diff options
author | 2020-12-15 20:06:10 +0000 | |
---|---|---|
committer | 2020-12-15 20:06:10 +0000 | |
commit | 95ad89d24e8e75f2f52defbb80d0d4ee0f27d31e (patch) | |
tree | 7be50ac3107bfa62f0227c7c6ff73528de84a422 /etc | |
parent | Refactor archivers (#3820) (diff) | |
download | firejail-95ad89d24e8e75f2f52defbb80d0d4ee0f27d31e.tar.gz firejail-95ad89d24e8e75f2f52defbb80d0d4ee0f27d31e.tar.zst firejail-95ad89d24e8e75f2f52defbb80d0d4ee0f27d31e.zip |
Refactor archivers ii (#3827)
* harden 7z.profile
* harden atool.profile
* harden bsdtar.profile
* harden cpio.profile
* harden gzip.profile
* harden tar.profile
* harden unrar.profile
* harden unzip.profile
* harden xzdec.profile
* harden zstd.profile
Diffstat (limited to 'etc')
-rw-r--r-- | etc/profile-a-l/7z.profile | 6 | ||||
-rw-r--r-- | etc/profile-a-l/atool.profile | 3 | ||||
-rw-r--r-- | etc/profile-a-l/bsdtar.profile | 2 | ||||
-rw-r--r-- | etc/profile-a-l/cpio.profile | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gzip.profile | 3 | ||||
-rw-r--r-- | etc/profile-m-z/tar.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/unrar.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/unzip.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzdec.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/zstd.profile | 1 |
10 files changed, 8 insertions, 20 deletions
diff --git a/etc/profile-a-l/7z.profile b/etc/profile-a-l/7z.profile index c7bed93ce..4f9e72a79 100644 --- a/etc/profile-a-l/7z.profile +++ b/etc/profile-a-l/7z.profile | |||
@@ -7,8 +7,8 @@ include 7z.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore include disable-shell.inc | 10 | noblacklist ${PATH}/bash |
11 | ignore nogroups | 11 | noblacklist ${PATH}/sh |
12 | include archiver-common.inc | 12 | include archiver-common.inc |
13 | 13 | ||
14 | #private-bin 7z,7z*,p7zip | 14 | private-bin 7z,7z*,bash,p7zip,sh |
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile index d8b6bbaaf..34af47df2 100644 --- a/etc/profile-a-l/atool.profile +++ b/etc/profile-a-l/atool.profile | |||
@@ -9,13 +9,10 @@ include globals.local | |||
9 | 9 | ||
10 | # Allow perl (blacklisted by disable-interpreters.inc) | 10 | # Allow perl (blacklisted by disable-interpreters.inc) |
11 | include allow-perl.inc | 11 | include allow-perl.inc |
12 | ignore include disable-devel.inc | ||
13 | ignore include disable-shell.inc | ||
14 | include archiver-common.inc | 12 | include archiver-common.inc |
15 | 13 | ||
16 | noroot | 14 | noroot |
17 | 15 | ||
18 | # private-bin atool,perl | ||
19 | # without login.defs atool complains and uses UID/GID 1000 by default | 16 | # without login.defs atool complains and uses UID/GID 1000 by default |
20 | private-etc alternatives,group,login.defs,passwd | 17 | private-etc alternatives,group,login.defs,passwd |
21 | private-tmp | 18 | private-tmp |
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile index 75e13e7e8..f2116f4ab 100644 --- a/etc/profile-a-l/bsdtar.profile +++ b/etc/profile-a-l/bsdtar.profile | |||
@@ -6,8 +6,6 @@ include bsdtar.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | ignore include disable-devel.inc | ||
10 | ignore include disable-shell.inc | ||
11 | include archiver-common.inc | 9 | include archiver-common.inc |
12 | 10 | ||
13 | # support compressed archives | 11 | # support compressed archives |
diff --git a/etc/profile-a-l/cpio.profile b/etc/profile-a-l/cpio.profile index 5e01952b4..785308ffd 100644 --- a/etc/profile-a-l/cpio.profile +++ b/etc/profile-a-l/cpio.profile | |||
@@ -10,7 +10,4 @@ include globals.local | |||
10 | noblacklist /sbin | 10 | noblacklist /sbin |
11 | noblacklist /usr/sbin | 11 | noblacklist /usr/sbin |
12 | 12 | ||
13 | ignore include disable-devel.inc | ||
14 | ignore include disable-interpreters.inc | ||
15 | ignore include disable-shell.inc | ||
16 | include archiver-common.inc | 13 | include archiver-common.inc |
diff --git a/etc/profile-a-l/gzip.profile b/etc/profile-a-l/gzip.profile index 96c1743e3..78ecf5116 100644 --- a/etc/profile-a-l/gzip.profile +++ b/etc/profile-a-l/gzip.profile | |||
@@ -10,5 +10,6 @@ include globals.local | |||
10 | # Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only. | 10 | # Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only. |
11 | noblacklist /var/lib/pacman | 11 | noblacklist /var/lib/pacman |
12 | 12 | ||
13 | ignore include disable-shell.inc | ||
14 | include archiver-common.inc | 13 | include archiver-common.inc |
14 | |||
15 | private-bin gunzip,gzexe,gzip,uncompress,zcat,zcmp,zdiff,zegrep,zfgrep,zforce,zgrep,zless,zmore,znew | ||
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile index 2ddc82dbb..29fda7e45 100644 --- a/etc/profile-m-z/tar.profile +++ b/etc/profile-m-z/tar.profile | |||
@@ -10,12 +10,13 @@ include globals.local | |||
10 | # Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only. | 10 | # Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only. |
11 | noblacklist /var/lib/pacman | 11 | noblacklist /var/lib/pacman |
12 | 12 | ||
13 | ignore include disable-shell.inc | 13 | noblacklist ${PATH}/bash |
14 | noblacklist ${PATH}/sh | ||
14 | include archiver-common.inc | 15 | include archiver-common.inc |
15 | 16 | ||
16 | # support compressed archives | 17 | # support compressed archives |
17 | private-bin awk,bash,bzip2,compress,firejail,grep,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz | 18 | private-bin awk,bash,bzip2,compress,firejail,grep,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz |
18 | private-etc alternatives,group,localtime,login.defs,passwd | 19 | private-etc alternatives,group,localtime,login.defs,passwd |
19 | private-lib libfakeroot | 20 | private-lib libfakeroot,liblzma.so.*,libreadline.so.* |
20 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) | 21 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) |
21 | writable-var | 22 | writable-var |
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile index cbf0e8679..9487f8e68 100644 --- a/etc/profile-m-z/unrar.profile +++ b/etc/profile-m-z/unrar.profile | |||
@@ -7,8 +7,6 @@ include unrar.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore nogroups | ||
11 | ignore private-cache | ||
12 | include archiver-common.inc | 10 | include archiver-common.inc |
13 | 11 | ||
14 | private-bin unrar | 12 | private-bin unrar |
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile index 30ee3ec12..be480923e 100644 --- a/etc/profile-m-z/unzip.profile +++ b/etc/profile-m-z/unzip.profile | |||
@@ -10,7 +10,6 @@ include globals.local | |||
10 | # GNOME Shell integration (chrome-gnome-shell) | 10 | # GNOME Shell integration (chrome-gnome-shell) |
11 | noblacklist ${HOME}/.local/share/gnome-shell | 11 | noblacklist ${HOME}/.local/share/gnome-shell |
12 | 12 | ||
13 | ignore nogroups | ||
14 | noroot | 13 | noroot |
15 | include archiver-common.inc | 14 | include archiver-common.inc |
16 | 15 | ||
diff --git a/etc/profile-m-z/xzdec.profile b/etc/profile-m-z/xzdec.profile index c21fe16cf..082392a08 100644 --- a/etc/profile-m-z/xzdec.profile +++ b/etc/profile-m-z/xzdec.profile | |||
@@ -7,6 +7,4 @@ include xzdec.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore include disable-shell.inc | ||
11 | ignore nogroups | ||
12 | include archiver-common.inc | 10 | include archiver-common.inc |
diff --git a/etc/profile-m-z/zstd.profile b/etc/profile-m-z/zstd.profile index 5ae38e633..42749ba6d 100644 --- a/etc/profile-m-z/zstd.profile +++ b/etc/profile-m-z/zstd.profile | |||
@@ -7,5 +7,4 @@ include zstd.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore include disable-shell.inc | ||
11 | include archiver-common.inc | 10 | include archiver-common.inc |