diff options
-rw-r--r-- | .github/workflows/codeql-analysis.yml | 6 | ||||
-rw-r--r-- | README.md | 2 | ||||
-rwxr-xr-x | configure | 18 | ||||
-rw-r--r-- | configure.ac | 9 | ||||
-rw-r--r-- | etc/inc/disable-programs.inc | 3 | ||||
-rw-r--r-- | etc/profile-a-l/email-common.profile | 2 | ||||
-rw-r--r-- | etc/profile-a-l/geary.profile | 18 | ||||
-rw-r--r-- | etc/profile-m-z/man.profile | 1 | ||||
-rw-r--r-- | etc/profile-m-z/opera-beta.profile | 14 | ||||
-rw-r--r-- | etc/profile-m-z/opera-developer.profile | 20 | ||||
-rw-r--r-- | etc/profile-m-z/opera.profile | 5 | ||||
-rw-r--r-- | etc/profile-m-z/thunderbird.profile | 1 | ||||
-rw-r--r-- | src/common.mk.in | 3 | ||||
-rw-r--r-- | src/firecfg/desktop_files.c | 9 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 1 | ||||
-rw-r--r-- | src/firejail/fs.c | 2 | ||||
-rw-r--r-- | src/firejail/macros.c | 20 | ||||
-rw-r--r-- | src/firejail/profile.c | 4 |
18 files changed, 104 insertions, 34 deletions
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 89f65d75e..a3b89def5 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml | |||
@@ -47,7 +47,7 @@ jobs: | |||
47 | 47 | ||
48 | # Initializes the CodeQL tools for scanning. | 48 | # Initializes the CodeQL tools for scanning. |
49 | - name: Initialize CodeQL | 49 | - name: Initialize CodeQL |
50 | uses: github/codeql-action/init@d39d5d5c9707b926d517b1b292905ef4c03aa777 | 50 | uses: github/codeql-action/init@75f07e7ab2ee63cba88752d8c696324e4df67466 |
51 | with: | 51 | with: |
52 | languages: ${{ matrix.language }} | 52 | languages: ${{ matrix.language }} |
53 | # If you wish to specify custom queries, you can do so here or in a config file. | 53 | # If you wish to specify custom queries, you can do so here or in a config file. |
@@ -58,7 +58,7 @@ jobs: | |||
58 | # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). | 58 | # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). |
59 | # If this step fails, then you should remove it and run the build manually (see below) | 59 | # If this step fails, then you should remove it and run the build manually (see below) |
60 | - name: Autobuild | 60 | - name: Autobuild |
61 | uses: github/codeql-action/autobuild@d39d5d5c9707b926d517b1b292905ef4c03aa777 | 61 | uses: github/codeql-action/autobuild@75f07e7ab2ee63cba88752d8c696324e4df67466 |
62 | 62 | ||
63 | # ℹ️ Command-line programs to run using the OS shell. | 63 | # ℹ️ Command-line programs to run using the OS shell. |
64 | # 📚 https://git.io/JvXDl | 64 | # 📚 https://git.io/JvXDl |
@@ -72,4 +72,4 @@ jobs: | |||
72 | # make release | 72 | # make release |
73 | 73 | ||
74 | - name: Perform CodeQL Analysis | 74 | - name: Perform CodeQL Analysis |
75 | uses: github/codeql-action/analyze@d39d5d5c9707b926d517b1b292905ef4c03aa777 | 75 | uses: github/codeql-action/analyze@75f07e7ab2ee63cba88752d8c696324e4df67466 |
@@ -259,4 +259,4 @@ Stats: | |||
259 | 259 | ||
260 | ### New profiles: | 260 | ### New profiles: |
261 | 261 | ||
262 | onionshare, onionshare-cli | 262 | onionshare, onionshare-cli, opera-developer |
@@ -628,6 +628,7 @@ EGREP | |||
628 | GREP | 628 | GREP |
629 | CPP | 629 | CPP |
630 | HAVE_LTS | 630 | HAVE_LTS |
631 | HAVE_ONLY_SYSCFG_PROFILES | ||
631 | HAVE_FORCE_NONEWPRIVS | 632 | HAVE_FORCE_NONEWPRIVS |
632 | HAVE_CONTRIB_INSTALL | 633 | HAVE_CONTRIB_INSTALL |
633 | HAVE_GCOV | 634 | HAVE_GCOV |
@@ -732,6 +733,7 @@ enable_busybox_workaround | |||
732 | enable_gcov | 733 | enable_gcov |
733 | enable_contrib_install | 734 | enable_contrib_install |
734 | enable_force_nonewprivs | 735 | enable_force_nonewprivs |
736 | enable_only_syscfg_profiles | ||
735 | enable_lts | 737 | enable_lts |
736 | ' | 738 | ' |
737 | ac_precious_vars='build_alias | 739 | ac_precious_vars='build_alias |
@@ -1395,6 +1397,8 @@ Optional Features: | |||
1395 | install contrib scripts | 1397 | install contrib scripts |
1396 | --enable-force-nonewprivs | 1398 | --enable-force-nonewprivs |
1397 | enable force nonewprivs | 1399 | enable force nonewprivs |
1400 | --enable-only-syscfg-profiles | ||
1401 | disable profiles in $HOME/.config/firejail | ||
1398 | --enable-lts enable long-term support software version (LTS) | 1402 | --enable-lts enable long-term support software version (LTS) |
1399 | 1403 | ||
1400 | Some influential environment variables: | 1404 | Some influential environment variables: |
@@ -3830,6 +3834,19 @@ if test "x$enable_force_nonewprivs" = "xyes"; then : | |||
3830 | 3834 | ||
3831 | fi | 3835 | fi |
3832 | 3836 | ||
3837 | HAVE_ONLY_SYSCFG_PROFILES="" | ||
3838 | |||
3839 | # Check whether --enable-only-syscfg-profiles was given. | ||
3840 | if test "${enable_only_syscfg_profiles+set}" = set; then : | ||
3841 | enableval=$enable_only_syscfg_profiles; | ||
3842 | fi | ||
3843 | |||
3844 | if test "x$enable_only_syscfg_profiles" = "xyes"; then : | ||
3845 | |||
3846 | HAVE_ONLY_SYSCFG_PROFILES="-DHAVE_ONLY_SYSCFG_PROFILES" | ||
3847 | |||
3848 | fi | ||
3849 | |||
3833 | HAVE_LTS="" | 3850 | HAVE_LTS="" |
3834 | 3851 | ||
3835 | # Check whether --enable-lts was given. | 3852 | # Check whether --enable-lts was given. |
@@ -5497,6 +5514,7 @@ Configuration options: | |||
5497 | Install as a SUID executable: $HAVE_SUID | 5514 | Install as a SUID executable: $HAVE_SUID |
5498 | LTS: $HAVE_LTS | 5515 | LTS: $HAVE_LTS |
5499 | Always enforce filters: $HAVE_FORCE_NONEWPRIVS | 5516 | Always enforce filters: $HAVE_FORCE_NONEWPRIVS |
5517 | Disable user profiles: $HAVE_ONLY_SYSCFG_PROFILES | ||
5500 | 5518 | ||
5501 | EOF | 5519 | EOF |
5502 | 5520 | ||
diff --git a/configure.ac b/configure.ac index 0ae9362cc..4ca30e6d7 100644 --- a/configure.ac +++ b/configure.ac | |||
@@ -237,6 +237,14 @@ AS_IF([test "x$enable_force_nonewprivs" = "xyes"], [ | |||
237 | HAVE_FORCE_NONEWPRIVS="-DHAVE_FORCE_NONEWPRIVS" | 237 | HAVE_FORCE_NONEWPRIVS="-DHAVE_FORCE_NONEWPRIVS" |
238 | ]) | 238 | ]) |
239 | 239 | ||
240 | HAVE_ONLY_SYSCFG_PROFILES="" | ||
241 | AC_SUBST([HAVE_ONLY_SYSCFG_PROFILES]) | ||
242 | AC_ARG_ENABLE([only-syscfg-profiles], | ||
243 | [AS_HELP_STRING([--enable-only-syscfg-profiles], [disable profiles in $HOME/.config/firejail])]) | ||
244 | AS_IF([test "x$enable_only_syscfg_profiles" = "xyes"], [ | ||
245 | HAVE_ONLY_SYSCFG_PROFILES="-DHAVE_ONLY_SYSCFG_PROFILES" | ||
246 | ]) | ||
247 | |||
240 | HAVE_LTS="" | 248 | HAVE_LTS="" |
241 | AC_SUBST([HAVE_LTS]) | 249 | AC_SUBST([HAVE_LTS]) |
242 | AC_ARG_ENABLE([lts], | 250 | AC_ARG_ENABLE([lts], |
@@ -305,6 +313,7 @@ Configuration options: | |||
305 | Install as a SUID executable: $HAVE_SUID | 313 | Install as a SUID executable: $HAVE_SUID |
306 | LTS: $HAVE_LTS | 314 | LTS: $HAVE_LTS |
307 | Always enforce filters: $HAVE_FORCE_NONEWPRIVS | 315 | Always enforce filters: $HAVE_FORCE_NONEWPRIVS |
316 | Disable user profiles: $HAVE_ONLY_SYSCFG_PROFILES | ||
308 | 317 | ||
309 | EOF | 318 | EOF |
310 | 319 | ||
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 6b9747fb4..5078ec82f 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -177,6 +177,7 @@ blacklist ${HOME}/.cache/nvim | |||
177 | blacklist ${HOME}/.cache/okular | 177 | blacklist ${HOME}/.cache/okular |
178 | blacklist ${HOME}/.cache/opera | 178 | blacklist ${HOME}/.cache/opera |
179 | blacklist ${HOME}/.cache/opera-beta | 179 | blacklist ${HOME}/.cache/opera-beta |
180 | blacklist ${HOME}/.cache/opera-developer | ||
180 | blacklist ${HOME}/.cache/org.gabmus.gfeeds | 181 | blacklist ${HOME}/.cache/org.gabmus.gfeeds |
181 | blacklist ${HOME}/.cache/org.gnome.Books | 182 | blacklist ${HOME}/.cache/org.gnome.Books |
182 | blacklist ${HOME}/.cache/org.gnome.Maps | 183 | blacklist ${HOME}/.cache/org.gnome.Maps |
@@ -553,6 +554,7 @@ blacklist ${HOME}/.config/onlyoffice | |||
553 | blacklist ${HOME}/.config/openmw | 554 | blacklist ${HOME}/.config/openmw |
554 | blacklist ${HOME}/.config/opera | 555 | blacklist ${HOME}/.config/opera |
555 | blacklist ${HOME}/.config/opera-beta | 556 | blacklist ${HOME}/.config/opera-beta |
557 | blacklist ${HOME}/.config/opera-developer | ||
556 | blacklist ${HOME}/.config/orage | 558 | blacklist ${HOME}/.config/orage |
557 | blacklist ${HOME}/.config/org.gabmus.gfeeds.json | 559 | blacklist ${HOME}/.config/org.gabmus.gfeeds.json |
558 | blacklist ${HOME}/.config/org.gabmus.gfeeds.saved_articles | 560 | blacklist ${HOME}/.config/org.gabmus.gfeeds.saved_articles |
@@ -1040,6 +1042,7 @@ blacklist ${HOME}/.openshot_qt | |||
1040 | blacklist ${HOME}/.openttd | 1042 | blacklist ${HOME}/.openttd |
1041 | blacklist ${HOME}/.opera | 1043 | blacklist ${HOME}/.opera |
1042 | blacklist ${HOME}/.opera-beta | 1044 | blacklist ${HOME}/.opera-beta |
1045 | blacklist ${HOME}/.opera-developer | ||
1043 | blacklist ${HOME}/.ostrichriders | 1046 | blacklist ${HOME}/.ostrichriders |
1044 | blacklist ${HOME}/.paradoxinteractive | 1047 | blacklist ${HOME}/.paradoxinteractive |
1045 | blacklist ${HOME}/.parallelrealities/blobwars | 1048 | blacklist ${HOME}/.parallelrealities/blobwars |
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile index ac73f002f..b45f6e25e 100644 --- a/etc/profile-a-l/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -66,7 +66,7 @@ tracelog | |||
66 | # disable-mnt | 66 | # disable-mnt |
67 | private-cache | 67 | private-cache |
68 | private-dev | 68 | private-dev |
69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg | 69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,gnupg,groups,gtk-2.0,gtk-3.0,hostname,hosts,hosts.conf,ld.so.cache,ld.so.preload,machine-id,mailname,nsswitch.conf,passwd,pki,resolv.conf,selinux,ssl,xdg |
70 | private-tmp | 70 | private-tmp |
71 | # encrypting and signing email | 71 | # encrypting and signing email |
72 | writable-run-user | 72 | writable-run-user |
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile index cececd9e9..221fbff01 100644 --- a/etc/profile-a-l/geary.profile +++ b/etc/profile-a-l/geary.profile | |||
@@ -13,7 +13,11 @@ noblacklist ${HOME}/.config/evolution | |||
13 | noblacklist ${HOME}/.config/geary | 13 | noblacklist ${HOME}/.config/geary |
14 | noblacklist ${HOME}/.local/share/evolution | 14 | noblacklist ${HOME}/.local/share/evolution |
15 | noblacklist ${HOME}/.local/share/geary | 15 | noblacklist ${HOME}/.local/share/geary |
16 | noblacklist ${HOME}/.local/share/pki | ||
16 | noblacklist ${HOME}/.mozilla | 17 | noblacklist ${HOME}/.mozilla |
18 | noblacklist ${HOME}/.pki | ||
19 | |||
20 | include allow-bin-sh.inc | ||
17 | 21 | ||
18 | include disable-common.inc | 22 | include disable-common.inc |
19 | include disable-devel.inc | 23 | include disable-devel.inc |
@@ -38,7 +42,9 @@ whitelist ${HOME}/.config/evolution | |||
38 | whitelist ${HOME}/.config/geary | 42 | whitelist ${HOME}/.config/geary |
39 | whitelist ${HOME}/.local/share/evolution | 43 | whitelist ${HOME}/.local/share/evolution |
40 | whitelist ${HOME}/.local/share/geary | 44 | whitelist ${HOME}/.local/share/geary |
45 | whitelist ${HOME}/.local/share/pki | ||
41 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | 46 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
47 | whitelist ${HOME}/.pki | ||
42 | whitelist /usr/share/geary | 48 | whitelist /usr/share/geary |
43 | include whitelist-common.inc | 49 | include whitelist-common.inc |
44 | include whitelist-runuser-common.inc | 50 | include whitelist-runuser-common.inc |
@@ -47,7 +53,8 @@ include whitelist-var-common.inc | |||
47 | 53 | ||
48 | apparmor | 54 | apparmor |
49 | caps.drop all | 55 | caps.drop all |
50 | machine-id | 56 | #ipc-namespace - may cause issues with X11 |
57 | #machine-id | ||
51 | netfilter | 58 | netfilter |
52 | no3d | 59 | no3d |
53 | nodvd | 60 | nodvd |
@@ -55,7 +62,7 @@ nogroups | |||
55 | noinput | 62 | noinput |
56 | nonewprivs | 63 | nonewprivs |
57 | noroot | 64 | noroot |
58 | nosound | 65 | #nosound |
59 | notv | 66 | notv |
60 | nou2f | 67 | nou2f |
61 | novideo | 68 | novideo |
@@ -66,21 +73,22 @@ shell none | |||
66 | tracelog | 73 | tracelog |
67 | 74 | ||
68 | # disable-mnt | 75 | # disable-mnt |
69 | # Add 'ignore private-bin' to geary.local for hyperlink support | 76 | #private-bin geary,sh |
70 | private-bin geary | ||
71 | private-cache | 77 | private-cache |
72 | private-dev | 78 | private-dev |
73 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,ld.so.preload,pki,resolv.conf,ssl,xdg | 79 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,gtk-3.0,hostname,hosts,ld.so.cache,ld.so.preload,machine-id,mailcap,mime.types,nsswitch.conf,passwd,pki,resolv.conf,ssl,xdg |
74 | private-tmp | 80 | private-tmp |
75 | 81 | ||
76 | dbus-user filter | 82 | dbus-user filter |
77 | dbus-user.own org.gnome.Geary | 83 | dbus-user.own org.gnome.Geary |
78 | dbus-user.talk ca.desrt.dconf | 84 | dbus-user.talk ca.desrt.dconf |
85 | dbus-user.talk org.freedesktop.Notifications | ||
79 | dbus-user.talk org.freedesktop.secrets | 86 | dbus-user.talk org.freedesktop.secrets |
80 | dbus-user.talk org.gnome.Contacts | 87 | dbus-user.talk org.gnome.Contacts |
81 | dbus-user.talk org.gnome.OnlineAccounts | 88 | dbus-user.talk org.gnome.OnlineAccounts |
82 | dbus-user.talk org.gnome.evolution.dataserver.AddressBook10 | 89 | dbus-user.talk org.gnome.evolution.dataserver.AddressBook10 |
83 | dbus-user.talk org.gnome.evolution.dataserver.Sources5 | 90 | dbus-user.talk org.gnome.evolution.dataserver.Sources5 |
91 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher | ||
84 | dbus-system none | 92 | dbus-system none |
85 | 93 | ||
86 | read-only ${HOME}/.mozilla/firefox/profiles.ini | 94 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
diff --git a/etc/profile-m-z/man.profile b/etc/profile-m-z/man.profile index 2e28423f7..ed3dac10e 100644 --- a/etc/profile-m-z/man.profile +++ b/etc/profile-m-z/man.profile | |||
@@ -25,7 +25,6 @@ include disable-xdg.inc | |||
25 | whitelist /usr/share/groff | 25 | whitelist /usr/share/groff |
26 | whitelist /usr/share/info | 26 | whitelist /usr/share/info |
27 | whitelist /usr/share/lintian | 27 | whitelist /usr/share/lintian |
28 | whitelist /usr/share/locale | ||
29 | whitelist /usr/share/man | 28 | whitelist /usr/share/man |
30 | whitelist /var/cache/man | 29 | whitelist /var/cache/man |
31 | #include whitelist-common.inc | 30 | #include whitelist-common.inc |
diff --git a/etc/profile-m-z/opera-beta.profile b/etc/profile-m-z/opera-beta.profile index 551f1aba4..becd3f86c 100644 --- a/etc/profile-m-z/opera-beta.profile +++ b/etc/profile-m-z/opera-beta.profile | |||
@@ -5,18 +5,16 @@ include opera-beta.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | 8 | noblacklist ${HOME}/.cache/opera-beta |
9 | ignore whitelist /usr/share/chromium | ||
10 | ignore include whitelist-runuser-common.inc | ||
11 | ignore include whitelist-usr-share-common.inc | ||
12 | |||
13 | noblacklist ${HOME}/.cache/opera | ||
14 | noblacklist ${HOME}/.config/opera-beta | 9 | noblacklist ${HOME}/.config/opera-beta |
10 | noblacklist ${HOME}/.opera-beta | ||
15 | 11 | ||
16 | mkdir ${HOME}/.cache/opera | 12 | mkdir ${HOME}/.cache/opera-beta |
17 | mkdir ${HOME}/.config/opera-beta | 13 | mkdir ${HOME}/.config/opera-beta |
18 | whitelist ${HOME}/.cache/opera | 14 | mkdir ${HOME}/.opera-beta |
15 | whitelist ${HOME}/.cache/opera-beta | ||
19 | whitelist ${HOME}/.config/opera-beta | 16 | whitelist ${HOME}/.config/opera-beta |
17 | whitelist ${HOME}/.opera-beta | ||
20 | 18 | ||
21 | # Redirect | 19 | # Redirect |
22 | include chromium-common.profile | 20 | include chromium-common.profile |
diff --git a/etc/profile-m-z/opera-developer.profile b/etc/profile-m-z/opera-developer.profile new file mode 100644 index 000000000..52c850227 --- /dev/null +++ b/etc/profile-m-z/opera-developer.profile | |||
@@ -0,0 +1,20 @@ | |||
1 | # Firejail profile for opera-developer | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include opera-developer.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | noblacklist ${HOME}/.cache/opera-developer | ||
9 | noblacklist ${HOME}/.config/opera-developer | ||
10 | noblacklist ${HOME}/.opera-developer | ||
11 | |||
12 | mkdir ${HOME}/.cache/opera-developer | ||
13 | mkdir ${HOME}/.config/opera-developer | ||
14 | mkdir ${HOME}/.opera-developer | ||
15 | whitelist ${HOME}/.cache/opera-developer | ||
16 | whitelist ${HOME}/.config/opera-developer | ||
17 | whitelist ${HOME}/.opera-developer | ||
18 | |||
19 | # Redirect | ||
20 | include chromium-common.profile | ||
diff --git a/etc/profile-m-z/opera.profile b/etc/profile-m-z/opera.profile index 2c7c5fc35..b342b3961 100644 --- a/etc/profile-m-z/opera.profile +++ b/etc/profile-m-z/opera.profile | |||
@@ -6,11 +6,6 @@ include opera.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disable for now, see https://www.tutorialspoint.com/difference-between-void-main-and-int-main-in-c-cplusplus | ||
10 | ignore whitelist /usr/share/chromium | ||
11 | ignore include whitelist-runuser-common.inc | ||
12 | ignore include whitelist-usr-share-common.inc | ||
13 | |||
14 | noblacklist ${HOME}/.cache/opera | 9 | noblacklist ${HOME}/.cache/opera |
15 | noblacklist ${HOME}/.config/opera | 10 | noblacklist ${HOME}/.config/opera |
16 | noblacklist ${HOME}/.opera | 11 | noblacklist ${HOME}/.opera |
diff --git a/etc/profile-m-z/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index b66b81fdf..1ac80bc9a 100644 --- a/etc/profile-m-z/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile | |||
@@ -47,6 +47,7 @@ whitelist ${HOME}/.gnupg | |||
47 | whitelist ${HOME}/.thunderbird | 47 | whitelist ${HOME}/.thunderbird |
48 | 48 | ||
49 | whitelist /usr/share/gnupg | 49 | whitelist /usr/share/gnupg |
50 | whitelist /usr/share/gnupg2 | ||
50 | whitelist /usr/share/mozilla | 51 | whitelist /usr/share/mozilla |
51 | whitelist /usr/share/thunderbird | 52 | whitelist /usr/share/thunderbird |
52 | whitelist /usr/share/webext | 53 | whitelist /usr/share/webext |
diff --git a/src/common.mk.in b/src/common.mk.in index c55c26f42..38c05bc69 100644 --- a/src/common.mk.in +++ b/src/common.mk.in | |||
@@ -28,6 +28,7 @@ HAVE_USERTMPFS=@HAVE_USERTMPFS@ | |||
28 | HAVE_OUTPUT=@HAVE_OUTPUT@ | 28 | HAVE_OUTPUT=@HAVE_OUTPUT@ |
29 | HAVE_LTS=@HAVE_LTS@ | 29 | HAVE_LTS=@HAVE_LTS@ |
30 | HAVE_FORCE_NONEWPRIVS=@HAVE_FORCE_NONEWPRIVS@ | 30 | HAVE_FORCE_NONEWPRIVS=@HAVE_FORCE_NONEWPRIVS@ |
31 | HAVE_ONLY_SYSCFG_PROFILES=@HAVE_ONLY_SYSCFG_PROFILES@ | ||
31 | 32 | ||
32 | H_FILE_LIST = $(sort $(wildcard *.h)) | 33 | H_FILE_LIST = $(sort $(wildcard *.h)) |
33 | C_FILE_LIST = $(sort $(wildcard *.c)) | 34 | C_FILE_LIST = $(sort $(wildcard *.c)) |
@@ -37,7 +38,7 @@ BINOBJS = $(foreach file, $(OBJS), $file) | |||
37 | CFLAGS = @CFLAGS@ | 38 | CFLAGS = @CFLAGS@ |
38 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) | 39 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV) |
39 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' -DVARDIR='"/var/lib/firejail"' | 40 | CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"' -DVARDIR='"/var/lib/firejail"' |
40 | MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) | 41 | MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_SELINUX) $(HAVE_SUID) $(HAVE_FORCE_NONEWPRIVS) $(HAVE_ONLY_SYSCFG_PROFILES) |
41 | CFLAGS += $(MANFLAGS) | 42 | CFLAGS += $(MANFLAGS) |
42 | CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security | 43 | CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security |
43 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | 44 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now |
diff --git a/src/firecfg/desktop_files.c b/src/firecfg/desktop_files.c index d434cb95e..408662907 100644 --- a/src/firecfg/desktop_files.c +++ b/src/firecfg/desktop_files.c | |||
@@ -24,11 +24,16 @@ | |||
24 | static int check_profile(const char *name, const char *homedir) { | 24 | static int check_profile(const char *name, const char *homedir) { |
25 | // build profile name | 25 | // build profile name |
26 | char *profname1; | 26 | char *profname1; |
27 | #ifndef HAVE_ONLY_SYSCFG_PROFILES | ||
27 | char *profname2; | 28 | char *profname2; |
29 | #endif | ||
28 | if (asprintf(&profname1, "%s/%s.profile", SYSCONFDIR, name) == -1) | 30 | if (asprintf(&profname1, "%s/%s.profile", SYSCONFDIR, name) == -1) |
29 | errExit("asprintf"); | 31 | errExit("asprintf"); |
32 | |||
33 | #ifndef HAVE_ONLY_SYSCFG_PROFILES | ||
30 | if (asprintf(&profname2, "%s/.config/firejail/%s.profile", homedir, name) == -1) | 34 | if (asprintf(&profname2, "%s/.config/firejail/%s.profile", homedir, name) == -1) |
31 | errExit("asprintf"); | 35 | errExit("asprintf"); |
36 | #endif | ||
32 | 37 | ||
33 | int rv = 0; | 38 | int rv = 0; |
34 | if (access(profname1, R_OK) == 0) { | 39 | if (access(profname1, R_OK) == 0) { |
@@ -36,14 +41,18 @@ static int check_profile(const char *name, const char *homedir) { | |||
36 | printf("found %s\n", profname1); | 41 | printf("found %s\n", profname1); |
37 | rv = 1; | 42 | rv = 1; |
38 | } | 43 | } |
44 | #ifndef HAVE_ONLY_SYSCFG_PROFILES | ||
39 | else if (access(profname2, R_OK) == 0) { | 45 | else if (access(profname2, R_OK) == 0) { |
40 | if (arg_debug) | 46 | if (arg_debug) |
41 | printf("found %s\n", profname2); | 47 | printf("found %s\n", profname2); |
42 | rv = 1; | 48 | rv = 1; |
43 | } | 49 | } |
50 | #endif | ||
44 | 51 | ||
45 | free(profname1); | 52 | free(profname1); |
53 | #ifndef HAVE_ONLY_SYSCFG_PROFILES | ||
46 | free(profname2); | 54 | free(profname2); |
55 | #endif | ||
47 | return rv; | 56 | return rv; |
48 | } | 57 | } |
49 | 58 | ||
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 21fcbe1f4..618093193 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -627,6 +627,7 @@ openstego | |||
627 | openttd | 627 | openttd |
628 | opera | 628 | opera |
629 | opera-beta | 629 | opera-beta |
630 | opera-developer | ||
630 | orage | 631 | orage |
631 | ostrichriders | 632 | ostrichriders |
632 | otter-browser | 633 | otter-browser |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 04ea715cd..c03cd7a12 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -825,11 +825,13 @@ void fs_proc_sys_dev_boot(void) { | |||
825 | // disable firejail configuration in ~/.config/firejail | 825 | // disable firejail configuration in ~/.config/firejail |
826 | void disable_config(void) { | 826 | void disable_config(void) { |
827 | EUID_USER(); | 827 | EUID_USER(); |
828 | #ifndef HAVE_ONLY_SYSCFG_PROFILES | ||
828 | char *fname; | 829 | char *fname; |
829 | if (asprintf(&fname, "%s/.config/firejail", cfg.homedir) == -1) | 830 | if (asprintf(&fname, "%s/.config/firejail", cfg.homedir) == -1) |
830 | errExit("asprintf"); | 831 | errExit("asprintf"); |
831 | disable_file(BLACKLIST_FILE, fname); | 832 | disable_file(BLACKLIST_FILE, fname); |
832 | free(fname); | 833 | free(fname); |
834 | #endif | ||
833 | 835 | ||
834 | // disable run time information | 836 | // disable run time information |
835 | disable_file(BLACKLIST_FILE, RUN_FIREJAIL_NETWORK_DIR); | 837 | disable_file(BLACKLIST_FILE, RUN_FIREJAIL_NETWORK_DIR); |
diff --git a/src/firejail/macros.c b/src/firejail/macros.c index 11385143a..0ba64e844 100644 --- a/src/firejail/macros.c +++ b/src/firejail/macros.c | |||
@@ -22,9 +22,11 @@ | |||
22 | #define MAXBUF 4098 | 22 | #define MAXBUF 4098 |
23 | 23 | ||
24 | typedef struct macro_t { | 24 | typedef struct macro_t { |
25 | char *name; // macro name | 25 | char *name; // macro name |
26 | char *xdg; // xdg line in ~/.config/user-dirs.dirs | 26 | char *xdg; // xdg line in ~/.config/user-dirs.dirs |
27 | #define MAX_TRANSLATIONS 3 // several translations in case ~/.config/user-dirs.dirs not found | 27 | // several translations in case ~/.config/user-dirs.dirs not found: |
28 | // English, Russian, French, Italian, Spanish, Portuguese, German | ||
29 | #define MAX_TRANSLATIONS 7 | ||
28 | char *translation[MAX_TRANSLATIONS]; | 30 | char *translation[MAX_TRANSLATIONS]; |
29 | } Macro; | 31 | } Macro; |
30 | 32 | ||
@@ -32,37 +34,37 @@ Macro macro[] = { | |||
32 | { | 34 | { |
33 | "${DOWNLOADS}", | 35 | "${DOWNLOADS}", |
34 | "XDG_DOWNLOAD_DIR=\"$HOME/", | 36 | "XDG_DOWNLOAD_DIR=\"$HOME/", |
35 | { "Downloads", "Загрузки", "Téléchargement" } | 37 | { "Downloads", "Загрузки", "Téléchargement", "Scaricati", "Descargas", "Downloads", "Downloads" } |
36 | }, | 38 | }, |
37 | 39 | ||
38 | { | 40 | { |
39 | "${MUSIC}", | 41 | "${MUSIC}", |
40 | "XDG_MUSIC_DIR=\"$HOME/", | 42 | "XDG_MUSIC_DIR=\"$HOME/", |
41 | {"Music", "Музыка", "Musique"} | 43 | {"Music", "Музыка", "Musique", "Musica", "Música", "Música", "Musik" } |
42 | }, | 44 | }, |
43 | 45 | ||
44 | { | 46 | { |
45 | "${VIDEOS}", | 47 | "${VIDEOS}", |
46 | "XDG_VIDEOS_DIR=\"$HOME/", | 48 | "XDG_VIDEOS_DIR=\"$HOME/", |
47 | {"Videos", "Видео", "Vidéos"} | 49 | {"Videos", "Видео", "Vidéos", "Video", "Vídeos", "Vídeos", "Videos" } |
48 | }, | 50 | }, |
49 | 51 | ||
50 | { | 52 | { |
51 | "${PICTURES}", | 53 | "${PICTURES}", |
52 | "XDG_PICTURES_DIR=\"$HOME/", | 54 | "XDG_PICTURES_DIR=\"$HOME/", |
53 | {"Pictures", "Изображения", "Photos"} | 55 | {"Pictures", "Изображения", "Photos", "Immagini", "Imágenes", "Imagens", "Bilder" } |
54 | }, | 56 | }, |
55 | 57 | ||
56 | { | 58 | { |
57 | "${DESKTOP}", | 59 | "${DESKTOP}", |
58 | "XDG_DESKTOP_DIR=\"$HOME/", | 60 | "XDG_DESKTOP_DIR=\"$HOME/", |
59 | {"Desktop", "Рабочий стол", "Bureau"} | 61 | {"Desktop", "Рабочий стол", "Bureau", "Scrivania", "Escritorio", "Área de trabalho", "Schreibtisch" } |
60 | }, | 62 | }, |
61 | 63 | ||
62 | { | 64 | { |
63 | "${DOCUMENTS}", | 65 | "${DOCUMENTS}", |
64 | "XDG_DOCUMENTS_DIR=\"$HOME/", | 66 | "XDG_DOCUMENTS_DIR=\"$HOME/", |
65 | {"Documents", "Документы", "Documents"} | 67 | {"Documents", "Документы", "Documents", "Documenti", "Documentos", "Documentos", "Dokumente" } |
66 | }, | 68 | }, |
67 | 69 | ||
68 | { 0 } | 70 | { 0 } |
@@ -154,7 +156,7 @@ static char *resolve_hardcoded(char *entries[]) { | |||
154 | struct stat s; | 156 | struct stat s; |
155 | 157 | ||
156 | int i = 0; | 158 | int i = 0; |
157 | while (entries[i] != NULL) { | 159 | while (i < MAX_TRANSLATIONS && entries[i] != NULL) { |
158 | if (asprintf(&fname, "%s/%s", cfg.homedir, entries[i]) == -1) | 160 | if (asprintf(&fname, "%s/%s", cfg.homedir, entries[i]) == -1) |
159 | errExit("asprintf"); | 161 | errExit("asprintf"); |
160 | 162 | ||
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 0b258e6bb..5bc77263a 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -72,6 +72,7 @@ static int profile_find(const char *name, const char *dir, int add_ext) { | |||
72 | // search and read the profile specified by name from firejail directories | 72 | // search and read the profile specified by name from firejail directories |
73 | // return 1 if a profile was found | 73 | // return 1 if a profile was found |
74 | int profile_find_firejail(const char *name, int add_ext) { | 74 | int profile_find_firejail(const char *name, int add_ext) { |
75 | #ifndef HAVE_ONLY_SYSCFG_PROFILES | ||
75 | // look for a profile in ~/.config/firejail directory | 76 | // look for a profile in ~/.config/firejail directory |
76 | char *usercfgdir; | 77 | char *usercfgdir; |
77 | if (asprintf(&usercfgdir, "%s/.config/firejail", cfg.homedir) == -1) | 78 | if (asprintf(&usercfgdir, "%s/.config/firejail", cfg.homedir) == -1) |
@@ -84,6 +85,9 @@ int profile_find_firejail(const char *name, int add_ext) { | |||
84 | rv = profile_find(name, SYSCONFDIR, add_ext); | 85 | rv = profile_find(name, SYSCONFDIR, add_ext); |
85 | 86 | ||
86 | return rv; | 87 | return rv; |
88 | #else | ||
89 | return profile_find(name, SYSCONFDIR, add_ext); | ||
90 | #endif | ||
87 | } | 91 | } |
88 | 92 | ||
89 | //*************************************************** | 93 | //*************************************************** |