aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
authorLibravatar rusty-snake <41237666+rusty-snake@users.noreply.github.com>2020-09-14 12:23:34 +0200
committerLibravatar rusty-snake <41237666+rusty-snake@users.noreply.github.com>2020-09-14 12:23:34 +0200
commit8d9b12d1c61000af20eb3ff39af712939ca8788a (patch)
tree876d1577d024f0a786531e59f3a90b8197dbb680 /etc
parentmake rpms: really fix man file inclusion (diff)
downloadfirejail-8d9b12d1c61000af20eb3ff39af712939ca8788a.tar.gz
firejail-8d9b12d1c61000af20eb3ff39af712939ca8788a.tar.zst
firejail-8d9b12d1c61000af20eb3ff39af712939ca8788a.zip
New profiles + fixes + hardening
- blacklist ~/.rustup in disable-devel.inc - add note to mpv (See #3628) - harden warsow - update relnotes - new profile qrencode, dbus-send, notify-send
Diffstat (limited to 'etc')
-rw-r--r--etc/inc/disable-devel.inc1
-rw-r--r--etc/profile-a-l/dbus-send.profile59
-rw-r--r--etc/profile-m-z/mpv.profile13
-rw-r--r--etc/profile-m-z/notify-send.profile60
-rw-r--r--etc/profile-m-z/qrencode.profile58
-rw-r--r--etc/profile-m-z/warsow.profile3
6 files changed, 194 insertions, 0 deletions
diff --git a/etc/inc/disable-devel.inc b/etc/inc/disable-devel.inc
index e1ba13380..e74b1b40b 100644
--- a/etc/inc/disable-devel.inc
+++ b/etc/inc/disable-devel.inc
@@ -49,6 +49,7 @@ blacklist ${PATH}/openssl-1.0
49blacklist ${PATH}/rust-gdb 49blacklist ${PATH}/rust-gdb
50blacklist ${PATH}/rust-lldb 50blacklist ${PATH}/rust-lldb
51blacklist ${PATH}/rustc 51blacklist ${PATH}/rustc
52blacklist ${HOME}/.rustup
52 53
53# tcc - Tiny C Compiler 54# tcc - Tiny C Compiler
54blacklist ${PATH}/tcc 55blacklist ${PATH}/tcc
diff --git a/etc/profile-a-l/dbus-send.profile b/etc/profile-a-l/dbus-send.profile
new file mode 100644
index 000000000..76a14d99b
--- /dev/null
+++ b/etc/profile-a-l/dbus-send.profile
@@ -0,0 +1,59 @@
1# Firejail profile for dbus-send
2# Description: Send a message to a message bus
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include dbus-send.local
7# Persistent global definitions
8include globals.local
9
10blacklist /tmp/.X11-unix
11blacklist ${RUNUSER}/wayland-*
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-write-mnt.inc
21include disable-xdg.inc
22
23include whitelist-common.inc
24include whitelist-runuser-common.inc
25include whitelist-usr-share-common.inc
26include whitelist-var-common.inc
27
28apparmor
29caps.drop all
30ipc-namespace
31machine-id
32# Breaks abstract sockets
33#net none
34netfilter
35no3d
36nodvd
37nogroups
38nonewprivs
39noroot
40nosound
41notv
42nou2f
43novideo
44protocol unix
45seccomp
46shell none
47tracelog
48
49disable-mnt
50private
51private-bin dbus-send
52private-cache
53private-dev
54private-etc alternatives,dbus-1
55private-lib libpcre2-8.so.0
56private-tmp
57
58memory-deny-write-execute
59read-only ${HOME}
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile
index 7ca57334d..08318d08e 100644
--- a/etc/profile-m-z/mpv.profile
+++ b/etc/profile-m-z/mpv.profile
@@ -11,6 +11,19 @@ include globals.local
11# edit ~/.config/mpv/foobar.conf: 11# edit ~/.config/mpv/foobar.conf:
12# screenshot-directory=~/Pictures 12# screenshot-directory=~/Pictures
13 13
14# Mpv has a powerfull lua-API, some off these lua-scripts interact
15# with external resources which are blocked by firejail. In such cases
16# you need to allow these resources by
17# - adding additional binaries to private-bin
18# - whitelisting additional paths
19# - noblacklisting paths
20# - weaking the dbus-policy
21# - ...
22#
23# Often these scripts require a shell:
24#noblacklist ${PATH}/sh
25#private-bin sh
26
14noblacklist ${HOME}/.config/mpv 27noblacklist ${HOME}/.config/mpv
15noblacklist ${HOME}/.config/youtube-dl 28noblacklist ${HOME}/.config/youtube-dl
16noblacklist ${HOME}/.netrc 29noblacklist ${HOME}/.netrc
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile
new file mode 100644
index 000000000..ff292f409
--- /dev/null
+++ b/etc/profile-m-z/notify-send.profile
@@ -0,0 +1,60 @@
1# Firejail profile for notify-send
2# Description: a program to send desktop notifications
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include notify-send.local
7# Persistent global definitions
8include globals.local
9
10blacklist ${RUNUSER}/wayland-*
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-shell.inc
19include disable-write-mnt.inc
20include disable-xdg.inc
21
22include whitelist-common.inc
23include whitelist-runuser-common.inc
24include whitelist-usr-share-common.inc
25include whitelist-var-common.inc
26
27apparmor
28caps.drop all
29ipc-namespace
30machine-id
31net none
32no3d
33nodvd
34nogroups
35nonewprivs
36noroot
37nosound
38notv
39nou2f
40novideo
41protocol unix
42seccomp
43shell none
44tracelog
45x11 none
46
47disable-mnt
48private
49private-bin notify-send
50private-cache
51private-dev
52private-etc none
53private-tmp
54
55dbus-user filter
56dbus-user.talk org.freedesktop.Notifications
57dbus-system none
58
59memory-deny-write-execute
60read-only ${HOME}
diff --git a/etc/profile-m-z/qrencode.profile b/etc/profile-m-z/qrencode.profile
new file mode 100644
index 000000000..5e49a342a
--- /dev/null
+++ b/etc/profile-m-z/qrencode.profile
@@ -0,0 +1,58 @@
1# Firejail profile for qrencode
2# Description: Encode input data in a QR Code and save as a PNG or EPS image.
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include qrencode.local
7# Persistent global definitions
8include globals.local
9
10blacklist ${RUNUSER}/wayland-*
11blacklist ${RUNUSER}
12
13include disable-common.inc
14include disable-devel.inc
15include disable-exec.inc
16include disable-interpreters.inc
17include disable-passwdmgr.inc
18include disable-programs.inc
19include disable-shell.inc
20include disable-write-mnt.inc
21include disable-xdg.inc
22
23include whitelist-runuser-common.inc
24include whitelist-usr-share-common.inc
25include whitelist-var-common.inc
26
27apparmor
28caps.drop all
29ipc-namespace
30machine-id
31net none
32no3d
33nodvd
34nogroups
35nonewprivs
36noroot
37nosound
38notv
39nou2f
40novideo
41protocol unix
42seccomp
43shell none
44tracelog
45x11 none
46
47disable-mnt
48private-bin qrencode
49private-cache
50private-dev
51private-etc none
52private-lib libpcre2-8.so.0
53private-tmp
54
55dbus-user none
56dbus-system none
57
58memory-deny-write-execute
diff --git a/etc/profile-m-z/warsow.profile b/etc/profile-m-z/warsow.profile
index d8cd5557e..178e0c7b1 100644
--- a/etc/profile-m-z/warsow.profile
+++ b/etc/profile-m-z/warsow.profile
@@ -24,7 +24,10 @@ mkdir ${HOME}/.cache/warsow-2.1
24mkdir ${HOME}/.local/share/warsow-2.1 24mkdir ${HOME}/.local/share/warsow-2.1
25whitelist ${HOME}/.cache/warsow-2.1 25whitelist ${HOME}/.cache/warsow-2.1
26whitelist ${HOME}/.local/share/warsow-2.1 26whitelist ${HOME}/.local/share/warsow-2.1
27whitelist /usr/share/warsow
27include whitelist-common.inc 28include whitelist-common.inc
29include whitelist-runuser-common.inc
30include whitelist-usr-share-common.inc
28include whitelist-var-common.inc 31include whitelist-var-common.inc
29 32
30caps.drop all 33caps.drop all
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-18 22:22:30 +0000