diff options
-rw-r--r-- | .github/workflows/sort.yml | 2 | ||||
-rwxr-xr-x | contrib/sort.py | 11 | ||||
-rw-r--r-- | etc/apparmor/firejail-local | 3 | ||||
-rw-r--r-- | etc/profile-a-l/jitsi-meet-desktop.profile | 2 | ||||
-rw-r--r-- | etc/profile-m-z/start-tor-browser.desktop.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/start-tor-browser.profile | 3 | ||||
-rw-r--r-- | etc/profile-m-z/torbrowser-launcher.profile | 5 |
7 files changed, 21 insertions, 10 deletions
diff --git a/.github/workflows/sort.yml b/.github/workflows/sort.yml index 3e717f162..f3ded0f22 100644 --- a/.github/workflows/sort.yml +++ b/.github/workflows/sort.yml | |||
@@ -5,10 +5,12 @@ on: | |||
5 | branches: [ master ] | 5 | branches: [ master ] |
6 | paths: | 6 | paths: |
7 | - 'etc/**' | 7 | - 'etc/**' |
8 | - 'contrib/sort.py' | ||
8 | pull_request: | 9 | pull_request: |
9 | branches: [ master ] | 10 | branches: [ master ] |
10 | paths: | 11 | paths: |
11 | - 'etc/**' | 12 | - 'etc/**' |
13 | - 'contrib/sort.py' | ||
12 | 14 | ||
13 | jobs: | 15 | jobs: |
14 | profile-sort: | 16 | profile-sort: |
diff --git a/contrib/sort.py b/contrib/sort.py index 5df353549..9e5062c3c 100755 --- a/contrib/sort.py +++ b/contrib/sort.py | |||
@@ -80,7 +80,7 @@ def fix_profile(filename): | |||
80 | lines = profile.read().split("\n") | 80 | lines = profile.read().split("\n") |
81 | was_fixed = False | 81 | was_fixed = False |
82 | fixed_profile = [] | 82 | fixed_profile = [] |
83 | for line in lines: | 83 | for lineno, line in enumerate(lines): |
84 | if line[:12] in ("private-bin ", "private-etc ", "private-lib "): | 84 | if line[:12] in ("private-bin ", "private-etc ", "private-lib "): |
85 | fixed_line = f"{line[:12]}{sort_alphabetical(line[12:])}" | 85 | fixed_line = f"{line[:12]}{sort_alphabetical(line[12:])}" |
86 | elif line[:13] in ("seccomp.drop ", "seccomp.keep "): | 86 | elif line[:13] in ("seccomp.drop ", "seccomp.keep "): |
@@ -95,6 +95,10 @@ def fix_profile(filename): | |||
95 | fixed_line = line | 95 | fixed_line = line |
96 | if fixed_line != line: | 96 | if fixed_line != line: |
97 | was_fixed = True | 97 | was_fixed = True |
98 | print( | ||
99 | f"{filename}:{lineno + 1}:-{line}\n" | ||
100 | f"{filename}:{lineno + 1}:+{fixed_line}" | ||
101 | ) | ||
98 | fixed_profile.append(fixed_line) | 102 | fixed_profile.append(fixed_line) |
99 | if was_fixed: | 103 | if was_fixed: |
100 | profile.seek(0) | 104 | profile.seek(0) |
@@ -108,6 +112,7 @@ def fix_profile(filename): | |||
108 | 112 | ||
109 | def main(args): | 113 | def main(args): |
110 | exit_code = 0 | 114 | exit_code = 0 |
115 | print(f"sort.py: checking {len(args)} {'profiles' if len(args) != 1 else 'profile'}...") | ||
111 | for filename in args: | 116 | for filename in args: |
112 | try: | 117 | try: |
113 | if exit_code not in (1, 101): | 118 | if exit_code not in (1, 101): |
@@ -120,8 +125,8 @@ def main(args): | |||
120 | except PermissionError: | 125 | except PermissionError: |
121 | print(f"[ Error ] Can't read/write `{filename}'") | 126 | print(f"[ Error ] Can't read/write `{filename}'") |
122 | exit_code = 1 | 127 | exit_code = 1 |
123 | except: | 128 | except Exception as err: |
124 | print(f"[ Error ] An error occurred while processing `{filename}'") | 129 | print(f"[ Error ] An error occurred while processing `{filename}': {err}") |
125 | exit_code = 1 | 130 | exit_code = 1 |
126 | return exit_code | 131 | return exit_code |
127 | 132 | ||
diff --git a/etc/apparmor/firejail-local b/etc/apparmor/firejail-local index f086653f8..893a1ce46 100644 --- a/etc/apparmor/firejail-local +++ b/etc/apparmor/firejail-local | |||
@@ -1,2 +1,5 @@ | |||
1 | # Site-specific additions and overrides for 'firejail-default'. | 1 | # Site-specific additions and overrides for 'firejail-default'. |
2 | # For more details, please see /etc/apparmor.d/local/README. | 2 | # For more details, please see /etc/apparmor.d/local/README. |
3 | |||
4 | # Uncomment to opt-in to apparmor for torbrowser-launcher | ||
5 | #owner @{HOME}/.local/share/torbrowser/tbb/{i686,x86_64}/tor-browser_*/Browser/** ix, | ||
diff --git a/etc/profile-a-l/jitsi-meet-desktop.profile b/etc/profile-a-l/jitsi-meet-desktop.profile index e5beb741a..edb7ed840 100644 --- a/etc/profile-a-l/jitsi-meet-desktop.profile +++ b/etc/profile-a-l/jitsi-meet-desktop.profile | |||
@@ -20,7 +20,7 @@ nowhitelist ${DOWNLOADS} | |||
20 | mkdir ${HOME}/.config/Jitsi Meet | 20 | mkdir ${HOME}/.config/Jitsi Meet |
21 | whitelist ${HOME}/.config/Jitsi Meet | 21 | whitelist ${HOME}/.config/Jitsi Meet |
22 | 22 | ||
23 | private-bin bash,jitsi-meet-desktop | 23 | private-bin bash,electron,electron[0-9],electron[0-9][0-9],jitsi-meet-desktop,sh |
24 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,drirc,fonts,glvnd,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | 24 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,drirc,fonts,glvnd,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg |
25 | 25 | ||
26 | # Redirect | 26 | # Redirect |
diff --git a/etc/profile-m-z/start-tor-browser.desktop.profile b/etc/profile-m-z/start-tor-browser.desktop.profile index 7367d906e..2f73c9fee 100644 --- a/etc/profile-m-z/start-tor-browser.desktop.profile +++ b/etc/profile-m-z/start-tor-browser.desktop.profile | |||
@@ -4,7 +4,7 @@ | |||
4 | include start-tor-browser.desktop.local | 4 | include start-tor-browser.desktop.local |
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | # added by included profile | 6 | # added by included profile |
7 | include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.tor-browser* | 9 | noblacklist ${HOME}/.tor-browser* |
10 | 10 | ||
@@ -72,8 +72,5 @@ whitelist ${HOME}/.tor-browser_vi | |||
72 | whitelist ${HOME}/.tor-browser_zh-CN | 72 | whitelist ${HOME}/.tor-browser_zh-CN |
73 | whitelist ${HOME}/.tor-browser_zh-TW | 73 | whitelist ${HOME}/.tor-browser_zh-TW |
74 | 74 | ||
75 | # Ignoring apparmor, tor browser is installed in user home directory using the binary archive distributed by Tor Foundation | ||
76 | ignore apparmor | ||
77 | |||
78 | # Redirect | 75 | # Redirect |
79 | include torbrowser-launcher.profile | 76 | include torbrowser-launcher.profile |
diff --git a/etc/profile-m-z/start-tor-browser.profile b/etc/profile-m-z/start-tor-browser.profile index b5c4d211e..17ceedee7 100644 --- a/etc/profile-m-z/start-tor-browser.profile +++ b/etc/profile-m-z/start-tor-browser.profile | |||
@@ -3,7 +3,8 @@ | |||
3 | # Persistent local customizations | 3 | # Persistent local customizations |
4 | include start-tor-browser.local | 4 | include start-tor-browser.local |
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | # added by included profile |
7 | #include globals.local | ||
7 | 8 | ||
8 | # Redirect | 9 | # Redirect |
9 | include start-tor-browser.desktop.profile | 10 | include start-tor-browser.desktop.profile |
diff --git a/etc/profile-m-z/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index eb90f0030..1045fa02a 100644 --- a/etc/profile-m-z/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -31,7 +31,10 @@ whitelist ${HOME}/.local/share/torbrowser | |||
31 | include whitelist-common.inc | 31 | include whitelist-common.inc |
32 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
33 | 33 | ||
34 | apparmor | 34 | # Uncomment the line below or put 'apparmor' in your torbrowser-launcher.local. |
35 | # IMPORTANT: the relevant rule in /etc/apparmor.d/local/firejail-default will need | ||
36 | # to be uncommented too for this to work as expected. | ||
37 | #apparmor | ||
35 | caps.drop all | 38 | caps.drop all |
36 | netfilter | 39 | netfilter |
37 | nodvd | 40 | nodvd |