aboutsummaryrefslogtreecommitdiffstats
path: root/contrib
diff options
context:
space:
mode:
authorLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2023-01-23 17:35:51 -0300
committerLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2023-01-28 00:05:54 -0300
commitaad1351ab111372232cbdd249a12a194b9884f7b (patch)
tree478cc8771c175da9540069efa7f4f6c5130ed415 /contrib
parentbuild: auto-generate syntax lists (diff)
downloadfirejail-aad1351ab111372232cbdd249a12a194b9884f7b.tar.gz
firejail-aad1351ab111372232cbdd249a12a194b9884f7b.tar.zst
firejail-aad1351ab111372232cbdd249a12a194b9884f7b.zip
build: auto-generate syntax files
Changes: * Generate firejail.vim from firejail.vim.in * Generate firejail-profile.lang from firejail-profile.lang.in * Update the manual syntax file steps on the new command checklist on CONTRIBUTING.md to use `make syntax` instead Relates to #2679 #5502 #5577 #5612.
Diffstat (limited to 'contrib')
-rw-r--r--contrib/syntax/files/firejail-profile.lang.in (renamed from contrib/syntax/files/firejail-profile.lang)7
-rw-r--r--contrib/syntax/files/firejail.vim104
-rw-r--r--contrib/syntax/files/firejail.vim.in99
3 files changed, 103 insertions, 107 deletions
diff --git a/contrib/syntax/files/firejail-profile.lang b/contrib/syntax/files/firejail-profile.lang.in
index 61c37f98f..acd5c86ce 100644
--- a/contrib/syntax/files/firejail-profile.lang
+++ b/contrib/syntax/files/firejail-profile.lang.in
@@ -1,4 +1,5 @@
1<?xml version="1.0" encoding="UTF-8"?> 1<?xml version="1.0" encoding="UTF-8"?>
2<!-- @make_input@ -->
2<!-- vim: set ts=2 sts=2 sw=2 et: --> 3<!-- vim: set ts=2 sts=2 sw=2 et: -->
3<!-- 4<!--
4 https://gitlab.gnome.org/GNOME/gtksourceview/-/blob/master/docs/lang-tutorial.md 5 https://gitlab.gnome.org/GNOME/gtksourceview/-/blob/master/docs/lang-tutorial.md
@@ -20,15 +21,15 @@
20 21
21 <definitions> 22 <definitions>
22 <define-regex id="commands-with-arguments" extended="true"> 23 <define-regex id="commands-with-arguments" extended="true">
23 (apparmor|bind|blacklist-nolog|blacklist|caps.drop|caps.keep|cpu|dbus-system.broadcast|dbus-system.call|dbus-system.own|dbus-system.see|dbus-system.talk|dbus-system|dbus-user.broadcast|dbus-user.call|dbus-user.own|dbus-user.see|dbus-user.talk|dbus-user|defaultgw|dns|env|hostname|hosts-file|ignore|include|ip6|ip|iprange|join-or-start|keep-fd|mac|mkdir|mkfile|mtu|name|net|netfilter6|netfilter|netmask|netns|nice|noblacklist|noexec|nowhitelist|overlay-named|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|private|protocol|read-only|read-write|restrict-namespaces|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|rlimit|rmenv|seccomp-error-action|seccomp.32.drop|seccomp.32.keep|seccomp.32|seccomp.drop|seccomp.keep|seccomp|shell|timeout|tmpfs|veth-name|whitelist-ro|whitelist|x11|xephyr-screen) 24 (@FJ_PROFILE_COMMANDS_ARG1@)
24 </define-regex> 25 </define-regex>
25 26
26 <define-regex id="commands-without-arguments" extended="true"> 27 <define-regex id="commands-without-arguments" extended="true">
27 (allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-fd|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noprinters|noroot|nosound|notv|nou2f|novideo|overlay-tmpfs|overlay|private-cache|private-cwd|private-dev|private-lib|private-tmp|private|quiet|restrict-namespaces|seccomp.32|seccomp.block-secondary|seccomp|tab|tracelog|writable-etc|writable-run-user|writable-var-log|writable-var|x11) 28 (@FJ_PROFILE_COMMANDS_ARG0@)
28 </define-regex> 29 </define-regex>
29 30
30 <define-regex id="conditions" extended="true"> 31 <define-regex id="conditions" extended="true">
31 (ALLOW_TRAY|BROWSER_ALLOW_DRM|BROWSER_DISABLE_U2F|HAS_APPIMAGE|HAS_NET|HAS_NODBUS|HAS_NOSOUND|HAS_X11) 32 (@FJ_PROFILE_CONDITIONALS@)
32 </define-regex> 33 </define-regex>
33 34
34 <context id="conditional-line"> 35 <context id="conditional-line">
diff --git a/contrib/syntax/files/firejail.vim b/contrib/syntax/files/firejail.vim
deleted file mode 100644
index c844350d8..000000000
--- a/contrib/syntax/files/firejail.vim
+++ /dev/null
@@ -1,104 +0,0 @@
1" Vim syntax file
2" Language: Firejail security sandbox profile
3" URL: https://github.com/netblue30/firejail
4
5if exists("b:current_syntax")
6 finish
7endif
8
9
10syn iskeyword @,48-57,_,.,-
11
12
13syn keyword fjTodo TODO FIXME XXX NOTE contained
14syn match fjComment "#.*$" contains=fjTodo
15
16"TODO: highlight "dangerous" capabilities differently, as is done in apparmor.vim?
17syn keyword fjCapability audit_control audit_read audit_write block_suspend chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mac_admin mac_override mknod net_admin net_bind_service net_broadcast net_raw setgid setfcap setpcap setuid sys_admin sys_boot sys_chroot sys_module sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config syslog wake_alarm nextgroup=fjCapabilityList contained
18syn match fjCapabilityList /,/ nextgroup=fjCapability contained
19
20syn keyword fjNamespaces cgroup ipc net mnt pid time user uts nextgroup=fjNamespacesList contained
21syn match fjNamespacesList /,/ nextgroup=fjNamespaces contained
22
23syn keyword fjProtocol unix inet inet6 netlink packet nextgroup=fjProtocolList contained
24syn match fjProtocolList /,/ nextgroup=fjProtocol contained
25
26" Syscalls grabbed from: src/include/syscall*.h
27" Generate list with: sed -n 's/{\s\+"\([^"]\+\)",.*},/\1/p' src/include/syscall*.h | sort -u | tr '\n' ' '
28syn keyword fjSyscall _llseek _newselect _sysctl accept accept4 access acct add_key adjtimex afs_syscall alarm arch_prctl arm_fadvise64_64 arm_sync_file_range bdflush bind bpf break brk capget capset chdir chmod chown chown32 chroot clock_adjtime clock_adjtime64 clock_getres clock_getres_time64 clock_gettime clock_gettime64 clock_nanosleep clock_nanosleep_time64 clock_settime clock_settime64 clone clone3 close connect copy_file_range creat create_module delete_module dup dup2 dup3 epoll_create epoll_create1 epoll_ctl epoll_ctl_old epoll_pwait epoll_wait epoll_wait_old eventfd eventfd2 execve execveat exit exit_group faccessat faccessat2 fadvise64 fadvise64_64 fallocate fanotify_init fanotify_mark fchdir fchmod fchmodat fchown fchown32 fchownat fcntl fcntl64 fdatasync fgetxattr finit_module flistxattr flock fork fremovexattr fsconfig fsetxattr fsmount fsopen fspick fstat fstat64 fstatat64 fstatfs fstatfs64 fsync ftime ftruncate ftruncate64 futex futex_time64 futimesat getcpu getcwd getdents getdents64 getegid getegid32 geteuid geteuid32 getgid getgid32 getgroups getgroups32 getitimer get_kernel_syms get_mempolicy getpeername getpgid getpgrp getpid getpmsg getppid getpriority getrandom getresgid getresgid32 getresuid getresuid32 getrlimit get_robust_list getrusage getsid getsockname getsockopt get_thread_area gettid gettimeofday getuid getuid32 getxattr gtty idle init_module inotify_add_watch inotify_init inotify_init1 inotify_rm_watch io_cancel ioctl io_destroy io_getevents ioperm io_pgetevents io_pgetevents_time64 iopl ioprio_get ioprio_set io_setup io_submit io_uring_enter io_uring_register io_uring_setup ipc kcmp kexec_file_load kexec_load keyctl kill lchown lchown32 lgetxattr link linkat listen listxattr llistxattr lock lookup_dcookie lremovexattr lseek lsetxattr lstat lstat64 madvise mbind membarrier memfd_create migrate_pages mincore mkdir mkdirat mknod mknodat mlock mlock2 mlockall mmap mmap2 modify_ldt mount move_mount move_pages mprotect mpx mq_getsetattr mq_notify mq_open mq_timedreceive mq_timedreceive_time64 mq_timedsend mq_timedsend_time64 mq_unlink mremap msgctl msgget msgrcv msgsnd msync munlock munlockall munmap name_to_handle_at nanosleep newfstatat nfsservctl nice oldfstat oldlstat oldolduname oldstat olduname open openat open_by_handle_at open_tree pause pciconfig_iobase pciconfig_read pciconfig_write perf_event_open personality pidfd_open pidfd_send_signal pipe pipe2 pivot_root pkey_alloc pkey_free pkey_mprotect poll ppoll ppoll_time64 prctl pread64 preadv preadv2 prlimit64 process_vm_readv process_vm_writev prof profil pselect6 pselect6_time64 ptrace putpmsg pwrite64 pwritev pwritev2 query_module quotactl read readahead readdir readlink readlinkat readv reboot recv recvfrom recvmmsg recvmmsg_time64 recvmsg remap_file_pages removexattr rename renameat renameat2 request_key restart_syscall rmdir rseq rt_sigaction rt_sigpending rt_sigprocmask rt_sigqueueinfo rt_sigreturn rt_sigsuspend rt_sigtimedwait rt_sigtimedwait_time64 rt_tgsigqueueinfo sched_getaffinity sched_getattr sched_getparam sched_get_priority_max sched_get_priority_min sched_getscheduler sched_rr_get_interval sched_rr_get_interval_time64 sched_setaffinity sched_setattr sched_setparam sched_setscheduler sched_yield seccomp security select semctl semget semop semtimedop semtimedop_time64 send sendfile sendfile64 sendmmsg sendmsg sendto setdomainname setfsgid setfsgid32 setfsuid setfsuid32 setgid setgid32 setgroups setgroups32 sethostname setitimer set_mempolicy setns setpgid setpriority setregid setregid32 setresgid setresgid32 setresuid setresuid32 setreuid setreuid32 setrlimit set_robust_list setsid setsockopt set_thread_area set_tid_address settimeofday setuid setuid32 setxattr sgetmask shmat shmctl shmdt shmget shutdown sigaction sigaltstack signal signalfd signalfd4 sigpending sigprocmask sigreturn sigsuspend socket socketcall socketpair splice ssetmask stat stat64 statfs statfs64 statx stime stty swapoff swapon symlink symlinkat sync sync_file_range sync_file_range2 syncfs syscall sysfs sysinfo syslog tee tgkill time timer_create timer_delete timerfd_create timerfd_gettime timerfd_gettime64 timerfd_settime timerfd_settime64 timer_getoverrun timer_gettime timer_gettime64 timer_settime timer_settime64 times tkill truncate truncate64 tuxcall ugetrlimit ulimit umask umount umount2 uname unlink unlinkat unshare uselib userfaultfd ustat utime utimensat utimensat_time64 utimes vfork vhangup vm86 vm86old vmsplice vserver wait4 waitid waitpid write writev nextgroup=fjSyscallErrno contained
29" Syscall groups grabbed from: src/fseccomp/syscall.c
30" Generate list with: sed -En 's/.*"@([^",]+).*/\1/p' src/lib/syscall.c | sort -u | tr '\n' '|'
31syn match fjSyscall /\v\@(aio|basic-io|chown|clock|cpu-emulation|debug|default|default-keep|default-nodebuggers|file-system|io-event|ipc|keyring|memlock|module|mount|network-io|obsolete|privileged|process|raw-io|reboot|resources|setuid|signal|swap|sync|system-service|timer)>/ nextgroup=fjSyscallErrno contained
32syn match fjSyscall /\$[0-9]\+/ nextgroup=fjSyscallErrno contained
33" Errnos grabbed from: src/fseccomp/errno.c
34" Generate list with: sed -En 's/.*"(E[^"]+).*/\1/p' src/lib/errno.c | sort -u | tr '\n' '|'
35syn match fjSyscallErrno /\v(:(E2BIG|EACCES|EADDRINUSE|EADDRNOTAVAIL|EADV|EAFNOSUPPORT|EAGAIN|EALREADY|EBADE|EBADF|EBADFD|EBADMSG|EBADR|EBADRQC|EBADSLT|EBFONT|EBUSY|ECANCELED|ECHILD|ECHRNG|ECOMM|ECONNABORTED|ECONNREFUSED|ECONNRESET|EDEADLK|EDEADLOCK|EDESTADDRREQ|EDOM|EDOTDOT|EDQUOT|EEXIST|EFAULT|EFBIG|EHOSTDOWN|EHOSTUNREACH|EHWPOISON|EIDRM|EILSEQ|EINPROGRESS|EINTR|EINVAL|EIO|EISCONN|EISDIR|EISNAM|EKEYEXPIRED|EKEYREJECTED|EKEYREVOKED|EL2HLT|EL2NSYNC|EL3HLT|EL3RST|ELIBACC|ELIBBAD|ELIBEXEC|ELIBMAX|ELIBSCN|ELNRNG|ELOOP|EMEDIUMTYPE|EMFILE|EMLINK|EMSGSIZE|EMULTIHOP|ENAMETOOLONG|ENAVAIL|ENETDOWN|ENETRESET|ENETUNREACH|ENFILE|ENOANO|ENOATTR|ENOBUFS|ENOCSI|ENODATA|ENODEV|ENOENT|ENOEXEC|ENOKEY|ENOLCK|ENOLINK|ENOMEDIUM|ENOMEM|ENOMSG|ENONET|ENOPKG|ENOPROTOOPT|ENOSPC|ENOSR|ENOSTR|ENOSYS|ENOTBLK|ENOTCONN|ENOTDIR|ENOTEMPTY|ENOTNAM|ENOTRECOVERABLE|ENOTSOCK|ENOTSUP|ENOTTY|ENOTUNIQ|ENXIO|EOPNOTSUPP|EOVERFLOW|EOWNERDEAD|EPERM|EPFNOSUPPORT|EPIPE|EPROTO|EPROTONOSUPPORT|EPROTOTYPE|ERANGE|EREMCHG|EREMOTE|EREMOTEIO|ERESTART|ERFKILL|EROFS|ESHUTDOWN|ESOCKTNOSUPPORT|ESPIPE|ESRCH|ESRMNT|ESTALE|ESTRPIPE|ETIME|ETIMEDOUT|ETOOMANYREFS|ETXTBSY|EUCLEAN|EUNATCH|EUSERS|EWOULDBLOCK|EXDEV|EXFULL)>)?/ nextgroup=fjSyscallList contained
36syn match fjSyscallList /,/ nextgroup=fjSyscall contained
37
38syn keyword fjX11Sandbox none xephyr xorg xpra xvfb contained
39syn keyword fjSeccompAction kill log ERRNO contained
40
41syn match fjEnvVar "[A-Za-z0-9_]\+=" contained
42syn match fjRmenvVar "[A-Za-z0-9_]\+" contained
43
44syn keyword fjAll all contained
45syn keyword fjNone none contained
46syn keyword fjLo lo contained
47syn keyword fjFilter filter contained
48
49" Variable names grabbed from: src/firejail/macros.c
50" Generate list with: sed -En 's/.*\$\{([^}]+)\}.*/\1/p' src/firejail/macros.c | sort -u | tr '\n' '|'
51syn match fjVar /\v\$\{(CFG|DESKTOP|DOCUMENTS|DOWNLOADS|HOME|MUSIC|PATH|PICTURES|RUNUSER|VIDEOS)}/
52
53" Commands grabbed from: src/firejail/profile.c
54" Generate list with: { sed -En 's/.*strn?cmp\(ptr, "([^"]+) ".*/\1/p' src/firejail/profile.c; echo private-lib; } | grep -Ev '^(include|ignore|caps\.drop|caps\.keep|protocol|restrict-namespaces|seccomp|seccomp\.drop|seccomp\.keep|env|rmenv|net|ip)$' | sort -u | tr '\n' '|' # private-lib is special-cased in the code and doesn't match the regex; grep-ed patterns are handled later with 'syn match nextgroup=' directives (except for include which is special-cased as a fjCommandNoCond keyword)
55syn match fjCommand /\v(apparmor|bind|blacklist|blacklist-nolog|cpu|defaultgw|dns|hostname|hosts-file|ip6|iprange|join-or-start|mac|mkdir|mkfile|mtu|name|netfilter|netfilter6|netmask|nice|noblacklist|noexec|nowhitelist|overlay-named|private|private-bin|private-cwd|private-etc|private-home|private-lib|private-opt|private-srv|read-only|read-write|rlimit-as|rlimit-cpu|rlimit-fsize|rlimit-nofile|rlimit-nproc|rlimit-sigpending|timeout|tmpfs|veth-name|whitelist|xephyr-screen) / skipwhite contained
56" Generate list with: sed -En 's/.*strn?cmp\(ptr, "([^ "]*[^ ])".*/\1/p' src/firejail/profile.c | grep -Ev '^(include|rlimit|quiet)$' | sed 's/\./\\./' | sort -u | tr '\n' '|' # include/rlimit are false positives, quiet is special-cased below
57syn match fjCommand /\v(allow-debuggers|allusers|apparmor|caps|deterministic-exit-code|deterministic-shutdown|disable-mnt|ipc-namespace|keep-config-pulse|keep-dev-shm|keep-fd|keep-var-tmp|machine-id|memory-deny-write-execute|netfilter|no3d|noautopulse|nodbus|nodvd|nogroups|noinput|nonewprivs|noprinters|noroot|nosound|notv|nou2f|novideo|overlay|overlay-tmpfs|private|private-cache|private-cwd|private-dev|private-lib|private-tmp|seccomp|seccomp\.32|seccomp\.block-secondary|tracelog|writable-etc|writable-run-user|writable-var|writable-var-log|x11)$/ contained
58syn match fjCommand /ignore / nextgroup=fjCommand,fjCommandNoCond skipwhite contained
59syn match fjCommand /caps\.drop / nextgroup=fjCapability,fjAll skipwhite contained
60syn match fjCommand /caps\.keep / nextgroup=fjCapability skipwhite contained
61syn match fjCommand /protocol / nextgroup=fjProtocol skipwhite contained
62syn match fjCommand /restrict-namespaces / nextgroup=fjNamespaces skipwhite contained
63syn match fjCommand /\vseccomp(\.32)?(\.drop|\.keep)? / nextgroup=fjSyscall skipwhite contained
64syn match fjCommand /x11 / nextgroup=fjX11Sandbox skipwhite contained
65syn match fjCommand /env / nextgroup=fjEnvVar skipwhite contained
66syn match fjCommand /rmenv / nextgroup=fjRmenvVar skipwhite contained
67syn match fjCommand /shell / nextgroup=fjNone skipwhite contained
68syn match fjCommand /net / nextgroup=fjNone,fjLo skipwhite contained
69syn match fjCommand /ip / nextgroup=fjNone skipwhite contained
70syn match fjCommand /seccomp-error-action / nextgroup=fjSeccompAction skipwhite contained
71syn match fjCommand /\vdbus-(user|system) / nextgroup=fjFilter,fjNone skipwhite contained
72syn match fjCommand /\vdbus-(user|system)\.(broadcast|call|own|see|talk) / skipwhite contained
73" Commands that can't be inside a ?CONDITIONAL: statement
74syn match fjCommandNoCond /include / skipwhite contained
75syn match fjCommandNoCond /quiet$/ contained
76
77" Conditionals grabbed from: src/firejail/profile.c
78" Generate list with: awk -- 'BEGIN {process=0;} /^Cond conditionals\[\] = \{$/ {process=1;} /\t*\{"[^"]+".*/ { if (process) {print gensub(/^\t*\{"([^"]+)".*$/, "\\1", 1);} } /^\t\{ NULL, NULL \}$/ {process=0;}' src/firejail/profile.c | sort -u | tr '\n' '|'
79syn match fjConditional /\v\?(ALLOW_TRAY|BROWSER_ALLOW_DRM|BROWSER_DISABLE_U2F|HAS_APPIMAGE|HAS_NET|HAS_NODBUS|HAS_NOSOUND|HAS_X11) ?:/ nextgroup=fjCommand skipwhite contained
80
81" A line is either a command, a conditional or a comment
82syn match fjStatement /^/ nextgroup=fjCommand,fjCommandNoCond,fjConditional,fjComment
83
84hi def link fjTodo Todo
85hi def link fjComment Comment
86hi def link fjCommand Statement
87hi def link fjCommandNoCond Statement
88hi def link fjConditional Macro
89hi def link fjVar Identifier
90hi def link fjCapability Type
91hi def link fjProtocol Type
92hi def link fjSyscall Type
93hi def link fjSyscallErrno Constant
94hi def link fjX11Sandbox Type
95hi def link fjEnvVar Type
96hi def link fjRmenvVar Type
97hi def link fjAll Type
98hi def link fjNone Type
99hi def link fjLo Type
100hi def link fjFilter Type
101hi def link fjSeccompAction Type
102
103
104let b:current_syntax = "firejail"
diff --git a/contrib/syntax/files/firejail.vim.in b/contrib/syntax/files/firejail.vim.in
new file mode 100644
index 000000000..ec6b29e4f
--- /dev/null
+++ b/contrib/syntax/files/firejail.vim.in
@@ -0,0 +1,99 @@
1" @make_input@
2" Vim syntax file
3" Language: Firejail security sandbox profile
4" URL: https://github.com/netblue30/firejail
5
6if exists("b:current_syntax")
7 finish
8endif
9
10
11syn iskeyword @,48-57,_,.,-
12
13
14syn keyword fjTodo TODO FIXME XXX NOTE contained
15syn match fjComment "#.*$" contains=fjTodo
16
17"TODO: highlight "dangerous" capabilities differently, as is done in apparmor.vim?
18syn keyword fjCapability audit_control audit_read audit_write block_suspend chown dac_override dac_read_search fowner fsetid ipc_lock ipc_owner kill lease linux_immutable mac_admin mac_override mknod net_admin net_bind_service net_broadcast net_raw setgid setfcap setpcap setuid sys_admin sys_boot sys_chroot sys_module sys_nice sys_pacct sys_ptrace sys_rawio sys_resource sys_time sys_tty_config syslog wake_alarm nextgroup=fjCapabilityList contained
19syn match fjCapabilityList /,/ nextgroup=fjCapability contained
20
21syn keyword fjNamespaces cgroup ipc net mnt pid time user uts nextgroup=fjNamespacesList contained
22syn match fjNamespacesList /,/ nextgroup=fjNamespaces contained
23
24syn keyword fjProtocol unix inet inet6 netlink packet nextgroup=fjProtocolList contained
25syn match fjProtocolList /,/ nextgroup=fjProtocol contained
26
27" Syscalls (auto-generated)
28syn keyword fjSyscall @FJ_SYSCALLS@ nextgroup=fjSyscallErrno contained
29" Syscall groups (auto-generated)
30syn match fjSyscall /\v\@(@FJ_SYSCALL_GROUPS@)>/ nextgroup=fjSyscallErrno contained
31syn match fjSyscall /\$[0-9]\+/ nextgroup=fjSyscallErrno contained
32" Errnos (auto-generated)
33syn match fjSyscallErrno /\v(:(@FJ_SYSTEM_ERRNOS@)>)?/ nextgroup=fjSyscallList contained
34syn match fjSyscallList /,/ nextgroup=fjSyscall contained
35
36syn keyword fjX11Sandbox none xephyr xorg xpra xvfb contained
37syn keyword fjSeccompAction kill log ERRNO contained
38
39syn match fjEnvVar "[A-Za-z0-9_]\+=" contained
40syn match fjRmenvVar "[A-Za-z0-9_]\+" contained
41
42syn keyword fjAll all contained
43syn keyword fjNone none contained
44syn keyword fjLo lo contained
45syn keyword fjFilter filter contained
46
47" Variable names (auto-generated)
48syn match fjVar /\v\$\{(@FJ_PROFILE_MACROS@)}/
49
50" Profile commands with 1 argument (auto-generated)
51syn match fjCommand /\v(@FJ_PROFILE_COMMANDS_ARG1@) / skipwhite contained
52" Profile commands with 0 arguments (auto-generated)
53syn match fjCommand /\v(@FJ_PROFILE_COMMANDS_ARG0@)$/ contained
54syn match fjCommand /ignore / nextgroup=fjCommand,fjCommandNoCond skipwhite contained
55syn match fjCommand /caps\.drop / nextgroup=fjCapability,fjAll skipwhite contained
56syn match fjCommand /caps\.keep / nextgroup=fjCapability skipwhite contained
57syn match fjCommand /protocol / nextgroup=fjProtocol skipwhite contained
58syn match fjCommand /restrict-namespaces / nextgroup=fjNamespaces skipwhite contained
59syn match fjCommand /\vseccomp(\.32)?(\.drop|\.keep)? / nextgroup=fjSyscall skipwhite contained
60syn match fjCommand /x11 / nextgroup=fjX11Sandbox skipwhite contained
61syn match fjCommand /env / nextgroup=fjEnvVar skipwhite contained
62syn match fjCommand /rmenv / nextgroup=fjRmenvVar skipwhite contained
63syn match fjCommand /shell / nextgroup=fjNone skipwhite contained
64syn match fjCommand /net / nextgroup=fjNone,fjLo skipwhite contained
65syn match fjCommand /ip / nextgroup=fjNone skipwhite contained
66syn match fjCommand /seccomp-error-action / nextgroup=fjSeccompAction skipwhite contained
67syn match fjCommand /\vdbus-(user|system) / nextgroup=fjFilter,fjNone skipwhite contained
68syn match fjCommand /\vdbus-(user|system)\.(broadcast|call|own|see|talk) / skipwhite contained
69" Commands that can't be inside a ?CONDITIONAL: statement
70syn match fjCommandNoCond /include / skipwhite contained
71syn match fjCommandNoCond /quiet$/ contained
72
73" Conditionals (auto-generated)
74syn match fjConditional /\v\?(@FJ_PROFILE_CONDITIONALS@) ?:/ nextgroup=fjCommand skipwhite contained
75
76" A line is either a command, a conditional or a comment
77syn match fjStatement /^/ nextgroup=fjCommand,fjCommandNoCond,fjConditional,fjComment
78
79hi def link fjTodo Todo
80hi def link fjComment Comment
81hi def link fjCommand Statement
82hi def link fjCommandNoCond Statement
83hi def link fjConditional Macro
84hi def link fjVar Identifier
85hi def link fjCapability Type
86hi def link fjProtocol Type
87hi def link fjSyscall Type
88hi def link fjSyscallErrno Constant
89hi def link fjX11Sandbox Type
90hi def link fjEnvVar Type
91hi def link fjRmenvVar Type
92hi def link fjAll Type
93hi def link fjNone Type
94hi def link fjLo Type
95hi def link fjFilter Type
96hi def link fjSeccompAction Type
97
98
99let b:current_syntax = "firejail"
generated by cgit v1.2.3-54-g00ecf (git 2.45.0) at 2024-05-05 12:55:04 +0000