aboutsummaryrefslogtreecommitdiffstats
path: root/etc
diff options
context:
space:
mode:
authorLibravatar netblue30 <netblue30@yahoo.com>2020-03-18 22:17:59 -0400
committerLibravatar netblue30 <netblue30@yahoo.com>2020-03-18 22:17:59 -0400
commit3c555a6ca44323c846d958e9ad5dcda540a25e95 (patch)
tree88789ef47c8cf60290c1f5bd33e89aba575626d2 /etc
parentprofile fixes (diff)
downloadfirejail-3c555a6ca44323c846d958e9ad5dcda540a25e95.tar.gz
firejail-3c555a6ca44323c846d958e9ad5dcda540a25e95.tar.zst
firejail-3c555a6ca44323c846d958e9ad5dcda540a25e95.zip
nslookup, host profiles
Diffstat (limited to 'etc')
-rw-r--r--etc/dig.profile2
-rw-r--r--etc/disable-common.inc15
-rw-r--r--etc/host.profile49
-rw-r--r--etc/nslookup.profile49
4 files changed, 114 insertions, 1 deletions
diff --git a/etc/dig.profile b/etc/dig.profile
index 0e1598406..e6b7e46d9 100644
--- a/etc/dig.profile
+++ b/etc/dig.profile
@@ -8,6 +8,7 @@ include dig.local
8include globals.local 8include globals.local
9 9
10noblacklist ${HOME}/.digrc 10noblacklist ${HOME}/.digrc
11noblacklist ${PATH}/dig
11 12
12blacklist /tmp/.X11-unix 13blacklist /tmp/.X11-unix
13 14
@@ -48,7 +49,6 @@ tracelog
48disable-mnt 49disable-mnt
49private 50private
50private-bin bash,dig,sh 51private-bin bash,dig,sh
51private-cache
52private-dev 52private-dev
53# Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038) 53# Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038)
54#private-lib 54#private-lib
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index 6f9149dee..6ff83964d 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -469,3 +469,18 @@ blacklist ${HOME}/sent
469 469
470# kernel configuration 470# kernel configuration
471blacklist /proc/config.gz 471blacklist /proc/config.gz
472
473# prevent DNS malware attempting to communicate with the server
474# using regular DNS tools
475blacklist ${PATH}/dig
476blacklist ${PATH}/kdig
477blacklist ${PATH}/nslookup
478blacklist ${PATH}/host
479blacklist ${PATH}/dlint
480blacklist ${PATH}/dnswalk
481blacklist ${PATH}/dns2tcp
482blacklist ${PATH}/iodine
483blacklist ${PATH}/knsupdate
484
485
486
diff --git a/etc/host.profile b/etc/host.profile
new file mode 100644
index 000000000..7e2012597
--- /dev/null
+++ b/etc/host.profile
@@ -0,0 +1,49 @@
1# Firejail profile for dig
2# Description: DNS lookup utility
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include host.local
7# Persistent global definitions
8include globals.local
9
10noblacklist ${PATH}/host
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-xdg.inc
19
20include whitelist-usr-share-common.inc
21include whitelist-var-common.inc
22
23apparmor
24caps.drop all
25ipc-namespace
26machine-id
27netfilter
28no3d
29nodbus
30nodvd
31nogroups
32nonewprivs
33noroot
34nosound
35notv
36nou2f
37novideo
38protocol unix,inet,inet6
39seccomp
40shell none
41tracelog
42
43disable-mnt
44private
45private-bin bash,host,sh
46private-dev
47private-tmp
48
49memory-deny-write-execute
diff --git a/etc/nslookup.profile b/etc/nslookup.profile
new file mode 100644
index 000000000..40897a3a8
--- /dev/null
+++ b/etc/nslookup.profile
@@ -0,0 +1,49 @@
1# Firejail profile for dig
2# Description: DNS lookup utility
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include nslookup.local
7# Persistent global definitions
8include globals.local
9
10noblacklist ${PATH}/nslookup
11
12include disable-common.inc
13include disable-devel.inc
14include disable-exec.inc
15include disable-interpreters.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18include disable-xdg.inc
19
20include whitelist-usr-share-common.inc
21include whitelist-var-common.inc
22
23apparmor
24caps.drop all
25ipc-namespace
26machine-id
27netfilter
28no3d
29nodbus
30nodvd
31nogroups
32nonewprivs
33noroot
34nosound
35notv
36nou2f
37novideo
38protocol unix,inet,inet6
39seccomp
40shell none
41tracelog
42
43disable-mnt
44private
45private-bin bash,nslookup,sh
46private-dev
47private-tmp
48
49memory-deny-write-execute