diff options
-rw-r--r-- | Makefile.in | 10 | ||||
-rw-r--r-- | README | 3 | ||||
-rw-r--r-- | README.md | 158 | ||||
-rw-r--r-- | RELNOTES | 7 | ||||
-rwxr-xr-x | configure | 18 | ||||
-rw-r--r-- | configure.ac | 2 | ||||
-rw-r--r-- | etc/Xephyr.profile | 6 | ||||
-rw-r--r-- | etc/Xvfb.profile | 2 | ||||
-rw-r--r-- | etc/vlc.profile | 2 | ||||
-rw-r--r-- | etc/xpra.profile | 8 | ||||
-rw-r--r-- | platform/debian/conffiles | 1 | ||||
-rw-r--r-- | platform/debian/control | 2 | ||||
-rwxr-xr-x | platform/rpm/old-mkrpm.sh | 48 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 2 | ||||
-rw-r--r-- | src/firejail/main.c | 2 | ||||
-rw-r--r-- | src/firejail/no_sandbox.c | 3 | ||||
-rw-r--r-- | src/firejail/profile.c | 6 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 4 | ||||
-rw-r--r-- | src/firejail/x11.c | 4 | ||||
-rw-r--r-- | src/fseccomp/protocol.c | 5 | ||||
-rw-r--r-- | src/man/firecfg.txt | 12 | ||||
-rwxr-xr-x | test/arguments/arguments.sh | 1 | ||||
-rwxr-xr-x | test/environment/allow-debuggers.exp | 3 | ||||
-rwxr-xr-x | test/filters/filters.sh | 2 | ||||
-rwxr-xr-x | test/utils/firecfg-fix.exp | 25 | ||||
-rwxr-xr-x | test/utils/utils.sh | 5 |
26 files changed, 104 insertions, 237 deletions
diff --git a/Makefile.in b/Makefile.in index b6997bd3d..e9aab83c9 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -16,6 +16,7 @@ VERSION=@PACKAGE_VERSION@ | |||
16 | NAME=@PACKAGE_NAME@ | 16 | NAME=@PACKAGE_NAME@ |
17 | PACKAGE_TARNAME=@PACKAGE_TARNAME@ | 17 | PACKAGE_TARNAME=@PACKAGE_TARNAME@ |
18 | DOCDIR=@docdir@ | 18 | DOCDIR=@docdir@ |
19 | HAVE_SECCOMP=@HAVE_SECCOMP@ | ||
19 | HAVE_APPARMOR=@HAVE_APPARMOR@ | 20 | HAVE_APPARMOR=@HAVE_APPARMOR@ |
20 | HAVE_CONTRIB_INSTALL=@HAVE_CONTRIB_INSTALL@ | 21 | HAVE_CONTRIB_INSTALL=@HAVE_CONTRIB_INSTALL@ |
21 | HAVE_GIT_INSTALL=@HAVE_GIT_INSTALL@ | 22 | HAVE_GIT_INSTALL=@HAVE_GIT_INSTALL@ |
@@ -39,10 +40,12 @@ $(MANPAGES): $(wildcard src/man/*.txt) | |||
39 | man: $(MANPAGES) | 40 | man: $(MANPAGES) |
40 | 41 | ||
41 | filters: src/fseccomp | 42 | filters: src/fseccomp |
43 | ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | ||
42 | src/fseccomp/fseccomp default seccomp | 44 | src/fseccomp/fseccomp default seccomp |
43 | src/fseccomp/fseccomp default seccomp.debug allow-debuggers | 45 | src/fseccomp/fseccomp default seccomp.debug allow-debuggers |
44 | src/fseccomp/fseccomp secondary 32 seccomp.i386 | 46 | src/fseccomp/fseccomp secondary 32 seccomp.i386 |
45 | src/fseccomp/fseccomp secondary 64 seccomp.amd64 | 47 | src/fseccomp/fseccomp secondary 64 seccomp.amd64 |
48 | endif | ||
46 | 49 | ||
47 | clean: | 50 | clean: |
48 | for dir in $(APPS) $(MYLIBS); do \ | 51 | for dir in $(APPS) $(MYLIBS); do \ |
@@ -87,15 +90,18 @@ ifeq ($(HAVE_GIT_INSTALL),-DHAVE_GIT_INSTALL) | |||
87 | install -c -m 0755 src/fgit/fgit-install.sh $(DESTDIR)/$(libdir)/firejail/. | 90 | install -c -m 0755 src/fgit/fgit-install.sh $(DESTDIR)/$(libdir)/firejail/. |
88 | install -c -m 0755 src/fgit/fgit-uninstall.sh $(DESTDIR)/$(libdir)/firejail/. | 91 | install -c -m 0755 src/fgit/fgit-uninstall.sh $(DESTDIR)/$(libdir)/firejail/. |
89 | endif | 92 | endif |
93 | |||
90 | install -c -m 0644 src/firecfg/firecfg.config $(DESTDIR)/$(libdir)/firejail/. | 94 | install -c -m 0644 src/firecfg/firecfg.config $(DESTDIR)/$(libdir)/firejail/. |
91 | install -c -m 0755 src/faudit/faudit $(DESTDIR)/$(libdir)/firejail/. | 95 | install -c -m 0755 src/faudit/faudit $(DESTDIR)/$(libdir)/firejail/. |
92 | install -c -m 0755 src/fnet/fnet $(DESTDIR)/$(libdir)/firejail/. | 96 | install -c -m 0755 src/fnet/fnet $(DESTDIR)/$(libdir)/firejail/. |
93 | install -c -m 0755 src/fseccomp/fseccomp $(DESTDIR)/$(libdir)/firejail/. | ||
94 | install -c -m 0755 src/fcopy/fcopy $(DESTDIR)/$(libdir)/firejail/. | 97 | install -c -m 0755 src/fcopy/fcopy $(DESTDIR)/$(libdir)/firejail/. |
98 | ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | ||
99 | install -c -m 0755 src/fseccomp/fseccomp $(DESTDIR)/$(libdir)/firejail/. | ||
95 | install -c -m 0644 seccomp $(DESTDIR)/$(libdir)/firejail/. | 100 | install -c -m 0644 seccomp $(DESTDIR)/$(libdir)/firejail/. |
96 | install -c -m 0644 seccomp.debug $(DESTDIR)/$(libdir)/firejail/. | 101 | install -c -m 0644 seccomp.debug $(DESTDIR)/$(libdir)/firejail/. |
97 | install -c -m 0644 seccomp.i386 $(DESTDIR)/$(libdir)/firejail/. | 102 | install -c -m 0644 seccomp.i386 $(DESTDIR)/$(libdir)/firejail/. |
98 | install -c -m 0644 seccomp.amd64 $(DESTDIR)/$(libdir)/firejail/. | 103 | install -c -m 0644 seccomp.amd64 $(DESTDIR)/$(libdir)/firejail/. |
104 | endif | ||
99 | ifeq ($(HAVE_CONTRIB_INSTALL),yes) | 105 | ifeq ($(HAVE_CONTRIB_INSTALL),yes) |
100 | install -c -m 0755 contrib/fix_private-bin.py $(DESTDIR)/$(libdir)/firejail/. | 106 | install -c -m 0755 contrib/fix_private-bin.py $(DESTDIR)/$(libdir)/firejail/. |
101 | install -c -m 0755 contrib/fjclip.py $(DESTDIR)/$(libdir)/firejail/. | 107 | install -c -m 0755 contrib/fjclip.py $(DESTDIR)/$(libdir)/firejail/. |
@@ -240,7 +246,9 @@ test-environment: | |||
240 | cd test/environment; ./environment.sh | grep TESTING | 246 | cd test/environment; ./environment.sh | grep TESTING |
241 | 247 | ||
242 | test-filters: | 248 | test-filters: |
249 | ifeq ($(HAVE_SECCOMP),-DHAVE_SECCOMP) | ||
243 | cd test/filters; ./filters.sh | grep TESTING | 250 | cd test/filters; ./filters.sh | grep TESTING |
251 | endif | ||
244 | 252 | ||
245 | test-arguments: | 253 | test-arguments: |
246 | cd test/arguments; ./arguments.sh | grep TESTING | 254 | cd test/arguments; ./arguments.sh | grep TESTING |
@@ -468,5 +468,6 @@ Zack Weinberg (https://github.com/zackw) | |||
468 | - Xvfb and Xephyr profiles, modified Xpra profile | 468 | - Xvfb and Xephyr profiles, modified Xpra profile |
469 | - support for sandboxing Xpra, Xvfb and Xephyr in independent sandboxes when started | 469 | - support for sandboxing Xpra, Xvfb and Xephyr in independent sandboxes when started |
470 | with firejail --x11 | 470 | with firejail --x11 |
471 | 471 | - support for xpra-extra-params in firejail.config | |
472 | |||
472 | Copyright (C) 2014-2017 Firejail Authors | 473 | Copyright (C) 2014-2017 Firejail Authors |
@@ -62,161 +62,7 @@ Use this issue to request new profiles: https://github.com/netblue30/firejail/is | |||
62 | ````` | 62 | ````` |
63 | 63 | ||
64 | ````` | 64 | ````` |
65 | # Current development version: 0.9.45 | 65 | # Current development version: 0.9.47 |
66 | ````` | ||
67 | |||
68 | ````` | ||
69 | ## Desktop integration | ||
70 | |||
71 | All --fix functionality is done by default in firecfg, --fix option was removed. Clicking on a program | ||
72 | in desktop manager menu should start the program automatically in a sandbox if a profile | ||
73 | is available in /etc/firejail. We cover about 300 different applications in this moment on all major desktop managers. | ||
74 | |||
75 | Symlinks for the common file managers are installed in /usr/local/bin by firecfg. | ||
76 | File managers are usually started by default at login time, and will be sandboxed. | ||
77 | Clicking on a file in the file manager will start the corresponding program in the same sandbox as the file manager. | ||
78 | For example, clicking on a video file will start a sandboxed VLC running the video. | ||
79 | We support in this moment XFCE, LXDE, MATE, Cinnamon and KDE. | ||
80 | |||
81 | ## AppImage | ||
82 | |||
83 | Added AppImage type 2 support, and support for passing command line arguments to appimages. | ||
84 | ````` | ||
85 | |||
86 | ````` | ||
87 | ## X11 sandboxing support | ||
88 | In this release we add support for Xvfb (X virtual framebuffer), an in-memory X display server. | ||
89 | Xvfb allows the user to run graphical applications without a display (e.g., browser tests on a CI server) | ||
90 | while also having the ability to take screenshots. | ||
91 | |||
92 | |||
93 | --x11=xvfb | ||
94 | Start Xvfb X11 server and attach the sandbox to this server. | ||
95 | Xvfb, short for X virtual framebuffer, performs all graphical | ||
96 | operations in memory without showing any screen output. Xvfb is | ||
97 | mainly used for remote access and software testing on headless | ||
98 | servers. | ||
99 | 66 | ||
100 | On Debian platforms Xvfb is installed with the command sudo apt- | 67 | Upcoming release 0.9.46 was moved on 0.9.46-bugfixes branch: https://github.com/netblue30/firejail/tree/0.9.46-bugfixes |
101 | get install xvfb. This feature is not available when running as | ||
102 | root. | ||
103 | 68 | ||
104 | Example: remote VNC access | ||
105 | |||
106 | On the server we start a sandbox using Xvfb and openbox window | ||
107 | manager. The default size of Xvfb screen is 800x600 - it can be | ||
108 | changed in /etc/firejail/firejail.config (xvfb-screen). Some | ||
109 | sort of networking (--net) is required in order to isolate the | ||
110 | abstract sockets used by other X servers. | ||
111 | |||
112 | $ firejail --net=none --x11=xvfb openbox | ||
113 | |||
114 | *** Attaching to Xvfb display 792 *** | ||
115 | |||
116 | Reading profile /etc/firejail/openbox.profile | ||
117 | Reading profile /etc/firejail/disable-common.inc | ||
118 | Reading profile /etc/firejail/disable-common.local | ||
119 | Parent pid 5400, child pid 5401 | ||
120 | |||
121 | On the server we also start a VNC server and attach it to the | ||
122 | display handled by our Xvfb server (792). | ||
123 | |||
124 | $ x11vnc -display :792 | ||
125 | |||
126 | On the client machine we start a VNC viewer and use it to con‐ | ||
127 | nect to our server: | ||
128 | |||
129 | $ vncviewer | ||
130 | |||
131 | |||
132 | ## New command line options | ||
133 | ````` | ||
134 | --private-opt=file,directory | ||
135 | Build a new /opt in a temporary filesystem, and copy the files | ||
136 | and directories in the list. If no listed file is found, /opt | ||
137 | directory will be empty. All modifications are discarded when | ||
138 | the sandbox is closed. | ||
139 | |||
140 | Example: | ||
141 | $ firejail --private-opt=firefox /opt/firefox/firefox | ||
142 | |||
143 | --private-srv=file,directory | ||
144 | Build a new /srv in a temporary filesystem, and copy the files | ||
145 | and directories in the list. If no listed file is found, /srv | ||
146 | directory will be empty. All modifications are discarded when | ||
147 | the sandbox is closed. | ||
148 | |||
149 | Example: | ||
150 | # firejail --private-srv=www /etc/init.d/apache2 start | ||
151 | |||
152 | --machine-id | ||
153 | Spoof id number in /etc/machine-id file - a new random id is | ||
154 | generated inside the sandbox. | ||
155 | |||
156 | Example: | ||
157 | $ firejail --machine-id | ||
158 | |||
159 | --allow-private-blacklist | ||
160 | Allow blacklisting files in private home directory. By default | ||
161 | these blacklists are disabled. | ||
162 | |||
163 | Example: | ||
164 | $ firejail --allow-private-blacklist --private=~/priv-dir | ||
165 | --blacklist=~/.mozilla | ||
166 | |||
167 | --hosts-file=file | ||
168 | Use file as /etc/hosts. | ||
169 | |||
170 | Example: | ||
171 | $ firejail --hosts-file=~/myhosts firefox | ||
172 | |||
173 | --writable-var-log | ||
174 | Use the real /var/log directory, not a clone. By default, a | ||
175 | tmpfs is mounted on top of /var/log directory, and a skeleton | ||
176 | filesystem is created based on the original /var/log. | ||
177 | |||
178 | Example: | ||
179 | $ sudo firejail --writable-var-log | ||
180 | |||
181 | --git-install | ||
182 | Download, compile and install mainline git version of Firejail | ||
183 | from the official repository on GitHub. The software is | ||
184 | installed in /usr/local/bin, and takes precedence over the (old) | ||
185 | version installed in /usr/bin. If for any reason the new version | ||
186 | doesn't work, the user can uninstall it using --git-uninstall | ||
187 | command and revert to the old version. | ||
188 | |||
189 | Prerequisites: git and compile support are required for this com‐ | ||
190 | mand to work. On Debian/Ubuntu systems this support is installed | ||
191 | using "sudo apt-get install build-essential git". | ||
192 | |||
193 | Example: | ||
194 | |||
195 | $ firejail --git-install | ||
196 | |||
197 | --git-uninstall | ||
198 | Remove the Firejail version previously installed in | ||
199 | /usr/local/bin using --git-install command. | ||
200 | |||
201 | Example: | ||
202 | |||
203 | $ firejail --git-uninstall | ||
204 | |||
205 | |||
206 | --nowhitelist=dirname_or_filename | ||
207 | Disable whitelist for this directory or file. | ||
208 | |||
209 | ````` | ||
210 | ## New Profiles | ||
211 | xiphos, Tor Browser Bundle, display (imagemagik), Wire, mumble, zoom, Guayadeque, qemu, keypass2, | ||
212 | amarok, ark, atool, bleachbit, brasero, dolphin, dragon, elinks, enchant, exiftool, file-roller, gedit, | ||
213 | gjs, gnome-books, gnome-clocks, gnome-documents, gnome-maps, gnome-music, gnome-photos, gnome-weather, | ||
214 | goobox, gpa, gpg, gpg-agent, highlight, img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, | ||
215 | simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget, | ||
216 | xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5, | ||
217 | PDFSam, Pithos, Xonotic, wireshark, keepassx2, QupZilla, FossaMail, Uzbl browser, xmms, iridium browser, | ||
218 | Kino, Thunar, Geeqie, Engrampa, Scribus, mousepad, gpicview, keepassxc, cvlc, MediathekView, baloo_file, | ||
219 | Nylas, dino, BibleTime, viewnior, Kodi, viking, youtube-dl, meld, Arduino, Akregator, KCalc, KTorrent, | ||
220 | Orage Globaltime, Orage Clendar, xfce4-notes, xfce4-dict, Ristretto, PCManFM, Dia, FontForge, Geany, Hugin, | ||
221 | mate-calc, mate-dictionary, mate-color-select, caja, galculator, Nemo, gnome-font-viewer, gucharmap, | ||
222 | knotes, clipit, leafpad, lximage-qt, lxmusic, qlipper, Xvfb, Xephyr, Blender, 2048-qt | ||
@@ -1,5 +1,4 @@ | |||
1 | firejail (0.9.46-rc1) baseline; urgency=low | 1 | firejail (0.9.46) baseline; urgency=low |
2 | * development version, work in progress | ||
3 | * security: split most of networking code in a separate executable | 2 | * security: split most of networking code in a separate executable |
4 | * security: split seccomp filter code configuration in a separate executable | 3 | * security: split seccomp filter code configuration in a separate executable |
5 | * security: split file copying in private option in a separate executable | 4 | * security: split file copying in private option in a separate executable |
@@ -34,6 +33,8 @@ firejail (0.9.46-rc1) baseline; urgency=low | |||
34 | * feature: --fix-sound support in firecfg | 33 | * feature: --fix-sound support in firecfg |
35 | * feature: added support for sandboxing Xpra, Xvfb and Xephyr in | 34 | * feature: added support for sandboxing Xpra, Xvfb and Xephyr in |
36 | independent sandboxes when started with firejail --x11 | 35 | independent sandboxes when started with firejail --x11 |
36 | * feature: enable automatic X server sandboxing for --x11=xpra | ||
37 | and --x11=xephyr | ||
37 | * feature: support for Xpra extra params in firejail config file | 38 | * feature: support for Xpra extra params in firejail config file |
38 | * new profiles: xiphos, Tor Browser Bundle, display (imagemagick), Wire, | 39 | * new profiles: xiphos, Tor Browser Bundle, display (imagemagick), Wire, |
39 | * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma, | 40 | * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma, |
@@ -51,7 +52,7 @@ firejail (0.9.46-rc1) baseline; urgency=low | |||
51 | * new profiles: clipit, leafpad, lximage-qt, lxmusic, qlipper, Xvfb, Xephyr | 52 | * new profiles: clipit, leafpad, lximage-qt, lxmusic, qlipper, Xvfb, Xephyr |
52 | * new profiles: Blender, 2048-qt | 53 | * new profiles: Blender, 2048-qt |
53 | * bugfixes | 54 | * bugfixes |
54 | -- netblue30 <netblue30@yahoo.com> Fri, 7 Apr 2017 08:00:00 -0500 | 55 | -- netblue30 <netblue30@yahoo.com> Sun, 14 May 2017 08:00:00 -0500 |
55 | 56 | ||
56 | firejail (0.9.44.10) baseline; urgency=low | 57 | firejail (0.9.44.10) baseline; urgency=low |
57 | * security: when using --x11=xorg and --net, incorrect processing of | 58 | * security: when using --x11=xorg and --net, incorrect processing of |
@@ -1,6 +1,6 @@ | |||
1 | #! /bin/sh | 1 | #! /bin/sh |
2 | # Guess values for system-dependent variables and create Makefiles. | 2 | # Guess values for system-dependent variables and create Makefiles. |
3 | # Generated by GNU Autoconf 2.69 for firejail 0.9.46~rc1. | 3 | # Generated by GNU Autoconf 2.69 for firejail 0.9.47. |
4 | # | 4 | # |
5 | # Report bugs to <netblue30@yahoo.com>. | 5 | # Report bugs to <netblue30@yahoo.com>. |
6 | # | 6 | # |
@@ -580,8 +580,8 @@ MAKEFLAGS= | |||
580 | # Identity of this package. | 580 | # Identity of this package. |
581 | PACKAGE_NAME='firejail' | 581 | PACKAGE_NAME='firejail' |
582 | PACKAGE_TARNAME='firejail' | 582 | PACKAGE_TARNAME='firejail' |
583 | PACKAGE_VERSION='0.9.46~rc1' | 583 | PACKAGE_VERSION='0.9.47' |
584 | PACKAGE_STRING='firejail 0.9.46~rc1' | 584 | PACKAGE_STRING='firejail 0.9.47' |
585 | PACKAGE_BUGREPORT='netblue30@yahoo.com' | 585 | PACKAGE_BUGREPORT='netblue30@yahoo.com' |
586 | PACKAGE_URL='http://firejail.wordpress.com' | 586 | PACKAGE_URL='http://firejail.wordpress.com' |
587 | 587 | ||
@@ -1265,7 +1265,7 @@ if test "$ac_init_help" = "long"; then | |||
1265 | # Omit some internal or obsolete options to make the list less imposing. | 1265 | # Omit some internal or obsolete options to make the list less imposing. |
1266 | # This message is too long to be a string in the A/UX 3.1 sh. | 1266 | # This message is too long to be a string in the A/UX 3.1 sh. |
1267 | cat <<_ACEOF | 1267 | cat <<_ACEOF |
1268 | \`configure' configures firejail 0.9.46~rc1 to adapt to many kinds of systems. | 1268 | \`configure' configures firejail 0.9.47 to adapt to many kinds of systems. |
1269 | 1269 | ||
1270 | Usage: $0 [OPTION]... [VAR=VALUE]... | 1270 | Usage: $0 [OPTION]... [VAR=VALUE]... |
1271 | 1271 | ||
@@ -1326,7 +1326,7 @@ fi | |||
1326 | 1326 | ||
1327 | if test -n "$ac_init_help"; then | 1327 | if test -n "$ac_init_help"; then |
1328 | case $ac_init_help in | 1328 | case $ac_init_help in |
1329 | short | recursive ) echo "Configuration of firejail 0.9.46~rc1:";; | 1329 | short | recursive ) echo "Configuration of firejail 0.9.47:";; |
1330 | esac | 1330 | esac |
1331 | cat <<\_ACEOF | 1331 | cat <<\_ACEOF |
1332 | 1332 | ||
@@ -1434,7 +1434,7 @@ fi | |||
1434 | test -n "$ac_init_help" && exit $ac_status | 1434 | test -n "$ac_init_help" && exit $ac_status |
1435 | if $ac_init_version; then | 1435 | if $ac_init_version; then |
1436 | cat <<\_ACEOF | 1436 | cat <<\_ACEOF |
1437 | firejail configure 0.9.46~rc1 | 1437 | firejail configure 0.9.47 |
1438 | generated by GNU Autoconf 2.69 | 1438 | generated by GNU Autoconf 2.69 |
1439 | 1439 | ||
1440 | Copyright (C) 2012 Free Software Foundation, Inc. | 1440 | Copyright (C) 2012 Free Software Foundation, Inc. |
@@ -1736,7 +1736,7 @@ cat >config.log <<_ACEOF | |||
1736 | This file contains any messages produced by compilers while | 1736 | This file contains any messages produced by compilers while |
1737 | running configure, to aid debugging if configure makes a mistake. | 1737 | running configure, to aid debugging if configure makes a mistake. |
1738 | 1738 | ||
1739 | It was created by firejail $as_me 0.9.46~rc1, which was | 1739 | It was created by firejail $as_me 0.9.47, which was |
1740 | generated by GNU Autoconf 2.69. Invocation command line was | 1740 | generated by GNU Autoconf 2.69. Invocation command line was |
1741 | 1741 | ||
1742 | $ $0 $@ | 1742 | $ $0 $@ |
@@ -4355,7 +4355,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 | |||
4355 | # report actual input values of CONFIG_FILES etc. instead of their | 4355 | # report actual input values of CONFIG_FILES etc. instead of their |
4356 | # values after options handling. | 4356 | # values after options handling. |
4357 | ac_log=" | 4357 | ac_log=" |
4358 | This file was extended by firejail $as_me 0.9.46~rc1, which was | 4358 | This file was extended by firejail $as_me 0.9.47, which was |
4359 | generated by GNU Autoconf 2.69. Invocation command line was | 4359 | generated by GNU Autoconf 2.69. Invocation command line was |
4360 | 4360 | ||
4361 | CONFIG_FILES = $CONFIG_FILES | 4361 | CONFIG_FILES = $CONFIG_FILES |
@@ -4409,7 +4409,7 @@ _ACEOF | |||
4409 | cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 | 4409 | cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 |
4410 | ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" | 4410 | ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" |
4411 | ac_cs_version="\\ | 4411 | ac_cs_version="\\ |
4412 | firejail config.status 0.9.46~rc1 | 4412 | firejail config.status 0.9.47 |
4413 | configured by $0, generated by GNU Autoconf 2.69, | 4413 | configured by $0, generated by GNU Autoconf 2.69, |
4414 | with options \\"\$ac_cs_config\\" | 4414 | with options \\"\$ac_cs_config\\" |
4415 | 4415 | ||
diff --git a/configure.ac b/configure.ac index c6048ca61..594a7abf8 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -1,5 +1,5 @@ | |||
1 | AC_PREREQ([2.68]) | 1 | AC_PREREQ([2.68]) |
2 | AC_INIT(firejail, 0.9.46~rc1, netblue30@yahoo.com, , http://firejail.wordpress.com) | 2 | AC_INIT(firejail, 0.9.47, netblue30@yahoo.com, , http://firejail.wordpress.com) |
3 | AC_CONFIG_SRCDIR([src/firejail/main.c]) | 3 | AC_CONFIG_SRCDIR([src/firejail/main.c]) |
4 | #AC_CONFIG_HEADERS([config.h]) | 4 | #AC_CONFIG_HEADERS([config.h]) |
5 | 5 | ||
diff --git a/etc/Xephyr.profile b/etc/Xephyr.profile index 362318bb1..d3349f7f7 100644 --- a/etc/Xephyr.profile +++ b/etc/Xephyr.profile | |||
@@ -4,13 +4,11 @@ include /etc/firejail/Xephyr.local | |||
4 | 4 | ||
5 | # | 5 | # |
6 | # This profile will sandbox Xephyr server itself when used with firejail --x11=xephyr. | 6 | # This profile will sandbox Xephyr server itself when used with firejail --x11=xephyr. |
7 | # The target program is sandboxed with its own profile. By default the this functionality | 7 | # To enable it, create a firejail-Xephyr symlink in /usr/local/bin: |
8 | # is disabled. To enable it, create a firejail-Xephyr symlink in /usr/local/bin: | ||
9 | # | 8 | # |
10 | # $ sudo ln -s /usr/bin/firejail /usr/local/bin/Xephyr | 9 | # $ sudo ln -s /usr/bin/firejail /usr/local/bin/Xephyr |
11 | # | 10 | # |
12 | # We have this functionality disabled by default because it creates problems on | 11 | # or run "sudo firecfg" |
13 | # some Linux distributions. | ||
14 | # | 12 | # |
15 | 13 | ||
16 | 14 | ||
diff --git a/etc/Xvfb.profile b/etc/Xvfb.profile index 9c919f432..0cf9b7e1c 100644 --- a/etc/Xvfb.profile +++ b/etc/Xvfb.profile | |||
@@ -10,7 +10,7 @@ include /etc/firejail/xvfb.local | |||
10 | # $ sudo ln -s /usr/bin/firejail /usr/local/bin/Xvfb | 10 | # $ sudo ln -s /usr/bin/firejail /usr/local/bin/Xvfb |
11 | # | 11 | # |
12 | # We have this functionality disabled by default because it creates problems on | 12 | # We have this functionality disabled by default because it creates problems on |
13 | # some Linux distributions. | 13 | # some Linux distributions. Also, older versions of Xpra use Xvfb. |
14 | # | 14 | # |
15 | 15 | ||
16 | 16 | ||
diff --git a/etc/vlc.profile b/etc/vlc.profile index 5d759ffd4..d32fa7cf7 100644 --- a/etc/vlc.profile +++ b/etc/vlc.profile | |||
@@ -11,7 +11,7 @@ include /etc/firejail/disable-devel.inc | |||
11 | include /etc/firejail/disable-passwdmgr.inc | 11 | include /etc/firejail/disable-passwdmgr.inc |
12 | 12 | ||
13 | caps.drop all | 13 | caps.drop all |
14 | ipc-namespace | 14 | #ipc-namespace |
15 | netfilter | 15 | netfilter |
16 | # nogroups | 16 | # nogroups |
17 | nonewprivs | 17 | nonewprivs |
diff --git a/etc/xpra.profile b/etc/xpra.profile index f4f28f9de..11bfec7eb 100644 --- a/etc/xpra.profile +++ b/etc/xpra.profile | |||
@@ -5,14 +5,11 @@ include /etc/firejail/xpra.local | |||
5 | 5 | ||
6 | # | 6 | # |
7 | # This profile will sandbox Xpra server itself when used with firejail --x11=xpra. | 7 | # This profile will sandbox Xpra server itself when used with firejail --x11=xpra. |
8 | # The target program is sandboxed with its own profile. By default the this functionality | 8 | # To enable it, create a firejail-xpra symlink in /usr/local/bin: |
9 | # is disabled. To enable it, create a firejail-xpra symlink in /usr/local/bin: | ||
10 | # | 9 | # |
11 | # $ sudo ln -s /usr/bin/firejail /usr/local/bin/xpra | 10 | # $ sudo ln -s /usr/bin/firejail /usr/local/bin/xpra |
12 | # | 11 | # |
13 | # We have this functionality disabled by default because it creates problems on | 12 | # or run "sudo firecfg" |
14 | # some Linux distributions. | ||
15 | # | ||
16 | 13 | ||
17 | # private home directory doesn't work on some distros, so we go for a regular home | 14 | # private home directory doesn't work on some distros, so we go for a regular home |
18 | #private | 15 | #private |
@@ -36,6 +33,7 @@ protocol unix | |||
36 | 33 | ||
37 | private-dev | 34 | private-dev |
38 | private-tmp | 35 | private-tmp |
36 | # older Xpra versions also use Xvfb | ||
39 | #private-bin xpra,python,Xvfb,Xorg,sh,xkbcomp,xauth,dbus-launch,pactl,ldconfig,which,strace,bash,cat,ls | 37 | #private-bin xpra,python,Xvfb,Xorg,sh,xkbcomp,xauth,dbus-launch,pactl,ldconfig,which,strace,bash,cat,ls |
40 | #private-etc ld.so.conf,ld.so.cache,resolv.conf,host.conf,nsswitch.conf,gai.conf,hosts,hostname,machine-id,xpra,X11 | 38 | #private-etc ld.so.conf,ld.so.cache,resolv.conf,host.conf,nsswitch.conf,gai.conf,hosts,hostname,machine-id,xpra,X11 |
41 | 39 | ||
diff --git a/platform/debian/conffiles b/platform/debian/conffiles index b9eadb9fc..965f18501 100644 --- a/platform/debian/conffiles +++ b/platform/debian/conffiles | |||
@@ -301,4 +301,3 @@ | |||
301 | /etc/firejail/blender.profile | 301 | /etc/firejail/blender.profile |
302 | /etc/firejail/2048-qt.profile | 302 | /etc/firejail/2048-qt.profile |
303 | /etc/firejail/gimp-2.8.profile | 303 | /etc/firejail/gimp-2.8.profile |
304 | |||
diff --git a/platform/debian/control b/platform/debian/control index 4287d6561..4161cbfb2 100644 --- a/platform/debian/control +++ b/platform/debian/control | |||
@@ -2,7 +2,7 @@ Package: firejail | |||
2 | Version: FIREJAILVER-1 | 2 | Version: FIREJAILVER-1 |
3 | Architecture: amd64 | 3 | Architecture: amd64 |
4 | Maintainer: netblue30 <netblue30@yahoo.com> | 4 | Maintainer: netblue30 <netblue30@yahoo.com> |
5 | Installed-Size: 272 | 5 | Installed-Size: 2024 |
6 | Depends: libc6 | 6 | Depends: libc6 |
7 | Suggests: python, python3 | 7 | Suggests: python, python3 |
8 | Section: admin | 8 | Section: admin |
diff --git a/platform/rpm/old-mkrpm.sh b/platform/rpm/old-mkrpm.sh index 46a2c613d..78e93507c 100755 --- a/platform/rpm/old-mkrpm.sh +++ b/platform/rpm/old-mkrpm.sh | |||
@@ -1,5 +1,5 @@ | |||
1 | #!/bin/bash | 1 | #!/bin/bash |
2 | VERSION="0.9.46~rc1" | 2 | VERSION="0.9.46" |
3 | rm -fr ~/rpmbuild | 3 | rm -fr ~/rpmbuild |
4 | rm -f firejail-$VERSION-1.x86_64.rpm | 4 | rm -f firejail-$VERSION-1.x86_64.rpm |
5 | 5 | ||
@@ -366,6 +366,50 @@ rm -rf %{buildroot} | |||
366 | %{_sysconfdir}/%{name}/xonotic.profile | 366 | %{_sysconfdir}/%{name}/xonotic.profile |
367 | %{_sysconfdir}/%{name}/xpra.profile | 367 | %{_sysconfdir}/%{name}/xpra.profile |
368 | %{_sysconfdir}/%{name}/zoom.profile | 368 | %{_sysconfdir}/%{name}/zoom.profile |
369 | %{_sysconfdir}/%{name}/2048-qt.profile | ||
370 | %{_sysconfdir}/%{name}/Xephyr.profile | ||
371 | %{_sysconfdir}/%{name}/Xvfb.profile | ||
372 | %{_sysconfdir}/%{name}/akregator.profile | ||
373 | %{_sysconfdir}/%{name}/arduino.profile | ||
374 | %{_sysconfdir}/%{name}/baloo_file.profile | ||
375 | %{_sysconfdir}/%{name}/bibletime.profile | ||
376 | %{_sysconfdir}/%{name}/blender.profile | ||
377 | %{_sysconfdir}/%{name}/caja.profile | ||
378 | %{_sysconfdir}/%{name}/clipit.profile | ||
379 | %{_sysconfdir}/%{name}/dia.profile | ||
380 | %{_sysconfdir}/%{name}/dino.profile | ||
381 | %{_sysconfdir}/%{name}/fontforge.profile | ||
382 | %{_sysconfdir}/%{name}/galculator.profile | ||
383 | %{_sysconfdir}/%{name}/geany.profile | ||
384 | %{_sysconfdir}/%{name}/gimp-2.8.profile | ||
385 | %{_sysconfdir}/%{name}/globaltime.profile | ||
386 | %{_sysconfdir}/%{name}/gnome-font-viewer.profile | ||
387 | %{_sysconfdir}/%{name}/gucharmap.profile | ||
388 | %{_sysconfdir}/%{name}/hugin.profile | ||
389 | %{_sysconfdir}/%{name}/kcalc.profile | ||
390 | %{_sysconfdir}/%{name}/knotes.profile | ||
391 | %{_sysconfdir}/%{name}/kodi.profile | ||
392 | %{_sysconfdir}/%{name}/ktorrent.profile | ||
393 | %{_sysconfdir}/%{name}/leafpad.profile | ||
394 | %{_sysconfdir}/%{name}/lximage-qt.profile | ||
395 | %{_sysconfdir}/%{name}/lxmusic.profile | ||
396 | %{_sysconfdir}/%{name}/mate-calc.profile | ||
397 | %{_sysconfdir}/%{name}/mate-calculator.profile | ||
398 | %{_sysconfdir}/%{name}/mate-color-select.profile | ||
399 | %{_sysconfdir}/%{name}/mate-dictionary.profile | ||
400 | %{_sysconfdir}/%{name}/meld.profile | ||
401 | %{_sysconfdir}/%{name}/nemo.profile | ||
402 | %{_sysconfdir}/%{name}/nylas.profile | ||
403 | %{_sysconfdir}/%{name}/orage.profile | ||
404 | %{_sysconfdir}/%{name}/pcmanfm.profile | ||
405 | %{_sysconfdir}/%{name}/qlipper.profile | ||
406 | %{_sysconfdir}/%{name}/ristretto.profile | ||
407 | %{_sysconfdir}/%{name}/viewnior.profile | ||
408 | %{_sysconfdir}/%{name}/viking.profile | ||
409 | %{_sysconfdir}/%{name}/xfce4-dict.profile | ||
410 | %{_sysconfdir}/%{name}/xfce4-notes.profile | ||
411 | %{_sysconfdir}/%{name}/youtube-dl.profile | ||
412 | |||
369 | 413 | ||
370 | /usr/bin/firejail | 414 | /usr/bin/firejail |
371 | /usr/bin/firemon | 415 | /usr/bin/firemon |
@@ -407,7 +451,7 @@ rm -rf %{buildroot} | |||
407 | chmod u+s /usr/bin/firejail | 451 | chmod u+s /usr/bin/firejail |
408 | 452 | ||
409 | %changelog | 453 | %changelog |
410 | * Fri Apr 7 2017 netblue30 <netblue30@yahoo.com> 0.9.46~rc1 | 454 | * Mon May 15 2017 netblue30 <netblue30@yahoo.com> 0.9.46-1 |
411 | 455 | ||
412 | * Fri Oct 21 2016 netblue30 <netblue30@yahoo.com> 0.9.44-1 | 456 | * Fri Oct 21 2016 netblue30 <netblue30@yahoo.com> 0.9.44-1 |
413 | - CVE-2016-7545 submitted by Aleksey Manevich | 457 | - CVE-2016-7545 submitted by Aleksey Manevich |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 60e414755..f46fdea35 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -230,6 +230,7 @@ wire | |||
230 | wireshark | 230 | wireshark |
231 | xchat | 231 | xchat |
232 | xed | 232 | xed |
233 | Xephyr | ||
233 | xfburn | 234 | xfburn |
234 | xfce4-dict | 235 | xfce4-dict |
235 | xfce4-notes | 236 | xfce4-notes |
@@ -239,6 +240,7 @@ xonotic-glx | |||
239 | xonotic-sdl | 240 | xonotic-sdl |
240 | xpdf | 241 | xpdf |
241 | xplayer | 242 | xplayer |
243 | xpra | ||
242 | xreader | 244 | xreader |
243 | xviewer | 245 | xviewer |
244 | youtube-dl | 246 | youtube-dl |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 9e5c31c32..86ca422ae 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -2174,7 +2174,7 @@ int main(int argc, char **argv) { | |||
2174 | 2174 | ||
2175 | // prog_index could still be -1 if no program was specified | 2175 | // prog_index could still be -1 if no program was specified |
2176 | if (prog_index == -1 && arg_shell_none) { | 2176 | if (prog_index == -1 && arg_shell_none) { |
2177 | fprintf(stderr, "shell=none configured, but no program specified\n"); | 2177 | fprintf(stderr, "Error: shell=none configured, but no program specified\n"); |
2178 | exit(1); | 2178 | exit(1); |
2179 | } | 2179 | } |
2180 | 2180 | ||
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c index 9221aaa99..05f5abe2a 100644 --- a/src/firejail/no_sandbox.c +++ b/src/firejail/no_sandbox.c | |||
@@ -230,8 +230,5 @@ void run_no_sandbox(int argc, char **argv) { | |||
230 | 230 | ||
231 | arg_quiet = 1; | 231 | arg_quiet = 1; |
232 | 232 | ||
233 | // we don't want to run a shell, otherwise it will be recursively | ||
234 | arg_shell_none = 1; | ||
235 | |||
236 | start_application(); | 233 | start_application(); |
237 | } | 234 | } |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index c515accc0..9ae2aa5b4 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -1089,12 +1089,8 @@ void profile_read(const char *fname) { | |||
1089 | } | 1089 | } |
1090 | 1090 | ||
1091 | // check file | 1091 | // check file |
1092 | if (strlen(fname) == 0) { | ||
1093 | fprintf(stderr, "Error: invalid profile file\n"); | ||
1094 | exit(1); | ||
1095 | } | ||
1096 | invalid_filename(fname); | 1092 | invalid_filename(fname); |
1097 | if (is_dir(fname) || is_link(fname) || strstr(fname, "..")) { | 1093 | if (strlen(fname) == 0 || is_dir(fname)) { |
1098 | fprintf(stderr, "Error: invalid profile file\n"); | 1094 | fprintf(stderr, "Error: invalid profile file\n"); |
1099 | exit(1); | 1095 | exit(1); |
1100 | } | 1096 | } |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index d8880b924..3ff104d26 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -43,7 +43,7 @@ | |||
43 | #ifdef HAVE_APPARMOR | 43 | #ifdef HAVE_APPARMOR |
44 | #include <sys/apparmor.h> | 44 | #include <sys/apparmor.h> |
45 | #endif | 45 | #endif |
46 | 46 | #include <syscall.h> | |
47 | 47 | ||
48 | static int monitored_pid = 0; | 48 | static int monitored_pid = 0; |
49 | static void sandbox_handler(int sig){ | 49 | static void sandbox_handler(int sig){ |
@@ -907,7 +907,7 @@ int sandbox(void* sandbox_arg) { | |||
907 | // set seccomp //todo: push it down after drop_privs and/or configuring noroot | 907 | // set seccomp //todo: push it down after drop_privs and/or configuring noroot |
908 | #ifdef HAVE_SECCOMP | 908 | #ifdef HAVE_SECCOMP |
909 | // install protocol filter | 909 | // install protocol filter |
910 | #ifdef SYS_SOCKET | 910 | #ifdef SYS_socket |
911 | if (cfg.protocol) { | 911 | if (cfg.protocol) { |
912 | if (arg_debug) | 912 | if (arg_debug) |
913 | printf("Install protocol filter: %s\n", cfg.protocol); | 913 | printf("Install protocol filter: %s\n", cfg.protocol); |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index 0f7ea56b6..f1d45adef 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -568,6 +568,7 @@ void x11_start_xephyr(int argc, char **argv) { | |||
568 | (void) rv; | 568 | (void) rv; |
569 | } | 569 | } |
570 | 570 | ||
571 | assert(display_str); | ||
571 | setenv("DISPLAY", display_str, 1); | 572 | setenv("DISPLAY", display_str, 1); |
572 | // run attach command | 573 | // run attach command |
573 | jail = fork(); | 574 | jail = fork(); |
@@ -785,6 +786,7 @@ void x11_start_xpra(int argc, char **argv) { | |||
785 | _exit(1); | 786 | _exit(1); |
786 | } | 787 | } |
787 | 788 | ||
789 | assert(display_str); | ||
788 | setenv("DISPLAY", display_str, 1); | 790 | setenv("DISPLAY", display_str, 1); |
789 | 791 | ||
790 | // build jail command | 792 | // build jail command |
@@ -798,7 +800,7 @@ void x11_start_xpra(int argc, char **argv) { | |||
798 | } | 800 | } |
799 | firejail_argv[pos] = NULL; | 801 | firejail_argv[pos] = NULL; |
800 | 802 | ||
801 | assert(pos < (argc+2)); | 803 | assert((int) pos < (argc+2)); |
802 | assert(!firejail_argv[pos]); | 804 | assert(!firejail_argv[pos]); |
803 | 805 | ||
804 | // start jail | 806 | // start jail |
diff --git a/src/fseccomp/protocol.c b/src/fseccomp/protocol.c index 57ce2f8e0..4a0fadb3c 100644 --- a/src/fseccomp/protocol.c +++ b/src/fseccomp/protocol.c | |||
@@ -60,6 +60,7 @@ static char *protocol[] = { | |||
60 | NULL | 60 | NULL |
61 | }; | 61 | }; |
62 | 62 | ||
63 | #ifdef SYS_socket | ||
63 | static struct sock_filter protocol_filter_command[] = { | 64 | static struct sock_filter protocol_filter_command[] = { |
64 | WHITELIST(AF_UNIX), | 65 | WHITELIST(AF_UNIX), |
65 | WHITELIST(AF_INET), | 66 | WHITELIST(AF_INET), |
@@ -67,6 +68,7 @@ static struct sock_filter protocol_filter_command[] = { | |||
67 | WHITELIST(AF_NETLINK), | 68 | WHITELIST(AF_NETLINK), |
68 | WHITELIST(AF_PACKET) | 69 | WHITELIST(AF_PACKET) |
69 | }; | 70 | }; |
71 | #endif | ||
70 | // Note: protocol[] and protocol_filter_command are synchronized | 72 | // Note: protocol[] and protocol_filter_command are synchronized |
71 | 73 | ||
72 | // command length | 74 | // command length |
@@ -75,6 +77,7 @@ struct sock_filter whitelist[] = { | |||
75 | }; | 77 | }; |
76 | unsigned whitelist_len = sizeof(whitelist) / sizeof(struct sock_filter); | 78 | unsigned whitelist_len = sizeof(whitelist) / sizeof(struct sock_filter); |
77 | 79 | ||
80 | #ifdef SYS_socket | ||
78 | static struct sock_filter *find_protocol_domain(const char *p) { | 81 | static struct sock_filter *find_protocol_domain(const char *p) { |
79 | int i = 0; | 82 | int i = 0; |
80 | while (protocol[i] != NULL) { | 83 | while (protocol[i] != NULL) { |
@@ -85,7 +88,7 @@ static struct sock_filter *find_protocol_domain(const char *p) { | |||
85 | 88 | ||
86 | return NULL; | 89 | return NULL; |
87 | } | 90 | } |
88 | 91 | #endif | |
89 | 92 | ||
90 | void protocol_print(void) { | 93 | void protocol_print(void) { |
91 | #ifndef SYS_socket | 94 | #ifndef SYS_socket |
diff --git a/src/man/firecfg.txt b/src/man/firecfg.txt index 979d4fc06..55b60dcac 100644 --- a/src/man/firecfg.txt +++ b/src/man/firecfg.txt | |||
@@ -20,16 +20,14 @@ The integration covers: | |||
20 | .br | 20 | .br |
21 | 21 | ||
22 | .br | 22 | .br |
23 | - programs started by clicking on file icons in file manager - only Cinnamon, KDE, LXDE, MATE and XFCE | 23 | - programs started by clicking on file icons in file manager - only Cinnamon, KDE, LXDE/LXQT, MATE and XFCE |
24 | desktop managers are supported in this moment | 24 | desktop managers are supported in this moment |
25 | .RE | 25 | .RE |
26 | 26 | ||
27 | This brings us as very close to full desktop integration. | 27 | To set it up, run "sudo firecfg" after installing Firejail software. |
28 | 28 | The same command should also be run after | |
29 | To set it up, run "sudo firecfg" after installing | 29 | installing new programs. If the program is supported by Firejail, the symbolic link in /usr/local/bin |
30 | Firejail software, and logout/login for the integration to take effect. "sudo firecfg" should also be run after | 30 | will be created. For a full list of programs supported by default run "cat /usr/lib/firejail/firecfg.config". |
31 | you install new programs. If the program is supported by Firejail, the symbolic link in /usr/local/bin | ||
32 | will be created. For a list of programs supported by default run "ls /etc/firejail". | ||
33 | 31 | ||
34 | For user-driven manual integration, see \fBDESKTOP INTEGRATION\fR section in \fBman 1 firejail\fR. | 32 | For user-driven manual integration, see \fBDESKTOP INTEGRATION\fR section in \fBman 1 firejail\fR. |
35 | 33 | ||
diff --git a/test/arguments/arguments.sh b/test/arguments/arguments.sh index d9b7058bf..73e589876 100755 --- a/test/arguments/arguments.sh +++ b/test/arguments/arguments.sh | |||
@@ -6,6 +6,7 @@ if [ -f /etc/debian_version ]; then | |||
6 | else | 6 | else |
7 | export PATH="$PATH:/usr/lib/firejail" | 7 | export PATH="$PATH:/usr/lib/firejail" |
8 | fi | 8 | fi |
9 | export PATH="$PATH:/usr/lib/firejail" | ||
9 | 10 | ||
10 | echo "TESTING: 1. regular bash session" | 11 | echo "TESTING: 1. regular bash session" |
11 | ./bashrun.exp | 12 | ./bashrun.exp |
diff --git a/test/environment/allow-debuggers.exp b/test/environment/allow-debuggers.exp index 8a404decb..f032e1c3e 100755 --- a/test/environment/allow-debuggers.exp +++ b/test/environment/allow-debuggers.exp | |||
@@ -8,7 +8,8 @@ match_max 100000 | |||
8 | send -- "firejail --profile=/etc/firejail/firefox.profile --allow-debuggers strace ls\r" | 8 | send -- "firejail --profile=/etc/firejail/firefox.profile --allow-debuggers strace ls\r" |
9 | expect { | 9 | expect { |
10 | timeout {puts "TESTING ERROR 0\n";exit} | 10 | timeout {puts "TESTING ERROR 0\n";exit} |
11 | "Child process initialized" | 11 | "Child process initialized" { puts "\n"} |
12 | "is disabled on Linux kernels prior to 4.8" { puts "TESTING SKIP: kernel too old\n"; exit } | ||
12 | } | 13 | } |
13 | expect { | 14 | expect { |
14 | timeout {puts "TESTING ERROR 1\n";exit} | 15 | timeout {puts "TESTING ERROR 1\n";exit} |
diff --git a/test/filters/filters.sh b/test/filters/filters.sh index 59d7d7e7f..6a5ec2b87 100755 --- a/test/filters/filters.sh +++ b/test/filters/filters.sh | |||
@@ -13,6 +13,8 @@ else | |||
13 | export PATH="$PATH:/usr/lib/firejail" | 13 | export PATH="$PATH:/usr/lib/firejail" |
14 | fi | 14 | fi |
15 | 15 | ||
16 | export PATH="$PATH:/usr/lib/firejail" | ||
17 | |||
16 | echo "TESTING: debug options (test/filters/debug.exp)" | 18 | echo "TESTING: debug options (test/filters/debug.exp)" |
17 | ./debug.exp | 19 | ./debug.exp |
18 | 20 | ||
diff --git a/test/utils/firecfg-fix.exp b/test/utils/firecfg-fix.exp deleted file mode 100755 index 685ce9c7b..000000000 --- a/test/utils/firecfg-fix.exp +++ /dev/null | |||
@@ -1,25 +0,0 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2017 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | spawn $env(SHELL) | ||
8 | match_max 100000 | ||
9 | |||
10 | send -- "firecfg --fix\r" | ||
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 0\n";exit} | ||
13 | "created" | ||
14 | } | ||
15 | sleep 1 | ||
16 | |||
17 | send -- "firecfg --fix\r" | ||
18 | expect { | ||
19 | timeout {puts "TESTING ERROR 1\n";exit} | ||
20 | "skipped" | ||
21 | } | ||
22 | sleep 1 | ||
23 | |||
24 | puts "\nall done\n" | ||
25 | |||
diff --git a/test/utils/utils.sh b/test/utils/utils.sh index d5ee5ef32..751f1f8e7 100755 --- a/test/utils/utils.sh +++ b/test/utils/utils.sh | |||
@@ -112,8 +112,3 @@ echo "TESTING: firemon interface (test/utils/firemon-interface.exp)" | |||
112 | echo "TESTING: firemon name (test/utils/firemon-name.exp)" | 112 | echo "TESTING: firemon name (test/utils/firemon-name.exp)" |
113 | ./firemon-name.exp | 113 | ./firemon-name.exp |
114 | 114 | ||
115 | echo "TESTING: firecfg --fix (test/utils/firecfg-fix.exp)" | ||
116 | mv ~/.local/share/applications ~/firejail-test-local-apps | ||
117 | ./firecfg-fix.exp | ||
118 | rm -fr ~/.local/share/applications | ||
119 | mv ~/firejail-test-local-apps ~/.local/share/applications | ||