aboutsummaryrefslogtreecommitdiffstats
path: root/src/man/firejail.txt
diff options
context:
space:
mode:
authorLibravatar a1346054 <36859588+a1346054@users.noreply.github.com>2021-08-31 12:21:43 +0000
committerLibravatar a1346054 <36859588+a1346054@users.noreply.github.com>2021-09-25 19:09:14 +0000
commit6eafbfdfcc261b8d89ed22358ed9f351d4bf5bf2 (patch)
treec533c541f1a6b48967e193060041705a616bba73 /src/man/firejail.txt
parentprivate-lib fixup (diff)
downloadfirejail-6eafbfdfcc261b8d89ed22358ed9f351d4bf5bf2.tar.gz
firejail-6eafbfdfcc261b8d89ed22358ed9f351d4bf5bf2.tar.zst
firejail-6eafbfdfcc261b8d89ed22358ed9f351d4bf5bf2.zip
trim excess whitespace
Diffstat (limited to 'src/man/firejail.txt')
-rw-r--r--src/man/firejail.txt18
1 files changed, 9 insertions, 9 deletions
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 0462705c0..2883ab257 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -45,7 +45,7 @@ firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-deb
45#ifdef HAVE_LTS 45#ifdef HAVE_LTS
46This is Firejail long-term support (LTS), an enterprise focused version of the software, 46This is Firejail long-term support (LTS), an enterprise focused version of the software,
47LTS is usually supported for two or three years. 47LTS is usually supported for two or three years.
48During this time only bugs and the occasional documentation problems are fixed. 48During this time only bugs and the occasional documentation problems are fixed.
49The attack surface of the SUID executable was greatly reduced by removing some of the features. 49The attack surface of the SUID executable was greatly reduced by removing some of the features.
50.br 50.br
51 51
@@ -109,7 +109,7 @@ ptrace system call allows a full bypass of the seccomp filter.
109.br 109.br
110Example: 110Example:
111.br 111.br
112$ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox 112$ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox
113.TP 113.TP
114\fB\-\-allusers 114\fB\-\-allusers
115All directories under /home are visible inside the sandbox. By default, only current user home directory is visible. 115All directories under /home are visible inside the sandbox. By default, only current user home directory is visible.
@@ -947,7 +947,7 @@ $ firejail \-\-net=eth0 \-\-\iprange=192.168.1.100,192.168.1.150
947 947
948.TP 948.TP
949\fB\-\-ipc-namespace 949\fB\-\-ipc-namespace
950Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default 950Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default
951for sandboxes started as root. 951for sandboxes started as root.
952.br 952.br
953 953
@@ -1014,7 +1014,7 @@ $ sudo firejail --join-network=browser /sbin/iptables -vL
1014.br 1014.br
1015 1015
1016.br 1016.br
1017# verify IP addresses 1017# verify IP addresses
1018.br 1018.br
1019$ sudo firejail --join-network=browser ip addr 1019$ sudo firejail --join-network=browser ip addr
1020.br 1020.br
@@ -2134,7 +2134,7 @@ Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024).
2134.TP 2134.TP
2135\fB\-\-rlimit-cpu=number 2135\fB\-\-rlimit-cpu=number
2136Set the maximum limit, in seconds, for the amount of CPU time each 2136Set the maximum limit, in seconds, for the amount of CPU time each
2137sandboxed process can consume. When the limit is reached, the processes are killed. 2137sandboxed process can consume. When the limit is reached, the processes are killed.
2138 2138
2139The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds 2139The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds
2140the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps 2140the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps
@@ -2178,7 +2178,7 @@ $ firejail \-\-net=eth0 \-\-scan
2178.TP 2178.TP
2179\fB\-\-seccomp 2179\fB\-\-seccomp
2180Enable seccomp filter and blacklist the syscalls in the default list, 2180Enable seccomp filter and blacklist the syscalls in the default list,
2181which is @default-nodebuggers unless \-\-allow-debuggers is specified, 2181which is @default-nodebuggers unless \-\-allow-debuggers is specified,
2182then it is @default. 2182then it is @default.
2183 2183
2184.br 2184.br
@@ -2865,7 +2865,7 @@ and it is installed by default on most Linux distributions. It provides support
2865connection model. Untrusted clients are restricted in certain ways to prevent them from reading window 2865connection model. Untrusted clients are restricted in certain ways to prevent them from reading window
2866contents of other clients, stealing input events, etc. 2866contents of other clients, stealing input events, etc.
2867 2867
2868The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients 2868The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients
2869and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples. 2869and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples.
2870Firefox and transmission-gtk seem to be working fine. 2870Firefox and transmission-gtk seem to be working fine.
2871A network namespace is not required for this option. 2871A network namespace is not required for this option.
@@ -3256,7 +3256,7 @@ The owner of the sandbox.
3256.SH RESTRICTED SHELL 3256.SH RESTRICTED SHELL
3257To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in 3257To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in
3258/etc/passwd file for each user that needs to be restricted. Alternatively, 3258/etc/passwd file for each user that needs to be restricted. Alternatively,
3259you can specify /usr/bin/firejail in adduser command: 3259you can specify /usr/bin/firejail in adduser command:
3260 3260
3261adduser \-\-shell /usr/bin/firejail username 3261adduser \-\-shell /usr/bin/firejail username
3262 3262
@@ -3266,7 +3266,7 @@ Additional arguments passed to firejail executable upon login are declared in /e
3266Several command line options can be passed to the program using 3266Several command line options can be passed to the program using
3267profile files. Firejail chooses the profile file as follows: 3267profile files. Firejail chooses the profile file as follows:
3268 3268
32691. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME. 32691. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME.
3270Example: 3270Example:
3271.PP 3271.PP
3272.RS 3272.RS