aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc/whitelist-common.inc
diff options
context:
space:
mode:
authorLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2021-07-18 20:39:14 -0300
committerLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2021-07-18 20:39:14 -0300
commitf43382f1e9707b4fd5e63c7bfe881912aa4ee994 (patch)
tree499639bb962c8b071b153dcdad1b42af8286521d /etc/inc/whitelist-common.inc
parentAdd MS Edge Beta profile (diff)
downloadfirejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.tar.gz
firejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.tar.zst
firejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.zip
Revert "move whitelist/blacklist to allow/deny"
This reverts commit fe0f975f447d59977d90c3226cc8c623b31b20b3. Note: This only reverts the changes from etc. The 4 aliases introduced on commit 45f2ba544 are mere, well, aliases. That is, they fail to address the different usability problems discussed on [#3447][3447] and in fact only make things more confusing (as has already been mentioned on [this][4379] and later comments). The main reason is that the aliases do not meaningfully map to the original commands. For example, the commands from each pair below seem like they would do the exact same thing: * `allow` and `nodeny` * `deny` and `noallow` Additionally, if these aliases are not the final commands, but only a test/work-in-progress, then keeping the wide-scale search/replace changes made on commit fe0f975f4 would only serve to cause confusion, as users of firejail-git, contributors and downstream projects might start changing the commands used on their profiles, only to later have to change them again, potentially to completely different commands. The sooner this is undone the better, as (besides the above reasons) the more profile changes there are between the original commit and the revert, the harder it is to e.g.: `git diff` versions of files across the following revision ranges: before the commit, after the commit but before the revert and after the revert. Note: This is still the case even if a commit is [ignored by `git blame`][4390]. So let us revert fe0f975f4 and only reapply similar large-scale changes once we have discussed and settled on better commands. How the revert was applied: Despite using the auto-generated message from `git revert`, to ensure correctness and to avoid conflicts the changes were reverted in different steps: Firstly, revert the files which can be safely reverted directly ("filestorevert"): # Find out which files have been changed on fe0f975f44, but have not # been changed afterwards and list them on "filestorevert" git show --pretty='' --name-only fe0f975f44 -- etc | LC_ALL=C sort >allfiles git diff --name-only fe0f975f44..master -- etc | LC_ALL=C sort >filestoignore comm -2 -3 allfiles filestoignore >filestorevert # Note: There are 3 extra files on filestoignore because they were # added after commit fe0f975f44 wc -l allfiles filestoignore filestorevert | head -n 3 # 797 allfiles # 8 filestoignore # 792 filestorevert # Automatically revert files in "filestorevert" # See https://stackoverflow.com/a/23401018/10095231 tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975f44 -- | git apply --reverse printf 'Total files reverted:\n' git diff --name-only | wc -l # 792 Secondly, do some search/replace on the rest: tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \ -e 's/allow /whitelist /' -e 's/noallow /nowhitelist /' \ -e 's/deny /blacklist /' -e 's/nodeny /noblacklist /' \ -e 's/deny-nolog /blacklist-nolog /' find etc -name '*.bak' -print0 | xargs -0 rm Thirdly, verify the result. The following command shows the difference between all the changes in etc from before fe0f975f44 and this commit (inclusive): git diff fe0f975f44~1 -- etc From the output, it looks like all alias changes are fully reverted and that the other changes to etc (from after fe0f975f44) remain, so the revert seems to be done correctly. [3447]: https://github.com/netblue30/firejail/issues/3447 [4379]: https://github.com/netblue30/firejail/issues/4379#issuecomment-876460222 [4390]: https://github.com/netblue30/firejail/issues/4390
Diffstat (limited to 'etc/inc/whitelist-common.inc')
-rw-r--r--etc/inc/whitelist-common.inc130
1 files changed, 65 insertions, 65 deletions
diff --git a/etc/inc/whitelist-common.inc b/etc/inc/whitelist-common.inc
index 11070e372..fedfb2bc2 100644
--- a/etc/inc/whitelist-common.inc
+++ b/etc/inc/whitelist-common.inc
@@ -4,82 +4,82 @@ include whitelist-common.local
4 4
5# common whitelist for all profiles 5# common whitelist for all profiles
6 6
7allow ${HOME}/.XCompose 7whitelist ${HOME}/.XCompose
8allow ${HOME}/.alsaequal.bin 8whitelist ${HOME}/.alsaequal.bin
9allow ${HOME}/.asoundrc 9whitelist ${HOME}/.asoundrc
10allow ${HOME}/.config/ibus 10whitelist ${HOME}/.config/ibus
11allow ${HOME}/.config/mimeapps.list 11whitelist ${HOME}/.config/mimeapps.list
12allow ${HOME}/.config/pkcs11 12whitelist ${HOME}/.config/pkcs11
13read-only ${HOME}/.config/pkcs11 13read-only ${HOME}/.config/pkcs11
14allow ${HOME}/.config/user-dirs.dirs 14whitelist ${HOME}/.config/user-dirs.dirs
15read-only ${HOME}/.config/user-dirs.dirs 15read-only ${HOME}/.config/user-dirs.dirs
16allow ${HOME}/.config/user-dirs.locale 16whitelist ${HOME}/.config/user-dirs.locale
17read-only ${HOME}/.config/user-dirs.locale 17read-only ${HOME}/.config/user-dirs.locale
18allow ${HOME}/.drirc 18whitelist ${HOME}/.drirc
19allow ${HOME}/.icons 19whitelist ${HOME}/.icons
20?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit 20?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit
21allow ${HOME}/.local/share/applications 21whitelist ${HOME}/.local/share/applications
22read-only ${HOME}/.local/share/applications 22read-only ${HOME}/.local/share/applications
23allow ${HOME}/.local/share/icons 23whitelist ${HOME}/.local/share/icons
24allow ${HOME}/.local/share/mime 24whitelist ${HOME}/.local/share/mime
25allow ${HOME}/.mime.types 25whitelist ${HOME}/.mime.types
26allow ${HOME}/.sndio/cookie 26whitelist ${HOME}/.sndio/cookie
27allow ${HOME}/.uim.d 27whitelist ${HOME}/.uim.d
28 28
29# dconf 29# dconf
30mkdir ${HOME}/.config/dconf 30mkdir ${HOME}/.config/dconf
31allow ${HOME}/.config/dconf 31whitelist ${HOME}/.config/dconf
32 32
33# fonts 33# fonts
34allow ${HOME}/.cache/fontconfig 34whitelist ${HOME}/.cache/fontconfig
35allow ${HOME}/.config/fontconfig 35whitelist ${HOME}/.config/fontconfig
36allow ${HOME}/.fontconfig 36whitelist ${HOME}/.fontconfig
37allow ${HOME}/.fonts 37whitelist ${HOME}/.fonts
38allow ${HOME}/.fonts.conf 38whitelist ${HOME}/.fonts.conf
39allow ${HOME}/.fonts.conf.d 39whitelist ${HOME}/.fonts.conf.d
40allow ${HOME}/.fonts.d 40whitelist ${HOME}/.fonts.d
41allow ${HOME}/.local/share/fonts 41whitelist ${HOME}/.local/share/fonts
42allow ${HOME}/.pangorc 42whitelist ${HOME}/.pangorc
43 43
44# gtk 44# gtk
45allow ${HOME}/.config/gtk-2.0 45whitelist ${HOME}/.config/gtk-2.0
46allow ${HOME}/.config/gtk-3.0 46whitelist ${HOME}/.config/gtk-3.0
47allow ${HOME}/.config/gtk-4.0 47whitelist ${HOME}/.config/gtk-4.0
48allow ${HOME}/.config/gtkrc 48whitelist ${HOME}/.config/gtkrc
49allow ${HOME}/.config/gtkrc-2.0 49whitelist ${HOME}/.config/gtkrc-2.0
50allow ${HOME}/.gnome2 50whitelist ${HOME}/.gnome2
51allow ${HOME}/.gnome2-private 51whitelist ${HOME}/.gnome2-private
52allow ${HOME}/.gtk-2.0 52whitelist ${HOME}/.gtk-2.0
53allow ${HOME}/.gtkrc 53whitelist ${HOME}/.gtkrc
54allow ${HOME}/.gtkrc-2.0 54whitelist ${HOME}/.gtkrc-2.0
55allow ${HOME}/.kde/share/config/gtkrc 55whitelist ${HOME}/.kde/share/config/gtkrc
56allow ${HOME}/.kde/share/config/gtkrc-2.0 56whitelist ${HOME}/.kde/share/config/gtkrc-2.0
57allow ${HOME}/.kde4/share/config/gtkrc 57whitelist ${HOME}/.kde4/share/config/gtkrc
58allow ${HOME}/.kde4/share/config/gtkrc-2.0 58whitelist ${HOME}/.kde4/share/config/gtkrc-2.0
59allow ${HOME}/.local/share/themes 59whitelist ${HOME}/.local/share/themes
60allow ${HOME}/.themes 60whitelist ${HOME}/.themes
61 61
62# qt/kde 62# qt/kde
63allow ${HOME}/.cache/kioexec/krun 63whitelist ${HOME}/.cache/kioexec/krun
64allow ${HOME}/.config/Kvantum 64whitelist ${HOME}/.config/Kvantum
65allow ${HOME}/.config/Trolltech.conf 65whitelist ${HOME}/.config/Trolltech.conf
66allow ${HOME}/.config/QtProject.conf 66whitelist ${HOME}/.config/QtProject.conf
67allow ${HOME}/.config/kdeglobals 67whitelist ${HOME}/.config/kdeglobals
68allow ${HOME}/.config/kio_httprc 68whitelist ${HOME}/.config/kio_httprc
69allow ${HOME}/.config/kioslaverc 69whitelist ${HOME}/.config/kioslaverc
70allow ${HOME}/.config/ksslcablacklist 70whitelist ${HOME}/.config/ksslcablacklist
71allow ${HOME}/.config/qt5ct 71whitelist ${HOME}/.config/qt5ct
72allow ${HOME}/.config/qtcurve 72whitelist ${HOME}/.config/qtcurve
73allow ${HOME}/.kde/share/config/kdeglobals 73whitelist ${HOME}/.kde/share/config/kdeglobals
74allow ${HOME}/.kde/share/config/kio_httprc 74whitelist ${HOME}/.kde/share/config/kio_httprc
75allow ${HOME}/.kde/share/config/kioslaverc 75whitelist ${HOME}/.kde/share/config/kioslaverc
76allow ${HOME}/.kde/share/config/ksslcablacklist 76whitelist ${HOME}/.kde/share/config/ksslcablacklist
77allow ${HOME}/.kde/share/config/oxygenrc 77whitelist ${HOME}/.kde/share/config/oxygenrc
78allow ${HOME}/.kde/share/icons 78whitelist ${HOME}/.kde/share/icons
79allow ${HOME}/.kde4/share/config/kdeglobals 79whitelist ${HOME}/.kde4/share/config/kdeglobals
80allow ${HOME}/.kde4/share/config/kio_httprc 80whitelist ${HOME}/.kde4/share/config/kio_httprc
81allow ${HOME}/.kde4/share/config/kioslaverc 81whitelist ${HOME}/.kde4/share/config/kioslaverc
82allow ${HOME}/.kde4/share/config/ksslcablacklist 82whitelist ${HOME}/.kde4/share/config/ksslcablacklist
83allow ${HOME}/.kde4/share/config/oxygenrc 83whitelist ${HOME}/.kde4/share/config/oxygenrc
84allow ${HOME}/.kde4/share/icons 84whitelist ${HOME}/.kde4/share/icons
85allow ${HOME}/.local/share/qt5ct 85whitelist ${HOME}/.local/share/qt5ct