aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc/whitelist-usr-share-common.inc
diff options
context:
space:
mode:
authorLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2021-07-18 20:39:14 -0300
committerLibravatar Kelvin M. Klann <kmk3.code@protonmail.com>2021-07-18 20:39:14 -0300
commitf43382f1e9707b4fd5e63c7bfe881912aa4ee994 (patch)
tree499639bb962c8b071b153dcdad1b42af8286521d /etc/inc/whitelist-usr-share-common.inc
parentAdd MS Edge Beta profile (diff)
downloadfirejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.tar.gz
firejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.tar.zst
firejail-f43382f1e9707b4fd5e63c7bfe881912aa4ee994.zip
Revert "move whitelist/blacklist to allow/deny"
This reverts commit fe0f975f447d59977d90c3226cc8c623b31b20b3. Note: This only reverts the changes from etc. The 4 aliases introduced on commit 45f2ba544 are mere, well, aliases. That is, they fail to address the different usability problems discussed on [#3447][3447] and in fact only make things more confusing (as has already been mentioned on [this][4379] and later comments). The main reason is that the aliases do not meaningfully map to the original commands. For example, the commands from each pair below seem like they would do the exact same thing: * `allow` and `nodeny` * `deny` and `noallow` Additionally, if these aliases are not the final commands, but only a test/work-in-progress, then keeping the wide-scale search/replace changes made on commit fe0f975f4 would only serve to cause confusion, as users of firejail-git, contributors and downstream projects might start changing the commands used on their profiles, only to later have to change them again, potentially to completely different commands. The sooner this is undone the better, as (besides the above reasons) the more profile changes there are between the original commit and the revert, the harder it is to e.g.: `git diff` versions of files across the following revision ranges: before the commit, after the commit but before the revert and after the revert. Note: This is still the case even if a commit is [ignored by `git blame`][4390]. So let us revert fe0f975f4 and only reapply similar large-scale changes once we have discussed and settled on better commands. How the revert was applied: Despite using the auto-generated message from `git revert`, to ensure correctness and to avoid conflicts the changes were reverted in different steps: Firstly, revert the files which can be safely reverted directly ("filestorevert"): # Find out which files have been changed on fe0f975f44, but have not # been changed afterwards and list them on "filestorevert" git show --pretty='' --name-only fe0f975f44 -- etc | LC_ALL=C sort >allfiles git diff --name-only fe0f975f44..master -- etc | LC_ALL=C sort >filestoignore comm -2 -3 allfiles filestoignore >filestorevert # Note: There are 3 extra files on filestoignore because they were # added after commit fe0f975f44 wc -l allfiles filestoignore filestorevert | head -n 3 # 797 allfiles # 8 filestoignore # 792 filestorevert # Automatically revert files in "filestorevert" # See https://stackoverflow.com/a/23401018/10095231 tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975f44 -- | git apply --reverse printf 'Total files reverted:\n' git diff --name-only | wc -l # 792 Secondly, do some search/replace on the rest: tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \ -e 's/allow /whitelist /' -e 's/noallow /nowhitelist /' \ -e 's/deny /blacklist /' -e 's/nodeny /noblacklist /' \ -e 's/deny-nolog /blacklist-nolog /' find etc -name '*.bak' -print0 | xargs -0 rm Thirdly, verify the result. The following command shows the difference between all the changes in etc from before fe0f975f44 and this commit (inclusive): git diff fe0f975f44~1 -- etc From the output, it looks like all alias changes are fully reverted and that the other changes to etc (from after fe0f975f44) remain, so the revert seems to be done correctly. [3447]: https://github.com/netblue30/firejail/issues/3447 [4379]: https://github.com/netblue30/firejail/issues/4379#issuecomment-876460222 [4390]: https://github.com/netblue30/firejail/issues/4390
Diffstat (limited to 'etc/inc/whitelist-usr-share-common.inc')
-rw-r--r--etc/inc/whitelist-usr-share-common.inc126
1 files changed, 63 insertions, 63 deletions
diff --git a/etc/inc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc
index 64296da15..fe0097934 100644
--- a/etc/inc/whitelist-usr-share-common.inc
+++ b/etc/inc/whitelist-usr-share-common.inc
@@ -4,66 +4,66 @@ include whitelist-usr-share-common.local
4 4
5# common /usr/share whitelist for all profiles 5# common /usr/share whitelist for all profiles
6 6
7allow /usr/share/alsa 7whitelist /usr/share/alsa
8allow /usr/share/applications 8whitelist /usr/share/applications
9allow /usr/share/ca-certificates 9whitelist /usr/share/ca-certificates
10allow /usr/share/crypto-policies 10whitelist /usr/share/crypto-policies
11allow /usr/share/cursors 11whitelist /usr/share/cursors
12allow /usr/share/dconf 12whitelist /usr/share/dconf
13allow /usr/share/distro-info 13whitelist /usr/share/distro-info
14allow /usr/share/drirc.d 14whitelist /usr/share/drirc.d
15allow /usr/share/enchant 15whitelist /usr/share/enchant
16allow /usr/share/enchant-2 16whitelist /usr/share/enchant-2
17allow /usr/share/file 17whitelist /usr/share/file
18allow /usr/share/fontconfig 18whitelist /usr/share/fontconfig
19allow /usr/share/fonts 19whitelist /usr/share/fonts
20allow /usr/share/fonts-config 20whitelist /usr/share/fonts-config
21allow /usr/share/gir-1.0 21whitelist /usr/share/gir-1.0
22allow /usr/share/gjs-1.0 22whitelist /usr/share/gjs-1.0
23allow /usr/share/glib-2.0 23whitelist /usr/share/glib-2.0
24allow /usr/share/glvnd 24whitelist /usr/share/glvnd
25allow /usr/share/gtk-2.0 25whitelist /usr/share/gtk-2.0
26allow /usr/share/gtk-3.0 26whitelist /usr/share/gtk-3.0
27allow /usr/share/gtk-engines 27whitelist /usr/share/gtk-engines
28allow /usr/share/gtksourceview-3.0 28whitelist /usr/share/gtksourceview-3.0
29allow /usr/share/gtksourceview-4 29whitelist /usr/share/gtksourceview-4
30allow /usr/share/hunspell 30whitelist /usr/share/hunspell
31allow /usr/share/hwdata 31whitelist /usr/share/hwdata
32allow /usr/share/icons 32whitelist /usr/share/icons
33allow /usr/share/icu 33whitelist /usr/share/icu
34allow /usr/share/knotifications5 34whitelist /usr/share/knotifications5
35allow /usr/share/kservices5 35whitelist /usr/share/kservices5
36allow /usr/share/Kvantum 36whitelist /usr/share/Kvantum
37allow /usr/share/kxmlgui5 37whitelist /usr/share/kxmlgui5
38allow /usr/share/libdrm 38whitelist /usr/share/libdrm
39allow /usr/share/libthai 39whitelist /usr/share/libthai
40allow /usr/share/locale 40whitelist /usr/share/locale
41allow /usr/share/mime 41whitelist /usr/share/mime
42allow /usr/share/misc 42whitelist /usr/share/misc
43allow /usr/share/Modules 43whitelist /usr/share/Modules
44allow /usr/share/myspell 44whitelist /usr/share/myspell
45allow /usr/share/p11-kit 45whitelist /usr/share/p11-kit
46allow /usr/share/perl 46whitelist /usr/share/perl
47allow /usr/share/perl5 47whitelist /usr/share/perl5
48allow /usr/share/pixmaps 48whitelist /usr/share/pixmaps
49allow /usr/share/pki 49whitelist /usr/share/pki
50allow /usr/share/plasma 50whitelist /usr/share/plasma
51allow /usr/share/publicsuffix 51whitelist /usr/share/publicsuffix
52allow /usr/share/qt 52whitelist /usr/share/qt
53allow /usr/share/qt4 53whitelist /usr/share/qt4
54allow /usr/share/qt5 54whitelist /usr/share/qt5
55allow /usr/share/qt5ct 55whitelist /usr/share/qt5ct
56allow /usr/share/sounds 56whitelist /usr/share/sounds
57allow /usr/share/tcl8.6 57whitelist /usr/share/tcl8.6
58allow /usr/share/tcltk 58whitelist /usr/share/tcltk
59allow /usr/share/terminfo 59whitelist /usr/share/terminfo
60allow /usr/share/texlive 60whitelist /usr/share/texlive
61allow /usr/share/texmf 61whitelist /usr/share/texmf
62allow /usr/share/themes 62whitelist /usr/share/themes
63allow /usr/share/thumbnail.so 63whitelist /usr/share/thumbnail.so
64allow /usr/share/uim 64whitelist /usr/share/uim
65allow /usr/share/vulkan 65whitelist /usr/share/vulkan
66allow /usr/share/X11 66whitelist /usr/share/X11
67allow /usr/share/xml 67whitelist /usr/share/xml
68allow /usr/share/zenity 68whitelist /usr/share/zenity
69allow /usr/share/zoneinfo 69whitelist /usr/share/zoneinfo