aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc/disable-common.inc
diff options
context:
space:
mode:
authorLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2021-07-18 20:39:14 -0300
committerLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2021-07-18 20:39:14 -0300
commitf43382f1e9707b4fd5e63c7bfe881912aa4ee994 (patch)
tree499639bb962c8b071b153dcdad1b42af8286521d /etc/inc/disable-common.inc
parentAdd MS Edge Beta profile (diff)
downloadfirejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.tar.gz
firejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.tar.zst
firejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.zip
Revert "move whitelist/blacklist to allow/deny"
This reverts commit fe0f975f447d59977d90c3226cc8c623b31b20b3. Note: This only reverts the changes from etc. The 4 aliases introduced on commit 45f2ba544 are mere, well, aliases. That is, they fail to address the different usability problems discussed on [#3447][3447] and in fact only make things more confusing (as has already been mentioned on [this][4379] and later comments). The main reason is that the aliases do not meaningfully map to the original commands. For example, the commands from each pair below seem like they would do the exact same thing: * `allow` and `nodeny` * `deny` and `noallow` Additionally, if these aliases are not the final commands, but only a test/work-in-progress, then keeping the wide-scale search/replace changes made on commit fe0f975f4 would only serve to cause confusion, as users of firejail-git, contributors and downstream projects might start changing the commands used on their profiles, only to later have to change them again, potentially to completely different commands. The sooner this is undone the better, as (besides the above reasons) the more profile changes there are between the original commit and the revert, the harder it is to e.g.: `git diff` versions of files across the following revision ranges: before the commit, after the commit but before the revert and after the revert. Note: This is still the case even if a commit is [ignored by `git blame`][4390]. So let us revert fe0f975f4 and only reapply similar large-scale changes once we have discussed and settled on better commands. How the revert was applied: Despite using the auto-generated message from `git revert`, to ensure correctness and to avoid conflicts the changes were reverted in different steps: Firstly, revert the files which can be safely reverted directly ("filestorevert"): # Find out which files have been changed on fe0f975f44, but have not # been changed afterwards and list them on "filestorevert" git show --pretty='' --name-only fe0f975f44 -- etc | LC_ALL=C sort >allfiles git diff --name-only fe0f975f44..master -- etc | LC_ALL=C sort >filestoignore comm -2 -3 allfiles filestoignore >filestorevert # Note: There are 3 extra files on filestoignore because they were # added after commit fe0f975f44 wc -l allfiles filestoignore filestorevert | head -n 3 # 797 allfiles # 8 filestoignore # 792 filestorevert # Automatically revert files in "filestorevert" # See https://stackoverflow.com/a/23401018/10095231 tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975f44 -- | git apply --reverse printf 'Total files reverted:\n' git diff --name-only | wc -l # 792 Secondly, do some search/replace on the rest: tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \ -e 's/allow /whitelist /' -e 's/noallow /nowhitelist /' \ -e 's/deny /blacklist /' -e 's/nodeny /noblacklist /' \ -e 's/deny-nolog /blacklist-nolog /' find etc -name '*.bak' -print0 | xargs -0 rm Thirdly, verify the result. The following command shows the difference between all the changes in etc from before fe0f975f44 and this commit (inclusive): git diff fe0f975f44~1 -- etc From the output, it looks like all alias changes are fully reverted and that the other changes to etc (from after fe0f975f44) remain, so the revert seems to be done correctly. [3447]: https://github.com/netblue30/firejail/issues/3447 [4379]: https://github.com/netblue30/firejail/issues/4379#issuecomment-876460222 [4390]: https://github.com/netblue30/firejail/issues/4390
Diffstat (limited to 'etc/inc/disable-common.inc')
-rw-r--r--etc/inc/disable-common.inc710
1 files changed, 355 insertions, 355 deletions
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index 1283a3a3d..6df0c4990 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -5,63 +5,63 @@ include disable-common.local
5# The following block breaks trash functionality in file managers 5# The following block breaks trash functionality in file managers
6#read-only ${HOME}/.local 6#read-only ${HOME}/.local
7#read-write ${HOME}/.local/share 7#read-write ${HOME}/.local/share
8deny ${HOME}/.local/share/Trash 8blacklist ${HOME}/.local/share/Trash
9 9
10# History files in $HOME and clipboard managers 10# History files in $HOME and clipboard managers
11deny-nolog ${HOME}/.*_history 11blacklist-nolog ${HOME}/.*_history
12deny-nolog ${HOME}/.adobe 12blacklist-nolog ${HOME}/.adobe
13deny-nolog ${HOME}/.cache/greenclip* 13blacklist-nolog ${HOME}/.cache/greenclip*
14deny-nolog ${HOME}/.histfile 14blacklist-nolog ${HOME}/.histfile
15deny-nolog ${HOME}/.history 15blacklist-nolog ${HOME}/.history
16deny-nolog ${HOME}/.kde/share/apps/klipper 16blacklist-nolog ${HOME}/.kde/share/apps/klipper
17deny-nolog ${HOME}/.kde4/share/apps/klipper 17blacklist-nolog ${HOME}/.kde4/share/apps/klipper
18deny-nolog ${HOME}/.local/share/fish/fish_history 18blacklist-nolog ${HOME}/.local/share/fish/fish_history
19deny-nolog ${HOME}/.local/share/klipper 19blacklist-nolog ${HOME}/.local/share/klipper
20deny-nolog ${HOME}/.macromedia 20blacklist-nolog ${HOME}/.macromedia
21deny-nolog ${HOME}/.mupdf.history 21blacklist-nolog ${HOME}/.mupdf.history
22deny-nolog ${HOME}/.python-history 22blacklist-nolog ${HOME}/.python-history
23deny-nolog ${HOME}/.python_history 23blacklist-nolog ${HOME}/.python_history
24deny-nolog ${HOME}/.pythonhist 24blacklist-nolog ${HOME}/.pythonhist
25deny-nolog ${HOME}/.lesshst 25blacklist-nolog ${HOME}/.lesshst
26deny-nolog ${HOME}/.viminfo 26blacklist-nolog ${HOME}/.viminfo
27deny-nolog /tmp/clipmenu* 27blacklist-nolog /tmp/clipmenu*
28 28
29# X11 session autostart 29# X11 session autostart
30# blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs 30# blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs
31deny ${HOME}/.Xsession 31blacklist ${HOME}/.Xsession
32deny ${HOME}/.blackbox 32blacklist ${HOME}/.blackbox
33deny ${HOME}/.config/autostart 33blacklist ${HOME}/.config/autostart
34deny ${HOME}/.config/autostart-scripts 34blacklist ${HOME}/.config/autostart-scripts
35deny ${HOME}/.config/awesome 35blacklist ${HOME}/.config/awesome
36deny ${HOME}/.config/i3 36blacklist ${HOME}/.config/i3
37deny ${HOME}/.config/sway 37blacklist ${HOME}/.config/sway
38deny ${HOME}/.config/lxsession/LXDE/autostart 38blacklist ${HOME}/.config/lxsession/LXDE/autostart
39deny ${HOME}/.config/openbox 39blacklist ${HOME}/.config/openbox
40deny ${HOME}/.config/plasma-workspace 40blacklist ${HOME}/.config/plasma-workspace
41deny ${HOME}/.config/startupconfig 41blacklist ${HOME}/.config/startupconfig
42deny ${HOME}/.config/startupconfigkeys 42blacklist ${HOME}/.config/startupconfigkeys
43deny ${HOME}/.fluxbox 43blacklist ${HOME}/.fluxbox
44deny ${HOME}/.gnomerc 44blacklist ${HOME}/.gnomerc
45deny ${HOME}/.kde/Autostart 45blacklist ${HOME}/.kde/Autostart
46deny ${HOME}/.kde/env 46blacklist ${HOME}/.kde/env
47deny ${HOME}/.kde/share/autostart 47blacklist ${HOME}/.kde/share/autostart
48deny ${HOME}/.kde/share/config/startupconfig 48blacklist ${HOME}/.kde/share/config/startupconfig
49deny ${HOME}/.kde/share/config/startupconfigkeys 49blacklist ${HOME}/.kde/share/config/startupconfigkeys
50deny ${HOME}/.kde/shutdown 50blacklist ${HOME}/.kde/shutdown
51deny ${HOME}/.kde4/env 51blacklist ${HOME}/.kde4/env
52deny ${HOME}/.kde4/Autostart 52blacklist ${HOME}/.kde4/Autostart
53deny ${HOME}/.kde4/share/autostart 53blacklist ${HOME}/.kde4/share/autostart
54deny ${HOME}/.kde4/shutdown 54blacklist ${HOME}/.kde4/shutdown
55deny ${HOME}/.kde4/share/config/startupconfig 55blacklist ${HOME}/.kde4/share/config/startupconfig
56deny ${HOME}/.kde4/share/config/startupconfigkeys 56blacklist ${HOME}/.kde4/share/config/startupconfigkeys
57deny ${HOME}/.local/share/autostart 57blacklist ${HOME}/.local/share/autostart
58deny ${HOME}/.xinitrc 58blacklist ${HOME}/.xinitrc
59deny ${HOME}/.xprofile 59blacklist ${HOME}/.xprofile
60deny ${HOME}/.xserverrc 60blacklist ${HOME}/.xserverrc
61deny ${HOME}/.xsession 61blacklist ${HOME}/.xsession
62deny ${HOME}/.xsessionrc 62blacklist ${HOME}/.xsessionrc
63deny /etc/X11/Xsession.d 63blacklist /etc/X11/Xsession.d
64deny /etc/xdg/autostart 64blacklist /etc/xdg/autostart
65read-only ${HOME}/.Xauthority 65read-only ${HOME}/.Xauthority
66 66
67# Session manager 67# Session manager
@@ -70,46 +70,46 @@ read-only ${HOME}/.Xauthority
70#?HAS_X11: blacklist /tmp/.ICE-unix 70#?HAS_X11: blacklist /tmp/.ICE-unix
71 71
72# KDE config 72# KDE config
73deny ${HOME}/.cache/konsole 73blacklist ${HOME}/.cache/konsole
74deny ${HOME}/.config/khotkeysrc 74blacklist ${HOME}/.config/khotkeysrc
75deny ${HOME}/.config/krunnerrc 75blacklist ${HOME}/.config/krunnerrc
76deny ${HOME}/.config/kscreenlockerrc 76blacklist ${HOME}/.config/kscreenlockerrc
77deny ${HOME}/.config/ksslcertificatemanager 77blacklist ${HOME}/.config/ksslcertificatemanager
78deny ${HOME}/.config/kwalletrc 78blacklist ${HOME}/.config/kwalletrc
79deny ${HOME}/.config/kwinrc 79blacklist ${HOME}/.config/kwinrc
80deny ${HOME}/.config/kwinrulesrc 80blacklist ${HOME}/.config/kwinrulesrc
81deny ${HOME}/.config/plasma-locale-settings.sh 81blacklist ${HOME}/.config/plasma-locale-settings.sh
82deny ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc 82blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc
83deny ${HOME}/.config/plasmashellrc 83blacklist ${HOME}/.config/plasmashellrc
84deny ${HOME}/.config/plasmavaultrc 84blacklist ${HOME}/.config/plasmavaultrc
85deny ${HOME}/.kde/share/apps/kwin 85blacklist ${HOME}/.kde/share/apps/kwin
86deny ${HOME}/.kde/share/apps/plasma 86blacklist ${HOME}/.kde/share/apps/plasma
87deny ${HOME}/.kde/share/apps/solid 87blacklist ${HOME}/.kde/share/apps/solid
88deny ${HOME}/.kde/share/config/khotkeysrc 88blacklist ${HOME}/.kde/share/config/khotkeysrc
89deny ${HOME}/.kde/share/config/krunnerrc 89blacklist ${HOME}/.kde/share/config/krunnerrc
90deny ${HOME}/.kde/share/config/kscreensaverrc 90blacklist ${HOME}/.kde/share/config/kscreensaverrc
91deny ${HOME}/.kde/share/config/ksslcertificatemanager 91blacklist ${HOME}/.kde/share/config/ksslcertificatemanager
92deny ${HOME}/.kde/share/config/kwalletrc 92blacklist ${HOME}/.kde/share/config/kwalletrc
93deny ${HOME}/.kde/share/config/kwinrc 93blacklist ${HOME}/.kde/share/config/kwinrc
94deny ${HOME}/.kde/share/config/kwinrulesrc 94blacklist ${HOME}/.kde/share/config/kwinrulesrc
95deny ${HOME}/.kde/share/config/plasma-desktop-appletsrc 95blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc
96deny ${HOME}/.kde4/share/apps/kwin 96blacklist ${HOME}/.kde4/share/apps/kwin
97deny ${HOME}/.kde4/share/apps/plasma 97blacklist ${HOME}/.kde4/share/apps/plasma
98deny ${HOME}/.kde4/share/apps/solid 98blacklist ${HOME}/.kde4/share/apps/solid
99deny ${HOME}/.kde4/share/config/khotkeysrc 99blacklist ${HOME}/.kde4/share/config/khotkeysrc
100deny ${HOME}/.kde4/share/config/krunnerrc 100blacklist ${HOME}/.kde4/share/config/krunnerrc
101deny ${HOME}/.kde4/share/config/kscreensaverrc 101blacklist ${HOME}/.kde4/share/config/kscreensaverrc
102deny ${HOME}/.kde4/share/config/ksslcertificatemanager 102blacklist ${HOME}/.kde4/share/config/ksslcertificatemanager
103deny ${HOME}/.kde4/share/config/kwalletrc 103blacklist ${HOME}/.kde4/share/config/kwalletrc
104deny ${HOME}/.kde4/share/config/kwinrc 104blacklist ${HOME}/.kde4/share/config/kwinrc
105deny ${HOME}/.kde4/share/config/kwinrulesrc 105blacklist ${HOME}/.kde4/share/config/kwinrulesrc
106deny ${HOME}/.kde4/share/config/plasma-desktop-appletsrc 106blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc
107deny ${HOME}/.local/share/kglobalaccel 107blacklist ${HOME}/.local/share/kglobalaccel
108deny ${HOME}/.local/share/kwin 108blacklist ${HOME}/.local/share/kwin
109deny ${HOME}/.local/share/plasma 109blacklist ${HOME}/.local/share/plasma
110deny ${HOME}/.local/share/plasmashell 110blacklist ${HOME}/.local/share/plasmashell
111deny ${HOME}/.local/share/solid 111blacklist ${HOME}/.local/share/solid
112deny /tmp/konsole-*.history 112blacklist /tmp/konsole-*.history
113read-only ${HOME}/.cache/ksycoca5_* 113read-only ${HOME}/.cache/ksycoca5_*
114read-only ${HOME}/.config/*notifyrc 114read-only ${HOME}/.config/*notifyrc
115read-only ${HOME}/.config/kdeglobals 115read-only ${HOME}/.config/kdeglobals
@@ -138,139 +138,139 @@ read-only ${HOME}/.local/share/kservices5
138read-only ${HOME}/.local/share/kssl 138read-only ${HOME}/.local/share/kssl
139 139
140# KDE sockets 140# KDE sockets
141deny ${RUNUSER}/*.slave-socket 141blacklist ${RUNUSER}/*.slave-socket
142deny ${RUNUSER}/kdeinit5__* 142blacklist ${RUNUSER}/kdeinit5__*
143deny ${RUNUSER}/kdesud_* 143blacklist ${RUNUSER}/kdesud_*
144# see #3358 144# see #3358
145#?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-* 145#?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-*
146#?HAS_NODBUS: blacklist /tmp/ksocket-* 146#?HAS_NODBUS: blacklist /tmp/ksocket-*
147 147
148# gnome 148# gnome
149# contains extensions, last used times of applications, and notifications 149# contains extensions, last used times of applications, and notifications
150deny ${HOME}/.local/share/gnome-shell 150blacklist ${HOME}/.local/share/gnome-shell
151# contains recently used files and serials of static/removable storage 151# contains recently used files and serials of static/removable storage
152deny ${HOME}/.local/share/gvfs-metadata 152blacklist ${HOME}/.local/share/gvfs-metadata
153# no direct modification of dconf database 153# no direct modification of dconf database
154read-only ${HOME}/.config/dconf 154read-only ${HOME}/.config/dconf
155deny ${RUNUSER}/gnome-session-leader-fifo 155blacklist ${RUNUSER}/gnome-session-leader-fifo
156deny ${RUNUSER}/gnome-shell 156blacklist ${RUNUSER}/gnome-shell
157deny ${RUNUSER}/gsconnect 157blacklist ${RUNUSER}/gsconnect
158 158
159# systemd 159# systemd
160deny ${HOME}/.config/systemd 160blacklist ${HOME}/.config/systemd
161deny ${HOME}/.local/share/systemd 161blacklist ${HOME}/.local/share/systemd
162deny /var/lib/systemd 162blacklist /var/lib/systemd
163deny ${PATH}/systemd-run 163blacklist ${PATH}/systemd-run
164deny ${RUNUSER}/systemd 164blacklist ${RUNUSER}/systemd
165deny ${PATH}/systemctl 165blacklist ${PATH}/systemctl
166deny /etc/systemd/system 166blacklist /etc/systemd/system
167deny /etc/systemd/network 167blacklist /etc/systemd/network
168# creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf 168# creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf
169#blacklist /var/run/systemd 169#blacklist /var/run/systemd
170 170
171# openrc 171# openrc
172deny /etc/runlevels/ 172blacklist /etc/runlevels/
173deny /etc/init.d/ 173blacklist /etc/init.d/
174deny /etc/rc.conf 174blacklist /etc/rc.conf
175 175
176# VirtualBox 176# VirtualBox
177deny ${HOME}/.VirtualBox 177blacklist ${HOME}/.VirtualBox
178deny ${HOME}/.config/VirtualBox 178blacklist ${HOME}/.config/VirtualBox
179deny ${HOME}/VirtualBox VMs 179blacklist ${HOME}/VirtualBox VMs
180 180
181# GNOME Boxes 181# GNOME Boxes
182deny ${HOME}/.config/gnome-boxes 182blacklist ${HOME}/.config/gnome-boxes
183deny ${HOME}/.local/share/gnome-boxes 183blacklist ${HOME}/.local/share/gnome-boxes
184 184
185# libvirt 185# libvirt
186deny ${HOME}/.cache/libvirt 186blacklist ${HOME}/.cache/libvirt
187deny ${HOME}/.config/libvirt 187blacklist ${HOME}/.config/libvirt
188deny ${RUNUSER}/libvirt 188blacklist ${RUNUSER}/libvirt
189deny /var/cache/libvirt 189blacklist /var/cache/libvirt
190deny /var/lib/libvirt 190blacklist /var/lib/libvirt
191deny /var/log/libvirt 191blacklist /var/log/libvirt
192 192
193# OCI-Containers / Podman 193# OCI-Containers / Podman
194deny ${RUNUSER}/containers 194blacklist ${RUNUSER}/containers
195deny ${RUNUSER}/crun 195blacklist ${RUNUSER}/crun
196deny ${RUNUSER}/libpod 196blacklist ${RUNUSER}/libpod
197deny ${RUNUSER}/runc 197blacklist ${RUNUSER}/runc
198deny ${RUNUSER}/toolbox 198blacklist ${RUNUSER}/toolbox
199 199
200# VeraCrypt 200# VeraCrypt
201deny ${HOME}/.VeraCrypt 201blacklist ${HOME}/.VeraCrypt
202deny ${PATH}/veracrypt 202blacklist ${PATH}/veracrypt
203deny ${PATH}/veracrypt-uninstall.sh 203blacklist ${PATH}/veracrypt-uninstall.sh
204deny /usr/share/applications/veracrypt.* 204blacklist /usr/share/applications/veracrypt.*
205deny /usr/share/pixmaps/veracrypt.* 205blacklist /usr/share/pixmaps/veracrypt.*
206deny /usr/share/veracrypt 206blacklist /usr/share/veracrypt
207 207
208# TrueCrypt 208# TrueCrypt
209deny ${HOME}/.TrueCrypt 209blacklist ${HOME}/.TrueCrypt
210deny ${PATH}/truecrypt 210blacklist ${PATH}/truecrypt
211deny ${PATH}/truecrypt-uninstall.sh 211blacklist ${PATH}/truecrypt-uninstall.sh
212deny /usr/share/applications/truecrypt.* 212blacklist /usr/share/applications/truecrypt.*
213deny /usr/share/pixmaps/truecrypt.* 213blacklist /usr/share/pixmaps/truecrypt.*
214deny /usr/share/truecrypt 214blacklist /usr/share/truecrypt
215 215
216# zuluCrypt 216# zuluCrypt
217deny ${HOME}/.zuluCrypt 217blacklist ${HOME}/.zuluCrypt
218deny ${HOME}/.zuluCrypt-socket 218blacklist ${HOME}/.zuluCrypt-socket
219deny ${PATH}/zuluCrypt-cli 219blacklist ${PATH}/zuluCrypt-cli
220deny ${PATH}/zuluMount-cli 220blacklist ${PATH}/zuluMount-cli
221 221
222# var 222# var
223deny /var/cache/apt 223blacklist /var/cache/apt
224deny /var/cache/pacman 224blacklist /var/cache/pacman
225deny /var/lib/apt 225blacklist /var/lib/apt
226deny /var/lib/clamav 226blacklist /var/lib/clamav
227deny /var/lib/dkms 227blacklist /var/lib/dkms
228deny /var/lib/mysql/mysql.sock 228blacklist /var/lib/mysql/mysql.sock
229deny /var/lib/mysqld/mysql.sock 229blacklist /var/lib/mysqld/mysql.sock
230deny /var/lib/pacman 230blacklist /var/lib/pacman
231deny /var/lib/upower 231blacklist /var/lib/upower
232# blacklist /var/log - a virtual /var/log directory (mostly empty) is build up by default for 232# blacklist /var/log - a virtual /var/log directory (mostly empty) is build up by default for
233# every sandbox, unless --writable-var-log switch is activated 233# every sandbox, unless --writable-var-log switch is activated
234deny /var/mail 234blacklist /var/mail
235deny /var/opt 235blacklist /var/opt
236deny /var/run/acpid.socket 236blacklist /var/run/acpid.socket
237deny /var/run/docker.sock 237blacklist /var/run/docker.sock
238deny /var/run/minissdpd.sock 238blacklist /var/run/minissdpd.sock
239deny /var/run/mysql/mysqld.sock 239blacklist /var/run/mysql/mysqld.sock
240deny /var/run/mysqld/mysqld.sock 240blacklist /var/run/mysqld/mysqld.sock
241deny /var/run/rpcbind.sock 241blacklist /var/run/rpcbind.sock
242deny /var/run/screens 242blacklist /var/run/screens
243deny /var/spool/anacron 243blacklist /var/spool/anacron
244deny /var/spool/cron 244blacklist /var/spool/cron
245deny /var/spool/mail 245blacklist /var/spool/mail
246 246
247# etc 247# etc
248deny /etc/anacrontab 248blacklist /etc/anacrontab
249deny /etc/cron* 249blacklist /etc/cron*
250deny /etc/profile.d 250blacklist /etc/profile.d
251deny /etc/rc.local 251blacklist /etc/rc.local
252# rc1.d, rc2.d, ... 252# rc1.d, rc2.d, ...
253deny /etc/rc?.d 253blacklist /etc/rc?.d
254deny /etc/kernel* 254blacklist /etc/kernel*
255deny /etc/grub* 255blacklist /etc/grub*
256deny /etc/dkms 256blacklist /etc/dkms
257deny /etc/apparmor* 257blacklist /etc/apparmor*
258deny /etc/selinux 258blacklist /etc/selinux
259deny /etc/modules* 259blacklist /etc/modules*
260deny /etc/logrotate* 260blacklist /etc/logrotate*
261deny /etc/adduser.conf 261blacklist /etc/adduser.conf
262 262
263# hide config for various intrusion detection systems 263# hide config for various intrusion detection systems
264deny /etc/rkhunter.conf 264blacklist /etc/rkhunter.conf
265deny /var/lib/rkhunter 265blacklist /var/lib/rkhunter
266deny /etc/chkrootkit.conf 266blacklist /etc/chkrootkit.conf
267deny /etc/lynis 267blacklist /etc/lynis
268deny /etc/aide 268blacklist /etc/aide
269deny /etc/logcheck 269blacklist /etc/logcheck
270deny /etc/tripwire 270blacklist /etc/tripwire
271deny /etc/snort 271blacklist /etc/snort
272deny /etc/fail2ban.conf 272blacklist /etc/fail2ban.conf
273deny /etc/suricata 273blacklist /etc/suricata
274 274
275# Startup files 275# Startup files
276read-only ${HOME}/.antigen 276read-only ${HOME}/.antigen
@@ -307,13 +307,13 @@ read-only ${HOME}/.zshrc
307read-only ${HOME}/.zshrc.local 307read-only ${HOME}/.zshrc.local
308 308
309# Remote access 309# Remote access
310deny ${HOME}/.rhosts 310blacklist ${HOME}/.rhosts
311deny ${HOME}/.shosts 311blacklist ${HOME}/.shosts
312deny ${HOME}/.ssh/authorized_keys 312blacklist ${HOME}/.ssh/authorized_keys
313deny ${HOME}/.ssh/authorized_keys2 313blacklist ${HOME}/.ssh/authorized_keys2
314deny ${HOME}/.ssh/environment 314blacklist ${HOME}/.ssh/environment
315deny ${HOME}/.ssh/rc 315blacklist ${HOME}/.ssh/rc
316deny /etc/hosts.equiv 316blacklist /etc/hosts.equiv
317read-only ${HOME}/.ssh/config 317read-only ${HOME}/.ssh/config
318read-only ${HOME}/.ssh/config.d 318read-only ${HOME}/.ssh/config.d
319 319
@@ -374,200 +374,200 @@ read-only ${HOME}/.local/share/mime
374read-only ${HOME}/.local/share/thumbnailers 374read-only ${HOME}/.local/share/thumbnailers
375 375
376# prevent access to ssh-agent 376# prevent access to ssh-agent
377deny /tmp/ssh-* 377blacklist /tmp/ssh-*
378 378
379# top secret 379# top secret
380deny ${HOME}/*.kdb 380blacklist ${HOME}/*.kdb
381deny ${HOME}/*.kdbx 381blacklist ${HOME}/*.kdbx
382deny ${HOME}/*.key 382blacklist ${HOME}/*.key
383deny ${HOME}/.Private 383blacklist ${HOME}/.Private
384deny ${HOME}/.caff 384blacklist ${HOME}/.caff
385deny ${HOME}/.cargo/credentials 385blacklist ${HOME}/.cargo/credentials
386deny ${HOME}/.cargo/credentials.toml 386blacklist ${HOME}/.cargo/credentials.toml
387deny ${HOME}/.cert 387blacklist ${HOME}/.cert
388deny ${HOME}/.config/keybase 388blacklist ${HOME}/.config/keybase
389deny ${HOME}/.davfs2/secrets 389blacklist ${HOME}/.davfs2/secrets
390deny ${HOME}/.ecryptfs 390blacklist ${HOME}/.ecryptfs
391deny ${HOME}/.fetchmailrc 391blacklist ${HOME}/.fetchmailrc
392deny ${HOME}/.fscrypt 392blacklist ${HOME}/.fscrypt
393deny ${HOME}/.git-credential-cache 393blacklist ${HOME}/.git-credential-cache
394deny ${HOME}/.git-credentials 394blacklist ${HOME}/.git-credentials
395deny ${HOME}/.gnome2/keyrings 395blacklist ${HOME}/.gnome2/keyrings
396deny ${HOME}/.gnupg 396blacklist ${HOME}/.gnupg
397deny ${HOME}/.config/hub 397blacklist ${HOME}/.config/hub
398deny ${HOME}/.kde/share/apps/kwallet 398blacklist ${HOME}/.kde/share/apps/kwallet
399deny ${HOME}/.kde4/share/apps/kwallet 399blacklist ${HOME}/.kde4/share/apps/kwallet
400deny ${HOME}/.local/share/keyrings 400blacklist ${HOME}/.local/share/keyrings
401deny ${HOME}/.local/share/kwalletd 401blacklist ${HOME}/.local/share/kwalletd
402deny ${HOME}/.local/share/plasma-vault 402blacklist ${HOME}/.local/share/plasma-vault
403deny ${HOME}/.msmtprc 403blacklist ${HOME}/.msmtprc
404deny ${HOME}/.mutt 404blacklist ${HOME}/.mutt
405deny ${HOME}/.muttrc 405blacklist ${HOME}/.muttrc
406deny ${HOME}/.netrc 406blacklist ${HOME}/.netrc
407deny ${HOME}/.nyx 407blacklist ${HOME}/.nyx
408deny ${HOME}/.pki 408blacklist ${HOME}/.pki
409deny ${HOME}/.local/share/pki 409blacklist ${HOME}/.local/share/pki
410deny ${HOME}/.smbcredentials 410blacklist ${HOME}/.smbcredentials
411deny ${HOME}/.ssh 411blacklist ${HOME}/.ssh
412deny ${HOME}/.vaults 412blacklist ${HOME}/.vaults
413deny /.fscrypt 413blacklist /.fscrypt
414deny /etc/davfs2/secrets 414blacklist /etc/davfs2/secrets
415deny /etc/group+ 415blacklist /etc/group+
416deny /etc/group- 416blacklist /etc/group-
417deny /etc/gshadow 417blacklist /etc/gshadow
418deny /etc/gshadow+ 418blacklist /etc/gshadow+
419deny /etc/gshadow- 419blacklist /etc/gshadow-
420deny /etc/passwd+ 420blacklist /etc/passwd+
421deny /etc/passwd- 421blacklist /etc/passwd-
422deny /etc/shadow 422blacklist /etc/shadow
423deny /etc/shadow+ 423blacklist /etc/shadow+
424deny /etc/shadow- 424blacklist /etc/shadow-
425deny /etc/ssh 425blacklist /etc/ssh
426deny /etc/ssh/* 426blacklist /etc/ssh/*
427deny /home/.ecryptfs 427blacklist /home/.ecryptfs
428deny /home/.fscrypt 428blacklist /home/.fscrypt
429deny /var/backup 429blacklist /var/backup
430 430
431# cloud provider configuration 431# cloud provider configuration
432deny ${HOME}/.aws 432blacklist ${HOME}/.aws
433deny ${HOME}/.boto 433blacklist ${HOME}/.boto
434deny ${HOME}/.config/gcloud 434blacklist ${HOME}/.config/gcloud
435deny ${HOME}/.kube 435blacklist ${HOME}/.kube
436deny ${HOME}/.passwd-s3fs 436blacklist ${HOME}/.passwd-s3fs
437deny ${HOME}/.s3cmd 437blacklist ${HOME}/.s3cmd
438deny /etc/boto.cfg 438blacklist /etc/boto.cfg
439 439
440# system directories 440# system directories
441deny /sbin 441blacklist /sbin
442deny /usr/local/sbin 442blacklist /usr/local/sbin
443deny /usr/sbin 443blacklist /usr/sbin
444 444
445# system management 445# system management
446deny ${PATH}/at 446blacklist ${PATH}/at
447deny ${PATH}/busybox 447blacklist ${PATH}/busybox
448deny ${PATH}/chage 448blacklist ${PATH}/chage
449deny ${PATH}/chfn 449blacklist ${PATH}/chfn
450deny ${PATH}/chsh 450blacklist ${PATH}/chsh
451deny ${PATH}/crontab 451blacklist ${PATH}/crontab
452deny ${PATH}/evtest 452blacklist ${PATH}/evtest
453deny ${PATH}/expiry 453blacklist ${PATH}/expiry
454deny ${PATH}/fusermount 454blacklist ${PATH}/fusermount
455deny ${PATH}/gksu 455blacklist ${PATH}/gksu
456deny ${PATH}/gksudo 456blacklist ${PATH}/gksudo
457deny ${PATH}/gpasswd 457blacklist ${PATH}/gpasswd
458deny ${PATH}/kdesudo 458blacklist ${PATH}/kdesudo
459deny ${PATH}/ksu 459blacklist ${PATH}/ksu
460deny ${PATH}/mount 460blacklist ${PATH}/mount
461deny ${PATH}/mount.ecryptfs_private 461blacklist ${PATH}/mount.ecryptfs_private
462deny ${PATH}/nc 462blacklist ${PATH}/nc
463deny ${PATH}/ncat 463blacklist ${PATH}/ncat
464deny ${PATH}/nmap 464blacklist ${PATH}/nmap
465deny ${PATH}/newgidmap 465blacklist ${PATH}/newgidmap
466deny ${PATH}/newgrp 466blacklist ${PATH}/newgrp
467deny ${PATH}/newuidmap 467blacklist ${PATH}/newuidmap
468deny ${PATH}/ntfs-3g 468blacklist ${PATH}/ntfs-3g
469deny ${PATH}/pkexec 469blacklist ${PATH}/pkexec
470deny ${PATH}/procmail 470blacklist ${PATH}/procmail
471deny ${PATH}/sg 471blacklist ${PATH}/sg
472deny ${PATH}/strace 472blacklist ${PATH}/strace
473deny ${PATH}/su 473blacklist ${PATH}/su
474deny ${PATH}/sudo 474blacklist ${PATH}/sudo
475deny ${PATH}/tcpdump 475blacklist ${PATH}/tcpdump
476deny ${PATH}/umount 476blacklist ${PATH}/umount
477deny ${PATH}/unix_chkpwd 477blacklist ${PATH}/unix_chkpwd
478deny ${PATH}/xev 478blacklist ${PATH}/xev
479deny ${PATH}/xinput 479blacklist ${PATH}/xinput
480 480
481# other SUID binaries 481# other SUID binaries
482deny /usr/lib/virtualbox 482blacklist /usr/lib/virtualbox
483deny /usr/lib64/virtualbox 483blacklist /usr/lib64/virtualbox
484 484
485# prevent lxterminal connecting to an existing lxterminal session 485# prevent lxterminal connecting to an existing lxterminal session
486deny /tmp/.lxterminal-socket* 486blacklist /tmp/.lxterminal-socket*
487# prevent tmux connecting to an existing session 487# prevent tmux connecting to an existing session
488deny /tmp/tmux-* 488blacklist /tmp/tmux-*
489 489
490# disable terminals running as server resulting in sandbox escape 490# disable terminals running as server resulting in sandbox escape
491deny ${PATH}/lxterminal 491blacklist ${PATH}/lxterminal
492deny ${PATH}/gnome-terminal 492blacklist ${PATH}/gnome-terminal
493deny ${PATH}/gnome-terminal.wrapper 493blacklist ${PATH}/gnome-terminal.wrapper
494deny ${PATH}/lilyterm 494blacklist ${PATH}/lilyterm
495deny ${PATH}/mate-terminal 495blacklist ${PATH}/mate-terminal
496deny ${PATH}/mate-terminal.wrapper 496blacklist ${PATH}/mate-terminal.wrapper
497deny ${PATH}/pantheon-terminal 497blacklist ${PATH}/pantheon-terminal
498deny ${PATH}/roxterm 498blacklist ${PATH}/roxterm
499deny ${PATH}/roxterm-config 499blacklist ${PATH}/roxterm-config
500deny ${PATH}/terminix 500blacklist ${PATH}/terminix
501deny ${PATH}/tilix 501blacklist ${PATH}/tilix
502deny ${PATH}/urxvtc 502blacklist ${PATH}/urxvtc
503deny ${PATH}/urxvtcd 503blacklist ${PATH}/urxvtcd
504deny ${PATH}/xfce4-terminal 504blacklist ${PATH}/xfce4-terminal
505deny ${PATH}/xfce4-terminal.wrapper 505blacklist ${PATH}/xfce4-terminal.wrapper
506# blacklist ${PATH}/konsole 506# blacklist ${PATH}/konsole
507# konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 507# konsole doesn't seem to have this problem - last tested on Ubuntu 16.04
508 508
509# kernel files 509# kernel files
510deny /initrd* 510blacklist /initrd*
511deny /vmlinuz* 511blacklist /vmlinuz*
512 512
513# snapshot files 513# snapshot files
514deny /.snapshots 514blacklist /.snapshots
515 515
516# flatpak 516# flatpak
517deny ${HOME}/.cache/flatpak 517blacklist ${HOME}/.cache/flatpak
518deny ${HOME}/.config/flatpak 518blacklist ${HOME}/.config/flatpak
519nodeny ${HOME}/.local/share/flatpak/exports 519noblacklist ${HOME}/.local/share/flatpak/exports
520read-only ${HOME}/.local/share/flatpak/exports 520read-only ${HOME}/.local/share/flatpak/exports
521deny ${HOME}/.local/share/flatpak/* 521blacklist ${HOME}/.local/share/flatpak/*
522deny ${HOME}/.var 522blacklist ${HOME}/.var
523deny ${RUNUSER}/app 523blacklist ${RUNUSER}/app
524deny ${RUNUSER}/doc 524blacklist ${RUNUSER}/doc
525deny ${RUNUSER}/.dbus-proxy 525blacklist ${RUNUSER}/.dbus-proxy
526deny ${RUNUSER}/.flatpak 526blacklist ${RUNUSER}/.flatpak
527deny ${RUNUSER}/.flatpak-cache 527blacklist ${RUNUSER}/.flatpak-cache
528deny ${RUNUSER}/.flatpak-helper 528blacklist ${RUNUSER}/.flatpak-helper
529deny /usr/share/flatpak 529blacklist /usr/share/flatpak
530nodeny /var/lib/flatpak/exports 530noblacklist /var/lib/flatpak/exports
531deny /var/lib/flatpak/* 531blacklist /var/lib/flatpak/*
532# most of the time bwrap is SUID binary 532# most of the time bwrap is SUID binary
533deny ${PATH}/bwrap 533blacklist ${PATH}/bwrap
534 534
535# snap 535# snap
536deny ${RUNUSER}/snapd-session-agent.socket 536blacklist ${RUNUSER}/snapd-session-agent.socket
537 537
538# mail directories used by mutt 538# mail directories used by mutt
539deny ${HOME}/.Mail 539blacklist ${HOME}/.Mail
540deny ${HOME}/.mail 540blacklist ${HOME}/.mail
541deny ${HOME}/.signature 541blacklist ${HOME}/.signature
542deny ${HOME}/Mail 542blacklist ${HOME}/Mail
543deny ${HOME}/mail 543blacklist ${HOME}/mail
544deny ${HOME}/postponed 544blacklist ${HOME}/postponed
545deny ${HOME}/sent 545blacklist ${HOME}/sent
546 546
547# kernel configuration 547# kernel configuration
548deny /proc/config.gz 548blacklist /proc/config.gz
549 549
550# prevent DNS malware attempting to communicate with the server 550# prevent DNS malware attempting to communicate with the server
551# using regular DNS tools 551# using regular DNS tools
552deny ${PATH}/dig 552blacklist ${PATH}/dig
553deny ${PATH}/dlint 553blacklist ${PATH}/dlint
554deny ${PATH}/dns2tcp 554blacklist ${PATH}/dns2tcp
555deny ${PATH}/dnssec-* 555blacklist ${PATH}/dnssec-*
556deny ${PATH}/dnswalk 556blacklist ${PATH}/dnswalk
557deny ${PATH}/drill 557blacklist ${PATH}/drill
558deny ${PATH}/host 558blacklist ${PATH}/host
559deny ${PATH}/iodine 559blacklist ${PATH}/iodine
560deny ${PATH}/kdig 560blacklist ${PATH}/kdig
561deny ${PATH}/khost 561blacklist ${PATH}/khost
562deny ${PATH}/knsupdate 562blacklist ${PATH}/knsupdate
563deny ${PATH}/ldns-* 563blacklist ${PATH}/ldns-*
564deny ${PATH}/ldnsd 564blacklist ${PATH}/ldnsd
565deny ${PATH}/nslookup 565blacklist ${PATH}/nslookup
566deny ${PATH}/resolvectl 566blacklist ${PATH}/resolvectl
567deny ${PATH}/unbound-host 567blacklist ${PATH}/unbound-host
568 568
569# rest of ${RUNUSER} 569# rest of ${RUNUSER}
570deny ${RUNUSER}/*.lock 570blacklist ${RUNUSER}/*.lock
571deny ${RUNUSER}/inaccessible 571blacklist ${RUNUSER}/inaccessible
572deny ${RUNUSER}/pk-debconf-socket 572blacklist ${RUNUSER}/pk-debconf-socket
573deny ${RUNUSER}/update-notifier.pid 573blacklist ${RUNUSER}/update-notifier.pid
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-01 20:12:10 +0000