejail - is that something that would be possible? I'd like to avoid writing a file with dynamic contents at run time to avoid problems with webapps being able to write to the filesystem.

[reinerh]

I don't think the firejail command line is the right interface to pass in iptables rules.
Is it really better to allow webapps influencing the commandline instead of files?

[netblue30]

I think I can bring in something generic. It will allow you to set port numbers, IP addresses etc. from the command line.

[netblue30]

I added template support for netfilter. You start as usual and pass some arguments on the command line after the filter file:

--netfilter=filter-file,arg1,arg2,arg3

Firejail will replace $ARG1, $ARG2 and $ARG3 in your filter file with arg1, arg2, and arg3. Up to 16 arguments are allowed. There is a small example in /etc/firejail/tcpserver.net file. Let me know if you run into problems.