Merge branch 'netblue30:master' into linuxqq

13 files changed, 154 insertions, 8 deletions

diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc
index 1ea77495b..7d7f84d4b 100644
--- a/etc/inc/disable-programs.inc
+++ b/etc/inc/disable-programs.inc
@@ -116,6 +116,7 @@ blacklist ${HOME}/.cache/fossamail
 blacklist ${HOME}/.cache/fractal
 blacklist ${HOME}/.cache/freecol
 blacklist ${HOME}/.cache/gajim
+blacklist ${HOME}/.cache/gdfuse
 blacklist ${HOME}/.cache/geary
 blacklist ${HOME}/.cache/geeqie
 blacklist ${HOME}/.cache/gegl-0.4
@@ -437,6 +438,7 @@ blacklist ${HOME}/.config/gajim
 blacklist ${HOME}/.config/galculator
 blacklist ${HOME}/.config/gallery-dl
 blacklist ${HOME}/.config/gconf
+blacklist ${HOME}/.config/gdfuse
 blacklist ${HOME}/.config/geany
 blacklist ${HOME}/.config/geary
 blacklist ${HOME}/.config/gedit
@@ -709,6 +711,7 @@ blacklist ${HOME}/.frozen-bubble
 blacklist ${HOME}/.funnyboat
 blacklist ${HOME}/.g8
 blacklist ${HOME}/.gallery-dl.conf
+blacklist ${HOME}/.gdfuse
 blacklist ${HOME}/.geekbench5
 blacklist ${HOME}/.gimp*
 blacklist ${HOME}/.gist
@@ -877,6 +880,7 @@ blacklist ${HOME}/.local/share/caja-python
 blacklist ${HOME}/.local/share/calligragemini
 blacklist ${HOME}/.local/share/cantata
 blacklist ${HOME}/.local/share/cdprojektred
+blacklist ${HOME}/.local/share/chatterino
 blacklist ${HOME}/.local/share/clipit
 blacklist ${HOME}/.local/share/com.github.johnfactotum.Foliate
 blacklist ${HOME}/.local/share/contacts
@@ -898,6 +902,7 @@ blacklist ${HOME}/.local/share/feral-interactive
 blacklist ${HOME}/.local/share/five-or-more
 blacklist ${HOME}/.local/share/freecol
 blacklist ${HOME}/.local/share/gajim
+blacklist ${HOME}/.local/share/gdfuse
 blacklist ${HOME}/.local/share/geary
 blacklist ${HOME}/.local/share/geeqie
 blacklist ${HOME}/.local/share/ghostwriter
diff --git a/etc/profile-a-l/chatterino.profile b/etc/profile-a-l/chatterino.profile
new file mode 100644
index 000000000..4dfd85740
--- /dev/null
+++ b/etc/profile-a-l/chatterino.profile
@@ -0,0 +1,92 @@
+# Firejail profile for Chatterino
+# Description: Chat client for https://twitch.tv
+# This file is overwritten after every install/update
+# Persistent local customizations
+include chatterino.local
+# Persistent global definitions
+include globals.local
+
+# To upload images, whitelist/noblacklist their path in chatterino.local.
+#whitelist ${PICTURES}
+# For custom notification sounds, whitelist/noblacklist their path in chatterino.local.
+#whitelist ${MUSIC}
+
+# Also allow access to mpv/vlc, they're usable via streamlink.
+noblacklist ${HOME}/.config/mpv
+noblacklist ${HOME}/.config/pulse
+noblacklist ${HOME}/.config/vlc
+noblacklist ${HOME}/.local/share/chatterino
+noblacklist ${HOME}/.local/share/vlc
+
+# Allow Lua for mpv (blacklisted by disable-interpreters.inc)
+include allow-lua.inc
+
+# Allow Python for Streamlink integration (blacklisted by disable-interpreters.inc)
+include allow-python3.inc
+
+include disable-common.inc
+include disable-devel.inc
+include disable-exec.inc
+include disable-interpreters.inc
+include disable-proc.inc
+include disable-programs.inc
+include disable-xdg.inc
+
+# Also allow read-only access to mpv/VLC, they're usable via streamlink.
+mkdir ${HOME}/.local/share/chatterino
+# VLC preferences will fail to save with read-only set.
+whitelist ${HOME}/.local/share/chatterino
+whitelist-ro ${HOME}/.config/mpv
+whitelist-ro ${HOME}/.config/pulse
+whitelist-ro ${HOME}/.config/vlc
+whitelist-ro ${HOME}/.local/share/vlc
+include whitelist-common.inc
+include whitelist-run-common.inc
+include whitelist-runuser-common.inc
+include whitelist-usr-share-common.inc
+include whitelist-var-common.inc
+
+# Streamlink+VLC doesn't seem to close properly with apparmor enabled.
+#apparmor
+caps.drop all
+netfilter
+nodvd
+nogroups
+nonewprivs
+noprinters
+noroot
+notv
+nou2f
+# Netlink is required for streamlink integration.
+protocol unix,inet,inet6,netlink
+# Seccomp may break browser integration.
+seccomp
+seccomp.block-secondary
+tracelog
+
+disable-mnt
+# Add more private-bin lines for browsers or video players to chatterino.local if wanted.
+private-bin chatterino,cvlc,env,ffmpeg,mpv,nvlc,pgrep,python*,qvlc,rvlc,streamlink,svlc,vlc
+# private-cache may cause issues with mpv (see #2838)
+private-cache
+private-dev
+private-etc alsa,alternatives,asound.conf,ca-certificates,dbus-1,fonts,hostname,hosts,kde4rc,kde5rc,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,nvidia,passwd,pulse,resolv.conf,rpc,services,ssl,Trolltech.conf,X11
+private-srv none
+private-tmp
+
+dbus-user filter
+dbus-user.own com.chatterino.*
+# Allow notifications.
+dbus-user.talk org.freedesktop.Notifications
+# For media player integration.
+dbus-user.talk org.freedesktop.ScreenSaver
+?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher
+dbus-user.own org.mpris.MediaPlayer2.chatterino
+dbus-user.talk org.mpris.MediaPlayer2.Player
+dbus-system none
+
+# Prevents browsers/players from lingering after Chatterino is closed.
+#deterministic-shutdown
+# memory-deny-write-execute may break streamlink and browser integration.
+#memory-deny-write-execute
+restrict-namespaces
diff --git a/etc/profile-a-l/claws-mail.profile b/etc/profile-a-l/claws-mail.profile
index 691657fa0..ce7b30122 100644
--- a/etc/profile-a-l/claws-mail.profile
+++ b/etc/profile-a-l/claws-mail.profile
@@ -1,5 +1,5 @@
 # Firejail profile for claws-mail
-# Description: Fast, lightweight and user-friendly GTK+2 based email client
+# Description: Fast, lightweight and user-friendly GTK based email client
 # This file is overwritten after every install/update
 # Persistent local customizations
 include claws-mail.local
@@ -22,9 +22,15 @@ whitelist /usr/share/doc/claws-mail
 
 dbus-user filter
 dbus-user.talk ca.desrt.dconf
-dbus-user.talk org.gnome.keyring.SystemPrompter
 # Add the next line to your claws-mail.local if you use the notification plugin.
 # dbus-user.talk org.freedesktop.Notifications
+dbus-user.talk org.freedesktop.secrets
+dbus-user.talk org.gnome.keyring
+dbus-user.talk org.gnome.keyring.PrivatePrompter
+dbus-user.talk org.gnome.keyring.SystemPrompter
+dbus-user.talk org.gnome.seahorse
+dbus-user.talk org.gnome.seahorse.Application
+dbus-user.talk org.mozilla.*
 
 # Redirect
 include email-common.profile
diff --git a/etc/profile-a-l/electron-hardened.inc.profile b/etc/profile-a-l/electron-hardened.inc.profile
new file mode 100644
index 000000000..eacf5cebe
--- /dev/null
+++ b/etc/profile-a-l/electron-hardened.inc.profile
@@ -0,0 +1,10 @@
+# Firejail profile alias for chrome-common-hardened.inc
+# This file is overwritten after every install/update
+# Persistent local customizations
+include electron-hardened.inc.local
+# Persistent global definitions
+# added by caller profile
+#include globals.local
+
+# Redirect
+include chrome-common-hardened.inc.profile
diff --git a/etc/profile-a-l/electron.profile b/etc/profile-a-l/electron.profile
index c1d337abd..c15e43399 100644
--- a/etc/profile-a-l/electron.profile
+++ b/etc/profile-a-l/electron.profile
@@ -22,8 +22,8 @@ include whitelist-runuser-common.inc
 include whitelist-usr-share-common.inc
 include whitelist-var-common.inc
 
-# Add the next line to your chromium-common.local if your kernel allows unprivileged userns clone.
-#include chromium-common-hardened.inc.profile
+# Add the next line to your electron.local if your kernel allows unprivileged userns clone.
+#include electron-hardened.inc.profile
 
 apparmor
 caps.keep sys_admin,sys_chroot
diff --git a/etc/profile-a-l/firefox-common.profile b/etc/profile-a-l/firefox-common.profile
index 13313cb67..60d64736e 100644
--- a/etc/profile-a-l/firefox-common.profile
+++ b/etc/profile-a-l/firefox-common.profile
@@ -35,6 +35,8 @@ include whitelist-runuser-common.inc
 include whitelist-var-common.inc
 
 apparmor
+# Fixme!
+apparmor-replace
 caps.drop all
 # machine-id breaks pulse audio; add it to your firefox-common.local if sound is not required.
 #machine-id
diff --git a/etc/profile-m-z/sylpheed.profile b/etc/profile-m-z/sylpheed.profile
index 328812b04..483ff39a8 100644
--- a/etc/profile-m-z/sylpheed.profile
+++ b/etc/profile-m-z/sylpheed.profile
@@ -17,10 +17,11 @@ whitelist /usr/share/sylpheed
 
 dbus-user filter
 dbus-user.talk ca.desrt.dconf
-dbus-user.talk org.freedesktop.secrets
-dbus-user.talk org.gnome.keyring.SystemPrompter
 # Add the next line to your sylpheed.local to enable notifications.
 # dbus-user.talk org.freedesktop.Notifications
+dbus-user.talk org.freedesktop.secrets
+dbus-user.talk org.gnome.keyring.SystemPrompter
+dbus-user.talk org.mozilla.*
 
 # Redirect
 include email-common.profile
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile
index 59b6e2543..aa466871c 100644
--- a/etc/profile-m-z/ytmdesktop.profile
+++ b/etc/profile-m-z/ytmdesktop.profile
@@ -1,5 +1,5 @@
 # Firejail profile for ytmdesktop
-# Description: Unofficial electron based desktop warpper for YouTube Music
+# Description: Unofficial electron based desktop wrapper for YouTube Music
 # This file is overwritten after every install/update
 # Persistent local customizations
 include youtube.local
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 788c150be..793ec9a52 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -130,6 +130,7 @@ catfish
 cawbird
 celluloid
 chafa
+chatterino
 checkbashisms
 cheese
 cherrytree
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 776649131..4fe3a5974 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -339,6 +339,7 @@ extern int arg_writable_var_log; // writable /var/log
 extern int arg_appimage;        // appimage
 extern int arg_apparmor;        // apparmor
 extern char *apparmor_profile;  // apparmor profile
+extern bool apparmor_replace; // whether apparmor should replace the profile (legacy behavior)
 extern int arg_allow_debuggers; // allow debuggers
 extern int arg_x11_block;       // block X11
 extern int arg_x11_xorg;        // use X11 security extension
diff --git a/src/firejail/main.c b/src/firejail/main.c
index c95964503..18e9ae651 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -134,6 +134,7 @@ int arg_writable_var_log = 0;		// writable /var/log
 int arg_appimage = 0;                           // appimage
 int arg_apparmor = 0;                           // apparmor
 char *apparmor_profile = NULL;  // apparmor profile
+bool apparmor_replace = false;  // apparmor profile
 int arg_allow_debuggers = 0;                    // allow debuggers
 int arg_x11_block = 0;                          // block X11
 int arg_x11_xorg = 0;                           // use X11 security extension
@@ -1383,6 +1384,10 @@ int main(int argc, char **argv, char **envp) {
                         arg_apparmor = 1;
                         apparmor_profile = argv[i] + 11;
                 }
+                else if (strncmp(argv[i], "--apparmor-replace", 18) == 0) {
+                        arg_apparmor = 1;
+                        apparmor_replace = true;
+                }
 #endif
                 else if (strncmp(argv[i], "--protocol=", 11) == 0) {
                         if (checkcfg(CFG_SECCOMP)) {
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index 4e6ebdbca..acf206da6 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -966,6 +966,22 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
                 return 0;
         }
 
+        if (strcmp(ptr, "apparmor-replace") == 0) {
+#ifdef HAVE_APPARMOR
+                arg_apparmor = 1;
+                apparmor_replace = true;
+#endif
+                return 0;
+        }
+
+        if (strcmp(ptr, "apparmor-stack") == 0) {
+#ifdef HAVE_APPARMOR
+                arg_apparmor = 1;
+                apparmor_replace = false;
+#endif
+                return 0;
+        }
+
         if (strncmp(ptr, "protocol ", 9) == 0) {
                 if (checkcfg(CFG_SECCOMP)) {
                         const char *add = ptr + 9;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index bae189a0d..77fe73174 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -130,7 +130,14 @@ static void set_caps(void) {
 static void set_apparmor(void) {
         EUID_ASSERT();
         if (checkcfg(CFG_APPARMOR) && arg_apparmor) {
-                if (aa_stack_onexec(apparmor_profile)) {
+                int res = 0;
+                if(apparmor_replace){
+                        fwarning("Replacing profile instead of stacking it. It is a legacy behavior that can result in relaxation of the protection. It is here as a temporary measure to unbreak the software that has been broken by switching to the stacking behavior.\n");
+                        res = aa_change_onexec(apparmor_profile);
+                } else {
+                        res = aa_stack_onexec(apparmor_profile);
+                }
+                if (res) {
                         fwarning("Cannot confine the application using AppArmor.\n"
                                 "Maybe firejail-default AppArmor profile is not loaded into the kernel.\n"
                                 "As root, run \"aa-enforce firejail-default\" to load it.\n");