diff options
author | 2022-12-21 23:38:25 +0000 | |
---|---|---|
committer | 2022-12-21 23:38:25 +0000 | |
commit | 73a6fced28f4d118dfd79b7d9790337279c260b7 (patch) | |
tree | 88edb4a23383332de6dd02506e711011a40600e5 /etc | |
parent | spectre-meltdown-checker: fixes (#5546) (diff) | |
download | firejail-73a6fced28f4d118dfd79b7d9790337279c260b7.tar.gz firejail-73a6fced28f4d118dfd79b7d9790337279c260b7.tar.zst firejail-73a6fced28f4d118dfd79b7d9790337279c260b7.zip |
New profile: ssmtp (#5544)
* disable-programs.inc: add ssmtp support
* Create ssmtp.profile
* ssmtp: support Debian/Ubuntu
* README.md: add ssmtp to 'New profiles' section
* disable-common.inc: move ssmtp support to keep CI happy
* ssmtp: improve dead.letter comment
Suggested in [review](https://github.com/netblue30/firejail/pull/5544#pullrequestreview-1225322546).
Diffstat (limited to 'etc')
-rw-r--r-- | etc/inc/disable-programs.inc | 1 | ||||
-rw-r--r-- | etc/profile-m-z/ssmtp.profile | 75 |
2 files changed, 76 insertions, 0 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 858a0c9f6..b52bcaa11 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -1181,6 +1181,7 @@ blacklist ${HOME}/yt-dlp.conf.txt | |||
1181 | blacklist ${RUNUSER}/*firefox* | 1181 | blacklist ${RUNUSER}/*firefox* |
1182 | blacklist ${RUNUSER}/akonadi | 1182 | blacklist ${RUNUSER}/akonadi |
1183 | blacklist ${RUNUSER}/psd/*firefox* | 1183 | blacklist ${RUNUSER}/psd/*firefox* |
1184 | blacklist /etc/ssmtp | ||
1184 | blacklist /tmp/.wine-* | 1185 | blacklist /tmp/.wine-* |
1185 | blacklist /tmp/akonadi-* | 1186 | blacklist /tmp/akonadi-* |
1186 | blacklist /var/games/nethack | 1187 | blacklist /var/games/nethack |
diff --git a/etc/profile-m-z/ssmtp.profile b/etc/profile-m-z/ssmtp.profile new file mode 100644 index 000000000..1a224e7b0 --- /dev/null +++ b/etc/profile-m-z/ssmtp.profile | |||
@@ -0,0 +1,75 @@ | |||
1 | # Firejail profile for ssmtp | ||
2 | # Description: Extremely simple MTA to get mail off the system to a mailhub | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include ssmtp.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER} | ||
11 | blacklist /usr/libexec | ||
12 | |||
13 | noblacklist /etc/logcheck | ||
14 | noblacklist /etc/ssmtp | ||
15 | noblacklist /sbin | ||
16 | noblacklist /usr/sbin | ||
17 | |||
18 | noblacklist ${DOCUMENTS} | ||
19 | include disable-common.inc | ||
20 | include disable-devel.inc | ||
21 | include disable-exec.inc | ||
22 | include disable-interpreters.inc | ||
23 | include disable-proc.inc | ||
24 | include disable-programs.inc | ||
25 | include disable-shell.inc | ||
26 | include disable-xdg.inc | ||
27 | include disable-X11.inc | ||
28 | |||
29 | mkfile ${HOME}/dead.letter | ||
30 | whitelist ${HOME}/dead.letter | ||
31 | whitelist ${DOCUMENTS} | ||
32 | whitelist ${DOWNLOADS} | ||
33 | include whitelist-common.inc | ||
34 | include whitelist-run-common.inc | ||
35 | include whitelist-runuser-common.inc | ||
36 | include whitelist-usr-share-common.inc | ||
37 | include whitelist-var-common.inc | ||
38 | |||
39 | apparmor | ||
40 | caps.drop all | ||
41 | ipc-namespace | ||
42 | machine-id | ||
43 | netfilter | ||
44 | no3d | ||
45 | nodvd | ||
46 | #nogroups breaks app | ||
47 | noinput | ||
48 | nonewprivs | ||
49 | noprinters | ||
50 | #noroot breaks app | ||
51 | nosound | ||
52 | notv | ||
53 | nou2f | ||
54 | novideo | ||
55 | protocol unix,inet,inet6 | ||
56 | seccomp | ||
57 | seccomp.block-secondary | ||
58 | tracelog | ||
59 | |||
60 | disable-mnt | ||
61 | # private works but then we lose ${HOME}/dead.letter | ||
62 | # which is useful to get notified on mail issues | ||
63 | #private | ||
64 | private-bin mailq,newaliases,sendmail,ssmtp | ||
65 | private-cache | ||
66 | private-dev | ||
67 | private-tmp | ||
68 | |||
69 | dbus-user none | ||
70 | dbus-system none | ||
71 | |||
72 | memory-deny-write-execute | ||
73 | restrict-namespaces | ||
74 | read-only ${HOME} | ||
75 | read-write ${HOME}/dead.letter | ||