diff options
author | 2023-10-24 09:13:27 -0400 | |
---|---|---|
committer | 2023-10-24 09:13:27 -0400 | |
commit | fa075b62fb010267e7b9eda8264b596d94d66aab (patch) | |
tree | 70770c7df31ff84f0f02890515eea562f84d8988 | |
parent | build(deps): bump github/codeql-action from 2.22.3 to 2.22.4 (diff) | |
download | firejail-fa075b62fb010267e7b9eda8264b596d94d66aab.tar.gz firejail-fa075b62fb010267e7b9eda8264b596d94d66aab.tar.zst firejail-fa075b62fb010267e7b9eda8264b596d94d66aab.zip |
enabled nettraces by default in the main build - you would need to be root to run these optionslandlock-split
-rw-r--r-- | src/firejail/main.c | 4 | ||||
-rw-r--r-- | src/fnettrace/main.c | 10 | ||||
-rw-r--r-- | src/fnettrace/static-ip-map.txt | 41 | ||||
-rw-r--r-- | src/man/firejail.1.in | 20 |
4 files changed, 47 insertions, 28 deletions
diff --git a/src/firejail/main.c b/src/firejail/main.c index e3dab561c..0c9c80137 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -420,7 +420,6 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
420 | exit_err_feature("x11"); | 420 | exit_err_feature("x11"); |
421 | } | 421 | } |
422 | #endif | 422 | #endif |
423 | #ifdef HAVE_NETWORK | ||
424 | else if (strcmp(argv[i], "--nettrace") == 0) { | 423 | else if (strcmp(argv[i], "--nettrace") == 0) { |
425 | if (checkcfg(CFG_NETWORK)) { | 424 | if (checkcfg(CFG_NETWORK)) { |
426 | if (getuid() != 0) { | 425 | if (getuid() != 0) { |
@@ -524,8 +523,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
524 | exit(0); | 523 | exit(0); |
525 | } | 524 | } |
526 | 525 | ||
527 | 526 | #ifdef HAVE_NETWORK | |
528 | |||
529 | else if (strncmp(argv[i], "--bandwidth=", 12) == 0) { | 527 | else if (strncmp(argv[i], "--bandwidth=", 12) == 0) { |
530 | if (checkcfg(CFG_NETWORK)) { | 528 | if (checkcfg(CFG_NETWORK)) { |
531 | logargs(argc, argv); | 529 | logargs(argc, argv); |
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c index 5a0b97e89..4db8e7478 100644 --- a/src/fnettrace/main.c +++ b/src/fnettrace/main.c | |||
@@ -308,6 +308,8 @@ static inline const char *common_port(uint16_t port) { | |||
308 | return "Tor"; | 308 | return "Tor"; |
309 | else if (port == 9030) | 309 | else if (port == 9030) |
310 | return "Tor"; | 310 | return "Tor"; |
311 | else if (port == 9040) | ||
312 | return "Tor"; | ||
311 | else if (port == 9050) | 313 | else if (port == 9050) |
312 | return "Tor"; | 314 | return "Tor"; |
313 | else if (port == 9051) | 315 | else if (port == 9051) |
@@ -506,16 +508,16 @@ static void print_stats(FILE *fp) { | |||
506 | 508 | ||
507 | fprintf(fp, "\n\nIP map"); | 509 | fprintf(fp, "\n\nIP map"); |
508 | if (fp == stdout) | 510 | if (fp == stdout) |
509 | ansi_faint(" - server-address network (packets)\n"); | 511 | ansi_faint(" - network (packets)\n"); |
510 | else | 512 | else |
511 | fprintf(fp, " - server-address network (packets)\n"); | 513 | fprintf(fp, " - network (packets)\n"); |
512 | radix_print(fp, 1); | 514 | radix_print(fp, 1); |
513 | 515 | ||
514 | fprintf(fp, "\n\nEvents %d", ev_cnt); | 516 | fprintf(fp, "\n\nEvents %d", ev_cnt); |
515 | if (fp == stdout) | 517 | if (fp == stdout) |
516 | ansi_faint(" - time address:port data\n"); | 518 | ansi_faint(" - time address data\n"); |
517 | else | 519 | else |
518 | fprintf(fp, " - time address:port data\n"); | 520 | fprintf(fp, " - time address data\n"); |
519 | ev_print(fp); | 521 | ev_print(fp); |
520 | 522 | ||
521 | } | 523 | } |
diff --git a/src/fnettrace/static-ip-map.txt b/src/fnettrace/static-ip-map.txt index 3e857b200..aeac58c6a 100644 --- a/src/fnettrace/static-ip-map.txt +++ b/src/fnettrace/static-ip-map.txt | |||
@@ -188,6 +188,7 @@ | |||
188 | 104.244.40.0/21 Twitter | 188 | 104.244.40.0/21 Twitter |
189 | 108.160.160.0/20 Dropbox | 189 | 108.160.160.0/20 Dropbox |
190 | 108.175.32.0/20 Netflix | 190 | 108.175.32.0/20 Netflix |
191 | 129.144.0.0/12 Oracle | ||
191 | 129.134.0.0/16 Facebook | 192 | 129.134.0.0/16 Facebook |
192 | 140.82.112.0/20 GitHub | 193 | 140.82.112.0/20 GitHub |
193 | 143.55.64.0/20 GitHub | 194 | 143.55.64.0/20 GitHub |
@@ -221,7 +222,6 @@ | |||
221 | 185.125.188.0/22 Ubuntu One | 222 | 185.125.188.0/22 Ubuntu One |
222 | 185.199.108.0/22 GitHub | 223 | 185.199.108.0/22 GitHub |
223 | 185.205.69.0/24 Tutanota | 224 | 185.205.69.0/24 Tutanota |
224 | 185.238.113.0/24 Bitchute | ||
225 | 188.64.224.0/21 Twitter | 225 | 188.64.224.0/21 Twitter |
226 | 190.217.33.0/24 Steam | 226 | 190.217.33.0/24 Steam |
227 | 192.0.64.0/18 Wordpress | 227 | 192.0.64.0/18 Wordpress |
@@ -253,7 +253,11 @@ | |||
253 | 63.141.247.168/29 BitChute | 253 | 63.141.247.168/29 BitChute |
254 | 63.141.247.240/29 BitChute | 254 | 63.141.247.240/29 BitChute |
255 | 69.30.200.200/29 BitChute | 255 | 69.30.200.200/29 BitChute |
256 | 69.30.230.64/29 BitChute | ||
257 | 69.30.241.40/29 BitChute | ||
256 | 69.30.241.48/29 BitChute | 258 | 69.30.241.48/29 BitChute |
259 | 69.30.243.168/29 BitChute | ||
260 | 69.30.245.232/29 BitChute | ||
257 | 69.30.253.16/29 BitChute | 261 | 69.30.253.16/29 BitChute |
258 | 69.197.182.184/29 BitChute | 262 | 69.197.182.184/29 BitChute |
259 | 74.91.28.208/29 BitChute | 263 | 74.91.28.208/29 BitChute |
@@ -264,6 +268,7 @@ | |||
264 | 107.150.45.120/29 BitChute | 268 | 107.150.45.120/29 BitChute |
265 | 142.54.180.104/29 BitChute | 269 | 142.54.180.104/29 BitChute |
266 | 142.54.181.184/29 BitChute | 270 | 142.54.181.184/29 BitChute |
271 | 142.54.188.112/29 BitChute | ||
267 | 142.54.189.192/29 BitChute | 272 | 142.54.189.192/29 BitChute |
268 | 173.208.154.8/29 BitChute | 273 | 173.208.154.8/29 BitChute |
269 | 173.208.154.160/29 BitChute | 274 | 173.208.154.160/29 BitChute |
@@ -275,19 +280,27 @@ | |||
275 | 173.208.216.40/29 BitChute | 280 | 173.208.216.40/29 BitChute |
276 | 173.208.219.112/29 BitChute | 281 | 173.208.219.112/29 BitChute |
277 | 173.208.246.160/29 BitChute | 282 | 173.208.246.160/29 BitChute |
283 | 185.238.113.0/24 BitChute | ||
284 | 192.151.147.16/29 BitChute | ||
278 | 192.151.158.136/29 BitChute | 285 | 192.151.158.136/29 BitChute |
279 | 192.187.97.88/29 BitChute | 286 | 192.187.97.88/29 BitChute |
280 | 192.187.114.16/29 BitChute | 287 | 192.187.114.16/29 BitChute |
281 | 192.187.114.96/29 BitChute | 288 | 192.187.114.96/29 BitChute |
289 | 192.187.118.168/29 BitChute | ||
290 | 192.187.121.208/29 BitChute | ||
282 | 192.187.123.112/29 BitChute | 291 | 192.187.123.112/29 BitChute |
283 | 192.187.126.0/29 BitChute | 292 | 192.187.126.0/29 BitChute |
284 | 198.204.226.120/29 BitChute | 293 | 198.204.226.120/29 BitChute |
285 | 198.204.228.48/29 BitChute | 294 | 198.204.228.48/29 BitChute |
295 | 198.204.235.88/29 BitChute | ||
286 | 198.204.235.216/29 BitChute | 296 | 198.204.235.216/29 BitChute |
287 | 198.204.245.32/29 BitChute | 297 | 198.204.245.32/29 BitChute |
288 | 198.204.245.88/29 BitChute | 298 | 198.204.245.88/29 BitChute |
289 | 198.204.250.208/29 BitChute | 299 | 198.204.250.208/29 BitChute |
300 | 198.204.253.64/29 BitChute | ||
301 | 198.204.253.184/29 BitChute | ||
290 | 199.168.96.24/29 BitChute | 302 | 199.168.96.24/29 BitChute |
303 | 199.168.96.64/29 BitChute | ||
291 | 204.12.220.136/29 BitChute | 304 | 204.12.220.136/29 BitChute |
292 | 204.12.194.176/29 BitChute | 305 | 204.12.194.176/29 BitChute |
293 | 204.12.194.248/29 BitChute | 306 | 204.12.194.248/29 BitChute |
@@ -297,7 +310,7 @@ | |||
297 | # WholeSale Internet | 310 | # WholeSale Internet |
298 | 69.30.192.0/18 WholeSale Internet | 311 | 69.30.192.0/18 WholeSale Internet |
299 | 69.197.128.0/18 WholeSale Internet | 312 | 69.197.128.0/18 WholeSale Internet |
300 | 313 | 142.54.160.0/19 WholeSale Internet | |
301 | 173.208.128.0/17 WholeSale Internet | 314 | 173.208.128.0/17 WholeSale Internet |
302 | 204.12.192.0/18 WholeSale Internet | 315 | 204.12.192.0/18 WholeSale Internet |
303 | 208.67.0.0/21 WholeSale Internet | 316 | 208.67.0.0/21 WholeSale Internet |
@@ -625,6 +638,7 @@ | |||
625 | 206.190.32.0/19 Yahoo | 638 | 206.190.32.0/19 Yahoo |
626 | 209.73.160.0/19 Yahoo | 639 | 209.73.160.0/19 Yahoo |
627 | 209.191.64.0/18 Yahoo | 640 | 209.191.64.0/18 Yahoo |
641 | 212.82.100.0/22 Yahoo | ||
628 | 216.115.96.0/20 Yahoo | 642 | 216.115.96.0/20 Yahoo |
629 | 643 | ||
630 | 644 | ||
@@ -634,6 +648,18 @@ | |||
634 | 8.35.192.0/20 Google | 648 | 8.35.192.0/20 Google |
635 | 23.236.48.0/20 Google | 649 | 23.236.48.0/20 Google |
636 | 23.251.128.0/19 Google | 650 | 23.251.128.0/19 Google |
651 | 34.4.16.0/20 Google | ||
652 | 34.4.64.0/18 Google | ||
653 | 34.4.6.0/23 Google | ||
654 | 34.16.0.0/12 Google | ||
655 | 34.32.0.0/11 Google | ||
656 | 34.4.128.0/17 Google | ||
657 | 34.8.0.0/13 Google | ||
658 | 34.4.8.0/21 Google | ||
659 | 34.5.0.0/16 Google | ||
660 | 34.6.0.0/15 Google | ||
661 | 34.4.32.0/19 Google | ||
662 | 34.4.5.0/24 Google | ||
637 | 34.64.0.0/10 Google | 663 | 34.64.0.0/10 Google |
638 | 34.128.0.0/10 Google | 664 | 34.128.0.0/10 Google |
639 | 35.184.0.0/13 Google | 665 | 35.184.0.0/13 Google |
@@ -1884,6 +1910,7 @@ | |||
1884 | 34.192.0.0/12 Amazon | 1910 | 34.192.0.0/12 Amazon |
1885 | 34.208.0.0/12 Amazon | 1911 | 34.208.0.0/12 Amazon |
1886 | 34.224.0.0/12 Amazon | 1912 | 34.224.0.0/12 Amazon |
1913 | 34.225.127.72/10 Amazon | ||
1887 | 34.240.0.0/13 Amazon | 1914 | 34.240.0.0/13 Amazon |
1888 | 34.248.0.0/13 Amazon | 1915 | 34.248.0.0/13 Amazon |
1889 | 35.71.64.0/22 Amazon | 1916 | 35.71.64.0/22 Amazon |
@@ -3432,7 +3459,7 @@ | |||
3432 | 54.93.0.0/16 Amazon | 3459 | 54.93.0.0/16 Amazon |
3433 | 54.94.0.0/16 Amazon | 3460 | 54.94.0.0/16 Amazon |
3434 | 54.95.0.0/16 Amazon | 3461 | 54.95.0.0/16 Amazon |
3435 | 54.144.0.0/14 Amazon | 3462 | 54.144.0.0/12 Amazon |
3436 | 54.148.0.0/15 Amazon | 3463 | 54.148.0.0/15 Amazon |
3437 | 54.150.0.0/16 Amazon | 3464 | 54.150.0.0/16 Amazon |
3438 | 54.151.0.0/17 Amazon | 3465 | 54.151.0.0/17 Amazon |
@@ -3443,7 +3470,7 @@ | |||
3443 | 54.154.0.0/16 Amazon | 3470 | 54.154.0.0/16 Amazon |
3444 | 54.155.0.0/16 Amazon | 3471 | 54.155.0.0/16 Amazon |
3445 | 54.156.0.0/14 Amazon | 3472 | 54.156.0.0/14 Amazon |
3446 | 54.160.0.0/13 Amazon | 3473 | 54.160.0.0/11 Amazon |
3447 | 54.168.0.0/16 Amazon | 3474 | 54.168.0.0/16 Amazon |
3448 | 54.169.0.0/16 Amazon | 3475 | 54.169.0.0/16 Amazon |
3449 | 54.170.0.0/15 Amazon | 3476 | 54.170.0.0/15 Amazon |
@@ -3456,7 +3483,7 @@ | |||
3456 | 54.182.0.0/16 Amazon | 3483 | 54.182.0.0/16 Amazon |
3457 | 54.183.0.0/16 Amazon | 3484 | 54.183.0.0/16 Amazon |
3458 | 54.184.0.0/13 Amazon | 3485 | 54.184.0.0/13 Amazon |
3459 | 54.192.0.0/16 Amazon | 3486 | 54.192.0.0/12 Amazon |
3460 | 54.193.0.0/16 Amazon | 3487 | 54.193.0.0/16 Amazon |
3461 | 54.194.0.0/15 Amazon | 3488 | 54.194.0.0/15 Amazon |
3462 | 54.196.0.0/15 Amazon | 3489 | 54.196.0.0/15 Amazon |
@@ -3467,12 +3494,12 @@ | |||
3467 | 54.204.0.0/15 Amazon | 3494 | 54.204.0.0/15 Amazon |
3468 | 54.206.0.0/16 Amazon | 3495 | 54.206.0.0/16 Amazon |
3469 | 54.207.0.0/16 Amazon | 3496 | 54.207.0.0/16 Amazon |
3470 | 54.208.0.0/15 Amazon | 3497 | 54.208.0.0/13 Amazon |
3471 | 54.210.0.0/15 Amazon | 3498 | 54.210.0.0/15 Amazon |
3472 | 54.212.0.0/15 Amazon | 3499 | 54.212.0.0/15 Amazon |
3473 | 54.214.0.0/16 Amazon | 3500 | 54.214.0.0/16 Amazon |
3474 | 54.215.0.0/16 Amazon | 3501 | 54.215.0.0/16 Amazon |
3475 | 54.216.0.0/15 Amazon | 3502 | 54.216.0.0/14 Amazon |
3476 | 54.218.0.0/16 Amazon | 3503 | 54.218.0.0/16 Amazon |
3477 | 54.219.0.0/16 Amazon | 3504 | 54.219.0.0/16 Amazon |
3478 | 54.220.0.0/16 Amazon | 3505 | 54.220.0.0/16 Amazon |
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in index ee4adf5b8..06969e851 100644 --- a/src/man/firejail.1.in +++ b/src/man/firejail.1.in | |||
@@ -788,7 +788,6 @@ $ firejail \-\-list | |||
788 | .br | 788 | .br |
789 | $ firejail \-\-dns.print=3272 | 789 | $ firejail \-\-dns.print=3272 |
790 | 790 | ||
791 | #ifdef HAVE_NETWORK | ||
792 | .TP | 791 | .TP |
793 | \fB\-\-dnstrace[=name|pid] | 792 | \fB\-\-dnstrace[=name|pid] |
794 | Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes | 793 | Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -828,7 +827,6 @@ $ sudo firejail --dnstrace | |||
828 | .br | 827 | .br |
829 | 11:32:08 9.9.9.9 www.youtube.com (type 1) | 828 | 11:32:08 9.9.9.9 www.youtube.com (type 1) |
830 | .br | 829 | .br |
831 | #endif | ||
832 | 830 | ||
833 | .TP | 831 | .TP |
834 | \fB\-\-env=name=value | 832 | \fB\-\-env=name=value |
@@ -930,7 +928,6 @@ $ firejail --ignore=seccomp --ignore=caps firefox | |||
930 | $ firejail \-\-ignore="net eth0" firefox | 928 | $ firejail \-\-ignore="net eth0" firefox |
931 | #endif | 929 | #endif |
932 | 930 | ||
933 | #ifdef HAVE_NETWORK | ||
934 | .TP | 931 | .TP |
935 | \fB\-\-icmptrace[=name|pid] | 932 | \fB\-\-icmptrace[=name|pid] |
936 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | 933 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -956,7 +953,6 @@ $ sudo firejail --icmptrace | |||
956 | .br | 953 | .br |
957 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable | 954 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable |
958 | .br | 955 | .br |
959 | #endif | ||
960 | 956 | ||
961 | .TP | 957 | .TP |
962 | \fB\-\-\include=file.profile | 958 | \fB\-\-\include=file.profile |
@@ -1643,6 +1639,7 @@ PID User RX(KB/s) TX(KB/s) Command | |||
1643 | 1294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox | 1639 | 1294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox |
1644 | .br | 1640 | .br |
1645 | 7383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission | 1641 | 7383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission |
1642 | #endif | ||
1646 | .TP | 1643 | .TP |
1647 | \fB\-\-nettrace[=name|pid] | 1644 | \fB\-\-nettrace[=name|pid] |
1648 | Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | 1645 | Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -1658,17 +1655,15 @@ Example: | |||
1658 | .br | 1655 | .br |
1659 | $ sudo firejail --nettrace | 1656 | $ sudo firejail --nettrace |
1660 | .br | 1657 | .br |
1661 | 95 KB/s geoip 457, IP database 4436 | 1658 | 93 KB/s address:port (protocol) network |
1662 | .br | 1659 | .br |
1663 | 52 KB/s *********** 64.222.84.207:443 United States | 1660 | 14 B/s ** 104.24.8.4:443(QUIC) Cloudflare |
1664 | .br | 1661 | .br |
1665 | 33 KB/s ******* 89.147.74.105:63930 Hungary | 1662 | 80 KB/s ***************** 192.187.97.90:443(TLS) BitChute |
1666 | .br | 1663 | .br |
1667 | 0 B/s 45.90.28.0:443 NextDNS | 1664 | 1 B/s 149.56.228.45:443(DoH) Canada |
1668 | .br | 1665 | .br |
1669 | 0 B/s 94.70.122.176:52309(UDP) Greece | 1666 | (D)isplay, (S)ave, (C)lear, e(X)it |
1670 | .br | ||
1671 | 339 B/s 104.26.7.35:443 Cloudflare | ||
1672 | .br | 1667 | .br |
1673 | 1668 | ||
1674 | .br | 1669 | .br |
@@ -1677,7 +1672,6 @@ the country the traffic originates from is added to the trace. | |||
1677 | We also use the static IP map in /usr/lib/firejail/static-ip-map | 1672 | We also use the static IP map in /usr/lib/firejail/static-ip-map |
1678 | to print the domain names for some of the more common websites and cloud platforms. | 1673 | to print the domain names for some of the more common websites and cloud platforms. |
1679 | No external services are contacted for reverse IP lookup. | 1674 | No external services are contacted for reverse IP lookup. |
1680 | #endif | ||
1681 | .TP | 1675 | .TP |
1682 | \fB\-\-nice=value | 1676 | \fB\-\-nice=value |
1683 | Set nice value for all processes running inside the sandbox. | 1677 | Set nice value for all processes running inside the sandbox. |
@@ -2862,7 +2856,6 @@ $ firejail \-\-list | |||
2862 | .br | 2856 | .br |
2863 | $ firejail \-\-shutdown=3272 | 2857 | $ firejail \-\-shutdown=3272 |
2864 | 2858 | ||
2865 | #ifdef HAVE_NETWORK | ||
2866 | .TP | 2859 | .TP |
2867 | \fB\-\-snitrace[=name|pid] | 2860 | \fB\-\-snitrace[=name|pid] |
2868 | Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes | 2861 | Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -2904,7 +2897,6 @@ $ sudo firejail --snitrace | |||
2904 | .br | 2897 | .br |
2905 | 07:53:11 192.0.73.2 1.gravatar.com | 2898 | 07:53:11 192.0.73.2 1.gravatar.com |
2906 | .br | 2899 | .br |
2907 | #endif | ||
2908 | 2900 | ||
2909 | .TP | 2901 | .TP |
2910 | \fB\-\-tab | 2902 | \fB\-\-tab |