diff options
-rw-r--r-- | .github/ISSUE_TEMPLATE/bug_report.md | 48 | ||||
-rw-r--r-- | .gitignore | 4 | ||||
-rw-r--r-- | .gitlab-ci.yml | 31 | ||||
-rw-r--r-- | Makefile.in | 192 | ||||
-rw-r--r-- | README | 43 | ||||
-rw-r--r-- | README.md | 49 | ||||
-rw-r--r-- | RELNOTES | 40 | ||||
-rw-r--r-- | SECURITY.md | 4 | ||||
-rwxr-xr-x | configure | 25 | ||||
-rw-r--r-- | configure.ac | 4 | ||||
-rwxr-xr-x | contrib/syscalls.sh | 38 | ||||
-rwxr-xr-x | contrib/update_deb.sh | 12 | ||||
-rw-r--r-- | dummy.c | 7 | ||||
-rw-r--r-- | etc-fixes/0.9.52/atom.profile | 31 | ||||
-rw-r--r-- | etc-fixes/0.9.58/atom.profile | 36 | ||||
-rw-r--r-- | etc-fixes/0.9.60/atom.profile | 37 | ||||
-rw-r--r-- | etc/Thunar.profile | 33 | ||||
-rw-r--r-- | etc/apparmor/firejail-default (renamed from etc/firejail-default) | 8 | ||||
-rw-r--r-- | etc/apparmor/firejail-local (renamed from etc/firejail-local) | 0 | ||||
-rw-r--r-- | etc/caja.profile | 43 | ||||
-rw-r--r-- | etc/dolphin.profile | 39 | ||||
-rw-r--r-- | etc/firejail.config | 39 | ||||
-rw-r--r-- | etc/inc/allow-common-devel.inc (renamed from etc/allow-common-devel.inc) | 6 | ||||
-rw-r--r-- | etc/inc/allow-gjs.inc (renamed from etc/allow-gjs.inc) | 1 | ||||
-rw-r--r-- | etc/inc/allow-java.inc (renamed from etc/allow-java.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-lua.inc (renamed from etc/allow-lua.inc) | 4 | ||||
-rw-r--r-- | etc/inc/allow-perl.inc (renamed from etc/allow-perl.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-php.inc (renamed from etc/allow-php.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-python2.inc (renamed from etc/allow-python2.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-python3.inc (renamed from etc/allow-python3.inc) | 0 | ||||
-rw-r--r-- | etc/inc/allow-ruby.inc (renamed from etc/allow-ruby.inc) | 0 | ||||
-rw-r--r-- | etc/inc/disable-common.inc (renamed from etc/disable-common.inc) | 76 | ||||
-rw-r--r-- | etc/inc/disable-devel.inc (renamed from etc/disable-devel.inc) | 1 | ||||
-rw-r--r-- | etc/inc/disable-exec.inc (renamed from etc/disable-exec.inc) | 0 | ||||
-rw-r--r-- | etc/inc/disable-interpreters.inc (renamed from etc/disable-interpreters.inc) | 6 | ||||
-rw-r--r-- | etc/inc/disable-passwdmgr.inc (renamed from etc/disable-passwdmgr.inc) | 0 | ||||
-rw-r--r-- | etc/inc/disable-programs.inc (renamed from etc/disable-programs.inc) | 117 | ||||
-rw-r--r-- | etc/inc/disable-shell.inc | 13 | ||||
-rw-r--r-- | etc/inc/disable-xdg.inc (renamed from etc/disable-xdg.inc) | 0 | ||||
-rw-r--r-- | etc/inc/feh-network.inc (renamed from etc/feh-network.inc) | 0 | ||||
-rw-r--r-- | etc/inc/firefox-common-addons.inc (renamed from etc/firefox-common-addons.inc) | 5 | ||||
-rw-r--r-- | etc/inc/softmaker-common.inc (renamed from etc/softmaker-common.inc) | 4 | ||||
-rw-r--r-- | etc/inc/whitelist-common.inc (renamed from etc/whitelist-common.inc) | 3 | ||||
-rw-r--r-- | etc/inc/whitelist-runuser-common.inc | 12 | ||||
-rw-r--r-- | etc/inc/whitelist-usr-share-common.inc (renamed from etc/whitelist-usr-share-common.inc) | 5 | ||||
-rw-r--r-- | etc/inc/whitelist-var-common.inc (renamed from etc/whitelist-var-common.inc) | 0 | ||||
-rw-r--r-- | etc/keepassxc.profile | 56 | ||||
-rw-r--r-- | etc/nautilus.profile | 44 | ||||
-rw-r--r-- | etc/nemo.profile | 38 | ||||
-rw-r--r-- | etc/net/nolocal.net (renamed from etc/nolocal.net) | 2 | ||||
-rw-r--r-- | etc/net/tcpserver.net (renamed from etc/tcpserver.net) | 0 | ||||
-rw-r--r-- | etc/net/webserver.net (renamed from etc/webserver.net) | 0 | ||||
-rw-r--r-- | etc/pcmanfm.profile | 33 | ||||
-rw-r--r-- | etc/profile-a-l/0ad.profile (renamed from etc/0ad.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/2048-qt.profile (renamed from etc/2048-qt.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/7z.profile (renamed from etc/7z.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/7za.profile (renamed from etc/7za.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/7zr.profile (renamed from etc/7zr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Builder.profile (renamed from etc/Builder.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Cheese.profile (renamed from etc/Cheese.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Cryptocat.profile (renamed from etc/Cryptocat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Cyberfox.profile (renamed from etc/Cyberfox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Discord.profile (renamed from etc/Discord.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/DiscordCanary.profile (renamed from etc/DiscordCanary.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Documents.profile (renamed from etc/Documents.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/FossaMail.profile (renamed from etc/FossaMail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Fritzing.profile (renamed from etc/Fritzing.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/Gitter.profile (renamed from etc/Gitter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/JDownloader.profile (renamed from etc/JDownloader.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/Logs.profile (renamed from etc/Logs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/abiword.profile | 49 | ||||
-rw-r--r-- | etc/profile-a-l/abrowser.profile (renamed from etc/abrowser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/acat.profile (renamed from etc/acat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/adiff.profile (renamed from etc/adiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/akonadi_control.profile (renamed from etc/akonadi_control.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/akregator.profile (renamed from etc/akregator.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/als.profile (renamed from etc/als.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/amarok.profile (renamed from etc/amarok.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/amule.profile (renamed from etc/amule.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/amuled.profile (renamed from etc/amuled.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/android-studio.profile (renamed from etc/android-studio.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/anki.profile (renamed from etc/anki.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/anydesk.profile (renamed from etc/anydesk.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/aosp.profile (renamed from etc/aosp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/apack.profile (renamed from etc/apack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/apktool.profile (renamed from etc/apktool.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/apostrophe.profile | 58 | ||||
-rw-r--r-- | etc/profile-a-l/ar.profile (renamed from etc/ar.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/arch-audit.profile (renamed from etc/arch-audit.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/archaudit-report.profile (renamed from etc/archaudit-report.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ardour4.profile (renamed from etc/ardour4.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ardour5.profile (renamed from etc/ardour5.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/arduino.profile (renamed from etc/arduino.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/arepack.profile (renamed from etc/arepack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/aria2c.profile (renamed from etc/aria2c.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/ark.profile (renamed from etc/ark.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/arm.profile (renamed from etc/arm.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/artha.profile (renamed from etc/artha.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/assogiate.profile (renamed from etc/assogiate.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/asunder.profile (renamed from etc/asunder.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/atom-beta.profile (renamed from etc/atom-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/atom.profile (renamed from etc/atom.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/atool.profile (renamed from etc/atool.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/atril-previewer.profile (renamed from etc/atril-previewer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/atril-thumbnailer.profile (renamed from etc/atril-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/atril.profile (renamed from etc/atril.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/audacious.profile (renamed from etc/audacious.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/audacity.profile (renamed from etc/audacity.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/audio-recorder.profile (renamed from etc/audio-recorder.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/aunpack.profile (renamed from etc/aunpack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/authenticator.profile (renamed from etc/authenticator.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-common.profile (renamed from etc/autokey-common.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-gtk.profile (renamed from etc/autokey-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-qt.profile (renamed from etc/autokey-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-run.profile (renamed from etc/autokey-run.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/autokey-shell.profile (renamed from etc/autokey-shell.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/aweather.profile (renamed from etc/aweather.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/awesome.profile (renamed from etc/awesome.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/baloo_file.profile (renamed from etc/baloo_file.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/baloo_filemetadata_temp_extractor.profile (renamed from etc/baloo_filemetadata_temp_extractor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/baobab.profile (renamed from etc/baobab.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/barrier.profile (renamed from etc/barrier.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/basilisk.profile (renamed from etc/basilisk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/beaker.profile (renamed from etc/beaker.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bibletime.profile (renamed from etc/bibletime.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/bibtex.profile (renamed from etc/bibtex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bijiben.profile | 58 | ||||
-rw-r--r-- | etc/profile-a-l/bitcoin-qt.profile (renamed from etc/bitcoin-qt.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/bitlbee.profile (renamed from etc/bitlbee.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bitwarden.profile (renamed from etc/bitwarden.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/blackbox.profile (renamed from etc/blackbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bleachbit.profile (renamed from etc/bleachbit.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/blender-2.8.profile (renamed from etc/blender-2.8.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/blender.profile (renamed from etc/blender.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/bless.profile (renamed from etc/bless.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/blobwars.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/bluefish.profile (renamed from etc/bluefish.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/bnox.profile (renamed from etc/bnox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brackets.profile (renamed from etc/brackets.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brasero.profile (renamed from etc/brasero.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-beta.profile (renamed from etc/brave-browser-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-dev.profile (renamed from etc/brave-browser-dev.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-nightly.profile (renamed from etc/brave-browser-nightly.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser-stable.profile (renamed from etc/brave-browser-stable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave-browser.profile (renamed from etc/brave-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/brave.profile (renamed from etc/brave.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bsdcat.profile (renamed from etc/bsdcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bsdcpio.profile (renamed from etc/bsdcpio.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bsdtar.profile (renamed from etc/bsdtar.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/bunzip2.profile (renamed from etc/bunzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bzcat.profile (renamed from etc/bzcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/bzflag.profile (renamed from etc/bzflag.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/bzip2.profile (renamed from etc/bzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/caja.profile | 15 | ||||
-rw-r--r-- | etc/profile-a-l/calibre.profile (renamed from etc/calibre.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/calligra.profile (renamed from etc/calligra.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/calligraauthor.profile (renamed from etc/calligraauthor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/calligraconverter.profile (renamed from etc/calligraconverter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/calligraflow.profile (renamed from etc/calligraflow.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/calligraplan.profile (renamed from etc/calligraplan.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligraplanwork.profile (renamed from etc/calligraplanwork.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligrasheets.profile (renamed from etc/calligrasheets.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligrastage.profile (renamed from etc/calligrastage.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/calligrawords.profile (renamed from etc/calligrawords.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/cameramonitor.profile (renamed from etc/cameramonitor.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/cantata.profile (renamed from etc/cantata.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/catfish.profile (renamed from etc/catfish.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/cawbird.profile | 46 | ||||
-rw-r--r-- | etc/profile-a-l/celluloid.profile (renamed from etc/celluloid.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/checkbashisms.profile (renamed from etc/checkbashisms.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/cheese.profile (renamed from etc/cheese.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/cherrytree.profile (renamed from etc/cherrytree.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/chromium-browser.profile (renamed from etc/chromium-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/chromium-common.profile (renamed from etc/chromium-common.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/chromium.profile (renamed from etc/chromium.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cin.profile (renamed from etc/cin.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/cinelerra.profile (renamed from etc/cinelerra.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamav.profile (renamed from etc/clamav.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/clamdscan.profile (renamed from etc/clamdscan.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamdtop.profile (renamed from etc/clamdtop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamscan.profile (renamed from etc/clamscan.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clamtk.profile (renamed from etc/clamtk.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/claws-mail.profile (renamed from etc/claws-mail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clawsker.profile (renamed from etc/clawsker.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/clementine.profile (renamed from etc/clementine.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clion.profile (renamed from etc/clion.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clipgrab.profile (renamed from etc/clipgrab.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/clipit.profile (renamed from etc/clipit.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cliqz.profile (renamed from etc/cliqz.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/clocks.profile (renamed from etc/clocks.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cmus.profile (renamed from etc/cmus.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/code-oss.profile (renamed from etc/code-oss.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/code.profile (renamed from etc/code.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/com.github.dahenson.agenda.profile | 66 | ||||
-rw-r--r-- | etc/profile-a-l/com.github.johnfactotum.Foliate.profile (renamed from etc/com.github.johnfactotum.Foliate.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/com.gitlab.newsflash.profile | 5 | ||||
-rw-r--r-- | etc/profile-a-l/conkeror.profile (renamed from etc/conkeror.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/conky.profile (renamed from etc/conky.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/conplay.profile (renamed from etc/conplay.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/corebird.profile (renamed from etc/corebird.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/cower.profile (renamed from etc/cower.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/cpio.profile (renamed from etc/cpio.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/crawl-tiles.profile (renamed from etc/crawl-tiles.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/crawl.profile (renamed from etc/crawl.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/crow.profile (renamed from etc/crow.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/cryptocat.profile (renamed from etc/cryptocat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/curl.profile (renamed from etc/curl.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/cvlc.profile (renamed from etc/cvlc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/cyberfox.profile (renamed from etc/cyberfox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/d-feet.profile (renamed from etc/d-feet.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/darktable.profile (renamed from etc/darktable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dconf-editor.profile (renamed from etc/dconf-editor.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/dconf.profile (renamed from etc/dconf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ddgtk.profile (renamed from etc/ddgtk.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/deadbeef.profile (renamed from etc/deadbeef.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/default.profile (renamed from etc/default.profile) | 14 | ||||
-rw-r--r-- | etc/profile-a-l/deluge.profile (renamed from etc/deluge.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/desktopeditors.profile (renamed from etc/desktopeditors.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/devhelp.profile (renamed from etc/devhelp.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/devilspie.profile (renamed from etc/devilspie.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/devilspie2.profile (renamed from etc/devilspie2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dex2jar.profile (renamed from etc/dex2jar.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/dia.profile (renamed from etc/dia.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/dig.profile (renamed from etc/dig.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/digikam.profile (renamed from etc/digikam.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/dillo.profile (renamed from etc/dillo.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dino-im.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/dino.profile (renamed from etc/dino.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/discord-canary.profile (renamed from etc/discord-canary.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/discord-common.profile (renamed from etc/discord-common.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/discord.profile (renamed from etc/discord.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/display.profile (renamed from etc/display.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/dnox.profile (renamed from etc/dnox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dnscrypt-proxy.profile (renamed from etc/dnscrypt-proxy.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/dnsmasq.profile (renamed from etc/dnsmasq.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dolphin.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/dooble-qt4.profile (renamed from etc/dooble-qt4.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dooble.profile (renamed from etc/dooble.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/dosbox.profile (renamed from etc/dosbox.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/dragon.profile (renamed from etc/dragon.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/drawio.profile (renamed from etc/drawio.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/dropbox.profile (renamed from etc/dropbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/easystroke.profile (renamed from etc/easystroke.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/ebook-viewer.profile (renamed from etc/ebook-viewer.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/electron-mail.profile (renamed from etc/electron-mail.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/electron.profile (renamed from etc/electron.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/electrum.profile (renamed from etc/electrum.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/element-desktop.profile | 22 | ||||
-rw-r--r-- | etc/profile-a-l/elinks.profile (renamed from etc/elinks.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/emacs.profile (renamed from etc/emacs.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/email-common.profile (renamed from etc/email-common.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/empathy.profile (renamed from etc/empathy.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant-2.profile (renamed from etc/enchant-2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant-lsmod-2.profile (renamed from etc/enchant-lsmod-2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant-lsmod.profile (renamed from etc/enchant-lsmod.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enchant.profile (renamed from etc/enchant.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/engrampa.profile (renamed from etc/engrampa.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/enox.profile (renamed from etc/enox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/enpass.profile (renamed from etc/enpass.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/eo-common.profile (renamed from etc/eo-common.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/eog.profile (renamed from etc/eog.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/eom.profile (renamed from etc/eom.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ephemeral.profile (renamed from etc/ephemeral.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/epiphany.profile (renamed from etc/epiphany.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/et.profile (renamed from etc/et.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/etr.profile (renamed from etc/etr.profile) | 9 | ||||
-rw-r--r-- | etc/profile-a-l/evince-previewer.profile (renamed from etc/evince-previewer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/evince-thumbnailer.profile (renamed from etc/evince-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/evince.profile (renamed from etc/evince.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/evolution.profile (renamed from etc/evolution.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/exfalso.profile (renamed from etc/exfalso.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/exiftool.profile (renamed from etc/exiftool.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/falkon.profile (renamed from etc/falkon.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/fbreader.profile (renamed from etc/fbreader.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/fdns.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/feedreader.profile (renamed from etc/feedreader.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/feh.profile (renamed from etc/feh.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/ferdi.profile | 46 | ||||
-rw-r--r-- | etc/profile-a-l/fetchmail.profile (renamed from etc/fetchmail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ffmpeg.profile (renamed from etc/ffmpeg.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/ffmpegthumbnailer.profile (renamed from etc/ffmpegthumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ffplay.profile (renamed from etc/ffplay.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ffprobe.profile (renamed from etc/ffprobe.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/file-manager-common.profile | 52 | ||||
-rw-r--r-- | etc/profile-a-l/file-roller.profile (renamed from etc/file-roller.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/file.profile (renamed from etc/file.profile) | 9 | ||||
-rw-r--r-- | etc/profile-a-l/filezilla.profile (renamed from etc/filezilla.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-beta.profile (renamed from etc/firefox-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-common.profile (renamed from etc/firefox-common.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-developer-edition.profile (renamed from etc/firefox-developer-edition.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-esr.profile (renamed from etc/firefox-esr.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-nightly.profile (renamed from etc/firefox-nightly.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-wayland.profile (renamed from etc/firefox-wayland.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-x11.profile (renamed from etc/firefox-x11.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/firefox.profile (renamed from etc/firefox.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/five-or-more.profile | 21 | ||||
-rw-r--r-- | etc/profile-a-l/flacsplt.profile (renamed from etc/flacsplt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/flameshot.profile (renamed from etc/flameshot.profile) | 17 | ||||
-rw-r--r-- | etc/profile-a-l/flashpeak-slimjet.profile (renamed from etc/flashpeak-slimjet.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/flowblade.profile (renamed from etc/flowblade.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/fluxbox.profile (renamed from etc/fluxbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/font-manager.profile (renamed from etc/font-manager.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/fontforge.profile (renamed from etc/fontforge.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/fossamail.profile (renamed from etc/fossamail.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/four-in-a-row.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/franz.profile (renamed from etc/franz.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freecad.profile (renamed from etc/freecad.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/freecadcmd.profile (renamed from etc/freecadcmd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freeciv-gtk3.profile (renamed from etc/freeciv-gtk3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freeciv-mp-gtk3.profile (renamed from etc/freeciv-mp-gtk3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/freeciv.profile (renamed from etc/freeciv.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/freecol.profile (renamed from etc/freecol.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/freemind.profile (renamed from etc/freemind.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/freeoffice-planmaker.profile (renamed from etc/freeoffice-planmaker.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/freeoffice-presentations.profile (renamed from etc/freeoffice-presentations.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/freeoffice-textmaker.profile (renamed from etc/freeoffice-textmaker.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/freetube.profile | 31 | ||||
-rw-r--r-- | etc/profile-a-l/freshclam.profile (renamed from etc/freshclam.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/frogatto.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/frozen-bubble.profile (renamed from etc/frozen-bubble.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gajim-history-manager.profile (renamed from etc/gajim-history-manager.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gajim.profile (renamed from etc/gajim.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/galculator.profile (renamed from etc/galculator.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gapplication.profile | 71 | ||||
-rw-r--r-- | etc/profile-a-l/gcalccmd.profile (renamed from etc/gcalccmd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gcloud.profile (renamed from etc/gcloud.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gconf-editor.profile (renamed from etc/gconf-editor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconf-merge-schema.profile (renamed from etc/gconf-merge-schema.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconf-merge-tree.profile (renamed from etc/gconf-merge-tree.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconf.profile (renamed from etc/gconf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconfpkg.profile (renamed from etc/gconfpkg.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gconftool-2.profile (renamed from etc/gconftool-2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/geany.profile (renamed from etc/geany.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/geary.profile (renamed from etc/geary.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gedit.profile (renamed from etc/gedit.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/geekbench.profile (renamed from etc/geekbench.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/geeqie.profile (renamed from etc/geeqie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gfeeds.profile (renamed from etc/gfeeds.profile) | 8 | ||||
-rw-r--r-- | etc/profile-a-l/ghb.profile (renamed from etc/ghb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ghostwriter.profile (renamed from etc/ghostwriter.profile) | 15 | ||||
-rw-r--r-- | etc/profile-a-l/gimp-2.10.profile (renamed from etc/gimp-2.10.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gimp-2.8.profile (renamed from etc/gimp-2.8.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gimp.profile (renamed from etc/gimp.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gist-paste.profile (renamed from etc/gist-paste.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gist.profile (renamed from etc/gist.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/git-cola.profile | 66 | ||||
-rw-r--r-- | etc/profile-a-l/git.profile (renamed from etc/git.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gitg.profile (renamed from etc/gitg.profile) | 16 | ||||
-rw-r--r-- | etc/profile-a-l/github-desktop.profile (renamed from etc/github-desktop.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gitter.profile (renamed from etc/gitter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gjs.profile (renamed from etc/gjs.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/globaltime.profile (renamed from etc/globaltime.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gmpc.profile (renamed from etc/gmpc.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-2048.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-books.profile (renamed from etc/gnome-books.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-builder.profile (renamed from etc/gnome-builder.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-calculator.profile (renamed from etc/gnome-calculator.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-calendar.profile | 62 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-character-map.profile (renamed from etc/gnome-character-map.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-characters.profile (renamed from etc/gnome-characters.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-chess.profile (renamed from etc/gnome-chess.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-clocks.profile (renamed from etc/gnome-clocks.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-contacts.profile (renamed from etc/gnome-contacts.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-documents.profile (renamed from etc/gnome-documents.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-font-viewer.profile (renamed from etc/gnome-font-viewer.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-hexgl.profile (renamed from etc/gnome-hexgl.profile) | 10 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-keyring-3.profile (renamed from etc/gnome-keyring-3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-keyring.profile (renamed from etc/gnome-keyring.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-klotski.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-latex.profile (renamed from etc/gnome-latex.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-logs.profile (renamed from etc/gnome-logs.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mahjongg.profile | 16 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-maps.profile (renamed from etc/gnome-maps.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mines.profile | 20 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mplayer.profile (renamed from etc/gnome-mplayer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-mpv.profile (renamed from etc/gnome-mpv.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-music.profile (renamed from etc/gnome-music.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-nettool.profile (renamed from etc/gnome-nettool.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-nibbles.profile | 23 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-passwordsafe.profile (renamed from etc/gnome-passwordsafe.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-photos.profile (renamed from etc/gnome-photos.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-pie.profile (renamed from etc/gnome-pie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-pomodoro.profile | 59 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-recipes.profile (renamed from etc/gnome-recipes.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-ring.profile (renamed from etc/gnome-ring.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-robots.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-schedule.profile (renamed from etc/gnome-schedule.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-screenshot.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-sound-recorder.profile (renamed from etc/gnome-sound-recorder.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-sudoku.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-system-log.profile (renamed from etc/gnome-system-log.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-taquin.profile | 19 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-tetravex.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-todo.profile | 64 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-twitch.profile (renamed from etc/gnome-twitch.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gnome-weather.profile (renamed from etc/gnome-weather.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gnome_games-common.profile | 48 | ||||
-rw-r--r-- | etc/profile-a-l/gnote.profile | 59 | ||||
-rw-r--r-- | etc/profile-a-l/gnubik.profile | 50 | ||||
-rw-r--r-- | etc/profile-a-l/godot.profile (renamed from etc/godot.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/goobox.profile (renamed from etc/goobox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome-beta.profile (renamed from etc/google-chrome-beta.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome-stable.profile (renamed from etc/google-chrome-stable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome-unstable.profile (renamed from etc/google-chrome-unstable.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/google-chrome.profile (renamed from etc/google-chrome.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/google-earth-pro.profile (renamed from etc/google-earth-pro.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-earth.profile (renamed from etc/google-earth.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/google-play-music-desktop-player.profile (renamed from etc/google-play-music-desktop-player.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gpa.profile (renamed from etc/gpa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gpg-agent.profile (renamed from etc/gpg-agent.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gpg.profile (renamed from etc/gpg.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gpg2.profile (renamed from etc/gpg2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gpicview.profile (renamed from etc/gpicview.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gpredict.profile (renamed from etc/gpredict.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gradio.profile (renamed from etc/gradio.profile) | 15 | ||||
-rw-r--r-- | etc/profile-a-l/gramps.profile (renamed from etc/gramps.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/gravity-beams-and-evaporating-stars.profile | 47 | ||||
-rw-r--r-- | etc/profile-a-l/gsettings-data-convert.profile (renamed from etc/gsettings-data-convert.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gsettings-schema-convert.profile (renamed from etc/gsettings-schema-convert.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gsettings.profile (renamed from etc/gsettings.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gtar.profile (renamed from etc/gtar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gthumb.profile (renamed from etc/gthumb.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gtk-update-icon-cache.profile (renamed from etc/gtk-update-icon-cache.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/gtk-youtube-viewer | 18 | ||||
-rw-r--r-- | etc/profile-a-l/gtk2-youtube-viewer | 18 | ||||
-rw-r--r-- | etc/profile-a-l/gtk3-youtube-viewer | 18 | ||||
-rw-r--r-- | etc/profile-a-l/guayadeque.profile (renamed from etc/guayadeque.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gucharmap.profile (renamed from etc/gucharmap.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/gummi.profile (renamed from etc/gummi.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/gunzip.profile (renamed from etc/gunzip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gwenview.profile (renamed from etc/gwenview.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/gzexe.profile (renamed from etc/gzexe.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/gzip.profile (renamed from etc/gzip.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/handbrake-gtk.profile (renamed from etc/handbrake-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/handbrake.profile (renamed from etc/handbrake.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/hashcat.profile (renamed from etc/hashcat.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/hedgewars.profile (renamed from etc/hedgewars.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/hexchat.profile (renamed from etc/hexchat.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/highlight.profile (renamed from etc/highlight.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/hitori.profile | 14 | ||||
-rw-r--r-- | etc/profile-a-l/homebank.profile | 59 | ||||
-rw-r--r-- | etc/profile-a-l/host.profile | 52 | ||||
-rw-r--r-- | etc/profile-a-l/hugin.profile (renamed from etc/hugin.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/hyperrogue.profile | 51 | ||||
-rw-r--r-- | etc/profile-a-l/i2prouter.profile (renamed from etc/i2prouter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/i3.profile (renamed from etc/i3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iagno.profile (renamed from etc/gnome-2048.profile) | 24 | ||||
-rw-r--r-- | etc/profile-a-l/icecat.profile (renamed from etc/icecat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/icedove.profile (renamed from etc/icedove.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iceweasel.profile (renamed from etc/iceweasel.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/idea.profile (renamed from etc/idea.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/idea.sh.profile (renamed from etc/idea.sh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ideaIC.profile (renamed from etc/ideaIC.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/imagej.profile (renamed from etc/imagej.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/img2txt.profile (renamed from etc/img2txt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/impressive.profile (renamed from etc/impressive.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/inkscape.profile (renamed from etc/inkscape.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/inkview.profile (renamed from etc/inkview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/inox.profile (renamed from etc/inox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iridium-browser.profile (renamed from etc/iridium-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/iridium.profile (renamed from etc/iridium.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/itch.profile (renamed from etc/itch.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/jd-gui.profile (renamed from etc/jd-gui.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/jdownloader.profile (renamed from etc/jdownloader.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/jerry.profile (renamed from etc/jerry.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/jitsi-meet-desktop.profile | 39 | ||||
-rw-r--r-- | etc/profile-a-l/jitsi.profile (renamed from etc/jitsi.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/jumpnbump-menu.profile | 15 | ||||
-rw-r--r-- | etc/profile-a-l/jumpnbump.profile | 49 | ||||
-rw-r--r-- | etc/profile-a-l/k3b.profile (renamed from etc/k3b.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kaffeine.profile (renamed from etc/kaffeine.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/kalgebra.profile (renamed from etc/kalgebra.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/kalgebramobile.profile (renamed from etc/kalgebramobile.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/karbon.profile (renamed from etc/karbon.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/kate.profile (renamed from etc/kate.profile) | 11 | ||||
-rw-r--r-- | etc/profile-a-l/kcalc.profile (renamed from etc/kcalc.profile) | 7 | ||||
-rw-r--r-- | etc/profile-a-l/kdeinit4.profile (renamed from etc/kdeinit4.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kdenlive.profile (renamed from etc/kdenlive.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/keepass.profile (renamed from etc/keepass.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepass2.profile (renamed from etc/keepass2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassx.profile (renamed from etc/keepassx.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/keepassx2.profile (renamed from etc/keepassx2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassxc-cli.profile (renamed from etc/keepassxc-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassxc-proxy.profile (renamed from etc/keepassxc-proxy.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/keepassxc.profile | 81 | ||||
-rw-r--r-- | etc/profile-a-l/kfind.profile (renamed from etc/kfind.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/kget.profile (renamed from etc/kget.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kid3-cli.profile (renamed from etc/kid3-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/kid3-qt.profile (renamed from etc/kid3-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/kid3.profile (renamed from etc/kid3.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/kino.profile (renamed from etc/kino.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/kiwix-desktop.profile (renamed from etc/kiwix-desktop.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/klatexformula.profile (renamed from etc/klatexformula.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/klatexformula_cmdl.profile (renamed from etc/klatexformula_cmdl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/klavaro.profile (renamed from etc/klavaro.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/kmail.profile (renamed from etc/kmail.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/kmplayer.profile | 41 | ||||
-rw-r--r-- | etc/profile-a-l/knotes.profile (renamed from etc/knotes.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kodi.profile (renamed from etc/kodi.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/konversation.profile (renamed from etc/konversation.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/kopete.profile (renamed from etc/kopete.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/krita.profile (renamed from etc/krita.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/krunner.profile (renamed from etc/krunner.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/ktorrent.profile (renamed from etc/ktorrent.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/ktouch.profile (renamed from etc/ktouch.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/kwin_x11.profile (renamed from etc/kwin_x11.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/kwrite.profile (renamed from etc/kwrite.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/latex-common.profile (renamed from etc/latex-common.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/latex.profile (renamed from etc/latex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lbunzip2.profile (renamed from etc/lbunzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lbzcat.profile (renamed from etc/lbzcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lbzip2.profile (renamed from etc/lbzip2.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/leafpad.profile (renamed from etc/leafpad.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/less.profile (renamed from etc/less.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/libreoffice.profile (renamed from etc/libreoffice.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/liferea.profile (renamed from etc/liferea.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lightsoff.profile | 16 | ||||
-rw-r--r-- | etc/profile-a-l/lincity-ng.profile (renamed from etc/lincity-ng.profile) | 6 | ||||
-rw-r--r-- | etc/profile-a-l/links.profile (renamed from etc/links.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/linphone.profile (renamed from etc/linphone.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lmms.profile (renamed from etc/lmms.profile) | 3 | ||||
-rw-r--r-- | etc/profile-a-l/lobase.profile (renamed from etc/lobase.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/localc.profile (renamed from etc/localc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lodraw.profile (renamed from etc/lodraw.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/loffice.profile (renamed from etc/loffice.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lofromtemplate.profile (renamed from etc/lofromtemplate.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/loimpress.profile (renamed from etc/loimpress.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lollypop.profile (renamed from etc/lollypop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lomath.profile (renamed from etc/lomath.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/loweb.profile (renamed from etc/loweb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lowriter.profile (renamed from etc/lowriter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrunzip.profile (renamed from etc/lrunzip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrz.profile (renamed from etc/lrz.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrzcat.profile (renamed from etc/lrzcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrzip.profile (renamed from etc/lrzip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrztar.profile (renamed from etc/lrztar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lrzuntar.profile (renamed from etc/lrzuntar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lugaru.profile (renamed from etc/lugaru.profile) | 5 | ||||
-rw-r--r-- | etc/profile-a-l/luminance-hdr.profile (renamed from etc/luminance-hdr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lximage-qt.profile (renamed from etc/lximage-qt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-a-l/lxmusic.profile (renamed from etc/lxmusic.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lynx.profile (renamed from etc/lynx.profile) | 2 | ||||
-rw-r--r-- | etc/profile-a-l/lyx.profile | 33 | ||||
-rw-r--r-- | etc/profile-a-l/lzcat.profile (renamed from etc/lzcat.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzcmp.profile (renamed from etc/lzcmp.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzdiff.profile (renamed from etc/lzdiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lzegrep.profile (renamed from etc/lzegrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzfgrep.profile (renamed from etc/lzfgrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzgrep.profile (renamed from etc/lzgrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzip.profile (renamed from etc/lzip.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzless.profile (renamed from etc/lzless.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzma.profile (renamed from etc/lzma.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzmadec.profile (renamed from etc/lzmadec.profile) | 0 | ||||
-rw-r--r-- | etc/profile-a-l/lzmainfo.profile (renamed from etc/lzmainfo.profile) | 1 | ||||
-rw-r--r-- | etc/profile-a-l/lzmore.profile (renamed from etc/lzmore.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/Maelstrom.profile (renamed from etc/Maelstrom.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/Maps.profile (renamed from etc/Maps.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Mathematica.profile (renamed from etc/Mathematica.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Natron.profile (renamed from etc/Natron.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/PPSSPPQt.profile (renamed from etc/PPSSPPQt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/QMediathekView.profile (renamed from etc/QMediathekView.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/QOwnNotes.profile (renamed from etc/QOwnNotes.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/Screenshot.profile | 6 | ||||
-rw-r--r-- | etc/profile-m-z/Telegram.profile (renamed from etc/Telegram.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Thunar.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/Viber.profile (renamed from etc/Viber.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/VirtualBox.profile (renamed from etc/VirtualBox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/XMind.profile (renamed from etc/XMind.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Xephyr.profile (renamed from etc/Xephyr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/Xvfb.profile (renamed from etc/Xvfb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ZeGrapher.profile | 48 | ||||
-rw-r--r-- | etc/profile-m-z/macrofusion.profile (renamed from etc/macrofusion.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/magicor.profile | 52 | ||||
-rw-r--r-- | etc/profile-m-z/makepkg.profile (renamed from etc/makepkg.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/manaplus.profile (renamed from etc/manaplus.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/masterpdfeditor.profile (renamed from etc/masterpdfeditor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/masterpdfeditor4.profile (renamed from etc/masterpdfeditor4.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/masterpdfeditor5.profile (renamed from etc/masterpdfeditor5.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mate-calc.profile (renamed from etc/mate-calc.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/mate-calculator.profile (renamed from etc/mate-calculator.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mate-color-select.profile (renamed from etc/mate-color-select.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/mate-dictionary.profile (renamed from etc/mate-dictionary.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/mathematica.profile (renamed from etc/mathematica.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mattermost-desktop.profile | 46 | ||||
-rw-r--r-- | etc/profile-m-z/mcabber.profile (renamed from etc/mcabber.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/mediainfo.profile (renamed from etc/mediainfo.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/mediathekview.profile (renamed from etc/mediathekview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/megaglest.profile (renamed from etc/megaglest.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/megaglest_editor.profile (renamed from etc/megaglest_editor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/meld.profile (renamed from etc/meld.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mencoder.profile (renamed from etc/mencoder.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mendeleydesktop.profile (renamed from etc/mendeleydesktop.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/meteo-qt.profile (renamed from etc/meteo-qt.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/midori.profile (renamed from etc/midori.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/min.profile (renamed from etc/min.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mindless.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/minecraft-launcher.profile | 58 | ||||
-rw-r--r-- | etc/profile-m-z/minetest.profile (renamed from etc/minetest.profile) | 11 | ||||
-rw-r--r-- | etc/profile-m-z/minitube.profile | 61 | ||||
-rw-r--r-- | etc/profile-m-z/mirrormagic.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/mocp.profile | 53 | ||||
-rw-r--r-- | etc/profile-m-z/mousepad.profile (renamed from etc/mousepad.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mp3splt-gtk.profile (renamed from etc/mp3splt-gtk.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/mp3splt.profile (renamed from etc/mp3splt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mp3wrap.profile (renamed from etc/mp3wrap.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpDris2.profile (renamed from etc/mpDris2.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/mpd.profile (renamed from etc/mpd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-alsa.profile (renamed from etc/mpg123-alsa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-id3dump.profile (renamed from etc/mpg123-id3dump.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-jack.profile (renamed from etc/mpg123-jack.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-nas.profile (renamed from etc/mpg123-nas.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-openal.profile (renamed from etc/mpg123-openal.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-oss.profile (renamed from etc/mpg123-oss.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-portaudio.profile (renamed from etc/mpg123-portaudio.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-pulse.profile (renamed from etc/mpg123-pulse.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123-strip.profile (renamed from etc/mpg123-strip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123.bin.profile (renamed from etc/mpg123.bin.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mpg123.profile (renamed from etc/mpg123.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/mplayer.profile (renamed from etc/mplayer.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/mpsyt.profile (renamed from etc/mpsyt.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/mpv.profile (renamed from etc/mpv.profile) | 13 | ||||
-rw-r--r-- | etc/profile-m-z/mrrescue.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/ms-excel.profile (renamed from etc/ms-excel.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-office.profile (renamed from etc/ms-office.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/ms-onenote.profile (renamed from etc/ms-onenote.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-outlook.profile (renamed from etc/ms-outlook.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-powerpoint.profile (renamed from etc/ms-powerpoint.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-skype.profile (renamed from etc/ms-skype.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ms-word.profile (renamed from etc/ms-word.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mtpaint.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/multimc.profile (renamed from etc/multimc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/multimc5.profile (renamed from etc/multimc5.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mumble.profile (renamed from etc/mumble.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf-gl.profile (renamed from etc/mupdf-gl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf-x11-curl.profile (renamed from etc/mupdf-x11-curl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf-x11.profile (renamed from etc/mupdf-x11.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mupdf.profile (renamed from etc/mupdf.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/mupen64plus.profile (renamed from etc/mupen64plus.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/muraster.profile (renamed from etc/muraster.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/musescore.profile (renamed from etc/musescore.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/musixmatch.profile (renamed from etc/musixmatch.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mutool.profile (renamed from etc/mutool.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mutt.profile (renamed from etc/mutt.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/mypaint-ora-thumbnailer.profile (renamed from etc/mypaint-ora-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/mypaint.profile (renamed from etc/mypaint.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/nano.profile (renamed from etc/nano.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/natron.profile (renamed from etc/natron.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nautilus.profile | 15 | ||||
-rw-r--r-- | etc/profile-m-z/ncdu.profile (renamed from etc/ncdu.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nemo.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/netactview.profile (renamed from etc/netactview.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/nethack-vultures.profile (renamed from etc/nethack-vultures.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nethack.profile (renamed from etc/nethack.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/netsurf.profile (renamed from etc/netsurf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/neverball.profile (renamed from etc/neverball.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/neverputt.profile (renamed from etc/neverputt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/newsbeuter.profile (renamed from etc/newsbeuter.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/newsboat.profile (renamed from etc/newsboat.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/newsflash.profile | 60 | ||||
-rw-r--r-- | etc/profile-m-z/nheko.profile (renamed from etc/nheko.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/nicotine.profile | 56 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-cli.profile (renamed from etc/nitroshare-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-nmh.profile (renamed from etc/nitroshare-nmh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-send.profile (renamed from etc/nitroshare-send.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare-ui.profile (renamed from etc/nitroshare-ui.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nitroshare.profile (renamed from etc/nitroshare.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/nomacs.profile (renamed from etc/nomacs.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/nslookup.profile | 56 | ||||
-rw-r--r-- | etc/profile-m-z/nuclear.profile | 40 | ||||
-rw-r--r-- | etc/profile-m-z/nylas.profile (renamed from etc/nylas.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/nyx.profile (renamed from etc/nyx.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/obs.profile (renamed from etc/obs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ocenaudio.profile (renamed from etc/ocenaudio.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/odt2txt.profile (renamed from etc/odt2txt.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/oggsplt.profile (renamed from etc/oggsplt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/okular.profile (renamed from etc/okular.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/onionshare-gui.profile (renamed from etc/onionshare-gui.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ooffice.profile (renamed from etc/ooffice.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ooviewdoc.profile (renamed from etc/ooviewdoc.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/open-invaders.profile (renamed from etc/open-invaders.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/openarena.profile (renamed from etc/openarena.profile) | 27 | ||||
-rw-r--r-- | etc/profile-m-z/openarena_ded.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/openbox.profile (renamed from etc/openbox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/opencity.profile (renamed from etc/opencity.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/openclonk.profile (renamed from etc/openclonk.profile) | 9 | ||||
-rw-r--r-- | etc/profile-m-z/openoffice.org.profile (renamed from etc/openoffice.org.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/openshot-qt.profile (renamed from etc/openshot-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/openshot.profile (renamed from etc/openshot.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/openttd.profile (renamed from etc/openttd.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/opera-beta.profile (renamed from etc/opera-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/opera.profile (renamed from etc/opera.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/orage.profile (renamed from etc/orage.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/org.gnome.NautilusPreviewer.profile | 10 | ||||
-rw-r--r-- | etc/profile-m-z/ostrichriders.profile (renamed from etc/ostrichriders.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/otter-browser.profile | 59 | ||||
-rw-r--r-- | etc/profile-m-z/out123.profile (renamed from etc/out123.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/p7zip.profile (renamed from etc/p7zip.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/palemoon.profile (renamed from etc/palemoon.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pandoc.profile (renamed from etc/pandoc.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/parole.profile (renamed from etc/parole.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/patch.profile (renamed from etc/patch.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/pavucontrol-qt.profile (renamed from etc/pavucontrol-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pavucontrol.profile (renamed from etc/pavucontrol.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/pcmanfm.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/pdfchain.profile (renamed from etc/pdfchain.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/pdflatex.profile (renamed from etc/pdflatex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pdfmod.profile (renamed from etc/pdfmod.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/pdfsam.profile (renamed from etc/pdfsam.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/pdftotext.profile (renamed from etc/pdftotext.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/peek.profile (renamed from etc/peek.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/penguin-command.profile | 42 | ||||
-rw-r--r-- | etc/profile-m-z/picard.profile (renamed from etc/picard.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pidgin.profile (renamed from etc/pidgin.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ping.profile (renamed from etc/ping.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/pingus.profile (renamed from etc/pingus.profile) | 17 | ||||
-rw-r--r-- | etc/profile-m-z/pinta.profile (renamed from etc/pinta.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/pioneer.profile (renamed from etc/pioneer.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/pithos.profile (renamed from etc/pithos.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/pitivi.profile (renamed from etc/pitivi.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/pix.profile (renamed from etc/pix.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/planmaker18.profile (renamed from etc/planmaker18.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/planmaker18free.profile (renamed from etc/planmaker18free.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/playonlinux.profile (renamed from etc/playonlinux.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pluma.profile (renamed from etc/pluma.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/plv.profile | 59 | ||||
-rw-r--r-- | etc/profile-m-z/pngquant.profile (renamed from etc/pngquant.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/polari.profile (renamed from etc/polari.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/ppsspp.profile (renamed from etc/ppsspp.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/pragha.profile (renamed from etc/pragha.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/presentations18.profile (renamed from etc/presentations18.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/presentations18free.profile (renamed from etc/presentations18free.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/profanity.profile (renamed from etc/profanity.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/psi-plus.profile (renamed from etc/psi-plus.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pybitmessage.profile (renamed from etc/pybitmessage.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pycharm-community.profile (renamed from etc/pycharm-community.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pycharm-professional.profile (renamed from etc/pycharm-professional.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/pzstd.profile (renamed from etc/pzstd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qbittorrent.profile (renamed from etc/qbittorrent.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/qemu-launcher.profile (renamed from etc/qemu-launcher.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qemu-system-x86_64.profile (renamed from etc/qemu-system-x86_64.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qgis.profile (renamed from etc/qgis.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/qlipper.profile (renamed from etc/qlipper.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qmmp.profile (renamed from etc/qmmp.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/qpdfview.profile (renamed from etc/qpdfview.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/qt-faststart.profile (renamed from etc/qt-faststart.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qtox.profile (renamed from etc/qtox.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/quadrapassel.profile | 20 | ||||
-rw-r--r-- | etc/profile-m-z/quassel.profile (renamed from etc/quassel.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/quiterss.profile (renamed from etc/quiterss.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/qupzilla.profile (renamed from etc/qupzilla.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/qutebrowser.profile (renamed from etc/qutebrowser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rambox.profile (renamed from etc/rambox.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/ranger.profile | 12 | ||||
-rw-r--r-- | etc/profile-m-z/redeclipse.profile (renamed from etc/redeclipse.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/redshift.profile (renamed from etc/redshift.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/regextester.profile (renamed from etc/regextester.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/remmina.profile (renamed from etc/remmina.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/rhythmbox-client.profile (renamed from etc/rhythmbox-client.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rhythmbox.profile (renamed from etc/rhythmbox.profile) | 17 | ||||
-rw-r--r-- | etc/profile-m-z/ricochet.profile (renamed from etc/ricochet.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/riot-desktop.profile (renamed from etc/riot-desktop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/riot-web.profile (renamed from etc/riot-web.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ripperx.profile | 43 | ||||
-rw-r--r-- | etc/profile-m-z/ristretto.profile (renamed from etc/ristretto.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/rnano.profile (renamed from etc/rnano.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rocketchat.profile (renamed from etc/rocketchat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rsync-download_only.profile (renamed from etc/rsync-download_only.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/rtorrent.profile (renamed from etc/rtorrent.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/rtv.profile (renamed from etc/rtv.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/runenpass.sh.profile (renamed from etc/runenpass.sh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rview.profile (renamed from etc/rview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/rvim.profile (renamed from etc/rvim.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/sayonara.profile (renamed from etc/sayonara.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/scallion.profile (renamed from etc/scallion.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/scorched3d-wrapper.profile | 10 | ||||
-rw-r--r-- | etc/profile-m-z/scorched3d.profile (renamed from etc/scorched3d.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/scorchwentbonkers.profile | 50 | ||||
-rw-r--r-- | etc/profile-m-z/scp.profile (renamed from etc/scp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/scribus.profile (renamed from etc/scribus.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/sdat2img.profile (renamed from etc/sdat2img.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse-adventures.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse-daemon.profile (renamed from etc/seahorse-daemon.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse-tool.profile (renamed from etc/seahorse-tool.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/seahorse.profile (renamed from etc/seahorse.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/seamonkey-bin.profile (renamed from etc/seamonkey-bin.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/seamonkey.profile (renamed from etc/seamonkey.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/secret-tool.profile (renamed from etc/secret-tool.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/server.profile (renamed from etc/server.profile) | 29 | ||||
-rw-r--r-- | etc/profile-m-z/sftp.profile (renamed from etc/sftp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/shellcheck.profile (renamed from etc/shellcheck.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/shortwave.profile | 50 | ||||
-rw-r--r-- | etc/profile-m-z/shotcut.profile (renamed from etc/shotcut.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/signal-cli.profile (renamed from etc/signal-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/signal-desktop.profile (renamed from etc/signal-desktop.profile) | 11 | ||||
-rw-r--r-- | etc/profile-m-z/silentarmy.profile (renamed from etc/silentarmy.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/simple-scan.profile (renamed from etc/simple-scan.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/simplescreenrecorder.profile (renamed from etc/simplescreenrecorder.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/simutrans.profile (renamed from etc/simutrans.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/skanlite.profile (renamed from etc/skanlite.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/skypeforlinux.profile (renamed from etc/skypeforlinux.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/slack.profile (renamed from etc/slack.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/slashem.profile (renamed from etc/slashem.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/smplayer.profile (renamed from etc/smplayer.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/smtube.profile (renamed from etc/smtube.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/snox.profile (renamed from etc/snox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/soffice.profile (renamed from etc/soffice.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/sol.profile (renamed from etc/sol.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/sound-juicer.profile | 43 | ||||
-rw-r--r-- | etc/profile-m-z/soundconverter.profile (renamed from etc/soundconverter.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/spectre-meltdown-checker.profile (renamed from etc/spectre-meltdown-checker.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/spotify.profile (renamed from etc/spotify.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/sqlitebrowser.profile (renamed from etc/sqlitebrowser.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/ssh-agent.profile (renamed from etc/ssh-agent.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/ssh.profile (renamed from etc/ssh.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/standardnotes-desktop.profile (renamed from etc/standardnotes-desktop.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/start-tor-browser.desktop.profile (renamed from etc/start-tor-browser.desktop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/start-tor-browser.profile (renamed from etc/start-tor-browser.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/steam-native.profile (renamed from etc/steam-native.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/steam-runtime.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/steam.profile (renamed from etc/steam.profile) | 65 | ||||
-rw-r--r-- | etc/profile-m-z/stellarium.profile (renamed from etc/stellarium.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/strawberry.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/strings.profile (renamed from etc/strings.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/studio.sh.profile (renamed from etc/studio.sh.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/subdownloader.profile (renamed from etc/subdownloader.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/supertux2.profile (renamed from etc/supertux2.profile) | 11 | ||||
-rw-r--r-- | etc/profile-m-z/supertuxkart.profile (renamed from etc/supertuxkart.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/surf.profile (renamed from etc/surf.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/sushi.profile | 48 | ||||
-rw-r--r-- | etc/profile-m-z/swell-foop.profile | 21 | ||||
-rw-r--r-- | etc/profile-m-z/sylpheed.profile (renamed from etc/sylpheed.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/synfigstudio.profile (renamed from etc/synfigstudio.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/sysprof-cli.profile (renamed from etc/sysprof-cli.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/sysprof.profile (renamed from etc/sysprof.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/tar.profile (renamed from etc/tar.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/tb-starter-wrapper.profile (renamed from etc/tb-starter-wrapper.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tcpdump.profile (renamed from etc/tcpdump.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/teams-for-linux.profile (renamed from etc/teams-for-linux.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/teams.profile (renamed from etc/teams.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/teamspeak3.profile (renamed from etc/teamspeak3.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/teeworlds.profile (renamed from etc/teeworlds.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/telegram-desktop.profile (renamed from etc/telegram-desktop.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/telegram.profile (renamed from etc/telegram.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/terasology.profile (renamed from etc/terasology.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/tex.profile (renamed from etc/tex.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/textmaker18.profile (renamed from etc/textmaker18.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/textmaker18free.profile (renamed from etc/textmaker18free.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/thunar.profile (renamed from etc/thunar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird-beta.profile (renamed from etc/thunderbird-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird-wayland.profile (renamed from etc/thunderbird-wayland.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird.profile (renamed from etc/thunderbird.profile) | 17 | ||||
-rw-r--r-- | etc/profile-m-z/tilp.profile (renamed from etc/tilp.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ar.profile (renamed from etc/tor-browser-ar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ca.profile (renamed from etc/tor-browser-ca.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-cs.profile (renamed from etc/tor-browser-cs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-da.profile (renamed from etc/tor-browser-da.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-de.profile (renamed from etc/tor-browser-de.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-el.profile (renamed from etc/tor-browser-el.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-en-us.profile (renamed from etc/tor-browser-en-us.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-en.profile (renamed from etc/tor-browser-en.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-es-es.profile (renamed from etc/tor-browser-es-es.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-es.profile (renamed from etc/tor-browser-es.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-fa.profile (renamed from etc/tor-browser-fa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-fr.profile (renamed from etc/tor-browser-fr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ga-ie.profile (renamed from etc/tor-browser-ga-ie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-he.profile (renamed from etc/tor-browser-he.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-hu.profile (renamed from etc/tor-browser-hu.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-id.profile (renamed from etc/tor-browser-id.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-is.profile (renamed from etc/tor-browser-is.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-it.profile (renamed from etc/tor-browser-it.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ja.profile (renamed from etc/tor-browser-ja.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ka.profile (renamed from etc/tor-browser-ka.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ko.profile (renamed from etc/tor-browser-ko.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-nb.profile (renamed from etc/tor-browser-nb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-nl.profile (renamed from etc/tor-browser-nl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-pl.profile (renamed from etc/tor-browser-pl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-pt-br.profile (renamed from etc/tor-browser-pt-br.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-ru.profile (renamed from etc/tor-browser-ru.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-sv-se.profile (renamed from etc/tor-browser-sv-se.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-tr.profile (renamed from etc/tor-browser-tr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-vi.profile (renamed from etc/tor-browser-vi.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-zh-cn.profile (renamed from etc/tor-browser-zh-cn.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser-zh-tw.profile (renamed from etc/tor-browser-zh-tw.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser.profile (renamed from etc/tor-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ar.profile (renamed from etc/tor-browser_ar.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ca.profile (renamed from etc/tor-browser_ca.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_cs.profile (renamed from etc/tor-browser_cs.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_da.profile (renamed from etc/tor-browser_da.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_de.profile (renamed from etc/tor-browser_de.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_el.profile (renamed from etc/tor-browser_el.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_en-US.profile (renamed from etc/tor-browser_en-US.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_en.profile (renamed from etc/tor-browser_en.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_es-ES.profile (renamed from etc/tor-browser_es-ES.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_es.profile (renamed from etc/tor-browser_es.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_fa.profile (renamed from etc/tor-browser_fa.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_fr.profile (renamed from etc/tor-browser_fr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ga-IE.profile (renamed from etc/tor-browser_ga-IE.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_he.profile (renamed from etc/tor-browser_he.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_hu.profile (renamed from etc/tor-browser_hu.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_id.profile (renamed from etc/tor-browser_id.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_is.profile (renamed from etc/tor-browser_is.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_it.profile (renamed from etc/tor-browser_it.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ja.profile (renamed from etc/tor-browser_ja.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ka.profile (renamed from etc/tor-browser_ka.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ko.profile (renamed from etc/tor-browser_ko.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_nb.profile (renamed from etc/tor-browser_nb.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_nl.profile (renamed from etc/tor-browser_nl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_pl.profile (renamed from etc/tor-browser_pl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_pt-BR.profile (renamed from etc/tor-browser_pt-BR.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_ru.profile (renamed from etc/tor-browser_ru.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_sv-SE.profile (renamed from etc/tor-browser_sv-SE.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_tr.profile (renamed from etc/tor-browser_tr.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_vi.profile (renamed from etc/tor-browser_vi.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_zh-CN.profile (renamed from etc/tor-browser_zh-CN.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor-browser_zh-TW.profile (renamed from etc/tor-browser_zh-TW.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tor.profile (renamed from etc/tor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/torbrowser-launcher.profile (renamed from etc/torbrowser-launcher.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/torcs.profile (renamed from etc/torcs.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/totem.profile (renamed from etc/totem.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/tracker.profile (renamed from etc/tracker.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/transgui.profile (renamed from etc/transgui.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-cli.profile (renamed from etc/transmission-cli.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-common.profile (renamed from etc/transmission-common.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-create.profile (renamed from etc/transmission-create.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-daemon.profile (renamed from etc/transmission-daemon.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-edit.profile (renamed from etc/transmission-edit.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-gtk.profile (renamed from etc/transmission-gtk.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-qt.profile (renamed from etc/transmission-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-remote-cli.profile (renamed from etc/transmission-remote-cli.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-remote-gtk.profile (renamed from etc/transmission-remote-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-remote.profile (renamed from etc/transmission-remote.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/transmission-show.profile (renamed from etc/transmission-show.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/tremulous.profile (renamed from etc/tremulous.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/truecraft.profile (renamed from etc/truecraft.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/ts3client_runscript.sh.profile | 19 | ||||
-rw-r--r-- | etc/profile-m-z/tshark.profile (renamed from etc/tshark.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/tuxguitar.profile (renamed from etc/tuxguitar.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/tvbrowser.profile (renamed from etc/tvbrowser.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/udiskie.profile (renamed from etc/udiskie.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/uefitool.profile (renamed from etc/uefitool.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/uget-gtk.profile (renamed from etc/uget-gtk.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/unbound.profile (renamed from etc/unbound.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/uncompress.profile (renamed from etc/uncompress.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/unf.profile (renamed from etc/unf.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/unknown-horizons.profile (renamed from etc/unknown-horizons.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/unlzma.profile (renamed from etc/unlzma.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/unrar.profile (renamed from etc/unrar.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/unxz.profile (renamed from etc/unxz.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/unzip.profile (renamed from etc/unzip.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/unzstd.profile (renamed from etc/unzstd.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/utox.profile (renamed from etc/utox.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/uudeview.profile (renamed from etc/uudeview.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/uzbl-browser.profile (renamed from etc/uzbl-browser.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/viewnior.profile (renamed from etc/viewnior.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/viking.profile (renamed from etc/viking.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vim.profile (renamed from etc/vim.profile) | 2 | ||||
-rw-r--r-- | etc/profile-m-z/vimcat.profile (renamed from etc/vimcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vimdiff.profile (renamed from etc/vimdiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vimpager.profile (renamed from etc/vimpager.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vimtutor.profile (renamed from etc/vimtutor.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/virtualbox.profile (renamed from etc/virtualbox.profile) | 19 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-beta.profile (renamed from etc/vivaldi-beta.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-snapshot.profile (renamed from etc/vivaldi-snapshot.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi-stable.profile (renamed from etc/vivaldi-stable.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vivaldi.profile (renamed from etc/vivaldi.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/vlc.profile (renamed from etc/vlc.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/vmware.profile | 39 | ||||
-rw-r--r-- | etc/profile-m-z/vscodium.profile (renamed from etc/vscodium.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vulturesclaw.profile (renamed from etc/vulturesclaw.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vultureseye.profile (renamed from etc/vultureseye.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/vym.profile (renamed from etc/vym.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/w3m.profile (renamed from etc/w3m.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/warmux.profile | 56 | ||||
-rw-r--r-- | etc/profile-m-z/warsow.profile (renamed from etc/warsow.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/warzone2100.profile (renamed from etc/warzone2100.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/waterfox-classic.profile (renamed from etc/waterfox-classic.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/waterfox-current.profile (renamed from etc/waterfox-current.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/waterfox.profile (renamed from etc/waterfox.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/webstorm.profile (renamed from etc/webstorm.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/webui-aria2.profile (renamed from etc/webui-aria2.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/weechat-curses.profile (renamed from etc/weechat-curses.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/weechat.profile (renamed from etc/weechat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wesnoth.profile (renamed from etc/wesnoth.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wget.profile (renamed from etc/wget.profile) | 7 | ||||
-rw-r--r-- | etc/profile-m-z/whalebird.profile (renamed from etc/whalebird.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/whois.profile (renamed from etc/whois.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/widelands.profile (renamed from etc/widelands.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/wine.profile (renamed from etc/wine.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wire-desktop.profile (renamed from etc/wire-desktop.profile) | 9 | ||||
-rw-r--r-- | etc/profile-m-z/wireshark-gtk.profile (renamed from etc/wireshark-gtk.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wireshark-qt.profile (renamed from etc/wireshark-qt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wireshark.profile (renamed from etc/wireshark.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/wordwarvi.profile | 52 | ||||
-rw-r--r-- | etc/profile-m-z/wpp.profile (renamed from etc/wpp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/wps.profile (renamed from etc/wps.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/wpspdf.profile (renamed from etc/wpspdf.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/x-terminal-emulator.profile (renamed from etc/x-terminal-emulator.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/x2goclient.profile | 49 | ||||
-rw-r--r-- | etc/profile-m-z/xbill.profile | 54 | ||||
-rw-r--r-- | etc/profile-m-z/xcalc.profile (renamed from etc/xcalc.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xchat.profile (renamed from etc/xchat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xed.profile (renamed from etc/xed.profile) | 10 | ||||
-rw-r--r-- | etc/profile-m-z/xfburn.profile (renamed from etc/xfburn.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-dict.profile (renamed from etc/xfce4-dict.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-mixer.profile (renamed from etc/xfce4-mixer.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-notes.profile (renamed from etc/xfce4-notes.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/xfce4-screenshooter.profile | 51 | ||||
-rw-r--r-- | etc/profile-m-z/xiphos.profile (renamed from etc/xiphos.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xlinks.profile (renamed from etc/xlinks.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xmms.profile (renamed from etc/xmms.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xmr-stak.profile (renamed from etc/xmr-stak.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic-glx.profile (renamed from etc/xonotic-glx.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic-sdl-wrapper.profile | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic-sdl.profile (renamed from etc/xonotic-sdl.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xonotic.profile (renamed from etc/xonotic.profile) | 15 | ||||
-rw-r--r-- | etc/profile-m-z/xournal.profile | 50 | ||||
-rw-r--r-- | etc/profile-m-z/xpdf.profile (renamed from etc/xpdf.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xplayer-audio-preview.profile (renamed from etc/xplayer-audio-preview.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xplayer-video-thumbnailer.profile (renamed from etc/xplayer-video-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xplayer.profile (renamed from etc/xplayer.profile) | 8 | ||||
-rw-r--r-- | etc/profile-m-z/xpra.profile (renamed from etc/xpra.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xreader-previewer.profile (renamed from etc/xreader-previewer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xreader-thumbnailer.profile (renamed from etc/xreader-thumbnailer.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xreader.profile (renamed from etc/xreader.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xviewer.profile (renamed from etc/xviewer.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/xxd.profile (renamed from etc/xxd.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/xz.profile (renamed from etc/xz.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzcat.profile (renamed from etc/xzcat.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzcmp.profile (renamed from etc/xzcmp.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzdec.profile (renamed from etc/xzdec.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/xzdiff.profile (renamed from etc/xzdiff.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzegrep.profile (renamed from etc/xzegrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzfgrep.profile (renamed from etc/xzfgrep.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/xzgrep.profile (renamed from etc/xzgrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xzless.profile (renamed from etc/xzless.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/xzmore.profile (renamed from etc/xzmore.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/yandex-browser.profile (renamed from etc/yandex-browser.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/yelp.profile (renamed from etc/yelp.profile) | 5 | ||||
-rw-r--r-- | etc/profile-m-z/youtube-dl.profile (renamed from etc/youtube-dl.profile) | 6 | ||||
-rw-r--r-- | etc/profile-m-z/youtube-viewer.profile | 57 | ||||
-rw-r--r-- | etc/profile-m-z/zaproxy.profile (renamed from etc/zaproxy.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zart.profile (renamed from etc/zart.profile) | 4 | ||||
-rw-r--r-- | etc/profile-m-z/zathura.profile (renamed from etc/zathura.profile) | 9 | ||||
-rw-r--r-- | etc/profile-m-z/zcat.profile (renamed from etc/zcat.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/zcmp.profile (renamed from etc/zcmp.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zdiff.profile (renamed from etc/zdiff.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zeal.profile (renamed from etc/zeal.profile) | 16 | ||||
-rw-r--r-- | etc/profile-m-z/zegrep.profile (renamed from etc/zegrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zfgrep.profile (renamed from etc/zfgrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zforce.profile (renamed from etc/zforce.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zgrep.profile (renamed from etc/zgrep.profile) | 3 | ||||
-rw-r--r-- | etc/profile-m-z/zless.profile (renamed from etc/zless.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zmore.profile (renamed from etc/zmore.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/znew.profile (renamed from etc/znew.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zoom.profile (renamed from etc/zoom.profile) | 18 | ||||
-rw-r--r-- | etc/profile-m-z/zpaq.profile (renamed from etc/zpaq.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstd.profile (renamed from etc/zstd.profile) | 1 | ||||
-rw-r--r-- | etc/profile-m-z/zstdcat.profile (renamed from etc/zstdcat.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstdgrep.profile (renamed from etc/zstdgrep.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstdless.profile (renamed from etc/zstdless.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zstdmt.profile (renamed from etc/zstdmt.profile) | 0 | ||||
-rw-r--r-- | etc/profile-m-z/zulip.profile (renamed from etc/zulip.profile) | 1 | ||||
-rw-r--r-- | etc/ranger.profile | 42 | ||||
-rw-r--r-- | etc/templates/profile.template | 24 | ||||
-rwxr-xr-x | mkdeb-apparmor.sh | 56 | ||||
-rwxr-xr-x | mkdeb.sh.in (renamed from mkdeb.sh) | 28 | ||||
-rwxr-xr-x | mketc.sh | 20 | ||||
-rw-r--r-- | platform/rpm/firejail.spec | 4 | ||||
-rwxr-xr-x | platform/rpm/mkrpm.sh | 12 | ||||
-rw-r--r-- | src/bash_completion/firejail.bash_completion | 2 | ||||
-rw-r--r-- | src/common.mk.in | 1 | ||||
-rw-r--r-- | src/faudit/dbus.c | 57 | ||||
-rw-r--r-- | src/faudit/pid.c | 2 | ||||
-rw-r--r-- | src/fbuilder/build_bin.c | 2 | ||||
-rw-r--r-- | src/fbuilder/build_fs.c | 12 | ||||
-rw-r--r-- | src/fbuilder/build_home.c | 8 | ||||
-rw-r--r-- | src/fbuilder/build_profile.c | 34 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 92 | ||||
-rw-r--r-- | src/firecfg/main.c | 5 | ||||
-rw-r--r-- | src/firejail/Makefile.in | 6 | ||||
-rw-r--r-- | src/firejail/arp.c | 4 | ||||
-rw-r--r-- | src/firejail/checkcfg.c | 33 | ||||
-rw-r--r-- | src/firejail/chroot.c | 3 | ||||
-rw-r--r-- | src/firejail/dbus.c | 532 | ||||
-rw-r--r-- | src/firejail/firejail.h | 81 | ||||
-rw-r--r-- | src/firejail/fs.c | 212 | ||||
-rw-r--r-- | src/firejail/fs_dev.c | 8 | ||||
-rw-r--r-- | src/firejail/fs_home.c | 73 | ||||
-rw-r--r-- | src/firejail/fs_mkdir.c | 28 | ||||
-rw-r--r-- | src/firejail/fs_whitelist.c | 42 | ||||
-rw-r--r-- | src/firejail/join.c | 63 | ||||
-rw-r--r-- | src/firejail/main.c | 336 | ||||
-rw-r--r-- | src/firejail/no_sandbox.c | 2 | ||||
-rw-r--r-- | src/firejail/output.c | 87 | ||||
-rw-r--r-- | src/firejail/preproc.c | 26 | ||||
-rw-r--r-- | src/firejail/profile.c | 189 | ||||
-rw-r--r-- | src/firejail/protocol.c | 2 | ||||
-rw-r--r-- | src/firejail/pulseaudio.c | 126 | ||||
-rw-r--r-- | src/firejail/restrict_users.c | 30 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 96 | ||||
-rw-r--r-- | src/firejail/sbox.c | 359 | ||||
-rw-r--r-- | src/firejail/seccomp.c | 108 | ||||
-rw-r--r-- | src/firejail/shutdown.c | 2 | ||||
-rw-r--r-- | src/firejail/usage.c | 19 | ||||
-rw-r--r-- | src/firejail/util.c | 29 | ||||
-rw-r--r-- | src/firejail/x11.c | 85 | ||||
-rw-r--r-- | src/firemon/firemon.h | 6 | ||||
-rw-r--r-- | src/firemon/procevent.c | 15 | ||||
-rw-r--r-- | src/fsec-print/Makefile.in | 4 | ||||
-rw-r--r-- | src/fsec-print/fsec_print.h | 4 | ||||
-rw-r--r-- | src/fsec-print/main.c | 17 | ||||
-rw-r--r-- | src/fsec-print/print.c | 2 | ||||
-rw-r--r-- | src/fsec-print/syscall_list.c | 47 | ||||
-rw-r--r-- | src/fseccomp/Makefile.in | 4 | ||||
-rw-r--r-- | src/fseccomp/fseccomp.h | 34 | ||||
-rw-r--r-- | src/fseccomp/main.c | 57 | ||||
-rw-r--r-- | src/fseccomp/protocol.c | 21 | ||||
-rw-r--r-- | src/fseccomp/seccomp.c | 153 | ||||
-rw-r--r-- | src/fseccomp/seccomp_file.c | 48 | ||||
-rw-r--r-- | src/fseccomp/seccomp_secondary.c | 2 | ||||
-rw-r--r-- | src/include/rundefs.h | 14 | ||||
-rw-r--r-- | src/include/seccomp.h | 9 | ||||
-rw-r--r-- | src/include/syscall.h | 5214 | ||||
-rw-r--r-- | src/include/syscall_armeabi.h | 354 | ||||
-rw-r--r-- | src/include/syscall_i386.h | 425 | ||||
-rw-r--r-- | src/include/syscall_x86_64.h | 347 | ||||
-rw-r--r-- | src/lib/errno.c (renamed from src/fseccomp/errno.c) | 6 | ||||
-rw-r--r-- | src/lib/syscall.c (renamed from src/fseccomp/syscall.c) | 147 | ||||
-rw-r--r-- | src/man/firecfg.txt | 4 | ||||
-rw-r--r-- | src/man/firejail-profile.txt | 160 | ||||
-rw-r--r-- | src/man/firejail.txt | 356 | ||||
-rw-r--r-- | src/profstats/Makefile.in | 14 | ||||
-rw-r--r-- | src/profstats/main.c | 304 | ||||
-rwxr-xr-x | test/compile/compile.sh | 19 | ||||
-rwxr-xr-x | test/environment/rlimit-profile.exp | 2 | ||||
-rwxr-xr-x | test/environment/rlimit.exp | 4 | ||||
-rw-r--r-- | test/environment/rlimit.profile | 2 | ||||
-rw-r--r-- | test/filters/memwrexe.c | 2 | ||||
-rwxr-xr-x | test/fs/mkdir.exp | 26 | ||||
-rw-r--r-- | test/fs/mkdir.profile | 4 | ||||
-rwxr-xr-x | test/fs/mkdir_mkfile.exp | 14 | ||||
-rwxr-xr-x | test/fs/private-lib.exp | 4 | ||||
-rwxr-xr-x | test/utils/build.exp | 56 | ||||
-rwxr-xr-x | test/utils/utils.sh | 5 |
1144 files changed, 10794 insertions, 7107 deletions
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md new file mode 100644 index 000000000..ae7b1089a --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug_report.md | |||
@@ -0,0 +1,48 @@ | |||
1 | --- | ||
2 | name: Bug report | ||
3 | about: Create a report to help us improve | ||
4 | title: '' | ||
5 | labels: '' | ||
6 | assignees: '' | ||
7 | |||
8 | --- | ||
9 | Write clear, concise and in textual form. | ||
10 | |||
11 | **Bug and expected behavior** | ||
12 | - Describe the bug. | ||
13 | - What did you expect to happen? | ||
14 | |||
15 | **No profile or disabling firejail** | ||
16 | - What changed calling `firejail --noprofile PROGRAM` in a shell? | ||
17 | - What changed calling the program *by path*=without firejail (check `whereis PROGRAM`, `firejail --list`, `stat $programpath`)? | ||
18 | |||
19 | **Reproduce** | ||
20 | Steps to reproduce the behavior: | ||
21 | 1. Run in bash `firejail PROGRAM` | ||
22 | 2. See error `ERROR` | ||
23 | 3. Click on '....' | ||
24 | 4. Scroll down to '....' | ||
25 | |||
26 | **Environment** | ||
27 | - Linux distribution and version (ie output of `lsb_release -a`) | ||
28 | - Firejail version (output of `firejail --version`) exclusive or used git commit (`git rev-parse HEAD`) | ||
29 | - What other programs interact with the affected program for the functionality? | ||
30 | - Are these listed in the profile? | ||
31 | |||
32 | **Additional context** | ||
33 | Other context about the problem like related errors to understand the problem. | ||
34 | |||
35 | **Checklist** | ||
36 | - [ ] The upstream profile (and redirect profile if exists) have no changes fixing it. | ||
37 | - [ ] The upstream profile exists (`find / -name 'firejail' 2>/dev/null`/`fd firejail` to locate profiles ie in `/usr/local/etc/firejail/PROGRAM.profile`) | ||
38 | - [ ] Programs needed for interaction are listed. | ||
39 | - [ ] Error was checked in search engine and on issue list without success. | ||
40 | |||
41 | |||
42 | <details><summary> debug output </summary> | ||
43 | |||
44 | ``` | ||
45 | OUTPUT OF `firejail --debug PROGRAM` | ||
46 | ``` | ||
47 | |||
48 | </details> | ||
diff --git a/.gitignore b/.gitignore index 9995da44c..8142985b3 100644 --- a/.gitignore +++ b/.gitignore | |||
@@ -6,6 +6,7 @@ | |||
6 | *.rpm | 6 | *.rpm |
7 | *.gcda | 7 | *.gcda |
8 | *.gcno | 8 | *.gcno |
9 | *.DS_Store | ||
9 | .directory | 10 | .directory |
10 | Makefile | 11 | Makefile |
11 | autom4te.cache/ | 12 | autom4te.cache/ |
@@ -19,6 +20,7 @@ firejail-users.5 | |||
19 | firejail.1 | 20 | firejail.1 |
20 | firemon.1 | 21 | firemon.1 |
21 | firecfg.1 | 22 | firecfg.1 |
23 | mkdeb.sh | ||
22 | src/firejail/firejail | 24 | src/firejail/firejail |
23 | src/firemon/firemon | 25 | src/firemon/firemon |
24 | src/firecfg/firecfg | 26 | src/firecfg/firecfg |
@@ -33,6 +35,7 @@ src/fsec-optimize/fsec-optimize | |||
33 | src/fcopy/fcopy | 35 | src/fcopy/fcopy |
34 | src/fldd/fldd | 36 | src/fldd/fldd |
35 | src/fbuilder/fbuilder | 37 | src/fbuilder/fbuilder |
38 | etc/profstats | ||
36 | uids.h | 39 | uids.h |
37 | seccomp | 40 | seccomp |
38 | seccomp.debug | 41 | seccomp.debug |
@@ -40,6 +43,7 @@ seccomp.32 | |||
40 | seccomp.64 | 43 | seccomp.64 |
41 | seccomp.block_secondary | 44 | seccomp.block_secondary |
42 | seccomp.mdwx | 45 | seccomp.mdwx |
46 | seccomp.mdwx.32 | ||
43 | src/common.mk | 47 | src/common.mk |
44 | aclocal.m4 | 48 | aclocal.m4 |
45 | __pycache__ | 49 | __pycache__ |
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 81b9cfce4..11f25284d 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml | |||
@@ -9,9 +9,9 @@ build_ubuntu_package: | |||
9 | image: ubuntu:rolling | 9 | image: ubuntu:rolling |
10 | script: | 10 | script: |
11 | - apt-get update -qq | 11 | - apt-get update -qq |
12 | - apt-get install -y -qq build-essential lintian pkg-config python3 | 12 | - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential lintian pkg-config python3 |
13 | - ./configure --prefix=/usr && make deb && dpkg -i firejail*.deb | 13 | - ./configure --prefix=/usr && make deb && dpkg -i firejail*.deb |
14 | - python3 contrib/sort.py etc/*.{profile,inc} | 14 | - python3 contrib/sort.py etc/profile-*/*.profile etc/inc/*.inc |
15 | 15 | ||
16 | build_debian_package: | 16 | build_debian_package: |
17 | image: debian:stretch | 17 | image: debian:stretch |
@@ -20,12 +20,12 @@ build_debian_package: | |||
20 | - apt-get install -y -qq build-essential lintian pkg-config | 20 | - apt-get install -y -qq build-essential lintian pkg-config |
21 | - ./configure --prefix=/usr && make deb && dpkg -i firejail*.deb | 21 | - ./configure --prefix=/usr && make deb && dpkg -i firejail*.deb |
22 | 22 | ||
23 | #build_redhat_package: | 23 | build_redhat_package: |
24 | # image: centos:latest | 24 | image: centos:latest |
25 | # script: | 25 | script: |
26 | # - yum update -y | 26 | - dnf update -y |
27 | # - yum install -y rpm-build gcc make | 27 | - dnf install -y rpm-build gcc make |
28 | # - ./configure --prefix=/usr && make rpms && yum install -y firejail*.rpm | 28 | - ./configure --prefix=/usr && make rpms && rpm -i firejail*.rpm |
29 | 29 | ||
30 | build_fedora_package: | 30 | build_fedora_package: |
31 | image: fedora:latest | 31 | image: fedora:latest |
@@ -33,7 +33,7 @@ build_fedora_package: | |||
33 | - dnf update -y | 33 | - dnf update -y |
34 | - dnf install -y rpm-build gcc make | 34 | - dnf install -y rpm-build gcc make |
35 | - ./configure --prefix=/usr && make rpms && rpm -i firejail*.rpm | 35 | - ./configure --prefix=/usr && make rpms && rpm -i firejail*.rpm |
36 | - python3 contrib/sort.py etc/*.{profile,inc} | 36 | - python3 contrib/sort.py etc/profile-*/*.profile etc/inc/*.inc |
37 | 37 | ||
38 | build_src_package: | 38 | build_src_package: |
39 | image: alpine:latest | 39 | image: alpine:latest |
@@ -48,8 +48,8 @@ build_apparmor: | |||
48 | image: ubuntu:latest | 48 | image: ubuntu:latest |
49 | script: | 49 | script: |
50 | - apt-get update -qq | 50 | - apt-get update -qq |
51 | - apt-get install -y -qq build-essential lintian libapparmor-dev pkg-config | 51 | - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential lintian libapparmor-dev pkg-config |
52 | - ./configure --prefix=/usr && make deb-apparmor && dpkg -i firejail-apparmor*.deb | 52 | - ./configure --prefix=/usr && make deb-apparmor && dpkg -i firejail*.deb |
53 | 53 | ||
54 | cppcheck: | 54 | cppcheck: |
55 | image: debian:latest | 55 | image: debian:latest |
@@ -59,6 +59,15 @@ cppcheck: | |||
59 | script: | 59 | script: |
60 | - cppcheck -q --force --error-exitcode=1 --enable=warning,performance . | 60 | - cppcheck -q --force --error-exitcode=1 --enable=warning,performance . |
61 | 61 | ||
62 | clang: | ||
63 | image: ubuntu:latest | ||
64 | script: | ||
65 | - apt-get update -qq | ||
66 | - apt-get --purge autoremove -y -qq gcc | ||
67 | - DEBIAN_FRONTEND=noninteractive apt-get install -y -qq clang pkg-config make | ||
68 | - ./configure --prefix=/usr CC=/usr/bin/clang && make && make install-strip | ||
69 | |||
70 | |||
62 | debian_ci: | 71 | debian_ci: |
63 | image: registry.salsa.debian.org/salsa-ci-team/ci-image-git-buildpackage:latest | 72 | image: registry.salsa.debian.org/salsa-ci-team/ci-image-git-buildpackage:latest |
64 | variables: | 73 | variables: |
diff --git a/Makefile.in b/Makefile.in index 0285d8592..8cbba12e9 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -1,9 +1,3 @@ | |||
1 | all: apps man filters | ||
2 | MYLIBS = src/lib | ||
3 | APPS = src/firejail src/firemon src/fsec-print src/fsec-optimize src/firecfg src/fnetfilter src/libtrace src/libtracelog src/ftee src/faudit src/fnet src/fseccomp src/fbuilder src/fcopy src/fldd src/libpostexecseccomp | ||
4 | MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 | ||
5 | SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx | ||
6 | |||
7 | prefix=@prefix@ | 1 | prefix=@prefix@ |
8 | exec_prefix=@exec_prefix@ | 2 | exec_prefix=@exec_prefix@ |
9 | bindir=@bindir@ | 3 | bindir=@bindir@ |
@@ -22,14 +16,26 @@ HAVE_CONTRIB_INSTALL=@HAVE_CONTRIB_INSTALL@ | |||
22 | BUSYBOX_WORKAROUND=@BUSYBOX_WORKAROUND@ | 16 | BUSYBOX_WORKAROUND=@BUSYBOX_WORKAROUND@ |
23 | HAVE_SUID=@HAVE_SUID@ | 17 | HAVE_SUID=@HAVE_SUID@ |
24 | 18 | ||
25 | .PHONY: mylibs $(MYLIBS) | 19 | all: all_items man filters |
26 | mylibs: $(MYLIBS) | 20 | APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats |
27 | $(MYLIBS): | 21 | SBOX_APPS = src/faudit/faudit src/fbuilder/fbuilder src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter src/ftee/ftee |
28 | $(MAKE) -C $@ | 22 | MYDIRS = src/lib |
23 | MYLIBS = src/libpostexecseccomp/libpostexecseccomp.so src/libtrace/libtrace.so src/libtracelog/libtracelog.so | ||
24 | MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 | ||
25 | ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | ||
26 | SBOX_APPS += src/fsec-optimize/fsec-optimize src/fsec-print/fsec-print src/fseccomp/fseccomp | ||
27 | SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx seccomp.mdwx.32 | ||
28 | endif | ||
29 | ALL_ITEMS = $(APPS) $(SBOX_APPS) $(MYLIBS) | ||
29 | 30 | ||
30 | .PHONY: apps $(APPS) | 31 | .PHONY: all_items $(ALL_ITEMS) |
31 | apps: $(APPS) | 32 | all_items: $(ALL_ITEMS) |
32 | $(APPS): $(MYLIBS) | 33 | $(ALL_ITEMS): $(MYDIRS) |
34 | $(MAKE) -C $(dir $@) | ||
35 | |||
36 | .PHONY: mydirs | ||
37 | mydirs: mydirs $(MYDIRS) | ||
38 | $(MYDIRS): | ||
33 | $(MAKE) -C $@ | 39 | $(MAKE) -C $@ |
34 | 40 | ||
35 | $(MANPAGES): $(wildcard src/man/*.txt) | 41 | $(MANPAGES): $(wildcard src/man/*.txt) |
@@ -37,20 +43,32 @@ $(MANPAGES): $(wildcard src/man/*.txt) | |||
37 | 43 | ||
38 | man: $(MANPAGES) | 44 | man: $(MANPAGES) |
39 | 45 | ||
40 | filters: src/fseccomp | 46 | filters: $(SECCOMP_FILTERS) $(SBOX_APPS) |
41 | ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | 47 | ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) |
48 | seccomp: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize | ||
42 | src/fseccomp/fseccomp default seccomp | 49 | src/fseccomp/fseccomp default seccomp |
43 | src/fsec-optimize/fsec-optimize seccomp | 50 | src/fsec-optimize/fsec-optimize seccomp |
51 | |||
52 | seccomp.debug: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize | ||
44 | src/fseccomp/fseccomp default seccomp.debug allow-debuggers | 53 | src/fseccomp/fseccomp default seccomp.debug allow-debuggers |
45 | src/fsec-optimize/fsec-optimize seccomp.debug | 54 | src/fsec-optimize/fsec-optimize seccomp.debug |
55 | |||
56 | seccomp.32: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize | ||
46 | src/fseccomp/fseccomp secondary 32 seccomp.32 | 57 | src/fseccomp/fseccomp secondary 32 seccomp.32 |
47 | src/fsec-optimize/fsec-optimize seccomp.32 | 58 | src/fsec-optimize/fsec-optimize seccomp.32 |
59 | |||
60 | seccomp.block_secondary: src/fseccomp/fseccomp | ||
48 | src/fseccomp/fseccomp secondary block seccomp.block_secondary | 61 | src/fseccomp/fseccomp secondary block seccomp.block_secondary |
62 | |||
63 | seccomp.mdwx: src/fseccomp/fseccomp | ||
49 | src/fseccomp/fseccomp memory-deny-write-execute seccomp.mdwx | 64 | src/fseccomp/fseccomp memory-deny-write-execute seccomp.mdwx |
65 | |||
66 | seccomp.mdwx.32: src/fseccomp/fseccomp | ||
67 | src/fseccomp/fseccomp memory-deny-write-execute.32 seccomp.mdwx.32 | ||
50 | endif | 68 | endif |
51 | 69 | ||
52 | clean: | 70 | clean: |
53 | for dir in $(APPS) $(MYLIBS); do \ | 71 | for dir in $$(dirname $(ALL_ITEMS)) $(MYDIRS); do \ |
54 | $(MAKE) -C $$dir clean; \ | 72 | $(MAKE) -C $$dir clean; \ |
55 | done | 73 | done |
56 | rm -f $(MANPAGES) $(MANPAGES:%=%.gz) firejail*.rpm | 74 | rm -f $(MANPAGES) $(MANPAGES:%=%.gz) firejail*.rpm |
@@ -68,139 +86,99 @@ clean: | |||
68 | cd test/compile; ./compile.sh --clean; cd ../.. | 86 | cd test/compile; ./compile.sh --clean; cd ../.. |
69 | 87 | ||
70 | distclean: clean | 88 | distclean: clean |
71 | for dir in $(APPS) $(MYLIBS); do \ | 89 | for dir in $$(dirname $(ALL_ITEMS)) $(MYDIRS); do \ |
72 | $(MAKE) -C $$dir distclean; \ | 90 | $(MAKE) -C $$dir distclean; \ |
73 | done | 91 | done |
74 | rm -fr Makefile autom4te.cache config.log config.status config.h dummy.o src/common.mk | 92 | rm -fr Makefile autom4te.cache config.log config.status config.h src/common.mk mkdeb.sh |
75 | 93 | ||
76 | realinstall: | 94 | realinstall: |
77 | # firejail executable | 95 | # firejail executable |
78 | install -m 0755 -d $(DESTDIR)/$(bindir) | 96 | install -m 0755 -d $(DESTDIR)$(bindir) |
79 | install -c -m 0755 src/firejail/firejail $(DESTDIR)/$(bindir)/. | 97 | install -m 0755 src/firejail/firejail $(DESTDIR)$(bindir) |
80 | ifeq ($(HAVE_SUID),yes) | 98 | ifeq ($(HAVE_SUID),yes) |
81 | chmod u+s $(DESTDIR)/$(bindir)/firejail | 99 | chmod u+s $(DESTDIR)$(bindir)/firejail |
82 | endif | 100 | endif |
83 | # firemon executable | 101 | # firemon executable |
84 | install -c -m 0755 src/firemon/firemon $(DESTDIR)/$(bindir)/. | 102 | install -m 0755 src/firemon/firemon $(DESTDIR)$(bindir) |
85 | # firecfg executable | 103 | # firecfg executable |
86 | install -c -m 0755 src/firecfg/firecfg $(DESTDIR)/$(bindir)/. | 104 | install -m 0755 src/firecfg/firecfg $(DESTDIR)$(bindir) |
87 | # libraries and plugins | 105 | # libraries and plugins |
88 | install -m 0755 -d $(DESTDIR)/$(libdir)/firejail | 106 | install -m 0755 -d $(DESTDIR)$(libdir)/firejail |
89 | install -c -m 0644 src/libtrace/libtrace.so $(DESTDIR)/$(libdir)/firejail/. | 107 | install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS) src/firecfg/firecfg.config |
90 | install -c -m 0644 src/libtracelog/libtracelog.so $(DESTDIR)/$(libdir)/firejail/. | 108 | install -m 0755 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS) |
91 | install -c -m 0644 src/libpostexecseccomp/libpostexecseccomp.so $(DESTDIR)/$(libdir)/firejail/. | ||
92 | install -c -m 0755 src/ftee/ftee $(DESTDIR)/$(libdir)/firejail/. | ||
93 | install -c -m 0755 src/fshaper/fshaper.sh $(DESTDIR)/$(libdir)/firejail/. | ||
94 | |||
95 | install -c -m 0644 src/firecfg/firecfg.config $(DESTDIR)/$(libdir)/firejail/. | ||
96 | install -c -m 0755 src/faudit/faudit $(DESTDIR)/$(libdir)/firejail/. | ||
97 | install -c -m 0755 src/fnet/fnet $(DESTDIR)/$(libdir)/firejail/. | ||
98 | install -c -m 0755 src/fnetfilter/fnetfilter $(DESTDIR)/$(libdir)/firejail/. | ||
99 | install -c -m 0755 src/fcopy/fcopy $(DESTDIR)/$(libdir)/firejail/. | ||
100 | install -c -m 0755 src/fldd/fldd $(DESTDIR)/$(libdir)/firejail/. | ||
101 | install -c -m 0755 src/fbuilder/fbuilder $(DESTDIR)/$(libdir)/firejail/. | ||
102 | ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | ||
103 | install -c -m 0755 src/fsec-print/fsec-print $(DESTDIR)/$(libdir)/firejail/. | ||
104 | install -c -m 0755 src/fsec-optimize/fsec-optimize $(DESTDIR)/$(libdir)/firejail/. | ||
105 | install -c -m 0755 src/fseccomp/fseccomp $(DESTDIR)/$(libdir)/firejail/. | ||
106 | install -c -m 0644 seccomp $(DESTDIR)/$(libdir)/firejail/. | ||
107 | install -c -m 0644 seccomp.debug $(DESTDIR)/$(libdir)/firejail/. | ||
108 | install -c -m 0644 seccomp.32 $(DESTDIR)/$(libdir)/firejail/. | ||
109 | install -c -m 0644 seccomp.block_secondary $(DESTDIR)/$(libdir)/firejail/. | ||
110 | install -c -m 0644 seccomp.mdwx $(DESTDIR)/$(libdir)/firejail/. | ||
111 | endif | ||
112 | ifeq ($(HAVE_CONTRIB_INSTALL),yes) | 109 | ifeq ($(HAVE_CONTRIB_INSTALL),yes) |
113 | install -c -m 0755 contrib/fix_private-bin.py $(DESTDIR)/$(libdir)/firejail/. | 110 | install -m 0755 -t $(DESTDIR)$(libdir)/firejail contrib/*.py contrib/*.sh |
114 | install -c -m 0755 contrib/fjclip.py $(DESTDIR)/$(libdir)/firejail/. | 111 | # vim syntax |
115 | install -c -m 0755 contrib/fjdisplay.py $(DESTDIR)/$(libdir)/firejail/. | 112 | install -m 0755 -d $(DESTDIR)$(datarootdir)/vim/vimfiles/ftdetect |
116 | install -c -m 0755 contrib/fjresize.py $(DESTDIR)/$(libdir)/firejail/. | 113 | install -m 0755 -d $(DESTDIR)$(datarootdir)/vim/vimfiles/syntax |
117 | install -c -m 0755 contrib/fj-mkdeb.py $(DESTDIR)/$(libdir)/firejail/. | 114 | install -m 0644 contrib/vim/ftdetect/firejail.vim $(DESTDIR)$(datarootdir)/vim/vimfiles/ftdetect |
118 | install -c -m 0755 contrib/sort.py $(DESTDIR)/$(libdir)/firejail/. | 115 | install -m 0644 contrib/vim/syntax/firejail.vim $(DESTDIR)$(datarootdir)/vim/vimfiles/syntax |
119 | install -c -m 0755 contrib/syscalls.sh $(DESTDIR)/$(libdir)/firejail/. | ||
120 | endif | 116 | endif |
121 | # documents | 117 | # documents |
122 | install -m 0755 -d $(DESTDIR)/$(DOCDIR) | 118 | install -m 0755 -d $(DESTDIR)$(DOCDIR) |
123 | install -c -m 0644 COPYING $(DESTDIR)/$(DOCDIR)/. | 119 | install -m 0644 -t $(DESTDIR)$(DOCDIR) COPYING README RELNOTES etc/templates/* |
124 | install -c -m 0644 README $(DESTDIR)/$(DOCDIR)/. | 120 | # profiles and settings |
125 | install -c -m 0644 RELNOTES $(DESTDIR)/$(DOCDIR)/. | 121 | install -m 0755 -d $(DESTDIR)$(sysconfdir)/firejail |
126 | install -c -m 0644 etc/templates/* $(DESTDIR)/$(DOCDIR)/. | 122 | install -m 0644 -t $(DESTDIR)$(sysconfdir)/firejail etc/profile-a-l/*.profile etc/profile-m-z/*.profile etc/inc/*.inc etc/net/*.net etc/firejail.config |
127 | # etc files | ||
128 | ./mketc.sh $(sysconfdir) $(BUSYBOX_WORKAROUND) | ||
129 | install -m 0755 -d $(DESTDIR)/$(sysconfdir)/firejail | ||
130 | for file in .etc/* etc/firejail.config; do \ | ||
131 | install -c -m 0644 $$file $(DESTDIR)/$(sysconfdir)/firejail; \ | ||
132 | done | ||
133 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" | 123 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" |
134 | rm -fr .etc | 124 | ifeq ($(BUSYBOX_WORKAROUND),yes) |
125 | ./mketc.sh $(DESTDIR)$(sysconfdir)/firejail/disable-common.inc | ||
126 | endif | ||
135 | ifeq ($(HAVE_APPARMOR),-DHAVE_APPARMOR) | 127 | ifeq ($(HAVE_APPARMOR),-DHAVE_APPARMOR) |
136 | # install apparmor profile | 128 | # install apparmor profile |
137 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d; fi;" | 129 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d; fi;" |
138 | install -c -m 0644 etc/firejail-default $(DESTDIR)/$(sysconfdir)/apparmor.d/. | 130 | install -m 0644 etc/apparmor/firejail-default $(DESTDIR)$(sysconfdir)/apparmor.d |
139 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/local ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/local; fi;" | 131 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/local ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/local; fi;" |
140 | # install apparmor profile customization file | 132 | # install apparmor profile customization file |
141 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-local ]; then install -c -m 0644 etc/firejail-local $(DESTDIR)/$(sysconfdir)/apparmor.d/local/.; fi;" | 133 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-local ]; then install -c -m 0644 etc/apparmor/firejail-local $(DESTDIR)/$(sysconfdir)/apparmor.d/local/.; fi;" |
142 | endif | 134 | endif |
143 | # man pages | 135 | # man pages |
144 | install -m 0755 -d $(DESTDIR)/$(mandir)/man1 | 136 | install -m 0755 -d $(DESTDIR)$(mandir)/man1 $(DESTDIR)$(mandir)/man5 |
145 | install -m 0755 -d $(DESTDIR)/$(mandir)/man5 | ||
146 | for man in $(MANPAGES); do \ | 137 | for man in $(MANPAGES); do \ |
147 | rm -f $$man.gz; \ | 138 | rm -f $$man.gz; \ |
148 | gzip -9n $$man; \ | 139 | gzip -9n $$man; \ |
149 | case "$$man" in \ | 140 | case "$$man" in \ |
150 | *.1) install -c -m 0644 $$man.gz $(DESTDIR)/$(mandir)/man1/; ;; \ | 141 | *.1) install -m 0644 $$man.gz $(DESTDIR)$(mandir)/man1/; ;; \ |
151 | *.5) install -c -m 0644 $$man.gz $(DESTDIR)/$(mandir)/man5/; ;; \ | 142 | *.5) install -m 0644 $$man.gz $(DESTDIR)$(mandir)/man5/; ;; \ |
152 | esac; \ | 143 | esac; \ |
153 | done | 144 | done |
154 | rm -f $(MANPAGES) $(MANPAGES:%=%.gz) | 145 | rm -f $(MANPAGES) $(MANPAGES:%=%.gz) |
155 | # bash completion | 146 | # bash completion |
156 | install -m 0755 -d $(DESTDIR)/$(datarootdir)/bash-completion/completions | 147 | install -m 0755 -d $(DESTDIR)$(datarootdir)/bash-completion/completions |
157 | install -c -m 0644 src/bash_completion/firejail.bash_completion $(DESTDIR)/$(datarootdir)/bash-completion/completions/firejail | 148 | install -m 0644 src/bash_completion/firejail.bash_completion $(DESTDIR)$(datarootdir)/bash-completion/completions/firejail |
158 | install -c -m 0644 src/bash_completion/firemon.bash_completion $(DESTDIR)/$(datarootdir)/bash-completion/completions/firemon | 149 | install -m 0644 src/bash_completion/firemon.bash_completion $(DESTDIR)$(datarootdir)/bash-completion/completions/firemon |
159 | install -c -m 0644 src/bash_completion/firecfg.bash_completion $(DESTDIR)/$(datarootdir)/bash-completion/completions/firecfg | 150 | install -m 0644 src/bash_completion/firecfg.bash_completion $(DESTDIR)$(datarootdir)/bash-completion/completions/firecfg |
160 | 151 | ||
161 | install: all | 152 | install: all |
162 | $(MAKE) realinstall | 153 | $(MAKE) realinstall |
163 | 154 | ||
164 | install-strip: all | 155 | install-strip: all |
165 | strip src/firejail/firejail | 156 | strip $(ALL_ITEMS) |
166 | strip src/firemon/firemon | ||
167 | strip src/firecfg/firecfg | ||
168 | strip src/libtrace/libtrace.so | ||
169 | strip src/libtracelog/libtracelog.so | ||
170 | strip src/libpostexecseccomp/libpostexecseccomp.so | ||
171 | strip src/ftee/ftee | ||
172 | strip src/faudit/faudit | ||
173 | strip src/fnet/fnet | ||
174 | strip src/fnetfilter/fnetfilter | ||
175 | strip src/fseccomp/fseccomp | ||
176 | strip src/fsec-print/fsec-print | ||
177 | strip src/fsec-optimize/fsec-optimize | ||
178 | strip src/fcopy/fcopy | ||
179 | strip src/fldd/fldd | ||
180 | strip src/fbuilder/fbuilder | ||
181 | $(MAKE) realinstall | 157 | $(MAKE) realinstall |
182 | 158 | ||
183 | uninstall: | 159 | uninstall: |
184 | rm -f $(DESTDIR)/$(bindir)/firejail | 160 | rm -f $(DESTDIR)$(bindir)/firejail |
185 | rm -f $(DESTDIR)/$(bindir)/firemon | 161 | rm -f $(DESTDIR)$(bindir)/firemon |
186 | rm -f $(DESTDIR)/$(bindir)/firecfg | 162 | rm -f $(DESTDIR)$(bindir)/firecfg |
187 | rm -fr $(DESTDIR)/$(libdir)/firejail | 163 | rm -fr $(DESTDIR)$(libdir)/firejail |
188 | rm -fr $(DESTDIR)/$(datarootdir)/doc/firejail | 164 | rm -fr $(DESTDIR)$(datarootdir)/doc/firejail |
189 | for man in $(MANPAGES); do \ | 165 | for man in $(MANPAGES); do \ |
190 | rm -f $(DESTDIR)/$(mandir)/man5/$$man*; \ | 166 | rm -f $(DESTDIR)$(mandir)/man5/$$man*; \ |
191 | rm -f $(DESTDIR)/$(mandir)/man1/$$man*; \ | 167 | rm -f $(DESTDIR)$(mandir)/man1/$$man*; \ |
192 | done | 168 | done |
193 | rm -f $(DESTDIR)/$(datarootdir)/bash-completion/completions/firejail | 169 | rm -f $(DESTDIR)$(datarootdir)/bash-completion/completions/firejail |
194 | rm -f $(DESTDIR)/$(datarootdir)/bash-completion/completions/firemon | 170 | rm -f $(DESTDIR)$(datarootdir)/bash-completion/completions/firemon |
195 | rm -f $(DESTDIR)/$(datarootdir)/bash-completion/completions/firecfg | 171 | rm -f $(DESTDIR)$(datarootdir)/bash-completion/completions/firecfg |
196 | @echo "If you want to install a different version of firejail, you might also need to run 'rm -fr $(DESTDIR)/$(sysconfdir)/firejail', see #2038." | 172 | @echo "If you want to install a different version of firejail, you might also need to run 'rm -fr $(DESTDIR)$(sysconfdir)/firejail', see #2038." |
197 | 173 | ||
198 | DISTFILES = "src etc m4 platform contrib configure configure.ac dummy.c Makefile.in install.sh mkman.sh mketc.sh mkdeb.sh mkdeb-apparmor.sh COPYING README RELNOTES" | 174 | DISTFILES = "src etc m4 platform contrib configure configure.ac Makefile.in install.sh mkman.sh mketc.sh mkdeb.sh.in COPYING README RELNOTES" |
199 | DISTFILES_TEST = "test/apps test/apps-x11 test/apps-x11-xorg test/root test/fcopy test/environment test/profiles test/utils test/compile test/filters test/network test/arguments test/fs test/sysutils test/chroot" | 175 | DISTFILES_TEST = "test/apps test/apps-x11 test/apps-x11-xorg test/root test/fcopy test/environment test/profiles test/utils test/compile test/filters test/network test/arguments test/fs test/sysutils test/chroot" |
200 | 176 | ||
201 | dist: | 177 | dist: |
202 | mv config.status config.status.old | 178 | mv config.status config.status.old |
179 | mv mkdeb.sh mkdeb.sh.old | ||
203 | make distclean | 180 | make distclean |
181 | mv mkdeb.sh.old mkdeb.sh | ||
204 | mv config.status.old config.status | 182 | mv config.status.old config.status |
205 | rm -fr $(NAME)-$(VERSION) $(NAME)-$(VERSION).tar.xz | 183 | rm -fr $(NAME)-$(VERSION) $(NAME)-$(VERSION).tar.xz |
206 | mkdir -p $(NAME)-$(VERSION)/test | 184 | mkdir -p $(NAME)-$(VERSION)/test |
@@ -214,10 +192,10 @@ dist: | |||
214 | asc:; ./mkasc.sh $(VERSION) | 192 | asc:; ./mkasc.sh $(VERSION) |
215 | 193 | ||
216 | deb: dist | 194 | deb: dist |
217 | ./mkdeb.sh $(NAME) $(VERSION) | 195 | ./mkdeb.sh |
218 | 196 | ||
219 | deb-apparmor: dist | 197 | deb-apparmor: dist |
220 | ./mkdeb-apparmor.sh $(NAME) $(VERSION) | 198 | ./mkdeb.sh -apparmor |
221 | 199 | ||
222 | test-compile: dist | 200 | test-compile: dist |
223 | cd test/compile; ./compile.sh $(NAME)-$(VERSION) | 201 | cd test/compile; ./compile.sh $(NAME)-$(VERSION) |
@@ -293,7 +271,7 @@ test-travis: test-profiles test-fcopy test-fnetfilter test-fs test-utils test-sy | |||
293 | 271 | ||
294 | ########################################## | 272 | ########################################## |
295 | # Individual tests, some of them require root access | 273 | # Individual tests, some of them require root access |
296 | # The tests are very intrussive, by the time you are done | 274 | # The tests are very intrusive, by the time you are done |
297 | # with them you will need to restart your computer. | 275 | # with them you will need to restart your computer. |
298 | ########################################## | 276 | ########################################## |
299 | 277 | ||
@@ -318,7 +296,7 @@ test-network: | |||
318 | test-stress: | 296 | test-stress: |
319 | cd test/stress; ./stress.sh | grep TESTING | 297 | cd test/stress; ./stress.sh | grep TESTING |
320 | 298 | ||
321 | # Tesets running a root user | 299 | # Tests running a root user |
322 | test-root: | 300 | test-root: |
323 | cd test/root; su -c ./root.sh | grep TESTING | 301 | cd test/root; su -c ./root.sh | grep TESTING |
324 | 302 | ||
@@ -37,6 +37,7 @@ Maintainer: | |||
37 | Committers | 37 | Committers |
38 | - chiraag-nataraj (https://github.com/chiraag-nataraj) | 38 | - chiraag-nataraj (https://github.com/chiraag-nataraj) |
39 | - crass (https://github.com/crass) | 39 | - crass (https://github.com/crass) |
40 | - curiosityseeker (https://github.com/curiosityseeker) | ||
40 | - glitsj16 (https://github.com/glitsj16) | 41 | - glitsj16 (https://github.com/glitsj16) |
41 | - Fred-Barclay (https://github.com/Fred-Barclay) | 42 | - Fred-Barclay (https://github.com/Fred-Barclay) |
42 | - Kristóf Marussy (https://github.com/kris7t) | 43 | - Kristóf Marussy (https://github.com/kris7t) |
@@ -54,6 +55,9 @@ Committers | |||
54 | 55 | ||
55 | Firejail Authors (alphabetical order) | 56 | Firejail Authors (alphabetical order) |
56 | 57 | ||
58 | 0x7969 (https://github.com/0x7969) | ||
59 | - fix wire-desktop.profile | ||
60 | - add ferdi.profile | ||
57 | 7twin (https://github.com/7twin_) | 61 | 7twin (https://github.com/7twin_) |
58 | - fix typos | 62 | - fix typos |
59 | - fix flameshot raw screenshots | 63 | - fix flameshot raw screenshots |
@@ -61,6 +65,7 @@ Firejail Authors (alphabetical order) | |||
61 | - add pybitmessage profile | 65 | - add pybitmessage profile |
62 | Adrian L. Shaw (https://github.com/adrianlshaw) | 66 | Adrian L. Shaw (https://github.com/adrianlshaw) |
63 | - add profanity profile | 67 | - add profanity profile |
68 | - add barrirer profile | ||
64 | Aidan Gauland (https://github.com/aidalgol) | 69 | Aidan Gauland (https://github.com/aidalgol) |
65 | - added electron and riot-web profiles | 70 | - added electron and riot-web profiles |
66 | Akhil Hans Maulloo (https://github.com/kouul) | 71 | Akhil Hans Maulloo (https://github.com/kouul) |
@@ -90,6 +95,9 @@ Alexander Gerasiov (https://github.com/gerasiov) | |||
90 | - profile updates | 95 | - profile updates |
91 | Alexander Stein (https://github.com/ajstein) | 96 | Alexander Stein (https://github.com/ajstein) |
92 | - added profile for qutebrowser | 97 | - added profile for qutebrowser |
98 | Amin Vakil (https://github.com/aminvakil) | ||
99 | - whois profile fix | ||
100 | - added profile for strawberry | ||
93 | Andreas Hunkeler (https://github.com/Karneades) | 101 | Andreas Hunkeler (https://github.com/Karneades) |
94 | - Add profile for offical Linux Teams application | 102 | - Add profile for offical Linux Teams application |
95 | Andrey Alekseenko (https://github.com/al42and) | 103 | Andrey Alekseenko (https://github.com/al42and) |
@@ -97,6 +105,8 @@ Andrey Alekseenko (https://github.com/al42and) | |||
97 | - fixed Skype profile | 105 | - fixed Skype profile |
98 | andrew160 (https://github.com/andrew160) | 106 | andrew160 (https://github.com/andrew160) |
99 | - profile and man pages fixes | 107 | - profile and man pages fixes |
108 | Andrew Branson (https://github.com/abranson) | ||
109 | - 32bit ARM syscall table | ||
100 | announ (https://github.com/announ) | 110 | announ (https://github.com/announ) |
101 | - mpv and youtube-dl profile fixes | 111 | - mpv and youtube-dl profile fixes |
102 | - git profile fix | 112 | - git profile fix |
@@ -105,13 +115,19 @@ Antonio Russo (https://github.com/aerusso) | |||
105 | - enumerate root directories in apparmor profile | 115 | - enumerate root directories in apparmor profile |
106 | - fix join-or-start | 116 | - fix join-or-start |
107 | - wusc fixes | 117 | - wusc fixes |
118 | - okular profile fixes | ||
119 | - manpage fixes | ||
108 | aoand (https://github.com/aoand) | 120 | aoand (https://github.com/aoand) |
109 | - seccomp fix: allow numeric syscalls | 121 | - seccomp fix: allow numeric syscalls |
122 | Atrate (https://github.com/Atrate) | ||
123 | - BetterDiscord support | ||
110 | Austin Morton (https://github.com/apmorton) | 124 | Austin Morton (https://github.com/apmorton) |
111 | - deterministic-exit-code option | 125 | - deterministic-exit-code option |
112 | - private-cwd options | 126 | - private-cwd options |
113 | Austin S. Hemmelgarn (https://github.com/Ferroin) | 127 | Austin S. Hemmelgarn (https://github.com/Ferroin) |
114 | - unbound profile update | 128 | - unbound profile update |
129 | Avi Lumelsky (https://github.com/avilum) | ||
130 | - syscall.sh improvements | ||
115 | avoidr (https://github.com/avoidr) | 131 | avoidr (https://github.com/avoidr) |
116 | - whitelist fix | 132 | - whitelist fix |
117 | - recently-used.xbel fix | 133 | - recently-used.xbel fix |
@@ -160,8 +176,13 @@ BytesTuner (https://github.com/BytesTuner) | |||
160 | - provided keepassxc profile | 176 | - provided keepassxc profile |
161 | caoliver (https://github.com/caoliver) | 177 | caoliver (https://github.com/caoliver) |
162 | - network system fixes | 178 | - network system fixes |
179 | Carlo Abelli (https://github.com/carloabelli) | ||
180 | - fixed udiskie profile | ||
181 | - Allow mbind syscall for GIMP | ||
163 | Cat (https://github.com/ecat3) | 182 | Cat (https://github.com/ecat3) |
164 | - prevent tmux connecting to an existing session | 183 | - prevent tmux connecting to an existing session |
184 | Christian Pinedo (https://github.com/chrpinedo) | ||
185 | - added nicotine profile | ||
165 | creideiki (https://github.com/creideiki) | 186 | creideiki (https://github.com/creideiki) |
166 | - make the sandbox process reap all children | 187 | - make the sandbox process reap all children |
167 | - tor browser profile fix | 188 | - tor browser profile fix |
@@ -183,7 +204,8 @@ crass (https://github.com/crass) | |||
183 | - extract_command_name fixes | 204 | - extract_command_name fixes |
184 | - update appimage size calculation to newest code from libappimage | 205 | - update appimage size calculation to newest code from libappimage |
185 | - firejail should look for processes with names exactly named | 206 | - firejail should look for processes with names exactly named |
186 | curiosity-seeker (https://github.com/curiosity-seeker) | 207 | curiosity-seeker (https://github.com/curiosity-seeker - old) |
208 | curiosityseeker (https://github.com/curiosityseeker - new) | ||
187 | - tightening unbound and dnscrypt-proxy profiles | 209 | - tightening unbound and dnscrypt-proxy profiles |
188 | - correct and tighten QuiteRss profile | 210 | - correct and tighten QuiteRss profile |
189 | - dnsmasq profile | 211 | - dnsmasq profile |
@@ -200,6 +222,8 @@ curiosity-seeker (https://github.com/curiosity-seeker) | |||
200 | - added cantata profile | 222 | - added cantata profile |
201 | - updated keypassxc profile | 223 | - updated keypassxc profile |
202 | - added syscalls.sh, which determine the necessary syscalls for a program | 224 | - added syscalls.sh, which determine the necessary syscalls for a program |
225 | - fixed conky profile | ||
226 | - thunderbird.profile: harden and enable the rules necessary to make Firefox open links | ||
203 | da2x (https://github.com/da2x) | 227 | da2x (https://github.com/da2x) |
204 | - matched RPM license tag | 228 | - matched RPM license tag |
205 | Daan Bakker (https://github.com/dbakker) | 229 | Daan Bakker (https://github.com/dbakker) |
@@ -214,6 +238,8 @@ Dara Adib (https://github.com/daradib) | |||
214 | - evince profile fix | 238 | - evince profile fix |
215 | David Thole (https://github.com/TheDarkTrumpet) | 239 | David Thole (https://github.com/TheDarkTrumpet) |
216 | - added profile for teams-for-linux | 240 | - added profile for teams-for-linux |
241 | Davide Beatrici (https://github.com/davidebeatrici) | ||
242 | - steam.profile: correctly blacklist unneeded directories in user's home | ||
217 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) | 243 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) |
218 | - added xpdf profile | 244 | - added xpdf profile |
219 | Denys Havrysh (https://github.com/vutny) | 245 | Denys Havrysh (https://github.com/vutny) |
@@ -227,6 +253,9 @@ DiGitHubCap (https://github.com/DiGitHubCap) | |||
227 | - deluge profile fix | 253 | - deluge profile fix |
228 | Disconnect3d (https://github.com/disconnect3d) | 254 | Disconnect3d (https://github.com/disconnect3d) |
229 | - code cleanup | 255 | - code cleanup |
256 | dmfreemon (https://github.com/dmfreemon) | ||
257 | - add sandbox name or name of private directory to the window title when xpra is used | ||
258 | - handle malloc() failures; use gnu_basename() instead of basenaem() | ||
230 | dshmgh (https://github.com/dshmgh) | 259 | dshmgh (https://github.com/dshmgh) |
231 | - overlayfs fix for systems with /home mounted on a separate partition | 260 | - overlayfs fix for systems with /home mounted on a separate partition |
232 | Duncan Overbruck (https://github.com/Duncaen) | 261 | Duncan Overbruck (https://github.com/Duncaen) |
@@ -250,6 +279,7 @@ Felipe Barriga Richards (https://github.com/fbarriga) | |||
250 | Florian Begusch (https://github.com/florianbegusch) | 279 | Florian Begusch (https://github.com/florianbegusch) |
251 | - (la)tex profiles | 280 | - (la)tex profiles |
252 | - fixed transmission-common.profile | 281 | - fixed transmission-common.profile |
282 | - fixed standardnotes-desktop.profile | ||
253 | floxo (https://github.com/floxo) | 283 | floxo (https://github.com/floxo) |
254 | - fixed qml disk cache issue | 284 | - fixed qml disk cache issue |
255 | Franco (nextime) Lanza (https://github.com/nextime) | 285 | Franco (nextime) Lanza (https://github.com/nextime) |
@@ -357,6 +387,8 @@ haarp (https://github.com/haarp) | |||
357 | - Allow sound for hexchat | 387 | - Allow sound for hexchat |
358 | hamzadis (https://github.com/hamzadis) | 388 | hamzadis (https://github.com/hamzadis) |
359 | - added --overlay-named=name and --overlay-path=path | 389 | - added --overlay-named=name and --overlay-path=path |
390 | Hans-Christoph Steiner (https://github.com/eighthave) | ||
391 | - added xournal profile | ||
360 | hawkey116477 (https://github.com/hawkeye116477) | 392 | hawkey116477 (https://github.com/hawkeye116477) |
361 | - added Waterfox profile | 393 | - added Waterfox profile |
362 | - updated Cyberfox profile | 394 | - updated Cyberfox profile |
@@ -472,12 +504,17 @@ LaurentGH (https://github.com/LaurentGH) | |||
472 | - allow private-bin parameters to be absolute paths | 504 | - allow private-bin parameters to be absolute paths |
473 | Loïc Damien (https://github.com/dzamlo) | 505 | Loïc Damien (https://github.com/dzamlo) |
474 | - small fixes | 506 | - small fixes |
507 | Liorst4 (https://github.com/Liorst4) | ||
508 | - Preserve CFLAGS given to configure in common.mk.in | ||
509 | - fix emacs config to load as read-write | ||
475 | Lockdis (https://github.com/Lockdis) | 510 | Lockdis (https://github.com/Lockdis) |
476 | - Added crow, nyx, and google-earth-pro profiles | 511 | - Added crow, nyx, and google-earth-pro profiles |
477 | Lukáš Krejčí (https://github.com/lskrejci) | 512 | Lukáš Krejčí (https://github.com/lskrejci) |
478 | - fixed parsing of --keep-var-tmp | 513 | - fixed parsing of --keep-var-tmp |
479 | luzpaz (https://github.com/luzpaz) | 514 | luzpaz (https://github.com/luzpaz) |
480 | - code spelling fixes | 515 | - code spelling fixes |
516 | Mace Muilman (https://github.com/mace015) | ||
517 | - google-chrome{,beta,unstable} flags | ||
481 | maces (https://github.com/maces) | 518 | maces (https://github.com/maces) |
482 | - Franz messenger profile | 519 | - Franz messenger profile |
483 | Madura A (https://github.com/manushanga) | 520 | Madura A (https://github.com/manushanga) |
@@ -502,6 +539,7 @@ Matthew Gyurgyik (https://github.com/pyther) | |||
502 | matu3ba (https://github.com/matu3ba) | 539 | matu3ba (https://github.com/matu3ba) |
503 | - evince hardening, dbus removed | 540 | - evince hardening, dbus removed |
504 | - fix dia profile | 541 | - fix dia profile |
542 | - several template fixes | ||
505 | maxice8 (https://github.com/maxice8) | 543 | maxice8 (https://github.com/maxice8) |
506 | - fixed missing header | 544 | - fixed missing header |
507 | Melvin Vermeeren (https://github.com/melvinvermeeren) | 545 | Melvin Vermeeren (https://github.com/melvinvermeeren) |
@@ -564,6 +602,8 @@ Peter Hogg (https://github.com/pigmonkey) | |||
564 | - bitlbee profile fixes | 602 | - bitlbee profile fixes |
565 | - mutt profile fixes | 603 | - mutt profile fixes |
566 | - fixes for youtube-dl in mpv profile | 604 | - fixes for youtube-dl in mpv profile |
605 | Peter Sanford (https://github.com/psanford) | ||
606 | - fix QtWebEngine in zoom | ||
567 | Petter Reinholdtsen (pere@hungry.com) | 607 | Petter Reinholdtsen (pere@hungry.com) |
568 | - Opera profile patch | 608 | - Opera profile patch |
569 | PharmaceuticalCobweb (https://github.com/PharmaceuticalCobweb) | 609 | PharmaceuticalCobweb (https://github.com/PharmaceuticalCobweb) |
@@ -760,6 +800,7 @@ StelFux (https://github.com/StelFux) | |||
760 | - Fix youtube video in totem | 800 | - Fix youtube video in totem |
761 | the-antz (https://github.com/the-antz) | 801 | the-antz (https://github.com/the-antz) |
762 | - Fix libx265 encoding in ffmpeg profile | 802 | - Fix libx265 encoding in ffmpeg profile |
803 | - Fix Firefox profile | ||
763 | - Profile tweaks | 804 | - Profile tweaks |
764 | thewisenerd (https://github.com/thewisenerd) | 805 | thewisenerd (https://github.com/thewisenerd) |
765 | - allow multiple private-home commands | 806 | - allow multiple private-home commands |
@@ -75,7 +75,14 @@ GitLab-CI status: https://gitlab.com/Firejail/firejail_ci/pipelines/ | |||
75 | 75 | ||
76 | We take security bugs very seriously. If you believe you have found one, please report it by emailing us at netblue30@yahoo.com | 76 | We take security bugs very seriously. If you believe you have found one, please report it by emailing us at netblue30@yahoo.com |
77 | 77 | ||
78 | ## Compile and install | 78 | ## Installing |
79 | |||
80 | Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others. | ||
81 | |||
82 | The firejail 0.9.52-LTS version is deprecated. On Ubuntu 18.04 LTS users are advised to use the [PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail). On Debian buster we recommend to use the [backports](https://packages.debian.org/buster-backports/firejail) package. | ||
83 | |||
84 | You can also install one of the [released packages](http://sourceforge.net/projects/firejail/files/firejail), or clone Firejail’s source code from our Git repository and compile manually: | ||
85 | |||
79 | ````` | 86 | ````` |
80 | $ git clone https://github.com/netblue30/firejail.git | 87 | $ git clone https://github.com/netblue30/firejail.git |
81 | $ cd firejail | 88 | $ cd firejail |
@@ -89,6 +96,8 @@ $ sudo apt-get install git build-essential libapparmor-dev pkg-config | |||
89 | ````` | 96 | ````` |
90 | For --selinux option, add libselinux1-dev (libselinux-devel for Fedora). | 97 | For --selinux option, add libselinux1-dev (libselinux-devel for Fedora). |
91 | 98 | ||
99 | Detailed information on using firejail from git is available on the [wiki](https://github.com/netblue30/firejail/wiki/Using-firejail-from-git). | ||
100 | |||
92 | ## Running the sandbox | 101 | ## Running the sandbox |
93 | 102 | ||
94 | To start the sandbox, prefix your command with “firejail”: | 103 | To start the sandbox, prefix your command with “firejail”: |
@@ -149,6 +158,42 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe | |||
149 | 158 | ||
150 | ## Current development version: 0.9.63 | 159 | ## Current development version: 0.9.63 |
151 | 160 | ||
161 | ### Profile Statistics | ||
162 | |||
163 | A small tool to print profile statistics. Compile as usual and run: | ||
164 | ````` | ||
165 | $ make | ||
166 | $ cd etc | ||
167 | $ ./profstats *.profile | ||
168 | profiles 966 | ||
169 | include local profile 966 (include profile-name.local) | ||
170 | include globals 966 (include globals.local) | ||
171 | blacklist ~/.ssh 951 (include disable-common.inc) | ||
172 | seccomp 908 | ||
173 | capabilities 965 | ||
174 | noexec 830 (include disable-exec.inc) | ||
175 | memory-deny-write-execute 214 | ||
176 | apparmor 488 | ||
177 | private-bin 483 | ||
178 | private-dev 829 | ||
179 | private-etc 366 | ||
180 | private-tmp 726 | ||
181 | whitelist var 638 (include whitelist-var-common.inc) | ||
182 | whitelist run/user 282 (include whitelist-runuser-common.inc | ||
183 | or blacklist ${RUNUSER}) | ||
184 | whitelist usr/share 275 (include whitelist-usr-share-common.inc | ||
185 | net none 313 | ||
186 | ````` | ||
187 | |||
188 | Run ./profstats -h for help. | ||
189 | |||
152 | ### New profiles: | 190 | ### New profiles: |
153 | 191 | ||
154 | gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, gnome-passwordsafe, bibtex, gummi, latex, pdflatex, tex, wpp, wpspdf, wps, et, multimc, gnome-hexgl, com.github.johnfactotum.Foliate, desktopeditors, impressive, mupdf-gl, mupdf-x11, mupdf-x11-curl, muraster, mutool, planmaker18, planmaker18free, presentations18, presentations18free, textmaker18, textmaker18free, teams | 192 | gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, gnome-passwordsafe, bibtex, gummi, latex, pdflatex, tex, wpp, wpspdf, wps, et, |
193 | multimc, gnome-hexgl, com.github.johnfactotum.Foliate, desktopeditors, impressive, mupdf-gl, mupdf-x11, mupdf-x11-curl, | ||
194 | muraster, mutool, planmaker18, planmaker18free, presentations18, presentations18free, textmaker18, textmaker18free, teams, xournal, | ||
195 | gnome-screenshot, ripperX, sound-juicer, iagno, com.github.dahenson.agenda, gnome-pomodoro, gnome-todo, kmplayer, | ||
196 | penguin-command, x2goclient, frogatto, gnome-mines, gnome-nibbles, lightsoff, ts3client_runscript.sh, warmux, ferdi, abiword, | ||
197 | four-in-a-row, gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin, gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars, | ||
198 | hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless, mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers, | ||
199 | seahorse-adventures, wordwarvi, xbill, gnome-klotski, five-or-more, swell-foop, fdns, jitsi-meet-desktop, nicontine, steam-runtime, apostrophe, quadrapassel, dino-im, strawberry, hitori, bijiben, gnote, gnubik, ZeGrapher, gapplication, xonotic-sdl-wrapper, openarena_ded, cawbird, freetube, homebank, mattermost-desktop, newsflash, com.gitlab.newsflash, element-desktop, sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx, minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar, vmware, git-cola, otter-browser | ||
@@ -1,14 +1,50 @@ | |||
1 | firejail (0.9.63) baseline; urgency=low | 1 | firejail (0.9.63) baseline; urgency=low |
2 | * work in progress | 2 | * work in progress |
3 | * security: fixes for CVE-2020-17367 & CVE-2020-17368, reported by Tim Starling | ||
4 | * The blocking action of seccomp filters has been changed from | ||
5 | killing the process to returning EPERM to the caller. To get the | ||
6 | previous behaviour, use --seccomp-error-action=kill or | ||
7 | syscall:kill syntax when constructing filters, or override in | ||
8 | /etc/firejail/firejail.config file. | ||
9 | * Fine-grained D-Bus sandboxing with xdg-dbus-proxy. | ||
10 | xdg-dbus-proxy must be installed, if not D-Bus access will be allowed. | ||
11 | With this version nodbus is deprecated, in favor of dbus-user none and | ||
12 | dbus-system none and will be removed in a future version. | ||
3 | * DHCP client support | 13 | * DHCP client support |
14 | * firecfg only fix dektop-files if started with sudo | ||
4 | * SELinux labeling support | 15 | * SELinux labeling support |
16 | * custom 32-bit seccomp filter support | ||
17 | * restrict ${RUNUSER} in several profiles | ||
18 | * blacklist shells such as bash in several profiles | ||
19 | * whitelist globbing | ||
20 | * mkdir and mkfile support for /run/user directory | ||
21 | * support ignore for include | ||
22 | * new condition: HAS_NOSOUND | ||
5 | * new profiles: gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, muraster | 23 | * new profiles: gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, muraster |
6 | * new profiles: gnome-passwordsafe, bibtex, gummi, latex, mupdf-x11-curl | 24 | * new profiles: gnome-passwordsafe, bibtex, gummi, latex, mupdf-x11-curl |
7 | * new profiles: pdflatex, tex, wpp, wpspdf, wps, et, multimc, mupdf-x11 | 25 | * new profiles: pdflatex, tex, wpp, wpspdf, wps, et, multimc, mupdf-x11 |
8 | * new profiles: gnome-hexgl, com.github.johnfactotum.Foliate, mupdf-gl, mutool | 26 | * new profiles: gnome-hexgl, com.github.johnfactotum.Foliate, mupdf-gl, mutool |
9 | * new profiles: desktopeditors, impressive, planmaker18, planmaker18free | 27 | * new profiles: desktopeditors, impressive, planmaker18, planmaker18free |
10 | * new profiles: presentations18, presentations18free, textmaker18, teams | 28 | * new profiles: presentations18, presentations18free, textmaker18, teams |
11 | * new profiles: textmaker18free | 29 | * new profiles: textmaker18free, xournal, gnome-screenshot, ripperX |
30 | * new profiles: sound-juicer, com.github.dahenson.agenda, gnome-pomodoro | ||
31 | * new profiles: gnome-todo, x2goclient, iagno, kmplayer, penguin-command | ||
32 | * new profiles: frogatto, gnome-mines, gnome-nibbles, lightsoff, warmux | ||
33 | * new profiles: ts3client_runscript.sh, ferdi, abiword, four-in-a-row | ||
34 | * new profiles: gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin | ||
35 | * new profiles: gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars | ||
36 | * new profiles: hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless | ||
37 | * new profiles: mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers | ||
38 | * new profiles: seahorse-adventures, wordwarvi, xbill, gnome-klotski | ||
39 | * new profiles: swell-foop, fdns, five-or-more, steam-runtime, jitsi-meet-desktop | ||
40 | * new profiles: nicotine, plv, mocp, apostrophe, quadrapassel, dino-im, strawberry | ||
41 | * new profiles: hitori, bijiben, gnote, gnubik, ZeGrapher, xonotic-sdl-wrapper | ||
42 | * new profiles: gapplication, openarena_ded, element-desktop, cawbird, freetube | ||
43 | * new profiles: homebank, mattermost-desktop, newsflash, com.gitlab.newsflash | ||
44 | * new profiles: sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx | ||
45 | * new profiles: minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar | ||
46 | * new profiles: vmware, git-cola, otter-browser | ||
47 | -- netblue30 <netblue30@yahoo.com> Tue, 21 Apr 2020 08:00:00 -0500 | ||
12 | 48 | ||
13 | firejail (0.9.62) baseline; urgency=low | 49 | firejail (0.9.62) baseline; urgency=low |
14 | * added file-copy-limit in /etc/firejail/firejail.config | 50 | * added file-copy-limit in /etc/firejail/firejail.config |
@@ -36,7 +72,7 @@ firejail (0.9.62) baseline; urgency=low | |||
36 | * new profiles: kalgebramobile, signal-cli, amuled, kfind, profanity | 72 | * new profiles: kalgebramobile, signal-cli, amuled, kfind, profanity |
37 | * new profiles: audio-recorder, cameramonitor, ddgtk, drawio, unf, gmpc | 73 | * new profiles: audio-recorder, cameramonitor, ddgtk, drawio, unf, gmpc |
38 | * new profiles: electron-mail, gist, gist-paste | 74 | * new profiles: electron-mail, gist, gist-paste |
39 | -- netblue30 <netblue30@yahoo.com> Sat, 1 Jun 2019 08:00:00 -0500 | 75 | -- netblue30 <netblue30@yahoo.com> Sat, 28 Dec 2019 08:00:00 -0500 |
40 | 76 | ||
41 | firejail (0.9.60) baseline; urgency=low | 77 | firejail (0.9.60) baseline; urgency=low |
42 | * security bug reported by Austin Morton: | 78 | * security bug reported by Austin Morton: |
diff --git a/SECURITY.md b/SECURITY.md index 46942a936..883f915ed 100644 --- a/SECURITY.md +++ b/SECURITY.md | |||
@@ -6,9 +6,9 @@ | |||
6 | | ------- | ------------------ | ---- | --------------------------- | 6 | | ------- | ------------------ | ---- | --------------------------- |
7 | | 0.9.62 | :heavy_check_mark: | | :white_check_mark: Debian 11 (testing/unstable), 10 **backports**; Ubuntu 20.04 | 7 | | 0.9.62 | :heavy_check_mark: | | :white_check_mark: Debian 11 (testing/unstable), 10 **backports**; Ubuntu 20.04 |
8 | | 0.9.60 | :x: | | :white_check_mark: Ubuntu 19.10 | 8 | | 0.9.60 | :x: | | :white_check_mark: Ubuntu 19.10 |
9 | | 0.9.58 | :x: | | :white_check_mark: Ubuntu 19.04; Debian 9 **backports**, 10 | 9 | | 0.9.58 | :x: | | :white_check_mark: Debian 9 **backports**, 10 |
10 | | 0.9.56 | :x: | 27 Jan 2019 | | 10 | | 0.9.56 | :x: | 27 Jan 2019 | |
11 | | 0.9.54 | :x: | | :white_check_mark: Ubuntu 18.10 | 11 | | 0.9.54 | :x: | 18 Sep 2018 | |
12 | | 0.9.52 | :x: | | :white_check_mark: Ubuntu 18.04 LTS | 12 | | 0.9.52 | :x: | | :white_check_mark: Ubuntu 18.04 LTS |
13 | | 0.9.50 | :x: | 12 Dec 2017 | | 13 | | 0.9.50 | :x: | 12 Dec 2017 | |
14 | | 0.9.48 | :x: | 09 Sep 2017 | | 14 | | 0.9.48 | :x: | 09 Sep 2017 | |
@@ -683,6 +683,7 @@ infodir | |||
683 | docdir | 683 | docdir |
684 | oldincludedir | 684 | oldincludedir |
685 | includedir | 685 | includedir |
686 | runstatedir | ||
686 | localstatedir | 687 | localstatedir |
687 | sharedstatedir | 688 | sharedstatedir |
688 | sysconfdir | 689 | sysconfdir |
@@ -776,6 +777,7 @@ datadir='${datarootdir}' | |||
776 | sysconfdir='${prefix}/etc' | 777 | sysconfdir='${prefix}/etc' |
777 | sharedstatedir='${prefix}/com' | 778 | sharedstatedir='${prefix}/com' |
778 | localstatedir='${prefix}/var' | 779 | localstatedir='${prefix}/var' |
780 | runstatedir='${localstatedir}/run' | ||
779 | includedir='${prefix}/include' | 781 | includedir='${prefix}/include' |
780 | oldincludedir='/usr/include' | 782 | oldincludedir='/usr/include' |
781 | docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' | 783 | docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' |
@@ -1028,6 +1030,15 @@ do | |||
1028 | | -silent | --silent | --silen | --sile | --sil) | 1030 | | -silent | --silent | --silen | --sile | --sil) |
1029 | silent=yes ;; | 1031 | silent=yes ;; |
1030 | 1032 | ||
1033 | -runstatedir | --runstatedir | --runstatedi | --runstated \ | ||
1034 | | --runstate | --runstat | --runsta | --runst | --runs \ | ||
1035 | | --run | --ru | --r) | ||
1036 | ac_prev=runstatedir ;; | ||
1037 | -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \ | ||
1038 | | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \ | ||
1039 | | --run=* | --ru=* | --r=*) | ||
1040 | runstatedir=$ac_optarg ;; | ||
1041 | |||
1031 | -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) | 1042 | -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) |
1032 | ac_prev=sbindir ;; | 1043 | ac_prev=sbindir ;; |
1033 | -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | 1044 | -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ |
@@ -1165,7 +1176,7 @@ fi | |||
1165 | for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ | 1176 | for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ |
1166 | datadir sysconfdir sharedstatedir localstatedir includedir \ | 1177 | datadir sysconfdir sharedstatedir localstatedir includedir \ |
1167 | oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ | 1178 | oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ |
1168 | libdir localedir mandir | 1179 | libdir localedir mandir runstatedir |
1169 | do | 1180 | do |
1170 | eval ac_val=\$$ac_var | 1181 | eval ac_val=\$$ac_var |
1171 | # Remove trailing slashes. | 1182 | # Remove trailing slashes. |
@@ -1318,6 +1329,7 @@ Fine tuning of the installation directories: | |||
1318 | --sysconfdir=DIR read-only single-machine data [PREFIX/etc] | 1329 | --sysconfdir=DIR read-only single-machine data [PREFIX/etc] |
1319 | --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] | 1330 | --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] |
1320 | --localstatedir=DIR modifiable single-machine data [PREFIX/var] | 1331 | --localstatedir=DIR modifiable single-machine data [PREFIX/var] |
1332 | --runstatedir=DIR modifiable per-process data [LOCALSTATEDIR/run] | ||
1321 | --libdir=DIR object code libraries [EPREFIX/lib] | 1333 | --libdir=DIR object code libraries [EPREFIX/lib] |
1322 | --includedir=DIR C header files [PREFIX/include] | 1334 | --includedir=DIR C header files [PREFIX/include] |
1323 | --oldincludedir=DIR C header files for non-gcc [/usr/include] | 1335 | --oldincludedir=DIR C header files for non-gcc [/usr/include] |
@@ -4174,7 +4186,9 @@ if test "$prefix" = /usr; then | |||
4174 | test "$sysconfdir" = '${prefix}/etc' && sysconfdir="/etc" | 4186 | test "$sysconfdir" = '${prefix}/etc' && sysconfdir="/etc" |
4175 | fi | 4187 | fi |
4176 | 4188 | ||
4177 | ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile" | 4189 | ac_config_files="$ac_config_files mkdeb.sh" |
4190 | |||
4191 | ac_config_files="$ac_config_files Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile src/profstats/Makefile" | ||
4178 | 4192 | ||
4179 | cat >confcache <<\_ACEOF | 4193 | cat >confcache <<\_ACEOF |
4180 | # This file is a shell script that caches the results of configure | 4194 | # This file is a shell script that caches the results of configure |
@@ -4883,6 +4897,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 | |||
4883 | for ac_config_target in $ac_config_targets | 4897 | for ac_config_target in $ac_config_targets |
4884 | do | 4898 | do |
4885 | case $ac_config_target in | 4899 | case $ac_config_target in |
4900 | "mkdeb.sh") CONFIG_FILES="$CONFIG_FILES mkdeb.sh" ;; | ||
4886 | "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; | 4901 | "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; |
4887 | "src/common.mk") CONFIG_FILES="$CONFIG_FILES src/common.mk" ;; | 4902 | "src/common.mk") CONFIG_FILES="$CONFIG_FILES src/common.mk" ;; |
4888 | "src/lib/Makefile") CONFIG_FILES="$CONFIG_FILES src/lib/Makefile" ;; | 4903 | "src/lib/Makefile") CONFIG_FILES="$CONFIG_FILES src/lib/Makefile" ;; |
@@ -4902,6 +4917,7 @@ do | |||
4902 | "src/fldd/Makefile") CONFIG_FILES="$CONFIG_FILES src/fldd/Makefile" ;; | 4917 | "src/fldd/Makefile") CONFIG_FILES="$CONFIG_FILES src/fldd/Makefile" ;; |
4903 | "src/libpostexecseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/libpostexecseccomp/Makefile" ;; | 4918 | "src/libpostexecseccomp/Makefile") CONFIG_FILES="$CONFIG_FILES src/libpostexecseccomp/Makefile" ;; |
4904 | "src/fsec-optimize/Makefile") CONFIG_FILES="$CONFIG_FILES src/fsec-optimize/Makefile" ;; | 4919 | "src/fsec-optimize/Makefile") CONFIG_FILES="$CONFIG_FILES src/fsec-optimize/Makefile" ;; |
4920 | "src/profstats/Makefile") CONFIG_FILES="$CONFIG_FILES src/profstats/Makefile" ;; | ||
4905 | 4921 | ||
4906 | *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; | 4922 | *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; |
4907 | esac | 4923 | esac |
@@ -5320,6 +5336,11 @@ which seems to be undefined. Please make sure it is defined" >&2;} | |||
5320 | 5336 | ||
5321 | esac | 5337 | esac |
5322 | 5338 | ||
5339 | |||
5340 | case $ac_file$ac_mode in | ||
5341 | "mkdeb.sh":F) chmod +x mkdeb.sh ;; | ||
5342 | |||
5343 | esac | ||
5323 | done # for ac_tag | 5344 | done # for ac_tag |
5324 | 5345 | ||
5325 | 5346 | ||
diff --git a/configure.ac b/configure.ac index 3c9f901cb..feb0b38a6 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -204,9 +204,11 @@ if test "$prefix" = /usr; then | |||
204 | test "$sysconfdir" = '${prefix}/etc' && sysconfdir="/etc" | 204 | test "$sysconfdir" = '${prefix}/etc' && sysconfdir="/etc" |
205 | fi | 205 | fi |
206 | 206 | ||
207 | AC_CONFIG_FILES([mkdeb.sh], [chmod +x mkdeb.sh]) | ||
207 | AC_OUTPUT(Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile \ | 208 | AC_OUTPUT(Makefile src/common.mk src/lib/Makefile src/fcopy/Makefile src/fnet/Makefile src/firejail/Makefile src/fnetfilter/Makefile \ |
208 | src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \ | 209 | src/firemon/Makefile src/libtrace/Makefile src/libtracelog/Makefile src/firecfg/Makefile src/fbuilder/Makefile src/fsec-print/Makefile \ |
209 | src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile) | 210 | src/ftee/Makefile src/faudit/Makefile src/fseccomp/Makefile src/fldd/Makefile src/libpostexecseccomp/Makefile src/fsec-optimize/Makefile \ |
211 | src/profstats/Makefile) | ||
210 | 212 | ||
211 | echo | 213 | echo |
212 | echo "Configuration options:" | 214 | echo "Configuration options:" |
diff --git a/contrib/syscalls.sh b/contrib/syscalls.sh index c9b5a245a..b990ac23c 100755 --- a/contrib/syscalls.sh +++ b/contrib/syscalls.sh | |||
@@ -8,26 +8,22 @@ SYSCALLS_OUTPUT_FILE="$(pwd)/syscalls.txt" | |||
8 | 8 | ||
9 | if [ $# -eq 0 ] | 9 | if [ $# -eq 0 ] |
10 | then | 10 | then |
11 | echo | 11 | echo |
12 | echo " *** No program specified!!! ***" | 12 | echo " *** No program specified!!! ***" |
13 | echo | 13 | echo |
14 | echo -e "Make this file executable and execute it as:\\n" | 14 | echo -e "Make this file executable and execute it as:\\n" |
15 | echo -e "\\e[96m syscalls.sh /full/path/to/program\\n" | 15 | echo -e "\\e[96m syscalls.sh /full/path/to/program\\n" |
16 | echo -e "\\e[39mif you saved this script in a directory in your PATH (e.g., in ${HOME}/bin), otherwise as:\\n" | 16 | echo -e "\\e[39mif you saved this script in a directory in your PATH (e.g., in ${HOME}/bin), otherwise as:\\n" |
17 | echo -e "\\e[96m ./syscalls.sh /full/path/to/program\\n" | 17 | echo -e "\\e[96m ./syscalls.sh /full/path/to/program\\n" |
18 | echo -e "\\e[39mUse the full path to the respective program to avoid executing it sandboxed with Firejail\\n(if a Firejail profile for it already exits and 'sudo firecfg' was executed earlier)\\nin order to determine the necessary system calls." | 18 | echo -e "\\e[39mUse the full path to the respective program to avoid executing it sandboxed with Firejail\\n(if a Firejail profile for it already exits and 'sudo firecfg' was executed earlier)\\nin order to determine the necessary system calls." |
19 | echo | 19 | echo |
20 | exit 0 | 20 | exit 0 |
21 | |||
22 | else | 21 | else |
23 | 22 | strace -cfo "$STRACE_OUTPUT_FILE" "$@" && awk '{print $NF}' "$STRACE_OUTPUT_FILE" | sed '/syscall\|-\|total/d' | sort -u | awk -vORS=, '{ print $1 }' | sed 's/,$/\n/' > "$SYSCALLS_OUTPUT_FILE" | |
24 | strace -cfo "$STRACE_OUTPUT_FILE" "$@" && awk '{print $NF}' "$STRACE_OUTPUT_FILE" | sed '/syscall\|-\|total/d' | sort -u | awk -vORS=, '{ print $1 }' | sed 's/,$/\n/' > "$SYSCALLS_OUTPUT_FILE" | 23 | echo |
25 | echo | 24 | echo -e "\e[39mThese are the sorted syscalls:\n\e[93m" |
26 | echo -e "\e[39mThese are the sorted syscalls:\n\e[93m" | 25 | cat "$SYSCALLS_OUTPUT_FILE" |
27 | cat "$SYSCALLS_OUTPUT_FILE" | 26 | echo |
28 | echo | 27 | echo -e "\e[39mThe sorted syscalls were saved to:\n\e[96m$SYSCALLS_OUTPUT_FILE\n\e[39m" |
29 | echo -e "\e[39mThe sorted syscalls were saved to:\n\n\e[96m$SYSCALLS_OUTPUT_FILE" | 28 | exit 0 |
30 | echo | ||
31 | exit 0 | ||
32 | |||
33 | fi | 29 | fi |
diff --git a/contrib/update_deb.sh b/contrib/update_deb.sh index d417a09ea..1fceca788 100755 --- a/contrib/update_deb.sh +++ b/contrib/update_deb.sh | |||
@@ -6,11 +6,19 @@ | |||
6 | # Purpose: Fetch, compile, and install firejail from GitHub source. For | 6 | # Purpose: Fetch, compile, and install firejail from GitHub source. For |
7 | # Debian-based distros only (Ubuntu, Mint, etc). | 7 | # Debian-based distros only (Ubuntu, Mint, etc). |
8 | set -e | 8 | set -e |
9 | |||
9 | git clone --depth=1 https://github.com/netblue30/firejail.git | 10 | git clone --depth=1 https://github.com/netblue30/firejail.git |
10 | cd firejail | 11 | cd firejail |
11 | ./configure --prefix=/usr | 12 | ./configure --enable-apparmor --prefix=/usr |
13 | |||
14 | # Fix https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916920 | ||
15 | sed -i \ | ||
16 | -e "s/# cgroup .*/cgroup no/" \ | ||
17 | -e "s/# restricted-network .*/restricted-network yes/" \ | ||
18 | etc/firejail.config | ||
19 | |||
12 | make deb | 20 | make deb |
13 | sudo dpkg -i firejail*.deb | 21 | sudo dpkg -i firejail*.deb |
14 | echo "Firejail was updated!" | 22 | echo "Firejail updated." |
15 | cd .. | 23 | cd .. |
16 | rm -rf firejail | 24 | rm -rf firejail |
diff --git a/dummy.c b/dummy.c deleted file mode 100644 index fbf3dd775..000000000 --- a/dummy.c +++ /dev/null | |||
@@ -1,7 +0,0 @@ | |||
1 | // This file is part of Firejail project | ||
2 | // Copyright (C) 2014-2020 Firejail Authors | ||
3 | // License GPL v2 | ||
4 | |||
5 | int main(void) { | ||
6 | return 0; | ||
7 | } | ||
diff --git a/etc-fixes/0.9.52/atom.profile b/etc-fixes/0.9.52/atom.profile new file mode 100644 index 000000000..87ffdced9 --- /dev/null +++ b/etc-fixes/0.9.52/atom.profile | |||
@@ -0,0 +1,31 @@ | |||
1 | # Firejail profile for atom | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include /etc/firejail/atom.local | ||
5 | # Persistent global definitions | ||
6 | include /etc/firejail/globals.local | ||
7 | |||
8 | # blacklist /run/user/*/bus | ||
9 | |||
10 | noblacklist ${HOME}/.atom | ||
11 | noblacklist ${HOME}/.config/Atom | ||
12 | |||
13 | include /etc/firejail/disable-common.inc | ||
14 | include /etc/firejail/disable-passwdmgr.inc | ||
15 | include /etc/firejail/disable-programs.inc | ||
16 | |||
17 | caps.keep sys_admin,sys_chroot | ||
18 | # net none | ||
19 | netfilter | ||
20 | nodvd | ||
21 | nogroups | ||
22 | nosound | ||
23 | notv | ||
24 | novideo | ||
25 | shell none | ||
26 | |||
27 | private-dev | ||
28 | private-tmp | ||
29 | |||
30 | noexec ${HOME} | ||
31 | noexec /tmp | ||
diff --git a/etc-fixes/0.9.58/atom.profile b/etc-fixes/0.9.58/atom.profile new file mode 100644 index 000000000..9bc35da5a --- /dev/null +++ b/etc-fixes/0.9.58/atom.profile | |||
@@ -0,0 +1,36 @@ | |||
1 | |||
2 | # Firejail profile for atom | ||
3 | # Description: A hackable text editor for the 21st Century | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include atom.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.atom | ||
11 | noblacklist ${HOME}/.config/Atom | ||
12 | noblacklist ${HOME}/.cargo/config | ||
13 | noblacklist ${HOME}/.cargo/registry | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | |||
19 | caps.keep sys_admin,sys_chroot | ||
20 | # net none | ||
21 | netfilter | ||
22 | nodbus | ||
23 | nodvd | ||
24 | nogroups | ||
25 | nosound | ||
26 | notv | ||
27 | nou2f | ||
28 | novideo | ||
29 | shell none | ||
30 | |||
31 | private-cache | ||
32 | private-dev | ||
33 | private-tmp | ||
34 | |||
35 | noexec ${HOME} | ||
36 | noexec /tmp | ||
diff --git a/etc-fixes/0.9.60/atom.profile b/etc-fixes/0.9.60/atom.profile new file mode 100644 index 000000000..c8929127b --- /dev/null +++ b/etc-fixes/0.9.60/atom.profile | |||
@@ -0,0 +1,37 @@ | |||
1 | # Firejail profile for atom | ||
2 | # Description: A hackable text editor for the 21st Century | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include atom.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.atom | ||
10 | noblacklist ${HOME}/.config/Atom | ||
11 | noblacklist ${HOME}/.config/git | ||
12 | noblacklist ${HOME}/.cargo/config | ||
13 | noblacklist ${HOME}/.cargo/registry | ||
14 | noblacklist ${HOME}/.gitconfig | ||
15 | noblacklist ${HOME}/.git-credentials | ||
16 | noblacklist ${HOME}/.pythonrc.py | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | |||
23 | caps.keep sys_admin,sys_chroot | ||
24 | # net none | ||
25 | netfilter | ||
26 | nodbus | ||
27 | nodvd | ||
28 | nogroups | ||
29 | nosound | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | shell none | ||
34 | |||
35 | private-cache | ||
36 | private-dev | ||
37 | private-tmp | ||
diff --git a/etc/Thunar.profile b/etc/Thunar.profile deleted file mode 100644 index 761440ccc..000000000 --- a/etc/Thunar.profile +++ /dev/null | |||
@@ -1,33 +0,0 @@ | |||
1 | # Firejail profile for Thunar | ||
2 | # Description: File Manager for Xfce | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include Thunar.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/Trash | ||
10 | noblacklist ${HOME}/.config/Thunar | ||
11 | noblacklist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/thunar.xml | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | ||
18 | |||
19 | allusers | ||
20 | caps.drop all | ||
21 | netfilter | ||
22 | no3d | ||
23 | nodvd | ||
24 | nogroups | ||
25 | nonewprivs | ||
26 | noroot | ||
27 | nosound | ||
28 | notv | ||
29 | novideo | ||
30 | protocol unix | ||
31 | seccomp | ||
32 | shell none | ||
33 | tracelog | ||
diff --git a/etc/firejail-default b/etc/apparmor/firejail-default index 763b838d3..04a38f0ce 100644 --- a/etc/firejail-default +++ b/etc/apparmor/firejail-default | |||
@@ -19,6 +19,8 @@ profile firejail-default flags=(attach_disconnected,mediate_deleted) { | |||
19 | #include <abstractions/dbus-strict> | 19 | #include <abstractions/dbus-strict> |
20 | #include <abstractions/dbus-session-strict> | 20 | #include <abstractions/dbus-session-strict> |
21 | dbus, | 21 | dbus, |
22 | # Add rule in order to avoid dbus-*=filter breakage (#3432) | ||
23 | owner /{,var/}run/firejail/dbus/[0-9]*/[0-9]*-user w, | ||
22 | 24 | ||
23 | ########## | 25 | ########## |
24 | # With ptrace it is possible to inspect and hijack running programs. | 26 | # With ptrace it is possible to inspect and hijack running programs. |
@@ -47,6 +49,10 @@ owner /{,run/firejail/mnt/oroot/}{,var/}run/firejail/mnt/trace w, | |||
47 | owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/** w, | 49 | owner /{,run/firejail/mnt/oroot/}{,var/}run/user/[0-9]*/** w, |
48 | owner /{,run/firejail/mnt/oroot/}{run,dev}/shm/** w, | 50 | owner /{,run/firejail/mnt/oroot/}{run,dev}/shm/** w, |
49 | 51 | ||
52 | # Allow writing to /var/mail and /var/spool/mail (for mail clients) | ||
53 | # Uncomment to enable | ||
54 | #owner /var/{mail,spool/mail}/** w, | ||
55 | |||
50 | # Allow writing to removable media | 56 | # Allow writing to removable media |
51 | owner /{,var/}run/media/** w, | 57 | owner /{,var/}run/media/** w, |
52 | 58 | ||
@@ -65,6 +71,8 @@ owner /proc/@{PID}/{uid_map,gid_map,setgroups} w, | |||
65 | 71 | ||
66 | # Needed for electron apps | 72 | # Needed for electron apps |
67 | /proc/@{PID}/comm w, | 73 | /proc/@{PID}/comm w, |
74 | # Needed for nslookup, dig, host | ||
75 | /proc/@{PID}/task/@{PID}/comm w, | ||
68 | 76 | ||
69 | # Used by chromium | 77 | # Used by chromium |
70 | owner /proc/@{PID}/oom_score_adj w, | 78 | owner /proc/@{PID}/oom_score_adj w, |
diff --git a/etc/firejail-local b/etc/apparmor/firejail-local index f086653f8..f086653f8 100644 --- a/etc/firejail-local +++ b/etc/apparmor/firejail-local | |||
diff --git a/etc/caja.profile b/etc/caja.profile deleted file mode 100644 index 7bf901ae3..000000000 --- a/etc/caja.profile +++ /dev/null | |||
@@ -1,43 +0,0 @@ | |||
1 | # Firejail profile for caja | ||
2 | # Description: File manager for the MATE desktop | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include caja.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a caja process running on MATE desktops firejail will have no effect. | ||
11 | |||
12 | noblacklist ${HOME}/.local/share/Trash | ||
13 | # noblacklist ${HOME}/.config/caja - disable-programs.inc is disabled, see below | ||
14 | # noblacklist ${HOME}/.local/share/caja-python | ||
15 | |||
16 | # Allow python (blacklisted by disable-interpreters.inc) | ||
17 | include allow-python2.inc | ||
18 | include allow-python3.inc | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-interpreters.inc | ||
23 | include disable-passwdmgr.inc | ||
24 | # include disable-programs.inc | ||
25 | |||
26 | allusers | ||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | novideo | ||
35 | protocol unix | ||
36 | seccomp | ||
37 | shell none | ||
38 | tracelog | ||
39 | |||
40 | # caja needs to be able to start arbitrary applications so we cannot blacklist their files | ||
41 | # private-bin caja | ||
42 | # private-dev | ||
43 | # private-tmp | ||
diff --git a/etc/dolphin.profile b/etc/dolphin.profile deleted file mode 100644 index 0e5a6e6fe..000000000 --- a/etc/dolphin.profile +++ /dev/null | |||
@@ -1,39 +0,0 @@ | |||
1 | # Firejail profile for dolphin | ||
2 | # Description: File manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include dolphin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/Trash | ||
10 | # noblacklist ${HOME}/.cache/dolphin - disable-programs.inc is disabled, see below | ||
11 | # noblacklist ${HOME}/.config/dolphinrc | ||
12 | # noblacklist ${HOME}/.local/share/dolphin | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | # dolphin needs to be able to start arbitrary applications so we cannot blacklist their files | ||
19 | # include disable-programs.inc | ||
20 | |||
21 | allusers | ||
22 | caps.drop all | ||
23 | # net none | ||
24 | netfilter | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | # Comment the next line (or put 'ignore noroot' in your dolphin.local) if you use MPV+Vulkan (see issue #3012) | ||
29 | noroot | ||
30 | notv | ||
31 | novideo | ||
32 | protocol unix,inet,inet6,netlink | ||
33 | seccomp | ||
34 | shell none | ||
35 | |||
36 | private-dev | ||
37 | # private-tmp | ||
38 | |||
39 | join-or-start dolphin | ||
diff --git a/etc/firejail.config b/etc/firejail.config index 6fb7d829a..731e744dd 100644 --- a/etc/firejail.config +++ b/etc/firejail.config | |||
@@ -27,7 +27,7 @@ | |||
27 | # Enable or disable chroot support, default enabled. | 27 | # Enable or disable chroot support, default enabled. |
28 | # chroot yes | 28 | # chroot yes |
29 | 29 | ||
30 | # Enable or disable dbus handling by --nodbus flag, default enabled. | 30 | # Enable or disable dbus handling, default enabled. |
31 | # dbus yes | 31 | # dbus yes |
32 | 32 | ||
33 | # Disable /mnt, /media, /run/mount and /run/media access. By default access | 33 | # Disable /mnt, /media, /run/mount and /run/media access. By default access |
@@ -70,6 +70,13 @@ | |||
70 | # Enable or disable sandbox name change, default enabled. | 70 | # Enable or disable sandbox name change, default enabled. |
71 | # name-change yes | 71 | # name-change yes |
72 | 72 | ||
73 | # Change default netfilter configuration. When using --netfilter option without | ||
74 | # a file argument, the default filter is hardcoded (see man 1 firejail). This | ||
75 | # configuration entry allows the user to change the default by specifying | ||
76 | # a file containing the filter configuration. The filter file format is the | ||
77 | # format of iptables-save and iptable-restore commands. Example: | ||
78 | # netfilter-default /etc/iptables.iptables.rules | ||
79 | |||
73 | # Enable or disable networking features, default enabled. | 80 | # Enable or disable networking features, default enabled. |
74 | # network yes | 81 | # network yes |
75 | 82 | ||
@@ -79,12 +86,12 @@ | |||
79 | # Remove /usr/local directories from private-bin list, default disabled. | 86 | # Remove /usr/local directories from private-bin list, default disabled. |
80 | # private-bin-no-local no | 87 | # private-bin-no-local no |
81 | 88 | ||
82 | # Enable or disable private-home feature, default enabled | ||
83 | # private-home yes | ||
84 | |||
85 | # Enable or disable private-cache feature, default enabled | 89 | # Enable or disable private-cache feature, default enabled |
86 | # private-cache yes | 90 | # private-cache yes |
87 | 91 | ||
92 | # Enable or disable private-home feature, default enabled | ||
93 | # private-home yes | ||
94 | |||
88 | # Enable or disable private-lib feature, default enabled | 95 | # Enable or disable private-lib feature, default enabled |
89 | # private-lib yes | 96 | # private-lib yes |
90 | 97 | ||
@@ -97,16 +104,12 @@ | |||
97 | # --netfilter only to root user. Regular users are only allowed --net=none. | 104 | # --netfilter only to root user. Regular users are only allowed --net=none. |
98 | # restricted-network no | 105 | # restricted-network no |
99 | 106 | ||
100 | # Change default netfilter configuration. When using --netfilter option without | ||
101 | # a file argument, the default filter is hardcoded (see man 1 firejail). This | ||
102 | # configuration entry allows the user to change the default by specifying | ||
103 | # a file containing the filter configuration. The filter file format is the | ||
104 | # format of iptables-save and iptable-restore commands. Example: | ||
105 | # netfilter-default /etc/iptables.iptables.rules | ||
106 | |||
107 | # Enable or disable seccomp support, default enabled. | 107 | # Enable or disable seccomp support, default enabled. |
108 | # seccomp yes | 108 | # seccomp yes |
109 | 109 | ||
110 | # Seccomp error action, kill, log or errno (EPERM, ENOSYS etc) | ||
111 | # seccomp-error-action EPERM | ||
112 | |||
110 | # Enable or disable user namespace support, default enabled. | 113 | # Enable or disable user namespace support, default enabled. |
111 | # userns yes | 114 | # userns yes |
112 | 115 | ||
@@ -116,6 +119,10 @@ | |||
116 | # Enable or disable X11 sandboxing support, default enabled. | 119 | # Enable or disable X11 sandboxing support, default enabled. |
117 | # x11 yes | 120 | # x11 yes |
118 | 121 | ||
122 | # Xephyr command extra parameters. None by default; these are examples. | ||
123 | # xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev | ||
124 | # xephyr-extra-params -grayscale | ||
125 | |||
119 | # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for | 126 | # Screen size for --x11=xephyr, default 800x600. Run /usr/bin/xrandr for |
120 | # a full list of resolutions available on your specific setup. | 127 | # a full list of resolutions available on your specific setup. |
121 | # xephyr-screen 640x480 | 128 | # xephyr-screen 640x480 |
@@ -126,17 +133,13 @@ | |||
126 | # Firejail window title in Xephyr, default enabled. | 133 | # Firejail window title in Xephyr, default enabled. |
127 | # xephyr-window-title yes | 134 | # xephyr-window-title yes |
128 | 135 | ||
129 | # Xephyr command extra parameters. None by default; these are examples. | ||
130 | # xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev | ||
131 | # xephyr-extra-params -grayscale | ||
132 | |||
133 | # Xpra server command extra parameters. None by default; this is an example. | ||
134 | # xpra-extra-params --dpi 96 | ||
135 | |||
136 | # Enable this option if you have a version of Xpra that supports --attach switch | 136 | # Enable this option if you have a version of Xpra that supports --attach switch |
137 | # for start command, default disabled. | 137 | # for start command, default disabled. |
138 | # xpra-attach no | 138 | # xpra-attach no |
139 | 139 | ||
140 | # Xpra server command extra parameters. None by default; this is an example. | ||
141 | # xpra-extra-params --dpi 96 | ||
142 | |||
140 | # Screen size for --x11=xvfb, default 800x600x24. The third dimension is | 143 | # Screen size for --x11=xvfb, default 800x600x24. The third dimension is |
141 | # color depth; use 24 unless you know exactly what you're doing. | 144 | # color depth; use 24 unless you know exactly what you're doing. |
142 | # xvfb-screen 640x480x24 | 145 | # xvfb-screen 640x480x24 |
diff --git a/etc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc index 63174eda6..7cd087b14 100644 --- a/etc/allow-common-devel.inc +++ b/etc/inc/allow-common-devel.inc | |||
@@ -12,10 +12,16 @@ noblacklist ${HOME}/.gradle | |||
12 | noblacklist ${HOME}/.java | 12 | noblacklist ${HOME}/.java |
13 | 13 | ||
14 | # Python | 14 | # Python |
15 | noblacklist ${HOME}/.pylint.d | ||
15 | noblacklist ${HOME}/.python-history | 16 | noblacklist ${HOME}/.python-history |
16 | noblacklist ${HOME}/.python_history | 17 | noblacklist ${HOME}/.python_history |
17 | noblacklist ${HOME}/.pythonhist | 18 | noblacklist ${HOME}/.pythonhist |
18 | 19 | ||
19 | # Rust | 20 | # Rust |
21 | noblacklist ${HOME}/.cargo/advisory-db | ||
20 | noblacklist ${HOME}/.cargo/config | 22 | noblacklist ${HOME}/.cargo/config |
23 | noblacklist ${HOME}/.cargo/git | ||
21 | noblacklist ${HOME}/.cargo/registry | 24 | noblacklist ${HOME}/.cargo/registry |
25 | noblacklist ${HOME}/.cargo/.crates.toml | ||
26 | noblacklist ${HOME}/.cargo/.crates2.json | ||
27 | noblacklist ${HOME}/.cargo/.package-cache | ||
diff --git a/etc/allow-gjs.inc b/etc/inc/allow-gjs.inc index f552ede9d..f4f9926cd 100644 --- a/etc/allow-gjs.inc +++ b/etc/inc/allow-gjs.inc | |||
@@ -8,3 +8,4 @@ noblacklist /usr/lib/gjs | |||
8 | noblacklist /usr/lib64/gjs | 8 | noblacklist /usr/lib64/gjs |
9 | noblacklist /usr/lib/libgjs* | 9 | noblacklist /usr/lib/libgjs* |
10 | noblacklist /usr/lib64/libgjs* | 10 | noblacklist /usr/lib64/libgjs* |
11 | noblacklist /usr/lib64/libmozjs-* | ||
diff --git a/etc/allow-java.inc b/etc/inc/allow-java.inc index 24d18fb77..24d18fb77 100644 --- a/etc/allow-java.inc +++ b/etc/inc/allow-java.inc | |||
diff --git a/etc/allow-lua.inc b/etc/inc/allow-lua.inc index fbdee22ee..9df8e8d32 100644 --- a/etc/allow-lua.inc +++ b/etc/inc/allow-lua.inc | |||
@@ -3,6 +3,8 @@ | |||
3 | include allow-lua.local | 3 | include allow-lua.local |
4 | 4 | ||
5 | noblacklist ${PATH}/lua* | 5 | noblacklist ${PATH}/lua* |
6 | noblacklist /usr/include/lua* | 6 | noblacklist /usr/include |
7 | noblacklist /usr/lib/liblua* | ||
7 | noblacklist /usr/lib/lua | 8 | noblacklist /usr/lib/lua |
8 | noblacklist /usr/share/lua | 9 | noblacklist /usr/share/lua |
10 | noblacklist /usr/share/lua* | ||
diff --git a/etc/allow-perl.inc b/etc/inc/allow-perl.inc index f44e1e3cc..f44e1e3cc 100644 --- a/etc/allow-perl.inc +++ b/etc/inc/allow-perl.inc | |||
diff --git a/etc/allow-php.inc b/etc/inc/allow-php.inc index a0950dc26..a0950dc26 100644 --- a/etc/allow-php.inc +++ b/etc/inc/allow-php.inc | |||
diff --git a/etc/allow-python2.inc b/etc/inc/allow-python2.inc index b0525e2e1..b0525e2e1 100644 --- a/etc/allow-python2.inc +++ b/etc/inc/allow-python2.inc | |||
diff --git a/etc/allow-python3.inc b/etc/inc/allow-python3.inc index d968886b0..d968886b0 100644 --- a/etc/allow-python3.inc +++ b/etc/inc/allow-python3.inc | |||
diff --git a/etc/allow-ruby.inc b/etc/inc/allow-ruby.inc index a8c701219..a8c701219 100644 --- a/etc/allow-ruby.inc +++ b/etc/inc/allow-ruby.inc | |||
diff --git a/etc/disable-common.inc b/etc/inc/disable-common.inc index bf29cd137..c7516ab42 100644 --- a/etc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -64,8 +64,9 @@ blacklist /etc/xdg/autostart | |||
64 | read-only ${HOME}/.Xauthority | 64 | read-only ${HOME}/.Xauthority |
65 | 65 | ||
66 | # Session manager | 66 | # Session manager |
67 | ?HAS_X11: blacklist ${HOME}/.ICEauthority | 67 | # see #3358 |
68 | ?HAS_X11: blacklist /tmp/.ICE-unix | 68 | #?HAS_X11: blacklist ${HOME}/.ICEauthority |
69 | #?HAS_X11: blacklist /tmp/.ICE-unix | ||
69 | 70 | ||
70 | # KDE config | 71 | # KDE config |
71 | blacklist ${HOME}/.config/khotkeysrc | 72 | blacklist ${HOME}/.config/khotkeysrc |
@@ -136,21 +137,27 @@ read-only ${HOME}/.local/share/kssl | |||
136 | blacklist ${RUNUSER}/*.slave-socket | 137 | blacklist ${RUNUSER}/*.slave-socket |
137 | blacklist ${RUNUSER}/kdeinit5__* | 138 | blacklist ${RUNUSER}/kdeinit5__* |
138 | blacklist ${RUNUSER}/kdesud_* | 139 | blacklist ${RUNUSER}/kdesud_* |
139 | ?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-* | 140 | # see #3358 |
140 | ?HAS_NODBUS: blacklist /tmp/ksocket-* | 141 | #?HAS_NODBUS: blacklist ${RUNUSER}/ksocket-* |
142 | #?HAS_NODBUS: blacklist /tmp/ksocket-* | ||
141 | 143 | ||
142 | # gnome | 144 | # gnome |
143 | # contains extensions, last used times of applications, and notifications | 145 | # contains extensions, last used times of applications, and notifications |
144 | blacklist ${HOME}/.local/share/gnome-shell | 146 | blacklist ${HOME}/.local/share/gnome-shell |
145 | # no direct modification of dconf database | 147 | # no direct modification of dconf database |
146 | read-only ${HOME}/.config/dconf | 148 | read-only ${HOME}/.config/dconf |
149 | blacklist ${RUNUSER}/gnome-session-leader-fifo | ||
150 | blacklist ${RUNUSER}/gnome-shell | ||
151 | blacklist ${RUNUSER}/gsconnect | ||
147 | 152 | ||
148 | # systemd | 153 | # systemd |
149 | blacklist ${HOME}/.config/systemd | 154 | blacklist ${HOME}/.config/systemd |
150 | blacklist ${HOME}/.local/share/systemd | 155 | blacklist ${HOME}/.local/share/systemd |
151 | blacklist /var/lib/systemd | 156 | blacklist /var/lib/systemd |
152 | # blacklist /var/run/systemd | 157 | blacklist ${PATH}/systemd-run |
158 | blacklist ${RUNUSER}/systemd | ||
153 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf | 159 | # creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf |
160 | #blacklist /var/run/systemd | ||
154 | 161 | ||
155 | # openrc | 162 | # openrc |
156 | blacklist /etc/runlevels/ | 163 | blacklist /etc/runlevels/ |
@@ -166,6 +173,21 @@ blacklist ${HOME}/VirtualBox VMs | |||
166 | blacklist ${HOME}/.config/gnome-boxes | 173 | blacklist ${HOME}/.config/gnome-boxes |
167 | blacklist ${HOME}/.local/share/gnome-boxes | 174 | blacklist ${HOME}/.local/share/gnome-boxes |
168 | 175 | ||
176 | # libvirt | ||
177 | blacklist ${HOME}/.cache/libvirt | ||
178 | blacklist ${HOME}/.config/libvirt | ||
179 | blacklist ${RUNUSER}/libvirt | ||
180 | blacklist /var/cache/libvirt | ||
181 | blacklist /var/lib/libvirt | ||
182 | blacklist /var/log/libvirt | ||
183 | |||
184 | # OCI-Containers / Podman | ||
185 | blacklist ${RUNUSER}/containers | ||
186 | blacklist ${RUNUSER}/crun | ||
187 | blacklist ${RUNUSER}/libpod | ||
188 | blacklist ${RUNUSER}/runc | ||
189 | blacklist ${RUNUSER}/toolbox | ||
190 | |||
169 | # VeraCrypt | 191 | # VeraCrypt |
170 | blacklist ${HOME}/.VeraCrypt | 192 | blacklist ${HOME}/.VeraCrypt |
171 | blacklist ${PATH}/veracrypt | 193 | blacklist ${PATH}/veracrypt |
@@ -300,13 +322,17 @@ read-only ${HOME}/bin | |||
300 | read-only ${HOME}/.bin | 322 | read-only ${HOME}/.bin |
301 | read-only ${HOME}/.local/bin | 323 | read-only ${HOME}/.local/bin |
302 | read-only ${HOME}/.cargo/bin | 324 | read-only ${HOME}/.cargo/bin |
303 | read-only ${HOME}/.cargo/env | ||
304 | 325 | ||
305 | # Write-protection for desktop entries | 326 | # Write-protection for desktop entries |
306 | read-only ${HOME}/.config/menus | 327 | read-only ${HOME}/.config/menus |
307 | read-only ${HOME}/.gnome/apps | 328 | read-only ${HOME}/.gnome/apps |
308 | read-only ${HOME}/.local/share/applications | 329 | read-only ${HOME}/.local/share/applications |
309 | 330 | ||
331 | read-only ${HOME}/.config/mimeapps.list | ||
332 | read-only ${HOME}/.config/user-dirs.dirs | ||
333 | read-only ${HOME}/.config/user-dirs.locale | ||
334 | read-only ${HOME}/.local/share/mime | ||
335 | |||
310 | # Write-protection for thumbnailer dir | 336 | # Write-protection for thumbnailer dir |
311 | read-only ${HOME}/.local/share/thumbnailers | 337 | read-only ${HOME}/.local/share/thumbnailers |
312 | 338 | ||
@@ -376,6 +402,7 @@ blacklist /usr/sbin | |||
376 | 402 | ||
377 | # system management | 403 | # system management |
378 | blacklist ${PATH}/at | 404 | blacklist ${PATH}/at |
405 | blacklist ${PATH}/busybox | ||
379 | blacklist ${PATH}/chage | 406 | blacklist ${PATH}/chage |
380 | blacklist ${PATH}/chfn | 407 | blacklist ${PATH}/chfn |
381 | blacklist ${PATH}/chsh | 408 | blacklist ${PATH}/chsh |
@@ -443,14 +470,30 @@ blacklist /vmlinuz* | |||
443 | blacklist /.snapshots | 470 | blacklist /.snapshots |
444 | 471 | ||
445 | # flatpak | 472 | # flatpak |
473 | blacklist ${HOME}/.cache/flatpak | ||
446 | blacklist ${HOME}/.config/flatpak | 474 | blacklist ${HOME}/.config/flatpak |
447 | blacklist ${HOME}/.local/share/flatpak | 475 | blacklist ${HOME}/.local/share/flatpak/app |
476 | blacklist ${HOME}/.local/share/flatpak/appstream | ||
477 | blacklist ${HOME}/.local/share/flatpak/db | ||
478 | read-only ${HOME}/.local/share/flatpak/exports | ||
479 | blacklist ${HOME}/.local/share/flatpak/oci | ||
480 | blacklist ${HOME}/.local/share/flatpak/overrides | ||
481 | blacklist ${HOME}/.local/share/flatpak/repo | ||
482 | blacklist ${HOME}/.local/share/flatpak/runtime | ||
448 | blacklist ${HOME}/.var | 483 | blacklist ${HOME}/.var |
484 | blacklist ${RUNUSER}/app | ||
485 | blacklist ${RUNUSER}/doc | ||
486 | blacklist ${RUNUSER}/.dbus-proxy | ||
487 | blacklist ${RUNUSER}/.flatpak | ||
488 | blacklist ${RUNUSER}/.flatpak-helper | ||
449 | blacklist /usr/share/flatpak | 489 | blacklist /usr/share/flatpak |
450 | blacklist /var/lib/flatpak | 490 | blacklist /var/lib/flatpak |
451 | # most of the time bwrap is SUID binary | 491 | # most of the time bwrap is SUID binary |
452 | blacklist ${PATH}/bwrap | 492 | blacklist ${PATH}/bwrap |
453 | 493 | ||
494 | # snap | ||
495 | blacklist ${RUNUSER}/snapd-session-agent.socket | ||
496 | |||
454 | # mail directories used by mutt | 497 | # mail directories used by mutt |
455 | blacklist ${HOME}/.Mail | 498 | blacklist ${HOME}/.Mail |
456 | blacklist ${HOME}/.mail | 499 | blacklist ${HOME}/.mail |
@@ -462,3 +505,22 @@ blacklist ${HOME}/sent | |||
462 | 505 | ||
463 | # kernel configuration | 506 | # kernel configuration |
464 | blacklist /proc/config.gz | 507 | blacklist /proc/config.gz |
508 | |||
509 | # prevent DNS malware attempting to communicate with the server | ||
510 | # using regular DNS tools | ||
511 | blacklist ${PATH}/dig | ||
512 | blacklist ${PATH}/kdig | ||
513 | blacklist ${PATH}/nslookup | ||
514 | blacklist ${PATH}/host | ||
515 | blacklist ${PATH}/dlint | ||
516 | blacklist ${PATH}/dnswalk | ||
517 | blacklist ${PATH}/dns2tcp | ||
518 | blacklist ${PATH}/iodine | ||
519 | blacklist ${PATH}/knsupdate | ||
520 | blacklist ${PATH}/resolvectl | ||
521 | |||
522 | # rest of ${RUNUSER} | ||
523 | blacklist ${RUNUSER}/*.lock | ||
524 | blacklist ${RUNUSER}/inaccessible | ||
525 | blacklist ${RUNUSER}/update-notifier.pid | ||
526 | blacklist ${RUNUSER}/pk-debconf-socket | ||
diff --git a/etc/disable-devel.inc b/etc/inc/disable-devel.inc index 59df9fb0f..e1ba13380 100644 --- a/etc/disable-devel.inc +++ b/etc/inc/disable-devel.inc | |||
@@ -26,7 +26,6 @@ blacklist ${PATH}/*-gcc* | |||
26 | blacklist ${PATH}/*-g++* | 26 | blacklist ${PATH}/*-g++* |
27 | blacklist ${PATH}/*-gcc* | 27 | blacklist ${PATH}/*-gcc* |
28 | blacklist ${PATH}/*-g++* | 28 | blacklist ${PATH}/*-g++* |
29 | blacklist /usr/include | ||
30 | # seems to create problems on Gentoo | 29 | # seems to create problems on Gentoo |
31 | #blacklist /usr/lib/gcc | 30 | #blacklist /usr/lib/gcc |
32 | 31 | ||
diff --git a/etc/disable-exec.inc b/etc/inc/disable-exec.inc index ee3391730..ee3391730 100644 --- a/etc/disable-exec.inc +++ b/etc/inc/disable-exec.inc | |||
diff --git a/etc/disable-interpreters.inc b/etc/inc/disable-interpreters.inc index ae539e1bc..59e9c7de3 100644 --- a/etc/disable-interpreters.inc +++ b/etc/inc/disable-interpreters.inc | |||
@@ -13,8 +13,12 @@ blacklist /usr/lib64/libgjs* | |||
13 | # Lua | 13 | # Lua |
14 | blacklist ${PATH}/lua* | 14 | blacklist ${PATH}/lua* |
15 | blacklist /usr/include/lua* | 15 | blacklist /usr/include/lua* |
16 | blacklist /usr/lib/liblua* | ||
16 | blacklist /usr/lib/lua | 17 | blacklist /usr/lib/lua |
17 | blacklist /usr/share/lua | 18 | blacklist /usr/share/lua* |
19 | |||
20 | # mozjs | ||
21 | blacklist /usr/lib64/libmozjs-* | ||
18 | 22 | ||
19 | # Node.js | 23 | # Node.js |
20 | blacklist ${PATH}/node | 24 | blacklist ${PATH}/node |
diff --git a/etc/disable-passwdmgr.inc b/etc/inc/disable-passwdmgr.inc index 316378cb8..316378cb8 100644 --- a/etc/disable-passwdmgr.inc +++ b/etc/inc/disable-passwdmgr.inc | |||
diff --git a/etc/disable-programs.inc b/etc/inc/disable-programs.inc index db257c1b6..e5dd9cb59 100644 --- a/etc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -8,6 +8,9 @@ blacklist ${HOME}/Monero/wallets | |||
8 | blacklist ${HOME}/Nextcloud/Notes | 8 | blacklist ${HOME}/Nextcloud/Notes |
9 | blacklist ${HOME}/SoftMaker | 9 | blacklist ${HOME}/SoftMaker |
10 | blacklist ${HOME}/Standard Notes Backups | 10 | blacklist ${HOME}/Standard Notes Backups |
11 | blacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
12 | blacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
13 | blacklist ${HOME}/hyperrogue.ini | ||
11 | blacklist ${HOME}/mps | 14 | blacklist ${HOME}/mps |
12 | blacklist ${HOME}/wallet.dat | 15 | blacklist ${HOME}/wallet.dat |
13 | blacklist ${HOME}/.*coin | 16 | blacklist ${HOME}/.*coin |
@@ -51,8 +54,13 @@ blacklist ${HOME}/.bibletime | |||
51 | blacklist ${HOME}/.bitcoin | 54 | blacklist ${HOME}/.bitcoin |
52 | blacklist ${HOME}/.bogofilter | 55 | blacklist ${HOME}/.bogofilter |
53 | blacklist ${HOME}/.bzf | 56 | blacklist ${HOME}/.bzf |
54 | blacklist ${HOME}/.cargo/registry | 57 | blacklist ${HOME}/.cargo/advisory-db |
55 | blacklist ${HOME}/.cargo/config | 58 | blacklist ${HOME}/.cargo/config |
59 | blacklist ${HOME}/.cargo/git | ||
60 | blacklist ${HOME}/.cargo/registry | ||
61 | blacklist ${HOME}/.cargo/.crates.toml | ||
62 | blacklist ${HOME}/.cargo/.crates2.json | ||
63 | blacklist ${HOME}/.cargo/.package-cache | ||
56 | blacklist ${HOME}/.claws-mail | 64 | blacklist ${HOME}/.claws-mail |
57 | blacklist ${HOME}/.cliqz | 65 | blacklist ${HOME}/.cliqz |
58 | blacklist ${HOME}/.clonk | 66 | blacklist ${HOME}/.clonk |
@@ -72,9 +80,15 @@ blacklist ${HOME}/.config/Code - OSS | |||
72 | blacklist ${HOME}/.config/Code Industry | 80 | blacklist ${HOME}/.config/Code Industry |
73 | blacklist ${HOME}/.config/Cryptocat | 81 | blacklist ${HOME}/.config/Cryptocat |
74 | blacklist ${HOME}/.config/Debauchee/Barrier.conf | 82 | blacklist ${HOME}/.config/Debauchee/Barrier.conf |
83 | blacklist ${HOME}/.config/Dharkael | ||
84 | blacklist ${HOME}/.config/Element | ||
85 | blacklist ${HOME}/.config/Element (Riot) | ||
75 | blacklist ${HOME}/.config/Enox | 86 | blacklist ${HOME}/.config/Enox |
87 | blacklist ${HOME}/.config/Ferdi | ||
88 | blacklist ${HOME}/.config/Flavio Tordini | ||
76 | blacklist ${HOME}/.config/Franz | 89 | blacklist ${HOME}/.config/Franz |
77 | blacklist ${HOME}/.config/FreeCAD | 90 | blacklist ${HOME}/.config/FreeCAD |
91 | blacklist ${HOME}/.config/FreeTube | ||
78 | blacklist ${HOME}/.config/Fritzing | 92 | blacklist ${HOME}/.config/Fritzing |
79 | blacklist ${HOME}/.config/GIMP | 93 | blacklist ${HOME}/.config/GIMP |
80 | blacklist ${HOME}/.config/GitHub Desktop | 94 | blacklist ${HOME}/.config/GitHub Desktop |
@@ -84,9 +98,12 @@ blacklist ${HOME}/.config/Google Play Music Desktop Player | |||
84 | blacklist ${HOME}/.config/Gpredict | 98 | blacklist ${HOME}/.config/Gpredict |
85 | blacklist ${HOME}/.config/INRIA | 99 | blacklist ${HOME}/.config/INRIA |
86 | blacklist ${HOME}/.config/InSilmaril | 100 | blacklist ${HOME}/.config/InSilmaril |
101 | blacklist ${HOME}/.config/Jitsi Meet | ||
87 | blacklist ${HOME}/.config/Kid3 | 102 | blacklist ${HOME}/.config/Kid3 |
88 | blacklist ${HOME}/.config/Kingsoft | 103 | blacklist ${HOME}/.config/Kingsoft |
89 | blacklist ${HOME}/.config/Luminance | 104 | blacklist ${HOME}/.config/Luminance |
105 | blacklist ${HOME}/.config/LyX | ||
106 | blacklist ${HOME}/.config/Mattermost | ||
90 | blacklist ${HOME}/.config/Meltytech | 107 | blacklist ${HOME}/.config/Meltytech |
91 | blacklist ${HOME}/.config/Mendeley Ltd. | 108 | blacklist ${HOME}/.config/Mendeley Ltd. |
92 | blacklist ${HOME}/.config/Min | 109 | blacklist ${HOME}/.config/Min |
@@ -97,6 +114,7 @@ blacklist ${HOME}/.config/MuseScore | |||
97 | blacklist ${HOME}/.config/MusicBrainz | 114 | blacklist ${HOME}/.config/MusicBrainz |
98 | blacklist ${HOME}/.config/Nathan Osman | 115 | blacklist ${HOME}/.config/Nathan Osman |
99 | blacklist ${HOME}/.config/Nylas Mail | 116 | blacklist ${HOME}/.config/Nylas Mail |
117 | blacklist ${HOME}/.config/PacmanLogViewer | ||
100 | blacklist ${HOME}/.config/PBE | 118 | blacklist ${HOME}/.config/PBE |
101 | blacklist ${HOME}/.config/Philipp Schmieder | 119 | blacklist ${HOME}/.config/Philipp Schmieder |
102 | blacklist ${HOME}/.config/QGIS | 120 | blacklist ${HOME}/.config/QGIS |
@@ -113,11 +131,16 @@ blacklist ${HOME}/.config/Slack | |||
113 | blacklist ${HOME}/.config/Standard Notes | 131 | blacklist ${HOME}/.config/Standard Notes |
114 | blacklist ${HOME}/.config/SubDownloader | 132 | blacklist ${HOME}/.config/SubDownloader |
115 | blacklist ${HOME}/.config/Thunar | 133 | blacklist ${HOME}/.config/Thunar |
134 | blacklist ${HOME}/.config/Unknown Organization | ||
116 | blacklist ${HOME}/.config/VirtualBox | 135 | blacklist ${HOME}/.config/VirtualBox |
117 | blacklist ${HOME}/.config/Wire | 136 | blacklist ${HOME}/.config/Wire |
118 | blacklist ${HOME}/.config/Zeal | 137 | blacklist ${HOME}/.config/Zeal |
138 | blacklist ${HOME}/.config/ZeGrapher Project | ||
139 | blacklist ${HOME}/.config/abiword | ||
140 | blacklist ${HOME}/.config/agenda | ||
119 | blacklist ${HOME}/.config/akonadi* | 141 | blacklist ${HOME}/.config/akonadi* |
120 | blacklist ${HOME}/.config/akregatorrc | 142 | blacklist ${HOME}/.config/akregatorrc |
143 | blacklist ${HOME}/.config/alacritty | ||
121 | blacklist ${HOME}/.config/ardour4 | 144 | blacklist ${HOME}/.config/ardour4 |
122 | blacklist ${HOME}/.config/ardour5 | 145 | blacklist ${HOME}/.config/ardour5 |
123 | blacklist ${HOME}/.config/aria2 | 146 | blacklist ${HOME}/.config/aria2 |
@@ -129,6 +152,7 @@ blacklist ${HOME}/.config/atril | |||
129 | blacklist ${HOME}/.config/audacious | 152 | blacklist ${HOME}/.config/audacious |
130 | blacklist ${HOME}/.config/autokey | 153 | blacklist ${HOME}/.config/autokey |
131 | blacklist ${HOME}/.config/aweather | 154 | blacklist ${HOME}/.config/aweather |
155 | blacklist ${HOME}/.config/backintime | ||
132 | blacklist ${HOME}/.config/baloofilerc | 156 | blacklist ${HOME}/.config/baloofilerc |
133 | blacklist ${HOME}/.config/baloorc | 157 | blacklist ${HOME}/.config/baloorc |
134 | blacklist ${HOME}/.config/blender | 158 | blacklist ${HOME}/.config/blender |
@@ -142,8 +166,15 @@ blacklist ${HOME}/.config/caja | |||
142 | blacklist ${HOME}/.config/calibre | 166 | blacklist ${HOME}/.config/calibre |
143 | blacklist ${HOME}/.config/cantata | 167 | blacklist ${HOME}/.config/cantata |
144 | blacklist ${HOME}/.config/catfish | 168 | blacklist ${HOME}/.config/catfish |
169 | blacklist ${HOME}/.config/cawbird | ||
145 | blacklist ${HOME}/.config/celluloid | 170 | blacklist ${HOME}/.config/celluloid |
146 | blacklist ${HOME}/.config/cherrytree | 171 | blacklist ${HOME}/.config/cherrytree |
172 | blacklist ${HOME}/.config/chrome-beta-flags.conf | ||
173 | blacklist ${HOME}/.config/chrome-beta-flags.config | ||
174 | blacklist ${HOME}/.config/chrome-flags.conf | ||
175 | blacklist ${HOME}/.config/chrome-flags.config | ||
176 | blacklist ${HOME}/.config/chrome-unstable-flags.conf | ||
177 | blacklist ${HOME}/.config/chrome-unstable-flags.config | ||
147 | blacklist ${HOME}/.config/chromium | 178 | blacklist ${HOME}/.config/chromium |
148 | blacklist ${HOME}/.config/chromium-dev | 179 | blacklist ${HOME}/.config/chromium-dev |
149 | blacklist ${HOME}/.config/chromium-flags.conf | 180 | blacklist ${HOME}/.config/chromium-flags.conf |
@@ -188,13 +219,20 @@ blacklist ${HOME}/.config/geeqie | |||
188 | blacklist ${HOME}/.config/ghb | 219 | blacklist ${HOME}/.config/ghb |
189 | blacklist ${HOME}/.config/ghostwriter | 220 | blacklist ${HOME}/.config/ghostwriter |
190 | blacklist ${HOME}/.config/git | 221 | blacklist ${HOME}/.config/git |
222 | blacklist ${HOME}/.config/git-cola | ||
223 | blacklist ${HOME}/.config/glade.conf | ||
191 | blacklist ${HOME}/.config/globaltime | 224 | blacklist ${HOME}/.config/globaltime |
192 | blacklist ${HOME}/.config/gmpc | 225 | blacklist ${HOME}/.config/gmpc |
193 | blacklist ${HOME}/.config/gnome-builder | 226 | blacklist ${HOME}/.config/gnome-builder |
227 | blacklist ${HOME}/.config/gnome-chess | ||
228 | blacklist ${HOME}/.config/gnome-control-center | ||
229 | blacklist ${HOME}/.config/gnome-initial-setup-done | ||
194 | blacklist ${HOME}/.config/gnome-latex | 230 | blacklist ${HOME}/.config/gnome-latex |
195 | blacklist ${HOME}/.config/gnome-mplayer | 231 | blacklist ${HOME}/.config/gnome-mplayer |
196 | blacklist ${HOME}/.config/gnome-mpv | 232 | blacklist ${HOME}/.config/gnome-mpv |
197 | blacklist ${HOME}/.config/gnome-pie | 233 | blacklist ${HOME}/.config/gnome-pie |
234 | blacklist ${HOME}/.config/gnome-session | ||
235 | blacklist ${HOME}/.config/gnote | ||
198 | blacklist ${HOME}/.config/godot | 236 | blacklist ${HOME}/.config/godot |
199 | blacklist ${HOME}/.config/google-chrome | 237 | blacklist ${HOME}/.config/google-chrome |
200 | blacklist ${HOME}/.config/google-chrome-beta | 238 | blacklist ${HOME}/.config/google-chrome-beta |
@@ -204,6 +242,7 @@ blacklist ${HOME}/.config/gthumb | |||
204 | blacklist ${HOME}/.config/gummi | 242 | blacklist ${HOME}/.config/gummi |
205 | blacklist ${HOME}/.config/gwenviewrc | 243 | blacklist ${HOME}/.config/gwenviewrc |
206 | blacklist ${HOME}/.config/hexchat | 244 | blacklist ${HOME}/.config/hexchat |
245 | blacklist ${HOME}/.config/homebank | ||
207 | blacklist ${HOME}/.config/i2p | 246 | blacklist ${HOME}/.config/i2p |
208 | blacklist ${HOME}/.config/inkscape | 247 | blacklist ${HOME}/.config/inkscape |
209 | blacklist ${HOME}/.config/inox | 248 | blacklist ${HOME}/.config/inox |
@@ -228,8 +267,10 @@ blacklist ${HOME}/.config/klavaro | |||
228 | blacklist ${HOME}/.config/klipperrc | 267 | blacklist ${HOME}/.config/klipperrc |
229 | blacklist ${HOME}/.config/kmail2rc | 268 | blacklist ${HOME}/.config/kmail2rc |
230 | blacklist ${HOME}/.config/kmailsearchindexingrc | 269 | blacklist ${HOME}/.config/kmailsearchindexingrc |
270 | blacklist ${HOME}/.config/kmplayerrc | ||
231 | blacklist ${HOME}/.config/knotesrc | 271 | blacklist ${HOME}/.config/knotesrc |
232 | blacklist ${HOME}/.config/konversationrc | 272 | blacklist ${HOME}/.config/konversationrc |
273 | blacklist ${HOME}/.config/konversation.notifyrc | ||
233 | blacklist ${HOME}/.config/kritarc | 274 | blacklist ${HOME}/.config/kritarc |
234 | blacklist ${HOME}/.config/ktorrentrc | 275 | blacklist ${HOME}/.config/ktorrentrc |
235 | blacklist ${HOME}/.config/ktouch2rc | 276 | blacklist ${HOME}/.config/ktouch2rc |
@@ -246,6 +287,7 @@ blacklist ${HOME}/.config/mate/eom | |||
246 | blacklist ${HOME}/.config/mate/mate-dictionary | 287 | blacklist ${HOME}/.config/mate/mate-dictionary |
247 | blacklist ${HOME}/.config/meld | 288 | blacklist ${HOME}/.config/meld |
248 | blacklist ${HOME}/.config/meteo-qt | 289 | blacklist ${HOME}/.config/meteo-qt |
290 | blacklist ${HOME}/.config/menulibre.cfg | ||
249 | blacklist ${HOME}/.config/mfusion | 291 | blacklist ${HOME}/.config/mfusion |
250 | blacklist ${HOME}/.config/Microsoft | 292 | blacklist ${HOME}/.config/Microsoft |
251 | blacklist ${HOME}/.config/midori | 293 | blacklist ${HOME}/.config/midori |
@@ -255,15 +297,18 @@ blacklist ${HOME}/.config/mpd | |||
255 | blacklist ${HOME}/.config/mps-youtube | 297 | blacklist ${HOME}/.config/mps-youtube |
256 | blacklist ${HOME}/.config/mpv | 298 | blacklist ${HOME}/.config/mpv |
257 | blacklist ${HOME}/.config/mupen64plus | 299 | blacklist ${HOME}/.config/mupen64plus |
300 | blacklist ${HOME}/.config/mutter | ||
258 | blacklist ${HOME}/.config/mypaint | 301 | blacklist ${HOME}/.config/mypaint |
259 | blacklist ${HOME}/.config/nano | 302 | blacklist ${HOME}/.config/nano |
260 | blacklist ${HOME}/.config/nautilus | 303 | blacklist ${HOME}/.config/nautilus |
261 | blacklist ${HOME}/.config/nemo | 304 | blacklist ${HOME}/.config/nemo |
262 | blacklist ${HOME}/.config/netsurf | 305 | blacklist ${HOME}/.config/netsurf |
263 | blacklist ${HOME}/.config/newsbeuter | 306 | blacklist ${HOME}/.config/newsbeuter |
307 | blacklist ${HOME}/.config/newsflash | ||
264 | blacklist ${HOME}/.config/nheko | 308 | blacklist ${HOME}/.config/nheko |
265 | blacklist ${HOME}/.config/NitroShare | 309 | blacklist ${HOME}/.config/NitroShare |
266 | blacklist ${HOME}/.config/nomacs | 310 | blacklist ${HOME}/.config/nomacs |
311 | blacklist ${HOME}/.config/nuclear | ||
267 | blacklist ${HOME}/.config/obs-studio | 312 | blacklist ${HOME}/.config/obs-studio |
268 | blacklist ${HOME}/.config/okularpartrc | 313 | blacklist ${HOME}/.config/okularpartrc |
269 | blacklist ${HOME}/.config/okularrc | 314 | blacklist ${HOME}/.config/okularrc |
@@ -274,6 +319,7 @@ blacklist ${HOME}/.config/opera-beta | |||
274 | blacklist ${HOME}/.config/orage | 319 | blacklist ${HOME}/.config/orage |
275 | blacklist ${HOME}/.config/org.gabmus.gfeeds.json | 320 | blacklist ${HOME}/.config/org.gabmus.gfeeds.json |
276 | blacklist ${HOME}/.config/org.kde.gwenviewrc | 321 | blacklist ${HOME}/.config/org.kde.gwenviewrc |
322 | blacklist ${HOME}/.config/otter | ||
277 | blacklist ${HOME}/.config/pavucontrol-qt | 323 | blacklist ${HOME}/.config/pavucontrol-qt |
278 | blacklist ${HOME}/.config/pavucontrol.ini | 324 | blacklist ${HOME}/.config/pavucontrol.ini |
279 | blacklist ${HOME}/.config/pcmanfm | 325 | blacklist ${HOME}/.config/pcmanfm |
@@ -305,13 +351,16 @@ blacklist ${HOME}/.config/slimjet | |||
305 | blacklist ${HOME}/.config/smplayer | 351 | blacklist ${HOME}/.config/smplayer |
306 | blacklist ${HOME}/.config/smtube | 352 | blacklist ${HOME}/.config/smtube |
307 | blacklist ${HOME}/.config/snox | 353 | blacklist ${HOME}/.config/snox |
354 | blacklist ${HOME}/.config/sound-juicer | ||
308 | blacklist ${HOME}/.config/specialmailcollectionsrc | 355 | blacklist ${HOME}/.config/specialmailcollectionsrc |
309 | blacklist ${HOME}/.config/spotify | 356 | blacklist ${HOME}/.config/spotify |
310 | blacklist ${HOME}/.config/sqlitebrowser | 357 | blacklist ${HOME}/.config/sqlitebrowser |
311 | blacklist ${HOME}/.config/stellarium | 358 | blacklist ${HOME}/.config/stellarium |
359 | blacklist ${HOME}/.config/strawberry | ||
312 | blacklist ${HOME}/.config/supertuxkart | 360 | blacklist ${HOME}/.config/supertuxkart |
313 | blacklist ${HOME}/.config/synfig | 361 | blacklist ${HOME}/.config/synfig |
314 | blacklist ${HOME}/.config/teams | 362 | blacklist ${HOME}/.config/teams |
363 | blacklist ${HOME}/.config/teams-for-linux | ||
315 | blacklist ${HOME}/.config/telepathy-account-widgets | 364 | blacklist ${HOME}/.config/telepathy-account-widgets |
316 | blacklist ${HOME}/.config/torbrowser | 365 | blacklist ${HOME}/.config/torbrowser |
317 | blacklist ${HOME}/.config/totem | 366 | blacklist ${HOME}/.config/totem |
@@ -327,6 +376,7 @@ blacklist ${HOME}/.config/vivaldi | |||
327 | blacklist ${HOME}/.config/vivaldi-snapshot | 376 | blacklist ${HOME}/.config/vivaldi-snapshot |
328 | blacklist ${HOME}/.config/vlc | 377 | blacklist ${HOME}/.config/vlc |
329 | blacklist ${HOME}/.config/wesnoth | 378 | blacklist ${HOME}/.config/wesnoth |
379 | blacklist ${HOME}/.config/wormux | ||
330 | blacklist ${HOME}/.config/Whalebird | 380 | blacklist ${HOME}/.config/Whalebird |
331 | blacklist ${HOME}/.config/wireshark | 381 | blacklist ${HOME}/.config/wireshark |
332 | blacklist ${HOME}/.config/xchat | 382 | blacklist ${HOME}/.config/xchat |
@@ -346,11 +396,13 @@ blacklist ${HOME}/.config/yandex-browser | |||
346 | blacklist ${HOME}/.config/yandex-browser-beta | 396 | blacklist ${HOME}/.config/yandex-browser-beta |
347 | blacklist ${HOME}/.config/yelp | 397 | blacklist ${HOME}/.config/yelp |
348 | blacklist ${HOME}/.config/youtube-dl | 398 | blacklist ${HOME}/.config/youtube-dl |
399 | blacklist ${HOME}/.config/youtube-viewer | ||
349 | blacklist ${HOME}/.config/zathura | 400 | blacklist ${HOME}/.config/zathura |
350 | blacklist ${HOME}/.config/zoomus.conf | 401 | blacklist ${HOME}/.config/zoomus.conf |
351 | blacklist ${HOME}/.config/Zulip | 402 | blacklist ${HOME}/.config/Zulip |
352 | blacklist ${HOME}/.conkeror.mozdev.org | 403 | blacklist ${HOME}/.conkeror.mozdev.org |
353 | blacklist ${HOME}/.crawl | 404 | blacklist ${HOME}/.crawl |
405 | blacklist ${HOME}/.cups | ||
354 | blacklist ${HOME}/.curlrc | 406 | blacklist ${HOME}/.curlrc |
355 | blacklist ${HOME}/.dashcore | 407 | blacklist ${HOME}/.dashcore |
356 | blacklist ${HOME}/.devilspie | 408 | blacklist ${HOME}/.devilspie |
@@ -375,6 +427,7 @@ blacklist ${HOME}/.fossamail | |||
375 | blacklist ${HOME}/.freeciv | 427 | blacklist ${HOME}/.freeciv |
376 | blacklist ${HOME}/.freecol | 428 | blacklist ${HOME}/.freecol |
377 | blacklist ${HOME}/.freemind | 429 | blacklist ${HOME}/.freemind |
430 | blacklist ${HOME}/.frogatto | ||
378 | blacklist ${HOME}/.frozen-bubble | 431 | blacklist ${HOME}/.frozen-bubble |
379 | blacklist ${HOME}/.gimp* | 432 | blacklist ${HOME}/.gimp* |
380 | blacklist ${HOME}/.gist | 433 | blacklist ${HOME}/.gist |
@@ -388,6 +441,7 @@ blacklist ${HOME}/.gradle | |||
388 | blacklist ${HOME}/.gramps | 441 | blacklist ${HOME}/.gramps |
389 | blacklist ${HOME}/.guayadeque | 442 | blacklist ${HOME}/.guayadeque |
390 | blacklist ${HOME}/.hashcat | 443 | blacklist ${HOME}/.hashcat |
444 | blacklist ${HOME}/.hex-a-hop | ||
391 | blacklist ${HOME}/.hedgewars | 445 | blacklist ${HOME}/.hedgewars |
392 | blacklist ${HOME}/.hugin | 446 | blacklist ${HOME}/.hugin |
393 | blacklist ${HOME}/.i2p | 447 | blacklist ${HOME}/.i2p |
@@ -401,6 +455,7 @@ blacklist ${HOME}/.jak | |||
401 | blacklist ${HOME}/.java | 455 | blacklist ${HOME}/.java |
402 | blacklist ${HOME}/.jd | 456 | blacklist ${HOME}/.jd |
403 | blacklist ${HOME}/.jitsi | 457 | blacklist ${HOME}/.jitsi |
458 | blacklist ${HOME}/.jumpnbump | ||
404 | blacklist ${HOME}/.kde/share/apps/digikam | 459 | blacklist ${HOME}/.kde/share/apps/digikam |
405 | blacklist ${HOME}/.kde/share/apps/gwenview | 460 | blacklist ${HOME}/.kde/share/apps/gwenview |
406 | blacklist ${HOME}/.kde/share/apps/kaffeine | 461 | blacklist ${HOME}/.kde/share/apps/kaffeine |
@@ -424,6 +479,7 @@ blacklist ${HOME}/.kde/share/config/kfindrc | |||
424 | blacklist ${HOME}/.kde/share/config/kgetrc | 479 | blacklist ${HOME}/.kde/share/config/kgetrc |
425 | blacklist ${HOME}/.kde/share/config/khtmlrc | 480 | blacklist ${HOME}/.kde/share/config/khtmlrc |
426 | blacklist ${HOME}/.kde/share/config/klipperrc | 481 | blacklist ${HOME}/.kde/share/config/klipperrc |
482 | blacklist ${HOME}/.kde/share/config/kmplayerrc | ||
427 | blacklist ${HOME}/.kde/share/config/konq_history | 483 | blacklist ${HOME}/.kde/share/config/konq_history |
428 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc | 484 | blacklist ${HOME}/.kde/share/config/konqsidebartngrc |
429 | blacklist ${HOME}/.kde/share/config/konquerorrc | 485 | blacklist ${HOME}/.kde/share/config/konquerorrc |
@@ -479,6 +535,7 @@ blacklist ${HOME}/.local/share/3909/PapersPlease | |||
479 | blacklist ${HOME}/.local/share/Anki2 | 535 | blacklist ${HOME}/.local/share/Anki2 |
480 | blacklist ${HOME}/.local/share/Empathy | 536 | blacklist ${HOME}/.local/share/Empathy |
481 | blacklist ${HOME}/.local/share/Enpass | 537 | blacklist ${HOME}/.local/share/Enpass |
538 | blacklist ${HOME}/.local/share/Flavio Tordini | ||
482 | blacklist ${HOME}/.local/share/JetBrains | 539 | blacklist ${HOME}/.local/share/JetBrains |
483 | blacklist ${HOME}/.local/share/Kingsoft | 540 | blacklist ${HOME}/.local/share/Kingsoft |
484 | blacklist ${HOME}/.local/share/Mendeley Ltd. | 541 | blacklist ${HOME}/.local/share/Mendeley Ltd. |
@@ -488,6 +545,7 @@ blacklist ${HOME}/.local/share/QGIS | |||
488 | blacklist ${HOME}/.local/share/QMediathekView | 545 | blacklist ${HOME}/.local/share/QMediathekView |
489 | blacklist ${HOME}/.local/share/QuiteRss | 546 | blacklist ${HOME}/.local/share/QuiteRss |
490 | blacklist ${HOME}/.local/share/Ricochet | 547 | blacklist ${HOME}/.local/share/Ricochet |
548 | blacklist ${HOME}/.local/share/Shortwave | ||
491 | blacklist ${HOME}/.local/share/Steam | 549 | blacklist ${HOME}/.local/share/Steam |
492 | blacklist ${HOME}/.local/share/SuperHexagon | 550 | blacklist ${HOME}/.local/share/SuperHexagon |
493 | blacklist ${HOME}/.local/share/TelegramDesktop | 551 | blacklist ${HOME}/.local/share/TelegramDesktop |
@@ -496,12 +554,15 @@ blacklist ${HOME}/.local/share/TpLogger | |||
496 | blacklist ${HOME}/.local/share/Zeal | 554 | blacklist ${HOME}/.local/share/Zeal |
497 | blacklist ${HOME}/.local/share/akonadi* | 555 | blacklist ${HOME}/.local/share/akonadi* |
498 | blacklist ${HOME}/.local/share/akregator | 556 | blacklist ${HOME}/.local/share/akregator |
557 | blacklist ${HOME}/.local/share/agenda | ||
499 | blacklist ${HOME}/.local/share/apps/korganizer | 558 | blacklist ${HOME}/.local/share/apps/korganizer |
500 | blacklist ${HOME}/.local/share/aspyr-media | 559 | blacklist ${HOME}/.local/share/aspyr-media |
501 | blacklist ${HOME}/.local/share/autokey | 560 | blacklist ${HOME}/.local/share/autokey |
561 | blacklist ${HOME}/.local/share/backintime | ||
502 | blacklist ${HOME}/.local/share/baloo | 562 | blacklist ${HOME}/.local/share/baloo |
503 | blacklist ${HOME}/.local/share/barrier | 563 | blacklist ${HOME}/.local/share/barrier |
504 | blacklist ${HOME}/.local/share/bibletime | 564 | blacklist ${HOME}/.local/share/bibletime |
565 | blacklist ${HOME}/.local/share/bijiben | ||
505 | blacklist ${HOME}/.local/share/caja-python | 566 | blacklist ${HOME}/.local/share/caja-python |
506 | blacklist ${HOME}/.local/share/cantata | 567 | blacklist ${HOME}/.local/share/cantata |
507 | blacklist ${HOME}/.local/share/cdprojektred | 568 | blacklist ${HOME}/.local/share/cdprojektred |
@@ -519,8 +580,10 @@ blacklist ${HOME}/.local/share/dolphin | |||
519 | blacklist ${HOME}/.local/share/emailidentities | 580 | blacklist ${HOME}/.local/share/emailidentities |
520 | blacklist ${HOME}/.local/share/epiphany | 581 | blacklist ${HOME}/.local/share/epiphany |
521 | blacklist ${HOME}/.local/share/evolution | 582 | blacklist ${HOME}/.local/share/evolution |
583 | blacklist ${HOME}/.local/share/FasterThanLight | ||
522 | blacklist ${HOME}/.local/share/feedreader | 584 | blacklist ${HOME}/.local/share/feedreader |
523 | blacklist ${HOME}/.local/share/feral-interactive | 585 | blacklist ${HOME}/.local/share/feral-interactive |
586 | blacklist ${HOME}/.local/share/five-or-more | ||
524 | blacklist ${HOME}/.local/share/freecol | 587 | blacklist ${HOME}/.local/share/freecol |
525 | blacklist ${HOME}/.local/share/gajim | 588 | blacklist ${HOME}/.local/share/gajim |
526 | blacklist ${HOME}/.local/share/geary | 589 | blacklist ${HOME}/.local/share/geary |
@@ -528,18 +591,26 @@ blacklist ${HOME}/.local/share/geeqie | |||
528 | blacklist ${HOME}/.local/share/ghostwriter | 591 | blacklist ${HOME}/.local/share/ghostwriter |
529 | blacklist ${HOME}/.local/share/gitg | 592 | blacklist ${HOME}/.local/share/gitg |
530 | blacklist ${HOME}/.local/share/gnome-2048 | 593 | blacklist ${HOME}/.local/share/gnome-2048 |
531 | blacklist ${HOME}/.local/share/gnome-chess | 594 | blacklist ${HOME}/.local/share/gnome-boxes |
532 | blacklist ${HOME}/.local/share/gnome-builder | 595 | blacklist ${HOME}/.local/share/gnome-builder |
596 | blacklist ${HOME}/.local/share/gnome-chess | ||
597 | blacklist ${HOME}/.local/share/gnome-klotski | ||
533 | blacklist ${HOME}/.local/share/gnome-latex | 598 | blacklist ${HOME}/.local/share/gnome-latex |
599 | blacklist ${HOME}/.local/share/gnome-mines | ||
534 | blacklist ${HOME}/.local/share/gnome-music | 600 | blacklist ${HOME}/.local/share/gnome-music |
601 | blacklist ${HOME}/.local/share/gnome-nibbles | ||
535 | blacklist ${HOME}/.local/share/gnome-photos | 602 | blacklist ${HOME}/.local/share/gnome-photos |
603 | blacklist ${HOME}/.local/share/gnome-pomodoro | ||
536 | blacklist ${HOME}/.local/share/gnome-recipes | 604 | blacklist ${HOME}/.local/share/gnome-recipes |
537 | blacklist ${HOME}/.local/share/gnome-ring | 605 | blacklist ${HOME}/.local/share/gnome-ring |
606 | blacklist ${HOME}/.local/share/gnome-sudoku | ||
538 | blacklist ${HOME}/.local/share/gnome-twitch | 607 | blacklist ${HOME}/.local/share/gnome-twitch |
608 | blacklist ${HOME}/.local/share/gnote | ||
539 | blacklist ${HOME}/.local/share/godot | 609 | blacklist ${HOME}/.local/share/godot |
540 | blacklist ${HOME}/.local/share/gradio | 610 | blacklist ${HOME}/.local/share/gradio |
541 | blacklist ${HOME}/.local/share/gwenview | 611 | blacklist ${HOME}/.local/share/gwenview |
542 | blacklist ${HOME}/.local/share/i2p | 612 | blacklist ${HOME}/.local/share/i2p |
613 | blacklist ${HOME}/.local/share/IntoTheBreach | ||
543 | blacklist ${HOME}/.local/share/kaffeine | 614 | blacklist ${HOME}/.local/share/kaffeine |
544 | blacklist ${HOME}/.local/share/kalgebra | 615 | blacklist ${HOME}/.local/share/kalgebra |
545 | blacklist ${HOME}/.local/share/kate | 616 | blacklist ${HOME}/.local/share/kate |
@@ -549,15 +620,18 @@ blacklist ${HOME}/.local/share/kiwix | |||
549 | blacklist ${HOME}/.local/share/kiwix-desktop | 620 | blacklist ${HOME}/.local/share/kiwix-desktop |
550 | blacklist ${HOME}/.local/share/klavaro | 621 | blacklist ${HOME}/.local/share/klavaro |
551 | blacklist ${HOME}/.local/share/kmail2 | 622 | blacklist ${HOME}/.local/share/kmail2 |
623 | blacklist ${HOME}/.local/share/kmplayer | ||
552 | blacklist ${HOME}/.local/share/knotes | 624 | blacklist ${HOME}/.local/share/knotes |
553 | blacklist ${HOME}/.local/share/krita | 625 | blacklist ${HOME}/.local/share/krita |
554 | blacklist ${HOME}/.local/share/ktorrent | 626 | blacklist ${HOME}/.local/share/ktorrent |
555 | blacklist ${HOME}/.local/share/ktorrentrc | 627 | blacklist ${HOME}/.local/share/ktorrentrc |
556 | blacklist ${HOME}/.local/share/ktouch | 628 | blacklist ${HOME}/.local/share/ktouch |
557 | blacklist ${HOME}/.local/share/kwrite | 629 | blacklist ${HOME}/.local/share/kwrite |
630 | blacklist ${HOME}/.local/share/kxmlgui5/* | ||
558 | blacklist ${HOME}/.local/share/liferea | 631 | blacklist ${HOME}/.local/share/liferea |
559 | blacklist ${HOME}/.local/share/local-mail | 632 | blacklist ${HOME}/.local/share/local-mail |
560 | blacklist ${HOME}/.local/share/lollypop | 633 | blacklist ${HOME}/.local/share/lollypop |
634 | blacklist ${HOME}/.local/share/love | ||
561 | blacklist ${HOME}/.local/share/lugaru | 635 | blacklist ${HOME}/.local/share/lugaru |
562 | blacklist ${HOME}/.local/share/mana | 636 | blacklist ${HOME}/.local/share/mana |
563 | blacklist ${HOME}/.local/share/maps-places.json | 637 | blacklist ${HOME}/.local/share/maps-places.json |
@@ -571,6 +645,7 @@ blacklist ${HOME}/.local/share/nautilus | |||
571 | blacklist ${HOME}/.local/share/nautilus-python | 645 | blacklist ${HOME}/.local/share/nautilus-python |
572 | blacklist ${HOME}/.local/share/nemo | 646 | blacklist ${HOME}/.local/share/nemo |
573 | blacklist ${HOME}/.local/share/nemo-python | 647 | blacklist ${HOME}/.local/share/nemo-python |
648 | blacklist ${HOME}/.local/share/news-flash | ||
574 | blacklist ${HOME}/.local/share/nomacs | 649 | blacklist ${HOME}/.local/share/nomacs |
575 | blacklist ${HOME}/.local/share/notes | 650 | blacklist ${HOME}/.local/share/notes |
576 | blacklist ${HOME}/.local/share/ocenaudio | 651 | blacklist ${HOME}/.local/share/ocenaudio |
@@ -578,10 +653,12 @@ blacklist ${HOME}/.local/share/okular | |||
578 | blacklist ${HOME}/.local/share/onlyoffice | 653 | blacklist ${HOME}/.local/share/onlyoffice |
579 | blacklist ${HOME}/.local/share/orage | 654 | blacklist ${HOME}/.local/share/orage |
580 | blacklist ${HOME}/.local/share/org.kde.gwenview | 655 | blacklist ${HOME}/.local/share/org.kde.gwenview |
656 | blacklist ${HOME}/.local/share/Paradox Interactive | ||
581 | blacklist ${HOME}/.local/share/pix | 657 | blacklist ${HOME}/.local/share/pix |
582 | blacklist ${HOME}/.local/share/plasma_notes | 658 | blacklist ${HOME}/.local/share/plasma_notes |
583 | blacklist ${HOME}/.local/share/profanity | 659 | blacklist ${HOME}/.local/share/profanity |
584 | blacklist ${HOME}/.local/share/psi+ | 660 | blacklist ${HOME}/.local/share/psi+ |
661 | blacklist ${HOME}/.local/share/quadrapassel | ||
585 | blacklist ${HOME}/.local/share/qpdfview | 662 | blacklist ${HOME}/.local/share/qpdfview |
586 | blacklist ${HOME}/.local/share/qutebrowser | 663 | blacklist ${HOME}/.local/share/qutebrowser |
587 | blacklist ${HOME}/.local/share/remmina | 664 | blacklist ${HOME}/.local/share/remmina |
@@ -591,8 +668,10 @@ blacklist ${HOME}/.local/share/scribus | |||
591 | blacklist ${HOME}/.local/share/signal-cli | 668 | blacklist ${HOME}/.local/share/signal-cli |
592 | blacklist ${HOME}/.local/share/spotify | 669 | blacklist ${HOME}/.local/share/spotify |
593 | blacklist ${HOME}/.local/share/steam | 670 | blacklist ${HOME}/.local/share/steam |
671 | blacklist ${HOME}/.local/share/strawberry | ||
594 | blacklist ${HOME}/.local/share/supertux2 | 672 | blacklist ${HOME}/.local/share/supertux2 |
595 | blacklist ${HOME}/.local/share/supertuxkart | 673 | blacklist ${HOME}/.local/share/supertuxkart |
674 | blacklist ${HOME}/.local/share/swell-foop | ||
596 | blacklist ${HOME}/.local/share/telepathy | 675 | blacklist ${HOME}/.local/share/telepathy |
597 | blacklist ${HOME}/.local/share/terasology | 676 | blacklist ${HOME}/.local/share/terasology |
598 | blacklist ${HOME}/.local/share/torbrowser | 677 | blacklist ${HOME}/.local/share/torbrowser |
@@ -603,16 +682,23 @@ blacklist ${HOME}/.local/share/vpltd | |||
603 | blacklist ${HOME}/.local/share/vulkan | 682 | blacklist ${HOME}/.local/share/vulkan |
604 | blacklist ${HOME}/.local/share/warsow-2.1 | 683 | blacklist ${HOME}/.local/share/warsow-2.1 |
605 | blacklist ${HOME}/.local/share/wesnoth | 684 | blacklist ${HOME}/.local/share/wesnoth |
685 | blacklist ${HOME}/.local/share/wormux | ||
606 | blacklist ${HOME}/.local/share/xplayer | 686 | blacklist ${HOME}/.local/share/xplayer |
607 | blacklist ${HOME}/.local/share/xreader | 687 | blacklist ${HOME}/.local/share/xreader |
608 | blacklist ${HOME}/.local/share/zathura | 688 | blacklist ${HOME}/.local/share/zathura |
609 | blacklist ${HOME}/.lv2 | 689 | blacklist ${HOME}/.lv2 |
690 | blacklist ${HOME}/.lyx | ||
691 | blacklist ${HOME}/.magicor | ||
610 | blacklist ${HOME}/.masterpdfeditor | 692 | blacklist ${HOME}/.masterpdfeditor |
693 | blacklist ${HOME}/.mbwarband | ||
611 | blacklist ${HOME}/.mcabber | 694 | blacklist ${HOME}/.mcabber |
612 | blacklist ${HOME}/.mcabberrc | 695 | blacklist ${HOME}/.mcabberrc |
613 | blacklist ${HOME}/.mediathek3 | 696 | blacklist ${HOME}/.mediathek3 |
614 | blacklist ${HOME}/.megaglest | 697 | blacklist ${HOME}/.megaglest |
698 | blacklist ${HOME}/.minecraft | ||
615 | blacklist ${HOME}/.minetest | 699 | blacklist ${HOME}/.minetest |
700 | blacklist ${HOME}/.mirrormagic | ||
701 | blacklist ${HOME}/.moc | ||
616 | blacklist ${HOME}/.moonchild productions/basilisk | 702 | blacklist ${HOME}/.moonchild productions/basilisk |
617 | blacklist ${HOME}/.moonchild productions/pale moon | 703 | blacklist ${HOME}/.moonchild productions/pale moon |
618 | blacklist ${HOME}/.mozilla | 704 | blacklist ${HOME}/.mozilla |
@@ -627,6 +713,7 @@ blacklist ${HOME}/.netactview | |||
627 | blacklist ${HOME}/.neverball | 713 | blacklist ${HOME}/.neverball |
628 | blacklist ${HOME}/.newsbeuter | 714 | blacklist ${HOME}/.newsbeuter |
629 | blacklist ${HOME}/.newsboat | 715 | blacklist ${HOME}/.newsboat |
716 | blacklist ${HOME}/.nicotine | ||
630 | blacklist ${HOME}/.nv | 717 | blacklist ${HOME}/.nv |
631 | blacklist ${HOME}/.nylas-mail | 718 | blacklist ${HOME}/.nylas-mail |
632 | blacklist ${HOME}/.openarena | 719 | blacklist ${HOME}/.openarena |
@@ -638,9 +725,13 @@ blacklist ${HOME}/.openttd | |||
638 | blacklist ${HOME}/.opera | 725 | blacklist ${HOME}/.opera |
639 | blacklist ${HOME}/.opera-beta | 726 | blacklist ${HOME}/.opera-beta |
640 | blacklist ${HOME}/.ostrichriders | 727 | blacklist ${HOME}/.ostrichriders |
728 | blacklist ${HOME}/.paradoxinteractive | ||
729 | blacklist ${HOME}/.parallelrealities/blobwars | ||
730 | blacklist ${HOME}/.penguin-command | ||
641 | blacklist ${HOME}/.pingus | 731 | blacklist ${HOME}/.pingus |
642 | blacklist ${HOME}/.pioneer | 732 | blacklist ${HOME}/.pioneer |
643 | blacklist ${HOME}/.purple | 733 | blacklist ${HOME}/.purple |
734 | blacklist ${HOME}/.pylint.d | ||
644 | blacklist ${HOME}/.qemu-launcher | 735 | blacklist ${HOME}/.qemu-launcher |
645 | blacklist ${HOME}/.qgis2 | 736 | blacklist ${HOME}/.qgis2 |
646 | blacklist ${HOME}/.qmmp | 737 | blacklist ${HOME}/.qmmp |
@@ -650,6 +741,7 @@ blacklist ${HOME}/.remmina | |||
650 | blacklist ${HOME}/.repo_.gitconfig.json | 741 | blacklist ${HOME}/.repo_.gitconfig.json |
651 | blacklist ${HOME}/.repoconfig | 742 | blacklist ${HOME}/.repoconfig |
652 | blacklist ${HOME}/.retroshare | 743 | blacklist ${HOME}/.retroshare |
744 | blacklist ${HOME}/.ripperXrc | ||
653 | blacklist ${HOME}/.scorched3d | 745 | blacklist ${HOME}/.scorched3d |
654 | blacklist ${HOME}/.scribus | 746 | blacklist ${HOME}/.scribus |
655 | blacklist ${HOME}/.scribusrc | 747 | blacklist ${HOME}/.scribusrc |
@@ -662,13 +754,14 @@ blacklist ${HOME}/.steampid | |||
662 | blacklist ${HOME}/.stellarium | 754 | blacklist ${HOME}/.stellarium |
663 | blacklist ${HOME}/.subversion | 755 | blacklist ${HOME}/.subversion |
664 | blacklist ${HOME}/.surf | 756 | blacklist ${HOME}/.surf |
757 | blacklist ${HOME}/.swb.ini | ||
665 | blacklist ${HOME}/.sword | 758 | blacklist ${HOME}/.sword |
666 | blacklist ${HOME}/.sylpheed-2.0 | 759 | blacklist ${HOME}/.sylpheed-2.0 |
667 | blacklist ${HOME}/.synfig | 760 | blacklist ${HOME}/.synfig |
668 | blacklist ${HOME}/.config/teams-for-linux | ||
669 | blacklist ${HOME}/.tb | 761 | blacklist ${HOME}/.tb |
670 | blacklist ${HOME}/.tconn | 762 | blacklist ${HOME}/.tconn |
671 | blacklist ${HOME}/.teeworlds | 763 | blacklist ${HOME}/.teeworlds |
764 | blacklist ${HOME}/.texlive2018 | ||
672 | blacklist ${HOME}/.thunderbird | 765 | blacklist ${HOME}/.thunderbird |
673 | blacklist ${HOME}/.tilp | 766 | blacklist ${HOME}/.tilp |
674 | blacklist ${HOME}/.tooling | 767 | blacklist ${HOME}/.tooling |
@@ -683,6 +776,7 @@ blacklist ${HOME}/.viking | |||
683 | blacklist ${HOME}/.viking-maps | 776 | blacklist ${HOME}/.viking-maps |
684 | blacklist ${HOME}/.vim | 777 | blacklist ${HOME}/.vim |
685 | blacklist ${HOME}/.vimrc | 778 | blacklist ${HOME}/.vimrc |
779 | blacklist ${HOME}/.vmware | ||
686 | blacklist ${HOME}/.vscode | 780 | blacklist ${HOME}/.vscode |
687 | blacklist ${HOME}/.vscode-oss | 781 | blacklist ${HOME}/.vscode-oss |
688 | blacklist ${HOME}/.vst | 782 | blacklist ${HOME}/.vst |
@@ -697,6 +791,8 @@ blacklist ${HOME}/.widelands | |||
697 | blacklist ${HOME}/.wine | 791 | blacklist ${HOME}/.wine |
698 | blacklist ${HOME}/.wine64 | 792 | blacklist ${HOME}/.wine64 |
699 | blacklist ${HOME}/.wireshark | 793 | blacklist ${HOME}/.wireshark |
794 | blacklist ${HOME}/.wordwarvi | ||
795 | blacklist ${HOME}/.wormux | ||
700 | blacklist ${HOME}/.xiphos | 796 | blacklist ${HOME}/.xiphos |
701 | blacklist ${HOME}/.xmind | 797 | blacklist ${HOME}/.xmind |
702 | blacklist ${HOME}/.xmms | 798 | blacklist ${HOME}/.xmms |
@@ -721,12 +817,18 @@ blacklist ${HOME}/.cache/BraveSoftware | |||
721 | blacklist ${HOME}/.cache/Clementine | 817 | blacklist ${HOME}/.cache/Clementine |
722 | blacklist ${HOME}/.cache/Enox | 818 | blacklist ${HOME}/.cache/Enox |
723 | blacklist ${HOME}/.cache/Enpass | 819 | blacklist ${HOME}/.cache/Enpass |
820 | blacklist ${HOME}/.cache/Ferdi | ||
821 | blacklist ${HOME}/.cache/Flavio Tordini | ||
724 | blacklist ${HOME}/.cache/Franz | 822 | blacklist ${HOME}/.cache/Franz |
725 | blacklist ${HOME}/.cache/INRIA | 823 | blacklist ${HOME}/.cache/INRIA |
726 | blacklist ${HOME}/.cache/MusicBrainz | 824 | blacklist ${HOME}/.cache/MusicBrainz |
825 | blacklist ${HOME}/.cache/NewsFlashGTK | ||
826 | blacklist ${HOME}/.cache/Otter | ||
727 | blacklist ${HOME}/.cache/QuiteRss | 827 | blacklist ${HOME}/.cache/QuiteRss |
828 | blacklist ${HOME}/.cache/Shortwave | ||
728 | blacklist ${HOME}/.cache/Tox | 829 | blacklist ${HOME}/.cache/Tox |
729 | blacklist ${HOME}/.cache/Zeal | 830 | blacklist ${HOME}/.cache/Zeal |
831 | blacklist ${HOME}/.cache/agenda | ||
730 | blacklist ${HOME}/.cache/akonadi* | 832 | blacklist ${HOME}/.cache/akonadi* |
731 | blacklist ${HOME}/.cache/atril | 833 | blacklist ${HOME}/.cache/atril |
732 | blacklist ${HOME}/.cache/attic | 834 | blacklist ${HOME}/.cache/attic |
@@ -741,6 +843,7 @@ blacklist ${HOME}/.cache/chromium-dev | |||
741 | blacklist ${HOME}/.cache/cliqz | 843 | blacklist ${HOME}/.cache/cliqz |
742 | blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate | 844 | blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate |
743 | blacklist ${HOME}/.cache/darktable | 845 | blacklist ${HOME}/.cache/darktable |
846 | blacklist ${HOME}/.cache/deja-dup | ||
744 | blacklist ${HOME}/.cache/discover | 847 | blacklist ${HOME}/.cache/discover |
745 | blacklist ${HOME}/.cache/dnox | 848 | blacklist ${HOME}/.cache/dnox |
746 | blacklist ${HOME}/.cache/dolphin | 849 | blacklist ${HOME}/.cache/dolphin |
@@ -757,8 +860,12 @@ blacklist ${HOME}/.cache/gegl-0.4 | |||
757 | blacklist ${HOME}/.cache/geeqie | 860 | blacklist ${HOME}/.cache/geeqie |
758 | blacklist ${HOME}/.cache/gfeeds | 861 | blacklist ${HOME}/.cache/gfeeds |
759 | blacklist ${HOME}/.cache/gimp | 862 | blacklist ${HOME}/.cache/gimp |
863 | blacklist ${HOME}/.cache/gnome-boxes | ||
760 | blacklist ${HOME}/.cache/gnome-builder | 864 | blacklist ${HOME}/.cache/gnome-builder |
865 | blacklist ${HOME}/.cache/gnome-control-center | ||
761 | blacklist ${HOME}/.cache/gnome-recipes | 866 | blacklist ${HOME}/.cache/gnome-recipes |
867 | blacklist ${HOME}/.cache/gnome-screenshot | ||
868 | blacklist ${HOME}/.cache/gnome-software | ||
762 | blacklist ${HOME}/.cache/gnome-twitch | 869 | blacklist ${HOME}/.cache/gnome-twitch |
763 | blacklist ${HOME}/.cache/godot | 870 | blacklist ${HOME}/.cache/godot |
764 | blacklist ${HOME}/.cache/google-chrome | 871 | blacklist ${HOME}/.cache/google-chrome |
@@ -773,6 +880,7 @@ blacklist ${HOME}/.cache/inox | |||
773 | blacklist ${HOME}/.cache/iridium | 880 | blacklist ${HOME}/.cache/iridium |
774 | blacklist ${HOME}/.cache/kcmshell5 | 881 | blacklist ${HOME}/.cache/kcmshell5 |
775 | blacklist ${HOME}/.cache/kdenlive | 882 | blacklist ${HOME}/.cache/kdenlive |
883 | blacklist ${HOME}/.cache/keepassxc | ||
776 | blacklist ${HOME}/.cache/kfind | 884 | blacklist ${HOME}/.cache/kfind |
777 | blacklist ${HOME}/.cache/kinfocenter | 885 | blacklist ${HOME}/.cache/kinfocenter |
778 | blacklist ${HOME}/.cache/kmail2 | 886 | blacklist ${HOME}/.cache/kmail2 |
@@ -809,6 +917,7 @@ blacklist ${HOME}/.cache/org.gnome.Books | |||
809 | blacklist ${HOME}/.cache/org.gnome.Maps | 917 | blacklist ${HOME}/.cache/org.gnome.Maps |
810 | blacklist ${HOME}/.cache/pdfmod | 918 | blacklist ${HOME}/.cache/pdfmod |
811 | blacklist ${HOME}/.cache/peek | 919 | blacklist ${HOME}/.cache/peek |
920 | blacklist ${HOME}/.cache/pip | ||
812 | blacklist ${HOME}/.cache/plasmashell | 921 | blacklist ${HOME}/.cache/plasmashell |
813 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* | 922 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* |
814 | blacklist ${HOME}/.cache/qBittorrent | 923 | blacklist ${HOME}/.cache/qBittorrent |
@@ -819,6 +928,7 @@ blacklist ${HOME}/.cache/simple-scan | |||
819 | blacklist ${HOME}/.cache/slimjet | 928 | blacklist ${HOME}/.cache/slimjet |
820 | blacklist ${HOME}/.cache/snox | 929 | blacklist ${HOME}/.cache/snox |
821 | blacklist ${HOME}/.cache/spotify | 930 | blacklist ${HOME}/.cache/spotify |
931 | blacklist ${HOME}/.cache/strawberry | ||
822 | blacklist ${HOME}/.cache/supertuxkart | 932 | blacklist ${HOME}/.cache/supertuxkart |
823 | blacklist ${HOME}/.cache/systemsettings | 933 | blacklist ${HOME}/.cache/systemsettings |
824 | blacklist ${HOME}/.cache/telepathy | 934 | blacklist ${HOME}/.cache/telepathy |
@@ -828,6 +938,7 @@ blacklist ${HOME}/.cache/transmission | |||
828 | blacklist ${HOME}/.cache/vivaldi | 938 | blacklist ${HOME}/.cache/vivaldi |
829 | blacklist ${HOME}/.cache/vivaldi-snapshot | 939 | blacklist ${HOME}/.cache/vivaldi-snapshot |
830 | blacklist ${HOME}/.cache/vlc | 940 | blacklist ${HOME}/.cache/vlc |
941 | blacklist ${HOME}/.cache/vmware | ||
831 | blacklist ${HOME}/.cache/warsow-2.1 | 942 | blacklist ${HOME}/.cache/warsow-2.1 |
832 | blacklist ${HOME}/.cache/waterfox | 943 | blacklist ${HOME}/.cache/waterfox |
833 | blacklist ${HOME}/.cache/wesnoth | 944 | blacklist ${HOME}/.cache/wesnoth |
diff --git a/etc/inc/disable-shell.inc b/etc/inc/disable-shell.inc new file mode 100644 index 000000000..fda528eb6 --- /dev/null +++ b/etc/inc/disable-shell.inc | |||
@@ -0,0 +1,13 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include disable-shell.local | ||
4 | |||
5 | blacklist ${PATH}/bash | ||
6 | blacklist ${PATH}/csh | ||
7 | blacklist ${PATH}/dash | ||
8 | blacklist ${PATH}/fish | ||
9 | blacklist ${PATH}/ksh | ||
10 | blacklist ${PATH}/sh | ||
11 | blacklist ${PATH}/tclsh | ||
12 | blacklist ${PATH}/tcsh | ||
13 | blacklist ${PATH}/zsh | ||
diff --git a/etc/disable-xdg.inc b/etc/inc/disable-xdg.inc index 22acf272d..22acf272d 100644 --- a/etc/disable-xdg.inc +++ b/etc/inc/disable-xdg.inc | |||
diff --git a/etc/feh-network.inc b/etc/inc/feh-network.inc index e94e7205c..e94e7205c 100644 --- a/etc/feh-network.inc +++ b/etc/inc/feh-network.inc | |||
diff --git a/etc/firefox-common-addons.inc b/etc/inc/firefox-common-addons.inc index 1dca67e06..11acb7b42 100644 --- a/etc/firefox-common-addons.inc +++ b/etc/inc/firefox-common-addons.inc | |||
@@ -17,6 +17,7 @@ noblacklist ${HOME}/.kde4/share/config/kgetrc | |||
17 | noblacklist ${HOME}/.kde4/share/config/okularpartrc | 17 | noblacklist ${HOME}/.kde4/share/config/okularpartrc |
18 | noblacklist ${HOME}/.kde4/share/config/okularrc | 18 | noblacklist ${HOME}/.kde4/share/config/okularrc |
19 | noblacklist ${HOME}/.local/share/kget | 19 | noblacklist ${HOME}/.local/share/kget |
20 | noblacklist ${HOME}/.local/share/kxmlgui5/okular | ||
20 | noblacklist ${HOME}/.local/share/okular | 21 | noblacklist ${HOME}/.local/share/okular |
21 | noblacklist ${HOME}/.local/share/qpdfview | 22 | noblacklist ${HOME}/.local/share/qpdfview |
22 | 23 | ||
@@ -41,6 +42,7 @@ whitelist ${HOME}/.kde4/share/config/okularrc | |||
41 | whitelist ${HOME}/.keysnail.js | 42 | whitelist ${HOME}/.keysnail.js |
42 | whitelist ${HOME}/.lastpass | 43 | whitelist ${HOME}/.lastpass |
43 | whitelist ${HOME}/.local/share/kget | 44 | whitelist ${HOME}/.local/share/kget |
45 | whitelist ${HOME}/.local/share/kxmlgui5/okular | ||
44 | whitelist ${HOME}/.local/share/okular | 46 | whitelist ${HOME}/.local/share/okular |
45 | whitelist ${HOME}/.local/share/qpdfview | 47 | whitelist ${HOME}/.local/share/qpdfview |
46 | whitelist ${HOME}/.local/share/tridactyl | 48 | whitelist ${HOME}/.local/share/tridactyl |
@@ -57,7 +59,8 @@ whitelist ${HOME}/dwhelper | |||
57 | # GNOME Shell integration (chrome-gnome-shell) needs dbus and python 3 (blacklisted by disable-interpreters.inc) | 59 | # GNOME Shell integration (chrome-gnome-shell) needs dbus and python 3 (blacklisted by disable-interpreters.inc) |
58 | noblacklist ${HOME}/.local/share/gnome-shell | 60 | noblacklist ${HOME}/.local/share/gnome-shell |
59 | whitelist ${HOME}/.local/share/gnome-shell | 61 | whitelist ${HOME}/.local/share/gnome-shell |
60 | ignore nodbus | 62 | ignore dbus-user none |
63 | ignore dbus-system none | ||
61 | include allow-python3.inc | 64 | include allow-python3.inc |
62 | 65 | ||
63 | # KeePassXC Browser Integration | 66 | # KeePassXC Browser Integration |
diff --git a/etc/softmaker-common.inc b/etc/inc/softmaker-common.inc index 48249877c..a8ec5848c 100644 --- a/etc/softmaker-common.inc +++ b/etc/inc/softmaker-common.inc | |||
@@ -28,7 +28,6 @@ apparmor | |||
28 | caps.drop all | 28 | caps.drop all |
29 | ipc-namespace | 29 | ipc-namespace |
30 | netfilter | 30 | netfilter |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -46,3 +45,6 @@ private-cache | |||
46 | private-dev | 45 | private-dev |
47 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl | 46 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl |
48 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/whitelist-common.inc b/etc/inc/whitelist-common.inc index 9c1b7b92c..0798c7d3e 100644 --- a/etc/whitelist-common.inc +++ b/etc/inc/whitelist-common.inc | |||
@@ -11,6 +11,8 @@ whitelist ${HOME}/.config/pkcs11 | |||
11 | read-only ${HOME}/.config/pkcs11 | 11 | read-only ${HOME}/.config/pkcs11 |
12 | whitelist ${HOME}/.config/user-dirs.dirs | 12 | whitelist ${HOME}/.config/user-dirs.dirs |
13 | read-only ${HOME}/.config/user-dirs.dirs | 13 | read-only ${HOME}/.config/user-dirs.dirs |
14 | whitelist ${HOME}/.config/user-dirs.locale | ||
15 | read-only ${HOME}/.config/user-dirs.locale | ||
14 | whitelist ${HOME}/.drirc | 16 | whitelist ${HOME}/.drirc |
15 | whitelist ${HOME}/.icons | 17 | whitelist ${HOME}/.icons |
16 | ?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit | 18 | ?HAS_APPIMAGE: whitelist ${HOME}/.local/share/appimagekit |
@@ -38,6 +40,7 @@ whitelist ${HOME}/.pangorc | |||
38 | # gtk | 40 | # gtk |
39 | whitelist ${HOME}/.config/gtk-2.0 | 41 | whitelist ${HOME}/.config/gtk-2.0 |
40 | whitelist ${HOME}/.config/gtk-3.0 | 42 | whitelist ${HOME}/.config/gtk-3.0 |
43 | whitelist ${HOME}/.config/gtk-4.0 | ||
41 | whitelist ${HOME}/.config/gtkrc | 44 | whitelist ${HOME}/.config/gtkrc |
42 | whitelist ${HOME}/.config/gtkrc-2.0 | 45 | whitelist ${HOME}/.config/gtkrc-2.0 |
43 | whitelist ${HOME}/.gnome2 | 46 | whitelist ${HOME}/.gnome2 |
diff --git a/etc/inc/whitelist-runuser-common.inc b/etc/inc/whitelist-runuser-common.inc new file mode 100644 index 000000000..f2a510e9d --- /dev/null +++ b/etc/inc/whitelist-runuser-common.inc | |||
@@ -0,0 +1,12 @@ | |||
1 | # Local customizations come here | ||
2 | include whitelist-runuser-common.local | ||
3 | |||
4 | # common ${RUNUSER} (=/run/user/$UID) whitelist for all profiles | ||
5 | |||
6 | whitelist ${RUNUSER}/bus | ||
7 | whitelist ${RUNUSER}/dconf | ||
8 | whitelist ${RUNUSER}/gdm/Xauthority | ||
9 | whitelist ${RUNUSER}/ICEauthority | ||
10 | whitelist ${RUNUSER}/.mutter-Xwaylandauth.* | ||
11 | whitelist ${RUNUSER}/pulse/native | ||
12 | whitelist ${RUNUSER}/wayland-0 | ||
diff --git a/etc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc index a9d4cadb8..ceeb14dcc 100644 --- a/etc/whitelist-usr-share-common.inc +++ b/etc/inc/whitelist-usr-share-common.inc | |||
@@ -22,6 +22,7 @@ whitelist /usr/share/glib-2.0 | |||
22 | whitelist /usr/share/glvnd | 22 | whitelist /usr/share/glvnd |
23 | whitelist /usr/share/gtk-2.0 | 23 | whitelist /usr/share/gtk-2.0 |
24 | whitelist /usr/share/gtk-3.0 | 24 | whitelist /usr/share/gtk-3.0 |
25 | whitelist /usr/share/gtk-engines | ||
25 | whitelist /usr/share/gtksourceview-3.0 | 26 | whitelist /usr/share/gtksourceview-3.0 |
26 | whitelist /usr/share/gtksourceview-4 | 27 | whitelist /usr/share/gtksourceview-4 |
27 | whitelist /usr/share/hunspell | 28 | whitelist /usr/share/hunspell |
@@ -40,6 +41,8 @@ whitelist /usr/share/misc | |||
40 | whitelist /usr/share/Modules | 41 | whitelist /usr/share/Modules |
41 | whitelist /usr/share/myspell | 42 | whitelist /usr/share/myspell |
42 | whitelist /usr/share/p11-kit | 43 | whitelist /usr/share/p11-kit |
44 | whitelist /usr/share/perl | ||
45 | whitelist /usr/share/perl5 | ||
43 | whitelist /usr/share/pixmaps | 46 | whitelist /usr/share/pixmaps |
44 | whitelist /usr/share/pki | 47 | whitelist /usr/share/pki |
45 | whitelist /usr/share/plasma | 48 | whitelist /usr/share/plasma |
@@ -47,8 +50,10 @@ whitelist /usr/share/publicsuffix | |||
47 | whitelist /usr/share/qt | 50 | whitelist /usr/share/qt |
48 | whitelist /usr/share/qt4 | 51 | whitelist /usr/share/qt4 |
49 | whitelist /usr/share/qt5 | 52 | whitelist /usr/share/qt5 |
53 | whitelist /usr/share/qt5ct | ||
50 | whitelist /usr/share/sounds | 54 | whitelist /usr/share/sounds |
51 | whitelist /usr/share/tcl8.6 | 55 | whitelist /usr/share/tcl8.6 |
56 | whitelist /usr/share/tcltk | ||
52 | whitelist /usr/share/terminfo | 57 | whitelist /usr/share/terminfo |
53 | whitelist /usr/share/texlive | 58 | whitelist /usr/share/texlive |
54 | whitelist /usr/share/texmf | 59 | whitelist /usr/share/texmf |
diff --git a/etc/whitelist-var-common.inc b/etc/inc/whitelist-var-common.inc index e2210057b..e2210057b 100644 --- a/etc/whitelist-var-common.inc +++ b/etc/inc/whitelist-var-common.inc | |||
diff --git a/etc/keepassxc.profile b/etc/keepassxc.profile deleted file mode 100644 index d04ada227..000000000 --- a/etc/keepassxc.profile +++ /dev/null | |||
@@ -1,56 +0,0 @@ | |||
1 | # Firejail profile for keepassxc | ||
2 | # Description: Cross Platform Password Manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include keepassxc.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/*.kdb | ||
10 | noblacklist ${HOME}/*.kdbx | ||
11 | noblacklist ${HOME}/.config/keepassxc | ||
12 | noblacklist ${HOME}/.keepassxc | ||
13 | # 2.2.4 needs this path when compiled with "Native messaging browser extension" | ||
14 | noblacklist ${HOME}/.mozilla | ||
15 | noblacklist ${DOCUMENTS} | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | whitelist /usr/share/keepassxc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | caps.drop all | ||
30 | machine-id | ||
31 | net none | ||
32 | no3d | ||
33 | nodvd | ||
34 | # Breaks 'Lock database when session is locked or lid is closed' (#2899). | ||
35 | # Also breaks (Plasma) tray icon, | ||
36 | # you can safely uncomment it or add to keepassxc.local if you don't need these features. | ||
37 | #nodbus | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | nosound | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix,netlink | ||
46 | seccomp | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy | ||
51 | private-dev | ||
52 | private-etc alternatives,fonts,ld.so.cache,machine-id | ||
53 | private-tmp | ||
54 | |||
55 | # Mutex is stored in /tmp by default, which is broken by private-tmp | ||
56 | join-or-start keepassxc | ||
diff --git a/etc/nautilus.profile b/etc/nautilus.profile deleted file mode 100644 index e003488de..000000000 --- a/etc/nautilus.profile +++ /dev/null | |||
@@ -1,44 +0,0 @@ | |||
1 | # Firejail profile for nautilus | ||
2 | # Description: File manager and graphical shell for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nautilus.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Nautilus is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a nautilus process running on gnome desktops firejail will have no effect. | ||
11 | |||
12 | noblacklist ${HOME}/.config/nautilus | ||
13 | noblacklist ${HOME}/.local/share/Trash | ||
14 | noblacklist ${HOME}/.local/share/nautilus | ||
15 | noblacklist ${HOME}/.local/share/nautilus-python | ||
16 | |||
17 | # Allow python (blacklisted by disable-interpreters.inc) | ||
18 | include allow-python2.inc | ||
19 | include allow-python3.inc | ||
20 | |||
21 | include disable-common.inc | ||
22 | include disable-devel.inc | ||
23 | include disable-interpreters.inc | ||
24 | include disable-passwdmgr.inc | ||
25 | # include disable-programs.inc | ||
26 | |||
27 | allusers | ||
28 | caps.drop all | ||
29 | netfilter | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | novideo | ||
36 | protocol unix | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | # nautilus needs to be able to start arbitrary applications so we cannot blacklist their files | ||
42 | # private-bin nautilus | ||
43 | # private-dev | ||
44 | # private-tmp | ||
diff --git a/etc/nemo.profile b/etc/nemo.profile deleted file mode 100644 index 6a62a3a0c..000000000 --- a/etc/nemo.profile +++ /dev/null | |||
@@ -1,38 +0,0 @@ | |||
1 | # Firejail profile for nemo | ||
2 | # Description: File manager and graphical shell for Cinnamon | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nemo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/nemo | ||
10 | noblacklist ${HOME}/.local/share/Trash | ||
11 | noblacklist ${HOME}/.local/share/nemo | ||
12 | noblacklist ${HOME}/.local/share/nemo-python | ||
13 | |||
14 | # Allow python (blacklisted by disable-interpreters.inc) | ||
15 | include allow-python2.inc | ||
16 | include allow-python3.inc | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-passwdmgr.inc | ||
23 | |||
24 | allusers | ||
25 | caps.drop all | ||
26 | netfilter | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | novideo | ||
35 | protocol unix,inet,inet6 | ||
36 | seccomp | ||
37 | shell none | ||
38 | |||
diff --git a/etc/nolocal.net b/etc/net/nolocal.net index 8955f740d..0eb9f9784 100644 --- a/etc/nolocal.net +++ b/etc/net/nolocal.net | |||
@@ -32,5 +32,5 @@ | |||
32 | -A OUTPUT -d 172.16.0.0/12 -j DROP | 32 | -A OUTPUT -d 172.16.0.0/12 -j DROP |
33 | 33 | ||
34 | # drop multicast traffic | 34 | # drop multicast traffic |
35 | -A OUTPUT -d 244.0.0.0/4 -j DROP | 35 | -A OUTPUT -d 224.0.0.0/4 -j DROP |
36 | COMMIT | 36 | COMMIT |
diff --git a/etc/tcpserver.net b/etc/net/tcpserver.net index 9c39ee5fb..9c39ee5fb 100644 --- a/etc/tcpserver.net +++ b/etc/net/tcpserver.net | |||
diff --git a/etc/webserver.net b/etc/net/webserver.net index 83db76825..83db76825 100644 --- a/etc/webserver.net +++ b/etc/net/webserver.net | |||
diff --git a/etc/pcmanfm.profile b/etc/pcmanfm.profile deleted file mode 100644 index 7f2a0d673..000000000 --- a/etc/pcmanfm.profile +++ /dev/null | |||
@@ -1,33 +0,0 @@ | |||
1 | # Firejail profile for pcmanfm | ||
2 | # Description: Extremely fast and lightweight file manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include pcmanfm.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/Trash | ||
10 | # noblacklist ${HOME}/.config/libfm - disable-programs.inc is disabled, see below | ||
11 | # noblacklist ${HOME}/.config/pcmanfm | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | ||
18 | |||
19 | allusers | ||
20 | caps.drop all | ||
21 | # net none - see issue #1467, computer:/// location broken | ||
22 | no3d | ||
23 | # nodbus | ||
24 | nodvd | ||
25 | nonewprivs | ||
26 | noroot | ||
27 | nosound | ||
28 | notv | ||
29 | novideo | ||
30 | protocol unix | ||
31 | seccomp | ||
32 | shell none | ||
33 | tracelog | ||
diff --git a/etc/0ad.profile b/etc/profile-a-l/0ad.profile index 8b5820d5e..6869ea631 100644 --- a/etc/0ad.profile +++ b/etc/profile-a-l/0ad.profile | |||
@@ -24,13 +24,13 @@ whitelist ${HOME}/.cache/0ad | |||
24 | whitelist ${HOME}/.config/0ad | 24 | whitelist ${HOME}/.config/0ad |
25 | whitelist ${HOME}/.local/share/0ad | 25 | whitelist ${HOME}/.local/share/0ad |
26 | whitelist /usr/share/0ad | 26 | whitelist /usr/share/0ad |
27 | whitelist /usr/share/games | ||
27 | include whitelist-common.inc | 28 | include whitelist-common.inc |
28 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
30 | 31 | ||
31 | caps.drop all | 32 | caps.drop all |
32 | netfilter | 33 | netfilter |
33 | nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -45,6 +45,9 @@ tracelog | |||
45 | 45 | ||
46 | disable-mnt | 46 | disable-mnt |
47 | private-bin 0ad,pyrogenesis,sh,which | 47 | private-bin 0ad,pyrogenesis,sh,which |
48 | private-cache | ||
48 | private-dev | 49 | private-dev |
49 | private-tmp | 50 | private-tmp |
50 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/2048-qt.profile b/etc/profile-a-l/2048-qt.profile index 2347039a6..12268706a 100644 --- a/etc/2048-qt.profile +++ b/etc/profile-a-l/2048-qt.profile | |||
@@ -23,8 +23,9 @@ whitelist ${HOME}/.config/xiaoyong | |||
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | net none |
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
diff --git a/etc/7z.profile b/etc/profile-a-l/7z.profile index b60bb9ee9..02a2e7ea0 100644 --- a/etc/7z.profile +++ b/etc/profile-a-l/7z.profile | |||
@@ -23,7 +23,6 @@ ipc-namespace | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | #nogroups | 27 | #nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -42,4 +41,7 @@ x11 none | |||
42 | private-cache | 41 | private-cache |
43 | private-dev | 42 | private-dev |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
45 | memory-deny-write-execute | 47 | memory-deny-write-execute |
diff --git a/etc/7za.profile b/etc/profile-a-l/7za.profile index 9cd04cad1..9cd04cad1 100644 --- a/etc/7za.profile +++ b/etc/profile-a-l/7za.profile | |||
diff --git a/etc/7zr.profile b/etc/profile-a-l/7zr.profile index bd3842900..bd3842900 100644 --- a/etc/7zr.profile +++ b/etc/profile-a-l/7zr.profile | |||
diff --git a/etc/Builder.profile b/etc/profile-a-l/Builder.profile index 54b437441..54b437441 100644 --- a/etc/Builder.profile +++ b/etc/profile-a-l/Builder.profile | |||
diff --git a/etc/Cheese.profile b/etc/profile-a-l/Cheese.profile index 5bb5064f0..5bb5064f0 100644 --- a/etc/Cheese.profile +++ b/etc/profile-a-l/Cheese.profile | |||
diff --git a/etc/Cryptocat.profile b/etc/profile-a-l/Cryptocat.profile index e9cc07bd7..e9cc07bd7 100644 --- a/etc/Cryptocat.profile +++ b/etc/profile-a-l/Cryptocat.profile | |||
diff --git a/etc/Cyberfox.profile b/etc/profile-a-l/Cyberfox.profile index 26a4348c9..26a4348c9 100644 --- a/etc/Cyberfox.profile +++ b/etc/profile-a-l/Cyberfox.profile | |||
diff --git a/etc/Discord.profile b/etc/profile-a-l/Discord.profile index 3f274b21c..3f274b21c 100644 --- a/etc/Discord.profile +++ b/etc/profile-a-l/Discord.profile | |||
diff --git a/etc/DiscordCanary.profile b/etc/profile-a-l/DiscordCanary.profile index d24e73ed8..d24e73ed8 100644 --- a/etc/DiscordCanary.profile +++ b/etc/profile-a-l/DiscordCanary.profile | |||
diff --git a/etc/Documents.profile b/etc/profile-a-l/Documents.profile index 171ab4357..171ab4357 100644 --- a/etc/Documents.profile +++ b/etc/profile-a-l/Documents.profile | |||
diff --git a/etc/FossaMail.profile b/etc/profile-a-l/FossaMail.profile index 9e1f61421..9e1f61421 100644 --- a/etc/FossaMail.profile +++ b/etc/profile-a-l/FossaMail.profile | |||
diff --git a/etc/Fritzing.profile b/etc/profile-a-l/Fritzing.profile index d318da885..d318da885 100644 --- a/etc/Fritzing.profile +++ b/etc/profile-a-l/Fritzing.profile | |||
diff --git a/etc/Gitter.profile b/etc/profile-a-l/Gitter.profile index a8bcb6a54..a8bcb6a54 100644 --- a/etc/Gitter.profile +++ b/etc/profile-a-l/Gitter.profile | |||
diff --git a/etc/JDownloader.profile b/etc/profile-a-l/JDownloader.profile index 1435f3422..45ec71e63 100644 --- a/etc/JDownloader.profile +++ b/etc/profile-a-l/JDownloader.profile | |||
@@ -28,7 +28,6 @@ caps.drop all | |||
28 | ipc-namespace | 28 | ipc-namespace |
29 | netfilter | 29 | netfilter |
30 | no3d | 30 | no3d |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -45,3 +44,5 @@ private-cache | |||
45 | private-dev | 44 | private-dev |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/Logs.profile b/etc/profile-a-l/Logs.profile index 431439f17..431439f17 100644 --- a/etc/Logs.profile +++ b/etc/profile-a-l/Logs.profile | |||
diff --git a/etc/profile-a-l/abiword.profile b/etc/profile-a-l/abiword.profile new file mode 100644 index 000000000..1fdc9e9fe --- /dev/null +++ b/etc/profile-a-l/abiword.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for abiword | ||
2 | # Description: flexible cross-platform word processor | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include abiword.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/abiword | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | |||
19 | whitelist /usr/share/abiword-3.0 | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | private-bin abiword | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc fonts,gtk-3.0,passwd | ||
46 | private-tmp | ||
47 | |||
48 | # dbus-user none | ||
49 | # dbus-system none | ||
diff --git a/etc/abrowser.profile b/etc/profile-a-l/abrowser.profile index 2e6e8f1af..2e6e8f1af 100644 --- a/etc/abrowser.profile +++ b/etc/profile-a-l/abrowser.profile | |||
diff --git a/etc/acat.profile b/etc/profile-a-l/acat.profile index 522d8db4e..522d8db4e 100644 --- a/etc/acat.profile +++ b/etc/profile-a-l/acat.profile | |||
diff --git a/etc/adiff.profile b/etc/profile-a-l/adiff.profile index a80886d56..a80886d56 100644 --- a/etc/adiff.profile +++ b/etc/profile-a-l/adiff.profile | |||
diff --git a/etc/akonadi_control.profile b/etc/profile-a-l/akonadi_control.profile index ffc613f1e..4ab1967a6 100644 --- a/etc/akonadi_control.profile +++ b/etc/profile-a-l/akonadi_control.profile | |||
@@ -47,7 +47,7 @@ notv | |||
47 | nou2f | 47 | nou2f |
48 | novideo | 48 | novideo |
49 | # protocol unix,inet,inet6,netlink | 49 | # protocol unix,inet,inet6,netlink |
50 | # seccomp !io_getevents,!io_setup,!io_submit,!ioprio_set | 50 | # seccomp !io_destroy,!io_getevents,!io_setup,!io_submit,!ioprio_set |
51 | tracelog | 51 | tracelog |
52 | 52 | ||
53 | private-dev | 53 | private-dev |
diff --git a/etc/akregator.profile b/etc/profile-a-l/akregator.profile index 34933f283..6a4d775e7 100644 --- a/etc/akregator.profile +++ b/etc/profile-a-l/akregator.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.config/akregatorrc | 9 | noblacklist ${HOME}/.config/akregatorrc |
10 | noblacklist ${HOME}/.local/share/akregator | 10 | noblacklist ${HOME}/.local/share/akregator |
11 | noblacklist ${HOME}/.local/share/kxmlgui5/akregator | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -15,12 +16,15 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | 20 | ||
19 | mkfile ${HOME}/.config/akregatorrc | 21 | mkfile ${HOME}/.config/akregatorrc |
20 | mkdir ${HOME}/.local/share/akregator | 22 | mkdir ${HOME}/.local/share/akregator |
23 | mkdir ${HOME}/.local/share/kxmlgui5/akregator | ||
21 | whitelist ${HOME}/.config/akregatorrc | 24 | whitelist ${HOME}/.config/akregatorrc |
22 | whitelist ${HOME}/.local/share/akregator | 25 | whitelist ${HOME}/.local/share/akregator |
23 | whitelist ${HOME}/.local/share/kssl | 26 | whitelist ${HOME}/.local/share/kssl |
27 | whitelist ${HOME}/.local/share/kxmlgui5/akregator | ||
24 | include whitelist-common.inc | 28 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
26 | 30 | ||
diff --git a/etc/als.profile b/etc/profile-a-l/als.profile index 5eae228b6..5eae228b6 100644 --- a/etc/als.profile +++ b/etc/profile-a-l/als.profile | |||
diff --git a/etc/amarok.profile b/etc/profile-a-l/amarok.profile index 0b974e9ac..0b974e9ac 100644 --- a/etc/amarok.profile +++ b/etc/profile-a-l/amarok.profile | |||
diff --git a/etc/amule.profile b/etc/profile-a-l/amule.profile index feb4a5e7e..feb4a5e7e 100644 --- a/etc/amule.profile +++ b/etc/profile-a-l/amule.profile | |||
diff --git a/etc/amuled.profile b/etc/profile-a-l/amuled.profile index 58b796875..58b796875 100644 --- a/etc/amuled.profile +++ b/etc/profile-a-l/amuled.profile | |||
diff --git a/etc/android-studio.profile b/etc/profile-a-l/android-studio.profile index 2e4e564dd..2e4e564dd 100644 --- a/etc/android-studio.profile +++ b/etc/profile-a-l/android-studio.profile | |||
diff --git a/etc/anki.profile b/etc/profile-a-l/anki.profile index a0a79ef48..61e5f2eea 100644 --- a/etc/anki.profile +++ b/etc/profile-a-l/anki.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.local/share/Anki2 | 25 | mkdir ${HOME}/.local/share/Anki2 |
@@ -32,7 +33,6 @@ caps.drop all | |||
32 | machine-id | 33 | machine-id |
33 | netfilter | 34 | netfilter |
34 | no3d | 35 | no3d |
35 | nodbus | ||
36 | nodvd | 36 | nodvd |
37 | nogroups | 37 | nogroups |
38 | nonewprivs | 38 | nonewprivs |
@@ -53,3 +53,6 @@ private-cache | |||
53 | private-dev | 53 | private-dev |
54 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,machine-id,pki,resolv.conf,ssl,Trolltech.conf | 54 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,machine-id,pki,resolv.conf,ssl,Trolltech.conf |
55 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/anydesk.profile b/etc/profile-a-l/anydesk.profile index 35b18bab4..c847a04dc 100644 --- a/etc/anydesk.profile +++ b/etc/profile-a-l/anydesk.profile | |||
@@ -9,9 +9,10 @@ noblacklist ${HOME}/.anydesk | |||
9 | 9 | ||
10 | include disable-common.inc | 10 | include disable-common.inc |
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | ||
12 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 14 | include disable-programs.inc |
14 | include disable-interpreters.inc | 15 | include disable-shell.inc |
15 | 16 | ||
16 | mkdir ${HOME}/.anydesk | 17 | mkdir ${HOME}/.anydesk |
17 | whitelist ${HOME}/.anydesk | 18 | whitelist ${HOME}/.anydesk |
diff --git a/etc/aosp.profile b/etc/profile-a-l/aosp.profile index a5b1ba9f1..a5b1ba9f1 100644 --- a/etc/aosp.profile +++ b/etc/profile-a-l/aosp.profile | |||
diff --git a/etc/apack.profile b/etc/profile-a-l/apack.profile index 9fef911af..9fef911af 100644 --- a/etc/apack.profile +++ b/etc/profile-a-l/apack.profile | |||
diff --git a/etc/apktool.profile b/etc/profile-a-l/apktool.profile index aeeb845ea..39c5da9ab 100644 --- a/etc/apktool.profile +++ b/etc/profile-a-l/apktool.profile | |||
@@ -18,7 +18,6 @@ include whitelist-var-common.inc | |||
18 | caps.drop all | 18 | caps.drop all |
19 | net none | 19 | net none |
20 | no3d | 20 | no3d |
21 | nodbus | ||
22 | nodvd | 21 | nodvd |
23 | nogroups | 22 | nogroups |
24 | nonewprivs | 23 | nonewprivs |
@@ -34,3 +33,6 @@ shell none | |||
34 | private-bin apktool,basename,bash,dirname,expr,java,sh | 33 | private-bin apktool,basename,bash,dirname,expr,java,sh |
35 | private-cache | 34 | private-cache |
36 | private-dev | 35 | private-dev |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/profile-a-l/apostrophe.profile b/etc/profile-a-l/apostrophe.profile new file mode 100644 index 000000000..9c0b92598 --- /dev/null +++ b/etc/profile-a-l/apostrophe.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for apostrophe | ||
2 | # Description: Distraction free Markdown editor for GNU/Linux made with GTK+ | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include apostrophe.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${DOCUMENTS} | ||
10 | noblacklist ${PICTURES} | ||
11 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | ||
21 | include disable-shell.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | whitelist /usr/share/apostrophe | ||
25 | whitelist /usr/share/pandoc-* | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | machine-id | ||
33 | net none | ||
34 | no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | nosound | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin apostrophe,pandoc,python3* | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,pango,X11 | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user filter | ||
56 | dbus-user.own org.gnome.gitlab.somas.Apostrophe | ||
57 | dbus-user.talk ca.desrt.dconf | ||
58 | dbus-system none | ||
diff --git a/etc/ar.profile b/etc/profile-a-l/ar.profile index e28370450..183587ff8 100644 --- a/etc/ar.profile +++ b/etc/profile-a-l/ar.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | apparmor | 20 | apparmor |
20 | caps.drop all | 21 | caps.drop all |
@@ -23,7 +24,6 @@ ipc-namespace | |||
23 | machine-id | 24 | machine-id |
24 | net none | 25 | net none |
25 | no3d | 26 | no3d |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,4 +42,7 @@ private-bin ar | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
47 | |||
45 | memory-deny-write-execute | 48 | memory-deny-write-execute |
diff --git a/etc/arch-audit.profile b/etc/profile-a-l/arch-audit.profile index 0a87ec297..934b89404 100644 --- a/etc/arch-audit.profile +++ b/etc/profile-a-l/arch-audit.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist /usr/share/arch-audit | 21 | whitelist /usr/share/arch-audit |
@@ -26,7 +27,6 @@ ipc-namespace | |||
26 | machine-id | 27 | machine-id |
27 | netfilter | 28 | netfilter |
28 | no3d | 29 | no3d |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -46,4 +46,7 @@ private-cache | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
49 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/archaudit-report.profile b/etc/profile-a-l/archaudit-report.profile index 19c37f90e..19c37f90e 100644 --- a/etc/archaudit-report.profile +++ b/etc/profile-a-l/archaudit-report.profile | |||
diff --git a/etc/ardour4.profile b/etc/profile-a-l/ardour4.profile index 4ad8dd456..4ad8dd456 100644 --- a/etc/ardour4.profile +++ b/etc/profile-a-l/ardour4.profile | |||
diff --git a/etc/ardour5.profile b/etc/profile-a-l/ardour5.profile index 5ebeafa76..a27cb4f6e 100644 --- a/etc/ardour5.profile +++ b/etc/profile-a-l/ardour5.profile | |||
@@ -23,7 +23,6 @@ include disable-xdg.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | ipc-namespace | 24 | ipc-namespace |
25 | net none | 25 | net none |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -40,3 +39,5 @@ private-dev | |||
40 | #private-etc alternatives,ardour4,ardour5,asound.conf,fonts,machine-id,pulse,X11 | 39 | #private-etc alternatives,ardour4,ardour5,asound.conf,fonts,machine-id,pulse,X11 |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/arduino.profile b/etc/profile-a-l/arduino.profile index fd1ca9a09..fd1ca9a09 100644 --- a/etc/arduino.profile +++ b/etc/profile-a-l/arduino.profile | |||
diff --git a/etc/arepack.profile b/etc/profile-a-l/arepack.profile index 012f2f049..012f2f049 100644 --- a/etc/arepack.profile +++ b/etc/profile-a-l/arepack.profile | |||
diff --git a/etc/aria2c.profile b/etc/profile-a-l/aria2c.profile index a52a26d6f..d2dcaace1 100644 --- a/etc/aria2c.profile +++ b/etc/profile-a-l/aria2c.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | ipc-namespace | 27 | ipc-namespace |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -50,4 +49,7 @@ private-etc alternatives,ca-certificates,crypto-policies,groups,login.defs,machi | |||
50 | private-lib libreadline.so.* | 49 | private-lib libreadline.so.* |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/ark.profile b/etc/profile-a-l/ark.profile index 2fe546b55..4b81b2717 100644 --- a/etc/ark.profile +++ b/etc/profile-a-l/ark.profile | |||
@@ -7,6 +7,7 @@ include ark.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/arkrc | 9 | noblacklist ${HOME}/.config/arkrc |
10 | noblacklist ${HOME}/.local/share/kxmlgui5/ark | ||
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
12 | include disable-devel.inc | 13 | include disable-devel.inc |
@@ -23,7 +24,6 @@ apparmor | |||
23 | caps.drop all | 24 | caps.drop all |
24 | # net none | 25 | # net none |
25 | netfilter | 26 | netfilter |
26 | # nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,3 +42,5 @@ private-bin 7z,ark,bash,lrzip,lsar,lz4,lzop,p7zip,rar,sh,tclsh,unar,unrar,unzip, | |||
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/arm.profile b/etc/profile-a-l/arm.profile index 51dad94d1..51dad94d1 100644 --- a/etc/arm.profile +++ b/etc/profile-a-l/arm.profile | |||
diff --git a/etc/artha.profile b/etc/profile-a-l/artha.profile index aaaede7ee..adb33fae1 100644 --- a/etc/artha.profile +++ b/etc/profile-a-l/artha.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | # whitelisting in ${HOME} makes settings immutable, see #3112 | 25 | # whitelisting in ${HOME} makes settings immutable, see #3112 |
@@ -38,7 +39,6 @@ caps.drop all | |||
38 | ipc-namespace | 39 | ipc-namespace |
39 | # net none - breaks on Ubuntu | 40 | # net none - breaks on Ubuntu |
40 | no3d | 41 | no3d |
41 | # nodbus | ||
42 | nodvd | 42 | nodvd |
43 | nogroups | 43 | nogroups |
44 | nonewprivs | 44 | nonewprivs |
@@ -60,4 +60,7 @@ private-etc alternatives,fonts,machine-id | |||
60 | private-lib libnotify.so.* | 60 | private-lib libnotify.so.* |
61 | private-tmp | 61 | private-tmp |
62 | 62 | ||
63 | # dbus-user none | ||
64 | # dbus-system none | ||
65 | |||
63 | memory-deny-write-execute | 66 | memory-deny-write-execute |
diff --git a/etc/assogiate.profile b/etc/profile-a-l/assogiate.profile index 542b3da8d..2686839ef 100644 --- a/etc/assogiate.profile +++ b/etc/profile-a-l/assogiate.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | whitelist ${PICTURES} | 20 | whitelist ${PICTURES} |
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | machine-id | 27 | machine-id |
27 | net none | 28 | net none |
28 | no3d | 29 | no3d |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -47,4 +47,7 @@ private-dev | |||
47 | private-lib gnome-vfs-2.0,libacl.so.*,libattr.so.*,libfam.so.* | 47 | private-lib gnome-vfs-2.0,libacl.so.*,libattr.so.*,libfam.so.* |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
50 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/asunder.profile b/etc/profile-a-l/asunder.profile index 1f3acd735..33dd4103f 100644 --- a/etc/asunder.profile +++ b/etc/profile-a-l/asunder.profile | |||
@@ -20,23 +20,29 @@ include disable-passwdmgr.inc | |||
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-xdg.inc | 21 | include disable-xdg.inc |
22 | 22 | ||
23 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
25 | apparmor | 26 | apparmor |
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | netfilter |
28 | nodbus | 29 | no3d |
29 | # nogroups | 30 | # nogroups |
30 | nonewprivs | 31 | nonewprivs |
31 | noroot | 32 | noroot |
32 | nou2f | 33 | nou2f |
34 | notv | ||
33 | novideo | 35 | novideo |
34 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
35 | seccomp | 37 | seccomp |
36 | shell none | 38 | shell none |
37 | 39 | ||
40 | private-cache | ||
38 | private-dev | 41 | private-dev |
39 | private-tmp | 42 | private-tmp |
40 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
41 | # mdwe is disabled due to breaking hardware accelerated decoding | 47 | # mdwe is disabled due to breaking hardware accelerated decoding |
42 | # memory-deny-write-execute | 48 | # memory-deny-write-execute |
diff --git a/etc/atom-beta.profile b/etc/profile-a-l/atom-beta.profile index c0ee2c492..c0ee2c492 100644 --- a/etc/atom-beta.profile +++ b/etc/profile-a-l/atom-beta.profile | |||
diff --git a/etc/atom.profile b/etc/profile-a-l/atom.profile index b9cb49d08..cf0a5a42b 100644 --- a/etc/atom.profile +++ b/etc/profile-a-l/atom.profile | |||
@@ -17,22 +17,20 @@ include disable-exec.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | caps.drop all | 20 | caps.keep sys_admin,sys_chroot |
21 | # net none | 21 | # net none |
22 | netfilter | 22 | netfilter |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | ||
27 | noroot | ||
28 | nosound | 25 | nosound |
29 | notv | 26 | notv |
30 | nou2f | 27 | nou2f |
31 | novideo | 28 | novideo |
32 | protocol unix,inet,inet6,netlink | ||
33 | seccomp | ||
34 | shell none | 29 | shell none |
35 | 30 | ||
36 | private-cache | 31 | private-cache |
37 | private-dev | 32 | private-dev |
38 | private-tmp | 33 | private-tmp |
34 | |||
35 | dbus-user none | ||
36 | dbus-system none | ||
diff --git a/etc/atool.profile b/etc/profile-a-l/atool.profile index 0250451fc..e501e956c 100644 --- a/etc/atool.profile +++ b/etc/profile-a-l/atool.profile | |||
@@ -25,10 +25,8 @@ hostname atool | |||
25 | ipc-namespace | 25 | ipc-namespace |
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | netfilter | ||
29 | no3d | 28 | no3d |
30 | nodvd | 29 | nodvd |
31 | nodbus | ||
32 | nogroups | 30 | nogroups |
33 | nonewprivs | 31 | nonewprivs |
34 | noroot | 32 | noroot |
@@ -49,4 +47,7 @@ private-dev | |||
49 | private-etc alternatives,group,login.defs,passwd | 47 | private-etc alternatives,group,login.defs,passwd |
50 | private-tmp | 48 | private-tmp |
51 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
52 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/atril-previewer.profile b/etc/profile-a-l/atril-previewer.profile index 7f4697357..7f4697357 100644 --- a/etc/atril-previewer.profile +++ b/etc/profile-a-l/atril-previewer.profile | |||
diff --git a/etc/atril-thumbnailer.profile b/etc/profile-a-l/atril-thumbnailer.profile index 8f6129ea6..8f6129ea6 100644 --- a/etc/atril-thumbnailer.profile +++ b/etc/profile-a-l/atril-thumbnailer.profile | |||
diff --git a/etc/atril.profile b/etc/profile-a-l/atril.profile index adca38cb5..adca38cb5 100644 --- a/etc/atril.profile +++ b/etc/profile-a-l/atril.profile | |||
diff --git a/etc/audacious.profile b/etc/profile-a-l/audacious.profile index 4d0c93047..2e1f6f32a 100644 --- a/etc/audacious.profile +++ b/etc/profile-a-l/audacious.profile | |||
@@ -23,7 +23,6 @@ include whitelist-var-common.inc | |||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | netfilter |
26 | #nodbus - dbus needed for MPRIS | ||
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
29 | noroot | 28 | noroot |
@@ -40,4 +39,6 @@ private-cache | |||
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
43 | memory-deny-write-execute | 42 | # dbus needed for MPRIS |
43 | # dbus-user none | ||
44 | # dbus-system none | ||
diff --git a/etc/audacity.profile b/etc/profile-a-l/audacity.profile index 200d3a387..a11e59553 100644 --- a/etc/audacity.profile +++ b/etc/profile-a-l/audacity.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
@@ -24,7 +25,6 @@ apparmor | |||
24 | caps.drop all | 25 | caps.drop all |
25 | net none | 26 | net none |
26 | no3d | 27 | no3d |
27 | # nodbus - problems on Fedora 27 | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -41,4 +41,6 @@ private-bin audacity | |||
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | memory-deny-write-execute | 44 | # problems on Fedora 27 |
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/audio-recorder.profile b/etc/profile-a-l/audio-recorder.profile index b2ed3b030..b2ed3b030 100644 --- a/etc/audio-recorder.profile +++ b/etc/profile-a-l/audio-recorder.profile | |||
diff --git a/etc/aunpack.profile b/etc/profile-a-l/aunpack.profile index 6ce4aa491..6ce4aa491 100644 --- a/etc/aunpack.profile +++ b/etc/profile-a-l/aunpack.profile | |||
diff --git a/etc/authenticator.profile b/etc/profile-a-l/authenticator.profile index 4887299ec..131b20c70 100644 --- a/etc/authenticator.profile +++ b/etc/profile-a-l/authenticator.profile | |||
@@ -24,7 +24,6 @@ include disable-programs.inc | |||
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | netfilter |
26 | no3d | 26 | no3d |
27 | # nodbus - makes settings immutable | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -43,4 +42,8 @@ private-dev | |||
43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,pki,resolv.conf,ssl | 42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,pki,resolv.conf,ssl |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
45 | # makes settings immutable | ||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
48 | |||
46 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 49 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/autokey-common.profile b/etc/profile-a-l/autokey-common.profile index b1a77c0a4..b1a77c0a4 100644 --- a/etc/autokey-common.profile +++ b/etc/profile-a-l/autokey-common.profile | |||
diff --git a/etc/autokey-gtk.profile b/etc/profile-a-l/autokey-gtk.profile index e16449064..e16449064 100644 --- a/etc/autokey-gtk.profile +++ b/etc/profile-a-l/autokey-gtk.profile | |||
diff --git a/etc/autokey-qt.profile b/etc/profile-a-l/autokey-qt.profile index b6f1210dd..b6f1210dd 100644 --- a/etc/autokey-qt.profile +++ b/etc/profile-a-l/autokey-qt.profile | |||
diff --git a/etc/autokey-run.profile b/etc/profile-a-l/autokey-run.profile index 05669351a..05669351a 100644 --- a/etc/autokey-run.profile +++ b/etc/profile-a-l/autokey-run.profile | |||
diff --git a/etc/autokey-shell.profile b/etc/profile-a-l/autokey-shell.profile index dfbd8759f..dfbd8759f 100644 --- a/etc/autokey-shell.profile +++ b/etc/profile-a-l/autokey-shell.profile | |||
diff --git a/etc/aweather.profile b/etc/profile-a-l/aweather.profile index d7228570f..44c3110a0 100644 --- a/etc/aweather.profile +++ b/etc/profile-a-l/aweather.profile | |||
@@ -13,6 +13,7 @@ include disable-devel.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | mkdir ${HOME}/.config/aweather | 18 | mkdir ${HOME}/.config/aweather |
18 | whitelist ${HOME}/.config/aweather | 19 | whitelist ${HOME}/.config/aweather |
diff --git a/etc/awesome.profile b/etc/profile-a-l/awesome.profile index 5d1bf5071..5d1bf5071 100644 --- a/etc/awesome.profile +++ b/etc/profile-a-l/awesome.profile | |||
diff --git a/etc/baloo_file.profile b/etc/profile-a-l/baloo_file.profile index 785e37a16..785e37a16 100644 --- a/etc/baloo_file.profile +++ b/etc/profile-a-l/baloo_file.profile | |||
diff --git a/etc/baloo_filemetadata_temp_extractor.profile b/etc/profile-a-l/baloo_filemetadata_temp_extractor.profile index ff10e9965..ff10e9965 100644 --- a/etc/baloo_filemetadata_temp_extractor.profile +++ b/etc/profile-a-l/baloo_filemetadata_temp_extractor.profile | |||
diff --git a/etc/baobab.profile b/etc/profile-a-l/baobab.profile index 18c862a4d..3937e1966 100644 --- a/etc/baobab.profile +++ b/etc/profile-a-l/baobab.profile | |||
@@ -12,12 +12,14 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | # include disable-programs.inc | 14 | # include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | # include disable-xdg.inc | 16 | # include disable-xdg.inc |
16 | 17 | ||
18 | include whitelist-runuser-common.inc | ||
19 | |||
17 | caps.drop all | 20 | caps.drop all |
18 | net none | 21 | net none |
19 | no3d | 22 | no3d |
20 | #nodbus | ||
21 | nodvd | 23 | nodvd |
22 | nogroups | 24 | nogroups |
23 | nonewprivs | 25 | nonewprivs |
@@ -29,9 +31,13 @@ novideo | |||
29 | protocol unix | 31 | protocol unix |
30 | seccomp | 32 | seccomp |
31 | shell none | 33 | shell none |
34 | tracelog | ||
32 | 35 | ||
33 | private-bin baobab | 36 | private-bin baobab |
34 | private-dev | 37 | private-dev |
35 | private-tmp | 38 | private-tmp |
36 | 39 | ||
40 | # dbus-user none | ||
41 | # dbus-system none | ||
42 | |||
37 | read-only ${HOME} | 43 | read-only ${HOME} |
diff --git a/etc/barrier.profile b/etc/profile-a-l/barrier.profile index f5da3782e..f5da3782e 100644 --- a/etc/barrier.profile +++ b/etc/profile-a-l/barrier.profile | |||
diff --git a/etc/basilisk.profile b/etc/profile-a-l/basilisk.profile index 8dc3847a0..8dc3847a0 100644 --- a/etc/basilisk.profile +++ b/etc/profile-a-l/basilisk.profile | |||
diff --git a/etc/beaker.profile b/etc/profile-a-l/beaker.profile index cc1886a49..cc1886a49 100644 --- a/etc/beaker.profile +++ b/etc/profile-a-l/beaker.profile | |||
diff --git a/etc/bibletime.profile b/etc/profile-a-l/bibletime.profile index b76bc8367..99e2802eb 100644 --- a/etc/bibletime.profile +++ b/etc/profile-a-l/bibletime.profile | |||
@@ -35,7 +35,6 @@ apparmor | |||
35 | caps.drop all | 35 | caps.drop all |
36 | machine-id | 36 | machine-id |
37 | netfilter | 37 | netfilter |
38 | nodbus | ||
39 | nodvd | 38 | nodvd |
40 | nogroups | 39 | nogroups |
41 | nonewprivs | 40 | nonewprivs |
@@ -54,3 +53,6 @@ private-cache | |||
54 | private-dev | 53 | private-dev |
55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf | 54 | private-etc alternatives,ca-certificates,crypto-policies,fonts,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf |
56 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/bibtex.profile b/etc/profile-a-l/bibtex.profile index e868dcbab..e868dcbab 100644 --- a/etc/bibtex.profile +++ b/etc/profile-a-l/bibtex.profile | |||
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile new file mode 100644 index 000000000..c1c338536 --- /dev/null +++ b/etc/profile-a-l/bijiben.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for bijiben | ||
2 | # Description: Simple Note Viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include bijiben.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/bijiben | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.local/share/bijiben | ||
21 | whitelist ${HOME}/.local/share/bijiben | ||
22 | whitelist ${HOME}/.cache/tracker | ||
23 | whitelist /usr/share/bijiben | ||
24 | whitelist /usr/share/tracker | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | machine-id | ||
33 | net none | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix | ||
43 | seccomp | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private-bin bijiben | ||
49 | # private-cache -- access to .cache/tracker is required | ||
50 | private-dev | ||
51 | private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload | ||
52 | private-tmp | ||
53 | |||
54 | dbus-user filter | ||
55 | dbus-user.own org.gnome.Notes | ||
56 | dbus-user.talk ca.desrt.dconf | ||
57 | dbus-user.talk org.freedesktop.Tracker1 | ||
58 | dbus-system none | ||
diff --git a/etc/bitcoin-qt.profile b/etc/profile-a-l/bitcoin-qt.profile index ac1e21ba7..3a3f2b62c 100644 --- a/etc/bitcoin-qt.profile +++ b/etc/profile-a-l/bitcoin-qt.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | mkdir ${HOME}/.bitcoin | 20 | mkdir ${HOME}/.bitcoin |
20 | mkdir ${HOME}/.config/Bitcoin | 21 | mkdir ${HOME}/.config/Bitcoin |
diff --git a/etc/bitlbee.profile b/etc/profile-a-l/bitlbee.profile index 62eeb88f3..62eeb88f3 100644 --- a/etc/bitlbee.profile +++ b/etc/profile-a-l/bitlbee.profile | |||
diff --git a/etc/bitwarden.profile b/etc/profile-a-l/bitwarden.profile index a5538bacc..41f8e51fd 100644 --- a/etc/bitwarden.profile +++ b/etc/profile-a-l/bitwarden.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/Bitwarden | 22 | mkdir ${HOME}/.config/Bitwarden |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | machine-id | 30 | machine-id |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | #nodbus - breaks appindicator (tray) functionality | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -39,7 +39,7 @@ notv | |||
39 | nou2f | 39 | nou2f |
40 | novideo | 40 | novideo |
41 | protocol unix,inet,inet6,netlink | 41 | protocol unix,inet,inet6,netlink |
42 | seccomp | 42 | seccomp !chroot |
43 | shell none | 43 | shell none |
44 | #tracelog - breaks on Arch | 44 | #tracelog - breaks on Arch |
45 | 45 | ||
@@ -51,4 +51,8 @@ private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,nsswitch.co | |||
51 | private-opt Bitwarden | 51 | private-opt Bitwarden |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | # breaks appindicator (tray) functionality | ||
55 | # dbus-user none | ||
56 | # dbus-system none | ||
57 | |||
54 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 58 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/blackbox.profile b/etc/profile-a-l/blackbox.profile index 13e83493d..13e83493d 100644 --- a/etc/blackbox.profile +++ b/etc/profile-a-l/blackbox.profile | |||
diff --git a/etc/bleachbit.profile b/etc/profile-a-l/bleachbit.profile index 47c0cfa48..8f230a413 100644 --- a/etc/bleachbit.profile +++ b/etc/profile-a-l/bleachbit.profile | |||
@@ -20,7 +20,6 @@ include disable-passwdmgr.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -36,5 +35,8 @@ shell none | |||
36 | private-dev | 35 | private-dev |
37 | # private-tmp | 36 | # private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
40 | |||
39 | # memory-deny-write-execute breaks some systems, see issue #1850 | 41 | # memory-deny-write-execute breaks some systems, see issue #1850 |
40 | # memory-deny-write-execute | 42 | # memory-deny-write-execute |
diff --git a/etc/blender-2.8.profile b/etc/profile-a-l/blender-2.8.profile index b7242c443..b7242c443 100644 --- a/etc/blender-2.8.profile +++ b/etc/profile-a-l/blender-2.8.profile | |||
diff --git a/etc/blender.profile b/etc/profile-a-l/blender.profile index 6a72fb602..0f80f0a63 100644 --- a/etc/blender.profile +++ b/etc/profile-a-l/blender.profile | |||
@@ -33,9 +33,8 @@ noroot | |||
33 | notv | 33 | notv |
34 | nou2f | 34 | nou2f |
35 | protocol unix,inet,inet6,netlink | 35 | protocol unix,inet,inet6,netlink |
36 | seccomp | 36 | # numpy, used by many add-ons, requires the mbind syscall |
37 | seccomp !mbind | ||
37 | shell none | 38 | shell none |
38 | 39 | ||
39 | private-dev | 40 | private-dev |
40 | private-tmp | ||
41 | |||
diff --git a/etc/bless.profile b/etc/profile-a-l/bless.profile index 35235962e..216e86109 100644 --- a/etc/bless.profile +++ b/etc/profile-a-l/bless.profile | |||
@@ -20,7 +20,6 @@ include whitelist-var-common.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -39,3 +38,5 @@ private-dev | |||
39 | private-etc alternatives,fonts,mono | 38 | private-etc alternatives,fonts,mono |
40 | private-tmp | 39 | private-tmp |
41 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/profile-a-l/blobwars.profile b/etc/profile-a-l/blobwars.profile new file mode 100644 index 000000000..d43a9d241 --- /dev/null +++ b/etc/profile-a-l/blobwars.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for blobwars | ||
2 | # Description: Mission and Objective based 2D Platform Game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include blobwars.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.parallelrealities/blobwars | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.parallelrealities/blobwars | ||
21 | whitelist ${HOME}/.parallelrealities/blobwars | ||
22 | whitelist /usr/share/blobwars | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,netlink | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin blobwars | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc machine-id | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/bluefish.profile b/etc/profile-a-l/bluefish.profile index 412088ba9..88ac9c0ed 100644 --- a/etc/bluefish.profile +++ b/etc/profile-a-l/bluefish.profile | |||
@@ -15,10 +15,10 @@ include disable-programs.inc | |||
15 | 15 | ||
16 | include whitelist-var-common.inc | 16 | include whitelist-var-common.inc |
17 | 17 | ||
18 | apparmor | ||
18 | caps.drop all | 19 | caps.drop all |
19 | net none | 20 | net none |
20 | no3d | 21 | no3d |
21 | nodbus | ||
22 | nodvd | 22 | nodvd |
23 | nogroups | 23 | nogroups |
24 | nonewprivs | 24 | nonewprivs |
@@ -36,3 +36,5 @@ private-bin bluefish | |||
36 | private-dev | 36 | private-dev |
37 | private-tmp | 37 | private-tmp |
38 | 38 | ||
39 | dbus-user none | ||
40 | dbus-system none | ||
diff --git a/etc/bnox.profile b/etc/profile-a-l/bnox.profile index 031f3f4bd..031f3f4bd 100644 --- a/etc/bnox.profile +++ b/etc/profile-a-l/bnox.profile | |||
diff --git a/etc/brackets.profile b/etc/profile-a-l/brackets.profile index 70f62813e..70f62813e 100644 --- a/etc/brackets.profile +++ b/etc/profile-a-l/brackets.profile | |||
diff --git a/etc/brasero.profile b/etc/profile-a-l/brasero.profile index 67fc07afb..417a6b3e0 100644 --- a/etc/brasero.profile +++ b/etc/profile-a-l/brasero.profile | |||
@@ -15,6 +15,9 @@ include disable-interpreters.inc | |||
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
18 | caps.drop all | 21 | caps.drop all |
19 | net none | 22 | net none |
20 | nogroups | 23 | nogroups |
diff --git a/etc/brave-browser-beta.profile b/etc/profile-a-l/brave-browser-beta.profile index 528a6402d..528a6402d 100644 --- a/etc/brave-browser-beta.profile +++ b/etc/profile-a-l/brave-browser-beta.profile | |||
diff --git a/etc/brave-browser-dev.profile b/etc/profile-a-l/brave-browser-dev.profile index 4601de119..4601de119 100644 --- a/etc/brave-browser-dev.profile +++ b/etc/profile-a-l/brave-browser-dev.profile | |||
diff --git a/etc/brave-browser-nightly.profile b/etc/profile-a-l/brave-browser-nightly.profile index 43d3cc724..43d3cc724 100644 --- a/etc/brave-browser-nightly.profile +++ b/etc/profile-a-l/brave-browser-nightly.profile | |||
diff --git a/etc/brave-browser-stable.profile b/etc/profile-a-l/brave-browser-stable.profile index 06d33dea4..06d33dea4 100644 --- a/etc/brave-browser-stable.profile +++ b/etc/profile-a-l/brave-browser-stable.profile | |||
diff --git a/etc/brave-browser.profile b/etc/profile-a-l/brave-browser.profile index e223ecf87..e223ecf87 100644 --- a/etc/brave-browser.profile +++ b/etc/profile-a-l/brave-browser.profile | |||
diff --git a/etc/brave.profile b/etc/profile-a-l/brave.profile index 35c59f5a3..35c59f5a3 100644 --- a/etc/brave.profile +++ b/etc/profile-a-l/brave.profile | |||
diff --git a/etc/bsdcat.profile b/etc/profile-a-l/bsdcat.profile index 5271ee5d6..5271ee5d6 100644 --- a/etc/bsdcat.profile +++ b/etc/profile-a-l/bsdcat.profile | |||
diff --git a/etc/bsdcpio.profile b/etc/profile-a-l/bsdcpio.profile index 5271ee5d6..5271ee5d6 100644 --- a/etc/bsdcpio.profile +++ b/etc/profile-a-l/bsdcpio.profile | |||
diff --git a/etc/bsdtar.profile b/etc/profile-a-l/bsdtar.profile index 5ce9b6406..08e51f3c1 100644 --- a/etc/bsdtar.profile +++ b/etc/profile-a-l/bsdtar.profile | |||
@@ -22,7 +22,6 @@ ipc-namespace | |||
22 | machine-id | 22 | machine-id |
23 | net none | 23 | net none |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -43,4 +42,7 @@ private-cache | |||
43 | private-dev | 42 | private-dev |
44 | private-etc alternatives,group,localtime,passwd | 43 | private-etc alternatives,group,localtime,passwd |
45 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
47 | |||
46 | memory-deny-write-execute | 48 | memory-deny-write-execute |
diff --git a/etc/bunzip2.profile b/etc/profile-a-l/bunzip2.profile index 37b47c2ce..37b47c2ce 100644 --- a/etc/bunzip2.profile +++ b/etc/profile-a-l/bunzip2.profile | |||
diff --git a/etc/bzcat.profile b/etc/profile-a-l/bzcat.profile index edefb6bb8..edefb6bb8 100644 --- a/etc/bzcat.profile +++ b/etc/profile-a-l/bzcat.profile | |||
diff --git a/etc/bzflag.profile b/etc/profile-a-l/bzflag.profile index 86ab73e0b..f06bead1e 100644 --- a/etc/bzflag.profile +++ b/etc/profile-a-l/bzflag.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.bzf | 20 | mkdir ${HOME}/.bzf |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin bzadmin,bzflag,bzflag-wrapper,bzfs | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/bzip2.profile b/etc/profile-a-l/bzip2.profile index 0756e0537..0756e0537 100644 --- a/etc/bzip2.profile +++ b/etc/profile-a-l/bzip2.profile | |||
diff --git a/etc/profile-a-l/caja.profile b/etc/profile-a-l/caja.profile new file mode 100644 index 000000000..1af102ca8 --- /dev/null +++ b/etc/profile-a-l/caja.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for caja | ||
2 | # Description: File manager for the MATE desktop | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include caja.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Caja is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a caja process running on MATE desktops firejail will have no effect. | ||
11 | |||
12 | # Put 'ignore noroot' in your caja.local if you use MPV+Vulkan (see issue #3012) | ||
13 | |||
14 | # Redirect | ||
15 | include file-manager-common.profile | ||
diff --git a/etc/calibre.profile b/etc/profile-a-l/calibre.profile index ad6f0aa0d..d17cfa85f 100644 --- a/etc/calibre.profile +++ b/etc/profile-a-l/calibre.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.drop all | 23 | caps.drop all |
23 | netfilter | 24 | netfilter |
24 | nodvd | 25 | nodvd |
diff --git a/etc/calligra.profile b/etc/profile-a-l/calligra.profile index 7054739c8..f4ce47018 100644 --- a/etc/calligra.profile +++ b/etc/profile-a-l/calligra.profile | |||
@@ -6,6 +6,8 @@ include calligra.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/kxmlgui5/calligra | ||
10 | |||
9 | include disable-common.inc | 11 | include disable-common.inc |
10 | include disable-devel.inc | 12 | include disable-devel.inc |
11 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
@@ -16,7 +18,6 @@ caps.drop all | |||
16 | ipc-namespace | 18 | ipc-namespace |
17 | # net none | 19 | # net none |
18 | netfilter | 20 | netfilter |
19 | # nodbus | ||
20 | nodvd | 21 | nodvd |
21 | nogroups | 22 | nogroups |
22 | nonewprivs | 23 | nonewprivs |
@@ -31,5 +32,8 @@ shell none | |||
31 | private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch,kbuildsycoca4,kdeinit4 | 32 | private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch,kbuildsycoca4,kdeinit4 |
32 | private-dev | 33 | private-dev |
33 | 34 | ||
35 | # dbus-user none | ||
36 | # dbus-system none | ||
37 | |||
34 | # noexec ${HOME} | 38 | # noexec ${HOME} |
35 | noexec /tmp | 39 | noexec /tmp |
diff --git a/etc/calligraauthor.profile b/etc/profile-a-l/calligraauthor.profile index 7804a3b97..7804a3b97 100644 --- a/etc/calligraauthor.profile +++ b/etc/profile-a-l/calligraauthor.profile | |||
diff --git a/etc/calligraconverter.profile b/etc/profile-a-l/calligraconverter.profile index 7804a3b97..7804a3b97 100644 --- a/etc/calligraconverter.profile +++ b/etc/profile-a-l/calligraconverter.profile | |||
diff --git a/etc/calligraflow.profile b/etc/profile-a-l/calligraflow.profile index 7804a3b97..7804a3b97 100644 --- a/etc/calligraflow.profile +++ b/etc/profile-a-l/calligraflow.profile | |||
diff --git a/etc/calligraplan.profile b/etc/profile-a-l/calligraplan.profile index 7804a3b97..23dd61175 100644 --- a/etc/calligraplan.profile +++ b/etc/profile-a-l/calligraplan.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligraplan | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligraplanwork.profile b/etc/profile-a-l/calligraplanwork.profile index 7804a3b97..1c283a3cb 100644 --- a/etc/calligraplanwork.profile +++ b/etc/profile-a-l/calligraplanwork.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligraplanwork | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligrasheets.profile b/etc/profile-a-l/calligrasheets.profile index 7804a3b97..8ef75be71 100644 --- a/etc/calligrasheets.profile +++ b/etc/profile-a-l/calligrasheets.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligrasheets | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligrastage.profile b/etc/profile-a-l/calligrastage.profile index 7804a3b97..d5c960248 100644 --- a/etc/calligrastage.profile +++ b/etc/profile-a-l/calligrastage.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligrastage | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/calligrawords.profile b/etc/profile-a-l/calligrawords.profile index 7804a3b97..5985b4250 100644 --- a/etc/calligrawords.profile +++ b/etc/profile-a-l/calligrawords.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for calligra | 1 | # Firejail profile alias for calligra |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/calligrawords | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include calligra.profile | 7 | include calligra.profile |
diff --git a/etc/cameramonitor.profile b/etc/profile-a-l/cameramonitor.profile index 1d7aa0f9c..74c7cc34b 100644 --- a/etc/cameramonitor.profile +++ b/etc/profile-a-l/cameramonitor.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | whitelist /usr/share/cameramonitor | 23 | whitelist /usr/share/cameramonitor |
@@ -30,7 +31,6 @@ ipc-namespace | |||
30 | machine-id | 31 | machine-id |
31 | net none | 32 | net none |
32 | no3d | 33 | no3d |
33 | #nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -50,4 +50,7 @@ private-cache | |||
50 | private-etc alternatives,fonts | 50 | private-etc alternatives,fonts |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
55 | |||
53 | # memory-deny-write-execute - breaks on Arch | 56 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/cantata.profile b/etc/profile-a-l/cantata.profile index c44d56b90..294bb31b3 100644 --- a/etc/cantata.profile +++ b/etc/profile-a-l/cantata.profile | |||
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | # apparmor | 26 | # apparmor |
diff --git a/etc/catfish.profile b/etc/profile-a-l/catfish.profile index c6c2d7e8a..009d3a049 100644 --- a/etc/catfish.profile +++ b/etc/profile-a-l/catfish.profile | |||
@@ -24,10 +24,10 @@ include disable-passwdmgr.inc | |||
24 | whitelist /var/lib/mlocate | 24 | whitelist /var/lib/mlocate |
25 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
26 | 26 | ||
27 | apparmor | ||
27 | caps.drop all | 28 | caps.drop all |
28 | net none | 29 | net none |
29 | no3d | 30 | no3d |
30 | nodbus | ||
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | nonewprivs | 33 | nonewprivs |
@@ -45,3 +45,6 @@ tracelog | |||
45 | # private-bin bash,catfish,env,locate,ls,mlocate,python* | 45 | # private-bin bash,catfish,env,locate,ls,mlocate,python* |
46 | # private-dev | 46 | # private-dev |
47 | # private-tmp | 47 | # private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/profile-a-l/cawbird.profile b/etc/profile-a-l/cawbird.profile new file mode 100644 index 000000000..3d29c3817 --- /dev/null +++ b/etc/profile-a-l/cawbird.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for cawbird | ||
2 | # Description: Open-source Twitter client for Linux | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include cawbird.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/cawbird | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | apparmor | ||
21 | caps.drop all | ||
22 | machine-id | ||
23 | netfilter | ||
24 | no3d | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | nosound | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix,inet,inet6 | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | disable-mnt | ||
39 | private-bin cawbird | ||
40 | private-cache | ||
41 | private-dev | ||
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg | ||
43 | private-tmp | ||
44 | |||
45 | # dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/celluloid.profile b/etc/profile-a-l/celluloid.profile index d099ba11e..567bd912a 100644 --- a/etc/celluloid.profile +++ b/etc/profile-a-l/celluloid.profile | |||
@@ -24,13 +24,13 @@ include disable-passwdmgr.inc | |||
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-xdg.inc | 25 | include disable-xdg.inc |
26 | 26 | ||
27 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
29 | 30 | ||
30 | apparmor | 31 | apparmor |
31 | caps.drop all | 32 | caps.drop all |
32 | netfilter | 33 | netfilter |
33 | # nodbus -- uses dconf, MPRIS | ||
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
36 | noroot | 36 | noroot |
@@ -46,5 +46,10 @@ private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3 | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user filter | ||
50 | dbus-user.own io.github.celluloid_player.Celluloid | ||
51 | dbus-user.talk org.gnome.SettingsDaemon.MediaKeys | ||
52 | dbus-system none | ||
53 | |||
49 | read-only ${HOME} | 54 | read-only ${HOME} |
50 | read-write ${HOME}/.config/celluloid | 55 | read-write ${HOME}/.config/celluloid |
diff --git a/etc/checkbashisms.profile b/etc/profile-a-l/checkbashisms.profile index e15131dca..93f61091b 100644 --- a/etc/checkbashisms.profile +++ b/etc/profile-a-l/checkbashisms.profile | |||
@@ -32,7 +32,6 @@ ipc-namespace | |||
32 | machine-id | 32 | machine-id |
33 | net none | 33 | net none |
34 | no3d | 34 | no3d |
35 | nodbus | ||
36 | nodvd | 35 | nodvd |
37 | nogroups | 36 | nogroups |
38 | nonewprivs | 37 | nonewprivs |
@@ -51,4 +50,7 @@ private-dev | |||
51 | private-lib libfreebl3.so,perl* | 50 | private-lib libfreebl3.so,perl* |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
54 | memory-deny-write-execute | 56 | memory-deny-write-execute |
diff --git a/etc/cheese.profile b/etc/profile-a-l/cheese.profile index 633928260..337117c4a 100644 --- a/etc/cheese.profile +++ b/etc/profile-a-l/cheese.profile | |||
@@ -26,7 +26,6 @@ apparmor | |||
26 | caps.drop all | 26 | caps.drop all |
27 | machine-id | 27 | machine-id |
28 | net none | 28 | net none |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -43,3 +42,6 @@ private-bin cheese | |||
43 | private-cache | 42 | private-cache |
44 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0 | 43 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0 |
45 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/cherrytree.profile b/etc/profile-a-l/cherrytree.profile index 70dea5bd9..70dea5bd9 100644 --- a/etc/cherrytree.profile +++ b/etc/profile-a-l/cherrytree.profile | |||
diff --git a/etc/chromium-browser.profile b/etc/profile-a-l/chromium-browser.profile index f83052d9a..f83052d9a 100644 --- a/etc/chromium-browser.profile +++ b/etc/profile-a-l/chromium-browser.profile | |||
diff --git a/etc/chromium-common.profile b/etc/profile-a-l/chromium-common.profile index c54fb0e19..899400d25 100644 --- a/etc/chromium-common.profile +++ b/etc/profile-a-l/chromium-common.profile | |||
@@ -29,7 +29,6 @@ include whitelist-var-common.inc | |||
29 | apparmor | 29 | apparmor |
30 | caps.keep sys_admin,sys_chroot | 30 | caps.keep sys_admin,sys_chroot |
31 | netfilter | 31 | netfilter |
32 | # nodbus - prevents access to passwords saved in GNOME Keyring and KWallet, also breaks Gnome connector | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | notv | 34 | notv |
@@ -40,5 +39,9 @@ disable-mnt | |||
40 | ?BROWSER_DISABLE_U2F: private-dev | 39 | ?BROWSER_DISABLE_U2F: private-dev |
41 | # private-tmp - problems with multiple browser sessions | 40 | # private-tmp - problems with multiple browser sessions |
42 | 41 | ||
42 | # prevents access to passwords saved in GNOME Keyring and KWallet, also breaks Gnome connector | ||
43 | # dbus-user none | ||
44 | dbus-system none | ||
45 | |||
43 | # the file dialog needs to work without d-bus | 46 | # the file dialog needs to work without d-bus |
44 | ?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1 | 47 | ?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1 |
diff --git a/etc/chromium.profile b/etc/profile-a-l/chromium.profile index dab9ce449..dab9ce449 100644 --- a/etc/chromium.profile +++ b/etc/profile-a-l/chromium.profile | |||
diff --git a/etc/cin.profile b/etc/profile-a-l/cin.profile index efeb9cd14..8c3fb42d1 100644 --- a/etc/cin.profile +++ b/etc/profile-a-l/cin.profile | |||
@@ -17,7 +17,6 @@ include disable-programs.inc | |||
17 | caps.drop all | 17 | caps.drop all |
18 | ipc-namespace | 18 | ipc-namespace |
19 | net none | 19 | net none |
20 | nodbus | ||
21 | nodvd | 20 | nodvd |
22 | #nogroups | 21 | #nogroups |
23 | nonewprivs | 22 | nonewprivs |
@@ -34,3 +33,5 @@ shell none | |||
34 | private-cache | 33 | private-cache |
35 | private-dev | 34 | private-dev |
36 | 35 | ||
36 | dbus-user none | ||
37 | dbus-system none | ||
diff --git a/etc/cinelerra.profile b/etc/profile-a-l/cinelerra.profile index 88a65037e..88a65037e 100644 --- a/etc/cinelerra.profile +++ b/etc/profile-a-l/cinelerra.profile | |||
diff --git a/etc/clamav.profile b/etc/profile-a-l/clamav.profile index 51bc58108..2726ab5af 100644 --- a/etc/clamav.profile +++ b/etc/profile-a-l/clamav.profile | |||
@@ -15,7 +15,6 @@ caps.drop all | |||
15 | ipc-namespace | 15 | ipc-namespace |
16 | net none | 16 | net none |
17 | no3d | 17 | no3d |
18 | nodbus | ||
19 | nodvd | 18 | nodvd |
20 | nogroups | 19 | nogroups |
21 | nonewprivs | 20 | nonewprivs |
@@ -31,6 +30,10 @@ tracelog | |||
31 | x11 none | 30 | x11 none |
32 | 31 | ||
33 | private-dev | 32 | private-dev |
33 | |||
34 | dbus-user none | ||
35 | dbus-system none | ||
36 | |||
34 | read-only ${HOME} | 37 | read-only ${HOME} |
35 | 38 | ||
36 | memory-deny-write-execute | 39 | memory-deny-write-execute |
diff --git a/etc/clamdscan.profile b/etc/profile-a-l/clamdscan.profile index 4c6c56c5f..4c6c56c5f 100644 --- a/etc/clamdscan.profile +++ b/etc/profile-a-l/clamdscan.profile | |||
diff --git a/etc/clamdtop.profile b/etc/profile-a-l/clamdtop.profile index 4c6c56c5f..4c6c56c5f 100644 --- a/etc/clamdtop.profile +++ b/etc/profile-a-l/clamdtop.profile | |||
diff --git a/etc/clamscan.profile b/etc/profile-a-l/clamscan.profile index 4c6c56c5f..4c6c56c5f 100644 --- a/etc/clamscan.profile +++ b/etc/profile-a-l/clamscan.profile | |||
diff --git a/etc/clamtk.profile b/etc/profile-a-l/clamtk.profile index bc09808cb..4425a2bd0 100644 --- a/etc/clamtk.profile +++ b/etc/profile-a-l/clamtk.profile | |||
@@ -11,7 +11,6 @@ caps.drop all | |||
11 | ipc-namespace | 11 | ipc-namespace |
12 | net none | 12 | net none |
13 | no3d | 13 | no3d |
14 | nodbus | ||
15 | nodvd | 14 | nodvd |
16 | nogroups | 15 | nogroups |
17 | nonewprivs | 16 | nonewprivs |
@@ -25,3 +24,6 @@ seccomp | |||
25 | shell none | 24 | shell none |
26 | 25 | ||
27 | private-dev | 26 | private-dev |
27 | |||
28 | dbus-user none | ||
29 | dbus-system none | ||
diff --git a/etc/claws-mail.profile b/etc/profile-a-l/claws-mail.profile index 24954b2d8..24954b2d8 100644 --- a/etc/claws-mail.profile +++ b/etc/profile-a-l/claws-mail.profile | |||
diff --git a/etc/clawsker.profile b/etc/profile-a-l/clawsker.profile index 07db86c92..12ce47401 100644 --- a/etc/clawsker.profile +++ b/etc/profile-a-l/clawsker.profile | |||
@@ -29,7 +29,6 @@ apparmor | |||
29 | caps.drop all | 29 | caps.drop all |
30 | net none | 30 | net none |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,4 +49,7 @@ private-etc alternatives,fonts | |||
50 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* | 49 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 55 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/clementine.profile b/etc/profile-a-l/clementine.profile index 4d92157d0..4d92157d0 100644 --- a/etc/clementine.profile +++ b/etc/profile-a-l/clementine.profile | |||
diff --git a/etc/clion.profile b/etc/profile-a-l/clion.profile index b27d93684..b27d93684 100644 --- a/etc/clion.profile +++ b/etc/profile-a-l/clion.profile | |||
diff --git a/etc/clipgrab.profile b/etc/profile-a-l/clipgrab.profile index 786d1c866..dace5e83e 100644 --- a/etc/clipgrab.profile +++ b/etc/profile-a-l/clipgrab.profile | |||
@@ -25,8 +25,6 @@ apparmor | |||
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | netfilter | 27 | netfilter |
28 | # Breaks tray-icon, uncommend or add to clipgrab.local if you don't need it. | ||
29 | #nodbus | ||
30 | nodvd | 28 | nodvd |
31 | nogroups | 29 | nogroups |
32 | nonewprivs | 30 | nonewprivs |
@@ -43,3 +41,7 @@ disable-mnt | |||
43 | private-cache | 41 | private-cache |
44 | private-dev | 42 | private-dev |
45 | private-tmp | 43 | private-tmp |
44 | |||
45 | # Breaks tray icon, uncomment or add to clipgrab.local if you don't need it | ||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
diff --git a/etc/clipit.profile b/etc/profile-a-l/clipit.profile index 66b5fc859..66b5fc859 100644 --- a/etc/clipit.profile +++ b/etc/profile-a-l/clipit.profile | |||
diff --git a/etc/cliqz.profile b/etc/profile-a-l/cliqz.profile index d0b8cc0ef..d0b8cc0ef 100644 --- a/etc/cliqz.profile +++ b/etc/profile-a-l/cliqz.profile | |||
diff --git a/etc/clocks.profile b/etc/profile-a-l/clocks.profile index da50e7d49..da50e7d49 100644 --- a/etc/clocks.profile +++ b/etc/profile-a-l/clocks.profile | |||
diff --git a/etc/cmus.profile b/etc/profile-a-l/cmus.profile index fa1e5d722..bcd557787 100644 --- a/etc/cmus.profile +++ b/etc/profile-a-l/cmus.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/code-oss.profile b/etc/profile-a-l/code-oss.profile index 6d45d5994..6d45d5994 100644 --- a/etc/code-oss.profile +++ b/etc/profile-a-l/code-oss.profile | |||
diff --git a/etc/code.profile b/etc/profile-a-l/code.profile index 6f8a25211..6f8a25211 100644 --- a/etc/code.profile +++ b/etc/profile-a-l/code.profile | |||
diff --git a/etc/profile-a-l/com.github.dahenson.agenda.profile b/etc/profile-a-l/com.github.dahenson.agenda.profile new file mode 100644 index 000000000..77b6c7bd8 --- /dev/null +++ b/etc/profile-a-l/com.github.dahenson.agenda.profile | |||
@@ -0,0 +1,66 @@ | |||
1 | # Firejail profile for com.github.dahenson.agenda | ||
2 | # Description: Simple, fast, no-nonsense to-do (task) list | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include com.github.dahenson.agenda.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/agenda | ||
10 | noblacklist ${HOME}/.config/agenda | ||
11 | noblacklist ${HOME}/.local/share/agenda | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/agenda | ||
23 | mkdir ${HOME}/.config/agenda | ||
24 | mkdir ${HOME}/.local/share/agenda | ||
25 | whitelist ${HOME}/.cache/agenda | ||
26 | whitelist ${HOME}/.config/agenda | ||
27 | whitelist ${HOME}/.local/share/agenda | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | machine-id | ||
36 | net none | ||
37 | no3d | ||
38 | nodvd | ||
39 | nogroups | ||
40 | nonewprivs | ||
41 | noroot | ||
42 | nosound | ||
43 | notv | ||
44 | nou2f | ||
45 | novideo | ||
46 | protocol unix | ||
47 | seccomp | ||
48 | shell none | ||
49 | tracelog | ||
50 | |||
51 | disable-mnt | ||
52 | private-bin com.github.dahenson.agenda | ||
53 | private-cache | ||
54 | private-dev | ||
55 | private-etc dconf,fonts,gtk-3.0 | ||
56 | private-tmp | ||
57 | |||
58 | dbus-user filter | ||
59 | dbus-user.own com.github.dahenson.agenda | ||
60 | dbus-user.talk ca.desrt.dconf | ||
61 | dbus-system none | ||
62 | |||
63 | read-only ${HOME} | ||
64 | read-write ${HOME}/.cache/agenda | ||
65 | read-write ${HOME}/.config/agenda | ||
66 | read-write ${HOME}/.local/share/agenda | ||
diff --git a/etc/com.github.johnfactotum.Foliate.profile b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile index 39a9a360d..c1800fe4c 100644 --- a/etc/com.github.johnfactotum.Foliate.profile +++ b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.cache/com.github.johnfactotum.Foliate | 25 | mkdir ${HOME}/.cache/com.github.johnfactotum.Foliate |
diff --git a/etc/profile-a-l/com.gitlab.newsflash.profile b/etc/profile-a-l/com.gitlab.newsflash.profile new file mode 100644 index 000000000..0628d3d01 --- /dev/null +++ b/etc/profile-a-l/com.gitlab.newsflash.profile | |||
@@ -0,0 +1,5 @@ | |||
1 | # Firejail profile alias for newsflash | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Redirect | ||
5 | include newsflash.profile | ||
diff --git a/etc/conkeror.profile b/etc/profile-a-l/conkeror.profile index 38edf0d21..38edf0d21 100644 --- a/etc/conkeror.profile +++ b/etc/profile-a-l/conkeror.profile | |||
diff --git a/etc/conky.profile b/etc/profile-a-l/conky.profile index 10a243cd3..e5cd7085a 100644 --- a/etc/conky.profile +++ b/etc/profile-a-l/conky.profile | |||
@@ -8,6 +8,9 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${PICTURES} | 9 | noblacklist ${PICTURES} |
10 | 10 | ||
11 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
12 | include allow-lua.inc | ||
13 | |||
11 | include disable-common.inc | 14 | include disable-common.inc |
12 | include disable-devel.inc | 15 | include disable-devel.inc |
13 | include disable-exec.inc | 16 | include disable-exec.inc |
diff --git a/etc/conplay.profile b/etc/profile-a-l/conplay.profile index 8d9f3324f..8d9f3324f 100644 --- a/etc/conplay.profile +++ b/etc/profile-a-l/conplay.profile | |||
diff --git a/etc/corebird.profile b/etc/profile-a-l/corebird.profile index dbb043c17..e9a2c9441 100644 --- a/etc/corebird.profile +++ b/etc/profile-a-l/corebird.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
diff --git a/etc/cower.profile b/etc/profile-a-l/cower.profile index 8efe48240..0ab5a7f78 100644 --- a/etc/cower.profile +++ b/etc/profile-a-l/cower.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | # This profile could be significantly strengthened by adding the following to cower.local | 22 | # This profile could be significantly strengthened by adding the following to cower.local |
diff --git a/etc/cpio.profile b/etc/profile-a-l/cpio.profile index 1156b7439..087a5b2bb 100644 --- a/etc/cpio.profile +++ b/etc/profile-a-l/cpio.profile | |||
@@ -25,7 +25,6 @@ ipc-namespace | |||
25 | machine-id | 25 | machine-id |
26 | net none | 26 | net none |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -41,4 +40,7 @@ x11 none | |||
41 | private-cache | 40 | private-cache |
42 | private-dev | 41 | private-dev |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
45 | |||
44 | memory-deny-write-execute | 46 | memory-deny-write-execute |
diff --git a/etc/crawl-tiles.profile b/etc/profile-a-l/crawl-tiles.profile index 39151865e..39151865e 100644 --- a/etc/crawl-tiles.profile +++ b/etc/profile-a-l/crawl-tiles.profile | |||
diff --git a/etc/crawl.profile b/etc/profile-a-l/crawl.profile index af78ac738..3da2413d9 100644 --- a/etc/crawl.profile +++ b/etc/profile-a-l/crawl.profile | |||
@@ -25,7 +25,6 @@ caps.drop all | |||
25 | ipc-namespace | 25 | ipc-namespace |
26 | net none | 26 | net none |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -43,3 +42,6 @@ private-bin crawl,crawl-tiles | |||
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/crow.profile b/etc/profile-a-l/crow.profile index 755b6e9f8..db4be7679 100644 --- a/etc/crow.profile +++ b/etc/profile-a-l/crow.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | include whitelist-common.inc | 23 | include whitelist-common.inc |
diff --git a/etc/cryptocat.profile b/etc/profile-a-l/cryptocat.profile index 69aa39de2..69aa39de2 100644 --- a/etc/cryptocat.profile +++ b/etc/profile-a-l/cryptocat.profile | |||
diff --git a/etc/curl.profile b/etc/profile-a-l/curl.profile index 3f93e5f7e..996ff51d3 100644 --- a/etc/curl.profile +++ b/etc/profile-a-l/curl.profile | |||
@@ -10,6 +10,8 @@ include globals.local | |||
10 | noblacklist ${HOME}/.curlrc | 10 | noblacklist ${HOME}/.curlrc |
11 | 11 | ||
12 | blacklist /tmp/.X11-unix | 12 | blacklist /tmp/.X11-unix |
13 | blacklist ${RUNUSER}/wayland-* | ||
14 | blacklist ${RUNUSER} | ||
13 | 15 | ||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-exec.inc | 17 | include disable-exec.inc |
@@ -19,13 +21,14 @@ include disable-programs.inc | |||
19 | #include disable-xdg.inc | 21 | #include disable-xdg.inc |
20 | 22 | ||
21 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | ||
22 | 25 | ||
26 | apparmor | ||
23 | caps.drop all | 27 | caps.drop all |
24 | ipc-namespace | 28 | ipc-namespace |
25 | machine-id | 29 | machine-id |
26 | netfilter | 30 | netfilter |
27 | no3d | 31 | no3d |
28 | nodbus | ||
29 | nodvd | 32 | nodvd |
30 | nogroups | 33 | nogroups |
31 | nonewprivs | 34 | nonewprivs |
@@ -44,3 +47,6 @@ private-cache | |||
44 | private-dev | 47 | private-dev |
45 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 48 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl |
46 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/cvlc.profile b/etc/profile-a-l/cvlc.profile index 56c0d965c..56c0d965c 100644 --- a/etc/cvlc.profile +++ b/etc/profile-a-l/cvlc.profile | |||
diff --git a/etc/cyberfox.profile b/etc/profile-a-l/cyberfox.profile index d1fff0004..d1fff0004 100644 --- a/etc/cyberfox.profile +++ b/etc/profile-a-l/cyberfox.profile | |||
diff --git a/etc/d-feet.profile b/etc/profile-a-l/d-feet.profile index 897bf5f5d..7e622799a 100644 --- a/etc/d-feet.profile +++ b/etc/profile-a-l/d-feet.profile | |||
@@ -18,12 +18,14 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.config/d-feet | 24 | mkdir ${HOME}/.config/d-feet |
24 | whitelist ${HOME}/.config/d-feet | 25 | whitelist ${HOME}/.config/d-feet |
25 | whitelist /usr/share/d-feet | 26 | whitelist /usr/share/d-feet |
26 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
29 | 31 | ||
diff --git a/etc/darktable.profile b/etc/profile-a-l/darktable.profile index 2a71ad11c..2a71ad11c 100644 --- a/etc/darktable.profile +++ b/etc/profile-a-l/darktable.profile | |||
diff --git a/etc/dconf-editor.profile b/etc/profile-a-l/dconf-editor.profile index a9d25128f..d6541850d 100644 --- a/etc/dconf-editor.profile +++ b/etc/profile-a-l/dconf-editor.profile | |||
@@ -12,10 +12,12 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist ${HOME}/.local/share/glib-2.0 | 18 | whitelist ${HOME}/.local/share/glib-2.0 |
18 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
21 | 23 | ||
@@ -43,3 +45,8 @@ private-dev | |||
43 | private-etc alternatives,dconf,fonts,gtk-3.0,machine-id | 45 | private-etc alternatives,dconf,fonts,gtk-3.0,machine-id |
44 | private-lib | 46 | private-lib |
45 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user filter | ||
50 | dbus-user.own ca.desrt.dconf-editor | ||
51 | dbus-user.talk ca.desrt.dconf | ||
52 | dbus-system none | ||
diff --git a/etc/dconf.profile b/etc/profile-a-l/dconf.profile index ea19b2209..ea19b2209 100644 --- a/etc/dconf.profile +++ b/etc/profile-a-l/dconf.profile | |||
diff --git a/etc/ddgtk.profile b/etc/profile-a-l/ddgtk.profile index 3dfc657bc..5b95b74be 100644 --- a/etc/ddgtk.profile +++ b/etc/profile-a-l/ddgtk.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | net none | 31 | net none |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -50,4 +49,7 @@ private-cache | |||
50 | private-etc alternatives,fonts | 49 | private-etc alternatives,fonts |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | # memory-deny-write-execute - breaks on Arch | 55 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/deadbeef.profile b/etc/profile-a-l/deadbeef.profile index 8e67d9daa..8e67d9daa 100644 --- a/etc/deadbeef.profile +++ b/etc/profile-a-l/deadbeef.profile | |||
diff --git a/etc/default.profile b/etc/profile-a-l/default.profile index 95a6e8095..74314cf92 100644 --- a/etc/default.profile +++ b/etc/profile-a-l/default.profile | |||
@@ -16,6 +16,11 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | # include disable-xdg.inc | 17 | # include disable-xdg.inc |
18 | 18 | ||
19 | # include whitelist-common.inc | ||
20 | # include whitelist-usr-share-common.inc | ||
21 | # include whitelist-runuser-common.inc | ||
22 | # include whitelist-var-common.inc | ||
23 | |||
19 | # apparmor | 24 | # apparmor |
20 | caps.drop all | 25 | caps.drop all |
21 | # ipc-namespace | 26 | # ipc-namespace |
@@ -23,7 +28,6 @@ caps.drop all | |||
23 | # net none | 28 | # net none |
24 | netfilter | 29 | netfilter |
25 | # no3d | 30 | # no3d |
26 | # nodbus | ||
27 | # nodvd | 31 | # nodvd |
28 | # nogroups | 32 | # nogroups |
29 | nonewprivs | 33 | nonewprivs |
@@ -42,8 +46,14 @@ seccomp | |||
42 | # private-bin program | 46 | # private-bin program |
43 | # private-cache | 47 | # private-cache |
44 | # private-dev | 48 | # private-dev |
45 | # private-etc alternatives | 49 | # see /usr/share/doc/firejail/profile.template for more common private-etc paths. |
50 | # private-etc alternatives,fonts,machine-id | ||
46 | # private-lib | 51 | # private-lib |
52 | # private-opt none | ||
47 | # private-tmp | 53 | # private-tmp |
48 | 54 | ||
55 | # dbus-user none | ||
56 | # dbus-system none | ||
57 | |||
49 | # memory-deny-write-execute | 58 | # memory-deny-write-execute |
59 | # read-only ${HOME} | ||
diff --git a/etc/deluge.profile b/etc/profile-a-l/deluge.profile index 8f4f9fbe9..17c5059f5 100644 --- a/etc/deluge.profile +++ b/etc/profile-a-l/deluge.profile | |||
@@ -14,6 +14,7 @@ include allow-python3.inc | |||
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | # include disable-devel.inc | 16 | # include disable-devel.inc |
17 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
@@ -24,6 +25,7 @@ whitelist ${HOME}/.config/deluge | |||
24 | include whitelist-common.inc | 25 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
28 | apparmor | ||
27 | caps.drop all | 29 | caps.drop all |
28 | machine-id | 30 | machine-id |
29 | netfilter | 31 | netfilter |
diff --git a/etc/desktopeditors.profile b/etc/profile-a-l/desktopeditors.profile index d0c727c5c..9a98c4933 100644 --- a/etc/desktopeditors.profile +++ b/etc/profile-a-l/desktopeditors.profile | |||
@@ -24,7 +24,6 @@ apparmor | |||
24 | caps.drop all | 24 | caps.drop all |
25 | ipc-namespace | 25 | ipc-namespace |
26 | netfilter | 26 | netfilter |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -41,3 +40,6 @@ private-bin desktopeditors,sh | |||
41 | private-cache | 40 | private-cache |
42 | private-dev | 41 | private-dev |
43 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/devhelp.profile b/etc/profile-a-l/devhelp.profile index cc9553e73..b8b07469d 100644 --- a/etc/devhelp.profile +++ b/etc/profile-a-l/devhelp.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | whitelist /usr/share/devhelp | 19 | whitelist /usr/share/devhelp |
@@ -24,7 +25,6 @@ include whitelist-usr-share-common.inc | |||
24 | apparmor | 25 | apparmor |
25 | caps.drop all | 26 | caps.drop all |
26 | # net none - makes settings immutable | 27 | # net none - makes settings immutable |
27 | # nodbus - makes settings immutable | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -45,6 +45,10 @@ private-dev | |||
45 | private-etc alternatives,dconf,fonts,ld.so.cache,machine-id,ssl | 45 | private-etc alternatives,dconf,fonts,ld.so.cache,machine-id,ssl |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # makes settings immutable | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
48 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
49 | 53 | ||
50 | read-only ${HOME} | 54 | read-only ${HOME} |
diff --git a/etc/devilspie.profile b/etc/profile-a-l/devilspie.profile index b561787d8..1ab10a6f6 100644 --- a/etc/devilspie.profile +++ b/etc/profile-a-l/devilspie.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | net none | 31 | net none |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -53,6 +52,9 @@ private-etc alternatives | |||
53 | private-lib gconv | 52 | private-lib gconv |
54 | private-tmp | 53 | private-tmp |
55 | 54 | ||
55 | dbus-user none | ||
56 | dbus-system none | ||
57 | |||
56 | memory-deny-write-execute | 58 | memory-deny-write-execute |
57 | 59 | ||
58 | read-only ${HOME} | 60 | read-only ${HOME} |
diff --git a/etc/devilspie2.profile b/etc/profile-a-l/devilspie2.profile index 9eab3f536..9eab3f536 100644 --- a/etc/devilspie2.profile +++ b/etc/profile-a-l/devilspie2.profile | |||
diff --git a/etc/dex2jar.profile b/etc/profile-a-l/dex2jar.profile index e5f37b06a..7a59c5d73 100644 --- a/etc/dex2jar.profile +++ b/etc/profile-a-l/dex2jar.profile | |||
@@ -22,7 +22,6 @@ include whitelist-var-common.inc | |||
22 | caps.drop all | 22 | caps.drop all |
23 | net none | 23 | net none |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -39,3 +38,5 @@ private-bin bash,dex2jar,dirname,expr,grep,java,ls,sh,uname | |||
39 | private-cache | 38 | private-cache |
40 | private-dev | 39 | private-dev |
41 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/dia.profile b/etc/profile-a-l/dia.profile index bd79797b7..52bf1c7f8 100644 --- a/etc/dia.profile +++ b/etc/profile-a-l/dia.profile | |||
@@ -19,10 +19,12 @@ include disable-passwdmgr.inc | |||
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
22 | caps.drop all | 25 | caps.drop all |
23 | net none | 26 | net none |
24 | no3d | 27 | no3d |
25 | nodbus | ||
26 | nodvd | 28 | nodvd |
27 | nogroups | 29 | nogroups |
28 | nonewprivs | 30 | nonewprivs |
@@ -41,3 +43,5 @@ private-cache | |||
41 | private-dev | 43 | private-dev |
42 | private-tmp | 44 | private-tmp |
43 | 45 | ||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/dig.profile b/etc/profile-a-l/dig.profile index 054e4891d..152dfd980 100644 --- a/etc/dig.profile +++ b/etc/profile-a-l/dig.profile | |||
@@ -8,8 +8,11 @@ include dig.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.digrc | 10 | noblacklist ${HOME}/.digrc |
11 | noblacklist ${PATH}/dig | ||
11 | 12 | ||
12 | blacklist /tmp/.X11-unix | 13 | blacklist /tmp/.X11-unix |
14 | blacklist ${RUNUSER}/wayland-* | ||
15 | blacklist ${RUNUSER} | ||
13 | 16 | ||
14 | include disable-common.inc | 17 | include disable-common.inc |
15 | # include disable-devel.inc | 18 | # include disable-devel.inc |
@@ -25,12 +28,12 @@ include whitelist-common.inc | |||
25 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
27 | 30 | ||
31 | apparmor | ||
28 | caps.drop all | 32 | caps.drop all |
29 | ipc-namespace | 33 | ipc-namespace |
30 | machine-id | 34 | machine-id |
31 | netfilter | 35 | netfilter |
32 | no3d | 36 | no3d |
33 | nodbus | ||
34 | nodvd | 37 | nodvd |
35 | nogroups | 38 | nogroups |
36 | nonewprivs | 39 | nonewprivs |
@@ -45,12 +48,13 @@ shell none | |||
45 | tracelog | 48 | tracelog |
46 | 49 | ||
47 | disable-mnt | 50 | disable-mnt |
48 | private | ||
49 | private-bin bash,dig,sh | 51 | private-bin bash,dig,sh |
50 | private-cache | ||
51 | private-dev | 52 | private-dev |
52 | # Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038) | 53 | # Uncomment the next line (or put 'private-lib' in your dig.local) on non Debian/Ubuntu OS (see issue #3038) |
53 | #private-lib | 54 | #private-lib |
54 | private-tmp | 55 | private-tmp |
55 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
59 | |||
56 | memory-deny-write-execute | 60 | memory-deny-write-execute |
diff --git a/etc/digikam.profile b/etc/profile-a-l/digikam.profile index e66434444..ae4a63c62 100644 --- a/etc/digikam.profile +++ b/etc/profile-a-l/digikam.profile | |||
@@ -25,7 +25,6 @@ include whitelist-var-common.inc | |||
25 | apparmor | 25 | apparmor |
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | # nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -39,3 +38,6 @@ shell none | |||
39 | # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device | 38 | # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device |
40 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 39 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl |
41 | private-tmp | 40 | private-tmp |
41 | |||
42 | # dbus-user none | ||
43 | # dbus-system none | ||
diff --git a/etc/dillo.profile b/etc/profile-a-l/dillo.profile index 7103d0285..7103d0285 100644 --- a/etc/dillo.profile +++ b/etc/profile-a-l/dillo.profile | |||
diff --git a/etc/profile-a-l/dino-im.profile b/etc/profile-a-l/dino-im.profile new file mode 100644 index 000000000..ae0549d3e --- /dev/null +++ b/etc/profile-a-l/dino-im.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for dino-im | ||
2 | # Description: Modern XMPP Chat Client using GTK+/Vala, Ubuntu specific bin name | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include dino-im.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | # Add Ubuntu specific binary name | ||
11 | private-bin dino-im | ||
12 | |||
13 | # Redirect | ||
14 | include dino.profile | ||
diff --git a/etc/dino.profile b/etc/profile-a-l/dino.profile index 82ddf2819..d06ca042e 100644 --- a/etc/dino.profile +++ b/etc/profile-a-l/dino.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.local/share/dino | 19 | mkdir ${HOME}/.local/share/dino |
19 | whitelist ${HOME}/.local/share/dino | 20 | whitelist ${HOME}/.local/share/dino |
diff --git a/etc/discord-canary.profile b/etc/profile-a-l/discord-canary.profile index 3e9dacd1e..3e9dacd1e 100644 --- a/etc/discord-canary.profile +++ b/etc/profile-a-l/discord-canary.profile | |||
diff --git a/etc/discord-common.profile b/etc/profile-a-l/discord-common.profile index a6e730937..35bea4aaa 100644 --- a/etc/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -6,12 +6,17 @@ include discord-common.local | |||
6 | # added by caller profile | 6 | # added by caller profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | ignore noexec ${HOME} | ||
10 | |||
9 | include disable-common.inc | 11 | include disable-common.inc |
10 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
11 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
12 | include disable-programs.inc | 15 | include disable-programs.inc |
13 | 16 | ||
14 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
18 | whitelist ${HOME}/.config/BetterDiscord | ||
19 | whitelist ${HOME}/.local/share/betterdiscordctl | ||
15 | include whitelist-common.inc | 20 | include whitelist-common.inc |
16 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
17 | 22 | ||
@@ -25,11 +30,9 @@ notv | |||
25 | nou2f | 30 | nou2f |
26 | novideo | 31 | novideo |
27 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
28 | seccomp | 33 | seccomp !chroot |
29 | 34 | ||
30 | private-bin bash,cut,echo,egrep,grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh | 35 | private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh |
31 | private-dev | 36 | private-dev |
32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl |
33 | private-tmp | 38 | private-tmp |
34 | |||
35 | noexec /tmp | ||
diff --git a/etc/discord.profile b/etc/profile-a-l/discord.profile index 8ef02a30f..8ef02a30f 100644 --- a/etc/discord.profile +++ b/etc/profile-a-l/discord.profile | |||
diff --git a/etc/display.profile b/etc/profile-a-l/display.profile index 9e976c11a..9de634da9 100644 --- a/etc/display.profile +++ b/etc/profile-a-l/display.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | 25 | ||
25 | caps.drop all | 26 | caps.drop all |
26 | net none | 27 | net none |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-dev | |||
42 | # On Debian-based systems, display is a symlink in /etc/alternatives | 42 | # On Debian-based systems, display is a symlink in /etc/alternatives |
43 | private-etc alternatives | 43 | private-etc alternatives |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/dnox.profile b/etc/profile-a-l/dnox.profile index e02395771..e02395771 100644 --- a/etc/dnox.profile +++ b/etc/profile-a-l/dnox.profile | |||
diff --git a/etc/dnscrypt-proxy.profile b/etc/profile-a-l/dnscrypt-proxy.profile index 6637b8d02..e48e9d1ac 100644 --- a/etc/dnscrypt-proxy.profile +++ b/etc/profile-a-l/dnscrypt-proxy.profile | |||
@@ -31,7 +31,6 @@ ipc-namespace | |||
31 | machine-id | 31 | machine-id |
32 | netfilter | 32 | netfilter |
33 | no3d | 33 | no3d |
34 | nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nonewprivs | 35 | nonewprivs |
37 | nosound | 36 | nosound |
@@ -48,5 +47,8 @@ private | |||
48 | private-cache | 47 | private-cache |
49 | private-dev | 48 | private-dev |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | # mdwe can break modules/plugins | 53 | # mdwe can break modules/plugins |
52 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/dnsmasq.profile b/etc/profile-a-l/dnsmasq.profile index 6db71bd49..6db71bd49 100644 --- a/etc/dnsmasq.profile +++ b/etc/profile-a-l/dnsmasq.profile | |||
diff --git a/etc/profile-a-l/dolphin.profile b/etc/profile-a-l/dolphin.profile new file mode 100644 index 000000000..e0300a577 --- /dev/null +++ b/etc/profile-a-l/dolphin.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for dolphin | ||
2 | # Description: File manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include dolphin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your dolphin.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
13 | |||
14 | join-or-start dolphin | ||
diff --git a/etc/dooble-qt4.profile b/etc/profile-a-l/dooble-qt4.profile index 70a21e11c..70a21e11c 100644 --- a/etc/dooble-qt4.profile +++ b/etc/profile-a-l/dooble-qt4.profile | |||
diff --git a/etc/dooble.profile b/etc/profile-a-l/dooble.profile index bc197b223..bc197b223 100644 --- a/etc/dooble.profile +++ b/etc/profile-a-l/dooble.profile | |||
diff --git a/etc/dosbox.profile b/etc/profile-a-l/dosbox.profile index 17ccc9b9a..11b9a4f42 100644 --- a/etc/dosbox.profile +++ b/etc/profile-a-l/dosbox.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
diff --git a/etc/dragon.profile b/etc/profile-a-l/dragon.profile index df839cc47..d355cd121 100644 --- a/etc/dragon.profile +++ b/etc/profile-a-l/dragon.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | whitelist /usr/share/dragonplayer | 22 | whitelist /usr/share/dragonplayer |
diff --git a/etc/drawio.profile b/etc/profile-a-l/drawio.profile index d4fd735a1..4d723c8aa 100644 --- a/etc/drawio.profile +++ b/etc/profile-a-l/drawio.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/draw.io | 20 | mkdir ${HOME}/.config/draw.io |
@@ -28,7 +29,6 @@ caps.drop all | |||
28 | ipc-namespace | 29 | ipc-namespace |
29 | machine-id | 30 | machine-id |
30 | net none | 31 | net none |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -48,4 +48,7 @@ private-dev | |||
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
51 | # memory-deny-write-execute - breaks on Arch | 54 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/dropbox.profile b/etc/profile-a-l/dropbox.profile index 1b242d422..1b242d422 100644 --- a/etc/dropbox.profile +++ b/etc/profile-a-l/dropbox.profile | |||
diff --git a/etc/easystroke.profile b/etc/profile-a-l/easystroke.profile index 1297f5f40..bb711b1bf 100644 --- a/etc/easystroke.profile +++ b/etc/profile-a-l/easystroke.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | machine-id | 27 | machine-id |
28 | net none | 28 | net none |
29 | no3d | 29 | no3d |
30 | # nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -51,4 +50,7 @@ private-etc alternatives,fonts,group,passwd | |||
51 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 50 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
55 | |||
54 | memory-deny-write-execute | 56 | memory-deny-write-execute |
diff --git a/etc/ebook-viewer.profile b/etc/profile-a-l/ebook-viewer.profile index 29cb87a62..706aec737 100644 --- a/etc/ebook-viewer.profile +++ b/etc/profile-a-l/ebook-viewer.profile | |||
@@ -4,7 +4,8 @@ | |||
4 | include ebook-viewer.local | 4 | include ebook-viewer.local |
5 | 5 | ||
6 | net none | 6 | net none |
7 | nodbus | 7 | dbus-user none |
8 | dbus-system none | ||
8 | 9 | ||
9 | # Redirect | 10 | # Redirect |
10 | include calibre.profile | 11 | include calibre.profile |
diff --git a/etc/electron-mail.profile b/etc/profile-a-l/electron-mail.profile index bde8978df..39366470f 100644 --- a/etc/electron-mail.profile +++ b/etc/profile-a-l/electron-mail.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/electron-mail | 22 | mkdir ${HOME}/.config/electron-mail |
@@ -29,7 +30,6 @@ apparmor | |||
29 | caps.drop all | 30 | caps.drop all |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | # nodbus - breaks tray functionality | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -49,4 +49,8 @@ private-etc alternatives,fonts | |||
49 | private-opt ElectronMail | 49 | private-opt ElectronMail |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # breaks tray functionality | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
55 | |||
52 | # memory-deny-write-execute - breaks on Arch | 56 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/electron.profile b/etc/profile-a-l/electron.profile index c24100f17..9b99c7ffb 100644 --- a/etc/electron.profile +++ b/etc/profile-a-l/electron.profile | |||
@@ -15,7 +15,6 @@ whitelist ${DOWNLOADS} | |||
15 | apparmor | 15 | apparmor |
16 | caps.drop all | 16 | caps.drop all |
17 | netfilter | 17 | netfilter |
18 | nodbus | ||
19 | nodvd | 18 | nodvd |
20 | nogroups | 19 | nogroups |
21 | nonewprivs | 20 | nonewprivs |
@@ -23,3 +22,6 @@ noroot | |||
23 | notv | 22 | notv |
24 | protocol unix,inet,inet6,netlink | 23 | protocol unix,inet,inet6,netlink |
25 | seccomp | 24 | seccomp |
25 | |||
26 | dbus-user none | ||
27 | dbus-system none | ||
diff --git a/etc/electrum.profile b/etc/profile-a-l/electrum.profile index c9f50f12a..73c19f380 100644 --- a/etc/electrum.profile +++ b/etc/profile-a-l/electrum.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.electrum | 24 | mkdir ${HOME}/.electrum |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | ipc-namespace | 30 | ipc-namespace |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | #nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -50,3 +50,5 @@ private-dev | |||
50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,machine-id,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,machine-id,pki,resolv.conf,ssl |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile new file mode 100644 index 000000000..c1aa821e3 --- /dev/null +++ b/etc/profile-a-l/element-desktop.profile | |||
@@ -0,0 +1,22 @@ | |||
1 | # Firejail profile for element-desktop | ||
2 | # Description: All-in-one secure chat app for teams, friends and organisations | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include element-desktop.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.config/Element | ||
11 | noblacklist ${HOME}/.config/Element (Riot) | ||
12 | |||
13 | mkdir ${HOME}/.config/Element | ||
14 | mkdir ${HOME}/.config/Element (Riot) | ||
15 | whitelist ${HOME}/.config/Element | ||
16 | whitelist ${HOME}/.config/Element (Riot) | ||
17 | whitelist /opt/Element | ||
18 | |||
19 | private-opt Element | ||
20 | |||
21 | # Redirect | ||
22 | include riot-desktop.profile | ||
diff --git a/etc/elinks.profile b/etc/profile-a-l/elinks.profile index 82d1ba528..2a306d704 100644 --- a/etc/elinks.profile +++ b/etc/profile-a-l/elinks.profile | |||
@@ -18,6 +18,8 @@ include disable-passwdmgr.inc | |||
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | ||
22 | |||
21 | caps.drop all | 23 | caps.drop all |
22 | netfilter | 24 | netfilter |
23 | no3d | 25 | no3d |
diff --git a/etc/emacs.profile b/etc/profile-a-l/emacs.profile index ab378105e..226237b5b 100644 --- a/etc/emacs.profile +++ b/etc/profile-a-l/emacs.profile | |||
@@ -29,3 +29,6 @@ notv | |||
29 | novideo | 29 | novideo |
30 | protocol unix,inet,inet6 | 30 | protocol unix,inet,inet6 |
31 | seccomp | 31 | seccomp |
32 | |||
33 | read-write ${HOME}/.emacs | ||
34 | read-write ${HOME}/.emacs.d | ||
diff --git a/etc/email-common.profile b/etc/profile-a-l/email-common.profile index f9d96858b..67af04267 100644 --- a/etc/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -63,6 +63,8 @@ read-only ${HOME}/.config/mimeapps.list | |||
63 | writable-run-user | 63 | writable-run-user |
64 | 64 | ||
65 | # If you want to read local mail stored in /var/mail, add the following to email-common.local: | 65 | # If you want to read local mail stored in /var/mail, add the following to email-common.local: |
66 | # whitelist /var/mail | 66 | #noblacklist /var/mail |
67 | # whitelist /var/spool/mail | 67 | #noblacklist /var/spool/mail |
68 | # writable-var | 68 | #whitelist /var/mail |
69 | #whitelist /var/spool/mail | ||
70 | #writable-var | ||
diff --git a/etc/empathy.profile b/etc/profile-a-l/empathy.profile index 5ca640d30..5ca640d30 100644 --- a/etc/empathy.profile +++ b/etc/profile-a-l/empathy.profile | |||
diff --git a/etc/enchant-2.profile b/etc/profile-a-l/enchant-2.profile index 32cc0e691..32cc0e691 100644 --- a/etc/enchant-2.profile +++ b/etc/profile-a-l/enchant-2.profile | |||
diff --git a/etc/enchant-lsmod-2.profile b/etc/profile-a-l/enchant-lsmod-2.profile index a7199955e..a7199955e 100644 --- a/etc/enchant-lsmod-2.profile +++ b/etc/profile-a-l/enchant-lsmod-2.profile | |||
diff --git a/etc/enchant-lsmod.profile b/etc/profile-a-l/enchant-lsmod.profile index ba4353d15..ba4353d15 100644 --- a/etc/enchant-lsmod.profile +++ b/etc/profile-a-l/enchant-lsmod.profile | |||
diff --git a/etc/enchant.profile b/etc/profile-a-l/enchant.profile index fa556c7d2..2b5de799f 100644 --- a/etc/enchant.profile +++ b/etc/profile-a-l/enchant.profile | |||
@@ -21,6 +21,7 @@ include disable-xdg.inc | |||
21 | mkdir ${HOME}/.config/enchant | 21 | mkdir ${HOME}/.config/enchant |
22 | whitelist ${HOME}/.config/enchant | 22 | whitelist ${HOME}/.config/enchant |
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
@@ -30,7 +31,6 @@ ipc-namespace | |||
30 | machine-id | 31 | machine-id |
31 | net none | 32 | net none |
32 | no3d | 33 | no3d |
33 | nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -52,4 +52,7 @@ private-etc alternatives | |||
52 | private-lib | 52 | private-lib |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-user none | ||
56 | dbus-system none | ||
57 | |||
55 | memory-deny-write-execute | 58 | memory-deny-write-execute |
diff --git a/etc/engrampa.profile b/etc/profile-a-l/engrampa.profile index aaf3e3382..6c0892c56 100644 --- a/etc/engrampa.profile +++ b/etc/profile-a-l/engrampa.profile | |||
@@ -19,7 +19,6 @@ apparmor | |||
19 | caps.drop all | 19 | caps.drop all |
20 | net none | 20 | net none |
21 | no3d | 21 | no3d |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -37,4 +36,7 @@ tracelog | |||
37 | private-dev | 36 | private-dev |
38 | # private-tmp | 37 | # private-tmp |
39 | 38 | ||
39 | dbus-user none | ||
40 | dbus-system none | ||
41 | |||
40 | memory-deny-write-execute | 42 | memory-deny-write-execute |
diff --git a/etc/enox.profile b/etc/profile-a-l/enox.profile index d8ac8b24a..d8ac8b24a 100644 --- a/etc/enox.profile +++ b/etc/profile-a-l/enox.profile | |||
diff --git a/etc/enpass.profile b/etc/profile-a-l/enpass.profile index 68113e294..68113e294 100644 --- a/etc/enpass.profile +++ b/etc/profile-a-l/enpass.profile | |||
diff --git a/etc/eo-common.profile b/etc/profile-a-l/eo-common.profile index 13f498c03..80c704c6b 100644 --- a/etc/eo-common.profile +++ b/etc/profile-a-l/eo-common.profile | |||
@@ -18,6 +18,7 @@ include disable-interpreters.inc | |||
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
diff --git a/etc/eog.profile b/etc/profile-a-l/eog.profile index 6690b33ca..0d0153fc2 100644 --- a/etc/eog.profile +++ b/etc/profile-a-l/eog.profile | |||
@@ -15,5 +15,10 @@ whitelist /usr/share/eog | |||
15 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local | 15 | # or put 'ignore private-bin', 'ignore private-etc' and 'ignore private-lib' in your eog.local |
16 | private-bin eog | 16 | private-bin eog |
17 | 17 | ||
18 | dbus-user filter | ||
19 | dbus-user.own org.gnome.eog | ||
20 | dbus-user.talk ca.desrt.dconf | ||
21 | dbus-system none | ||
22 | |||
18 | # Redirect | 23 | # Redirect |
19 | include eo-common.profile | 24 | include eo-common.profile |
diff --git a/etc/eom.profile b/etc/profile-a-l/eom.profile index 5bfeb8c8f..5bfeb8c8f 100644 --- a/etc/eom.profile +++ b/etc/profile-a-l/eom.profile | |||
diff --git a/etc/ephemeral.profile b/etc/profile-a-l/ephemeral.profile index c688c2324..029f613c6 100644 --- a/etc/ephemeral.profile +++ b/etc/profile-a-l/ephemeral.profile | |||
@@ -39,8 +39,6 @@ caps.drop all | |||
39 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. | 39 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. |
40 | #machine-id | 40 | #machine-id |
41 | netfilter | 41 | netfilter |
42 | # nodbus breaks preferences | ||
43 | #nodbus | ||
44 | nodvd | 42 | nodvd |
45 | nogroups | 43 | nogroups |
46 | nonewprivs | 44 | nonewprivs |
@@ -59,3 +57,7 @@ private-cache | |||
59 | # private-etc below works fine on most distributions. There are some problems on CentOS. | 57 | # private-etc below works fine on most distributions. There are some problems on CentOS. |
60 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,login.defs,machine-id,mailcap,mime.types,nsswitch.conf,os-release,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 58 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,login.defs,machine-id,mailcap,mime.types,nsswitch.conf,os-release,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
61 | private-tmp | 59 | private-tmp |
60 | |||
61 | # breaks preferences | ||
62 | # dbus-user none | ||
63 | # dbus-system none | ||
diff --git a/etc/epiphany.profile b/etc/profile-a-l/epiphany.profile index 225811226..225811226 100644 --- a/etc/epiphany.profile +++ b/etc/profile-a-l/epiphany.profile | |||
diff --git a/etc/et.profile b/etc/profile-a-l/et.profile index 4e70bb114..4e70bb114 100644 --- a/etc/et.profile +++ b/etc/profile-a-l/et.profile | |||
diff --git a/etc/etr.profile b/etc/profile-a-l/etr.profile index 97a43bb59..1c34335d2 100644 --- a/etc/etr.profile +++ b/etc/profile-a-l/etr.profile | |||
@@ -9,21 +9,25 @@ include globals.local | |||
9 | noblacklist ${HOME}/.etr | 9 | noblacklist ${HOME}/.etr |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | ||
12 | include disable-exec.inc | 13 | include disable-exec.inc |
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 18 | include disable-xdg.inc |
17 | 19 | ||
18 | mkdir ${HOME}/.etr | 20 | mkdir ${HOME}/.etr |
19 | whitelist ${HOME}/.etr | 21 | whitelist ${HOME}/.etr |
22 | whitelist /usr/share/etr | ||
20 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
22 | 27 | ||
23 | apparmor | 28 | apparmor |
24 | caps.drop all | 29 | caps.drop all |
25 | net none | 30 | net none |
26 | nodbus | ||
27 | nodvd | 31 | nodvd |
28 | nogroups | 32 | nogroups |
29 | nonewprivs | 33 | nonewprivs |
@@ -42,3 +46,6 @@ private-cache | |||
42 | private-dev | 46 | private-dev |
43 | # private-etc alternatives,drirc,machine-id,openal | 47 | # private-etc alternatives,drirc,machine-id,openal |
44 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/evince-previewer.profile b/etc/profile-a-l/evince-previewer.profile index 3857d6f7b..3857d6f7b 100644 --- a/etc/evince-previewer.profile +++ b/etc/profile-a-l/evince-previewer.profile | |||
diff --git a/etc/evince-thumbnailer.profile b/etc/profile-a-l/evince-thumbnailer.profile index 080a04a52..080a04a52 100644 --- a/etc/evince-thumbnailer.profile +++ b/etc/profile-a-l/evince-thumbnailer.profile | |||
diff --git a/etc/evince.profile b/etc/profile-a-l/evince.profile index 143a347e6..77a48f0ba 100644 --- a/etc/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -15,12 +15,14 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist /usr/share/doc | 21 | whitelist /usr/share/doc |
21 | whitelist /usr/share/evince | 22 | whitelist /usr/share/evince |
22 | whitelist /usr/share/poppler | 23 | whitelist /usr/share/poppler |
23 | whitelist /usr/share/tracker | 24 | whitelist /usr/share/tracker |
25 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
26 | 28 | ||
@@ -29,8 +31,6 @@ machine-id | |||
29 | # net none - breaks AppArmor on Ubuntu systems | 31 | # net none - breaks AppArmor on Ubuntu systems |
30 | netfilter | 32 | netfilter |
31 | no3d | 33 | no3d |
32 | # nodbus might break two-page-view on some systems | ||
33 | nodbus | ||
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | nonewprivs | 36 | nonewprivs |
@@ -51,3 +51,7 @@ private-etc alternatives,fonts,group,ld.so.cache,machine-id,passwd | |||
51 | # private-lib might break two-page-view on some systems | 51 | # private-lib might break two-page-view on some systems |
52 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* | 52 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* |
53 | private-tmp | 53 | private-tmp |
54 | |||
55 | # might break two-page-view on some systems | ||
56 | dbus-user none | ||
57 | dbus-system none | ||
diff --git a/etc/evolution.profile b/etc/profile-a-l/evolution.profile index 71a7a5600..422200ffe 100644 --- a/etc/evolution.profile +++ b/etc/profile-a-l/evolution.profile | |||
@@ -23,6 +23,8 @@ include disable-interpreters.inc | |||
23 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | 25 | ||
26 | include whitelist-runuser-common.inc | ||
27 | |||
26 | caps.drop all | 28 | caps.drop all |
27 | netfilter | 29 | netfilter |
28 | # no3d breaks under wayland | 30 | # no3d breaks under wayland |
@@ -41,4 +43,4 @@ shell none | |||
41 | 43 | ||
42 | private-dev | 44 | private-dev |
43 | private-tmp | 45 | private-tmp |
44 | 46 | writable-var | |
diff --git a/etc/exfalso.profile b/etc/profile-a-l/exfalso.profile index 04bafdde4..192858304 100644 --- a/etc/exfalso.profile +++ b/etc/profile-a-l/exfalso.profile | |||
@@ -22,6 +22,7 @@ include disable-exec.inc | |||
22 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
23 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
24 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-shell.inc | ||
25 | include disable-xdg.inc | 26 | include disable-xdg.inc |
26 | 27 | ||
27 | mkdir ${HOME}/.quodlibet | 28 | mkdir ${HOME}/.quodlibet |
@@ -35,7 +36,6 @@ ipc-namespace | |||
35 | machine-id | 36 | machine-id |
36 | netfilter | 37 | netfilter |
37 | no3d | 38 | no3d |
38 | nodbus | ||
39 | nodvd | 39 | nodvd |
40 | nogroups | 40 | nogroups |
41 | nonewprivs | 41 | nonewprivs |
@@ -55,4 +55,7 @@ private-etc alternatives,fonts,group,passwd | |||
55 | private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository-1.0.so.*,libgstreamer-1.0.so.*,libgtk-3.so.*,libgtksourceview-3.0.so.*,libpango-1.0.so.*,libpython*,libreadline.so.*,libsoup-2.4.so.*,libssl.so.1.*,python2*,python3* | 55 | private-lib libatk-1.0.so.*,libgdk-3.so.*,libgdk_pixbuf-2.0.so.*,libgirepository-1.0.so.*,libgstreamer-1.0.so.*,libgtk-3.so.*,libgtksourceview-3.0.so.*,libpango-1.0.so.*,libpython*,libreadline.so.*,libsoup-2.4.so.*,libssl.so.1.*,python2*,python3* |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
58 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 61 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/exiftool.profile b/etc/profile-a-l/exiftool.profile index daacbc0c7..90d8a0fc2 100644 --- a/etc/exiftool.profile +++ b/etc/profile-a-l/exiftool.profile | |||
@@ -29,7 +29,6 @@ ipc-namespace | |||
29 | machine-id | 29 | machine-id |
30 | net none | 30 | net none |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -52,4 +51,7 @@ private-dev | |||
52 | private-etc alternatives | 51 | private-etc alternatives |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
55 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/falkon.profile b/etc/profile-a-l/falkon.profile index 0024b6660..0024b6660 100644 --- a/etc/falkon.profile +++ b/etc/profile-a-l/falkon.profile | |||
diff --git a/etc/fbreader.profile b/etc/profile-a-l/fbreader.profile index 701f14dce..e9fcc2231 100644 --- a/etc/fbreader.profile +++ b/etc/profile-a-l/fbreader.profile | |||
@@ -11,15 +11,18 @@ noblacklist ${DOCUMENTS} | |||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 19 | include disable-xdg.inc |
18 | 20 | ||
19 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
20 | 22 | ||
23 | apparmor | ||
21 | caps.drop all | 24 | caps.drop all |
22 | netfilter | 25 | net none |
23 | nodvd | 26 | nodvd |
24 | nonewprivs | 27 | nonewprivs |
25 | noroot | 28 | noroot |
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile new file mode 100644 index 000000000..179540806 --- /dev/null +++ b/etc/profile-a-l/fdns.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for server | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include fdns.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist /sbin | ||
9 | noblacklist /usr/sbin | ||
10 | |||
11 | blacklist /tmp/.X11-unix | ||
12 | blacklist ${RUNUSER}/wayland-* | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | #include whitelist-usr-share-common.inc | ||
23 | #include whitelist-var-common.inc | ||
24 | |||
25 | caps.keep kill,net_bind_service,setgid,setuid,sys_admin,sys_chroot | ||
26 | ipc-namespace | ||
27 | # netfilter /etc/firejail/webserver.net | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | # noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6 | ||
38 | #seccomp | ||
39 | #shell none | ||
40 | |||
41 | disable-mnt | ||
42 | private | ||
43 | private-bin bash,fdns,sh | ||
44 | # private-cache | ||
45 | private-dev | ||
46 | private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl | ||
47 | # private-lib | ||
48 | private-tmp | ||
49 | |||
50 | memory-deny-write-execute | ||
diff --git a/etc/feedreader.profile b/etc/profile-a-l/feedreader.profile index 5a72b60ea..2abd80b06 100644 --- a/etc/feedreader.profile +++ b/etc/profile-a-l/feedreader.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.cache/feedreader | 21 | mkdir ${HOME}/.cache/feedreader |
@@ -23,6 +24,7 @@ whitelist ${HOME}/.cache/feedreader | |||
23 | whitelist ${HOME}/.local/share/feedreader | 24 | whitelist ${HOME}/.local/share/feedreader |
24 | whitelist /usr/share/feedreader | 25 | whitelist /usr/share/feedreader |
25 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
28 | 30 | ||
@@ -47,3 +49,11 @@ private-cache | |||
47 | private-dev | 49 | private-dev |
48 | private-tmp | 50 | private-tmp |
49 | 51 | ||
52 | dbus-user filter | ||
53 | dbus-user.own org.gnome.FeedReader | ||
54 | dbus-user.own org.gnome.FeedReader.ArticleView | ||
55 | dbus-user.talk org.freedesktop.secrets | ||
56 | # Enable as you need. | ||
57 | #dbus-user.talk org.freedesktop.Notifications | ||
58 | #dbus-user.talk org.gnome.OnlineAccounts | ||
59 | dbus-system none | ||
diff --git a/etc/feh.profile b/etc/profile-a-l/feh.profile index 6a8071c28..3ee07e559 100644 --- a/etc/feh.profile +++ b/etc/profile-a-l/feh.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | 16 | ||
16 | # This profile disables network access | 17 | # This profile disables network access |
17 | # In order to enable network access, | 18 | # In order to enable network access, |
@@ -21,7 +22,6 @@ include disable-programs.inc | |||
21 | caps.drop all | 22 | caps.drop all |
22 | net none | 23 | net none |
23 | no3d | 24 | no3d |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -39,3 +39,6 @@ private-cache | |||
39 | private-dev | 39 | private-dev |
40 | private-etc alternatives,feh | 40 | private-etc alternatives,feh |
41 | private-tmp | 41 | private-tmp |
42 | |||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/profile-a-l/ferdi.profile b/etc/profile-a-l/ferdi.profile new file mode 100644 index 000000000..9b4c5f114 --- /dev/null +++ b/etc/profile-a-l/ferdi.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for ferdi | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include ferdi.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | ignore noexec /tmp | ||
9 | |||
10 | noblacklist ${HOME}/.cache/Ferdi | ||
11 | noblacklist ${HOME}/.config/Ferdi | ||
12 | noblacklist ${HOME}/.pki | ||
13 | noblacklist ${HOME}/.local/share/pki | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-programs.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/Ferdi | ||
22 | mkdir ${HOME}/.config/Ferdi | ||
23 | mkdir ${HOME}/.pki | ||
24 | mkdir ${HOME}/.local/share/pki | ||
25 | whitelist ${DOWNLOADS} | ||
26 | whitelist ${HOME}/.cache/Ferdi | ||
27 | whitelist ${HOME}/.config/Ferdi | ||
28 | whitelist ${HOME}/.pki | ||
29 | whitelist ${HOME}/.local/share/pki | ||
30 | include whitelist-common.inc | ||
31 | |||
32 | caps.drop all | ||
33 | netfilter | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | notv | ||
39 | nou2f | ||
40 | protocol unix,inet,inet6,netlink | ||
41 | seccomp !chroot | ||
42 | shell none | ||
43 | |||
44 | disable-mnt | ||
45 | private-dev | ||
46 | private-tmp | ||
diff --git a/etc/fetchmail.profile b/etc/profile-a-l/fetchmail.profile index d64fe830f..d64fe830f 100644 --- a/etc/fetchmail.profile +++ b/etc/profile-a-l/fetchmail.profile | |||
diff --git a/etc/ffmpeg.profile b/etc/profile-a-l/ffmpeg.profile index b392087e8..fb5c9ee57 100644 --- a/etc/ffmpeg.profile +++ b/etc/profile-a-l/ffmpeg.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | whitelist /usr/share/devedeng | 22 | whitelist /usr/share/devedeng |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | ipc-namespace | 30 | ipc-namespace |
30 | machine-id | 31 | machine-id |
31 | netfilter | 32 | netfilter |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -50,4 +50,7 @@ private-dev | |||
50 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pkcs11,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pkcs11,pki,resolv.conf,ssl |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
53 | # memory-deny-write-execute - it breaks old versions of ffmpeg | 56 | # memory-deny-write-execute - it breaks old versions of ffmpeg |
diff --git a/etc/ffmpegthumbnailer.profile b/etc/profile-a-l/ffmpegthumbnailer.profile index 6d72c3b99..6d72c3b99 100644 --- a/etc/ffmpegthumbnailer.profile +++ b/etc/profile-a-l/ffmpegthumbnailer.profile | |||
diff --git a/etc/ffplay.profile b/etc/profile-a-l/ffplay.profile index 04134cbf4..04134cbf4 100644 --- a/etc/ffplay.profile +++ b/etc/profile-a-l/ffplay.profile | |||
diff --git a/etc/ffprobe.profile b/etc/profile-a-l/ffprobe.profile index e7c9f678d..e7c9f678d 100644 --- a/etc/ffprobe.profile +++ b/etc/profile-a-l/ffprobe.profile | |||
diff --git a/etc/profile-a-l/file-manager-common.profile b/etc/profile-a-l/file-manager-common.profile new file mode 100644 index 000000000..24339953b --- /dev/null +++ b/etc/profile-a-l/file-manager-common.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for file managers | ||
2 | # Description: Common profile for GUI file managers | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include file-manager-common.local | ||
6 | # Persistent global definitions | ||
7 | # added by caller profile | ||
8 | #include globals.local | ||
9 | |||
10 | # File managers need to be able to see everything under ${HOME} | ||
11 | # and be able to start arbitrary applications | ||
12 | |||
13 | ignore noexec ${HOME} | ||
14 | |||
15 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
16 | include allow-lua.inc | ||
17 | |||
18 | # Allow perl | ||
19 | include allow-perl.inc | ||
20 | |||
21 | # Allow python (blacklisted by disable-interpreters.inc) | ||
22 | include allow-python2.inc | ||
23 | include allow-python3.inc | ||
24 | |||
25 | #include disable-common.inc | ||
26 | include disable-devel.inc | ||
27 | include disable-exec.inc | ||
28 | include disable-interpreters.inc | ||
29 | include disable-passwdmgr.inc | ||
30 | #include disable-programs.inc | ||
31 | |||
32 | allusers | ||
33 | #apparmor | ||
34 | caps.drop all | ||
35 | #net none | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6,netlink | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | private-dev | ||
50 | |||
51 | #dbus-user none | ||
52 | #dbus-system none | ||
diff --git a/etc/file-roller.profile b/etc/profile-a-l/file-roller.profile index 253b82cfe..745b8b8e9 100644 --- a/etc/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile | |||
@@ -14,6 +14,7 @@ include disable-passwdmgr.inc | |||
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | 15 | ||
16 | whitelist /usr/share/file-roller | 16 | whitelist /usr/share/file-roller |
17 | include whitelist-runuser-common.inc | ||
17 | include whitelist-usr-share-common.inc | 18 | include whitelist-usr-share-common.inc |
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
@@ -36,8 +37,10 @@ seccomp | |||
36 | shell none | 37 | shell none |
37 | tracelog | 38 | tracelog |
38 | 39 | ||
39 | private-bin 7z,7za,7zr,ar,arj,brotli,bzip2,compress,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,rar,rzip,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,xz,zip,zoo | 40 | private-bin 7z,7za,7zr,ar,arj,bash,brotli,bzip2,compress,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,p7zip,rar,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,xz,zip,zoo |
40 | private-cache | 41 | private-cache |
41 | private-dev | 42 | private-dev |
42 | private-etc dconf,fonts,gtk-3.0,xdg | 43 | private-etc dconf,fonts,gtk-3.0,xdg |
43 | # private-tmp | 44 | # private-tmp |
45 | |||
46 | dbus-system none | ||
diff --git a/etc/file.profile b/etc/profile-a-l/file.profile index 9b21818f8..74620d4cd 100644 --- a/etc/file.profile +++ b/etc/profile-a-l/file.profile | |||
@@ -8,6 +8,7 @@ include file.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-exec.inc | 14 | include disable-exec.inc |
@@ -21,7 +22,6 @@ ipc-namespace | |||
21 | machine-id | 22 | machine-id |
22 | net none | 23 | net none |
23 | no3d | 24 | no3d |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -38,8 +38,11 @@ x11 none | |||
38 | #private-bin bzip2,file,gzip,lrzip,lz4,lzip,xz,zstd | 38 | #private-bin bzip2,file,gzip,lrzip,lz4,lzip,xz,zstd |
39 | private-cache | 39 | private-cache |
40 | private-dev | 40 | private-dev |
41 | private-etc alternatives,localtime,magic,magic.mgc | 41 | #private-etc alternatives,localtime,magic,magic.mgc |
42 | private-lib file,libarchive.so.*,libfakeroot,libmagic.so.* | 42 | #private-lib file,libarchive.so.*,libfakeroot,libmagic.so.*,libseccomp.so.* |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
43 | 46 | ||
44 | memory-deny-write-execute | 47 | memory-deny-write-execute |
45 | read-only ${HOME} | 48 | read-only ${HOME} |
diff --git a/etc/filezilla.profile b/etc/profile-a-l/filezilla.profile index d8d4c1746..6c7ab8f0d 100644 --- a/etc/filezilla.profile +++ b/etc/profile-a-l/filezilla.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | |||
21 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
21 | 23 | ||
22 | caps.drop all | 24 | caps.drop all |
diff --git a/etc/firefox-beta.profile b/etc/profile-a-l/firefox-beta.profile index fa8bbb1f5..fa8bbb1f5 100644 --- a/etc/firefox-beta.profile +++ b/etc/profile-a-l/firefox-beta.profile | |||
diff --git a/etc/firefox-common.profile b/etc/profile-a-l/firefox-common.profile index 323070289..7c343c26d 100644 --- a/etc/firefox-common.profile +++ b/etc/profile-a-l/firefox-common.profile | |||
@@ -34,9 +34,6 @@ caps.drop all | |||
34 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. | 34 | # machine-id breaks pulse audio; it should work fine in setups where sound is not required. |
35 | #machine-id | 35 | #machine-id |
36 | netfilter | 36 | netfilter |
37 | # nodbus breaks various desktop integration features | ||
38 | # among other things global menus, native notifications, Gnome connector, KDE connect and power management on KDE Plasma | ||
39 | nodbus | ||
40 | nodvd | 37 | nodvd |
41 | nogroups | 38 | nogroups |
42 | nonewprivs | 39 | nonewprivs |
@@ -56,3 +53,8 @@ disable-mnt | |||
56 | # private-etc below works fine on most distributions. There are some problems on CentOS. | 53 | # private-etc below works fine on most distributions. There are some problems on CentOS. |
57 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 54 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
58 | private-tmp | 55 | private-tmp |
56 | |||
57 | # breaks various desktop integration features | ||
58 | # among other things global menus, native notifications, Gnome connector, KDE connect and power management on KDE Plasma | ||
59 | dbus-user none | ||
60 | dbus-system none | ||
diff --git a/etc/firefox-developer-edition.profile b/etc/profile-a-l/firefox-developer-edition.profile index 8c7ca3887..8c7ca3887 100644 --- a/etc/firefox-developer-edition.profile +++ b/etc/profile-a-l/firefox-developer-edition.profile | |||
diff --git a/etc/firefox-esr.profile b/etc/profile-a-l/firefox-esr.profile index 6c1d77986..5e69fdb51 100644 --- a/etc/firefox-esr.profile +++ b/etc/profile-a-l/firefox-esr.profile | |||
@@ -6,5 +6,7 @@ include firefox-esr.local | |||
6 | # added by included profile | 6 | # added by included profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | whitelist /usr/share/firefox-esr | ||
10 | |||
9 | # Redirect | 11 | # Redirect |
10 | include firefox.profile | 12 | include firefox.profile |
diff --git a/etc/firefox-nightly.profile b/etc/profile-a-l/firefox-nightly.profile index 96d2bf898..96d2bf898 100644 --- a/etc/firefox-nightly.profile +++ b/etc/profile-a-l/firefox-nightly.profile | |||
diff --git a/etc/firefox-wayland.profile b/etc/profile-a-l/firefox-wayland.profile index 17c9f059e..17c9f059e 100644 --- a/etc/firefox-wayland.profile +++ b/etc/profile-a-l/firefox-wayland.profile | |||
diff --git a/etc/firefox-x11.profile b/etc/profile-a-l/firefox-x11.profile index ffd64aad7..ffd64aad7 100644 --- a/etc/firefox-x11.profile +++ b/etc/profile-a-l/firefox-x11.profile | |||
diff --git a/etc/firefox.profile b/etc/profile-a-l/firefox.profile index 0530516d8..337311ed8 100644 --- a/etc/firefox.profile +++ b/etc/profile-a-l/firefox.profile | |||
@@ -15,6 +15,7 @@ whitelist ${HOME}/.cache/mozilla/firefox | |||
15 | whitelist ${HOME}/.mozilla | 15 | whitelist ${HOME}/.mozilla |
16 | 16 | ||
17 | whitelist /usr/share/doc | 17 | whitelist /usr/share/doc |
18 | whitelist /usr/share/firefox | ||
18 | whitelist /usr/share/gtk-doc/html | 19 | whitelist /usr/share/gtk-doc/html |
19 | whitelist /usr/share/mozilla | 20 | whitelist /usr/share/mozilla |
20 | whitelist /usr/share/webext | 21 | whitelist /usr/share/webext |
@@ -27,5 +28,12 @@ include whitelist-usr-share-common.inc | |||
27 | # private-etc must first be enabled in firefox-common.profile | 28 | # private-etc must first be enabled in firefox-common.profile |
28 | #private-etc firefox | 29 | #private-etc firefox |
29 | 30 | ||
31 | dbus-user filter | ||
32 | dbus-user.own org.mozilla.firefox.* | ||
33 | dbus-user.own org.mpris.MediaPlayer2.firefox.* | ||
34 | # Uncomment or put in your firefox.local to enable native notifications. | ||
35 | #dbus-user.talk org.freedesktop.Notifications | ||
36 | ignore dbus-user none | ||
37 | |||
30 | # Redirect | 38 | # Redirect |
31 | include firefox-common.profile | 39 | include firefox-common.profile |
diff --git a/etc/profile-a-l/five-or-more.profile b/etc/profile-a-l/five-or-more.profile new file mode 100644 index 000000000..2c86d3ac7 --- /dev/null +++ b/etc/profile-a-l/five-or-more.profile | |||
@@ -0,0 +1,21 @@ | |||
1 | # Firejail profile for five-or-more | ||
2 | # Description: GNOME port of the once-popular Colour Lines game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include five-or-more.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/five-or-more | ||
10 | |||
11 | mkdir ${HOME}/.local/share/five-or-more | ||
12 | whitelist ${HOME}/.local/share/five-or-more | ||
13 | |||
14 | whitelist /usr/share/five-or-more | ||
15 | |||
16 | private-bin five-or-more | ||
17 | |||
18 | dbus-user.own org.gnome.five-or-more | ||
19 | |||
20 | # Redirect | ||
21 | include gnome_games-common.profile | ||
diff --git a/etc/flacsplt.profile b/etc/profile-a-l/flacsplt.profile index 2efef0f22..2efef0f22 100644 --- a/etc/flacsplt.profile +++ b/etc/profile-a-l/flacsplt.profile | |||
diff --git a/etc/flameshot.profile b/etc/profile-a-l/flameshot.profile index 3aad9723b..7c41417ec 100644 --- a/etc/flameshot.profile +++ b/etc/profile-a-l/flameshot.profile | |||
@@ -8,6 +8,7 @@ include flameshot.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | noblacklist ${PICTURES} | 10 | noblacklist ${PICTURES} |
11 | noblacklist ${HOME}/.config/Dharkael | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -15,13 +16,21 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
19 | 21 | ||
22 | #whitelist ${PICTURES} | ||
23 | #whitelist ${HOME}/.config/Dharkael | ||
24 | whitelist /usr/share/flameshot | ||
25 | #include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
20 | caps.drop all | 30 | caps.drop all |
21 | ipc-namespace | 31 | ipc-namespace |
22 | netfilter | 32 | netfilter |
23 | no3d | 33 | no3d |
24 | # nodbus | ||
25 | nodvd | 34 | nodvd |
26 | nogroups | 35 | nogroups |
27 | nonewprivs | 36 | nonewprivs |
@@ -33,11 +42,15 @@ novideo | |||
33 | protocol unix,inet,inet6 | 42 | protocol unix,inet,inet6 |
34 | seccomp | 43 | seccomp |
35 | shell none | 44 | shell none |
45 | tracelog | ||
36 | 46 | ||
37 | disable-mnt | 47 | disable-mnt |
38 | private-bin flameshot | 48 | private-bin flameshot |
39 | private-cache | 49 | private-cache |
40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,machine-id,pki,resolv.conf,ssl |
41 | private-dev | 51 | private-dev |
42 | private-tmp | 52 | private-tmp |
43 | 53 | ||
54 | dbus-user filter | ||
55 | dbus-user.own org.dharkael.Flameshot | ||
56 | dbus-system none | ||
diff --git a/etc/flashpeak-slimjet.profile b/etc/profile-a-l/flashpeak-slimjet.profile index b841bce75..b841bce75 100644 --- a/etc/flashpeak-slimjet.profile +++ b/etc/profile-a-l/flashpeak-slimjet.profile | |||
diff --git a/etc/flowblade.profile b/etc/profile-a-l/flowblade.profile index 40472ab93..40472ab93 100644 --- a/etc/flowblade.profile +++ b/etc/profile-a-l/flowblade.profile | |||
diff --git a/etc/fluxbox.profile b/etc/profile-a-l/fluxbox.profile index c296c0491..c296c0491 100644 --- a/etc/fluxbox.profile +++ b/etc/profile-a-l/fluxbox.profile | |||
diff --git a/etc/font-manager.profile b/etc/profile-a-l/font-manager.profile index ae0e32d1e..acad6ad13 100644 --- a/etc/font-manager.profile +++ b/etc/profile-a-l/font-manager.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.cache/font-manager | 25 | mkdir ${HOME}/.cache/font-manager |
diff --git a/etc/fontforge.profile b/etc/profile-a-l/fontforge.profile index 6d305e2af..6d305e2af 100644 --- a/etc/fontforge.profile +++ b/etc/profile-a-l/fontforge.profile | |||
diff --git a/etc/fossamail.profile b/etc/profile-a-l/fossamail.profile index 2d700d336..2d700d336 100644 --- a/etc/fossamail.profile +++ b/etc/profile-a-l/fossamail.profile | |||
diff --git a/etc/profile-a-l/four-in-a-row.profile b/etc/profile-a-l/four-in-a-row.profile new file mode 100644 index 000000000..eb0c43ca5 --- /dev/null +++ b/etc/profile-a-l/four-in-a-row.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for four-in-a-row | ||
2 | # Description: four-in-a-row game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include four-in-a-row.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/four-in-a-row | ||
13 | |||
14 | private-bin four-in-a-row | ||
15 | |||
16 | dbus-user.own org.gnome.Four-in-a-row | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/franz.profile b/etc/profile-a-l/franz.profile index 344804ca9..344804ca9 100644 --- a/etc/franz.profile +++ b/etc/profile-a-l/franz.profile | |||
diff --git a/etc/freecad.profile b/etc/profile-a-l/freecad.profile index 6f0f52a55..0a1d4a750 100644 --- a/etc/freecad.profile +++ b/etc/profile-a-l/freecad.profile | |||
@@ -24,7 +24,6 @@ include disable-xdg.inc | |||
24 | caps.drop all | 24 | caps.drop all |
25 | ipc-namespace | 25 | ipc-namespace |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -42,3 +41,5 @@ private-cache | |||
42 | private-dev | 41 | private-dev |
43 | private-tmp | 42 | private-tmp |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/freecadcmd.profile b/etc/profile-a-l/freecadcmd.profile index 44bf62cfe..44bf62cfe 100644 --- a/etc/freecadcmd.profile +++ b/etc/profile-a-l/freecadcmd.profile | |||
diff --git a/etc/freeciv-gtk3.profile b/etc/profile-a-l/freeciv-gtk3.profile index fa36459e7..fa36459e7 100644 --- a/etc/freeciv-gtk3.profile +++ b/etc/profile-a-l/freeciv-gtk3.profile | |||
diff --git a/etc/freeciv-mp-gtk3.profile b/etc/profile-a-l/freeciv-mp-gtk3.profile index fa36459e7..fa36459e7 100644 --- a/etc/freeciv-mp-gtk3.profile +++ b/etc/profile-a-l/freeciv-mp-gtk3.profile | |||
diff --git a/etc/freeciv.profile b/etc/profile-a-l/freeciv.profile index fa115d325..0fe933478 100644 --- a/etc/freeciv.profile +++ b/etc/profile-a-l/freeciv.profile | |||
@@ -21,10 +21,10 @@ whitelist ${HOME}/.freeciv | |||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin freeciv-gtk3,freeciv-manual,freeciv-mp-gtk3,freeciv-server | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/freecol.profile b/etc/profile-a-l/freecol.profile index baeb4c528..3cbd2ff53 100644 --- a/etc/freecol.profile +++ b/etc/profile-a-l/freecol.profile | |||
@@ -37,7 +37,6 @@ include whitelist-var-common.inc | |||
37 | caps.drop all | 37 | caps.drop all |
38 | ipc-namespace | 38 | ipc-namespace |
39 | netfilter | 39 | netfilter |
40 | nodbus | ||
41 | nodvd | 40 | nodvd |
42 | nogroups | 41 | nogroups |
43 | nonewprivs | 42 | nonewprivs |
@@ -54,3 +53,6 @@ disable-mnt | |||
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/freemind.profile b/etc/profile-a-l/freemind.profile index ba945c0fb..0ffb5c54d 100644 --- a/etc/freemind.profile +++ b/etc/profile-a-l/freemind.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | machine-id | 27 | machine-id |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -49,3 +48,6 @@ private-dev | |||
49 | private-tmp | 48 | private-tmp |
50 | private-opt none | 49 | private-opt none |
51 | private-srv none | 50 | private-srv none |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/freeoffice-planmaker.profile b/etc/profile-a-l/freeoffice-planmaker.profile index b6ca167eb..9449e7c48 100644 --- a/etc/freeoffice-planmaker.profile +++ b/etc/profile-a-l/freeoffice-planmaker.profile | |||
@@ -7,4 +7,4 @@ include freeoffice-planmaker.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/freeoffice-presentations.profile b/etc/profile-a-l/freeoffice-presentations.profile index 43661028c..636868e2e 100644 --- a/etc/freeoffice-presentations.profile +++ b/etc/profile-a-l/freeoffice-presentations.profile | |||
@@ -7,4 +7,4 @@ include freeoffice-presentations.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/freeoffice-textmaker.profile b/etc/profile-a-l/freeoffice-textmaker.profile index f7d30eaed..5d98d1cc6 100644 --- a/etc/freeoffice-textmaker.profile +++ b/etc/profile-a-l/freeoffice-textmaker.profile | |||
@@ -6,4 +6,4 @@ include freeoffice-textmaker.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Redirect | 8 | # Redirect |
9 | include softmaker-common.profile | 9 | include softmaker-common.inc |
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile new file mode 100644 index 000000000..91f0caf87 --- /dev/null +++ b/etc/profile-a-l/freetube.profile | |||
@@ -0,0 +1,31 @@ | |||
1 | # Firejail profile for freetube | ||
2 | # Description: Youtube client with local subscription feature | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include freetube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/FreeTube | ||
10 | |||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | |||
17 | mkdir ${HOME}/.config/FreeTube | ||
18 | whitelist ${HOME}/.config/FreeTube | ||
19 | |||
20 | seccomp !chroot | ||
21 | shell none | ||
22 | |||
23 | disable-mnt | ||
24 | private-bin freetube | ||
25 | private-cache | ||
26 | private-dev | ||
27 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg | ||
28 | private-tmp | ||
29 | |||
30 | # Redirect | ||
31 | include electron.profile | ||
diff --git a/etc/freshclam.profile b/etc/profile-a-l/freshclam.profile index 2bab79e2e..2bab79e2e 100644 --- a/etc/freshclam.profile +++ b/etc/profile-a-l/freshclam.profile | |||
diff --git a/etc/profile-a-l/frogatto.profile b/etc/profile-a-l/frogatto.profile new file mode 100644 index 000000000..653272499 --- /dev/null +++ b/etc/profile-a-l/frogatto.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for frogatto | ||
2 | # Description: 2D platformer game starring a quixotic frog | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include frogatto.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.frogatto | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.frogatto | ||
20 | whitelist ${HOME}/.frogatto | ||
21 | whitelist /usr/share/frogatto | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin frogatto,sh | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc machine-id | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/frozen-bubble.profile b/etc/profile-a-l/frozen-bubble.profile index 6cef181c8..9245ae3a9 100644 --- a/etc/frozen-bubble.profile +++ b/etc/profile-a-l/frozen-bubble.profile | |||
@@ -13,18 +13,23 @@ include allow-perl.inc | |||
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | ||
19 | 21 | ||
20 | mkdir ${HOME}/.frozen-bubble | 22 | mkdir ${HOME}/.frozen-bubble |
21 | whitelist ${HOME}/.frozen-bubble | 23 | whitelist ${HOME}/.frozen-bubble |
24 | whitelist /usr/share/perl5 | ||
22 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
24 | 29 | ||
30 | apparmor | ||
25 | caps.drop all | 31 | caps.drop all |
26 | net none | 32 | net none |
27 | nodbus | ||
28 | nodvd | 33 | nodvd |
29 | nogroups | 34 | nogroups |
30 | nonewprivs | 35 | nonewprivs |
@@ -35,8 +40,12 @@ novideo | |||
35 | protocol unix,netlink | 40 | protocol unix,netlink |
36 | seccomp | 41 | seccomp |
37 | shell none | 42 | shell none |
43 | tracelog | ||
38 | 44 | ||
39 | disable-mnt | 45 | disable-mnt |
40 | # private-bin frozen-bubble | 46 | # private-bin frozen-bubble |
41 | private-dev | 47 | private-dev |
42 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/gajim-history-manager.profile b/etc/profile-a-l/gajim-history-manager.profile index 2ae6dd9d8..2ae6dd9d8 100644 --- a/etc/gajim-history-manager.profile +++ b/etc/profile-a-l/gajim-history-manager.profile | |||
diff --git a/etc/gajim.profile b/etc/profile-a-l/gajim.profile index 85d9b9bd9..85d9b9bd9 100644 --- a/etc/gajim.profile +++ b/etc/profile-a-l/gajim.profile | |||
diff --git a/etc/galculator.profile b/etc/profile-a-l/galculator.profile index f757aed69..89f20b923 100644 --- a/etc/galculator.profile +++ b/etc/profile-a-l/galculator.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/galculator | 20 | mkdir ${HOME}/.config/galculator |
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | #hostname galculator - breaks Arch Linux | 27 | #hostname galculator - breaks Arch Linux |
27 | #ipc-namespace | 28 | #ipc-namespace |
28 | net none | 29 | net none |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -47,4 +47,7 @@ private-etc alternatives,fonts | |||
47 | private-lib | 47 | private-lib |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
50 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile new file mode 100644 index 000000000..74b468020 --- /dev/null +++ b/etc/profile-a-l/gapplication.profile | |||
@@ -0,0 +1,71 @@ | |||
1 | # Firejail profile for gapplication | ||
2 | # Description: D-Bus application launcher | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gapplication.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | blacklist ${RUNUSER}/wayland-* | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-common.inc | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | ipc-namespace | ||
28 | machine-id | ||
29 | net none | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | nosound | ||
36 | notv | ||
37 | nou2f | ||
38 | novideo | ||
39 | protocol unix | ||
40 | seccomp | ||
41 | shell none | ||
42 | tracelog | ||
43 | x11 none | ||
44 | |||
45 | disable-mnt | ||
46 | private | ||
47 | private-bin gapplication | ||
48 | private-cache | ||
49 | private-dev | ||
50 | private-etc none | ||
51 | private-tmp | ||
52 | |||
53 | # Uncomment (or add to your gapplcation.local) the next line to filter D-Bus names. | ||
54 | # You might need to add additional dbus-user.talk rules. see 'gapplication list-apps'. | ||
55 | #dbus-user filter | ||
56 | dbus-user.talk org.gnome.Boxes | ||
57 | dbus-user.talk org.gnome.Builder | ||
58 | dbus-user.talk org.gnome.Calendar | ||
59 | dbus-user.talk org.gnome.ChromeGnomeShell | ||
60 | dbus-user.talk org.gnome.DejaDup | ||
61 | dbus-user.talk org.gnome.DiskUtility | ||
62 | dbus-user.talk org.gnome.Extensions | ||
63 | dbus-user.talk org.gnome.Maps | ||
64 | dbus-user.talk org.gnome.Nautilus | ||
65 | dbus-user.talk org.gnome.Shell.PortalHelper | ||
66 | dbus-user.talk org.gnome.Software | ||
67 | dbus-user.talk org.gnome.Weather | ||
68 | dbus-system none | ||
69 | |||
70 | memory-deny-write-execute | ||
71 | read-only ${HOME} | ||
diff --git a/etc/gcalccmd.profile b/etc/profile-a-l/gcalccmd.profile index 691d6b0c4..691d6b0c4 100644 --- a/etc/gcalccmd.profile +++ b/etc/profile-a-l/gcalccmd.profile | |||
diff --git a/etc/gcloud.profile b/etc/profile-a-l/gcloud.profile index 7ca99f420..46a862a21 100644 --- a/etc/gcloud.profile +++ b/etc/profile-a-l/gcloud.profile | |||
@@ -21,7 +21,6 @@ apparmor | |||
21 | caps.drop all | 21 | caps.drop all |
22 | machine-id | 22 | machine-id |
23 | netfilter | 23 | netfilter |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | # required for sudo-free docker | 25 | # required for sudo-free docker |
27 | #nogroups | 26 | #nogroups |
@@ -38,3 +37,6 @@ disable-mnt | |||
38 | private-dev | 37 | private-dev |
39 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,localtime,nsswitch.conf,pki,resolv.conf,ssl | 38 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,localtime,nsswitch.conf,pki,resolv.conf,ssl |
40 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/gconf-editor.profile b/etc/profile-a-l/gconf-editor.profile index cb39174e5..cb39174e5 100644 --- a/etc/gconf-editor.profile +++ b/etc/profile-a-l/gconf-editor.profile | |||
diff --git a/etc/gconf-merge-schema.profile b/etc/profile-a-l/gconf-merge-schema.profile index 619f801b0..619f801b0 100644 --- a/etc/gconf-merge-schema.profile +++ b/etc/profile-a-l/gconf-merge-schema.profile | |||
diff --git a/etc/gconf-merge-tree.profile b/etc/profile-a-l/gconf-merge-tree.profile index 2f6bfe5e5..2f6bfe5e5 100644 --- a/etc/gconf-merge-tree.profile +++ b/etc/profile-a-l/gconf-merge-tree.profile | |||
diff --git a/etc/gconf.profile b/etc/profile-a-l/gconf.profile index 96848575d..96848575d 100644 --- a/etc/gconf.profile +++ b/etc/profile-a-l/gconf.profile | |||
diff --git a/etc/gconfpkg.profile b/etc/profile-a-l/gconfpkg.profile index 5bfc1250a..5bfc1250a 100644 --- a/etc/gconfpkg.profile +++ b/etc/profile-a-l/gconfpkg.profile | |||
diff --git a/etc/gconftool-2.profile b/etc/profile-a-l/gconftool-2.profile index 947e4252f..947e4252f 100644 --- a/etc/gconftool-2.profile +++ b/etc/profile-a-l/gconftool-2.profile | |||
diff --git a/etc/geany.profile b/etc/profile-a-l/geany.profile index 31599e32a..31599e32a 100644 --- a/etc/geany.profile +++ b/etc/profile-a-l/geany.profile | |||
diff --git a/etc/geary.profile b/etc/profile-a-l/geary.profile index eb427c077..fa01d04b7 100644 --- a/etc/geary.profile +++ b/etc/profile-a-l/geary.profile | |||
@@ -10,7 +10,8 @@ include geary.local | |||
10 | # Users have Geary set to open a browser by clicking a link in an email | 10 | # Users have Geary set to open a browser by clicking a link in an email |
11 | # We are not allowed to blacklist browser-specific directories | 11 | # We are not allowed to blacklist browser-specific directories |
12 | 12 | ||
13 | ignore nodbus | 13 | ignore dbus-user none |
14 | ignore dbus-system none | ||
14 | ignore private-tmp | 15 | ignore private-tmp |
15 | 16 | ||
16 | noblacklist ${HOME}/.gnupg | 17 | noblacklist ${HOME}/.gnupg |
diff --git a/etc/gedit.profile b/etc/profile-a-l/gedit.profile index a4471077a..17b7ad563 100644 --- a/etc/gedit.profile +++ b/etc/profile-a-l/gedit.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | # apparmor - makes settings immutable | 25 | # apparmor - makes settings immutable |
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | machine-id | 27 | machine-id |
27 | # net none - makes settings immutable | 28 | # net none - makes settings immutable |
28 | no3d | 29 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -46,3 +46,6 @@ private-dev | |||
46 | #private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* | 46 | #private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | # makes settings immutable | ||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
diff --git a/etc/geekbench.profile b/etc/profile-a-l/geekbench.profile index 6398505ed..e06a9afad 100644 --- a/etc/geekbench.profile +++ b/etc/profile-a-l/geekbench.profile | |||
@@ -25,7 +25,6 @@ ipc-namespace | |||
25 | machine-id | 25 | machine-id |
26 | netfilter | 26 | netfilter |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -48,6 +47,9 @@ private-lib gcc/*/*/libstdc++.so.* | |||
48 | private-opt none | 47 | private-opt none |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
52 | 54 | ||
53 | read-only ${HOME} | 55 | read-only ${HOME} |
diff --git a/etc/geeqie.profile b/etc/profile-a-l/geeqie.profile index 8810ca161..8810ca161 100644 --- a/etc/geeqie.profile +++ b/etc/profile-a-l/geeqie.profile | |||
diff --git a/etc/gfeeds.profile b/etc/profile-a-l/gfeeds.profile index d332c1bbe..d97ab530b 100644 --- a/etc/gfeeds.profile +++ b/etc/profile-a-l/gfeeds.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.cache/gfeeds | 25 | mkdir ${HOME}/.cache/gfeeds |
@@ -29,6 +30,7 @@ whitelist ${HOME}/.cache/org.gabmus.gfeeds | |||
29 | whitelist ${HOME}/.config/org.gabmus.gfeeds.json | 30 | whitelist ${HOME}/.config/org.gabmus.gfeeds.json |
30 | whitelist /usr/share/gfeeds | 31 | whitelist /usr/share/gfeeds |
31 | include whitelist-common.inc | 32 | include whitelist-common.inc |
33 | include whitelist-runuser-common.inc | ||
32 | include whitelist-usr-share-common.inc | 34 | include whitelist-usr-share-common.inc |
33 | include whitelist-var-common.inc | 35 | include whitelist-var-common.inc |
34 | 36 | ||
@@ -37,7 +39,6 @@ caps.drop all | |||
37 | machine-id | 39 | machine-id |
38 | netfilter | 40 | netfilter |
39 | no3d | 41 | no3d |
40 | #nodbus | ||
41 | nodvd | 42 | nodvd |
42 | nogroups | 43 | nogroups |
43 | nonewprivs | 44 | nonewprivs |
@@ -57,3 +58,8 @@ private-bin gfeeds,python3* | |||
57 | private-dev | 58 | private-dev |
58 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,fonts,gconf,group,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg | 59 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,fonts,gconf,group,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg |
59 | private-tmp | 60 | private-tmp |
61 | |||
62 | dbus-user filter | ||
63 | dbus-user.own org.gabmus.gfeeds | ||
64 | dbus-user.talk ca.desrt.dconf | ||
65 | dbus-system none | ||
diff --git a/etc/ghb.profile b/etc/profile-a-l/ghb.profile index 1e7ce2350..1e7ce2350 100644 --- a/etc/ghb.profile +++ b/etc/profile-a-l/ghb.profile | |||
diff --git a/etc/ghostwriter.profile b/etc/profile-a-l/ghostwriter.profile index 27becf8fe..5bb410278 100644 --- a/etc/ghostwriter.profile +++ b/etc/profile-a-l/ghostwriter.profile | |||
@@ -17,13 +17,15 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | #whitelist /usr/share/ghostwriter | 23 | whitelist /usr/share/ghostwriter |
23 | #whitelist /usr/share/mozilla-dicts | 24 | whitelist /usr/share/mozilla-dicts |
24 | #whitelist /usr/share/texlive | 25 | whitelist /usr/share/texlive |
25 | #whitelist /usr/share/pandoc* | 26 | whitelist /usr/share/pandoc* |
26 | #include whitelist-usr-share-common.inc | 27 | include whitelist-runuser-common.inc |
28 | include whitelist-usr-share-common.inc | ||
27 | 29 | ||
28 | apparmor | 30 | apparmor |
29 | caps.drop all | 31 | caps.drop all |
@@ -48,3 +50,6 @@ private-dev | |||
48 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed | 50 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed |
49 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,firejail,fonts,gconf,groups,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,texlive,Trolltech.conf,X11,xdg | 51 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,firejail,fonts,gconf,groups,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,texlive,Trolltech.conf,X11,xdg |
50 | private-tmp | 52 | private-tmp |
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
diff --git a/etc/gimp-2.10.profile b/etc/profile-a-l/gimp-2.10.profile index dbf49ac22..dbf49ac22 100644 --- a/etc/gimp-2.10.profile +++ b/etc/profile-a-l/gimp-2.10.profile | |||
diff --git a/etc/gimp-2.8.profile b/etc/profile-a-l/gimp-2.8.profile index dbf49ac22..dbf49ac22 100644 --- a/etc/gimp-2.8.profile +++ b/etc/profile-a-l/gimp-2.8.profile | |||
diff --git a/etc/gimp.profile b/etc/profile-a-l/gimp.profile index 94035bc02..8093c0c39 100644 --- a/etc/gimp.profile +++ b/etc/profile-a-l/gimp.profile | |||
@@ -36,7 +36,6 @@ include whitelist-var-common.inc | |||
36 | apparmor | 36 | apparmor |
37 | caps.drop all | 37 | caps.drop all |
38 | net none | 38 | net none |
39 | nodbus | ||
40 | nodvd | 39 | nodvd |
41 | nogroups | 40 | nogroups |
42 | nonewprivs | 41 | nonewprivs |
@@ -51,3 +50,6 @@ tracelog | |||
51 | 50 | ||
52 | private-dev | 51 | private-dev |
53 | private-tmp | 52 | private-tmp |
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
diff --git a/etc/gist-paste.profile b/etc/profile-a-l/gist-paste.profile index 56b3176ed..56b3176ed 100644 --- a/etc/gist-paste.profile +++ b/etc/profile-a-l/gist-paste.profile | |||
diff --git a/etc/gist.profile b/etc/profile-a-l/gist.profile index 59fcb2775..681fc2829 100644 --- a/etc/gist.profile +++ b/etc/profile-a-l/gist.profile | |||
@@ -36,7 +36,6 @@ ipc-namespace | |||
36 | machine-id | 36 | machine-id |
37 | netfilter | 37 | netfilter |
38 | no3d | 38 | no3d |
39 | nodbus | ||
40 | nodvd | 39 | nodvd |
41 | nogroups | 40 | nogroups |
42 | nonewprivs | 41 | nonewprivs |
@@ -56,4 +55,7 @@ private-dev | |||
56 | private-etc alternatives | 55 | private-etc alternatives |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
59 | memory-deny-write-execute | 61 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/git-cola.profile b/etc/profile-a-l/git-cola.profile new file mode 100644 index 000000000..30e80f519 --- /dev/null +++ b/etc/profile-a-l/git-cola.profile | |||
@@ -0,0 +1,66 @@ | |||
1 | # Firejail profile for git-cola | ||
2 | # Description: Linux native frontend for Git | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include git-cola.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore noexec ${HOME} | ||
10 | |||
11 | noblacklist ${HOME}/.gitconfig | ||
12 | noblacklist ${HOME}/.git-credentials | ||
13 | noblacklist ${HOME}/.gnupg | ||
14 | noblacklist ${HOME}/.ssh | ||
15 | noblacklist ${HOME}/.config/git | ||
16 | noblacklist ${HOME}/.config/git-cola | ||
17 | # Put your editor,diff viewer config path below and uncomment to load settings | ||
18 | # noblacklist ${HOME}/ | ||
19 | |||
20 | include allow-python2.inc | ||
21 | include allow-python3.inc | ||
22 | |||
23 | include disable-common.inc | ||
24 | include disable-devel.inc | ||
25 | include disable-exec.inc | ||
26 | include disable-interpreters.inc | ||
27 | include disable-passwdmgr.inc | ||
28 | include disable-programs.inc | ||
29 | include disable-xdg.inc | ||
30 | |||
31 | include whitelist-runuser-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | apparmor | ||
35 | caps.drop all | ||
36 | machine-id | ||
37 | netfilter | ||
38 | no3d | ||
39 | nodvd | ||
40 | nogroups | ||
41 | nonewprivs | ||
42 | noroot | ||
43 | nosound | ||
44 | notv | ||
45 | nou2f | ||
46 | novideo | ||
47 | protocol unix,inet,inet6,netlink | ||
48 | seccomp | ||
49 | shell none | ||
50 | tracelog | ||
51 | |||
52 | # private-bin atom,bash,colordiff,emacs,fldiff,geany,gedit,git,git gui,git-cola,git-dag,gitk,gpg,gvim,leafpad,meld,mousepad,nano,notepadqq,python*,sh,ssh,vim,vimdiff,which,xed | ||
53 | private-cache | ||
54 | private-dev | ||
55 | # Comment if you sign commits with GPG | ||
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,X11,xdg | ||
57 | private-tmp | ||
58 | |||
59 | dbus-user filter | ||
60 | # Uncomment if you need keyring access | ||
61 | # dbus-user.talk org.freedesktop.secrets | ||
62 | dbus-system none | ||
63 | |||
64 | read-only ${HOME}/.ssh | ||
65 | read-only ${HOME}/.gnupg | ||
66 | read-only ${HOME}/.git-credentials | ||
diff --git a/etc/git.profile b/etc/profile-a-l/git.profile index e5a2f3985..e5a2f3985 100644 --- a/etc/git.profile +++ b/etc/profile-a-l/git.profile | |||
diff --git a/etc/gitg.profile b/etc/profile-a-l/gitg.profile index 56f8e136f..71b8e9b11 100644 --- a/etc/gitg.profile +++ b/etc/profile-a-l/gitg.profile | |||
@@ -19,7 +19,16 @@ include disable-interpreters.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | #whitelist ${HOME}/YOUR_GIT_PROJECTS_DIRECTORY | ||
23 | #whitelist ${HOME}/.config/git | ||
24 | #whitelist ${HOME}/.gitconfig | ||
25 | #whitelist ${HOME}/.git-credentials | ||
26 | #whitelist ${HOME}/.local/share/gitg | ||
27 | #whitelist ${HOME}/.ssh | ||
28 | #include whitelist-common.inc | ||
29 | |||
22 | whitelist /usr/share/gitg | 30 | whitelist /usr/share/gitg |
31 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | 32 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 33 | include whitelist-var-common.inc |
25 | 34 | ||
@@ -43,3 +52,10 @@ private-bin git,gitg,ssh | |||
43 | private-cache | 52 | private-cache |
44 | private-dev | 53 | private-dev |
45 | private-tmp | 54 | private-tmp |
55 | |||
56 | dbus-user filter | ||
57 | dbus-user.own org.gnome.gitg | ||
58 | dbus-user.talk ca.desrt.dconf | ||
59 | # Uncomment (or put in your gitg.local) if you need keyring access. | ||
60 | #dbus-user.talk org.freedesktop.secrets | ||
61 | dbus-system none | ||
diff --git a/etc/github-desktop.profile b/etc/profile-a-l/github-desktop.profile index b25b138ad..152396553 100644 --- a/etc/github-desktop.profile +++ b/etc/profile-a-l/github-desktop.profile | |||
@@ -30,7 +30,7 @@ notv | |||
30 | nou2f | 30 | nou2f |
31 | novideo | 31 | novideo |
32 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
33 | seccomp | 33 | seccomp !chroot |
34 | 34 | ||
35 | # Note: On debian-based distributions the binary might be located in | 35 | # Note: On debian-based distributions the binary might be located in |
36 | # /opt/GitHub Desktop/github-desktop, and therefore not be in PATH. | 36 | # /opt/GitHub Desktop/github-desktop, and therefore not be in PATH. |
diff --git a/etc/gitter.profile b/etc/profile-a-l/gitter.profile index 017b1765a..017b1765a 100644 --- a/etc/gitter.profile +++ b/etc/profile-a-l/gitter.profile | |||
diff --git a/etc/gjs.profile b/etc/profile-a-l/gjs.profile index 85dd57f29..9c8848b8a 100644 --- a/etc/gjs.profile +++ b/etc/profile-a-l/gjs.profile | |||
@@ -22,6 +22,7 @@ include disable-interpreters.inc | |||
22 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | 24 | ||
25 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
27 | 28 | ||
diff --git a/etc/globaltime.profile b/etc/profile-a-l/globaltime.profile index bb78a608e..bb78a608e 100644 --- a/etc/globaltime.profile +++ b/etc/profile-a-l/globaltime.profile | |||
diff --git a/etc/gmpc.profile b/etc/profile-a-l/gmpc.profile index b1546db30..b3aad8b2c 100644 --- a/etc/gmpc.profile +++ b/etc/profile-a-l/gmpc.profile | |||
@@ -30,7 +30,6 @@ caps.drop all | |||
30 | ipc-namespace | 30 | ipc-namespace |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | #nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -50,4 +49,7 @@ private-etc alternatives,fonts | |||
50 | private-tmp | 49 | private-tmp |
51 | writable-run-user | 50 | writable-run-user |
52 | 51 | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
53 | # memory-deny-write-execute - breaks on Arch | 55 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/profile-a-l/gnome-2048.profile b/etc/profile-a-l/gnome-2048.profile new file mode 100644 index 000000000..777c81dbe --- /dev/null +++ b/etc/profile-a-l/gnome-2048.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-2048 | ||
2 | # Description: Sliding tile puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-2048.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-2048 | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-2048 | ||
12 | whitelist ${HOME}/.local/share/gnome-2048 | ||
13 | |||
14 | private-bin gnome-2048 | ||
15 | |||
16 | dbus-user.own org.gnome.TwentyFortyEight | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-books.profile b/etc/profile-a-l/gnome-books.profile index 84e38d0e1..998109ca7 100644 --- a/etc/gnome-books.profile +++ b/etc/profile-a-l/gnome-books.profile | |||
@@ -23,8 +23,9 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | net none |
28 | no3d | 29 | no3d |
29 | nodvd | 30 | nodvd |
30 | nogroups | 31 | nogroups |
diff --git a/etc/gnome-builder.profile b/etc/profile-a-l/gnome-builder.profile index eaf48931d..7a684dd59 100644 --- a/etc/gnome-builder.profile +++ b/etc/profile-a-l/gnome-builder.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | ipc-namespace | 23 | ipc-namespace |
22 | netfilter | 24 | netfilter |
diff --git a/etc/gnome-calculator.profile b/etc/profile-a-l/gnome-calculator.profile index 6709a331e..ceb01f2a0 100644 --- a/etc/gnome-calculator.profile +++ b/etc/profile-a-l/gnome-calculator.profile | |||
@@ -13,9 +13,11 @@ include disable-exec.inc | |||
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
21 | 23 | ||
@@ -23,10 +25,9 @@ apparmor | |||
23 | caps.drop all | 25 | caps.drop all |
24 | ipc-namespace | 26 | ipc-namespace |
25 | machine-id | 27 | machine-id |
26 | # net none | 28 | #net none -- breaks currency conversion |
27 | netfilter | 29 | netfilter |
28 | no3d | 30 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 31 | nodvd |
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
@@ -38,6 +39,7 @@ novideo | |||
38 | protocol unix,inet,inet6 | 39 | protocol unix,inet,inet6 |
39 | seccomp | 40 | seccomp |
40 | shell none | 41 | shell none |
42 | tracelog | ||
41 | 43 | ||
42 | disable-mnt | 44 | disable-mnt |
43 | private-bin gnome-calculator | 45 | private-bin gnome-calculator |
@@ -46,4 +48,7 @@ private-dev | |||
46 | #private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.* | 48 | #private-lib gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.*,libgnutls.so.*,libproxy.so.*,librsvg-2.so.*,libxml2.so.* |
47 | private-tmp | 49 | private-tmp |
48 | 50 | ||
49 | # memory-deny-write-execute | 51 | dbus-user filter |
52 | dbus-user.own org.gnome.Calculator | ||
53 | dbus-user.talk ca.desrt.dconf | ||
54 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile new file mode 100644 index 000000000..3e815234c --- /dev/null +++ b/etc/profile-a-l/gnome-calendar.profile | |||
@@ -0,0 +1,62 @@ | |||
1 | # Firejail profile for gnome-calendar | ||
2 | # Description: Calendar for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-calendar.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/libgweather | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | netfilter | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6 | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin gnome-calendar | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,nsswitch.conf,pki,resolv.conf,ssl | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user filter | ||
51 | dbus-user.own org.gnome.Calendar | ||
52 | dbus-user.talk ca.desrt.dconf | ||
53 | dbus-user.talk org.gnome.evolution.dataserver.* | ||
54 | #dbus-user.talk org.gnome.OnlineAccounts | ||
55 | #dbus-user.talk org.gnome.ControlCenter | ||
56 | # NOTE: dbus-system none fails, filter without rules works. | ||
57 | dbus-system filter | ||
58 | #dbus-system.talk org.freedesktop.timedate1 | ||
59 | #dbus-system.talk org.freedesktop.login1 | ||
60 | #dbus-system.talk org.freedesktop.GeoClue2 | ||
61 | |||
62 | read-only ${HOME} | ||
diff --git a/etc/gnome-character-map.profile b/etc/profile-a-l/gnome-character-map.profile index 27804fdd0..27804fdd0 100644 --- a/etc/gnome-character-map.profile +++ b/etc/profile-a-l/gnome-character-map.profile | |||
diff --git a/etc/gnome-characters.profile b/etc/profile-a-l/gnome-characters.profile index 2d4724610..f4f3ae2d7 100644 --- a/etc/gnome-characters.profile +++ b/etc/profile-a-l/gnome-characters.profile | |||
@@ -15,20 +15,20 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist /usr/share/org.gnome.Characters | 21 | whitelist /usr/share/org.gnome.Characters |
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
23 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
24 | 26 | ||
27 | apparmor | ||
25 | caps.drop all | 28 | caps.drop all |
26 | machine-id | 29 | machine-id |
27 | net none | 30 | net none |
28 | no3d | 31 | no3d |
29 | # Uncomment the next line (or add it to your gnome-characters.local) | ||
30 | # if you don't need recently used chars | ||
31 | #nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -52,4 +52,9 @@ private-dev | |||
52 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,pango,X11,xdg | 52 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,pango,X11,xdg |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | # Uncomment the next lines (or add it to your gnome-characters.local) | ||
56 | # if you don't need recently used chars | ||
57 | # dbus-user none | ||
58 | # dbus-system none | ||
59 | |||
55 | read-only ${HOME} | 60 | read-only ${HOME} |
diff --git a/etc/gnome-chess.profile b/etc/profile-a-l/gnome-chess.profile index e657293ac..84a3cabd6 100644 --- a/etc/gnome-chess.profile +++ b/etc/profile-a-l/gnome-chess.profile | |||
@@ -6,6 +6,7 @@ include gnome-chess.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/gnome-chess | ||
9 | noblacklist ${HOME}/.local/share/gnome-chess | 10 | noblacklist ${HOME}/.local/share/gnome-chess |
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
@@ -14,8 +15,17 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 19 | include disable-xdg.inc |
18 | 20 | ||
21 | #mkdir ${HOME}/.local/share/gnome-chess | ||
22 | #whitelist ${HOME}/.local/share/gnome-chess | ||
23 | #include whitelist-common.inc | ||
24 | |||
25 | whitelist /usr/share/gnuchess | ||
26 | whitelist /usr/share/gnome-chess | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
19 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
20 | 30 | ||
21 | apparmor | 31 | apparmor |
diff --git a/etc/gnome-clocks.profile b/etc/profile-a-l/gnome-clocks.profile index 025335a23..fc899178f 100644 --- a/etc/gnome-clocks.profile +++ b/etc/profile-a-l/gnome-clocks.profile | |||
@@ -12,11 +12,13 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /usr/share/gnome-clocks | 18 | whitelist /usr/share/gnome-clocks |
18 | whitelist /usr/share/libgweather | 19 | whitelist /usr/share/libgweather |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
22 | 24 | ||
diff --git a/etc/gnome-contacts.profile b/etc/profile-a-l/gnome-contacts.profile index ac6d82451..7a38bdc8a 100644 --- a/etc/gnome-contacts.profile +++ b/etc/profile-a-l/gnome-contacts.profile | |||
@@ -17,11 +17,12 @@ include disable-programs.inc | |||
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | include whitelist-common.inc | 19 | include whitelist-common.inc |
20 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
22 | caps.drop all | 23 | caps.drop all |
23 | netfilter | 24 | netfilter |
24 | no3d | 25 | #no3d - breaks on Arch |
25 | nodvd | 26 | nodvd |
26 | nonewprivs | 27 | nonewprivs |
27 | noroot | 28 | noroot |
diff --git a/etc/gnome-documents.profile b/etc/profile-a-l/gnome-documents.profile index 705fe624e..705fe624e 100644 --- a/etc/gnome-documents.profile +++ b/etc/profile-a-l/gnome-documents.profile | |||
diff --git a/etc/gnome-font-viewer.profile b/etc/profile-a-l/gnome-font-viewer.profile index 468ef0401..b2327133c 100644 --- a/etc/gnome-font-viewer.profile +++ b/etc/profile-a-l/gnome-font-viewer.profile | |||
@@ -17,8 +17,9 @@ include disable-xdg.inc | |||
17 | 17 | ||
18 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
19 | 19 | ||
20 | apparmor | ||
20 | caps.drop all | 21 | caps.drop all |
21 | netfilter | 22 | net none |
22 | no3d | 23 | no3d |
23 | nodvd | 24 | nodvd |
24 | nonewprivs | 25 | nonewprivs |
diff --git a/etc/gnome-hexgl.profile b/etc/profile-a-l/gnome-hexgl.profile index 386c33d7f..5ae7bbe01 100644 --- a/etc/gnome-hexgl.profile +++ b/etc/profile-a-l/gnome-hexgl.profile | |||
@@ -12,19 +12,18 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | mkdir ${HOME}/.cache/mesa_shader_cache | 18 | mkdir ${HOME}/.cache/mesa_shader_cache |
18 | whitelist ${RUNUSER}/pulse | ||
19 | whitelist ${RUNUSER}/wayland-0 | ||
20 | whitelist /usr/share/gnome-hexgl | 19 | whitelist /usr/share/gnome-hexgl |
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -42,8 +41,11 @@ private | |||
42 | private-bin gnome-hexgl | 41 | private-bin gnome-hexgl |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc machine-id | 44 | private-etc alsa,asound.conf,machine-id,pulse |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
48 | read-only ${HOME} | 50 | read-only ${HOME} |
49 | read-write ${HOME}/.cache/mesa_shader_cache | 51 | read-write ${HOME}/.cache/mesa_shader_cache |
diff --git a/etc/gnome-keyring-3.profile b/etc/profile-a-l/gnome-keyring-3.profile index e9961e4f0..e9961e4f0 100644 --- a/etc/gnome-keyring-3.profile +++ b/etc/profile-a-l/gnome-keyring-3.profile | |||
diff --git a/etc/gnome-keyring.profile b/etc/profile-a-l/gnome-keyring.profile index 7e2d701b7..ecbb74158 100644 --- a/etc/gnome-keyring.profile +++ b/etc/profile-a-l/gnome-keyring.profile | |||
@@ -31,7 +31,6 @@ ipc-namespace | |||
31 | machine-id | 31 | machine-id |
32 | netfilter | 32 | netfilter |
33 | no3d | 33 | no3d |
34 | # nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nogroups | 35 | nogroups |
37 | nonewprivs | 36 | nonewprivs |
@@ -52,4 +51,7 @@ private-dev | |||
52 | #private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security | 51 | #private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security |
53 | private-tmp | 52 | private-tmp |
54 | 53 | ||
54 | # dbus-user none | ||
55 | # dbus-system none | ||
56 | |||
55 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/gnome-klotski.profile b/etc/profile-a-l/gnome-klotski.profile new file mode 100644 index 000000000..c67a5c0da --- /dev/null +++ b/etc/profile-a-l/gnome-klotski.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-klotski | ||
2 | # Description: Sliding block puzzles game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-klotski.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-klotski | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-klotski | ||
12 | whitelist ${HOME}/.local/share/gnome-klotski | ||
13 | |||
14 | private-bin gnome-klotski | ||
15 | |||
16 | dbus-user.own org.gnome.Klotski | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-latex.profile b/etc/profile-a-l/gnome-latex.profile index 1bf48c6ab..eb5e9ec40 100644 --- a/etc/gnome-latex.profile +++ b/etc/profile-a-l/gnome-latex.profile | |||
@@ -22,6 +22,7 @@ include disable-programs.inc | |||
22 | whitelist /usr/share/gnome-latex | 22 | whitelist /usr/share/gnome-latex |
23 | whitelist /usr/share/perl5 | 23 | whitelist /usr/share/perl5 |
24 | whitelist /usr/share/texlive | 24 | whitelist /usr/share/texlive |
25 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | # May cause issues. | 27 | # May cause issues. |
27 | #include whitelist-var-common.inc | 28 | #include whitelist-var-common.inc |
@@ -48,3 +49,5 @@ private-cache | |||
48 | private-dev | 49 | private-dev |
49 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed | 50 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed |
50 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,login.defs,passwd,texlive | 51 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,login.defs,passwd,texlive |
52 | |||
53 | dbus-system none | ||
diff --git a/etc/gnome-logs.profile b/etc/profile-a-l/gnome-logs.profile index 0c5bec144..41218d3f7 100644 --- a/etc/gnome-logs.profile +++ b/etc/profile-a-l/gnome-logs.profile | |||
@@ -12,9 +12,11 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /var/log/journal | 18 | whitelist /var/log/journal |
19 | include whitelist-runuser-common.inc | ||
18 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
20 | 22 | ||
@@ -23,7 +25,6 @@ caps.drop all | |||
23 | ipc-namespace | 25 | ipc-namespace |
24 | net none | 26 | net none |
25 | no3d | 27 | no3d |
26 | nodbus | ||
27 | nodvd | 28 | nodvd |
28 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), | 29 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), |
29 | # comment both 'nogroups' and 'noroot' | 30 | # comment both 'nogroups' and 'noroot' |
@@ -49,6 +50,9 @@ private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.s | |||
49 | private-tmp | 50 | private-tmp |
50 | writable-var-log | 51 | writable-var-log |
51 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
52 | # comment this if you export logs to a file in your ${HOME} | 56 | # comment this if you export logs to a file in your ${HOME} |
53 | # or put 'ignore read-only ${HOME}' in your gnome-logs.local. | 57 | # or put 'ignore read-only ${HOME}' in your gnome-logs.local. |
54 | read-only ${HOME} | 58 | read-only ${HOME} |
diff --git a/etc/profile-a-l/gnome-mahjongg.profile b/etc/profile-a-l/gnome-mahjongg.profile new file mode 100644 index 000000000..42409dce8 --- /dev/null +++ b/etc/profile-a-l/gnome-mahjongg.profile | |||
@@ -0,0 +1,16 @@ | |||
1 | # Firejail profile for gnome-mahjongg | ||
2 | # Description: A matching game played with Mahjongg tiles | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-mahjongg.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | whitelist /usr/share/gnome-mahjongg | ||
10 | |||
11 | private-bin gnome-mahjongg | ||
12 | |||
13 | dbus-user.own org.gnome.Mahjongg | ||
14 | |||
15 | # Redirect | ||
16 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-maps.profile b/etc/profile-a-l/gnome-maps.profile index 62350b862..eb0030dda 100644 --- a/etc/gnome-maps.profile +++ b/etc/profile-a-l/gnome-maps.profile | |||
@@ -13,7 +13,6 @@ include globals.local | |||
13 | 13 | ||
14 | noblacklist ${HOME}/.cache/champlain | 14 | noblacklist ${HOME}/.cache/champlain |
15 | noblacklist ${HOME}/.cache/org.gnome.Maps | 15 | noblacklist ${HOME}/.cache/org.gnome.Maps |
16 | noblacklist ${HOME}/.local/share/flatpak | ||
17 | noblacklist ${HOME}/.local/share/maps-places.json | 16 | noblacklist ${HOME}/.local/share/maps-places.json |
18 | 17 | ||
19 | # Allow gjs (blacklisted by disable-interpreters.inc) | 18 | # Allow gjs (blacklisted by disable-interpreters.inc) |
@@ -25,6 +24,7 @@ include disable-exec.inc | |||
25 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | 25 | include disable-passwdmgr.inc |
27 | include disable-programs.inc | 26 | include disable-programs.inc |
27 | include disable-shell.inc | ||
28 | include disable-xdg.inc | 28 | include disable-xdg.inc |
29 | 29 | ||
30 | mkdir ${HOME}/.cache/champlain | 30 | mkdir ${HOME}/.cache/champlain |
@@ -36,6 +36,7 @@ whitelist ${PICTURES} | |||
36 | whitelist /usr/share/gnome-maps | 36 | whitelist /usr/share/gnome-maps |
37 | whitelist /usr/share/libgweather | 37 | whitelist /usr/share/libgweather |
38 | include whitelist-common.inc | 38 | include whitelist-common.inc |
39 | include whitelist-runuser-common.inc | ||
39 | include whitelist-usr-share-common.inc | 40 | include whitelist-usr-share-common.inc |
40 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
41 | 42 | ||
@@ -62,3 +63,11 @@ private-bin gjs,gnome-maps | |||
62 | private-dev | 63 | private-dev |
63 | private-etc alternatives,ca-certificates,clutter-1.0,crypto-policies,dconf,drirc,fonts,gconf,gcrypt,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pkcs11,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg | 64 | private-etc alternatives,ca-certificates,clutter-1.0,crypto-policies,dconf,drirc,fonts,gconf,gcrypt,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pkcs11,pki,protocols,resolv.conf,rpc,services,ssl,X11,xdg |
64 | private-tmp | 65 | private-tmp |
66 | |||
67 | dbus-user filter | ||
68 | dbus-user.own org.gnome.Maps | ||
69 | #dbus-user.talk org.freedesktop.secrets | ||
70 | #dbus-user.talk org.gnome.OnlineAccounts | ||
71 | dbus-system filter | ||
72 | #dbus-system.talk org.freedesktop.NetworkManager | ||
73 | dbus-system.talk org.freedesktop.GeoClue2 | ||
diff --git a/etc/profile-a-l/gnome-mines.profile b/etc/profile-a-l/gnome-mines.profile new file mode 100644 index 000000000..4fe8986c2 --- /dev/null +++ b/etc/profile-a-l/gnome-mines.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for gnome-mines | ||
2 | # Description: The popular logic puzzle minesweeper | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-mines.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-mines | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-mines | ||
12 | whitelist ${HOME}/.local/share/gnome-mines | ||
13 | whitelist /usr/share/gnome-mines | ||
14 | |||
15 | private-bin gnome-mines | ||
16 | |||
17 | dbus-user.own org.gnome.Mines | ||
18 | |||
19 | # Redirect | ||
20 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-mplayer.profile b/etc/profile-a-l/gnome-mplayer.profile index 12bee6448..12bee6448 100644 --- a/etc/gnome-mplayer.profile +++ b/etc/profile-a-l/gnome-mplayer.profile | |||
diff --git a/etc/gnome-mpv.profile b/etc/profile-a-l/gnome-mpv.profile index f5d652732..f5d652732 100644 --- a/etc/gnome-mpv.profile +++ b/etc/profile-a-l/gnome-mpv.profile | |||
diff --git a/etc/gnome-music.profile b/etc/profile-a-l/gnome-music.profile index ad3fa1753..36b46897c 100644 --- a/etc/gnome-music.profile +++ b/etc/profile-a-l/gnome-music.profile | |||
@@ -21,8 +21,10 @@ include disable-passwdmgr.inc | |||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | netfilter | 29 | netfilter |
28 | no3d | 30 | no3d |
@@ -37,8 +39,9 @@ seccomp | |||
37 | shell none | 39 | shell none |
38 | tracelog | 40 | tracelog |
39 | 41 | ||
40 | private-bin env,gio-launch-desktop,gnome-music,python*,yelp | 42 | # private-bin calls a file manager - whatever is installed! |
43 | #private-bin env,gio-launch-desktop,gnome-music,python*,yelp | ||
41 | private-dev | 44 | private-dev |
42 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 45 | private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,machine-id,pulse,selinux,xdg |
43 | private-tmp | 46 | private-tmp |
44 | 47 | ||
diff --git a/etc/gnome-nettool.profile b/etc/profile-a-l/gnome-nettool.profile index d15299890..33eb9c81a 100644 --- a/etc/gnome-nettool.profile +++ b/etc/profile-a-l/gnome-nettool.profile | |||
@@ -16,6 +16,7 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/gnome-nettool | 17 | whitelist /usr/share/gnome-nettool |
18 | #include whitelist-common.inc -- see #903 | 18 | #include whitelist-common.inc -- see #903 |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
@@ -24,7 +25,6 @@ ipc-namespace | |||
24 | machine-id | 25 | machine-id |
25 | netfilter | 26 | netfilter |
26 | no3d | 27 | no3d |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | # ping needs to elevate privileges, noroot and nonewprivs will kill it | 30 | # ping needs to elevate privileges, noroot and nonewprivs will kill it |
@@ -44,3 +44,5 @@ private-dev | |||
44 | private-lib libbind9.so.*,libcrypto.so.*,libdns.so.*,libgtk-3.so.*,libgtop*,libirs.so.*,liblua.so.*,libssh2.so.*,libssl.so.* | 44 | private-lib libbind9.so.*,libcrypto.so.*,libdns.so.*,libgtk-3.so.*,libgtop*,libirs.so.*,liblua.so.*,libssh2.so.*,libssl.so.* |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnome-nibbles.profile b/etc/profile-a-l/gnome-nibbles.profile new file mode 100644 index 000000000..b22810d34 --- /dev/null +++ b/etc/profile-a-l/gnome-nibbles.profile | |||
@@ -0,0 +1,23 @@ | |||
1 | # Firejail profile for gnome-nibbles | ||
2 | # Description: A worm game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-nibbles.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | noblacklist ${HOME}/.local/share/gnome-nibbles | ||
13 | |||
14 | mkdir ${HOME}/.local/share/gnome-nibbles | ||
15 | whitelist ${HOME}/.local/share/gnome-nibbles | ||
16 | whitelist /usr/share/gnome-nibbles | ||
17 | |||
18 | private-bin gnome-nibbles | ||
19 | |||
20 | dbus-user.own org.gnome.Nibbles | ||
21 | |||
22 | # Redirect | ||
23 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile index de8f6ad7d..615be7873 100644 --- a/etc/gnome-passwordsafe.profile +++ b/etc/profile-a-l/gnome-passwordsafe.profile | |||
@@ -19,15 +19,12 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | whitelist ${RUNUSER}/bus | ||
25 | # If you have a second wayland compositor, whitelist its socket here. | ||
26 | whitelist ${RUNUSER}/wayland-0 | ||
27 | whitelist ${RUNUSER}/gdm/Xauthority | ||
28 | |||
29 | whitelist /usr/share/cracklib | 25 | whitelist /usr/share/cracklib |
30 | whitelist /usr/share/passwordsafe | 26 | whitelist /usr/share/passwordsafe |
27 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
32 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
33 | 30 | ||
diff --git a/etc/gnome-photos.profile b/etc/profile-a-l/gnome-photos.profile index aa0b7dbe3..2af406af9 100644 --- a/etc/gnome-photos.profile +++ b/etc/profile-a-l/gnome-photos.profile | |||
@@ -17,8 +17,10 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
23 | apparmor | ||
22 | caps.drop all | 24 | caps.drop all |
23 | netfilter | 25 | netfilter |
24 | nodvd | 26 | nodvd |
diff --git a/etc/gnome-pie.profile b/etc/profile-a-l/gnome-pie.profile index c1d2dae35..c1d2dae35 100644 --- a/etc/gnome-pie.profile +++ b/etc/profile-a-l/gnome-pie.profile | |||
diff --git a/etc/profile-a-l/gnome-pomodoro.profile b/etc/profile-a-l/gnome-pomodoro.profile new file mode 100644 index 000000000..a46e47759 --- /dev/null +++ b/etc/profile-a-l/gnome-pomodoro.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for gnome-pomodoro | ||
2 | # Description: time management utility for GNOME based on the pomodoro technique | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-pomodoro.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-pomodoro | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.local/share/gnome-pomodoro | ||
20 | whitelist ${HOME}/.local/share/gnome-pomodoro | ||
21 | whitelist /usr/share/gnome-pomodoro | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private-bin gnome-pomodoro | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user filter | ||
51 | dbus-user.own org.gnome.Pomodoro | ||
52 | dbus-user.talk ca.desrt.dconf | ||
53 | dbus-user.talk org.gnome.Mutter.IdleMonitor | ||
54 | dbus-user.talk org.gnome.Shell | ||
55 | dbus-user.talk org.freedesktop.Notifications | ||
56 | dbus-system none | ||
57 | |||
58 | read-only ${HOME} | ||
59 | read-write ${HOME}/.local/share/gnome-pomodoro | ||
diff --git a/etc/gnome-recipes.profile b/etc/profile-a-l/gnome-recipes.profile index b4791afc5..c4969590f 100644 --- a/etc/gnome-recipes.profile +++ b/etc/profile-a-l/gnome-recipes.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | 20 | ||
20 | mkdir ${HOME}/.cache/gnome-recipes | 21 | mkdir ${HOME}/.cache/gnome-recipes |
21 | mkdir ${HOME}/.local/share/gnome-recipes | 22 | mkdir ${HOME}/.local/share/gnome-recipes |
@@ -26,6 +27,7 @@ include whitelist-common.inc | |||
26 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
30 | apparmor | ||
29 | caps.drop all | 31 | caps.drop all |
30 | ipc-namespace | 32 | ipc-namespace |
31 | machine-id | 33 | machine-id |
diff --git a/etc/gnome-ring.profile b/etc/profile-a-l/gnome-ring.profile index 78ceb9c4f..78ceb9c4f 100644 --- a/etc/gnome-ring.profile +++ b/etc/profile-a-l/gnome-ring.profile | |||
diff --git a/etc/profile-a-l/gnome-robots.profile b/etc/profile-a-l/gnome-robots.profile new file mode 100644 index 000000000..8835f2b93 --- /dev/null +++ b/etc/profile-a-l/gnome-robots.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-robots | ||
2 | # Description: Based on classic BSD Robots | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-robots.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/gnome-robots | ||
13 | |||
14 | private-bin gnome-robots | ||
15 | |||
16 | dbus-user.own org.gnome.Robots | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-schedule.profile b/etc/profile-a-l/gnome-schedule.profile index c8dd8ead7..55913a2d7 100644 --- a/etc/gnome-schedule.profile +++ b/etc/profile-a-l/gnome-schedule.profile | |||
@@ -39,6 +39,7 @@ whitelist /usr/share/gnome-schedule | |||
39 | whitelist /var/spool/atd | 39 | whitelist /var/spool/atd |
40 | whitelist /var/spool/cron | 40 | whitelist /var/spool/cron |
41 | include whitelist-common.inc | 41 | include whitelist-common.inc |
42 | include whitelist-runuser-common.inc | ||
42 | include whitelist-usr-share-common.inc | 43 | include whitelist-usr-share-common.inc |
43 | include whitelist-var-common.inc | 44 | include whitelist-var-common.inc |
44 | 45 | ||
diff --git a/etc/profile-a-l/gnome-screenshot.profile b/etc/profile-a-l/gnome-screenshot.profile new file mode 100644 index 000000000..82fb1b658 --- /dev/null +++ b/etc/profile-a-l/gnome-screenshot.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for gnome-screenshot | ||
2 | # Description: GNOME screenshot tool | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-screenshot.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | noblacklist ${HOME}/.cache/gnome-screenshot | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin gnome-screenshot | ||
43 | private-dev | ||
44 | private-etc dconf,fonts,gtk-3.0,localtime,machine-id | ||
45 | private-tmp | ||
46 | |||
47 | dbus-user filter | ||
48 | dbus-user.own org.gnome.Screenshot | ||
49 | dbus-user.talk org.gnome.Shell.Screenshot | ||
50 | dbus-system none | ||
diff --git a/etc/gnome-sound-recorder.profile b/etc/profile-a-l/gnome-sound-recorder.profile index 7f8fc8a0c..a64ec25a9 100644 --- a/etc/gnome-sound-recorder.profile +++ b/etc/profile-a-l/gnome-sound-recorder.profile | |||
@@ -7,7 +7,6 @@ include gnome-sound-recorder.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${MUSIC} | 9 | noblacklist ${MUSIC} |
10 | noblacklist ${HOME}/.local/share/flatpak | ||
11 | noblacklist ${HOME}/.local/share/Trash | 10 | noblacklist ${HOME}/.local/share/Trash |
12 | 11 | ||
13 | # Allow gjs (blacklisted by disable-interpreters.inc) | 12 | # Allow gjs (blacklisted by disable-interpreters.inc) |
diff --git a/etc/profile-a-l/gnome-sudoku.profile b/etc/profile-a-l/gnome-sudoku.profile new file mode 100644 index 000000000..12fd48a86 --- /dev/null +++ b/etc/profile-a-l/gnome-sudoku.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-sudoku | ||
2 | # Description: puzzle game for the popular Japanese sudoku logic puzzle | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-sudoku.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/gnome-sudoku | ||
10 | |||
11 | mkdir ${HOME}/.local/share/gnome-sudoku | ||
12 | whitelist ${HOME}/.local/share/gnome-sudoku | ||
13 | |||
14 | private-bin gnome-sudoku | ||
15 | |||
16 | dbus-user.own org.gnome.Sudoku | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/gnome-system-log.profile b/etc/profile-a-l/gnome-system-log.profile index cfe39d18b..14b0f758e 100644 --- a/etc/gnome-system-log.profile +++ b/etc/profile-a-l/gnome-system-log.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /var/log | 18 | whitelist /var/log |
@@ -24,7 +25,6 @@ caps.drop all | |||
24 | ipc-namespace | 25 | ipc-namespace |
25 | # net none - breaks dbus | 26 | # net none - breaks dbus |
26 | no3d | 27 | no3d |
27 | # nodbus | ||
28 | nodvd | 28 | nodvd |
29 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), | 29 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), |
30 | # comment both 'nogroups' and 'noroot' | 30 | # comment both 'nogroups' and 'noroot' |
@@ -49,6 +49,9 @@ private-lib | |||
49 | private-tmp | 49 | private-tmp |
50 | writable-var-log | 50 | writable-var-log |
51 | 51 | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
52 | memory-deny-write-execute | 55 | memory-deny-write-execute |
53 | 56 | ||
54 | # comment this if you export logs to a file in your ${HOME} | 57 | # comment this if you export logs to a file in your ${HOME} |
diff --git a/etc/profile-a-l/gnome-taquin.profile b/etc/profile-a-l/gnome-taquin.profile new file mode 100644 index 000000000..2341334f7 --- /dev/null +++ b/etc/profile-a-l/gnome-taquin.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for gnome-taquin | ||
2 | # Description: A sliding puzzle game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-taquin.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore machine-id | ||
10 | ignore nosound | ||
11 | |||
12 | whitelist /usr/share/gnome-taquin | ||
13 | |||
14 | private-bin gnome-taquin | ||
15 | |||
16 | dbus-user.own org.gnome.Taquin | ||
17 | |||
18 | # Redirect | ||
19 | include gnome_games-common.profile | ||
diff --git a/etc/profile-a-l/gnome-tetravex.profile b/etc/profile-a-l/gnome-tetravex.profile new file mode 100644 index 000000000..6e820dd70 --- /dev/null +++ b/etc/profile-a-l/gnome-tetravex.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for gnome-tetravex | ||
2 | # Description: A simple puzzle game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-tetravex.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | private-bin gnome-tetravex | ||
10 | |||
11 | dbus-user.own org.gnome.Tetravex | ||
12 | |||
13 | # Redirect | ||
14 | include gnome_games-common.profile | ||
diff --git a/etc/profile-a-l/gnome-todo.profile b/etc/profile-a-l/gnome-todo.profile new file mode 100644 index 000000000..2fab3dcc7 --- /dev/null +++ b/etc/profile-a-l/gnome-todo.profile | |||
@@ -0,0 +1,64 @@ | |||
1 | # Firejail profile for gnome-todo | ||
2 | # Description: Personal task manager for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnome-todo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Allow python (blacklisted by disable-interpreters.inc) | ||
10 | include allow-python3.inc | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | whitelist /usr/share/gnome-todo | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | machine-id | ||
30 | net none | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | nosound | ||
36 | notv | ||
37 | nou2f | ||
38 | novideo | ||
39 | protocol unix | ||
40 | seccomp | ||
41 | shell none | ||
42 | tracelog | ||
43 | |||
44 | disable-mnt | ||
45 | #private | ||
46 | private-bin gnome-todo | ||
47 | private-cache | ||
48 | private-dev | ||
49 | private-etc dconf,fonts,gtk-3.0,localtime,passwd,xdg | ||
50 | private-tmp | ||
51 | |||
52 | dbus-user filter | ||
53 | dbus-user.own org.gnome.Todo | ||
54 | dbus-user.talk ca.desrt.dconf | ||
55 | #dbus-user.talk org.gnome.evolution.dataserver.AddressBook9 | ||
56 | #dbus-user.talk org.gnome.evolution.dataserver.Calendar8 | ||
57 | #dbus-user.talk org.gnome.evolution.dataserver.Sources5 | ||
58 | #dbus-user.talk org.gnome.evolution.dataserver.Subprocess.Backend.* | ||
59 | #dbus-user.talk org.gnome.OnlineAccounts | ||
60 | dbus-system none | ||
61 | #dbus-system filter | ||
62 | #dbus-system.talk org.freedesktop.login1 | ||
63 | |||
64 | read-only ${HOME} | ||
diff --git a/etc/gnome-twitch.profile b/etc/profile-a-l/gnome-twitch.profile index 5e8153035..5e8153035 100644 --- a/etc/gnome-twitch.profile +++ b/etc/profile-a-l/gnome-twitch.profile | |||
diff --git a/etc/gnome-weather.profile b/etc/profile-a-l/gnome-weather.profile index 10db6296b..a181f1b9e 100644 --- a/etc/gnome-weather.profile +++ b/etc/profile-a-l/gnome-weather.profile | |||
@@ -21,6 +21,7 @@ include disable-passwdmgr.inc | |||
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
26 | caps.drop all | 27 | caps.drop all |
diff --git a/etc/profile-a-l/gnome_games-common.profile b/etc/profile-a-l/gnome_games-common.profile new file mode 100644 index 000000000..c46fbc1d9 --- /dev/null +++ b/etc/profile-a-l/gnome_games-common.profile | |||
@@ -0,0 +1,48 @@ | |||
1 | # Firejail profile for gnome_games-common | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include gnome_games-common.local | ||
5 | # Persistent global definitions | ||
6 | # added by caller profile | ||
7 | #include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | include whitelist-common.inc | ||
19 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | machine-id | ||
26 | net none | ||
27 | nodvd | ||
28 | nogroups | ||
29 | nonewprivs | ||
30 | noroot | ||
31 | nosound | ||
32 | notv | ||
33 | nou2f | ||
34 | novideo | ||
35 | protocol unix | ||
36 | seccomp | ||
37 | shell none | ||
38 | tracelog | ||
39 | |||
40 | disable-mnt | ||
41 | private-cache | ||
42 | private-dev | ||
43 | private-etc dconf,fonts,gconf,gtk-2.0,gtk-3.0,machine-id,pango,passwd,X11 | ||
44 | private-tmp | ||
45 | |||
46 | dbus-user filter | ||
47 | dbus-user.talk ca.desrt.dconf | ||
48 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnote.profile b/etc/profile-a-l/gnote.profile new file mode 100644 index 000000000..1b5129fc5 --- /dev/null +++ b/etc/profile-a-l/gnote.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for gnote | ||
2 | # Description: A simple note-taking application for Gnome | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnote.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/gnote | ||
10 | noblacklist ${HOME}/.local/share/gnote | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.config/gnote | ||
22 | mkdir ${HOME}/.local/share/gnote | ||
23 | whitelist ${HOME}/.config/gnote | ||
24 | whitelist ${HOME}/.local/share/gnote | ||
25 | whitelist /usr/share/gnote | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | machine-id | ||
34 | net none | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin gnote | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc dconf,fonts,gtk-3.0,pango,X11 | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user filter | ||
57 | dbus-user.own org.gnome.Gnote | ||
58 | dbus-user.talk ca.desrt.dconf | ||
59 | dbus-system none | ||
diff --git a/etc/profile-a-l/gnubik.profile b/etc/profile-a-l/gnubik.profile new file mode 100644 index 000000000..8eaba161c --- /dev/null +++ b/etc/profile-a-l/gnubik.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for gnubik | ||
2 | # Description: DESCRIPTION | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gnubik.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/gnubik | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private | ||
43 | private-bin gnubik | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc drirc,fonts,gtk-2.0 | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/godot.profile b/etc/profile-a-l/godot.profile index 2baf09b1d..8324a4eb5 100644 --- a/etc/godot.profile +++ b/etc/profile-a-l/godot.profile | |||
@@ -22,7 +22,6 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -41,3 +40,6 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl | 41 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl |
43 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/goobox.profile b/etc/profile-a-l/goobox.profile index c932ad528..c932ad528 100644 --- a/etc/goobox.profile +++ b/etc/profile-a-l/goobox.profile | |||
diff --git a/etc/google-chrome-beta.profile b/etc/profile-a-l/google-chrome-beta.profile index 73101f509..a62e4cf74 100644 --- a/etc/google-chrome-beta.profile +++ b/etc/profile-a-l/google-chrome-beta.profile | |||
@@ -8,10 +8,16 @@ include globals.local | |||
8 | noblacklist ${HOME}/.cache/google-chrome-beta | 8 | noblacklist ${HOME}/.cache/google-chrome-beta |
9 | noblacklist ${HOME}/.config/google-chrome-beta | 9 | noblacklist ${HOME}/.config/google-chrome-beta |
10 | 10 | ||
11 | noblacklist ${HOME}/.config/chrome-beta-flags.conf | ||
12 | noblacklist ${HOME}/.config/chrome-beta-flags.config | ||
13 | |||
11 | mkdir ${HOME}/.cache/google-chrome-beta | 14 | mkdir ${HOME}/.cache/google-chrome-beta |
12 | mkdir ${HOME}/.config/google-chrome-beta | 15 | mkdir ${HOME}/.config/google-chrome-beta |
13 | whitelist ${HOME}/.cache/google-chrome-beta | 16 | whitelist ${HOME}/.cache/google-chrome-beta |
14 | whitelist ${HOME}/.config/google-chrome-beta | 17 | whitelist ${HOME}/.config/google-chrome-beta |
15 | 18 | ||
19 | whitelist ${HOME}/.config/chrome-beta-flags.conf | ||
20 | whitelist ${HOME}/.config/chrome-beta-flags.config | ||
21 | |||
16 | # Redirect | 22 | # Redirect |
17 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/google-chrome-stable.profile b/etc/profile-a-l/google-chrome-stable.profile index a456e8d61..a456e8d61 100644 --- a/etc/google-chrome-stable.profile +++ b/etc/profile-a-l/google-chrome-stable.profile | |||
diff --git a/etc/google-chrome-unstable.profile b/etc/profile-a-l/google-chrome-unstable.profile index 50e9923aa..14547eab2 100644 --- a/etc/google-chrome-unstable.profile +++ b/etc/profile-a-l/google-chrome-unstable.profile | |||
@@ -8,10 +8,16 @@ include globals.local | |||
8 | noblacklist ${HOME}/.cache/google-chrome-unstable | 8 | noblacklist ${HOME}/.cache/google-chrome-unstable |
9 | noblacklist ${HOME}/.config/google-chrome-unstable | 9 | noblacklist ${HOME}/.config/google-chrome-unstable |
10 | 10 | ||
11 | noblacklist ${HOME}/.config/chrome-unstable-flags.conf | ||
12 | noblacklist ${HOME}/.config/chrome-unstable-flags.config | ||
13 | |||
11 | mkdir ${HOME}/.cache/google-chrome-unstable | 14 | mkdir ${HOME}/.cache/google-chrome-unstable |
12 | mkdir ${HOME}/.config/google-chrome-unstable | 15 | mkdir ${HOME}/.config/google-chrome-unstable |
13 | whitelist ${HOME}/.cache/google-chrome-unstable | 16 | whitelist ${HOME}/.cache/google-chrome-unstable |
14 | whitelist ${HOME}/.config/google-chrome-unstable | 17 | whitelist ${HOME}/.config/google-chrome-unstable |
15 | 18 | ||
19 | whitelist ${HOME}/.config/chrome-unstable-flags.conf | ||
20 | whitelist ${HOME}/.config/chrome-unstable-flags.config | ||
21 | |||
16 | # Redirect | 22 | # Redirect |
17 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/google-chrome.profile b/etc/profile-a-l/google-chrome.profile index c69e98271..66f76caa0 100644 --- a/etc/google-chrome.profile +++ b/etc/profile-a-l/google-chrome.profile | |||
@@ -8,10 +8,16 @@ include globals.local | |||
8 | noblacklist ${HOME}/.cache/google-chrome | 8 | noblacklist ${HOME}/.cache/google-chrome |
9 | noblacklist ${HOME}/.config/google-chrome | 9 | noblacklist ${HOME}/.config/google-chrome |
10 | 10 | ||
11 | noblacklist ${HOME}/.config/chrome-flags.conf | ||
12 | noblacklist ${HOME}/.config/chrome-flags.config | ||
13 | |||
11 | mkdir ${HOME}/.cache/google-chrome | 14 | mkdir ${HOME}/.cache/google-chrome |
12 | mkdir ${HOME}/.config/google-chrome | 15 | mkdir ${HOME}/.config/google-chrome |
13 | whitelist ${HOME}/.cache/google-chrome | 16 | whitelist ${HOME}/.cache/google-chrome |
14 | whitelist ${HOME}/.config/google-chrome | 17 | whitelist ${HOME}/.config/google-chrome |
15 | 18 | ||
19 | whitelist ${HOME}/.config/chrome-flags.conf | ||
20 | whitelist ${HOME}/.config/chrome-flags.config | ||
21 | |||
16 | # Redirect | 22 | # Redirect |
17 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/google-earth-pro.profile b/etc/profile-a-l/google-earth-pro.profile index c1f919769..c1f919769 100644 --- a/etc/google-earth-pro.profile +++ b/etc/profile-a-l/google-earth-pro.profile | |||
diff --git a/etc/google-earth.profile b/etc/profile-a-l/google-earth.profile index a331ef8d2..a331ef8d2 100644 --- a/etc/google-earth.profile +++ b/etc/profile-a-l/google-earth.profile | |||
diff --git a/etc/google-play-music-desktop-player.profile b/etc/profile-a-l/google-play-music-desktop-player.profile index daa385234..daa385234 100644 --- a/etc/google-play-music-desktop-player.profile +++ b/etc/profile-a-l/google-play-music-desktop-player.profile | |||
diff --git a/etc/gpa.profile b/etc/profile-a-l/gpa.profile index ce7c8496d..ce7c8496d 100644 --- a/etc/gpa.profile +++ b/etc/profile-a-l/gpa.profile | |||
diff --git a/etc/gpg-agent.profile b/etc/profile-a-l/gpg-agent.profile index 16bda186e..adc8957e6 100644 --- a/etc/gpg-agent.profile +++ b/etc/profile-a-l/gpg-agent.profile | |||
@@ -21,9 +21,12 @@ include disable-xdg.inc | |||
21 | 21 | ||
22 | mkdir ${HOME}/.gnupg | 22 | mkdir ${HOME}/.gnupg |
23 | whitelist ${HOME}/.gnupg | 23 | whitelist ${HOME}/.gnupg |
24 | whitelist ${RUNUSER}/gnupg | ||
25 | whitelist ${RUNUSER}/keyring | ||
24 | whitelist /usr/share/gnupg | 26 | whitelist /usr/share/gnupg |
25 | whitelist /usr/share/gnupg2 | 27 | whitelist /usr/share/gnupg2 |
26 | include whitelist-common.inc | 28 | include whitelist-common.inc |
29 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
29 | 32 | ||
diff --git a/etc/gpg.profile b/etc/profile-a-l/gpg.profile index b408a0123..787f35f9e 100644 --- a/etc/gpg.profile +++ b/etc/profile-a-l/gpg.profile | |||
@@ -18,9 +18,12 @@ include disable-interpreters.inc | |||
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | whitelist ${RUNUSER}/gnupg | ||
22 | whitelist ${RUNUSER}/keyring | ||
21 | whitelist /usr/share/gnupg | 23 | whitelist /usr/share/gnupg |
22 | whitelist /usr/share/gnupg2 | 24 | whitelist /usr/share/gnupg2 |
23 | whitelist /usr/share/pacman/keyrings | 25 | whitelist /usr/share/pacman/keyrings |
26 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
26 | 29 | ||
diff --git a/etc/gpg2.profile b/etc/profile-a-l/gpg2.profile index b831b0f62..b831b0f62 100644 --- a/etc/gpg2.profile +++ b/etc/profile-a-l/gpg2.profile | |||
diff --git a/etc/gpicview.profile b/etc/profile-a-l/gpicview.profile index eb00688dd..a536e5985 100644 --- a/etc/gpicview.profile +++ b/etc/profile-a-l/gpicview.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | whitelist /usr/share/gpicview | 19 | whitelist /usr/share/gpicview |
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
@@ -24,7 +25,6 @@ caps.drop all | |||
24 | ipc-namespace | 25 | ipc-namespace |
25 | machine-id | 26 | machine-id |
26 | net none | 27 | net none |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -45,4 +45,7 @@ private-etc alternatives,fonts,group,passwd | |||
45 | private-lib | 45 | private-lib |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
48 | memory-deny-write-execute | 51 | memory-deny-write-execute |
diff --git a/etc/gpredict.profile b/etc/profile-a-l/gpredict.profile index c1f1b53a0..3152db096 100644 --- a/etc/gpredict.profile +++ b/etc/profile-a-l/gpredict.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.config/Gpredict | 19 | mkdir ${HOME}/.config/Gpredict |
19 | whitelist ${HOME}/.config/Gpredict | 20 | whitelist ${HOME}/.config/Gpredict |
diff --git a/etc/gradio.profile b/etc/profile-a-l/gradio.profile index 82e2504b9..a16e65efb 100644 --- a/etc/gradio.profile +++ b/etc/profile-a-l/gradio.profile | |||
@@ -14,12 +14,15 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.cache/gradio | 19 | mkdir ${HOME}/.cache/gradio |
19 | mkdir ${HOME}/.local/share/gradio | 20 | mkdir ${HOME}/.local/share/gradio |
20 | whitelist ${HOME}/.cache/gradio | 21 | whitelist ${HOME}/.cache/gradio |
21 | whitelist ${HOME}/.local/share/gradio | 22 | whitelist ${HOME}/.local/share/gradio |
22 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
24 | 27 | ||
25 | caps.drop all | 28 | caps.drop all |
@@ -30,11 +33,23 @@ nogroups | |||
30 | nonewprivs | 33 | nonewprivs |
31 | noroot | 34 | noroot |
32 | notv | 35 | notv |
36 | nou2f | ||
33 | novideo | 37 | novideo |
34 | protocol unix,inet,inet6 | 38 | protocol unix,inet,inet6 |
35 | seccomp | 39 | seccomp |
40 | seccomp.block-secondary | ||
36 | shell none | 41 | shell none |
42 | tracelog | ||
37 | 43 | ||
44 | disable-mnt | ||
45 | private-bin gradio | ||
46 | private-cache | ||
47 | private-dev | ||
38 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 48 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg |
39 | private-tmp | 49 | private-tmp |
40 | 50 | ||
51 | dbus-user filter | ||
52 | dbus-user.own de.haeckerfelix.gradio | ||
53 | dbus-user.own org.mpris.MediaPlayer2.gradio | ||
54 | dbus-user.talk ca.desrt.dconf | ||
55 | dbus-system none | ||
diff --git a/etc/gramps.profile b/etc/profile-a-l/gramps.profile index 54b154964..427fe2d7a 100644 --- a/etc/gramps.profile +++ b/etc/profile-a-l/gramps.profile | |||
@@ -30,7 +30,6 @@ caps.drop all | |||
30 | ipc-namespace | 30 | ipc-namespace |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -47,3 +46,6 @@ disable-mnt | |||
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile new file mode 100644 index 000000000..0cb3aa864 --- /dev/null +++ b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile | |||
@@ -0,0 +1,47 @@ | |||
1 | # Firejail profile for gravity-beams-and-evaporating-stars | ||
2 | # Description: a game about hurling asteroids into the sun | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gravity-beams-and-evaporating-stars.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/gravity-beams-and-evaporating-stars | ||
19 | include whitelist-common.inc | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | net none | ||
26 | nodvd | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | disable-mnt | ||
39 | private | ||
40 | private-bin gravity-beams-and-evaporating-stars | ||
41 | private-cache | ||
42 | private-dev | ||
43 | private-etc fonts,machine-id | ||
44 | private-tmp | ||
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/gsettings-data-convert.profile b/etc/profile-a-l/gsettings-data-convert.profile index 6f1d43939..6f1d43939 100644 --- a/etc/gsettings-data-convert.profile +++ b/etc/profile-a-l/gsettings-data-convert.profile | |||
diff --git a/etc/gsettings-schema-convert.profile b/etc/profile-a-l/gsettings-schema-convert.profile index 5c8b0e2e2..5c8b0e2e2 100644 --- a/etc/gsettings-schema-convert.profile +++ b/etc/profile-a-l/gsettings-schema-convert.profile | |||
diff --git a/etc/gsettings.profile b/etc/profile-a-l/gsettings.profile index 2203fac15..2203fac15 100644 --- a/etc/gsettings.profile +++ b/etc/profile-a-l/gsettings.profile | |||
diff --git a/etc/gtar.profile b/etc/profile-a-l/gtar.profile index 2391c121b..2391c121b 100644 --- a/etc/gtar.profile +++ b/etc/profile-a-l/gtar.profile | |||
diff --git a/etc/gthumb.profile b/etc/profile-a-l/gthumb.profile index 77de59802..de0fc96ae 100644 --- a/etc/gthumb.profile +++ b/etc/profile-a-l/gthumb.profile | |||
@@ -15,6 +15,7 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | nodvd | 21 | nodvd |
diff --git a/etc/gtk-update-icon-cache.profile b/etc/profile-a-l/gtk-update-icon-cache.profile index 668a48f9a..2051a8af6 100644 --- a/etc/gtk-update-icon-cache.profile +++ b/etc/profile-a-l/gtk-update-icon-cache.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | include whitelist-common.inc | 21 | include whitelist-common.inc |
@@ -27,7 +28,6 @@ ipc-namespace | |||
27 | machine-id | 28 | machine-id |
28 | net none | 29 | net none |
29 | no3d | 30 | no3d |
30 | nodbus | ||
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | nonewprivs | 33 | nonewprivs |
@@ -50,4 +50,7 @@ private-etc none | |||
50 | private-lib | 50 | private-lib |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
53 | memory-deny-write-execute | 56 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/gtk-youtube-viewer b/etc/profile-a-l/gtk-youtube-viewer new file mode 100644 index 000000000..023f10d3d --- /dev/null +++ b/etc/profile-a-l/gtk-youtube-viewer | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gtk-youtube-viewer | ||
2 | # Description: Gtk front-end to youtube-viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gtk-youtube-viewer.local | ||
6 | # Persistent global definitions | ||
7 | # include globals.local | ||
8 | |||
9 | ignore quiet | ||
10 | |||
11 | noblacklist /tmp/.X11-unix | ||
12 | noblacklist ${RUNUSER}/wayland-* | ||
13 | noblacklist ${RUNUSER} | ||
14 | |||
15 | include whitelist-runuser-common.inc | ||
16 | |||
17 | # Redirect | ||
18 | include youtube-viewer.profile \ No newline at end of file | ||
diff --git a/etc/profile-a-l/gtk2-youtube-viewer b/etc/profile-a-l/gtk2-youtube-viewer new file mode 100644 index 000000000..331e73218 --- /dev/null +++ b/etc/profile-a-l/gtk2-youtube-viewer | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gtk2-youtube-viewer | ||
2 | # Description: Gtk front-end to youtube-viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gtk2-youtube-viewer.local | ||
6 | # Persistent global definitions | ||
7 | # include globals.local | ||
8 | |||
9 | ignore quiet | ||
10 | |||
11 | noblacklist /tmp/.X11-unix | ||
12 | noblacklist ${RUNUSER}/wayland-* | ||
13 | noblacklist ${RUNUSER} | ||
14 | |||
15 | include whitelist-runuser-common.inc | ||
16 | |||
17 | # Redirect | ||
18 | include youtube-viewer.profile \ No newline at end of file | ||
diff --git a/etc/profile-a-l/gtk3-youtube-viewer b/etc/profile-a-l/gtk3-youtube-viewer new file mode 100644 index 000000000..4c5bde55f --- /dev/null +++ b/etc/profile-a-l/gtk3-youtube-viewer | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for gtk3-youtube-viewer | ||
2 | # Description: Gtk front-end to youtube-viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gtk3-youtube-viewer.local | ||
6 | # Persistent global definitions | ||
7 | # include globals.local | ||
8 | |||
9 | ignore quiet | ||
10 | |||
11 | noblacklist /tmp/.X11-unix | ||
12 | noblacklist ${RUNUSER}/wayland-* | ||
13 | noblacklist ${RUNUSER} | ||
14 | |||
15 | include whitelist-runuser-common.inc | ||
16 | |||
17 | # Redirect | ||
18 | include youtube-viewer.profile \ No newline at end of file | ||
diff --git a/etc/guayadeque.profile b/etc/profile-a-l/guayadeque.profile index 8ffd7ff58..8a7f65918 100644 --- a/etc/guayadeque.profile +++ b/etc/profile-a-l/guayadeque.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/gucharmap.profile b/etc/profile-a-l/gucharmap.profile index b3aa58d29..c0254b5ec 100644 --- a/etc/gucharmap.profile +++ b/etc/profile-a-l/gucharmap.profile | |||
@@ -12,9 +12,11 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
18 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
20 | 22 | ||
@@ -23,7 +25,6 @@ caps.drop all | |||
23 | machine-id | 25 | machine-id |
24 | #net none - breaks dbus | 26 | #net none - breaks dbus |
25 | no3d | 27 | no3d |
26 | #nodbus - breaks state saveing | ||
27 | nodvd | 28 | nodvd |
28 | nogroups | 29 | nogroups |
29 | nonewprivs | 30 | nonewprivs |
@@ -45,4 +46,8 @@ private-etc alternatives,dbus-1,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld | |||
45 | private-lib | 46 | private-lib |
46 | private-tmp | 47 | private-tmp |
47 | 48 | ||
49 | # breaks state saving | ||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
52 | |||
48 | read-only ${HOME} | 53 | read-only ${HOME} |
diff --git a/etc/gummi.profile b/etc/profile-a-l/gummi.profile index 922b2cbde..40c268c46 100644 --- a/etc/gummi.profile +++ b/etc/profile-a-l/gummi.profile | |||
@@ -12,8 +12,7 @@ include allow-lua.inc | |||
12 | include allow-perl.inc | 12 | include allow-perl.inc |
13 | include allow-python3.inc | 13 | include allow-python3.inc |
14 | 14 | ||
15 | private-bin dvipdf,dvips,env,gummi,latex,latexmk,lua*,lualatex,luatex,pdflatex,pdftex,perl,ps2pdf,python3*,rubber,synctex,tex,xelatex,xetex | 15 | private-bin dvipdf,dvips,env,gummi,latex,latexmk,lua*,pdflatex,pdftex,perl,ps2pdf,python3*,rubber,synctex,tex,xelatex,xetex |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include latex-common.profile | 18 | include latex-common.profile |
19 | |||
diff --git a/etc/gunzip.profile b/etc/profile-a-l/gunzip.profile index 6e97c6b78..6e97c6b78 100644 --- a/etc/gunzip.profile +++ b/etc/profile-a-l/gunzip.profile | |||
diff --git a/etc/gwenview.profile b/etc/profile-a-l/gwenview.profile index 5a5d81378..efdc56e38 100644 --- a/etc/gwenview.profile +++ b/etc/profile-a-l/gwenview.profile | |||
@@ -15,6 +15,7 @@ noblacklist ${HOME}/.kde/share/config/gwenviewrc | |||
15 | noblacklist ${HOME}/.kde4/share/apps/gwenview | 15 | noblacklist ${HOME}/.kde4/share/apps/gwenview |
16 | noblacklist ${HOME}/.kde4/share/config/gwenviewrc | 16 | noblacklist ${HOME}/.kde4/share/config/gwenviewrc |
17 | noblacklist ${HOME}/.local/share/gwenview | 17 | noblacklist ${HOME}/.local/share/gwenview |
18 | noblacklist ${HOME}/.local/share/kxmlgui5/gwenview | ||
18 | noblacklist ${HOME}/.local/share/org.kde.gwenview | 19 | noblacklist ${HOME}/.local/share/org.kde.gwenview |
19 | 20 | ||
20 | include disable-common.inc | 21 | include disable-common.inc |
@@ -23,6 +24,7 @@ include disable-exec.inc | |||
23 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | 25 | include disable-passwdmgr.inc |
25 | include disable-programs.inc | 26 | include disable-programs.inc |
27 | include disable-shell.inc | ||
26 | 28 | ||
27 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
28 | 30 | ||
@@ -30,7 +32,6 @@ apparmor | |||
30 | caps.drop all | 32 | caps.drop all |
31 | # net none | 33 | # net none |
32 | netfilter | 34 | netfilter |
33 | # nodbus | ||
34 | nodvd | 35 | nodvd |
35 | nogroups | 36 | nogroups |
36 | nonewprivs | 37 | nonewprivs |
@@ -47,4 +48,7 @@ private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 | |||
47 | private-dev | 48 | private-dev |
48 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg | 49 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg |
49 | 50 | ||
51 | # dbus-user none | ||
52 | # dbus-system none | ||
53 | |||
50 | # memory-deny-write-execute | 54 | # memory-deny-write-execute |
diff --git a/etc/gzexe.profile b/etc/profile-a-l/gzexe.profile index bb570d553..bb570d553 100644 --- a/etc/gzexe.profile +++ b/etc/profile-a-l/gzexe.profile | |||
diff --git a/etc/gzip.profile b/etc/profile-a-l/gzip.profile index 1af15d227..8ec39d8ca 100644 --- a/etc/gzip.profile +++ b/etc/profile-a-l/gzip.profile | |||
@@ -26,7 +26,6 @@ ipc-namespace | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -44,4 +43,7 @@ x11 none | |||
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
46 | 45 | ||
46 | dbus-user none | ||
47 | dbus-system none | ||
48 | |||
47 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/handbrake-gtk.profile b/etc/profile-a-l/handbrake-gtk.profile index 1e7ce2350..1e7ce2350 100644 --- a/etc/handbrake-gtk.profile +++ b/etc/profile-a-l/handbrake-gtk.profile | |||
diff --git a/etc/handbrake.profile b/etc/profile-a-l/handbrake.profile index 324c629e3..0539ffcb8 100644 --- a/etc/handbrake.profile +++ b/etc/profile-a-l/handbrake.profile | |||
@@ -22,8 +22,7 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | net none |
26 | nodbus | ||
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
29 | noroot | 28 | noroot |
@@ -36,3 +35,5 @@ shell none | |||
36 | private-dev | 35 | private-dev |
37 | private-tmp | 36 | private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/hashcat.profile b/etc/profile-a-l/hashcat.profile index b4d6d52f0..8ec67ff19 100644 --- a/etc/hashcat.profile +++ b/etc/profile-a-l/hashcat.profile | |||
@@ -23,7 +23,6 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | caps.drop all | 24 | caps.drop all |
25 | net none | 25 | net none |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -43,3 +42,5 @@ private-cache | |||
43 | private-dev | 42 | private-dev |
44 | private-tmp | 43 | private-tmp |
45 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/hedgewars.profile b/etc/profile-a-l/hedgewars.profile index 898a07a5f..898a07a5f 100644 --- a/etc/hedgewars.profile +++ b/etc/profile-a-l/hedgewars.profile | |||
diff --git a/etc/hexchat.profile b/etc/profile-a-l/hexchat.profile index 7723cbd6b..4c8911a06 100644 --- a/etc/hexchat.profile +++ b/etc/profile-a-l/hexchat.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.config/hexchat | 25 | mkdir ${HOME}/.config/hexchat |
diff --git a/etc/highlight.profile b/etc/profile-a-l/highlight.profile index 036de8d99..0761aa2fc 100644 --- a/etc/highlight.profile +++ b/etc/profile-a-l/highlight.profile | |||
@@ -7,17 +7,18 @@ include highlight.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | blacklist ${RUNUSER}/wayland-* | 9 | blacklist ${RUNUSER}/wayland-* |
10 | blacklist ${RUNUSER} | ||
10 | 11 | ||
11 | include disable-common.inc | 12 | include disable-common.inc |
12 | include disable-devel.inc | 13 | include disable-devel.inc |
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | 18 | ||
17 | caps.drop all | 19 | caps.drop all |
18 | net none | 20 | net none |
19 | no3d | 21 | no3d |
20 | nodbus | ||
21 | nodvd | 22 | nodvd |
22 | nogroups | 23 | nogroups |
23 | nonewprivs | 24 | nonewprivs |
@@ -36,3 +37,6 @@ private-bin highlight | |||
36 | private-cache | 37 | private-cache |
37 | private-dev | 38 | private-dev |
38 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/profile-a-l/hitori.profile b/etc/profile-a-l/hitori.profile new file mode 100644 index 000000000..6d67f4587 --- /dev/null +++ b/etc/profile-a-l/hitori.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for hitori | ||
2 | # Description: Play the Hitori puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include hitori.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | private-bin hitori | ||
10 | |||
11 | dbus-user.own org.gnome.Hitori | ||
12 | |||
13 | # Redirect | ||
14 | include gnome_games-common.profile | ||
diff --git a/etc/profile-a-l/homebank.profile b/etc/profile-a-l/homebank.profile new file mode 100644 index 000000000..8e600a2d7 --- /dev/null +++ b/etc/profile-a-l/homebank.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for homebank | ||
2 | # Description: Personal finance manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include homebank.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/homebank | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.config/homebank | ||
21 | whitelist ${DOWNLOADS} | ||
22 | whitelist ${HOME}/.config/homebank | ||
23 | whitelist /usr/share/homebank | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | apparmor | ||
30 | caps.drop all | ||
31 | machine-id | ||
32 | # net none | ||
33 | netfilter | ||
34 | nodvd | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6 | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin homebank | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11 | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none | ||
58 | |||
59 | # memory-deny-write-execute | ||
diff --git a/etc/profile-a-l/host.profile b/etc/profile-a-l/host.profile new file mode 100644 index 000000000..e5a5a7efa --- /dev/null +++ b/etc/profile-a-l/host.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for host | ||
2 | # Description: DNS lookup utility | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include host.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER} | ||
11 | noblacklist ${PATH}/host | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | ipc-namespace | ||
27 | machine-id | ||
28 | netfilter | ||
29 | no3d | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix,inet,inet6 | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private | ||
45 | private-bin bash,host,sh | ||
46 | private-dev | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
52 | memory-deny-write-execute | ||
diff --git a/etc/hugin.profile b/etc/profile-a-l/hugin.profile index 07a697c05..e03b68128 100644 --- a/etc/hugin.profile +++ b/etc/profile-a-l/hugin.profile | |||
@@ -16,11 +16,11 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | caps.drop all | 22 | caps.drop all |
22 | net none | 23 | net none |
23 | nodbus | ||
24 | nodvd | 24 | nodvd |
25 | nogroups | 25 | nogroups |
26 | nonewprivs | 26 | nonewprivs |
@@ -38,3 +38,5 @@ private-cache | |||
38 | private-dev | 38 | private-dev |
39 | private-tmp | 39 | private-tmp |
40 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/profile-a-l/hyperrogue.profile b/etc/profile-a-l/hyperrogue.profile new file mode 100644 index 000000000..f2cb25edf --- /dev/null +++ b/etc/profile-a-l/hyperrogue.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for hyperrogue | ||
2 | # Description: An SDL roguelike in a non-euclidean world | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include hyperrogue.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/hyperrogue.ini | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkfile ${HOME}/hyperrogue.ini | ||
21 | whitelist ${HOME}/hyperrogue.ini | ||
22 | whitelist /usr/share/hyperrogue | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin hyperrogue | ||
44 | private-cache | ||
45 | private-cwd ${HOME} | ||
46 | private-dev | ||
47 | private-etc fonts,machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/i2prouter.profile b/etc/profile-a-l/i2prouter.profile index 9ffdb9e9b..9ffdb9e9b 100644 --- a/etc/i2prouter.profile +++ b/etc/profile-a-l/i2prouter.profile | |||
diff --git a/etc/i3.profile b/etc/profile-a-l/i3.profile index c1ca0e413..c1ca0e413 100644 --- a/etc/i3.profile +++ b/etc/profile-a-l/i3.profile | |||
diff --git a/etc/gnome-2048.profile b/etc/profile-a-l/iagno.profile index 9eb4c147d..42fc7d449 100644 --- a/etc/gnome-2048.profile +++ b/etc/profile-a-l/iagno.profile | |||
@@ -1,38 +1,40 @@ | |||
1 | # Firejail profile for gnome-2048 | 1 | # Firejail profile for iagno |
2 | # Description: Sliding tile puzzle game | 2 | # Description: Reversi clone for Gnome desktop |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include gnome-2048.local | 5 | include iagno.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/gnome-2048 | ||
10 | |||
11 | include disable-common.inc | 9 | include disable-common.inc |
12 | include disable-devel.inc | 10 | include disable-devel.inc |
13 | include disable-exec.inc | 11 | include disable-exec.inc |
14 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
17 | 16 | ||
18 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
19 | 18 | ||
20 | mkdir ${HOME}/.local/share/gnome-2048 | 19 | apparmor |
21 | whitelist ${HOME}/.local/share/gnome-2048 | ||
22 | include whitelist-common.inc | ||
23 | |||
24 | caps.drop all | 20 | caps.drop all |
25 | netfilter | 21 | net none |
26 | nodvd | 22 | nodvd |
23 | nogroups | ||
27 | nonewprivs | 24 | nonewprivs |
28 | noroot | 25 | noroot |
29 | notv | 26 | notv |
30 | nou2f | 27 | nou2f |
31 | novideo | 28 | novideo |
32 | protocol unix,inet,inet6 | 29 | protocol unix |
33 | seccomp | 30 | seccomp |
31 | shell none | ||
34 | 32 | ||
35 | disable-mnt | 33 | disable-mnt |
34 | private | ||
35 | private-bin iagno | ||
36 | private-dev | 36 | private-dev |
37 | private-tmp | 37 | private-tmp |
38 | 38 | ||
39 | # dbus-user none | ||
40 | # dbus-system none | ||
diff --git a/etc/icecat.profile b/etc/profile-a-l/icecat.profile index 660343a29..660343a29 100644 --- a/etc/icecat.profile +++ b/etc/profile-a-l/icecat.profile | |||
diff --git a/etc/icedove.profile b/etc/profile-a-l/icedove.profile index 19690cd5a..19690cd5a 100644 --- a/etc/icedove.profile +++ b/etc/profile-a-l/icedove.profile | |||
diff --git a/etc/iceweasel.profile b/etc/profile-a-l/iceweasel.profile index badd2648a..badd2648a 100644 --- a/etc/iceweasel.profile +++ b/etc/profile-a-l/iceweasel.profile | |||
diff --git a/etc/idea.profile b/etc/profile-a-l/idea.profile index 4e43bb629..4e43bb629 100644 --- a/etc/idea.profile +++ b/etc/profile-a-l/idea.profile | |||
diff --git a/etc/idea.sh.profile b/etc/profile-a-l/idea.sh.profile index a7d0d531f..a7d0d531f 100644 --- a/etc/idea.sh.profile +++ b/etc/profile-a-l/idea.sh.profile | |||
diff --git a/etc/ideaIC.profile b/etc/profile-a-l/ideaIC.profile index 7e1778f58..7e1778f58 100644 --- a/etc/ideaIC.profile +++ b/etc/profile-a-l/ideaIC.profile | |||
diff --git a/etc/imagej.profile b/etc/profile-a-l/imagej.profile index 00ee115ed..91a60c188 100644 --- a/etc/imagej.profile +++ b/etc/profile-a-l/imagej.profile | |||
@@ -21,7 +21,6 @@ include disable-programs.inc | |||
21 | caps.drop all | 21 | caps.drop all |
22 | ipc-namespace | 22 | ipc-namespace |
23 | net none | 23 | net none |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | nogroups | 25 | nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -38,3 +37,5 @@ private-bin awk,basename,bash,cut,free,grep,hostname,imagej,ln,ls,mkdir,rm,sort, | |||
38 | private-dev | 37 | private-dev |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/img2txt.profile b/etc/profile-a-l/img2txt.profile index 0b30ec33f..ae03fc8bc 100644 --- a/etc/img2txt.profile +++ b/etc/profile-a-l/img2txt.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | ipc-namespace | 27 | ipc-namespace |
28 | machine-id | 28 | machine-id |
29 | net none | 29 | net none |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -47,4 +46,7 @@ private-cache | |||
47 | private-dev | 46 | private-dev |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
50 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/impressive.profile b/etc/profile-a-l/impressive.profile index 0bfe5de5a..af82fb059 100644 --- a/etc/impressive.profile +++ b/etc/profile-a-l/impressive.profile | |||
@@ -33,7 +33,6 @@ caps.drop all | |||
33 | ipc-namespace | 33 | ipc-namespace |
34 | machine-id | 34 | machine-id |
35 | net none | 35 | net none |
36 | nodbus | ||
37 | nodvd | 36 | nodvd |
38 | nogroups | 37 | nogroups |
39 | nonewprivs | 38 | nonewprivs |
@@ -51,5 +50,8 @@ private-cache | |||
51 | private-dev | 50 | private-dev |
52 | private-tmp | 51 | private-tmp |
53 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
54 | read-only ${HOME} | 56 | read-only ${HOME} |
55 | read-write ${HOME}/.cache/mesa_shader_cache | 57 | read-write ${HOME}/.cache/mesa_shader_cache |
diff --git a/etc/inkscape.profile b/etc/profile-a-l/inkscape.profile index 30cb5d75d..f14868668 100644 --- a/etc/inkscape.profile +++ b/etc/profile-a-l/inkscape.profile | |||
@@ -37,7 +37,6 @@ caps.drop all | |||
37 | ipc-namespace | 37 | ipc-namespace |
38 | machine-id | 38 | machine-id |
39 | net none | 39 | net none |
40 | nodbus | ||
41 | nodvd | 40 | nodvd |
42 | nogroups | 41 | nogroups |
43 | nonewprivs | 42 | nonewprivs |
@@ -56,4 +55,7 @@ private-cache | |||
56 | private-dev | 55 | private-dev |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
59 | # memory-deny-write-execute | 61 | # memory-deny-write-execute |
diff --git a/etc/inkview.profile b/etc/profile-a-l/inkview.profile index 4f88b0258..4f88b0258 100644 --- a/etc/inkview.profile +++ b/etc/profile-a-l/inkview.profile | |||
diff --git a/etc/inox.profile b/etc/profile-a-l/inox.profile index 1b3db73b4..1b3db73b4 100644 --- a/etc/inox.profile +++ b/etc/profile-a-l/inox.profile | |||
diff --git a/etc/iridium-browser.profile b/etc/profile-a-l/iridium-browser.profile index c7ee64d56..c7ee64d56 100644 --- a/etc/iridium-browser.profile +++ b/etc/profile-a-l/iridium-browser.profile | |||
diff --git a/etc/iridium.profile b/etc/profile-a-l/iridium.profile index ebb39b0a3..ebb39b0a3 100644 --- a/etc/iridium.profile +++ b/etc/profile-a-l/iridium.profile | |||
diff --git a/etc/itch.profile b/etc/profile-a-l/itch.profile index b3c78c810..b3c78c810 100644 --- a/etc/itch.profile +++ b/etc/profile-a-l/itch.profile | |||
diff --git a/etc/jd-gui.profile b/etc/profile-a-l/jd-gui.profile index 5b7275718..0944051e5 100644 --- a/etc/jd-gui.profile +++ b/etc/profile-a-l/jd-gui.profile | |||
@@ -23,7 +23,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -41,3 +40,5 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/jdownloader.profile b/etc/profile-a-l/jdownloader.profile index b5f892a9d..b5f892a9d 100644 --- a/etc/jdownloader.profile +++ b/etc/profile-a-l/jdownloader.profile | |||
diff --git a/etc/jerry.profile b/etc/profile-a-l/jerry.profile index f6bfb9953..b79ae0ee0 100644 --- a/etc/jerry.profile +++ b/etc/profile-a-l/jerry.profile | |||
@@ -20,7 +20,6 @@ caps.drop all | |||
20 | machine-id | 20 | machine-id |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -38,4 +37,7 @@ private-dev | |||
38 | private-etc fonts,gtk-2.0,gtk-3.0 | 37 | private-etc fonts,gtk-2.0,gtk-3.0 |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
42 | |||
41 | memory-deny-write-execute | 43 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/jitsi-meet-desktop.profile b/etc/profile-a-l/jitsi-meet-desktop.profile new file mode 100644 index 000000000..c4121d835 --- /dev/null +++ b/etc/profile-a-l/jitsi-meet-desktop.profile | |||
@@ -0,0 +1,39 @@ | |||
1 | # Firejail profile for jitsi-meet-desktop | ||
2 | # Description: Jitsi Meet desktop application powered by Electron | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include jitsi-meet-desktop.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore noexec /tmp | ||
10 | |||
11 | noblacklist ${HOME}/.config/Jitsi Meet | ||
12 | |||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | nowhitelist ${DOWNLOADS} | ||
19 | |||
20 | mkdir ${HOME}/.config/Jitsi Meet | ||
21 | |||
22 | whitelist ${HOME}/.config/Jitsi Meet | ||
23 | |||
24 | include whitelist-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | seccomp !chroot | ||
30 | |||
31 | disable-mnt | ||
32 | private-bin bash,jitsi-meet-desktop | ||
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,drirc,fonts,glvnd,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | ||
36 | private-tmp | ||
37 | |||
38 | # Redirect | ||
39 | include electron.profile | ||
diff --git a/etc/jitsi.profile b/etc/profile-a-l/jitsi.profile index 223c360b8..223c360b8 100644 --- a/etc/jitsi.profile +++ b/etc/profile-a-l/jitsi.profile | |||
diff --git a/etc/profile-a-l/jumpnbump-menu.profile b/etc/profile-a-l/jumpnbump-menu.profile new file mode 100644 index 000000000..b1852b015 --- /dev/null +++ b/etc/profile-a-l/jumpnbump-menu.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for jumpnbump-menu | ||
2 | # Description: Level selection and config menu for the Jump 'n Bump game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include jumpnbump-menu.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | include allow-python3.inc | ||
11 | |||
12 | private-bin jumpnbump-menu,python3* | ||
13 | |||
14 | # Redirect | ||
15 | include jumpnbump.profile | ||
diff --git a/etc/profile-a-l/jumpnbump.profile b/etc/profile-a-l/jumpnbump.profile new file mode 100644 index 000000000..daeb54610 --- /dev/null +++ b/etc/profile-a-l/jumpnbump.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for jumpnbump | ||
2 | # Description: Cute multiplayer platform game with bunnies | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include jumpnbump.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.jumpnbump | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.jumpnbump | ||
20 | whitelist ${HOME}/.jumpnbump | ||
21 | whitelist /usr/share/jumpnbump | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | net none | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,netlink | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin jumpnbump | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc none | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/k3b.profile b/etc/profile-a-l/k3b.profile index 0c1da7ae1..86292744c 100644 --- a/etc/k3b.profile +++ b/etc/profile-a-l/k3b.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.config/k3brc | 9 | noblacklist ${HOME}/.config/k3brc |
10 | noblacklist ${HOME}/.kde/share/config/k3brc | 10 | noblacklist ${HOME}/.kde/share/config/k3brc |
11 | noblacklist ${HOME}/.kde4/share/config/k3brc | 11 | noblacklist ${HOME}/.kde4/share/config/k3brc |
12 | noblacklist ${HOME}/.local/share/kxmlgui5/k3b | ||
12 | noblacklist ${MUSIC} | 13 | noblacklist ${MUSIC} |
13 | 14 | ||
14 | include disable-common.inc | 15 | include disable-common.inc |
diff --git a/etc/kaffeine.profile b/etc/profile-a-l/kaffeine.profile index c7f811939..c7f811939 100644 --- a/etc/kaffeine.profile +++ b/etc/profile-a-l/kaffeine.profile | |||
diff --git a/etc/kalgebra.profile b/etc/profile-a-l/kalgebra.profile index 2dc90b9b9..e1e93163b 100644 --- a/etc/kalgebra.profile +++ b/etc/profile-a-l/kalgebra.profile | |||
@@ -25,7 +25,6 @@ apparmor | |||
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -45,3 +44,6 @@ private-cache | |||
45 | private-dev | 44 | private-dev |
46 | private-etc fonts,machine-id | 45 | private-etc fonts,machine-id |
47 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/kalgebramobile.profile b/etc/profile-a-l/kalgebramobile.profile index d2394fe20..d2394fe20 100644 --- a/etc/kalgebramobile.profile +++ b/etc/profile-a-l/kalgebramobile.profile | |||
diff --git a/etc/karbon.profile b/etc/profile-a-l/karbon.profile index 3b2e93b0a..d54d6d3d0 100644 --- a/etc/karbon.profile +++ b/etc/profile-a-l/karbon.profile | |||
@@ -1,5 +1,7 @@ | |||
1 | # Firejail profile alias for krita | 1 | # Firejail profile alias for krita |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | 3 | ||
4 | noblacklist ${HOME}/.local/share/kxmlgui5/karbon | ||
5 | |||
4 | # Redirect | 6 | # Redirect |
5 | include krita.profile | 7 | include krita.profile |
diff --git a/etc/kate.profile b/etc/profile-a-l/kate.profile index 3035393c4..37605dfa9 100644 --- a/etc/kate.profile +++ b/etc/profile-a-l/kate.profile | |||
@@ -15,6 +15,13 @@ noblacklist ${HOME}/.config/kateschemarc | |||
15 | noblacklist ${HOME}/.config/katesyntaxhighlightingrc | 15 | noblacklist ${HOME}/.config/katesyntaxhighlightingrc |
16 | noblacklist ${HOME}/.config/katevirc | 16 | noblacklist ${HOME}/.config/katevirc |
17 | noblacklist ${HOME}/.local/share/kate | 17 | noblacklist ${HOME}/.local/share/kate |
18 | noblacklist ${HOME}/.local/share/kxmlgui5/kate | ||
19 | noblacklist ${HOME}/.local/share/kxmlgui5/katefiletree | ||
20 | noblacklist ${HOME}/.local/share/kxmlgui5/katekonsole | ||
21 | noblacklist ${HOME}/.local/share/kxmlgui5/kateopenheaderplugin | ||
22 | noblacklist ${HOME}/.local/share/kxmlgui5/katepart | ||
23 | noblacklist ${HOME}/.local/share/kxmlgui5/kateproject | ||
24 | noblacklist ${HOME}/.local/share/kxmlgui5/katesearch | ||
18 | 25 | ||
19 | include disable-common.inc | 26 | include disable-common.inc |
20 | # include disable-devel.inc | 27 | # include disable-devel.inc |
@@ -28,7 +35,6 @@ include whitelist-var-common.inc | |||
28 | # apparmor | 35 | # apparmor |
29 | caps.drop all | 36 | caps.drop all |
30 | # net none | 37 | # net none |
31 | # nodbus | ||
32 | netfilter | 38 | netfilter |
33 | nodvd | 39 | nodvd |
34 | nogroups | 40 | nogroups |
@@ -48,4 +54,7 @@ private-dev | |||
48 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg | 54 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg |
49 | private-tmp | 55 | private-tmp |
50 | 56 | ||
57 | # dbus-user none | ||
58 | # dbus-system none | ||
59 | |||
51 | join-or-start kate | 60 | join-or-start kate |
diff --git a/etc/kcalc.profile b/etc/profile-a-l/kcalc.profile index 8c641802b..fa82e76f3 100644 --- a/etc/kcalc.profile +++ b/etc/profile-a-l/kcalc.profile | |||
@@ -6,6 +6,7 @@ include kcalc.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.local/share/kxmlgui5/kcalc | ||
9 | 10 | ||
10 | include disable-common.inc | 11 | include disable-common.inc |
11 | include disable-devel.inc | 12 | include disable-devel.inc |
@@ -13,13 +14,16 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | 18 | ||
19 | mkdir ${HOME}/.local/share/kxmlgui5/kcalc | ||
17 | mkfile ${HOME}/.config/kcalcrc | 20 | mkfile ${HOME}/.config/kcalcrc |
18 | mkfile ${HOME}/.kde/share/config/kcalcrc | 21 | mkfile ${HOME}/.kde/share/config/kcalcrc |
19 | mkfile ${HOME}/.kde4/share/config/kcalcrc | 22 | mkfile ${HOME}/.kde4/share/config/kcalcrc |
20 | whitelist ${HOME}/.config/kcalcrc | 23 | whitelist ${HOME}/.config/kcalcrc |
21 | whitelist ${HOME}/.kde/share/config/kcalcrc | 24 | whitelist ${HOME}/.kde/share/config/kcalcrc |
22 | whitelist ${HOME}/.kde4/share/config/kcalcrc | 25 | whitelist ${HOME}/.kde4/share/config/kcalcrc |
26 | whitelist ${HOME}/.local/share/kxmlgui5/kcalc | ||
23 | include whitelist-common.inc | 27 | include whitelist-common.inc |
24 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
25 | 29 | ||
@@ -27,7 +31,6 @@ apparmor | |||
27 | caps.drop all | 31 | caps.drop all |
28 | net none | 32 | net none |
29 | no3d | 33 | no3d |
30 | nodbus | ||
31 | nodvd | 34 | nodvd |
32 | nogroups | 35 | nogroups |
33 | nonewprivs | 36 | nonewprivs |
@@ -46,3 +49,5 @@ private-dev | |||
46 | # private-lib - problems on Arch | 49 | # private-lib - problems on Arch |
47 | private-tmp | 50 | private-tmp |
48 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/kdeinit4.profile b/etc/profile-a-l/kdeinit4.profile index 082045c62..f7235ea84 100644 --- a/etc/kdeinit4.profile +++ b/etc/profile-a-l/kdeinit4.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
18 | 19 | ||
diff --git a/etc/kdenlive.profile b/etc/profile-a-l/kdenlive.profile index 361109127..9ca33b68e 100644 --- a/etc/kdenlive.profile +++ b/etc/profile-a-l/kdenlive.profile | |||
@@ -11,6 +11,7 @@ ignore noexec ${HOME} | |||
11 | noblacklist ${HOME}/.cache/kdenlive | 11 | noblacklist ${HOME}/.cache/kdenlive |
12 | noblacklist ${HOME}/.config/kdenliverc | 12 | noblacklist ${HOME}/.config/kdenliverc |
13 | noblacklist ${HOME}/.local/share/kdenlive | 13 | noblacklist ${HOME}/.local/share/kdenlive |
14 | noblacklist ${HOME}/.local/share/kxmlgui5/kdenlive | ||
14 | 15 | ||
15 | include disable-common.inc | 16 | include disable-common.inc |
16 | include disable-devel.inc | 17 | include disable-devel.inc |
@@ -22,7 +23,6 @@ include disable-programs.inc | |||
22 | apparmor | 23 | apparmor |
23 | caps.drop all | 24 | caps.drop all |
24 | # net none | 25 | # net none |
25 | # nodbus | ||
26 | nodvd | 26 | nodvd |
27 | nogroups | 27 | nogroups |
28 | nonewprivs | 28 | nonewprivs |
@@ -36,3 +36,6 @@ shell none | |||
36 | private-bin dbus-launch,dvdauthor,ffmpeg,ffplay,ffprobe,genisoimage,kdeinit4,kdeinit4_shutdown,kdeinit4_wrapper,kdeinit5,kdeinit5_shutdown,kdeinit5_wrapper,kdenlive,kdenlive_render,kshell4,kshell5,melt,mlt-melt,vlc,xine | 36 | private-bin dbus-launch,dvdauthor,ffmpeg,ffplay,ffprobe,genisoimage,kdeinit4,kdeinit4_shutdown,kdeinit4_wrapper,kdeinit5,kdeinit5_shutdown,kdeinit5_wrapper,kdenlive,kdenlive_render,kshell4,kshell5,melt,mlt-melt,vlc,xine |
37 | private-dev | 37 | private-dev |
38 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,X11,xdg | 38 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,X11,xdg |
39 | |||
40 | # dbus-user none | ||
41 | # dbus-system none | ||
diff --git a/etc/keepass.profile b/etc/profile-a-l/keepass.profile index 9852f8a79..9852f8a79 100644 --- a/etc/keepass.profile +++ b/etc/profile-a-l/keepass.profile | |||
diff --git a/etc/keepass2.profile b/etc/profile-a-l/keepass2.profile index aef236ccc..aef236ccc 100644 --- a/etc/keepass2.profile +++ b/etc/profile-a-l/keepass2.profile | |||
diff --git a/etc/keepassx.profile b/etc/profile-a-l/keepassx.profile index 44e9c67bb..b8239e140 100644 --- a/etc/keepassx.profile +++ b/etc/profile-a-l/keepassx.profile | |||
@@ -26,7 +26,6 @@ caps.drop all | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -45,4 +44,7 @@ private-dev | |||
45 | private-etc alternatives,fonts,machine-id | 44 | private-etc alternatives,fonts,machine-id |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
48 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/keepassx2.profile b/etc/profile-a-l/keepassx2.profile index fdd27e9f9..fdd27e9f9 100644 --- a/etc/keepassx2.profile +++ b/etc/profile-a-l/keepassx2.profile | |||
diff --git a/etc/keepassxc-cli.profile b/etc/profile-a-l/keepassxc-cli.profile index 925609384..925609384 100644 --- a/etc/keepassxc-cli.profile +++ b/etc/profile-a-l/keepassxc-cli.profile | |||
diff --git a/etc/keepassxc-proxy.profile b/etc/profile-a-l/keepassxc-proxy.profile index b2b6763ee..b2b6763ee 100644 --- a/etc/keepassxc-proxy.profile +++ b/etc/profile-a-l/keepassxc-proxy.profile | |||
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile new file mode 100644 index 000000000..e8fc4e632 --- /dev/null +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -0,0 +1,81 @@ | |||
1 | # Firejail profile for keepassxc | ||
2 | # Description: Cross Platform Password Manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include keepassxc.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/*.kdb | ||
10 | noblacklist ${HOME}/*.kdbx | ||
11 | noblacklist ${HOME}/.cache/keepassxc | ||
12 | noblacklist ${HOME}/.config/keepassxc | ||
13 | noblacklist ${HOME}/.keepassxc | ||
14 | # 2.2.4 needs this path when compiled with "Native messaging browser extension" | ||
15 | noblacklist ${HOME}/.mozilla | ||
16 | noblacklist ${DOCUMENTS} | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | ||
24 | include disable-shell.inc | ||
25 | include disable-xdg.inc | ||
26 | |||
27 | # You can enable whitelisting for keepassxc by uncommenting (or adding to you keepassxc.local) the following lines. | ||
28 | # If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx | ||
29 | #mkdir ${HOME}/Documents/KeePassXC | ||
30 | #whitelist ${HOME}/Documents/KeePassXC | ||
31 | # Needed for KeePassXC-Browser | ||
32 | #mkfile ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | ||
33 | #whitelist ${HOME}/.mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json | ||
34 | #mkdir ${HOME}/.cache/keepassxc | ||
35 | #mkdir ${HOME}/.config/keepassxc | ||
36 | #whitelist ${HOME}/.cache/keepassxc | ||
37 | #whitelist ${HOME}/.config/keepassxc | ||
38 | #include whitelist-common.inc | ||
39 | |||
40 | whitelist /usr/share/keepassxc | ||
41 | include whitelist-usr-share-common.inc | ||
42 | include whitelist-var-common.inc | ||
43 | |||
44 | caps.drop all | ||
45 | machine-id | ||
46 | net none | ||
47 | no3d | ||
48 | nodvd | ||
49 | nogroups | ||
50 | nonewprivs | ||
51 | noroot | ||
52 | nosound | ||
53 | notv | ||
54 | nou2f | ||
55 | novideo | ||
56 | protocol unix,netlink | ||
57 | seccomp | ||
58 | shell none | ||
59 | tracelog | ||
60 | |||
61 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy | ||
62 | private-dev | ||
63 | private-etc alternatives,fonts,ld.so.cache,machine-id | ||
64 | private-tmp | ||
65 | |||
66 | dbus-user filter | ||
67 | #dbus-user.own org.keepassxc.KeePassXC | ||
68 | dbus-user.talk com.canonical.Unity.Session | ||
69 | dbus-user.talk org.freedesktop.ScreenSaver | ||
70 | dbus-user.talk org.freedesktop.login1.Manager | ||
71 | dbus-user.talk org.freedesktop.login1.Session | ||
72 | dbus-user.talk org.gnome.ScreenSaver | ||
73 | dbus-user.talk org.gnome.SessionManager | ||
74 | dbus-user.talk org.gnome.SessionManager.Presence | ||
75 | # Uncomment or add to your keepassxc.local to allow Notifications. | ||
76 | #dbus-user.talk org.freedesktop.Notifications | ||
77 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
78 | dbus-system none | ||
79 | |||
80 | # Mutex is stored in /tmp by default, which is broken by private-tmp | ||
81 | join-or-start keepassxc | ||
diff --git a/etc/kfind.profile b/etc/profile-a-l/kfind.profile index ee4c35825..ed815676a 100644 --- a/etc/kfind.profile +++ b/etc/profile-a-l/kfind.profile | |||
@@ -27,7 +27,6 @@ machine-id | |||
27 | # net none | 27 | # net none |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | # nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -43,3 +42,6 @@ shell none | |||
43 | # private-bin kbuildsycoca4,kdeinit4,kfind | 42 | # private-bin kbuildsycoca4,kdeinit4,kfind |
44 | private-dev | 43 | private-dev |
45 | private-tmp | 44 | private-tmp |
45 | |||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
diff --git a/etc/kget.profile b/etc/profile-a-l/kget.profile index 485edc1a4..5990d0752 100644 --- a/etc/kget.profile +++ b/etc/profile-a-l/kget.profile | |||
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.kde/share/config/kgetrc | |||
12 | noblacklist ${HOME}/.kde4/share/apps/kget | 12 | noblacklist ${HOME}/.kde4/share/apps/kget |
13 | noblacklist ${HOME}/.kde4/share/config/kgetrc | 13 | noblacklist ${HOME}/.kde4/share/config/kgetrc |
14 | noblacklist ${HOME}/.local/share/kget | 14 | noblacklist ${HOME}/.local/share/kget |
15 | noblacklist ${HOME}/.local/share/kxmlgui5/kget | ||
15 | 16 | ||
16 | include disable-common.inc | 17 | include disable-common.inc |
17 | include disable-devel.inc | 18 | include disable-devel.inc |
diff --git a/etc/kid3-cli.profile b/etc/profile-a-l/kid3-cli.profile index bee62b5d9..bee62b5d9 100644 --- a/etc/kid3-cli.profile +++ b/etc/profile-a-l/kid3-cli.profile | |||
diff --git a/etc/kid3-qt.profile b/etc/profile-a-l/kid3-qt.profile index 9bcede077..9bcede077 100644 --- a/etc/kid3-qt.profile +++ b/etc/profile-a-l/kid3-qt.profile | |||
diff --git a/etc/kid3.profile b/etc/profile-a-l/kid3.profile index 01064feb5..aa2e0ad1e 100644 --- a/etc/kid3.profile +++ b/etc/profile-a-l/kid3.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${MUSIC} | 9 | noblacklist ${MUSIC} |
10 | noblacklist ${HOME}/.config/kid3rc | 10 | noblacklist ${HOME}/.config/kid3rc |
11 | noblacklist ${HOME}/.local/share/kxmlgui5/kid3 | ||
11 | 12 | ||
12 | include disable-common.inc | 13 | include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -22,7 +23,6 @@ include whitelist-var-common.inc | |||
22 | apparmor | 23 | apparmor |
23 | caps.drop all | 24 | caps.drop all |
24 | netfilter | 25 | netfilter |
25 | nodbus | ||
26 | nodvd | 26 | nodvd |
27 | nogroups | 27 | nogroups |
28 | nonewprivs | 28 | nonewprivs |
@@ -42,4 +42,7 @@ private-tmp | |||
42 | private-opt none | 42 | private-opt none |
43 | private-srv none | 43 | private-srv none |
44 | 44 | ||
45 | dbus-user none | ||
46 | dbus-system none | ||
47 | |||
45 | memory-deny-write-execute | 48 | memory-deny-write-execute |
diff --git a/etc/kino.profile b/etc/profile-a-l/kino.profile index 9e8d61391..b3ade0dd9 100644 --- a/etc/kino.profile +++ b/etc/profile-a-l/kino.profile | |||
@@ -16,6 +16,9 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | include whitelist-var-common.inc | ||
20 | |||
21 | apparmor | ||
19 | caps.drop all | 22 | caps.drop all |
20 | netfilter | 23 | netfilter |
21 | nogroups | 24 | nogroups |
diff --git a/etc/kiwix-desktop.profile b/etc/profile-a-l/kiwix-desktop.profile index 8b7b12882..d222d6d24 100644 --- a/etc/kiwix-desktop.profile +++ b/etc/profile-a-l/kiwix-desktop.profile | |||
@@ -29,7 +29,6 @@ caps.drop all | |||
29 | ipc-namespace | 29 | ipc-namespace |
30 | netfilter | 30 | netfilter |
31 | # no3d | 31 | # no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -47,3 +46,6 @@ private-cache | |||
47 | private-dev | 46 | private-dev |
48 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl | 47 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl |
49 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/klatexformula.profile b/etc/profile-a-l/klatexformula.profile index d584f6a56..10b689ce5 100644 --- a/etc/klatexformula.profile +++ b/etc/profile-a-l/klatexformula.profile | |||
@@ -24,7 +24,6 @@ apparmor | |||
24 | caps.drop all | 24 | caps.drop all |
25 | machine-id | 25 | machine-id |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
@@ -41,3 +40,6 @@ tracelog | |||
41 | private-cache | 40 | private-cache |
42 | private-dev | 41 | private-dev |
43 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/klatexformula_cmdl.profile b/etc/profile-a-l/klatexformula_cmdl.profile index 9137963c4..9137963c4 100644 --- a/etc/klatexformula_cmdl.profile +++ b/etc/profile-a-l/klatexformula_cmdl.profile | |||
diff --git a/etc/klavaro.profile b/etc/profile-a-l/klavaro.profile index b6b538557..c03d75098 100644 --- a/etc/klavaro.profile +++ b/etc/profile-a-l/klavaro.profile | |||
@@ -29,7 +29,6 @@ caps.drop all | |||
29 | machine-id | 29 | machine-id |
30 | net none | 30 | net none |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,3 +49,6 @@ private-etc alternatives,fonts | |||
50 | private-tmp | 49 | private-tmp |
51 | private-opt none | 50 | private-opt none |
52 | private-srv none | 51 | private-srv none |
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/kmail.profile b/etc/profile-a-l/kmail.profile index 198b05a11..ab4ff10b9 100644 --- a/etc/kmail.profile +++ b/etc/profile-a-l/kmail.profile | |||
@@ -25,6 +25,8 @@ noblacklist ${HOME}/.local/share/apps/korganizer | |||
25 | noblacklist ${HOME}/.local/share/contacts | 25 | noblacklist ${HOME}/.local/share/contacts |
26 | noblacklist ${HOME}/.local/share/emailidentities | 26 | noblacklist ${HOME}/.local/share/emailidentities |
27 | noblacklist ${HOME}/.local/share/kmail2 | 27 | noblacklist ${HOME}/.local/share/kmail2 |
28 | noblacklist ${HOME}/.local/share/kxmlgui5/kmail | ||
29 | noblacklist ${HOME}/.local/share/kxmlgui5/kmail2 | ||
28 | noblacklist ${HOME}/.local/share/local-mail | 30 | noblacklist ${HOME}/.local/share/local-mail |
29 | noblacklist ${HOME}/.local/share/notes | 31 | noblacklist ${HOME}/.local/share/notes |
30 | noblacklist /tmp/akonadi-* | 32 | noblacklist /tmp/akonadi-* |
diff --git a/etc/profile-a-l/kmplayer.profile b/etc/profile-a-l/kmplayer.profile new file mode 100644 index 000000000..7eabde61d --- /dev/null +++ b/etc/profile-a-l/kmplayer.profile | |||
@@ -0,0 +1,41 @@ | |||
1 | # Firejail profile for mplayer | ||
2 | # Description: mplayer KDE GUI (movie player) | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include kmplayer.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/kmplayerrc | ||
10 | noblacklist ${HOME}/.kde/share/config/kmplayerrc | ||
11 | noblacklist ${HOME}/.local/share/kmplayer | ||
12 | noblacklist ${MUSIC} | ||
13 | noblacklist ${VIDEOS} | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nou2f | ||
33 | protocol unix,inet,inet6,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | |||
37 | # private-bin kmplayer,mplayer | ||
38 | private-cache | ||
39 | private-dev | ||
40 | private-tmp | ||
41 | |||
diff --git a/etc/knotes.profile b/etc/profile-a-l/knotes.profile index ababfcdb1..f155d0ad6 100644 --- a/etc/knotes.profile +++ b/etc/profile-a-l/knotes.profile | |||
@@ -12,6 +12,7 @@ include knotes.local | |||
12 | 12 | ||
13 | noblacklist ${HOME}/.config/knotesrc | 13 | noblacklist ${HOME}/.config/knotesrc |
14 | noblacklist ${HOME}/.local/share/knotes | 14 | noblacklist ${HOME}/.local/share/knotes |
15 | noblacklist ${HOME}/.local/share/kxmlgui5/knotes | ||
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include kmail.profile | 18 | include kmail.profile |
diff --git a/etc/kodi.profile b/etc/profile-a-l/kodi.profile index 86afe46b5..63cae6231 100644 --- a/etc/kodi.profile +++ b/etc/profile-a-l/kodi.profile | |||
@@ -33,6 +33,7 @@ caps.drop all | |||
33 | netfilter | 33 | netfilter |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
36 | # Seems to cause issues with Nvidia drivers sometimes (#3501) | ||
36 | noroot | 37 | noroot |
37 | nou2f | 38 | nou2f |
38 | protocol unix,inet,inet6,netlink | 39 | protocol unix,inet,inet6,netlink |
diff --git a/etc/konversation.profile b/etc/profile-a-l/konversation.profile index dd3e9617f..4dd929c6b 100644 --- a/etc/konversation.profile +++ b/etc/profile-a-l/konversation.profile | |||
@@ -7,8 +7,10 @@ include konversation.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/konversationrc | 9 | noblacklist ${HOME}/.config/konversationrc |
10 | noblacklist ${HOME}/.config/konversation.notifyrc | ||
10 | noblacklist ${HOME}/.kde/share/config/konversationrc | 11 | noblacklist ${HOME}/.kde/share/config/konversationrc |
11 | noblacklist ${HOME}/.kde4/share/config/konversationrc | 12 | noblacklist ${HOME}/.kde4/share/config/konversationrc |
13 | noblacklist ${HOME}/.local/share/kxmlgui5/konversation | ||
12 | 14 | ||
13 | include disable-common.inc | 15 | include disable-common.inc |
14 | include disable-devel.inc | 16 | include disable-devel.inc |
@@ -16,6 +18,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 22 | include disable-xdg.inc |
20 | 23 | ||
21 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
diff --git a/etc/kopete.profile b/etc/profile-a-l/kopete.profile index e0bdce059..a5269373d 100644 --- a/etc/kopete.profile +++ b/etc/profile-a-l/kopete.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.kde/share/apps/kopete | |||
10 | noblacklist ${HOME}/.kde/share/config/kopeterc | 10 | noblacklist ${HOME}/.kde/share/config/kopeterc |
11 | noblacklist ${HOME}/.kde4/share/apps/kopete | 11 | noblacklist ${HOME}/.kde4/share/apps/kopete |
12 | noblacklist ${HOME}/.kde4/share/config/kopeterc | 12 | noblacklist ${HOME}/.kde4/share/config/kopeterc |
13 | noblacklist ${HOME}/.local/share/kxmlgui5/kopete | ||
13 | 14 | ||
14 | include disable-common.inc | 15 | include disable-common.inc |
15 | include disable-devel.inc | 16 | include disable-devel.inc |
diff --git a/etc/krita.profile b/etc/profile-a-l/krita.profile index 49c36274a..be9921478 100644 --- a/etc/krita.profile +++ b/etc/profile-a-l/krita.profile | |||
@@ -31,7 +31,6 @@ caps.drop all | |||
31 | ipc-namespace | 31 | ipc-namespace |
32 | # net none | 32 | # net none |
33 | netfilter | 33 | netfilter |
34 | # nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nogroups | 35 | nogroups |
37 | nonewprivs | 36 | nonewprivs |
@@ -47,3 +46,6 @@ shell none | |||
47 | private-cache | 46 | private-cache |
48 | private-dev | 47 | private-dev |
49 | private-tmp | 48 | private-tmp |
49 | |||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
diff --git a/etc/krunner.profile b/etc/profile-a-l/krunner.profile index c64113c15..c64113c15 100644 --- a/etc/krunner.profile +++ b/etc/profile-a-l/krunner.profile | |||
diff --git a/etc/ktorrent.profile b/etc/profile-a-l/ktorrent.profile index 2eb46a7e8..b55e00f22 100644 --- a/etc/ktorrent.profile +++ b/etc/profile-a-l/ktorrent.profile | |||
@@ -12,6 +12,7 @@ noblacklist ${HOME}/.kde/share/config/ktorrentrc | |||
12 | noblacklist ${HOME}/.kde4/share/apps/ktorrent | 12 | noblacklist ${HOME}/.kde4/share/apps/ktorrent |
13 | noblacklist ${HOME}/.kde4/share/config/ktorrentrc | 13 | noblacklist ${HOME}/.kde4/share/config/ktorrentrc |
14 | noblacklist ${HOME}/.local/share/ktorrent | 14 | noblacklist ${HOME}/.local/share/ktorrent |
15 | noblacklist ${HOME}/.local/share/kxmlgui5/ktorrent | ||
15 | 16 | ||
16 | include disable-common.inc | 17 | include disable-common.inc |
17 | include disable-devel.inc | 18 | include disable-devel.inc |
@@ -19,10 +20,12 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
22 | 24 | ||
23 | mkdir ${HOME}/.kde/share/apps/ktorrent | 25 | mkdir ${HOME}/.kde/share/apps/ktorrent |
24 | mkdir ${HOME}/.kde4/share/apps/ktorrent | 26 | mkdir ${HOME}/.kde4/share/apps/ktorrent |
25 | mkdir ${HOME}/.local/share/ktorrent | 27 | mkdir ${HOME}/.local/share/ktorrent |
28 | mkdir ${HOME}/.local/share/kxmlgui5/ktorrent | ||
26 | mkfile ${HOME}/.config/ktorrentrc | 29 | mkfile ${HOME}/.config/ktorrentrc |
27 | mkfile ${HOME}/.kde/share/config/ktorrentrc | 30 | mkfile ${HOME}/.kde/share/config/ktorrentrc |
28 | mkfile ${HOME}/.kde4/share/config/ktorrentrc | 31 | mkfile ${HOME}/.kde4/share/config/ktorrentrc |
@@ -33,6 +36,7 @@ whitelist ${HOME}/.kde/share/config/ktorrentrc | |||
33 | whitelist ${HOME}/.kde4/share/apps/ktorrent | 36 | whitelist ${HOME}/.kde4/share/apps/ktorrent |
34 | whitelist ${HOME}/.kde4/share/config/ktorrentrc | 37 | whitelist ${HOME}/.kde4/share/config/ktorrentrc |
35 | whitelist ${HOME}/.local/share/ktorrent | 38 | whitelist ${HOME}/.local/share/ktorrent |
39 | whitelist ${HOME}/.local/share/kxmlgui5/ktorrent | ||
36 | include whitelist-common.inc | 40 | include whitelist-common.inc |
37 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
38 | 42 | ||
diff --git a/etc/ktouch.profile b/etc/profile-a-l/ktouch.profile index 446bc50ee..8d8bcdd7d 100644 --- a/etc/ktouch.profile +++ b/etc/profile-a-l/ktouch.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkfile ${HOME}/.config/ktouch2rc | 21 | mkfile ${HOME}/.config/ktouch2rc |
@@ -28,7 +29,6 @@ apparmor | |||
28 | caps.drop all | 29 | caps.drop all |
29 | machine-id | 30 | machine-id |
30 | net none | 31 | net none |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -48,3 +48,6 @@ private-cache | |||
48 | private-dev | 48 | private-dev |
49 | private-etc alternatives,fonts,kde5rc,machine-id | 49 | private-etc alternatives,fonts,kde5rc,machine-id |
50 | private-tmp | 50 | private-tmp |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/kwin_x11.profile b/etc/profile-a-l/kwin_x11.profile index d512dd100..316a93d30 100644 --- a/etc/kwin_x11.profile +++ b/etc/profile-a-l/kwin_x11.profile | |||
@@ -19,6 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-shell.inc | ||
22 | include disable-xdg.inc | 23 | include disable-xdg.inc |
23 | 24 | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
diff --git a/etc/kwrite.profile b/etc/profile-a-l/kwrite.profile index 31ac19039..4ff8efa70 100644 --- a/etc/kwrite.profile +++ b/etc/profile-a-l/kwrite.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.config/katesyntaxhighlightingrc | |||
13 | noblacklist ${HOME}/.config/katevirc | 13 | noblacklist ${HOME}/.config/katevirc |
14 | noblacklist ${HOME}/.config/kwriterc | 14 | noblacklist ${HOME}/.config/kwriterc |
15 | noblacklist ${HOME}/.local/share/kwrite | 15 | noblacklist ${HOME}/.local/share/kwrite |
16 | noblacklist ${HOME}/.local/share/kxmlgui5/kwrite | ||
16 | noblacklist ${DOCUMENTS} | 17 | noblacklist ${DOCUMENTS} |
17 | 18 | ||
18 | include disable-common.inc | 19 | include disable-common.inc |
@@ -21,6 +22,7 @@ include disable-exec.inc | |||
21 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-shell.inc | ||
24 | include disable-xdg.inc | 26 | include disable-xdg.inc |
25 | 27 | ||
26 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
@@ -29,7 +31,6 @@ apparmor | |||
29 | caps.drop all | 31 | caps.drop all |
30 | # net none | 32 | # net none |
31 | netfilter | 33 | netfilter |
32 | # nodbus | ||
33 | nodvd | 34 | nodvd |
34 | nogroups | 35 | nogroups |
35 | nonewprivs | 36 | nonewprivs |
@@ -48,5 +49,7 @@ private-dev | |||
48 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg | 49 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg |
49 | private-tmp | 50 | private-tmp |
50 | 51 | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
51 | 54 | ||
52 | join-or-start kwrite | 55 | join-or-start kwrite |
diff --git a/etc/latex-common.profile b/etc/profile-a-l/latex-common.profile index 712ada722..b090be726 100644 --- a/etc/latex-common.profile +++ b/etc/profile-a-l/latex-common.profile | |||
@@ -14,12 +14,12 @@ include disable-passwdmgr.inc | |||
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | 15 | ||
16 | whitelist /var/lib | 16 | whitelist /var/lib |
17 | include whitelist-runuser-common.inc | ||
17 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | net none | 21 | net none |
21 | no3d | 22 | no3d |
22 | nodbus | ||
23 | nodvd | 23 | nodvd |
24 | nogroups | 24 | nogroups |
25 | nonewprivs | 25 | nonewprivs |
@@ -37,3 +37,5 @@ private-cache | |||
37 | private-dev | 37 | private-dev |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/latex.profile b/etc/profile-a-l/latex.profile index 2230dd570..2230dd570 100644 --- a/etc/latex.profile +++ b/etc/profile-a-l/latex.profile | |||
diff --git a/etc/lbunzip2.profile b/etc/profile-a-l/lbunzip2.profile index 338d8c8bb..338d8c8bb 100644 --- a/etc/lbunzip2.profile +++ b/etc/profile-a-l/lbunzip2.profile | |||
diff --git a/etc/lbzcat.profile b/etc/profile-a-l/lbzcat.profile index 338d8c8bb..338d8c8bb 100644 --- a/etc/lbzcat.profile +++ b/etc/profile-a-l/lbzcat.profile | |||
diff --git a/etc/lbzip2.profile b/etc/profile-a-l/lbzip2.profile index 338d8c8bb..338d8c8bb 100644 --- a/etc/lbzip2.profile +++ b/etc/profile-a-l/lbzip2.profile | |||
diff --git a/etc/leafpad.profile b/etc/profile-a-l/leafpad.profile index 56a792c8e..eb23b200b 100644 --- a/etc/leafpad.profile +++ b/etc/profile-a-l/leafpad.profile | |||
@@ -14,11 +14,13 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
21 | apparmor | ||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | net none |
22 | no3d | 24 | no3d |
23 | nodvd | 25 | nodvd |
24 | nogroups | 26 | nogroups |
diff --git a/etc/less.profile b/etc/profile-a-l/less.profile index 00624e0f1..de6fa67d1 100644 --- a/etc/less.profile +++ b/etc/profile-a-l/less.profile | |||
@@ -8,6 +8,7 @@ include less.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${HOME}/.lesshst | 13 | noblacklist ${HOME}/.lesshst |
13 | 14 | ||
@@ -22,7 +23,6 @@ ipc-namespace | |||
22 | machine-id | 23 | machine-id |
23 | net none | 24 | net none |
24 | no3d | 25 | no3d |
25 | nodbus | ||
26 | nodvd | 26 | nodvd |
27 | nonewprivs | 27 | nonewprivs |
28 | #noroot | 28 | #noroot |
@@ -44,6 +44,9 @@ private-cache | |||
44 | private-dev | 44 | private-dev |
45 | writable-var-log | 45 | writable-var-log |
46 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
47 | memory-deny-write-execute | 50 | memory-deny-write-execute |
48 | read-only ${HOME} | 51 | read-only ${HOME} |
49 | read-write ${HOME}/.lesshst | 52 | read-write ${HOME}/.lesshst |
diff --git a/etc/libreoffice.profile b/etc/profile-a-l/libreoffice.profile index aa113883e..f9c92f6f6 100644 --- a/etc/libreoffice.profile +++ b/etc/profile-a-l/libreoffice.profile | |||
@@ -46,4 +46,6 @@ tracelog | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-system none | ||
50 | |||
49 | join-or-start libreoffice | 51 | join-or-start libreoffice |
diff --git a/etc/liferea.profile b/etc/profile-a-l/liferea.profile index 7cfd4fc10..7cfd4fc10 100644 --- a/etc/liferea.profile +++ b/etc/profile-a-l/liferea.profile | |||
diff --git a/etc/profile-a-l/lightsoff.profile b/etc/profile-a-l/lightsoff.profile new file mode 100644 index 000000000..c065c44a9 --- /dev/null +++ b/etc/profile-a-l/lightsoff.profile | |||
@@ -0,0 +1,16 @@ | |||
1 | # Firejail profile for lightsoff | ||
2 | # Description: GNOME Lightsoff game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lightsoff.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | whitelist /usr/share/lightsoff | ||
10 | |||
11 | private-bin lightsoff | ||
12 | |||
13 | dbus-user.own org.gnome.LightsOff | ||
14 | |||
15 | # Redirect | ||
16 | include gnome_games-common.profile | ||
diff --git a/etc/lincity-ng.profile b/etc/profile-a-l/lincity-ng.profile index b55ac9a15..91bd12d0d 100644 --- a/etc/lincity-ng.profile +++ b/etc/profile-a-l/lincity-ng.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.lincity-ng | 20 | mkdir ${HOME}/.lincity-ng |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.lincity-ng | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | net none |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin lincity-ng | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/links.profile b/etc/profile-a-l/links.profile index a31001c87..b2f94d3cf 100644 --- a/etc/links.profile +++ b/etc/profile-a-l/links.profile | |||
@@ -24,6 +24,7 @@ include disable-xdg.inc | |||
24 | mkdir ${HOME}/.links | 24 | mkdir ${HOME}/.links |
25 | whitelist ${HOME}/.links | 25 | whitelist ${HOME}/.links |
26 | whitelist ${DOWNLOADS} | 26 | whitelist ${DOWNLOADS} |
27 | include whitelist-runuser-common.inc | ||
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
29 | caps.drop all | 30 | caps.drop all |
diff --git a/etc/linphone.profile b/etc/profile-a-l/linphone.profile index dc156b298..dc156b298 100644 --- a/etc/linphone.profile +++ b/etc/profile-a-l/linphone.profile | |||
diff --git a/etc/lmms.profile b/etc/profile-a-l/lmms.profile index 98ddd03e5..afe1ad635 100644 --- a/etc/lmms.profile +++ b/etc/profile-a-l/lmms.profile | |||
@@ -22,7 +22,6 @@ caps.drop all | |||
22 | ipc-namespace | 22 | ipc-namespace |
23 | net none | 23 | net none |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -37,3 +36,5 @@ shell none | |||
37 | private-dev | 36 | private-dev |
38 | private-tmp | 37 | private-tmp |
39 | 38 | ||
39 | dbus-user none | ||
40 | dbus-system none | ||
diff --git a/etc/lobase.profile b/etc/profile-a-l/lobase.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lobase.profile +++ b/etc/profile-a-l/lobase.profile | |||
diff --git a/etc/localc.profile b/etc/profile-a-l/localc.profile index 8348a57fe..8348a57fe 100644 --- a/etc/localc.profile +++ b/etc/profile-a-l/localc.profile | |||
diff --git a/etc/lodraw.profile b/etc/profile-a-l/lodraw.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lodraw.profile +++ b/etc/profile-a-l/lodraw.profile | |||
diff --git a/etc/loffice.profile b/etc/profile-a-l/loffice.profile index 8348a57fe..8348a57fe 100644 --- a/etc/loffice.profile +++ b/etc/profile-a-l/loffice.profile | |||
diff --git a/etc/lofromtemplate.profile b/etc/profile-a-l/lofromtemplate.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lofromtemplate.profile +++ b/etc/profile-a-l/lofromtemplate.profile | |||
diff --git a/etc/loimpress.profile b/etc/profile-a-l/loimpress.profile index 8348a57fe..8348a57fe 100644 --- a/etc/loimpress.profile +++ b/etc/profile-a-l/loimpress.profile | |||
diff --git a/etc/lollypop.profile b/etc/profile-a-l/lollypop.profile index 1ce83822d..1ce83822d 100644 --- a/etc/lollypop.profile +++ b/etc/profile-a-l/lollypop.profile | |||
diff --git a/etc/lomath.profile b/etc/profile-a-l/lomath.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lomath.profile +++ b/etc/profile-a-l/lomath.profile | |||
diff --git a/etc/loweb.profile b/etc/profile-a-l/loweb.profile index 8348a57fe..8348a57fe 100644 --- a/etc/loweb.profile +++ b/etc/profile-a-l/loweb.profile | |||
diff --git a/etc/lowriter.profile b/etc/profile-a-l/lowriter.profile index 8348a57fe..8348a57fe 100644 --- a/etc/lowriter.profile +++ b/etc/profile-a-l/lowriter.profile | |||
diff --git a/etc/lrunzip.profile b/etc/profile-a-l/lrunzip.profile index c010cbd96..c010cbd96 100644 --- a/etc/lrunzip.profile +++ b/etc/profile-a-l/lrunzip.profile | |||
diff --git a/etc/lrz.profile b/etc/profile-a-l/lrz.profile index 8077be945..8077be945 100644 --- a/etc/lrz.profile +++ b/etc/profile-a-l/lrz.profile | |||
diff --git a/etc/lrzcat.profile b/etc/profile-a-l/lrzcat.profile index d05ee7aae..d05ee7aae 100644 --- a/etc/lrzcat.profile +++ b/etc/profile-a-l/lrzcat.profile | |||
diff --git a/etc/lrzip.profile b/etc/profile-a-l/lrzip.profile index 3767767f6..3767767f6 100644 --- a/etc/lrzip.profile +++ b/etc/profile-a-l/lrzip.profile | |||
diff --git a/etc/lrztar.profile b/etc/profile-a-l/lrztar.profile index 673e9f62e..673e9f62e 100644 --- a/etc/lrztar.profile +++ b/etc/profile-a-l/lrztar.profile | |||
diff --git a/etc/lrzuntar.profile b/etc/profile-a-l/lrzuntar.profile index 245d1c669..245d1c669 100644 --- a/etc/lrzuntar.profile +++ b/etc/profile-a-l/lrzuntar.profile | |||
diff --git a/etc/lugaru.profile b/etc/profile-a-l/lugaru.profile index d81441572..cd8f0e529 100644 --- a/etc/lugaru.profile +++ b/etc/profile-a-l/lugaru.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | mkdir ${HOME}/.config/lugaru | 23 | mkdir ${HOME}/.config/lugaru |
@@ -29,7 +30,6 @@ include whitelist-var-common.inc | |||
29 | caps.drop all | 30 | caps.drop all |
30 | ipc-namespace | 31 | ipc-namespace |
31 | net none | 32 | net none |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -47,3 +47,6 @@ private-bin lugaru | |||
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/luminance-hdr.profile b/etc/profile-a-l/luminance-hdr.profile index 2b0feaa17..2b0feaa17 100644 --- a/etc/luminance-hdr.profile +++ b/etc/profile-a-l/luminance-hdr.profile | |||
diff --git a/etc/lximage-qt.profile b/etc/profile-a-l/lximage-qt.profile index 74adb7a67..a33ddab78 100644 --- a/etc/lximage-qt.profile +++ b/etc/profile-a-l/lximage-qt.profile | |||
@@ -14,9 +14,11 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include whitelist-var-common.inc | ||
17 | 18 | ||
19 | apparmor | ||
18 | caps.drop all | 20 | caps.drop all |
19 | netfilter | 21 | net none |
20 | no3d | 22 | no3d |
21 | nodvd | 23 | nodvd |
22 | nogroups | 24 | nogroups |
diff --git a/etc/lxmusic.profile b/etc/profile-a-l/lxmusic.profile index e1a37343e..9094f4377 100644 --- a/etc/lxmusic.profile +++ b/etc/profile-a-l/lxmusic.profile | |||
@@ -20,6 +20,7 @@ include disable-xdg.inc | |||
20 | 20 | ||
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
22 | 22 | ||
23 | apparmor | ||
23 | caps.drop all | 24 | caps.drop all |
24 | netfilter | 25 | netfilter |
25 | no3d | 26 | no3d |
diff --git a/etc/lynx.profile b/etc/profile-a-l/lynx.profile index fb6fe94ec..dbd0a61e5 100644 --- a/etc/lynx.profile +++ b/etc/profile-a-l/lynx.profile | |||
@@ -16,6 +16,8 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | include whitelist-runuser-common.inc | ||
20 | |||
19 | caps.drop all | 21 | caps.drop all |
20 | netfilter | 22 | netfilter |
21 | no3d | 23 | no3d |
diff --git a/etc/profile-a-l/lyx.profile b/etc/profile-a-l/lyx.profile new file mode 100644 index 000000000..b2c0afbe7 --- /dev/null +++ b/etc/profile-a-l/lyx.profile | |||
@@ -0,0 +1,33 @@ | |||
1 | # Firejail profile for lyx | ||
2 | # Description: Open source document processor based on LaTeX typsetting | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lyx.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore private-tmp | ||
10 | |||
11 | noblacklist ${HOME}/.config/LyX | ||
12 | noblacklist ${HOME}/.lyx | ||
13 | |||
14 | include allow-lua.inc | ||
15 | include allow-perl.inc | ||
16 | include allow-python2.inc | ||
17 | include allow-python3.inc | ||
18 | |||
19 | whitelist /usr/share/lyx | ||
20 | whitelist /usr/share/texinfo | ||
21 | whitelist /usr/share/texlive | ||
22 | whitelist /usr/share/texmf-dist | ||
23 | whitelist /usr/share/tlpkg | ||
24 | include whitelist-usr-share-common.inc | ||
25 | |||
26 | apparmor | ||
27 | machine-id | ||
28 | |||
29 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex | ||
30 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,lyx,mime.types,passwd,texmf,X11,xdg | ||
31 | |||
32 | # Redirect | ||
33 | include latex-common.profile | ||
diff --git a/etc/lzcat.profile b/etc/profile-a-l/lzcat.profile index f7410b928..d9c72407f 100644 --- a/etc/lzcat.profile +++ b/etc/profile-a-l/lzcat.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzcmp.profile b/etc/profile-a-l/lzcmp.profile index f7410b928..d9c72407f 100644 --- a/etc/lzcmp.profile +++ b/etc/profile-a-l/lzcmp.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzdiff.profile b/etc/profile-a-l/lzdiff.profile index f7410b928..f7410b928 100644 --- a/etc/lzdiff.profile +++ b/etc/profile-a-l/lzdiff.profile | |||
diff --git a/etc/lzegrep.profile b/etc/profile-a-l/lzegrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzegrep.profile +++ b/etc/profile-a-l/lzegrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzfgrep.profile b/etc/profile-a-l/lzfgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzfgrep.profile +++ b/etc/profile-a-l/lzfgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzgrep.profile b/etc/profile-a-l/lzgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/lzgrep.profile +++ b/etc/profile-a-l/lzgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzip.profile b/etc/profile-a-l/lzip.profile index f7410b928..d9c72407f 100644 --- a/etc/lzip.profile +++ b/etc/profile-a-l/lzip.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzless.profile b/etc/profile-a-l/lzless.profile index f7410b928..d9c72407f 100644 --- a/etc/lzless.profile +++ b/etc/profile-a-l/lzless.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzma.profile b/etc/profile-a-l/lzma.profile index f7410b928..d9c72407f 100644 --- a/etc/lzma.profile +++ b/etc/profile-a-l/lzma.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzmadec.profile b/etc/profile-a-l/lzmadec.profile index 0c5ec1b09..0c5ec1b09 100644 --- a/etc/lzmadec.profile +++ b/etc/profile-a-l/lzmadec.profile | |||
diff --git a/etc/lzmainfo.profile b/etc/profile-a-l/lzmainfo.profile index f7410b928..d9c72407f 100644 --- a/etc/lzmainfo.profile +++ b/etc/profile-a-l/lzmainfo.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/lzmore.profile b/etc/profile-a-l/lzmore.profile index f7410b928..d9c72407f 100644 --- a/etc/lzmore.profile +++ b/etc/profile-a-l/lzmore.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/Maelstrom.profile b/etc/profile-m-z/Maelstrom.profile index cee49111e..77bce4179 100644 --- a/etc/Maelstrom.profile +++ b/etc/profile-m-z/Maelstrom.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | whitelist /var/lib/games | 20 | whitelist /var/lib/games |
@@ -23,7 +24,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 24 | caps.drop all |
24 | ipc-namespace | 25 | ipc-namespace |
25 | net none | 26 | net none |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | #nonewprivs | 29 | #nonewprivs |
@@ -41,3 +41,6 @@ private-bin Maelstrom | |||
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
44 | |||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/Maps.profile b/etc/profile-m-z/Maps.profile index c52d2f2da..c52d2f2da 100644 --- a/etc/Maps.profile +++ b/etc/profile-m-z/Maps.profile | |||
diff --git a/etc/Mathematica.profile b/etc/profile-m-z/Mathematica.profile index c2734b1c1..c2734b1c1 100644 --- a/etc/Mathematica.profile +++ b/etc/profile-m-z/Mathematica.profile | |||
diff --git a/etc/Natron.profile b/etc/profile-m-z/Natron.profile index 42c22bf67..42c22bf67 100644 --- a/etc/Natron.profile +++ b/etc/profile-m-z/Natron.profile | |||
diff --git a/etc/PPSSPPQt.profile b/etc/profile-m-z/PPSSPPQt.profile index c5592f99c..c5592f99c 100644 --- a/etc/PPSSPPQt.profile +++ b/etc/profile-m-z/PPSSPPQt.profile | |||
diff --git a/etc/QMediathekView.profile b/etc/profile-m-z/QMediathekView.profile index b9ddd80c4..589dcfeb6 100644 --- a/etc/QMediathekView.profile +++ b/etc/profile-m-z/QMediathekView.profile | |||
@@ -25,6 +25,7 @@ include disable-exec.inc | |||
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | 26 | include disable-passwdmgr.inc |
27 | include disable-programs.inc | 27 | include disable-programs.inc |
28 | include disable-shell.inc | ||
28 | include disable-xdg.inc | 29 | include disable-xdg.inc |
29 | 30 | ||
30 | whitelist /usr/share/qtchooser | 31 | whitelist /usr/share/qtchooser |
@@ -34,7 +35,6 @@ include whitelist-var-common.inc | |||
34 | caps.drop all | 35 | caps.drop all |
35 | netfilter | 36 | netfilter |
36 | # no3d | 37 | # no3d |
37 | # nodbus | ||
38 | nodvd | 38 | nodvd |
39 | nogroups | 39 | nogroups |
40 | nonewprivs | 40 | nonewprivs |
@@ -53,4 +53,7 @@ private-cache | |||
53 | private-dev | 53 | private-dev |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | # dbus-user none | ||
57 | # dbus-system none | ||
58 | |||
56 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 59 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/QOwnNotes.profile b/etc/profile-m-z/QOwnNotes.profile index 8157cdff4..e2dcf17e0 100644 --- a/etc/QOwnNotes.profile +++ b/etc/profile-m-z/QOwnNotes.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | mkdir ${HOME}/Nextcloud/Notes | 23 | mkdir ${HOME}/Nextcloud/Notes |
diff --git a/etc/profile-m-z/Screenshot.profile b/etc/profile-m-z/Screenshot.profile new file mode 100644 index 000000000..d4b083736 --- /dev/null +++ b/etc/profile-m-z/Screenshot.profile | |||
@@ -0,0 +1,6 @@ | |||
1 | # Firejail profile for gnome-screenshot | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Temporary fix for https://github.com/netblue30/firejail/issues/2624 | ||
5 | # Redirect | ||
6 | include gnome-screenshot.profile | ||
diff --git a/etc/Telegram.profile b/etc/profile-m-z/Telegram.profile index 310e0237e..310e0237e 100644 --- a/etc/Telegram.profile +++ b/etc/profile-m-z/Telegram.profile | |||
diff --git a/etc/profile-m-z/Thunar.profile b/etc/profile-m-z/Thunar.profile new file mode 100644 index 000000000..28acb414b --- /dev/null +++ b/etc/profile-m-z/Thunar.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for Thunar | ||
2 | # Description: File Manager for Xfce | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include Thunar.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your pcmanfm.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/Viber.profile b/etc/profile-m-z/Viber.profile index 925e130de..3195e39fa 100644 --- a/etc/Viber.profile +++ b/etc/profile-m-z/Viber.profile | |||
@@ -6,6 +6,7 @@ include Viber.local | |||
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | noblacklist ${HOME}/.ViberPC | 8 | noblacklist ${HOME}/.ViberPC |
9 | noblacklist ${PATH}/dig | ||
9 | 10 | ||
10 | include disable-common.inc | 11 | include disable-common.inc |
11 | include disable-devel.inc | 12 | include disable-devel.inc |
diff --git a/etc/VirtualBox.profile b/etc/profile-m-z/VirtualBox.profile index 4c99ae9a3..4c99ae9a3 100644 --- a/etc/VirtualBox.profile +++ b/etc/profile-m-z/VirtualBox.profile | |||
diff --git a/etc/XMind.profile b/etc/profile-m-z/XMind.profile index 7e7c0c3cd..7e7c0c3cd 100644 --- a/etc/XMind.profile +++ b/etc/profile-m-z/XMind.profile | |||
diff --git a/etc/Xephyr.profile b/etc/profile-m-z/Xephyr.profile index ab5fdf942..ab5fdf942 100644 --- a/etc/Xephyr.profile +++ b/etc/profile-m-z/Xephyr.profile | |||
diff --git a/etc/Xvfb.profile b/etc/profile-m-z/Xvfb.profile index 937d02d60..937d02d60 100644 --- a/etc/Xvfb.profile +++ b/etc/profile-m-z/Xvfb.profile | |||
diff --git a/etc/profile-m-z/ZeGrapher.profile b/etc/profile-m-z/ZeGrapher.profile new file mode 100644 index 000000000..02c5a043d --- /dev/null +++ b/etc/profile-m-z/ZeGrapher.profile | |||
@@ -0,0 +1,48 @@ | |||
1 | # Firejail profile for ZeGrapher | ||
2 | # Description: Free and opensource math graphing software | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ZeGrapher.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/ZeGrapher Project | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | |||
19 | whitelist /usr/share/ZeGrapher | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | nodvd | ||
29 | nogroups | ||
30 | nonewprivs | ||
31 | noroot | ||
32 | nosound | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,netlink | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin ZeGrapher | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-tmp | ||
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/macrofusion.profile b/etc/profile-m-z/macrofusion.profile index 94d90780b..2e0071b47 100644 --- a/etc/macrofusion.profile +++ b/etc/profile-m-z/macrofusion.profile | |||
@@ -18,12 +18,12 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | caps.drop all | 24 | caps.drop all |
24 | ipc-namespace | 25 | ipc-namespace |
25 | net none | 26 | net none |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -41,3 +41,5 @@ private-cache | |||
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/profile-m-z/magicor.profile b/etc/profile-m-z/magicor.profile new file mode 100644 index 000000000..d26aed0bb --- /dev/null +++ b/etc/profile-m-z/magicor.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for magicor | ||
2 | # Description: Push ice blocks around to extinguish all fires | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include magicor.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.magicor | ||
10 | |||
11 | # Allow python (blacklisted by disable-interpreters.inc) | ||
12 | include allow-python2.inc | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | mkdir ${HOME}/.magicor | ||
24 | whitelist ${HOME}/.magicor | ||
25 | whitelist /usr/share/magicor | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | net none | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | notv | ||
37 | nou2f | ||
38 | novideo | ||
39 | protocol unix | ||
40 | seccomp | ||
41 | shell none | ||
42 | tracelog | ||
43 | |||
44 | disable-mnt | ||
45 | private-bin magicor,python2* | ||
46 | private-cache | ||
47 | private-dev | ||
48 | private-etc machine-id | ||
49 | private-tmp | ||
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/makepkg.profile b/etc/profile-m-z/makepkg.profile index 513fcae55..513fcae55 100644 --- a/etc/makepkg.profile +++ b/etc/profile-m-z/makepkg.profile | |||
diff --git a/etc/manaplus.profile b/etc/profile-m-z/manaplus.profile index 93d409bf8..eba77c8f2 100644 --- a/etc/manaplus.profile +++ b/etc/profile-m-z/manaplus.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.config/mana | 21 | mkdir ${HOME}/.config/mana |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | caps.drop all | 29 | caps.drop all |
29 | ipc-namespace | 30 | ipc-namespace |
30 | netfilter | 31 | netfilter |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -46,3 +46,6 @@ private-bin manaplus | |||
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-tmp | 48 | private-tmp |
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/masterpdfeditor.profile b/etc/profile-m-z/masterpdfeditor.profile index e4da0c66a..e4da0c66a 100644 --- a/etc/masterpdfeditor.profile +++ b/etc/profile-m-z/masterpdfeditor.profile | |||
diff --git a/etc/masterpdfeditor4.profile b/etc/profile-m-z/masterpdfeditor4.profile index 84e78171f..84e78171f 100644 --- a/etc/masterpdfeditor4.profile +++ b/etc/profile-m-z/masterpdfeditor4.profile | |||
diff --git a/etc/masterpdfeditor5.profile b/etc/profile-m-z/masterpdfeditor5.profile index 057d343dd..057d343dd 100644 --- a/etc/masterpdfeditor5.profile +++ b/etc/profile-m-z/masterpdfeditor5.profile | |||
diff --git a/etc/mate-calc.profile b/etc/profile-m-z/mate-calc.profile index 2f6020ad3..ce418d68f 100644 --- a/etc/mate-calc.profile +++ b/etc/profile-m-z/mate-calc.profile | |||
@@ -22,11 +22,12 @@ whitelist ${HOME}/.cache/mate-calc | |||
22 | whitelist ${HOME}/.config/caja | 22 | whitelist ${HOME}/.config/caja |
23 | whitelist ${HOME}/.config/mate-menu | 23 | whitelist ${HOME}/.config/mate-menu |
24 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-var-common.inc | ||
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | net none | 29 | net none |
28 | no3d | 30 | no3d |
29 | nodbus | ||
30 | nodvd | 31 | nodvd |
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
@@ -46,4 +47,7 @@ private-dev | |||
46 | private-opt none | 47 | private-opt none |
47 | private-tmp | 48 | private-tmp |
48 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
49 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/mate-calculator.profile b/etc/profile-m-z/mate-calculator.profile index bb438f5f0..bb438f5f0 100644 --- a/etc/mate-calculator.profile +++ b/etc/profile-m-z/mate-calculator.profile | |||
diff --git a/etc/mate-color-select.profile b/etc/profile-m-z/mate-color-select.profile index f1a7ca18f..b6dc643d4 100644 --- a/etc/mate-color-select.profile +++ b/etc/profile-m-z/mate-color-select.profile | |||
@@ -11,6 +11,7 @@ include disable-exec.inc | |||
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | 15 | ||
15 | include whitelist-common.inc | 16 | include whitelist-common.inc |
16 | 17 | ||
diff --git a/etc/mate-dictionary.profile b/etc/profile-m-z/mate-dictionary.profile index 49a776766..2267bbb50 100644 --- a/etc/mate-dictionary.profile +++ b/etc/profile-m-z/mate-dictionary.profile | |||
@@ -13,11 +13,13 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | mkdir ${HOME}/.config/mate/mate-dictionary | 18 | mkdir ${HOME}/.config/mate/mate-dictionary |
18 | whitelist ${HOME}/.config/mate/mate-dictionary | 19 | whitelist ${HOME}/.config/mate/mate-dictionary |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
20 | 21 | ||
22 | apparmor | ||
21 | caps.drop all | 23 | caps.drop all |
22 | netfilter | 24 | netfilter |
23 | no3d | 25 | no3d |
diff --git a/etc/mathematica.profile b/etc/profile-m-z/mathematica.profile index 964060350..964060350 100644 --- a/etc/mathematica.profile +++ b/etc/profile-m-z/mathematica.profile | |||
diff --git a/etc/profile-m-z/mattermost-desktop.profile b/etc/profile-m-z/mattermost-desktop.profile new file mode 100644 index 000000000..e4487c8aa --- /dev/null +++ b/etc/profile-m-z/mattermost-desktop.profile | |||
@@ -0,0 +1,46 @@ | |||
1 | # Firejail profile for mattermost-desktop | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include mattermost-desktop.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.config/Mattermost | ||
9 | |||
10 | include disable-common.inc | ||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/Mattermost | ||
20 | whitelist ${DOWNLOADS} | ||
21 | whitelist ${HOME}/.config/Mattermost | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | caps.keep sys_admin,sys_chroot | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | notv | ||
32 | nou2f | ||
33 | novideo | ||
34 | shell none | ||
35 | |||
36 | disable-mnt | ||
37 | private-cache | ||
38 | private-dev | ||
39 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
40 | private-tmp | ||
41 | |||
42 | # Not tested | ||
43 | #dbus-user filter | ||
44 | #dbus-user.own com.mattermost.Desktop | ||
45 | #dbus-user.talk org.freedesktop.Notifications | ||
46 | #dbus-system none | ||
diff --git a/etc/mcabber.profile b/etc/profile-m-z/mcabber.profile index 134a6ae63..b63de6c3e 100644 --- a/etc/mcabber.profile +++ b/etc/profile-m-z/mcabber.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | caps.drop all | 19 | caps.drop all |
19 | netfilter | 20 | netfilter |
diff --git a/etc/mediainfo.profile b/etc/profile-m-z/mediainfo.profile index 40ae663fc..be7c8cbca 100644 --- a/etc/mediainfo.profile +++ b/etc/profile-m-z/mediainfo.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
@@ -24,7 +25,6 @@ ipc-namespace | |||
24 | machine-id | 25 | machine-id |
25 | net none | 26 | net none |
26 | no3d | 27 | no3d |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -45,4 +45,7 @@ private-dev | |||
45 | private-etc alternatives | 45 | private-etc alternatives |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
48 | memory-deny-write-execute | 51 | memory-deny-write-execute |
diff --git a/etc/mediathekview.profile b/etc/profile-m-z/mediathekview.profile index 95cd673c6..95cd673c6 100644 --- a/etc/mediathekview.profile +++ b/etc/profile-m-z/mediathekview.profile | |||
diff --git a/etc/megaglest.profile b/etc/profile-m-z/megaglest.profile index 08eae6dfc..19f9edf05 100644 --- a/etc/megaglest.profile +++ b/etc/profile-m-z/megaglest.profile | |||
@@ -18,13 +18,16 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.megaglest | 19 | mkdir ${HOME}/.megaglest |
20 | whitelist ${HOME}/.megaglest | 20 | whitelist ${HOME}/.megaglest |
21 | whitelist /usr/share/megaglest | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
27 | apparmor | ||
24 | caps.drop all | 28 | caps.drop all |
25 | ipc-namespace | 29 | ipc-namespace |
26 | netfilter | 30 | netfilter |
27 | nodbus | ||
28 | nodvd | 31 | nodvd |
29 | nogroups | 32 | nogroups |
30 | nonewprivs | 33 | nonewprivs |
@@ -42,3 +45,6 @@ private-bin megaglest,megaglest_editor,megaglest_g3dviewer | |||
42 | private-cache | 45 | private-cache |
43 | private-dev | 46 | private-dev |
44 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/megaglest_editor.profile b/etc/profile-m-z/megaglest_editor.profile index 02aad8084..02aad8084 100644 --- a/etc/megaglest_editor.profile +++ b/etc/profile-m-z/megaglest_editor.profile | |||
diff --git a/etc/meld.profile b/etc/profile-m-z/meld.profile index 9a320c13d..385700648 100644 --- a/etc/meld.profile +++ b/etc/profile-m-z/meld.profile | |||
@@ -35,6 +35,9 @@ include disable-interpreters.inc | |||
35 | include disable-passwdmgr.inc | 35 | include disable-passwdmgr.inc |
36 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in disable-programs.inc. | 36 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare files in disable-programs.inc. |
37 | #include disable-programs.inc | 37 | #include disable-programs.inc |
38 | include disable-shell.inc | ||
39 | |||
40 | include whitelist-runuser-common.inc | ||
38 | 41 | ||
39 | # Uncomment the next lines (or put it into your meld.local) if you don't need to compare files in /usr/share. | 42 | # Uncomment the next lines (or put it into your meld.local) if you don't need to compare files in /usr/share. |
40 | #whitelist /usr/share/meld | 43 | #whitelist /usr/share/meld |
@@ -67,6 +70,7 @@ private-cache | |||
67 | private-dev | 70 | private-dev |
68 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare in /etc. | 71 | # Uncomment the next line (or put it into your meld.local) if you don't need to compare in /etc. |
69 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,subversion | 72 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,subversion |
73 | # Comment the next line (or add 'ignore private-tmp to your meld.local') if you want to use it as a difftool (#3551) | ||
70 | private-tmp | 74 | private-tmp |
71 | 75 | ||
72 | read-only ${HOME}/.ssh | 76 | read-only ${HOME}/.ssh |
diff --git a/etc/mencoder.profile b/etc/profile-m-z/mencoder.profile index ad5ce436a..caf238785 100644 --- a/etc/mencoder.profile +++ b/etc/profile-m-z/mencoder.profile | |||
@@ -18,7 +18,6 @@ ipc-namespace | |||
18 | machine-id | 18 | machine-id |
19 | net none | 19 | net none |
20 | no3d | 20 | no3d |
21 | nodbus | ||
22 | nosound | 21 | nosound |
23 | notv | 22 | notv |
24 | protocol unix | 23 | protocol unix |
@@ -27,6 +26,9 @@ x11 none | |||
27 | 26 | ||
28 | private-bin mencoder | 27 | private-bin mencoder |
29 | 28 | ||
29 | dbus-user none | ||
30 | dbus-system none | ||
31 | |||
30 | memory-deny-write-execute | 32 | memory-deny-write-execute |
31 | 33 | ||
32 | # Redirect | 34 | # Redirect |
diff --git a/etc/mendeleydesktop.profile b/etc/profile-m-z/mendeleydesktop.profile index 1f02ff5c0..6022b110a 100644 --- a/etc/mendeleydesktop.profile +++ b/etc/profile-m-z/mendeleydesktop.profile | |||
@@ -29,7 +29,6 @@ include whitelist-var-common.inc | |||
29 | 29 | ||
30 | caps.drop all | 30 | caps.drop all |
31 | netfilter | 31 | netfilter |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -47,3 +46,5 @@ private-bin cat,env,gconftool-2,ln,mendeleydesktop,python*,sh,update-desktop-dat | |||
47 | private-dev | 46 | private-dev |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/meteo-qt.profile b/etc/profile-m-z/meteo-qt.profile index 4437d86ea..c8b0a0ff1 100644 --- a/etc/meteo-qt.profile +++ b/etc/profile-m-z/meteo-qt.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.config/meteo-qt | 24 | mkdir ${HOME}/.config/meteo-qt |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | 29 | ||
29 | caps.drop all | 30 | caps.drop all |
30 | netfilter | 31 | netfilter |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -48,4 +48,7 @@ private-cache | |||
48 | private-dev | 48 | private-dev |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
51 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/midori.profile b/etc/profile-m-z/midori.profile index e11e2acaa..e15259608 100644 --- a/etc/midori.profile +++ b/etc/profile-m-z/midori.profile | |||
@@ -48,7 +48,9 @@ whitelist ${HOME}/.local/share/webkitgtk | |||
48 | whitelist ${HOME}/.pki | 48 | whitelist ${HOME}/.pki |
49 | whitelist ${HOME}/.local/share/pki | 49 | whitelist ${HOME}/.local/share/pki |
50 | include whitelist-common.inc | 50 | include whitelist-common.inc |
51 | include whitelist-var-common.inc | ||
51 | 52 | ||
53 | apparmor | ||
52 | caps.drop all | 54 | caps.drop all |
53 | netfilter | 55 | netfilter |
54 | nodvd | 56 | nodvd |
@@ -60,3 +62,4 @@ seccomp | |||
60 | tracelog | 62 | tracelog |
61 | 63 | ||
62 | disable-mnt | 64 | disable-mnt |
65 | private-tmp | ||
diff --git a/etc/min.profile b/etc/profile-m-z/min.profile index 7f3aeab44..7f3aeab44 100644 --- a/etc/min.profile +++ b/etc/profile-m-z/min.profile | |||
diff --git a/etc/profile-m-z/mindless.profile b/etc/profile-m-z/mindless.profile new file mode 100644 index 000000000..6108c0b69 --- /dev/null +++ b/etc/profile-m-z/mindless.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for mindless | ||
2 | # Description: figure out the secret code | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mindless.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/mindless | ||
19 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | machine-id | ||
25 | net none | ||
26 | no3d | ||
27 | nodvd | ||
28 | nogroups | ||
29 | nonewprivs | ||
30 | noroot | ||
31 | nosound | ||
32 | notv | ||
33 | nou2f | ||
34 | novideo | ||
35 | protocol unix | ||
36 | seccomp | ||
37 | shell none | ||
38 | tracelog | ||
39 | |||
40 | disable-mnt | ||
41 | private | ||
42 | private-bin mindless | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc fonts | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
51 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/minecraft-launcher.profile b/etc/profile-m-z/minecraft-launcher.profile new file mode 100644 index 000000000..8c7d18c58 --- /dev/null +++ b/etc/profile-m-z/minecraft-launcher.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for minecraft-launcher | ||
2 | # Description: Official Minecraft launcher from Mojang | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include minecraft-launcher.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # On some distros executable may be in '/opt/minecraft-launcher/', if so, run 'firejail /opt/minecraft-launcher/minecraft-launcher' to start it. | ||
10 | |||
11 | ignore noexec ${HOME} | ||
12 | |||
13 | noblacklist ${HOME}/.minecraft | ||
14 | |||
15 | include allow-java.inc | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | mkdir ${HOME}/.minecraft | ||
27 | whitelist ${HOME}/.minecraft | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-runuser-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | netfilter | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6,netlink | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin java,java-config,minecraft-launcher | ||
50 | private-cache | ||
51 | private-dev | ||
52 | # If multiplayer or realms break add your own java folder from /etc or comment the line below. | ||
53 | private-etc alternatives,asound.conf,ati,ca-certificates,crypto-policies,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-14-openjdk,java-7-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,login.defs,machine-id,mime.types,nvidia,passwd,pki,pulse,resolv.conf,selinux,services,ssl,timezone,X11,xdg | ||
54 | private-opt minecraft-launcher | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/minetest.profile b/etc/profile-m-z/minetest.profile index 0439a1ccc..1da430ce6 100644 --- a/etc/minetest.profile +++ b/etc/profile-m-z/minetest.profile | |||
@@ -6,6 +6,9 @@ include minetest.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # In order to save in-game screenshots to a persistent location edit ~/.minetest/minetest.conf: | ||
10 | # screenshot_path = /home/<USER>/.minetest/screenshots | ||
11 | |||
9 | noblacklist ${HOME}/.cache/minetest | 12 | noblacklist ${HOME}/.cache/minetest |
10 | noblacklist ${HOME}/.minetest | 13 | noblacklist ${HOME}/.minetest |
11 | 14 | ||
@@ -15,19 +18,22 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 22 | include disable-xdg.inc |
19 | 23 | ||
20 | mkdir ${HOME}/.cache/minetest | 24 | mkdir ${HOME}/.cache/minetest |
21 | mkdir ${HOME}/.minetest | 25 | mkdir ${HOME}/.minetest |
22 | whitelist ${HOME}/.cache/minetest | 26 | whitelist ${HOME}/.cache/minetest |
23 | whitelist ${HOME}/.minetest | 27 | whitelist ${HOME}/.minetest |
28 | whitelist /usr/share/minetest | ||
24 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
26 | 33 | ||
27 | caps.drop all | 34 | caps.drop all |
28 | ipc-namespace | 35 | ipc-namespace |
29 | netfilter | 36 | netfilter |
30 | nodbus | ||
31 | nodvd | 37 | nodvd |
32 | nogroups | 38 | nogroups |
33 | nonewprivs | 39 | nonewprivs |
@@ -47,3 +53,6 @@ private-dev | |||
47 | # private-etc needs to be updated, see #1702 | 53 | # private-etc needs to be updated, see #1702 |
48 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl | 54 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl |
49 | private-tmp | 55 | private-tmp |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/profile-m-z/minitube.profile b/etc/profile-m-z/minitube.profile new file mode 100644 index 000000000..2c70978a9 --- /dev/null +++ b/etc/profile-m-z/minitube.profile | |||
@@ -0,0 +1,61 @@ | |||
1 | # Firejail profile for minitube | ||
2 | # Description: Native Youtube viewer for Linux | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include minitube.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | noblacklist ${HOME}/.cache/Flavio Tordini | ||
11 | noblacklist ${HOME}/.config/Flavio Tordini | ||
12 | noblacklist ${HOME}/.local/share/Flavio Tordini | ||
13 | |||
14 | include allow-lua.inc | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-shell.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | mkdir ${HOME}/.cache/Flavio Tordini | ||
26 | mkdir ${HOME}/.config/Flavio Tordini | ||
27 | mkdir ${HOME}/.local/share/Flavio Tordini | ||
28 | whitelist ${PICTURES} | ||
29 | whitelist ${HOME}/.cache/Flavio Tordini | ||
30 | whitelist ${HOME}/.config/Flavio Tordini | ||
31 | whitelist ${HOME}/.local/share/Flavio Tordini | ||
32 | whitelist /usr/share/minitube | ||
33 | include whitelist-common.inc | ||
34 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | ||
36 | include whitelist-var-common.inc | ||
37 | |||
38 | apparmor | ||
39 | caps.drop all | ||
40 | netfilter | ||
41 | nodvd | ||
42 | nogroups | ||
43 | nonewprivs | ||
44 | noroot | ||
45 | notv | ||
46 | nou2f | ||
47 | novideo | ||
48 | protocol unix,inet,inet6,netlink | ||
49 | seccomp | ||
50 | shell none | ||
51 | tracelog | ||
52 | |||
53 | disable-mnt | ||
54 | private-bin minitube | ||
55 | private-cache | ||
56 | private-dev | ||
57 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
58 | private-tmp | ||
59 | |||
60 | dbus-user none | ||
61 | dbus-system none | ||
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile new file mode 100644 index 000000000..ded84bf7e --- /dev/null +++ b/etc/profile-m-z/mirrormagic.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for mirrormagic | ||
2 | # Description: Puzzle game where you steer a beam of light using mirrors | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mirrormagic.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.mirrormagic | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.mirrormagic | ||
21 | whitelist ${HOME}/.mirrormagic | ||
22 | whitelist /usr/share/mirrormagic | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,netlink | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin mirrormagic | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile new file mode 100644 index 000000000..6fc7a4d67 --- /dev/null +++ b/etc/profile-m-z/mocp.profile | |||
@@ -0,0 +1,53 @@ | |||
1 | # Firejail profile for mocp | ||
2 | # Description: A powerful & easy to use console audio player | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include mocp.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.moc | ||
11 | noblacklist ${MUSIC} | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | ipc-namespace | ||
28 | netfilter | ||
29 | no3d | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6,netlink | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | private-bin mocp | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
51 | memory-deny-write-execute | ||
52 | read-only ${HOME} | ||
53 | read-write ${HOME}/.moc | ||
diff --git a/etc/mousepad.profile b/etc/profile-m-z/mousepad.profile index 20370a5b5..5f15b71e2 100644 --- a/etc/mousepad.profile +++ b/etc/profile-m-z/mousepad.profile | |||
@@ -14,11 +14,13 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
21 | apparmor | ||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | net none |
22 | nodvd | 24 | nodvd |
23 | nogroups | 25 | nogroups |
24 | nonewprivs | 26 | nonewprivs |
diff --git a/etc/mp3splt-gtk.profile b/etc/profile-m-z/mp3splt-gtk.profile index e0936476b..3481a4a82 100644 --- a/etc/mp3splt-gtk.profile +++ b/etc/profile-m-z/mp3splt-gtk.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
@@ -21,7 +22,6 @@ apparmor | |||
21 | caps.drop all | 22 | caps.drop all |
22 | net none | 23 | net none |
23 | no3d | 24 | no3d |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -39,3 +39,6 @@ private-cache | |||
39 | private-dev | 39 | private-dev |
40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,machine-id,openal,pulse | 40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,machine-id,openal,pulse |
41 | private-tmp | 41 | private-tmp |
42 | |||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/mp3splt.profile b/etc/profile-m-z/mp3splt.profile index 7754d276b..c65754a03 100644 --- a/etc/mp3splt.profile +++ b/etc/profile-m-z/mp3splt.profile | |||
@@ -26,7 +26,6 @@ ipc-namespace | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -49,3 +48,6 @@ private-etc alternatives | |||
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
51 | memory-deny-write-execute | 50 | memory-deny-write-execute |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/mp3wrap.profile b/etc/profile-m-z/mp3wrap.profile index 9e48f7807..9e48f7807 100644 --- a/etc/mp3wrap.profile +++ b/etc/profile-m-z/mp3wrap.profile | |||
diff --git a/etc/mpDris2.profile b/etc/profile-m-z/mpDris2.profile index fd0351db0..4ba1dfbd6 100644 --- a/etc/mpDris2.profile +++ b/etc/profile-m-z/mpDris2.profile | |||
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | whitelist ${MUSIC} | 26 | whitelist ${MUSIC} |
diff --git a/etc/mpd.profile b/etc/profile-m-z/mpd.profile index 3fda87a48..3fda87a48 100644 --- a/etc/mpd.profile +++ b/etc/profile-m-z/mpd.profile | |||
diff --git a/etc/mpg123-alsa.profile b/etc/profile-m-z/mpg123-alsa.profile index 378435af1..378435af1 100644 --- a/etc/mpg123-alsa.profile +++ b/etc/profile-m-z/mpg123-alsa.profile | |||
diff --git a/etc/mpg123-id3dump.profile b/etc/profile-m-z/mpg123-id3dump.profile index 370a57b3c..370a57b3c 100644 --- a/etc/mpg123-id3dump.profile +++ b/etc/profile-m-z/mpg123-id3dump.profile | |||
diff --git a/etc/mpg123-jack.profile b/etc/profile-m-z/mpg123-jack.profile index e36a2e5b3..e36a2e5b3 100644 --- a/etc/mpg123-jack.profile +++ b/etc/profile-m-z/mpg123-jack.profile | |||
diff --git a/etc/mpg123-nas.profile b/etc/profile-m-z/mpg123-nas.profile index cdbf0b1d2..cdbf0b1d2 100644 --- a/etc/mpg123-nas.profile +++ b/etc/profile-m-z/mpg123-nas.profile | |||
diff --git a/etc/mpg123-openal.profile b/etc/profile-m-z/mpg123-openal.profile index e5585feaa..e5585feaa 100644 --- a/etc/mpg123-openal.profile +++ b/etc/profile-m-z/mpg123-openal.profile | |||
diff --git a/etc/mpg123-oss.profile b/etc/profile-m-z/mpg123-oss.profile index dcb92ecd6..dcb92ecd6 100644 --- a/etc/mpg123-oss.profile +++ b/etc/profile-m-z/mpg123-oss.profile | |||
diff --git a/etc/mpg123-portaudio.profile b/etc/profile-m-z/mpg123-portaudio.profile index 319843504..319843504 100644 --- a/etc/mpg123-portaudio.profile +++ b/etc/profile-m-z/mpg123-portaudio.profile | |||
diff --git a/etc/mpg123-pulse.profile b/etc/profile-m-z/mpg123-pulse.profile index 31063a96b..31063a96b 100644 --- a/etc/mpg123-pulse.profile +++ b/etc/profile-m-z/mpg123-pulse.profile | |||
diff --git a/etc/mpg123-strip.profile b/etc/profile-m-z/mpg123-strip.profile index 62de57c22..62de57c22 100644 --- a/etc/mpg123-strip.profile +++ b/etc/profile-m-z/mpg123-strip.profile | |||
diff --git a/etc/mpg123.bin.profile b/etc/profile-m-z/mpg123.bin.profile index 0a01d0829..0a01d0829 100644 --- a/etc/mpg123.bin.profile +++ b/etc/profile-m-z/mpg123.bin.profile | |||
diff --git a/etc/mpg123.profile b/etc/profile-m-z/mpg123.profile index 6dfeb4586..b1ab81c1e 100644 --- a/etc/mpg123.profile +++ b/etc/profile-m-z/mpg123.profile | |||
@@ -1,13 +1,13 @@ | |||
1 | # Firejail profile for mpg123 | 1 | # Firejail profile for mpg123 |
2 | # Description: MPEG audio player/decoder | 2 | # Description: MPEG audio player/decoder |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include mpg123.local | 6 | include mpg123.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
7 | include globals.local | 8 | include globals.local |
8 | 9 | ||
9 | noblacklist ${MUSIC} | 10 | noblacklist ${MUSIC} |
10 | noblacklist ${VIDEOS} | ||
11 | 11 | ||
12 | include disable-common.inc | 12 | include disable-common.inc |
13 | include disable-devel.inc | 13 | include disable-devel.inc |
@@ -23,17 +23,23 @@ include whitelist-var-common.inc | |||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | netfilter | 25 | netfilter |
26 | nodbus | 26 | no3d |
27 | nogroups | 27 | nogroups |
28 | nonewprivs | 28 | nonewprivs |
29 | noroot | 29 | noroot |
30 | notv | ||
30 | nou2f | 31 | nou2f |
32 | novideo | ||
31 | protocol unix,inet,inet6,netlink | 33 | protocol unix,inet,inet6,netlink |
32 | seccomp | 34 | seccomp |
33 | shell none | 35 | shell none |
36 | tracelog | ||
34 | 37 | ||
35 | #private-bin mpg123* | 38 | #private-bin mpg123* |
36 | private-dev | 39 | private-dev |
37 | private-tmp | 40 | private-tmp |
38 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
44 | |||
39 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/mplayer.profile b/etc/profile-m-z/mplayer.profile index 9ab4f8c7f..cd25d6c0b 100644 --- a/etc/mplayer.profile +++ b/etc/profile-m-z/mplayer.profile | |||
@@ -21,7 +21,9 @@ include disable-xdg.inc | |||
21 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | apparmor | ||
24 | caps.drop all | 25 | caps.drop all |
26 | # net none - mplayer can be used for streaming. | ||
25 | netfilter | 27 | netfilter |
26 | # nogroups | 28 | # nogroups |
27 | nonewprivs | 29 | nonewprivs |
diff --git a/etc/mpsyt.profile b/etc/profile-m-z/mpsyt.profile index 546755ecb..e0c6ff1c8 100644 --- a/etc/mpsyt.profile +++ b/etc/profile-m-z/mpsyt.profile | |||
@@ -26,6 +26,7 @@ include disable-exec.inc | |||
26 | include disable-interpreters.inc | 26 | include disable-interpreters.inc |
27 | include disable-passwdmgr.inc | 27 | include disable-passwdmgr.inc |
28 | include disable-programs.inc | 28 | include disable-programs.inc |
29 | include disable-shell.inc | ||
29 | include disable-xdg.inc | 30 | include disable-xdg.inc |
30 | 31 | ||
31 | mkdir ${HOME}/.config/mps-youtube | 32 | mkdir ${HOME}/.config/mps-youtube |
@@ -48,7 +49,6 @@ include whitelist-var-common.inc | |||
48 | apparmor | 49 | apparmor |
49 | caps.drop all | 50 | caps.drop all |
50 | netfilter | 51 | netfilter |
51 | nodbus | ||
52 | nodvd | 52 | nodvd |
53 | # Seems to cause issues with Nvidia drivers sometimes | 53 | # Seems to cause issues with Nvidia drivers sometimes |
54 | nogroups | 54 | nogroups |
@@ -67,3 +67,5 @@ private-bin env,ffmpeg,mplayer,mpsyt,mpv,python*,youtube-dl | |||
67 | private-dev | 67 | private-dev |
68 | private-tmp | 68 | private-tmp |
69 | 69 | ||
70 | dbus-user none | ||
71 | dbus-system none | ||
diff --git a/etc/mpv.profile b/etc/profile-m-z/mpv.profile index 56cd66199..2fc027257 100644 --- a/etc/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -11,6 +11,8 @@ noblacklist ${HOME}/.config/mpv | |||
11 | noblacklist ${HOME}/.config/youtube-dl | 11 | noblacklist ${HOME}/.config/youtube-dl |
12 | noblacklist ${HOME}/.netrc | 12 | noblacklist ${HOME}/.netrc |
13 | 13 | ||
14 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
15 | include allow-lua.inc | ||
14 | # Allow python (blacklisted by disable-interpreters.inc) | 16 | # Allow python (blacklisted by disable-interpreters.inc) |
15 | include allow-python2.inc | 17 | include allow-python2.inc |
16 | include allow-python3.inc | 18 | include allow-python3.inc |
@@ -25,8 +27,11 @@ include disable-exec.inc | |||
25 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
26 | include disable-passwdmgr.inc | 28 | include disable-passwdmgr.inc |
27 | include disable-programs.inc | 29 | include disable-programs.inc |
30 | include disable-shell.inc | ||
28 | include disable-xdg.inc | 31 | include disable-xdg.inc |
29 | 32 | ||
33 | whitelist /usr/share/lua | ||
34 | whitelist /usr/share/lua* | ||
30 | whitelist /usr/share/vulkan | 35 | whitelist /usr/share/vulkan |
31 | include whitelist-usr-share-common.inc | 36 | include whitelist-usr-share-common.inc |
32 | include whitelist-var-common.inc | 37 | include whitelist-var-common.inc |
@@ -34,8 +39,7 @@ include whitelist-var-common.inc | |||
34 | apparmor | 39 | apparmor |
35 | caps.drop all | 40 | caps.drop all |
36 | netfilter | 41 | netfilter |
37 | nodbus | 42 | # nogroups seems to cause issues with Nvidia drivers sometimes |
38 | # Seems to cause issues with Nvidia drivers sometimes | ||
39 | nogroups | 43 | nogroups |
40 | nonewprivs | 44 | nonewprivs |
41 | noroot | 45 | noroot |
@@ -46,6 +50,9 @@ shell none | |||
46 | tracelog | 50 | tracelog |
47 | 51 | ||
48 | private-bin env,mpv,python*,youtube-dl | 52 | private-bin env,mpv,python*,youtube-dl |
49 | # Causes slow OSD, see #2838 | 53 | # private-cache causes slow OSD, see #2838 |
50 | #private-cache | 54 | #private-cache |
51 | private-dev | 55 | private-dev |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/profile-m-z/mrrescue.profile b/etc/profile-m-z/mrrescue.profile new file mode 100644 index 000000000..f02a4f357 --- /dev/null +++ b/etc/profile-m-z/mrrescue.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for mrrescue | ||
2 | # Description: Arcade-style fire fighting game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mrrescue.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/love | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.local/share/love | ||
20 | whitelist ${HOME}/.local/share/love | ||
21 | whitelist /usr/share/mrrescue | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | net none | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,netlink | ||
37 | seccomp | ||
38 | shell none | ||
39 | tracelog | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin love,mrrescue,sh | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc machine-id | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/ms-excel.profile b/etc/profile-m-z/ms-excel.profile index db24e8f9b..db24e8f9b 100644 --- a/etc/ms-excel.profile +++ b/etc/profile-m-z/ms-excel.profile | |||
diff --git a/etc/ms-office.profile b/etc/profile-m-z/ms-office.profile index 3bc674134..a6892d698 100644 --- a/etc/ms-office.profile +++ b/etc/profile-m-z/ms-office.profile | |||
@@ -21,7 +21,6 @@ include disable-programs.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | nogroups | 25 | nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -40,3 +39,5 @@ private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | |||
40 | private-dev | 39 | private-dev |
41 | private-tmp | 40 | private-tmp |
42 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/ms-onenote.profile b/etc/profile-m-z/ms-onenote.profile index 9ea0637bd..9ea0637bd 100644 --- a/etc/ms-onenote.profile +++ b/etc/profile-m-z/ms-onenote.profile | |||
diff --git a/etc/ms-outlook.profile b/etc/profile-m-z/ms-outlook.profile index fc3e7c009..fc3e7c009 100644 --- a/etc/ms-outlook.profile +++ b/etc/profile-m-z/ms-outlook.profile | |||
diff --git a/etc/ms-powerpoint.profile b/etc/profile-m-z/ms-powerpoint.profile index dadcd5b1e..dadcd5b1e 100644 --- a/etc/ms-powerpoint.profile +++ b/etc/profile-m-z/ms-powerpoint.profile | |||
diff --git a/etc/ms-skype.profile b/etc/profile-m-z/ms-skype.profile index df1618361..df1618361 100644 --- a/etc/ms-skype.profile +++ b/etc/profile-m-z/ms-skype.profile | |||
diff --git a/etc/ms-word.profile b/etc/profile-m-z/ms-word.profile index 5a617a893..5a617a893 100644 --- a/etc/ms-word.profile +++ b/etc/profile-m-z/ms-word.profile | |||
diff --git a/etc/profile-m-z/mtpaint.profile b/etc/profile-m-z/mtpaint.profile new file mode 100644 index 000000000..cfd00e8ae --- /dev/null +++ b/etc/profile-m-z/mtpaint.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for mtpaint | ||
2 | # Description: Simple painting and editing program | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include mtpaint.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | nodvd | ||
29 | no3d | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin mtpaint | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/multimc.profile b/etc/profile-m-z/multimc.profile index 338f494c9..338f494c9 100644 --- a/etc/multimc.profile +++ b/etc/profile-m-z/multimc.profile | |||
diff --git a/etc/multimc5.profile b/etc/profile-m-z/multimc5.profile index 475307418..475307418 100644 --- a/etc/multimc5.profile +++ b/etc/profile-m-z/multimc5.profile | |||
diff --git a/etc/mumble.profile b/etc/profile-m-z/mumble.profile index 94ccbad0c..0c4efc3d3 100644 --- a/etc/mumble.profile +++ b/etc/profile-m-z/mumble.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | 20 | ||
20 | mkdir ${HOME}/.config/Mumble | 21 | mkdir ${HOME}/.config/Mumble |
21 | mkdir ${HOME}/.local/share/data/Mumble | 22 | mkdir ${HOME}/.local/share/data/Mumble |
@@ -34,7 +35,7 @@ nogroups | |||
34 | nonewprivs | 35 | nonewprivs |
35 | noroot | 36 | noroot |
36 | notv | 37 | notv |
37 | protocol unix,inet,inet6 | 38 | protocol unix,inet,inet6,netlink |
38 | seccomp | 39 | seccomp |
39 | shell none | 40 | shell none |
40 | tracelog | 41 | tracelog |
diff --git a/etc/mupdf-gl.profile b/etc/profile-m-z/mupdf-gl.profile index be94a9083..be94a9083 100644 --- a/etc/mupdf-gl.profile +++ b/etc/profile-m-z/mupdf-gl.profile | |||
diff --git a/etc/mupdf-x11-curl.profile b/etc/profile-m-z/mupdf-x11-curl.profile index a04d386a2..a04d386a2 100644 --- a/etc/mupdf-x11-curl.profile +++ b/etc/profile-m-z/mupdf-x11-curl.profile | |||
diff --git a/etc/mupdf-x11.profile b/etc/profile-m-z/mupdf-x11.profile index 256201d0c..256201d0c 100644 --- a/etc/mupdf-x11.profile +++ b/etc/profile-m-z/mupdf-x11.profile | |||
diff --git a/etc/mupdf.profile b/etc/profile-m-z/mupdf.profile index 43afbc859..a3e56170a 100644 --- a/etc/mupdf.profile +++ b/etc/profile-m-z/mupdf.profile | |||
@@ -18,10 +18,10 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
20 | 20 | ||
21 | apparmor | ||
21 | caps.drop all | 22 | caps.drop all |
22 | machine-id | 23 | machine-id |
23 | net none | 24 | net none |
24 | nodbus | ||
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | nonewprivs | 27 | nonewprivs |
@@ -38,3 +38,6 @@ tracelog | |||
38 | private-dev | 38 | private-dev |
39 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload | 39 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
40 | private-tmp | 40 | private-tmp |
41 | |||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/mupen64plus.profile b/etc/profile-m-z/mupen64plus.profile index e131f5319..00983a8f3 100644 --- a/etc/mupen64plus.profile +++ b/etc/profile-m-z/mupen64plus.profile | |||
@@ -24,10 +24,12 @@ include whitelist-common.inc | |||
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nonewprivs | 28 | nonewprivs |
30 | noroot | 29 | noroot |
31 | notv | 30 | notv |
32 | novideo | 31 | novideo |
33 | seccomp | 32 | seccomp |
33 | |||
34 | dbus-user none | ||
35 | dbus-system none | ||
diff --git a/etc/muraster.profile b/etc/profile-m-z/muraster.profile index 90e3f2050..90e3f2050 100644 --- a/etc/muraster.profile +++ b/etc/profile-m-z/muraster.profile | |||
diff --git a/etc/musescore.profile b/etc/profile-m-z/musescore.profile index b3693c956..679e82ae8 100644 --- a/etc/musescore.profile +++ b/etc/profile-m-z/musescore.profile | |||
@@ -23,6 +23,7 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | apparmor | ||
26 | caps.drop all | 27 | caps.drop all |
27 | netfilter | 28 | netfilter |
28 | no3d | 29 | no3d |
diff --git a/etc/musixmatch.profile b/etc/profile-m-z/musixmatch.profile index a6b85a8e4..a6b85a8e4 100644 --- a/etc/musixmatch.profile +++ b/etc/profile-m-z/musixmatch.profile | |||
diff --git a/etc/mutool.profile b/etc/profile-m-z/mutool.profile index e61f4665d..e61f4665d 100644 --- a/etc/mutool.profile +++ b/etc/profile-m-z/mutool.profile | |||
diff --git a/etc/mutt.profile b/etc/profile-m-z/mutt.profile index 1fc412955..1ce12f54f 100644 --- a/etc/mutt.profile +++ b/etc/profile-m-z/mutt.profile | |||
@@ -40,6 +40,8 @@ include disable-interpreters.inc | |||
40 | include disable-passwdmgr.inc | 40 | include disable-passwdmgr.inc |
41 | include disable-programs.inc | 41 | include disable-programs.inc |
42 | 42 | ||
43 | include whitelist-runuser-common.inc | ||
44 | |||
43 | caps.drop all | 45 | caps.drop all |
44 | netfilter | 46 | netfilter |
45 | no3d | 47 | no3d |
@@ -57,3 +59,4 @@ shell none | |||
57 | 59 | ||
58 | private-dev | 60 | private-dev |
59 | writable-run-user | 61 | writable-run-user |
62 | writable-var | ||
diff --git a/etc/mypaint-ora-thumbnailer.profile b/etc/profile-m-z/mypaint-ora-thumbnailer.profile index 59b3024ed..59b3024ed 100644 --- a/etc/mypaint-ora-thumbnailer.profile +++ b/etc/profile-m-z/mypaint-ora-thumbnailer.profile | |||
diff --git a/etc/mypaint.profile b/etc/profile-m-z/mypaint.profile index d75651d78..c592e8477 100644 --- a/etc/mypaint.profile +++ b/etc/profile-m-z/mypaint.profile | |||
@@ -28,7 +28,6 @@ caps.drop all | |||
28 | machine-id | 28 | machine-id |
29 | net none | 29 | net none |
30 | no3d | 30 | no3d |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -47,3 +46,5 @@ private-dev | |||
47 | private-etc alternatives,dconf,fonts,gtk-3.0 | 46 | private-etc alternatives,dconf,fonts,gtk-3.0 |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/nano.profile b/etc/profile-m-z/nano.profile index bc8c3dde0..2a4625896 100644 --- a/etc/nano.profile +++ b/etc/profile-m-z/nano.profile | |||
@@ -28,7 +28,6 @@ ipc-namespace | |||
28 | machine-id | 28 | machine-id |
29 | net none | 29 | net none |
30 | no3d | 30 | no3d |
31 | nodbus | ||
32 | nodvd | 31 | nodvd |
33 | nogroups | 32 | nogroups |
34 | nonewprivs | 33 | nonewprivs |
@@ -50,4 +49,7 @@ private-dev | |||
50 | # Comment the next line if you want to edit files in /etc directly | 49 | # Comment the next line if you want to edit files in /etc directly |
51 | private-etc alternatives,nanorc | 50 | private-etc alternatives,nanorc |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/natron.profile b/etc/profile-m-z/natron.profile index 7ad217b72..5bf152f84 100644 --- a/etc/natron.profile +++ b/etc/profile-m-z/natron.profile | |||
@@ -22,7 +22,6 @@ include disable-programs.inc | |||
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | net none | 24 | net none |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nogroups | 26 | nogroups |
28 | nonewprivs | 27 | nonewprivs |
@@ -34,3 +33,6 @@ seccomp | |||
34 | shell none | 33 | shell none |
35 | 34 | ||
36 | private-bin natron,Natron,NatronRenderer | 35 | private-bin natron,Natron,NatronRenderer |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/profile-m-z/nautilus.profile b/etc/profile-m-z/nautilus.profile new file mode 100644 index 000000000..e54bea228 --- /dev/null +++ b/etc/profile-m-z/nautilus.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for nautilus | ||
2 | # Description: File manager and graphical shell for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nautilus.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Nautilus is started by systemd on most systems. Therefore it is not firejailed by default. Since there | ||
10 | # is already a nautilus process running on gnome desktops firejail will have no effect. | ||
11 | |||
12 | # Put 'ignore noroot' in your nautilus.local if you use MPV+Vulkan (see issue #3012) | ||
13 | |||
14 | # Redirect | ||
15 | include file-manager-common.profile | ||
diff --git a/etc/ncdu.profile b/etc/profile-m-z/ncdu.profile index 9fda6ebe0..651804bf1 100644 --- a/etc/ncdu.profile +++ b/etc/profile-m-z/ncdu.profile | |||
@@ -12,7 +12,6 @@ include disable-exec.inc | |||
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | ipc-namespace | 14 | ipc-namespace |
15 | nodbus | ||
16 | net none | 15 | net none |
17 | no3d | 16 | no3d |
18 | nodvd | 17 | nodvd |
@@ -31,4 +30,7 @@ x11 none | |||
31 | private-dev | 30 | private-dev |
32 | # private-tmp | 31 | # private-tmp |
33 | 32 | ||
33 | dbus-user none | ||
34 | dbus-system none | ||
35 | |||
34 | memory-deny-write-execute | 36 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/nemo.profile b/etc/profile-m-z/nemo.profile new file mode 100644 index 000000000..1b3333e8c --- /dev/null +++ b/etc/profile-m-z/nemo.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for nemo | ||
2 | # Description: File manager and graphical shell for Cinnamon | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nemo.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your nemo.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/netactview.profile b/etc/profile-m-z/netactview.profile index 0618caf68..fd73cea89 100644 --- a/etc/netactview.profile +++ b/etc/profile-m-z/netactview.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkfile ${HOME}/.netactview | 20 | mkfile ${HOME}/.netactview |
@@ -29,7 +30,6 @@ ipc-namespace | |||
29 | machine-id | 30 | machine-id |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -49,4 +49,7 @@ private-etc alternatives,fonts | |||
49 | private-lib | 49 | private-lib |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
52 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/nethack-vultures.profile b/etc/profile-m-z/nethack-vultures.profile index 079f44ee7..4daa8054b 100644 --- a/etc/nethack-vultures.profile +++ b/etc/profile-m-z/nethack-vultures.profile | |||
@@ -24,7 +24,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 24 | caps.drop all |
25 | ipc-namespace | 25 | ipc-namespace |
26 | net none | 26 | net none |
27 | nodbus | ||
28 | nodvd | 27 | nodvd |
29 | nogroups | 28 | nogroups |
30 | #nonewprivs | 29 | #nonewprivs |
@@ -41,3 +40,6 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | writable-var | 42 | writable-var |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
diff --git a/etc/nethack.profile b/etc/profile-m-z/nethack.profile index 3df632451..c8c927db2 100644 --- a/etc/nethack.profile +++ b/etc/profile-m-z/nethack.profile | |||
@@ -23,7 +23,6 @@ caps.drop all | |||
23 | ipc-namespace | 23 | ipc-namespace |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | #nonewprivs | 28 | #nonewprivs |
@@ -42,4 +41,7 @@ private-dev | |||
42 | private-tmp | 41 | private-tmp |
43 | writable-var | 42 | writable-var |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
45 | #memory-deny-write-execute | 47 | #memory-deny-write-execute |
diff --git a/etc/netsurf.profile b/etc/profile-m-z/netsurf.profile index 0ddb7bbbe..0ddb7bbbe 100644 --- a/etc/netsurf.profile +++ b/etc/profile-m-z/netsurf.profile | |||
diff --git a/etc/neverball.profile b/etc/profile-m-z/neverball.profile index 84c634549..84c634549 100644 --- a/etc/neverball.profile +++ b/etc/profile-m-z/neverball.profile | |||
diff --git a/etc/neverputt.profile b/etc/profile-m-z/neverputt.profile index d370d1218..d370d1218 100644 --- a/etc/neverputt.profile +++ b/etc/profile-m-z/neverputt.profile | |||
diff --git a/etc/newsbeuter.profile b/etc/profile-m-z/newsbeuter.profile index 059c2156d..85581a2f0 100644 --- a/etc/newsbeuter.profile +++ b/etc/profile-m-z/newsbeuter.profile | |||
@@ -1,4 +1,4 @@ | |||
1 | # Firejail profile for Newsboat | 1 | # Firejail profile for Newsbeuter |
2 | # Description: Text based Atom/RSS feed reader | 2 | # Description: Text based Atom/RSS feed reader |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
diff --git a/etc/newsboat.profile b/etc/profile-m-z/newsboat.profile index e063abe53..a7bac6286 100644 --- a/etc/newsboat.profile +++ b/etc/profile-m-z/newsboat.profile | |||
@@ -19,13 +19,13 @@ include disable-xdg.inc | |||
19 | mkdir ${HOME}/.newsboat | 19 | mkdir ${HOME}/.newsboat |
20 | whitelist ${HOME}/.newsboat | 20 | whitelist ${HOME}/.newsboat |
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | no3d | 28 | no3d |
28 | nodbus | ||
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
31 | nonewprivs | 31 | nonewprivs |
@@ -44,4 +44,7 @@ private-dev | |||
44 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,terminfo | 44 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,terminfo |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | dbus-user none | ||
48 | dbus-system none | ||
49 | |||
47 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/newsflash.profile b/etc/profile-m-z/newsflash.profile new file mode 100644 index 000000000..d0ac83baf --- /dev/null +++ b/etc/profile-m-z/newsflash.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for newsflash | ||
2 | # Description: Modern feed reader | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include newsflash.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/NewsFlashGTK | ||
10 | noblacklist ${HOME}/.config/news-flash | ||
11 | noblacklist ${HOME}/.local/share/news-flash | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/NewsFlashGTK | ||
23 | mkdir ${HOME}/.config/news-flash | ||
24 | mkdir ${HOME}/.local/share/news-flash | ||
25 | whitelist ${HOME}/.cache/NewsFlashGTK | ||
26 | whitelist ${HOME}/.config/news-flash | ||
27 | whitelist ${HOME}/.local/share/news-flash | ||
28 | include whitelist-common.inc | ||
29 | include whitelist-runuser-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | machine-id | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | nosound | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix,inet,inet6 | ||
46 | seccomp | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | disable-mnt | ||
51 | private-bin com.gitlab.newsflash,newsflash | ||
52 | private-cache | ||
53 | private-dev | ||
54 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11 | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user none | ||
58 | #dbus-user.own com.gitlab.newsflash | ||
59 | #dbus-user.talk org.freedesktop.Notifications | ||
60 | dbus-system none | ||
diff --git a/etc/nheko.profile b/etc/profile-m-z/nheko.profile index 119b30239..701098f4b 100644 --- a/etc/nheko.profile +++ b/etc/profile-m-z/nheko.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | mkdir ${HOME}/.config/nheko | 20 | mkdir ${HOME}/.config/nheko |
20 | mkdir ${HOME}/.cache/nheko/nheko | 21 | mkdir ${HOME}/.cache/nheko/nheko |
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile new file mode 100644 index 000000000..6c363345e --- /dev/null +++ b/etc/profile-m-z/nicotine.profile | |||
@@ -0,0 +1,56 @@ | |||
1 | # Firejail profile for Nicotine Plus | ||
2 | # Description: Soulseek music-sharing client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nicotine.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.nicotine | ||
10 | |||
11 | include allow-python2.inc | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.nicotine | ||
23 | whitelist ${DOWNLOADS} | ||
24 | whitelist ${HOME}/.nicotine | ||
25 | whitelist /usr/share/GeoIP | ||
26 | include whitelist-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | #ipc-namespace | ||
34 | netfilter | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6 | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin nicotine,python2* | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
diff --git a/etc/nitroshare-cli.profile b/etc/profile-m-z/nitroshare-cli.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-cli.profile +++ b/etc/profile-m-z/nitroshare-cli.profile | |||
diff --git a/etc/nitroshare-nmh.profile b/etc/profile-m-z/nitroshare-nmh.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-nmh.profile +++ b/etc/profile-m-z/nitroshare-nmh.profile | |||
diff --git a/etc/nitroshare-send.profile b/etc/profile-m-z/nitroshare-send.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-send.profile +++ b/etc/profile-m-z/nitroshare-send.profile | |||
diff --git a/etc/nitroshare-ui.profile b/etc/profile-m-z/nitroshare-ui.profile index d9cb2edc5..d9cb2edc5 100644 --- a/etc/nitroshare-ui.profile +++ b/etc/profile-m-z/nitroshare-ui.profile | |||
diff --git a/etc/nitroshare.profile b/etc/profile-m-z/nitroshare.profile index dfa64cff9..1743a771e 100644 --- a/etc/nitroshare.profile +++ b/etc/profile-m-z/nitroshare.profile | |||
@@ -26,7 +26,6 @@ include whitelist-var-common.inc | |||
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | no3d | 28 | no3d |
29 | # nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -47,4 +46,7 @@ private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache, | |||
47 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare | 46 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare |
48 | private-tmp | 47 | private-tmp |
49 | 48 | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
50 | # memory-deny-write-execute | 52 | # memory-deny-write-execute |
diff --git a/etc/nomacs.profile b/etc/profile-m-z/nomacs.profile index 7a7ff504a..d081c9cb7 100644 --- a/etc/nomacs.profile +++ b/etc/profile-m-z/nomacs.profile | |||
@@ -43,5 +43,3 @@ private-cache | |||
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,login.defs,machine-id,pki,resolv.conf,ssl | 44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,login.defs,machine-id,pki,resolv.conf,ssl |
45 | private-tmp | 45 | private-tmp |
46 | |||
47 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/nslookup.profile b/etc/profile-m-z/nslookup.profile new file mode 100644 index 000000000..a8e0ddd89 --- /dev/null +++ b/etc/profile-m-z/nslookup.profile | |||
@@ -0,0 +1,56 @@ | |||
1 | # Firejail profile for nslookup | ||
2 | # Description: DNS lookup utility | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include nslookup.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
14 | noblacklist ${PATH}/nslookup | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | whitelist ${HOME}/.nslookuprc | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | apparmor | ||
30 | caps.drop all | ||
31 | ipc-namespace | ||
32 | machine-id | ||
33 | netfilter | ||
34 | no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | nosound | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6 | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin bash,nslookup,sh | ||
50 | private-dev | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
56 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile new file mode 100644 index 000000000..1b97eda9b --- /dev/null +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -0,0 +1,40 @@ | |||
1 | # Firejail profile for nuclear | ||
2 | # Description: Stream music from Youtube,Soundcloud,Jamendo | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nuclear.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore dbus-user | ||
10 | |||
11 | noblacklist ${HOME}/.config/nuclear | ||
12 | |||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/nuclear | ||
20 | whitelist ${HOME}/.config/nuclear | ||
21 | include whitelist-common.inc | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | no3d | ||
27 | nou2f | ||
28 | novideo | ||
29 | shell none | ||
30 | |||
31 | disable-mnt | ||
32 | # private-bin nuclear | ||
33 | private-cache | ||
34 | private-dev | ||
35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
36 | private-opt nuclear | ||
37 | private-tmp | ||
38 | |||
39 | # Redirect | ||
40 | include electron.profile | ||
diff --git a/etc/nylas.profile b/etc/profile-m-z/nylas.profile index c959eb991..c959eb991 100644 --- a/etc/nylas.profile +++ b/etc/profile-m-z/nylas.profile | |||
diff --git a/etc/nyx.profile b/etc/profile-m-z/nyx.profile index c4475c75c..9e27dafab 100644 --- a/etc/nyx.profile +++ b/etc/profile-m-z/nyx.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
23 | mkdir ${HOME}/.nyx | 24 | mkdir ${HOME}/.nyx |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | caps.drop all | 29 | caps.drop all |
29 | netfilter | 30 | netfilter |
30 | no3d | 31 | no3d |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -50,3 +50,5 @@ private-opt none | |||
50 | private-srv none | 50 | private-srv none |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/obs.profile b/etc/profile-m-z/obs.profile index 4277bdab3..4277bdab3 100644 --- a/etc/obs.profile +++ b/etc/profile-m-z/obs.profile | |||
diff --git a/etc/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index a523a6c56..ae18cfff9 100644 --- a/etc/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
@@ -29,8 +30,6 @@ ipc-namespace | |||
29 | #net none | 30 | #net none |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | # nodbus - breaks preferences, comment (or put 'ignore nodbus' in your oceanaudio.local) when needed | ||
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -49,4 +48,8 @@ private-dev | |||
49 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse | 48 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
51 | # breaks preferences | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 55 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/odt2txt.profile b/etc/profile-m-z/odt2txt.profile index c0c5b671c..6201b6fba 100644 --- a/etc/odt2txt.profile +++ b/etc/profile-m-z/odt2txt.profile | |||
@@ -15,12 +15,12 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | caps.drop all | 21 | caps.drop all |
21 | net none | 22 | net none |
22 | no3d | 23 | no3d |
23 | nodbus | ||
24 | nodvd | 24 | nodvd |
25 | nogroups | 25 | nogroups |
26 | nonewprivs | 26 | nonewprivs |
@@ -40,4 +40,8 @@ private-cache | |||
40 | private-dev | 40 | private-dev |
41 | private-etc alternatives | 41 | private-etc alternatives |
42 | private-tmp | 42 | private-tmp |
43 | |||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
43 | read-only ${HOME} | 47 | read-only ${HOME} |
diff --git a/etc/oggsplt.profile b/etc/profile-m-z/oggsplt.profile index 5aedadde9..5aedadde9 100644 --- a/etc/oggsplt.profile +++ b/etc/profile-m-z/oggsplt.profile | |||
diff --git a/etc/okular.profile b/etc/profile-m-z/okular.profile index 9debd86ff..36723ca29 100644 --- a/etc/okular.profile +++ b/etc/profile-m-z/okular.profile | |||
@@ -15,6 +15,7 @@ noblacklist ${HOME}/.kde/share/config/okularrc | |||
15 | noblacklist ${HOME}/.kde4/share/apps/okular | 15 | noblacklist ${HOME}/.kde4/share/apps/okular |
16 | noblacklist ${HOME}/.kde4/share/config/okularpartrc | 16 | noblacklist ${HOME}/.kde4/share/config/okularpartrc |
17 | noblacklist ${HOME}/.kde4/share/config/okularrc | 17 | noblacklist ${HOME}/.kde4/share/config/okularrc |
18 | noblacklist ${HOME}/.local/share/kxmlgui5/okular | ||
18 | noblacklist ${HOME}/.local/share/okular | 19 | noblacklist ${HOME}/.local/share/okular |
19 | noblacklist ${DOCUMENTS} | 20 | noblacklist ${DOCUMENTS} |
20 | 21 | ||
@@ -24,9 +25,11 @@ include disable-exec.inc | |||
24 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
25 | include disable-passwdmgr.inc | 26 | include disable-passwdmgr.inc |
26 | include disable-programs.inc | 27 | include disable-programs.inc |
28 | include disable-shell.inc | ||
27 | include disable-xdg.inc | 29 | include disable-xdg.inc |
28 | 30 | ||
29 | whitelist /usr/share/config.kcfg | 31 | whitelist /usr/share/config.kcfg |
32 | whitelist /usr/share/kxmlgui5/okular | ||
30 | whitelist /usr/share/okular | 33 | whitelist /usr/share/okular |
31 | whitelist /usr/share/poppler | 34 | whitelist /usr/share/poppler |
32 | include whitelist-usr-share-common.inc | 35 | include whitelist-usr-share-common.inc |
@@ -37,7 +40,6 @@ caps.drop all | |||
37 | machine-id | 40 | machine-id |
38 | # net none | 41 | # net none |
39 | netfilter | 42 | netfilter |
40 | # nodbus | ||
41 | nodvd | 43 | nodvd |
42 | nogroups | 44 | nogroups |
43 | nonewprivs | 45 | nonewprivs |
@@ -56,6 +58,9 @@ private-dev | |||
56 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg | 58 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg |
57 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients | 59 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients |
58 | 60 | ||
61 | # dbus-user none | ||
62 | # dbus-system none | ||
63 | |||
59 | # memory-deny-write-execute | 64 | # memory-deny-write-execute |
60 | 65 | ||
61 | join-or-start okular | 66 | join-or-start okular |
diff --git a/etc/onionshare-gui.profile b/etc/profile-m-z/onionshare-gui.profile index 5bfcd0527..5bfcd0527 100644 --- a/etc/onionshare-gui.profile +++ b/etc/profile-m-z/onionshare-gui.profile | |||
diff --git a/etc/ooffice.profile b/etc/profile-m-z/ooffice.profile index 8348a57fe..8348a57fe 100644 --- a/etc/ooffice.profile +++ b/etc/profile-m-z/ooffice.profile | |||
diff --git a/etc/ooviewdoc.profile b/etc/profile-m-z/ooviewdoc.profile index 8348a57fe..8348a57fe 100644 --- a/etc/ooviewdoc.profile +++ b/etc/profile-m-z/ooviewdoc.profile | |||
diff --git a/etc/open-invaders.profile b/etc/profile-m-z/open-invaders.profile index 5925ccc09..e18599d1d 100644 --- a/etc/open-invaders.profile +++ b/etc/profile-m-z/open-invaders.profile | |||
@@ -10,17 +10,20 @@ noblacklist ${HOME}/.openinvaders | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
16 | 18 | ||
17 | mkdir ${HOME}/.openinvaders | 19 | mkdir ${HOME}/.openinvaders |
18 | whitelist ${HOME}/.openinvaders | 20 | whitelist ${HOME}/.openinvaders |
19 | include whitelist-common.inc | 21 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | ||
20 | 23 | ||
24 | apparmor | ||
21 | caps.drop all | 25 | caps.drop all |
22 | net none | 26 | net none |
23 | nodbus | ||
24 | nodvd | 27 | nodvd |
25 | nogroups | 28 | nogroups |
26 | nonewprivs | 29 | nonewprivs |
@@ -32,6 +35,9 @@ protocol unix,netlink | |||
32 | seccomp | 35 | seccomp |
33 | shell none | 36 | shell none |
34 | 37 | ||
35 | # private-bin open-invaders | 38 | private-bin open-invaders |
36 | private-dev | 39 | private-dev |
37 | private-tmp | 40 | private-tmp |
41 | |||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/openarena.profile b/etc/profile-m-z/openarena.profile index c83e78e2c..45682fc31 100644 --- a/etc/openarena.profile +++ b/etc/profile-m-z/openarena.profile | |||
@@ -16,28 +16,35 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | mkdir ${HOME}/.openarena | ||
20 | whitelist ${HOME}/.openarena | ||
21 | whitelist /usr/share/openarena | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.in | ||
19 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
20 | 26 | ||
21 | apparmor | 27 | apparmor |
22 | caps.drop all | 28 | caps.drop all |
23 | # ipc-namespace | 29 | netfilter |
24 | # netfilter | 30 | nodvd |
25 | # nodbus | 31 | nogroups |
26 | # nodvd | ||
27 | # nogroups | ||
28 | nonewprivs | 32 | nonewprivs |
29 | noroot | 33 | noroot |
30 | notv | 34 | notv |
31 | # nou2f | 35 | nou2f |
32 | novideo | 36 | novideo |
33 | protocol unix,inet,inet6,netlink | 37 | protocol unix,inet,inet6,netlink |
34 | seccomp | 38 | seccomp |
35 | shell none | 39 | shell none |
36 | # tracelog | 40 | tracelog |
37 | 41 | ||
38 | # disable-mnt | 42 | disable-mnt |
39 | # private-bin openarena | 43 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity |
40 | private-cache | 44 | private-cache |
41 | private-dev | 45 | private-dev |
42 | # private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg | 46 | private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg |
43 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/profile-m-z/openarena_ded.profile b/etc/profile-m-z/openarena_ded.profile new file mode 100644 index 000000000..c529e7e11 --- /dev/null +++ b/etc/profile-m-z/openarena_ded.profile | |||
@@ -0,0 +1,5 @@ | |||
1 | # Firejail profile alias for openarena | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Redirect | ||
5 | include openarena.profile | ||
diff --git a/etc/openbox.profile b/etc/profile-m-z/openbox.profile index 1fb93c79c..1fb93c79c 100644 --- a/etc/openbox.profile +++ b/etc/profile-m-z/openbox.profile | |||
diff --git a/etc/opencity.profile b/etc/profile-m-z/opencity.profile index 6a27c8095..cb8a511ad 100644 --- a/etc/opencity.profile +++ b/etc/profile-m-z/opencity.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.opencity | 20 | mkdir ${HOME}/.opencity |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.opencity | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | net none |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin opencity | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/openclonk.profile b/etc/profile-m-z/openclonk.profile index da60006b3..a6760617c 100644 --- a/etc/openclonk.profile +++ b/etc/profile-m-z/openclonk.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.clonk | 20 | mkdir ${HOME}/.clonk |
@@ -21,10 +22,11 @@ whitelist ${HOME}/.clonk | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | # net none - networked game |
27 | nodbus | 29 | netfilter |
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -42,3 +44,6 @@ private-bin c4group,openclonk | |||
42 | private-cache | 44 | private-cache |
43 | private-dev | 45 | private-dev |
44 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/openoffice.org.profile b/etc/profile-m-z/openoffice.org.profile index 8348a57fe..8348a57fe 100644 --- a/etc/openoffice.org.profile +++ b/etc/profile-m-z/openoffice.org.profile | |||
diff --git a/etc/openshot-qt.profile b/etc/profile-m-z/openshot-qt.profile index 2f886d2ac..2f886d2ac 100644 --- a/etc/openshot-qt.profile +++ b/etc/profile-m-z/openshot-qt.profile | |||
diff --git a/etc/openshot.profile b/etc/profile-m-z/openshot.profile index 9d0b4c4c9..e1839c724 100644 --- a/etc/openshot.profile +++ b/etc/profile-m-z/openshot.profile | |||
@@ -23,9 +23,7 @@ include whitelist-var-common.inc | |||
23 | 23 | ||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | #net none | 26 | net none |
27 | netfilter | ||
28 | nodbus | ||
29 | nodvd | 27 | nodvd |
30 | nogroups | 28 | nogroups |
31 | nonewprivs | 29 | nonewprivs |
@@ -40,3 +38,5 @@ tracelog | |||
40 | private-dev | 38 | private-dev |
41 | private-tmp | 39 | private-tmp |
42 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/openttd.profile b/etc/profile-m-z/openttd.profile index 5de4d325d..b71883d68 100644 --- a/etc/openttd.profile +++ b/etc/profile-m-z/openttd.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.openttd | 20 | mkdir ${HOME}/.openttd |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.openttd | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | netfilter | 28 | net none |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin openttd | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/opera-beta.profile b/etc/profile-m-z/opera-beta.profile index 8658d30c6..8658d30c6 100644 --- a/etc/opera-beta.profile +++ b/etc/profile-m-z/opera-beta.profile | |||
diff --git a/etc/opera.profile b/etc/profile-m-z/opera.profile index b342b3961..b342b3961 100644 --- a/etc/opera.profile +++ b/etc/profile-m-z/opera.profile | |||
diff --git a/etc/orage.profile b/etc/profile-m-z/orage.profile index 4e12892d6..4e12892d6 100644 --- a/etc/orage.profile +++ b/etc/profile-m-z/orage.profile | |||
diff --git a/etc/profile-m-z/org.gnome.NautilusPreviewer.profile b/etc/profile-m-z/org.gnome.NautilusPreviewer.profile new file mode 100644 index 000000000..eb75add58 --- /dev/null +++ b/etc/profile-m-z/org.gnome.NautilusPreviewer.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile alias for sushi | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include org.gnome.NautilusPreviewer.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include sushi.profile | ||
diff --git a/etc/ostrichriders.profile b/etc/profile-m-z/ostrichriders.profile index bef784126..cc44d5a48 100644 --- a/etc/ostrichriders.profile +++ b/etc/profile-m-z/ostrichriders.profile | |||
@@ -14,17 +14,19 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.ostrichriders | 20 | mkdir ${HOME}/.ostrichriders |
20 | whitelist ${HOME}/.ostrichriders | 21 | whitelist ${HOME}/.ostrichriders |
22 | whitelist /usr/share/ostrichriders | ||
21 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
24 | caps.drop all | 27 | caps.drop all |
25 | ipc-namespace | 28 | ipc-namespace |
26 | net none | 29 | net none |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -43,3 +45,6 @@ private-cache | |||
43 | # private-dev should be commented for controllers | 45 | # private-dev should be commented for controllers |
44 | private-dev | 46 | private-dev |
45 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/profile-m-z/otter-browser.profile b/etc/profile-m-z/otter-browser.profile new file mode 100644 index 000000000..652b6b7cb --- /dev/null +++ b/etc/profile-m-z/otter-browser.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for otter-browser | ||
2 | # Description: Lightweight web browser based on Qt5 | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include otter-browser.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ?BROWSER_ALLOW_DRM: ignore noexec ${HOME} | ||
10 | |||
11 | noblacklist ${HOME}/.cache/Otter | ||
12 | noblacklist ${HOME}/.config/otter | ||
13 | noblacklist ${HOME}/.pki | ||
14 | noblacklist ${HOME}/.local/share/pki | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-xdg.inc | ||
23 | |||
24 | mkdir ${HOME}/.cache/Otter | ||
25 | mkdir ${HOME}/.config/otter | ||
26 | mkdir ${HOME}/.pki | ||
27 | mkdir ${HOME}/.local/share/pki | ||
28 | whitelist ${DOWNLOADS} | ||
29 | whitelist ${HOME}/.cache/Otter | ||
30 | whitelist ${HOME}/.config/otter | ||
31 | whitelist ${HOME}/.pki | ||
32 | whitelist ${HOME}/.local/share/pki | ||
33 | whitelist /usr/share/otter-browser | ||
34 | include whitelist-common.inc | ||
35 | include whitelist-runuser-common.inc | ||
36 | include whitelist-usr-share-common.inc | ||
37 | include whitelist-var-common.inc | ||
38 | |||
39 | apparmor | ||
40 | caps.drop all | ||
41 | netfilter | ||
42 | nodvd | ||
43 | nogroups | ||
44 | nonewprivs | ||
45 | noroot | ||
46 | notv | ||
47 | ?BROWSER_DISABLE_U2F: nou2f | ||
48 | protocol unix,inet,inet6,netlink | ||
49 | seccomp !chroot | ||
50 | shell none | ||
51 | |||
52 | disable-mnt | ||
53 | private-bin bash,otter-browser,sh,which | ||
54 | private-cache | ||
55 | ?BROWSER_DISABLE_U2F: private-dev | ||
56 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | ||
57 | private-tmp | ||
58 | |||
59 | dbus-system none | ||
diff --git a/etc/out123.profile b/etc/profile-m-z/out123.profile index 4754c05ba..4754c05ba 100644 --- a/etc/out123.profile +++ b/etc/profile-m-z/out123.profile | |||
diff --git a/etc/p7zip.profile b/etc/profile-m-z/p7zip.profile index 652fac7bd..652fac7bd 100644 --- a/etc/p7zip.profile +++ b/etc/profile-m-z/p7zip.profile | |||
diff --git a/etc/palemoon.profile b/etc/profile-m-z/palemoon.profile index acb2ce176..acb2ce176 100644 --- a/etc/palemoon.profile +++ b/etc/profile-m-z/palemoon.profile | |||
diff --git a/etc/pandoc.profile b/etc/profile-m-z/pandoc.profile index 9a8d82a96..9ee7e75b4 100644 --- a/etc/pandoc.profile +++ b/etc/profile-m-z/pandoc.profile | |||
@@ -8,6 +8,7 @@ include pandoc.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
@@ -17,6 +18,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 22 | include disable-xdg.inc |
21 | 23 | ||
22 | # breaks pdf output | 24 | # breaks pdf output |
@@ -28,7 +30,6 @@ ipc-namespace | |||
28 | machine-id | 30 | machine-id |
29 | net none | 31 | net none |
30 | no3d | 32 | no3d |
31 | nodbus | ||
32 | nodvd | 33 | nodvd |
33 | nogroups | 34 | nogroups |
34 | nonewprivs | 35 | nonewprivs |
@@ -47,7 +48,10 @@ disable-mnt | |||
47 | private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf | 48 | private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf |
48 | private-cache | 49 | private-cache |
49 | private-dev | 50 | private-dev |
50 | private-etc alternatives,texlive | 51 | private-etc alternatives,texlive,texmf |
51 | private-tmp | 52 | private-tmp |
52 | 53 | ||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
53 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/parole.profile b/etc/profile-m-z/parole.profile index e7a0694ed..0a4422a73 100644 --- a/etc/parole.profile +++ b/etc/profile-m-z/parole.profile | |||
@@ -14,6 +14,7 @@ include disable-devel.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/patch.profile b/etc/profile-m-z/patch.profile index 4a3365378..8663fb453 100644 --- a/etc/patch.profile +++ b/etc/profile-m-z/patch.profile | |||
@@ -8,6 +8,7 @@ include patch.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
@@ -16,6 +17,7 @@ include disable-devel.inc | |||
16 | include disable-exec.inc | 17 | include disable-exec.inc |
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 21 | include disable-xdg.inc |
20 | 22 | ||
21 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
@@ -25,7 +27,6 @@ caps.drop all | |||
25 | ipc-namespace | 27 | ipc-namespace |
26 | net none | 28 | net none |
27 | no3d | 29 | no3d |
28 | nodbus | ||
29 | nodvd | 30 | nodvd |
30 | nogroups | 31 | nogroups |
31 | nonewprivs | 32 | nonewprivs |
@@ -44,4 +45,7 @@ private-bin patch,red | |||
44 | private-dev | 45 | private-dev |
45 | private-lib libfakeroot | 46 | private-lib libfakeroot |
46 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
47 | memory-deny-write-execute | 51 | memory-deny-write-execute |
diff --git a/etc/pavucontrol-qt.profile b/etc/profile-m-z/pavucontrol-qt.profile index f96ba14d2..f96ba14d2 100644 --- a/etc/pavucontrol-qt.profile +++ b/etc/profile-m-z/pavucontrol-qt.profile | |||
diff --git a/etc/pavucontrol.profile b/etc/profile-m-z/pavucontrol.profile index 0ae9f08af..f7d3576da 100644 --- a/etc/pavucontrol.profile +++ b/etc/profile-m-z/pavucontrol.profile | |||
@@ -29,7 +29,6 @@ apparmor | |||
29 | caps.drop all | 29 | caps.drop all |
30 | netfilter | 30 | netfilter |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,5 +49,8 @@ private-etc alternatives,asound.conf,avahi,fonts,machine-id,pulse | |||
50 | private-lib | 49 | private-lib |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | # mdwe is broken under Wayland, but works under Xorg. | 55 | # mdwe is broken under Wayland, but works under Xorg. |
54 | #memory-deny-write-execute | 56 | #memory-deny-write-execute |
diff --git a/etc/profile-m-z/pcmanfm.profile b/etc/profile-m-z/pcmanfm.profile new file mode 100644 index 000000000..5718ab164 --- /dev/null +++ b/etc/profile-m-z/pcmanfm.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for pcmanfm | ||
2 | # Description: Extremely fast and lightweight file manager | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include pcmanfm.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your pcmanfm.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/pdfchain.profile b/etc/profile-m-z/pdfchain.profile index 98a9f1840..4b6da4d6f 100644 --- a/etc/pdfchain.profile +++ b/etc/profile-m-z/pdfchain.profile | |||
@@ -21,7 +21,6 @@ caps.drop all | |||
21 | ipc-namespace | 21 | ipc-namespace |
22 | net none | 22 | net none |
23 | no3d | 23 | no3d |
24 | nodbus | ||
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
27 | noroot | 26 | noroot |
@@ -38,4 +37,7 @@ private-dev | |||
38 | private-etc alternatives,dconf,fonts,gtk-3.0,xdg | 37 | private-etc alternatives,dconf,fonts,gtk-3.0,xdg |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
42 | |||
41 | memory-deny-write-execute | 43 | memory-deny-write-execute |
diff --git a/etc/pdflatex.profile b/etc/profile-m-z/pdflatex.profile index caf980d4d..caf980d4d 100644 --- a/etc/pdflatex.profile +++ b/etc/profile-m-z/pdflatex.profile | |||
diff --git a/etc/pdfmod.profile b/etc/profile-m-z/pdfmod.profile index 177070e83..fb3c42526 100644 --- a/etc/pdfmod.profile +++ b/etc/profile-m-z/pdfmod.profile | |||
@@ -25,7 +25,6 @@ ipc-namespace | |||
25 | machine-id | 25 | machine-id |
26 | net none | 26 | net none |
27 | no3d | 27 | no3d |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -41,3 +40,5 @@ shell none | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/pdfsam.profile b/etc/profile-m-z/pdfsam.profile index 48f424190..2f4227159 100644 --- a/etc/pdfsam.profile +++ b/etc/profile-m-z/pdfsam.profile | |||
@@ -23,7 +23,6 @@ caps.drop all | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -41,3 +40,5 @@ private-cache | |||
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/pdftotext.profile b/etc/profile-m-z/pdftotext.profile index 73ebf4615..eee42424f 100644 --- a/etc/pdftotext.profile +++ b/etc/profile-m-z/pdftotext.profile | |||
@@ -7,6 +7,7 @@ include pdftotext.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | blacklist ${RUNUSER}/wayland-* | 9 | blacklist ${RUNUSER}/wayland-* |
10 | blacklist ${RUNUSER} | ||
10 | 11 | ||
11 | noblacklist ${DOCUMENTS} | 12 | noblacklist ${DOCUMENTS} |
12 | 13 | ||
@@ -15,6 +16,7 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
19 | 21 | ||
20 | whitelist ${DOCUMENTS} | 22 | whitelist ${DOCUMENTS} |
@@ -28,7 +30,6 @@ ipc-namespace | |||
28 | machine-id | 30 | machine-id |
29 | net none | 31 | net none |
30 | no3d | 32 | no3d |
31 | nodbus | ||
32 | nodvd | 33 | nodvd |
33 | nogroups | 34 | nogroups |
34 | nonewprivs | 35 | nonewprivs |
@@ -48,3 +49,6 @@ private-cache | |||
48 | private-dev | 49 | private-dev |
49 | private-etc alternatives | 50 | private-etc alternatives |
50 | private-tmp | 51 | private-tmp |
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/peek.profile b/etc/profile-m-z/peek.profile index 8cbff0c64..66fdd6496 100644 --- a/etc/peek.profile +++ b/etc/profile-m-z/peek.profile | |||
@@ -20,7 +20,6 @@ include disable-xdg.inc | |||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | no3d | 22 | no3d |
23 | nodbus | ||
24 | nodvd | 23 | nodvd |
25 | nogroups | 24 | nogroups |
26 | nonewprivs | 25 | nonewprivs |
@@ -38,4 +37,7 @@ shell none | |||
38 | private-dev | 37 | private-dev |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
42 | |||
41 | memory-deny-write-execute | 43 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/penguin-command.profile b/etc/profile-m-z/penguin-command.profile new file mode 100644 index 000000000..db0d84496 --- /dev/null +++ b/etc/profile-m-z/penguin-command.profile | |||
@@ -0,0 +1,42 @@ | |||
1 | # Firejail profile for open-invaders | ||
2 | # Description: Space Invaders clone | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include penguin-command.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.penguin-command | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | |||
19 | whitelist ${HOME}/.penguin-command | ||
20 | include whitelist-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | net none | ||
26 | nodvd | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | notv | ||
31 | nou2f | ||
32 | novideo | ||
33 | protocol unix,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | |||
37 | private-bin penguin-command | ||
38 | private-dev | ||
39 | private-tmp | ||
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/picard.profile b/etc/profile-m-z/picard.profile index 15fc7a454..15fc7a454 100644 --- a/etc/picard.profile +++ b/etc/profile-m-z/picard.profile | |||
diff --git a/etc/pidgin.profile b/etc/profile-m-z/pidgin.profile index 2e4215744..2e4215744 100644 --- a/etc/pidgin.profile +++ b/etc/profile-m-z/pidgin.profile | |||
diff --git a/etc/ping.profile b/etc/profile-m-z/ping.profile index 5f68ee011..3ef8ad64a 100644 --- a/etc/ping.profile +++ b/etc/profile-m-z/ping.profile | |||
@@ -7,6 +7,10 @@ include ping.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
10 | include disable-common.inc | 14 | include disable-common.inc |
11 | include disable-devel.inc | 15 | include disable-devel.inc |
12 | include disable-exec.inc | 16 | include disable-exec.inc |
@@ -19,6 +23,7 @@ include whitelist-common.inc | |||
19 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
21 | 25 | ||
26 | apparmor | ||
22 | caps.keep net_raw | 27 | caps.keep net_raw |
23 | ipc-namespace | 28 | ipc-namespace |
24 | #net tun0 | 29 | #net tun0 |
diff --git a/etc/pingus.profile b/etc/profile-m-z/pingus.profile index a3adc55a2..ebfd236aa 100644 --- a/etc/pingus.profile +++ b/etc/profile-m-z/pingus.profile | |||
@@ -10,17 +10,23 @@ noblacklist ${HOME}/.pingus | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
16 | 18 | ||
17 | mkdir ${HOME}/.pingus | 19 | mkdir ${HOME}/.pingus |
18 | whitelist ${HOME}/.pingus | 20 | whitelist ${HOME}/.pingus |
21 | whitelist /usr/share/pingus | ||
19 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
20 | 26 | ||
27 | apparmor | ||
21 | caps.drop all | 28 | caps.drop all |
22 | net none | 29 | net none |
23 | nodbus | ||
24 | nodvd | 30 | nodvd |
25 | nogroups | 31 | nogroups |
26 | nonewprivs | 32 | nonewprivs |
@@ -31,7 +37,14 @@ novideo | |||
31 | protocol unix,netlink | 37 | protocol unix,netlink |
32 | seccomp | 38 | seccomp |
33 | shell none | 39 | shell none |
40 | tracelog | ||
34 | 41 | ||
35 | # private-bin pingus | 42 | disable-mnt |
43 | private-bin pingus,pingus.bin,sh | ||
44 | private-cache | ||
36 | private-dev | 45 | private-dev |
46 | private-etc machine-id | ||
37 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/pinta.profile b/etc/profile-m-z/pinta.profile index 8151bc98f..7d94972c4 100644 --- a/etc/pinta.profile +++ b/etc/profile-m-z/pinta.profile | |||
@@ -21,7 +21,6 @@ include disable-xdg.inc | |||
21 | caps.drop all | 21 | caps.drop all |
22 | ipc-namespace | 22 | ipc-namespace |
23 | net none | 23 | net none |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | nogroups | 25 | nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -38,3 +37,5 @@ private-dev | |||
38 | private-cache | 37 | private-cache |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/pioneer.profile b/etc/profile-m-z/pioneer.profile index c5b936617..5f329195b 100644 --- a/etc/pioneer.profile +++ b/etc/profile-m-z/pioneer.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.pioneer | 20 | mkdir ${HOME}/.pioneer |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | net none | 27 | net none |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin modelcompiler,pioneer,savegamedump | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/pithos.profile b/etc/profile-m-z/pithos.profile index ad56ce525..0864dd0bc 100644 --- a/etc/pithos.profile +++ b/etc/profile-m-z/pithos.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
diff --git a/etc/pitivi.profile b/etc/profile-m-z/pitivi.profile index 89a6a020b..c722e29b4 100644 --- a/etc/pitivi.profile +++ b/etc/profile-m-z/pitivi.profile | |||
@@ -6,7 +6,6 @@ include pitivi.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | |||
10 | noblacklist ${HOME}/.config/pitivi | 9 | noblacklist ${HOME}/.config/pitivi |
11 | 10 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 11 | # Allow python (blacklisted by disable-interpreters.inc) |
@@ -20,11 +19,13 @@ include disable-interpreters.inc | |||
20 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
21 | include disable-programs.inc | 20 | include disable-programs.inc |
22 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
24 | 24 | ||
25 | apparmor | ||
25 | caps.drop all | 26 | caps.drop all |
26 | ipc-namespace | 27 | ipc-namespace |
27 | netfilter | 28 | net none |
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
diff --git a/etc/pix.profile b/etc/profile-m-z/pix.profile index 9864ed718..a2c35beb5 100644 --- a/etc/pix.profile +++ b/etc/profile-m-z/pix.profile | |||
@@ -15,6 +15,7 @@ include disable-devel.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | nodvd | 21 | nodvd |
diff --git a/etc/planmaker18.profile b/etc/profile-m-z/planmaker18.profile index 4cf1efb7f..2ba8e86c0 100644 --- a/etc/planmaker18.profile +++ b/etc/profile-m-z/planmaker18.profile | |||
@@ -7,4 +7,4 @@ include planmaker18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/planmaker18free.profile b/etc/profile-m-z/planmaker18free.profile index bb85f1fc7..d0bce44f5 100644 --- a/etc/planmaker18free.profile +++ b/etc/profile-m-z/planmaker18free.profile | |||
@@ -7,4 +7,4 @@ include planmaker18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/playonlinux.profile b/etc/profile-m-z/playonlinux.profile index 03091af6d..03091af6d 100644 --- a/etc/playonlinux.profile +++ b/etc/profile-m-z/playonlinux.profile | |||
diff --git a/etc/pluma.profile b/etc/profile-m-z/pluma.profile index dadfcc44e..5303eae8a 100644 --- a/etc/pluma.profile +++ b/etc/profile-m-z/pluma.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | 22 | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
@@ -26,7 +27,6 @@ caps.drop all | |||
26 | machine-id | 27 | machine-id |
27 | # net none - makes settings immutable | 28 | # net none - makes settings immutable |
28 | no3d | 29 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -45,6 +45,10 @@ private-dev | |||
45 | private-lib aspell,gconv,libgspell-1.so.*,libreadline.so.*,libtinfo.so.*,pluma | 45 | private-lib aspell,gconv,libgspell-1.so.*,libreadline.so.*,libtinfo.so.*,pluma |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # makes settings immutable | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
48 | memory-deny-write-execute | 52 | memory-deny-write-execute |
49 | 53 | ||
50 | join-or-start pluma | 54 | join-or-start pluma |
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile new file mode 100644 index 000000000..7ff59ea77 --- /dev/null +++ b/etc/profile-m-z/plv.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for plv | ||
2 | # Description: Inspect pacman log files | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include plv.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/PacmanLogViewer | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/PacmanLogViewer | ||
20 | whitelist ${HOME}/.config/PacmanLogViewer | ||
21 | whitelist /var/log/pacman* | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | ipc-namespace | ||
30 | machine-id | ||
31 | net none | ||
32 | no3d | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | nosound | ||
38 | notv | ||
39 | nou2f | ||
40 | novideo | ||
41 | seccomp | ||
42 | shell none | ||
43 | tracelog | ||
44 | |||
45 | disable-mnt | ||
46 | private-bin plv | ||
47 | private-cache | ||
48 | private-dev | ||
49 | private-etc alternatives,fonts | ||
50 | private-opt none | ||
51 | private-tmp | ||
52 | writable-var-log | ||
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
57 | #memory-deny-write-execute - breaks opening file-chooser | ||
58 | read-only ${HOME} | ||
59 | read-write ${HOME}/.config/PacmanLogViewer | ||
diff --git a/etc/pngquant.profile b/etc/profile-m-z/pngquant.profile index f9ce43c4c..83905b108 100644 --- a/etc/pngquant.profile +++ b/etc/profile-m-z/pngquant.profile | |||
@@ -15,7 +15,10 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
19 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
20 | 23 | ||
21 | apparmor | 24 | apparmor |
@@ -24,7 +27,6 @@ ipc-namespace | |||
24 | machine-id | 27 | machine-id |
25 | net none | 28 | net none |
26 | no3d | 29 | no3d |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -46,4 +48,7 @@ private-dev | |||
46 | private-etc alternatives | 48 | private-etc alternatives |
47 | private-tmp | 49 | private-tmp |
48 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
49 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/polari.profile b/etc/profile-m-z/polari.profile index 939e2537e..87a53775f 100644 --- a/etc/polari.profile +++ b/etc/profile-m-z/polari.profile | |||
@@ -28,6 +28,7 @@ whitelist ${HOME}/.local/share/TpLogger | |||
28 | whitelist ${HOME}/.local/share/telepathy | 28 | whitelist ${HOME}/.local/share/telepathy |
29 | whitelist ${HOME}/.purple | 29 | whitelist ${HOME}/.purple |
30 | include whitelist-common.inc | 30 | include whitelist-common.inc |
31 | include whitelist-runuser-common.inc | ||
31 | 32 | ||
32 | caps.drop all | 33 | caps.drop all |
33 | netfilter | 34 | netfilter |
diff --git a/etc/ppsspp.profile b/etc/profile-m-z/ppsspp.profile index 970290002..c62e53151 100644 --- a/etc/ppsspp.profile +++ b/etc/profile-m-z/ppsspp.profile | |||
@@ -21,9 +21,7 @@ include whitelist-var-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | ipc-namespace | 23 | ipc-namespace |
24 | netfilter | ||
25 | net none | 24 | net none |
26 | nodbus | ||
27 | nodvd | 25 | nodvd |
28 | nogroups | 26 | nogroups |
29 | nonewprivs | 27 | nonewprivs |
@@ -40,3 +38,5 @@ private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts | |||
40 | private-opt ppsspp | 38 | private-opt ppsspp |
41 | private-tmp | 39 | private-tmp |
42 | 40 | ||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/pragha.profile b/etc/profile-m-z/pragha.profile index 019c1a547..019c1a547 100644 --- a/etc/pragha.profile +++ b/etc/profile-m-z/pragha.profile | |||
diff --git a/etc/presentations18.profile b/etc/profile-m-z/presentations18.profile index ac844d1af..d4f531060 100644 --- a/etc/presentations18.profile +++ b/etc/profile-m-z/presentations18.profile | |||
@@ -7,4 +7,5 @@ include presentations18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/presentations18free.profile b/etc/profile-m-z/presentations18free.profile index 218747224..e2319f13f 100644 --- a/etc/presentations18free.profile +++ b/etc/profile-m-z/presentations18free.profile | |||
@@ -7,4 +7,4 @@ include presentations18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
diff --git a/etc/profanity.profile b/etc/profile-m-z/profanity.profile index 6ca9314e9..a02bcd826 100644 --- a/etc/profanity.profile +++ b/etc/profile-m-z/profanity.profile | |||
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
@@ -28,7 +29,6 @@ include whitelist-var-common.inc | |||
28 | caps.drop all | 29 | caps.drop all |
29 | netfilter | 30 | netfilter |
30 | no3d | 31 | no3d |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -47,4 +47,7 @@ private-dev | |||
47 | private-etc alternatives,ca-certificates,crypto-policies,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
50 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/psi-plus.profile b/etc/profile-m-z/psi-plus.profile index 16fffe517..16fffe517 100644 --- a/etc/psi-plus.profile +++ b/etc/profile-m-z/psi-plus.profile | |||
diff --git a/etc/pybitmessage.profile b/etc/profile-m-z/pybitmessage.profile index 034c144c7..034c144c7 100644 --- a/etc/pybitmessage.profile +++ b/etc/profile-m-z/pybitmessage.profile | |||
diff --git a/etc/pycharm-community.profile b/etc/profile-m-z/pycharm-community.profile index 9ee426a95..9ee426a95 100644 --- a/etc/pycharm-community.profile +++ b/etc/profile-m-z/pycharm-community.profile | |||
diff --git a/etc/pycharm-professional.profile b/etc/profile-m-z/pycharm-professional.profile index a14d0268b..a14d0268b 100644 --- a/etc/pycharm-professional.profile +++ b/etc/profile-m-z/pycharm-professional.profile | |||
diff --git a/etc/pzstd.profile b/etc/profile-m-z/pzstd.profile index ce9af3286..ce9af3286 100644 --- a/etc/pzstd.profile +++ b/etc/profile-m-z/pzstd.profile | |||
diff --git a/etc/qbittorrent.profile b/etc/profile-m-z/qbittorrent.profile index fe9caec77..81ec1bc6b 100644 --- a/etc/qbittorrent.profile +++ b/etc/profile-m-z/qbittorrent.profile | |||
@@ -21,6 +21,7 @@ include disable-exec.inc | |||
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | include disable-shell.inc | ||
24 | 25 | ||
25 | mkdir ${HOME}/.cache/qBittorrent | 26 | mkdir ${HOME}/.cache/qBittorrent |
26 | mkdir ${HOME}/.config/qBittorrent | 27 | mkdir ${HOME}/.config/qBittorrent |
@@ -38,7 +39,6 @@ apparmor | |||
38 | caps.drop all | 39 | caps.drop all |
39 | machine-id | 40 | machine-id |
40 | netfilter | 41 | netfilter |
41 | nodbus | ||
42 | nodvd | 42 | nodvd |
43 | nogroups | 43 | nogroups |
44 | nonewprivs | 44 | nonewprivs |
@@ -56,4 +56,7 @@ private-dev | |||
56 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg | 56 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg |
57 | private-tmp | 57 | private-tmp |
58 | 58 | ||
59 | dbus-user none | ||
60 | dbus-system none | ||
61 | |||
59 | # memory-deny-write-execute - problems on Arch, see #1690 on GitHub repo | 62 | # memory-deny-write-execute - problems on Arch, see #1690 on GitHub repo |
diff --git a/etc/qemu-launcher.profile b/etc/profile-m-z/qemu-launcher.profile index ac60384fd..ac60384fd 100644 --- a/etc/qemu-launcher.profile +++ b/etc/profile-m-z/qemu-launcher.profile | |||
diff --git a/etc/qemu-system-x86_64.profile b/etc/profile-m-z/qemu-system-x86_64.profile index d7d7905dd..d7d7905dd 100644 --- a/etc/qemu-system-x86_64.profile +++ b/etc/profile-m-z/qemu-system-x86_64.profile | |||
diff --git a/etc/qgis.profile b/etc/profile-m-z/qgis.profile index 88ed0cd81..eee538383 100644 --- a/etc/qgis.profile +++ b/etc/profile-m-z/qgis.profile | |||
@@ -35,7 +35,6 @@ include whitelist-var-common.inc | |||
35 | caps.drop all | 35 | caps.drop all |
36 | netfilter | 36 | netfilter |
37 | machine-id | 37 | machine-id |
38 | nodbus | ||
39 | nodvd | 38 | nodvd |
40 | nogroups | 39 | nogroups |
41 | nonewprivs | 40 | nonewprivs |
@@ -55,3 +54,6 @@ private-cache | |||
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf |
57 | private-tmp | 56 | private-tmp |
57 | |||
58 | dbus-user none | ||
59 | dbus-system none | ||
diff --git a/etc/qlipper.profile b/etc/profile-m-z/qlipper.profile index fb9dca48f..fb9dca48f 100644 --- a/etc/qlipper.profile +++ b/etc/profile-m-z/qlipper.profile | |||
diff --git a/etc/qmmp.profile b/etc/profile-m-z/qmmp.profile index b69bbdef1..e1f679417 100644 --- a/etc/qmmp.profile +++ b/etc/profile-m-z/qmmp.profile | |||
@@ -14,12 +14,12 @@ include disable-devel.inc | |||
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | netfilter | 21 | netfilter |
21 | # no3d | 22 | # no3d |
22 | nodbus | ||
23 | nogroups | 23 | nogroups |
24 | nonewprivs | 24 | nonewprivs |
25 | noroot | 25 | noroot |
@@ -35,3 +35,5 @@ private-bin bzip2,gzip,qmmp,tar,unzip | |||
35 | private-dev | 35 | private-dev |
36 | private-tmp | 36 | private-tmp |
37 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/qpdfview.profile b/etc/profile-m-z/qpdfview.profile index 863f57ba4..80e34334a 100644 --- a/etc/qpdfview.profile +++ b/etc/profile-m-z/qpdfview.profile | |||
@@ -16,14 +16,14 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
22 | 23 | ||
24 | apparmor | ||
23 | caps.drop all | 25 | caps.drop all |
24 | machine-id | 26 | machine-id |
25 | # needs D-Bus when started from a file manager | ||
26 | #nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -40,3 +40,7 @@ tracelog | |||
40 | private-bin qpdfview | 40 | private-bin qpdfview |
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | |||
44 | # needs D-Bus when started from a file manager | ||
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/qt-faststart.profile b/etc/profile-m-z/qt-faststart.profile index 2cdff33a6..2cdff33a6 100644 --- a/etc/qt-faststart.profile +++ b/etc/profile-m-z/qt-faststart.profile | |||
diff --git a/etc/qtox.profile b/etc/profile-m-z/qtox.profile index cb2a78920..eb8e3e314 100644 --- a/etc/qtox.profile +++ b/etc/profile-m-z/qtox.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.config/tox | 21 | mkdir ${HOME}/.config/tox |
@@ -27,7 +28,6 @@ apparmor | |||
27 | caps.drop all | 28 | caps.drop all |
28 | ipc-namespace | 29 | ipc-namespace |
29 | netfilter | 30 | netfilter |
30 | nodbus | ||
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | nonewprivs | 33 | nonewprivs |
@@ -46,4 +46,7 @@ private-dev | |||
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
49 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-m-z/quadrapassel.profile b/etc/profile-m-z/quadrapassel.profile new file mode 100644 index 000000000..91e0d9d0d --- /dev/null +++ b/etc/profile-m-z/quadrapassel.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for quadrapassel | ||
2 | # Description: Tetris-like game for GNOME | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include quadrapassel.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/quadrapassel | ||
10 | |||
11 | mkdir ${HOME}/.local/share/quadrapassel | ||
12 | whitelist ${HOME}/.local/share/quadrapassel | ||
13 | whitelist /usr/share/quadrapassel | ||
14 | |||
15 | private-bin quadrapassel | ||
16 | |||
17 | dbus-user.own org.gnome.Quadrapassel | ||
18 | |||
19 | # Redirect | ||
20 | include gnome_games-common.profile | ||
diff --git a/etc/quassel.profile b/etc/profile-m-z/quassel.profile index c65089e20..c65089e20 100644 --- a/etc/quassel.profile +++ b/etc/profile-m-z/quassel.profile | |||
diff --git a/etc/quiterss.profile b/etc/profile-m-z/quiterss.profile index 8dbdffdc8..366cff4ed 100644 --- a/etc/quiterss.profile +++ b/etc/profile-m-z/quiterss.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | 21 | ||
21 | mkdir ${HOME}/.cache/QuiteRss | 22 | mkdir ${HOME}/.cache/QuiteRss |
22 | mkdir ${HOME}/.config/QuiteRss | 23 | mkdir ${HOME}/.config/QuiteRss |
diff --git a/etc/qupzilla.profile b/etc/profile-m-z/qupzilla.profile index 7aa71c848..7aa71c848 100644 --- a/etc/qupzilla.profile +++ b/etc/profile-m-z/qupzilla.profile | |||
diff --git a/etc/qutebrowser.profile b/etc/profile-m-z/qutebrowser.profile index fc910b589..fc910b589 100644 --- a/etc/qutebrowser.profile +++ b/etc/profile-m-z/qutebrowser.profile | |||
diff --git a/etc/rambox.profile b/etc/profile-m-z/rambox.profile index 6f7f37aaf..ffa2022ee 100644 --- a/etc/rambox.profile +++ b/etc/profile-m-z/rambox.profile | |||
@@ -1,4 +1,5 @@ | |||
1 | # Firejail profile for rambox | 1 | # Firejail profile for rambox |
2 | # Description: Free and Open Source messaging and emailing app that combines common web applications into one (Electron-based) | ||
2 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 4 | # Persistent local customizations |
4 | include rambox.local | 5 | include rambox.local |
@@ -31,5 +32,7 @@ nonewprivs | |||
31 | noroot | 32 | noroot |
32 | notv | 33 | notv |
33 | protocol unix,inet,inet6,netlink | 34 | protocol unix,inet,inet6,netlink |
34 | seccomp | 35 | # electron-based application, needing chroot |
36 | #seccomp | ||
37 | seccomp !chroot | ||
35 | # tracelog | 38 | # tracelog |
diff --git a/etc/profile-m-z/ranger.profile b/etc/profile-m-z/ranger.profile new file mode 100644 index 000000000..8b3fe97d8 --- /dev/null +++ b/etc/profile-m-z/ranger.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail profile for ranger | ||
2 | # Description: File manager with an ncurses frontend written in Python | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ranger.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Put 'ignore noroot' in your ranger.local if you use MPV+Vulkan (see issue #3012) | ||
10 | |||
11 | # Redirect | ||
12 | include file-manager-common.profile | ||
diff --git a/etc/redeclipse.profile b/etc/profile-m-z/redeclipse.profile index bb1ad56d3..bb1ad56d3 100644 --- a/etc/redeclipse.profile +++ b/etc/profile-m-z/redeclipse.profile | |||
diff --git a/etc/redshift.profile b/etc/profile-m-z/redshift.profile index 0f6d34ed0..298ab1902 100644 --- a/etc/redshift.profile +++ b/etc/profile-m-z/redshift.profile | |||
@@ -29,7 +29,6 @@ ipc-namespace | |||
29 | machine-id | 29 | machine-id |
30 | netfilter | 30 | netfilter |
31 | no3d | 31 | no3d |
32 | nodbus | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -48,4 +47,7 @@ private-cache | |||
48 | private-dev | 47 | private-dev |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/regextester.profile b/etc/profile-m-z/regextester.profile index e30748946..6fb0d4b5f 100644 --- a/etc/regextester.profile +++ b/etc/profile-m-z/regextester.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | whitelist /usr/share/com.github.artemanufrij.regextester | 18 | whitelist /usr/share/com.github.artemanufrij.regextester |
@@ -26,7 +27,6 @@ ipc-namespace | |||
26 | machine-id | 27 | machine-id |
27 | net none | 28 | net none |
28 | no3d | 29 | no3d |
29 | # nodbus - makes settings immutable | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -48,6 +48,10 @@ private-etc alternatives,fonts | |||
48 | private-lib libgranite.so.* | 48 | private-lib libgranite.so.* |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # makes settings immutable | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
54 | |||
51 | memory-deny-write-execute | 55 | memory-deny-write-execute |
52 | 56 | ||
53 | # never write anything | 57 | # never write anything |
diff --git a/etc/remmina.profile b/etc/profile-m-z/remmina.profile index e85ceca13..6311c91df 100644 --- a/etc/remmina.profile +++ b/etc/profile-m-z/remmina.profile | |||
@@ -19,6 +19,7 @@ include disable-passwdmgr.inc | |||
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-runuser-common.inc | ||
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
24 | caps.drop all | 25 | caps.drop all |
diff --git a/etc/rhythmbox-client.profile b/etc/profile-m-z/rhythmbox-client.profile index 29e65d716..29e65d716 100644 --- a/etc/rhythmbox-client.profile +++ b/etc/profile-m-z/rhythmbox-client.profile | |||
diff --git a/etc/rhythmbox.profile b/etc/profile-m-z/rhythmbox.profile index ad8b1015e..b76f2b947 100644 --- a/etc/rhythmbox.profile +++ b/etc/profile-m-z/rhythmbox.profile | |||
@@ -20,25 +20,26 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 24 | include disable-xdg.inc |
24 | 25 | ||
25 | whitelist /usr/share/rhythmbox | 26 | whitelist /usr/share/rhythmbox |
26 | whitelist /usr/share/lua | 27 | whitelist /usr/share/lua |
27 | whitelist /usr/share/libquvi-scripts | 28 | whitelist /usr/share/libquvi-scripts |
29 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
30 | 32 | ||
31 | # apparmor - makes settings immutable | 33 | apparmor |
32 | caps.drop all | 34 | caps.drop all |
33 | netfilter | 35 | netfilter |
34 | # nodbus - makes settings immutable | ||
35 | nogroups | 36 | nogroups |
36 | nonewprivs | 37 | nonewprivs |
37 | noroot | 38 | noroot |
38 | notv | 39 | notv |
39 | nou2f | 40 | nou2f |
40 | novideo | 41 | novideo |
41 | protocol unix,inet,inet6 | 42 | protocol unix,inet,inet6,netlink |
42 | seccomp | 43 | seccomp |
43 | shell none | 44 | shell none |
44 | tracelog | 45 | tracelog |
@@ -46,3 +47,13 @@ tracelog | |||
46 | private-bin rhythmbox,rhythmbox-client | 47 | private-bin rhythmbox,rhythmbox-client |
47 | private-dev | 48 | private-dev |
48 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user filter | ||
52 | dbus-user.own org.gnome.Rhythmbox3 | ||
53 | dbus-user.own org.mpris.MediaPlayer2.rhythmbox | ||
54 | dbus-user.own org.gnome.UPnP.MediaServer2.Rhythmbox | ||
55 | dbus-user.talk ca.desrt.dconf | ||
56 | dbus-user.talk org.freedesktop.Notifications | ||
57 | dbus-system none | ||
58 | dbus-system filter | ||
59 | dbus-system.talk org.freedesktop.Avahi | ||
diff --git a/etc/ricochet.profile b/etc/profile-m-z/ricochet.profile index 1b8fbbc97..86e3fbfb5 100644 --- a/etc/ricochet.profile +++ b/etc/profile-m-z/ricochet.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | mkdir ${HOME}/.local/share/Ricochet | 18 | mkdir ${HOME}/.local/share/Ricochet |
18 | whitelist ${DOWNLOADS} | 19 | whitelist ${DOWNLOADS} |
diff --git a/etc/riot-desktop.profile b/etc/profile-m-z/riot-desktop.profile index 4372fabe1..4372fabe1 100644 --- a/etc/riot-desktop.profile +++ b/etc/profile-m-z/riot-desktop.profile | |||
diff --git a/etc/riot-web.profile b/etc/profile-m-z/riot-web.profile index b930adf2b..b930adf2b 100644 --- a/etc/riot-web.profile +++ b/etc/profile-m-z/riot-web.profile | |||
diff --git a/etc/profile-m-z/ripperx.profile b/etc/profile-m-z/ripperx.profile new file mode 100644 index 000000000..cf6daada5 --- /dev/null +++ b/etc/profile-m-z/ripperx.profile | |||
@@ -0,0 +1,43 @@ | |||
1 | # Firejail profile for mpv | ||
2 | # Description: Graphical audio CD ripper and encoder | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ripperx.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.ripperXrc | ||
10 | noblacklist ${MUSIC} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | netfilter | ||
26 | no3d | ||
27 | nogroups | ||
28 | nonewprivs | ||
29 | noroot | ||
30 | nou2f | ||
31 | notv | ||
32 | novideo | ||
33 | protocol unix,inet,inet6 | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | private-cache | ||
39 | private-dev | ||
40 | private-tmp | ||
41 | |||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/ristretto.profile b/etc/profile-m-z/ristretto.profile index 8fcbb203c..a1cbdf16c 100644 --- a/etc/ristretto.profile +++ b/etc/profile-m-z/ristretto.profile | |||
@@ -17,7 +17,11 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
20 | caps.drop all | 23 | caps.drop all |
24 | net none | ||
21 | netfilter | 25 | netfilter |
22 | no3d | 26 | no3d |
23 | nodvd | 27 | nodvd |
diff --git a/etc/rnano.profile b/etc/profile-m-z/rnano.profile index d9048982a..d9048982a 100644 --- a/etc/rnano.profile +++ b/etc/profile-m-z/rnano.profile | |||
diff --git a/etc/rocketchat.profile b/etc/profile-m-z/rocketchat.profile index a574e4e8b..a574e4e8b 100644 --- a/etc/rocketchat.profile +++ b/etc/profile-m-z/rocketchat.profile | |||
diff --git a/etc/rsync-download_only.profile b/etc/profile-m-z/rsync-download_only.profile index 84147f0a5..95deed119 100644 --- a/etc/rsync-download_only.profile +++ b/etc/profile-m-z/rsync-download_only.profile | |||
@@ -14,6 +14,7 @@ include globals.local | |||
14 | 14 | ||
15 | blacklist /tmp/.X11-unix | 15 | blacklist /tmp/.X11-unix |
16 | blacklist ${RUNUSER}/wayland-* | 16 | blacklist ${RUNUSER}/wayland-* |
17 | blacklist ${RUNUSER} | ||
17 | 18 | ||
18 | include disable-common.inc | 19 | include disable-common.inc |
19 | include disable-devel.inc | 20 | include disable-devel.inc |
@@ -21,6 +22,7 @@ include disable-exec.inc | |||
21 | include disable-interpreters.inc | 22 | include disable-interpreters.inc |
22 | include disable-passwdmgr.inc | 23 | include disable-passwdmgr.inc |
23 | include disable-programs.inc | 24 | include disable-programs.inc |
25 | include disable-shell.inc | ||
24 | include disable-xdg.inc | 26 | include disable-xdg.inc |
25 | 27 | ||
26 | # Uncomment or add to rsync.local to enable extra hardening | 28 | # Uncomment or add to rsync.local to enable extra hardening |
@@ -32,7 +34,6 @@ ipc-namespace | |||
32 | machine-id | 34 | machine-id |
33 | netfilter | 35 | netfilter |
34 | no3d | 36 | no3d |
35 | nodbus | ||
36 | nodvd | 37 | nodvd |
37 | nogroups | 38 | nogroups |
38 | nonewprivs | 39 | nonewprivs |
@@ -53,4 +54,7 @@ private-dev | |||
53 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 54 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
54 | private-tmp | 55 | private-tmp |
55 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
59 | |||
56 | memory-deny-write-execute | 60 | memory-deny-write-execute |
diff --git a/etc/rtorrent.profile b/etc/profile-m-z/rtorrent.profile index 0b4d6e1b1..308c1c802 100644 --- a/etc/rtorrent.profile +++ b/etc/profile-m-z/rtorrent.profile | |||
@@ -12,6 +12,7 @@ include disable-devel.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | 16 | ||
16 | caps.drop all | 17 | caps.drop all |
17 | machine-id | 18 | machine-id |
diff --git a/etc/rtv.profile b/etc/profile-m-z/rtv.profile index af4b7e94b..14740e05f 100644 --- a/etc/rtv.profile +++ b/etc/profile-m-z/rtv.profile | |||
@@ -35,7 +35,6 @@ caps.drop all | |||
35 | machine-id | 35 | machine-id |
36 | netfilter | 36 | netfilter |
37 | no3d | 37 | no3d |
38 | nodbus | ||
39 | nodvd | 38 | nodvd |
40 | nogroups | 39 | nogroups |
41 | nonewprivs | 40 | nonewprivs |
@@ -54,3 +53,6 @@ private-bin python*,rtv,sh,xdg-settings | |||
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg | 55 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,terminfo,xdg |
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/runenpass.sh.profile b/etc/profile-m-z/runenpass.sh.profile index 64432c171..64432c171 100644 --- a/etc/runenpass.sh.profile +++ b/etc/profile-m-z/runenpass.sh.profile | |||
diff --git a/etc/rview.profile b/etc/profile-m-z/rview.profile index fb72a00de..fb72a00de 100644 --- a/etc/rview.profile +++ b/etc/profile-m-z/rview.profile | |||
diff --git a/etc/rvim.profile b/etc/profile-m-z/rvim.profile index 7c6465d3c..7c6465d3c 100644 --- a/etc/rvim.profile +++ b/etc/profile-m-z/rvim.profile | |||
diff --git a/etc/sayonara.profile b/etc/profile-m-z/sayonara.profile index 8f0544f33..6557c0c42 100644 --- a/etc/sayonara.profile +++ b/etc/profile-m-z/sayonara.profile | |||
@@ -13,6 +13,7 @@ include disable-devel.inc | |||
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/scallion.profile b/etc/profile-m-z/scallion.profile index dee9e1f40..0f67d4d09 100644 --- a/etc/scallion.profile +++ b/etc/profile-m-z/scallion.profile | |||
@@ -23,7 +23,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 23 | caps.drop all |
24 | ipc-namespace | 24 | ipc-namespace |
25 | net none | 25 | net none |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -40,3 +39,6 @@ disable-mnt | |||
40 | private | 39 | private |
41 | private-dev | 40 | private-dev |
42 | private-tmp | 41 | private-tmp |
42 | |||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/profile-m-z/scorched3d-wrapper.profile b/etc/profile-m-z/scorched3d-wrapper.profile new file mode 100644 index 000000000..507d0827e --- /dev/null +++ b/etc/profile-m-z/scorched3d-wrapper.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile for scorched3d | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include scorched3d-wrapper.local | ||
5 | |||
6 | whitelist /usr/share/opengl-games-utils | ||
7 | private-bin basename,bash,cut,glxinfo,grep,head,sed,zenity | ||
8 | |||
9 | # Redirect | ||
10 | include scorched3d.profile | ||
diff --git a/etc/scorched3d.profile b/etc/profile-m-z/scorched3d.profile index e94d436cf..6a1003c33 100644 --- a/etc/scorched3d.profile +++ b/etc/profile-m-z/scorched3d.profile | |||
@@ -18,13 +18,15 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.scorched3d | 19 | mkdir ${HOME}/.scorched3d |
20 | whitelist ${HOME}/.scorched3d | 20 | whitelist ${HOME}/.scorched3d |
21 | whitelist /usr/share/scorched3d | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
24 | caps.drop all | 27 | caps.drop all |
25 | ipc-namespace | 28 | ipc-namespace |
26 | netfilter | 29 | netfilter |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -42,3 +44,6 @@ private-bin scorched3d,scorched3d-wrapper,scorched3dc,scorched3ds | |||
42 | private-cache | 44 | private-cache |
43 | private-dev | 45 | private-dev |
44 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/profile-m-z/scorchwentbonkers.profile b/etc/profile-m-z/scorchwentbonkers.profile new file mode 100644 index 000000000..484ebc38e --- /dev/null +++ b/etc/profile-m-z/scorchwentbonkers.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for scorchwentbonkers | ||
2 | # Description: Realtime remake of Scorched Earth | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include scorchwentbonkers.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.swb.ini | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.swb.ini | ||
21 | whitelist ${HOME}/.swb.ini | ||
22 | whitelist /usr/share/scorchwentbonkers | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin scorchwentbonkers | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc alsa,asound.conf,machine-id,pulse | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/scp.profile b/etc/profile-m-z/scp.profile index 287b8029a..287b8029a 100644 --- a/etc/scp.profile +++ b/etc/profile-m-z/scp.profile | |||
diff --git a/etc/scribus.profile b/etc/profile-m-z/scribus.profile index e20cd1b5a..22cd10737 100644 --- a/etc/scribus.profile +++ b/etc/profile-m-z/scribus.profile | |||
@@ -40,9 +40,9 @@ include disable-xdg.inc | |||
40 | 40 | ||
41 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
42 | 42 | ||
43 | apparmor | ||
43 | caps.drop all | 44 | caps.drop all |
44 | net none | 45 | net none |
45 | nodbus | ||
46 | nodvd | 46 | nodvd |
47 | nogroups | 47 | nogroups |
48 | nonewprivs | 48 | nonewprivs |
@@ -60,3 +60,5 @@ tracelog | |||
60 | private-dev | 60 | private-dev |
61 | private-tmp | 61 | private-tmp |
62 | 62 | ||
63 | dbus-user none | ||
64 | dbus-system none | ||
diff --git a/etc/sdat2img.profile b/etc/profile-m-z/sdat2img.profile index a367acad5..8d16cd07f 100644 --- a/etc/sdat2img.profile +++ b/etc/profile-m-z/sdat2img.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
@@ -23,7 +24,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 24 | caps.drop all |
24 | net none | 25 | net none |
25 | no3d | 26 | no3d |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -40,3 +40,5 @@ private-bin env,python*,sdat2img | |||
40 | private-cache | 40 | private-cache |
41 | private-dev | 41 | private-dev |
42 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile new file mode 100644 index 000000000..cb2e5ef91 --- /dev/null +++ b/etc/profile-m-z/seahorse-adventures.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for seahorse-adventures | ||
2 | # Description: Help barbie the seahorse float on bubbles to the moon | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include seahorse-adventures.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Allow python (blacklisted by disable-interpreters.inc) | ||
10 | include allow-python2.inc | ||
11 | include allow-python3.inc | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | whitelist /usr/share/seahorse-adventures | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin python*,seahorse-adventures | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc machine-id | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
diff --git a/etc/seahorse-daemon.profile b/etc/profile-m-z/seahorse-daemon.profile index 6410da4d8..6410da4d8 100644 --- a/etc/seahorse-daemon.profile +++ b/etc/profile-m-z/seahorse-daemon.profile | |||
diff --git a/etc/seahorse-tool.profile b/etc/profile-m-z/seahorse-tool.profile index 96ff74edf..96ff74edf 100644 --- a/etc/seahorse-tool.profile +++ b/etc/profile-m-z/seahorse-tool.profile | |||
diff --git a/etc/seahorse.profile b/etc/profile-m-z/seahorse.profile index 5a742d05f..85d86d646 100644 --- a/etc/seahorse.profile +++ b/etc/profile-m-z/seahorse.profile | |||
@@ -31,7 +31,10 @@ whitelist /usr/share/gnupg | |||
31 | whitelist /usr/share/gnupg2 | 31 | whitelist /usr/share/gnupg2 |
32 | whitelist /usr/share/seahorse | 32 | whitelist /usr/share/seahorse |
33 | whitelist /usr/share/seahorse-nautilus | 33 | whitelist /usr/share/seahorse-nautilus |
34 | whitelist ${RUNUSER}/gnupg | ||
35 | whitelist ${RUNUSER}/keyring | ||
34 | #include whitelist-common.inc | 36 | #include whitelist-common.inc |
37 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | 38 | include whitelist-usr-share-common.inc |
36 | include whitelist-var-common.inc | 39 | include whitelist-var-common.inc |
37 | 40 | ||
@@ -58,3 +61,8 @@ private-cache | |||
58 | private-dev | 61 | private-dev |
59 | private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 | 62 | private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 |
60 | writable-run-user | 63 | writable-run-user |
64 | |||
65 | dbus-user filter | ||
66 | dbus-user.own org.gnome.seahorse.Application | ||
67 | dbus-user.talk org.freedesktop.secrets | ||
68 | dbus-system none | ||
diff --git a/etc/seamonkey-bin.profile b/etc/profile-m-z/seamonkey-bin.profile index 532294950..532294950 100644 --- a/etc/seamonkey-bin.profile +++ b/etc/profile-m-z/seamonkey-bin.profile | |||
diff --git a/etc/seamonkey.profile b/etc/profile-m-z/seamonkey.profile index 807effbeb..807effbeb 100644 --- a/etc/seamonkey.profile +++ b/etc/profile-m-z/seamonkey.profile | |||
diff --git a/etc/secret-tool.profile b/etc/profile-m-z/secret-tool.profile index 70d9a5b1d..99ba11d30 100644 --- a/etc/secret-tool.profile +++ b/etc/profile-m-z/secret-tool.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for secret-tool | 1 | # Firejail profile for secret-tool |
2 | # Description: Library for storing and retrieving passwords and other secrets | 2 | # Description: Library for storing and retrieving passwords and other secrets |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include secret-tool.local | 6 | include secret-tool.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
diff --git a/etc/server.profile b/etc/profile-m-z/server.profile index ce318a828..5bc4735ae 100644 --- a/etc/server.profile +++ b/etc/profile-m-z/server.profile | |||
@@ -1,4 +1,27 @@ | |||
1 | # Firejail profile for server | 1 | # Generic Firejail profile for servers started as root |
2 | # | ||
3 | # This profile is used as a default when starting the sandbox as root. | ||
4 | # Example: | ||
5 | # | ||
6 | # $ sudo firejail | ||
7 | # [sudo] password for netblue: | ||
8 | # Reading profile /etc/firejail/server.profile | ||
9 | # Reading profile /etc/firejail/disable-common.inc | ||
10 | # Reading profile /etc/firejail/disable-passwdmgr.inc | ||
11 | # Reading profile /etc/firejail/disable-programs.inc | ||
12 | # | ||
13 | # ** Note: you can use --noprofile to disable server.profile ** | ||
14 | # | ||
15 | # Parent pid 5347, child pid 5348 | ||
16 | # The new log directory is /proc/5348/root/var/log | ||
17 | # Child process initialized in 64.43 ms | ||
18 | # root@debian:~# | ||
19 | # | ||
20 | # Customize the profile as usual. Examples: unbound.profile, fdns.profile. | ||
21 | # All the rules for regular user profiles apply with the exception of | ||
22 | # /usr/local/bin symlink redirection and firecfg tool. The redirection is disabled | ||
23 | # by default for root user. | ||
24 | |||
2 | # This file is overwritten after every install/update | 25 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 26 | # Persistent local customizations |
4 | include server.local | 27 | include server.local |
@@ -28,7 +51,6 @@ caps | |||
28 | # ipc-namespace | 51 | # ipc-namespace |
29 | # netfilter /etc/firejail/webserver.net | 52 | # netfilter /etc/firejail/webserver.net |
30 | no3d | 53 | no3d |
31 | # nodbus | ||
32 | nodvd | 54 | nodvd |
33 | # nogroups | 55 | # nogroups |
34 | # nonewprivs | 56 | # nonewprivs |
@@ -49,4 +71,7 @@ private-dev | |||
49 | # private-lib | 71 | # private-lib |
50 | private-tmp | 72 | private-tmp |
51 | 73 | ||
74 | # dbus-user none | ||
75 | # dbus-system none | ||
76 | |||
52 | # memory-deny-write-execute | 77 | # memory-deny-write-execute |
diff --git a/etc/sftp.profile b/etc/profile-m-z/sftp.profile index 66dc2a57b..66dc2a57b 100644 --- a/etc/sftp.profile +++ b/etc/profile-m-z/sftp.profile | |||
diff --git a/etc/shellcheck.profile b/etc/profile-m-z/shellcheck.profile index f8744bdf8..6cd70c2ea 100644 --- a/etc/shellcheck.profile +++ b/etc/profile-m-z/shellcheck.profile | |||
@@ -8,6 +8,7 @@ include shellcheck.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | noblacklist ${DOCUMENTS} | 13 | noblacklist ${DOCUMENTS} |
13 | 14 | ||
@@ -23,12 +24,12 @@ whitelist /usr/share/shellcheck | |||
23 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
27 | apparmor | ||
26 | caps.drop all | 28 | caps.drop all |
27 | ipc-namespace | 29 | ipc-namespace |
28 | machine-id | 30 | machine-id |
29 | net none | 31 | net none |
30 | no3d | 32 | no3d |
31 | nodbus | ||
32 | nodvd | 33 | nodvd |
33 | nogroups | 34 | nogroups |
34 | nonewprivs | 35 | nonewprivs |
@@ -47,4 +48,7 @@ private-cache | |||
47 | private-dev | 48 | private-dev |
48 | private-tmp | 49 | private-tmp |
49 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
50 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/shortwave.profile b/etc/profile-m-z/shortwave.profile new file mode 100644 index 000000000..ee2314833 --- /dev/null +++ b/etc/profile-m-z/shortwave.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for shortwave | ||
2 | # Description: Listen to internet radio | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include shortwave.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/Shortwave | ||
10 | noblacklist ${HOME}/.local/share/Shortwave | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.cache/Shortwave | ||
21 | mkdir ${HOME}/.local/share/Shortwave | ||
22 | whitelist ${HOME}/.cache/Shortwave | ||
23 | whitelist ${HOME}/.local/share/Shortwave | ||
24 | whitelist /usr/share/shortwave | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | netfilter | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | notv | ||
38 | nou2f | ||
39 | novideo | ||
40 | protocol unix,inet,inet6 | ||
41 | seccomp | ||
42 | shell none | ||
43 | tracelog | ||
44 | |||
45 | disable-mnt | ||
46 | private-bin shortwave | ||
47 | private-cache | ||
48 | private-dev | ||
49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gconf,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
50 | private-tmp | ||
diff --git a/etc/shotcut.profile b/etc/profile-m-z/shotcut.profile index 072cc2c0d..bec0bfbb0 100644 --- a/etc/shotcut.profile +++ b/etc/profile-m-z/shotcut.profile | |||
@@ -19,7 +19,6 @@ include disable-programs.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | net none | 21 | net none |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -34,3 +33,6 @@ tracelog | |||
34 | #private-bin melt,nice,qmelt,shotcut | 33 | #private-bin melt,nice,qmelt,shotcut |
35 | private-cache | 34 | private-cache |
36 | private-dev | 35 | private-dev |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/signal-cli.profile b/etc/profile-m-z/signal-cli.profile index 6a2f5c434..6a2f5c434 100644 --- a/etc/signal-cli.profile +++ b/etc/profile-m-z/signal-cli.profile | |||
diff --git a/etc/signal-desktop.profile b/etc/profile-m-z/signal-desktop.profile index f810a37ec..b51a86e7d 100644 --- a/etc/signal-desktop.profile +++ b/etc/profile-m-z/signal-desktop.profile | |||
@@ -9,6 +9,11 @@ ignore noexec /tmp | |||
9 | 9 | ||
10 | noblacklist ${HOME}/.config/Signal | 10 | noblacklist ${HOME}/.config/Signal |
11 | 11 | ||
12 | # These lines are needed to allow Firefox to open links | ||
13 | noblacklist ${HOME}/.mozilla | ||
14 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
15 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
16 | |||
12 | include disable-common.inc | 17 | include disable-common.inc |
13 | include disable-devel.inc | 18 | include disable-devel.inc |
14 | include disable-exec.inc | 19 | include disable-exec.inc |
@@ -22,14 +27,20 @@ whitelist ${HOME}/.config/Signal | |||
22 | include whitelist-common.inc | 27 | include whitelist-common.inc |
23 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
24 | 29 | ||
30 | apparmor | ||
25 | caps.keep sys_admin,sys_chroot | 31 | caps.keep sys_admin,sys_chroot |
26 | netfilter | 32 | netfilter |
27 | nodvd | 33 | nodvd |
28 | nogroups | 34 | nogroups |
29 | notv | 35 | notv |
30 | nou2f | 36 | nou2f |
37 | novideo | ||
31 | shell none | 38 | shell none |
32 | 39 | ||
33 | disable-mnt | 40 | disable-mnt |
34 | private-dev | 41 | private-dev |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
35 | private-tmp | 43 | private-tmp |
44 | |||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/silentarmy.profile b/etc/profile-m-z/silentarmy.profile index cfc33d074..220035ee7 100644 --- a/etc/silentarmy.profile +++ b/etc/profile-m-z/silentarmy.profile | |||
@@ -12,6 +12,7 @@ include disable-exec.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | include disable-xdg.inc | 16 | include disable-xdg.inc |
16 | 17 | ||
17 | include whitelist-var-common.inc | 18 | include whitelist-var-common.inc |
diff --git a/etc/simple-scan.profile b/etc/profile-m-z/simple-scan.profile index 40fe8c566..17920677b 100644 --- a/etc/simple-scan.profile +++ b/etc/profile-m-z/simple-scan.profile | |||
@@ -16,6 +16,7 @@ include disable-passwdmgr.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | 17 | include disable-xdg.inc |
18 | 18 | ||
19 | whitelist /usr/share/hplip | ||
19 | whitelist /usr/share/simple-scan | 20 | whitelist /usr/share/simple-scan |
20 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
diff --git a/etc/simplescreenrecorder.profile b/etc/profile-m-z/simplescreenrecorder.profile index edcc2a0f4..edcc2a0f4 100644 --- a/etc/simplescreenrecorder.profile +++ b/etc/profile-m-z/simplescreenrecorder.profile | |||
diff --git a/etc/simutrans.profile b/etc/profile-m-z/simutrans.profile index c6f5f70b0..1b81f2ea1 100644 --- a/etc/simutrans.profile +++ b/etc/profile-m-z/simutrans.profile | |||
@@ -10,6 +10,7 @@ noblacklist ${HOME}/.simutrans | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
@@ -17,10 +18,11 @@ include disable-programs.inc | |||
17 | mkdir ${HOME}/.simutrans | 18 | mkdir ${HOME}/.simutrans |
18 | whitelist ${HOME}/.simutrans | 19 | whitelist ${HOME}/.simutrans |
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | include whitelist-var-common.inc | ||
20 | 22 | ||
23 | apparmor | ||
21 | caps.drop all | 24 | caps.drop all |
22 | net none | 25 | net none |
23 | nodbus | ||
24 | nodvd | 26 | nodvd |
25 | nogroups | 27 | nogroups |
26 | nonewprivs | 28 | nonewprivs |
@@ -35,3 +37,6 @@ shell none | |||
35 | # private-bin simutrans | 37 | # private-bin simutrans |
36 | private-dev | 38 | private-dev |
37 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/skanlite.profile b/etc/profile-m-z/skanlite.profile index 6f9bfd201..093a61398 100644 --- a/etc/skanlite.profile +++ b/etc/profile-m-z/skanlite.profile | |||
@@ -17,7 +17,6 @@ include disable-xdg.inc | |||
17 | 17 | ||
18 | caps.drop all | 18 | caps.drop all |
19 | netfilter | 19 | netfilter |
20 | # nodbus | ||
21 | nodvd | 20 | nodvd |
22 | nogroups | 21 | nogroups |
23 | nonewprivs | 22 | nonewprivs |
@@ -33,3 +32,6 @@ shell none | |||
33 | # private-bin kbuildsycoca4,kdeinit4,skanlite | 32 | # private-bin kbuildsycoca4,kdeinit4,skanlite |
34 | # private-dev | 33 | # private-dev |
35 | # private-tmp | 34 | # private-tmp |
35 | |||
36 | # dbus-user none | ||
37 | # dbus-system none | ||
diff --git a/etc/skypeforlinux.profile b/etc/profile-m-z/skypeforlinux.profile index 341c25a95..341c25a95 100644 --- a/etc/skypeforlinux.profile +++ b/etc/profile-m-z/skypeforlinux.profile | |||
diff --git a/etc/slack.profile b/etc/profile-m-z/slack.profile index 54069f657..8ab3edd63 100644 --- a/etc/slack.profile +++ b/etc/profile-m-z/slack.profile | |||
@@ -12,6 +12,7 @@ include disable-devel.inc | |||
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
14 | include disable-programs.inc | 14 | include disable-programs.inc |
15 | include disable-shell.inc | ||
15 | 16 | ||
16 | mkdir ${HOME}/.config/Slack | 17 | mkdir ${HOME}/.config/Slack |
17 | whitelist ${HOME}/.config/Slack | 18 | whitelist ${HOME}/.config/Slack |
@@ -19,16 +20,12 @@ whitelist ${DOWNLOADS} | |||
19 | include whitelist-common.inc | 20 | include whitelist-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
22 | caps.drop all | 23 | caps.keep sys_admin,sys_chroot |
23 | netfilter | 24 | netfilter |
24 | nodvd | 25 | nodvd |
25 | nogroups | 26 | nogroups |
26 | nonewprivs | ||
27 | noroot | ||
28 | notv | 27 | notv |
29 | nou2f | 28 | nou2f |
30 | protocol unix,inet,inet6,netlink | ||
31 | seccomp | ||
32 | shell none | 29 | shell none |
33 | 30 | ||
34 | disable-mnt | 31 | disable-mnt |
@@ -36,4 +33,3 @@ private-bin locale,slack | |||
36 | private-cache | 33 | private-cache |
37 | private-dev | 34 | private-dev |
38 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe | 35 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe |
39 | private-tmp | ||
diff --git a/etc/slashem.profile b/etc/profile-m-z/slashem.profile index 8c84180d7..ca0516e65 100644 --- a/etc/slashem.profile +++ b/etc/profile-m-z/slashem.profile | |||
@@ -23,7 +23,6 @@ caps.drop all | |||
23 | ipc-namespace | 23 | ipc-namespace |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | #nonewprivs | 28 | #nonewprivs |
@@ -42,4 +41,7 @@ private-dev | |||
42 | private-tmp | 41 | private-tmp |
43 | writable-var | 42 | writable-var |
44 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
45 | #memory-deny-write-execute | 47 | #memory-deny-write-execute |
diff --git a/etc/smplayer.profile b/etc/profile-m-z/smplayer.profile index 395888c8a..3fb6fc349 100644 --- a/etc/smplayer.profile +++ b/etc/profile-m-z/smplayer.profile | |||
@@ -23,6 +23,7 @@ include disable-exec.inc | |||
23 | include disable-interpreters.inc | 23 | include disable-interpreters.inc |
24 | include disable-passwdmgr.inc | 24 | include disable-passwdmgr.inc |
25 | include disable-programs.inc | 25 | include disable-programs.inc |
26 | include disable-shell.inc | ||
26 | include disable-xdg.inc | 27 | include disable-xdg.inc |
27 | 28 | ||
28 | whitelist /usr/share/smplayer | 29 | whitelist /usr/share/smplayer |
@@ -32,7 +33,6 @@ include whitelist-var-common.inc | |||
32 | apparmor | 33 | apparmor |
33 | caps.drop all | 34 | caps.drop all |
34 | netfilter | 35 | netfilter |
35 | # nodbus - problems with KDE | ||
36 | # nogroups | 36 | # nogroups |
37 | nonewprivs | 37 | nonewprivs |
38 | noroot | 38 | noroot |
@@ -45,3 +45,6 @@ private-bin env,mplayer,mpv,python*,smplayer,smtube,youtube-dl | |||
45 | private-dev | 45 | private-dev |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # problems with KDE | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
diff --git a/etc/smtube.profile b/etc/profile-m-z/smtube.profile index 98e0229ce..79bc02979 100644 --- a/etc/smtube.profile +++ b/etc/profile-m-z/smtube.profile | |||
@@ -28,6 +28,7 @@ whitelist /usr/share/smtube | |||
28 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
29 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
30 | 30 | ||
31 | apparmor | ||
31 | caps.drop all | 32 | caps.drop all |
32 | netfilter | 33 | netfilter |
33 | nodvd | 34 | nodvd |
diff --git a/etc/snox.profile b/etc/profile-m-z/snox.profile index 3b3fd1ae1..3b3fd1ae1 100644 --- a/etc/snox.profile +++ b/etc/profile-m-z/snox.profile | |||
diff --git a/etc/soffice.profile b/etc/profile-m-z/soffice.profile index 8348a57fe..8348a57fe 100644 --- a/etc/soffice.profile +++ b/etc/profile-m-z/soffice.profile | |||
diff --git a/etc/sol.profile b/etc/profile-m-z/sol.profile index ea1620b31..44fb8cfe2 100644 --- a/etc/sol.profile +++ b/etc/profile-m-z/sol.profile | |||
@@ -11,17 +11,18 @@ include disable-exec.inc | |||
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | include disable-xdg.inc | 15 | include disable-xdg.inc |
15 | 16 | ||
16 | # all necessary files in $HOME are in whitelist-common.inc | 17 | # all necessary files in $HOME are in whitelist-common.inc |
17 | include whitelist-common.inc | 18 | include whitelist-common.inc |
18 | include whitelist-var-common.inc | 19 | include whitelist-var-common.inc |
19 | 20 | ||
21 | apparmor | ||
20 | caps.drop all | 22 | caps.drop all |
21 | ipc-namespace | 23 | ipc-namespace |
22 | net none | 24 | net none |
23 | # no3d | 25 | # no3d |
24 | nodbus | ||
25 | nodvd | 26 | nodvd |
26 | nogroups | 27 | nogroups |
27 | nonewprivs | 28 | nonewprivs |
@@ -40,4 +41,7 @@ private-cache | |||
40 | private-dev | 41 | private-dev |
41 | private-tmp | 42 | private-tmp |
42 | 43 | ||
44 | dbus-user none | ||
45 | dbus-system none | ||
46 | |||
43 | # memory-deny-write-execute | 47 | # memory-deny-write-execute |
diff --git a/etc/profile-m-z/sound-juicer.profile b/etc/profile-m-z/sound-juicer.profile new file mode 100644 index 000000000..b9f3768be --- /dev/null +++ b/etc/profile-m-z/sound-juicer.profile | |||
@@ -0,0 +1,43 @@ | |||
1 | # Firejail profile for mpv | ||
2 | # Description: Graphical audio CD ripper and encoder | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include sound-juicer.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/sound-juicer | ||
10 | noblacklist ${MUSIC} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | netfilter | ||
25 | no3d | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | nosound | ||
30 | nou2f | ||
31 | notv | ||
32 | novideo | ||
33 | protocol unix,inet,inet6,netlink | ||
34 | seccomp | ||
35 | shell none | ||
36 | tracelog | ||
37 | |||
38 | private-cache | ||
39 | private-dev | ||
40 | private-tmp | ||
41 | |||
42 | # dbus-user none | ||
43 | # dbus-system none | ||
diff --git a/etc/soundconverter.profile b/etc/profile-m-z/soundconverter.profile index bdd6eb7f5..bdd6eb7f5 100644 --- a/etc/soundconverter.profile +++ b/etc/profile-m-z/soundconverter.profile | |||
diff --git a/etc/spectre-meltdown-checker.profile b/etc/profile-m-z/spectre-meltdown-checker.profile index e27df4cc8..a0b99abcf 100644 --- a/etc/spectre-meltdown-checker.profile +++ b/etc/profile-m-z/spectre-meltdown-checker.profile | |||
@@ -31,7 +31,6 @@ caps.keep sys_rawio | |||
31 | ipc-namespace | 31 | ipc-namespace |
32 | net none | 32 | net none |
33 | no3d | 33 | no3d |
34 | nodbus | ||
35 | nodvd | 34 | nodvd |
36 | nogroups | 35 | nogroups |
37 | nonewprivs | 36 | nonewprivs |
@@ -49,4 +48,7 @@ private-bin awk,bzip2,cat,coreos-install,cpucontrol,cut,dd,dirname,dmesg,dnf,ech | |||
49 | private-cache | 48 | private-cache |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
51 | dbus-user none | ||
52 | dbus-system none | ||
53 | |||
52 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/spotify.profile b/etc/profile-m-z/spotify.profile index 59692f1d6..1a34cb86d 100644 --- a/etc/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -29,7 +29,6 @@ include whitelist-var-common.inc | |||
29 | 29 | ||
30 | caps.drop all | 30 | caps.drop all |
31 | netfilter | 31 | netfilter |
32 | #nodbus - dbus needed for MPRIS | ||
33 | nodvd | 32 | nodvd |
34 | nogroups | 33 | nogroups |
35 | nonewprivs | 34 | nonewprivs |
@@ -50,3 +49,6 @@ private-opt spotify | |||
50 | private-srv none | 49 | private-srv none |
51 | private-tmp | 50 | private-tmp |
52 | 51 | ||
52 | # dbus needed for MPRIS | ||
53 | # dbus-user none | ||
54 | # dbus-system none | ||
diff --git a/etc/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile index 94bb4d3f2..cdb20b4e0 100644 --- a/etc/sqlitebrowser.profile +++ b/etc/profile-m-z/sqlitebrowser.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | include whitelist-usr-share-common.inc | 21 | include whitelist-usr-share-common.inc |
@@ -24,7 +25,6 @@ apparmor | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | # nodbus - breaks proxy creation | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -43,4 +43,8 @@ private-dev | |||
43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl | 43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | # breaks proxy creation | ||
47 | # dbus-user none | ||
48 | # dbus-system none | ||
49 | |||
46 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 50 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/ssh-agent.profile b/etc/profile-m-z/ssh-agent.profile index cf509852a..01b63d3ce 100644 --- a/etc/ssh-agent.profile +++ b/etc/profile-m-z/ssh-agent.profile | |||
@@ -22,7 +22,6 @@ include whitelist-usr-share-common.inc | |||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | no3d | 24 | no3d |
25 | nodbus | ||
26 | nodvd | 25 | nodvd |
27 | nonewprivs | 26 | nonewprivs |
28 | noroot | 27 | noroot |
@@ -34,3 +33,6 @@ shell none | |||
34 | tracelog | 33 | tracelog |
35 | 34 | ||
36 | writable-run-user | 35 | writable-run-user |
36 | |||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/ssh.profile b/etc/profile-m-z/ssh.profile index 1551c3fb6..5d3458c29 100644 --- a/etc/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -12,19 +12,22 @@ noblacklist /tmp/ssh-* | |||
12 | noblacklist ${HOME}/.ssh | 12 | noblacklist ${HOME}/.ssh |
13 | # nc can be used as ProxyCommand, e.g. when using tor | 13 | # nc can be used as ProxyCommand, e.g. when using tor |
14 | noblacklist ${PATH}/nc | 14 | noblacklist ${PATH}/nc |
15 | noblacklist ${PATH}/ncat | ||
15 | 16 | ||
16 | include disable-common.inc | 17 | include disable-common.inc |
17 | include disable-exec.inc | 18 | include disable-exec.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
20 | 21 | ||
22 | whitelist ${RUNUSER}/keyring/ssh | ||
23 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh | ||
21 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
25 | include whitelist-runuser-common.inc | ||
22 | 26 | ||
23 | caps.drop all | 27 | caps.drop all |
24 | ipc-namespace | 28 | ipc-namespace |
25 | netfilter | 29 | netfilter |
26 | no3d | 30 | no3d |
27 | nodbus | ||
28 | nodvd | 31 | nodvd |
29 | nogroups | 32 | nogroups |
30 | nonewprivs | 33 | nonewprivs |
@@ -43,4 +46,7 @@ private-dev | |||
43 | # private-tmp # Breaks when exiting | 46 | # private-tmp # Breaks when exiting |
44 | writable-run-user | 47 | writable-run-user |
45 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
46 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/standardnotes-desktop.profile b/etc/profile-m-z/standardnotes-desktop.profile index a402aca5a..1292b806b 100644 --- a/etc/standardnotes-desktop.profile +++ b/etc/profile-m-z/standardnotes-desktop.profile | |||
@@ -25,7 +25,6 @@ apparmor | |||
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | netfilter | 27 | netfilter |
28 | nodbus | ||
29 | nodvd | 28 | nodvd |
30 | nogroups | 29 | nogroups |
31 | nonewprivs | 30 | nonewprivs |
@@ -41,3 +40,5 @@ private-dev | |||
41 | private-tmp | 40 | private-tmp |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg | 41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg |
43 | 42 | ||
43 | dbus-user none | ||
44 | dbus-system none | ||
diff --git a/etc/start-tor-browser.desktop.profile b/etc/profile-m-z/start-tor-browser.desktop.profile index 2f73c9fee..2f73c9fee 100644 --- a/etc/start-tor-browser.desktop.profile +++ b/etc/profile-m-z/start-tor-browser.desktop.profile | |||
diff --git a/etc/start-tor-browser.profile b/etc/profile-m-z/start-tor-browser.profile index f9daf8f09..b62b19101 100644 --- a/etc/start-tor-browser.profile +++ b/etc/profile-m-z/start-tor-browser.profile | |||
@@ -19,7 +19,6 @@ include whitelist-var-common.inc | |||
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | netfilter | 21 | netfilter |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -38,3 +37,6 @@ private-bin bash,cat,cp,cut,dirname,env,getconf,gpg,grep,gxmessage,id,kdialog,ln | |||
38 | private-dev | 37 | private-dev |
39 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl | 38 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
40 | private-tmp | 39 | private-tmp |
40 | |||
41 | dbus-user none | ||
42 | dbus-system none | ||
diff --git a/etc/steam-native.profile b/etc/profile-m-z/steam-native.profile index 47608ad28..47608ad28 100644 --- a/etc/steam-native.profile +++ b/etc/profile-m-z/steam-native.profile | |||
diff --git a/etc/profile-m-z/steam-runtime.profile b/etc/profile-m-z/steam-runtime.profile new file mode 100644 index 000000000..47608ad28 --- /dev/null +++ b/etc/profile-m-z/steam-runtime.profile | |||
@@ -0,0 +1,5 @@ | |||
1 | # Firejail profile alias for steam | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | # Redirect | ||
5 | include steam.profile | ||
diff --git a/etc/steam.profile b/etc/profile-m-z/steam.profile index bc90af837..7292f189c 100644 --- a/etc/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -10,12 +10,17 @@ noblacklist ${HOME}/.killingfloor | |||
10 | noblacklist ${HOME}/.local/share/3909/PapersPlease | 10 | noblacklist ${HOME}/.local/share/3909/PapersPlease |
11 | noblacklist ${HOME}/.local/share/aspyr-media | 11 | noblacklist ${HOME}/.local/share/aspyr-media |
12 | noblacklist ${HOME}/.local/share/cdprojektred | 12 | noblacklist ${HOME}/.local/share/cdprojektred |
13 | noblacklist ${HOME}/.local/share/FasterThanLight | ||
13 | noblacklist ${HOME}/.local/share/feral-interactive | 14 | noblacklist ${HOME}/.local/share/feral-interactive |
15 | noblacklist ${HOME}/.local/share/IntoTheBreach | ||
16 | noblacklist ${HOME}/.local/share/Paradox Interactive | ||
14 | noblacklist ${HOME}/.local/share/Steam | 17 | noblacklist ${HOME}/.local/share/Steam |
15 | noblacklist ${HOME}/.local/share/SuperHexagon | 18 | noblacklist ${HOME}/.local/share/SuperHexagon |
16 | noblacklist ${HOME}/.local/share/Terraria | 19 | noblacklist ${HOME}/.local/share/Terraria |
17 | noblacklist ${HOME}/.local/share/vpltd | 20 | noblacklist ${HOME}/.local/share/vpltd |
18 | noblacklist ${HOME}/.local/share/vulkan | 21 | noblacklist ${HOME}/.local/share/vulkan |
22 | noblacklist ${HOME}/.mbwarband | ||
23 | noblacklist ${HOME}/.paradoxinteractive | ||
19 | noblacklist ${HOME}/.steam | 24 | noblacklist ${HOME}/.steam |
20 | noblacklist ${HOME}/.steampath | 25 | noblacklist ${HOME}/.steampath |
21 | noblacklist ${HOME}/.steampid | 26 | noblacklist ${HOME}/.steampid |
@@ -27,8 +32,8 @@ noblacklist /usr/sbin | |||
27 | include allow-java.inc | 32 | include allow-java.inc |
28 | 33 | ||
29 | # Allow python (blacklisted by disable-interpreters.inc) | 34 | # Allow python (blacklisted by disable-interpreters.inc) |
30 | include allow-python2.inc | 35 | include allow-python2.inc |
31 | include allow-python3.inc | 36 | include allow-python3.inc |
32 | 37 | ||
33 | include disable-common.inc | 38 | include disable-common.inc |
34 | include disable-devel.inc | 39 | include disable-devel.inc |
@@ -36,16 +41,52 @@ include disable-interpreters.inc | |||
36 | include disable-passwdmgr.inc | 41 | include disable-passwdmgr.inc |
37 | include disable-programs.inc | 42 | include disable-programs.inc |
38 | 43 | ||
44 | mkdir ${HOME}/.config/unity3d | ||
45 | mkdir ${HOME}/.killingfloor | ||
46 | mkdir ${HOME}/.local/share/3909/PapersPlease | ||
47 | mkdir ${HOME}/.local/share/aspyr-media | ||
48 | mkdir ${HOME}/.local/share/cdprojektred | ||
49 | mkdir ${HOME}/.local/share/FasterThanLight | ||
50 | mkdir ${HOME}/.local/share/feral-interactive | ||
51 | mkdir ${HOME}/.local/share/IntoTheBreach | ||
52 | mkdir ${HOME}/.local/share/Paradox Interactive | ||
53 | mkdir ${HOME}/.local/share/Steam | ||
54 | mkdir ${HOME}/.local/share/SuperHexagon | ||
55 | mkdir ${HOME}/.local/share/Terraria | ||
56 | mkdir ${HOME}/.local/share/vpltd | ||
57 | mkdir ${HOME}/.local/share/vulkan | ||
58 | mkdir ${HOME}/.mbwarband | ||
59 | mkdir ${HOME}/.paradoxinteractive | ||
60 | mkdir ${HOME}/.steam | ||
61 | mkfile ${HOME}/.steampath | ||
62 | mkfile ${HOME}/.steampid | ||
63 | whitelist ${HOME}/.config/unity3d | ||
64 | whitelist ${HOME}/.killingfloor | ||
65 | whitelist ${HOME}/.local/share/3909/PapersPlease | ||
66 | whitelist ${HOME}/.local/share/aspyr-media | ||
67 | whitelist ${HOME}/.local/share/cdprojektred | ||
68 | whitelist ${HOME}/.local/share/FasterThanLight | ||
69 | whitelist ${HOME}/.local/share/feral-interactive | ||
70 | whitelist ${HOME}/.local/share/IntoTheBreach | ||
71 | whitelist ${HOME}/.local/share/Paradox Interactive | ||
72 | whitelist ${HOME}/.local/share/Steam | ||
73 | whitelist ${HOME}/.local/share/SuperHexagon | ||
74 | whitelist ${HOME}/.local/share/Terraria | ||
75 | whitelist ${HOME}/.local/share/vpltd | ||
76 | whitelist ${HOME}/.local/share/vulkan | ||
77 | whitelist ${HOME}/.mbwarband | ||
78 | whitelist ${HOME}/.paradoxinteractive | ||
79 | whitelist ${HOME}/.steam | ||
80 | whitelist ${HOME}/.steampath | ||
81 | whitelist ${HOME}/.steampid | ||
82 | include whitelist-common.inc | ||
39 | include whitelist-var-common.inc | 83 | include whitelist-var-common.inc |
40 | 84 | ||
41 | # allow-debuggers needed for running some games with proton | ||
42 | allow-debuggers | ||
43 | caps.drop all | 85 | caps.drop all |
44 | #ipc-namespace | 86 | #ipc-namespace |
45 | netfilter | 87 | netfilter |
46 | # nodbus disabled as it breaks appindicator support | ||
47 | #nodbus | ||
48 | nodvd | 88 | nodvd |
89 | # nVidia users may need to comment / ignore nogroups and noroot | ||
49 | nogroups | 90 | nogroups |
50 | nonewprivs | 91 | nonewprivs |
51 | noroot | 92 | noroot |
@@ -54,11 +95,11 @@ nou2f | |||
54 | # novideo should be commented for VR | 95 | # novideo should be commented for VR |
55 | novideo | 96 | novideo |
56 | protocol unix,inet,inet6,netlink | 97 | protocol unix,inet,inet6,netlink |
57 | # seccomp cause sometimes issues (see #2860, #2951), | 98 | # seccomp sometimes causes issues (see #2951, #3267), |
58 | # comment it or add 'ignore seccomp' to steam.local if so. | 99 | # comment it or add 'ignore seccomp' to steam.local if so. |
59 | seccomp | 100 | seccomp !ptrace |
60 | shell none | 101 | shell none |
61 | # tracelog disabled as it breaks integrated browser | 102 | # tracelog breaks integrated browser |
62 | #tracelog | 103 | #tracelog |
63 | 104 | ||
64 | # private-bin is disabled while in testing, but has been tested working with multiple games | 105 | # private-bin is disabled while in testing, but has been tested working with multiple games |
@@ -71,5 +112,9 @@ shell none | |||
71 | # private-dev should be commented for controllers | 112 | # private-dev should be commented for controllers |
72 | private-dev | 113 | private-dev |
73 | # private-etc breaks a small selection of games on some systems, comment to support those | 114 | # private-etc breaks a small selection of games on some systems, comment to support those |
74 | private-etc alternatives,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl | 115 | private-etc alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl |
75 | private-tmp | 116 | private-tmp |
117 | |||
118 | # breaks appindicator support | ||
119 | # dbus-user none | ||
120 | # dbus-system none | ||
diff --git a/etc/stellarium.profile b/etc/profile-m-z/stellarium.profile index d6df2e0ad..3f93fe591 100644 --- a/etc/stellarium.profile +++ b/etc/profile-m-z/stellarium.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | mkdir ${HOME}/.config/stellarium | 20 | mkdir ${HOME}/.config/stellarium |
20 | mkdir ${HOME}/.stellarium | 21 | mkdir ${HOME}/.stellarium |
diff --git a/etc/profile-m-z/strawberry.profile b/etc/profile-m-z/strawberry.profile new file mode 100644 index 000000000..cd36c0d41 --- /dev/null +++ b/etc/profile-m-z/strawberry.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for strawberry | ||
2 | # Description: A music player and music collection organizer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include strawberry.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/strawberry | ||
10 | noblacklist ${HOME}/.config/strawberry | ||
11 | noblacklist ${HOME}/.local/share/strawberry | ||
12 | noblacklist ${MUSIC} | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | ||
24 | include whitelist-var-common.inc | ||
25 | |||
26 | apparmor | ||
27 | caps.drop all | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,inet,inet6,netlink | ||
37 | # blacklisting of ioprio_set system calls breaks strawberry | ||
38 | seccomp !ioprio_set | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin strawberry,strawberry-tagreader | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,nsswitch.conf,pki,resolv.conf,ssl | ||
47 | private-tmp | ||
48 | |||
49 | dbus-system none | ||
diff --git a/etc/strings.profile b/etc/profile-m-z/strings.profile index 7dc453b1f..426b2dc1c 100644 --- a/etc/strings.profile +++ b/etc/profile-m-z/strings.profile | |||
@@ -8,6 +8,7 @@ include strings.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist ${RUNUSER}/wayland-* | 10 | blacklist ${RUNUSER}/wayland-* |
11 | blacklist ${RUNUSER} | ||
11 | 12 | ||
12 | #include disable-common.inc | 13 | #include disable-common.inc |
13 | include disable-devel.inc | 14 | include disable-devel.inc |
@@ -15,6 +16,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | #include disable-programs.inc | 18 | #include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | #include disable-xdg.inc | 20 | #include disable-xdg.inc |
19 | 21 | ||
20 | #include whitelist-usr-share-common.inc | 22 | #include whitelist-usr-share-common.inc |
@@ -26,7 +28,6 @@ ipc-namespace | |||
26 | machine-id | 28 | machine-id |
27 | net none | 29 | net none |
28 | no3d | 30 | no3d |
29 | nodbus | ||
30 | nodvd | 31 | nodvd |
31 | nogroups | 32 | nogroups |
32 | nonewprivs | 33 | nonewprivs |
@@ -49,5 +50,8 @@ private-dev | |||
49 | #private-lib libfakeroot | 50 | #private-lib libfakeroot |
50 | private-tmp | 51 | private-tmp |
51 | 52 | ||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
52 | memory-deny-write-execute | 56 | memory-deny-write-execute |
53 | read-only ${HOME} | 57 | read-only ${HOME} |
diff --git a/etc/studio.sh.profile b/etc/profile-m-z/studio.sh.profile index 79e879f36..79e879f36 100644 --- a/etc/studio.sh.profile +++ b/etc/profile-m-z/studio.sh.profile | |||
diff --git a/etc/subdownloader.profile b/etc/profile-m-z/subdownloader.profile index f6165f139..428af3737 100644 --- a/etc/subdownloader.profile +++ b/etc/profile-m-z/subdownloader.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nogroups | 34 | nogroups |
36 | nonewprivs | 35 | nonewprivs |
@@ -48,4 +47,7 @@ private-dev | |||
48 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/supertux2.profile b/etc/profile-m-z/supertux2.profile index 4c64ee766..ceaae8fbf 100644 --- a/etc/supertux2.profile +++ b/etc/profile-m-z/supertux2.profile | |||
@@ -10,18 +10,23 @@ noblacklist ${HOME}/.local/share/supertux2 | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
16 | 18 | ||
17 | mkdir ${HOME}/.local/share/supertux2 | 19 | mkdir ${HOME}/.local/share/supertux2 |
18 | whitelist ${HOME}/.local/share/supertux2 | 20 | whitelist ${HOME}/.local/share/supertux2 |
21 | whitelist /usr/share/supertux2 | ||
19 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
21 | 26 | ||
27 | apparmor | ||
22 | caps.drop all | 28 | caps.drop all |
23 | net none | 29 | net none |
24 | nodbus | ||
25 | nodvd | 30 | nodvd |
26 | nogroups | 31 | nogroups |
27 | nonewprivs | 32 | nonewprivs |
@@ -32,8 +37,12 @@ novideo | |||
32 | protocol unix,netlink | 37 | protocol unix,netlink |
33 | seccomp | 38 | seccomp |
34 | shell none | 39 | shell none |
40 | tracelog | ||
35 | 41 | ||
36 | disable-mnt | 42 | disable-mnt |
37 | # private-bin supertux2 | 43 | # private-bin supertux2 |
38 | private-dev | 44 | private-dev |
39 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile index 2975a61ed..ce69c8b4b 100644 --- a/etc/supertuxkart.profile +++ b/etc/profile-m-z/supertuxkart.profile | |||
@@ -13,10 +13,11 @@ noblacklist ${HOME}/.local/share/supertuxkart | |||
13 | include disable-common.inc | 13 | include disable-common.inc |
14 | include disable-devel.inc | 14 | include disable-devel.inc |
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 20 | include disable-xdg.inc |
19 | include disable-interpreters.inc | ||
20 | 21 | ||
21 | mkdir ${HOME}/.config/supertuxkart | 22 | mkdir ${HOME}/.config/supertuxkart |
22 | mkdir ${HOME}/.cache/supertuxkart | 23 | mkdir ${HOME}/.cache/supertuxkart |
@@ -32,7 +33,6 @@ include whitelist-var-common.inc | |||
32 | apparmor | 33 | apparmor |
33 | caps.drop all | 34 | caps.drop all |
34 | netfilter | 35 | netfilter |
35 | nodbus | ||
36 | nodvd | 36 | nodvd |
37 | nogroups | 37 | nogroups |
38 | nonewprivs | 38 | nonewprivs |
@@ -54,3 +54,5 @@ private-tmp | |||
54 | private-opt none | 54 | private-opt none |
55 | private-srv none | 55 | private-srv none |
56 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/surf.profile b/etc/profile-m-z/surf.profile index d4c6d9afc..5ad82601d 100644 --- a/etc/surf.profile +++ b/etc/profile-m-z/surf.profile | |||
@@ -34,6 +34,6 @@ tracelog | |||
34 | disable-mnt | 34 | disable-mnt |
35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop | 35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop |
36 | private-dev | 36 | private-dev |
37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,passwd,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
diff --git a/etc/profile-m-z/sushi.profile b/etc/profile-m-z/sushi.profile new file mode 100644 index 000000000..68abd8c94 --- /dev/null +++ b/etc/profile-m-z/sushi.profile | |||
@@ -0,0 +1,48 @@ | |||
1 | # Firejail profile for sushi | ||
2 | # Description: A quick previewer for Nautilus | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include sushi.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Allow gjs (blacklisted by disable-interpreters.inc) | ||
10 | include allow-gjs.inc | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | # include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | |||
20 | include whitelist-runuser-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | net none | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix | ||
33 | seccomp | ||
34 | shell none | ||
35 | tracelog | ||
36 | |||
37 | private-bin gjs,sushi | ||
38 | private-dev | ||
39 | private-tmp | ||
40 | |||
41 | dbus-system none | ||
42 | |||
43 | read-only / | ||
44 | read-only /mnt | ||
45 | read-only /media | ||
46 | read-only /run/mount | ||
47 | read-only /run/media | ||
48 | read-only ${HOME} | ||
diff --git a/etc/profile-m-z/swell-foop.profile b/etc/profile-m-z/swell-foop.profile new file mode 100644 index 000000000..9efae815d --- /dev/null +++ b/etc/profile-m-z/swell-foop.profile | |||
@@ -0,0 +1,21 @@ | |||
1 | # Firejail profile for swell-foop | ||
2 | # Description: GNOME colored tiles puzzle game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include swell-foop.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/swell-foop | ||
10 | |||
11 | mkdir ${HOME}/.local/share/swell-foop | ||
12 | whitelist ${HOME}/.local/share/swell-foop | ||
13 | |||
14 | whitelist /usr/share/swell-foop | ||
15 | |||
16 | private-bin swell-foop | ||
17 | |||
18 | dbus-user.own org.gnome.SwellFoop | ||
19 | |||
20 | # Redirect | ||
21 | include gnome_games-common.profile | ||
diff --git a/etc/sylpheed.profile b/etc/profile-m-z/sylpheed.profile index 4344fe73a..4344fe73a 100644 --- a/etc/sylpheed.profile +++ b/etc/profile-m-z/sylpheed.profile | |||
diff --git a/etc/synfigstudio.profile b/etc/profile-m-z/synfigstudio.profile index 30b0ad762..a83080cc3 100644 --- a/etc/synfigstudio.profile +++ b/etc/profile-m-z/synfigstudio.profile | |||
@@ -18,7 +18,6 @@ include disable-programs.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | net none | 20 | net none |
21 | nodbus | ||
22 | nodvd | 21 | nodvd |
23 | nogroups | 22 | nogroups |
24 | nonewprivs | 23 | nonewprivs |
@@ -36,3 +35,5 @@ private-cache | |||
36 | private-dev | 35 | private-dev |
37 | private-tmp | 36 | private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/sysprof-cli.profile b/etc/profile-m-z/sysprof-cli.profile index 935c7e9ca..8f4de130b 100644 --- a/etc/sysprof-cli.profile +++ b/etc/profile-m-z/sysprof-cli.profile | |||
@@ -7,12 +7,13 @@ include sysprof-cli.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | nodbus | ||
11 | |||
12 | # There is no GUI help menu to break in the CLI version | 10 | # There is no GUI help menu to break in the CLI version |
13 | private-bin sysprof-cli | 11 | private-bin sysprof-cli |
14 | private-lib | 12 | private-lib |
15 | 13 | ||
14 | dbus-user none | ||
15 | dbus-system none | ||
16 | |||
16 | memory-deny-write-execute | 17 | memory-deny-write-execute |
17 | 18 | ||
18 | # Redirect | 19 | # Redirect |
diff --git a/etc/sysprof.profile b/etc/profile-m-z/sysprof.profile index 9761629d2..ad3346285 100644 --- a/etc/sysprof.profile +++ b/etc/profile-m-z/sysprof.profile | |||
@@ -23,7 +23,6 @@ ipc-namespace | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | # nodbus - makes settings immutable | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
@@ -46,4 +45,8 @@ private-etc alternatives,fonts,ld.so.cache,machine-id,ssl | |||
46 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so | 45 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so |
47 | private-tmp | 46 | private-tmp |
48 | 47 | ||
48 | # makes settings immutable | ||
49 | # dbus-user none | ||
50 | # dbus-system none | ||
51 | |||
49 | # memory-deny-write-execute - Breaks GUI on Arch | 52 | # memory-deny-write-execute - Breaks GUI on Arch |
diff --git a/etc/tar.profile b/etc/profile-m-z/tar.profile index 0858dcb26..3a7405305 100644 --- a/etc/tar.profile +++ b/etc/profile-m-z/tar.profile | |||
@@ -26,7 +26,6 @@ ipc-namespace | |||
26 | machine-id | 26 | machine-id |
27 | net none | 27 | net none |
28 | no3d | 28 | no3d |
29 | nodbus | ||
30 | nodvd | 29 | nodvd |
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
@@ -50,4 +49,7 @@ private-lib libfakeroot | |||
50 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) | 49 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) |
51 | writable-var | 50 | writable-var |
52 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
53 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/tb-starter-wrapper.profile b/etc/profile-m-z/tb-starter-wrapper.profile index ffe9605b6..ffe9605b6 100644 --- a/etc/tb-starter-wrapper.profile +++ b/etc/profile-m-z/tb-starter-wrapper.profile | |||
diff --git a/etc/tcpdump.profile b/etc/profile-m-z/tcpdump.profile index 3c46dfdcb..881fbf49e 100644 --- a/etc/tcpdump.profile +++ b/etc/profile-m-z/tcpdump.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-common.inc | 20 | include whitelist-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.keep net_raw | 23 | caps.keep net_raw |
23 | ipc-namespace | 24 | ipc-namespace |
24 | #net tun0 | 25 | #net tun0 |
diff --git a/etc/teams-for-linux.profile b/etc/profile-m-z/teams-for-linux.profile index 882d8d0f3..a13c92bc3 100644 --- a/etc/teams-for-linux.profile +++ b/etc/profile-m-z/teams-for-linux.profile | |||
@@ -7,7 +7,8 @@ include teams-for-linux.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | ignore nodbus | 10 | ignore dbus-user none |
11 | ignore dbus-system none | ||
11 | 12 | ||
12 | noblacklist ${HOME}/.config/teams-for-linux | 13 | noblacklist ${HOME}/.config/teams-for-linux |
13 | 14 | ||
diff --git a/etc/teams.profile b/etc/profile-m-z/teams.profile index 8b60a941e..bd7faa80a 100644 --- a/etc/teams.profile +++ b/etc/profile-m-z/teams.profile | |||
@@ -1,14 +1,17 @@ | |||
1 | # Firejail profile for teams | 1 | # Firejail profile for teams |
2 | # Description: Official Microsoft Teams client for Linux using Electron. | 2 | # Description: Official Microsoft Teams client for Linux using Electron. |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Known issues: | ||
5 | # * if Teams crashes on startup try using "ignore apparmor" in your local config | ||
6 | # Persistent local customizations | 4 | # Persistent local customizations |
7 | include teams.local | 5 | include teams.local |
8 | # Persistent global definitions | 6 | # Persistent global definitions |
9 | # added by included profile | 7 | # added by included profile |
10 | #include globals.local | 8 | #include globals.local |
11 | 9 | ||
10 | # see #3404 | ||
11 | ignore apparmor | ||
12 | ignore dbus-user none | ||
13 | ignore dbus-system none | ||
14 | |||
12 | noblacklist ${HOME}/.config/teams | 15 | noblacklist ${HOME}/.config/teams |
13 | noblacklist ${HOME}/.config/Microsoft | 16 | noblacklist ${HOME}/.config/Microsoft |
14 | 17 | ||
@@ -30,7 +33,6 @@ tracelog | |||
30 | disable-mnt | 33 | disable-mnt |
31 | private-cache | 34 | private-cache |
32 | private-dev | 35 | private-dev |
33 | private-tmp | ||
34 | 36 | ||
35 | # Redirect | 37 | # Redirect |
36 | include electron.profile | 38 | include electron.profile |
diff --git a/etc/teamspeak3.profile b/etc/profile-m-z/teamspeak3.profile index c1c666f58..c1c666f58 100644 --- a/etc/teamspeak3.profile +++ b/etc/profile-m-z/teamspeak3.profile | |||
diff --git a/etc/teeworlds.profile b/etc/profile-m-z/teeworlds.profile index 782f337d3..c0d62bec2 100644 --- a/etc/teeworlds.profile +++ b/etc/profile-m-z/teeworlds.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.teeworlds | 20 | mkdir ${HOME}/.teeworlds |
@@ -24,7 +25,6 @@ include whitelist-var-common.inc | |||
24 | caps.drop all | 25 | caps.drop all |
25 | ipc-namespace | 26 | ipc-namespace |
26 | netfilter | 27 | netfilter |
27 | nodbus | ||
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | nonewprivs | 30 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin teeworlds | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/telegram-desktop.profile b/etc/profile-m-z/telegram-desktop.profile index 0cfa7114b..0cfa7114b 100644 --- a/etc/telegram-desktop.profile +++ b/etc/profile-m-z/telegram-desktop.profile | |||
diff --git a/etc/telegram.profile b/etc/profile-m-z/telegram.profile index e3af5600a..8e0741458 100644 --- a/etc/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -25,5 +25,5 @@ seccomp | |||
25 | 25 | ||
26 | disable-mnt | 26 | disable-mnt |
27 | private-cache | 27 | private-cache |
28 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | ||
28 | private-tmp | 29 | private-tmp |
29 | |||
diff --git a/etc/terasology.profile b/etc/profile-m-z/terasology.profile index 9a8426435..36ce6d469 100644 --- a/etc/terasology.profile +++ b/etc/profile-m-z/terasology.profile | |||
@@ -28,8 +28,6 @@ include whitelist-common.inc | |||
28 | caps.drop all | 28 | caps.drop all |
29 | ipc-namespace | 29 | ipc-namespace |
30 | net none | 30 | net none |
31 | netfilter | ||
32 | nodbus | ||
33 | nodvd | 31 | nodvd |
34 | nogroups | 32 | nogroups |
35 | nonewprivs | 33 | nonewprivs |
@@ -45,3 +43,6 @@ disable-mnt | |||
45 | private-dev | 43 | private-dev |
46 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-7-openjdk,java-8-openjdk,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pki,pulse,resolv.conf,ssl | 44 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,java-7-openjdk,java-8-openjdk,ld.so.cache,ld.so.preload,localtime,lsb-release,machine-id,mime.types,passwd,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/tex.profile b/etc/profile-m-z/tex.profile index f56c3038e..f56c3038e 100644 --- a/etc/tex.profile +++ b/etc/profile-m-z/tex.profile | |||
diff --git a/etc/textmaker18.profile b/etc/profile-m-z/textmaker18.profile index 8284df791..d28947394 100644 --- a/etc/textmaker18.profile +++ b/etc/profile-m-z/textmaker18.profile | |||
@@ -7,4 +7,5 @@ include textmaker18.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/textmaker18free.profile b/etc/profile-m-z/textmaker18free.profile index ad945ca55..7b4fd5b08 100644 --- a/etc/textmaker18free.profile +++ b/etc/profile-m-z/textmaker18free.profile | |||
@@ -7,4 +7,5 @@ include textmaker18free.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include softmaker-common.profile | 10 | include softmaker-common.inc |
11 | |||
diff --git a/etc/thunar.profile b/etc/profile-m-z/thunar.profile index 19993016a..19993016a 100644 --- a/etc/thunar.profile +++ b/etc/profile-m-z/thunar.profile | |||
diff --git a/etc/thunderbird-beta.profile b/etc/profile-m-z/thunderbird-beta.profile index 6450e40d6..6450e40d6 100644 --- a/etc/thunderbird-beta.profile +++ b/etc/profile-m-z/thunderbird-beta.profile | |||
diff --git a/etc/thunderbird-wayland.profile b/etc/profile-m-z/thunderbird-wayland.profile index 9fbb80d29..9fbb80d29 100644 --- a/etc/thunderbird-wayland.profile +++ b/etc/profile-m-z/thunderbird-wayland.profile | |||
diff --git a/etc/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index 6e888c163..6e4bb50d4 100644 --- a/etc/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile | |||
@@ -7,22 +7,22 @@ include thunderbird.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # writable-run-user and dbus are needed by enigmail | 9 | # writable-run-user and dbus are needed by enigmail |
10 | ignore nodbus | 10 | ignore dbus-user none |
11 | ignore dbus-system none | ||
11 | writable-run-user | 12 | writable-run-user |
12 | 13 | ||
13 | # If you want to read local mail stored in /var/mail, add the following to thunderbird.local: | 14 | # If you want to read local mail stored in /var/mail edit /etc/apparmor.d/firejail-default accordingly |
15 | # and add the following to thunderbird.local: | ||
14 | #noblacklist /var/mail | 16 | #noblacklist /var/mail |
15 | #noblacklist /var/spool/mail | 17 | #noblacklist /var/spool/mail |
16 | #whitelist /var/mail | 18 | #whitelist /var/mail |
17 | #whitelist /var/spool/mail | 19 | #whitelist /var/spool/mail |
18 | #writable-var | 20 | #writable-var |
19 | 21 | ||
20 | # Uncomment the next 4 lines or put them in your thunderbird.local to | 22 | # These lines are needed to allow Firefox to load your profile when clicking a link in an email |
21 | # allow Firefox to load your profile when clicking a link in an email | 23 | noblacklist ${HOME}/.mozilla |
22 | #noblacklist ${HOME}/.cache/mozilla | 24 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
23 | #noblacklist ${HOME}/.mozilla | 25 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
24 | #whitelist ${HOME}/.cache/mozilla/firefox | ||
25 | #whitelist ${HOME}/.mozilla | ||
26 | 26 | ||
27 | noblacklist ${HOME}/.cache/thunderbird | 27 | noblacklist ${HOME}/.cache/thunderbird |
28 | noblacklist ${HOME}/.gnupg | 28 | noblacklist ${HOME}/.gnupg |
@@ -47,6 +47,7 @@ whitelist ${HOME}/.thunderbird | |||
47 | 47 | ||
48 | whitelist /usr/share/gnupg | 48 | whitelist /usr/share/gnupg |
49 | whitelist /usr/share/mozilla | 49 | whitelist /usr/share/mozilla |
50 | whitelist /usr/share/thunderbird | ||
50 | whitelist /usr/share/webext | 51 | whitelist /usr/share/webext |
51 | include whitelist-usr-share-common.inc | 52 | include whitelist-usr-share-common.inc |
52 | 53 | ||
diff --git a/etc/tilp.profile b/etc/profile-m-z/tilp.profile index 4d38d5184..dd4a372c4 100644 --- a/etc/tilp.profile +++ b/etc/profile-m-z/tilp.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | 17 | ||
17 | caps.drop all | 18 | caps.drop all |
18 | net none | 19 | net none |
diff --git a/etc/tor-browser-ar.profile b/etc/profile-m-z/tor-browser-ar.profile index 612b2d01b..612b2d01b 100644 --- a/etc/tor-browser-ar.profile +++ b/etc/profile-m-z/tor-browser-ar.profile | |||
diff --git a/etc/tor-browser-ca.profile b/etc/profile-m-z/tor-browser-ca.profile index db70a7109..db70a7109 100644 --- a/etc/tor-browser-ca.profile +++ b/etc/profile-m-z/tor-browser-ca.profile | |||
diff --git a/etc/tor-browser-cs.profile b/etc/profile-m-z/tor-browser-cs.profile index 77b271b68..77b271b68 100644 --- a/etc/tor-browser-cs.profile +++ b/etc/profile-m-z/tor-browser-cs.profile | |||
diff --git a/etc/tor-browser-da.profile b/etc/profile-m-z/tor-browser-da.profile index 3b9fff9a4..3b9fff9a4 100644 --- a/etc/tor-browser-da.profile +++ b/etc/profile-m-z/tor-browser-da.profile | |||
diff --git a/etc/tor-browser-de.profile b/etc/profile-m-z/tor-browser-de.profile index 3b4f7f94f..3b4f7f94f 100644 --- a/etc/tor-browser-de.profile +++ b/etc/profile-m-z/tor-browser-de.profile | |||
diff --git a/etc/tor-browser-el.profile b/etc/profile-m-z/tor-browser-el.profile index b978b6042..b978b6042 100644 --- a/etc/tor-browser-el.profile +++ b/etc/profile-m-z/tor-browser-el.profile | |||
diff --git a/etc/tor-browser-en-us.profile b/etc/profile-m-z/tor-browser-en-us.profile index db56dda1b..db56dda1b 100644 --- a/etc/tor-browser-en-us.profile +++ b/etc/profile-m-z/tor-browser-en-us.profile | |||
diff --git a/etc/tor-browser-en.profile b/etc/profile-m-z/tor-browser-en.profile index ad4110c0e..ad4110c0e 100644 --- a/etc/tor-browser-en.profile +++ b/etc/profile-m-z/tor-browser-en.profile | |||
diff --git a/etc/tor-browser-es-es.profile b/etc/profile-m-z/tor-browser-es-es.profile index 1aa586658..1aa586658 100644 --- a/etc/tor-browser-es-es.profile +++ b/etc/profile-m-z/tor-browser-es-es.profile | |||
diff --git a/etc/tor-browser-es.profile b/etc/profile-m-z/tor-browser-es.profile index a386e3387..a386e3387 100644 --- a/etc/tor-browser-es.profile +++ b/etc/profile-m-z/tor-browser-es.profile | |||
diff --git a/etc/tor-browser-fa.profile b/etc/profile-m-z/tor-browser-fa.profile index 7f847a7c2..7f847a7c2 100644 --- a/etc/tor-browser-fa.profile +++ b/etc/profile-m-z/tor-browser-fa.profile | |||
diff --git a/etc/tor-browser-fr.profile b/etc/profile-m-z/tor-browser-fr.profile index bce470ec8..bce470ec8 100644 --- a/etc/tor-browser-fr.profile +++ b/etc/profile-m-z/tor-browser-fr.profile | |||
diff --git a/etc/tor-browser-ga-ie.profile b/etc/profile-m-z/tor-browser-ga-ie.profile index 994897a87..994897a87 100644 --- a/etc/tor-browser-ga-ie.profile +++ b/etc/profile-m-z/tor-browser-ga-ie.profile | |||
diff --git a/etc/tor-browser-he.profile b/etc/profile-m-z/tor-browser-he.profile index 6367b4c0a..6367b4c0a 100644 --- a/etc/tor-browser-he.profile +++ b/etc/profile-m-z/tor-browser-he.profile | |||
diff --git a/etc/tor-browser-hu.profile b/etc/profile-m-z/tor-browser-hu.profile index 68e79833e..68e79833e 100644 --- a/etc/tor-browser-hu.profile +++ b/etc/profile-m-z/tor-browser-hu.profile | |||
diff --git a/etc/tor-browser-id.profile b/etc/profile-m-z/tor-browser-id.profile index 85b455ba2..85b455ba2 100644 --- a/etc/tor-browser-id.profile +++ b/etc/profile-m-z/tor-browser-id.profile | |||
diff --git a/etc/tor-browser-is.profile b/etc/profile-m-z/tor-browser-is.profile index 48e88db71..48e88db71 100644 --- a/etc/tor-browser-is.profile +++ b/etc/profile-m-z/tor-browser-is.profile | |||
diff --git a/etc/tor-browser-it.profile b/etc/profile-m-z/tor-browser-it.profile index 3c239ca29..3c239ca29 100644 --- a/etc/tor-browser-it.profile +++ b/etc/profile-m-z/tor-browser-it.profile | |||
diff --git a/etc/tor-browser-ja.profile b/etc/profile-m-z/tor-browser-ja.profile index c52e0f64e..c52e0f64e 100644 --- a/etc/tor-browser-ja.profile +++ b/etc/profile-m-z/tor-browser-ja.profile | |||
diff --git a/etc/tor-browser-ka.profile b/etc/profile-m-z/tor-browser-ka.profile index 173b85e5c..173b85e5c 100644 --- a/etc/tor-browser-ka.profile +++ b/etc/profile-m-z/tor-browser-ka.profile | |||
diff --git a/etc/tor-browser-ko.profile b/etc/profile-m-z/tor-browser-ko.profile index 8faa5afa1..8faa5afa1 100644 --- a/etc/tor-browser-ko.profile +++ b/etc/profile-m-z/tor-browser-ko.profile | |||
diff --git a/etc/tor-browser-nb.profile b/etc/profile-m-z/tor-browser-nb.profile index d1352dd80..d1352dd80 100644 --- a/etc/tor-browser-nb.profile +++ b/etc/profile-m-z/tor-browser-nb.profile | |||
diff --git a/etc/tor-browser-nl.profile b/etc/profile-m-z/tor-browser-nl.profile index d4443cca2..d4443cca2 100644 --- a/etc/tor-browser-nl.profile +++ b/etc/profile-m-z/tor-browser-nl.profile | |||
diff --git a/etc/tor-browser-pl.profile b/etc/profile-m-z/tor-browser-pl.profile index 08ddd4ae7..08ddd4ae7 100644 --- a/etc/tor-browser-pl.profile +++ b/etc/profile-m-z/tor-browser-pl.profile | |||
diff --git a/etc/tor-browser-pt-br.profile b/etc/profile-m-z/tor-browser-pt-br.profile index 9942a3fe8..9942a3fe8 100644 --- a/etc/tor-browser-pt-br.profile +++ b/etc/profile-m-z/tor-browser-pt-br.profile | |||
diff --git a/etc/tor-browser-ru.profile b/etc/profile-m-z/tor-browser-ru.profile index 6294f8ca0..6294f8ca0 100644 --- a/etc/tor-browser-ru.profile +++ b/etc/profile-m-z/tor-browser-ru.profile | |||
diff --git a/etc/tor-browser-sv-se.profile b/etc/profile-m-z/tor-browser-sv-se.profile index c8544262f..c8544262f 100644 --- a/etc/tor-browser-sv-se.profile +++ b/etc/profile-m-z/tor-browser-sv-se.profile | |||
diff --git a/etc/tor-browser-tr.profile b/etc/profile-m-z/tor-browser-tr.profile index 2343fa8de..2343fa8de 100644 --- a/etc/tor-browser-tr.profile +++ b/etc/profile-m-z/tor-browser-tr.profile | |||
diff --git a/etc/tor-browser-vi.profile b/etc/profile-m-z/tor-browser-vi.profile index 734c38698..734c38698 100644 --- a/etc/tor-browser-vi.profile +++ b/etc/profile-m-z/tor-browser-vi.profile | |||
diff --git a/etc/tor-browser-zh-cn.profile b/etc/profile-m-z/tor-browser-zh-cn.profile index 21e813e45..21e813e45 100644 --- a/etc/tor-browser-zh-cn.profile +++ b/etc/profile-m-z/tor-browser-zh-cn.profile | |||
diff --git a/etc/tor-browser-zh-tw.profile b/etc/profile-m-z/tor-browser-zh-tw.profile index 6fe09c6c1..6fe09c6c1 100644 --- a/etc/tor-browser-zh-tw.profile +++ b/etc/profile-m-z/tor-browser-zh-tw.profile | |||
diff --git a/etc/tor-browser.profile b/etc/profile-m-z/tor-browser.profile index 0cd84abf5..0cd84abf5 100644 --- a/etc/tor-browser.profile +++ b/etc/profile-m-z/tor-browser.profile | |||
diff --git a/etc/tor-browser_ar.profile b/etc/profile-m-z/tor-browser_ar.profile index 1e1f5ce35..1e1f5ce35 100644 --- a/etc/tor-browser_ar.profile +++ b/etc/profile-m-z/tor-browser_ar.profile | |||
diff --git a/etc/tor-browser_ca.profile b/etc/profile-m-z/tor-browser_ca.profile index e114b6051..e114b6051 100644 --- a/etc/tor-browser_ca.profile +++ b/etc/profile-m-z/tor-browser_ca.profile | |||
diff --git a/etc/tor-browser_cs.profile b/etc/profile-m-z/tor-browser_cs.profile index 498068bc6..498068bc6 100644 --- a/etc/tor-browser_cs.profile +++ b/etc/profile-m-z/tor-browser_cs.profile | |||
diff --git a/etc/tor-browser_da.profile b/etc/profile-m-z/tor-browser_da.profile index 5c25c03c8..5c25c03c8 100644 --- a/etc/tor-browser_da.profile +++ b/etc/profile-m-z/tor-browser_da.profile | |||
diff --git a/etc/tor-browser_de.profile b/etc/profile-m-z/tor-browser_de.profile index d530e7dbe..d530e7dbe 100644 --- a/etc/tor-browser_de.profile +++ b/etc/profile-m-z/tor-browser_de.profile | |||
diff --git a/etc/tor-browser_el.profile b/etc/profile-m-z/tor-browser_el.profile index 67d5ab440..67d5ab440 100644 --- a/etc/tor-browser_el.profile +++ b/etc/profile-m-z/tor-browser_el.profile | |||
diff --git a/etc/tor-browser_en-US.profile b/etc/profile-m-z/tor-browser_en-US.profile index b298ab2b8..b298ab2b8 100644 --- a/etc/tor-browser_en-US.profile +++ b/etc/profile-m-z/tor-browser_en-US.profile | |||
diff --git a/etc/tor-browser_en.profile b/etc/profile-m-z/tor-browser_en.profile index 6bb0616b1..6bb0616b1 100644 --- a/etc/tor-browser_en.profile +++ b/etc/profile-m-z/tor-browser_en.profile | |||
diff --git a/etc/tor-browser_es-ES.profile b/etc/profile-m-z/tor-browser_es-ES.profile index 78f57ffe5..78f57ffe5 100644 --- a/etc/tor-browser_es-ES.profile +++ b/etc/profile-m-z/tor-browser_es-ES.profile | |||
diff --git a/etc/tor-browser_es.profile b/etc/profile-m-z/tor-browser_es.profile index ea34a07c9..ea34a07c9 100644 --- a/etc/tor-browser_es.profile +++ b/etc/profile-m-z/tor-browser_es.profile | |||
diff --git a/etc/tor-browser_fa.profile b/etc/profile-m-z/tor-browser_fa.profile index fbc416ce5..fbc416ce5 100644 --- a/etc/tor-browser_fa.profile +++ b/etc/profile-m-z/tor-browser_fa.profile | |||
diff --git a/etc/tor-browser_fr.profile b/etc/profile-m-z/tor-browser_fr.profile index caea6db5b..caea6db5b 100644 --- a/etc/tor-browser_fr.profile +++ b/etc/profile-m-z/tor-browser_fr.profile | |||
diff --git a/etc/tor-browser_ga-IE.profile b/etc/profile-m-z/tor-browser_ga-IE.profile index 6342daebf..6342daebf 100644 --- a/etc/tor-browser_ga-IE.profile +++ b/etc/profile-m-z/tor-browser_ga-IE.profile | |||
diff --git a/etc/tor-browser_he.profile b/etc/profile-m-z/tor-browser_he.profile index cc4150620..cc4150620 100644 --- a/etc/tor-browser_he.profile +++ b/etc/profile-m-z/tor-browser_he.profile | |||
diff --git a/etc/tor-browser_hu.profile b/etc/profile-m-z/tor-browser_hu.profile index 952a0b68a..952a0b68a 100644 --- a/etc/tor-browser_hu.profile +++ b/etc/profile-m-z/tor-browser_hu.profile | |||
diff --git a/etc/tor-browser_id.profile b/etc/profile-m-z/tor-browser_id.profile index a006b27c0..a006b27c0 100644 --- a/etc/tor-browser_id.profile +++ b/etc/profile-m-z/tor-browser_id.profile | |||
diff --git a/etc/tor-browser_is.profile b/etc/profile-m-z/tor-browser_is.profile index 038e0fabb..038e0fabb 100644 --- a/etc/tor-browser_is.profile +++ b/etc/profile-m-z/tor-browser_is.profile | |||
diff --git a/etc/tor-browser_it.profile b/etc/profile-m-z/tor-browser_it.profile index 3d2566994..3d2566994 100644 --- a/etc/tor-browser_it.profile +++ b/etc/profile-m-z/tor-browser_it.profile | |||
diff --git a/etc/tor-browser_ja.profile b/etc/profile-m-z/tor-browser_ja.profile index 08c942bcd..08c942bcd 100644 --- a/etc/tor-browser_ja.profile +++ b/etc/profile-m-z/tor-browser_ja.profile | |||
diff --git a/etc/tor-browser_ka.profile b/etc/profile-m-z/tor-browser_ka.profile index 97664be4d..97664be4d 100644 --- a/etc/tor-browser_ka.profile +++ b/etc/profile-m-z/tor-browser_ka.profile | |||
diff --git a/etc/tor-browser_ko.profile b/etc/profile-m-z/tor-browser_ko.profile index 98cf1e3e1..98cf1e3e1 100644 --- a/etc/tor-browser_ko.profile +++ b/etc/profile-m-z/tor-browser_ko.profile | |||
diff --git a/etc/tor-browser_nb.profile b/etc/profile-m-z/tor-browser_nb.profile index 6df840573..6df840573 100644 --- a/etc/tor-browser_nb.profile +++ b/etc/profile-m-z/tor-browser_nb.profile | |||
diff --git a/etc/tor-browser_nl.profile b/etc/profile-m-z/tor-browser_nl.profile index 3f545f888..3f545f888 100644 --- a/etc/tor-browser_nl.profile +++ b/etc/profile-m-z/tor-browser_nl.profile | |||
diff --git a/etc/tor-browser_pl.profile b/etc/profile-m-z/tor-browser_pl.profile index 4e04dc027..4e04dc027 100644 --- a/etc/tor-browser_pl.profile +++ b/etc/profile-m-z/tor-browser_pl.profile | |||
diff --git a/etc/tor-browser_pt-BR.profile b/etc/profile-m-z/tor-browser_pt-BR.profile index 7f864886c..7f864886c 100644 --- a/etc/tor-browser_pt-BR.profile +++ b/etc/profile-m-z/tor-browser_pt-BR.profile | |||
diff --git a/etc/tor-browser_ru.profile b/etc/profile-m-z/tor-browser_ru.profile index 2fae6fbe7..2fae6fbe7 100644 --- a/etc/tor-browser_ru.profile +++ b/etc/profile-m-z/tor-browser_ru.profile | |||
diff --git a/etc/tor-browser_sv-SE.profile b/etc/profile-m-z/tor-browser_sv-SE.profile index 2157f8d2b..2157f8d2b 100644 --- a/etc/tor-browser_sv-SE.profile +++ b/etc/profile-m-z/tor-browser_sv-SE.profile | |||
diff --git a/etc/tor-browser_tr.profile b/etc/profile-m-z/tor-browser_tr.profile index 20ac246ca..20ac246ca 100644 --- a/etc/tor-browser_tr.profile +++ b/etc/profile-m-z/tor-browser_tr.profile | |||
diff --git a/etc/tor-browser_vi.profile b/etc/profile-m-z/tor-browser_vi.profile index 4faa06ff6..4faa06ff6 100644 --- a/etc/tor-browser_vi.profile +++ b/etc/profile-m-z/tor-browser_vi.profile | |||
diff --git a/etc/tor-browser_zh-CN.profile b/etc/profile-m-z/tor-browser_zh-CN.profile index e4d8215e6..e4d8215e6 100644 --- a/etc/tor-browser_zh-CN.profile +++ b/etc/profile-m-z/tor-browser_zh-CN.profile | |||
diff --git a/etc/tor-browser_zh-TW.profile b/etc/profile-m-z/tor-browser_zh-TW.profile index 8a28015a6..8a28015a6 100644 --- a/etc/tor-browser_zh-TW.profile +++ b/etc/profile-m-z/tor-browser_zh-TW.profile | |||
diff --git a/etc/tor.profile b/etc/profile-m-z/tor.profile index 13d071635..13d071635 100644 --- a/etc/tor.profile +++ b/etc/profile-m-z/tor.profile | |||
diff --git a/etc/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index 72bdf9fa1..6bcc51f4d 100644 --- a/etc/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -12,8 +12,8 @@ noblacklist ${HOME}/.config/torbrowser | |||
12 | noblacklist ${HOME}/.local/share/torbrowser | 12 | noblacklist ${HOME}/.local/share/torbrowser |
13 | 13 | ||
14 | # Allow python (blacklisted by disable-interpreters.inc) | 14 | # Allow python (blacklisted by disable-interpreters.inc) |
15 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | 16 | include allow-python3.inc |
17 | 17 | ||
18 | include disable-common.inc | 18 | include disable-common.inc |
19 | include disable-devel.inc | 19 | include disable-devel.inc |
@@ -33,7 +33,6 @@ include whitelist-var-common.inc | |||
33 | 33 | ||
34 | caps.drop all | 34 | caps.drop all |
35 | netfilter | 35 | netfilter |
36 | nodbus | ||
37 | nodvd | 36 | nodvd |
38 | nogroups | 37 | nogroups |
39 | nonewprivs | 38 | nonewprivs |
@@ -52,3 +51,6 @@ private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog, | |||
52 | private-dev | 51 | private-dev |
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl | 52 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
54 | private-tmp | 53 | private-tmp |
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
diff --git a/etc/torcs.profile b/etc/profile-m-z/torcs.profile index d9c59b276..1ed78934e 100644 --- a/etc/torcs.profile +++ b/etc/profile-m-z/torcs.profile | |||
@@ -18,13 +18,15 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.torcs | 19 | mkdir ${HOME}/.torcs |
20 | whitelist ${HOME}/.torcs | 20 | whitelist ${HOME}/.torcs |
21 | whitelist /usr/share/games/torcs | ||
22 | whitelist /var/games/torcs | ||
21 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
24 | caps.drop all | 27 | caps.drop all |
25 | ipc-namespace | 28 | ipc-namespace |
26 | net none | 29 | net none |
27 | nodbus | ||
28 | nodvd | 30 | nodvd |
29 | nogroups | 31 | nogroups |
30 | nonewprivs | 32 | nonewprivs |
@@ -38,6 +40,10 @@ shell none | |||
38 | tracelog | 40 | tracelog |
39 | 41 | ||
40 | disable-mnt | 42 | disable-mnt |
43 | private-bin bash,chmod,cp,mkdir,rm,torcs | ||
41 | private-cache | 44 | private-cache |
42 | private-dev | 45 | private-dev |
43 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/totem.profile b/etc/profile-m-z/totem.profile index 5b74709e3..b8f4ca765 100644 --- a/etc/totem.profile +++ b/etc/profile-m-z/totem.profile | |||
@@ -9,9 +9,13 @@ include globals.local | |||
9 | # Allow lua (required for youtube video) | 9 | # Allow lua (required for youtube video) |
10 | include allow-lua.inc | 10 | include allow-lua.inc |
11 | 11 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
12 | noblacklist ${HOME}/.config/totem | 15 | noblacklist ${HOME}/.config/totem |
13 | noblacklist ${HOME}/.local/share/totem | 16 | noblacklist ${HOME}/.local/share/totem |
14 | noblacklist ${MUSIC} | 17 | noblacklist ${MUSIC} |
18 | noblacklist ${PICTURES} | ||
15 | noblacklist ${VIDEOS} | 19 | noblacklist ${VIDEOS} |
16 | 20 | ||
17 | include disable-common.inc | 21 | include disable-common.inc |
@@ -20,6 +24,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 24 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 25 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 26 | include disable-programs.inc |
27 | include disable-shell.inc | ||
23 | include disable-xdg.inc | 28 | include disable-xdg.inc |
24 | 29 | ||
25 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
@@ -27,7 +32,6 @@ include whitelist-var-common.inc | |||
27 | # apparmor - makes settings immutable | 32 | # apparmor - makes settings immutable |
28 | caps.drop all | 33 | caps.drop all |
29 | netfilter | 34 | netfilter |
30 | # nodbus - makes settings immutable | ||
31 | nogroups | 35 | nogroups |
32 | nonewprivs | 36 | nonewprivs |
33 | noroot | 37 | noroot |
@@ -35,6 +39,7 @@ nou2f | |||
35 | protocol unix,inet,inet6 | 39 | protocol unix,inet,inet6 |
36 | seccomp | 40 | seccomp |
37 | shell none | 41 | shell none |
42 | tracelog | ||
38 | 43 | ||
39 | private-bin totem | 44 | private-bin totem |
40 | # totem needs access to ~/.cache/tracker or it exits | 45 | # totem needs access to ~/.cache/tracker or it exits |
@@ -43,3 +48,6 @@ private-dev | |||
43 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl | 48 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl |
44 | private-tmp | 49 | private-tmp |
45 | 50 | ||
51 | # makes settings immutable | ||
52 | # dbus-user none | ||
53 | # dbus-system none | ||
diff --git a/etc/tracker.profile b/etc/profile-m-z/tracker.profile index d47185b1d..87c5de076 100644 --- a/etc/tracker.profile +++ b/etc/profile-m-z/tracker.profile | |||
@@ -16,6 +16,9 @@ include disable-devel.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
20 | |||
21 | include whitelist-runuser-common.inc | ||
19 | 22 | ||
20 | caps.drop all | 23 | caps.drop all |
21 | netfilter | 24 | netfilter |
diff --git a/etc/transgui.profile b/etc/profile-m-z/transgui.profile index 567e2ab30..c31055cdc 100644 --- a/etc/transgui.profile +++ b/etc/profile-m-z/transgui.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/transgui | 20 | mkdir ${HOME}/.config/transgui |
@@ -28,7 +29,6 @@ caps.drop all | |||
28 | ipc-namespace | 29 | ipc-namespace |
29 | machine-id | 30 | machine-id |
30 | netfilter | 31 | netfilter |
31 | nodbus | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -49,4 +49,7 @@ private-etc alternatives,fonts | |||
49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* | 49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
52 | memory-deny-write-execute | 55 | memory-deny-write-execute |
diff --git a/etc/transmission-cli.profile b/etc/profile-m-z/transmission-cli.profile index 486be5fe6..486be5fe6 100644 --- a/etc/transmission-cli.profile +++ b/etc/profile-m-z/transmission-cli.profile | |||
diff --git a/etc/transmission-common.profile b/etc/profile-m-z/transmission-common.profile index b9f49c4a4..9d2e8e990 100644 --- a/etc/transmission-common.profile +++ b/etc/profile-m-z/transmission-common.profile | |||
@@ -30,7 +30,6 @@ apparmor | |||
30 | caps.drop all | 30 | caps.drop all |
31 | machine-id | 31 | machine-id |
32 | netfilter | 32 | netfilter |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nonewprivs | 34 | nonewprivs |
36 | noroot | 35 | noroot |
@@ -48,4 +47,7 @@ private-dev | |||
48 | private-lib | 47 | private-lib |
49 | private-tmp | 48 | private-tmp |
50 | 49 | ||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
51 | memory-deny-write-execute | 53 | memory-deny-write-execute |
diff --git a/etc/transmission-create.profile b/etc/profile-m-z/transmission-create.profile index 8220b7887..8220b7887 100644 --- a/etc/transmission-create.profile +++ b/etc/profile-m-z/transmission-create.profile | |||
diff --git a/etc/transmission-daemon.profile b/etc/profile-m-z/transmission-daemon.profile index 1841b8ed0..363c685e0 100644 --- a/etc/transmission-daemon.profile +++ b/etc/profile-m-z/transmission-daemon.profile | |||
@@ -7,6 +7,8 @@ include transmission-daemon.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore caps.drop all | ||
11 | |||
10 | mkdir ${HOME}/.config/transmission-daemon | 12 | mkdir ${HOME}/.config/transmission-daemon |
11 | whitelist ${HOME}/.config/transmission-daemon | 13 | whitelist ${HOME}/.config/transmission-daemon |
12 | whitelist /var/lib/transmission | 14 | whitelist /var/lib/transmission |
diff --git a/etc/transmission-edit.profile b/etc/profile-m-z/transmission-edit.profile index df381b5cd..df381b5cd 100644 --- a/etc/transmission-edit.profile +++ b/etc/profile-m-z/transmission-edit.profile | |||
diff --git a/etc/transmission-gtk.profile b/etc/profile-m-z/transmission-gtk.profile index 01bdeb4ef..03111ec56 100644 --- a/etc/transmission-gtk.profile +++ b/etc/profile-m-z/transmission-gtk.profile | |||
@@ -7,7 +7,10 @@ include transmission-gtk.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | include whitelist-runuser-common.inc | ||
11 | |||
10 | private-bin transmission-gtk | 12 | private-bin transmission-gtk |
13 | private-cache | ||
11 | 14 | ||
12 | ignore memory-deny-write-execute | 15 | ignore memory-deny-write-execute |
13 | 16 | ||
diff --git a/etc/transmission-qt.profile b/etc/profile-m-z/transmission-qt.profile index 94f3c3a20..94f3c3a20 100644 --- a/etc/transmission-qt.profile +++ b/etc/profile-m-z/transmission-qt.profile | |||
diff --git a/etc/transmission-remote-cli.profile b/etc/profile-m-z/transmission-remote-cli.profile index 8b3a966c1..7b9285e66 100644 --- a/etc/transmission-remote-cli.profile +++ b/etc/profile-m-z/transmission-remote-cli.profile | |||
@@ -8,8 +8,8 @@ include transmission-remote-cli.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | # Allow python (blacklisted by disable-interpreters.inc) | 10 | # Allow python (blacklisted by disable-interpreters.inc) |
11 | include allow-python2.inc | 11 | include allow-python2.inc |
12 | include allow-python3.inc | 12 | include allow-python3.inc |
13 | 13 | ||
14 | private-bin python*,transmission-remote-cli | 14 | private-bin python*,transmission-remote-cli |
15 | 15 | ||
diff --git a/etc/transmission-remote-gtk.profile b/etc/profile-m-z/transmission-remote-gtk.profile index a6400e2c0..a6400e2c0 100644 --- a/etc/transmission-remote-gtk.profile +++ b/etc/profile-m-z/transmission-remote-gtk.profile | |||
diff --git a/etc/transmission-remote.profile b/etc/profile-m-z/transmission-remote.profile index fee4999e6..fee4999e6 100644 --- a/etc/transmission-remote.profile +++ b/etc/profile-m-z/transmission-remote.profile | |||
diff --git a/etc/transmission-show.profile b/etc/profile-m-z/transmission-show.profile index 5a3c83f58..5a3c83f58 100644 --- a/etc/transmission-show.profile +++ b/etc/profile-m-z/transmission-show.profile | |||
diff --git a/etc/tremulous.profile b/etc/profile-m-z/tremulous.profile index e148298ae..67463a999 100644 --- a/etc/tremulous.profile +++ b/etc/profile-m-z/tremulous.profile | |||
@@ -14,17 +14,20 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.tremulous | 20 | mkdir ${HOME}/.tremulous |
20 | whitelist ${HOME}/.tremulous | 21 | whitelist ${HOME}/.tremulous |
22 | whitelist /usr/share/tremulous | ||
21 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
23 | 27 | ||
24 | caps.drop all | 28 | caps.drop all |
25 | ipc-namespace | 29 | ipc-namespace |
26 | netfilter | 30 | netfilter |
27 | nodbus | ||
28 | nodvd | 31 | nodvd |
29 | nogroups | 32 | nogroups |
30 | nonewprivs | 33 | nonewprivs |
@@ -42,3 +45,6 @@ private-bin tremded,tremulous,tremulous-wrapper | |||
42 | private-cache | 45 | private-cache |
43 | private-dev | 46 | private-dev |
44 | private-tmp | 47 | private-tmp |
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/truecraft.profile b/etc/profile-m-z/truecraft.profile index e76d52219..e76d52219 100644 --- a/etc/truecraft.profile +++ b/etc/profile-m-z/truecraft.profile | |||
diff --git a/etc/profile-m-z/ts3client_runscript.sh.profile b/etc/profile-m-z/ts3client_runscript.sh.profile new file mode 100644 index 000000000..8d4675454 --- /dev/null +++ b/etc/profile-m-z/ts3client_runscript.sh.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile alias for teamspeak3 | ||
2 | # Description: TeamSpeak is software for quality voice communication via the Internet | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ts3client_runscript.sh.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | ignore noexec ${HOME} | ||
11 | |||
12 | noblacklist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
13 | noblacklist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
14 | |||
15 | whitelist ${HOME}/TeamSpeak3-Client-linux_x86 | ||
16 | whitelist ${HOME}/TeamSpeak3-Client-linux_amd64 | ||
17 | |||
18 | # Redirect | ||
19 | include teamspeak3.profile | ||
diff --git a/etc/tshark.profile b/etc/profile-m-z/tshark.profile index 22ced5d8a..684a9491d 100644 --- a/etc/tshark.profile +++ b/etc/profile-m-z/tshark.profile | |||
@@ -16,9 +16,11 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/wireshark | 17 | whitelist /usr/share/wireshark |
18 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
23 | apparmor | ||
22 | #caps.keep net_raw | 24 | #caps.keep net_raw |
23 | caps.keep dac_override,net_admin,net_raw | 25 | caps.keep dac_override,net_admin,net_raw |
24 | ipc-namespace | 26 | ipc-namespace |
diff --git a/etc/tuxguitar.profile b/etc/profile-m-z/tuxguitar.profile index ae868a022..d2b13d9ee 100644 --- a/etc/tuxguitar.profile +++ b/etc/profile-m-z/tuxguitar.profile | |||
@@ -15,6 +15,7 @@ include allow-java.inc | |||
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
18 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 21 | include disable-programs.inc |
@@ -22,6 +23,7 @@ include disable-xdg.inc | |||
22 | 23 | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
26 | apparmor | ||
25 | caps.drop all | 27 | caps.drop all |
26 | netfilter | 28 | netfilter |
27 | no3d | 29 | no3d |
diff --git a/etc/tvbrowser.profile b/etc/profile-m-z/tvbrowser.profile index 6e028b086..d3dcbfe53 100644 --- a/etc/tvbrowser.profile +++ b/etc/profile-m-z/tvbrowser.profile | |||
@@ -32,7 +32,6 @@ include whitelist-var-common.inc | |||
32 | caps.drop all | 32 | caps.drop all |
33 | netfilter | 33 | netfilter |
34 | no3d | 34 | no3d |
35 | nodbus | ||
36 | nodvd | 35 | nodvd |
37 | nogroups | 36 | nogroups |
38 | nonewprivs | 37 | nonewprivs |
@@ -49,3 +48,6 @@ disable-mnt | |||
49 | private-cache | 48 | private-cache |
50 | private-dev | 49 | private-dev |
51 | private-tmp | 50 | private-tmp |
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
diff --git a/etc/udiskie.profile b/etc/profile-m-z/udiskie.profile index 265f6429d..265f6429d 100644 --- a/etc/udiskie.profile +++ b/etc/profile-m-z/udiskie.profile | |||
diff --git a/etc/uefitool.profile b/etc/profile-m-z/uefitool.profile index 8ab0e9a26..8807b0b2c 100644 --- a/etc/uefitool.profile +++ b/etc/profile-m-z/uefitool.profile | |||
@@ -19,7 +19,6 @@ caps.drop all | |||
19 | ipc-namespace | 19 | ipc-namespace |
20 | net none | 20 | net none |
21 | no3d | 21 | no3d |
22 | nodbus | ||
23 | nodvd | 22 | nodvd |
24 | nogroups | 23 | nogroups |
25 | nonewprivs | 24 | nonewprivs |
@@ -36,3 +35,5 @@ private-cache | |||
36 | private-dev | 35 | private-dev |
37 | private-tmp | 36 | private-tmp |
38 | 37 | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/uget-gtk.profile b/etc/profile-m-z/uget-gtk.profile index 8a2e83a1a..c8f28444f 100644 --- a/etc/uget-gtk.profile +++ b/etc/profile-m-z/uget-gtk.profile | |||
@@ -11,6 +11,7 @@ include disable-common.inc | |||
11 | include disable-devel.inc | 11 | include disable-devel.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | 15 | ||
15 | mkdir ${HOME}/.config/uGet | 16 | mkdir ${HOME}/.config/uGet |
16 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
diff --git a/etc/unbound.profile b/etc/profile-m-z/unbound.profile index 36533a762..714a3f2f4 100644 --- a/etc/unbound.profile +++ b/etc/profile-m-z/unbound.profile | |||
@@ -30,7 +30,6 @@ ipc-namespace | |||
30 | machine-id | 30 | machine-id |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
33 | nodbus | ||
34 | nodvd | 33 | nodvd |
35 | nonewprivs | 34 | nonewprivs |
36 | nosound | 35 | nosound |
@@ -46,5 +45,8 @@ private-dev | |||
46 | private-tmp | 45 | private-tmp |
47 | writable-var | 46 | writable-var |
48 | 47 | ||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
49 | # mdwe can break modules/plugins | 51 | # mdwe can break modules/plugins |
50 | memory-deny-write-execute | 52 | memory-deny-write-execute |
diff --git a/etc/uncompress.profile b/etc/profile-m-z/uncompress.profile index f659d8e87..f659d8e87 100644 --- a/etc/uncompress.profile +++ b/etc/profile-m-z/uncompress.profile | |||
diff --git a/etc/unf.profile b/etc/profile-m-z/unf.profile index b8eccf4dc..bcd256ba3 100644 --- a/etc/unf.profile +++ b/etc/profile-m-z/unf.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
@@ -29,7 +30,6 @@ ipc-namespace | |||
29 | machine-id | 30 | machine-id |
30 | net none | 31 | net none |
31 | no3d | 32 | no3d |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -53,4 +53,7 @@ private-etc alternatives | |||
53 | private-lib gcc/*/*/libgcc_s.so.* | 53 | private-lib gcc/*/*/libgcc_s.so.* |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | dbus-user none | ||
57 | dbus-system none | ||
58 | |||
56 | memory-deny-write-execute | 59 | memory-deny-write-execute |
diff --git a/etc/unknown-horizons.profile b/etc/profile-m-z/unknown-horizons.profile index 7223ea2e1..7dc13e284 100644 --- a/etc/unknown-horizons.profile +++ b/etc/profile-m-z/unknown-horizons.profile | |||
@@ -9,13 +9,19 @@ include globals.local | |||
9 | noblacklist ${HOME}/.unknown-horizons | 9 | noblacklist ${HOME}/.unknown-horizons |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-exec.inc | ||
12 | include disable-passwdmgr.inc | 13 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 14 | include disable-programs.inc |
14 | 15 | ||
15 | mkdir ${HOME}/.unknown-horizons | 16 | mkdir ${HOME}/.unknown-horizons |
16 | whitelist ${HOME}/.unknown-horizons | 17 | whitelist ${HOME}/.unknown-horizons |
17 | include whitelist-common.inc | 18 | include whitelist-common.inc |
19 | include whitelist-runuser-common.inc | ||
20 | whitelist /usr/share/unknown-horizons | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
18 | 23 | ||
24 | apparmor | ||
19 | caps.drop all | 25 | caps.drop all |
20 | nodvd | 26 | nodvd |
21 | nogroups | 27 | nogroups |
@@ -28,7 +34,11 @@ protocol unix,inet,inet6,netlink | |||
28 | seccomp | 34 | seccomp |
29 | shell none | 35 | shell none |
30 | 36 | ||
37 | disable-mnt | ||
31 | # private-bin unknown-horizons | 38 | # private-bin unknown-horizons |
32 | private-dev | 39 | private-dev |
33 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 40 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl |
34 | private-tmp | 41 | private-tmp |
42 | |||
43 | # doesn't work - maybe all Tcl/Tk programs have this problem | ||
44 | # memory-deny-write-execute | ||
diff --git a/etc/unlzma.profile b/etc/profile-m-z/unlzma.profile index f7410b928..d9c72407f 100644 --- a/etc/unlzma.profile +++ b/etc/profile-m-z/unlzma.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/unrar.profile b/etc/profile-m-z/unrar.profile index bf28746b0..e07a6fc93 100644 --- a/etc/unrar.profile +++ b/etc/profile-m-z/unrar.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | caps.drop all | 20 | caps.drop all |
20 | hostname unrar | 21 | hostname unrar |
@@ -22,7 +23,6 @@ ipc-namespace | |||
22 | machine-id | 23 | machine-id |
23 | net none | 24 | net none |
24 | no3d | 25 | no3d |
25 | nodbus | ||
26 | nodvd | 26 | nodvd |
27 | #nogroups | 27 | #nogroups |
28 | nonewprivs | 28 | nonewprivs |
@@ -41,3 +41,6 @@ private-bin unrar | |||
41 | private-dev | 41 | private-dev |
42 | private-etc alternatives,group,localtime,passwd | 42 | private-etc alternatives,group,localtime,passwd |
43 | private-tmp | 43 | private-tmp |
44 | |||
45 | dbus-user none | ||
46 | dbus-system none | ||
diff --git a/etc/unxz.profile b/etc/profile-m-z/unxz.profile index f7410b928..d9c72407f 100644 --- a/etc/unxz.profile +++ b/etc/profile-m-z/unxz.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/unzip.profile b/etc/profile-m-z/unzip.profile index 7882f2b63..e08511c12 100644 --- a/etc/unzip.profile +++ b/etc/profile-m-z/unzip.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | 22 | ||
22 | caps.drop all | 23 | caps.drop all |
23 | hostname unzip | 24 | hostname unzip |
@@ -25,7 +26,6 @@ ipc-namespace | |||
25 | machine-id | 26 | machine-id |
26 | net none | 27 | net none |
27 | no3d | 28 | no3d |
28 | nodbus | ||
29 | nodvd | 29 | nodvd |
30 | #nogroups | 30 | #nogroups |
31 | nonewprivs | 31 | nonewprivs |
@@ -43,3 +43,6 @@ x11 none | |||
43 | private-bin unzip | 43 | private-bin unzip |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,group,localtime,passwd | 45 | private-etc alternatives,group,localtime,passwd |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/unzstd.profile b/etc/profile-m-z/unzstd.profile index ce9af3286..ce9af3286 100644 --- a/etc/unzstd.profile +++ b/etc/profile-m-z/unzstd.profile | |||
diff --git a/etc/utox.profile b/etc/profile-m-z/utox.profile index 9877ea889..cd4374004 100644 --- a/etc/utox.profile +++ b/etc/profile-m-z/utox.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | mkdir ${HOME}/.config/tox | 21 | mkdir ${HOME}/.config/tox |
diff --git a/etc/uudeview.profile b/etc/profile-m-z/uudeview.profile index bd2ee01d5..f60c134e0 100644 --- a/etc/uudeview.profile +++ b/etc/profile-m-z/uudeview.profile | |||
@@ -15,6 +15,7 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | 19 | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | 21 | ||
@@ -23,7 +24,6 @@ hostname uudeview | |||
23 | ipc-namespace | 24 | ipc-namespace |
24 | machine-id | 25 | machine-id |
25 | net none | 26 | net none |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | #nogroups | 28 | #nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,3 +42,6 @@ private-bin uudeview | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,ld.so.preload | 44 | private-etc alternatives,ld.so.preload |
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
diff --git a/etc/uzbl-browser.profile b/etc/profile-m-z/uzbl-browser.profile index d4e54235b..41487a8f2 100644 --- a/etc/uzbl-browser.profile +++ b/etc/profile-m-z/uzbl-browser.profile | |||
@@ -10,8 +10,8 @@ noblacklist ${HOME}/.gnupg | |||
10 | noblacklist ${HOME}/.local/share/uzbl | 10 | noblacklist ${HOME}/.local/share/uzbl |
11 | 11 | ||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 12 | # Allow python (blacklisted by disable-interpreters.inc) |
13 | include allow-python2.inc | 13 | include allow-python2.inc |
14 | include allow-python3.inc | 14 | include allow-python3.inc |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | 17 | include disable-devel.inc |
diff --git a/etc/viewnior.profile b/etc/profile-m-z/viewnior.profile index 9f57b2971..83727d42b 100644 --- a/etc/viewnior.profile +++ b/etc/profile-m-z/viewnior.profile | |||
@@ -18,6 +18,7 @@ include disable-exec.inc | |||
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-shell.inc | ||
21 | 22 | ||
22 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
@@ -26,7 +27,6 @@ apparmor | |||
26 | caps.drop all | 27 | caps.drop all |
27 | net none | 28 | net none |
28 | no3d | 29 | no3d |
29 | nodbus | ||
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | nonewprivs | 32 | nonewprivs |
@@ -46,4 +46,7 @@ private-dev | |||
46 | private-etc alternatives,fonts,machine-id | 46 | private-etc alternatives,fonts,machine-id |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
49 | #memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808) | 52 | #memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808) |
diff --git a/etc/viking.profile b/etc/profile-m-z/viking.profile index 5b6228a94..5b6228a94 100644 --- a/etc/viking.profile +++ b/etc/profile-m-z/viking.profile | |||
diff --git a/etc/vim.profile b/etc/profile-m-z/vim.profile index d27a9a633..e9a474239 100644 --- a/etc/vim.profile +++ b/etc/profile-m-z/vim.profile | |||
@@ -17,6 +17,8 @@ include disable-common.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-runuser-common.inc | ||
21 | |||
20 | caps.drop all | 22 | caps.drop all |
21 | netfilter | 23 | netfilter |
22 | nodvd | 24 | nodvd |
diff --git a/etc/vimcat.profile b/etc/profile-m-z/vimcat.profile index 73b76b5ab..73b76b5ab 100644 --- a/etc/vimcat.profile +++ b/etc/profile-m-z/vimcat.profile | |||
diff --git a/etc/vimdiff.profile b/etc/profile-m-z/vimdiff.profile index f09faf1d6..f09faf1d6 100644 --- a/etc/vimdiff.profile +++ b/etc/profile-m-z/vimdiff.profile | |||
diff --git a/etc/vimpager.profile b/etc/profile-m-z/vimpager.profile index af7703752..af7703752 100644 --- a/etc/vimpager.profile +++ b/etc/profile-m-z/vimpager.profile | |||
diff --git a/etc/vimtutor.profile b/etc/profile-m-z/vimtutor.profile index b9584cc49..b9584cc49 100644 --- a/etc/vimtutor.profile +++ b/etc/profile-m-z/vimtutor.profile | |||
diff --git a/etc/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index c0dbc9116..12bef5d1f 100644 --- a/etc/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -14,9 +14,12 @@ noblacklist /usr/lib/virtualbox | |||
14 | noblacklist /usr/lib64/virtualbox | 14 | noblacklist /usr/lib64/virtualbox |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | include disable-devel.inc | ||
17 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | include disable-interpreters.inc | ||
18 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | include disable-xdg.inc | ||
20 | 23 | ||
21 | mkdir ${HOME}/.config/VirtualBox | 24 | mkdir ${HOME}/.config/VirtualBox |
22 | mkdir ${HOME}/VirtualBox VMs | 25 | mkdir ${HOME}/VirtualBox VMs |
@@ -24,9 +27,23 @@ whitelist ${HOME}/.config/VirtualBox | |||
24 | whitelist ${HOME}/VirtualBox VMs | 27 | whitelist ${HOME}/VirtualBox VMs |
25 | whitelist ${DOWNLOADS} | 28 | whitelist ${DOWNLOADS} |
26 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
28 | 33 | ||
29 | caps.keep net_raw,sys_admin,sys_nice | 34 | # For host-only network sys_admin is needed. See https://github.com/netblue30/firejail/issues/2868#issuecomment-518647630 |
35 | |||
36 | caps.keep net_raw,sys_nice | ||
30 | netfilter | 37 | netfilter |
31 | nodvd | 38 | nodvd |
39 | #nogroups | ||
32 | notv | 40 | notv |
41 | shell none | ||
42 | tracelog | ||
43 | |||
44 | #disable-mnt | ||
45 | private-cache | ||
46 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/vivaldi-beta.profile b/etc/profile-m-z/vivaldi-beta.profile index 5de5682a3..5de5682a3 100644 --- a/etc/vivaldi-beta.profile +++ b/etc/profile-m-z/vivaldi-beta.profile | |||
diff --git a/etc/vivaldi-snapshot.profile b/etc/profile-m-z/vivaldi-snapshot.profile index ea4a4009f..ea4a4009f 100644 --- a/etc/vivaldi-snapshot.profile +++ b/etc/profile-m-z/vivaldi-snapshot.profile | |||
diff --git a/etc/vivaldi-stable.profile b/etc/profile-m-z/vivaldi-stable.profile index 5de5682a3..5de5682a3 100644 --- a/etc/vivaldi-stable.profile +++ b/etc/profile-m-z/vivaldi-stable.profile | |||
diff --git a/etc/vivaldi.profile b/etc/profile-m-z/vivaldi.profile index 2185b90ec..096ce8a72 100644 --- a/etc/vivaldi.profile +++ b/etc/profile-m-z/vivaldi.profile | |||
@@ -23,8 +23,9 @@ whitelist ${HOME}/.cache/vivaldi | |||
23 | whitelist ${HOME}/.config/vivaldi | 23 | whitelist ${HOME}/.config/vivaldi |
24 | whitelist ${HOME}/.local/lib/vivaldi | 24 | whitelist ${HOME}/.local/lib/vivaldi |
25 | 25 | ||
26 | # nodbus breaks vivaldi sync | 26 | # breaks vivaldi sync |
27 | ignore nodbus | 27 | ignore dbus-user none |
28 | ignore dbus-system none | ||
28 | 29 | ||
29 | # Redirect | 30 | # Redirect |
30 | include chromium-common.profile | 31 | include chromium-common.profile |
diff --git a/etc/vlc.profile b/etc/profile-m-z/vlc.profile index 572758f28..0069ebeae 100644 --- a/etc/vlc.profile +++ b/etc/profile-m-z/vlc.profile | |||
@@ -25,7 +25,6 @@ include whitelist-var-common.inc | |||
25 | #apparmor - on Ubuntu 18.04 it refuses to start without dbus access | 25 | #apparmor - on Ubuntu 18.04 it refuses to start without dbus access |
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | #nodbus - dbus needed for MPRIS | ||
29 | nogroups | 28 | nogroups |
30 | nonewprivs | 29 | nonewprivs |
31 | noroot | 30 | noroot |
@@ -38,5 +37,9 @@ private-bin cvlc,nvlc,qvlc,rvlc,svlc,vlc | |||
38 | private-dev | 37 | private-dev |
39 | private-tmp | 38 | private-tmp |
40 | 39 | ||
40 | # dbus needed for MPRIS | ||
41 | # dbus-user none | ||
42 | # dbus-system none | ||
43 | |||
41 | # mdwe is disabled due to breaking hardware accelerated decoding | 44 | # mdwe is disabled due to breaking hardware accelerated decoding |
42 | #memory-deny-write-execute | 45 | #memory-deny-write-execute |
diff --git a/etc/profile-m-z/vmware.profile b/etc/profile-m-z/vmware.profile new file mode 100644 index 000000000..720b69773 --- /dev/null +++ b/etc/profile-m-z/vmware.profile | |||
@@ -0,0 +1,39 @@ | |||
1 | # Firejail profile for vmware | ||
2 | # Description: The industry standard for running multiple operating systems as virtual machines on a single Linux PC. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include vmware.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/vmware | ||
10 | noblacklist ${HOME}/.vmware | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-passwdmgr.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.cache/vmware | ||
21 | mkdir ${HOME}/.vmware | ||
22 | whitelist ${HOME}/.cache/vmware | ||
23 | whitelist ${HOME}/.vmware | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | caps.keep chown,net_raw,sys_nice,sys_rawio | ||
30 | netfilter | ||
31 | nogroups | ||
32 | notv | ||
33 | shell none | ||
34 | tracelog | ||
35 | |||
36 | #disable-mnt | ||
37 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix | ||
38 | dbus-user none | ||
39 | dbus-system none | ||
diff --git a/etc/vscodium.profile b/etc/profile-m-z/vscodium.profile index b4728fb72..b4728fb72 100644 --- a/etc/vscodium.profile +++ b/etc/profile-m-z/vscodium.profile | |||
diff --git a/etc/vulturesclaw.profile b/etc/profile-m-z/vulturesclaw.profile index 2e9078a7b..2e9078a7b 100644 --- a/etc/vulturesclaw.profile +++ b/etc/profile-m-z/vulturesclaw.profile | |||
diff --git a/etc/vultureseye.profile b/etc/profile-m-z/vultureseye.profile index 44c263cfc..44c263cfc 100644 --- a/etc/vultureseye.profile +++ b/etc/profile-m-z/vultureseye.profile | |||
diff --git a/etc/vym.profile b/etc/profile-m-z/vym.profile index fbb53943c..fbb53943c 100644 --- a/etc/vym.profile +++ b/etc/profile-m-z/vym.profile | |||
diff --git a/etc/w3m.profile b/etc/profile-m-z/w3m.profile index 97465baa1..bd33edd6a 100644 --- a/etc/w3m.profile +++ b/etc/profile-m-z/w3m.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for w3m | 1 | # Firejail profile for w3m |
2 | # Description: WWW browsable pager with excellent tables/frames support | 2 | # Description: WWW browsable pager with excellent tables/frames support |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include w3m.local | 6 | include w3m.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -20,6 +21,8 @@ include disable-passwdmgr.inc | |||
20 | include disable-programs.inc | 21 | include disable-programs.inc |
21 | include disable-xdg.inc | 22 | include disable-xdg.inc |
22 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
25 | |||
23 | caps.drop all | 26 | caps.drop all |
24 | netfilter | 27 | netfilter |
25 | no3d | 28 | no3d |
diff --git a/etc/profile-m-z/warmux.profile b/etc/profile-m-z/warmux.profile new file mode 100644 index 000000000..aaef652fd --- /dev/null +++ b/etc/profile-m-z/warmux.profile | |||
@@ -0,0 +1,56 @@ | |||
1 | # Firejail profile for warmux | ||
2 | # Description: a convivial mass murder game | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include warmux.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/wormux | ||
10 | noblacklist ${HOME}/.local/share/wormux | ||
11 | noblacklist ${HOME}/.wormux | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.config/wormux | ||
23 | mkdir ${HOME}/.local/share/wormux | ||
24 | mkdir ${HOME}/.wormux | ||
25 | whitelist ${HOME}/.config/wormux | ||
26 | whitelist ${HOME}/.local/share/wormux | ||
27 | whitelist ${HOME}/.wormux | ||
28 | whitelist /usr/share/warmux | ||
29 | include whitelist-common.inc | ||
30 | include whitelist-usr-share-common.inc | ||
31 | include whitelist-var-common.inc | ||
32 | |||
33 | apparmor | ||
34 | caps.drop all | ||
35 | netfilter | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6 | ||
44 | seccomp | ||
45 | shell none | ||
46 | tracelog | ||
47 | |||
48 | disable-mnt | ||
49 | private-bin warmux | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | ||
53 | private-tmp | ||
54 | |||
55 | dbus-user none | ||
56 | dbus-system none | ||
diff --git a/etc/warsow.profile b/etc/profile-m-z/warsow.profile index e884ab07a..d8cd5557e 100644 --- a/etc/warsow.profile +++ b/etc/profile-m-z/warsow.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
22 | mkdir ${HOME}/.cache/warsow-2.1 | 23 | mkdir ${HOME}/.cache/warsow-2.1 |
@@ -29,7 +30,6 @@ include whitelist-var-common.inc | |||
29 | caps.drop all | 30 | caps.drop all |
30 | ipc-namespace | 31 | ipc-namespace |
31 | netfilter | 32 | netfilter |
32 | nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -47,3 +47,6 @@ private-bin warsow | |||
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-tmp | 49 | private-tmp |
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/warzone2100.profile b/etc/profile-m-z/warzone2100.profile index e65e0a0c3..369c9cc1d 100644 --- a/etc/warzone2100.profile +++ b/etc/profile-m-z/warzone2100.profile | |||
@@ -14,14 +14,19 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | 18 | ||
18 | # mkdir ${HOME}/.warzone2100-3.1 | 19 | # mkdir ${HOME}/.warzone2100-3.1 |
19 | # mkdir ${HOME}/.warzone2100-3.2 | 20 | # mkdir ${HOME}/.warzone2100-3.2 |
20 | whitelist ${HOME}/.warzone2100-3.1 | 21 | whitelist ${HOME}/.warzone2100-3.1 |
21 | whitelist ${HOME}/.warzone2100-3.2 | 22 | whitelist ${HOME}/.warzone2100-3.2 |
23 | whitelist /usr/share/games | ||
22 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
24 | 28 | ||
29 | apparmor | ||
25 | caps.drop all | 30 | caps.drop all |
26 | netfilter | 31 | netfilter |
27 | nodvd | 32 | nodvd |
diff --git a/etc/waterfox-classic.profile b/etc/profile-m-z/waterfox-classic.profile index 6c7e18a46..6c7e18a46 100644 --- a/etc/waterfox-classic.profile +++ b/etc/profile-m-z/waterfox-classic.profile | |||
diff --git a/etc/waterfox-current.profile b/etc/profile-m-z/waterfox-current.profile index 5e12a6fe3..5e12a6fe3 100644 --- a/etc/waterfox-current.profile +++ b/etc/profile-m-z/waterfox-current.profile | |||
diff --git a/etc/waterfox.profile b/etc/profile-m-z/waterfox.profile index c6c940fa3..c6c940fa3 100644 --- a/etc/waterfox.profile +++ b/etc/profile-m-z/waterfox.profile | |||
diff --git a/etc/webstorm.profile b/etc/profile-m-z/webstorm.profile index fc4e8e571..fc4e8e571 100644 --- a/etc/webstorm.profile +++ b/etc/profile-m-z/webstorm.profile | |||
diff --git a/etc/webui-aria2.profile b/etc/profile-m-z/webui-aria2.profile index 0cd1e05ab..8928f8116 100644 --- a/etc/webui-aria2.profile +++ b/etc/profile-m-z/webui-aria2.profile | |||
@@ -18,7 +18,6 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | nodbus | ||
22 | nodvd | 21 | nodvd |
23 | nogroups | 22 | nogroups |
24 | nonewprivs | 23 | nonewprivs |
@@ -35,3 +34,5 @@ private-cache | |||
35 | private-dev | 34 | private-dev |
36 | private-tmp | 35 | private-tmp |
37 | 36 | ||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/weechat-curses.profile b/etc/profile-m-z/weechat-curses.profile index 4719b9788..4719b9788 100644 --- a/etc/weechat-curses.profile +++ b/etc/profile-m-z/weechat-curses.profile | |||
diff --git a/etc/weechat.profile b/etc/profile-m-z/weechat.profile index 800724054..800724054 100644 --- a/etc/weechat.profile +++ b/etc/profile-m-z/weechat.profile | |||
diff --git a/etc/wesnoth.profile b/etc/profile-m-z/wesnoth.profile index 934edfce9..934edfce9 100644 --- a/etc/wesnoth.profile +++ b/etc/profile-m-z/wesnoth.profile | |||
diff --git a/etc/wget.profile b/etc/profile-m-z/wget.profile index 401926e2d..cdb8f0b93 100644 --- a/etc/wget.profile +++ b/etc/profile-m-z/wget.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${HOME}/.wgetrc | |||
13 | 13 | ||
14 | blacklist /tmp/.X11-unix | 14 | blacklist /tmp/.X11-unix |
15 | blacklist ${RUNUSER}/wayland-* | 15 | blacklist ${RUNUSER}/wayland-* |
16 | blacklist ${RUNUSER} | ||
16 | 17 | ||
17 | include disable-common.inc | 18 | include disable-common.inc |
18 | include disable-devel.inc | 19 | include disable-devel.inc |
@@ -20,16 +21,17 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 23 | include disable-programs.inc |
24 | include disable-shell.inc | ||
23 | # depending on workflow you can uncomment the below or put 'include disable-xdg.inc' in your wget.local | 25 | # depending on workflow you can uncomment the below or put 'include disable-xdg.inc' in your wget.local |
24 | #include disable-xdg.inc | 26 | #include disable-xdg.inc |
25 | 27 | ||
26 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
28 | 30 | ||
31 | apparmor | ||
29 | caps.drop all | 32 | caps.drop all |
30 | ipc-namespace | 33 | ipc-namespace |
31 | machine-id | 34 | machine-id |
32 | nodbus | ||
33 | netfilter | 35 | netfilter |
34 | no3d | 36 | no3d |
35 | nodvd | 37 | nodvd |
@@ -52,4 +54,7 @@ private-dev | |||
52 | #private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,wgetrc | 54 | #private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl,wgetrc |
53 | #private-tmp | 55 | #private-tmp |
54 | 56 | ||
57 | dbus-user none | ||
58 | dbus-system none | ||
59 | |||
55 | memory-deny-write-execute | 60 | memory-deny-write-execute |
diff --git a/etc/whalebird.profile b/etc/profile-m-z/whalebird.profile index 2e24dd8e0..187c49ed8 100644 --- a/etc/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -7,7 +7,8 @@ include whalebird.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | ignore nodbus | 10 | ignore dbus-user none |
11 | ignore dbus-system none | ||
11 | 12 | ||
12 | noblacklist ${HOME}/.config/Whalebird | 13 | noblacklist ${HOME}/.config/Whalebird |
13 | 14 | ||
diff --git a/etc/whois.profile b/etc/profile-m-z/whois.profile index 0e60e18ab..2af1379e0 100644 --- a/etc/whois.profile +++ b/etc/profile-m-z/whois.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | 10 | blacklist /tmp/.X11-unix |
11 | blacklist ${RUNUSER}/wayland-* | 11 | blacklist ${RUNUSER}/wayland-* |
12 | blacklist ${RUNUSER} | ||
12 | 13 | ||
13 | include disable-common.inc | 14 | include disable-common.inc |
14 | include disable-devel.inc | 15 | include disable-devel.inc |
@@ -21,13 +22,13 @@ include disable-xdg.inc | |||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | hostname whois | 27 | hostname whois |
26 | ipc-namespace | 28 | ipc-namespace |
27 | machine-id | 29 | machine-id |
28 | netfilter | 30 | netfilter |
29 | no3d | 31 | no3d |
30 | nodbus | ||
31 | nodvd | 32 | nodvd |
32 | nogroups | 33 | nogroups |
33 | nonewprivs | 34 | nonewprivs |
@@ -50,4 +51,7 @@ private-etc alternatives,hosts,jwhois.conf,resolv.conf,services,whois.conf | |||
50 | private-lib gconv | 51 | private-lib gconv |
51 | private-tmp | 52 | private-tmp |
52 | 53 | ||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
53 | memory-deny-write-execute | 57 | memory-deny-write-execute |
diff --git a/etc/widelands.profile b/etc/profile-m-z/widelands.profile index c6b5f27da..f18878554 100644 --- a/etc/widelands.profile +++ b/etc/profile-m-z/widelands.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.widelands | 20 | mkdir ${HOME}/.widelands |
@@ -21,10 +22,10 @@ whitelist ${HOME}/.widelands | |||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
25 | apparmor | ||
24 | caps.drop all | 26 | caps.drop all |
25 | ipc-namespace | 27 | ipc-namespace |
26 | netfilter | 28 | netfilter |
27 | nodbus | ||
28 | nodvd | 29 | nodvd |
29 | nogroups | 30 | nogroups |
30 | nonewprivs | 31 | nonewprivs |
@@ -42,3 +43,6 @@ private-bin widelands | |||
42 | private-cache | 43 | private-cache |
43 | private-dev | 44 | private-dev |
44 | private-tmp | 45 | private-tmp |
46 | |||
47 | dbus-user none | ||
48 | dbus-system none | ||
diff --git a/etc/wine.profile b/etc/profile-m-z/wine.profile index 901340052..901340052 100644 --- a/etc/wine.profile +++ b/etc/profile-m-z/wine.profile | |||
diff --git a/etc/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile index 3c783322b..8f6014dc3 100644 --- a/etc/wire-desktop.profile +++ b/etc/profile-m-z/wire-desktop.profile | |||
@@ -9,8 +9,8 @@ include wire-desktop.local | |||
9 | 9 | ||
10 | # Debian/Ubuntu use /opt/Wire. As that is not in PATH by default, run `firejail /opt/Wire/wire-desktop` to start it. | 10 | # Debian/Ubuntu use /opt/Wire. As that is not in PATH by default, run `firejail /opt/Wire/wire-desktop` to start it. |
11 | 11 | ||
12 | ignore caps.drop all | 12 | ignore dbus-user none |
13 | ignore nodbus | 13 | ignore dbus-system none |
14 | 14 | ||
15 | noblacklist ${HOME}/.config/Wire | 15 | noblacklist ${HOME}/.config/Wire |
16 | 16 | ||
@@ -21,12 +21,13 @@ mkdir ${HOME}/.config/Wire | |||
21 | whitelist ${HOME}/.config/Wire | 21 | whitelist ${HOME}/.config/Wire |
22 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | 23 | ||
24 | caps.keep sys_admin,sys_chroot | ||
25 | nou2f | 24 | nou2f |
25 | ignore seccomp | ||
26 | seccomp !chroot | ||
26 | shell none | 27 | shell none |
27 | 28 | ||
28 | disable-mnt | 29 | disable-mnt |
29 | private-bin bash,electron,electron4,env,sh,wire-desktop | 30 | private-bin bash,electron,electron4,electron6,env,sh,wire-desktop |
30 | private-dev | 31 | private-dev |
31 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 32 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl |
32 | private-tmp | 33 | private-tmp |
diff --git a/etc/wireshark-gtk.profile b/etc/profile-m-z/wireshark-gtk.profile index 3e2e1807e..3e2e1807e 100644 --- a/etc/wireshark-gtk.profile +++ b/etc/profile-m-z/wireshark-gtk.profile | |||
diff --git a/etc/wireshark-qt.profile b/etc/profile-m-z/wireshark-qt.profile index 3e2e1807e..3e2e1807e 100644 --- a/etc/wireshark-qt.profile +++ b/etc/profile-m-z/wireshark-qt.profile | |||
diff --git a/etc/wireshark.profile b/etc/profile-m-z/wireshark.profile index d73e2e279..a30cb43d5 100644 --- a/etc/wireshark.profile +++ b/etc/profile-m-z/wireshark.profile | |||
@@ -47,4 +47,3 @@ tracelog | |||
47 | private-dev | 47 | private-dev |
48 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,ssl | 48 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,ssl |
49 | private-tmp | 49 | private-tmp |
50 | |||
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile new file mode 100644 index 000000000..da1210bb8 --- /dev/null +++ b/etc/profile-m-z/wordwarvi.profile | |||
@@ -0,0 +1,52 @@ | |||
1 | # Firejail profile for wordwarvi | ||
2 | # Description: Old school '80's style side scrolling space shoot'em up game. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include wordwarvi.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.wordwarvi | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.wordwarvi | ||
21 | whitelist ${HOME}/.wordwarvi | ||
22 | whitelist /usr/share/wordwarvi | ||
23 | include whitelist-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | net none | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | |||
43 | disable-mnt | ||
44 | private | ||
45 | private-bin wordwarvi | ||
46 | private-cache | ||
47 | private-dev | ||
48 | private-etc alsa,asound.conf,machine-id,pulse | ||
49 | private-tmp | ||
50 | |||
51 | dbus-user none | ||
52 | dbus-system none | ||
diff --git a/etc/wpp.profile b/etc/profile-m-z/wpp.profile index a219397a9..a219397a9 100644 --- a/etc/wpp.profile +++ b/etc/profile-m-z/wpp.profile | |||
diff --git a/etc/wps.profile b/etc/profile-m-z/wps.profile index 47bba2dda..6e4a313e3 100644 --- a/etc/wps.profile +++ b/etc/profile-m-z/wps.profile | |||
@@ -27,7 +27,6 @@ machine-id | |||
27 | #net none | 27 | #net none |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodbus | ||
31 | nodvd | 30 | nodvd |
32 | nogroups | 31 | nogroups |
33 | nonewprivs | 32 | nonewprivs |
@@ -45,3 +44,6 @@ tracelog | |||
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
47 | private-tmp | 46 | private-tmp |
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
diff --git a/etc/wpspdf.profile b/etc/profile-m-z/wpspdf.profile index 82080acbc..82080acbc 100644 --- a/etc/wpspdf.profile +++ b/etc/profile-m-z/wpspdf.profile | |||
diff --git a/etc/x-terminal-emulator.profile b/etc/profile-m-z/x-terminal-emulator.profile index e21b74030..fe0781336 100644 --- a/etc/x-terminal-emulator.profile +++ b/etc/profile-m-z/x-terminal-emulator.profile | |||
@@ -8,8 +8,6 @@ include globals.local | |||
8 | caps.drop all | 8 | caps.drop all |
9 | ipc-namespace | 9 | ipc-namespace |
10 | net none | 10 | net none |
11 | netfilter | ||
12 | nodbus | ||
13 | nogroups | 11 | nogroups |
14 | noroot | 12 | noroot |
15 | nou2f | 13 | nou2f |
@@ -18,4 +16,7 @@ seccomp | |||
18 | 16 | ||
19 | private-dev | 17 | private-dev |
20 | 18 | ||
19 | dbus-user none | ||
20 | dbus-system none | ||
21 | |||
21 | noexec /tmp | 22 | noexec /tmp |
diff --git a/etc/profile-m-z/x2goclient.profile b/etc/profile-m-z/x2goclient.profile new file mode 100644 index 000000000..bc9603835 --- /dev/null +++ b/etc/profile-m-z/x2goclient.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for x2goclient | ||
2 | # Description: Graphical client for X2Go remote desktop system | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include x2goclient.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.ssh | ||
10 | noblacklist ${HOME}/.x2go | ||
11 | noblacklist ${HOME}/.x2goclient | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | |||
20 | apparmor | ||
21 | caps.drop all | ||
22 | ipc-namespace | ||
23 | netfilter | ||
24 | #no3d | ||
25 | nodvd | ||
26 | nogroups | ||
27 | nonewprivs | ||
28 | noroot | ||
29 | notv | ||
30 | nou2f | ||
31 | novideo | ||
32 | protocol unix,inet,inet6 | ||
33 | seccomp | ||
34 | shell none | ||
35 | tracelog | ||
36 | |||
37 | #private-bin nxproxy,x2goclient | ||
38 | private-cache | ||
39 | private-dev | ||
40 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,X11,xdg | ||
41 | #private-lib | ||
42 | private-opt none | ||
43 | private-srv none | ||
44 | private-tmp | ||
45 | |||
46 | dbus-user none | ||
47 | dbus-system none | ||
48 | |||
49 | #memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile new file mode 100644 index 000000000..cdfebfb29 --- /dev/null +++ b/etc/profile-m-z/xbill.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for xbill | ||
2 | # Description: save your computers from Wingdows [TM] virus | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xbill.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | whitelist /usr/share/xbill | ||
19 | whitelist /var/games/xbill/scores | ||
20 | include whitelist-common.inc | ||
21 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | ||
23 | |||
24 | apparmor | ||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private | ||
44 | private-bin xbill | ||
45 | private-cache | ||
46 | private-dev | ||
47 | private-etc none | ||
48 | private-tmp | ||
49 | |||
50 | dbus-user none | ||
51 | dbus-system none | ||
52 | |||
53 | memory-deny-write-execute | ||
54 | read-only ${HOME} | ||
diff --git a/etc/xcalc.profile b/etc/profile-m-z/xcalc.profile index 0ad423d30..56ce01498 100644 --- a/etc/xcalc.profile +++ b/etc/profile-m-z/xcalc.profile | |||
@@ -11,15 +11,15 @@ include disable-exec.inc | |||
11 | include disable-interpreters.inc | 11 | include disable-interpreters.inc |
12 | include disable-passwdmgr.inc | 12 | include disable-passwdmgr.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
14 | include disable-shell.inc | ||
14 | include disable-xdg.inc | 15 | include disable-xdg.inc |
15 | 16 | ||
16 | include whitelist-var-common.inc | 17 | include whitelist-var-common.inc |
17 | 18 | ||
19 | apparmor | ||
18 | caps.drop all | 20 | caps.drop all |
19 | net none | 21 | net none |
20 | netfilter | ||
21 | no3d | 22 | no3d |
22 | nodbus | ||
23 | nodvd | 23 | nodvd |
24 | nogroups | 24 | nogroups |
25 | nonewprivs | 25 | nonewprivs |
@@ -39,3 +39,5 @@ private-dev | |||
39 | private-lib | 39 | private-lib |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
diff --git a/etc/xchat.profile b/etc/profile-m-z/xchat.profile index a94444aab..a94444aab 100644 --- a/etc/xchat.profile +++ b/etc/profile-m-z/xchat.profile | |||
diff --git a/etc/xed.profile b/etc/profile-m-z/xed.profile index a67230e51..b114f9ab5 100644 --- a/etc/xed.profile +++ b/etc/profile-m-z/xed.profile | |||
@@ -11,8 +11,8 @@ noblacklist ${HOME}/.python_history | |||
11 | noblacklist ${HOME}/.pythonhist | 11 | noblacklist ${HOME}/.pythonhist |
12 | 12 | ||
13 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | # Allow python (blacklisted by disable-interpreters.inc) |
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 21 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-shell.inc | ||
23 | 24 | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
@@ -28,7 +29,6 @@ caps.drop all | |||
28 | machine-id | 29 | machine-id |
29 | # net none - makes settings immutable | 30 | # net none - makes settings immutable |
30 | no3d | 31 | no3d |
31 | # nodbus - makes settings immutable | ||
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | nonewprivs | 34 | nonewprivs |
@@ -46,5 +46,9 @@ private-bin xed | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | # makes settings immutable | ||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
52 | |||
49 | # xed uses python plugins, memory-deny-write-execute breaks python | 53 | # xed uses python plugins, memory-deny-write-execute breaks python |
50 | # memory-deny-write-execute | 54 | # memory-deny-write-execute |
diff --git a/etc/xfburn.profile b/etc/profile-m-z/xfburn.profile index cd9561e74..cd9561e74 100644 --- a/etc/xfburn.profile +++ b/etc/profile-m-z/xfburn.profile | |||
diff --git a/etc/xfce4-dict.profile b/etc/profile-m-z/xfce4-dict.profile index bc499bd30..a3e0c4633 100644 --- a/etc/xfce4-dict.profile +++ b/etc/profile-m-z/xfce4-dict.profile | |||
@@ -15,6 +15,9 @@ include disable-interpreters.inc | |||
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | include whitelist-var-common.inc | ||
19 | |||
20 | apparmor | ||
18 | caps.drop all | 21 | caps.drop all |
19 | netfilter | 22 | netfilter |
20 | no3d | 23 | no3d |
diff --git a/etc/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index 6ef85f318..6ff4a1103 100644 --- a/etc/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml | 20 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml |
@@ -29,7 +30,6 @@ caps.drop all | |||
29 | ipc-namespace | 30 | ipc-namespace |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | # nodbus | ||
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | nonewprivs | 35 | nonewprivs |
@@ -48,4 +48,7 @@ private-dev | |||
48 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 48 | private-etc alternatives,asound.conf,fonts,machine-id,pulse |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # dbus-user none | ||
52 | # dbus-system none | ||
53 | |||
51 | memory-deny-write-execute | 54 | memory-deny-write-execute |
diff --git a/etc/xfce4-notes.profile b/etc/profile-m-z/xfce4-notes.profile index 4dad1bf7a..c3d0930ff 100644 --- a/etc/xfce4-notes.profile +++ b/etc/profile-m-z/xfce4-notes.profile | |||
@@ -17,6 +17,9 @@ include disable-interpreters.inc | |||
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | 19 | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
20 | caps.drop all | 23 | caps.drop all |
21 | netfilter | 24 | netfilter |
22 | no3d | 25 | no3d |
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile new file mode 100644 index 000000000..b760b44dd --- /dev/null +++ b/etc/profile-m-z/xfce4-screenshooter.profile | |||
@@ -0,0 +1,51 @@ | |||
1 | # Firejail profile for xfce4-screenshooter | ||
2 | # Description: Xfce screenshot tool | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xfce4-screenshooter.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PICTURES} | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | whitelist /usr/share/xfce4 | ||
21 | include whitelist-runuser-common.inc | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | machine-id | ||
28 | netfilter | ||
29 | no3d | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix,inet,inet6 | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin xfce4-screenshooter,xfconf-query | ||
44 | private-dev | ||
45 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,pki,resolv.conf,ssl | ||
46 | private-tmp | ||
47 | |||
48 | dbus-user none | ||
49 | dbus-system none | ||
50 | |||
51 | memory-deny-write-execute | ||
diff --git a/etc/xiphos.profile b/etc/profile-m-z/xiphos.profile index 7114f0469..188589df3 100644 --- a/etc/xiphos.profile +++ b/etc/profile-m-z/xiphos.profile | |||
@@ -17,6 +17,7 @@ include disable-exec.inc | |||
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-shell.inc | ||
20 | 21 | ||
21 | mkdir ${HOME}/.sword | 22 | mkdir ${HOME}/.sword |
22 | mkdir ${HOME}/.xiphos | 23 | mkdir ${HOME}/.xiphos |
diff --git a/etc/xlinks.profile b/etc/profile-m-z/xlinks.profile index 7987af280..7987af280 100644 --- a/etc/xlinks.profile +++ b/etc/profile-m-z/xlinks.profile | |||
diff --git a/etc/xmms.profile b/etc/profile-m-z/xmms.profile index 7a11e1244..9391f68de 100644 --- a/etc/xmms.profile +++ b/etc/profile-m-z/xmms.profile | |||
@@ -13,6 +13,7 @@ include disable-devel.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index c6ba9bd9d..3278e295d 100644 --- a/etc/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -13,6 +13,7 @@ include disable-exec.inc | |||
13 | include disable-interpreters.inc | 13 | include disable-interpreters.inc |
14 | include disable-passwdmgr.inc | 14 | include disable-passwdmgr.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | include disable-shell.inc | ||
16 | include disable-xdg.inc | 17 | include disable-xdg.inc |
17 | 18 | ||
18 | mkdir ${HOME}/.xmr-stak | 19 | mkdir ${HOME}/.xmr-stak |
diff --git a/etc/xonotic-glx.profile b/etc/profile-m-z/xonotic-glx.profile index abb91e1ec..abb91e1ec 100644 --- a/etc/xonotic-glx.profile +++ b/etc/profile-m-z/xonotic-glx.profile | |||
diff --git a/etc/profile-m-z/xonotic-sdl-wrapper.profile b/etc/profile-m-z/xonotic-sdl-wrapper.profile new file mode 100644 index 000000000..6f0c7cf4c --- /dev/null +++ b/etc/profile-m-z/xonotic-sdl-wrapper.profile | |||
@@ -0,0 +1,6 @@ | |||
1 | # Firejail profile alias for xonotic | ||
2 | # This file is overwritten after every install/update | ||
3 | include xonotic-sdl-wrapper.local | ||
4 | |||
5 | # Redirect | ||
6 | include xonotic.profile | ||
diff --git a/etc/xonotic-sdl.profile b/etc/profile-m-z/xonotic-sdl.profile index abb91e1ec..abb91e1ec 100644 --- a/etc/xonotic-sdl.profile +++ b/etc/profile-m-z/xonotic-sdl.profile | |||
diff --git a/etc/xonotic.profile b/etc/profile-m-z/xonotic.profile index f4f828eda..aa8cc7d0e 100644 --- a/etc/xonotic.profile +++ b/etc/profile-m-z/xonotic.profile | |||
@@ -14,15 +14,19 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
17 | 18 | ||
18 | mkdir ${HOME}/.xonotic | 19 | mkdir ${HOME}/.xonotic |
19 | whitelist ${HOME}/.xonotic | 20 | whitelist ${HOME}/.xonotic |
21 | whitelist /usr/share/xonotic | ||
20 | include whitelist-common.inc | 22 | include whitelist-common.inc |
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
22 | 26 | ||
27 | apparmor | ||
23 | caps.drop all | 28 | caps.drop all |
24 | netfilter | 29 | netfilter |
25 | nodbus | ||
26 | nodvd | 30 | nodvd |
27 | nogroups | 31 | nogroups |
28 | nonewprivs | 32 | nonewprivs |
@@ -33,10 +37,17 @@ novideo | |||
33 | protocol unix,inet,inet6 | 37 | protocol unix,inet,inet6 |
34 | seccomp | 38 | seccomp |
35 | shell none | 39 | shell none |
40 | tracelog | ||
36 | 41 | ||
37 | disable-mnt | 42 | disable-mnt |
38 | private-bin bash,blind-id,darkplaces-glx,darkplaces-sdl,dirname,grep,ldd,netstat,ps,readlink,sh,uname,xonotic,xonotic-glx,xonotic-linux32-dedicated,xonotic-linux32-glx,xonotic-linux32-sdl,xonotic-linux64-dedicated,xonotic-linux64-glx,xonotic-linux64-sdl,xonotic-sdl | 43 | private-cache |
44 | private-bin basename,bash,blind-id,cut,darkplaces-glx,darkplaces-sdl,dirname,glxinfo,grep,head,ldd,netstat,ps,readlink,sed,sh,uname,xonotic,xonotic-glx,xonotic-linux32-dedicated,xonotic-linux32-glx,xonotic-linux32-sdl,xonotic-linux64-dedicated,xonotic-linux64-glx,xonotic-linux64-sdl,xonotic-sdl,xonotic-sdl-wrapper,zenity | ||
39 | private-dev | 45 | private-dev |
40 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl |
41 | private-tmp | 47 | private-tmp |
42 | 48 | ||
49 | dbus-user none | ||
50 | dbus-system none | ||
51 | |||
52 | read-only ${HOME} | ||
53 | read-write ${HOME}/.xonotic | ||
diff --git a/etc/profile-m-z/xournal.profile b/etc/profile-m-z/xournal.profile new file mode 100644 index 000000000..b842b5307 --- /dev/null +++ b/etc/profile-m-z/xournal.profile | |||
@@ -0,0 +1,50 @@ | |||
1 | # Firejail profile for xournal | ||
2 | # Description: Note taking and PDF editing | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include xournal.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${DOCUMENTS} | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | whitelist /usr/share/xournal | ||
21 | whitelist /usr/share/poppler | ||
22 | include whitelist-usr-share-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | caps.drop all | ||
26 | machine-id | ||
27 | net none | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | shell none | ||
40 | tracelog | ||
41 | |||
42 | private-bin xournal | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc alternatives,fonts,group,machine-id,passwd | ||
46 | # TODO should use private-lib | ||
47 | private-tmp | ||
48 | |||
49 | dbus-user none | ||
50 | dbus-system none | ||
diff --git a/etc/xpdf.profile b/etc/profile-m-z/xpdf.profile index 8c405ba1d..cdffe4eb7 100644 --- a/etc/xpdf.profile +++ b/etc/profile-m-z/xpdf.profile | |||
@@ -19,11 +19,11 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | apparmor | ||
22 | caps.drop all | 23 | caps.drop all |
23 | machine-id | 24 | machine-id |
24 | net none | 25 | net none |
25 | no3d | 26 | no3d |
26 | nodbus | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -39,3 +39,7 @@ shell none | |||
39 | private-dev | 39 | private-dev |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | dbus-user none | ||
43 | dbus-system none | ||
44 | |||
45 | memory-deny-write-execute | ||
diff --git a/etc/xplayer-audio-preview.profile b/etc/profile-m-z/xplayer-audio-preview.profile index 0559b8183..0559b8183 100644 --- a/etc/xplayer-audio-preview.profile +++ b/etc/profile-m-z/xplayer-audio-preview.profile | |||
diff --git a/etc/xplayer-video-thumbnailer.profile b/etc/profile-m-z/xplayer-video-thumbnailer.profile index 6b2878476..6b2878476 100644 --- a/etc/xplayer-video-thumbnailer.profile +++ b/etc/profile-m-z/xplayer-video-thumbnailer.profile | |||
diff --git a/etc/xplayer.profile b/etc/profile-m-z/xplayer.profile index 325ce7627..28df73ea5 100644 --- a/etc/xplayer.profile +++ b/etc/profile-m-z/xplayer.profile | |||
@@ -11,8 +11,8 @@ noblacklist ${MUSIC} | |||
11 | noblacklist ${VIDEOS} | 11 | noblacklist ${VIDEOS} |
12 | 12 | ||
13 | # Allow python (blacklisted by disable-interpreters.inc) | 13 | # Allow python (blacklisted by disable-interpreters.inc) |
14 | include allow-python2.inc | 14 | include allow-python2.inc |
15 | include allow-python3.inc | 15 | include allow-python3.inc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
@@ -27,7 +27,6 @@ include whitelist-var-common.inc | |||
27 | # apparmor - makes settings immutable | 27 | # apparmor - makes settings immutable |
28 | caps.drop all | 28 | caps.drop all |
29 | netfilter | 29 | netfilter |
30 | # nodbus - makes settings immutable | ||
31 | nogroups | 30 | nogroups |
32 | nonewprivs | 31 | nonewprivs |
33 | noroot | 32 | noroot |
@@ -42,3 +41,6 @@ private-dev | |||
42 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl | 41 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl |
43 | private-tmp | 42 | private-tmp |
44 | 43 | ||
44 | # makes settings immutable | ||
45 | # dbus-user none | ||
46 | # dbus-system none | ||
diff --git a/etc/xpra.profile b/etc/profile-m-z/xpra.profile index 1033a7471..1033a7471 100644 --- a/etc/xpra.profile +++ b/etc/profile-m-z/xpra.profile | |||
diff --git a/etc/xreader-previewer.profile b/etc/profile-m-z/xreader-previewer.profile index 6e1dcb5d2..6e1dcb5d2 100644 --- a/etc/xreader-previewer.profile +++ b/etc/profile-m-z/xreader-previewer.profile | |||
diff --git a/etc/xreader-thumbnailer.profile b/etc/profile-m-z/xreader-thumbnailer.profile index a6925fcde..a6925fcde 100644 --- a/etc/xreader-thumbnailer.profile +++ b/etc/profile-m-z/xreader-thumbnailer.profile | |||
diff --git a/etc/xreader.profile b/etc/profile-m-z/xreader.profile index 643c5a317..643c5a317 100644 --- a/etc/xreader.profile +++ b/etc/profile-m-z/xreader.profile | |||
diff --git a/etc/xviewer.profile b/etc/profile-m-z/xviewer.profile index b09bf8ab1..0ac0f665e 100644 --- a/etc/xviewer.profile +++ b/etc/profile-m-z/xviewer.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | 20 | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
@@ -23,7 +24,6 @@ include whitelist-var-common.inc | |||
23 | caps.drop all | 24 | caps.drop all |
24 | # net none - makes settings immutable | 25 | # net none - makes settings immutable |
25 | no3d | 26 | no3d |
26 | # nodbus - makes settings immutable | ||
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | nonewprivs | 29 | nonewprivs |
@@ -42,4 +42,8 @@ private-dev | |||
42 | private-lib | 42 | private-lib |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # makes settings immutable | ||
46 | # dbus-user none | ||
47 | # dbus-system none | ||
48 | |||
45 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/xxd.profile b/etc/profile-m-z/xxd.profile index 569f194d3..864e8ce9c 100644 --- a/etc/xxd.profile +++ b/etc/profile-m-z/xxd.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for xxd | 1 | # Firejail profile for xxd |
2 | # Description: Tool to make (or reverse) a hex dump | 2 | # Description: Tool to make (or reverse) a hex dump |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include xxd.local | 6 | include xxd.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -8,4 +9,4 @@ include xxd.local | |||
8 | #include globals.local | 9 | #include globals.local |
9 | 10 | ||
10 | # Redirect | 11 | # Redirect |
11 | include vim.profile | 12 | include cpio.profile |
diff --git a/etc/xz.profile b/etc/profile-m-z/xz.profile index f7410b928..d9c72407f 100644 --- a/etc/xz.profile +++ b/etc/profile-m-z/xz.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzcat.profile b/etc/profile-m-z/xzcat.profile index f7410b928..d9c72407f 100644 --- a/etc/xzcat.profile +++ b/etc/profile-m-z/xzcat.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzcmp.profile b/etc/profile-m-z/xzcmp.profile index f7410b928..d9c72407f 100644 --- a/etc/xzcmp.profile +++ b/etc/profile-m-z/xzcmp.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzdec.profile b/etc/profile-m-z/xzdec.profile index ca6aaf1d5..542363b57 100644 --- a/etc/xzdec.profile +++ b/etc/profile-m-z/xzdec.profile | |||
@@ -21,7 +21,6 @@ ipc-namespace | |||
21 | machine-id | 21 | machine-id |
22 | net none | 22 | net none |
23 | no3d | 23 | no3d |
24 | nodbus | ||
25 | nodvd | 24 | nodvd |
26 | #nogroups | 25 | #nogroups |
27 | nonewprivs | 26 | nonewprivs |
@@ -37,3 +36,6 @@ tracelog | |||
37 | x11 none | 36 | x11 none |
38 | 37 | ||
39 | private-dev | 38 | private-dev |
39 | |||
40 | dbus-user none | ||
41 | dbus-system none | ||
diff --git a/etc/xzdiff.profile b/etc/profile-m-z/xzdiff.profile index f7410b928..d9c72407f 100644 --- a/etc/xzdiff.profile +++ b/etc/profile-m-z/xzdiff.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzegrep.profile b/etc/profile-m-z/xzegrep.profile index f7410b928..d9c72407f 100644 --- a/etc/xzegrep.profile +++ b/etc/profile-m-z/xzegrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzfgrep.profile b/etc/profile-m-z/xzfgrep.profile index f7410b928..d9c72407f 100644 --- a/etc/xzfgrep.profile +++ b/etc/profile-m-z/xzfgrep.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/xzgrep.profile b/etc/profile-m-z/xzgrep.profile index f7410b928..f7410b928 100644 --- a/etc/xzgrep.profile +++ b/etc/profile-m-z/xzgrep.profile | |||
diff --git a/etc/xzless.profile b/etc/profile-m-z/xzless.profile index f7410b928..f7410b928 100644 --- a/etc/xzless.profile +++ b/etc/profile-m-z/xzless.profile | |||
diff --git a/etc/xzmore.profile b/etc/profile-m-z/xzmore.profile index f7410b928..d9c72407f 100644 --- a/etc/xzmore.profile +++ b/etc/profile-m-z/xzmore.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile alias for cpio | 1 | # Firejail profile alias for cpio |
2 | # Description: Library and command line tools for XZ and LZMA compressed files | 2 | # Description: Library and command line tools for XZ and LZMA compressed files |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | 5 | ||
5 | # Redirect | 6 | # Redirect |
6 | include cpio.profile | 7 | include cpio.profile |
diff --git a/etc/yandex-browser.profile b/etc/profile-m-z/yandex-browser.profile index 680bef677..680bef677 100644 --- a/etc/yandex-browser.profile +++ b/etc/profile-m-z/yandex-browser.profile | |||
diff --git a/etc/yelp.profile b/etc/profile-m-z/yelp.profile index acd483209..fd95ceb04 100644 --- a/etc/yelp.profile +++ b/etc/profile-m-z/yelp.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.config/yelp | 20 | mkdir ${HOME}/.config/yelp |
@@ -21,8 +22,10 @@ whitelist ${HOME}/.config/yelp | |||
21 | whitelist /usr/share/doc | 22 | whitelist /usr/share/doc |
22 | whitelist /usr/share/help | 23 | whitelist /usr/share/help |
23 | whitelist /usr/share/yelp | 24 | whitelist /usr/share/yelp |
25 | whitelist /usr/share/yelp-tools | ||
24 | whitelist /usr/share/yelp-xsl | 26 | whitelist /usr/share/yelp-xsl |
25 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
27 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
28 | 31 | ||
@@ -48,6 +51,8 @@ private-dev | |||
48 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,gtk-3.0,machine-id,openal,os-release,pulse,sgml,xml | 51 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,gtk-3.0,machine-id,openal,os-release,pulse,sgml,xml |
49 | private-tmp | 52 | private-tmp |
50 | 53 | ||
54 | dbus-system none | ||
55 | |||
51 | # read-only ${HOME} breaks some not necesarry featrues, comment it if | 56 | # read-only ${HOME} breaks some not necesarry featrues, comment it if |
52 | # you need them or put 'ignore read-only ${HOME}' into your yelp.local. | 57 | # you need them or put 'ignore read-only ${HOME}' into your yelp.local. |
53 | # broken features: | 58 | # broken features: |
diff --git a/etc/youtube-dl.profile b/etc/profile-m-z/youtube-dl.profile index 19effef47..db3535f78 100644 --- a/etc/youtube-dl.profile +++ b/etc/profile-m-z/youtube-dl.profile | |||
@@ -22,6 +22,7 @@ include allow-python3.inc | |||
22 | 22 | ||
23 | blacklist /tmp/.X11-unix | 23 | blacklist /tmp/.X11-unix |
24 | blacklist ${RUNUSER}/wayland-* | 24 | blacklist ${RUNUSER}/wayland-* |
25 | blacklist ${RUNUSER} | ||
25 | 26 | ||
26 | include disable-common.inc | 27 | include disable-common.inc |
27 | include disable-devel.inc | 28 | include disable-devel.inc |
@@ -29,6 +30,7 @@ include disable-exec.inc | |||
29 | include disable-interpreters.inc | 30 | include disable-interpreters.inc |
30 | include disable-passwdmgr.inc | 31 | include disable-passwdmgr.inc |
31 | include disable-programs.inc | 32 | include disable-programs.inc |
33 | include disable-shell.inc | ||
32 | include disable-xdg.inc | 34 | include disable-xdg.inc |
33 | 35 | ||
34 | include whitelist-usr-share-common.inc | 36 | include whitelist-usr-share-common.inc |
@@ -40,7 +42,6 @@ ipc-namespace | |||
40 | machine-id | 42 | machine-id |
41 | netfilter | 43 | netfilter |
42 | no3d | 44 | no3d |
43 | nodbus | ||
44 | nodvd | 45 | nodvd |
45 | nogroups | 46 | nogroups |
46 | nonewprivs | 47 | nonewprivs |
@@ -60,4 +61,7 @@ private-dev | |||
60 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf | 61 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf |
61 | private-tmp | 62 | private-tmp |
62 | 63 | ||
64 | dbus-user none | ||
65 | dbus-system none | ||
66 | |||
63 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 67 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-m-z/youtube-viewer.profile b/etc/profile-m-z/youtube-viewer.profile new file mode 100644 index 000000000..513cb0f6e --- /dev/null +++ b/etc/profile-m-z/youtube-viewer.profile | |||
@@ -0,0 +1,57 @@ | |||
1 | # Firejail profile for youtube-viewer | ||
2 | # Description: Trizen's CLI Youtube viewer with login support | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include youtube-viewer.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
14 | noblacklist ${HOME}/.config/youtube-viewer | ||
15 | |||
16 | include allow-perl.inc | ||
17 | include allow-python2.inc | ||
18 | include allow-python3.inc | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-exec.inc | ||
23 | include disable-interpreters.inc | ||
24 | include disable-passwdmgr.inc | ||
25 | include disable-programs.inc | ||
26 | include disable-xdg.inc | ||
27 | |||
28 | mkdir ${HOME}/.config/youtube-viewer | ||
29 | whitelist ${HOME}/.config/youtube-viewer | ||
30 | include whitelist-common.inc | ||
31 | include whitelist-usr-share-common.inc | ||
32 | include whitelist-var-common.inc | ||
33 | |||
34 | apparmor | ||
35 | caps.drop all | ||
36 | netfilter | ||
37 | nodvd | ||
38 | nogroups | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix,inet,inet6 | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | # private-bin ffmpeg,ffprobe,firefox,gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,mpv,python*,smplayer,sh,which,vlc,youtube-dl,youtube-viewer | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none \ No newline at end of file | ||
diff --git a/etc/zaproxy.profile b/etc/profile-m-z/zaproxy.profile index 6228ff3bd..6228ff3bd 100644 --- a/etc/zaproxy.profile +++ b/etc/profile-m-z/zaproxy.profile | |||
diff --git a/etc/zart.profile b/etc/profile-m-z/zart.profile index 347bed8b6..ca35e3b51 100644 --- a/etc/zart.profile +++ b/etc/profile-m-z/zart.profile | |||
@@ -15,12 +15,12 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-shell.inc | ||
18 | include disable-xdg.inc | 19 | include disable-xdg.inc |
19 | 20 | ||
20 | caps.drop all | 21 | caps.drop all |
21 | ipc-namespace | 22 | ipc-namespace |
22 | net none | 23 | net none |
23 | nodbus | ||
24 | nodvd | 24 | nodvd |
25 | nogroups | 25 | nogroups |
26 | nonewprivs | 26 | nonewprivs |
@@ -34,3 +34,5 @@ shell none | |||
34 | private-bin ffmpeg,ffplay,ffprobe,melt,zart | 34 | private-bin ffmpeg,ffplay,ffprobe,melt,zart |
35 | private-dev | 35 | private-dev |
36 | 36 | ||
37 | dbus-user none | ||
38 | dbus-system none | ||
diff --git a/etc/zathura.profile b/etc/profile-m-z/zathura.profile index 703c8edd4..5274e5b42 100644 --- a/etc/zathura.profile +++ b/etc/profile-m-z/zathura.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/zathura | 22 | mkdir ${HOME}/.config/zathura |
@@ -25,11 +26,11 @@ whitelist /usr/share/zathura | |||
25 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
27 | 28 | ||
29 | apparmor | ||
28 | caps.drop all | 30 | caps.drop all |
29 | ipc-namespace | 31 | ipc-namespace |
30 | machine-id | 32 | machine-id |
31 | net none | 33 | net none |
32 | nodbus | ||
33 | nodvd | 34 | nodvd |
34 | nogroups | 35 | nogroups |
35 | nonewprivs | 36 | nonewprivs |
@@ -47,9 +48,13 @@ private-bin zathura | |||
47 | private-cache | 48 | private-cache |
48 | private-dev | 49 | private-dev |
49 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id | 50 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id |
50 | private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura | 51 | # private-lib has problems on Debian 10 |
52 | #private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,libarchive.so.*,libdjvulibre.so.*,libgirara-gtk*,libpoppler-glib.so.*,libspectre.so.*,zathura | ||
51 | private-tmp | 53 | private-tmp |
52 | 54 | ||
55 | dbus-user none | ||
56 | dbus-system none | ||
57 | |||
53 | read-only ${HOME} | 58 | read-only ${HOME} |
54 | read-write ${HOME}/.config/zathura | 59 | read-write ${HOME}/.config/zathura |
55 | read-write ${HOME}/.local/share/zathura | 60 | read-write ${HOME}/.local/share/zathura |
diff --git a/etc/zcat.profile b/etc/profile-m-z/zcat.profile index 12932ea92..bbac50712 100644 --- a/etc/zcat.profile +++ b/etc/profile-m-z/zcat.profile | |||
@@ -7,5 +7,8 @@ include zcat.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # Allow running kernel config check | ||
11 | noblacklist /proc/config.gz | ||
12 | |||
10 | # Redirect | 13 | # Redirect |
11 | include gzip.profile | 14 | include gzip.profile |
diff --git a/etc/zcmp.profile b/etc/profile-m-z/zcmp.profile index 795cdae2a..795cdae2a 100644 --- a/etc/zcmp.profile +++ b/etc/profile-m-z/zcmp.profile | |||
diff --git a/etc/zdiff.profile b/etc/profile-m-z/zdiff.profile index 1e75e38fe..1e75e38fe 100644 --- a/etc/zdiff.profile +++ b/etc/profile-m-z/zdiff.profile | |||
diff --git a/etc/zeal.profile b/etc/profile-m-z/zeal.profile index f0fa29aa3..2d0d944fd 100644 --- a/etc/zeal.profile +++ b/etc/profile-m-z/zeal.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for zeal | 1 | # Firejail profile for zeal |
2 | # Description: Offline documentation browser | 2 | # Description: Offline API documentation browser |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include zeal.local | 5 | include zeal.local |
@@ -16,13 +16,15 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/Zeal | ||
22 | mkdir ${HOME}/.cache/Zeal | 22 | mkdir ${HOME}/.cache/Zeal |
23 | mkdir ${HOME}/.config/qt5ct | ||
24 | mkdir ${HOME}/.config/Zeal | ||
23 | mkdir ${HOME}/.local/share/Zeal | 25 | mkdir ${HOME}/.local/share/Zeal |
24 | whitelist ${HOME}/.config/Zeal | ||
25 | whitelist ${HOME}/.cache/Zeal | 26 | whitelist ${HOME}/.cache/Zeal |
27 | whitelist ${HOME}/.config/Zeal | ||
26 | whitelist ${HOME}/.local/share/Zeal | 28 | whitelist ${HOME}/.local/share/Zeal |
27 | include whitelist-common.inc | 29 | include whitelist-common.inc |
28 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
@@ -32,7 +34,6 @@ caps.drop all | |||
32 | machine-id | 34 | machine-id |
33 | netfilter | 35 | netfilter |
34 | no3d | 36 | no3d |
35 | nodbus | ||
36 | nodvd | 37 | nodvd |
37 | nogroups | 38 | nogroups |
38 | nonewprivs | 39 | nonewprivs |
@@ -41,7 +42,7 @@ nosound | |||
41 | notv | 42 | notv |
42 | nou2f | 43 | nou2f |
43 | novideo | 44 | novideo |
44 | protocol unix,inet,inet6 | 45 | protocol unix,inet,inet6,netlink |
45 | seccomp | 46 | seccomp |
46 | shell none | 47 | shell none |
47 | tracelog | 48 | tracelog |
@@ -53,4 +54,7 @@ private-dev | |||
53 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg | 54 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,mime.types,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg |
54 | private-tmp | 55 | private-tmp |
55 | 56 | ||
56 | memory-deny-write-execute | 57 | dbus-user none |
58 | dbus-system none | ||
59 | |||
60 | # memory-deny-write-execute - breaks on Arch | ||
diff --git a/etc/zegrep.profile b/etc/profile-m-z/zegrep.profile index 54dc6b2a0..54dc6b2a0 100644 --- a/etc/zegrep.profile +++ b/etc/profile-m-z/zegrep.profile | |||
diff --git a/etc/zfgrep.profile b/etc/profile-m-z/zfgrep.profile index 73b22f2e8..73b22f2e8 100644 --- a/etc/zfgrep.profile +++ b/etc/profile-m-z/zfgrep.profile | |||
diff --git a/etc/zforce.profile b/etc/profile-m-z/zforce.profile index d62e57065..d62e57065 100644 --- a/etc/zforce.profile +++ b/etc/profile-m-z/zforce.profile | |||
diff --git a/etc/zgrep.profile b/etc/profile-m-z/zgrep.profile index b39a58420..0e7151400 100644 --- a/etc/zgrep.profile +++ b/etc/profile-m-z/zgrep.profile | |||
@@ -7,5 +7,8 @@ include zgrep.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # Allow running kernel config check | ||
11 | noblacklist /proc/config.gz | ||
12 | |||
10 | # Redirect | 13 | # Redirect |
11 | include gzip.profile | 14 | include gzip.profile |
diff --git a/etc/zless.profile b/etc/profile-m-z/zless.profile index 0a26cda1f..0a26cda1f 100644 --- a/etc/zless.profile +++ b/etc/profile-m-z/zless.profile | |||
diff --git a/etc/zmore.profile b/etc/profile-m-z/zmore.profile index 3a8f63562..3a8f63562 100644 --- a/etc/zmore.profile +++ b/etc/profile-m-z/zmore.profile | |||
diff --git a/etc/znew.profile b/etc/profile-m-z/znew.profile index a8593e58e..a8593e58e 100644 --- a/etc/znew.profile +++ b/etc/profile-m-z/znew.profile | |||
diff --git a/etc/zoom.profile b/etc/profile-m-z/zoom.profile index 6d312aff6..b3125ee50 100644 --- a/etc/zoom.profile +++ b/etc/profile-m-z/zoom.profile | |||
@@ -10,8 +10,11 @@ noblacklist ${HOME}/.zoom | |||
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | ||
14 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-xdg.inc | ||
15 | 18 | ||
16 | mkdir ${HOME}/.cache/zoom | 19 | mkdir ${HOME}/.cache/zoom |
17 | mkfile ${HOME}/.config/zoomus.conf | 20 | mkfile ${HOME}/.config/zoomus.conf |
@@ -20,14 +23,25 @@ whitelist ${HOME}/.cache/zoom | |||
20 | whitelist ${HOME}/.config/zoomus.conf | 23 | whitelist ${HOME}/.config/zoomus.conf |
21 | whitelist ${HOME}/.zoom | 24 | whitelist ${HOME}/.zoom |
22 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
23 | 29 | ||
24 | caps.drop all | 30 | caps.drop all |
25 | netfilter | 31 | netfilter |
26 | nodvd | 32 | nodvd |
33 | nogroups | ||
27 | nonewprivs | 34 | nonewprivs |
28 | noroot | 35 | noroot |
29 | notv | 36 | notv |
30 | protocol unix,inet,inet6 | 37 | nou2f |
31 | seccomp | 38 | protocol unix,inet,inet6,netlink |
39 | seccomp !chroot | ||
40 | shell none | ||
41 | tracelog | ||
32 | 42 | ||
43 | disable-mnt | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
33 | private-tmp | 47 | private-tmp |
diff --git a/etc/zpaq.profile b/etc/profile-m-z/zpaq.profile index 80329ecfd..80329ecfd 100644 --- a/etc/zpaq.profile +++ b/etc/profile-m-z/zpaq.profile | |||
diff --git a/etc/zstd.profile b/etc/profile-m-z/zstd.profile index 93b849568..be27c10e1 100644 --- a/etc/zstd.profile +++ b/etc/profile-m-z/zstd.profile | |||
@@ -23,7 +23,6 @@ ipc-namespace | |||
23 | machine-id | 23 | machine-id |
24 | net none | 24 | net none |
25 | no3d | 25 | no3d |
26 | nodbus | ||
27 | nodvd | 26 | nodvd |
28 | nogroups | 27 | nogroups |
29 | nonewprivs | 28 | nonewprivs |
diff --git a/etc/zstdcat.profile b/etc/profile-m-z/zstdcat.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdcat.profile +++ b/etc/profile-m-z/zstdcat.profile | |||
diff --git a/etc/zstdgrep.profile b/etc/profile-m-z/zstdgrep.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdgrep.profile +++ b/etc/profile-m-z/zstdgrep.profile | |||
diff --git a/etc/zstdless.profile b/etc/profile-m-z/zstdless.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdless.profile +++ b/etc/profile-m-z/zstdless.profile | |||
diff --git a/etc/zstdmt.profile b/etc/profile-m-z/zstdmt.profile index ce9af3286..ce9af3286 100644 --- a/etc/zstdmt.profile +++ b/etc/profile-m-z/zstdmt.profile | |||
diff --git a/etc/zulip.profile b/etc/profile-m-z/zulip.profile index 999c2f77a..993f2a64b 100644 --- a/etc/zulip.profile +++ b/etc/profile-m-z/zulip.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
19 | include disable-xdg.inc | 20 | include disable-xdg.inc |
20 | 21 | ||
21 | mkdir ${HOME}/.config/Zulip | 22 | mkdir ${HOME}/.config/Zulip |
diff --git a/etc/ranger.profile b/etc/ranger.profile deleted file mode 100644 index bcf39095b..000000000 --- a/etc/ranger.profile +++ /dev/null | |||
@@ -1,42 +0,0 @@ | |||
1 | # Firejail profile for ranger | ||
2 | # Description: File manager with an ncurses frontend written in Python | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include ranger.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/nano | ||
10 | noblacklist ${HOME}/.config/ranger | ||
11 | noblacklist ${HOME}/.nanorc | ||
12 | |||
13 | # Allow python (blacklisted by disable-interpreters.inc) | ||
14 | include allow-python2.inc | ||
15 | include allow-python3.inc | ||
16 | |||
17 | # Allow perl | ||
18 | include allow-perl.inc | ||
19 | |||
20 | include disable-common.inc | ||
21 | include disable-devel.inc | ||
22 | include disable-interpreters.inc | ||
23 | include disable-passwdmgr.inc | ||
24 | include disable-programs.inc | ||
25 | |||
26 | allusers | ||
27 | caps.drop all | ||
28 | net none | ||
29 | nodbus | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | #x11 none | ||
41 | |||
42 | private-dev | ||
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index 0362b82af..02d9fa076 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -27,11 +27,13 @@ | |||
27 | # ALLOW INCLUDES | 27 | # ALLOW INCLUDES |
28 | # BLACKLISTS | 28 | # BLACKLISTS |
29 | # DISABLE INCLUDES | 29 | # DISABLE INCLUDES |
30 | # NOWHITELISTS | ||
30 | # MKDIRS | 31 | # MKDIRS |
31 | # WHITELISTS | 32 | # WHITELISTS |
32 | # WHITELIST INCLUDES | 33 | # WHITELIST INCLUDES |
33 | # OPTIONS (caps*, net*, no*, protocol, seccomp*, shell none, tracelog) | 34 | # OPTIONS (caps*, net*, no*, protocol, seccomp*, shell none, tracelog) |
34 | # PRIVATE OPTIONS (disable-mnt, private-*, writable-*) | 35 | # PRIVATE OPTIONS (disable-mnt, private-*, writable-*) |
36 | # DBUS FILTER | ||
35 | # SPECIAL OPTIONS (mdwx, noexec, read-only, join-or-start) | 37 | # SPECIAL OPTIONS (mdwx, noexec, read-only, join-or-start) |
36 | # REDIRECT INCLUDES | 38 | # REDIRECT INCLUDES |
37 | # | 39 | # |
@@ -62,6 +64,8 @@ include globals.local | |||
62 | #blacklist /tmp/.X11-unix | 64 | #blacklist /tmp/.X11-unix |
63 | # Disable Wayland | 65 | # Disable Wayland |
64 | #blacklist ${RUNUSER}/wayland-* | 66 | #blacklist ${RUNUSER}/wayland-* |
67 | # Disable RUNUSER (cli only) | ||
68 | #blacklist ${RUNUSER} | ||
65 | 69 | ||
66 | # It is common practice to add files/dirs containing program-specific configuration | 70 | # It is common practice to add files/dirs containing program-specific configuration |
67 | # (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME) into disable-programs.inc | 71 | # (often ${HOME}/PROGRAMNAME or ${HOME}/.config/PROGRAMNAME) into disable-programs.inc |
@@ -105,6 +109,7 @@ include globals.local | |||
105 | #include disable-interpreters.inc | 109 | #include disable-interpreters.inc |
106 | #include disable-passwdmgr.inc | 110 | #include disable-passwdmgr.inc |
107 | #include disable-programs.inc | 111 | #include disable-programs.inc |
112 | #include disable-shell.inc | ||
108 | #include disable-xdg.inc | 113 | #include disable-xdg.inc |
109 | 114 | ||
110 | # This section often mirrors noblacklist section above. The idea is | 115 | # This section often mirrors noblacklist section above. The idea is |
@@ -116,6 +121,7 @@ include globals.local | |||
116 | ##mkfile PATH | 121 | ##mkfile PATH |
117 | #whitelist PATH | 122 | #whitelist PATH |
118 | #include whitelist-common.inc | 123 | #include whitelist-common.inc |
124 | #include whitelist-runuser-common.inc | ||
119 | #include whitelist-usr-share-common.inc | 125 | #include whitelist-usr-share-common.inc |
120 | #include whitelist-var-common.inc | 126 | #include whitelist-var-common.inc |
121 | 127 | ||
@@ -132,7 +138,7 @@ include globals.local | |||
132 | #net none | 138 | #net none |
133 | #netfilter | 139 | #netfilter |
134 | #no3d | 140 | #no3d |
135 | #nodbus | 141 | ##nodbus (deprecated, use 'dbus-user none' and 'dbus-system none', see below) |
136 | #nodvd | 142 | #nodvd |
137 | #nogroups | 143 | #nogroups |
138 | #nonewprivs | 144 | #nonewprivs |
@@ -182,6 +188,22 @@ include globals.local | |||
182 | ##writable-var | 188 | ##writable-var |
183 | ##writable-var-log | 189 | ##writable-var-log |
184 | 190 | ||
191 | # Since 0.9.63 also a more granular regulation of dbus is supported. | ||
192 | # To get the dbus-addresses to which an application needs access to. | ||
193 | # You can look at flatpak if the application is also distriputed via flatpak: | ||
194 | # flatpak remote-info --show-metadata flathub <APP-ID> | ||
195 | # Notes: | ||
196 | # - flatpak implicitly allows an app to own <APP-ID> on the session bus | ||
197 | # - In order to make dconf work (if it is used by the app) you need to allow | ||
198 | # 'ca.desrt.dconf' even if it is not allowed by flatpak. | ||
199 | # Notes and Policiy about addresses can be found at | ||
200 | # <https://github.com/netblue30/firejail/wiki/Restrict-D-Bus> | ||
201 | #dbus-user filter | ||
202 | #dbus-user.own com.github.netblue30.firejail | ||
203 | #dbus-user.talk ca.desrt.dconf | ||
204 | #dbus-user.talk org.freedesktop.Notifications | ||
205 | #dbus-system none | ||
206 | |||
185 | ##env VAR=VALUE | 207 | ##env VAR=VALUE |
186 | #memory-deny-write-execute | 208 | #memory-deny-write-execute |
187 | ##noexec PATH | 209 | ##noexec PATH |
diff --git a/mkdeb-apparmor.sh b/mkdeb-apparmor.sh deleted file mode 100755 index 3c560179c..000000000 --- a/mkdeb-apparmor.sh +++ /dev/null | |||
@@ -1,56 +0,0 @@ | |||
1 | #!/bin/sh | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2020 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | # based on http://tldp.org/HOWTO/html_single/Debian-Binary-Package-Building-HOWTO/ | ||
7 | # a code archive should already be available | ||
8 | |||
9 | set -e | ||
10 | |||
11 | TOP=`pwd` | ||
12 | CODE_ARCHIVE="$1-$2.tar.xz" | ||
13 | CODE_DIR="$1-$2" | ||
14 | INSTALL_DIR="${INSTALL_DIR}${CODE_DIR}/debian" | ||
15 | DEBIAN_CTRL_DIR="${DEBIAN_CTRL_DIR}${CODE_DIR}/debian/DEBIAN" | ||
16 | |||
17 | echo "*****************************************" | ||
18 | echo "code archive: $CODE_ARCHIVE" | ||
19 | echo "code directory: $CODE_DIR" | ||
20 | echo "install directory: $INSTALL_DIR" | ||
21 | echo "debian control directory: $DEBIAN_CTRL_DIR" | ||
22 | echo "*****************************************" | ||
23 | |||
24 | tar -xJvf $CODE_ARCHIVE | ||
25 | #mkdir -p $INSTALL_DIR | ||
26 | cd $CODE_DIR | ||
27 | ./configure --prefix=/usr --enable-apparmor | ||
28 | make -j2 | ||
29 | mkdir debian | ||
30 | DESTDIR=debian make install-strip | ||
31 | |||
32 | cd .. | ||
33 | echo "*****************************************" | ||
34 | SIZE=`du -s $INSTALL_DIR` | ||
35 | echo "install size $SIZE" | ||
36 | echo "*****************************************" | ||
37 | |||
38 | mv $INSTALL_DIR/usr/share/doc/firejail/RELNOTES $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian | ||
39 | gzip -9 -n $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian | ||
40 | rm $INSTALL_DIR/usr/share/doc/firejail/COPYING | ||
41 | install -m644 platform/debian/copyright $INSTALL_DIR/usr/share/doc/firejail/. | ||
42 | mkdir -p $DEBIAN_CTRL_DIR | ||
43 | sed "s/FIREJAILVER/$2/g" platform/debian/control.$(dpkg-architecture -qDEB_HOST_ARCH) > $DEBIAN_CTRL_DIR/control | ||
44 | |||
45 | mkdir -p $INSTALL_DIR/usr/share/lintian/overrides/ | ||
46 | install -m644 platform/debian/firejail.lintian-overrides $INSTALL_DIR/usr/share/lintian/overrides/firejail | ||
47 | |||
48 | find $INSTALL_DIR/etc -type f | sed "s,^$INSTALL_DIR,," | LC_ALL=C sort > $DEBIAN_CTRL_DIR/conffiles | ||
49 | chmod 644 $DEBIAN_CTRL_DIR/conffiles | ||
50 | find $INSTALL_DIR -type d | xargs chmod 755 | ||
51 | cd $CODE_DIR | ||
52 | fakeroot dpkg-deb --build debian | ||
53 | lintian debian.deb | ||
54 | mv debian.deb ../firejail-apparmor_$2_1_$(dpkg-architecture -qDEB_HOST_ARCH).deb | ||
55 | cd .. | ||
56 | rm -fr $CODE_DIR | ||
@@ -7,10 +7,24 @@ | |||
7 | # a code archive should already be available | 7 | # a code archive should already be available |
8 | 8 | ||
9 | set -e | 9 | set -e |
10 | NAME=@PACKAGE_NAME@ | ||
11 | VERSION=@PACKAGE_VERSION@ | ||
12 | PACKAGE_TARNAME=@PACKAGE_TARNAME@ | ||
13 | HAVE_APPARMOR=@HAVE_APPARMOR@ | ||
14 | HAVE_SELINUX=@HAVE_SELINUX@ | ||
15 | EXTRA_VERSION=$1 | ||
16 | |||
17 | CONFIG_ARGS="--prefix=/usr" | ||
18 | if [ -n "$HAVE_APPARMOR" ]; then | ||
19 | CONFIG_ARGS="$CONFIG_ARGS --enable-apparmor" | ||
20 | fi | ||
21 | if [ -n "$HAVE_SELINUX" ]; then | ||
22 | CONFIG_ARGS="$CONFIG_ARGS --enable-selinux" | ||
23 | fi | ||
10 | 24 | ||
11 | TOP=`pwd` | 25 | TOP=`pwd` |
12 | CODE_ARCHIVE="$1-$2.tar.xz" | 26 | CODE_ARCHIVE="$NAME-$VERSION.tar.xz" |
13 | CODE_DIR="$1-$2" | 27 | CODE_DIR="$NAME-$VERSION" |
14 | INSTALL_DIR="${INSTALL_DIR}${CODE_DIR}/debian" | 28 | INSTALL_DIR="${INSTALL_DIR}${CODE_DIR}/debian" |
15 | DEBIAN_CTRL_DIR="${DEBIAN_CTRL_DIR}${CODE_DIR}/debian/DEBIAN" | 29 | DEBIAN_CTRL_DIR="${DEBIAN_CTRL_DIR}${CODE_DIR}/debian/DEBIAN" |
16 | 30 | ||
@@ -24,7 +38,7 @@ echo "*****************************************" | |||
24 | tar -xJvf $CODE_ARCHIVE | 38 | tar -xJvf $CODE_ARCHIVE |
25 | #mkdir -p $INSTALL_DIR | 39 | #mkdir -p $INSTALL_DIR |
26 | cd $CODE_DIR | 40 | cd $CODE_DIR |
27 | ./configure --prefix=/usr | 41 | ./configure $CONFIG_ARGS |
28 | make -j2 | 42 | make -j2 |
29 | mkdir debian | 43 | mkdir debian |
30 | DESTDIR=debian make install-strip | 44 | DESTDIR=debian make install-strip |
@@ -38,12 +52,12 @@ echo "*****************************************" | |||
38 | mv $INSTALL_DIR/usr/share/doc/firejail/RELNOTES $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian | 52 | mv $INSTALL_DIR/usr/share/doc/firejail/RELNOTES $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian |
39 | gzip -9 -n $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian | 53 | gzip -9 -n $INSTALL_DIR/usr/share/doc/firejail/changelog.Debian |
40 | rm $INSTALL_DIR/usr/share/doc/firejail/COPYING | 54 | rm $INSTALL_DIR/usr/share/doc/firejail/COPYING |
41 | install -m644 platform/debian/copyright $INSTALL_DIR/usr/share/doc/firejail/. | 55 | install -m644 $CODE_DIR/platform/debian/copyright $INSTALL_DIR/usr/share/doc/firejail/. |
42 | mkdir -p $DEBIAN_CTRL_DIR | 56 | mkdir -p $DEBIAN_CTRL_DIR |
43 | sed "s/FIREJAILVER/$2/g" platform/debian/control.$(dpkg-architecture -qDEB_HOST_ARCH) > $DEBIAN_CTRL_DIR/control | 57 | sed "s/FIREJAILVER/$VERSION/g" $CODE_DIR/platform/debian/control.$(dpkg-architecture -qDEB_HOST_ARCH) > $DEBIAN_CTRL_DIR/control |
44 | 58 | ||
45 | mkdir -p $INSTALL_DIR/usr/share/lintian/overrides/ | 59 | mkdir -p $INSTALL_DIR/usr/share/lintian/overrides/ |
46 | install -m644 platform/debian/firejail.lintian-overrides $INSTALL_DIR/usr/share/lintian/overrides/firejail | 60 | install -m644 $CODE_DIR/platform/debian/firejail.lintian-overrides $INSTALL_DIR/usr/share/lintian/overrides/firejail |
47 | 61 | ||
48 | find $INSTALL_DIR/etc -type f | sed "s,^$INSTALL_DIR,," | LC_ALL=C sort > $DEBIAN_CTRL_DIR/conffiles | 62 | find $INSTALL_DIR/etc -type f | sed "s,^$INSTALL_DIR,," | LC_ALL=C sort > $DEBIAN_CTRL_DIR/conffiles |
49 | chmod 644 $DEBIAN_CTRL_DIR/conffiles | 63 | chmod 644 $DEBIAN_CTRL_DIR/conffiles |
@@ -51,6 +65,6 @@ find $INSTALL_DIR -type d | xargs chmod 755 | |||
51 | cd $CODE_DIR | 65 | cd $CODE_DIR |
52 | fakeroot dpkg-deb --build debian | 66 | fakeroot dpkg-deb --build debian |
53 | lintian debian.deb | 67 | lintian debian.deb |
54 | mv debian.deb ../firejail_$2_1_$(dpkg-architecture -qDEB_HOST_ARCH).deb | 68 | mv debian.deb ../firejail_${VERSION}${EXTRA_VERSION}_1_$(dpkg-architecture -qDEB_HOST_ARCH).deb |
55 | cd .. | 69 | cd .. |
56 | rm -fr $CODE_DIR | 70 | rm -fr $CODE_DIR |
@@ -3,25 +3,15 @@ | |||
3 | # Copyright (C) 2014-2020 Firejail Authors | 3 | # Copyright (C) 2014-2020 Firejail Authors |
4 | # License GPL v2 | 4 | # License GPL v2 |
5 | 5 | ||
6 | rm -fr .etc | ||
7 | mkdir .etc | ||
8 | |||
9 | for file in etc/*.profile etc/*.inc etc/*.net; | ||
10 | do | ||
11 | sed "s;/etc/firejail;$1/firejail;g" $file > .$file | ||
12 | done | ||
13 | |||
14 | if [ "x$2" = "xyes" ] | ||
15 | then | ||
16 | sed -i -e ' | 6 | sed -i -e ' |
17 | 1i# Workaround for systems where common UNIX utilities are symlinks to busybox.\ | 7 | 1i# Workaround for systems where common UNIX utilities are symlinks to busybox.\ |
18 | # If this is not your case you can remove --enable-busybox-workaround from\ | 8 | # If this is not your case you can remove --enable-busybox-workaround from\ |
19 | # ./configure options, for added security.\ | 9 | # ./configure options, for added security.\ |
10 | noblacklist \${PATH}/busybox\ | ||
11 | noblacklist \${PATH}/crontab\ | ||
20 | noblacklist \${PATH}/mount\ | 12 | noblacklist \${PATH}/mount\ |
21 | noblacklist \${PATH}/umount\ | 13 | noblacklist \${PATH}/nc\ |
22 | noblacklist \${PATH}/su\ | 14 | noblacklist \${PATH}/su\ |
23 | noblacklist \${PATH}/sudo\ | 15 | noblacklist \${PATH}/sudo\ |
24 | noblacklist \${PATH}/nc\ | 16 | noblacklist \${PATH}/umount\ |
25 | noblacklist \${PATH}/crontab\ | 17 | ' "$1" |
26 | ' .etc/disable-common.inc | ||
27 | fi | ||
diff --git a/platform/rpm/firejail.spec b/platform/rpm/firejail.spec index b32407c7d..da91f5a4f 100644 --- a/platform/rpm/firejail.spec +++ b/platform/rpm/firejail.spec | |||
@@ -1,7 +1,7 @@ | |||
1 | Name: __NAME__ | 1 | Name: __NAME__ |
2 | Version: __VERSION__ | 2 | Version: __VERSION__ |
3 | Release: 1 | 3 | Release: 1 |
4 | Summary: Linux namepaces sandbox program | 4 | Summary: Linux namespaces sandbox program |
5 | 5 | ||
6 | License: GPLv2+ | 6 | License: GPLv2+ |
7 | Group: Development/Tools | 7 | Group: Development/Tools |
@@ -19,7 +19,7 @@ using Linux namespaces. It includes a sandbox profile for Mozilla Firefox. | |||
19 | %setup -q | 19 | %setup -q |
20 | 20 | ||
21 | %build | 21 | %build |
22 | %configure --disable-userns --disable-contrib-install | 22 | %configure __CONFIG_OPT__ |
23 | make %{?_smp_mflags} | 23 | make %{?_smp_mflags} |
24 | 24 | ||
25 | %install | 25 | %install |
diff --git a/platform/rpm/mkrpm.sh b/platform/rpm/mkrpm.sh index 348bea7f2..2bdead7a8 100755 --- a/platform/rpm/mkrpm.sh +++ b/platform/rpm/mkrpm.sh | |||
@@ -3,7 +3,7 @@ | |||
3 | # Copyright (C) 2014-2020 Firejail Authors | 3 | # Copyright (C) 2014-2020 Firejail Authors |
4 | # License GPL v2 | 4 | # License GPL v2 |
5 | # | 5 | # |
6 | # Usage: ./platform/rpm/mkrpm.sh firejail <version> | 6 | # Usage: ./platform/rpm/mkrpm.sh firejail <version> "<config options>" |
7 | # | 7 | # |
8 | # Builds rpms in a temporary directory then places the result in the | 8 | # Builds rpms in a temporary directory then places the result in the |
9 | # current working directory. | 9 | # current working directory. |
@@ -11,6 +11,7 @@ | |||
11 | name=$1 | 11 | name=$1 |
12 | # Strip any trailing prefix from the version like -rc1 etc | 12 | # Strip any trailing prefix from the version like -rc1 etc |
13 | version=$(echo "$2" | sed 's/\-.*//g') | 13 | version=$(echo "$2" | sed 's/\-.*//g') |
14 | config_opt=$3 | ||
14 | 15 | ||
15 | if [[ ! -f platform/rpm/${name}.spec ]]; then | 16 | if [[ ! -f platform/rpm/${name}.spec ]]; then |
16 | echo error: spec file not found for name \"${name}\" | 17 | echo error: spec file not found for name \"${name}\" |
@@ -22,6 +23,10 @@ if [[ -z "${version}" ]]; then | |||
22 | exit 1 | 23 | exit 1 |
23 | fi | 24 | fi |
24 | 25 | ||
26 | if [[ -z "${config_opt}" ]]; then | ||
27 | config_opt="--disable-userns --disable-contrib-install" | ||
28 | fi | ||
29 | |||
25 | # Make a temporary directory and arrange to clean up on exit | 30 | # Make a temporary directory and arrange to clean up on exit |
26 | tmpdir=$(mktemp -d) | 31 | tmpdir=$(mktemp -d) |
27 | mkdir -p ${tmpdir}/{BUILD,RPMS,SOURCES,SPECS,SRPMS} | 32 | mkdir -p ${tmpdir}/{BUILD,RPMS,SOURCES,SPECS,SRPMS} |
@@ -32,7 +37,10 @@ trap cleanup EXIT | |||
32 | 37 | ||
33 | # Create the spec file | 38 | # Create the spec file |
34 | tmp_spec_file=${tmpdir}/SPECS/${name}.spec | 39 | tmp_spec_file=${tmpdir}/SPECS/${name}.spec |
35 | sed -e "s/__NAME__/${name}/g" -e "s/__VERSION__/${version}/g" platform/rpm/${name}.spec >${tmp_spec_file} | 40 | sed -e "s/__NAME__/${name}/g" \ |
41 | -e "s/__VERSION__/${version}/g" \ | ||
42 | -e "s/__CONFIG_OPT__/${config_opt}/g" \ | ||
43 | platform/rpm/${name}.spec >${tmp_spec_file} | ||
36 | # FIXME: We could parse RELNOTES and create a %changelog section here | 44 | # FIXME: We could parse RELNOTES and create a %changelog section here |
37 | 45 | ||
38 | # Copy the source to build into a tarball | 46 | # Copy the source to build into a tarball |
diff --git a/src/bash_completion/firejail.bash_completion b/src/bash_completion/firejail.bash_completion index 09798f505..0a1b34d7d 100644 --- a/src/bash_completion/firejail.bash_completion +++ b/src/bash_completion/firejail.bash_completion | |||
@@ -16,7 +16,7 @@ _firejail() | |||
16 | _init_completion -s || return | 16 | _init_completion -s || return |
17 | 17 | ||
18 | case $prev in | 18 | case $prev in |
19 | --help|--version|-debug-caps|--debug-syscalls|--list|--tree|--top|--join|--shutdown) | 19 | --help|--version|-debug-caps|--debug-syscalls|--debug-syscalls32|--list|--tree|--top|--join|--shutdown) |
20 | return 0 | 20 | return 0 |
21 | ;; | 21 | ;; |
22 | --profile) | 22 | --profile) |
diff --git a/src/common.mk.in b/src/common.mk.in index 945815a40..8104bc258 100644 --- a/src/common.mk.in +++ b/src/common.mk.in | |||
@@ -31,6 +31,7 @@ C_FILE_LIST = $(sort $(wildcard *.c)) | |||
31 | OBJS = $(C_FILE_LIST:.c=.o) | 31 | OBJS = $(C_FILE_LIST:.c=.o) |
32 | BINOBJS = $(foreach file, $(OBJS), $file) | 32 | BINOBJS = $(foreach file, $(OBJS), $file) |
33 | 33 | ||
34 | CFLAGS = @CFLAGS@ | ||
34 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) | 35 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) |
35 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' | 36 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' |
36 | CFLAGS += $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_FIRETUNNEL) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX) | 37 | CFLAGS += $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_FIRETUNNEL) $(HAVE_SECCOMP) $(HAVE_GLOBALCFG) $(HAVE_SECCOMP_H) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX) |
diff --git a/src/faudit/dbus.c b/src/faudit/dbus.c index 8c26c5271..beaa5ac46 100644 --- a/src/faudit/dbus.c +++ b/src/faudit/dbus.c | |||
@@ -18,6 +18,8 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "faudit.h" | 20 | #include "faudit.h" |
21 | #include "../include/rundefs.h" | ||
22 | #include <stdarg.h> | ||
21 | #include <sys/socket.h> | 23 | #include <sys/socket.h> |
22 | #include <sys/un.h> | 24 | #include <sys/un.h> |
23 | 25 | ||
@@ -46,9 +48,10 @@ int check_unix(const char *sockfile) { | |||
46 | return rv; | 48 | return rv; |
47 | } | 49 | } |
48 | 50 | ||
49 | void dbus_test(void) { | 51 | static char *test_dbus_env(char *env_var_name) { |
50 | // check the session bus | 52 | // check the session bus |
51 | char *str = getenv("DBUS_SESSION_BUS_ADDRESS"); | 53 | char *str = getenv(env_var_name); |
54 | char *found = NULL; | ||
52 | if (str) { | 55 | if (str) { |
53 | int rv = 0; | 56 | int rv = 0; |
54 | char *bus = strdup(str); | 57 | char *bus = strdup(str); |
@@ -74,19 +77,55 @@ void dbus_test(void) { | |||
74 | if (ptr) | 77 | if (ptr) |
75 | *ptr = '\0'; | 78 | *ptr = '\0'; |
76 | rv = check_unix(sockfile); | 79 | rv = check_unix(sockfile); |
77 | if (rv == 0) | 80 | if (rv == 0) { |
78 | printf("MAYBE: D-Bus socket %s is available\n", sockfile); | 81 | if (strcmp(RUN_DBUS_USER_SOCKET, sockfile) == 0 || |
82 | strcmp(RUN_DBUS_SYSTEM_SOCKET, sockfile) == 0) { | ||
83 | printf("GOOD: D-Bus filtering is active on %s\n", sockfile); | ||
84 | } else { | ||
85 | printf("MAYBE: D-Bus socket %s is available\n", sockfile); | ||
86 | } | ||
87 | } | ||
79 | else if (rv == -1) | 88 | else if (rv == -1) |
80 | printf("GOOD: cannot connect to D-Bus socket %s\n", sockfile); | 89 | printf("GOOD: cannot connect to D-Bus socket %s\n", sockfile); |
90 | found = strdup(sockfile); | ||
91 | if (!found) | ||
92 | errExit("strdup"); | ||
81 | } | 93 | } |
82 | else if ((sockfile = strstr(bus, "tcp:host=")) != NULL) | 94 | else if ((sockfile = strstr(bus, "tcp:host=")) != NULL) |
83 | printf("UGLY: session bus configured for TCP communication.\n"); | 95 | printf("UGLY: %s bus configured for TCP communication.\n", env_var_name); |
84 | else | 96 | else |
85 | printf("GOOD: cannot find a D-Bus socket\n"); | 97 | printf("GOOD: cannot find a %s D-Bus socket\n", env_var_name); |
86 | |||
87 | |||
88 | free(bus); | 98 | free(bus); |
89 | } | 99 | } |
90 | else | 100 | else |
91 | printf("GOOD: DBUS_SESSION_BUS_ADDRESS environment variable not configured."); | 101 | printf("MAYBE: %s environment variable not configured.\n", env_var_name); |
102 | return found; | ||
103 | } | ||
104 | |||
105 | static void test_default_socket(const char *found, const char *format, ...) { | ||
106 | va_list ap; | ||
107 | va_start(ap, format); | ||
108 | char *sockfile; | ||
109 | if (vasprintf(&sockfile, format, ap) == -1) | ||
110 | errExit("vasprintf"); | ||
111 | va_end(ap); | ||
112 | if (found != NULL && strcmp(found, sockfile) == 0) | ||
113 | goto end; | ||
114 | int rv = check_unix(sockfile); | ||
115 | if (rv == 0) | ||
116 | printf("MAYBE: D-Bus socket %s is available\n", sockfile); | ||
117 | end: | ||
118 | free(sockfile); | ||
119 | } | ||
120 | |||
121 | void dbus_test(void) { | ||
122 | char *found_user = test_dbus_env("DBUS_SESSION_BUS_ADDRESS"); | ||
123 | test_default_socket(found_user, "/run/user/%d/bus", (int) getuid()); | ||
124 | test_default_socket(found_user, "/run/user/%d/dbus/user_bus_socket", (int) getuid()); | ||
125 | if (found_user != NULL) | ||
126 | free(found_user); | ||
127 | char *found_system = test_dbus_env("DBUS_SYSTEM_BUS_ADDRESS"); | ||
128 | test_default_socket(found_system, "/run/dbus/system_bus_socket"); | ||
129 | if (found_system != NULL) | ||
130 | free(found_system); | ||
92 | } | 131 | } |
diff --git a/src/faudit/pid.c b/src/faudit/pid.c index a45b6e31a..0a277ddc2 100644 --- a/src/faudit/pid.c +++ b/src/faudit/pid.c | |||
@@ -20,7 +20,7 @@ | |||
20 | #include "faudit.h" | 20 | #include "faudit.h" |
21 | 21 | ||
22 | void pid_test(void) { | 22 | void pid_test(void) { |
23 | char *kern_proc[] = { | 23 | static char *kern_proc[] = { |
24 | "kthreadd", | 24 | "kthreadd", |
25 | "ksoftirqd", | 25 | "ksoftirqd", |
26 | "kworker", | 26 | "kworker", |
diff --git a/src/fbuilder/build_bin.c b/src/fbuilder/build_bin.c index a44546699..c6f84dfbc 100644 --- a/src/fbuilder/build_bin.c +++ b/src/fbuilder/build_bin.c | |||
@@ -71,7 +71,7 @@ static void process_bin(const char *fname) { | |||
71 | else if (strncmp(ptr, "/usr/local/sbin/", 16) == 0) | 71 | else if (strncmp(ptr, "/usr/local/sbin/", 16) == 0) |
72 | ptr += 16; | 72 | ptr += 16; |
73 | else if (strncmp(ptr, "/usr/games/", 11) == 0) | 73 | else if (strncmp(ptr, "/usr/games/", 11) == 0) |
74 | ptr += 12; | 74 | ptr += 11; |
75 | else if (strncmp(ptr, "/usr/local/games/", 17) == 0) | 75 | else if (strncmp(ptr, "/usr/local/games/", 17) == 0) |
76 | ptr += 17; | 76 | ptr += 17; |
77 | else | 77 | else |
diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c index b08afb939..1b8231033 100644 --- a/src/fbuilder/build_fs.c +++ b/src/fbuilder/build_fs.c | |||
@@ -165,10 +165,12 @@ void build_var(const char *fname, FILE *fp) { | |||
165 | 165 | ||
166 | process_files(fname, "/var", var_callback); | 166 | process_files(fname, "/var", var_callback); |
167 | 167 | ||
168 | if (var_out == NULL) | 168 | if (var_out == NULL) { |
169 | fprintf(fp, "blacklist /var\n"); | 169 | fprintf(fp, "blacklist /var\n"); |
170 | else | 170 | } else { |
171 | filedb_print(var_out, "whitelist ", fp); | 171 | filedb_print(var_out, "whitelist ", fp); |
172 | fprintf(fp, "include whitelist-var-common.inc\n"); | ||
173 | } | ||
172 | } | 174 | } |
173 | 175 | ||
174 | 176 | ||
@@ -202,10 +204,12 @@ void build_share(const char *fname, FILE *fp) { | |||
202 | 204 | ||
203 | process_files(fname, "/usr/share", share_callback); | 205 | process_files(fname, "/usr/share", share_callback); |
204 | 206 | ||
205 | if (share_out == NULL) | 207 | if (share_out == NULL) { |
206 | fprintf(fp, "blacklist /usr/share\n"); | 208 | fprintf(fp, "blacklist /usr/share\n"); |
207 | else | 209 | } else { |
208 | filedb_print(share_out, "whitelist ", fp); | 210 | filedb_print(share_out, "whitelist ", fp); |
211 | fprintf(fp, "include whitelist-usr-share-common.inc\n"); | ||
212 | } | ||
209 | } | 213 | } |
210 | 214 | ||
211 | //******************************************* | 215 | //******************************************* |
diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c index 8db17a942..fca3396c4 100644 --- a/src/fbuilder/build_home.c +++ b/src/fbuilder/build_home.c | |||
@@ -32,9 +32,9 @@ static void load_whitelist_common(void) { | |||
32 | 32 | ||
33 | char buf[MAX_BUF]; | 33 | char buf[MAX_BUF]; |
34 | while (fgets(buf, MAX_BUF, fp)) { | 34 | while (fgets(buf, MAX_BUF, fp)) { |
35 | if (strncmp(buf, "whitelist ~/", 12) != 0) | 35 | if (strncmp(buf, "whitelist ${HOME}/", 18) != 0) |
36 | continue; | 36 | continue; |
37 | char *fn = buf + 12; | 37 | char *fn = buf + 18; |
38 | char *ptr = strchr(buf, '\n'); | 38 | char *ptr = strchr(buf, '\n'); |
39 | if (!ptr) | 39 | if (!ptr) |
40 | continue; | 40 | continue; |
@@ -190,8 +190,8 @@ void build_home(const char *fname, FILE *fp) { | |||
190 | 190 | ||
191 | // print the out list if any | 191 | // print the out list if any |
192 | if (db_out) { | 192 | if (db_out) { |
193 | filedb_print(db_out, "whitelist ~/", fp); | 193 | filedb_print(db_out, "whitelist ${HOME}/", fp); |
194 | fprintf(fp, "include /etc/firejail/whitelist-common.inc\n"); | 194 | fprintf(fp, "include whitelist-common.inc\n"); |
195 | } | 195 | } |
196 | else | 196 | else |
197 | fprintf(fp, "private\n"); | 197 | fprintf(fp, "private\n"); |
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c index ea9e9a4a0..adc00e67b 100644 --- a/src/fbuilder/build_profile.c +++ b/src/fbuilder/build_profile.c | |||
@@ -131,18 +131,21 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
131 | if (WIFEXITED(status) && WEXITSTATUS(status) == 0) { | 131 | if (WIFEXITED(status) && WEXITSTATUS(status) == 0) { |
132 | if (fp == stdout) | 132 | if (fp == stdout) |
133 | printf("--- Built profile beings after this line ---\n"); | 133 | printf("--- Built profile beings after this line ---\n"); |
134 | fprintf(fp, "############################################\n"); | 134 | fprintf(fp, "# Firejail profile for %s\n", argv[index]); |
135 | fprintf(fp, "# %s profile\n", argv[index]); | 135 | fprintf(fp, "# Persistent local customizations\n"); |
136 | fprintf(fp, "############################################\n"); | 136 | fprintf(fp, "#include %s.local\n", argv[index]); |
137 | fprintf(fp, "# Persistent global definitions\n"); | 137 | fprintf(fp, "# Persistent global definitions\n"); |
138 | fprintf(fp, "# include /etc/firejail/globals.local\n"); | 138 | fprintf(fp, "#include globals.local\n"); |
139 | fprintf(fp, "\n"); | 139 | fprintf(fp, "\n"); |
140 | 140 | ||
141 | fprintf(fp, "### basic blacklisting\n"); | 141 | fprintf(fp, "### basic blacklisting\n"); |
142 | fprintf(fp, "include /etc/firejail/disable-common.inc\n"); | 142 | fprintf(fp, "include disable-common.inc\n"); |
143 | fprintf(fp, "# include /etc/firejail/disable-devel.inc\n"); | 143 | fprintf(fp, "# include disable-devel.inc\n"); |
144 | fprintf(fp, "include /etc/firejail/disable-passwdmgr.inc\n"); | 144 | fprintf(fp, "# include disable-exec.inc\n"); |
145 | fprintf(fp, "# include /etc/firejail/disable-programs.inc\n"); | 145 | fprintf(fp, "# include disable-interpreters.inc\n"); |
146 | fprintf(fp, "include disable-passwdmgr.inc\n"); | ||
147 | fprintf(fp, "# include disable-programs.inc\n"); | ||
148 | fprintf(fp, "# include disable-xdg.inc\n"); | ||
146 | fprintf(fp, "\n"); | 149 | fprintf(fp, "\n"); |
147 | 150 | ||
148 | fprintf(fp, "### home directory whitelisting\n"); | 151 | fprintf(fp, "### home directory whitelisting\n"); |
@@ -150,12 +153,19 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
150 | fprintf(fp, "\n"); | 153 | fprintf(fp, "\n"); |
151 | 154 | ||
152 | fprintf(fp, "### filesystem\n"); | 155 | fprintf(fp, "### filesystem\n"); |
153 | build_tmp(trace_output, fp); | 156 | fprintf(fp, "# /usr/share:\n"); |
154 | build_dev(trace_output, fp); | 157 | build_share(trace_output, fp); |
155 | build_etc(trace_output, fp); | 158 | fprintf(fp, "# /var:\n"); |
156 | build_var(trace_output, fp); | 159 | build_var(trace_output, fp); |
160 | fprintf(fp, "\n"); | ||
161 | fprintf(fp, "# $PATH:\n"); | ||
157 | build_bin(trace_output, fp); | 162 | build_bin(trace_output, fp); |
158 | build_share(trace_output, fp); | 163 | fprintf(fp, "# /dev:\n"); |
164 | build_dev(trace_output, fp); | ||
165 | fprintf(fp, "# /etc:\n"); | ||
166 | build_etc(trace_output, fp); | ||
167 | fprintf(fp, "# /tmp:\n"); | ||
168 | build_tmp(trace_output, fp); | ||
159 | fprintf(fp, "\n"); | 169 | fprintf(fp, "\n"); |
160 | 170 | ||
161 | fprintf(fp, "### security filters\n"); | 171 | fprintf(fp, "### security filters\n"); |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index adf66f008..0574daae6 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -23,11 +23,14 @@ Natron | |||
23 | PPSSPPQt | 23 | PPSSPPQt |
24 | QMediathekView | 24 | QMediathekView |
25 | QOwnNotes | 25 | QOwnNotes |
26 | Screenshot | ||
26 | Telegram | 27 | Telegram |
27 | Viber | 28 | Viber |
28 | VirtualBox | 29 | VirtualBox |
29 | XMind | 30 | XMind |
30 | Xephyr | 31 | Xephyr |
32 | ZeGrapher | ||
33 | abiword | ||
31 | abrowser | 34 | abrowser |
32 | akonadi_control | 35 | akonadi_control |
33 | akregator | 36 | akregator |
@@ -36,6 +39,7 @@ amule | |||
36 | amuled | 39 | amuled |
37 | android-studio | 40 | android-studio |
38 | anydesk | 41 | anydesk |
42 | apostrophe | ||
39 | apktool | 43 | apktool |
40 | # ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 44 | # ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
41 | arch-audit | 45 | arch-audit |
@@ -71,6 +75,7 @@ barrier | |||
71 | basilisk | 75 | basilisk |
72 | beaker | 76 | beaker |
73 | bibletime | 77 | bibletime |
78 | bijiben | ||
74 | bitcoin-qt | 79 | bitcoin-qt |
75 | bitlbee | 80 | bitlbee |
76 | bitwarden | 81 | bitwarden |
@@ -78,6 +83,7 @@ bleachbit | |||
78 | blender | 83 | blender |
79 | blender-2.8 | 84 | blender-2.8 |
80 | bless | 85 | bless |
86 | blobwars | ||
81 | bluefish | 87 | bluefish |
82 | bnox | 88 | bnox |
83 | brackets | 89 | brackets |
@@ -105,6 +111,7 @@ calligrawords | |||
105 | cameramonitor | 111 | cameramonitor |
106 | cantata | 112 | cantata |
107 | catfish | 113 | catfish |
114 | cawbird | ||
108 | celluloid | 115 | celluloid |
109 | checkbashisms | 116 | checkbashisms |
110 | cheese | 117 | cheese |
@@ -128,7 +135,9 @@ clocks | |||
128 | cmus | 135 | cmus |
129 | code | 136 | code |
130 | code-oss | 137 | code-oss |
138 | com.github.dahenson.agenda | ||
131 | com.github.johnfactotum.Foliate | 139 | com.github.johnfactotum.Foliate |
140 | com.gitlab.newsflash | ||
132 | conkeror | 141 | conkeror |
133 | conky | 142 | conky |
134 | conplay | 143 | conplay |
@@ -148,9 +157,11 @@ desktopeditors | |||
148 | devhelp | 157 | devhelp |
149 | dex2jar | 158 | dex2jar |
150 | dia | 159 | dia |
160 | dig | ||
151 | digikam | 161 | digikam |
152 | dillo | 162 | dillo |
153 | dino | 163 | dino |
164 | dino-im | ||
154 | discord | 165 | discord |
155 | discord-canary | 166 | discord-canary |
156 | display | 167 | display |
@@ -169,6 +180,7 @@ easystroke | |||
169 | ebook-viewer | 180 | ebook-viewer |
170 | electron-mail | 181 | electron-mail |
171 | electrum | 182 | electrum |
183 | element-desktop | ||
172 | elinks | 184 | elinks |
173 | empathy | 185 | empathy |
174 | enchant | 186 | enchant |
@@ -194,6 +206,7 @@ falkon | |||
194 | fbreader | 206 | fbreader |
195 | feedreader | 207 | feedreader |
196 | feh | 208 | feh |
209 | ferdi | ||
197 | ffmpeg | 210 | ffmpeg |
198 | ffmpegthumbnailer | 211 | ffmpegthumbnailer |
199 | ffplay | 212 | ffplay |
@@ -207,6 +220,7 @@ firefox-esr | |||
207 | firefox-nightly | 220 | firefox-nightly |
208 | firefox-wayland | 221 | firefox-wayland |
209 | firefox-x11 | 222 | firefox-x11 |
223 | five-or-more | ||
210 | flacsplt | 224 | flacsplt |
211 | flameshot | 225 | flameshot |
212 | flashpeak-slimjet | 226 | flashpeak-slimjet |
@@ -214,6 +228,7 @@ flowblade | |||
214 | font-manager | 228 | font-manager |
215 | fontforge | 229 | fontforge |
216 | fossamail | 230 | fossamail |
231 | four-in-a-row | ||
217 | franz | 232 | franz |
218 | freecad | 233 | freecad |
219 | freecadcmd | 234 | freecadcmd |
@@ -225,11 +240,14 @@ freemind | |||
225 | freeoffice-planmaker | 240 | freeoffice-planmaker |
226 | freeoffice-presentations | 241 | freeoffice-presentations |
227 | freeoffice-textmaker | 242 | freeoffice-textmaker |
243 | freetube | ||
228 | freshclam | 244 | freshclam |
245 | frogatto | ||
229 | frozen-bubble | 246 | frozen-bubble |
230 | gajim | 247 | gajim |
231 | gajim-history-manager | 248 | gajim-history-manager |
232 | galculator | 249 | galculator |
250 | gapplication | ||
233 | gcalccmd | 251 | gcalccmd |
234 | gcloud | 252 | gcloud |
235 | gconf-editor | 253 | gconf-editor |
@@ -247,15 +265,17 @@ gimp-2.8 | |||
247 | gist | 265 | gist |
248 | gist-paste | 266 | gist-paste |
249 | gitg | 267 | gitg |
268 | git-cola | ||
250 | github-desktop | 269 | github-desktop |
251 | gitter | 270 | gitter |
252 | gjs | 271 | # gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 |
253 | globaltime | 272 | globaltime |
254 | gmpc | 273 | gmpc |
255 | gnome-2048 | 274 | gnome-2048 |
256 | gnome-books | 275 | gnome-books |
257 | gnome-builder | 276 | gnome-builder |
258 | gnome-calculator | 277 | gnome-calculator |
278 | gnome-calendar | ||
259 | gnome-character-map | 279 | gnome-character-map |
260 | gnome-characters | 280 | gnome-characters |
261 | gnome-chess | 281 | gnome-chess |
@@ -264,20 +284,33 @@ gnome-contacts | |||
264 | gnome-documents | 284 | gnome-documents |
265 | gnome-font-viewer | 285 | gnome-font-viewer |
266 | gnome-hexgl | 286 | gnome-hexgl |
287 | gnome-klotski | ||
267 | gnome-latex | 288 | gnome-latex |
268 | gnome-logs | 289 | gnome-logs |
290 | gnome-mahjongg | ||
269 | gnome-maps | 291 | gnome-maps |
292 | gnome-mines | ||
270 | gnome-mplayer | 293 | gnome-mplayer |
271 | gnome-mpv | 294 | gnome-mpv |
272 | gnome-music | 295 | gnome-music |
273 | gnome-nettool | 296 | gnome-nettool |
297 | gnome-nibbles | ||
274 | gnome-passwordsafe | 298 | gnome-passwordsafe |
275 | gnome-photos | 299 | gnome-photos |
300 | gnome-pomodoro | ||
276 | gnome-recipes | 301 | gnome-recipes |
302 | gnome-robots | ||
277 | gnome-schedule | 303 | gnome-schedule |
304 | gnome-screenshot | ||
305 | gnome-sudoku | ||
278 | gnome-system-log | 306 | gnome-system-log |
307 | gnome-taquin | ||
308 | gnome-tetravex | ||
309 | gnome-todo | ||
279 | gnome-twitch | 310 | gnome-twitch |
280 | gnome-weather | 311 | gnome-weather |
312 | gnote | ||
313 | gnubik | ||
281 | godot | 314 | godot |
282 | goobox | 315 | goobox |
283 | google-chrome | 316 | google-chrome |
@@ -292,7 +325,11 @@ gpicview | |||
292 | gpredict | 325 | gpredict |
293 | gradio | 326 | gradio |
294 | gramps | 327 | gramps |
328 | gravity-beams-and-evaporating-stars | ||
295 | gthumb | 329 | gthumb |
330 | gtk-youtube-viewer | ||
331 | gtk2-youtube-viewer | ||
332 | gtk3-youtube-viewer | ||
296 | guayadeque | 333 | guayadeque |
297 | gucharmap | 334 | gucharmap |
298 | gummi | 335 | gummi |
@@ -303,7 +340,12 @@ hashcat | |||
303 | hedgewars | 340 | hedgewars |
304 | hexchat | 341 | hexchat |
305 | highlight | 342 | highlight |
343 | hitori | ||
344 | homebank | ||
345 | host | ||
306 | hugin | 346 | hugin |
347 | hyperrogue | ||
348 | iagno | ||
307 | icecat | 349 | icecat |
308 | icedove | 350 | icedove |
309 | iceweasel | 351 | iceweasel |
@@ -322,6 +364,9 @@ jd-gui | |||
322 | jdownloader | 364 | jdownloader |
323 | jerry | 365 | jerry |
324 | jitsi | 366 | jitsi |
367 | jitsi-meet-desktop | ||
368 | jumpnbump | ||
369 | jumpnbump-menu | ||
325 | k3b | 370 | k3b |
326 | kaffeine | 371 | kaffeine |
327 | kalgebra | 372 | kalgebra |
@@ -349,6 +394,7 @@ klatexformula | |||
349 | klatexformula_cmdl | 394 | klatexformula_cmdl |
350 | klavaro | 395 | klavaro |
351 | kmail | 396 | kmail |
397 | kmplayer | ||
352 | knotes | 398 | knotes |
353 | kodi | 399 | kodi |
354 | konversation | 400 | konversation |
@@ -360,9 +406,10 @@ ktouch | |||
360 | # kwin_x11 | 406 | # kwin_x11 |
361 | kwrite | 407 | kwrite |
362 | leafpad | 408 | leafpad |
363 | less | 409 | # less - breaks man |
364 | libreoffice | 410 | libreoffice |
365 | liferea | 411 | liferea |
412 | lightsoff | ||
366 | lincity-ng | 413 | lincity-ng |
367 | links | 414 | links |
368 | linphone | 415 | linphone |
@@ -387,7 +434,9 @@ luminance-hdr | |||
387 | lximage-qt | 434 | lximage-qt |
388 | lxmusic | 435 | lxmusic |
389 | lynx | 436 | lynx |
437 | lyx | ||
390 | macrofusion | 438 | macrofusion |
439 | magicor | ||
391 | manaplus | 440 | manaplus |
392 | masterpdfeditor | 441 | masterpdfeditor |
393 | masterpdfeditor4 | 442 | masterpdfeditor4 |
@@ -397,6 +446,7 @@ mate-calculator | |||
397 | mate-color-select | 446 | mate-color-select |
398 | mate-dictionary | 447 | mate-dictionary |
399 | mathematica | 448 | mathematica |
449 | mattermost-desktop | ||
400 | mcabber | 450 | mcabber |
401 | mediainfo | 451 | mediainfo |
402 | mediathekview | 452 | mediathekview |
@@ -408,7 +458,12 @@ mendeleydesktop | |||
408 | meteo-qt | 458 | meteo-qt |
409 | midori | 459 | midori |
410 | min | 460 | min |
461 | mindless | ||
462 | minecraft-launcher | ||
411 | minetest | 463 | minetest |
464 | minitube | ||
465 | mirrormagic | ||
466 | mocp | ||
412 | mousepad | 467 | mousepad |
413 | mp3splt | 468 | mp3splt |
414 | mp3splt-gtk | 469 | mp3splt-gtk |
@@ -428,6 +483,7 @@ mpg123-strip | |||
428 | mplayer | 483 | mplayer |
429 | mpsyt | 484 | mpsyt |
430 | mpv | 485 | mpv |
486 | mrrescue | ||
431 | ms-excel | 487 | ms-excel |
432 | ms-office | 488 | ms-office |
433 | ms-onenote | 489 | ms-onenote |
@@ -435,6 +491,7 @@ ms-outlook | |||
435 | ms-powerpoint | 491 | ms-powerpoint |
436 | ms-skype | 492 | ms-skype |
437 | ms-word | 493 | ms-word |
494 | mtpaint | ||
438 | multimc | 495 | multimc |
439 | multimc5 | 496 | multimc5 |
440 | mumble | 497 | mumble |
@@ -459,13 +516,17 @@ neverball | |||
459 | neverputt | 516 | neverputt |
460 | newsbeuter | 517 | newsbeuter |
461 | newsboat | 518 | newsboat |
519 | newsflash | ||
462 | nheko | 520 | nheko |
521 | nicotine | ||
463 | nitroshare | 522 | nitroshare |
464 | nitroshare-cli | 523 | nitroshare-cli |
465 | nitroshare-nmh | 524 | nitroshare-nmh |
466 | nitroshare-send | 525 | nitroshare-send |
467 | nitroshare-ui | 526 | nitroshare-ui |
468 | nomacs | 527 | nomacs |
528 | nslookup | ||
529 | nuclear | ||
469 | nylas | 530 | nylas |
470 | nyx | 531 | nyx |
471 | obs | 532 | obs |
@@ -478,7 +539,9 @@ ooffice | |||
478 | ooviewdoc | 539 | ooviewdoc |
479 | open-invaders | 540 | open-invaders |
480 | openarena | 541 | openarena |
542 | openarena_ded | ||
481 | opencity | 543 | opencity |
544 | openclonk | ||
482 | openoffice.org | 545 | openoffice.org |
483 | openshot | 546 | openshot |
484 | openshot-qt | 547 | openshot-qt |
@@ -487,9 +550,10 @@ opera | |||
487 | opera-beta | 550 | opera-beta |
488 | orage | 551 | orage |
489 | ostrichriders | 552 | ostrichriders |
553 | otter-browser | ||
490 | out123 | 554 | out123 |
491 | palemoon | 555 | palemoon |
492 | pandoc | 556 | #pandoc |
493 | parole | 557 | parole |
494 | patch | 558 | patch |
495 | pavucontrol | 559 | pavucontrol |
@@ -499,6 +563,7 @@ pdfmod | |||
499 | pdfsam | 563 | pdfsam |
500 | pdftotext | 564 | pdftotext |
501 | peek | 565 | peek |
566 | penguin-command | ||
502 | picard | 567 | picard |
503 | pidgin | 568 | pidgin |
504 | #ping - disabled until we fix #1912 | 569 | #ping - disabled until we fix #1912 |
@@ -512,6 +577,7 @@ planmaker18 | |||
512 | planmaker18free | 577 | planmaker18free |
513 | playonlinux | 578 | playonlinux |
514 | pluma | 579 | pluma |
580 | plv | ||
515 | pngquant | 581 | pngquant |
516 | polari | 582 | polari |
517 | ppsspp | 583 | ppsspp |
@@ -532,6 +598,7 @@ qmmp | |||
532 | qpdfview | 598 | qpdfview |
533 | qt-faststart | 599 | qt-faststart |
534 | qtox | 600 | qtox |
601 | quadrapassel | ||
535 | quassel | 602 | quassel |
536 | quiterss | 603 | quiterss |
537 | qupzilla | 604 | qupzilla |
@@ -546,6 +613,7 @@ rhythmbox-client | |||
546 | ricochet | 613 | ricochet |
547 | riot-desktop | 614 | riot-desktop |
548 | riot-web | 615 | riot-web |
616 | ripperx | ||
549 | ristretto | 617 | ristretto |
550 | rocketchat | 618 | rocketchat |
551 | rtorrent | 619 | rtorrent |
@@ -553,15 +621,19 @@ runenpass.sh | |||
553 | sayonara | 621 | sayonara |
554 | scallion | 622 | scallion |
555 | scorched3d | 623 | scorched3d |
624 | scorched3d-wrapper | ||
625 | scorchwentbonkers | ||
556 | scribus | 626 | scribus |
557 | sdat2img | 627 | sdat2img |
558 | seahorse | 628 | seahorse |
629 | seahorse-adventures | ||
559 | seahorse-daemon | 630 | seahorse-daemon |
560 | seahorse-tool | 631 | seahorse-tool |
561 | seamonkey | 632 | seamonkey |
562 | seamonkey-bin | 633 | seamonkey-bin |
563 | secret-tool | 634 | secret-tool |
564 | shellcheck | 635 | shellcheck |
636 | shortwave | ||
565 | shotcut | 637 | shotcut |
566 | signal-cli | 638 | signal-cli |
567 | signal-desktop | 639 | signal-desktop |
@@ -578,6 +650,7 @@ smtube | |||
578 | snox | 650 | snox |
579 | soffice | 651 | soffice |
580 | sol | 652 | sol |
653 | sound-juicer | ||
581 | soundconverter | 654 | soundconverter |
582 | spotify | 655 | spotify |
583 | sqlitebrowser | 656 | sqlitebrowser |
@@ -587,13 +660,17 @@ standardnotes-desktop | |||
587 | start-tor-browser | 660 | start-tor-browser |
588 | steam | 661 | steam |
589 | steam-native | 662 | steam-native |
663 | steam-runtime | ||
590 | stellarium | 664 | stellarium |
665 | strawberry | ||
591 | strings | 666 | strings |
592 | studio.sh | 667 | studio.sh |
593 | subdownloader | 668 | subdownloader |
594 | supertux2 | 669 | supertux2 |
595 | supertuxkart | 670 | supertuxkart |
596 | surf | 671 | surf |
672 | sushi | ||
673 | swell-foop | ||
597 | sylpheed | 674 | sylpheed |
598 | synfigstudio | 675 | synfigstudio |
599 | sysprof | 676 | sysprof |
@@ -682,11 +759,13 @@ vivaldi-beta | |||
682 | vivaldi-snapshot | 759 | vivaldi-snapshot |
683 | vivaldi-stable | 760 | vivaldi-stable |
684 | vlc | 761 | vlc |
762 | vmware | ||
685 | vscodium | 763 | vscodium |
686 | vulturesclaw | 764 | vulturesclaw |
687 | vultureseye | 765 | vultureseye |
688 | vym | 766 | vym |
689 | w3m | 767 | w3m |
768 | warmux | ||
690 | warsow | 769 | warsow |
691 | warzone2100 | 770 | warzone2100 |
692 | waterfox | 771 | waterfox |
@@ -708,6 +787,9 @@ wireshark-qt | |||
708 | wpp | 787 | wpp |
709 | wps | 788 | wps |
710 | wpspdf | 789 | wpspdf |
790 | wordwarvi | ||
791 | x2goclient | ||
792 | xbill | ||
711 | xcalc | 793 | xcalc |
712 | xchat | 794 | xchat |
713 | xed | 795 | xed |
@@ -715,6 +797,7 @@ xfburn | |||
715 | xfce4-dict | 797 | xfce4-dict |
716 | xfce4-mixer | 798 | xfce4-mixer |
717 | xfce4-notes | 799 | xfce4-notes |
800 | xfce4-screenshooter | ||
718 | xiphos | 801 | xiphos |
719 | xlinks | 802 | xlinks |
720 | xmms | 803 | xmms |
@@ -722,6 +805,8 @@ xmr-stak | |||
722 | xonotic | 805 | xonotic |
723 | xonotic-glx | 806 | xonotic-glx |
724 | xonotic-sdl | 807 | xonotic-sdl |
808 | xonotic-sdl-wrapper | ||
809 | xournal | ||
725 | xpdf | 810 | xpdf |
726 | xplayer | 811 | xplayer |
727 | xplayer-audio-preview | 812 | xplayer-audio-preview |
@@ -734,6 +819,7 @@ xviewer | |||
734 | yandex-browser | 819 | yandex-browser |
735 | yelp | 820 | yelp |
736 | youtube-dl | 821 | youtube-dl |
822 | youtube-viewer | ||
737 | zaproxy | 823 | zaproxy |
738 | zart | 824 | zart |
739 | zathura | 825 | zathura |
diff --git a/src/firecfg/main.c b/src/firecfg/main.c index 1e49a2fc7..0e520b0f1 100644 --- a/src/firecfg/main.c +++ b/src/firecfg/main.c | |||
@@ -486,8 +486,9 @@ int main(int argc, char **argv) { | |||
486 | if (arg_debug) | 486 | if (arg_debug) |
487 | printf("%s %d %d %d %d\n", user, getuid(), getgid(), geteuid(), getegid()); | 487 | printf("%s %d %d %d %d\n", user, getuid(), getgid(), geteuid(), getegid()); |
488 | 488 | ||
489 | // fix .desktop files in ~/.local/share/applications directory | 489 | // if runs as regular user, fix .desktop files in ~/.local/share/applications directory |
490 | fix_desktop_files(home); | 490 | if (getuid() != 0) |
491 | fix_desktop_files(home); | ||
491 | 492 | ||
492 | return 0; | 493 | return 0; |
493 | } | 494 | } |
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in index e2d02788d..b9bf13b9c 100644 --- a/src/firejail/Makefile.in +++ b/src/firejail/Makefile.in | |||
@@ -2,11 +2,11 @@ all: firejail | |||
2 | 2 | ||
3 | include ../common.mk | 3 | include ../common.mk |
4 | 4 | ||
5 | %.o : %.c $(H_FILE_LIST) ../include/rundefs.h ../include/common.h ../include/ldd_utils.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall.h ../include/firejail_user.h | 5 | %.o : %.c $(H_FILE_LIST) ../include/rundefs.h ../include/common.h ../include/ldd_utils.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall_i386.h ../include/syscall_x86_64.h ../include/firejail_user.h |
6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | 6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ |
7 | 7 | ||
8 | firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o | 8 | firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o $(LIBS) $(EXTRA_LDFLAGS) | 9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 10 | ||
11 | clean:; rm -fr *.o firejail *.gcov *.gcda *.gcno *.plist | 11 | clean:; rm -fr *.o firejail *.gcov *.gcda *.gcno *.plist |
12 | 12 | ||
diff --git a/src/firejail/arp.c b/src/firejail/arp.c index 3714af9a3..f88d0a1dd 100644 --- a/src/firejail/arp.c +++ b/src/firejail/arp.c | |||
@@ -239,9 +239,7 @@ int arp_check(const char *dev, uint32_t destaddr) { | |||
239 | } | 239 | } |
240 | } | 240 | } |
241 | 241 | ||
242 | // it will never get here! | 242 | __builtin_unreachable(); |
243 | close(sock); | ||
244 | return -1; | ||
245 | } | 243 | } |
246 | 244 | ||
247 | // assign a random IP address and check it | 245 | // assign a random IP address and check it |
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index fbe150b34..f6b3b3252 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -18,6 +18,8 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/seccomp.h" | ||
22 | #include "../include/syscall.h" | ||
21 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
22 | #include <linux/loop.h> | 24 | #include <linux/loop.h> |
23 | 25 | ||
@@ -32,6 +34,7 @@ char *xvfb_screen = "800x600x24"; | |||
32 | char *xvfb_extra_params = ""; | 34 | char *xvfb_extra_params = ""; |
33 | char *netfilter_default = NULL; | 35 | char *netfilter_default = NULL; |
34 | unsigned long join_timeout = 5000000; // microseconds | 36 | unsigned long join_timeout = 5000000; // microseconds |
37 | char *config_seccomp_error_action_str = "EPERM"; | ||
35 | 38 | ||
36 | int checkcfg(int val) { | 39 | int checkcfg(int val) { |
37 | assert(val < CFG_MAX); | 40 | assert(val < CFG_MAX); |
@@ -51,6 +54,8 @@ int checkcfg(int val) { | |||
51 | cfg_val[CFG_DISABLE_MNT] = 0; | 54 | cfg_val[CFG_DISABLE_MNT] = 0; |
52 | cfg_val[CFG_ARP_PROBES] = DEFAULT_ARP_PROBES; | 55 | cfg_val[CFG_ARP_PROBES] = DEFAULT_ARP_PROBES; |
53 | cfg_val[CFG_XPRA_ATTACH] = 0; | 56 | cfg_val[CFG_XPRA_ATTACH] = 0; |
57 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = -1; | ||
58 | cfg_val[CFG_BROWSER_ALLOW_DRM] = 0; | ||
54 | 59 | ||
55 | // open configuration file | 60 | // open configuration file |
56 | const char *fname = SYSCONFDIR "/firejail.config"; | 61 | const char *fname = SYSCONFDIR "/firejail.config"; |
@@ -219,6 +224,26 @@ int checkcfg(int val) { | |||
219 | else if (strncmp(ptr, "join-timeout ", 13) == 0) | 224 | else if (strncmp(ptr, "join-timeout ", 13) == 0) |
220 | join_timeout = strtoul(ptr + 13, NULL, 10) * 1000000; // seconds to microseconds | 225 | join_timeout = strtoul(ptr + 13, NULL, 10) * 1000000; // seconds to microseconds |
221 | 226 | ||
227 | // seccomp error action | ||
228 | else if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { | ||
229 | #ifdef HAVE_SECCOMP | ||
230 | if (strcmp(ptr + 21, "kill") == 0) | ||
231 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = SECCOMP_RET_KILL; | ||
232 | else if (strcmp(ptr + 21, "log") == 0) | ||
233 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = SECCOMP_RET_LOG; | ||
234 | else { | ||
235 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = errno_find_name(ptr + 21); | ||
236 | if (cfg_val[CFG_SECCOMP_ERROR_ACTION] == -1) | ||
237 | errExit("seccomp-error-action: unknown errno"); | ||
238 | } | ||
239 | config_seccomp_error_action_str = strdup(ptr + 21); | ||
240 | if (!config_seccomp_error_action_str) | ||
241 | errExit("strdup"); | ||
242 | #else | ||
243 | warning_feature_disabled("seccomp"); | ||
244 | #endif | ||
245 | } | ||
246 | |||
222 | else | 247 | else |
223 | goto errout; | 248 | goto errout; |
224 | 249 | ||
@@ -330,6 +355,14 @@ void print_compiletime_support(void) { | |||
330 | #endif | 355 | #endif |
331 | ); | 356 | ); |
332 | 357 | ||
358 | printf("\t- SELinux support is %s\n", | ||
359 | #ifdef HAVE_SELINUX | ||
360 | "enabled" | ||
361 | #else | ||
362 | "disabled" | ||
363 | #endif | ||
364 | ); | ||
365 | |||
333 | printf("\t- user namespace support is %s\n", | 366 | printf("\t- user namespace support is %s\n", |
334 | #ifdef HAVE_USERNS | 367 | #ifdef HAVE_USERNS |
335 | "enabled" | 368 | "enabled" |
diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c index cae52e20b..5fc6c8298 100644 --- a/src/firejail/chroot.c +++ b/src/firejail/chroot.c | |||
@@ -165,7 +165,8 @@ void fs_chroot(const char *rootdir) { | |||
165 | close(fd); | 165 | close(fd); |
166 | 166 | ||
167 | // x11 | 167 | // x11 |
168 | if (getenv("FIREJAIL_X11")) { | 168 | // if users want this mount, they should set FIREJAIL_CHROOT_X11 |
169 | if (getenv("FIREJAIL_X11") || getenv("FIREJAIL_CHROOT_X11")) { | ||
169 | if (arg_debug) | 170 | if (arg_debug) |
170 | printf("Mounting /tmp/.X11-unix on chroot /tmp/.X11-unix\n"); | 171 | printf("Mounting /tmp/.X11-unix on chroot /tmp/.X11-unix\n"); |
171 | check_subdir(parentfd, "tmp/.X11-unix", 0); | 172 | check_subdir(parentfd, "tmp/.X11-unix", 0); |
diff --git a/src/firejail/dbus.c b/src/firejail/dbus.c index 7acbd338c..6609e48bd 100644 --- a/src/firejail/dbus.c +++ b/src/firejail/dbus.c | |||
@@ -18,41 +18,531 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | ||
22 | #include <sys/stat.h> | ||
23 | #include <sys/types.h> | ||
24 | #include <sys/wait.h> | ||
25 | #include <errno.h> | ||
26 | #include <unistd.h> | ||
27 | #include <fcntl.h> | ||
28 | #include <string.h> | ||
21 | 29 | ||
22 | void dbus_disable(void) { | 30 | #ifndef O_PATH |
23 | if (!checkcfg(CFG_DBUS)) { | 31 | #define O_PATH 010000000 |
24 | fwarning("D-Bus handling is disabled in Firejail configuration file\n"); | 32 | #endif |
25 | return; | 33 | |
34 | #define DBUS_SOCKET_PATH_PREFIX "unix:path=" | ||
35 | #define DBUS_USER_SOCKET_FORMAT "/run/user/%d/bus" | ||
36 | #define DBUS_USER_SOCKET_FORMAT2 "/run/user/%d/dbus/user_bus_socket" | ||
37 | #define DBUS_SYSTEM_SOCKET "/run/dbus/system_bus_socket" | ||
38 | #define DBUS_SESSION_BUS_ADDRESS_ENV "DBUS_SESSION_BUS_ADDRESS" | ||
39 | #define DBUS_SYSTEM_BUS_ADDRESS_ENV "DBUS_SYSTEM_BUS_ADDRESS" | ||
40 | #define DBUS_USER_DIR_FORMAT RUN_FIREJAIL_DBUS_DIR "/%d" | ||
41 | #define DBUS_USER_PROXY_SOCKET_FORMAT DBUS_USER_DIR_FORMAT "/%d-user" | ||
42 | #define DBUS_SYSTEM_PROXY_SOCKET_FORMAT DBUS_USER_DIR_FORMAT "/%d-system" | ||
43 | #define DBUS_MAX_NAME_LENGTH 255 | ||
44 | #define XDG_DBUS_PROXY_PATH "/usr/bin/xdg-dbus-proxy" | ||
45 | |||
46 | static pid_t dbus_proxy_pid = 0; | ||
47 | static int dbus_proxy_status_fd = -1; | ||
48 | static char *dbus_user_proxy_socket = NULL; | ||
49 | static char *dbus_system_proxy_socket = NULL; | ||
50 | |||
51 | static int check_bus_or_interface_name(const char *name, int hyphens_allowed) { | ||
52 | unsigned long length = strlen(name); | ||
53 | if (length == 0 || length > DBUS_MAX_NAME_LENGTH) | ||
54 | return 0; | ||
55 | const char *p = name; | ||
56 | int segments = 1; | ||
57 | int in_segment = 0; | ||
58 | while (*p) { | ||
59 | int alpha = (*p >= 'a' && *p <= 'z') || (*p >= 'A' && *p <= 'Z'); | ||
60 | int digit = *p >= '0' && *p <= '9'; | ||
61 | if (in_segment) { | ||
62 | if (*p == '.') { | ||
63 | ++segments; | ||
64 | in_segment = 0; | ||
65 | } else if (!alpha && !digit && *p != '_' && (!hyphens_allowed || *p != '-')) { | ||
66 | return 0; | ||
67 | } | ||
68 | } | ||
69 | else { | ||
70 | if (*p == '*') { | ||
71 | return *(p + 1) == '\0'; | ||
72 | } else if (!alpha && *p != '_' && (!hyphens_allowed || *p != '-')) { | ||
73 | return 0; | ||
74 | } | ||
75 | in_segment = 1; | ||
76 | } | ||
77 | ++p; | ||
78 | } | ||
79 | return in_segment && segments >= 2; | ||
80 | } | ||
81 | |||
82 | static int check_object_path(const char *path) { | ||
83 | unsigned long length = strlen(path); | ||
84 | if (length == 0 || path[0] != '/') | ||
85 | return 0; | ||
86 | // The root path "/" is the only path allowed to have a trailing slash. | ||
87 | if (length == 1) | ||
88 | return 1; | ||
89 | const char *p = path + 1; | ||
90 | int segments = 1; | ||
91 | int in_segment = 0; | ||
92 | while (*p) { | ||
93 | int alpha = (*p >= 'a' && *p <= 'z') || (*p >= 'A' && *p <= 'Z'); | ||
94 | int digit = *p >= '0' && *p <= '9'; | ||
95 | if (in_segment) { | ||
96 | if (*p == '/') { | ||
97 | ++segments; | ||
98 | in_segment = 0; | ||
99 | } else if (!alpha && !digit && *p != '_') { | ||
100 | return 0; | ||
101 | } | ||
102 | } | ||
103 | else { | ||
104 | if (*p == '*') { | ||
105 | return *(p + 1) == '\0'; | ||
106 | } else if (!alpha && *p != '_') { | ||
107 | return 0; | ||
108 | } | ||
109 | in_segment = 1; | ||
110 | } | ||
111 | ++p; | ||
26 | } | 112 | } |
113 | return in_segment && segments >= 2; | ||
114 | } | ||
115 | |||
116 | int dbus_check_name(const char *name) { | ||
117 | return check_bus_or_interface_name(name, 1); | ||
118 | } | ||
119 | |||
120 | int dbus_check_call_rule(const char *rule) { | ||
121 | char buf[DBUS_MAX_NAME_LENGTH + 1]; | ||
122 | char *name_end = strchr(rule, '='); | ||
123 | if (name_end == NULL) | ||
124 | return 0; | ||
125 | size_t name_length = (size_t) (name_end - rule); | ||
126 | if (name_length > DBUS_MAX_NAME_LENGTH) | ||
127 | return 0; | ||
128 | strncpy(buf, rule, (size_t) name_length); | ||
129 | buf[name_length] = '\0'; | ||
130 | if (!dbus_check_name(buf)) | ||
131 | return 0; | ||
132 | ++name_end; | ||
133 | char *interface_end = strchr(name_end, '@'); | ||
134 | if (interface_end == NULL) | ||
135 | return check_bus_or_interface_name(name_end, 0); | ||
136 | size_t interface_length = (size_t) (interface_end - name_end); | ||
137 | if (interface_length > DBUS_MAX_NAME_LENGTH) | ||
138 | return 0; | ||
139 | if (interface_length > 0) { | ||
140 | strncpy(buf, name_end, interface_length); | ||
141 | buf[interface_length] = '\0'; | ||
142 | if (!check_bus_or_interface_name(buf, 0)) | ||
143 | return 0; | ||
144 | } | ||
145 | return check_object_path(interface_end + 1); | ||
146 | } | ||
147 | |||
148 | static void dbus_check_bus_profile(char const *prefix, DbusPolicy *policy) { | ||
149 | if (*policy == DBUS_POLICY_FILTER) { | ||
150 | struct stat s; | ||
151 | if (stat(XDG_DBUS_PROXY_PATH, &s) == -1) { | ||
152 | if (errno == ENOENT) { | ||
153 | fprintf(stderr, | ||
154 | "Warning: " XDG_DBUS_PROXY_PATH | ||
155 | " was not found, downgrading %s policy to allow.\n" | ||
156 | "To enable DBus filtering, install the xdg-dbus-proxy " | ||
157 | "program.\n", prefix); | ||
158 | *policy = DBUS_POLICY_ALLOW; | ||
159 | } else { | ||
160 | errExit("stat"); | ||
161 | } | ||
162 | } else { | ||
163 | // No need to warn on profile entries. | ||
164 | return; | ||
165 | } | ||
166 | } | ||
167 | |||
168 | size_t prefix_length = strlen(prefix); | ||
169 | ProfileEntry *it = cfg.profile; | ||
170 | int num_matches = 0; | ||
171 | const char *first_match = NULL; | ||
172 | while (it) { | ||
173 | char *data = it->data; | ||
174 | it = it->next; | ||
175 | if (strncmp(prefix, data, prefix_length) == 0) { | ||
176 | ++num_matches; | ||
177 | if (first_match == NULL) | ||
178 | first_match = data; | ||
179 | } | ||
180 | } | ||
181 | |||
182 | if (num_matches > 0) { | ||
183 | assert(first_match != NULL); | ||
184 | if (num_matches == 1) { | ||
185 | fprintf(stderr, "Ignoring \"%s\".\n", first_match); | ||
186 | } else if (num_matches == 2) { | ||
187 | fprintf(stderr, "Ignoring \"%s\" and 1 other %s filter rule.\n", | ||
188 | first_match, prefix); | ||
189 | } else { | ||
190 | fprintf(stderr, "Ignoring \"%s\" and %d other %s filter rules.\n", | ||
191 | first_match, num_matches - 1, prefix); | ||
192 | } | ||
193 | } | ||
194 | } | ||
27 | 195 | ||
196 | void dbus_check_profile(void) { | ||
197 | dbus_check_bus_profile("dbus-user", &arg_dbus_user); | ||
198 | dbus_check_bus_profile("dbus-system", &arg_dbus_system); | ||
199 | } | ||
200 | |||
201 | static void write_arg(int fd, char const *format, ...) { | ||
202 | va_list ap; | ||
203 | va_start(ap, format); | ||
204 | char *arg; | ||
205 | int length = vasprintf(&arg, format, ap); | ||
206 | va_end(ap); | ||
207 | if (length == -1) | ||
208 | errExit("vasprintf"); | ||
209 | length++; | ||
210 | if (arg_debug) | ||
211 | printf("xdg-dbus-proxy arg: %s\n", arg); | ||
212 | if (write(fd, arg, (size_t) length) != (ssize_t) length) | ||
213 | errExit("write"); | ||
214 | free(arg); | ||
215 | } | ||
216 | |||
217 | static void write_profile(int fd, char const *prefix) { | ||
218 | size_t prefix_length = strlen(prefix); | ||
219 | ProfileEntry *it = cfg.profile; | ||
220 | while (it) { | ||
221 | char *data = it->data; | ||
222 | it = it->next; | ||
223 | if (strncmp(prefix, data, prefix_length) != 0) | ||
224 | continue; | ||
225 | data += prefix_length; | ||
226 | int arg_length = 0; | ||
227 | while (data[arg_length] != '\0' && data[arg_length] != ' ') | ||
228 | arg_length++; | ||
229 | if (data[arg_length] != ' ') | ||
230 | continue; | ||
231 | write_arg(fd, "--%.*s=%s", arg_length, data, &data[arg_length + 1]); | ||
232 | } | ||
233 | } | ||
234 | |||
235 | static void dbus_create_user_dir(void) { | ||
28 | char *path; | 236 | char *path; |
29 | if (asprintf(&path, "/run/user/%d/bus", getuid()) == -1) | 237 | if (asprintf(&path, DBUS_USER_DIR_FORMAT, (int) getuid()) == -1) |
238 | errExit("asprintf"); | ||
239 | struct stat s; | ||
240 | mode_t mode = 0700; | ||
241 | uid_t uid = getuid(); | ||
242 | gid_t gid = getgid(); | ||
243 | if (stat(path, &s)) { | ||
244 | if (arg_debug) | ||
245 | printf("Creating %s directory for DBus proxy sockets\n", path); | ||
246 | if (mkdir(path, mode) == -1 && errno != EEXIST) | ||
247 | errExit("mkdir"); | ||
248 | if (set_perms(path, uid, gid, mode)) | ||
249 | errExit("set_perms"); | ||
250 | ASSERT_PERMS(path, uid, gid, mode); | ||
251 | } | ||
252 | free(path); | ||
253 | } | ||
254 | |||
255 | static char *find_user_socket_by_format(char *format) { | ||
256 | char *dbus_user_socket; | ||
257 | if (asprintf(&dbus_user_socket, format, (int) getuid()) == -1) | ||
30 | errExit("asprintf"); | 258 | errExit("asprintf"); |
31 | char *env_var; | 259 | struct stat s; |
32 | if (asprintf(&env_var, "unix:path=%s", path) == -1) | 260 | if (stat(dbus_user_socket, &s) == -1) { |
261 | if (errno == ENOENT) | ||
262 | goto fail; | ||
263 | return NULL; | ||
264 | errExit("stat"); | ||
265 | } | ||
266 | if (!S_ISSOCK(s.st_mode)) | ||
267 | goto fail; | ||
268 | return dbus_user_socket; | ||
269 | fail: | ||
270 | free(dbus_user_socket); | ||
271 | return NULL; | ||
272 | } | ||
273 | |||
274 | static char *find_user_socket(void) { | ||
275 | char *socket1 = find_user_socket_by_format(DBUS_USER_SOCKET_FORMAT); | ||
276 | if (socket1 != NULL) | ||
277 | return socket1; | ||
278 | char *socket2 = find_user_socket_by_format(DBUS_USER_SOCKET_FORMAT2); | ||
279 | if (socket2 != NULL) | ||
280 | return socket2; | ||
281 | fprintf(stderr, "DBus user socket was not found.\n"); | ||
282 | exit(1); | ||
283 | } | ||
284 | |||
285 | void dbus_proxy_start(void) { | ||
286 | dbus_create_user_dir(); | ||
287 | |||
288 | EUID_USER(); | ||
289 | |||
290 | int status_pipe[2]; | ||
291 | if (pipe(status_pipe) == -1) | ||
292 | errExit("pipe"); | ||
293 | dbus_proxy_status_fd = status_pipe[0]; | ||
294 | |||
295 | int args_pipe[2]; | ||
296 | if (pipe(args_pipe) == -1) | ||
297 | errExit("pipe"); | ||
298 | |||
299 | dbus_proxy_pid = fork(); | ||
300 | if (dbus_proxy_pid == -1) | ||
301 | errExit("fork"); | ||
302 | if (dbus_proxy_pid == 0) { | ||
303 | int i; | ||
304 | for (i = STDERR_FILENO + 1; i < FIREJAIL_MAX_FD; i++) { | ||
305 | if (i != status_pipe[1] && i != args_pipe[0]) | ||
306 | close(i); // close open files | ||
307 | } | ||
308 | if (arg_dbus_log_file != NULL) { | ||
309 | int output_fd = creat(arg_dbus_log_file, 0666); | ||
310 | if (output_fd < 0) | ||
311 | errExit("creat"); | ||
312 | if (output_fd != STDOUT_FILENO) { | ||
313 | if (dup2(output_fd, STDOUT_FILENO) != STDOUT_FILENO) | ||
314 | errExit("dup2"); | ||
315 | close(output_fd); | ||
316 | } | ||
317 | } | ||
318 | close(STDIN_FILENO); | ||
319 | char *args[4] = {XDG_DBUS_PROXY_PATH, NULL, NULL, NULL}; | ||
320 | if (asprintf(&args[1], "--fd=%d", status_pipe[1]) == -1 | ||
321 | || asprintf(&args[2], "--args=%d", args_pipe[0]) == -1) | ||
322 | errExit("asprintf"); | ||
323 | if (arg_debug) | ||
324 | printf("starting xdg-dbus-proxy\n"); | ||
325 | sbox_exec_v(SBOX_USER | SBOX_SECCOMP | SBOX_CAPS_NONE | SBOX_KEEP_FDS, args); | ||
326 | } else { | ||
327 | if (close(status_pipe[1]) == -1 || close(args_pipe[0]) == -1) | ||
328 | errExit("close"); | ||
329 | |||
330 | if (arg_dbus_user == DBUS_POLICY_FILTER) { | ||
331 | char *user_env = getenv(DBUS_SESSION_BUS_ADDRESS_ENV); | ||
332 | if (user_env == NULL) { | ||
333 | char *dbus_user_socket = find_user_socket(); | ||
334 | write_arg(args_pipe[1], DBUS_SOCKET_PATH_PREFIX "%s", | ||
335 | dbus_user_socket); | ||
336 | free(dbus_user_socket); | ||
337 | } else { | ||
338 | write_arg(args_pipe[1], "%s", user_env); | ||
339 | } | ||
340 | if (asprintf(&dbus_user_proxy_socket, DBUS_USER_PROXY_SOCKET_FORMAT, | ||
341 | (int) getuid(), (int) getpid()) == -1) | ||
342 | errExit("asprintf"); | ||
343 | write_arg(args_pipe[1], "%s", dbus_user_proxy_socket); | ||
344 | if (arg_dbus_log_user) { | ||
345 | write_arg(args_pipe[1], "--log"); | ||
346 | } | ||
347 | write_arg(args_pipe[1], "--filter"); | ||
348 | write_profile(args_pipe[1], "dbus-user."); | ||
349 | } | ||
350 | |||
351 | if (arg_dbus_system == DBUS_POLICY_FILTER) { | ||
352 | char *system_env = getenv(DBUS_SYSTEM_BUS_ADDRESS_ENV); | ||
353 | if (system_env == NULL) { | ||
354 | write_arg(args_pipe[1], | ||
355 | DBUS_SOCKET_PATH_PREFIX DBUS_SYSTEM_SOCKET); | ||
356 | } else { | ||
357 | write_arg(args_pipe[1], "%s", system_env); | ||
358 | } | ||
359 | if (asprintf(&dbus_system_proxy_socket, DBUS_SYSTEM_PROXY_SOCKET_FORMAT, | ||
360 | (int) getuid(), (int) getpid()) == -1) | ||
361 | errExit("asprintf"); | ||
362 | write_arg(args_pipe[1], "%s", dbus_system_proxy_socket); | ||
363 | if (arg_dbus_log_system) { | ||
364 | write_arg(args_pipe[1], "--log"); | ||
365 | } | ||
366 | write_arg(args_pipe[1], "--filter"); | ||
367 | write_profile(args_pipe[1], "dbus-system."); | ||
368 | } | ||
369 | |||
370 | if (close(args_pipe[1]) == -1) | ||
371 | errExit("close"); | ||
372 | char buf[1]; | ||
373 | ssize_t read_bytes = read(status_pipe[0], buf, 1); | ||
374 | switch (read_bytes) { | ||
375 | case -1: | ||
376 | errExit("read"); | ||
377 | break; | ||
378 | case 0: | ||
379 | fprintf(stderr, "xdg-dbus-proxy closed pipe unexpectedly\n"); | ||
380 | // Wait for the subordinate process to write any errors to stderr and exit. | ||
381 | waitpid(dbus_proxy_pid, NULL, 0); | ||
382 | exit(-1); | ||
383 | break; | ||
384 | case 1: | ||
385 | if (arg_debug) | ||
386 | printf("xdg-dbus-proxy initialized\n"); | ||
387 | break; | ||
388 | default: | ||
389 | assert(0); | ||
390 | } | ||
391 | } | ||
392 | } | ||
393 | |||
394 | void dbus_proxy_stop(void) { | ||
395 | if (dbus_proxy_pid == 0) | ||
396 | return; | ||
397 | assert(dbus_proxy_status_fd >= 0); | ||
398 | if (close(dbus_proxy_status_fd) == -1) | ||
399 | errExit("close"); | ||
400 | int status; | ||
401 | if (waitpid(dbus_proxy_pid, &status, 0) == -1) | ||
402 | errExit("waitpid"); | ||
403 | if (WIFEXITED(status) && WEXITSTATUS(status) != 0) | ||
404 | fwarning("xdg-dbus-proxy returned %s\n", WEXITSTATUS(status)); | ||
405 | dbus_proxy_pid = 0; | ||
406 | dbus_proxy_status_fd = -1; | ||
407 | if (dbus_user_proxy_socket != NULL) { | ||
408 | free(dbus_user_proxy_socket); | ||
409 | dbus_user_proxy_socket = NULL; | ||
410 | } | ||
411 | if (dbus_system_proxy_socket != NULL) { | ||
412 | free(dbus_system_proxy_socket); | ||
413 | dbus_system_proxy_socket = NULL; | ||
414 | } | ||
415 | } | ||
416 | |||
417 | static void socket_overlay(char *socket_path, char *proxy_path) { | ||
418 | int fd = safe_fd(proxy_path, O_PATH | O_NOFOLLOW | O_CLOEXEC); | ||
419 | if (fd == -1) | ||
420 | errExit("opening DBus proxy socket"); | ||
421 | struct stat s; | ||
422 | if (fstat(fd, &s) == -1) | ||
423 | errExit("fstat"); | ||
424 | if (!S_ISSOCK(s.st_mode)) { | ||
425 | errno = ENOTSOCK; | ||
426 | errExit("mounting DBus proxy socket"); | ||
427 | } | ||
428 | char *proxy_fd_path; | ||
429 | if (asprintf(&proxy_fd_path, "/proc/self/fd/%d", fd) == -1) | ||
33 | errExit("asprintf"); | 430 | errExit("asprintf"); |
431 | if (mount(proxy_path, socket_path, NULL, MS_BIND | MS_REC, NULL) == -1) | ||
432 | errExit("mount bind"); | ||
433 | free(proxy_fd_path); | ||
434 | close(fd); | ||
435 | } | ||
34 | 436 | ||
35 | // set a new environment variable: DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/<UID>/bus | 437 | static char *get_socket_env(const char *name) { |
36 | if (setenv("DBUS_SESSION_BUS_ADDRESS", env_var, 1) == -1) { | 438 | char *value = getenv(name); |
37 | fprintf(stderr, "Error: cannot modify DBUS_SESSION_BUS_ADDRESS required by --nodbus\n"); | 439 | if (value == NULL) |
440 | return NULL; | ||
441 | if (strncmp(value, DBUS_SOCKET_PATH_PREFIX, | ||
442 | strlen(DBUS_SOCKET_PATH_PREFIX)) == 0) | ||
443 | return value + strlen(DBUS_SOCKET_PATH_PREFIX); | ||
444 | return NULL; | ||
445 | } | ||
446 | |||
447 | void dbus_set_session_bus_env(void) { | ||
448 | if (setenv(DBUS_SESSION_BUS_ADDRESS_ENV, | ||
449 | DBUS_SOCKET_PATH_PREFIX RUN_DBUS_USER_SOCKET, 1) == -1) { | ||
450 | fprintf(stderr, "Error: cannot modify " DBUS_SESSION_BUS_ADDRESS_ENV | ||
451 | " required by --dbus-user\n"); | ||
38 | exit(1); | 452 | exit(1); |
39 | } | 453 | } |
454 | } | ||
40 | 455 | ||
41 | // blacklist the path | 456 | void dbus_set_system_bus_env(void) { |
42 | disable_file_or_dir(path); | 457 | if (setenv(DBUS_SYSTEM_BUS_ADDRESS_ENV, |
43 | free(path); | 458 | DBUS_SOCKET_PATH_PREFIX RUN_DBUS_SYSTEM_SOCKET, 1) == -1) { |
44 | free(env_var); | 459 | fprintf(stderr, "Error: cannot modify " DBUS_SYSTEM_BUS_ADDRESS_ENV |
460 | " required by --dbus-system\n"); | ||
461 | exit(1); | ||
462 | } | ||
463 | } | ||
45 | 464 | ||
465 | static void disable_socket_dir(void) { | ||
466 | struct stat s; | ||
467 | if (stat(RUN_FIREJAIL_DBUS_DIR, &s) == 0) | ||
468 | disable_file_or_dir(RUN_FIREJAIL_DBUS_DIR); | ||
469 | } | ||
46 | 470 | ||
47 | // blacklist the dbus-launch user directory | 471 | void dbus_apply_policy(void) { |
48 | if (asprintf(&path, "%s/.dbus", cfg.homedir) == -1) | 472 | EUID_ROOT(); |
49 | errExit("asprintf"); | ||
50 | disable_file_or_dir(path); | ||
51 | free(path); | ||
52 | 473 | ||
53 | // blacklist also system D-Bus socket | 474 | if (arg_dbus_user == DBUS_POLICY_ALLOW && arg_dbus_system == DBUS_POLICY_ALLOW) { |
54 | disable_file_or_dir("/run/dbus/system_bus_socket"); | 475 | disable_socket_dir(); |
476 | return; | ||
477 | } | ||
478 | |||
479 | if (!checkcfg(CFG_DBUS)) { | ||
480 | disable_socket_dir(); | ||
481 | fwarning("D-Bus handling is disabled in Firejail configuration file\n"); | ||
482 | return; | ||
483 | } | ||
484 | |||
485 | create_empty_dir_as_root(RUN_DBUS_DIR, 0755); | ||
486 | |||
487 | if (arg_dbus_user != DBUS_POLICY_ALLOW) { | ||
488 | create_empty_file_as_root(RUN_DBUS_USER_SOCKET, 0700); | ||
489 | |||
490 | if (arg_dbus_user == DBUS_POLICY_FILTER) { | ||
491 | assert(dbus_user_proxy_socket != NULL); | ||
492 | socket_overlay(RUN_DBUS_USER_SOCKET, dbus_user_proxy_socket); | ||
493 | free(dbus_user_proxy_socket); | ||
494 | } | ||
495 | |||
496 | char *dbus_user_socket; | ||
497 | if (asprintf(&dbus_user_socket, DBUS_USER_SOCKET_FORMAT, | ||
498 | (int) getuid()) == -1) | ||
499 | errExit("asprintf"); | ||
500 | disable_file_or_dir(dbus_user_socket); | ||
501 | |||
502 | char *dbus_user_socket2; | ||
503 | if (asprintf(&dbus_user_socket2, DBUS_USER_SOCKET_FORMAT2, | ||
504 | (int) getuid()) == -1) | ||
505 | errExit("asprintf"); | ||
506 | disable_file_or_dir(dbus_user_socket2); | ||
507 | |||
508 | char *user_env = get_socket_env(DBUS_SESSION_BUS_ADDRESS_ENV); | ||
509 | if (user_env != NULL && strcmp(user_env, dbus_user_socket) != 0 && | ||
510 | strcmp(user_env, dbus_user_socket2) != 0) | ||
511 | disable_file_or_dir(user_env); | ||
512 | |||
513 | free(dbus_user_socket); | ||
514 | free(dbus_user_socket2); | ||
515 | |||
516 | dbus_set_session_bus_env(); | ||
517 | |||
518 | // blacklist the dbus-launch user directory | ||
519 | char *path; | ||
520 | if (asprintf(&path, "%s/.dbus", cfg.homedir) == -1) | ||
521 | errExit("asprintf"); | ||
522 | disable_file_or_dir(path); | ||
523 | free(path); | ||
524 | } | ||
525 | |||
526 | if (arg_dbus_system != DBUS_POLICY_ALLOW) { | ||
527 | create_empty_file_as_root(RUN_DBUS_SYSTEM_SOCKET, 0700); | ||
528 | |||
529 | if (arg_dbus_system == DBUS_POLICY_FILTER) { | ||
530 | assert(dbus_system_proxy_socket != NULL); | ||
531 | socket_overlay(RUN_DBUS_SYSTEM_SOCKET, dbus_system_proxy_socket); | ||
532 | free(dbus_system_proxy_socket); | ||
533 | } | ||
534 | |||
535 | disable_file_or_dir(DBUS_SYSTEM_SOCKET); | ||
536 | |||
537 | char *system_env = get_socket_env(DBUS_SYSTEM_BUS_ADDRESS_ENV); | ||
538 | if (system_env != NULL && strcmp(system_env, DBUS_SYSTEM_SOCKET) != 0) | ||
539 | disable_file_or_dir(system_env); | ||
540 | |||
541 | dbus_set_system_bus_env(); | ||
542 | } | ||
55 | 543 | ||
544 | // Only disable access to /run/firejail/dbus here, when the sockets have been bind-mounted. | ||
545 | disable_socket_dir(); | ||
56 | 546 | ||
57 | // look for a possible abstract unix socket | 547 | // look for a possible abstract unix socket |
58 | 548 | ||
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 66328a55e..c98f80d13 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -182,10 +182,11 @@ typedef struct config_t { | |||
182 | char *dns4; | 182 | char *dns4; |
183 | 183 | ||
184 | // seccomp | 184 | // seccomp |
185 | char *seccomp_list;// optional seccomp list on top of default filter | 185 | char *seccomp_list, *seccomp_list32; // optional seccomp list on top of default filter |
186 | char *seccomp_list_drop; // seccomp drop list | 186 | char *seccomp_list_drop, *seccomp_list_drop32; // seccomp drop list |
187 | char *seccomp_list_keep; // seccomp keep list | 187 | char *seccomp_list_keep, *seccomp_list_keep32; // seccomp keep list |
188 | char *protocol; // protocol list | 188 | char *protocol; // protocol list |
189 | char *seccomp_error_action; // error action: kill, log or errno | ||
189 | 190 | ||
190 | // rlimits | 191 | // rlimits |
191 | long long unsigned rlimit_cpu; | 192 | long long unsigned rlimit_cpu; |
@@ -270,6 +271,7 @@ extern int arg_overlay_keep; // place overlay diff in a known directory | |||
270 | extern int arg_overlay_reuse; // allow the reuse of overlays | 271 | extern int arg_overlay_reuse; // allow the reuse of overlays |
271 | 272 | ||
272 | extern int arg_seccomp; // enable default seccomp filter | 273 | extern int arg_seccomp; // enable default seccomp filter |
274 | extern int arg_seccomp32; // enable default seccomp filter for 32 bit arch | ||
273 | extern int arg_seccomp_postexec; // need postexec ld.preload library? | 275 | extern int arg_seccomp_postexec; // need postexec ld.preload library? |
274 | extern int arg_seccomp_block_secondary; // block any secondary architectures | 276 | extern int arg_seccomp_block_secondary; // block any secondary architectures |
275 | 277 | ||
@@ -338,9 +340,19 @@ extern int arg_memory_deny_write_execute; // block writable and executable memor | |||
338 | extern int arg_notv; // --notv | 340 | extern int arg_notv; // --notv |
339 | extern int arg_nodvd; // --nodvd | 341 | extern int arg_nodvd; // --nodvd |
340 | extern int arg_nou2f; // --nou2f | 342 | extern int arg_nou2f; // --nou2f |
341 | extern int arg_nodbus; // -nodbus | ||
342 | extern int arg_deterministic_exit_code; // always exit with first child's exit status | 343 | extern int arg_deterministic_exit_code; // always exit with first child's exit status |
343 | 344 | ||
345 | typedef enum { | ||
346 | DBUS_POLICY_ALLOW, // Allow unrestricted access to the bus | ||
347 | DBUS_POLICY_FILTER, // Filter with xdg-dbus-proxy | ||
348 | DBUS_POLICY_BLOCK // Block access | ||
349 | } DbusPolicy; | ||
350 | extern DbusPolicy arg_dbus_user; // --dbus-user | ||
351 | extern DbusPolicy arg_dbus_system; // --dbus-system | ||
352 | extern int arg_dbus_log_user; | ||
353 | extern int arg_dbus_log_system; | ||
354 | extern const char *arg_dbus_log_file; | ||
355 | |||
344 | extern int login_shell; | 356 | extern int login_shell; |
345 | extern int parent_to_child_fds[2]; | 357 | extern int parent_to_child_fds[2]; |
346 | extern int child_to_parent_fds[2]; | 358 | extern int child_to_parent_fds[2]; |
@@ -349,6 +361,7 @@ extern mode_t orig_umask; | |||
349 | extern unsigned long long start_timestamp; | 361 | extern unsigned long long start_timestamp; |
350 | 362 | ||
351 | #define MAX_ARGS 128 // maximum number of command arguments (argc) | 363 | #define MAX_ARGS 128 // maximum number of command arguments (argc) |
364 | #define MAX_ARG_LEN (PATH_MAX + 32) // --foobar=PATH | ||
352 | extern char *fullargv[MAX_ARGS]; | 365 | extern char *fullargv[MAX_ARGS]; |
353 | extern int fullargc; | 366 | extern int fullargc; |
354 | 367 | ||
@@ -358,13 +371,14 @@ char *guess_shell(void); | |||
358 | 371 | ||
359 | // sandbox.c | 372 | // sandbox.c |
360 | int sandbox(void* sandbox_arg); | 373 | int sandbox(void* sandbox_arg); |
361 | void start_application(int no_sandbox, FILE *fp); | 374 | void start_application(int no_sandbox, FILE *fp) __attribute__((noreturn)); |
375 | void set_apparmor(void); | ||
362 | 376 | ||
363 | // network_main.c | 377 | // network_main.c |
364 | void net_configure_sandbox_ip(Bridge *br); | 378 | void net_configure_sandbox_ip(Bridge *br); |
365 | void net_configure_veth_pair(Bridge *br, const char *ifname, pid_t child); | 379 | void net_configure_veth_pair(Bridge *br, const char *ifname, pid_t child); |
366 | void net_check_cfg(void); | 380 | void net_check_cfg(void); |
367 | void net_dns_print(pid_t pid); | 381 | void net_dns_print(pid_t pid) __attribute__((noreturn)); |
368 | void network_main(pid_t child); | 382 | void network_main(pid_t child); |
369 | void net_print(pid_t pid); | 383 | void net_print(pid_t pid); |
370 | 384 | ||
@@ -394,6 +408,7 @@ typedef enum { | |||
394 | MOUNT_TMPFS, | 408 | MOUNT_TMPFS, |
395 | MOUNT_NOEXEC, | 409 | MOUNT_NOEXEC, |
396 | MOUNT_RDWR, | 410 | MOUNT_RDWR, |
411 | MOUNT_RDWR_NOCHECK, // no check of ownership | ||
397 | OPERATION_MAX | 412 | OPERATION_MAX |
398 | } OPERATION; | 413 | } OPERATION; |
399 | 414 | ||
@@ -402,8 +417,7 @@ void fs_blacklist(void); | |||
402 | // mount a writable tmpfs | 417 | // mount a writable tmpfs |
403 | void fs_tmpfs(const char *dir, unsigned check_owner); | 418 | void fs_tmpfs(const char *dir, unsigned check_owner); |
404 | // remount noexec/nodev/nosuid or read-only or read-write | 419 | // remount noexec/nodev/nosuid or read-only or read-write |
405 | void fs_remount(const char *dir, OPERATION op, unsigned check_mnt); | 420 | void fs_remount(const char *dir, OPERATION op, int rec); |
406 | void fs_remount_rec(const char *dir, OPERATION op, unsigned check_mnt); | ||
407 | // mount /proc and /sys directories | 421 | // mount /proc and /sys directories |
408 | void fs_proc_sys_dev_boot(void); | 422 | void fs_proc_sys_dev_boot(void); |
409 | // blacklist firejail configuration and runtime directories | 423 | // blacklist firejail configuration and runtime directories |
@@ -439,13 +453,12 @@ void profile_add_ignore(const char *str); | |||
439 | void list(void); | 453 | void list(void); |
440 | void tree(void); | 454 | void tree(void); |
441 | void top(void); | 455 | void top(void); |
442 | void netstats(void); | ||
443 | 456 | ||
444 | // usage.c | 457 | // usage.c |
445 | void usage(void); | 458 | void usage(void); |
446 | 459 | ||
447 | // join.c | 460 | // join.c |
448 | void join(pid_t pid, int argc, char **argv, int index); | 461 | void join(pid_t pid, int argc, char **argv, int index) __attribute__((noreturn)); |
449 | bool is_ready_for_join(const pid_t pid); | 462 | bool is_ready_for_join(const pid_t pid); |
450 | void check_join_permission(pid_t pid); | 463 | void check_join_permission(pid_t pid); |
451 | pid_t switch_to_child(pid_t pid); | 464 | pid_t switch_to_child(pid_t pid); |
@@ -472,7 +485,7 @@ int macro_id(const char *name); | |||
472 | 485 | ||
473 | 486 | ||
474 | // util.c | 487 | // util.c |
475 | void errLogExit(char* fmt, ...); | 488 | void errLogExit(char* fmt, ...) __attribute__((noreturn)); |
476 | void fwarning(char* fmt, ...); | 489 | void fwarning(char* fmt, ...); |
477 | void fmessage(char* fmt, ...); | 490 | void fmessage(char* fmt, ...); |
478 | void drop_privs(int nogroups); | 491 | void drop_privs(int nogroups); |
@@ -567,9 +580,10 @@ void fs_private_home_list(void); | |||
567 | char *seccomp_check_list(const char *str); | 580 | char *seccomp_check_list(const char *str); |
568 | int seccomp_install_filters(void); | 581 | int seccomp_install_filters(void); |
569 | int seccomp_load(const char *fname); | 582 | int seccomp_load(const char *fname); |
570 | int seccomp_filter_drop(void); | 583 | int seccomp_filter_drop(bool native); |
571 | int seccomp_filter_keep(void); | 584 | int seccomp_filter_keep(bool native); |
572 | void seccomp_print_filter(pid_t pid); | 585 | int seccomp_filter_mdwx(bool native); |
586 | void seccomp_print_filter(pid_t pid) __attribute__((noreturn)); | ||
573 | 587 | ||
574 | // caps.c | 588 | // caps.c |
575 | void seccomp_load_file_list(void); | 589 | void seccomp_load_file_list(void); |
@@ -580,7 +594,7 @@ void caps_set(uint64_t caps); | |||
580 | void caps_check_list(const char *clist, void (*callback)(int)); | 594 | void caps_check_list(const char *clist, void (*callback)(int)); |
581 | void caps_drop_list(const char *clist); | 595 | void caps_drop_list(const char *clist); |
582 | void caps_keep_list(const char *clist); | 596 | void caps_keep_list(const char *clist); |
583 | void caps_print_filter(pid_t pid); | 597 | void caps_print_filter(pid_t pid) __attribute__((noreturn)); |
584 | void caps_drop_dac_override(void); | 598 | void caps_drop_dac_override(void); |
585 | 599 | ||
586 | // fs_trace.c | 600 | // fs_trace.c |
@@ -603,7 +617,7 @@ void read_cpu_list(const char *str); | |||
603 | void set_cpu_affinity(void); | 617 | void set_cpu_affinity(void); |
604 | void load_cpu(const char *fname); | 618 | void load_cpu(const char *fname); |
605 | void save_cpu(void); | 619 | void save_cpu(void); |
606 | void cpu_print_filter(pid_t pid); | 620 | void cpu_print_filter(pid_t pid) __attribute__((noreturn)); |
607 | 621 | ||
608 | // cgroup.c | 622 | // cgroup.c |
609 | void save_cgroup(void); | 623 | void save_cgroup(void); |
@@ -625,7 +639,7 @@ void netns(const char *nsname); | |||
625 | void netns_mounts(const char *nsname); | 639 | void netns_mounts(const char *nsname); |
626 | 640 | ||
627 | // bandwidth.c | 641 | // bandwidth.c |
628 | void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, int up); | 642 | void bandwidth_pid(pid_t pid, const char *command, const char *dev, int down, int up) __attribute__((noreturn)); |
629 | void network_set_run_file(pid_t pid); | 643 | void network_set_run_file(pid_t pid); |
630 | 644 | ||
631 | // fs_etc.c | 645 | // fs_etc.c |
@@ -635,8 +649,10 @@ void fs_private_dir_list(const char *private_dir, const char *private_run_dir, c | |||
635 | // no_sandbox.c | 649 | // no_sandbox.c |
636 | int check_namespace_virt(void); | 650 | int check_namespace_virt(void); |
637 | int check_kernel_procs(void); | 651 | int check_kernel_procs(void); |
638 | void run_no_sandbox(int argc, char **argv); | 652 | void run_no_sandbox(int argc, char **argv) __attribute__((noreturn)); |
639 | 653 | ||
654 | #define MAX_ENVS 256 // some sane maximum number of environment variables | ||
655 | #define MAX_ENV_LEN (PATH_MAX + 32) // FOOBAR=SOME_PATH | ||
640 | // env.c | 656 | // env.c |
641 | typedef enum { | 657 | typedef enum { |
642 | SETENV = 0, | 658 | SETENV = 0, |
@@ -664,7 +680,7 @@ void fs_private_lib(void); | |||
664 | // protocol.c | 680 | // protocol.c |
665 | void protocol_filter_save(void); | 681 | void protocol_filter_save(void); |
666 | void protocol_filter_load(const char *fname); | 682 | void protocol_filter_load(const char *fname); |
667 | void protocol_print_filter(pid_t pid); | 683 | void protocol_print_filter(pid_t pid) __attribute__((noreturn)); |
668 | 684 | ||
669 | // restrict_users.c | 685 | // restrict_users.c |
670 | void restrict_users(void); | 686 | void restrict_users(void); |
@@ -676,7 +692,7 @@ void fs_logger2int(const char *msg1, int d); | |||
676 | void fs_logger3(const char *msg1, const char *msg2, const char *msg3); | 692 | void fs_logger3(const char *msg1, const char *msg2, const char *msg3); |
677 | void fs_logger_print(void); | 693 | void fs_logger_print(void); |
678 | void fs_logger_change_owner(void); | 694 | void fs_logger_change_owner(void); |
679 | void fs_logger_print_log(pid_t pid); | 695 | void fs_logger_print_log(pid_t pid) __attribute__((noreturn)); |
680 | 696 | ||
681 | // run_symlink.c | 697 | // run_symlink.c |
682 | void run_symlink(int argc, char **argv, int run_as_is); | 698 | void run_symlink(int argc, char **argv, int run_as_is); |
@@ -702,11 +718,11 @@ void fs_mkfile(const char *name); | |||
702 | 718 | ||
703 | void fs_x11(void); | 719 | void fs_x11(void); |
704 | int x11_display(void); | 720 | int x11_display(void); |
705 | void x11_start(int argc, char **argv); | 721 | void x11_start(int argc, char **argv) __attribute__((noreturn)); |
706 | void x11_start_xpra(int argc, char **argv); | 722 | void x11_start_xpra(int argc, char **argv) __attribute__((noreturn)); |
707 | void x11_start_xephyr(int argc, char **argv); | 723 | void x11_start_xephyr(int argc, char **argv) __attribute__((noreturn)); |
708 | void x11_block(void); | 724 | void x11_block(void); |
709 | void x11_start_xvfb(int argc, char **argv); | 725 | void x11_start_xvfb(int argc, char **argv) __attribute__((noreturn)); |
710 | void x11_xorg(void); | 726 | void x11_xorg(void); |
711 | 727 | ||
712 | // ls.c | 728 | // ls.c |
@@ -716,7 +732,7 @@ enum { | |||
716 | SANDBOX_FS_PUT, | 732 | SANDBOX_FS_PUT, |
717 | SANDBOX_FS_MAX // this should always be the last entry | 733 | SANDBOX_FS_MAX // this should always be the last entry |
718 | }; | 734 | }; |
719 | void sandboxfs(int op, pid_t pid, const char *path1, const char *path2); | 735 | void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) __attribute__((noreturn)); |
720 | 736 | ||
721 | // checkcfg.c | 737 | // checkcfg.c |
722 | #define DEFAULT_ARP_PROBES 2 | 738 | #define DEFAULT_ARP_PROBES 2 |
@@ -749,6 +765,7 @@ enum { | |||
749 | CFG_PRIVATE_CACHE, | 765 | CFG_PRIVATE_CACHE, |
750 | CFG_CGROUP, | 766 | CFG_CGROUP, |
751 | CFG_NAME_CHANGE, | 767 | CFG_NAME_CHANGE, |
768 | CFG_SECCOMP_ERROR_ACTION, | ||
752 | // CFG_FILE_COPY_LIMIT - file copy limit handled using setenv/getenv | 769 | // CFG_FILE_COPY_LIMIT - file copy limit handled using setenv/getenv |
753 | CFG_MAX // this should always be the last entry | 770 | CFG_MAX // this should always be the last entry |
754 | }; | 771 | }; |
@@ -759,6 +776,8 @@ extern char *xvfb_screen; | |||
759 | extern char *xvfb_extra_params; | 776 | extern char *xvfb_extra_params; |
760 | extern char *netfilter_default; | 777 | extern char *netfilter_default; |
761 | extern unsigned long join_timeout; | 778 | extern unsigned long join_timeout; |
779 | extern char *config_seccomp_error_action_str; | ||
780 | |||
762 | int checkcfg(int val); | 781 | int checkcfg(int val); |
763 | void print_compiletime_support(void); | 782 | void print_compiletime_support(void); |
764 | 783 | ||
@@ -813,10 +832,13 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, | |||
813 | #define SBOX_STDIN_FROM_FILE (1 << 6) // open file and redirect it to stdin | 832 | #define SBOX_STDIN_FROM_FILE (1 << 6) // open file and redirect it to stdin |
814 | #define SBOX_CAPS_HIDEPID (1 << 7) // hidepid caps filter for running firemon | 833 | #define SBOX_CAPS_HIDEPID (1 << 7) // hidepid caps filter for running firemon |
815 | #define SBOX_CAPS_NET_SERVICE (1 << 8) // caps filter for programs running network services | 834 | #define SBOX_CAPS_NET_SERVICE (1 << 8) // caps filter for programs running network services |
835 | #define SBOX_KEEP_FDS (1 << 9) // keep file descriptors open | ||
836 | #define FIREJAIL_MAX_FD 20 // getdtablesize() is overkill for a firejail process | ||
816 | 837 | ||
817 | // run sbox | 838 | // run sbox |
818 | int sbox_run(unsigned filter, int num, ...); | 839 | int sbox_run(unsigned filter, int num, ...); |
819 | int sbox_run_v(unsigned filter, char * const arg[]); | 840 | int sbox_run_v(unsigned filter, char * const arg[]); |
841 | void sbox_exec_v(unsigned filter, char * const arg[]) __attribute__((noreturn)); | ||
820 | 842 | ||
821 | // run_files.c | 843 | // run_files.c |
822 | void delete_run_files(pid_t pid); | 844 | void delete_run_files(pid_t pid); |
@@ -826,7 +848,14 @@ void set_x11_run_file(pid_t pid, int display); | |||
826 | void set_profile_run_file(pid_t pid, const char *fname); | 848 | void set_profile_run_file(pid_t pid, const char *fname); |
827 | 849 | ||
828 | // dbus.c | 850 | // dbus.c |
829 | void dbus_disable(void); | 851 | int dbus_check_name(const char *name); |
852 | int dbus_check_call_rule(const char *name); | ||
853 | void dbus_check_profile(void); | ||
854 | void dbus_proxy_start(void); | ||
855 | void dbus_proxy_stop(void); | ||
856 | void dbus_set_session_bus_env(void); | ||
857 | void dbus_set_system_bus_env(void); | ||
858 | void dbus_apply_policy(void); | ||
830 | 859 | ||
831 | // dhcp.c | 860 | // dhcp.c |
832 | extern pid_t dhclient4_pid; | 861 | extern pid_t dhclient4_pid; |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index c7dd91b06..2000ffc62 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -28,10 +28,9 @@ | |||
28 | #include <dirent.h> | 28 | #include <dirent.h> |
29 | #include <errno.h> | 29 | #include <errno.h> |
30 | 30 | ||
31 | |||
32 | #include <fcntl.h> | 31 | #include <fcntl.h> |
33 | #ifndef O_PATH | 32 | #ifndef O_PATH |
34 | # define O_PATH 010000000 | 33 | #define O_PATH 010000000 |
35 | #endif | 34 | #endif |
36 | 35 | ||
37 | #define MAX_BUF 4096 | 36 | #define MAX_BUF 4096 |
@@ -43,6 +42,8 @@ | |||
43 | //*********************************************** | 42 | //*********************************************** |
44 | // process profile file | 43 | // process profile file |
45 | //*********************************************** | 44 | //*********************************************** |
45 | static void fs_remount_rec(const char *dir, OPERATION op); | ||
46 | |||
46 | static char *opstr[] = { | 47 | static char *opstr[] = { |
47 | [BLACKLIST_FILE] = "blacklist", | 48 | [BLACKLIST_FILE] = "blacklist", |
48 | [BLACKLIST_NOLOG] = "blacklist-nolog", | 49 | [BLACKLIST_NOLOG] = "blacklist-nolog", |
@@ -50,6 +51,7 @@ static char *opstr[] = { | |||
50 | [MOUNT_TMPFS] = "tmpfs", | 51 | [MOUNT_TMPFS] = "tmpfs", |
51 | [MOUNT_NOEXEC] = "noexec", | 52 | [MOUNT_NOEXEC] = "noexec", |
52 | [MOUNT_RDWR] = "read-write", | 53 | [MOUNT_RDWR] = "read-write", |
54 | [MOUNT_RDWR_NOCHECK] = "read-write", | ||
53 | }; | 55 | }; |
54 | 56 | ||
55 | typedef enum { | 57 | typedef enum { |
@@ -109,6 +111,13 @@ static void disable_file(OPERATION op, const char *filename) { | |||
109 | return; | 111 | return; |
110 | } | 112 | } |
111 | 113 | ||
114 | // check for firejail executable | ||
115 | // we migth have a file found in ${PATH} pointing to /usr/bin/firejail | ||
116 | // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird | ||
117 | // and expects Firefox to open in the same sandbox | ||
118 | if (strcmp(BINDIR "/firejail", fname) == 0) | ||
119 | return; | ||
120 | |||
112 | // modify the file | 121 | // modify the file |
113 | if (op == BLACKLIST_FILE || op == BLACKLIST_NOLOG) { | 122 | if (op == BLACKLIST_FILE || op == BLACKLIST_NOLOG) { |
114 | // some distros put all executables under /usr/bin and make /bin a symbolic link | 123 | // some distros put all executables under /usr/bin and make /bin a symbolic link |
@@ -148,7 +157,7 @@ static void disable_file(OPERATION op, const char *filename) { | |||
148 | } | 157 | } |
149 | } | 158 | } |
150 | else if (op == MOUNT_READONLY || op == MOUNT_RDWR || op == MOUNT_NOEXEC) { | 159 | else if (op == MOUNT_READONLY || op == MOUNT_RDWR || op == MOUNT_NOEXEC) { |
151 | fs_remount_rec(fname, op, 1); | 160 | fs_remount_rec(fname, op); |
152 | // todo: last_disable = SUCCESSFUL; | 161 | // todo: last_disable = SUCCESSFUL; |
153 | } | 162 | } |
154 | else if (op == MOUNT_TMPFS) { | 163 | else if (op == MOUNT_TMPFS) { |
@@ -254,6 +263,7 @@ void fs_blacklist(void) { | |||
254 | // whitelist commands handled by fs_whitelist() | 263 | // whitelist commands handled by fs_whitelist() |
255 | if (strncmp(entry->data, "whitelist ", 10) == 0 || | 264 | if (strncmp(entry->data, "whitelist ", 10) == 0 || |
256 | strncmp(entry->data, "nowhitelist ", 12) == 0 || | 265 | strncmp(entry->data, "nowhitelist ", 12) == 0 || |
266 | strncmp(entry->data, "dbus-", 5) == 0 || | ||
257 | *entry->data == '\0') { | 267 | *entry->data == '\0') { |
258 | entry = entry->next; | 268 | entry = entry->next; |
259 | continue; | 269 | continue; |
@@ -425,21 +435,11 @@ void fs_blacklist(void) { | |||
425 | free(noblacklist); | 435 | free(noblacklist); |
426 | } | 436 | } |
427 | 437 | ||
428 | static int get_mount_flags(const char *path, unsigned long *flags) { | ||
429 | struct statvfs buf; | ||
430 | |||
431 | if (statvfs(path, &buf) < 0) | ||
432 | return -errno; | ||
433 | *flags = buf.f_flag; | ||
434 | return 0; | ||
435 | } | ||
436 | |||
437 | //*********************************************** | 438 | //*********************************************** |
438 | // mount namespace | 439 | // mount namespace |
439 | // - functions need fully resolved paths | ||
440 | //*********************************************** | 440 | //*********************************************** |
441 | 441 | ||
442 | // mount a writable tmpfs on directory | 442 | // mount a writable tmpfs on directory; requires a resolved path |
443 | void fs_tmpfs(const char *dir, unsigned check_owner) { | 443 | void fs_tmpfs(const char *dir, unsigned check_owner) { |
444 | assert(dir); | 444 | assert(dir); |
445 | if (arg_debug) | 445 | if (arg_debug) |
@@ -480,71 +480,114 @@ void fs_tmpfs(const char *dir, unsigned check_owner) { | |||
480 | close(fd); | 480 | close(fd); |
481 | } | 481 | } |
482 | 482 | ||
483 | void fs_remount(const char *dir, OPERATION op, unsigned check_mnt) { | 483 | // remount path, but preserve existing mount flags; requires a resolved path |
484 | assert(dir); | 484 | static void fs_remount_simple(const char *path, OPERATION op) { |
485 | // check directory exists | 485 | assert(path); |
486 | |||
487 | // open path without following symbolic links | ||
488 | int fd = safe_fd(path, O_PATH|O_NOFOLLOW|O_CLOEXEC); | ||
489 | if (fd == -1) | ||
490 | goto out; | ||
491 | // identify file owner | ||
486 | struct stat s; | 492 | struct stat s; |
487 | int rv = stat(dir, &s); | 493 | if (fstat(fd, &s) == -1) { |
488 | if (rv == 0) { | 494 | // fstat can fail with EACCES if path is a FUSE mount, |
489 | unsigned long flags = 0; | 495 | // mounted without 'allow_root' or 'allow_other' |
490 | if (get_mount_flags(dir, &flags) != 0) { | 496 | if (errno != EACCES) |
491 | fwarning("cannot remount %s\n", dir); | 497 | errExit("fstat"); |
498 | close(fd); | ||
499 | goto out; | ||
500 | } | ||
501 | // get mount flags | ||
502 | struct statvfs buf; | ||
503 | if (fstatvfs(fd, &buf) == -1) | ||
504 | errExit("fstatvfs"); | ||
505 | unsigned long flags = buf.f_flag; | ||
506 | |||
507 | // read-write option | ||
508 | if (op == MOUNT_RDWR || op == MOUNT_RDWR_NOCHECK) { | ||
509 | // nothing to do if there is no read-only flag | ||
510 | if ((flags & MS_RDONLY) == 0) { | ||
511 | close(fd); | ||
492 | return; | 512 | return; |
493 | } | 513 | } |
494 | if (op == MOUNT_RDWR) { | 514 | // allow only user owned directories, except the user is root |
495 | // allow only user owned directories, except the user is root | 515 | if (op == MOUNT_RDWR && getuid() != 0 && s.st_uid != getuid()) { |
496 | if (getuid() != 0 && s.st_uid != getuid()) { | 516 | fwarning("you are not allowed to change %s to read-write\n", path); |
497 | fwarning("you are not allowed to change %s to read-write\n", dir); | 517 | close(fd); |
498 | return; | 518 | return; |
499 | } | ||
500 | if ((flags & MS_RDONLY) == 0) | ||
501 | return; | ||
502 | flags &= ~MS_RDONLY; | ||
503 | } | ||
504 | else if (op == MOUNT_NOEXEC) { | ||
505 | if ((flags & (MS_NOEXEC|MS_NODEV|MS_NOSUID)) == (MS_NOEXEC|MS_NODEV|MS_NOSUID)) | ||
506 | return; | ||
507 | flags |= MS_NOEXEC|MS_NODEV|MS_NOSUID; | ||
508 | } | 519 | } |
509 | else if (op == MOUNT_READONLY) { | 520 | flags &= ~MS_RDONLY; |
510 | if ((flags & MS_RDONLY) == MS_RDONLY) | 521 | } |
511 | return; | 522 | // noexec option |
512 | flags |= MS_RDONLY; | 523 | else if (op == MOUNT_NOEXEC) { |
524 | // nothing to do if path is mounted noexec already | ||
525 | if ((flags & (MS_NOEXEC|MS_NODEV|MS_NOSUID)) == (MS_NOEXEC|MS_NODEV|MS_NOSUID)) { | ||
526 | close(fd); | ||
527 | return; | ||
513 | } | 528 | } |
514 | else | 529 | flags |= MS_NOEXEC|MS_NODEV|MS_NOSUID; |
515 | assert(0); | 530 | } |
516 | 531 | // read-only option | |
517 | if (arg_debug) | 532 | else if (op == MOUNT_READONLY) { |
518 | printf("Mounting %s %s\n", opstr[op], dir); | 533 | // nothing to do if path is mounted read-only already |
519 | // mount --bind /bin /bin | 534 | if ((flags & MS_RDONLY) == MS_RDONLY) { |
520 | // mount --bind -o remount,rw /bin | 535 | close(fd); |
521 | if (mount(dir, dir, NULL, MS_BIND|MS_REC, NULL) < 0 || | 536 | return; |
522 | mount(NULL, dir, NULL, flags|MS_BIND|MS_REMOUNT, NULL) < 0) | ||
523 | errExit("remounting"); | ||
524 | // run a sanity check on /proc/self/mountinfo | ||
525 | if (check_mnt) { | ||
526 | // confirm target of the last mount operation was dir; if there are other | ||
527 | // mount points contained inside dir, one of those will show up as target | ||
528 | // of the last mount operation instead | ||
529 | MountData *mptr = get_last_mount(); | ||
530 | size_t len = strlen(dir); | ||
531 | if ((strncmp(mptr->dir, dir, len) != 0 || | ||
532 | (*(mptr->dir + len) != '\0' && *(mptr->dir + len) != '/')) | ||
533 | && strcmp(dir, "/") != 0) // support read-only=/ | ||
534 | errLogExit("invalid %s mount", opstr[op]); | ||
535 | } | 537 | } |
536 | fs_logger2(opstr[op], dir); | 538 | flags |= MS_RDONLY; |
537 | } | 539 | } |
540 | else | ||
541 | assert(0); | ||
542 | |||
543 | if (arg_debug) | ||
544 | printf("Mounting %s %s\n", opstr[op], path); | ||
545 | // mount --bind /bin /bin | ||
546 | char *proc; | ||
547 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) | ||
548 | errExit("asprintf"); | ||
549 | if (mount(proc, proc, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
550 | errExit("mount"); | ||
551 | free(proc); | ||
552 | close(fd); | ||
553 | |||
554 | // mount --bind -o remount,ro /bin | ||
555 | // we need to open path again | ||
556 | fd = safe_fd(path, O_PATH|O_NOFOLLOW|O_CLOEXEC); | ||
557 | if (fd == -1) | ||
558 | errExit("open"); | ||
559 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) | ||
560 | errExit("asprintf"); | ||
561 | if (mount(NULL, proc, NULL, flags|MS_BIND|MS_REMOUNT, NULL) < 0) | ||
562 | errExit("mount"); | ||
563 | |||
564 | // run a sanity check on /proc/self/mountinfo and confirm that target of the last | ||
565 | // mount operation was path; if there are other mount points contained inside path, | ||
566 | // one of those will show up as target of the last mount operation instead | ||
567 | MountData *mptr = get_last_mount(); | ||
568 | size_t len = strlen(path); | ||
569 | if ((strncmp(mptr->dir, path, len) != 0 || | ||
570 | (*(mptr->dir + len) != '\0' && *(mptr->dir + len) != '/')) | ||
571 | && strcmp(path, "/") != 0) // support read-only=/ | ||
572 | errLogExit("invalid %s mount", opstr[op]); | ||
573 | fs_logger2(opstr[op], path); | ||
574 | free(proc); | ||
575 | close(fd); | ||
576 | return; | ||
577 | |||
578 | out: | ||
579 | fwarning("not remounting %s\n", path); | ||
538 | } | 580 | } |
539 | 581 | ||
540 | void fs_remount_rec(const char *dir, OPERATION op, unsigned check_mnt) { | 582 | // remount recursively; requires a resolved path |
583 | static void fs_remount_rec(const char *dir, OPERATION op) { | ||
541 | assert(dir); | 584 | assert(dir); |
542 | struct stat s; | 585 | struct stat s; |
543 | if (stat(dir, &s) != 0) | 586 | if (stat(dir, &s) != 0) |
544 | return; | 587 | return; |
545 | if (!S_ISDIR(s.st_mode)) { | 588 | if (!S_ISDIR(s.st_mode)) { |
546 | // no need to search in /proc/self/mountinfo for submounts if not a directory | 589 | // no need to search in /proc/self/mountinfo for submounts if not a directory |
547 | fs_remount(dir, op, check_mnt); | 590 | fs_remount_simple(dir, op); |
548 | return; | 591 | return; |
549 | } | 592 | } |
550 | // get mount point of the directory | 593 | // get mount point of the directory |
@@ -558,7 +601,7 @@ void fs_remount_rec(const char *dir, OPERATION op, unsigned check_mnt) { | |||
558 | fwarning("read-only, read-write and noexec options are not applied recursively\n"); | 601 | fwarning("read-only, read-write and noexec options are not applied recursively\n"); |
559 | mount_warning = 1; | 602 | mount_warning = 1; |
560 | } | 603 | } |
561 | fs_remount(dir, op, check_mnt); | 604 | fs_remount_simple(dir, op); |
562 | return; | 605 | return; |
563 | } | 606 | } |
564 | // build array with all mount points that need to get remounted | 607 | // build array with all mount points that need to get remounted |
@@ -567,12 +610,25 @@ void fs_remount_rec(const char *dir, OPERATION op, unsigned check_mnt) { | |||
567 | // remount | 610 | // remount |
568 | char **tmp = arr; | 611 | char **tmp = arr; |
569 | while (*tmp) { | 612 | while (*tmp) { |
570 | fs_remount(*tmp, op, check_mnt); | 613 | fs_remount_simple(*tmp, op); |
571 | free(*tmp++); | 614 | free(*tmp++); |
572 | } | 615 | } |
573 | free(arr); | 616 | free(arr); |
574 | } | 617 | } |
575 | 618 | ||
619 | // resolve a path and remount it | ||
620 | void fs_remount(const char *path, OPERATION op, int rec) { | ||
621 | assert(path); | ||
622 | char *rpath = realpath(path, NULL); | ||
623 | if (rpath) { | ||
624 | if (rec) | ||
625 | fs_remount_rec(rpath, op); | ||
626 | else | ||
627 | fs_remount_simple(rpath, op); | ||
628 | free(rpath); | ||
629 | } | ||
630 | } | ||
631 | |||
576 | // Disable /mnt, /media, /run/mount and /run/media access | 632 | // Disable /mnt, /media, /run/mount and /run/media access |
577 | void fs_mnt(const int enforce) { | 633 | void fs_mnt(const int enforce) { |
578 | if (enforce) { | 634 | if (enforce) { |
@@ -749,22 +805,22 @@ void fs_basic_fs(void) { | |||
749 | if (arg_debug) | 805 | if (arg_debug) |
750 | printf("Basic read-only filesystem:\n"); | 806 | printf("Basic read-only filesystem:\n"); |
751 | if (!arg_writable_etc) { | 807 | if (!arg_writable_etc) { |
752 | fs_remount("/etc", MOUNT_READONLY, 0); | 808 | fs_remount("/etc", MOUNT_READONLY, 1); |
753 | if (uid) | 809 | if (uid) |
754 | fs_remount("/etc", MOUNT_NOEXEC, 0); | 810 | fs_remount("/etc", MOUNT_NOEXEC, 1); |
755 | } | 811 | } |
756 | if (!arg_writable_var) { | 812 | if (!arg_writable_var) { |
757 | fs_remount("/var", MOUNT_READONLY, 0); | 813 | fs_remount("/var", MOUNT_READONLY, 1); |
758 | if (uid) | 814 | if (uid) |
759 | fs_remount("/var", MOUNT_NOEXEC, 0); | 815 | fs_remount("/var", MOUNT_NOEXEC, 1); |
760 | } | 816 | } |
761 | fs_remount("/bin", MOUNT_READONLY, 0); | 817 | fs_remount("/usr", MOUNT_READONLY, 1); |
762 | fs_remount("/sbin", MOUNT_READONLY, 0); | 818 | fs_remount("/bin", MOUNT_READONLY, 1); |
763 | fs_remount("/lib", MOUNT_READONLY, 0); | 819 | fs_remount("/sbin", MOUNT_READONLY, 1); |
764 | fs_remount("/lib64", MOUNT_READONLY, 0); | 820 | fs_remount("/lib", MOUNT_READONLY, 1); |
765 | fs_remount("/lib32", MOUNT_READONLY, 0); | 821 | fs_remount("/lib64", MOUNT_READONLY, 1); |
766 | fs_remount("/libx32", MOUNT_READONLY, 0); | 822 | fs_remount("/lib32", MOUNT_READONLY, 1); |
767 | fs_remount("/usr", MOUNT_READONLY, 0); | 823 | fs_remount("/libx32", MOUNT_READONLY, 1); |
768 | 824 | ||
769 | // update /var directory in order to support multiple sandboxes running on the same root directory | 825 | // update /var directory in order to support multiple sandboxes running on the same root directory |
770 | fs_var_lock(); | 826 | fs_var_lock(); |
@@ -773,7 +829,7 @@ void fs_basic_fs(void) { | |||
773 | if (!arg_writable_var_log) | 829 | if (!arg_writable_var_log) |
774 | fs_var_log(); | 830 | fs_var_log(); |
775 | else | 831 | else |
776 | fs_remount("/var/log", MOUNT_RDWR, 0); | 832 | fs_remount("/var/log", MOUNT_RDWR_NOCHECK, 0); |
777 | 833 | ||
778 | fs_var_lib(); | 834 | fs_var_lib(); |
779 | fs_var_cache(); | 835 | fs_var_cache(); |
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c index 500b6bf1b..00edc5f88 100644 --- a/src/firejail/fs_dev.c +++ b/src/firejail/fs_dev.c | |||
@@ -25,6 +25,7 @@ | |||
25 | #include <dirent.h> | 25 | #include <dirent.h> |
26 | #include <fcntl.h> | 26 | #include <fcntl.h> |
27 | #include <pwd.h> | 27 | #include <pwd.h> |
28 | #include <errno.h> | ||
28 | #ifndef _BSD_SOURCE | 29 | #ifndef _BSD_SOURCE |
29 | #define _BSD_SOURCE | 30 | #define _BSD_SOURCE |
30 | #endif | 31 | #endif |
@@ -148,7 +149,7 @@ static void create_char_dev(const char *path, mode_t mode, int major, int minor) | |||
148 | return; | 149 | return; |
149 | 150 | ||
150 | errexit: | 151 | errexit: |
151 | fprintf(stderr, "Error: cannot create %s device\n", path); | 152 | fprintf(stderr, "Error: cannot create %s device: %s\n", path, strerror(errno)); |
152 | exit(1); | 153 | exit(1); |
153 | } | 154 | } |
154 | 155 | ||
@@ -157,9 +158,6 @@ static void create_link(const char *oldpath, const char *newpath) { | |||
157 | fprintf(stderr, "Error: cannot create %s device\n", newpath); | 158 | fprintf(stderr, "Error: cannot create %s device\n", newpath); |
158 | exit(1); | 159 | exit(1); |
159 | } | 160 | } |
160 | |||
161 | if (chown(newpath, 0, 0) < 0) {;} | ||
162 | |||
163 | fs_logger2("create", newpath); | 161 | fs_logger2("create", newpath); |
164 | return; | 162 | return; |
165 | } | 163 | } |
@@ -302,12 +300,10 @@ void fs_private_dev(void){ | |||
302 | fs_logger("clone /dev/pts"); | 300 | fs_logger("clone /dev/pts"); |
303 | 301 | ||
304 | // stdin, stdout, stderr | 302 | // stdin, stdout, stderr |
305 | #if 0 | ||
306 | create_link("/proc/self/fd", "/dev/fd"); | 303 | create_link("/proc/self/fd", "/dev/fd"); |
307 | create_link("/proc/self/fd/0", "/dev/stdin"); | 304 | create_link("/proc/self/fd/0", "/dev/stdin"); |
308 | create_link("/proc/self/fd/1", "/dev/stdout"); | 305 | create_link("/proc/self/fd/1", "/dev/stdout"); |
309 | create_link("/proc/self/fd/2", "/dev/stderr"); | 306 | create_link("/proc/self/fd/2", "/dev/stderr"); |
310 | #endif | ||
311 | 307 | ||
312 | // symlinks for DVD/CD players | 308 | // symlinks for DVD/CD players |
313 | if (stat("/dev/sr0", &s) == 0) { | 309 | if (stat("/dev/sr0", &s) == 0) { |
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c index bec22e5a6..af891d61f 100644 --- a/src/firejail/fs_home.c +++ b/src/firejail/fs_home.c | |||
@@ -20,7 +20,6 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | 21 | #include <sys/mount.h> |
22 | #include <linux/limits.h> | 22 | #include <linux/limits.h> |
23 | #include <glob.h> | ||
24 | #include <dirent.h> | 23 | #include <dirent.h> |
25 | #include <errno.h> | 24 | #include <errno.h> |
26 | #include <sys/stat.h> | 25 | #include <sys/stat.h> |
@@ -353,49 +352,51 @@ void fs_private(void) { | |||
353 | int xflag = store_xauthority(); | 352 | int xflag = store_xauthority(); |
354 | int aflag = store_asoundrc(); | 353 | int aflag = store_asoundrc(); |
355 | 354 | ||
356 | // mask /home | ||
357 | if (u == 0 && arg_allusers) // allow --allusers when starting the sandbox as root | ||
358 | ; | ||
359 | else { | ||
360 | if (arg_debug) | ||
361 | printf("Mounting a new /home directory\n"); | ||
362 | if (arg_allusers) | ||
363 | fwarning("allusers option disabled by private or whitelist option\n"); | ||
364 | if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME, "mode=755,gid=0") < 0) | ||
365 | errExit("mounting /home directory"); | ||
366 | selinux_relabel_path("/home", "/home"); | ||
367 | fs_logger("tmpfs /home"); | ||
368 | } | ||
369 | |||
370 | // mask /root | 355 | // mask /root |
371 | if (arg_debug) | 356 | if (arg_debug) |
372 | printf("Mounting a new /root directory\n"); | 357 | printf("Mounting a new /root directory\n"); |
373 | if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME, "mode=700,gid=0") < 0) | 358 | if (mount("tmpfs", "/root", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME, "mode=700,gid=0") < 0) |
374 | errExit("mounting /root directory"); | 359 | errExit("mounting /root directory"); |
360 | selinux_relabel_path("/root", "/root"); | ||
375 | fs_logger("tmpfs /root"); | 361 | fs_logger("tmpfs /root"); |
376 | 362 | ||
377 | if (u != 0) { | 363 | if (arg_allusers) { |
378 | if (strncmp(homedir, "/home/", 6) == 0) { | 364 | if (u != 0) |
379 | // create /home/user | 365 | // mask user home directory |
380 | if (arg_debug) | 366 | // the directory should be owned by the current user |
381 | printf("Create a new user directory\n"); | 367 | fs_tmpfs(homedir, 1); |
382 | if (mkdir(homedir, S_IRWXU) == -1) { | 368 | } |
383 | if (mkpath_as_root(homedir) == -1) | 369 | else { // mask /home |
384 | errExit("mkpath"); | 370 | if (arg_debug) |
385 | if (mkdir(homedir, S_IRWXU) == -1 && errno != EEXIST) | 371 | printf("Mounting a new /home directory\n"); |
386 | errExit("mkdir"); | 372 | if (mount("tmpfs", "/home", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOEXEC | MS_STRICTATIME, "mode=755,gid=0") < 0) |
387 | } | 373 | errExit("mounting /home directory"); |
388 | if (chown(homedir, u, g) < 0) | 374 | selinux_relabel_path("/home", "/home"); |
389 | errExit("chown"); | 375 | fs_logger("tmpfs /home"); |
390 | selinux_relabel_path(homedir, homedir); | ||
391 | 376 | ||
392 | fs_logger2("mkdir", homedir); | 377 | if (u != 0) { |
393 | fs_logger2("tmpfs", homedir); | 378 | if (strncmp(homedir, "/home/", 6) == 0) { |
379 | // create /home/user | ||
380 | if (arg_debug) | ||
381 | printf("Create a new user directory\n"); | ||
382 | if (mkdir(homedir, S_IRWXU) == -1) { | ||
383 | if (mkpath_as_root(homedir) == -1) | ||
384 | errExit("mkpath"); | ||
385 | if (mkdir(homedir, S_IRWXU) == -1 && errno != EEXIST) | ||
386 | errExit("mkdir"); | ||
387 | } | ||
388 | if (chown(homedir, u, g) < 0) | ||
389 | errExit("chown"); | ||
390 | |||
391 | selinux_relabel_path(homedir, homedir); | ||
392 | fs_logger2("mkdir", homedir); | ||
393 | fs_logger2("tmpfs", homedir); | ||
394 | } | ||
395 | else | ||
396 | // mask user home directory | ||
397 | // the directory should be owned by the current user | ||
398 | fs_tmpfs(homedir, 1); | ||
394 | } | 399 | } |
395 | else | ||
396 | // user directory is outside /home, mask it as well | ||
397 | // check if directory is owned by the current user | ||
398 | fs_tmpfs(homedir, 1); | ||
399 | } | 400 | } |
400 | 401 | ||
401 | skel(homedir, u, g); | 402 | skel(homedir, u, g); |
@@ -519,7 +520,7 @@ static void duplicate(char *name) { | |||
519 | ptr++; | 520 | ptr++; |
520 | if (asprintf(&path, "%s/%s", RUN_HOME_DIR, ptr) == -1) | 521 | if (asprintf(&path, "%s/%s", RUN_HOME_DIR, ptr) == -1) |
521 | errExit("asprintf"); | 522 | errExit("asprintf"); |
522 | mkdir_attr(path, 0755, getuid(), getgid()); | 523 | create_empty_dir_as_user(path, 0755); |
523 | sbox_run(SBOX_USER| SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FCOPY, fname, path); | 524 | sbox_run(SBOX_USER| SBOX_CAPS_NONE | SBOX_SECCOMP, 3, PATH_FCOPY, fname, path); |
524 | free(path); | 525 | free(path); |
525 | } | 526 | } |
diff --git a/src/firejail/fs_mkdir.c b/src/firejail/fs_mkdir.c index eb660df90..0e213f2f8 100644 --- a/src/firejail/fs_mkdir.c +++ b/src/firejail/fs_mkdir.c | |||
@@ -25,6 +25,22 @@ | |||
25 | #include <sys/wait.h> | 25 | #include <sys/wait.h> |
26 | #include <string.h> | 26 | #include <string.h> |
27 | 27 | ||
28 | |||
29 | static void check(const char *fname) { | ||
30 | // manufacture /run/user directory | ||
31 | char *runuser; | ||
32 | if (asprintf(&runuser, "/run/user/%d/", getuid()) == -1) | ||
33 | errExit("asprintf"); | ||
34 | |||
35 | if (strncmp(fname, cfg.homedir, strlen(cfg.homedir)) != 0 && | ||
36 | strncmp(fname, "/tmp", 4) != 0 && | ||
37 | strncmp(fname, runuser, strlen(runuser)) != 0) { | ||
38 | fprintf(stderr, "Error: only files or directories in user home, /tmp, or /run/user/<UID> are supported by mkdir\n"); | ||
39 | exit(1); | ||
40 | } | ||
41 | free(runuser); | ||
42 | } | ||
43 | |||
28 | static void mkdir_recursive(char *path) { | 44 | static void mkdir_recursive(char *path) { |
29 | char *subdir = NULL; | 45 | char *subdir = NULL; |
30 | struct stat s; | 46 | struct stat s; |
@@ -61,11 +77,7 @@ void fs_mkdir(const char *name) { | |||
61 | // check directory name | 77 | // check directory name |
62 | invalid_filename(name, 0); // no globbing | 78 | invalid_filename(name, 0); // no globbing |
63 | char *expanded = expand_macros(name); | 79 | char *expanded = expand_macros(name); |
64 | if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 && | 80 | check(expanded); // will exit if wrong path |
65 | strncmp(expanded, "/tmp", 4) != 0) { | ||
66 | fprintf(stderr, "Error: only directories in user home or /tmp are supported by mkdir\n"); | ||
67 | exit(1); | ||
68 | } | ||
69 | 81 | ||
70 | struct stat s; | 82 | struct stat s; |
71 | if (stat(expanded, &s) == 0) { | 83 | if (stat(expanded, &s) == 0) { |
@@ -101,11 +113,7 @@ void fs_mkfile(const char *name) { | |||
101 | // check file name | 113 | // check file name |
102 | invalid_filename(name, 0); // no globbing | 114 | invalid_filename(name, 0); // no globbing |
103 | char *expanded = expand_macros(name); | 115 | char *expanded = expand_macros(name); |
104 | if (strncmp(expanded, cfg.homedir, strlen(cfg.homedir)) != 0 && | 116 | check(expanded); // will exit if wrong path |
105 | strncmp(expanded, "/tmp", 4) != 0) { | ||
106 | fprintf(stderr, "Error: only files in user home or /tmp are supported by mkfile\n"); | ||
107 | exit(1); | ||
108 | } | ||
109 | 117 | ||
110 | struct stat s; | 118 | struct stat s; |
111 | if (stat(expanded, &s) == 0) { | 119 | if (stat(expanded, &s) == 0) { |
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c index c5b066b12..1d7552339 100644 --- a/src/firejail/fs_whitelist.c +++ b/src/firejail/fs_whitelist.c | |||
@@ -346,6 +346,39 @@ static void whitelist_home(int topdir) { | |||
346 | } | 346 | } |
347 | 347 | ||
348 | 348 | ||
349 | static void globbing(const char *pattern) { | ||
350 | assert(pattern); | ||
351 | |||
352 | // globbing | ||
353 | glob_t globbuf; | ||
354 | int globerr = glob(pattern, GLOB_NOCHECK | GLOB_NOSORT | GLOB_PERIOD, NULL, &globbuf); | ||
355 | if (globerr) { | ||
356 | fprintf(stderr, "Error: failed to glob private-bin pattern %s\n", pattern); | ||
357 | exit(1); | ||
358 | } | ||
359 | |||
360 | size_t i; | ||
361 | for (i = 0; i < globbuf.gl_pathc; i++) { | ||
362 | assert(globbuf.gl_pathv[i]); | ||
363 | // testing for GLOB_NOCHECK - no pattern matched returns the original pattern | ||
364 | if (strcmp(globbuf.gl_pathv[i], pattern) == 0) | ||
365 | continue; | ||
366 | |||
367 | // build the new profile command | ||
368 | char *newcmd; | ||
369 | if (asprintf(&newcmd, "whitelist %s", globbuf.gl_pathv[i]) == -1) | ||
370 | errExit("asprintf"); | ||
371 | |||
372 | // add the new profile command at the end of the list | ||
373 | if (arg_debug || arg_debug_whitelists) | ||
374 | printf("Adding new profile command: %s\n", newcmd); | ||
375 | profile_add(newcmd); | ||
376 | } | ||
377 | |||
378 | globfree(&globbuf); | ||
379 | } | ||
380 | |||
381 | |||
349 | void fs_whitelist(void) { | 382 | void fs_whitelist(void) { |
350 | ProfileEntry *entry = cfg.profile; | 383 | ProfileEntry *entry = cfg.profile; |
351 | if (!entry) | 384 | if (!entry) |
@@ -444,6 +477,13 @@ void fs_whitelist(void) { | |||
444 | else | 477 | else |
445 | fname = realpath(new_name, NULL); | 478 | fname = realpath(new_name, NULL); |
446 | 479 | ||
480 | // if this is not a real path, let's try globbing | ||
481 | // mark this entry as EMPTY_STRING and push the new paths at the end of profile entry list | ||
482 | // the new profile entries will be processed in this loop | ||
483 | // currently there is no globbing support for nowhitelist | ||
484 | if (!fname && !nowhitelist_flag) | ||
485 | globbing(new_name); | ||
486 | |||
447 | if (!fname) { | 487 | if (!fname) { |
448 | // file not found, blank the entry in the list and continue | 488 | // file not found, blank the entry in the list and continue |
449 | if (arg_debug || arg_debug_whitelists) { | 489 | if (arg_debug || arg_debug_whitelists) { |
@@ -1030,7 +1070,7 @@ void fs_whitelist(void) { | |||
1030 | free(proc); | 1070 | free(proc); |
1031 | close(fd); | 1071 | close(fd); |
1032 | 1072 | ||
1033 | // mount a tmpfs and initialize home directory, overrides --allusers | 1073 | // mount a tmpfs and initialize home directory |
1034 | fs_private(); | 1074 | fs_private(); |
1035 | } | 1075 | } |
1036 | else | 1076 | else |
diff --git a/src/firejail/join.c b/src/firejail/join.c index 531f8c06a..f202d1a9c 100644 --- a/src/firejail/join.c +++ b/src/firejail/join.c | |||
@@ -26,7 +26,11 @@ | |||
26 | 26 | ||
27 | #include <sys/prctl.h> | 27 | #include <sys/prctl.h> |
28 | #ifndef PR_SET_NO_NEW_PRIVS | 28 | #ifndef PR_SET_NO_NEW_PRIVS |
29 | # define PR_SET_NO_NEW_PRIVS 38 | 29 | #define PR_SET_NO_NEW_PRIVS 38 |
30 | #endif | ||
31 | |||
32 | #ifdef HAVE_APPARMOR | ||
33 | #include <sys/apparmor.h> | ||
30 | #endif | 34 | #endif |
31 | 35 | ||
32 | static int apply_caps = 0; | 36 | static int apply_caps = 0; |
@@ -50,6 +54,46 @@ static void install_handler(void) { | |||
50 | sigaction(SIGTERM, &sga, NULL); | 54 | sigaction(SIGTERM, &sga, NULL); |
51 | } | 55 | } |
52 | 56 | ||
57 | #ifdef HAVE_APPARMOR | ||
58 | static void extract_apparmor(pid_t pid) { | ||
59 | if (checkcfg(CFG_APPARMOR)) { | ||
60 | EUID_USER(); | ||
61 | if (aa_is_enabled() == 1) { | ||
62 | // get pid of next child process | ||
63 | pid_t child; | ||
64 | if (find_child(pid, &child) == 1) | ||
65 | child = pid; // no child, proceed with current pid | ||
66 | |||
67 | // get name of AppArmor profile | ||
68 | char *fname; | ||
69 | if (asprintf(&fname, "/proc/%d/attr/current", child) == -1) | ||
70 | errExit("asprintf"); | ||
71 | EUID_ROOT(); | ||
72 | int fd = open(fname, O_RDONLY|O_CLOEXEC); | ||
73 | EUID_USER(); | ||
74 | free(fname); | ||
75 | if (fd == -1) | ||
76 | goto errexit; | ||
77 | char buf[BUFLEN]; | ||
78 | ssize_t rv = read(fd, buf, sizeof(buf) - 1); | ||
79 | close(fd); | ||
80 | if (rv < 0) | ||
81 | goto errexit; | ||
82 | buf[rv] = '\0'; | ||
83 | // process confined by Firejail's AppArmor policy? | ||
84 | if (strncmp(buf, "firejail-default", 16) == 0) | ||
85 | arg_apparmor = 1; | ||
86 | } | ||
87 | EUID_ROOT(); | ||
88 | } | ||
89 | return; | ||
90 | |||
91 | errexit: | ||
92 | fprintf(stderr, "Error: cannot read /proc file\n"); | ||
93 | exit(1); | ||
94 | } | ||
95 | #endif // HAVE_APPARMOR | ||
96 | |||
53 | static void extract_x11_display(pid_t pid) { | 97 | static void extract_x11_display(pid_t pid) { |
54 | char *fname; | 98 | char *fname; |
55 | if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_X11_DIR, pid) == -1) | 99 | if (asprintf(&fname, "%s/%d", RUN_FIREJAIL_X11_DIR, pid) == -1) |
@@ -388,6 +432,9 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
388 | extract_cgroup(pid); | 432 | extract_cgroup(pid); |
389 | extract_nogroups(pid); | 433 | extract_nogroups(pid); |
390 | extract_user_namespace(pid); | 434 | extract_user_namespace(pid); |
435 | #ifdef HAVE_APPARMOR | ||
436 | extract_apparmor(pid); | ||
437 | #endif | ||
391 | } | 438 | } |
392 | 439 | ||
393 | // set cgroup | 440 | // set cgroup |
@@ -501,6 +548,11 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
501 | // kill the child in case the parent died | 548 | // kill the child in case the parent died |
502 | prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); | 549 | prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); |
503 | 550 | ||
551 | #ifdef HAVE_APPARMOR | ||
552 | // add apparmor confinement after the execve | ||
553 | set_apparmor(); | ||
554 | #endif | ||
555 | |||
504 | extract_command(argc, argv, index); | 556 | extract_command(argc, argv, index); |
505 | if (cfg.command_line == NULL) { | 557 | if (cfg.command_line == NULL) { |
506 | assert(cfg.shell); | 558 | assert(cfg.shell); |
@@ -527,9 +579,16 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
527 | free(display_str); | 579 | free(display_str); |
528 | } | 580 | } |
529 | 581 | ||
582 | // set D-Bus environment variables | ||
583 | struct stat s; | ||
584 | if (stat(RUN_DBUS_USER_SOCKET, &s) == 0) | ||
585 | dbus_set_session_bus_env(); | ||
586 | if (stat(RUN_DBUS_SYSTEM_SOCKET, &s) == 0) | ||
587 | dbus_set_system_bus_env(); | ||
588 | |||
530 | start_application(0, NULL); | 589 | start_application(0, NULL); |
531 | 590 | ||
532 | // it will never get here!!! | 591 | __builtin_unreachable(); |
533 | } | 592 | } |
534 | EUID_USER(); | 593 | EUID_USER(); |
535 | 594 | ||
diff --git a/src/firejail/main.c b/src/firejail/main.c index 78717ab41..b9cb43444 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -20,6 +20,8 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/pid.h" | 21 | #include "../include/pid.h" |
22 | #include "../include/firejail_user.h" | 22 | #include "../include/firejail_user.h" |
23 | #include "../include/syscall.h" | ||
24 | #include "../include/seccomp.h" | ||
23 | #define _GNU_SOURCE | 25 | #define _GNU_SOURCE |
24 | #include <sys/utsname.h> | 26 | #include <sys/utsname.h> |
25 | #include <sched.h> | 27 | #include <sched.h> |
@@ -72,8 +74,10 @@ int arg_overlay_keep = 0; // place overlay diff in a known directory | |||
72 | int arg_overlay_reuse = 0; // allow the reuse of overlays | 74 | int arg_overlay_reuse = 0; // allow the reuse of overlays |
73 | 75 | ||
74 | int arg_seccomp = 0; // enable default seccomp filter | 76 | int arg_seccomp = 0; // enable default seccomp filter |
77 | int arg_seccomp32 = 0; // enable default seccomp filter for 32 bit arch | ||
75 | int arg_seccomp_postexec = 0; // need postexec ld.preload library? | 78 | int arg_seccomp_postexec = 0; // need postexec ld.preload library? |
76 | int arg_seccomp_block_secondary = 0; // block any secondary architectures | 79 | int arg_seccomp_block_secondary = 0; // block any secondary architectures |
80 | int arg_seccomp_error_action = 0; | ||
77 | 81 | ||
78 | int arg_caps_default_filter = 0; // enable default capabilities filter | 82 | int arg_caps_default_filter = 0; // enable default capabilities filter |
79 | int arg_caps_drop = 0; // drop list | 83 | int arg_caps_drop = 0; // drop list |
@@ -140,9 +144,13 @@ int arg_noprofile = 0; // use default.profile if none other found/specified | |||
140 | int arg_memory_deny_write_execute = 0; // block writable and executable memory | 144 | int arg_memory_deny_write_execute = 0; // block writable and executable memory |
141 | int arg_notv = 0; // --notv | 145 | int arg_notv = 0; // --notv |
142 | int arg_nodvd = 0; // --nodvd | 146 | int arg_nodvd = 0; // --nodvd |
143 | int arg_nodbus = 0; // -nodbus | ||
144 | int arg_nou2f = 0; // --nou2f | 147 | int arg_nou2f = 0; // --nou2f |
145 | int arg_deterministic_exit_code = 0; // always exit with first child's exit status | 148 | int arg_deterministic_exit_code = 0; // always exit with first child's exit status |
149 | DbusPolicy arg_dbus_user = DBUS_POLICY_ALLOW; // --dbus-user | ||
150 | DbusPolicy arg_dbus_system = DBUS_POLICY_ALLOW; // --dbus-system | ||
151 | const char *arg_dbus_log_file = NULL; | ||
152 | int arg_dbus_log_user = 0; | ||
153 | int arg_dbus_log_system = 0; | ||
146 | int login_shell = 0; | 154 | int login_shell = 0; |
147 | 155 | ||
148 | //********************************************************************************** | 156 | //********************************************************************************** |
@@ -176,6 +184,7 @@ static void myexit(int rv) { | |||
176 | 184 | ||
177 | 185 | ||
178 | // delete sandbox files in shared memory | 186 | // delete sandbox files in shared memory |
187 | dbus_proxy_stop(); | ||
179 | EUID_ROOT(); | 188 | EUID_ROOT(); |
180 | delete_run_files(sandbox_pid); | 189 | delete_run_files(sandbox_pid); |
181 | appimage_clear(); | 190 | appimage_clear(); |
@@ -347,6 +356,27 @@ static void init_cfg(int argc, char **argv) { | |||
347 | sandbox_pid = getpid(); | 356 | sandbox_pid = getpid(); |
348 | time_t t = time(NULL); | 357 | time_t t = time(NULL); |
349 | srand(t ^ sandbox_pid); | 358 | srand(t ^ sandbox_pid); |
359 | |||
360 | arg_seccomp_error_action = EPERM; | ||
361 | cfg.seccomp_error_action = "EPERM"; | ||
362 | } | ||
363 | |||
364 | static void fix_single_std_fd(int fd, const char *file, int flags) { | ||
365 | struct stat s; | ||
366 | if (fstat(fd, &s) == -1 && errno == EBADF) { | ||
367 | // something is wrong with fd, probably it is not opened | ||
368 | int nfd = open(file, flags); | ||
369 | if (nfd != fd || fstat(fd, &s) != 0) | ||
370 | _exit(1); // no further attempts to fix the situation | ||
371 | } | ||
372 | } | ||
373 | |||
374 | // glibc does this automatically if Firejail was started by a regular user | ||
375 | // run this for root user and as a fallback | ||
376 | static void fix_std_streams(void) { | ||
377 | fix_single_std_fd(0, "/dev/full", O_RDONLY|O_NOFOLLOW); | ||
378 | fix_single_std_fd(1, "/dev/null", O_WRONLY|O_NOFOLLOW); | ||
379 | fix_single_std_fd(2, "/dev/null", O_WRONLY|O_NOFOLLOW); | ||
350 | } | 380 | } |
351 | 381 | ||
352 | static void check_network(Bridge *br) { | 382 | static void check_network(Bridge *br) { |
@@ -548,6 +578,14 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
548 | else | 578 | else |
549 | exit_err_feature("seccomp"); | 579 | exit_err_feature("seccomp"); |
550 | } | 580 | } |
581 | else if (strcmp(argv[i], "--debug-syscalls32") == 0) { | ||
582 | if (checkcfg(CFG_SECCOMP)) { | ||
583 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSECCOMP_MAIN, "debug-syscalls32"); | ||
584 | exit(rv); | ||
585 | } | ||
586 | else | ||
587 | exit_err_feature("seccomp"); | ||
588 | } | ||
551 | else if (strcmp(argv[i], "--debug-errnos") == 0) { | 589 | else if (strcmp(argv[i], "--debug-errnos") == 0) { |
552 | if (checkcfg(CFG_SECCOMP)) { | 590 | if (checkcfg(CFG_SECCOMP)) { |
553 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSECCOMP_MAIN, "debug-errnos"); | 591 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSECCOMP_MAIN, "debug-errnos"); |
@@ -956,11 +994,38 @@ static void run_builder(int argc, char **argv) { | |||
956 | exit(1); | 994 | exit(1); |
957 | } | 995 | } |
958 | 996 | ||
997 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) { | ||
998 | (void) fd; | ||
999 | (void) syscall; | ||
1000 | (void) arg; | ||
1001 | (void) ptrarg; | ||
1002 | (void) native; | ||
1003 | } | ||
1004 | void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, bool native) { | ||
1005 | (void) fd; | ||
1006 | (void) syscall; | ||
1007 | (void) arg; | ||
1008 | (void) ptrarg; | ||
1009 | (void) native; | ||
1010 | } | ||
1011 | |||
1012 | #ifdef HAVE_SECCOMP | ||
1013 | static int check_postexec(const char *list) { | ||
1014 | char *prelist, *postlist; | ||
1015 | |||
1016 | if (list) { | ||
1017 | syscalls_in_list(list, "@default-keep", -1, &prelist, &postlist, true); | ||
1018 | if (postlist) | ||
1019 | return 1; | ||
1020 | } | ||
1021 | return 0; | ||
1022 | } | ||
1023 | #endif | ||
959 | 1024 | ||
960 | //******************************************* | 1025 | //******************************************* |
961 | // Main program | 1026 | // Main program |
962 | //******************************************* | 1027 | //******************************************* |
963 | int main(int argc, char **argv) { | 1028 | int main(int argc, char **argv, char **envp) { |
964 | int i; | 1029 | int i; |
965 | int prog_index = -1; // index in argv where the program command starts | 1030 | int prog_index = -1; // index in argv where the program command starts |
966 | int lockfd_network = -1; | 1031 | int lockfd_network = -1; |
@@ -968,17 +1033,48 @@ int main(int argc, char **argv) { | |||
968 | int option_cgroup = 0; | 1033 | int option_cgroup = 0; |
969 | int custom_profile = 0; // custom profile loaded | 1034 | int custom_profile = 0; // custom profile loaded |
970 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) | 1035 | int arg_caps_cmdline = 0; // caps requested on command line (used to break out of --chroot) |
1036 | char **ptr; | ||
1037 | |||
1038 | // sanitize the umask | ||
1039 | orig_umask = umask(022); | ||
1040 | |||
1041 | // check standard streams before printing anything | ||
1042 | fix_std_streams(); | ||
971 | 1043 | ||
972 | // drop permissions by default and rise them when required | 1044 | // drop permissions by default and rise them when required |
973 | EUID_INIT(); | 1045 | EUID_INIT(); |
974 | EUID_USER(); | 1046 | EUID_USER(); |
975 | 1047 | ||
976 | // sanitize the umask | ||
977 | orig_umask = umask(022); | ||
978 | |||
979 | // argument count should be larger than 0 | 1048 | // argument count should be larger than 0 |
980 | if (argc == 0) { | 1049 | if (argc == 0 || !argv || strlen(argv[0]) == 0) { |
981 | fprintf(stderr, "Error: argv[0] is NULL\n"); | 1050 | fprintf(stderr, "Error: argv is invalid\n"); |
1051 | exit(1); | ||
1052 | } else if (argc >= MAX_ARGS) { | ||
1053 | fprintf(stderr, "Error: too many arguments\n"); | ||
1054 | exit(1); | ||
1055 | } | ||
1056 | |||
1057 | // sanity check for arguments | ||
1058 | for (i = 0; i < argc; i++) { | ||
1059 | if (*argv[i] == 0) { | ||
1060 | fprintf(stderr, "Error: too short arguments\n"); | ||
1061 | exit(1); | ||
1062 | } | ||
1063 | if (strlen(argv[i]) >= MAX_ARG_LEN) { | ||
1064 | fprintf(stderr, "Error: too long arguments\n"); | ||
1065 | exit(1); | ||
1066 | } | ||
1067 | } | ||
1068 | |||
1069 | // sanity check for environment variables | ||
1070 | for (i = 0, ptr = envp; ptr && *ptr && i < MAX_ENVS; i++, ptr++) { | ||
1071 | if (strlen(*ptr) >= MAX_ENV_LEN) { | ||
1072 | fprintf(stderr, "Error: too long environment variables\n"); | ||
1073 | exit(1); | ||
1074 | } | ||
1075 | } | ||
1076 | if (i >= MAX_ENVS) { | ||
1077 | fprintf(stderr, "Error: too many environment variables\n"); | ||
982 | exit(1); | 1078 | exit(1); |
983 | } | 1079 | } |
984 | 1080 | ||
@@ -1063,8 +1159,7 @@ int main(int argc, char **argv) { | |||
1063 | 1159 | ||
1064 | // start the program directly without sandboxing | 1160 | // start the program directly without sandboxing |
1065 | run_no_sandbox(argc, argv); | 1161 | run_no_sandbox(argc, argv); |
1066 | // it will never get here! | 1162 | __builtin_unreachable(); |
1067 | assert(0); | ||
1068 | } | 1163 | } |
1069 | } | 1164 | } |
1070 | EUID_ASSERT(); | 1165 | EUID_ASSERT(); |
@@ -1263,6 +1358,18 @@ int main(int argc, char **argv) { | |||
1263 | else | 1358 | else |
1264 | exit_err_feature("seccomp"); | 1359 | exit_err_feature("seccomp"); |
1265 | } | 1360 | } |
1361 | else if (strncmp(argv[i], "--seccomp.32=", 13) == 0) { | ||
1362 | if (checkcfg(CFG_SECCOMP)) { | ||
1363 | if (arg_seccomp32) { | ||
1364 | fprintf(stderr, "Error: seccomp.32 already enabled\n"); | ||
1365 | exit(1); | ||
1366 | } | ||
1367 | arg_seccomp32 = 1; | ||
1368 | cfg.seccomp_list32 = seccomp_check_list(argv[i] + 13); | ||
1369 | } | ||
1370 | else | ||
1371 | exit_err_feature("seccomp"); | ||
1372 | } | ||
1266 | else if (strncmp(argv[i], "--seccomp.drop=", 15) == 0) { | 1373 | else if (strncmp(argv[i], "--seccomp.drop=", 15) == 0) { |
1267 | if (checkcfg(CFG_SECCOMP)) { | 1374 | if (checkcfg(CFG_SECCOMP)) { |
1268 | if (arg_seccomp) { | 1375 | if (arg_seccomp) { |
@@ -1275,6 +1382,18 @@ int main(int argc, char **argv) { | |||
1275 | else | 1382 | else |
1276 | exit_err_feature("seccomp"); | 1383 | exit_err_feature("seccomp"); |
1277 | } | 1384 | } |
1385 | else if (strncmp(argv[i], "--seccomp.32.drop=", 18) == 0) { | ||
1386 | if (checkcfg(CFG_SECCOMP)) { | ||
1387 | if (arg_seccomp32) { | ||
1388 | fprintf(stderr, "Error: seccomp.32 already enabled\n"); | ||
1389 | exit(1); | ||
1390 | } | ||
1391 | arg_seccomp32 = 1; | ||
1392 | cfg.seccomp_list_drop32 = seccomp_check_list(argv[i] + 18); | ||
1393 | } | ||
1394 | else | ||
1395 | exit_err_feature("seccomp"); | ||
1396 | } | ||
1278 | else if (strncmp(argv[i], "--seccomp.keep=", 15) == 0) { | 1397 | else if (strncmp(argv[i], "--seccomp.keep=", 15) == 0) { |
1279 | if (checkcfg(CFG_SECCOMP)) { | 1398 | if (checkcfg(CFG_SECCOMP)) { |
1280 | if (arg_seccomp) { | 1399 | if (arg_seccomp) { |
@@ -1287,8 +1406,24 @@ int main(int argc, char **argv) { | |||
1287 | else | 1406 | else |
1288 | exit_err_feature("seccomp"); | 1407 | exit_err_feature("seccomp"); |
1289 | } | 1408 | } |
1409 | else if (strncmp(argv[i], "--seccomp.32.keep=", 18) == 0) { | ||
1410 | if (checkcfg(CFG_SECCOMP)) { | ||
1411 | if (arg_seccomp32) { | ||
1412 | fprintf(stderr, "Error: seccomp.32 already enabled\n"); | ||
1413 | exit(1); | ||
1414 | } | ||
1415 | arg_seccomp32 = 1; | ||
1416 | cfg.seccomp_list_keep32 = seccomp_check_list(argv[i] + 18); | ||
1417 | } | ||
1418 | else | ||
1419 | exit_err_feature("seccomp"); | ||
1420 | } | ||
1290 | else if (strcmp(argv[i], "--seccomp.block-secondary") == 0) { | 1421 | else if (strcmp(argv[i], "--seccomp.block-secondary") == 0) { |
1291 | if (checkcfg(CFG_SECCOMP)) { | 1422 | if (checkcfg(CFG_SECCOMP)) { |
1423 | if (arg_seccomp32) { | ||
1424 | fprintf(stderr, "Error: seccomp.32 conflicts with block-secondary\n"); | ||
1425 | exit(1); | ||
1426 | } | ||
1292 | arg_seccomp_block_secondary = 1; | 1427 | arg_seccomp_block_secondary = 1; |
1293 | } | 1428 | } |
1294 | else | 1429 | else |
@@ -1300,6 +1435,28 @@ int main(int argc, char **argv) { | |||
1300 | else | 1435 | else |
1301 | exit_err_feature("seccomp"); | 1436 | exit_err_feature("seccomp"); |
1302 | } | 1437 | } |
1438 | else if (strncmp(argv[i], "--seccomp-error-action=", 23) == 0) { | ||
1439 | if (checkcfg(CFG_SECCOMP)) { | ||
1440 | int config_seccomp_error_action = checkcfg(CFG_SECCOMP_ERROR_ACTION); | ||
1441 | if (config_seccomp_error_action == -1) { | ||
1442 | if (strcmp(argv[i] + 23, "kill") == 0) | ||
1443 | arg_seccomp_error_action = SECCOMP_RET_KILL; | ||
1444 | else if (strcmp(argv[i] + 23, "log") == 0) | ||
1445 | arg_seccomp_error_action = SECCOMP_RET_LOG; | ||
1446 | else { | ||
1447 | arg_seccomp_error_action = errno_find_name(argv[i] + 23); | ||
1448 | if (arg_seccomp_error_action == -1) | ||
1449 | errExit("seccomp-error-action: unknown errno"); | ||
1450 | } | ||
1451 | cfg.seccomp_error_action = strdup(argv[i] + 23); | ||
1452 | if (!cfg.seccomp_error_action) | ||
1453 | errExit("strdup"); | ||
1454 | } else | ||
1455 | exit_err_feature("seccomp-error-action"); | ||
1456 | |||
1457 | } else | ||
1458 | exit_err_feature("seccomp"); | ||
1459 | } | ||
1303 | #endif | 1460 | #endif |
1304 | else if (strcmp(argv[i], "--caps") == 0) { | 1461 | else if (strcmp(argv[i], "--caps") == 0) { |
1305 | arg_caps_default_filter = 1; | 1462 | arg_caps_default_filter = 1; |
@@ -1923,8 +2080,147 @@ int main(int argc, char **argv) { | |||
1923 | arg_nodvd = 1; | 2080 | arg_nodvd = 1; |
1924 | else if (strcmp(argv[i], "--nou2f") == 0) | 2081 | else if (strcmp(argv[i], "--nou2f") == 0) |
1925 | arg_nou2f = 1; | 2082 | arg_nou2f = 1; |
1926 | else if (strcmp(argv[i], "--nodbus") == 0) | 2083 | else if (strcmp(argv[i], "--nodbus") == 0) { |
1927 | arg_nodbus = 1; | 2084 | arg_dbus_user = DBUS_POLICY_BLOCK; |
2085 | arg_dbus_system = DBUS_POLICY_BLOCK; | ||
2086 | } | ||
2087 | else if (strncmp("--dbus-user=", argv[i], 12) == 0) { | ||
2088 | if (strcmp("filter", argv[i] + 12) == 0) { | ||
2089 | if (arg_dbus_user == DBUS_POLICY_BLOCK) { | ||
2090 | fprintf(stderr, "Warning: Cannot relax --dbus-user policy, it is already set to block\n"); | ||
2091 | } else { | ||
2092 | arg_dbus_user = DBUS_POLICY_FILTER; | ||
2093 | } | ||
2094 | } else if (strcmp("none", argv[i] + 12) == 0) { | ||
2095 | if (arg_dbus_log_user) { | ||
2096 | fprintf(stderr, "Error: --dbus-user.log requires --dbus-user=filter\n"); | ||
2097 | exit(1); | ||
2098 | } | ||
2099 | arg_dbus_user = DBUS_POLICY_BLOCK; | ||
2100 | } else { | ||
2101 | fprintf(stderr, "Unknown dbus-user policy: %s\n", argv[i] + 12); | ||
2102 | exit(1); | ||
2103 | } | ||
2104 | } | ||
2105 | else if (strncmp(argv[i], "--dbus-user.see=", 16) == 0) { | ||
2106 | char *line; | ||
2107 | if (asprintf(&line, "dbus-user.see %s", argv[i] + 16) == -1) | ||
2108 | errExit("asprintf"); | ||
2109 | |||
2110 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2111 | profile_add(line); | ||
2112 | } | ||
2113 | else if (strncmp(argv[i], "--dbus-user.talk=", 17) == 0) { | ||
2114 | char *line; | ||
2115 | if (asprintf(&line, "dbus-user.talk %s", argv[i] + 17) == -1) | ||
2116 | errExit("asprintf"); | ||
2117 | |||
2118 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2119 | profile_add(line); | ||
2120 | } | ||
2121 | else if (strncmp(argv[i], "--dbus-user.own=", 16) == 0) { | ||
2122 | char *line; | ||
2123 | if (asprintf(&line, "dbus-user.own %s", argv[i] + 16) == -1) | ||
2124 | errExit("asprintf"); | ||
2125 | |||
2126 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2127 | profile_add(line); | ||
2128 | } | ||
2129 | else if (strncmp(argv[i], "--dbus-user.call=", 17) == 0) { | ||
2130 | char *line; | ||
2131 | if (asprintf(&line, "dbus-user.call %s", argv[i] + 17) == -1) | ||
2132 | errExit("asprintf"); | ||
2133 | |||
2134 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2135 | profile_add(line); | ||
2136 | } | ||
2137 | else if (strncmp(argv[i], "--dbus-user.broadcast=", 22) == 0) { | ||
2138 | char *line; | ||
2139 | if (asprintf(&line, "dbus-user.broadcast %s", argv[i] + 22) == -1) | ||
2140 | errExit("asprintf"); | ||
2141 | |||
2142 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2143 | profile_add(line); | ||
2144 | } | ||
2145 | else if (strncmp("--dbus-system=", argv[i], 14) == 0) { | ||
2146 | if (strcmp("filter", argv[i] + 14) == 0) { | ||
2147 | if (arg_dbus_system == DBUS_POLICY_BLOCK) { | ||
2148 | fprintf(stderr, "Warning: Cannot relax --dbus-system policy, it is already set to block\n"); | ||
2149 | } else { | ||
2150 | arg_dbus_system = DBUS_POLICY_FILTER; | ||
2151 | } | ||
2152 | } else if (strcmp("none", argv[i] + 14) == 0) { | ||
2153 | if (arg_dbus_log_system) { | ||
2154 | fprintf(stderr, "Error: --dbus-system.log requires --dbus-system=filter\n"); | ||
2155 | exit(1); | ||
2156 | } | ||
2157 | arg_dbus_system = DBUS_POLICY_BLOCK; | ||
2158 | } else { | ||
2159 | fprintf(stderr, "Unknown dbus-system policy: %s\n", argv[i] + 14); | ||
2160 | exit(1); | ||
2161 | } | ||
2162 | } | ||
2163 | else if (strncmp(argv[i], "--dbus-system.see=", 18) == 0) { | ||
2164 | char *line; | ||
2165 | if (asprintf(&line, "dbus-system.see %s", argv[i] + 18) == -1) | ||
2166 | errExit("asprintf"); | ||
2167 | |||
2168 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2169 | profile_add(line); | ||
2170 | } | ||
2171 | else if (strncmp(argv[i], "--dbus-system.talk=", 19) == 0) { | ||
2172 | char *line; | ||
2173 | if (asprintf(&line, "dbus-system.talk %s", argv[i] + 19) == -1) | ||
2174 | errExit("asprintf"); | ||
2175 | |||
2176 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2177 | profile_add(line); | ||
2178 | } | ||
2179 | else if (strncmp(argv[i], "--dbus-system.own=", 18) == 0) { | ||
2180 | char *line; | ||
2181 | if (asprintf(&line, "dbus-system.own %s", argv[i] + 18) == -1) | ||
2182 | errExit("asprintf"); | ||
2183 | |||
2184 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2185 | profile_add(line); | ||
2186 | } | ||
2187 | else if (strncmp(argv[i], "--dbus-system.call=", 19) == 0) { | ||
2188 | char *line; | ||
2189 | if (asprintf(&line, "dbus-system.call %s", argv[i] + 19) == -1) | ||
2190 | errExit("asprintf"); | ||
2191 | |||
2192 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2193 | profile_add(line); | ||
2194 | } | ||
2195 | else if (strncmp(argv[i], "--dbus-system.broadcast=", 24) == 0) { | ||
2196 | char *line; | ||
2197 | if (asprintf(&line, "dbus-system.broadcast %s", argv[i] + 24) == -1) | ||
2198 | errExit("asprintf"); | ||
2199 | |||
2200 | profile_check_line(line, 0, NULL); // will exit if something wrong | ||
2201 | profile_add(line); | ||
2202 | } | ||
2203 | else if (strncmp(argv[i], "--dbus-log=", 11) == 0) { | ||
2204 | if (arg_dbus_log_file != NULL) { | ||
2205 | fprintf(stderr, "Error: --dbus-log option already specified\n"); | ||
2206 | exit(1); | ||
2207 | } | ||
2208 | arg_dbus_log_file = argv[i] + 11; | ||
2209 | } | ||
2210 | else if (strcmp(argv[i], "--dbus-user.log") == 0) { | ||
2211 | if (arg_dbus_user != DBUS_POLICY_FILTER) { | ||
2212 | fprintf(stderr, "Error: --dbus-user.log requires --dbus-user=filter\n"); | ||
2213 | exit(1); | ||
2214 | } | ||
2215 | arg_dbus_log_user = 1; | ||
2216 | } | ||
2217 | else if (strcmp(argv[i], "--dbus-system.log") == 0) { | ||
2218 | if (arg_dbus_system != DBUS_POLICY_FILTER) { | ||
2219 | fprintf(stderr, "Error: --dbus-system.log requires --dbus-system=filter\n"); | ||
2220 | exit(1); | ||
2221 | } | ||
2222 | arg_dbus_log_system = 1; | ||
2223 | } | ||
1928 | 2224 | ||
1929 | //************************************* | 2225 | //************************************* |
1930 | // network | 2226 | // network |
@@ -2542,6 +2838,14 @@ int main(int argc, char **argv) { | |||
2542 | // check network configuration options - it will exit if anything went wrong | 2838 | // check network configuration options - it will exit if anything went wrong |
2543 | net_check_cfg(); | 2839 | net_check_cfg(); |
2544 | 2840 | ||
2841 | #ifdef HAVE_SECCOMP | ||
2842 | if (arg_seccomp) | ||
2843 | arg_seccomp_postexec = check_postexec(cfg.seccomp_list) || check_postexec(cfg.seccomp_list_drop); | ||
2844 | #endif | ||
2845 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; | ||
2846 | if (need_preload && (cfg.seccomp_list32 || cfg.seccomp_list_drop32 || cfg.seccomp_list_keep32)) | ||
2847 | fwarning("preload libraries (trace, tracelog, postexecseccomp due to seccomp.drop=execve etc.) are incompatible with 32 bit filters\n"); | ||
2848 | |||
2545 | // check and assign an IP address - for macvlan it will be done again in the sandbox! | 2849 | // check and assign an IP address - for macvlan it will be done again in the sandbox! |
2546 | if (any_bridge_configured()) { | 2850 | if (any_bridge_configured()) { |
2547 | EUID_ROOT(); | 2851 | EUID_ROOT(); |
@@ -2602,6 +2906,16 @@ int main(int argc, char **argv) { | |||
2602 | } | 2906 | } |
2603 | EUID_USER(); | 2907 | EUID_USER(); |
2604 | 2908 | ||
2909 | if (checkcfg(CFG_DBUS)) { | ||
2910 | dbus_check_profile(); | ||
2911 | if (arg_dbus_user == DBUS_POLICY_FILTER || | ||
2912 | arg_dbus_system == DBUS_POLICY_FILTER) { | ||
2913 | EUID_ROOT(); | ||
2914 | dbus_proxy_start(); | ||
2915 | EUID_USER(); | ||
2916 | } | ||
2917 | } | ||
2918 | |||
2605 | // clone environment | 2919 | // clone environment |
2606 | int flags = CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWUTS | SIGCHLD; | 2920 | int flags = CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWUTS | SIGCHLD; |
2607 | 2921 | ||
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c index 8bf8adecc..01df77ee6 100644 --- a/src/firejail/no_sandbox.c +++ b/src/firejail/no_sandbox.c | |||
@@ -89,7 +89,7 @@ int check_kernel_procs(void) { | |||
89 | // only user processes are available in /proc when running grsecurity | 89 | // only user processes are available in /proc when running grsecurity |
90 | // EUID_ASSERT(); | 90 | // EUID_ASSERT(); |
91 | 91 | ||
92 | char *kern_proc[] = { | 92 | static char *kern_proc[] = { |
93 | "kthreadd", | 93 | "kthreadd", |
94 | "ksoftirqd", | 94 | "ksoftirqd", |
95 | "kworker", | 95 | "kworker", |
diff --git a/src/firejail/output.c b/src/firejail/output.c index d4a7f464a..36cb905cb 100644 --- a/src/firejail/output.c +++ b/src/firejail/output.c | |||
@@ -30,6 +30,12 @@ void check_output(int argc, char **argv) { | |||
30 | int enable_stderr = 0; | 30 | int enable_stderr = 0; |
31 | 31 | ||
32 | for (i = 1; i < argc; i++) { | 32 | for (i = 1; i < argc; i++) { |
33 | if (strncmp(argv[i], "--", 2) != 0) { | ||
34 | return; | ||
35 | } | ||
36 | if (strcmp(argv[i], "--") == 0) { | ||
37 | return; | ||
38 | } | ||
33 | if (strncmp(argv[i], "--output=", 9) == 0) { | 39 | if (strncmp(argv[i], "--output=", 9) == 0) { |
34 | outindex = i; | 40 | outindex = i; |
35 | break; | 41 | break; |
@@ -71,38 +77,67 @@ void check_output(int argc, char **argv) { | |||
71 | } | 77 | } |
72 | } | 78 | } |
73 | 79 | ||
74 | // build the new command line | 80 | int pipefd[2]; |
75 | int len = 0; | 81 | if (pipe(pipefd) == -1) { |
76 | for (i = 0; i < argc; i++) { | 82 | errExit("pipe"); |
77 | len += strlen(argv[i]) + 1; // + ' ' | ||
78 | } | 83 | } |
79 | len += 100 + strlen(LIBDIR) + strlen(outfile); // tee command | ||
80 | 84 | ||
81 | char *cmd = malloc(len + 1); // + '\0' | 85 | pid_t pid = fork(); |
82 | if (!cmd) | 86 | if (pid == -1) { |
83 | errExit("malloc"); | 87 | errExit("fork"); |
88 | } else if (pid == 0) { | ||
89 | /* child */ | ||
90 | if (dup2(pipefd[0], STDIN_FILENO) == -1) { | ||
91 | errExit("dup2"); | ||
92 | } | ||
93 | close(pipefd[1]); | ||
94 | if (pipefd[0] != STDIN_FILENO) { | ||
95 | close(pipefd[0]); | ||
96 | } | ||
84 | 97 | ||
85 | char *ptr = cmd; | 98 | char *args[3]; |
86 | for (i = 0; i < argc; i++) { | 99 | args[0] = LIBDIR "/firejail/ftee"; |
87 | if (strncmp(argv[i], "--output=", 9) == 0) | 100 | args[1] = outfile; |
88 | continue; | 101 | args[2] = NULL; |
89 | if (strncmp(argv[i], "--output-stderr=", 16) == 0) | 102 | execv(args[0], args); |
90 | continue; | 103 | perror("execvp"); |
91 | ptr += sprintf(ptr, "%s ", argv[i]); | 104 | exit(1); |
92 | } | 105 | } |
93 | 106 | ||
94 | if (enable_stderr) | 107 | /* parent */ |
95 | sprintf(ptr, "2>&1 | %s/firejail/ftee %s", LIBDIR, outfile); | 108 | if (dup2(pipefd[1], STDOUT_FILENO) == -1) { |
96 | else | 109 | errExit("dup2"); |
97 | sprintf(ptr, " | %s/firejail/ftee %s", LIBDIR, outfile); | 110 | } |
111 | if (enable_stderr && dup2(STDOUT_FILENO, STDERR_FILENO) == -1) { | ||
112 | errExit("dup2"); | ||
113 | } | ||
114 | close(pipefd[0]); | ||
115 | if (pipefd[1] != STDOUT_FILENO) { | ||
116 | close(pipefd[1]); | ||
117 | } | ||
98 | 118 | ||
99 | // run command | 119 | char **args = calloc(argc + 1, sizeof(char *)); |
100 | char *a[4]; | 120 | if (!args) { |
101 | a[0] = "/bin/bash"; | 121 | errExit("calloc"); |
102 | a[1] = "-c"; | 122 | } |
103 | a[2] = cmd; | 123 | bool found_separator = false; |
104 | a[3] = NULL; | 124 | /* copy argv into args, but drop --output(-stderr) arguments */ |
105 | execvp(a[0], a); | 125 | int j; |
126 | for (i = 0, j = 0; i < argc; i++) { | ||
127 | if (!found_separator && i > 0) { | ||
128 | if (strncmp(argv[i], "--output=", 9) == 0) { | ||
129 | continue; | ||
130 | } | ||
131 | if (strncmp(argv[i], "--output-stderr=", 16) == 0) { | ||
132 | continue; | ||
133 | } | ||
134 | if (strncmp(argv[i], "--", 2) != 0 || strcmp(argv[i], "--") == 0) { | ||
135 | found_separator = true; | ||
136 | } | ||
137 | } | ||
138 | args[j++] = argv[i]; | ||
139 | } | ||
140 | execvp(args[0], args); | ||
106 | 141 | ||
107 | perror("execvp"); | 142 | perror("execvp"); |
108 | exit(1); | 143 | exit(1); |
diff --git a/src/firejail/preproc.c b/src/firejail/preproc.c index 278099e55..c0b09e945 100644 --- a/src/firejail/preproc.c +++ b/src/firejail/preproc.c | |||
@@ -58,6 +58,20 @@ void preproc_build_firejail_dir(void) { | |||
58 | create_empty_dir_as_root(RUN_FIREJAIL_X11_DIR, 0755); | 58 | create_empty_dir_as_root(RUN_FIREJAIL_X11_DIR, 0755); |
59 | } | 59 | } |
60 | 60 | ||
61 | if (stat(RUN_FIREJAIL_DBUS_DIR, &s)) { | ||
62 | create_empty_dir_as_root(RUN_FIREJAIL_DBUS_DIR, 0755); | ||
63 | if (arg_debug) | ||
64 | printf("Remounting the " RUN_FIREJAIL_DBUS_DIR | ||
65 | " directory as noexec\n"); | ||
66 | if (mount(RUN_FIREJAIL_DBUS_DIR, RUN_FIREJAIL_DBUS_DIR, NULL, | ||
67 | MS_BIND, NULL) == -1) | ||
68 | errExit("mounting " RUN_FIREJAIL_DBUS_DIR); | ||
69 | if (mount(NULL, RUN_FIREJAIL_DBUS_DIR, NULL, | ||
70 | MS_REMOUNT | MS_BIND | MS_NOSUID | MS_NOEXEC | MS_NODEV, | ||
71 | "mode=755,gid=0") == -1) | ||
72 | errExit("remounting " RUN_FIREJAIL_DBUS_DIR); | ||
73 | } | ||
74 | |||
61 | if (stat(RUN_FIREJAIL_APPIMAGE_DIR, &s)) { | 75 | if (stat(RUN_FIREJAIL_APPIMAGE_DIR, &s)) { |
62 | create_empty_dir_as_root(RUN_FIREJAIL_APPIMAGE_DIR, 0755); | 76 | create_empty_dir_as_root(RUN_FIREJAIL_APPIMAGE_DIR, 0755); |
63 | } | 77 | } |
@@ -98,13 +112,16 @@ void preproc_mount_mnt_dir(void) { | |||
98 | //copy default seccomp files | 112 | //copy default seccomp files |
99 | copy_file(PATH_SECCOMP_32, RUN_SECCOMP_32, getuid(), getgid(), 0644); // root needed | 113 | copy_file(PATH_SECCOMP_32, RUN_SECCOMP_32, getuid(), getgid(), 0644); // root needed |
100 | } | 114 | } |
101 | if (arg_allow_debuggers) | 115 | if (arg_allow_debuggers) { |
102 | copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed | 116 | copy_file(PATH_SECCOMP_DEFAULT_DEBUG, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed |
103 | else | 117 | copy_file(PATH_SECCOMP_DEBUG_32, RUN_SECCOMP_32, getuid(), getgid(), 0644); // root needed |
118 | } else | ||
104 | copy_file(PATH_SECCOMP_DEFAULT, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed | 119 | copy_file(PATH_SECCOMP_DEFAULT, RUN_SECCOMP_CFG, getuid(), getgid(), 0644); // root needed |
105 | 120 | ||
106 | if (arg_memory_deny_write_execute) | 121 | if (arg_memory_deny_write_execute) { |
107 | copy_file(PATH_SECCOMP_MDWX, RUN_SECCOMP_MDWX, getuid(), getgid(), 0644); // root needed | 122 | copy_file(PATH_SECCOMP_MDWX, RUN_SECCOMP_MDWX, getuid(), getgid(), 0644); // root needed |
123 | copy_file(PATH_SECCOMP_MDWX_32, RUN_SECCOMP_MDWX_32, getuid(), getgid(), 0644); // root needed | ||
124 | } | ||
108 | // as root, create empty RUN_SECCOMP_PROTOCOL and RUN_SECCOMP_POSTEXEC files | 125 | // as root, create empty RUN_SECCOMP_PROTOCOL and RUN_SECCOMP_POSTEXEC files |
109 | create_empty_file_as_root(RUN_SECCOMP_PROTOCOL, 0644); | 126 | create_empty_file_as_root(RUN_SECCOMP_PROTOCOL, 0644); |
110 | if (set_perms(RUN_SECCOMP_PROTOCOL, getuid(), getgid(), 0644)) | 127 | if (set_perms(RUN_SECCOMP_PROTOCOL, getuid(), getgid(), 0644)) |
@@ -112,6 +129,9 @@ void preproc_mount_mnt_dir(void) { | |||
112 | create_empty_file_as_root(RUN_SECCOMP_POSTEXEC, 0644); | 129 | create_empty_file_as_root(RUN_SECCOMP_POSTEXEC, 0644); |
113 | if (set_perms(RUN_SECCOMP_POSTEXEC, getuid(), getgid(), 0644)) | 130 | if (set_perms(RUN_SECCOMP_POSTEXEC, getuid(), getgid(), 0644)) |
114 | errExit("set_perms"); | 131 | errExit("set_perms"); |
132 | create_empty_file_as_root(RUN_SECCOMP_POSTEXEC_32, 0644); | ||
133 | if (set_perms(RUN_SECCOMP_POSTEXEC_32, getuid(), getgid(), 0644)) | ||
134 | errExit("set_perms"); | ||
115 | #endif | 135 | #endif |
116 | } | 136 | } |
117 | } | 137 | } |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 969209869..970033899 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -18,6 +18,8 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/seccomp.h" | ||
22 | #include "../include/syscall.h" | ||
21 | #include <dirent.h> | 23 | #include <dirent.h> |
22 | #include <sys/stat.h> | 24 | #include <sys/stat.h> |
23 | extern char *xephyr_screen; | 25 | extern char *xephyr_screen; |
@@ -148,7 +150,11 @@ static int check_netoptions(void) { | |||
148 | } | 150 | } |
149 | 151 | ||
150 | static int check_nodbus(void) { | 152 | static int check_nodbus(void) { |
151 | return arg_nodbus != 0; | 153 | return arg_dbus_user != DBUS_POLICY_ALLOW || arg_dbus_system != DBUS_POLICY_ALLOW; |
154 | } | ||
155 | |||
156 | static int check_nosound(void) { | ||
157 | return arg_nosound != 0; | ||
152 | } | 158 | } |
153 | 159 | ||
154 | static int check_x11(void) { | 160 | static int check_x11(void) { |
@@ -167,6 +173,7 @@ Cond conditionals[] = { | |||
167 | {"HAS_APPIMAGE", check_appimage}, | 173 | {"HAS_APPIMAGE", check_appimage}, |
168 | {"HAS_NET", check_netoptions}, | 174 | {"HAS_NET", check_netoptions}, |
169 | {"HAS_NODBUS", check_nodbus}, | 175 | {"HAS_NODBUS", check_nodbus}, |
176 | {"HAS_NOSOUND", check_nosound}, | ||
170 | {"HAS_X11", check_x11}, | 177 | {"HAS_X11", check_x11}, |
171 | {"BROWSER_DISABLE_U2F", check_disable_u2f}, | 178 | {"BROWSER_DISABLE_U2F", check_disable_u2f}, |
172 | {"BROWSER_ALLOW_DRM", check_allow_drm}, | 179 | {"BROWSER_ALLOW_DRM", check_allow_drm}, |
@@ -425,11 +432,122 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
425 | return 0; | 432 | return 0; |
426 | } | 433 | } |
427 | else if (strcmp(ptr, "nodbus") == 0) { | 434 | else if (strcmp(ptr, "nodbus") == 0) { |
428 | arg_nodbus = 1; | 435 | arg_dbus_user = DBUS_POLICY_BLOCK; |
436 | arg_dbus_system = DBUS_POLICY_BLOCK; | ||
429 | return 0; | 437 | return 0; |
430 | } | 438 | } |
439 | else if (strncmp("dbus-user ", ptr, 10) == 0) { | ||
440 | ptr += 10; | ||
441 | if (strcmp("filter", ptr) == 0) { | ||
442 | if (arg_dbus_user == DBUS_POLICY_BLOCK) { | ||
443 | fprintf(stderr, "Error: Cannot relax dbus-user policy, it is already set to block\n"); | ||
444 | } else { | ||
445 | arg_dbus_user = DBUS_POLICY_FILTER; | ||
446 | } | ||
447 | } else if (strcmp("none", ptr) == 0) { | ||
448 | if (arg_dbus_log_user) { | ||
449 | fprintf(stderr, "Error: --dbus-user.log requires --dbus-user=filter\n"); | ||
450 | exit(1); | ||
451 | } | ||
452 | arg_dbus_user = DBUS_POLICY_BLOCK; | ||
453 | } else { | ||
454 | fprintf(stderr, "Unknown dbus-user policy: %s\n", ptr); | ||
455 | exit(1); | ||
456 | } | ||
457 | return 0; | ||
458 | } | ||
459 | else if (strncmp(ptr, "dbus-user.see ", 14) == 0) { | ||
460 | if (!dbus_check_name(ptr + 14)) { | ||
461 | printf("Invalid dbus-user.see name: %s\n", ptr + 15); | ||
462 | exit(1); | ||
463 | } | ||
464 | return 1; | ||
465 | } | ||
466 | else if (strncmp(ptr, "dbus-user.talk ", 15) == 0) { | ||
467 | if (!dbus_check_name(ptr + 15)) { | ||
468 | printf("Invalid dbus-user.talk name: %s\n", ptr + 15); | ||
469 | exit(1); | ||
470 | } | ||
471 | return 1; | ||
472 | } | ||
473 | else if (strncmp(ptr, "dbus-user.own ", 14) == 0) { | ||
474 | if (!dbus_check_name(ptr + 14)) { | ||
475 | fprintf(stderr, "Invalid dbus-user.own name: %s\n", ptr + 14); | ||
476 | exit(1); | ||
477 | } | ||
478 | return 1; | ||
479 | } | ||
480 | else if (strncmp(ptr, "dbus-user.call ", 15) == 0) { | ||
481 | if (!dbus_check_call_rule(ptr + 15)) { | ||
482 | fprintf(stderr, "Invalid dbus-user.call rule: %s\n", ptr + 15); | ||
483 | exit(1); | ||
484 | } | ||
485 | return 1; | ||
486 | } | ||
487 | else if (strncmp(ptr, "dbus-user.broadcast ", 20) == 0) { | ||
488 | if (!dbus_check_call_rule(ptr + 20)) { | ||
489 | fprintf(stderr, "Invalid dbus-user.broadcast rule: %s\n", ptr + 20); | ||
490 | exit(1); | ||
491 | } | ||
492 | return 1; | ||
493 | } | ||
494 | else if (strncmp("dbus-system ", ptr, 12) == 0) { | ||
495 | ptr += 12; | ||
496 | if (strcmp("filter", ptr) == 0) { | ||
497 | if (arg_dbus_system == DBUS_POLICY_BLOCK) { | ||
498 | fprintf(stderr, "Error: Cannot relax dbus-system policy, it is already set to block\n"); | ||
499 | } else { | ||
500 | arg_dbus_system = DBUS_POLICY_FILTER; | ||
501 | } | ||
502 | } else if (strcmp("none", ptr) == 0) { | ||
503 | if (arg_dbus_log_system) { | ||
504 | fprintf(stderr, "Error: --dbus-system.log requires --dbus-system=filter\n"); | ||
505 | exit(1); | ||
506 | } | ||
507 | arg_dbus_system = DBUS_POLICY_BLOCK; | ||
508 | } else { | ||
509 | fprintf(stderr, "Unknown dbus-system policy: %s\n", ptr); | ||
510 | exit(1); | ||
511 | } | ||
512 | return 0; | ||
513 | } | ||
514 | else if (strncmp(ptr, "dbus-system.see ", 16) == 0) { | ||
515 | if (!dbus_check_name(ptr + 16)) { | ||
516 | fprintf(stderr, "Invalid dbus-system.see name: %s\n", ptr + 17); | ||
517 | exit(1); | ||
518 | } | ||
519 | return 1; | ||
520 | } | ||
521 | else if (strncmp(ptr, "dbus-system.talk ", 17) == 0) { | ||
522 | if (!dbus_check_name(ptr + 17)) { | ||
523 | fprintf(stderr, "Invalid dbus-system.talk name: %s\n", ptr + 17); | ||
524 | exit(1); | ||
525 | } | ||
526 | return 1; | ||
527 | } | ||
528 | else if (strncmp(ptr, "dbus-system.own ", 16) == 0) { | ||
529 | if (!dbus_check_name(ptr + 16)) { | ||
530 | fprintf(stderr, "Invalid dbus-system.own name: %s\n", ptr + 16); | ||
531 | exit(1); | ||
532 | } | ||
533 | return 1; | ||
534 | } | ||
535 | else if (strncmp(ptr, "dbus-system.call ", 17) == 0) { | ||
536 | if (!dbus_check_call_rule(ptr + 17)) { | ||
537 | fprintf(stderr, "Invalid dbus-system.call rule: %s\n", ptr + 17); | ||
538 | exit(1); | ||
539 | } | ||
540 | return 1; | ||
541 | } | ||
542 | else if (strncmp(ptr, "dbus-system.broadcast ", 22) == 0) { | ||
543 | if (!dbus_check_call_rule(ptr + 22)) { | ||
544 | fprintf(stderr, "Invalid dbus-system.broadcast rule: %s\n", ptr + 22); | ||
545 | exit(1); | ||
546 | } | ||
547 | return 1; | ||
548 | } | ||
431 | else if (strcmp(ptr, "nou2f") == 0) { | 549 | else if (strcmp(ptr, "nou2f") == 0) { |
432 | arg_nou2f = 1; | 550 | arg_nou2f = 1; |
433 | return 0; | 551 | return 0; |
434 | } | 552 | } |
435 | else if (strcmp(ptr, "netfilter") == 0) { | 553 | else if (strcmp(ptr, "netfilter") == 0) { |
@@ -783,6 +901,18 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
783 | 901 | ||
784 | return 0; | 902 | return 0; |
785 | } | 903 | } |
904 | if (strncmp(ptr, "seccomp.32 ", 11) == 0) { | ||
905 | #ifdef HAVE_SECCOMP | ||
906 | if (checkcfg(CFG_SECCOMP)) { | ||
907 | arg_seccomp32 = 1; | ||
908 | cfg.seccomp_list32 = seccomp_check_list(ptr + 11); | ||
909 | } | ||
910 | else if (!arg_quiet) | ||
911 | warning_feature_disabled("seccomp"); | ||
912 | #endif | ||
913 | |||
914 | return 0; | ||
915 | } | ||
786 | 916 | ||
787 | if (strcmp(ptr, "seccomp.block-secondary") == 0) { | 917 | if (strcmp(ptr, "seccomp.block-secondary") == 0) { |
788 | #ifdef HAVE_SECCOMP | 918 | #ifdef HAVE_SECCOMP |
@@ -806,6 +936,17 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
806 | #endif | 936 | #endif |
807 | return 0; | 937 | return 0; |
808 | } | 938 | } |
939 | if (strncmp(ptr, "seccomp.32.drop ", 13) == 0) { | ||
940 | #ifdef HAVE_SECCOMP | ||
941 | if (checkcfg(CFG_SECCOMP)) { | ||
942 | arg_seccomp32 = 1; | ||
943 | cfg.seccomp_list_drop32 = seccomp_check_list(ptr + 13); | ||
944 | } | ||
945 | else | ||
946 | warning_feature_disabled("seccomp"); | ||
947 | #endif | ||
948 | return 0; | ||
949 | } | ||
809 | 950 | ||
810 | // seccomp keep list | 951 | // seccomp keep list |
811 | if (strncmp(ptr, "seccomp.keep ", 13) == 0) { | 952 | if (strncmp(ptr, "seccomp.keep ", 13) == 0) { |
@@ -819,6 +960,17 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
819 | #endif | 960 | #endif |
820 | return 0; | 961 | return 0; |
821 | } | 962 | } |
963 | if (strncmp(ptr, "seccomp.32.keep ", 13) == 0) { | ||
964 | #ifdef HAVE_SECCOMP | ||
965 | if (checkcfg(CFG_SECCOMP)) { | ||
966 | arg_seccomp32 = 1; | ||
967 | cfg.seccomp_list_keep32 = seccomp_check_list(ptr + 13); | ||
968 | } | ||
969 | else | ||
970 | warning_feature_disabled("seccomp"); | ||
971 | #endif | ||
972 | return 0; | ||
973 | } | ||
822 | 974 | ||
823 | // memory deny write&execute | 975 | // memory deny write&execute |
824 | if (strcmp(ptr, "memory-deny-write-execute") == 0) { | 976 | if (strcmp(ptr, "memory-deny-write-execute") == 0) { |
@@ -831,6 +983,35 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
831 | return 0; | 983 | return 0; |
832 | } | 984 | } |
833 | 985 | ||
986 | // seccomp error action | ||
987 | if (strncmp(ptr, "seccomp-error-action ", 21) == 0) { | ||
988 | #ifdef HAVE_SECCOMP | ||
989 | if (checkcfg(CFG_SECCOMP)) { | ||
990 | int config_seccomp_error_action = checkcfg(CFG_SECCOMP_ERROR_ACTION); | ||
991 | if (config_seccomp_error_action == -1) { | ||
992 | if (strcmp(ptr + 21, "kill") == 0) | ||
993 | arg_seccomp_error_action = SECCOMP_RET_KILL; | ||
994 | else if (strcmp(ptr + 21, "log") == 0) | ||
995 | arg_seccomp_error_action = SECCOMP_RET_LOG; | ||
996 | else { | ||
997 | arg_seccomp_error_action = errno_find_name(ptr + 21); | ||
998 | if (arg_seccomp_error_action == -1) | ||
999 | errExit("seccomp-error-action: unknown errno"); | ||
1000 | } | ||
1001 | cfg.seccomp_error_action = strdup(ptr + 21); | ||
1002 | if (!cfg.seccomp_error_action) | ||
1003 | errExit("strdup"); | ||
1004 | } else { | ||
1005 | arg_seccomp_error_action = config_seccomp_error_action; | ||
1006 | cfg.seccomp_error_action = config_seccomp_error_action_str; | ||
1007 | warning_feature_disabled("seccomp-error-action"); | ||
1008 | } | ||
1009 | } else | ||
1010 | warning_feature_disabled("seccomp"); | ||
1011 | #endif | ||
1012 | return 0; | ||
1013 | } | ||
1014 | |||
834 | // caps drop list | 1015 | // caps drop list |
835 | if (strncmp(ptr, "caps.drop ", 10) == 0) { | 1016 | if (strncmp(ptr, "caps.drop ", 10) == 0) { |
836 | arg_caps_drop = 1; | 1017 | arg_caps_drop = 1; |
@@ -1506,7 +1687,7 @@ void profile_read(const char *fname) { | |||
1506 | } | 1687 | } |
1507 | 1688 | ||
1508 | // process include | 1689 | // process include |
1509 | if (strncmp(ptr, "include ", 8) == 0) { | 1690 | if (strncmp(ptr, "include ", 8) == 0 && !is_in_ignore_list(ptr)) { |
1510 | include_level++; | 1691 | include_level++; |
1511 | 1692 | ||
1512 | // expand macros in front of the include profile file | 1693 | // expand macros in front of the include profile file |
diff --git a/src/firejail/protocol.c b/src/firejail/protocol.c index 6402afbc6..a1594d6b9 100644 --- a/src/firejail/protocol.c +++ b/src/firejail/protocol.c | |||
@@ -90,7 +90,7 @@ void protocol_print_filter(pid_t pid) { | |||
90 | exit(0); | 90 | exit(0); |
91 | #else | 91 | #else |
92 | fwarning("--protocol not supported on this platform\n"); | 92 | fwarning("--protocol not supported on this platform\n"); |
93 | return; | 93 | exit(1); |
94 | #endif | 94 | #endif |
95 | } | 95 | } |
96 | 96 | ||
diff --git a/src/firejail/pulseaudio.c b/src/firejail/pulseaudio.c index a8fb838ab..b4df78dda 100644 --- a/src/firejail/pulseaudio.c +++ b/src/firejail/pulseaudio.c | |||
@@ -27,7 +27,7 @@ | |||
27 | 27 | ||
28 | #include <fcntl.h> | 28 | #include <fcntl.h> |
29 | #ifndef O_PATH | 29 | #ifndef O_PATH |
30 | # define O_PATH 010000000 | 30 | #define O_PATH 010000000 |
31 | #endif | 31 | #endif |
32 | 32 | ||
33 | // disable pulseaudio socket | 33 | // disable pulseaudio socket |
@@ -72,8 +72,13 @@ void pulseaudio_disable(void) { | |||
72 | closedir(dir); | 72 | closedir(dir); |
73 | } | 73 | } |
74 | 74 | ||
75 | static void pulseaudio_set_environment(const char *path) { | ||
76 | assert(path); | ||
77 | if (setenv("PULSE_CLIENTCONFIG", path, 1) < 0) | ||
78 | errExit("setenv"); | ||
79 | } | ||
75 | 80 | ||
76 | // disable shm in pulseaudio | 81 | // disable shm in pulseaudio (issue #69) |
77 | void pulseaudio_init(void) { | 82 | void pulseaudio_init(void) { |
78 | struct stat s; | 83 | struct stat s; |
79 | 84 | ||
@@ -108,84 +113,63 @@ void pulseaudio_init(void) { | |||
108 | errExit("set_perms"); | 113 | errExit("set_perms"); |
109 | 114 | ||
110 | // create ~/.config/pulse directory if not present | 115 | // create ~/.config/pulse directory if not present |
111 | char *homeusercfg; | 116 | char *homeusercfg = NULL; |
112 | if (asprintf(&homeusercfg, "%s/.config", cfg.homedir) == -1) | 117 | if (asprintf(&homeusercfg, "%s/.config", cfg.homedir) == -1) |
113 | errExit("asprintf"); | 118 | errExit("asprintf"); |
114 | if (lstat(homeusercfg, &s) == -1) { | 119 | if (create_empty_dir_as_user(homeusercfg, 0700)) |
115 | if (create_empty_dir_as_user(homeusercfg, 0700)) | 120 | fs_logger2("create", homeusercfg); |
116 | fs_logger2("create", homeusercfg); | ||
117 | } | ||
118 | else if (!S_ISDIR(s.st_mode)) { | ||
119 | if (S_ISLNK(s.st_mode)) | ||
120 | fprintf(stderr, "Error: %s is a symbolic link\n", homeusercfg); | ||
121 | else | ||
122 | fprintf(stderr, "Error: %s is not a directory\n", homeusercfg); | ||
123 | exit(1); | ||
124 | } | ||
125 | free(homeusercfg); | ||
126 | 121 | ||
122 | free(homeusercfg); | ||
127 | if (asprintf(&homeusercfg, "%s/.config/pulse", cfg.homedir) == -1) | 123 | if (asprintf(&homeusercfg, "%s/.config/pulse", cfg.homedir) == -1) |
128 | errExit("asprintf"); | 124 | errExit("asprintf"); |
129 | if (lstat(homeusercfg, &s) == -1) { | 125 | if (create_empty_dir_as_user(homeusercfg, 0700)) |
130 | if (create_empty_dir_as_user(homeusercfg, 0700)) | 126 | fs_logger2("create", homeusercfg); |
131 | fs_logger2("create", homeusercfg); | 127 | |
132 | } | 128 | // if ~/.config/pulse now exists and there are no symbolic links, mount the new directory |
133 | else if (!S_ISDIR(s.st_mode)) { | 129 | // else set environment variable |
134 | if (S_ISLNK(s.st_mode)) | 130 | int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); |
135 | fprintf(stderr, "Error: %s is a symbolic link\n", homeusercfg); | 131 | if (fd == -1) { |
136 | else | 132 | pulseaudio_set_environment(pulsecfg); |
137 | fprintf(stderr, "Error: %s is not a directory\n", homeusercfg); | 133 | goto out; |
138 | exit(1); | ||
139 | } | 134 | } |
140 | 135 | // confirm the actual mount destination is owned by the user | |
141 | // if we have ~/.config/pulse mount the new directory, else set environment variable. | 136 | if (fstat(fd, &s) == -1) |
142 | if (stat(homeusercfg, &s) == 0) { | 137 | errExit("fstat"); |
143 | // get a file descriptor for ~/.config/pulse, fails if there is any symlink | 138 | if (s.st_uid != getuid()) { |
144 | int fd = safe_fd(homeusercfg, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | ||
145 | if (fd == -1) | ||
146 | errExit("safe_fd"); | ||
147 | // confirm the actual mount destination is owned by the user | ||
148 | if (fstat(fd, &s) == -1) | ||
149 | errExit("fstat"); | ||
150 | if (s.st_uid != getuid()) { | ||
151 | fprintf(stderr, "Error: %s is not owned by the current user\n", homeusercfg); | ||
152 | exit(1); | ||
153 | } | ||
154 | // preserve a read-only mount | ||
155 | struct statvfs vfs; | ||
156 | if (fstatvfs(fd, &vfs) == -1) | ||
157 | errExit("fstatvfs"); | ||
158 | if ((vfs.f_flag & MS_RDONLY) == MS_RDONLY) | ||
159 | fs_remount(RUN_PULSE_DIR, MOUNT_READONLY, 0); | ||
160 | // mount via the link in /proc/self/fd | ||
161 | if (arg_debug) | ||
162 | printf("Mounting %s on %s\n", RUN_PULSE_DIR, homeusercfg); | ||
163 | char *proc; | ||
164 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) | ||
165 | errExit("asprintf"); | ||
166 | if (mount(RUN_PULSE_DIR, proc, "none", MS_BIND, NULL) < 0) | ||
167 | errExit("mount pulseaudio"); | ||
168 | fs_logger2("tmpfs", homeusercfg); | ||
169 | free(proc); | ||
170 | close(fd); | 139 | close(fd); |
171 | // check /proc/self/mountinfo to confirm the mount is ok | 140 | pulseaudio_set_environment(pulsecfg); |
172 | MountData *mptr = get_last_mount(); | 141 | goto out; |
173 | if (strcmp(mptr->dir, homeusercfg) != 0 || strcmp(mptr->fstype, "tmpfs") != 0) | ||
174 | errLogExit("invalid pulseaudio mount"); | ||
175 | |||
176 | char *p; | ||
177 | if (asprintf(&p, "%s/client.conf", homeusercfg) == -1) | ||
178 | errExit("asprintf"); | ||
179 | fs_logger2("create", p); | ||
180 | free(p); | ||
181 | } | ||
182 | |||
183 | else { | ||
184 | // set environment | ||
185 | if (setenv("PULSE_CLIENTCONFIG", pulsecfg, 1) < 0) | ||
186 | errExit("setenv"); | ||
187 | } | 142 | } |
143 | // preserve a read-only mount | ||
144 | struct statvfs vfs; | ||
145 | if (fstatvfs(fd, &vfs) == -1) | ||
146 | errExit("fstatvfs"); | ||
147 | if ((vfs.f_flag & MS_RDONLY) == MS_RDONLY) | ||
148 | fs_remount(RUN_PULSE_DIR, MOUNT_READONLY, 0); | ||
149 | // mount via the link in /proc/self/fd | ||
150 | if (arg_debug) | ||
151 | printf("Mounting %s on %s\n", RUN_PULSE_DIR, homeusercfg); | ||
152 | char *proc; | ||
153 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) | ||
154 | errExit("asprintf"); | ||
155 | if (mount(RUN_PULSE_DIR, proc, "none", MS_BIND, NULL) < 0) | ||
156 | errExit("mount pulseaudio"); | ||
157 | // check /proc/self/mountinfo to confirm the mount is ok | ||
158 | MountData *mptr = get_last_mount(); | ||
159 | if (strcmp(mptr->dir, homeusercfg) != 0 || strcmp(mptr->fstype, "tmpfs") != 0) | ||
160 | errLogExit("invalid pulseaudio mount"); | ||
161 | fs_logger2("tmpfs", homeusercfg); | ||
162 | free(proc); | ||
163 | close(fd); | ||
164 | |||
165 | char *p; | ||
166 | if (asprintf(&p, "%s/client.conf", homeusercfg) == -1) | ||
167 | errExit("asprintf"); | ||
168 | fs_logger2("create", p); | ||
169 | pulseaudio_set_environment(p); | ||
170 | free(p); | ||
188 | 171 | ||
172 | out: | ||
189 | free(pulsecfg); | 173 | free(pulsecfg); |
190 | free(homeusercfg); | 174 | free(homeusercfg); |
191 | } | 175 | } |
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c index 5ebb0e9ec..a007312a6 100644 --- a/src/firejail/restrict_users.c +++ b/src/firejail/restrict_users.c | |||
@@ -29,7 +29,7 @@ | |||
29 | 29 | ||
30 | #include <fcntl.h> | 30 | #include <fcntl.h> |
31 | #ifndef O_PATH | 31 | #ifndef O_PATH |
32 | # define O_PATH 010000000 | 32 | #define O_PATH 010000000 |
33 | #endif | 33 | #endif |
34 | 34 | ||
35 | #define MAXBUF 1024 | 35 | #define MAXBUF 1024 |
@@ -68,27 +68,25 @@ static USER_LIST *ulist_find(const char *user) { | |||
68 | 68 | ||
69 | static void sanitize_home(void) { | 69 | static void sanitize_home(void) { |
70 | assert(getuid() != 0); // this code works only for regular users | 70 | assert(getuid() != 0); // this code works only for regular users |
71 | struct stat s; | ||
71 | 72 | ||
72 | if (arg_debug) | 73 | if (arg_debug) |
73 | printf("Cleaning /home directory\n"); | 74 | printf("Cleaning /home directory\n"); |
74 | |||
75 | struct stat s; | ||
76 | if (stat(cfg.homedir, &s) == -1) { | ||
77 | // cannot find home directory, just return | ||
78 | fwarning("cannot find home directory\n"); | ||
79 | return; | ||
80 | } | ||
81 | |||
82 | if (mkdir(RUN_WHITELIST_HOME_DIR, 0755) == -1) | ||
83 | errExit("mkdir"); | ||
84 | |||
85 | // keep a copy of the user home directory | 75 | // keep a copy of the user home directory |
86 | int fd = safe_fd(cfg.homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | 76 | int fd = safe_fd(cfg.homedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); |
87 | if (fd == -1) | 77 | if (fd == -1) |
88 | errExit("safe_fd"); | 78 | goto errout; |
79 | if (fstat(fd, &s) == -1) { // FUSE | ||
80 | if (errno != EACCES) | ||
81 | errExit("fstat"); | ||
82 | close(fd); | ||
83 | goto errout; | ||
84 | } | ||
89 | char *proc; | 85 | char *proc; |
90 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) | 86 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) |
91 | errExit("asprintf"); | 87 | errExit("asprintf"); |
88 | if (mkdir(RUN_WHITELIST_HOME_DIR, 0755) == -1) | ||
89 | errExit("mkdir"); | ||
92 | if (mount(proc, RUN_WHITELIST_HOME_DIR, NULL, MS_BIND|MS_REC, NULL) < 0) | 90 | if (mount(proc, RUN_WHITELIST_HOME_DIR, NULL, MS_BIND|MS_REC, NULL) < 0) |
93 | errExit("mount bind"); | 91 | errExit("mount bind"); |
94 | free(proc); | 92 | free(proc); |
@@ -125,6 +123,10 @@ static void sanitize_home(void) { | |||
125 | if (!arg_private) | 123 | if (!arg_private) |
126 | fs_logger2("whitelist", cfg.homedir); | 124 | fs_logger2("whitelist", cfg.homedir); |
127 | 125 | ||
126 | return; | ||
127 | |||
128 | errout: | ||
129 | fwarning("cannot clean /home directory\n"); | ||
128 | } | 130 | } |
129 | 131 | ||
130 | static void sanitize_run(void) { | 132 | static void sanitize_run(void) { |
@@ -167,7 +169,7 @@ static void sanitize_run(void) { | |||
167 | if (set_perms(runuser, getuid(), getgid(), 0700)) | 169 | if (set_perms(runuser, getuid(), getgid(), 0700)) |
168 | errExit("set_perms"); | 170 | errExit("set_perms"); |
169 | 171 | ||
170 | // mount user home directory | 172 | // mount /run/user/$UID directory |
171 | if (mount(RUN_WHITELIST_RUN_DIR, runuser, NULL, MS_BIND|MS_REC, NULL) < 0) | 173 | if (mount(RUN_WHITELIST_RUN_DIR, runuser, NULL, MS_BIND|MS_REC, NULL) < 0) |
172 | errExit("mount bind"); | 174 | errExit("mount bind"); |
173 | 175 | ||
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index d1d98f636..e42d35be5 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -19,16 +19,17 @@ | |||
19 | */ | 19 | */ |
20 | 20 | ||
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include "../include/seccomp.h" | ||
22 | #include <sys/mount.h> | 23 | #include <sys/mount.h> |
23 | #include <sys/wait.h> | 24 | #include <sys/wait.h> |
24 | #include <sys/stat.h> | 25 | #include <sys/stat.h> |
25 | #include <sys/prctl.h> | ||
26 | #include <sys/time.h> | 26 | #include <sys/time.h> |
27 | #include <sys/resource.h> | 27 | #include <sys/resource.h> |
28 | #include <sys/types.h> | 28 | #include <sys/types.h> |
29 | #include <dirent.h> | 29 | #include <dirent.h> |
30 | #include <errno.h> | 30 | #include <errno.h> |
31 | #include <fcntl.h> | 31 | #include <fcntl.h> |
32 | #include <syscall.h> | ||
32 | 33 | ||
33 | #include <sched.h> | 34 | #include <sched.h> |
34 | #ifndef CLONE_NEWUSER | 35 | #ifndef CLONE_NEWUSER |
@@ -37,16 +38,15 @@ | |||
37 | 38 | ||
38 | #include <sys/prctl.h> | 39 | #include <sys/prctl.h> |
39 | #ifndef PR_SET_NO_NEW_PRIVS | 40 | #ifndef PR_SET_NO_NEW_PRIVS |
40 | # define PR_SET_NO_NEW_PRIVS 38 | 41 | #define PR_SET_NO_NEW_PRIVS 38 |
41 | #endif | 42 | #endif |
42 | #ifndef PR_GET_NO_NEW_PRIVS | 43 | #ifndef PR_GET_NO_NEW_PRIVS |
43 | # define PR_GET_NO_NEW_PRIVS 39 | 44 | #define PR_GET_NO_NEW_PRIVS 39 |
44 | #endif | 45 | #endif |
45 | 46 | ||
46 | #ifdef HAVE_APPARMOR | 47 | #ifdef HAVE_APPARMOR |
47 | #include <sys/apparmor.h> | 48 | #include <sys/apparmor.h> |
48 | #endif | 49 | #endif |
49 | #include <syscall.h> | ||
50 | 50 | ||
51 | 51 | ||
52 | static int force_nonewprivs = 0; | 52 | static int force_nonewprivs = 0; |
@@ -125,6 +125,21 @@ static void set_caps(void) { | |||
125 | caps_drop_dac_override(); | 125 | caps_drop_dac_override(); |
126 | } | 126 | } |
127 | 127 | ||
128 | #ifdef HAVE_APPARMOR | ||
129 | void set_apparmor(void) { | ||
130 | EUID_ASSERT(); | ||
131 | if (checkcfg(CFG_APPARMOR) && arg_apparmor) { | ||
132 | if (aa_change_onexec("firejail-default")) { | ||
133 | fwarning("Cannot confine the application using AppArmor.\n" | ||
134 | "Maybe firejail-default AppArmor profile is not loaded into the kernel.\n" | ||
135 | "As root, run \"aa-enforce firejail-default\" to load it.\n"); | ||
136 | } | ||
137 | else if (arg_debug) | ||
138 | printf("AppArmor enabled\n"); | ||
139 | } | ||
140 | } | ||
141 | #endif | ||
142 | |||
128 | static void save_nogroups(void) { | 143 | static void save_nogroups(void) { |
129 | if (arg_nogroups == 0) | 144 | if (arg_nogroups == 0) |
130 | return; | 145 | return; |
@@ -182,6 +197,32 @@ static FILE *create_ready_for_join_file(void) { | |||
182 | } | 197 | } |
183 | } | 198 | } |
184 | 199 | ||
200 | #ifdef HAVE_SECCOMP | ||
201 | static void seccomp_debug(void) { | ||
202 | if (arg_debug == 0) | ||
203 | return; | ||
204 | |||
205 | pid_t child = fork(); | ||
206 | if (child < 0) | ||
207 | errExit("fork"); | ||
208 | if (child == 0) { | ||
209 | // dropping privs before calling system(3) | ||
210 | drop_privs(1); | ||
211 | printf("Seccomp directory:\n"); | ||
212 | int rv = system("ls -l " RUN_SECCOMP_DIR); | ||
213 | (void) rv; | ||
214 | printf("Active seccomp files:\n"); | ||
215 | rv = system("cat " RUN_SECCOMP_LIST); | ||
216 | (void) rv; | ||
217 | #ifdef HAVE_GCOV | ||
218 | __gcov_flush(); | ||
219 | #endif | ||
220 | _exit(0); | ||
221 | } | ||
222 | waitpid(child, NULL, 0); | ||
223 | } | ||
224 | #endif | ||
225 | |||
185 | static void sandbox_if_up(Bridge *br) { | 226 | static void sandbox_if_up(Bridge *br) { |
186 | assert(br); | 227 | assert(br); |
187 | if (!br->configured) | 228 | if (!br->configured) |
@@ -625,7 +666,8 @@ int sandbox(void* sandbox_arg) { | |||
625 | // ... and mount a tmpfs on top of /run/firejail/mnt directory | 666 | // ... and mount a tmpfs on top of /run/firejail/mnt directory |
626 | preproc_mount_mnt_dir(); | 667 | preproc_mount_mnt_dir(); |
627 | // bind-mount firejail binaries and helper programs | 668 | // bind-mount firejail binaries and helper programs |
628 | if (mount(LIBDIR "/firejail", RUN_FIREJAIL_LIB_DIR, "none", MS_BIND, NULL) < 0) | 669 | if (mount(LIBDIR "/firejail", RUN_FIREJAIL_LIB_DIR, NULL, MS_BIND, NULL) < 0 || |
670 | mount(NULL, RUN_FIREJAIL_LIB_DIR, NULL, MS_RDONLY|MS_NOSUID|MS_NODEV|MS_BIND|MS_REMOUNT, NULL) < 0) | ||
629 | errExit("mounting " RUN_FIREJAIL_LIB_DIR); | 671 | errExit("mounting " RUN_FIREJAIL_LIB_DIR); |
630 | 672 | ||
631 | //**************************** | 673 | //**************************** |
@@ -778,8 +820,6 @@ int sandbox(void* sandbox_arg) { | |||
778 | if (rv) | 820 | if (rv) |
779 | exit(rv); | 821 | exit(rv); |
780 | } | 822 | } |
781 | if (arg_seccomp && (cfg.seccomp_list || cfg.seccomp_list_drop || cfg.seccomp_list_keep)) | ||
782 | arg_seccomp_postexec = 1; | ||
783 | #endif | 823 | #endif |
784 | 824 | ||
785 | // need ld.so.preload if tracing or seccomp with any non-default lists | 825 | // need ld.so.preload if tracing or seccomp with any non-default lists |
@@ -918,8 +958,7 @@ int sandbox(void* sandbox_arg) { | |||
918 | //**************************** | 958 | //**************************** |
919 | // Session D-BUS | 959 | // Session D-BUS |
920 | //**************************** | 960 | //**************************** |
921 | if (arg_nodbus) | 961 | dbus_apply_policy(); |
922 | dbus_disable(); | ||
923 | 962 | ||
924 | 963 | ||
925 | //**************************** | 964 | //**************************** |
@@ -1098,28 +1137,32 @@ int sandbox(void* sandbox_arg) { | |||
1098 | // if a keep list is available, disregard the drop list | 1137 | // if a keep list is available, disregard the drop list |
1099 | if (arg_seccomp == 1) { | 1138 | if (arg_seccomp == 1) { |
1100 | if (cfg.seccomp_list_keep) | 1139 | if (cfg.seccomp_list_keep) |
1101 | seccomp_filter_keep(); | 1140 | seccomp_filter_keep(true); |
1102 | else | 1141 | else |
1103 | seccomp_filter_drop(); | 1142 | seccomp_filter_drop(true); |
1104 | |||
1105 | } | 1143 | } |
1106 | else { // clean seccomp files under /run/firejail/mnt | 1144 | if (arg_seccomp32 == 1) { |
1107 | int rv = unlink(RUN_SECCOMP_CFG); | 1145 | if (cfg.seccomp_list_keep32) |
1108 | rv |= unlink(RUN_SECCOMP_32); | 1146 | seccomp_filter_keep(false); |
1109 | (void) rv; | 1147 | else |
1148 | seccomp_filter_drop(false); | ||
1149 | |||
1110 | } | 1150 | } |
1111 | 1151 | ||
1112 | if (arg_memory_deny_write_execute) { | 1152 | if (arg_memory_deny_write_execute) { |
1153 | if (arg_seccomp_error_action != EPERM) { | ||
1154 | seccomp_filter_mdwx(true); | ||
1155 | seccomp_filter_mdwx(false); | ||
1156 | } | ||
1113 | if (arg_debug) | 1157 | if (arg_debug) |
1114 | printf("Install memory write&execute filter\n"); | 1158 | printf("Install memory write&execute filter\n"); |
1115 | seccomp_load(RUN_SECCOMP_MDWX); // install filter | 1159 | seccomp_load(RUN_SECCOMP_MDWX); // install filter |
1160 | seccomp_load(RUN_SECCOMP_MDWX_32); | ||
1116 | } | 1161 | } |
1117 | else { | 1162 | |
1118 | int rv = unlink(RUN_SECCOMP_MDWX); | ||
1119 | (void) rv; | ||
1120 | } | ||
1121 | // make seccomp filters read-only | 1163 | // make seccomp filters read-only |
1122 | fs_remount(RUN_SECCOMP_DIR, MOUNT_READONLY, 0); | 1164 | fs_remount(RUN_SECCOMP_DIR, MOUNT_READONLY, 0); |
1165 | seccomp_debug(); | ||
1123 | #endif | 1166 | #endif |
1124 | 1167 | ||
1125 | // set capabilities | 1168 | // set capabilities |
@@ -1203,17 +1246,10 @@ int sandbox(void* sandbox_arg) { | |||
1203 | 1246 | ||
1204 | if (app_pid == 0) { | 1247 | if (app_pid == 0) { |
1205 | #ifdef HAVE_APPARMOR | 1248 | #ifdef HAVE_APPARMOR |
1206 | if (checkcfg(CFG_APPARMOR) && arg_apparmor) { | 1249 | // add apparmor confinement after the execve |
1207 | errno = 0; | 1250 | set_apparmor(); |
1208 | if (aa_change_onexec("firejail-default")) { | ||
1209 | fwarning("Cannot confine the application using AppArmor.\n" | ||
1210 | "Maybe firejail-default AppArmor profile is not loaded into the kernel.\n" | ||
1211 | "As root, run \"aa-enforce firejail-default\" to load it.\n"); | ||
1212 | } | ||
1213 | else if (arg_debug) | ||
1214 | printf("AppArmor enabled\n"); | ||
1215 | } | ||
1216 | #endif | 1251 | #endif |
1252 | |||
1217 | // set nice and rlimits | 1253 | // set nice and rlimits |
1218 | if (arg_nice) | 1254 | if (arg_nice) |
1219 | set_nice(cfg.nice); | 1255 | set_nice(cfg.nice); |
diff --git a/src/firejail/sbox.c b/src/firejail/sbox.c index c3b68f3a8..57c21ce78 100644 --- a/src/firejail/sbox.c +++ b/src/firejail/sbox.c | |||
@@ -23,7 +23,7 @@ | |||
23 | #include <unistd.h> | 23 | #include <unistd.h> |
24 | #include <net/if.h> | 24 | #include <net/if.h> |
25 | #include <stdarg.h> | 25 | #include <stdarg.h> |
26 | #include <sys/wait.h> | 26 | #include <sys/wait.h> |
27 | #include "../include/seccomp.h" | 27 | #include "../include/seccomp.h" |
28 | 28 | ||
29 | #include <fcntl.h> | 29 | #include <fcntl.h> |
@@ -31,101 +31,233 @@ | |||
31 | #define O_PATH 010000000 | 31 | #define O_PATH 010000000 |
32 | #endif | 32 | #endif |
33 | 33 | ||
34 | static struct sock_filter filter[] = { | 34 | static int __attribute__((noreturn)) sbox_do_exec_v(unsigned filtermask, char * const arg[]) { |
35 | VALIDATE_ARCHITECTURE, | 35 | // build a new, clean environment |
36 | EXAMINE_SYSCALL, | 36 | int env_index = 0; |
37 | char *new_environment[256] = { NULL }; | ||
38 | // preserve firejail-specific env vars | ||
39 | char *cl = getenv("FIREJAIL_FILE_COPY_LIMIT"); | ||
40 | if (cl) { | ||
41 | if (asprintf(&new_environment[env_index++], "FIREJAIL_FILE_COPY_LIMIT=%s", cl) == -1) | ||
42 | errExit("asprintf"); | ||
43 | } | ||
44 | if (arg_quiet) // --quiet is passed as an environment variable | ||
45 | new_environment[env_index++] = "FIREJAIL_QUIET=yes"; | ||
46 | if (arg_debug) // --debug is passed as an environment variable | ||
47 | new_environment[env_index++] = "FIREJAIL_DEBUG=yes"; | ||
48 | if (cfg.seccomp_error_action) | ||
49 | if (asprintf(&new_environment[env_index++], "FIREJAIL_SECCOMP_ERROR_ACTION=%s", cfg.seccomp_error_action) == -1) | ||
50 | errExit("asprintf"); | ||
51 | |||
52 | if (filtermask & SBOX_STDIN_FROM_FILE) { | ||
53 | int fd; | ||
54 | if((fd = open(SBOX_STDIN_FILE, O_RDONLY)) == -1) { | ||
55 | fprintf(stderr,"Error: cannot open %s\n", SBOX_STDIN_FILE); | ||
56 | exit(1); | ||
57 | } | ||
58 | if (dup2(fd, STDIN_FILENO) == -1) | ||
59 | errExit("dup2"); | ||
60 | close(fd); | ||
61 | } | ||
62 | else if ((filtermask & SBOX_ALLOW_STDIN) == 0) { | ||
63 | int fd = open("/dev/null",O_RDWR, 0); | ||
64 | if (fd != -1) { | ||
65 | if (dup2(fd, STDIN_FILENO) == -1) | ||
66 | errExit("dup2"); | ||
67 | close(fd); | ||
68 | } | ||
69 | else // the user could run the sandbox without /dev/null | ||
70 | close(STDIN_FILENO); | ||
71 | } | ||
72 | |||
73 | // close all other file descriptors | ||
74 | if ((filtermask & SBOX_KEEP_FDS) == 0) { | ||
75 | int i; | ||
76 | for (i = 3; i < FIREJAIL_MAX_FD; i++) | ||
77 | close(i); // close open files | ||
78 | } | ||
79 | |||
80 | umask(027); | ||
81 | |||
82 | // apply filters | ||
83 | if (filtermask & SBOX_CAPS_NONE) { | ||
84 | caps_drop_all(); | ||
85 | } else { | ||
86 | uint64_t set = 0; | ||
87 | if (filtermask & SBOX_CAPS_NETWORK) { | ||
88 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
89 | set |= ((uint64_t) 1) << CAP_NET_ADMIN; | ||
90 | set |= ((uint64_t) 1) << CAP_NET_RAW; | ||
91 | #endif | ||
92 | } | ||
93 | if (filtermask & SBOX_CAPS_HIDEPID) { | ||
94 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
95 | set |= ((uint64_t) 1) << CAP_SYS_PTRACE; | ||
96 | set |= ((uint64_t) 1) << CAP_SYS_PACCT; | ||
97 | #endif | ||
98 | } | ||
99 | if (filtermask & SBOX_CAPS_NET_SERVICE) { | ||
100 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
101 | set |= ((uint64_t) 1) << CAP_NET_BIND_SERVICE; | ||
102 | set |= ((uint64_t) 1) << CAP_NET_BROADCAST; | ||
103 | #endif | ||
104 | } | ||
105 | if (set != 0) { // some SBOX_CAPS_ flag was specified, drop all other capabilities | ||
106 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
107 | caps_set(set); | ||
108 | #endif | ||
109 | } | ||
110 | } | ||
111 | |||
112 | if (filtermask & SBOX_SECCOMP) { | ||
113 | struct sock_filter filter[] = { | ||
114 | VALIDATE_ARCHITECTURE, | ||
115 | EXAMINE_SYSCALL, | ||
37 | 116 | ||
38 | #if defined(__x86_64__) | 117 | #if defined(__x86_64__) |
39 | #define X32_SYSCALL_BIT 0x40000000 | 118 | #define X32_SYSCALL_BIT 0x40000000 |
40 | // handle X32 ABI | 119 | // handle X32 ABI |
41 | BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, X32_SYSCALL_BIT, 1, 0), | 120 | BPF_JUMP(BPF_JMP + BPF_JGE + BPF_K, X32_SYSCALL_BIT, 1, 0), |
42 | BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, 0, 1, 0), | 121 | BPF_JUMP(BPF_JMP + BPF_JGE + BPF_K, 0, 1, 0), |
43 | RETURN_ERRNO(EPERM), | 122 | RETURN_ERRNO(EPERM), |
44 | #endif | 123 | #endif |
45 | 124 | ||
46 | // syscall list | 125 | // syscall list |
47 | #ifdef SYS_mount | 126 | #ifdef SYS_mount |
48 | BLACKLIST(SYS_mount), // mount/unmount filesystems | 127 | BLACKLIST(SYS_mount), // mount/unmount filesystems |
128 | #endif | ||
129 | #ifdef SYS_umount | ||
130 | BLACKLIST(SYS_umount), | ||
49 | #endif | 131 | #endif |
50 | #ifdef SYS_umount2 | 132 | #ifdef SYS_umount2 |
51 | BLACKLIST(SYS_umount2), | 133 | BLACKLIST(SYS_umount2), |
52 | #endif | 134 | #endif |
53 | #ifdef SYS_ptrace | 135 | #ifdef SYS_ptrace |
54 | BLACKLIST(SYS_ptrace), // trace processes | 136 | BLACKLIST(SYS_ptrace), // trace processes |
137 | #endif | ||
138 | #ifdef SYS_process_vm_readv | ||
139 | BLACKLIST(SYS_process_vm_readv), | ||
140 | #endif | ||
141 | #ifdef SYS_process_vm_writev | ||
142 | BLACKLIST(SYS_process_vm_writev), | ||
55 | #endif | 143 | #endif |
56 | #ifdef SYS_kexec_file_load | 144 | #ifdef SYS_kexec_file_load |
57 | BLACKLIST(SYS_kexec_file_load), | 145 | BLACKLIST(SYS_kexec_file_load), // loading a different kernel |
58 | #endif | 146 | #endif |
59 | #ifdef SYS_kexec_load | 147 | #ifdef SYS_kexec_load |
60 | BLACKLIST(SYS_kexec_load), // loading a different kernel | 148 | BLACKLIST(SYS_kexec_load), |
61 | #endif | 149 | #endif |
62 | #ifdef SYS_name_to_handle_at | 150 | #ifdef SYS_name_to_handle_at |
63 | BLACKLIST(SYS_name_to_handle_at), | 151 | BLACKLIST(SYS_name_to_handle_at), |
64 | #endif | 152 | #endif |
65 | #ifdef SYS_open_by_handle_at | 153 | #ifdef SYS_open_by_handle_at |
66 | BLACKLIST(SYS_open_by_handle_at), // open by handle | 154 | BLACKLIST(SYS_open_by_handle_at), // open by handle |
67 | #endif | 155 | #endif |
68 | #ifdef SYS_init_module | 156 | #ifdef SYS_init_module |
69 | BLACKLIST(SYS_init_module), // kernel module handling | 157 | BLACKLIST(SYS_init_module), // kernel module handling |
70 | #endif | 158 | #endif |
71 | #ifdef SYS_finit_module // introduced in 2013 | 159 | #ifdef SYS_finit_module // introduced in 2013 |
72 | BLACKLIST(SYS_finit_module), | 160 | BLACKLIST(SYS_finit_module), |
73 | #endif | 161 | #endif |
74 | #ifdef SYS_create_module | 162 | #ifdef SYS_create_module |
75 | BLACKLIST(SYS_create_module), | 163 | BLACKLIST(SYS_create_module), |
76 | #endif | 164 | #endif |
77 | #ifdef SYS_delete_module | 165 | #ifdef SYS_delete_module |
78 | BLACKLIST(SYS_delete_module), | 166 | BLACKLIST(SYS_delete_module), |
79 | #endif | 167 | #endif |
80 | #ifdef SYS_iopl | 168 | #ifdef SYS_iopl |
81 | BLACKLIST(SYS_iopl), // io permissions | 169 | BLACKLIST(SYS_iopl), // io permissions |
82 | #endif | ||
83 | #ifdef SYS_ioperm | ||
84 | BLACKLIST(SYS_ioperm), | ||
85 | #endif | 170 | #endif |
86 | #ifdef SYS_iopl | 171 | #ifdef SYS_ioperm |
87 | BLACKLIST(SYS_iopl), // io permissions | 172 | BLACKLIST(SYS_ioperm), |
88 | #endif | 173 | #endif |
89 | #ifdef SYS_ioprio_set | 174 | #ifdef SYS_ioprio_set |
90 | BLACKLIST(SYS_ioprio_set), | 175 | BLACKLIST(SYS_ioprio_set), |
91 | #endif | 176 | #endif |
92 | #ifdef SYS_ni_syscall // new io permissions call on arm devices | 177 | #ifdef SYS_ni_syscall // new io permissions call on arm devices |
93 | BLACKLIST(SYS_ni_syscall), | 178 | BLACKLIST(SYS_ni_syscall), |
94 | #endif | 179 | #endif |
95 | #ifdef SYS_swapon | 180 | #ifdef SYS_swapon |
96 | BLACKLIST(SYS_swapon), // swap on/off | 181 | BLACKLIST(SYS_swapon), // swap on/off |
97 | #endif | 182 | #endif |
98 | #ifdef SYS_swapoff | 183 | #ifdef SYS_swapoff |
99 | BLACKLIST(SYS_swapoff), | 184 | BLACKLIST(SYS_swapoff), |
100 | #endif | 185 | #endif |
101 | #ifdef SYS_syslog | 186 | #ifdef SYS_syslog |
102 | BLACKLIST(SYS_syslog), // kernel printk control | 187 | BLACKLIST(SYS_syslog), // kernel printk control |
103 | #endif | 188 | #endif |
104 | RETURN_ALLOW | 189 | RETURN_ALLOW |
105 | }; | 190 | }; |
106 | 191 | ||
107 | static struct sock_fprog prog = { | 192 | struct sock_fprog prog = { |
108 | .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])), | 193 | .len = (unsigned short)(sizeof(filter) / sizeof(filter[0])), |
109 | .filter = filter, | 194 | .filter = filter, |
110 | }; | 195 | }; |
196 | |||
197 | if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | ||
198 | perror("prctl(NO_NEW_PRIVS)"); | ||
199 | } | ||
200 | if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) { | ||
201 | perror("prctl(PR_SET_SECCOMP)"); | ||
202 | } | ||
203 | } | ||
204 | |||
205 | if (filtermask & SBOX_ROOT) { | ||
206 | // elevate privileges in order to get grsecurity working | ||
207 | if (setreuid(0, 0)) | ||
208 | errExit("setreuid"); | ||
209 | if (setregid(0, 0)) | ||
210 | errExit("setregid"); | ||
211 | } | ||
212 | else if (filtermask & SBOX_USER) | ||
213 | drop_privs(1); | ||
214 | |||
215 | if (arg[0]) { // get rid of scan-build warning | ||
216 | int fd = open(arg[0], O_PATH | O_CLOEXEC); | ||
217 | if (fd == -1) { | ||
218 | if (errno == ENOENT) { | ||
219 | fprintf(stderr, "Error: %s does not exist\n", arg[0]); | ||
220 | exit(1); | ||
221 | } else { | ||
222 | errExit("open"); | ||
223 | } | ||
224 | } | ||
225 | struct stat s; | ||
226 | if (fstat(fd, &s) == -1) | ||
227 | errExit("fstat"); | ||
228 | if (s.st_uid != 0 && s.st_gid != 0) { | ||
229 | fprintf(stderr, "Error: %s is not owned by root, refusing to execute\n", arg[0]); | ||
230 | exit(1); | ||
231 | } | ||
232 | if (s.st_mode & 00002) { | ||
233 | fprintf(stderr, "Error: %s is world writable, refusing to execute\n", arg[0]); | ||
234 | exit(1); | ||
235 | } | ||
236 | fexecve(fd, arg, new_environment); | ||
237 | } else { | ||
238 | assert(0); | ||
239 | } | ||
240 | perror("fexecve"); | ||
241 | _exit(1); | ||
242 | } | ||
111 | 243 | ||
112 | int sbox_run(unsigned filtermask, int num, ...) { | 244 | int sbox_run(unsigned filtermask, int num, ...) { |
113 | va_list valist; | 245 | va_list valist; |
114 | va_start(valist, num); | 246 | va_start(valist, num); |
115 | 247 | ||
116 | // build argument list | 248 | // build argument list |
117 | char **arg = malloc((num + 1) * sizeof(char *)); | 249 | char **arg = malloc((num + 1) * sizeof(char *)); |
118 | int i; | 250 | int i; |
119 | for (i = 0; i < num; i++) | 251 | for (i = 0; i < num; i++) |
120 | arg[i] = va_arg(valist, char*); | 252 | arg[i] = va_arg(valist, char *); |
121 | arg[i] = NULL; | 253 | arg[i] = NULL; |
122 | va_end(valist); | 254 | va_end(valist); |
123 | 255 | ||
124 | int status = sbox_run_v(filtermask, arg); | 256 | int status = sbox_run_v(filtermask, arg); |
125 | 257 | ||
126 | free(arg); | 258 | free(arg); |
127 | 259 | ||
128 | return status; | 260 | return status; |
129 | } | 261 | } |
130 | 262 | ||
131 | int sbox_run_v(unsigned filtermask, char * const arg[]) { | 263 | int sbox_run_v(unsigned filtermask, char * const arg[]) { |
@@ -141,129 +273,14 @@ int sbox_run_v(unsigned filtermask, char * const arg[]) { | |||
141 | printf("\n"); | 273 | printf("\n"); |
142 | } | 274 | } |
143 | 275 | ||
276 | // KEEP_FDS only makes sense with sbox_exec_v | ||
277 | assert((filtermask & SBOX_KEEP_FDS) == 0); | ||
278 | |||
144 | pid_t child = fork(); | 279 | pid_t child = fork(); |
145 | if (child < 0) | 280 | if (child < 0) |
146 | errExit("fork"); | 281 | errExit("fork"); |
147 | if (child == 0) { | 282 | if (child == 0) { |
148 | int env_index = 0; | 283 | sbox_do_exec_v(filtermask, arg); |
149 | char *new_environment[256] = { NULL }; | ||
150 | // preserve firejail-specific env vars | ||
151 | char *cl = getenv("FIREJAIL_FILE_COPY_LIMIT"); | ||
152 | if (cl) { | ||
153 | if (asprintf(&new_environment[env_index++], "FIREJAIL_FILE_COPY_LIMIT=%s", cl) == -1) | ||
154 | errExit("asprintf"); | ||
155 | } | ||
156 | clearenv(); | ||
157 | if (arg_quiet) // --quiet is passed as an environment variable | ||
158 | new_environment[env_index++] = "FIREJAIL_QUIET=yes"; | ||
159 | if (arg_debug) // --debug is passed as an environment variable | ||
160 | new_environment[env_index++] = "FIREJAIL_DEBUG=yes"; | ||
161 | |||
162 | if (filtermask & SBOX_STDIN_FROM_FILE) { | ||
163 | int fd; | ||
164 | if((fd = open(SBOX_STDIN_FILE, O_RDONLY)) == -1) { | ||
165 | fprintf(stderr,"Error: cannot open %s\n", SBOX_STDIN_FILE); | ||
166 | exit(1); | ||
167 | } | ||
168 | if (dup2(fd, STDIN_FILENO) == -1) | ||
169 | errExit("dup2"); | ||
170 | close(fd); | ||
171 | } | ||
172 | else if ((filtermask & SBOX_ALLOW_STDIN) == 0) { | ||
173 | int fd = open("/dev/null",O_RDWR, 0); | ||
174 | if (fd != -1) { | ||
175 | if (dup2(fd, STDIN_FILENO) == -1) | ||
176 | errExit("dup2"); | ||
177 | close(fd); | ||
178 | } | ||
179 | else // the user could run the sandbox without /dev/null | ||
180 | close(STDIN_FILENO); | ||
181 | } | ||
182 | |||
183 | // close all other file descriptors | ||
184 | int max = 20; // getdtablesize() is overkill for a firejail process | ||
185 | int i = 3; | ||
186 | for (i = 3; i < max; i++) | ||
187 | close(i); // close open files | ||
188 | |||
189 | umask(027); | ||
190 | |||
191 | // apply filters | ||
192 | if (filtermask & SBOX_CAPS_NONE) { | ||
193 | caps_drop_all(); | ||
194 | } else { | ||
195 | uint64_t set = 0; | ||
196 | if (filtermask & SBOX_CAPS_NETWORK) { | ||
197 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
198 | set |= ((uint64_t) 1) << CAP_NET_ADMIN; | ||
199 | set |= ((uint64_t) 1) << CAP_NET_RAW; | ||
200 | #endif | ||
201 | } | ||
202 | if (filtermask & SBOX_CAPS_HIDEPID) { | ||
203 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
204 | set |= ((uint64_t) 1) << CAP_SYS_PTRACE; | ||
205 | set |= ((uint64_t) 1) << CAP_SYS_PACCT; | ||
206 | #endif | ||
207 | } | ||
208 | if (filtermask & SBOX_CAPS_NET_SERVICE) { | ||
209 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
210 | set |= ((uint64_t) 1) << CAP_NET_BIND_SERVICE; | ||
211 | set |= ((uint64_t) 1) << CAP_NET_BROADCAST; | ||
212 | #endif | ||
213 | } | ||
214 | if (set != 0) { // some SBOX_CAPS_ flag was specified, drop all other capabilities | ||
215 | #ifndef HAVE_GCOV // the following filter will prevent GCOV from saving info in .gcda files | ||
216 | caps_set(set); | ||
217 | #endif | ||
218 | } | ||
219 | } | ||
220 | |||
221 | if (filtermask & SBOX_SECCOMP) { | ||
222 | if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { | ||
223 | perror("prctl(NO_NEW_PRIVS)"); | ||
224 | } | ||
225 | if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog)) { | ||
226 | perror("prctl(PR_SET_SECCOMP)"); | ||
227 | } | ||
228 | } | ||
229 | |||
230 | if (filtermask & SBOX_ROOT) { | ||
231 | // elevate privileges in order to get grsecurity working | ||
232 | if (setreuid(0, 0)) | ||
233 | errExit("setreuid"); | ||
234 | if (setregid(0, 0)) | ||
235 | errExit("setregid"); | ||
236 | } | ||
237 | else if (filtermask & SBOX_USER) | ||
238 | drop_privs(1); | ||
239 | |||
240 | if (arg[0]) { // get rid of scan-build warning | ||
241 | int fd = open(arg[0], O_PATH | O_CLOEXEC); | ||
242 | if (fd == -1) { | ||
243 | if (errno == ENOENT) { | ||
244 | fprintf(stderr, "Error: %s does not exist\n", arg[0]); | ||
245 | exit(1); | ||
246 | } else { | ||
247 | errExit("open"); | ||
248 | } | ||
249 | } | ||
250 | struct stat s; | ||
251 | if (fstat(fd, &s) == -1) | ||
252 | errExit("fstat"); | ||
253 | if (s.st_uid != 0 && s.st_gid != 0) { | ||
254 | fprintf(stderr, "Error: %s is not owned by root, refusing to execute\n", arg[0]); | ||
255 | exit(1); | ||
256 | } | ||
257 | if (s.st_mode & 00002) { | ||
258 | fprintf(stderr, "Error: %s is world writable, refusing to execute\n", arg[0]); | ||
259 | exit(1); | ||
260 | } | ||
261 | fexecve(fd, arg, new_environment); | ||
262 | } else { | ||
263 | assert(0); | ||
264 | } | ||
265 | perror("fexecve"); | ||
266 | _exit(1); | ||
267 | } | 284 | } |
268 | 285 | ||
269 | int status; | 286 | int status; |
@@ -277,3 +294,19 @@ int sbox_run_v(unsigned filtermask, char * const arg[]) { | |||
277 | 294 | ||
278 | return status; | 295 | return status; |
279 | } | 296 | } |
297 | |||
298 | void sbox_exec_v(unsigned filtermask, char * const arg[]) { | ||
299 | EUID_ROOT(); | ||
300 | |||
301 | if (arg_debug) { | ||
302 | printf("sbox exec: "); | ||
303 | int i = 0; | ||
304 | while (arg[i]) { | ||
305 | printf("%s ", arg[i]); | ||
306 | i++; | ||
307 | } | ||
308 | printf("\n"); | ||
309 | } | ||
310 | |||
311 | sbox_do_exec_v(filtermask, arg); | ||
312 | } | ||
diff --git a/src/firejail/seccomp.c b/src/firejail/seccomp.c index 10a2a5665..7f55ccc0e 100644 --- a/src/firejail/seccomp.c +++ b/src/firejail/seccomp.c | |||
@@ -191,15 +191,25 @@ static void seccomp_filter_block_secondary(void) { | |||
191 | } | 191 | } |
192 | 192 | ||
193 | // drop filter for seccomp option | 193 | // drop filter for seccomp option |
194 | int seccomp_filter_drop(void) { | 194 | int seccomp_filter_drop(bool native) { |
195 | const char *filter, *postexec_filter; | ||
196 | |||
197 | if (native) { | ||
198 | filter = RUN_SECCOMP_CFG; | ||
199 | postexec_filter = RUN_SECCOMP_POSTEXEC; | ||
200 | } else { | ||
201 | filter = RUN_SECCOMP_32; | ||
202 | postexec_filter = RUN_SECCOMP_POSTEXEC_32; | ||
203 | } | ||
204 | |||
195 | // if we have multiple seccomp commands, only one of them is executed | 205 | // if we have multiple seccomp commands, only one of them is executed |
196 | // in the following order: | 206 | // in the following order: |
197 | // - seccomp.drop list | 207 | // - seccomp.drop list |
198 | // - seccomp list | 208 | // - seccomp list |
199 | // - seccomp | 209 | // - seccomp |
200 | if (cfg.seccomp_list_drop == NULL) { | 210 | if (cfg.seccomp_list_drop == NULL) { |
201 | // default seccomp | 211 | // default seccomp if error action is not changed |
202 | if (cfg.seccomp_list == NULL) { | 212 | if (cfg.seccomp_list == NULL && cfg.seccomp_error_action) { |
203 | if (arg_seccomp_block_secondary) | 213 | if (arg_seccomp_block_secondary) |
204 | seccomp_filter_block_secondary(); | 214 | seccomp_filter_block_secondary(); |
205 | else { | 215 | else { |
@@ -224,19 +234,30 @@ int seccomp_filter_drop(void) { | |||
224 | if (arg_debug) | 234 | if (arg_debug) |
225 | printf("Build default+drop seccomp filter\n"); | 235 | printf("Build default+drop seccomp filter\n"); |
226 | 236 | ||
237 | const char *command, *list; | ||
238 | if (native) { | ||
239 | command = "default"; | ||
240 | list = cfg.seccomp_list; | ||
241 | } else { | ||
242 | command = "default32"; | ||
243 | list = cfg.seccomp_list32; | ||
244 | } | ||
245 | |||
246 | if (list == NULL) | ||
247 | list = ""; | ||
227 | // build the seccomp filter as a regular user | 248 | // build the seccomp filter as a regular user |
228 | int rv; | 249 | int rv; |
229 | if (arg_allow_debuggers) | 250 | if (arg_allow_debuggers) |
230 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, | 251 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 7, |
231 | PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list, "allow-debuggers"); | 252 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list, "allow-debuggers"); |
232 | else | 253 | else |
233 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, | 254 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, |
234 | PATH_FSECCOMP, "default", "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list); | 255 | PATH_FSECCOMP, command, "drop", filter, postexec_filter, list); |
235 | if (rv) | 256 | if (rv) |
236 | exit(rv); | 257 | exit(rv); |
237 | 258 | ||
238 | // optimize the new filter | 259 | // optimize the new filter |
239 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSEC_OPTIMIZE, RUN_SECCOMP_CFG); | 260 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSEC_OPTIMIZE, filter); |
240 | if (rv) | 261 | if (rv) |
241 | exit(rv); | 262 | exit(rv); |
242 | } | 263 | } |
@@ -250,36 +271,45 @@ int seccomp_filter_drop(void) { | |||
250 | if (arg_debug) | 271 | if (arg_debug) |
251 | printf("Build drop seccomp filter\n"); | 272 | printf("Build drop seccomp filter\n"); |
252 | 273 | ||
274 | const char *command, *list; | ||
275 | if (native) { | ||
276 | command = "drop"; | ||
277 | list = cfg.seccomp_list_drop; | ||
278 | } else { | ||
279 | command = "drop32"; | ||
280 | list = cfg.seccomp_list_drop32; | ||
281 | } | ||
282 | |||
253 | // build the seccomp filter as a regular user | 283 | // build the seccomp filter as a regular user |
254 | int rv; | 284 | int rv; |
255 | if (arg_allow_debuggers) | 285 | if (arg_allow_debuggers) |
256 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, | 286 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 6, |
257 | PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_drop, "allow-debuggers"); | 287 | PATH_FSECCOMP, command, filter, postexec_filter, list, "allow-debuggers"); |
258 | else | 288 | else |
259 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, | 289 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, |
260 | PATH_FSECCOMP, "drop", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_drop); | 290 | PATH_FSECCOMP, command, filter, postexec_filter, list); |
261 | 291 | ||
262 | if (rv) | 292 | if (rv) |
263 | exit(rv); | 293 | exit(rv); |
264 | 294 | ||
265 | // optimize the drop filter | 295 | // optimize the drop filter |
266 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSEC_OPTIMIZE, RUN_SECCOMP_CFG); | 296 | rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, PATH_FSEC_OPTIMIZE, filter); |
267 | if (rv) | 297 | if (rv) |
268 | exit(rv); | 298 | exit(rv); |
269 | } | 299 | } |
270 | 300 | ||
271 | // load the filter | 301 | // load the filter |
272 | if (seccomp_load(RUN_SECCOMP_CFG) == 0) { | 302 | if (seccomp_load(filter) == 0) { |
273 | if (arg_debug) | 303 | if (arg_debug) |
274 | printf("seccomp filter configured\n"); | 304 | printf("seccomp filter configured\n"); |
275 | } | 305 | } |
276 | 306 | ||
277 | if (arg_debug && access(PATH_FSEC_PRINT, X_OK) == 0) { | 307 | if (arg_debug && access(PATH_FSEC_PRINT, X_OK) == 0) { |
278 | struct stat st; | 308 | struct stat st; |
279 | if (stat(RUN_SECCOMP_POSTEXEC, &st) != -1 && st.st_size != 0) { | 309 | if (stat(postexec_filter, &st) != -1 && st.st_size != 0) { |
280 | printf("configuring postexec seccomp filter in %s\n", RUN_SECCOMP_POSTEXEC); | 310 | printf("configuring postexec seccomp filter in %s\n", postexec_filter); |
281 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, | 311 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, |
282 | PATH_FSEC_PRINT, RUN_SECCOMP_POSTEXEC); | 312 | PATH_FSEC_PRINT, postexec_filter); |
283 | } | 313 | } |
284 | } | 314 | } |
285 | 315 | ||
@@ -287,7 +317,7 @@ int seccomp_filter_drop(void) { | |||
287 | } | 317 | } |
288 | 318 | ||
289 | // keep filter for seccomp option | 319 | // keep filter for seccomp option |
290 | int seccomp_filter_keep(void) { | 320 | int seccomp_filter_keep(bool native) { |
291 | // secondary filters are not installed except when secondary | 321 | // secondary filters are not installed except when secondary |
292 | // architectures are explicitly blocked | 322 | // architectures are explicitly blocked |
293 | if (arg_seccomp_block_secondary) | 323 | if (arg_seccomp_block_secondary) |
@@ -296,9 +326,20 @@ int seccomp_filter_keep(void) { | |||
296 | if (arg_debug) | 326 | if (arg_debug) |
297 | printf("Build keep seccomp filter\n"); | 327 | printf("Build keep seccomp filter\n"); |
298 | 328 | ||
329 | const char *filter, *postexec_filter, *list; | ||
330 | if (native) { | ||
331 | filter = RUN_SECCOMP_CFG; | ||
332 | postexec_filter = RUN_SECCOMP_POSTEXEC; | ||
333 | list = cfg.seccomp_list_keep; | ||
334 | } else { | ||
335 | filter = RUN_SECCOMP_32; | ||
336 | postexec_filter = RUN_SECCOMP_POSTEXEC_32; | ||
337 | list = cfg.seccomp_list_keep32; | ||
338 | } | ||
339 | |||
299 | // build the seccomp filter as a regular user | 340 | // build the seccomp filter as a regular user |
300 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, | 341 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 5, |
301 | PATH_FSECCOMP, "keep", RUN_SECCOMP_CFG, RUN_SECCOMP_POSTEXEC, cfg.seccomp_list_keep); | 342 | PATH_FSECCOMP, "keep", filter, postexec_filter, list); |
302 | 343 | ||
303 | if (rv) { | 344 | if (rv) { |
304 | fprintf(stderr, "Error: cannot configure seccomp filter\n"); | 345 | fprintf(stderr, "Error: cannot configure seccomp filter\n"); |
@@ -309,23 +350,52 @@ int seccomp_filter_keep(void) { | |||
309 | printf("seccomp filter configured\n"); | 350 | printf("seccomp filter configured\n"); |
310 | 351 | ||
311 | // load the filter | 352 | // load the filter |
312 | if (seccomp_load(RUN_SECCOMP_CFG) == 0) { | 353 | if (seccomp_load(filter) == 0) { |
313 | if (arg_debug) | 354 | if (arg_debug) |
314 | printf("seccomp filter configured\n"); | 355 | printf("seccomp filter configured\n"); |
315 | } | 356 | } |
316 | 357 | ||
317 | if (arg_debug && access(PATH_FSEC_PRINT, X_OK) == 0) { | 358 | if (arg_debug && access(PATH_FSEC_PRINT, X_OK) == 0) { |
318 | struct stat st; | 359 | struct stat st; |
319 | if (stat(RUN_SECCOMP_POSTEXEC, &st) != -1 && st.st_size != 0) { | 360 | if (stat(postexec_filter, &st) != -1 && st.st_size != 0) { |
320 | printf("configuring postexec seccomp filter in %s\n", RUN_SECCOMP_POSTEXEC); | 361 | printf("configuring postexec seccomp filter in %s\n", postexec_filter); |
321 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, | 362 | sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 2, |
322 | PATH_FSEC_PRINT, RUN_SECCOMP_POSTEXEC); | 363 | PATH_FSEC_PRINT, postexec_filter); |
323 | } | 364 | } |
324 | } | 365 | } |
325 | 366 | ||
326 | return 0; | 367 | return 0; |
327 | } | 368 | } |
328 | 369 | ||
370 | // create mdwx filter for non-default error action | ||
371 | int seccomp_filter_mdwx(bool native) { | ||
372 | if (arg_debug) | ||
373 | printf("Build memory-deny-write-execute filter\n"); | ||
374 | |||
375 | const char *command, *filter; | ||
376 | if (native) { | ||
377 | command = "memory-deny-write-execute"; | ||
378 | filter = RUN_SECCOMP_MDWX; | ||
379 | } else { | ||
380 | command = "memory-deny-write-execute.32"; | ||
381 | filter = RUN_SECCOMP_MDWX_32; | ||
382 | } | ||
383 | |||
384 | // build the seccomp filter as a regular user | ||
385 | int rv = sbox_run(SBOX_USER | SBOX_CAPS_NONE | SBOX_SECCOMP, 3, | ||
386 | PATH_FSECCOMP, command, filter); | ||
387 | |||
388 | if (rv) { | ||
389 | fprintf(stderr, "Error: cannot build memory-deny-write-execute filter\n"); | ||
390 | exit(rv); | ||
391 | } | ||
392 | |||
393 | if (arg_debug) | ||
394 | printf("Memory-deny-write-execute filter configured\n"); | ||
395 | |||
396 | return 0; | ||
397 | } | ||
398 | |||
329 | void seccomp_print_filter(pid_t pid) { | 399 | void seccomp_print_filter(pid_t pid) { |
330 | EUID_ASSERT(); | 400 | EUID_ASSERT(); |
331 | 401 | ||
diff --git a/src/firejail/shutdown.c b/src/firejail/shutdown.c index a7d0b2fbe..7e9628007 100644 --- a/src/firejail/shutdown.c +++ b/src/firejail/shutdown.c | |||
@@ -63,7 +63,9 @@ void shut(pid_t pid) { | |||
63 | sleep(1); | 63 | sleep(1); |
64 | monsec--; | 64 | monsec--; |
65 | 65 | ||
66 | EUID_ROOT(); | ||
66 | FILE *fp = fopen(monfile, "r"); | 67 | FILE *fp = fopen(monfile, "r"); |
68 | EUID_USER(); | ||
67 | if (!fp) { | 69 | if (!fp) { |
68 | killdone = 1; | 70 | killdone = 1; |
69 | break; | 71 | break; |
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index 52d4f7c03..73c9a6a8b 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -53,6 +53,21 @@ static char *usage_str = | |||
53 | #endif | 53 | #endif |
54 | " --cpu=cpu-number,cpu-number - set cpu affinity.\n" | 54 | " --cpu=cpu-number,cpu-number - set cpu affinity.\n" |
55 | " --cpu.print=name|pid - print the cpus in use.\n" | 55 | " --cpu.print=name|pid - print the cpus in use.\n" |
56 | " --dbus-log=file - set DBus log file location.\n" | ||
57 | " --dbus-system=filter|none - set system DBus access policy.\n" | ||
58 | " --dbus-system.broadcast=rule - allow signals on the system DBus according to rule.\n" | ||
59 | " --dbus-system.call=rule - allow calls on the system DBus according to rule.\n" | ||
60 | " --dbus-system.log - turn on logging for the system DBus." | ||
61 | " --dbus-system.own=name - allow ownership of name on the system DBus.\n" | ||
62 | " --dbus-system.see=name - allow seeing name on the system DBus.\n" | ||
63 | " --dbus-system.talk=name - allow talking to name on the system DBus.\n" | ||
64 | " --dbus-user=filter|none - set session DBus access policy.\n" | ||
65 | " --dbus-user.broadcast=rule - allow signals on the session DBus according to rule.\n" | ||
66 | " --dbus-user.call=rule - allow calls on the session DBus according to rule.\n" | ||
67 | " --dbus-user.log - turn on logging for the user DBus." | ||
68 | " --dbus-user.own=name - allow ownership of name on the session DBus.\n" | ||
69 | " --dbus-user.see=name - allow seeing name on the session DBus.\n" | ||
70 | " --dbus-user.talk=name - allow talking to name on the session DBus.\n" | ||
56 | " --debug - print sandbox debug messages.\n" | 71 | " --debug - print sandbox debug messages.\n" |
57 | " --debug-blacklists - debug blacklisting.\n" | 72 | " --debug-blacklists - debug blacklisting.\n" |
58 | " --debug-caps - print all recognized capabilities.\n" | 73 | " --debug-caps - print all recognized capabilities.\n" |
@@ -60,6 +75,7 @@ static char *usage_str = | |||
60 | " --debug-private-lib - debug for --private-lib option.\n" | 75 | " --debug-private-lib - debug for --private-lib option.\n" |
61 | " --debug-protocols - print all recognized protocols.\n" | 76 | " --debug-protocols - print all recognized protocols.\n" |
62 | " --debug-syscalls - print all recognized system calls.\n" | 77 | " --debug-syscalls - print all recognized system calls.\n" |
78 | " --debug-syscalls32 - print all recognized 32 bit system calls.\n" | ||
63 | #ifdef HAVE_WHITELIST | 79 | #ifdef HAVE_WHITELIST |
64 | " --debug-whitelists - debug whitelisting.\n" | 80 | " --debug-whitelists - debug whitelisting.\n" |
65 | #endif | 81 | #endif |
@@ -207,6 +223,9 @@ static char *usage_str = | |||
207 | "\twhitelist the syscalls specified by the command.\n" | 223 | "\twhitelist the syscalls specified by the command.\n" |
208 | " --seccomp.print=name|pid - print the seccomp filter for the sandbox\n" | 224 | " --seccomp.print=name|pid - print the seccomp filter for the sandbox\n" |
209 | "\tidentified by name or PID.\n" | 225 | "\tidentified by name or PID.\n" |
226 | " --seccomp.32[.drop,.keep][=syscall] - like above but for 32 bit architecture.\n" | ||
227 | " --seccomp-error-action=errno|kill|log - change error code, kill process\n" | ||
228 | "\tor log the attempt.\n" | ||
210 | #endif | 229 | #endif |
211 | " --shell=none - run the program directly without a user shell.\n" | 230 | " --shell=none - run the program directly without a user shell.\n" |
212 | " --shell=program - set default user shell.\n" | 231 | " --shell=program - set default user shell.\n" |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 6bfc80903..3aa0584d6 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -957,16 +957,27 @@ int remove_overlay_directory(void) { | |||
957 | return 0; | 957 | return 0; |
958 | } | 958 | } |
959 | 959 | ||
960 | // flush stdin if it is connected to a tty and has input | ||
960 | void flush_stdin(void) { | 961 | void flush_stdin(void) { |
961 | if (isatty(STDIN_FILENO)) { | 962 | if (!isatty(STDIN_FILENO)) |
962 | int cnt = 0; | 963 | return; |
963 | int rv = ioctl(STDIN_FILENO, FIONREAD, &cnt); | 964 | |
964 | if (rv == 0 && cnt) { | 965 | int cnt = 0; |
965 | fwarning("removing %d bytes from stdin\n", cnt); | 966 | int rv = ioctl(STDIN_FILENO, FIONREAD, &cnt); |
966 | rv = ioctl(STDIN_FILENO, TCFLSH, TCIFLUSH); | 967 | if (rv != 0 || cnt == 0) |
967 | (void) rv; | 968 | return; |
968 | } | 969 | |
969 | } | 970 | fwarning("removing %d bytes from stdin\n", cnt); |
971 | |||
972 | // If this process is backgrounded, below ioctl() will trigger | ||
973 | // SIGTTOU and stop us. We avoid this by ignoring SIGTTOU for | ||
974 | // the duration of the ioctl. | ||
975 | sighandler_t hdlr = signal(SIGTTOU, SIG_IGN); | ||
976 | rv = ioctl(STDIN_FILENO, TCFLSH, TCIFLUSH); | ||
977 | signal(SIGTTOU, hdlr); | ||
978 | |||
979 | if (rv) | ||
980 | fwarning("Flushing stdin failed: %s\n", strerror(errno)); | ||
970 | } | 981 | } |
971 | 982 | ||
972 | // return 1 if new directory was created, else return 0 | 983 | // return 1 if new directory was created, else return 0 |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index 6395903f9..ba54ca376 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -625,7 +625,64 @@ void x11_start_xephyr(int argc, char **argv) { | |||
625 | } | 625 | } |
626 | 626 | ||
627 | 627 | ||
628 | void x11_start_xpra_old(int argc, char **argv, int display, char *display_str) { | 628 | // this function returns the string that will appear in the window title when xpra is being used |
629 | // this string may include one of these items: | ||
630 | // * the "--name" argument, if specified | ||
631 | // * the basename portion of the "--private" directory, if specified | ||
632 | // note: the malloc() is leaking, but this is a small string allocated one time only during startup, so don't care | ||
633 | static char * get_title_arg_str() { | ||
634 | |||
635 | char * title_arg_str = NULL; | ||
636 | |||
637 | const char * title_start = "--title=firejail x11 sandbox"; | ||
638 | const char * title_sep = " "; | ||
639 | |||
640 | // use the "--name" argument if it was explicitly specified | ||
641 | if ((cfg.name != NULL) && (strlen(cfg.name) > 0)) { | ||
642 | |||
643 | title_arg_str = malloc(strlen(title_start) + strlen(title_sep) + strlen(cfg.name) + 1); | ||
644 | if (title_arg_str == NULL) { | ||
645 | fprintf(stderr, "Error: malloc() failed to allocate memory\n"); | ||
646 | exit(1); | ||
647 | } | ||
648 | |||
649 | strcpy(title_arg_str, title_start); | ||
650 | strcat(title_arg_str, title_sep); | ||
651 | strcat(title_arg_str, cfg.name); | ||
652 | } | ||
653 | |||
654 | // use the "--private" argument if it was explicitly specified | ||
655 | else if ((cfg.home_private != NULL) && (strlen(cfg.home_private) > 0)) { | ||
656 | |||
657 | const char * base_out = gnu_basename(cfg.home_private); | ||
658 | |||
659 | title_arg_str = malloc(strlen(title_start) + strlen(title_sep) + strlen(base_out) + 1); | ||
660 | if (title_arg_str == NULL) { | ||
661 | fprintf(stderr, "Error: malloc() failed to allocate memory\n"); | ||
662 | exit(1); | ||
663 | } | ||
664 | |||
665 | strcpy(title_arg_str, title_start); | ||
666 | strcat(title_arg_str, title_sep); | ||
667 | strcat(title_arg_str, base_out); | ||
668 | } | ||
669 | |||
670 | // default | ||
671 | else { | ||
672 | title_arg_str = malloc(strlen(title_start) + 1); | ||
673 | if (title_arg_str == NULL) { | ||
674 | fprintf(stderr, "Error: malloc() failed to allocate memory\n"); | ||
675 | exit(1); | ||
676 | } | ||
677 | |||
678 | strcpy(title_arg_str, title_start); | ||
679 | } | ||
680 | |||
681 | return title_arg_str; | ||
682 | } | ||
683 | |||
684 | |||
685 | static void __attribute__((noreturn)) x11_start_xpra_old(int argc, char **argv, int display, char *display_str) { | ||
629 | EUID_ASSERT(); | 686 | EUID_ASSERT(); |
630 | int i; | 687 | int i; |
631 | struct stat s; | 688 | struct stat s; |
@@ -752,7 +809,10 @@ void x11_start_xpra_old(int argc, char **argv, int display, char *display_str) { | |||
752 | free(fname); | 809 | free(fname); |
753 | 810 | ||
754 | // build attach command | 811 | // build attach command |
755 | char *attach_argv[] = { "xpra", "--title=\"firejail x11 sandbox\"", "attach", display_str, NULL }; | 812 | |
813 | char * title_arg_str = get_title_arg_str(); | ||
814 | |||
815 | char *attach_argv[] = { "xpra", title_arg_str, "attach", display_str, NULL }; | ||
756 | 816 | ||
757 | // run attach command | 817 | // run attach command |
758 | client = fork(); | 818 | client = fork(); |
@@ -861,7 +921,7 @@ void x11_start_xpra_old(int argc, char **argv, int display, char *display_str) { | |||
861 | } | 921 | } |
862 | 922 | ||
863 | 923 | ||
864 | void x11_start_xpra_new(int argc, char **argv, char *display_str) { | 924 | static void __attribute__((noreturn)) x11_start_xpra_new(int argc, char **argv, char *display_str) { |
865 | EUID_ASSERT(); | 925 | EUID_ASSERT(); |
866 | int i; | 926 | int i; |
867 | pid_t server = 0; | 927 | pid_t server = 0; |
@@ -1175,16 +1235,15 @@ void x11_xorg(void) { | |||
1175 | 1235 | ||
1176 | // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted | 1236 | // move the temporary file in RUN_XAUTHORITY_SEC_FILE in order to have it deleted |
1177 | // automatically when the sandbox is closed (rename doesn't work) | 1237 | // automatically when the sandbox is closed (rename doesn't work) |
1178 | // root needed | 1238 | if (arg_debug) |
1179 | if (copy_file(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600)) { | 1239 | printf("Copying the new .Xauthority file\n"); |
1180 | fprintf(stderr, "Error: cannot create the new .Xauthority file\n"); | 1240 | copy_file_from_user_to_root(tmpfname, RUN_XAUTHORITY_SEC_FILE, getuid(), getgid(), 0600); |
1181 | exit(1); | 1241 | |
1182 | } | ||
1183 | /* coverity[toctou] */ | 1242 | /* coverity[toctou] */ |
1184 | unlink(tmpfname); | 1243 | unlink(tmpfname); |
1185 | umount("/tmp"); | 1244 | umount("/tmp"); |
1186 | 1245 | ||
1187 | // remount RUN_XAUTHORITY_SEC_FILE noexec, nodev, nosuid | 1246 | // mount RUN_XAUTHORITY_SEC_FILE noexec, nodev, nosuid |
1188 | fs_remount(RUN_XAUTHORITY_SEC_FILE, MOUNT_NOEXEC, 0); | 1247 | fs_remount(RUN_XAUTHORITY_SEC_FILE, MOUNT_NOEXEC, 0); |
1189 | 1248 | ||
1190 | // Ensure there is already a file in the usual location, so that bind-mount below will work. | 1249 | // Ensure there is already a file in the usual location, so that bind-mount below will work. |
@@ -1294,19 +1353,17 @@ void fs_x11(void) { | |||
1294 | if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0) | 1353 | if (mount("/tmp/.X11-unix", RUN_WHITELIST_X11_DIR, 0, MS_BIND|MS_REC, 0) < 0) |
1295 | errExit("mount bind"); | 1354 | errExit("mount bind"); |
1296 | 1355 | ||
1297 | // This directory must be mode 1777, or Xlib will barf. | 1356 | // This directory must be mode 1777 |
1298 | if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs", | 1357 | if (mount("tmpfs", "/tmp/.X11-unix", "tmpfs", |
1299 | MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME, | 1358 | MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_STRICTATIME, |
1300 | "mode=1777,uid=0,gid=0") < 0) | 1359 | "mode=1777,uid=0,gid=0") < 0) |
1301 | errExit("mounting tmpfs on /tmp/.X11-unix"); | 1360 | errExit("mounting tmpfs on /tmp/.X11-unix"); |
1302 | fs_logger("tmpfs /tmp/.X11-unix"); | 1361 | fs_logger("tmpfs /tmp/.X11-unix"); |
1303 | 1362 | ||
1304 | // create an empty file which will have the desired socket bind-mounted over it | 1363 | // create an empty root-owned file which will have the desired socket bind-mounted over it |
1305 | int fd = open(x11file, O_RDWR|O_CREAT|O_EXCL, x11stat.st_mode & ~S_IFMT); | 1364 | int fd = open(x11file, O_RDONLY|O_CREAT|O_EXCL, S_IRUSR | S_IWUSR); |
1306 | if (fd < 0) | 1365 | if (fd < 0) |
1307 | errExit(x11file); | 1366 | errExit(x11file); |
1308 | if (fchown(fd, x11stat.st_uid, x11stat.st_gid)) | ||
1309 | errExit("fchown"); | ||
1310 | close(fd); | 1367 | close(fd); |
1311 | 1368 | ||
1312 | // the mount source is under control of the user, so be careful and | 1369 | // the mount source is under control of the user, so be careful and |
diff --git a/src/firemon/firemon.h b/src/firemon/firemon.h index 7a55a64fb..3fba486eb 100644 --- a/src/firemon/firemon.h +++ b/src/firemon/firemon.h | |||
@@ -46,13 +46,13 @@ void firemon_sleep(int st); | |||
46 | 46 | ||
47 | 47 | ||
48 | // procevent.c | 48 | // procevent.c |
49 | void procevent(pid_t pid); | 49 | void procevent(pid_t pid) __attribute__((noreturn)); |
50 | 50 | ||
51 | // usage.c | 51 | // usage.c |
52 | void usage(void); | 52 | void usage(void); |
53 | 53 | ||
54 | // top.c | 54 | // top.c |
55 | void top(void); | 55 | void top(void) __attribute__((noreturn)); |
56 | 56 | ||
57 | // list.c | 57 | // list.c |
58 | void list(void); | 58 | void list(void); |
@@ -82,7 +82,7 @@ void cgroup(pid_t pid, int print_procs); | |||
82 | void tree(pid_t pid); | 82 | void tree(pid_t pid); |
83 | 83 | ||
84 | // netstats.c | 84 | // netstats.c |
85 | void netstats(void); | 85 | void netstats(void) __attribute__((noreturn)); |
86 | 86 | ||
87 | // x11.c | 87 | // x11.c |
88 | void x11(pid_t pid, int print_procs); | 88 | void x11(pid_t pid, int print_procs); |
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c index c823943c0..45964d3a2 100644 --- a/src/firemon/procevent.c +++ b/src/firemon/procevent.c | |||
@@ -98,7 +98,7 @@ static int pid_is_firejail(pid_t pid) { | |||
98 | "apparmor.print", "caps.print", "cpu.print", "dns.print", "fs.print", "netfilter.print", | 98 | "apparmor.print", "caps.print", "cpu.print", "dns.print", "fs.print", "netfilter.print", |
99 | "netfilter6.print", "profile.print", "protocol.print", "seccomp.print", | 99 | "netfilter6.print", "profile.print", "protocol.print", "seccomp.print", |
100 | // debug | 100 | // debug |
101 | "debug-caps", "debug-errnos", "debug-protocols", "debug-syscalls", | 101 | "debug-caps", "debug-errnos", "debug-protocols", "debug-syscalls", "debug-syscalls32", |
102 | // file transfer | 102 | // file transfer |
103 | "ls", "get", "put", | 103 | "ls", "get", "put", |
104 | // stats | 104 | // stats |
@@ -220,7 +220,7 @@ errexit: | |||
220 | } | 220 | } |
221 | 221 | ||
222 | 222 | ||
223 | static int procevent_monitor(const int sock, pid_t mypid) { | 223 | static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t mypid) { |
224 | ssize_t len; | 224 | ssize_t len; |
225 | struct nlmsghdr *nlmsghdr; | 225 | struct nlmsghdr *nlmsghdr; |
226 | 226 | ||
@@ -246,8 +246,7 @@ static int procevent_monitor(const int sock, pid_t mypid) { | |||
246 | 246 | ||
247 | int rv = select(max, &readfds, NULL, NULL, &tv); | 247 | int rv = select(max, &readfds, NULL, NULL, &tv); |
248 | if (rv == -1) { | 248 | if (rv == -1) { |
249 | fprintf(stderr, "recv: %s\n", strerror(errno)); | 249 | errExit("recv"); |
250 | return -1; | ||
251 | } | 250 | } |
252 | 251 | ||
253 | // timeout | 252 | // timeout |
@@ -259,7 +258,7 @@ static int procevent_monitor(const int sock, pid_t mypid) { | |||
259 | 258 | ||
260 | 259 | ||
261 | if ((len = recv(sock, buf, sizeof(buf), 0)) == 0) | 260 | if ((len = recv(sock, buf, sizeof(buf), 0)) == 0) |
262 | return 0; | 261 | exit(0); |
263 | if (len == -1) { | 262 | if (len == -1) { |
264 | if (errno == EINTR) | 263 | if (errno == EINTR) |
265 | continue; | 264 | continue; |
@@ -271,7 +270,7 @@ static int procevent_monitor(const int sock, pid_t mypid) { | |||
271 | } | 270 | } |
272 | else { | 271 | else { |
273 | fprintf(stderr,"Error: rx socket recv call, errno %d, %s\n", errno, strerror(errno)); | 272 | fprintf(stderr,"Error: rx socket recv call, errno %d, %s\n", errno, strerror(errno)); |
274 | return -1; | 273 | exit(1); |
275 | } | 274 | } |
276 | } | 275 | } |
277 | 276 | ||
@@ -497,7 +496,7 @@ static int procevent_monitor(const int sock, pid_t mypid) { | |||
497 | exit(0); | 496 | exit(0); |
498 | } | 497 | } |
499 | } | 498 | } |
500 | return 0; | 499 | __builtin_unreachable(); |
501 | } | 500 | } |
502 | 501 | ||
503 | void procevent(pid_t pid) { | 502 | void procevent(pid_t pid) { |
@@ -515,6 +514,4 @@ void procevent(pid_t pid) { | |||
515 | } | 514 | } |
516 | 515 | ||
517 | procevent_monitor(sock, pid); // it will never return from here | 516 | procevent_monitor(sock, pid); // it will never return from here |
518 | assert(0); | ||
519 | close(sock); // quiet static analyzers | ||
520 | } | 517 | } |
diff --git a/src/fsec-print/Makefile.in b/src/fsec-print/Makefile.in index f717af788..a30ff4ba3 100644 --- a/src/fsec-print/Makefile.in +++ b/src/fsec-print/Makefile.in | |||
@@ -5,8 +5,8 @@ include ../common.mk | |||
5 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h | 5 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h |
6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | 6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ |
7 | 7 | ||
8 | fsec-print: $(OBJS) ../lib/libnetlink.o | 8 | fsec-print: $(OBJS) ../lib/libnetlink.o ../lib/errno.o ../lib/syscall.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 10 | ||
11 | clean:; rm -fr *.o fsec-print *.gcov *.gcda *.gcno *.plist | 11 | clean:; rm -fr *.o fsec-print *.gcov *.gcda *.gcno *.plist |
12 | 12 | ||
diff --git a/src/fsec-print/fsec_print.h b/src/fsec-print/fsec_print.h index 0237fd020..337199288 100644 --- a/src/fsec-print/fsec_print.h +++ b/src/fsec-print/fsec_print.h | |||
@@ -21,12 +21,10 @@ | |||
21 | #define FSEC_PRINT_H | 21 | #define FSEC_PRINT_H |
22 | #include "../include/common.h" | 22 | #include "../include/common.h" |
23 | #include "../include/seccomp.h" | 23 | #include "../include/seccomp.h" |
24 | #include "../include/syscall.h" | ||
24 | #include <sys/mman.h> | 25 | #include <sys/mman.h> |
25 | 26 | ||
26 | // print.c | 27 | // print.c |
27 | void print(struct sock_filter *filter, int entries); | 28 | void print(struct sock_filter *filter, int entries); |
28 | 29 | ||
29 | // syscall_list.c | ||
30 | const char *syscall_find_nr(int nr); | ||
31 | |||
32 | #endif | 30 | #endif |
diff --git a/src/fsec-print/main.c b/src/fsec-print/main.c index 728308dac..ade45c881 100644 --- a/src/fsec-print/main.c +++ b/src/fsec-print/main.c | |||
@@ -24,6 +24,23 @@ static void usage(void) { | |||
24 | printf("\tfsec-print file - disassemble seccomp filter\n"); | 24 | printf("\tfsec-print file - disassemble seccomp filter\n"); |
25 | } | 25 | } |
26 | 26 | ||
27 | int arg_quiet = 0; | ||
28 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) { | ||
29 | (void) fd; | ||
30 | (void) syscall; | ||
31 | (void) arg; | ||
32 | (void) ptrarg; | ||
33 | (void) native; | ||
34 | } | ||
35 | |||
36 | void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, bool native) { | ||
37 | (void) fd; | ||
38 | (void) syscall; | ||
39 | (void) arg; | ||
40 | (void) ptrarg; | ||
41 | (void) native; | ||
42 | } | ||
43 | |||
27 | int main(int argc, char **argv) { | 44 | int main(int argc, char **argv) { |
28 | #if 0 | 45 | #if 0 |
29 | { | 46 | { |
diff --git a/src/fsec-print/print.c b/src/fsec-print/print.c index 5c244b000..a6aae5ecb 100644 --- a/src/fsec-print/print.c +++ b/src/fsec-print/print.c | |||
@@ -250,7 +250,7 @@ static void bpf_decode_args(const struct sock_filter *bpf, unsigned int line) { | |||
250 | break; | 250 | break; |
251 | case BPF_JMP: | 251 | case BPF_JMP: |
252 | if (BPF_OP(bpf->code) == BPF_JA) { | 252 | if (BPF_OP(bpf->code) == BPF_JA) { |
253 | printf("%.4u", (line + 1) + bpf->k); | 253 | printf("%.4x", (line + 1) + bpf->k); |
254 | } | 254 | } |
255 | else { | 255 | else { |
256 | const char *name = NULL; | 256 | const char *name = NULL; |
diff --git a/src/fsec-print/syscall_list.c b/src/fsec-print/syscall_list.c deleted file mode 100644 index 274908cef..000000000 --- a/src/fsec-print/syscall_list.c +++ /dev/null | |||
@@ -1,47 +0,0 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2020 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include "fsec_print.h" | ||
21 | #include <sys/syscall.h> | ||
22 | |||
23 | typedef struct { | ||
24 | const char * const name; | ||
25 | int nr; | ||
26 | } SyscallEntry; | ||
27 | |||
28 | static const SyscallEntry syslist[] = { | ||
29 | // | ||
30 | // code generated using tools/extract-syscall | ||
31 | // | ||
32 | #include "../include/syscall.h" | ||
33 | // | ||
34 | // end of generated code | ||
35 | // | ||
36 | }; // end of syslist | ||
37 | |||
38 | const char *syscall_find_nr(int nr) { | ||
39 | int i; | ||
40 | int elems = sizeof(syslist) / sizeof(syslist[0]); | ||
41 | for (i = 0; i < elems; i++) { | ||
42 | if (nr == syslist[i].nr) | ||
43 | return syslist[i].name; | ||
44 | } | ||
45 | |||
46 | return NULL; | ||
47 | } | ||
diff --git a/src/fseccomp/Makefile.in b/src/fseccomp/Makefile.in index 67e074b3d..8623db6f8 100644 --- a/src/fseccomp/Makefile.in +++ b/src/fseccomp/Makefile.in | |||
@@ -5,8 +5,8 @@ include ../common.mk | |||
5 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h | 5 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h |
6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | 6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ |
7 | 7 | ||
8 | fseccomp: $(OBJS) | 8 | fseccomp: $(OBJS) ../lib/errno.o ../lib/syscall.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 10 | ||
11 | clean:; rm -fr *.o fseccomp *.gcov *.gcda *.gcno *.plist | 11 | clean:; rm -fr *.o fseccomp *.gcov *.gcda *.gcno *.plist |
12 | 12 | ||
diff --git a/src/fseccomp/fseccomp.h b/src/fseccomp/fseccomp.h index bf55870f2..e8dd083b6 100644 --- a/src/fseccomp/fseccomp.h +++ b/src/fseccomp/fseccomp.h | |||
@@ -24,21 +24,11 @@ | |||
24 | #include <string.h> | 24 | #include <string.h> |
25 | #include <assert.h> | 25 | #include <assert.h> |
26 | #include "../include/common.h" | 26 | #include "../include/common.h" |
27 | #include "../include/syscall.h" | ||
27 | 28 | ||
28 | // main.c | 29 | // main.c |
29 | extern int arg_quiet; | 30 | extern int arg_quiet; |
30 | 31 | ||
31 | // syscall.c | ||
32 | void syscall_print(void); | ||
33 | int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg, void *ptrarg), int fd, int arg, void *ptrarg); | ||
34 | const char *syscall_find_nr(int nr); | ||
35 | void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist); | ||
36 | |||
37 | // errno.c | ||
38 | void errno_print(void); | ||
39 | int errno_find_name(const char *name); | ||
40 | char *errno_find_nr(int nr); | ||
41 | |||
42 | // protocol.c | 32 | // protocol.c |
43 | void protocol_print(void); | 33 | void protocol_print(void); |
44 | void protocol_build_filter(const char *prlist, const char *fname); | 34 | void protocol_build_filter(const char *prlist, const char *fname); |
@@ -49,27 +39,27 @@ void seccomp_secondary_32(const char *fname); | |||
49 | void seccomp_secondary_block(const char *fname); | 39 | void seccomp_secondary_block(const char *fname); |
50 | 40 | ||
51 | // seccomp_file.c | 41 | // seccomp_file.c |
52 | void write_to_file(int fd, const void *data, int size); | 42 | void write_to_file(int fd, const void *data, size_t size); |
53 | void filter_init(int fd); | 43 | void filter_init(int fd, bool native); |
54 | void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg); | 44 | void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg, bool native); |
55 | void filter_add_whitelist_for_excluded(int fd, int syscall, int arg, void *ptrarg); | 45 | void filter_add_whitelist_for_excluded(int fd, int syscall, int arg, void *ptrarg, bool native); |
56 | void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg); | 46 | void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg, bool native); |
57 | void filter_add_blacklist_for_excluded(int fd, int syscall, int arg, void *ptrarg); | 47 | void filter_add_blacklist_for_excluded(int fd, int syscall, int arg, void *ptrarg, bool native); |
58 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg); | ||
59 | void filter_end_blacklist(int fd); | 48 | void filter_end_blacklist(int fd); |
60 | void filter_end_whitelist(int fd); | 49 | void filter_end_whitelist(int fd); |
61 | 50 | ||
62 | // seccomp.c | 51 | // seccomp.c |
63 | // default list | 52 | // default list |
64 | void seccomp_default(const char *fname, int allow_debuggers); | 53 | void seccomp_default(const char *fname, int allow_debuggers, bool native); |
65 | // drop list | 54 | // drop list |
66 | void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers); | 55 | void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers, bool native); |
67 | // default+drop list | 56 | // default+drop list |
68 | void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers); | 57 | void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers, bool native); |
69 | // whitelisted filter | 58 | // whitelisted filter |
70 | void seccomp_keep(const char *fname1, const char *fname2, char *list); | 59 | void seccomp_keep(const char *fname1, const char *fname2, char *list, bool native); |
71 | // block writable and executable memory | 60 | // block writable and executable memory |
72 | void memory_deny_write_execute(const char *fname); | 61 | void memory_deny_write_execute(const char *fname); |
62 | void memory_deny_write_execute_32(const char *fname); | ||
73 | 63 | ||
74 | // seccomp_print | 64 | // seccomp_print |
75 | void filter_print(const char *fname); | 65 | void filter_print(const char *fname); |
diff --git a/src/fseccomp/main.c b/src/fseccomp/main.c index 82b96f476..3b3c92b46 100644 --- a/src/fseccomp/main.c +++ b/src/fseccomp/main.c | |||
@@ -18,11 +18,14 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "fseccomp.h" | 20 | #include "fseccomp.h" |
21 | #include "../include/seccomp.h" | ||
21 | int arg_quiet = 0; | 22 | int arg_quiet = 0; |
23 | int arg_seccomp_error_action = EPERM; // error action: errno, log or kill | ||
22 | 24 | ||
23 | static void usage(void) { | 25 | static void usage(void) { |
24 | printf("Usage:\n"); | 26 | printf("Usage:\n"); |
25 | printf("\tfseccomp debug-syscalls\n"); | 27 | printf("\tfseccomp debug-syscalls\n"); |
28 | printf("\tfseccomp debug-syscalls32\n"); | ||
26 | printf("\tfseccomp debug-errnos\n"); | 29 | printf("\tfseccomp debug-errnos\n"); |
27 | printf("\tfseccomp debug-protocols\n"); | 30 | printf("\tfseccomp debug-protocols\n"); |
28 | printf("\tfseccomp protocol build list file\n"); | 31 | printf("\tfseccomp protocol build list file\n"); |
@@ -31,12 +34,20 @@ static void usage(void) { | |||
31 | printf("\tfseccomp secondary block file\n"); | 34 | printf("\tfseccomp secondary block file\n"); |
32 | printf("\tfseccomp default file\n"); | 35 | printf("\tfseccomp default file\n"); |
33 | printf("\tfseccomp default file allow-debuggers\n"); | 36 | printf("\tfseccomp default file allow-debuggers\n"); |
37 | printf("\tfseccomp default32 file\n"); | ||
38 | printf("\tfseccomp default32 file allow-debuggers\n"); | ||
34 | printf("\tfseccomp drop file1 file2 list\n"); | 39 | printf("\tfseccomp drop file1 file2 list\n"); |
35 | printf("\tfseccomp drop file1 file2 list allow-debuggers\n"); | 40 | printf("\tfseccomp drop file1 file2 list allow-debuggers\n"); |
41 | printf("\tfseccomp drop32 file1 file2 list\n"); | ||
42 | printf("\tfseccomp drop32 file1 file2 list allow-debuggers\n"); | ||
36 | printf("\tfseccomp default drop file1 file2 list\n"); | 43 | printf("\tfseccomp default drop file1 file2 list\n"); |
37 | printf("\tfseccomp default drop file1 file2 list allow-debuggers\n"); | 44 | printf("\tfseccomp default drop file1 file2 list allow-debuggers\n"); |
45 | printf("\tfseccomp default32 drop file1 file2 list\n"); | ||
46 | printf("\tfseccomp default32 drop file1 file2 list allow-debuggers\n"); | ||
38 | printf("\tfseccomp keep file1 file2 list\n"); | 47 | printf("\tfseccomp keep file1 file2 list\n"); |
48 | printf("\tfseccomp keep32 file1 file2 list\n"); | ||
39 | printf("\tfseccomp memory-deny-write-execute file\n"); | 49 | printf("\tfseccomp memory-deny-write-execute file\n"); |
50 | printf("\tfseccomp memory-deny-write-execute.32 file\n"); | ||
40 | } | 51 | } |
41 | 52 | ||
42 | int main(int argc, char **argv) { | 53 | int main(int argc, char **argv) { |
@@ -58,12 +69,28 @@ printf("\n"); | |||
58 | if (quiet && strcmp(quiet, "yes") == 0) | 69 | if (quiet && strcmp(quiet, "yes") == 0) |
59 | arg_quiet = 1; | 70 | arg_quiet = 1; |
60 | 71 | ||
72 | char *error_action = getenv("FIREJAIL_SECCOMP_ERROR_ACTION"); | ||
73 | if (error_action) { | ||
74 | if (strcmp(error_action, "kill") == 0) | ||
75 | arg_seccomp_error_action = SECCOMP_RET_KILL; | ||
76 | else if (strcmp(error_action, "log") == 0) | ||
77 | arg_seccomp_error_action = SECCOMP_RET_LOG; | ||
78 | else { | ||
79 | arg_seccomp_error_action = errno_find_name(error_action); | ||
80 | if (arg_seccomp_error_action == -1) | ||
81 | errExit("seccomp-error-action: unknown errno"); | ||
82 | arg_seccomp_error_action |= SECCOMP_RET_ERRNO; | ||
83 | } | ||
84 | } | ||
85 | |||
61 | if (strcmp(argv[1], "-h") == 0 || strcmp(argv[1], "--help") == 0 || strcmp(argv[1], "-?") ==0) { | 86 | if (strcmp(argv[1], "-h") == 0 || strcmp(argv[1], "--help") == 0 || strcmp(argv[1], "-?") ==0) { |
62 | usage(); | 87 | usage(); |
63 | return 0; | 88 | return 0; |
64 | } | 89 | } |
65 | else if (argc == 2 && strcmp(argv[1], "debug-syscalls") == 0) | 90 | else if (argc == 2 && strcmp(argv[1], "debug-syscalls") == 0) |
66 | syscall_print(); | 91 | syscall_print(); |
92 | else if (argc == 2 && strcmp(argv[1], "debug-syscalls32") == 0) | ||
93 | syscall_print_32(); | ||
67 | else if (argc == 2 && strcmp(argv[1], "debug-errnos") == 0) | 94 | else if (argc == 2 && strcmp(argv[1], "debug-errnos") == 0) |
68 | errno_print(); | 95 | errno_print(); |
69 | else if (argc == 2 && strcmp(argv[1], "debug-protocols") == 0) | 96 | else if (argc == 2 && strcmp(argv[1], "debug-protocols") == 0) |
@@ -75,21 +102,37 @@ printf("\n"); | |||
75 | else if (argc == 4 && strcmp(argv[1], "secondary") == 0 && strcmp(argv[2], "block") == 0) | 102 | else if (argc == 4 && strcmp(argv[1], "secondary") == 0 && strcmp(argv[2], "block") == 0) |
76 | seccomp_secondary_block(argv[3]); | 103 | seccomp_secondary_block(argv[3]); |
77 | else if (argc == 3 && strcmp(argv[1], "default") == 0) | 104 | else if (argc == 3 && strcmp(argv[1], "default") == 0) |
78 | seccomp_default(argv[2], 0); | 105 | seccomp_default(argv[2], 0, true); |
79 | else if (argc == 4 && strcmp(argv[1], "default") == 0 && strcmp(argv[3], "allow-debuggers") == 0) | 106 | else if (argc == 4 && strcmp(argv[1], "default") == 0 && strcmp(argv[3], "allow-debuggers") == 0) |
80 | seccomp_default(argv[2], 1); | 107 | seccomp_default(argv[2], 1, true); |
108 | else if (argc == 3 && strcmp(argv[1], "default32") == 0) | ||
109 | seccomp_default(argv[2], 0, false); | ||
110 | else if (argc == 4 && strcmp(argv[1], "default32") == 0 && strcmp(argv[3], "allow-debuggers") == 0) | ||
111 | seccomp_default(argv[2], 1, false); | ||
81 | else if (argc == 5 && strcmp(argv[1], "drop") == 0) | 112 | else if (argc == 5 && strcmp(argv[1], "drop") == 0) |
82 | seccomp_drop(argv[2], argv[3], argv[4], 0); | 113 | seccomp_drop(argv[2], argv[3], argv[4], 0, true); |
83 | else if (argc == 6 && strcmp(argv[1], "drop") == 0 && strcmp(argv[5], "allow-debuggers") == 0) | 114 | else if (argc == 6 && strcmp(argv[1], "drop") == 0 && strcmp(argv[5], "allow-debuggers") == 0) |
84 | seccomp_drop(argv[2], argv[3], argv[4], 1); | 115 | seccomp_drop(argv[2], argv[3], argv[4], 1, true); |
116 | else if (argc == 5 && strcmp(argv[1], "drop32") == 0) | ||
117 | seccomp_drop(argv[2], argv[3], argv[4], 0, false); | ||
118 | else if (argc == 6 && strcmp(argv[1], "drop32") == 0 && strcmp(argv[5], "allow-debuggers") == 0) | ||
119 | seccomp_drop(argv[2], argv[3], argv[4], 1, false); | ||
85 | else if (argc == 6 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0) | 120 | else if (argc == 6 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0) |
86 | seccomp_default_drop(argv[3], argv[4], argv[5], 0); | 121 | seccomp_default_drop(argv[3], argv[4], argv[5], 0, true); |
87 | else if (argc == 7 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0 && strcmp(argv[6], "allow-debuggers") == 0) | 122 | else if (argc == 7 && strcmp(argv[1], "default") == 0 && strcmp(argv[2], "drop") == 0 && strcmp(argv[6], "allow-debuggers") == 0) |
88 | seccomp_default_drop(argv[3], argv[4], argv[5], 1); | 123 | seccomp_default_drop(argv[3], argv[4], argv[5], 1, true); |
124 | else if (argc == 6 && strcmp(argv[1], "default32") == 0 && strcmp(argv[2], "drop") == 0) | ||
125 | seccomp_default_drop(argv[3], argv[4], argv[5], 0, false); | ||
126 | else if (argc == 7 && strcmp(argv[1], "default32") == 0 && strcmp(argv[2], "drop") == 0 && strcmp(argv[6], "allow-debuggers") == 0) | ||
127 | seccomp_default_drop(argv[3], argv[4], argv[5], 1, false); | ||
89 | else if (argc == 5 && strcmp(argv[1], "keep") == 0) | 128 | else if (argc == 5 && strcmp(argv[1], "keep") == 0) |
90 | seccomp_keep(argv[2], argv[3], argv[4]); | 129 | seccomp_keep(argv[2], argv[3], argv[4], true); |
130 | else if (argc == 5 && strcmp(argv[1], "keep32") == 0) | ||
131 | seccomp_keep(argv[2], argv[3], argv[4], false); | ||
91 | else if (argc == 3 && strcmp(argv[1], "memory-deny-write-execute") == 0) | 132 | else if (argc == 3 && strcmp(argv[1], "memory-deny-write-execute") == 0) |
92 | memory_deny_write_execute(argv[2]); | 133 | memory_deny_write_execute(argv[2]); |
134 | else if (argc == 3 && strcmp(argv[1], "memory-deny-write-execute.32") == 0) | ||
135 | memory_deny_write_execute_32(argv[2]); | ||
93 | else { | 136 | else { |
94 | fprintf(stderr, "Error fseccomp: invalid arguments\n"); | 137 | fprintf(stderr, "Error fseccomp: invalid arguments\n"); |
95 | return 1; | 138 | return 1; |
diff --git a/src/fseccomp/protocol.c b/src/fseccomp/protocol.c index 7a21eb2c2..b8b30f488 100644 --- a/src/fseccomp/protocol.c +++ b/src/fseccomp/protocol.c | |||
@@ -122,10 +122,23 @@ void protocol_build_filter(const char *prlist, const char *fname) { | |||
122 | 122 | ||
123 | // header | 123 | // header |
124 | struct sock_filter filter_start[] = { | 124 | struct sock_filter filter_start[] = { |
125 | VALIDATE_ARCHITECTURE, | 125 | #if defined __x86_64__ |
126 | EXAMINE_SYSCALL, | 126 | /* check for native arch */ |
127 | ONLY(SYS_socket), | 127 | BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, arch))), |
128 | EXAMINE_ARGUMENT(0) | 128 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, ARCH_NR, 1 + 2 + 1, 0), |
129 | /* i386 filter */ | ||
130 | EXAMINE_SYSCALL, // 1 | ||
131 | // checking SYS_socket only: filtering SYS_socketcall not possible with seccomp | ||
132 | ONLY(359), // 1 + 2 | ||
133 | BPF_JUMP(BPF_JMP+BPF_JA+BPF_K, (3 + 1 + 2), 0, 0), // 1 + 2 + 1 | ||
134 | #else | ||
135 | #warning 32 bit protocol filter not implemented yet for your architecture | ||
136 | #endif | ||
137 | VALIDATE_ARCHITECTURE, // 3 | ||
138 | EXAMINE_SYSCALL, // 3 + 1 | ||
139 | ONLY(SYS_socket), // 3 + 1 + 2 | ||
140 | |||
141 | EXAMINE_ARGUMENT(0) // 3 + 1 + 2 + 1 | ||
129 | }; | 142 | }; |
130 | memcpy(ptr, &filter_start[0], sizeof(filter_start)); | 143 | memcpy(ptr, &filter_start[0], sizeof(filter_start)); |
131 | ptr += sizeof(filter_start); | 144 | ptr += sizeof(filter_start); |
diff --git a/src/fseccomp/seccomp.c b/src/fseccomp/seccomp.c index 29aa2f2f5..e808538b0 100644 --- a/src/fseccomp/seccomp.c +++ b/src/fseccomp/seccomp.c | |||
@@ -24,12 +24,12 @@ | |||
24 | #include <sys/syscall.h> | 24 | #include <sys/syscall.h> |
25 | #include <sys/types.h> | 25 | #include <sys/types.h> |
26 | 26 | ||
27 | static void add_default_list(int fd, int allow_debuggers) { | 27 | static void add_default_list(int fd, int allow_debuggers, bool native) { |
28 | int r; | 28 | int r; |
29 | if (!allow_debuggers) | 29 | if (!allow_debuggers) |
30 | r = syscall_check_list("@default-nodebuggers", filter_add_blacklist, fd, 0, NULL); | 30 | r = syscall_check_list("@default-nodebuggers", filter_add_blacklist, fd, 0, NULL, native); |
31 | else | 31 | else |
32 | r = syscall_check_list("@default", filter_add_blacklist, fd, 0, NULL); | 32 | r = syscall_check_list("@default", filter_add_blacklist, fd, 0, NULL, native); |
33 | 33 | ||
34 | assert(r == 0); | 34 | assert(r == 0); |
35 | //#ifdef SYS_mknod - emoved in 0.9.29 - it breaks Zotero extension | 35 | //#ifdef SYS_mknod - emoved in 0.9.29 - it breaks Zotero extension |
@@ -46,7 +46,7 @@ static void add_default_list(int fd, int allow_debuggers) { | |||
46 | } | 46 | } |
47 | 47 | ||
48 | // default list | 48 | // default list |
49 | void seccomp_default(const char *fname, int allow_debuggers) { | 49 | void seccomp_default(const char *fname, int allow_debuggers, bool native) { |
50 | assert(fname); | 50 | assert(fname); |
51 | 51 | ||
52 | // open file | 52 | // open file |
@@ -57,8 +57,8 @@ void seccomp_default(const char *fname, int allow_debuggers) { | |||
57 | } | 57 | } |
58 | 58 | ||
59 | // build filter (no post-exec filter needed because default list is fine for us) | 59 | // build filter (no post-exec filter needed because default list is fine for us) |
60 | filter_init(fd); | 60 | filter_init(fd, native); |
61 | add_default_list(fd, allow_debuggers); | 61 | add_default_list(fd, allow_debuggers, native); |
62 | filter_end_blacklist(fd); | 62 | filter_end_blacklist(fd); |
63 | 63 | ||
64 | // close file | 64 | // close file |
@@ -66,7 +66,7 @@ void seccomp_default(const char *fname, int allow_debuggers) { | |||
66 | } | 66 | } |
67 | 67 | ||
68 | // drop list | 68 | // drop list |
69 | void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers) { | 69 | void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers, bool native) { |
70 | assert(fname1); | 70 | assert(fname1); |
71 | assert(fname2); | 71 | assert(fname2); |
72 | (void) allow_debuggers; // todo: to implemnet it | 72 | (void) allow_debuggers; // todo: to implemnet it |
@@ -79,15 +79,15 @@ void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_ | |||
79 | } | 79 | } |
80 | 80 | ||
81 | // build pre-exec filter: don't blacklist any syscalls in @default-keep | 81 | // build pre-exec filter: don't blacklist any syscalls in @default-keep |
82 | filter_init(fd); | 82 | filter_init(fd, native); |
83 | 83 | ||
84 | // allow exceptions in form of !syscall | 84 | // allow exceptions in form of !syscall |
85 | syscall_check_list(list, filter_add_whitelist_for_excluded, fd, 0, NULL); | 85 | syscall_check_list(list, filter_add_whitelist_for_excluded, fd, 0, NULL, native); |
86 | 86 | ||
87 | char *prelist, *postlist; | 87 | char *prelist, *postlist; |
88 | syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist); | 88 | syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist, native); |
89 | if (prelist) | 89 | if (prelist) |
90 | if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL)) { | 90 | if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL, native)) { |
91 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 91 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
92 | exit(1); | 92 | exit(1); |
93 | } | 93 | } |
@@ -106,8 +106,8 @@ void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_ | |||
106 | } | 106 | } |
107 | 107 | ||
108 | // build post-exec filter: blacklist remaining syscalls | 108 | // build post-exec filter: blacklist remaining syscalls |
109 | filter_init(fd); | 109 | filter_init(fd, native); |
110 | if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL)) { | 110 | if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL, native)) { |
111 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 111 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
112 | exit(1); | 112 | exit(1); |
113 | } | 113 | } |
@@ -118,7 +118,7 @@ void seccomp_drop(const char *fname1, const char *fname2, char *list, int allow_ | |||
118 | } | 118 | } |
119 | 119 | ||
120 | // default+drop | 120 | // default+drop |
121 | void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers) { | 121 | void seccomp_default_drop(const char *fname1, const char *fname2, char *list, int allow_debuggers, bool native) { |
122 | assert(fname1); | 122 | assert(fname1); |
123 | assert(fname2); | 123 | assert(fname2); |
124 | 124 | ||
@@ -131,16 +131,16 @@ void seccomp_default_drop(const char *fname1, const char *fname2, char *list, in | |||
131 | 131 | ||
132 | // build pre-exec filter: blacklist @default, don't blacklist | 132 | // build pre-exec filter: blacklist @default, don't blacklist |
133 | // any listed syscalls in @default-keep | 133 | // any listed syscalls in @default-keep |
134 | filter_init(fd); | 134 | filter_init(fd, native); |
135 | 135 | ||
136 | // allow exceptions in form of !syscall | 136 | // allow exceptions in form of !syscall |
137 | syscall_check_list(list, filter_add_whitelist_for_excluded, fd, 0, NULL); | 137 | syscall_check_list(list, filter_add_whitelist_for_excluded, fd, 0, NULL, native); |
138 | 138 | ||
139 | add_default_list(fd, allow_debuggers); | 139 | add_default_list(fd, allow_debuggers, native); |
140 | char *prelist, *postlist; | 140 | char *prelist, *postlist; |
141 | syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist); | 141 | syscalls_in_list(list, "@default-keep", fd, &prelist, &postlist, native); |
142 | if (prelist) | 142 | if (prelist) |
143 | if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL)) { | 143 | if (syscall_check_list(prelist, filter_add_blacklist, fd, 0, NULL, native)) { |
144 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 144 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
145 | exit(1); | 145 | exit(1); |
146 | } | 146 | } |
@@ -160,8 +160,8 @@ void seccomp_default_drop(const char *fname1, const char *fname2, char *list, in | |||
160 | } | 160 | } |
161 | 161 | ||
162 | // build post-exec filter: blacklist remaining syscalls | 162 | // build post-exec filter: blacklist remaining syscalls |
163 | filter_init(fd); | 163 | filter_init(fd, native); |
164 | if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL)) { | 164 | if (syscall_check_list(postlist, filter_add_blacklist, fd, 0, NULL, native)) { |
165 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 165 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
166 | exit(1); | 166 | exit(1); |
167 | } | 167 | } |
@@ -171,7 +171,7 @@ void seccomp_default_drop(const char *fname1, const char *fname2, char *list, in | |||
171 | close(fd); | 171 | close(fd); |
172 | } | 172 | } |
173 | 173 | ||
174 | void seccomp_keep(const char *fname1, const char *fname2, char *list) { | 174 | void seccomp_keep(const char *fname1, const char *fname2, char *list, bool native) { |
175 | (void) fname2; | 175 | (void) fname2; |
176 | 176 | ||
177 | // open file for pre-exec filter | 177 | // open file for pre-exec filter |
@@ -182,17 +182,17 @@ void seccomp_keep(const char *fname1, const char *fname2, char *list) { | |||
182 | } | 182 | } |
183 | 183 | ||
184 | // build pre-exec filter: whitelist also @default-keep | 184 | // build pre-exec filter: whitelist also @default-keep |
185 | filter_init(fd); | 185 | filter_init(fd, native); |
186 | 186 | ||
187 | // allow exceptions in form of !syscall | 187 | // allow exceptions in form of !syscall |
188 | syscall_check_list(list, filter_add_blacklist_for_excluded, fd, 0, NULL); | 188 | syscall_check_list(list, filter_add_blacklist_for_excluded, fd, 0, NULL, native); |
189 | 189 | ||
190 | // these syscalls are used by firejail after the seccomp filter is initialized | 190 | // these syscalls are used by firejail after the seccomp filter is initialized |
191 | int r; | 191 | int r; |
192 | r = syscall_check_list("@default-keep", filter_add_whitelist, fd, 0, NULL); | 192 | r = syscall_check_list("@default-keep", filter_add_whitelist, fd, 0, NULL, native); |
193 | assert(r == 0); | 193 | assert(r == 0); |
194 | 194 | ||
195 | if (syscall_check_list(list, filter_add_whitelist, fd, 0, NULL)) { | 195 | if (syscall_check_list(list, filter_add_whitelist, fd, 0, NULL, native)) { |
196 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); | 196 | fprintf(stderr, "Error fseccomp: cannot build seccomp filter\n"); |
197 | exit(1); | 197 | exit(1); |
198 | } | 198 | } |
@@ -206,6 +206,15 @@ void seccomp_keep(const char *fname1, const char *fname2, char *list) { | |||
206 | #if defined(__x86_64__) || defined(__aarch64__) || defined(__powerpc64__) | 206 | #if defined(__x86_64__) || defined(__aarch64__) || defined(__powerpc64__) |
207 | # define filter_syscall SYS_mmap | 207 | # define filter_syscall SYS_mmap |
208 | # undef block_syscall | 208 | # undef block_syscall |
209 | #if defined(__x86_64__) | ||
210 | // i386 syscalls | ||
211 | # define filter_syscall_32 192 | ||
212 | # define block_syscall_32 90 | ||
213 | # define mprotect_32 125 | ||
214 | # define pkey_mprotect_32 380 | ||
215 | # define shmat_32 397 | ||
216 | # define memfd_create_32 356 | ||
217 | #endif | ||
209 | #elif defined(__i386__) | 218 | #elif defined(__i386__) |
210 | # define filter_syscall SYS_mmap2 | 219 | # define filter_syscall SYS_mmap2 |
211 | # define block_syscall SYS_mmap | 220 | # define block_syscall SYS_mmap |
@@ -216,6 +225,12 @@ void seccomp_keep(const char *fname1, const char *fname2, char *list) { | |||
216 | # warning "Platform does not support seccomp memory-deny-write-execute filter yet" | 225 | # warning "Platform does not support seccomp memory-deny-write-execute filter yet" |
217 | # undef filter_syscall | 226 | # undef filter_syscall |
218 | # undef block_syscall | 227 | # undef block_syscall |
228 | # undef filter_syscall_32 | ||
229 | # undef block_syscall_32 | ||
230 | # undef mprotect_32 | ||
231 | # undef pkey_mprotect_32 | ||
232 | # undef shmat_32 | ||
233 | # undef memfd_create_32 | ||
219 | #endif | 234 | #endif |
220 | 235 | ||
221 | void memory_deny_write_execute(const char *fname) { | 236 | void memory_deny_write_execute(const char *fname) { |
@@ -226,10 +241,10 @@ void memory_deny_write_execute(const char *fname) { | |||
226 | exit(1); | 241 | exit(1); |
227 | } | 242 | } |
228 | 243 | ||
229 | filter_init(fd); | 244 | filter_init(fd, true); |
230 | 245 | ||
231 | // build filter | 246 | // build filter |
232 | static const struct sock_filter filter[] = { | 247 | struct sock_filter filter[] = { |
233 | #ifdef block_syscall | 248 | #ifdef block_syscall |
234 | // block old multiplexing mmap syscall for i386 | 249 | // block old multiplexing mmap syscall for i386 |
235 | BLACKLIST(block_syscall), | 250 | BLACKLIST(block_syscall), |
@@ -240,7 +255,7 @@ void memory_deny_write_execute(const char *fname) { | |||
240 | EXAMINE_ARGUMENT(2), | 255 | EXAMINE_ARGUMENT(2), |
241 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_WRITE|PROT_EXEC), | 256 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_WRITE|PROT_EXEC), |
242 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_WRITE|PROT_EXEC, 0, 1), | 257 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_WRITE|PROT_EXEC, 0, 1), |
243 | KILL_PROCESS, | 258 | KILL_OR_RETURN_ERRNO, |
244 | RETURN_ALLOW, | 259 | RETURN_ALLOW, |
245 | #endif | 260 | #endif |
246 | 261 | ||
@@ -249,7 +264,7 @@ void memory_deny_write_execute(const char *fname) { | |||
249 | EXAMINE_ARGUMENT(2), | 264 | EXAMINE_ARGUMENT(2), |
250 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_EXEC), | 265 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_EXEC), |
251 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_EXEC, 0, 1), | 266 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_EXEC, 0, 1), |
252 | KILL_PROCESS, | 267 | KILL_OR_RETURN_ERRNO, |
253 | RETURN_ALLOW, | 268 | RETURN_ALLOW, |
254 | 269 | ||
255 | // same for pkey_mprotect(,,PROT_EXEC), where available | 270 | // same for pkey_mprotect(,,PROT_EXEC), where available |
@@ -258,7 +273,7 @@ void memory_deny_write_execute(const char *fname) { | |||
258 | EXAMINE_ARGUMENT(2), | 273 | EXAMINE_ARGUMENT(2), |
259 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_EXEC), | 274 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_EXEC), |
260 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_EXEC, 0, 1), | 275 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_EXEC, 0, 1), |
261 | KILL_PROCESS, | 276 | KILL_OR_RETURN_ERRNO, |
262 | RETURN_ALLOW, | 277 | RETURN_ALLOW, |
263 | #endif | 278 | #endif |
264 | 279 | ||
@@ -269,7 +284,7 @@ void memory_deny_write_execute(const char *fname) { | |||
269 | EXAMINE_ARGUMENT(2), | 284 | EXAMINE_ARGUMENT(2), |
270 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, SHM_EXEC), | 285 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, SHM_EXEC), |
271 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SHM_EXEC, 0, 1), | 286 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SHM_EXEC, 0, 1), |
272 | KILL_PROCESS, | 287 | KILL_OR_RETURN_ERRNO, |
273 | RETURN_ALLOW, | 288 | RETURN_ALLOW, |
274 | #endif | 289 | #endif |
275 | #ifdef SYS_memfd_create | 290 | #ifdef SYS_memfd_create |
@@ -277,7 +292,7 @@ void memory_deny_write_execute(const char *fname) { | |||
277 | // arbitrary memory contents which can be later mapped | 292 | // arbitrary memory contents which can be later mapped |
278 | // as executable | 293 | // as executable |
279 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_memfd_create, 0, 1), | 294 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SYS_memfd_create, 0, 1), |
280 | KILL_PROCESS, | 295 | KILL_OR_RETURN_ERRNO, |
281 | RETURN_ALLOW | 296 | RETURN_ALLOW |
282 | #endif | 297 | #endif |
283 | }; | 298 | }; |
@@ -288,3 +303,75 @@ void memory_deny_write_execute(const char *fname) { | |||
288 | // close file | 303 | // close file |
289 | close(fd); | 304 | close(fd); |
290 | } | 305 | } |
306 | |||
307 | void memory_deny_write_execute_32(const char *fname) { | ||
308 | // open file | ||
309 | int fd = open(fname, O_CREAT|O_WRONLY|O_TRUNC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | ||
310 | if (fd < 0) { | ||
311 | fprintf(stderr, "Error fseccomp: cannot open %s file\n", fname); | ||
312 | exit(1); | ||
313 | } | ||
314 | |||
315 | filter_init(fd, false); | ||
316 | |||
317 | // build filter | ||
318 | struct sock_filter filter[] = { | ||
319 | #if defined(__x86_64__) | ||
320 | #ifdef block_syscall_32 | ||
321 | // block old multiplexing mmap syscall for i386 | ||
322 | BLACKLIST(block_syscall_32), | ||
323 | #endif | ||
324 | #ifdef filter_syscall_32 | ||
325 | // block mmap(,,x|PROT_WRITE|PROT_EXEC) so W&X memory can't be created | ||
326 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, filter_syscall_32, 0, 5), | ||
327 | EXAMINE_ARGUMENT(2), | ||
328 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_WRITE|PROT_EXEC), | ||
329 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_WRITE|PROT_EXEC, 0, 1), | ||
330 | KILL_OR_RETURN_ERRNO, | ||
331 | RETURN_ALLOW, | ||
332 | #endif | ||
333 | #ifdef mprotect_32 | ||
334 | // block mprotect(,,PROT_EXEC) so writable memory can't be turned into executable | ||
335 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, mprotect_32, 0, 5), | ||
336 | EXAMINE_ARGUMENT(2), | ||
337 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_EXEC), | ||
338 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_EXEC, 0, 1), | ||
339 | KILL_OR_RETURN_ERRNO, | ||
340 | RETURN_ALLOW, | ||
341 | #endif | ||
342 | #ifdef pkey_mprotect_32 | ||
343 | // same for pkey_mprotect(,,PROT_EXEC), where available | ||
344 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, pkey_mprotect_32, 0, 5), | ||
345 | EXAMINE_ARGUMENT(2), | ||
346 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, PROT_EXEC), | ||
347 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, PROT_EXEC, 0, 1), | ||
348 | KILL_OR_RETURN_ERRNO, | ||
349 | RETURN_ALLOW, | ||
350 | #endif | ||
351 | |||
352 | #ifdef shmat_32 | ||
353 | // block shmat(,,x|SHM_EXEC) so W&X shared memory can't be created | ||
354 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, shmat_32, 0, 5), | ||
355 | EXAMINE_ARGUMENT(2), | ||
356 | BPF_STMT(BPF_ALU+BPF_AND+BPF_K, SHM_EXEC), | ||
357 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, SHM_EXEC, 0, 1), | ||
358 | KILL_OR_RETURN_ERRNO, | ||
359 | RETURN_ALLOW, | ||
360 | #endif | ||
361 | #ifdef memfd_create_32 | ||
362 | // block memfd_create as it can be used to create | ||
363 | // arbitrary memory contents which can be later mapped | ||
364 | // as executable | ||
365 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, memfd_create_32, 0, 1), | ||
366 | KILL_OR_RETURN_ERRNO, | ||
367 | #endif | ||
368 | #endif | ||
369 | RETURN_ALLOW | ||
370 | }; | ||
371 | write_to_file(fd, filter, sizeof(filter)); | ||
372 | |||
373 | filter_end_blacklist(fd); | ||
374 | |||
375 | // close file | ||
376 | close(fd); | ||
377 | } | ||
diff --git a/src/fseccomp/seccomp_file.c b/src/fseccomp/seccomp_file.c index e47e8db25..9e8ceb898 100644 --- a/src/fseccomp/seccomp_file.c +++ b/src/fseccomp/seccomp_file.c | |||
@@ -21,11 +21,11 @@ | |||
21 | #include "../include/seccomp.h" | 21 | #include "../include/seccomp.h" |
22 | #include <sys/syscall.h> | 22 | #include <sys/syscall.h> |
23 | 23 | ||
24 | void write_to_file(int fd, const void *data, int size) { | 24 | void write_to_file(int fd, const void *data, size_t size) { |
25 | assert(data); | 25 | assert(data); |
26 | assert(size); | 26 | assert(size); |
27 | 27 | ||
28 | int written = 0; | 28 | size_t written = 0; |
29 | while (written < size) { | 29 | while (written < size) { |
30 | int rv = write(fd, (unsigned char *) data + written, size - written); | 30 | int rv = write(fd, (unsigned char *) data + written, size - written); |
31 | if (rv == -1) { | 31 | if (rv == -1) { |
@@ -36,8 +36,8 @@ void write_to_file(int fd, const void *data, int size) { | |||
36 | } | 36 | } |
37 | } | 37 | } |
38 | 38 | ||
39 | void filter_init(int fd) { | 39 | void filter_init(int fd, bool native) { |
40 | struct sock_filter filter[] = { | 40 | struct sock_filter filter_native[] = { |
41 | VALIDATE_ARCHITECTURE, | 41 | VALIDATE_ARCHITECTURE, |
42 | #if defined(__x86_64__) | 42 | #if defined(__x86_64__) |
43 | EXAMINE_SYSCALL, | 43 | EXAMINE_SYSCALL, |
@@ -46,6 +46,10 @@ void filter_init(int fd) { | |||
46 | EXAMINE_SYSCALL | 46 | EXAMINE_SYSCALL |
47 | #endif | 47 | #endif |
48 | }; | 48 | }; |
49 | struct sock_filter filter_32[] = { | ||
50 | VALIDATE_ARCHITECTURE_32, | ||
51 | EXAMINE_SYSCALL | ||
52 | }; | ||
49 | 53 | ||
50 | #if 0 | 54 | #if 0 |
51 | { | 55 | { |
@@ -57,7 +61,10 @@ void filter_init(int fd) { | |||
57 | } | 61 | } |
58 | #endif | 62 | #endif |
59 | 63 | ||
60 | write_to_file(fd, filter, sizeof(filter)); | 64 | if (native) |
65 | write_to_file(fd, filter_native, sizeof(filter_native)); | ||
66 | else | ||
67 | write_to_file(fd, filter_32, sizeof(filter_32)); | ||
61 | } | 68 | } |
62 | 69 | ||
63 | static void write_whitelist(int fd, int syscall) { | 70 | static void write_whitelist(int fd, int syscall) { |
@@ -74,9 +81,10 @@ static void write_blacklist(int fd, int syscall) { | |||
74 | write_to_file(fd, filter, sizeof(filter)); | 81 | write_to_file(fd, filter, sizeof(filter)); |
75 | } | 82 | } |
76 | 83 | ||
77 | void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg) { | 84 | void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg, bool native) { |
78 | (void) arg; | 85 | (void) arg; |
79 | (void) ptrarg; | 86 | (void) ptrarg; |
87 | (void) native; | ||
80 | 88 | ||
81 | if (syscall >= 0) { | 89 | if (syscall >= 0) { |
82 | write_whitelist(fd, syscall); | 90 | write_whitelist(fd, syscall); |
@@ -84,36 +92,54 @@ void filter_add_whitelist(int fd, int syscall, int arg, void *ptrarg) { | |||
84 | } | 92 | } |
85 | 93 | ||
86 | // handle seccomp list exceptions (seccomp x,y,!z) | 94 | // handle seccomp list exceptions (seccomp x,y,!z) |
87 | void filter_add_whitelist_for_excluded(int fd, int syscall, int arg, void *ptrarg) { | 95 | void filter_add_whitelist_for_excluded(int fd, int syscall, int arg, void *ptrarg, bool native) { |
88 | (void) arg; | 96 | (void) arg; |
89 | (void) ptrarg; | 97 | (void) ptrarg; |
98 | (void) native; | ||
90 | 99 | ||
91 | if (syscall < 0) { | 100 | if (syscall < 0) { |
92 | write_whitelist(fd, -syscall); | 101 | write_whitelist(fd, -syscall); |
93 | } | 102 | } |
94 | } | 103 | } |
95 | 104 | ||
96 | void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg) { | 105 | void filter_add_blacklist(int fd, int syscall, int arg, void *ptrarg, bool native) { |
97 | (void) arg; | 106 | (void) arg; |
98 | (void) ptrarg; | 107 | (void) ptrarg; |
108 | (void) native; | ||
99 | 109 | ||
100 | if (syscall >= 0) { | 110 | if (syscall >= 0) { |
101 | write_blacklist(fd, syscall); | 111 | write_blacklist(fd, syscall); |
102 | } | 112 | } |
103 | } | 113 | } |
104 | 114 | ||
115 | void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, bool native) { | ||
116 | (void) arg; | ||
117 | (void) ptrarg; | ||
118 | (void) native; | ||
119 | |||
120 | if (syscall >= 0) { | ||
121 | int saved_error_action = arg_seccomp_error_action; | ||
122 | arg_seccomp_error_action = SECCOMP_RET_KILL; | ||
123 | write_blacklist(fd, syscall); | ||
124 | arg_seccomp_error_action = saved_error_action; | ||
125 | } | ||
126 | } | ||
127 | |||
105 | // handle seccomp list exceptions (seccomp x,y,!z) | 128 | // handle seccomp list exceptions (seccomp x,y,!z) |
106 | void filter_add_blacklist_for_excluded(int fd, int syscall, int arg, void *ptrarg) { | 129 | void filter_add_blacklist_for_excluded(int fd, int syscall, int arg, void *ptrarg, bool native) { |
107 | (void) arg; | 130 | (void) arg; |
108 | (void) ptrarg; | 131 | (void) ptrarg; |
132 | (void) native; | ||
109 | 133 | ||
110 | if (syscall < 0) { | 134 | if (syscall < 0) { |
111 | write_blacklist(fd, -syscall); | 135 | write_blacklist(fd, -syscall); |
112 | } | 136 | } |
113 | } | 137 | } |
114 | 138 | ||
115 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg) { | 139 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native) { |
116 | (void) ptrarg; | 140 | (void) ptrarg; |
141 | (void) native; | ||
142 | |||
117 | struct sock_filter filter[] = { | 143 | struct sock_filter filter[] = { |
118 | BLACKLIST_ERRNO(syscall, arg) | 144 | BLACKLIST_ERRNO(syscall, arg) |
119 | }; | 145 | }; |
@@ -129,7 +155,7 @@ void filter_end_blacklist(int fd) { | |||
129 | 155 | ||
130 | void filter_end_whitelist(int fd) { | 156 | void filter_end_whitelist(int fd) { |
131 | struct sock_filter filter[] = { | 157 | struct sock_filter filter[] = { |
132 | KILL_PROCESS | 158 | KILL_OR_RETURN_ERRNO |
133 | }; | 159 | }; |
134 | write_to_file(fd, filter, sizeof(filter)); | 160 | write_to_file(fd, filter, sizeof(filter)); |
135 | } | 161 | } |
diff --git a/src/fseccomp/seccomp_secondary.c b/src/fseccomp/seccomp_secondary.c index 9a00d1884..f024859d3 100644 --- a/src/fseccomp/seccomp_secondary.c +++ b/src/fseccomp/seccomp_secondary.c | |||
@@ -142,7 +142,7 @@ void seccomp_secondary_block(const char *fname) { | |||
142 | // 5: if MSW(arg0) == 0, goto 7 (allow) else continue to 6 (kill) | 142 | // 5: if MSW(arg0) == 0, goto 7 (allow) else continue to 6 (kill) |
143 | BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 0, jmp_from_to(5, 7), 0), | 143 | BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, 0, jmp_from_to(5, 7), 0), |
144 | // 6: | 144 | // 6: |
145 | KILL_PROCESS, | 145 | KILL_OR_RETURN_ERRNO, |
146 | // 7: | 146 | // 7: |
147 | RETURN_ALLOW | 147 | RETURN_ALLOW |
148 | }; | 148 | }; |
diff --git a/src/include/rundefs.h b/src/include/rundefs.h index 1cfeee28d..f8bcdec52 100644 --- a/src/include/rundefs.h +++ b/src/include/rundefs.h | |||
@@ -30,6 +30,7 @@ | |||
30 | #define RUN_FIREJAIL_NETWORK_DIR RUN_FIREJAIL_DIR "/network" | 30 | #define RUN_FIREJAIL_NETWORK_DIR RUN_FIREJAIL_DIR "/network" |
31 | #define RUN_FIREJAIL_BANDWIDTH_DIR RUN_FIREJAIL_DIR "/bandwidth" | 31 | #define RUN_FIREJAIL_BANDWIDTH_DIR RUN_FIREJAIL_DIR "/bandwidth" |
32 | #define RUN_FIREJAIL_PROFILE_DIR RUN_FIREJAIL_DIR "/profile" | 32 | #define RUN_FIREJAIL_PROFILE_DIR RUN_FIREJAIL_DIR "/profile" |
33 | #define RUN_FIREJAIL_DBUS_DIR RUN_FIREJAIL_DIR "/dbus" | ||
33 | #define RUN_NETWORK_LOCK_FILE RUN_FIREJAIL_DIR "/firejail-network.lock" | 34 | #define RUN_NETWORK_LOCK_FILE RUN_FIREJAIL_DIR "/firejail-network.lock" |
34 | #define RUN_DIRECTORY_LOCK_FILE RUN_FIREJAIL_DIR "/firejail-run.lock" | 35 | #define RUN_DIRECTORY_LOCK_FILE RUN_FIREJAIL_DIR "/firejail-run.lock" |
35 | #define RUN_RO_DIR RUN_FIREJAIL_DIR "/firejail.ro.dir" | 36 | #define RUN_RO_DIR RUN_FIREJAIL_DIR "/firejail.ro.dir" |
@@ -56,19 +57,26 @@ | |||
56 | #define RUN_DHCLIENT_4_LEASES_FILE RUN_DHCLIENT_DIR "/dhclient.leases" | 57 | #define RUN_DHCLIENT_4_LEASES_FILE RUN_DHCLIENT_DIR "/dhclient.leases" |
57 | #define RUN_DHCLIENT_4_PID_FILE RUN_DHCLIENT_DIR "/dhclient.pid" | 58 | #define RUN_DHCLIENT_4_PID_FILE RUN_DHCLIENT_DIR "/dhclient.pid" |
58 | #define RUN_DHCLIENT_6_PID_FILE RUN_DHCLIENT_DIR "/dhclient6.pid" | 59 | #define RUN_DHCLIENT_6_PID_FILE RUN_DHCLIENT_DIR "/dhclient6.pid" |
60 | #define RUN_DBUS_DIR RUN_MNT_DIR "/dbus" | ||
61 | #define RUN_DBUS_USER_SOCKET RUN_DBUS_DIR "/user" | ||
62 | #define RUN_DBUS_SYSTEM_SOCKET RUN_DBUS_DIR "/system" | ||
59 | 63 | ||
60 | #define RUN_SECCOMP_DIR RUN_MNT_DIR "/seccomp" | 64 | #define RUN_SECCOMP_DIR RUN_MNT_DIR "/seccomp" |
61 | #define RUN_SECCOMP_LIST RUN_SECCOMP_DIR "/seccomp.list" // list of seccomp files installed | 65 | #define RUN_SECCOMP_LIST RUN_SECCOMP_DIR "/seccomp.list" // list of seccomp files installed |
62 | #define RUN_SECCOMP_PROTOCOL RUN_SECCOMP_DIR "/seccomp.protocol" // protocol filter | 66 | #define RUN_SECCOMP_PROTOCOL RUN_SECCOMP_DIR "/seccomp.protocol" // protocol filter |
63 | #define RUN_SECCOMP_CFG RUN_SECCOMP_DIR "/seccomp" // configured filter | 67 | #define RUN_SECCOMP_CFG RUN_SECCOMP_DIR "/seccomp" // configured filter |
64 | #define RUN_SECCOMP_32 RUN_SECCOMP_DIR "/seccomp.32" // 32bit arch filter installed on 64bit architectures | 68 | #define RUN_SECCOMP_32 RUN_SECCOMP_DIR "/seccomp.32" // 32bit arch filter installed on 64bit architectures |
65 | #define RUN_SECCOMP_MDWX RUN_SECCOMP_DIR "/seccomp.mdwx" // filter for memory-deny-write-execute | 69 | #define RUN_SECCOMP_MDWX RUN_SECCOMP_DIR "/seccomp.mdwx" // filter for memory-deny-write-execute |
70 | #define RUN_SECCOMP_MDWX_32 RUN_SECCOMP_DIR "/seccomp.mdwx.32" | ||
66 | #define RUN_SECCOMP_BLOCK_SECONDARY RUN_SECCOMP_DIR "/seccomp.block_secondary" // secondary arch blocking filter | 71 | #define RUN_SECCOMP_BLOCK_SECONDARY RUN_SECCOMP_DIR "/seccomp.block_secondary" // secondary arch blocking filter |
67 | #define RUN_SECCOMP_POSTEXEC RUN_SECCOMP_DIR "/seccomp.postexec" // filter for post-exec library | 72 | #define RUN_SECCOMP_POSTEXEC RUN_SECCOMP_DIR "/seccomp.postexec" // filter for post-exec library |
73 | #define RUN_SECCOMP_POSTEXEC_32 RUN_SECCOMP_DIR "/seccomp.postexec32" // filter for post-exec library | ||
68 | #define PATH_SECCOMP_DEFAULT LIBDIR "/firejail/seccomp" // default filter built during make | 74 | #define PATH_SECCOMP_DEFAULT LIBDIR "/firejail/seccomp" // default filter built during make |
69 | #define PATH_SECCOMP_DEFAULT_DEBUG LIBDIR "/firejail/seccomp.debug" // default filter built during make | 75 | #define PATH_SECCOMP_DEFAULT_DEBUG LIBDIR "/firejail/seccomp.debug" // debug filter built during make |
70 | #define PATH_SECCOMP_32 LIBDIR "/firejail/seccomp.32" // 32bit arch filter built during make | 76 | #define PATH_SECCOMP_32 LIBDIR "/firejail/seccomp.32" // 32bit arch filter built during make |
71 | #define PATH_SECCOMP_MDWX LIBDIR "/firejail/seccomp.mdwx" // filter for memory-deny-write-execute built during make | 77 | #define PATH_SECCOMP_DEBUG_32 LIBDIR "/firejail/seccomp.debug32" // 32bit arch debug filter built during make |
78 | #define PATH_SECCOMP_MDWX LIBDIR "/firejail/seccomp.mdwx" // filter for memory-deny-write-execute built during make | ||
79 | #define PATH_SECCOMP_MDWX_32 LIBDIR "/firejail/seccomp.mdwx.32" | ||
72 | #define PATH_SECCOMP_BLOCK_SECONDARY LIBDIR "/firejail/seccomp.block_secondary" // secondary arch blocking filter built during make | 80 | #define PATH_SECCOMP_BLOCK_SECONDARY LIBDIR "/firejail/seccomp.block_secondary" // secondary arch blocking filter built during make |
73 | 81 | ||
74 | 82 | ||
diff --git a/src/include/seccomp.h b/src/include/seccomp.h index 80a83df34..29b858c70 100644 --- a/src/include/seccomp.h +++ b/src/include/seccomp.h | |||
@@ -243,7 +243,7 @@ struct seccomp_data { | |||
243 | #define HANDLE_X32_KILL \ | 243 | #define HANDLE_X32_KILL \ |
244 | BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, X32_SYSCALL_BIT, 1, 0), \ | 244 | BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, X32_SYSCALL_BIT, 1, 0), \ |
245 | BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, 0, 1, 0), \ | 245 | BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, 0, 1, 0), \ |
246 | KILL_PROCESS | 246 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) |
247 | #endif | 247 | #endif |
248 | 248 | ||
249 | #define EXAMINE_SYSCALL BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \ | 249 | #define EXAMINE_SYSCALL BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \ |
@@ -258,7 +258,7 @@ struct seccomp_data { | |||
258 | 258 | ||
259 | #define BLACKLIST(syscall_nr) \ | 259 | #define BLACKLIST(syscall_nr) \ |
260 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, syscall_nr, 0, 1), \ | 260 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, syscall_nr, 0, 1), \ |
261 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) | 261 | KILL_OR_RETURN_ERRNO |
262 | 262 | ||
263 | #define WHITELIST(syscall_nr) \ | 263 | #define WHITELIST(syscall_nr) \ |
264 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, syscall_nr, 0, 1), \ | 264 | BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, syscall_nr, 0, 1), \ |
@@ -274,7 +274,8 @@ struct seccomp_data { | |||
274 | #define RETURN_ERRNO(nr) \ | 274 | #define RETURN_ERRNO(nr) \ |
275 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO | nr) | 275 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ERRNO | nr) |
276 | 276 | ||
277 | #define KILL_PROCESS \ | 277 | extern int arg_seccomp_error_action; // error action: errno, log or kill |
278 | BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL) | 278 | #define KILL_OR_RETURN_ERRNO \ |
279 | BPF_STMT(BPF_RET+BPF_K, arg_seccomp_error_action) | ||
279 | 280 | ||
280 | #endif | 281 | #endif |
diff --git a/src/include/syscall.h b/src/include/syscall.h index e11c56a05..489da0600 100644 --- a/src/include/syscall.h +++ b/src/include/syscall.h | |||
@@ -17,5195 +17,29 @@ | |||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | 17 | * with this program; if not, write to the Free Software Foundation, Inc., |
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #ifndef SYSCALL_H | ||
21 | #define SYSCALL_H | ||
22 | |||
23 | #include <stdbool.h> | ||
24 | |||
25 | // main.c | ||
26 | extern int arg_quiet; | ||
27 | |||
28 | // seccomp_file.c or dummy versions in firejail/main.c and fsec-print/main.c | ||
29 | void filter_add_errno(int fd, int syscall, int arg, void *ptrarg, bool native); | ||
30 | void filter_add_blacklist_override(int fd, int syscall, int arg, void *ptrarg, bool native); | ||
31 | |||
32 | // errno.c | ||
33 | void errno_print(void); | ||
34 | int errno_find_name(const char *name); | ||
35 | const char *errno_find_nr(int nr); | ||
36 | |||
37 | // syscall.c | ||
38 | void syscall_print(void); | ||
39 | void syscall_print_32(void); | ||
40 | typedef void (filter_fn)(int fd, int syscall, int arg, void *ptrarg, bool native); | ||
41 | int syscall_check_list(const char *slist, filter_fn *callback, int fd, int arg, void *ptrarg, bool native); | ||
42 | const char *syscall_find_nr(int nr); | ||
43 | void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist, bool native); | ||
20 | 44 | ||
21 | // content extracted from /bits/syscall.h file form glibc 2.22 | ||
22 | // using ../tools/extract_syscall tool | ||
23 | #if !defined __x86_64__ | ||
24 | #ifdef SYS__llseek | ||
25 | #ifdef __NR__llseek | ||
26 | {"_llseek", __NR__llseek}, | ||
27 | #endif | ||
28 | #endif | ||
29 | #ifdef SYS__newselect | ||
30 | #ifdef __NR__newselect | ||
31 | {"_newselect", __NR__newselect}, | ||
32 | #endif | ||
33 | #endif | ||
34 | #ifdef SYS__sysctl | ||
35 | #ifdef __NR__sysctl | ||
36 | {"_sysctl", __NR__sysctl}, | ||
37 | #endif | ||
38 | #endif | ||
39 | #ifdef SYS_accept4 | ||
40 | #ifdef __NR_accept4 | ||
41 | {"accept4", __NR_accept4}, | ||
42 | #endif | ||
43 | #endif | ||
44 | #ifdef SYS_access | ||
45 | #ifdef __NR_access | ||
46 | {"access", __NR_access}, | ||
47 | #endif | ||
48 | #endif | ||
49 | #ifdef SYS_acct | ||
50 | #ifdef __NR_acct | ||
51 | {"acct", __NR_acct}, | ||
52 | #endif | ||
53 | #endif | ||
54 | #ifdef SYS_add_key | ||
55 | #ifdef __NR_add_key | ||
56 | {"add_key", __NR_add_key}, | ||
57 | #endif | ||
58 | #endif | ||
59 | #ifdef SYS_adjtimex | ||
60 | #ifdef __NR_adjtimex | ||
61 | {"adjtimex", __NR_adjtimex}, | ||
62 | #endif | ||
63 | #endif | ||
64 | #ifdef SYS_afs_syscall | ||
65 | #ifdef __NR_afs_syscall | ||
66 | {"afs_syscall", __NR_afs_syscall}, | ||
67 | #endif | ||
68 | #endif | ||
69 | #ifdef SYS_alarm | ||
70 | #ifdef __NR_alarm | ||
71 | {"alarm", __NR_alarm}, | ||
72 | #endif | ||
73 | #endif | ||
74 | #ifdef SYS_arch_prctl | ||
75 | #ifdef __NR_arch_prctl | ||
76 | {"arch_prctl", __NR_arch_prctl}, | ||
77 | #endif | ||
78 | #endif | ||
79 | #ifdef SYS_bdflush | ||
80 | #ifdef __NR_bdflush | ||
81 | {"bdflush", __NR_bdflush}, | ||
82 | #endif | ||
83 | #endif | ||
84 | #ifdef SYS_bind | ||
85 | #ifdef __NR_bind | ||
86 | {"bind", __NR_bind}, | ||
87 | #endif | ||
88 | #endif | ||
89 | #ifdef SYS_bpf | ||
90 | #ifdef __NR_bpf | ||
91 | {"bpf", __NR_bpf}, | ||
92 | #endif | ||
93 | #endif | ||
94 | #ifdef SYS_break | ||
95 | #ifdef __NR_break | ||
96 | {"break", __NR_break}, | ||
97 | #endif | ||
98 | #endif | ||
99 | #ifdef SYS_brk | ||
100 | #ifdef __NR_brk | ||
101 | {"brk", __NR_brk}, | ||
102 | #endif | ||
103 | #endif | ||
104 | #ifdef SYS_capget | ||
105 | #ifdef __NR_capget | ||
106 | {"capget", __NR_capget}, | ||
107 | #endif | ||
108 | #endif | ||
109 | #ifdef SYS_capset | ||
110 | #ifdef __NR_capset | ||
111 | {"capset", __NR_capset}, | ||
112 | #endif | ||
113 | #endif | ||
114 | #ifdef SYS_chdir | ||
115 | #ifdef __NR_chdir | ||
116 | {"chdir", __NR_chdir}, | ||
117 | #endif | ||
118 | #endif | ||
119 | #ifdef SYS_chmod | ||
120 | #ifdef __NR_chmod | ||
121 | {"chmod", __NR_chmod}, | ||
122 | #endif | ||
123 | #endif | ||
124 | #ifdef SYS_chown | ||
125 | #ifdef __NR_chown | ||
126 | {"chown", __NR_chown}, | ||
127 | #endif | ||
128 | #endif | ||
129 | #ifdef SYS_chown32 | ||
130 | #ifdef __NR_chown32 | ||
131 | {"chown32", __NR_chown32}, | ||
132 | #endif | ||
133 | #endif | ||
134 | #ifdef SYS_chroot | ||
135 | #ifdef __NR_chroot | ||
136 | {"chroot", __NR_chroot}, | ||
137 | #endif | ||
138 | #endif | ||
139 | #ifdef SYS_clock_adjtime | ||
140 | #ifdef __NR_clock_adjtime | ||
141 | {"clock_adjtime", __NR_clock_adjtime}, | ||
142 | #endif | ||
143 | #endif | ||
144 | #ifdef SYS_clock_getres | ||
145 | #ifdef __NR_clock_getres | ||
146 | {"clock_getres", __NR_clock_getres}, | ||
147 | #endif | ||
148 | #endif | ||
149 | #ifdef SYS_clock_gettime | ||
150 | #ifdef __NR_clock_gettime | ||
151 | {"clock_gettime", __NR_clock_gettime}, | ||
152 | #endif | ||
153 | #endif | ||
154 | #ifdef SYS_clock_nanosleep | ||
155 | #ifdef __NR_clock_nanosleep | ||
156 | {"clock_nanosleep", __NR_clock_nanosleep}, | ||
157 | #endif | ||
158 | #endif | ||
159 | #ifdef SYS_clock_settime | ||
160 | #ifdef __NR_clock_settime | ||
161 | {"clock_settime", __NR_clock_settime}, | ||
162 | #endif | ||
163 | #endif | ||
164 | #ifdef SYS_clone | ||
165 | #ifdef __NR_clone | ||
166 | {"clone", __NR_clone}, | ||
167 | #endif | ||
168 | #endif | ||
169 | #ifdef SYS_close | ||
170 | #ifdef __NR_close | ||
171 | {"close", __NR_close}, | ||
172 | #endif | ||
173 | #endif | ||
174 | #ifdef SYS_connect | ||
175 | #ifdef __NR_connect | ||
176 | {"connect", __NR_connect}, | ||
177 | #endif | ||
178 | #endif | ||
179 | #ifdef SYS_copy_file_range | ||
180 | #ifdef __NR_copy_file_range | ||
181 | {"copy_file_range", __NR_copy_file_range}, | ||
182 | #endif | ||
183 | #endif | ||
184 | #ifdef SYS_creat | ||
185 | #ifdef __NR_creat | ||
186 | {"creat", __NR_creat}, | ||
187 | #endif | ||
188 | #endif | ||
189 | #ifdef SYS_create_module | ||
190 | #ifdef __NR_create_module | ||
191 | {"create_module", __NR_create_module}, | ||
192 | #endif | ||
193 | #endif | ||
194 | #ifdef SYS_delete_module | ||
195 | #ifdef __NR_delete_module | ||
196 | {"delete_module", __NR_delete_module}, | ||
197 | #endif | ||
198 | #endif | ||
199 | #ifdef SYS_dup | ||
200 | #ifdef __NR_dup | ||
201 | {"dup", __NR_dup}, | ||
202 | #endif | ||
203 | #endif | ||
204 | #ifdef SYS_dup2 | ||
205 | #ifdef __NR_dup2 | ||
206 | {"dup2", __NR_dup2}, | ||
207 | #endif | ||
208 | #endif | ||
209 | #ifdef SYS_dup3 | ||
210 | #ifdef __NR_dup3 | ||
211 | {"dup3", __NR_dup3}, | ||
212 | #endif | ||
213 | #endif | ||
214 | #ifdef SYS_epoll_create | ||
215 | #ifdef __NR_epoll_create | ||
216 | {"epoll_create", __NR_epoll_create}, | ||
217 | #endif | ||
218 | #endif | ||
219 | #ifdef SYS_epoll_create1 | ||
220 | #ifdef __NR_epoll_create1 | ||
221 | {"epoll_create1", __NR_epoll_create1}, | ||
222 | #endif | ||
223 | #endif | ||
224 | #ifdef SYS_epoll_ctl | ||
225 | #ifdef __NR_epoll_ctl | ||
226 | {"epoll_ctl", __NR_epoll_ctl}, | ||
227 | #endif | ||
228 | #endif | ||
229 | #ifdef SYS_epoll_pwait | ||
230 | #ifdef __NR_epoll_pwait | ||
231 | {"epoll_pwait", __NR_epoll_pwait}, | ||
232 | #endif | ||
233 | #endif | ||
234 | #ifdef SYS_epoll_wait | ||
235 | #ifdef __NR_epoll_wait | ||
236 | {"epoll_wait", __NR_epoll_wait}, | ||
237 | #endif | ||
238 | #endif | ||
239 | #ifdef SYS_eventfd | ||
240 | #ifdef __NR_eventfd | ||
241 | {"eventfd", __NR_eventfd}, | ||
242 | #endif | ||
243 | #endif | ||
244 | #ifdef SYS_eventfd2 | ||
245 | #ifdef __NR_eventfd2 | ||
246 | {"eventfd2", __NR_eventfd2}, | ||
247 | #endif | ||
248 | #endif | ||
249 | #ifdef SYS_execve | ||
250 | #ifdef __NR_execve | ||
251 | {"execve", __NR_execve}, | ||
252 | #endif | ||
253 | #endif | ||
254 | #ifdef SYS_execveat | ||
255 | #ifdef __NR_execveat | ||
256 | {"execveat", __NR_execveat}, | ||
257 | #endif | ||
258 | #endif | ||
259 | #ifdef SYS_exit | ||
260 | #ifdef __NR_exit | ||
261 | {"exit", __NR_exit}, | ||
262 | #endif | ||
263 | #endif | ||
264 | #ifdef SYS_exit_group | ||
265 | #ifdef __NR_exit_group | ||
266 | {"exit_group", __NR_exit_group}, | ||
267 | #endif | ||
268 | #endif | ||
269 | #ifdef SYS_faccessat | ||
270 | #ifdef __NR_faccessat | ||
271 | {"faccessat", __NR_faccessat}, | ||
272 | #endif | ||
273 | #endif | ||
274 | #ifdef SYS_fadvise64 | ||
275 | #ifdef __NR_fadvise64 | ||
276 | {"fadvise64", __NR_fadvise64}, | ||
277 | #endif | ||
278 | #endif | ||
279 | #ifdef SYS_fadvise64_64 | ||
280 | #ifdef __NR_fadvise64_64 | ||
281 | {"fadvise64_64", __NR_fadvise64_64}, | ||
282 | #endif | ||
283 | #endif | ||
284 | #ifdef SYS_fallocate | ||
285 | #ifdef __NR_fallocate | ||
286 | {"fallocate", __NR_fallocate}, | ||
287 | #endif | ||
288 | #endif | ||
289 | #ifdef SYS_fanotify_init | ||
290 | #ifdef __NR_fanotify_init | ||
291 | {"fanotify_init", __NR_fanotify_init}, | ||
292 | #endif | ||
293 | #endif | ||
294 | #ifdef SYS_fanotify_mark | ||
295 | #ifdef __NR_fanotify_mark | ||
296 | {"fanotify_mark", __NR_fanotify_mark}, | ||
297 | #endif | ||
298 | #endif | ||
299 | #ifdef SYS_fchdir | ||
300 | #ifdef __NR_fchdir | ||
301 | {"fchdir", __NR_fchdir}, | ||
302 | #endif | ||
303 | #endif | ||
304 | #ifdef SYS_fchmod | ||
305 | #ifdef __NR_fchmod | ||
306 | {"fchmod", __NR_fchmod}, | ||
307 | #endif | ||
308 | #endif | ||
309 | #ifdef SYS_fchmodat | ||
310 | #ifdef __NR_fchmodat | ||
311 | {"fchmodat", __NR_fchmodat}, | ||
312 | #endif | ||
313 | #endif | ||
314 | #ifdef SYS_fchown | ||
315 | #ifdef __NR_fchown | ||
316 | {"fchown", __NR_fchown}, | ||
317 | #endif | ||
318 | #endif | ||
319 | #ifdef SYS_fchown32 | ||
320 | #ifdef __NR_fchown32 | ||
321 | {"fchown32", __NR_fchown32}, | ||
322 | #endif | ||
323 | #endif | ||
324 | #ifdef SYS_fchownat | ||
325 | #ifdef __NR_fchownat | ||
326 | {"fchownat", __NR_fchownat}, | ||
327 | #endif | ||
328 | #endif | ||
329 | #ifdef SYS_fcntl | ||
330 | #ifdef __NR_fcntl | ||
331 | {"fcntl", __NR_fcntl}, | ||
332 | #endif | ||
333 | #endif | ||
334 | #ifdef SYS_fcntl64 | ||
335 | #ifdef __NR_fcntl64 | ||
336 | {"fcntl64", __NR_fcntl64}, | ||
337 | #endif | ||
338 | #endif | ||
339 | #ifdef SYS_fdatasync | ||
340 | #ifdef __NR_fdatasync | ||
341 | {"fdatasync", __NR_fdatasync}, | ||
342 | #endif | ||
343 | #endif | ||
344 | #ifdef SYS_fgetxattr | ||
345 | #ifdef __NR_fgetxattr | ||
346 | {"fgetxattr", __NR_fgetxattr}, | ||
347 | #endif | ||
348 | #endif | ||
349 | #ifdef SYS_finit_module | ||
350 | #ifdef __NR_finit_module | ||
351 | {"finit_module", __NR_finit_module}, | ||
352 | #endif | ||
353 | #endif | ||
354 | #ifdef SYS_flistxattr | ||
355 | #ifdef __NR_flistxattr | ||
356 | {"flistxattr", __NR_flistxattr}, | ||
357 | #endif | ||
358 | #endif | ||
359 | #ifdef SYS_flock | ||
360 | #ifdef __NR_flock | ||
361 | {"flock", __NR_flock}, | ||
362 | #endif | ||
363 | #endif | ||
364 | #ifdef SYS_fork | ||
365 | #ifdef __NR_fork | ||
366 | {"fork", __NR_fork}, | ||
367 | #endif | ||
368 | #endif | ||
369 | #ifdef SYS_fremovexattr | ||
370 | #ifdef __NR_fremovexattr | ||
371 | {"fremovexattr", __NR_fremovexattr}, | ||
372 | #endif | ||
373 | #endif | ||
374 | #ifdef SYS_fsetxattr | ||
375 | #ifdef __NR_fsetxattr | ||
376 | {"fsetxattr", __NR_fsetxattr}, | ||
377 | #endif | ||
378 | #endif | ||
379 | #ifdef SYS_fstat | ||
380 | #ifdef __NR_fstat | ||
381 | {"fstat", __NR_fstat}, | ||
382 | #endif | ||
383 | #endif | ||
384 | #ifdef SYS_fstat64 | ||
385 | #ifdef __NR_fstat64 | ||
386 | {"fstat64", __NR_fstat64}, | ||
387 | #endif | ||
388 | #endif | ||
389 | #ifdef SYS_fstatat64 | ||
390 | #ifdef __NR_fstatat64 | ||
391 | {"fstatat64", __NR_fstatat64}, | ||
392 | #endif | ||
393 | #endif | ||
394 | #ifdef SYS_fstatfs | ||
395 | #ifdef __NR_fstatfs | ||
396 | {"fstatfs", __NR_fstatfs}, | ||
397 | #endif | ||
398 | #endif | ||
399 | #ifdef SYS_fstatfs64 | ||
400 | #ifdef __NR_fstatfs64 | ||
401 | {"fstatfs64", __NR_fstatfs64}, | ||
402 | #endif | ||
403 | #endif | ||
404 | #ifdef SYS_fsync | ||
405 | #ifdef __NR_fsync | ||
406 | {"fsync", __NR_fsync}, | ||
407 | #endif | ||
408 | #endif | ||
409 | #ifdef SYS_ftime | ||
410 | #ifdef __NR_ftime | ||
411 | {"ftime", __NR_ftime}, | ||
412 | #endif | ||
413 | #endif | ||
414 | #ifdef SYS_ftruncate | ||
415 | #ifdef __NR_ftruncate | ||
416 | {"ftruncate", __NR_ftruncate}, | ||
417 | #endif | ||
418 | #endif | ||
419 | #ifdef SYS_ftruncate64 | ||
420 | #ifdef __NR_ftruncate64 | ||
421 | {"ftruncate64", __NR_ftruncate64}, | ||
422 | #endif | ||
423 | #endif | ||
424 | #ifdef SYS_futex | ||
425 | #ifdef __NR_futex | ||
426 | {"futex", __NR_futex}, | ||
427 | #endif | ||
428 | #endif | ||
429 | #ifdef SYS_futimesat | ||
430 | #ifdef __NR_futimesat | ||
431 | {"futimesat", __NR_futimesat}, | ||
432 | #endif | ||
433 | #endif | ||
434 | #ifdef SYS_get_kernel_syms | ||
435 | #ifdef __NR_get_kernel_syms | ||
436 | {"get_kernel_syms", __NR_get_kernel_syms}, | ||
437 | #endif | ||
438 | #endif | ||
439 | #ifdef SYS_get_mempolicy | ||
440 | #ifdef __NR_get_mempolicy | ||
441 | {"get_mempolicy", __NR_get_mempolicy}, | ||
442 | #endif | ||
443 | #endif | ||
444 | #ifdef SYS_get_robust_list | ||
445 | #ifdef __NR_get_robust_list | ||
446 | {"get_robust_list", __NR_get_robust_list}, | ||
447 | #endif | ||
448 | #endif | ||
449 | #ifdef SYS_get_thread_area | ||
450 | #ifdef __NR_get_thread_area | ||
451 | {"get_thread_area", __NR_get_thread_area}, | ||
452 | #endif | ||
453 | #endif | ||
454 | #ifdef SYS_getcpu | ||
455 | #ifdef __NR_getcpu | ||
456 | {"getcpu", __NR_getcpu}, | ||
457 | #endif | ||
458 | #endif | ||
459 | #ifdef SYS_getcwd | ||
460 | #ifdef __NR_getcwd | ||
461 | {"getcwd", __NR_getcwd}, | ||
462 | #endif | ||
463 | #endif | ||
464 | #ifdef SYS_getdents | ||
465 | #ifdef __NR_getdents | ||
466 | {"getdents", __NR_getdents}, | ||
467 | #endif | ||
468 | #endif | ||
469 | #ifdef SYS_getdents64 | ||
470 | #ifdef __NR_getdents64 | ||
471 | {"getdents64", __NR_getdents64}, | ||
472 | #endif | ||
473 | #endif | ||
474 | #ifdef SYS_getegid | ||
475 | #ifdef __NR_getegid | ||
476 | {"getegid", __NR_getegid}, | ||
477 | #endif | ||
478 | #endif | ||
479 | #ifdef SYS_getegid32 | ||
480 | #ifdef __NR_getegid32 | ||
481 | {"getegid32", __NR_getegid32}, | ||
482 | #endif | ||
483 | #endif | ||
484 | #ifdef SYS_geteuid | ||
485 | #ifdef __NR_geteuid | ||
486 | {"geteuid", __NR_geteuid}, | ||
487 | #endif | ||
488 | #endif | ||
489 | #ifdef SYS_geteuid32 | ||
490 | #ifdef __NR_geteuid32 | ||
491 | {"geteuid32", __NR_geteuid32}, | ||
492 | #endif | ||
493 | #endif | ||
494 | #ifdef SYS_getgid | ||
495 | #ifdef __NR_getgid | ||
496 | {"getgid", __NR_getgid}, | ||
497 | #endif | ||
498 | #endif | ||
499 | #ifdef SYS_getgid32 | ||
500 | #ifdef __NR_getgid32 | ||
501 | {"getgid32", __NR_getgid32}, | ||
502 | #endif | ||
503 | #endif | ||
504 | #ifdef SYS_getgroups | ||
505 | #ifdef __NR_getgroups | ||
506 | {"getgroups", __NR_getgroups}, | ||
507 | #endif | ||
508 | #endif | ||
509 | #ifdef SYS_getgroups32 | ||
510 | #ifdef __NR_getgroups32 | ||
511 | {"getgroups32", __NR_getgroups32}, | ||
512 | #endif | ||
513 | #endif | ||
514 | #ifdef SYS_getitimer | ||
515 | #ifdef __NR_getitimer | ||
516 | {"getitimer", __NR_getitimer}, | ||
517 | #endif | ||
518 | #endif | ||
519 | #ifdef SYS_getpeername | ||
520 | #ifdef __NR_getpeername | ||
521 | {"getpeername", __NR_getpeername}, | ||
522 | #endif | ||
523 | #endif | ||
524 | #ifdef SYS_getpgid | ||
525 | #ifdef __NR_getpgid | ||
526 | {"getpgid", __NR_getpgid}, | ||
527 | #endif | ||
528 | #endif | ||
529 | #ifdef SYS_getpgrp | ||
530 | #ifdef __NR_getpgrp | ||
531 | {"getpgrp", __NR_getpgrp}, | ||
532 | #endif | ||
533 | #endif | ||
534 | #ifdef SYS_getpid | ||
535 | #ifdef __NR_getpid | ||
536 | {"getpid", __NR_getpid}, | ||
537 | #endif | ||
538 | #endif | ||
539 | #ifdef SYS_getpmsg | ||
540 | #ifdef __NR_getpmsg | ||
541 | {"getpmsg", __NR_getpmsg}, | ||
542 | #endif | ||
543 | #endif | ||
544 | #ifdef SYS_getppid | ||
545 | #ifdef __NR_getppid | ||
546 | {"getppid", __NR_getppid}, | ||
547 | #endif | ||
548 | #endif | ||
549 | #ifdef SYS_getpriority | ||
550 | #ifdef __NR_getpriority | ||
551 | {"getpriority", __NR_getpriority}, | ||
552 | #endif | ||
553 | #endif | ||
554 | #ifdef SYS_getrandom | ||
555 | #ifdef __NR_getrandom | ||
556 | {"getrandom", __NR_getrandom}, | ||
557 | #endif | ||
558 | #endif | ||
559 | #ifdef SYS_getresgid | ||
560 | #ifdef __NR_getresgid | ||
561 | {"getresgid", __NR_getresgid}, | ||
562 | #endif | ||
563 | #endif | ||
564 | #ifdef SYS_getresgid32 | ||
565 | #ifdef __NR_getresgid32 | ||
566 | {"getresgid32", __NR_getresgid32}, | ||
567 | #endif | ||
568 | #endif | ||
569 | #ifdef SYS_getresuid | ||
570 | #ifdef __NR_getresuid | ||
571 | {"getresuid", __NR_getresuid}, | ||
572 | #endif | ||
573 | #endif | ||
574 | #ifdef SYS_getresuid32 | ||
575 | #ifdef __NR_getresuid32 | ||
576 | {"getresuid32", __NR_getresuid32}, | ||
577 | #endif | ||
578 | #endif | ||
579 | #ifdef SYS_getrlimit | ||
580 | #ifdef __NR_getrlimit | ||
581 | {"getrlimit", __NR_getrlimit}, | ||
582 | #endif | ||
583 | #endif | ||
584 | #ifdef SYS_getrusage | ||
585 | #ifdef __NR_getrusage | ||
586 | {"getrusage", __NR_getrusage}, | ||
587 | #endif | ||
588 | #endif | ||
589 | #ifdef SYS_getsid | ||
590 | #ifdef __NR_getsid | ||
591 | {"getsid", __NR_getsid}, | ||
592 | #endif | ||
593 | #endif | ||
594 | #ifdef SYS_getsockname | ||
595 | #ifdef __NR_getsockname | ||
596 | {"getsockname", __NR_getsockname}, | ||
597 | #endif | ||
598 | #endif | ||
599 | #ifdef SYS_getsockopt | ||
600 | #ifdef __NR_getsockopt | ||
601 | {"getsockopt", __NR_getsockopt}, | ||
602 | #endif | ||
603 | #endif | ||
604 | #ifdef SYS_gettid | ||
605 | #ifdef __NR_gettid | ||
606 | {"gettid", __NR_gettid}, | ||
607 | #endif | ||
608 | #endif | ||
609 | #ifdef SYS_gettimeofday | ||
610 | #ifdef __NR_gettimeofday | ||
611 | {"gettimeofday", __NR_gettimeofday}, | ||
612 | #endif | ||
613 | #endif | ||
614 | #ifdef SYS_getuid | ||
615 | #ifdef __NR_getuid | ||
616 | {"getuid", __NR_getuid}, | ||
617 | #endif | ||
618 | #endif | ||
619 | #ifdef SYS_getuid32 | ||
620 | #ifdef __NR_getuid32 | ||
621 | {"getuid32", __NR_getuid32}, | ||
622 | #endif | ||
623 | #endif | ||
624 | #ifdef SYS_getxattr | ||
625 | #ifdef __NR_getxattr | ||
626 | {"getxattr", __NR_getxattr}, | ||
627 | #endif | ||
628 | #endif | ||
629 | #ifdef SYS_gtty | ||
630 | #ifdef __NR_gtty | ||
631 | {"gtty", __NR_gtty}, | ||
632 | #endif | ||
633 | #endif | ||
634 | #ifdef SYS_idle | ||
635 | #ifdef __NR_idle | ||
636 | {"idle", __NR_idle}, | ||
637 | #endif | ||
638 | #endif | ||
639 | #ifdef SYS_init_module | ||
640 | #ifdef __NR_init_module | ||
641 | {"init_module", __NR_init_module}, | ||
642 | #endif | ||
643 | #endif | ||
644 | #ifdef SYS_inotify_add_watch | ||
645 | #ifdef __NR_inotify_add_watch | ||
646 | {"inotify_add_watch", __NR_inotify_add_watch}, | ||
647 | #endif | ||
648 | #endif | ||
649 | #ifdef SYS_inotify_init | ||
650 | #ifdef __NR_inotify_init | ||
651 | {"inotify_init", __NR_inotify_init}, | ||
652 | #endif | ||
653 | #endif | ||
654 | #ifdef SYS_inotify_init1 | ||
655 | #ifdef __NR_inotify_init1 | ||
656 | {"inotify_init1", __NR_inotify_init1}, | ||
657 | #endif | ||
658 | #endif | ||
659 | #ifdef SYS_inotify_rm_watch | ||
660 | #ifdef __NR_inotify_rm_watch | ||
661 | {"inotify_rm_watch", __NR_inotify_rm_watch}, | ||
662 | #endif | ||
663 | #endif | ||
664 | #ifdef SYS_io_cancel | ||
665 | #ifdef __NR_io_cancel | ||
666 | {"io_cancel", __NR_io_cancel}, | ||
667 | #endif | ||
668 | #endif | ||
669 | #ifdef SYS_io_destroy | ||
670 | #ifdef __NR_io_destroy | ||
671 | {"io_destroy", __NR_io_destroy}, | ||
672 | #endif | ||
673 | #endif | ||
674 | #ifdef SYS_io_getevents | ||
675 | #ifdef __NR_io_getevents | ||
676 | {"io_getevents", __NR_io_getevents}, | ||
677 | #endif | ||
678 | #endif | ||
679 | #ifdef SYS_io_setup | ||
680 | #ifdef __NR_io_setup | ||
681 | {"io_setup", __NR_io_setup}, | ||
682 | #endif | ||
683 | #endif | ||
684 | #ifdef SYS_io_submit | ||
685 | #ifdef __NR_io_submit | ||
686 | {"io_submit", __NR_io_submit}, | ||
687 | #endif | ||
688 | #endif | ||
689 | #ifdef SYS_ioctl | ||
690 | #ifdef __NR_ioctl | ||
691 | {"ioctl", __NR_ioctl}, | ||
692 | #endif | ||
693 | #endif | ||
694 | #ifdef SYS_ioperm | ||
695 | #ifdef __NR_ioperm | ||
696 | {"ioperm", __NR_ioperm}, | ||
697 | #endif | ||
698 | #endif | ||
699 | #ifdef SYS_iopl | ||
700 | #ifdef __NR_iopl | ||
701 | {"iopl", __NR_iopl}, | ||
702 | #endif | ||
703 | #endif | ||
704 | #ifdef SYS_ioprio_get | ||
705 | #ifdef __NR_ioprio_get | ||
706 | {"ioprio_get", __NR_ioprio_get}, | ||
707 | #endif | ||
708 | #endif | ||
709 | #ifdef SYS_ioprio_set | ||
710 | #ifdef __NR_ioprio_set | ||
711 | {"ioprio_set", __NR_ioprio_set}, | ||
712 | #endif | ||
713 | #endif | ||
714 | #ifdef SYS_ipc | ||
715 | #ifdef __NR_ipc | ||
716 | {"ipc", __NR_ipc}, | ||
717 | #endif | ||
718 | #endif | ||
719 | #ifdef SYS_kcmp | ||
720 | #ifdef __NR_kcmp | ||
721 | {"kcmp", __NR_kcmp}, | ||
722 | #endif | ||
723 | #endif | ||
724 | #ifdef SYS_kexec_load | ||
725 | #ifdef __NR_kexec_load | ||
726 | {"kexec_load", __NR_kexec_load}, | ||
727 | #endif | ||
728 | #endif | ||
729 | #ifdef SYS_keyctl | ||
730 | #ifdef __NR_keyctl | ||
731 | {"keyctl", __NR_keyctl}, | ||
732 | #endif | ||
733 | #endif | ||
734 | #ifdef SYS_kill | ||
735 | #ifdef __NR_kill | ||
736 | {"kill", __NR_kill}, | ||
737 | #endif | ||
738 | #endif | ||
739 | #ifdef SYS_lchown | ||
740 | #ifdef __NR_lchown | ||
741 | {"lchown", __NR_lchown}, | ||
742 | #endif | ||
743 | #endif | ||
744 | #ifdef SYS_lchown32 | ||
745 | #ifdef __NR_lchown32 | ||
746 | {"lchown32", __NR_lchown32}, | ||
747 | #endif | ||
748 | #endif | ||
749 | #ifdef SYS_lgetxattr | ||
750 | #ifdef __NR_lgetxattr | ||
751 | {"lgetxattr", __NR_lgetxattr}, | ||
752 | #endif | ||
753 | #endif | ||
754 | #ifdef SYS_link | ||
755 | #ifdef __NR_link | ||
756 | {"link", __NR_link}, | ||
757 | #endif | ||
758 | #endif | ||
759 | #ifdef SYS_linkat | ||
760 | #ifdef __NR_linkat | ||
761 | {"linkat", __NR_linkat}, | ||
762 | #endif | ||
763 | #endif | ||
764 | #ifdef SYS_listen | ||
765 | #ifdef __NR_listen | ||
766 | {"listen", __NR_listen}, | ||
767 | #endif | ||
768 | #endif | ||
769 | #ifdef SYS_listxattr | ||
770 | #ifdef __NR_listxattr | ||
771 | {"listxattr", __NR_listxattr}, | ||
772 | #endif | ||
773 | #endif | ||
774 | #ifdef SYS_llistxattr | ||
775 | #ifdef __NR_llistxattr | ||
776 | {"llistxattr", __NR_llistxattr}, | ||
777 | #endif | ||
778 | #endif | ||
779 | #ifdef SYS_lock | ||
780 | #ifdef __NR_lock | ||
781 | {"lock", __NR_lock}, | ||
782 | #endif | ||
783 | #endif | ||
784 | #ifdef SYS_lookup_dcookie | ||
785 | #ifdef __NR_lookup_dcookie | ||
786 | {"lookup_dcookie", __NR_lookup_dcookie}, | ||
787 | #endif | ||
788 | #endif | ||
789 | #ifdef SYS_lremovexattr | ||
790 | #ifdef __NR_lremovexattr | ||
791 | {"lremovexattr", __NR_lremovexattr}, | ||
792 | #endif | ||
793 | #endif | ||
794 | #ifdef SYS_lseek | ||
795 | #ifdef __NR_lseek | ||
796 | {"lseek", __NR_lseek}, | ||
797 | #endif | ||
798 | #endif | ||
799 | #ifdef SYS_lsetxattr | ||
800 | #ifdef __NR_lsetxattr | ||
801 | {"lsetxattr", __NR_lsetxattr}, | ||
802 | #endif | ||
803 | #endif | ||
804 | #ifdef SYS_lstat | ||
805 | #ifdef __NR_lstat | ||
806 | {"lstat", __NR_lstat}, | ||
807 | #endif | ||
808 | #endif | ||
809 | #ifdef SYS_lstat64 | ||
810 | #ifdef __NR_lstat64 | ||
811 | {"lstat64", __NR_lstat64}, | ||
812 | #endif | ||
813 | #endif | ||
814 | #ifdef SYS_madvise | ||
815 | #ifdef __NR_madvise | ||
816 | {"madvise", __NR_madvise}, | ||
817 | #endif | ||
818 | #endif | ||
819 | #ifdef SYS_mbind | ||
820 | #ifdef __NR_mbind | ||
821 | {"mbind", __NR_mbind}, | ||
822 | #endif | ||
823 | #endif | ||
824 | #ifdef SYS_membarrier | ||
825 | #ifdef __NR_membarrier | ||
826 | {"membarrier", __NR_membarrier}, | ||
827 | #endif | ||
828 | #endif | ||
829 | #ifdef SYS_memfd_create | ||
830 | #ifdef __NR_memfd_create | ||
831 | {"memfd_create", __NR_memfd_create}, | ||
832 | #endif | ||
833 | #endif | ||
834 | #ifdef SYS_migrate_pages | ||
835 | #ifdef __NR_migrate_pages | ||
836 | {"migrate_pages", __NR_migrate_pages}, | ||
837 | #endif | ||
838 | #endif | ||
839 | #ifdef SYS_mincore | ||
840 | #ifdef __NR_mincore | ||
841 | {"mincore", __NR_mincore}, | ||
842 | #endif | ||
843 | #endif | ||
844 | #ifdef SYS_mkdir | ||
845 | #ifdef __NR_mkdir | ||
846 | {"mkdir", __NR_mkdir}, | ||
847 | #endif | ||
848 | #endif | ||
849 | #ifdef SYS_mkdirat | ||
850 | #ifdef __NR_mkdirat | ||
851 | {"mkdirat", __NR_mkdirat}, | ||
852 | #endif | ||
853 | #endif | ||
854 | #ifdef SYS_mknod | ||
855 | #ifdef __NR_mknod | ||
856 | {"mknod", __NR_mknod}, | ||
857 | #endif | ||
858 | #endif | ||
859 | #ifdef SYS_mknodat | ||
860 | #ifdef __NR_mknodat | ||
861 | {"mknodat", __NR_mknodat}, | ||
862 | #endif | ||
863 | #endif | ||
864 | #ifdef SYS_mlock | ||
865 | #ifdef __NR_mlock | ||
866 | {"mlock", __NR_mlock}, | ||
867 | #endif | ||
868 | #endif | ||
869 | #ifdef SYS_mlock2 | ||
870 | #ifdef __NR_mlock2 | ||
871 | {"mlock2", __NR_mlock2}, | ||
872 | #endif | ||
873 | #endif | ||
874 | #ifdef SYS_mlockall | ||
875 | #ifdef __NR_mlockall | ||
876 | {"mlockall", __NR_mlockall}, | ||
877 | #endif | ||
878 | #endif | ||
879 | #ifdef SYS_mmap | ||
880 | #ifdef __NR_mmap | ||
881 | {"mmap", __NR_mmap}, | ||
882 | #endif | ||
883 | #endif | ||
884 | #ifdef SYS_mmap2 | ||
885 | #ifdef __NR_mmap2 | ||
886 | {"mmap2", __NR_mmap2}, | ||
887 | #endif | ||
888 | #endif | ||
889 | #ifdef SYS_modify_ldt | ||
890 | #ifdef __NR_modify_ldt | ||
891 | {"modify_ldt", __NR_modify_ldt}, | ||
892 | #endif | ||
893 | #endif | ||
894 | #ifdef SYS_mount | ||
895 | #ifdef __NR_mount | ||
896 | {"mount", __NR_mount}, | ||
897 | #endif | ||
898 | #endif | ||
899 | #ifdef SYS_move_pages | ||
900 | #ifdef __NR_move_pages | ||
901 | {"move_pages", __NR_move_pages}, | ||
902 | #endif | ||
903 | #endif | ||
904 | #ifdef SYS_mprotect | ||
905 | #ifdef __NR_mprotect | ||
906 | {"mprotect", __NR_mprotect}, | ||
907 | #endif | ||
908 | #endif | ||
909 | #ifdef SYS_mpx | ||
910 | #ifdef __NR_mpx | ||
911 | {"mpx", __NR_mpx}, | ||
912 | #endif | ||
913 | #endif | ||
914 | #ifdef SYS_mq_getsetattr | ||
915 | #ifdef __NR_mq_getsetattr | ||
916 | {"mq_getsetattr", __NR_mq_getsetattr}, | ||
917 | #endif | ||
918 | #endif | ||
919 | #ifdef SYS_mq_notify | ||
920 | #ifdef __NR_mq_notify | ||
921 | {"mq_notify", __NR_mq_notify}, | ||
922 | #endif | ||
923 | #endif | ||
924 | #ifdef SYS_mq_open | ||
925 | #ifdef __NR_mq_open | ||
926 | {"mq_open", __NR_mq_open}, | ||
927 | #endif | ||
928 | #endif | ||
929 | #ifdef SYS_mq_timedreceive | ||
930 | #ifdef __NR_mq_timedreceive | ||
931 | {"mq_timedreceive", __NR_mq_timedreceive}, | ||
932 | #endif | ||
933 | #endif | ||
934 | #ifdef SYS_mq_timedsend | ||
935 | #ifdef __NR_mq_timedsend | ||
936 | {"mq_timedsend", __NR_mq_timedsend}, | ||
937 | #endif | ||
938 | #endif | ||
939 | #ifdef SYS_mq_unlink | ||
940 | #ifdef __NR_mq_unlink | ||
941 | {"mq_unlink", __NR_mq_unlink}, | ||
942 | #endif | ||
943 | #endif | ||
944 | #ifdef SYS_mremap | ||
945 | #ifdef __NR_mremap | ||
946 | {"mremap", __NR_mremap}, | ||
947 | #endif | ||
948 | #endif | ||
949 | #ifdef SYS_msync | ||
950 | #ifdef __NR_msync | ||
951 | {"msync", __NR_msync}, | ||
952 | #endif | ||
953 | #endif | ||
954 | #ifdef SYS_munlock | ||
955 | #ifdef __NR_munlock | ||
956 | {"munlock", __NR_munlock}, | ||
957 | #endif | ||
958 | #endif | ||
959 | #ifdef SYS_munlockall | ||
960 | #ifdef __NR_munlockall | ||
961 | {"munlockall", __NR_munlockall}, | ||
962 | #endif | ||
963 | #endif | ||
964 | #ifdef SYS_munmap | ||
965 | #ifdef __NR_munmap | ||
966 | {"munmap", __NR_munmap}, | ||
967 | #endif | ||
968 | #endif | ||
969 | #ifdef SYS_name_to_handle_at | ||
970 | #ifdef __NR_name_to_handle_at | ||
971 | {"name_to_handle_at", __NR_name_to_handle_at}, | ||
972 | #endif | ||
973 | #endif | ||
974 | #ifdef SYS_nanosleep | ||
975 | #ifdef __NR_nanosleep | ||
976 | {"nanosleep", __NR_nanosleep}, | ||
977 | #endif | ||
978 | #endif | ||
979 | #ifdef SYS_nfsservctl | ||
980 | #ifdef __NR_nfsservctl | ||
981 | {"nfsservctl", __NR_nfsservctl}, | ||
982 | #endif | ||
983 | #endif | ||
984 | #ifdef SYS_nice | ||
985 | #ifdef __NR_nice | ||
986 | {"nice", __NR_nice}, | ||
987 | #endif | ||
988 | #endif | ||
989 | #ifdef SYS_oldfstat | ||
990 | #ifdef __NR_oldfstat | ||
991 | {"oldfstat", __NR_oldfstat}, | ||
992 | #endif | ||
993 | #endif | ||
994 | #ifdef SYS_oldlstat | ||
995 | #ifdef __NR_oldlstat | ||
996 | {"oldlstat", __NR_oldlstat}, | ||
997 | #endif | ||
998 | #endif | ||
999 | #ifdef SYS_oldolduname | ||
1000 | #ifdef __NR_oldolduname | ||
1001 | {"oldolduname", __NR_oldolduname}, | ||
1002 | #endif | ||
1003 | #endif | ||
1004 | #ifdef SYS_oldstat | ||
1005 | #ifdef __NR_oldstat | ||
1006 | {"oldstat", __NR_oldstat}, | ||
1007 | #endif | ||
1008 | #endif | ||
1009 | #ifdef SYS_olduname | ||
1010 | #ifdef __NR_olduname | ||
1011 | {"olduname", __NR_olduname}, | ||
1012 | #endif | ||
1013 | #endif | ||
1014 | #ifdef SYS_open | ||
1015 | #ifdef __NR_open | ||
1016 | {"open", __NR_open}, | ||
1017 | #endif | ||
1018 | #endif | ||
1019 | #ifdef SYS_open_by_handle_at | ||
1020 | #ifdef __NR_open_by_handle_at | ||
1021 | {"open_by_handle_at", __NR_open_by_handle_at}, | ||
1022 | #endif | ||
1023 | #endif | ||
1024 | #ifdef SYS_openat | ||
1025 | #ifdef __NR_openat | ||
1026 | {"openat", __NR_openat}, | ||
1027 | #endif | ||
1028 | #endif | ||
1029 | #ifdef SYS_pause | ||
1030 | #ifdef __NR_pause | ||
1031 | {"pause", __NR_pause}, | ||
1032 | #endif | ||
1033 | #endif | ||
1034 | #ifdef SYS_perf_event_open | ||
1035 | #ifdef __NR_perf_event_open | ||
1036 | {"perf_event_open", __NR_perf_event_open}, | ||
1037 | #endif | ||
1038 | #endif | ||
1039 | #ifdef SYS_personality | ||
1040 | #ifdef __NR_personality | ||
1041 | {"personality", __NR_personality}, | ||
1042 | #endif | ||
1043 | #endif | ||
1044 | #ifdef SYS_pipe | ||
1045 | #ifdef __NR_pipe | ||
1046 | {"pipe", __NR_pipe}, | ||
1047 | #endif | ||
1048 | #endif | ||
1049 | #ifdef SYS_pipe2 | ||
1050 | #ifdef __NR_pipe2 | ||
1051 | {"pipe2", __NR_pipe2}, | ||
1052 | #endif | ||
1053 | #endif | ||
1054 | #ifdef SYS_pivot_root | ||
1055 | #ifdef __NR_pivot_root | ||
1056 | {"pivot_root", __NR_pivot_root}, | ||
1057 | #endif | ||
1058 | #endif | ||
1059 | #ifdef SYS_pkey_alloc | ||
1060 | #ifdef __NR_pkey_alloc | ||
1061 | {"pkey_alloc", __NR_pkey_alloc}, | ||
1062 | #endif | ||
1063 | #endif | ||
1064 | #ifdef SYS_pkey_free | ||
1065 | #ifdef __NR_pkey_free | ||
1066 | {"pkey_free", __NR_pkey_free}, | ||
1067 | #endif | ||
1068 | #endif | ||
1069 | #ifdef SYS_pkey_mprotect | ||
1070 | #ifdef __NR_pkey_mprotect | ||
1071 | {"pkey_mprotect", __NR_pkey_mprotect}, | ||
1072 | #endif | ||
1073 | #endif | ||
1074 | #ifdef SYS_poll | ||
1075 | #ifdef __NR_poll | ||
1076 | {"poll", __NR_poll}, | ||
1077 | #endif | ||
1078 | #endif | ||
1079 | #ifdef SYS_ppoll | ||
1080 | #ifdef __NR_ppoll | ||
1081 | {"ppoll", __NR_ppoll}, | ||
1082 | #endif | ||
1083 | #endif | ||
1084 | #ifdef SYS_prctl | ||
1085 | #ifdef __NR_prctl | ||
1086 | {"prctl", __NR_prctl}, | ||
1087 | #endif | ||
1088 | #endif | ||
1089 | #ifdef SYS_pread64 | ||
1090 | #ifdef __NR_pread64 | ||
1091 | {"pread64", __NR_pread64}, | ||
1092 | #endif | ||
1093 | #endif | ||
1094 | #ifdef SYS_preadv | ||
1095 | #ifdef __NR_preadv | ||
1096 | {"preadv", __NR_preadv}, | ||
1097 | #endif | ||
1098 | #endif | ||
1099 | #ifdef SYS_preadv2 | ||
1100 | #ifdef __NR_preadv2 | ||
1101 | {"preadv2", __NR_preadv2}, | ||
1102 | #endif | ||
1103 | #endif | ||
1104 | #ifdef SYS_prlimit64 | ||
1105 | #ifdef __NR_prlimit64 | ||
1106 | {"prlimit64", __NR_prlimit64}, | ||
1107 | #endif | ||
1108 | #endif | ||
1109 | #ifdef SYS_process_vm_readv | ||
1110 | #ifdef __NR_process_vm_readv | ||
1111 | {"process_vm_readv", __NR_process_vm_readv}, | ||
1112 | #endif | ||
1113 | #endif | ||
1114 | #ifdef SYS_process_vm_writev | ||
1115 | #ifdef __NR_process_vm_writev | ||
1116 | {"process_vm_writev", __NR_process_vm_writev}, | ||
1117 | #endif | ||
1118 | #endif | ||
1119 | #ifdef SYS_prof | ||
1120 | #ifdef __NR_prof | ||
1121 | {"prof", __NR_prof}, | ||
1122 | #endif | ||
1123 | #endif | ||
1124 | #ifdef SYS_profil | ||
1125 | #ifdef __NR_profil | ||
1126 | {"profil", __NR_profil}, | ||
1127 | #endif | ||
1128 | #endif | ||
1129 | #ifdef SYS_pselect6 | ||
1130 | #ifdef __NR_pselect6 | ||
1131 | {"pselect6", __NR_pselect6}, | ||
1132 | #endif | ||
1133 | #endif | ||
1134 | #ifdef SYS_ptrace | ||
1135 | #ifdef __NR_ptrace | ||
1136 | {"ptrace", __NR_ptrace}, | ||
1137 | #endif | ||
1138 | #endif | ||
1139 | #ifdef SYS_putpmsg | ||
1140 | #ifdef __NR_putpmsg | ||
1141 | {"putpmsg", __NR_putpmsg}, | ||
1142 | #endif | ||
1143 | #endif | ||
1144 | #ifdef SYS_pwrite64 | ||
1145 | #ifdef __NR_pwrite64 | ||
1146 | {"pwrite64", __NR_pwrite64}, | ||
1147 | #endif | ||
1148 | #endif | ||
1149 | #ifdef SYS_pwritev | ||
1150 | #ifdef __NR_pwritev | ||
1151 | {"pwritev", __NR_pwritev}, | ||
1152 | #endif | ||
1153 | #endif | ||
1154 | #ifdef SYS_pwritev2 | ||
1155 | #ifdef __NR_pwritev2 | ||
1156 | {"pwritev2", __NR_pwritev2}, | ||
1157 | #endif | ||
1158 | #endif | ||
1159 | #ifdef SYS_query_module | ||
1160 | #ifdef __NR_query_module | ||
1161 | {"query_module", __NR_query_module}, | ||
1162 | #endif | ||
1163 | #endif | ||
1164 | #ifdef SYS_quotactl | ||
1165 | #ifdef __NR_quotactl | ||
1166 | {"quotactl", __NR_quotactl}, | ||
1167 | #endif | ||
1168 | #endif | ||
1169 | #ifdef SYS_read | ||
1170 | #ifdef __NR_read | ||
1171 | {"read", __NR_read}, | ||
1172 | #endif | ||
1173 | #endif | ||
1174 | #ifdef SYS_readahead | ||
1175 | #ifdef __NR_readahead | ||
1176 | {"readahead", __NR_readahead}, | ||
1177 | #endif | ||
1178 | #endif | ||
1179 | #ifdef SYS_readdir | ||
1180 | #ifdef __NR_readdir | ||
1181 | {"readdir", __NR_readdir}, | ||
1182 | #endif | ||
1183 | #endif | ||
1184 | #ifdef SYS_readlink | ||
1185 | #ifdef __NR_readlink | ||
1186 | {"readlink", __NR_readlink}, | ||
1187 | #endif | ||
1188 | #endif | ||
1189 | #ifdef SYS_readlinkat | ||
1190 | #ifdef __NR_readlinkat | ||
1191 | {"readlinkat", __NR_readlinkat}, | ||
1192 | #endif | ||
1193 | #endif | ||
1194 | #ifdef SYS_readv | ||
1195 | #ifdef __NR_readv | ||
1196 | {"readv", __NR_readv}, | ||
1197 | #endif | ||
1198 | #endif | ||
1199 | #ifdef SYS_reboot | ||
1200 | #ifdef __NR_reboot | ||
1201 | {"reboot", __NR_reboot}, | ||
1202 | #endif | ||
1203 | #endif | ||
1204 | #ifdef SYS_recvfrom | ||
1205 | #ifdef __NR_recvfrom | ||
1206 | {"recvfrom", __NR_recvfrom}, | ||
1207 | #endif | ||
1208 | #endif | ||
1209 | #ifdef SYS_recvmmsg | ||
1210 | #ifdef __NR_recvmmsg | ||
1211 | {"recvmmsg", __NR_recvmmsg}, | ||
1212 | #endif | ||
1213 | #endif | ||
1214 | #ifdef SYS_recvmsg | ||
1215 | #ifdef __NR_recvmsg | ||
1216 | {"recvmsg", __NR_recvmsg}, | ||
1217 | #endif | ||
1218 | #endif | ||
1219 | #ifdef SYS_remap_file_pages | ||
1220 | #ifdef __NR_remap_file_pages | ||
1221 | {"remap_file_pages", __NR_remap_file_pages}, | ||
1222 | #endif | ||
1223 | #endif | ||
1224 | #ifdef SYS_removexattr | ||
1225 | #ifdef __NR_removexattr | ||
1226 | {"removexattr", __NR_removexattr}, | ||
1227 | #endif | ||
1228 | #endif | ||
1229 | #ifdef SYS_rename | ||
1230 | #ifdef __NR_rename | ||
1231 | {"rename", __NR_rename}, | ||
1232 | #endif | ||
1233 | #endif | ||
1234 | #ifdef SYS_renameat | ||
1235 | #ifdef __NR_renameat | ||
1236 | {"renameat", __NR_renameat}, | ||
1237 | #endif | ||
1238 | #endif | ||
1239 | #ifdef SYS_renameat2 | ||
1240 | #ifdef __NR_renameat2 | ||
1241 | {"renameat2", __NR_renameat2}, | ||
1242 | #endif | ||
1243 | #endif | ||
1244 | #ifdef SYS_request_key | ||
1245 | #ifdef __NR_request_key | ||
1246 | {"request_key", __NR_request_key}, | ||
1247 | #endif | ||
1248 | #endif | ||
1249 | #ifdef SYS_restart_syscall | ||
1250 | #ifdef __NR_restart_syscall | ||
1251 | {"restart_syscall", __NR_restart_syscall}, | ||
1252 | #endif | ||
1253 | #endif | ||
1254 | #ifdef SYS_rmdir | ||
1255 | #ifdef __NR_rmdir | ||
1256 | {"rmdir", __NR_rmdir}, | ||
1257 | #endif | ||
1258 | #endif | ||
1259 | #ifdef SYS_rt_sigaction | ||
1260 | #ifdef __NR_rt_sigaction | ||
1261 | {"rt_sigaction", __NR_rt_sigaction}, | ||
1262 | #endif | ||
1263 | #endif | ||
1264 | #ifdef SYS_rt_sigpending | ||
1265 | #ifdef __NR_rt_sigpending | ||
1266 | {"rt_sigpending", __NR_rt_sigpending}, | ||
1267 | #endif | ||
1268 | #endif | ||
1269 | #ifdef SYS_rt_sigprocmask | ||
1270 | #ifdef __NR_rt_sigprocmask | ||
1271 | {"rt_sigprocmask", __NR_rt_sigprocmask}, | ||
1272 | #endif | ||
1273 | #endif | ||
1274 | #ifdef SYS_rt_sigqueueinfo | ||
1275 | #ifdef __NR_rt_sigqueueinfo | ||
1276 | {"rt_sigqueueinfo", __NR_rt_sigqueueinfo}, | ||
1277 | #endif | ||
1278 | #endif | ||
1279 | #ifdef SYS_rt_sigreturn | ||
1280 | #ifdef __NR_rt_sigreturn | ||
1281 | {"rt_sigreturn", __NR_rt_sigreturn}, | ||
1282 | #endif | ||
1283 | #endif | ||
1284 | #ifdef SYS_rt_sigsuspend | ||
1285 | #ifdef __NR_rt_sigsuspend | ||
1286 | {"rt_sigsuspend", __NR_rt_sigsuspend}, | ||
1287 | #endif | ||
1288 | #endif | ||
1289 | #ifdef SYS_rt_sigtimedwait | ||
1290 | #ifdef __NR_rt_sigtimedwait | ||
1291 | {"rt_sigtimedwait", __NR_rt_sigtimedwait}, | ||
1292 | #endif | ||
1293 | #endif | ||
1294 | #ifdef SYS_rt_tgsigqueueinfo | ||
1295 | #ifdef __NR_rt_tgsigqueueinfo | ||
1296 | {"rt_tgsigqueueinfo", __NR_rt_tgsigqueueinfo}, | ||
1297 | #endif | ||
1298 | #endif | ||
1299 | #ifdef SYS_sched_get_priority_max | ||
1300 | #ifdef __NR_sched_get_priority_max | ||
1301 | {"sched_get_priority_max", __NR_sched_get_priority_max}, | ||
1302 | #endif | ||
1303 | #endif | ||
1304 | #ifdef SYS_sched_get_priority_min | ||
1305 | #ifdef __NR_sched_get_priority_min | ||
1306 | {"sched_get_priority_min", __NR_sched_get_priority_min}, | ||
1307 | #endif | ||
1308 | #endif | ||
1309 | #ifdef SYS_sched_getaffinity | ||
1310 | #ifdef __NR_sched_getaffinity | ||
1311 | {"sched_getaffinity", __NR_sched_getaffinity}, | ||
1312 | #endif | ||
1313 | #endif | ||
1314 | #ifdef SYS_sched_getattr | ||
1315 | #ifdef __NR_sched_getattr | ||
1316 | {"sched_getattr", __NR_sched_getattr}, | ||
1317 | #endif | ||
1318 | #endif | ||
1319 | #ifdef SYS_sched_getparam | ||
1320 | #ifdef __NR_sched_getparam | ||
1321 | {"sched_getparam", __NR_sched_getparam}, | ||
1322 | #endif | ||
1323 | #endif | ||
1324 | #ifdef SYS_sched_getscheduler | ||
1325 | #ifdef __NR_sched_getscheduler | ||
1326 | {"sched_getscheduler", __NR_sched_getscheduler}, | ||
1327 | #endif | ||
1328 | #endif | ||
1329 | #ifdef SYS_sched_rr_get_interval | ||
1330 | #ifdef __NR_sched_rr_get_interval | ||
1331 | {"sched_rr_get_interval", __NR_sched_rr_get_interval}, | ||
1332 | #endif | ||
1333 | #endif | ||
1334 | #ifdef SYS_sched_setaffinity | ||
1335 | #ifdef __NR_sched_setaffinity | ||
1336 | {"sched_setaffinity", __NR_sched_setaffinity}, | ||
1337 | #endif | ||
1338 | #endif | ||
1339 | #ifdef SYS_sched_setattr | ||
1340 | #ifdef __NR_sched_setattr | ||
1341 | {"sched_setattr", __NR_sched_setattr}, | ||
1342 | #endif | ||
1343 | #endif | ||
1344 | #ifdef SYS_sched_setparam | ||
1345 | #ifdef __NR_sched_setparam | ||
1346 | {"sched_setparam", __NR_sched_setparam}, | ||
1347 | #endif | ||
1348 | #endif | ||
1349 | #ifdef SYS_sched_setscheduler | ||
1350 | #ifdef __NR_sched_setscheduler | ||
1351 | {"sched_setscheduler", __NR_sched_setscheduler}, | ||
1352 | #endif | ||
1353 | #endif | ||
1354 | #ifdef SYS_sched_yield | ||
1355 | #ifdef __NR_sched_yield | ||
1356 | {"sched_yield", __NR_sched_yield}, | ||
1357 | #endif | ||
1358 | #endif | ||
1359 | #ifdef SYS_seccomp | ||
1360 | #ifdef __NR_seccomp | ||
1361 | {"seccomp", __NR_seccomp}, | ||
1362 | #endif | ||
1363 | #endif | ||
1364 | #ifdef SYS_select | ||
1365 | #ifdef __NR_select | ||
1366 | {"select", __NR_select}, | ||
1367 | #endif | ||
1368 | #endif | ||
1369 | #ifdef SYS_sendfile | ||
1370 | #ifdef __NR_sendfile | ||
1371 | {"sendfile", __NR_sendfile}, | ||
1372 | #endif | ||
1373 | #endif | ||
1374 | #ifdef SYS_sendfile64 | ||
1375 | #ifdef __NR_sendfile64 | ||
1376 | {"sendfile64", __NR_sendfile64}, | ||
1377 | #endif | ||
1378 | #endif | ||
1379 | #ifdef SYS_sendmmsg | ||
1380 | #ifdef __NR_sendmmsg | ||
1381 | {"sendmmsg", __NR_sendmmsg}, | ||
1382 | #endif | ||
1383 | #endif | ||
1384 | #ifdef SYS_sendmsg | ||
1385 | #ifdef __NR_sendmsg | ||
1386 | {"sendmsg", __NR_sendmsg}, | ||
1387 | #endif | ||
1388 | #endif | ||
1389 | #ifdef SYS_sendto | ||
1390 | #ifdef __NR_sendto | ||
1391 | {"sendto", __NR_sendto}, | ||
1392 | #endif | ||
1393 | #endif | ||
1394 | #ifdef SYS_set_mempolicy | ||
1395 | #ifdef __NR_set_mempolicy | ||
1396 | {"set_mempolicy", __NR_set_mempolicy}, | ||
1397 | #endif | ||
1398 | #endif | ||
1399 | #ifdef SYS_set_robust_list | ||
1400 | #ifdef __NR_set_robust_list | ||
1401 | {"set_robust_list", __NR_set_robust_list}, | ||
1402 | #endif | ||
1403 | #endif | ||
1404 | #ifdef SYS_set_thread_area | ||
1405 | #ifdef __NR_set_thread_area | ||
1406 | {"set_thread_area", __NR_set_thread_area}, | ||
1407 | #endif | ||
1408 | #endif | ||
1409 | #ifdef SYS_set_tid_address | ||
1410 | #ifdef __NR_set_tid_address | ||
1411 | {"set_tid_address", __NR_set_tid_address}, | ||
1412 | #endif | ||
1413 | #endif | ||
1414 | #ifdef SYS_setdomainname | ||
1415 | #ifdef __NR_setdomainname | ||
1416 | {"setdomainname", __NR_setdomainname}, | ||
1417 | #endif | ||
1418 | #endif | ||
1419 | #ifdef SYS_setfsgid | ||
1420 | #ifdef __NR_setfsgid | ||
1421 | {"setfsgid", __NR_setfsgid}, | ||
1422 | #endif | ||
1423 | #endif | ||
1424 | #ifdef SYS_setfsgid32 | ||
1425 | #ifdef __NR_setfsgid32 | ||
1426 | {"setfsgid32", __NR_setfsgid32}, | ||
1427 | #endif | ||
1428 | #endif | ||
1429 | #ifdef SYS_setfsuid | ||
1430 | #ifdef __NR_setfsuid | ||
1431 | {"setfsuid", __NR_setfsuid}, | ||
1432 | #endif | ||
1433 | #endif | ||
1434 | #ifdef SYS_setfsuid32 | ||
1435 | #ifdef __NR_setfsuid32 | ||
1436 | {"setfsuid32", __NR_setfsuid32}, | ||
1437 | #endif | ||
1438 | #endif | ||
1439 | #ifdef SYS_setgid | ||
1440 | #ifdef __NR_setgid | ||
1441 | {"setgid", __NR_setgid}, | ||
1442 | #endif | ||
1443 | #endif | ||
1444 | #ifdef SYS_setgid32 | ||
1445 | #ifdef __NR_setgid32 | ||
1446 | {"setgid32", __NR_setgid32}, | ||
1447 | #endif | ||
1448 | #endif | ||
1449 | #ifdef SYS_setgroups | ||
1450 | #ifdef __NR_setgroups | ||
1451 | {"setgroups", __NR_setgroups}, | ||
1452 | #endif | ||
1453 | #endif | ||
1454 | #ifdef SYS_setgroups32 | ||
1455 | #ifdef __NR_setgroups32 | ||
1456 | {"setgroups32", __NR_setgroups32}, | ||
1457 | #endif | ||
1458 | #endif | ||
1459 | #ifdef SYS_sethostname | ||
1460 | #ifdef __NR_sethostname | ||
1461 | {"sethostname", __NR_sethostname}, | ||
1462 | #endif | ||
1463 | #endif | ||
1464 | #ifdef SYS_setitimer | ||
1465 | #ifdef __NR_setitimer | ||
1466 | {"setitimer", __NR_setitimer}, | ||
1467 | #endif | ||
1468 | #endif | ||
1469 | #ifdef SYS_setns | ||
1470 | #ifdef __NR_setns | ||
1471 | {"setns", __NR_setns}, | ||
1472 | #endif | ||
1473 | #endif | ||
1474 | #ifdef SYS_setpgid | ||
1475 | #ifdef __NR_setpgid | ||
1476 | {"setpgid", __NR_setpgid}, | ||
1477 | #endif | ||
1478 | #endif | ||
1479 | #ifdef SYS_setpriority | ||
1480 | #ifdef __NR_setpriority | ||
1481 | {"setpriority", __NR_setpriority}, | ||
1482 | #endif | ||
1483 | #endif | ||
1484 | #ifdef SYS_setregid | ||
1485 | #ifdef __NR_setregid | ||
1486 | {"setregid", __NR_setregid}, | ||
1487 | #endif | ||
1488 | #endif | ||
1489 | #ifdef SYS_setregid32 | ||
1490 | #ifdef __NR_setregid32 | ||
1491 | {"setregid32", __NR_setregid32}, | ||
1492 | #endif | ||
1493 | #endif | ||
1494 | #ifdef SYS_setresgid | ||
1495 | #ifdef __NR_setresgid | ||
1496 | {"setresgid", __NR_setresgid}, | ||
1497 | #endif | ||
1498 | #endif | ||
1499 | #ifdef SYS_setresgid32 | ||
1500 | #ifdef __NR_setresgid32 | ||
1501 | {"setresgid32", __NR_setresgid32}, | ||
1502 | #endif | ||
1503 | #endif | ||
1504 | #ifdef SYS_setresuid | ||
1505 | #ifdef __NR_setresuid | ||
1506 | {"setresuid", __NR_setresuid}, | ||
1507 | #endif | ||
1508 | #endif | ||
1509 | #ifdef SYS_setresuid32 | ||
1510 | #ifdef __NR_setresuid32 | ||
1511 | {"setresuid32", __NR_setresuid32}, | ||
1512 | #endif | ||
1513 | #endif | ||
1514 | #ifdef SYS_setreuid | ||
1515 | #ifdef __NR_setreuid | ||
1516 | {"setreuid", __NR_setreuid}, | ||
1517 | #endif | ||
1518 | #endif | ||
1519 | #ifdef SYS_setreuid32 | ||
1520 | #ifdef __NR_setreuid32 | ||
1521 | {"setreuid32", __NR_setreuid32}, | ||
1522 | #endif | ||
1523 | #endif | ||
1524 | #ifdef SYS_setrlimit | ||
1525 | #ifdef __NR_setrlimit | ||
1526 | {"setrlimit", __NR_setrlimit}, | ||
1527 | #endif | ||
1528 | #endif | ||
1529 | #ifdef SYS_setsid | ||
1530 | #ifdef __NR_setsid | ||
1531 | {"setsid", __NR_setsid}, | ||
1532 | #endif | ||
1533 | #endif | ||
1534 | #ifdef SYS_setsockopt | ||
1535 | #ifdef __NR_setsockopt | ||
1536 | {"setsockopt", __NR_setsockopt}, | ||
1537 | #endif | ||
1538 | #endif | ||
1539 | #ifdef SYS_settimeofday | ||
1540 | #ifdef __NR_settimeofday | ||
1541 | {"settimeofday", __NR_settimeofday}, | ||
1542 | #endif | ||
1543 | #endif | ||
1544 | #ifdef SYS_setuid | ||
1545 | #ifdef __NR_setuid | ||
1546 | {"setuid", __NR_setuid}, | ||
1547 | #endif | ||
1548 | #endif | ||
1549 | #ifdef SYS_setuid32 | ||
1550 | #ifdef __NR_setuid32 | ||
1551 | {"setuid32", __NR_setuid32}, | ||
1552 | #endif | ||
1553 | #endif | ||
1554 | #ifdef SYS_setxattr | ||
1555 | #ifdef __NR_setxattr | ||
1556 | {"setxattr", __NR_setxattr}, | ||
1557 | #endif | ||
1558 | #endif | ||
1559 | #ifdef SYS_sgetmask | ||
1560 | #ifdef __NR_sgetmask | ||
1561 | {"sgetmask", __NR_sgetmask}, | ||
1562 | #endif | ||
1563 | #endif | ||
1564 | #ifdef SYS_shutdown | ||
1565 | #ifdef __NR_shutdown | ||
1566 | {"shutdown", __NR_shutdown}, | ||
1567 | #endif | ||
1568 | #endif | ||
1569 | #ifdef SYS_sigaction | ||
1570 | #ifdef __NR_sigaction | ||
1571 | {"sigaction", __NR_sigaction}, | ||
1572 | #endif | ||
1573 | #endif | ||
1574 | #ifdef SYS_sigaltstack | ||
1575 | #ifdef __NR_sigaltstack | ||
1576 | {"sigaltstack", __NR_sigaltstack}, | ||
1577 | #endif | ||
1578 | #endif | ||
1579 | #ifdef SYS_signal | ||
1580 | #ifdef __NR_signal | ||
1581 | {"signal", __NR_signal}, | ||
1582 | #endif | ||
1583 | #endif | ||
1584 | #ifdef SYS_signalfd | ||
1585 | #ifdef __NR_signalfd | ||
1586 | {"signalfd", __NR_signalfd}, | ||
1587 | #endif | ||
1588 | #endif | ||
1589 | #ifdef SYS_signalfd4 | ||
1590 | #ifdef __NR_signalfd4 | ||
1591 | {"signalfd4", __NR_signalfd4}, | ||
1592 | #endif | ||
1593 | #endif | ||
1594 | #ifdef SYS_sigpending | ||
1595 | #ifdef __NR_sigpending | ||
1596 | {"sigpending", __NR_sigpending}, | ||
1597 | #endif | ||
1598 | #endif | ||
1599 | #ifdef SYS_sigprocmask | ||
1600 | #ifdef __NR_sigprocmask | ||
1601 | {"sigprocmask", __NR_sigprocmask}, | ||
1602 | #endif | ||
1603 | #endif | ||
1604 | #ifdef SYS_sigreturn | ||
1605 | #ifdef __NR_sigreturn | ||
1606 | {"sigreturn", __NR_sigreturn}, | ||
1607 | #endif | ||
1608 | #endif | ||
1609 | #ifdef SYS_sigsuspend | ||
1610 | #ifdef __NR_sigsuspend | ||
1611 | {"sigsuspend", __NR_sigsuspend}, | ||
1612 | #endif | ||
1613 | #endif | ||
1614 | #ifdef SYS_socket | ||
1615 | #ifdef __NR_socket | ||
1616 | {"socket", __NR_socket}, | ||
1617 | #endif | ||
1618 | #endif | ||
1619 | #ifdef SYS_socketcall | ||
1620 | #ifdef __NR_socketcall | ||
1621 | {"socketcall", __NR_socketcall}, | ||
1622 | #endif | ||
1623 | #endif | ||
1624 | #ifdef SYS_socketpair | ||
1625 | #ifdef __NR_socketpair | ||
1626 | {"socketpair", __NR_socketpair}, | ||
1627 | #endif | ||
1628 | #endif | ||
1629 | #ifdef SYS_splice | ||
1630 | #ifdef __NR_splice | ||
1631 | {"splice", __NR_splice}, | ||
1632 | #endif | ||
1633 | #endif | ||
1634 | #ifdef SYS_ssetmask | ||
1635 | #ifdef __NR_ssetmask | ||
1636 | {"ssetmask", __NR_ssetmask}, | ||
1637 | #endif | ||
1638 | #endif | ||
1639 | #ifdef SYS_stat | ||
1640 | #ifdef __NR_stat | ||
1641 | {"stat", __NR_stat}, | ||
1642 | #endif | ||
1643 | #endif | ||
1644 | #ifdef SYS_stat64 | ||
1645 | #ifdef __NR_stat64 | ||
1646 | {"stat64", __NR_stat64}, | ||
1647 | #endif | ||
1648 | #endif | ||
1649 | #ifdef SYS_statfs | ||
1650 | #ifdef __NR_statfs | ||
1651 | {"statfs", __NR_statfs}, | ||
1652 | #endif | ||
1653 | #endif | ||
1654 | #ifdef SYS_statfs64 | ||
1655 | #ifdef __NR_statfs64 | ||
1656 | {"statfs64", __NR_statfs64}, | ||
1657 | #endif | ||
1658 | #endif | ||
1659 | #ifdef SYS_statx | ||
1660 | #ifdef __NR_statx | ||
1661 | {"statx", __NR_statx}, | ||
1662 | #endif | ||
1663 | #endif | ||
1664 | #ifdef SYS_stime | ||
1665 | #ifdef __NR_stime | ||
1666 | {"stime", __NR_stime}, | ||
1667 | #endif | ||
1668 | #endif | ||
1669 | #ifdef SYS_stty | ||
1670 | #ifdef __NR_stty | ||
1671 | {"stty", __NR_stty}, | ||
1672 | #endif | ||
1673 | #endif | ||
1674 | #ifdef SYS_swapoff | ||
1675 | #ifdef __NR_swapoff | ||
1676 | {"swapoff", __NR_swapoff}, | ||
1677 | #endif | ||
1678 | #endif | ||
1679 | #ifdef SYS_swapon | ||
1680 | #ifdef __NR_swapon | ||
1681 | {"swapon", __NR_swapon}, | ||
1682 | #endif | ||
1683 | #endif | ||
1684 | #ifdef SYS_symlink | ||
1685 | #ifdef __NR_symlink | ||
1686 | {"symlink", __NR_symlink}, | ||
1687 | #endif | ||
1688 | #endif | ||
1689 | #ifdef SYS_symlinkat | ||
1690 | #ifdef __NR_symlinkat | ||
1691 | {"symlinkat", __NR_symlinkat}, | ||
1692 | #endif | ||
1693 | #endif | ||
1694 | #ifdef SYS_sync | ||
1695 | #ifdef __NR_sync | ||
1696 | {"sync", __NR_sync}, | ||
1697 | #endif | ||
1698 | #endif | ||
1699 | #ifdef SYS_sync_file_range | ||
1700 | #ifdef __NR_sync_file_range | ||
1701 | {"sync_file_range", __NR_sync_file_range}, | ||
1702 | #endif | ||
1703 | #endif | ||
1704 | #ifdef SYS_syncfs | ||
1705 | #ifdef __NR_syncfs | ||
1706 | {"syncfs", __NR_syncfs}, | ||
1707 | #endif | ||
1708 | #endif | ||
1709 | #ifdef SYS_sysfs | ||
1710 | #ifdef __NR_sysfs | ||
1711 | {"sysfs", __NR_sysfs}, | ||
1712 | #endif | ||
1713 | #endif | ||
1714 | #ifdef SYS_sysinfo | ||
1715 | #ifdef __NR_sysinfo | ||
1716 | {"sysinfo", __NR_sysinfo}, | ||
1717 | #endif | ||
1718 | #endif | ||
1719 | #ifdef SYS_syslog | ||
1720 | #ifdef __NR_syslog | ||
1721 | {"syslog", __NR_syslog}, | ||
1722 | #endif | ||
1723 | #endif | ||
1724 | #ifdef SYS_tee | ||
1725 | #ifdef __NR_tee | ||
1726 | {"tee", __NR_tee}, | ||
1727 | #endif | ||
1728 | #endif | ||
1729 | #ifdef SYS_tgkill | ||
1730 | #ifdef __NR_tgkill | ||
1731 | {"tgkill", __NR_tgkill}, | ||
1732 | #endif | ||
1733 | #endif | ||
1734 | #ifdef SYS_time | ||
1735 | #ifdef __NR_time | ||
1736 | {"time", __NR_time}, | ||
1737 | #endif | ||
1738 | #endif | ||
1739 | #ifdef SYS_timer_create | ||
1740 | #ifdef __NR_timer_create | ||
1741 | {"timer_create", __NR_timer_create}, | ||
1742 | #endif | ||
1743 | #endif | ||
1744 | #ifdef SYS_timer_delete | ||
1745 | #ifdef __NR_timer_delete | ||
1746 | {"timer_delete", __NR_timer_delete}, | ||
1747 | #endif | ||
1748 | #endif | ||
1749 | #ifdef SYS_timer_getoverrun | ||
1750 | #ifdef __NR_timer_getoverrun | ||
1751 | {"timer_getoverrun", __NR_timer_getoverrun}, | ||
1752 | #endif | ||
1753 | #endif | ||
1754 | #ifdef SYS_timer_gettime | ||
1755 | #ifdef __NR_timer_gettime | ||
1756 | {"timer_gettime", __NR_timer_gettime}, | ||
1757 | #endif | ||
1758 | #endif | ||
1759 | #ifdef SYS_timer_settime | ||
1760 | #ifdef __NR_timer_settime | ||
1761 | {"timer_settime", __NR_timer_settime}, | ||
1762 | #endif | ||
1763 | #endif | ||
1764 | #ifdef SYS_timerfd_create | ||
1765 | #ifdef __NR_timerfd_create | ||
1766 | {"timerfd_create", __NR_timerfd_create}, | ||
1767 | #endif | ||
1768 | #endif | ||
1769 | #ifdef SYS_timerfd_gettime | ||
1770 | #ifdef __NR_timerfd_gettime | ||
1771 | {"timerfd_gettime", __NR_timerfd_gettime}, | ||
1772 | #endif | ||
1773 | #endif | ||
1774 | #ifdef SYS_timerfd_settime | ||
1775 | #ifdef __NR_timerfd_settime | ||
1776 | {"timerfd_settime", __NR_timerfd_settime}, | ||
1777 | #endif | ||
1778 | #endif | ||
1779 | #ifdef SYS_times | ||
1780 | #ifdef __NR_times | ||
1781 | {"times", __NR_times}, | ||
1782 | #endif | ||
1783 | #endif | ||
1784 | #ifdef SYS_tkill | ||
1785 | #ifdef __NR_tkill | ||
1786 | {"tkill", __NR_tkill}, | ||
1787 | #endif | ||
1788 | #endif | ||
1789 | #ifdef SYS_truncate | ||
1790 | #ifdef __NR_truncate | ||
1791 | {"truncate", __NR_truncate}, | ||
1792 | #endif | ||
1793 | #endif | ||
1794 | #ifdef SYS_truncate64 | ||
1795 | #ifdef __NR_truncate64 | ||
1796 | {"truncate64", __NR_truncate64}, | ||
1797 | #endif | ||
1798 | #endif | ||
1799 | #ifdef SYS_ugetrlimit | ||
1800 | #ifdef __NR_ugetrlimit | ||
1801 | {"ugetrlimit", __NR_ugetrlimit}, | ||
1802 | #endif | ||
1803 | #endif | ||
1804 | #ifdef SYS_ulimit | ||
1805 | #ifdef __NR_ulimit | ||
1806 | {"ulimit", __NR_ulimit}, | ||
1807 | #endif | ||
1808 | #endif | ||
1809 | #ifdef SYS_umask | ||
1810 | #ifdef __NR_umask | ||
1811 | {"umask", __NR_umask}, | ||
1812 | #endif | ||
1813 | #endif | ||
1814 | #ifdef SYS_umount | ||
1815 | #ifdef __NR_umount | ||
1816 | {"umount", __NR_umount}, | ||
1817 | #endif | ||
1818 | #endif | ||
1819 | #ifdef SYS_umount2 | ||
1820 | #ifdef __NR_umount2 | ||
1821 | {"umount2", __NR_umount2}, | ||
1822 | #endif | ||
1823 | #endif | ||
1824 | #ifdef SYS_uname | ||
1825 | #ifdef __NR_uname | ||
1826 | {"uname", __NR_uname}, | ||
1827 | #endif | ||
1828 | #endif | ||
1829 | #ifdef SYS_unlink | ||
1830 | #ifdef __NR_unlink | ||
1831 | {"unlink", __NR_unlink}, | ||
1832 | #endif | ||
1833 | #endif | ||
1834 | #ifdef SYS_unlinkat | ||
1835 | #ifdef __NR_unlinkat | ||
1836 | {"unlinkat", __NR_unlinkat}, | ||
1837 | #endif | ||
1838 | #endif | ||
1839 | #ifdef SYS_unshare | ||
1840 | #ifdef __NR_unshare | ||
1841 | {"unshare", __NR_unshare}, | ||
1842 | #endif | ||
1843 | #endif | ||
1844 | #ifdef SYS_uselib | ||
1845 | #ifdef __NR_uselib | ||
1846 | {"uselib", __NR_uselib}, | ||
1847 | #endif | ||
1848 | #endif | ||
1849 | #ifdef SYS_userfaultfd | ||
1850 | #ifdef __NR_userfaultfd | ||
1851 | {"userfaultfd", __NR_userfaultfd}, | ||
1852 | #endif | ||
1853 | #endif | ||
1854 | #ifdef SYS_ustat | ||
1855 | #ifdef __NR_ustat | ||
1856 | {"ustat", __NR_ustat}, | ||
1857 | #endif | ||
1858 | #endif | ||
1859 | #ifdef SYS_utime | ||
1860 | #ifdef __NR_utime | ||
1861 | {"utime", __NR_utime}, | ||
1862 | #endif | ||
1863 | #endif | ||
1864 | #ifdef SYS_utimensat | ||
1865 | #ifdef __NR_utimensat | ||
1866 | {"utimensat", __NR_utimensat}, | ||
1867 | #endif | ||
1868 | #endif | ||
1869 | #ifdef SYS_utimes | ||
1870 | #ifdef __NR_utimes | ||
1871 | {"utimes", __NR_utimes}, | ||
1872 | #endif | ||
1873 | #endif | ||
1874 | #ifdef SYS_vfork | ||
1875 | #ifdef __NR_vfork | ||
1876 | {"vfork", __NR_vfork}, | ||
1877 | #endif | ||
1878 | #endif | ||
1879 | #ifdef SYS_vhangup | ||
1880 | #ifdef __NR_vhangup | ||
1881 | {"vhangup", __NR_vhangup}, | ||
1882 | #endif | ||
1883 | #endif | ||
1884 | #ifdef SYS_vm86 | ||
1885 | #ifdef __NR_vm86 | ||
1886 | {"vm86", __NR_vm86}, | ||
1887 | #endif | ||
1888 | #endif | ||
1889 | #ifdef SYS_vm86old | ||
1890 | #ifdef __NR_vm86old | ||
1891 | {"vm86old", __NR_vm86old}, | ||
1892 | #endif | ||
1893 | #endif | ||
1894 | #ifdef SYS_vmsplice | ||
1895 | #ifdef __NR_vmsplice | ||
1896 | {"vmsplice", __NR_vmsplice}, | ||
1897 | #endif | ||
1898 | #endif | ||
1899 | #ifdef SYS_vserver | ||
1900 | #ifdef __NR_vserver | ||
1901 | {"vserver", __NR_vserver}, | ||
1902 | #endif | ||
1903 | #endif | ||
1904 | #ifdef SYS_wait4 | ||
1905 | #ifdef __NR_wait4 | ||
1906 | {"wait4", __NR_wait4}, | ||
1907 | #endif | ||
1908 | #endif | ||
1909 | #ifdef SYS_waitid | ||
1910 | #ifdef __NR_waitid | ||
1911 | {"waitid", __NR_waitid}, | ||
1912 | #endif | ||
1913 | #endif | ||
1914 | #ifdef SYS_waitpid | ||
1915 | #ifdef __NR_waitpid | ||
1916 | {"waitpid", __NR_waitpid}, | ||
1917 | #endif | ||
1918 | #endif | ||
1919 | #ifdef SYS_write | ||
1920 | #ifdef __NR_write | ||
1921 | {"write", __NR_write}, | ||
1922 | #endif | ||
1923 | #endif | ||
1924 | #ifdef SYS_writev | ||
1925 | #ifdef __NR_writev | ||
1926 | {"writev", __NR_writev}, | ||
1927 | #endif | ||
1928 | #endif | ||
1929 | #endif | ||
1930 | //#endif | ||
1931 | #if defined __x86_64__ && defined __LP64__ | ||
1932 | #ifdef SYS__sysctl | ||
1933 | #ifdef __NR__sysctl | ||
1934 | {"_sysctl", __NR__sysctl}, | ||
1935 | #endif | ||
1936 | #endif | ||
1937 | #ifdef SYS_accept | ||
1938 | #ifdef __NR_accept | ||
1939 | {"accept", __NR_accept}, | ||
1940 | #endif | ||
1941 | #endif | ||
1942 | #ifdef SYS_accept4 | ||
1943 | #ifdef __NR_accept4 | ||
1944 | {"accept4", __NR_accept4}, | ||
1945 | #endif | ||
1946 | #endif | ||
1947 | #ifdef SYS_access | ||
1948 | #ifdef __NR_access | ||
1949 | {"access", __NR_access}, | ||
1950 | #endif | ||
1951 | #endif | ||
1952 | #ifdef SYS_acct | ||
1953 | #ifdef __NR_acct | ||
1954 | {"acct", __NR_acct}, | ||
1955 | #endif | ||
1956 | #endif | ||
1957 | #ifdef SYS_add_key | ||
1958 | #ifdef __NR_add_key | ||
1959 | {"add_key", __NR_add_key}, | ||
1960 | #endif | ||
1961 | #endif | ||
1962 | #ifdef SYS_adjtimex | ||
1963 | #ifdef __NR_adjtimex | ||
1964 | {"adjtimex", __NR_adjtimex}, | ||
1965 | #endif | ||
1966 | #endif | ||
1967 | #ifdef SYS_afs_syscall | ||
1968 | #ifdef __NR_afs_syscall | ||
1969 | {"afs_syscall", __NR_afs_syscall}, | ||
1970 | #endif | ||
1971 | #endif | ||
1972 | #ifdef SYS_alarm | ||
1973 | #ifdef __NR_alarm | ||
1974 | {"alarm", __NR_alarm}, | ||
1975 | #endif | ||
1976 | #endif | ||
1977 | #ifdef SYS_arch_prctl | ||
1978 | #ifdef __NR_arch_prctl | ||
1979 | {"arch_prctl", __NR_arch_prctl}, | ||
1980 | #endif | ||
1981 | #endif | ||
1982 | #ifdef SYS_bind | ||
1983 | #ifdef __NR_bind | ||
1984 | {"bind", __NR_bind}, | ||
1985 | #endif | ||
1986 | #endif | ||
1987 | #ifdef SYS_bpf | ||
1988 | #ifdef __NR_bpf | ||
1989 | {"bpf", __NR_bpf}, | ||
1990 | #endif | ||
1991 | #endif | ||
1992 | #ifdef SYS_brk | ||
1993 | #ifdef __NR_brk | ||
1994 | {"brk", __NR_brk}, | ||
1995 | #endif | ||
1996 | #endif | ||
1997 | #ifdef SYS_capget | ||
1998 | #ifdef __NR_capget | ||
1999 | {"capget", __NR_capget}, | ||
2000 | #endif | ||
2001 | #endif | ||
2002 | #ifdef SYS_capset | ||
2003 | #ifdef __NR_capset | ||
2004 | {"capset", __NR_capset}, | ||
2005 | #endif | ||
2006 | #endif | ||
2007 | #ifdef SYS_chdir | ||
2008 | #ifdef __NR_chdir | ||
2009 | {"chdir", __NR_chdir}, | ||
2010 | #endif | ||
2011 | #endif | ||
2012 | #ifdef SYS_chmod | ||
2013 | #ifdef __NR_chmod | ||
2014 | {"chmod", __NR_chmod}, | ||
2015 | #endif | ||
2016 | #endif | ||
2017 | #ifdef SYS_chown | ||
2018 | #ifdef __NR_chown | ||
2019 | {"chown", __NR_chown}, | ||
2020 | #endif | ||
2021 | #endif | ||
2022 | #ifdef SYS_chroot | ||
2023 | #ifdef __NR_chroot | ||
2024 | {"chroot", __NR_chroot}, | ||
2025 | #endif | ||
2026 | #endif | ||
2027 | #ifdef SYS_clock_adjtime | ||
2028 | #ifdef __NR_clock_adjtime | ||
2029 | {"clock_adjtime", __NR_clock_adjtime}, | ||
2030 | #endif | ||
2031 | #endif | ||
2032 | #ifdef SYS_clock_getres | ||
2033 | #ifdef __NR_clock_getres | ||
2034 | {"clock_getres", __NR_clock_getres}, | ||
2035 | #endif | ||
2036 | #endif | ||
2037 | #ifdef SYS_clock_gettime | ||
2038 | #ifdef __NR_clock_gettime | ||
2039 | {"clock_gettime", __NR_clock_gettime}, | ||
2040 | #endif | ||
2041 | #endif | ||
2042 | #ifdef SYS_clock_nanosleep | ||
2043 | #ifdef __NR_clock_nanosleep | ||
2044 | {"clock_nanosleep", __NR_clock_nanosleep}, | ||
2045 | #endif | ||
2046 | #endif | ||
2047 | #ifdef SYS_clock_settime | ||
2048 | #ifdef __NR_clock_settime | ||
2049 | {"clock_settime", __NR_clock_settime}, | ||
2050 | #endif | ||
2051 | #endif | ||
2052 | #ifdef SYS_clone | ||
2053 | #ifdef __NR_clone | ||
2054 | {"clone", __NR_clone}, | ||
2055 | #endif | ||
2056 | #endif | ||
2057 | #ifdef SYS_close | ||
2058 | #ifdef __NR_close | ||
2059 | {"close", __NR_close}, | ||
2060 | #endif | ||
2061 | #endif | ||
2062 | #ifdef SYS_connect | ||
2063 | #ifdef __NR_connect | ||
2064 | {"connect", __NR_connect}, | ||
2065 | #endif | ||
2066 | #endif | ||
2067 | #ifdef SYS_copy_file_range | ||
2068 | #ifdef __NR_copy_file_range | ||
2069 | {"copy_file_range", __NR_copy_file_range}, | ||
2070 | #endif | ||
2071 | #endif | ||
2072 | #ifdef SYS_creat | ||
2073 | #ifdef __NR_creat | ||
2074 | {"creat", __NR_creat}, | ||
2075 | #endif | ||
2076 | #endif | ||
2077 | #ifdef SYS_create_module | ||
2078 | #ifdef __NR_create_module | ||
2079 | {"create_module", __NR_create_module}, | ||
2080 | #endif | ||
2081 | #endif | ||
2082 | #ifdef SYS_delete_module | ||
2083 | #ifdef __NR_delete_module | ||
2084 | {"delete_module", __NR_delete_module}, | ||
2085 | #endif | ||
2086 | #endif | ||
2087 | #ifdef SYS_dup | ||
2088 | #ifdef __NR_dup | ||
2089 | {"dup", __NR_dup}, | ||
2090 | #endif | ||
2091 | #endif | ||
2092 | #ifdef SYS_dup2 | ||
2093 | #ifdef __NR_dup2 | ||
2094 | {"dup2", __NR_dup2}, | ||
2095 | #endif | ||
2096 | #endif | ||
2097 | #ifdef SYS_dup3 | ||
2098 | #ifdef __NR_dup3 | ||
2099 | {"dup3", __NR_dup3}, | ||
2100 | #endif | ||
2101 | #endif | ||
2102 | #ifdef SYS_epoll_create | ||
2103 | #ifdef __NR_epoll_create | ||
2104 | {"epoll_create", __NR_epoll_create}, | ||
2105 | #endif | ||
2106 | #endif | ||
2107 | #ifdef SYS_epoll_create1 | ||
2108 | #ifdef __NR_epoll_create1 | ||
2109 | {"epoll_create1", __NR_epoll_create1}, | ||
2110 | #endif | ||
2111 | #endif | ||
2112 | #ifdef SYS_epoll_ctl | ||
2113 | #ifdef __NR_epoll_ctl | ||
2114 | {"epoll_ctl", __NR_epoll_ctl}, | ||
2115 | #endif | ||
2116 | #endif | ||
2117 | #ifdef SYS_epoll_ctl_old | ||
2118 | #ifdef __NR_epoll_ctl_old | ||
2119 | {"epoll_ctl_old", __NR_epoll_ctl_old}, | ||
2120 | #endif | ||
2121 | #endif | ||
2122 | #ifdef SYS_epoll_pwait | ||
2123 | #ifdef __NR_epoll_pwait | ||
2124 | {"epoll_pwait", __NR_epoll_pwait}, | ||
2125 | #endif | ||
2126 | #endif | ||
2127 | #ifdef SYS_epoll_wait | ||
2128 | #ifdef __NR_epoll_wait | ||
2129 | {"epoll_wait", __NR_epoll_wait}, | ||
2130 | #endif | ||
2131 | #endif | ||
2132 | #ifdef SYS_epoll_wait_old | ||
2133 | #ifdef __NR_epoll_wait_old | ||
2134 | {"epoll_wait_old", __NR_epoll_wait_old}, | ||
2135 | #endif | ||
2136 | #endif | ||
2137 | #ifdef SYS_eventfd | ||
2138 | #ifdef __NR_eventfd | ||
2139 | {"eventfd", __NR_eventfd}, | ||
2140 | #endif | ||
2141 | #endif | ||
2142 | #ifdef SYS_eventfd2 | ||
2143 | #ifdef __NR_eventfd2 | ||
2144 | {"eventfd2", __NR_eventfd2}, | ||
2145 | #endif | ||
2146 | #endif | ||
2147 | #ifdef SYS_execve | ||
2148 | #ifdef __NR_execve | ||
2149 | {"execve", __NR_execve}, | ||
2150 | #endif | ||
2151 | #endif | ||
2152 | #ifdef SYS_execveat | ||
2153 | #ifdef __NR_execveat | ||
2154 | {"execveat", __NR_execveat}, | ||
2155 | #endif | ||
2156 | #endif | ||
2157 | #ifdef SYS_exit | ||
2158 | #ifdef __NR_exit | ||
2159 | {"exit", __NR_exit}, | ||
2160 | #endif | ||
2161 | #endif | ||
2162 | #ifdef SYS_exit_group | ||
2163 | #ifdef __NR_exit_group | ||
2164 | {"exit_group", __NR_exit_group}, | ||
2165 | #endif | ||
2166 | #endif | ||
2167 | #ifdef SYS_faccessat | ||
2168 | #ifdef __NR_faccessat | ||
2169 | {"faccessat", __NR_faccessat}, | ||
2170 | #endif | ||
2171 | #endif | ||
2172 | #ifdef SYS_fadvise64 | ||
2173 | #ifdef __NR_fadvise64 | ||
2174 | {"fadvise64", __NR_fadvise64}, | ||
2175 | #endif | ||
2176 | #endif | ||
2177 | #ifdef SYS_fallocate | ||
2178 | #ifdef __NR_fallocate | ||
2179 | {"fallocate", __NR_fallocate}, | ||
2180 | #endif | ||
2181 | #endif | ||
2182 | #ifdef SYS_fanotify_init | ||
2183 | #ifdef __NR_fanotify_init | ||
2184 | {"fanotify_init", __NR_fanotify_init}, | ||
2185 | #endif | ||
2186 | #endif | ||
2187 | #ifdef SYS_fanotify_mark | ||
2188 | #ifdef __NR_fanotify_mark | ||
2189 | {"fanotify_mark", __NR_fanotify_mark}, | ||
2190 | #endif | ||
2191 | #endif | ||
2192 | #ifdef SYS_fchdir | ||
2193 | #ifdef __NR_fchdir | ||
2194 | {"fchdir", __NR_fchdir}, | ||
2195 | #endif | ||
2196 | #endif | ||
2197 | #ifdef SYS_fchmod | ||
2198 | #ifdef __NR_fchmod | ||
2199 | {"fchmod", __NR_fchmod}, | ||
2200 | #endif | ||
2201 | #endif | ||
2202 | #ifdef SYS_fchmodat | ||
2203 | #ifdef __NR_fchmodat | ||
2204 | {"fchmodat", __NR_fchmodat}, | ||
2205 | #endif | ||
2206 | #endif | ||
2207 | #ifdef SYS_fchown | ||
2208 | #ifdef __NR_fchown | ||
2209 | {"fchown", __NR_fchown}, | ||
2210 | #endif | ||
2211 | #endif | ||
2212 | #ifdef SYS_fchownat | ||
2213 | #ifdef __NR_fchownat | ||
2214 | {"fchownat", __NR_fchownat}, | ||
2215 | #endif | ||
2216 | #endif | ||
2217 | #ifdef SYS_fcntl | ||
2218 | #ifdef __NR_fcntl | ||
2219 | {"fcntl", __NR_fcntl}, | ||
2220 | #endif | ||
2221 | #endif | ||
2222 | #ifdef SYS_fdatasync | ||
2223 | #ifdef __NR_fdatasync | ||
2224 | {"fdatasync", __NR_fdatasync}, | ||
2225 | #endif | ||
2226 | #endif | ||
2227 | #ifdef SYS_fgetxattr | ||
2228 | #ifdef __NR_fgetxattr | ||
2229 | {"fgetxattr", __NR_fgetxattr}, | ||
2230 | #endif | ||
2231 | #endif | ||
2232 | #ifdef SYS_finit_module | ||
2233 | #ifdef __NR_finit_module | ||
2234 | {"finit_module", __NR_finit_module}, | ||
2235 | #endif | ||
2236 | #endif | ||
2237 | #ifdef SYS_flistxattr | ||
2238 | #ifdef __NR_flistxattr | ||
2239 | {"flistxattr", __NR_flistxattr}, | ||
2240 | #endif | ||
2241 | #endif | ||
2242 | #ifdef SYS_flock | ||
2243 | #ifdef __NR_flock | ||
2244 | {"flock", __NR_flock}, | ||
2245 | #endif | ||
2246 | #endif | ||
2247 | #ifdef SYS_fork | ||
2248 | #ifdef __NR_fork | ||
2249 | {"fork", __NR_fork}, | ||
2250 | #endif | ||
2251 | #endif | ||
2252 | #ifdef SYS_fremovexattr | ||
2253 | #ifdef __NR_fremovexattr | ||
2254 | {"fremovexattr", __NR_fremovexattr}, | ||
2255 | #endif | ||
2256 | #endif | ||
2257 | #ifdef SYS_fsetxattr | ||
2258 | #ifdef __NR_fsetxattr | ||
2259 | {"fsetxattr", __NR_fsetxattr}, | ||
2260 | #endif | ||
2261 | #endif | ||
2262 | #ifdef SYS_fstat | ||
2263 | #ifdef __NR_fstat | ||
2264 | {"fstat", __NR_fstat}, | ||
2265 | #endif | ||
2266 | #endif | ||
2267 | #ifdef SYS_fstatfs | ||
2268 | #ifdef __NR_fstatfs | ||
2269 | {"fstatfs", __NR_fstatfs}, | ||
2270 | #endif | ||
2271 | #endif | ||
2272 | #ifdef SYS_fsync | ||
2273 | #ifdef __NR_fsync | ||
2274 | {"fsync", __NR_fsync}, | ||
2275 | #endif | ||
2276 | #endif | ||
2277 | #ifdef SYS_ftruncate | ||
2278 | #ifdef __NR_ftruncate | ||
2279 | {"ftruncate", __NR_ftruncate}, | ||
2280 | #endif | ||
2281 | #endif | ||
2282 | #ifdef SYS_futex | ||
2283 | #ifdef __NR_futex | ||
2284 | {"futex", __NR_futex}, | ||
2285 | #endif | ||
2286 | #endif | ||
2287 | #ifdef SYS_futimesat | ||
2288 | #ifdef __NR_futimesat | ||
2289 | {"futimesat", __NR_futimesat}, | ||
2290 | #endif | ||
2291 | #endif | ||
2292 | #ifdef SYS_get_kernel_syms | ||
2293 | #ifdef __NR_get_kernel_syms | ||
2294 | {"get_kernel_syms", __NR_get_kernel_syms}, | ||
2295 | #endif | ||
2296 | #endif | ||
2297 | #ifdef SYS_get_mempolicy | ||
2298 | #ifdef __NR_get_mempolicy | ||
2299 | {"get_mempolicy", __NR_get_mempolicy}, | ||
2300 | #endif | ||
2301 | #endif | ||
2302 | #ifdef SYS_get_robust_list | ||
2303 | #ifdef __NR_get_robust_list | ||
2304 | {"get_robust_list", __NR_get_robust_list}, | ||
2305 | #endif | ||
2306 | #endif | ||
2307 | #ifdef SYS_get_thread_area | ||
2308 | #ifdef __NR_get_thread_area | ||
2309 | {"get_thread_area", __NR_get_thread_area}, | ||
2310 | #endif | ||
2311 | #endif | ||
2312 | #ifdef SYS_getcpu | ||
2313 | #ifdef __NR_getcpu | ||
2314 | {"getcpu", __NR_getcpu}, | ||
2315 | #endif | ||
2316 | #endif | ||
2317 | #ifdef SYS_getcwd | ||
2318 | #ifdef __NR_getcwd | ||
2319 | {"getcwd", __NR_getcwd}, | ||
2320 | #endif | ||
2321 | #endif | ||
2322 | #ifdef SYS_getdents | ||
2323 | #ifdef __NR_getdents | ||
2324 | {"getdents", __NR_getdents}, | ||
2325 | #endif | ||
2326 | #endif | ||
2327 | #ifdef SYS_getdents64 | ||
2328 | #ifdef __NR_getdents64 | ||
2329 | {"getdents64", __NR_getdents64}, | ||
2330 | #endif | ||
2331 | #endif | ||
2332 | #ifdef SYS_getegid | ||
2333 | #ifdef __NR_getegid | ||
2334 | {"getegid", __NR_getegid}, | ||
2335 | #endif | ||
2336 | #endif | ||
2337 | #ifdef SYS_geteuid | ||
2338 | #ifdef __NR_geteuid | ||
2339 | {"geteuid", __NR_geteuid}, | ||
2340 | #endif | ||
2341 | #endif | ||
2342 | #ifdef SYS_getgid | ||
2343 | #ifdef __NR_getgid | ||
2344 | {"getgid", __NR_getgid}, | ||
2345 | #endif | ||
2346 | #endif | ||
2347 | #ifdef SYS_getgroups | ||
2348 | #ifdef __NR_getgroups | ||
2349 | {"getgroups", __NR_getgroups}, | ||
2350 | #endif | ||
2351 | #endif | ||
2352 | #ifdef SYS_getitimer | ||
2353 | #ifdef __NR_getitimer | ||
2354 | {"getitimer", __NR_getitimer}, | ||
2355 | #endif | ||
2356 | #endif | ||
2357 | #ifdef SYS_getpeername | ||
2358 | #ifdef __NR_getpeername | ||
2359 | {"getpeername", __NR_getpeername}, | ||
2360 | #endif | ||
2361 | #endif | ||
2362 | #ifdef SYS_getpgid | ||
2363 | #ifdef __NR_getpgid | ||
2364 | {"getpgid", __NR_getpgid}, | ||
2365 | #endif | ||
2366 | #endif | ||
2367 | #ifdef SYS_getpgrp | ||
2368 | #ifdef __NR_getpgrp | ||
2369 | {"getpgrp", __NR_getpgrp}, | ||
2370 | #endif | ||
2371 | #endif | ||
2372 | #ifdef SYS_getpid | ||
2373 | #ifdef __NR_getpid | ||
2374 | {"getpid", __NR_getpid}, | ||
2375 | #endif | ||
2376 | #endif | ||
2377 | #ifdef SYS_getpmsg | ||
2378 | #ifdef __NR_getpmsg | ||
2379 | {"getpmsg", __NR_getpmsg}, | ||
2380 | #endif | ||
2381 | #endif | ||
2382 | #ifdef SYS_getppid | ||
2383 | #ifdef __NR_getppid | ||
2384 | {"getppid", __NR_getppid}, | ||
2385 | #endif | ||
2386 | #endif | ||
2387 | #ifdef SYS_getpriority | ||
2388 | #ifdef __NR_getpriority | ||
2389 | {"getpriority", __NR_getpriority}, | ||
2390 | #endif | ||
2391 | #endif | ||
2392 | #ifdef SYS_getrandom | ||
2393 | #ifdef __NR_getrandom | ||
2394 | {"getrandom", __NR_getrandom}, | ||
2395 | #endif | ||
2396 | #endif | ||
2397 | #ifdef SYS_getresgid | ||
2398 | #ifdef __NR_getresgid | ||
2399 | {"getresgid", __NR_getresgid}, | ||
2400 | #endif | ||
2401 | #endif | ||
2402 | #ifdef SYS_getresuid | ||
2403 | #ifdef __NR_getresuid | ||
2404 | {"getresuid", __NR_getresuid}, | ||
2405 | #endif | ||
2406 | #endif | ||
2407 | #ifdef SYS_getrlimit | ||
2408 | #ifdef __NR_getrlimit | ||
2409 | {"getrlimit", __NR_getrlimit}, | ||
2410 | #endif | ||
2411 | #endif | ||
2412 | #ifdef SYS_getrusage | ||
2413 | #ifdef __NR_getrusage | ||
2414 | {"getrusage", __NR_getrusage}, | ||
2415 | #endif | ||
2416 | #endif | ||
2417 | #ifdef SYS_getsid | ||
2418 | #ifdef __NR_getsid | ||
2419 | {"getsid", __NR_getsid}, | ||
2420 | #endif | ||
2421 | #endif | ||
2422 | #ifdef SYS_getsockname | ||
2423 | #ifdef __NR_getsockname | ||
2424 | {"getsockname", __NR_getsockname}, | ||
2425 | #endif | ||
2426 | #endif | ||
2427 | #ifdef SYS_getsockopt | ||
2428 | #ifdef __NR_getsockopt | ||
2429 | {"getsockopt", __NR_getsockopt}, | ||
2430 | #endif | ||
2431 | #endif | ||
2432 | #ifdef SYS_gettid | ||
2433 | #ifdef __NR_gettid | ||
2434 | {"gettid", __NR_gettid}, | ||
2435 | #endif | ||
2436 | #endif | ||
2437 | #ifdef SYS_gettimeofday | ||
2438 | #ifdef __NR_gettimeofday | ||
2439 | {"gettimeofday", __NR_gettimeofday}, | ||
2440 | #endif | ||
2441 | #endif | ||
2442 | #ifdef SYS_getuid | ||
2443 | #ifdef __NR_getuid | ||
2444 | {"getuid", __NR_getuid}, | ||
2445 | #endif | ||
2446 | #endif | ||
2447 | #ifdef SYS_getxattr | ||
2448 | #ifdef __NR_getxattr | ||
2449 | {"getxattr", __NR_getxattr}, | ||
2450 | #endif | ||
2451 | #endif | ||
2452 | #ifdef SYS_init_module | ||
2453 | #ifdef __NR_init_module | ||
2454 | {"init_module", __NR_init_module}, | ||
2455 | #endif | ||
2456 | #endif | ||
2457 | #ifdef SYS_inotify_add_watch | ||
2458 | #ifdef __NR_inotify_add_watch | ||
2459 | {"inotify_add_watch", __NR_inotify_add_watch}, | ||
2460 | #endif | ||
2461 | #endif | ||
2462 | #ifdef SYS_inotify_init | ||
2463 | #ifdef __NR_inotify_init | ||
2464 | {"inotify_init", __NR_inotify_init}, | ||
2465 | #endif | ||
2466 | #endif | ||
2467 | #ifdef SYS_inotify_init1 | ||
2468 | #ifdef __NR_inotify_init1 | ||
2469 | {"inotify_init1", __NR_inotify_init1}, | ||
2470 | #endif | ||
2471 | #endif | ||
2472 | #ifdef SYS_inotify_rm_watch | ||
2473 | #ifdef __NR_inotify_rm_watch | ||
2474 | {"inotify_rm_watch", __NR_inotify_rm_watch}, | ||
2475 | #endif | ||
2476 | #endif | ||
2477 | #ifdef SYS_io_cancel | ||
2478 | #ifdef __NR_io_cancel | ||
2479 | {"io_cancel", __NR_io_cancel}, | ||
2480 | #endif | ||
2481 | #endif | ||
2482 | #ifdef SYS_io_destroy | ||
2483 | #ifdef __NR_io_destroy | ||
2484 | {"io_destroy", __NR_io_destroy}, | ||
2485 | #endif | ||
2486 | #endif | ||
2487 | #ifdef SYS_io_getevents | ||
2488 | #ifdef __NR_io_getevents | ||
2489 | {"io_getevents", __NR_io_getevents}, | ||
2490 | #endif | ||
2491 | #endif | ||
2492 | #ifdef SYS_io_setup | ||
2493 | #ifdef __NR_io_setup | ||
2494 | {"io_setup", __NR_io_setup}, | ||
2495 | #endif | ||
2496 | #endif | ||
2497 | #ifdef SYS_io_submit | ||
2498 | #ifdef __NR_io_submit | ||
2499 | {"io_submit", __NR_io_submit}, | ||
2500 | #endif | ||
2501 | #endif | ||
2502 | #ifdef SYS_ioctl | ||
2503 | #ifdef __NR_ioctl | ||
2504 | {"ioctl", __NR_ioctl}, | ||
2505 | #endif | ||
2506 | #endif | ||
2507 | #ifdef SYS_ioperm | ||
2508 | #ifdef __NR_ioperm | ||
2509 | {"ioperm", __NR_ioperm}, | ||
2510 | #endif | ||
2511 | #endif | ||
2512 | #ifdef SYS_iopl | ||
2513 | #ifdef __NR_iopl | ||
2514 | {"iopl", __NR_iopl}, | ||
2515 | #endif | ||
2516 | #endif | ||
2517 | #ifdef SYS_ioprio_get | ||
2518 | #ifdef __NR_ioprio_get | ||
2519 | {"ioprio_get", __NR_ioprio_get}, | ||
2520 | #endif | ||
2521 | #endif | ||
2522 | #ifdef SYS_ioprio_set | ||
2523 | #ifdef __NR_ioprio_set | ||
2524 | {"ioprio_set", __NR_ioprio_set}, | ||
2525 | #endif | ||
2526 | #endif | ||
2527 | #ifdef SYS_kcmp | ||
2528 | #ifdef __NR_kcmp | ||
2529 | {"kcmp", __NR_kcmp}, | ||
2530 | #endif | ||
2531 | #endif | ||
2532 | #ifdef SYS_kexec_file_load | ||
2533 | #ifdef __NR_kexec_file_load | ||
2534 | {"kexec_file_load", __NR_kexec_file_load}, | ||
2535 | #endif | ||
2536 | #endif | ||
2537 | #ifdef SYS_kexec_load | ||
2538 | #ifdef __NR_kexec_load | ||
2539 | {"kexec_load", __NR_kexec_load}, | ||
2540 | #endif | ||
2541 | #endif | ||
2542 | #ifdef SYS_keyctl | ||
2543 | #ifdef __NR_keyctl | ||
2544 | {"keyctl", __NR_keyctl}, | ||
2545 | #endif | ||
2546 | #endif | ||
2547 | #ifdef SYS_kill | ||
2548 | #ifdef __NR_kill | ||
2549 | {"kill", __NR_kill}, | ||
2550 | #endif | ||
2551 | #endif | ||
2552 | #ifdef SYS_lchown | ||
2553 | #ifdef __NR_lchown | ||
2554 | {"lchown", __NR_lchown}, | ||
2555 | #endif | ||
2556 | #endif | ||
2557 | #ifdef SYS_lgetxattr | ||
2558 | #ifdef __NR_lgetxattr | ||
2559 | {"lgetxattr", __NR_lgetxattr}, | ||
2560 | #endif | ||
2561 | #endif | ||
2562 | #ifdef SYS_link | ||
2563 | #ifdef __NR_link | ||
2564 | {"link", __NR_link}, | ||
2565 | #endif | ||
2566 | #endif | ||
2567 | #ifdef SYS_linkat | ||
2568 | #ifdef __NR_linkat | ||
2569 | {"linkat", __NR_linkat}, | ||
2570 | #endif | ||
2571 | #endif | ||
2572 | #ifdef SYS_listen | ||
2573 | #ifdef __NR_listen | ||
2574 | {"listen", __NR_listen}, | ||
2575 | #endif | ||
2576 | #endif | ||
2577 | #ifdef SYS_listxattr | ||
2578 | #ifdef __NR_listxattr | ||
2579 | {"listxattr", __NR_listxattr}, | ||
2580 | #endif | ||
2581 | #endif | ||
2582 | #ifdef SYS_llistxattr | ||
2583 | #ifdef __NR_llistxattr | ||
2584 | {"llistxattr", __NR_llistxattr}, | ||
2585 | #endif | ||
2586 | #endif | ||
2587 | #ifdef SYS_lookup_dcookie | ||
2588 | #ifdef __NR_lookup_dcookie | ||
2589 | {"lookup_dcookie", __NR_lookup_dcookie}, | ||
2590 | #endif | ||
2591 | #endif | ||
2592 | #ifdef SYS_lremovexattr | ||
2593 | #ifdef __NR_lremovexattr | ||
2594 | {"lremovexattr", __NR_lremovexattr}, | ||
2595 | #endif | ||
2596 | #endif | ||
2597 | #ifdef SYS_lseek | ||
2598 | #ifdef __NR_lseek | ||
2599 | {"lseek", __NR_lseek}, | ||
2600 | #endif | ||
2601 | #endif | ||
2602 | #ifdef SYS_lsetxattr | ||
2603 | #ifdef __NR_lsetxattr | ||
2604 | {"lsetxattr", __NR_lsetxattr}, | ||
2605 | #endif | ||
2606 | #endif | ||
2607 | #ifdef SYS_lstat | ||
2608 | #ifdef __NR_lstat | ||
2609 | {"lstat", __NR_lstat}, | ||
2610 | #endif | ||
2611 | #endif | ||
2612 | #ifdef SYS_madvise | ||
2613 | #ifdef __NR_madvise | ||
2614 | {"madvise", __NR_madvise}, | ||
2615 | #endif | ||
2616 | #endif | ||
2617 | #ifdef SYS_mbind | ||
2618 | #ifdef __NR_mbind | ||
2619 | {"mbind", __NR_mbind}, | ||
2620 | #endif | ||
2621 | #endif | ||
2622 | #ifdef SYS_membarrier | ||
2623 | #ifdef __NR_membarrier | ||
2624 | {"membarrier", __NR_membarrier}, | ||
2625 | #endif | ||
2626 | #endif | ||
2627 | #ifdef SYS_memfd_create | ||
2628 | #ifdef __NR_memfd_create | ||
2629 | {"memfd_create", __NR_memfd_create}, | ||
2630 | #endif | ||
2631 | #endif | ||
2632 | #ifdef SYS_migrate_pages | ||
2633 | #ifdef __NR_migrate_pages | ||
2634 | {"migrate_pages", __NR_migrate_pages}, | ||
2635 | #endif | ||
2636 | #endif | ||
2637 | #ifdef SYS_mincore | ||
2638 | #ifdef __NR_mincore | ||
2639 | {"mincore", __NR_mincore}, | ||
2640 | #endif | ||
2641 | #endif | ||
2642 | #ifdef SYS_mkdir | ||
2643 | #ifdef __NR_mkdir | ||
2644 | {"mkdir", __NR_mkdir}, | ||
2645 | #endif | ||
2646 | #endif | ||
2647 | #ifdef SYS_mkdirat | ||
2648 | #ifdef __NR_mkdirat | ||
2649 | {"mkdirat", __NR_mkdirat}, | ||
2650 | #endif | ||
2651 | #endif | ||
2652 | #ifdef SYS_mknod | ||
2653 | #ifdef __NR_mknod | ||
2654 | {"mknod", __NR_mknod}, | ||
2655 | #endif | ||
2656 | #endif | ||
2657 | #ifdef SYS_mknodat | ||
2658 | #ifdef __NR_mknodat | ||
2659 | {"mknodat", __NR_mknodat}, | ||
2660 | #endif | ||
2661 | #endif | ||
2662 | #ifdef SYS_mlock | ||
2663 | #ifdef __NR_mlock | ||
2664 | {"mlock", __NR_mlock}, | ||
2665 | #endif | ||
2666 | #endif | ||
2667 | #ifdef SYS_mlock2 | ||
2668 | #ifdef __NR_mlock2 | ||
2669 | {"mlock2", __NR_mlock2}, | ||
2670 | #endif | ||
2671 | #endif | ||
2672 | #ifdef SYS_mlockall | ||
2673 | #ifdef __NR_mlockall | ||
2674 | {"mlockall", __NR_mlockall}, | ||
2675 | #endif | ||
2676 | #endif | ||
2677 | #ifdef SYS_mmap | ||
2678 | #ifdef __NR_mmap | ||
2679 | {"mmap", __NR_mmap}, | ||
2680 | #endif | ||
2681 | #endif | ||
2682 | #ifdef SYS_modify_ldt | ||
2683 | #ifdef __NR_modify_ldt | ||
2684 | {"modify_ldt", __NR_modify_ldt}, | ||
2685 | #endif | ||
2686 | #endif | ||
2687 | #ifdef SYS_mount | ||
2688 | #ifdef __NR_mount | ||
2689 | {"mount", __NR_mount}, | ||
2690 | #endif | ||
2691 | #endif | ||
2692 | #ifdef SYS_move_pages | ||
2693 | #ifdef __NR_move_pages | ||
2694 | {"move_pages", __NR_move_pages}, | ||
2695 | #endif | ||
2696 | #endif | ||
2697 | #ifdef SYS_mprotect | ||
2698 | #ifdef __NR_mprotect | ||
2699 | {"mprotect", __NR_mprotect}, | ||
2700 | #endif | ||
2701 | #endif | ||
2702 | #ifdef SYS_mq_getsetattr | ||
2703 | #ifdef __NR_mq_getsetattr | ||
2704 | {"mq_getsetattr", __NR_mq_getsetattr}, | ||
2705 | #endif | ||
2706 | #endif | ||
2707 | #ifdef SYS_mq_notify | ||
2708 | #ifdef __NR_mq_notify | ||
2709 | {"mq_notify", __NR_mq_notify}, | ||
2710 | #endif | ||
2711 | #endif | ||
2712 | #ifdef SYS_mq_open | ||
2713 | #ifdef __NR_mq_open | ||
2714 | {"mq_open", __NR_mq_open}, | ||
2715 | #endif | ||
2716 | #endif | ||
2717 | #ifdef SYS_mq_timedreceive | ||
2718 | #ifdef __NR_mq_timedreceive | ||
2719 | {"mq_timedreceive", __NR_mq_timedreceive}, | ||
2720 | #endif | ||
2721 | #endif | ||
2722 | #ifdef SYS_mq_timedsend | ||
2723 | #ifdef __NR_mq_timedsend | ||
2724 | {"mq_timedsend", __NR_mq_timedsend}, | ||
2725 | #endif | ||
2726 | #endif | ||
2727 | #ifdef SYS_mq_unlink | ||
2728 | #ifdef __NR_mq_unlink | ||
2729 | {"mq_unlink", __NR_mq_unlink}, | ||
2730 | #endif | ||
2731 | #endif | ||
2732 | #ifdef SYS_mremap | ||
2733 | #ifdef __NR_mremap | ||
2734 | {"mremap", __NR_mremap}, | ||
2735 | #endif | ||
2736 | #endif | ||
2737 | #ifdef SYS_msgctl | ||
2738 | #ifdef __NR_msgctl | ||
2739 | {"msgctl", __NR_msgctl}, | ||
2740 | #endif | ||
2741 | #endif | ||
2742 | #ifdef SYS_msgget | ||
2743 | #ifdef __NR_msgget | ||
2744 | {"msgget", __NR_msgget}, | ||
2745 | #endif | ||
2746 | #endif | ||
2747 | #ifdef SYS_msgrcv | ||
2748 | #ifdef __NR_msgrcv | ||
2749 | {"msgrcv", __NR_msgrcv}, | ||
2750 | #endif | ||
2751 | #endif | ||
2752 | #ifdef SYS_msgsnd | ||
2753 | #ifdef __NR_msgsnd | ||
2754 | {"msgsnd", __NR_msgsnd}, | ||
2755 | #endif | ||
2756 | #endif | ||
2757 | #ifdef SYS_msync | ||
2758 | #ifdef __NR_msync | ||
2759 | {"msync", __NR_msync}, | ||
2760 | #endif | ||
2761 | #endif | ||
2762 | #ifdef SYS_munlock | ||
2763 | #ifdef __NR_munlock | ||
2764 | {"munlock", __NR_munlock}, | ||
2765 | #endif | ||
2766 | #endif | ||
2767 | #ifdef SYS_munlockall | ||
2768 | #ifdef __NR_munlockall | ||
2769 | {"munlockall", __NR_munlockall}, | ||
2770 | #endif | ||
2771 | #endif | ||
2772 | #ifdef SYS_munmap | ||
2773 | #ifdef __NR_munmap | ||
2774 | {"munmap", __NR_munmap}, | ||
2775 | #endif | ||
2776 | #endif | ||
2777 | #ifdef SYS_name_to_handle_at | ||
2778 | #ifdef __NR_name_to_handle_at | ||
2779 | {"name_to_handle_at", __NR_name_to_handle_at}, | ||
2780 | #endif | ||
2781 | #endif | ||
2782 | #ifdef SYS_nanosleep | ||
2783 | #ifdef __NR_nanosleep | ||
2784 | {"nanosleep", __NR_nanosleep}, | ||
2785 | #endif | ||
2786 | #endif | ||
2787 | #ifdef SYS_newfstatat | ||
2788 | #ifdef __NR_newfstatat | ||
2789 | {"newfstatat", __NR_newfstatat}, | ||
2790 | #endif | ||
2791 | #endif | ||
2792 | #ifdef SYS_nfsservctl | ||
2793 | #ifdef __NR_nfsservctl | ||
2794 | {"nfsservctl", __NR_nfsservctl}, | ||
2795 | #endif | ||
2796 | #endif | ||
2797 | #ifdef SYS_open | ||
2798 | #ifdef __NR_open | ||
2799 | {"open", __NR_open}, | ||
2800 | #endif | ||
2801 | #endif | ||
2802 | #ifdef SYS_open_by_handle_at | ||
2803 | #ifdef __NR_open_by_handle_at | ||
2804 | {"open_by_handle_at", __NR_open_by_handle_at}, | ||
2805 | #endif | ||
2806 | #endif | ||
2807 | #ifdef SYS_openat | ||
2808 | #ifdef __NR_openat | ||
2809 | {"openat", __NR_openat}, | ||
2810 | #endif | ||
2811 | #endif | ||
2812 | #ifdef SYS_pause | ||
2813 | #ifdef __NR_pause | ||
2814 | {"pause", __NR_pause}, | ||
2815 | #endif | ||
2816 | #endif | ||
2817 | #ifdef SYS_perf_event_open | ||
2818 | #ifdef __NR_perf_event_open | ||
2819 | {"perf_event_open", __NR_perf_event_open}, | ||
2820 | #endif | ||
2821 | #endif | ||
2822 | #ifdef SYS_personality | ||
2823 | #ifdef __NR_personality | ||
2824 | {"personality", __NR_personality}, | ||
2825 | #endif | ||
2826 | #endif | ||
2827 | #ifdef SYS_pipe | ||
2828 | #ifdef __NR_pipe | ||
2829 | {"pipe", __NR_pipe}, | ||
2830 | #endif | ||
2831 | #endif | ||
2832 | #ifdef SYS_pipe2 | ||
2833 | #ifdef __NR_pipe2 | ||
2834 | {"pipe2", __NR_pipe2}, | ||
2835 | #endif | ||
2836 | #endif | ||
2837 | #ifdef SYS_pivot_root | ||
2838 | #ifdef __NR_pivot_root | ||
2839 | {"pivot_root", __NR_pivot_root}, | ||
2840 | #endif | ||
2841 | #endif | ||
2842 | #ifdef SYS_pkey_alloc | ||
2843 | #ifdef __NR_pkey_alloc | ||
2844 | {"pkey_alloc", __NR_pkey_alloc}, | ||
2845 | #endif | ||
2846 | #endif | ||
2847 | #ifdef SYS_pkey_free | ||
2848 | #ifdef __NR_pkey_free | ||
2849 | {"pkey_free", __NR_pkey_free}, | ||
2850 | #endif | ||
2851 | #endif | ||
2852 | #ifdef SYS_pkey_mprotect | ||
2853 | #ifdef __NR_pkey_mprotect | ||
2854 | {"pkey_mprotect", __NR_pkey_mprotect}, | ||
2855 | #endif | ||
2856 | #endif | ||
2857 | #ifdef SYS_poll | ||
2858 | #ifdef __NR_poll | ||
2859 | {"poll", __NR_poll}, | ||
2860 | #endif | ||
2861 | #endif | ||
2862 | #ifdef SYS_ppoll | ||
2863 | #ifdef __NR_ppoll | ||
2864 | {"ppoll", __NR_ppoll}, | ||
2865 | #endif | ||
2866 | #endif | ||
2867 | #ifdef SYS_prctl | ||
2868 | #ifdef __NR_prctl | ||
2869 | {"prctl", __NR_prctl}, | ||
2870 | #endif | ||
2871 | #endif | ||
2872 | #ifdef SYS_pread64 | ||
2873 | #ifdef __NR_pread64 | ||
2874 | {"pread64", __NR_pread64}, | ||
2875 | #endif | ||
2876 | #endif | ||
2877 | #ifdef SYS_preadv | ||
2878 | #ifdef __NR_preadv | ||
2879 | {"preadv", __NR_preadv}, | ||
2880 | #endif | ||
2881 | #endif | ||
2882 | #ifdef SYS_preadv2 | ||
2883 | #ifdef __NR_preadv2 | ||
2884 | {"preadv2", __NR_preadv2}, | ||
2885 | #endif | ||
2886 | #endif | ||
2887 | #ifdef SYS_prlimit64 | ||
2888 | #ifdef __NR_prlimit64 | ||
2889 | {"prlimit64", __NR_prlimit64}, | ||
2890 | #endif | ||
2891 | #endif | ||
2892 | #ifdef SYS_process_vm_readv | ||
2893 | #ifdef __NR_process_vm_readv | ||
2894 | {"process_vm_readv", __NR_process_vm_readv}, | ||
2895 | #endif | ||
2896 | #endif | ||
2897 | #ifdef SYS_process_vm_writev | ||
2898 | #ifdef __NR_process_vm_writev | ||
2899 | {"process_vm_writev", __NR_process_vm_writev}, | ||
2900 | #endif | ||
2901 | #endif | ||
2902 | #ifdef SYS_pselect6 | ||
2903 | #ifdef __NR_pselect6 | ||
2904 | {"pselect6", __NR_pselect6}, | ||
2905 | #endif | ||
2906 | #endif | ||
2907 | #ifdef SYS_ptrace | ||
2908 | #ifdef __NR_ptrace | ||
2909 | {"ptrace", __NR_ptrace}, | ||
2910 | #endif | ||
2911 | #endif | ||
2912 | #ifdef SYS_putpmsg | ||
2913 | #ifdef __NR_putpmsg | ||
2914 | {"putpmsg", __NR_putpmsg}, | ||
2915 | #endif | ||
2916 | #endif | ||
2917 | #ifdef SYS_pwrite64 | ||
2918 | #ifdef __NR_pwrite64 | ||
2919 | {"pwrite64", __NR_pwrite64}, | ||
2920 | #endif | ||
2921 | #endif | ||
2922 | #ifdef SYS_pwritev | ||
2923 | #ifdef __NR_pwritev | ||
2924 | {"pwritev", __NR_pwritev}, | ||
2925 | #endif | ||
2926 | #endif | ||
2927 | #ifdef SYS_pwritev2 | ||
2928 | #ifdef __NR_pwritev2 | ||
2929 | {"pwritev2", __NR_pwritev2}, | ||
2930 | #endif | ||
2931 | #endif | ||
2932 | #ifdef SYS_query_module | ||
2933 | #ifdef __NR_query_module | ||
2934 | {"query_module", __NR_query_module}, | ||
2935 | #endif | ||
2936 | #endif | ||
2937 | #ifdef SYS_quotactl | ||
2938 | #ifdef __NR_quotactl | ||
2939 | {"quotactl", __NR_quotactl}, | ||
2940 | #endif | ||
2941 | #endif | ||
2942 | #ifdef SYS_read | ||
2943 | #ifdef __NR_read | ||
2944 | {"read", __NR_read}, | ||
2945 | #endif | ||
2946 | #endif | ||
2947 | #ifdef SYS_readahead | ||
2948 | #ifdef __NR_readahead | ||
2949 | {"readahead", __NR_readahead}, | ||
2950 | #endif | ||
2951 | #endif | ||
2952 | #ifdef SYS_readlink | ||
2953 | #ifdef __NR_readlink | ||
2954 | {"readlink", __NR_readlink}, | ||
2955 | #endif | ||
2956 | #endif | ||
2957 | #ifdef SYS_readlinkat | ||
2958 | #ifdef __NR_readlinkat | ||
2959 | {"readlinkat", __NR_readlinkat}, | ||
2960 | #endif | ||
2961 | #endif | ||
2962 | #ifdef SYS_readv | ||
2963 | #ifdef __NR_readv | ||
2964 | {"readv", __NR_readv}, | ||
2965 | #endif | ||
2966 | #endif | ||
2967 | #ifdef SYS_reboot | ||
2968 | #ifdef __NR_reboot | ||
2969 | {"reboot", __NR_reboot}, | ||
2970 | #endif | ||
2971 | #endif | ||
2972 | #ifdef SYS_recvfrom | ||
2973 | #ifdef __NR_recvfrom | ||
2974 | {"recvfrom", __NR_recvfrom}, | ||
2975 | #endif | ||
2976 | #endif | ||
2977 | #ifdef SYS_recvmmsg | ||
2978 | #ifdef __NR_recvmmsg | ||
2979 | {"recvmmsg", __NR_recvmmsg}, | ||
2980 | #endif | ||
2981 | #endif | ||
2982 | #ifdef SYS_recvmsg | ||
2983 | #ifdef __NR_recvmsg | ||
2984 | {"recvmsg", __NR_recvmsg}, | ||
2985 | #endif | ||
2986 | #endif | ||
2987 | #ifdef SYS_remap_file_pages | ||
2988 | #ifdef __NR_remap_file_pages | ||
2989 | {"remap_file_pages", __NR_remap_file_pages}, | ||
2990 | #endif | ||
2991 | #endif | ||
2992 | #ifdef SYS_removexattr | ||
2993 | #ifdef __NR_removexattr | ||
2994 | {"removexattr", __NR_removexattr}, | ||
2995 | #endif | ||
2996 | #endif | ||
2997 | #ifdef SYS_rename | ||
2998 | #ifdef __NR_rename | ||
2999 | {"rename", __NR_rename}, | ||
3000 | #endif | ||
3001 | #endif | ||
3002 | #ifdef SYS_renameat | ||
3003 | #ifdef __NR_renameat | ||
3004 | {"renameat", __NR_renameat}, | ||
3005 | #endif | ||
3006 | #endif | ||
3007 | #ifdef SYS_renameat2 | ||
3008 | #ifdef __NR_renameat2 | ||
3009 | {"renameat2", __NR_renameat2}, | ||
3010 | #endif | ||
3011 | #endif | ||
3012 | #ifdef SYS_request_key | ||
3013 | #ifdef __NR_request_key | ||
3014 | {"request_key", __NR_request_key}, | ||
3015 | #endif | ||
3016 | #endif | ||
3017 | #ifdef SYS_restart_syscall | ||
3018 | #ifdef __NR_restart_syscall | ||
3019 | {"restart_syscall", __NR_restart_syscall}, | ||
3020 | #endif | ||
3021 | #endif | ||
3022 | #ifdef SYS_rmdir | ||
3023 | #ifdef __NR_rmdir | ||
3024 | {"rmdir", __NR_rmdir}, | ||
3025 | #endif | ||
3026 | #endif | ||
3027 | #ifdef SYS_rt_sigaction | ||
3028 | #ifdef __NR_rt_sigaction | ||
3029 | {"rt_sigaction", __NR_rt_sigaction}, | ||
3030 | #endif | ||
3031 | #endif | ||
3032 | #ifdef SYS_rt_sigpending | ||
3033 | #ifdef __NR_rt_sigpending | ||
3034 | {"rt_sigpending", __NR_rt_sigpending}, | ||
3035 | #endif | ||
3036 | #endif | ||
3037 | #ifdef SYS_rt_sigprocmask | ||
3038 | #ifdef __NR_rt_sigprocmask | ||
3039 | {"rt_sigprocmask", __NR_rt_sigprocmask}, | ||
3040 | #endif | ||
3041 | #endif | ||
3042 | #ifdef SYS_rt_sigqueueinfo | ||
3043 | #ifdef __NR_rt_sigqueueinfo | ||
3044 | {"rt_sigqueueinfo", __NR_rt_sigqueueinfo}, | ||
3045 | #endif | ||
3046 | #endif | ||
3047 | #ifdef SYS_rt_sigreturn | ||
3048 | #ifdef __NR_rt_sigreturn | ||
3049 | {"rt_sigreturn", __NR_rt_sigreturn}, | ||
3050 | #endif | ||
3051 | #endif | ||
3052 | #ifdef SYS_rt_sigsuspend | ||
3053 | #ifdef __NR_rt_sigsuspend | ||
3054 | {"rt_sigsuspend", __NR_rt_sigsuspend}, | ||
3055 | #endif | ||
3056 | #endif | ||
3057 | #ifdef SYS_rt_sigtimedwait | ||
3058 | #ifdef __NR_rt_sigtimedwait | ||
3059 | {"rt_sigtimedwait", __NR_rt_sigtimedwait}, | ||
3060 | #endif | ||
3061 | #endif | ||
3062 | #ifdef SYS_rt_tgsigqueueinfo | ||
3063 | #ifdef __NR_rt_tgsigqueueinfo | ||
3064 | {"rt_tgsigqueueinfo", __NR_rt_tgsigqueueinfo}, | ||
3065 | #endif | ||
3066 | #endif | ||
3067 | #ifdef SYS_sched_get_priority_max | ||
3068 | #ifdef __NR_sched_get_priority_max | ||
3069 | {"sched_get_priority_max", __NR_sched_get_priority_max}, | ||
3070 | #endif | ||
3071 | #endif | ||
3072 | #ifdef SYS_sched_get_priority_min | ||
3073 | #ifdef __NR_sched_get_priority_min | ||
3074 | {"sched_get_priority_min", __NR_sched_get_priority_min}, | ||
3075 | #endif | ||
3076 | #endif | ||
3077 | #ifdef SYS_sched_getaffinity | ||
3078 | #ifdef __NR_sched_getaffinity | ||
3079 | {"sched_getaffinity", __NR_sched_getaffinity}, | ||
3080 | #endif | ||
3081 | #endif | ||
3082 | #ifdef SYS_sched_getattr | ||
3083 | #ifdef __NR_sched_getattr | ||
3084 | {"sched_getattr", __NR_sched_getattr}, | ||
3085 | #endif | ||
3086 | #endif | ||
3087 | #ifdef SYS_sched_getparam | ||
3088 | #ifdef __NR_sched_getparam | ||
3089 | {"sched_getparam", __NR_sched_getparam}, | ||
3090 | #endif | ||
3091 | #endif | ||
3092 | #ifdef SYS_sched_getscheduler | ||
3093 | #ifdef __NR_sched_getscheduler | ||
3094 | {"sched_getscheduler", __NR_sched_getscheduler}, | ||
3095 | #endif | ||
3096 | #endif | ||
3097 | #ifdef SYS_sched_rr_get_interval | ||
3098 | #ifdef __NR_sched_rr_get_interval | ||
3099 | {"sched_rr_get_interval", __NR_sched_rr_get_interval}, | ||
3100 | #endif | ||
3101 | #endif | ||
3102 | #ifdef SYS_sched_setaffinity | ||
3103 | #ifdef __NR_sched_setaffinity | ||
3104 | {"sched_setaffinity", __NR_sched_setaffinity}, | ||
3105 | #endif | ||
3106 | #endif | ||
3107 | #ifdef SYS_sched_setattr | ||
3108 | #ifdef __NR_sched_setattr | ||
3109 | {"sched_setattr", __NR_sched_setattr}, | ||
3110 | #endif | ||
3111 | #endif | ||
3112 | #ifdef SYS_sched_setparam | ||
3113 | #ifdef __NR_sched_setparam | ||
3114 | {"sched_setparam", __NR_sched_setparam}, | ||
3115 | #endif | ||
3116 | #endif | ||
3117 | #ifdef SYS_sched_setscheduler | ||
3118 | #ifdef __NR_sched_setscheduler | ||
3119 | {"sched_setscheduler", __NR_sched_setscheduler}, | ||
3120 | #endif | ||
3121 | #endif | ||
3122 | #ifdef SYS_sched_yield | ||
3123 | #ifdef __NR_sched_yield | ||
3124 | {"sched_yield", __NR_sched_yield}, | ||
3125 | #endif | ||
3126 | #endif | ||
3127 | #ifdef SYS_seccomp | ||
3128 | #ifdef __NR_seccomp | ||
3129 | {"seccomp", __NR_seccomp}, | ||
3130 | #endif | ||
3131 | #endif | ||
3132 | #ifdef SYS_security | ||
3133 | #ifdef __NR_security | ||
3134 | {"security", __NR_security}, | ||
3135 | #endif | ||
3136 | #endif | ||
3137 | #ifdef SYS_select | ||
3138 | #ifdef __NR_select | ||
3139 | {"select", __NR_select}, | ||
3140 | #endif | ||
3141 | #endif | ||
3142 | #ifdef SYS_semctl | ||
3143 | #ifdef __NR_semctl | ||
3144 | {"semctl", __NR_semctl}, | ||
3145 | #endif | ||
3146 | #endif | ||
3147 | #ifdef SYS_semget | ||
3148 | #ifdef __NR_semget | ||
3149 | {"semget", __NR_semget}, | ||
3150 | #endif | ||
3151 | #endif | ||
3152 | #ifdef SYS_semop | ||
3153 | #ifdef __NR_semop | ||
3154 | {"semop", __NR_semop}, | ||
3155 | #endif | ||
3156 | #endif | ||
3157 | #ifdef SYS_semtimedop | ||
3158 | #ifdef __NR_semtimedop | ||
3159 | {"semtimedop", __NR_semtimedop}, | ||
3160 | #endif | ||
3161 | #endif | ||
3162 | #ifdef SYS_sendfile | ||
3163 | #ifdef __NR_sendfile | ||
3164 | {"sendfile", __NR_sendfile}, | ||
3165 | #endif | ||
3166 | #endif | ||
3167 | #ifdef SYS_sendmmsg | ||
3168 | #ifdef __NR_sendmmsg | ||
3169 | {"sendmmsg", __NR_sendmmsg}, | ||
3170 | #endif | ||
3171 | #endif | ||
3172 | #ifdef SYS_sendmsg | ||
3173 | #ifdef __NR_sendmsg | ||
3174 | {"sendmsg", __NR_sendmsg}, | ||
3175 | #endif | ||
3176 | #endif | ||
3177 | #ifdef SYS_sendto | ||
3178 | #ifdef __NR_sendto | ||
3179 | {"sendto", __NR_sendto}, | ||
3180 | #endif | ||
3181 | #endif | ||
3182 | #ifdef SYS_set_mempolicy | ||
3183 | #ifdef __NR_set_mempolicy | ||
3184 | {"set_mempolicy", __NR_set_mempolicy}, | ||
3185 | #endif | ||
3186 | #endif | ||
3187 | #ifdef SYS_set_robust_list | ||
3188 | #ifdef __NR_set_robust_list | ||
3189 | {"set_robust_list", __NR_set_robust_list}, | ||
3190 | #endif | ||
3191 | #endif | ||
3192 | #ifdef SYS_set_thread_area | ||
3193 | #ifdef __NR_set_thread_area | ||
3194 | {"set_thread_area", __NR_set_thread_area}, | ||
3195 | #endif | ||
3196 | #endif | ||
3197 | #ifdef SYS_set_tid_address | ||
3198 | #ifdef __NR_set_tid_address | ||
3199 | {"set_tid_address", __NR_set_tid_address}, | ||
3200 | #endif | ||
3201 | #endif | ||
3202 | #ifdef SYS_setdomainname | ||
3203 | #ifdef __NR_setdomainname | ||
3204 | {"setdomainname", __NR_setdomainname}, | ||
3205 | #endif | ||
3206 | #endif | ||
3207 | #ifdef SYS_setfsgid | ||
3208 | #ifdef __NR_setfsgid | ||
3209 | {"setfsgid", __NR_setfsgid}, | ||
3210 | #endif | ||
3211 | #endif | ||
3212 | #ifdef SYS_setfsuid | ||
3213 | #ifdef __NR_setfsuid | ||
3214 | {"setfsuid", __NR_setfsuid}, | ||
3215 | #endif | ||
3216 | #endif | ||
3217 | #ifdef SYS_setgid | ||
3218 | #ifdef __NR_setgid | ||
3219 | {"setgid", __NR_setgid}, | ||
3220 | #endif | ||
3221 | #endif | ||
3222 | #ifdef SYS_setgroups | ||
3223 | #ifdef __NR_setgroups | ||
3224 | {"setgroups", __NR_setgroups}, | ||
3225 | #endif | ||
3226 | #endif | ||
3227 | #ifdef SYS_sethostname | ||
3228 | #ifdef __NR_sethostname | ||
3229 | {"sethostname", __NR_sethostname}, | ||
3230 | #endif | ||
3231 | #endif | ||
3232 | #ifdef SYS_setitimer | ||
3233 | #ifdef __NR_setitimer | ||
3234 | {"setitimer", __NR_setitimer}, | ||
3235 | #endif | ||
3236 | #endif | ||
3237 | #ifdef SYS_setns | ||
3238 | #ifdef __NR_setns | ||
3239 | {"setns", __NR_setns}, | ||
3240 | #endif | ||
3241 | #endif | ||
3242 | #ifdef SYS_setpgid | ||
3243 | #ifdef __NR_setpgid | ||
3244 | {"setpgid", __NR_setpgid}, | ||
3245 | #endif | ||
3246 | #endif | ||
3247 | #ifdef SYS_setpriority | ||
3248 | #ifdef __NR_setpriority | ||
3249 | {"setpriority", __NR_setpriority}, | ||
3250 | #endif | ||
3251 | #endif | ||
3252 | #ifdef SYS_setregid | ||
3253 | #ifdef __NR_setregid | ||
3254 | {"setregid", __NR_setregid}, | ||
3255 | #endif | ||
3256 | #endif | ||
3257 | #ifdef SYS_setresgid | ||
3258 | #ifdef __NR_setresgid | ||
3259 | {"setresgid", __NR_setresgid}, | ||
3260 | #endif | ||
3261 | #endif | ||
3262 | #ifdef SYS_setresuid | ||
3263 | #ifdef __NR_setresuid | ||
3264 | {"setresuid", __NR_setresuid}, | ||
3265 | #endif | ||
3266 | #endif | ||
3267 | #ifdef SYS_setreuid | ||
3268 | #ifdef __NR_setreuid | ||
3269 | {"setreuid", __NR_setreuid}, | ||
3270 | #endif | ||
3271 | #endif | ||
3272 | #ifdef SYS_setrlimit | ||
3273 | #ifdef __NR_setrlimit | ||
3274 | {"setrlimit", __NR_setrlimit}, | ||
3275 | #endif | ||
3276 | #endif | ||
3277 | #ifdef SYS_setsid | ||
3278 | #ifdef __NR_setsid | ||
3279 | {"setsid", __NR_setsid}, | ||
3280 | #endif | ||
3281 | #endif | ||
3282 | #ifdef SYS_setsockopt | ||
3283 | #ifdef __NR_setsockopt | ||
3284 | {"setsockopt", __NR_setsockopt}, | ||
3285 | #endif | ||
3286 | #endif | ||
3287 | #ifdef SYS_settimeofday | ||
3288 | #ifdef __NR_settimeofday | ||
3289 | {"settimeofday", __NR_settimeofday}, | ||
3290 | #endif | ||
3291 | #endif | ||
3292 | #ifdef SYS_setuid | ||
3293 | #ifdef __NR_setuid | ||
3294 | {"setuid", __NR_setuid}, | ||
3295 | #endif | ||
3296 | #endif | ||
3297 | #ifdef SYS_setxattr | ||
3298 | #ifdef __NR_setxattr | ||
3299 | {"setxattr", __NR_setxattr}, | ||
3300 | #endif | ||
3301 | #endif | ||
3302 | #ifdef SYS_shmat | ||
3303 | #ifdef __NR_shmat | ||
3304 | {"shmat", __NR_shmat}, | ||
3305 | #endif | ||
3306 | #endif | ||
3307 | #ifdef SYS_shmctl | ||
3308 | #ifdef __NR_shmctl | ||
3309 | {"shmctl", __NR_shmctl}, | ||
3310 | #endif | ||
3311 | #endif | ||
3312 | #ifdef SYS_shmdt | ||
3313 | #ifdef __NR_shmdt | ||
3314 | {"shmdt", __NR_shmdt}, | ||
3315 | #endif | ||
3316 | #endif | ||
3317 | #ifdef SYS_shmget | ||
3318 | #ifdef __NR_shmget | ||
3319 | {"shmget", __NR_shmget}, | ||
3320 | #endif | ||
3321 | #endif | ||
3322 | #ifdef SYS_shutdown | ||
3323 | #ifdef __NR_shutdown | ||
3324 | {"shutdown", __NR_shutdown}, | ||
3325 | #endif | ||
3326 | #endif | ||
3327 | #ifdef SYS_sigaltstack | ||
3328 | #ifdef __NR_sigaltstack | ||
3329 | {"sigaltstack", __NR_sigaltstack}, | ||
3330 | #endif | ||
3331 | #endif | ||
3332 | #ifdef SYS_signalfd | ||
3333 | #ifdef __NR_signalfd | ||
3334 | {"signalfd", __NR_signalfd}, | ||
3335 | #endif | ||
3336 | #endif | ||
3337 | #ifdef SYS_signalfd4 | ||
3338 | #ifdef __NR_signalfd4 | ||
3339 | {"signalfd4", __NR_signalfd4}, | ||
3340 | #endif | ||
3341 | #endif | ||
3342 | #ifdef SYS_socket | ||
3343 | #ifdef __NR_socket | ||
3344 | {"socket", __NR_socket}, | ||
3345 | #endif | ||
3346 | #endif | ||
3347 | #ifdef SYS_socketpair | ||
3348 | #ifdef __NR_socketpair | ||
3349 | {"socketpair", __NR_socketpair}, | ||
3350 | #endif | ||
3351 | #endif | ||
3352 | #ifdef SYS_splice | ||
3353 | #ifdef __NR_splice | ||
3354 | {"splice", __NR_splice}, | ||
3355 | #endif | ||
3356 | #endif | ||
3357 | #ifdef SYS_stat | ||
3358 | #ifdef __NR_stat | ||
3359 | {"stat", __NR_stat}, | ||
3360 | #endif | ||
3361 | #endif | ||
3362 | #ifdef SYS_statfs | ||
3363 | #ifdef __NR_statfs | ||
3364 | {"statfs", __NR_statfs}, | ||
3365 | #endif | ||
3366 | #endif | ||
3367 | #ifdef SYS_statx | ||
3368 | #ifdef __NR_statx | ||
3369 | {"statx", __NR_statx}, | ||
3370 | #endif | ||
3371 | #endif | ||
3372 | #ifdef SYS_swapoff | ||
3373 | #ifdef __NR_swapoff | ||
3374 | {"swapoff", __NR_swapoff}, | ||
3375 | #endif | ||
3376 | #endif | ||
3377 | #ifdef SYS_swapon | ||
3378 | #ifdef __NR_swapon | ||
3379 | {"swapon", __NR_swapon}, | ||
3380 | #endif | ||
3381 | #endif | ||
3382 | #ifdef SYS_symlink | ||
3383 | #ifdef __NR_symlink | ||
3384 | {"symlink", __NR_symlink}, | ||
3385 | #endif | ||
3386 | #endif | ||
3387 | #ifdef SYS_symlinkat | ||
3388 | #ifdef __NR_symlinkat | ||
3389 | {"symlinkat", __NR_symlinkat}, | ||
3390 | #endif | ||
3391 | #endif | ||
3392 | #ifdef SYS_sync | ||
3393 | #ifdef __NR_sync | ||
3394 | {"sync", __NR_sync}, | ||
3395 | #endif | ||
3396 | #endif | ||
3397 | #ifdef SYS_sync_file_range | ||
3398 | #ifdef __NR_sync_file_range | ||
3399 | {"sync_file_range", __NR_sync_file_range}, | ||
3400 | #endif | ||
3401 | #endif | ||
3402 | #ifdef SYS_syncfs | ||
3403 | #ifdef __NR_syncfs | ||
3404 | {"syncfs", __NR_syncfs}, | ||
3405 | #endif | ||
3406 | #endif | ||
3407 | #ifdef SYS_sysfs | ||
3408 | #ifdef __NR_sysfs | ||
3409 | {"sysfs", __NR_sysfs}, | ||
3410 | #endif | ||
3411 | #endif | ||
3412 | #ifdef SYS_sysinfo | ||
3413 | #ifdef __NR_sysinfo | ||
3414 | {"sysinfo", __NR_sysinfo}, | ||
3415 | #endif | ||
3416 | #endif | ||
3417 | #ifdef SYS_syslog | ||
3418 | #ifdef __NR_syslog | ||
3419 | {"syslog", __NR_syslog}, | ||
3420 | #endif | ||
3421 | #endif | ||
3422 | #ifdef SYS_tee | ||
3423 | #ifdef __NR_tee | ||
3424 | {"tee", __NR_tee}, | ||
3425 | #endif | ||
3426 | #endif | ||
3427 | #ifdef SYS_tgkill | ||
3428 | #ifdef __NR_tgkill | ||
3429 | {"tgkill", __NR_tgkill}, | ||
3430 | #endif | ||
3431 | #endif | ||
3432 | #ifdef SYS_time | ||
3433 | #ifdef __NR_time | ||
3434 | {"time", __NR_time}, | ||
3435 | #endif | ||
3436 | #endif | ||
3437 | #ifdef SYS_timer_create | ||
3438 | #ifdef __NR_timer_create | ||
3439 | {"timer_create", __NR_timer_create}, | ||
3440 | #endif | ||
3441 | #endif | ||
3442 | #ifdef SYS_timer_delete | ||
3443 | #ifdef __NR_timer_delete | ||
3444 | {"timer_delete", __NR_timer_delete}, | ||
3445 | #endif | ||
3446 | #endif | ||
3447 | #ifdef SYS_timer_getoverrun | ||
3448 | #ifdef __NR_timer_getoverrun | ||
3449 | {"timer_getoverrun", __NR_timer_getoverrun}, | ||
3450 | #endif | ||
3451 | #endif | ||
3452 | #ifdef SYS_timer_gettime | ||
3453 | #ifdef __NR_timer_gettime | ||
3454 | {"timer_gettime", __NR_timer_gettime}, | ||
3455 | #endif | ||
3456 | #endif | ||
3457 | #ifdef SYS_timer_settime | ||
3458 | #ifdef __NR_timer_settime | ||
3459 | {"timer_settime", __NR_timer_settime}, | ||
3460 | #endif | ||
3461 | #endif | ||
3462 | #ifdef SYS_timerfd_create | ||
3463 | #ifdef __NR_timerfd_create | ||
3464 | {"timerfd_create", __NR_timerfd_create}, | ||
3465 | #endif | ||
3466 | #endif | ||
3467 | #ifdef SYS_timerfd_gettime | ||
3468 | #ifdef __NR_timerfd_gettime | ||
3469 | {"timerfd_gettime", __NR_timerfd_gettime}, | ||
3470 | #endif | ||
3471 | #endif | ||
3472 | #ifdef SYS_timerfd_settime | ||
3473 | #ifdef __NR_timerfd_settime | ||
3474 | {"timerfd_settime", __NR_timerfd_settime}, | ||
3475 | #endif | ||
3476 | #endif | ||
3477 | #ifdef SYS_times | ||
3478 | #ifdef __NR_times | ||
3479 | {"times", __NR_times}, | ||
3480 | #endif | ||
3481 | #endif | ||
3482 | #ifdef SYS_tkill | ||
3483 | #ifdef __NR_tkill | ||
3484 | {"tkill", __NR_tkill}, | ||
3485 | #endif | ||
3486 | #endif | ||
3487 | #ifdef SYS_truncate | ||
3488 | #ifdef __NR_truncate | ||
3489 | {"truncate", __NR_truncate}, | ||
3490 | #endif | ||
3491 | #endif | ||
3492 | #ifdef SYS_tuxcall | ||
3493 | #ifdef __NR_tuxcall | ||
3494 | {"tuxcall", __NR_tuxcall}, | ||
3495 | #endif | ||
3496 | #endif | ||
3497 | #ifdef SYS_umask | ||
3498 | #ifdef __NR_umask | ||
3499 | {"umask", __NR_umask}, | ||
3500 | #endif | ||
3501 | #endif | ||
3502 | #ifdef SYS_umount2 | ||
3503 | #ifdef __NR_umount2 | ||
3504 | {"umount2", __NR_umount2}, | ||
3505 | #endif | ||
3506 | #endif | ||
3507 | #ifdef SYS_uname | ||
3508 | #ifdef __NR_uname | ||
3509 | {"uname", __NR_uname}, | ||
3510 | #endif | ||
3511 | #endif | ||
3512 | #ifdef SYS_unlink | ||
3513 | #ifdef __NR_unlink | ||
3514 | {"unlink", __NR_unlink}, | ||
3515 | #endif | ||
3516 | #endif | ||
3517 | #ifdef SYS_unlinkat | ||
3518 | #ifdef __NR_unlinkat | ||
3519 | {"unlinkat", __NR_unlinkat}, | ||
3520 | #endif | ||
3521 | #endif | ||
3522 | #ifdef SYS_unshare | ||
3523 | #ifdef __NR_unshare | ||
3524 | {"unshare", __NR_unshare}, | ||
3525 | #endif | ||
3526 | #endif | ||
3527 | #ifdef SYS_uselib | ||
3528 | #ifdef __NR_uselib | ||
3529 | {"uselib", __NR_uselib}, | ||
3530 | #endif | ||
3531 | #endif | ||
3532 | #ifdef SYS_userfaultfd | ||
3533 | #ifdef __NR_userfaultfd | ||
3534 | {"userfaultfd", __NR_userfaultfd}, | ||
3535 | #endif | ||
3536 | #endif | ||
3537 | #ifdef SYS_ustat | ||
3538 | #ifdef __NR_ustat | ||
3539 | {"ustat", __NR_ustat}, | ||
3540 | #endif | ||
3541 | #endif | ||
3542 | #ifdef SYS_utime | ||
3543 | #ifdef __NR_utime | ||
3544 | {"utime", __NR_utime}, | ||
3545 | #endif | ||
3546 | #endif | ||
3547 | #ifdef SYS_utimensat | ||
3548 | #ifdef __NR_utimensat | ||
3549 | {"utimensat", __NR_utimensat}, | ||
3550 | #endif | ||
3551 | #endif | ||
3552 | #ifdef SYS_utimes | ||
3553 | #ifdef __NR_utimes | ||
3554 | {"utimes", __NR_utimes}, | ||
3555 | #endif | ||
3556 | #endif | ||
3557 | #ifdef SYS_vfork | ||
3558 | #ifdef __NR_vfork | ||
3559 | {"vfork", __NR_vfork}, | ||
3560 | #endif | ||
3561 | #endif | ||
3562 | #ifdef SYS_vhangup | ||
3563 | #ifdef __NR_vhangup | ||
3564 | {"vhangup", __NR_vhangup}, | ||
3565 | #endif | ||
3566 | #endif | ||
3567 | #ifdef SYS_vmsplice | ||
3568 | #ifdef __NR_vmsplice | ||
3569 | {"vmsplice", __NR_vmsplice}, | ||
3570 | #endif | ||
3571 | #endif | ||
3572 | #ifdef SYS_vserver | ||
3573 | #ifdef __NR_vserver | ||
3574 | {"vserver", __NR_vserver}, | ||
3575 | #endif | ||
3576 | #endif | ||
3577 | #ifdef SYS_wait4 | ||
3578 | #ifdef __NR_wait4 | ||
3579 | {"wait4", __NR_wait4}, | ||
3580 | #endif | ||
3581 | #endif | ||
3582 | #ifdef SYS_waitid | ||
3583 | #ifdef __NR_waitid | ||
3584 | {"waitid", __NR_waitid}, | ||
3585 | #endif | ||
3586 | #endif | ||
3587 | #ifdef SYS_write | ||
3588 | #ifdef __NR_write | ||
3589 | {"write", __NR_write}, | ||
3590 | #endif | ||
3591 | #endif | ||
3592 | #ifdef SYS_writev | ||
3593 | #ifdef __NR_writev | ||
3594 | {"writev", __NR_writev}, | ||
3595 | #endif | ||
3596 | #endif | ||
3597 | #endif | ||
3598 | //#endif | ||
3599 | #if defined __x86_64__ && defined __ILP32__ | ||
3600 | #ifdef SYS_accept | ||
3601 | #ifdef __NR_accept | ||
3602 | {"accept", __NR_accept}, | ||
3603 | #endif | ||
3604 | #endif | ||
3605 | #ifdef SYS_accept4 | ||
3606 | #ifdef __NR_accept4 | ||
3607 | {"accept4", __NR_accept4}, | ||
3608 | #endif | ||
3609 | #endif | ||
3610 | #ifdef SYS_access | ||
3611 | #ifdef __NR_access | ||
3612 | {"access", __NR_access}, | ||
3613 | #endif | ||
3614 | #endif | ||
3615 | #ifdef SYS_acct | ||
3616 | #ifdef __NR_acct | ||
3617 | {"acct", __NR_acct}, | ||
3618 | #endif | ||
3619 | #endif | ||
3620 | #ifdef SYS_add_key | ||
3621 | #ifdef __NR_add_key | ||
3622 | {"add_key", __NR_add_key}, | ||
3623 | #endif | ||
3624 | #endif | ||
3625 | #ifdef SYS_adjtimex | ||
3626 | #ifdef __NR_adjtimex | ||
3627 | {"adjtimex", __NR_adjtimex}, | ||
3628 | #endif | ||
3629 | #endif | ||
3630 | #ifdef SYS_afs_syscall | ||
3631 | #ifdef __NR_afs_syscall | ||
3632 | {"afs_syscall", __NR_afs_syscall}, | ||
3633 | #endif | ||
3634 | #endif | ||
3635 | #ifdef SYS_alarm | ||
3636 | #ifdef __NR_alarm | ||
3637 | {"alarm", __NR_alarm}, | ||
3638 | #endif | ||
3639 | #endif | ||
3640 | #ifdef SYS_arch_prctl | ||
3641 | #ifdef __NR_arch_prctl | ||
3642 | {"arch_prctl", __NR_arch_prctl}, | ||
3643 | #endif | ||
3644 | #endif | ||
3645 | #ifdef SYS_bind | ||
3646 | #ifdef __NR_bind | ||
3647 | {"bind", __NR_bind}, | ||
3648 | #endif | ||
3649 | #endif | ||
3650 | #ifdef SYS_bpf | ||
3651 | #ifdef __NR_bpf | ||
3652 | {"bpf", __NR_bpf}, | ||
3653 | #endif | ||
3654 | #endif | ||
3655 | #ifdef SYS_brk | ||
3656 | #ifdef __NR_brk | ||
3657 | {"brk", __NR_brk}, | ||
3658 | #endif | ||
3659 | #endif | ||
3660 | #ifdef SYS_capget | ||
3661 | #ifdef __NR_capget | ||
3662 | {"capget", __NR_capget}, | ||
3663 | #endif | ||
3664 | #endif | ||
3665 | #ifdef SYS_capset | ||
3666 | #ifdef __NR_capset | ||
3667 | {"capset", __NR_capset}, | ||
3668 | #endif | ||
3669 | #endif | ||
3670 | #ifdef SYS_chdir | ||
3671 | #ifdef __NR_chdir | ||
3672 | {"chdir", __NR_chdir}, | ||
3673 | #endif | ||
3674 | #endif | ||
3675 | #ifdef SYS_chmod | ||
3676 | #ifdef __NR_chmod | ||
3677 | {"chmod", __NR_chmod}, | ||
3678 | #endif | ||
3679 | #endif | ||
3680 | #ifdef SYS_chown | ||
3681 | #ifdef __NR_chown | ||
3682 | {"chown", __NR_chown}, | ||
3683 | #endif | ||
3684 | #endif | ||
3685 | #ifdef SYS_chroot | ||
3686 | #ifdef __NR_chroot | ||
3687 | {"chroot", __NR_chroot}, | ||
3688 | #endif | ||
3689 | #endif | ||
3690 | #ifdef SYS_clock_adjtime | ||
3691 | #ifdef __NR_clock_adjtime | ||
3692 | {"clock_adjtime", __NR_clock_adjtime}, | ||
3693 | #endif | ||
3694 | #endif | ||
3695 | #ifdef SYS_clock_getres | ||
3696 | #ifdef __NR_clock_getres | ||
3697 | {"clock_getres", __NR_clock_getres}, | ||
3698 | #endif | ||
3699 | #endif | ||
3700 | #ifdef SYS_clock_gettime | ||
3701 | #ifdef __NR_clock_gettime | ||
3702 | {"clock_gettime", __NR_clock_gettime}, | ||
3703 | #endif | ||
3704 | #endif | ||
3705 | #ifdef SYS_clock_nanosleep | ||
3706 | #ifdef __NR_clock_nanosleep | ||
3707 | {"clock_nanosleep", __NR_clock_nanosleep}, | ||
3708 | #endif | ||
3709 | #endif | ||
3710 | #ifdef SYS_clock_settime | ||
3711 | #ifdef __NR_clock_settime | ||
3712 | {"clock_settime", __NR_clock_settime}, | ||
3713 | #endif | ||
3714 | #endif | ||
3715 | #ifdef SYS_clone | ||
3716 | #ifdef __NR_clone | ||
3717 | {"clone", __NR_clone}, | ||
3718 | #endif | ||
3719 | #endif | ||
3720 | #ifdef SYS_close | ||
3721 | #ifdef __NR_close | ||
3722 | {"close", __NR_close}, | ||
3723 | #endif | ||
3724 | #endif | ||
3725 | #ifdef SYS_connect | ||
3726 | #ifdef __NR_connect | ||
3727 | {"connect", __NR_connect}, | ||
3728 | #endif | ||
3729 | #endif | ||
3730 | #ifdef SYS_copy_file_range | ||
3731 | #ifdef __NR_copy_file_range | ||
3732 | {"copy_file_range", __NR_copy_file_range}, | ||
3733 | #endif | ||
3734 | #endif | ||
3735 | #ifdef SYS_creat | ||
3736 | #ifdef __NR_creat | ||
3737 | {"creat", __NR_creat}, | ||
3738 | #endif | ||
3739 | #endif | ||
3740 | #ifdef SYS_delete_module | ||
3741 | #ifdef __NR_delete_module | ||
3742 | {"delete_module", __NR_delete_module}, | ||
3743 | #endif | ||
3744 | #endif | ||
3745 | #ifdef SYS_dup | ||
3746 | #ifdef __NR_dup | ||
3747 | {"dup", __NR_dup}, | ||
3748 | #endif | ||
3749 | #endif | ||
3750 | #ifdef SYS_dup2 | ||
3751 | #ifdef __NR_dup2 | ||
3752 | {"dup2", __NR_dup2}, | ||
3753 | #endif | ||
3754 | #endif | ||
3755 | #ifdef SYS_dup3 | ||
3756 | #ifdef __NR_dup3 | ||
3757 | {"dup3", __NR_dup3}, | ||
3758 | #endif | ||
3759 | #endif | ||
3760 | #ifdef SYS_epoll_create | ||
3761 | #ifdef __NR_epoll_create | ||
3762 | {"epoll_create", __NR_epoll_create}, | ||
3763 | #endif | ||
3764 | #endif | ||
3765 | #ifdef SYS_epoll_create1 | ||
3766 | #ifdef __NR_epoll_create1 | ||
3767 | {"epoll_create1", __NR_epoll_create1}, | ||
3768 | #endif | ||
3769 | #endif | ||
3770 | #ifdef SYS_epoll_ctl | ||
3771 | #ifdef __NR_epoll_ctl | ||
3772 | {"epoll_ctl", __NR_epoll_ctl}, | ||
3773 | #endif | ||
3774 | #endif | ||
3775 | #ifdef SYS_epoll_pwait | ||
3776 | #ifdef __NR_epoll_pwait | ||
3777 | {"epoll_pwait", __NR_epoll_pwait}, | ||
3778 | #endif | ||
3779 | #endif | ||
3780 | #ifdef SYS_epoll_wait | ||
3781 | #ifdef __NR_epoll_wait | ||
3782 | {"epoll_wait", __NR_epoll_wait}, | ||
3783 | #endif | ||
3784 | #endif | ||
3785 | #ifdef SYS_eventfd | ||
3786 | #ifdef __NR_eventfd | ||
3787 | {"eventfd", __NR_eventfd}, | ||
3788 | #endif | ||
3789 | #endif | ||
3790 | #ifdef SYS_eventfd2 | ||
3791 | #ifdef __NR_eventfd2 | ||
3792 | {"eventfd2", __NR_eventfd2}, | ||
3793 | #endif | ||
3794 | #endif | ||
3795 | #ifdef SYS_execve | ||
3796 | #ifdef __NR_execve | ||
3797 | {"execve", __NR_execve}, | ||
3798 | #endif | ||
3799 | #endif | ||
3800 | #ifdef SYS_execveat | ||
3801 | #ifdef __NR_execveat | ||
3802 | {"execveat", __NR_execveat}, | ||
3803 | #endif | ||
3804 | #endif | ||
3805 | #ifdef SYS_exit | ||
3806 | #ifdef __NR_exit | ||
3807 | {"exit", __NR_exit}, | ||
3808 | #endif | ||
3809 | #endif | ||
3810 | #ifdef SYS_exit_group | ||
3811 | #ifdef __NR_exit_group | ||
3812 | {"exit_group", __NR_exit_group}, | ||
3813 | #endif | ||
3814 | #endif | ||
3815 | #ifdef SYS_faccessat | ||
3816 | #ifdef __NR_faccessat | ||
3817 | {"faccessat", __NR_faccessat}, | ||
3818 | #endif | ||
3819 | #endif | ||
3820 | #ifdef SYS_fadvise64 | ||
3821 | #ifdef __NR_fadvise64 | ||
3822 | {"fadvise64", __NR_fadvise64}, | ||
3823 | #endif | ||
3824 | #endif | ||
3825 | #ifdef SYS_fallocate | ||
3826 | #ifdef __NR_fallocate | ||
3827 | {"fallocate", __NR_fallocate}, | ||
3828 | #endif | ||
3829 | #endif | ||
3830 | #ifdef SYS_fanotify_init | ||
3831 | #ifdef __NR_fanotify_init | ||
3832 | {"fanotify_init", __NR_fanotify_init}, | ||
3833 | #endif | ||
3834 | #endif | ||
3835 | #ifdef SYS_fanotify_mark | ||
3836 | #ifdef __NR_fanotify_mark | ||
3837 | {"fanotify_mark", __NR_fanotify_mark}, | ||
3838 | #endif | ||
3839 | #endif | ||
3840 | #ifdef SYS_fchdir | ||
3841 | #ifdef __NR_fchdir | ||
3842 | {"fchdir", __NR_fchdir}, | ||
3843 | #endif | ||
3844 | #endif | ||
3845 | #ifdef SYS_fchmod | ||
3846 | #ifdef __NR_fchmod | ||
3847 | {"fchmod", __NR_fchmod}, | ||
3848 | #endif | ||
3849 | #endif | ||
3850 | #ifdef SYS_fchmodat | ||
3851 | #ifdef __NR_fchmodat | ||
3852 | {"fchmodat", __NR_fchmodat}, | ||
3853 | #endif | ||
3854 | #endif | ||
3855 | #ifdef SYS_fchown | ||
3856 | #ifdef __NR_fchown | ||
3857 | {"fchown", __NR_fchown}, | ||
3858 | #endif | ||
3859 | #endif | ||
3860 | #ifdef SYS_fchownat | ||
3861 | #ifdef __NR_fchownat | ||
3862 | {"fchownat", __NR_fchownat}, | ||
3863 | #endif | ||
3864 | #endif | ||
3865 | #ifdef SYS_fcntl | ||
3866 | #ifdef __NR_fcntl | ||
3867 | {"fcntl", __NR_fcntl}, | ||
3868 | #endif | ||
3869 | #endif | ||
3870 | #ifdef SYS_fdatasync | ||
3871 | #ifdef __NR_fdatasync | ||
3872 | {"fdatasync", __NR_fdatasync}, | ||
3873 | #endif | ||
3874 | #endif | ||
3875 | #ifdef SYS_fgetxattr | ||
3876 | #ifdef __NR_fgetxattr | ||
3877 | {"fgetxattr", __NR_fgetxattr}, | ||
3878 | #endif | ||
3879 | #endif | ||
3880 | #ifdef SYS_finit_module | ||
3881 | #ifdef __NR_finit_module | ||
3882 | {"finit_module", __NR_finit_module}, | ||
3883 | #endif | ||
3884 | #endif | ||
3885 | #ifdef SYS_flistxattr | ||
3886 | #ifdef __NR_flistxattr | ||
3887 | {"flistxattr", __NR_flistxattr}, | ||
3888 | #endif | ||
3889 | #endif | ||
3890 | #ifdef SYS_flock | ||
3891 | #ifdef __NR_flock | ||
3892 | {"flock", __NR_flock}, | ||
3893 | #endif | ||
3894 | #endif | ||
3895 | #ifdef SYS_fork | ||
3896 | #ifdef __NR_fork | ||
3897 | {"fork", __NR_fork}, | ||
3898 | #endif | ||
3899 | #endif | ||
3900 | #ifdef SYS_fremovexattr | ||
3901 | #ifdef __NR_fremovexattr | ||
3902 | {"fremovexattr", __NR_fremovexattr}, | ||
3903 | #endif | ||
3904 | #endif | ||
3905 | #ifdef SYS_fsetxattr | ||
3906 | #ifdef __NR_fsetxattr | ||
3907 | {"fsetxattr", __NR_fsetxattr}, | ||
3908 | #endif | ||
3909 | #endif | ||
3910 | #ifdef SYS_fstat | ||
3911 | #ifdef __NR_fstat | ||
3912 | {"fstat", __NR_fstat}, | ||
3913 | #endif | ||
3914 | #endif | ||
3915 | #ifdef SYS_fstatfs | ||
3916 | #ifdef __NR_fstatfs | ||
3917 | {"fstatfs", __NR_fstatfs}, | ||
3918 | #endif | ||
3919 | #endif | ||
3920 | #ifdef SYS_fsync | ||
3921 | #ifdef __NR_fsync | ||
3922 | {"fsync", __NR_fsync}, | ||
3923 | #endif | ||
3924 | #endif | ||
3925 | #ifdef SYS_ftruncate | ||
3926 | #ifdef __NR_ftruncate | ||
3927 | {"ftruncate", __NR_ftruncate}, | ||
3928 | #endif | ||
3929 | #endif | ||
3930 | #ifdef SYS_futex | ||
3931 | #ifdef __NR_futex | ||
3932 | {"futex", __NR_futex}, | ||
3933 | #endif | ||
3934 | #endif | ||
3935 | #ifdef SYS_futimesat | ||
3936 | #ifdef __NR_futimesat | ||
3937 | {"futimesat", __NR_futimesat}, | ||
3938 | #endif | ||
3939 | #endif | ||
3940 | #ifdef SYS_get_mempolicy | ||
3941 | #ifdef __NR_get_mempolicy | ||
3942 | {"get_mempolicy", __NR_get_mempolicy}, | ||
3943 | #endif | ||
3944 | #endif | ||
3945 | #ifdef SYS_get_robust_list | ||
3946 | #ifdef __NR_get_robust_list | ||
3947 | {"get_robust_list", __NR_get_robust_list}, | ||
3948 | #endif | ||
3949 | #endif | ||
3950 | #ifdef SYS_getcpu | ||
3951 | #ifdef __NR_getcpu | ||
3952 | {"getcpu", __NR_getcpu}, | ||
3953 | #endif | ||
3954 | #endif | ||
3955 | #ifdef SYS_getcwd | ||
3956 | #ifdef __NR_getcwd | ||
3957 | {"getcwd", __NR_getcwd}, | ||
3958 | #endif | ||
3959 | #endif | ||
3960 | #ifdef SYS_getdents | ||
3961 | #ifdef __NR_getdents | ||
3962 | {"getdents", __NR_getdents}, | ||
3963 | #endif | ||
3964 | #endif | ||
3965 | #ifdef SYS_getdents64 | ||
3966 | #ifdef __NR_getdents64 | ||
3967 | {"getdents64", __NR_getdents64}, | ||
3968 | #endif | ||
3969 | #endif | ||
3970 | #ifdef SYS_getegid | ||
3971 | #ifdef __NR_getegid | ||
3972 | {"getegid", __NR_getegid}, | ||
3973 | #endif | ||
3974 | #endif | ||
3975 | #ifdef SYS_geteuid | ||
3976 | #ifdef __NR_geteuid | ||
3977 | {"geteuid", __NR_geteuid}, | ||
3978 | #endif | ||
3979 | #endif | ||
3980 | #ifdef SYS_getgid | ||
3981 | #ifdef __NR_getgid | ||
3982 | {"getgid", __NR_getgid}, | ||
3983 | #endif | ||
3984 | #endif | ||
3985 | #ifdef SYS_getgroups | ||
3986 | #ifdef __NR_getgroups | ||
3987 | {"getgroups", __NR_getgroups}, | ||
3988 | #endif | ||
3989 | #endif | ||
3990 | #ifdef SYS_getitimer | ||
3991 | #ifdef __NR_getitimer | ||
3992 | {"getitimer", __NR_getitimer}, | ||
3993 | #endif | ||
3994 | #endif | ||
3995 | #ifdef SYS_getpeername | ||
3996 | #ifdef __NR_getpeername | ||
3997 | {"getpeername", __NR_getpeername}, | ||
3998 | #endif | ||
3999 | #endif | ||
4000 | #ifdef SYS_getpgid | ||
4001 | #ifdef __NR_getpgid | ||
4002 | {"getpgid", __NR_getpgid}, | ||
4003 | #endif | ||
4004 | #endif | ||
4005 | #ifdef SYS_getpgrp | ||
4006 | #ifdef __NR_getpgrp | ||
4007 | {"getpgrp", __NR_getpgrp}, | ||
4008 | #endif | ||
4009 | #endif | ||
4010 | #ifdef SYS_getpid | ||
4011 | #ifdef __NR_getpid | ||
4012 | {"getpid", __NR_getpid}, | ||
4013 | #endif | ||
4014 | #endif | ||
4015 | #ifdef SYS_getpmsg | ||
4016 | #ifdef __NR_getpmsg | ||
4017 | {"getpmsg", __NR_getpmsg}, | ||
4018 | #endif | ||
4019 | #endif | ||
4020 | #ifdef SYS_getppid | ||
4021 | #ifdef __NR_getppid | ||
4022 | {"getppid", __NR_getppid}, | ||
4023 | #endif | ||
4024 | #endif | ||
4025 | #ifdef SYS_getpriority | ||
4026 | #ifdef __NR_getpriority | ||
4027 | {"getpriority", __NR_getpriority}, | ||
4028 | #endif | ||
4029 | #endif | ||
4030 | #ifdef SYS_getrandom | ||
4031 | #ifdef __NR_getrandom | ||
4032 | {"getrandom", __NR_getrandom}, | ||
4033 | #endif | ||
4034 | #endif | ||
4035 | #ifdef SYS_getresgid | ||
4036 | #ifdef __NR_getresgid | ||
4037 | {"getresgid", __NR_getresgid}, | ||
4038 | #endif | ||
4039 | #endif | ||
4040 | #ifdef SYS_getresuid | ||
4041 | #ifdef __NR_getresuid | ||
4042 | {"getresuid", __NR_getresuid}, | ||
4043 | #endif | ||
4044 | #endif | ||
4045 | #ifdef SYS_getrlimit | ||
4046 | #ifdef __NR_getrlimit | ||
4047 | {"getrlimit", __NR_getrlimit}, | ||
4048 | #endif | ||
4049 | #endif | ||
4050 | #ifdef SYS_getrusage | ||
4051 | #ifdef __NR_getrusage | ||
4052 | {"getrusage", __NR_getrusage}, | ||
4053 | #endif | ||
4054 | #endif | ||
4055 | #ifdef SYS_getsid | ||
4056 | #ifdef __NR_getsid | ||
4057 | {"getsid", __NR_getsid}, | ||
4058 | #endif | ||
4059 | #endif | ||
4060 | #ifdef SYS_getsockname | ||
4061 | #ifdef __NR_getsockname | ||
4062 | {"getsockname", __NR_getsockname}, | ||
4063 | #endif | ||
4064 | #endif | ||
4065 | #ifdef SYS_getsockopt | ||
4066 | #ifdef __NR_getsockopt | ||
4067 | {"getsockopt", __NR_getsockopt}, | ||
4068 | #endif | ||
4069 | #endif | ||
4070 | #ifdef SYS_gettid | ||
4071 | #ifdef __NR_gettid | ||
4072 | {"gettid", __NR_gettid}, | ||
4073 | #endif | ||
4074 | #endif | ||
4075 | #ifdef SYS_gettimeofday | ||
4076 | #ifdef __NR_gettimeofday | ||
4077 | {"gettimeofday", __NR_gettimeofday}, | ||
4078 | #endif | ||
4079 | #endif | ||
4080 | #ifdef SYS_getuid | ||
4081 | #ifdef __NR_getuid | ||
4082 | {"getuid", __NR_getuid}, | ||
4083 | #endif | ||
4084 | #endif | ||
4085 | #ifdef SYS_getxattr | ||
4086 | #ifdef __NR_getxattr | ||
4087 | {"getxattr", __NR_getxattr}, | ||
4088 | #endif | ||
4089 | #endif | ||
4090 | #ifdef SYS_init_module | ||
4091 | #ifdef __NR_init_module | ||
4092 | {"init_module", __NR_init_module}, | ||
4093 | #endif | ||
4094 | #endif | ||
4095 | #ifdef SYS_inotify_add_watch | ||
4096 | #ifdef __NR_inotify_add_watch | ||
4097 | {"inotify_add_watch", __NR_inotify_add_watch}, | ||
4098 | #endif | ||
4099 | #endif | ||
4100 | #ifdef SYS_inotify_init | ||
4101 | #ifdef __NR_inotify_init | ||
4102 | {"inotify_init", __NR_inotify_init}, | ||
4103 | #endif | ||
4104 | #endif | ||
4105 | #ifdef SYS_inotify_init1 | ||
4106 | #ifdef __NR_inotify_init1 | ||
4107 | {"inotify_init1", __NR_inotify_init1}, | ||
4108 | #endif | ||
4109 | #endif | ||
4110 | #ifdef SYS_inotify_rm_watch | ||
4111 | #ifdef __NR_inotify_rm_watch | ||
4112 | {"inotify_rm_watch", __NR_inotify_rm_watch}, | ||
4113 | #endif | ||
4114 | #endif | ||
4115 | #ifdef SYS_io_cancel | ||
4116 | #ifdef __NR_io_cancel | ||
4117 | {"io_cancel", __NR_io_cancel}, | ||
4118 | #endif | ||
4119 | #endif | ||
4120 | #ifdef SYS_io_destroy | ||
4121 | #ifdef __NR_io_destroy | ||
4122 | {"io_destroy", __NR_io_destroy}, | ||
4123 | #endif | ||
4124 | #endif | ||
4125 | #ifdef SYS_io_getevents | ||
4126 | #ifdef __NR_io_getevents | ||
4127 | {"io_getevents", __NR_io_getevents}, | ||
4128 | #endif | ||
4129 | #endif | ||
4130 | #ifdef SYS_io_setup | ||
4131 | #ifdef __NR_io_setup | ||
4132 | {"io_setup", __NR_io_setup}, | ||
4133 | #endif | ||
4134 | #endif | ||
4135 | #ifdef SYS_io_submit | ||
4136 | #ifdef __NR_io_submit | ||
4137 | {"io_submit", __NR_io_submit}, | ||
4138 | #endif | ||
4139 | #endif | ||
4140 | #ifdef SYS_ioctl | ||
4141 | #ifdef __NR_ioctl | ||
4142 | {"ioctl", __NR_ioctl}, | ||
4143 | #endif | ||
4144 | #endif | ||
4145 | #ifdef SYS_ioperm | ||
4146 | #ifdef __NR_ioperm | ||
4147 | {"ioperm", __NR_ioperm}, | ||
4148 | #endif | ||
4149 | #endif | ||
4150 | #ifdef SYS_iopl | ||
4151 | #ifdef __NR_iopl | ||
4152 | {"iopl", __NR_iopl}, | ||
4153 | #endif | ||
4154 | #endif | ||
4155 | #ifdef SYS_ioprio_get | ||
4156 | #ifdef __NR_ioprio_get | ||
4157 | {"ioprio_get", __NR_ioprio_get}, | ||
4158 | #endif | ||
4159 | #endif | ||
4160 | #ifdef SYS_ioprio_set | ||
4161 | #ifdef __NR_ioprio_set | ||
4162 | {"ioprio_set", __NR_ioprio_set}, | ||
4163 | #endif | ||
4164 | #endif | ||
4165 | #ifdef SYS_kcmp | ||
4166 | #ifdef __NR_kcmp | ||
4167 | {"kcmp", __NR_kcmp}, | ||
4168 | #endif | ||
4169 | #endif | ||
4170 | #ifdef SYS_kexec_file_load | ||
4171 | #ifdef __NR_kexec_file_load | ||
4172 | {"kexec_file_load", __NR_kexec_file_load}, | ||
4173 | #endif | ||
4174 | #endif | ||
4175 | #ifdef SYS_kexec_load | ||
4176 | #ifdef __NR_kexec_load | ||
4177 | {"kexec_load", __NR_kexec_load}, | ||
4178 | #endif | ||
4179 | #endif | ||
4180 | #ifdef SYS_keyctl | ||
4181 | #ifdef __NR_keyctl | ||
4182 | {"keyctl", __NR_keyctl}, | ||
4183 | #endif | ||
4184 | #endif | ||
4185 | #ifdef SYS_kill | ||
4186 | #ifdef __NR_kill | ||
4187 | {"kill", __NR_kill}, | ||
4188 | #endif | ||
4189 | #endif | ||
4190 | #ifdef SYS_lchown | ||
4191 | #ifdef __NR_lchown | ||
4192 | {"lchown", __NR_lchown}, | ||
4193 | #endif | ||
4194 | #endif | ||
4195 | #ifdef SYS_lgetxattr | ||
4196 | #ifdef __NR_lgetxattr | ||
4197 | {"lgetxattr", __NR_lgetxattr}, | ||
4198 | #endif | ||
4199 | #endif | ||
4200 | #ifdef SYS_link | ||
4201 | #ifdef __NR_link | ||
4202 | {"link", __NR_link}, | ||
4203 | #endif | ||
4204 | #endif | ||
4205 | #ifdef SYS_linkat | ||
4206 | #ifdef __NR_linkat | ||
4207 | {"linkat", __NR_linkat}, | ||
4208 | #endif | ||
4209 | #endif | ||
4210 | #ifdef SYS_listen | ||
4211 | #ifdef __NR_listen | ||
4212 | {"listen", __NR_listen}, | ||
4213 | #endif | ||
4214 | #endif | ||
4215 | #ifdef SYS_listxattr | ||
4216 | #ifdef __NR_listxattr | ||
4217 | {"listxattr", __NR_listxattr}, | ||
4218 | #endif | ||
4219 | #endif | ||
4220 | #ifdef SYS_llistxattr | ||
4221 | #ifdef __NR_llistxattr | ||
4222 | {"llistxattr", __NR_llistxattr}, | ||
4223 | #endif | ||
4224 | #endif | ||
4225 | #ifdef SYS_lookup_dcookie | ||
4226 | #ifdef __NR_lookup_dcookie | ||
4227 | {"lookup_dcookie", __NR_lookup_dcookie}, | ||
4228 | #endif | ||
4229 | #endif | ||
4230 | #ifdef SYS_lremovexattr | ||
4231 | #ifdef __NR_lremovexattr | ||
4232 | {"lremovexattr", __NR_lremovexattr}, | ||
4233 | #endif | ||
4234 | #endif | ||
4235 | #ifdef SYS_lseek | ||
4236 | #ifdef __NR_lseek | ||
4237 | {"lseek", __NR_lseek}, | ||
4238 | #endif | ||
4239 | #endif | ||
4240 | #ifdef SYS_lsetxattr | ||
4241 | #ifdef __NR_lsetxattr | ||
4242 | {"lsetxattr", __NR_lsetxattr}, | ||
4243 | #endif | ||
4244 | #endif | ||
4245 | #ifdef SYS_lstat | ||
4246 | #ifdef __NR_lstat | ||
4247 | {"lstat", __NR_lstat}, | ||
4248 | #endif | ||
4249 | #endif | ||
4250 | #ifdef SYS_madvise | ||
4251 | #ifdef __NR_madvise | ||
4252 | {"madvise", __NR_madvise}, | ||
4253 | #endif | ||
4254 | #endif | ||
4255 | #ifdef SYS_mbind | ||
4256 | #ifdef __NR_mbind | ||
4257 | {"mbind", __NR_mbind}, | ||
4258 | #endif | ||
4259 | #endif | ||
4260 | #ifdef SYS_membarrier | ||
4261 | #ifdef __NR_membarrier | ||
4262 | {"membarrier", __NR_membarrier}, | ||
4263 | #endif | ||
4264 | #endif | ||
4265 | #ifdef SYS_memfd_create | ||
4266 | #ifdef __NR_memfd_create | ||
4267 | {"memfd_create", __NR_memfd_create}, | ||
4268 | #endif | ||
4269 | #endif | ||
4270 | #ifdef SYS_migrate_pages | ||
4271 | #ifdef __NR_migrate_pages | ||
4272 | {"migrate_pages", __NR_migrate_pages}, | ||
4273 | #endif | ||
4274 | #endif | ||
4275 | #ifdef SYS_mincore | ||
4276 | #ifdef __NR_mincore | ||
4277 | {"mincore", __NR_mincore}, | ||
4278 | #endif | ||
4279 | #endif | ||
4280 | #ifdef SYS_mkdir | ||
4281 | #ifdef __NR_mkdir | ||
4282 | {"mkdir", __NR_mkdir}, | ||
4283 | #endif | ||
4284 | #endif | ||
4285 | #ifdef SYS_mkdirat | ||
4286 | #ifdef __NR_mkdirat | ||
4287 | {"mkdirat", __NR_mkdirat}, | ||
4288 | #endif | ||
4289 | #endif | ||
4290 | #ifdef SYS_mknod | ||
4291 | #ifdef __NR_mknod | ||
4292 | {"mknod", __NR_mknod}, | ||
4293 | #endif | ||
4294 | #endif | ||
4295 | #ifdef SYS_mknodat | ||
4296 | #ifdef __NR_mknodat | ||
4297 | {"mknodat", __NR_mknodat}, | ||
4298 | #endif | ||
4299 | #endif | ||
4300 | #ifdef SYS_mlock | ||
4301 | #ifdef __NR_mlock | ||
4302 | {"mlock", __NR_mlock}, | ||
4303 | #endif | ||
4304 | #endif | ||
4305 | #ifdef SYS_mlock2 | ||
4306 | #ifdef __NR_mlock2 | ||
4307 | {"mlock2", __NR_mlock2}, | ||
4308 | #endif | ||
4309 | #endif | ||
4310 | #ifdef SYS_mlockall | ||
4311 | #ifdef __NR_mlockall | ||
4312 | {"mlockall", __NR_mlockall}, | ||
4313 | #endif | ||
4314 | #endif | ||
4315 | #ifdef SYS_mmap | ||
4316 | #ifdef __NR_mmap | ||
4317 | {"mmap", __NR_mmap}, | ||
4318 | #endif | ||
4319 | #endif | ||
4320 | #ifdef SYS_modify_ldt | ||
4321 | #ifdef __NR_modify_ldt | ||
4322 | {"modify_ldt", __NR_modify_ldt}, | ||
4323 | #endif | ||
4324 | #endif | ||
4325 | #ifdef SYS_mount | ||
4326 | #ifdef __NR_mount | ||
4327 | {"mount", __NR_mount}, | ||
4328 | #endif | ||
4329 | #endif | ||
4330 | #ifdef SYS_move_pages | ||
4331 | #ifdef __NR_move_pages | ||
4332 | {"move_pages", __NR_move_pages}, | ||
4333 | #endif | ||
4334 | #endif | ||
4335 | #ifdef SYS_mprotect | ||
4336 | #ifdef __NR_mprotect | ||
4337 | {"mprotect", __NR_mprotect}, | ||
4338 | #endif | ||
4339 | #endif | ||
4340 | #ifdef SYS_mq_getsetattr | ||
4341 | #ifdef __NR_mq_getsetattr | ||
4342 | {"mq_getsetattr", __NR_mq_getsetattr}, | ||
4343 | #endif | ||
4344 | #endif | ||
4345 | #ifdef SYS_mq_notify | ||
4346 | #ifdef __NR_mq_notify | ||
4347 | {"mq_notify", __NR_mq_notify}, | ||
4348 | #endif | ||
4349 | #endif | ||
4350 | #ifdef SYS_mq_open | ||
4351 | #ifdef __NR_mq_open | ||
4352 | {"mq_open", __NR_mq_open}, | ||
4353 | #endif | ||
4354 | #endif | ||
4355 | #ifdef SYS_mq_timedreceive | ||
4356 | #ifdef __NR_mq_timedreceive | ||
4357 | {"mq_timedreceive", __NR_mq_timedreceive}, | ||
4358 | #endif | ||
4359 | #endif | ||
4360 | #ifdef SYS_mq_timedsend | ||
4361 | #ifdef __NR_mq_timedsend | ||
4362 | {"mq_timedsend", __NR_mq_timedsend}, | ||
4363 | #endif | ||
4364 | #endif | ||
4365 | #ifdef SYS_mq_unlink | ||
4366 | #ifdef __NR_mq_unlink | ||
4367 | {"mq_unlink", __NR_mq_unlink}, | ||
4368 | #endif | ||
4369 | #endif | ||
4370 | #ifdef SYS_mremap | ||
4371 | #ifdef __NR_mremap | ||
4372 | {"mremap", __NR_mremap}, | ||
4373 | #endif | ||
4374 | #endif | ||
4375 | #ifdef SYS_msgctl | ||
4376 | #ifdef __NR_msgctl | ||
4377 | {"msgctl", __NR_msgctl}, | ||
4378 | #endif | ||
4379 | #endif | ||
4380 | #ifdef SYS_msgget | ||
4381 | #ifdef __NR_msgget | ||
4382 | {"msgget", __NR_msgget}, | ||
4383 | #endif | ||
4384 | #endif | ||
4385 | #ifdef SYS_msgrcv | ||
4386 | #ifdef __NR_msgrcv | ||
4387 | {"msgrcv", __NR_msgrcv}, | ||
4388 | #endif | ||
4389 | #endif | ||
4390 | #ifdef SYS_msgsnd | ||
4391 | #ifdef __NR_msgsnd | ||
4392 | {"msgsnd", __NR_msgsnd}, | ||
4393 | #endif | ||
4394 | #endif | ||
4395 | #ifdef SYS_msync | ||
4396 | #ifdef __NR_msync | ||
4397 | {"msync", __NR_msync}, | ||
4398 | #endif | ||
4399 | #endif | ||
4400 | #ifdef SYS_munlock | ||
4401 | #ifdef __NR_munlock | ||
4402 | {"munlock", __NR_munlock}, | ||
4403 | #endif | ||
4404 | #endif | ||
4405 | #ifdef SYS_munlockall | ||
4406 | #ifdef __NR_munlockall | ||
4407 | {"munlockall", __NR_munlockall}, | ||
4408 | #endif | ||
4409 | #endif | ||
4410 | #ifdef SYS_munmap | ||
4411 | #ifdef __NR_munmap | ||
4412 | {"munmap", __NR_munmap}, | ||
4413 | #endif | ||
4414 | #endif | ||
4415 | #ifdef SYS_name_to_handle_at | ||
4416 | #ifdef __NR_name_to_handle_at | ||
4417 | {"name_to_handle_at", __NR_name_to_handle_at}, | ||
4418 | #endif | ||
4419 | #endif | ||
4420 | #ifdef SYS_nanosleep | ||
4421 | #ifdef __NR_nanosleep | ||
4422 | {"nanosleep", __NR_nanosleep}, | ||
4423 | #endif | ||
4424 | #endif | ||
4425 | #ifdef SYS_newfstatat | ||
4426 | #ifdef __NR_newfstatat | ||
4427 | {"newfstatat", __NR_newfstatat}, | ||
4428 | #endif | ||
4429 | #endif | ||
4430 | #ifdef SYS_open | ||
4431 | #ifdef __NR_open | ||
4432 | {"open", __NR_open}, | ||
4433 | #endif | ||
4434 | #endif | ||
4435 | #ifdef SYS_open_by_handle_at | ||
4436 | #ifdef __NR_open_by_handle_at | ||
4437 | {"open_by_handle_at", __NR_open_by_handle_at}, | ||
4438 | #endif | ||
4439 | #endif | ||
4440 | #ifdef SYS_openat | ||
4441 | #ifdef __NR_openat | ||
4442 | {"openat", __NR_openat}, | ||
4443 | #endif | ||
4444 | #endif | ||
4445 | #ifdef SYS_pause | ||
4446 | #ifdef __NR_pause | ||
4447 | {"pause", __NR_pause}, | ||
4448 | #endif | ||
4449 | #endif | ||
4450 | #ifdef SYS_perf_event_open | ||
4451 | #ifdef __NR_perf_event_open | ||
4452 | {"perf_event_open", __NR_perf_event_open}, | ||
4453 | #endif | ||
4454 | #endif | ||
4455 | #ifdef SYS_personality | ||
4456 | #ifdef __NR_personality | ||
4457 | {"personality", __NR_personality}, | ||
4458 | #endif | ||
4459 | #endif | ||
4460 | #ifdef SYS_pipe | ||
4461 | #ifdef __NR_pipe | ||
4462 | {"pipe", __NR_pipe}, | ||
4463 | #endif | ||
4464 | #endif | ||
4465 | #ifdef SYS_pipe2 | ||
4466 | #ifdef __NR_pipe2 | ||
4467 | {"pipe2", __NR_pipe2}, | ||
4468 | #endif | ||
4469 | #endif | ||
4470 | #ifdef SYS_pivot_root | ||
4471 | #ifdef __NR_pivot_root | ||
4472 | {"pivot_root", __NR_pivot_root}, | ||
4473 | #endif | ||
4474 | #endif | ||
4475 | #ifdef SYS_pkey_alloc | ||
4476 | #ifdef __NR_pkey_alloc | ||
4477 | {"pkey_alloc", __NR_pkey_alloc}, | ||
4478 | #endif | ||
4479 | #endif | ||
4480 | #ifdef SYS_pkey_free | ||
4481 | #ifdef __NR_pkey_free | ||
4482 | {"pkey_free", __NR_pkey_free}, | ||
4483 | #endif | ||
4484 | #endif | ||
4485 | #ifdef SYS_pkey_mprotect | ||
4486 | #ifdef __NR_pkey_mprotect | ||
4487 | {"pkey_mprotect", __NR_pkey_mprotect}, | ||
4488 | #endif | ||
4489 | #endif | ||
4490 | #ifdef SYS_poll | ||
4491 | #ifdef __NR_poll | ||
4492 | {"poll", __NR_poll}, | ||
4493 | #endif | ||
4494 | #endif | ||
4495 | #ifdef SYS_ppoll | ||
4496 | #ifdef __NR_ppoll | ||
4497 | {"ppoll", __NR_ppoll}, | ||
4498 | #endif | ||
4499 | #endif | ||
4500 | #ifdef SYS_prctl | ||
4501 | #ifdef __NR_prctl | ||
4502 | {"prctl", __NR_prctl}, | ||
4503 | #endif | ||
4504 | #endif | ||
4505 | #ifdef SYS_pread64 | ||
4506 | #ifdef __NR_pread64 | ||
4507 | {"pread64", __NR_pread64}, | ||
4508 | #endif | ||
4509 | #endif | ||
4510 | #ifdef SYS_preadv | ||
4511 | #ifdef __NR_preadv | ||
4512 | {"preadv", __NR_preadv}, | ||
4513 | #endif | ||
4514 | #endif | ||
4515 | #ifdef SYS_preadv2 | ||
4516 | #ifdef __NR_preadv2 | ||
4517 | {"preadv2", __NR_preadv2}, | ||
4518 | #endif | ||
4519 | #endif | ||
4520 | #ifdef SYS_prlimit64 | ||
4521 | #ifdef __NR_prlimit64 | ||
4522 | {"prlimit64", __NR_prlimit64}, | ||
4523 | #endif | ||
4524 | #endif | ||
4525 | #ifdef SYS_process_vm_readv | ||
4526 | #ifdef __NR_process_vm_readv | ||
4527 | {"process_vm_readv", __NR_process_vm_readv}, | ||
4528 | #endif | ||
4529 | #endif | ||
4530 | #ifdef SYS_process_vm_writev | ||
4531 | #ifdef __NR_process_vm_writev | ||
4532 | {"process_vm_writev", __NR_process_vm_writev}, | ||
4533 | #endif | ||
4534 | #endif | ||
4535 | #ifdef SYS_pselect6 | ||
4536 | #ifdef __NR_pselect6 | ||
4537 | {"pselect6", __NR_pselect6}, | ||
4538 | #endif | ||
4539 | #endif | ||
4540 | #ifdef SYS_ptrace | ||
4541 | #ifdef __NR_ptrace | ||
4542 | {"ptrace", __NR_ptrace}, | ||
4543 | #endif | ||
4544 | #endif | ||
4545 | #ifdef SYS_putpmsg | ||
4546 | #ifdef __NR_putpmsg | ||
4547 | {"putpmsg", __NR_putpmsg}, | ||
4548 | #endif | ||
4549 | #endif | ||
4550 | #ifdef SYS_pwrite64 | ||
4551 | #ifdef __NR_pwrite64 | ||
4552 | {"pwrite64", __NR_pwrite64}, | ||
4553 | #endif | ||
4554 | #endif | ||
4555 | #ifdef SYS_pwritev | ||
4556 | #ifdef __NR_pwritev | ||
4557 | {"pwritev", __NR_pwritev}, | ||
4558 | #endif | ||
4559 | #endif | ||
4560 | #ifdef SYS_pwritev2 | ||
4561 | #ifdef __NR_pwritev2 | ||
4562 | {"pwritev2", __NR_pwritev2}, | ||
4563 | #endif | ||
4564 | #endif | ||
4565 | #ifdef SYS_quotactl | ||
4566 | #ifdef __NR_quotactl | ||
4567 | {"quotactl", __NR_quotactl}, | ||
4568 | #endif | ||
4569 | #endif | ||
4570 | #ifdef SYS_read | ||
4571 | #ifdef __NR_read | ||
4572 | {"read", __NR_read}, | ||
4573 | #endif | ||
4574 | #endif | ||
4575 | #ifdef SYS_readahead | ||
4576 | #ifdef __NR_readahead | ||
4577 | {"readahead", __NR_readahead}, | ||
4578 | #endif | ||
4579 | #endif | ||
4580 | #ifdef SYS_readlink | ||
4581 | #ifdef __NR_readlink | ||
4582 | {"readlink", __NR_readlink}, | ||
4583 | #endif | ||
4584 | #endif | ||
4585 | #ifdef SYS_readlinkat | ||
4586 | #ifdef __NR_readlinkat | ||
4587 | {"readlinkat", __NR_readlinkat}, | ||
4588 | #endif | ||
4589 | #endif | ||
4590 | #ifdef SYS_readv | ||
4591 | #ifdef __NR_readv | ||
4592 | {"readv", __NR_readv}, | ||
4593 | #endif | ||
4594 | #endif | ||
4595 | #ifdef SYS_reboot | ||
4596 | #ifdef __NR_reboot | ||
4597 | {"reboot", __NR_reboot}, | ||
4598 | #endif | ||
4599 | #endif | ||
4600 | #ifdef SYS_recvfrom | ||
4601 | #ifdef __NR_recvfrom | ||
4602 | {"recvfrom", __NR_recvfrom}, | ||
4603 | #endif | ||
4604 | #endif | ||
4605 | #ifdef SYS_recvmmsg | ||
4606 | #ifdef __NR_recvmmsg | ||
4607 | {"recvmmsg", __NR_recvmmsg}, | ||
4608 | #endif | ||
4609 | #endif | ||
4610 | #ifdef SYS_recvmsg | ||
4611 | #ifdef __NR_recvmsg | ||
4612 | {"recvmsg", __NR_recvmsg}, | ||
4613 | #endif | ||
4614 | #endif | ||
4615 | #ifdef SYS_remap_file_pages | ||
4616 | #ifdef __NR_remap_file_pages | ||
4617 | {"remap_file_pages", __NR_remap_file_pages}, | ||
4618 | #endif | ||
4619 | #endif | ||
4620 | #ifdef SYS_removexattr | ||
4621 | #ifdef __NR_removexattr | ||
4622 | {"removexattr", __NR_removexattr}, | ||
4623 | #endif | ||
4624 | #endif | ||
4625 | #ifdef SYS_rename | ||
4626 | #ifdef __NR_rename | ||
4627 | {"rename", __NR_rename}, | ||
4628 | #endif | ||
4629 | #endif | ||
4630 | #ifdef SYS_renameat | ||
4631 | #ifdef __NR_renameat | ||
4632 | {"renameat", __NR_renameat}, | ||
4633 | #endif | ||
4634 | #endif | ||
4635 | #ifdef SYS_renameat2 | ||
4636 | #ifdef __NR_renameat2 | ||
4637 | {"renameat2", __NR_renameat2}, | ||
4638 | #endif | ||
4639 | #endif | ||
4640 | #ifdef SYS_request_key | ||
4641 | #ifdef __NR_request_key | ||
4642 | {"request_key", __NR_request_key}, | ||
4643 | #endif | ||
4644 | #endif | ||
4645 | #ifdef SYS_restart_syscall | ||
4646 | #ifdef __NR_restart_syscall | ||
4647 | {"restart_syscall", __NR_restart_syscall}, | ||
4648 | #endif | ||
4649 | #endif | ||
4650 | #ifdef SYS_rmdir | ||
4651 | #ifdef __NR_rmdir | ||
4652 | {"rmdir", __NR_rmdir}, | ||
4653 | #endif | ||
4654 | #endif | ||
4655 | #ifdef SYS_rt_sigaction | ||
4656 | #ifdef __NR_rt_sigaction | ||
4657 | {"rt_sigaction", __NR_rt_sigaction}, | ||
4658 | #endif | ||
4659 | #endif | ||
4660 | #ifdef SYS_rt_sigpending | ||
4661 | #ifdef __NR_rt_sigpending | ||
4662 | {"rt_sigpending", __NR_rt_sigpending}, | ||
4663 | #endif | ||
4664 | #endif | ||
4665 | #ifdef SYS_rt_sigprocmask | ||
4666 | #ifdef __NR_rt_sigprocmask | ||
4667 | {"rt_sigprocmask", __NR_rt_sigprocmask}, | ||
4668 | #endif | ||
4669 | #endif | ||
4670 | #ifdef SYS_rt_sigqueueinfo | ||
4671 | #ifdef __NR_rt_sigqueueinfo | ||
4672 | {"rt_sigqueueinfo", __NR_rt_sigqueueinfo}, | ||
4673 | #endif | ||
4674 | #endif | ||
4675 | #ifdef SYS_rt_sigreturn | ||
4676 | #ifdef __NR_rt_sigreturn | ||
4677 | {"rt_sigreturn", __NR_rt_sigreturn}, | ||
4678 | #endif | ||
4679 | #endif | ||
4680 | #ifdef SYS_rt_sigsuspend | ||
4681 | #ifdef __NR_rt_sigsuspend | ||
4682 | {"rt_sigsuspend", __NR_rt_sigsuspend}, | ||
4683 | #endif | ||
4684 | #endif | ||
4685 | #ifdef SYS_rt_sigtimedwait | ||
4686 | #ifdef __NR_rt_sigtimedwait | ||
4687 | {"rt_sigtimedwait", __NR_rt_sigtimedwait}, | ||
4688 | #endif | ||
4689 | #endif | ||
4690 | #ifdef SYS_rt_tgsigqueueinfo | ||
4691 | #ifdef __NR_rt_tgsigqueueinfo | ||
4692 | {"rt_tgsigqueueinfo", __NR_rt_tgsigqueueinfo}, | ||
4693 | #endif | ||
4694 | #endif | ||
4695 | #ifdef SYS_sched_get_priority_max | ||
4696 | #ifdef __NR_sched_get_priority_max | ||
4697 | {"sched_get_priority_max", __NR_sched_get_priority_max}, | ||
4698 | #endif | ||
4699 | #endif | ||
4700 | #ifdef SYS_sched_get_priority_min | ||
4701 | #ifdef __NR_sched_get_priority_min | ||
4702 | {"sched_get_priority_min", __NR_sched_get_priority_min}, | ||
4703 | #endif | ||
4704 | #endif | ||
4705 | #ifdef SYS_sched_getaffinity | ||
4706 | #ifdef __NR_sched_getaffinity | ||
4707 | {"sched_getaffinity", __NR_sched_getaffinity}, | ||
4708 | #endif | ||
4709 | #endif | ||
4710 | #ifdef SYS_sched_getattr | ||
4711 | #ifdef __NR_sched_getattr | ||
4712 | {"sched_getattr", __NR_sched_getattr}, | ||
4713 | #endif | ||
4714 | #endif | ||
4715 | #ifdef SYS_sched_getparam | ||
4716 | #ifdef __NR_sched_getparam | ||
4717 | {"sched_getparam", __NR_sched_getparam}, | ||
4718 | #endif | ||
4719 | #endif | ||
4720 | #ifdef SYS_sched_getscheduler | ||
4721 | #ifdef __NR_sched_getscheduler | ||
4722 | {"sched_getscheduler", __NR_sched_getscheduler}, | ||
4723 | #endif | ||
4724 | #endif | ||
4725 | #ifdef SYS_sched_rr_get_interval | ||
4726 | #ifdef __NR_sched_rr_get_interval | ||
4727 | {"sched_rr_get_interval", __NR_sched_rr_get_interval}, | ||
4728 | #endif | ||
4729 | #endif | ||
4730 | #ifdef SYS_sched_setaffinity | ||
4731 | #ifdef __NR_sched_setaffinity | ||
4732 | {"sched_setaffinity", __NR_sched_setaffinity}, | ||
4733 | #endif | ||
4734 | #endif | ||
4735 | #ifdef SYS_sched_setattr | ||
4736 | #ifdef __NR_sched_setattr | ||
4737 | {"sched_setattr", __NR_sched_setattr}, | ||
4738 | #endif | ||
4739 | #endif | ||
4740 | #ifdef SYS_sched_setparam | ||
4741 | #ifdef __NR_sched_setparam | ||
4742 | {"sched_setparam", __NR_sched_setparam}, | ||
4743 | #endif | ||
4744 | #endif | ||
4745 | #ifdef SYS_sched_setscheduler | ||
4746 | #ifdef __NR_sched_setscheduler | ||
4747 | {"sched_setscheduler", __NR_sched_setscheduler}, | ||
4748 | #endif | ||
4749 | #endif | ||
4750 | #ifdef SYS_sched_yield | ||
4751 | #ifdef __NR_sched_yield | ||
4752 | {"sched_yield", __NR_sched_yield}, | ||
4753 | #endif | ||
4754 | #endif | ||
4755 | #ifdef SYS_seccomp | ||
4756 | #ifdef __NR_seccomp | ||
4757 | {"seccomp", __NR_seccomp}, | ||
4758 | #endif | ||
4759 | #endif | ||
4760 | #ifdef SYS_security | ||
4761 | #ifdef __NR_security | ||
4762 | {"security", __NR_security}, | ||
4763 | #endif | ||
4764 | #endif | ||
4765 | #ifdef SYS_select | ||
4766 | #ifdef __NR_select | ||
4767 | {"select", __NR_select}, | ||
4768 | #endif | ||
4769 | #endif | ||
4770 | #ifdef SYS_semctl | ||
4771 | #ifdef __NR_semctl | ||
4772 | {"semctl", __NR_semctl}, | ||
4773 | #endif | ||
4774 | #endif | ||
4775 | #ifdef SYS_semget | ||
4776 | #ifdef __NR_semget | ||
4777 | {"semget", __NR_semget}, | ||
4778 | #endif | ||
4779 | #endif | ||
4780 | #ifdef SYS_semop | ||
4781 | #ifdef __NR_semop | ||
4782 | {"semop", __NR_semop}, | ||
4783 | #endif | ||
4784 | #endif | ||
4785 | #ifdef SYS_semtimedop | ||
4786 | #ifdef __NR_semtimedop | ||
4787 | {"semtimedop", __NR_semtimedop}, | ||
4788 | #endif | ||
4789 | #endif | ||
4790 | #ifdef SYS_sendfile | ||
4791 | #ifdef __NR_sendfile | ||
4792 | {"sendfile", __NR_sendfile}, | ||
4793 | #endif | ||
4794 | #endif | ||
4795 | #ifdef SYS_sendmmsg | ||
4796 | #ifdef __NR_sendmmsg | ||
4797 | {"sendmmsg", __NR_sendmmsg}, | ||
4798 | #endif | ||
4799 | #endif | ||
4800 | #ifdef SYS_sendmsg | ||
4801 | #ifdef __NR_sendmsg | ||
4802 | {"sendmsg", __NR_sendmsg}, | ||
4803 | #endif | ||
4804 | #endif | ||
4805 | #ifdef SYS_sendto | ||
4806 | #ifdef __NR_sendto | ||
4807 | {"sendto", __NR_sendto}, | ||
4808 | #endif | ||
4809 | #endif | ||
4810 | #ifdef SYS_set_mempolicy | ||
4811 | #ifdef __NR_set_mempolicy | ||
4812 | {"set_mempolicy", __NR_set_mempolicy}, | ||
4813 | #endif | ||
4814 | #endif | ||
4815 | #ifdef SYS_set_robust_list | ||
4816 | #ifdef __NR_set_robust_list | ||
4817 | {"set_robust_list", __NR_set_robust_list}, | ||
4818 | #endif | ||
4819 | #endif | ||
4820 | #ifdef SYS_set_tid_address | ||
4821 | #ifdef __NR_set_tid_address | ||
4822 | {"set_tid_address", __NR_set_tid_address}, | ||
4823 | #endif | ||
4824 | #endif | ||
4825 | #ifdef SYS_setdomainname | ||
4826 | #ifdef __NR_setdomainname | ||
4827 | {"setdomainname", __NR_setdomainname}, | ||
4828 | #endif | ||
4829 | #endif | ||
4830 | #ifdef SYS_setfsgid | ||
4831 | #ifdef __NR_setfsgid | ||
4832 | {"setfsgid", __NR_setfsgid}, | ||
4833 | #endif | ||
4834 | #endif | ||
4835 | #ifdef SYS_setfsuid | ||
4836 | #ifdef __NR_setfsuid | ||
4837 | {"setfsuid", __NR_setfsuid}, | ||
4838 | #endif | ||
4839 | #endif | ||
4840 | #ifdef SYS_setgid | ||
4841 | #ifdef __NR_setgid | ||
4842 | {"setgid", __NR_setgid}, | ||
4843 | #endif | ||
4844 | #endif | ||
4845 | #ifdef SYS_setgroups | ||
4846 | #ifdef __NR_setgroups | ||
4847 | {"setgroups", __NR_setgroups}, | ||
4848 | #endif | ||
4849 | #endif | ||
4850 | #ifdef SYS_sethostname | ||
4851 | #ifdef __NR_sethostname | ||
4852 | {"sethostname", __NR_sethostname}, | ||
4853 | #endif | ||
4854 | #endif | ||
4855 | #ifdef SYS_setitimer | ||
4856 | #ifdef __NR_setitimer | ||
4857 | {"setitimer", __NR_setitimer}, | ||
4858 | #endif | ||
4859 | #endif | ||
4860 | #ifdef SYS_setns | ||
4861 | #ifdef __NR_setns | ||
4862 | {"setns", __NR_setns}, | ||
4863 | #endif | ||
4864 | #endif | ||
4865 | #ifdef SYS_setpgid | ||
4866 | #ifdef __NR_setpgid | ||
4867 | {"setpgid", __NR_setpgid}, | ||
4868 | #endif | ||
4869 | #endif | ||
4870 | #ifdef SYS_setpriority | ||
4871 | #ifdef __NR_setpriority | ||
4872 | {"setpriority", __NR_setpriority}, | ||
4873 | #endif | ||
4874 | #endif | ||
4875 | #ifdef SYS_setregid | ||
4876 | #ifdef __NR_setregid | ||
4877 | {"setregid", __NR_setregid}, | ||
4878 | #endif | ||
4879 | #endif | ||
4880 | #ifdef SYS_setresgid | ||
4881 | #ifdef __NR_setresgid | ||
4882 | {"setresgid", __NR_setresgid}, | ||
4883 | #endif | ||
4884 | #endif | ||
4885 | #ifdef SYS_setresuid | ||
4886 | #ifdef __NR_setresuid | ||
4887 | {"setresuid", __NR_setresuid}, | ||
4888 | #endif | ||
4889 | #endif | ||
4890 | #ifdef SYS_setreuid | ||
4891 | #ifdef __NR_setreuid | ||
4892 | {"setreuid", __NR_setreuid}, | ||
4893 | #endif | ||
4894 | #endif | ||
4895 | #ifdef SYS_setrlimit | ||
4896 | #ifdef __NR_setrlimit | ||
4897 | {"setrlimit", __NR_setrlimit}, | ||
4898 | #endif | ||
4899 | #endif | ||
4900 | #ifdef SYS_setsid | ||
4901 | #ifdef __NR_setsid | ||
4902 | {"setsid", __NR_setsid}, | ||
4903 | #endif | ||
4904 | #endif | ||
4905 | #ifdef SYS_setsockopt | ||
4906 | #ifdef __NR_setsockopt | ||
4907 | {"setsockopt", __NR_setsockopt}, | ||
4908 | #endif | ||
4909 | #endif | ||
4910 | #ifdef SYS_settimeofday | ||
4911 | #ifdef __NR_settimeofday | ||
4912 | {"settimeofday", __NR_settimeofday}, | ||
4913 | #endif | ||
4914 | #endif | ||
4915 | #ifdef SYS_setuid | ||
4916 | #ifdef __NR_setuid | ||
4917 | {"setuid", __NR_setuid}, | ||
4918 | #endif | ||
4919 | #endif | ||
4920 | #ifdef SYS_setxattr | ||
4921 | #ifdef __NR_setxattr | ||
4922 | {"setxattr", __NR_setxattr}, | ||
4923 | #endif | ||
4924 | #endif | ||
4925 | #ifdef SYS_shmat | ||
4926 | #ifdef __NR_shmat | ||
4927 | {"shmat", __NR_shmat}, | ||
4928 | #endif | ||
4929 | #endif | ||
4930 | #ifdef SYS_shmctl | ||
4931 | #ifdef __NR_shmctl | ||
4932 | {"shmctl", __NR_shmctl}, | ||
4933 | #endif | ||
4934 | #endif | ||
4935 | #ifdef SYS_shmdt | ||
4936 | #ifdef __NR_shmdt | ||
4937 | {"shmdt", __NR_shmdt}, | ||
4938 | #endif | ||
4939 | #endif | ||
4940 | #ifdef SYS_shmget | ||
4941 | #ifdef __NR_shmget | ||
4942 | {"shmget", __NR_shmget}, | ||
4943 | #endif | ||
4944 | #endif | ||
4945 | #ifdef SYS_shutdown | ||
4946 | #ifdef __NR_shutdown | ||
4947 | {"shutdown", __NR_shutdown}, | ||
4948 | #endif | ||
4949 | #endif | ||
4950 | #ifdef SYS_sigaltstack | ||
4951 | #ifdef __NR_sigaltstack | ||
4952 | {"sigaltstack", __NR_sigaltstack}, | ||
4953 | #endif | ||
4954 | #endif | ||
4955 | #ifdef SYS_signalfd | ||
4956 | #ifdef __NR_signalfd | ||
4957 | {"signalfd", __NR_signalfd}, | ||
4958 | #endif | ||
4959 | #endif | ||
4960 | #ifdef SYS_signalfd4 | ||
4961 | #ifdef __NR_signalfd4 | ||
4962 | {"signalfd4", __NR_signalfd4}, | ||
4963 | #endif | ||
4964 | #endif | ||
4965 | #ifdef SYS_socket | ||
4966 | #ifdef __NR_socket | ||
4967 | {"socket", __NR_socket}, | ||
4968 | #endif | ||
4969 | #endif | ||
4970 | #ifdef SYS_socketpair | ||
4971 | #ifdef __NR_socketpair | ||
4972 | {"socketpair", __NR_socketpair}, | ||
4973 | #endif | ||
4974 | #endif | ||
4975 | #ifdef SYS_splice | ||
4976 | #ifdef __NR_splice | ||
4977 | {"splice", __NR_splice}, | ||
4978 | #endif | ||
4979 | #endif | ||
4980 | #ifdef SYS_stat | ||
4981 | #ifdef __NR_stat | ||
4982 | {"stat", __NR_stat}, | ||
4983 | #endif | ||
4984 | #endif | ||
4985 | #ifdef SYS_statfs | ||
4986 | #ifdef __NR_statfs | ||
4987 | {"statfs", __NR_statfs}, | ||
4988 | #endif | ||
4989 | #endif | ||
4990 | #ifdef SYS_statx | ||
4991 | #ifdef __NR_statx | ||
4992 | {"statx", __NR_statx}, | ||
4993 | #endif | ||
4994 | #endif | ||
4995 | #ifdef SYS_swapoff | ||
4996 | #ifdef __NR_swapoff | ||
4997 | {"swapoff", __NR_swapoff}, | ||
4998 | #endif | ||
4999 | #endif | ||
5000 | #ifdef SYS_swapon | ||
5001 | #ifdef __NR_swapon | ||
5002 | {"swapon", __NR_swapon}, | ||
5003 | #endif | ||
5004 | #endif | ||
5005 | #ifdef SYS_symlink | ||
5006 | #ifdef __NR_symlink | ||
5007 | {"symlink", __NR_symlink}, | ||
5008 | #endif | ||
5009 | #endif | ||
5010 | #ifdef SYS_symlinkat | ||
5011 | #ifdef __NR_symlinkat | ||
5012 | {"symlinkat", __NR_symlinkat}, | ||
5013 | #endif | ||
5014 | #endif | ||
5015 | #ifdef SYS_sync | ||
5016 | #ifdef __NR_sync | ||
5017 | {"sync", __NR_sync}, | ||
5018 | #endif | ||
5019 | #endif | ||
5020 | #ifdef SYS_sync_file_range | ||
5021 | #ifdef __NR_sync_file_range | ||
5022 | {"sync_file_range", __NR_sync_file_range}, | ||
5023 | #endif | ||
5024 | #endif | ||
5025 | #ifdef SYS_syncfs | ||
5026 | #ifdef __NR_syncfs | ||
5027 | {"syncfs", __NR_syncfs}, | ||
5028 | #endif | ||
5029 | #endif | ||
5030 | #ifdef SYS_sysfs | ||
5031 | #ifdef __NR_sysfs | ||
5032 | {"sysfs", __NR_sysfs}, | ||
5033 | #endif | ||
5034 | #endif | ||
5035 | #ifdef SYS_sysinfo | ||
5036 | #ifdef __NR_sysinfo | ||
5037 | {"sysinfo", __NR_sysinfo}, | ||
5038 | #endif | ||
5039 | #endif | ||
5040 | #ifdef SYS_syslog | ||
5041 | #ifdef __NR_syslog | ||
5042 | {"syslog", __NR_syslog}, | ||
5043 | #endif | ||
5044 | #endif | ||
5045 | #ifdef SYS_tee | ||
5046 | #ifdef __NR_tee | ||
5047 | {"tee", __NR_tee}, | ||
5048 | #endif | ||
5049 | #endif | ||
5050 | #ifdef SYS_tgkill | ||
5051 | #ifdef __NR_tgkill | ||
5052 | {"tgkill", __NR_tgkill}, | ||
5053 | #endif | ||
5054 | #endif | ||
5055 | #ifdef SYS_time | ||
5056 | #ifdef __NR_time | ||
5057 | {"time", __NR_time}, | ||
5058 | #endif | ||
5059 | #endif | ||
5060 | #ifdef SYS_timer_create | ||
5061 | #ifdef __NR_timer_create | ||
5062 | {"timer_create", __NR_timer_create}, | ||
5063 | #endif | ||
5064 | #endif | ||
5065 | #ifdef SYS_timer_delete | ||
5066 | #ifdef __NR_timer_delete | ||
5067 | {"timer_delete", __NR_timer_delete}, | ||
5068 | #endif | ||
5069 | #endif | ||
5070 | #ifdef SYS_timer_getoverrun | ||
5071 | #ifdef __NR_timer_getoverrun | ||
5072 | {"timer_getoverrun", __NR_timer_getoverrun}, | ||
5073 | #endif | ||
5074 | #endif | ||
5075 | #ifdef SYS_timer_gettime | ||
5076 | #ifdef __NR_timer_gettime | ||
5077 | {"timer_gettime", __NR_timer_gettime}, | ||
5078 | #endif | ||
5079 | #endif | ||
5080 | #ifdef SYS_timer_settime | ||
5081 | #ifdef __NR_timer_settime | ||
5082 | {"timer_settime", __NR_timer_settime}, | ||
5083 | #endif | ||
5084 | #endif | ||
5085 | #ifdef SYS_timerfd_create | ||
5086 | #ifdef __NR_timerfd_create | ||
5087 | {"timerfd_create", __NR_timerfd_create}, | ||
5088 | #endif | ||
5089 | #endif | ||
5090 | #ifdef SYS_timerfd_gettime | ||
5091 | #ifdef __NR_timerfd_gettime | ||
5092 | {"timerfd_gettime", __NR_timerfd_gettime}, | ||
5093 | #endif | ||
5094 | #endif | ||
5095 | #ifdef SYS_timerfd_settime | ||
5096 | #ifdef __NR_timerfd_settime | ||
5097 | {"timerfd_settime", __NR_timerfd_settime}, | ||
5098 | #endif | ||
5099 | #endif | ||
5100 | #ifdef SYS_times | ||
5101 | #ifdef __NR_times | ||
5102 | {"times", __NR_times}, | ||
5103 | #endif | ||
5104 | #endif | ||
5105 | #ifdef SYS_tkill | ||
5106 | #ifdef __NR_tkill | ||
5107 | {"tkill", __NR_tkill}, | ||
5108 | #endif | ||
5109 | #endif | ||
5110 | #ifdef SYS_truncate | ||
5111 | #ifdef __NR_truncate | ||
5112 | {"truncate", __NR_truncate}, | ||
5113 | #endif | ||
5114 | #endif | ||
5115 | #ifdef SYS_tuxcall | ||
5116 | #ifdef __NR_tuxcall | ||
5117 | {"tuxcall", __NR_tuxcall}, | ||
5118 | #endif | ||
5119 | #endif | ||
5120 | #ifdef SYS_umask | ||
5121 | #ifdef __NR_umask | ||
5122 | {"umask", __NR_umask}, | ||
5123 | #endif | ||
5124 | #endif | ||
5125 | #ifdef SYS_umount2 | ||
5126 | #ifdef __NR_umount2 | ||
5127 | {"umount2", __NR_umount2}, | ||
5128 | #endif | ||
5129 | #endif | ||
5130 | #ifdef SYS_uname | ||
5131 | #ifdef __NR_uname | ||
5132 | {"uname", __NR_uname}, | ||
5133 | #endif | ||
5134 | #endif | ||
5135 | #ifdef SYS_unlink | ||
5136 | #ifdef __NR_unlink | ||
5137 | {"unlink", __NR_unlink}, | ||
5138 | #endif | ||
5139 | #endif | ||
5140 | #ifdef SYS_unlinkat | ||
5141 | #ifdef __NR_unlinkat | ||
5142 | {"unlinkat", __NR_unlinkat}, | ||
5143 | #endif | ||
5144 | #endif | ||
5145 | #ifdef SYS_unshare | ||
5146 | #ifdef __NR_unshare | ||
5147 | {"unshare", __NR_unshare}, | ||
5148 | #endif | ||
5149 | #endif | ||
5150 | #ifdef SYS_userfaultfd | ||
5151 | #ifdef __NR_userfaultfd | ||
5152 | {"userfaultfd", __NR_userfaultfd}, | ||
5153 | #endif | ||
5154 | #endif | ||
5155 | #ifdef SYS_ustat | ||
5156 | #ifdef __NR_ustat | ||
5157 | {"ustat", __NR_ustat}, | ||
5158 | #endif | ||
5159 | #endif | ||
5160 | #ifdef SYS_utime | ||
5161 | #ifdef __NR_utime | ||
5162 | {"utime", __NR_utime}, | ||
5163 | #endif | ||
5164 | #endif | ||
5165 | #ifdef SYS_utimensat | ||
5166 | #ifdef __NR_utimensat | ||
5167 | {"utimensat", __NR_utimensat}, | ||
5168 | #endif | ||
5169 | #endif | ||
5170 | #ifdef SYS_utimes | ||
5171 | #ifdef __NR_utimes | ||
5172 | {"utimes", __NR_utimes}, | ||
5173 | #endif | ||
5174 | #endif | ||
5175 | #ifdef SYS_vfork | ||
5176 | #ifdef __NR_vfork | ||
5177 | {"vfork", __NR_vfork}, | ||
5178 | #endif | ||
5179 | #endif | ||
5180 | #ifdef SYS_vhangup | ||
5181 | #ifdef __NR_vhangup | ||
5182 | {"vhangup", __NR_vhangup}, | ||
5183 | #endif | ||
5184 | #endif | ||
5185 | #ifdef SYS_vmsplice | ||
5186 | #ifdef __NR_vmsplice | ||
5187 | {"vmsplice", __NR_vmsplice}, | ||
5188 | #endif | ||
5189 | #endif | ||
5190 | #ifdef SYS_wait4 | ||
5191 | #ifdef __NR_wait4 | ||
5192 | {"wait4", __NR_wait4}, | ||
5193 | #endif | ||
5194 | #endif | ||
5195 | #ifdef SYS_waitid | ||
5196 | #ifdef __NR_waitid | ||
5197 | {"waitid", __NR_waitid}, | ||
5198 | #endif | ||
5199 | #endif | ||
5200 | #ifdef SYS_write | ||
5201 | #ifdef __NR_write | ||
5202 | {"write", __NR_write}, | ||
5203 | #endif | ||
5204 | #endif | ||
5205 | #ifdef SYS_writev | ||
5206 | #ifdef __NR_writev | ||
5207 | {"writev", __NR_writev}, | ||
5208 | #endif | ||
5209 | #endif | ||
5210 | #endif | 45 | #endif |
5211 | //#endif | ||
diff --git a/src/include/syscall_armeabi.h b/src/include/syscall_armeabi.h new file mode 100644 index 000000000..cbdc67f37 --- /dev/null +++ b/src/include/syscall_armeabi.h | |||
@@ -0,0 +1,354 @@ | |||
1 | { "accept", 285 }, | ||
2 | { "accept4", 366 }, | ||
3 | { "access", 33 }, | ||
4 | { "acct", 51 }, | ||
5 | { "add_key", 309 }, | ||
6 | { "adjtimex", 124 }, | ||
7 | { "alarm", 27 }, | ||
8 | { "arm_fadvise64_64", 270 }, | ||
9 | { "arm_sync_file_range", 341 }, | ||
10 | { "bdflush", 134 }, | ||
11 | { "bind", 282 }, | ||
12 | { "bpf", 386 }, | ||
13 | { "brk", 45 }, | ||
14 | { "capget", 184 }, | ||
15 | { "capset", 185 }, | ||
16 | { "chdir", 12 }, | ||
17 | { "chmod", 15 }, | ||
18 | { "chown", 182 }, | ||
19 | { "chown32", 212 }, | ||
20 | { "chroot", 61 }, | ||
21 | { "clock_adjtime", 372 }, | ||
22 | { "clock_getres", 264 }, | ||
23 | { "clock_gettime", 263 }, | ||
24 | { "clock_nanosleep", 265 }, | ||
25 | { "clock_settime", 262 }, | ||
26 | { "clone", 120 }, | ||
27 | { "close", 6 }, | ||
28 | { "connect", 283 }, | ||
29 | { "creat", 8 }, | ||
30 | { "delete_module", 129 }, | ||
31 | { "dup2", 63 }, | ||
32 | { "dup3", 358 }, | ||
33 | { "dup", 41 }, | ||
34 | { "epoll_create1", 357 }, | ||
35 | { "epoll_create", 250 }, | ||
36 | { "epoll_ctl", 251 }, | ||
37 | { "epoll_pwait", 346 }, | ||
38 | { "epoll_wait", 252 }, | ||
39 | { "eventfd2", 356 }, | ||
40 | { "eventfd", 351 }, | ||
41 | { "execve", 11 }, | ||
42 | { "exit", 1 }, | ||
43 | { "exit_group", 248 }, | ||
44 | { "faccessat", 334 }, | ||
45 | { "fallocate", 352 }, | ||
46 | { "fanotify_init", 367 }, | ||
47 | { "fanotify_mark", 368 }, | ||
48 | { "fchdir", 133 }, | ||
49 | { "fchmod", 94 }, | ||
50 | { "fchmodat", 333 }, | ||
51 | { "fchown32", 207 }, | ||
52 | { "fchown", 95 }, | ||
53 | { "fchownat", 325 }, | ||
54 | { "fcntl", 55 }, | ||
55 | { "fcntl64", 221 }, | ||
56 | { "fdatasync", 148 }, | ||
57 | { "fgetxattr", 231 }, | ||
58 | { "finit_module", 379 }, | ||
59 | { "flistxattr", 234 }, | ||
60 | { "flock", 143 }, | ||
61 | { "fork", 2 }, | ||
62 | { "fremovexattr", 237 }, | ||
63 | { "fsetxattr", 228 }, | ||
64 | { "fstat", 108 }, | ||
65 | { "fstat64", 197 }, | ||
66 | { "fstatat64", 327 }, | ||
67 | { "fstatfs", 100 }, | ||
68 | { "fstatfs64", 267 }, | ||
69 | { "fsync", 118 }, | ||
70 | { "ftruncate64", 194 }, | ||
71 | { "ftruncate", 93 }, | ||
72 | { "futex", 240 }, | ||
73 | { "futimesat", 326 }, | ||
74 | { "getcpu", 345 }, | ||
75 | { "getcwd", 183 }, | ||
76 | { "getdents", 141 }, | ||
77 | { "getdents64", 217 }, | ||
78 | { "getegid32", 202 }, | ||
79 | { "getegid", 50 }, | ||
80 | { "geteuid32", 201 }, | ||
81 | { "geteuid", 49 }, | ||
82 | { "getgid32", 200 }, | ||
83 | { "getgid", 47 }, | ||
84 | { "getgroups32", 205 }, | ||
85 | { "getgroups", 80 }, | ||
86 | { "getitimer", 105 }, | ||
87 | { "get_mempolicy", 320 }, | ||
88 | { "getpeername", 287 }, | ||
89 | { "getpgid", 132 }, | ||
90 | { "getpgrp", 65 }, | ||
91 | { "getpid", 20 }, | ||
92 | { "getppid", 64 }, | ||
93 | { "getpriority", 96 }, | ||
94 | { "getrandom", 384 }, | ||
95 | { "getresgid", 171 }, | ||
96 | { "getresgid32", 211 }, | ||
97 | { "getresuid", 165 }, | ||
98 | { "getresuid32", 209 }, | ||
99 | { "getrlimit", 76 }, | ||
100 | { "get_robust_list", 339 }, | ||
101 | { "getrusage", 77 }, | ||
102 | { "getsid", 147 }, | ||
103 | { "getsockname", 286 }, | ||
104 | { "getsockopt", 295 }, | ||
105 | { "gettid", 224 }, | ||
106 | { "gettimeofday", 78 }, | ||
107 | { "getuid", 24 }, | ||
108 | { "getuid32", 199 }, | ||
109 | { "getxattr", 229 }, | ||
110 | { "init_module", 128 }, | ||
111 | { "inotify_add_watch", 317 }, | ||
112 | { "inotify_init1", 360 }, | ||
113 | { "inotify_init", 316 }, | ||
114 | { "inotify_rm_watch", 318 }, | ||
115 | { "io_cancel", 247 }, | ||
116 | { "ioctl", 54 }, | ||
117 | { "io_destroy", 244 }, | ||
118 | { "io_getevents", 245 }, | ||
119 | { "ioprio_get", 315 }, | ||
120 | { "ioprio_set", 314 }, | ||
121 | { "io_setup", 243 }, | ||
122 | { "io_submit", 246 }, | ||
123 | { "ipc", 117 }, | ||
124 | { "kcmp", 378 }, | ||
125 | { "kexec_load", 347 }, | ||
126 | { "keyctl", 311 }, | ||
127 | { "kill", 37 }, | ||
128 | { "lchown", 16 }, | ||
129 | { "lchown32", 198 }, | ||
130 | { "lgetxattr", 230 }, | ||
131 | { "link", 9 }, | ||
132 | { "linkat", 330 }, | ||
133 | { "listen", 284 }, | ||
134 | { "listxattr", 232 }, | ||
135 | { "llistxattr", 233 }, | ||
136 | { "_llseek", 140 }, | ||
137 | { "lookup_dcookie", 249 }, | ||
138 | { "lremovexattr", 236 }, | ||
139 | { "lseek", 19 }, | ||
140 | { "lsetxattr", 227 }, | ||
141 | { "lstat", 107 }, | ||
142 | { "lstat64", 196 }, | ||
143 | { "madvise", 220 }, | ||
144 | { "mbind", 319 }, | ||
145 | { "memfd_create", 385 }, | ||
146 | { "mincore", 219 }, | ||
147 | { "mkdir", 39 }, | ||
148 | { "mkdirat", 323 }, | ||
149 | { "mknod", 14 }, | ||
150 | { "mknodat", 324 }, | ||
151 | { "mlock", 150 }, | ||
152 | { "mlockall", 152 }, | ||
153 | { "mmap2", 192 }, | ||
154 | { "mmap", 90 }, | ||
155 | { "mount", 21 }, | ||
156 | { "move_pages", 344 }, | ||
157 | { "mprotect", 125 }, | ||
158 | { "mq_getsetattr", 279 }, | ||
159 | { "mq_notify", 278 }, | ||
160 | { "mq_open", 274 }, | ||
161 | { "mq_timedreceive", 277 }, | ||
162 | { "mq_timedsend", 276 }, | ||
163 | { "mq_unlink", 275 }, | ||
164 | { "mremap", 163 }, | ||
165 | { "msgctl", 304 }, | ||
166 | { "msgget", 303 }, | ||
167 | { "msgrcv", 302 }, | ||
168 | { "msgsnd", 301 }, | ||
169 | { "msync", 144 }, | ||
170 | { "munlock", 151 }, | ||
171 | { "munlockall", 153 }, | ||
172 | { "munmap", 91 }, | ||
173 | { "name_to_handle_at", 370 }, | ||
174 | { "nanosleep", 162 }, | ||
175 | { "_newselect", 142 }, | ||
176 | { "nfsservctl", 169 }, | ||
177 | { "nice", 34 }, | ||
178 | { "open", 5 }, | ||
179 | { "openat", 322 }, | ||
180 | { "open_by_handle_at", 371 }, | ||
181 | { "pause", 29 }, | ||
182 | { "pciconfig_iobase", 271 }, | ||
183 | { "pciconfig_read", 272 }, | ||
184 | { "pciconfig_write", 273 }, | ||
185 | { "perf_event_open", 364 }, | ||
186 | { "personality", 136 }, | ||
187 | { "pipe2", 359 }, | ||
188 | { "pipe", 42 }, | ||
189 | { "pivot_root", 218 }, | ||
190 | { "poll", 168 }, | ||
191 | { "ppoll", 336 }, | ||
192 | { "prctl", 172 }, | ||
193 | { "pread64", 180 }, | ||
194 | { "preadv", 361 }, | ||
195 | { "prlimit64", 369 }, | ||
196 | { "process_vm_readv", 376 }, | ||
197 | { "process_vm_writev", 377 }, | ||
198 | { "pselect6", 335 }, | ||
199 | { "ptrace", 26 }, | ||
200 | { "pwrite64", 181 }, | ||
201 | { "pwritev", 362 }, | ||
202 | { "quotactl", 131 }, | ||
203 | { "read", 3 }, | ||
204 | { "readahead", 225 }, | ||
205 | { "readdir", 89 }, | ||
206 | { "readlink", 85 }, | ||
207 | { "readlinkat", 332 }, | ||
208 | { "readv", 145 }, | ||
209 | { "reboot", 88 }, | ||
210 | { "recv", 291 }, | ||
211 | { "recvfrom", 292 }, | ||
212 | { "recvmmsg", 365 }, | ||
213 | { "recvmsg", 297 }, | ||
214 | { "remap_file_pages", 253 }, | ||
215 | { "removexattr", 235 }, | ||
216 | { "rename", 38 }, | ||
217 | { "renameat2", 382 }, | ||
218 | { "renameat", 329 }, | ||
219 | { "request_key", 310 }, | ||
220 | { "rmdir", 40 }, | ||
221 | { "rt_sigaction", 174 }, | ||
222 | { "rt_sigpending", 176 }, | ||
223 | { "rt_sigprocmask", 175 }, | ||
224 | { "rt_sigqueueinfo", 178 }, | ||
225 | { "rt_sigreturn", 173 }, | ||
226 | { "rt_sigsuspend", 179 }, | ||
227 | { "rt_sigtimedwait", 177 }, | ||
228 | { "rt_tgsigqueueinfo", 363 }, | ||
229 | { "sched_getaffinity", 242 }, | ||
230 | { "sched_getattr", 381 }, | ||
231 | { "sched_getparam", 155 }, | ||
232 | { "sched_get_priority_max", 159 }, | ||
233 | { "sched_get_priority_min", 160 }, | ||
234 | { "sched_getscheduler", 157 }, | ||
235 | { "sched_rr_get_interval", 161 }, | ||
236 | { "sched_setaffinity", 241 }, | ||
237 | { "sched_setattr", 380 }, | ||
238 | { "sched_setparam", 154 }, | ||
239 | { "sched_setscheduler", 156 }, | ||
240 | { "sched_yield", 158 }, | ||
241 | { "seccomp", 383 }, | ||
242 | { "select", 82 }, | ||
243 | { "semctl", 300 }, | ||
244 | { "semget", 299 }, | ||
245 | { "semop", 298 }, | ||
246 | { "semtimedop", 312 }, | ||
247 | { "send", 289 }, | ||
248 | { "sendfile", 187 }, | ||
249 | { "sendfile64", 239 }, | ||
250 | { "sendmmsg", 374 }, | ||
251 | { "sendmsg", 296 }, | ||
252 | { "sendto", 290 }, | ||
253 | { "setdomainname", 121 }, | ||
254 | { "setfsgid", 139 }, | ||
255 | { "setfsgid32", 216 }, | ||
256 | { "setfsuid", 138 }, | ||
257 | { "setfsuid32", 215 }, | ||
258 | { "setgid32", 214 }, | ||
259 | { "setgid", 46 }, | ||
260 | { "setgroups32", 206 }, | ||
261 | { "setgroups", 81 }, | ||
262 | { "sethostname", 74 }, | ||
263 | { "setitimer", 104 }, | ||
264 | { "set_mempolicy", 321 }, | ||
265 | { "setns", 375 }, | ||
266 | { "setpgid", 57 }, | ||
267 | { "setpriority", 97 }, | ||
268 | { "setregid32", 204 }, | ||
269 | { "setregid", 71 }, | ||
270 | { "setresgid", 170 }, | ||
271 | { "setresgid32", 210 }, | ||
272 | { "setresuid", 164 }, | ||
273 | { "setresuid32", 208 }, | ||
274 | { "setreuid32", 203 }, | ||
275 | { "setreuid", 70 }, | ||
276 | { "setrlimit", 75 }, | ||
277 | { "set_robust_list", 338 }, | ||
278 | { "setsid", 66 }, | ||
279 | { "setsockopt", 294 }, | ||
280 | { "set_tid_address", 256 }, | ||
281 | { "settimeofday", 79 }, | ||
282 | { "setuid", 23 }, | ||
283 | { "setuid32", 213 }, | ||
284 | { "setxattr", 226 }, | ||
285 | { "shmat", 305 }, | ||
286 | { "shmctl", 308 }, | ||
287 | { "shmdt", 306 }, | ||
288 | { "shmget", 307 }, | ||
289 | { "shutdown", 293 }, | ||
290 | { "sigaction", 67 }, | ||
291 | { "sigaltstack", 186 }, | ||
292 | { "signalfd", 349 }, | ||
293 | { "signalfd4", 355 }, | ||
294 | { "sigpending", 73 }, | ||
295 | { "sigprocmask", 126 }, | ||
296 | { "sigreturn", 119 }, | ||
297 | { "sigsuspend", 72 }, | ||
298 | { "socket", 281 }, | ||
299 | { "socketcall", 102 }, | ||
300 | { "socketpair", 288 }, | ||
301 | { "splice", 340 }, | ||
302 | { "stat", 106 }, | ||
303 | { "stat64", 195 }, | ||
304 | { "statfs64", 266 }, | ||
305 | { "statfs", 99 }, | ||
306 | { "stime", 25 }, | ||
307 | { "swapoff", 115 }, | ||
308 | { "swapon", 87 }, | ||
309 | { "symlink", 83 }, | ||
310 | { "symlinkat", 331 }, | ||
311 | { "sync", 36 }, | ||
312 | { "sync_file_range2", 341 }, | ||
313 | { "syncfs", 373 }, | ||
314 | { "syscall", 113 }, | ||
315 | { "_sysctl", 149 }, | ||
316 | { "sysfs", 135 }, | ||
317 | { "sysinfo", 116 }, | ||
318 | { "syslog", 103 }, | ||
319 | { "tee", 342 }, | ||
320 | { "tgkill", 268 }, | ||
321 | { "time", 13 }, | ||
322 | { "timer_create", 257 }, | ||
323 | { "timer_delete", 261 }, | ||
324 | { "timerfd_create", 350 }, | ||
325 | { "timerfd_gettime", 354 }, | ||
326 | { "timerfd_settime", 353 }, | ||
327 | { "timer_getoverrun", 260 }, | ||
328 | { "timer_gettime", 259 }, | ||
329 | { "timer_settime", 258 }, | ||
330 | { "times", 43 }, | ||
331 | { "tkill", 238 }, | ||
332 | { "truncate64", 193 }, | ||
333 | { "truncate", 92 }, | ||
334 | { "ugetrlimit", 191 }, | ||
335 | { "umask", 60 }, | ||
336 | { "umount", 22 }, | ||
337 | { "umount2", 52 }, | ||
338 | { "uname", 122 }, | ||
339 | { "unlink", 10 }, | ||
340 | { "unlinkat", 328 }, | ||
341 | { "unshare", 337 }, | ||
342 | { "uselib", 86 }, | ||
343 | { "ustat", 62 }, | ||
344 | { "utime", 30 }, | ||
345 | { "utimensat", 348 }, | ||
346 | { "utimes", 269 }, | ||
347 | { "vfork", 190 }, | ||
348 | { "vhangup", 111 }, | ||
349 | { "vmsplice", 343 }, | ||
350 | { "vserver", 313 }, | ||
351 | { "wait4", 114 }, | ||
352 | { "waitid", 280 }, | ||
353 | { "write", 4 }, | ||
354 | { "writev", 146 }, | ||
diff --git a/src/include/syscall_i386.h b/src/include/syscall_i386.h new file mode 100644 index 000000000..4795e5b2a --- /dev/null +++ b/src/include/syscall_i386.h | |||
@@ -0,0 +1,425 @@ | |||
1 | { "_llseek", 140 }, | ||
2 | { "_newselect", 142 }, | ||
3 | { "_sysctl", 149 }, | ||
4 | { "accept4", 364 }, | ||
5 | { "access", 33 }, | ||
6 | { "acct", 51 }, | ||
7 | { "add_key", 286 }, | ||
8 | { "adjtimex", 124 }, | ||
9 | { "afs_syscall", 137 }, | ||
10 | { "alarm", 27 }, | ||
11 | { "arch_prctl", 384 }, | ||
12 | { "bdflush", 134 }, | ||
13 | { "bind", 361 }, | ||
14 | { "bpf", 357 }, | ||
15 | { "break", 17 }, | ||
16 | { "brk", 45 }, | ||
17 | { "capget", 184 }, | ||
18 | { "capset", 185 }, | ||
19 | { "chdir", 12 }, | ||
20 | { "chmod", 15 }, | ||
21 | { "chown", 182 }, | ||
22 | { "chown32", 212 }, | ||
23 | { "chroot", 61 }, | ||
24 | { "clock_adjtime", 343 }, | ||
25 | { "clock_adjtime64", 405 }, | ||
26 | { "clock_getres", 266 }, | ||
27 | { "clock_getres_time64", 406 }, | ||
28 | { "clock_gettime", 265 }, | ||
29 | { "clock_gettime64", 403 }, | ||
30 | { "clock_nanosleep", 267 }, | ||
31 | { "clock_nanosleep_time64", 407 }, | ||
32 | { "clock_settime", 264 }, | ||
33 | { "clock_settime64", 404 }, | ||
34 | { "clone", 120 }, | ||
35 | { "clone3", 435 }, | ||
36 | { "close", 6 }, | ||
37 | { "connect", 362 }, | ||
38 | { "copy_file_range", 377 }, | ||
39 | { "creat", 8 }, | ||
40 | { "create_module", 127 }, | ||
41 | { "delete_module", 129 }, | ||
42 | { "dup", 41 }, | ||
43 | { "dup2", 63 }, | ||
44 | { "dup3", 330 }, | ||
45 | { "epoll_create", 254 }, | ||
46 | { "epoll_create1", 329 }, | ||
47 | { "epoll_ctl", 255 }, | ||
48 | { "epoll_pwait", 319 }, | ||
49 | { "epoll_wait", 256 }, | ||
50 | { "eventfd", 323 }, | ||
51 | { "eventfd2", 328 }, | ||
52 | { "execve", 11 }, | ||
53 | { "execveat", 358 }, | ||
54 | { "exit", 1 }, | ||
55 | { "exit_group", 252 }, | ||
56 | { "faccessat", 307 }, | ||
57 | { "fadvise64", 250 }, | ||
58 | { "fadvise64_64", 272 }, | ||
59 | { "fallocate", 324 }, | ||
60 | { "fanotify_init", 338 }, | ||
61 | { "fanotify_mark", 339 }, | ||
62 | { "fchdir", 133 }, | ||
63 | { "fchmod", 94 }, | ||
64 | { "fchmodat", 306 }, | ||
65 | { "fchown", 95 }, | ||
66 | { "fchown32", 207 }, | ||
67 | { "fchownat", 298 }, | ||
68 | { "fcntl", 55 }, | ||
69 | { "fcntl64", 221 }, | ||
70 | { "fdatasync", 148 }, | ||
71 | { "fgetxattr", 231 }, | ||
72 | { "finit_module", 350 }, | ||
73 | { "flistxattr", 234 }, | ||
74 | { "flock", 143 }, | ||
75 | { "fork", 2 }, | ||
76 | { "fremovexattr", 237 }, | ||
77 | { "fsconfig", 431 }, | ||
78 | { "fsetxattr", 228 }, | ||
79 | { "fsmount", 432 }, | ||
80 | { "fsopen", 430 }, | ||
81 | { "fspick", 433 }, | ||
82 | { "fstat", 108 }, | ||
83 | { "fstat64", 197 }, | ||
84 | { "fstatat64", 300 }, | ||
85 | { "fstatfs", 100 }, | ||
86 | { "fstatfs64", 269 }, | ||
87 | { "fsync", 118 }, | ||
88 | { "ftime", 35 }, | ||
89 | { "ftruncate", 93 }, | ||
90 | { "ftruncate64", 194 }, | ||
91 | { "futex", 240 }, | ||
92 | { "futex_time64", 422 }, | ||
93 | { "futimesat", 299 }, | ||
94 | { "get_kernel_syms", 130 }, | ||
95 | { "get_mempolicy", 275 }, | ||
96 | { "get_robust_list", 312 }, | ||
97 | { "get_thread_area", 244 }, | ||
98 | { "getcpu", 318 }, | ||
99 | { "getcwd", 183 }, | ||
100 | { "getdents", 141 }, | ||
101 | { "getdents64", 220 }, | ||
102 | { "getegid", 50 }, | ||
103 | { "getegid32", 202 }, | ||
104 | { "geteuid", 49 }, | ||
105 | { "geteuid32", 201 }, | ||
106 | { "getgid", 47 }, | ||
107 | { "getgid32", 200 }, | ||
108 | { "getgroups", 80 }, | ||
109 | { "getgroups32", 205 }, | ||
110 | { "getitimer", 105 }, | ||
111 | { "getpeername", 368 }, | ||
112 | { "getpgid", 132 }, | ||
113 | { "getpgrp", 65 }, | ||
114 | { "getpid", 20 }, | ||
115 | { "getpmsg", 188 }, | ||
116 | { "getppid", 64 }, | ||
117 | { "getpriority", 96 }, | ||
118 | { "getrandom", 355 }, | ||
119 | { "getresgid", 171 }, | ||
120 | { "getresgid32", 211 }, | ||
121 | { "getresuid", 165 }, | ||
122 | { "getresuid32", 209 }, | ||
123 | { "getrlimit", 76 }, | ||
124 | { "getrusage", 77 }, | ||
125 | { "getsid", 147 }, | ||
126 | { "getsockname", 367 }, | ||
127 | { "getsockopt", 365 }, | ||
128 | { "gettid", 224 }, | ||
129 | { "gettimeofday", 78 }, | ||
130 | { "getuid", 24 }, | ||
131 | { "getuid32", 199 }, | ||
132 | { "getxattr", 229 }, | ||
133 | { "gtty", 32 }, | ||
134 | { "idle", 112 }, | ||
135 | { "init_module", 128 }, | ||
136 | { "inotify_add_watch", 292 }, | ||
137 | { "inotify_init", 291 }, | ||
138 | { "inotify_init1", 332 }, | ||
139 | { "inotify_rm_watch", 293 }, | ||
140 | { "io_cancel", 249 }, | ||
141 | { "io_destroy", 246 }, | ||
142 | { "io_getevents", 247 }, | ||
143 | { "io_pgetevents", 385 }, | ||
144 | { "io_pgetevents_time64", 416 }, | ||
145 | { "io_setup", 245 }, | ||
146 | { "io_submit", 248 }, | ||
147 | { "io_uring_enter", 426 }, | ||
148 | { "io_uring_register", 427 }, | ||
149 | { "io_uring_setup", 425 }, | ||
150 | { "ioctl", 54 }, | ||
151 | { "ioperm", 101 }, | ||
152 | { "iopl", 110 }, | ||
153 | { "ioprio_get", 290 }, | ||
154 | { "ioprio_set", 289 }, | ||
155 | { "ipc", 117 }, | ||
156 | { "kcmp", 349 }, | ||
157 | { "kexec_load", 283 }, | ||
158 | { "keyctl", 288 }, | ||
159 | { "kill", 37 }, | ||
160 | { "lchown", 16 }, | ||
161 | { "lchown32", 198 }, | ||
162 | { "lgetxattr", 230 }, | ||
163 | { "link", 9 }, | ||
164 | { "linkat", 303 }, | ||
165 | { "listen", 363 }, | ||
166 | { "listxattr", 232 }, | ||
167 | { "llistxattr", 233 }, | ||
168 | { "lock", 53 }, | ||
169 | { "lookup_dcookie", 253 }, | ||
170 | { "lremovexattr", 236 }, | ||
171 | { "lseek", 19 }, | ||
172 | { "lsetxattr", 227 }, | ||
173 | { "lstat", 107 }, | ||
174 | { "lstat64", 196 }, | ||
175 | { "madvise", 219 }, | ||
176 | { "mbind", 274 }, | ||
177 | { "membarrier", 375 }, | ||
178 | { "memfd_create", 356 }, | ||
179 | { "migrate_pages", 294 }, | ||
180 | { "mincore", 218 }, | ||
181 | { "mkdir", 39 }, | ||
182 | { "mkdirat", 296 }, | ||
183 | { "mknod", 14 }, | ||
184 | { "mknodat", 297 }, | ||
185 | { "mlock", 150 }, | ||
186 | { "mlock2", 376 }, | ||
187 | { "mlockall", 152 }, | ||
188 | { "mmap", 90 }, | ||
189 | { "mmap2", 192 }, | ||
190 | { "modify_ldt", 123 }, | ||
191 | { "mount", 21 }, | ||
192 | { "move_mount", 429 }, | ||
193 | { "move_pages", 317 }, | ||
194 | { "mprotect", 125 }, | ||
195 | { "mpx", 56 }, | ||
196 | { "mq_getsetattr", 282 }, | ||
197 | { "mq_notify", 281 }, | ||
198 | { "mq_open", 277 }, | ||
199 | { "mq_timedreceive", 280 }, | ||
200 | { "mq_timedreceive_time64", 419 }, | ||
201 | { "mq_timedsend", 279 }, | ||
202 | { "mq_timedsend_time64", 418 }, | ||
203 | { "mq_unlink", 278 }, | ||
204 | { "mremap", 163 }, | ||
205 | { "msgctl", 402 }, | ||
206 | { "msgget", 399 }, | ||
207 | { "msgrcv", 401 }, | ||
208 | { "msgsnd", 400 }, | ||
209 | { "msync", 144 }, | ||
210 | { "munlock", 151 }, | ||
211 | { "munlockall", 153 }, | ||
212 | { "munmap", 91 }, | ||
213 | { "name_to_handle_at", 341 }, | ||
214 | { "nanosleep", 162 }, | ||
215 | { "nfsservctl", 169 }, | ||
216 | { "nice", 34 }, | ||
217 | { "oldfstat", 28 }, | ||
218 | { "oldlstat", 84 }, | ||
219 | { "oldolduname", 59 }, | ||
220 | { "oldstat", 18 }, | ||
221 | { "olduname", 109 }, | ||
222 | { "open", 5 }, | ||
223 | { "open_by_handle_at", 342 }, | ||
224 | { "open_tree", 428 }, | ||
225 | { "openat", 295 }, | ||
226 | { "pause", 29 }, | ||
227 | { "perf_event_open", 336 }, | ||
228 | { "personality", 136 }, | ||
229 | { "pidfd_open", 434 }, | ||
230 | { "pidfd_send_signal", 424 }, | ||
231 | { "pipe", 42 }, | ||
232 | { "pipe2", 331 }, | ||
233 | { "pivot_root", 217 }, | ||
234 | { "pkey_alloc", 381 }, | ||
235 | { "pkey_free", 382 }, | ||
236 | { "pkey_mprotect", 380 }, | ||
237 | { "poll", 168 }, | ||
238 | { "ppoll", 309 }, | ||
239 | { "ppoll_time64", 414 }, | ||
240 | { "prctl", 172 }, | ||
241 | { "pread64", 180 }, | ||
242 | { "preadv", 333 }, | ||
243 | { "preadv2", 378 }, | ||
244 | { "prlimit64", 340 }, | ||
245 | { "process_vm_readv", 347 }, | ||
246 | { "process_vm_writev", 348 }, | ||
247 | { "prof", 44 }, | ||
248 | { "profil", 98 }, | ||
249 | { "pselect6", 308 }, | ||
250 | { "pselect6_time64", 413 }, | ||
251 | { "ptrace", 26 }, | ||
252 | { "putpmsg", 189 }, | ||
253 | { "pwrite64", 181 }, | ||
254 | { "pwritev", 334 }, | ||
255 | { "pwritev2", 379 }, | ||
256 | { "query_module", 167 }, | ||
257 | { "quotactl", 131 }, | ||
258 | { "read", 3 }, | ||
259 | { "readahead", 225 }, | ||
260 | { "readdir", 89 }, | ||
261 | { "readlink", 85 }, | ||
262 | { "readlinkat", 305 }, | ||
263 | { "readv", 145 }, | ||
264 | { "reboot", 88 }, | ||
265 | { "recvfrom", 371 }, | ||
266 | { "recvmmsg", 337 }, | ||
267 | { "recvmmsg_time64", 417 }, | ||
268 | { "recvmsg", 372 }, | ||
269 | { "remap_file_pages", 257 }, | ||
270 | { "removexattr", 235 }, | ||
271 | { "rename", 38 }, | ||
272 | { "renameat", 302 }, | ||
273 | { "renameat2", 353 }, | ||
274 | { "request_key", 287 }, | ||
275 | { "restart_syscall", 0 }, | ||
276 | { "rmdir", 40 }, | ||
277 | { "rseq", 386 }, | ||
278 | { "rt_sigaction", 174 }, | ||
279 | { "rt_sigpending", 176 }, | ||
280 | { "rt_sigprocmask", 175 }, | ||
281 | { "rt_sigqueueinfo", 178 }, | ||
282 | { "rt_sigreturn", 173 }, | ||
283 | { "rt_sigsuspend", 179 }, | ||
284 | { "rt_sigtimedwait", 177 }, | ||
285 | { "rt_sigtimedwait_time64", 421 }, | ||
286 | { "rt_tgsigqueueinfo", 335 }, | ||
287 | { "sched_get_priority_max", 159 }, | ||
288 | { "sched_get_priority_min", 160 }, | ||
289 | { "sched_getaffinity", 242 }, | ||
290 | { "sched_getattr", 352 }, | ||
291 | { "sched_getparam", 155 }, | ||
292 | { "sched_getscheduler", 157 }, | ||
293 | { "sched_rr_get_interval", 161 }, | ||
294 | { "sched_rr_get_interval_time64", 423 }, | ||
295 | { "sched_setaffinity", 241 }, | ||
296 | { "sched_setattr", 351 }, | ||
297 | { "sched_setparam", 154 }, | ||
298 | { "sched_setscheduler", 156 }, | ||
299 | { "sched_yield", 158 }, | ||
300 | { "seccomp", 354 }, | ||
301 | { "select", 82 }, | ||
302 | { "semctl", 394 }, | ||
303 | { "semget", 393 }, | ||
304 | { "semtimedop_time64", 420 }, | ||
305 | { "sendfile", 187 }, | ||
306 | { "sendfile64", 239 }, | ||
307 | { "sendmmsg", 345 }, | ||
308 | { "sendmsg", 370 }, | ||
309 | { "sendto", 369 }, | ||
310 | { "set_mempolicy", 276 }, | ||
311 | { "set_robust_list", 311 }, | ||
312 | { "set_thread_area", 243 }, | ||
313 | { "set_tid_address", 258 }, | ||
314 | { "setdomainname", 121 }, | ||
315 | { "setfsgid", 139 }, | ||
316 | { "setfsgid32", 216 }, | ||
317 | { "setfsuid", 138 }, | ||
318 | { "setfsuid32", 215 }, | ||
319 | { "setgid", 46 }, | ||
320 | { "setgid32", 214 }, | ||
321 | { "setgroups", 81 }, | ||
322 | { "setgroups32", 206 }, | ||
323 | { "sethostname", 74 }, | ||
324 | { "setitimer", 104 }, | ||
325 | { "setns", 346 }, | ||
326 | { "setpgid", 57 }, | ||
327 | { "setpriority", 97 }, | ||
328 | { "setregid", 71 }, | ||
329 | { "setregid32", 204 }, | ||
330 | { "setresgid", 170 }, | ||
331 | { "setresgid32", 210 }, | ||
332 | { "setresuid", 164 }, | ||
333 | { "setresuid32", 208 }, | ||
334 | { "setreuid", 70 }, | ||
335 | { "setreuid32", 203 }, | ||
336 | { "setrlimit", 75 }, | ||
337 | { "setsid", 66 }, | ||
338 | { "setsockopt", 366 }, | ||
339 | { "settimeofday", 79 }, | ||
340 | { "setuid", 23 }, | ||
341 | { "setuid32", 213 }, | ||
342 | { "setxattr", 226 }, | ||
343 | { "sgetmask", 68 }, | ||
344 | { "shmat", 397 }, | ||
345 | { "shmctl", 396 }, | ||
346 | { "shmdt", 398 }, | ||
347 | { "shmget", 395 }, | ||
348 | { "shutdown", 373 }, | ||
349 | { "sigaction", 67 }, | ||
350 | { "sigaltstack", 186 }, | ||
351 | { "signal", 48 }, | ||
352 | { "signalfd", 321 }, | ||
353 | { "signalfd4", 327 }, | ||
354 | { "sigpending", 73 }, | ||
355 | { "sigprocmask", 126 }, | ||
356 | { "sigreturn", 119 }, | ||
357 | { "sigsuspend", 72 }, | ||
358 | { "socket", 359 }, | ||
359 | { "socketcall", 102 }, | ||
360 | { "socketpair", 360 }, | ||
361 | { "splice", 313 }, | ||
362 | { "ssetmask", 69 }, | ||
363 | { "stat", 106 }, | ||
364 | { "stat64", 195 }, | ||
365 | { "statfs", 99 }, | ||
366 | { "statfs64", 268 }, | ||
367 | { "statx", 383 }, | ||
368 | { "stime", 25 }, | ||
369 | { "stty", 31 }, | ||
370 | { "swapoff", 115 }, | ||
371 | { "swapon", 87 }, | ||
372 | { "symlink", 83 }, | ||
373 | { "symlinkat", 304 }, | ||
374 | { "sync", 36 }, | ||
375 | { "sync_file_range", 314 }, | ||
376 | { "syncfs", 344 }, | ||
377 | { "sysfs", 135 }, | ||
378 | { "sysinfo", 116 }, | ||
379 | { "syslog", 103 }, | ||
380 | { "tee", 315 }, | ||
381 | { "tgkill", 270 }, | ||
382 | { "time", 13 }, | ||
383 | { "timer_create", 259 }, | ||
384 | { "timer_delete", 263 }, | ||
385 | { "timer_getoverrun", 262 }, | ||
386 | { "timer_gettime", 261 }, | ||
387 | { "timer_gettime64", 408 }, | ||
388 | { "timer_settime", 260 }, | ||
389 | { "timer_settime64", 409 }, | ||
390 | { "timerfd_create", 322 }, | ||
391 | { "timerfd_gettime", 326 }, | ||
392 | { "timerfd_gettime64", 410 }, | ||
393 | { "timerfd_settime", 325 }, | ||
394 | { "timerfd_settime64", 411 }, | ||
395 | { "times", 43 }, | ||
396 | { "tkill", 238 }, | ||
397 | { "truncate", 92 }, | ||
398 | { "truncate64", 193 }, | ||
399 | { "ugetrlimit", 191 }, | ||
400 | { "ulimit", 58 }, | ||
401 | { "umask", 60 }, | ||
402 | { "umount", 22 }, | ||
403 | { "umount2", 52 }, | ||
404 | { "uname", 122 }, | ||
405 | { "unlink", 10 }, | ||
406 | { "unlinkat", 301 }, | ||
407 | { "unshare", 310 }, | ||
408 | { "uselib", 86 }, | ||
409 | { "userfaultfd", 374 }, | ||
410 | { "ustat", 62 }, | ||
411 | { "utime", 30 }, | ||
412 | { "utimensat", 320 }, | ||
413 | { "utimensat_time64", 412 }, | ||
414 | { "utimes", 271 }, | ||
415 | { "vfork", 190 }, | ||
416 | { "vhangup", 111 }, | ||
417 | { "vm86", 166 }, | ||
418 | { "vm86old", 113 }, | ||
419 | { "vmsplice", 316 }, | ||
420 | { "vserver", 273 }, | ||
421 | { "wait4", 114 }, | ||
422 | { "waitid", 284 }, | ||
423 | { "waitpid", 7 }, | ||
424 | { "write", 4 }, | ||
425 | { "writev", 146 }, | ||
diff --git a/src/include/syscall_x86_64.h b/src/include/syscall_x86_64.h new file mode 100644 index 000000000..539e874be --- /dev/null +++ b/src/include/syscall_x86_64.h | |||
@@ -0,0 +1,347 @@ | |||
1 | { "_sysctl", 156 }, | ||
2 | { "accept", 43 }, | ||
3 | { "accept4", 288 }, | ||
4 | { "access", 21 }, | ||
5 | { "acct", 163 }, | ||
6 | { "add_key", 248 }, | ||
7 | { "adjtimex", 159 }, | ||
8 | { "afs_syscall", 183 }, | ||
9 | { "alarm", 37 }, | ||
10 | { "arch_prctl", 158 }, | ||
11 | { "bind", 49 }, | ||
12 | { "bpf", 321 }, | ||
13 | { "brk", 12 }, | ||
14 | { "capget", 125 }, | ||
15 | { "capset", 126 }, | ||
16 | { "chdir", 80 }, | ||
17 | { "chmod", 90 }, | ||
18 | { "chown", 92 }, | ||
19 | { "chroot", 161 }, | ||
20 | { "clock_adjtime", 305 }, | ||
21 | { "clock_getres", 229 }, | ||
22 | { "clock_gettime", 228 }, | ||
23 | { "clock_nanosleep", 230 }, | ||
24 | { "clock_settime", 227 }, | ||
25 | { "clone", 56 }, | ||
26 | { "clone3", 435 }, | ||
27 | { "close", 3 }, | ||
28 | { "connect", 42 }, | ||
29 | { "copy_file_range", 326 }, | ||
30 | { "creat", 85 }, | ||
31 | { "create_module", 174 }, | ||
32 | { "delete_module", 176 }, | ||
33 | { "dup", 32 }, | ||
34 | { "dup2", 33 }, | ||
35 | { "dup3", 292 }, | ||
36 | { "epoll_create", 213 }, | ||
37 | { "epoll_create1", 291 }, | ||
38 | { "epoll_ctl", 233 }, | ||
39 | { "epoll_ctl_old", 214 }, | ||
40 | { "epoll_pwait", 281 }, | ||
41 | { "epoll_wait", 232 }, | ||
42 | { "epoll_wait_old", 215 }, | ||
43 | { "eventfd", 284 }, | ||
44 | { "eventfd2", 290 }, | ||
45 | { "execve", 59 }, | ||
46 | { "execveat", 322 }, | ||
47 | { "exit", 60 }, | ||
48 | { "exit_group", 231 }, | ||
49 | { "faccessat", 269 }, | ||
50 | { "fadvise64", 221 }, | ||
51 | { "fallocate", 285 }, | ||
52 | { "fanotify_init", 300 }, | ||
53 | { "fanotify_mark", 301 }, | ||
54 | { "fchdir", 81 }, | ||
55 | { "fchmod", 91 }, | ||
56 | { "fchmodat", 268 }, | ||
57 | { "fchown", 93 }, | ||
58 | { "fchownat", 260 }, | ||
59 | { "fcntl", 72 }, | ||
60 | { "fdatasync", 75 }, | ||
61 | { "fgetxattr", 193 }, | ||
62 | { "finit_module", 313 }, | ||
63 | { "flistxattr", 196 }, | ||
64 | { "flock", 73 }, | ||
65 | { "fork", 57 }, | ||
66 | { "fremovexattr", 199 }, | ||
67 | { "fsconfig", 431 }, | ||
68 | { "fsetxattr", 190 }, | ||
69 | { "fsmount", 432 }, | ||
70 | { "fsopen", 430 }, | ||
71 | { "fspick", 433 }, | ||
72 | { "fstat", 5 }, | ||
73 | { "fstatfs", 138 }, | ||
74 | { "fsync", 74 }, | ||
75 | { "ftruncate", 77 }, | ||
76 | { "futex", 202 }, | ||
77 | { "futimesat", 261 }, | ||
78 | { "get_kernel_syms", 177 }, | ||
79 | { "get_mempolicy", 239 }, | ||
80 | { "get_robust_list", 274 }, | ||
81 | { "get_thread_area", 211 }, | ||
82 | { "getcpu", 309 }, | ||
83 | { "getcwd", 79 }, | ||
84 | { "getdents", 78 }, | ||
85 | { "getdents64", 217 }, | ||
86 | { "getegid", 108 }, | ||
87 | { "geteuid", 107 }, | ||
88 | { "getgid", 104 }, | ||
89 | { "getgroups", 115 }, | ||
90 | { "getitimer", 36 }, | ||
91 | { "getpeername", 52 }, | ||
92 | { "getpgid", 121 }, | ||
93 | { "getpgrp", 111 }, | ||
94 | { "getpid", 39 }, | ||
95 | { "getpmsg", 181 }, | ||
96 | { "getppid", 110 }, | ||
97 | { "getpriority", 140 }, | ||
98 | { "getrandom", 318 }, | ||
99 | { "getresgid", 120 }, | ||
100 | { "getresuid", 118 }, | ||
101 | { "getrlimit", 97 }, | ||
102 | { "getrusage", 98 }, | ||
103 | { "getsid", 124 }, | ||
104 | { "getsockname", 51 }, | ||
105 | { "getsockopt", 55 }, | ||
106 | { "gettid", 186 }, | ||
107 | { "gettimeofday", 96 }, | ||
108 | { "getuid", 102 }, | ||
109 | { "getxattr", 191 }, | ||
110 | { "init_module", 175 }, | ||
111 | { "inotify_add_watch", 254 }, | ||
112 | { "inotify_init", 253 }, | ||
113 | { "inotify_init1", 294 }, | ||
114 | { "inotify_rm_watch", 255 }, | ||
115 | { "io_cancel", 210 }, | ||
116 | { "io_destroy", 207 }, | ||
117 | { "io_getevents", 208 }, | ||
118 | { "io_pgetevents", 333 }, | ||
119 | { "io_setup", 206 }, | ||
120 | { "io_submit", 209 }, | ||
121 | { "io_uring_enter", 426 }, | ||
122 | { "io_uring_register", 427 }, | ||
123 | { "io_uring_setup", 425 }, | ||
124 | { "ioctl", 16 }, | ||
125 | { "ioperm", 173 }, | ||
126 | { "iopl", 172 }, | ||
127 | { "ioprio_get", 252 }, | ||
128 | { "ioprio_set", 251 }, | ||
129 | { "kcmp", 312 }, | ||
130 | { "kexec_file_load", 320 }, | ||
131 | { "kexec_load", 246 }, | ||
132 | { "keyctl", 250 }, | ||
133 | { "kill", 62 }, | ||
134 | { "lchown", 94 }, | ||
135 | { "lgetxattr", 192 }, | ||
136 | { "link", 86 }, | ||
137 | { "linkat", 265 }, | ||
138 | { "listen", 50 }, | ||
139 | { "listxattr", 194 }, | ||
140 | { "llistxattr", 195 }, | ||
141 | { "lookup_dcookie", 212 }, | ||
142 | { "lremovexattr", 198 }, | ||
143 | { "lseek", 8 }, | ||
144 | { "lsetxattr", 189 }, | ||
145 | { "lstat", 6 }, | ||
146 | { "madvise", 28 }, | ||
147 | { "mbind", 237 }, | ||
148 | { "membarrier", 324 }, | ||
149 | { "memfd_create", 319 }, | ||
150 | { "migrate_pages", 256 }, | ||
151 | { "mincore", 27 }, | ||
152 | { "mkdir", 83 }, | ||
153 | { "mkdirat", 258 }, | ||
154 | { "mknod", 133 }, | ||
155 | { "mknodat", 259 }, | ||
156 | { "mlock", 149 }, | ||
157 | { "mlock2", 325 }, | ||
158 | { "mlockall", 151 }, | ||
159 | { "mmap", 9 }, | ||
160 | { "modify_ldt", 154 }, | ||
161 | { "mount", 165 }, | ||
162 | { "move_mount", 429 }, | ||
163 | { "move_pages", 279 }, | ||
164 | { "mprotect", 10 }, | ||
165 | { "mq_getsetattr", 245 }, | ||
166 | { "mq_notify", 244 }, | ||
167 | { "mq_open", 240 }, | ||
168 | { "mq_timedreceive", 243 }, | ||
169 | { "mq_timedsend", 242 }, | ||
170 | { "mq_unlink", 241 }, | ||
171 | { "mremap", 25 }, | ||
172 | { "msgctl", 71 }, | ||
173 | { "msgget", 68 }, | ||
174 | { "msgrcv", 70 }, | ||
175 | { "msgsnd", 69 }, | ||
176 | { "msync", 26 }, | ||
177 | { "munlock", 150 }, | ||
178 | { "munlockall", 152 }, | ||
179 | { "munmap", 11 }, | ||
180 | { "name_to_handle_at", 303 }, | ||
181 | { "nanosleep", 35 }, | ||
182 | { "newfstatat", 262 }, | ||
183 | { "nfsservctl", 180 }, | ||
184 | { "open", 2 }, | ||
185 | { "open_by_handle_at", 304 }, | ||
186 | { "open_tree", 428 }, | ||
187 | { "openat", 257 }, | ||
188 | { "pause", 34 }, | ||
189 | { "perf_event_open", 298 }, | ||
190 | { "personality", 135 }, | ||
191 | { "pidfd_open", 434 }, | ||
192 | { "pidfd_send_signal", 424 }, | ||
193 | { "pipe", 22 }, | ||
194 | { "pipe2", 293 }, | ||
195 | { "pivot_root", 155 }, | ||
196 | { "pkey_alloc", 330 }, | ||
197 | { "pkey_free", 331 }, | ||
198 | { "pkey_mprotect", 329 }, | ||
199 | { "poll", 7 }, | ||
200 | { "ppoll", 271 }, | ||
201 | { "prctl", 157 }, | ||
202 | { "pread64", 17 }, | ||
203 | { "preadv", 295 }, | ||
204 | { "preadv2", 327 }, | ||
205 | { "prlimit64", 302 }, | ||
206 | { "process_vm_readv", 310 }, | ||
207 | { "process_vm_writev", 311 }, | ||
208 | { "pselect6", 270 }, | ||
209 | { "ptrace", 101 }, | ||
210 | { "putpmsg", 182 }, | ||
211 | { "pwrite64", 18 }, | ||
212 | { "pwritev", 296 }, | ||
213 | { "pwritev2", 328 }, | ||
214 | { "query_module", 178 }, | ||
215 | { "quotactl", 179 }, | ||
216 | { "read", 0 }, | ||
217 | { "readahead", 187 }, | ||
218 | { "readlink", 89 }, | ||
219 | { "readlinkat", 267 }, | ||
220 | { "readv", 19 }, | ||
221 | { "reboot", 169 }, | ||
222 | { "recvfrom", 45 }, | ||
223 | { "recvmmsg", 299 }, | ||
224 | { "recvmsg", 47 }, | ||
225 | { "remap_file_pages", 216 }, | ||
226 | { "removexattr", 197 }, | ||
227 | { "rename", 82 }, | ||
228 | { "renameat", 264 }, | ||
229 | { "renameat2", 316 }, | ||
230 | { "request_key", 249 }, | ||
231 | { "restart_syscall", 219 }, | ||
232 | { "rmdir", 84 }, | ||
233 | { "rseq", 334 }, | ||
234 | { "rt_sigaction", 13 }, | ||
235 | { "rt_sigpending", 127 }, | ||
236 | { "rt_sigprocmask", 14 }, | ||
237 | { "rt_sigqueueinfo", 129 }, | ||
238 | { "rt_sigreturn", 15 }, | ||
239 | { "rt_sigsuspend", 130 }, | ||
240 | { "rt_sigtimedwait", 128 }, | ||
241 | { "rt_tgsigqueueinfo", 297 }, | ||
242 | { "sched_get_priority_max", 146 }, | ||
243 | { "sched_get_priority_min", 147 }, | ||
244 | { "sched_getaffinity", 204 }, | ||
245 | { "sched_getattr", 315 }, | ||
246 | { "sched_getparam", 143 }, | ||
247 | { "sched_getscheduler", 145 }, | ||
248 | { "sched_rr_get_interval", 148 }, | ||
249 | { "sched_setaffinity", 203 }, | ||
250 | { "sched_setattr", 314 }, | ||
251 | { "sched_setparam", 142 }, | ||
252 | { "sched_setscheduler", 144 }, | ||
253 | { "sched_yield", 24 }, | ||
254 | { "seccomp", 317 }, | ||
255 | { "security", 185 }, | ||
256 | { "select", 23 }, | ||
257 | { "semctl", 66 }, | ||
258 | { "semget", 64 }, | ||
259 | { "semop", 65 }, | ||
260 | { "semtimedop", 220 }, | ||
261 | { "sendfile", 40 }, | ||
262 | { "sendmmsg", 307 }, | ||
263 | { "sendmsg", 46 }, | ||
264 | { "sendto", 44 }, | ||
265 | { "set_mempolicy", 238 }, | ||
266 | { "set_robust_list", 273 }, | ||
267 | { "set_thread_area", 205 }, | ||
268 | { "set_tid_address", 218 }, | ||
269 | { "setdomainname", 171 }, | ||
270 | { "setfsgid", 123 }, | ||
271 | { "setfsuid", 122 }, | ||
272 | { "setgid", 106 }, | ||
273 | { "setgroups", 116 }, | ||
274 | { "sethostname", 170 }, | ||
275 | { "setitimer", 38 }, | ||
276 | { "setns", 308 }, | ||
277 | { "setpgid", 109 }, | ||
278 | { "setpriority", 141 }, | ||
279 | { "setregid", 114 }, | ||
280 | { "setresgid", 119 }, | ||
281 | { "setresuid", 117 }, | ||
282 | { "setreuid", 113 }, | ||
283 | { "setrlimit", 160 }, | ||
284 | { "setsid", 112 }, | ||
285 | { "setsockopt", 54 }, | ||
286 | { "settimeofday", 164 }, | ||
287 | { "setuid", 105 }, | ||
288 | { "setxattr", 188 }, | ||
289 | { "shmat", 30 }, | ||
290 | { "shmctl", 31 }, | ||
291 | { "shmdt", 67 }, | ||
292 | { "shmget", 29 }, | ||
293 | { "shutdown", 48 }, | ||
294 | { "sigaltstack", 131 }, | ||
295 | { "signalfd", 282 }, | ||
296 | { "signalfd4", 289 }, | ||
297 | { "socket", 41 }, | ||
298 | { "socketpair", 53 }, | ||
299 | { "splice", 275 }, | ||
300 | { "stat", 4 }, | ||
301 | { "statfs", 137 }, | ||
302 | { "statx", 332 }, | ||
303 | { "swapoff", 168 }, | ||
304 | { "swapon", 167 }, | ||
305 | { "symlink", 88 }, | ||
306 | { "symlinkat", 266 }, | ||
307 | { "sync", 162 }, | ||
308 | { "sync_file_range", 277 }, | ||
309 | { "syncfs", 306 }, | ||
310 | { "sysfs", 139 }, | ||
311 | { "sysinfo", 99 }, | ||
312 | { "syslog", 103 }, | ||
313 | { "tee", 276 }, | ||
314 | { "tgkill", 234 }, | ||
315 | { "time", 201 }, | ||
316 | { "timer_create", 222 }, | ||
317 | { "timer_delete", 226 }, | ||
318 | { "timer_getoverrun", 225 }, | ||
319 | { "timer_gettime", 224 }, | ||
320 | { "timer_settime", 223 }, | ||
321 | { "timerfd_create", 283 }, | ||
322 | { "timerfd_gettime", 287 }, | ||
323 | { "timerfd_settime", 286 }, | ||
324 | { "times", 100 }, | ||
325 | { "tkill", 200 }, | ||
326 | { "truncate", 76 }, | ||
327 | { "tuxcall", 184 }, | ||
328 | { "umask", 95 }, | ||
329 | { "umount2", 166 }, | ||
330 | { "uname", 63 }, | ||
331 | { "unlink", 87 }, | ||
332 | { "unlinkat", 263 }, | ||
333 | { "unshare", 272 }, | ||
334 | { "uselib", 134 }, | ||
335 | { "userfaultfd", 323 }, | ||
336 | { "ustat", 136 }, | ||
337 | { "utime", 132 }, | ||
338 | { "utimensat", 280 }, | ||
339 | { "utimes", 235 }, | ||
340 | { "vfork", 58 }, | ||
341 | { "vhangup", 153 }, | ||
342 | { "vmsplice", 278 }, | ||
343 | { "vserver", 236 }, | ||
344 | { "wait4", 61 }, | ||
345 | { "waitid", 247 }, | ||
346 | { "write", 1 }, | ||
347 | { "writev", 20 }, | ||
diff --git a/src/fseccomp/errno.c b/src/lib/errno.c index 9c5aa770c..881c3b27e 100644 --- a/src/fseccomp/errno.c +++ b/src/lib/errno.c | |||
@@ -17,9 +17,11 @@ | |||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | 17 | * with this program; if not, write to the Free Software Foundation, Inc., |
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "fseccomp.h" | 20 | #include "../include/syscall.h" |
21 | 21 | ||
22 | #include <errno.h> | 22 | #include <errno.h> |
23 | #include <stdio.h> | ||
24 | #include <string.h> | ||
23 | //#include <attr/xattr.h> | 25 | //#include <attr/xattr.h> |
24 | 26 | ||
25 | typedef struct { | 27 | typedef struct { |
@@ -181,7 +183,7 @@ int errno_find_name(const char *name) { | |||
181 | return -1; | 183 | return -1; |
182 | } | 184 | } |
183 | 185 | ||
184 | char *errno_find_nr(int nr) { | 186 | const char *errno_find_nr(int nr) { |
185 | int i; | 187 | int i; |
186 | int elems = sizeof(errnolist) / sizeof(errnolist[0]); | 188 | int elems = sizeof(errnolist) / sizeof(errnolist[0]); |
187 | for (i = 0; i < elems; i++) { | 189 | for (i = 0; i < elems; i++) { |
diff --git a/src/fseccomp/syscall.c b/src/lib/syscall.c index 2b112245c..2f8ccaed7 100644 --- a/src/fseccomp/syscall.c +++ b/src/lib/syscall.c | |||
@@ -18,9 +18,18 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #define _GNU_SOURCE | 20 | #define _GNU_SOURCE |
21 | #include "fseccomp.h" | 21 | #include "../include/syscall.h" |
22 | #include <assert.h> | ||
23 | #include <limits.h> | ||
24 | #include <stdbool.h> | ||
22 | #include <stdio.h> | 25 | #include <stdio.h> |
26 | #include <string.h> | ||
23 | #include <sys/syscall.h> | 27 | #include <sys/syscall.h> |
28 | #include "../include/common.h" | ||
29 | #include "../include/seccomp.h" | ||
30 | |||
31 | #define SYSCALL_ERROR INT_MAX | ||
32 | #define ERRNO_KILL -2 | ||
24 | 33 | ||
25 | typedef struct { | 34 | typedef struct { |
26 | const char * const name; | 35 | const char * const name; |
@@ -39,15 +48,31 @@ typedef struct { | |||
39 | int syscall; | 48 | int syscall; |
40 | } SyscallCheckList; | 49 | } SyscallCheckList; |
41 | 50 | ||
51 | // Native syscalls (64 bit versions for 64 bit arch etc) | ||
42 | static const SyscallEntry syslist[] = { | 52 | static const SyscallEntry syslist[] = { |
43 | // | 53 | #if defined(__x86_64__) |
44 | // code generated using tools/extract-syscall | 54 | // code generated using |
45 | // | 55 | // awk '/__NR_/ { print "{ \"" gensub("__NR_", "", "g", $2) "\", " $3 " },"; }' < /usr/include/x86_64-linux-gnu/asm/unistd_64.h |
46 | #include "../include/syscall.h" | 56 | #include "../include/syscall_x86_64.h" |
47 | // | 57 | #elif defined(__i386__) |
48 | // end of generated code | 58 | // awk '/__NR_/ { print "{ \"" gensub("__NR_", "", "g", $2) "\", " $3 " },"; }' < /usr/include/x86_64-linux-gnu/asm/unistd_32.h |
49 | // | 59 | #include "../include/syscall_i386.h" |
50 | }; // end of syslist | 60 | #elif defined(__arm__) |
61 | #include "../include/syscall_armeabi.h" | ||
62 | #else | ||
63 | #warning "Please submit a syscall table for your architecture" | ||
64 | #endif | ||
65 | }; | ||
66 | |||
67 | // 32 bit syscalls for 64 bit arch | ||
68 | static const SyscallEntry syslist32[] = { | ||
69 | #if defined(__x86_64__) | ||
70 | #include "../include/syscall_i386.h" | ||
71 | // TODO for other 64 bit archs | ||
72 | #elif defined(__i386__) || defined(__arm__) || defined(__powerpc__) | ||
73 | // no secondary arch for 32 bit archs | ||
74 | #endif | ||
75 | }; | ||
51 | 76 | ||
52 | static const SyscallGroupList sysgroups[] = { | 77 | static const SyscallGroupList sysgroups[] = { |
53 | { .name = "@aio", .list = | 78 | { .name = "@aio", .list = |
@@ -1412,7 +1437,7 @@ static const SyscallGroupList sysgroups[] = { | |||
1412 | } | 1437 | } |
1413 | }; | 1438 | }; |
1414 | 1439 | ||
1415 | // return -1 if error, or syscall number | 1440 | // return SYSCALL_ERROR if error, or syscall number |
1416 | static int syscall_find_name(const char *name) { | 1441 | static int syscall_find_name(const char *name) { |
1417 | int i; | 1442 | int i; |
1418 | int elems = sizeof(syslist) / sizeof(syslist[0]); | 1443 | int elems = sizeof(syslist) / sizeof(syslist[0]); |
@@ -1421,7 +1446,18 @@ static int syscall_find_name(const char *name) { | |||
1421 | return syslist[i].nr; | 1446 | return syslist[i].nr; |
1422 | } | 1447 | } |
1423 | 1448 | ||
1424 | return -1; | 1449 | return SYSCALL_ERROR; |
1450 | } | ||
1451 | |||
1452 | static int syscall_find_name_32(const char *name) { | ||
1453 | int i; | ||
1454 | int elems = sizeof(syslist32) / sizeof(syslist32[0]); | ||
1455 | for (i = 0; i < elems; i++) { | ||
1456 | if (strcmp(name, syslist32[i].name) == 0) | ||
1457 | return syslist32[i].nr; | ||
1458 | } | ||
1459 | |||
1460 | return SYSCALL_ERROR; | ||
1425 | } | 1461 | } |
1426 | 1462 | ||
1427 | const char *syscall_find_nr(int nr) { | 1463 | const char *syscall_find_nr(int nr) { |
@@ -1435,6 +1471,17 @@ const char *syscall_find_nr(int nr) { | |||
1435 | return "unknown"; | 1471 | return "unknown"; |
1436 | } | 1472 | } |
1437 | 1473 | ||
1474 | const char *syscall_find_nr_32(int nr) { | ||
1475 | int i; | ||
1476 | int elems = sizeof(syslist32) / sizeof(syslist32[0]); | ||
1477 | for (i = 0; i < elems; i++) { | ||
1478 | if (nr == syslist32[i].nr) | ||
1479 | return syslist32[i].name; | ||
1480 | } | ||
1481 | |||
1482 | return "unknown"; | ||
1483 | } | ||
1484 | |||
1438 | void syscall_print(void) { | 1485 | void syscall_print(void) { |
1439 | int i; | 1486 | int i; |
1440 | int elems = sizeof(syslist) / sizeof(syslist[0]); | 1487 | int elems = sizeof(syslist) / sizeof(syslist[0]); |
@@ -1444,6 +1491,15 @@ void syscall_print(void) { | |||
1444 | printf("\n"); | 1491 | printf("\n"); |
1445 | } | 1492 | } |
1446 | 1493 | ||
1494 | void syscall_print_32(void) { | ||
1495 | int i; | ||
1496 | int elems = sizeof(syslist32) / sizeof(syslist32[0]); | ||
1497 | for (i = 0; i < elems; i++) { | ||
1498 | printf("%d\t- %s\n", syslist32[i].nr, syslist32[i].name); | ||
1499 | } | ||
1500 | printf("\n"); | ||
1501 | } | ||
1502 | |||
1447 | static const char *syscall_find_group(const char *name) { | 1503 | static const char *syscall_find_group(const char *name) { |
1448 | int i; | 1504 | int i; |
1449 | int elems = sizeof(sysgroups) / sizeof(sysgroups[0]); | 1505 | int elems = sizeof(sysgroups) / sizeof(sysgroups[0]); |
@@ -1458,7 +1514,7 @@ static const char *syscall_find_group(const char *name) { | |||
1458 | // allowed input: | 1514 | // allowed input: |
1459 | // - syscall | 1515 | // - syscall |
1460 | // - syscall(error) | 1516 | // - syscall(error) |
1461 | static void syscall_process_name(const char *name, int *syscall_nr, int *error_nr) { | 1517 | static void syscall_process_name(const char *name, int *syscall_nr, int *error_nr, bool native) { |
1462 | assert(name); | 1518 | assert(name); |
1463 | if (strlen(name) == 0) | 1519 | if (strlen(name) == 0) |
1464 | goto error; | 1520 | goto error; |
@@ -1482,12 +1538,20 @@ static void syscall_process_name(const char *name, int *syscall_nr, int *error_n | |||
1482 | 1538 | ||
1483 | if (*syscall_name == '$') | 1539 | if (*syscall_name == '$') |
1484 | *syscall_nr = strtol(syscall_name + 1, NULL, 0); | 1540 | *syscall_nr = strtol(syscall_name + 1, NULL, 0); |
1485 | else | 1541 | else { |
1486 | *syscall_nr = syscall_find_name(syscall_name); | 1542 | if (native) |
1543 | *syscall_nr = syscall_find_name(syscall_name); | ||
1544 | else | ||
1545 | *syscall_nr = syscall_find_name_32(syscall_name); | ||
1546 | } | ||
1487 | if (error_name) { | 1547 | if (error_name) { |
1488 | *error_nr = errno_find_name(error_name); | 1548 | if (strcmp(error_name, "kill") == 0) |
1489 | if (*error_nr == -1) | 1549 | *error_nr = ERRNO_KILL; |
1490 | *syscall_nr = -1; | 1550 | else { |
1551 | *error_nr = errno_find_name(error_name); | ||
1552 | if (*error_nr == -1) | ||
1553 | *syscall_nr = SYSCALL_ERROR; | ||
1554 | } | ||
1491 | } | 1555 | } |
1492 | 1556 | ||
1493 | free(str); | 1557 | free(str); |
@@ -1499,7 +1563,7 @@ error: | |||
1499 | } | 1563 | } |
1500 | 1564 | ||
1501 | // return 1 if error, 0 if OK | 1565 | // return 1 if error, 0 if OK |
1502 | int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, int arg, void *ptrarg), int fd, int arg, void *ptrarg) { | 1566 | int syscall_check_list(const char *slist, filter_fn *callback, int fd, int arg, void *ptrarg, bool native) { |
1503 | // don't allow empty lists | 1567 | // don't allow empty lists |
1504 | if (slist == NULL || *slist == '\0') { | 1568 | if (slist == NULL || *slist == '\0') { |
1505 | fprintf(stderr, "Error fseccomp: empty syscall lists are not allowed\n"); | 1569 | fprintf(stderr, "Error fseccomp: empty syscall lists are not allowed\n"); |
@@ -1527,7 +1591,7 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, | |||
1527 | fprintf(stderr, "Error fseccomp: unknown syscall group %s\n", ptr); | 1591 | fprintf(stderr, "Error fseccomp: unknown syscall group %s\n", ptr); |
1528 | exit(1); | 1592 | exit(1); |
1529 | } | 1593 | } |
1530 | syscall_check_list(new_list, callback, fd, arg, ptrarg); | 1594 | syscall_check_list(new_list, callback, fd, arg, ptrarg, native); |
1531 | } | 1595 | } |
1532 | else { | 1596 | else { |
1533 | bool negate = false; | 1597 | bool negate = false; |
@@ -1535,20 +1599,20 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, | |||
1535 | negate = true; | 1599 | negate = true; |
1536 | ptr++; | 1600 | ptr++; |
1537 | } | 1601 | } |
1538 | syscall_process_name(ptr, &syscall_nr, &error_nr); | 1602 | syscall_process_name(ptr, &syscall_nr, &error_nr, native); |
1539 | if (syscall_nr == -1) {;} | 1603 | if (syscall_nr != SYSCALL_ERROR && callback != NULL) { |
1540 | else if (callback != NULL) { | ||
1541 | if (negate) { | 1604 | if (negate) { |
1542 | syscall_nr = -syscall_nr; | 1605 | syscall_nr = -syscall_nr; |
1543 | } | 1606 | } |
1544 | if (error_nr != -1 && fd != 0) { | 1607 | if (error_nr >= 0 && fd > 0) |
1545 | filter_add_errno(fd, syscall_nr, error_nr, ptrarg); | 1608 | filter_add_errno(fd, syscall_nr, error_nr, ptrarg, native); |
1546 | } | 1609 | else if (error_nr == ERRNO_KILL && fd > 0) |
1547 | else if (error_nr != -1 && fd == 0) { | 1610 | filter_add_blacklist_override(fd, syscall_nr, 0, ptrarg, native); |
1548 | callback(fd, syscall_nr, error_nr, ptrarg); | 1611 | else if (error_nr >= 0 && fd == 0) { |
1612 | callback(fd, syscall_nr, error_nr, ptrarg, native); | ||
1549 | } | 1613 | } |
1550 | else { | 1614 | else { |
1551 | callback(fd, syscall_nr, arg, ptrarg); | 1615 | callback(fd, syscall_nr, arg, ptrarg, native); |
1552 | } | 1616 | } |
1553 | } | 1617 | } |
1554 | } | 1618 | } |
@@ -1559,41 +1623,50 @@ int syscall_check_list(const char *slist, void (*callback)(int fd, int syscall, | |||
1559 | return 0; | 1623 | return 0; |
1560 | } | 1624 | } |
1561 | 1625 | ||
1562 | static void find_syscall(int fd, int syscall, int arg, void *ptrarg) { | 1626 | static void find_syscall(int fd, int syscall, int arg, void *ptrarg, bool native) { |
1563 | (void)fd; | 1627 | (void)fd; |
1564 | (void) arg; | 1628 | (void) arg; |
1629 | (void)native; | ||
1565 | SyscallCheckList *ptr = ptrarg; | 1630 | SyscallCheckList *ptr = ptrarg; |
1566 | if (abs(syscall) == ptr->syscall) | 1631 | if (abs(syscall) == ptr->syscall) |
1567 | ptr->found = true; | 1632 | ptr->found = true; |
1568 | } | 1633 | } |
1569 | 1634 | ||
1570 | // go through list2 and find matches for problem syscall | 1635 | // go through list2 and find matches for problem syscall |
1571 | static void syscall_in_list(int fd, int syscall, int arg, void *ptrarg) { | 1636 | static void syscall_in_list(int fd, int syscall, int arg, void *ptrarg, bool native) { |
1572 | (void) fd; | 1637 | (void) fd; |
1573 | (void)arg; | 1638 | (void)arg; |
1574 | SyscallCheckList *ptr = ptrarg; | 1639 | SyscallCheckList *ptr = ptrarg; |
1575 | SyscallCheckList sl; | 1640 | SyscallCheckList sl; |
1641 | const char *name; | ||
1642 | |||
1576 | sl.found = false; | 1643 | sl.found = false; |
1577 | sl.syscall = syscall; | 1644 | sl.syscall = syscall; |
1578 | syscall_check_list(ptr->slist, find_syscall, fd, 0, &sl); | 1645 | syscall_check_list(ptr->slist, find_syscall, fd, 0, &sl, native); |
1646 | |||
1647 | if (native) | ||
1648 | name = syscall_find_nr(syscall); | ||
1649 | else | ||
1650 | name = syscall_find_nr_32(syscall); | ||
1651 | |||
1579 | // if found in the problem list, add to post-exec list | 1652 | // if found in the problem list, add to post-exec list |
1580 | if (sl.found) { | 1653 | if (sl.found) { |
1581 | if (ptr->postlist) { | 1654 | if (ptr->postlist) { |
1582 | if (asprintf(&ptr->postlist, "%s,%s", ptr->postlist, syscall_find_nr(syscall)) == -1) | 1655 | if (asprintf(&ptr->postlist, "%s,%s", ptr->postlist, name) == -1) |
1583 | errExit("asprintf"); | 1656 | errExit("asprintf"); |
1584 | } | 1657 | } |
1585 | else | 1658 | else |
1586 | ptr->postlist = strdup(syscall_find_nr(syscall)); | 1659 | ptr->postlist = strdup(name); |
1587 | } | 1660 | } |
1588 | else { // no problem, add to pre-exec list | 1661 | else { // no problem, add to pre-exec list |
1589 | // build syscall:error_no | 1662 | // build syscall:error_no |
1590 | char *newcall = NULL; | 1663 | char *newcall = NULL; |
1591 | if (arg != 0) { | 1664 | if (arg != 0) { |
1592 | if (asprintf(&newcall, "%s:%s", syscall_find_nr(syscall), errno_find_nr(arg)) == -1) | 1665 | if (asprintf(&newcall, "%s:%s", name, errno_find_nr(arg)) == -1) |
1593 | errExit("asprintf"); | 1666 | errExit("asprintf"); |
1594 | } | 1667 | } |
1595 | else { | 1668 | else { |
1596 | newcall = strdup(syscall_find_nr(syscall)); | 1669 | newcall = strdup(name); |
1597 | if (!newcall) | 1670 | if (!newcall) |
1598 | errExit("strdup"); | 1671 | errExit("strdup"); |
1599 | } | 1672 | } |
@@ -1609,14 +1682,14 @@ static void syscall_in_list(int fd, int syscall, int arg, void *ptrarg) { | |||
1609 | } | 1682 | } |
1610 | 1683 | ||
1611 | // go through list and find matches for syscalls in list @default-keep | 1684 | // go through list and find matches for syscalls in list @default-keep |
1612 | void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist) { | 1685 | void syscalls_in_list(const char *list, const char *slist, int fd, char **prelist, char **postlist, bool native) { |
1613 | (void) fd; | 1686 | (void) fd; |
1614 | SyscallCheckList sl; | 1687 | SyscallCheckList sl; |
1615 | // these syscalls are used by firejail after the seccomp filter is initialized | 1688 | // these syscalls are used by firejail after the seccomp filter is initialized |
1616 | sl.slist = slist; | 1689 | sl.slist = slist; |
1617 | sl.prelist = NULL; | 1690 | sl.prelist = NULL; |
1618 | sl.postlist = NULL; | 1691 | sl.postlist = NULL; |
1619 | syscall_check_list(list, syscall_in_list, 0, 0, &sl); | 1692 | syscall_check_list(list, syscall_in_list, 0, 0, &sl, native); |
1620 | if (!arg_quiet) { | 1693 | if (!arg_quiet) { |
1621 | printf("Seccomp list in: %s,", list); | 1694 | printf("Seccomp list in: %s,", list); |
1622 | if (sl.slist) | 1695 | if (sl.slist) |
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt index 2887a6c53..e282c8cf0 100644 --- a/src/man/firecfg.txt +++ b/src/man/firecfg.txt | |||
@@ -43,6 +43,10 @@ The following actions are implemented by default by running sudo firecfg: | |||
43 | 43 | ||
44 | .br | 44 | .br |
45 | - fix desktop files in $HOME/.local/share/applications/ (firecfg --fix). | 45 | - fix desktop files in $HOME/.local/share/applications/ (firecfg --fix). |
46 | .br | ||
47 | |||
48 | .br | ||
49 | - automatically loads and forces the AppArmor profile "firejail-default". | ||
46 | .RE | 50 | .RE |
47 | 51 | ||
48 | .SH OPTIONS | 52 | .SH OPTIONS |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index 84aed41a4..0784e7fd7 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -103,7 +103,7 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir" | |||
103 | 103 | ||
104 | This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line. | 104 | This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line. |
105 | 105 | ||
106 | Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS and HAS_X11. The conditionals BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM | 106 | Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS, HAS_NOSOUND and HAS_X11. The conditionals BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM |
107 | can be enabled or disabled globally in Firejail's configuration file. | 107 | can be enabled or disabled globally in Firejail's configuration file. |
108 | 108 | ||
109 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. | 109 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. |
@@ -165,8 +165,9 @@ host filesystem. Each line describes a file/directory that is inaccessible | |||
165 | (\fBblacklist\fR), a read-only file or directory (\fBread-only\fR), | 165 | (\fBblacklist\fR), a read-only file or directory (\fBread-only\fR), |
166 | a tmpfs mounted on top of an existing directory (\fBtmpfs\fR), | 166 | a tmpfs mounted on top of an existing directory (\fBtmpfs\fR), |
167 | or mount-bind a directory or file on top of another directory or file (\fBbind\fR). | 167 | or mount-bind a directory or file on top of another directory or file (\fBbind\fR). |
168 | Use \fBprivate\fR to set private mode. | 168 | Use \fBprivate\fR to set private mode. File globbing is supported, and PATH and |
169 | File globbing is supported, and PATH and HOME directories are searched. | 169 | HOME directories are searched, see the \fBfirejail\f(1) \fBFILE GLOBBING\fR section |
170 | for more details. | ||
170 | Examples: | 171 | Examples: |
171 | .TP | 172 | .TP |
172 | \fBblacklist file_or_directory | 173 | \fBblacklist file_or_directory |
@@ -210,7 +211,7 @@ Disable /mnt, /media, /run/mount and /run/media access. | |||
210 | /var/tmp directory is untouched. | 211 | /var/tmp directory is untouched. |
211 | .TP | 212 | .TP |
212 | \fBmkdir directory | 213 | \fBmkdir directory |
213 | Create a directory in user home or under /tmp before the sandbox is started. | 214 | Create a directory in user home, under /tmp, or under /run/user/<UID> before the sandbox is started. |
214 | The directory is created if it doesn't already exist. | 215 | The directory is created if it doesn't already exist. |
215 | .br | 216 | .br |
216 | 217 | ||
@@ -229,10 +230,18 @@ whitelist ~/.mozilla | |||
229 | mkdir ~/.cache/mozilla/firefox | 230 | mkdir ~/.cache/mozilla/firefox |
230 | .br | 231 | .br |
231 | whitelist ~/.cache/mozilla/firefox | 232 | whitelist ~/.cache/mozilla/firefox |
233 | .br | ||
234 | |||
235 | .br | ||
236 | For files in /run/user/<PID> use ${RUNUSER} macro: | ||
237 | .br | ||
238 | |||
239 | .br | ||
240 | mkdir ${RUNUSER}/firejail-testing | ||
232 | .TP | 241 | .TP |
233 | \fBmkfile file | 242 | \fBmkfile file |
234 | Similar to mkdir, this command creates a file in user home or under /tmp before the sandbox is started. | 243 | Similar to mkdir, this command creates an empty file in user home, or /tmp, or under /run/user/<UID> |
235 | The file is created if it doesn't already exist. | 244 | before the sandbox is started. The file is created if it doesn't already exist. |
236 | .TP | 245 | .TP |
237 | \fBnoexec file_or_directory | 246 | \fBnoexec file_or_directory |
238 | Remount the file or the directory noexec, nodev and nosuid. | 247 | Remount the file or the directory noexec, nodev and nosuid. |
@@ -259,6 +268,8 @@ Use directory as user home. | |||
259 | .TP | 268 | .TP |
260 | \fBprivate-bin file,file | 269 | \fBprivate-bin file,file |
261 | Build a new /bin in a temporary filesystem, and copy the programs in the list. | 270 | Build a new /bin in a temporary filesystem, and copy the programs in the list. |
271 | The files in the list must be expressed as relative to the /bin, | ||
272 | /sbin, /usr/bin, /usr/sbin, or /usr/local/bin directories. | ||
262 | The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin. | 273 | The same directory is also bind-mounted over /sbin, /usr/bin and /usr/sbin. |
263 | .TP | 274 | .TP |
264 | \fBprivate-cache | 275 | \fBprivate-cache |
@@ -280,26 +291,37 @@ Use the options no3d, nodvd, nosound, notv, nou2f and novideo for additional res | |||
280 | \fBprivate-etc file,directory | 291 | \fBprivate-etc file,directory |
281 | Build a new /etc in a temporary | 292 | Build a new /etc in a temporary |
282 | filesystem, and copy the files and directories in the list. | 293 | filesystem, and copy the files and directories in the list. |
294 | The files and directories in the list must be expressed as relative to | ||
295 | the /etc directory. | ||
283 | All modifications are discarded when the sandbox is closed. | 296 | All modifications are discarded when the sandbox is closed. |
284 | .TP | 297 | .TP |
285 | \fBprivate-home file,directory | 298 | \fBprivate-home file,directory |
286 | Build a new user home in a temporary | 299 | Build a new user home in a temporary |
287 | filesystem, and copy the files and directories in the list in the | 300 | filesystem, and copy the files and directories in the list in the |
288 | new home. All modifications are discarded when the sandbox is | 301 | new home. |
302 | The files and directories in the list must be expressed as relative to | ||
303 | the current user's home directory. | ||
304 | All modifications are discarded when the sandbox is | ||
289 | closed. | 305 | closed. |
290 | .TP | 306 | .TP |
291 | \fBprivate-lib file,directory | 307 | \fBprivate-lib file,directory |
292 | Build a new /lib directory and bring in the libraries required by the application to run. | 308 | Build a new /lib directory and bring in the libraries required by the application to run. |
309 | The files and directories in the list must be expressed as relative to | ||
310 | the /lib directory. | ||
293 | This feature is still under development, see \fBman 1 firejail\fR for some examples. | 311 | This feature is still under development, see \fBman 1 firejail\fR for some examples. |
294 | .TP | 312 | .TP |
295 | \fBprivate-opt file,directory | 313 | \fBprivate-opt file,directory |
296 | Build a new /opt in a temporary | 314 | Build a new /opt in a temporary |
297 | filesystem, and copy the files and directories in the list. | 315 | filesystem, and copy the files and directories in the list. |
316 | The files and directories in the list must be expressed as relative to | ||
317 | the /opt directory. | ||
298 | All modifications are discarded when the sandbox is closed. | 318 | All modifications are discarded when the sandbox is closed. |
299 | .TP | 319 | .TP |
300 | \fBprivate-srv file,directory | 320 | \fBprivate-srv file,directory |
301 | Build a new /srv in a temporary | 321 | Build a new /srv in a temporary |
302 | filesystem, and copy the files and directories in the list. | 322 | filesystem, and copy the files and directories in the list. |
323 | The files and directories in the list must be expressed as relative to | ||
324 | the /srv directory. | ||
303 | All modifications are discarded when the sandbox is closed. | 325 | All modifications are discarded when the sandbox is closed. |
304 | .TP | 326 | .TP |
305 | \fBprivate-tmp | 327 | \fBprivate-tmp |
@@ -386,19 +408,36 @@ first argument to socket system call. Recognized values: \fBunix\fR, | |||
386 | \fBseccomp | 408 | \fBseccomp |
387 | Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details. | 409 | Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details. |
388 | .TP | 410 | .TP |
411 | \fBseccomp.32 | ||
412 | Enable seccomp filter and blacklist the syscalls in the default list for 32 bit system calls on a 64 bit architecture system. | ||
413 | .TP | ||
389 | \fBseccomp syscall,syscall,syscall | 414 | \fBseccomp syscall,syscall,syscall |
390 | Enable seccomp filter and blacklist the system calls in the list on top of default seccomp filter. | 415 | Enable seccomp filter and blacklist the system calls in the list on top of default seccomp filter. |
391 | .TP | 416 | .TP |
417 | \fBseccomp.32 syscall,syscall,syscall | ||
418 | Enable seccomp filter and blacklist the system calls in the list on top of default seccomp filter for 32 bit system calls on a 64 bit architecture system. | ||
419 | .TP | ||
392 | \fBseccomp.block-secondary | 420 | \fBseccomp.block-secondary |
393 | Enable seccomp filter and filter system call architectures | 421 | Enable seccomp filter and filter system call architectures |
394 | so that only the native architecture is allowed. | 422 | so that only the native architecture is allowed. |
395 | .TP | 423 | .TP |
396 | \fBseccomp.drop syscall,syscall,syscall | 424 | \fBseccomp.drop syscall,syscall,syscall |
397 | Enable seccomp filter and blacklist the system calls in the list. | 425 | Enable seccomp filter and blacklist the system calls in the list. |
426 | .TP | ||
427 | \fBseccomp.32.drop syscall,syscall,syscall | ||
428 | Enable seccomp filter and blacklist the system calls in the list for 32 bit system calls on a 64 bit architecture system. | ||
398 | .TP | 429 | .TP |
399 | \fBseccomp.keep syscall,syscall,syscall | 430 | \fBseccomp.keep syscall,syscall,syscall |
400 | Enable seccomp filter and whitelist the system calls in the list. | 431 | Enable seccomp filter and whitelist the system calls in the list. |
401 | .TP | 432 | .TP |
433 | \fBseccomp.32.keep syscall,syscall,syscall | ||
434 | Enable seccomp filter and whitelist the system calls in the list for 32 bit system calls on a 64 bit architecture system. | ||
435 | .TP | ||
436 | \fBseccomp-error-action kill | log | ERRNO | ||
437 | Return a different error instead of EPERM to the process, kill it when | ||
438 | an attempt is made to call a blocked system call, or allow but log the | ||
439 | attempt. | ||
440 | .TP | ||
402 | \fBx11 | 441 | \fBx11 |
403 | Enable X11 sandboxing. | 442 | Enable X11 sandboxing. |
404 | .TP | 443 | .TP |
@@ -432,7 +471,100 @@ xephyr-screen 640x480 | |||
432 | .br | 471 | .br |
433 | x11 xephyr | 472 | x11 xephyr |
434 | 473 | ||
474 | .SH DBus filtering | ||
475 | |||
476 | Access to the session and system DBus UNIX sockets can be allowed, filtered or | ||
477 | disabled. To disable the abstract sockets (and force applications to use the | ||
478 | filtered UNIX socket) you would need to request a new network namespace using | ||
479 | \-\-net command. Another option is to remove unix from the \-\-protocol set. | ||
480 | .br | ||
481 | |||
482 | .br | ||
483 | Filtering requires installing the xdg-dbus-proxy utility. Filter rules can be | ||
484 | specified for well-known DBus names, but they are also propagated to the owning | ||
485 | unique name, too. The permissions are "sticky" and are kept even if the | ||
486 | corresponding well-known name is released (however, applications rarely release | ||
487 | well-known names in practice). Names may have a .* suffix to match all names | ||
488 | underneath them, including themselves (e.g. "foo.bar.*" matches "foo.bar", | ||
489 | "foo.bar.baz" and "foo.bar.baz.quux", but not "foobar"). For more information, | ||
490 | see xdg-dbus-proxy(1). | ||
491 | .br | ||
435 | 492 | ||
493 | .br | ||
494 | Examples: | ||
495 | |||
496 | .TP | ||
497 | \fBdbus-system filter | ||
498 | Enable filtered access to the system DBus. Filters can be specified with the dbus-system.talk and dbus-system.own commands. | ||
499 | .TP | ||
500 | \fBdbus-system none | ||
501 | Disable access to the system DBus. Once access is disabled, it cannot be relaxed to filtering. | ||
502 | .TP | ||
503 | \fBdbus-system.own org.gnome.ghex.* | ||
504 | Allow the application to own the name org.gnome.ghex and all names underneath in on the system DBus. | ||
505 | .TP | ||
506 | \fBdbus-system.talk org.freedesktop.Notifications | ||
507 | Allow the application to talk to the name org.freedesktop.Notifications on the system DBus. | ||
508 | .TP | ||
509 | \fBdbus-system.see org.freedesktop.Notifications | ||
510 | Allow the application to see but not talk to the name org.freedesktop.Notifications on the system DBus. | ||
511 | .TP | ||
512 | \fBdbus-system.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
513 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | ||
514 | .TP | ||
515 | \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
516 | Allow the application to recieve broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | ||
517 | .TP | ||
518 | \fBdbus-user filter | ||
519 | Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. | ||
520 | .TP | ||
521 | \fBdbus-user none | ||
522 | Disable access to the session DBus. Once access is disabled, it cannot be relaxed to filtering. | ||
523 | .TP | ||
524 | \fBdbus-user.own org.gnome.ghex.* | ||
525 | Allow the application to own the name org.gnome.ghex and all names underneath in on the session DBus. | ||
526 | .TP | ||
527 | \fBdbus-user.talk org.freedesktop.Notifications | ||
528 | Allow the application to talk to the name org.freedesktop.Notifications on the session DBus. | ||
529 | .TP | ||
530 | \fBdbus-user.see org.freedesktop.Notifications | ||
531 | Allow the application to see but not talk to the name org.freedesktop.Notifications on the session DBus. | ||
532 | .TP | ||
533 | \fBdbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
534 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus. | ||
535 | .TP | ||
536 | \fBdbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
537 | Allow the application to recieve broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus. | ||
538 | .TP | ||
539 | \fBnodbus \fR(deprecated) | ||
540 | Disable D-Bus access (both system and session buses). Equivalent to dbus-system none and dbus-user none. | ||
541 | .TP | ||
542 | .br | ||
543 | |||
544 | .br | ||
545 | Individual filters can be overridden via the \-\-ignore command. Supposing a profile has | ||
546 | .br | ||
547 | [...] | ||
548 | .br | ||
549 | dbus-user filter | ||
550 | .br | ||
551 | dbus-user.own org.mozilla.firefox.* | ||
552 | .br | ||
553 | dbus-user.talk org.freedesktop.Notifications | ||
554 | .br | ||
555 | dbus-system none | ||
556 | .br | ||
557 | [...] | ||
558 | .br | ||
559 | |||
560 | .br | ||
561 | and the user wants to disable notifications, this can be achieved by putting the below in a local override file: | ||
562 | .br | ||
563 | [...] | ||
564 | .br | ||
565 | ignore dbus-user.talk org.freedesktop.Notifications | ||
566 | .br | ||
567 | [...] | ||
436 | 568 | ||
437 | .SH Resource limits, CPU affinity, Control Groups | 569 | .SH Resource limits, CPU affinity, Control Groups |
438 | These profile entries define the limits on system resources (rlimits) for the processes inside the sandbox. | 570 | These profile entries define the limits on system resources (rlimits) for the processes inside the sandbox. |
@@ -507,12 +639,6 @@ Disable 3D hardware acceleration. | |||
507 | Disable automatic ~/.config/pulse init, for complex setups such as remote | 639 | Disable automatic ~/.config/pulse init, for complex setups such as remote |
508 | pulse servers or non-standard socket paths. | 640 | pulse servers or non-standard socket paths. |
509 | .TP | 641 | .TP |
510 | \fBnodbus | ||
511 | Disable D-Bus access. Only the regular UNIX socket is handled by | ||
512 | this command. To disable the abstract socket, you would need to | ||
513 | request a new network namespace using the net command. Another | ||
514 | option is to remove unix from protocol set. | ||
515 | .TP | ||
516 | \fBnodvd | 642 | \fBnodvd |
517 | Disable DVD and audio CD devices. | 643 | Disable DVD and audio CD devices. |
518 | .TP | 644 | .TP |
@@ -749,5 +875,7 @@ Homepage: https://firejail.wordpress.com | |||
749 | \&\flfirejail\fR\|(1), | 875 | \&\flfirejail\fR\|(1), |
750 | \&\flfiremon\fR\|(1), | 876 | \&\flfiremon\fR\|(1), |
751 | \&\flfirecfg\fR\|(1), | 877 | \&\flfirecfg\fR\|(1), |
752 | \&\flfirejail-login\fR\|(5) | 878 | \&\flfirejail-login\fR\|(5), |
753 | \&\flfirejail-users\fR\|(5) | 879 | \&\flfirejail-users\fR\|(5), |
880 | .UR https://github.com/netblue30/firejail/wiki/Creating-Profiles | ||
881 | .UE | ||
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 926e9b2cc..e216531ae 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -35,7 +35,7 @@ firejail {\-\-list | \-\-netstats | \-\-top | \-\-tree} | |||
35 | Miscellaneous: | 35 | Miscellaneous: |
36 | .PP | 36 | .PP |
37 | .RS | 37 | .RS |
38 | firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-debug-protocols | \-\-help | \-\-version} | 38 | firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-debug-syscalls32 | \-\-debug-protocols | \-\-help | \-\-version} |
39 | .RE | 39 | .RE |
40 | .SH DESCRIPTION | 40 | .SH DESCRIPTION |
41 | Firejail is a SUID sandbox program that reduces the risk of security breaches by | 41 | Firejail is a SUID sandbox program that reduces the risk of security breaches by |
@@ -66,7 +66,8 @@ command line options. The default Firejail filesystem is based on the host files | |||
66 | system directories mounted read-only. These directories are /etc, /var, /usr, /bin, /sbin, /lib, /lib32, | 66 | system directories mounted read-only. These directories are /etc, /var, /usr, /bin, /sbin, /lib, /lib32, |
67 | /libx32 and /lib64. Only /home and /tmp are writable. | 67 | /libx32 and /lib64. Only /home and /tmp are writable. |
68 | .PP | 68 | .PP |
69 | As it starts up, Firejail tries to find a security profile based on the name of the application. | 69 | Upon execution Firejail first looks in ~/.config/firejail/ for a profile and if it doesn't find one, it looks in /etc/firejail/. |
70 | For profile resolution detail see https://github.com/netblue30/firejail/wiki/Creating-Profiles#locations-and-types. | ||
70 | If an appropriate profile is not found, Firejail will use a default profile. | 71 | If an appropriate profile is not found, Firejail will use a default profile. |
71 | The default profile is quite restrictive. In case the application doesn't work, use --noprofile option | 72 | The default profile is quite restrictive. In case the application doesn't work, use --noprofile option |
72 | to disable it. For more information, please see \fBSECURITY PROFILES\fR section below. | 73 | to disable it. For more information, please see \fBSECURITY PROFILES\fR section below. |
@@ -326,6 +327,248 @@ $ firejail \-\-list | |||
326 | $ firejail \-\-cpu.print=3272 | 327 | $ firejail \-\-cpu.print=3272 |
327 | 328 | ||
328 | .TP | 329 | .TP |
330 | \fB\-\-dbus-log=file | ||
331 | Specify the location for the DBus log file. | ||
332 | .br | ||
333 | |||
334 | .br | ||
335 | The log file contains events for both the system and session buses if both of | ||
336 | the --dbus-sysem.log and --dbus-user.log options are specified. If no log file | ||
337 | path is given, logs are written to the standard output instead. | ||
338 | .br | ||
339 | |||
340 | .br | ||
341 | Example: | ||
342 | .br | ||
343 | $ firejail --dbus-system=filter --dbus-system.log --dbus-log=dbus.txt | ||
344 | |||
345 | .TP | ||
346 | \fB\-\-dbus-system=filter|none | ||
347 | Set system DBus sandboxing policy. | ||
348 | .br | ||
349 | |||
350 | .br | ||
351 | The \fBfilter\fR policy enables the system DBus filter. This option requires | ||
352 | installing the xdg-dbus-proxy utility. Permissions for well-known can be | ||
353 | specified with the --dbus-system.talk and --dbus-system.own options. | ||
354 | .br | ||
355 | |||
356 | .br | ||
357 | The \fBnone\fR policy disables access to the system DBus. | ||
358 | .br | ||
359 | |||
360 | .br | ||
361 | Only the regular system DBus UNIX socket is handled by this option. To disable | ||
362 | the abstract sockets (and force applications to use the filtered UNIX socket) | ||
363 | you would need to request a new network namespace using \-\-net command. Another | ||
364 | option is to remove unix from the \-\-protocol set. | ||
365 | .br | ||
366 | |||
367 | .br | ||
368 | Example: | ||
369 | .br | ||
370 | $ firejail \-\-dbus-system=none | ||
371 | |||
372 | .TP | ||
373 | \fB\-\-dbus-system.broadcast=name=[member][@path] | ||
374 | Allows the application to receive broadcast signals from theindicated interface | ||
375 | member at the indicated object path exposed by the indicated bus name on the | ||
376 | system DBus. | ||
377 | The name may have a .* suffix to match all names underneath it, including | ||
378 | itself. | ||
379 | The interface member may have a .* to match all members of an interface, or be * to match all interfaces. | ||
380 | The path may have a /* suffix to indicate all objects underneath it, including | ||
381 | itself. | ||
382 | Omitting the interface member or the object path will match all members and | ||
383 | object paths, respectively. | ||
384 | .br | ||
385 | |||
386 | .br | ||
387 | Example: | ||
388 | .br | ||
389 | $ firejail --dbus-system=filter --dbus-system.broadcast=org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
390 | |||
391 | .TP | ||
392 | \fB\-\-dbus-system.call=name=[member][@path] | ||
393 | Allows the application to call the indicated interface member at the indicated | ||
394 | object path exposed by the indicated bus name on the system DBus. | ||
395 | The name may have a .* suffix to match all names underneath it, including | ||
396 | itself. | ||
397 | The interface member may have a .* to match all members of an interface, or be * to match all interfaces. | ||
398 | The path may have a /* suffix to indicate all objects underneath it, including | ||
399 | itself. | ||
400 | Omitting the interface member or the object path will match all members and | ||
401 | object paths, respectively. | ||
402 | .br | ||
403 | |||
404 | .br | ||
405 | Example: | ||
406 | .br | ||
407 | $ firejail --dbus-system=filter --dbus-system.call=org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
408 | |||
409 | .TP | ||
410 | \fB\-\-dbus-system.log | ||
411 | Turn on DBus logging for the system DBus. This option requires --dbus-system=log. | ||
412 | |||
413 | .br | ||
414 | Example: | ||
415 | .br | ||
416 | $ firejail --dbus-system=filter --dbus-system.log | ||
417 | |||
418 | .TP | ||
419 | \fB\-\-dbus-system.own=name | ||
420 | Allows the application to own the specified well-known name on the system DBus. | ||
421 | The name may have a .* suffix to match all names underneath it, including itself | ||
422 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | ||
423 | not "foobar"). | ||
424 | .br | ||
425 | |||
426 | .br | ||
427 | Example: | ||
428 | .br | ||
429 | $ firejail --dbus-system=filter --dbus-system.own=org.gnome.ghex.* | ||
430 | |||
431 | .TP | ||
432 | \fB\-\-dbus-system.see=name | ||
433 | Allows the application to see, but not talk to the specified well-known name on | ||
434 | the system DBus. | ||
435 | The name may have a .* suffix to match all names underneath it, including itself | ||
436 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | ||
437 | not "foobar"). | ||
438 | .br | ||
439 | |||
440 | .br | ||
441 | Example: | ||
442 | .br | ||
443 | $ firejail --dbus-system=filter --dbus-system.see=org.freedesktop.Notifications | ||
444 | |||
445 | .TP | ||
446 | \fB\-\-dbus-system.talk=name | ||
447 | Allows the application to talk to the specified well-known name on the system DBus. | ||
448 | The name may have a .* suffix to match all names underneath it, including itself | ||
449 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | ||
450 | not "foobar"). | ||
451 | .br | ||
452 | |||
453 | .br | ||
454 | Example: | ||
455 | .br | ||
456 | $ firejail --dbus-system=filter --dbus-system.talk=org.freedesktop.Notifications | ||
457 | |||
458 | .TP | ||
459 | \fB\-\-dbus-user=filter|none | ||
460 | Set session DBus sandboxing policy. | ||
461 | .br | ||
462 | |||
463 | .br | ||
464 | The \fBfilter\fR policy enables the session DBus filter. This option requires | ||
465 | installing the xdg-dbus-proxy utility. Permissions for well-known names can be | ||
466 | added with the --dbus-user.talk and --dbus-user.own options. | ||
467 | .br | ||
468 | |||
469 | .br | ||
470 | The \fBnone\fR policy disables access to the session DBus. | ||
471 | .br | ||
472 | |||
473 | .br | ||
474 | Only the regular session DBus UNIX socket is handled by this option. To disable | ||
475 | the abstract sockets (and force applications to use the filtered UNIX socket) | ||
476 | you would need to request a new network namespace using \-\-net command. Another | ||
477 | option is to remove unix from the \-\-protocol set. | ||
478 | .br | ||
479 | |||
480 | .br | ||
481 | Example: | ||
482 | .br | ||
483 | $ firejail \-\-dbus-user=none | ||
484 | |||
485 | .TP | ||
486 | \fB\-\-dbus-user.broadcast=name=[member][@path] | ||
487 | Allows the application to receive broadcast signals from theindicated interface | ||
488 | member at the indicated object path exposed by the indicated bus name on the | ||
489 | session DBus. | ||
490 | The name may have a .* suffix to match all names underneath it, including | ||
491 | itself. | ||
492 | The interface member may have a .* to match all members of an interface, or be * to match all interfaces. | ||
493 | The path may have a /* suffix to indicate all objects underneath it, including | ||
494 | itself. | ||
495 | Omitting the interface member or the object path will match all members and | ||
496 | object paths, respectively. | ||
497 | .br | ||
498 | |||
499 | .br | ||
500 | Example: | ||
501 | .br | ||
502 | $ firejail --dbus-user=filter --dbus-user.broadcast=org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
503 | |||
504 | .TP | ||
505 | \fB\-\-dbus-user.call=name=[member][@path] | ||
506 | Allows the application to call the indicated interface member at the indicated | ||
507 | object path exposed by the indicated bus name on the session DBus. | ||
508 | The name may have a .* suffix to match all names underneath it, including | ||
509 | itself. | ||
510 | The interface member may have a .* to match all members of an interface, or be * to match all interfaces. | ||
511 | The path may have a /* suffix to indicate all objects underneath it, including | ||
512 | itself. | ||
513 | Omitting the interface member or the object path will match all members and | ||
514 | object paths, respectively. | ||
515 | .br | ||
516 | |||
517 | .br | ||
518 | Example: | ||
519 | .br | ||
520 | $ firejail --dbus-user=filter --dbus-user.call=org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
521 | |||
522 | .TP | ||
523 | \fB\-\-dbus-user.log | ||
524 | Turn on DBus logging for the session DBus. This option requires --dbus-user=log. | ||
525 | |||
526 | .br | ||
527 | Example: | ||
528 | .br | ||
529 | $ firejail --dbus-user=filter --dbus-user.log | ||
530 | |||
531 | .TP | ||
532 | \fB\-\-dbus-user.own=name | ||
533 | Allows the application to own the specified well-known name on the session DBus. | ||
534 | The name may have a .* suffix to match all names underneath it, including itself | ||
535 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | ||
536 | not "foobar"). | ||
537 | .br | ||
538 | |||
539 | .br | ||
540 | Example: | ||
541 | .br | ||
542 | $ firejail --dbus-user=filter --dbus-user.own=org.gnome.ghex.* | ||
543 | |||
544 | .TP | ||
545 | \fB\-\-dbus-user.talk=name | ||
546 | Allows the application to talk to the specified well-known name on the session DBus. | ||
547 | The name may have a .* suffix to match all names underneath it, including itself | ||
548 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | ||
549 | not "foobar"). | ||
550 | .br | ||
551 | |||
552 | .br | ||
553 | Example: | ||
554 | .br | ||
555 | $ firejail --dbus-user=filter --dbus-user.talk=org.freedesktop.Notifications | ||
556 | |||
557 | .TP | ||
558 | \fB\-\-dbus-user.see=name | ||
559 | Allows the application to see, but not talk to the specified well-known name on | ||
560 | the session DBus. | ||
561 | The name may have a .* suffix to match all names underneath it, including itself | ||
562 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | ||
563 | not "foobar"). | ||
564 | .br | ||
565 | |||
566 | .br | ||
567 | Example: | ||
568 | .br | ||
569 | $ firejail --dbus-user=filter --dbus-user.see=org.freedesktop.Notifications | ||
570 | |||
571 | .TP | ||
329 | \fB\-\-debug\fR | 572 | \fB\-\-debug\fR |
330 | Print debug messages. | 573 | Print debug messages. |
331 | .br | 574 | .br |
@@ -386,6 +629,10 @@ Example: | |||
386 | .br | 629 | .br |
387 | $ firejail \-\-debug-syscalls | 630 | $ firejail \-\-debug-syscalls |
388 | .TP | 631 | .TP |
632 | \fB\-\-debug-syscalls32 | ||
633 | Print all recognized 32 bit system calls in the current Firejail software build and exit. | ||
634 | .br | ||
635 | .TP | ||
389 | \fB\-\-debug-whitelists\fR | 636 | \fB\-\-debug-whitelists\fR |
390 | Debug whitelisting. | 637 | Debug whitelisting. |
391 | .br | 638 | .br |
@@ -810,8 +1057,9 @@ $ firejail \-\-machine-id | |||
810 | Install a seccomp filter to block attempts to create memory mappings | 1057 | Install a seccomp filter to block attempts to create memory mappings |
811 | that are both writable and executable, to change mappings to be | 1058 | that are both writable and executable, to change mappings to be |
812 | executable, or to create executable shared memory. The filter examines | 1059 | executable, or to create executable shared memory. The filter examines |
813 | the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create and | 1060 | the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create |
814 | shmat system calls and kills the process if necessary. | 1061 | and shmat system calls and returns error EPERM to the process (or |
1062 | kills it or log the attempt, see \-\-seccomp-error-action below) if necessary. | ||
815 | .br | 1063 | .br |
816 | 1064 | ||
817 | .br | 1065 | .br |
@@ -1165,12 +1413,8 @@ $ nc dict.org 2628 | |||
1165 | 220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64 | 1413 | 220 pan.alephnull.com dictd 1.12.1/rf on Linux 3.14-1-amd64 |
1166 | .br | 1414 | .br |
1167 | .TP | 1415 | .TP |
1168 | \fB\-\-nodbus | 1416 | \fB\-\-nodbus \fR(deprecated) |
1169 | Disable D-Bus access (both system and session buses). Only the regular | 1417 | Disable D-Bus access (both system and session buses). Equivalent to --dbus-system=none --dbus-user=none. |
1170 | UNIX sockets are handled by this command. To disable the abstract | ||
1171 | sockets you would need to request a new network namespace using | ||
1172 | \-\-net command. Another option is to remove unix from \-\-protocol | ||
1173 | set. | ||
1174 | .br | 1418 | .br |
1175 | 1419 | ||
1176 | .br | 1420 | .br |
@@ -1453,7 +1697,9 @@ $ firejail \-\-private=/home/netblue/firefox-home firefox | |||
1453 | .TP | 1697 | .TP |
1454 | \fB\-\-private-bin=file,file | 1698 | \fB\-\-private-bin=file,file |
1455 | Build a new /bin in a temporary filesystem, and copy the programs in the list. | 1699 | Build a new /bin in a temporary filesystem, and copy the programs in the list. |
1456 | If no listed file is found, /bin directory will be empty. | 1700 | The files in the list must be expressed as relative to the /bin, |
1701 | /sbin, /usr/bin, /usr/sbin, or /usr/local/bin directories. | ||
1702 | If no listed files are found, /bin directory will be empty. | ||
1457 | The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin. | 1703 | The same directory is also bind-mounted over /sbin, /usr/bin, /usr/sbin and /usr/local/bin. |
1458 | All modifications are discarded when the sandbox is closed. File globbing is supported, | 1704 | All modifications are discarded when the sandbox is closed. File globbing is supported, |
1459 | see \fBFILE GLOBBING\fR section for more details. | 1705 | see \fBFILE GLOBBING\fR section for more details. |
@@ -1549,6 +1795,8 @@ $ | |||
1549 | \fB\-\-private-etc=file,directory | 1795 | \fB\-\-private-etc=file,directory |
1550 | Build a new /etc in a temporary | 1796 | Build a new /etc in a temporary |
1551 | filesystem, and copy the files and directories in the list. | 1797 | filesystem, and copy the files and directories in the list. |
1798 | The files and directories in the list must be expressed as relative to | ||
1799 | the /etc directory. | ||
1552 | If no listed file is found, /etc directory will be empty. | 1800 | If no listed file is found, /etc directory will be empty. |
1553 | All modifications are discarded when the sandbox is closed. | 1801 | All modifications are discarded when the sandbox is closed. |
1554 | .br | 1802 | .br |
@@ -1558,13 +1806,16 @@ Example: | |||
1558 | .br | 1806 | .br |
1559 | $ firejail --private-etc=group,hostname,localtime, \\ | 1807 | $ firejail --private-etc=group,hostname,localtime, \\ |
1560 | .br | 1808 | .br |
1561 | nsswitch.conf,passwd,resolv.conf | 1809 | nsswitch.conf,passwd,resolv.conf,default/motd-news |
1562 | 1810 | ||
1563 | .TP | 1811 | .TP |
1564 | \fB\-\-private-home=file,directory | 1812 | \fB\-\-private-home=file,directory |
1565 | Build a new user home in a temporary | 1813 | Build a new user home in a temporary |
1566 | filesystem, and copy the files and directories in the list in the | 1814 | filesystem, and copy the files and directories in the list in the |
1567 | new home. All modifications are discarded when the sandbox is | 1815 | new home. |
1816 | The files and directories in the list must be expressed as relative to | ||
1817 | the current user's home directory. | ||
1818 | All modifications are discarded when the sandbox is | ||
1568 | closed. | 1819 | closed. |
1569 | .br | 1820 | .br |
1570 | 1821 | ||
@@ -1576,6 +1827,8 @@ $ firejail \-\-private-home=.mozilla firefox | |||
1576 | .TP | 1827 | .TP |
1577 | \fB\-\-private-lib=file,directory | 1828 | \fB\-\-private-lib=file,directory |
1578 | This feature is currently under heavy development. Only amd64 platforms are supported at this moment. | 1829 | This feature is currently under heavy development. Only amd64 platforms are supported at this moment. |
1830 | The files and directories in the list must be expressed as relative to | ||
1831 | the /lib directory. | ||
1579 | The idea is to build a new /lib in a temporary filesystem, | 1832 | The idea is to build a new /lib in a temporary filesystem, |
1580 | with only the library files necessary to run the application. | 1833 | with only the library files necessary to run the application. |
1581 | It could be as simple as: | 1834 | It could be as simple as: |
@@ -1627,6 +1880,8 @@ $ | |||
1627 | \fB\-\-private-opt=file,directory | 1880 | \fB\-\-private-opt=file,directory |
1628 | Build a new /opt in a temporary | 1881 | Build a new /opt in a temporary |
1629 | filesystem, and copy the files and directories in the list. | 1882 | filesystem, and copy the files and directories in the list. |
1883 | The files and directories in the list must be expressed as relative to | ||
1884 | the /opt directory. | ||
1630 | If no listed file is found, /opt directory will be empty. | 1885 | If no listed file is found, /opt directory will be empty. |
1631 | All modifications are discarded when the sandbox is closed. | 1886 | All modifications are discarded when the sandbox is closed. |
1632 | .br | 1887 | .br |
@@ -1640,6 +1895,8 @@ $ firejail --private-opt=firefox /opt/firefox/firefox | |||
1640 | \fB\-\-private-srv=file,directory | 1895 | \fB\-\-private-srv=file,directory |
1641 | Build a new /srv in a temporary | 1896 | Build a new /srv in a temporary |
1642 | filesystem, and copy the files and directories in the list. | 1897 | filesystem, and copy the files and directories in the list. |
1898 | The files and directories in the list must be expressed as relative to | ||
1899 | the /srv directory. | ||
1643 | If no listed file is found, /srv directory will be empty. | 1900 | If no listed file is found, /srv directory will be empty. |
1644 | All modifications are discarded when the sandbox is closed. | 1901 | All modifications are discarded when the sandbox is closed. |
1645 | .br | 1902 | .br |
@@ -1832,7 +2089,9 @@ Exceptions can be allowed with prefix !. | |||
1832 | System architecture is strictly imposed only if flag | 2089 | System architecture is strictly imposed only if flag |
1833 | \-\-seccomp.block-secondary is used. The filter is applied at run time | 2090 | \-\-seccomp.block-secondary is used. The filter is applied at run time |
1834 | only if the correct architecture was detected. For the case of I386 | 2091 | only if the correct architecture was detected. For the case of I386 |
1835 | and AMD64 both 32-bit and 64-bit filters are installed. | 2092 | and AMD64 both 32-bit and 64-bit filters are installed. On a 64 bit |
2093 | architecture, an additional filter for 32 bit system calls can be | ||
2094 | installed with \-\-seccomp.32. | ||
1836 | .br | 2095 | .br |
1837 | 2096 | ||
1838 | .br | 2097 | .br |
@@ -1859,8 +2118,12 @@ $ firejail \-\-seccomp=@clock,mkdir,unlinkat transmission-gtk | |||
1859 | .br | 2118 | .br |
1860 | 2119 | ||
1861 | .br | 2120 | .br |
1862 | Instead of dropping the syscall, a specific error number can be returned | 2121 | Instead of dropping the syscall by returning EPERM, another error |
1863 | using \fBsyscall:errorno\fR syntax. | 2122 | number can be returned using \fBsyscall:errno\fR syntax. This can be |
2123 | also changed globally with \-\-seccomp-error-action or | ||
2124 | in /etc/firejail/firejail.config file. The process can also be killed | ||
2125 | by using \fBsyscall:kill\fR syntax, or the attempt may be logged with | ||
2126 | \fBsyscall:log\fR. | ||
1864 | .br | 2127 | .br |
1865 | 2128 | ||
1866 | .br | 2129 | .br |
@@ -1881,7 +2144,8 @@ rm: cannot remove `testfile': Operation not permitted | |||
1881 | .br | 2144 | .br |
1882 | If the blocked system calls would also block Firejail from operating, | 2145 | If the blocked system calls would also block Firejail from operating, |
1883 | they are handled by adding a preloaded library which performs seccomp | 2146 | they are handled by adding a preloaded library which performs seccomp |
1884 | system calls later. | 2147 | system calls later. However, this is incompatible with 32 bit seccomp |
2148 | filters. | ||
1885 | .br | 2149 | .br |
1886 | 2150 | ||
1887 | .br | 2151 | .br |
@@ -1912,7 +2176,10 @@ domain with personality(2) system call. | |||
1912 | 2176 | ||
1913 | .TP | 2177 | .TP |
1914 | \fB\-\-seccomp.drop=syscall,@group | 2178 | \fB\-\-seccomp.drop=syscall,@group |
1915 | Enable seccomp filter, and blacklist the syscalls or the syscall groups specified by the command. | 2179 | Enable seccomp filter, and blacklist the syscalls or the syscall |
2180 | groups specified by the command. On a 64 bit architecture, an | ||
2181 | additional filter for 32 bit system calls can be installed with | ||
2182 | \-\-seccomp.32.drop. | ||
1916 | .br | 2183 | .br |
1917 | 2184 | ||
1918 | .br | 2185 | .br |
@@ -1922,8 +2189,12 @@ $ firejail \-\-seccomp.drop=utime,utimensat,utimes,@clock | |||
1922 | .br | 2189 | .br |
1923 | 2190 | ||
1924 | .br | 2191 | .br |
1925 | Instead of dropping the syscall, a specific error number can be returned | 2192 | Instead of dropping the syscall by returning EPERM, another error |
1926 | using \fBsyscall:errorno\fR syntax. | 2193 | number can be returned using \fBsyscall:errno\fR syntax. This can be |
2194 | also changed globally with \-\-seccomp-error-action or | ||
2195 | in /etc/firejail/firejail.config file. The process can also be killed | ||
2196 | by using \fBsyscall:kill\fR syntax, or the attempt may be logged with | ||
2197 | \fBsyscall:log\fR. | ||
1927 | .br | 2198 | .br |
1928 | 2199 | ||
1929 | .br | 2200 | .br |
@@ -1950,7 +2221,9 @@ rm: cannot remove `testfile': Operation not permitted | |||
1950 | \fB\-\-seccomp.keep=syscall,@group,!syscall2 | 2221 | \fB\-\-seccomp.keep=syscall,@group,!syscall2 |
1951 | Enable seccomp filter, blacklist all syscall not listed and "syscall2". | 2222 | Enable seccomp filter, blacklist all syscall not listed and "syscall2". |
1952 | The system calls needed by Firejail (group @default-keep: prctl, execve) | 2223 | The system calls needed by Firejail (group @default-keep: prctl, execve) |
1953 | are handled with the preload library. | 2224 | are handled with the preload library. On a 64 bit architecture, an |
2225 | additional filter for 32 bit system calls can be installed with | ||
2226 | \-\-seccomp.32.keep. | ||
1954 | .br | 2227 | .br |
1955 | 2228 | ||
1956 | .br | 2229 | .br |
@@ -2123,6 +2396,20 @@ $ firejail --seccomp.print=browser | |||
2123 | 0049: 06 00 01 00000000 ret KILL | 2396 | 0049: 06 00 01 00000000 ret KILL |
2124 | .br | 2397 | .br |
2125 | $ | 2398 | $ |
2399 | |||
2400 | .TP | ||
2401 | \fB\-\-seccomp-error-action= kill | ERRNO | ||
2402 | By default, if a seccomp filter blocks a system call, the process gets | ||
2403 | EPERM as the error. With \-\-seccomp-error-action=error, another error | ||
2404 | number can be returned, for example ENOSYS or EACCES. The process can | ||
2405 | also be killed (like in versions <0.9.63 of Firejail) by using | ||
2406 | \-\-seccomp-error-action=kill syntax, or the attempt may be logged | ||
2407 | with \-\-seccomp-error-action=log. Not killing the process weakens | ||
2408 | Firejail slightly when trying to contain intrusion, but it may also | ||
2409 | allow tighter filters if the only alternative is to allow a system | ||
2410 | call. | ||
2411 | .br | ||
2412 | |||
2126 | .TP | 2413 | .TP |
2127 | \fB\-\-shell=none | 2414 | \fB\-\-shell=none |
2128 | Run the program directly, without a user shell. | 2415 | Run the program directly, without a user shell. |
@@ -2334,6 +2621,10 @@ the same top directory. For user home, both the link and the real file should be | |||
2334 | .br | 2621 | .br |
2335 | 2622 | ||
2336 | .br | 2623 | .br |
2624 | File globbing is supported, see \fBFILE GLOBBING\fR section for more details. | ||
2625 | .br | ||
2626 | |||
2627 | .br | ||
2337 | Example: | 2628 | Example: |
2338 | .br | 2629 | .br |
2339 | $ firejail \-\-noprofile \-\-whitelist=~/.mozilla | 2630 | $ firejail \-\-noprofile \-\-whitelist=~/.mozilla |
@@ -2341,6 +2632,8 @@ $ firejail \-\-noprofile \-\-whitelist=~/.mozilla | |||
2341 | $ firejail \-\-whitelist=/tmp/.X11-unix --whitelist=/dev/null | 2632 | $ firejail \-\-whitelist=/tmp/.X11-unix --whitelist=/dev/null |
2342 | .br | 2633 | .br |
2343 | $ firejail "\-\-whitelist=/home/username/My Virtual Machines" | 2634 | $ firejail "\-\-whitelist=/home/username/My Virtual Machines" |
2635 | .br | ||
2636 | $ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups* | ||
2344 | 2637 | ||
2345 | .TP | 2638 | .TP |
2346 | \fB\-\-writable-etc | 2639 | \fB\-\-writable-etc |
@@ -2694,7 +2987,11 @@ List all sandboxed processes. | |||
2694 | 2987 | ||
2695 | .SH FILE GLOBBING | 2988 | .SH FILE GLOBBING |
2696 | .TP | 2989 | .TP |
2697 | Globbing is the operation that expands a wildcard pattern into the list of pathnames matching the pattern. Matching is defined by: | 2990 | Globbing is the operation that expands a wildcard pattern into the |
2991 | list of pathnames matching the pattern. This pattern is matched at | ||
2992 | firejail \fBstart\fR, and is NOT UPDATED at runtime. \fBFiles matching | ||
2993 | a blacklist, but created after firejail start will be accessible within | ||
2994 | the jail.\fR Matching is defined by: | ||
2698 | .br | 2995 | .br |
2699 | 2996 | ||
2700 | .br | 2997 | .br |
@@ -2705,12 +3002,15 @@ Globbing is the operation that expands a wildcard pattern into the list of pathn | |||
2705 | - '[' denotes a range of characters | 3002 | - '[' denotes a range of characters |
2706 | .br | 3003 | .br |
2707 | .TP | 3004 | .TP |
2708 | The globbing feature is implemented using glibc glob command. For more information on the wildcard syntax see man 7 glob. | 3005 | The globbing feature is implemented using glibc glob command. For |
3006 | more information on the wildcard syntax see man 7 glob. | ||
2709 | .br | 3007 | .br |
2710 | 3008 | ||
2711 | .br | 3009 | .br |
2712 | .TP | 3010 | .TP |
2713 | The following command line options are supported: \-\-blacklist, \-\-private-bin, \-\-noexec, \-\-read-only, \-\-read-write, and \-\-tmpfs. | 3011 | The following command line options are supported: \-\-blacklist, |
3012 | \-\-private-bin, \-\-noexec, \-\-read-only, \-\-read-write, | ||
3013 | \-\-tmpfs, and \-\-whitelist. | ||
2714 | .br | 3014 | .br |
2715 | 3015 | ||
2716 | .br | 3016 | .br |
@@ -2959,5 +3259,9 @@ Homepage: https://firejail.wordpress.com | |||
2959 | \&\flfiremon\fR\|(1), | 3259 | \&\flfiremon\fR\|(1), |
2960 | \&\flfirecfg\fR\|(1), | 3260 | \&\flfirecfg\fR\|(1), |
2961 | \&\flfirejail-profile\fR\|(5), | 3261 | \&\flfirejail-profile\fR\|(5), |
2962 | \&\flfirejail-login\fR\|(5) | 3262 | \&\flfirejail-login\fR\|(5), |
2963 | \&\flfirejail-users\fR\|(5) | 3263 | \&\flfirejail-users\fR\|(5), |
3264 | .UR https://github.com/netblue30/firejail/wiki | ||
3265 | .UE , | ||
3266 | .UR https://github.com/netblue30/firejail | ||
3267 | .UE | ||
diff --git a/src/profstats/Makefile.in b/src/profstats/Makefile.in new file mode 100644 index 000000000..2beaa3ed6 --- /dev/null +++ b/src/profstats/Makefile.in | |||
@@ -0,0 +1,14 @@ | |||
1 | all: profstats | ||
2 | |||
3 | include ../common.mk | ||
4 | |||
5 | %.o : %.c $(H_FILE_LIST) | ||
6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
7 | |||
8 | profstats: $(OBJS) | ||
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
10 | |||
11 | clean:; rm -fr *.o profstats *.gcov *.gcda *.gcno *.plist | ||
12 | |||
13 | distclean: clean | ||
14 | rm -fr Makefile | ||
diff --git a/src/profstats/main.c b/src/profstats/main.c new file mode 100644 index 000000000..a75ad8e29 --- /dev/null +++ b/src/profstats/main.c | |||
@@ -0,0 +1,304 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2020 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include <stdio.h> | ||
21 | #include <stdlib.h> | ||
22 | #include <string.h> | ||
23 | #include <assert.h> | ||
24 | |||
25 | #define MAXBUF 2048 | ||
26 | // stats | ||
27 | static int cnt_profiles = 0; | ||
28 | static int cnt_apparmor = 0; | ||
29 | static int cnt_seccomp = 0; | ||
30 | static int cnt_caps = 0; | ||
31 | static int cnt_dotlocal = 0; | ||
32 | static int cnt_globalsdotlocal = 0; | ||
33 | static int cnt_netnone = 0; | ||
34 | static int cnt_noexec = 0; // include disable-exec.inc | ||
35 | static int cnt_privatebin = 0; | ||
36 | static int cnt_privatedev = 0; | ||
37 | static int cnt_privatetmp = 0; | ||
38 | static int cnt_privateetc = 0; | ||
39 | static int cnt_whitelistvar = 0; // include whitelist-var-common.inc | ||
40 | static int cnt_whitelistrunuser = 0; // include whitelist-runuser-common.inc | ||
41 | static int cnt_whitelistusrshare = 0; // include whitelist-usr-share-common.inc | ||
42 | static int cnt_ssh = 0; | ||
43 | static int cnt_mdwx = 0; | ||
44 | |||
45 | static int level = 0; | ||
46 | static int arg_debug = 0; | ||
47 | static int arg_apparmor = 0; | ||
48 | static int arg_caps = 0; | ||
49 | static int arg_seccomp = 0; | ||
50 | static int arg_noexec = 0; | ||
51 | static int arg_privatebin = 0; | ||
52 | static int arg_privatedev = 0; | ||
53 | static int arg_privatetmp = 0; | ||
54 | static int arg_privateetc = 0; | ||
55 | static int arg_whitelistvar = 0; | ||
56 | static int arg_whitelistrunuser = 0; | ||
57 | static int arg_whitelistusrshare = 0; | ||
58 | static int arg_ssh = 0; | ||
59 | static int arg_mdwx = 0; | ||
60 | |||
61 | static char *profile = NULL; | ||
62 | |||
63 | |||
64 | static void usage(void) { | ||
65 | printf("proftool - print profile statistics\n"); | ||
66 | printf("Usage: proftool [options] file[s]\n"); | ||
67 | printf("Options:\n"); | ||
68 | printf(" --apparmor - print profiles without apparmor\n"); | ||
69 | printf(" --caps - print profiles without caps\n"); | ||
70 | printf(" --ssh - print profiles without \"include disable-common.inc\"\n"); | ||
71 | printf(" --noexec - print profiles without \"include disable-exec.inc\"\n"); | ||
72 | printf(" --private-bin - print profiles without private-bin\n"); | ||
73 | printf(" --private-dev - print profiles without private-dev\n"); | ||
74 | printf(" --private-etc - print profiles without private-etc\n"); | ||
75 | printf(" --private-tmp - print profiles without private-tmp\n"); | ||
76 | printf(" --seccomp - print profiles without seccomp\n"); | ||
77 | printf(" --memory-deny-write-execute - profile without \"memory-deny-write-execute\"\n"); | ||
78 | printf(" --whitelist-var - print profiles without \"include whitelist-var-common.inc\"\n"); | ||
79 | printf(" --whitelist-runuser - print profiles without \"include whitelist-runuser-common.inc\" or \"blacklist ${RUNUSER}\"\n"); | ||
80 | printf(" --whitelist-usrshare - print profiles without \"include whitelist-usr-share-common.inc\"\n"); | ||
81 | printf(" --debug\n"); | ||
82 | printf("\n"); | ||
83 | } | ||
84 | |||
85 | void process_file(const char *fname) { | ||
86 | assert(fname); | ||
87 | |||
88 | if (arg_debug) | ||
89 | printf("processing #%s#\n", fname); | ||
90 | level++; | ||
91 | assert(level < 32); // to do - check in firejail code | ||
92 | |||
93 | FILE *fp = fopen(fname, "r"); | ||
94 | if (!fp) { | ||
95 | fprintf(stderr, "Warning: cannot open %s, while processing %s\n", fname, profile); | ||
96 | level--; | ||
97 | return; | ||
98 | } | ||
99 | |||
100 | char buf[MAXBUF]; | ||
101 | while (fgets(buf, MAXBUF, fp)) { | ||
102 | char *ptr = strchr(buf, '\n'); | ||
103 | if (ptr) | ||
104 | *ptr = '\0'; | ||
105 | ptr = buf; | ||
106 | |||
107 | while (*ptr == ' ' || *ptr == '\t') | ||
108 | ptr++; | ||
109 | if (*ptr == '\n' || *ptr == '#') | ||
110 | continue; | ||
111 | |||
112 | if (strncmp(ptr, "seccomp", 7) == 0) | ||
113 | cnt_seccomp++; | ||
114 | else if (strncmp(ptr, "caps", 4) == 0) | ||
115 | cnt_caps++; | ||
116 | else if (strncmp(ptr, "include disable-exec.inc", 24) == 0) | ||
117 | cnt_noexec++; | ||
118 | else if (strncmp(ptr, "include whitelist-var-common.inc", 32) == 0) | ||
119 | cnt_whitelistvar++; | ||
120 | else if (strncmp(ptr, "include whitelist-runuser-common.inc", 36) == 0 || | ||
121 | strncmp(ptr, "blacklist ${RUNUSER}", 20) == 0) | ||
122 | cnt_whitelistrunuser++; | ||
123 | else if (strncmp(ptr, "include whitelist-usr-share-common.inc", 38) == 0) | ||
124 | cnt_whitelistusrshare++; | ||
125 | else if (strncmp(ptr, "include disable-common.inc", 26) == 0) | ||
126 | cnt_ssh++; | ||
127 | else if (strncmp(ptr, "memory-deny-write-execute", 25) == 0) | ||
128 | cnt_mdwx++; | ||
129 | else if (strncmp(ptr, "net none", 8) == 0) | ||
130 | cnt_netnone++; | ||
131 | else if (strncmp(ptr, "apparmor", 8) == 0) | ||
132 | cnt_apparmor++; | ||
133 | else if (strncmp(ptr, "private-bin", 11) == 0) | ||
134 | cnt_privatebin++; | ||
135 | else if (strncmp(ptr, "private-dev", 11) == 0) | ||
136 | cnt_privatedev++; | ||
137 | else if (strncmp(ptr, "private-tmp", 11) == 0) | ||
138 | cnt_privatetmp++; | ||
139 | else if (strncmp(ptr, "private-etc", 11) == 0) | ||
140 | cnt_privateetc++; | ||
141 | else if (strncmp(ptr, "include ", 8) == 0) { | ||
142 | // not processing .local files | ||
143 | if (strstr(ptr, ".local")) { | ||
144 | //printf("dotlocal %d, level %d - #%s#, redirect #%s#\n", cnt_dotlocal, level, fname, buf + 8); | ||
145 | if (strstr(ptr, "globals.local")) | ||
146 | cnt_globalsdotlocal++; | ||
147 | else | ||
148 | cnt_dotlocal++; | ||
149 | continue; | ||
150 | } | ||
151 | process_file(buf + 8); | ||
152 | } | ||
153 | } | ||
154 | |||
155 | fclose(fp); | ||
156 | level--; | ||
157 | } | ||
158 | |||
159 | int main(int argc, char **argv) { | ||
160 | if (argc <= 1) { | ||
161 | usage(); | ||
162 | return 1; | ||
163 | } | ||
164 | |||
165 | int start = 1; | ||
166 | int i; | ||
167 | for (i = 1; i < argc; i++) { | ||
168 | if (strcmp(argv[i], "--help") == 0) { | ||
169 | usage(); | ||
170 | return 0; | ||
171 | } | ||
172 | else if (strcmp(argv[i], "--debug") == 0) | ||
173 | arg_debug = 1; | ||
174 | else if (strcmp(argv[i], "--apparmor") == 0) | ||
175 | arg_apparmor = 1; | ||
176 | else if (strcmp(argv[i], "--caps") == 0) | ||
177 | arg_caps = 1; | ||
178 | else if (strcmp(argv[i], "--seccomp") == 0) | ||
179 | arg_seccomp = 1; | ||
180 | else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) | ||
181 | arg_mdwx = 1; | ||
182 | else if (strcmp(argv[i], "--noexec") == 0) | ||
183 | arg_noexec = 1; | ||
184 | else if (strcmp(argv[i], "--private-bin") == 0) | ||
185 | arg_privatebin = 1; | ||
186 | else if (strcmp(argv[i], "--private-dev") == 0) | ||
187 | arg_privatedev = 1; | ||
188 | else if (strcmp(argv[i], "--private-tmp") == 0) | ||
189 | arg_privatetmp = 1; | ||
190 | else if (strcmp(argv[i], "--private-etc") == 0) | ||
191 | arg_privateetc = 1; | ||
192 | else if (strcmp(argv[i], "--whitelist-var") == 0) | ||
193 | arg_whitelistvar = 1; | ||
194 | else if (strcmp(argv[i], "--whitelist-runuser") == 0) | ||
195 | arg_whitelistrunuser = 1; | ||
196 | else if (strcmp(argv[i], "--whitelist-usrshare") == 0) | ||
197 | arg_whitelistusrshare = 1; | ||
198 | else if (strcmp(argv[i], "--ssh") == 0) | ||
199 | arg_ssh = 1; | ||
200 | else if (*argv[i] == '-') { | ||
201 | fprintf(stderr, "Error: invalid option %s\n", argv[i]); | ||
202 | return 1; | ||
203 | } | ||
204 | else | ||
205 | break; | ||
206 | } | ||
207 | |||
208 | start = i; | ||
209 | if (i == argc) { | ||
210 | fprintf(stderr, "Error: no profile file specified\n"); | ||
211 | return 1; | ||
212 | } | ||
213 | |||
214 | for (i = start; i < argc; i++) { | ||
215 | cnt_profiles++; | ||
216 | |||
217 | // watch seccomp | ||
218 | int seccomp = cnt_seccomp; | ||
219 | int caps = cnt_caps; | ||
220 | int apparmor = cnt_apparmor; | ||
221 | int noexec = cnt_noexec; | ||
222 | int privatebin = cnt_privatebin; | ||
223 | int privatetmp = cnt_privatetmp; | ||
224 | int privatedev = cnt_privatedev; | ||
225 | int privateetc = cnt_privateetc; | ||
226 | int dotlocal = cnt_dotlocal; | ||
227 | int globalsdotlocal = cnt_globalsdotlocal; | ||
228 | int whitelistvar = cnt_whitelistvar; | ||
229 | int whitelistrunuser = cnt_whitelistrunuser; | ||
230 | int whitelistusrshare = cnt_whitelistusrshare; | ||
231 | int ssh = cnt_ssh; | ||
232 | int mdwx = cnt_mdwx; | ||
233 | |||
234 | // process file | ||
235 | profile = argv[i]; | ||
236 | process_file(argv[i]); | ||
237 | |||
238 | // warnings | ||
239 | if ((caps + 2) <= cnt_caps) { | ||
240 | printf("Warning: multiple caps in %s\n", argv[i]); | ||
241 | cnt_caps = caps + 1; | ||
242 | } | ||
243 | |||
244 | // fix redirections | ||
245 | if (cnt_dotlocal > (dotlocal + 1)) | ||
246 | cnt_dotlocal = dotlocal + 1; | ||
247 | if (cnt_globalsdotlocal > (globalsdotlocal + 1)) | ||
248 | cnt_globalsdotlocal = globalsdotlocal + 1; | ||
249 | if (cnt_whitelistrunuser > (whitelistrunuser + 1)) | ||
250 | cnt_whitelistrunuser = whitelistrunuser + 1; | ||
251 | |||
252 | if (arg_apparmor && apparmor == cnt_apparmor) | ||
253 | printf("No apparmor found in %s\n", argv[i]); | ||
254 | if (arg_caps && caps == cnt_caps) | ||
255 | printf("No caps found in %s\n", argv[i]); | ||
256 | if (arg_seccomp && seccomp == cnt_seccomp) | ||
257 | printf("No seccomp found in %s\n", argv[i]); | ||
258 | if (arg_noexec && noexec == cnt_noexec) | ||
259 | printf("No include disable-exec.inc found in %s\n", argv[i]); | ||
260 | if (arg_privatedev && privatedev == cnt_privatedev) | ||
261 | printf("No private-dev found in %s\n", argv[i]); | ||
262 | if (arg_privatebin && privatebin == cnt_privatebin) | ||
263 | printf("No private-bin found in %s\n", argv[i]); | ||
264 | if (arg_privatetmp && privatetmp == cnt_privatetmp) | ||
265 | printf("No private-tmp found in %s\n", argv[i]); | ||
266 | if (arg_privateetc && privateetc == cnt_privateetc) | ||
267 | printf("No private-etc found in %s\n", argv[i]); | ||
268 | if (arg_whitelistvar && whitelistvar == cnt_whitelistvar) | ||
269 | printf("No include whitelist-var-common.inc found in %s\n", argv[i]); | ||
270 | if (arg_whitelistrunuser && whitelistrunuser == cnt_whitelistrunuser) | ||
271 | printf("No include whitelist-runuser-common.inc found in %s\n", argv[i]); | ||
272 | if (arg_whitelistusrshare && whitelistusrshare == cnt_whitelistusrshare) | ||
273 | printf("No include whitelist-usr-share-common.inc found in %s\n", argv[i]); | ||
274 | if (arg_ssh && ssh == cnt_ssh) | ||
275 | printf("No include disable-common.inc found in %s\n", argv[i]); | ||
276 | if (arg_mdwx && mdwx == cnt_mdwx) | ||
277 | printf("No memory-deny-write-execute found in %s\n", argv[i]); | ||
278 | |||
279 | assert(level == 0); | ||
280 | } | ||
281 | |||
282 | printf("\n"); | ||
283 | printf("Stats:\n"); | ||
284 | printf(" profiles\t\t\t%d\n", cnt_profiles); | ||
285 | printf(" include local profile\t%d (include profile-name.local)\n", cnt_dotlocal); | ||
286 | printf(" include globals\t\t%d (include globals.local)\n", cnt_dotlocal); | ||
287 | printf(" blacklist ~/.ssh\t\t%d (include disable-common.inc)\n", cnt_ssh); | ||
288 | printf(" seccomp\t\t\t%d\n", cnt_seccomp); | ||
289 | printf(" capabilities\t\t%d\n", cnt_caps); | ||
290 | printf(" noexec\t\t\t%d (include disable-exec.inc)\n", cnt_noexec); | ||
291 | printf(" memory-deny-write-execute\t%d\n", cnt_mdwx); | ||
292 | printf(" apparmor\t\t\t%d\n", cnt_apparmor); | ||
293 | printf(" private-bin\t\t\t%d\n", cnt_privatebin); | ||
294 | printf(" private-dev\t\t\t%d\n", cnt_privatedev); | ||
295 | printf(" private-etc\t\t\t%d\n", cnt_privateetc); | ||
296 | printf(" private-tmp\t\t\t%d\n", cnt_privatetmp); | ||
297 | printf(" whitelist var\t\t%d (include whitelist-var-common.inc)\n", cnt_whitelistvar); | ||
298 | printf(" whitelist run/user\t\t%d (include whitelist-runuser-common.inc\n", cnt_whitelistrunuser); | ||
299 | printf("\t\t\t\t\tor blacklist ${RUNUSER})\n"); | ||
300 | printf(" whitelist usr/share\t\t%d (include whitelist-usr-share-common.inc\n", cnt_whitelistusrshare); | ||
301 | printf(" net none\t\t\t%d\n", cnt_netnone); | ||
302 | printf("\n"); | ||
303 | return 0; | ||
304 | } | ||
diff --git a/test/compile/compile.sh b/test/compile/compile.sh index ccf37dc40..2f9e0ece6 100755 --- a/test/compile/compile.sh +++ b/test/compile/compile.sh | |||
@@ -10,7 +10,7 @@ arr[4]="TEST 4: compile firetunnel disabled" | |||
10 | arr[5]="TEST 5: compile user namespace disabled" | 10 | arr[5]="TEST 5: compile user namespace disabled" |
11 | arr[6]="TEST 6: compile network disabled" | 11 | arr[6]="TEST 6: compile network disabled" |
12 | arr[7]="TEST 7: compile X11 disabled" | 12 | arr[7]="TEST 7: compile X11 disabled" |
13 | arr[8]="deprecated: TEST 8: compile network restricted" | 13 | arr[8]="TEST 8: compile selinux" |
14 | arr[9]="TEST 9: compile file transfer disabled" | 14 | arr[9]="TEST 9: compile file transfer disabled" |
15 | arr[10]="TEST 10: compile disable whitelist" | 15 | arr[10]="TEST 10: compile disable whitelist" |
16 | arr[11]="TEST 11: compile disable global config" | 16 | arr[11]="TEST 11: compile disable global config" |
@@ -183,6 +183,23 @@ cp output-configure oc7 | |||
183 | cp output-make om7 | 183 | cp output-make om7 |
184 | rm output-configure output-make | 184 | rm output-configure output-make |
185 | 185 | ||
186 | #***************************************************************** | ||
187 | # TEST 8 | ||
188 | #***************************************************************** | ||
189 | # - enable selinux | ||
190 | #***************************************************************** | ||
191 | print_title "${arr[8]}" | ||
192 | # seccomp | ||
193 | cd firejail | ||
194 | make distclean | ||
195 | ./configure --prefix=/usr --enable-selinux --enable-fatal-warnings 2>&1 | tee ../output-configure | ||
196 | make -j4 2>&1 | tee ../output-make | ||
197 | cd .. | ||
198 | grep Warning output-configure output-make > ./report-test8 | ||
199 | grep Error output-configure output-make >> ./report-test8 | ||
200 | cp output-configure oc8 | ||
201 | cp output-make om8 | ||
202 | rm output-configure output-make | ||
186 | 203 | ||
187 | #***************************************************************** | 204 | #***************************************************************** |
188 | # TEST 9 | 205 | # TEST 9 |
diff --git a/test/environment/rlimit-profile.exp b/test/environment/rlimit-profile.exp index 721e2196e..6dd7cb3b5 100755 --- a/test/environment/rlimit-profile.exp +++ b/test/environment/rlimit-profile.exp | |||
@@ -30,7 +30,7 @@ expect { | |||
30 | } | 30 | } |
31 | expect { | 31 | expect { |
32 | timeout {puts "TESTING ERROR 1.4\n";exit} | 32 | timeout {puts "TESTING ERROR 1.4\n";exit} |
33 | "Max address space 123456789012 123456789012" | 33 | "Max address space 1234567890 1234567890" |
34 | } | 34 | } |
35 | expect { | 35 | expect { |
36 | timeout {puts "TESTING ERROR 1.5\n";exit} | 36 | timeout {puts "TESTING ERROR 1.5\n";exit} |
diff --git a/test/environment/rlimit.exp b/test/environment/rlimit.exp index 757faf1f9..ed3f08e20 100755 --- a/test/environment/rlimit.exp +++ b/test/environment/rlimit.exp | |||
@@ -8,7 +8,7 @@ cd /home | |||
8 | spawn $env(SHELL) | 8 | spawn $env(SHELL) |
9 | match_max 100000 | 9 | match_max 100000 |
10 | 10 | ||
11 | send -- "firejail --rlimit-fsize=1024 --rlimit-nproc=1000 --rlimit-nofile=500 --rlimit-sigpending=200 --rlimit-as=123456789012\r" | 11 | send -- "firejail --rlimit-fsize=1024 --rlimit-nproc=1000 --rlimit-nofile=500 --rlimit-sigpending=200 --rlimit-as=1234567890\r" |
12 | expect { | 12 | expect { |
13 | timeout {puts "TESTING ERROR 0\n";exit} | 13 | timeout {puts "TESTING ERROR 0\n";exit} |
14 | "Child process initialized" | 14 | "Child process initialized" |
@@ -30,7 +30,7 @@ expect { | |||
30 | } | 30 | } |
31 | expect { | 31 | expect { |
32 | timeout {puts "TESTING ERROR 1.4\n";exit} | 32 | timeout {puts "TESTING ERROR 1.4\n";exit} |
33 | "Max address space 123456789012 123456789012" | 33 | "Max address space 1234567890 1234567890" |
34 | } | 34 | } |
35 | expect { | 35 | expect { |
36 | timeout {puts "TESTING ERROR 1.5\n";exit} | 36 | timeout {puts "TESTING ERROR 1.5\n";exit} |
diff --git a/test/environment/rlimit.profile b/test/environment/rlimit.profile index a569edc6d..2f1134e6c 100644 --- a/test/environment/rlimit.profile +++ b/test/environment/rlimit.profile | |||
@@ -2,4 +2,4 @@ rlimit-fsize 1024 | |||
2 | rlimit-nproc 1000 | 2 | rlimit-nproc 1000 |
3 | rlimit-nofile 500 | 3 | rlimit-nofile 500 |
4 | rlimit-sigpending 200 | 4 | rlimit-sigpending 200 |
5 | rlimit-as 123456789012 | 5 | rlimit-as 1234567890 |
diff --git a/test/filters/memwrexe.c b/test/filters/memwrexe.c index 797e7881d..e68176b42 100644 --- a/test/filters/memwrexe.c +++ b/test/filters/memwrexe.c | |||
@@ -65,7 +65,7 @@ int main(int argc, char **argv) { | |||
65 | } | 65 | } |
66 | 66 | ||
67 | void *p = mmap (0, size, PROT_READ, MAP_SHARED, fd, 0); | 67 | void *p = mmap (0, size, PROT_READ, MAP_SHARED, fd, 0); |
68 | if (!p) { | 68 | if (p == MAP_FAILED) { |
69 | fprintf(stderr, "TESTING ERROR: cannot map file for mprotect test\n"); | 69 | fprintf(stderr, "TESTING ERROR: cannot map file for mprotect test\n"); |
70 | return 1; | 70 | return 1; |
71 | } | 71 | } |
diff --git a/test/fs/mkdir.exp b/test/fs/mkdir.exp index 8a7ac9d97..59005e1a2 100755 --- a/test/fs/mkdir.exp +++ b/test/fs/mkdir.exp | |||
@@ -17,10 +17,32 @@ expect { | |||
17 | send -- "rm -rf ~/.firejail_test\r" | 17 | send -- "rm -rf ~/.firejail_test\r" |
18 | after 100 | 18 | after 100 |
19 | 19 | ||
20 | send -- "firejail --profile=mkdir.profile find /tmp/.firejail_test\r" | ||
21 | expect { | ||
22 | timeout {puts "TESTING ERROR 2.1\n";exit} | ||
23 | "Warning: cannot create" { puts "TESTING ERROR 2.2\n";exit} | ||
24 | "No such file or directory" { puts "TESTING ERROR 2.3\n";exit} | ||
25 | "/tmp/.firejail_test/a/b/c/d.txt" | ||
26 | } | ||
27 | send -- "rm -rf /tmp/.firejail_test\r" | ||
28 | after 100 | ||
29 | |||
30 | set UID [exec id -u] | ||
31 | send -- "firejail --profile=mkdir.profile find /run/user/$UID/.firejail_test\r" | ||
32 | expect { | ||
33 | timeout {puts "TESTING ERROR 3.1\n";exit} | ||
34 | "Warning: cannot create" { puts "TESTING ERROR 3.2\n";exit} | ||
35 | "No such file or directory" { puts "TESTING ERROR 3.3\n";exit} | ||
36 | "/run/user/$UID/.firejail_test/a/b/c/d.txt" | ||
37 | } | ||
38 | send -- "rm -rf /run/user/$UID/.firejail_test\r" | ||
39 | after 100 | ||
40 | |||
41 | |||
20 | send -- "firejail --profile=mkdir2.profile\r" | 42 | send -- "firejail --profile=mkdir2.profile\r" |
21 | expect { | 43 | expect { |
22 | timeout {puts "TESTING ERROR 2\n";exit} | 44 | timeout {puts "TESTING ERROR 4\n";exit} |
23 | "only directories in user home or /tmp" | 45 | "only files or directories in user home, /tmp, or /run/user/<UID>" |
24 | } | 46 | } |
25 | after 100 | 47 | after 100 |
26 | 48 | ||
diff --git a/test/fs/mkdir.profile b/test/fs/mkdir.profile index 61b44c9ac..35c27c872 100644 --- a/test/fs/mkdir.profile +++ b/test/fs/mkdir.profile | |||
@@ -1,2 +1,6 @@ | |||
1 | mkdir ~/.firejail_test/a/b/c | 1 | mkdir ~/.firejail_test/a/b/c |
2 | mkfile ~/.firejail_test/a/b/c/d.txt | 2 | mkfile ~/.firejail_test/a/b/c/d.txt |
3 | mkdir /tmp/.firejail_test/a/b/c | ||
4 | mkfile /tmp/.firejail_test/a/b/c/d.txt | ||
5 | mkdir ${RUNUSER}/.firejail_test/a/b/c | ||
6 | mkfile ${RUNUSER}/.firejail_test/a/b/c/d.txt | ||
diff --git a/test/fs/mkdir_mkfile.exp b/test/fs/mkdir_mkfile.exp index 109984035..82dab1ddf 100755 --- a/test/fs/mkdir_mkfile.exp +++ b/test/fs/mkdir_mkfile.exp | |||
@@ -22,23 +22,23 @@ expect { | |||
22 | "_firejail_test_dir" | 22 | "_firejail_test_dir" |
23 | } | 23 | } |
24 | expect { | 24 | expect { |
25 | timeout {puts "TESTING ERROR 1\n";exit} | 25 | timeout {puts "TESTING ERROR 2\n";exit} |
26 | "_firejail_test_dir/dir1" | 26 | "_firejail_test_dir/dir1" |
27 | } | 27 | } |
28 | expect { | 28 | expect { |
29 | timeout {puts "TESTING ERROR 1\n";exit} | 29 | timeout {puts "TESTING ERROR 3\n";exit} |
30 | "_firejail_test_dir/dir1/dir2" | 30 | "_firejail_test_dir/dir1/dir2" |
31 | } | 31 | } |
32 | expect { | 32 | expect { |
33 | timeout {puts "TESTING ERROR 1\n";exit} | 33 | timeout {puts "TESTING ERROR 4\n";exit} |
34 | "_firejail_test_dir/dir1/dir2/dir3" | 34 | "_firejail_test_dir/dir1/dir2/dir3" |
35 | } | 35 | } |
36 | expect { | 36 | expect { |
37 | timeout {puts "TESTING ERROR 1\n";exit} | 37 | timeout {puts "TESTING ERROR 5\n";exit} |
38 | "_firejail_test_dir/dir1/dir2/dir3/file1" | 38 | "_firejail_test_dir/dir1/dir2/dir3/file1" |
39 | } | 39 | } |
40 | expect { | 40 | expect { |
41 | timeout {puts "TESTING ERROR 1\n";exit} | 41 | timeout {puts "TESTING ERROR 6\n";exit} |
42 | "_firejail_test_file" | 42 | "_firejail_test_file" |
43 | } | 43 | } |
44 | after 100 | 44 | after 100 |
@@ -47,8 +47,8 @@ after 100 | |||
47 | 47 | ||
48 | send -- "firejail --profile=mkfile.profile\r" | 48 | send -- "firejail --profile=mkfile.profile\r" |
49 | expect { | 49 | expect { |
50 | timeout {puts "TESTING ERROR 1\n";exit} | 50 | timeout {puts "TESTING ERROR 7\n";exit} |
51 | "only files in user home or /tmp" | 51 | "only files or directories in user home, /tmp" |
52 | } | 52 | } |
53 | after 100 | 53 | after 100 |
54 | 54 | ||
diff --git a/test/fs/private-lib.exp b/test/fs/private-lib.exp index ed04de1f9..574ca7ab4 100755 --- a/test/fs/private-lib.exp +++ b/test/fs/private-lib.exp | |||
@@ -30,8 +30,8 @@ after 100 | |||
30 | send -- "cd /lib; find .\r" | 30 | send -- "cd /lib; find .\r" |
31 | expect { | 31 | expect { |
32 | timeout {puts "TESTING ERROR 5\n";exit} | 32 | timeout {puts "TESTING ERROR 5\n";exit} |
33 | "modules" {puts "TESTING ERROR 6\n";exit} | 33 | "./modules" {puts "TESTING ERROR 6\n";exit} |
34 | "firmware" {puts "TESTING ERROR 7\n";exit} | 34 | "./firmware" {puts "TESTING ERROR 7\n";exit} |
35 | "libc.so" | 35 | "libc.so" |
36 | } | 36 | } |
37 | after 100 | 37 | after 100 |
diff --git a/test/utils/build.exp b/test/utils/build.exp index ae46ffa6e..ac4f30326 100755 --- a/test/utils/build.exp +++ b/test/utils/build.exp | |||
@@ -7,22 +7,21 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "echo testing > ~/firejail-test-file-7699\r" | ||
11 | after 100 | ||
12 | |||
10 | send -- "firejail --build cat ~/firejail-test-file-7699\r" | 13 | send -- "firejail --build cat ~/firejail-test-file-7699\r" |
11 | expect { | 14 | expect { |
12 | timeout {puts "TESTING ERROR 0\n";exit} | 15 | timeout {puts "TESTING ERROR 0\n";exit} |
13 | "whitelist ~/firejail-test-file-7699" | 16 | "whitelist $\{HOME\}/firejail-test-file-7699" |
14 | } | ||
15 | expect { | ||
16 | timeout {puts "TESTING ERROR 0.1\n";exit} | ||
17 | "include /etc/firejail/whitelist-common.inc" | ||
18 | } | 17 | } |
19 | expect { | 18 | expect { |
20 | timeout {puts "TESTING ERROR 1\n";exit} | 19 | timeout {puts "TESTING ERROR 1\n";exit} |
21 | "private-tmp" | 20 | "include whitelist-common.inc" |
22 | } | 21 | } |
23 | expect { | 22 | expect { |
24 | timeout {puts "TESTING ERROR 2\n";exit} | 23 | timeout {puts "TESTING ERROR 2\n";exit} |
25 | "private-dev" | 24 | "blacklist /usr/share" |
26 | } | 25 | } |
27 | expect { | 26 | expect { |
28 | timeout {puts "TESTING ERROR 3\n";exit} | 27 | timeout {puts "TESTING ERROR 3\n";exit} |
@@ -34,26 +33,40 @@ expect { | |||
34 | } | 33 | } |
35 | expect { | 34 | expect { |
36 | timeout {puts "TESTING ERROR 5\n";exit} | 35 | timeout {puts "TESTING ERROR 5\n";exit} |
37 | "caps.drop all" | 36 | "private-dev" |
38 | } | 37 | } |
39 | expect { | 38 | expect { |
40 | timeout {puts "TESTING ERROR 6\n";exit} | 39 | timeout {puts "TESTING ERROR 6\n";exit} |
41 | "nonewprivs" | 40 | "private-etc" |
42 | } | 41 | } |
43 | expect { | 42 | expect { |
44 | timeout {puts "TESTING ERROR 7\n";exit} | 43 | timeout {puts "TESTING ERROR 7\n";exit} |
45 | "seccomp" | 44 | "private-tmp" |
46 | } | 45 | } |
47 | expect { | 46 | expect { |
48 | timeout {puts "TESTING ERROR 8\n";exit} | 47 | timeout {puts "TESTING ERROR 8\n";exit} |
49 | "net none" | 48 | "caps.drop all" |
50 | } | 49 | } |
51 | expect { | 50 | expect { |
52 | timeout {puts "TESTING ERROR 9\n";exit} | 51 | timeout {puts "TESTING ERROR 9\n";exit} |
52 | "nonewprivs" | ||
53 | } | ||
54 | expect { | ||
55 | timeout {puts "TESTING ERROR 10\n";exit} | ||
56 | "seccomp" | ||
57 | } | ||
58 | expect { | ||
59 | timeout {puts "TESTING ERROR 11\n";exit} | ||
60 | "net none" | ||
61 | } | ||
62 | expect { | ||
63 | timeout {puts "TESTING ERROR 12\n";exit} | ||
53 | "shell none" | 64 | "shell none" |
54 | } | 65 | } |
55 | after 100 | 66 | after 100 |
56 | 67 | ||
68 | |||
69 | |||
57 | send -- "firejail --build cat /etc/passwd\r" | 70 | send -- "firejail --build cat /etc/passwd\r" |
58 | expect { | 71 | expect { |
59 | timeout {puts "TESTING ERROR 10\n";exit} | 72 | timeout {puts "TESTING ERROR 10\n";exit} |
@@ -72,21 +85,6 @@ expect { | |||
72 | } | 85 | } |
73 | after 100 | 86 | after 100 |
74 | 87 | ||
75 | |||
76 | #send -- "firejail --build cat /var/tmp/firejail-test-file-7699\r" | ||
77 | #expect { | ||
78 | # timeout {puts "TESTING ERROR 11\n";exit} | ||
79 | # "whitelist /var/tmp/firejail-test-file-7699" | ||
80 | #} | ||
81 | #after 100 | ||
82 | |||
83 | #send -- "firejail --build man firejail\r" | ||
84 | #expect { | ||
85 | # timeout {puts "TESTING ERROR 12\n";exit} | ||
86 | # "whitelist /usr/share/man" | ||
87 | #} | ||
88 | #after 100 | ||
89 | |||
90 | send -- "firejail --build wget --output-document=~ debian.org\r" | 88 | send -- "firejail --build wget --output-document=~ debian.org\r" |
91 | expect { | 89 | expect { |
92 | timeout {puts "TESTING ERROR 13\n";exit} | 90 | timeout {puts "TESTING ERROR 13\n";exit} |
@@ -98,10 +96,4 @@ expect { | |||
98 | } | 96 | } |
99 | after 100 | 97 | after 100 |
100 | 98 | ||
101 | |||
102 | send -- "firejail --build cat /tmp/firejail-test-file-7699\r" | ||
103 | #todo - bug: it comes back with private-tmp | ||
104 | sleep 1 | ||
105 | |||
106 | |||
107 | puts "all done\n" | 99 | puts "all done\n" |
diff --git a/test/utils/utils.sh b/test/utils/utils.sh index 82ccc82bb..48a8051fa 100755 --- a/test/utils/utils.sh +++ b/test/utils/utils.sh | |||
@@ -13,14 +13,9 @@ if [ -f /etc/debian_version ]; then | |||
13 | fi | 13 | fi |
14 | export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" | 14 | export PATH="$PATH:/usr/lib/firejail:/usr/lib64/firejail" |
15 | 15 | ||
16 | echo "testing" > ~/firejail-test-file-7699 | ||
17 | echo "testing" > /tmp/firejail-test-file-7699 | ||
18 | echo "testing" > /var/tmp/firejail-test-file-7699 | ||
19 | echo "TESTING: build (test/utils/build.exp)" | 16 | echo "TESTING: build (test/utils/build.exp)" |
20 | ./build.exp | 17 | ./build.exp |
21 | rm -f ~/firejail-test-file-7699 | 18 | rm -f ~/firejail-test-file-7699 |
22 | rm -f /tmp/firejail-test-file-7699 | ||
23 | rm -f /var/tmp/firejail-test-file-7699 | ||
24 | rm -f firejail-test-file-4388 | 19 | rm -f firejail-test-file-4388 |
25 | 20 | ||
26 | if [ $(readlink /proc/self) -lt 100 ]; then | 21 | if [ $(readlink /proc/self) -lt 100 ]; then |