feature: firecfg: add firecfg.d & add ignore command

[kmk3]

Main changes:

• firecfg: parse config files in /etc/firejail/firecfg.d

/etc/firejail/firecfg.d/*.conf files are parsed before
/etc/firejail/firecfg.config, so the former can ignore/override any item in the
latter.

• Add ignore command (!PROGRAM)

It prevents firecfg from creating a symlink for the given program.

Also, document the paths used and the config file syntax.

Suggested by @WhyNotHugo:

• firecfg: allow for ignoring specific apps #2097 (comment)

Closes #2097.

[kmk3]

A few considerations:

Instead of !PROGRAM, I thought about using ignore PROGRAM for better
readability and to be consistent with firejail, but ignore works slightly
differently in firejail:

• firejail/src/firejail/profile.c

  Lines 103 to 119 in 33c75b8

  	static int is_in_ignore_list(char *ptr) {
  	// check ignore list
  	int i;
  	for (i = 0; i < MAX_PROFILE_IGNORE; i++) {
  	if (cfg.profile_ignore[i] == NULL)
  	break;
  	int len = strlen(cfg.profile_ignore[i]);
  	if (strncmp(ptr, cfg.profile_ignore[i], len) == 0) {
  	// full word match
  	if (*(ptr + len) == '\0' || *(ptr + len) == ' ')
  	return 1; // ignore line
  	}
  	}
  	return 0;
  	}

It only compares up to the first space, so it considers ignore foo and
ignore foo bar to be equivalent, for example. That makes sense for ignoring
commands with arguments (like ignore name ignores name foo), but not so
much for paths.

To avoid confusion (if a program name has a space in it for whatever reason),
it seems like a good idea to use a different name/syntax.

Other than that, I'd say it's fairly straightforward.

[glitsj16]

We might need to make it explicit in release notes that this introduces a dependency on zenity to the firejail package.

[kmk3]

We might need to make it explicit in release notes that this introduces a
dependency on zenity to the firejail package.

The zenity-related code is already there and is only executed if --guide is
used:

• firejail/src/firecfg/main.c

  Lines 449 to 464 in 33c75b8

  	if (arg_guide) {
  	char *cmd;
  	if (arg_debug) {
  	if (asprintf(&cmd, "sudo %s/firejail/firejail-welcome.sh /usr/lib/firejail/fzenity %s %s", LIBDIR, SYSCONFDIR, user) == -1)
  	errExit("asprintf");
  	}
  	else {
  	if (asprintf(&cmd, "sudo %s/firejail/firejail-welcome.sh /usr/bin/zenity %s %s", LIBDIR, SYSCONFDIR, user) == -1)
  	errExit("asprintf");
  	}
  	int status = system(cmd);
  	if (status == -1) {
  	fprintf(stderr, "Error: cannot run firejail-welcome.sh\n");
  	exit(1);
  	}
  	free(cmd);

It was added in the following commits:

• 62e33cf ("more on firecfg --guide", 2022-04-21)
• 1cdfa6f ("more on firecfg --guide: fzenity", 2022-04-25)

---

This PR only moves such paths to constants; see commit 1f07de8 ("firecfg:
turn constant strings into constants", 2023-06-30).

[glitsj16]

@kmk3 Thank you for clearing up this zenity situation in such a detailed manner.

[netblue30]

Cool job! If you don't have anything coming, check it in!

[netblue30]

All merged, thanks!