keep-dev-ntsync: block /dev/ntsync by default

Restore and use `fs_dev_disable_ntsync()`.

etc/profile-m-z/noprofile.profile

@@ -21,6 +21,7 @@ ignore read-only /sys/module/nvidia*
 allow-debuggers
 allusers
 keep-config-pulse
+keep-dev-ntsync
 keep-dev-shm
 keep-fd all
 keep-var-tmp

src/firejail/firejail.h

@@ -651,6 +651,7 @@ void fs_dev_disable_dvd(void);
 void fs_dev_disable_tpm(void);
 void fs_dev_disable_u2f(void);
 void fs_dev_disable_input(void);
+void fs_dev_disable_ntsync(void);
 
 // fs_home.c
 // private mode (--private)

src/firejail/fs_dev.c

@@ -421,3 +421,12 @@ void fs_dev_disable_input(void) {
 		i++;
 	}
 }
+
+void fs_dev_disable_ntsync(void) {
+	int i = 0;
+	while (dev[i].dev_fname != NULL) {
+		if (dev[i].type == DEV_NTSYNC)
+			disable_file_or_dir(dev[i].dev_fname);
+		i++;
+	}
+}

src/firejail/sandbox.c

@@ -1113,6 +1113,9 @@ int sandbox(void* sandbox_arg) {
 	if (arg_noinput)
 		fs_dev_disable_input();
 
+	if (!arg_keep_dev_ntsync)
+		fs_dev_disable_ntsync();
+
 	//****************************
 	// set DNS
 	//****************************