diff options
43 files changed, 379 insertions, 427 deletions
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml index a319e1ac6..e9ec436a4 100644 --- a/.github/workflows/build-extra.yml +++ b/.github/workflows/build-extra.yml | |||
@@ -4,33 +4,43 @@ on: | |||
4 | push: | 4 | push: |
5 | branches: [ master ] | 5 | branches: [ master ] |
6 | paths-ignore: | 6 | paths-ignore: |
7 | - '.github/ISSUE_TEMPLATE/*' | ||
8 | - 'etc/**' | ||
9 | - 'contrib/vim/**' | ||
10 | - 'src/man/*.txt' | ||
7 | - .git-blame-ignore-revs | 11 | - .git-blame-ignore-revs |
12 | - .github/dependabot.yml | ||
13 | - .github/pull_request_template.md | ||
14 | - .github/workflows/codeql-analysis.yml | ||
8 | - .gitignore | 15 | - .gitignore |
16 | - .gitlab-ci.yml | ||
9 | - CONTRIBUTING.md | 17 | - CONTRIBUTING.md |
10 | - COPYING | 18 | - COPYING |
11 | - README | 19 | - README |
12 | - README.md | 20 | - README.md |
13 | - RELNOTES | 21 | - RELNOTES |
14 | - SECURITY.md | 22 | - SECURITY.md |
15 | - 'etc/**' | 23 | - src/firecfg/firecfg.config |
16 | - 'src/firecfg/firecfg.config' | ||
17 | - '.github/ISSUE_TEMPLATE/*' | ||
18 | - '.github/pull_request_template.md' | ||
19 | pull_request: | 24 | pull_request: |
20 | branches: [ master ] | 25 | branches: [ master ] |
21 | paths-ignore: | 26 | paths-ignore: |
27 | - '.github/ISSUE_TEMPLATE/*' | ||
28 | - 'etc/**' | ||
29 | - 'contrib/vim/**' | ||
30 | - 'src/man/*.txt' | ||
22 | - .git-blame-ignore-revs | 31 | - .git-blame-ignore-revs |
32 | - .github/dependabot.yml | ||
33 | - .github/pull_request_template.md | ||
34 | - .github/workflows/codeql-analysis.yml | ||
23 | - .gitignore | 35 | - .gitignore |
36 | - .gitlab-ci.yml | ||
24 | - CONTRIBUTING.md | 37 | - CONTRIBUTING.md |
25 | - COPYING | 38 | - COPYING |
26 | - README | 39 | - README |
27 | - README.md | 40 | - README.md |
28 | - RELNOTES | 41 | - RELNOTES |
29 | - SECURITY.md | 42 | - SECURITY.md |
30 | - 'etc/**' | 43 | - src/firecfg/firecfg.config |
31 | - 'src/firecfg/firecfg.config' | ||
32 | - '.github/ISSUE_TEMPLATE/*' | ||
33 | - '.github/pull_request_template.md' | ||
34 | 44 | ||
35 | permissions: # added using https://github.com/step-security/secure-workflows | 45 | permissions: # added using https://github.com/step-security/secure-workflows |
36 | contents: read | 46 | contents: read |
@@ -40,7 +50,7 @@ jobs: | |||
40 | runs-on: ubuntu-22.04 | 50 | runs-on: ubuntu-22.04 |
41 | steps: | 51 | steps: |
42 | - name: Harden Runner | 52 | - name: Harden Runner |
43 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | 53 | uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 |
44 | with: | 54 | with: |
45 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | 55 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs |
46 | 56 | ||
@@ -59,7 +69,7 @@ jobs: | |||
59 | runs-on: ubuntu-22.04 | 69 | runs-on: ubuntu-22.04 |
60 | steps: | 70 | steps: |
61 | - name: Harden Runner | 71 | - name: Harden Runner |
62 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | 72 | uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 |
63 | with: | 73 | with: |
64 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | 74 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs |
65 | 75 | ||
@@ -74,7 +84,7 @@ jobs: | |||
74 | runs-on: ubuntu-22.04 | 84 | runs-on: ubuntu-22.04 |
75 | steps: | 85 | steps: |
76 | - name: Harden Runner | 86 | - name: Harden Runner |
77 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | 87 | uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 |
78 | with: | 88 | with: |
79 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | 89 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs |
80 | 90 | ||
@@ -89,7 +99,7 @@ jobs: | |||
89 | runs-on: ubuntu-20.04 | 99 | runs-on: ubuntu-20.04 |
90 | steps: | 100 | steps: |
91 | - name: Harden Runner | 101 | - name: Harden Runner |
92 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | 102 | uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 |
93 | with: | 103 | with: |
94 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | 104 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs |
95 | 105 | ||
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e383c9ef2..3119f59b9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml | |||
@@ -4,8 +4,13 @@ on: | |||
4 | push: | 4 | push: |
5 | branches: [ master ] | 5 | branches: [ master ] |
6 | paths-ignore: | 6 | paths-ignore: |
7 | - '.github/ISSUE_TEMPLATE/*' | ||
7 | - .git-blame-ignore-revs | 8 | - .git-blame-ignore-revs |
9 | - .github/dependabot.yml | ||
10 | - .github/pull_request_template.md | ||
11 | - .github/workflows/codeql-analysis.yml | ||
8 | - .gitignore | 12 | - .gitignore |
13 | - .gitlab-ci.yml | ||
9 | - CONTRIBUTING.md | 14 | - CONTRIBUTING.md |
10 | - COPYING | 15 | - COPYING |
11 | - README | 16 | - README |
@@ -15,8 +20,13 @@ on: | |||
15 | pull_request: | 20 | pull_request: |
16 | branches: [ master ] | 21 | branches: [ master ] |
17 | paths-ignore: | 22 | paths-ignore: |
23 | - '.github/ISSUE_TEMPLATE/*' | ||
18 | - .git-blame-ignore-revs | 24 | - .git-blame-ignore-revs |
25 | - .github/dependabot.yml | ||
26 | - .github/pull_request_template.md | ||
27 | - .github/workflows/codeql-analysis.yml | ||
19 | - .gitignore | 28 | - .gitignore |
29 | - .gitlab-ci.yml | ||
20 | - CONTRIBUTING.md | 30 | - CONTRIBUTING.md |
21 | - COPYING | 31 | - COPYING |
22 | - README | 32 | - README |
@@ -32,7 +42,7 @@ jobs: | |||
32 | runs-on: ubuntu-22.04 | 42 | runs-on: ubuntu-22.04 |
33 | steps: | 43 | steps: |
34 | - name: Harden Runner | 44 | - name: Harden Runner |
35 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | 45 | uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 |
36 | with: | 46 | with: |
37 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | 47 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs |
38 | 48 | ||
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 6c8a9bf99..ad19c9530 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml | |||
@@ -9,28 +9,42 @@ on: | |||
9 | push: | 9 | push: |
10 | branches: [ master ] | 10 | branches: [ master ] |
11 | paths-ignore: | 11 | paths-ignore: |
12 | - '.github/ISSUE_TEMPLATE/*' | ||
13 | - 'etc/**' | ||
14 | - 'contrib/vim/**' | ||
15 | - 'src/man/*.txt' | ||
12 | - .git-blame-ignore-revs | 16 | - .git-blame-ignore-revs |
17 | - .github/dependabot.yml | ||
18 | - .github/pull_request_template.md | ||
13 | - .gitignore | 19 | - .gitignore |
20 | - .gitlab-ci.yml | ||
14 | - CONTRIBUTING.md | 21 | - CONTRIBUTING.md |
15 | - COPYING | 22 | - COPYING |
16 | - README | 23 | - README |
17 | - README.md | 24 | - README.md |
18 | - RELNOTES | 25 | - RELNOTES |
19 | - SECURITY.md | 26 | - SECURITY.md |
20 | - 'etc/**' | 27 | - src/firecfg/firecfg.config |
21 | pull_request: | 28 | pull_request: |
22 | # The branches below must be a subset of the branches above | 29 | # The branches below must be a subset of the branches above |
23 | branches: [ master ] | 30 | branches: [ master ] |
24 | paths-ignore: | 31 | paths-ignore: |
32 | - '.github/ISSUE_TEMPLATE/*' | ||
33 | - 'etc/**' | ||
34 | - 'contrib/vim/**' | ||
35 | - 'src/man/*.txt' | ||
25 | - .git-blame-ignore-revs | 36 | - .git-blame-ignore-revs |
37 | - .github/dependabot.yml | ||
38 | - .github/pull_request_template.md | ||
26 | - .gitignore | 39 | - .gitignore |
40 | - .gitlab-ci.yml | ||
27 | - CONTRIBUTING.md | 41 | - CONTRIBUTING.md |
28 | - COPYING | 42 | - COPYING |
29 | - README | 43 | - README |
30 | - README.md | 44 | - README.md |
31 | - RELNOTES | 45 | - RELNOTES |
32 | - SECURITY.md | 46 | - SECURITY.md |
33 | - 'etc/**' | 47 | - src/firecfg/firecfg.config |
34 | schedule: | 48 | schedule: |
35 | - cron: '0 7 * * 2' | 49 | - cron: '0 7 * * 2' |
36 | 50 | ||
@@ -56,7 +70,7 @@ jobs: | |||
56 | 70 | ||
57 | steps: | 71 | steps: |
58 | - name: Harden Runner | 72 | - name: Harden Runner |
59 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | 73 | uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 |
60 | with: | 74 | with: |
61 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | 75 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs |
62 | 76 | ||
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/profile-checks.yml index f5de62412..17e756685 100644 --- a/.github/workflows/profile-checks.yml +++ b/.github/workflows/profile-checks.yml | |||
@@ -4,17 +4,17 @@ on: | |||
4 | push: | 4 | push: |
5 | branches: [ master ] | 5 | branches: [ master ] |
6 | paths: | 6 | paths: |
7 | - 'etc/**' | ||
8 | - 'ci/check/profiles/**' | 7 | - 'ci/check/profiles/**' |
9 | - 'src/firecfg/firecfg.config' | 8 | - 'etc/**' |
10 | - 'contrib/sort.py' | 9 | - contrib/sort.py |
10 | - src/firecfg/firecfg.config | ||
11 | pull_request: | 11 | pull_request: |
12 | branches: [ master ] | 12 | branches: [ master ] |
13 | paths: | 13 | paths: |
14 | - 'etc/**' | ||
15 | - 'ci/check/profiles/**' | 14 | - 'ci/check/profiles/**' |
16 | - 'src/firecfg/firecfg.config' | 15 | - 'etc/**' |
17 | - 'contrib/sort.py' | 16 | - contrib/sort.py |
17 | - src/firecfg/firecfg.config | ||
18 | 18 | ||
19 | permissions: # added using https://github.com/step-security/secure-workflows | 19 | permissions: # added using https://github.com/step-security/secure-workflows |
20 | contents: read | 20 | contents: read |
@@ -24,7 +24,7 @@ jobs: | |||
24 | runs-on: ubuntu-latest | 24 | runs-on: ubuntu-latest |
25 | steps: | 25 | steps: |
26 | - name: Harden Runner | 26 | - name: Harden Runner |
27 | uses: step-security/harden-runner@2e205a28d0e1da00c5f53b161f4067b052c61f34 | 27 | uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5 |
28 | with: | 28 | with: |
29 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs | 29 | egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs |
30 | 30 | ||
@@ -1,3 +1,4 @@ | |||
1 | ROOT = . | ||
1 | -include config.mk | 2 | -include config.mk |
2 | 3 | ||
3 | ifneq ($(HAVE_MAN),no) | 4 | ifneq ($(HAVE_MAN),no) |
@@ -7,8 +8,6 @@ endif | |||
7 | 8 | ||
8 | COMPLETIONDIRS = src/zsh_completion src/bash_completion | 9 | COMPLETIONDIRS = src/zsh_completion src/bash_completion |
9 | 10 | ||
10 | .PHONY: all | ||
11 | all: all_items mydirs $(MAN_TARGET) filters | ||
12 | APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats src/jailcheck/jailcheck | 11 | APPS = src/firecfg/firecfg src/firejail/firejail src/firemon/firemon src/profstats/profstats src/jailcheck/jailcheck |
13 | SBOX_APPS = src/fbuilder/fbuilder src/ftee/ftee src/fids/fids | 12 | SBOX_APPS = src/fbuilder/fbuilder src/ftee/ftee src/fids/fids |
14 | SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter src/fzenity/fzenity | 13 | SBOX_APPS_NON_DUMPABLE = src/fcopy/fcopy src/fldd/fldd src/fnet/fnet src/fnetfilter/fnetfilter src/fzenity/fzenity |
@@ -22,6 +21,9 @@ MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 fi | |||
22 | SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx seccomp.mdwx.32 | 21 | SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx seccomp.mdwx.32 |
23 | ALL_ITEMS = $(APPS) $(SBOX_APPS) $(SBOX_APPS_NON_DUMPABLE) $(MYLIBS) | 22 | ALL_ITEMS = $(APPS) $(SBOX_APPS) $(SBOX_APPS_NON_DUMPABLE) $(MYLIBS) |
24 | 23 | ||
24 | .PHONY: all | ||
25 | all: all_items mydirs $(MAN_TARGET) filters | ||
26 | |||
25 | config.mk config.sh: | 27 | config.mk config.sh: |
26 | printf 'run ./configure to generate %s\n' "$@" >&2 | 28 | printf 'run ./configure to generate %s\n' "$@" >&2 |
27 | false | 29 | false |
@@ -2,6 +2,8 @@ firejail (0.9.71) baseline; urgency=low | |||
2 | * work in progress | 2 | * work in progress |
3 | * feature: On failing to remount a fuse filesystem, give warning instead of | 3 | * feature: On failing to remount a fuse filesystem, give warning instead of |
4 | erroring out (#5240 #5242) | 4 | erroring out (#5240 #5242) |
5 | * feature: Update syscall tables and seccomp groups (#5188) | ||
6 | * feature: improve force-nonewprivs security guarantees (#5217 #5271) | ||
5 | * feature: restrict namespaces (--restrict-namespaces) implemented as | 7 | * feature: restrict namespaces (--restrict-namespaces) implemented as |
6 | a seccomp filter for both 64 and 32 bit architectures (#4939 #5259) | 8 | a seccomp filter for both 64 and 32 bit architectures (#4939 #5259) |
7 | * feature: support for custom AppArmor profiles (--apparmor=) (#5274 #5316 | 9 | * feature: support for custom AppArmor profiles (--apparmor=) (#5274 #5316 |
@@ -38,6 +40,8 @@ firejail (0.9.71) baseline; urgency=low | |||
38 | * docs: Add IRC channel info to README.md (#5361) | 40 | * docs: Add IRC channel info to README.md (#5361) |
39 | * docs: man: Note that some commands can be disabled in firejail.config | 41 | * docs: man: Note that some commands can be disabled in firejail.config |
40 | (#5366) | 42 | (#5366) |
43 | * docs: Add gist note to bug_report.md (#5398) | ||
44 | * docs: clarify that --appimage should appear before --profile (#5402 #5451) | ||
41 | -- netblue30 <netblue30@yahoo.com> Sat, 11 Jun 2022 09:00:00 -0500 | 45 | -- netblue30 <netblue30@yahoo.com> Sat, 11 Jun 2022 09:00:00 -0500 |
42 | 46 | ||
43 | firejail (0.9.70) baseline; urgency=low | 47 | firejail (0.9.70) baseline; urgency=low |
diff --git a/contrib/sort.py b/contrib/sort.py index 6f21370ec..638f14516 100755 --- a/contrib/sort.py +++ b/contrib/sort.py | |||
@@ -2,48 +2,61 @@ | |||
2 | # This file is part of Firejail project | 2 | # This file is part of Firejail project |
3 | # Copyright (C) 2014-2022 Firejail Authors | 3 | # Copyright (C) 2014-2022 Firejail Authors |
4 | # License GPL v2 | 4 | # License GPL v2 |
5 | """ | ||
6 | Sort the items of multi-item options in profiles, the following options are supported: | ||
7 | private-bin, private-etc, private-lib, caps.drop, caps.keep, seccomp.drop, seccomp.drop, protocol | ||
8 | 5 | ||
9 | Usage: | 6 | # Requirements: |
10 | $ ./sort.py /path/to/profile [ /path/to/profile2 /path/to/profile3 ... ] | 7 | # python >= 3.6 |
8 | from os import path | ||
9 | from sys import argv, exit as sys_exit, stderr | ||
10 | |||
11 | __doc__ = f"""\ | ||
12 | Sort the arguments of commands in profiles. | ||
13 | |||
14 | Usage: {path.basename(argv[0])} [/path/to/profile ...] | ||
15 | |||
16 | The following commands are supported: | ||
17 | |||
18 | private-bin, private-etc, private-lib, caps.drop, caps.keep, seccomp.drop, | ||
19 | seccomp.drop, protocol | ||
20 | |||
21 | Note that this is only applicable to commands that support multiple arguments. | ||
22 | |||
11 | Keep in mind that this will overwrite your profile(s). | 23 | Keep in mind that this will overwrite your profile(s). |
12 | 24 | ||
13 | Examples: | 25 | Examples: |
14 | $ ./sort.py MyAwesomeProfile.profile | 26 | $ {argv[0]} MyAwesomeProfile.profile |
15 | $ ./sort.py new_profile.profile second_new_profile.profile | 27 | $ {argv[0]} new_profile.profile second_new_profile.profile |
16 | $ ./sort.py ~/.config/firejail/*.{profile,inc,local} | 28 | $ {argv[0]} ~/.config/firejail/*.{{profile,inc,local}} |
17 | $ sudo ./sort.py /etc/firejail/*.{profile,inc,local} | 29 | $ sudo {argv[0]} /etc/firejail/*.{{profile,inc,local}} |
18 | 30 | ||
19 | Exit-Codes: | 31 | Exit Codes: |
20 | 0: No Error; No Profile Fixed. | 32 | 0: Success: No profiles needed fixing. |
21 | 1: Error, one or more profiles were not processed correctly. | 33 | 1: Error: One or more profiles could not be processed correctly. |
22 | 101: No Error; One or more profile were fixed. | 34 | 2: Error: Missing arguments. |
35 | 101: Info: One or more profiles were fixed. | ||
23 | """ | 36 | """ |
24 | 37 | ||
25 | # Requirements: | ||
26 | # python >= 3.6 | ||
27 | from sys import argv, exit as sys_exit | ||
28 | |||
29 | 38 | ||
30 | def sort_alphabetical(raw_items): | 39 | def sort_alphabetical(original_items): |
31 | items = raw_items.split(",") | 40 | items = original_items.split(",") |
32 | items.sort(key=lambda s: s.casefold()) | 41 | items.sort(key=str.casefold) |
33 | return ",".join(items) | 42 | return ",".join(items) |
34 | 43 | ||
35 | 44 | ||
36 | def sort_protocol(protocols): | 45 | def sort_protocol(original_protocols): |
37 | """sort the given protocols into this scheme: unix,inet,inet6,netlink,packet,bluetooth""" | 46 | """ |
47 | Sort the given protocols into the following order: | ||
48 | |||
49 | unix,inet,inet6,netlink,packet,bluetooth | ||
50 | """ | ||
38 | 51 | ||
39 | # shortcut for common protocol lines | 52 | # shortcut for common protocol lines |
40 | if protocols in ("unix", "unix,inet,inet6"): | 53 | if original_protocols in ("unix", "unix,inet,inet6"): |
41 | return protocols | 54 | return original_protocols |
42 | 55 | ||
43 | fixed_protocols = "" | 56 | fixed_protocols = "" |
44 | for protocol in ("unix", "inet", "inet6", "netlink", "packet", "bluetooth"): | 57 | for protocol in ("unix", "inet", "inet6", "netlink", "packet", "bluetooth"): |
45 | for prefix in ("", "-", "+", "="): | 58 | for prefix in ("", "-", "+", "="): |
46 | if f",{prefix}{protocol}," in f",{protocols},": | 59 | if f",{prefix}{protocol}," in f",{original_protocols},": |
47 | fixed_protocols += f"{prefix}{protocol}," | 60 | fixed_protocols += f"{prefix}{protocol}," |
48 | return fixed_protocols[:-1] | 61 | return fixed_protocols[:-1] |
49 | 62 | ||
@@ -53,7 +66,7 @@ def fix_profile(filename): | |||
53 | lines = profile.read().split("\n") | 66 | lines = profile.read().split("\n") |
54 | was_fixed = False | 67 | was_fixed = False |
55 | fixed_profile = [] | 68 | fixed_profile = [] |
56 | for lineno, line in enumerate(lines): | 69 | for lineno, line in enumerate(lines, 1): |
57 | if line[:12] in ("private-bin ", "private-etc ", "private-lib "): | 70 | if line[:12] in ("private-bin ", "private-etc ", "private-lib "): |
58 | fixed_line = f"{line[:12]}{sort_alphabetical(line[12:])}" | 71 | fixed_line = f"{line[:12]}{sort_alphabetical(line[12:])}" |
59 | elif line[:13] in ("seccomp.drop ", "seccomp.keep "): | 72 | elif line[:13] in ("seccomp.drop ", "seccomp.keep "): |
@@ -69,8 +82,8 @@ def fix_profile(filename): | |||
69 | if fixed_line != line: | 82 | if fixed_line != line: |
70 | was_fixed = True | 83 | was_fixed = True |
71 | print( | 84 | print( |
72 | f"{filename}:{lineno + 1}:-{line}\n" | 85 | f"{filename}:{lineno}:-{line}\n" |
73 | f"{filename}:{lineno + 1}:+{fixed_line}" | 86 | f"{filename}:{lineno}:+{fixed_line}" |
74 | ) | 87 | ) |
75 | fixed_profile.append(fixed_line) | 88 | fixed_profile.append(fixed_line) |
76 | if was_fixed: | 89 | if was_fixed: |
@@ -84,22 +97,30 @@ def fix_profile(filename): | |||
84 | 97 | ||
85 | 98 | ||
86 | def main(args): | 99 | def main(args): |
100 | if len(args) < 1: | ||
101 | print(__doc__, file=stderr) | ||
102 | return 2 | ||
103 | |||
104 | print(f"sort.py: checking {len(args)} profile(s)...") | ||
105 | |||
87 | exit_code = 0 | 106 | exit_code = 0 |
88 | print(f"sort.py: checking {len(args)} {'profiles' if len(args) != 1 else 'profile'}...") | ||
89 | for filename in args: | 107 | for filename in args: |
90 | try: | 108 | try: |
91 | if exit_code not in (1, 101): | 109 | if exit_code not in (1, 101): |
92 | exit_code = fix_profile(filename) | 110 | exit_code = fix_profile(filename) |
93 | else: | 111 | else: |
94 | fix_profile(filename) | 112 | fix_profile(filename) |
95 | except FileNotFoundError: | 113 | except FileNotFoundError as err: |
96 | print(f"[ Error ] Can't find `{filename}'") | 114 | print(f"[ Error ] {err}", file=stderr) |
97 | exit_code = 1 | 115 | exit_code = 1 |
98 | except PermissionError: | 116 | except PermissionError as err: |
99 | print(f"[ Error ] Can't read/write `{filename}'") | 117 | print(f"[ Error ] {err}", file=stderr) |
100 | exit_code = 1 | 118 | exit_code = 1 |
101 | except Exception as err: | 119 | except Exception as err: |
102 | print(f"[ Error ] An error occurred while processing `{filename}': {err}") | 120 | print( |
121 | f"[ Error ] An error occurred while processing '{filename}': {err}", | ||
122 | file=stderr, | ||
123 | ) | ||
103 | exit_code = 1 | 124 | exit_code = 1 |
104 | return exit_code | 125 | return exit_code |
105 | 126 | ||
diff --git a/etc/profile-a-l/brave.profile b/etc/profile-a-l/brave.profile index 09548c761..071a279b0 100644 --- a/etc/profile-a-l/brave.profile +++ b/etc/profile-a-l/brave.profile | |||
@@ -13,6 +13,8 @@ ignore noexec /tmp | |||
13 | # you will need to uncomment the 'brave + tor' rule in /etc/apparmor.d/local/firejail-default. | 13 | # you will need to uncomment the 'brave + tor' rule in /etc/apparmor.d/local/firejail-default. |
14 | # Alternatively you can add 'ignore apparmor' to your brave.local. | 14 | # Alternatively you can add 'ignore apparmor' to your brave.local. |
15 | ignore noexec ${HOME} | 15 | ignore noexec ${HOME} |
16 | # Causes slow starts (#4604) | ||
17 | ignore private-cache | ||
16 | 18 | ||
17 | noblacklist ${HOME}/.cache/BraveSoftware | 19 | noblacklist ${HOME}/.cache/BraveSoftware |
18 | noblacklist ${HOME}/.config/BraveSoftware | 20 | noblacklist ${HOME}/.config/BraveSoftware |
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile index 2b26b3727..89c44bf76 100644 --- a/etc/profile-a-l/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -65,7 +65,7 @@ tracelog | |||
65 | # disable-mnt | 65 | # disable-mnt |
66 | private-cache | 66 | private-cache |
67 | private-dev | 67 | private-dev |
68 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,machine-id,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg | 68 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,localtime,machine-id,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg |
69 | private-tmp | 69 | private-tmp |
70 | # encrypting and signing email | 70 | # encrypting and signing email |
71 | writable-run-user | 71 | writable-run-user |
diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index 21bf7eabf..eec9f86db 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -6,9 +6,9 @@ include evince.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # WARNING: using bookmarks possibly exposes information, including file history from other programs. | 9 | # WARNING: This exposes information like file history from other programs. |
10 | # Add the next line to your evince.local if you need bookmarks support. This also needs additional dbus-user filtering (see below). | 10 | # You can add a blacklist for it in your evince.local for additional hardening if you can live with some restrictions. |
11 | #noblacklist ${HOME}/.local/share/gvfs-metadata | 11 | noblacklist ${HOME}/.local/share/gvfs-metadata |
12 | 12 | ||
13 | noblacklist ${HOME}/.config/evince | 13 | noblacklist ${HOME}/.config/evince |
14 | noblacklist ${DOCUMENTS} | 14 | noblacklist ${DOCUMENTS} |
@@ -59,9 +59,8 @@ private-etc alternatives,fonts,group,ld.so.cache,ld.so.preload,machine-id,passwd | |||
59 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* | 59 | private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libarchive.so.*,libdjvulibre.so.*,libgconf-2.so.*,libgraphite2.so.*,libpoppler-glib.so.*,librsvg-2.so.*,libspectre.so.* |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
62 | # dbus-user filtering might break two-page-view on some systems | ||
63 | dbus-user filter | 62 | dbus-user filter |
64 | # Add the next two lines to your evince.local if you need bookmarks support. | 63 | dbus-user.talk ca.desrt.dconf |
65 | #dbus-user.talk org.gtk.vfs.Daemon | 64 | dbus-user.talk org.gtk.vfs.Daemon |
66 | #dbus-user.talk org.gtk.vfs.Metadata | 65 | dbus-user.talk org.gtk.vfs.Metadata |
67 | dbus-system none | 66 | dbus-system none |
diff --git a/etc/profile-a-l/lutris.profile b/etc/profile-a-l/lutris.profile index 0562cf430..80cecd056 100644 --- a/etc/profile-a-l/lutris.profile +++ b/etc/profile-a-l/lutris.profile | |||
@@ -69,7 +69,8 @@ notv | |||
69 | nou2f | 69 | nou2f |
70 | novideo | 70 | novideo |
71 | protocol unix,inet,inet6,netlink | 71 | protocol unix,inet,inet6,netlink |
72 | seccomp | 72 | seccomp !modify_ldt |
73 | seccomp.32 !modify_ldt | ||
73 | 74 | ||
74 | # Add the next line to your lutris.local if you do not need controller support. | 75 | # Add the next line to your lutris.local if you do not need controller support. |
75 | #private-dev | 76 | #private-dev |
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile index bb2a41457..22c8b1782 100644 --- a/etc/profile-m-z/nicotine.profile +++ b/etc/profile-m-z/nicotine.profile | |||
@@ -8,8 +8,12 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.nicotine | 9 | noblacklist ${HOME}/.nicotine |
10 | 10 | ||
11 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
12 | include allow-bin-sh.inc | ||
13 | |||
11 | # Allow python (blacklisted by disable-interpreters.inc) | 14 | # Allow python (blacklisted by disable-interpreters.inc) |
12 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | ||
13 | 17 | ||
14 | include disable-common.inc | 18 | include disable-common.inc |
15 | include disable-devel.inc | 19 | include disable-devel.inc |
@@ -37,6 +41,7 @@ nodvd | |||
37 | nogroups | 41 | nogroups |
38 | noinput | 42 | noinput |
39 | nonewprivs | 43 | nonewprivs |
44 | noprinters | ||
40 | noroot | 45 | noroot |
41 | nosound | 46 | nosound |
42 | notv | 47 | notv |
@@ -47,7 +52,7 @@ seccomp | |||
47 | tracelog | 52 | tracelog |
48 | 53 | ||
49 | disable-mnt | 54 | disable-mnt |
50 | private-bin nicotine,python2* | 55 | #private-bin nicotine,python2* |
51 | private-cache | 56 | private-cache |
52 | private-dev | 57 | private-dev |
53 | private-tmp | 58 | private-tmp |
diff --git a/etc/profile-m-z/whalebird.profile b/etc/profile-m-z/whalebird.profile index 92ebebdae..8a9614fb0 100644 --- a/etc/profile-m-z/whalebird.profile +++ b/etc/profile-m-z/whalebird.profile | |||
@@ -10,6 +10,7 @@ include globals.local | |||
10 | ignore include whitelist-runuser-common.inc | 10 | ignore include whitelist-runuser-common.inc |
11 | ignore include whitelist-usr-share-common.inc | 11 | ignore include whitelist-usr-share-common.inc |
12 | 12 | ||
13 | ignore apparmor | ||
13 | ignore dbus-user none | 14 | ignore dbus-user none |
14 | ignore dbus-system none | 15 | ignore dbus-system none |
15 | 16 | ||
@@ -21,7 +22,7 @@ whitelist ${HOME}/.config/Whalebird | |||
21 | no3d | 22 | no3d |
22 | 23 | ||
23 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird | 24 | private-bin electron,electron[0-9],electron[0-9][0-9],whalebird |
24 | private-etc alternatives,fonts,ld.so.cache,ld.so.preload,machine-id | 25 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl |
25 | 26 | ||
26 | # Redirect | 27 | # Redirect |
27 | include electron.profile | 28 | include electron.profile |
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile index 8582e2462..28c219377 100644 --- a/etc/profile-m-z/youtube-viewers-common.profile +++ b/etc/profile-m-z/youtube-viewers-common.profile | |||
@@ -19,6 +19,13 @@ include allow-perl.inc | |||
19 | include allow-python2.inc | 19 | include allow-python2.inc |
20 | include allow-python3.inc | 20 | include allow-python3.inc |
21 | 21 | ||
22 | # The lines below are needed to find the default Firefox profile name, to allow | ||
23 | # opening links in an existing instance of Firefox (note that it still fails if | ||
24 | # there isn't a Firefox instance running with the default profile; see #5352) | ||
25 | noblacklist ${HOME}/.mozilla | ||
26 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
27 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
28 | |||
22 | include disable-common.inc | 29 | include disable-common.inc |
23 | include disable-devel.inc | 30 | include disable-devel.inc |
24 | include disable-exec.inc | 31 | include disable-exec.inc |
@@ -55,5 +62,8 @@ private-dev | |||
55 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | 62 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg |
56 | private-tmp | 63 | private-tmp |
57 | 64 | ||
58 | dbus-user none | 65 | dbus-user filter |
66 | # allow D-Bus communication with firefox for opening links | ||
67 | dbus-user.talk org.mozilla.* | ||
68 | |||
59 | dbus-system none | 69 | dbus-system none |
diff --git a/src/common.mk b/src/common.mk deleted file mode 100644 index 07b5e373d..000000000 --- a/src/common.mk +++ /dev/null | |||
@@ -1,16 +0,0 @@ | |||
1 | # Common definitions for building C programs and non-shared objects. | ||
2 | # | ||
3 | # Note: "ROOT" must be defined before including this file. | ||
4 | |||
5 | -include $(ROOT)/config.mk | ||
6 | |||
7 | H_FILE_LIST = $(sort $(wildcard *.h)) | ||
8 | C_FILE_LIST = $(sort $(wildcard *.c)) | ||
9 | OBJS = $(C_FILE_LIST:.c=.o) | ||
10 | BINOBJS = $(foreach file, $(OBJS), $file) | ||
11 | |||
12 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) | ||
13 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' -DVARDIR='"/var/lib/firejail"' | ||
14 | CFLAGS += $(MANFLAGS) | ||
15 | CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security | ||
16 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | ||
diff --git a/src/fbuilder/Makefile b/src/fbuilder/Makefile index da0403c6e..ad73e8960 100644 --- a/src/fbuilder/Makefile +++ b/src/fbuilder/Makefile | |||
@@ -1,17 +1,9 @@ | |||
1 | .PHONY: all | ||
2 | all: fbuilder | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fbuilder: $(OBJS) $(ROOT)/config.mk | 4 | PROG = fbuilder |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/syscall.h |
14 | clean:; rm -fr *.o fbuilder *.gcov *.gcda *.gcno *.plist | ||
15 | 8 | ||
16 | .PHONY: distclean | 9 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fcopy/Makefile b/src/fcopy/Makefile index ae128df9b..27054627c 100644 --- a/src/fcopy/Makefile +++ b/src/fcopy/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: fcopy | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fcopy: $(OBJS) ../lib/common.o $(ROOT)/config.mk | 4 | PROG = fcopy |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/syscall.h |
14 | clean:; rm -fr *.o fcopy *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fids/Makefile b/src/fids/Makefile index e57c56b5b..44ea396d7 100644 --- a/src/fids/Makefile +++ b/src/fids/Makefile | |||
@@ -1,18 +1,9 @@ | |||
1 | .PHONY: all | ||
2 | all: fids | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | #fseccomp: $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o | 4 | PROG = fids |
11 | fids: $(OBJS) $(ROOT)/config.mk | 5 | TARGET = $(PROG) |
12 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
13 | 6 | ||
14 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h |
15 | clean:; rm -fr *.o fids *.gcov *.gcda *.gcno *.plist | ||
16 | 8 | ||
17 | .PHONY: distclean | 9 | include $(ROOT)/src/prog.mk |
18 | distclean: clean | ||
diff --git a/src/firecfg/Makefile b/src/firecfg/Makefile index 3b0daed71..05cc088f4 100644 --- a/src/firecfg/Makefile +++ b/src/firecfg/Makefile | |||
@@ -1,17 +1,16 @@ | |||
1 | .PHONY: all | ||
2 | all: firecfg | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | 3 | ||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/euid_common.h ../include/libnetlink.h ../include/firejail_user.h ../include/pid.h $(ROOT)/config.mk | 4 | PROG = firecfg |
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | 5 | TARGET = $(PROG) |
9 | 6 | ||
10 | firecfg: $(OBJS) ../lib/common.o ../lib/firejail_user.o $(ROOT)/config.mk | 7 | MOD_HDRS = \ |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/firejail_user.o $(LIBS) $(EXTRA_LDFLAGS) | 8 | ../include/common.h \ |
9 | ../include/euid_common.h \ | ||
10 | ../include/libnetlink.h \ | ||
11 | ../include/firejail_user.h \ | ||
12 | ../include/pid.h | ||
12 | 13 | ||
13 | .PHONY: clean | 14 | MOD_OBJS = ../lib/common.o ../lib/firejail_user.o |
14 | clean:; rm -fr *.o firecfg *.gcov *.gcda *.gcno *.plist | ||
15 | 15 | ||
16 | .PHONY: distclean | 16 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/firejail/Makefile b/src/firejail/Makefile index 23444107f..4e241af7e 100644 --- a/src/firejail/Makefile +++ b/src/firejail/Makefile | |||
@@ -1,17 +1,25 @@ | |||
1 | .PHONY: all | ||
2 | all: firejail | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | 3 | ||
7 | %.o : %.c $(H_FILE_LIST) ../include/rundefs.h ../include/common.h ../include/ldd_utils.h ../include/euid_common.h ../include/pid.h ../include/seccomp.h ../include/syscall_i386.h ../include/syscall_x86_64.h ../include/firejail_user.h $(ROOT)/config.mk | 4 | PROG = firejail |
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | 5 | TARGET = $(PROG) |
9 | 6 | ||
10 | firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o $(ROOT)/config.mk | 7 | MOD_HDRS = \ |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) | 8 | ../include/rundefs.h \ |
9 | ../include/common.h \ | ||
10 | ../include/ldd_utils.h \ | ||
11 | ../include/euid_common.h \ | ||
12 | ../include/pid.h \ | ||
13 | ../include/seccomp.h \ | ||
14 | ../include/syscall_i386.h \ | ||
15 | ../include/syscall_x86_64.h \ | ||
16 | ../include/firejail_user.h | ||
12 | 17 | ||
13 | .PHONY: clean | 18 | MOD_OBJS = \ |
14 | clean:; rm -fr *.o firejail *.gcov *.gcda *.gcno *.plist | 19 | ../lib/common.o \ |
20 | ../lib/ldd_utils.o \ | ||
21 | ../lib/firejail_user.o \ | ||
22 | ../lib/errno.o \ | ||
23 | ../lib/syscall.o | ||
15 | 24 | ||
16 | .PHONY: distclean | 25 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/firemon/Makefile b/src/firemon/Makefile index b2d2f4d14..433e4267d 100644 --- a/src/firemon/Makefile +++ b/src/firemon/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: firemon | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/pid.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | firemon: $(OBJS) ../lib/common.o ../lib/pid.o $(ROOT)/config.mk | 4 | PROG = firemon |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/pid.h |
14 | clean:; rm -fr *.o firemon *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o ../lib/pid.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fldd/Makefile b/src/fldd/Makefile index d9a70529b..0c127af55 100644 --- a/src/fldd/Makefile +++ b/src/fldd/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: fldd | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h ../include/ldd_utils.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fldd: $(OBJS) ../lib/common.o ../lib/ldd_utils.o $(ROOT)/config.mk | 4 | PROG = fldd |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/syscall.h ../include/ldd_utils.h |
14 | clean:; rm -fr *.o fldd *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o ../lib/ldd_utils.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fnet/Makefile b/src/fnet/Makefile index 36e95522f..91de109fa 100644 --- a/src/fnet/Makefile +++ b/src/fnet/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: fnet | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/libnetlink.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fnet: $(OBJS) ../lib/common.o ../lib/libnetlink.o $(ROOT)/config.mk | 4 | PROG = fnet |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/libnetlink.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/libnetlink.h |
14 | clean:; rm -fr *.o fnet *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o ../lib/libnetlink.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fnetfilter/Makefile b/src/fnetfilter/Makefile index 758561b9e..506d287ab 100644 --- a/src/fnetfilter/Makefile +++ b/src/fnetfilter/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: fnetfilter | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fnetfilter: $(OBJS) ../lib/common.o $(ROOT)/config.mk | 4 | PROG = fnetfilter |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/syscall.h |
14 | clean:; rm -fr *.o fnetfilter *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fnettrace-dns/Makefile b/src/fnettrace-dns/Makefile index 101abd4d4..36542f567 100644 --- a/src/fnettrace-dns/Makefile +++ b/src/fnettrace-dns/Makefile | |||
@@ -1,17 +1,7 @@ | |||
1 | .PHONY: all | ||
2 | all: fnettrace-dns | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | |||
10 | fnettrace-dns: $(OBJS) $(ROOT)/config.mk | ||
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
12 | 3 | ||
13 | .PHONY: clean | 4 | PROG = fnettrace-dns |
14 | clean:; rm -fr *.o fnettrace-dns *.gcov *.gcda *.gcno *.plist | 5 | TARGET = $(PROG) |
15 | 6 | ||
16 | .PHONY: distclean | 7 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fnettrace-icmp/Makefile b/src/fnettrace-icmp/Makefile index 4dfdc891a..12ae42e9a 100644 --- a/src/fnettrace-icmp/Makefile +++ b/src/fnettrace-icmp/Makefile | |||
@@ -1,17 +1,7 @@ | |||
1 | .PHONY: all | ||
2 | all: fnettrace-icmp | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | |||
10 | fnettrace-icmp: $(OBJS) $(ROOT)/config.mk | ||
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
12 | 3 | ||
13 | .PHONY: clean | 4 | PROG = fnettrace-icmp |
14 | clean:; rm -fr *.o fnettrace-icmp *.gcov *.gcda *.gcno *.plist | 5 | TARGET = $(PROG) |
15 | 6 | ||
16 | .PHONY: distclean | 7 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fnettrace-sni/Makefile b/src/fnettrace-sni/Makefile index da7c1ca4e..8d9a437d5 100644 --- a/src/fnettrace-sni/Makefile +++ b/src/fnettrace-sni/Makefile | |||
@@ -1,17 +1,7 @@ | |||
1 | .PHONY: all | ||
2 | all: fnettrace-sni | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | |||
10 | fnettrace-sni: $(OBJS) $(ROOT)/config.mk | ||
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
12 | 3 | ||
13 | .PHONY: clean | 4 | PROG = fnettrace-sni |
14 | clean:; rm -fr *.o fnettrace-sni *.gcov *.gcda *.gcno *.plist | 5 | TARGET = $(PROG) |
15 | 6 | ||
16 | .PHONY: distclean | 7 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fnettrace/Makefile b/src/fnettrace/Makefile index f41a4d36d..952036ad3 100644 --- a/src/fnettrace/Makefile +++ b/src/fnettrace/Makefile | |||
@@ -1,17 +1,7 @@ | |||
1 | .PHONY: all | ||
2 | all: fnettrace | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | |||
10 | fnettrace: $(OBJS) $(ROOT)/config.mk | ||
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
12 | 3 | ||
13 | .PHONY: clean | 4 | PROG = fnettrace |
14 | clean:; rm -fr *.o fnettrace *.gcov *.gcda *.gcno *.plist | 5 | TARGET = $(PROG) |
15 | 6 | ||
16 | .PHONY: distclean | 7 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fsec-optimize/Makefile b/src/fsec-optimize/Makefile index 1aa49d34b..ce65f4719 100644 --- a/src/fsec-optimize/Makefile +++ b/src/fsec-optimize/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: fsec-optimize | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fsec-optimize: $(OBJS) ../lib/common.o ../lib/libnetlink.o $(ROOT)/config.mk | 4 | PROG = fsec-optimize |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/seccomp.h ../include/syscall.h |
14 | clean:; rm -fr *.o fsec-optimize *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o ../lib/errno.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fsec-print/Makefile b/src/fsec-print/Makefile index b076c0588..cbe061d45 100644 --- a/src/fsec-print/Makefile +++ b/src/fsec-print/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: fsec-print | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/seccomp.h ../include/syscall.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fsec-print: $(OBJS) ../lib/common.o ../lib/libnetlink.o ../lib/errno.o ../lib/syscall.o $(ROOT)/config.mk | 4 | PROG = fsec-print |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/seccomp.h ../include/syscall.h |
14 | clean:; rm -fr *.o fsec-print *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o ../lib/errno.o ../lib/syscall.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fseccomp/Makefile b/src/fseccomp/Makefile index 9bf4c050b..1b8d0bb48 100644 --- a/src/fseccomp/Makefile +++ b/src/fseccomp/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: fseccomp | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/syscall.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fseccomp: $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o $(ROOT)/config.mk | 4 | PROG = fseccomp |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/syscall.h |
14 | clean:; rm -fr *.o fseccomp *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o ../lib/errno.o ../lib/syscall.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/ftee/Makefile b/src/ftee/Makefile index 535d7ff63..2f26ab900 100644 --- a/src/ftee/Makefile +++ b/src/ftee/Makefile | |||
@@ -1,17 +1,7 @@ | |||
1 | .PHONY: all | ||
2 | all: ftee | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | |||
10 | ftee: $(OBJS) $(ROOT)/config.mk | ||
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
12 | 3 | ||
13 | .PHONY: clean | 4 | PROG = ftee |
14 | clean:; rm -fr *.o ftee *.gcov *.gcda *.gcno *.plist | 5 | TARGET = $(PROG) |
15 | 6 | ||
16 | .PHONY: distclean | 7 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/fzenity/Makefile b/src/fzenity/Makefile index 0358dd3e9..aeb862d9b 100644 --- a/src/fzenity/Makefile +++ b/src/fzenity/Makefile | |||
@@ -1,17 +1,9 @@ | |||
1 | .PHONY: all | ||
2 | all: fzenity | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | fzenity: $(OBJS) $(ROOT)/config.mk | 4 | PROG = fzenity |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h |
14 | clean:; rm -fr *.o fzenity *.gcov *.gcda *.gcno *.plist | ||
15 | 8 | ||
16 | .PHONY: distclean | 9 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/jailcheck/Makefile b/src/jailcheck/Makefile index 52feb86e6..e3b84fbf3 100644 --- a/src/jailcheck/Makefile +++ b/src/jailcheck/Makefile | |||
@@ -1,17 +1,10 @@ | |||
1 | .PHONY: all | ||
2 | all: jailcheck | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h ../include/pid.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | jailcheck: $(OBJS) $(ROOT)/config.mk | 4 | PROG = jailcheck |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h ../include/pid.h |
14 | clean:; rm -fr *.o jailcheck *.gcov *.gcda *.gcno *.plist | 8 | MOD_OBJS = ../lib/common.o ../lib/pid.o |
15 | 9 | ||
16 | .PHONY: distclean | 10 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/lib/Makefile b/src/lib/Makefile index d9bc63ef7..f5b92e389 100644 --- a/src/lib/Makefile +++ b/src/lib/Makefile | |||
@@ -1,14 +1,9 @@ | |||
1 | ROOT = ../.. | 1 | ROOT = ../.. |
2 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
3 | 3 | ||
4 | .PHONY: all | 4 | TARGET = lib |
5 | all: $(OBJS) | ||
6 | 5 | ||
7 | %.o : %.c $(H_FILE_LIST) $(ROOT)/config.mk | 6 | include $(ROOT)/src/prog.mk |
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 7 | ||
10 | .PHONY: clean | 8 | .PHONY: lib |
11 | clean:; rm -fr $(OBJS) *.gcov *.gcda *.gcno *.plist | 9 | lib: $(OBJS) |
12 | |||
13 | .PHONY: distclean | ||
14 | distclean: clean | ||
diff --git a/src/libpostexecseccomp/Makefile b/src/libpostexecseccomp/Makefile index 5386af58b..62e167b73 100644 --- a/src/libpostexecseccomp/Makefile +++ b/src/libpostexecseccomp/Makefile | |||
@@ -1,24 +1,9 @@ | |||
1 | ROOT = ../.. | 1 | ROOT = ../.. |
2 | -include $(ROOT)/config.mk | 2 | -include $(ROOT)/config.mk |
3 | 3 | ||
4 | H_FILE_LIST = $(sort $(wildcard *.h)) | 4 | SO = libpostexecseccomp.so |
5 | C_FILE_LIST = $(sort $(wildcard *.c)) | 5 | TARGET = $(SO) |
6 | OBJS = $(C_FILE_LIST:.c=.o) | ||
7 | BINOBJS = $(foreach file, $(OBJS), $file) | ||
8 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security | ||
9 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | ||
10 | 6 | ||
11 | .PHONY: all | 7 | MOD_HDRS = ../include/seccomp.h ../include/rundefs.h |
12 | all: libpostexecseccomp.so | ||
13 | 8 | ||
14 | %.o : %.c $(H_FILE_LIST) ../include/seccomp.h ../include/rundefs.h $(ROOT)/config.mk | 9 | include $(ROOT)/src/so.mk |
15 | $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@ | ||
16 | |||
17 | libpostexecseccomp.so: $(OBJS) $(ROOT)/config.mk | ||
18 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | ||
19 | |||
20 | .PHONY: clean | ||
21 | clean:; rm -fr $(OBJS) libpostexecseccomp.so *.plist | ||
22 | |||
23 | .PHONY: distclean | ||
24 | distclean: clean | ||
diff --git a/src/libtrace/Makefile b/src/libtrace/Makefile index 6f28b3442..d45b3e2f6 100644 --- a/src/libtrace/Makefile +++ b/src/libtrace/Makefile | |||
@@ -1,24 +1,7 @@ | |||
1 | ROOT = ../.. | 1 | ROOT = ../.. |
2 | -include $(ROOT)/config.mk | 2 | -include $(ROOT)/config.mk |
3 | 3 | ||
4 | H_FILE_LIST = $(sort $(wildcard *.h)) | 4 | SO = libtrace.so |
5 | C_FILE_LIST = $(sort $(wildcard *.c)) | 5 | TARGET = $(SO) |
6 | OBJS = $(C_FILE_LIST:.c=.o) | ||
7 | BINOBJS = $(foreach file, $(OBJS), $file) | ||
8 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security | ||
9 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | ||
10 | 6 | ||
11 | .PHONY: all | 7 | include $(ROOT)/src/so.mk |
12 | all: libtrace.so | ||
13 | |||
14 | %.o : %.c $(H_FILE_LIST) $(ROOT)/config.mk | ||
15 | $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@ | ||
16 | |||
17 | libtrace.so: $(OBJS) $(ROOT)/config.mk | ||
18 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | ||
19 | |||
20 | .PHONY: clean | ||
21 | clean:; rm -fr $(OBJS) libtrace.so *.plist | ||
22 | |||
23 | .PHONY: distclean | ||
24 | distclean: clean | ||
diff --git a/src/libtracelog/Makefile b/src/libtracelog/Makefile index c5d9c131d..bfc5adddc 100644 --- a/src/libtracelog/Makefile +++ b/src/libtracelog/Makefile | |||
@@ -1,24 +1,9 @@ | |||
1 | ROOT = ../.. | 1 | ROOT = ../.. |
2 | -include $(ROOT)/config.mk | 2 | -include $(ROOT)/config.mk |
3 | 3 | ||
4 | H_FILE_LIST = $(sort $(wildcard *.h)) | 4 | SO = libtracelog.so |
5 | C_FILE_LIST = $(sort $(wildcard *.c)) | 5 | TARGET = $(SO) |
6 | OBJS = $(C_FILE_LIST:.c=.o) | ||
7 | BINOBJS = $(foreach file, $(OBJS), $file) | ||
8 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security | ||
9 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | ||
10 | 6 | ||
11 | .PHONY: all | 7 | MOD_HDRS = ../include/rundefs.h |
12 | all: libtracelog.so | ||
13 | 8 | ||
14 | %.o : %.c $(H_FILE_LIST) ../include/rundefs.h $(ROOT)/config.mk | 9 | include $(ROOT)/src/so.mk |
15 | $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@ | ||
16 | |||
17 | libtracelog.so: $(OBJS) $(ROOT)/config.mk | ||
18 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | ||
19 | |||
20 | .PHONY: clean | ||
21 | clean:; rm -fr $(OBJS) libtracelog.so *.plist | ||
22 | |||
23 | .PHONY: distclean | ||
24 | distclean: clean | ||
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index 138aae8af..7fa677ae5 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -14,7 +14,7 @@ Using a specific profile: | |||
14 | .br | 14 | .br |
15 | Example: | 15 | Example: |
16 | .br | 16 | .br |
17 | $ firejail --profile=/etc/firejail/kdenlive.profile --appimage kdenlive.appimage | 17 | $ firejail --appimage --profile=/etc/firejail/kdenlive.profile kdenlive.appimage |
18 | .br | 18 | .br |
19 | 19 | ||
20 | .br | 20 | .br |
@@ -25,7 +25,7 @@ $ firejail --profile=/etc/firejail/kdenlive.profile --appimage kdenlive.appimage | |||
25 | .br | 25 | .br |
26 | Example: | 26 | Example: |
27 | .br | 27 | .br |
28 | $ firejail --profile=kdenlive --appimage kdenlive.appimage | 28 | $ firejail --appimage --profile=kdenlive kdenlive.appimage |
29 | .br | 29 | .br |
30 | 30 | ||
31 | .br | 31 | .br |
@@ -179,6 +179,11 @@ can be enabled or disabled globally in Firejail's configuration file. | |||
179 | 179 | ||
180 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. | 180 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. |
181 | 181 | ||
182 | Note: When using one or more conditionals and \fB--profile\fR, it is | ||
183 | recommended that the relevant option(s) (such as \fB--appimage\fR) be specified | ||
184 | before \fB--profile\fR, so that their respective conditional(s) (such as | ||
185 | \fB?HAS_APPIMAGE\fR) inside of the profile evaluate to true. | ||
186 | |||
182 | .TP | 187 | .TP |
183 | \fBinclude other.profile | 188 | \fBinclude other.profile |
184 | Include other.profile file. | 189 | Include other.profile file. |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index b4be1cd62..39c81312c 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -11,7 +11,7 @@ firejail [OPTIONS] [program and arguments] | |||
11 | Start an AppImage program: | 11 | Start an AppImage program: |
12 | .PP | 12 | .PP |
13 | .RS | 13 | .RS |
14 | firejail [OPTIONS] --appimage [appimage-file and arguments] | 14 | firejail [OPTIONS] --appimage [OPTIONS] [appimage-file and arguments] |
15 | .RE | 15 | .RE |
16 | .PP | 16 | .PP |
17 | #ifdef HAVE_FILE_TRANSFER | 17 | #ifdef HAVE_FILE_TRANSFER |
@@ -164,15 +164,22 @@ private-bin and private-lib are disabled by default when running appimages. | |||
164 | .br | 164 | .br |
165 | Example: | 165 | Example: |
166 | .br | 166 | .br |
167 | $ firejail --profile=krita --appimage krita-3.0-x86_64.appimage | 167 | $ firejail --appimage --profile=krita krita-3.0-x86_64.appimage |
168 | .br | 168 | .br |
169 | $ firejail --private --profile=krita --appimage krita-3.0-x86_64.appimage | 169 | $ firejail --quiet --appimage --private --profile=krita krita-3.0-x86_64.appimage |
170 | .br | 170 | .br |
171 | #ifdef HAVE_X11 | 171 | #ifdef HAVE_X11 |
172 | $ firejail --net=none --x11 --profile=krita --appimage krita-3.0-x86_64.appimage | 172 | $ firejail --appimage --net=none --x11 --profile=krita krita-3.0-x86_64.appimage |
173 | #endif | 173 | #endif |
174 | .TP | 174 | .br |
175 | |||
176 | .br | ||
177 | Note: When using both \fB--appimage\fR and \fB--profile\fR, it is recommended | ||
178 | to always specify the former before the latter, so that any \fB?HAS_APPIMAGE\fR | ||
179 | conditionals inside of the profile evaluate to true (see \fB?CONDITIONAL\fR in | ||
180 | firejail-profile(5)). | ||
175 | #ifdef HAVE_NETWORK | 181 | #ifdef HAVE_NETWORK |
182 | .TP | ||
176 | \fB\-\-bandwidth=name|pid | 183 | \fB\-\-bandwidth=name|pid |
177 | Set bandwidth limits for the sandbox identified by name or PID, see \fBTRAFFIC SHAPING\fR section for more details. | 184 | Set bandwidth limits for the sandbox identified by name or PID, see \fBTRAFFIC SHAPING\fR section for more details. |
178 | #endif | 185 | #endif |
diff --git a/src/profstats/Makefile b/src/profstats/Makefile index 0274aead2..47b39e76c 100644 --- a/src/profstats/Makefile +++ b/src/profstats/Makefile | |||
@@ -1,17 +1,9 @@ | |||
1 | .PHONY: all | ||
2 | all: profstats | ||
3 | |||
4 | ROOT = ../.. | 1 | ROOT = ../.. |
5 | include $(ROOT)/src/common.mk | 2 | -include $(ROOT)/config.mk |
6 | |||
7 | %.o : %.c $(H_FILE_LIST) ../include/common.h $(ROOT)/config.mk | ||
8 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
9 | 3 | ||
10 | profstats: $(OBJS) $(ROOT)/config.mk | 4 | PROG = profstats |
11 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 5 | TARGET = $(PROG) |
12 | 6 | ||
13 | .PHONY: clean | 7 | MOD_HDRS = ../include/common.h |
14 | clean:; rm -fr *.o profstats *.gcov *.gcda *.gcno *.plist | ||
15 | 8 | ||
16 | .PHONY: distclean | 9 | include $(ROOT)/src/prog.mk |
17 | distclean: clean | ||
diff --git a/src/prog.mk b/src/prog.mk new file mode 100644 index 000000000..84f43142d --- /dev/null +++ b/src/prog.mk | |||
@@ -0,0 +1,36 @@ | |||
1 | # Common definitions for building C programs and non-shared objects. | ||
2 | # | ||
3 | # Note: $(ROOT)/config.mk must be included before this file. | ||
4 | # | ||
5 | # The includer should probably define PROG and TARGET and may also want to | ||
6 | # define MOD_HDRS, MOD_SRCS, MOD_OBJS, TOCLEAN and TODISTCLEAN. | ||
7 | |||
8 | HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS) | ||
9 | SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS) | ||
10 | OBJS := $(SRCS:.c=.o) $(MOD_OBJS) | ||
11 | |||
12 | CFLAGS += \ | ||
13 | -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \ | ||
14 | -fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \ | ||
15 | -fPIE \ | ||
16 | -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' \ | ||
17 | -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' \ | ||
18 | -DVARDIR='"/var/lib/firejail"' \ | ||
19 | $(HAVE_GCOV) $(MANFLAGS) | ||
20 | |||
21 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | ||
22 | |||
23 | .PHONY: all | ||
24 | all: $(TARGET) | ||
25 | |||
26 | %.o : %.c $(HDRS) $(ROOT)/config.mk | ||
27 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | ||
28 | |||
29 | $(PROG): $(OBJS) $(ROOT)/config.mk | ||
30 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | ||
31 | |||
32 | .PHONY: clean | ||
33 | clean:; rm -fr *.o $(PROG) *.gcov *.gcda *.gcno *.plist $(TOCLEAN) | ||
34 | |||
35 | .PHONY: distclean | ||
36 | distclean: clean; rm -fr $(TODISTCLEAN) | ||
diff --git a/src/so.mk b/src/so.mk new file mode 100644 index 000000000..10c43ad21 --- /dev/null +++ b/src/so.mk | |||
@@ -0,0 +1,32 @@ | |||
1 | # Common definitions for making shared objects. | ||
2 | # | ||
3 | # Note: $(ROOT)/config.mk must be included before this file. | ||
4 | # | ||
5 | # The includer should probably define SO and TARGET and may also want to define | ||
6 | # MOD_HDRS, MOD_SRCS, MOD_OBJS, TOCLEAN and TODISTCLEAN. | ||
7 | |||
8 | HDRS := $(sort $(wildcard *.h)) $(MOD_HDRS) | ||
9 | SRCS := $(sort $(wildcard *.c)) $(MOD_SRCS) | ||
10 | OBJS := $(SRCS:.c=.o) $(MOD_OBJS) | ||
11 | |||
12 | CFLAGS += \ | ||
13 | -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' \ | ||
14 | -fstack-protector-all -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security \ | ||
15 | -fPIC | ||
16 | |||
17 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | ||
18 | |||
19 | .PHONY: all | ||
20 | all: $(TARGET) | ||
21 | |||
22 | %.o : %.c $(HDRS) $(ROOT)/config.mk | ||
23 | $(CC) $(CFLAGS) $(INCLUDE) -c $< -o $@ | ||
24 | |||
25 | $(SO): $(OBJS) $(ROOT)/config.mk | ||
26 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | ||
27 | |||
28 | .PHONY: clean | ||
29 | clean:; rm -fr $(OBJS) $(SO) *.plist $(TOCLEAN) | ||
30 | |||
31 | .PHONY: distclean | ||
32 | distclean: clean; rm -fr $(TODISTCLEAN) | ||