diff options
author | 2018-04-20 20:32:43 +0200 | |
---|---|---|
committer | 2018-04-20 20:41:13 +0200 | |
commit | 5395e525f68f2fcf78e933f731b1da0009f64149 (patch) | |
tree | d482748f7b8eaf3d41db03ea435dee2a52c8d98b | |
parent | merges (diff) | |
download | firejail-5395e525f68f2fcf78e933f731b1da0009f64149.tar.gz firejail-5395e525f68f2fcf78e933f731b1da0009f64149.tar.zst firejail-5395e525f68f2fcf78e933f731b1da0009f64149.zip |
docs and comment updates
adds sorting to syscall list in firejail man page
-rw-r--r-- | etc/firejail-default | 10 | ||||
-rw-r--r-- | etc/skypeforlinux.profile | 2 | ||||
-rw-r--r-- | src/firejail/x11.c | 2 | ||||
-rw-r--r-- | src/man/firejail-profile.txt | 9 | ||||
-rw-r--r-- | src/man/firejail.txt | 26 |
5 files changed, 26 insertions, 23 deletions
diff --git a/etc/firejail-default b/etc/firejail-default index 2e48439f5..5cfb1b5ea 100644 --- a/etc/firejail-default +++ b/etc/firejail-default | |||
@@ -21,10 +21,10 @@ profile firejail-default flags=(attach_disconnected,mediate_deleted) { | |||
21 | #dbus, | 21 | #dbus, |
22 | 22 | ||
23 | ########## | 23 | ########## |
24 | # Allows to attach to a running program and modify the process memory. | 24 | # With ptrace it is possible to inspect and hijack running programs. Usually this |
25 | # May be needed by chromium crash handler. Uncomment if you need it. | 25 | # is needed only for debugging. To allow ptrace, uncomment the following line |
26 | ########## | 26 | ########## |
27 | #ptrace (trace tracedby), | 27 | #ptrace, |
28 | 28 | ||
29 | ########## | 29 | ########## |
30 | # Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes | 30 | # Line starting with /run/firejail/mnt/oroot deal with --overlay sandboxes |
@@ -133,8 +133,8 @@ network raw, | |||
133 | signal, | 133 | signal, |
134 | 134 | ||
135 | ########## | 135 | ########## |
136 | # We let Firejail deal with capabilities, | 136 | # We let Firejail deal with capabilities, but ensure that |
137 | # but mac_admin should be dropped in any case. | 137 | # some AppArmor related capabilities will not be available. |
138 | ########## | 138 | ########## |
139 | capability chown, | 139 | capability chown, |
140 | capability dac_override, | 140 | capability dac_override, |
diff --git a/etc/skypeforlinux.profile b/etc/skypeforlinux.profile index 015709247..c2270ce39 100644 --- a/etc/skypeforlinux.profile +++ b/etc/skypeforlinux.profile | |||
@@ -25,7 +25,7 @@ seccomp | |||
25 | shell none | 25 | shell none |
26 | 26 | ||
27 | disable-mnt | 27 | disable-mnt |
28 | #private-dev | 28 | # private-dev - needs /dev/disk |
29 | private-tmp | 29 | private-tmp |
30 | 30 | ||
31 | noexec ${HOME} | 31 | noexec ${HOME} |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index 7040dea18..8cf4fccf3 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -1078,7 +1078,7 @@ void x11_xorg(void) { | |||
1078 | // check xauth utility is present in the system | 1078 | // check xauth utility is present in the system |
1079 | struct stat s; | 1079 | struct stat s; |
1080 | if (stat("/usr/bin/xauth", &s) == -1) { | 1080 | if (stat("/usr/bin/xauth", &s) == -1) { |
1081 | fprintf(stderr, "Error: xauth utility not found in PATH. Please install it:\n" | 1081 | fprintf(stderr, "Error: xauth utility not found in /usr/bin. Please install it:\n" |
1082 | " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); | 1082 | " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); |
1083 | exit(1); | 1083 | exit(1); |
1084 | } | 1084 | } |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index b529f63e3..0217e1353 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -223,7 +223,8 @@ Build a new /bin in a temporary filesystem, and copy the programs in the list. | |||
223 | The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin. | 223 | The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin. |
224 | .TP | 224 | .TP |
225 | \fBprivate-dev | 225 | \fBprivate-dev |
226 | Create a new /dev directory. Only dri, null, full, zero, tty, pts, ptmx, random, urandom, log and shm devices are available. | 226 | Create a new /dev directory. Only disc, dri, null, full, zero, tty, pts, ptmx, |
227 | random, snd, urandom, video, log and shm devices are available. | ||
227 | .TP | 228 | .TP |
228 | \fBprivate-etc file,directory | 229 | \fBprivate-etc file,directory |
229 | Build a new /etc in a temporary | 230 | Build a new /etc in a temporary |
@@ -448,6 +449,12 @@ Run the program directly, without a shell. | |||
448 | \fBipc-namespace | 449 | \fBipc-namespace |
449 | Enable IPC namespace. | 450 | Enable IPC namespace. |
450 | .TP | 451 | .TP |
452 | \fBnodbus | ||
453 | Disable D-Bus access. Only the regular UNIX socket is handled by | ||
454 | this command. To disable the abstract socket, you would need to | ||
455 | request a new network namespace using the net command. Another | ||
456 | option is to remove unix from protocol set. | ||
457 | .TP | ||
451 | \fBnosound | 458 | \fBnosound |
452 | Disable sound system. | 459 | Disable sound system. |
453 | .TP | 460 | .TP |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 2e410061d..d8fed1f31 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -1602,20 +1602,16 @@ $ firejail \-\-net=eth0 \-\-scan | |||
1602 | .TP | 1602 | .TP |
1603 | \fB\-\-seccomp | 1603 | \fB\-\-seccomp |
1604 | Enable seccomp filter and blacklist the syscalls in the default list (@default). The default list is as follows: | 1604 | Enable seccomp filter and blacklist the syscalls in the default list (@default). The default list is as follows: |
1605 | mount, umount2, ptrace, kexec_load, kexec_file_load, name_to_handle_at, open_by_handle_at, create_module, init_module, finit_module, delete_module, | 1605 | _sysctl, acct, add_key, adjtimex, afs_syscall, bdflush, bpf, break, chroot, clock_adjtime, clock_settime, |
1606 | iopl, ioperm, ioprio_set, swapon, swapoff, syslog, process_vm_readv, process_vm_writev, | 1606 | create_module, delete_module, fanotify_init, finit_module, ftime, get_kernel_syms, getpmsg, gtty, init_module, |
1607 | sysfs,_sysctl, adjtimex, clock_adjtime, lookup_dcookie, perf_event_open, fanotify_init, kcmp, | 1607 | io_cancel, io_destroy, io_getevents, io_setup, io_submit, ioperm, iopl, ioprio_set, kcmp, kexec_file_load, |
1608 | add_key, request_key, keyctl, uselib, acct, modify_ldt, pivot_root, io_setup, | 1608 | kexec_load, keyctl, lock, lookup_dcookie, mbind, mfsservctl, migrate_pages, modify_ldt, mount, move_pages, mpx, |
1609 | io_destroy, io_getevents, io_submit, io_cancel, | 1609 | name_to_handle_at, open_by_handle_at, pciconfig_iobase, pciconfig_read, pciconfig_write, perf_event_open, |
1610 | remap_file_pages, mbind, set_mempolicy, | 1610 | personality, pivot_root, process_vm_readv, process_vm_writev, process_vm_writev, prof, profil, ptrace, putpmsg, |
1611 | migrate_pages, move_pages, vmsplice, chroot, | 1611 | query_module, reboot, remap_file_pages, request_key, rtas, s390_mmio_read, s390_mmio_write, s390_runtime_instr, |
1612 | tuxcall, reboot, mfsservctl, get_kernel_syms, | 1612 | security, set_mempolicy, setdomainname, sethostname, settimeofday, sgetmask, ssetmask, stime, stty, subpage_prot, |
1613 | bpf, clock_settime, personality, process_vm_writev, query_module, | 1613 | swapoff, swapon, switch_endian, sysfs, syslog, tuxcall, ulimit, umount, umount2, uselib, userfaultfd, ustat, vhangup, |
1614 | settimeofday, stime, umount, userfaultfd, ustat, vm86, vm86old, | 1614 | vm86, vm86old, vmsplice and vserver. |
1615 | afs_syscall, bdflush, break, ftime, getpmsg, gtty, lock, mpx, pciconfig_iobase, pciconfig_read, | ||
1616 | pciconfig_write, prof, profil, putpmsg, rtas, s390_runtime_instr, s390_mmio_read, s390_mmio_write, | ||
1617 | security, setdomainname, sethostname, sgetmask, ssetmask, stty, subpage_prot, switch_endian, | ||
1618 | ulimit, vhangup and vserver. | ||
1619 | 1615 | ||
1620 | .br | 1616 | .br |
1621 | To help creating useful seccomp filters more easily, the following | 1617 | To help creating useful seccomp filters more easily, the following |
@@ -1698,7 +1694,7 @@ Bad system call | |||
1698 | .br | 1694 | .br |
1699 | 1695 | ||
1700 | .TP | 1696 | .TP |
1701 | \fB\-\-seccomp.block_secondary | 1697 | \fB\-\-seccomp.block-secondary |
1702 | Enable seccomp filter and filter system call architectures so that | 1698 | Enable seccomp filter and filter system call architectures so that |
1703 | only the native architecture is allowed. For example, on amd64, i386 | 1699 | only the native architecture is allowed. For example, on amd64, i386 |
1704 | and x32 system calls are blocked as well as changing the execution | 1700 | and x32 system calls are blocked as well as changing the execution |