diff options
author | 2023-08-11 03:54:39 +0000 | |
---|---|---|
committer | 2023-08-11 03:54:39 +0000 | |
commit | a3a41b8fff7763862b07db00b0357f20774687f5 (patch) | |
tree | 9a6bebb77b42aeea30539077032f856a595681f2 /etc/profile-m-z | |
parent | 0ad.profile: fix libmozjs error on OpenSUSE Tumbleweed (#5944) (diff) | |
download | firejail-a3a41b8fff7763862b07db00b0357f20774687f5.tar.gz firejail-a3a41b8fff7763862b07db00b0357f20774687f5.tar.zst firejail-a3a41b8fff7763862b07db00b0357f20774687f5.zip |
profiles: improvements to profiles using private (#5946)
Changes:
* comment `include whitelist-common.inc` when using `private`
* drop `private` on profiles that access files in `${HOME}`
* use `#` in comments
Relates to #903.
Diffstat (limited to 'etc/profile-m-z')
-rw-r--r-- | etc/profile-m-z/Xephyr.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/Xvfb.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/mirrormagic.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/notify-send.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/ping.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/reader.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse-adventures.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/wordwarvi.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xbill.profile | 2 |
9 files changed, 7 insertions, 9 deletions
diff --git a/etc/profile-m-z/Xephyr.profile b/etc/profile-m-z/Xephyr.profile index 2fc1d1b8a..0c3d4c1da 100644 --- a/etc/profile-m-z/Xephyr.profile +++ b/etc/profile-m-z/Xephyr.profile | |||
@@ -16,7 +16,7 @@ include globals.local | |||
16 | # | 16 | # |
17 | 17 | ||
18 | whitelist /var/lib/xkb | 18 | whitelist /var/lib/xkb |
19 | include whitelist-common.inc | 19 | #include whitelist-common.inc # see #903 |
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | # Xephyr needs to be allowed access to the abstract Unix socket namespace. | 22 | # Xephyr needs to be allowed access to the abstract Unix socket namespace. |
diff --git a/etc/profile-m-z/Xvfb.profile b/etc/profile-m-z/Xvfb.profile index ee19fa3b0..2bb9f171a 100644 --- a/etc/profile-m-z/Xvfb.profile +++ b/etc/profile-m-z/Xvfb.profile | |||
@@ -19,7 +19,7 @@ include globals.local | |||
19 | # | 19 | # |
20 | 20 | ||
21 | whitelist /var/lib/xkb | 21 | whitelist /var/lib/xkb |
22 | include whitelist-common.inc | 22 | #include whitelist-common.inc # see #903 |
23 | 23 | ||
24 | caps.drop all | 24 | caps.drop all |
25 | # Xvfb needs to be allowed access to the abstract Unix socket namespace. | 25 | # Xvfb needs to be allowed access to the abstract Unix socket namespace. |
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile index 4943a80af..a8c6e3533 100644 --- a/etc/profile-m-z/mirrormagic.profile +++ b/etc/profile-m-z/mirrormagic.profile | |||
@@ -39,7 +39,6 @@ seccomp | |||
39 | tracelog | 39 | tracelog |
40 | 40 | ||
41 | disable-mnt | 41 | disable-mnt |
42 | private | ||
43 | private-bin mirrormagic | 42 | private-bin mirrormagic |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile index f0f2cca2e..5ec81c2ac 100644 --- a/etc/profile-m-z/notify-send.profile +++ b/etc/profile-m-z/notify-send.profile | |||
@@ -18,7 +18,7 @@ include disable-shell.inc | |||
18 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-common.inc | 21 | #include whitelist-common.inc # see #903 |
22 | include whitelist-runuser-common.inc | 22 | include whitelist-runuser-common.inc |
23 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/ping.profile b/etc/profile-m-z/ping.profile index 4520ac2fa..d563064e1 100644 --- a/etc/profile-m-z/ping.profile +++ b/etc/profile-m-z/ping.profile | |||
@@ -18,7 +18,7 @@ include disable-programs.inc | |||
18 | include disable-X11.inc | 18 | include disable-X11.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-common.inc | 21 | #include whitelist-common.inc # see #903 |
22 | include whitelist-run-common.inc | 22 | include whitelist-run-common.inc |
23 | include whitelist-runuser-common.inc | 23 | include whitelist-runuser-common.inc |
24 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/reader.profile b/etc/profile-m-z/reader.profile index 050c46d53..31c45fe84 100644 --- a/etc/profile-m-z/reader.profile +++ b/etc/profile-m-z/reader.profile | |||
@@ -17,7 +17,7 @@ include disable-programs.inc | |||
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | include whitelist-common.inc | 20 | #include whitelist-common.inc # see #903 |
21 | include whitelist-run-common.inc | 21 | include whitelist-run-common.inc |
22 | include whitelist-runuser-common.inc | 22 | include whitelist-runuser-common.inc |
23 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile index 5985e0da3..49d98d9f5 100644 --- a/etc/profile-m-z/seahorse-adventures.profile +++ b/etc/profile-m-z/seahorse-adventures.profile | |||
@@ -23,7 +23,7 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | whitelist /usr/share/seahorse-adventures | 24 | whitelist /usr/share/seahorse-adventures |
25 | whitelist /usr/share/games/seahorse-adventures | 25 | whitelist /usr/share/games/seahorse-adventures |
26 | include whitelist-common.inc | 26 | #include whitelist-common.inc # see #903 |
27 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
29 | 29 | ||
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile index 310e8b470..970063f93 100644 --- a/etc/profile-m-z/wordwarvi.profile +++ b/etc/profile-m-z/wordwarvi.profile | |||
@@ -40,7 +40,6 @@ seccomp | |||
40 | tracelog | 40 | tracelog |
41 | 41 | ||
42 | disable-mnt | 42 | disable-mnt |
43 | private | ||
44 | private-bin wordwarvi | 43 | private-bin wordwarvi |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile index e85bb9f18..46e3e81bc 100644 --- a/etc/profile-m-z/xbill.profile +++ b/etc/profile-m-z/xbill.profile | |||
@@ -16,7 +16,7 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/xbill | 17 | whitelist /usr/share/xbill |
18 | whitelist /var/games/xbill/scores | 18 | whitelist /var/games/xbill/scores |
19 | include whitelist-common.inc | 19 | #include whitelist-common.inc # see #903 |
20 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
22 | 22 | ||