diff options
-rw-r--r-- | .github/workflows/codeql-analysis.yml | 6 | ||||
-rw-r--r-- | .github/workflows/profile-checks.yml | 5 | ||||
-rw-r--r-- | etc/profile-a-l/atool.profile | 2 | ||||
-rw-r--r-- | etc/profile-a-l/curl.profile | 1 | ||||
-rw-r--r-- | etc/profile-a-l/firefox-common.profile | 1 | ||||
-rw-r--r-- | etc/profile-a-l/gimp.profile | 1 | ||||
-rw-r--r-- | etc/profile-a-l/inkscape.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/qutebrowser.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/warzone2100.profile | 1 | ||||
-rw-r--r-- | src/include/etc_groups.h | 4 |
10 files changed, 16 insertions, 8 deletions
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index eb9c28345..9cf216492 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml | |||
@@ -88,7 +88,7 @@ jobs: | |||
88 | 88 | ||
89 | # Initializes the CodeQL tools for scanning. | 89 | # Initializes the CodeQL tools for scanning. |
90 | - name: Initialize CodeQL | 90 | - name: Initialize CodeQL |
91 | uses: github/codeql-action/init@a34ca99b4610d924e04c68db79e503e1f79f9f02 | 91 | uses: github/codeql-action/init@3ebbd71c74ef574dbc558c82f70e52732c8b44fe |
92 | with: | 92 | with: |
93 | languages: ${{ matrix.language }} | 93 | languages: ${{ matrix.language }} |
94 | # If you wish to specify custom queries, you can do so here or in a config file. | 94 | # If you wish to specify custom queries, you can do so here or in a config file. |
@@ -99,7 +99,7 @@ jobs: | |||
99 | # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). | 99 | # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). |
100 | # If this step fails, then you should remove it and run the build manually (see below) | 100 | # If this step fails, then you should remove it and run the build manually (see below) |
101 | - name: Autobuild | 101 | - name: Autobuild |
102 | uses: github/codeql-action/autobuild@a34ca99b4610d924e04c68db79e503e1f79f9f02 | 102 | uses: github/codeql-action/autobuild@3ebbd71c74ef574dbc558c82f70e52732c8b44fe |
103 | 103 | ||
104 | # âšī¸ Command-line programs to run using the OS shell. | 104 | # âšī¸ Command-line programs to run using the OS shell. |
105 | # đ https://git.io/JvXDl | 105 | # đ https://git.io/JvXDl |
@@ -113,4 +113,4 @@ jobs: | |||
113 | # make release | 113 | # make release |
114 | 114 | ||
115 | - name: Perform CodeQL Analysis | 115 | - name: Perform CodeQL Analysis |
116 | uses: github/codeql-action/analyze@a34ca99b4610d924e04c68db79e503e1f79f9f02 | 116 | uses: github/codeql-action/analyze@3ebbd71c74ef574dbc558c82f70e52732c8b44fe |
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/profile-checks.yml index 403036f4f..66bba61f5 100644 --- a/.github/workflows/profile-checks.yml +++ b/.github/workflows/profile-checks.yml | |||
@@ -36,8 +36,9 @@ jobs: | |||
36 | - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c | 36 | - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c |
37 | - name: sort.py | 37 | - name: sort.py |
38 | run: ./ci/check/profiles/sort.py etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile | 38 | run: ./ci/check/profiles/sort.py etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile |
39 | - name: private-etc-always-required.sh | 39 | # Currently broken (see #5610) |
40 | run: ./ci/check/profiles/private-etc-always-required.sh etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile | 40 | # - name: private-etc-always-required.sh |
41 | # run: ./ci/check/profiles/private-etc-always-required.sh etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile | ||
41 | - name: sort-disable-programs.sh | 42 | - name: sort-disable-programs.sh |
42 | run: ./ci/check/profiles/sort-disable-programs.sh etc/inc/disable-programs.inc | 43 | run: ./ci/check/profiles/sort-disable-programs.sh etc/inc/disable-programs.inc |
43 | - name: sort-firecfg.config.sh | 44 | - name: sort-firecfg.config.sh |
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile index 6399bc1a3..b2bc17c67 100644 --- a/etc/profile-a-l/atool.profile +++ b/etc/profile-a-l/atool.profile | |||
@@ -13,7 +13,7 @@ include allow-perl.inc | |||
13 | noroot | 13 | noroot |
14 | 14 | ||
15 | # without login.defs atool complains and uses UID/GID 1000 by default | 15 | # without login.defs atool complains and uses UID/GID 1000 by default |
16 | private-etc alternatives,group,ld.so.cache,ld.so.preload,login.defs,passwd | 16 | private-etc alternatives,group,ld.so.cache,ld.so.preload,login.defs,passwd,resolv.conf |
17 | private-tmp | 17 | private-tmp |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
diff --git a/etc/profile-a-l/curl.profile b/etc/profile-a-l/curl.profile index 3e5878574..88b29cfbd 100644 --- a/etc/profile-a-l/curl.profile +++ b/etc/profile-a-l/curl.profile | |||
@@ -54,6 +54,7 @@ tracelog | |||
54 | private-cache | 54 | private-cache |
55 | private-dev | 55 | private-dev |
56 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 56 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl |
57 | private-etc TLS-CA | ||
57 | private-tmp | 58 | private-tmp |
58 | 59 | ||
59 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-a-l/firefox-common.profile b/etc/profile-a-l/firefox-common.profile index 60d64736e..3365c0829 100644 --- a/etc/profile-a-l/firefox-common.profile +++ b/etc/profile-a-l/firefox-common.profile | |||
@@ -60,6 +60,7 @@ disable-mnt | |||
60 | # private-etc below works fine on most distributions. There are some problems on CentOS. | 60 | # private-etc below works fine on most distributions. There are some problems on CentOS. |
61 | # Add it to your firefox-common.local if you want to enable it. | 61 | # Add it to your firefox-common.local if you want to enable it. |
62 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 62 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
63 | private-etc GUI,mailcap,mime.types,NETWORK,os-release,TLS-CA | ||
63 | private-tmp | 64 | private-tmp |
64 | 65 | ||
65 | blacklist ${PATH}/curl | 66 | blacklist ${PATH}/curl |
diff --git a/etc/profile-a-l/gimp.profile b/etc/profile-a-l/gimp.profile index 083b85a91..d9515c867 100644 --- a/etc/profile-a-l/gimp.profile +++ b/etc/profile-a-l/gimp.profile | |||
@@ -59,6 +59,7 @@ seccomp !mbind | |||
59 | tracelog | 59 | tracelog |
60 | 60 | ||
61 | private-dev | 61 | private-dev |
62 | private-etc gcrypt,GUI,python* | ||
62 | private-tmp | 63 | private-tmp |
63 | 64 | ||
64 | dbus-user none | 65 | dbus-user none |
diff --git a/etc/profile-a-l/inkscape.profile b/etc/profile-a-l/inkscape.profile index 1034c225f..1e75781ab 100644 --- a/etc/profile-a-l/inkscape.profile +++ b/etc/profile-a-l/inkscape.profile | |||
@@ -54,6 +54,7 @@ tracelog | |||
54 | # private-bin inkscape,potrace,python* - problems on Debian stretch | 54 | # private-bin inkscape,potrace,python* - problems on Debian stretch |
55 | private-cache | 55 | private-cache |
56 | private-dev | 56 | private-dev |
57 | private-etc ImageMagick*,inkscape: GUI,python* | ||
57 | private-tmp | 58 | private-tmp |
58 | 59 | ||
59 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-m-z/qutebrowser.profile b/etc/profile-m-z/qutebrowser.profile index 89f8b257a..ea0e2afa7 100644 --- a/etc/profile-m-z/qutebrowser.profile +++ b/etc/profile-m-z/qutebrowser.profile | |||
@@ -56,7 +56,7 @@ seccomp !chroot,!name_to_handle_at | |||
56 | disable-mnt | 56 | disable-mnt |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | private-dev |
59 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl | 59 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
62 | dbus-user filter | 62 | dbus-user filter |
diff --git a/etc/profile-m-z/warzone2100.profile b/etc/profile-m-z/warzone2100.profile index 50c776412..6000bd98f 100644 --- a/etc/profile-m-z/warzone2100.profile +++ b/etc/profile-m-z/warzone2100.profile | |||
@@ -46,6 +46,7 @@ tracelog | |||
46 | disable-mnt | 46 | disable-mnt |
47 | private-bin bash,dash,sh,warzone2100,which | 47 | private-bin bash,dash,sh,warzone2100,which |
48 | private-dev | 48 | private-dev |
49 | private-etc GAMES,GUI | ||
49 | private-tmp | 50 | private-tmp |
50 | 51 | ||
51 | restrict-namespaces | 52 | restrict-namespaces |
diff --git a/src/include/etc_groups.h b/src/include/etc_groups.h index 066c97570..421837fbb 100644 --- a/src/include/etc_groups.h +++ b/src/include/etc_groups.h | |||
@@ -35,8 +35,10 @@ static char *etc_list[ETC_MAX + 1] = { // plus 1 for ending NULL pointer | |||
35 | "locale.alias", | 35 | "locale.alias", |
36 | "locale.conf", | 36 | "locale.conf", |
37 | "localtime", | 37 | "localtime", |
38 | "login.defs", // firejail reading UID/GID MIN and MAX at startup | ||
38 | "nsswitch.conf", | 39 | "nsswitch.conf", |
39 | "passwd", | 40 | "passwd", |
41 | "group", | ||
40 | NULL | 42 | NULL |
41 | }; | 43 | }; |
42 | 44 | ||
@@ -77,6 +79,7 @@ static char *etc_group_gui[] = { | |||
77 | "gtk-3.0", | 79 | "gtk-3.0", |
78 | "kde4rc", | 80 | "kde4rc", |
79 | "kde5rc", | 81 | "kde5rc", |
82 | "pango", // text rendering/internationalization | ||
80 | NULL | 83 | NULL |
81 | }; | 84 | }; |
82 | 85 | ||
@@ -85,7 +88,6 @@ static char *etc_group_games[] = { | |||
85 | "timidity", // MIDI | 88 | "timidity", // MIDI |
86 | "timidity.cfg", | 89 | "timidity.cfg", |
87 | "openal", // 3D sound | 90 | "openal", // 3D sound |
88 | "gcrypt", // GNU crypto library | ||
89 | NULL | 91 | NULL |
90 | }; | 92 | }; |
91 | 93 | ||