diff options
384 files changed, 2409 insertions, 1588 deletions
diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 000000000..6b329f917 --- /dev/null +++ b/.gitattributes | |||
@@ -0,0 +1 @@ | |||
/etc/inc/*.inc linguist-language=text | |||
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 0f13afc51..eb485b8a2 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md | |||
@@ -7,6 +7,13 @@ assignees: '' | |||
7 | 7 | ||
8 | --- | 8 | --- |
9 | 9 | ||
10 | <!-- | ||
11 | See the following links for help with formatting: | ||
12 | |||
13 | https://guides.github.com/features/mastering-markdown/ | ||
14 | https://docs.github.com/en/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax | ||
15 | --> | ||
16 | |||
10 | ### Description | 17 | ### Description |
11 | 18 | ||
12 | _Describe the bug_ | 19 | _Describe the bug_ |
@@ -15,7 +22,7 @@ _Describe the bug_ | |||
15 | 22 | ||
16 | _Steps to reproduce the behavior_ | 23 | _Steps to reproduce the behavior_ |
17 | 24 | ||
18 | 1. Run in bash `LANG=C firejail PROGRAM` (`LANG=C` to get English messages that can be understood by everybody) | 25 | 1. Run in bash `LC_ALL=C firejail PROGRAM` (`LC_ALL=C` to get a consistent output in English that can be understood by everybody) |
19 | 2. Click on '....' | 26 | 2. Click on '....' |
20 | 3. Scroll down to '....' | 27 | 3. Scroll down to '....' |
21 | 4. See error `ERROR` | 28 | 4. See error `ERROR` |
@@ -30,7 +37,7 @@ _What actually happened_ | |||
30 | 37 | ||
31 | ### Behavior without a profile | 38 | ### Behavior without a profile |
32 | 39 | ||
33 | _What changed calling `firejail --noprofile /path/to/program` in a terminal?_ | 40 | _What changed calling `LC_ALL=C firejail --noprofile /path/to/program` in a terminal?_ |
34 | 41 | ||
35 | ### Additional context | 42 | ### Additional context |
36 | 43 | ||
@@ -44,6 +51,12 @@ _Any other detail that may help to understand/debug the problem_ | |||
44 | 51 | ||
45 | ### Checklist | 52 | ### Checklist |
46 | 53 | ||
54 | <!-- | ||
55 | Note: Items are checked with an "x", like so: | ||
56 | |||
57 | - [x] This is a checked item. | ||
58 | --> | ||
59 | |||
47 | - [ ] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). | 60 | - [ ] The issues is caused by firejail (i.e. running the program by path (e.g. `/usr/bin/vlc`) "fixes" it). |
48 | - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). | 61 | - [ ] I can reproduce the issue without custom modifications (e.g. globals.local). |
49 | - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) | 62 | - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) |
@@ -55,7 +68,7 @@ _Any other detail that may help to understand/debug the problem_ | |||
55 | ### Log | 68 | ### Log |
56 | 69 | ||
57 | <details> | 70 | <details> |
58 | <summary>Output of <code>firejail /path/to/program</code></summary> | 71 | <summary>Output of <code>LC_ALL=C firejail /path/to/program</code></summary> |
59 | <p> | 72 | <p> |
60 | 73 | ||
61 | ``` | 74 | ``` |
@@ -66,7 +79,7 @@ output goes here | |||
66 | </details> | 79 | </details> |
67 | 80 | ||
68 | <details> | 81 | <details> |
69 | <summary>Output of <code>firejail --debug /path/to/program</code></summary> | 82 | <summary>Output of <code>LC_ALL=C firejail --debug /path/to/program</code></summary> |
70 | <p> | 83 | <p> |
71 | 84 | ||
72 | ``` | 85 | ``` |
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 57ac2e9c4..7cb92a938 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md | |||
@@ -1,4 +1,3 @@ | |||
1 | |||
2 | If your PR isn't about profiles or you have no idea how to do one of these, skip the following and go ahead with this PR. | 1 | If your PR isn't about profiles or you have no idea how to do one of these, skip the following and go ahead with this PR. |
3 | 2 | ||
4 | If you submit a PR for new profiles or changing profiles, please do the following: | 3 | If you submit a PR for new profiles or changing profiles, please do the following: |
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/profile-checks.yml new file mode 100644 index 000000000..951a8b8cf --- /dev/null +++ b/.github/workflows/profile-checks.yml | |||
@@ -0,0 +1,31 @@ | |||
1 | name: Profile Checks | ||
2 | |||
3 | on: | ||
4 | push: | ||
5 | branches: [ master ] | ||
6 | paths: | ||
7 | - 'etc/**' | ||
8 | - 'ci/check/profiles/**' | ||
9 | - 'src/firecfg/firecfg.config' | ||
10 | - 'contrib/sort.py' | ||
11 | pull_request: | ||
12 | branches: [ master ] | ||
13 | paths: | ||
14 | - 'etc/**' | ||
15 | - 'ci/check/profiles/**' | ||
16 | - 'src/firecfg/firecfg.config' | ||
17 | - 'contrib/sort.py' | ||
18 | |||
19 | jobs: | ||
20 | profile-checks: | ||
21 | runs-on: ubuntu-20.04 | ||
22 | steps: | ||
23 | - uses: actions/checkout@v2 | ||
24 | - name: sort.py | ||
25 | run: ./ci/check/profiles/sort.py etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile | ||
26 | - name: private-etc-always-required.sh | ||
27 | run: ./ci/check/profiles/private-etc-always-required.sh etc/inc/*.inc etc/{profile-a-l,profile-m-z}/*.profile | ||
28 | - name: sort-disable-programs.sh | ||
29 | run: ./ci/check/profiles/sort-disable-programs.sh etc/inc/disable-programs.inc | ||
30 | - name: sort-firecfg.config.sh | ||
31 | run: ./ci/check/profiles/sort-firecfg.config.sh src/firecfg/firecfg.config | ||
diff --git a/.github/workflows/sort.yml b/.github/workflows/sort.yml deleted file mode 100644 index f3ded0f22..000000000 --- a/.github/workflows/sort.yml +++ /dev/null | |||
@@ -1,22 +0,0 @@ | |||
1 | name: sort.py | ||
2 | |||
3 | on: | ||
4 | push: | ||
5 | branches: [ master ] | ||
6 | paths: | ||
7 | - 'etc/**' | ||
8 | - 'contrib/sort.py' | ||
9 | pull_request: | ||
10 | branches: [ master ] | ||
11 | paths: | ||
12 | - 'etc/**' | ||
13 | - 'contrib/sort.py' | ||
14 | |||
15 | jobs: | ||
16 | profile-sort: | ||
17 | runs-on: ubuntu-20.04 | ||
18 | steps: | ||
19 | - uses: actions/checkout@v2 | ||
20 | - name: check profiles | ||
21 | run: ./contrib/sort.py etc/*/{*.inc,*.profile} | ||
22 | |||
@@ -1,12 +1,12 @@ | |||
1 | GNU GENERAL PUBLIC LICENSE | 1 | GNU GENERAL PUBLIC LICENSE |
2 | Version 2, June 1991 | 2 | Version 2, June 1991 |
3 | 3 | ||
4 | Copyright (C) 1989, 1991 Free Software Foundation, Inc. | 4 | Copyright (C) 1989, 1991 Free Software Foundation, Inc., |
5 | 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA | 5 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA |
6 | Everyone is permitted to copy and distribute verbatim copies | 6 | Everyone is permitted to copy and distribute verbatim copies |
7 | of this license document, but changing it is not allowed. | 7 | of this license document, but changing it is not allowed. |
8 | 8 | ||
9 | Preamble | 9 | Preamble |
10 | 10 | ||
11 | The licenses for most software are designed to take away your | 11 | The licenses for most software are designed to take away your |
12 | freedom to share and change it. By contrast, the GNU General Public | 12 | freedom to share and change it. By contrast, the GNU General Public |
@@ -15,7 +15,7 @@ software--to make sure the software is free for all its users. This | |||
15 | General Public License applies to most of the Free Software | 15 | General Public License applies to most of the Free Software |
16 | Foundation's software and to any other program whose authors commit to | 16 | Foundation's software and to any other program whose authors commit to |
17 | using it. (Some other Free Software Foundation software is covered by | 17 | using it. (Some other Free Software Foundation software is covered by |
18 | the GNU Library General Public License instead.) You can apply it to | 18 | the GNU Lesser General Public License instead.) You can apply it to |
19 | your programs, too. | 19 | your programs, too. |
20 | 20 | ||
21 | When we speak of free software, we are referring to freedom, not | 21 | When we speak of free software, we are referring to freedom, not |
@@ -55,8 +55,8 @@ patent must be licensed for everyone's free use or not licensed at all. | |||
55 | 55 | ||
56 | The precise terms and conditions for copying, distribution and | 56 | The precise terms and conditions for copying, distribution and |
57 | modification follow. | 57 | modification follow. |
58 | 58 | ||
59 | GNU GENERAL PUBLIC LICENSE | 59 | GNU GENERAL PUBLIC LICENSE |
60 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION | 60 | TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION |
61 | 61 | ||
62 | 0. This License applies to any program or other work which contains | 62 | 0. This License applies to any program or other work which contains |
@@ -110,7 +110,7 @@ above, provided that you also meet all of these conditions: | |||
110 | License. (Exception: if the Program itself is interactive but | 110 | License. (Exception: if the Program itself is interactive but |
111 | does not normally print such an announcement, your work based on | 111 | does not normally print such an announcement, your work based on |
112 | the Program is not required to print an announcement.) | 112 | the Program is not required to print an announcement.) |
113 | 113 | ||
114 | These requirements apply to the modified work as a whole. If | 114 | These requirements apply to the modified work as a whole. If |
115 | identifiable sections of that work are not derived from the Program, | 115 | identifiable sections of that work are not derived from the Program, |
116 | and can be reasonably considered independent and separate works in | 116 | and can be reasonably considered independent and separate works in |
@@ -168,7 +168,7 @@ access to copy from a designated place, then offering equivalent | |||
168 | access to copy the source code from the same place counts as | 168 | access to copy the source code from the same place counts as |
169 | distribution of the source code, even though third parties are not | 169 | distribution of the source code, even though third parties are not |
170 | compelled to copy the source along with the object code. | 170 | compelled to copy the source along with the object code. |
171 | 171 | ||
172 | 4. You may not copy, modify, sublicense, or distribute the Program | 172 | 4. You may not copy, modify, sublicense, or distribute the Program |
173 | except as expressly provided under this License. Any attempt | 173 | except as expressly provided under this License. Any attempt |
174 | otherwise to copy, modify, sublicense or distribute the Program is | 174 | otherwise to copy, modify, sublicense or distribute the Program is |
@@ -225,7 +225,7 @@ impose that choice. | |||
225 | 225 | ||
226 | This section is intended to make thoroughly clear what is believed to | 226 | This section is intended to make thoroughly clear what is believed to |
227 | be a consequence of the rest of this License. | 227 | be a consequence of the rest of this License. |
228 | 228 | ||
229 | 8. If the distribution and/or use of the Program is restricted in | 229 | 8. If the distribution and/or use of the Program is restricted in |
230 | certain countries either by patents or by copyrighted interfaces, the | 230 | certain countries either by patents or by copyrighted interfaces, the |
231 | original copyright holder who places the Program under this License | 231 | original copyright holder who places the Program under this License |
@@ -255,7 +255,7 @@ make exceptions for this. Our decision will be guided by the two goals | |||
255 | of preserving the free status of all derivatives of our free software and | 255 | of preserving the free status of all derivatives of our free software and |
256 | of promoting the sharing and reuse of software generally. | 256 | of promoting the sharing and reuse of software generally. |
257 | 257 | ||
258 | NO WARRANTY | 258 | NO WARRANTY |
259 | 259 | ||
260 | 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY | 260 | 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY |
261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN | 261 | FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN |
@@ -277,4 +277,63 @@ YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER | |||
277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE | 277 | PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE |
278 | POSSIBILITY OF SUCH DAMAGES. | 278 | POSSIBILITY OF SUCH DAMAGES. |
279 | 279 | ||
280 | END OF TERMS AND CONDITIONS | 280 | END OF TERMS AND CONDITIONS |
281 | |||
282 | How to Apply These Terms to Your New Programs | ||
283 | |||
284 | If you develop a new program, and you want it to be of the greatest | ||
285 | possible use to the public, the best way to achieve this is to make it | ||
286 | free software which everyone can redistribute and change under these terms. | ||
287 | |||
288 | To do so, attach the following notices to the program. It is safest | ||
289 | to attach them to the start of each source file to most effectively | ||
290 | convey the exclusion of warranty; and each file should have at least | ||
291 | the "copyright" line and a pointer to where the full notice is found. | ||
292 | |||
293 | <one line to give the program's name and a brief idea of what it does.> | ||
294 | Copyright (C) <year> <name of author> | ||
295 | |||
296 | This program is free software; you can redistribute it and/or modify | ||
297 | it under the terms of the GNU General Public License as published by | ||
298 | the Free Software Foundation; either version 2 of the License, or | ||
299 | (at your option) any later version. | ||
300 | |||
301 | This program is distributed in the hope that it will be useful, | ||
302 | but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
303 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
304 | GNU General Public License for more details. | ||
305 | |||
306 | You should have received a copy of the GNU General Public License along | ||
307 | with this program; if not, write to the Free Software Foundation, Inc., | ||
308 | 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
309 | |||
310 | Also add information on how to contact you by electronic and paper mail. | ||
311 | |||
312 | If the program is interactive, make it output a short notice like this | ||
313 | when it starts in an interactive mode: | ||
314 | |||
315 | Gnomovision version 69, Copyright (C) year name of author | ||
316 | Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. | ||
317 | This is free software, and you are welcome to redistribute it | ||
318 | under certain conditions; type `show c' for details. | ||
319 | |||
320 | The hypothetical commands `show w' and `show c' should show the appropriate | ||
321 | parts of the General Public License. Of course, the commands you use may | ||
322 | be called something other than `show w' and `show c'; they could even be | ||
323 | mouse-clicks or menu items--whatever suits your program. | ||
324 | |||
325 | You should also get your employer (if you work as a programmer) or your | ||
326 | school, if any, to sign a "copyright disclaimer" for the program, if | ||
327 | necessary. Here is a sample; alter the names: | ||
328 | |||
329 | Yoyodyne, Inc., hereby disclaims all copyright interest in the program | ||
330 | `Gnomovision' (which makes passes at compilers) written by James Hacker. | ||
331 | |||
332 | <signature of Ty Coon>, 1 April 1989 | ||
333 | Ty Coon, President of Vice | ||
334 | |||
335 | This General Public License does not permit incorporating your program into | ||
336 | proprietary programs. If your program is a subroutine library, you may | ||
337 | consider it more useful to permit linking proprietary applications with the | ||
338 | library. If this is what you want to do, use the GNU Lesser General | ||
339 | Public License instead of this License. | ||
diff --git a/Makefile.in b/Makefile.in index c94d8c7a4..11193122d 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -144,9 +144,13 @@ ifeq ($(HAVE_APPARMOR),-DHAVE_APPARMOR) | |||
144 | # install apparmor profile | 144 | # install apparmor profile |
145 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d; fi;" | 145 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d; fi;" |
146 | install -m 0644 etc/apparmor/firejail-default $(DESTDIR)$(sysconfdir)/apparmor.d | 146 | install -m 0644 etc/apparmor/firejail-default $(DESTDIR)$(sysconfdir)/apparmor.d |
147 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/local ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/local; fi;" | ||
148 | # install apparmor profile customization file | 147 | # install apparmor profile customization file |
148 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/local ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/local; fi;" | ||
149 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-default ]; then install -c -m 0644 etc/apparmor/firejail-local $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-default; fi;" | 149 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-default ]; then install -c -m 0644 etc/apparmor/firejail-local $(DESTDIR)/$(sysconfdir)/apparmor.d/local/firejail-default; fi;" |
150 | # install apparmor base abstraction drop-in | ||
151 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions; fi;" | ||
152 | sh -c "if [ ! -d $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions/base.d ]; then install -d -m 755 $(DESTDIR)/$(sysconfdir)/apparmor.d/abstractions/base.d; fi;" | ||
153 | install -m 0644 etc/apparmor/firejail-base $(DESTDIR)$(sysconfdir)/apparmor.d/abstractions/base.d | ||
150 | endif | 154 | endif |
151 | ifneq ($(HAVE_MAN),no) | 155 | ifneq ($(HAVE_MAN),no) |
152 | # man pages | 156 | # man pages |
@@ -1,13 +1,13 @@ | |||
1 | Firejail is a SUID sandbox program that reduces the risk of security | 1 | Firejail is a SUID sandbox program that reduces the risk of security |
2 | breaches by restricting the running environment of untrusted applications | 2 | breaches by restricting the running environment of untrusted applications |
3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for | 3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for |
4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, | 4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, |
5 | VLC, Audacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. | 5 | VLC, Audacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. |
6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, | 6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, |
7 | Pidgin, Quassel, and XChat. | 7 | Pidgin, Quassel, and XChat. |
8 | 8 | ||
9 | Firejail also expands the restricted shell facility found in bash by adding | 9 | Firejail also expands the restricted shell facility found in bash by adding |
10 | Linux namespace support. It supports sandboxing specific users upon login. | 10 | Linux namespace support. It supports sandboxing specific users upon login. |
11 | 11 | ||
12 | Download: https://sourceforge.net/projects/firejail/files/ | 12 | Download: https://sourceforge.net/projects/firejail/files/ |
13 | Build and install: ./configure && make && sudo make install | 13 | Build and install: ./configure && make && sudo make install |
@@ -68,11 +68,14 @@ Firejail Authors (alphabetical order) | |||
68 | - fix flameshot raw screenshots | 68 | - fix flameshot raw screenshots |
69 | 1dnrr (https://github.com/1dnrr) | 69 | 1dnrr (https://github.com/1dnrr) |
70 | - add pybitmessage profile | 70 | - add pybitmessage profile |
71 | a1346054 (https://github.com/a1346054) | ||
72 | - add missing final newlines in various files | ||
71 | Ádler Jonas Gross (https://github.com/adgross) | 73 | Ádler Jonas Gross (https://github.com/adgross) |
72 | - AppArmor fix | 74 | - AppArmor fix |
73 | Adrian L. Shaw (https://github.com/adrianlshaw) | 75 | Adrian L. Shaw (https://github.com/adrianlshaw) |
74 | - add profanity profile | 76 | - add profanity profile |
75 | - add barrirer profile | 77 | - add barrirer profile |
78 | - add profile for Beyond All Reason | ||
76 | Aidan Gauland (https://github.com/aidalgol) | 79 | Aidan Gauland (https://github.com/aidalgol) |
77 | - added electron, riot-web and npm profiles | 80 | - added electron, riot-web and npm profiles |
78 | - whitelist Bohemia Interactive config dir for Steam | 81 | - whitelist Bohemia Interactive config dir for Steam |
@@ -221,6 +224,8 @@ Carlo Abelli (https://github.com/carloabelli) | |||
221 | - fixed simple-scan | 224 | - fixed simple-scan |
222 | Cat (https://github.com/ecat3) | 225 | Cat (https://github.com/ecat3) |
223 | - prevent tmux connecting to an existing session | 226 | - prevent tmux connecting to an existing session |
227 | cayday (https://github.com/caydey) | ||
228 | - added ~/Private blacklist in disable-common.inc | ||
224 | Christian Pinedo (https://github.com/chrpinedo) | 229 | Christian Pinedo (https://github.com/chrpinedo) |
225 | - added nicotine profile | 230 | - added nicotine profile |
226 | - allow python3 in totem profile | 231 | - allow python3 in totem profile |
@@ -246,6 +251,9 @@ crass (https://github.com/crass) | |||
246 | - extract_command_name fixes | 251 | - extract_command_name fixes |
247 | - update appimage size calculation to newest code from libappimage | 252 | - update appimage size calculation to newest code from libappimage |
248 | - firejail should look for processes with names exactly named | 253 | - firejail should look for processes with names exactly named |
254 | croket (https://github.com/crocket) | ||
255 | - fix librewolf profile | ||
256 | - added profiles for imv, retroarch, and torbrowser | ||
249 | curiosity-seeker (https://github.com/curiosity-seeker - old) | 257 | curiosity-seeker (https://github.com/curiosity-seeker - old) |
250 | curiosityseeker (https://github.com/curiosityseeker - new) | 258 | curiosityseeker (https://github.com/curiosityseeker - new) |
251 | - tightening unbound and dnscrypt-proxy profiles | 259 | - tightening unbound and dnscrypt-proxy profiles |
@@ -304,6 +312,8 @@ DiGitHubCap (https://github.com/DiGitHubCap) | |||
304 | - fix qt5ct colour schemes and QSS | 312 | - fix qt5ct colour schemes and QSS |
305 | Disconnect3d (https://github.com/disconnect3d) | 313 | Disconnect3d (https://github.com/disconnect3d) |
306 | - code cleanup | 314 | - code cleanup |
315 | dm9pZCAq (https://github.com/dm9pZCAq) | ||
316 | - fix for compilation under musl | ||
307 | dmfreemon (https://github.com/dmfreemon) | 317 | dmfreemon (https://github.com/dmfreemon) |
308 | - add sandbox name or name of private directory to the window title when xpra is used | 318 | - add sandbox name or name of private directory to the window title when xpra is used |
309 | - handle malloc() failures; use gnu_basename() instead of basenaem() | 319 | - handle malloc() failures; use gnu_basename() instead of basenaem() |
@@ -454,7 +464,7 @@ hawkey116477 (https://github.com/hawkeye116477) | |||
454 | Helmut Grohne (https://github.com/helmutg) | 464 | Helmut Grohne (https://github.com/helmutg) |
455 | - compiler support in the build system - Debian bug #869707 | 465 | - compiler support in the build system - Debian bug #869707 |
456 | hhzek0014 (https://github.com/hhzek0014) | 466 | hhzek0014 (https://github.com/hhzek0014) |
457 | - updated bibletime.profile | 467 | - updated bibletime.profile |
458 | hlein (https://github.com/hlein) | 468 | hlein (https://github.com/hlein) |
459 | - strip out \r's from jail prober | 469 | - strip out \r's from jail prober |
460 | Holger Heinz (https://github.com/hheinz) | 470 | Holger Heinz (https://github.com/hheinz) |
@@ -490,6 +500,10 @@ James Elford (https://github.com/jelford) | |||
490 | - removed shell none from ssh-agent configuration, fixing the infinite loop | 500 | - removed shell none from ssh-agent configuration, fixing the infinite loop |
491 | - added gcloud profile | 501 | - added gcloud profile |
492 | - blacklist sensitive cloud provider files in disable-common | 502 | - blacklist sensitive cloud provider files in disable-common |
503 | Jan-Niclas (https://github.com/0x6a61) | ||
504 | - moved rules from firefox-common.profile to firefox.profile | ||
505 | - blacklist /*firefox* except for firefox itself | ||
506 | - fix Firefox 'Profile not found' - whitelist /run/user/xxx/firefox | ||
493 | Jean Lucas (https://github.com/flacks) | 507 | Jean Lucas (https://github.com/flacks) |
494 | - fix Discord profile | 508 | - fix Discord profile |
495 | - add AnyDesk profile | 509 | - add AnyDesk profile |
@@ -526,6 +540,7 @@ John Mullee (https://github.com/jmullee) | |||
526 | Jonas Heinrich (https://github.com/onny) | 540 | Jonas Heinrich (https://github.com/onny) |
527 | - added signal-desktop profile | 541 | - added signal-desktop profile |
528 | - fixed franz profile | 542 | - fixed franz profile |
543 | - remove /etc/hosts is_link check for NixOS | ||
529 | Jose Riha (https://github.com/jose1711) | 544 | Jose Riha (https://github.com/jose1711) |
530 | - added meteo-qt profile | 545 | - added meteo-qt profile |
531 | - created qgis, links, xlinks profiles | 546 | - created qgis, links, xlinks profiles |
@@ -536,6 +551,8 @@ Jose Riha (https://github.com/jose1711) | |||
536 | - Add profile for udiskie | 551 | - Add profile for udiskie |
537 | - fix udiskie.profile | 552 | - fix udiskie.profile |
538 | - improve hints for allowing browser access to Gnome extensions connector | 553 | - improve hints for allowing browser access to Gnome extensions connector |
554 | - fix warshow, jumpnbump, tremulous, blobwars profile fixes | ||
555 | - drop noinput for games with gampad/joystick support | ||
539 | jrabe (https://github.com/jrabe) | 556 | jrabe (https://github.com/jrabe) |
540 | - disallow access to kdbx files | 557 | - disallow access to kdbx files |
541 | - Epiphany profile | 558 | - Epiphany profile |
@@ -568,7 +585,7 @@ Kishore96in (https://github.com/Kishore96in) | |||
568 | - added falkon profile | 585 | - added falkon profile |
569 | - kxmlgui fixes | 586 | - kxmlgui fixes |
570 | - okular profile fixes | 587 | - okular profile fixes |
571 | - jitsi-meet-desktop profile | 588 | - jitsi-meet-desktop profile |
572 | - konversatin profile fix | 589 | - konversatin profile fix |
573 | - added Neochat profile | 590 | - added Neochat profile |
574 | - added whitelist-1793-workaround.inc | 591 | - added whitelist-1793-workaround.inc |
@@ -595,6 +612,9 @@ Laurent Declercq (https://github.com/nuxwin) | |||
595 | - fixed test for shell interpreter in chroots | 612 | - fixed test for shell interpreter in chroots |
596 | LaurentGH (https://github.com/LaurentGH) | 613 | LaurentGH (https://github.com/LaurentGH) |
597 | - allow private-bin parameters to be absolute paths | 614 | - allow private-bin parameters to be absolute paths |
615 | lecso7 (https://github.com/lecso7) | ||
616 | - added goldendict profile | ||
617 | - allow evince to read .cbz file format | ||
598 | Loïc Damien (https://github.com/dzamlo) | 618 | Loïc Damien (https://github.com/dzamlo) |
599 | - small fixes | 619 | - small fixes |
600 | Liorst4 (https://github.com/Liorst4) | 620 | Liorst4 (https://github.com/Liorst4) |
@@ -627,6 +647,8 @@ Martin Carpenter (https://github.com/mcarpenter) | |||
627 | Martin Dosch (spam-debian@mdosch.de) | 647 | Martin Dosch (spam-debian@mdosch.de) |
628 | - support for gnome-shell integration addon in Firefox | 648 | - support for gnome-shell integration addon in Firefox |
629 | (Bug-Debian: https://bugs.debian.org/872720) | 649 | (Bug-Debian: https://bugs.debian.org/872720) |
650 | Martynas Janonis (https://github.com/mjanonis) | ||
651 | - update wrc for Arch Linux | ||
630 | Matt Parnell (https://github.com/ilikenwf) | 652 | Matt Parnell (https://github.com/ilikenwf) |
631 | - whitelisting for core firefox related functionality | 653 | - whitelisting for core firefox related functionality |
632 | Mattias Wadman (https://github.com/wader) | 654 | Mattias Wadman (https://github.com/wader) |
@@ -699,7 +721,7 @@ Ondra Nekola (https://github.com/satai) | |||
699 | OndrejMalek (https://github.com/OndrejMalek) | 721 | OndrejMalek (https://github.com/OndrejMalek) |
700 | - various manpage fixes | 722 | - various manpage fixes |
701 | Ondřej Nový (https://github.com/onovy) | 723 | Ondřej Nový (https://github.com/onovy) |
702 | - allow video for Signal profile | 724 | - allow video for Signal profile |
703 | - added Mattermost desktop profile | 725 | - added Mattermost desktop profile |
704 | - hardened Zoom profile | 726 | - hardened Zoom profile |
705 | - hardened Signal desktop profile | 727 | - hardened Signal desktop profile |
@@ -716,7 +738,7 @@ Patrick Toomey (https://sourceforge.net/u/ptoomey/profile/) | |||
716 | Paul Moore <pmoore@redhat.com> | 738 | Paul Moore <pmoore@redhat.com> |
717 | -src/fsec-print/print.c extracted from libseccomp software package | 739 | -src/fsec-print/print.c extracted from libseccomp software package |
718 | Paupiah Yash (https://github.com/CaffeinatedStud) | 740 | Paupiah Yash (https://github.com/CaffeinatedStud) |
719 | - gzip profile | 741 | - gzip profile |
720 | Pawel (https://github.com/grimskies) | 742 | Pawel (https://github.com/grimskies) |
721 | - make --join return exit code of the invoked program | 743 | - make --join return exit code of the invoked program |
722 | Peter Millerchip (https://github.com/pmillerchip) | 744 | Peter Millerchip (https://github.com/pmillerchip) |
@@ -944,7 +966,7 @@ SYN-cook (https://github.com/SYN-cook) | |||
944 | - gnome-calculator changes | 966 | - gnome-calculator changes |
945 | startx2017 (https://github.com/startx2017) | 967 | startx2017 (https://github.com/startx2017) |
946 | - syscall list update | 968 | - syscall list update |
947 | - updated default seccomp filters - added bpf, clock_settime, personality, process_vm_writev, query_module, | 969 | - updated default seccomp filters - added bpf, clock_settime, personality, process_vm_writev, query_module, |
948 | settimeofday, stime, umount, userfaultfd, ustat, vm86, and vm86old | 970 | settimeofday, stime, umount, userfaultfd, ustat, vm86, and vm86old |
949 | - enable/disable join support in /etc/firejail/firejail.config | 971 | - enable/disable join support in /etc/firejail/firejail.config |
950 | - firecfg fix: create ~/.local/share/applications directory if it doesn't exist | 972 | - firecfg fix: create ~/.local/share/applications directory if it doesn't exist |
@@ -995,10 +1017,11 @@ Topi Miettinen (https://github.com/topimiettinen) | |||
995 | - improve loading of seccomp filter and memory-deny-write-execute feature | 1017 | - improve loading of seccomp filter and memory-deny-write-execute feature |
996 | - private-lib feature | 1018 | - private-lib feature |
997 | - make --nodbus block also system D-Bus socket | 1019 | - make --nodbus block also system D-Bus socket |
998 | Ted Robertson (https://github.com/tredondo) | 1020 | Ted Robertson (https://github.com/tredondo) |
999 | - webstorm profile fixes | 1021 | - webstorm profile fixes |
1000 | - added bcompare profile | 1022 | - added bcompare profile |
1001 | - various documentation fixes | 1023 | - various documentation fixes |
1024 | - blacklist Exodus wallet | ||
1002 | user1024 (user1024@tut.by) | 1025 | user1024 (user1024@tut.by) |
1003 | - electron profile whitelisting | 1026 | - electron profile whitelisting |
1004 | - fixed Rocket.Chat profile | 1027 | - fixed Rocket.Chat profile |
@@ -1054,7 +1077,7 @@ vismir2 (https://github.com/vismir2) | |||
1054 | - feh, ranger, 7z, keepass, keepassx and zathura profiles | 1077 | - feh, ranger, 7z, keepass, keepassx and zathura profiles |
1055 | - claws-mail, mutt, git, emacs, vim profiles | 1078 | - claws-mail, mutt, git, emacs, vim profiles |
1056 | - lots of profile fixes | 1079 | - lots of profile fixes |
1057 | - support for truecrypt and zuluCrypt | 1080 | - support for truecrypt and zuluCrypt |
1058 | viq (https://github.com/viq) | 1081 | viq (https://github.com/viq) |
1059 | - discord-canary profile | 1082 | - discord-canary profile |
1060 | Vladimir Gorelov (https://github.com/larkvirtual) | 1083 | Vladimir Gorelov (https://github.com/larkvirtual) |
@@ -1062,11 +1085,12 @@ Vladimir Gorelov (https://github.com/larkvirtual) | |||
1062 | Vladimir Schowalter (https://github.com/VladimirSchowalter20) | 1085 | Vladimir Schowalter (https://github.com/VladimirSchowalter20) |
1063 | - apparmor profile enhancements | 1086 | - apparmor profile enhancements |
1064 | - various KDE profile enhancements | 1087 | - various KDE profile enhancements |
1065 | read-only kde5 services directory | 1088 | - read-only kde5 services directory |
1066 | Vladislav Nepogodin (https://github.com/vnepogodin) | 1089 | Vladislav Nepogodin (https://github.com/vnepogodin) |
1067 | - added Librewolf profiles | 1090 | - added Librewolf profiles |
1068 | - added Sway profile | 1091 | - added Sway profile |
1069 | - fix CLion profile | 1092 | - fix CLion profile |
1093 | - fixes for disable-programs.inc | ||
1070 | xee5ch (https://github.com/xee5ch) | 1094 | xee5ch (https://github.com/xee5ch) |
1071 | - skypeforlinux profile | 1095 | - skypeforlinux profile |
1072 | Ypnose (https://github.com/Ypnose) | 1096 | Ypnose (https://github.com/Ypnose) |
@@ -22,43 +22,23 @@ implemented directly in Linux kernel and available on any Linux computer. | |||
22 | <table><tr> | 22 | <table><tr> |
23 | 23 | ||
24 | <td> | 24 | <td> |
25 | <a href="http://www.youtube.com/watch?feature=player_embedded&v=8jfXL0ePV7U | 25 | <a href="https://www.brighteon.com/1928415c-2bce-40b2-a81f-7861a3734913" target="_blank"> |
26 | " target="_blank"><img src="http://img.youtube.com/vi/8jfXL0ePV7U/0.jpg" | 26 | <img src="https://video.brighteon.com/file/Brighteon-staging/thumbnail/682ae17c-3fd8-4813-9c4e-6917c7cd2a5c.0000001.jpg" |
27 | alt="Firejail Introduction" width="240" height="180" border="10" /><br/>Firejail Intro</a> | 27 | alt="Introduction" width="240" height="142" border="10" /><br/>Introduction</a> |
28 | </td> | 28 | </td> |
29 | 29 | ||
30 | <td> | 30 | <td> |
31 | <a href="http://www.youtube.com/watch?feature=player_embedded&v=J1ZsXrpAgBU | 31 | <a href="https://www.brighteon.com/c20c32ac-1953-438f-8640-a414dcb318d6" target="_blank"> |
32 | " target="_blank"><img src="http://img.youtube.com/vi/J1ZsXrpAgBU/0.jpg" | 32 | <img src="https://photos.brighteon.com/thumbnail/ecd8b0ca-7564-4993-a676-bbe4aa21cffc" |
33 | alt="Firejail Demo" width="240" height="180" border="10" /><br/>Firejail Demo</a> | 33 | alt="Technology" width="240" height="142" border="10" /><br/>Technology</a> |
34 | </td> | 34 | </td> |
35 | 35 | ||
36 | <td> | 36 | <td> |
37 | <a href="http://www.youtube.com/watch?feature=player_embedded&v=EyEz65RYfw4 | 37 | <a href="https://www.brighteon.com/94ae1731-2352-4cda-bb48-7cc7a6ad32f8" target="_blank"> |
38 | " target="_blank"><img src="http://img.youtube.com/vi/EyEz65RYfw4/0.jpg" | 38 | <img src="https://photos.brighteon.com/thumbnail/5c90254c-61f3-4927-ac57-ae279dc543cf" |
39 | alt="Debian Install" width="240" height="180" border="10" /><br/>Debian Install</a> | 39 | alt="Deep Dive" width="240" height="142" border="10" /><br/>Deep Dive</a> |
40 | </td> | 40 | </td> |
41 | 41 | ||
42 | |||
43 | </tr><tr> | ||
44 | <td> | ||
45 | <a href="http://www.youtube.com/watch?feature=player_embedded&v=Uy2ZTHc4s0w | ||
46 | " target="_blank"><img src="http://img.youtube.com/vi/Uy2ZTHc4s0w/0.jpg" | ||
47 | alt="Arch Linux Install" width="240" height="180" border="10" /><br/>Arch Linux Install</a> | ||
48 | |||
49 | </td> | ||
50 | <td> | ||
51 | <a href="http://www.youtube.com/watch?feature=player_embedded&v=xuMxRx0zSfQ | ||
52 | " target="_blank"><img src="http://img.youtube.com/vi/xuMxRx0zSfQ/0.jpg" | ||
53 | alt="Disable Network Access" width="240" height="180" border="10" /><br/>Disable Network Access</a> | ||
54 | |||
55 | </td> | ||
56 | <td> | ||
57 | <a href="http://www.youtube.com/watch?feature=player_embedded&v=N-Mso2bSr3o | ||
58 | " target="_blank"><img src="http://img.youtube.com/vi/N-Mso2bSr3o/0.jpg" | ||
59 | alt="Firejail Security Deep Dive" width="240" height="180" border="10" /><br/>Firejail Security Deep Dive</a> | ||
60 | |||
61 | </td> | ||
62 | </tr></table> | 42 | </tr></table> |
63 | 43 | ||
64 | Project webpage: https://firejail.wordpress.com/ | 44 | Project webpage: https://firejail.wordpress.com/ |
@@ -116,7 +96,7 @@ https://unparalleled.eu/blog/2021/20210208-rigged-race-against-firejail-for-loca | |||
116 | 96 | ||
117 | Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Artix, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others. | 97 | Try installing Firejail from your system packages first. Firejail is included in Alpine, ALT Linux, Arch, Artix, Chakra, Debian, Deepin, Devuan, Fedora, Gentoo, Manjaro, Mint, NixOS, Parabola, Parrot, PCLinuxOS, ROSA, Solus, Slackware/SlackBuilds, Trisquel, Ubuntu, Void and possibly others. |
118 | 98 | ||
119 | The firejail 0.9.52-LTS version is deprecated. On Ubuntu 18.04 LTS users are advised to use the [PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail). On Debian buster we recommend to use the [backports](https://packages.debian.org/buster-backports/firejail) package. | 99 | The firejail 0.9.52-LTS version is deprecated. On Ubuntu 18.04 LTS users are advised to use the [PPA](https://launchpad.net/~deki/+archive/ubuntu/firejail). On Debian stable (bullseye) we recommend to use the [backports](https://packages.debian.org/bullseye-backports/firejail) package. |
120 | 100 | ||
121 | You can also install one of the [released packages](http://sourceforge.net/projects/firejail/files/firejail), or clone Firejail’s source code from our Git repository and compile manually: | 101 | You can also install one of the [released packages](http://sourceforge.net/projects/firejail/files/firejail), or clone Firejail’s source code from our Git repository and compile manually: |
122 | 102 | ||
@@ -239,32 +219,33 @@ A small tool to print profile statistics. Compile as usual and run in /etc/profi | |||
239 | $ sudo cp src/profstats/profstats /etc/firejail/. | 219 | $ sudo cp src/profstats/profstats /etc/firejail/. |
240 | $ cd /etc/firejail | 220 | $ cd /etc/firejail |
241 | $ ./profstats *.profile | 221 | $ ./profstats *.profile |
242 | profiles 1150 | 222 | profiles 1167 |
243 | include local profile 1150 (include profile-name.local) | 223 | include local profile 1167 (include profile-name.local) |
244 | include globals 1120 (include globals.local) | 224 | include globals 1136 (include globals.local) |
245 | blacklist ~/.ssh 1026 (include disable-common.inc) | 225 | blacklist ~/.ssh 1042 (include disable-common.inc) |
246 | seccomp 1050 | 226 | seccomp 1062 |
247 | capabilities 1146 | 227 | capabilities 1163 |
248 | noexec 1030 (include disable-exec.inc) | 228 | noexec 1049 (include disable-exec.inc) |
249 | noroot 959 | 229 | noroot 971 |
250 | memory-deny-write-execute 253 | 230 | memory-deny-write-execute 256 |
251 | apparmor 681 | 231 | apparmor 693 |
252 | private-bin 667 | 232 | private-bin 677 |
253 | private-dev 1009 | 233 | private-dev 1027 |
254 | private-etc 523 | 234 | private-etc 532 |
255 | private-tmp 883 | 235 | private-tmp 897 |
256 | whitelist home directory 547 | 236 | whitelist home directory 557 |
257 | whitelist var 818 (include whitelist-var-common.inc) | 237 | whitelist var 836 (include whitelist-var-common.inc) |
258 | whitelist run/user 616 (include whitelist-runuser-common.inc | 238 | whitelist run/user 1137 (include whitelist-runuser-common.inc |
259 | or blacklist ${RUNUSER}) | 239 | or blacklist ${RUNUSER}) |
260 | whitelist usr/share 591 (include whitelist-usr-share-common.inc | 240 | whitelist usr/share 609 (include whitelist-usr-share-common.inc |
261 | net none 391 | 241 | net none 396 |
262 | dbus-user none 641 | 242 | dbus-user none 656 |
263 | dbus-user filter 105 | 243 | dbus-user filter 108 |
264 | dbus-system none 792 | 244 | dbus-system none 808 |
265 | dbus-system filter 7 | 245 | dbus-system filter 10 |
266 | ``` | 246 | ``` |
267 | 247 | ||
268 | ### New profiles: | 248 | ### New profiles: |
269 | 249 | ||
270 | clion-eap, lifeograph, io.github.lainsce.Notejot, rednotebook, zim, microsoft-edge-beta, ncdu2, gallery-dl, yt-dlp | 250 | clion-eap, lifeograph, io.github.lainsce.Notejot, rednotebook, zim, microsoft-edge-beta, ncdu2, gallery-dl, yt-dlp, goldendict, bundle, |
251 | cmake, make, meson, pip, codium | ||
@@ -1,13 +1,16 @@ | |||
1 | firejail (0.9.67) baseline; urgency=low | 1 | firejail (0.9.67) baseline; urgency=low |
2 | * work in progress | 2 | * work in progress |
3 | * exit code: distinguish fatal signals by adding 128 | ||
3 | * deprecated --disable-whitelist at compile time | 4 | * deprecated --disable-whitelist at compile time |
4 | * deprecated whitelist=yes/no in /etc/firejail/firejail.config | 5 | * deprecated whitelist=yes/no in /etc/firejail/firejail.config |
6 | * new condition: ALLOW_TRAY | ||
5 | * remove (some) environment variables with auth-tokens | 7 | * remove (some) environment variables with auth-tokens |
6 | * new includes: whitelist-run-common.inc, disable-X11.inc | 8 | * new includes: whitelist-run-common.inc, disable-X11.inc |
7 | * removed includes: disable-passwordmgr.inc | 9 | * removed includes: disable-passwordmgr.inc |
8 | * new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim | 10 | * new profiles: microsoft-edge-beta, clion-eap, lifeograph, zim |
9 | * new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl | 11 | * new profiles: io.github.lainsce.Notejot, rednotebook, gallery-dl |
10 | * new profiles: yt-dlp | 12 | * new profiles: yt-dlp, goldendict, goldendict, bundle, cmake |
13 | * new profiles: make, meson, pip, codium | ||
11 | -- netblue30 <netblue30@yahoo.com> Thu, 29 Jul 2021 09:00:00 -0500 | 14 | -- netblue30 <netblue30@yahoo.com> Thu, 29 Jul 2021 09:00:00 -0500 |
12 | 15 | ||
13 | firejail (0.9.66) baseline; urgency=low | 16 | firejail (0.9.66) baseline; urgency=low |
@@ -59,7 +62,7 @@ firejail (0.9.64.4) baseline; urgency=low | |||
59 | 62 | ||
60 | firejail (0.9.64.2) baseline; urgency=low | 63 | firejail (0.9.64.2) baseline; urgency=low |
61 | * allow --tmpfs inside $HOME for unprivileged users | 64 | * allow --tmpfs inside $HOME for unprivileged users |
62 | * --disable-usertmpfs compile time option | 65 | * --disable-usertmpfs compile time option |
63 | * allow AF_BLUETOOTH via --protocol=bluetooth | 66 | * allow AF_BLUETOOTH via --protocol=bluetooth |
64 | * Setup guide for new users: contrib/firejail-welcome.sh | 67 | * Setup guide for new users: contrib/firejail-welcome.sh |
65 | * implement netns in profiles | 68 | * implement netns in profiles |
@@ -566,7 +569,7 @@ firejail (0.9.44) baseline; urgency=low | |||
566 | * feature: disable 3D hardware acceleration (--no3d) | 569 | * feature: disable 3D hardware acceleration (--no3d) |
567 | * feature: x11 xpra, x11 xephyr, x11 block, allusers, no3d profile commands | 570 | * feature: x11 xpra, x11 xephyr, x11 block, allusers, no3d profile commands |
568 | * feature: move files in sandbox (--put) | 571 | * feature: move files in sandbox (--put) |
569 | * feature: accept wildcard patterns in user name field of restricted | 572 | * feature: accept wildcard patterns in user name field of restricted |
570 | shell login feature | 573 | shell login feature |
571 | * new profiles: qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape | 574 | * new profiles: qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape |
572 | * new profiles: feh, ranger, zathura, 7z, keepass, keepassx, | 575 | * new profiles: feh, ranger, zathura, 7z, keepass, keepassx, |
@@ -608,7 +611,7 @@ firejail (0.9.42) baseline; urgency=low | |||
608 | * compile time: disable whitelisting (--disable-whitelist) | 611 | * compile time: disable whitelisting (--disable-whitelist) |
609 | * compile time: disable global config (--disable-globalcfg) | 612 | * compile time: disable global config (--disable-globalcfg) |
610 | * run time: enable/disable overlayfs (overlayfs yes/no) | 613 | * run time: enable/disable overlayfs (overlayfs yes/no) |
611 | * run time: enable/disable quiet as default (quiet-by-default yes/no) | 614 | * run time: enable/disable quiet as default (quiet-by-default yes/no) |
612 | * run time: user-defined network filter (netfilter-default) | 615 | * run time: user-defined network filter (netfilter-default) |
613 | * run time: enable/disable whitelisting (whitelist yes/no) | 616 | * run time: enable/disable whitelisting (whitelist yes/no) |
614 | * run time: enable/disable remounting of /proc and /sys | 617 | * run time: enable/disable remounting of /proc and /sys |
@@ -706,7 +709,7 @@ firejail (0.9.38) baseline; urgency=low | |||
706 | -- netblue30 <netblue30@yahoo.com> Tue, 2 Feb 2016 10:00:00 -0500 | 709 | -- netblue30 <netblue30@yahoo.com> Tue, 2 Feb 2016 10:00:00 -0500 |
707 | 710 | ||
708 | firejail (0.9.36) baseline; urgency=low | 711 | firejail (0.9.36) baseline; urgency=low |
709 | * added unbound, dnscrypt-proxy, BitlBee, HexChat, WeeChat, | 712 | * added unbound, dnscrypt-proxy, BitlBee, HexChat, WeeChat, |
710 | parole and rtorrent profiles | 713 | parole and rtorrent profiles |
711 | * Google Chrome profile rework | 714 | * Google Chrome profile rework |
712 | * added google-chrome-stable profile | 715 | * added google-chrome-stable profile |
diff --git a/SECURITY.md b/SECURITY.md index 7ec2940f6..ef9b9b5fb 100644 --- a/SECURITY.md +++ b/SECURITY.md | |||
@@ -2,24 +2,24 @@ | |||
2 | 2 | ||
3 | ## Supported Versions | 3 | ## Supported Versions |
4 | 4 | ||
5 | | Version | Supported by us | EOL | Supported by distribution | | 5 | | Version | Supported by us | EOL | Supported by distribution | |
6 | | ------- | ------------------ | ---- | ------------------------- | | 6 | | ------- | ------------------ | ------------------ | --------------------------------------------------------------------------------- | |
7 | | 0.9.66 | :heavy_check_mark: | | | | 7 | | 0.9.66 | :heavy_check_mark: | | :white_check_mark: Debian 11 **backports**, Debian 12 (testing/unstable) | |
8 | | 0.9.64 | :x: | | :white_check_mark: Debian 10 **backports**, Debian 11 **backports**, Debian 12 (testing/unstable) | | 8 | | 0.9.64 | :x: | | :white_check_mark: Debian 10 **backports**, Debian 11, Ubuntu 21.04, Ubuntu 21.10 | |
9 | | 0.9.62 | :x: | | :white_check_mark: Ubuntu 20.04 LTS, Ubuntu 20.10 | | 9 | | 0.9.62 | :x: | | :white_check_mark: Ubuntu 20.04 LTS, Ubuntu 20.10 | |
10 | | 0.9.60 | :x: | 29 Dec 2019 | | | 10 | | 0.9.60 | :x: | 29 Dec 2019 | | |
11 | | 0.9.58 | :x: | | :white_check_mark: Debian 9 **backports**, Debian 10 | | 11 | | 0.9.58 | :x: | | :white_check_mark: Debian 9 **backports**, Debian 10 | |
12 | | 0.9.56 | :x: | 27 Jan 2019 | | | 12 | | 0.9.56 | :x: | 27 Jan 2019 | | |
13 | | 0.9.54 | :x: | 18 Sep 2018 | | | 13 | | 0.9.54 | :x: | 18 Sep 2018 | | |
14 | | 0.9.52 | :x: | | :white_check_mark: Ubuntu 18.04 LTS | | 14 | | 0.9.52 | :x: | | :white_check_mark: Ubuntu 18.04 LTS | |
15 | | 0.9.50 | :x: | 12 Dec 2017 | | | 15 | | 0.9.50 | :x: | 12 Dec 2017 | | |
16 | | 0.9.48 | :x: | 09 Sep 2017 | | | 16 | | 0.9.48 | :x: | 09 Sep 2017 | | |
17 | | 0.9.46 | :x: | 12 Jun 2017 | | | 17 | | 0.9.46 | :x: | 12 Jun 2017 | | |
18 | | 0.9.44 | :x: | | :white_check_mark: Debian 9 | | 18 | | 0.9.44 | :x: | | :white_check_mark: Debian 9 | |
19 | | 0.9.42 | :x: | 22 Oct 2016 | | | 19 | | 0.9.42 | :x: | 22 Oct 2016 | | |
20 | | 0.9.40 | :x: | 09 Sep 2016 | | | 20 | | 0.9.40 | :x: | 09 Sep 2016 | | |
21 | | 0.9.38 | :x: | | :white_check_mark: Ubuntu 16.04 LTS | | 21 | | 0.9.38 | :x: | | :white_check_mark: Ubuntu 16.04 LTS | |
22 | | <0.9.38 | :x: | Before 05 Feb 2016 | | | 22 | | <0.9.38 | :x: | Before 05 Feb 2016 | | |
23 | 23 | ||
24 | ## Security vulnerabilities | 24 | ## Security vulnerabilities |
25 | 25 | ||
diff --git a/ci/check/profiles/private-etc-always-required.sh b/ci/check/profiles/private-etc-always-required.sh new file mode 100755 index 000000000..892b15aa4 --- /dev/null +++ b/ci/check/profiles/private-etc-always-required.sh | |||
@@ -0,0 +1,15 @@ | |||
1 | #!/bin/bash | ||
2 | |||
3 | ALWAYS_REQUIRED=(alternatives ld.so.cache ld.so.preload) | ||
4 | |||
5 | error=0 | ||
6 | while IFS=: read -r profile private_etc; do | ||
7 | for required in "${ALWAYS_REQUIRED[@]}"; do | ||
8 | if grep -q -v -E "( |,)$required(,|$)" <<<"$private_etc"; then | ||
9 | printf '%s misses %s\n' "$profile" "$required" >&2 | ||
10 | error=1 | ||
11 | fi | ||
12 | done | ||
13 | done < <(grep "^private-etc " "$@") | ||
14 | |||
15 | exit "$error" | ||
diff --git a/ci/check/profiles/sort-disable-programs.sh b/ci/check/profiles/sort-disable-programs.sh new file mode 100755 index 000000000..d81ee75d7 --- /dev/null +++ b/ci/check/profiles/sort-disable-programs.sh | |||
@@ -0,0 +1,2 @@ | |||
1 | #!/bin/sh | ||
2 | tail -n +5 "$1" | LC_ALL=C sort -c -u | ||
diff --git a/ci/check/profiles/sort-firecfg.config.sh b/ci/check/profiles/sort-firecfg.config.sh new file mode 100755 index 000000000..17a595350 --- /dev/null +++ b/ci/check/profiles/sort-firecfg.config.sh | |||
@@ -0,0 +1,2 @@ | |||
1 | #!/bin/sh | ||
2 | tail -n +4 "$1" | sed 's/^# /#/' | LC_ALL=C sort -c -d | ||
diff --git a/ci/check/profiles/sort.py b/ci/check/profiles/sort.py new file mode 120000 index 000000000..e1f3f5f16 --- /dev/null +++ b/ci/check/profiles/sort.py | |||
@@ -0,0 +1 @@ | |||
../../../contrib/sort.py \ No newline at end of file | |||
@@ -711,6 +711,7 @@ ac_subst_files='' | |||
711 | ac_user_opts=' | 711 | ac_user_opts=' |
712 | enable_option_checking | 712 | enable_option_checking |
713 | enable_analyzer | 713 | enable_analyzer |
714 | enable_sanitizer | ||
714 | enable_apparmor | 715 | enable_apparmor |
715 | enable_selinux | 716 | enable_selinux |
716 | enable_dbusproxy | 717 | enable_dbusproxy |
@@ -1368,6 +1369,8 @@ Optional Features: | |||
1368 | --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) | 1369 | --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) |
1369 | --enable-FEATURE[=ARG] include FEATURE [ARG=yes] | 1370 | --enable-FEATURE[=ARG] include FEATURE [ARG=yes] |
1370 | --enable-analyzer enable GCC static analyzer | 1371 | --enable-analyzer enable GCC static analyzer |
1372 | --enable-sanitizer=[address | memory | undefined] | ||
1373 | enable a compiler-based sanitizer (debug) | ||
1371 | --enable-apparmor enable apparmor | 1374 | --enable-apparmor enable apparmor |
1372 | --enable-selinux SELinux labeling support | 1375 | --enable-selinux SELinux labeling support |
1373 | --disable-dbusproxy disable dbus proxy | 1376 | --disable-dbusproxy disable dbus proxy |
@@ -3294,6 +3297,57 @@ if test "x$enable_analyzer" = "xyes"; then : | |||
3294 | 3297 | ||
3295 | fi | 3298 | fi |
3296 | 3299 | ||
3300 | # Check whether --enable-sanitizer was given. | ||
3301 | if test "${enable_sanitizer+set}" = set; then : | ||
3302 | enableval=$enable_sanitizer; | ||
3303 | else | ||
3304 | enable_sanitizer=no | ||
3305 | fi | ||
3306 | |||
3307 | if test "x$enable_sanitizer" != "xno" ; then : | ||
3308 | as_CACHEVAR=`$as_echo "ax_cv_check_cflags__-fsanitize=$enable_sanitizer" | $as_tr_sh` | ||
3309 | { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether C compiler accepts -fsanitize=$enable_sanitizer" >&5 | ||
3310 | $as_echo_n "checking whether C compiler accepts -fsanitize=$enable_sanitizer... " >&6; } | ||
3311 | if eval \${$as_CACHEVAR+:} false; then : | ||
3312 | $as_echo_n "(cached) " >&6 | ||
3313 | else | ||
3314 | |||
3315 | ax_check_save_flags=$CFLAGS | ||
3316 | CFLAGS="$CFLAGS -fsanitize=$enable_sanitizer" | ||
3317 | cat confdefs.h - <<_ACEOF >conftest.$ac_ext | ||
3318 | /* end confdefs.h. */ | ||
3319 | |||
3320 | int | ||
3321 | main () | ||
3322 | { | ||
3323 | |||
3324 | ; | ||
3325 | return 0; | ||
3326 | } | ||
3327 | _ACEOF | ||
3328 | if ac_fn_c_try_compile "$LINENO"; then : | ||
3329 | eval "$as_CACHEVAR=yes" | ||
3330 | else | ||
3331 | eval "$as_CACHEVAR=no" | ||
3332 | fi | ||
3333 | rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | ||
3334 | CFLAGS=$ax_check_save_flags | ||
3335 | fi | ||
3336 | eval ac_res=\$$as_CACHEVAR | ||
3337 | { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 | ||
3338 | $as_echo "$ac_res" >&6; } | ||
3339 | if eval test \"x\$"$as_CACHEVAR"\" = x"yes"; then : | ||
3340 | |||
3341 | EXTRA_CFLAGS="$EXTRA_CFLAGS -fsanitize=$enable_sanitizer -fno-omit-frame-pointer" | ||
3342 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS -fsanitize=$enable_sanitizer" | ||
3343 | |||
3344 | else | ||
3345 | as_fn_error $? "sanitizer not supported: $enable_sanitizer" "$LINENO" 5 | ||
3346 | |||
3347 | fi | ||
3348 | |||
3349 | fi | ||
3350 | |||
3297 | HAVE_APPARMOR="" | 3351 | HAVE_APPARMOR="" |
3298 | # Check whether --enable-apparmor was given. | 3352 | # Check whether --enable-apparmor was given. |
3299 | if test "${enable_apparmor+set}" = set; then : | 3353 | if test "${enable_apparmor+set}" = set; then : |
@@ -3549,7 +3603,7 @@ if test "x$enable_dbusproxy" != "xno"; then : | |||
3549 | 3603 | ||
3550 | fi | 3604 | fi |
3551 | 3605 | ||
3552 | # overlayfs features temporarely disabled pending fixes | 3606 | # overlayfs features temporarily disabled pending fixes |
3553 | HAVE_OVERLAYFS="" | 3607 | HAVE_OVERLAYFS="" |
3554 | 3608 | ||
3555 | # | 3609 | # |
diff --git a/configure.ac b/configure.ac index 7879a5239..fc5823143 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -45,6 +45,15 @@ AS_IF([test "x$enable_analyzer" = "xyes"], [ | |||
45 | EXTRA_CFLAGS="$EXTRA_CFLAGS -fanalyzer -Wno-analyzer-malloc-leak" | 45 | EXTRA_CFLAGS="$EXTRA_CFLAGS -fanalyzer -Wno-analyzer-malloc-leak" |
46 | ]) | 46 | ]) |
47 | 47 | ||
48 | AC_ARG_ENABLE([sanitizer], | ||
49 | AS_HELP_STRING([--enable-sanitizer=@<:@address | memory | undefined@:>@], [enable a compiler-based sanitizer (debug)]), [], [enable_sanitizer=no]) | ||
50 | AS_IF([test "x$enable_sanitizer" != "xno" ], | ||
51 | [AX_CHECK_COMPILE_FLAG([-fsanitize=$enable_sanitizer], [ | ||
52 | EXTRA_CFLAGS="$EXTRA_CFLAGS -fsanitize=$enable_sanitizer -fno-omit-frame-pointer" | ||
53 | EXTRA_LDFLAGS="$EXTRA_LDFLAGS -fsanitize=$enable_sanitizer" | ||
54 | ], [AC_MSG_ERROR([sanitizer not supported: $enable_sanitizer])] | ||
55 | )]) | ||
56 | |||
48 | HAVE_APPARMOR="" | 57 | HAVE_APPARMOR="" |
49 | AC_ARG_ENABLE([apparmor], | 58 | AC_ARG_ENABLE([apparmor], |
50 | AS_HELP_STRING([--enable-apparmor], [enable apparmor])) | 59 | AS_HELP_STRING([--enable-apparmor], [enable apparmor])) |
@@ -76,7 +85,7 @@ AS_IF([test "x$enable_dbusproxy" != "xno"], [ | |||
76 | AC_SUBST(HAVE_DBUSPROXY) | 85 | AC_SUBST(HAVE_DBUSPROXY) |
77 | ]) | 86 | ]) |
78 | 87 | ||
79 | # overlayfs features temporarely disabled pending fixes | 88 | # overlayfs features temporarily disabled pending fixes |
80 | HAVE_OVERLAYFS="" | 89 | HAVE_OVERLAYFS="" |
81 | AC_SUBST(HAVE_OVERLAYFS) | 90 | AC_SUBST(HAVE_OVERLAYFS) |
82 | # | 91 | # |
diff --git a/contrib/fix_private-bin.py b/contrib/fix_private-bin.py index 12b596749..961646aa4 100755 --- a/contrib/fix_private-bin.py +++ b/contrib/fix_private-bin.py | |||
@@ -164,7 +164,7 @@ def printHelp(): | |||
164 | 164 | ||
165 | 165 | ||
166 | def main() -> None: | 166 | def main() -> None: |
167 | """The main function. Parses the commandline args, shows messages and calles the function actually doing the work.""" | 167 | """The main function. Parses the commandline args, shows messages and calls the function actually doing the work.""" |
168 | if len(sys.argv) > 2 or (len(sys.argv) == 2 and | 168 | if len(sys.argv) > 2 or (len(sys.argv) == 2 and |
169 | (sys.argv[1] == "-h" or sys.argv[1] == "--help")): | 169 | (sys.argv[1] == "-h" or sys.argv[1] == "--help")): |
170 | printHelp() | 170 | printHelp() |
diff --git a/contrib/gdb-firejail.sh b/contrib/gdb-firejail.sh index 941fc45ef..686bdc2c0 100755 --- a/contrib/gdb-firejail.sh +++ b/contrib/gdb-firejail.sh | |||
@@ -21,4 +21,4 @@ else | |||
21 | fi | 21 | fi |
22 | 22 | ||
23 | bash -c "kill -STOP \$\$; exec \"\$0\" \"\$@\"" "$@" & | 23 | bash -c "kill -STOP \$\$; exec \"\$0\" \"\$@\"" "$@" & |
24 | sudo gdb -e "$FIREJAIL" -p "$!" | 24 | sudo gdb -e "$FIREJAIL" -p "$!" |
diff --git a/contrib/sort.py b/contrib/sort.py index d7a2cd05d..4af9c674c 100755 --- a/contrib/sort.py +++ b/contrib/sort.py | |||
@@ -34,7 +34,7 @@ def sort_alphabetical(raw_items): | |||
34 | 34 | ||
35 | 35 | ||
36 | def sort_protocol(protocols): | 36 | def sort_protocol(protocols): |
37 | """sort the given protocole into this scheme: unix,inet,inet6,netlink,packet,bluetooth""" | 37 | """sort the given protocols into this scheme: unix,inet,inet6,netlink,packet,bluetooth""" |
38 | 38 | ||
39 | # shortcut for common protocol lines | 39 | # shortcut for common protocol lines |
40 | if protocols in ("unix", "unix,inet,inet6"): | 40 | if protocols in ("unix", "unix,inet,inet6"): |
diff --git a/contrib/vim/syntax/firejail.vim b/contrib/vim/syntax/firejail.vim index d07690ee2..fa80a9c00 100644 --- a/contrib/vim/syntax/firejail.vim +++ b/contrib/vim/syntax/firejail.vim | |||
@@ -72,7 +72,7 @@ syn match fjCommandNoCond /quiet$/ contained | |||
72 | 72 | ||
73 | " Conditionals grabbed from: src/firejail/profile.c | 73 | " Conditionals grabbed from: src/firejail/profile.c |
74 | " Generate list with: awk -- 'BEGIN {process=0;} /^Cond conditionals\[\] = \{$/ {process=1;} /\t*\{"[^"]+".*/ { if (process) {print gensub(/^\t*\{"([^"]+)".*$/, "\\1", 1);} } /^\t\{ NULL, NULL \}$/ {process=0;}' src/firejail/profile.c | sort -u | tr $'\n' '|' | 74 | " Generate list with: awk -- 'BEGIN {process=0;} /^Cond conditionals\[\] = \{$/ {process=1;} /\t*\{"[^"]+".*/ { if (process) {print gensub(/^\t*\{"([^"]+)".*$/, "\\1", 1);} } /^\t\{ NULL, NULL \}$/ {process=0;}' src/firejail/profile.c | sort -u | tr $'\n' '|' |
75 | syn match fjConditional /\v\?(BROWSER_ALLOW_DRM|BROWSER_DISABLE_U2F|HAS_APPIMAGE|HAS_NET|HAS_NODBUS|HAS_NOSOUND|HAS_X11) ?:/ nextgroup=fjCommand skipwhite contained | 75 | syn match fjConditional /\v\?(ALLOW_TRAY|BROWSER_ALLOW_DRM|BROWSER_DISABLE_U2F|HAS_APPIMAGE|HAS_NET|HAS_NODBUS|HAS_NOSOUND|HAS_X11) ?:/ nextgroup=fjCommand skipwhite contained |
76 | 76 | ||
77 | " A line is either a command, a conditional or a comment | 77 | " A line is either a command, a conditional or a comment |
78 | syn match fjStatement /^/ nextgroup=fjCommand,fjCommandNoCond,fjConditional,fjComment | 78 | syn match fjStatement /^/ nextgroup=fjCommand,fjCommandNoCond,fjConditional,fjComment |
diff --git a/etc-fixes/0.9.58/atom.profile b/etc-fixes/0.9.58/atom.profile index 9bc35da5a..1cc9b0116 100644 --- a/etc-fixes/0.9.58/atom.profile +++ b/etc-fixes/0.9.58/atom.profile | |||
@@ -1,4 +1,3 @@ | |||
1 | |||
2 | # Firejail profile for atom | 1 | # Firejail profile for atom |
3 | # Description: A hackable text editor for the 21st Century | 2 | # Description: A hackable text editor for the 21st Century |
4 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
diff --git a/etc-fixes/seccomp-join-bug/README b/etc-fixes/seccomp-join-bug/README index 9f85a0e00..15596eca7 100644 --- a/etc-fixes/seccomp-join-bug/README +++ b/etc-fixes/seccomp-join-bug/README | |||
@@ -8,4 +8,3 @@ on May 21, 2019: | |||
8 | 8 | ||
9 | The original discussion thread: https://github.com/netblue30/firejail/issues/2718 | 9 | The original discussion thread: https://github.com/netblue30/firejail/issues/2718 |
10 | The fix on mainline: https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134 | 10 | The fix on mainline: https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134 |
11 | |||
diff --git a/etc/apparmor/firejail-base b/etc/apparmor/firejail-base new file mode 100644 index 000000000..6e286d4af --- /dev/null +++ b/etc/apparmor/firejail-base | |||
@@ -0,0 +1,27 @@ | |||
1 | ######################################### | ||
2 | # Firejail base abstraction drop-in | ||
3 | # | ||
4 | # Adds basic Firejail support to AppArmor profiles. | ||
5 | # Please note: Firejail's nonewprivs and seccomp options | ||
6 | # are not compatible with AppArmor profile transitions. | ||
7 | # Also there is no support for Firejail chroot options. | ||
8 | ######################################### | ||
9 | |||
10 | # Discovery of process names | ||
11 | owner /proc/@{pid}/comm r, | ||
12 | |||
13 | ########## | ||
14 | # Following paths only exist inside a Firejail sandbox | ||
15 | ########## | ||
16 | |||
17 | # Library preloading | ||
18 | /{,var/}run/firejail/lib/*.so mr, | ||
19 | |||
20 | # Supporting seccomp | ||
21 | owner /{,var/}run/firejail/mnt/seccomp/seccomp.postexec r, | ||
22 | |||
23 | # Supporting trace | ||
24 | owner /{,var/}run/firejail/mnt/trace w, | ||
25 | |||
26 | # Supporting tracelog | ||
27 | /{,var/}run/firejail/mnt/fslogger r, | ||
diff --git a/etc/apparmor/firejail-default b/etc/apparmor/firejail-default index ca32f5b0d..a7044152e 100644 --- a/etc/apparmor/firejail-default +++ b/etc/apparmor/firejail-default | |||
@@ -129,7 +129,7 @@ signal (receive), | |||
129 | ########## | 129 | ########## |
130 | # The list of recognized capabilities varies from one apparmor version to another. | 130 | # The list of recognized capabilities varies from one apparmor version to another. |
131 | # For example on Debian 10 (apparmor 2.13.2) checkpoint_restore, perfmon, bpf are not available | 131 | # For example on Debian 10 (apparmor 2.13.2) checkpoint_restore, perfmon, bpf are not available |
132 | # We allow all caps by default and remove the ones we don't like: | 132 | # We allow all caps by default and remove the ones we don't like: |
133 | capability, | 133 | capability, |
134 | deny capability audit_write, | 134 | deny capability audit_write, |
135 | deny capability audit_control, | 135 | deny capability audit_control, |
diff --git a/etc/firejail.config b/etc/firejail.config index 2e355586b..7912b746c 100644 --- a/etc/firejail.config +++ b/etc/firejail.config | |||
@@ -2,6 +2,9 @@ | |||
2 | # keyword-argument pairs, one per line. Most features are enabled by default. | 2 | # keyword-argument pairs, one per line. Most features are enabled by default. |
3 | # Use 'yes' or 'no' as configuration values. | 3 | # Use 'yes' or 'no' as configuration values. |
4 | 4 | ||
5 | # Allow programs to display a tray icon | ||
6 | # allow-tray no | ||
7 | |||
5 | # Enable AppArmor functionality, default enabled. | 8 | # Enable AppArmor functionality, default enabled. |
6 | # apparmor yes | 9 | # apparmor yes |
7 | 10 | ||
@@ -63,7 +66,7 @@ | |||
63 | # a file argument, the default filter is hardcoded (see man 1 firejail). This | 66 | # a file argument, the default filter is hardcoded (see man 1 firejail). This |
64 | # configuration entry allows the user to change the default by specifying | 67 | # configuration entry allows the user to change the default by specifying |
65 | # a file containing the filter configuration. The filter file format is the | 68 | # a file containing the filter configuration. The filter file format is the |
66 | # format of iptables-save and iptable-restore commands. Example: | 69 | # format of iptables-save and iptables-restore commands. Example: |
67 | # netfilter-default /etc/iptables.iptables.rules | 70 | # netfilter-default /etc/iptables.iptables.rules |
68 | 71 | ||
69 | # Enable or disable networking features, default enabled. | 72 | # Enable or disable networking features, default enabled. |
diff --git a/etc/ids.config b/etc/ids.config index 09b0ae912..ff55416ca 100644 --- a/etc/ids.config +++ b/etc/ids.config | |||
@@ -37,6 +37,7 @@ include ids.config.local | |||
37 | 37 | ||
38 | ### shells local ### | 38 | ### shells local ### |
39 | # bash | 39 | # bash |
40 | ${HOME}/.bash_aliases | ||
40 | ${HOME}/.bash_login | 41 | ${HOME}/.bash_login |
41 | ${HOME}/.bash_logout | 42 | ${HOME}/.bash_logout |
42 | ${HOME}/.bash_profile | 43 | ${HOME}/.bash_profile |
@@ -99,10 +100,24 @@ ${HOME}/.xsessionrc | |||
99 | ### window/desktop manager ### | 100 | ### window/desktop manager ### |
100 | ${HOME}/Desktop/*.desktop | 101 | ${HOME}/Desktop/*.desktop |
101 | ${HOME}/.config/autostart | 102 | ${HOME}/.config/autostart |
103 | ${HOME}/.config/autostart-scripts | ||
102 | ${HOME}/.config/lxsession/LXDE/autostart | 104 | ${HOME}/.config/lxsession/LXDE/autostart |
105 | ${HOME}/.config/openbox/autostart | ||
106 | ${HOME}/.config/openbox/environment | ||
107 | ${HOME}/.config/plasma-workspace/env | ||
108 | ${HOME}/.config/plasma-workspace/shutdown | ||
103 | ${HOME}/.gnomerc | 109 | ${HOME}/.gnomerc |
104 | ${HOME}/.gtkrc | 110 | ${HOME}/.gtkrc |
111 | ${HOME}/.kde/Autostart | ||
112 | ${HOME}/.kde/env | ||
113 | ${HOME}/.kde/share/autostart | ||
114 | ${HOME}/.kde/shutdown | ||
115 | ${HOME}/.kde4/Autostart | ||
116 | ${HOME}/.kde4/env | ||
117 | ${HOME}/.kde4/share/autostart | ||
118 | ${HOME}/.kde4/shutdown | ||
105 | ${HOME}/.kderc | 119 | ${HOME}/.kderc |
120 | ${HOME}/.local/share/autostart | ||
106 | 121 | ||
107 | ### security ### | 122 | ### security ### |
108 | /etc/aide | 123 | /etc/aide |
@@ -123,6 +138,7 @@ ${HOME}/.kderc | |||
123 | /etc/tripwire | 138 | /etc/tripwire |
124 | ${HOME}/.config/firejail | 139 | ${HOME}/.config/firejail |
125 | ${HOME}/.gnupg | 140 | ${HOME}/.gnupg |
141 | ${HOME}/.pam_environment | ||
126 | 142 | ||
127 | ### network security ### | 143 | ### network security ### |
128 | /etc/ca-certificates* | 144 | /etc/ca-certificates* |
diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc index 011bbe226..4e460fc10 100644 --- a/etc/inc/allow-common-devel.inc +++ b/etc/inc/allow-common-devel.inc | |||
@@ -27,5 +27,8 @@ noblacklist ${HOME}/.python-history | |||
27 | noblacklist ${HOME}/.python_history | 27 | noblacklist ${HOME}/.python_history |
28 | noblacklist ${HOME}/.pythonhist | 28 | noblacklist ${HOME}/.pythonhist |
29 | 29 | ||
30 | # Ruby | ||
31 | noblacklist ${HOME}/.bundle | ||
32 | |||
30 | # Rust | 33 | # Rust |
31 | noblacklist ${HOME}/.cargo/* | 34 | noblacklist ${HOME}/.cargo |
diff --git a/etc/inc/allow-ruby.inc b/etc/inc/allow-ruby.inc index a8c701219..00276cac7 100644 --- a/etc/inc/allow-ruby.inc +++ b/etc/inc/allow-ruby.inc | |||
@@ -4,3 +4,4 @@ include allow-ruby.local | |||
4 | 4 | ||
5 | noblacklist ${PATH}/ruby | 5 | noblacklist ${PATH}/ruby |
6 | noblacklist /usr/lib/ruby | 6 | noblacklist /usr/lib/ruby |
7 | noblacklist /usr/lib64/ruby | ||
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index ae84ee38a..f3d685d18 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -458,7 +458,7 @@ blacklist /sbin | |||
458 | blacklist /usr/local/sbin | 458 | blacklist /usr/local/sbin |
459 | blacklist /usr/sbin | 459 | blacklist /usr/sbin |
460 | 460 | ||
461 | # system management | 461 | # system management and various SUID executables |
462 | blacklist ${PATH}/at | 462 | blacklist ${PATH}/at |
463 | blacklist ${PATH}/busybox | 463 | blacklist ${PATH}/busybox |
464 | blacklist ${PATH}/chage | 464 | blacklist ${PATH}/chage |
@@ -493,6 +493,12 @@ blacklist ${PATH}/umount | |||
493 | blacklist ${PATH}/unix_chkpwd | 493 | blacklist ${PATH}/unix_chkpwd |
494 | blacklist ${PATH}/xev | 494 | blacklist ${PATH}/xev |
495 | blacklist ${PATH}/xinput | 495 | blacklist ${PATH}/xinput |
496 | blacklist /usr/lib/openssh/ssh-keysign | ||
497 | blacklist ${PATH}/passwd | ||
498 | blacklist /usr/lib/xorg/Xorg.wrap | ||
499 | blacklist /usr/lib/policykit-1/polkit-agent-helper-1 | ||
500 | blacklist /usr/lib/dbus-1.0/dbus-daemon-launch-helper | ||
501 | blacklist /usr/lib/eject/dmcrypt-get-device | ||
496 | 502 | ||
497 | # other SUID binaries | 503 | # other SUID binaries |
498 | blacklist /usr/lib/virtualbox | 504 | blacklist /usr/lib/virtualbox |
diff --git a/etc/inc/disable-devel.inc b/etc/inc/disable-devel.inc index e74b1b40b..98bf5ecc8 100644 --- a/etc/inc/disable-devel.inc +++ b/etc/inc/disable-devel.inc | |||
@@ -60,9 +60,7 @@ blacklist /usr/lib/tcc | |||
60 | blacklist ${PATH}/valgrind* | 60 | blacklist ${PATH}/valgrind* |
61 | blacklist /usr/lib/valgrind | 61 | blacklist /usr/lib/valgrind |
62 | 62 | ||
63 | |||
64 | # Source-Code | 63 | # Source-Code |
65 | |||
66 | blacklist /usr/src | 64 | blacklist /usr/src |
67 | blacklist /usr/local/src | 65 | blacklist /usr/local/src |
68 | blacklist /usr/include | 66 | blacklist /usr/include |
diff --git a/etc/inc/disable-exec.inc b/etc/inc/disable-exec.inc index 9b5c40a2b..d7dcef7e7 100644 --- a/etc/inc/disable-exec.inc +++ b/etc/inc/disable-exec.inc | |||
@@ -6,6 +6,7 @@ noexec ${HOME} | |||
6 | noexec ${RUNUSER} | 6 | noexec ${RUNUSER} |
7 | noexec /dev/mqueue | 7 | noexec /dev/mqueue |
8 | noexec /dev/shm | 8 | noexec /dev/shm |
9 | noexec /run/shm | ||
9 | noexec /tmp | 10 | noexec /tmp |
10 | # /var is noexec by default for unprivileged users | 11 | # /var is noexec by default for unprivileged users |
11 | # except there is a writable-var option, so just in case: | 12 | # except there is a writable-var option, so just in case: |
diff --git a/etc/inc/disable-interpreters.inc b/etc/inc/disable-interpreters.inc index 5d8a236fb..804869e2a 100644 --- a/etc/inc/disable-interpreters.inc +++ b/etc/inc/disable-interpreters.inc | |||
@@ -48,6 +48,7 @@ blacklist /usr/share/php* | |||
48 | # Ruby | 48 | # Ruby |
49 | blacklist ${PATH}/ruby | 49 | blacklist ${PATH}/ruby |
50 | blacklist /usr/lib/ruby | 50 | blacklist /usr/lib/ruby |
51 | blacklist /usr/lib64/ruby | ||
51 | 52 | ||
52 | # Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus | 53 | # Programs using python: deluge, firefox addons, filezilla, cherrytree, xchat, hexchat, libreoffice, scribus |
53 | # Python 2 | 54 | # Python 2 |
diff --git a/etc/inc/disable-proc.inc b/etc/inc/disable-proc.inc new file mode 100644 index 000000000..81a8883f3 --- /dev/null +++ b/etc/inc/disable-proc.inc | |||
@@ -0,0 +1,82 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include disable-proc.local | ||
4 | |||
5 | blacklist /proc/acpi | ||
6 | blacklist /proc/asound | ||
7 | blacklist /proc/bootconfig | ||
8 | blacklist /proc/buddyinfo | ||
9 | blacklist /proc/cgroups | ||
10 | blacklist /proc/cmdline | ||
11 | blacklist /proc/config.gz | ||
12 | blacklist /proc/consoles | ||
13 | #blacklist /proc/cpuinfo | ||
14 | blacklist /proc/crypto | ||
15 | blacklist /proc/devices | ||
16 | blacklist /proc/diskstats | ||
17 | blacklist /proc/dma | ||
18 | #blacklist /proc/driver | ||
19 | blacklist /proc/dynamic_debug | ||
20 | blacklist /proc/execdomains | ||
21 | blacklist /proc/fb | ||
22 | #blacklist /proc/filesystems | ||
23 | blacklist /proc/fs | ||
24 | blacklist /proc/i8k | ||
25 | blacklist /proc/interrupts | ||
26 | blacklist /proc/iomem | ||
27 | blacklist /proc/ioports | ||
28 | blacklist /proc/irq | ||
29 | blacklist /proc/kallsyms | ||
30 | blacklist /proc/kcore | ||
31 | blacklist /proc/keys | ||
32 | blacklist /proc/key-users | ||
33 | blacklist /proc/kmsg | ||
34 | blacklist /proc/kpagecgroup | ||
35 | blacklist /proc/kpagecount | ||
36 | blacklist /proc/kpageflags | ||
37 | blacklist /proc/latency_stats | ||
38 | #blacklist /proc/loadavg | ||
39 | blacklist /proc/locks | ||
40 | blacklist /proc/mdstat | ||
41 | #blacklist /proc/meminfo | ||
42 | blacklist /proc/misc | ||
43 | #blacklist /proc/modules | ||
44 | #blacklist /proc/mounts | ||
45 | blacklist /proc/mtrr | ||
46 | #blacklist /proc/net | ||
47 | blacklist /proc/partitions | ||
48 | blacklist /proc/pressure | ||
49 | blacklist /proc/sched_debug | ||
50 | blacklist /proc/schedstat | ||
51 | blacklist /proc/scsi | ||
52 | #blacklist /proc/self | ||
53 | blacklist /proc/slabinfo | ||
54 | blacklist /proc/softirqs | ||
55 | blacklist /proc/spl | ||
56 | #blacklist /proc/stat | ||
57 | blacklist /proc/swaps | ||
58 | #blacklist /proc/sys | ||
59 | blacklist /proc/sysrq-trigger | ||
60 | blacklist /proc/sysvipc | ||
61 | #blacklist /proc/thread-self | ||
62 | blacklist /proc/timer_list | ||
63 | blacklist /proc/tty | ||
64 | #blacklist /proc/uptime | ||
65 | #blacklist /proc/version | ||
66 | blacklist /proc/version_signature | ||
67 | blacklist /proc/vmallocinfo | ||
68 | #blacklist /proc/vmstat | ||
69 | #blacklist /proc/zoneinfo | ||
70 | |||
71 | blacklist /proc/sys/abi | ||
72 | blacklist /proc/sys/crypto | ||
73 | blacklist /proc/sys/debug | ||
74 | blacklist /proc/sys/dev | ||
75 | blacklist /proc/sys/fs | ||
76 | blacklist /proc/sys/net | ||
77 | blacklist /proc/sys/user | ||
78 | blacklist /proc/sys/vm | ||
79 | |||
80 | noblacklist /proc/sys/kernel/osrelease | ||
81 | noblacklist /proc/sys/kernel/yama | ||
82 | blacklist /proc/sys/*/* | ||
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 4941630a2..e78f15e10 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -49,11 +49,184 @@ blacklist ${HOME}/.bibletime | |||
49 | blacklist ${HOME}/.bitcoin | 49 | blacklist ${HOME}/.bitcoin |
50 | blacklist ${HOME}/.blobby | 50 | blacklist ${HOME}/.blobby |
51 | blacklist ${HOME}/.bogofilter | 51 | blacklist ${HOME}/.bogofilter |
52 | blacklist ${HOME}/.bundle | ||
52 | blacklist ${HOME}/.bzf | 53 | blacklist ${HOME}/.bzf |
53 | blacklist ${HOME}/.cargo/* | 54 | blacklist ${HOME}/.cache/0ad |
55 | blacklist ${HOME}/.cache/8pecxstudios | ||
56 | blacklist ${HOME}/.cache/Authenticator | ||
57 | blacklist ${HOME}/.cache/BraveSoftware | ||
58 | blacklist ${HOME}/.cache/Clementine | ||
59 | blacklist ${HOME}/.cache/ENCOM/Spectral | ||
60 | blacklist ${HOME}/.cache/Enox | ||
61 | blacklist ${HOME}/.cache/Enpass | ||
62 | blacklist ${HOME}/.cache/Ferdi | ||
63 | blacklist ${HOME}/.cache/Flavio Tordini | ||
64 | blacklist ${HOME}/.cache/Franz | ||
65 | blacklist ${HOME}/.cache/GoldenDict | ||
66 | blacklist ${HOME}/.cache/INRIA | ||
67 | blacklist ${HOME}/.cache/INRIA/Natron | ||
68 | blacklist ${HOME}/.cache/JetBrains/CLion* | ||
69 | blacklist ${HOME}/.cache/KDE/neochat | ||
70 | blacklist ${HOME}/.cache/Mendeley Ltd. | ||
71 | blacklist ${HOME}/.cache/MusicBrainz | ||
72 | blacklist ${HOME}/.cache/NewsFlashGTK | ||
73 | blacklist ${HOME}/.cache/Otter | ||
74 | blacklist ${HOME}/.cache/PawelStolowski | ||
75 | blacklist ${HOME}/.cache/Psi | ||
76 | blacklist ${HOME}/.cache/QuiteRss | ||
77 | blacklist ${HOME}/.cache/Quotient/quaternion | ||
78 | blacklist ${HOME}/.cache/Shortwave | ||
79 | blacklist ${HOME}/.cache/Tox | ||
80 | blacklist ${HOME}/.cache/Zeal | ||
81 | blacklist ${HOME}/.cache/agenda | ||
82 | blacklist ${HOME}/.cache/akonadi* | ||
83 | blacklist ${HOME}/.cache/atril | ||
84 | blacklist ${HOME}/.cache/attic | ||
85 | blacklist ${HOME}/.cache/babl | ||
86 | blacklist ${HOME}/.cache/bnox | ||
87 | blacklist ${HOME}/.cache/borg | ||
88 | blacklist ${HOME}/.cache/calibre | ||
89 | blacklist ${HOME}/.cache/cantata | ||
90 | blacklist ${HOME}/.cache/champlain | ||
91 | blacklist ${HOME}/.cache/chromium | ||
92 | blacklist ${HOME}/.cache/chromium-dev | ||
93 | blacklist ${HOME}/.cache/cliqz | ||
94 | blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate | ||
95 | blacklist ${HOME}/.cache/darktable | ||
96 | blacklist ${HOME}/.cache/deja-dup | ||
97 | blacklist ${HOME}/.cache/discover | ||
98 | blacklist ${HOME}/.cache/dnox | ||
99 | blacklist ${HOME}/.cache/dolphin | ||
100 | blacklist ${HOME}/.cache/dolphin-emu | ||
101 | blacklist ${HOME}/.cache/ephemeral | ||
102 | blacklist ${HOME}/.cache/epiphany | ||
103 | blacklist ${HOME}/.cache/evolution | ||
104 | blacklist ${HOME}/.cache/falkon | ||
105 | blacklist ${HOME}/.cache/feedreader | ||
106 | blacklist ${HOME}/.cache/firedragon | ||
107 | blacklist ${HOME}/.cache/flaska.net/trojita | ||
108 | blacklist ${HOME}/.cache/folks | ||
109 | blacklist ${HOME}/.cache/font-manager | ||
110 | blacklist ${HOME}/.cache/fossamail | ||
111 | blacklist ${HOME}/.cache/fractal | ||
112 | blacklist ${HOME}/.cache/freecol | ||
113 | blacklist ${HOME}/.cache/gajim | ||
114 | blacklist ${HOME}/.cache/geary | ||
115 | blacklist ${HOME}/.cache/geeqie | ||
116 | blacklist ${HOME}/.cache/gegl-0.4 | ||
117 | blacklist ${HOME}/.cache/gfeeds | ||
118 | blacklist ${HOME}/.cache/gimp | ||
119 | blacklist ${HOME}/.cache/gnome-boxes | ||
120 | blacklist ${HOME}/.cache/gnome-builder | ||
121 | blacklist ${HOME}/.cache/gnome-control-center | ||
122 | blacklist ${HOME}/.cache/gnome-recipes | ||
123 | blacklist ${HOME}/.cache/gnome-screenshot | ||
124 | blacklist ${HOME}/.cache/gnome-software | ||
125 | blacklist ${HOME}/.cache/gnome-twitch | ||
126 | blacklist ${HOME}/.cache/godot | ||
127 | blacklist ${HOME}/.cache/google-chrome | ||
128 | blacklist ${HOME}/.cache/google-chrome-beta | ||
129 | blacklist ${HOME}/.cache/google-chrome-unstable | ||
130 | blacklist ${HOME}/.cache/gradio | ||
131 | blacklist ${HOME}/.cache/gummi | ||
132 | blacklist ${HOME}/.cache/icedove | ||
133 | blacklist ${HOME}/.cache/inkscape | ||
134 | blacklist ${HOME}/.cache/inox | ||
135 | blacklist ${HOME}/.cache/io.github.lainsce.Notejot | ||
136 | blacklist ${HOME}/.cache/iridium | ||
137 | blacklist ${HOME}/.cache/kcmshell5 | ||
138 | blacklist ${HOME}/.cache/kdenlive | ||
139 | blacklist ${HOME}/.cache/keepassxc | ||
140 | blacklist ${HOME}/.cache/kfind | ||
141 | blacklist ${HOME}/.cache/kinfocenter | ||
142 | blacklist ${HOME}/.cache/kmail2 | ||
143 | blacklist ${HOME}/.cache/krunner | ||
144 | blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite* | ||
145 | blacklist ${HOME}/.cache/kscreenlocker_greet | ||
146 | blacklist ${HOME}/.cache/ksmserver-logout-greeter | ||
147 | blacklist ${HOME}/.cache/ksplashqml | ||
148 | blacklist ${HOME}/.cache/kube | ||
149 | blacklist ${HOME}/.cache/kwin | ||
150 | blacklist ${HOME}/.cache/libgweather | ||
151 | blacklist ${HOME}/.cache/librewolf | ||
152 | blacklist ${HOME}/.cache/liferea | ||
153 | blacklist ${HOME}/.cache/lutris | ||
154 | blacklist ${HOME}/.cache/marker | ||
155 | blacklist ${HOME}/.cache/matrix-mirage | ||
156 | blacklist ${HOME}/.cache/microsoft-edge-beta | ||
157 | blacklist ${HOME}/.cache/microsoft-edge-dev | ||
158 | blacklist ${HOME}/.cache/midori | ||
159 | blacklist ${HOME}/.cache/minetest | ||
160 | blacklist ${HOME}/.cache/mirage | ||
161 | blacklist ${HOME}/.cache/moonchild productions/basilisk | ||
162 | blacklist ${HOME}/.cache/moonchild productions/pale moon | ||
163 | blacklist ${HOME}/.cache/mozilla | ||
164 | blacklist ${HOME}/.cache/ms-excel-online | ||
165 | blacklist ${HOME}/.cache/ms-office-online | ||
166 | blacklist ${HOME}/.cache/ms-onenote-online | ||
167 | blacklist ${HOME}/.cache/ms-outlook-online | ||
168 | blacklist ${HOME}/.cache/ms-powerpoint-online | ||
169 | blacklist ${HOME}/.cache/ms-skype-online | ||
170 | blacklist ${HOME}/.cache/ms-word-online | ||
171 | blacklist ${HOME}/.cache/mutt | ||
172 | blacklist ${HOME}/.cache/mypaint | ||
173 | blacklist ${HOME}/.cache/netsurf | ||
174 | blacklist ${HOME}/.cache/nheko | ||
175 | blacklist ${HOME}/.cache/okular | ||
176 | blacklist ${HOME}/.cache/opera | ||
177 | blacklist ${HOME}/.cache/opera-beta | ||
178 | blacklist ${HOME}/.cache/org.gabmus.gfeeds | ||
179 | blacklist ${HOME}/.cache/org.gnome.Books | ||
180 | blacklist ${HOME}/.cache/org.gnome.Maps | ||
181 | blacklist ${HOME}/.cache/pdfmod | ||
182 | blacklist ${HOME}/.cache/peek | ||
183 | blacklist ${HOME}/.cache/pip | ||
184 | blacklist ${HOME}/.cache/pipe-viewer | ||
185 | blacklist ${HOME}/.cache/plasmashell | ||
186 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* | ||
187 | blacklist ${HOME}/.cache/psi | ||
188 | blacklist ${HOME}/.cache/qBittorrent | ||
189 | blacklist ${HOME}/.cache/quodlibet | ||
190 | blacklist ${HOME}/.cache/qupzilla | ||
191 | blacklist ${HOME}/.cache/qutebrowser | ||
192 | blacklist ${HOME}/.cache/rednotebook | ||
193 | blacklist ${HOME}/.cache/rhythmbox | ||
194 | blacklist ${HOME}/.cache/shotwell | ||
195 | blacklist ${HOME}/.cache/simple-scan | ||
196 | blacklist ${HOME}/.cache/slimjet | ||
197 | blacklist ${HOME}/.cache/smuxi | ||
198 | blacklist ${HOME}/.cache/snox | ||
199 | blacklist ${HOME}/.cache/spotify | ||
200 | blacklist ${HOME}/.cache/straw-viewer | ||
201 | blacklist ${HOME}/.cache/strawberry | ||
202 | blacklist ${HOME}/.cache/supertuxkart | ||
203 | blacklist ${HOME}/.cache/systemsettings | ||
204 | blacklist ${HOME}/.cache/telepathy | ||
205 | blacklist ${HOME}/.cache/thunderbird | ||
206 | blacklist ${HOME}/.cache/torbrowser | ||
207 | blacklist ${HOME}/.cache/transmission | ||
208 | blacklist ${HOME}/.cache/ungoogled-chromium | ||
209 | blacklist ${HOME}/.cache/vivaldi | ||
210 | blacklist ${HOME}/.cache/vivaldi-snapshot | ||
211 | blacklist ${HOME}/.cache/vlc | ||
212 | blacklist ${HOME}/.cache/vmware | ||
213 | blacklist ${HOME}/.cache/warsow-2.1 | ||
214 | blacklist ${HOME}/.cache/waterfox | ||
215 | blacklist ${HOME}/.cache/wesnoth | ||
216 | blacklist ${HOME}/.cache/winetricks | ||
217 | blacklist ${HOME}/.cache/xmms2 | ||
218 | blacklist ${HOME}/.cache/xournalpp | ||
219 | blacklist ${HOME}/.cache/xreader | ||
220 | blacklist ${HOME}/.cache/yandex-browser | ||
221 | blacklist ${HOME}/.cache/yandex-browser-beta | ||
222 | blacklist ${HOME}/.cache/youtube-dl | ||
223 | blacklist ${HOME}/.cache/youtube-viewer | ||
224 | blacklist ${HOME}/.cache/yt-dlp | ||
225 | blacklist ${HOME}/.cache/zim | ||
226 | blacklist ${HOME}/.cargo | ||
54 | blacklist ${HOME}/.claws-mail | 227 | blacklist ${HOME}/.claws-mail |
55 | blacklist ${HOME}/.cliqz | ||
56 | blacklist ${HOME}/.clion* | 228 | blacklist ${HOME}/.clion* |
229 | blacklist ${HOME}/.cliqz | ||
57 | blacklist ${HOME}/.clonk | 230 | blacklist ${HOME}/.clonk |
58 | blacklist ${HOME}/.config/0ad | 231 | blacklist ${HOME}/.config/0ad |
59 | blacklist ${HOME}/.config/2048-qt | 232 | blacklist ${HOME}/.config/2048-qt |
@@ -92,8 +265,8 @@ blacklist ${HOME}/.config/Google Play Music Desktop Player | |||
92 | blacklist ${HOME}/.config/Gpredict | 265 | blacklist ${HOME}/.config/Gpredict |
93 | blacklist ${HOME}/.config/INRIA | 266 | blacklist ${HOME}/.config/INRIA |
94 | blacklist ${HOME}/.config/InSilmaril | 267 | blacklist ${HOME}/.config/InSilmaril |
95 | blacklist ${HOME}/.config/Jitsi Meet | ||
96 | blacklist ${HOME}/.config/JetBrains/CLion* | 268 | blacklist ${HOME}/.config/JetBrains/CLion* |
269 | blacklist ${HOME}/.config/Jitsi Meet | ||
97 | blacklist ${HOME}/.config/KDE/neochat | 270 | blacklist ${HOME}/.config/KDE/neochat |
98 | blacklist ${HOME}/.config/KeePass | 271 | blacklist ${HOME}/.config/KeePass |
99 | blacklist ${HOME}/.config/KeePassXCrc | 272 | blacklist ${HOME}/.config/KeePassXCrc |
@@ -142,6 +315,7 @@ blacklist ${HOME}/.config/SubDownloader | |||
142 | blacklist ${HOME}/.config/Thunar | 315 | blacklist ${HOME}/.config/Thunar |
143 | blacklist ${HOME}/.config/Twitch | 316 | blacklist ${HOME}/.config/Twitch |
144 | blacklist ${HOME}/.config/Unknown Organization | 317 | blacklist ${HOME}/.config/Unknown Organization |
318 | blacklist ${HOME}/.config/VSCodium | ||
145 | blacklist ${HOME}/.config/VirtualBox | 319 | blacklist ${HOME}/.config/VirtualBox |
146 | blacklist ${HOME}/.config/Whalebird | 320 | blacklist ${HOME}/.config/Whalebird |
147 | blacklist ${HOME}/.config/Wire | 321 | blacklist ${HOME}/.config/Wire |
@@ -496,12 +670,14 @@ blacklist ${HOME}/.frogatto | |||
496 | blacklist ${HOME}/.frozen-bubble | 670 | blacklist ${HOME}/.frozen-bubble |
497 | blacklist ${HOME}/.funnyboat | 671 | blacklist ${HOME}/.funnyboat |
498 | blacklist ${HOME}/.gallery-dl.conf | 672 | blacklist ${HOME}/.gallery-dl.conf |
673 | blacklist ${HOME}/.geekbench5 | ||
499 | blacklist ${HOME}/.gimp* | 674 | blacklist ${HOME}/.gimp* |
500 | blacklist ${HOME}/.gist | 675 | blacklist ${HOME}/.gist |
501 | blacklist ${HOME}/.gitconfig | 676 | blacklist ${HOME}/.gitconfig |
502 | blacklist ${HOME}/.gl-117 | 677 | blacklist ${HOME}/.gl-117 |
503 | blacklist ${HOME}/.glaxiumrc | 678 | blacklist ${HOME}/.glaxiumrc |
504 | blacklist ${HOME}/.gnome/gnome-schedule | 679 | blacklist ${HOME}/.gnome/gnome-schedule |
680 | blacklist ${HOME}/.goldendict | ||
505 | blacklist ${HOME}/.googleearth | 681 | blacklist ${HOME}/.googleearth |
506 | blacklist ${HOME}/.gradle | 682 | blacklist ${HOME}/.gradle |
507 | blacklist ${HOME}/.gramps | 683 | blacklist ${HOME}/.gramps |
@@ -954,176 +1130,3 @@ blacklist /var/games/slashem | |||
954 | blacklist /var/games/vulturesclaw | 1130 | blacklist /var/games/vulturesclaw |
955 | blacklist /var/games/vultureseye | 1131 | blacklist /var/games/vultureseye |
956 | blacklist /var/lib/games/Maelstrom-Scores | 1132 | blacklist /var/lib/games/Maelstrom-Scores |
957 | |||
958 | # ${HOME}/.cache directory | ||
959 | blacklist ${HOME}/.cache/0ad | ||
960 | blacklist ${HOME}/.cache/8pecxstudios | ||
961 | blacklist ${HOME}/.cache/Authenticator | ||
962 | blacklist ${HOME}/.cache/BraveSoftware | ||
963 | blacklist ${HOME}/.cache/Clementine | ||
964 | blacklist ${HOME}/.cache/ENCOM/Spectral | ||
965 | blacklist ${HOME}/.cache/Enox | ||
966 | blacklist ${HOME}/.cache/Enpass | ||
967 | blacklist ${HOME}/.cache/Ferdi | ||
968 | blacklist ${HOME}/.cache/Flavio Tordini | ||
969 | blacklist ${HOME}/.cache/Franz | ||
970 | blacklist ${HOME}/.cache/INRIA | ||
971 | blacklist ${HOME}/.cache/INRIA/Natron | ||
972 | blacklist ${HOME}/.cache/KDE/neochat | ||
973 | blacklist ${HOME}/.cache/Mendeley Ltd. | ||
974 | blacklist ${HOME}/.cache/MusicBrainz | ||
975 | blacklist ${HOME}/.cache/NewsFlashGTK | ||
976 | blacklist ${HOME}/.cache/Otter | ||
977 | blacklist ${HOME}/.cache/PawelStolowski | ||
978 | blacklist ${HOME}/.cache/Psi | ||
979 | blacklist ${HOME}/.cache/QuiteRss | ||
980 | blacklist ${HOME}/.cache/Quotient/quaternion | ||
981 | blacklist ${HOME}/.cache/Shortwave | ||
982 | blacklist ${HOME}/.cache/Tox | ||
983 | blacklist ${HOME}/.cache/Zeal | ||
984 | blacklist ${HOME}/.cache/agenda | ||
985 | blacklist ${HOME}/.cache/akonadi* | ||
986 | blacklist ${HOME}/.cache/atril | ||
987 | blacklist ${HOME}/.cache/attic | ||
988 | blacklist ${HOME}/.cache/babl | ||
989 | blacklist ${HOME}/.cache/bnox | ||
990 | blacklist ${HOME}/.cache/borg | ||
991 | blacklist ${HOME}/.cache/calibre | ||
992 | blacklist ${HOME}/.cache/cantata | ||
993 | blacklist ${HOME}/.cache/champlain | ||
994 | blacklist ${HOME}/.cache/chromium | ||
995 | blacklist ${HOME}/.cache/chromium-dev | ||
996 | blacklist ${HOME}/.cache/cliqz | ||
997 | blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate | ||
998 | blacklist ${HOME}/.cache/darktable | ||
999 | blacklist ${HOME}/.cache/deja-dup | ||
1000 | blacklist ${HOME}/.cache/discover | ||
1001 | blacklist ${HOME}/.cache/dnox | ||
1002 | blacklist ${HOME}/.cache/dolphin | ||
1003 | blacklist ${HOME}/.cache/dolphin-emu | ||
1004 | blacklist ${HOME}/.cache/ephemeral | ||
1005 | blacklist ${HOME}/.cache/epiphany | ||
1006 | blacklist ${HOME}/.cache/evolution | ||
1007 | blacklist ${HOME}/.cache/falkon | ||
1008 | blacklist ${HOME}/.cache/feedreader | ||
1009 | blacklist ${HOME}/.cache/firedragon | ||
1010 | blacklist ${HOME}/.cache/flaska.net/trojita | ||
1011 | blacklist ${HOME}/.cache/folks | ||
1012 | blacklist ${HOME}/.cache/font-manager | ||
1013 | blacklist ${HOME}/.cache/fossamail | ||
1014 | blacklist ${HOME}/.cache/fractal | ||
1015 | blacklist ${HOME}/.cache/freecol | ||
1016 | blacklist ${HOME}/.cache/gajim | ||
1017 | blacklist ${HOME}/.cache/geary | ||
1018 | blacklist ${HOME}/.cache/geeqie | ||
1019 | blacklist ${HOME}/.cache/gegl-0.4 | ||
1020 | blacklist ${HOME}/.cache/gfeeds | ||
1021 | blacklist ${HOME}/.cache/gimp | ||
1022 | blacklist ${HOME}/.cache/gnome-boxes | ||
1023 | blacklist ${HOME}/.cache/gnome-builder | ||
1024 | blacklist ${HOME}/.cache/gnome-control-center | ||
1025 | blacklist ${HOME}/.cache/gnome-recipes | ||
1026 | blacklist ${HOME}/.cache/gnome-screenshot | ||
1027 | blacklist ${HOME}/.cache/gnome-software | ||
1028 | blacklist ${HOME}/.cache/gnome-twitch | ||
1029 | blacklist ${HOME}/.cache/godot | ||
1030 | blacklist ${HOME}/.cache/google-chrome | ||
1031 | blacklist ${HOME}/.cache/google-chrome-beta | ||
1032 | blacklist ${HOME}/.cache/google-chrome-unstable | ||
1033 | blacklist ${HOME}/.cache/gradio | ||
1034 | blacklist ${HOME}/.cache/gummi | ||
1035 | blacklist ${HOME}/.cache/icedove | ||
1036 | blacklist ${HOME}/.cache/inkscape | ||
1037 | blacklist ${HOME}/.cache/inox | ||
1038 | blacklist ${HOME}/.cache/io.github.lainsce.Notejot | ||
1039 | blacklist ${HOME}/.cache/iridium | ||
1040 | blacklist ${HOME}/.cache/JetBrains/CLion* | ||
1041 | blacklist ${HOME}/.cache/kcmshell5 | ||
1042 | blacklist ${HOME}/.cache/kdenlive | ||
1043 | blacklist ${HOME}/.cache/keepassxc | ||
1044 | blacklist ${HOME}/.cache/kfind | ||
1045 | blacklist ${HOME}/.cache/kinfocenter | ||
1046 | blacklist ${HOME}/.cache/kmail2 | ||
1047 | blacklist ${HOME}/.cache/krunner | ||
1048 | blacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite* | ||
1049 | blacklist ${HOME}/.cache/kscreenlocker_greet | ||
1050 | blacklist ${HOME}/.cache/ksmserver-logout-greeter | ||
1051 | blacklist ${HOME}/.cache/ksplashqml | ||
1052 | blacklist ${HOME}/.cache/kube | ||
1053 | blacklist ${HOME}/.cache/kwin | ||
1054 | blacklist ${HOME}/.cache/libgweather | ||
1055 | blacklist ${HOME}/.cache/librewolf | ||
1056 | blacklist ${HOME}/.cache/liferea | ||
1057 | blacklist ${HOME}/.cache/lutris | ||
1058 | blacklist ${HOME}/.cache/marker | ||
1059 | blacklist ${HOME}/.cache/matrix-mirage | ||
1060 | blacklist ${HOME}/.cache/microsoft-edge-beta | ||
1061 | blacklist ${HOME}/.cache/microsoft-edge-dev | ||
1062 | blacklist ${HOME}/.cache/midori | ||
1063 | blacklist ${HOME}/.cache/minetest | ||
1064 | blacklist ${HOME}/.cache/mirage | ||
1065 | blacklist ${HOME}/.cache/moonchild productions/basilisk | ||
1066 | blacklist ${HOME}/.cache/moonchild productions/pale moon | ||
1067 | blacklist ${HOME}/.cache/mozilla | ||
1068 | blacklist ${HOME}/.cache/ms-excel-online | ||
1069 | blacklist ${HOME}/.cache/ms-office-online | ||
1070 | blacklist ${HOME}/.cache/ms-onenote-online | ||
1071 | blacklist ${HOME}/.cache/ms-outlook-online | ||
1072 | blacklist ${HOME}/.cache/ms-powerpoint-online | ||
1073 | blacklist ${HOME}/.cache/ms-skype-online | ||
1074 | blacklist ${HOME}/.cache/ms-word-online | ||
1075 | blacklist ${HOME}/.cache/mutt | ||
1076 | blacklist ${HOME}/.cache/mypaint | ||
1077 | blacklist ${HOME}/.cache/netsurf | ||
1078 | blacklist ${HOME}/.cache/nheko | ||
1079 | blacklist ${HOME}/.cache/okular | ||
1080 | blacklist ${HOME}/.cache/opera | ||
1081 | blacklist ${HOME}/.cache/opera-beta | ||
1082 | blacklist ${HOME}/.cache/org.gabmus.gfeeds | ||
1083 | blacklist ${HOME}/.cache/org.gnome.Books | ||
1084 | blacklist ${HOME}/.cache/org.gnome.Maps | ||
1085 | blacklist ${HOME}/.cache/pdfmod | ||
1086 | blacklist ${HOME}/.cache/peek | ||
1087 | blacklist ${HOME}/.cache/pip | ||
1088 | blacklist ${HOME}/.cache/pipe-viewer | ||
1089 | blacklist ${HOME}/.cache/plasmashell | ||
1090 | blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite* | ||
1091 | blacklist ${HOME}/.cache/psi | ||
1092 | blacklist ${HOME}/.cache/qBittorrent | ||
1093 | blacklist ${HOME}/.cache/quodlibet | ||
1094 | blacklist ${HOME}/.cache/qupzilla | ||
1095 | blacklist ${HOME}/.cache/qutebrowser | ||
1096 | blacklist ${HOME}/.cache/rednotebook | ||
1097 | blacklist ${HOME}/.cache/rhythmbox | ||
1098 | blacklist ${HOME}/.cache/shotwell | ||
1099 | blacklist ${HOME}/.cache/simple-scan | ||
1100 | blacklist ${HOME}/.cache/slimjet | ||
1101 | blacklist ${HOME}/.cache/smuxi | ||
1102 | blacklist ${HOME}/.cache/snox | ||
1103 | blacklist ${HOME}/.cache/spotify | ||
1104 | blacklist ${HOME}/.cache/straw-viewer | ||
1105 | blacklist ${HOME}/.cache/strawberry | ||
1106 | blacklist ${HOME}/.cache/supertuxkart | ||
1107 | blacklist ${HOME}/.cache/systemsettings | ||
1108 | blacklist ${HOME}/.cache/telepathy | ||
1109 | blacklist ${HOME}/.cache/thunderbird | ||
1110 | blacklist ${HOME}/.cache/torbrowser | ||
1111 | blacklist ${HOME}/.cache/transmission | ||
1112 | blacklist ${HOME}/.cache/ungoogled-chromium | ||
1113 | blacklist ${HOME}/.cache/vivaldi | ||
1114 | blacklist ${HOME}/.cache/vivaldi-snapshot | ||
1115 | blacklist ${HOME}/.cache/vlc | ||
1116 | blacklist ${HOME}/.cache/vmware | ||
1117 | blacklist ${HOME}/.cache/warsow-2.1 | ||
1118 | blacklist ${HOME}/.cache/waterfox | ||
1119 | blacklist ${HOME}/.cache/wesnoth | ||
1120 | blacklist ${HOME}/.cache/winetricks | ||
1121 | blacklist ${HOME}/.cache/xmms2 | ||
1122 | blacklist ${HOME}/.cache/xournalpp | ||
1123 | blacklist ${HOME}/.cache/xreader | ||
1124 | blacklist ${HOME}/.cache/yandex-browser | ||
1125 | blacklist ${HOME}/.cache/yandex-browser-beta | ||
1126 | blacklist ${HOME}/.cache/youtube-dl | ||
1127 | blacklist ${HOME}/.cache/youtube-viewer | ||
1128 | blacklist ${HOME}/.cache/yt-dlp | ||
1129 | blacklist ${HOME}/.cache/zim | ||
diff --git a/etc/inc/whitelist-run-common.inc b/etc/inc/whitelist-run-common.inc index 224d21064..d74655a08 100644 --- a/etc/inc/whitelist-run-common.inc +++ b/etc/inc/whitelist-run-common.inc | |||
@@ -7,5 +7,9 @@ whitelist /run/cups/cups.sock | |||
7 | whitelist /run/dbus/system_bus_socket | 7 | whitelist /run/dbus/system_bus_socket |
8 | whitelist /run/media | 8 | whitelist /run/media |
9 | whitelist /run/resolvconf/resolv.conf | 9 | whitelist /run/resolvconf/resolv.conf |
10 | whitelist /run/shm | ||
11 | whitelist /run/systemd/journal/dev-log | ||
12 | whitelist /run/systemd/journal/socket | ||
10 | whitelist /run/systemd/resolve/resolv.conf | 13 | whitelist /run/systemd/resolve/resolv.conf |
11 | whitelist /run/systemd/resolve/stub-resolv.conf | 14 | whitelist /run/systemd/resolve/stub-resolv.conf |
15 | whitelist /run/udev/data | ||
diff --git a/etc/profile-a-l/Books.profile b/etc/profile-a-l/Books.profile index 76fd21d32..a256e942f 100644 --- a/etc/profile-a-l/Books.profile +++ b/etc/profile-a-l/Books.profile | |||
@@ -1,5 +1,10 @@ | |||
1 | # Firejail profile for gnome-books | 1 | # Firejail profile for gnome-books |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | ||
4 | include Books.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
3 | 8 | ||
4 | 9 | ||
5 | # Temporary fix for https://github.com/netblue30/firejail/issues/2624 | 10 | # Temporary fix for https://github.com/netblue30/firejail/issues/2624 |
diff --git a/etc/profile-a-l/abiword.profile b/etc/profile-a-l/abiword.profile index 005a502c4..0e7126458 100644 --- a/etc/profile-a-l/abiword.profile +++ b/etc/profile-a-l/abiword.profile | |||
@@ -42,7 +42,7 @@ tracelog | |||
42 | private-bin abiword | 42 | private-bin abiword |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc fonts,gtk-3.0,passwd | 45 | private-etc alternatives,fonts,gtk-3.0,ld.so.cache,ld.so.preload,passwd |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # dbus-user none | 48 | # dbus-user none |
diff --git a/etc/profile-a-l/agetpkg.profile b/etc/profile-a-l/agetpkg.profile index fea25fd58..dd3b2e59b 100644 --- a/etc/profile-a-l/agetpkg.profile +++ b/etc/profile-a-l/agetpkg.profile | |||
@@ -50,7 +50,7 @@ tracelog | |||
50 | private-bin agetpkg,python3 | 50 | private-bin agetpkg,python3 |
51 | private-cache | 51 | private-cache |
52 | private-dev | 52 | private-dev |
53 | private-etc ca-certificates,crypto-policies,pki,resolv.conf,ssl | 53 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-a-l/akonadi_control.profile b/etc/profile-a-l/akonadi_control.profile index 168e81985..f3fb678d1 100644 --- a/etc/profile-a-l/akonadi_control.profile +++ b/etc/profile-a-l/akonadi_control.profile | |||
@@ -27,6 +27,7 @@ include disable-exec.inc | |||
27 | include disable-interpreters.inc | 27 | include disable-interpreters.inc |
28 | include disable-programs.inc | 28 | include disable-programs.inc |
29 | 29 | ||
30 | include whitelist-run-common.inc | ||
30 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
31 | 32 | ||
32 | # disabled options below are not compatible with the apparmor profile for mysqld-akonadi. | 33 | # disabled options below are not compatible with the apparmor profile for mysqld-akonadi. |
diff --git a/etc/profile-a-l/akregator.profile b/etc/profile-a-l/akregator.profile index d1e7df37b..39008d67a 100644 --- a/etc/profile-a-l/akregator.profile +++ b/etc/profile-a-l/akregator.profile | |||
@@ -25,6 +25,7 @@ whitelist ${HOME}/.local/share/akregator | |||
25 | whitelist ${HOME}/.local/share/kssl | 25 | whitelist ${HOME}/.local/share/kssl |
26 | whitelist ${HOME}/.local/share/kxmlgui5/akregator | 26 | whitelist ${HOME}/.local/share/kxmlgui5/akregator |
27 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-run-common.inc | ||
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
29 | 30 | ||
30 | caps.drop all | 31 | caps.drop all |
diff --git a/etc/profile-a-l/alacarte.profile b/etc/profile-a-l/alacarte.profile index 69b499c74..5a528595b 100644 --- a/etc/profile-a-l/alacarte.profile +++ b/etc/profile-a-l/alacarte.profile | |||
@@ -53,7 +53,7 @@ disable-mnt | |||
53 | # private-bin alacarte,bash,python*,sh | 53 | # private-bin alacarte,bash,python*,sh |
54 | private-cache | 54 | private-cache |
55 | private-dev | 55 | private-dev |
56 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg | 56 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,locale.alias,locale.conf,login.defs,mime.types,nsswitch.conf,passwd,pki,X11,xdg |
57 | private-tmp | 57 | private-tmp |
58 | 58 | ||
59 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-a-l/alienarena.profile b/etc/profile-a-l/alienarena.profile index 62857a3e2..68512e37b 100644 --- a/etc/profile-a-l/alienarena.profile +++ b/etc/profile-a-l/alienarena.profile | |||
@@ -29,7 +29,6 @@ caps.drop all | |||
29 | netfilter | 29 | netfilter |
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | noinput | ||
33 | nonewprivs | 32 | nonewprivs |
34 | noroot | 33 | noroot |
35 | notv | 34 | notv |
diff --git a/etc/profile-a-l/amarok.profile b/etc/profile-a-l/amarok.profile index e7b78f7d0..7d8ec481d 100644 --- a/etc/profile-a-l/amarok.profile +++ b/etc/profile-a-l/amarok.profile | |||
@@ -39,7 +39,7 @@ dbus-user.own org.kde.amarok | |||
39 | dbus-user.own org.mpris.amarok | 39 | dbus-user.own org.mpris.amarok |
40 | dbus-user.own org.mpris.MediaPlayer2.amarok | 40 | dbus-user.own org.mpris.MediaPlayer2.amarok |
41 | dbus-user.talk org.freedesktop.Notifications | 41 | dbus-user.talk org.freedesktop.Notifications |
42 | dbus-user.talk org.kde.StatusNotifierWatcher | 42 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
43 | # If you're not on kde-plasma add the next lines to your amarok.local. | 43 | # If you're not on kde-plasma add the next lines to your amarok.local. |
44 | #dbus-user.own org.kde.kded | 44 | #dbus-user.own org.kde.kded |
45 | #dbus-user.own org.kde.klauncher | 45 | #dbus-user.own org.kde.klauncher |
diff --git a/etc/profile-a-l/amule.profile b/etc/profile-a-l/amule.profile index 3ce05c5bc..e82c145d1 100644 --- a/etc/profile-a-l/amule.profile +++ b/etc/profile-a-l/amule.profile | |||
@@ -32,6 +32,7 @@ nosound | |||
32 | notv | 32 | notv |
33 | nou2f | 33 | nou2f |
34 | novideo | 34 | novideo |
35 | # Add netlink protocol to use UPnP | ||
35 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
36 | seccomp | 37 | seccomp |
37 | shell none | 38 | shell none |
diff --git a/etc/profile-a-l/anki.profile b/etc/profile-a-l/anki.profile index fa4dfbb6f..f6d711b2e 100644 --- a/etc/profile-a-l/anki.profile +++ b/etc/profile-a-l/anki.profile | |||
@@ -50,7 +50,7 @@ disable-mnt | |||
50 | private-bin anki,python* | 50 | private-bin anki,python* |
51 | private-cache | 51 | private-cache |
52 | private-dev | 52 | private-dev |
53 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,machine-id,pki,resolv.conf,ssl,Trolltech.conf | 53 | private-etc alternatives,ca-certificates,fonts,gtk-2.0,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,resolv.conf,ssl,Trolltech.conf |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-a-l/aria2c.profile b/etc/profile-a-l/aria2c.profile index 737cf3095..8aef75cd1 100644 --- a/etc/profile-a-l/aria2c.profile +++ b/etc/profile-a-l/aria2c.profile | |||
@@ -45,7 +45,7 @@ private-bin aria2c,gzip | |||
45 | # Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772). | 45 | # Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772). |
46 | #private-cache | 46 | #private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,ca-certificates,crypto-policies,groups,login.defs,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl | 48 | private-etc alternatives,ca-certificates,crypto-policies,groups,ld.so.cache,ld.so.preload,login.defs,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl |
49 | private-lib libreadline.so.* | 49 | private-lib libreadline.so.* |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
diff --git a/etc/profile-a-l/ark.profile b/etc/profile-a-l/ark.profile index 45071dc62..a26592f3a 100644 --- a/etc/profile-a-l/ark.profile +++ b/etc/profile-a-l/ark.profile | |||
@@ -16,6 +16,7 @@ include disable-interpreters.inc | |||
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | 17 | ||
18 | whitelist /usr/share/ark | 18 | whitelist /usr/share/ark |
19 | include whitelist-run-common.inc | ||
19 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
diff --git a/etc/profile-a-l/arm.profile b/etc/profile-a-l/arm.profile index 3253fb586..6676d42e9 100644 --- a/etc/profile-a-l/arm.profile +++ b/etc/profile-a-l/arm.profile | |||
@@ -43,6 +43,6 @@ tracelog | |||
43 | disable-mnt | 43 | disable-mnt |
44 | private-bin arm,bash,ldconfig,lsof,ps,python*,sh,tor | 44 | private-bin arm,bash,ldconfig,lsof,ps,python*,sh,tor |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,ca-certificates,crypto-policies,passwd,pki,ssl,tor | 46 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,passwd,pki,ssl,tor |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
diff --git a/etc/profile-a-l/artha.profile b/etc/profile-a-l/artha.profile index 8d74b6ba4..254f3f571 100644 --- a/etc/profile-a-l/artha.profile +++ b/etc/profile-a-l/artha.profile | |||
@@ -56,7 +56,7 @@ disable-mnt | |||
56 | private-bin artha,enchant,notify-send | 56 | private-bin artha,enchant,notify-send |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | private-dev |
59 | private-etc alternatives,fonts,machine-id | 59 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
60 | private-lib libnotify.so.* | 60 | private-lib libnotify.so.* |
61 | private-tmp | 61 | private-tmp |
62 | 62 | ||
diff --git a/etc/profile-a-l/atool.profile b/etc/profile-a-l/atool.profile index e377de2c8..6399bc1a3 100644 --- a/etc/profile-a-l/atool.profile +++ b/etc/profile-a-l/atool.profile | |||
@@ -13,7 +13,7 @@ include allow-perl.inc | |||
13 | noroot | 13 | noroot |
14 | 14 | ||
15 | # without login.defs atool complains and uses UID/GID 1000 by default | 15 | # without login.defs atool complains and uses UID/GID 1000 by default |
16 | private-etc alternatives,group,login.defs,passwd | 16 | private-etc alternatives,group,ld.so.cache,ld.so.preload,login.defs,passwd |
17 | private-tmp | 17 | private-tmp |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
diff --git a/etc/profile-a-l/atril.profile b/etc/profile-a-l/atril.profile index f7c62926f..264bc0215 100644 --- a/etc/profile-a-l/atril.profile +++ b/etc/profile-a-l/atril.profile | |||
@@ -42,7 +42,7 @@ tracelog | |||
42 | 42 | ||
43 | private-bin 7z,7za,7zr,atril,atril-previewer,atril-thumbnailer,sh,tar,unrar,unzip,zipnote | 43 | private-bin 7z,7za,7zr,atril,atril-previewer,atril-thumbnailer,sh,tar,unrar,unzip,zipnote |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,fonts,ld.so.cache | 45 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
46 | # atril uses webkit gtk to display epub files | 46 | # atril uses webkit gtk to display epub files |
47 | # waiting for globbing support in private-lib; for now hardcoding it to webkit2gtk-4.0 | 47 | # waiting for globbing support in private-lib; for now hardcoding it to webkit2gtk-4.0 |
48 | #private-lib webkit2gtk-4.0 - problems on Arch with the new version of WebKit | 48 | #private-lib webkit2gtk-4.0 - problems on Arch with the new version of WebKit |
diff --git a/etc/profile-a-l/audacious.profile b/etc/profile-a-l/audacious.profile index d71370b7e..e9ecdd72e 100644 --- a/etc/profile-a-l/audacious.profile +++ b/etc/profile-a-l/audacious.profile | |||
@@ -17,6 +17,7 @@ include disable-interpreters.inc | |||
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | include whitelist-run-common.inc | ||
20 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
21 | 22 | ||
22 | apparmor | 23 | apparmor |
diff --git a/etc/profile-a-l/authenticator-rs.profile b/etc/profile-a-l/authenticator-rs.profile index 411c5f4d3..a8af1928b 100644 --- a/etc/profile-a-l/authenticator-rs.profile +++ b/etc/profile-a-l/authenticator-rs.profile | |||
@@ -47,7 +47,7 @@ disable-mnt | |||
47 | private-bin authenticator-rs | 47 | private-bin authenticator-rs |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,pki,resolv.conf,ssl,xdg | 50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user filter | 53 | dbus-user filter |
diff --git a/etc/profile-a-l/authenticator.profile b/etc/profile-a-l/authenticator.profile index 0f0fb7ceb..f9a03ca68 100644 --- a/etc/profile-a-l/authenticator.profile +++ b/etc/profile-a-l/authenticator.profile | |||
@@ -39,7 +39,7 @@ shell none | |||
39 | disable-mnt | 39 | disable-mnt |
40 | # private-bin authenticator,python* | 40 | # private-bin authenticator,python* |
41 | private-dev | 41 | private-dev |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,pki,resolv.conf,ssl | 42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # makes settings immutable | 45 | # makes settings immutable |
diff --git a/etc/profile-a-l/baloo_file.profile b/etc/profile-a-l/baloo_file.profile index 252016bec..55d2453d8 100644 --- a/etc/profile-a-l/baloo_file.profile +++ b/etc/profile-a-l/baloo_file.profile | |||
@@ -25,6 +25,7 @@ include disable-exec.inc | |||
25 | include disable-interpreters.inc | 25 | include disable-interpreters.inc |
26 | include disable-programs.inc | 26 | include disable-programs.inc |
27 | 27 | ||
28 | include whitelist-run-common.inc | ||
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
29 | 30 | ||
30 | apparmor | 31 | apparmor |
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile index 197f787ca..be3543b08 100644 --- a/etc/profile-a-l/balsa.profile +++ b/etc/profile-a-l/balsa.profile | |||
@@ -66,7 +66,7 @@ tracelog | |||
66 | private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm | 66 | private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm |
67 | private-cache | 67 | private-cache |
68 | private-dev | 68 | private-dev |
69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg | 69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg |
70 | private-tmp | 70 | private-tmp |
71 | writable-run-user | 71 | writable-run-user |
72 | writable-var | 72 | writable-var |
@@ -79,4 +79,4 @@ dbus-user.talk org.freedesktop.secrets | |||
79 | dbus-user.talk org.gnome.keyring.SystemPrompter | 79 | dbus-user.talk org.gnome.keyring.SystemPrompter |
80 | dbus-system none | 80 | dbus-system none |
81 | 81 | ||
82 | read-only ${HOME}/.mozilla/firefox/profiles.ini \ No newline at end of file | 82 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
diff --git a/etc/profile-a-l/bibletime.profile b/etc/profile-a-l/bibletime.profile index 0104dc181..be29ce8a7 100644 --- a/etc/profile-a-l/bibletime.profile +++ b/etc/profile-a-l/bibletime.profile | |||
@@ -52,7 +52,7 @@ disable-mnt | |||
52 | # private-bin bibletime,qt5ct | 52 | # private-bin bibletime,qt5ct |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,login.defs,machine-id,passwd,pki,resolv.conf,ssl,sword,sword.conf |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile index 61cd792b1..b86232860 100644 --- a/etc/profile-a-l/bijiben.profile +++ b/etc/profile-a-l/bijiben.profile | |||
@@ -51,7 +51,7 @@ disable-mnt | |||
51 | private-bin bijiben | 51 | private-bin bijiben |
52 | # private-cache -- access to .cache/tracker is required | 52 | # private-cache -- access to .cache/tracker is required |
53 | private-dev | 53 | private-dev |
54 | private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload | 54 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
55 | private-tmp | 55 | private-tmp |
56 | 56 | ||
57 | dbus-user filter | 57 | dbus-user filter |
diff --git a/etc/profile-a-l/bitwarden.profile b/etc/profile-a-l/bitwarden.profile index ba2eb2ea7..f8114c71b 100644 --- a/etc/profile-a-l/bitwarden.profile +++ b/etc/profile-a-l/bitwarden.profile | |||
@@ -23,7 +23,7 @@ no3d | |||
23 | nosound | 23 | nosound |
24 | 24 | ||
25 | ?HAS_APPIMAGE: ignore private-dev | 25 | ?HAS_APPIMAGE: ignore private-dev |
26 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,nsswitch.conf,pki,resolv.conf,ssl | 26 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
27 | private-opt Bitwarden | 27 | private-opt Bitwarden |
28 | 28 | ||
29 | # Redirect | 29 | # Redirect |
diff --git a/etc/profile-a-l/bless.profile b/etc/profile-a-l/bless.profile index 61d1c3a1e..3e20ed133 100644 --- a/etc/profile-a-l/bless.profile +++ b/etc/profile-a-l/bless.profile | |||
@@ -35,7 +35,7 @@ shell none | |||
35 | # private-bin bash,bless,mono,sh | 35 | # private-bin bash,bless,mono,sh |
36 | private-cache | 36 | private-cache |
37 | private-dev | 37 | private-dev |
38 | private-etc alternatives,fonts,mono | 38 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,mono |
39 | private-tmp | 39 | private-tmp |
40 | 40 | ||
41 | dbus-user none | 41 | dbus-user none |
diff --git a/etc/profile-a-l/blobby.profile b/etc/profile-a-l/blobby.profile index 11d705c5b..d7df3bc49 100644 --- a/etc/profile-a-l/blobby.profile +++ b/etc/profile-a-l/blobby.profile | |||
@@ -41,7 +41,7 @@ tracelog | |||
41 | disable-mnt | 41 | disable-mnt |
42 | private-bin blobby | 42 | private-bin blobby |
43 | private-dev | 43 | private-dev |
44 | private-etc alsa,alternatives,asound.conf,drirc,group,hosts,login.defs,machine-id,passwd,pulse | 44 | private-etc alsa,alternatives,asound.conf,drirc,group,hosts,ld.so.cache,ld.so.preload,login.defs,machine-id,passwd,pulse |
45 | private-lib | 45 | private-lib |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
diff --git a/etc/profile-a-l/blobwars.profile b/etc/profile-a-l/blobwars.profile index 6e3d4256c..cc2fda3f2 100644 --- a/etc/profile-a-l/blobwars.profile +++ b/etc/profile-a-l/blobwars.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | mkdir ${HOME}/.parallelrealities/blobwars | 19 | mkdir ${HOME}/.parallelrealities/blobwars |
20 | whitelist ${HOME}/.parallelrealities/blobwars | 20 | whitelist ${HOME}/.parallelrealities/blobwars |
21 | whitelist /usr/share/blobwars | 21 | whitelist /usr/share/blobwars |
22 | whitelist /usr/share/games/blobwars | ||
22 | include whitelist-common.inc | 23 | include whitelist-common.inc |
23 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
@@ -28,7 +29,6 @@ caps.drop all | |||
28 | net none | 29 | net none |
29 | nodvd | 30 | nodvd |
30 | nogroups | 31 | nogroups |
31 | noinput | ||
32 | nonewprivs | 32 | nonewprivs |
33 | noroot | 33 | noroot |
34 | notv | 34 | notv |
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin blobwars | 43 | private-bin blobwars |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc machine-id | 46 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-a-l/bsdtar.profile b/etc/profile-a-l/bsdtar.profile index d731a6a6e..fbc7c9056 100644 --- a/etc/profile-a-l/bsdtar.profile +++ b/etc/profile-a-l/bsdtar.profile | |||
@@ -6,7 +6,7 @@ include bsdtar.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | private-etc alternatives,group,localtime,passwd | 9 | private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd |
10 | 10 | ||
11 | # Redirect | 11 | # Redirect |
12 | include archiver-common.profile | 12 | include archiver-common.profile |
diff --git a/etc/profile-a-l/build-systems-common.profile b/etc/profile-a-l/build-systems-common.profile new file mode 100644 index 000000000..1b199d612 --- /dev/null +++ b/etc/profile-a-l/build-systems-common.profile | |||
@@ -0,0 +1,66 @@ | |||
1 | # Firejail profile for build-systems-common | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include build-systems-common.local | ||
5 | # Persistent global definitions | ||
6 | # added by caller profile | ||
7 | #include globals.local | ||
8 | |||
9 | ignore noexec ${HOME} | ||
10 | ignore noexec /tmp | ||
11 | |||
12 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
13 | include allow-bin-sh.inc | ||
14 | |||
15 | # Allows files commonly used by IDEs | ||
16 | include allow-common-devel.inc | ||
17 | |||
18 | # Allow ssh (blacklisted by disable-common.inc) | ||
19 | #include allow-ssh.inc | ||
20 | |||
21 | blacklist ${RUNUSER} | ||
22 | |||
23 | include disable-common.inc | ||
24 | include disable-exec.inc | ||
25 | include disable-interpreters.inc | ||
26 | include disable-programs.inc | ||
27 | include disable-shell.inc | ||
28 | include disable-X11.inc | ||
29 | include disable-xdg.inc | ||
30 | |||
31 | #whitelist ${HOME}/Projects | ||
32 | #include whitelist-common.inc | ||
33 | |||
34 | whitelist /usr/share/pkgconfig | ||
35 | include whitelist-run-common.inc | ||
36 | include whitelist-usr-share-common.inc | ||
37 | include whitelist-var-common.inc | ||
38 | |||
39 | caps.drop all | ||
40 | ipc-namespace | ||
41 | machine-id | ||
42 | # net none | ||
43 | netfilter | ||
44 | no3d | ||
45 | nodvd | ||
46 | nogroups | ||
47 | noinput | ||
48 | nonewprivs | ||
49 | noroot | ||
50 | nosound | ||
51 | notv | ||
52 | nou2f | ||
53 | novideo | ||
54 | protocol unix,inet,inet6 | ||
55 | seccomp | ||
56 | seccomp.block-secondary | ||
57 | shell none | ||
58 | tracelog | ||
59 | |||
60 | disable-mnt | ||
61 | private-cache | ||
62 | private-dev | ||
63 | private-tmp | ||
64 | |||
65 | dbus-user none | ||
66 | dbus-system none | ||
diff --git a/etc/profile-a-l/bundle.profile b/etc/profile-a-l/bundle.profile new file mode 100644 index 000000000..bb82022b1 --- /dev/null +++ b/etc/profile-a-l/bundle.profile | |||
@@ -0,0 +1,23 @@ | |||
1 | # Firejail profile for bundle | ||
2 | # Description: Ruby Dependency Management | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include bundle.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.bundle | ||
11 | |||
12 | # Allow ruby (blacklisted by disable-interpreters.inc) | ||
13 | include allow-ruby.inc | ||
14 | |||
15 | #whitelist ${HOME}/.bundle | ||
16 | #whitelist ${HOME}/.gem | ||
17 | #whitelist ${HOME}/.local/share/gem | ||
18 | whitelist /usr/share/gems | ||
19 | whitelist /usr/share/ruby | ||
20 | whitelist /usr/share/rubygems | ||
21 | |||
22 | # Redirect | ||
23 | include build-systems-common.profile | ||
diff --git a/etc/profile-a-l/cameramonitor.profile b/etc/profile-a-l/cameramonitor.profile index ae9e0f1d2..92c455144 100644 --- a/etc/profile-a-l/cameramonitor.profile +++ b/etc/profile-a-l/cameramonitor.profile | |||
@@ -46,7 +46,7 @@ tracelog | |||
46 | disable-mnt | 46 | disable-mnt |
47 | private-bin cameramonitor,python* | 47 | private-bin cameramonitor,python* |
48 | private-cache | 48 | private-cache |
49 | private-etc alternatives,fonts | 49 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # dbus-user none | 52 | # dbus-user none |
diff --git a/etc/profile-a-l/cargo.profile b/etc/profile-a-l/cargo.profile index ff46cd429..4c8afd895 100644 --- a/etc/profile-a-l/cargo.profile +++ b/etc/profile-a-l/cargo.profile | |||
@@ -7,66 +7,18 @@ include cargo.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | ignore noexec ${HOME} | 10 | ignore read-only ${HOME}/.cargo/bin |
11 | ignore noexec /tmp | ||
12 | |||
13 | blacklist /tmp/.X11-unix | ||
14 | blacklist ${RUNUSER} | ||
15 | 11 | ||
16 | noblacklist ${HOME}/.cargo/credentials | 12 | noblacklist ${HOME}/.cargo/credentials |
17 | noblacklist ${HOME}/.cargo/credentials.toml | 13 | noblacklist ${HOME}/.cargo/credentials.toml |
18 | 14 | ||
19 | # Allows files commonly used by IDEs | ||
20 | include allow-common-devel.inc | ||
21 | |||
22 | # Allow ssh (blacklisted by disable-common.inc) | ||
23 | #include allow-ssh.inc | ||
24 | |||
25 | include disable-common.inc | ||
26 | include disable-exec.inc | ||
27 | include disable-interpreters.inc | ||
28 | include disable-programs.inc | ||
29 | include disable-xdg.inc | ||
30 | |||
31 | #mkdir ${HOME}/.cargo | ||
32 | #whitelist ${HOME}/YOUR_CARGO_PROJECTS | ||
33 | #whitelist ${HOME}/.cargo | 15 | #whitelist ${HOME}/.cargo |
34 | #whitelist ${HOME}/.rustup | 16 | #whitelist ${HOME}/.rustup |
35 | #include whitelist-common.inc | ||
36 | whitelist /usr/share/pkgconfig | ||
37 | include whitelist-runuser-common.inc | ||
38 | include whitelist-usr-share-common.inc | ||
39 | include whitelist-var-common.inc | ||
40 | 17 | ||
41 | caps.drop all | ||
42 | ipc-namespace | ||
43 | machine-id | ||
44 | netfilter | ||
45 | no3d | ||
46 | nodvd | ||
47 | nogroups | ||
48 | noinput | ||
49 | nonewprivs | ||
50 | noroot | ||
51 | nosound | ||
52 | notv | ||
53 | nou2f | ||
54 | novideo | ||
55 | protocol unix,inet,inet6 | ||
56 | seccomp | ||
57 | seccomp.block-secondary | ||
58 | shell none | ||
59 | tracelog | ||
60 | |||
61 | disable-mnt | ||
62 | #private-bin cargo,rustc | 18 | #private-bin cargo,rustc |
63 | private-cache | ||
64 | private-dev | ||
65 | private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,magic,magic.mgc,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl | 19 | private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,magic,magic.mgc,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl |
66 | private-tmp | ||
67 | |||
68 | dbus-user none | ||
69 | dbus-system none | ||
70 | 20 | ||
71 | memory-deny-write-execute | 21 | memory-deny-write-execute |
72 | read-write ${HOME}/.cargo/bin | 22 | |
23 | # Redirect | ||
24 | include build-systems-common.profile | ||
diff --git a/etc/profile-a-l/cawbird.profile b/etc/profile-a-l/cawbird.profile index 78df5af83..c7a98250e 100644 --- a/etc/profile-a-l/cawbird.profile +++ b/etc/profile-a-l/cawbird.profile | |||
@@ -39,7 +39,7 @@ disable-mnt | |||
39 | private-bin cawbird | 39 | private-bin cawbird |
40 | private-cache | 40 | private-cache |
41 | private-dev | 41 | private-dev |
42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg | 42 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,resolv.conf,ssl,X11,xdg |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # dbus-user none | 45 | # dbus-user none |
diff --git a/etc/profile-a-l/celluloid.profile b/etc/profile-a-l/celluloid.profile index 0beeaafdd..1a9340632 100644 --- a/etc/profile-a-l/celluloid.profile +++ b/etc/profile-a-l/celluloid.profile | |||
@@ -53,7 +53,7 @@ tracelog | |||
53 | 53 | ||
54 | private-bin celluloid,env,gnome-mpv,python*,youtube-dl | 54 | private-bin celluloid,env,gnome-mpv,python*,youtube-dl |
55 | private-cache | 55 | private-cache |
56 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg | 56 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,libva.conf,localtime,machine-id,pkcs11,pki,resolv.conf,selinux,ssl,xdg |
57 | private-dev | 57 | private-dev |
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
diff --git a/etc/profile-a-l/cheese.profile b/etc/profile-a-l/cheese.profile index c2fc064f3..713d8a5e4 100644 --- a/etc/profile-a-l/cheese.profile +++ b/etc/profile-a-l/cheese.profile | |||
@@ -9,17 +9,23 @@ include globals.local | |||
9 | noblacklist ${VIDEOS} | 9 | noblacklist ${VIDEOS} |
10 | noblacklist ${PICTURES} | 10 | noblacklist ${PICTURES} |
11 | 11 | ||
12 | include allow-python3.inc | ||
13 | |||
12 | include disable-common.inc | 14 | include disable-common.inc |
13 | include disable-devel.inc | 15 | include disable-devel.inc |
14 | include disable-exec.inc | 16 | include disable-exec.inc |
15 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
16 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 20 | include disable-xdg.inc |
18 | 21 | ||
19 | whitelist ${VIDEOS} | 22 | whitelist ${VIDEOS} |
20 | whitelist ${PICTURES} | 23 | whitelist ${PICTURES} |
24 | whitelist /usr/libexec/gstreamer-1.0/gst-plugin-scanner | ||
21 | whitelist /usr/share/gnome-video-effects | 25 | whitelist /usr/share/gnome-video-effects |
26 | whitelist /usr/share/gstreamer-1.0 | ||
22 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-run-common.inc | ||
23 | include whitelist-runuser-common.inc | 29 | include whitelist-runuser-common.inc |
24 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
@@ -30,21 +36,26 @@ machine-id | |||
30 | net none | 36 | net none |
31 | nodvd | 37 | nodvd |
32 | nogroups | 38 | nogroups |
39 | noinput | ||
33 | nonewprivs | 40 | nonewprivs |
34 | noroot | 41 | noroot |
42 | nosound | ||
35 | notv | 43 | notv |
36 | nou2f | 44 | nou2f |
37 | protocol unix | 45 | protocol unix |
38 | seccomp | 46 | seccomp |
47 | seccomp.block-secondary | ||
39 | shell none | 48 | shell none |
40 | tracelog | 49 | tracelog |
41 | 50 | ||
42 | disable-mnt | 51 | disable-mnt |
43 | private-bin cheese | 52 | private-bin cheese |
44 | private-cache | 53 | private-cache |
45 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0 | 54 | private-dev |
55 | private-etc alternatives,clutter-1.0,dconf,drirc,fonts,gtk-3.0,ld.so.cache,ld.so.preload | ||
46 | private-tmp | 56 | private-tmp |
47 | 57 | ||
48 | dbus-user filter | 58 | dbus-user filter |
59 | dbus-user.own org.gnome.Cheese | ||
49 | dbus-user.talk ca.desrt.dconf | 60 | dbus-user.talk ca.desrt.dconf |
50 | dbus-system none | 61 | dbus-system none |
diff --git a/etc/profile-a-l/clawsker.profile b/etc/profile-a-l/clawsker.profile index 8ccf67ba1..677d2b7eb 100644 --- a/etc/profile-a-l/clawsker.profile +++ b/etc/profile-a-l/clawsker.profile | |||
@@ -44,7 +44,7 @@ disable-mnt | |||
44 | private-bin bash,clawsker,perl,sh,which | 44 | private-bin bash,clawsker,perl,sh,which |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
48 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-3.so.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* | 48 | private-lib girepository-1.*,libdbus-glib-1.so.*,libetpan.so.*,libgirepository-1.*,libgtk-3.so.*,libgtk-x11-2.0.so.*,libstartup-notification-1.so.*,perl* |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
diff --git a/etc/profile-a-l/cmake.profile b/etc/profile-a-l/cmake.profile new file mode 100644 index 000000000..26cc2a00a --- /dev/null +++ b/etc/profile-a-l/cmake.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for cargo | ||
2 | # Description: The Rust package manager | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include cargo.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | memory-deny-write-execute | ||
11 | |||
12 | # Redirect | ||
13 | include build-systems-common.profile | ||
diff --git a/etc/profile-a-l/cmus.profile b/etc/profile-a-l/cmus.profile index 19a30e694..7421debe0 100644 --- a/etc/profile-a-l/cmus.profile +++ b/etc/profile-a-l/cmus.profile | |||
@@ -27,4 +27,4 @@ seccomp | |||
27 | shell none | 27 | shell none |
28 | 28 | ||
29 | private-bin cmus | 29 | private-bin cmus |
30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl | 30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
diff --git a/etc/profile-a-l/codium.profile b/etc/profile-a-l/codium.profile new file mode 100644 index 000000000..9ff87ed8a --- /dev/null +++ b/etc/profile-a-l/codium.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile alias for VSCodium | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include codium.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include vscodium.profile | ||
diff --git a/etc/profile-a-l/cola.profile b/etc/profile-a-l/cola.profile index e5debfd82..97bf6d394 100644 --- a/etc/profile-a-l/cola.profile +++ b/etc/profile-a-l/cola.profile | |||
@@ -7,4 +7,4 @@ include cola.local | |||
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Redirect | 9 | # Redirect |
10 | include git-cola.profile \ No newline at end of file | 10 | include git-cola.profile |
diff --git a/etc/profile-a-l/com.github.bleakgrey.tootle.profile b/etc/profile-a-l/com.github.bleakgrey.tootle.profile index 8d9de93bb..27780b669 100644 --- a/etc/profile-a-l/com.github.bleakgrey.tootle.profile +++ b/etc/profile-a-l/com.github.bleakgrey.tootle.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin com.github.bleakgrey.tootle | 45 | private-bin com.github.bleakgrey.tootle |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg | 48 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # Settings are immutable | 51 | # Settings are immutable |
diff --git a/etc/profile-a-l/com.github.dahenson.agenda.profile b/etc/profile-a-l/com.github.dahenson.agenda.profile index e7aa32be9..0e29d90de 100644 --- a/etc/profile-a-l/com.github.dahenson.agenda.profile +++ b/etc/profile-a-l/com.github.dahenson.agenda.profile | |||
@@ -52,7 +52,7 @@ disable-mnt | |||
52 | private-bin com.github.dahenson.agenda | 52 | private-bin com.github.dahenson.agenda |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc dconf,fonts,gtk-3.0 | 55 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user filter | 58 | dbus-user filter |
diff --git a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile index aa9a19fcb..24222164b 100644 --- a/etc/profile-a-l/com.github.johnfactotum.Foliate.profile +++ b/etc/profile-a-l/com.github.johnfactotum.Foliate.profile | |||
@@ -55,7 +55,7 @@ disable-mnt | |||
55 | private-bin com.github.johnfactotum.Foliate,gjs | 55 | private-bin com.github.johnfactotum.Foliate,gjs |
56 | private-cache | 56 | private-cache |
57 | private-dev | 57 | private-dev |
58 | private-etc dconf,fonts,gconf,gtk-3.0 | 58 | private-etc alternatives,dconf,fonts,gconf,gtk-3.0,ld.so.cache,ld.so.preload |
59 | private-tmp | 59 | private-tmp |
60 | 60 | ||
61 | read-only ${HOME} | 61 | read-only ${HOME} |
diff --git a/etc/profile-a-l/coyim.profile b/etc/profile-a-l/coyim.profile index 03218d85a..099253b21 100644 --- a/etc/profile-a-l/coyim.profile +++ b/etc/profile-a-l/coyim.profile | |||
@@ -40,7 +40,7 @@ tracelog | |||
40 | disable-mnt | 40 | disable-mnt |
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,ssl | 43 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,ssl |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | dbus-user none | 46 | dbus-user none |
diff --git a/etc/profile-a-l/crow.profile b/etc/profile-a-l/crow.profile index 177abf829..ed1213687 100644 --- a/etc/profile-a-l/crow.profile +++ b/etc/profile-a-l/crow.profile | |||
@@ -39,7 +39,7 @@ shell none | |||
39 | disable-mnt | 39 | disable-mnt |
40 | private-bin crow | 40 | private-bin crow |
41 | private-dev | 41 | private-dev |
42 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 42 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
43 | private-opt none | 43 | private-opt none |
44 | private-tmp | 44 | private-tmp |
45 | private-srv none | 45 | private-srv none |
diff --git a/etc/profile-a-l/d-feet.profile b/etc/profile-a-l/d-feet.profile index 0e4b8d475..c75bc756f 100644 --- a/etc/profile-a-l/d-feet.profile +++ b/etc/profile-a-l/d-feet.profile | |||
@@ -50,7 +50,7 @@ disable-mnt | |||
50 | private-bin d-feet,python* | 50 | private-bin d-feet,python* |
51 | private-cache | 51 | private-cache |
52 | private-dev | 52 | private-dev |
53 | private-etc alternatives,dbus-1,fonts,machine-id | 53 | private-etc alternatives,dbus-1,fonts,ld.so.cache,ld.so.preload,machine-id |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 56 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-a-l/dbus-send.profile b/etc/profile-a-l/dbus-send.profile index 768f1ac2c..e1b96f186 100644 --- a/etc/profile-a-l/dbus-send.profile +++ b/etc/profile-a-l/dbus-send.profile | |||
@@ -51,7 +51,7 @@ private | |||
51 | private-bin dbus-send | 51 | private-bin dbus-send |
52 | private-cache | 52 | private-cache |
53 | private-dev | 53 | private-dev |
54 | private-etc alternatives,dbus-1 | 54 | private-etc alternatives,dbus-1,ld.so.cache,ld.so.preload |
55 | private-lib libpcre* | 55 | private-lib libpcre* |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
diff --git a/etc/profile-a-l/dconf-editor.profile b/etc/profile-a-l/dconf-editor.profile index f57063ab6..8c3c22dcf 100644 --- a/etc/profile-a-l/dconf-editor.profile +++ b/etc/profile-a-l/dconf-editor.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin dconf-editor | 43 | private-bin dconf-editor |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,dconf,fonts,gtk-3.0,machine-id | 46 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id |
47 | private-lib | 47 | private-lib |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
diff --git a/etc/profile-a-l/dconf.profile b/etc/profile-a-l/dconf.profile index 8b7c86789..b170842c3 100644 --- a/etc/profile-a-l/dconf.profile +++ b/etc/profile-a-l/dconf.profile | |||
@@ -46,7 +46,7 @@ disable-mnt | |||
46 | private-bin dconf,gsettings | 46 | private-bin dconf,gsettings |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc alternatives,dconf | 49 | private-etc alternatives,dconf,ld.so.cache,ld.so.preload |
50 | private-lib | 50 | private-lib |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
diff --git a/etc/profile-a-l/ddgtk.profile b/etc/profile-a-l/ddgtk.profile index 701755d93..e9b8f5c47 100644 --- a/etc/profile-a-l/ddgtk.profile +++ b/etc/profile-a-l/ddgtk.profile | |||
@@ -45,7 +45,7 @@ tracelog | |||
45 | disable-mnt | 45 | disable-mnt |
46 | private-bin bash,dd,ddgtk,grep,lsblk,python*,sed,sh,tr | 46 | private-bin bash,dd,ddgtk,grep,lsblk,python*,sed,sh,tr |
47 | private-cache | 47 | private-cache |
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-a-l/devhelp.profile b/etc/profile-a-l/devhelp.profile index a416bc27e..562f6b105 100644 --- a/etc/profile-a-l/devhelp.profile +++ b/etc/profile-a-l/devhelp.profile | |||
@@ -42,7 +42,7 @@ disable-mnt | |||
42 | private-bin devhelp | 42 | private-bin devhelp |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,dconf,fonts,ld.so.cache,machine-id,ssl | 45 | private-etc alternatives,dconf,fonts,ld.so.cache,ld.so.preload,machine-id,ssl |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # makes settings immutable | 48 | # makes settings immutable |
diff --git a/etc/profile-a-l/devilspie.profile b/etc/profile-a-l/devilspie.profile index 89c8e1ae8..a0f24c388 100644 --- a/etc/profile-a-l/devilspie.profile +++ b/etc/profile-a-l/devilspie.profile | |||
@@ -48,7 +48,7 @@ disable-mnt | |||
48 | private-bin devilspie | 48 | private-bin devilspie |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc alternatives | 51 | private-etc alternatives,ld.so.cache,ld.so.preload |
52 | private-lib gconv | 52 | private-lib gconv |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
diff --git a/etc/profile-a-l/discord-common.profile b/etc/profile-a-l/discord-common.profile index 2613027ba..c04e38899 100644 --- a/etc/profile-a-l/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -24,7 +24,7 @@ whitelist ${HOME}/.config/BetterDiscord | |||
24 | whitelist ${HOME}/.local/share/betterdiscordctl | 24 | whitelist ${HOME}/.local/share/betterdiscordctl |
25 | 25 | ||
26 | private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh | 26 | private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh |
27 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl | 27 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl |
28 | 28 | ||
29 | join-or-start discord | 29 | join-or-start discord |
30 | 30 | ||
diff --git a/etc/profile-a-l/display.profile b/etc/profile-a-l/display.profile index 0f134bd87..8a8d816a3 100644 --- a/etc/profile-a-l/display.profile +++ b/etc/profile-a-l/display.profile | |||
@@ -40,7 +40,7 @@ shell none | |||
40 | private-bin display,python* | 40 | private-bin display,python* |
41 | private-dev | 41 | private-dev |
42 | # On Debian-based systems, display is a symlink in /etc/alternatives | 42 | # On Debian-based systems, display is a symlink in /etc/alternatives |
43 | private-etc alternatives | 43 | private-etc alternatives,ld.so.cache,ld.so.preload |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | dbus-user none | 46 | dbus-user none |
diff --git a/etc/profile-a-l/dragon.profile b/etc/profile-a-l/dragon.profile index 26243ab4e..d5591adfb 100644 --- a/etc/profile-a-l/dragon.profile +++ b/etc/profile-a-l/dragon.profile | |||
@@ -19,6 +19,7 @@ include disable-shell.inc | |||
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | whitelist /usr/share/dragonplayer | 21 | whitelist /usr/share/dragonplayer |
22 | include whitelist-run-common.inc | ||
22 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
diff --git a/etc/profile-a-l/drawio.profile b/etc/profile-a-l/drawio.profile index 6d5e2501f..df7be55de 100644 --- a/etc/profile-a-l/drawio.profile +++ b/etc/profile-a-l/drawio.profile | |||
@@ -45,7 +45,7 @@ shell none | |||
45 | private-bin drawio | 45 | private-bin drawio |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-a-l/easystroke.profile b/etc/profile-a-l/easystroke.profile index fd7f252b6..20cffae73 100644 --- a/etc/profile-a-l/easystroke.profile +++ b/etc/profile-a-l/easystroke.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | #private-bin bash,easystroke,sh | 45 | #private-bin bash,easystroke,sh |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,fonts,group,passwd | 48 | private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,passwd |
49 | # breaks custom shell command functionality | 49 | # breaks custom shell command functionality |
50 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 50 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
51 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-a-l/electron-mail.profile b/etc/profile-a-l/electron-mail.profile index 9aac3f570..09d14045a 100644 --- a/etc/profile-a-l/electron-mail.profile +++ b/etc/profile-a-l/electron-mail.profile | |||
@@ -45,7 +45,7 @@ shell none | |||
45 | private-bin electron-mail | 45 | private-bin electron-mail |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg | 48 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,selinux,ssl,xdg |
49 | private-opt ElectronMail | 49 | private-opt ElectronMail |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
diff --git a/etc/profile-a-l/electrum.profile b/etc/profile-a-l/electrum.profile index 1647f2bc4..dfbe5cee4 100644 --- a/etc/profile-a-l/electrum.profile +++ b/etc/profile-a-l/electrum.profile | |||
@@ -47,7 +47,7 @@ private-bin electrum,python* | |||
47 | private-cache | 47 | private-cache |
48 | ?HAS_APPIMAGE: ignore private-dev | 48 | ?HAS_APPIMAGE: ignore private-dev |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,machine-id,pki,resolv.conf,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,ld.so.cache,ld.so.preload,machine-id,pki,resolv.conf,ssl |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | # dbus-user none | 53 | # dbus-user none |
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile index 03fd9033a..ac73f002f 100644 --- a/etc/profile-a-l/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.gnupg | |||
12 | noblacklist ${HOME}/.mozilla | 12 | noblacklist ${HOME}/.mozilla |
13 | noblacklist ${HOME}/.signature | 13 | noblacklist ${HOME}/.signature |
14 | # when storing mail outside the default ${HOME}/Mail path, 'noblacklist' the custom path in your email-common.local | 14 | # when storing mail outside the default ${HOME}/Mail path, 'noblacklist' the custom path in your email-common.local |
15 | # and 'blacklist' it in your disable-common.local too so it is kept hidden from other applications | 15 | # and 'blacklist' it in your disable-common.local too so it is kept hidden from other applications |
16 | noblacklist ${HOME}/Mail | 16 | noblacklist ${HOME}/Mail |
17 | 17 | ||
18 | noblacklist ${DOCUMENTS} | 18 | noblacklist ${DOCUMENTS} |
@@ -66,7 +66,7 @@ tracelog | |||
66 | # disable-mnt | 66 | # disable-mnt |
67 | private-cache | 67 | private-cache |
68 | private-dev | 68 | private-dev |
69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg | 69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg |
70 | private-tmp | 70 | private-tmp |
71 | # encrypting and signing email | 71 | # encrypting and signing email |
72 | writable-run-user | 72 | writable-run-user |
diff --git a/etc/profile-a-l/enchant.profile b/etc/profile-a-l/enchant.profile index dc383984e..eff0f64ea 100644 --- a/etc/profile-a-l/enchant.profile +++ b/etc/profile-a-l/enchant.profile | |||
@@ -48,7 +48,7 @@ x11 none | |||
48 | private-bin enchant,enchant-* | 48 | private-bin enchant,enchant-* |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc alternatives | 51 | private-etc alternatives,ld.so.cache,ld.so.preload |
52 | private-lib | 52 | private-lib |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
diff --git a/etc/profile-a-l/eo-common.profile b/etc/profile-a-l/eo-common.profile index 02112ef20..31f39e210 100644 --- a/etc/profile-a-l/eo-common.profile +++ b/etc/profile-a-l/eo-common.profile | |||
@@ -47,6 +47,6 @@ tracelog | |||
47 | 47 | ||
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,dconf,fonts,gtk-3.0 | 50 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload |
51 | private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.* | 51 | private-lib eog,eom,gdk-pixbuf-2.*,gio,girepository-1.*,gvfs,libgconf-2.so.* |
52 | private-tmp | 52 | private-tmp |
diff --git a/etc/profile-a-l/eog.profile b/etc/profile-a-l/eog.profile index 5892374bd..65e5c6e69 100644 --- a/etc/profile-a-l/eog.profile +++ b/etc/profile-a-l/eog.profile | |||
@@ -18,7 +18,7 @@ whitelist /usr/share/eog | |||
18 | 18 | ||
19 | private-bin eog | 19 | private-bin eog |
20 | 20 | ||
21 | # broken on Debian 10 (buster) running LXDE got the folowing error: | 21 | # broken on Debian 10 (buster) running LXDE got the following error: |
22 | # Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown | 22 | # Failed to register: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: org.freedesktop.DBus.Error.ServiceUnknown |
23 | #dbus-user filter | 23 | #dbus-user filter |
24 | #dbus-user.own org.gnome.eog | 24 | #dbus-user.own org.gnome.eog |
diff --git a/etc/profile-a-l/equalx.profile b/etc/profile-a-l/equalx.profile index 7566f7b50..0c3b790d5 100644 --- a/etc/profile-a-l/equalx.profile +++ b/etc/profile-a-l/equalx.profile | |||
@@ -54,7 +54,7 @@ disable-mnt | |||
54 | private-bin equalx,gs,pdflatex,pdftocairo | 54 | private-bin equalx,gs,pdflatex,pdftocairo |
55 | private-cache | 55 | private-cache |
56 | private-dev | 56 | private-dev |
57 | private-etc equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,machine-id,papersize,passwd,texlive,Trolltech.conf | 57 | private-etc alternatives,equalx,equalx.conf,fonts,gtk-2.0,latexmk.conf,ld.so.cache,ld.so.preload,machine-id,papersize,passwd,texlive,Trolltech.conf |
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index 19ad5799c..63e456488 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -54,7 +54,7 @@ tracelog | |||
54 | private-bin evince,evince-previewer,evince-thumbnailer | 54 | private-bin evince,evince-previewer,evince-thumbnailer |
55 | private-cache | 55 | private-cache |
56 | private-dev | 56 | private-dev |
57 | private-etc alternatives,fonts,group,ld.so.cache,machine-id,passwd | 57 | private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd |
58 | # private-lib might break two-page-view on some systems | 58 | # private-lib might break two-page-view on some systems |
59 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* | 59 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* |
60 | private-tmp | 60 | private-tmp |
diff --git a/etc/profile-a-l/exiftool.profile b/etc/profile-a-l/exiftool.profile index 49a16f2f2..ae550e842 100644 --- a/etc/profile-a-l/exiftool.profile +++ b/etc/profile-a-l/exiftool.profile | |||
@@ -48,7 +48,7 @@ x11 none | |||
48 | #private-bin exiftool,perl | 48 | #private-bin exiftool,perl |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc alternatives | 51 | private-etc alternatives,ld.so.cache,ld.so.preload |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-a-l/falkon.profile b/etc/profile-a-l/falkon.profile index 3911a8c75..321cb0145 100644 --- a/etc/profile-a-l/falkon.profile +++ b/etc/profile-a-l/falkon.profile | |||
@@ -23,6 +23,7 @@ whitelist ${HOME}/.cache/falkon | |||
23 | whitelist ${HOME}/.config/falkon | 23 | whitelist ${HOME}/.config/falkon |
24 | whitelist /usr/share/falkon | 24 | whitelist /usr/share/falkon |
25 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-run-common.inc | ||
26 | include whitelist-runuser-common.inc | 27 | include whitelist-runuser-common.inc |
27 | include whitelist-usr-share-common.inc | 28 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
@@ -46,7 +47,7 @@ disable-mnt | |||
46 | # private-bin falkon | 47 | # private-bin falkon |
47 | private-cache | 48 | private-cache |
48 | private-dev | 49 | private-dev |
49 | private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 50 | private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
50 | private-tmp | 51 | private-tmp |
51 | 52 | ||
52 | # dbus-user filter | 53 | # dbus-user filter |
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile index 25e1082ad..ee775566e 100644 --- a/etc/profile-a-l/fdns.profile +++ b/etc/profile-a-l/fdns.profile | |||
@@ -42,7 +42,7 @@ private | |||
42 | private-bin bash,fdns,sh | 42 | private-bin bash,fdns,sh |
43 | private-cache | 43 | private-cache |
44 | #private-dev | 44 | #private-dev |
45 | private-etc ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,fdns,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,passwd,pki,ssl |
46 | # private-lib | 46 | # private-lib |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
diff --git a/etc/profile-a-l/feh-network.inc.profile b/etc/profile-a-l/feh-network.inc.profile index 690b39171..7293e89a8 100644 --- a/etc/profile-a-l/feh-network.inc.profile +++ b/etc/profile-a-l/feh-network.inc.profile | |||
@@ -5,4 +5,4 @@ include feh-network.inc.local | |||
5 | ignore net none | 5 | ignore net none |
6 | netfilter | 6 | netfilter |
7 | protocol unix,inet,inet6 | 7 | protocol unix,inet,inet6 |
8 | private-etc ca-certificates,crypto-policies,hosts,pki,resolv.conf,ssl | 8 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
diff --git a/etc/profile-a-l/feh.profile b/etc/profile-a-l/feh.profile index 0fdb1d3d3..4b8d41170 100644 --- a/etc/profile-a-l/feh.profile +++ b/etc/profile-a-l/feh.profile | |||
@@ -36,7 +36,7 @@ shell none | |||
36 | private-bin feh,jpegexiforient,jpegtran | 36 | private-bin feh,jpegexiforient,jpegtran |
37 | private-cache | 37 | private-cache |
38 | private-dev | 38 | private-dev |
39 | private-etc alternatives,feh | 39 | private-etc alternatives,feh,ld.so.cache,ld.so.preload |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | dbus-user none | 42 | dbus-user none |
diff --git a/etc/profile-a-l/ffplay.profile b/etc/profile-a-l/ffplay.profile index 04134cbf4..52abb99d4 100644 --- a/etc/profile-a-l/ffplay.profile +++ b/etc/profile-a-l/ffplay.profile | |||
@@ -14,7 +14,7 @@ ignore nogroups | |||
14 | ignore nosound | 14 | ignore nosound |
15 | 15 | ||
16 | private-bin ffplay | 16 | private-bin ffplay |
17 | private-etc alsa,asound.conf,group | 17 | private-etc alsa,alternatives,asound.conf,group,ld.so.cache,ld.so.preload |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
20 | include ffmpeg.profile | 20 | include ffmpeg.profile |
diff --git a/etc/profile-a-l/file-roller.profile b/etc/profile-a-l/file-roller.profile index 434466139..06a8f6170 100644 --- a/etc/profile-a-l/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile | |||
@@ -43,7 +43,7 @@ tracelog | |||
43 | private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd | 43 | private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc dconf,fonts,gtk-3.0,xdg | 46 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,xdg |
47 | # private-tmp | 47 | # private-tmp |
48 | 48 | ||
49 | dbus-system none | 49 | dbus-system none |
diff --git a/etc/profile-a-l/firefox-common.profile b/etc/profile-a-l/firefox-common.profile index 20ae039aa..ef647b5a0 100644 --- a/etc/profile-a-l/firefox-common.profile +++ b/etc/profile-a-l/firefox-common.profile | |||
@@ -19,6 +19,7 @@ include disable-common.inc | |||
19 | include disable-devel.inc | 19 | include disable-devel.inc |
20 | include disable-exec.inc | 20 | include disable-exec.inc |
21 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
22 | include disable-proc.inc | ||
22 | include disable-programs.inc | 23 | include disable-programs.inc |
23 | 24 | ||
24 | mkdir ${HOME}/.pki | 25 | mkdir ${HOME}/.pki |
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile index e9241efc3..f80297022 100644 --- a/etc/profile-a-l/flameshot.profile +++ b/etc/profile-a-l/flameshot.profile | |||
@@ -52,7 +52,7 @@ tracelog | |||
52 | disable-mnt | 52 | disable-mnt |
53 | private-bin flameshot | 53 | private-bin flameshot |
54 | private-cache | 54 | private-cache |
55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.conf,machine-id,pki,resolv.conf,ssl | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,pki,resolv.conf,ssl |
56 | private-dev | 56 | private-dev |
57 | #private-tmp | 57 | #private-tmp |
58 | 58 | ||
@@ -63,6 +63,6 @@ dbus-user.talk org.freedesktop.Notifications | |||
63 | dbus-user.talk org.freedesktop.portal.Desktop | 63 | dbus-user.talk org.freedesktop.portal.Desktop |
64 | dbus-user.talk org.gnome.Shell | 64 | dbus-user.talk org.gnome.Shell |
65 | dbus-user.talk org.kde.KWin | 65 | dbus-user.talk org.kde.KWin |
66 | dbus-user.talk org.kde.StatusNotifierWatcher | 66 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
67 | dbus-user.own org.kde.* | 67 | ?ALLOW_TRAY: dbus-user.own org.kde.* |
68 | dbus-system none | 68 | dbus-system none |
diff --git a/etc/profile-a-l/freetube.profile b/etc/profile-a-l/freetube.profile index 7beb2bcba..cb00ce11b 100644 --- a/etc/profile-a-l/freetube.profile +++ b/etc/profile-a-l/freetube.profile | |||
@@ -16,7 +16,7 @@ mkdir ${HOME}/.config/FreeTube | |||
16 | whitelist ${HOME}/.config/FreeTube | 16 | whitelist ${HOME}/.config/FreeTube |
17 | 17 | ||
18 | private-bin electron,electron[0-9],electron[0-9][0-9],freetube,sh | 18 | private-bin electron,electron[0-9],electron[0-9][0-9],freetube,sh |
19 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg | 19 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,ssl,X11,xdg |
20 | 20 | ||
21 | # Redirect | 21 | # Redirect |
22 | include electron.profile | 22 | include electron.profile |
diff --git a/etc/profile-a-l/frogatto.profile b/etc/profile-a-l/frogatto.profile index fa08b4956..8419998de 100644 --- a/etc/profile-a-l/frogatto.profile +++ b/etc/profile-a-l/frogatto.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin frogatto,sh | 45 | private-bin frogatto,sh |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc machine-id | 48 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-a-l/frozen-bubble.profile b/etc/profile-a-l/frozen-bubble.profile index bb35c9447..88943760a 100644 --- a/etc/profile-a-l/frozen-bubble.profile +++ b/etc/profile-a-l/frozen-bubble.profile | |||
@@ -30,7 +30,6 @@ caps.drop all | |||
30 | net none | 30 | net none |
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | noinput | ||
34 | nonewprivs | 33 | nonewprivs |
35 | noroot | 34 | noroot |
36 | notv | 35 | notv |
diff --git a/etc/profile-a-l/funnyboat.profile b/etc/profile-a-l/funnyboat.profile index 1009f345b..4a08fca9b 100644 --- a/etc/profile-a-l/funnyboat.profile +++ b/etc/profile-a-l/funnyboat.profile | |||
@@ -35,7 +35,6 @@ ipc-namespace | |||
35 | netfilter | 35 | netfilter |
36 | nodvd | 36 | nodvd |
37 | nogroups | 37 | nogroups |
38 | noinput | ||
39 | nonewprivs | 38 | nonewprivs |
40 | noroot | 39 | noroot |
41 | notv | 40 | notv |
diff --git a/etc/profile-a-l/gajim.profile b/etc/profile-a-l/gajim.profile index b0d017db9..6d764a0f9 100644 --- a/etc/profile-a-l/gajim.profile +++ b/etc/profile-a-l/gajim.profile | |||
@@ -59,7 +59,7 @@ disable-mnt | |||
59 | private-bin bash,gajim,gajim-history-manager,gpg,gpg2,paplay,python*,sh,zsh | 59 | private-bin bash,gajim,gajim-history-manager,gpg,gpg2,paplay,python*,sh,zsh |
60 | private-cache | 60 | private-cache |
61 | private-dev | 61 | private-dev |
62 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,xdg | 62 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,xdg |
63 | private-tmp | 63 | private-tmp |
64 | writable-run-user | 64 | writable-run-user |
65 | 65 | ||
diff --git a/etc/profile-a-l/galculator.profile b/etc/profile-a-l/galculator.profile index 50b1c319c..4efe41f8d 100644 --- a/etc/profile-a-l/galculator.profile +++ b/etc/profile-a-l/galculator.profile | |||
@@ -43,7 +43,7 @@ tracelog | |||
43 | private-bin galculator | 43 | private-bin galculator |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,fonts | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
47 | private-lib | 47 | private-lib |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
diff --git a/etc/profile-a-l/gallery-dl.profile b/etc/profile-a-l/gallery-dl.profile index 9c8200dc4..2947873ef 100644 --- a/etc/profile-a-l/gallery-dl.profile +++ b/etc/profile-a-l/gallery-dl.profile | |||
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.config/gallery-dl | |||
12 | noblacklist ${HOME}/.gallery-dl.conf | 12 | noblacklist ${HOME}/.gallery-dl.conf |
13 | 13 | ||
14 | private-bin gallery-dl | 14 | private-bin gallery-dl |
15 | private-etc gallery-dl.conf | 15 | private-etc alternatives,gallery-dl.conf,ld.so.cache,ld.so.preload |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include youtube-dl.profile | 18 | include youtube-dl.profile |
diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile index 8263423a0..ec5b733c8 100644 --- a/etc/profile-a-l/gapplication.profile +++ b/etc/profile-a-l/gapplication.profile | |||
@@ -49,7 +49,7 @@ private | |||
49 | private-bin gapplication | 49 | private-bin gapplication |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc none | 52 | private-etc alternatives,ld.so.cache,ld.so.preload |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | # Add the next line to your gapplication.local to filter D-Bus names. | 55 | # Add the next line to your gapplication.local to filter D-Bus names. |
diff --git a/etc/profile-a-l/gcloud.profile b/etc/profile-a-l/gcloud.profile index 388f4c0df..297e5d345 100644 --- a/etc/profile-a-l/gcloud.profile +++ b/etc/profile-a-l/gcloud.profile | |||
@@ -36,7 +36,7 @@ tracelog | |||
36 | 36 | ||
37 | disable-mnt | 37 | disable-mnt |
38 | private-dev | 38 | private-dev |
39 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,localtime,nsswitch.conf,pki,resolv.conf,ssl | 39 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | dbus-user none | 42 | dbus-user none |
diff --git a/etc/profile-a-l/gconf.profile b/etc/profile-a-l/gconf.profile index b01d88f80..a45374d4e 100644 --- a/etc/profile-a-l/gconf.profile +++ b/etc/profile-a-l/gconf.profile | |||
@@ -54,7 +54,7 @@ disable-mnt | |||
54 | private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2* | 54 | private-bin gconf-editor,gconf-merge-*,gconfpkg,gconftool-2,gsettings-*-convert,python2* |
55 | private-cache | 55 | private-cache |
56 | private-dev | 56 | private-dev |
57 | private-etc alternatives,fonts,gconf | 57 | private-etc alternatives,fonts,gconf,ld.so.cache,ld.so.preload |
58 | private-lib GConf,libpython*,python2* | 58 | private-lib GConf,libpython*,python2* |
59 | private-tmp | 59 | private-tmp |
60 | 60 | ||
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile index 29c620556..cececd9e9 100644 --- a/etc/profile-a-l/geary.profile +++ b/etc/profile-a-l/geary.profile | |||
@@ -70,7 +70,7 @@ tracelog | |||
70 | private-bin geary | 70 | private-bin geary |
71 | private-cache | 71 | private-cache |
72 | private-dev | 72 | private-dev |
73 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,xdg | 73 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg |
74 | private-tmp | 74 | private-tmp |
75 | 75 | ||
76 | dbus-user filter | 76 | dbus-user filter |
diff --git a/etc/profile-a-l/geekbench.profile b/etc/profile-a-l/geekbench.profile index f0e17963c..243b893b9 100644 --- a/etc/profile-a-l/geekbench.profile +++ b/etc/profile-a-l/geekbench.profile | |||
@@ -6,6 +6,10 @@ include geekbench.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.geekbench5 | ||
10 | noblacklist /sbin | ||
11 | noblacklist /usr/sbin | ||
12 | |||
9 | include disable-common.inc | 13 | include disable-common.inc |
10 | include disable-devel.inc | 14 | include disable-devel.inc |
11 | include disable-exec.inc | 15 | include disable-exec.inc |
@@ -13,6 +17,8 @@ include disable-interpreters.inc | |||
13 | include disable-programs.inc | 17 | include disable-programs.inc |
14 | include disable-xdg.inc | 18 | include disable-xdg.inc |
15 | 19 | ||
20 | mkdir ${HOME}/.geekbench5 | ||
21 | whitelist ${HOME}/.geekbench5 | ||
16 | include whitelist-common.inc | 22 | include whitelist-common.inc |
17 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
18 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
@@ -39,16 +45,14 @@ shell none | |||
39 | tracelog | 45 | tracelog |
40 | 46 | ||
41 | disable-mnt | 47 | disable-mnt |
42 | private-bin bash,geekbenc*,sh | 48 | #private-bin bash,geekbench*,sh -- #4576 |
43 | private-cache | 49 | private-cache |
44 | private-dev | 50 | private-dev |
45 | private-etc alternatives,group,lsb-release,passwd | 51 | private-etc alternatives,group,ld.so.cache,ld.so.preload,lsb-release,passwd |
46 | private-lib gcc/*/*/libstdc++.so.* | ||
47 | private-opt none | ||
48 | private-tmp | 52 | private-tmp |
49 | 53 | ||
50 | dbus-user none | 54 | dbus-user none |
51 | dbus-system none | 55 | dbus-system none |
52 | 56 | ||
53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | ||
54 | read-only ${HOME} | 57 | read-only ${HOME} |
58 | read-write ${HOME}/.geekbench5 | ||
diff --git a/etc/profile-a-l/gget.profile b/etc/profile-a-l/gget.profile index b2adaa8e4..bc1199914 100644 --- a/etc/profile-a-l/gget.profile +++ b/etc/profile-a-l/gget.profile | |||
@@ -49,7 +49,7 @@ disable-mnt | |||
49 | private-bin gget | 49 | private-bin gget |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
53 | private-lib | 53 | private-lib |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
diff --git a/etc/profile-a-l/gimp.profile b/etc/profile-a-l/gimp.profile index df9c2ac7a..28070cb9c 100644 --- a/etc/profile-a-l/gimp.profile +++ b/etc/profile-a-l/gimp.profile | |||
@@ -39,6 +39,7 @@ whitelist /usr/share/gegl-0.4 | |||
39 | whitelist /usr/share/gimp | 39 | whitelist /usr/share/gimp |
40 | whitelist /usr/share/mypaint-data | 40 | whitelist /usr/share/mypaint-data |
41 | whitelist /usr/share/lensfun | 41 | whitelist /usr/share/lensfun |
42 | include whitelist-run-common.inc | ||
42 | include whitelist-usr-share-common.inc | 43 | include whitelist-usr-share-common.inc |
43 | include whitelist-var-common.inc | 44 | include whitelist-var-common.inc |
44 | 45 | ||
diff --git a/etc/profile-a-l/gist.profile b/etc/profile-a-l/gist.profile index 80fa18119..506ab7127 100644 --- a/etc/profile-a-l/gist.profile +++ b/etc/profile-a-l/gist.profile | |||
@@ -52,7 +52,7 @@ tracelog | |||
52 | disable-mnt | 52 | disable-mnt |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc alternatives | 55 | private-etc alternatives,ld.so.cache,ld.so.preload |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-a-l/git-cola.profile b/etc/profile-a-l/git-cola.profile index f77adef63..6439c8821 100644 --- a/etc/profile-a-l/git-cola.profile +++ b/etc/profile-a-l/git-cola.profile | |||
@@ -70,7 +70,7 @@ tracelog | |||
70 | private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed | 70 | private-bin basename,bash,cola,envsubst,gettext,git,git-cola,git-dag,git-gui,gitk,gpg,gpg-agent,nano,ps,python*,sh,ssh,ssh-agent,tclsh,tr,wc,which,xed |
71 | private-cache | 71 | private-cache |
72 | private-dev | 72 | private-dev |
73 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg | 73 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gitconfig,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,mime.types,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssh,ssl,X11,xdg |
74 | private-tmp | 74 | private-tmp |
75 | writable-run-user | 75 | writable-run-user |
76 | 76 | ||
diff --git a/etc/profile-a-l/gitter.profile b/etc/profile-a-l/gitter.profile index 5dfb48189..16358d064 100644 --- a/etc/profile-a-l/gitter.profile +++ b/etc/profile-a-l/gitter.profile | |||
@@ -37,7 +37,7 @@ shell none | |||
37 | 37 | ||
38 | disable-mnt | 38 | disable-mnt |
39 | private-bin bash,env,gitter | 39 | private-bin bash,env,gitter |
40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,pulse,resolv.conf,ssl | 40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,pulse,resolv.conf,ssl |
41 | private-opt Gitter | 41 | private-opt Gitter |
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
diff --git a/etc/profile-a-l/gl-117.profile b/etc/profile-a-l/gl-117.profile index 35d969e6d..edb85048b 100644 --- a/etc/profile-a-l/gl-117.profile +++ b/etc/profile-a-l/gl-117.profile | |||
@@ -29,7 +29,6 @@ caps.drop all | |||
29 | net none | 29 | net none |
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | noinput | ||
33 | nonewprivs | 32 | nonewprivs |
34 | noroot | 33 | noroot |
35 | notv | 34 | notv |
diff --git a/etc/profile-a-l/glaxium.profile b/etc/profile-a-l/glaxium.profile index dec0daef2..b5f98b411 100644 --- a/etc/profile-a-l/glaxium.profile +++ b/etc/profile-a-l/glaxium.profile | |||
@@ -29,7 +29,6 @@ caps.drop all | |||
29 | net none | 29 | net none |
30 | nodvd | 30 | nodvd |
31 | nogroups | 31 | nogroups |
32 | noinput | ||
33 | nonewprivs | 32 | nonewprivs |
34 | noroot | 33 | noroot |
35 | notv | 34 | notv |
diff --git a/etc/profile-a-l/gmpc.profile b/etc/profile-a-l/gmpc.profile index 4aa4b6c20..e53297c06 100644 --- a/etc/profile-a-l/gmpc.profile +++ b/etc/profile-a-l/gmpc.profile | |||
@@ -44,7 +44,7 @@ tracelog | |||
44 | disable-mnt | 44 | disable-mnt |
45 | #private-bin gmpc | 45 | #private-bin gmpc |
46 | private-cache | 46 | private-cache |
47 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
48 | private-tmp | 48 | private-tmp |
49 | writable-run-user | 49 | writable-run-user |
50 | 50 | ||
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile index c8903a991..f9df83e2a 100644 --- a/etc/profile-a-l/gnome-calendar.profile +++ b/etc/profile-a-l/gnome-calendar.profile | |||
@@ -45,7 +45,7 @@ private | |||
45 | private-bin gnome-calendar | 45 | private-bin gnome-calendar |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,localtime,nsswitch.conf,pki,resolv.conf,ssl | 48 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user filter | 51 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-chess.profile b/etc/profile-a-l/gnome-chess.profile index d038d775a..dc9092a93 100644 --- a/etc/profile-a-l/gnome-chess.profile +++ b/etc/profile-a-l/gnome-chess.profile | |||
@@ -50,5 +50,5 @@ disable-mnt | |||
50 | private-bin fairymax,gnome-chess,gnuchess,hoichess | 50 | private-bin fairymax,gnome-chess,gnuchess,hoichess |
51 | private-cache | 51 | private-cache |
52 | private-dev | 52 | private-dev |
53 | private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0 | 53 | private-etc alternatives,dconf,fonts,gnome-chess,gtk-3.0,ld.so.cache,ld.so.preload |
54 | private-tmp | 54 | private-tmp |
diff --git a/etc/profile-a-l/gnome-clocks.profile b/etc/profile-a-l/gnome-clocks.profile index 96a39f6ce..90665add6 100644 --- a/etc/profile-a-l/gnome-clocks.profile +++ b/etc/profile-a-l/gnome-clocks.profile | |||
@@ -42,6 +42,6 @@ disable-mnt | |||
42 | private-bin gnome-clocks,gsound-play | 42 | private-bin gnome-clocks,gsound-play |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,localtime,machine-id,pkcs11,pki,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pkcs11,pki,ssl |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
diff --git a/etc/profile-a-l/gnome-hexgl.profile b/etc/profile-a-l/gnome-hexgl.profile index 19a4bc5c7..ab6279608 100644 --- a/etc/profile-a-l/gnome-hexgl.profile +++ b/etc/profile-a-l/gnome-hexgl.profile | |||
@@ -42,7 +42,7 @@ private | |||
42 | private-bin gnome-hexgl | 42 | private-bin gnome-hexgl |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc alsa,asound.conf,machine-id,pulse | 45 | private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-a-l/gnome-latex.profile b/etc/profile-a-l/gnome-latex.profile index 26c2c4409..39a6718a6 100644 --- a/etc/profile-a-l/gnome-latex.profile +++ b/etc/profile-a-l/gnome-latex.profile | |||
@@ -48,6 +48,6 @@ tracelog | |||
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed | 50 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed |
51 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,login.defs,passwd,texlive | 51 | private-etc alternatives,dconf,fonts,gtk-3.0,latexmk.conf,ld.so.cache,ld.so.preload,login.defs,passwd,texlive |
52 | 52 | ||
53 | dbus-system none | 53 | dbus-system none |
diff --git a/etc/profile-a-l/gnome-logs.profile b/etc/profile-a-l/gnome-logs.profile index 2c15f7592..7ee4d8b75 100644 --- a/etc/profile-a-l/gnome-logs.profile +++ b/etc/profile-a-l/gnome-logs.profile | |||
@@ -40,7 +40,7 @@ disable-mnt | |||
40 | private-bin gnome-logs | 40 | private-bin gnome-logs |
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | private-etc alternatives,fonts,localtime,machine-id | 43 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,localtime,machine-id |
44 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 44 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
45 | private-tmp | 45 | private-tmp |
46 | writable-var-log | 46 | writable-var-log |
diff --git a/etc/profile-a-l/gnome-music.profile b/etc/profile-a-l/gnome-music.profile index a00edfa37..7b79fa15d 100644 --- a/etc/profile-a-l/gnome-music.profile +++ b/etc/profile-a-l/gnome-music.profile | |||
@@ -42,6 +42,6 @@ tracelog | |||
42 | # private-bin calls a file manager - whatever is installed! | 42 | # private-bin calls a file manager - whatever is installed! |
43 | #private-bin env,gio-launch-desktop,gnome-music,python*,yelp | 43 | #private-bin env,gio-launch-desktop,gnome-music,python*,yelp |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,machine-id,pulse,selinux,xdg | 45 | private-etc alternatives,asound.conf,dconf,fonts,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,pulse,selinux,xdg |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
diff --git a/etc/profile-a-l/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile index b69899c70..a96ec6f05 100644 --- a/etc/profile-a-l/gnome-passwordsafe.profile +++ b/etc/profile-a-l/gnome-passwordsafe.profile | |||
@@ -53,7 +53,7 @@ disable-mnt | |||
53 | private-bin gnome-passwordsafe,python3* | 53 | private-bin gnome-passwordsafe,python3* |
54 | private-cache | 54 | private-cache |
55 | private-dev | 55 | private-dev |
56 | private-etc dconf,fonts,gtk-3.0,passwd | 56 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,passwd |
57 | private-tmp | 57 | private-tmp |
58 | 58 | ||
59 | dbus-user filter | 59 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-pie.profile b/etc/profile-a-l/gnome-pie.profile index 3ab2e4aad..6d30213cb 100644 --- a/etc/profile-a-l/gnome-pie.profile +++ b/etc/profile-a-l/gnome-pie.profile | |||
@@ -34,7 +34,7 @@ shell none | |||
34 | disable-mnt | 34 | disable-mnt |
35 | private-cache | 35 | private-cache |
36 | private-dev | 36 | private-dev |
37 | private-etc alternatives,fonts,machine-id | 37 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
38 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 38 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
39 | private-tmp | 39 | private-tmp |
40 | 40 | ||
diff --git a/etc/profile-a-l/gnome-pomodoro.profile b/etc/profile-a-l/gnome-pomodoro.profile index 256a0c69f..99d569a04 100644 --- a/etc/profile-a-l/gnome-pomodoro.profile +++ b/etc/profile-a-l/gnome-pomodoro.profile | |||
@@ -44,7 +44,7 @@ disable-mnt | |||
44 | private-bin gnome-pomodoro | 44 | private-bin gnome-pomodoro |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id | 47 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,machine-id |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user filter | 50 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-recipes.profile b/etc/profile-a-l/gnome-recipes.profile index 01162b552..b2ce4a92a 100644 --- a/etc/profile-a-l/gnome-recipes.profile +++ b/etc/profile-a-l/gnome-recipes.profile | |||
@@ -47,7 +47,7 @@ shell none | |||
47 | disable-mnt | 47 | disable-mnt |
48 | private-bin gnome-recipes,tar | 48 | private-bin gnome-recipes,tar |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl | 50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,ssl |
51 | private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.* | 51 | private-lib gdk-pixbuf-2.0,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,libgnutls.so.*,libjpeg.so.*,libp11-kit.so.*,libproxy.so.*,librsvg-2.so.* |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
diff --git a/etc/profile-a-l/gnome-screenshot.profile b/etc/profile-a-l/gnome-screenshot.profile index f5afa9fb3..36c6693a9 100644 --- a/etc/profile-a-l/gnome-screenshot.profile +++ b/etc/profile-a-l/gnome-screenshot.profile | |||
@@ -42,7 +42,7 @@ tracelog | |||
42 | disable-mnt | 42 | disable-mnt |
43 | private-bin gnome-screenshot | 43 | private-bin gnome-screenshot |
44 | private-dev | 44 | private-dev |
45 | private-etc dconf,fonts,gtk-3.0,localtime,machine-id | 45 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,localtime,machine-id |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user filter | 48 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome-sound-recorder.profile b/etc/profile-a-l/gnome-sound-recorder.profile index 159145b1b..28a0205b9 100644 --- a/etc/profile-a-l/gnome-sound-recorder.profile +++ b/etc/profile-a-l/gnome-sound-recorder.profile | |||
@@ -40,5 +40,5 @@ tracelog | |||
40 | disable-mnt | 40 | disable-mnt |
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | private-etc alsa,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,machine-id,openal,pango,pulse,xdg | 43 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,openal,pango,pulse,xdg |
44 | private-tmp | 44 | private-tmp |
diff --git a/etc/profile-a-l/gnome-system-log.profile b/etc/profile-a-l/gnome-system-log.profile index 3f9497e80..02b023855 100644 --- a/etc/profile-a-l/gnome-system-log.profile +++ b/etc/profile-a-l/gnome-system-log.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin gnome-system-log | 43 | private-bin gnome-system-log |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,fonts,localtime,machine-id | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,localtime,machine-id |
47 | private-lib | 47 | private-lib |
48 | private-tmp | 48 | private-tmp |
49 | writable-var-log | 49 | writable-var-log |
diff --git a/etc/profile-a-l/gnome-todo.profile b/etc/profile-a-l/gnome-todo.profile index 4640f7f43..c6cd12250 100644 --- a/etc/profile-a-l/gnome-todo.profile +++ b/etc/profile-a-l/gnome-todo.profile | |||
@@ -46,7 +46,7 @@ disable-mnt | |||
46 | private-bin gnome-todo | 46 | private-bin gnome-todo |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc dconf,fonts,gtk-3.0,localtime,passwd,xdg | 49 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,localtime,passwd,xdg |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user filter | 52 | dbus-user filter |
diff --git a/etc/profile-a-l/gnome_games-common.profile b/etc/profile-a-l/gnome_games-common.profile index 4ad39a988..9b4f68808 100644 --- a/etc/profile-a-l/gnome_games-common.profile +++ b/etc/profile-a-l/gnome_games-common.profile | |||
@@ -41,7 +41,7 @@ tracelog | |||
41 | disable-mnt | 41 | disable-mnt |
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-etc dconf,fonts,gconf,gtk-2.0,gtk-3.0,machine-id,pango,passwd,X11 | 44 | private-etc alternatives,dconf,fonts,gconf,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,pango,passwd,X11 |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | dbus-user filter | 47 | dbus-user filter |
diff --git a/etc/profile-a-l/gnote.profile b/etc/profile-a-l/gnote.profile index 2d4ce2437..928f2c548 100644 --- a/etc/profile-a-l/gnote.profile +++ b/etc/profile-a-l/gnote.profile | |||
@@ -51,7 +51,7 @@ disable-mnt | |||
51 | private-bin gnote | 51 | private-bin gnote |
52 | private-cache | 52 | private-cache |
53 | private-dev | 53 | private-dev |
54 | private-etc dconf,fonts,gtk-3.0,pango,X11 | 54 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,pango,X11 |
55 | private-tmp | 55 | private-tmp |
56 | 56 | ||
57 | dbus-user filter | 57 | dbus-user filter |
diff --git a/etc/profile-a-l/gnubik.profile b/etc/profile-a-l/gnubik.profile index 902e76416..c895b4ce9 100644 --- a/etc/profile-a-l/gnubik.profile +++ b/etc/profile-a-l/gnubik.profile | |||
@@ -43,7 +43,7 @@ private | |||
43 | private-bin gnubik | 43 | private-bin gnubik |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc drirc,fonts,gtk-2.0 | 46 | private-etc alternatives,drirc,fonts,gtk-2.0,ld.so.cache,ld.so.preload |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-a-l/godot.profile b/etc/profile-a-l/godot.profile index b3c19e97f..46b362db9 100644 --- a/etc/profile-a-l/godot.profile +++ b/etc/profile-a-l/godot.profile | |||
@@ -38,7 +38,7 @@ tracelog | |||
38 | # private-bin godot | 38 | # private-bin godot |
39 | private-cache | 39 | private-cache |
40 | private-dev | 40 | private-dev |
41 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,mono,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl | 41 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,ld.so.cache,ld.so.preload,machine-id,mono,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | dbus-user none | 44 | dbus-user none |
diff --git a/etc/profile-a-l/goldendict.profile b/etc/profile-a-l/goldendict.profile new file mode 100644 index 000000000..5251ed427 --- /dev/null +++ b/etc/profile-a-l/goldendict.profile | |||
@@ -0,0 +1,57 @@ | |||
1 | # Firejail profile for goldendict | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include goldendict.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.goldendict | ||
9 | noblacklist ${HOME}/.cache/GoldenDict | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.goldendict | ||
20 | mkdir ${HOME}/.cache/GoldenDict | ||
21 | whitelist ${HOME}/.goldendict | ||
22 | whitelist ${HOME}/.cache/GoldenDict | ||
23 | # The default path of dictionaries | ||
24 | whitelist /usr/share/stardict/dic | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | netfilter | ||
33 | # no3d leads to the libGL MESA-LOADER errors | ||
34 | #no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | noinput | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6,netlink | ||
44 | seccomp | ||
45 | seccomp.block-secondary | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | disable-mnt | ||
50 | private-bin goldendict | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user none | ||
57 | dbus-system none | ||
diff --git a/etc/profile-a-l/googler-common.profile b/etc/profile-a-l/googler-common.profile index b8e2b04df..a35813a09 100644 --- a/etc/profile-a-l/googler-common.profile +++ b/etc/profile-a-l/googler-common.profile | |||
@@ -54,7 +54,7 @@ disable-mnt | |||
54 | private-bin env,python3*,sh,w3m | 54 | private-bin env,python3*,sh,w3m |
55 | private-cache | 55 | private-cache |
56 | private-dev | 56 | private-dev |
57 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 57 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-a-l/gpicview.profile b/etc/profile-a-l/gpicview.profile index 9a782b238..26afe6e49 100644 --- a/etc/profile-a-l/gpicview.profile +++ b/etc/profile-a-l/gpicview.profile | |||
@@ -41,7 +41,7 @@ tracelog | |||
41 | private-bin gpicview | 41 | private-bin gpicview |
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,fonts,group,passwd | 44 | private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,passwd |
45 | private-lib | 45 | private-lib |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
diff --git a/etc/profile-a-l/gpredict.profile b/etc/profile-a-l/gpredict.profile index 54e52d695..511be6fcc 100644 --- a/etc/profile-a-l/gpredict.profile +++ b/etc/profile-a-l/gpredict.profile | |||
@@ -36,6 +36,6 @@ tracelog | |||
36 | 36 | ||
37 | private-bin gpredict | 37 | private-bin gpredict |
38 | private-dev | 38 | private-dev |
39 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl | 39 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
diff --git a/etc/profile-a-l/gradio.profile b/etc/profile-a-l/gradio.profile index 31f95fb80..9cc25e45c 100644 --- a/etc/profile-a-l/gradio.profile +++ b/etc/profile-a-l/gradio.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin gradio | 45 | private-bin gradio |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 48 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user filter | 51 | dbus-user filter |
diff --git a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile index c5bcc85f3..d76ca105f 100644 --- a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile +++ b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile | |||
@@ -40,7 +40,7 @@ private | |||
40 | private-bin gravity-beams-and-evaporating-stars | 40 | private-bin gravity-beams-and-evaporating-stars |
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | private-etc fonts,machine-id | 43 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | dbus-user none | 46 | dbus-user none |
diff --git a/etc/profile-a-l/gtk-update-icon-cache.profile b/etc/profile-a-l/gtk-update-icon-cache.profile index 3231374b7..ec8a614fd 100644 --- a/etc/profile-a-l/gtk-update-icon-cache.profile +++ b/etc/profile-a-l/gtk-update-icon-cache.profile | |||
@@ -46,7 +46,7 @@ disable-mnt | |||
46 | private-bin gtk-update-icon-cache | 46 | private-bin gtk-update-icon-cache |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc none | 49 | private-etc alternatives,ld.so.cache,ld.so.preload |
50 | private-lib | 50 | private-lib |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
diff --git a/etc/profile-a-l/gwenview.profile b/etc/profile-a-l/gwenview.profile index 8c4453a8b..d98d341ae 100644 --- a/etc/profile-a-l/gwenview.profile +++ b/etc/profile-a-l/gwenview.profile | |||
@@ -25,6 +25,7 @@ include disable-interpreters.inc | |||
25 | include disable-programs.inc | 25 | include disable-programs.inc |
26 | include disable-shell.inc | 26 | include disable-shell.inc |
27 | 27 | ||
28 | include whitelist-run-common.inc | ||
28 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
29 | 30 | ||
30 | apparmor | 31 | apparmor |
@@ -46,7 +47,7 @@ shell none | |||
46 | 47 | ||
47 | private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 | 48 | private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 |
48 | private-dev | 49 | private-dev |
49 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,xdg | 50 | private-etc alternatives,fonts,gimp,gtk-2.0,kde4rc,kde5rc,ld.so.cache,ld.so.preload,machine-id,passwd,pulse,xdg |
50 | 51 | ||
51 | # dbus-user none | 52 | # dbus-user none |
52 | # dbus-system none | 53 | # dbus-system none |
diff --git a/etc/profile-a-l/hyperrogue.profile b/etc/profile-a-l/hyperrogue.profile index f210a264f..74e0faa7f 100644 --- a/etc/profile-a-l/hyperrogue.profile +++ b/etc/profile-a-l/hyperrogue.profile | |||
@@ -44,7 +44,7 @@ private-bin hyperrogue | |||
44 | private-cache | 44 | private-cache |
45 | private-cwd ${HOME} | 45 | private-cwd ${HOME} |
46 | private-dev | 46 | private-dev |
47 | private-etc fonts,machine-id | 47 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-a-l/i2prouter.profile b/etc/profile-a-l/i2prouter.profile index c875cad72..200b4c8b1 100644 --- a/etc/profile-a-l/i2prouter.profile +++ b/etc/profile-a-l/i2prouter.profile | |||
@@ -68,5 +68,5 @@ shell none | |||
68 | disable-mnt | 68 | disable-mnt |
69 | private-cache | 69 | private-cache |
70 | private-dev | 70 | private-dev |
71 | private-etc alternatives,ca-certificates,crypto-policies,dconf,group,hostname,hosts,i2p,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,localtime,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl | 71 | private-etc alternatives,ca-certificates,crypto-policies,dconf,group,hostname,hosts,i2p,java-10-openjdk,java-11-openjdk,java-12-openjdk,java-13-openjdk,java-8-openjdk,java-9-openjdk,java-openjdk,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,resolv.conf,ssl |
72 | private-tmp | 72 | private-tmp |
diff --git a/etc/profile-a-l/imv.profile b/etc/profile-a-l/imv.profile new file mode 100644 index 000000000..65e7537bf --- /dev/null +++ b/etc/profile-a-l/imv.profile | |||
@@ -0,0 +1,57 @@ | |||
1 | # Firejail profile for imv | ||
2 | # Description: imv is an image viewer. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include imv.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | include allow-bin-sh.inc | ||
10 | |||
11 | blacklist /usr/libexec | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-write-mnt.inc | ||
20 | # Users may want to view images in ${HOME} | ||
21 | #include disable-xdg.inc | ||
22 | |||
23 | # Users may want to view images in ${HOME} | ||
24 | #include whitelist-common.inc | ||
25 | include whitelist-run-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | # Users may want to view images in /usr/share | ||
28 | #include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | net none | ||
34 | nodvd | ||
35 | nogroups | ||
36 | noinput | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | nosound | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix | ||
44 | seccomp | ||
45 | seccomp.block-secondary | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | private-bin imv,imv-wayland,imv-x11,sh | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-tmp | ||
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
56 | |||
57 | read-only ${HOME} | ||
diff --git a/etc/profile-a-l/inkscape.profile b/etc/profile-a-l/inkscape.profile index 5e54b5441..016a4d6c8 100644 --- a/etc/profile-a-l/inkscape.profile +++ b/etc/profile-a-l/inkscape.profile | |||
@@ -1,6 +1,7 @@ | |||
1 | # Firejail profile for inkscape | 1 | # Firejail profile for inkscape |
2 | # Description: Vector-based drawing program | 2 | # Description: Vector-based drawing program |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | quiet | ||
4 | # Persistent local customizations | 5 | # Persistent local customizations |
5 | include inkscape.local | 6 | include inkscape.local |
6 | # Persistent global definitions | 7 | # Persistent global definitions |
@@ -28,6 +29,7 @@ include disable-programs.inc | |||
28 | include disable-xdg.inc | 29 | include disable-xdg.inc |
29 | 30 | ||
30 | whitelist /usr/share/inkscape | 31 | whitelist /usr/share/inkscape |
32 | include whitelist-run-common.inc | ||
31 | include whitelist-usr-share-common.inc | 33 | include whitelist-usr-share-common.inc |
32 | include whitelist-var-common.inc | 34 | include whitelist-var-common.inc |
33 | 35 | ||
diff --git a/etc/profile-a-l/ipcalc.profile b/etc/profile-a-l/ipcalc.profile index ea4ee5ae1..6eefd2945 100644 --- a/etc/profile-a-l/ipcalc.profile +++ b/etc/profile-a-l/ipcalc.profile | |||
@@ -50,7 +50,7 @@ private-bin bash,ipcalc,ipcalc-ng,perl,sh | |||
50 | # private-cache | 50 | # private-cache |
51 | private-dev | 51 | private-dev |
52 | # empty etc directory | 52 | # empty etc directory |
53 | private-etc none | 53 | private-etc alternatives,ld.so.cache,ld.so.preload |
54 | private-lib | 54 | private-lib |
55 | private-opt none | 55 | private-opt none |
56 | private-tmp | 56 | private-tmp |
diff --git a/etc/profile-a-l/jerry.profile b/etc/profile-a-l/jerry.profile index 1209c5e11..6ca977512 100644 --- a/etc/profile-a-l/jerry.profile +++ b/etc/profile-a-l/jerry.profile | |||
@@ -34,7 +34,7 @@ tracelog | |||
34 | 34 | ||
35 | private-bin bash,jerry,sh,stockfish | 35 | private-bin bash,jerry,sh,stockfish |
36 | private-dev | 36 | private-dev |
37 | private-etc fonts,gtk-2.0,gtk-3.0 | 37 | private-etc alternatives,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
40 | dbus-user none | 40 | dbus-user none |
diff --git a/etc/profile-a-l/jumpnbump-menu.profile b/etc/profile-a-l/jumpnbump-menu.profile index 8d391b90f..59d762f55 100644 --- a/etc/profile-a-l/jumpnbump-menu.profile +++ b/etc/profile-a-l/jumpnbump-menu.profile | |||
@@ -10,7 +10,7 @@ include jumpnbump-menu.local | |||
10 | # Allow python (blacklisted by disable-interpreters.inc) | 10 | # Allow python (blacklisted by disable-interpreters.inc) |
11 | include allow-python3.inc | 11 | include allow-python3.inc |
12 | 12 | ||
13 | private-bin jumpnbump-menu,python3* | 13 | private-bin env,jumpnbump-menu,python3* |
14 | 14 | ||
15 | # Redirect | 15 | # Redirect |
16 | include jumpnbump.profile | 16 | include jumpnbump.profile |
diff --git a/etc/profile-a-l/jumpnbump.profile b/etc/profile-a-l/jumpnbump.profile index 77d3f6bf4..4a9232344 100644 --- a/etc/profile-a-l/jumpnbump.profile +++ b/etc/profile-a-l/jumpnbump.profile | |||
@@ -27,7 +27,6 @@ caps.drop all | |||
27 | net none | 27 | net none |
28 | nodvd | 28 | nodvd |
29 | nogroups | 29 | nogroups |
30 | noinput | ||
31 | nonewprivs | 30 | nonewprivs |
32 | noroot | 31 | noroot |
33 | notv | 32 | notv |
@@ -42,7 +41,7 @@ disable-mnt | |||
42 | private-bin jumpnbump | 41 | private-bin jumpnbump |
43 | private-cache | 42 | private-cache |
44 | private-dev | 43 | private-dev |
45 | private-etc none | 44 | private-etc alternatives,ld.so.cache,ld.so.preload |
46 | private-tmp | 45 | private-tmp |
47 | 46 | ||
48 | dbus-user none | 47 | dbus-user none |
diff --git a/etc/profile-a-l/kaffeine.profile b/etc/profile-a-l/kaffeine.profile index 8799a6f24..e74c57546 100644 --- a/etc/profile-a-l/kaffeine.profile +++ b/etc/profile-a-l/kaffeine.profile | |||
@@ -22,6 +22,7 @@ include disable-interpreters.inc | |||
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-xdg.inc | 23 | include disable-xdg.inc |
24 | 24 | ||
25 | include whitelist-run-common.inc | ||
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
27 | caps.drop all | 28 | caps.drop all |
diff --git a/etc/profile-a-l/kalgebra.profile b/etc/profile-a-l/kalgebra.profile index 210b7cf03..6ad50cf14 100644 --- a/etc/profile-a-l/kalgebra.profile +++ b/etc/profile-a-l/kalgebra.profile | |||
@@ -42,7 +42,7 @@ disable-mnt | |||
42 | private-bin kalgebra,kalgebramobile | 42 | private-bin kalgebra,kalgebramobile |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc fonts,machine-id | 45 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-a-l/kate.profile b/etc/profile-a-l/kate.profile index d8b2dddb1..8c340d536 100644 --- a/etc/profile-a-l/kate.profile +++ b/etc/profile-a-l/kate.profile | |||
@@ -29,6 +29,7 @@ include disable-exec.inc | |||
29 | # include disable-interpreters.inc | 29 | # include disable-interpreters.inc |
30 | include disable-programs.inc | 30 | include disable-programs.inc |
31 | 31 | ||
32 | include whitelist-run-common.inc | ||
32 | include whitelist-var-common.inc | 33 | include whitelist-var-common.inc |
33 | 34 | ||
34 | # apparmor | 35 | # apparmor |
diff --git a/etc/profile-a-l/kazam.profile b/etc/profile-a-l/kazam.profile index 7b990bf41..277db1c24 100644 --- a/etc/profile-a-l/kazam.profile +++ b/etc/profile-a-l/kazam.profile | |||
@@ -49,7 +49,7 @@ disable-mnt | |||
49 | # private-bin kazam,python* | 49 | # private-bin kazam,python* |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,machine-id,pulse,selinux,X11,xdg | 52 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,pulse,selinux,X11,xdg |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-system none | 55 | dbus-system none |
diff --git a/etc/profile-a-l/kcalc.profile b/etc/profile-a-l/kcalc.profile index 46e8ccb82..06978cbf1 100644 --- a/etc/profile-a-l/kcalc.profile +++ b/etc/profile-a-l/kcalc.profile | |||
@@ -28,6 +28,7 @@ whitelist /usr/share/config.kcfg/kcalc.kcfg | |||
28 | whitelist /usr/share/kcalc | 28 | whitelist /usr/share/kcalc |
29 | whitelist /usr/share/kconf_update/kcalcrc.upd | 29 | whitelist /usr/share/kconf_update/kcalcrc.upd |
30 | include whitelist-common.inc | 30 | include whitelist-common.inc |
31 | include whitelist-run-common.inc | ||
31 | include whitelist-runuser-common.inc | 32 | include whitelist-runuser-common.inc |
32 | include whitelist-usr-share-common.inc | 33 | include whitelist-usr-share-common.inc |
33 | include whitelist-var-common.inc | 34 | include whitelist-var-common.inc |
@@ -55,7 +56,7 @@ disable-mnt | |||
55 | private-bin kcalc | 56 | private-bin kcalc |
56 | private-cache | 57 | private-cache |
57 | private-dev | 58 | private-dev |
58 | private-etc alternatives,fonts,ld.so.cache,locale,locale.conf | 59 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,locale,locale.conf |
59 | # private-lib - problems on Arch | 60 | # private-lib - problems on Arch |
60 | private-tmp | 61 | private-tmp |
61 | 62 | ||
diff --git a/etc/profile-a-l/kdiff3.profile b/etc/profile-a-l/kdiff3.profile index 7c9be2bcc..df7ee31dc 100644 --- a/etc/profile-a-l/kdiff3.profile +++ b/etc/profile-a-l/kdiff3.profile | |||
@@ -23,6 +23,8 @@ include disable-interpreters.inc | |||
23 | include disable-shell.inc | 23 | include disable-shell.inc |
24 | include disable-xdg.inc | 24 | include disable-xdg.inc |
25 | 25 | ||
26 | # Add the next line to your kdiff3.local if you don't need to compare files in /run. | ||
27 | #include whitelist-run-common.inc | ||
26 | include whitelist-runuser-common.inc | 28 | include whitelist-runuser-common.inc |
27 | # Add the next line to your kdiff3.local if you don't need to compare files in /usr/share. | 29 | # Add the next line to your kdiff3.local if you don't need to compare files in /usr/share. |
28 | #include whitelist-usr-share-common.inc | 30 | #include whitelist-usr-share-common.inc |
@@ -48,7 +50,7 @@ shell none | |||
48 | tracelog | 50 | tracelog |
49 | 51 | ||
50 | disable-mnt | 52 | disable-mnt |
51 | private-bin kdiff3 | 53 | private-bin kdiff3 |
52 | private-cache | 54 | private-cache |
53 | private-dev | 55 | private-dev |
54 | 56 | ||
diff --git a/etc/profile-a-l/keepassx.profile b/etc/profile-a-l/keepassx.profile index 768a3cef0..5e2d6d8df 100644 --- a/etc/profile-a-l/keepassx.profile +++ b/etc/profile-a-l/keepassx.profile | |||
@@ -41,7 +41,7 @@ tracelog | |||
41 | 41 | ||
42 | private-bin keepassx,keepassx2 | 42 | private-bin keepassx,keepassx2 |
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,fonts,machine-id | 44 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | dbus-user none | 47 | dbus-user none |
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile index b915f6202..45a707071 100644 --- a/etc/profile-a-l/keepassxc.profile +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -88,7 +88,7 @@ tracelog | |||
88 | 88 | ||
89 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy | 89 | private-bin keepassxc,keepassxc-cli,keepassxc-proxy |
90 | private-dev | 90 | private-dev |
91 | private-etc alternatives,fonts,ld.so.cache,machine-id | 91 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
92 | private-tmp | 92 | private-tmp |
93 | 93 | ||
94 | dbus-user filter | 94 | dbus-user filter |
@@ -98,11 +98,10 @@ dbus-user.talk org.freedesktop.ScreenSaver | |||
98 | dbus-user.talk org.gnome.ScreenSaver | 98 | dbus-user.talk org.gnome.ScreenSaver |
99 | dbus-user.talk org.gnome.SessionManager | 99 | dbus-user.talk org.gnome.SessionManager |
100 | dbus-user.talk org.xfce.ScreenSaver | 100 | dbus-user.talk org.xfce.ScreenSaver |
101 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher | ||
102 | ?ALLOW_TRAY: dbus-user.own org.kde.* | ||
101 | # Add the next line to your keepassxc.local to allow notifications. | 103 | # Add the next line to your keepassxc.local to allow notifications. |
102 | #dbus-user.talk org.freedesktop.Notifications | 104 | #dbus-user.talk org.freedesktop.Notifications |
103 | # Add the next line to your keepassxc.local to allow the tray menu. | ||
104 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
105 | #dbus-user.own org.kde.* | ||
106 | dbus-system filter | 105 | dbus-system filter |
107 | dbus-system.talk org.freedesktop.login1 | 106 | dbus-system.talk org.freedesktop.login1 |
108 | 107 | ||
diff --git a/etc/profile-a-l/kget.profile b/etc/profile-a-l/kget.profile index ec315b431..9b6646725 100644 --- a/etc/profile-a-l/kget.profile +++ b/etc/profile-a-l/kget.profile | |||
@@ -20,6 +20,7 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | 22 | ||
23 | include whitelist-run-common.inc | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
25 | caps.drop all | 26 | caps.drop all |
diff --git a/etc/profile-a-l/kid3.profile b/etc/profile-a-l/kid3.profile index e66716eeb..5563aa410 100644 --- a/etc/profile-a-l/kid3.profile +++ b/etc/profile-a-l/kid3.profile | |||
@@ -37,7 +37,7 @@ tracelog | |||
37 | 37 | ||
38 | private-cache | 38 | private-cache |
39 | private-dev | 39 | private-dev |
40 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hostname,hosts,kde5rc,machine-id,pki,pulse,resolv.conf,ssl | 40 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hostname,hosts,kde5rc,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
41 | private-tmp | 41 | private-tmp |
42 | private-opt none | 42 | private-opt none |
43 | private-srv none | 43 | private-srv none |
diff --git a/etc/profile-a-l/kiwix-desktop.profile b/etc/profile-a-l/kiwix-desktop.profile index 968402a8a..837ea9e36 100644 --- a/etc/profile-a-l/kiwix-desktop.profile +++ b/etc/profile-a-l/kiwix-desktop.profile | |||
@@ -44,7 +44,7 @@ shell none | |||
44 | disable-mnt | 44 | disable-mnt |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl | 47 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-a-l/klavaro.profile b/etc/profile-a-l/klavaro.profile index f733fa42c..46164403b 100644 --- a/etc/profile-a-l/klavaro.profile +++ b/etc/profile-a-l/klavaro.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin bash,klavaro,sh,tclsh,tclsh* | 45 | private-bin bash,klavaro,sh,tclsh,tclsh* |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
49 | private-tmp | 49 | private-tmp |
50 | private-opt none | 50 | private-opt none |
51 | private-srv none | 51 | private-srv none |
diff --git a/etc/profile-a-l/kmail.profile b/etc/profile-a-l/kmail.profile index 2c645677c..0796e6876 100644 --- a/etc/profile-a-l/kmail.profile +++ b/etc/profile-a-l/kmail.profile | |||
@@ -37,6 +37,7 @@ include disable-exec.inc | |||
37 | include disable-interpreters.inc | 37 | include disable-interpreters.inc |
38 | include disable-programs.inc | 38 | include disable-programs.inc |
39 | 39 | ||
40 | include whitelist-run-common.inc | ||
40 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
41 | 42 | ||
42 | # apparmor | 43 | # apparmor |
diff --git a/etc/profile-a-l/konversation.profile b/etc/profile-a-l/konversation.profile index 723fef0d2..1121dc8a5 100644 --- a/etc/profile-a-l/konversation.profile +++ b/etc/profile-a-l/konversation.profile | |||
@@ -20,6 +20,7 @@ include disable-programs.inc | |||
20 | include disable-shell.inc | 20 | include disable-shell.inc |
21 | include disable-xdg.inc | 21 | include disable-xdg.inc |
22 | 22 | ||
23 | include whitelist-run-common.inc | ||
23 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
24 | 25 | ||
25 | caps.drop all | 26 | caps.drop all |
diff --git a/etc/profile-a-l/ktorrent.profile b/etc/profile-a-l/ktorrent.profile index 9d8aa1bd7..6e3b0c875 100644 --- a/etc/profile-a-l/ktorrent.profile +++ b/etc/profile-a-l/ktorrent.profile | |||
@@ -37,6 +37,7 @@ whitelist ${HOME}/.kde4/share/config/ktorrentrc | |||
37 | whitelist ${HOME}/.local/share/ktorrent | 37 | whitelist ${HOME}/.local/share/ktorrent |
38 | whitelist ${HOME}/.local/share/kxmlgui5/ktorrent | 38 | whitelist ${HOME}/.local/share/kxmlgui5/ktorrent |
39 | include whitelist-common.inc | 39 | include whitelist-common.inc |
40 | include whitelist-run-common.inc | ||
40 | include whitelist-var-common.inc | 41 | include whitelist-var-common.inc |
41 | 42 | ||
42 | caps.drop all | 43 | caps.drop all |
diff --git a/etc/profile-a-l/ktouch.profile b/etc/profile-a-l/ktouch.profile index 051782172..44da8acca 100644 --- a/etc/profile-a-l/ktouch.profile +++ b/etc/profile-a-l/ktouch.profile | |||
@@ -46,7 +46,7 @@ disable-mnt | |||
46 | private-bin ktouch | 46 | private-bin ktouch |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc alternatives,fonts,kde5rc,machine-id | 49 | private-etc alternatives,fonts,kde5rc,ld.so.cache,ld.so.preload,machine-id |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user none | 52 | dbus-user none |
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile index 262ffb532..718cbbf40 100644 --- a/etc/profile-a-l/kube.profile +++ b/etc/profile-a-l/kube.profile | |||
@@ -68,7 +68,7 @@ tracelog | |||
68 | private-bin kube,sink_synchronizer | 68 | private-bin kube,sink_synchronizer |
69 | private-cache | 69 | private-cache |
70 | private-dev | 70 | private-dev |
71 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | 71 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gcrypt,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg |
72 | private-tmp | 72 | private-tmp |
73 | writable-run-user | 73 | writable-run-user |
74 | 74 | ||
diff --git a/etc/profile-a-l/kwin_x11.profile b/etc/profile-a-l/kwin_x11.profile index 5bbadfc73..0b8763c29 100644 --- a/etc/profile-a-l/kwin_x11.profile +++ b/etc/profile-a-l/kwin_x11.profile | |||
@@ -21,6 +21,7 @@ include disable-programs.inc | |||
21 | include disable-shell.inc | 21 | include disable-shell.inc |
22 | include disable-xdg.inc | 22 | include disable-xdg.inc |
23 | 23 | ||
24 | include whitelist-run-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
26 | caps.drop all | 27 | caps.drop all |
@@ -42,5 +43,5 @@ tracelog | |||
42 | disable-mnt | 43 | disable-mnt |
43 | private-bin kwin_x11 | 44 | private-bin kwin_x11 |
44 | private-dev | 45 | private-dev |
45 | private-etc alternatives,drirc,fonts,kde5rc,ld.so.cache,machine-id,xdg | 46 | private-etc alternatives,drirc,fonts,kde5rc,ld.so.cache,ld.so.preload,machine-id,xdg |
46 | private-tmp | 47 | private-tmp |
diff --git a/etc/profile-a-l/kwrite.profile b/etc/profile-a-l/kwrite.profile index 682c7782d..aff6f3181 100644 --- a/etc/profile-a-l/kwrite.profile +++ b/etc/profile-a-l/kwrite.profile | |||
@@ -24,6 +24,7 @@ include disable-programs.inc | |||
24 | include disable-shell.inc | 24 | include disable-shell.inc |
25 | include disable-xdg.inc | 25 | include disable-xdg.inc |
26 | 26 | ||
27 | include whitelist-run-common.inc | ||
27 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
28 | 29 | ||
29 | apparmor | 30 | apparmor |
@@ -46,7 +47,7 @@ tracelog | |||
46 | 47 | ||
47 | private-bin kbuildsycoca4,kdeinit4,kwrite | 48 | private-bin kbuildsycoca4,kdeinit4,kwrite |
48 | private-dev | 49 | private-dev |
49 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,pulse,xdg | 50 | private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,ld.so.preload,machine-id,pulse,xdg |
50 | private-tmp | 51 | private-tmp |
51 | 52 | ||
52 | # dbus-user none | 53 | # dbus-user none |
diff --git a/etc/profile-a-l/libreoffice.profile b/etc/profile-a-l/libreoffice.profile index 328307705..12ff79748 100644 --- a/etc/profile-a-l/libreoffice.profile +++ b/etc/profile-a-l/libreoffice.profile | |||
@@ -21,6 +21,7 @@ include disable-devel.inc | |||
21 | include disable-exec.inc | 21 | include disable-exec.inc |
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | 23 | ||
24 | include whitelist-run-common.inc | ||
24 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
25 | 26 | ||
26 | # Debian 10/Ubuntu 18.04 come with their own apparmor profile, but it is not in enforce mode. | 27 | # Debian 10/Ubuntu 18.04 come with their own apparmor profile, but it is not in enforce mode. |
diff --git a/etc/profile-a-l/links-common.profile b/etc/profile-a-l/links-common.profile index bd28f25d6..84f5dc50d 100644 --- a/etc/profile-a-l/links-common.profile +++ b/etc/profile-a-l/links-common.profile | |||
@@ -47,11 +47,11 @@ shell none | |||
47 | tracelog | 47 | tracelog |
48 | 48 | ||
49 | disable-mnt | 49 | disable-mnt |
50 | # Add 'private-bin PROGRAM1,PROGRAM2' to your links-common.local if you want to use user-configured programs. | 50 | # Add 'private-bin PROGRAM1,PROGRAM2' to your links-common.local if you want to use user-configured programs. |
51 | private-bin sh | 51 | private-bin sh |
52 | private-cache | 52 | private-cache |
53 | private-dev | 53 | private-dev |
54 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 54 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
55 | # Add the next line to your links-common.local to allow external media players. | 55 | # Add the next line to your links-common.local to allow external media players. |
56 | # private-etc alsa,asound.conf,machine-id,openal,pulse | 56 | # private-etc alsa,asound.conf,machine-id,openal,pulse |
57 | private-tmp | 57 | private-tmp |
diff --git a/etc/profile-a-l/lollypop.profile b/etc/profile-a-l/lollypop.profile index a187ca0fc..fde338ff0 100644 --- a/etc/profile-a-l/lollypop.profile +++ b/etc/profile-a-l/lollypop.profile | |||
@@ -37,6 +37,6 @@ seccomp | |||
37 | shell none | 37 | shell none |
38 | 38 | ||
39 | private-dev | 39 | private-dev |
40 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 40 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg |
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
diff --git a/etc/profile-a-l/lyx.profile b/etc/profile-a-l/lyx.profile index fa69463d1..ae2f2d434 100644 --- a/etc/profile-a-l/lyx.profile +++ b/etc/profile-a-l/lyx.profile | |||
@@ -32,7 +32,7 @@ apparmor | |||
32 | machine-id | 32 | machine-id |
33 | 33 | ||
34 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex | 34 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex |
35 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,lyx,machine-id,mime.types,passwd,texmf,X11,xdg | 35 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,lyx,machine-id,mime.types,passwd,texmf,X11,xdg |
36 | 36 | ||
37 | # Redirect | 37 | # Redirect |
38 | include latex-common.profile | 38 | include latex-common.profile |
diff --git a/etc/profile-m-z/QOwnNotes.profile b/etc/profile-m-z/QOwnNotes.profile index 15cb931dd..235640eeb 100644 --- a/etc/profile-m-z/QOwnNotes.profile +++ b/etc/profile-m-z/QOwnNotes.profile | |||
@@ -50,6 +50,6 @@ tracelog | |||
50 | disable-mnt | 50 | disable-mnt |
51 | private-bin gio,QOwnNotes | 51 | private-bin gio,QOwnNotes |
52 | private-dev | 52 | private-dev |
53 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hosts,ld.so.cache,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 53 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
diff --git a/etc/profile-m-z/Viber.profile b/etc/profile-m-z/Viber.profile index 866d57e67..89ca53af6 100644 --- a/etc/profile-m-z/Viber.profile +++ b/etc/profile-m-z/Viber.profile | |||
@@ -33,5 +33,5 @@ shell none | |||
33 | 33 | ||
34 | disable-mnt | 34 | disable-mnt |
35 | private-bin awk,bash,dig,sh,Viber | 35 | private-bin awk,bash,dig,sh,Viber |
36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11 | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,mailcap,nsswitch.conf,pki,proxychains.conf,pulse,resolv.conf,ssl,X11 |
37 | private-tmp | 37 | private-tmp |
diff --git a/etc/profile-m-z/Xvfb.profile b/etc/profile-m-z/Xvfb.profile index 1acd43023..722e12d9c 100644 --- a/etc/profile-m-z/Xvfb.profile +++ b/etc/profile-m-z/Xvfb.profile | |||
@@ -43,5 +43,5 @@ private | |||
43 | # private-bin sh,xkbcomp,Xvfb | 43 | # private-bin sh,xkbcomp,Xvfb |
44 | # private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb | 44 | # private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf | 46 | private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,nsswitch.conf,resolv.conf |
47 | private-tmp | 47 | private-tmp |
diff --git a/etc/profile-m-z/magicor.profile b/etc/profile-m-z/magicor.profile index fc5ae3ee9..47165dd3d 100644 --- a/etc/profile-m-z/magicor.profile +++ b/etc/profile-m-z/magicor.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin magicor,python2* | 45 | private-bin magicor,python2* |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc machine-id | 48 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/make.profile b/etc/profile-m-z/make.profile new file mode 100644 index 000000000..7e9638fe4 --- /dev/null +++ b/etc/profile-m-z/make.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for make | ||
2 | # Description: GNU make utility to maintain groups of programs | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include make.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | memory-deny-write-execute | ||
11 | |||
12 | # Redirect | ||
13 | include build-systems-common.profile | ||
diff --git a/etc/profile-m-z/man.profile b/etc/profile-m-z/man.profile index b2f761230..9c5959091 100644 --- a/etc/profile-m-z/man.profile +++ b/etc/profile-m-z/man.profile | |||
@@ -58,7 +58,7 @@ disable-mnt | |||
58 | #private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim | 58 | #private-bin apropos,bash,cat,catman,col,gpreconv,groff,grotty,gunzip,gzip,less,man,most,nroff,preconv,sed,sh,tbl,tr,troff,whatis,which,xtotroff,zcat,zsoelim |
59 | private-cache | 59 | private-cache |
60 | private-dev | 60 | private-dev |
61 | private-etc alternatives,fonts,groff,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg | 61 | private-etc alternatives,fonts,groff,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,man_db.conf,manpath.config,selinux,sysless,xdg |
62 | #private-tmp | 62 | #private-tmp |
63 | 63 | ||
64 | dbus-user none | 64 | dbus-user none |
diff --git a/etc/profile-m-z/masterpdfeditor.profile b/etc/profile-m-z/masterpdfeditor.profile index e61578ffe..764d040ab 100644 --- a/etc/profile-m-z/masterpdfeditor.profile +++ b/etc/profile-m-z/masterpdfeditor.profile | |||
@@ -36,6 +36,6 @@ tracelog | |||
36 | 36 | ||
37 | private-cache | 37 | private-cache |
38 | private-dev | 38 | private-dev |
39 | private-etc alternatives,fonts | 39 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
diff --git a/etc/profile-m-z/mate-calc.profile b/etc/profile-m-z/mate-calc.profile index 64b184482..2be6b9af1 100644 --- a/etc/profile-m-z/mate-calc.profile +++ b/etc/profile-m-z/mate-calc.profile | |||
@@ -42,7 +42,7 @@ shell none | |||
42 | 42 | ||
43 | disable-mnt | 43 | disable-mnt |
44 | private-bin mate-calc,mate-calculator | 44 | private-bin mate-calc,mate-calculator |
45 | private-etc alternatives,dconf,fonts,gtk-3.0 | 45 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload |
46 | private-dev | 46 | private-dev |
47 | private-opt none | 47 | private-opt none |
48 | private-tmp | 48 | private-tmp |
diff --git a/etc/profile-m-z/mate-color-select.profile b/etc/profile-m-z/mate-color-select.profile index a6b49315c..e16b0fc6c 100644 --- a/etc/profile-m-z/mate-color-select.profile +++ b/etc/profile-m-z/mate-color-select.profile | |||
@@ -33,7 +33,7 @@ shell none | |||
33 | 33 | ||
34 | disable-mnt | 34 | disable-mnt |
35 | private-bin mate-color-select | 35 | private-bin mate-color-select |
36 | private-etc alternatives,fonts | 36 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
37 | private-dev | 37 | private-dev |
38 | private-lib | 38 | private-lib |
39 | private-tmp | 39 | private-tmp |
diff --git a/etc/profile-m-z/mate-dictionary.profile b/etc/profile-m-z/mate-dictionary.profile index 3f3d027b9..469416304 100644 --- a/etc/profile-m-z/mate-dictionary.profile +++ b/etc/profile-m-z/mate-dictionary.profile | |||
@@ -37,7 +37,7 @@ shell none | |||
37 | 37 | ||
38 | disable-mnt | 38 | disable-mnt |
39 | private-bin mate-dictionary | 39 | private-bin mate-dictionary |
40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl | 40 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
41 | private-opt mate-dictionary | 41 | private-opt mate-dictionary |
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
diff --git a/etc/profile-m-z/mcabber.profile b/etc/profile-m-z/mcabber.profile index 7592d879c..4c4a6aa76 100644 --- a/etc/profile-m-z/mcabber.profile +++ b/etc/profile-m-z/mcabber.profile | |||
@@ -31,4 +31,4 @@ shell none | |||
31 | 31 | ||
32 | private-bin mcabber | 32 | private-bin mcabber |
33 | private-dev | 33 | private-dev |
34 | private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 34 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,ssl |
diff --git a/etc/profile-m-z/mdr.profile b/etc/profile-m-z/mdr.profile index 08d56ede5..bcfd59cbb 100644 --- a/etc/profile-m-z/mdr.profile +++ b/etc/profile-m-z/mdr.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin mdr | 45 | private-bin mdr |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc none | 48 | private-etc alternatives,ld.so.cache,ld.so.preload |
49 | private-lib | 49 | private-lib |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
diff --git a/etc/profile-m-z/mediainfo.profile b/etc/profile-m-z/mediainfo.profile index 7597d4067..9bfbaf745 100644 --- a/etc/profile-m-z/mediainfo.profile +++ b/etc/profile-m-z/mediainfo.profile | |||
@@ -42,7 +42,7 @@ x11 none | |||
42 | private-bin mediainfo | 42 | private-bin mediainfo |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives | 45 | private-etc alternatives,ld.so.cache,ld.so.preload |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/menulibre.profile b/etc/profile-m-z/menulibre.profile index 4845e9cce..ed0758a49 100644 --- a/etc/profile-m-z/menulibre.profile +++ b/etc/profile-m-z/menulibre.profile | |||
@@ -52,7 +52,7 @@ tracelog | |||
52 | disable-mnt | 52 | disable-mnt |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc alternatives,dconf,fonts,gtk-3.0,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg | 55 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,locale.alias,locale.conf,mime.types,nsswitch.conf,passwd,pki,selinux,X11,xdg |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/meson.profile b/etc/profile-m-z/meson.profile new file mode 100644 index 000000000..b4909a9d8 --- /dev/null +++ b/etc/profile-m-z/meson.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for meson | ||
2 | # Description: A high productivity build system | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include meson.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | # Allow python3 (blacklisted by disable-interpreters.inc) | ||
11 | include allow-python3.inc | ||
12 | |||
13 | # Redirect | ||
14 | include build-systems-common.profile | ||
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile index 34d9f470a..095038f08 100644 --- a/etc/profile-m-z/microsoft-edge-beta.profile +++ b/etc/profile-m-z/microsoft-edge-beta.profile | |||
@@ -17,4 +17,4 @@ whitelist ${HOME}/.config/microsoft-edge-beta | |||
17 | private-opt microsoft | 17 | private-opt microsoft |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
20 | include chromium-common.profile \ No newline at end of file | 20 | include chromium-common.profile |
diff --git a/etc/profile-m-z/mindless.profile b/etc/profile-m-z/mindless.profile index ad7e40b12..16ace7ce4 100644 --- a/etc/profile-m-z/mindless.profile +++ b/etc/profile-m-z/mindless.profile | |||
@@ -42,7 +42,7 @@ private | |||
42 | private-bin mindless | 42 | private-bin mindless |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc fonts | 45 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile index c47a16ffd..be846ce63 100644 --- a/etc/profile-m-z/mirrormagic.profile +++ b/etc/profile-m-z/mirrormagic.profile | |||
@@ -44,7 +44,7 @@ private | |||
44 | private-bin mirrormagic | 44 | private-bin mirrormagic |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc machine-id | 47 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile index dbc3c1d40..313d78030 100644 --- a/etc/profile-m-z/mocp.profile +++ b/etc/profile-m-z/mocp.profile | |||
@@ -42,7 +42,7 @@ tracelog | |||
42 | private-bin mocp | 42 | private-bin mocp |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,machine-id,pki,pulse,resolv.conf,ssl | 45 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,group,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/mp3splt-gtk.profile b/etc/profile-m-z/mp3splt-gtk.profile index f0063d250..fe3c78b55 100644 --- a/etc/profile-m-z/mp3splt-gtk.profile +++ b/etc/profile-m-z/mp3splt-gtk.profile | |||
@@ -37,7 +37,7 @@ tracelog | |||
37 | private-bin mp3splt-gtk | 37 | private-bin mp3splt-gtk |
38 | private-cache | 38 | private-cache |
39 | private-dev | 39 | private-dev |
40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,machine-id,openal,pulse | 40 | private-etc alsa,alternatives,asound.conf,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,openal,pulse |
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
43 | dbus-user none | 43 | dbus-user none |
diff --git a/etc/profile-m-z/mp3splt.profile b/etc/profile-m-z/mp3splt.profile index 400d8a6b6..c89c72ce4 100644 --- a/etc/profile-m-z/mp3splt.profile +++ b/etc/profile-m-z/mp3splt.profile | |||
@@ -44,7 +44,7 @@ disable-mnt | |||
44 | private-bin flacsplt,mp3splt,mp3wrap,oggsplt | 44 | private-bin flacsplt,mp3splt,mp3wrap,oggsplt |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc alternatives | 47 | private-etc alternatives,ld.so.cache,ld.so.preload |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/mpDris2.profile b/etc/profile-m-z/mpDris2.profile index 10964ef24..18a839363 100644 --- a/etc/profile-m-z/mpDris2.profile +++ b/etc/profile-m-z/mpDris2.profile | |||
@@ -49,7 +49,7 @@ shell none | |||
49 | private-bin mpDris2,notify-send,python* | 49 | private-bin mpDris2,notify-send,python* |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc alternatives,hosts,nsswitch.conf | 52 | private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf |
53 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* | 53 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile index fa433b672..efb11465b 100644 --- a/etc/profile-m-z/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -11,7 +11,7 @@ include globals.local | |||
11 | # edit ~/.config/mpv/foobar.conf: | 11 | # edit ~/.config/mpv/foobar.conf: |
12 | # screenshot-directory=~/Pictures | 12 | # screenshot-directory=~/Pictures |
13 | 13 | ||
14 | # Mpv has a powerfull lua-API, some off these lua-scripts interact | 14 | # Mpv has a powerful lua-API, some off these lua-scripts interact |
15 | # with external resources which are blocked by firejail. In such cases | 15 | # with external resources which are blocked by firejail. In such cases |
16 | # you need to allow these resources by | 16 | # you need to allow these resources by |
17 | # - adding additional binaries to private-bin | 17 | # - adding additional binaries to private-bin |
@@ -74,7 +74,7 @@ seccomp.block-secondary | |||
74 | shell none | 74 | shell none |
75 | tracelog | 75 | tracelog |
76 | 76 | ||
77 | private-bin env,mpv,python*,waf,youtube-dl | 77 | private-bin env,mpv,python*,waf,youtube-dl,yt-dlp |
78 | # private-cache causes slow OSD, see #2838 | 78 | # private-cache causes slow OSD, see #2838 |
79 | #private-cache | 79 | #private-cache |
80 | private-dev | 80 | private-dev |
diff --git a/etc/profile-m-z/mrrescue.profile b/etc/profile-m-z/mrrescue.profile index 530e779fc..3fe88ec7f 100644 --- a/etc/profile-m-z/mrrescue.profile +++ b/etc/profile-m-z/mrrescue.profile | |||
@@ -37,7 +37,6 @@ caps.drop all | |||
37 | net none | 37 | net none |
38 | nodvd | 38 | nodvd |
39 | nogroups | 39 | nogroups |
40 | noinput | ||
41 | nonewprivs | 40 | nonewprivs |
42 | noroot | 41 | noroot |
43 | notv | 42 | notv |
@@ -53,7 +52,7 @@ disable-mnt | |||
53 | private-bin love,mrrescue,sh | 52 | private-bin love,mrrescue,sh |
54 | private-cache | 53 | private-cache |
55 | private-dev | 54 | private-dev |
56 | private-etc machine-id | 55 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
57 | private-tmp | 56 | private-tmp |
58 | 57 | ||
59 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/ms-office.profile b/etc/profile-m-z/ms-office.profile index ad12f53a4..e15b14db7 100644 --- a/etc/profile-m-z/ms-office.profile +++ b/etc/profile-m-z/ms-office.profile | |||
@@ -35,7 +35,7 @@ tracelog | |||
35 | 35 | ||
36 | disable-mnt | 36 | disable-mnt |
37 | private-bin bash,env,fonts,jak,ms-office,python*,sh | 37 | private-bin bash,env,fonts,jak,ms-office,python*,sh |
38 | private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 38 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
39 | private-dev | 39 | private-dev |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
diff --git a/etc/profile-m-z/mupdf-x11-curl.profile b/etc/profile-m-z/mupdf-x11-curl.profile index a04d386a2..006f64ba8 100644 --- a/etc/profile-m-z/mupdf-x11-curl.profile +++ b/etc/profile-m-z/mupdf-x11-curl.profile | |||
@@ -12,7 +12,7 @@ ignore net none | |||
12 | netfilter | 12 | netfilter |
13 | protocol unix,inet,inet6 | 13 | protocol unix,inet,inet6 |
14 | 14 | ||
15 | private-etc ca-certificates,crypto-policies,hosts,nsswitch.conf,pki,resolv.conf,ssl | 15 | private-etc alternatives,ca-certificates,crypto-policies,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include mupdf.profile | 18 | include mupdf.profile |
diff --git a/etc/profile-m-z/musixmatch.profile b/etc/profile-m-z/musixmatch.profile index 07661cac8..796d7fbb0 100644 --- a/etc/profile-m-z/musixmatch.profile +++ b/etc/profile-m-z/musixmatch.profile | |||
@@ -29,9 +29,9 @@ notv | |||
29 | nou2f | 29 | nou2f |
30 | novideo | 30 | novideo |
31 | protocol unix,inet,inet6,netlink | 31 | protocol unix,inet,inet6,netlink |
32 | seccomp | 32 | seccomp !chroot |
33 | 33 | ||
34 | disable-mnt | 34 | disable-mnt |
35 | private-dev | 35 | private-dev |
36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,machine-id,pki,pulse,ssl | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,machine-id,pki,pulse,ssl |
37 | 37 | ||
diff --git a/etc/profile-m-z/mutt.profile b/etc/profile-m-z/mutt.profile index c4d96711c..d10c55549 100644 --- a/etc/profile-m-z/mutt.profile +++ b/etc/profile-m-z/mutt.profile | |||
@@ -134,7 +134,7 @@ tracelog | |||
134 | # disable-mnt | 134 | # disable-mnt |
135 | private-cache | 135 | private-cache |
136 | private-dev | 136 | private-dev |
137 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg | 137 | private-etc alternatives,ca-certificates,crypto-policies,fonts,gai.conf,gcrypt,gnupg,gnutls,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,terminfo,xdg |
138 | private-tmp | 138 | private-tmp |
139 | writable-run-user | 139 | writable-run-user |
140 | writable-var | 140 | writable-var |
diff --git a/etc/profile-m-z/mypaint.profile b/etc/profile-m-z/mypaint.profile index 1b4fc4346..74301df06 100644 --- a/etc/profile-m-z/mypaint.profile +++ b/etc/profile-m-z/mypaint.profile | |||
@@ -43,7 +43,7 @@ tracelog | |||
43 | 43 | ||
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,dconf,fonts,gtk-3.0 | 46 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/nano.profile b/etc/profile-m-z/nano.profile index 996a1722a..f7c1f0ff7 100644 --- a/etc/profile-m-z/nano.profile +++ b/etc/profile-m-z/nano.profile | |||
@@ -49,7 +49,7 @@ private-dev | |||
49 | # Add the next lines to your nano.local if you want to edit files in /etc directly. | 49 | # Add the next lines to your nano.local if you want to edit files in /etc directly. |
50 | #ignore private-etc | 50 | #ignore private-etc |
51 | #writable-etc | 51 | #writable-etc |
52 | private-etc alternatives,nanorc | 52 | private-etc alternatives,ld.so.cache,ld.so.preload,nanorc |
53 | # Add the next line to your nano.local if you want to edit files in /var directly. | 53 | # Add the next line to your nano.local if you want to edit files in /var directly. |
54 | #writable-var | 54 | #writable-var |
55 | 55 | ||
diff --git a/etc/profile-m-z/neochat.profile b/etc/profile-m-z/neochat.profile index 58cc716d9..0f55b674f 100644 --- a/etc/profile-m-z/neochat.profile +++ b/etc/profile-m-z/neochat.profile | |||
@@ -60,6 +60,6 @@ private-tmp | |||
60 | dbus-user filter | 60 | dbus-user filter |
61 | dbus-user.own org.kde.neochat | 61 | dbus-user.own org.kde.neochat |
62 | dbus-user.talk org.freedesktop.Notifications | 62 | dbus-user.talk org.freedesktop.Notifications |
63 | dbus-user.talk org.kde.StatusNotifierWatcher | 63 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
64 | dbus-user.talk org.kde.kwalletd5 | 64 | dbus-user.talk org.kde.kwalletd5 |
65 | dbus-system none | 65 | dbus-system none |
diff --git a/etc/profile-m-z/neomutt.profile b/etc/profile-m-z/neomutt.profile index 7e627a52e..f31cf9dcb 100644 --- a/etc/profile-m-z/neomutt.profile +++ b/etc/profile-m-z/neomutt.profile | |||
@@ -137,7 +137,7 @@ tracelog | |||
137 | # disable-mnt | 137 | # disable-mnt |
138 | private-cache | 138 | private-cache |
139 | private-dev | 139 | private-dev |
140 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg | 140 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mail,mailname,Mutt,Muttrc,Muttrc.d,neomuttrc,neomuttrc.d,nntpserver,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg |
141 | private-tmp | 141 | private-tmp |
142 | writable-run-user | 142 | writable-run-user |
143 | writable-var | 143 | writable-var |
diff --git a/etc/profile-m-z/netactview.profile b/etc/profile-m-z/netactview.profile index 1bcc6a962..d6ac8d5bc 100644 --- a/etc/profile-m-z/netactview.profile +++ b/etc/profile-m-z/netactview.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin netactview,netactview_polkit | 45 | private-bin netactview,netactview_polkit |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
49 | private-lib | 49 | private-lib |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
diff --git a/etc/profile-m-z/newsboat.profile b/etc/profile-m-z/newsboat.profile index fa4ccea7c..cf72bf802 100644 --- a/etc/profile-m-z/newsboat.profile +++ b/etc/profile-m-z/newsboat.profile | |||
@@ -53,7 +53,7 @@ disable-mnt | |||
53 | private-bin gzip,lynx,newsboat,sh,w3m | 53 | private-bin gzip,lynx,newsboat,sh,w3m |
54 | private-cache | 54 | private-cache |
55 | private-dev | 55 | private-dev |
56 | private-etc alternatives,ca-certificates,crypto-policies,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo | 56 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,lynx.cfg,lynx.lss,pki,resolv.conf,ssl,terminfo |
57 | private-tmp | 57 | private-tmp |
58 | 58 | ||
59 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-m-z/newsflash.profile b/etc/profile-m-z/newsflash.profile index 56cedec03..9966a0e1b 100644 --- a/etc/profile-m-z/newsflash.profile +++ b/etc/profile-m-z/newsflash.profile | |||
@@ -51,7 +51,7 @@ disable-mnt | |||
51 | private-bin com.gitlab.newsflash,newsflash | 51 | private-bin com.gitlab.newsflash,newsflash |
52 | private-cache | 52 | private-cache |
53 | private-dev | 53 | private-dev |
54 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11 | 54 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,nsswitch.conf,pango,pki,resolv.conf,ssl,X11 |
55 | private-tmp | 55 | private-tmp |
56 | 56 | ||
57 | dbus-user none | 57 | dbus-user none |
diff --git a/etc/profile-m-z/nextcloud.profile b/etc/profile-m-z/nextcloud.profile index cb499ba34..354d3351e 100644 --- a/etc/profile-m-z/nextcloud.profile +++ b/etc/profile-m-z/nextcloud.profile | |||
@@ -61,12 +61,11 @@ tracelog | |||
61 | disable-mnt | 61 | disable-mnt |
62 | private-bin nextcloud,nextcloud-desktop | 62 | private-bin nextcloud,nextcloud-desktop |
63 | private-cache | 63 | private-cache |
64 | private-etc alternatives,ca-certificates,crypto-policies,drirc,fonts,gcrypt,host.conf,hosts,ld.so.cache,machine-id,Nextcloud,nsswitch.conf,os-release,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 64 | private-etc alternatives,ca-certificates,crypto-policies,drirc,fonts,gcrypt,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,Nextcloud,nsswitch.conf,os-release,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
65 | private-dev | 65 | private-dev |
66 | private-tmp | 66 | private-tmp |
67 | 67 | ||
68 | dbus-user filter | 68 | dbus-user filter |
69 | dbus-user.talk org.freedesktop.secrets | 69 | dbus-user.talk org.freedesktop.secrets |
70 | # Add the next line to your nextcloud.local for tray icon support | 70 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
71 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
72 | dbus-system none | 71 | dbus-system none |
diff --git a/etc/profile-m-z/nheko.profile b/etc/profile-m-z/nheko.profile index 035ad086a..89a146a09 100644 --- a/etc/profile-m-z/nheko.profile +++ b/etc/profile-m-z/nheko.profile | |||
@@ -51,11 +51,9 @@ private-dev | |||
51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | 54 | dbus-user filter | |
55 | # Add the next lines to your nheko.local to enable notification support. | 55 | dbus-user.talk org.freedesktop.secrets |
56 | #ignore dbus-user none | 56 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
57 | #dbus-user filter | 57 | # Add the next line to your nheko.local to enable notification support. |
58 | #dbus-user.talk org.freedesktop.Notifications | 58 | #dbus-user.talk org.freedesktop.Notifications |
59 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
60 | dbus-user none | ||
61 | dbus-system none | 59 | dbus-system none |
diff --git a/etc/profile-m-z/nitroshare.profile b/etc/profile-m-z/nitroshare.profile index d5dd4ca95..d6234cd04 100644 --- a/etc/profile-m-z/nitroshare.profile +++ b/etc/profile-m-z/nitroshare.profile | |||
@@ -42,7 +42,7 @@ disable-mnt | |||
42 | private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,nitroshare-ui | 42 | private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,nitroshare-ui |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache,machine-id,nsswitch.conf,ssl | 45 | private-etc alternatives,ca-certificates,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,ssl |
46 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare | 46 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
diff --git a/etc/profile-m-z/nomacs.profile b/etc/profile-m-z/nomacs.profile index b044fb879..7ffb09e56 100644 --- a/etc/profile-m-z/nomacs.profile +++ b/etc/profile-m-z/nomacs.profile | |||
@@ -41,5 +41,5 @@ tracelog | |||
41 | #private-bin nomacs | 41 | #private-bin nomacs |
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,login.defs,machine-id,pki,resolv.conf,ssl | 44 | private-etc alternatives,ca-certificates,crypto-policies,dconf,drirc,fonts,gtk-3.0,hosts,ld.so.cache,ld.so.preload,login.defs,machine-id,pki,resolv.conf,ssl |
45 | private-tmp | 45 | private-tmp |
diff --git a/etc/profile-m-z/noprofile.profile b/etc/profile-m-z/noprofile.profile new file mode 100644 index 000000000..560ee9db3 --- /dev/null +++ b/etc/profile-m-z/noprofile.profile | |||
@@ -0,0 +1,28 @@ | |||
1 | # This is the weakest possible firejail profile. | ||
2 | # If a program still fail with this profile, it is incompatible with firejail. | ||
3 | # (from https://gist.github.com/rusty-snake/bb234cb3e50e1e4e7429f29a7931cc72) | ||
4 | # | ||
5 | # Usage: | ||
6 | # 1. download | ||
7 | # 2. firejail --profile=noprofile.profile /path/to/program | ||
8 | |||
9 | # Keep in mind that even with this profile some things are done | ||
10 | # which can break the program. | ||
11 | # - some env-vars are cleared | ||
12 | # - /etc/firejail/firejail.config can contain options such as 'force-nonewprivs yes' | ||
13 | # - a new private pid-namespace is created | ||
14 | # - a minimal hardcoded blacklist is applied | ||
15 | # - ... | ||
16 | |||
17 | noblacklist /sys/fs | ||
18 | noblacklist /sys/module | ||
19 | |||
20 | allow-debuggers | ||
21 | allusers | ||
22 | keep-config-pulse | ||
23 | keep-dev-shm | ||
24 | keep-var-tmp | ||
25 | writable-etc | ||
26 | writable-run-user | ||
27 | writable-var | ||
28 | writable-var-log | ||
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile index 5caf3374d..9f23c099d 100644 --- a/etc/profile-m-z/notify-send.profile +++ b/etc/profile-m-z/notify-send.profile | |||
@@ -49,7 +49,7 @@ private | |||
49 | private-bin notify-send | 49 | private-bin notify-send |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc none | 52 | private-etc alternatives,ld.so.cache,ld.so.preload |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-user filter | 55 | dbus-user filter |
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile index 886403b9e..9f4a6ec46 100644 --- a/etc/profile-m-z/nuclear.profile +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -18,7 +18,7 @@ whitelist ${HOME}/.config/nuclear | |||
18 | no3d | 18 | no3d |
19 | 19 | ||
20 | # private-bin nuclear | 20 | # private-bin nuclear |
21 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
22 | private-opt nuclear | 22 | private-opt nuclear |
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
diff --git a/etc/profile-m-z/nyx.profile b/etc/profile-m-z/nyx.profile index 460a580b3..653591482 100644 --- a/etc/profile-m-z/nyx.profile +++ b/etc/profile-m-z/nyx.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin nyx,python* | 45 | private-bin nyx,python* |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,fonts,passwd,tor | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,passwd,tor |
49 | private-opt none | 49 | private-opt none |
50 | private-srv none | 50 | private-srv none |
51 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index 8e87f1d5d..0bfb35333 100644 --- a/etc/profile-m-z/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -45,7 +45,7 @@ tracelog | |||
45 | private-bin ocenaudio | 45 | private-bin ocenaudio |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,asound.conf,fonts,ld.so.cache,pulse | 48 | private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,pulse |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # breaks preferences | 51 | # breaks preferences |
diff --git a/etc/profile-m-z/odt2txt.profile b/etc/profile-m-z/odt2txt.profile index 22cec475b..de62f4114 100644 --- a/etc/profile-m-z/odt2txt.profile +++ b/etc/profile-m-z/odt2txt.profile | |||
@@ -38,7 +38,7 @@ x11 none | |||
38 | private-bin odt2txt | 38 | private-bin odt2txt |
39 | private-cache | 39 | private-cache |
40 | private-dev | 40 | private-dev |
41 | private-etc alternatives | 41 | private-etc alternatives,ld.so.cache,ld.so.preload |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | dbus-user none | 44 | dbus-user none |
diff --git a/etc/profile-m-z/okular.profile b/etc/profile-m-z/okular.profile index 84edc65ef..fb28ad89f 100644 --- a/etc/profile-m-z/okular.profile +++ b/etc/profile-m-z/okular.profile | |||
@@ -36,6 +36,7 @@ whitelist /usr/share/kconf_update/okular.upd | |||
36 | whitelist /usr/share/kxmlgui5/okular | 36 | whitelist /usr/share/kxmlgui5/okular |
37 | whitelist /usr/share/okular | 37 | whitelist /usr/share/okular |
38 | whitelist /usr/share/poppler | 38 | whitelist /usr/share/poppler |
39 | include whitelist-run-common.inc | ||
39 | include whitelist-runuser-common.inc | 40 | include whitelist-runuser-common.inc |
40 | include whitelist-usr-share-common.inc | 41 | include whitelist-usr-share-common.inc |
41 | include whitelist-var-common.inc | 42 | include whitelist-var-common.inc |
@@ -61,7 +62,7 @@ tracelog | |||
61 | 62 | ||
62 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar | 63 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar |
63 | private-dev | 64 | private-dev |
64 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,xdg | 65 | private-etc alternatives,cups,fonts,kde4rc,kde5rc,ld.so.cache,ld.so.preload,machine-id,passwd,xdg |
65 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients | 66 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients |
66 | 67 | ||
67 | # dbus-user none | 68 | # dbus-user none |
diff --git a/etc/profile-m-z/onboard.profile b/etc/profile-m-z/onboard.profile index b0ffba19c..e05e58cad 100644 --- a/etc/profile-m-z/onboard.profile +++ b/etc/profile-m-z/onboard.profile | |||
@@ -50,7 +50,7 @@ disable-mnt | |||
50 | private-cache | 50 | private-cache |
51 | private-bin onboard,python*,tput | 51 | private-bin onboard,python*,tput |
52 | private-dev | 52 | private-dev |
53 | private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg | 53 | private-etc alternatives,dbus-1,dconf,fonts,gtk-2.0,gtk-3.0,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,mime.types,selinux,X11,xdg |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | dbus-system none | 56 | dbus-system none |
diff --git a/etc/profile-m-z/open-invaders.profile b/etc/profile-m-z/open-invaders.profile index 12c7ea3d0..c2c22f42d 100644 --- a/etc/profile-m-z/open-invaders.profile +++ b/etc/profile-m-z/open-invaders.profile | |||
@@ -25,7 +25,6 @@ caps.drop all | |||
25 | net none | 25 | net none |
26 | nodvd | 26 | nodvd |
27 | nogroups | 27 | nogroups |
28 | noinput | ||
29 | nonewprivs | 28 | nonewprivs |
30 | noroot | 29 | noroot |
31 | notv | 30 | notv |
diff --git a/etc/profile-m-z/openarena.profile b/etc/profile-m-z/openarena.profile index 076a655a1..c3ac097a0 100644 --- a/etc/profile-m-z/openarena.profile +++ b/etc/profile-m-z/openarena.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity | 43 | private-bin bash,cut,glxinfo,grep,head,openarena,openarena_ded,quake3,zenity |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc drirc,machine-id,openal,passwd,selinux,udev,xdg | 46 | private-etc alternatives,drirc,ld.so.cache,ld.so.preload,machine-id,openal,passwd,selinux,udev,xdg |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/openclonk.profile b/etc/profile-m-z/openclonk.profile index 253465991..68362cbc8 100644 --- a/etc/profile-m-z/openclonk.profile +++ b/etc/profile-m-z/openclonk.profile | |||
@@ -28,7 +28,6 @@ ipc-namespace | |||
28 | netfilter | 28 | netfilter |
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
31 | noinput | ||
32 | nonewprivs | 31 | nonewprivs |
33 | noroot | 32 | noroot |
34 | notv | 33 | notv |
diff --git a/etc/profile-m-z/pandoc.profile b/etc/profile-m-z/pandoc.profile index 2595d8a8f..c016b5103 100644 --- a/etc/profile-m-z/pandoc.profile +++ b/etc/profile-m-z/pandoc.profile | |||
@@ -11,6 +11,8 @@ blacklist ${RUNUSER} | |||
11 | 11 | ||
12 | noblacklist ${DOCUMENTS} | 12 | noblacklist ${DOCUMENTS} |
13 | 13 | ||
14 | include allow-bin-sh.inc | ||
15 | |||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-devel.inc | 17 | include disable-devel.inc |
16 | include disable-exec.inc | 18 | include disable-exec.inc |
@@ -19,6 +21,7 @@ include disable-programs.inc | |||
19 | include disable-shell.inc | 21 | include disable-shell.inc |
20 | include disable-xdg.inc | 22 | include disable-xdg.inc |
21 | 23 | ||
24 | include whitelist-runuser-common.inc | ||
22 | # breaks pdf output | 25 | # breaks pdf output |
23 | #include whitelist-var-common.inc | 26 | #include whitelist-var-common.inc |
24 | 27 | ||
@@ -39,15 +42,15 @@ nou2f | |||
39 | novideo | 42 | novideo |
40 | protocol unix | 43 | protocol unix |
41 | seccomp | 44 | seccomp |
45 | seccomp.block-secondary | ||
42 | shell none | 46 | shell none |
43 | tracelog | 47 | tracelog |
44 | x11 none | 48 | x11 none |
45 | 49 | ||
46 | disable-mnt | 50 | disable-mnt |
47 | private-bin context,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf | ||
48 | private-cache | 51 | private-cache |
49 | private-dev | 52 | private-dev |
50 | private-etc alternatives,texlive,texmf | 53 | private-etc alternatives,ld.so.cache,ld.so.preload,texlive,texmf |
51 | private-tmp | 54 | private-tmp |
52 | 55 | ||
53 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-m-z/parole.profile b/etc/profile-m-z/parole.profile index 33d75f0d2..3d380542f 100644 --- a/etc/profile-m-z/parole.profile +++ b/etc/profile-m-z/parole.profile | |||
@@ -27,4 +27,4 @@ shell none | |||
27 | 27 | ||
28 | private-bin dbus-launch,parole | 28 | private-bin dbus-launch,parole |
29 | private-cache | 29 | private-cache |
30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,pulse,ssl | 30 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd,pki,pulse,ssl |
diff --git a/etc/profile-m-z/pavucontrol.profile b/etc/profile-m-z/pavucontrol.profile index 0bd14e88e..d64aab200 100644 --- a/etc/profile-m-z/pavucontrol.profile +++ b/etc/profile-m-z/pavucontrol.profile | |||
@@ -45,7 +45,7 @@ disable-mnt | |||
45 | private-bin pavucontrol | 45 | private-bin pavucontrol |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,asound.conf,avahi,fonts,machine-id,pulse | 48 | private-etc alternatives,asound.conf,avahi,fonts,ld.so.cache,ld.so.preload,machine-id,pulse |
49 | private-lib | 49 | private-lib |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
diff --git a/etc/profile-m-z/pdfchain.profile b/etc/profile-m-z/pdfchain.profile index bebd4ba44..41ec98a39 100644 --- a/etc/profile-m-z/pdfchain.profile +++ b/etc/profile-m-z/pdfchain.profile | |||
@@ -34,7 +34,7 @@ shell none | |||
34 | 34 | ||
35 | private-bin pdfchain,pdftk,sh | 35 | private-bin pdfchain,pdftk,sh |
36 | private-dev | 36 | private-dev |
37 | private-etc alternatives,dconf,fonts,gtk-3.0,xdg | 37 | private-etc alternatives,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,xdg |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
40 | dbus-user none | 40 | dbus-user none |
diff --git a/etc/profile-m-z/pdftotext.profile b/etc/profile-m-z/pdftotext.profile index 0cb08aa74..9d2f2b95f 100644 --- a/etc/profile-m-z/pdftotext.profile +++ b/etc/profile-m-z/pdftotext.profile | |||
@@ -48,7 +48,7 @@ x11 none | |||
48 | private-bin pdftotext | 48 | private-bin pdftotext |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc alternatives | 51 | private-etc alternatives,ld.so.cache,ld.so.preload |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/peek.profile b/etc/profile-m-z/peek.profile index a8f925313..f5c295b5d 100644 --- a/etc/profile-m-z/peek.profile +++ b/etc/profile-m-z/peek.profile | |||
@@ -48,7 +48,7 @@ tracelog | |||
48 | disable-mnt | 48 | disable-mnt |
49 | private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh | 49 | private-bin bash,convert,ffmpeg,firejail,fish,peek,sh,which,zsh |
50 | private-dev | 50 | private-dev |
51 | private-etc dconf,firejail,fonts,gtk-3.0,login.defs,pango,passwd,X11 | 51 | private-etc alternatives,dconf,firejail,fonts,gtk-3.0,ld.so.cache,ld.so.preload,login.defs,pango,passwd,X11 |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | dbus-user filter | 54 | dbus-user filter |
diff --git a/etc/profile-m-z/photoflare.profile b/etc/profile-m-z/photoflare.profile index c012504c4..80efedec7 100644 --- a/etc/profile-m-z/photoflare.profile +++ b/etc/profile-m-z/photoflare.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin photoflare | 43 | private-bin photoflare |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,fonts,locale,locale.alias,locale.conf,mime.types,X11 | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,locale,locale.alias,locale.conf,mime.types,X11 |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/pingus.profile b/etc/profile-m-z/pingus.profile index 5b2d7a5a4..69c78740d 100644 --- a/etc/profile-m-z/pingus.profile +++ b/etc/profile-m-z/pingus.profile | |||
@@ -50,7 +50,7 @@ disable-mnt | |||
50 | private-bin pingus,pingus.bin,sh | 50 | private-bin pingus,pingus.bin,sh |
51 | private-cache | 51 | private-cache |
52 | private-dev | 52 | private-dev |
53 | private-etc machine-id | 53 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | dbus-user none | 56 | dbus-user none |
diff --git a/etc/profile-m-z/pip.profile b/etc/profile-m-z/pip.profile new file mode 100644 index 000000000..a0926371f --- /dev/null +++ b/etc/profile-m-z/pip.profile | |||
@@ -0,0 +1,18 @@ | |||
1 | # Firejail profile for pip | ||
2 | # Description: package manager for Python packages | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include meson.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | ignore read-only ${HOME}/.local/lib | ||
11 | |||
12 | # Allow python3 (blacklisted by disable-interpreters.inc) | ||
13 | include allow-python3.inc | ||
14 | |||
15 | #whitelist ${HOME}/.local/lib/python* | ||
16 | |||
17 | # Redirect | ||
18 | include build-systems-common.profile | ||
diff --git a/etc/profile-m-z/pkglog.profile b/etc/profile-m-z/pkglog.profile index c2707dac4..69b954f53 100644 --- a/etc/profile-m-z/pkglog.profile +++ b/etc/profile-m-z/pkglog.profile | |||
@@ -44,7 +44,7 @@ private | |||
44 | private-bin pkglog,python* | 44 | private-bin pkglog,python* |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc alternatives | 47 | private-etc alternatives,ld.so.cache,ld.so.preload |
48 | private-opt none | 48 | private-opt none |
49 | private-tmp | 49 | private-tmp |
50 | writable-var-log | 50 | writable-var-log |
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile index 80f768170..38ccf72e8 100644 --- a/etc/profile-m-z/plv.profile +++ b/etc/profile-m-z/plv.profile | |||
@@ -46,7 +46,7 @@ disable-mnt | |||
46 | private-bin plv | 46 | private-bin plv |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc alternatives,fonts | 49 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
50 | private-opt none | 50 | private-opt none |
51 | private-tmp | 51 | private-tmp |
52 | writable-var-log | 52 | writable-var-log |
diff --git a/etc/profile-m-z/pngquant.profile b/etc/profile-m-z/pngquant.profile index 0b3d2b44c..6b989202f 100644 --- a/etc/profile-m-z/pngquant.profile +++ b/etc/profile-m-z/pngquant.profile | |||
@@ -47,7 +47,7 @@ x11 none | |||
47 | private-bin pngquant | 47 | private-bin pngquant |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives | 50 | private-etc alternatives,ld.so.cache,ld.so.preload |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | dbus-user none | 53 | dbus-user none |
diff --git a/etc/profile-m-z/pragha.profile b/etc/profile-m-z/pragha.profile index bc0ff0e85..fd595c27a 100644 --- a/etc/profile-m-z/pragha.profile +++ b/etc/profile-m-z/pragha.profile | |||
@@ -33,6 +33,6 @@ seccomp | |||
33 | shell none | 33 | shell none |
34 | 34 | ||
35 | private-dev | 35 | private-dev |
36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,machine-id,pki,pulse,resolv.conf,ssl,xdg | 36 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,pki,pulse,resolv.conf,ssl,xdg |
37 | private-tmp | 37 | private-tmp |
38 | 38 | ||
diff --git a/etc/profile-m-z/profanity.profile b/etc/profile-m-z/profanity.profile index 705af370b..25a248425 100644 --- a/etc/profile-m-z/profanity.profile +++ b/etc/profile-m-z/profanity.profile | |||
@@ -44,7 +44,7 @@ shell none | |||
44 | private-bin profanity | 44 | private-bin profanity |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc alternatives,ca-certificates,crypto-policies,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,localtime,mime.types,nsswitch.conf,pki,resolv.conf,ssl |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/psi.profile b/etc/profile-m-z/psi.profile index 450bb10c7..99a72adee 100644 --- a/etc/profile-m-z/psi.profile +++ b/etc/profile-m-z/psi.profile | |||
@@ -71,7 +71,7 @@ disable-mnt | |||
71 | private-bin getopt,psi | 71 | private-bin getopt,psi |
72 | private-cache | 72 | private-cache |
73 | private-dev | 73 | private-dev |
74 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gcrypt,group,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 74 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,gcrypt,group,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
75 | private-tmp | 75 | private-tmp |
76 | 76 | ||
77 | dbus-user none | 77 | dbus-user none |
diff --git a/etc/profile-m-z/qgis.profile b/etc/profile-m-z/qgis.profile index 3dc232b55..555e1e41b 100644 --- a/etc/profile-m-z/qgis.profile +++ b/etc/profile-m-z/qgis.profile | |||
@@ -52,7 +52,7 @@ tracelog | |||
52 | disable-mnt | 52 | disable-mnt |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf | 55 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,QGIS,QGIS.conf,resolv.conf,ssl,Trolltech.conf |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/qnapi.profile b/etc/profile-m-z/qnapi.profile index 4eee0df5f..4a3ce366e 100644 --- a/etc/profile-m-z/qnapi.profile +++ b/etc/profile-m-z/qnapi.profile | |||
@@ -47,7 +47,7 @@ tracelog | |||
47 | private-bin 7z,qnapi | 47 | private-bin 7z,qnapi |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,fonts | 50 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
51 | private-opt none | 51 | private-opt none |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
diff --git a/etc/profile-m-z/qrencode.profile b/etc/profile-m-z/qrencode.profile index 7ef676068..dd3f24875 100644 --- a/etc/profile-m-z/qrencode.profile +++ b/etc/profile-m-z/qrencode.profile | |||
@@ -47,7 +47,7 @@ disable-mnt | |||
47 | private-bin qrencode | 47 | private-bin qrencode |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc none | 50 | private-etc alternatives,ld.so.cache,ld.so.preload |
51 | private-lib libpcre* | 51 | private-lib libpcre* |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
diff --git a/etc/profile-m-z/qtox.profile b/etc/profile-m-z/qtox.profile index bae802cc6..60e1539fa 100644 --- a/etc/profile-m-z/qtox.profile +++ b/etc/profile-m-z/qtox.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin qtox | 43 | private-bin qtox |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/regextester.profile b/etc/profile-m-z/regextester.profile index 1de59bc7c..f1ce313e7 100644 --- a/etc/profile-m-z/regextester.profile +++ b/etc/profile-m-z/regextester.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin regextester | 43 | private-bin regextester |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,fonts | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
47 | private-lib libgranite.so.* | 47 | private-lib libgranite.so.* |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
diff --git a/etc/profile-m-z/retroarch.profile b/etc/profile-m-z/retroarch.profile new file mode 100644 index 000000000..1887a9b72 --- /dev/null +++ b/etc/profile-m-z/retroarch.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for retroarch | ||
2 | # Description: retroarch is a frontend to libretro emulator cores. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include retroarch.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | blacklist /usr/libexec | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/retroarch | ||
20 | whitelist ${HOME}/.config/retroarch | ||
21 | whitelist /run/udev | ||
22 | whitelist /usr/share/retroarch | ||
23 | whitelist /usr/share/libretro | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-run-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | netfilter | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | notv | ||
38 | nou2f | ||
39 | # If you need access to cameras, add `ignore novideo` to retroarch.local | ||
40 | novideo | ||
41 | protocol unix,inet,inet6,netlink | ||
42 | seccomp | ||
43 | seccomp.block-secondary | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private-bin retroarch | ||
49 | private-cache | ||
50 | private-dev | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/profile-m-z/rsync-download_only.profile b/etc/profile-m-z/rsync-download_only.profile index 23a65f54a..e44e55a12 100644 --- a/etc/profile-m-z/rsync-download_only.profile +++ b/etc/profile-m-z/rsync-download_only.profile | |||
@@ -49,7 +49,7 @@ disable-mnt | |||
49 | private-bin rsync | 49 | private-bin rsync |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/scorchwentbonkers.profile b/etc/profile-m-z/scorchwentbonkers.profile index 1069c34ea..70b5d844a 100644 --- a/etc/profile-m-z/scorchwentbonkers.profile +++ b/etc/profile-m-z/scorchwentbonkers.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin scorchwentbonkers | 43 | private-bin scorchwentbonkers |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alsa,asound.conf,machine-id,pulse | 46 | private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile index af7d5eeac..72d6d5cf7 100644 --- a/etc/profile-m-z/seahorse-adventures.profile +++ b/etc/profile-m-z/seahorse-adventures.profile | |||
@@ -48,7 +48,7 @@ private | |||
48 | private-bin bash,dash,python*,seahorse-adventures,sh | 48 | private-bin bash,dash,python*,seahorse-adventures,sh |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc machine-id | 51 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/seahorse-tool.profile b/etc/profile-m-z/seahorse-tool.profile index 96ff74edf..9ef174606 100644 --- a/etc/profile-m-z/seahorse-tool.profile +++ b/etc/profile-m-z/seahorse-tool.profile | |||
@@ -8,7 +8,7 @@ include seahorse-tool.local | |||
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # private-etc workaround for: #2877 | 10 | # private-etc workaround for: #2877 |
11 | private-etc firejail,login.defs,passwd | 11 | private-etc alternatives,firejail,ld.so.cache,ld.so.preload,login.defs,passwd |
12 | private-tmp | 12 | private-tmp |
13 | 13 | ||
14 | # Redirect | 14 | # Redirect |
diff --git a/etc/profile-m-z/seahorse.profile b/etc/profile-m-z/seahorse.profile index 94a27da87..7382e4712 100644 --- a/etc/profile-m-z/seahorse.profile +++ b/etc/profile-m-z/seahorse.profile | |||
@@ -60,7 +60,7 @@ tracelog | |||
60 | disable-mnt | 60 | disable-mnt |
61 | private-cache | 61 | private-cache |
62 | private-dev | 62 | private-dev |
63 | private-etc ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 | 63 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pango,pki,protocols,resolv.conf,rpc,services,ssh,ssl,X11 |
64 | writable-run-user | 64 | writable-run-user |
65 | 65 | ||
66 | dbus-user filter | 66 | dbus-user filter |
diff --git a/etc/profile-m-z/shotwell.profile b/etc/profile-m-z/shotwell.profile index b6a828636..3b569eeaf 100644 --- a/etc/profile-m-z/shotwell.profile +++ b/etc/profile-m-z/shotwell.profile | |||
@@ -49,7 +49,7 @@ tracelog | |||
49 | private-bin shotwell | 49 | private-bin shotwell |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc alternatives,fonts,machine-id | 52 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
53 | private-opt none | 53 | private-opt none |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
diff --git a/etc/profile-m-z/slack.profile b/etc/profile-m-z/slack.profile index 51f6c8b00..a511ebb1c 100644 --- a/etc/profile-m-z/slack.profile +++ b/etc/profile-m-z/slack.profile | |||
@@ -26,7 +26,7 @@ mkdir ${HOME}/.config/Slack | |||
26 | whitelist ${HOME}/.config/Slack | 26 | whitelist ${HOME}/.config/Slack |
27 | 27 | ||
28 | private-bin electron,electron[0-9],electron[0-9][0-9],locale,sh,slack | 28 | private-bin electron,electron[0-9],electron[0-9][0-9],locale,sh,slack |
29 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe | 29 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,ld.so.preload,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe |
30 | 30 | ||
31 | # Redirect | 31 | # Redirect |
32 | include electron.profile | 32 | include electron.profile |
diff --git a/etc/profile-m-z/smuxi-frontend-gnome.profile b/etc/profile-m-z/smuxi-frontend-gnome.profile index 31d14924c..0cdb5537e 100644 --- a/etc/profile-m-z/smuxi-frontend-gnome.profile +++ b/etc/profile-m-z/smuxi-frontend-gnome.profile | |||
@@ -48,7 +48,7 @@ disable-mnt | |||
48 | private-bin bash,mono,mono-sgen,sh,smuxi-frontend-gnome | 48 | private-bin bash,mono,mono-sgen,sh,smuxi-frontend-gnome |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,mono,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg | 51 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.preload,machine-id,mono,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | dbus-user none | 54 | dbus-user none |
diff --git a/etc/profile-m-z/softmaker-common.profile b/etc/profile-m-z/softmaker-common.profile index ebdd5c1f8..099e6a2ad 100644 --- a/etc/profile-m-z/softmaker-common.profile +++ b/etc/profile-m-z/softmaker-common.profile | |||
@@ -6,9 +6,9 @@ include softmaker-common.local | |||
6 | # added by caller profile | 6 | # added by caller profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | # The offical packages install the desktop file under /usr/local/share/applications | 9 | # The official packages install the desktop file under /usr/local/share/applications |
10 | # with an absolute Exec line. These files are NOT handelt by firecfg, | 10 | # with an absolute Exec line. These files are NOT handled by firecfg, |
11 | # therefore you must manualy copy them in you home and remove '/usr/bin/'. | 11 | # therefore you must manually copy them in you home and remove '/usr/bin/'. |
12 | 12 | ||
13 | noblacklist ${HOME}/SoftMaker | 13 | noblacklist ${HOME}/SoftMaker |
14 | 14 | ||
@@ -43,7 +43,7 @@ tracelog | |||
43 | private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free | 43 | private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,SoftMaker,ssl |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/spectacle.profile b/etc/profile-m-z/spectacle.profile index d803fa5ce..fc4ae2b04 100644 --- a/etc/profile-m-z/spectacle.profile +++ b/etc/profile-m-z/spectacle.profile | |||
@@ -22,7 +22,7 @@ include disable-interpreters.inc | |||
22 | include disable-programs.inc | 22 | include disable-programs.inc |
23 | include disable-xdg.inc | 23 | include disable-xdg.inc |
24 | 24 | ||
25 | mkfile ${HOME}/.config/spectaclerc | 25 | mkfile ${HOME}/.config/spectaclerc |
26 | whitelist ${HOME}/.config/spectaclerc | 26 | whitelist ${HOME}/.config/spectaclerc |
27 | whitelist ${PICTURES} | 27 | whitelist ${PICTURES} |
28 | whitelist /usr/share/kconf_update/spectacle_newConfig.upd | 28 | whitelist /usr/share/kconf_update/spectacle_newConfig.upd |
@@ -56,7 +56,7 @@ disable-mnt | |||
56 | private-bin spectacle | 56 | private-bin spectacle |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | private-dev |
59 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d | 59 | private-etc alternatives,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
62 | dbus-user filter | 62 | dbus-user filter |
diff --git a/etc/profile-m-z/spectral.profile b/etc/profile-m-z/spectral.profile index 5f17b73dc..3f7f68009 100644 --- a/etc/profile-m-z/spectral.profile +++ b/etc/profile-m-z/spectral.profile | |||
@@ -49,10 +49,8 @@ private-dev | |||
49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user none | 52 | dbus-user filter |
53 | # Add the next lines to your spectral.local to enable notification support. | 53 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
54 | #ignore dbus-user none | 54 | # Add the next line to your spectral.local to enable notification support. |
55 | #dbus-user filter | ||
56 | #dbus-user.talk org.freedesktop.Notifications | 55 | #dbus-user.talk org.freedesktop.Notifications |
57 | #dbus-user.talk org.kde.StatusNotifierWatcher | ||
58 | dbus-system none | 56 | dbus-system none |
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile index ffee76d23..0ce918161 100644 --- a/etc/profile-m-z/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -44,7 +44,7 @@ disable-mnt | |||
44 | private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity | 44 | private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity |
45 | private-dev | 45 | private-dev |
46 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. | 46 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. |
47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hosts,ld.so.cache,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl | 47 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,host.conf,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,pulse,resolv.conf,ssl |
48 | private-opt spotify | 48 | private-opt spotify |
49 | private-srv none | 49 | private-srv none |
50 | private-tmp | 50 | private-tmp |
diff --git a/etc/profile-m-z/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile index e35f74404..deaf37f52 100644 --- a/etc/profile-m-z/sqlitebrowser.profile +++ b/etc/profile-m-z/sqlitebrowser.profile | |||
@@ -42,7 +42,7 @@ shell none | |||
42 | private-bin sqlitebrowser | 42 | private-bin sqlitebrowser |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,machine-id,passwd,pki,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd,pki,ssl |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # breaks proxy creation | 48 | # breaks proxy creation |
diff --git a/etc/profile-m-z/ssh-agent.profile b/etc/profile-m-z/ssh-agent.profile index 11723664f..9d3fe9637 100644 --- a/etc/profile-m-z/ssh-agent.profile +++ b/etc/profile-m-z/ssh-agent.profile | |||
@@ -11,6 +11,7 @@ include allow-ssh.inc | |||
11 | 11 | ||
12 | blacklist /tmp/.X11-unix | 12 | blacklist /tmp/.X11-unix |
13 | blacklist ${RUNUSER}/wayland-* | 13 | blacklist ${RUNUSER}/wayland-* |
14 | noblacklist /usr/lib/openssh/ssh-keysign | ||
14 | 15 | ||
15 | include disable-common.inc | 16 | include disable-common.inc |
16 | include disable-programs.inc | 17 | include disable-programs.inc |
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile index 9295013e7..194b2082c 100644 --- a/etc/profile-m-z/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -10,6 +10,7 @@ include globals.local | |||
10 | # nc can be used as ProxyCommand, e.g. when using tor | 10 | # nc can be used as ProxyCommand, e.g. when using tor |
11 | noblacklist ${PATH}/nc | 11 | noblacklist ${PATH}/nc |
12 | noblacklist ${PATH}/ncat | 12 | noblacklist ${PATH}/ncat |
13 | noblacklist /usr/lib/openssh/ssh-keysign | ||
13 | 14 | ||
14 | # Allow ssh (blacklisted by disable-common.inc) | 15 | # Allow ssh (blacklisted by disable-common.inc) |
15 | include allow-ssh.inc | 16 | include allow-ssh.inc |
diff --git a/etc/profile-m-z/standardnotes-desktop.profile b/etc/profile-m-z/standardnotes-desktop.profile index d54ddacdd..7a59274bf 100644 --- a/etc/profile-m-z/standardnotes-desktop.profile +++ b/etc/profile-m-z/standardnotes-desktop.profile | |||
@@ -38,7 +38,7 @@ seccomp !chroot | |||
38 | disable-mnt | 38 | disable-mnt |
39 | private-dev | 39 | private-dev |
40 | private-tmp | 40 | private-tmp |
41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,pki,resolv.conf,ssl,xdg | 41 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg |
42 | 42 | ||
43 | dbus-user none | 43 | dbus-user none |
44 | dbus-system none | 44 | dbus-system none |
diff --git a/etc/profile-m-z/straw-viewer.profile b/etc/profile-m-z/straw-viewer.profile index d73927f2a..513abc21b 100644 --- a/etc/profile-m-z/straw-viewer.profile +++ b/etc/profile-m-z/straw-viewer.profile | |||
@@ -18,4 +18,4 @@ whitelist ${HOME}/.config/straw-viewer | |||
18 | private-bin gtk-straw-viewer,straw-viewer | 18 | private-bin gtk-straw-viewer,straw-viewer |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include youtube-viewers-common.profile \ No newline at end of file | 21 | include youtube-viewers-common.profile |
diff --git a/etc/profile-m-z/strawberry.profile b/etc/profile-m-z/strawberry.profile index dfb0a3e3b..32e43f079 100644 --- a/etc/profile-m-z/strawberry.profile +++ b/etc/profile-m-z/strawberry.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin strawberry,strawberry-tagreader | 43 | private-bin strawberry,strawberry-tagreader |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,nsswitch.conf,pki,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-system none | 49 | dbus-system none |
diff --git a/etc/profile-m-z/subdownloader.profile b/etc/profile-m-z/subdownloader.profile index 100ac9d14..a9f22085b 100644 --- a/etc/profile-m-z/subdownloader.profile +++ b/etc/profile-m-z/subdownloader.profile | |||
@@ -44,7 +44,7 @@ tracelog | |||
44 | 44 | ||
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc alternatives,fonts | 47 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile index 0e9113821..464fa1b08 100644 --- a/etc/profile-m-z/supertux2.profile +++ b/etc/profile-m-z/supertux2.profile | |||
@@ -30,7 +30,6 @@ caps.drop all | |||
30 | net none | 30 | net none |
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | noinput | ||
34 | nonewprivs | 33 | nonewprivs |
35 | noroot | 34 | noroot |
36 | notv | 35 | notv |
@@ -45,7 +44,7 @@ tracelog | |||
45 | disable-mnt | 44 | disable-mnt |
46 | # private-bin supertux2 | 45 | # private-bin supertux2 |
47 | private-cache | 46 | private-cache |
48 | private-etc machine-id | 47 | private-etc alternatives,ld.so.cache,ld.so.preload,machine-id |
49 | private-dev | 48 | private-dev |
50 | private-tmp | 49 | private-tmp |
51 | 50 | ||
diff --git a/etc/profile-m-z/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile index 7ba7e7023..473472251 100644 --- a/etc/profile-m-z/supertuxkart.profile +++ b/etc/profile-m-z/supertuxkart.profile | |||
@@ -54,7 +54,7 @@ private-bin supertuxkart | |||
54 | private-cache | 54 | private-cache |
55 | # Add the next line to your supertuxkart.local if you do not need controller support. | 55 | # Add the next line to your supertuxkart.local if you do not need controller support. |
56 | #private-dev | 56 | #private-dev |
57 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,machine-id,openal,pki,resolv.conf,ssl | 57 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,ld.so.cache,ld.so.preload,machine-id,openal,pki,resolv.conf,ssl |
58 | private-tmp | 58 | private-tmp |
59 | private-opt none | 59 | private-opt none |
60 | private-srv none | 60 | private-srv none |
diff --git a/etc/profile-m-z/surf.profile b/etc/profile-m-z/surf.profile index 7c092fccc..c04f00cab 100644 --- a/etc/profile-m-z/surf.profile +++ b/etc/profile-m-z/surf.profile | |||
@@ -34,6 +34,6 @@ tracelog | |||
34 | disable-mnt | 34 | disable-mnt |
35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop | 35 | private-bin bash,curl,dmenu,ls,printf,sed,sh,sleep,st,stterm,surf,xargs,xprop |
36 | private-dev | 36 | private-dev |
37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl | 37 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,ld.so.cache,ld.so.preload,machine-id,passwd,pki,resolv.conf,ssl |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
diff --git a/etc/profile-m-z/sway.profile b/etc/profile-m-z/sway.profile index 4637419bf..046d1b4be 100644 --- a/etc/profile-m-z/sway.profile +++ b/etc/profile-m-z/sway.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for Sway | 1 | # Firejail profile for Sway |
2 | # Description: i3-compatible Wayland compositor | 2 | # Description: i3-compatible Wayland compositor |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include sway.local | 5 | include sway.local |
diff --git a/etc/profile-m-z/sysprof.profile b/etc/profile-m-z/sysprof.profile index ac4a380bb..c7119ae0f 100644 --- a/etc/profile-m-z/sysprof.profile +++ b/etc/profile-m-z/sysprof.profile | |||
@@ -63,7 +63,7 @@ disable-mnt | |||
63 | #private-bin sysprof - breaks help menu | 63 | #private-bin sysprof - breaks help menu |
64 | private-cache | 64 | private-cache |
65 | private-dev | 65 | private-dev |
66 | private-etc alternatives,fonts,ld.so.cache,machine-id,ssl | 66 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id,ssl |
67 | # private-lib - breaks help menu | 67 | # private-lib - breaks help menu |
68 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so | 68 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so |
69 | private-tmp | 69 | private-tmp |
diff --git a/etc/profile-m-z/tar.profile b/etc/profile-m-z/tar.profile index 0d3a900e9..0817adda8 100644 --- a/etc/profile-m-z/tar.profile +++ b/etc/profile-m-z/tar.profile | |||
@@ -14,7 +14,7 @@ ignore include disable-shell.inc | |||
14 | # all capabilities this is automatically read-only. | 14 | # all capabilities this is automatically read-only. |
15 | noblacklist /var/lib/pacman | 15 | noblacklist /var/lib/pacman |
16 | 16 | ||
17 | private-etc alternatives,group,localtime,login.defs,passwd | 17 | private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,login.defs,passwd |
18 | #private-lib libfakeroot,liblzma.so.*,libreadline.so.* | 18 | #private-lib libfakeroot,liblzma.so.*,libreadline.so.* |
19 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) | 19 | # Debian based distributions need this for 'dpkg --unpack' (incl. synaptic) |
20 | writable-var | 20 | writable-var |
diff --git a/etc/profile-m-z/teams-for-linux.profile b/etc/profile-m-z/teams-for-linux.profile index c97921d92..ee19bcd00 100644 --- a/etc/profile-m-z/teams-for-linux.profile +++ b/etc/profile-m-z/teams-for-linux.profile | |||
@@ -20,7 +20,7 @@ mkdir ${HOME}/.config/teams-for-linux | |||
20 | whitelist ${HOME}/.config/teams-for-linux | 20 | whitelist ${HOME}/.config/teams-for-linux |
21 | 21 | ||
22 | private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh | 22 | private-bin bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,teams-for-linux,tr,xdg-mime,xdg-open,zsh |
23 | private-etc ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,pki,resolv.conf,ssl | 23 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,resolv.conf,ssl |
24 | 24 | ||
25 | # Redirect | 25 | # Redirect |
26 | include electron.profile | 26 | include electron.profile |
diff --git a/etc/profile-m-z/teeworlds.profile b/etc/profile-m-z/teeworlds.profile index df54fb9ba..d0fb0d43e 100644 --- a/etc/profile-m-z/teeworlds.profile +++ b/etc/profile-m-z/teeworlds.profile | |||
@@ -26,7 +26,6 @@ ipc-namespace | |||
26 | netfilter | 26 | netfilter |
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | noinput | ||
30 | nonewprivs | 29 | nonewprivs |
31 | noroot | 30 | noroot |
32 | notv | 31 | notv |
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile index 115be54eb..dc1f77664 100644 --- a/etc/profile-m-z/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -41,16 +41,16 @@ seccomp.block-secondary | |||
41 | shell none | 41 | shell none |
42 | 42 | ||
43 | disable-mnt | 43 | disable-mnt |
44 | #private-bin telegram,Telegram,telegram-desktop | 44 | private-bin telegram,Telegram,telegram-desktop |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg | 47 | private-etc alsa,alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,machine-id,os-release,passwd,pki,pulse,resolv.conf,ssl,xdg |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user filter | 50 | dbus-user filter |
51 | dbus-user.own org.telegram.desktop.* | 51 | dbus-user.own org.telegram.desktop.* |
52 | dbus-user.talk org.freedesktop.Notifications | 52 | dbus-user.talk org.freedesktop.Notifications |
53 | dbus-user.talk org.kde.StatusNotifierWatcher | 53 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
54 | dbus-user.talk org.gnome.Mutter.IdleMonitor | 54 | dbus-user.talk org.gnome.Mutter.IdleMonitor |
55 | dbus-user.talk org.freedesktop.ScreenSaver | 55 | dbus-user.talk org.freedesktop.ScreenSaver |
56 | dbus-system none | 56 | dbus-system none |
diff --git a/etc/profile-m-z/tilp.profile b/etc/profile-m-z/tilp.profile index 7c18aab50..d2db44b1c 100644 --- a/etc/profile-m-z/tilp.profile +++ b/etc/profile-m-z/tilp.profile | |||
@@ -30,6 +30,6 @@ tracelog | |||
30 | disable-mnt | 30 | disable-mnt |
31 | private-bin tilp | 31 | private-bin tilp |
32 | private-cache | 32 | private-cache |
33 | private-etc alternatives,fonts | 33 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
34 | private-tmp | 34 | private-tmp |
35 | 35 | ||
diff --git a/etc/profile-m-z/tin.profile b/etc/profile-m-z/tin.profile index 039063c1e..1d4ee9370 100644 --- a/etc/profile-m-z/tin.profile +++ b/etc/profile-m-z/tin.profile | |||
@@ -58,7 +58,7 @@ disable-mnt | |||
58 | private-bin rtin,tin | 58 | private-bin rtin,tin |
59 | private-cache | 59 | private-cache |
60 | private-dev | 60 | private-dev |
61 | private-etc passwd,resolv.conf,terminfo,tin | 61 | private-etc alternatives,ld.so.cache,ld.so.preload,passwd,resolv.conf,terminfo,tin |
62 | private-lib terminfo | 62 | private-lib terminfo |
63 | private-tmp | 63 | private-tmp |
64 | 64 | ||
diff --git a/etc/profile-m-z/tor.profile b/etc/profile-m-z/tor.profile index 08e949309..d8cd8eb44 100644 --- a/etc/profile-m-z/tor.profile +++ b/etc/profile-m-z/tor.profile | |||
@@ -46,6 +46,6 @@ private | |||
46 | private-bin bash,tor | 46 | private-bin bash,tor |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc alternatives,ca-certificates,crypto-policies,passwd,pki,ssl,tor | 49 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,passwd,pki,ssl,tor |
50 | private-tmp | 50 | private-tmp |
51 | writable-var | 51 | writable-var |
diff --git a/etc/profile-m-z/torbrowser.profile b/etc/profile-m-z/torbrowser.profile new file mode 100644 index 000000000..fc579b973 --- /dev/null +++ b/etc/profile-m-z/torbrowser.profile | |||
@@ -0,0 +1,26 @@ | |||
1 | # Firejail profile for torbrowser | ||
2 | # Description: This profile was tested with www-client/torbrowser::torbrowser | ||
3 | # on Gentoo Linux. | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include torbrowser.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | ignore dbus-user none | ||
11 | |||
12 | noblacklist ${HOME}/.cache/mozilla | ||
13 | noblacklist ${HOME}/.mozilla | ||
14 | |||
15 | blacklist /usr/libexec | ||
16 | |||
17 | mkdir ${HOME}/.cache/mozilla/torbrowser | ||
18 | mkdir ${HOME}/.mozilla | ||
19 | whitelist ${HOME}/.cache/mozilla/torbrowser | ||
20 | whitelist ${HOME}/.mozilla | ||
21 | include whitelist-usr-share-common.inc | ||
22 | |||
23 | dbus-user filter | ||
24 | dbus-user.own org.mozilla.torbrowser.* | ||
25 | |||
26 | include firefox-common.profile | ||
diff --git a/etc/profile-m-z/torcs.profile b/etc/profile-m-z/torcs.profile index a7ebaf2af..19e586db4 100644 --- a/etc/profile-m-z/torcs.profile +++ b/etc/profile-m-z/torcs.profile | |||
@@ -28,7 +28,6 @@ ipc-namespace | |||
28 | net none | 28 | net none |
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
31 | noinput | ||
32 | nonewprivs | 31 | nonewprivs |
33 | noroot | 32 | noroot |
34 | notv | 33 | notv |
diff --git a/etc/profile-m-z/transgui.profile b/etc/profile-m-z/transgui.profile index 2b63f6448..4acb8e7e8 100644 --- a/etc/profile-m-z/transgui.profile +++ b/etc/profile-m-z/transgui.profile | |||
@@ -45,7 +45,7 @@ tracelog | |||
45 | private-bin geoiplookup,geoiplookup6,transgui | 45 | private-bin geoiplookup,geoiplookup6,transgui |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alternatives,fonts | 48 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* | 49 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
diff --git a/etc/profile-m-z/transmission-cli.profile b/etc/profile-m-z/transmission-cli.profile index 486be5fe6..8a1711e97 100644 --- a/etc/profile-m-z/transmission-cli.profile +++ b/etc/profile-m-z/transmission-cli.profile | |||
@@ -8,7 +8,7 @@ include transmission-cli.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-cli | 10 | private-bin transmission-cli |
11 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 11 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/transmission-daemon.profile b/etc/profile-m-z/transmission-daemon.profile index 348d3cb80..5d28f2f10 100644 --- a/etc/profile-m-z/transmission-daemon.profile +++ b/etc/profile-m-z/transmission-daemon.profile | |||
@@ -17,7 +17,7 @@ caps.keep ipc_lock,net_bind_service,setgid,setuid,sys_chroot | |||
17 | protocol packet | 17 | protocol packet |
18 | 18 | ||
19 | private-bin transmission-daemon | 19 | private-bin transmission-daemon |
20 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 20 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
21 | 21 | ||
22 | read-write /var/lib/transmission | 22 | read-write /var/lib/transmission |
23 | writable-var-log | 23 | writable-var-log |
diff --git a/etc/profile-m-z/transmission-remote-gtk.profile b/etc/profile-m-z/transmission-remote-gtk.profile index a6400e2c0..6a0f1bde3 100644 --- a/etc/profile-m-z/transmission-remote-gtk.profile +++ b/etc/profile-m-z/transmission-remote-gtk.profile | |||
@@ -12,7 +12,7 @@ noblacklist ${HOME}/.config/transmission-remote-gtk | |||
12 | mkdir ${HOME}/.config/transmission-remote-gtk | 12 | mkdir ${HOME}/.config/transmission-remote-gtk |
13 | whitelist ${HOME}/.config/transmission-remote-gtk | 13 | whitelist ${HOME}/.config/transmission-remote-gtk |
14 | 14 | ||
15 | private-etc fonts,hostname,hosts,resolv.conf | 15 | private-etc alternatives,fonts,hostname,hosts,ld.so.cache,ld.so.preload,resolv.conf |
16 | # Problems with private-lib (see issue #2889) | 16 | # Problems with private-lib (see issue #2889) |
17 | ignore private-lib | 17 | ignore private-lib |
18 | 18 | ||
diff --git a/etc/profile-m-z/transmission-remote.profile b/etc/profile-m-z/transmission-remote.profile index fee4999e6..565433d99 100644 --- a/etc/profile-m-z/transmission-remote.profile +++ b/etc/profile-m-z/transmission-remote.profile | |||
@@ -8,7 +8,7 @@ include transmission-remote.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-remote | 10 | private-bin transmission-remote |
11 | private-etc alternatives,hosts,nsswitch.conf | 11 | private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/transmission-show.profile b/etc/profile-m-z/transmission-show.profile index 5a3c83f58..0a5826ec4 100644 --- a/etc/profile-m-z/transmission-show.profile +++ b/etc/profile-m-z/transmission-show.profile | |||
@@ -8,7 +8,7 @@ include transmission-show.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin transmission-show | 10 | private-bin transmission-show |
11 | private-etc alternatives,hosts,nsswitch.conf | 11 | private-etc alternatives,hosts,ld.so.cache,ld.so.preload,nsswitch.conf |
12 | 12 | ||
13 | # Redirect | 13 | # Redirect |
14 | include transmission-common.profile | 14 | include transmission-common.profile |
diff --git a/etc/profile-m-z/tremulous.profile b/etc/profile-m-z/tremulous.profile index 4e16df553..96541ae25 100644 --- a/etc/profile-m-z/tremulous.profile +++ b/etc/profile-m-z/tremulous.profile | |||
@@ -8,6 +8,9 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.tremulous | 9 | noblacklist ${HOME}/.tremulous |
10 | 10 | ||
11 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
12 | include allow-bin-sh.inc | ||
13 | |||
11 | include disable-common.inc | 14 | include disable-common.inc |
12 | include disable-devel.inc | 15 | include disable-devel.inc |
13 | include disable-exec.inc | 16 | include disable-exec.inc |
@@ -41,7 +44,7 @@ shell none | |||
41 | tracelog | 44 | tracelog |
42 | 45 | ||
43 | disable-mnt | 46 | disable-mnt |
44 | private-bin tremded,tremulous,tremulous-wrapper | 47 | private-bin env,sh,tremded,tremulous,tremulous-wrapper |
45 | private-cache | 48 | private-cache |
46 | private-dev | 49 | private-dev |
47 | private-tmp | 50 | private-tmp |
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile index 41426c606..60a192ac1 100644 --- a/etc/profile-m-z/trojita.profile +++ b/etc/profile-m-z/trojita.profile | |||
@@ -54,7 +54,7 @@ tracelog | |||
54 | private-bin trojita | 54 | private-bin trojita |
55 | private-cache | 55 | private-cache |
56 | private-dev | 56 | private-dev |
57 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | 57 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,selinux,ssl,xdg |
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | dbus-user filter | 60 | dbus-user filter |
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile index d767b4c9d..987a2b719 100644 --- a/etc/profile-m-z/twitch.profile +++ b/etc/profile-m-z/twitch.profile | |||
@@ -18,7 +18,7 @@ mkdir ${HOME}/.config/Twitch | |||
18 | whitelist ${HOME}/.config/Twitch | 18 | whitelist ${HOME}/.config/Twitch |
19 | 19 | ||
20 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch | 20 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch |
21 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 21 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
22 | private-opt Twitch | 22 | private-opt Twitch |
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
diff --git a/etc/profile-m-z/unf.profile b/etc/profile-m-z/unf.profile index 212e6d181..1b82ad881 100644 --- a/etc/profile-m-z/unf.profile +++ b/etc/profile-m-z/unf.profile | |||
@@ -49,7 +49,7 @@ private-bin unf | |||
49 | private-cache | 49 | private-cache |
50 | ?HAS_APPIMAGE: ignore private-dev | 50 | ?HAS_APPIMAGE: ignore private-dev |
51 | private-dev | 51 | private-dev |
52 | private-etc alternatives | 52 | private-etc alternatives,ld.so.cache,ld.so.preload |
53 | private-lib gcc/*/*/libgcc_s.so.* | 53 | private-lib gcc/*/*/libgcc_s.so.* |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
diff --git a/etc/profile-m-z/unrar.profile b/etc/profile-m-z/unrar.profile index 9d3d9b40e..443d1f415 100644 --- a/etc/profile-m-z/unrar.profile +++ b/etc/profile-m-z/unrar.profile | |||
@@ -8,7 +8,7 @@ include unrar.local | |||
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | private-bin unrar | 10 | private-bin unrar |
11 | private-etc alternatives,group,localtime,passwd | 11 | private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd |
12 | private-tmp | 12 | private-tmp |
13 | 13 | ||
14 | # Redirect | 14 | # Redirect |
diff --git a/etc/profile-m-z/unzip.profile b/etc/profile-m-z/unzip.profile index 0231e3dba..97df693ba 100644 --- a/etc/profile-m-z/unzip.profile +++ b/etc/profile-m-z/unzip.profile | |||
@@ -10,7 +10,7 @@ include globals.local | |||
10 | # GNOME Shell integration (chrome-gnome-shell) | 10 | # GNOME Shell integration (chrome-gnome-shell) |
11 | noblacklist ${HOME}/.local/share/gnome-shell | 11 | noblacklist ${HOME}/.local/share/gnome-shell |
12 | 12 | ||
13 | private-etc alternatives,group,localtime,passwd | 13 | private-etc alternatives,group,ld.so.cache,ld.so.preload,localtime,passwd |
14 | 14 | ||
15 | # Redirect | 15 | # Redirect |
16 | include archiver-common.profile | 16 | include archiver-common.profile |
diff --git a/etc/profile-m-z/utox.profile b/etc/profile-m-z/utox.profile index b164494fa..5a867a683 100644 --- a/etc/profile-m-z/utox.profile +++ b/etc/profile-m-z/utox.profile | |||
@@ -43,7 +43,7 @@ disable-mnt | |||
43 | private-bin utox | 43 | private-bin utox |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,localtime,machine-id,openal,pki,pulse,resolv.conf,ssl | 46 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,localtime,machine-id,openal,pki,pulse,resolv.conf,ssl |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/uudeview.profile b/etc/profile-m-z/uudeview.profile index 3b38f16e0..426766e17 100644 --- a/etc/profile-m-z/uudeview.profile +++ b/etc/profile-m-z/uudeview.profile | |||
@@ -41,7 +41,7 @@ x11 none | |||
41 | private-bin uudeview | 41 | private-bin uudeview |
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-etc alternatives,ld.so.preload | 44 | private-etc alternatives,ld.so.cache,ld.so.preload |
45 | 45 | ||
46 | dbus-user none | 46 | dbus-user none |
47 | dbus-system none | 47 | dbus-system none |
diff --git a/etc/profile-m-z/viewnior.profile b/etc/profile-m-z/viewnior.profile index 469e65542..585a8eddb 100644 --- a/etc/profile-m-z/viewnior.profile +++ b/etc/profile-m-z/viewnior.profile | |||
@@ -43,7 +43,7 @@ tracelog | |||
43 | private-bin viewnior | 43 | private-bin viewnior |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,fonts,machine-id | 46 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index 6ab9aa15b..227ad83cc 100644 --- a/etc/profile-m-z/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -45,7 +45,7 @@ tracelog | |||
45 | #disable-mnt | 45 | #disable-mnt |
46 | #private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami | 46 | #private-bin awk,basename,bash,env,gawk,grep,ps,readlink,sh,virtualbox,VirtualBox,VBox*,vbox*,whoami |
47 | private-cache | 47 | private-cache |
48 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,localtime,machine-id,pki,pulse,resolv.conf,ssl | 48 | private-etc alsa,alternatives,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,pki,pulse,resolv.conf,ssl |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/vmware.profile b/etc/profile-m-z/vmware.profile index cb85836b7..1e3983f0e 100644 --- a/etc/profile-m-z/vmware.profile +++ b/etc/profile-m-z/vmware.profile | |||
@@ -38,6 +38,6 @@ tracelog | |||
38 | #disable-mnt | 38 | #disable-mnt |
39 | # Add the next line to your vmware.local to enable private-bin. | 39 | # Add the next line to your vmware.local to enable private-bin. |
40 | #private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-* | 40 | #private-bin env,bash,sh,ovftool,vmafossexec,vmaf_*,vmnet-*,vmplayer,vmrest,vmrun,vmss2core,vmstat,vmware,vmware-* |
41 | private-etc alsa,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix | 41 | private-etc alsa,alternatives,asound.conf,ca-certificates,conf.d,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,vmware,vmware-installer,vmware-vix |
42 | dbus-user none | 42 | dbus-user none |
43 | dbus-system none | 43 | dbus-system none |
diff --git a/etc/profile-m-z/vscodium.profile b/etc/profile-m-z/vscodium.profile index a4a4fb7d8..9c0a887b2 100644 --- a/etc/profile-m-z/vscodium.profile +++ b/etc/profile-m-z/vscodium.profile | |||
@@ -1,4 +1,4 @@ | |||
1 | # Firejail profile alias for Visual Studio Code | 1 | # Firejail profile alias for VSCodium |
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 3 | # Persistent local customizations |
4 | include vscodium.local | 4 | include vscodium.local |
@@ -7,6 +7,8 @@ include vscodium.local | |||
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.VSCodium | 9 | noblacklist ${HOME}/.VSCodium |
10 | noblacklist ${HOME}/.config/VSCodium | ||
11 | noblacklist ${HOME}/.vscode-oss | ||
10 | 12 | ||
11 | # Redirect | 13 | # Redirect |
12 | include code.profile | 14 | include code.profile |
diff --git a/etc/profile-m-z/w3m.profile b/etc/profile-m-z/w3m.profile index 81c8a2f5c..c9e209142 100644 --- a/etc/profile-m-z/w3m.profile +++ b/etc/profile-m-z/w3m.profile | |||
@@ -62,7 +62,7 @@ disable-mnt | |||
62 | private-bin perl,sh,w3m | 62 | private-bin perl,sh,w3m |
63 | private-cache | 63 | private-cache |
64 | private-dev | 64 | private-dev |
65 | private-etc alternatives,ca-certificates,crypto-policies,mailcap,nsswitch.conf,pki,resolv.conf,ssl | 65 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,mailcap,nsswitch.conf,pki,resolv.conf,ssl |
66 | private-tmp | 66 | private-tmp |
67 | 67 | ||
68 | dbus-user none | 68 | dbus-user none |
diff --git a/etc/profile-m-z/warmux.profile b/etc/profile-m-z/warmux.profile index 92e0e7a83..0a6f19b1e 100644 --- a/etc/profile-m-z/warmux.profile +++ b/etc/profile-m-z/warmux.profile | |||
@@ -49,7 +49,7 @@ disable-mnt | |||
49 | private-bin warmux | 49 | private-bin warmux |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc ca-certificates,crypto-policies,host.conf,hostname,hosts,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/warsow.profile b/etc/profile-m-z/warsow.profile index 5659ec69c..2f818b733 100644 --- a/etc/profile-m-z/warsow.profile +++ b/etc/profile-m-z/warsow.profile | |||
@@ -11,6 +11,9 @@ ignore noexec ${HOME} | |||
11 | noblacklist ${HOME}/.cache/warsow-2.1 | 11 | noblacklist ${HOME}/.cache/warsow-2.1 |
12 | noblacklist ${HOME}/.local/share/warsow-2.1 | 12 | noblacklist ${HOME}/.local/share/warsow-2.1 |
13 | 13 | ||
14 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
15 | include allow-bin-sh.inc | ||
16 | |||
14 | include disable-common.inc | 17 | include disable-common.inc |
15 | include disable-devel.inc | 18 | include disable-devel.inc |
16 | include disable-exec.inc | 19 | include disable-exec.inc |
@@ -34,19 +37,18 @@ ipc-namespace | |||
34 | netfilter | 37 | netfilter |
35 | nodvd | 38 | nodvd |
36 | nogroups | 39 | nogroups |
37 | noinput | ||
38 | nonewprivs | 40 | nonewprivs |
39 | noroot | 41 | noroot |
40 | notv | 42 | notv |
41 | nou2f | 43 | nou2f |
42 | novideo | 44 | novideo |
43 | protocol unix,inet,inet6 | 45 | protocol unix,inet,inet6,netlink |
44 | seccomp | 46 | seccomp |
45 | shell none | 47 | shell none |
46 | tracelog | 48 | tracelog |
47 | 49 | ||
48 | disable-mnt | 50 | disable-mnt |
49 | private-bin warsow | 51 | private-bin basename,bash,dirname,sed,sh,uname,warsow |
50 | private-cache | 52 | private-cache |
51 | private-dev | 53 | private-dev |
52 | private-tmp | 54 | private-tmp |
diff --git a/etc/profile-m-z/whalebird.profile b/etc/profile-m-z/whalebird.profile index 2f26bf14c..92ebebdae 100644 --- a/etc/profile-m-z/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -21,7 +21,7 @@ whitelist ${HOME}/.config/Whalebird | |||
21 | no3d | 21 | no3d |
22 | 22 | ||
23 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird | 23 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird |
24 | private-etc fonts,machine-id | 24 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id |
25 | 25 | ||
26 | # Redirect | 26 | # Redirect |
27 | include electron.profile | 27 | include electron.profile |
diff --git a/etc/profile-m-z/whois.profile b/etc/profile-m-z/whois.profile index 755e62f60..afff6f587 100644 --- a/etc/profile-m-z/whois.profile +++ b/etc/profile-m-z/whois.profile | |||
@@ -47,7 +47,7 @@ private | |||
47 | private-bin bash,sh,whois | 47 | private-bin bash,sh,whois |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,hosts,jwhois.conf,resolv.conf,services,whois.conf | 50 | private-etc alternatives,hosts,jwhois.conf,ld.so.cache,ld.so.preload,resolv.conf,services,whois.conf |
51 | private-lib gconv | 51 | private-lib gconv |
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
diff --git a/etc/profile-m-z/wire-desktop.profile b/etc/profile-m-z/wire-desktop.profile index 151cd2adb..d8742cd71 100644 --- a/etc/profile-m-z/wire-desktop.profile +++ b/etc/profile-m-z/wire-desktop.profile | |||
@@ -26,7 +26,7 @@ mkdir ${HOME}/.config/Wire | |||
26 | whitelist ${HOME}/.config/Wire | 26 | whitelist ${HOME}/.config/Wire |
27 | 27 | ||
28 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop | 28 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],env,sh,wire-desktop |
29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,machine-id,pki,resolv.conf,ssl | 29 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,pki,resolv.conf,ssl |
30 | 30 | ||
31 | # Redirect | 31 | # Redirect |
32 | include electron.profile | 32 | include electron.profile |
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile index b2f3341ee..3147c2ac3 100644 --- a/etc/profile-m-z/wordwarvi.profile +++ b/etc/profile-m-z/wordwarvi.profile | |||
@@ -45,7 +45,7 @@ private | |||
45 | private-bin wordwarvi | 45 | private-bin wordwarvi |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | private-etc alsa,asound.conf,machine-id,pulse | 48 | private-etc alsa,alternatives,asound.conf,ld.so.cache,ld.so.preload,machine-id,pulse |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | dbus-user none | 51 | dbus-user none |
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile index c9e408ccd..bb119996c 100644 --- a/etc/profile-m-z/xbill.profile +++ b/etc/profile-m-z/xbill.profile | |||
@@ -44,7 +44,7 @@ private | |||
44 | private-bin xbill | 44 | private-bin xbill |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc none | 47 | private-etc alternatives,ld.so.cache,ld.so.preload |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | dbus-user none | 50 | dbus-user none |
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index 05c46dffb..386ef2bd6 100644 --- a/etc/profile-m-z/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -46,7 +46,7 @@ disable-mnt | |||
46 | private-bin xfce4-mixer,xfconf-query | 46 | private-bin xfce4-mixer,xfconf-query |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 49 | private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,machine-id,pulse |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | dbus-user filter | 52 | dbus-user filter |
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile index b869ae005..d74ed5754 100644 --- a/etc/profile-m-z/xfce4-screenshooter.profile +++ b/etc/profile-m-z/xfce4-screenshooter.profile | |||
@@ -42,7 +42,7 @@ tracelog | |||
42 | disable-mnt | 42 | disable-mnt |
43 | private-bin xfce4-screenshooter,xfconf-query | 43 | private-bin xfce4-screenshooter,xfconf-query |
44 | private-dev | 44 | private-dev |
45 | private-etc ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,pki,resolv.conf,ssl | 45 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-3.0,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/xiphos.profile b/etc/profile-m-z/xiphos.profile index 070e5e0f7..c7fd0799b 100644 --- a/etc/profile-m-z/xiphos.profile +++ b/etc/profile-m-z/xiphos.profile | |||
@@ -47,5 +47,5 @@ disable-mnt | |||
47 | private-bin xiphos | 47 | private-bin xiphos |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssli,sword,sword.conf | 50 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssli,sword,sword.conf |
51 | private-tmp | 51 | private-tmp |
diff --git a/etc/profile-m-z/xlinks.profile b/etc/profile-m-z/xlinks.profile index d5e25cfe7..404baf607 100644 --- a/etc/profile-m-z/xlinks.profile +++ b/etc/profile-m-z/xlinks.profile | |||
@@ -14,7 +14,7 @@ include whitelist-common.inc | |||
14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' | 14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' |
15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line | 15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line |
16 | private-bin xlinks | 16 | private-bin xlinks |
17 | private-etc fonts | 17 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
20 | include links.profile | 20 | include links.profile |
diff --git a/etc/profile-m-z/xlinks2 b/etc/profile-m-z/xlinks2 index 1ae6a60ca..d7edd3543 100644 --- a/etc/profile-m-z/xlinks2 +++ b/etc/profile-m-z/xlinks2 | |||
@@ -14,7 +14,7 @@ include whitelist-common.inc | |||
14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' | 14 | # if you want to use user-configured programs add 'private-bin PROGRAM1,PROGRAM2' |
15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line | 15 | # to your xlinks.local or append 'PROGRAM1,PROGRAM2' to this private-bin line |
16 | private-bin xlinks2 | 16 | private-bin xlinks2 |
17 | private-etc fonts | 17 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
18 | 18 | ||
19 | # Redirect | 19 | # Redirect |
20 | include links2.profile | 20 | include links2.profile |
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index 8179e8d76..e541436a4 100644 --- a/etc/profile-m-z/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -38,7 +38,7 @@ disable-mnt | |||
38 | private ${HOME}/.xmr-stak | 38 | private ${HOME}/.xmr-stak |
39 | private-bin xmr-stak | 39 | private-bin xmr-stak |
40 | private-dev | 40 | private-dev |
41 | private-etc alternatives,ca-certificates,crypto-policies,nsswitch.conf,pki,resolv.conf,ssl | 41 | private-etc alternatives,ca-certificates,crypto-policies,ld.so.cache,ld.so.preload,nsswitch.conf,pki,resolv.conf,ssl |
42 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend | 42 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend |
43 | private-opt cuda | 43 | private-opt cuda |
44 | private-tmp | 44 | private-tmp |
diff --git a/etc/profile-m-z/xonotic.profile b/etc/profile-m-z/xonotic.profile index 6ffe9ece9..7c2b38d1d 100644 --- a/etc/profile-m-z/xonotic.profile +++ b/etc/profile-m-z/xonotic.profile | |||
@@ -32,7 +32,6 @@ caps.drop all | |||
32 | netfilter | 32 | netfilter |
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | noinput | ||
36 | nonewprivs | 35 | nonewprivs |
37 | noroot | 36 | noroot |
38 | notv | 37 | notv |
diff --git a/etc/profile-m-z/xournal.profile b/etc/profile-m-z/xournal.profile index e4282a125..a0e77b4e7 100644 --- a/etc/profile-m-z/xournal.profile +++ b/etc/profile-m-z/xournal.profile | |||
@@ -43,7 +43,7 @@ tracelog | |||
43 | private-bin xournal | 43 | private-bin xournal |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-etc alternatives,fonts,group,machine-id,passwd | 46 | private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd |
47 | # TODO should use private-lib | 47 | # TODO should use private-lib |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
diff --git a/etc/profile-m-z/xreader.profile b/etc/profile-m-z/xreader.profile index f59adc6e2..8b880426f 100644 --- a/etc/profile-m-z/xreader.profile +++ b/etc/profile-m-z/xreader.profile | |||
@@ -39,7 +39,7 @@ tracelog | |||
39 | 39 | ||
40 | private-bin xreader,xreader-previewer,xreader-thumbnailer | 40 | private-bin xreader,xreader-previewer,xreader-thumbnailer |
41 | private-dev | 41 | private-dev |
42 | private-etc alternatives,fonts,ld.so.cache | 42 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/yelp.profile b/etc/profile-m-z/yelp.profile index 2a6dbe1bf..31a51b2c4 100644 --- a/etc/profile-m-z/yelp.profile +++ b/etc/profile-m-z/yelp.profile | |||
@@ -56,7 +56,7 @@ disable-mnt | |||
56 | private-bin groff,man,tbl,troff,yelp | 56 | private-bin groff,man,tbl,troff,yelp |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | private-dev |
59 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml | 59 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,ld.so.cache,ld.so.preload,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
62 | dbus-user filter | 62 | dbus-user filter |
diff --git a/etc/profile-m-z/youtube-dl-gui.profile b/etc/profile-m-z/youtube-dl-gui.profile index 5d6fb47c1..94f37a92b 100644 --- a/etc/profile-m-z/youtube-dl-gui.profile +++ b/etc/profile-m-z/youtube-dl-gui.profile | |||
@@ -49,7 +49,7 @@ disable-mnt | |||
49 | private-bin atomicparsley,ffmpeg,ffprobe,python*,youtube-dl-gui | 49 | private-bin atomicparsley,ffmpeg,ffprobe,python*,youtube-dl-gui |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,locale,locale.conf,passwd,pki,resolv.conf,ssl | 52 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,locale,locale.conf,passwd,pki,resolv.conf,ssl |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/youtube-dl.profile b/etc/profile-m-z/youtube-dl.profile index 145e565fd..71e50ab11 100644 --- a/etc/profile-m-z/youtube-dl.profile +++ b/etc/profile-m-z/youtube-dl.profile | |||
@@ -58,7 +58,7 @@ tracelog | |||
58 | private-bin env,ffmpeg,python*,youtube-dl | 58 | private-bin env,ffmpeg,python*,youtube-dl |
59 | private-cache | 59 | private-cache |
60 | private-dev | 60 | private-dev |
61 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,mime.types,pki,resolv.conf,ssl,youtube-dl.conf | 61 | private-etc alternatives,ca-certificates,crypto-policies,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,pki,resolv.conf,ssl,youtube-dl.conf |
62 | private-tmp | 62 | private-tmp |
63 | 63 | ||
64 | dbus-user none | 64 | dbus-user none |
diff --git a/etc/profile-m-z/youtube-viewer.profile b/etc/profile-m-z/youtube-viewer.profile index b54dd37ad..825599fcc 100644 --- a/etc/profile-m-z/youtube-viewer.profile +++ b/etc/profile-m-z/youtube-viewer.profile | |||
@@ -18,4 +18,4 @@ whitelist ${HOME}/.config/youtube-viewer | |||
18 | private-bin gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,youtube-viewer | 18 | private-bin gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,youtube-viewer |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include youtube-viewers-common.profile \ No newline at end of file | 21 | include youtube-viewers-common.profile |
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile index a05f05c51..80d551038 100644 --- a/etc/profile-m-z/youtube-viewers-common.profile +++ b/etc/profile-m-z/youtube-viewers-common.profile | |||
@@ -53,7 +53,7 @@ disable-mnt | |||
53 | private-bin bash,ffmpeg,ffprobe,firefox,mpv,perl,python*,sh,smplayer,stty,wget,which,xterm,youtube-dl,yt-dlp | 53 | private-bin bash,ffmpeg,ffprobe,firefox,mpv,perl,python*,sh,smplayer,stty,wget,which,xterm,youtube-dl,yt-dlp |
54 | private-cache | 54 | private-cache |
55 | private-dev | 55 | private-dev |
56 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | 56 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg |
57 | private-tmp | 57 | private-tmp |
58 | 58 | ||
59 | dbus-user none | 59 | dbus-user none |
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile index efb001ee6..5c4d697da 100644 --- a/etc/profile-m-z/youtube.profile +++ b/etc/profile-m-z/youtube.profile | |||
@@ -17,7 +17,7 @@ mkdir ${HOME}/.config/Youtube | |||
17 | whitelist ${HOME}/.config/Youtube | 17 | whitelist ${HOME}/.config/Youtube |
18 | 18 | ||
19 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube | 19 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube |
20 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 20 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
21 | private-opt Youtube | 21 | private-opt Youtube |
22 | 22 | ||
23 | # Redirect | 23 | # Redirect |
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile index ce7161a70..2b5ffeaaf 100644 --- a/etc/profile-m-z/youtubemusic-nativefier.profile +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -14,7 +14,7 @@ mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | |||
14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | 14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 |
15 | 15 | ||
16 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier | 16 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier |
17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
18 | private-opt youtubemusic-nativefier | 18 | private-opt youtubemusic-nativefier |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
diff --git a/etc/profile-m-z/yt-dlp.profile b/etc/profile-m-z/yt-dlp.profile index 1c3382a08..88e7a0949 100644 --- a/etc/profile-m-z/yt-dlp.profile +++ b/etc/profile-m-z/yt-dlp.profile | |||
@@ -13,7 +13,7 @@ noblacklist ${HOME}/.config/yt-dlp | |||
13 | noblacklist ${HOME}/yt-dlp.conf | 13 | noblacklist ${HOME}/yt-dlp.conf |
14 | 14 | ||
15 | private-bin yt-dlp | 15 | private-bin yt-dlp |
16 | private-etc yt-dlp.conf | 16 | private-etc alternatives,ld.so.cache,ld.so.preload,yt-dlp.conf |
17 | 17 | ||
18 | # Redirect | 18 | # Redirect |
19 | include youtube-dl.profile | 19 | include youtube-dl.profile |
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile index ab46fccc2..59b6e2543 100644 --- a/etc/profile-m-z/ytmdesktop.profile +++ b/etc/profile-m-z/ytmdesktop.profile | |||
@@ -14,7 +14,7 @@ mkdir ${HOME}/.config/youtube-music-desktop-app | |||
14 | whitelist ${HOME}/.config/youtube-music-desktop-app | 14 | whitelist ${HOME}/.config/youtube-music-desktop-app |
15 | 15 | ||
16 | # private-bin env,ytmdesktop | 16 | # private-bin env,ytmdesktop |
17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 17 | private-etc alsa,alternatives,asound.conf,ati,bumblebee,ca-certificates,crypto-policies,drirc,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,mime.types,nsswitch.conf,nvidia,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
18 | # private-opt | 18 | # private-opt |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
diff --git a/etc/profile-m-z/zulip.profile b/etc/profile-m-z/zulip.profile index 604da4c8e..8acfdd651 100644 --- a/etc/profile-m-z/zulip.profile +++ b/etc/profile-m-z/zulip.profile | |||
@@ -44,5 +44,5 @@ disable-mnt | |||
44 | private-bin locale,zulip | 44 | private-bin locale,zulip |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-etc asound.conf,fonts,machine-id | 47 | private-etc alternatives,asound.conf,fonts,ld.so.cache,ld.so.preload,machine-id |
48 | private-tmp | 48 | private-tmp |
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index e580a0c0c..44197b547 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -116,6 +116,7 @@ include globals.local | |||
116 | #include disable-devel.inc | 116 | #include disable-devel.inc |
117 | #include disable-exec.inc | 117 | #include disable-exec.inc |
118 | #include disable-interpreters.inc | 118 | #include disable-interpreters.inc |
119 | #include disable-proc.inc | ||
119 | #include disable-programs.inc | 120 | #include disable-programs.inc |
120 | #include disable-shell.inc | 121 | #include disable-shell.inc |
121 | #include disable-write-mnt.inc | 122 | #include disable-write-mnt.inc |
@@ -204,7 +205,7 @@ include globals.local | |||
204 | 205 | ||
205 | # Since 0.9.63 also a more granular control of dbus is supported. | 206 | # Since 0.9.63 also a more granular control of dbus is supported. |
206 | # To get the dbus-addresses an application needs access to you can | 207 | # To get the dbus-addresses an application needs access to you can |
207 | # check with flatpak (when the application is distriputed that way): | 208 | # check with flatpak (when the application is distributed that way): |
208 | # flatpak remote-info --show-metadata flathub <APP-ID> | 209 | # flatpak remote-info --show-metadata flathub <APP-ID> |
209 | # Notes: | 210 | # Notes: |
210 | # - flatpak implicitly allows an app to own <APP-ID> on the session bus | 211 | # - flatpak implicitly allows an app to own <APP-ID> on the session bus |
@@ -24,8 +24,8 @@ gcov_init() { | |||
24 | } | 24 | } |
25 | 25 | ||
26 | generate() { | 26 | generate() { |
27 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-new | 27 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-new |
28 | lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file | 28 | lcov --add-tracefile gcov-file-old --add-tracefile gcov-file-new --output-file gcov-file |
29 | rm -fr gcov-dir | 29 | rm -fr gcov-dir |
30 | genhtml -q gcov-file --output-directory gcov-dir | 30 | genhtml -q gcov-file --output-directory gcov-dir |
31 | find . -name '*.gcda' -exec sudo rm '{}' + | 31 | find . -name '*.gcda' -exec sudo rm '{}' + |
@@ -35,7 +35,7 @@ generate() { | |||
35 | 35 | ||
36 | 36 | ||
37 | gcov_init | 37 | gcov_init |
38 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-old | 38 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file-old |
39 | 39 | ||
40 | #make test-utils | 40 | #make test-utils |
41 | #generate | 41 | #generate |
diff --git a/linecnt.sh b/linecnt.sh index 37b4f2a65..c30e175ba 100755 --- a/linecnt.sh +++ b/linecnt.sh | |||
@@ -26,6 +26,6 @@ gcov_init() { | |||
26 | rm -fr gcov-dir | 26 | rm -fr gcov-dir |
27 | gcov_init | 27 | gcov_init |
28 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder \ | 28 | lcov -q --capture -d src/firejail -d src/firemon -d src/faudit -d src/fbuilder \ |
29 | -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp \ | 29 | -d src/fcopy -d src/fnetfilter -d src/fsec-print -d src/fsec-optimize -d src/fseccomp \ |
30 | -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file | 30 | -d src/fnet -d src/ftee -d src/lib -d src/firecfg -d src/fldd --output-file gcov-file |
31 | genhtml -q gcov-file --output-directory gcov-dir | 31 | genhtml -q gcov-file --output-directory gcov-dir |
diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in index f68edf380..ff411c807 100644 --- a/src/bash_completion/firejail.bash_completion.in +++ b/src/bash_completion/firejail.bash_completion.in | |||
@@ -5,7 +5,7 @@ | |||
5 | # http://bash-completion.alioth.debian.org | 5 | # http://bash-completion.alioth.debian.org |
6 | #******************************************************************* | 6 | #******************************************************************* |
7 | 7 | ||
8 | __interfaces(){ | 8 | __interfaces() { |
9 | cut -f 1 -d ':' /proc/net/dev | tail -n +3 | grep -v lo | xargs | 9 | cut -f 1 -d ':' /proc/net/dev | tail -n +3 | grep -v lo | xargs |
10 | } | 10 | } |
11 | 11 | ||
@@ -90,11 +90,11 @@ _firejail() | |||
90 | _filedir | 90 | _filedir |
91 | return 0 | 91 | return 0 |
92 | ;; | 92 | ;; |
93 | --net) | 93 | --net) |
94 | comps=$(__interfaces) | 94 | comps=$(__interfaces) |
95 | COMPREPLY=( $(compgen -W '$comps' -- "$cur") ) | 95 | COMPREPLY=( $(compgen -W '$comps' -- "$cur") ) |
96 | return 0 | 96 | return 0 |
97 | ;; | 97 | ;; |
98 | esac | 98 | esac |
99 | 99 | ||
100 | $split && return 0 | 100 | $split && return 0 |
diff --git a/src/fbuilder/build_fs.c b/src/fbuilder/build_fs.c index 019c3ac5a..a1847284c 100644 --- a/src/fbuilder/build_fs.c +++ b/src/fbuilder/build_fs.c | |||
@@ -182,12 +182,12 @@ static void var_callback(char *ptr) { | |||
182 | void build_var(const char *fname, FILE *fp) { | 182 | void build_var(const char *fname, FILE *fp) { |
183 | assert(fname); | 183 | assert(fname); |
184 | 184 | ||
185 | var_skip = filedb_load_whitelist(var_skip, "whitelist-var-common.inc", "allow /var/"); | 185 | var_skip = filedb_load_whitelist(var_skip, "whitelist-var-common.inc", "whitelist /var/"); |
186 | process_files(fname, "/var", var_callback); | 186 | process_files(fname, "/var", var_callback); |
187 | 187 | ||
188 | // always whitelist /var | 188 | // always whitelist /var |
189 | if (var_out) | 189 | if (var_out) |
190 | filedb_print(var_out, "allow /var/", fp); | 190 | filedb_print(var_out, "whitelist /var/", fp); |
191 | fprintf(fp, "include whitelist-var-common.inc\n"); | 191 | fprintf(fp, "include whitelist-var-common.inc\n"); |
192 | } | 192 | } |
193 | 193 | ||
@@ -222,12 +222,12 @@ static void share_callback(char *ptr) { | |||
222 | void build_share(const char *fname, FILE *fp) { | 222 | void build_share(const char *fname, FILE *fp) { |
223 | assert(fname); | 223 | assert(fname); |
224 | 224 | ||
225 | share_skip = filedb_load_whitelist(share_skip, "whitelist-usr-share-common.inc", "allow /usr/share/"); | 225 | share_skip = filedb_load_whitelist(share_skip, "whitelist-usr-share-common.inc", "whitelist /usr/share/"); |
226 | process_files(fname, "/usr/share", share_callback); | 226 | process_files(fname, "/usr/share", share_callback); |
227 | 227 | ||
228 | // always whitelist /usr/share | 228 | // always whitelist /usr/share |
229 | if (share_out) | 229 | if (share_out) |
230 | filedb_print(share_out, "allow /usr/share/", fp); | 230 | filedb_print(share_out, "whitelist /usr/share/", fp); |
231 | fprintf(fp, "include whitelist-usr-share-common.inc\n"); | 231 | fprintf(fp, "include whitelist-usr-share-common.inc\n"); |
232 | } | 232 | } |
233 | 233 | ||
@@ -236,9 +236,6 @@ void build_share(const char *fname, FILE *fp) { | |||
236 | //******************************************* | 236 | //******************************************* |
237 | static FileDB *tmp_out = NULL; | 237 | static FileDB *tmp_out = NULL; |
238 | static void tmp_callback(char *ptr) { | 238 | static void tmp_callback(char *ptr) { |
239 | // skip strace file | ||
240 | if (strncmp(ptr, "/tmp/firejail-strace", 20) == 0) | ||
241 | return; | ||
242 | if (strncmp(ptr, "/tmp/runtime-", 13) == 0) | 239 | if (strncmp(ptr, "/tmp/runtime-", 13) == 0) |
243 | return; | 240 | return; |
244 | if (strcmp(ptr, "/tmp") == 0) | 241 | if (strcmp(ptr, "/tmp") == 0) |
diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c index c85474779..0fe0ffef6 100644 --- a/src/fbuilder/build_home.c +++ b/src/fbuilder/build_home.c | |||
@@ -140,7 +140,7 @@ void build_home(const char *fname, FILE *fp) { | |||
140 | assert(fname); | 140 | assert(fname); |
141 | 141 | ||
142 | // load whitelist common | 142 | // load whitelist common |
143 | db_skip = filedb_load_whitelist(db_skip, "whitelist-common.inc", "allow ${HOME}/"); | 143 | db_skip = filedb_load_whitelist(db_skip, "whitelist-common.inc", "whitelist ${HOME}/"); |
144 | 144 | ||
145 | // find user home directory | 145 | // find user home directory |
146 | struct passwd *pw = getpwuid(getuid()); | 146 | struct passwd *pw = getpwuid(getuid()); |
@@ -168,7 +168,7 @@ void build_home(const char *fname, FILE *fp) { | |||
168 | 168 | ||
169 | // print the out list if any | 169 | // print the out list if any |
170 | if (db_out) { | 170 | if (db_out) { |
171 | filedb_print(db_out, "allow ${HOME}/", fp); | 171 | filedb_print(db_out, "whitelist ${HOME}/", fp); |
172 | fprintf(fp, "include whitelist-common.inc\n"); | 172 | fprintf(fp, "include whitelist-common.inc\n"); |
173 | } | 173 | } |
174 | else | 174 | else |
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c index 0b9a99739..c945d7253 100644 --- a/src/fbuilder/build_profile.c +++ b/src/fbuilder/build_profile.c | |||
@@ -92,7 +92,7 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
92 | 92 | ||
93 | if (WIFEXITED(status) && WEXITSTATUS(status) == 0) { | 93 | if (WIFEXITED(status) && WEXITSTATUS(status) == 0) { |
94 | if (fp == stdout) | 94 | if (fp == stdout) |
95 | printf("--- Built profile beings after this line ---\n"); | 95 | printf("--- Built profile begins after this line ---\n"); |
96 | fprintf(fp, "# Save this file as \"application.profile\" (change \"application\" with the\n"); | 96 | fprintf(fp, "# Save this file as \"application.profile\" (change \"application\" with the\n"); |
97 | fprintf(fp, "# program name) in ~/.config/firejail directory. Firejail will find it\n"); | 97 | fprintf(fp, "# program name) in ~/.config/firejail directory. Firejail will find it\n"); |
98 | fprintf(fp, "# automatically every time you sandbox your application.\n#\n"); | 98 | fprintf(fp, "# automatically every time you sandbox your application.\n#\n"); |
diff --git a/src/fcopy/main.c b/src/fcopy/main.c index 31810de9a..f279af89f 100644 --- a/src/fcopy/main.c +++ b/src/fcopy/main.c | |||
@@ -88,7 +88,8 @@ static void selinux_relabel_path(const char *path, const char *inside_path) { | |||
88 | if (arg_debug) | 88 | if (arg_debug) |
89 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); | 89 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); |
90 | 90 | ||
91 | setfilecon_raw(procfs_path, fcon); | 91 | if (setfilecon_raw(procfs_path, fcon) != 0 && arg_debug) |
92 | printf("Cannot relabel %s: %s\n", path, strerror(errno)); | ||
92 | } | 93 | } |
93 | freecon(fcon); | 94 | freecon(fcon); |
94 | close: | 95 | close: |
diff --git a/src/fids/fids.h b/src/fids/fids.h index a2e2886fe..eaf2bbd29 100644 --- a/src/fids/fids.h +++ b/src/fids/fids.h | |||
@@ -48,4 +48,4 @@ int db_exclude_check(const char *fname); | |||
48 | //#define KEY_SIZE 512 | 48 | //#define KEY_SIZE 512 |
49 | int blake2b(void *out, size_t outlen, const void *in, size_t inlen); | 49 | int blake2b(void *out, size_t outlen, const void *in, size_t inlen); |
50 | 50 | ||
51 | #endif \ No newline at end of file | 51 | #endif |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 698630180..0f4c1b18b 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -1,7 +1,6 @@ | |||
1 | # /usr/lib/firejail/firecfg.config - firecfg utility configuration file | 1 | # /usr/lib/firejail/firecfg.config - firecfg utility configuration file |
2 | # This is the list of programs in alphabetical order handled by firecfg utility | 2 | # This is the list of programs in alphabetical order handled by firecfg utility |
3 | # | 3 | # |
4 | #qemu-system-x86_64 | ||
5 | 0ad | 4 | 0ad |
6 | 2048-qt | 5 | 2048-qt |
7 | Books | 6 | Books |
@@ -139,8 +138,8 @@ clamdscan | |||
139 | clamdtop | 138 | clamdtop |
140 | clamscan | 139 | clamscan |
141 | clamtk | 140 | clamtk |
142 | claws-mail | ||
143 | clawsker | 141 | clawsker |
142 | claws-mail | ||
144 | clementine | 143 | clementine |
145 | clion | 144 | clion |
146 | clion-eap | 145 | clion-eap |
@@ -151,6 +150,7 @@ clocks | |||
151 | cmus | 150 | cmus |
152 | code | 151 | code |
153 | code-oss | 152 | code-oss |
153 | codium | ||
154 | cola | 154 | cola |
155 | colorful | 155 | colorful |
156 | com.github.bleakgrey.tootle | 156 | com.github.bleakgrey.tootle |
@@ -169,7 +169,6 @@ crow | |||
169 | cryptocat | 169 | cryptocat |
170 | cvlc | 170 | cvlc |
171 | cyberfox | 171 | cyberfox |
172 | d-feet | ||
173 | darktable | 172 | darktable |
174 | dconf-editor | 173 | dconf-editor |
175 | ddgr | 174 | ddgr |
@@ -179,6 +178,7 @@ deluge | |||
179 | desktopeditors | 178 | desktopeditors |
180 | devhelp | 179 | devhelp |
181 | dex2jar | 180 | dex2jar |
181 | d-feet | ||
182 | dia | 182 | dia |
183 | dig | 183 | dig |
184 | digikam | 184 | digikam |
@@ -255,8 +255,8 @@ flacsplt | |||
255 | flameshot | 255 | flameshot |
256 | flashpeak-slimjet | 256 | flashpeak-slimjet |
257 | flowblade | 257 | flowblade |
258 | font-manager | ||
259 | fontforge | 258 | fontforge |
259 | font-manager | ||
260 | fossamail | 260 | fossamail |
261 | four-in-a-row | 261 | four-in-a-row |
262 | fractal | 262 | fractal |
@@ -348,6 +348,7 @@ gnome-weather | |||
348 | gnote | 348 | gnote |
349 | gnubik | 349 | gnubik |
350 | godot | 350 | godot |
351 | goldendict | ||
351 | goobox | 352 | goobox |
352 | google-chrome | 353 | google-chrome |
353 | google-chrome-beta | 354 | google-chrome-beta |
@@ -364,11 +365,11 @@ gradio | |||
364 | gramps | 365 | gramps |
365 | gravity-beams-and-evaporating-stars | 366 | gravity-beams-and-evaporating-stars |
366 | gthumb | 367 | gthumb |
368 | gtk2-youtube-viewer | ||
369 | gtk3-youtube-viewer | ||
367 | gtk-pipe-viewer | 370 | gtk-pipe-viewer |
368 | gtk-straw-viewer | 371 | gtk-straw-viewer |
369 | gtk-youtube-viewer | 372 | gtk-youtube-viewer |
370 | gtk2-youtube-viewer | ||
371 | gtk3-youtube-viewer | ||
372 | guayadeque | 373 | guayadeque |
373 | gucharmap | 374 | gucharmap |
374 | gummi | 375 | gummi |
@@ -389,11 +390,12 @@ icecat | |||
389 | icedove | 390 | icedove |
390 | iceweasel | 391 | iceweasel |
391 | idea | 392 | idea |
392 | idea.sh | ||
393 | ideaIC | 393 | ideaIC |
394 | idea.sh | ||
394 | imagej | 395 | imagej |
395 | img2txt | 396 | img2txt |
396 | impressive | 397 | impressive |
398 | imv | ||
397 | inkscape | 399 | inkscape |
398 | inkview | 400 | inkview |
399 | inox | 401 | inox |
@@ -530,6 +532,7 @@ mp3wrap | |||
530 | mpDris2 | 532 | mpDris2 |
531 | mpg123 | 533 | mpg123 |
532 | mpg123-alsa | 534 | mpg123-alsa |
535 | mpg123.bin | ||
533 | mpg123-id3dump | 536 | mpg123-id3dump |
534 | mpg123-jack | 537 | mpg123-jack |
535 | mpg123-nas | 538 | mpg123-nas |
@@ -538,7 +541,6 @@ mpg123-oss | |||
538 | mpg123-portaudio | 541 | mpg123-portaudio |
539 | mpg123-pulse | 542 | mpg123-pulse |
540 | mpg123-strip | 543 | mpg123-strip |
541 | mpg123.bin | ||
542 | mplayer | 544 | mplayer |
543 | mpsyt | 545 | mpsyt |
544 | mpv | 546 | mpv |
@@ -603,11 +605,11 @@ onboard | |||
603 | onionshare-gui | 605 | onionshare-gui |
604 | ooffice | 606 | ooffice |
605 | ooviewdoc | 607 | ooviewdoc |
606 | open-invaders | ||
607 | openarena | 608 | openarena |
608 | openarena_ded | 609 | openarena_ded |
609 | opencity | 610 | opencity |
610 | openclonk | 611 | openclonk |
612 | open-invaders | ||
611 | openmw | 613 | openmw |
612 | openmw-launcher | 614 | openmw-launcher |
613 | openoffice.org | 615 | openoffice.org |
@@ -666,6 +668,7 @@ pybitmessage | |||
666 | qbittorrent | 668 | qbittorrent |
667 | qcomicbook | 669 | qcomicbook |
668 | qemu-launcher | 670 | qemu-launcher |
671 | #qemu-system-x86_64 | ||
669 | qgis | 672 | qgis |
670 | qlipper | 673 | qlipper |
671 | qmmp | 674 | qmmp |
@@ -685,6 +688,7 @@ rednotebook | |||
685 | redshift | 688 | redshift |
686 | regextester | 689 | regextester |
687 | remmina | 690 | remmina |
691 | retroarch | ||
688 | rhythmbox | 692 | rhythmbox |
689 | rhythmbox-client | 693 | rhythmbox-client |
690 | ricochet | 694 | ricochet |
@@ -728,8 +732,8 @@ smuxi-frontend-gnome | |||
728 | snox | 732 | snox |
729 | soffice | 733 | soffice |
730 | sol | 734 | sol |
731 | sound-juicer | ||
732 | soundconverter | 735 | soundconverter |
736 | sound-juicer | ||
733 | spectacle | 737 | spectacle |
734 | spectral | 738 | spectral |
735 | spotify | 739 | spotify |
@@ -742,8 +746,8 @@ steam | |||
742 | steam-native | 746 | steam-native |
743 | steam-runtime | 747 | steam-runtime |
744 | stellarium | 748 | stellarium |
745 | straw-viewer | ||
746 | strawberry | 749 | strawberry |
750 | straw-viewer | ||
747 | strings | 751 | strings |
748 | studio.sh | 752 | studio.sh |
749 | subdownloader | 753 | subdownloader |
@@ -771,6 +775,7 @@ thunderbird-beta | |||
771 | thunderbird-wayland | 775 | thunderbird-wayland |
772 | tilp | 776 | tilp |
773 | tor-browser | 777 | tor-browser |
778 | torbrowser | ||
774 | tor-browser-ar | 779 | tor-browser-ar |
775 | tor-browser-ca | 780 | tor-browser-ca |
776 | tor-browser-cs | 781 | tor-browser-cs |
@@ -792,6 +797,7 @@ tor-browser-it | |||
792 | tor-browser-ja | 797 | tor-browser-ja |
793 | tor-browser-ka | 798 | tor-browser-ka |
794 | tor-browser-ko | 799 | tor-browser-ko |
800 | torbrowser-launcher | ||
795 | tor-browser-nb | 801 | tor-browser-nb |
796 | tor-browser-nl | 802 | tor-browser-nl |
797 | tor-browser-pl | 803 | tor-browser-pl |
@@ -802,7 +808,6 @@ tor-browser-tr | |||
802 | tor-browser-vi | 808 | tor-browser-vi |
803 | tor-browser-zh-cn | 809 | tor-browser-zh-cn |
804 | tor-browser-zh-tw | 810 | tor-browser-zh-tw |
805 | torbrowser-launcher | ||
806 | torcs | 811 | torcs |
807 | totem | 812 | totem |
808 | tracker | 813 | tracker |
@@ -908,8 +913,8 @@ yelp | |||
908 | youtube | 913 | youtube |
909 | youtube-dl | 914 | youtube-dl |
910 | youtube-dl-gui | 915 | youtube-dl-gui |
911 | youtube-viewer | ||
912 | youtubemusic-nativefier | 916 | youtubemusic-nativefier |
917 | youtube-viewer | ||
913 | yt-dlp | 918 | yt-dlp |
914 | ytmdesktop | 919 | ytmdesktop |
915 | zaproxy | 920 | zaproxy |
diff --git a/src/firejail/cgroup.c b/src/firejail/cgroup.c index e7ffbca36..38b3c32d3 100644 --- a/src/firejail/cgroup.c +++ b/src/firejail/cgroup.c | |||
@@ -18,7 +18,8 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/stat.h> | 21 | #include <sys/wait.h> |
22 | #include <errno.h> | ||
22 | 23 | ||
23 | #define MAXBUF 4096 | 24 | #define MAXBUF 4096 |
24 | 25 | ||
@@ -68,52 +69,60 @@ errout: | |||
68 | fclose(fp); | 69 | fclose(fp); |
69 | } | 70 | } |
70 | 71 | ||
72 | static int is_cgroup_path(const char *fname) { | ||
73 | // path starts with /sys/fs/cgroup | ||
74 | if (strncmp(fname, "/sys/fs/cgroup", 14) != 0) | ||
75 | return 0; | ||
71 | 76 | ||
72 | void set_cgroup(const char *path) { | 77 | // no .. traversal |
73 | EUID_ASSERT(); | 78 | char *ptr = strstr(fname, ".."); |
79 | if (ptr) | ||
80 | return 0; | ||
74 | 81 | ||
75 | invalid_filename(path, 0); // no globbing | 82 | return 1; |
83 | } | ||
76 | 84 | ||
77 | // path starts with /sys/fs/cgroup | 85 | void check_cgroup_file(const char *fname) { |
78 | if (strncmp(path, "/sys/fs/cgroup", 14) != 0) | 86 | assert(fname); |
79 | goto errout; | 87 | invalid_filename(fname, 0); // no globbing |
80 | 88 | ||
81 | // path ends in tasks | 89 | if (!is_cgroup_path(fname)) |
82 | char *ptr = strstr(path, "tasks"); | ||
83 | if (!ptr) | ||
84 | goto errout; | ||
85 | if (*(ptr + 5) != '\0') | ||
86 | goto errout; | 90 | goto errout; |
87 | 91 | ||
88 | // no .. traversal | 92 | const char *base = gnu_basename(fname); |
89 | ptr = strstr(path, ".."); | 93 | if (strcmp(base, "tasks") != 0 && // cgroup v1 |
90 | if (ptr) | 94 | strcmp(base, "cgroup.procs") != 0) |
91 | goto errout; | 95 | goto errout; |
92 | 96 | ||
93 | // tasks file exists | 97 | if (access(fname, W_OK) == 0) |
94 | FILE *fp = fopen(path, "ae"); | 98 | return; |
95 | if (!fp) | ||
96 | goto errout; | ||
97 | // task file belongs to the user running the sandbox | ||
98 | int fd = fileno(fp); | ||
99 | if (fd == -1) | ||
100 | errExit("fileno"); | ||
101 | struct stat s; | ||
102 | if (fstat(fd, &s) == -1) | ||
103 | errExit("fstat"); | ||
104 | if (s.st_uid != getuid() && s.st_gid != getgid()) | ||
105 | goto errout2; | ||
106 | // add the task to cgroup | ||
107 | pid_t pid = getpid(); | ||
108 | int rv = fprintf(fp, "%d\n", pid); | ||
109 | (void) rv; | ||
110 | fclose(fp); | ||
111 | return; | ||
112 | 99 | ||
113 | errout: | 100 | errout: |
114 | fprintf(stderr, "Error: invalid cgroup\n"); | 101 | fprintf(stderr, "Error: invalid cgroup\n"); |
115 | exit(1); | 102 | exit(1); |
116 | errout2: | 103 | } |
117 | fprintf(stderr, "Error: you don't have permissions to use this control group\n"); | 104 | |
118 | exit(1); | 105 | static void do_set_cgroup(const char *fname, pid_t pid) { |
106 | FILE *fp = fopen(fname, "ae"); | ||
107 | if (!fp) { | ||
108 | fwarning("cannot open %s for writing: %s\n", fname, strerror(errno)); | ||
109 | return; | ||
110 | } | ||
111 | |||
112 | int rv = fprintf(fp, "%d\n", pid); | ||
113 | (void) rv; | ||
114 | fclose(fp); | ||
115 | } | ||
116 | |||
117 | void set_cgroup(const char *fname, pid_t pid) { | ||
118 | pid_t child = fork(); | ||
119 | if (child < 0) | ||
120 | errExit("fork"); | ||
121 | if (child == 0) { | ||
122 | drop_privs(0); | ||
123 | |||
124 | do_set_cgroup(fname, pid); | ||
125 | _exit(0); | ||
126 | } | ||
127 | waitpid(child, NULL, 0); | ||
119 | } | 128 | } |
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index 06e6f0ccb..e5d837bbb 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -58,6 +58,7 @@ int checkcfg(int val) { | |||
58 | cfg_val[CFG_XPRA_ATTACH] = 0; | 58 | cfg_val[CFG_XPRA_ATTACH] = 0; |
59 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = -1; | 59 | cfg_val[CFG_SECCOMP_ERROR_ACTION] = -1; |
60 | cfg_val[CFG_BROWSER_ALLOW_DRM] = 0; | 60 | cfg_val[CFG_BROWSER_ALLOW_DRM] = 0; |
61 | cfg_val[CFG_ALLOW_TRAY] = 0; | ||
61 | 62 | ||
62 | // open configuration file | 63 | // open configuration file |
63 | const char *fname = SYSCONFDIR "/firejail.config"; | 64 | const char *fname = SYSCONFDIR "/firejail.config"; |
@@ -122,6 +123,7 @@ int checkcfg(int val) { | |||
122 | PARSE_YESNO(CFG_XPRA_ATTACH, "xpra-attach") | 123 | PARSE_YESNO(CFG_XPRA_ATTACH, "xpra-attach") |
123 | PARSE_YESNO(CFG_BROWSER_DISABLE_U2F, "browser-disable-u2f") | 124 | PARSE_YESNO(CFG_BROWSER_DISABLE_U2F, "browser-disable-u2f") |
124 | PARSE_YESNO(CFG_BROWSER_ALLOW_DRM, "browser-allow-drm") | 125 | PARSE_YESNO(CFG_BROWSER_ALLOW_DRM, "browser-allow-drm") |
126 | PARSE_YESNO(CFG_ALLOW_TRAY, "allow-tray") | ||
125 | #undef PARSE_YESNO | 127 | #undef PARSE_YESNO |
126 | 128 | ||
127 | // netfilter | 129 | // netfilter |
diff --git a/src/firejail/chroot.c b/src/firejail/chroot.c index 37ec22117..9425638ea 100644 --- a/src/firejail/chroot.c +++ b/src/firejail/chroot.c | |||
@@ -86,7 +86,7 @@ static void update_file(int parentfd, const char *relpath) { | |||
86 | if (arg_debug) | 86 | if (arg_debug) |
87 | printf("Updating chroot /%s\n", relpath); | 87 | printf("Updating chroot /%s\n", relpath); |
88 | unlinkat(parentfd, relpath, 0); | 88 | unlinkat(parentfd, relpath, 0); |
89 | int out = openat(parentfd, relpath, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 89 | int out = openat(parentfd, relpath, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
90 | if (out == -1) { | 90 | if (out == -1) { |
91 | close(in); | 91 | close(in); |
92 | goto errout; | 92 | goto errout; |
diff --git a/src/firejail/env.c b/src/firejail/env.c index f5e9dd980..4c0d729a1 100644 --- a/src/firejail/env.c +++ b/src/firejail/env.c | |||
@@ -22,6 +22,7 @@ | |||
22 | #include <sys/stat.h> | 22 | #include <sys/stat.h> |
23 | #include <unistd.h> | 23 | #include <unistd.h> |
24 | #include <dirent.h> | 24 | #include <dirent.h> |
25 | #include <limits.h> | ||
25 | 26 | ||
26 | typedef struct env_t { | 27 | typedef struct env_t { |
27 | struct env_t *next; | 28 | struct env_t *next; |
@@ -262,7 +263,7 @@ static const char * const env_whitelist[] = { | |||
262 | "LANG", | 263 | "LANG", |
263 | "LANGUAGE", | 264 | "LANGUAGE", |
264 | "LC_MESSAGES", | 265 | "LC_MESSAGES", |
265 | "PATH", | 266 | // "PATH", |
266 | "DISPLAY" // required by X11 | 267 | "DISPLAY" // required by X11 |
267 | }; | 268 | }; |
268 | 269 | ||
@@ -311,6 +312,10 @@ void env_apply_whitelist(void) { | |||
311 | errExit("clearenv"); | 312 | errExit("clearenv"); |
312 | 313 | ||
313 | env_apply_list(env_whitelist, ARRAY_SIZE(env_whitelist)); | 314 | env_apply_list(env_whitelist, ARRAY_SIZE(env_whitelist)); |
315 | |||
316 | // hardcoding PATH | ||
317 | if (setenv("PATH", "/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/sbin:/sbin", 1) < 0) | ||
318 | errExit("setenv"); | ||
314 | } | 319 | } |
315 | 320 | ||
316 | // Filter env variables for a sbox app | 321 | // Filter env variables for a sbox app |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 2a7d88575..ec789cd63 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -22,6 +22,7 @@ | |||
22 | #include "../include/common.h" | 22 | #include "../include/common.h" |
23 | #include "../include/euid_common.h" | 23 | #include "../include/euid_common.h" |
24 | #include "../include/rundefs.h" | 24 | #include "../include/rundefs.h" |
25 | #include <linux/limits.h> // Note: Plain limits.h may break ARG_MAX (see #4583) | ||
25 | #include <stdarg.h> | 26 | #include <stdarg.h> |
26 | #include <sys/stat.h> | 27 | #include <sys/stat.h> |
27 | 28 | ||
@@ -433,13 +434,15 @@ void fs_proc_sys_dev_boot(void); | |||
433 | void disable_config(void); | 434 | void disable_config(void); |
434 | // build a basic read-only filesystem | 435 | // build a basic read-only filesystem |
435 | void fs_basic_fs(void); | 436 | void fs_basic_fs(void); |
436 | // mount overlayfs on top of / directory | ||
437 | char *fs_check_overlay_dir(const char *subdirname, int allow_reuse); | ||
438 | void fs_overlayfs(void); | ||
439 | void fs_private_tmp(void); | 437 | void fs_private_tmp(void); |
440 | void fs_private_cache(void); | 438 | void fs_private_cache(void); |
441 | void fs_mnt(const int enforce); | 439 | void fs_mnt(const int enforce); |
442 | 440 | ||
441 | // fs_overlayfs.c | ||
442 | char *fs_check_overlay_dir(const char *subdirname, int allow_reuse); | ||
443 | void fs_overlayfs(void); | ||
444 | int remove_overlay_directory(void); | ||
445 | |||
443 | // chroot.c | 446 | // chroot.c |
444 | // chroot into an existing directory; mount existing /dev and update /etc/resolv.conf | 447 | // chroot into an existing directory; mount existing /dev and update /etc/resolv.conf |
445 | void fs_check_chroot_dir(void); | 448 | void fs_check_chroot_dir(void); |
@@ -516,6 +519,7 @@ void touch_file_as_user(const char *fname, mode_t mode); | |||
516 | int is_dir(const char *fname); | 519 | int is_dir(const char *fname); |
517 | int is_link(const char *fname); | 520 | int is_link(const char *fname); |
518 | char *realpath_as_user(const char *fname); | 521 | char *realpath_as_user(const char *fname); |
522 | ssize_t readlink_as_user(const char *fname, char *buf, size_t sz); | ||
519 | int stat_as_user(const char *fname, struct stat *s); | 523 | int stat_as_user(const char *fname, struct stat *s); |
520 | int lstat_as_user(const char *fname, struct stat *s); | 524 | int lstat_as_user(const char *fname, struct stat *s); |
521 | void trim_trailing_slash_or_dot(char *path); | 525 | void trim_trailing_slash_or_dot(char *path); |
@@ -529,8 +533,7 @@ void update_map(char *mapping, char *map_file); | |||
529 | void wait_for_other(int fd); | 533 | void wait_for_other(int fd); |
530 | void notify_other(int fd); | 534 | void notify_other(int fd); |
531 | uid_t pid_get_uid(pid_t pid); | 535 | uid_t pid_get_uid(pid_t pid); |
532 | uid_t get_group_id(const char *group); | 536 | gid_t get_group_id(const char *groupname); |
533 | int remove_overlay_directory(void); | ||
534 | void flush_stdin(void); | 537 | void flush_stdin(void); |
535 | int create_empty_dir_as_user(const char *dir, mode_t mode); | 538 | int create_empty_dir_as_user(const char *dir, mode_t mode); |
536 | void create_empty_dir_as_root(const char *dir, mode_t mode); | 539 | void create_empty_dir_as_root(const char *dir, mode_t mode); |
@@ -563,8 +566,8 @@ typedef struct { | |||
563 | 566 | ||
564 | // mountinfo.c | 567 | // mountinfo.c |
565 | MountData *get_last_mount(void); | 568 | MountData *get_last_mount(void); |
566 | int get_mount_id(const char *path); | 569 | int get_mount_id(int fd); |
567 | char **build_mount_array(const int mount_id, const char *path); | 570 | char **build_mount_array(const int mountid, const char *path); |
568 | 571 | ||
569 | // fs_var.c | 572 | // fs_var.c |
570 | void fs_var_log(void); // mounting /var/log | 573 | void fs_var_log(void); // mounting /var/log |
@@ -621,7 +624,8 @@ void caps_print_filter(pid_t pid) __attribute__((noreturn)); | |||
621 | void caps_drop_dac_override(void); | 624 | void caps_drop_dac_override(void); |
622 | 625 | ||
623 | // fs_trace.c | 626 | // fs_trace.c |
624 | void fs_trace_preload(void); | 627 | void fs_trace_touch_preload(void); |
628 | void fs_trace_touch_or_store_preload(void); | ||
625 | void fs_tracefile(void); | 629 | void fs_tracefile(void); |
626 | void fs_trace(void); | 630 | void fs_trace(void); |
627 | 631 | ||
@@ -644,7 +648,8 @@ void cpu_print_filter(pid_t pid) __attribute__((noreturn)); | |||
644 | // cgroup.c | 648 | // cgroup.c |
645 | void save_cgroup(void); | 649 | void save_cgroup(void); |
646 | void load_cgroup(const char *fname); | 650 | void load_cgroup(const char *fname); |
647 | void set_cgroup(const char *path); | 651 | void check_cgroup_file(const char *fname); |
652 | void set_cgroup(const char *fname, pid_t pid); | ||
648 | 653 | ||
649 | // output.c | 654 | // output.c |
650 | void check_output(int argc, char **argv); | 655 | void check_output(int argc, char **argv); |
@@ -704,6 +709,8 @@ void pulseaudio_disable(void); | |||
704 | void fs_private_bin_list(void); | 709 | void fs_private_bin_list(void); |
705 | 710 | ||
706 | // fs_lib.c | 711 | // fs_lib.c |
712 | int is_firejail_link(const char *fname); | ||
713 | char *find_in_path(const char *program); | ||
707 | void fs_private_lib(void); | 714 | void fs_private_lib(void); |
708 | 715 | ||
709 | // protocol.c | 716 | // protocol.c |
@@ -801,6 +808,7 @@ enum { | |||
801 | CFG_NAME_CHANGE, | 808 | CFG_NAME_CHANGE, |
802 | CFG_SECCOMP_ERROR_ACTION, | 809 | CFG_SECCOMP_ERROR_ACTION, |
803 | // CFG_FILE_COPY_LIMIT - file copy limit handled using setenv/getenv | 810 | // CFG_FILE_COPY_LIMIT - file copy limit handled using setenv/getenv |
811 | CFG_ALLOW_TRAY, | ||
804 | CFG_MAX // this should always be the last entry | 812 | CFG_MAX // this should always be the last entry |
805 | }; | 813 | }; |
806 | extern char *xephyr_screen; | 814 | extern char *xephyr_screen; |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 5ac2da164..9c1b889ed 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -20,10 +20,7 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include "../include/gcov_wrapper.h" | 21 | #include "../include/gcov_wrapper.h" |
22 | #include <sys/mount.h> | 22 | #include <sys/mount.h> |
23 | #include <sys/stat.h> | ||
24 | #include <sys/statvfs.h> | 23 | #include <sys/statvfs.h> |
25 | #include <sys/wait.h> | ||
26 | #include <linux/limits.h> | ||
27 | #include <fnmatch.h> | 24 | #include <fnmatch.h> |
28 | #include <glob.h> | 25 | #include <glob.h> |
29 | #include <dirent.h> | 26 | #include <dirent.h> |
@@ -35,7 +32,7 @@ | |||
35 | #endif | 32 | #endif |
36 | 33 | ||
37 | #define MAX_BUF 4096 | 34 | #define MAX_BUF 4096 |
38 | #define EMPTY_STRING ("") | 35 | |
39 | // check noblacklist statements not matched by a proper blacklist in disable-*.inc files | 36 | // check noblacklist statements not matched by a proper blacklist in disable-*.inc files |
40 | //#define TEST_NO_BLACKLIST_MATCHING | 37 | //#define TEST_NO_BLACKLIST_MATCHING |
41 | 38 | ||
@@ -108,7 +105,7 @@ static void disable_file(OPERATION op, const char *filename) { | |||
108 | } | 105 | } |
109 | 106 | ||
110 | // check for firejail executable | 107 | // check for firejail executable |
111 | // we migth have a file found in ${PATH} pointing to /usr/bin/firejail | 108 | // we might have a file found in ${PATH} pointing to /usr/bin/firejail |
112 | // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird | 109 | // blacklisting it here will end up breaking situations like user clicks on a link in Thunderbird |
113 | // and expects Firefox to open in the same sandbox | 110 | // and expects Firefox to open in the same sandbox |
114 | if (strcmp(BINDIR "/firejail", fname) == 0) { | 111 | if (strcmp(BINDIR "/firejail", fname) == 0) { |
@@ -200,8 +197,6 @@ static void disable_file(OPERATION op, const char *filename) { | |||
200 | } | 197 | } |
201 | 198 | ||
202 | fs_tmpfs(fname, uid); | 199 | fs_tmpfs(fname, uid); |
203 | EUID_USER(); // fs_tmpfs returns with EUID 0 | ||
204 | |||
205 | selinux_relabel_path(fname, fname); | 200 | selinux_relabel_path(fname, fname); |
206 | } | 201 | } |
207 | else | 202 | else |
@@ -282,6 +277,8 @@ static void globbing(OPERATION op, const char *pattern, const char *noblacklist[ | |||
282 | 277 | ||
283 | // blacklist files or directories by mounting empty files on top of them | 278 | // blacklist files or directories by mounting empty files on top of them |
284 | void fs_blacklist(void) { | 279 | void fs_blacklist(void) { |
280 | EUID_ASSERT(); | ||
281 | |||
285 | ProfileEntry *entry = cfg.profile; | 282 | ProfileEntry *entry = cfg.profile; |
286 | if (!entry) | 283 | if (!entry) |
287 | return; | 284 | return; |
@@ -293,7 +290,6 @@ void fs_blacklist(void) { | |||
293 | if (noblacklist == NULL) | 290 | if (noblacklist == NULL) |
294 | errExit("failed allocating memory for noblacklist entries"); | 291 | errExit("failed allocating memory for noblacklist entries"); |
295 | 292 | ||
296 | EUID_USER(); | ||
297 | while (entry) { | 293 | while (entry) { |
298 | OPERATION op = OPERATION_MAX; | 294 | OPERATION op = OPERATION_MAX; |
299 | char *ptr; | 295 | char *ptr; |
@@ -469,8 +465,6 @@ void fs_blacklist(void) { | |||
469 | for (i = 0; i < noblacklist_c; i++) | 465 | for (i = 0; i < noblacklist_c; i++) |
470 | free(noblacklist[i]); | 466 | free(noblacklist[i]); |
471 | free(noblacklist); | 467 | free(noblacklist); |
472 | |||
473 | EUID_ROOT(); | ||
474 | } | 468 | } |
475 | 469 | ||
476 | //*********************************************** | 470 | //*********************************************** |
@@ -479,7 +473,7 @@ void fs_blacklist(void) { | |||
479 | 473 | ||
480 | // mount a writable tmpfs on directory; requires a resolved path | 474 | // mount a writable tmpfs on directory; requires a resolved path |
481 | void fs_tmpfs(const char *dir, unsigned check_owner) { | 475 | void fs_tmpfs(const char *dir, unsigned check_owner) { |
482 | EUID_USER(); | 476 | EUID_ASSERT(); |
483 | assert(dir); | 477 | assert(dir); |
484 | if (arg_debug) | 478 | if (arg_debug) |
485 | printf("Mounting tmpfs on %s, check owner: %s\n", dir, (check_owner)? "yes": "no"); | 479 | printf("Mounting tmpfs on %s, check owner: %s\n", dir, (check_owner)? "yes": "no"); |
@@ -504,12 +498,13 @@ void fs_tmpfs(const char *dir, unsigned check_owner) { | |||
504 | errExit("fstatvfs"); | 498 | errExit("fstatvfs"); |
505 | unsigned long flags = buf.f_flag & ~(MS_RDONLY|MS_BIND|MS_REMOUNT); | 499 | unsigned long flags = buf.f_flag & ~(MS_RDONLY|MS_BIND|MS_REMOUNT); |
506 | // mount via the symbolic link in /proc/self/fd | 500 | // mount via the symbolic link in /proc/self/fd |
507 | EUID_ROOT(); | ||
508 | char *proc; | 501 | char *proc; |
509 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) | 502 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) |
510 | errExit("asprintf"); | 503 | errExit("asprintf"); |
504 | EUID_ROOT(); | ||
511 | if (mount("tmpfs", proc, "tmpfs", flags|MS_NOSUID|MS_NODEV, options) < 0) | 505 | if (mount("tmpfs", proc, "tmpfs", flags|MS_NOSUID|MS_NODEV, options) < 0) |
512 | errExit("mounting tmpfs"); | 506 | errExit("mounting tmpfs"); |
507 | EUID_USER(); | ||
513 | // check the last mount operation | 508 | // check the last mount operation |
514 | MountData *mdata = get_last_mount(); | 509 | MountData *mdata = get_last_mount(); |
515 | if (strcmp(mdata->fstype, "tmpfs") != 0 || strcmp(mdata->dir, dir) != 0) | 510 | if (strcmp(mdata->fstype, "tmpfs") != 0 || strcmp(mdata->dir, dir) != 0) |
@@ -635,40 +630,37 @@ out: | |||
635 | } | 630 | } |
636 | 631 | ||
637 | // remount recursively; requires a resolved path | 632 | // remount recursively; requires a resolved path |
638 | static void fs_remount_rec(const char *dir, OPERATION op) { | 633 | static void fs_remount_rec(const char *path, OPERATION op) { |
639 | EUID_ASSERT(); | 634 | EUID_ASSERT(); |
640 | assert(dir); | 635 | assert(op < OPERATION_MAX); |
636 | assert(path); | ||
641 | 637 | ||
642 | struct stat s; | 638 | // no need to search /proc/self/mountinfo for submounts if not a directory |
643 | if (stat(dir, &s) != 0) | 639 | int fd = open(path, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); |
644 | return; | 640 | if (fd < 0) { |
645 | if (!S_ISDIR(s.st_mode)) { | 641 | fs_remount_simple(path, op); |
646 | // no need to search in /proc/self/mountinfo for submounts if not a directory | ||
647 | fs_remount_simple(dir, op); | ||
648 | return; | 642 | return; |
649 | } | 643 | } |
650 | // get mount point of the directory | 644 | |
651 | int mountid = get_mount_id(dir); | 645 | // get mount id of the directory |
652 | if (mountid == -1) | 646 | int mountid = get_mount_id(fd); |
653 | return; | 647 | close(fd); |
654 | if (mountid == -2) { | 648 | if (mountid < 0) { |
655 | // falling back to a simple remount on old kernels | 649 | // falling back to a simple remount |
656 | static int mount_warning = 0; | 650 | fwarning("%s %s not applied recursively\n", opstr[op], path); |
657 | if (!mount_warning) { | 651 | fs_remount_simple(path, op); |
658 | fwarning("read-only, read-write and noexec options are not applied recursively\n"); | ||
659 | mount_warning = 1; | ||
660 | } | ||
661 | fs_remount_simple(dir, op); | ||
662 | return; | 652 | return; |
663 | } | 653 | } |
654 | |||
664 | // build array with all mount points that need to get remounted | 655 | // build array with all mount points that need to get remounted |
665 | char **arr = build_mount_array(mountid, dir); | 656 | char **arr = build_mount_array(mountid, path); |
666 | assert(arr); | 657 | if (!arr) |
658 | return; | ||
667 | // remount | 659 | // remount |
668 | char **tmp = arr; | 660 | int i; |
669 | while (*tmp) { | 661 | for (i = 0; arr[i]; i++) { |
670 | fs_remount_simple(*tmp, op); | 662 | fs_remount_simple(arr[i], op); |
671 | free(*tmp++); | 663 | free(arr[i]); |
672 | } | 664 | } |
673 | free(arr); | 665 | free(arr); |
674 | } | 666 | } |
@@ -903,367 +895,6 @@ void fs_basic_fs(void) { | |||
903 | } | 895 | } |
904 | 896 | ||
905 | 897 | ||
906 | |||
907 | #ifdef HAVE_OVERLAYFS | ||
908 | char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) { | ||
909 | assert(subdirname); | ||
910 | EUID_ASSERT(); | ||
911 | struct stat s; | ||
912 | char *dirname; | ||
913 | |||
914 | if (asprintf(&dirname, "%s/.firejail", cfg.homedir) == -1) | ||
915 | errExit("asprintf"); | ||
916 | // check if ~/.firejail already exists | ||
917 | if (lstat(dirname, &s) == 0) { | ||
918 | if (!S_ISDIR(s.st_mode)) { | ||
919 | if (S_ISLNK(s.st_mode)) | ||
920 | fprintf(stderr, "Error: %s is a symbolic link\n", dirname); | ||
921 | else | ||
922 | fprintf(stderr, "Error: %s is not a directory\n", dirname); | ||
923 | exit(1); | ||
924 | } | ||
925 | if (s.st_uid != getuid()) { | ||
926 | fprintf(stderr, "Error: %s is not owned by the current user\n", dirname); | ||
927 | exit(1); | ||
928 | } | ||
929 | } | ||
930 | else { | ||
931 | // create ~/.firejail directory | ||
932 | create_empty_dir_as_user(dirname, 0700); | ||
933 | if (stat(dirname, &s) == -1) { | ||
934 | fprintf(stderr, "Error: cannot create directory %s\n", dirname); | ||
935 | exit(1); | ||
936 | } | ||
937 | } | ||
938 | free(dirname); | ||
939 | |||
940 | // check overlay directory | ||
941 | if (asprintf(&dirname, "%s/.firejail/%s", cfg.homedir, subdirname) == -1) | ||
942 | errExit("asprintf"); | ||
943 | if (lstat(dirname, &s) == 0) { | ||
944 | if (!S_ISDIR(s.st_mode)) { | ||
945 | if (S_ISLNK(s.st_mode)) | ||
946 | fprintf(stderr, "Error: %s is a symbolic link\n", dirname); | ||
947 | else | ||
948 | fprintf(stderr, "Error: %s is not a directory\n", dirname); | ||
949 | exit(1); | ||
950 | } | ||
951 | if (s.st_uid != 0) { | ||
952 | fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", dirname); | ||
953 | exit(1); | ||
954 | } | ||
955 | if (allow_reuse == 0) { | ||
956 | fprintf(stderr, "Error: overlay directory exists, but reuse is not allowed\n"); | ||
957 | exit(1); | ||
958 | } | ||
959 | } | ||
960 | |||
961 | return dirname; | ||
962 | } | ||
963 | |||
964 | |||
965 | |||
966 | // mount overlayfs on top of / directory | ||
967 | // mounting an overlay and chrooting into it: | ||
968 | // | ||
969 | // Old Ubuntu kernel | ||
970 | // # cd ~ | ||
971 | // # mkdir -p overlay/root | ||
972 | // # mkdir -p overlay/diff | ||
973 | // # mount -t overlayfs -o lowerdir=/,upperdir=/root/overlay/diff overlayfs /root/overlay/root | ||
974 | // # chroot /root/overlay/root | ||
975 | // to shutdown, first exit the chroot and then unmount the overlay | ||
976 | // # exit | ||
977 | // # umount /root/overlay/root | ||
978 | // | ||
979 | // Kernels 3.18+ | ||
980 | // # cd ~ | ||
981 | // # mkdir -p overlay/root | ||
982 | // # mkdir -p overlay/diff | ||
983 | // # mkdir -p overlay/work | ||
984 | // # mount -t overlay -o lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work overlay /root/overlay/root | ||
985 | // # cat /etc/mtab | grep overlay | ||
986 | // /root/overlay /root/overlay/root overlay rw,relatime,lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work 0 0 | ||
987 | // # chroot /root/overlay/root | ||
988 | // to shutdown, first exit the chroot and then unmount the overlay | ||
989 | // # exit | ||
990 | // # umount /root/overlay/root | ||
991 | |||
992 | |||
993 | // to do: fix the code below; also, it might work without /dev, but consider keeping /dev/shm; add locking mechanism for overlay-clean | ||
994 | #include <sys/utsname.h> | ||
995 | void fs_overlayfs(void) { | ||
996 | struct stat s; | ||
997 | |||
998 | // check kernel version | ||
999 | struct utsname u; | ||
1000 | int rv = uname(&u); | ||
1001 | if (rv != 0) | ||
1002 | errExit("uname"); | ||
1003 | int major; | ||
1004 | int minor; | ||
1005 | if (2 != sscanf(u.release, "%d.%d", &major, &minor)) { | ||
1006 | fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version); | ||
1007 | exit(1); | ||
1008 | } | ||
1009 | |||
1010 | if (arg_debug) | ||
1011 | printf("Linux kernel version %d.%d\n", major, minor); | ||
1012 | int oldkernel = 0; | ||
1013 | if (major < 3) { | ||
1014 | fprintf(stderr, "Error: minimum kernel version required 3.x\n"); | ||
1015 | exit(1); | ||
1016 | } | ||
1017 | if (major == 3 && minor < 18) | ||
1018 | oldkernel = 1; | ||
1019 | |||
1020 | // mounting an overlayfs on top of / seems to be broken for kernels > 4.19 | ||
1021 | // we disable overlayfs for now, pending fixing | ||
1022 | if (major >= 4 &&minor >= 19) { | ||
1023 | fprintf(stderr, "Error: OverlayFS disabled for Linux kernels 4.19 and newer, pending fixing.\n"); | ||
1024 | exit(1); | ||
1025 | } | ||
1026 | |||
1027 | char *oroot = RUN_OVERLAY_ROOT; | ||
1028 | mkdir_attr(oroot, 0755, 0, 0); | ||
1029 | |||
1030 | // set base for working and diff directories | ||
1031 | char *basedir = RUN_MNT_DIR; | ||
1032 | int basefd = -1; | ||
1033 | |||
1034 | if (arg_overlay_keep) { | ||
1035 | basedir = cfg.overlay_dir; | ||
1036 | assert(basedir); | ||
1037 | // get a file descriptor for ~/.firejail, fails if there is any symlink | ||
1038 | char *firejail; | ||
1039 | if (asprintf(&firejail, "%s/.firejail", cfg.homedir) == -1) | ||
1040 | errExit("asprintf"); | ||
1041 | int fd = safer_openat(-1, firejail, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | ||
1042 | if (fd == -1) | ||
1043 | errExit("safer_openat"); | ||
1044 | free(firejail); | ||
1045 | // create basedir if it doesn't exist | ||
1046 | // the new directory will be owned by root | ||
1047 | const char *dirname = gnu_basename(basedir); | ||
1048 | if (mkdirat(fd, dirname, 0755) == -1 && errno != EEXIST) { | ||
1049 | perror("mkdir"); | ||
1050 | fprintf(stderr, "Error: cannot create overlay directory %s\n", basedir); | ||
1051 | exit(1); | ||
1052 | } | ||
1053 | // open basedir | ||
1054 | basefd = openat(fd, dirname, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | ||
1055 | close(fd); | ||
1056 | } | ||
1057 | else { | ||
1058 | basefd = open(basedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | ||
1059 | } | ||
1060 | if (basefd == -1) { | ||
1061 | perror("open"); | ||
1062 | fprintf(stderr, "Error: cannot open overlay directory %s\n", basedir); | ||
1063 | exit(1); | ||
1064 | } | ||
1065 | |||
1066 | // confirm once more base is owned by root | ||
1067 | if (fstat(basefd, &s) == -1) | ||
1068 | errExit("fstat"); | ||
1069 | if (s.st_uid != 0) { | ||
1070 | fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", basedir); | ||
1071 | exit(1); | ||
1072 | } | ||
1073 | // confirm permissions of base are 0755 | ||
1074 | if (((S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH) & s.st_mode) != (S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH)) { | ||
1075 | fprintf(stderr, "Error: invalid permissions on overlay directory %s\n", basedir); | ||
1076 | exit(1); | ||
1077 | } | ||
1078 | |||
1079 | // create diff and work directories inside base | ||
1080 | // no need to check arg_overlay_reuse | ||
1081 | char *odiff; | ||
1082 | if (asprintf(&odiff, "%s/odiff", basedir) == -1) | ||
1083 | errExit("asprintf"); | ||
1084 | // the new directory will be owned by root | ||
1085 | if (mkdirat(basefd, "odiff", 0755) == -1 && errno != EEXIST) { | ||
1086 | perror("mkdir"); | ||
1087 | fprintf(stderr, "Error: cannot create overlay directory %s\n", odiff); | ||
1088 | exit(1); | ||
1089 | } | ||
1090 | ASSERT_PERMS(odiff, 0, 0, 0755); | ||
1091 | |||
1092 | char *owork; | ||
1093 | if (asprintf(&owork, "%s/owork", basedir) == -1) | ||
1094 | errExit("asprintf"); | ||
1095 | // the new directory will be owned by root | ||
1096 | if (mkdirat(basefd, "owork", 0755) == -1 && errno != EEXIST) { | ||
1097 | perror("mkdir"); | ||
1098 | fprintf(stderr, "Error: cannot create overlay directory %s\n", owork); | ||
1099 | exit(1); | ||
1100 | } | ||
1101 | ASSERT_PERMS(owork, 0, 0, 0755); | ||
1102 | |||
1103 | // mount overlayfs | ||
1104 | if (arg_debug) | ||
1105 | printf("Mounting OverlayFS\n"); | ||
1106 | char *option; | ||
1107 | if (oldkernel) { // old Ubuntu/OpenSUSE kernels | ||
1108 | if (arg_overlay_keep) { | ||
1109 | fprintf(stderr, "Error: option --overlay= not available for kernels older than 3.18\n"); | ||
1110 | exit(1); | ||
1111 | } | ||
1112 | if (asprintf(&option, "lowerdir=/,upperdir=%s", odiff) == -1) | ||
1113 | errExit("asprintf"); | ||
1114 | if (mount("overlayfs", oroot, "overlayfs", MS_MGC_VAL, option) < 0) | ||
1115 | errExit("mounting overlayfs"); | ||
1116 | } | ||
1117 | else { // kernel 3.18 or newer | ||
1118 | if (asprintf(&option, "lowerdir=/,upperdir=%s,workdir=%s", odiff, owork) == -1) | ||
1119 | errExit("asprintf"); | ||
1120 | if (mount("overlay", oroot, "overlay", MS_MGC_VAL, option) < 0) { | ||
1121 | fprintf(stderr, "Debug: running on kernel version %d.%d\n", major, minor); | ||
1122 | errExit("mounting overlayfs"); | ||
1123 | } | ||
1124 | |||
1125 | //*************************** | ||
1126 | // issue #263 start code | ||
1127 | // My setup has a separate mount point for /home. When the overlay is mounted, | ||
1128 | // the overlay does not contain the original /home contents. | ||
1129 | // I added code to create a second overlay for /home if the overlay home dir is empty and this seems to work | ||
1130 | // @dshmgh, Jan 2016 | ||
1131 | { | ||
1132 | char *overlayhome; | ||
1133 | struct stat s; | ||
1134 | char *hroot; | ||
1135 | char *hdiff; | ||
1136 | char *hwork; | ||
1137 | |||
1138 | // dons add debug | ||
1139 | if (arg_debug) printf ("DEBUG: chroot dirs are oroot %s odiff %s owork %s\n",oroot,odiff,owork); | ||
1140 | |||
1141 | // BEFORE NEXT, WE NEED TO TEST IF /home has any contents or do we need to mount it? | ||
1142 | // must create var for oroot/cfg.homedir | ||
1143 | if (asprintf(&overlayhome, "%s%s", oroot, cfg.homedir) == -1) | ||
1144 | errExit("asprintf"); | ||
1145 | if (arg_debug) printf ("DEBUG: overlayhome var holds ##%s##\n", overlayhome); | ||
1146 | |||
1147 | // if no homedir in overlay -- create another overlay for /home | ||
1148 | if (stat(cfg.homedir, &s) == 0 && stat(overlayhome, &s) == -1) { | ||
1149 | |||
1150 | // no need to check arg_overlay_reuse | ||
1151 | if (asprintf(&hdiff, "%s/hdiff", basedir) == -1) | ||
1152 | errExit("asprintf"); | ||
1153 | // the new directory will be owned by root | ||
1154 | if (mkdirat(basefd, "hdiff", 0755) == -1 && errno != EEXIST) { | ||
1155 | perror("mkdir"); | ||
1156 | fprintf(stderr, "Error: cannot create overlay directory %s\n", hdiff); | ||
1157 | exit(1); | ||
1158 | } | ||
1159 | ASSERT_PERMS(hdiff, 0, 0, 0755); | ||
1160 | |||
1161 | // no need to check arg_overlay_reuse | ||
1162 | if (asprintf(&hwork, "%s/hwork", basedir) == -1) | ||
1163 | errExit("asprintf"); | ||
1164 | // the new directory will be owned by root | ||
1165 | if (mkdirat(basefd, "hwork", 0755) == -1 && errno != EEXIST) { | ||
1166 | perror("mkdir"); | ||
1167 | fprintf(stderr, "Error: cannot create overlay directory %s\n", hwork); | ||
1168 | exit(1); | ||
1169 | } | ||
1170 | ASSERT_PERMS(hwork, 0, 0, 0755); | ||
1171 | |||
1172 | // no homedir in overlay so now mount another overlay for /home | ||
1173 | if (asprintf(&hroot, "%s/home", oroot) == -1) | ||
1174 | errExit("asprintf"); | ||
1175 | if (asprintf(&option, "lowerdir=/home,upperdir=%s,workdir=%s", hdiff, hwork) == -1) | ||
1176 | errExit("asprintf"); | ||
1177 | if (mount("overlay", hroot, "overlay", MS_MGC_VAL, option) < 0) | ||
1178 | errExit("mounting overlayfs for mounted home directory"); | ||
1179 | |||
1180 | printf("OverlayFS for /home configured in %s directory\n", basedir); | ||
1181 | free(hroot); | ||
1182 | free(hdiff); | ||
1183 | free(hwork); | ||
1184 | |||
1185 | } // stat(overlayhome) | ||
1186 | free(overlayhome); | ||
1187 | } | ||
1188 | // issue #263 end code | ||
1189 | //*************************** | ||
1190 | } | ||
1191 | fmessage("OverlayFS configured in %s directory\n", basedir); | ||
1192 | close(basefd); | ||
1193 | |||
1194 | // /dev, /run and /tmp are not covered by the overlay | ||
1195 | // mount-bind dev directory | ||
1196 | if (arg_debug) | ||
1197 | printf("Mounting /dev\n"); | ||
1198 | char *dev; | ||
1199 | if (asprintf(&dev, "%s/dev", oroot) == -1) | ||
1200 | errExit("asprintf"); | ||
1201 | if (mount("/dev", dev, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
1202 | errExit("mounting /dev"); | ||
1203 | fs_logger("whitelist /dev"); | ||
1204 | |||
1205 | // mount-bind run directory | ||
1206 | if (arg_debug) | ||
1207 | printf("Mounting /run\n"); | ||
1208 | char *run; | ||
1209 | if (asprintf(&run, "%s/run", oroot) == -1) | ||
1210 | errExit("asprintf"); | ||
1211 | if (mount("/run", run, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
1212 | errExit("mounting /run"); | ||
1213 | fs_logger("whitelist /run"); | ||
1214 | |||
1215 | // mount-bind tmp directory | ||
1216 | if (arg_debug) | ||
1217 | printf("Mounting /tmp\n"); | ||
1218 | char *tmp; | ||
1219 | if (asprintf(&tmp, "%s/tmp", oroot) == -1) | ||
1220 | errExit("asprintf"); | ||
1221 | if (mount("/tmp", tmp, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
1222 | errExit("mounting /tmp"); | ||
1223 | fs_logger("whitelist /tmp"); | ||
1224 | |||
1225 | // chroot in the new filesystem | ||
1226 | __gcov_flush(); | ||
1227 | |||
1228 | if (chroot(oroot) == -1) | ||
1229 | errExit("chroot"); | ||
1230 | |||
1231 | // mount a new proc filesystem | ||
1232 | if (arg_debug) | ||
1233 | printf("Mounting /proc filesystem representing the PID namespace\n"); | ||
1234 | if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0) | ||
1235 | errExit("mounting /proc"); | ||
1236 | |||
1237 | // update /var directory in order to support multiple sandboxes running on the same root directory | ||
1238 | // if (!arg_private_dev) | ||
1239 | // fs_dev_shm(); | ||
1240 | fs_var_lock(); | ||
1241 | if (!arg_keep_var_tmp) | ||
1242 | fs_var_tmp(); | ||
1243 | if (!arg_writable_var_log) | ||
1244 | fs_var_log(); | ||
1245 | fs_var_lib(); | ||
1246 | fs_var_cache(); | ||
1247 | fs_var_utmp(); | ||
1248 | fs_machineid(); | ||
1249 | |||
1250 | // don't leak user information | ||
1251 | restrict_users(); | ||
1252 | |||
1253 | // when starting as root, firejail config is not disabled; | ||
1254 | if (getuid() != 0) | ||
1255 | disable_config(); | ||
1256 | |||
1257 | // cleanup and exit | ||
1258 | free(option); | ||
1259 | free(odiff); | ||
1260 | free(owork); | ||
1261 | free(dev); | ||
1262 | free(run); | ||
1263 | free(tmp); | ||
1264 | } | ||
1265 | #endif | ||
1266 | |||
1267 | // this function is called from sandbox.c before blacklist/whitelist functions | 898 | // this function is called from sandbox.c before blacklist/whitelist functions |
1268 | void fs_private_tmp(void) { | 899 | void fs_private_tmp(void) { |
1269 | EUID_ASSERT(); | 900 | EUID_ASSERT(); |
@@ -1287,7 +918,6 @@ void fs_private_tmp(void) { | |||
1287 | 918 | ||
1288 | // whitelist x11 directory | 919 | // whitelist x11 directory |
1289 | profile_add("whitelist /tmp/.X11-unix"); | 920 | profile_add("whitelist /tmp/.X11-unix"); |
1290 | // read-only x11 directory | ||
1291 | profile_add("read-only /tmp/.X11-unix"); | 921 | profile_add("read-only /tmp/.X11-unix"); |
1292 | 922 | ||
1293 | // whitelist sndio directory | 923 | // whitelist sndio directory |
diff --git a/src/firejail/fs_bin.c b/src/firejail/fs_bin.c index 61398f12b..4c9dac0c2 100644 --- a/src/firejail/fs_bin.c +++ b/src/firejail/fs_bin.c | |||
@@ -41,9 +41,9 @@ static char *paths[] = { | |||
41 | 41 | ||
42 | // return 1 if found, 0 if not found | 42 | // return 1 if found, 0 if not found |
43 | static char *check_dir_or_file(const char *name) { | 43 | static char *check_dir_or_file(const char *name) { |
44 | EUID_ASSERT(); | ||
44 | assert(name); | 45 | assert(name); |
45 | struct stat s; | 46 | struct stat s; |
46 | char *fname = NULL; | ||
47 | 47 | ||
48 | int i = 0; | 48 | int i = 0; |
49 | while (paths[i]) { | 49 | while (paths[i]) { |
@@ -54,50 +54,34 @@ static char *check_dir_or_file(const char *name) { | |||
54 | } | 54 | } |
55 | 55 | ||
56 | // check file | 56 | // check file |
57 | char *fname; | ||
57 | if (asprintf(&fname, "%s/%s", paths[i], name) == -1) | 58 | if (asprintf(&fname, "%s/%s", paths[i], name) == -1) |
58 | errExit("asprintf"); | 59 | errExit("asprintf"); |
59 | if (arg_debug) | 60 | if (arg_debug) |
60 | printf("Checking %s/%s\n", paths[i], name); | 61 | printf("Checking %s/%s\n", paths[i], name); |
61 | if (stat(fname, &s) == 0 && !S_ISDIR(s.st_mode)) { // do not allow directories | 62 | if (stat(fname, &s) == 0 && |
62 | // check symlink to firejail executable in /usr/local/bin | 63 | !S_ISDIR(s.st_mode) && // do not allow directories |
63 | if (strcmp(paths[i], "/usr/local/bin") == 0 && is_link(fname)) { | 64 | !is_firejail_link(fname)) { // skip symlinks to firejail executable, as created by firecfg |
64 | /* coverity[toctou] */ | 65 | free(fname); |
65 | char *actual_path = realpath(fname, NULL); | ||
66 | if (actual_path) { | ||
67 | char *ptr = strstr(actual_path, "/firejail"); | ||
68 | if (ptr && strlen(ptr) == strlen("/firejail")) { | ||
69 | if (arg_debug) | ||
70 | printf("firejail exec symlink detected\n"); | ||
71 | free(actual_path); | ||
72 | free(fname); | ||
73 | fname = NULL; | ||
74 | i++; | ||
75 | continue; | ||
76 | } | ||
77 | free(actual_path); | ||
78 | } | ||
79 | |||
80 | } | ||
81 | break; // file found | 66 | break; // file found |
82 | } | 67 | } |
83 | 68 | ||
84 | free(fname); | 69 | free(fname); |
85 | fname = NULL; | ||
86 | i++; | 70 | i++; |
87 | } | 71 | } |
88 | 72 | ||
89 | if (!fname) { | 73 | if (!paths[i]) { |
90 | if (arg_debug) | 74 | if (arg_debug) |
91 | fwarning("file %s not found\n", name); | 75 | fwarning("file %s not found\n", name); |
92 | return NULL; | 76 | return NULL; |
93 | } | 77 | } |
94 | 78 | ||
95 | free(fname); | ||
96 | return paths[i]; | 79 | return paths[i]; |
97 | } | 80 | } |
98 | 81 | ||
99 | // return 1 if the file is in paths[] | 82 | // return 1 if the file is in paths[] |
100 | static int valid_full_path_file(const char *name) { | 83 | static int valid_full_path_file(const char *name) { |
84 | EUID_ASSERT(); | ||
101 | assert(name); | 85 | assert(name); |
102 | 86 | ||
103 | if (*name != '/') | 87 | if (*name != '/') |
@@ -149,6 +133,7 @@ static void report_duplication(const char *fname) { | |||
149 | } | 133 | } |
150 | 134 | ||
151 | static void duplicate(char *fname) { | 135 | static void duplicate(char *fname) { |
136 | EUID_ASSERT(); | ||
152 | assert(fname); | 137 | assert(fname); |
153 | 138 | ||
154 | if (*fname == '~' || strstr(fname, "..")) { | 139 | if (*fname == '~' || strstr(fname, "..")) { |
@@ -220,6 +205,7 @@ static void duplicate(char *fname) { | |||
220 | } | 205 | } |
221 | 206 | ||
222 | static void globbing(char *fname) { | 207 | static void globbing(char *fname) { |
208 | EUID_ASSERT(); | ||
223 | assert(fname); | 209 | assert(fname); |
224 | 210 | ||
225 | // go directly to duplicate() if no globbing char is present - see man 7 glob | 211 | // go directly to duplicate() if no globbing char is present - see man 7 glob |
@@ -256,6 +242,9 @@ static void globbing(char *fname) { | |||
256 | // testing for GLOB_NOCHECK - no pattern matched returns the original pattern | 242 | // testing for GLOB_NOCHECK - no pattern matched returns the original pattern |
257 | if (strcmp(globbuf.gl_pathv[j], pattern) == 0) | 243 | if (strcmp(globbuf.gl_pathv[j], pattern) == 0) |
258 | continue; | 244 | continue; |
245 | // skip symlinks to firejail executable, as created by firecfg | ||
246 | if (is_firejail_link(globbuf.gl_pathv[j])) | ||
247 | continue; | ||
259 | 248 | ||
260 | duplicate(globbuf.gl_pathv[j]); | 249 | duplicate(globbuf.gl_pathv[j]); |
261 | } | 250 | } |
@@ -267,6 +256,7 @@ static void globbing(char *fname) { | |||
267 | } | 256 | } |
268 | 257 | ||
269 | void fs_private_bin_list(void) { | 258 | void fs_private_bin_list(void) { |
259 | EUID_ASSERT(); | ||
270 | char *private_list = cfg.bin_private_keep; | 260 | char *private_list = cfg.bin_private_keep; |
271 | assert(private_list); | 261 | assert(private_list); |
272 | 262 | ||
@@ -274,7 +264,9 @@ void fs_private_bin_list(void) { | |||
274 | timetrace_start(); | 264 | timetrace_start(); |
275 | 265 | ||
276 | // create /run/firejail/mnt/bin directory | 266 | // create /run/firejail/mnt/bin directory |
267 | EUID_ROOT(); | ||
277 | mkdir_attr(RUN_BIN_DIR, 0755, 0, 0); | 268 | mkdir_attr(RUN_BIN_DIR, 0755, 0, 0); |
269 | EUID_USER(); | ||
278 | 270 | ||
279 | if (arg_debug) | 271 | if (arg_debug) |
280 | printf("Copying files in the new bin directory\n"); | 272 | printf("Copying files in the new bin directory\n"); |
@@ -293,9 +285,9 @@ void fs_private_bin_list(void) { | |||
293 | while ((ptr = strtok(NULL, ",")) != NULL) | 285 | while ((ptr = strtok(NULL, ",")) != NULL) |
294 | globbing(ptr); | 286 | globbing(ptr); |
295 | free(dlist); | 287 | free(dlist); |
296 | fs_logger_print(); | ||
297 | 288 | ||
298 | // mount-bind | 289 | // mount-bind |
290 | EUID_ROOT(); | ||
299 | int i = 0; | 291 | int i = 0; |
300 | while (paths[i]) { | 292 | while (paths[i]) { |
301 | struct stat s; | 293 | struct stat s; |
@@ -309,6 +301,9 @@ void fs_private_bin_list(void) { | |||
309 | } | 301 | } |
310 | i++; | 302 | i++; |
311 | } | 303 | } |
304 | fs_logger_print(); | ||
305 | EUID_USER(); | ||
306 | |||
312 | selinux_relabel_path(RUN_BIN_DIR, "/bin"); | 307 | selinux_relabel_path(RUN_BIN_DIR, "/bin"); |
313 | fmessage("%d %s installed in %0.2f ms\n", prog_cnt, (prog_cnt == 1)? "program": "programs", timetrace_end()); | 308 | fmessage("%d %s installed in %0.2f ms\n", prog_cnt, (prog_cnt == 1)? "program": "programs", timetrace_end()); |
314 | } | 309 | } |
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c index 8cc3ecc62..694d0a379 100644 --- a/src/firejail/fs_dev.c +++ b/src/firejail/fs_dev.c | |||
@@ -20,7 +20,6 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | 21 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 22 | #include <sys/stat.h> |
23 | #include <linux/limits.h> | ||
24 | #include <glob.h> | 23 | #include <glob.h> |
25 | #include <dirent.h> | 24 | #include <dirent.h> |
26 | #include <fcntl.h> | 25 | #include <fcntl.h> |
@@ -330,8 +329,10 @@ void fs_dev_disable_sound(void) { | |||
330 | } | 329 | } |
331 | 330 | ||
332 | // disable all jack sockets in /dev/shm | 331 | // disable all jack sockets in /dev/shm |
332 | EUID_USER(); | ||
333 | glob_t globbuf; | 333 | glob_t globbuf; |
334 | int globerr = glob("/dev/shm/jack*", GLOB_NOSORT, NULL, &globbuf); | 334 | int globerr = glob("/dev/shm/jack*", GLOB_NOSORT, NULL, &globbuf); |
335 | EUID_ROOT(); | ||
335 | if (globerr) | 336 | if (globerr) |
336 | return; | 337 | return; |
337 | 338 | ||
diff --git a/src/firejail/fs_home.c b/src/firejail/fs_home.c index 0ed476063..230e9186c 100644 --- a/src/firejail/fs_home.c +++ b/src/firejail/fs_home.c | |||
@@ -19,7 +19,6 @@ | |||
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | 21 | #include <sys/mount.h> |
22 | #include <linux/limits.h> | ||
23 | #include <dirent.h> | 22 | #include <dirent.h> |
24 | #include <errno.h> | 23 | #include <errno.h> |
25 | #include <sys/stat.h> | 24 | #include <sys/stat.h> |
@@ -381,12 +380,14 @@ void fs_private(void) { | |||
381 | selinux_relabel_path("/home", "/home"); | 380 | selinux_relabel_path("/home", "/home"); |
382 | fs_logger("tmpfs /home"); | 381 | fs_logger("tmpfs /home"); |
383 | } | 382 | } |
383 | EUID_USER(); | ||
384 | 384 | ||
385 | if (u != 0) { | 385 | if (u != 0) { |
386 | if (!arg_allusers && strncmp(homedir, "/home/", 6) == 0) { | 386 | if (!arg_allusers && strncmp(homedir, "/home/", 6) == 0) { |
387 | // create new empty /home/user directory | 387 | // create new empty /home/user directory |
388 | if (arg_debug) | 388 | if (arg_debug) |
389 | printf("Create a new user directory\n"); | 389 | printf("Create a new user directory\n"); |
390 | EUID_ROOT(); | ||
390 | if (mkdir(homedir, S_IRWXU) == -1) { | 391 | if (mkdir(homedir, S_IRWXU) == -1) { |
391 | if (mkpath_as_root(homedir) == -1) | 392 | if (mkpath_as_root(homedir) == -1) |
392 | errExit("mkpath"); | 393 | errExit("mkpath"); |
@@ -395,7 +396,7 @@ void fs_private(void) { | |||
395 | } | 396 | } |
396 | if (chown(homedir, u, g) < 0) | 397 | if (chown(homedir, u, g) < 0) |
397 | errExit("chown"); | 398 | errExit("chown"); |
398 | 399 | EUID_USER(); | |
399 | fs_logger2("mkdir", homedir); | 400 | fs_logger2("mkdir", homedir); |
400 | fs_logger2("tmpfs", homedir); | 401 | fs_logger2("tmpfs", homedir); |
401 | } | 402 | } |
@@ -406,7 +407,6 @@ void fs_private(void) { | |||
406 | 407 | ||
407 | selinux_relabel_path(homedir, homedir); | 408 | selinux_relabel_path(homedir, homedir); |
408 | } | 409 | } |
409 | EUID_USER(); | ||
410 | 410 | ||
411 | skel(homedir); | 411 | skel(homedir); |
412 | if (xflag) | 412 | if (xflag) |
@@ -564,12 +564,13 @@ void fs_private_home_list(void) { | |||
564 | int xflag = store_xauthority(); | 564 | int xflag = store_xauthority(); |
565 | int aflag = store_asoundrc(); | 565 | int aflag = store_asoundrc(); |
566 | 566 | ||
567 | // create /run/firejail/mnt/home directory | ||
568 | EUID_ROOT(); | 567 | EUID_ROOT(); |
568 | // create /run/firejail/mnt/home directory | ||
569 | mkdir_attr(RUN_HOME_DIR, 0755, uid, gid); | 569 | mkdir_attr(RUN_HOME_DIR, 0755, uid, gid); |
570 | selinux_relabel_path(RUN_HOME_DIR, homedir); | 570 | selinux_relabel_path(RUN_HOME_DIR, homedir); |
571 | 571 | ||
572 | fs_logger_print(); // save the current log | 572 | // save the current log |
573 | fs_logger_print(); | ||
573 | EUID_USER(); | 574 | EUID_USER(); |
574 | 575 | ||
575 | // copy the list of files in the new home directory | 576 | // copy the list of files in the new home directory |
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c index 1a9a78ceb..8b7e94f51 100644 --- a/src/firejail/fs_hostname.c +++ b/src/firejail/fs_hostname.c | |||
@@ -20,7 +20,6 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | 21 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 22 | #include <sys/stat.h> |
23 | #include <linux/limits.h> | ||
24 | #include <glob.h> | 23 | #include <glob.h> |
25 | #include <dirent.h> | 24 | #include <dirent.h> |
26 | #include <fcntl.h> | 25 | #include <fcntl.h> |
@@ -33,7 +32,7 @@ void fs_hostname(const char *hostname) { | |||
33 | if (arg_debug) | 32 | if (arg_debug) |
34 | printf("Creating a new /etc/hostname file\n"); | 33 | printf("Creating a new /etc/hostname file\n"); |
35 | 34 | ||
36 | create_empty_file_as_root(RUN_HOSTNAME_FILE, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 35 | create_empty_file_as_root(RUN_HOSTNAME_FILE, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
37 | 36 | ||
38 | // bind-mount the file on top of /etc/hostname | 37 | // bind-mount the file on top of /etc/hostname |
39 | if (mount(RUN_HOSTNAME_FILE, "/etc/hostname", NULL, MS_BIND|MS_REC, NULL) < 0) | 38 | if (mount(RUN_HOSTNAME_FILE, "/etc/hostname", NULL, MS_BIND|MS_REC, NULL) < 0) |
@@ -75,7 +74,7 @@ void fs_hostname(const char *hostname) { | |||
75 | } | 74 | } |
76 | fclose(fp1); | 75 | fclose(fp1); |
77 | // mode and owner | 76 | // mode and owner |
78 | SET_PERMS_STREAM(fp2, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 77 | SET_PERMS_STREAM(fp2, 0, 0, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
79 | fclose(fp2); | 78 | fclose(fp2); |
80 | 79 | ||
81 | // bind-mount the file on top of /etc/hostname | 80 | // bind-mount the file on top of /etc/hostname |
@@ -93,10 +92,6 @@ char *fs_check_hosts_file(const char *fname) { | |||
93 | invalid_filename(fname, 0); // no globbing | 92 | invalid_filename(fname, 0); // no globbing |
94 | char *rv = expand_macros(fname); | 93 | char *rv = expand_macros(fname); |
95 | 94 | ||
96 | // no a link | ||
97 | if (is_link(rv)) | ||
98 | goto errexit; | ||
99 | |||
100 | // the user has read access to the file | 95 | // the user has read access to the file |
101 | if (access(rv, R_OK)) | 96 | if (access(rv, R_OK)) |
102 | goto errexit; | 97 | goto errexit; |
@@ -119,9 +114,6 @@ void fs_mount_hosts_file(void) { | |||
119 | struct stat s; | 114 | struct stat s; |
120 | if (stat("/etc/hosts", &s) == -1) | 115 | if (stat("/etc/hosts", &s) == -1) |
121 | goto errexit; | 116 | goto errexit; |
122 | // not a link | ||
123 | if (is_link("/etc/hosts")) | ||
124 | goto errexit; | ||
125 | // owned by root | 117 | // owned by root |
126 | if (s.st_uid != 0) | 118 | if (s.st_uid != 0) |
127 | goto errexit; | 119 | goto errexit; |
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c index 9d7a17cf3..03af7f8fb 100644 --- a/src/firejail/fs_lib.c +++ b/src/firejail/fs_lib.c | |||
@@ -61,17 +61,31 @@ static int valid_full_path(const char *full_path) { | |||
61 | return 0; | 61 | return 0; |
62 | } | 62 | } |
63 | 63 | ||
64 | // return 1 if symlink to firejail executable | ||
65 | int is_firejail_link(const char *fname) { | ||
66 | EUID_ASSERT(); | ||
67 | |||
68 | if (!is_link(fname)) | ||
69 | return 0; | ||
70 | |||
71 | char *rp = realpath(fname, NULL); | ||
72 | if (!rp) | ||
73 | return 0; | ||
74 | |||
75 | int rv = 0; | ||
76 | const char *base = gnu_basename(rp); | ||
77 | if (strcmp(base, "firejail") == 0) | ||
78 | rv = 1; | ||
79 | |||
80 | free(rp); | ||
81 | return rv; | ||
82 | } | ||
83 | |||
64 | char *find_in_path(const char *program) { | 84 | char *find_in_path(const char *program) { |
65 | EUID_ASSERT(); | 85 | EUID_ASSERT(); |
66 | if (arg_debug) | 86 | if (arg_debug) |
67 | printf("Searching $PATH for %s\n", program); | 87 | printf("Searching $PATH for %s\n", program); |
68 | 88 | ||
69 | char self[MAXBUF]; | ||
70 | ssize_t len = readlink("/proc/self/exe", self, MAXBUF - 1); | ||
71 | if (len < 0) | ||
72 | errExit("readlink"); | ||
73 | self[len] = '\0'; | ||
74 | |||
75 | const char *path = env_get("PATH"); | 89 | const char *path = env_get("PATH"); |
76 | if (!path) | 90 | if (!path) |
77 | return NULL; | 91 | return NULL; |
@@ -88,18 +102,12 @@ char *find_in_path(const char *program) { | |||
88 | if (arg_debug) | 102 | if (arg_debug) |
89 | printf("trying #%s#\n", fname); | 103 | printf("trying #%s#\n", fname); |
90 | struct stat s; | 104 | struct stat s; |
91 | if (stat(fname, &s) == 0) { | 105 | if (stat(fname, &s) == 0 && |
92 | // but skip links created by firecfg | 106 | !is_firejail_link(fname)) { // skip links created by firecfg |
93 | char *rp = realpath(fname, NULL); | 107 | free(dup); |
94 | if (!rp) | 108 | return fname; |
95 | errExit("realpath"); | ||
96 | if (strcmp(self, rp) != 0) { | ||
97 | free(rp); | ||
98 | free(dup); | ||
99 | return fname; | ||
100 | } | ||
101 | free(rp); | ||
102 | } | 109 | } |
110 | |||
103 | free(fname); | 111 | free(fname); |
104 | tok = strtok(NULL, ":"); | 112 | tok = strtok(NULL, ":"); |
105 | } | 113 | } |
@@ -195,6 +203,11 @@ void fslib_mount_libs(const char *full_path, unsigned user) { | |||
195 | assert(full_path); | 203 | assert(full_path); |
196 | // if library/executable does not exist or the user does not have read access to it | 204 | // if library/executable does not exist or the user does not have read access to it |
197 | // print a warning and exit the function. | 205 | // print a warning and exit the function. |
206 | if (access(full_path, F_OK)) { | ||
207 | if (arg_debug || arg_debug_private_lib) | ||
208 | printf("Cannot find %s, skipping...\n", full_path); | ||
209 | return; | ||
210 | } | ||
198 | if (user && access(full_path, R_OK)) { | 211 | if (user && access(full_path, R_OK)) { |
199 | if (arg_debug || arg_debug_private_lib) | 212 | if (arg_debug || arg_debug_private_lib) |
200 | printf("Cannot read %s, skipping...\n", full_path); | 213 | printf("Cannot read %s, skipping...\n", full_path); |
diff --git a/src/firejail/fs_lib2.c b/src/firejail/fs_lib2.c index c69bf7c98..a347b380c 100644 --- a/src/firejail/fs_lib2.c +++ b/src/firejail/fs_lib2.c | |||
@@ -143,7 +143,7 @@ static void fdir(void) { | |||
143 | NULL, | 143 | NULL, |
144 | }; | 144 | }; |
145 | 145 | ||
146 | // need to parse as root user, unprivileged users have no read permission on executables | 146 | // need to parse as root user, unprivileged users have no read permission on some of these binaries |
147 | int i; | 147 | int i; |
148 | for (i = 0; fbin[i]; i++) | 148 | for (i = 0; fbin[i]; i++) |
149 | fslib_mount_libs(fbin[i], 0); | 149 | fslib_mount_libs(fbin[i], 0); |
@@ -153,7 +153,9 @@ void fslib_install_firejail(void) { | |||
153 | timetrace_start(); | 153 | timetrace_start(); |
154 | // bring in firejail executable libraries, in case we are redirected here | 154 | // bring in firejail executable libraries, in case we are redirected here |
155 | // by a firejail symlink from /usr/local/bin/firejail | 155 | // by a firejail symlink from /usr/local/bin/firejail |
156 | fslib_mount_libs(PATH_FIREJAIL, 1); // parse as user | 156 | // fldd might have no read permission on the firejail executable |
157 | // parse as root in order to support these setups | ||
158 | fslib_mount_libs(PATH_FIREJAIL, 0); | ||
157 | 159 | ||
158 | // bring in firejail directory | 160 | // bring in firejail directory |
159 | fdir(); | 161 | fdir(); |
diff --git a/src/firejail/fs_overlayfs.c b/src/firejail/fs_overlayfs.c new file mode 100644 index 000000000..fe3761cb6 --- /dev/null +++ b/src/firejail/fs_overlayfs.c | |||
@@ -0,0 +1,470 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2021 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | |||
21 | #ifdef HAVE_OVERLAYFS | ||
22 | #include "firejail.h" | ||
23 | #include "../include/gcov_wrapper.h" | ||
24 | #include <sys/mount.h> | ||
25 | #include <sys/wait.h> | ||
26 | #include <ftw.h> | ||
27 | #include <errno.h> | ||
28 | |||
29 | #include <fcntl.h> | ||
30 | #ifndef O_PATH | ||
31 | #define O_PATH 010000000 | ||
32 | #endif | ||
33 | |||
34 | |||
35 | char *fs_check_overlay_dir(const char *subdirname, int allow_reuse) { | ||
36 | assert(subdirname); | ||
37 | EUID_ASSERT(); | ||
38 | struct stat s; | ||
39 | char *dirname; | ||
40 | |||
41 | if (asprintf(&dirname, "%s/.firejail", cfg.homedir) == -1) | ||
42 | errExit("asprintf"); | ||
43 | // check if ~/.firejail already exists | ||
44 | if (lstat(dirname, &s) == 0) { | ||
45 | if (!S_ISDIR(s.st_mode)) { | ||
46 | if (S_ISLNK(s.st_mode)) | ||
47 | fprintf(stderr, "Error: %s is a symbolic link\n", dirname); | ||
48 | else | ||
49 | fprintf(stderr, "Error: %s is not a directory\n", dirname); | ||
50 | exit(1); | ||
51 | } | ||
52 | if (s.st_uid != getuid()) { | ||
53 | fprintf(stderr, "Error: %s is not owned by the current user\n", dirname); | ||
54 | exit(1); | ||
55 | } | ||
56 | } | ||
57 | else { | ||
58 | // create ~/.firejail directory | ||
59 | create_empty_dir_as_user(dirname, 0700); | ||
60 | if (stat(dirname, &s) == -1) { | ||
61 | fprintf(stderr, "Error: cannot create directory %s\n", dirname); | ||
62 | exit(1); | ||
63 | } | ||
64 | } | ||
65 | free(dirname); | ||
66 | |||
67 | // check overlay directory | ||
68 | if (asprintf(&dirname, "%s/.firejail/%s", cfg.homedir, subdirname) == -1) | ||
69 | errExit("asprintf"); | ||
70 | if (lstat(dirname, &s) == 0) { | ||
71 | if (!S_ISDIR(s.st_mode)) { | ||
72 | if (S_ISLNK(s.st_mode)) | ||
73 | fprintf(stderr, "Error: %s is a symbolic link\n", dirname); | ||
74 | else | ||
75 | fprintf(stderr, "Error: %s is not a directory\n", dirname); | ||
76 | exit(1); | ||
77 | } | ||
78 | if (s.st_uid != 0) { | ||
79 | fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", dirname); | ||
80 | exit(1); | ||
81 | } | ||
82 | if (allow_reuse == 0) { | ||
83 | fprintf(stderr, "Error: overlay directory exists, but reuse is not allowed\n"); | ||
84 | exit(1); | ||
85 | } | ||
86 | } | ||
87 | |||
88 | return dirname; | ||
89 | } | ||
90 | |||
91 | |||
92 | // mount overlayfs on top of / directory | ||
93 | // mounting an overlay and chrooting into it: | ||
94 | // | ||
95 | // Old Ubuntu kernel | ||
96 | // # cd ~ | ||
97 | // # mkdir -p overlay/root | ||
98 | // # mkdir -p overlay/diff | ||
99 | // # mount -t overlayfs -o lowerdir=/,upperdir=/root/overlay/diff overlayfs /root/overlay/root | ||
100 | // # chroot /root/overlay/root | ||
101 | // to shutdown, first exit the chroot and then unmount the overlay | ||
102 | // # exit | ||
103 | // # umount /root/overlay/root | ||
104 | // | ||
105 | // Kernels 3.18+ | ||
106 | // # cd ~ | ||
107 | // # mkdir -p overlay/root | ||
108 | // # mkdir -p overlay/diff | ||
109 | // # mkdir -p overlay/work | ||
110 | // # mount -t overlay -o lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work overlay /root/overlay/root | ||
111 | // # cat /etc/mtab | grep overlay | ||
112 | // /root/overlay /root/overlay/root overlay rw,relatime,lowerdir=/,upperdir=/root/overlay/diff,workdir=/root/overlay/work 0 0 | ||
113 | // # chroot /root/overlay/root | ||
114 | // to shutdown, first exit the chroot and then unmount the overlay | ||
115 | // # exit | ||
116 | // # umount /root/overlay/root | ||
117 | |||
118 | // to do: fix the code below | ||
119 | #include <sys/utsname.h> | ||
120 | void fs_overlayfs(void) { | ||
121 | struct stat s; | ||
122 | |||
123 | // check kernel version | ||
124 | struct utsname u; | ||
125 | int rv = uname(&u); | ||
126 | if (rv != 0) | ||
127 | errExit("uname"); | ||
128 | int major; | ||
129 | int minor; | ||
130 | if (2 != sscanf(u.release, "%d.%d", &major, &minor)) { | ||
131 | fprintf(stderr, "Error: cannot extract Linux kernel version: %s\n", u.version); | ||
132 | exit(1); | ||
133 | } | ||
134 | |||
135 | if (arg_debug) | ||
136 | printf("Linux kernel version %d.%d\n", major, minor); | ||
137 | int oldkernel = 0; | ||
138 | if (major < 3) { | ||
139 | fprintf(stderr, "Error: minimum kernel version required 3.x\n"); | ||
140 | exit(1); | ||
141 | } | ||
142 | if (major == 3 && minor < 18) | ||
143 | oldkernel = 1; | ||
144 | |||
145 | // mounting an overlayfs on top of / seems to be broken for kernels > 4.19 | ||
146 | // we disable overlayfs for now, pending fixing | ||
147 | if (major >= 4 &&minor >= 19) { | ||
148 | fprintf(stderr, "Error: OverlayFS disabled for Linux kernels 4.19 and newer, pending fixing.\n"); | ||
149 | exit(1); | ||
150 | } | ||
151 | |||
152 | char *oroot = RUN_OVERLAY_ROOT; | ||
153 | mkdir_attr(oroot, 0755, 0, 0); | ||
154 | |||
155 | // set base for working and diff directories | ||
156 | char *basedir = RUN_MNT_DIR; | ||
157 | int basefd = -1; | ||
158 | |||
159 | if (arg_overlay_keep) { | ||
160 | basedir = cfg.overlay_dir; | ||
161 | assert(basedir); | ||
162 | // get a file descriptor for ~/.firejail, fails if there is any symlink | ||
163 | char *firejail; | ||
164 | if (asprintf(&firejail, "%s/.firejail", cfg.homedir) == -1) | ||
165 | errExit("asprintf"); | ||
166 | int fd = safer_openat(-1, firejail, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | ||
167 | if (fd == -1) | ||
168 | errExit("safer_openat"); | ||
169 | free(firejail); | ||
170 | // create basedir if it doesn't exist | ||
171 | // the new directory will be owned by root | ||
172 | const char *dirname = gnu_basename(basedir); | ||
173 | if (mkdirat(fd, dirname, 0755) == -1 && errno != EEXIST) { | ||
174 | perror("mkdir"); | ||
175 | fprintf(stderr, "Error: cannot create overlay directory %s\n", basedir); | ||
176 | exit(1); | ||
177 | } | ||
178 | // open basedir | ||
179 | basefd = openat(fd, dirname, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | ||
180 | close(fd); | ||
181 | } | ||
182 | else { | ||
183 | basefd = open(basedir, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | ||
184 | } | ||
185 | if (basefd == -1) { | ||
186 | perror("open"); | ||
187 | fprintf(stderr, "Error: cannot open overlay directory %s\n", basedir); | ||
188 | exit(1); | ||
189 | } | ||
190 | |||
191 | // confirm once more base is owned by root | ||
192 | if (fstat(basefd, &s) == -1) | ||
193 | errExit("fstat"); | ||
194 | if (s.st_uid != 0) { | ||
195 | fprintf(stderr, "Error: overlay directory %s is not owned by the root user\n", basedir); | ||
196 | exit(1); | ||
197 | } | ||
198 | // confirm permissions of base are 0755 | ||
199 | if (((S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH) & s.st_mode) != (S_IRWXU|S_IRGRP|S_IXGRP|S_IROTH|S_IXOTH)) { | ||
200 | fprintf(stderr, "Error: invalid permissions on overlay directory %s\n", basedir); | ||
201 | exit(1); | ||
202 | } | ||
203 | |||
204 | // create diff and work directories inside base | ||
205 | // no need to check arg_overlay_reuse | ||
206 | char *odiff; | ||
207 | if (asprintf(&odiff, "%s/odiff", basedir) == -1) | ||
208 | errExit("asprintf"); | ||
209 | // the new directory will be owned by root | ||
210 | if (mkdirat(basefd, "odiff", 0755) == -1 && errno != EEXIST) { | ||
211 | perror("mkdir"); | ||
212 | fprintf(stderr, "Error: cannot create overlay directory %s\n", odiff); | ||
213 | exit(1); | ||
214 | } | ||
215 | ASSERT_PERMS(odiff, 0, 0, 0755); | ||
216 | |||
217 | char *owork; | ||
218 | if (asprintf(&owork, "%s/owork", basedir) == -1) | ||
219 | errExit("asprintf"); | ||
220 | // the new directory will be owned by root | ||
221 | if (mkdirat(basefd, "owork", 0755) == -1 && errno != EEXIST) { | ||
222 | perror("mkdir"); | ||
223 | fprintf(stderr, "Error: cannot create overlay directory %s\n", owork); | ||
224 | exit(1); | ||
225 | } | ||
226 | ASSERT_PERMS(owork, 0, 0, 0755); | ||
227 | |||
228 | // mount overlayfs | ||
229 | if (arg_debug) | ||
230 | printf("Mounting OverlayFS\n"); | ||
231 | char *option; | ||
232 | if (oldkernel) { // old Ubuntu/OpenSUSE kernels | ||
233 | if (arg_overlay_keep) { | ||
234 | fprintf(stderr, "Error: option --overlay= not available for kernels older than 3.18\n"); | ||
235 | exit(1); | ||
236 | } | ||
237 | if (asprintf(&option, "lowerdir=/,upperdir=%s", odiff) == -1) | ||
238 | errExit("asprintf"); | ||
239 | if (mount("overlayfs", oroot, "overlayfs", MS_MGC_VAL, option) < 0) | ||
240 | errExit("mounting overlayfs"); | ||
241 | } | ||
242 | else { // kernel 3.18 or newer | ||
243 | if (asprintf(&option, "lowerdir=/,upperdir=%s,workdir=%s", odiff, owork) == -1) | ||
244 | errExit("asprintf"); | ||
245 | if (mount("overlay", oroot, "overlay", MS_MGC_VAL, option) < 0) { | ||
246 | fprintf(stderr, "Debug: running on kernel version %d.%d\n", major, minor); | ||
247 | errExit("mounting overlayfs"); | ||
248 | } | ||
249 | |||
250 | //*************************** | ||
251 | // issue #263 start code | ||
252 | // My setup has a separate mount point for /home. When the overlay is mounted, | ||
253 | // the overlay does not contain the original /home contents. | ||
254 | // I added code to create a second overlay for /home if the overlay home dir is empty and this seems to work | ||
255 | // @dshmgh, Jan 2016 | ||
256 | { | ||
257 | char *overlayhome; | ||
258 | struct stat s; | ||
259 | char *hroot; | ||
260 | char *hdiff; | ||
261 | char *hwork; | ||
262 | |||
263 | // dons add debug | ||
264 | if (arg_debug) printf ("DEBUG: chroot dirs are oroot %s odiff %s owork %s\n",oroot,odiff,owork); | ||
265 | |||
266 | // BEFORE NEXT, WE NEED TO TEST IF /home has any contents or do we need to mount it? | ||
267 | // must create var for oroot/cfg.homedir | ||
268 | if (asprintf(&overlayhome, "%s%s", oroot, cfg.homedir) == -1) | ||
269 | errExit("asprintf"); | ||
270 | if (arg_debug) printf ("DEBUG: overlayhome var holds ##%s##\n", overlayhome); | ||
271 | |||
272 | // if no homedir in overlay -- create another overlay for /home | ||
273 | if (stat(cfg.homedir, &s) == 0 && stat(overlayhome, &s) == -1) { | ||
274 | |||
275 | // no need to check arg_overlay_reuse | ||
276 | if (asprintf(&hdiff, "%s/hdiff", basedir) == -1) | ||
277 | errExit("asprintf"); | ||
278 | // the new directory will be owned by root | ||
279 | if (mkdirat(basefd, "hdiff", 0755) == -1 && errno != EEXIST) { | ||
280 | perror("mkdir"); | ||
281 | fprintf(stderr, "Error: cannot create overlay directory %s\n", hdiff); | ||
282 | exit(1); | ||
283 | } | ||
284 | ASSERT_PERMS(hdiff, 0, 0, 0755); | ||
285 | |||
286 | // no need to check arg_overlay_reuse | ||
287 | if (asprintf(&hwork, "%s/hwork", basedir) == -1) | ||
288 | errExit("asprintf"); | ||
289 | // the new directory will be owned by root | ||
290 | if (mkdirat(basefd, "hwork", 0755) == -1 && errno != EEXIST) { | ||
291 | perror("mkdir"); | ||
292 | fprintf(stderr, "Error: cannot create overlay directory %s\n", hwork); | ||
293 | exit(1); | ||
294 | } | ||
295 | ASSERT_PERMS(hwork, 0, 0, 0755); | ||
296 | |||
297 | // no homedir in overlay so now mount another overlay for /home | ||
298 | if (asprintf(&hroot, "%s/home", oroot) == -1) | ||
299 | errExit("asprintf"); | ||
300 | if (asprintf(&option, "lowerdir=/home,upperdir=%s,workdir=%s", hdiff, hwork) == -1) | ||
301 | errExit("asprintf"); | ||
302 | if (mount("overlay", hroot, "overlay", MS_MGC_VAL, option) < 0) | ||
303 | errExit("mounting overlayfs for mounted home directory"); | ||
304 | |||
305 | printf("OverlayFS for /home configured in %s directory\n", basedir); | ||
306 | free(hroot); | ||
307 | free(hdiff); | ||
308 | free(hwork); | ||
309 | |||
310 | } // stat(overlayhome) | ||
311 | free(overlayhome); | ||
312 | } | ||
313 | // issue #263 end code | ||
314 | //*************************** | ||
315 | } | ||
316 | fmessage("OverlayFS configured in %s directory\n", basedir); | ||
317 | close(basefd); | ||
318 | |||
319 | // /dev, /run and /tmp are not covered by the overlay | ||
320 | // mount-bind dev directory | ||
321 | if (arg_debug) | ||
322 | printf("Mounting /dev\n"); | ||
323 | char *dev; | ||
324 | if (asprintf(&dev, "%s/dev", oroot) == -1) | ||
325 | errExit("asprintf"); | ||
326 | if (mount("/dev", dev, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
327 | errExit("mounting /dev"); | ||
328 | fs_logger("whitelist /dev"); | ||
329 | |||
330 | // mount-bind run directory | ||
331 | if (arg_debug) | ||
332 | printf("Mounting /run\n"); | ||
333 | char *run; | ||
334 | if (asprintf(&run, "%s/run", oroot) == -1) | ||
335 | errExit("asprintf"); | ||
336 | if (mount("/run", run, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
337 | errExit("mounting /run"); | ||
338 | fs_logger("whitelist /run"); | ||
339 | |||
340 | // mount-bind tmp directory | ||
341 | if (arg_debug) | ||
342 | printf("Mounting /tmp\n"); | ||
343 | char *tmp; | ||
344 | if (asprintf(&tmp, "%s/tmp", oroot) == -1) | ||
345 | errExit("asprintf"); | ||
346 | if (mount("/tmp", tmp, NULL, MS_BIND|MS_REC, NULL) < 0) | ||
347 | errExit("mounting /tmp"); | ||
348 | fs_logger("whitelist /tmp"); | ||
349 | |||
350 | // chroot in the new filesystem | ||
351 | __gcov_flush(); | ||
352 | |||
353 | if (chroot(oroot) == -1) | ||
354 | errExit("chroot"); | ||
355 | |||
356 | // mount a new proc filesystem | ||
357 | if (arg_debug) | ||
358 | printf("Mounting /proc filesystem representing the PID namespace\n"); | ||
359 | if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_REC, NULL) < 0) | ||
360 | errExit("mounting /proc"); | ||
361 | |||
362 | // update /var directory in order to support multiple sandboxes running on the same root directory | ||
363 | // if (!arg_private_dev) | ||
364 | // fs_dev_shm(); | ||
365 | fs_var_lock(); | ||
366 | if (!arg_keep_var_tmp) | ||
367 | fs_var_tmp(); | ||
368 | if (!arg_writable_var_log) | ||
369 | fs_var_log(); | ||
370 | fs_var_lib(); | ||
371 | fs_var_cache(); | ||
372 | fs_var_utmp(); | ||
373 | fs_machineid(); | ||
374 | |||
375 | // don't leak user information | ||
376 | restrict_users(); | ||
377 | |||
378 | // when starting as root, firejail config is not disabled; | ||
379 | if (getuid() != 0) | ||
380 | disable_config(); | ||
381 | |||
382 | // cleanup and exit | ||
383 | free(option); | ||
384 | free(odiff); | ||
385 | free(owork); | ||
386 | free(dev); | ||
387 | free(run); | ||
388 | free(tmp); | ||
389 | } | ||
390 | |||
391 | |||
392 | static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) { | ||
393 | (void) sb; | ||
394 | (void) typeflag; | ||
395 | (void) ftwbuf; | ||
396 | assert(fpath); | ||
397 | |||
398 | if (strcmp(fpath, ".") == 0) // rmdir would fail with EINVAL | ||
399 | return 0; | ||
400 | |||
401 | if (remove(fpath)) { // removes the link not the actual file | ||
402 | fprintf(stderr, "Error: cannot remove file: %s\n", strerror(errno)); | ||
403 | exit(1); | ||
404 | } | ||
405 | |||
406 | return 0; | ||
407 | } | ||
408 | |||
409 | int remove_overlay_directory(void) { | ||
410 | EUID_ASSERT(); | ||
411 | sleep(1); | ||
412 | |||
413 | char *path; | ||
414 | if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1) | ||
415 | errExit("asprintf"); | ||
416 | |||
417 | if (access(path, F_OK) == 0) { | ||
418 | pid_t child = fork(); | ||
419 | if (child < 0) | ||
420 | errExit("fork"); | ||
421 | if (child == 0) { | ||
422 | // open ~/.firejail | ||
423 | int fd = safer_openat(-1, path, O_PATH|O_NOFOLLOW|O_CLOEXEC); | ||
424 | if (fd == -1) { | ||
425 | fprintf(stderr, "Error: cannot open %s\n", path); | ||
426 | exit(1); | ||
427 | } | ||
428 | struct stat s; | ||
429 | if (fstat(fd, &s) == -1) | ||
430 | errExit("fstat"); | ||
431 | if (!S_ISDIR(s.st_mode)) { | ||
432 | if (S_ISLNK(s.st_mode)) | ||
433 | fprintf(stderr, "Error: %s is a symbolic link\n", path); | ||
434 | else | ||
435 | fprintf(stderr, "Error: %s is not a directory\n", path); | ||
436 | exit(1); | ||
437 | } | ||
438 | if (s.st_uid != getuid()) { | ||
439 | fprintf(stderr, "Error: %s is not owned by the current user\n", path); | ||
440 | exit(1); | ||
441 | } | ||
442 | // chdir to ~/.firejail | ||
443 | if (fchdir(fd) == -1) | ||
444 | errExit("fchdir"); | ||
445 | close(fd); | ||
446 | |||
447 | EUID_ROOT(); | ||
448 | // FTW_PHYS - do not follow symbolic links | ||
449 | if (nftw(".", remove_callback, 64, FTW_DEPTH | FTW_PHYS) == -1) | ||
450 | errExit("nftw"); | ||
451 | |||
452 | EUID_USER(); | ||
453 | // remove ~/.firejail | ||
454 | if (rmdir(path) == -1) | ||
455 | errExit("rmdir"); | ||
456 | |||
457 | __gcov_flush(); | ||
458 | |||
459 | _exit(0); | ||
460 | } | ||
461 | // wait for the child to finish | ||
462 | waitpid(child, NULL, 0); | ||
463 | // check if ~/.firejail was deleted | ||
464 | if (access(path, F_OK) == 0) | ||
465 | return 1; | ||
466 | } | ||
467 | return 0; | ||
468 | } | ||
469 | |||
470 | #endif // HAVE_OVERLAYFS | ||
diff --git a/src/firejail/fs_trace.c b/src/firejail/fs_trace.c index 475a391ec..17a7b3d23 100644 --- a/src/firejail/fs_trace.c +++ b/src/firejail/fs_trace.c | |||
@@ -20,25 +20,31 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | 21 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 22 | #include <sys/stat.h> |
23 | #include <linux/limits.h> | ||
24 | #include <glob.h> | 23 | #include <glob.h> |
25 | #include <dirent.h> | 24 | #include <dirent.h> |
26 | #include <fcntl.h> | 25 | #include <fcntl.h> |
27 | #include <pwd.h> | 26 | #include <pwd.h> |
28 | 27 | ||
29 | void fs_trace_preload(void) { | 28 | // create an empty /etc/ld.so.preload |
29 | void fs_trace_touch_preload(void) { | ||
30 | create_empty_file_as_root("/etc/ld.so.preload", S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); | ||
31 | } | ||
32 | |||
33 | void fs_trace_touch_or_store_preload(void) { | ||
30 | struct stat s; | 34 | struct stat s; |
31 | 35 | ||
32 | // create an empty /etc/ld.so.preload | 36 | if (stat("/etc/ld.so.preload", &s) != 0) { |
33 | if (stat("/etc/ld.so.preload", &s)) { | 37 | fs_trace_touch_preload(); |
34 | if (arg_debug) | 38 | return; |
35 | printf("Creating an empty /etc/ld.so.preload file\n"); | 39 | } |
36 | FILE *fp = fopen("/etc/ld.so.preload", "wxe"); | 40 | |
37 | if (!fp) | 41 | if (s.st_size == 0) |
38 | errExit("fopen"); | 42 | return; |
39 | SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 43 | |
40 | fclose(fp); | 44 | // create a copy of /etc/ld.so.preload |
41 | fs_logger("touch /etc/ld.so.preload"); | 45 | if (copy_file("/etc/ld.so.preload", RUN_LDPRELOAD_FILE, 0, 0, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH)) { |
46 | fprintf(stderr, "Error: cannot copy /etc/ld.so.preload file\n"); | ||
47 | exit(1); | ||
42 | } | 48 | } |
43 | } | 49 | } |
44 | 50 | ||
@@ -47,7 +53,7 @@ void fs_tracefile(void) { | |||
47 | if (arg_debug) | 53 | if (arg_debug) |
48 | printf("Creating an empty trace log file: %s\n", arg_tracefile); | 54 | printf("Creating an empty trace log file: %s\n", arg_tracefile); |
49 | EUID_USER(); | 55 | EUID_USER(); |
50 | int fd = open(arg_tracefile, O_CREAT|O_WRONLY|O_CLOEXEC, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 56 | int fd = open(arg_tracefile, O_CREAT|O_WRONLY|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
51 | if (fd == -1) { | 57 | if (fd == -1) { |
52 | perror("open"); | 58 | perror("open"); |
53 | fprintf(stderr, "Error: cannot open trace log file %s for writing\n", arg_tracefile); | 59 | fprintf(stderr, "Error: cannot open trace log file %s for writing\n", arg_tracefile); |
@@ -83,7 +89,7 @@ void fs_trace(void) { | |||
83 | if (arg_debug) | 89 | if (arg_debug) |
84 | printf("Create the new ld.so.preload file\n"); | 90 | printf("Create the new ld.so.preload file\n"); |
85 | 91 | ||
86 | FILE *fp = fopen(RUN_LDPRELOAD_FILE, "we"); | 92 | FILE *fp = fopen(RUN_LDPRELOAD_FILE, "ae"); |
87 | if (!fp) | 93 | if (!fp) |
88 | errExit("fopen"); | 94 | errExit("fopen"); |
89 | const char *prefix = RUN_FIREJAIL_LIB_DIR; | 95 | const char *prefix = RUN_FIREJAIL_LIB_DIR; |
@@ -100,7 +106,7 @@ void fs_trace(void) { | |||
100 | fmessage("Post-exec seccomp protector enabled\n"); | 106 | fmessage("Post-exec seccomp protector enabled\n"); |
101 | } | 107 | } |
102 | 108 | ||
103 | SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 109 | SET_PERMS_STREAM(fp, 0, 0, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
104 | fclose(fp); | 110 | fclose(fp); |
105 | 111 | ||
106 | // mount the new preload file | 112 | // mount the new preload file |
diff --git a/src/firejail/fs_var.c b/src/firejail/fs_var.c index 20e262d80..e19d0df96 100644 --- a/src/firejail/fs_var.c +++ b/src/firejail/fs_var.c | |||
@@ -20,7 +20,6 @@ | |||
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <sys/mount.h> | 21 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 22 | #include <sys/stat.h> |
23 | #include <linux/limits.h> | ||
24 | #include <glob.h> | 23 | #include <glob.h> |
25 | #include <dirent.h> | 24 | #include <dirent.h> |
26 | #include <fcntl.h> | 25 | #include <fcntl.h> |
@@ -129,7 +128,7 @@ void fs_var_log(void) { | |||
129 | /* coverity[toctou] */ | 128 | /* coverity[toctou] */ |
130 | FILE *fp = fopen("/var/log/wtmp", "wxe"); | 129 | FILE *fp = fopen("/var/log/wtmp", "wxe"); |
131 | if (fp) { | 130 | if (fp) { |
132 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH); | 131 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH); |
133 | fclose(fp); | 132 | fclose(fp); |
134 | } | 133 | } |
135 | fs_logger("touch /var/log/wtmp"); | 134 | fs_logger("touch /var/log/wtmp"); |
@@ -137,7 +136,7 @@ void fs_var_log(void) { | |||
137 | // create an empty /var/log/btmp file | 136 | // create an empty /var/log/btmp file |
138 | fp = fopen("/var/log/btmp", "wxe"); | 137 | fp = fopen("/var/log/btmp", "wxe"); |
139 | if (fp) { | 138 | if (fp) { |
140 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP); | 139 | SET_PERMS_STREAM(fp, 0, wtmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP); |
141 | fclose(fp); | 140 | fclose(fp); |
142 | } | 141 | } |
143 | fs_logger("touch /var/log/btmp"); | 142 | fs_logger("touch /var/log/btmp"); |
@@ -314,7 +313,7 @@ void fs_var_utmp(void) { | |||
314 | // save new utmp file | 313 | // save new utmp file |
315 | int rv = fwrite(&u_boot, sizeof(u_boot), 1, fp); | 314 | int rv = fwrite(&u_boot, sizeof(u_boot), 1, fp); |
316 | (void) rv; | 315 | (void) rv; |
317 | SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWRITE | S_IRGRP | S_IWGRP | S_IROTH); | 316 | SET_PERMS_STREAM(fp, 0, utmp_group, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH); |
318 | fclose(fp); | 317 | fclose(fp); |
319 | 318 | ||
320 | // mount the new utmp file | 319 | // mount the new utmp file |
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c index 943f275de..7afebed1f 100644 --- a/src/firejail/fs_whitelist.c +++ b/src/firejail/fs_whitelist.c | |||
@@ -105,6 +105,7 @@ static int whitelist_mkpath(const char* path, mode_t mode) { | |||
105 | } | 105 | } |
106 | 106 | ||
107 | static void whitelist_file(int dirfd, const char *relpath, const char *path) { | 107 | static void whitelist_file(int dirfd, const char *relpath, const char *path) { |
108 | EUID_ASSERT(); | ||
108 | assert(relpath && path); | 109 | assert(relpath && path); |
109 | 110 | ||
110 | // open mount source, using a file descriptor that refers to the | 111 | // open mount source, using a file descriptor that refers to the |
@@ -130,12 +131,9 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
130 | } | 131 | } |
131 | 132 | ||
132 | // create mount target as root, except if inside home or run/user/$UID directory | 133 | // create mount target as root, except if inside home or run/user/$UID directory |
133 | int userprivs = 0; | 134 | if ((strncmp(path, cfg.homedir, homedir_len) != 0 || path[homedir_len] != '/') && |
134 | if ((strncmp(path, cfg.homedir, homedir_len) == 0 && path[homedir_len] == '/') || | 135 | (strncmp(path, runuser, runuser_len) != 0 || path[runuser_len] != '/')) |
135 | (strncmp(path, runuser, runuser_len) == 0 && path[runuser_len] == '/')) { | 136 | EUID_ROOT(); |
136 | EUID_USER(); | ||
137 | userprivs = 1; | ||
138 | } | ||
139 | 137 | ||
140 | // create path of the mount target | 138 | // create path of the mount target |
141 | int fd2 = whitelist_mkpath(path, 0755); | 139 | int fd2 = whitelist_mkpath(path, 0755); |
@@ -146,8 +144,7 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
146 | if (arg_debug || arg_debug_whitelists) | 144 | if (arg_debug || arg_debug_whitelists) |
147 | printf("Debug %d: skip whitelist %s\n", __LINE__, path); | 145 | printf("Debug %d: skip whitelist %s\n", __LINE__, path); |
148 | close(fd); | 146 | close(fd); |
149 | if (userprivs) | 147 | EUID_USER(); |
150 | EUID_ROOT(); | ||
151 | return; | 148 | return; |
152 | } | 149 | } |
153 | 150 | ||
@@ -166,8 +163,7 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
166 | } | 163 | } |
167 | close(fd); | 164 | close(fd); |
168 | close(fd2); | 165 | close(fd2); |
169 | if (userprivs) | 166 | EUID_USER(); |
170 | EUID_ROOT(); | ||
171 | return; | 167 | return; |
172 | } | 168 | } |
173 | fd3 = openat(fd2, file, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); | 169 | fd3 = openat(fd2, file, O_PATH|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC); |
@@ -184,19 +180,17 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
184 | } | 180 | } |
185 | close(fd); | 181 | close(fd); |
186 | close(fd2); | 182 | close(fd2); |
187 | if (userprivs) | 183 | EUID_USER(); |
188 | EUID_ROOT(); | ||
189 | return; | 184 | return; |
190 | } | 185 | } |
191 | |||
192 | close(fd2); | 186 | close(fd2); |
193 | if (userprivs) | ||
194 | EUID_ROOT(); | ||
195 | 187 | ||
196 | if (arg_debug || arg_debug_whitelists) | 188 | if (arg_debug || arg_debug_whitelists) |
197 | printf("Whitelisting %s\n", path); | 189 | printf("Whitelisting %s\n", path); |
190 | EUID_ROOT(); | ||
198 | if (bind_mount_by_fd(fd, fd3)) | 191 | if (bind_mount_by_fd(fd, fd3)) |
199 | errExit("mount bind"); | 192 | errExit("mount bind"); |
193 | EUID_USER(); | ||
200 | // check the last mount operation | 194 | // check the last mount operation |
201 | MountData *mptr = get_last_mount(); // will do exit(1) if the mount cannot be found | 195 | MountData *mptr = get_last_mount(); // will do exit(1) if the mount cannot be found |
202 | #ifdef TEST_MOUNTINFO | 196 | #ifdef TEST_MOUNTINFO |
@@ -219,22 +213,19 @@ static void whitelist_file(int dirfd, const char *relpath, const char *path) { | |||
219 | } | 213 | } |
220 | 214 | ||
221 | static void whitelist_symlink(const char *link, const char *target) { | 215 | static void whitelist_symlink(const char *link, const char *target) { |
216 | EUID_ASSERT(); | ||
222 | assert(link && target); | 217 | assert(link && target); |
223 | 218 | ||
224 | // create files as root, except if inside home or run/user/$UID directory | 219 | // create files as root, except if inside home or run/user/$UID directory |
225 | int userprivs = 0; | 220 | if ((strncmp(link, cfg.homedir, homedir_len) != 0 || link[homedir_len] != '/') && |
226 | if ((strncmp(link, cfg.homedir, homedir_len) == 0 && link[homedir_len] == '/') || | 221 | (strncmp(link, runuser, runuser_len) != 0 || link[runuser_len] != '/')) |
227 | (strncmp(link, runuser, runuser_len) == 0 && link[runuser_len] == '/')) { | 222 | EUID_ROOT(); |
228 | EUID_USER(); | ||
229 | userprivs = 1; | ||
230 | } | ||
231 | 223 | ||
232 | int fd = whitelist_mkpath(link, 0755); | 224 | int fd = whitelist_mkpath(link, 0755); |
233 | if (fd == -1) { | 225 | if (fd == -1) { |
234 | if (arg_debug || arg_debug_whitelists) | 226 | if (arg_debug || arg_debug_whitelists) |
235 | printf("Debug %d: cannot create symbolic link %s\n", __LINE__, link); | 227 | printf("Debug %d: cannot create symbolic link %s\n", __LINE__, link); |
236 | if (userprivs) | 228 | EUID_USER(); |
237 | EUID_ROOT(); | ||
238 | return; | 229 | return; |
239 | } | 230 | } |
240 | 231 | ||
@@ -252,8 +243,7 @@ static void whitelist_symlink(const char *link, const char *target) { | |||
252 | printf("Created symbolic link %s -> %s\n", link, target); | 243 | printf("Created symbolic link %s -> %s\n", link, target); |
253 | 244 | ||
254 | close(fd); | 245 | close(fd); |
255 | if (userprivs) | 246 | EUID_USER(); |
256 | EUID_ROOT(); | ||
257 | } | 247 | } |
258 | 248 | ||
259 | static void globbing(const char *pattern) { | 249 | static void globbing(const char *pattern) { |
@@ -330,10 +320,11 @@ static void tmpfs_topdirs(const TopDir *topdirs) { | |||
330 | // init tmpfs | 320 | // init tmpfs |
331 | if (strcmp(topdirs[i].path, "/run") == 0) { | 321 | if (strcmp(topdirs[i].path, "/run") == 0) { |
332 | // restore /run/firejail directory | 322 | // restore /run/firejail directory |
333 | if (mkdir(RUN_FIREJAIL_DIR, 0755) == -1) | 323 | EUID_ROOT(); |
334 | errExit("mkdir"); | 324 | mkdir_attr(RUN_FIREJAIL_DIR, 0755, 0, 0); |
335 | if (bind_mount_fd_to_path(fd, RUN_FIREJAIL_DIR)) | 325 | if (bind_mount_fd_to_path(fd, RUN_FIREJAIL_DIR)) |
336 | errExit("mount bind"); | 326 | errExit("mount bind"); |
327 | EUID_USER(); | ||
337 | close(fd); | 328 | close(fd); |
338 | fs_logger2("whitelist", RUN_FIREJAIL_DIR); | 329 | fs_logger2("whitelist", RUN_FIREJAIL_DIR); |
339 | 330 | ||
@@ -351,12 +342,14 @@ static void tmpfs_topdirs(const TopDir *topdirs) { | |||
351 | errExit("asprintf"); | 342 | errExit("asprintf"); |
352 | if (strcmp(env, pamtmpdir) == 0) { | 343 | if (strcmp(env, pamtmpdir) == 0) { |
353 | // create empty user-owned /tmp/user/$UID directory | 344 | // create empty user-owned /tmp/user/$UID directory |
345 | EUID_ROOT(); | ||
354 | mkdir_attr("/tmp/user", 0711, 0, 0); | 346 | mkdir_attr("/tmp/user", 0711, 0, 0); |
355 | selinux_relabel_path("/tmp/user", "/tmp/user"); | 347 | selinux_relabel_path("/tmp/user", "/tmp/user"); |
356 | fs_logger("mkdir /tmp/user"); | 348 | fs_logger("mkdir /tmp/user"); |
357 | mkdir_attr(pamtmpdir, 0700, getuid(), 0); | 349 | mkdir_attr(pamtmpdir, 0700, getuid(), 0); |
358 | selinux_relabel_path(pamtmpdir, pamtmpdir); | 350 | selinux_relabel_path(pamtmpdir, pamtmpdir); |
359 | fs_logger2("mkdir", pamtmpdir); | 351 | fs_logger2("mkdir", pamtmpdir); |
352 | EUID_USER(); | ||
360 | } | 353 | } |
361 | free(pamtmpdir); | 354 | free(pamtmpdir); |
362 | } | 355 | } |
@@ -374,11 +367,8 @@ static void tmpfs_topdirs(const TopDir *topdirs) { | |||
374 | } | 367 | } |
375 | 368 | ||
376 | // user home directory | 369 | // user home directory |
377 | if (tmpfs_home) { | 370 | if (tmpfs_home) |
378 | EUID_USER(); | ||
379 | fs_private(); // checks owner if outside /home | 371 | fs_private(); // checks owner if outside /home |
380 | EUID_ROOT(); | ||
381 | } | ||
382 | 372 | ||
383 | // /run/user/$UID directory | 373 | // /run/user/$UID directory |
384 | if (tmpfs_runuser) { | 374 | if (tmpfs_runuser) { |
@@ -402,6 +392,7 @@ static int reject_topdir(const char *dir) { | |||
402 | // keep track of whitelist top level directories by adding them to an array | 392 | // keep track of whitelist top level directories by adding them to an array |
403 | // open each directory | 393 | // open each directory |
404 | static TopDir *add_topdir(const char *dir, TopDir *topdirs, const char *path) { | 394 | static TopDir *add_topdir(const char *dir, TopDir *topdirs, const char *path) { |
395 | EUID_ASSERT(); | ||
405 | assert(dir && path); | 396 | assert(dir && path); |
406 | 397 | ||
407 | // /proc and /sys are not allowed | 398 | // /proc and /sys are not allowed |
@@ -516,6 +507,8 @@ static char *extract_topdir(const char *path) { | |||
516 | } | 507 | } |
517 | 508 | ||
518 | void fs_whitelist(void) { | 509 | void fs_whitelist(void) { |
510 | EUID_ASSERT(); | ||
511 | |||
519 | ProfileEntry *entry = cfg.profile; | 512 | ProfileEntry *entry = cfg.profile; |
520 | if (!entry) | 513 | if (!entry) |
521 | return; | 514 | return; |
@@ -536,7 +529,6 @@ void fs_whitelist(void) { | |||
536 | errExit("calloc"); | 529 | errExit("calloc"); |
537 | 530 | ||
538 | // verify whitelist files, extract symbolic links, etc. | 531 | // verify whitelist files, extract symbolic links, etc. |
539 | EUID_USER(); | ||
540 | while (entry) { | 532 | while (entry) { |
541 | int nowhitelist_flag = 0; | 533 | int nowhitelist_flag = 0; |
542 | 534 | ||
@@ -630,7 +622,7 @@ void fs_whitelist(void) { | |||
630 | if (!fname) { | 622 | if (!fname) { |
631 | if (arg_debug || arg_debug_whitelists) { | 623 | if (arg_debug || arg_debug_whitelists) { |
632 | printf("Removed path: %s\n", entry->data); | 624 | printf("Removed path: %s\n", entry->data); |
633 | printf("\texpanded: %s\n", new_name); | 625 | printf("\tnew_name: %s\n", new_name); |
634 | printf("\trealpath: (null)\n"); | 626 | printf("\trealpath: (null)\n"); |
635 | printf("\t%s\n", strerror(errno)); | 627 | printf("\t%s\n", strerror(errno)); |
636 | } | 628 | } |
@@ -712,7 +704,6 @@ void fs_whitelist(void) { | |||
712 | free(nowhitelist); | 704 | free(nowhitelist); |
713 | 705 | ||
714 | // mount tmpfs on all top level directories | 706 | // mount tmpfs on all top level directories |
715 | EUID_ROOT(); | ||
716 | tmpfs_topdirs(topdirs); | 707 | tmpfs_topdirs(topdirs); |
717 | 708 | ||
718 | // go through profile rules again, and interpret whitelist commands | 709 | // go through profile rules again, and interpret whitelist commands |
diff --git a/src/firejail/ids.c b/src/firejail/ids.c index 59acdb1fe..a9ff59be4 100644 --- a/src/firejail/ids.c +++ b/src/firejail/ids.c | |||
@@ -86,4 +86,4 @@ void run_ids(int argc, char **argv) { | |||
86 | fprintf(stderr, "Error: unrecognized IDS command\n"); | 86 | fprintf(stderr, "Error: unrecognized IDS command\n"); |
87 | 87 | ||
88 | exit(0); | 88 | exit(0); |
89 | } \ No newline at end of file | 89 | } |
diff --git a/src/firejail/join.c b/src/firejail/join.c index 99fbfdd0a..0e76fd944 100644 --- a/src/firejail/join.c +++ b/src/firejail/join.c | |||
@@ -431,7 +431,7 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
431 | 431 | ||
432 | // set cgroup | 432 | // set cgroup |
433 | if (cfg.cgroup) // not available for uid 0 | 433 | if (cfg.cgroup) // not available for uid 0 |
434 | set_cgroup(cfg.cgroup); | 434 | set_cgroup(cfg.cgroup, getpid()); |
435 | 435 | ||
436 | // join namespaces | 436 | // join namespaces |
437 | if (arg_join_network) { | 437 | if (arg_join_network) { |
@@ -551,10 +551,6 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
551 | if (cfg.cpus) // not available for uid 0 | 551 | if (cfg.cpus) // not available for uid 0 |
552 | set_cpu_affinity(); | 552 | set_cpu_affinity(); |
553 | 553 | ||
554 | // set nice value | ||
555 | if (arg_nice) | ||
556 | set_nice(cfg.nice); | ||
557 | |||
558 | // add x11 display | 554 | // add x11 display |
559 | if (display) { | 555 | if (display) { |
560 | char *display_str; | 556 | char *display_str; |
@@ -573,6 +569,11 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
573 | dbus_set_system_bus_env(); | 569 | dbus_set_system_bus_env(); |
574 | #endif | 570 | #endif |
575 | 571 | ||
572 | // set nice and rlimits | ||
573 | if (arg_nice) | ||
574 | set_nice(cfg.nice); | ||
575 | set_rlimits(); | ||
576 | |||
576 | start_application(0, shfd, NULL); | 577 | start_application(0, shfd, NULL); |
577 | 578 | ||
578 | __builtin_unreachable(); | 579 | __builtin_unreachable(); |
diff --git a/src/firejail/ls.c b/src/firejail/ls.c index 70985ba9e..53e918dde 100644 --- a/src/firejail/ls.c +++ b/src/firejail/ls.c | |||
@@ -305,7 +305,7 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { | |||
305 | } | 305 | } |
306 | // create destination file if necessary | 306 | // create destination file if necessary |
307 | EUID_ASSERT(); | 307 | EUID_ASSERT(); |
308 | int fd = open(dest_fname, O_WRONLY|O_CREAT|O_CLOEXEC, S_IRUSR | S_IWRITE); | 308 | int fd = open(dest_fname, O_WRONLY|O_CREAT|O_CLOEXEC, S_IRUSR | S_IWUSR); |
309 | if (fd == -1) { | 309 | if (fd == -1) { |
310 | fprintf(stderr, "Error: cannot open %s for writing\n", dest_fname); | 310 | fprintf(stderr, "Error: cannot open %s for writing\n", dest_fname); |
311 | exit(1); | 311 | exit(1); |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 81d148257..e765d1d8d 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -32,7 +32,8 @@ | |||
32 | #include <dirent.h> | 32 | #include <dirent.h> |
33 | #include <pwd.h> | 33 | #include <pwd.h> |
34 | #include <errno.h> | 34 | #include <errno.h> |
35 | //#include <limits.h> | 35 | |
36 | #include <limits.h> | ||
36 | #include <sys/file.h> | 37 | #include <sys/file.h> |
37 | #include <sys/prctl.h> | 38 | #include <sys/prctl.h> |
38 | #include <signal.h> | 39 | #include <signal.h> |
@@ -870,7 +871,7 @@ char *guess_shell(void) { | |||
870 | if (shell) { | 871 | if (shell) { |
871 | invalid_filename(shell, 0); // no globbing | 872 | invalid_filename(shell, 0); // no globbing |
872 | if (access(shell, X_OK) == 0 && !is_dir(shell) && strstr(shell, "..") == NULL && | 873 | if (access(shell, X_OK) == 0 && !is_dir(shell) && strstr(shell, "..") == NULL && |
873 | strcmp(shell, PATH_FIREJAIL) != 0) | 874 | strcmp(gnu_basename(shell), "firejail") != 0) |
874 | goto found; | 875 | goto found; |
875 | } | 876 | } |
876 | 877 | ||
@@ -1528,15 +1529,16 @@ int main(int argc, char **argv, char **envp) { | |||
1528 | else if (strncmp(argv[i], "--cgroup=", 9) == 0) { | 1529 | else if (strncmp(argv[i], "--cgroup=", 9) == 0) { |
1529 | if (checkcfg(CFG_CGROUP)) { | 1530 | if (checkcfg(CFG_CGROUP)) { |
1530 | if (option_cgroup) { | 1531 | if (option_cgroup) { |
1531 | fprintf(stderr, "Error: only a cgroup can be defined\n"); | 1532 | fprintf(stderr, "Error: only one cgroup can be defined\n"); |
1532 | exit(1); | 1533 | exit(1); |
1533 | } | 1534 | } |
1534 | |||
1535 | option_cgroup = 1; | ||
1536 | cfg.cgroup = strdup(argv[i] + 9); | 1535 | cfg.cgroup = strdup(argv[i] + 9); |
1537 | if (!cfg.cgroup) | 1536 | if (!cfg.cgroup) |
1538 | errExit("strdup"); | 1537 | errExit("strdup"); |
1539 | set_cgroup(cfg.cgroup); | 1538 | |
1539 | check_cgroup_file(cfg.cgroup); | ||
1540 | set_cgroup(cfg.cgroup, getpid()); | ||
1541 | option_cgroup = 1; | ||
1540 | } | 1542 | } |
1541 | else | 1543 | else |
1542 | exit_err_feature("cgroup"); | 1544 | exit_err_feature("cgroup"); |
@@ -2154,6 +2156,10 @@ int main(int argc, char **argv, char **envp) { | |||
2154 | arg_novideo = 1; | 2156 | arg_novideo = 1; |
2155 | else if (strcmp(argv[i], "--no3d") == 0) | 2157 | else if (strcmp(argv[i], "--no3d") == 0) |
2156 | arg_no3d = 1; | 2158 | arg_no3d = 1; |
2159 | else if (strcmp(argv[i], "--noprinters") == 0) { | ||
2160 | profile_add("blacklist /dev/lp*"); | ||
2161 | profile_add("blacklist /run/cups/cups.sock"); | ||
2162 | } | ||
2157 | else if (strcmp(argv[i], "--notv") == 0) | 2163 | else if (strcmp(argv[i], "--notv") == 0) |
2158 | arg_notv = 1; | 2164 | arg_notv = 1; |
2159 | else if (strcmp(argv[i], "--nodvd") == 0) | 2165 | else if (strcmp(argv[i], "--nodvd") == 0) |
diff --git a/src/firejail/mountinfo.c b/src/firejail/mountinfo.c index 64a94bd84..ee437e10b 100644 --- a/src/firejail/mountinfo.c +++ b/src/firejail/mountinfo.c | |||
@@ -19,6 +19,7 @@ | |||
19 | */ | 19 | */ |
20 | 20 | ||
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include <errno.h> | ||
22 | 23 | ||
23 | #include <fcntl.h> | 24 | #include <fcntl.h> |
24 | #ifndef O_PATH | 25 | #ifndef O_PATH |
@@ -32,43 +33,38 @@ static MountData mdata; | |||
32 | 33 | ||
33 | 34 | ||
34 | // Convert octal escape sequence to decimal value | 35 | // Convert octal escape sequence to decimal value |
35 | static int read_oct(const char *path) { | 36 | static unsigned read_oct(char *s) { |
36 | int dec = 0; | 37 | assert(s[0] == '\\'); |
37 | int digit, i; | 38 | s++; |
38 | // there are always exactly three octal digits | 39 | |
39 | for (i = 1; i < 4; i++) { | 40 | int i; |
40 | digit = *(path + i); | 41 | for (i = 0; i < 3; i++) |
41 | if (digit < '0' || digit > '7') { | 42 | assert(s[i] >= '0' && s[i] <= '7'); |
42 | fprintf(stderr, "Error: cannot read /proc/self/mountinfo\n"); | 43 | |
43 | exit(1); | 44 | return ((s[0] - '0') << 6 | |
44 | } | 45 | (s[1] - '0') << 3 | |
45 | dec = (dec << 3) + (digit - '0'); | 46 | (s[2] - '0') << 0); |
46 | } | ||
47 | return dec; | ||
48 | } | 47 | } |
49 | 48 | ||
50 | // Restore empty spaces in pathnames extracted from /proc/self/mountinfo | 49 | // Restore empty spaces in pathnames extracted from /proc/self/mountinfo |
51 | static void unmangle_path(char *path) { | 50 | static void unmangle_path(char *path) { |
52 | char *p = strchr(path, '\\'); | 51 | char *r = strchr(path, '\\'); |
53 | if (p && read_oct(p) == ' ') { | 52 | if (!r) |
54 | *p = ' '; | 53 | return; |
55 | int i = 3; | 54 | |
56 | do { | 55 | char *w = r; |
57 | p++; | 56 | do { |
58 | if (*(p + i) == '\\' && read_oct(p + i) == ' ') { | 57 | while (*r == '\\') { |
59 | *p = ' '; | 58 | *w++ = read_oct(r); |
60 | i += 3; | 59 | r += 4; |
61 | } | 60 | } |
62 | else | 61 | *w++ = *r; |
63 | *p = *(p + i); | 62 | } while (*r++); |
64 | } while (*p); | ||
65 | } | ||
66 | } | 63 | } |
67 | 64 | ||
68 | // Parse a line from /proc/self/mountinfo, | 65 | // Parse a line from /proc/self/mountinfo, |
69 | // the function does an exit(1) if anything goes wrong. | 66 | // the function does an exit(1) if anything goes wrong. |
70 | static void parse_line(char *line, MountData *output) { | 67 | static void parse_line(char *line, MountData *output) { |
71 | assert(line && output); | ||
72 | memset(output, 0, sizeof(*output)); | 68 | memset(output, 0, sizeof(*output)); |
73 | // extract mount id, filesystem name, directory and filesystem types | 69 | // extract mount id, filesystem name, directory and filesystem types |
74 | // examples: | 70 | // examples: |
@@ -86,8 +82,6 @@ static void parse_line(char *line, MountData *output) { | |||
86 | char *ptr = strtok(line, " "); | 82 | char *ptr = strtok(line, " "); |
87 | if (!ptr) | 83 | if (!ptr) |
88 | goto errexit; | 84 | goto errexit; |
89 | if (ptr != line) | ||
90 | goto errexit; | ||
91 | output->mountid = atoi(ptr); | 85 | output->mountid = atoi(ptr); |
92 | int cnt = 1; | 86 | int cnt = 1; |
93 | 87 | ||
@@ -108,10 +102,9 @@ static void parse_line(char *line, MountData *output) { | |||
108 | ptr = strtok(NULL, " "); | 102 | ptr = strtok(NULL, " "); |
109 | if (!ptr) | 103 | if (!ptr) |
110 | goto errexit; | 104 | goto errexit; |
111 | output->fstype = ptr++; | 105 | output->fstype = ptr; |
112 | |||
113 | 106 | ||
114 | if (output->mountid == 0 || | 107 | if (output->mountid < 0 || |
115 | output->fsname == NULL || | 108 | output->fsname == NULL || |
116 | output->dir == NULL || | 109 | output->dir == NULL || |
117 | output->fstype == NULL) | 110 | output->fstype == NULL) |
@@ -151,111 +144,117 @@ MountData *get_last_mount(void) { | |||
151 | return &mdata; | 144 | return &mdata; |
152 | } | 145 | } |
153 | 146 | ||
154 | // Extract the mount id from /proc/self/fdinfo and return it. | 147 | // Returns mount id, or -1 if fd refers to a procfs or sysfs file |
155 | int get_mount_id(const char *path) { | 148 | static int get_mount_id_from_handle(int fd) { |
156 | EUID_ASSERT(); | 149 | EUID_ASSERT(); |
157 | assert(path); | ||
158 | 150 | ||
159 | int fd = open(path, O_PATH|O_CLOEXEC); | 151 | char *proc; |
160 | if (fd == -1) | 152 | if (asprintf(&proc, "/proc/self/fd/%d", fd) == -1) |
161 | return -1; | 153 | errExit("asprintf"); |
154 | struct file_handle *fh = malloc(sizeof *fh); | ||
155 | if (!fh) | ||
156 | errExit("malloc"); | ||
157 | fh->handle_bytes = 0; | ||
158 | |||
159 | int rv = -1; | ||
160 | int tmp; | ||
161 | if (name_to_handle_at(-1, proc, fh, &tmp, AT_SYMLINK_FOLLOW) != -1) { | ||
162 | fprintf(stderr, "Error: unexpected result from name_to_handle_at\n"); | ||
163 | exit(1); | ||
164 | } | ||
165 | if (errno == EOVERFLOW && fh->handle_bytes) | ||
166 | rv = tmp; | ||
167 | |||
168 | free(proc); | ||
169 | free(fh); | ||
170 | return rv; | ||
171 | } | ||
172 | |||
173 | // Returns mount id, or -1 on kernels < 3.15 | ||
174 | static int get_mount_id_from_fdinfo(int fd) { | ||
175 | EUID_ASSERT(); | ||
176 | int rv = -1; | ||
162 | 177 | ||
163 | char *fdinfo; | 178 | char *proc; |
164 | if (asprintf(&fdinfo, "/proc/self/fdinfo/%d", fd) == -1) | 179 | if (asprintf(&proc, "/proc/self/fdinfo/%d", fd) == -1) |
165 | errExit("asprintf"); | 180 | errExit("asprintf"); |
166 | EUID_ROOT(); | 181 | EUID_ROOT(); |
167 | FILE *fp = fopen(fdinfo, "re"); | 182 | FILE *fp = fopen(proc, "re"); |
168 | EUID_USER(); | 183 | EUID_USER(); |
169 | free(fdinfo); | ||
170 | if (!fp) | 184 | if (!fp) |
171 | goto errexit; | 185 | goto errexit; |
172 | 186 | ||
173 | // read the file | ||
174 | char buf[MAX_BUF]; | 187 | char buf[MAX_BUF]; |
175 | if (fgets(buf, MAX_BUF, fp) == NULL) | 188 | while (fgets(buf, MAX_BUF, fp)) { |
176 | goto errexit; | ||
177 | do { | ||
178 | if (strncmp(buf, "mnt_id:", 7) == 0) { | 189 | if (strncmp(buf, "mnt_id:", 7) == 0) { |
179 | char *ptr = buf + 7; | 190 | if (sscanf(buf + 7, "%d", &rv) == 1) |
180 | while (*ptr != '\0' && (*ptr == ' ' || *ptr == '\t')) { | 191 | break; |
181 | ptr++; | 192 | goto errexit; |
182 | } | ||
183 | if (*ptr == '\0') | ||
184 | goto errexit; | ||
185 | fclose(fp); | ||
186 | close(fd); | ||
187 | return atoi(ptr); | ||
188 | } | 193 | } |
189 | } while (fgets(buf, MAX_BUF, fp)); | 194 | } |
190 | 195 | ||
191 | // fallback, kernels older than 3.15 don't expose the mount id in this place | 196 | free(proc); |
192 | fclose(fp); | 197 | fclose(fp); |
193 | close(fd); | 198 | return rv; |
194 | return -2; | ||
195 | 199 | ||
196 | errexit: | 200 | errexit: |
197 | fprintf(stderr, "Error: cannot read proc file\n"); | 201 | fprintf(stderr, "Error: cannot read proc file\n"); |
198 | exit(1); | 202 | exit(1); |
199 | } | 203 | } |
200 | 204 | ||
205 | int get_mount_id(int fd) { | ||
206 | int rv = get_mount_id_from_fdinfo(fd); | ||
207 | if (rv < 0) | ||
208 | rv = get_mount_id_from_handle(fd); | ||
209 | return rv; | ||
210 | } | ||
211 | |||
201 | // Check /proc/self/mountinfo if path contains any mounts points. | 212 | // Check /proc/self/mountinfo if path contains any mounts points. |
202 | // Returns an array that can be iterated over for recursive remounting. | 213 | // Returns an array that can be iterated over for recursive remounting. |
203 | char **build_mount_array(const int mount_id, const char *path) { | 214 | char **build_mount_array(const int mountid, const char *path) { |
204 | assert(path); | 215 | assert(path); |
205 | 216 | ||
206 | // open /proc/self/mountinfo | ||
207 | FILE *fp = fopen("/proc/self/mountinfo", "re"); | 217 | FILE *fp = fopen("/proc/self/mountinfo", "re"); |
208 | if (!fp) { | 218 | if (!fp) { |
209 | fprintf(stderr, "Error: cannot read /proc/self/mountinfo\n"); | 219 | fprintf(stderr, "Error: cannot read /proc/self/mountinfo\n"); |
210 | exit(1); | 220 | exit(1); |
211 | } | 221 | } |
212 | 222 | ||
213 | // array to be returned | 223 | // try to find line with mount id |
214 | size_t cnt = 0; | 224 | int found = 0; |
225 | MountData mntp; | ||
226 | char line[MAX_BUF]; | ||
227 | while (fgets(line, MAX_BUF, fp)) { | ||
228 | parse_line(line, &mntp); | ||
229 | if (mntp.mountid == mountid) { | ||
230 | found = 1; | ||
231 | break; | ||
232 | } | ||
233 | } | ||
234 | |||
235 | if (!found) { | ||
236 | fclose(fp); | ||
237 | return NULL; | ||
238 | } | ||
239 | |||
240 | // allocate array | ||
215 | size_t size = 32; | 241 | size_t size = 32; |
216 | char **rv = malloc(size * sizeof(*rv)); | 242 | char **rv = malloc(size * sizeof(*rv)); |
217 | if (!rv) | 243 | if (!rv) |
218 | errExit("malloc"); | 244 | errExit("malloc"); |
219 | 245 | ||
220 | // read /proc/self/mountinfo | 246 | // add directory itself |
221 | size_t pathlen = strlen(path); | 247 | size_t cnt = 0; |
222 | char buf[MAX_BUF]; | 248 | rv[cnt] = strdup(path); |
223 | MountData mntp; | 249 | if (rv[cnt] == NULL) |
224 | int found = 0; | 250 | errExit("strdup"); |
225 | 251 | ||
226 | if (fgets(buf, MAX_BUF, fp) == NULL) { | 252 | // and add all following mountpoints contained in this directory |
227 | fprintf(stderr, "Error: cannot read /proc/self/mountinfo\n"); | 253 | size_t pathlen = strlen(path); |
228 | exit(1); | 254 | while (fgets(line, MAX_BUF, fp)) { |
229 | } | 255 | parse_line(line, &mntp); |
230 | do { | 256 | if (strncmp(mntp.dir, path, pathlen) == 0 && mntp.dir[pathlen] == '/') { |
231 | parse_line(buf, &mntp); | 257 | if (++cnt == size) { |
232 | // find mount point with mount id | ||
233 | if (!found) { | ||
234 | if (mntp.mountid == mount_id) { | ||
235 | // give up if mount id has been reassigned, | ||
236 | // don't remount blacklisted path | ||
237 | if (strncmp(mntp.dir, path, strlen(mntp.dir)) || | ||
238 | strstr(mntp.fsname, "firejail.ro.dir") || | ||
239 | strstr(mntp.fsname, "firejail.ro.file")) | ||
240 | break; | ||
241 | |||
242 | rv[cnt] = strdup(path); | ||
243 | if (rv[cnt] == NULL) | ||
244 | errExit("strdup"); | ||
245 | cnt++; | ||
246 | found = 1; | ||
247 | continue; | ||
248 | } | ||
249 | continue; | ||
250 | } | ||
251 | // from here on add all mount points below path, | ||
252 | // don't remount blacklisted paths | ||
253 | if (strncmp(mntp.dir, path, pathlen) == 0 && | ||
254 | mntp.dir[pathlen] == '/' && | ||
255 | strstr(mntp.fsname, "firejail.ro.dir") == NULL && | ||
256 | strstr(mntp.fsname, "firejail.ro.file") == NULL) { | ||
257 | |||
258 | if (cnt == size) { | ||
259 | size *= 2; | 258 | size *= 2; |
260 | rv = realloc(rv, size * sizeof(*rv)); | 259 | rv = realloc(rv, size * sizeof(*rv)); |
261 | if (!rv) | 260 | if (!rv) |
@@ -264,18 +263,17 @@ char **build_mount_array(const int mount_id, const char *path) { | |||
264 | rv[cnt] = strdup(mntp.dir); | 263 | rv[cnt] = strdup(mntp.dir); |
265 | if (rv[cnt] == NULL) | 264 | if (rv[cnt] == NULL) |
266 | errExit("strdup"); | 265 | errExit("strdup"); |
267 | cnt++; | ||
268 | } | 266 | } |
269 | } while (fgets(buf, MAX_BUF, fp)); | 267 | } |
268 | fclose(fp); | ||
270 | 269 | ||
271 | if (cnt == size) { | 270 | // end of array |
272 | size++; | 271 | if (++cnt == size) { |
272 | ++size; | ||
273 | rv = realloc(rv, size * sizeof(*rv)); | 273 | rv = realloc(rv, size * sizeof(*rv)); |
274 | if (!rv) | 274 | if (!rv) |
275 | errExit("realloc"); | 275 | errExit("realloc"); |
276 | } | 276 | } |
277 | rv[cnt] = NULL; // end of the array | 277 | rv[cnt] = NULL; |
278 | |||
279 | fclose(fp); | ||
280 | return rv; | 278 | return rv; |
281 | } | 279 | } |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index b7c7185a6..babc3941e 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -175,6 +175,10 @@ static int check_allow_drm(void) { | |||
175 | return checkcfg(CFG_BROWSER_ALLOW_DRM) != 0; | 175 | return checkcfg(CFG_BROWSER_ALLOW_DRM) != 0; |
176 | } | 176 | } |
177 | 177 | ||
178 | static int check_allow_tray(void) { | ||
179 | return checkcfg(CFG_ALLOW_TRAY) != 0; | ||
180 | } | ||
181 | |||
178 | Cond conditionals[] = { | 182 | Cond conditionals[] = { |
179 | {"HAS_APPIMAGE", check_appimage}, | 183 | {"HAS_APPIMAGE", check_appimage}, |
180 | {"HAS_NET", check_netoptions}, | 184 | {"HAS_NET", check_netoptions}, |
@@ -184,6 +188,7 @@ Cond conditionals[] = { | |||
184 | {"HAS_X11", check_x11}, | 188 | {"HAS_X11", check_x11}, |
185 | {"BROWSER_DISABLE_U2F", check_disable_u2f}, | 189 | {"BROWSER_DISABLE_U2F", check_disable_u2f}, |
186 | {"BROWSER_ALLOW_DRM", check_allow_drm}, | 190 | {"BROWSER_ALLOW_DRM", check_allow_drm}, |
191 | {"ALLOW_TRAY", check_allow_tray}, | ||
187 | { NULL, NULL } | 192 | { NULL, NULL } |
188 | }; | 193 | }; |
189 | 194 | ||
@@ -444,6 +449,11 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
444 | arg_no3d = 1; | 449 | arg_no3d = 1; |
445 | return 0; | 450 | return 0; |
446 | } | 451 | } |
452 | else if (strcmp(ptr, "noprinters") == 0) { | ||
453 | profile_add("blacklist /dev/lp*"); | ||
454 | profile_add("blacklist /run/cups/cups.sock"); | ||
455 | return 0; | ||
456 | } | ||
447 | else if (strcmp(ptr, "noinput") == 0) { | 457 | else if (strcmp(ptr, "noinput") == 0) { |
448 | arg_noinput = 1; | 458 | arg_noinput = 1; |
449 | return 0; | 459 | return 0; |
@@ -630,7 +640,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
630 | #endif | 640 | #endif |
631 | return 0; | 641 | return 0; |
632 | } | 642 | } |
633 | else if (strncmp(ptr, "netns ", 6) == 0) { | 643 | else if (strncmp(ptr, "netns ", 6) == 0) { |
634 | #ifdef HAVE_NETWORK | 644 | #ifdef HAVE_NETWORK |
635 | if (checkcfg(CFG_NETWORK)) { | 645 | if (checkcfg(CFG_NETWORK)) { |
636 | arg_netns = ptr + 6; | 646 | arg_netns = ptr + 6; |
@@ -981,10 +991,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
981 | warning_feature_disabled("seccomp"); | 991 | warning_feature_disabled("seccomp"); |
982 | return 0; | 992 | return 0; |
983 | } | 993 | } |
984 | if (strncmp(ptr, "seccomp.32.drop ", 13) == 0) { | 994 | if (strncmp(ptr, "seccomp.32.drop ", 16) == 0) { |
985 | if (checkcfg(CFG_SECCOMP)) { | 995 | if (checkcfg(CFG_SECCOMP)) { |
986 | arg_seccomp32 = 1; | 996 | arg_seccomp32 = 1; |
987 | cfg.seccomp_list_drop32 = seccomp_check_list(ptr + 13); | 997 | cfg.seccomp_list_drop32 = seccomp_check_list(ptr + 16); |
988 | } | 998 | } |
989 | else | 999 | else |
990 | warning_feature_disabled("seccomp"); | 1000 | warning_feature_disabled("seccomp"); |
@@ -1001,10 +1011,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
1001 | warning_feature_disabled("seccomp"); | 1011 | warning_feature_disabled("seccomp"); |
1002 | return 0; | 1012 | return 0; |
1003 | } | 1013 | } |
1004 | if (strncmp(ptr, "seccomp.32.keep ", 13) == 0) { | 1014 | if (strncmp(ptr, "seccomp.32.keep ", 16) == 0) { |
1005 | if (checkcfg(CFG_SECCOMP)) { | 1015 | if (checkcfg(CFG_SECCOMP)) { |
1006 | arg_seccomp32 = 1; | 1016 | arg_seccomp32 = 1; |
1007 | cfg.seccomp_list_keep32 = seccomp_check_list(ptr + 13); | 1017 | cfg.seccomp_list_keep32 = seccomp_check_list(ptr + 16); |
1008 | } | 1018 | } |
1009 | else | 1019 | else |
1010 | warning_feature_disabled("seccomp"); | 1020 | warning_feature_disabled("seccomp"); |
@@ -1124,8 +1134,14 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
1124 | 1134 | ||
1125 | // cgroup | 1135 | // cgroup |
1126 | if (strncmp(ptr, "cgroup ", 7) == 0) { | 1136 | if (strncmp(ptr, "cgroup ", 7) == 0) { |
1127 | if (checkcfg(CFG_CGROUP)) | 1137 | if (checkcfg(CFG_CGROUP)) { |
1128 | set_cgroup(ptr + 7); | 1138 | cfg.cgroup = strdup(ptr + 7); |
1139 | if (!cfg.cgroup) | ||
1140 | errExit("strdup"); | ||
1141 | |||
1142 | check_cgroup_file(cfg.cgroup); | ||
1143 | set_cgroup(cfg.cgroup, getpid()); | ||
1144 | } | ||
1129 | else | 1145 | else |
1130 | warning_feature_disabled("cgroup"); | 1146 | warning_feature_disabled("cgroup"); |
1131 | return 0; | 1147 | return 0; |
@@ -1938,7 +1954,7 @@ char *profile_list_compress(char *list) | |||
1938 | /* Include non-empty item */ | 1954 | /* Include non-empty item */ |
1939 | if (!*item) | 1955 | if (!*item) |
1940 | in[i] = 0; | 1956 | in[i] = 0; |
1941 | /* Remove all allready included items */ | 1957 | /* Remove all already included items */ |
1942 | for (k = 0; k < i; ++k) | 1958 | for (k = 0; k < i; ++k) |
1943 | in[k] = 0; | 1959 | in[k] = 0; |
1944 | break; | 1960 | break; |
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c index 6f17231a4..59077dada 100644 --- a/src/firejail/restrict_users.c +++ b/src/firejail/restrict_users.c | |||
@@ -21,7 +21,6 @@ | |||
21 | #include "../include/firejail_user.h" | 21 | #include "../include/firejail_user.h" |
22 | #include <sys/mount.h> | 22 | #include <sys/mount.h> |
23 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
24 | #include <linux/limits.h> | ||
25 | #include <fnmatch.h> | 24 | #include <fnmatch.h> |
26 | #include <glob.h> | 25 | #include <glob.h> |
27 | #include <dirent.h> | 26 | #include <dirent.h> |
diff --git a/src/firejail/run_symlink.c b/src/firejail/run_symlink.c index 77fac5438..6397418d1 100644 --- a/src/firejail/run_symlink.c +++ b/src/firejail/run_symlink.c | |||
@@ -22,7 +22,6 @@ | |||
22 | #include <sys/stat.h> | 22 | #include <sys/stat.h> |
23 | #include <unistd.h> | 23 | #include <unistd.h> |
24 | 24 | ||
25 | extern char *find_in_path(const char *program); | ||
26 | 25 | ||
27 | void run_symlink(int argc, char **argv, int run_as_is) { | 26 | void run_symlink(int argc, char **argv, int run_as_is) { |
28 | EUID_ASSERT(); | 27 | EUID_ASSERT(); |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 995827fb7..efa21c34b 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -204,7 +204,7 @@ static void save_umask(void) { | |||
204 | } | 204 | } |
205 | 205 | ||
206 | static char *create_join_file(void) { | 206 | static char *create_join_file(void) { |
207 | int fd = open(RUN_JOIN_FILE, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWRITE | S_IRGRP | S_IROTH); | 207 | int fd = open(RUN_JOIN_FILE, O_RDWR|O_CREAT|O_EXCL|O_CLOEXEC, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); |
208 | if (fd == -1) | 208 | if (fd == -1) |
209 | errExit("open"); | 209 | errExit("open"); |
210 | if (ftruncate(fd, 1) == -1) | 210 | if (ftruncate(fd, 1) == -1) |
@@ -798,7 +798,7 @@ int sandbox(void* sandbox_arg) { | |||
798 | 798 | ||
799 | // trace pre-install | 799 | // trace pre-install |
800 | if (need_preload) | 800 | if (need_preload) |
801 | fs_trace_preload(); | 801 | fs_trace_touch_or_store_preload(); |
802 | 802 | ||
803 | // store hosts file | 803 | // store hosts file |
804 | if (cfg.hosts_file) | 804 | if (cfg.hosts_file) |
@@ -814,8 +814,11 @@ int sandbox(void* sandbox_arg) { | |||
814 | //**************************** | 814 | //**************************** |
815 | // trace pre-install, this time inside chroot | 815 | // trace pre-install, this time inside chroot |
816 | //**************************** | 816 | //**************************** |
817 | if (need_preload) | 817 | if (need_preload) { |
818 | fs_trace_preload(); | 818 | int rv = unlink(RUN_LDPRELOAD_FILE); |
819 | (void) rv; | ||
820 | fs_trace_touch_or_store_preload(); | ||
821 | } | ||
819 | } | 822 | } |
820 | else | 823 | else |
821 | #endif | 824 | #endif |
@@ -887,16 +890,16 @@ int sandbox(void* sandbox_arg) { | |||
887 | else if (arg_overlay) | 890 | else if (arg_overlay) |
888 | fwarning("private-bin feature is disabled in overlay\n"); | 891 | fwarning("private-bin feature is disabled in overlay\n"); |
889 | else { | 892 | else { |
893 | EUID_USER(); | ||
890 | // for --x11=xorg we need to add xauth command | 894 | // for --x11=xorg we need to add xauth command |
891 | if (arg_x11_xorg) { | 895 | if (arg_x11_xorg) { |
892 | EUID_USER(); | ||
893 | char *tmp; | 896 | char *tmp; |
894 | if (asprintf(&tmp, "%s,xauth", cfg.bin_private_keep) == -1) | 897 | if (asprintf(&tmp, "%s,xauth", cfg.bin_private_keep) == -1) |
895 | errExit("asprintf"); | 898 | errExit("asprintf"); |
896 | cfg.bin_private_keep = tmp; | 899 | cfg.bin_private_keep = tmp; |
897 | EUID_ROOT(); | ||
898 | } | 900 | } |
899 | fs_private_bin_list(); | 901 | fs_private_bin_list(); |
902 | EUID_ROOT(); | ||
900 | } | 903 | } |
901 | } | 904 | } |
902 | 905 | ||
@@ -992,7 +995,7 @@ int sandbox(void* sandbox_arg) { | |||
992 | 995 | ||
993 | // create /etc/ld.so.preload file again | 996 | // create /etc/ld.so.preload file again |
994 | if (need_preload) | 997 | if (need_preload) |
995 | fs_trace_preload(); | 998 | fs_trace_touch_preload(); |
996 | 999 | ||
997 | // openSUSE configuration is split between /etc and /usr/etc | 1000 | // openSUSE configuration is split between /etc and /usr/etc |
998 | // process private-etc a second time | 1001 | // process private-etc a second time |
@@ -1004,10 +1007,12 @@ int sandbox(void* sandbox_arg) { | |||
1004 | // apply the profile file | 1007 | // apply the profile file |
1005 | //**************************** | 1008 | //**************************** |
1006 | // apply all whitelist commands ... | 1009 | // apply all whitelist commands ... |
1010 | EUID_USER(); | ||
1007 | fs_whitelist(); | 1011 | fs_whitelist(); |
1008 | 1012 | ||
1009 | // ... followed by blacklist commands | 1013 | // ... followed by blacklist commands |
1010 | fs_blacklist(); // mkdir and mkfile are processed all over again | 1014 | fs_blacklist(); // mkdir and mkfile are processed all over again |
1015 | EUID_ROOT(); | ||
1011 | 1016 | ||
1012 | //**************************** | 1017 | //**************************** |
1013 | // nosound/no3d/notv/novideo and fix for pulseaudio 7.0 | 1018 | // nosound/no3d/notv/novideo and fix for pulseaudio 7.0 |
diff --git a/src/firejail/selinux.c b/src/firejail/selinux.c index 6969e7a3d..fa59882ed 100644 --- a/src/firejail/selinux.c +++ b/src/firejail/selinux.c | |||
@@ -21,6 +21,7 @@ | |||
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include <sys/types.h> | 22 | #include <sys/types.h> |
23 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
24 | #include <errno.h> | ||
24 | 25 | ||
25 | #include <fcntl.h> | 26 | #include <fcntl.h> |
26 | #ifndef O_PATH | 27 | #ifndef O_PATH |
@@ -57,7 +58,17 @@ void selinux_relabel_path(const char *path, const char *inside_path) | |||
57 | 58 | ||
58 | /* Open the file as O_PATH, to pin it while we determine and adjust the label | 59 | /* Open the file as O_PATH, to pin it while we determine and adjust the label |
59 | * Defeat symlink races by not allowing symbolic links */ | 60 | * Defeat symlink races by not allowing symbolic links */ |
61 | int called_as_root = 0; | ||
62 | if (geteuid() == 0) | ||
63 | called_as_root = 1; | ||
64 | if (called_as_root) | ||
65 | EUID_USER(); | ||
66 | |||
60 | fd = safer_openat(-1, path, O_NOFOLLOW|O_CLOEXEC|O_PATH); | 67 | fd = safer_openat(-1, path, O_NOFOLLOW|O_CLOEXEC|O_PATH); |
68 | |||
69 | if (called_as_root) | ||
70 | EUID_ROOT(); | ||
71 | |||
61 | if (fd < 0) | 72 | if (fd < 0) |
62 | return; | 73 | return; |
63 | if (fstat(fd, &st) < 0) | 74 | if (fstat(fd, &st) < 0) |
@@ -68,8 +79,16 @@ void selinux_relabel_path(const char *path, const char *inside_path) | |||
68 | if (arg_debug) | 79 | if (arg_debug) |
69 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); | 80 | printf("Relabeling %s as %s (%s)\n", path, inside_path, fcon); |
70 | 81 | ||
71 | setfilecon_raw(procfs_path, fcon); | 82 | if (!called_as_root) |
83 | EUID_ROOT(); | ||
84 | |||
85 | if (setfilecon_raw(procfs_path, fcon) != 0 && arg_debug) | ||
86 | printf("Cannot relabel %s: %s\n", path, strerror(errno)); | ||
87 | |||
88 | if (!called_as_root) | ||
89 | EUID_USER(); | ||
72 | } | 90 | } |
91 | |||
73 | freecon(fcon); | 92 | freecon(fcon); |
74 | close: | 93 | close: |
75 | close(fd); | 94 | close(fd); |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 094a68c60..86977cecf 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -20,8 +20,6 @@ | |||
20 | #define _XOPEN_SOURCE 500 | 20 | #define _XOPEN_SOURCE 500 |
21 | #include "firejail.h" | 21 | #include "firejail.h" |
22 | #include "../include/gcov_wrapper.h" | 22 | #include "../include/gcov_wrapper.h" |
23 | #include <ftw.h> | ||
24 | #include <sys/stat.h> | ||
25 | #include <sys/mount.h> | 23 | #include <sys/mount.h> |
26 | #include <syslog.h> | 24 | #include <syslog.h> |
27 | #include <errno.h> | 25 | #include <errno.h> |
@@ -32,9 +30,6 @@ | |||
32 | #include <sys/wait.h> | 30 | #include <sys/wait.h> |
33 | #include <limits.h> | 31 | #include <limits.h> |
34 | 32 | ||
35 | #include <string.h> | ||
36 | #include <ctype.h> | ||
37 | |||
38 | #include <fcntl.h> | 33 | #include <fcntl.h> |
39 | #ifndef O_PATH | 34 | #ifndef O_PATH |
40 | #define O_PATH 010000000 | 35 | #define O_PATH 010000000 |
@@ -459,31 +454,21 @@ int is_dir(const char *fname) { | |||
459 | if (*fname == '\0') | 454 | if (*fname == '\0') |
460 | return 0; | 455 | return 0; |
461 | 456 | ||
462 | int called_as_root = 0; | ||
463 | if (geteuid() == 0) | ||
464 | called_as_root = 1; | ||
465 | |||
466 | if (called_as_root) | ||
467 | EUID_USER(); | ||
468 | |||
469 | // if fname doesn't end in '/', add one | 457 | // if fname doesn't end in '/', add one |
470 | int rv; | 458 | int rv; |
471 | struct stat s; | 459 | struct stat s; |
472 | if (fname[strlen(fname) - 1] == '/') | 460 | if (fname[strlen(fname) - 1] == '/') |
473 | rv = stat(fname, &s); | 461 | rv = stat_as_user(fname, &s); |
474 | else { | 462 | else { |
475 | char *tmp; | 463 | char *tmp; |
476 | if (asprintf(&tmp, "%s/", fname) == -1) { | 464 | if (asprintf(&tmp, "%s/", fname) == -1) { |
477 | fprintf(stderr, "Error: cannot allocate memory, %s:%d\n", __FILE__, __LINE__); | 465 | fprintf(stderr, "Error: cannot allocate memory, %s:%d\n", __FILE__, __LINE__); |
478 | errExit("asprintf"); | 466 | errExit("asprintf"); |
479 | } | 467 | } |
480 | rv = stat(tmp, &s); | 468 | rv = stat_as_user(tmp, &s); |
481 | free(tmp); | 469 | free(tmp); |
482 | } | 470 | } |
483 | 471 | ||
484 | if (called_as_root) | ||
485 | EUID_ROOT(); | ||
486 | |||
487 | if (rv == -1) | 472 | if (rv == -1) |
488 | return 0; | 473 | return 0; |
489 | 474 | ||
@@ -499,13 +484,6 @@ int is_link(const char *fname) { | |||
499 | if (*fname == '\0') | 484 | if (*fname == '\0') |
500 | return 0; | 485 | return 0; |
501 | 486 | ||
502 | int called_as_root = 0; | ||
503 | if (geteuid() == 0) | ||
504 | called_as_root = 1; | ||
505 | |||
506 | if (called_as_root) | ||
507 | EUID_USER(); | ||
508 | |||
509 | // remove trailing '/' if any | 487 | // remove trailing '/' if any |
510 | char *tmp = strdup(fname); | 488 | char *tmp = strdup(fname); |
511 | if (!tmp) | 489 | if (!tmp) |
@@ -513,12 +491,9 @@ int is_link(const char *fname) { | |||
513 | trim_trailing_slash_or_dot(tmp); | 491 | trim_trailing_slash_or_dot(tmp); |
514 | 492 | ||
515 | char c; | 493 | char c; |
516 | ssize_t rv = readlink(tmp, &c, 1); | 494 | ssize_t rv = readlink_as_user(tmp, &c, 1); |
517 | free(tmp); | 495 | free(tmp); |
518 | 496 | ||
519 | if (called_as_root) | ||
520 | EUID_ROOT(); | ||
521 | |||
522 | return (rv != -1); | 497 | return (rv != -1); |
523 | } | 498 | } |
524 | 499 | ||
@@ -540,6 +515,24 @@ char *realpath_as_user(const char *fname) { | |||
540 | return rv; | 515 | return rv; |
541 | } | 516 | } |
542 | 517 | ||
518 | ssize_t readlink_as_user(const char *fname, char *buf, size_t sz) { | ||
519 | assert(fname && buf && sz); | ||
520 | |||
521 | int called_as_root = 0; | ||
522 | if (geteuid() == 0) | ||
523 | called_as_root = 1; | ||
524 | |||
525 | if (called_as_root) | ||
526 | EUID_USER(); | ||
527 | |||
528 | ssize_t rv = readlink(fname, buf, sz); | ||
529 | |||
530 | if (called_as_root) | ||
531 | EUID_ROOT(); | ||
532 | |||
533 | return rv; | ||
534 | } | ||
535 | |||
543 | int stat_as_user(const char *fname, struct stat *s) { | 536 | int stat_as_user(const char *fname, struct stat *s) { |
544 | assert(fname); | 537 | assert(fname); |
545 | 538 | ||
@@ -974,12 +967,9 @@ uid_t pid_get_uid(pid_t pid) { | |||
974 | } | 967 | } |
975 | 968 | ||
976 | 969 | ||
977 | 970 | gid_t get_group_id(const char *groupname) { | |
978 | |||
979 | uid_t get_group_id(const char *group) { | ||
980 | // find tty group id | ||
981 | gid_t gid = 0; | 971 | gid_t gid = 0; |
982 | struct group *g = getgrnam(group); | 972 | struct group *g = getgrnam(groupname); |
983 | if (g) | 973 | if (g) |
984 | gid = g->gr_gid; | 974 | gid = g->gr_gid; |
985 | 975 | ||
@@ -987,86 +977,6 @@ uid_t get_group_id(const char *group) { | |||
987 | } | 977 | } |
988 | 978 | ||
989 | 979 | ||
990 | static int remove_callback(const char *fpath, const struct stat *sb, int typeflag, struct FTW *ftwbuf) { | ||
991 | (void) sb; | ||
992 | (void) typeflag; | ||
993 | (void) ftwbuf; | ||
994 | assert(fpath); | ||
995 | |||
996 | if (strcmp(fpath, ".") == 0) | ||
997 | return 0; | ||
998 | |||
999 | if (remove(fpath)) { // removes the link not the actual file | ||
1000 | perror("remove"); | ||
1001 | fprintf(stderr, "Error: cannot remove file from user .firejail directory: %s\n", fpath); | ||
1002 | exit(1); | ||
1003 | } | ||
1004 | |||
1005 | return 0; | ||
1006 | } | ||
1007 | |||
1008 | |||
1009 | int remove_overlay_directory(void) { | ||
1010 | EUID_ASSERT(); | ||
1011 | sleep(1); | ||
1012 | |||
1013 | char *path; | ||
1014 | if (asprintf(&path, "%s/.firejail", cfg.homedir) == -1) | ||
1015 | errExit("asprintf"); | ||
1016 | |||
1017 | if (access(path, F_OK) == 0) { | ||
1018 | pid_t child = fork(); | ||
1019 | if (child < 0) | ||
1020 | errExit("fork"); | ||
1021 | if (child == 0) { | ||
1022 | // open ~/.firejail | ||
1023 | int fd = safer_openat(-1, path, O_PATH|O_NOFOLLOW|O_CLOEXEC); | ||
1024 | if (fd == -1) { | ||
1025 | fprintf(stderr, "Error: cannot open %s\n", path); | ||
1026 | exit(1); | ||
1027 | } | ||
1028 | struct stat s; | ||
1029 | if (fstat(fd, &s) == -1) | ||
1030 | errExit("fstat"); | ||
1031 | if (!S_ISDIR(s.st_mode)) { | ||
1032 | if (S_ISLNK(s.st_mode)) | ||
1033 | fprintf(stderr, "Error: %s is a symbolic link\n", path); | ||
1034 | else | ||
1035 | fprintf(stderr, "Error: %s is not a directory\n", path); | ||
1036 | exit(1); | ||
1037 | } | ||
1038 | if (s.st_uid != getuid()) { | ||
1039 | fprintf(stderr, "Error: %s is not owned by the current user\n", path); | ||
1040 | exit(1); | ||
1041 | } | ||
1042 | // chdir to ~/.firejail | ||
1043 | if (fchdir(fd) == -1) | ||
1044 | errExit("fchdir"); | ||
1045 | close(fd); | ||
1046 | |||
1047 | EUID_ROOT(); | ||
1048 | // FTW_PHYS - do not follow symbolic links | ||
1049 | if (nftw(".", remove_callback, 64, FTW_DEPTH | FTW_PHYS) == -1) | ||
1050 | errExit("nftw"); | ||
1051 | |||
1052 | EUID_USER(); | ||
1053 | // remove ~/.firejail | ||
1054 | if (rmdir(path) == -1) | ||
1055 | errExit("rmdir"); | ||
1056 | |||
1057 | __gcov_flush(); | ||
1058 | |||
1059 | _exit(0); | ||
1060 | } | ||
1061 | // wait for the child to finish | ||
1062 | waitpid(child, NULL, 0); | ||
1063 | // check if ~/.firejail was deleted | ||
1064 | if (access(path, F_OK) == 0) | ||
1065 | return 1; | ||
1066 | } | ||
1067 | return 0; | ||
1068 | } | ||
1069 | |||
1070 | // flush stdin if it is connected to a tty and has input | 980 | // flush stdin if it is connected to a tty and has input |
1071 | void flush_stdin(void) { | 981 | void flush_stdin(void) { |
1072 | if (!isatty(STDIN_FILENO)) | 982 | if (!isatty(STDIN_FILENO)) |
@@ -1095,31 +1005,33 @@ int create_empty_dir_as_user(const char *dir, mode_t mode) { | |||
1095 | assert(dir); | 1005 | assert(dir); |
1096 | mode &= 07777; | 1006 | mode &= 07777; |
1097 | 1007 | ||
1098 | if (access(dir, F_OK) != 0) { | 1008 | if (access(dir, F_OK) == 0) |
1009 | return 0; | ||
1010 | |||
1011 | pid_t child = fork(); | ||
1012 | if (child < 0) | ||
1013 | errExit("fork"); | ||
1014 | if (child == 0) { | ||
1015 | // drop privileges | ||
1016 | drop_privs(0); | ||
1017 | |||
1099 | if (arg_debug) | 1018 | if (arg_debug) |
1100 | printf("Creating empty %s directory\n", dir); | 1019 | printf("Creating empty %s directory\n", dir); |
1101 | pid_t child = fork(); | 1020 | if (mkdir(dir, mode) == 0) { |
1102 | if (child < 0) | 1021 | int err = chmod(dir, mode); |
1103 | errExit("fork"); | 1022 | (void) err; |
1104 | if (child == 0) { | 1023 | } |
1105 | // drop privileges | 1024 | else if (arg_debug) |
1106 | drop_privs(0); | 1025 | printf("Directory %s not created: %s\n", dir, strerror(errno)); |
1107 | |||
1108 | if (mkdir(dir, mode) == 0) { | ||
1109 | int err = chmod(dir, mode); | ||
1110 | (void) err; | ||
1111 | } | ||
1112 | else if (arg_debug) | ||
1113 | printf("Directory %s not created: %s\n", dir, strerror(errno)); | ||
1114 | 1026 | ||
1115 | __gcov_flush(); | 1027 | __gcov_flush(); |
1116 | 1028 | ||
1117 | _exit(0); | 1029 | _exit(0); |
1118 | } | ||
1119 | waitpid(child, NULL, 0); | ||
1120 | if (access(dir, F_OK) == 0) | ||
1121 | return 1; | ||
1122 | } | 1030 | } |
1031 | waitpid(child, NULL, 0); | ||
1032 | |||
1033 | if (access(dir, F_OK) == 0) | ||
1034 | return 1; | ||
1123 | return 0; | 1035 | return 0; |
1124 | } | 1036 | } |
1125 | 1037 | ||
@@ -1509,7 +1421,7 @@ static int has_link(const char *dir) { | |||
1509 | void check_homedir(const char *dir) { | 1421 | void check_homedir(const char *dir) { |
1510 | assert(dir); | 1422 | assert(dir); |
1511 | if (dir[0] != '/') { | 1423 | if (dir[0] != '/') { |
1512 | fprintf(stderr, "Error: invalid user directory \"%s\"\n", cfg.homedir); | 1424 | fprintf(stderr, "Error: invalid user directory \"%s\"\n", dir); |
1513 | exit(1); | 1425 | exit(1); |
1514 | } | 1426 | } |
1515 | // symlinks are rejected in many places | 1427 | // symlinks are rejected in many places |
diff --git a/src/jailcheck/jailcheck.h b/src/jailcheck/jailcheck.h index be3104da3..3f8c89bfb 100644 --- a/src/jailcheck/jailcheck.h +++ b/src/jailcheck/jailcheck.h | |||
@@ -61,4 +61,4 @@ char *get_homedir(const char *user, uid_t *uid, gid_t *gid); | |||
61 | int find_child(pid_t pid); | 61 | int find_child(pid_t pid); |
62 | pid_t switch_to_child(pid_t pid); | 62 | pid_t switch_to_child(pid_t pid); |
63 | 63 | ||
64 | #endif \ No newline at end of file | 64 | #endif |
diff --git a/src/jailcheck/noexec.c b/src/jailcheck/noexec.c index 7f994d6a1..be18ac109 100644 --- a/src/jailcheck/noexec.c +++ b/src/jailcheck/noexec.c | |||
@@ -110,4 +110,4 @@ void noexec_test(const char *path) { | |||
110 | wait(&status); | 110 | wait(&status); |
111 | int rv = unlink(fname); | 111 | int rv = unlink(fname); |
112 | (void) rv; | 112 | (void) rv; |
113 | } \ No newline at end of file | 113 | } |
diff --git a/src/libtrace/libtrace.c b/src/libtrace/libtrace.c index d88512b0a..319902ff7 100644 --- a/src/libtrace/libtrace.c +++ b/src/libtrace/libtrace.c | |||
@@ -18,12 +18,12 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #define _GNU_SOURCE | 20 | #define _GNU_SOURCE |
21 | #include <errno.h> | ||
21 | #include <stdio.h> | 22 | #include <stdio.h> |
22 | #include <stdlib.h> | 23 | #include <stdlib.h> |
23 | #include <string.h> | 24 | #include <string.h> |
24 | #include <dlfcn.h> | 25 | #include <dlfcn.h> |
25 | #include <sys/types.h> | 26 | #include <sys/types.h> |
26 | #include <limits.h> | ||
27 | #include <unistd.h> | 27 | #include <unistd.h> |
28 | #include <sys/socket.h> | 28 | #include <sys/socket.h> |
29 | #include <netinet/in.h> | 29 | #include <netinet/in.h> |
@@ -706,10 +706,14 @@ __attribute__((constructor)) | |||
706 | static void log_exec(int argc, char** argv) { | 706 | static void log_exec(int argc, char** argv) { |
707 | (void) argc; | 707 | (void) argc; |
708 | (void) argv; | 708 | (void) argv; |
709 | static char buf[PATH_MAX + 1]; | 709 | char *buf = realpath("/proc/self/exe", NULL); |
710 | int rv = readlink("/proc/self/exe", buf, PATH_MAX); | 710 | if (buf == NULL) { |
711 | if (rv != -1) { | 711 | if (errno == ENOMEM) { |
712 | buf[rv] = '\0'; // readlink does not add a '\0' at the end | 712 | tprintf(ftty, "realpath: %s\n", strerror(errno)); |
713 | exit(1); | ||
714 | } | ||
715 | } else { | ||
713 | tprintf(ftty, "%u:%s:exec %s:0\n", mypid, myname, buf); | 716 | tprintf(ftty, "%u:%s:exec %s:0\n", mypid, myname, buf); |
717 | free(buf); | ||
714 | } | 718 | } |
715 | } | 719 | } |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index d0d3c25e8..a1eccaa5e 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -78,7 +78,7 @@ in your desktop environment copy the profile file in ~/.config/firejail director | |||
78 | Several command line options can be passed to the program using | 78 | Several command line options can be passed to the program using |
79 | profile files. Firejail chooses the profile file as follows: | 79 | profile files. Firejail chooses the profile file as follows: |
80 | 80 | ||
81 | \fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. | 81 | \fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. |
82 | Example: | 82 | Example: |
83 | .PP | 83 | .PP |
84 | .RS | 84 | .RS |
@@ -174,7 +174,7 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir" | |||
174 | 174 | ||
175 | This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line. | 175 | This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line. |
176 | 176 | ||
177 | Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS, HAS_NOSOUND, HAS_PRIVATE and HAS_X11. The conditionals BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM | 177 | Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS, HAS_NOSOUND, HAS_PRIVATE and HAS_X11. The conditionals ALLOW_TRAY, BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM |
178 | can be enabled or disabled globally in Firejail's configuration file. | 178 | can be enabled or disabled globally in Firejail's configuration file. |
179 | 179 | ||
180 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. | 180 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. |
@@ -324,16 +324,16 @@ Remount the file or the directory noexec, nodev and nosuid. | |||
324 | #ifdef HAVE_OVERLAYFS | 324 | #ifdef HAVE_OVERLAYFS |
325 | .TP | 325 | .TP |
326 | \fBoverlay | 326 | \fBoverlay |
327 | Mount a filesystem overlay on top of the current filesystem. | 327 | Mount a filesystem overlay on top of the current filesystem. |
328 | The overlay is stored in $HOME/.firejail/<PID> directory. | 328 | The overlay is stored in $HOME/.firejail/<PID> directory. |
329 | .TP | 329 | .TP |
330 | \fBoverlay-named name | 330 | \fBoverlay-named name |
331 | Mount a filesystem overlay on top of the current filesystem. | 331 | Mount a filesystem overlay on top of the current filesystem. |
332 | The overlay is stored in $HOME/.firejail/name directory. | 332 | The overlay is stored in $HOME/.firejail/name directory. |
333 | .TP | 333 | .TP |
334 | \fBoverlay-tmpfs | 334 | \fBoverlay-tmpfs |
335 | Mount a filesystem overlay on top of the current filesystem. | 335 | Mount a filesystem overlay on top of the current filesystem. |
336 | All filesystem modifications are discarded when the sandbox is closed. | 336 | All filesystem modifications are discarded when the sandbox is closed. |
337 | #endif | 337 | #endif |
338 | .TP | 338 | .TP |
339 | \fBprivate | 339 | \fBprivate |
@@ -487,12 +487,12 @@ does not result in an increase of privilege. | |||
487 | #ifdef HAVE_USERNS | 487 | #ifdef HAVE_USERNS |
488 | .TP | 488 | .TP |
489 | \fBnoroot | 489 | \fBnoroot |
490 | Use this command to enable an user namespace. The namespace has only one user, the current user. | 490 | Use this command to enable an user namespace. The namespace has only one user, the current user. |
491 | There is no root account (uid 0) defined in the namespace. | 491 | There is no root account (uid 0) defined in the namespace. |
492 | #endif | 492 | #endif |
493 | .TP | 493 | .TP |
494 | \fBprotocol protocol1,protocol2,protocol3 | 494 | \fBprotocol protocol1,protocol2,protocol3 |
495 | Enable protocol filter. The filter is based on seccomp and checks the | 495 | Enable protocol filter. The filter is based on seccomp and checks the |
496 | first argument to socket system call. Recognized values: \fBunix\fR, | 496 | first argument to socket system call. Recognized values: \fBunix\fR, |
497 | \fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR. | 497 | \fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR. |
498 | .TP | 498 | .TP |
@@ -606,7 +606,7 @@ Allow the application to see but not talk to the name org.freedesktop.Notificati | |||
606 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | 606 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. |
607 | .TP | 607 | .TP |
608 | \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | 608 | \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications |
609 | Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | 609 | Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. |
610 | .TP | 610 | .TP |
611 | \fBdbus-user filter | 611 | \fBdbus-user filter |
612 | Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. | 612 | Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. |
@@ -873,8 +873,8 @@ a DHCP client and releasing the lease manually. | |||
873 | 873 | ||
874 | .TP | 874 | .TP |
875 | \fBiprange address,address | 875 | \fBiprange address,address |
876 | Assign an IP address in the provided range to the last network | 876 | Assign an IP address in the provided range to the last network |
877 | interface defined by a net command. A default gateway is assigned by default. | 877 | interface defined by a net command. A default gateway is assigned by default. |
878 | .br | 878 | .br |
879 | 879 | ||
880 | .br | 880 | .br |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 0462705c0..e724e4bb9 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -45,7 +45,7 @@ firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-deb | |||
45 | #ifdef HAVE_LTS | 45 | #ifdef HAVE_LTS |
46 | This is Firejail long-term support (LTS), an enterprise focused version of the software, | 46 | This is Firejail long-term support (LTS), an enterprise focused version of the software, |
47 | LTS is usually supported for two or three years. | 47 | LTS is usually supported for two or three years. |
48 | During this time only bugs and the occasional documentation problems are fixed. | 48 | During this time only bugs and the occasional documentation problems are fixed. |
49 | The attack surface of the SUID executable was greatly reduced by removing some of the features. | 49 | The attack surface of the SUID executable was greatly reduced by removing some of the features. |
50 | .br | 50 | .br |
51 | 51 | ||
@@ -109,7 +109,7 @@ ptrace system call allows a full bypass of the seccomp filter. | |||
109 | .br | 109 | .br |
110 | Example: | 110 | Example: |
111 | .br | 111 | .br |
112 | $ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox | 112 | $ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox |
113 | .TP | 113 | .TP |
114 | \fB\-\-allusers | 114 | \fB\-\-allusers |
115 | All directories under /home are visible inside the sandbox. By default, only current user home directory is visible. | 115 | All directories under /home are visible inside the sandbox. By default, only current user home directory is visible. |
@@ -290,8 +290,8 @@ $ firejail \-\-caps.print=3272 | |||
290 | Print content of file from sandbox container, see FILE TRANSFER section for more details. | 290 | Print content of file from sandbox container, see FILE TRANSFER section for more details. |
291 | #endif | 291 | #endif |
292 | .TP | 292 | .TP |
293 | \fB\-\-cgroup=tasks-file | 293 | \fB\-\-cgroup=file |
294 | Place the sandbox in the specified control group. tasks-file is the full path of cgroup tasks file. | 294 | Place the sandbox in the specified control group. file is the full path of a tasks or cgroup.procs file. |
295 | .br | 295 | .br |
296 | 296 | ||
297 | .br | 297 | .br |
@@ -310,6 +310,11 @@ regular user, nonewprivs and a default capabilities filter are enabled. | |||
310 | Example: | 310 | Example: |
311 | .br | 311 | .br |
312 | $ firejail \-\-chroot=/media/ubuntu warzone2100 | 312 | $ firejail \-\-chroot=/media/ubuntu warzone2100 |
313 | .br | ||
314 | |||
315 | .br | ||
316 | For automatic mounting of X11 and PulseAudio sockets set environment variables | ||
317 | FIREJAIL_CHROOT_X11 and FIREJAIL_CHROOT_PULSE. | ||
313 | #endif | 318 | #endif |
314 | .TP | 319 | .TP |
315 | \fB\-\-cpu=cpu-number,cpu-number,cpu-number | 320 | \fB\-\-cpu=cpu-number,cpu-number,cpu-number |
@@ -947,7 +952,7 @@ $ firejail \-\-net=eth0 \-\-\iprange=192.168.1.100,192.168.1.150 | |||
947 | 952 | ||
948 | .TP | 953 | .TP |
949 | \fB\-\-ipc-namespace | 954 | \fB\-\-ipc-namespace |
950 | Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default | 955 | Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default |
951 | for sandboxes started as root. | 956 | for sandboxes started as root. |
952 | .br | 957 | .br |
953 | 958 | ||
@@ -1014,7 +1019,7 @@ $ sudo firejail --join-network=browser /sbin/iptables -vL | |||
1014 | .br | 1019 | .br |
1015 | 1020 | ||
1016 | .br | 1021 | .br |
1017 | # verify IP addresses | 1022 | # verify IP addresses |
1018 | .br | 1023 | .br |
1019 | $ sudo firejail --join-network=browser ip addr | 1024 | $ sudo firejail --join-network=browser ip addr |
1020 | .br | 1025 | .br |
@@ -2134,7 +2139,7 @@ Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024). | |||
2134 | .TP | 2139 | .TP |
2135 | \fB\-\-rlimit-cpu=number | 2140 | \fB\-\-rlimit-cpu=number |
2136 | Set the maximum limit, in seconds, for the amount of CPU time each | 2141 | Set the maximum limit, in seconds, for the amount of CPU time each |
2137 | sandboxed process can consume. When the limit is reached, the processes are killed. | 2142 | sandboxed process can consume. When the limit is reached, the processes are killed. |
2138 | 2143 | ||
2139 | The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds | 2144 | The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds |
2140 | the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps | 2145 | the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps |
@@ -2178,7 +2183,7 @@ $ firejail \-\-net=eth0 \-\-scan | |||
2178 | .TP | 2183 | .TP |
2179 | \fB\-\-seccomp | 2184 | \fB\-\-seccomp |
2180 | Enable seccomp filter and blacklist the syscalls in the default list, | 2185 | Enable seccomp filter and blacklist the syscalls in the default list, |
2181 | which is @default-nodebuggers unless \-\-allow-debuggers is specified, | 2186 | which is @default-nodebuggers unless \-\-allow-debuggers is specified, |
2182 | then it is @default. | 2187 | then it is @default. |
2183 | 2188 | ||
2184 | .br | 2189 | .br |
@@ -2192,6 +2197,11 @@ More information about groups can be found in /usr/share/doc/firejail/syscalls.t | |||
2192 | .br | 2197 | .br |
2193 | 2198 | ||
2194 | .br | 2199 | .br |
2200 | The default list can be customized, see \-\-seccomp= for a description. | ||
2201 | It can be customized also globally in /etc/firejail/firejail.config file. | ||
2202 | .br | ||
2203 | |||
2204 | .br | ||
2195 | System architecture is strictly imposed only if flag | 2205 | System architecture is strictly imposed only if flag |
2196 | \-\-seccomp.block-secondary is used. The filter is applied at run time | 2206 | \-\-seccomp.block-secondary is used. The filter is applied at run time |
2197 | only if the correct architecture was detected. For the case of I386 | 2207 | only if the correct architecture was detected. For the case of I386 |
@@ -2206,11 +2216,7 @@ Firejail will print seccomp violations to the audit log if the kernel was compil | |||
2206 | Example: | 2216 | Example: |
2207 | .br | 2217 | .br |
2208 | $ firejail \-\-seccomp | 2218 | $ firejail \-\-seccomp |
2209 | .br | ||
2210 | 2219 | ||
2211 | .br | ||
2212 | The default list can be customized, see \-\-seccomp= for a description. It can be customized | ||
2213 | also globally in /etc/firejail/firejail.config file. | ||
2214 | 2220 | ||
2215 | .TP | 2221 | .TP |
2216 | \fB\-\-seccomp=syscall,@group,!syscall2 | 2222 | \fB\-\-seccomp=syscall,@group,!syscall2 |
@@ -2865,7 +2871,7 @@ and it is installed by default on most Linux distributions. It provides support | |||
2865 | connection model. Untrusted clients are restricted in certain ways to prevent them from reading window | 2871 | connection model. Untrusted clients are restricted in certain ways to prevent them from reading window |
2866 | contents of other clients, stealing input events, etc. | 2872 | contents of other clients, stealing input events, etc. |
2867 | 2873 | ||
2868 | The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients | 2874 | The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients |
2869 | and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples. | 2875 | and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples. |
2870 | Firefox and transmission-gtk seem to be working fine. | 2876 | Firefox and transmission-gtk seem to be working fine. |
2871 | A network namespace is not required for this option. | 2877 | A network namespace is not required for this option. |
@@ -3256,7 +3262,7 @@ The owner of the sandbox. | |||
3256 | .SH RESTRICTED SHELL | 3262 | .SH RESTRICTED SHELL |
3257 | To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in | 3263 | To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in |
3258 | /etc/passwd file for each user that needs to be restricted. Alternatively, | 3264 | /etc/passwd file for each user that needs to be restricted. Alternatively, |
3259 | you can specify /usr/bin/firejail in adduser command: | 3265 | you can specify /usr/bin/firejail in adduser command: |
3260 | 3266 | ||
3261 | adduser \-\-shell /usr/bin/firejail username | 3267 | adduser \-\-shell /usr/bin/firejail username |
3262 | 3268 | ||
@@ -3266,7 +3272,7 @@ Additional arguments passed to firejail executable upon login are declared in /e | |||
3266 | Several command line options can be passed to the program using | 3272 | Several command line options can be passed to the program using |
3267 | profile files. Firejail chooses the profile file as follows: | 3273 | profile files. Firejail chooses the profile file as follows: |
3268 | 3274 | ||
3269 | 1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME. | 3275 | 1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME. |
3270 | Example: | 3276 | Example: |
3271 | .PP | 3277 | .PP |
3272 | .RS | 3278 | .RS |
diff --git a/src/man/firemon.txt b/src/man/firemon.txt index 76b2f7be2..c4e6e15b3 100644 --- a/src/man/firemon.txt +++ b/src/man/firemon.txt | |||
@@ -56,7 +56,7 @@ Print route table for each sandbox. | |||
56 | Print seccomp configuration for each sandbox. | 56 | Print seccomp configuration for each sandbox. |
57 | .TP | 57 | .TP |
58 | \fB\-\-top | 58 | \fB\-\-top |
59 | Monitor the most CPU-intensive sandboxes. This command is similar to | 59 | Monitor the most CPU-intensive sandboxes. This command is similar to |
60 | the regular UNIX top command, however it applies only to sandboxes. | 60 | the regular UNIX top command, however it applies only to sandboxes. |
61 | .TP | 61 | .TP |
62 | \fB\-\-tree | 62 | \fB\-\-tree |
diff --git a/src/tools/profcleaner.c b/src/tools/profcleaner.c index 93bb3f73d..beff93199 100644 --- a/src/tools/profcleaner.c +++ b/src/tools/profcleaner.c | |||
@@ -72,4 +72,4 @@ int main(int argc, char **argv) { | |||
72 | } | 72 | } |
73 | 73 | ||
74 | return 0; | 74 | return 0; |
75 | } \ No newline at end of file | 75 | } |
diff --git a/test/environment/environment.sh b/test/environment/environment.sh index 152975c9d..1e1dd549b 100755 --- a/test/environment/environment.sh +++ b/test/environment/environment.sh | |||
@@ -112,14 +112,17 @@ echo "TESTING: rlimit (test/environment/rlimit.exp)" | |||
112 | echo "TESTING: rlimit profile (test/environment/rlimit-profile.exp)" | 112 | echo "TESTING: rlimit profile (test/environment/rlimit-profile.exp)" |
113 | ./rlimit-profile.exp | 113 | ./rlimit-profile.exp |
114 | 114 | ||
115 | echo "TESTING: rlimit join (test/environment/rlimit-join.exp)" | ||
116 | ./rlimit-join.exp | ||
117 | |||
115 | echo "TESTING: rlimit errors (test/environment/rlimit-bad.exp)" | 118 | echo "TESTING: rlimit errors (test/environment/rlimit-bad.exp)" |
116 | ./rlimit-bad.exp | 119 | ./rlimit-bad.exp |
117 | 120 | ||
118 | echo "TESTING: rlimit errors profile (test/environment/rlimit-bad-profile.exp)" | 121 | echo "TESTING: rlimit errors profile (test/environment/rlimit-bad-profile.exp)" |
119 | ./rlimit-bad-profile.exp | 122 | ./rlimit-bad-profile.exp |
120 | 123 | ||
121 | echo "TESTING: deterministic exit code (test/environment/deterministic-exit-code.exp" | 124 | echo "TESTING: deterministic exit code (test/environment/deterministic-exit-code.exp)" |
122 | ./deterministic-exit-code.exp | 125 | ./deterministic-exit-code.exp |
123 | 126 | ||
124 | echo "TESTING: retain umask (test/environment/umask.exp" | 127 | echo "TESTING: retain umask (test/environment/umask.exp)" |
125 | (umask 123 && ./umask.exp) | 128 | (umask 123 && ./umask.exp) |
diff --git a/test/environment/rlimit-join.exp b/test/environment/rlimit-join.exp new file mode 100755 index 000000000..aa8a203c0 --- /dev/null +++ b/test/environment/rlimit-join.exp | |||
@@ -0,0 +1,36 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2021 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | cd /home | ||
8 | spawn $env(SHELL) | ||
9 | match_max 100000 | ||
10 | |||
11 | send -- "firejail --noprofile --name=\"rlimit testing\"\r" | ||
12 | expect { | ||
13 | timeout {puts "TESTING ERROR 0\n";exit} | ||
14 | "Child process initialized" | ||
15 | } | ||
16 | sleep 1 | ||
17 | |||
18 | spawn $env(SHELL) | ||
19 | send -- "firejail --rlimit-nofile=1234 --join=\"rlimit testing\"\r" | ||
20 | expect { | ||
21 | timeout {puts "TESTING ERROR 1\n";exit} | ||
22 | "Switching to pid" | ||
23 | } | ||
24 | sleep 1 | ||
25 | |||
26 | send -- "cat /proc/self/limits\r" | ||
27 | expect { | ||
28 | timeout {puts "TESTING ERROR 2\n";exit} | ||
29 | "Max open files 1234 1234" | ||
30 | } | ||
31 | after 100 | ||
32 | |||
33 | send -- "exit\r" | ||
34 | after 100 | ||
35 | |||
36 | puts "\nall done\n" | ||
diff --git a/test/utils/build.exp b/test/utils/build.exp index 104ac037c..b9733c137 100755 --- a/test/utils/build.exp +++ b/test/utils/build.exp | |||
@@ -13,7 +13,7 @@ after 100 | |||
13 | send -- "firejail --build cat ~/_firejail-test-file\r" | 13 | send -- "firejail --build cat ~/_firejail-test-file\r" |
14 | expect { | 14 | expect { |
15 | timeout {puts "TESTING ERROR 0\n";exit} | 15 | timeout {puts "TESTING ERROR 0\n";exit} |
16 | "allow $\{HOME\}/_firejail-test-file" | 16 | "whitelist $\{HOME\}/_firejail-test-file" |
17 | } | 17 | } |
18 | expect { | 18 | expect { |
19 | timeout {puts "TESTING ERROR 1\n";exit} | 19 | timeout {puts "TESTING ERROR 1\n";exit} |