diff options
372 files changed, 3192 insertions, 1432 deletions
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml index 0a9628d31..6c2905e43 100644 --- a/.github/workflows/build-extra.yml +++ b/.github/workflows/build-extra.yml | |||
@@ -1,50 +1,39 @@ | |||
1 | name: Build-extra CI | 1 | # Builds the project with alternative tools. |
2 | |||
3 | name: Build-extra | ||
2 | 4 | ||
3 | on: | 5 | on: |
6 | workflow_dispatch: | ||
4 | push: | 7 | push: |
5 | paths-ignore: | 8 | branches-ignore: |
6 | - '.github/ISSUE_TEMPLATE/*' | 9 | - 'dependabot/**' |
7 | - 'contrib/syntax/**' | 10 | paths: |
8 | - 'contrib/vim/**' | 11 | - 'm4/**' |
9 | - 'etc/**' | 12 | - 'src/**.c' |
10 | - 'src/man/*.txt' | 13 | - 'src/**.h' |
11 | - .git-blame-ignore-revs | 14 | - 'src/**.mk' |
12 | - .github/dependabot.yml | 15 | - 'src/**Makefile' |
13 | - .github/pull_request_template.md | 16 | - .github/workflows/build-extra.yml |
14 | - .github/workflows/build.yml | 17 | - Makefile |
15 | - .github/workflows/codeql-analysis.yml | 18 | - ci/printenv.sh |
16 | - .github/workflows/profile-checks.yml | 19 | - config.mk.in |
17 | - .gitignore | 20 | - config.sh.in |
18 | - .gitlab-ci.yml | 21 | - configure |
19 | - CONTRIBUTING.md | 22 | - configure.ac |
20 | - COPYING | ||
21 | - README | ||
22 | - README.md | ||
23 | - RELNOTES | ||
24 | - SECURITY.md | ||
25 | - src/firecfg/firecfg.config | ||
26 | pull_request: | 23 | pull_request: |
27 | paths-ignore: | 24 | paths: |
28 | - '.github/ISSUE_TEMPLATE/*' | 25 | - 'm4/**' |
29 | - 'contrib/syntax/**' | 26 | - 'src/**.c' |
30 | - 'contrib/vim/**' | 27 | - 'src/**.h' |
31 | - 'etc/**' | 28 | - 'src/**.mk' |
32 | - 'src/man/*.txt' | 29 | - 'src/**Makefile' |
33 | - .git-blame-ignore-revs | 30 | - .github/workflows/build-extra.yml |
34 | - .github/dependabot.yml | 31 | - Makefile |
35 | - .github/pull_request_template.md | 32 | - ci/printenv.sh |
36 | - .github/workflows/build.yml | 33 | - config.mk.in |
37 | - .github/workflows/codeql-analysis.yml | 34 | - config.sh.in |
38 | - .github/workflows/profile-checks.yml | 35 | - configure |
39 | - .gitignore | 36 | - configure.ac |
40 | - .gitlab-ci.yml | ||
41 | - CONTRIBUTING.md | ||
42 | - COPYING | ||
43 | - README | ||
44 | - README.md | ||
45 | - RELNOTES | ||
46 | - SECURITY.md | ||
47 | - src/firecfg/firecfg.config | ||
48 | 37 | ||
49 | permissions: # added using https://github.com/step-security/secure-workflows | 38 | permissions: # added using https://github.com/step-security/secure-workflows |
50 | contents: read | 39 | contents: read |
@@ -54,13 +43,17 @@ jobs: | |||
54 | runs-on: ubuntu-22.04 | 43 | runs-on: ubuntu-22.04 |
55 | steps: | 44 | steps: |
56 | - name: Harden Runner | 45 | - name: Harden Runner |
57 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | 46 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 |
58 | with: | 47 | with: |
59 | egress-policy: block | 48 | egress-policy: block |
60 | allowed-endpoints: > | 49 | allowed-endpoints: > |
50 | archive.ubuntu.com:80 | ||
61 | azure.archive.ubuntu.com:80 | 51 | azure.archive.ubuntu.com:80 |
62 | github.com:443 | 52 | github.com:443 |
63 | - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | 53 | packages.microsoft.com:443 |
54 | ppa.launchpadcontent.net:443 | ||
55 | security.ubuntu.com:80 | ||
56 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
64 | - name: update package information | 57 | - name: update package information |
65 | run: sudo apt-get update -qy | 58 | run: sudo apt-get update -qy |
66 | - name: install dependencies | 59 | - name: install dependencies |
@@ -80,87 +73,3 @@ jobs: | |||
80 | run: sudo make install | 73 | run: sudo make install |
81 | - name: print version | 74 | - name: print version |
82 | run: command -V firejail && firejail --version | 75 | run: command -V firejail && firejail --version |
83 | scan-build: | ||
84 | runs-on: ubuntu-22.04 | ||
85 | steps: | ||
86 | - name: Harden Runner | ||
87 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | ||
88 | with: | ||
89 | egress-policy: block | ||
90 | allowed-endpoints: > | ||
91 | azure.archive.ubuntu.com:80 | ||
92 | github.com:443 | ||
93 | - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | ||
94 | - name: update package information | ||
95 | run: sudo apt-get update -qy | ||
96 | - name: install clang-tools-14 and dependencies | ||
97 | run: > | ||
98 | sudo apt-get install -qy | ||
99 | clang-tools-14 libapparmor-dev libselinux1-dev | ||
100 | - name: print env | ||
101 | run: ./ci/printenv.sh | ||
102 | - name: configure | ||
103 | run: > | ||
104 | CC=clang-14 ./configure --enable-fatal-warnings --enable-apparmor | ||
105 | --enable-selinux | ||
106 | || (cat config.log; exit 1) | ||
107 | - name: scan-build | ||
108 | run: scan-build-14 --status-bugs make | ||
109 | cppcheck: | ||
110 | runs-on: ubuntu-22.04 | ||
111 | steps: | ||
112 | - name: Harden Runner | ||
113 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | ||
114 | with: | ||
115 | egress-policy: block | ||
116 | allowed-endpoints: > | ||
117 | azure.archive.ubuntu.com:80 | ||
118 | github.com:443 | ||
119 | - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | ||
120 | - name: update package information | ||
121 | run: sudo apt-get update -qy | ||
122 | - name: install cppcheck | ||
123 | run: sudo apt-get install -qy cppcheck | ||
124 | - run: cppcheck --version | ||
125 | - name: cppcheck | ||
126 | run: > | ||
127 | cppcheck -q --force --error-exitcode=1 --enable=warning,performance | ||
128 | -i src/firejail/checkcfg.c -i src/firejail/main.c . | ||
129 | # new cppcheck version currently chokes on checkcfg.c and main.c, therefore | ||
130 | # scan all files also with older cppcheck version from ubuntu 20.04. | ||
131 | cppcheck_old: | ||
132 | runs-on: ubuntu-20.04 | ||
133 | steps: | ||
134 | - name: Harden Runner | ||
135 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | ||
136 | with: | ||
137 | egress-policy: block | ||
138 | allowed-endpoints: > | ||
139 | azure.archive.ubuntu.com:80 | ||
140 | github.com:443 | ||
141 | - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | ||
142 | - name: update package information | ||
143 | run: sudo apt-get update -qy | ||
144 | - name: install cppcheck | ||
145 | run: sudo apt-get install -qy cppcheck | ||
146 | - run: cppcheck --version | ||
147 | - name: cppcheck | ||
148 | run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance . | ||
149 | codespell: | ||
150 | runs-on: ubuntu-22.04 | ||
151 | steps: | ||
152 | - name: Harden Runner | ||
153 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | ||
154 | with: | ||
155 | egress-policy: block | ||
156 | allowed-endpoints: > | ||
157 | azure.archive.ubuntu.com:80 | ||
158 | github.com:443 | ||
159 | - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | ||
160 | - name: update package information | ||
161 | run: sudo apt-get update -qy | ||
162 | - name: install dependencies | ||
163 | run: sudo apt-get install -qy codespell | ||
164 | - run: codespell --version | ||
165 | - name: codespell | ||
166 | run: make codespell | ||
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index a53260e64..ae1aef039 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml | |||
@@ -1,67 +1,73 @@ | |||
1 | name: Build CI | 1 | # Checks that `make dist` works and builds the project with the default |
2 | # configuration. | ||
2 | 3 | ||
4 | name: Build | ||
5 | |||
6 | # Note: Keep this list in sync with DISTFILES in ../../Makefile. | ||
3 | on: | 7 | on: |
8 | workflow_dispatch: | ||
4 | push: | 9 | push: |
5 | paths-ignore: | 10 | branches-ignore: |
6 | - '.github/ISSUE_TEMPLATE/*' | 11 | - 'dependabot/**' |
7 | - .git-blame-ignore-revs | 12 | paths: |
8 | - .github/dependabot.yml | 13 | - 'contrib/**' |
9 | - .github/pull_request_template.md | 14 | - 'etc/**' |
10 | - .github/workflows/build-extra.yml | 15 | - 'm4/**' |
11 | - .github/workflows/codeql-analysis.yml | 16 | - 'platform/**' |
12 | - .github/workflows/profile-checks.yml | 17 | - 'src/**' |
13 | - .gitignore | 18 | - 'test/**' |
14 | - .gitlab-ci.yml | 19 | - .github/workflows/build.yml |
15 | - CONTRIBUTING.md | ||
16 | - COPYING | 20 | - COPYING |
21 | - Makefile | ||
17 | - README | 22 | - README |
18 | - README.md | ||
19 | - RELNOTES | 23 | - RELNOTES |
20 | - SECURITY.md | 24 | - ci/printenv.sh |
25 | - config.mk.in | ||
26 | - config.sh.in | ||
27 | - configure | ||
28 | - configure.ac | ||
29 | - install.sh | ||
30 | - mkdeb.sh | ||
31 | - mketc.sh | ||
21 | pull_request: | 32 | pull_request: |
22 | paths-ignore: | 33 | paths: |
23 | - '.github/ISSUE_TEMPLATE/*' | 34 | - 'contrib/**' |
24 | - .git-blame-ignore-revs | 35 | - 'etc/**' |
25 | - .github/dependabot.yml | 36 | - 'm4/**' |
26 | - .github/pull_request_template.md | 37 | - 'platform/**' |
27 | - .github/workflows/build-extra.yml | 38 | - 'src/**' |
28 | - .github/workflows/codeql-analysis.yml | 39 | - 'test/**' |
29 | - .github/workflows/profile-checks.yml | 40 | - .github/workflows/build.yml |
30 | - .gitignore | ||
31 | - .gitlab-ci.yml | ||
32 | - CONTRIBUTING.md | ||
33 | - COPYING | 41 | - COPYING |
42 | - Makefile | ||
34 | - README | 43 | - README |
35 | - README.md | ||
36 | - RELNOTES | 44 | - RELNOTES |
37 | - SECURITY.md | 45 | - ci/printenv.sh |
46 | - config.mk.in | ||
47 | - config.sh.in | ||
48 | - configure | ||
49 | - configure.ac | ||
50 | - install.sh | ||
51 | - mkdeb.sh | ||
52 | - mketc.sh | ||
38 | 53 | ||
39 | permissions: # added using https://github.com/step-security/secure-workflows | 54 | permissions: # added using https://github.com/step-security/secure-workflows |
40 | contents: read | 55 | contents: read |
41 | 56 | ||
42 | jobs: | 57 | jobs: |
43 | build_and_test: | 58 | build: |
44 | runs-on: ubuntu-22.04 | 59 | runs-on: ubuntu-22.04 |
45 | env: | ||
46 | SHELL: /bin/bash | ||
47 | steps: | 60 | steps: |
48 | - name: Harden Runner | 61 | - name: Harden Runner |
49 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | 62 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 |
50 | with: | 63 | with: |
51 | egress-policy: block | 64 | egress-policy: block |
52 | allowed-endpoints: > | 65 | allowed-endpoints: > |
53 | 1.1.1.1:1025 | ||
54 | azure.archive.ubuntu.com:80 | 66 | azure.archive.ubuntu.com:80 |
55 | debian.org:80 | ||
56 | dns.quad9.net:53 | ||
57 | github.com:443 | 67 | github.com:443 |
58 | packages.microsoft.com:443 | 68 | packages.microsoft.com:443 |
59 | ppa.launchpadcontent.net:443 | 69 | ppa.launchpadcontent.net:443 |
60 | whois.pir.org:43 | 70 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 |
61 | www.debian.org:443 | ||
62 | www.debian.org:80 | ||
63 | yahoo.com:1025 | ||
64 | - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | ||
65 | - name: update package information | 71 | - name: update package information |
66 | run: sudo apt-get update -qy | 72 | run: sudo apt-get update -qy |
67 | - name: install dependencies | 73 | - name: install dependencies |
@@ -82,19 +88,3 @@ jobs: | |||
82 | run: sudo make install | 88 | run: sudo make install |
83 | - name: print firejail version | 89 | - name: print firejail version |
84 | run: command -V firejail && firejail --version | 90 | run: command -V firejail && firejail --version |
85 | - run: make lab-setup | ||
86 | - run: make test-seccomp-extra | ||
87 | - run: make test-firecfg | ||
88 | - run: make test-capabilities | ||
89 | - run: make test-apparmor | ||
90 | - run: make test-appimage | ||
91 | - run: make test-chroot | ||
92 | - run: make test-sysutils | ||
93 | - run: make test-private-etc | ||
94 | - run: make test-profiles | ||
95 | - run: make test-fcopy | ||
96 | - run: make test-fnetfilter | ||
97 | - run: make test-fs | ||
98 | - run: make test-utils | ||
99 | - run: make test-environment | ||
100 | - run: make test-network | ||
diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml new file mode 100644 index 000000000..3324906f7 --- /dev/null +++ b/.github/workflows/check-c.yml | |||
@@ -0,0 +1,164 @@ | |||
1 | # Checks for potential issues in the source code. | ||
2 | |||
3 | name: Check-C | ||
4 | |||
5 | on: | ||
6 | workflow_dispatch: | ||
7 | push: | ||
8 | branches-ignore: | ||
9 | - 'dependabot/**' | ||
10 | paths: | ||
11 | - 'm4/**' | ||
12 | - 'src/**.c' | ||
13 | - 'src/**.h' | ||
14 | - 'src/**.mk' | ||
15 | - 'src/**Makefile' | ||
16 | - .github/workflows/check-c.yml | ||
17 | - Makefile | ||
18 | - ci/printenv.sh | ||
19 | - config.mk.in | ||
20 | - config.sh.in | ||
21 | - configure | ||
22 | - configure.ac | ||
23 | pull_request: | ||
24 | paths: | ||
25 | - 'm4/**' | ||
26 | - 'src/**.c' | ||
27 | - 'src/**.h' | ||
28 | - 'src/**.mk' | ||
29 | - 'src/**Makefile' | ||
30 | - .github/workflows/check-c.yml | ||
31 | - Makefile | ||
32 | - ci/printenv.sh | ||
33 | - config.mk.in | ||
34 | - config.sh.in | ||
35 | - configure | ||
36 | - configure.ac | ||
37 | schedule: | ||
38 | - cron: '0 7 * * 2' | ||
39 | |||
40 | permissions: # added using https://github.com/step-security/secure-workflows | ||
41 | contents: read | ||
42 | |||
43 | jobs: | ||
44 | scan-build: | ||
45 | runs-on: ubuntu-22.04 | ||
46 | steps: | ||
47 | - name: Harden Runner | ||
48 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
49 | with: | ||
50 | egress-policy: block | ||
51 | allowed-endpoints: > | ||
52 | archive.ubuntu.com:80 | ||
53 | azure.archive.ubuntu.com:80 | ||
54 | github.com:443 | ||
55 | packages.microsoft.com:443 | ||
56 | ppa.launchpadcontent.net:443 | ||
57 | security.ubuntu.com:80 | ||
58 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
59 | - name: update package information | ||
60 | run: sudo apt-get update -qy | ||
61 | - name: install clang-tools-14 and dependencies | ||
62 | run: > | ||
63 | sudo apt-get install -qy | ||
64 | clang-tools-14 libapparmor-dev libselinux1-dev | ||
65 | - name: print env | ||
66 | run: ./ci/printenv.sh | ||
67 | - name: configure | ||
68 | run: > | ||
69 | CC=clang-14 ./configure --enable-fatal-warnings --enable-apparmor | ||
70 | --enable-selinux | ||
71 | || (cat config.log; exit 1) | ||
72 | - name: scan-build | ||
73 | run: scan-build-14 --status-bugs make | ||
74 | |||
75 | cppcheck: | ||
76 | runs-on: ubuntu-22.04 | ||
77 | steps: | ||
78 | - name: Harden Runner | ||
79 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
80 | with: | ||
81 | egress-policy: block | ||
82 | allowed-endpoints: > | ||
83 | archive.ubuntu.com:80 | ||
84 | azure.archive.ubuntu.com:80 | ||
85 | github.com:443 | ||
86 | packages.microsoft.com:443 | ||
87 | ppa.launchpadcontent.net:443 | ||
88 | security.ubuntu.com:80 | ||
89 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
90 | - name: update package information | ||
91 | run: sudo apt-get update -qy | ||
92 | - name: install cppcheck | ||
93 | run: sudo apt-get install -qy cppcheck | ||
94 | - run: cppcheck --version | ||
95 | - name: cppcheck | ||
96 | run: > | ||
97 | cppcheck -q --force --error-exitcode=1 --enable=warning,performance | ||
98 | -i src/firejail/checkcfg.c -i src/firejail/main.c . | ||
99 | |||
100 | # new cppcheck version currently chokes on checkcfg.c and main.c, therefore | ||
101 | # scan all files also with older cppcheck version from ubuntu 20.04. | ||
102 | cppcheck_old: | ||
103 | runs-on: ubuntu-20.04 | ||
104 | steps: | ||
105 | - name: Harden Runner | ||
106 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
107 | with: | ||
108 | egress-policy: block | ||
109 | allowed-endpoints: > | ||
110 | archive.ubuntu.com:80 | ||
111 | azure.archive.ubuntu.com:80 | ||
112 | github.com:443 | ||
113 | packages.microsoft.com:443 | ||
114 | ppa.launchpad.net:80 | ||
115 | ppa.launchpadcontent.net:443 | ||
116 | security.ubuntu.com:80 | ||
117 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
118 | - name: update package information | ||
119 | run: sudo apt-get update -qy | ||
120 | - name: install cppcheck | ||
121 | run: sudo apt-get install -qy cppcheck | ||
122 | - run: cppcheck --version | ||
123 | - name: cppcheck | ||
124 | run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance . | ||
125 | |||
126 | codeql-cpp: | ||
127 | permissions: | ||
128 | actions: read | ||
129 | contents: read | ||
130 | security-events: write | ||
131 | runs-on: ubuntu-latest | ||
132 | |||
133 | steps: | ||
134 | - name: Harden Runner | ||
135 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
136 | with: | ||
137 | disable-sudo: true | ||
138 | egress-policy: block | ||
139 | allowed-endpoints: > | ||
140 | api.github.com:443 | ||
141 | github.com:443 | ||
142 | objects.githubusercontent.com:443 | ||
143 | uploads.github.com:443 | ||
144 | |||
145 | - name: Checkout repository | ||
146 | uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
147 | |||
148 | - name: print env | ||
149 | run: ./ci/printenv.sh | ||
150 | |||
151 | # Initializes the CodeQL tools for scanning. | ||
152 | - name: Initialize CodeQL | ||
153 | uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75 | ||
154 | with: | ||
155 | languages: cpp | ||
156 | |||
157 | - name: configure | ||
158 | run: ./configure | ||
159 | |||
160 | - name: make | ||
161 | run: make -j "$(nproc)" | ||
162 | |||
163 | - name: Perform CodeQL Analysis | ||
164 | uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75 | ||
diff --git a/.github/workflows/profile-checks.yml b/.github/workflows/check-profiles.yml index 8d4e5ba28..b5490c944 100644 --- a/.github/workflows/profile-checks.yml +++ b/.github/workflows/check-profiles.yml | |||
@@ -1,18 +1,25 @@ | |||
1 | name: Profile Checks | 1 | # Lints and checks for potential issues in the profiles. |
2 | |||
3 | name: Check-Profiles | ||
2 | 4 | ||
3 | on: | 5 | on: |
6 | workflow_dispatch: | ||
4 | push: | 7 | push: |
8 | branches-ignore: | ||
9 | - 'dependabot/**' | ||
5 | paths: | 10 | paths: |
6 | - 'ci/check/profiles/**' | 11 | - 'ci/check/profiles/**' |
7 | - 'etc/**' | 12 | - 'etc/**' |
8 | - .github/workflows/profile-checks.yml | 13 | - .github/workflows/check-profiles.yml |
14 | - ci/printenv.sh | ||
9 | - contrib/sort.py | 15 | - contrib/sort.py |
10 | - src/firecfg/firecfg.config | 16 | - src/firecfg/firecfg.config |
11 | pull_request: | 17 | pull_request: |
12 | paths: | 18 | paths: |
13 | - 'ci/check/profiles/**' | 19 | - 'ci/check/profiles/**' |
14 | - 'etc/**' | 20 | - 'etc/**' |
15 | - .github/workflows/profile-checks.yml | 21 | - .github/workflows/check-profiles.yml |
22 | - ci/printenv.sh | ||
16 | - contrib/sort.py | 23 | - contrib/sort.py |
17 | - src/firecfg/firecfg.config | 24 | - src/firecfg/firecfg.config |
18 | 25 | ||
@@ -24,14 +31,14 @@ jobs: | |||
24 | runs-on: ubuntu-latest | 31 | runs-on: ubuntu-latest |
25 | steps: | 32 | steps: |
26 | - name: Harden Runner | 33 | - name: Harden Runner |
27 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | 34 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 |
28 | with: | 35 | with: |
29 | disable-sudo: true | 36 | disable-sudo: true |
30 | egress-policy: block | 37 | egress-policy: block |
31 | allowed-endpoints: > | 38 | allowed-endpoints: > |
32 | github.com:443 | 39 | github.com:443 |
33 | 40 | ||
34 | - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | 41 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 |
35 | - name: print env | 42 | - name: print env |
36 | run: ./ci/printenv.sh | 43 | run: ./ci/printenv.sh |
37 | - run: python3 --version | 44 | - run: python3 --version |
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml new file mode 100644 index 000000000..4425af2b7 --- /dev/null +++ b/.github/workflows/check-python.yml | |||
@@ -0,0 +1,58 @@ | |||
1 | # Lints and checks for potential issues in Python files. | ||
2 | |||
3 | name: Check-Python | ||
4 | |||
5 | on: | ||
6 | workflow_dispatch: | ||
7 | push: | ||
8 | branches-ignore: | ||
9 | - 'dependabot/**' | ||
10 | paths: | ||
11 | - '**.py' | ||
12 | - .github/workflows/check-python.yml | ||
13 | pull_request: | ||
14 | paths: | ||
15 | - '**.py' | ||
16 | - .github/workflows/check-python.yml | ||
17 | schedule: | ||
18 | - cron: '0 7 * * 2' | ||
19 | |||
20 | permissions: # added using https://github.com/step-security/secure-workflows | ||
21 | contents: read | ||
22 | |||
23 | jobs: | ||
24 | codeql-python: | ||
25 | permissions: | ||
26 | actions: read | ||
27 | contents: read | ||
28 | security-events: write | ||
29 | runs-on: ubuntu-latest | ||
30 | |||
31 | steps: | ||
32 | - name: Harden Runner | ||
33 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
34 | with: | ||
35 | disable-sudo: true | ||
36 | egress-policy: block | ||
37 | allowed-endpoints: > | ||
38 | api.github.com:443 | ||
39 | files.pythonhosted.org:443 | ||
40 | github.com:443 | ||
41 | objects.githubusercontent.com:443 | ||
42 | pypi.org:443 | ||
43 | uploads.github.com:443 | ||
44 | |||
45 | - name: Checkout repository | ||
46 | uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
47 | |||
48 | - name: print env | ||
49 | run: ./ci/printenv.sh | ||
50 | |||
51 | # Initializes the CodeQL tools for scanning. | ||
52 | - name: Initialize CodeQL | ||
53 | uses: github/codeql-action/init@407ffafae6a767df3e0230c3df91b6443ae8df75 | ||
54 | with: | ||
55 | languages: python | ||
56 | |||
57 | - name: Perform CodeQL Analysis | ||
58 | uses: github/codeql-action/analyze@407ffafae6a767df3e0230c3df91b6443ae8df75 | ||
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml deleted file mode 100644 index 4b9aaa7d6..000000000 --- a/.github/workflows/codeql-analysis.yml +++ /dev/null | |||
@@ -1,121 +0,0 @@ | |||
1 | # For most projects, this workflow file will not need changing; you simply need | ||
2 | # to commit it to your repository. | ||
3 | # | ||
4 | # You may wish to alter this file to override the set of languages analyzed, | ||
5 | # or to provide custom queries or build logic. | ||
6 | name: "CodeQL" | ||
7 | |||
8 | on: | ||
9 | push: | ||
10 | paths-ignore: | ||
11 | - '.github/ISSUE_TEMPLATE/*' | ||
12 | - 'contrib/syntax/**' | ||
13 | - 'contrib/vim/**' | ||
14 | - 'etc/**' | ||
15 | - 'src/man/*.txt' | ||
16 | - .git-blame-ignore-revs | ||
17 | - .github/dependabot.yml | ||
18 | - .github/pull_request_template.md | ||
19 | - .github/workflows/build-extra.yml | ||
20 | - .github/workflows/build.yml | ||
21 | - .github/workflows/profile-checks.yml | ||
22 | - .gitignore | ||
23 | - .gitlab-ci.yml | ||
24 | - CONTRIBUTING.md | ||
25 | - COPYING | ||
26 | - README | ||
27 | - README.md | ||
28 | - RELNOTES | ||
29 | - SECURITY.md | ||
30 | - src/firecfg/firecfg.config | ||
31 | pull_request: | ||
32 | paths-ignore: | ||
33 | - '.github/ISSUE_TEMPLATE/*' | ||
34 | - 'contrib/syntax/**' | ||
35 | - 'contrib/vim/**' | ||
36 | - 'etc/**' | ||
37 | - 'src/man/*.txt' | ||
38 | - .git-blame-ignore-revs | ||
39 | - .github/dependabot.yml | ||
40 | - .github/pull_request_template.md | ||
41 | - .github/workflows/build-extra.yml | ||
42 | - .github/workflows/build.yml | ||
43 | - .github/workflows/profile-checks.yml | ||
44 | - .gitignore | ||
45 | - .gitlab-ci.yml | ||
46 | - CONTRIBUTING.md | ||
47 | - COPYING | ||
48 | - README | ||
49 | - README.md | ||
50 | - RELNOTES | ||
51 | - SECURITY.md | ||
52 | - src/firecfg/firecfg.config | ||
53 | schedule: | ||
54 | - cron: '0 7 * * 2' | ||
55 | |||
56 | permissions: # added using https://github.com/step-security/secure-workflows | ||
57 | contents: read | ||
58 | |||
59 | jobs: | ||
60 | analyze: | ||
61 | permissions: | ||
62 | actions: read # for github/codeql-action/init to get workflow details | ||
63 | contents: read # for actions/checkout to fetch code | ||
64 | security-events: write # for github/codeql-action/autobuild to send a status report | ||
65 | name: Analyze | ||
66 | runs-on: ubuntu-latest | ||
67 | |||
68 | strategy: | ||
69 | fail-fast: false | ||
70 | matrix: | ||
71 | language: [ 'cpp', 'python' ] | ||
72 | # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ] | ||
73 | # Learn more: | ||
74 | # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed | ||
75 | |||
76 | steps: | ||
77 | - name: Harden Runner | ||
78 | uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 | ||
79 | with: | ||
80 | disable-sudo: true | ||
81 | egress-policy: block | ||
82 | allowed-endpoints: > | ||
83 | api.github.com:443 | ||
84 | github.com:443 | ||
85 | objects.githubusercontent.com:443 | ||
86 | uploads.github.com:443 | ||
87 | |||
88 | - name: Checkout repository | ||
89 | uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 | ||
90 | |||
91 | - name: print env | ||
92 | run: ./ci/printenv.sh | ||
93 | |||
94 | # Initializes the CodeQL tools for scanning. | ||
95 | - name: Initialize CodeQL | ||
96 | uses: github/codeql-action/init@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 | ||
97 | with: | ||
98 | languages: ${{ matrix.language }} | ||
99 | # If you wish to specify custom queries, you can do so here or in a config file. | ||
100 | # By default, queries listed here will override any specified in a config file. | ||
101 | # Prefix the list here with "+" to use these queries and those in the config file. | ||
102 | # queries: ./path/to/local/query, your-org/your-repo/queries@main | ||
103 | |||
104 | # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). | ||
105 | # If this step fails, then you should remove it and run the build manually (see below) | ||
106 | - name: Autobuild | ||
107 | uses: github/codeql-action/autobuild@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 | ||
108 | |||
109 | # ℹ️ Command-line programs to run using the OS shell. | ||
110 | # 📚 https://git.io/JvXDl | ||
111 | |||
112 | # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines | ||
113 | # and modify them (or add more) to build your code if your project | ||
114 | # uses a compiled language | ||
115 | |||
116 | #- run: | | ||
117 | # make bootstrap | ||
118 | # make release | ||
119 | |||
120 | - name: Perform CodeQL Analysis | ||
121 | uses: github/codeql-action/analyze@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 | ||
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml new file mode 100644 index 000000000..f3c512c3e --- /dev/null +++ b/.github/workflows/codespell.yml | |||
@@ -0,0 +1,47 @@ | |||
1 | # Checks the spelling on all non-third-party files. | ||
2 | |||
3 | name: Codespell | ||
4 | |||
5 | on: | ||
6 | workflow_dispatch: | ||
7 | push: | ||
8 | branches-ignore: | ||
9 | - 'dependabot/**' | ||
10 | paths-ignore: | ||
11 | - 'm4/**' | ||
12 | - COPYING | ||
13 | pull_request: | ||
14 | paths-ignore: | ||
15 | - 'm4/**' | ||
16 | - COPYING | ||
17 | |||
18 | permissions: # added using https://github.com/step-security/secure-workflows | ||
19 | contents: read | ||
20 | |||
21 | jobs: | ||
22 | codespell: | ||
23 | runs-on: ubuntu-22.04 | ||
24 | steps: | ||
25 | - name: Harden Runner | ||
26 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
27 | with: | ||
28 | egress-policy: block | ||
29 | allowed-endpoints: > | ||
30 | archive.ubuntu.com:80 | ||
31 | azure.archive.ubuntu.com:80 | ||
32 | github.com:443 | ||
33 | packages.microsoft.com:443 | ||
34 | ppa.launchpadcontent.net:443 | ||
35 | security.ubuntu.com:80 | ||
36 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
37 | - name: update package information | ||
38 | run: sudo apt-get update -qy | ||
39 | - name: install dependencies | ||
40 | run: sudo apt-get install -qy codespell | ||
41 | - name: print env | ||
42 | run: ./ci/printenv.sh | ||
43 | - name: configure | ||
44 | run: ./configure || (cat config.log; exit 1) | ||
45 | - run: codespell --version | ||
46 | - name: codespell | ||
47 | run: make codespell | ||
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 000000000..0a6069a5c --- /dev/null +++ b/.github/workflows/test.yml | |||
@@ -0,0 +1,258 @@ | |||
1 | # Checks that the tests are passing. | ||
2 | |||
3 | name: Test | ||
4 | |||
5 | on: | ||
6 | workflow_dispatch: | ||
7 | push: | ||
8 | branches-ignore: | ||
9 | - 'dependabot/**' | ||
10 | paths: | ||
11 | - 'm4/**' | ||
12 | - 'src/**.c' | ||
13 | - 'src/**.h' | ||
14 | - 'src/**.mk' | ||
15 | - 'src/**Makefile' | ||
16 | - 'test/**' | ||
17 | - .github/workflows/test.yml | ||
18 | - Makefile | ||
19 | - config.mk.in | ||
20 | - config.sh.in | ||
21 | - configure | ||
22 | - configure.ac | ||
23 | - etc/profile-a-l/default.profile | ||
24 | - src/firecfg/firecfg.config | ||
25 | pull_request: | ||
26 | paths: | ||
27 | - 'm4/**' | ||
28 | - 'src/**.c' | ||
29 | - 'src/**.h' | ||
30 | - 'src/**.mk' | ||
31 | - 'src/**Makefile' | ||
32 | - 'test/**' | ||
33 | - .github/workflows/test.yml | ||
34 | - Makefile | ||
35 | - config.mk.in | ||
36 | - config.sh.in | ||
37 | - configure | ||
38 | - configure.ac | ||
39 | - etc/profile-a-l/default.profile | ||
40 | - src/firecfg/firecfg.config | ||
41 | |||
42 | permissions: # added using https://github.com/step-security/secure-workflows | ||
43 | contents: read | ||
44 | |||
45 | # | ||
46 | # Faster tests | ||
47 | # | ||
48 | |||
49 | jobs: | ||
50 | test-main: | ||
51 | runs-on: ubuntu-22.04 | ||
52 | env: | ||
53 | SHELL: /bin/bash | ||
54 | steps: | ||
55 | - name: Harden Runner | ||
56 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
57 | with: | ||
58 | egress-policy: block | ||
59 | allowed-endpoints: > | ||
60 | azure.archive.ubuntu.com:80 | ||
61 | github.com:443 | ||
62 | packages.microsoft.com:443 | ||
63 | ppa.launchpadcontent.net:443 | ||
64 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
65 | - name: update package information | ||
66 | run: sudo apt-get update -qy | ||
67 | - name: install dependencies | ||
68 | run: > | ||
69 | sudo apt-get install -qy | ||
70 | gcc-12 libapparmor-dev libselinux1-dev expect xzdec bridge-utils | ||
71 | - name: print env | ||
72 | run: ./ci/printenv.sh | ||
73 | - name: configure | ||
74 | run: > | ||
75 | CC=gcc-12 ./configure --prefix=/usr --enable-fatal-warnings | ||
76 | --enable-analyzer --enable-apparmor --enable-selinux | ||
77 | || (cat config.log; exit 1) | ||
78 | - name: make | ||
79 | run: make -j "$(nproc)" | ||
80 | - name: make install | ||
81 | run: sudo make install | ||
82 | - name: print firejail version | ||
83 | run: command -V firejail && firejail --version | ||
84 | - run: make lab-setup | ||
85 | - run: make test-seccomp-extra | ||
86 | - run: make test-firecfg | ||
87 | - run: make test-capabilities | ||
88 | - run: make test-apparmor | ||
89 | - run: make test-appimage | ||
90 | - run: make test-chroot | ||
91 | - run: make test-fcopy | ||
92 | |||
93 | # | ||
94 | # Slower tests | ||
95 | # | ||
96 | |||
97 | test-fs: | ||
98 | runs-on: ubuntu-22.04 | ||
99 | env: | ||
100 | SHELL: /bin/bash | ||
101 | steps: | ||
102 | - name: Harden Runner | ||
103 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
104 | with: | ||
105 | egress-policy: block | ||
106 | allowed-endpoints: > | ||
107 | azure.archive.ubuntu.com:80 | ||
108 | github.com:443 | ||
109 | packages.microsoft.com:443 | ||
110 | ppa.launchpadcontent.net:443 | ||
111 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
112 | - name: update package information | ||
113 | run: sudo apt-get update -qy | ||
114 | - name: install dependencies | ||
115 | run: > | ||
116 | sudo apt-get install -qy | ||
117 | gcc-12 libapparmor-dev libselinux1-dev expect xzdec bridge-utils | ||
118 | - name: print env | ||
119 | run: ./ci/printenv.sh | ||
120 | - name: configure | ||
121 | run: > | ||
122 | CC=gcc-12 ./configure --prefix=/usr --enable-fatal-warnings | ||
123 | --enable-analyzer --enable-apparmor --enable-selinux | ||
124 | || (cat config.log; exit 1) | ||
125 | - name: make | ||
126 | run: make -j "$(nproc)" | ||
127 | - name: make install | ||
128 | run: sudo make install | ||
129 | - name: print firejail version | ||
130 | run: command -V firejail && firejail --version | ||
131 | - run: make lab-setup | ||
132 | - run: make test-private-etc | ||
133 | - run: make test-fs | ||
134 | |||
135 | test-environment: | ||
136 | runs-on: ubuntu-22.04 | ||
137 | env: | ||
138 | SHELL: /bin/bash | ||
139 | steps: | ||
140 | - name: Harden Runner | ||
141 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
142 | with: | ||
143 | egress-policy: block | ||
144 | allowed-endpoints: > | ||
145 | azure.archive.ubuntu.com:80 | ||
146 | github.com:443 | ||
147 | packages.microsoft.com:443 | ||
148 | ppa.launchpadcontent.net:443 | ||
149 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
150 | - name: update package information | ||
151 | run: sudo apt-get update -qy | ||
152 | - name: install dependencies | ||
153 | run: > | ||
154 | sudo apt-get install -qy | ||
155 | gcc-12 libapparmor-dev libselinux1-dev expect xzdec bridge-utils | ||
156 | - name: print env | ||
157 | run: ./ci/printenv.sh | ||
158 | - name: configure | ||
159 | run: > | ||
160 | CC=gcc-12 ./configure --prefix=/usr --enable-fatal-warnings | ||
161 | --enable-analyzer --enable-apparmor --enable-selinux | ||
162 | || (cat config.log; exit 1) | ||
163 | - name: make | ||
164 | run: make -j "$(nproc)" | ||
165 | - name: make install | ||
166 | run: sudo make install | ||
167 | - name: print firejail version | ||
168 | run: command -V firejail && firejail --version | ||
169 | - run: make lab-setup | ||
170 | - run: make test-environment | ||
171 | - run: make test-profiles | ||
172 | |||
173 | test-utils: | ||
174 | runs-on: ubuntu-22.04 | ||
175 | env: | ||
176 | SHELL: /bin/bash | ||
177 | steps: | ||
178 | - name: Harden Runner | ||
179 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
180 | with: | ||
181 | egress-policy: block | ||
182 | allowed-endpoints: > | ||
183 | azure.archive.ubuntu.com:80 | ||
184 | debian.org:80 | ||
185 | github.com:443 | ||
186 | packages.microsoft.com:443 | ||
187 | ppa.launchpadcontent.net:443 | ||
188 | www.debian.org:443 | ||
189 | www.debian.org:80 | ||
190 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
191 | - name: update package information | ||
192 | run: sudo apt-get update -qy | ||
193 | - name: install dependencies | ||
194 | run: > | ||
195 | sudo apt-get install -qy | ||
196 | gcc-12 libapparmor-dev libselinux1-dev expect xzdec bridge-utils | ||
197 | - name: print env | ||
198 | run: ./ci/printenv.sh | ||
199 | - name: configure | ||
200 | run: > | ||
201 | CC=gcc-12 ./configure --prefix=/usr --enable-fatal-warnings | ||
202 | --enable-analyzer --enable-apparmor --enable-selinux | ||
203 | || (cat config.log; exit 1) | ||
204 | - name: make | ||
205 | run: make -j "$(nproc)" | ||
206 | - name: make install | ||
207 | run: sudo make install | ||
208 | - name: print firejail version | ||
209 | run: command -V firejail && firejail --version | ||
210 | - run: make lab-setup | ||
211 | - run: make test-utils | ||
212 | |||
213 | test-network: | ||
214 | runs-on: ubuntu-22.04 | ||
215 | env: | ||
216 | SHELL: /bin/bash | ||
217 | steps: | ||
218 | - name: Harden Runner | ||
219 | uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 | ||
220 | with: | ||
221 | egress-policy: block | ||
222 | allowed-endpoints: > | ||
223 | 1.1.1.1:1025 | ||
224 | azure.archive.ubuntu.com:80 | ||
225 | debian.org:80 | ||
226 | dns.quad9.net:53 | ||
227 | github.com:443 | ||
228 | packages.microsoft.com:443 | ||
229 | ppa.launchpadcontent.net:443 | ||
230 | whois.pir.org:43 | ||
231 | www.debian.org:443 | ||
232 | www.debian.org:80 | ||
233 | yahoo.com:1025 | ||
234 | - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 | ||
235 | - name: update package information | ||
236 | run: sudo apt-get update -qy | ||
237 | - name: install dependencies | ||
238 | run: > | ||
239 | sudo apt-get install -qy | ||
240 | gcc-12 libapparmor-dev libselinux1-dev expect xzdec whois | ||
241 | bridge-utils | ||
242 | - name: print env | ||
243 | run: ./ci/printenv.sh | ||
244 | - name: configure | ||
245 | run: > | ||
246 | CC=gcc-12 ./configure --prefix=/usr --enable-fatal-warnings | ||
247 | --enable-analyzer --enable-apparmor --enable-selinux | ||
248 | || (cat config.log; exit 1) | ||
249 | - name: make | ||
250 | run: make -j "$(nproc)" | ||
251 | - name: make install | ||
252 | run: sudo make install | ||
253 | - name: print firejail version | ||
254 | run: command -V firejail && firejail --version | ||
255 | - run: make lab-setup | ||
256 | - run: make test-fnetfilter | ||
257 | - run: make test-sysutils | ||
258 | - run: make test-network | ||
@@ -64,31 +64,31 @@ $(MYDIRS): | |||
64 | 64 | ||
65 | .PHONY: filters | 65 | .PHONY: filters |
66 | filters: $(SECCOMP_FILTERS) | 66 | filters: $(SECCOMP_FILTERS) |
67 | seccomp: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize | 67 | seccomp: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize Makefile |
68 | src/fseccomp/fseccomp default seccomp | 68 | src/fseccomp/fseccomp default seccomp |
69 | src/fsec-optimize/fsec-optimize seccomp | 69 | src/fsec-optimize/fsec-optimize seccomp |
70 | 70 | ||
71 | seccomp.debug: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize | 71 | seccomp.debug: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize Makefile |
72 | src/fseccomp/fseccomp default seccomp.debug allow-debuggers | 72 | src/fseccomp/fseccomp default seccomp.debug allow-debuggers |
73 | src/fsec-optimize/fsec-optimize seccomp.debug | 73 | src/fsec-optimize/fsec-optimize seccomp.debug |
74 | 74 | ||
75 | seccomp.32: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize | 75 | seccomp.32: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize Makefile |
76 | src/fseccomp/fseccomp secondary 32 seccomp.32 | 76 | src/fseccomp/fseccomp secondary 32 seccomp.32 |
77 | src/fsec-optimize/fsec-optimize seccomp.32 | 77 | src/fsec-optimize/fsec-optimize seccomp.32 |
78 | 78 | ||
79 | seccomp.block_secondary: src/fseccomp/fseccomp | 79 | seccomp.block_secondary: src/fseccomp/fseccomp Makefile |
80 | src/fseccomp/fseccomp secondary block seccomp.block_secondary | 80 | src/fseccomp/fseccomp secondary block seccomp.block_secondary |
81 | 81 | ||
82 | seccomp.mdwx: src/fseccomp/fseccomp | 82 | seccomp.mdwx: src/fseccomp/fseccomp Makefile |
83 | src/fseccomp/fseccomp memory-deny-write-execute seccomp.mdwx | 83 | src/fseccomp/fseccomp memory-deny-write-execute seccomp.mdwx |
84 | 84 | ||
85 | seccomp.mdwx.32: src/fseccomp/fseccomp | 85 | seccomp.mdwx.32: src/fseccomp/fseccomp Makefile |
86 | src/fseccomp/fseccomp memory-deny-write-execute.32 seccomp.mdwx.32 | 86 | src/fseccomp/fseccomp memory-deny-write-execute.32 seccomp.mdwx.32 |
87 | 87 | ||
88 | seccomp.namespaces: src/fseccomp/fseccomp | 88 | seccomp.namespaces: src/fseccomp/fseccomp Makefile |
89 | src/fseccomp/fseccomp restrict-namespaces seccomp.namespaces cgroup,ipc,net,mnt,pid,time,user,uts | 89 | src/fseccomp/fseccomp restrict-namespaces seccomp.namespaces cgroup,ipc,net,mnt,pid,time,user,uts |
90 | 90 | ||
91 | seccomp.namespaces.32: src/fseccomp/fseccomp | 91 | seccomp.namespaces.32: src/fseccomp/fseccomp Makefile |
92 | src/fseccomp/fseccomp restrict-namespaces seccomp.namespaces.32 cgroup,ipc,net,mnt,pid,time,user,uts | 92 | src/fseccomp/fseccomp restrict-namespaces seccomp.namespaces.32 cgroup,ipc,net,mnt,pid,time,user,uts |
93 | 93 | ||
94 | .PHONY: man | 94 | .PHONY: man |
@@ -103,58 +103,65 @@ contrib: syntax | |||
103 | syntax: $(SYNTAX_FILES) | 103 | syntax: $(SYNTAX_FILES) |
104 | 104 | ||
105 | # TODO: include/rlimit are false positives | 105 | # TODO: include/rlimit are false positives |
106 | contrib/syntax/lists/profile_commands_arg0.list: src/firejail/profile.c | 106 | contrib/syntax/lists/profile_commands_arg0.list: src/firejail/profile.c Makefile |
107 | @printf 'Generating %s from %s\n' $@ $< | ||
107 | @sed -En 's/.*strn?cmp\(ptr, "([^ "]*[^ ])".*/\1/p' $< | \ | 108 | @sed -En 's/.*strn?cmp\(ptr, "([^ "]*[^ ])".*/\1/p' $< | \ |
108 | grep -Ev '^(include|rlimit)$$' | sed 's/\./\\./' | LC_ALL=C sort -u >$@ | 109 | grep -Ev '^(include|rlimit)$$' | LC_ALL=C sort -u >$@ |
109 | 110 | ||
110 | # TODO: private-lib is special-cased in the code and doesn't match the regex | 111 | # TODO: private-lib is special-cased in the code and doesn't match the regex |
111 | contrib/syntax/lists/profile_commands_arg1.list: src/firejail/profile.c | 112 | contrib/syntax/lists/profile_commands_arg1.list: src/firejail/profile.c Makefile |
112 | @{ sed -En 's/.*strn?cmp\(ptr, "([^"]+) ".*/\1/p' $<; echo private-lib; } | \ | 113 | @printf 'Generating %s from %s\n' $@ $< |
113 | LC_ALL=C sort -u >$@ | 114 | @{ sed -En 's/.*strn?cmp\(ptr, "([^"]+) .*/\1/p' $<; \ |
115 | echo private-lib; } | LC_ALL=C sort -u >$@ | ||
114 | 116 | ||
115 | contrib/syntax/lists/profile_conditionals.list: src/firejail/profile.c | 117 | contrib/syntax/lists/profile_conditionals.list: src/firejail/profile.c Makefile |
118 | @printf 'Generating %s from %s\n' $@ $< | ||
116 | @awk -- 'BEGIN {process=0;} /^Cond conditionals\[\] = \{$$/ {process=1;} \ | 119 | @awk -- 'BEGIN {process=0;} /^Cond conditionals\[\] = \{$$/ {process=1;} \ |
117 | /\t*\{"[^"]+".*/ \ | 120 | /\t*\{"[^"]+".*/ \ |
118 | { if (process) {print gensub(/^\t*\{"([^"]+)".*$$/, "\\1", 1);} } \ | 121 | { if (process) {print gensub(/^\t*\{"([^"]+)".*$$/, "\\1", 1);} } \ |
119 | /^\t\{ NULL, NULL \}$$/ {process=0;}' \ | 122 | /^\t\{ NULL, NULL \}$$/ {process=0;}' \ |
120 | $< | LC_ALL=C sort -u >$@ | 123 | $< | LC_ALL=C sort -u >$@ |
121 | 124 | ||
122 | contrib/syntax/lists/profile_macros.list: src/firejail/macros.c | 125 | contrib/syntax/lists/profile_macros.list: src/firejail/macros.c Makefile |
126 | @printf 'Generating %s from %s\n' $@ $< | ||
123 | @sed -En 's/.*\$$\{([^}]+)\}.*/\1/p' $< | LC_ALL=C sort -u >$@ | 127 | @sed -En 's/.*\$$\{([^}]+)\}.*/\1/p' $< | LC_ALL=C sort -u >$@ |
124 | 128 | ||
125 | contrib/syntax/lists/syscall_groups.list: src/lib/syscall.c | 129 | contrib/syntax/lists/syscall_groups.list: src/lib/syscall.c Makefile |
130 | @printf 'Generating %s from %s\n' $@ $< | ||
126 | @sed -En 's/.*"@([^",]+).*/\1/p' $< | LC_ALL=C sort -u >$@ | 131 | @sed -En 's/.*"@([^",]+).*/\1/p' $< | LC_ALL=C sort -u >$@ |
127 | 132 | ||
128 | contrib/syntax/lists/syscalls.list: $(SYSCALL_HEADERS) | 133 | contrib/syntax/lists/syscalls.list: $(SYSCALL_HEADERS) Makefile |
134 | @printf 'Generating %s\n' $@ | ||
129 | @sed -n 's/{\s\+"\([^"]\+\)",.*},/\1/p' $(SYSCALL_HEADERS) | \ | 135 | @sed -n 's/{\s\+"\([^"]\+\)",.*},/\1/p' $(SYSCALL_HEADERS) | \ |
130 | LC_ALL=C sort -u >$@ | 136 | LC_ALL=C sort -u >$@ |
131 | 137 | ||
132 | contrib/syntax/lists/system_errnos.list: src/lib/errno.c | 138 | contrib/syntax/lists/system_errnos.list: src/lib/errno.c Makefile |
139 | @printf 'Generating %s from %s\n' $@ $< | ||
133 | @sed -En 's/.*"(E[^"]+).*/\1/p' $< | LC_ALL=C sort -u >$@ | 140 | @sed -En 's/.*"(E[^"]+).*/\1/p' $< | LC_ALL=C sort -u >$@ |
134 | 141 | ||
135 | pipe_fromlf = { tr '\n' '|' | sed 's/|$$//'; } | 142 | regex_fromlf = { tr '\n' '|' | sed -e 's/|$$//' -e 's/\./\\\\./g'; } |
136 | space_fromlf = { tr '\n' ' ' | sed 's/ $$//'; } | 143 | space_fromlf = { tr '\n' ' ' | sed -e 's/ $$//'; } |
137 | edit_syntax_file = sed \ | 144 | edit_syntax_file = sed \ |
138 | -e "s/@make_input@/$$(basename $@). Generated from $$(basename $<) by make./" \ | 145 | -e "s/@make_input@/$$(basename $@). Generated from $$(basename $<) by make./" \ |
139 | -e "s/@FJ_PROFILE_COMMANDS_ARG0@/$$($(pipe_fromlf) <contrib/syntax/lists/profile_commands_arg0.list)/" \ | 146 | -e "s/@FJ_PROFILE_COMMANDS_ARG0@/$$($(regex_fromlf) <contrib/syntax/lists/profile_commands_arg0.list)/" \ |
140 | -e "s/@FJ_PROFILE_COMMANDS_ARG1@/$$($(pipe_fromlf) <contrib/syntax/lists/profile_commands_arg1.list)/" \ | 147 | -e "s/@FJ_PROFILE_COMMANDS_ARG1@/$$($(regex_fromlf) <contrib/syntax/lists/profile_commands_arg1.list)/" \ |
141 | -e "s/@FJ_PROFILE_CONDITIONALS@/$$($(pipe_fromlf) <contrib/syntax/lists/profile_conditionals.list)/" \ | 148 | -e "s/@FJ_PROFILE_CONDITIONALS@/$$($(regex_fromlf) <contrib/syntax/lists/profile_conditionals.list)/" \ |
142 | -e "s/@FJ_PROFILE_MACROS@/$$($(pipe_fromlf) <contrib/syntax/lists/profile_macros.list)/" \ | 149 | -e "s/@FJ_PROFILE_MACROS@/$$($(regex_fromlf) <contrib/syntax/lists/profile_macros.list)/" \ |
143 | -e "s/@FJ_SYSCALLS@/$$($(space_fromlf) <contrib/syntax/lists/syscalls.list)/" \ | 150 | -e "s/@FJ_SYSCALLS@/$$($(space_fromlf) <contrib/syntax/lists/syscalls.list)/" \ |
144 | -e "s/@FJ_SYSCALL_GROUPS@/$$($(pipe_fromlf) <contrib/syntax/lists/syscall_groups.list)/" \ | 151 | -e "s/@FJ_SYSCALL_GROUPS@/$$($(regex_fromlf) <contrib/syntax/lists/syscall_groups.list)/" \ |
145 | -e "s/@FJ_SYSTEM_ERRNOS@/$$($(pipe_fromlf) <contrib/syntax/lists/system_errnos.list)/" | 152 | -e "s/@FJ_SYSTEM_ERRNOS@/$$($(regex_fromlf) <contrib/syntax/lists/system_errnos.list)/" |
146 | 153 | ||
147 | contrib/syntax/files/example: contrib/syntax/files/example.in $(SYNTAX_LISTS) | 154 | contrib/syntax/files/example: contrib/syntax/files/example.in $(SYNTAX_LISTS) Makefile |
148 | @printf 'Generating %s from %s\n' $@ $< | 155 | @printf 'Generating %s from %s\n' $@ $< |
149 | @$(edit_syntax_file) $< >$@ | 156 | @$(edit_syntax_file) $< >$@ |
150 | 157 | ||
151 | # gtksourceview language-specs | 158 | # gtksourceview language-specs |
152 | contrib/syntax/files/%.lang: contrib/syntax/files/%.lang.in $(SYNTAX_LISTS) | 159 | contrib/syntax/files/%.lang: contrib/syntax/files/%.lang.in $(SYNTAX_LISTS) Makefile |
153 | @printf 'Generating %s from %s\n' $@ $< | 160 | @printf 'Generating %s from %s\n' $@ $< |
154 | @$(edit_syntax_file) $< >$@ | 161 | @$(edit_syntax_file) $< >$@ |
155 | 162 | ||
156 | # vim syntax files | 163 | # vim syntax files |
157 | contrib/syntax/files/%.vim: contrib/syntax/files/%.vim.in $(SYNTAX_LISTS) | 164 | contrib/syntax/files/%.vim: contrib/syntax/files/%.vim.in $(SYNTAX_LISTS) Makefile |
158 | @printf 'Generating %s from %s\n' $@ $< | 165 | @printf 'Generating %s from %s\n' $@ $< |
159 | @$(edit_syntax_file) $< >$@ | 166 | @$(edit_syntax_file) $< >$@ |
160 | 167 | ||
@@ -293,6 +300,7 @@ uninstall: config.mk | |||
293 | rm -f $(DESTDIR)$(datarootdir)/gtksourceview-5/language-specs/firejail-profile.lang | 300 | rm -f $(DESTDIR)$(datarootdir)/gtksourceview-5/language-specs/firejail-profile.lang |
294 | @echo "If you want to install a different version of firejail, you might also need to run 'rm -fr $(DESTDIR)$(sysconfdir)/firejail', see #2038." | 301 | @echo "If you want to install a different version of firejail, you might also need to run 'rm -fr $(DESTDIR)$(sysconfdir)/firejail', see #2038." |
295 | 302 | ||
303 | # Note: Keep this list in sync with `paths` in .github/workflows/build.yml. | ||
296 | DISTFILES = \ | 304 | DISTFILES = \ |
297 | COPYING \ | 305 | COPYING \ |
298 | Makefile \ | 306 | Makefile \ |
@@ -367,9 +375,16 @@ cppcheck: clean | |||
367 | scan-build: clean | 375 | scan-build: clean |
368 | scan-build $(MAKE) | 376 | scan-build $(MAKE) |
369 | 377 | ||
378 | # TODO: Old codespell versions (such as v2.1.0 in CI) have issues with | ||
379 | # contrib/syscalls.sh | ||
370 | .PHONY: codespell | 380 | .PHONY: codespell |
371 | codespell: clean | 381 | codespell: |
372 | codespell --ignore-regex "UE|creat|doas|shotcut|ether" src test | 382 | @printf 'Running %s...\n' $@ |
383 | @codespell --ignore-regex 'UE|als|chage|creat|doas|ether|isplay|readby|[Ss]hotcut' \ | ||
384 | -S *.gz,*.o,*.so \ | ||
385 | -S COPYING,m4 \ | ||
386 | -S ./contrib/syscalls.sh \ | ||
387 | . | ||
373 | 388 | ||
374 | .PHONY: print-env | 389 | .PHONY: print-env |
375 | print-env: | 390 | print-env: |
@@ -125,6 +125,7 @@ Aleksey Manevich (https://github.com/manevich) | |||
125 | Alexander Gerasiov (https://github.com/gerasiov) | 125 | Alexander Gerasiov (https://github.com/gerasiov) |
126 | - read-only ~/.ssh/authorized_keys | 126 | - read-only ~/.ssh/authorized_keys |
127 | - profile updates | 127 | - profile updates |
128 | - fcopy: Use lstat when copy directory | ||
128 | Alexander Stein (https://github.com/ajstein) | 129 | Alexander Stein (https://github.com/ajstein) |
129 | - added profile for qutebrowser | 130 | - added profile for qutebrowser |
130 | alkim0 (https://github.com/alkim0) | 131 | alkim0 (https://github.com/alkim0) |
@@ -169,6 +170,8 @@ aoand (https://github.com/aoand) | |||
169 | - seccomp fix: allow numeric syscalls | 170 | - seccomp fix: allow numeric syscalls |
170 | Arne Welzel (https://github.com/awelzel) | 171 | Arne Welzel (https://github.com/awelzel) |
171 | - ignore SIGTTOU during flush_stdin() | 172 | - ignore SIGTTOU during flush_stdin() |
173 | archaon616 (https://github.com/archaon616) | ||
174 | - steam.profile: Allow Factorio | ||
172 | Atrate (https://github.com/Atrate) | 175 | Atrate (https://github.com/Atrate) |
173 | - BetterDiscord support | 176 | - BetterDiscord support |
174 | Austin Morton (https://github.com/apmorton) | 177 | Austin Morton (https://github.com/apmorton) |
@@ -283,6 +286,8 @@ Christian Stadelmann (https://github.com/genodeftest) | |||
283 | - evolution profile fix | 286 | - evolution profile fix |
284 | Clayton Williams (https://github.com/gosre) | 287 | Clayton Williams (https://github.com/gosre) |
285 | - addition of RLIMIT_AS | 288 | - addition of RLIMIT_AS |
289 | CodeWithMa (https://github.com/CodeWithMa) | ||
290 | - mpv.profile: add new XDG_STATE_HOME path | ||
286 | corecontingency (https://https://github.com/corecontingency) | 291 | corecontingency (https://https://github.com/corecontingency) |
287 | - tighten private-bin and etc for torbrowser-launcher.profile | 292 | - tighten private-bin and etc for torbrowser-launcher.profile |
288 | - added i2prouter profile | 293 | - added i2prouter profile |
@@ -349,6 +354,10 @@ David Hyrule (https://github.com/Svaag) | |||
349 | - remove nou2f in ssh profile | 354 | - remove nou2f in ssh profile |
350 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) | 355 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) |
351 | - added xpdf profile | 356 | - added xpdf profile |
357 | DefaultUser (https://github.com/DefaultUser) | ||
358 | - neochat: Allow netlink | ||
359 | Denis Subbotin (https://github.com/mr-tron) | ||
360 | - telegram.profile: allow ~/.local/share/telegram-desktop | ||
352 | Denys Havrysh (https://github.com/vutny) | 361 | Denys Havrysh (https://github.com/vutny) |
353 | - update SkypeForLinux profile for latest version | 362 | - update SkypeForLinux profile for latest version |
354 | - removed outdated Skype profile | 363 | - removed outdated Skype profile |
@@ -371,6 +380,7 @@ dmfreemon (https://github.com/dmfreemon) | |||
371 | - handle malloc() failures; use gnu_basename() instead of basenaem() | 380 | - handle malloc() failures; use gnu_basename() instead of basenaem() |
372 | Dmitriy Chestnykh (https://github.com/chestnykh) | 381 | Dmitriy Chestnykh (https://github.com/chestnykh) |
373 | - add ability to disable user profiles at compile time | 382 | - add ability to disable user profiles at compile time |
383 | - lookup xauth in PATH | ||
374 | Dpeta (https://github.com/Dpeta) | 384 | Dpeta (https://github.com/Dpeta) |
375 | - add Chatterino profile | 385 | - add Chatterino profile |
376 | dshmgh (https://github.com/dshmgh) | 386 | dshmgh (https://github.com/dshmgh) |
@@ -465,6 +475,9 @@ Fred-Barclay (https://github.com/Fred-Barclay) | |||
465 | - added Catfish profile | 475 | - added Catfish profile |
466 | Frederik Olesen (https://github.com/Freso) | 476 | Frederik Olesen (https://github.com/Freso) |
467 | - added many vim profiles | 477 | - added many vim profiles |
478 | Frostbyte4664 (https://github.com/Frostbyte4664) | ||
479 | - steam.profile: Allow Baba Is You | ||
480 | - blender-3.6 redirect | ||
468 | g3ngr33n (https://github.com/g3ngr33n) | 481 | g3ngr33n (https://github.com/g3ngr33n) |
469 | - fix musl compilation | 482 | - fix musl compilation |
470 | G4JC (https://sourceforge.net/u/gaming4jc/profile/) | 483 | G4JC (https://sourceforge.net/u/gaming4jc/profile/) |
@@ -497,6 +510,8 @@ glitsj16 (https://github.com/glitsj16) | |||
497 | - new profiles: lzip, artha, nitroshare, nitroshare-cli, nitroshare-nmh | 510 | - new profiles: lzip, artha, nitroshare, nitroshare-cli, nitroshare-nmh |
498 | - new profiles: nirtoshare-send, nitroshare-ui, mencoder, gnome-pie | 511 | - new profiles: nirtoshare-send, nitroshare-ui, mencoder, gnome-pie |
499 | - new profiles: masterpdfeditor | 512 | - new profiles: masterpdfeditor |
513 | glu8716 (https://github.com/glu8716) | ||
514 | - nicotine: support Fcitx and dconf via dbus-user filter | ||
500 | gm10 (https://github.com/gm10) | 515 | gm10 (https://github.com/gm10) |
501 | - get_user() do not use the unreliable getlogin() | 516 | - get_user() do not use the unreliable getlogin() |
502 | GovanifY (https://github.com/GovanifY) | 517 | GovanifY (https://github.com/GovanifY) |
@@ -514,6 +529,7 @@ GSI (https://github.com/GSI) | |||
514 | - added Uzbl browser profile | 529 | - added Uzbl browser profile |
515 | haarp (https://github.com/haarp) | 530 | haarp (https://github.com/haarp) |
516 | - Allow sound for hexchat | 531 | - Allow sound for hexchat |
532 | - discord-common.profile: harden & allow notifications | ||
517 | hamzadis (https://github.com/hamzadis) | 533 | hamzadis (https://github.com/hamzadis) |
518 | - added --overlay-named=name and --overlay-path=path | 534 | - added --overlay-named=name and --overlay-path=path |
519 | Hans-Christoph Steiner (https://github.com/eighthave) | 535 | Hans-Christoph Steiner (https://github.com/eighthave) |
@@ -642,6 +658,8 @@ jrabe (https://github.com/jrabe) | |||
642 | - Polari profile | 658 | - Polari profile |
643 | - qTox profile | 659 | - qTox profile |
644 | - X11 fixes | 660 | - X11 fixes |
661 | jtrv (https://github.com/jtrv) | ||
662 | - tidal-hifi profile | ||
645 | juan (https://github.com/nyancat18) | 663 | juan (https://github.com/nyancat18) |
646 | - fixed Kdenlive, Shotcut profiles | 664 | - fixed Kdenlive, Shotcut profiles |
647 | - new profiles for Cinelerra, Cliqz, Bluefish | 665 | - new profiles for Cinelerra, Cliqz, Bluefish |
@@ -690,6 +708,8 @@ kuesji koesnu (https://github.com/kuesji) | |||
690 | - better parser for size strings | 708 | - better parser for size strings |
691 | Kunal Mehta (https://github.com/legoktm) | 709 | Kunal Mehta (https://github.com/legoktm) |
692 | - converted all links to https in manpages | 710 | - converted all links to https in manpages |
711 | kzsa (https://github.com/kzsa) | ||
712 | - wusc: add /usr/share/locale-langpack (LC_MESSAGES) | ||
693 | laniakea64 (https://github.com/laniakea64) | 713 | laniakea64 (https://github.com/laniakea64) |
694 | - added fj-mkdeb.py script to build deb packages | 714 | - added fj-mkdeb.py script to build deb packages |
695 | Lari Rauno (https://github.com/tuutti) | 715 | Lari Rauno (https://github.com/tuutti) |
@@ -705,6 +725,8 @@ layderv (https://github.com/layderv) | |||
705 | lecso7 (https://github.com/lecso7) | 725 | lecso7 (https://github.com/lecso7) |
706 | - added goldendict profile | 726 | - added goldendict profile |
707 | - allow evince to read .cbz file format | 727 | - allow evince to read .cbz file format |
728 | leukimi (https://github.com/leukimi) | ||
729 | - 0ad.profile: fix libmozjs error on OpenSUSE Tumbleweed | ||
708 | Loïc Damien (https://github.com/dzamlo) | 730 | Loïc Damien (https://github.com/dzamlo) |
709 | - small fixes | 731 | - small fixes |
710 | Liorst4 (https://github.com/Liorst4) | 732 | Liorst4 (https://github.com/Liorst4) |
@@ -729,12 +751,15 @@ Madura A (https://github.com/manushanga) | |||
729 | mahdi1234 (https://github.com/mahdi1234) | 751 | mahdi1234 (https://github.com/mahdi1234) |
730 | - cherrytree profile | 752 | - cherrytree profile |
731 | - Seamonkey profiles | 753 | - Seamonkey profiles |
754 | mammo0 (https://github.com/mammo0) | ||
755 | - remove 'text/plain' from firejail-profile.lang.in | ||
732 | Manuel Dipolt (https://github.com/xeniter) | 756 | Manuel Dipolt (https://github.com/xeniter) |
733 | - stack alignment for the ARM Architecture | 757 | - stack alignment for the ARM Architecture |
734 | Marek Küthe (https://github.com/marek22k) | 758 | Marek Küthe (https://github.com/marek22k) |
735 | - allow loading plugins in gajim | 759 | - allow loading plugins in gajim |
736 | - allow bsfilter in email-common.profile | 760 | - allow bsfilter in email-common.profile |
737 | - email-common.profile: allow clamav plugin for claws-mail | 761 | - email-common.profile: allow clamav plugin for claws-mail |
762 | - VSCodium: Fix developing Arduino | ||
738 | Martin Carpenter (https://github.com/mcarpenter) | 763 | Martin Carpenter (https://github.com/mcarpenter) |
739 | - security audit and bug fixes | 764 | - security audit and bug fixes |
740 | - Centos 6.x support | 765 | - Centos 6.x support |
@@ -823,6 +848,9 @@ Nikos Chantziaras (https://github.com/realnc) | |||
823 | - fix audio support for Discord | 848 | - fix audio support for Discord |
824 | nolanl (https://github.com/nolanl) | 849 | nolanl (https://github.com/nolanl) |
825 | - added localtime to signal-desktop's profile | 850 | - added localtime to signal-desktop's profile |
851 | nutta-git (https://github.com/nutta-git) | ||
852 | - steam.profile: allow process_vm_readv syscall | ||
853 | - lutris.profile: allow more syscalls | ||
826 | nyancat18 (https://github.com/nyancat18) | 854 | nyancat18 (https://github.com/nyancat18) |
827 | - added ardour4, dooble, karbon, krita profiles | 855 | - added ardour4, dooble, karbon, krita profiles |
828 | nya1 (https://github.com/nya1) | 856 | nya1 (https://github.com/nya1) |
@@ -1193,6 +1221,9 @@ Vadim A. Misbakh-Soloviov (https://github.com/msva) | |||
1193 | ValdikSS (https://github.com/ValdikSS) | 1221 | ValdikSS (https://github.com/ValdikSS) |
1194 | - Psi+, Corebird, Konversation profiles | 1222 | - Psi+, Corebird, Konversation profiles |
1195 | - various profile fixes | 1223 | - various profile fixes |
1224 | Varun Sharma (https://github.com/varunsh-coder) | ||
1225 | - update allowed endpoints | ||
1226 | - build(deps): bump step-security/harden-runner from 2.5.0 to 2.5.1 | ||
1196 | Vasya Novikov (https://github.com/vn971) | 1227 | Vasya Novikov (https://github.com/vn971) |
1197 | - Wesnoth profile | 1228 | - Wesnoth profile |
1198 | - Hedegewars profile | 1229 | - Hedegewars profile |
@@ -1,8 +1,13 @@ | |||
1 | # Firejail | 1 | # Firejail |
2 | 2 | ||
3 | [![Build CI (GitLab)](https://gitlab.com/Firejail/firejail_ci/badges/master/pipeline.svg)](https://gitlab.com/Firejail/firejail_ci/pipelines) | 3 | [![Build (GitLab)](https://gitlab.com/Firejail/firejail_ci/badges/master/pipeline.svg)](https://gitlab.com/Firejail/firejail_ci/pipelines) |
4 | [![Build CI (GitHub)](https://github.com/netblue30/firejail/workflows/Build%20CI/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3A%22Build+CI%22) | 4 | [![Build (GitHub)](https://github.com/netblue30/firejail/workflows/Build/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ABuild) |
5 | [![CodeQL CI](https://github.com/netblue30/firejail/workflows/CodeQL/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ACodeQL) | 5 | [![Build-extra](https://github.com/netblue30/firejail/workflows/Build-extra/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ABuild-extra) |
6 | [![Test](https://github.com/netblue30/firejail/workflows/Test/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ATest) | ||
7 | [![Check-C](https://github.com/netblue30/firejail/workflows/Check-C/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ACheck-C) | ||
8 | [![Check-Profiles](https://github.com/netblue30/firejail/workflows/Check-Profiles/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ACheck-Profiles) | ||
9 | [![Check-Python](https://github.com/netblue30/firejail/workflows/Check-Python/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ACheck-Python) | ||
10 | [![Codespell](https://github.com/netblue30/firejail/workflows/Codespell/badge.svg)](https://github.com/netblue30/firejail/actions?query=workflow%3ACodespell) | ||
6 | [![Packaging status (Repology)](https://repology.org/badge/tiny-repos/firejail.svg)](https://repology.org/project/firejail/versions) | 11 | [![Packaging status (Repology)](https://repology.org/badge/tiny-repos/firejail.svg)](https://repology.org/project/firejail/versions) |
7 | 12 | ||
8 | Firejail is a SUID sandbox program that reduces the risk of security breaches | 13 | Firejail is a SUID sandbox program that reduces the risk of security breaches |
@@ -21,10 +21,16 @@ firejail (0.9.73) baseline; urgency=low | |||
21 | * modif: Improve --version/--help & print version on startup (#5829) | 21 | * modif: Improve --version/--help & print version on startup (#5829) |
22 | * modif: improve errExit error messages (#5871) | 22 | * modif: improve errExit error messages (#5871) |
23 | * modif: drop deprecated 'shell' option references (#5894) | 23 | * modif: drop deprecated 'shell' option references (#5894) |
24 | * modif: keep pipewire group unless nosound is used (#5992 #5993) | ||
25 | * modif: Lookup xauth in PATH (#6006 #6087) | ||
24 | * bugfix: qutebrowser: links will not open in the existing instance (#5601 | 26 | * bugfix: qutebrowser: links will not open in the existing instance (#5601 |
25 | #5618) | 27 | #5618) |
26 | * bugfix: fix --hostname and --hosts-file commands | 28 | * bugfix: fix --hostname and --hosts-file commands |
27 | * bugfix: arp.c: ensure positive timeout on select(2) (#5806) | 29 | * bugfix: arp.c: ensure positive timeout on select(2) (#5806) |
30 | * bugfix: Wrong syscall names for s390_pci_mmio_read and s390_pci_mmio_write | ||
31 | (#5965 #5976) | ||
32 | * bugfix: firejail --ls reports wrong file sizes for large files (#5982 | ||
33 | #6086) | ||
28 | * build: auto-generate syntax files (#5627) | 34 | * build: auto-generate syntax files (#5627) |
29 | * build: mark all phony targets as such (#5637) | 35 | * build: mark all phony targets as such (#5637) |
30 | * build: mkdeb.sh: pass all arguments to ./configure (#5654) | 36 | * build: mkdeb.sh: pass all arguments to ./configure (#5654) |
@@ -40,6 +46,10 @@ firejail (0.9.73) baseline; urgency=low | |||
40 | * build: fix hardcoded make & remove unnecessary distclean targets (#5911) | 46 | * build: fix hardcoded make & remove unnecessary distclean targets (#5911) |
41 | * build: dist and asc improvements (#5916) | 47 | * build: dist and asc improvements (#5916) |
42 | * build: fix some shellcheck issues & use config.sh in more scripts (#5927) | 48 | * build: fix some shellcheck issues & use config.sh in more scripts (#5927) |
49 | * build: firecfg.config sorting improvements (#5942) | ||
50 | * build: codespell improvements (#5955) | ||
51 | * build: add missing makefile dep & syntax improvements (#5956) | ||
52 | * build: sort.py: use case-sensitive sorting (#6070) | ||
43 | * ci: always update the package db before installing packages (#5742) | 53 | * ci: always update the package db before installing packages (#5742) |
44 | * ci: fix codeql unable to download its own bundle (#5783) | 54 | * ci: fix codeql unable to download its own bundle (#5783) |
45 | * ci: split configure/build/install commands on gitlab (#5784) | 55 | * ci: split configure/build/install commands on gitlab (#5784) |
@@ -48,6 +58,11 @@ firejail (0.9.73) baseline; urgency=low | |||
48 | * ci: run for every branch instead of just master (#5815) | 58 | * ci: run for every branch instead of just master (#5815) |
49 | * ci: upgrade debian:stretch to debian:buster (#5818) | 59 | * ci: upgrade debian:stretch to debian:buster (#5818) |
50 | * ci: standardize apt-get update/install & misc improvements (#5857) | 60 | * ci: standardize apt-get update/install & misc improvements (#5857) |
61 | * ci: whitelist paths, reorganize workflows & speed-up tests (#5960) | ||
62 | * ci: fix dependabot duplicated workflow runs (#5984) | ||
63 | * ci: allow running workflows manually (#6026) | ||
64 | * contrib/syntax: remove 'text/plain' from firejail-profile.lang.in (#6057 | ||
65 | #6059) | ||
51 | * contrib/vim: match profile files more broadly (#5850) | 66 | * contrib/vim: match profile files more broadly (#5850) |
52 | * test: split individual test groups in github workflows | 67 | * test: split individual test groups in github workflows |
53 | * test: add chroot, appimage and network tests in github workflows | 68 | * test: add chroot, appimage and network tests in github workflows |
@@ -58,6 +73,9 @@ firejail (0.9.73) baseline; urgency=low | |||
58 | * docs: add uninstall instructions to README.md (#5812) | 73 | * docs: add uninstall instructions to README.md (#5812) |
59 | * legal: selinux.c: Split Copyright notice & use same license as upstream | 74 | * legal: selinux.c: Split Copyright notice & use same license as upstream |
60 | (#5667) | 75 | (#5667) |
76 | * profiles: standardize commented code and eol comments (#5987) | ||
77 | * profiles: replace private-opt with whitelist & document private-opt issues | ||
78 | (#6021) | ||
61 | * new profiles: fix-qdf, qpdf, zlib-flate, standard-notes, url-eater | 79 | * new profiles: fix-qdf, qpdf, zlib-flate, standard-notes, url-eater |
62 | -- netblue30 <netblue30@yahoo.com> Mon, 17 Jan 2023 09:00:00 -0500 | 80 | -- netblue30 <netblue30@yahoo.com> Mon, 17 Jan 2023 09:00:00 -0500 |
63 | 81 | ||
@@ -363,7 +381,7 @@ firejail (0.9.62) baseline; urgency=low | |||
363 | * whitelisting /usr/share in a large number of profiles | 381 | * whitelisting /usr/share in a large number of profiles |
364 | * new scripts in contrib: gdb-firejail.sh and sort.py | 382 | * new scripts in contrib: gdb-firejail.sh and sort.py |
365 | * enhancement: whitelist /usr/share in some profiles | 383 | * enhancement: whitelist /usr/share in some profiles |
366 | * added signal mediation ot apparmor profile | 384 | * added signal mediation to apparmor profile |
367 | * new conditions: HAS_X11, HAS_NET | 385 | * new conditions: HAS_X11, HAS_NET |
368 | * new profiles: qgis, klatexformula, klatexformula_cmdl, links, xlinks | 386 | * new profiles: qgis, klatexformula, klatexformula_cmdl, links, xlinks |
369 | * new profiles: pandoc, teams-for-linux, OpenArena, gnome-sound-recorder | 387 | * new profiles: pandoc, teams-for-linux, OpenArena, gnome-sound-recorder |
@@ -758,7 +776,7 @@ firejail (0.9.44.4) baseline; urgency=low | |||
758 | 776 | ||
759 | firejail (0.9.44.2) baseline; urgency=low | 777 | firejail (0.9.44.2) baseline; urgency=low |
760 | * security: overwrite /etc/resolv.conf found by Martin Carpenter (CVE-2016-10118) | 778 | * security: overwrite /etc/resolv.conf found by Martin Carpenter (CVE-2016-10118) |
761 | * secuirty: TOCTOU exploit for --get and --put found by Daniel Hodson | 779 | * security: TOCTOU exploit for --get and --put found by Daniel Hodson |
762 | * security: invalid environment exploit found by Martin Carpenter (CVE-2016-10122) | 780 | * security: invalid environment exploit found by Martin Carpenter (CVE-2016-10122) |
763 | * security: several security enhancements | 781 | * security: several security enhancements |
764 | * bugfix: crashing VLC by pressing Ctrl-O | 782 | * bugfix: crashing VLC by pressing Ctrl-O |
diff --git a/ci/check/profiles/sort-firecfg.config.sh b/ci/check/profiles/sort-firecfg.config.sh index 17a595350..dbfbf24f5 100755 --- a/ci/check/profiles/sort-firecfg.config.sh +++ b/ci/check/profiles/sort-firecfg.config.sh | |||
@@ -1,2 +1,5 @@ | |||
1 | #!/bin/sh | 1 | #!/bin/sh |
2 | tail -n +4 "$1" | sed 's/^# /#/' | LC_ALL=C sort -c -d | 2 | # See ../../../src/firecfg/firecfg.config |
3 | |||
4 | sed -E -e '/^#$/d' -e '/^# /d' -e 's/^#([^ ])/\1/' "$1" | | ||
5 | LC_ALL=C sort -c -u | ||
diff --git a/contrib/jail_prober.py b/contrib/jail_prober.py index fcfe90eb7..070079e09 100755 --- a/contrib/jail_prober.py +++ b/contrib/jail_prober.py | |||
@@ -151,8 +151,8 @@ def run_firejail(program, all_args): | |||
151 | if arg: | 151 | if arg: |
152 | myargs.insert(-1, arg) | 152 | myargs.insert(-1, arg) |
153 | subprocess.call(myargs) | 153 | subprocess.call(myargs) |
154 | ans = input('Did %s run correctly? [y]/n ' % program) | 154 | answer = input('Did %s run correctly? [y]/n ' % program) |
155 | if ans in ['n', 'N']: | 155 | if answer in ['n', 'N']: |
156 | bad_args.append(arg) | 156 | bad_args.append(arg) |
157 | elif arg: | 157 | elif arg: |
158 | good_args.insert(-1, arg) | 158 | good_args.insert(-1, arg) |
diff --git a/contrib/sort.py b/contrib/sort.py index cdeecf99b..a827e20ba 100755 --- a/contrib/sort.py +++ b/contrib/sort.py | |||
@@ -15,8 +15,8 @@ Usage: {path.basename(argv[0])} [/path/to/profile ...] | |||
15 | 15 | ||
16 | The following commands are supported: | 16 | The following commands are supported: |
17 | 17 | ||
18 | private-bin, private-etc, private-lib, caps.drop, caps.keep, seccomp.drop, | 18 | private-bin, private-etc, private-lib, caps.drop, caps.keep, seccomp, |
19 | seccomp.drop, protocol | 19 | seccomp.drop, seccomp.keep, protocol |
20 | 20 | ||
21 | Note that this is only applicable to commands that support multiple arguments. | 21 | Note that this is only applicable to commands that support multiple arguments. |
22 | 22 | ||
@@ -38,7 +38,7 @@ Exit Codes: | |||
38 | 38 | ||
39 | def sort_alphabetical(original_items): | 39 | def sort_alphabetical(original_items): |
40 | items = original_items.split(",") | 40 | items = original_items.split(",") |
41 | items.sort(key=str.casefold) | 41 | items.sort() |
42 | return ",".join(items) | 42 | return ",".join(items) |
43 | 43 | ||
44 | 44 | ||
diff --git a/contrib/syntax/files/firejail-profile.lang.in b/contrib/syntax/files/firejail-profile.lang.in index acd5c86ce..a5deceb2c 100644 --- a/contrib/syntax/files/firejail-profile.lang.in +++ b/contrib/syntax/files/firejail-profile.lang.in | |||
@@ -7,7 +7,7 @@ | |||
7 | --> | 7 | --> |
8 | <language id="firejail-profile" name="Firejail Profile" version="2.0" _section="Other"> | 8 | <language id="firejail-profile" name="Firejail Profile" version="2.0" _section="Other"> |
9 | <metadata> | 9 | <metadata> |
10 | <property name="mimetypes">text/plain;text/x-firejail-profile</property> | 10 | <property name="mimetypes">text/x-firejail-profile</property> |
11 | <property name="globs">*.profile;*.local;*.inc</property> | 11 | <property name="globs">*.profile;*.local;*.inc</property> |
12 | <property name="line-comment-start">#</property> | 12 | <property name="line-comment-start">#</property> |
13 | </metadata> | 13 | </metadata> |
diff --git a/contrib/syntax/lists/profile_commands_arg0.list b/contrib/syntax/lists/profile_commands_arg0.list index fd1bdb401..e7fecef4b 100644 --- a/contrib/syntax/lists/profile_commands_arg0.list +++ b/contrib/syntax/lists/profile_commands_arg0.list | |||
@@ -41,7 +41,7 @@ private-tmp | |||
41 | quiet | 41 | quiet |
42 | restrict-namespaces | 42 | restrict-namespaces |
43 | seccomp | 43 | seccomp |
44 | seccomp\.block-secondary | 44 | seccomp.block-secondary |
45 | tab | 45 | tab |
46 | tracelog | 46 | tracelog |
47 | writable-etc | 47 | writable-etc |
diff --git a/contrib/syntax/lists/profile_commands_arg1.list b/contrib/syntax/lists/profile_commands_arg1.list index 28913542f..5862f16ac 100644 --- a/contrib/syntax/lists/profile_commands_arg1.list +++ b/contrib/syntax/lists/profile_commands_arg1.list | |||
@@ -5,11 +5,13 @@ blacklist-nolog | |||
5 | caps.drop | 5 | caps.drop |
6 | caps.keep | 6 | caps.keep |
7 | cpu | 7 | cpu |
8 | dbus-system | ||
8 | dbus-system.broadcast | 9 | dbus-system.broadcast |
9 | dbus-system.call | 10 | dbus-system.call |
10 | dbus-system.own | 11 | dbus-system.own |
11 | dbus-system.see | 12 | dbus-system.see |
12 | dbus-system.talk | 13 | dbus-system.talk |
14 | dbus-user | ||
13 | dbus-user.broadcast | 15 | dbus-user.broadcast |
14 | dbus-user.call | 16 | dbus-user.call |
15 | dbus-user.own | 17 | dbus-user.own |
@@ -74,4 +76,5 @@ tmpfs | |||
74 | veth-name | 76 | veth-name |
75 | whitelist | 77 | whitelist |
76 | whitelist-ro | 78 | whitelist-ro |
79 | x11 | ||
77 | xephyr-screen | 80 | xephyr-screen |
diff --git a/etc-fixes/0.9.38/firefox.profile b/etc-fixes/0.9.38/firefox.profile index 00244aaa4..3b8264e75 100644 --- a/etc-fixes/0.9.38/firefox.profile +++ b/etc-fixes/0.9.38/firefox.profile | |||
@@ -7,7 +7,7 @@ include /etc/firejail/disable-devel.inc | |||
7 | caps.drop all | 7 | caps.drop all |
8 | 8 | ||
9 | #seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice | 9 | #seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice |
10 | seccomp.drop adjtimex,clock_adjtime,clock_settime,settimeofday,stime,modify_ldt,subpage_prot,switch_endian,vm86,vm86old,lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext,delete_module,finit_module,init_module,_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver,ioperm,iopl,pciconfig_iobase,pciconfig_read,pciconfig_write,s390_mmio_read,s390_mmio_write,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice | 10 | seccomp.drop adjtimex,clock_adjtime,clock_settime,settimeofday,stime,modify_ldt,subpage_prot,switch_endian,vm86,vm86old,lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext,delete_module,finit_module,init_module,_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver,ioperm,iopl,pciconfig_iobase,pciconfig_read,pciconfig_write,s390_pci_mmio_read,s390_pci_mmio_write,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice |
11 | 11 | ||
12 | protocol unix,inet,inet6,netlink | 12 | protocol unix,inet,inet6,netlink |
13 | netfilter | 13 | netfilter |
diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc index 9576239f3..8083ef1a8 100644 --- a/etc/inc/allow-common-devel.inc +++ b/etc/inc/allow-common-devel.inc | |||
@@ -2,6 +2,10 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include allow-common-devel.local | 3 | include allow-common-devel.local |
4 | 4 | ||
5 | # Arduino | ||
6 | noblacklist ${HOME}/.arduino15 | ||
7 | noblacklist ${HOME}/Arduino | ||
8 | |||
5 | # Git | 9 | # Git |
6 | noblacklist ${HOME}/.config/git | 10 | noblacklist ${HOME}/.config/git |
7 | noblacklist ${HOME}/.gitconfig | 11 | noblacklist ${HOME}/.gitconfig |
@@ -26,6 +30,9 @@ noblacklist ${HOME}/.yarn-config | |||
26 | noblacklist ${HOME}/.yarncache | 30 | noblacklist ${HOME}/.yarncache |
27 | noblacklist ${HOME}/.yarnrc | 31 | noblacklist ${HOME}/.yarnrc |
28 | 32 | ||
33 | # PlatformIO | ||
34 | noblacklist ${HOME}/.platformio | ||
35 | |||
29 | # Python | 36 | # Python |
30 | noblacklist ${HOME}/.pylint.d | 37 | noblacklist ${HOME}/.pylint.d |
31 | noblacklist ${HOME}/.python-history | 38 | noblacklist ${HOME}/.python-history |
@@ -37,3 +44,4 @@ noblacklist ${HOME}/.bundle | |||
37 | 44 | ||
38 | # Rust | 45 | # Rust |
39 | noblacklist ${HOME}/.cargo | 46 | noblacklist ${HOME}/.cargo |
47 | noblacklist ${HOME}/.rustup | ||
diff --git a/etc/inc/allow-ssh.inc b/etc/inc/allow-ssh.inc index 024d87be7..6b2c5846e 100644 --- a/etc/inc/allow-ssh.inc +++ b/etc/inc/allow-ssh.inc | |||
@@ -6,7 +6,7 @@ noblacklist ${HOME}/.ssh | |||
6 | noblacklist /etc/ssh | 6 | noblacklist /etc/ssh |
7 | noblacklist /etc/ssh/ssh_config | 7 | noblacklist /etc/ssh/ssh_config |
8 | noblacklist /etc/ssh/ssh_config.d | 8 | noblacklist /etc/ssh/ssh_config.d |
9 | noblacklist ${PATH}/ssh | 9 | noblacklist ${PATH}/ssh* |
10 | noblacklist /tmp/ssh-* | 10 | noblacklist /tmp/ssh-* |
11 | # Arch Linux and derivatives | 11 | # Arch Linux and derivatives |
12 | noblacklist /usr/lib/ssh | 12 | noblacklist /usr/lib/ssh |
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index ce4f08958..55aabbc73 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -33,7 +33,8 @@ blacklist-nolog ${HOME}/.viminfo | |||
33 | blacklist-nolog /tmp/clipmenu* | 33 | blacklist-nolog /tmp/clipmenu* |
34 | 34 | ||
35 | # X11 session autostart | 35 | # X11 session autostart |
36 | # blacklist ${HOME}/.xpra - this will kill --x11=xpra cmdline option for all programs | 36 | # this will kill --x11=xpra cmdline option for all programs |
37 | #blacklist ${HOME}/.xpra | ||
37 | blacklist ${HOME}/.Xsession | 38 | blacklist ${HOME}/.Xsession |
38 | blacklist ${HOME}/.blackbox | 39 | blacklist ${HOME}/.blackbox |
39 | blacklist ${HOME}/.config/autostart | 40 | blacklist ${HOME}/.config/autostart |
@@ -170,7 +171,7 @@ blacklist ${RUNUSER}/gsconnect | |||
170 | blacklist ${HOME}/.config/systemd | 171 | blacklist ${HOME}/.config/systemd |
171 | blacklist ${HOME}/.local/share/systemd | 172 | blacklist ${HOME}/.local/share/systemd |
172 | blacklist ${PATH}/systemctl | 173 | blacklist ${PATH}/systemctl |
173 | blacklist ${PATH}/systemd-run | 174 | blacklist ${PATH}/systemd* |
174 | blacklist ${RUNUSER}/systemd | 175 | blacklist ${RUNUSER}/systemd |
175 | blacklist /etc/credstore* | 176 | blacklist /etc/credstore* |
176 | blacklist /etc/systemd/network | 177 | blacklist /etc/systemd/network |
@@ -191,6 +192,7 @@ blacklist ${HOME}/.VirtualBox | |||
191 | blacklist ${HOME}/VirtualBox VMs | 192 | blacklist ${HOME}/VirtualBox VMs |
192 | 193 | ||
193 | # GNOME Boxes | 194 | # GNOME Boxes |
195 | blacklist ${HOME}/.cache/gnome-boxes | ||
194 | blacklist ${HOME}/.config/gnome-boxes | 196 | blacklist ${HOME}/.config/gnome-boxes |
195 | blacklist ${HOME}/.local/share/gnome-boxes | 197 | blacklist ${HOME}/.local/share/gnome-boxes |
196 | 198 | ||
@@ -241,8 +243,9 @@ blacklist /var/lib/mysql/mysql.sock | |||
241 | blacklist /var/lib/mysqld/mysql.sock | 243 | blacklist /var/lib/mysqld/mysql.sock |
242 | blacklist /var/lib/pacman | 244 | blacklist /var/lib/pacman |
243 | blacklist /var/lib/upower | 245 | blacklist /var/lib/upower |
244 | # blacklist /var/log - a virtual /var/log directory (mostly empty) is build up by default for | 246 | # a virtual /var/log directory (mostly empty) is build up by default for every |
245 | # every sandbox, unless --writable-var-log switch is activated | 247 | # sandbox, unless --writable-var-log switch is activated |
248 | #blacklist /var/log | ||
246 | blacklist /var/mail | 249 | blacklist /var/mail |
247 | blacklist /var/opt | 250 | blacklist /var/opt |
248 | blacklist /var/run/acpid.socket | 251 | blacklist /var/run/acpid.socket |
@@ -319,7 +322,7 @@ read-only ${HOME}/.zshenv | |||
319 | read-only ${HOME}/.zshrc | 322 | read-only ${HOME}/.zshrc |
320 | read-only ${HOME}/.zshrc.local | 323 | read-only ${HOME}/.zshrc.local |
321 | 324 | ||
322 | # Remote access | 325 | # Remote access (used only by sshd; should always be blacklisted) |
323 | blacklist ${HOME}/.rhosts | 326 | blacklist ${HOME}/.rhosts |
324 | blacklist ${HOME}/.shosts | 327 | blacklist ${HOME}/.shosts |
325 | blacklist ${HOME}/.ssh/authorized_keys | 328 | blacklist ${HOME}/.ssh/authorized_keys |
@@ -327,13 +330,12 @@ blacklist ${HOME}/.ssh/authorized_keys2 | |||
327 | blacklist ${HOME}/.ssh/environment | 330 | blacklist ${HOME}/.ssh/environment |
328 | blacklist ${HOME}/.ssh/rc | 331 | blacklist ${HOME}/.ssh/rc |
329 | blacklist /etc/hosts.equiv | 332 | blacklist /etc/hosts.equiv |
330 | read-only ${HOME}/.ssh/config | ||
331 | read-only ${HOME}/.ssh/config.d | ||
332 | 333 | ||
333 | # Initialization files that allow arbitrary command execution | 334 | # Initialization files that allow arbitrary command execution |
334 | read-only ${HOME}/.caffrc | 335 | read-only ${HOME}/.caffrc |
335 | read-only ${HOME}/.cargo/env | 336 | read-only ${HOME}/.cargo/env |
336 | read-only ${HOME}/.config/mpv | 337 | read-only ${HOME}/.config/mpv |
338 | read-only ${HOME}/.config/msmtp | ||
337 | read-only ${HOME}/.config/nano | 339 | read-only ${HOME}/.config/nano |
338 | read-only ${HOME}/.config/nvim | 340 | read-only ${HOME}/.config/nvim |
339 | read-only ${HOME}/.config/pkcs11 | 341 | read-only ${HOME}/.config/pkcs11 |
@@ -360,6 +362,8 @@ read-only ${HOME}/.nanorc | |||
360 | read-only ${HOME}/.npmrc | 362 | read-only ${HOME}/.npmrc |
361 | read-only ${HOME}/.pythonrc.py | 363 | read-only ${HOME}/.pythonrc.py |
362 | read-only ${HOME}/.reportbugrc | 364 | read-only ${HOME}/.reportbugrc |
365 | read-only ${HOME}/.ssh/config | ||
366 | read-only ${HOME}/.ssh/config.d | ||
363 | read-only ${HOME}/.tmux.conf | 367 | read-only ${HOME}/.tmux.conf |
364 | read-only ${HOME}/.vim | 368 | read-only ${HOME}/.vim |
365 | read-only ${HOME}/.viminfo | 369 | read-only ${HOME}/.viminfo |
@@ -422,6 +426,7 @@ blacklist /etc/group- | |||
422 | blacklist /etc/gshadow | 426 | blacklist /etc/gshadow |
423 | blacklist /etc/gshadow+ | 427 | blacklist /etc/gshadow+ |
424 | blacklist /etc/gshadow- | 428 | blacklist /etc/gshadow- |
429 | blacklist /etc/msmtprc | ||
425 | blacklist /etc/passwd+ | 430 | blacklist /etc/passwd+ |
426 | blacklist /etc/passwd- | 431 | blacklist /etc/passwd- |
427 | blacklist /etc/shadow | 432 | blacklist /etc/shadow |
@@ -444,6 +449,7 @@ blacklist ${HOME}/.cargo/credentials.toml | |||
444 | blacklist ${HOME}/.cert | 449 | blacklist ${HOME}/.cert |
445 | blacklist ${HOME}/.config/hub | 450 | blacklist ${HOME}/.config/hub |
446 | blacklist ${HOME}/.config/keybase | 451 | blacklist ${HOME}/.config/keybase |
452 | blacklist ${HOME}/.config/msmtp | ||
447 | blacklist ${HOME}/.davfs2/secrets | 453 | blacklist ${HOME}/.davfs2/secrets |
448 | blacklist ${HOME}/.ecryptfs | 454 | blacklist ${HOME}/.ecryptfs |
449 | blacklist ${HOME}/.fetchmailrc | 455 | blacklist ${HOME}/.fetchmailrc |
@@ -502,6 +508,7 @@ blacklist /usr/sbin | |||
502 | 508 | ||
503 | # system management and various SUID executables | 509 | # system management and various SUID executables |
504 | blacklist ${PATH}/at | 510 | blacklist ${PATH}/at |
511 | blacklist ${PATH}/bmon | ||
505 | blacklist ${PATH}/busybox | 512 | blacklist ${PATH}/busybox |
506 | blacklist ${PATH}/chage | 513 | blacklist ${PATH}/chage |
507 | blacklist ${PATH}/chfn | 514 | blacklist ${PATH}/chfn |
@@ -510,69 +517,96 @@ blacklist ${PATH}/crontab | |||
510 | blacklist ${PATH}/doas | 517 | blacklist ${PATH}/doas |
511 | blacklist ${PATH}/evtest | 518 | blacklist ${PATH}/evtest |
512 | blacklist ${PATH}/expiry | 519 | blacklist ${PATH}/expiry |
513 | blacklist ${PATH}/fusermount | 520 | blacklist ${PATH}/fping |
521 | blacklist ${PATH}/fping6 | ||
522 | blacklist ${PATH}/fusermount* | ||
514 | blacklist ${PATH}/gksu | 523 | blacklist ${PATH}/gksu |
515 | blacklist ${PATH}/gksudo | 524 | blacklist ${PATH}/gksudo |
516 | blacklist ${PATH}/gpasswd | 525 | blacklist ${PATH}/gpasswd |
526 | blacklist ${PATH}/groupmems | ||
527 | blacklist ${PATH}/hostname | ||
528 | #blacklist ${PATH}/ip # breaks --ip=dhcp | ||
517 | blacklist ${PATH}/kdesudo | 529 | blacklist ${PATH}/kdesudo |
518 | blacklist ${PATH}/ksu | 530 | blacklist ${PATH}/ksu |
519 | blacklist ${PATH}/mount | 531 | blacklist ${PATH}/mount |
520 | blacklist ${PATH}/mount.ecryptfs_private | 532 | blacklist ${PATH}/mount.* |
533 | blacklist ${PATH}/mountpoint | ||
534 | blacklist ${PATH}/mtr | ||
535 | blacklist ${PATH}/mtr-packet | ||
521 | blacklist ${PATH}/nc | 536 | blacklist ${PATH}/nc |
537 | blacklist ${PATH}/nc.openbsd | ||
538 | blacklist ${PATH}/nc.traditional | ||
522 | blacklist ${PATH}/ncat | 539 | blacklist ${PATH}/ncat |
523 | blacklist ${PATH}/nmap | 540 | blacklist ${PATH}/netstat |
541 | blacklist ${PATH}/networkctl | ||
524 | blacklist ${PATH}/newgidmap | 542 | blacklist ${PATH}/newgidmap |
525 | blacklist ${PATH}/newgrp | 543 | blacklist ${PATH}/newgrp |
526 | blacklist ${PATH}/newuidmap | 544 | blacklist ${PATH}/newuidmap |
545 | blacklist ${PATH}/nm-online | ||
546 | blacklist ${PATH}/nmap | ||
547 | blacklist ${PATH}/nmcli | ||
548 | blacklist ${PATH}/nmtui | ||
549 | blacklist ${PATH}/nmtui-connect | ||
550 | blacklist ${PATH}/nmtui-edit | ||
551 | blacklist ${PATH}/nmtui-hostname | ||
527 | blacklist ${PATH}/ntfs-3g | 552 | blacklist ${PATH}/ntfs-3g |
553 | blacklist ${PATH}/passwd | ||
554 | blacklist ${PATH}/physlock | ||
528 | blacklist ${PATH}/pkexec | 555 | blacklist ${PATH}/pkexec |
556 | blacklist ${PATH}/plocate | ||
557 | blacklist ${PATH}/pmount | ||
529 | blacklist ${PATH}/procmail | 558 | blacklist ${PATH}/procmail |
559 | blacklist ${PATH}/pumount | ||
560 | blacklist ${PATH}/schroot | ||
530 | blacklist ${PATH}/sg | 561 | blacklist ${PATH}/sg |
562 | blacklist ${PATH}/slock | ||
563 | blacklist ${PATH}/ss | ||
564 | blacklist ${PATH}/ssmtp | ||
531 | blacklist ${PATH}/strace | 565 | blacklist ${PATH}/strace |
532 | blacklist ${PATH}/su | 566 | blacklist ${PATH}/su |
533 | blacklist ${PATH}/sudo | 567 | blacklist ${PATH}/sudo |
568 | blacklist ${PATH}/suexec | ||
534 | blacklist ${PATH}/tcpdump | 569 | blacklist ${PATH}/tcpdump |
570 | blacklist ${PATH}/traceroute | ||
535 | blacklist ${PATH}/umount | 571 | blacklist ${PATH}/umount |
536 | blacklist ${PATH}/unix_chkpwd | 572 | blacklist ${PATH}/unix_chkpwd |
573 | blacklist ${PATH}/wall | ||
574 | blacklist ${PATH}/write | ||
575 | blacklist ${PATH}/wshowkeys | ||
537 | blacklist ${PATH}/xev | 576 | blacklist ${PATH}/xev |
538 | blacklist ${PATH}/xinput | 577 | blacklist ${PATH}/xinput |
539 | # from 0.9.67 | 578 | blacklist /usr/lib/chromium/chrome-sandbox |
540 | blacklist /usr/lib/openssh | ||
541 | blacklist /usr/lib/ssh | ||
542 | blacklist /usr/libexec/openssh | ||
543 | blacklist ${PATH}/passwd | ||
544 | blacklist /usr/lib/xorg/Xorg.wrap | ||
545 | blacklist /usr/lib/policykit-1/polkit-agent-helper-1 | ||
546 | blacklist /usr/lib/dbus-1.0/dbus-daemon-launch-helper | 579 | blacklist /usr/lib/dbus-1.0/dbus-daemon-launch-helper |
547 | blacklist /usr/lib/eject/dmcrypt-get-device | 580 | blacklist /usr/lib/eject/dmcrypt-get-device |
548 | blacklist /usr/lib/chromium/chrome-sandbox | 581 | blacklist /usr/lib/openssh |
549 | blacklist /usr/lib/opera/opera_sandbox | 582 | blacklist /usr/lib/opera/opera_sandbox |
550 | blacklist /usr/lib/vmware | 583 | blacklist /usr/lib/policykit-1/polkit-agent-helper-1 |
551 | blacklist ${PATH}/suexec | ||
552 | blacklist /usr/lib/squid/basic_pam_auth | 584 | blacklist /usr/lib/squid/basic_pam_auth |
553 | blacklist ${PATH}/slock | 585 | blacklist /usr/lib/ssh |
554 | blacklist ${PATH}/physlock | 586 | blacklist /usr/lib/vmware |
555 | blacklist ${PATH}/schroot | 587 | blacklist /usr/lib/xorg/Xorg.wrap |
556 | blacklist ${PATH}/wshowkeys | 588 | blacklist /usr/libexec/openssh |
557 | blacklist ${PATH}/pmount | 589 | # since firejail version 0.9.73 |
558 | blacklist ${PATH}/pumount | 590 | blacklist ${PATH}/dpkg* |
559 | blacklist ${PATH}/bmon | 591 | blacklist ${PATH}/apt* |
560 | blacklist ${PATH}/fping | 592 | blacklist ${PATH}/dumpcap |
561 | blacklist ${PATH}/fping6 | 593 | blacklist ${PATH}/efibootdump |
562 | blacklist ${PATH}/hostname | 594 | blacklist ${PATH}/efibootmgr |
563 | # blacklist ${PATH}/ip - breaks --ip=dhcp | 595 | blacklist ${PATH}/passmass |
564 | blacklist ${PATH}/mtr | 596 | blacklist ${PATH}/proxy |
565 | blacklist ${PATH}/mtr-packet | 597 | blacklist ${PATH}/aa-* |
566 | blacklist ${PATH}/netstat | 598 | blacklist ${PATH}/airscan-discover |
567 | blacklist ${PATH}/nm-online | 599 | blacklist ${PATH}/avahi* |
568 | blacklist ${PATH}/nmcli | 600 | blacklist ${PATH}/dbus-* |
569 | blacklist ${PATH}/nmtui | 601 | blacklist ${PATH}/debconf* |
570 | blacklist ${PATH}/nmtui-connect | 602 | blacklist ${PATH}/grub-* |
571 | blacklist ${PATH}/nmtui-edit | 603 | blacklist ${PATH}/kernel-install # from systemd package |
572 | blacklist ${PATH}/nmtui-hostname | 604 | |
573 | blacklist ${PATH}/networkctl | 605 | # binaries installed by firejail |
574 | blacklist ${PATH}/ss | 606 | blacklist ${PATH}/firemon |
575 | blacklist ${PATH}/traceroute | 607 | blacklist ${PATH}/firecfg |
608 | blacklist ${PATH}/jailcheck | ||
609 | blacklist ${PATH}/firetools | ||
576 | 610 | ||
577 | # other SUID binaries | 611 | # other SUID binaries |
578 | blacklist /opt/microsoft/msedge*/msedge-sandbox | 612 | blacklist /opt/microsoft/msedge*/msedge-sandbox |
@@ -585,11 +619,13 @@ blacklist /tmp/.lxterminal-socket* | |||
585 | blacklist /tmp/tmux-* | 619 | blacklist /tmp/tmux-* |
586 | 620 | ||
587 | # disable terminals running as server resulting in sandbox escape | 621 | # disable terminals running as server resulting in sandbox escape |
622 | blacklist ${PATH}/foot | ||
623 | blacklist ${PATH}/footserver | ||
588 | blacklist ${PATH}/gnome-terminal | 624 | blacklist ${PATH}/gnome-terminal |
589 | blacklist ${PATH}/gnome-terminal.wrapper | 625 | blacklist ${PATH}/gnome-terminal.wrapper |
590 | blacklist ${PATH}/kgx | 626 | blacklist ${PATH}/kgx |
591 | # blacklist ${PATH}/konsole | ||
592 | # konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 | 627 | # konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 |
628 | #blacklist ${PATH}/konsole | ||
593 | blacklist ${PATH}/lilyterm | 629 | blacklist ${PATH}/lilyterm |
594 | blacklist ${PATH}/lxterminal | 630 | blacklist ${PATH}/lxterminal |
595 | blacklist ${PATH}/mate-terminal | 631 | blacklist ${PATH}/mate-terminal |
@@ -653,10 +689,13 @@ blacklist ${HOME}/sent | |||
653 | blacklist /proc/config.gz | 689 | blacklist /proc/config.gz |
654 | 690 | ||
655 | # prevent DNS malware attempting to communicate with the server using regular DNS tools | 691 | # prevent DNS malware attempting to communicate with the server using regular DNS tools |
692 | blacklist ${PATH}/delv | ||
656 | blacklist ${PATH}/dig | 693 | blacklist ${PATH}/dig |
657 | blacklist ${PATH}/dlint | 694 | blacklist ${PATH}/dlint |
658 | blacklist ${PATH}/dns2tcp | 695 | blacklist ${PATH}/dns2tcp |
659 | blacklist ${PATH}/dnssec-* | 696 | blacklist ${PATH}/dnssec-* |
697 | blacklist ${PATH}/dnstap-read | ||
698 | blacklist ${PATH}/mdig | ||
660 | blacklist ${PATH}/dnswalk | 699 | blacklist ${PATH}/dnswalk |
661 | blacklist ${PATH}/drill | 700 | blacklist ${PATH}/drill |
662 | blacklist ${PATH}/host | 701 | blacklist ${PATH}/host |
@@ -667,12 +706,14 @@ blacklist ${PATH}/knsupdate | |||
667 | blacklist ${PATH}/ldns-* | 706 | blacklist ${PATH}/ldns-* |
668 | blacklist ${PATH}/ldnsd | 707 | blacklist ${PATH}/ldnsd |
669 | blacklist ${PATH}/nslookup | 708 | blacklist ${PATH}/nslookup |
709 | blacklist ${PATH}/nsupdate | ||
710 | blacklist ${PATH}/nstat | ||
670 | blacklist ${PATH}/resolvectl | 711 | blacklist ${PATH}/resolvectl |
671 | blacklist ${PATH}/unbound-host | 712 | blacklist ${PATH}/unbound-host |
672 | 713 | ||
673 | # prevent an intruder to guess passwords using regular network tools | 714 | # prevent an intruder to guess passwords using regular network tools |
674 | blacklist ${PATH}/ftp | 715 | blacklist ${PATH}/ftp |
675 | blacklist ${PATH}/ssh | 716 | blacklist ${PATH}/ssh* |
676 | blacklist ${PATH}/telnet | 717 | blacklist ${PATH}/telnet |
677 | 718 | ||
678 | # rest of ${RUNUSER} | 719 | # rest of ${RUNUSER} |
diff --git a/etc/inc/disable-devel.inc b/etc/inc/disable-devel.inc index 360077936..ae64f456e 100644 --- a/etc/inc/disable-devel.inc +++ b/etc/inc/disable-devel.inc | |||
@@ -4,32 +4,72 @@ include disable-devel.local | |||
4 | 4 | ||
5 | # development tools | 5 | # development tools |
6 | 6 | ||
7 | # autoconf/automake | ||
8 | blacklist ${PATH}/aclocal* | ||
9 | blacklist ${PATH}/autoconf | ||
10 | blacklist ${PATH}/autoheader | ||
11 | blacklist ${PATH}/autom4te | ||
12 | blacklist ${PATH}/automake* | ||
13 | blacklist ${PATH}/autoreconf | ||
14 | blacklist ${PATH}/autoscan | ||
15 | blacklist ${PATH}/autoupdate | ||
16 | blacklist ${PATH}/ifnames | ||
17 | blacklist ${PATH}/m4 | ||
18 | |||
19 | # patch | ||
20 | blacklist ${PATH}/elfedit | ||
21 | blacklist ${PATH}/espdiff | ||
22 | blacklist ${PATH}/patch | ||
23 | blacklist ${PATH}/patchview | ||
24 | |||
25 | # packaging | ||
26 | blacklist ${PATH}/dh_* | ||
27 | blacklist ${PATH}/fakeroot* | ||
28 | blacklist ${PATH}/lintian | ||
29 | |||
30 | # expect | ||
31 | blacklist ${PATH}/autoexpect | ||
32 | blacklist ${PATH}/expect* | ||
33 | |||
7 | # clang/llvm | 34 | # clang/llvm |
35 | blacklist ${PATH}/analyze-build* | ||
36 | blacklist ${PATH}/asan_symbolize* | ||
37 | blacklist ${PATH}/bugpoint* | ||
38 | blacklist ${PATH}/c-index-test* | ||
8 | blacklist ${PATH}/clang* | 39 | blacklist ${PATH}/clang* |
40 | blacklist ${PATH}/llc* | ||
9 | blacklist ${PATH}/lldb* | 41 | blacklist ${PATH}/lldb* |
42 | blacklist ${PATH}/lli* | ||
10 | blacklist ${PATH}/llvm* | 43 | blacklist ${PATH}/llvm* |
44 | blacklist ${PATH}/scan-build | ||
11 | # see issue #2106 - it disables hardware acceleration in Firefox on Radeon GPU | 45 | # see issue #2106 - it disables hardware acceleration in Firefox on Radeon GPU |
12 | # blacklist /usr/lib/llvm* | 46 | #blacklist /usr/lib/llvm* |
13 | 47 | ||
14 | # GCC | 48 | # GCC |
49 | blacklist ${PATH}/*-g++* | ||
50 | blacklist ${PATH}/*-g++* | ||
51 | blacklist ${PATH}/*-gcc* | ||
52 | blacklist ${PATH}/*-gcc* | ||
15 | blacklist ${PATH}/as | 53 | blacklist ${PATH}/as |
16 | blacklist ${PATH}/cc | ||
17 | blacklist ${PATH}/c++* | 54 | blacklist ${PATH}/c++* |
18 | blacklist ${PATH}/c8* | 55 | blacklist ${PATH}/c8* |
19 | blacklist ${PATH}/c9* | 56 | blacklist ${PATH}/c9* |
57 | blacklist ${PATH}/cc | ||
20 | blacklist ${PATH}/cpp* | 58 | blacklist ${PATH}/cpp* |
59 | blacklist ${PATH}/elfedit | ||
21 | blacklist ${PATH}/g++* | 60 | blacklist ${PATH}/g++* |
22 | blacklist ${PATH}/gcc* | 61 | blacklist ${PATH}/gcc* |
62 | blacklist ${PATH}/gcov* | ||
23 | blacklist ${PATH}/gdb | 63 | blacklist ${PATH}/gdb |
64 | blacklist ${PATH}/gmake | ||
24 | blacklist ${PATH}/ld | 65 | blacklist ${PATH}/ld |
25 | blacklist ${PATH}/*-gcc* | 66 | blacklist ${PATH}/make |
26 | blacklist ${PATH}/*-g++* | 67 | blacklist ${PATH}/make-first-existing-target |
27 | blacklist ${PATH}/*-gcc* | 68 | blacklist ${PATH}/x86_64-linux-gnu-* |
28 | blacklist ${PATH}/*-g++* | ||
29 | # seems to create problems on Gentoo | 69 | # seems to create problems on Gentoo |
30 | #blacklist /usr/lib/gcc | 70 | #blacklist /usr/lib/gcc |
31 | 71 | ||
32 | #Go | 72 | # Go |
33 | blacklist ${PATH}/gccgo | 73 | blacklist ${PATH}/gccgo |
34 | blacklist ${PATH}/go | 74 | blacklist ${PATH}/go |
35 | blacklist ${PATH}/gofmt | 75 | blacklist ${PATH}/gofmt |
@@ -48,15 +88,14 @@ blacklist ${PATH}/scala3-compiler | |||
48 | blacklist ${PATH}/scala3-repl | 88 | blacklist ${PATH}/scala3-repl |
49 | blacklist ${PATH}/scalac | 89 | blacklist ${PATH}/scalac |
50 | 90 | ||
51 | #OpenSSL | 91 | # OpenSSL |
52 | blacklist ${PATH}/openssl | 92 | blacklist ${PATH}/openssl |
53 | blacklist ${PATH}/openssl-1.0 | 93 | blacklist ${PATH}/openssl-1.0 |
54 | 94 | ||
55 | #Rust | 95 | # Rust |
56 | blacklist ${PATH}/rust-gdb | 96 | blacklist ${PATH}/rust-gdb |
57 | blacklist ${PATH}/rust-lldb | 97 | blacklist ${PATH}/rust-lldb |
58 | blacklist ${PATH}/rustc | 98 | blacklist ${PATH}/rustc |
59 | blacklist ${HOME}/.rustup | ||
60 | 99 | ||
61 | # tcc - Tiny C Compiler | 100 | # tcc - Tiny C Compiler |
62 | blacklist ${PATH}/tcc | 101 | blacklist ${PATH}/tcc |
@@ -68,7 +107,7 @@ blacklist ${PATH}/valgrind* | |||
68 | blacklist /usr/lib/valgrind | 107 | blacklist /usr/lib/valgrind |
69 | 108 | ||
70 | # Source-Code | 109 | # Source-Code |
71 | blacklist /usr/src | ||
72 | blacklist /usr/local/src | ||
73 | blacklist /usr/include | 110 | blacklist /usr/include |
74 | blacklist /usr/local/include | 111 | blacklist /usr/local/include |
112 | blacklist /usr/local/src | ||
113 | blacklist /usr/src | ||
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index d2ae55867..13b4b2078 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -22,7 +22,6 @@ blacklist ${HOME}/.Steampid | |||
22 | blacklist ${HOME}/.TelegramDesktop | 22 | blacklist ${HOME}/.TelegramDesktop |
23 | blacklist ${HOME}/.VSCodium | 23 | blacklist ${HOME}/.VSCodium |
24 | blacklist ${HOME}/.ViberPC | 24 | blacklist ${HOME}/.ViberPC |
25 | blacklist ${HOME}/.VirtualBox | ||
26 | blacklist ${HOME}/.WebStorm* | 25 | blacklist ${HOME}/.WebStorm* |
27 | blacklist ${HOME}/.Wolfram Research | 26 | blacklist ${HOME}/.Wolfram Research |
28 | blacklist ${HOME}/.ZAP | 27 | blacklist ${HOME}/.ZAP |
@@ -112,6 +111,7 @@ blacklist ${HOME}/.cache/falkon | |||
112 | blacklist ${HOME}/.cache/feedreader | 111 | blacklist ${HOME}/.cache/feedreader |
113 | blacklist ${HOME}/.cache/firedragon | 112 | blacklist ${HOME}/.cache/firedragon |
114 | blacklist ${HOME}/.cache/flaska.net/trojita | 113 | blacklist ${HOME}/.cache/flaska.net/trojita |
114 | blacklist ${HOME}/.cache/floorp | ||
115 | blacklist ${HOME}/.cache/folks | 115 | blacklist ${HOME}/.cache/folks |
116 | blacklist ${HOME}/.cache/font-manager | 116 | blacklist ${HOME}/.cache/font-manager |
117 | blacklist ${HOME}/.cache/fossamail | 117 | blacklist ${HOME}/.cache/fossamail |
@@ -124,7 +124,6 @@ blacklist ${HOME}/.cache/geeqie | |||
124 | blacklist ${HOME}/.cache/gegl-0.4 | 124 | blacklist ${HOME}/.cache/gegl-0.4 |
125 | blacklist ${HOME}/.cache/gfeeds | 125 | blacklist ${HOME}/.cache/gfeeds |
126 | blacklist ${HOME}/.cache/gimp | 126 | blacklist ${HOME}/.cache/gimp |
127 | blacklist ${HOME}/.cache/gnome-boxes | ||
128 | blacklist ${HOME}/.cache/gnome-builder | 127 | blacklist ${HOME}/.cache/gnome-builder |
129 | blacklist ${HOME}/.cache/gnome-control-center | 128 | blacklist ${HOME}/.cache/gnome-control-center |
130 | blacklist ${HOME}/.cache/gnome-recipes | 129 | blacklist ${HOME}/.cache/gnome-recipes |
@@ -142,6 +141,7 @@ blacklist ${HOME}/.cache/inkscape | |||
142 | blacklist ${HOME}/.cache/inox | 141 | blacklist ${HOME}/.cache/inox |
143 | blacklist ${HOME}/.cache/io.github.lainsce.Notejot | 142 | blacklist ${HOME}/.cache/io.github.lainsce.Notejot |
144 | blacklist ${HOME}/.cache/iridium | 143 | blacklist ${HOME}/.cache/iridium |
144 | blacklist ${HOME}/.cache/journal-viewer | ||
145 | blacklist ${HOME}/.cache/kcmshell5 | 145 | blacklist ${HOME}/.cache/kcmshell5 |
146 | blacklist ${HOME}/.cache/kdenlive | 146 | blacklist ${HOME}/.cache/kdenlive |
147 | blacklist ${HOME}/.cache/keepassxc | 147 | blacklist ${HOME}/.cache/keepassxc |
@@ -156,6 +156,7 @@ blacklist ${HOME}/.cache/ksplashqml | |||
156 | blacklist ${HOME}/.cache/kube | 156 | blacklist ${HOME}/.cache/kube |
157 | blacklist ${HOME}/.cache/kwin | 157 | blacklist ${HOME}/.cache/kwin |
158 | blacklist ${HOME}/.cache/lbry-viewer | 158 | blacklist ${HOME}/.cache/lbry-viewer |
159 | blacklist ${HOME}/.cache/lettura | ||
159 | blacklist ${HOME}/.cache/libgweather | 160 | blacklist ${HOME}/.cache/libgweather |
160 | blacklist ${HOME}/.cache/librewolf | 161 | blacklist ${HOME}/.cache/librewolf |
161 | blacklist ${HOME}/.cache/liferea | 162 | blacklist ${HOME}/.cache/liferea |
@@ -171,6 +172,7 @@ blacklist ${HOME}/.cache/mirage | |||
171 | blacklist ${HOME}/.cache/moonchild productions/basilisk | 172 | blacklist ${HOME}/.cache/moonchild productions/basilisk |
172 | blacklist ${HOME}/.cache/moonchild productions/pale moon | 173 | blacklist ${HOME}/.cache/moonchild productions/pale moon |
173 | blacklist ${HOME}/.cache/mozilla | 174 | blacklist ${HOME}/.cache/mozilla |
175 | blacklist ${HOME}/.cache/mpv | ||
174 | blacklist ${HOME}/.cache/ms-excel-online | 176 | blacklist ${HOME}/.cache/ms-excel-online |
175 | blacklist ${HOME}/.cache/ms-office-online | 177 | blacklist ${HOME}/.cache/ms-office-online |
176 | blacklist ${HOME}/.cache/ms-onenote-online | 178 | blacklist ${HOME}/.cache/ms-onenote-online |
@@ -219,6 +221,7 @@ blacklist ${HOME}/.cache/supertuxkart | |||
219 | blacklist ${HOME}/.cache/systemsettings | 221 | blacklist ${HOME}/.cache/systemsettings |
220 | blacklist ${HOME}/.cache/telepathy | 222 | blacklist ${HOME}/.cache/telepathy |
221 | blacklist ${HOME}/.cache/thunderbird | 223 | blacklist ${HOME}/.cache/thunderbird |
224 | blacklist ${HOME}/.cache/tiny-rdm | ||
222 | blacklist ${HOME}/.cache/torbrowser | 225 | blacklist ${HOME}/.cache/torbrowser |
223 | blacklist ${HOME}/.cache/transmission | 226 | blacklist ${HOME}/.cache/transmission |
224 | blacklist ${HOME}/.cache/ueberzugpp | 227 | blacklist ${HOME}/.cache/ueberzugpp |
@@ -343,10 +346,10 @@ blacklist ${HOME}/.config/Slack | |||
343 | blacklist ${HOME}/.config/Standard Notes | 346 | blacklist ${HOME}/.config/Standard Notes |
344 | blacklist ${HOME}/.config/SubDownloader | 347 | blacklist ${HOME}/.config/SubDownloader |
345 | blacklist ${HOME}/.config/Thunar | 348 | blacklist ${HOME}/.config/Thunar |
349 | blacklist ${HOME}/.config/TinyRDM | ||
346 | blacklist ${HOME}/.config/Twitch | 350 | blacklist ${HOME}/.config/Twitch |
347 | blacklist ${HOME}/.config/Unknown Organization | 351 | blacklist ${HOME}/.config/Unknown Organization |
348 | blacklist ${HOME}/.config/VSCodium | 352 | blacklist ${HOME}/.config/VSCodium |
349 | blacklist ${HOME}/.config/VirtualBox | ||
350 | blacklist ${HOME}/.config/Whalebird | 353 | blacklist ${HOME}/.config/Whalebird |
351 | blacklist ${HOME}/.config/Wire | 354 | blacklist ${HOME}/.config/Wire |
352 | blacklist ${HOME}/.config/Youtube | 355 | blacklist ${HOME}/.config/Youtube |
@@ -383,6 +386,7 @@ blacklist ${HOME}/.config/borg | |||
383 | blacklist ${HOME}/.config/brasero | 386 | blacklist ${HOME}/.config/brasero |
384 | blacklist ${HOME}/.config/brave | 387 | blacklist ${HOME}/.config/brave |
385 | blacklist ${HOME}/.config/brave-flags.conf | 388 | blacklist ${HOME}/.config/brave-flags.conf |
389 | blacklist ${HOME}/.config/breezy | ||
386 | blacklist ${HOME}/.config/caja | 390 | blacklist ${HOME}/.config/caja |
387 | blacklist ${HOME}/.config/calibre | 391 | blacklist ${HOME}/.config/calibre |
388 | blacklist ${HOME}/.config/cantata | 392 | blacklist ${HOME}/.config/cantata |
@@ -404,6 +408,7 @@ blacklist ${HOME}/.config/cliqz | |||
404 | blacklist ${HOME}/.config/cmus | 408 | blacklist ${HOME}/.config/cmus |
405 | blacklist ${HOME}/.config/cointop | 409 | blacklist ${HOME}/.config/cointop |
406 | blacklist ${HOME}/.config/com.github.bleakgrey.tootle | 410 | blacklist ${HOME}/.config/com.github.bleakgrey.tootle |
411 | blacklist ${HOME}/.config/com.lettura.dev | ||
407 | blacklist ${HOME}/.config/corebird | 412 | blacklist ${HOME}/.config/corebird |
408 | blacklist ${HOME}/.config/coyim | 413 | blacklist ${HOME}/.config/coyim |
409 | blacklist ${HOME}/.config/d-feet | 414 | blacklist ${HOME}/.config/d-feet |
@@ -713,8 +718,10 @@ blacklist ${HOME}/.emacs.d | |||
713 | blacklist ${HOME}/.equalx | 718 | blacklist ${HOME}/.equalx |
714 | blacklist ${HOME}/.ethereum | 719 | blacklist ${HOME}/.ethereum |
715 | blacklist ${HOME}/.etr | 720 | blacklist ${HOME}/.etr |
721 | blacklist ${HOME}/.factorio | ||
716 | blacklist ${HOME}/.filezilla | 722 | blacklist ${HOME}/.filezilla |
717 | blacklist ${HOME}/.firedragon | 723 | blacklist ${HOME}/.firedragon |
724 | blacklist ${HOME}/.floorp | ||
718 | blacklist ${HOME}/.flowblade | 725 | blacklist ${HOME}/.flowblade |
719 | blacklist ${HOME}/.fltk | 726 | blacklist ${HOME}/.fltk |
720 | blacklist ${HOME}/.fossamail | 727 | blacklist ${HOME}/.fossamail |
@@ -830,6 +837,7 @@ blacklist ${HOME}/.klatexformula | |||
830 | blacklist ${HOME}/.klei | 837 | blacklist ${HOME}/.klei |
831 | blacklist ${HOME}/.kodi | 838 | blacklist ${HOME}/.kodi |
832 | blacklist ${HOME}/.lastpass | 839 | blacklist ${HOME}/.lastpass |
840 | blacklist ${HOME}/.lettura | ||
833 | blacklist ${HOME}/.librewolf | 841 | blacklist ${HOME}/.librewolf |
834 | blacklist ${HOME}/.lincity-ng | 842 | blacklist ${HOME}/.lincity-ng |
835 | blacklist ${HOME}/.links | 843 | blacklist ${HOME}/.links |
@@ -841,6 +849,7 @@ blacklist ${HOME}/.local/lib/vivaldi | |||
841 | blacklist ${HOME}/.local/share/0ad | 849 | blacklist ${HOME}/.local/share/0ad |
842 | blacklist ${HOME}/.local/share/3909/PapersPlease | 850 | blacklist ${HOME}/.local/share/3909/PapersPlease |
843 | blacklist ${HOME}/.local/share/Anki2 | 851 | blacklist ${HOME}/.local/share/Anki2 |
852 | blacklist ${HOME}/.local/share/Baba_Is_You | ||
844 | blacklist ${HOME}/.local/share/Colossal Order | 853 | blacklist ${HOME}/.local/share/Colossal Order |
845 | blacklist ${HOME}/.local/share/Dredmor | 854 | blacklist ${HOME}/.local/share/Dredmor |
846 | blacklist ${HOME}/.local/share/Empathy | 855 | blacklist ${HOME}/.local/share/Empathy |
@@ -900,6 +909,8 @@ blacklist ${HOME}/.local/share/cdprojektred | |||
900 | blacklist ${HOME}/.local/share/chatterino | 909 | blacklist ${HOME}/.local/share/chatterino |
901 | blacklist ${HOME}/.local/share/clipit | 910 | blacklist ${HOME}/.local/share/clipit |
902 | blacklist ${HOME}/.local/share/com.github.johnfactotum.Foliate | 911 | blacklist ${HOME}/.local/share/com.github.johnfactotum.Foliate |
912 | blacklist ${HOME}/.local/share/com.lettura.dev | ||
913 | blacklist ${HOME}/.local/share/com.vmingueza.journal-viewer | ||
903 | blacklist ${HOME}/.local/share/contacts | 914 | blacklist ${HOME}/.local/share/contacts |
904 | blacklist ${HOME}/.local/share/cor-games | 915 | blacklist ${HOME}/.local/share/cor-games |
905 | blacklist ${HOME}/.local/share/data/Mendeley Ltd. | 916 | blacklist ${HOME}/.local/share/data/Mendeley Ltd. |
@@ -917,6 +928,7 @@ blacklist ${HOME}/.local/share/evolution | |||
917 | blacklist ${HOME}/.local/share/feedreader | 928 | blacklist ${HOME}/.local/share/feedreader |
918 | blacklist ${HOME}/.local/share/feral-interactive | 929 | blacklist ${HOME}/.local/share/feral-interactive |
919 | blacklist ${HOME}/.local/share/five-or-more | 930 | blacklist ${HOME}/.local/share/five-or-more |
931 | blacklist ${HOME}/.local/share/fluffychat | ||
920 | blacklist ${HOME}/.local/share/freecol | 932 | blacklist ${HOME}/.local/share/freecol |
921 | blacklist ${HOME}/.local/share/gajim | 933 | blacklist ${HOME}/.local/share/gajim |
922 | blacklist ${HOME}/.local/share/gdfuse | 934 | blacklist ${HOME}/.local/share/gdfuse |
@@ -925,7 +937,6 @@ blacklist ${HOME}/.local/share/geeqie | |||
925 | blacklist ${HOME}/.local/share/ghostwriter | 937 | blacklist ${HOME}/.local/share/ghostwriter |
926 | blacklist ${HOME}/.local/share/gitg | 938 | blacklist ${HOME}/.local/share/gitg |
927 | blacklist ${HOME}/.local/share/gnome-2048 | 939 | blacklist ${HOME}/.local/share/gnome-2048 |
928 | blacklist ${HOME}/.local/share/gnome-boxes | ||
929 | blacklist ${HOME}/.local/share/gnome-builder | 940 | blacklist ${HOME}/.local/share/gnome-builder |
930 | blacklist ${HOME}/.local/share/gnome-chess | 941 | blacklist ${HOME}/.local/share/gnome-chess |
931 | blacklist ${HOME}/.local/share/gnome-klotski | 942 | blacklist ${HOME}/.local/share/gnome-klotski |
@@ -1005,6 +1016,7 @@ blacklist ${HOME}/.local/share/orage | |||
1005 | blacklist ${HOME}/.local/share/org.kde.gwenview | 1016 | blacklist ${HOME}/.local/share/org.kde.gwenview |
1006 | blacklist ${HOME}/.local/share/pix | 1017 | blacklist ${HOME}/.local/share/pix |
1007 | blacklist ${HOME}/.local/share/plasma_notes | 1018 | blacklist ${HOME}/.local/share/plasma_notes |
1019 | blacklist ${HOME}/.local/share/pnpm | ||
1008 | blacklist ${HOME}/.local/share/profanity | 1020 | blacklist ${HOME}/.local/share/profanity |
1009 | blacklist ${HOME}/.local/share/psi | 1021 | blacklist ${HOME}/.local/share/psi |
1010 | blacklist ${HOME}/.local/share/psi+ | 1022 | blacklist ${HOME}/.local/share/psi+ |
@@ -1027,6 +1039,7 @@ blacklist ${HOME}/.local/share/strawberry | |||
1027 | blacklist ${HOME}/.local/share/supertux2 | 1039 | blacklist ${HOME}/.local/share/supertux2 |
1028 | blacklist ${HOME}/.local/share/supertuxkart | 1040 | blacklist ${HOME}/.local/share/supertuxkart |
1029 | blacklist ${HOME}/.local/share/swell-foop | 1041 | blacklist ${HOME}/.local/share/swell-foop |
1042 | blacklist ${HOME}/.local/share/telegram-desktop | ||
1030 | blacklist ${HOME}/.local/share/telepathy | 1043 | blacklist ${HOME}/.local/share/telepathy |
1031 | blacklist ${HOME}/.local/share/terasology | 1044 | blacklist ${HOME}/.local/share/terasology |
1032 | blacklist ${HOME}/.local/share/torbrowser | 1045 | blacklist ${HOME}/.local/share/torbrowser |
@@ -1069,7 +1082,6 @@ blacklist ${HOME}/.mp3splt-gtk | |||
1069 | blacklist ${HOME}/.mpd | 1082 | blacklist ${HOME}/.mpd |
1070 | blacklist ${HOME}/.mpdconf | 1083 | blacklist ${HOME}/.mpdconf |
1071 | blacklist ${HOME}/.mplayer | 1084 | blacklist ${HOME}/.mplayer |
1072 | blacklist ${HOME}/.msmtprc | ||
1073 | blacklist ${HOME}/.mullvad/mullvadbrowser | 1085 | blacklist ${HOME}/.mullvad/mullvadbrowser |
1074 | blacklist ${HOME}/.multimc5 | 1086 | blacklist ${HOME}/.multimc5 |
1075 | blacklist ${HOME}/.nanorc | 1087 | blacklist ${HOME}/.nanorc |
@@ -1112,6 +1124,7 @@ blacklist ${HOME}/.pinerc | |||
1112 | blacklist ${HOME}/.pinercex | 1124 | blacklist ${HOME}/.pinercex |
1113 | blacklist ${HOME}/.pingus | 1125 | blacklist ${HOME}/.pingus |
1114 | blacklist ${HOME}/.pioneer | 1126 | blacklist ${HOME}/.pioneer |
1127 | blacklist ${HOME}/.platformio | ||
1115 | blacklist ${HOME}/.prey | 1128 | blacklist ${HOME}/.prey |
1116 | blacklist ${HOME}/.purple | 1129 | blacklist ${HOME}/.purple |
1117 | blacklist ${HOME}/.pylint.d | 1130 | blacklist ${HOME}/.pylint.d |
@@ -1126,6 +1139,7 @@ blacklist ${HOME}/.repo_.gitconfig.json | |||
1126 | blacklist ${HOME}/.repoconfig | 1139 | blacklist ${HOME}/.repoconfig |
1127 | blacklist ${HOME}/.retroshare | 1140 | blacklist ${HOME}/.retroshare |
1128 | blacklist ${HOME}/.ripperXrc | 1141 | blacklist ${HOME}/.ripperXrc |
1142 | blacklist ${HOME}/.rustup | ||
1129 | blacklist ${HOME}/.sbt | 1143 | blacklist ${HOME}/.sbt |
1130 | blacklist ${HOME}/.scorched3d | 1144 | blacklist ${HOME}/.scorched3d |
1131 | blacklist ${HOME}/.scribus | 1145 | blacklist ${HOME}/.scribus |
diff --git a/etc/inc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc index dcf941004..03653cc16 100644 --- a/etc/inc/whitelist-usr-share-common.inc +++ b/etc/inc/whitelist-usr-share-common.inc | |||
@@ -40,6 +40,7 @@ whitelist /usr/share/kxmlgui5 | |||
40 | whitelist /usr/share/libdrm | 40 | whitelist /usr/share/libdrm |
41 | whitelist /usr/share/libthai | 41 | whitelist /usr/share/libthai |
42 | whitelist /usr/share/locale | 42 | whitelist /usr/share/locale |
43 | whitelist /usr/share/locale-langpack | ||
43 | whitelist /usr/share/mime | 44 | whitelist /usr/share/mime |
44 | whitelist /usr/share/misc | 45 | whitelist /usr/share/misc |
45 | whitelist /usr/share/Modules | 46 | whitelist /usr/share/Modules |
diff --git a/etc/profile-a-l/0ad.profile b/etc/profile-a-l/0ad.profile index 48a2afdf2..9ec2f2ad1 100644 --- a/etc/profile-a-l/0ad.profile +++ b/etc/profile-a-l/0ad.profile | |||
@@ -10,6 +10,9 @@ noblacklist ${HOME}/.cache/0ad | |||
10 | noblacklist ${HOME}/.config/0ad | 10 | noblacklist ${HOME}/.config/0ad |
11 | noblacklist ${HOME}/.local/share/0ad | 11 | noblacklist ${HOME}/.local/share/0ad |
12 | 12 | ||
13 | # Allow gjs (blacklisted by disable-interpreters.inc) | ||
14 | include allow-gjs.inc | ||
15 | |||
13 | blacklist /usr/libexec | 16 | blacklist /usr/libexec |
14 | 17 | ||
15 | include disable-common.inc | 18 | include disable-common.inc |
diff --git a/etc/profile-a-l/abiword.profile b/etc/profile-a-l/abiword.profile index a0eed24ca..dcd1259cf 100644 --- a/etc/profile-a-l/abiword.profile +++ b/etc/profile-a-l/abiword.profile | |||
@@ -44,7 +44,7 @@ private-dev | |||
44 | private-etc @x11 | 44 | private-etc @x11 |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | # dbus-user none | 47 | #dbus-user none |
48 | # dbus-system none | 48 | #dbus-system none |
49 | 49 | ||
50 | restrict-namespaces | 50 | restrict-namespaces |
diff --git a/etc/profile-a-l/akonadi_control.profile b/etc/profile-a-l/akonadi_control.profile index 184036f24..275ff41ef 100644 --- a/etc/profile-a-l/akonadi_control.profile +++ b/etc/profile-a-l/akonadi_control.profile | |||
@@ -34,7 +34,7 @@ include whitelist-var-common.inc | |||
34 | # disabled options below are not compatible with the apparmor profile for mysqld-akonadi. | 34 | # disabled options below are not compatible with the apparmor profile for mysqld-akonadi. |
35 | # this affects ubuntu and debian currently | 35 | # this affects ubuntu and debian currently |
36 | 36 | ||
37 | # apparmor | 37 | #apparmor |
38 | caps.drop all | 38 | caps.drop all |
39 | ipc-namespace | 39 | ipc-namespace |
40 | netfilter | 40 | netfilter |
@@ -42,17 +42,17 @@ no3d | |||
42 | nodvd | 42 | nodvd |
43 | nogroups | 43 | nogroups |
44 | noinput | 44 | noinput |
45 | # nonewprivs | 45 | #nonewprivs |
46 | noroot | 46 | noroot |
47 | nosound | 47 | nosound |
48 | notv | 48 | notv |
49 | nou2f | 49 | nou2f |
50 | novideo | 50 | novideo |
51 | # protocol unix,inet,inet6,netlink | 51 | #protocol unix,inet,inet6,netlink |
52 | # seccomp !io_destroy,!io_getevents,!io_setup,!io_submit,!ioprio_set | 52 | #seccomp !io_destroy,!io_getevents,!io_setup,!io_submit,!ioprio_set |
53 | tracelog | 53 | tracelog |
54 | 54 | ||
55 | private-dev | 55 | private-dev |
56 | # private-tmp - breaks programs that depend on akonadi | 56 | #private-tmp # breaks programs that depend on akonadi |
57 | 57 | ||
58 | # restrict-namespaces | 58 | #restrict-namespaces |
diff --git a/etc/profile-a-l/akregator.profile b/etc/profile-a-l/akregator.profile index d88a1fcad..9de992a76 100644 --- a/etc/profile-a-l/akregator.profile +++ b/etc/profile-a-l/akregator.profile | |||
@@ -49,4 +49,4 @@ private-dev | |||
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | deterministic-shutdown | 51 | deterministic-shutdown |
52 | # restrict-namespaces | 52 | #restrict-namespaces |
diff --git a/etc/profile-a-l/alacarte.profile b/etc/profile-a-l/alacarte.profile index 22a303cdd..14c425cc6 100644 --- a/etc/profile-a-l/alacarte.profile +++ b/etc/profile-a-l/alacarte.profile | |||
@@ -49,7 +49,7 @@ seccomp.block-secondary | |||
49 | tracelog | 49 | tracelog |
50 | 50 | ||
51 | disable-mnt | 51 | disable-mnt |
52 | # private-bin alacarte,bash,python*,sh | 52 | #private-bin alacarte,bash,python*,sh |
53 | private-cache | 53 | private-cache |
54 | private-dev | 54 | private-dev |
55 | private-etc @tls-ca,@x11,mime.types | 55 | private-etc @tls-ca,@x11,mime.types |
diff --git a/etc/profile-a-l/amarok.profile b/etc/profile-a-l/amarok.profile index 389aae602..0c78ab20d 100644 --- a/etc/profile-a-l/amarok.profile +++ b/etc/profile-a-l/amarok.profile | |||
@@ -26,11 +26,11 @@ notv | |||
26 | nou2f | 26 | nou2f |
27 | novideo | 27 | novideo |
28 | protocol unix,inet,inet6 | 28 | protocol unix,inet,inet6 |
29 | # seccomp | 29 | #seccomp |
30 | 30 | ||
31 | # private-bin amarok | 31 | #private-bin amarok |
32 | private-dev | 32 | private-dev |
33 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,machine-id,pki,pulse,resolv.conf,ssl | 33 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,machine-id,pki,pulse,resolv.conf,ssl |
34 | private-tmp | 34 | private-tmp |
35 | 35 | ||
36 | dbus-user filter | 36 | dbus-user filter |
@@ -45,4 +45,4 @@ dbus-user.talk org.freedesktop.Notifications | |||
45 | #dbus-user.talk org.kde.knotify | 45 | #dbus-user.talk org.kde.knotify |
46 | dbus-system none | 46 | dbus-system none |
47 | 47 | ||
48 | # restrict-namespaces | 48 | #restrict-namespaces |
diff --git a/etc/profile-a-l/android-studio.profile b/etc/profile-a-l/android-studio.profile index 3dfa0f95a..09289ace1 100644 --- a/etc/profile-a-l/android-studio.profile +++ b/etc/profile-a-l/android-studio.profile | |||
@@ -36,7 +36,7 @@ protocol unix,inet,inet6 | |||
36 | seccomp | 36 | seccomp |
37 | 37 | ||
38 | private-cache | 38 | private-cache |
39 | # private-tmp | 39 | #private-tmp |
40 | 40 | ||
41 | # noexec /tmp breaks 'Android Profiler' | 41 | # noexec /tmp breaks 'Android Profiler' |
42 | #noexec /tmp | 42 | #noexec /tmp |
diff --git a/etc/profile-a-l/ani-cli.profile b/etc/profile-a-l/ani-cli.profile index 613f74ce5..76db2986d 100644 --- a/etc/profile-a-l/ani-cli.profile +++ b/etc/profile-a-l/ani-cli.profile | |||
@@ -10,6 +10,7 @@ include ani-cli.local | |||
10 | 10 | ||
11 | noblacklist ${HOME}/.cache/ani-cli | 11 | noblacklist ${HOME}/.cache/ani-cli |
12 | noblacklist ${HOME}/.local/state/ani-cli | 12 | noblacklist ${HOME}/.local/state/ani-cli |
13 | noblacklist ${PATH}/patch | ||
13 | 14 | ||
14 | # Allow /bin/sh (blacklisted by disable-shell.inc) | 15 | # Allow /bin/sh (blacklisted by disable-shell.inc) |
15 | include allow-bin-sh.inc | 16 | include allow-bin-sh.inc |
@@ -30,9 +31,9 @@ noprinters | |||
30 | notv | 31 | notv |
31 | 32 | ||
32 | disable-mnt | 33 | disable-mnt |
33 | private-bin ani-cli,aria2c,cat,cp,curl,cut,ffmpeg,fzf,grep,head,mkdir,mv,nl,nohup,patch,printf,rm,rofi,sed,sh,sort,tail,tput,tr,uname,wc | 34 | private-bin ani-cli,aria2c,cat,cp,curl,cut,ffmpeg,fzf,grep,head,mkdir,mktemp,mv,nl,nohup,patch,printf,rm,rofi,sed,sh,sort,tail,tput,tr,uname,wc |
34 | #private-cache | 35 | #private-cache |
35 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | 36 | private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg |
36 | private-tmp | 37 | private-tmp |
37 | 38 | ||
38 | # Redirect | 39 | # Redirect |
diff --git a/etc/profile-a-l/anki.profile b/etc/profile-a-l/anki.profile index 2d0bfcb6c..acf52509c 100644 --- a/etc/profile-a-l/anki.profile +++ b/etc/profile-a-l/anki.profile | |||
@@ -55,4 +55,4 @@ private-tmp | |||
55 | dbus-user none | 55 | dbus-user none |
56 | dbus-system none | 56 | dbus-system none |
57 | 57 | ||
58 | # restrict-namespaces | 58 | #restrict-namespaces |
diff --git a/etc/profile-a-l/arduino.profile b/etc/profile-a-l/arduino.profile index 85ea76939..a925e223f 100644 --- a/etc/profile-a-l/arduino.profile +++ b/etc/profile-a-l/arduino.profile | |||
@@ -21,7 +21,7 @@ caps.drop all | |||
21 | netfilter | 21 | netfilter |
22 | no3d | 22 | no3d |
23 | nodvd | 23 | nodvd |
24 | # nogroups | 24 | #nogroups |
25 | nonewprivs | 25 | nonewprivs |
26 | noroot | 26 | noroot |
27 | nosound | 27 | nosound |
diff --git a/etc/profile-a-l/aria2c.profile b/etc/profile-a-l/aria2c.profile index 7f9463c4f..65ffdfa1b 100644 --- a/etc/profile-a-l/aria2c.profile +++ b/etc/profile-a-l/aria2c.profile | |||
@@ -39,7 +39,7 @@ novideo | |||
39 | protocol unix,inet,inet6,netlink | 39 | protocol unix,inet,inet6,netlink |
40 | seccomp | 40 | seccomp |
41 | 41 | ||
42 | # disable-mnt | 42 | #disable-mnt |
43 | # Add your custom event hook commands to 'private-bin' in your aria2c.local. | 43 | # Add your custom event hook commands to 'private-bin' in your aria2c.local. |
44 | private-bin aria2c,gzip | 44 | private-bin aria2c,gzip |
45 | # Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772). | 45 | # Add 'private-cache' to your aria2c.local if you don't use Lutris/winetricks (see issue #2772). |
diff --git a/etc/profile-a-l/ark.profile b/etc/profile-a-l/ark.profile index 272e06219..65e965248 100644 --- a/etc/profile-a-l/ark.profile +++ b/etc/profile-a-l/ark.profile | |||
@@ -22,7 +22,7 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | # net none | 25 | #net none |
26 | netfilter | 26 | netfilter |
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
@@ -42,7 +42,7 @@ private-bin 7z,ark,bash,lrzip,lsar,lz4,lzop,p7zip,rar,sh,tclsh,unar,unrar,unzip, | |||
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # dbus-user none | 45 | #dbus-user none |
46 | # dbus-system none | 46 | #dbus-system none |
47 | 47 | ||
48 | restrict-namespaces | 48 | restrict-namespaces |
diff --git a/etc/profile-a-l/artha.profile b/etc/profile-a-l/artha.profile index 897140857..f6369eb86 100644 --- a/etc/profile-a-l/artha.profile +++ b/etc/profile-a-l/artha.profile | |||
@@ -35,7 +35,7 @@ include whitelist-var-common.inc | |||
35 | apparmor | 35 | apparmor |
36 | caps.drop all | 36 | caps.drop all |
37 | ipc-namespace | 37 | ipc-namespace |
38 | # net none - breaks on Ubuntu | 38 | #net none # breaks on Ubuntu |
39 | no3d | 39 | no3d |
40 | nodvd | 40 | nodvd |
41 | nogroups | 41 | nogroups |
diff --git a/etc/profile-a-l/asunder.profile b/etc/profile-a-l/asunder.profile index c09ad7936..601ef5c13 100644 --- a/etc/profile-a-l/asunder.profile +++ b/etc/profile-a-l/asunder.profile | |||
@@ -26,7 +26,7 @@ apparmor | |||
26 | caps.drop all | 26 | caps.drop all |
27 | netfilter | 27 | netfilter |
28 | no3d | 28 | no3d |
29 | # nogroups | 29 | #nogroups |
30 | noinput | 30 | noinput |
31 | nonewprivs | 31 | nonewprivs |
32 | noroot | 32 | noroot |
@@ -44,5 +44,5 @@ dbus-user none | |||
44 | dbus-system none | 44 | dbus-system none |
45 | 45 | ||
46 | # mdwe is disabled due to breaking hardware accelerated decoding | 46 | # mdwe is disabled due to breaking hardware accelerated decoding |
47 | # memory-deny-write-execute | 47 | #memory-deny-write-execute |
48 | restrict-namespaces | 48 | restrict-namespaces |
diff --git a/etc/profile-a-l/atom.profile b/etc/profile-a-l/atom.profile index 8e8f8515f..f21a8c34a 100644 --- a/etc/profile-a-l/atom.profile +++ b/etc/profile-a-l/atom.profile | |||
@@ -26,7 +26,7 @@ noblacklist ${HOME}/.config/Atom | |||
26 | # Allows files commonly used by IDEs | 26 | # Allows files commonly used by IDEs |
27 | include allow-common-devel.inc | 27 | include allow-common-devel.inc |
28 | 28 | ||
29 | # net none | 29 | #net none |
30 | nosound | 30 | nosound |
31 | 31 | ||
32 | # Redirect | 32 | # Redirect |
diff --git a/etc/profile-a-l/atril.profile b/etc/profile-a-l/atril.profile index d0513d2a7..26b978158 100644 --- a/etc/profile-a-l/atril.profile +++ b/etc/profile-a-l/atril.profile | |||
@@ -22,7 +22,7 @@ include disable-xdg.inc | |||
22 | 22 | ||
23 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
24 | 24 | ||
25 | # apparmor | 25 | #apparmor |
26 | caps.drop all | 26 | caps.drop all |
27 | machine-id | 27 | machine-id |
28 | no3d | 28 | no3d |
@@ -44,7 +44,7 @@ private-dev | |||
44 | private-etc | 44 | private-etc |
45 | # atril uses webkit gtk to display epub files | 45 | # atril uses webkit gtk to display epub files |
46 | # waiting for globbing support in private-lib; for now hardcoding it to webkit2gtk-4.0 | 46 | # waiting for globbing support in private-lib; for now hardcoding it to webkit2gtk-4.0 |
47 | #private-lib webkit2gtk-4.0 - problems on Arch with the new version of WebKit | 47 | #private-lib webkit2gtk-4.0 # problems on Arch with the new version of WebKit |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | # webkit gtk killed by memory-deny-write-execute | 50 | # webkit gtk killed by memory-deny-write-execute |
diff --git a/etc/profile-a-l/audacious.profile b/etc/profile-a-l/audacious.profile index 6abd87c92..6d1a07e2d 100644 --- a/etc/profile-a-l/audacious.profile +++ b/etc/profile-a-l/audacious.profile | |||
@@ -36,7 +36,7 @@ protocol unix,inet,inet6 | |||
36 | seccomp | 36 | seccomp |
37 | tracelog | 37 | tracelog |
38 | 38 | ||
39 | # private-bin audacious | 39 | #private-bin audacious |
40 | private-cache | 40 | private-cache |
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
diff --git a/etc/profile-a-l/audacity.profile b/etc/profile-a-l/audacity.profile index c2a482b61..e70215891 100644 --- a/etc/profile-a-l/audacity.profile +++ b/etc/profile-a-l/audacity.profile | |||
@@ -54,7 +54,7 @@ private-etc @x11 | |||
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | # problems on Fedora 27 | 56 | # problems on Fedora 27 |
57 | # dbus-user none | 57 | #dbus-user none |
58 | # dbus-system none | 58 | #dbus-system none |
59 | 59 | ||
60 | restrict-namespaces | 60 | restrict-namespaces |
diff --git a/etc/profile-a-l/audio-recorder.profile b/etc/profile-a-l/audio-recorder.profile index deba11a47..816852a71 100644 --- a/etc/profile-a-l/audio-recorder.profile +++ b/etc/profile-a-l/audio-recorder.profile | |||
@@ -41,7 +41,7 @@ seccomp | |||
41 | tracelog | 41 | tracelog |
42 | 42 | ||
43 | disable-mnt | 43 | disable-mnt |
44 | # private-bin audio-recorder | 44 | #private-bin audio-recorder |
45 | private-cache | 45 | private-cache |
46 | private-etc | 46 | private-etc |
47 | private-tmp | 47 | private-tmp |
@@ -50,5 +50,5 @@ dbus-user filter | |||
50 | dbus-user.talk ca.desrt.dconf | 50 | dbus-user.talk ca.desrt.dconf |
51 | dbus-system none | 51 | dbus-system none |
52 | 52 | ||
53 | # memory-deny-write-execute - breaks on Arch | 53 | #memory-deny-write-execute # breaks on Arch |
54 | restrict-namespaces | 54 | restrict-namespaces |
diff --git a/etc/profile-a-l/authenticator.profile b/etc/profile-a-l/authenticator.profile index 96c70a838..cbd97449d 100644 --- a/etc/profile-a-l/authenticator.profile +++ b/etc/profile-a-l/authenticator.profile | |||
@@ -19,7 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | # apparmor | 22 | #apparmor |
23 | caps.drop all | 23 | caps.drop all |
24 | netfilter | 24 | netfilter |
25 | no3d | 25 | no3d |
@@ -31,19 +31,19 @@ noroot | |||
31 | nosound | 31 | nosound |
32 | notv | 32 | notv |
33 | nou2f | 33 | nou2f |
34 | # novideo | 34 | #novideo |
35 | protocol unix,inet,inet6 | 35 | protocol unix,inet,inet6 |
36 | seccomp | 36 | seccomp |
37 | 37 | ||
38 | disable-mnt | 38 | disable-mnt |
39 | # private-bin authenticator,python* | 39 | #private-bin authenticator,python* |
40 | private-dev | 40 | private-dev |
41 | private-etc @tls-ca | 41 | private-etc @tls-ca |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | # makes settings immutable | 44 | # makes settings immutable |
45 | # dbus-user none | 45 | #dbus-user none |
46 | # dbus-system none | 46 | #dbus-system none |
47 | 47 | ||
48 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 48 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
49 | restrict-namespaces | 49 | restrict-namespaces |
diff --git a/etc/profile-a-l/autokey-common.profile b/etc/profile-a-l/autokey-common.profile index 834eac11a..bc47b26a9 100644 --- a/etc/profile-a-l/autokey-common.profile +++ b/etc/profile-a-l/autokey-common.profile | |||
@@ -38,5 +38,5 @@ private-cache | |||
38 | private-dev | 38 | private-dev |
39 | private-tmp | 39 | private-tmp |
40 | 40 | ||
41 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 41 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
42 | restrict-namespaces | 42 | restrict-namespaces |
diff --git a/etc/profile-a-l/baloo_file.profile b/etc/profile-a-l/baloo_file.profile index 084b7c702..de4004724 100644 --- a/etc/profile-a-l/baloo_file.profile +++ b/etc/profile-a-l/baloo_file.profile | |||
@@ -7,10 +7,10 @@ include globals.local | |||
7 | 7 | ||
8 | # Make home directory read-only and allow writing only to ${HOME}/.local/share/baloo | 8 | # Make home directory read-only and allow writing only to ${HOME}/.local/share/baloo |
9 | # Note: Baloo will not be able to update the "first run" key in its configuration files. | 9 | # Note: Baloo will not be able to update the "first run" key in its configuration files. |
10 | # mkdir ${HOME}/.local/share/baloo | 10 | #mkdir ${HOME}/.local/share/baloo |
11 | # read-only ${HOME} | 11 | #read-only ${HOME} |
12 | # read-write ${HOME}/.local/share/baloo | 12 | #read-write ${HOME}/.local/share/baloo |
13 | # ignore read-write | 13 | #ignore read-write |
14 | 14 | ||
15 | noblacklist ${HOME}/.config/baloofilerc | 15 | noblacklist ${HOME}/.config/baloofilerc |
16 | noblacklist ${HOME}/.kde/share/config/baloofilerc | 16 | noblacklist ${HOME}/.kde/share/config/baloofilerc |
@@ -31,7 +31,7 @@ include whitelist-var-common.inc | |||
31 | apparmor | 31 | apparmor |
32 | caps.drop all | 32 | caps.drop all |
33 | machine-id | 33 | machine-id |
34 | # net none | 34 | #net none |
35 | netfilter | 35 | netfilter |
36 | no3d | 36 | no3d |
37 | nodvd | 37 | nodvd |
@@ -46,7 +46,7 @@ novideo | |||
46 | protocol unix | 46 | protocol unix |
47 | # blacklisting of ioprio_set system calls breaks baloo_file | 47 | # blacklisting of ioprio_set system calls breaks baloo_file |
48 | seccomp !ioprio_set | 48 | seccomp !ioprio_set |
49 | # x11 xorg | 49 | #x11 xorg |
50 | 50 | ||
51 | private-bin baloo_file,baloo_file_extractor,baloo_filemetadata_temp_extractor,kbuildsycoca4 | 51 | private-bin baloo_file,baloo_file_extractor,baloo_filemetadata_temp_extractor,kbuildsycoca4 |
52 | private-cache | 52 | private-cache |
diff --git a/etc/profile-a-l/baobab.profile b/etc/profile-a-l/baobab.profile index 31ef66a58..942d82941 100644 --- a/etc/profile-a-l/baobab.profile +++ b/etc/profile-a-l/baobab.profile | |||
@@ -6,13 +6,13 @@ include baobab.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # include disable-common.inc | 9 | #include disable-common.inc |
10 | include disable-devel.inc | 10 | include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | # include disable-programs.inc | 13 | #include disable-programs.inc |
14 | include disable-shell.inc | 14 | include disable-shell.inc |
15 | # include disable-xdg.inc | 15 | #include disable-xdg.inc |
16 | 16 | ||
17 | include whitelist-runuser-common.inc | 17 | include whitelist-runuser-common.inc |
18 | 18 | ||
@@ -37,8 +37,8 @@ private-bin baobab | |||
37 | private-dev | 37 | private-dev |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
40 | # dbus-user none | 40 | #dbus-user none |
41 | # dbus-system none | 41 | #dbus-system none |
42 | 42 | ||
43 | read-only ${HOME} | 43 | read-only ${HOME} |
44 | restrict-namespaces | 44 | restrict-namespaces |
diff --git a/etc/profile-a-l/bcompare.profile b/etc/profile-a-l/bcompare.profile index d566b94e8..c0e024445 100644 --- a/etc/profile-a-l/bcompare.profile +++ b/etc/profile-a-l/bcompare.profile | |||
@@ -19,7 +19,7 @@ include disable-exec.inc | |||
19 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | # Add the next line to your bcompare.local if you don't need to compare files in disable-programs.inc. | 20 | # Add the next line to your bcompare.local if you don't need to compare files in disable-programs.inc. |
21 | #include disable-programs.inc | 21 | #include disable-programs.inc |
22 | #include disable-shell.inc - breaks launch | 22 | #include disable-shell.inc # breaks launch |
23 | include disable-write-mnt.inc | 23 | include disable-write-mnt.inc |
24 | 24 | ||
25 | apparmor | 25 | apparmor |
diff --git a/etc/profile-a-l/bibletime.profile b/etc/profile-a-l/bibletime.profile index 3fb2a82c3..dcef2bff1 100644 --- a/etc/profile-a-l/bibletime.profile +++ b/etc/profile-a-l/bibletime.profile | |||
@@ -48,7 +48,7 @@ protocol unix,inet,inet6,netlink | |||
48 | seccomp !chroot | 48 | seccomp !chroot |
49 | 49 | ||
50 | disable-mnt | 50 | disable-mnt |
51 | # private-bin bibletime | 51 | #private-bin bibletime |
52 | private-cache | 52 | private-cache |
53 | private-dev | 53 | private-dev |
54 | private-etc @tls-ca,sword,sword.conf | 54 | private-etc @tls-ca,sword,sword.conf |
@@ -57,4 +57,4 @@ private-tmp | |||
57 | dbus-user none | 57 | dbus-user none |
58 | dbus-system none | 58 | dbus-system none |
59 | 59 | ||
60 | # restrict-namespaces | 60 | #restrict-namespaces |
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile index 53d212e34..e596ec9d2 100644 --- a/etc/profile-a-l/bijiben.profile +++ b/etc/profile-a-l/bijiben.profile | |||
@@ -48,7 +48,7 @@ tracelog | |||
48 | 48 | ||
49 | disable-mnt | 49 | disable-mnt |
50 | private-bin bijiben | 50 | private-bin bijiben |
51 | # private-cache -- access to .cache/tracker is required | 51 | #private-cache # access to .cache/tracker is required |
52 | private-dev | 52 | private-dev |
53 | private-etc @x11 | 53 | private-etc @x11 |
54 | private-tmp | 54 | private-tmp |
diff --git a/etc/profile-a-l/bitlbee.profile b/etc/profile-a-l/bitlbee.profile index 988a1479e..0f10c7ce0 100644 --- a/etc/profile-a-l/bitlbee.profile +++ b/etc/profile-a-l/bitlbee.profile | |||
@@ -10,7 +10,7 @@ ignore noexec ${HOME} | |||
10 | 10 | ||
11 | noblacklist /sbin | 11 | noblacklist /sbin |
12 | noblacklist /usr/sbin | 12 | noblacklist /usr/sbin |
13 | # noblacklist /var/log | 13 | #noblacklist /var/log |
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | include disable-devel.inc | 16 | include disable-devel.inc |
diff --git a/etc/profile-a-l/bitwarden.profile b/etc/profile-a-l/bitwarden.profile index 56bb871e7..1572ca572 100644 --- a/etc/profile-a-l/bitwarden.profile +++ b/etc/profile-a-l/bitwarden.profile | |||
@@ -17,6 +17,7 @@ include disable-shell.inc | |||
17 | 17 | ||
18 | mkdir ${HOME}/.config/Bitwarden | 18 | mkdir ${HOME}/.config/Bitwarden |
19 | whitelist ${HOME}/.config/Bitwarden | 19 | whitelist ${HOME}/.config/Bitwarden |
20 | whitelist /opt/Bitwarden | ||
20 | 21 | ||
21 | machine-id | 22 | machine-id |
22 | no3d | 23 | no3d |
@@ -24,7 +25,6 @@ nosound | |||
24 | 25 | ||
25 | ?HAS_APPIMAGE: ignore private-dev | 26 | ?HAS_APPIMAGE: ignore private-dev |
26 | private-etc @tls-ca | 27 | private-etc @tls-ca |
27 | private-opt Bitwarden | ||
28 | 28 | ||
29 | # Redirect | 29 | # Redirect |
30 | include electron-common.profile | 30 | include electron-common.profile |
diff --git a/etc/profile-a-l/bleachbit.profile b/etc/profile-a-l/bleachbit.profile index 52d970d89..cd1b059b4 100644 --- a/etc/profile-a-l/bleachbit.profile +++ b/etc/profile-a-l/bleachbit.profile | |||
@@ -18,7 +18,7 @@ include disable-common.inc | |||
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | # include disable-programs.inc | 21 | #include disable-programs.inc |
22 | 22 | ||
23 | caps.drop all | 23 | caps.drop all |
24 | net none | 24 | net none |
@@ -36,11 +36,11 @@ protocol unix | |||
36 | seccomp | 36 | seccomp |
37 | 37 | ||
38 | private-dev | 38 | private-dev |
39 | # private-tmp | 39 | #private-tmp |
40 | 40 | ||
41 | dbus-user none | 41 | dbus-user none |
42 | dbus-system none | 42 | dbus-system none |
43 | 43 | ||
44 | # memory-deny-write-execute breaks some systems, see issue #1850 | 44 | # memory-deny-write-execute breaks some systems, see issue #1850 |
45 | # memory-deny-write-execute | 45 | #memory-deny-write-execute |
46 | restrict-namespaces | 46 | restrict-namespaces |
diff --git a/etc/profile-a-l/blender-3.6.profile b/etc/profile-a-l/blender-3.6.profile new file mode 100644 index 000000000..4e32c1f6d --- /dev/null +++ b/etc/profile-a-l/blender-3.6.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile alias for blender | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include blender-3.6.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include blender.profile | ||
diff --git a/etc/profile-a-l/bless.profile b/etc/profile-a-l/bless.profile index 6dd540943..85f232751 100644 --- a/etc/profile-a-l/bless.profile +++ b/etc/profile-a-l/bless.profile | |||
@@ -31,7 +31,7 @@ novideo | |||
31 | protocol unix | 31 | protocol unix |
32 | seccomp | 32 | seccomp |
33 | 33 | ||
34 | # private-bin bash,bless,mono,sh | 34 | #private-bin bash,bless,mono,sh |
35 | private-cache | 35 | private-cache |
36 | private-dev | 36 | private-dev |
37 | private-etc mono | 37 | private-etc mono |
diff --git a/etc/profile-a-l/brackets.profile b/etc/profile-a-l/brackets.profile index a483c2b0a..684504937 100644 --- a/etc/profile-a-l/brackets.profile +++ b/etc/profile-a-l/brackets.profile | |||
@@ -32,4 +32,4 @@ seccomp !chroot,!ioperm | |||
32 | private-cache | 32 | private-cache |
33 | private-dev | 33 | private-dev |
34 | 34 | ||
35 | # restrict-namespaces | 35 | #restrict-namespaces |
diff --git a/etc/profile-a-l/brasero.profile b/etc/profile-a-l/brasero.profile index 12d7062ab..92184ef18 100644 --- a/etc/profile-a-l/brasero.profile +++ b/etc/profile-a-l/brasero.profile | |||
@@ -29,9 +29,9 @@ protocol unix | |||
29 | seccomp | 29 | seccomp |
30 | tracelog | 30 | tracelog |
31 | 31 | ||
32 | # private-bin brasero | 32 | #private-bin brasero |
33 | private-cache | 33 | private-cache |
34 | # private-dev | 34 | #private-dev |
35 | # private-tmp | 35 | #private-tmp |
36 | 36 | ||
37 | restrict-namespaces | 37 | restrict-namespaces |
diff --git a/etc/profile-a-l/brz.profile b/etc/profile-a-l/brz.profile new file mode 100644 index 000000000..dcc7af54b --- /dev/null +++ b/etc/profile-a-l/brz.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for brz | ||
2 | # Description: Distributed VCS with support for Bazaar and Git file formats | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include brz.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.config/breezy | ||
12 | |||
13 | # Redirect | ||
14 | include git.profile | ||
diff --git a/etc/profile-a-l/build-systems-common.profile b/etc/profile-a-l/build-systems-common.profile index cf5f462ae..8616996d2 100644 --- a/etc/profile-a-l/build-systems-common.profile +++ b/etc/profile-a-l/build-systems-common.profile | |||
@@ -39,7 +39,7 @@ include whitelist-var-common.inc | |||
39 | caps.drop all | 39 | caps.drop all |
40 | ipc-namespace | 40 | ipc-namespace |
41 | machine-id | 41 | machine-id |
42 | # net none | 42 | #net none |
43 | netfilter | 43 | netfilter |
44 | no3d | 44 | no3d |
45 | nodvd | 45 | nodvd |
diff --git a/etc/profile-a-l/bzr.profile b/etc/profile-a-l/bzr.profile new file mode 100644 index 000000000..61c1aae38 --- /dev/null +++ b/etc/profile-a-l/bzr.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile alias for bzr | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include bzr.local | ||
5 | # Persistent global definitions | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | # Redirect | ||
10 | include brz.profile | ||
diff --git a/etc/profile-a-l/calibre.profile b/etc/profile-a-l/calibre.profile index b347941d7..cb9c92ffb 100644 --- a/etc/profile-a-l/calibre.profile +++ b/etc/profile-a-l/calibre.profile | |||
@@ -36,4 +36,4 @@ seccomp !chroot | |||
36 | private-dev | 36 | private-dev |
37 | private-tmp | 37 | private-tmp |
38 | 38 | ||
39 | # restrict-namespaces | 39 | #restrict-namespaces |
diff --git a/etc/profile-a-l/calligra.profile b/etc/profile-a-l/calligra.profile index c2972f902..ffb83b2ed 100644 --- a/etc/profile-a-l/calligra.profile +++ b/etc/profile-a-l/calligra.profile | |||
@@ -15,7 +15,7 @@ include disable-programs.inc | |||
15 | 15 | ||
16 | caps.drop all | 16 | caps.drop all |
17 | ipc-namespace | 17 | ipc-namespace |
18 | # net none | 18 | #net none |
19 | netfilter | 19 | netfilter |
20 | nodvd | 20 | nodvd |
21 | nogroups | 21 | nogroups |
@@ -32,9 +32,9 @@ seccomp.block-secondary | |||
32 | private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligragemini,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch,kbuildsycoca4,kdeinit4 | 32 | private-bin calligra,calligraauthor,calligraconverter,calligraflow,calligragemini,calligraplan,calligraplanwork,calligrasheets,calligrastage,calligrawords,dbus-launch,kbuildsycoca4,kdeinit4 |
33 | private-dev | 33 | private-dev |
34 | 34 | ||
35 | # dbus-user none | 35 | #dbus-user none |
36 | # dbus-system none | 36 | #dbus-system none |
37 | 37 | ||
38 | # noexec ${HOME} | 38 | #noexec ${HOME} |
39 | noexec /tmp | 39 | noexec /tmp |
40 | restrict-namespaces | 40 | restrict-namespaces |
diff --git a/etc/profile-a-l/cameramonitor.profile b/etc/profile-a-l/cameramonitor.profile index df94ac859..4f8fd7187 100644 --- a/etc/profile-a-l/cameramonitor.profile +++ b/etc/profile-a-l/cameramonitor.profile | |||
@@ -48,8 +48,8 @@ private-cache | |||
48 | private-etc | 48 | private-etc |
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # dbus-user none | 51 | #dbus-user none |
52 | # dbus-system none | 52 | #dbus-system none |
53 | 53 | ||
54 | # memory-deny-write-execute - breaks on Arch | 54 | #memory-deny-write-execute # breaks on Arch |
55 | restrict-namespaces | 55 | restrict-namespaces |
diff --git a/etc/profile-a-l/cantata.profile b/etc/profile-a-l/cantata.profile index 7cb56efee..36c7c1091 100644 --- a/etc/profile-a-l/cantata.profile +++ b/etc/profile-a-l/cantata.profile | |||
@@ -22,7 +22,7 @@ include disable-programs.inc | |||
22 | include disable-shell.inc | 22 | include disable-shell.inc |
23 | include disable-xdg.inc | 23 | include disable-xdg.inc |
24 | 24 | ||
25 | # apparmor | 25 | #apparmor |
26 | caps.drop all | 26 | caps.drop all |
27 | ipc-namespace | 27 | ipc-namespace |
28 | netfilter | 28 | netfilter |
@@ -34,7 +34,7 @@ novideo | |||
34 | protocol unix,inet,inet6,netlink | 34 | protocol unix,inet,inet6,netlink |
35 | seccomp | 35 | seccomp |
36 | 36 | ||
37 | # private-etc alternatives,drirc,fonts,gcrypt,hosts,kde5rc,mpd.conf,passwd,samba,ssl,xdg | 37 | #private-etc alternatives,drirc,fonts,gcrypt,hosts,kde5rc,mpd.conf,passwd,samba,ssl,xdg |
38 | private-bin cantata,mpd,perl | 38 | private-bin cantata,mpd,perl |
39 | private-dev | 39 | private-dev |
40 | 40 | ||
diff --git a/etc/profile-a-l/catfish.profile b/etc/profile-a-l/catfish.profile index e2df341e9..037f6ee40 100644 --- a/etc/profile-a-l/catfish.profile +++ b/etc/profile-a-l/catfish.profile | |||
@@ -15,10 +15,10 @@ noblacklist ${HOME}/.config/catfish | |||
15 | include allow-python2.inc | 15 | include allow-python2.inc |
16 | include allow-python3.inc | 16 | include allow-python3.inc |
17 | 17 | ||
18 | # include disable-common.inc | 18 | #include disable-common.inc |
19 | # include disable-devel.inc | 19 | #include disable-devel.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | # include disable-programs.inc | 21 | #include disable-programs.inc |
22 | 22 | ||
23 | whitelist /var/lib/mlocate | 23 | whitelist /var/lib/mlocate |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
@@ -40,9 +40,9 @@ tracelog | |||
40 | 40 | ||
41 | # These options work but are disabled in case | 41 | # These options work but are disabled in case |
42 | # a users wants to search in these directories. | 42 | # a users wants to search in these directories. |
43 | # private-bin bash,catfish,env,locate,ls,mlocate,python* | 43 | #private-bin bash,catfish,env,locate,ls,mlocate,python* |
44 | # private-dev | 44 | #private-dev |
45 | # private-tmp | 45 | #private-tmp |
46 | 46 | ||
47 | dbus-user none | 47 | dbus-user none |
48 | dbus-system none | 48 | dbus-system none |
diff --git a/etc/profile-a-l/cawbird.profile b/etc/profile-a-l/cawbird.profile index 17887b6cc..7fdbc3881 100644 --- a/etc/profile-a-l/cawbird.profile +++ b/etc/profile-a-l/cawbird.profile | |||
@@ -41,7 +41,7 @@ private-dev | |||
41 | private-etc @tls-ca,@x11,host.conf,mime.types | 41 | private-etc @tls-ca,@x11,host.conf,mime.types |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | # dbus-user none | 44 | #dbus-user none |
45 | dbus-system none | 45 | dbus-system none |
46 | 46 | ||
47 | restrict-namespaces | 47 | restrict-namespaces |
diff --git a/etc/profile-a-l/chatterino.profile b/etc/profile-a-l/chatterino.profile index 2df03b10b..2a77b6fd6 100644 --- a/etc/profile-a-l/chatterino.profile +++ b/etc/profile-a-l/chatterino.profile | |||
@@ -12,11 +12,13 @@ include globals.local | |||
12 | #whitelist ${MUSIC} | 12 | #whitelist ${MUSIC} |
13 | 13 | ||
14 | # Also allow access to mpv/vlc, they're usable via streamlink. | 14 | # Also allow access to mpv/vlc, they're usable via streamlink. |
15 | noblacklist ${HOME}/.cache/mpv | ||
15 | noblacklist ${HOME}/.config/mpv | 16 | noblacklist ${HOME}/.config/mpv |
16 | noblacklist ${HOME}/.config/pulse | 17 | noblacklist ${HOME}/.config/pulse |
17 | noblacklist ${HOME}/.config/vlc | 18 | noblacklist ${HOME}/.config/vlc |
18 | noblacklist ${HOME}/.local/share/chatterino | 19 | noblacklist ${HOME}/.local/share/chatterino |
19 | noblacklist ${HOME}/.local/share/vlc | 20 | noblacklist ${HOME}/.local/share/vlc |
21 | noblacklist ${HOME}/.local/state/mpv | ||
20 | 22 | ||
21 | # Allow Lua for mpv (blacklisted by disable-interpreters.inc) | 23 | # Allow Lua for mpv (blacklisted by disable-interpreters.inc) |
22 | include allow-lua.inc | 24 | include allow-lua.inc |
diff --git a/etc/profile-a-l/chromium-browser-privacy.profile b/etc/profile-a-l/chromium-browser-privacy.profile index 8803a4d9d..67a3a43af 100644 --- a/etc/profile-a-l/chromium-browser-privacy.profile +++ b/etc/profile-a-l/chromium-browser-privacy.profile | |||
@@ -13,7 +13,7 @@ mkdir ${HOME}/.config/ungoogled-chromium | |||
13 | whitelist ${HOME}/.cache/ungoogled-chromium | 13 | whitelist ${HOME}/.cache/ungoogled-chromium |
14 | whitelist ${HOME}/.config/ungoogled-chromium | 14 | whitelist ${HOME}/.config/ungoogled-chromium |
15 | 15 | ||
16 | # private-bin basename,bash,cat,chromium-browser-privacy,dirname,mkdir,readlink,sed,touch,which,xdg-settings | 16 | #private-bin basename,bash,cat,chromium-browser-privacy,dirname,mkdir,readlink,sed,touch,which,xdg-settings |
17 | 17 | ||
18 | # Redirect | 18 | # Redirect |
19 | include chromium.profile | 19 | include chromium.profile |
diff --git a/etc/profile-a-l/chromium-common.profile b/etc/profile-a-l/chromium-common.profile index 878e0fe1d..37bfa0bfe 100644 --- a/etc/profile-a-l/chromium-common.profile +++ b/etc/profile-a-l/chromium-common.profile | |||
@@ -33,13 +33,15 @@ include whitelist-run-common.inc | |||
33 | ?BROWSER_DISABLE_U2F: nou2f | 33 | ?BROWSER_DISABLE_U2F: nou2f |
34 | 34 | ||
35 | ?BROWSER_DISABLE_U2F: private-dev | 35 | ?BROWSER_DISABLE_U2F: private-dev |
36 | #private-tmp - issues when using multiple browser sessions | 36 | #private-tmp # issues when using multiple browser sessions |
37 | 37 | ||
38 | blacklist ${PATH}/curl | 38 | blacklist ${PATH}/curl |
39 | blacklist ${PATH}/wget | 39 | blacklist ${PATH}/wget |
40 | blacklist ${PATH}/wget2 | 40 | blacklist ${PATH}/wget2 |
41 | 41 | ||
42 | #dbus-user none - prevents access to passwords saved in GNOME Keyring and KWallet, also breaks Gnome connector. | 42 | # This prevents access to passwords saved in GNOME Keyring and KWallet, also |
43 | # breaks Gnome connector. | ||
44 | #dbus-user none | ||
43 | 45 | ||
44 | # The file dialog needs to work without d-bus. | 46 | # The file dialog needs to work without d-bus. |
45 | ?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1 | 47 | ?HAS_NODBUS: env NO_CHROME_KDE_FILE_DIALOG=1 |
diff --git a/etc/profile-a-l/chromium.profile b/etc/profile-a-l/chromium.profile index 14f1bbe64..8c43aac9c 100644 --- a/etc/profile-a-l/chromium.profile +++ b/etc/profile-a-l/chromium.profile | |||
@@ -17,7 +17,7 @@ whitelist ${HOME}/.config/chromium | |||
17 | whitelist ${HOME}/.config/chromium-flags.conf | 17 | whitelist ${HOME}/.config/chromium-flags.conf |
18 | whitelist /usr/share/chromium | 18 | whitelist /usr/share/chromium |
19 | 19 | ||
20 | # private-bin chromium,chromium-browser,chromedriver | 20 | #private-bin chromium,chromium-browser,chromedriver |
21 | 21 | ||
22 | # Redirect | 22 | # Redirect |
23 | include chromium-common.profile | 23 | include chromium-common.profile |
diff --git a/etc/profile-a-l/clac.profile b/etc/profile-a-l/clac.profile new file mode 100644 index 000000000..cd2b2522d --- /dev/null +++ b/etc/profile-a-l/clac.profile | |||
@@ -0,0 +1,63 @@ | |||
1 | # Firejail profile for clac | ||
2 | # Description: Simple command-line calculator | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include clac.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist ${RUNUSER} | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-proc.inc | ||
17 | include disable-programs.inc | ||
18 | include disable-shell.inc | ||
19 | #include disable-X11.inc # x11 none | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | #include whitelist-common.inc # see #903 | ||
23 | include whitelist-run-common.inc | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
26 | include whitelist-var-common.inc | ||
27 | |||
28 | apparmor | ||
29 | caps.drop all | ||
30 | ipc-namespace | ||
31 | machine-id | ||
32 | net none | ||
33 | no3d | ||
34 | nodvd | ||
35 | nogroups | ||
36 | noinput | ||
37 | nonewprivs | ||
38 | noprinters | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | # block socket syscall to simulate empty protocol option (see #639) | ||
45 | seccomp socket | ||
46 | seccomp.block-secondary | ||
47 | tracelog | ||
48 | x11 none | ||
49 | |||
50 | disable-mnt | ||
51 | private | ||
52 | private-bin clac | ||
53 | #private-cache | ||
54 | private-dev | ||
55 | private-etc | ||
56 | private-tmp | ||
57 | |||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
61 | memory-deny-write-execute | ||
62 | read-only ${HOME} | ||
63 | restrict-namespaces | ||
diff --git a/etc/profile-a-l/clamtk.profile b/etc/profile-a-l/clamtk.profile index 9fc73ee55..7651c5d32 100644 --- a/etc/profile-a-l/clamtk.profile +++ b/etc/profile-a-l/clamtk.profile | |||
@@ -1,4 +1,5 @@ | |||
1 | # Firejail profile for clamtk | 1 | # Firejail profile for clamtk |
2 | # Description: Easy to use, light-weight, on-demand virus scanner for Linux systems | ||
2 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
3 | # Persistent local customizations | 4 | # Persistent local customizations |
4 | include clamtk.local | 5 | include clamtk.local |
@@ -7,15 +8,22 @@ include globals.local | |||
7 | 8 | ||
8 | include disable-exec.inc | 9 | include disable-exec.inc |
9 | 10 | ||
11 | # Add the below lines to your clamtk.local if you update signatures databases per-user: | ||
12 | #ignore net none | ||
13 | #netfilter | ||
14 | #protocol inet,inet6 | ||
15 | |||
10 | caps.drop all | 16 | caps.drop all |
11 | ipc-namespace | 17 | ipc-namespace |
12 | net none | 18 | net none |
13 | no3d | 19 | no3d |
14 | nodvd | 20 | nodvd |
15 | nogroups | 21 | # nogroups breaks scanning |
22 | #nogroups | ||
16 | noinput | 23 | noinput |
17 | nonewprivs | 24 | nonewprivs |
18 | noroot | 25 | # noroot breaks scanning |
26 | #noroot | ||
19 | nosound | 27 | nosound |
20 | notv | 28 | notv |
21 | nou2f | 29 | nou2f |
@@ -25,7 +33,9 @@ seccomp | |||
25 | 33 | ||
26 | private-dev | 34 | private-dev |
27 | 35 | ||
28 | dbus-user none | 36 | dbus-user filter |
37 | dbus-user.talk ca.desrt.dconf | ||
38 | dbus-user.talk org.gtk.vfs.UDisks2VolumeMonitor | ||
29 | dbus-system none | 39 | dbus-system none |
30 | 40 | ||
31 | restrict-namespaces | 41 | restrict-namespaces |
diff --git a/etc/profile-a-l/claws-mail.profile b/etc/profile-a-l/claws-mail.profile index 7fefc68b1..53db480a4 100644 --- a/etc/profile-a-l/claws-mail.profile +++ b/etc/profile-a-l/claws-mail.profile | |||
@@ -18,7 +18,7 @@ whitelist ${HOME}/.claws-mail | |||
18 | 18 | ||
19 | whitelist /usr/share/doc/claws-mail | 19 | whitelist /usr/share/doc/claws-mail |
20 | 20 | ||
21 | # private-bin claws-mail,curl,gpg,gpg2,gpg-agent,gpgsm,gpgme-config,pinentry,pinentry-gtk-2 | 21 | #private-bin claws-mail,curl,gpg,gpg2,gpg-agent,gpgsm,gpgme-config,pinentry,pinentry-gtk-2 |
22 | 22 | ||
23 | # Redirect | 23 | # Redirect |
24 | include email-common.profile | 24 | include email-common.profile |
diff --git a/etc/profile-a-l/clawsker.profile b/etc/profile-a-l/clawsker.profile index 3b8eb7bbd..37d9e9e3a 100644 --- a/etc/profile-a-l/clawsker.profile +++ b/etc/profile-a-l/clawsker.profile | |||
@@ -50,5 +50,5 @@ private-tmp | |||
50 | dbus-user none | 50 | dbus-user none |
51 | dbus-system none | 51 | dbus-system none |
52 | 52 | ||
53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
54 | restrict-namespaces | 54 | restrict-namespaces |
diff --git a/etc/profile-a-l/clementine.profile b/etc/profile-a-l/clementine.profile index ee01fa653..3e9363bb4 100644 --- a/etc/profile-a-l/clementine.profile +++ b/etc/profile-a-l/clementine.profile | |||
@@ -37,6 +37,6 @@ private-dev | |||
37 | private-tmp | 37 | private-tmp |
38 | 38 | ||
39 | dbus-system none | 39 | dbus-system none |
40 | # dbus-user none | 40 | #dbus-user none |
41 | 41 | ||
42 | restrict-namespaces | 42 | restrict-namespaces |
diff --git a/etc/profile-a-l/clion.profile b/etc/profile-a-l/clion.profile index 652809f1b..0cea1c7d4 100644 --- a/etc/profile-a-l/clion.profile +++ b/etc/profile-a-l/clion.profile | |||
@@ -37,7 +37,7 @@ seccomp | |||
37 | 37 | ||
38 | private-cache | 38 | private-cache |
39 | private-dev | 39 | private-dev |
40 | # private-tmp | 40 | #private-tmp |
41 | 41 | ||
42 | noexec /tmp | 42 | noexec /tmp |
43 | restrict-namespaces | 43 | restrict-namespaces |
diff --git a/etc/profile-a-l/clipgrab.profile b/etc/profile-a-l/clipgrab.profile index 3f3748e1a..2657876b8 100644 --- a/etc/profile-a-l/clipgrab.profile +++ b/etc/profile-a-l/clipgrab.profile | |||
@@ -46,7 +46,7 @@ private-dev | |||
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # 'dbus-user none' breaks tray menu - add 'dbus-user none' to your clipgrab.local if you don't need it. | 48 | # 'dbus-user none' breaks tray menu - add 'dbus-user none' to your clipgrab.local if you don't need it. |
49 | # dbus-user none | 49 | #dbus-user none |
50 | # dbus-system none | 50 | #dbus-system none |
51 | 51 | ||
52 | # restrict-namespaces | 52 | #restrict-namespaces |
diff --git a/etc/profile-a-l/code.profile b/etc/profile-a-l/code.profile index 19862bc92..1b69effc3 100644 --- a/etc/profile-a-l/code.profile +++ b/etc/profile-a-l/code.profile | |||
@@ -35,7 +35,7 @@ nosound | |||
35 | # Disabling noexec ${HOME} for now since it will | 35 | # Disabling noexec ${HOME} for now since it will |
36 | # probably interfere with running some programmes | 36 | # probably interfere with running some programmes |
37 | # in VS Code | 37 | # in VS Code |
38 | # noexec ${HOME} | 38 | #noexec ${HOME} |
39 | noexec /tmp | 39 | noexec /tmp |
40 | 40 | ||
41 | # Redirect | 41 | # Redirect |
diff --git a/etc/profile-a-l/com.github.bleakgrey.tootle.profile b/etc/profile-a-l/com.github.bleakgrey.tootle.profile index 180282869..b1275e96b 100644 --- a/etc/profile-a-l/com.github.bleakgrey.tootle.profile +++ b/etc/profile-a-l/com.github.bleakgrey.tootle.profile | |||
@@ -48,9 +48,9 @@ private-etc @tls-ca,@x11,host.conf,mime.types | |||
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | # Settings are immutable | 50 | # Settings are immutable |
51 | # dbus-user filter | 51 | #dbus-user filter |
52 | # dbus-user.own com.github.bleakgrey.tootle | 52 | #dbus-user.own com.github.bleakgrey.tootle |
53 | # dbus-user.talk ca.desrt.dconf | 53 | #dbus-user.talk ca.desrt.dconf |
54 | dbus-system none | 54 | dbus-system none |
55 | 55 | ||
56 | restrict-namespaces | 56 | restrict-namespaces |
diff --git a/etc/profile-a-l/cower.profile b/etc/profile-a-l/cower.profile index 9b05b4416..c280cf22a 100644 --- a/etc/profile-a-l/cower.profile +++ b/etc/profile-a-l/cower.profile | |||
@@ -19,8 +19,8 @@ include disable-shell.inc | |||
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | # This profile could be significantly strengthened by adding the following to cower.local | 21 | # This profile could be significantly strengthened by adding the following to cower.local |
22 | # whitelist ${HOME}/<Your Build Folder> | 22 | #whitelist ${HOME}/<Your Build Folder> |
23 | # whitelist ${HOME}/.config/cower | 23 | #whitelist ${HOME}/.config/cower |
24 | 24 | ||
25 | caps.drop all | 25 | caps.drop all |
26 | ipc-namespace | 26 | ipc-namespace |
diff --git a/etc/profile-a-l/curl.profile b/etc/profile-a-l/curl.profile index bfe8764d5..42ade7ce9 100644 --- a/etc/profile-a-l/curl.profile +++ b/etc/profile-a-l/curl.profile | |||
@@ -50,10 +50,10 @@ protocol inet,inet6 | |||
50 | seccomp | 50 | seccomp |
51 | tracelog | 51 | tracelog |
52 | 52 | ||
53 | # private-bin curl | 53 | #private-bin curl |
54 | private-cache | 54 | private-cache |
55 | private-dev | 55 | private-dev |
56 | # private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl | 56 | #private-etc alternatives,ca-certificates,crypto-policies,pki,resolv.conf,ssl |
57 | private-etc @tls-ca | 57 | private-etc @tls-ca |
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
diff --git a/etc/profile-a-l/cyberfox.profile b/etc/profile-a-l/cyberfox.profile index a303c5979..c7a42e0eb 100644 --- a/etc/profile-a-l/cyberfox.profile +++ b/etc/profile-a-l/cyberfox.profile | |||
@@ -15,7 +15,7 @@ whitelist ${HOME}/.cache/8pecxstudios | |||
15 | whitelist /usr/share/8pecxstudios | 15 | whitelist /usr/share/8pecxstudios |
16 | whitelist /usr/share/cyberfox | 16 | whitelist /usr/share/cyberfox |
17 | 17 | ||
18 | # private-bin cyberfox,dbus-launch,dbus-send,env,sh,which | 18 | #private-bin cyberfox,dbus-launch,dbus-send,env,sh,which |
19 | # private-etc must first be enabled in firefox-common.profile | 19 | # private-etc must first be enabled in firefox-common.profile |
20 | #private-etc cyberfox | 20 | #private-etc cyberfox |
21 | 21 | ||
diff --git a/etc/profile-a-l/d-feet.profile b/etc/profile-a-l/d-feet.profile index 7dd5ca260..75338eb6d 100644 --- a/etc/profile-a-l/d-feet.profile +++ b/etc/profile-a-l/d-feet.profile | |||
@@ -31,7 +31,7 @@ include whitelist-var-common.inc | |||
31 | apparmor | 31 | apparmor |
32 | caps.drop all | 32 | caps.drop all |
33 | ipc-namespace | 33 | ipc-namespace |
34 | # net none - breaks on Ubuntu | 34 | #net none # breaks on Ubuntu |
35 | no3d | 35 | no3d |
36 | nodvd | 36 | nodvd |
37 | nogroups | 37 | nogroups |
@@ -52,5 +52,5 @@ private-dev | |||
52 | private-etc dbus-1 | 52 | private-etc dbus-1 |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 55 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
56 | restrict-namespaces | 56 | restrict-namespaces |
diff --git a/etc/profile-a-l/daisy.profile b/etc/profile-a-l/daisy.profile index 4f1c80f23..40b29a1f5 100644 --- a/etc/profile-a-l/daisy.profile +++ b/etc/profile-a-l/daisy.profile | |||
@@ -15,7 +15,7 @@ include disable-interpreters.inc | |||
15 | include disable-proc.inc | 15 | include disable-proc.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | #include disable-X11.inc - x11 none | 18 | #include disable-X11.inc # x11 none |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-common.inc | 21 | include whitelist-common.inc |
@@ -47,7 +47,6 @@ tracelog | |||
47 | x11 none | 47 | x11 none |
48 | 48 | ||
49 | disable-mnt | 49 | disable-mnt |
50 | private | ||
51 | private-bin daisy | 50 | private-bin daisy |
52 | private-cache | 51 | private-cache |
53 | private-dev | 52 | private-dev |
diff --git a/etc/profile-a-l/dbus-send.profile b/etc/profile-a-l/dbus-send.profile index 80790bb0c..70bd7370d 100644 --- a/etc/profile-a-l/dbus-send.profile +++ b/etc/profile-a-l/dbus-send.profile | |||
@@ -19,7 +19,7 @@ include disable-shell.inc | |||
19 | include disable-write-mnt.inc | 19 | include disable-write-mnt.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-common.inc | 22 | #include whitelist-common.inc # see #903 |
23 | include whitelist-runuser-common.inc | 23 | include whitelist-runuser-common.inc |
24 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
@@ -28,8 +28,7 @@ apparmor | |||
28 | caps.drop all | 28 | caps.drop all |
29 | ipc-namespace | 29 | ipc-namespace |
30 | machine-id | 30 | machine-id |
31 | # Breaks abstract sockets | 31 | #net none # breaks abstract sockets |
32 | #net none | ||
33 | netfilter | 32 | netfilter |
34 | no3d | 33 | no3d |
35 | nodvd | 34 | nodvd |
diff --git a/etc/profile-a-l/dconf-editor.profile b/etc/profile-a-l/dconf-editor.profile index e2e2492bc..e8acd60b7 100644 --- a/etc/profile-a-l/dconf-editor.profile +++ b/etc/profile-a-l/dconf-editor.profile | |||
@@ -22,7 +22,7 @@ include whitelist-var-common.inc | |||
22 | 22 | ||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | # net none - breaks application on older versions | 25 | #net none # breaks application on older versions |
26 | no3d | 26 | no3d |
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
diff --git a/etc/profile-a-l/ddgtk.profile b/etc/profile-a-l/ddgtk.profile index 9811c90d6..0fa88f232 100644 --- a/etc/profile-a-l/ddgtk.profile +++ b/etc/profile-a-l/ddgtk.profile | |||
@@ -50,5 +50,5 @@ private-tmp | |||
50 | dbus-user none | 50 | dbus-user none |
51 | dbus-system none | 51 | dbus-system none |
52 | 52 | ||
53 | # memory-deny-write-execute - breaks on Arch | 53 | #memory-deny-write-execute # breaks on Arch |
54 | restrict-namespaces | 54 | restrict-namespaces |
diff --git a/etc/profile-a-l/default.profile b/etc/profile-a-l/default.profile index 41794d173..c071da4b7 100644 --- a/etc/profile-a-l/default.profile +++ b/etc/profile-a-l/default.profile | |||
@@ -9,54 +9,54 @@ include globals.local | |||
9 | # depending on your usage, you can enable some of the commands below: | 9 | # depending on your usage, you can enable some of the commands below: |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
12 | # include disable-devel.inc | 12 | #include disable-devel.inc |
13 | # include disable-exec.inc | 13 | #include disable-exec.inc |
14 | # include disable-interpreters.inc | 14 | #include disable-interpreters.inc |
15 | include disable-programs.inc | 15 | include disable-programs.inc |
16 | # include disable-shell.inc | 16 | #include disable-shell.inc |
17 | # include disable-write-mnt.inc | 17 | #include disable-write-mnt.inc |
18 | # include disable-xdg.inc | 18 | #include disable-xdg.inc |
19 | 19 | ||
20 | # include whitelist-common.inc | 20 | #include whitelist-common.inc |
21 | # include whitelist-runuser-common.inc | 21 | #include whitelist-runuser-common.inc |
22 | # include whitelist-usr-share-common.inc | 22 | #include whitelist-usr-share-common.inc |
23 | # include whitelist-var-common.inc | 23 | #include whitelist-var-common.inc |
24 | 24 | ||
25 | # apparmor | 25 | #apparmor |
26 | caps.drop all | 26 | caps.drop all |
27 | # ipc-namespace | 27 | #ipc-namespace |
28 | # machine-id | 28 | #machine-id |
29 | # net none | 29 | #net none |
30 | netfilter | 30 | netfilter |
31 | # no3d | 31 | #no3d |
32 | # nodvd | 32 | #nodvd |
33 | # nogroups | 33 | #nogroups |
34 | noinput | 34 | noinput |
35 | nonewprivs | 35 | nonewprivs |
36 | noroot | 36 | noroot |
37 | # nosound | 37 | #nosound |
38 | notv | 38 | notv |
39 | # nou2f | 39 | #nou2f |
40 | novideo | 40 | novideo |
41 | protocol unix,inet,inet6 | 41 | protocol unix,inet,inet6 |
42 | seccomp | 42 | seccomp |
43 | # tracelog | 43 | #tracelog |
44 | 44 | ||
45 | # disable-mnt | 45 | #disable-mnt |
46 | # private | 46 | #private |
47 | # private-bin program | 47 | #private-bin program |
48 | # private-cache | 48 | #private-cache |
49 | # private-dev | 49 | private-dev |
50 | # see /usr/share/doc/firejail/profile.template for more common private-etc paths. | 50 | # see /usr/share/doc/firejail/profile.template for more common private-etc paths. |
51 | # private-etc alternatives,fonts,machine-id | 51 | #private-etc alternatives,fonts,machine-id |
52 | # private-lib | 52 | #private-lib |
53 | # private-opt none | 53 | #private-opt none |
54 | # private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | # dbus-user none | 56 | #dbus-user none |
57 | # dbus-system none | 57 | #dbus-system none |
58 | 58 | ||
59 | # deterministic-shutdown | 59 | #deterministic-shutdown |
60 | # memory-deny-write-execute | 60 | #memory-deny-write-execute |
61 | # read-only ${HOME} | 61 | #read-only ${HOME} |
62 | restrict-namespaces | 62 | restrict-namespaces |
diff --git a/etc/profile-a-l/deluge.profile b/etc/profile-a-l/deluge.profile index ebc751e1a..b257f9a4c 100644 --- a/etc/profile-a-l/deluge.profile +++ b/etc/profile-a-l/deluge.profile | |||
@@ -13,7 +13,7 @@ include allow-python2.inc | |||
13 | include allow-python3.inc | 13 | include allow-python3.inc |
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | # include disable-devel.inc | 16 | #include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
diff --git a/etc/profile-a-l/devhelp.profile b/etc/profile-a-l/devhelp.profile index 066cdc8b0..7b5e692a0 100644 --- a/etc/profile-a-l/devhelp.profile +++ b/etc/profile-a-l/devhelp.profile | |||
@@ -23,7 +23,7 @@ include whitelist-usr-share-common.inc | |||
23 | 23 | ||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | # net none - makes settings immutable | 26 | #net none # makes settings immutable |
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
29 | noinput | 29 | noinput |
@@ -45,9 +45,9 @@ private-etc @tls-ca,@x11 | |||
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | # makes settings immutable | 47 | # makes settings immutable |
48 | # dbus-user none | 48 | #dbus-user none |
49 | # dbus-system none | 49 | #dbus-system none |
50 | 50 | ||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 51 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
52 | read-only ${HOME} | 52 | read-only ${HOME} |
53 | restrict-namespaces | 53 | restrict-namespaces |
diff --git a/etc/profile-a-l/dig.profile b/etc/profile-a-l/dig.profile index 7c0fee9c3..781dfdcbc 100644 --- a/etc/profile-a-l/dig.profile +++ b/etc/profile-a-l/dig.profile | |||
@@ -14,13 +14,13 @@ blacklist /tmp/.X11-unix | |||
14 | blacklist ${RUNUSER} | 14 | blacklist ${RUNUSER} |
15 | 15 | ||
16 | include disable-common.inc | 16 | include disable-common.inc |
17 | # include disable-devel.inc | 17 | #include disable-devel.inc |
18 | include disable-exec.inc | 18 | include disable-exec.inc |
19 | # include disable-interpreters.inc | 19 | #include disable-interpreters.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | include disable-xdg.inc | 21 | include disable-xdg.inc |
22 | 22 | ||
23 | #mkfile ${HOME}/.digrc - see #903 | 23 | #mkfile ${HOME}/.digrc # see #903 |
24 | whitelist ${HOME}/.digrc | 24 | whitelist ${HOME}/.digrc |
25 | include whitelist-common.inc | 25 | include whitelist-common.inc |
26 | include whitelist-usr-share-common.inc | 26 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-a-l/digikam.profile b/etc/profile-a-l/digikam.profile index 05f0dfba8..34d4081d4 100644 --- a/etc/profile-a-l/digikam.profile +++ b/etc/profile-a-l/digikam.profile | |||
@@ -37,11 +37,13 @@ protocol unix,inet,inet6,netlink | |||
37 | # QtWebengine needs chroot to set up its own sandbox | 37 | # QtWebengine needs chroot to set up its own sandbox |
38 | seccomp !chroot | 38 | seccomp !chroot |
39 | 39 | ||
40 | # private-dev - prevents libdc1394 loading; this lib is used to connect to a camera device | 40 | # private-dev prevents libdc1394 from loading; this lib is used to connect to a |
41 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 41 | # camera device |
42 | #private-dev | ||
43 | #private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | ||
42 | private-tmp | 44 | private-tmp |
43 | 45 | ||
44 | # dbus-user none | 46 | #dbus-user none |
45 | # dbus-system none | 47 | #dbus-system none |
46 | 48 | ||
47 | # restrict-namespaces | 49 | #restrict-namespaces |
diff --git a/etc/profile-a-l/dino.profile b/etc/profile-a-l/dino.profile index fe2b59a1e..44a3f0846 100644 --- a/etc/profile-a-l/dino.profile +++ b/etc/profile-a-l/dino.profile | |||
@@ -40,7 +40,8 @@ tracelog | |||
40 | disable-mnt | 40 | disable-mnt |
41 | private-bin dino | 41 | private-bin dino |
42 | private-dev | 42 | private-dev |
43 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl -- breaks server connection | 43 | # breaks server connection |
44 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl | ||
44 | private-tmp | 45 | private-tmp |
45 | 46 | ||
46 | dbus-user filter | 47 | dbus-user filter |
diff --git a/etc/profile-a-l/discord-canary.profile b/etc/profile-a-l/discord-canary.profile index 245b07b8d..acf0281d9 100644 --- a/etc/profile-a-l/discord-canary.profile +++ b/etc/profile-a-l/discord-canary.profile | |||
@@ -9,9 +9,10 @@ noblacklist ${HOME}/.config/discordcanary | |||
9 | 9 | ||
10 | mkdir ${HOME}/.config/discordcanary | 10 | mkdir ${HOME}/.config/discordcanary |
11 | whitelist ${HOME}/.config/discordcanary | 11 | whitelist ${HOME}/.config/discordcanary |
12 | whitelist /opt/DiscordCanary | ||
13 | whitelist /opt/discord-canary | ||
12 | 14 | ||
13 | private-bin discord-canary,DiscordCanary | 15 | private-bin DiscordCanary,discord-canary |
14 | private-opt discord-canary,DiscordCanary | ||
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include discord-common.profile | 18 | include discord-common.profile |
diff --git a/etc/profile-a-l/discord-common.profile b/etc/profile-a-l/discord-common.profile index 83fca8772..b7744a83c 100644 --- a/etc/profile-a-l/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -7,15 +7,7 @@ include discord-common.local | |||
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | 9 | # Disabled until someone reported positive feedback |
10 | ignore include disable-interpreters.inc | ||
11 | ignore include disable-xdg.inc | ||
12 | ignore include whitelist-runuser-common.inc | ||
13 | ignore include whitelist-usr-share-common.inc | ||
14 | ignore apparmor | 10 | ignore apparmor |
15 | ignore disable-mnt | ||
16 | ignore private-cache | ||
17 | ignore dbus-user none | ||
18 | ignore dbus-system none | ||
19 | 11 | ||
20 | ignore noexec ${HOME} | 12 | ignore noexec ${HOME} |
21 | ignore novideo | 13 | ignore novideo |
@@ -26,6 +18,11 @@ whitelist ${HOME}/.local/share/betterdiscordctl | |||
26 | private-bin awk,bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,which,xdg-mime,xdg-open,zsh | 18 | private-bin awk,bash,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],fish,grep,head,sed,sh,tclsh,tr,which,xdg-mime,xdg-open,zsh |
27 | private-etc @tls-ca | 19 | private-etc @tls-ca |
28 | 20 | ||
21 | # allow D-Bus notifications | ||
22 | dbus-user filter | ||
23 | dbus-user.talk org.freedesktop.Notifications | ||
24 | ignore dbus-user none | ||
25 | |||
29 | join-or-start discord | 26 | join-or-start discord |
30 | 27 | ||
31 | # Redirect | 28 | # Redirect |
diff --git a/etc/profile-a-l/discord-ptb.profile b/etc/profile-a-l/discord-ptb.profile index 265bf5615..82b33174c 100644 --- a/etc/profile-a-l/discord-ptb.profile +++ b/etc/profile-a-l/discord-ptb.profile | |||
@@ -9,9 +9,10 @@ noblacklist ${HOME}/.config/discordptb | |||
9 | 9 | ||
10 | mkdir ${HOME}/.config/discordptb | 10 | mkdir ${HOME}/.config/discordptb |
11 | whitelist ${HOME}/.config/discordptb | 11 | whitelist ${HOME}/.config/discordptb |
12 | whitelist /opt/DiscordPTB | ||
13 | whitelist /opt/discord | ||
12 | 14 | ||
13 | private-bin discord-ptb,DiscordPTB | 15 | private-bin DiscordPTB,discord-ptb |
14 | private-opt discord-ptb,DiscordPTB | ||
15 | 16 | ||
16 | # Redirect | 17 | # Redirect |
17 | include discord-common.profile | 18 | include discord-common.profile |
diff --git a/etc/profile-a-l/discord.profile b/etc/profile-a-l/discord.profile index 02d1c65cd..9776b41d5 100644 --- a/etc/profile-a-l/discord.profile +++ b/etc/profile-a-l/discord.profile | |||
@@ -9,9 +9,11 @@ noblacklist ${HOME}/.config/discord | |||
9 | 9 | ||
10 | mkdir ${HOME}/.config/discord | 10 | mkdir ${HOME}/.config/discord |
11 | whitelist ${HOME}/.config/discord | 11 | whitelist ${HOME}/.config/discord |
12 | whitelist /opt/Discord | ||
13 | whitelist /opt/discord | ||
14 | whitelist /usr/share/discord | ||
12 | 15 | ||
13 | private-bin discord,Discord | 16 | private-bin Discord,discord |
14 | private-opt discord,Discord | ||
15 | 17 | ||
16 | # Redirect | 18 | # Redirect |
17 | include discord-common.profile | 19 | include discord-common.profile |
diff --git a/etc/profile-a-l/display.profile b/etc/profile-a-l/display.profile index bf77828be..53ed90e9c 100644 --- a/etc/profile-a-l/display.profile +++ b/etc/profile-a-l/display.profile | |||
@@ -34,13 +34,13 @@ notv | |||
34 | nou2f | 34 | nou2f |
35 | protocol unix | 35 | protocol unix |
36 | seccomp | 36 | seccomp |
37 | # x11 xorg - problems on kubuntu 17.04 | 37 | #x11 xorg # problems on kubuntu 17.04 |
38 | 38 | ||
39 | private-bin display,python* | 39 | private-bin display,python* |
40 | private-dev | 40 | private-dev |
41 | # On Debian-based systems, display is a symlink in /etc/alternatives | 41 | # On Debian-based systems, display is a symlink in /etc/alternatives |
42 | private-etc ImageMagick-6,ImageMagick-7 | 42 | private-etc ImageMagick-6,ImageMagick-7 |
43 | private-lib gcc/*/*/libgcc_s.so.*,gcc/*/*/libgomp.so.*,ImageMagick*,libfreetype.so.*,libltdl.so.*,libMagickWand-*.so.*,libXext.so.* | 43 | private-lib ImageMagick*,gcc/*/*/libgcc_s.so.*,gcc/*/*/libgomp.so.*,libMagickWand-*.so.*,libXext.so.*,libfreetype.so.*,libltdl.so.* |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | dbus-user none | 46 | dbus-user none |
diff --git a/etc/profile-a-l/dolphin-emu.profile b/etc/profile-a-l/dolphin-emu.profile index 9743ebfbd..0ae09ce7e 100644 --- a/etc/profile-a-l/dolphin-emu.profile +++ b/etc/profile-a-l/dolphin-emu.profile | |||
@@ -36,7 +36,7 @@ apparmor | |||
36 | caps.drop all | 36 | caps.drop all |
37 | ipc-namespace | 37 | ipc-namespace |
38 | # Add the next line to your dolphin-emu.local if you do not need NetPlay support. | 38 | # Add the next line to your dolphin-emu.local if you do not need NetPlay support. |
39 | # net none | 39 | #net none |
40 | netfilter | 40 | netfilter |
41 | # Add the next line to your dolphin-emu.local if you do not need disc support. | 41 | # Add the next line to your dolphin-emu.local if you do not need disc support. |
42 | #nodvd | 42 | #nodvd |
diff --git a/etc/profile-a-l/drawio.profile b/etc/profile-a-l/drawio.profile index 79366b8ee..c9daa939a 100644 --- a/etc/profile-a-l/drawio.profile +++ b/etc/profile-a-l/drawio.profile | |||
@@ -39,7 +39,7 @@ nou2f | |||
39 | novideo | 39 | novideo |
40 | protocol unix | 40 | protocol unix |
41 | seccomp !chroot | 41 | seccomp !chroot |
42 | # tracelog - breaks on Arch | 42 | #tracelog # breaks on Arch |
43 | 43 | ||
44 | private-bin drawio | 44 | private-bin drawio |
45 | private-cache | 45 | private-cache |
@@ -50,5 +50,5 @@ private-tmp | |||
50 | dbus-user none | 50 | dbus-user none |
51 | dbus-system none | 51 | dbus-system none |
52 | 52 | ||
53 | # memory-deny-write-execute - breaks on Arch | 53 | #memory-deny-write-execute # breaks on Arch |
54 | # restrict-namespaces | 54 | #restrict-namespaces |
diff --git a/etc/profile-a-l/drill.profile b/etc/profile-a-l/drill.profile index bd6fb6dcc..63dfd6c0d 100644 --- a/etc/profile-a-l/drill.profile +++ b/etc/profile-a-l/drill.profile | |||
@@ -13,13 +13,13 @@ blacklist /tmp/.X11-unix | |||
13 | blacklist ${RUNUSER} | 13 | blacklist ${RUNUSER} |
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | # include disable-devel.inc | 16 | #include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | # include disable-interpreters.inc | 18 | #include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | include whitelist-common.inc | 22 | #include whitelist-common.inc # see #903 |
23 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
diff --git a/etc/profile-a-l/easystroke.profile b/etc/profile-a-l/easystroke.profile index 40fd8be7c..3fd5578e6 100644 --- a/etc/profile-a-l/easystroke.profile +++ b/etc/profile-a-l/easystroke.profile | |||
@@ -49,8 +49,8 @@ private-etc | |||
49 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 49 | #private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # dbus-user none | 52 | #dbus-user none |
53 | # dbus-system none | 53 | #dbus-system none |
54 | 54 | ||
55 | memory-deny-write-execute | 55 | memory-deny-write-execute |
56 | restrict-namespaces | 56 | restrict-namespaces |
diff --git a/etc/profile-a-l/electron-mail.profile b/etc/profile-a-l/electron-mail.profile index 766fe523b..544756877 100644 --- a/etc/profile-a-l/electron-mail.profile +++ b/etc/profile-a-l/electron-mail.profile | |||
@@ -18,6 +18,7 @@ include disable-shell.inc | |||
18 | 18 | ||
19 | mkdir ${HOME}/.config/electron-mail | 19 | mkdir ${HOME}/.config/electron-mail |
20 | whitelist ${HOME}/.config/electron-mail | 20 | whitelist ${HOME}/.config/electron-mail |
21 | whitelist /opt/ElectronMail | ||
21 | 22 | ||
22 | # The lines below are needed to find the default Firefox profile name, to allow | 23 | # The lines below are needed to find the default Firefox profile name, to allow |
23 | # opening links in an existing instance of Firefox (note that it still fails if | 24 | # opening links in an existing instance of Firefox (note that it still fails if |
@@ -29,7 +30,6 @@ machine-id | |||
29 | nosound | 30 | nosound |
30 | 31 | ||
31 | private-etc @tls-ca,@x11 | 32 | private-etc @tls-ca,@x11 |
32 | private-opt ElectronMail | ||
33 | 33 | ||
34 | dbus-user filter | 34 | dbus-user filter |
35 | dbus-user.talk org.freedesktop.Notifications | 35 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-a-l/electrum.profile b/etc/profile-a-l/electrum.profile index 48ce0aa22..d73ed9092 100644 --- a/etc/profile-a-l/electrum.profile +++ b/etc/profile-a-l/electrum.profile | |||
@@ -49,7 +49,7 @@ private-dev | |||
49 | private-etc @tls-ca,@x11 | 49 | private-etc @tls-ca,@x11 |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # dbus-user none | 52 | #dbus-user none |
53 | # dbus-system none | 53 | #dbus-system none |
54 | 54 | ||
55 | restrict-namespaces | 55 | restrict-namespaces |
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile index 7b4994a85..1af2884b6 100644 --- a/etc/profile-a-l/element-desktop.profile +++ b/etc/profile-a-l/element-desktop.profile | |||
@@ -15,8 +15,6 @@ mkdir ${HOME}/.config/Element | |||
15 | whitelist ${HOME}/.config/Element | 15 | whitelist ${HOME}/.config/Element |
16 | whitelist /opt/Element | 16 | whitelist /opt/Element |
17 | 17 | ||
18 | private-opt Element | ||
19 | |||
20 | dbus-user filter | 18 | dbus-user filter |
21 | dbus-user.talk org.freedesktop.Notifications | 19 | dbus-user.talk org.freedesktop.Notifications |
22 | dbus-user.talk org.freedesktop.secrets | 20 | dbus-user.talk org.freedesktop.secrets |
diff --git a/etc/profile-a-l/email-common.profile b/etc/profile-a-l/email-common.profile index 8eee662ad..cffa85fd5 100644 --- a/etc/profile-a-l/email-common.profile +++ b/etc/profile-a-l/email-common.profile | |||
@@ -75,7 +75,7 @@ seccomp | |||
75 | seccomp.block-secondary | 75 | seccomp.block-secondary |
76 | tracelog | 76 | tracelog |
77 | 77 | ||
78 | # disable-mnt | 78 | #disable-mnt |
79 | private-cache | 79 | private-cache |
80 | private-dev | 80 | private-dev |
81 | private-etc @tls-ca,@x11,bogofilter,bogofilter.cf,gnupg,hosts.conf,mailname,timezone | 81 | private-etc @tls-ca,@x11,bogofilter,bogofilter.cf,gnupg,hosts.conf,mailname,timezone |
diff --git a/etc/profile-a-l/engrampa.profile b/etc/profile-a-l/engrampa.profile index e1d107dc7..24e4f8a0e 100644 --- a/etc/profile-a-l/engrampa.profile +++ b/etc/profile-a-l/engrampa.profile | |||
@@ -35,9 +35,9 @@ seccomp | |||
35 | seccomp.block-secondary | 35 | seccomp.block-secondary |
36 | tracelog | 36 | tracelog |
37 | 37 | ||
38 | # private-bin engrampa | 38 | #private-bin engrampa |
39 | private-dev | 39 | private-dev |
40 | # private-tmp | 40 | #private-tmp |
41 | 41 | ||
42 | dbus-user filter | 42 | dbus-user filter |
43 | dbus-user.talk ca.desrt.dconf | 43 | dbus-user.talk ca.desrt.dconf |
diff --git a/etc/profile-a-l/enpass.profile b/etc/profile-a-l/enpass.profile index 45a1125b4..62e9d42ac 100644 --- a/etc/profile-a-l/enpass.profile +++ b/etc/profile-a-l/enpass.profile | |||
@@ -52,11 +52,11 @@ protocol unix,inet,inet6,netlink | |||
52 | seccomp | 52 | seccomp |
53 | tracelog | 53 | tracelog |
54 | 54 | ||
55 | private-bin dirname,Enpass,importer_enpass,readlink,sh | 55 | private-bin Enpass,dirname,importer_enpass,readlink,sh |
56 | ?HAS_APPIMAGE: ignore private-dev | 56 | ?HAS_APPIMAGE: ignore private-dev |
57 | private-dev | 57 | private-dev |
58 | private-opt Enpass | 58 | private-opt Enpass |
59 | private-tmp | 59 | private-tmp |
60 | 60 | ||
61 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 61 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
62 | restrict-namespaces | 62 | restrict-namespaces |
diff --git a/etc/profile-a-l/ephemeral.profile b/etc/profile-a-l/ephemeral.profile index 8b32d08b1..795128418 100644 --- a/etc/profile-a-l/ephemeral.profile +++ b/etc/profile-a-l/ephemeral.profile | |||
@@ -59,7 +59,7 @@ private-cache | |||
59 | private-tmp | 59 | private-tmp |
60 | 60 | ||
61 | # breaks preferences | 61 | # breaks preferences |
62 | # dbus-user none | 62 | #dbus-user none |
63 | # dbus-system none | 63 | #dbus-system none |
64 | 64 | ||
65 | restrict-namespaces | 65 | restrict-namespaces |
diff --git a/etc/profile-a-l/etr.profile b/etc/profile-a-l/etr.profile index 5b9892af3..4789afee6 100644 --- a/etc/profile-a-l/etr.profile +++ b/etc/profile-a-l/etr.profile | |||
@@ -48,7 +48,7 @@ disable-mnt | |||
48 | private-bin etr | 48 | private-bin etr |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | # private-etc alternatives,drirc,machine-id,openal,passwd | 51 | #private-etc alternatives,drirc,machine-id,openal,passwd |
52 | private-etc @games,@x11 | 52 | private-etc @games,@x11 |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index 75a3958ad..06a4a64b1 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -34,7 +34,7 @@ include whitelist-var-common.inc | |||
34 | 34 | ||
35 | caps.drop all | 35 | caps.drop all |
36 | machine-id | 36 | machine-id |
37 | # net none - breaks AppArmor on Ubuntu systems | 37 | #net none # breaks AppArmor on Ubuntu systems |
38 | netfilter | 38 | netfilter |
39 | no3d | 39 | no3d |
40 | nodvd | 40 | nodvd |
diff --git a/etc/profile-a-l/falkon.profile b/etc/profile-a-l/falkon.profile index d805766eb..2a30d2e23 100644 --- a/etc/profile-a-l/falkon.profile +++ b/etc/profile-a-l/falkon.profile | |||
@@ -41,17 +41,17 @@ nou2f | |||
41 | protocol unix,inet,inet6,netlink | 41 | protocol unix,inet,inet6,netlink |
42 | # blacklisting of chroot system calls breaks falkon | 42 | # blacklisting of chroot system calls breaks falkon |
43 | seccomp !chroot | 43 | seccomp !chroot |
44 | # tracelog | 44 | #tracelog |
45 | 45 | ||
46 | disable-mnt | 46 | disable-mnt |
47 | # private-bin falkon | 47 | #private-bin falkon |
48 | private-cache | 48 | private-cache |
49 | private-dev | 49 | private-dev |
50 | private-etc @tls-ca,@x11,adobe,mailcap,mime.types | 50 | private-etc @tls-ca,@x11,adobe,mailcap,mime.types |
51 | private-tmp | 51 | private-tmp |
52 | 52 | ||
53 | # dbus-user filter | 53 | #dbus-user filter |
54 | # dbus-user.own org.kde.Falkon | 54 | #dbus-user.own org.kde.Falkon |
55 | dbus-system none | 55 | dbus-system none |
56 | 56 | ||
57 | # restrict-namespaces | 57 | #restrict-namespaces |
diff --git a/etc/profile-a-l/fbreader.profile b/etc/profile-a-l/fbreader.profile index 434371aee..5906085de 100644 --- a/etc/profile-a-l/fbreader.profile +++ b/etc/profile-a-l/fbreader.profile | |||
@@ -33,7 +33,7 @@ novideo | |||
33 | protocol unix,inet,inet6 | 33 | protocol unix,inet,inet6 |
34 | seccomp | 34 | seccomp |
35 | 35 | ||
36 | private-bin fbreader,FBReader | 36 | private-bin FBReader,fbreader |
37 | private-dev | 37 | private-dev |
38 | private-tmp | 38 | private-tmp |
39 | 39 | ||
diff --git a/etc/profile-a-l/fdns.profile b/etc/profile-a-l/fdns.profile index fe7f88a75..e9d5709ec 100644 --- a/etc/profile-a-l/fdns.profile +++ b/etc/profile-a-l/fdns.profile | |||
@@ -24,7 +24,7 @@ include disable-xdg.inc | |||
24 | apparmor /usr/bin/fdns | 24 | apparmor /usr/bin/fdns |
25 | caps.keep kill,net_bind_service,setgid,setuid,sys_admin,sys_chroot | 25 | caps.keep kill,net_bind_service,setgid,setuid,sys_admin,sys_chroot |
26 | ipc-namespace | 26 | ipc-namespace |
27 | # netfilter /etc/firejail/webserver.net | 27 | #netfilter /etc/firejail/webserver.net |
28 | no3d | 28 | no3d |
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
@@ -43,7 +43,7 @@ private-bin bash,fdns,sh | |||
43 | private-cache | 43 | private-cache |
44 | #private-dev | 44 | #private-dev |
45 | private-etc @tls-ca,fdns | 45 | private-etc @tls-ca,fdns |
46 | # private-lib | 46 | #private-lib |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/feedreader.profile b/etc/profile-a-l/feedreader.profile index 6aa24cc86..7b205a917 100644 --- a/etc/profile-a-l/feedreader.profile +++ b/etc/profile-a-l/feedreader.profile | |||
@@ -29,13 +29,13 @@ include whitelist-var-common.inc | |||
29 | 29 | ||
30 | caps.drop all | 30 | caps.drop all |
31 | netfilter | 31 | netfilter |
32 | # no3d | 32 | #no3d |
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
35 | noinput | 35 | noinput |
36 | nonewprivs | 36 | nonewprivs |
37 | noroot | 37 | noroot |
38 | # nosound | 38 | #nosound |
39 | notv | 39 | notv |
40 | nou2f | 40 | nou2f |
41 | novideo | 41 | novideo |
diff --git a/etc/profile-a-l/ferdi.profile b/etc/profile-a-l/ferdi.profile index 3a044542f..27920620a 100644 --- a/etc/profile-a-l/ferdi.profile +++ b/etc/profile-a-l/ferdi.profile | |||
@@ -45,4 +45,4 @@ disable-mnt | |||
45 | private-dev | 45 | private-dev |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # restrict-namespaces | 48 | #restrict-namespaces |
diff --git a/etc/profile-a-l/ffmpeg.profile b/etc/profile-a-l/ffmpeg.profile index b7d54f05d..af9d556db 100644 --- a/etc/profile-a-l/ffmpeg.profile +++ b/etc/profile-a-l/ffmpeg.profile | |||
@@ -53,5 +53,5 @@ private-tmp | |||
53 | dbus-user none | 53 | dbus-user none |
54 | dbus-system none | 54 | dbus-system none |
55 | 55 | ||
56 | # memory-deny-write-execute - it breaks old versions of ffmpeg | 56 | #memory-deny-write-execute # it breaks old versions of ffmpeg |
57 | restrict-namespaces | 57 | restrict-namespaces |
diff --git a/etc/profile-a-l/file-roller.profile b/etc/profile-a-l/file-roller.profile index 78e2751b3..cc1a290ef 100644 --- a/etc/profile-a-l/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile | |||
@@ -6,6 +6,8 @@ include file-roller.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${PATH}/dpkg* | ||
10 | |||
9 | include disable-common.inc | 11 | include disable-common.inc |
10 | include disable-devel.inc | 12 | include disable-devel.inc |
11 | include disable-exec.inc | 13 | include disable-exec.inc |
@@ -22,7 +24,7 @@ include whitelist-var-common.inc | |||
22 | apparmor | 24 | apparmor |
23 | caps.drop all | 25 | caps.drop all |
24 | machine-id | 26 | machine-id |
25 | # net none - breaks on older Ubuntu versions | 27 | #net none # breaks on older Ubuntu versions |
26 | netfilter | 28 | netfilter |
27 | no3d | 29 | no3d |
28 | nodvd | 30 | nodvd |
@@ -40,11 +42,11 @@ seccomp | |||
40 | seccomp.block-secondary | 42 | seccomp.block-secondary |
41 | tracelog | 43 | tracelog |
42 | 44 | ||
43 | private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg-deb,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd | 45 | private-bin 7z,7za,7zr,ar,arj,atool,bash,brotli,bsdtar,bzip2,compress,cp,cpio,dpkg*,file-roller,gtar,gzip,isoinfo,lha,lrzip,lsar,lz4,lzip,lzma,lzop,mv,p7zip,rar,rm,rzip,sh,tar,unace,unalz,unar,uncompress,unrar,unsquashfs,unstuff,unzip,unzstd,xz,xzdec,zip,zoo,zstd |
44 | private-cache | 46 | private-cache |
45 | private-dev | 47 | private-dev |
46 | private-etc @x11 | 48 | private-etc @x11 |
47 | # private-tmp | 49 | #private-tmp |
48 | 50 | ||
49 | dbus-user filter | 51 | dbus-user filter |
50 | dbus-user.own org.gnome.ArchiveManager1 | 52 | dbus-user.own org.gnome.ArchiveManager1 |
diff --git a/etc/profile-a-l/firefox-common-addons.profile b/etc/profile-a-l/firefox-common-addons.profile index f12750fda..566e88bf8 100644 --- a/etc/profile-a-l/firefox-common-addons.profile +++ b/etc/profile-a-l/firefox-common-addons.profile | |||
@@ -11,6 +11,7 @@ ignore include whitelist-runuser-common.inc | |||
11 | 11 | ||
12 | ignore private-cache | 12 | ignore private-cache |
13 | 13 | ||
14 | noblacklist ${HOME}/.cache/mpv | ||
14 | noblacklist ${HOME}/.cache/youtube-dl | 15 | noblacklist ${HOME}/.cache/youtube-dl |
15 | noblacklist ${HOME}/.config/kgetrc | 16 | noblacklist ${HOME}/.config/kgetrc |
16 | noblacklist ${HOME}/.config/mpv | 17 | noblacklist ${HOME}/.config/mpv |
@@ -32,9 +33,11 @@ noblacklist ${HOME}/.local/share/kget | |||
32 | noblacklist ${HOME}/.local/share/kxmlgui5/okular | 33 | noblacklist ${HOME}/.local/share/kxmlgui5/okular |
33 | noblacklist ${HOME}/.local/share/okular | 34 | noblacklist ${HOME}/.local/share/okular |
34 | noblacklist ${HOME}/.local/share/qpdfview | 35 | noblacklist ${HOME}/.local/share/qpdfview |
36 | noblacklist ${HOME}/.local/state/mpv | ||
35 | noblacklist ${HOME}/.netrc | 37 | noblacklist ${HOME}/.netrc |
36 | 38 | ||
37 | whitelist ${HOME}/.cache/gnome-mplayer/plugin | 39 | whitelist ${HOME}/.cache/gnome-mplayer/plugin |
40 | whitelist ${HOME}/.cache/mpv | ||
38 | whitelist ${HOME}/.cache/youtube-dl/youtube-sigfuncs | 41 | whitelist ${HOME}/.cache/youtube-dl/youtube-sigfuncs |
39 | whitelist ${HOME}/.config/gnome-mplayer | 42 | whitelist ${HOME}/.config/gnome-mplayer |
40 | whitelist ${HOME}/.config/kgetrc | 43 | whitelist ${HOME}/.config/kgetrc |
@@ -62,6 +65,7 @@ whitelist ${HOME}/.local/share/kxmlgui5/okular | |||
62 | whitelist ${HOME}/.local/share/okular | 65 | whitelist ${HOME}/.local/share/okular |
63 | whitelist ${HOME}/.local/share/qpdfview | 66 | whitelist ${HOME}/.local/share/qpdfview |
64 | whitelist ${HOME}/.local/share/tridactyl | 67 | whitelist ${HOME}/.local/share/tridactyl |
68 | whitelist ${HOME}/.local/state/mpv | ||
65 | whitelist ${HOME}/.netrc | 69 | whitelist ${HOME}/.netrc |
66 | whitelist ${HOME}/.pentadactyl | 70 | whitelist ${HOME}/.pentadactyl |
67 | whitelist ${HOME}/.pentadactylrc | 71 | whitelist ${HOME}/.pentadactylrc |
diff --git a/etc/profile-a-l/floorp.profile b/etc/profile-a-l/floorp.profile new file mode 100644 index 000000000..49caed107 --- /dev/null +++ b/etc/profile-a-l/floorp.profile | |||
@@ -0,0 +1,45 @@ | |||
1 | # Firejail profile for floorp | ||
2 | # Description: A customisable Firefox fork with excellent privacy protection | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include floorp.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/floorp | ||
10 | noblacklist ${HOME}/.floorp | ||
11 | |||
12 | mkdir ${HOME}/.cache/floorp | ||
13 | mkdir ${HOME}/.floorp | ||
14 | whitelist ${HOME}/.cache/floorp | ||
15 | whitelist ${HOME}/.floorp | ||
16 | |||
17 | # Add the next lines to your floorp.local if you want to use the migration wizard. | ||
18 | #noblacklist ${HOME}/.mozilla | ||
19 | #whitelist ${HOME}/.mozilla | ||
20 | |||
21 | # To enable KeePassXC Plugin add one of the following lines to your floorp.local. | ||
22 | # Note: Start KeePassXC before floorp and keep it open to allow communication between them. | ||
23 | #whitelist ${RUNUSER}/kpxc_server | ||
24 | #whitelist ${RUNUSER}/org.keepassxc.KeePassXC.BrowserServer | ||
25 | |||
26 | dbus-user filter | ||
27 | dbus-user.own org.mozilla.floorp.* | ||
28 | # Add the next line to your floorp.local to enable native notifications. | ||
29 | #dbus-user.talk org.freedesktop.Notifications | ||
30 | # Add the next line to your floorp.local to allow inhibiting screensavers. | ||
31 | #dbus-user.talk org.freedesktop.ScreenSaver | ||
32 | # Add the next lines to your floorp.local for plasma browser integration. | ||
33 | #dbus-user.own org.mpris.MediaPlayer2.plasma-browser-integration | ||
34 | #dbus-user.talk org.kde.JobViewServer | ||
35 | #dbus-user.talk org.kde.kuiserver | ||
36 | # Add the next line to your floorp.local to allow screensharing under Wayland. | ||
37 | #dbus-user.talk org.freedesktop.portal.Desktop | ||
38 | # Also add the next line to your floorp.local if screensharing does not work with | ||
39 | # the above lines (depends on the portal implementation). | ||
40 | #ignore noroot | ||
41 | ignore apparmor | ||
42 | ignore dbus-user none | ||
43 | |||
44 | # Redirect | ||
45 | include firefox-common.profile | ||
diff --git a/etc/profile-a-l/fluffychat.profile b/etc/profile-a-l/fluffychat.profile new file mode 100644 index 000000000..1c5db09e9 --- /dev/null +++ b/etc/profile-a-l/fluffychat.profile | |||
@@ -0,0 +1,73 @@ | |||
1 | # Firejail profile for fluffychat | ||
2 | # Description: Easy to use matrix messenger | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include fluffychat.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/fluffychat | ||
10 | |||
11 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
12 | include allow-bin-sh.inc | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-proc.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | # The lines below are needed to find the default Firefox profile name, to allow | ||
24 | # opening links in an existing instance of Firefox (note that it still fails if | ||
25 | # there isn't a Firefox instance running with the default profile; see #5352) | ||
26 | noblacklist ${HOME}/.mozilla | ||
27 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
28 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
29 | |||
30 | mkdir ${HOME}/.local/share/fluffychat | ||
31 | whitelist ${DOWNLOADS} | ||
32 | whitelist ${HOME}/.local/share/fluffychat | ||
33 | whitelist /opt/fluffychat | ||
34 | whitelist /usr/share/fluffychat | ||
35 | include whitelist-common.inc | ||
36 | include whitelist-run-common.inc | ||
37 | include whitelist-runuser-common.inc | ||
38 | include whitelist-usr-share-common.inc | ||
39 | include whitelist-var-common.inc | ||
40 | |||
41 | apparmor | ||
42 | caps.drop all | ||
43 | netfilter | ||
44 | no3d | ||
45 | nodvd | ||
46 | nogroups | ||
47 | noinput | ||
48 | nonewprivs | ||
49 | noprinters | ||
50 | noroot | ||
51 | notv | ||
52 | nou2f | ||
53 | novideo | ||
54 | protocol unix,inet,inet6 | ||
55 | seccomp | ||
56 | seccomp.block-secondary | ||
57 | tracelog | ||
58 | |||
59 | disable-mnt | ||
60 | private-bin firefox,fluffychat,sh,which,zenity | ||
61 | private-cache | ||
62 | private-dev | ||
63 | private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,dconf,fonts,gconf,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg | ||
64 | private-tmp | ||
65 | |||
66 | dbus-user filter | ||
67 | dbus-user.talk org.freedesktop.secrets | ||
68 | # allow D-Bus communication with firefox for opening links | ||
69 | dbus-user.talk org.mozilla.* | ||
70 | dbus-system filter | ||
71 | dbus-system.talk org.freedesktop.NetworkManager | ||
72 | |||
73 | restrict-namespaces | ||
diff --git a/etc/profile-a-l/font-manager.profile b/etc/profile-a-l/font-manager.profile index 88ae56c82..5b9603243 100644 --- a/etc/profile-a-l/font-manager.profile +++ b/etc/profile-a-l/font-manager.profile | |||
@@ -33,7 +33,7 @@ include whitelist-var-common.inc | |||
33 | apparmor | 33 | apparmor |
34 | caps.drop all | 34 | caps.drop all |
35 | machine-id | 35 | machine-id |
36 | # net none - issues on older versions | 36 | #net none # issues on older versions |
37 | no3d | 37 | no3d |
38 | nodvd | 38 | nodvd |
39 | nogroups | 39 | nogroups |
@@ -53,5 +53,5 @@ private-bin font-manager,python*,yelp | |||
53 | private-dev | 53 | private-dev |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 56 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
57 | restrict-namespaces | 57 | restrict-namespaces |
diff --git a/etc/profile-a-l/franz.profile b/etc/profile-a-l/franz.profile index e21789d73..664773b77 100644 --- a/etc/profile-a-l/franz.profile +++ b/etc/profile-a-l/franz.profile | |||
@@ -45,4 +45,4 @@ disable-mnt | |||
45 | private-dev | 45 | private-dev |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # restrict-namespaces | 48 | #restrict-namespaces |
diff --git a/etc/profile-a-l/freemind.profile b/etc/profile-a-l/freemind.profile index 9bf5a14be..80958d305 100644 --- a/etc/profile-a-l/freemind.profile +++ b/etc/profile-a-l/freemind.profile | |||
@@ -9,6 +9,8 @@ include globals.local | |||
9 | noblacklist ${DOCUMENTS} | 9 | noblacklist ${DOCUMENTS} |
10 | noblacklist ${HOME}/.freemind | 10 | noblacklist ${HOME}/.freemind |
11 | 11 | ||
12 | noblacklist ${PATH}/dpkg* | ||
13 | |||
12 | # Allow java (blacklisted by disable-devel.inc) | 14 | # Allow java (blacklisted by disable-devel.inc) |
13 | include allow-java.inc | 15 | include allow-java.inc |
14 | 16 | ||
@@ -40,7 +42,7 @@ seccomp | |||
40 | tracelog | 42 | tracelog |
41 | 43 | ||
42 | disable-mnt | 44 | disable-mnt |
43 | private-bin bash,cp,dirname,dpkg,echo,freemind,grep,java,lsb_release,mkdir,readlink,rpm,sed,sh,uname,which | 45 | private-bin bash,cp,dirname,dpkg*,echo,freemind,grep,java,lsb_release,mkdir,readlink,rpm,sed,sh,uname,which |
44 | private-cache | 46 | private-cache |
45 | private-dev | 47 | private-dev |
46 | #private-etc alternatives,fonts,java* | 48 | #private-etc alternatives,fonts,java* |
diff --git a/etc/profile-a-l/freshclam.profile b/etc/profile-a-l/freshclam.profile index 133d66f0d..f59094567 100644 --- a/etc/profile-a-l/freshclam.profile +++ b/etc/profile-a-l/freshclam.profile | |||
@@ -2,7 +2,7 @@ | |||
2 | # This file is overwritten after every install/update | 2 | # This file is overwritten after every install/update |
3 | quiet | 3 | quiet |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include clamav.local | 5 | include freshclam.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
diff --git a/etc/profile-a-l/frozen-bubble.profile b/etc/profile-a-l/frozen-bubble.profile index f162a4a31..98f473654 100644 --- a/etc/profile-a-l/frozen-bubble.profile +++ b/etc/profile-a-l/frozen-bubble.profile | |||
@@ -41,7 +41,7 @@ seccomp | |||
41 | tracelog | 41 | tracelog |
42 | 42 | ||
43 | disable-mnt | 43 | disable-mnt |
44 | # private-bin frozen-bubble | 44 | #private-bin frozen-bubble |
45 | private-dev | 45 | private-dev |
46 | private-etc @games,@x11 | 46 | private-etc @games,@x11 |
47 | private-tmp | 47 | private-tmp |
diff --git a/etc/profile-a-l/funnyboat.profile b/etc/profile-a-l/funnyboat.profile index 8ca349d1c..bd790cab4 100644 --- a/etc/profile-a-l/funnyboat.profile +++ b/etc/profile-a-l/funnyboat.profile | |||
@@ -16,7 +16,7 @@ include disable-devel.inc | |||
16 | include disable-exec.inc | 16 | include disable-exec.inc |
17 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | # include disable-shell.inc | 19 | #include disable-shell.inc |
20 | include disable-xdg.inc | 20 | include disable-xdg.inc |
21 | 21 | ||
22 | mkdir ${HOME}/.funnyboat | 22 | mkdir ${HOME}/.funnyboat |
@@ -41,7 +41,7 @@ notv | |||
41 | novideo | 41 | novideo |
42 | protocol unix,inet,inet6 | 42 | protocol unix,inet,inet6 |
43 | seccomp | 43 | seccomp |
44 | # tracelog | 44 | #tracelog |
45 | 45 | ||
46 | disable-mnt | 46 | disable-mnt |
47 | private-cache | 47 | private-cache |
diff --git a/etc/profile-a-l/galculator.profile b/etc/profile-a-l/galculator.profile index 44d62cc86..aa1b96c41 100644 --- a/etc/profile-a-l/galculator.profile +++ b/etc/profile-a-l/galculator.profile | |||
@@ -48,5 +48,5 @@ private-tmp | |||
48 | dbus-user none | 48 | dbus-user none |
49 | dbus-system none | 49 | dbus-system none |
50 | 50 | ||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 51 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
52 | restrict-namespaces | 52 | restrict-namespaces |
diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile index baf8f614e..2d0511cf6 100644 --- a/etc/profile-a-l/gapplication.profile +++ b/etc/profile-a-l/gapplication.profile | |||
@@ -17,7 +17,7 @@ include disable-programs.inc | |||
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | include whitelist-common.inc | 20 | #include whitelist-common.inc # see #903 |
21 | include whitelist-runuser-common.inc | 21 | include whitelist-runuser-common.inc |
22 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
23 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/geary.profile b/etc/profile-a-l/geary.profile index ba0837780..da240c36a 100644 --- a/etc/profile-a-l/geary.profile +++ b/etc/profile-a-l/geary.profile | |||
@@ -53,7 +53,7 @@ include whitelist-var-common.inc | |||
53 | 53 | ||
54 | apparmor | 54 | apparmor |
55 | caps.drop all | 55 | caps.drop all |
56 | #ipc-namespace - may cause issues with X11 | 56 | #ipc-namespace # may cause issues with X11 |
57 | #machine-id | 57 | #machine-id |
58 | netfilter | 58 | netfilter |
59 | no3d | 59 | no3d |
@@ -71,7 +71,7 @@ seccomp | |||
71 | seccomp.block-secondary | 71 | seccomp.block-secondary |
72 | tracelog | 72 | tracelog |
73 | 73 | ||
74 | # disable-mnt | 74 | #disable-mnt |
75 | #private-bin geary,sh | 75 | #private-bin geary,sh |
76 | private-cache | 76 | private-cache |
77 | private-dev | 77 | private-dev |
diff --git a/etc/profile-a-l/gedit.profile b/etc/profile-a-l/gedit.profile index dbb3ab971..bc265a509 100644 --- a/etc/profile-a-l/gedit.profile +++ b/etc/profile-a-l/gedit.profile | |||
@@ -13,18 +13,18 @@ noblacklist ${HOME}/.config/gedit | |||
13 | include allow-common-devel.inc | 13 | include allow-common-devel.inc |
14 | 14 | ||
15 | include disable-common.inc | 15 | include disable-common.inc |
16 | # include disable-devel.inc | 16 | #include disable-devel.inc |
17 | include disable-exec.inc | 17 | include disable-exec.inc |
18 | # include disable-interpreters.inc | 18 | #include disable-interpreters.inc |
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | 21 | include whitelist-runuser-common.inc |
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | # apparmor - makes settings immutable | 24 | #apparmor # makes settings immutable |
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | # net none - makes settings immutable | 27 | #net none # makes settings immutable |
28 | no3d | 28 | no3d |
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
@@ -40,14 +40,14 @@ seccomp | |||
40 | seccomp.block-secondary | 40 | seccomp.block-secondary |
41 | tracelog | 41 | tracelog |
42 | 42 | ||
43 | # private-bin gedit | 43 | #private-bin gedit |
44 | private-dev | 44 | private-dev |
45 | # private-lib breaks python plugins - add the next line to your gedit.local if you don't use them. | 45 | # private-lib breaks python plugins - add the next line to your gedit.local if you don't use them. |
46 | #private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* | 46 | #private-lib aspell,gconv,gedit,libgspell-1.so.*,libgtksourceview-*,libpeas-gtk-1.0.so.*,libreadline.so.*,libtinfo.so.* |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | # makes settings immutable | 49 | # makes settings immutable |
50 | # dbus-user none | 50 | #dbus-user none |
51 | # dbus-system none | 51 | #dbus-system none |
52 | 52 | ||
53 | restrict-namespaces | 53 | restrict-namespaces |
diff --git a/etc/profile-a-l/geekbench.profile b/etc/profile-a-l/geekbench.profile index e8d4c013f..387ec615f 100644 --- a/etc/profile-a-l/geekbench.profile +++ b/etc/profile-a-l/geekbench.profile | |||
@@ -43,7 +43,7 @@ seccomp | |||
43 | tracelog | 43 | tracelog |
44 | 44 | ||
45 | disable-mnt | 45 | disable-mnt |
46 | #private-bin bash,geekbench*,sh -- #4576 | 46 | #private-bin bash,geekbench*,sh # #4576 |
47 | private-cache | 47 | private-cache |
48 | private-dev | 48 | private-dev |
49 | private-etc lsb-release | 49 | private-etc lsb-release |
diff --git a/etc/profile-a-l/geeqie.profile b/etc/profile-a-l/geeqie.profile index f81a49e4f..6cd28f25d 100644 --- a/etc/profile-a-l/geeqie.profile +++ b/etc/profile-a-l/geeqie.profile | |||
@@ -32,7 +32,7 @@ novideo | |||
32 | protocol unix,inet,inet6 | 32 | protocol unix,inet,inet6 |
33 | seccomp | 33 | seccomp |
34 | 34 | ||
35 | # private-bin geeqie | 35 | #private-bin geeqie |
36 | private-dev | 36 | private-dev |
37 | 37 | ||
38 | restrict-namespaces | 38 | restrict-namespaces |
diff --git a/etc/profile-a-l/gfeeds.profile b/etc/profile-a-l/gfeeds.profile index 1c97ad21c..007658138 100644 --- a/etc/profile-a-l/gfeeds.profile +++ b/etc/profile-a-l/gfeeds.profile | |||
@@ -58,7 +58,7 @@ tracelog | |||
58 | 58 | ||
59 | disable-mnt | 59 | disable-mnt |
60 | private-bin gfeeds,python3* | 60 | private-bin gfeeds,python3* |
61 | # private-cache -- feeds are stored in ~/.cache | 61 | #private-cache # feeds are stored in ~/.cache |
62 | private-dev | 62 | private-dev |
63 | private-etc @tls-ca,@x11,dbus-1,gconf,host.conf,mime.types,rpc,services | 63 | private-etc @tls-ca,@x11,dbus-1,gconf,host.conf,mime.types,rpc,services |
64 | private-tmp | 64 | private-tmp |
diff --git a/etc/profile-a-l/ghostwriter.profile b/etc/profile-a-l/ghostwriter.profile index dabf0dd7f..2023ca9f0 100644 --- a/etc/profile-a-l/ghostwriter.profile +++ b/etc/profile-a-l/ghostwriter.profile | |||
@@ -45,7 +45,7 @@ novideo | |||
45 | protocol unix,inet,inet6,netlink | 45 | protocol unix,inet,inet6,netlink |
46 | seccomp !chroot | 46 | seccomp !chroot |
47 | seccomp.block-secondary | 47 | seccomp.block-secondary |
48 | #tracelog -- breaks | 48 | #tracelog # breaks |
49 | 49 | ||
50 | private-bin context,gettext,ghostwriter,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf | 50 | private-bin context,gettext,ghostwriter,latex,mktexfmt,pandoc,pdflatex,pdfroff,prince,weasyprint,wkhtmltopdf |
51 | private-cache | 51 | private-cache |
diff --git a/etc/profile-a-l/github-desktop.profile b/etc/profile-a-l/github-desktop.profile index ced1aa190..88134b363 100644 --- a/etc/profile-a-l/github-desktop.profile +++ b/etc/profile-a-l/github-desktop.profile | |||
@@ -29,14 +29,14 @@ noblacklist ${HOME}/.config/git | |||
29 | noblacklist ${HOME}/.gitconfig | 29 | noblacklist ${HOME}/.gitconfig |
30 | noblacklist ${HOME}/.git-credentials | 30 | noblacklist ${HOME}/.git-credentials |
31 | 31 | ||
32 | # no3d | 32 | #no3d |
33 | nosound | 33 | nosound |
34 | 34 | ||
35 | # private-bin github-desktop | 35 | #private-bin github-desktop |
36 | ?HAS_APPIMAGE: ignore private-dev | 36 | ?HAS_APPIMAGE: ignore private-dev |
37 | # private-lib | 37 | #private-lib |
38 | 38 | ||
39 | # memory-deny-write-execute | 39 | #memory-deny-write-execute |
40 | 40 | ||
41 | # Redirect | 41 | # Redirect |
42 | include electron-common.profile | 42 | include electron-common.profile |
diff --git a/etc/profile-a-l/gitter.profile b/etc/profile-a-l/gitter.profile index e3cf87c87..54f2923ba 100644 --- a/etc/profile-a-l/gitter.profile +++ b/etc/profile-a-l/gitter.profile | |||
@@ -18,6 +18,7 @@ mkdir ${HOME}/.config/Gitter | |||
18 | whitelist ${DOWNLOADS} | 18 | whitelist ${DOWNLOADS} |
19 | whitelist ${HOME}/.config/autostart | 19 | whitelist ${HOME}/.config/autostart |
20 | whitelist ${HOME}/.config/Gitter | 20 | whitelist ${HOME}/.config/Gitter |
21 | whitelist /opt/Gitter | ||
21 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
22 | 23 | ||
23 | caps.drop all | 24 | caps.drop all |
@@ -37,7 +38,6 @@ seccomp | |||
37 | disable-mnt | 38 | disable-mnt |
38 | private-bin bash,env,gitter | 39 | private-bin bash,env,gitter |
39 | private-etc @tls-ca | 40 | private-etc @tls-ca |
40 | private-opt Gitter | ||
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
diff --git a/etc/profile-a-l/gjs.profile b/etc/profile-a-l/gjs.profile index bd332a6d5..cad261365 100644 --- a/etc/profile-a-l/gjs.profile +++ b/etc/profile-a-l/gjs.profile | |||
@@ -38,9 +38,9 @@ protocol unix,inet,inet6 | |||
38 | seccomp | 38 | seccomp |
39 | tracelog | 39 | tracelog |
40 | 40 | ||
41 | # private-bin gjs,gnome-books,gnome-documents,gnome-maps,gnome-photos,gnome-weather | 41 | #private-bin gjs,gnome-books,gnome-documents,gnome-maps,gnome-photos,gnome-weather |
42 | private-dev | 42 | private-dev |
43 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl | 43 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | restrict-namespaces | 46 | restrict-namespaces |
diff --git a/etc/profile-a-l/gmpc.profile b/etc/profile-a-l/gmpc.profile index f3e045000..4d4a0d50e 100644 --- a/etc/profile-a-l/gmpc.profile +++ b/etc/profile-a-l/gmpc.profile | |||
@@ -47,8 +47,9 @@ private-etc | |||
47 | private-tmp | 47 | private-tmp |
48 | writable-run-user | 48 | writable-run-user |
49 | 49 | ||
50 | # dbus-user none | 50 | dbus-user filter |
51 | # dbus-system none | 51 | dbus-user.talk org.mpris.MediaPlayer2.mpd |
52 | dbus-system none | ||
52 | 53 | ||
53 | # memory-deny-write-execute - breaks on Arch | 54 | #memory-deny-write-execute # breaks on Arch |
54 | restrict-namespaces | 55 | restrict-namespaces |
diff --git a/etc/profile-a-l/gnome-books.profile b/etc/profile-a-l/gnome-books.profile index 812923b2d..962b8b30f 100644 --- a/etc/profile-a-l/gnome-books.profile +++ b/etc/profile-a-l/gnome-books.profile | |||
@@ -39,7 +39,7 @@ protocol unix | |||
39 | seccomp | 39 | seccomp |
40 | tracelog | 40 | tracelog |
41 | 41 | ||
42 | # private-bin gjs,gnome-books | 42 | #private-bin gjs,gnome-books |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
diff --git a/etc/profile-a-l/gnome-calculator.profile b/etc/profile-a-l/gnome-calculator.profile index e5c6022e8..40f799693 100644 --- a/etc/profile-a-l/gnome-calculator.profile +++ b/etc/profile-a-l/gnome-calculator.profile | |||
@@ -24,7 +24,7 @@ apparmor | |||
24 | caps.drop all | 24 | caps.drop all |
25 | ipc-namespace | 25 | ipc-namespace |
26 | machine-id | 26 | machine-id |
27 | #net none -- breaks currency conversion | 27 | #net none # breaks currency conversion |
28 | netfilter | 28 | netfilter |
29 | no3d | 29 | no3d |
30 | nodvd | 30 | nodvd |
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile index ddfe57879..e6fe27774 100644 --- a/etc/profile-a-l/gnome-calendar.profile +++ b/etc/profile-a-l/gnome-calendar.profile | |||
@@ -15,7 +15,7 @@ include disable-shell.inc | |||
15 | include disable-xdg.inc | 15 | include disable-xdg.inc |
16 | 16 | ||
17 | whitelist /usr/share/libgweather | 17 | whitelist /usr/share/libgweather |
18 | include whitelist-common.inc | 18 | #include whitelist-common.inc # see #903 |
19 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
20 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/gnome-characters.profile b/etc/profile-a-l/gnome-characters.profile index 9e9730e53..9f592722c 100644 --- a/etc/profile-a-l/gnome-characters.profile +++ b/etc/profile-a-l/gnome-characters.profile | |||
@@ -52,8 +52,8 @@ private-etc @x11,gconf,mime.types | |||
52 | private-tmp | 52 | private-tmp |
53 | 53 | ||
54 | # Add the next lines to your gnome-characters.local if you don't need access to recently used chars. | 54 | # Add the next lines to your gnome-characters.local if you don't need access to recently used chars. |
55 | # dbus-user none | 55 | #dbus-user none |
56 | # dbus-system none | 56 | #dbus-system none |
57 | 57 | ||
58 | read-only ${HOME} | 58 | read-only ${HOME} |
59 | restrict-namespaces | 59 | restrict-namespaces |
diff --git a/etc/profile-a-l/gnome-contacts.profile b/etc/profile-a-l/gnome-contacts.profile index 2326115c3..25a906c69 100644 --- a/etc/profile-a-l/gnome-contacts.profile +++ b/etc/profile-a-l/gnome-contacts.profile | |||
@@ -21,7 +21,7 @@ include whitelist-var-common.inc | |||
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | netfilter | 23 | netfilter |
24 | #no3d - breaks on Arch | 24 | #no3d # breaks on Arch |
25 | nodvd | 25 | nodvd |
26 | noinput | 26 | noinput |
27 | nonewprivs | 27 | nonewprivs |
diff --git a/etc/profile-a-l/gnome-keyring.profile b/etc/profile-a-l/gnome-keyring.profile index 45b6fd880..aa0a7f4cc 100644 --- a/etc/profile-a-l/gnome-keyring.profile +++ b/etc/profile-a-l/gnome-keyring.profile | |||
@@ -55,7 +55,7 @@ private-dev | |||
55 | #private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security | 55 | #private-lib alternatives,gnome-keyring,libsecret-1.so.*,pkcs11,security |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | # dbus-user none | 58 | #dbus-user none |
59 | dbus-system none | 59 | dbus-system none |
60 | 60 | ||
61 | memory-deny-write-execute | 61 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/gnome-logs.profile b/etc/profile-a-l/gnome-logs.profile index 61f4f4107..4d2681fbc 100644 --- a/etc/profile-a-l/gnome-logs.profile +++ b/etc/profile-a-l/gnome-logs.profile | |||
@@ -6,49 +6,15 @@ include gnome-logs.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | include disable-common.inc | 9 | whitelist /usr/share/gnome-logs |
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-programs.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | 10 | ||
17 | whitelist /var/log/journal | ||
18 | include whitelist-runuser-common.inc | ||
19 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | ipc-namespace | ||
25 | net none | ||
26 | no3d | ||
27 | nodvd | ||
28 | noinput | ||
29 | nonewprivs | ||
30 | nosound | ||
31 | notv | ||
32 | nou2f | ||
33 | novideo | ||
34 | protocol unix | ||
35 | seccomp | ||
36 | tracelog | ||
37 | |||
38 | disable-mnt | ||
39 | private-bin gnome-logs | 11 | private-bin gnome-logs |
40 | private-cache | ||
41 | private-dev | ||
42 | private-etc | ||
43 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* | 12 | private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.* |
44 | private-tmp | ||
45 | writable-var-log | ||
46 | 13 | ||
47 | dbus-user filter | 14 | dbus-user filter |
48 | dbus-user.own org.gnome.Logs | 15 | dbus-user.own org.gnome.Logs |
49 | dbus-user.talk ca.desrt.dconf | 16 | dbus-user.talk ca.desrt.dconf |
50 | dbus-system none | 17 | ignore dbus-user none |
51 | 18 | ||
52 | # Add 'ignore read-only ${HOME}' to your gnome-logs.local if you export logs to a file under your ${HOME}. | 19 | # Redirect |
53 | read-only ${HOME} | 20 | include system-log-common.profile |
54 | restrict-namespaces | ||
diff --git a/etc/profile-a-l/gnome-maps.profile b/etc/profile-a-l/gnome-maps.profile index 17f52e588..40c264c86 100644 --- a/etc/profile-a-l/gnome-maps.profile +++ b/etc/profile-a-l/gnome-maps.profile | |||
@@ -61,7 +61,7 @@ tracelog | |||
61 | 61 | ||
62 | disable-mnt | 62 | disable-mnt |
63 | private-bin gjs,gnome-maps | 63 | private-bin gjs,gnome-maps |
64 | # private-cache -- gnome-maps cache all maps/satelite-images | 64 | #private-cache # gnome-maps cache all maps/satelite-images |
65 | private-dev | 65 | private-dev |
66 | private-etc @tls-ca,@x11,clutter-1.0,gconf,host.conf,mime.types,pkcs11,rpc,services | 66 | private-etc @tls-ca,@x11,clutter-1.0,gconf,host.conf,mime.types,pkcs11,rpc,services |
67 | private-tmp | 67 | private-tmp |
diff --git a/etc/profile-a-l/gnome-mplayer.profile b/etc/profile-a-l/gnome-mplayer.profile index 052e9ba9c..5315cbec6 100644 --- a/etc/profile-a-l/gnome-mplayer.profile +++ b/etc/profile-a-l/gnome-mplayer.profile | |||
@@ -26,7 +26,7 @@ nou2f | |||
26 | protocol unix,inet,inet6 | 26 | protocol unix,inet,inet6 |
27 | seccomp | 27 | seccomp |
28 | 28 | ||
29 | # private-bin gnome-mplayer,mplayer | 29 | #private-bin gnome-mplayer,mplayer |
30 | private-cache | 30 | private-cache |
31 | private-dev | 31 | private-dev |
32 | private-tmp | 32 | private-tmp |
diff --git a/etc/profile-a-l/gnome-nettool.profile b/etc/profile-a-l/gnome-nettool.profile index 7a9a0e336..7a8338cd7 100644 --- a/etc/profile-a-l/gnome-nettool.profile +++ b/etc/profile-a-l/gnome-nettool.profile | |||
@@ -14,7 +14,7 @@ include disable-programs.inc | |||
14 | include disable-xdg.inc | 14 | include disable-xdg.inc |
15 | 15 | ||
16 | whitelist /usr/share/gnome-nettool | 16 | whitelist /usr/share/gnome-nettool |
17 | #include whitelist-common.inc -- see #903 | 17 | #include whitelist-common.inc # see #903 |
18 | include whitelist-runuser-common.inc | 18 | include whitelist-runuser-common.inc |
19 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/gnome-photos.profile b/etc/profile-a-l/gnome-photos.profile index 1d0291aa2..4d2a3913f 100644 --- a/etc/profile-a-l/gnome-photos.profile +++ b/etc/profile-a-l/gnome-photos.profile | |||
@@ -36,7 +36,7 @@ seccomp | |||
36 | seccomp.block-secondary | 36 | seccomp.block-secondary |
37 | tracelog | 37 | tracelog |
38 | 38 | ||
39 | # private-bin gjs,gnome-photos | 39 | #private-bin gjs,gnome-photos |
40 | private-dev | 40 | private-dev |
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
diff --git a/etc/profile-a-l/gnome-pie.profile b/etc/profile-a-l/gnome-pie.profile index ac0fb555d..dff6032d1 100644 --- a/etc/profile-a-l/gnome-pie.profile +++ b/etc/profile-a-l/gnome-pie.profile | |||
@@ -16,7 +16,7 @@ include disable-exec.inc | |||
16 | 16 | ||
17 | caps.drop all | 17 | caps.drop all |
18 | ipc-namespace | 18 | ipc-namespace |
19 | # net none - breaks dbus | 19 | #net none # breaks dbus |
20 | no3d | 20 | no3d |
21 | nodvd | 21 | nodvd |
22 | nogroups | 22 | nogroups |
diff --git a/etc/profile-a-l/gnome-ring.profile b/etc/profile-a-l/gnome-ring.profile index 8f2ab7fd6..898cdf1f8 100644 --- a/etc/profile-a-l/gnome-ring.profile +++ b/etc/profile-a-l/gnome-ring.profile | |||
@@ -27,7 +27,7 @@ protocol unix,inet,inet6,netlink | |||
27 | seccomp | 27 | seccomp |
28 | 28 | ||
29 | disable-mnt | 29 | disable-mnt |
30 | # private-dev | 30 | #private-dev |
31 | private-tmp | 31 | private-tmp |
32 | 32 | ||
33 | restrict-namespaces | 33 | restrict-namespaces |
diff --git a/etc/profile-a-l/gnome-schedule.profile b/etc/profile-a-l/gnome-schedule.profile index b71d77621..33f22136e 100644 --- a/etc/profile-a-l/gnome-schedule.profile +++ b/etc/profile-a-l/gnome-schedule.profile | |||
@@ -46,7 +46,7 @@ apparmor | |||
46 | caps.keep chown,dac_override,setgid,setuid | 46 | caps.keep chown,dac_override,setgid,setuid |
47 | ipc-namespace | 47 | ipc-namespace |
48 | machine-id | 48 | machine-id |
49 | #net none - breaks on Ubuntu | 49 | #net none # breaks on Ubuntu |
50 | no3d | 50 | no3d |
51 | nodvd | 51 | nodvd |
52 | nogroups | 52 | nogroups |
diff --git a/etc/profile-a-l/gnome-system-log.profile b/etc/profile-a-l/gnome-system-log.profile index f4e985342..0d6116f4f 100644 --- a/etc/profile-a-l/gnome-system-log.profile +++ b/etc/profile-a-l/gnome-system-log.profile | |||
@@ -6,51 +6,13 @@ include gnome-system-log.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | include disable-common.inc | 9 | # 'net none' breaks dbus |
10 | include disable-devel.inc | 10 | ignore net none |
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-programs.inc | ||
14 | include disable-shell.inc | ||
15 | include disable-xdg.inc | ||
16 | 11 | ||
17 | whitelist /var/log | ||
18 | include whitelist-common.inc | ||
19 | include whitelist-usr-share-common.inc | ||
20 | include whitelist-var-common.inc | ||
21 | |||
22 | apparmor | ||
23 | caps.drop all | ||
24 | ipc-namespace | ||
25 | # net none - breaks dbus | ||
26 | no3d | ||
27 | nodvd | ||
28 | # When using 'volatile' storage (https://www.freedesktop.org/software/systemd/man/journald.conf.html), | ||
29 | # put 'ignore nogroups' and 'ignore noroot' in your gnome-system-log.local. | ||
30 | nogroups | ||
31 | noinput | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | |||
41 | disable-mnt | ||
42 | private-bin gnome-system-log | 12 | private-bin gnome-system-log |
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc | ||
46 | private-lib | 13 | private-lib |
47 | private-tmp | ||
48 | writable-var-log | ||
49 | |||
50 | # dbus-user none | ||
51 | # dbus-system none | ||
52 | 14 | ||
53 | memory-deny-write-execute | 15 | memory-deny-write-execute |
54 | # Add 'ignore read-only ${HOME}' to your gnome-system-log.local if you export logs to a file under your ${HOME}. | 16 | |
55 | read-only ${HOME} | 17 | # Redirect |
56 | restrict-namespaces | 18 | include system-log-common.profile |
diff --git a/etc/profile-a-l/gnome-weather.profile b/etc/profile-a-l/gnome-weather.profile index 147b84a19..8637f5019 100644 --- a/etc/profile-a-l/gnome-weather.profile +++ b/etc/profile-a-l/gnome-weather.profile | |||
@@ -41,9 +41,9 @@ seccomp.block-secondary | |||
41 | tracelog | 41 | tracelog |
42 | 42 | ||
43 | disable-mnt | 43 | disable-mnt |
44 | # private-bin gjs,gnome-weather | 44 | #private-bin gjs,gnome-weather |
45 | private-dev | 45 | private-dev |
46 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl | 46 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | restrict-namespaces | 49 | restrict-namespaces |
diff --git a/etc/profile-a-l/gnubik.profile b/etc/profile-a-l/gnubik.profile index 025cb74b6..0c4ca35ac 100644 --- a/etc/profile-a-l/gnubik.profile +++ b/etc/profile-a-l/gnubik.profile | |||
@@ -15,7 +15,7 @@ include disable-shell.inc | |||
15 | include disable-xdg.inc | 15 | include disable-xdg.inc |
16 | 16 | ||
17 | whitelist /usr/share/gnubik | 17 | whitelist /usr/share/gnubik |
18 | include whitelist-common.inc | 18 | #include whitelist-common.inc # see #903 |
19 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
20 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
diff --git a/etc/profile-a-l/godot.profile b/etc/profile-a-l/godot.profile index 5e41384ab..96bbffc41 100644 --- a/etc/profile-a-l/godot.profile +++ b/etc/profile-a-l/godot.profile | |||
@@ -34,7 +34,7 @@ seccomp | |||
34 | tracelog | 34 | tracelog |
35 | 35 | ||
36 | 36 | ||
37 | # private-bin godot | 37 | #private-bin godot |
38 | private-cache | 38 | private-cache |
39 | private-dev | 39 | private-dev |
40 | private-etc @games,@tls-ca,@x11,mono | 40 | private-etc @games,@tls-ca,@x11,mono |
diff --git a/etc/profile-a-l/goobox.profile b/etc/profile-a-l/goobox.profile index 8807a239d..96b72230d 100644 --- a/etc/profile-a-l/goobox.profile +++ b/etc/profile-a-l/goobox.profile | |||
@@ -28,9 +28,9 @@ protocol unix,inet,inet6 | |||
28 | seccomp | 28 | seccomp |
29 | tracelog | 29 | tracelog |
30 | 30 | ||
31 | # private-bin goobox | 31 | #private-bin goobox |
32 | private-dev | 32 | private-dev |
33 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl | 33 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl |
34 | # private-tmp | 34 | #private-tmp |
35 | 35 | ||
36 | restrict-namespaces | 36 | restrict-namespaces |
diff --git a/etc/profile-a-l/google-earth.profile b/etc/profile-a-l/google-earth.profile index 4af6ce36b..1087b3d6e 100644 --- a/etc/profile-a-l/google-earth.profile +++ b/etc/profile-a-l/google-earth.profile | |||
@@ -18,6 +18,7 @@ mkdir ${HOME}/.config/Google | |||
18 | mkdir ${HOME}/.googleearth | 18 | mkdir ${HOME}/.googleearth |
19 | whitelist ${HOME}/.config/Google | 19 | whitelist ${HOME}/.config/Google |
20 | whitelist ${HOME}/.googleearth | 20 | whitelist ${HOME}/.googleearth |
21 | whitelist /opt/google | ||
21 | include whitelist-common.inc | 22 | include whitelist-common.inc |
22 | 23 | ||
23 | caps.drop all | 24 | caps.drop all |
@@ -37,6 +38,5 @@ seccomp | |||
37 | disable-mnt | 38 | disable-mnt |
38 | private-bin bash,dirname,google-earth,grep,ls,sed,sh | 39 | private-bin bash,dirname,google-earth,grep,ls,sed,sh |
39 | private-dev | 40 | private-dev |
40 | private-opt google | ||
41 | 41 | ||
42 | restrict-namespaces | 42 | restrict-namespaces |
diff --git a/etc/profile-a-l/google-play-music-desktop-player.profile b/etc/profile-a-l/google-play-music-desktop-player.profile index c2a7d89fd..1218631d8 100644 --- a/etc/profile-a-l/google-play-music-desktop-player.profile +++ b/etc/profile-a-l/google-play-music-desktop-player.profile | |||
@@ -17,8 +17,8 @@ include disable-interpreters.inc | |||
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | 18 | ||
19 | mkdir ${HOME}/.config/Google Play Music Desktop Player | 19 | mkdir ${HOME}/.config/Google Play Music Desktop Player |
20 | # whitelist ${HOME}/.config/pulse | 20 | #whitelist ${HOME}/.config/pulse |
21 | # whitelist ${HOME}/.pulse | 21 | #whitelist ${HOME}/.pulse |
22 | whitelist ${HOME}/.config/Google Play Music Desktop Player | 22 | whitelist ${HOME}/.config/Google Play Music Desktop Player |
23 | include whitelist-common.inc | 23 | include whitelist-common.inc |
24 | 24 | ||
diff --git a/etc/profile-a-l/gpa.profile b/etc/profile-a-l/gpa.profile index e05cdf424..25498d89e 100644 --- a/etc/profile-a-l/gpa.profile +++ b/etc/profile-a-l/gpa.profile | |||
@@ -28,7 +28,7 @@ protocol unix,inet,inet6 | |||
28 | seccomp | 28 | seccomp |
29 | tracelog | 29 | tracelog |
30 | 30 | ||
31 | # private-bin gpa,gpg | 31 | #private-bin gpa,gpg |
32 | private-dev | 32 | private-dev |
33 | 33 | ||
34 | restrict-namespaces | 34 | restrict-namespaces |
diff --git a/etc/profile-a-l/gpg-agent.profile b/etc/profile-a-l/gpg-agent.profile index f4cd85e3a..3b623a338 100644 --- a/etc/profile-a-l/gpg-agent.profile +++ b/etc/profile-a-l/gpg-agent.profile | |||
@@ -46,7 +46,7 @@ protocol unix,inet,inet6 | |||
46 | seccomp | 46 | seccomp |
47 | tracelog | 47 | tracelog |
48 | 48 | ||
49 | # private-bin gpg-agent | 49 | #private-bin gpg-agent |
50 | private-cache | 50 | private-cache |
51 | private-dev | 51 | private-dev |
52 | 52 | ||
diff --git a/etc/profile-a-l/gpg.profile b/etc/profile-a-l/gpg.profile index 60690852a..bf4a1c60b 100644 --- a/etc/profile-a-l/gpg.profile +++ b/etc/profile-a-l/gpg.profile | |||
@@ -42,7 +42,7 @@ protocol unix,inet,inet6 | |||
42 | seccomp | 42 | seccomp |
43 | tracelog | 43 | tracelog |
44 | 44 | ||
45 | # private-bin gpg | 45 | #private-bin gpg |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
48 | 48 | ||
diff --git a/etc/profile-a-l/gpg2.profile b/etc/profile-a-l/gpg2.profile index b831b0f62..a9d928f17 100644 --- a/etc/profile-a-l/gpg2.profile +++ b/etc/profile-a-l/gpg2.profile | |||
@@ -7,7 +7,7 @@ include gpg2.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # private-bin gpg2 | 10 | #private-bin gpg2 |
11 | 11 | ||
12 | # Redirect | 12 | # Redirect |
13 | include gpg.profile | 13 | include gpg.profile |
diff --git a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile index 19af7c0b9..5ccce8447 100644 --- a/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile +++ b/etc/profile-a-l/gravity-beams-and-evaporating-stars.profile | |||
@@ -15,7 +15,7 @@ include disable-shell.inc | |||
15 | include disable-xdg.inc | 15 | include disable-xdg.inc |
16 | 16 | ||
17 | whitelist /usr/share/gravity-beams-and-evaporating-stars | 17 | whitelist /usr/share/gravity-beams-and-evaporating-stars |
18 | include whitelist-common.inc | 18 | #include whitelist-common.inc # see #903 |
19 | include whitelist-usr-share-common.inc | 19 | include whitelist-usr-share-common.inc |
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
diff --git a/etc/profile-a-l/gucharmap.profile b/etc/profile-a-l/gucharmap.profile index ef4aad4da..93db304da 100644 --- a/etc/profile-a-l/gucharmap.profile +++ b/etc/profile-a-l/gucharmap.profile | |||
@@ -22,7 +22,7 @@ include whitelist-var-common.inc | |||
22 | apparmor | 22 | apparmor |
23 | caps.drop all | 23 | caps.drop all |
24 | machine-id | 24 | machine-id |
25 | #net none - breaks dbus | 25 | #net none # breaks dbus |
26 | no3d | 26 | no3d |
27 | nodvd | 27 | nodvd |
28 | nogroups | 28 | nogroups |
@@ -47,8 +47,8 @@ private-lib | |||
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | # breaks state saving | 49 | # breaks state saving |
50 | # dbus-user none | 50 | #dbus-user none |
51 | # dbus-system none | 51 | #dbus-system none |
52 | 52 | ||
53 | read-only ${HOME} | 53 | read-only ${HOME} |
54 | restrict-namespaces | 54 | restrict-namespaces |
diff --git a/etc/profile-a-l/gwenview.profile b/etc/profile-a-l/gwenview.profile index 4be71f6d3..bc4084a38 100644 --- a/etc/profile-a-l/gwenview.profile +++ b/etc/profile-a-l/gwenview.profile | |||
@@ -14,6 +14,7 @@ noblacklist ${HOME}/.kde/share/apps/gwenview | |||
14 | noblacklist ${HOME}/.kde/share/config/gwenviewrc | 14 | noblacklist ${HOME}/.kde/share/config/gwenviewrc |
15 | noblacklist ${HOME}/.kde4/share/apps/gwenview | 15 | noblacklist ${HOME}/.kde4/share/apps/gwenview |
16 | noblacklist ${HOME}/.kde4/share/config/gwenviewrc | 16 | noblacklist ${HOME}/.kde4/share/config/gwenviewrc |
17 | noblacklist ${HOME}/.local/share/Trash | ||
17 | noblacklist ${HOME}/.local/share/gwenview | 18 | noblacklist ${HOME}/.local/share/gwenview |
18 | noblacklist ${HOME}/.local/share/kxmlgui5/gwenview | 19 | noblacklist ${HOME}/.local/share/kxmlgui5/gwenview |
19 | noblacklist ${HOME}/.local/share/org.kde.gwenview | 20 | noblacklist ${HOME}/.local/share/org.kde.gwenview |
@@ -30,7 +31,7 @@ include whitelist-var-common.inc | |||
30 | 31 | ||
31 | apparmor | 32 | apparmor |
32 | caps.drop all | 33 | caps.drop all |
33 | # net none | 34 | #net none |
34 | netfilter | 35 | netfilter |
35 | nodvd | 36 | nodvd |
36 | nogroups | 37 | nogroups |
@@ -42,14 +43,14 @@ nou2f | |||
42 | novideo | 43 | novideo |
43 | protocol unix | 44 | protocol unix |
44 | seccomp | 45 | seccomp |
45 | # tracelog | 46 | #tracelog |
46 | 47 | ||
47 | private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 | 48 | private-bin gimp*,gwenview,kbuildsycoca4,kdeinit4 |
48 | private-dev | 49 | private-dev |
49 | private-etc @x11,gimp | 50 | private-etc @x11,gimp |
50 | 51 | ||
51 | # dbus-user none | 52 | #dbus-user none |
52 | # dbus-system none | 53 | #dbus-system none |
53 | 54 | ||
54 | # memory-deny-write-execute | 55 | #memory-deny-write-execute |
55 | restrict-namespaces | 56 | restrict-namespaces |
diff --git a/etc/profile-a-l/hexchat.profile b/etc/profile-a-l/hexchat.profile index df7f8f3a3..def7bf25f 100644 --- a/etc/profile-a-l/hexchat.profile +++ b/etc/profile-a-l/hexchat.profile | |||
@@ -32,7 +32,7 @@ include whitelist-common.inc | |||
32 | include whitelist-var-common.inc | 32 | include whitelist-var-common.inc |
33 | 33 | ||
34 | caps.drop all | 34 | caps.drop all |
35 | #machine-id -- breaks sound | 35 | #machine-id # breaks sound |
36 | netfilter | 36 | netfilter |
37 | no3d | 37 | no3d |
38 | nodvd | 38 | nodvd |
@@ -51,8 +51,8 @@ disable-mnt | |||
51 | # debug note: private-bin requires perl, python, etc on some systems | 51 | # debug note: private-bin requires perl, python, etc on some systems |
52 | private-bin hexchat,python*,sh | 52 | private-bin hexchat,python*,sh |
53 | private-dev | 53 | private-dev |
54 | #private-lib - python problems | 54 | #private-lib # python problems |
55 | private-tmp | 55 | private-tmp |
56 | 56 | ||
57 | # memory-deny-write-execute - breaks python | 57 | #memory-deny-write-execute # breaks python |
58 | restrict-namespaces | 58 | restrict-namespaces |
diff --git a/etc/profile-a-l/homebank.profile b/etc/profile-a-l/homebank.profile index ccbb66333..d36cf0f46 100644 --- a/etc/profile-a-l/homebank.profile +++ b/etc/profile-a-l/homebank.profile | |||
@@ -28,7 +28,7 @@ include whitelist-var-common.inc | |||
28 | apparmor | 28 | apparmor |
29 | caps.drop all | 29 | caps.drop all |
30 | machine-id | 30 | machine-id |
31 | # net none | 31 | #net none |
32 | netfilter | 32 | netfilter |
33 | nodvd | 33 | nodvd |
34 | no3d | 34 | no3d |
@@ -55,5 +55,5 @@ private-tmp | |||
55 | dbus-user none | 55 | dbus-user none |
56 | dbus-system none | 56 | dbus-system none |
57 | 57 | ||
58 | # memory-deny-write-execute | 58 | #memory-deny-write-execute |
59 | restrict-namespaces | 59 | restrict-namespaces |
diff --git a/etc/profile-a-l/hugin.profile b/etc/profile-a-l/hugin.profile index c4085cf9c..683e1b5f7 100644 --- a/etc/profile-a-l/hugin.profile +++ b/etc/profile-a-l/hugin.profile | |||
@@ -38,7 +38,7 @@ novideo | |||
38 | protocol unix | 38 | protocol unix |
39 | seccomp | 39 | seccomp |
40 | 40 | ||
41 | private-bin align_image_stack,autooptimiser,calibrate_lens_gui,celeste_standalone,checkpto,cpclean,cpfind,deghosting_mask,enblend,exiftool,fulla,geocpset,hugin,hugin_executor,hugin_hdrmerge,hugin_lensdb,hugin_stitch_project,icpfind,linefind,nona,pano_modify,pano_trafo,perl,PTBatcherGUI,pto_gen,pto_lensstack,pto_mask,pto_merge,pto_move,pto_template,pto_var,sh,tca_correct,uname,verdandi,vig_optimize | 41 | private-bin PTBatcherGUI,align_image_stack,autooptimiser,calibrate_lens_gui,celeste_standalone,checkpto,cpclean,cpfind,deghosting_mask,enblend,exiftool,fulla,geocpset,hugin,hugin_executor,hugin_hdrmerge,hugin_lensdb,hugin_stitch_project,icpfind,linefind,nona,pano_modify,pano_trafo,perl,pto_gen,pto_lensstack,pto_mask,pto_merge,pto_move,pto_template,pto_var,sh,tca_correct,uname,verdandi,vig_optimize |
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
diff --git a/etc/profile-a-l/iagno.profile b/etc/profile-a-l/iagno.profile index 82cba7887..47c341333 100644 --- a/etc/profile-a-l/iagno.profile +++ b/etc/profile-a-l/iagno.profile | |||
@@ -43,7 +43,7 @@ private-dev | |||
43 | private-etc @x11,gconf | 43 | private-etc @x11,gconf |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | # dbus-user none | 46 | #dbus-user none |
47 | # dbus-system none | 47 | #dbus-system none |
48 | 48 | ||
49 | restrict-namespaces | 49 | restrict-namespaces |
diff --git a/etc/profile-a-l/idea.sh.profile b/etc/profile-a-l/idea.sh.profile index 31f65962f..2b4c68a4d 100644 --- a/etc/profile-a-l/idea.sh.profile +++ b/etc/profile-a-l/idea.sh.profile | |||
@@ -36,7 +36,7 @@ seccomp | |||
36 | 36 | ||
37 | private-cache | 37 | private-cache |
38 | private-dev | 38 | private-dev |
39 | # private-tmp | 39 | #private-tmp |
40 | 40 | ||
41 | noexec /tmp | 41 | noexec /tmp |
42 | restrict-namespaces | 42 | restrict-namespaces |
diff --git a/etc/profile-a-l/img2txt.profile b/etc/profile-a-l/img2txt.profile index ee341423a..8091a4c9e 100644 --- a/etc/profile-a-l/img2txt.profile +++ b/etc/profile-a-l/img2txt.profile | |||
@@ -41,7 +41,7 @@ seccomp | |||
41 | tracelog | 41 | tracelog |
42 | x11 none | 42 | x11 none |
43 | 43 | ||
44 | # private-bin img2txt | 44 | #private-bin img2txt |
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
diff --git a/etc/profile-a-l/inkscape.profile b/etc/profile-a-l/inkscape.profile index c4fc16c87..ced7a285f 100644 --- a/etc/profile-a-l/inkscape.profile +++ b/etc/profile-a-l/inkscape.profile | |||
@@ -61,7 +61,7 @@ protocol unix | |||
61 | seccomp | 61 | seccomp |
62 | tracelog | 62 | tracelog |
63 | 63 | ||
64 | # private-bin inkscape,potrace,python* - problems on Debian stretch | 64 | #private-bin inkscape,potrace,python* # problems on Debian stretch |
65 | private-cache | 65 | private-cache |
66 | private-dev | 66 | private-dev |
67 | private-etc @x11,ImageMagick*,python* | 67 | private-etc @x11,ImageMagick*,python* |
diff --git a/etc/profile-a-l/ipcalc.profile b/etc/profile-a-l/ipcalc.profile index 7eabbca84..369519947 100644 --- a/etc/profile-a-l/ipcalc.profile +++ b/etc/profile-a-l/ipcalc.profile | |||
@@ -14,11 +14,11 @@ include disable-devel.inc | |||
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | # include disable-shell.inc | 17 | #include disable-shell.inc |
18 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | # include whitelist-common.inc | 21 | #include whitelist-common.inc # see #903 |
22 | include whitelist-runuser-common.inc | 22 | include whitelist-runuser-common.inc |
23 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
@@ -26,7 +26,7 @@ include whitelist-var-common.inc | |||
26 | apparmor | 26 | apparmor |
27 | caps.drop all | 27 | caps.drop all |
28 | ipc-namespace | 28 | ipc-namespace |
29 | # machine-id | 29 | #machine-id |
30 | net none | 30 | net none |
31 | netfilter | 31 | netfilter |
32 | no3d | 32 | no3d |
@@ -39,14 +39,14 @@ nosound | |||
39 | notv | 39 | notv |
40 | nou2f | 40 | nou2f |
41 | novideo | 41 | novideo |
42 | # protocol unix | 42 | #protocol unix |
43 | seccomp | 43 | seccomp |
44 | # tracelog | 44 | #tracelog |
45 | 45 | ||
46 | disable-mnt | 46 | disable-mnt |
47 | private | 47 | private |
48 | private-bin bash,ipcalc,ipcalc-ng,perl,sh | 48 | private-bin bash,ipcalc,ipcalc-ng,perl,sh |
49 | # private-cache | 49 | #private-cache |
50 | private-dev | 50 | private-dev |
51 | # empty etc directory | 51 | # empty etc directory |
52 | private-etc | 52 | private-etc |
@@ -57,6 +57,6 @@ private-tmp | |||
57 | dbus-user none | 57 | dbus-user none |
58 | dbus-system none | 58 | dbus-system none |
59 | 59 | ||
60 | # memory-deny-write-execute | 60 | #memory-deny-write-execute |
61 | # read-only ${HOME} | 61 | #read-only ${HOME} |
62 | restrict-namespaces | 62 | restrict-namespaces |
diff --git a/etc/profile-a-l/journal-viewer.profile b/etc/profile-a-l/journal-viewer.profile new file mode 100644 index 000000000..eb007b765 --- /dev/null +++ b/etc/profile-a-l/journal-viewer.profile | |||
@@ -0,0 +1,24 @@ | |||
1 | # Firejail profile for journal-viewer | ||
2 | # Description: Visualize systemd logs | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include journal-viewer.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/journal-viewer | ||
10 | noblacklist ${HOME}/.local/share/com.vmingueza.journal-viewer | ||
11 | |||
12 | mkdir ${HOME}/.cache/journal-viewer | ||
13 | mkdir ${HOME}/.local/share/com.vmingueza.journal-viewer | ||
14 | whitelist ${HOME}/.cache/journal-viewer | ||
15 | whitelist ${HOME}/.local/share/com.vmingueza.journal-viewer | ||
16 | |||
17 | private-bin journal-viewer | ||
18 | private-lib webkit2gtk-* | ||
19 | |||
20 | read-write ${HOME}/.cache/journal-viewer | ||
21 | read-write ${HOME}/.local/share/com.vmingueza.journal-viewer | ||
22 | |||
23 | # Redirect | ||
24 | include system-log-common.profile | ||
diff --git a/etc/profile-a-l/k3b.profile b/etc/profile-a-l/k3b.profile index 81d4f3458..9fb609151 100644 --- a/etc/profile-a-l/k3b.profile +++ b/etc/profile-a-l/k3b.profile | |||
@@ -21,19 +21,19 @@ include disable-xdg.inc | |||
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
22 | 22 | ||
23 | caps.keep chown,dac_override,ipc_lock,net_bind_service,sys_admin,sys_nice,sys_rawio,sys_resource | 23 | caps.keep chown,dac_override,ipc_lock,net_bind_service,sys_admin,sys_nice,sys_rawio,sys_resource |
24 | # net none | 24 | #net none |
25 | netfilter | 25 | netfilter |
26 | no3d | 26 | no3d |
27 | # nonewprivs - breaks privileged helpers | 27 | #nonewprivs # breaks privileged helpers |
28 | noinput | 28 | noinput |
29 | # noroot - breaks privileged helpers | 29 | #noroot # breaks privileged helpers |
30 | nosound | 30 | nosound |
31 | notv | 31 | notv |
32 | novideo | 32 | novideo |
33 | # protocol unix - breaks privileged helpers | 33 | #protocol unix # breaks privileged helpers |
34 | # seccomp - breaks privileged helpers | 34 | #seccomp # breaks privileged helpers |
35 | 35 | ||
36 | private-dev | 36 | private-dev |
37 | # private-tmp | 37 | #private-tmp |
38 | 38 | ||
39 | # restrict-namespaces - breaks privileged helpers | 39 | #restrict-namespaces # breaks privileged helpers |
diff --git a/etc/profile-a-l/kaffeine.profile b/etc/profile-a-l/kaffeine.profile index 73417bf11..b84d144bd 100644 --- a/etc/profile-a-l/kaffeine.profile +++ b/etc/profile-a-l/kaffeine.profile | |||
@@ -36,7 +36,7 @@ novideo | |||
36 | protocol unix,inet,inet6 | 36 | protocol unix,inet,inet6 |
37 | seccomp | 37 | seccomp |
38 | 38 | ||
39 | # private-bin kaffeine | 39 | #private-bin kaffeine |
40 | private-dev | 40 | private-dev |
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
diff --git a/etc/profile-a-l/kalgebra.profile b/etc/profile-a-l/kalgebra.profile index a4e67cf6b..359c02b38 100644 --- a/etc/profile-a-l/kalgebra.profile +++ b/etc/profile-a-l/kalgebra.profile | |||
@@ -35,7 +35,7 @@ nou2f | |||
35 | novideo | 35 | novideo |
36 | protocol unix,netlink | 36 | protocol unix,netlink |
37 | seccomp !chroot | 37 | seccomp !chroot |
38 | # tracelog | 38 | #tracelog |
39 | 39 | ||
40 | disable-mnt | 40 | disable-mnt |
41 | private-bin kalgebra,kalgebramobile | 41 | private-bin kalgebra,kalgebramobile |
@@ -47,4 +47,4 @@ private-tmp | |||
47 | dbus-user none | 47 | dbus-user none |
48 | dbus-system none | 48 | dbus-system none |
49 | 49 | ||
50 | # restrict-namespaces | 50 | #restrict-namespaces |
diff --git a/etc/profile-a-l/kate.profile b/etc/profile-a-l/kate.profile index 152f73d5d..f141a25e1 100644 --- a/etc/profile-a-l/kate.profile +++ b/etc/profile-a-l/kate.profile | |||
@@ -28,17 +28,17 @@ noblacklist ${HOME}/.local/share/kxmlgui5/katesearch | |||
28 | include allow-common-devel.inc | 28 | include allow-common-devel.inc |
29 | 29 | ||
30 | include disable-common.inc | 30 | include disable-common.inc |
31 | # include disable-devel.inc | 31 | #include disable-devel.inc |
32 | include disable-exec.inc | 32 | include disable-exec.inc |
33 | # include disable-interpreters.inc | 33 | #include disable-interpreters.inc |
34 | include disable-programs.inc | 34 | include disable-programs.inc |
35 | 35 | ||
36 | include whitelist-run-common.inc | 36 | include whitelist-run-common.inc |
37 | include whitelist-var-common.inc | 37 | include whitelist-var-common.inc |
38 | 38 | ||
39 | # apparmor | 39 | #apparmor |
40 | caps.drop all | 40 | caps.drop all |
41 | # net none | 41 | #net none |
42 | netfilter | 42 | netfilter |
43 | nodvd | 43 | nodvd |
44 | nogroups | 44 | nogroups |
@@ -52,13 +52,13 @@ novideo | |||
52 | protocol unix | 52 | protocol unix |
53 | seccomp | 53 | seccomp |
54 | 54 | ||
55 | # private-bin kate,kbuildsycoca4,kdeinit4 | 55 | #private-bin kate,kbuildsycoca4,kdeinit4 |
56 | private-dev | 56 | private-dev |
57 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg | 57 | #private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,xdg |
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | # dbus-user none | 60 | #dbus-user none |
61 | # dbus-system none | 61 | #dbus-system none |
62 | 62 | ||
63 | restrict-namespaces | 63 | restrict-namespaces |
64 | join-or-start kate | 64 | join-or-start kate |
diff --git a/etc/profile-a-l/kazam.profile b/etc/profile-a-l/kazam.profile index 70414eeea..5a19d2f50 100644 --- a/etc/profile-a-l/kazam.profile +++ b/etc/profile-a-l/kazam.profile | |||
@@ -45,7 +45,7 @@ seccomp | |||
45 | tracelog | 45 | tracelog |
46 | 46 | ||
47 | disable-mnt | 47 | disable-mnt |
48 | # private-bin kazam,python* | 48 | #private-bin kazam,python* |
49 | private-cache | 49 | private-cache |
50 | private-dev | 50 | private-dev |
51 | private-etc @x11 | 51 | private-etc @x11 |
diff --git a/etc/profile-a-l/kcalc.profile b/etc/profile-a-l/kcalc.profile index cfb756c43..9f10039df 100644 --- a/etc/profile-a-l/kcalc.profile +++ b/etc/profile-a-l/kcalc.profile | |||
@@ -60,7 +60,7 @@ private-bin kcalc | |||
60 | private-cache | 60 | private-cache |
61 | private-dev | 61 | private-dev |
62 | private-etc | 62 | private-etc |
63 | # private-lib - problems on Arch | 63 | #private-lib # problems on Arch |
64 | private-tmp | 64 | private-tmp |
65 | 65 | ||
66 | dbus-user none | 66 | dbus-user none |
diff --git a/etc/profile-a-l/kdeinit4.profile b/etc/profile-a-l/kdeinit4.profile index 2f426e191..dce189c59 100644 --- a/etc/profile-a-l/kdeinit4.profile +++ b/etc/profile-a-l/kdeinit4.profile | |||
@@ -22,7 +22,7 @@ no3d | |||
22 | nogroups | 22 | nogroups |
23 | noinput | 23 | noinput |
24 | nonewprivs | 24 | nonewprivs |
25 | # nosound - disabled for knotify | 25 | #nosound # disabled for knotify |
26 | noroot | 26 | noroot |
27 | nou2f | 27 | nou2f |
28 | novideo | 28 | novideo |
diff --git a/etc/profile-a-l/kdenlive.profile b/etc/profile-a-l/kdenlive.profile index d4933d816..717bfa8d6 100644 --- a/etc/profile-a-l/kdenlive.profile +++ b/etc/profile-a-l/kdenlive.profile | |||
@@ -21,7 +21,7 @@ include disable-programs.inc | |||
21 | 21 | ||
22 | apparmor | 22 | apparmor |
23 | caps.drop all | 23 | caps.drop all |
24 | # net none | 24 | #net none |
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | noinput | 27 | noinput |
@@ -34,9 +34,9 @@ seccomp | |||
34 | 34 | ||
35 | private-bin dbus-launch,dvdauthor,ffmpeg,ffplay,ffprobe,genisoimage,kdeinit4,kdeinit4_shutdown,kdeinit4_wrapper,kdeinit5,kdeinit5_shutdown,kdeinit5_wrapper,kdenlive,kdenlive_render,kshell4,kshell5,melt,mlt-melt,vlc,xine | 35 | private-bin dbus-launch,dvdauthor,ffmpeg,ffplay,ffprobe,genisoimage,kdeinit4,kdeinit4_shutdown,kdeinit4_wrapper,kdeinit5,kdeinit5_shutdown,kdeinit5_wrapper,kdenlive,kdenlive_render,kshell4,kshell5,melt,mlt-melt,vlc,xine |
36 | private-dev | 36 | private-dev |
37 | # private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,X11,xdg | 37 | #private-etc alternatives,fonts,kde4rc,kde5rc,ld.so.cache,machine-id,passwd,pulse,X11,xdg |
38 | 38 | ||
39 | # dbus-user none | 39 | #dbus-user none |
40 | # dbus-system none | 40 | #dbus-system none |
41 | 41 | ||
42 | restrict-namespaces | 42 | restrict-namespaces |
diff --git a/etc/profile-a-l/kfind.profile b/etc/profile-a-l/kfind.profile index c70030a38..115f785eb 100644 --- a/etc/profile-a-l/kfind.profile +++ b/etc/profile-a-l/kfind.profile | |||
@@ -9,21 +9,21 @@ include globals.local | |||
9 | # searching in blacklisted or masked paths fails silently | 9 | # searching in blacklisted or masked paths fails silently |
10 | # adjust filesystem restrictions as necessary | 10 | # adjust filesystem restrictions as necessary |
11 | 11 | ||
12 | # noblacklist ${HOME}/.cache/kfind - disable-programs.inc is disabled, see below | 12 | #noblacklist ${HOME}/.cache/kfind # disable-programs.inc is disabled, see below |
13 | # noblacklist ${HOME}/.config/kfindrc | 13 | #noblacklist ${HOME}/.config/kfindrc |
14 | # noblacklist ${HOME}/.kde/share/config/kfindrc | 14 | #noblacklist ${HOME}/.kde/share/config/kfindrc |
15 | # noblacklist ${HOME}/.kde4/share/config/kfindrc | 15 | #noblacklist ${HOME}/.kde4/share/config/kfindrc |
16 | 16 | ||
17 | include disable-common.inc | 17 | include disable-common.inc |
18 | include disable-devel.inc | 18 | include disable-devel.inc |
19 | include disable-exec.inc | 19 | include disable-exec.inc |
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | # include disable-programs.inc | 21 | #include disable-programs.inc |
22 | 22 | ||
23 | apparmor | 23 | apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | machine-id | 25 | machine-id |
26 | # net none | 26 | #net none |
27 | netfilter | 27 | netfilter |
28 | no3d | 28 | no3d |
29 | nodvd | 29 | nodvd |
@@ -38,11 +38,11 @@ novideo | |||
38 | protocol unix | 38 | protocol unix |
39 | seccomp | 39 | seccomp |
40 | 40 | ||
41 | # private-bin kbuildsycoca4,kdeinit4,kfind | 41 | #private-bin kbuildsycoca4,kdeinit4,kfind |
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # dbus-user none | 45 | #dbus-user none |
46 | # dbus-system none | 46 | #dbus-system none |
47 | 47 | ||
48 | restrict-namespaces | 48 | restrict-namespaces |
diff --git a/etc/profile-a-l/kget.profile b/etc/profile-a-l/kget.profile index dd45c1889..892577117 100644 --- a/etc/profile-a-l/kget.profile +++ b/etc/profile-a-l/kget.profile | |||
@@ -40,5 +40,5 @@ seccomp | |||
40 | private-dev | 40 | private-dev |
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
43 | # memory-deny-write-execute | 43 | #memory-deny-write-execute |
44 | restrict-namespaces | 44 | restrict-namespaces |
diff --git a/etc/profile-a-l/kiwix-desktop.profile b/etc/profile-a-l/kiwix-desktop.profile index 2e369b945..9f41f41db 100644 --- a/etc/profile-a-l/kiwix-desktop.profile +++ b/etc/profile-a-l/kiwix-desktop.profile | |||
@@ -27,13 +27,13 @@ apparmor | |||
27 | caps.drop all | 27 | caps.drop all |
28 | ipc-namespace | 28 | ipc-namespace |
29 | netfilter | 29 | netfilter |
30 | # no3d | 30 | #no3d |
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
33 | noinput | 33 | noinput |
34 | nonewprivs | 34 | nonewprivs |
35 | noroot | 35 | noroot |
36 | # nosound | 36 | #nosound |
37 | notv | 37 | notv |
38 | nou2f | 38 | nou2f |
39 | novideo | 39 | novideo |
@@ -49,4 +49,4 @@ private-tmp | |||
49 | dbus-user none | 49 | dbus-user none |
50 | dbus-system none | 50 | dbus-system none |
51 | 51 | ||
52 | # restrict-namespaces | 52 | #restrict-namespaces |
diff --git a/etc/profile-a-l/kmail.profile b/etc/profile-a-l/kmail.profile index 9724f4963..20d2c01d6 100644 --- a/etc/profile-a-l/kmail.profile +++ b/etc/profile-a-l/kmail.profile | |||
@@ -41,7 +41,7 @@ include disable-programs.inc | |||
41 | include whitelist-run-common.inc | 41 | include whitelist-run-common.inc |
42 | include whitelist-var-common.inc | 42 | include whitelist-var-common.inc |
43 | 43 | ||
44 | # apparmor | 44 | #apparmor |
45 | caps.drop all | 45 | caps.drop all |
46 | netfilter | 46 | netfilter |
47 | nodvd | 47 | nodvd |
@@ -56,11 +56,11 @@ novideo | |||
56 | protocol unix,inet,inet6,netlink | 56 | protocol unix,inet,inet6,netlink |
57 | # we need to allow chroot, io_getevents, ioprio_set, io_setup, io_submit system calls | 57 | # we need to allow chroot, io_getevents, ioprio_set, io_setup, io_submit system calls |
58 | seccomp !chroot,!io_getevents,!io_setup,!io_submit,!ioprio_set | 58 | seccomp !chroot,!io_getevents,!io_setup,!io_submit,!ioprio_set |
59 | # tracelog | 59 | #tracelog |
60 | 60 | ||
61 | private-dev | 61 | private-dev |
62 | # private-tmp - interrupts connection to akonadi, breaks opening of email attachments | 62 | #private-tmp # interrupts connection to akonadi, breaks opening of email attachments |
63 | # writable-run-user is needed for signing and encrypting emails | 63 | # writable-run-user is needed for signing and encrypting emails |
64 | writable-run-user | 64 | writable-run-user |
65 | 65 | ||
66 | # restrict-namespaces | 66 | #restrict-namespaces |
diff --git a/etc/profile-a-l/kmplayer.profile b/etc/profile-a-l/kmplayer.profile index 992b312ee..7615f00c4 100644 --- a/etc/profile-a-l/kmplayer.profile +++ b/etc/profile-a-l/kmplayer.profile | |||
@@ -33,7 +33,7 @@ nou2f | |||
33 | protocol unix,inet,inet6,netlink | 33 | protocol unix,inet,inet6,netlink |
34 | seccomp | 34 | seccomp |
35 | 35 | ||
36 | # private-bin kmplayer,mplayer | 36 | #private-bin kmplayer,mplayer |
37 | private-cache | 37 | private-cache |
38 | private-dev | 38 | private-dev |
39 | private-tmp | 39 | private-tmp |
diff --git a/etc/profile-a-l/konversation.profile b/etc/profile-a-l/konversation.profile index e4781fea3..10a823c89 100644 --- a/etc/profile-a-l/konversation.profile +++ b/etc/profile-a-l/konversation.profile | |||
@@ -42,5 +42,5 @@ private-cache | |||
42 | private-dev | 42 | private-dev |
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | # memory-deny-write-execute | 45 | #memory-deny-write-execute |
46 | restrict-namespaces | 46 | restrict-namespaces |
diff --git a/etc/profile-a-l/krita.profile b/etc/profile-a-l/krita.profile index a04376430..f61bf36a8 100644 --- a/etc/profile-a-l/krita.profile +++ b/etc/profile-a-l/krita.profile | |||
@@ -28,7 +28,7 @@ include disable-xdg.inc | |||
28 | apparmor | 28 | apparmor |
29 | caps.drop all | 29 | caps.drop all |
30 | ipc-namespace | 30 | ipc-namespace |
31 | # net none | 31 | #net none |
32 | netfilter | 32 | netfilter |
33 | nodvd | 33 | nodvd |
34 | nogroups | 34 | nogroups |
@@ -46,7 +46,7 @@ private-cache | |||
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
49 | # dbus-user none | 49 | #dbus-user none |
50 | # dbus-system none | 50 | #dbus-system none |
51 | 51 | ||
52 | restrict-namespaces | 52 | restrict-namespaces |
diff --git a/etc/profile-a-l/krunner.profile b/etc/profile-a-l/krunner.profile index a0244ef47..8af3657d1 100644 --- a/etc/profile-a-l/krunner.profile +++ b/etc/profile-a-l/krunner.profile | |||
@@ -10,19 +10,19 @@ include globals.local | |||
10 | # When a file is opened in krunner, the file viewer runs in its own sandbox | 10 | # When a file is opened in krunner, the file viewer runs in its own sandbox |
11 | # with its own profile, if it is sandboxed automatically. | 11 | # with its own profile, if it is sandboxed automatically. |
12 | 12 | ||
13 | # noblacklist ${HOME}/.cache/krunner | 13 | #noblacklist ${HOME}/.cache/krunner |
14 | # noblacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite* | 14 | #noblacklist ${HOME}/.cache/krunnerbookmarkrunnerfirefoxdbfile.sqlite* |
15 | # noblacklist ${HOME}/.config/chromium | 15 | #noblacklist ${HOME}/.config/chromium |
16 | noblacklist ${HOME}/.config/krunnerrc | 16 | noblacklist ${HOME}/.config/krunnerrc |
17 | noblacklist ${HOME}/.kde/share/config/krunnerrc | 17 | noblacklist ${HOME}/.kde/share/config/krunnerrc |
18 | noblacklist ${HOME}/.kde4/share/config/krunnerrc | 18 | noblacklist ${HOME}/.kde4/share/config/krunnerrc |
19 | # noblacklist ${HOME}/.local/share/baloo | 19 | #noblacklist ${HOME}/.local/share/baloo |
20 | # noblacklist ${HOME}/.mozilla | 20 | #noblacklist ${HOME}/.mozilla |
21 | 21 | ||
22 | include disable-common.inc | 22 | include disable-common.inc |
23 | # include disable-devel.inc | 23 | #include disable-devel.inc |
24 | # include disable-interpreters.inc | 24 | #include disable-interpreters.inc |
25 | # include disable-programs.inc | 25 | #include disable-programs.inc |
26 | 26 | ||
27 | include whitelist-var-common.inc | 27 | include whitelist-var-common.inc |
28 | 28 | ||
@@ -34,6 +34,6 @@ noroot | |||
34 | protocol unix,inet,inet6 | 34 | protocol unix,inet,inet6 |
35 | seccomp | 35 | seccomp |
36 | 36 | ||
37 | # private-cache | 37 | #private-cache |
38 | 38 | ||
39 | restrict-namespaces | 39 | restrict-namespaces |
diff --git a/etc/profile-a-l/ktorrent.profile b/etc/profile-a-l/ktorrent.profile index da267b962..63bdc0b83 100644 --- a/etc/profile-a-l/ktorrent.profile +++ b/etc/profile-a-l/ktorrent.profile | |||
@@ -62,9 +62,9 @@ seccomp | |||
62 | 62 | ||
63 | private-bin kbuildsycoca4,kdeinit4,ktmagnetdownloader,ktorrent,ktupnptest | 63 | private-bin kbuildsycoca4,kdeinit4,ktmagnetdownloader,ktorrent,ktupnptest |
64 | private-dev | 64 | private-dev |
65 | # private-lib - problems on Arch | 65 | #private-lib # problems on Arch |
66 | private-tmp | 66 | private-tmp |
67 | 67 | ||
68 | deterministic-shutdown | 68 | deterministic-shutdown |
69 | # memory-deny-write-execute | 69 | #memory-deny-write-execute |
70 | restrict-namespaces | 70 | restrict-namespaces |
diff --git a/etc/profile-a-l/kube.profile b/etc/profile-a-l/kube.profile index 82336969d..1f8757edb 100644 --- a/etc/profile-a-l/kube.profile +++ b/etc/profile-a-l/kube.profile | |||
@@ -65,7 +65,7 @@ protocol unix,inet,inet6 | |||
65 | seccomp | 65 | seccomp |
66 | tracelog | 66 | tracelog |
67 | 67 | ||
68 | # disable-mnt | 68 | #disable-mnt |
69 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg | 69 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg |
70 | private-bin kube,sink_synchronizer | 70 | private-bin kube,sink_synchronizer |
71 | private-cache | 71 | private-cache |
diff --git a/etc/profile-a-l/kwin_x11.profile b/etc/profile-a-l/kwin_x11.profile index 589811643..da430377e 100644 --- a/etc/profile-a-l/kwin_x11.profile +++ b/etc/profile-a-l/kwin_x11.profile | |||
@@ -5,7 +5,7 @@ include kwin_x11.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # fix automatical kwin_x11 sandboxing: | 8 | # fix automatic kwin_x11 sandboxing: |
9 | # echo KDEWM=kwin_x11 >> ~/.pam_environment | 9 | # echo KDEWM=kwin_x11 >> ~/.pam_environment |
10 | 10 | ||
11 | noblacklist ${HOME}/.cache/kwin | 11 | noblacklist ${HOME}/.cache/kwin |
diff --git a/etc/profile-a-l/kwrite.profile b/etc/profile-a-l/kwrite.profile index 34fe2ace6..efc6b7c56 100644 --- a/etc/profile-a-l/kwrite.profile +++ b/etc/profile-a-l/kwrite.profile | |||
@@ -29,14 +29,14 @@ include whitelist-var-common.inc | |||
29 | 29 | ||
30 | apparmor | 30 | apparmor |
31 | caps.drop all | 31 | caps.drop all |
32 | # net none | 32 | #net none |
33 | netfilter | 33 | netfilter |
34 | nodvd | 34 | nodvd |
35 | nogroups | 35 | nogroups |
36 | noinput | 36 | noinput |
37 | nonewprivs | 37 | nonewprivs |
38 | noroot | 38 | noroot |
39 | # nosound - KWrite is using ALSA! | 39 | #nosound # KWrite is using ALSA! |
40 | notv | 40 | notv |
41 | nou2f | 41 | nou2f |
42 | novideo | 42 | novideo |
@@ -49,8 +49,8 @@ private-dev | |||
49 | private-etc @x11 | 49 | private-etc @x11 |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # dbus-user none | 52 | #dbus-user none |
53 | # dbus-system none | 53 | #dbus-system none |
54 | 54 | ||
55 | restrict-namespaces | 55 | restrict-namespaces |
56 | join-or-start kwrite | 56 | join-or-start kwrite |
diff --git a/etc/profile-a-l/less.profile b/etc/profile-a-l/less.profile index 6efe23ade..661c0594a 100644 --- a/etc/profile-a-l/less.profile +++ b/etc/profile-a-l/less.profile | |||
@@ -36,8 +36,8 @@ x11 none | |||
36 | 36 | ||
37 | # The user can have a custom coloring script configured in ${HOME}/.lessfilter. | 37 | # The user can have a custom coloring script configured in ${HOME}/.lessfilter. |
38 | # Enable private-bin and private-lib if you are not using any filter. | 38 | # Enable private-bin and private-lib if you are not using any filter. |
39 | # private-bin less | 39 | #private-bin less |
40 | # private-lib | 40 | #private-lib |
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | writable-var-log | 43 | writable-var-log |
diff --git a/etc/profile-a-l/lettura.profile b/etc/profile-a-l/lettura.profile new file mode 100644 index 000000000..94a455355 --- /dev/null +++ b/etc/profile-a-l/lettura.profile | |||
@@ -0,0 +1,76 @@ | |||
1 | # Firejail profile for lettura | ||
2 | # Description: Another free and open-source feed reader | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lettura.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/lettura | ||
10 | noblacklist ${HOME}/.config/com.lettura.dev | ||
11 | noblacklist ${HOME}/.lettura | ||
12 | noblacklist ${HOME}/.local/share/com.lettura.dev | ||
13 | |||
14 | include disable-common.inc | ||
15 | include disable-devel.inc | ||
16 | include disable-exec.inc | ||
17 | include disable-interpreters.inc | ||
18 | include disable-proc.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | mkdir ${HOME}/.cache/lettura | ||
24 | mkdir ${HOME}/.config/com.lettura.dev | ||
25 | mkdir ${HOME}/.lettura | ||
26 | mkdir ${HOME}/.local/share/com.lettura.dev | ||
27 | whitelist ${HOME}/.cache/lettura | ||
28 | whitelist ${HOME}/.config/com.lettura.dev | ||
29 | whitelist ${HOME}/.lettura | ||
30 | whitelist ${HOME}/.local/share/com.lettura.dev | ||
31 | whitelist ${DOWNLOADS} | ||
32 | include whitelist-common.inc | ||
33 | include whitelist-run-common.inc | ||
34 | include whitelist-runuser-common.inc | ||
35 | include whitelist-usr-share-common.inc | ||
36 | include whitelist-var-common.inc | ||
37 | |||
38 | # The lines below are needed to find the default Firefox profile name, to allow | ||
39 | # opening links in an existing instance of Firefox (note that it still fails if | ||
40 | # there isn't a Firefox instance running with the default profile; see #5352) | ||
41 | noblacklist ${HOME}/.mozilla | ||
42 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
43 | |||
44 | apparmor | ||
45 | caps.drop all | ||
46 | netfilter | ||
47 | nodvd | ||
48 | nogroups | ||
49 | noinput | ||
50 | nonewprivs | ||
51 | noprinters | ||
52 | noroot | ||
53 | #nosound | ||
54 | notv | ||
55 | nou2f | ||
56 | novideo | ||
57 | protocol unix,inet,inet6 | ||
58 | seccomp | ||
59 | seccomp.block-secondary | ||
60 | tracelog | ||
61 | |||
62 | disable-mnt | ||
63 | private-bin lettura | ||
64 | private-cache | ||
65 | private-dev | ||
66 | private-etc @network,@sound,@tls-ca,@x11,mime.types | ||
67 | private-tmp | ||
68 | |||
69 | dbus-user filter | ||
70 | dbus-user.talk org.freedesktop.Notifications | ||
71 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher | ||
72 | # allow D-Bus communication with firefox for opening links | ||
73 | dbus-user.talk org.mozilla.* | ||
74 | dbus-system none | ||
75 | |||
76 | restrict-namespaces | ||
diff --git a/etc/profile-a-l/liferea.profile b/etc/profile-a-l/liferea.profile index b0e9015ee..739d2cc1e 100644 --- a/etc/profile-a-l/liferea.profile +++ b/etc/profile-a-l/liferea.profile | |||
@@ -33,13 +33,13 @@ include whitelist-var-common.inc | |||
33 | 33 | ||
34 | caps.drop all | 34 | caps.drop all |
35 | netfilter | 35 | netfilter |
36 | # no3d | 36 | #no3d |
37 | nodvd | 37 | nodvd |
38 | nogroups | 38 | nogroups |
39 | noinput | 39 | noinput |
40 | nonewprivs | 40 | nonewprivs |
41 | noroot | 41 | noroot |
42 | # nosound | 42 | #nosound |
43 | notv | 43 | notv |
44 | nou2f | 44 | nou2f |
45 | novideo | 45 | novideo |
diff --git a/etc/profile-a-l/links-common.profile b/etc/profile-a-l/links-common.profile index 838d619b7..636560789 100644 --- a/etc/profile-a-l/links-common.profile +++ b/etc/profile-a-l/links-common.profile | |||
@@ -52,7 +52,7 @@ private-cache | |||
52 | private-dev | 52 | private-dev |
53 | private-etc @tls-ca | 53 | private-etc @tls-ca |
54 | # Add the next line to your links-common.local to allow external media players. | 54 | # Add the next line to your links-common.local to allow external media players. |
55 | # private-etc alsa,asound.conf,machine-id,openal,pulse | 55 | #private-etc alsa,asound.conf,machine-id,openal,pulse |
56 | private-tmp | 56 | private-tmp |
57 | 57 | ||
58 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-a-l/linuxqq.profile b/etc/profile-a-l/linuxqq.profile index 6ca8b8103..e900c0914 100644 --- a/etc/profile-a-l/linuxqq.profile +++ b/etc/profile-a-l/linuxqq.profile | |||
@@ -17,6 +17,7 @@ mkdir ${HOME}/.config/QQ | |||
17 | whitelist ${HOME}/.config/QQ | 17 | whitelist ${HOME}/.config/QQ |
18 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | 18 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
19 | whitelist ${DESKTOP} | 19 | whitelist ${DESKTOP} |
20 | whitelist /opt/QQ | ||
20 | 21 | ||
21 | ignore apparmor | 22 | ignore apparmor |
22 | noprinters | 23 | noprinters |
@@ -24,7 +25,6 @@ noprinters | |||
24 | # If you don't need/want to save anything to disk you can add `private` to your linuxqq.local. | 25 | # If you don't need/want to save anything to disk you can add `private` to your linuxqq.local. |
25 | #private | 26 | #private |
26 | private-etc @tls-ca,@x11,host.conf,os-release | 27 | private-etc @tls-ca,@x11,host.conf,os-release |
27 | private-opt QQ | ||
28 | 28 | ||
29 | dbus-user filter | 29 | dbus-user filter |
30 | dbus-user.talk org.freedesktop.Notifications | 30 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-a-l/lobster.profile b/etc/profile-a-l/lobster.profile index 4daa1d010..367f69743 100644 --- a/etc/profile-a-l/lobster.profile +++ b/etc/profile-a-l/lobster.profile | |||
@@ -17,6 +17,7 @@ noblacklist ${HOME}/.config/ueberzugpp | |||
17 | noblacklist ${HOME}/.local/share/applications/lobster | 17 | noblacklist ${HOME}/.local/share/applications/lobster |
18 | noblacklist ${HOME}/.local/share/lobster | 18 | noblacklist ${HOME}/.local/share/lobster |
19 | noblacklist ${PATH}/openssl | 19 | noblacklist ${PATH}/openssl |
20 | noblacklist ${PATH}/patch | ||
20 | 21 | ||
21 | # Allow /bin/sh (blacklisted by disable-shell.inc) | 22 | # Allow /bin/sh (blacklisted by disable-shell.inc) |
22 | include allow-bin-sh.inc | 23 | include allow-bin-sh.inc |
@@ -43,7 +44,7 @@ notv | |||
43 | disable-mnt | 44 | disable-mnt |
44 | private-bin base64,bash,cat,command,curl,cut,date,dirname,echo,ffmpeg,ffprobe,find,fzf,grep,head,hxunent,ln,lobster,ls,mkdir,mkfifo,nano,nohup,openssl,patch,pgrep,ps,rm,rofi,sed,sh,sleep,socat,tail,tee,tput,tr,ueberzugpp,uname,uuidgen,vim,wc | 45 | private-bin base64,bash,cat,command,curl,cut,date,dirname,echo,ffmpeg,ffprobe,find,fzf,grep,head,hxunent,ln,lobster,ls,mkdir,mkfifo,nano,nohup,openssl,patch,pgrep,ps,rm,rofi,sed,sh,sleep,socat,tail,tee,tput,tr,ueberzugpp,uname,uuidgen,vim,wc |
45 | #private-cache | 46 | #private-cache |
46 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | 47 | private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg |
47 | private-tmp | 48 | private-tmp |
48 | 49 | ||
49 | # Redirect | 50 | # Redirect |
diff --git a/etc/profile-a-l/lutris.profile b/etc/profile-a-l/lutris.profile index 2658c5373..226bc8dde 100644 --- a/etc/profile-a-l/lutris.profile +++ b/etc/profile-a-l/lutris.profile | |||
@@ -13,7 +13,7 @@ noblacklist ${HOME}/.cache/wine | |||
13 | noblacklist ${HOME}/.cache/winetricks | 13 | noblacklist ${HOME}/.cache/winetricks |
14 | noblacklist ${HOME}/.config/lutris | 14 | noblacklist ${HOME}/.config/lutris |
15 | noblacklist ${HOME}/.local/share/lutris | 15 | noblacklist ${HOME}/.local/share/lutris |
16 | # noblacklist ${HOME}/.wine | 16 | #noblacklist ${HOME}/.wine |
17 | noblacklist /tmp/.wine-* | 17 | noblacklist /tmp/.wine-* |
18 | # Don't block access to /sbin and /usr/sbin to allow using ldconfig. Otherwise | 18 | # Don't block access to /sbin and /usr/sbin to allow using ldconfig. Otherwise |
19 | # Lutris won't even start. | 19 | # Lutris won't even start. |
@@ -39,7 +39,7 @@ mkdir ${HOME}/.cache/wine | |||
39 | mkdir ${HOME}/.cache/winetricks | 39 | mkdir ${HOME}/.cache/winetricks |
40 | mkdir ${HOME}/.config/lutris | 40 | mkdir ${HOME}/.config/lutris |
41 | mkdir ${HOME}/.local/share/lutris | 41 | mkdir ${HOME}/.local/share/lutris |
42 | # mkdir ${HOME}/.wine | 42 | #mkdir ${HOME}/.wine |
43 | whitelist ${DOWNLOADS} | 43 | whitelist ${DOWNLOADS} |
44 | whitelist ${HOME}/Games | 44 | whitelist ${HOME}/Games |
45 | whitelist ${HOME}/.cache/lutris | 45 | whitelist ${HOME}/.cache/lutris |
@@ -47,7 +47,7 @@ whitelist ${HOME}/.cache/wine | |||
47 | whitelist ${HOME}/.cache/winetricks | 47 | whitelist ${HOME}/.cache/winetricks |
48 | whitelist ${HOME}/.config/lutris | 48 | whitelist ${HOME}/.config/lutris |
49 | whitelist ${HOME}/.local/share/lutris | 49 | whitelist ${HOME}/.local/share/lutris |
50 | # whitelist ${HOME}/.wine | 50 | #whitelist ${HOME}/.wine |
51 | whitelist /usr/share/lutris | 51 | whitelist /usr/share/lutris |
52 | whitelist /usr/share/wine | 52 | whitelist /usr/share/wine |
53 | include whitelist-common.inc | 53 | include whitelist-common.inc |
@@ -55,11 +55,11 @@ include whitelist-usr-share-common.inc | |||
55 | include whitelist-runuser-common.inc | 55 | include whitelist-runuser-common.inc |
56 | include whitelist-var-common.inc | 56 | include whitelist-var-common.inc |
57 | 57 | ||
58 | # allow-debuggers | 58 | #allow-debuggers |
59 | # apparmor | 59 | #apparmor |
60 | caps.drop all | 60 | caps.drop all |
61 | ipc-namespace | 61 | ipc-namespace |
62 | # net none | 62 | #net none |
63 | netfilter | 63 | netfilter |
64 | nodvd | 64 | nodvd |
65 | nogroups | 65 | nogroups |
@@ -69,7 +69,7 @@ notv | |||
69 | nou2f | 69 | nou2f |
70 | novideo | 70 | novideo |
71 | protocol unix,inet,inet6,netlink | 71 | protocol unix,inet,inet6,netlink |
72 | seccomp !modify_ldt | 72 | seccomp !clone3,!modify_ldt,!process_vm_readv,!ptrace |
73 | seccomp.32 !modify_ldt | 73 | seccomp.32 !modify_ldt |
74 | 74 | ||
75 | # Add the next line to your lutris.local if you do not need controller support. | 75 | # Add the next line to your lutris.local if you do not need controller support. |
diff --git a/etc/profile-a-l/lynx.profile b/etc/profile-a-l/lynx.profile index caf8de104..248061b3f 100644 --- a/etc/profile-a-l/lynx.profile +++ b/etc/profile-a-l/lynx.profile | |||
@@ -34,10 +34,10 @@ protocol unix,inet,inet6 | |||
34 | seccomp | 34 | seccomp |
35 | tracelog | 35 | tracelog |
36 | 36 | ||
37 | # private-bin lynx | 37 | #private-bin lynx |
38 | private-cache | 38 | private-cache |
39 | private-dev | 39 | private-dev |
40 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 40 | #private-etc alternatives,ca-certificates,crypto-policies,pki,ssl |
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
43 | restrict-namespaces | 43 | restrict-namespaces |
diff --git a/etc/profile-a-l/lyx.profile b/etc/profile-a-l/lyx.profile index c3366acef..d210333c3 100644 --- a/etc/profile-a-l/lyx.profile +++ b/etc/profile-a-l/lyx.profile | |||
@@ -31,7 +31,7 @@ include whitelist-usr-share-common.inc | |||
31 | apparmor | 31 | apparmor |
32 | machine-id | 32 | machine-id |
33 | 33 | ||
34 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex | 34 | #private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex |
35 | private-etc @x11,lyx,mime.types,texmf | 35 | private-etc @x11,lyx,mime.types,texmf |
36 | 36 | ||
37 | # Redirect | 37 | # Redirect |
diff --git a/etc/profile-m-z/PCSX2.profile b/etc/profile-m-z/PCSX2.profile index e75de80ac..a6a9ba6bc 100644 --- a/etc/profile-m-z/PCSX2.profile +++ b/etc/profile-m-z/PCSX2.profile | |||
@@ -40,8 +40,8 @@ notv | |||
40 | nou2f | 40 | nou2f |
41 | novideo | 41 | novideo |
42 | protocol unix,netlink | 42 | protocol unix,netlink |
43 | #seccomp - breaks loading with no logs | 43 | #seccomp # breaks loading with no logs |
44 | #tracelog - 32/64 bit incompatibility | 44 | #tracelog # 32/64 bit incompatibility |
45 | 45 | ||
46 | private-bin PCSX2 | 46 | private-bin PCSX2 |
47 | private-cache | 47 | private-cache |
diff --git a/etc/profile-m-z/QMediathekView.profile b/etc/profile-m-z/QMediathekView.profile index f8b5cec13..853b6ae52 100644 --- a/etc/profile-m-z/QMediathekView.profile +++ b/etc/profile-m-z/QMediathekView.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.config/QMediathekView | 9 | noblacklist ${HOME}/.config/QMediathekView |
10 | noblacklist ${HOME}/.local/share/QMediathekView | 10 | noblacklist ${HOME}/.local/share/QMediathekView |
11 | 11 | ||
12 | noblacklist ${HOME}/.cache/mpv | ||
12 | noblacklist ${HOME}/.config/mpv | 13 | noblacklist ${HOME}/.config/mpv |
13 | noblacklist ${HOME}/.config/smplayer | 14 | noblacklist ${HOME}/.config/smplayer |
14 | noblacklist ${HOME}/.config/totem | 15 | noblacklist ${HOME}/.config/totem |
@@ -16,6 +17,7 @@ noblacklist ${HOME}/.config/vlc | |||
16 | noblacklist ${HOME}/.config/xplayer | 17 | noblacklist ${HOME}/.config/xplayer |
17 | noblacklist ${HOME}/.local/share/totem | 18 | noblacklist ${HOME}/.local/share/totem |
18 | noblacklist ${HOME}/.local/share/xplayer | 19 | noblacklist ${HOME}/.local/share/xplayer |
20 | noblacklist ${HOME}/.local/state/mpv | ||
19 | noblacklist ${HOME}/.mplayer | 21 | noblacklist ${HOME}/.mplayer |
20 | noblacklist ${VIDEOS} | 22 | noblacklist ${VIDEOS} |
21 | 23 | ||
@@ -35,6 +37,7 @@ whitelist ${HOME}/.local/share/QMediathekView | |||
35 | whitelist ${DOWNLOADS} | 37 | whitelist ${DOWNLOADS} |
36 | whitelist ${VIDEOS} | 38 | whitelist ${VIDEOS} |
37 | 39 | ||
40 | whitelist ${HOME}/.cache/mpv | ||
38 | whitelist ${HOME}/.config/mpv | 41 | whitelist ${HOME}/.config/mpv |
39 | whitelist ${HOME}/.config/smplayer | 42 | whitelist ${HOME}/.config/smplayer |
40 | whitelist ${HOME}/.config/totem | 43 | whitelist ${HOME}/.config/totem |
@@ -42,6 +45,7 @@ whitelist ${HOME}/.config/vlc | |||
42 | whitelist ${HOME}/.config/xplayer | 45 | whitelist ${HOME}/.config/xplayer |
43 | whitelist ${HOME}/.local/share/totem | 46 | whitelist ${HOME}/.local/share/totem |
44 | whitelist ${HOME}/.local/share/xplayer | 47 | whitelist ${HOME}/.local/share/xplayer |
48 | whitelist ${HOME}/.local/state/mpv | ||
45 | whitelist ${HOME}/.mplayer | 49 | whitelist ${HOME}/.mplayer |
46 | whitelist /usr/share/qtchooser | 50 | whitelist /usr/share/qtchooser |
47 | include whitelist-common.inc | 51 | include whitelist-common.inc |
@@ -53,7 +57,7 @@ include whitelist-var-common.inc | |||
53 | apparmor | 57 | apparmor |
54 | caps.drop all | 58 | caps.drop all |
55 | netfilter | 59 | netfilter |
56 | # no3d | 60 | #no3d |
57 | nodvd | 61 | nodvd |
58 | nogroups | 62 | nogroups |
59 | noinput | 63 | noinput |
@@ -68,7 +72,7 @@ seccomp | |||
68 | tracelog | 72 | tracelog |
69 | 73 | ||
70 | disable-mnt | 74 | disable-mnt |
71 | private-bin mplayer,mpv,QMediathekView,smplayer,totem,vlc,xplayer | 75 | private-bin QMediathekView,mplayer,mpv,smplayer,totem,vlc,xplayer |
72 | private-cache | 76 | private-cache |
73 | private-dev | 77 | private-dev |
74 | private-etc @tls-ca | 78 | private-etc @tls-ca |
@@ -77,5 +81,5 @@ private-tmp | |||
77 | dbus-user none | 81 | dbus-user none |
78 | dbus-system none | 82 | dbus-system none |
79 | 83 | ||
80 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 84 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
81 | restrict-namespaces | 85 | restrict-namespaces |
diff --git a/etc/profile-m-z/QOwnNotes.profile b/etc/profile-m-z/QOwnNotes.profile index eed839041..e7dba9cd5 100644 --- a/etc/profile-m-z/QOwnNotes.profile +++ b/etc/profile-m-z/QOwnNotes.profile | |||
@@ -47,7 +47,7 @@ seccomp | |||
47 | tracelog | 47 | tracelog |
48 | 48 | ||
49 | disable-mnt | 49 | disable-mnt |
50 | private-bin gio,QOwnNotes | 50 | private-bin QOwnNotes,gio |
51 | private-dev | 51 | private-dev |
52 | private-etc @tls-ca,host.conf | 52 | private-etc @tls-ca,host.conf |
53 | private-tmp | 53 | private-tmp |
diff --git a/etc/profile-m-z/Viber.profile b/etc/profile-m-z/Viber.profile index 34d500bb1..ea7d8bfa7 100644 --- a/etc/profile-m-z/Viber.profile +++ b/etc/profile-m-z/Viber.profile | |||
@@ -31,8 +31,8 @@ protocol unix,inet,inet6 | |||
31 | seccomp !chroot | 31 | seccomp !chroot |
32 | 32 | ||
33 | disable-mnt | 33 | disable-mnt |
34 | private-bin awk,bash,dig,sh,Viber | 34 | private-bin Viber,awk,bash,dig,sh |
35 | private-etc @tls-ca,@x11,mailcap,proxychains.conf | 35 | private-etc @tls-ca,@x11,mailcap,proxychains.conf |
36 | private-tmp | 36 | private-tmp |
37 | 37 | ||
38 | # restrict-namespaces | 38 | #restrict-namespaces |
diff --git a/etc/profile-m-z/XMind.profile b/etc/profile-m-z/XMind.profile index 97b9d2898..5b8747825 100644 --- a/etc/profile-m-z/XMind.profile +++ b/etc/profile-m-z/XMind.profile | |||
@@ -31,7 +31,7 @@ protocol unix,inet,inet6 | |||
31 | seccomp | 31 | seccomp |
32 | 32 | ||
33 | disable-mnt | 33 | disable-mnt |
34 | private-bin cp,sh,XMind | 34 | private-bin XMind,cp,sh |
35 | private-tmp | 35 | private-tmp |
36 | private-dev | 36 | private-dev |
37 | 37 | ||
diff --git a/etc/profile-m-z/Xephyr.profile b/etc/profile-m-z/Xephyr.profile index 2fc1d1b8a..aae1808dd 100644 --- a/etc/profile-m-z/Xephyr.profile +++ b/etc/profile-m-z/Xephyr.profile | |||
@@ -16,7 +16,7 @@ include globals.local | |||
16 | # | 16 | # |
17 | 17 | ||
18 | whitelist /var/lib/xkb | 18 | whitelist /var/lib/xkb |
19 | include whitelist-common.inc | 19 | #include whitelist-common.inc # see #903 |
20 | 20 | ||
21 | caps.drop all | 21 | caps.drop all |
22 | # Xephyr needs to be allowed access to the abstract Unix socket namespace. | 22 | # Xephyr needs to be allowed access to the abstract Unix socket namespace. |
@@ -25,7 +25,7 @@ nogroups | |||
25 | noinput | 25 | noinput |
26 | nonewprivs | 26 | nonewprivs |
27 | # In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix. | 27 | # In noroot mode, Xephyr cannot create a socket in the real /tmp/.X11-unix. |
28 | # noroot | 28 | #noroot |
29 | nosound | 29 | nosound |
30 | notv | 30 | notv |
31 | nou2f | 31 | nou2f |
@@ -35,10 +35,10 @@ seccomp | |||
35 | disable-mnt | 35 | disable-mnt |
36 | # using a private home directory | 36 | # using a private home directory |
37 | private | 37 | private |
38 | # private-bin sh,Xephyr,xkbcomp | 38 | #private-bin sh,Xephyr,xkbcomp |
39 | # private-bin bash,cat,ls,sh,strace,Xephyr,xkbcomp | 39 | #private-bin bash,cat,ls,sh,strace,Xephyr,xkbcomp |
40 | private-dev | 40 | private-dev |
41 | # private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf | 41 | #private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,nsswitch.conf,resolv.conf |
42 | #private-tmp | 42 | #private-tmp |
43 | 43 | ||
44 | restrict-namespaces | 44 | restrict-namespaces |
diff --git a/etc/profile-m-z/Xvfb.profile b/etc/profile-m-z/Xvfb.profile index ee19fa3b0..052ea520d 100644 --- a/etc/profile-m-z/Xvfb.profile +++ b/etc/profile-m-z/Xvfb.profile | |||
@@ -19,7 +19,7 @@ include globals.local | |||
19 | # | 19 | # |
20 | 20 | ||
21 | whitelist /var/lib/xkb | 21 | whitelist /var/lib/xkb |
22 | include whitelist-common.inc | 22 | #include whitelist-common.inc # see #903 |
23 | 23 | ||
24 | caps.drop all | 24 | caps.drop all |
25 | # Xvfb needs to be allowed access to the abstract Unix socket namespace. | 25 | # Xvfb needs to be allowed access to the abstract Unix socket namespace. |
@@ -39,8 +39,8 @@ seccomp | |||
39 | disable-mnt | 39 | disable-mnt |
40 | # using a private home directory | 40 | # using a private home directory |
41 | private | 41 | private |
42 | # private-bin sh,xkbcomp,Xvfb | 42 | #private-bin sh,xkbcomp,Xvfb |
43 | # private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb | 43 | #private-bin bash,cat,ls,sh,strace,xkbcomp,Xvfb |
44 | private-dev | 44 | private-dev |
45 | private-etc gai.conf,host.conf | 45 | private-etc gai.conf,host.conf |
46 | private-tmp | 46 | private-tmp |
diff --git a/etc/profile-m-z/makepkg.profile b/etc/profile-m-z/makepkg.profile index 266d00395..b6afbad59 100644 --- a/etc/profile-m-z/makepkg.profile +++ b/etc/profile-m-z/makepkg.profile | |||
@@ -14,8 +14,8 @@ blacklist ${RUNUSER}/wayland-* | |||
14 | # for potential issues and their solutions when Firejailing makepkg | 14 | # for potential issues and their solutions when Firejailing makepkg |
15 | 15 | ||
16 | # This profile could be significantly strengthened by adding the following to makepkg.local | 16 | # This profile could be significantly strengthened by adding the following to makepkg.local |
17 | # whitelist ${HOME}/<Your Build Folder> | 17 | #whitelist ${HOME}/<Your Build Folder> |
18 | # whitelist ${HOME}/.gnupg | 18 | #whitelist ${HOME}/.gnupg |
19 | 19 | ||
20 | # Enable severely restricted access to ${HOME}/.gnupg | 20 | # Enable severely restricted access to ${HOME}/.gnupg |
21 | noblacklist ${HOME}/.gnupg | 21 | noblacklist ${HOME}/.gnupg |
diff --git a/etc/profile-m-z/mediathekview.profile b/etc/profile-m-z/mediathekview.profile index 19ce6fcd1..ef0c8bcc9 100644 --- a/etc/profile-m-z/mediathekview.profile +++ b/etc/profile-m-z/mediathekview.profile | |||
@@ -6,6 +6,7 @@ include mediathekview.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/mpv | ||
9 | noblacklist ${HOME}/.config/mpv | 10 | noblacklist ${HOME}/.config/mpv |
10 | noblacklist ${HOME}/.config/smplayer | 11 | noblacklist ${HOME}/.config/smplayer |
11 | noblacklist ${HOME}/.config/totem | 12 | noblacklist ${HOME}/.config/totem |
@@ -13,6 +14,7 @@ noblacklist ${HOME}/.config/vlc | |||
13 | noblacklist ${HOME}/.config/xplayer | 14 | noblacklist ${HOME}/.config/xplayer |
14 | noblacklist ${HOME}/.local/share/totem | 15 | noblacklist ${HOME}/.local/share/totem |
15 | noblacklist ${HOME}/.local/share/xplayer | 16 | noblacklist ${HOME}/.local/share/xplayer |
17 | noblacklist ${HOME}/.local/state/mpv | ||
16 | noblacklist ${HOME}/.mediathek3 | 18 | noblacklist ${HOME}/.mediathek3 |
17 | noblacklist ${HOME}/.mplayer | 19 | noblacklist ${HOME}/.mplayer |
18 | noblacklist ${VIDEOS} | 20 | noblacklist ${VIDEOS} |
diff --git a/etc/profile-m-z/microsoft-edge-beta.profile b/etc/profile-m-z/microsoft-edge-beta.profile index 6843c11c7..e07bbe6e5 100644 --- a/etc/profile-m-z/microsoft-edge-beta.profile +++ b/etc/profile-m-z/microsoft-edge-beta.profile | |||
@@ -14,10 +14,7 @@ mkdir ${HOME}/.cache/microsoft-edge-beta | |||
14 | mkdir ${HOME}/.config/microsoft-edge-beta | 14 | mkdir ${HOME}/.config/microsoft-edge-beta |
15 | whitelist ${HOME}/.cache/microsoft-edge-beta | 15 | whitelist ${HOME}/.cache/microsoft-edge-beta |
16 | whitelist ${HOME}/.config/microsoft-edge-beta | 16 | whitelist ${HOME}/.config/microsoft-edge-beta |
17 | |||
18 | whitelist /opt/microsoft/msedge-beta | 17 | whitelist /opt/microsoft/msedge-beta |
19 | # private-opt might break the file-copy-limit, see #5307 | ||
20 | #private-opt microsoft | ||
21 | 18 | ||
22 | # Redirect | 19 | # Redirect |
23 | include chromium-common.profile | 20 | include chromium-common.profile |
diff --git a/etc/profile-m-z/midori.profile b/etc/profile-m-z/midori.profile index d1655fabb..fcc4845df 100644 --- a/etc/profile-m-z/midori.profile +++ b/etc/profile-m-z/midori.profile | |||
@@ -13,8 +13,8 @@ noblacklist ${HOME}/.cache/midori | |||
13 | noblacklist ${HOME}/.config/midori | 13 | noblacklist ${HOME}/.config/midori |
14 | noblacklist ${HOME}/.local/share/midori | 14 | noblacklist ${HOME}/.local/share/midori |
15 | noblacklist ${HOME}/.local/share/pki | 15 | noblacklist ${HOME}/.local/share/pki |
16 | # noblacklist ${HOME}/.local/share/webkit | 16 | #noblacklist ${HOME}/.local/share/webkit |
17 | # noblacklist ${HOME}/.local/share/webkitgtk | 17 | #noblacklist ${HOME}/.local/share/webkitgtk |
18 | noblacklist ${HOME}/.pki | 18 | noblacklist ${HOME}/.pki |
19 | 19 | ||
20 | noblacklist ${HOME}/.cache/gnome-mplayer | 20 | noblacklist ${HOME}/.cache/gnome-mplayer |
@@ -54,7 +54,7 @@ caps.drop all | |||
54 | netfilter | 54 | netfilter |
55 | nodvd | 55 | nodvd |
56 | nonewprivs | 56 | nonewprivs |
57 | # noroot - problems on Ubuntu 14.04 | 57 | #noroot # problems on Ubuntu 14.04 |
58 | notv | 58 | notv |
59 | protocol unix,inet,inet6,netlink | 59 | protocol unix,inet,inet6,netlink |
60 | seccomp | 60 | seccomp |
diff --git a/etc/profile-m-z/mirrormagic.profile b/etc/profile-m-z/mirrormagic.profile index 4943a80af..a8c6e3533 100644 --- a/etc/profile-m-z/mirrormagic.profile +++ b/etc/profile-m-z/mirrormagic.profile | |||
@@ -39,7 +39,6 @@ seccomp | |||
39 | tracelog | 39 | tracelog |
40 | 40 | ||
41 | disable-mnt | 41 | disable-mnt |
42 | private | ||
43 | private-bin mirrormagic | 42 | private-bin mirrormagic |
44 | private-cache | 43 | private-cache |
45 | private-dev | 44 | private-dev |
diff --git a/etc/profile-m-z/mocp.profile b/etc/profile-m-z/mocp.profile index 2ba03ec97..0a5e4255a 100644 --- a/etc/profile-m-z/mocp.profile +++ b/etc/profile-m-z/mocp.profile | |||
@@ -10,15 +10,24 @@ include globals.local | |||
10 | noblacklist ${HOME}/.moc | 10 | noblacklist ${HOME}/.moc |
11 | noblacklist ${MUSIC} | 11 | noblacklist ${MUSIC} |
12 | 12 | ||
13 | blacklist /tmp/.X11-unix | ||
14 | blacklist ${RUNUSER}/wayland-* | ||
15 | |||
13 | include disable-common.inc | 16 | include disable-common.inc |
14 | include disable-devel.inc | 17 | include disable-devel.inc |
15 | include disable-exec.inc | 18 | include disable-exec.inc |
16 | include disable-interpreters.inc | 19 | include disable-interpreters.inc |
20 | include disable-proc.inc | ||
17 | include disable-programs.inc | 21 | include disable-programs.inc |
18 | include disable-xdg.inc | 22 | include disable-xdg.inc |
19 | 23 | ||
20 | include whitelist-usr-share-common.inc | 24 | mkdir ${HOME}/.moc |
25 | whitelist ${HOME}/.moc | ||
26 | whitelist ${MUSIC} | ||
27 | include whitelist-common.inc | ||
28 | include whitelist-run-common.inc | ||
21 | include whitelist-runuser-common.inc | 29 | include whitelist-runuser-common.inc |
30 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
23 | 32 | ||
24 | apparmor | 33 | apparmor |
@@ -30,18 +39,20 @@ nodvd | |||
30 | nogroups | 39 | nogroups |
31 | noinput | 40 | noinput |
32 | nonewprivs | 41 | nonewprivs |
42 | noprinters | ||
33 | noroot | 43 | noroot |
34 | notv | 44 | notv |
35 | nou2f | 45 | nou2f |
36 | novideo | 46 | novideo |
37 | protocol unix,inet,inet6,netlink | 47 | protocol unix,inet,inet6 |
38 | seccomp | 48 | seccomp |
49 | seccomp.block-secondary | ||
39 | tracelog | 50 | tracelog |
40 | 51 | ||
41 | private-bin mocp | 52 | private-bin mocp |
42 | private-cache | 53 | private-cache |
43 | private-dev | 54 | private-dev |
44 | private-etc @tls-ca | 55 | private-etc @network,@tls-ca |
45 | private-tmp | 56 | private-tmp |
46 | 57 | ||
47 | dbus-user none | 58 | dbus-user none |
diff --git a/etc/profile-m-z/mov-cli.profile b/etc/profile-m-z/mov-cli.profile index 8007b887a..1efd1e8f9 100644 --- a/etc/profile-m-z/mov-cli.profile +++ b/etc/profile-m-z/mov-cli.profile | |||
@@ -26,7 +26,7 @@ notv | |||
26 | disable-mnt | 26 | disable-mnt |
27 | private-bin ffmpeg,fzf,mov-cli | 27 | private-bin ffmpeg,fzf,mov-cli |
28 | #private-cache | 28 | #private-cache |
29 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,magic,magic.mgc,mime.types,nsswitch.conf,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,X11,xdg | 29 | private-etc X11,alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,magic,magic.mgc,mime.types,nsswitch.conf,pango,passwd,pki,protocols,pulse,resolv.conf,rpc,services,ssl,xdg |
30 | private-tmp | 30 | private-tmp |
31 | 31 | ||
32 | # Redirect | 32 | # Redirect |
diff --git a/etc/profile-m-z/mpDris2.profile b/etc/profile-m-z/mpDris2.profile index a9631733c..ab1c93eaf 100644 --- a/etc/profile-m-z/mpDris2.profile +++ b/etc/profile-m-z/mpDris2.profile | |||
@@ -52,7 +52,11 @@ private-etc | |||
52 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* | 52 | private-lib libdbus-1.so.*,libdbus-glib-1.so.*,libgirepository-1.0.so.*,libnotify.so.*,libpython*,python2*,python3* |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 55 | dbus-user filter |
56 | dbus-user.own org.mpris.MediaPlayer2.mpd | ||
57 | dbus-system none | ||
58 | |||
59 | #memory-deny-write-execute # breaks on Arch (see issue #1803) | ||
56 | 60 | ||
57 | read-only ${HOME} | 61 | read-only ${HOME} |
58 | restrict-namespaces | 62 | restrict-namespaces |
diff --git a/etc/profile-m-z/mpd.profile b/etc/profile-m-z/mpd.profile index d1c4bd24f..6bf881faf 100644 --- a/etc/profile-m-z/mpd.profile +++ b/etc/profile-m-z/mpd.profile | |||
@@ -41,4 +41,8 @@ private-cache | |||
41 | private-dev | 41 | private-dev |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | dbus-user filter | ||
45 | dbus-user.talk org.mpris.MediaPlayer2.mpd | ||
46 | dbus-system none | ||
47 | |||
44 | restrict-namespaces | 48 | restrict-namespaces |
diff --git a/etc/profile-m-z/mplayer.profile b/etc/profile-m-z/mplayer.profile index 7d9ff39ad..bdb9fa51d 100644 --- a/etc/profile-m-z/mplayer.profile +++ b/etc/profile-m-z/mplayer.profile | |||
@@ -24,9 +24,9 @@ include whitelist-var-common.inc | |||
24 | 24 | ||
25 | apparmor | 25 | apparmor |
26 | caps.drop all | 26 | caps.drop all |
27 | # net none - mplayer can be used for streaming. | 27 | #net none # mplayer can be used for streaming. |
28 | netfilter | 28 | netfilter |
29 | # nogroups | 29 | #nogroups |
30 | noinput | 30 | noinput |
31 | nonewprivs | 31 | nonewprivs |
32 | noroot | 32 | noroot |
diff --git a/etc/profile-m-z/mpsyt.profile b/etc/profile-m-z/mpsyt.profile index e73e3142c..e4f76855e 100644 --- a/etc/profile-m-z/mpsyt.profile +++ b/etc/profile-m-z/mpsyt.profile | |||
@@ -6,9 +6,11 @@ include mpsyt.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/mpv | ||
9 | noblacklist ${HOME}/.config/mps-youtube | 10 | noblacklist ${HOME}/.config/mps-youtube |
10 | noblacklist ${HOME}/.config/mpv | 11 | noblacklist ${HOME}/.config/mpv |
11 | noblacklist ${HOME}/.config/youtube-dl | 12 | noblacklist ${HOME}/.config/youtube-dl |
13 | noblacklist ${HOME}/.local/state/mpv | ||
12 | noblacklist ${HOME}/.mplayer | 14 | noblacklist ${HOME}/.mplayer |
13 | noblacklist ${HOME}/.netrc | 15 | noblacklist ${HOME}/.netrc |
14 | noblacklist ${HOME}/mps | 16 | noblacklist ${HOME}/mps |
@@ -32,13 +34,13 @@ include disable-shell.inc | |||
32 | include disable-xdg.inc | 34 | include disable-xdg.inc |
33 | 35 | ||
34 | mkdir ${HOME}/.config/mps-youtube | 36 | mkdir ${HOME}/.config/mps-youtube |
35 | mkdir ${HOME}/.config/mpv | ||
36 | mkdir ${HOME}/.config/youtube-dl | ||
37 | mkdir ${HOME}/.mplayer | 37 | mkdir ${HOME}/.mplayer |
38 | mkdir ${HOME}/mps | 38 | mkdir ${HOME}/mps |
39 | whitelist ${HOME}/.cache/mpv | ||
39 | whitelist ${HOME}/.config/mps-youtube | 40 | whitelist ${HOME}/.config/mps-youtube |
40 | whitelist ${HOME}/.config/mpv | 41 | whitelist ${HOME}/.config/mpv |
41 | whitelist ${HOME}/.config/youtube-dl | 42 | whitelist ${HOME}/.config/youtube-dl |
43 | whitelist ${HOME}/.local/state/mpv | ||
42 | whitelist ${HOME}/.mplayer | 44 | whitelist ${HOME}/.mplayer |
43 | whitelist ${HOME}/.netrc | 45 | whitelist ${HOME}/.netrc |
44 | whitelist ${HOME}/mps | 46 | whitelist ${HOME}/mps |
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile index d1bbdd167..af8f00c0c 100644 --- a/etc/profile-m-z/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -24,6 +24,7 @@ include globals.local | |||
24 | #include allow-bin-sh.inc | 24 | #include allow-bin-sh.inc |
25 | #private-bin sh | 25 | #private-bin sh |
26 | 26 | ||
27 | noblacklist ${HOME}/.cache/mpv | ||
27 | noblacklist ${HOME}/.config/mpv | 28 | noblacklist ${HOME}/.config/mpv |
28 | noblacklist ${HOME}/.config/youtube-dl | 29 | noblacklist ${HOME}/.config/youtube-dl |
29 | noblacklist ${HOME}/.config/yt-dlp | 30 | noblacklist ${HOME}/.config/yt-dlp |
@@ -50,9 +51,11 @@ include disable-programs.inc | |||
50 | include disable-shell.inc | 51 | include disable-shell.inc |
51 | 52 | ||
52 | read-only ${DESKTOP} | 53 | read-only ${DESKTOP} |
54 | mkdir ${HOME}/.cache/mpv | ||
53 | mkdir ${HOME}/.config/mpv | 55 | mkdir ${HOME}/.config/mpv |
54 | mkdir ${HOME}/.local/state/mpv | 56 | mkdir ${HOME}/.local/state/mpv |
55 | mkfile ${HOME}/.netrc | 57 | mkfile ${HOME}/.netrc |
58 | whitelist ${HOME}/.cache/mpv | ||
56 | whitelist ${HOME}/.config/mpv | 59 | whitelist ${HOME}/.config/mpv |
57 | whitelist ${HOME}/.config/youtube-dl | 60 | whitelist ${HOME}/.config/youtube-dl |
58 | whitelist ${HOME}/.config/yt-dlp | 61 | whitelist ${HOME}/.config/yt-dlp |
diff --git a/etc/profile-m-z/mullvad-browser.profile b/etc/profile-m-z/mullvad-browser.profile index b9eb57743..6706386aa 100644 --- a/etc/profile-m-z/mullvad-browser.profile +++ b/etc/profile-m-z/mullvad-browser.profile | |||
@@ -73,13 +73,12 @@ novideo | |||
73 | protocol unix,inet,inet6 | 73 | protocol unix,inet,inet6 |
74 | seccomp !chroot | 74 | seccomp !chroot |
75 | seccomp.block-secondary | 75 | seccomp.block-secondary |
76 | #tracelog - may cause issues, see #1930 | 76 | #tracelog # may cause issues, see #1930 |
77 | 77 | ||
78 | disable-mnt | 78 | disable-mnt |
79 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity | 79 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mullvad-browser,mv,python*,rm,sed,sh,tail,tar,tclsh,test,update-desktop-database,xmessage,xz,zenity |
80 | private-dev | 80 | private-dev |
81 | private-etc @tls-ca | 81 | private-etc @tls-ca |
82 | #private-opt mullvad-browser - can cause slow startup | ||
83 | private-tmp | 82 | private-tmp |
84 | 83 | ||
85 | blacklist ${PATH}/curl | 84 | blacklist ${PATH}/curl |
diff --git a/etc/profile-m-z/multimc5.profile b/etc/profile-m-z/multimc5.profile index 73107680c..41f82bd07 100644 --- a/etc/profile-m-z/multimc5.profile +++ b/etc/profile-m-z/multimc5.profile | |||
@@ -41,12 +41,12 @@ notv | |||
41 | nou2f | 41 | nou2f |
42 | novideo | 42 | novideo |
43 | protocol unix,inet,inet6 | 43 | protocol unix,inet,inet6 |
44 | # seccomp | 44 | #seccomp |
45 | 45 | ||
46 | disable-mnt | 46 | disable-mnt |
47 | # private-bin works, but causes weirdness | 47 | # private-bin works, but causes weirdness |
48 | # private-bin apt-file,awk,bash,chmod,dirname,dnf,grep,java,kdialog,ldd,mkdir,multimc5,pfl,pkgfile,readlink,sort,valgrind,which,yum,zenity,zypper | 48 | #private-bin apt-file,awk,bash,chmod,dirname,dnf,grep,java,kdialog,ldd,mkdir,multimc5,pfl,pkgfile,readlink,sort,valgrind,which,yum,zenity,zypper |
49 | private-dev | 49 | private-dev |
50 | private-tmp | 50 | private-tmp |
51 | 51 | ||
52 | # restrict-namespaces | 52 | #restrict-namespaces |
diff --git a/etc/profile-m-z/mumble.profile b/etc/profile-m-z/mumble.profile index ef09e6fca..52dc46800 100644 --- a/etc/profile-m-z/mumble.profile +++ b/etc/profile-m-z/mumble.profile | |||
@@ -41,5 +41,5 @@ disable-mnt | |||
41 | private-bin mumble | 41 | private-bin mumble |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 44 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
45 | restrict-namespaces | 45 | restrict-namespaces |
diff --git a/etc/profile-m-z/musescore.profile b/etc/profile-m-z/musescore.profile index ca951f70c..b62674ad6 100644 --- a/etc/profile-m-z/musescore.profile +++ b/etc/profile-m-z/musescore.profile | |||
@@ -37,7 +37,7 @@ protocol unix,inet,inet6 | |||
37 | seccomp !chroot | 37 | seccomp !chroot |
38 | tracelog | 38 | tracelog |
39 | 39 | ||
40 | # private-bin musescore,mscore | 40 | #private-bin musescore,mscore |
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
43 | # restrict-namespaces | 43 | #restrict-namespaces |
diff --git a/etc/profile-m-z/musixmatch.profile b/etc/profile-m-z/musixmatch.profile index 7ce7fbd19..d67cd24bd 100644 --- a/etc/profile-m-z/musixmatch.profile +++ b/etc/profile-m-z/musixmatch.profile | |||
@@ -35,4 +35,4 @@ disable-mnt | |||
35 | private-dev | 35 | private-dev |
36 | private-etc @tls-ca | 36 | private-etc @tls-ca |
37 | 37 | ||
38 | # restrict-namespaces | 38 | #restrict-namespaces |
diff --git a/etc/profile-m-z/mutt.profile b/etc/profile-m-z/mutt.profile index 288ffedf1..097ce6e83 100644 --- a/etc/profile-m-z/mutt.profile +++ b/etc/profile-m-z/mutt.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${DOCUMENTS} | |||
13 | noblacklist ${HOME}/.Mail | 13 | noblacklist ${HOME}/.Mail |
14 | noblacklist ${HOME}/.bogofilter | 14 | noblacklist ${HOME}/.bogofilter |
15 | noblacklist ${HOME}/.cache/mutt | 15 | noblacklist ${HOME}/.cache/mutt |
16 | noblacklist ${HOME}/.config/msmtp | ||
16 | noblacklist ${HOME}/.config/mutt | 17 | noblacklist ${HOME}/.config/mutt |
17 | noblacklist ${HOME}/.config/nano | 18 | noblacklist ${HOME}/.config/nano |
18 | noblacklist ${HOME}/.elinks | 19 | noblacklist ${HOME}/.elinks |
@@ -35,6 +36,7 @@ noblacklist ${HOME}/Mail | |||
35 | noblacklist ${HOME}/mail | 36 | noblacklist ${HOME}/mail |
36 | noblacklist ${HOME}/postponed | 37 | noblacklist ${HOME}/postponed |
37 | noblacklist ${HOME}/sent | 38 | noblacklist ${HOME}/sent |
39 | noblacklist /etc/msmtprc | ||
38 | 40 | ||
39 | blacklist /tmp/.X11-unix | 41 | blacklist /tmp/.X11-unix |
40 | blacklist ${RUNUSER}/wayland-* | 42 | blacklist ${RUNUSER}/wayland-* |
@@ -69,6 +71,7 @@ whitelist ${DOWNLOADS} | |||
69 | whitelist ${HOME}/.Mail | 71 | whitelist ${HOME}/.Mail |
70 | whitelist ${HOME}/.bogofilter | 72 | whitelist ${HOME}/.bogofilter |
71 | whitelist ${HOME}/.cache/mutt | 73 | whitelist ${HOME}/.cache/mutt |
74 | whitelist ${HOME}/.config/msmtp | ||
72 | whitelist ${HOME}/.config/mutt | 75 | whitelist ${HOME}/.config/mutt |
73 | whitelist ${HOME}/.config/nano | 76 | whitelist ${HOME}/.config/nano |
74 | whitelist ${HOME}/.elinks | 77 | whitelist ${HOME}/.elinks |
@@ -121,10 +124,10 @@ seccomp | |||
121 | seccomp.block-secondary | 124 | seccomp.block-secondary |
122 | tracelog | 125 | tracelog |
123 | 126 | ||
124 | # disable-mnt | 127 | #disable-mnt |
125 | private-cache | 128 | private-cache |
126 | private-dev | 129 | private-dev |
127 | private-etc @tls-ca,@x11,Mutt,Muttrc,Muttrc.d,gai.conf,gnupg,gnutls,hosts.conf,mail,mailname,nntpserver,terminfo | 130 | private-etc @tls-ca,@x11,Mutt,Muttrc,Muttrc.d,gai.conf,gnupg,gnutls,hosts.conf,mail,mailname,msmtprc,nntpserver,terminfo |
128 | private-tmp | 131 | private-tmp |
129 | writable-run-user | 132 | writable-run-user |
130 | writable-var | 133 | writable-var |
diff --git a/etc/profile-m-z/nano.profile b/etc/profile-m-z/nano.profile index 6b4074dfb..ba63b2067 100644 --- a/etc/profile-m-z/nano.profile +++ b/etc/profile-m-z/nano.profile | |||
@@ -41,7 +41,7 @@ seccomp | |||
41 | tracelog | 41 | tracelog |
42 | x11 none | 42 | x11 none |
43 | 43 | ||
44 | # disable-mnt | 44 | #disable-mnt |
45 | private-bin nano,rnano | 45 | private-bin nano,rnano |
46 | private-cache | 46 | private-cache |
47 | private-dev | 47 | private-dev |
diff --git a/etc/profile-m-z/natron.profile b/etc/profile-m-z/natron.profile index b979e1aee..30dd164b6 100644 --- a/etc/profile-m-z/natron.profile +++ b/etc/profile-m-z/natron.profile | |||
@@ -30,7 +30,7 @@ nou2f | |||
30 | protocol unix | 30 | protocol unix |
31 | seccomp | 31 | seccomp |
32 | 32 | ||
33 | private-bin natron,Natron,NatronRenderer | 33 | private-bin Natron,NatronRenderer,natron |
34 | 34 | ||
35 | dbus-user none | 35 | dbus-user none |
36 | dbus-system none | 36 | dbus-system none |
diff --git a/etc/profile-m-z/ncdu.profile b/etc/profile-m-z/ncdu.profile index 09687199b..5cfd8290a 100644 --- a/etc/profile-m-z/ncdu.profile +++ b/etc/profile-m-z/ncdu.profile | |||
@@ -29,7 +29,7 @@ seccomp | |||
29 | x11 none | 29 | x11 none |
30 | 30 | ||
31 | private-dev | 31 | private-dev |
32 | # private-tmp | 32 | #private-tmp |
33 | 33 | ||
34 | dbus-user none | 34 | dbus-user none |
35 | dbus-system none | 35 | dbus-system none |
diff --git a/etc/profile-m-z/neochat.profile b/etc/profile-m-z/neochat.profile index 80e28a5e5..d1a36e079 100644 --- a/etc/profile-m-z/neochat.profile +++ b/etc/profile-m-z/neochat.profile | |||
@@ -45,7 +45,7 @@ nosound | |||
45 | notv | 45 | notv |
46 | nou2f | 46 | nou2f |
47 | novideo | 47 | novideo |
48 | protocol unix,inet,inet6 | 48 | protocol unix,inet,inet6,netlink |
49 | seccomp | 49 | seccomp |
50 | seccomp.block-secondary | 50 | seccomp.block-secondary |
51 | tracelog | 51 | tracelog |
diff --git a/etc/profile-m-z/neomutt.profile b/etc/profile-m-z/neomutt.profile index 5bd1e7cba..51e2e43bf 100644 --- a/etc/profile-m-z/neomutt.profile +++ b/etc/profile-m-z/neomutt.profile | |||
@@ -10,6 +10,7 @@ include globals.local | |||
10 | noblacklist ${DOCUMENTS} | 10 | noblacklist ${DOCUMENTS} |
11 | noblacklist ${HOME}/.Mail | 11 | noblacklist ${HOME}/.Mail |
12 | noblacklist ${HOME}/.bogofilter | 12 | noblacklist ${HOME}/.bogofilter |
13 | noblacklist ${HOME}/.config/msmtp | ||
13 | noblacklist ${HOME}/.config/mutt | 14 | noblacklist ${HOME}/.config/mutt |
14 | noblacklist ${HOME}/.config/nano | 15 | noblacklist ${HOME}/.config/nano |
15 | noblacklist ${HOME}/.config/neomutt | 16 | noblacklist ${HOME}/.config/neomutt |
@@ -34,6 +35,7 @@ noblacklist ${HOME}/Mail | |||
34 | noblacklist ${HOME}/mail | 35 | noblacklist ${HOME}/mail |
35 | noblacklist ${HOME}/postponed | 36 | noblacklist ${HOME}/postponed |
36 | noblacklist ${HOME}/sent | 37 | noblacklist ${HOME}/sent |
38 | noblacklist /etc/msmtprc | ||
37 | noblacklist /var/mail | 39 | noblacklist /var/mail |
38 | noblacklist /var/spool/mail | 40 | noblacklist /var/spool/mail |
39 | 41 | ||
@@ -59,6 +61,7 @@ whitelist ${DOCUMENTS} | |||
59 | whitelist ${DOWNLOADS} | 61 | whitelist ${DOWNLOADS} |
60 | whitelist ${HOME}/.Mail | 62 | whitelist ${HOME}/.Mail |
61 | whitelist ${HOME}/.bogofilter | 63 | whitelist ${HOME}/.bogofilter |
64 | whitelist ${HOME}/.config/msmtp | ||
62 | whitelist ${HOME}/.config/mutt | 65 | whitelist ${HOME}/.config/mutt |
63 | whitelist ${HOME}/.config/nano | 66 | whitelist ${HOME}/.config/nano |
64 | whitelist ${HOME}/.config/neomutt | 67 | whitelist ${HOME}/.config/neomutt |
@@ -113,10 +116,10 @@ seccomp | |||
113 | seccomp.block-secondary | 116 | seccomp.block-secondary |
114 | tracelog | 117 | tracelog |
115 | 118 | ||
116 | # disable-mnt | 119 | #disable-mnt |
117 | private-cache | 120 | private-cache |
118 | private-dev | 121 | private-dev |
119 | private-etc @tls-ca,@x11,Mutt,Muttrc,Muttrc.d,gnupg,hosts.conf,mail,mailname,neomuttrc,neomuttrc.d,nntpserver | 122 | private-etc @tls-ca,@x11,Mutt,Muttrc,Muttrc.d,gnupg,hosts.conf,mail,mailname,msmtprc,neomuttrc,neomuttrc.d,nntpserver |
120 | private-tmp | 123 | private-tmp |
121 | writable-run-user | 124 | writable-run-user |
122 | writable-var | 125 | writable-var |
diff --git a/etc/profile-m-z/nicotine.profile b/etc/profile-m-z/nicotine.profile index 568899eea..d1680e666 100644 --- a/etc/profile-m-z/nicotine.profile +++ b/etc/profile-m-z/nicotine.profile | |||
@@ -43,7 +43,6 @@ noinput | |||
43 | nonewprivs | 43 | nonewprivs |
44 | noprinters | 44 | noprinters |
45 | noroot | 45 | noroot |
46 | nosound | ||
47 | notv | 46 | notv |
48 | nou2f | 47 | nou2f |
49 | novideo | 48 | novideo |
@@ -57,7 +56,9 @@ private-cache | |||
57 | private-dev | 56 | private-dev |
58 | private-tmp | 57 | private-tmp |
59 | 58 | ||
60 | dbus-user none | 59 | dbus-user filter |
60 | dbus-user.own org.nicotine_plus.Nicotine | ||
61 | dbus-user.talk ca.desrt.dconf | ||
61 | dbus-system none | 62 | dbus-system none |
62 | 63 | ||
63 | restrict-namespaces | 64 | restrict-namespaces |
diff --git a/etc/profile-m-z/nitroshare.profile b/etc/profile-m-z/nitroshare.profile index 7a97ca825..254eb789a 100644 --- a/etc/profile-m-z/nitroshare.profile +++ b/etc/profile-m-z/nitroshare.profile | |||
@@ -42,11 +42,11 @@ private-bin awk,grep,nitroshare,nitroshare-cli,nitroshare-nmh,nitroshare-send,ni | |||
42 | private-cache | 42 | private-cache |
43 | private-dev | 43 | private-dev |
44 | private-etc @tls-ca,@x11 | 44 | private-etc @tls-ca,@x11 |
45 | # private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare | 45 | #private-lib libnitroshare.so.*,libqhttpengine.so.*,libqmdnsengine.so.*,nitroshare |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # dbus-user none | 48 | #dbus-user none |
49 | # dbus-system none | 49 | #dbus-system none |
50 | 50 | ||
51 | # memory-deny-write-execute | 51 | #memory-deny-write-execute |
52 | restrict-namespaces | 52 | restrict-namespaces |
diff --git a/etc/profile-m-z/nodejs-common.profile b/etc/profile-m-z/nodejs-common.profile index 4c463521c..f301196c6 100644 --- a/etc/profile-m-z/nodejs-common.profile +++ b/etc/profile-m-z/nodejs-common.profile | |||
@@ -7,7 +7,7 @@ include nodejs-common.local | |||
7 | # added by caller profile | 7 | # added by caller profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | # Note: gulp, node-gyp, npm, npx, semver and yarn are all node scripts | 10 | # Note: gulp, node-gyp, npm, npx, pnpm, pnpx, semver and yarn are all node scripts |
11 | # using the `#!/usr/bin/env node` shebang. By sandboxing node the full | 11 | # using the `#!/usr/bin/env node` shebang. By sandboxing node the full |
12 | # node.js stack will be firejailed. The only exception is nvm, which is implemented | 12 | # node.js stack will be firejailed. The only exception is nvm, which is implemented |
13 | # as a sourced shell function, not an executable binary. Hence it is not | 13 | # as a sourced shell function, not an executable binary. Hence it is not |
@@ -22,6 +22,7 @@ ignore read-only ${HOME}/.npmrc | |||
22 | ignore read-only ${HOME}/.nvm | 22 | ignore read-only ${HOME}/.nvm |
23 | ignore read-only ${HOME}/.yarnrc | 23 | ignore read-only ${HOME}/.yarnrc |
24 | 24 | ||
25 | noblacklist ${HOME}/.local/share/pnpm | ||
25 | noblacklist ${HOME}/.node-gyp | 26 | noblacklist ${HOME}/.node-gyp |
26 | noblacklist ${HOME}/.npm | 27 | noblacklist ${HOME}/.npm |
27 | noblacklist ${HOME}/.npmrc | 28 | noblacklist ${HOME}/.npmrc |
@@ -43,6 +44,7 @@ include disable-xdg.inc | |||
43 | 44 | ||
44 | # If you want whitelisting, change ${HOME}/Projects below to your node projects directory | 45 | # If you want whitelisting, change ${HOME}/Projects below to your node projects directory |
45 | # and add the next lines to your nodejs-common.local. | 46 | # and add the next lines to your nodejs-common.local. |
47 | #mkdir ${HOME}/.local/share/pnpm | ||
46 | #mkdir ${HOME}/.node-gyp | 48 | #mkdir ${HOME}/.node-gyp |
47 | #mkdir ${HOME}/.npm | 49 | #mkdir ${HOME}/.npm |
48 | #mkdir ${HOME}/.npm-packages | 50 | #mkdir ${HOME}/.npm-packages |
@@ -52,6 +54,7 @@ include disable-xdg.inc | |||
52 | #mkdir ${HOME}/.yarn-config | 54 | #mkdir ${HOME}/.yarn-config |
53 | #mkdir ${HOME}/.yarncache | 55 | #mkdir ${HOME}/.yarncache |
54 | #mkfile ${HOME}/.yarnrc | 56 | #mkfile ${HOME}/.yarnrc |
57 | #whitelist ${HOME}/.local/share/pnpm | ||
55 | #whitelist ${HOME}/.node-gyp | 58 | #whitelist ${HOME}/.node-gyp |
56 | #whitelist ${HOME}/.npm | 59 | #whitelist ${HOME}/.npm |
57 | #whitelist ${HOME}/.npm-packages | 60 | #whitelist ${HOME}/.npm-packages |
diff --git a/etc/profile-m-z/notable.profile b/etc/profile-m-z/notable.profile index 9fbbf94c0..4bd3d45ac 100644 --- a/etc/profile-m-z/notable.profile +++ b/etc/profile-m-z/notable.profile | |||
@@ -14,11 +14,12 @@ include globals.local | |||
14 | noblacklist ${HOME}/.config/Notable | 14 | noblacklist ${HOME}/.config/Notable |
15 | noblacklist ${HOME}/.notable | 15 | noblacklist ${HOME}/.notable |
16 | 16 | ||
17 | whitelist /opt/Notable | ||
18 | |||
17 | net none | 19 | net none |
18 | nosound | 20 | nosound |
19 | 21 | ||
20 | ?HAS_APPIMAGE: ignore private-dev | 22 | ?HAS_APPIMAGE: ignore private-dev |
21 | private-opt Notable | ||
22 | 23 | ||
23 | dbus-user filter | 24 | dbus-user filter |
24 | dbus-user.talk ca.desrt.dconf | 25 | dbus-user.talk ca.desrt.dconf |
diff --git a/etc/profile-m-z/notify-send.profile b/etc/profile-m-z/notify-send.profile index f0f2cca2e..5ec81c2ac 100644 --- a/etc/profile-m-z/notify-send.profile +++ b/etc/profile-m-z/notify-send.profile | |||
@@ -18,7 +18,7 @@ include disable-shell.inc | |||
18 | include disable-write-mnt.inc | 18 | include disable-write-mnt.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-common.inc | 21 | #include whitelist-common.inc # see #903 |
22 | include whitelist-runuser-common.inc | 22 | include whitelist-runuser-common.inc |
23 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
diff --git a/etc/profile-m-z/nuclear.profile b/etc/profile-m-z/nuclear.profile index dec48c827..6d1e3cd8a 100644 --- a/etc/profile-m-z/nuclear.profile +++ b/etc/profile-m-z/nuclear.profile | |||
@@ -14,12 +14,12 @@ include disable-shell.inc | |||
14 | 14 | ||
15 | mkdir ${HOME}/.config/nuclear | 15 | mkdir ${HOME}/.config/nuclear |
16 | whitelist ${HOME}/.config/nuclear | 16 | whitelist ${HOME}/.config/nuclear |
17 | whitelist /opt/nuclear | ||
17 | 18 | ||
18 | no3d | 19 | no3d |
19 | 20 | ||
20 | # private-bin nuclear | 21 | #private-bin nuclear |
21 | private-etc @tls-ca,@x11,host.conf,mime.types | 22 | private-etc @tls-ca,@x11,host.conf,mime.types |
22 | private-opt nuclear | ||
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
25 | include electron-common.profile | 25 | include electron-common.profile |
diff --git a/etc/profile-m-z/ocenaudio.profile b/etc/profile-m-z/ocenaudio.profile index 830483bd4..3fe5a4712 100644 --- a/etc/profile-m-z/ocenaudio.profile +++ b/etc/profile-m-z/ocenaudio.profile | |||
@@ -25,6 +25,7 @@ whitelist ${HOME}/.cache/ocenaudio | |||
25 | whitelist ${HOME}/.local/share/ocenaudio | 25 | whitelist ${HOME}/.local/share/ocenaudio |
26 | whitelist ${DOWNLOADS} | 26 | whitelist ${DOWNLOADS} |
27 | whitelist ${MUSIC} | 27 | whitelist ${MUSIC} |
28 | whitelist /opt/ocenaudio | ||
28 | include whitelist-common.inc | 29 | include whitelist-common.inc |
29 | include whitelist-run-common.inc | 30 | include whitelist-run-common.inc |
30 | include whitelist-runuser-common.inc | 31 | include whitelist-runuser-common.inc |
@@ -54,7 +55,6 @@ private-bin ocenaudio,ocenvst | |||
54 | private-cache | 55 | private-cache |
55 | private-dev | 56 | private-dev |
56 | private-etc @tls-ca,@x11,mime.types | 57 | private-etc @tls-ca,@x11,mime.types |
57 | private-opt ocenaudio | ||
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | dbus-user none | 60 | dbus-user none |
diff --git a/etc/profile-m-z/okular.profile b/etc/profile-m-z/okular.profile index 8e0758c37..ac573dc47 100644 --- a/etc/profile-m-z/okular.profile +++ b/etc/profile-m-z/okular.profile | |||
@@ -44,7 +44,7 @@ include whitelist-var-common.inc | |||
44 | apparmor | 44 | apparmor |
45 | caps.drop all | 45 | caps.drop all |
46 | machine-id | 46 | machine-id |
47 | # net none | 47 | #net none |
48 | netfilter | 48 | netfilter |
49 | nodvd | 49 | nodvd |
50 | nogroups | 50 | nogroups |
@@ -62,12 +62,13 @@ tracelog | |||
62 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar | 62 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar |
63 | private-dev | 63 | private-dev |
64 | private-etc @x11,cups | 64 | private-etc @x11,cups |
65 | # private-tmp - on KDE we need access to the real /tmp for data exchange with email clients | 65 | # on KDE we need access to the real /tmp for data exchange with email clients |
66 | #private-tmp | ||
66 | 67 | ||
67 | # dbus-user none | 68 | #dbus-user none |
68 | # dbus-system none | 69 | #dbus-system none |
69 | 70 | ||
70 | # memory-deny-write-execute | 71 | #memory-deny-write-execute |
71 | 72 | ||
72 | restrict-namespaces | 73 | restrict-namespaces |
73 | join-or-start okular | 74 | join-or-start okular |
diff --git a/etc/profile-m-z/onionshare-gui.profile b/etc/profile-m-z/onionshare-gui.profile index 47ac9fc05..3338cadf5 100644 --- a/etc/profile-m-z/onionshare-gui.profile +++ b/etc/profile-m-z/onionshare-gui.profile | |||
@@ -50,7 +50,7 @@ novideo | |||
50 | protocol unix,inet,inet6 | 50 | protocol unix,inet,inet6 |
51 | seccomp | 51 | seccomp |
52 | seccomp.block-secondary | 52 | seccomp.block-secondary |
53 | #tracelog - may cause issues, see #1930 | 53 | #tracelog # may cause issues, see #1930 |
54 | 54 | ||
55 | disable-mnt | 55 | disable-mnt |
56 | private-bin onionshare,onionshare-cli,onionshare-gui,python*,tor* | 56 | private-bin onionshare,onionshare-cli,onionshare-gui,python*,tor* |
diff --git a/etc/profile-m-z/openclonk.profile b/etc/profile-m-z/openclonk.profile index 3449ac686..e10f6011b 100644 --- a/etc/profile-m-z/openclonk.profile +++ b/etc/profile-m-z/openclonk.profile | |||
@@ -24,7 +24,7 @@ include whitelist-var-common.inc | |||
24 | apparmor | 24 | apparmor |
25 | caps.drop all | 25 | caps.drop all |
26 | ipc-namespace | 26 | ipc-namespace |
27 | # net none - networked game | 27 | #net none # networked game |
28 | netfilter | 28 | netfilter |
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
diff --git a/etc/profile-m-z/orage.profile b/etc/profile-m-z/orage.profile index fa16c05e2..c4849b958 100644 --- a/etc/profile-m-z/orage.profile +++ b/etc/profile-m-z/orage.profile | |||
@@ -24,7 +24,7 @@ nogroups | |||
24 | noinput | 24 | noinput |
25 | nonewprivs | 25 | nonewprivs |
26 | noroot | 26 | noroot |
27 | # nosound - calendar application, It must be able to play sound to wake you up. | 27 | #nosound # calendar application, It must be able to play sound to wake you up. |
28 | notv | 28 | notv |
29 | nou2f | 29 | nou2f |
30 | novideo | 30 | novideo |
diff --git a/etc/profile-m-z/otter-browser.profile b/etc/profile-m-z/otter-browser.profile index a1c0462ba..76d4a2c52 100644 --- a/etc/profile-m-z/otter-browser.profile +++ b/etc/profile-m-z/otter-browser.profile | |||
@@ -57,4 +57,4 @@ private-tmp | |||
57 | 57 | ||
58 | dbus-system none | 58 | dbus-system none |
59 | 59 | ||
60 | # restrict-namespaces | 60 | #restrict-namespaces |
diff --git a/etc/profile-m-z/palemoon.profile b/etc/profile-m-z/palemoon.profile index ab4e24595..8917a9bc5 100644 --- a/etc/profile-m-z/palemoon.profile +++ b/etc/profile-m-z/palemoon.profile | |||
@@ -12,6 +12,7 @@ mkdir ${HOME}/.cache/moonchild productions/pale moon | |||
12 | mkdir ${HOME}/.moonchild productions | 12 | mkdir ${HOME}/.moonchild productions |
13 | whitelist ${HOME}/.cache/moonchild productions/pale moon | 13 | whitelist ${HOME}/.cache/moonchild productions/pale moon |
14 | whitelist ${HOME}/.moonchild productions | 14 | whitelist ${HOME}/.moonchild productions |
15 | whitelist /opt/palemoon | ||
15 | whitelist /usr/share/moonchild productions | 16 | whitelist /usr/share/moonchild productions |
16 | whitelist /usr/share/palemoon | 17 | whitelist /usr/share/palemoon |
17 | 18 | ||
@@ -22,7 +23,6 @@ ignore seccomp | |||
22 | #private-bin palemoon | 23 | #private-bin palemoon |
23 | # private-etc must first be enabled in firefox-common.profile | 24 | # private-etc must first be enabled in firefox-common.profile |
24 | #private-etc palemoon | 25 | #private-etc palemoon |
25 | #private-opt palemoon | ||
26 | 26 | ||
27 | restrict-namespaces | 27 | restrict-namespaces |
28 | ignore restrict-namespaces | 28 | ignore restrict-namespaces |
diff --git a/etc/profile-m-z/patch.profile b/etc/profile-m-z/patch.profile index 5a0f69f79..23e734b43 100644 --- a/etc/profile-m-z/patch.profile +++ b/etc/profile-m-z/patch.profile | |||
@@ -10,6 +10,7 @@ include globals.local | |||
10 | blacklist ${RUNUSER} | 10 | blacklist ${RUNUSER} |
11 | 11 | ||
12 | noblacklist ${DOCUMENTS} | 12 | noblacklist ${DOCUMENTS} |
13 | noblacklist ${PATH}/patch | ||
13 | 14 | ||
14 | include disable-common.inc | 15 | include disable-common.inc |
15 | include disable-devel.inc | 16 | include disable-devel.inc |
diff --git a/etc/profile-m-z/pavucontrol-qt.profile b/etc/profile-m-z/pavucontrol-qt.profile index f96ba14d2..79ed8777d 100644 --- a/etc/profile-m-z/pavucontrol-qt.profile +++ b/etc/profile-m-z/pavucontrol-qt.profile | |||
@@ -9,8 +9,9 @@ include pavucontrol-qt.local | |||
9 | 9 | ||
10 | noblacklist ${HOME}/.config/pavucontrol-qt | 10 | noblacklist ${HOME}/.config/pavucontrol-qt |
11 | 11 | ||
12 | mkdir ${HOME}/.config/pavucontrol-qt | 12 | # whitelisting in ${HOME} is broken, see #3112 |
13 | whitelist ${HOME}/.config/pavucontrol-qt | 13 | #mkdir ${HOME}/.config/pavucontrol-qt |
14 | #whitelist ${HOME}/.config/pavucontrol-qt | ||
14 | 15 | ||
15 | private-bin pavucontrol-qt | 16 | private-bin pavucontrol-qt |
16 | ignore private-lib | 17 | ignore private-lib |
diff --git a/etc/profile-m-z/pidgin.profile b/etc/profile-m-z/pidgin.profile index a852a2a18..5bc0bd700 100644 --- a/etc/profile-m-z/pidgin.profile +++ b/etc/profile-m-z/pidgin.profile | |||
@@ -40,7 +40,7 @@ protocol unix,inet,inet6,netlink | |||
40 | seccomp | 40 | seccomp |
41 | tracelog | 41 | tracelog |
42 | 42 | ||
43 | # private-bin pidgin | 43 | #private-bin pidgin |
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | private-tmp | 46 | private-tmp |
diff --git a/etc/profile-m-z/ping.profile b/etc/profile-m-z/ping.profile index 4520ac2fa..c3aa0a501 100644 --- a/etc/profile-m-z/ping.profile +++ b/etc/profile-m-z/ping.profile | |||
@@ -18,7 +18,7 @@ include disable-programs.inc | |||
18 | include disable-X11.inc | 18 | include disable-X11.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-common.inc | 21 | #include whitelist-common.inc # see #903 |
22 | include whitelist-run-common.inc | 22 | include whitelist-run-common.inc |
23 | include whitelist-runuser-common.inc | 23 | include whitelist-runuser-common.inc |
24 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
@@ -55,7 +55,7 @@ tracelog | |||
55 | 55 | ||
56 | disable-mnt | 56 | disable-mnt |
57 | private | 57 | private |
58 | #private-bin ping - has mammoth problems with execvp: "No such file or directory" | 58 | #private-bin ping # has mammoth problems with execvp: "No such file or directory" |
59 | private-cache | 59 | private-cache |
60 | private-dev | 60 | private-dev |
61 | private-etc @tls-ca | 61 | private-etc @tls-ca |
diff --git a/etc/profile-m-z/pluma.profile b/etc/profile-m-z/pluma.profile index efcdaa661..6e56208d5 100644 --- a/etc/profile-m-z/pluma.profile +++ b/etc/profile-m-z/pluma.profile | |||
@@ -21,10 +21,10 @@ include disable-shell.inc | |||
21 | 21 | ||
22 | include whitelist-var-common.inc | 22 | include whitelist-var-common.inc |
23 | 23 | ||
24 | # apparmor - makes settings immutable | 24 | #apparmor # makes settings immutable |
25 | caps.drop all | 25 | caps.drop all |
26 | machine-id | 26 | machine-id |
27 | # net none - makes settings immutable | 27 | #net none # makes settings immutable |
28 | no3d | 28 | no3d |
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
@@ -45,8 +45,8 @@ private-lib aspell,gconv,libgspell-1.so.*,libreadline.so.*,libtinfo.so.*,pluma | |||
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | # makes settings immutable | 47 | # makes settings immutable |
48 | # dbus-user none | 48 | #dbus-user none |
49 | # dbus-system none | 49 | #dbus-system none |
50 | 50 | ||
51 | restrict-namespaces | 51 | restrict-namespaces |
52 | join-or-start pluma | 52 | join-or-start pluma |
diff --git a/etc/profile-m-z/plv.profile b/etc/profile-m-z/plv.profile index 34e18cbd7..38fa01553 100644 --- a/etc/profile-m-z/plv.profile +++ b/etc/profile-m-z/plv.profile | |||
@@ -53,7 +53,7 @@ writable-var-log | |||
53 | dbus-user none | 53 | dbus-user none |
54 | dbus-system none | 54 | dbus-system none |
55 | 55 | ||
56 | #memory-deny-write-execute - breaks opening file-chooser | 56 | #memory-deny-write-execute # breaks opening file-chooser |
57 | read-only ${HOME} | 57 | read-only ${HOME} |
58 | read-write ${HOME}/.config/PacmanLogViewer | 58 | read-write ${HOME}/.config/PacmanLogViewer |
59 | read-only /var/log/pacman.log | 59 | read-only /var/log/pacman.log |
diff --git a/etc/profile-m-z/pnpm.profile b/etc/profile-m-z/pnpm.profile new file mode 100644 index 000000000..08f88be43 --- /dev/null +++ b/etc/profile-m-z/pnpm.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for pnpm | ||
2 | # Description: Fast, disk space efficient package manager | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include pnpm.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include nodejs-common.profile | ||
diff --git a/etc/profile-m-z/pnpx.profile b/etc/profile-m-z/pnpx.profile new file mode 100644 index 000000000..a99d1232a --- /dev/null +++ b/etc/profile-m-z/pnpx.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for pnpx | ||
2 | # Description: Part of the Node.js stack | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include pnpx.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include nodejs-common.profile | ||
diff --git a/etc/profile-m-z/postman.profile b/etc/profile-m-z/postman.profile index c8f00584d..a74b72695 100644 --- a/etc/profile-m-z/postman.profile +++ b/etc/profile-m-z/postman.profile | |||
@@ -17,7 +17,7 @@ include whitelist-run-common.inc | |||
17 | 17 | ||
18 | protocol unix,inet,inet6,netlink | 18 | protocol unix,inet,inet6,netlink |
19 | 19 | ||
20 | private-bin electron,electron[0-9],electron[0-9][0-9],locale,node,Postman,postman,sh | 20 | private-bin Postman,electron,electron[0-9],electron[0-9][0-9],locale,node,postman,sh |
21 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl | 21 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,nsswitch.conf,pki,resolv.conf,ssl |
22 | # private-opt breaks file-copy-limit, use a whitelist instead of draining RAM | 22 | # private-opt breaks file-copy-limit, use a whitelist instead of draining RAM |
23 | # https://github.com/netblue30/firejail/discussions/5307 | 23 | # https://github.com/netblue30/firejail/discussions/5307 |
diff --git a/etc/profile-m-z/ppsspp.profile b/etc/profile-m-z/ppsspp.profile index da16ae912..5ae6ccf04 100644 --- a/etc/profile-m-z/ppsspp.profile +++ b/etc/profile-m-z/ppsspp.profile | |||
@@ -39,7 +39,7 @@ novideo | |||
39 | protocol unix,netlink | 39 | protocol unix,netlink |
40 | seccomp | 40 | seccomp |
41 | 41 | ||
42 | private-bin ppsspp,PPSSPP,PPSSPPQt,PPSSPPSDL | 42 | private-bin PPSSPP,PPSSPPQt,PPSSPPSDL,ppsspp |
43 | # Add the next line to your ppsspp.local if you do not need controller support. | 43 | # Add the next line to your ppsspp.local if you do not need controller support. |
44 | #private-dev | 44 | #private-dev |
45 | private-etc @tls-ca,@x11,host.conf | 45 | private-etc @tls-ca,@x11,host.conf |
diff --git a/etc/profile-m-z/psi-plus.profile b/etc/profile-m-z/psi-plus.profile index af117c3b5..7a735bba7 100644 --- a/etc/profile-m-z/psi-plus.profile +++ b/etc/profile-m-z/psi-plus.profile | |||
@@ -43,4 +43,4 @@ disable-mnt | |||
43 | private-dev | 43 | private-dev |
44 | private-tmp | 44 | private-tmp |
45 | 45 | ||
46 | # restrict-namespaces | 46 | #restrict-namespaces |
diff --git a/etc/profile-m-z/psi.profile b/etc/profile-m-z/psi.profile index a1a0606b9..1417a87c9 100644 --- a/etc/profile-m-z/psi.profile +++ b/etc/profile-m-z/psi.profile | |||
@@ -62,7 +62,7 @@ novideo | |||
62 | nou2f | 62 | nou2f |
63 | protocol unix,inet,inet6,netlink | 63 | protocol unix,inet,inet6,netlink |
64 | seccomp !chroot | 64 | seccomp !chroot |
65 | #tracelog - breaks on Arch | 65 | #tracelog # breaks on Arch |
66 | 66 | ||
67 | disable-mnt | 67 | disable-mnt |
68 | # Add the next line to your psi.local to enable GPG support. | 68 | # Add the next line to your psi.local to enable GPG support. |
diff --git a/etc/profile-m-z/pycharm-community.profile b/etc/profile-m-z/pycharm-community.profile index 875b83e8e..fa307fc88 100644 --- a/etc/profile-m-z/pycharm-community.profile +++ b/etc/profile-m-z/pycharm-community.profile | |||
@@ -34,8 +34,8 @@ nou2f | |||
34 | novideo | 34 | novideo |
35 | tracelog | 35 | tracelog |
36 | 36 | ||
37 | # private-etc alternatives,fonts,passwd - minimal required to run but will probably break | 37 | # minimum required to run but will probably break the program! |
38 | # program! | 38 | #private-etc alternatives,fonts,passwd |
39 | private-dev | 39 | private-dev |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
diff --git a/etc/profile-m-z/qbittorrent.profile b/etc/profile-m-z/qbittorrent.profile index 9605da3ac..ae0a2cdf1 100644 --- a/etc/profile-m-z/qbittorrent.profile +++ b/etc/profile-m-z/qbittorrent.profile | |||
@@ -55,12 +55,12 @@ seccomp | |||
55 | 55 | ||
56 | private-bin python*,qbittorrent | 56 | private-bin python*,qbittorrent |
57 | private-dev | 57 | private-dev |
58 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg | 58 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,resolv.conf,ssl,X11,xdg |
59 | private-tmp | 59 | private-tmp |
60 | 60 | ||
61 | # See https://github.com/netblue30/firejail/issues/3707 for tray-icon | 61 | # See https://github.com/netblue30/firejail/issues/3707 for tray-icon |
62 | dbus-user none | 62 | dbus-user none |
63 | dbus-system none | 63 | dbus-system none |
64 | 64 | ||
65 | # memory-deny-write-execute - problems on Arch, see #1690 on GitHub repo | 65 | #memory-deny-write-execute # problems on Arch, see #1690 on GitHub repo |
66 | restrict-namespaces | 66 | restrict-namespaces |
diff --git a/etc/profile-m-z/qmmp.profile b/etc/profile-m-z/qmmp.profile index ecd62a7d1..66c8f3238 100644 --- a/etc/profile-m-z/qmmp.profile +++ b/etc/profile-m-z/qmmp.profile | |||
@@ -18,7 +18,7 @@ include disable-xdg.inc | |||
18 | 18 | ||
19 | caps.drop all | 19 | caps.drop all |
20 | netfilter | 20 | netfilter |
21 | # no3d | 21 | #no3d |
22 | nogroups | 22 | nogroups |
23 | noinput | 23 | noinput |
24 | nonewprivs | 24 | nonewprivs |
diff --git a/etc/profile-m-z/qpdfview.profile b/etc/profile-m-z/qpdfview.profile index 4caa0917f..784d2fafd 100644 --- a/etc/profile-m-z/qpdfview.profile +++ b/etc/profile-m-z/qpdfview.profile | |||
@@ -41,7 +41,7 @@ private-dev | |||
41 | private-tmp | 41 | private-tmp |
42 | 42 | ||
43 | # needs D-Bus when started from a file manager | 43 | # needs D-Bus when started from a file manager |
44 | # dbus-user none | 44 | #dbus-user none |
45 | # dbus-system none | 45 | #dbus-system none |
46 | 46 | ||
47 | restrict-namespaces | 47 | restrict-namespaces |
diff --git a/etc/profile-m-z/qtox.profile b/etc/profile-m-z/qtox.profile index ab0f9425a..20c84c5a8 100644 --- a/etc/profile-m-z/qtox.profile +++ b/etc/profile-m-z/qtox.profile | |||
@@ -48,5 +48,5 @@ private-tmp | |||
48 | dbus-user none | 48 | dbus-user none |
49 | dbus-system none | 49 | dbus-system none |
50 | 50 | ||
51 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 51 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
52 | restrict-namespaces | 52 | restrict-namespaces |
diff --git a/etc/profile-m-z/quassel.profile b/etc/profile-m-z/quassel.profile index 4589c9e4a..4ec990e95 100644 --- a/etc/profile-m-z/quassel.profile +++ b/etc/profile-m-z/quassel.profile | |||
@@ -25,4 +25,4 @@ seccomp !chroot | |||
25 | private-cache | 25 | private-cache |
26 | private-tmp | 26 | private-tmp |
27 | 27 | ||
28 | # restrict-namespaces | 28 | #restrict-namespaces |
diff --git a/etc/profile-m-z/quiterss.profile b/etc/profile-m-z/quiterss.profile index a59f01f85..4102b1ea0 100644 --- a/etc/profile-m-z/quiterss.profile +++ b/etc/profile-m-z/quiterss.profile | |||
@@ -50,6 +50,6 @@ tracelog | |||
50 | disable-mnt | 50 | disable-mnt |
51 | private-bin quiterss | 51 | private-bin quiterss |
52 | private-dev | 52 | private-dev |
53 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl,X11 | 53 | #private-etc alternatives,ca-certificates,crypto-policies,pki,ssl,X11 |
54 | 54 | ||
55 | restrict-namespaces | 55 | restrict-namespaces |
diff --git a/etc/profile-m-z/reader.profile b/etc/profile-m-z/reader.profile index 050c46d53..31c45fe84 100644 --- a/etc/profile-m-z/reader.profile +++ b/etc/profile-m-z/reader.profile | |||
@@ -17,7 +17,7 @@ include disable-programs.inc | |||
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | include whitelist-common.inc | 20 | #include whitelist-common.inc # see #903 |
21 | include whitelist-run-common.inc | 21 | include whitelist-run-common.inc |
22 | include whitelist-runuser-common.inc | 22 | include whitelist-runuser-common.inc |
23 | include whitelist-usr-share-common.inc | 23 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/rpcs3.profile b/etc/profile-m-z/rpcs3.profile index 405ab818d..603ec8ff4 100644 --- a/etc/profile-m-z/rpcs3.profile +++ b/etc/profile-m-z/rpcs3.profile | |||
@@ -54,7 +54,8 @@ tracelog | |||
54 | 54 | ||
55 | disable-mnt | 55 | disable-mnt |
56 | #private-cache | 56 | #private-cache |
57 | #private-etc alternatives,ca-certificates,crypto-policies,machine-id,pki,resolv.conf,ssl # seems to need awk | 57 | # seems to need awk |
58 | #private-etc alternatives,ca-certificates,crypto-policies,machine-id,pki,resolv.conf,ssl | ||
58 | private-tmp | 59 | private-tmp |
59 | 60 | ||
60 | dbus-user none | 61 | dbus-user none |
diff --git a/etc/profile-m-z/rssguard.profile b/etc/profile-m-z/rssguard.profile index 81381c205..ce455baba 100644 --- a/etc/profile-m-z/rssguard.profile +++ b/etc/profile-m-z/rssguard.profile | |||
@@ -31,13 +31,13 @@ include whitelist-var-common.inc | |||
31 | apparmor | 31 | apparmor |
32 | caps.drop all | 32 | caps.drop all |
33 | netfilter | 33 | netfilter |
34 | # no3d | 34 | #no3d |
35 | nodvd | 35 | nodvd |
36 | nogroups | 36 | nogroups |
37 | noinput | 37 | noinput |
38 | nonewprivs | 38 | nonewprivs |
39 | noroot | 39 | noroot |
40 | # nosound | 40 | #nosound |
41 | notv | 41 | notv |
42 | nou2f | 42 | nou2f |
43 | novideo | 43 | novideo |
diff --git a/etc/profile-m-z/rtv-addons.profile b/etc/profile-m-z/rtv-addons.profile index cc6db5043..3098cf0a0 100644 --- a/etc/profile-m-z/rtv-addons.profile +++ b/etc/profile-m-z/rtv-addons.profile | |||
@@ -11,13 +11,17 @@ ignore nosound | |||
11 | ignore private-bin | 11 | ignore private-bin |
12 | ignore dbus-user none | 12 | ignore dbus-user none |
13 | 13 | ||
14 | noblacklist ${HOME}/.cache/mpv | ||
14 | noblacklist ${HOME}/.config/mpv | 15 | noblacklist ${HOME}/.config/mpv |
16 | noblacklist ${HOME}/.local/state/mpv | ||
15 | noblacklist ${HOME}/.mailcap | 17 | noblacklist ${HOME}/.mailcap |
16 | noblacklist ${HOME}/.netrc | 18 | noblacklist ${HOME}/.netrc |
17 | noblacklist ${HOME}/.w3m | 19 | noblacklist ${HOME}/.w3m |
18 | 20 | ||
21 | whitelist ${HOME}/.cache/mpv | ||
19 | whitelist ${HOME}/.cache/youtube-dl/youtube-sigfuncs | 22 | whitelist ${HOME}/.cache/youtube-dl/youtube-sigfuncs |
20 | whitelist ${HOME}/.config/mpv | 23 | whitelist ${HOME}/.config/mpv |
24 | whitelist ${HOME}/.local/state/mpv | ||
21 | whitelist ${HOME}/.mailcap | 25 | whitelist ${HOME}/.mailcap |
22 | whitelist ${HOME}/.netrc | 26 | whitelist ${HOME}/.netrc |
23 | whitelist ${HOME}/.w3m | 27 | whitelist ${HOME}/.w3m |
diff --git a/etc/profile-m-z/scribus.profile b/etc/profile-m-z/scribus.profile index 34cf783fe..8e25375b0 100644 --- a/etc/profile-m-z/scribus.profile +++ b/etc/profile-m-z/scribus.profile | |||
@@ -55,7 +55,7 @@ protocol unix | |||
55 | seccomp | 55 | seccomp |
56 | tracelog | 56 | tracelog |
57 | 57 | ||
58 | # private-bin gimp*,gs,scribus | 58 | #private-bin gimp*,gs,scribus |
59 | private-dev | 59 | private-dev |
60 | private-tmp | 60 | private-tmp |
61 | 61 | ||
diff --git a/etc/profile-m-z/seahorse-adventures.profile b/etc/profile-m-z/seahorse-adventures.profile index 5985e0da3..49d98d9f5 100644 --- a/etc/profile-m-z/seahorse-adventures.profile +++ b/etc/profile-m-z/seahorse-adventures.profile | |||
@@ -23,7 +23,7 @@ include disable-xdg.inc | |||
23 | 23 | ||
24 | whitelist /usr/share/seahorse-adventures | 24 | whitelist /usr/share/seahorse-adventures |
25 | whitelist /usr/share/games/seahorse-adventures | 25 | whitelist /usr/share/games/seahorse-adventures |
26 | include whitelist-common.inc | 26 | #include whitelist-common.inc # see #903 |
27 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
28 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
29 | 29 | ||
diff --git a/etc/profile-m-z/seamonkey.profile b/etc/profile-m-z/seamonkey.profile index c2dbbc2c6..1171a52f0 100644 --- a/etc/profile-m-z/seamonkey.profile +++ b/etc/profile-m-z/seamonkey.profile | |||
@@ -55,7 +55,7 @@ seccomp | |||
55 | tracelog | 55 | tracelog |
56 | 56 | ||
57 | disable-mnt | 57 | disable-mnt |
58 | # private-etc adobe,alternatives,asound.conf,ca-certificates,crypto-policies,firefox,fonts,group,gtk-2.0,hostname,hosts,iceweasel,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl | 58 | #private-etc adobe,alternatives,asound.conf,ca-certificates,crypto-policies,firefox,fonts,group,gtk-2.0,hostname,hosts,iceweasel,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,ssl |
59 | writable-run-user | 59 | writable-run-user |
60 | 60 | ||
61 | restrict-namespaces | 61 | restrict-namespaces |
diff --git a/etc/profile-m-z/server.profile b/etc/profile-m-z/server.profile index 667f9c557..74587c992 100644 --- a/etc/profile-m-z/server.profile +++ b/etc/profile-m-z/server.profile | |||
@@ -34,36 +34,36 @@ include globals.local | |||
34 | noblacklist /sbin | 34 | noblacklist /sbin |
35 | noblacklist /usr/sbin | 35 | noblacklist /usr/sbin |
36 | noblacklist /etc/init.d | 36 | noblacklist /etc/init.d |
37 | # noblacklist /var/opt | 37 | #noblacklist /var/opt |
38 | 38 | ||
39 | blacklist /tmp/.X11-unix | 39 | blacklist /tmp/.X11-unix |
40 | blacklist ${RUNUSER}/wayland-* | 40 | blacklist ${RUNUSER}/wayland-* |
41 | 41 | ||
42 | include disable-common.inc | 42 | include disable-common.inc |
43 | # include disable-devel.inc | 43 | #include disable-devel.inc |
44 | # include disable-exec.inc | 44 | #include disable-exec.inc |
45 | # include disable-interpreters.inc | 45 | #include disable-interpreters.inc |
46 | include disable-programs.inc | 46 | include disable-programs.inc |
47 | include disable-write-mnt.inc | 47 | include disable-write-mnt.inc |
48 | include disable-xdg.inc | 48 | include disable-xdg.inc |
49 | 49 | ||
50 | # include whitelist-runuser-common.inc | 50 | #include whitelist-runuser-common.inc |
51 | # include whitelist-usr-share-common.inc | 51 | #include whitelist-usr-share-common.inc |
52 | # include whitelist-var-common.inc | 52 | #include whitelist-var-common.inc |
53 | 53 | ||
54 | # people use to install servers all over the place! | 54 | # people use to install servers all over the place! |
55 | # apparmor runs executable only from default system locations | 55 | # apparmor runs executable only from default system locations |
56 | # apparmor | 56 | #apparmor |
57 | caps | 57 | caps |
58 | # ipc-namespace | 58 | #ipc-namespace |
59 | machine-id | 59 | machine-id |
60 | # netfilter /etc/firejail/webserver.net | 60 | #netfilter /etc/firejail/webserver.net |
61 | no3d | 61 | no3d |
62 | nodvd | 62 | nodvd |
63 | # nogroups | 63 | #nogroups |
64 | noinput | 64 | noinput |
65 | nonewprivs | 65 | nonewprivs |
66 | # noroot | 66 | #noroot |
67 | nosound | 67 | nosound |
68 | notv | 68 | notv |
69 | nou2f | 69 | nou2f |
@@ -74,22 +74,22 @@ tab # allow tab completion | |||
74 | 74 | ||
75 | disable-mnt | 75 | disable-mnt |
76 | private | 76 | private |
77 | # private-bin program | 77 | #private-bin program |
78 | # private-cache | 78 | #private-cache |
79 | private-dev | 79 | private-dev |
80 | # see /usr/share/doc/firejail/profile.template for more common private-etc paths. | 80 | # see /usr/share/doc/firejail/profile.template for more common private-etc paths. |
81 | # private-etc alternatives | 81 | #private-etc alternatives |
82 | # private-lib | 82 | #private-lib |
83 | # private-opt none | 83 | #private-opt none |
84 | private-tmp | 84 | private-tmp |
85 | # writable-run-user | 85 | #writable-run-user |
86 | # writable-var | 86 | #writable-var |
87 | # writable-var-log | 87 | #writable-var-log |
88 | 88 | ||
89 | dbus-user none | 89 | dbus-user none |
90 | # dbus-system none | 90 | #dbus-system none |
91 | 91 | ||
92 | # deterministic-shutdown | 92 | #deterministic-shutdown |
93 | # memory-deny-write-execute | 93 | #memory-deny-write-execute |
94 | # read-only ${HOME} | 94 | #read-only ${HOME} |
95 | # restrict-namespaces | 95 | #restrict-namespaces |
diff --git a/etc/profile-m-z/silentarmy.profile b/etc/profile-m-z/silentarmy.profile index 96e4cf283..154e29ccf 100644 --- a/etc/profile-m-z/silentarmy.profile +++ b/etc/profile-m-z/silentarmy.profile | |||
@@ -7,7 +7,7 @@ include globals.local | |||
7 | 7 | ||
8 | 8 | ||
9 | include disable-common.inc | 9 | include disable-common.inc |
10 | # include disable-devel.inc | 10 | #include disable-devel.inc |
11 | include disable-exec.inc | 11 | include disable-exec.inc |
12 | include disable-interpreters.inc | 12 | include disable-interpreters.inc |
13 | include disable-programs.inc | 13 | include disable-programs.inc |
diff --git a/etc/profile-m-z/simple-scan.profile b/etc/profile-m-z/simple-scan.profile index 14846cf58..f8bcd3c6e 100644 --- a/etc/profile-m-z/simple-scan.profile +++ b/etc/profile-m-z/simple-scan.profile | |||
@@ -28,15 +28,15 @@ nonewprivs | |||
28 | noroot | 28 | noroot |
29 | nosound | 29 | nosound |
30 | notv | 30 | notv |
31 | # novideo | 31 | #novideo |
32 | protocol unix,inet,inet6,netlink | 32 | protocol unix,inet,inet6,netlink |
33 | # blacklisting of ioperm system calls breaks simple-scan | 33 | # blacklisting of ioperm system calls breaks simple-scan |
34 | seccomp !ioperm | 34 | seccomp !ioperm |
35 | tracelog | 35 | tracelog |
36 | 36 | ||
37 | # private-bin simple-scan | 37 | #private-bin simple-scan |
38 | # private-dev | 38 | #private-dev |
39 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl | 39 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,pki,ssl |
40 | # private-tmp | 40 | #private-tmp |
41 | 41 | ||
42 | restrict-namespaces | 42 | restrict-namespaces |
diff --git a/etc/profile-m-z/simutrans.profile b/etc/profile-m-z/simutrans.profile index f88ae65c8..995b59538 100644 --- a/etc/profile-m-z/simutrans.profile +++ b/etc/profile-m-z/simutrans.profile | |||
@@ -33,7 +33,7 @@ novideo | |||
33 | protocol unix | 33 | protocol unix |
34 | seccomp | 34 | seccomp |
35 | 35 | ||
36 | # private-bin simutrans | 36 | #private-bin simutrans |
37 | private-dev | 37 | private-dev |
38 | private-etc @games,@x11 | 38 | private-etc @games,@x11 |
39 | private-tmp | 39 | private-tmp |
diff --git a/etc/profile-m-z/skanlite.profile b/etc/profile-m-z/skanlite.profile index 6b73b2289..3b78f7fd2 100644 --- a/etc/profile-m-z/skanlite.profile +++ b/etc/profile-m-z/skanlite.profile | |||
@@ -22,16 +22,16 @@ nonewprivs | |||
22 | noroot | 22 | noroot |
23 | nosound | 23 | nosound |
24 | notv | 24 | notv |
25 | # novideo | 25 | #novideo |
26 | protocol unix,inet,inet6,netlink | 26 | protocol unix,inet,inet6,netlink |
27 | # blacklisting of ioperm system calls breaks skanlite | 27 | # blacklisting of ioperm system calls breaks skanlite |
28 | seccomp !ioperm | 28 | seccomp !ioperm |
29 | 29 | ||
30 | # private-bin kbuildsycoca4,kdeinit4,skanlite | 30 | #private-bin kbuildsycoca4,kdeinit4,skanlite |
31 | # private-dev | 31 | #private-dev |
32 | # private-tmp | 32 | #private-tmp |
33 | 33 | ||
34 | # dbus-user none | 34 | #dbus-user none |
35 | # dbus-system none | 35 | #dbus-system none |
36 | 36 | ||
37 | restrict-namespaces | 37 | restrict-namespaces |
diff --git a/etc/profile-m-z/smplayer.profile b/etc/profile-m-z/smplayer.profile index 9dd41fd27..ece191b73 100644 --- a/etc/profile-m-z/smplayer.profile +++ b/etc/profile-m-z/smplayer.profile | |||
@@ -36,7 +36,7 @@ include whitelist-var-common.inc | |||
36 | apparmor | 36 | apparmor |
37 | caps.drop all | 37 | caps.drop all |
38 | netfilter | 38 | netfilter |
39 | # nogroups | 39 | #nogroups |
40 | noinput | 40 | noinput |
41 | nonewprivs | 41 | nonewprivs |
42 | noroot | 42 | noroot |
@@ -49,7 +49,7 @@ private-dev | |||
49 | private-tmp | 49 | private-tmp |
50 | 50 | ||
51 | # problems with KDE | 51 | # problems with KDE |
52 | # dbus-user none | 52 | #dbus-user none |
53 | # dbus-system none | 53 | #dbus-system none |
54 | 54 | ||
55 | restrict-namespaces | 55 | restrict-namespaces |
diff --git a/etc/profile-m-z/smtube.profile b/etc/profile-m-z/smtube.profile index b617444af..7debd4057 100644 --- a/etc/profile-m-z/smtube.profile +++ b/etc/profile-m-z/smtube.profile | |||
@@ -6,12 +6,14 @@ include smtube.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/mpv | ||
10 | noblacklist ${HOME}/.config/mpv | ||
9 | noblacklist ${HOME}/.config/smplayer | 11 | noblacklist ${HOME}/.config/smplayer |
10 | noblacklist ${HOME}/.config/smtube | 12 | noblacklist ${HOME}/.config/smtube |
11 | noblacklist ${HOME}/.config/mpv | ||
12 | noblacklist ${HOME}/.mplayer | ||
13 | noblacklist ${HOME}/.config/vlc | 13 | noblacklist ${HOME}/.config/vlc |
14 | noblacklist ${HOME}/.local/share/vlc | 14 | noblacklist ${HOME}/.local/share/vlc |
15 | noblacklist ${HOME}/.local/state/mpv | ||
16 | noblacklist ${HOME}/.mplayer | ||
15 | noblacklist ${MUSIC} | 17 | noblacklist ${MUSIC} |
16 | noblacklist ${VIDEOS} | 18 | noblacklist ${VIDEOS} |
17 | 19 | ||
diff --git a/etc/profile-m-z/sniffnet.profile b/etc/profile-m-z/sniffnet.profile index eb18c1f01..940c35b2e 100644 --- a/etc/profile-m-z/sniffnet.profile +++ b/etc/profile-m-z/sniffnet.profile | |||
@@ -29,8 +29,8 @@ netfilter | |||
29 | nodvd | 29 | nodvd |
30 | nogroups | 30 | nogroups |
31 | noinput | 31 | noinput |
32 | # nonewprivs - breaks network traffic capture for unprivileged users | 32 | #nonewprivs # breaks network traffic capture for unprivileged users |
33 | # noroot | 33 | #noroot |
34 | notv | 34 | notv |
35 | nou2f | 35 | nou2f |
36 | novideo | 36 | novideo |
diff --git a/etc/profile-m-z/softmaker-common.profile b/etc/profile-m-z/softmaker-common.profile index 7ce6748d1..3a3a9062e 100644 --- a/etc/profile-m-z/softmaker-common.profile +++ b/etc/profile-m-z/softmaker-common.profile | |||
@@ -42,7 +42,7 @@ tracelog | |||
42 | private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free | 42 | private-bin freeoffice-planmaker,freeoffice-presentations,freeoffice-textmaker,planmaker18,planmaker18free,presentations18,presentations18free,sh,textmaker18,textmaker18free |
43 | private-cache | 43 | private-cache |
44 | private-dev | 44 | private-dev |
45 | private-etc @tls-ca,fstab,SoftMaker | 45 | private-etc @tls-ca,SoftMaker,fstab |
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | dbus-user none | 48 | dbus-user none |
diff --git a/etc/profile-m-z/sol.profile b/etc/profile-m-z/sol.profile index e2be4e9e0..07f9b0094 100644 --- a/etc/profile-m-z/sol.profile +++ b/etc/profile-m-z/sol.profile | |||
@@ -21,13 +21,13 @@ apparmor | |||
21 | caps.drop all | 21 | caps.drop all |
22 | ipc-namespace | 22 | ipc-namespace |
23 | net none | 23 | net none |
24 | # no3d | 24 | #no3d |
25 | nodvd | 25 | nodvd |
26 | nogroups | 26 | nogroups |
27 | noinput | 27 | noinput |
28 | nonewprivs | 28 | nonewprivs |
29 | noroot | 29 | noroot |
30 | # nosound | 30 | #nosound |
31 | notv | 31 | notv |
32 | nou2f | 32 | nou2f |
33 | novideo | 33 | novideo |
@@ -43,5 +43,5 @@ private-tmp | |||
43 | dbus-user none | 43 | dbus-user none |
44 | dbus-system none | 44 | dbus-system none |
45 | 45 | ||
46 | # memory-deny-write-execute | 46 | #memory-deny-write-execute |
47 | restrict-namespaces | 47 | restrict-namespaces |
diff --git a/etc/profile-m-z/sound-juicer.profile b/etc/profile-m-z/sound-juicer.profile index f5ac6c739..5c5763538 100644 --- a/etc/profile-m-z/sound-juicer.profile +++ b/etc/profile-m-z/sound-juicer.profile | |||
@@ -38,7 +38,7 @@ private-cache | |||
38 | private-dev | 38 | private-dev |
39 | private-tmp | 39 | private-tmp |
40 | 40 | ||
41 | # dbus-user none | 41 | #dbus-user none |
42 | # dbus-system none | 42 | #dbus-system none |
43 | 43 | ||
44 | restrict-namespaces | 44 | restrict-namespaces |
diff --git a/etc/profile-m-z/spotify.profile b/etc/profile-m-z/spotify.profile index c893a92fb..63c2c5086 100644 --- a/etc/profile-m-z/spotify.profile +++ b/etc/profile-m-z/spotify.profile | |||
@@ -26,6 +26,7 @@ whitelist ${HOME}/.cache/spotify | |||
26 | whitelist ${HOME}/.config/spotify | 26 | whitelist ${HOME}/.config/spotify |
27 | whitelist ${HOME}/.config/spotify-adblock | 27 | whitelist ${HOME}/.config/spotify-adblock |
28 | whitelist ${HOME}/.local/share/spotify | 28 | whitelist ${HOME}/.local/share/spotify |
29 | whitelist /opt/spotify | ||
29 | include whitelist-common.inc | 30 | include whitelist-common.inc |
30 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
31 | 32 | ||
@@ -48,7 +49,6 @@ private-bin bash,cat,dirname,find,grep,head,rm,sh,spotify,tclsh,touch,zenity | |||
48 | private-dev | 49 | private-dev |
49 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. | 50 | # If you want to see album covers or want to use the radio, add 'ignore private-etc' to your spotify.local. |
50 | private-etc @tls-ca,host.conf,spotify-adblock | 51 | private-etc @tls-ca,host.conf,spotify-adblock |
51 | private-opt spotify | ||
52 | private-srv none | 52 | private-srv none |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
diff --git a/etc/profile-m-z/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile index ce356367f..013c7ac13 100644 --- a/etc/profile-m-z/sqlitebrowser.profile +++ b/etc/profile-m-z/sqlitebrowser.profile | |||
@@ -46,8 +46,8 @@ private-etc @tls-ca | |||
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # breaks proxy creation | 48 | # breaks proxy creation |
49 | # dbus-user none | 49 | #dbus-user none |
50 | # dbus-system none | 50 | #dbus-system none |
51 | 51 | ||
52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 52 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
53 | restrict-namespaces | 53 | restrict-namespaces |
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile index a7956a76e..fde85be64 100644 --- a/etc/profile-m-z/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -32,10 +32,10 @@ nodvd | |||
32 | nogroups | 32 | nogroups |
33 | noinput | 33 | noinput |
34 | nonewprivs | 34 | nonewprivs |
35 | # noroot - see issue #1543 | 35 | #noroot # see issue #1543 |
36 | nosound | 36 | nosound |
37 | notv | 37 | notv |
38 | # nou2f - OpenSSH >= 8.2 supports U2F | 38 | #nou2f # OpenSSH >= 8.2 supports U2F |
39 | novideo | 39 | novideo |
40 | protocol unix,inet,inet6 | 40 | protocol unix,inet,inet6 |
41 | seccomp | 41 | seccomp |
@@ -43,7 +43,7 @@ tracelog | |||
43 | 43 | ||
44 | private-cache | 44 | private-cache |
45 | private-dev | 45 | private-dev |
46 | # private-tmp # Breaks when exiting | 46 | #private-tmp # Breaks when exiting |
47 | writable-run-user | 47 | writable-run-user |
48 | 48 | ||
49 | dbus-user none | 49 | dbus-user none |
diff --git a/etc/profile-m-z/ssmtp.profile b/etc/profile-m-z/ssmtp.profile index 1a224e7b0..b87f514f9 100644 --- a/etc/profile-m-z/ssmtp.profile +++ b/etc/profile-m-z/ssmtp.profile | |||
@@ -16,6 +16,7 @@ noblacklist /sbin | |||
16 | noblacklist /usr/sbin | 16 | noblacklist /usr/sbin |
17 | 17 | ||
18 | noblacklist ${DOCUMENTS} | 18 | noblacklist ${DOCUMENTS} |
19 | noblacklist ${PATH}/ssmtp | ||
19 | include disable-common.inc | 20 | include disable-common.inc |
20 | include disable-devel.inc | 21 | include disable-devel.inc |
21 | include disable-exec.inc | 22 | include disable-exec.inc |
diff --git a/etc/profile-m-z/standardnotes-desktop.profile b/etc/profile-m-z/standardnotes-desktop.profile index 3fe0963a9..fe4e4b6d7 100644 --- a/etc/profile-m-z/standardnotes-desktop.profile +++ b/etc/profile-m-z/standardnotes-desktop.profile | |||
@@ -47,4 +47,4 @@ private-etc @tls-ca,@x11,host.conf | |||
47 | dbus-user none | 47 | dbus-user none |
48 | dbus-system none | 48 | dbus-system none |
49 | 49 | ||
50 | # restrict-namespaces | 50 | #restrict-namespaces |
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile index 99317c9dc..41de746dd 100644 --- a/etc/profile-m-z/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -12,10 +12,12 @@ noblacklist ${HOME}/.config/MangoHud | |||
12 | noblacklist ${HOME}/.config/ModTheSpire | 12 | noblacklist ${HOME}/.config/ModTheSpire |
13 | noblacklist ${HOME}/.config/RogueLegacy | 13 | noblacklist ${HOME}/.config/RogueLegacy |
14 | noblacklist ${HOME}/.config/RogueLegacyStorageContainer | 14 | noblacklist ${HOME}/.config/RogueLegacyStorageContainer |
15 | noblacklist ${HOME}/.factorio | ||
15 | noblacklist ${HOME}/.killingfloor | 16 | noblacklist ${HOME}/.killingfloor |
16 | noblacklist ${HOME}/.klei | 17 | noblacklist ${HOME}/.klei |
17 | noblacklist ${HOME}/.local/share/3909/PapersPlease | 18 | noblacklist ${HOME}/.local/share/3909/PapersPlease |
18 | noblacklist ${HOME}/.local/share/aspyr-media | 19 | noblacklist ${HOME}/.local/share/aspyr-media |
20 | noblacklist ${HOME}/.local/share/Baba_Is_You | ||
19 | noblacklist ${HOME}/.local/share/bohemiainteractive | 21 | noblacklist ${HOME}/.local/share/bohemiainteractive |
20 | noblacklist ${HOME}/.local/share/cdprojektred | 22 | noblacklist ${HOME}/.local/share/cdprojektred |
21 | noblacklist ${HOME}/.local/share/Colossal Order | 23 | noblacklist ${HOME}/.local/share/Colossal Order |
@@ -64,10 +66,12 @@ mkdir ${HOME}/.config/MangoHud | |||
64 | mkdir ${HOME}/.config/ModTheSpire | 66 | mkdir ${HOME}/.config/ModTheSpire |
65 | mkdir ${HOME}/.config/RogueLegacy | 67 | mkdir ${HOME}/.config/RogueLegacy |
66 | mkdir ${HOME}/.config/unity3d | 68 | mkdir ${HOME}/.config/unity3d |
69 | mkdir ${HOME}/.factorio | ||
67 | mkdir ${HOME}/.killingfloor | 70 | mkdir ${HOME}/.killingfloor |
68 | mkdir ${HOME}/.klei | 71 | mkdir ${HOME}/.klei |
69 | mkdir ${HOME}/.local/share/3909/PapersPlease | 72 | mkdir ${HOME}/.local/share/3909/PapersPlease |
70 | mkdir ${HOME}/.local/share/aspyr-media | 73 | mkdir ${HOME}/.local/share/aspyr-media |
74 | mkdir ${HOME}/.local/share/Baba_Is_You | ||
71 | mkdir ${HOME}/.local/share/bohemiainteractive | 75 | mkdir ${HOME}/.local/share/bohemiainteractive |
72 | mkdir ${HOME}/.local/share/cdprojektred | 76 | mkdir ${HOME}/.local/share/cdprojektred |
73 | mkdir ${HOME}/.local/share/Colossal Order | 77 | mkdir ${HOME}/.local/share/Colossal Order |
@@ -100,10 +104,12 @@ whitelist ${HOME}/.config/ModTheSpire | |||
100 | whitelist ${HOME}/.config/RogueLegacy | 104 | whitelist ${HOME}/.config/RogueLegacy |
101 | whitelist ${HOME}/.config/RogueLegacyStorageContainer | 105 | whitelist ${HOME}/.config/RogueLegacyStorageContainer |
102 | whitelist ${HOME}/.config/unity3d | 106 | whitelist ${HOME}/.config/unity3d |
107 | whitelist ${HOME}/.factorio | ||
103 | whitelist ${HOME}/.killingfloor | 108 | whitelist ${HOME}/.killingfloor |
104 | whitelist ${HOME}/.klei | 109 | whitelist ${HOME}/.klei |
105 | whitelist ${HOME}/.local/share/3909/PapersPlease | 110 | whitelist ${HOME}/.local/share/3909/PapersPlease |
106 | whitelist ${HOME}/.local/share/aspyr-media | 111 | whitelist ${HOME}/.local/share/aspyr-media |
112 | whitelist ${HOME}/.local/share/Baba_Is_You | ||
107 | whitelist ${HOME}/.local/share/bohemiainteractive | 113 | whitelist ${HOME}/.local/share/bohemiainteractive |
108 | whitelist ${HOME}/.local/share/cdprojektred | 114 | whitelist ${HOME}/.local/share/cdprojektred |
109 | whitelist ${HOME}/.local/share/Colossal Order | 115 | whitelist ${HOME}/.local/share/Colossal Order |
@@ -157,7 +163,7 @@ protocol unix,inet,inet6,netlink | |||
157 | # Add 'ignore seccomp' to your steam.local if you experience this. | 163 | # Add 'ignore seccomp' to your steam.local if you experience this. |
158 | # mount, name_to_handle_at, pivot_root and umount2 are used by Proton >= 5.13 | 164 | # mount, name_to_handle_at, pivot_root and umount2 are used by Proton >= 5.13 |
159 | # (see #4366). | 165 | # (see #4366). |
160 | seccomp !chroot,!mount,!name_to_handle_at,!pivot_root,!ptrace,!umount2 | 166 | seccomp !chroot,!mount,!name_to_handle_at,!pivot_root,!process_vm_readv,!ptrace,!umount2 |
161 | # process_vm_readv is used by GE-Proton7-18 (see #5185). | 167 | # process_vm_readv is used by GE-Proton7-18 (see #5185). |
162 | seccomp.32 !process_vm_readv | 168 | seccomp.32 !process_vm_readv |
163 | # tracelog breaks integrated browser | 169 | # tracelog breaks integrated browser |
diff --git a/etc/profile-m-z/subdownloader.profile b/etc/profile-m-z/subdownloader.profile index 6de288c46..8b5d7e253 100644 --- a/etc/profile-m-z/subdownloader.profile +++ b/etc/profile-m-z/subdownloader.profile | |||
@@ -49,5 +49,5 @@ private-tmp | |||
49 | dbus-user none | 49 | dbus-user none |
50 | dbus-system none | 50 | dbus-system none |
51 | 51 | ||
52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 52 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
53 | restrict-namespaces | 53 | restrict-namespaces |
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile index 2ad107f1a..65aea6667 100644 --- a/etc/profile-m-z/supertux2.profile +++ b/etc/profile-m-z/supertux2.profile | |||
@@ -41,7 +41,7 @@ seccomp.block-secondary | |||
41 | tracelog | 41 | tracelog |
42 | 42 | ||
43 | disable-mnt | 43 | disable-mnt |
44 | # private-bin supertux2 | 44 | #private-bin supertux2 |
45 | private-cache | 45 | private-cache |
46 | private-etc | 46 | private-etc |
47 | private-dev | 47 | private-dev |
diff --git a/etc/profile-m-z/sushi.profile b/etc/profile-m-z/sushi.profile index 7b6a87b31..728db012e 100644 --- a/etc/profile-m-z/sushi.profile +++ b/etc/profile-m-z/sushi.profile | |||
@@ -13,7 +13,7 @@ include disable-common.inc | |||
13 | include disable-devel.inc | 13 | include disable-devel.inc |
14 | include disable-exec.inc | 14 | include disable-exec.inc |
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | # include disable-programs.inc | 16 | #include disable-programs.inc |
17 | include disable-shell.inc | 17 | include disable-shell.inc |
18 | 18 | ||
19 | include whitelist-runuser-common.inc | 19 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-m-z/sylpheed.profile b/etc/profile-m-z/sylpheed.profile index 5fb35aa04..7cef394c2 100644 --- a/etc/profile-m-z/sylpheed.profile +++ b/etc/profile-m-z/sylpheed.profile | |||
@@ -13,7 +13,7 @@ whitelist ${HOME}/.sylpheed-2.0 | |||
13 | 13 | ||
14 | whitelist /usr/share/sylpheed | 14 | whitelist /usr/share/sylpheed |
15 | 15 | ||
16 | # private-bin curl,gpg,gpg2,gpg-agent,gpgsm,pinentry,pinentry-gtk-2,sylpheed | 16 | #private-bin curl,gpg,gpg2,gpg-agent,gpgsm,pinentry,pinentry-gtk-2,sylpheed |
17 | 17 | ||
18 | # Redirect | 18 | # Redirect |
19 | include email-common.profile | 19 | include email-common.profile |
diff --git a/etc/profile-m-z/sysprof.profile b/etc/profile-m-z/sysprof.profile index 726baf336..b0a80fc27 100644 --- a/etc/profile-m-z/sysprof.profile +++ b/etc/profile-m-z/sysprof.profile | |||
@@ -59,11 +59,11 @@ seccomp | |||
59 | tracelog | 59 | tracelog |
60 | 60 | ||
61 | disable-mnt | 61 | disable-mnt |
62 | #private-bin sysprof - breaks help menu | 62 | #private-bin sysprof # breaks help menu |
63 | private-cache | 63 | private-cache |
64 | private-dev | 64 | private-dev |
65 | private-etc @tls-ca | 65 | private-etc @tls-ca |
66 | # private-lib - breaks help menu | 66 | #private-lib # breaks help menu |
67 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so | 67 | #private-lib gdk-pixbuf-2.*,gio,gtk3,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*,libsysprof-2.so,libsysprof-ui-2.so |
68 | private-tmp | 68 | private-tmp |
69 | 69 | ||
@@ -73,5 +73,5 @@ dbus-user.own org.gnome.Yelp | |||
73 | dbus-user.own org.gnome.Sysprof3 | 73 | dbus-user.own org.gnome.Sysprof3 |
74 | dbus-user.talk ca.desrt.dconf | 74 | dbus-user.talk ca.desrt.dconf |
75 | 75 | ||
76 | # memory-deny-write-execute - breaks on Arch | 76 | #memory-deny-write-execute # breaks on Arch |
77 | restrict-namespaces | 77 | restrict-namespaces |
diff --git a/etc/profile-m-z/system-log-common.profile b/etc/profile-m-z/system-log-common.profile new file mode 100644 index 000000000..dda8bdc47 --- /dev/null +++ b/etc/profile-m-z/system-log-common.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for system-log-common | ||
2 | # Description: Common profile for GUI system log viewers | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include system-log-common.local | ||
6 | # Persistent global definitions | ||
7 | # added by caller profile | ||
8 | #include globals.local | ||
9 | |||
10 | include disable-common.inc | ||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-proc.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | whitelist /run/log/journal | ||
20 | whitelist /var/log/journal | ||
21 | include whitelist-common.inc | ||
22 | include whitelist-run-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | ipc-namespace | ||
30 | net none | ||
31 | no3d | ||
32 | nodvd | ||
33 | #nogroups | ||
34 | noinput | ||
35 | nonewprivs | ||
36 | noprinters | ||
37 | #noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix | ||
43 | seccomp | ||
44 | seccomp.block-secondary | ||
45 | tracelog | ||
46 | |||
47 | disable-mnt | ||
48 | private-cache | ||
49 | private-dev | ||
50 | private-etc machine-id | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
55 | |||
56 | restrict-namespaces | ||
57 | # Add 'ignore read-only ${HOME}' to your system-log-common.local | ||
58 | # if you export logs to a file under your ${HOME}. | ||
59 | read-only ${HOME} | ||
60 | writable-var-log | ||
diff --git a/etc/profile-m-z/teamspeak3.profile b/etc/profile-m-z/teamspeak3.profile index 41da4ee13..06b547b3d 100644 --- a/etc/profile-m-z/teamspeak3.profile +++ b/etc/profile-m-z/teamspeak3.profile | |||
@@ -39,4 +39,4 @@ disable-mnt | |||
39 | private-dev | 39 | private-dev |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | # restrict-namespaces | 42 | #restrict-namespaces |
diff --git a/etc/profile-m-z/telegram.profile b/etc/profile-m-z/telegram.profile index ba915c2d4..7ed3d98d4 100644 --- a/etc/profile-m-z/telegram.profile +++ b/etc/profile-m-z/telegram.profile | |||
@@ -7,6 +7,7 @@ include globals.local | |||
7 | 7 | ||
8 | noblacklist ${HOME}/.TelegramDesktop | 8 | noblacklist ${HOME}/.TelegramDesktop |
9 | noblacklist ${HOME}/.local/share/TelegramDesktop | 9 | noblacklist ${HOME}/.local/share/TelegramDesktop |
10 | noblacklist ${HOME}/.local/share/telegram-desktop | ||
10 | 11 | ||
11 | # Allow opening hyperlinks | 12 | # Allow opening hyperlinks |
12 | include allow-bin-sh.inc | 13 | include allow-bin-sh.inc |
@@ -21,8 +22,10 @@ include disable-xdg.inc | |||
21 | 22 | ||
22 | mkdir ${HOME}/.TelegramDesktop | 23 | mkdir ${HOME}/.TelegramDesktop |
23 | mkdir ${HOME}/.local/share/TelegramDesktop | 24 | mkdir ${HOME}/.local/share/TelegramDesktop |
25 | mkdir ${HOME}/.local/share/telegram-desktop | ||
24 | whitelist ${HOME}/.TelegramDesktop | 26 | whitelist ${HOME}/.TelegramDesktop |
25 | whitelist ${HOME}/.local/share/TelegramDesktop | 27 | whitelist ${HOME}/.local/share/TelegramDesktop |
28 | whitelist ${HOME}/.local/share/telegram-desktop | ||
26 | whitelist ${DOWNLOADS} | 29 | whitelist ${DOWNLOADS} |
27 | whitelist /usr/share/TelegramDesktop | 30 | whitelist /usr/share/TelegramDesktop |
28 | include whitelist-common.inc | 31 | include whitelist-common.inc |
@@ -43,7 +46,7 @@ seccomp | |||
43 | seccomp.block-secondary | 46 | seccomp.block-secondary |
44 | 47 | ||
45 | disable-mnt | 48 | disable-mnt |
46 | private-bin bash,sh,telegram,Telegram,telegram-desktop,xdg-open | 49 | private-bin Telegram,bash,sh,telegram,telegram-desktop,xdg-open |
47 | private-cache | 50 | private-cache |
48 | private-dev | 51 | private-dev |
49 | private-etc @tls-ca,@x11,os-release | 52 | private-etc @tls-ca,@x11,os-release |
diff --git a/etc/profile-m-z/termshark.profile b/etc/profile-m-z/termshark.profile new file mode 100644 index 000000000..630d5dda6 --- /dev/null +++ b/etc/profile-m-z/termshark.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for termshark | ||
2 | # Description: Terminal UI for tshark, inspired by Wireshark | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include termshark.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | blacklist /tmp/.X11-unix | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
14 | # Redirect | ||
15 | include wireshark.profile | ||
diff --git a/etc/profile-m-z/tesseract.profile b/etc/profile-m-z/tesseract.profile index 5babfb8d2..c0293406d 100644 --- a/etc/profile-m-z/tesseract.profile +++ b/etc/profile-m-z/tesseract.profile | |||
@@ -26,6 +26,7 @@ include whitelist-common.inc | |||
26 | include whitelist-run-common.inc | 26 | include whitelist-run-common.inc |
27 | include whitelist-runuser-common.inc | 27 | include whitelist-runuser-common.inc |
28 | whitelist /usr/share/tessdata | 28 | whitelist /usr/share/tessdata |
29 | whitelist /usr/share/tesseract-ocr | ||
29 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
30 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
31 | 32 | ||
diff --git a/etc/profile-m-z/thunderbird-beta.profile b/etc/profile-m-z/thunderbird-beta.profile index 46a1e57c8..e01a9d2d8 100644 --- a/etc/profile-m-z/thunderbird-beta.profile +++ b/etc/profile-m-z/thunderbird-beta.profile | |||
@@ -6,7 +6,7 @@ include thunderbird-beta.local | |||
6 | # added by included profile | 6 | # added by included profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | private-opt thunderbird-beta | 9 | whitelist /opt/thunderbird-beta |
10 | 10 | ||
11 | # Redirect | 11 | # Redirect |
12 | include thunderbird.profile | 12 | include thunderbird.profile |
diff --git a/etc/profile-m-z/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index 17e2f0856..979971ac2 100644 --- a/etc/profile-m-z/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile | |||
@@ -35,7 +35,7 @@ whitelist ${HOME}/.mozilla/firefox/profiles.ini | |||
35 | 35 | ||
36 | noblacklist ${HOME}/.cache/thunderbird | 36 | noblacklist ${HOME}/.cache/thunderbird |
37 | noblacklist ${HOME}/.gnupg | 37 | noblacklist ${HOME}/.gnupg |
38 | # noblacklist ${HOME}/.icedove | 38 | #noblacklist ${HOME}/.icedove |
39 | noblacklist ${HOME}/.thunderbird | 39 | noblacklist ${HOME}/.thunderbird |
40 | 40 | ||
41 | include disable-xdg.inc | 41 | include disable-xdg.inc |
@@ -46,11 +46,11 @@ include disable-xdg.inc | |||
46 | # See https://github.com/netblue30/firejail/issues/2357 | 46 | # See https://github.com/netblue30/firejail/issues/2357 |
47 | mkdir ${HOME}/.cache/thunderbird | 47 | mkdir ${HOME}/.cache/thunderbird |
48 | mkdir ${HOME}/.gnupg | 48 | mkdir ${HOME}/.gnupg |
49 | # mkdir ${HOME}/.icedove | 49 | #mkdir ${HOME}/.icedove |
50 | mkdir ${HOME}/.thunderbird | 50 | mkdir ${HOME}/.thunderbird |
51 | whitelist ${HOME}/.cache/thunderbird | 51 | whitelist ${HOME}/.cache/thunderbird |
52 | whitelist ${HOME}/.gnupg | 52 | whitelist ${HOME}/.gnupg |
53 | # whitelist ${HOME}/.icedove | 53 | #whitelist ${HOME}/.icedove |
54 | whitelist ${HOME}/.thunderbird | 54 | whitelist ${HOME}/.thunderbird |
55 | 55 | ||
56 | whitelist /usr/share/gnupg | 56 | whitelist /usr/share/gnupg |
diff --git a/etc/profile-m-z/tidal-hifi.profile b/etc/profile-m-z/tidal-hifi.profile new file mode 100644 index 000000000..d2e23239e --- /dev/null +++ b/etc/profile-m-z/tidal-hifi.profile | |||
@@ -0,0 +1,39 @@ | |||
1 | # Firejail profile for tidal-hifi | ||
2 | # Description: The web version of Tidal running in electron with hifi support thanks to widevine. | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include tidal-hifi.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore noexec ${HOME} | ||
10 | |||
11 | noblacklist ${HOME}/.config/tidal-hifi | ||
12 | |||
13 | include disable-proc.inc | ||
14 | include disable-shell.inc | ||
15 | |||
16 | whitelist ${HOME}/.config/tidal-hifi | ||
17 | |||
18 | caps.drop all | ||
19 | no3d | ||
20 | nonewprivs | ||
21 | noprinters | ||
22 | noroot | ||
23 | protocol unix,inet,inet6 | ||
24 | seccomp !chroot | ||
25 | seccomp.block-secondary | ||
26 | tracelog | ||
27 | |||
28 | private-bin chrome-sandbox,tidal-hifi | ||
29 | private-etc @network,@sound,@tls-ca,@xdg | ||
30 | private-opt tidal-hifi | ||
31 | |||
32 | ignore dbus-user none | ||
33 | dbus-user filter | ||
34 | dbus-user.own org.mpris.MediaPlayer2.tidal-hifi | ||
35 | dbus-user.talk org.freedesktop.Notifications | ||
36 | |||
37 | join-or-start tidal-hifi | ||
38 | |||
39 | include electron-common.profile | ||
diff --git a/etc/profile-m-z/tiny-rdm.profile b/etc/profile-m-z/tiny-rdm.profile new file mode 100644 index 000000000..4134d666c --- /dev/null +++ b/etc/profile-m-z/tiny-rdm.profile | |||
@@ -0,0 +1,61 @@ | |||
1 | # Firejail profile for tiny-rdm | ||
2 | # Description: A Modern Redis GUI Client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include tiny-rdm.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/tiny-rdm | ||
10 | noblacklist ${HOME}/.config/TinyRDM | ||
11 | |||
12 | include disable-common.inc | ||
13 | include disable-devel.inc | ||
14 | include disable-exec.inc | ||
15 | include disable-interpreters.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-proc.inc | ||
18 | include disable-shell.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.cache/tiny-rdm | ||
22 | mkdir ${HOME}/.config/TinyRDM | ||
23 | whitelist ${HOME}/.cache/tiny-rdm | ||
24 | whitelist ${HOME}/.config/TinyRDM | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-run-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | apparmor | ||
32 | caps.drop all | ||
33 | ipc-namespace | ||
34 | netfilter | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | noinput | ||
39 | nonewprivs | ||
40 | noprinters | ||
41 | noroot | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | nosound | ||
46 | protocol unix,inet,inet6 | ||
47 | seccomp | ||
48 | seccomp.block-secondary | ||
49 | tracelog | ||
50 | |||
51 | disable-mnt | ||
52 | private-bin tiny-rdm | ||
53 | private-cache | ||
54 | private-dev | ||
55 | private-etc @network,@tls-ca,@x11 | ||
56 | private-tmp | ||
57 | |||
58 | dbus-user none | ||
59 | dbus-system none | ||
60 | |||
61 | restrict-namespaces | ||
diff --git a/etc/profile-m-z/tmux.profile b/etc/profile-m-z/tmux.profile index a855ff839..ddd2aa85f 100644 --- a/etc/profile-m-z/tmux.profile +++ b/etc/profile-m-z/tmux.profile | |||
@@ -12,10 +12,10 @@ blacklist ${RUNUSER} | |||
12 | 12 | ||
13 | noblacklist /tmp/tmux-* | 13 | noblacklist /tmp/tmux-* |
14 | 14 | ||
15 | # include disable-common.inc | 15 | #include disable-common.inc |
16 | # include disable-devel.inc | 16 | #include disable-devel.inc |
17 | # include disable-exec.inc | 17 | #include disable-exec.inc |
18 | # include disable-programs.inc | 18 | #include disable-programs.inc |
19 | 19 | ||
20 | caps.drop all | 20 | caps.drop all |
21 | ipc-namespace | 21 | ipc-namespace |
@@ -36,9 +36,9 @@ seccomp | |||
36 | seccomp.block-secondary | 36 | seccomp.block-secondary |
37 | tracelog | 37 | tracelog |
38 | 38 | ||
39 | # private-cache | 39 | #private-cache |
40 | private-dev | 40 | private-dev |
41 | # private-tmp | 41 | #private-tmp |
42 | 42 | ||
43 | dbus-user none | 43 | dbus-user none |
44 | dbus-system none | 44 | dbus-system none |
diff --git a/etc/profile-m-z/torbrowser-launcher.profile b/etc/profile-m-z/torbrowser-launcher.profile index 86746c7f1..b9fdcf92c 100644 --- a/etc/profile-m-z/torbrowser-launcher.profile +++ b/etc/profile-m-z/torbrowser-launcher.profile | |||
@@ -56,13 +56,12 @@ novideo | |||
56 | protocol unix,inet,inet6 | 56 | protocol unix,inet,inet6 |
57 | seccomp !chroot | 57 | seccomp !chroot |
58 | seccomp.block-secondary | 58 | seccomp.block-secondary |
59 | #tracelog - may cause issues, see #1930 | 59 | #tracelog # may cause issues, see #1930 |
60 | 60 | ||
61 | disable-mnt | 61 | disable-mnt |
62 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity | 62 | private-bin bash,cat,cp,cut,dirname,env,expr,file,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,python*,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity |
63 | private-dev | 63 | private-dev |
64 | private-etc @tls-ca | 64 | private-etc @tls-ca |
65 | #private-opt tor-browser - can cause slow startup | ||
66 | private-tmp | 65 | private-tmp |
67 | 66 | ||
68 | dbus-user none | 67 | dbus-user none |
diff --git a/etc/profile-m-z/totem.profile b/etc/profile-m-z/totem.profile index a4cb49171..73d3b0b6f 100644 --- a/etc/profile-m-z/totem.profile +++ b/etc/profile-m-z/totem.profile | |||
@@ -35,7 +35,7 @@ include whitelist-runuser-common.inc | |||
35 | include whitelist-usr-share-common.inc | 35 | include whitelist-usr-share-common.inc |
36 | include whitelist-var-common.inc | 36 | include whitelist-var-common.inc |
37 | 37 | ||
38 | # apparmor - makes settings immutable | 38 | #apparmor # makes settings immutable |
39 | caps.drop all | 39 | caps.drop all |
40 | netfilter | 40 | netfilter |
41 | nogroups | 41 | nogroups |
@@ -55,7 +55,7 @@ private-etc @tls-ca,@x11,python* | |||
55 | private-tmp | 55 | private-tmp |
56 | 56 | ||
57 | # makes settings immutable | 57 | # makes settings immutable |
58 | # dbus-user none | 58 | #dbus-user none |
59 | dbus-system none | 59 | dbus-system none |
60 | 60 | ||
61 | restrict-namespaces | 61 | restrict-namespaces |
diff --git a/etc/profile-m-z/tracker.profile b/etc/profile-m-z/tracker.profile index f30b0aef6..c46b00fc9 100644 --- a/etc/profile-m-z/tracker.profile +++ b/etc/profile-m-z/tracker.profile | |||
@@ -33,8 +33,8 @@ protocol unix | |||
33 | seccomp | 33 | seccomp |
34 | tracelog | 34 | tracelog |
35 | 35 | ||
36 | # private-bin tracker | 36 | #private-bin tracker |
37 | # private-dev | 37 | #private-dev |
38 | # private-tmp | 38 | #private-tmp |
39 | 39 | ||
40 | restrict-namespaces | 40 | restrict-namespaces |
diff --git a/etc/profile-m-z/transgui.profile b/etc/profile-m-z/transgui.profile index 645c55c3b..bac48805c 100644 --- a/etc/profile-m-z/transgui.profile +++ b/etc/profile-m-z/transgui.profile | |||
@@ -12,6 +12,7 @@ include disable-common.inc | |||
12 | include disable-devel.inc | 12 | include disable-devel.inc |
13 | include disable-exec.inc | 13 | include disable-exec.inc |
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-proc.inc | ||
15 | include disable-programs.inc | 16 | include disable-programs.inc |
16 | include disable-shell.inc | 17 | include disable-shell.inc |
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
@@ -19,7 +20,10 @@ include disable-xdg.inc | |||
19 | mkdir ${HOME}/.config/transgui | 20 | mkdir ${HOME}/.config/transgui |
20 | whitelist ${HOME}/.config/transgui | 21 | whitelist ${HOME}/.config/transgui |
21 | whitelist ${DOWNLOADS} | 22 | whitelist ${DOWNLOADS} |
23 | whitelist /usr/share/transgui | ||
22 | include whitelist-common.inc | 24 | include whitelist-common.inc |
25 | include whitelist-run-common.inc | ||
26 | include whitelist-runuser-common.inc | ||
23 | include whitelist-usr-share-common.inc | 27 | include whitelist-usr-share-common.inc |
24 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
25 | 29 | ||
@@ -44,8 +48,8 @@ tracelog | |||
44 | private-bin geoiplookup,geoiplookup6,transgui | 48 | private-bin geoiplookup,geoiplookup6,transgui |
45 | private-cache | 49 | private-cache |
46 | private-dev | 50 | private-dev |
47 | private-etc | 51 | private-etc @network,@tls-ca,@x11 |
48 | private-lib libgdk_pixbuf-2.0.so.*,libGeoIP.so*,libgthread-2.0.so.*,libgtk-x11-2.0.so.*,libX11.so.* | 52 | private-lib libGeoIP.so*,libX11.so.*,libgdk_pixbuf-2.0.so.*,libgthread-2.0.so.*,libgtk-x11-2.0.so.* |
49 | private-tmp | 53 | private-tmp |
50 | 54 | ||
51 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile index 2578eb0be..5e9e7f127 100644 --- a/etc/profile-m-z/trojita.profile +++ b/etc/profile-m-z/trojita.profile | |||
@@ -52,7 +52,7 @@ protocol unix,inet,inet6,netlink | |||
52 | seccomp | 52 | seccomp |
53 | tracelog | 53 | tracelog |
54 | 54 | ||
55 | # disable-mnt | 55 | #disable-mnt |
56 | private-bin trojita | 56 | private-bin trojita |
57 | private-cache | 57 | private-cache |
58 | private-dev | 58 | private-dev |
diff --git a/etc/profile-m-z/tshark.profile b/etc/profile-m-z/tshark.profile index 3f5a9647e..f2273e6a7 100644 --- a/etc/profile-m-z/tshark.profile +++ b/etc/profile-m-z/tshark.profile | |||
@@ -7,5 +7,8 @@ include tshark.local | |||
7 | # added by included profile | 7 | # added by included profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER} | ||
12 | |||
10 | # Redirect | 13 | # Redirect |
11 | include wireshark.profile | 14 | include wireshark.profile |
diff --git a/etc/profile-m-z/tutanota-desktop.profile b/etc/profile-m-z/tutanota-desktop.profile index 55e4a4392..f0a0cacaf 100644 --- a/etc/profile-m-z/tutanota-desktop.profile +++ b/etc/profile-m-z/tutanota-desktop.profile | |||
@@ -22,6 +22,7 @@ mkdir ${HOME}/.config/tuta_integration | |||
22 | mkdir ${HOME}/.config/tutanota-desktop | 22 | mkdir ${HOME}/.config/tutanota-desktop |
23 | whitelist ${HOME}/.config/tuta_integration | 23 | whitelist ${HOME}/.config/tuta_integration |
24 | whitelist ${HOME}/.config/tutanota-desktop | 24 | whitelist ${HOME}/.config/tutanota-desktop |
25 | whitelist /opt/tutanota-desktop | ||
25 | 26 | ||
26 | # The lines below are needed to find the default Firefox profile name, to allow | 27 | # The lines below are needed to find the default Firefox profile name, to allow |
27 | # opening links in an existing instance of Firefox (note that it still fails if | 28 | # opening links in an existing instance of Firefox (note that it still fails if |
@@ -34,7 +35,6 @@ nosound | |||
34 | 35 | ||
35 | ?HAS_APPIMAGE: ignore private-dev | 36 | ?HAS_APPIMAGE: ignore private-dev |
36 | private-etc @tls-ca | 37 | private-etc @tls-ca |
37 | private-opt tutanota-desktop | ||
38 | 38 | ||
39 | dbus-user filter | 39 | dbus-user filter |
40 | dbus-user.talk org.freedesktop.Notifications | 40 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-m-z/tvbrowser.profile b/etc/profile-m-z/tvbrowser.profile index 518dc95c7..16162f989 100644 --- a/etc/profile-m-z/tvbrowser.profile +++ b/etc/profile-m-z/tvbrowser.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for tvbrowser | 1 | # Firejail profile for tvbrowser |
2 | # Description: java tv programm form tvbrowser.org | 2 | # Description: java tv program form tvbrowser.org |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include tvbrowser.local | 5 | include tvbrowser.local |
diff --git a/etc/profile-m-z/twitch.profile b/etc/profile-m-z/twitch.profile index d53acdaf7..55106d622 100644 --- a/etc/profile-m-z/twitch.profile +++ b/etc/profile-m-z/twitch.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for twitch | 1 | # Firejail profile for twitch |
2 | # Description: Unofficial electron based desktop warpper for Twitch | 2 | # Description: Unofficial electron based desktop wrapper for Twitch |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include twitch.local | 5 | include twitch.local |
@@ -16,10 +16,10 @@ include disable-shell.inc | |||
16 | 16 | ||
17 | mkdir ${HOME}/.config/Twitch | 17 | mkdir ${HOME}/.config/Twitch |
18 | whitelist ${HOME}/.config/Twitch | 18 | whitelist ${HOME}/.config/Twitch |
19 | whitelist /opt/Twitch | ||
19 | 20 | ||
20 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch | 21 | private-bin electron,electron[0-9],electron[0-9][0-9],twitch |
21 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 22 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
22 | private-opt Twitch | ||
23 | 23 | ||
24 | # Redirect | 24 | # Redirect |
25 | include electron-common.profile | 25 | include electron-common.profile |
diff --git a/etc/profile-m-z/udiskie.profile b/etc/profile-m-z/udiskie.profile index c182326bb..175ae4591 100644 --- a/etc/profile-m-z/udiskie.profile +++ b/etc/profile-m-z/udiskie.profile | |||
@@ -36,8 +36,8 @@ tracelog | |||
36 | 36 | ||
37 | private-bin awk,cut,dbus-send,egrep,file,grep,head,python*,readlink,sed,sh,udiskie,uname,which,xdg-mime,xdg-open,xprop | 37 | private-bin awk,cut,dbus-send,egrep,file,grep,head,python*,readlink,sed,sh,udiskie,uname,which,xdg-mime,xdg-open,xprop |
38 | # add your configured file browser in udiskie.local, e. g. | 38 | # add your configured file browser in udiskie.local, e. g. |
39 | # private-bin nautilus | 39 | #private-bin nautilus |
40 | # private-bin thunar | 40 | #private-bin thunar |
41 | private-cache | 41 | private-cache |
42 | private-dev | 42 | private-dev |
43 | private-etc @x11,mime.types | 43 | private-etc @x11,mime.types |
diff --git a/etc/profile-m-z/unknown-horizons.profile b/etc/profile-m-z/unknown-horizons.profile index 3e2b28dec..4e7dc3705 100644 --- a/etc/profile-m-z/unknown-horizons.profile +++ b/etc/profile-m-z/unknown-horizons.profile | |||
@@ -34,11 +34,11 @@ protocol unix,inet,inet6,netlink | |||
34 | seccomp | 34 | seccomp |
35 | 35 | ||
36 | disable-mnt | 36 | disable-mnt |
37 | # private-bin unknown-horizons | 37 | #private-bin unknown-horizons |
38 | private-dev | 38 | private-dev |
39 | # private-etc alternatives,ca-certificates,crypto-policies,pki,ssl | 39 | #private-etc alternatives,ca-certificates,crypto-policies,pki,ssl |
40 | private-tmp | 40 | private-tmp |
41 | 41 | ||
42 | # doesn't work - maybe all Tcl/Tk programs have this problem | 42 | # doesn't work - maybe all Tcl/Tk programs have this problem |
43 | # memory-deny-write-execute | 43 | #memory-deny-write-execute |
44 | restrict-namespaces | 44 | restrict-namespaces |
diff --git a/etc/profile-m-z/viewnior.profile b/etc/profile-m-z/viewnior.profile index aa8199442..8c6efaa1c 100644 --- a/etc/profile-m-z/viewnior.profile +++ b/etc/profile-m-z/viewnior.profile | |||
@@ -49,5 +49,5 @@ private-tmp | |||
49 | dbus-user none | 49 | dbus-user none |
50 | dbus-system none | 50 | dbus-system none |
51 | 51 | ||
52 | #memory-deny-write-execute - breaks on Arch (see issues #1803 and #1808) | 52 | #memory-deny-write-execute # breaks on Arch (see issues #1803 and #1808) |
53 | restrict-namespaces | 53 | restrict-namespaces |
diff --git a/etc/profile-m-z/virtualbox.profile b/etc/profile-m-z/virtualbox.profile index ae8afbbf1..b768a635a 100644 --- a/etc/profile-m-z/virtualbox.profile +++ b/etc/profile-m-z/virtualbox.profile | |||
@@ -9,7 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.VirtualBox | 9 | noblacklist ${HOME}/.VirtualBox |
10 | noblacklist ${HOME}/.config/VirtualBox | 10 | noblacklist ${HOME}/.config/VirtualBox |
11 | noblacklist ${HOME}/VirtualBox VMs | 11 | noblacklist ${HOME}/VirtualBox VMs |
12 | # noblacklist /usr/bin/virtualbox | 12 | #noblacklist /usr/bin/virtualbox |
13 | noblacklist /usr/lib/virtualbox | 13 | noblacklist /usr/lib/virtualbox |
14 | noblacklist /usr/lib64/virtualbox | 14 | noblacklist /usr/lib64/virtualbox |
15 | 15 | ||
diff --git a/etc/profile-m-z/warzone2100.profile b/etc/profile-m-z/warzone2100.profile index 79ba41d44..a7b0f5f1d 100644 --- a/etc/profile-m-z/warzone2100.profile +++ b/etc/profile-m-z/warzone2100.profile | |||
@@ -15,7 +15,7 @@ include disable-devel.inc | |||
15 | include disable-exec.inc | 15 | include disable-exec.inc |
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | #include disable-shell.inc - problems on Debian 11 | 18 | #include disable-shell.inc # problems on Debian 11 |
19 | 19 | ||
20 | mkdir ${HOME}/.local/share/warzone2100 | 20 | mkdir ${HOME}/.local/share/warzone2100 |
21 | mkdir ${HOME}/.local/share/warzone2100-3.3.0 | 21 | mkdir ${HOME}/.local/share/warzone2100-3.3.0 |
diff --git a/etc/profile-m-z/wine.profile b/etc/profile-m-z/wine.profile index 1e2b164b9..33f404464 100644 --- a/etc/profile-m-z/wine.profile +++ b/etc/profile-m-z/wine.profile | |||
@@ -20,23 +20,23 @@ include disable-devel.inc | |||
20 | include disable-interpreters.inc | 20 | include disable-interpreters.inc |
21 | include disable-programs.inc | 21 | include disable-programs.inc |
22 | 22 | ||
23 | # whitelist /usr/share/wine | 23 | #whitelist /usr/share/wine |
24 | # include whitelist-usr-share-common.inc | 24 | #include whitelist-usr-share-common.inc |
25 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
26 | 26 | ||
27 | # Some applications don't need allow-debuggers. Add 'ignore allow-debuggers' to your wine.local if you want to override this. | 27 | # Some applications don't need allow-debuggers. Add 'ignore allow-debuggers' to your wine.local if you want to override this. |
28 | allow-debuggers | 28 | allow-debuggers |
29 | caps.drop all | 29 | caps.drop all |
30 | # net none | 30 | #net none |
31 | netfilter | 31 | netfilter |
32 | nodvd | 32 | nodvd |
33 | nogroups | 33 | nogroups |
34 | noinput | 34 | noinput |
35 | nonewprivs | 35 | nonewprivs |
36 | noroot | 36 | noroot |
37 | # nosound | 37 | #nosound |
38 | notv | 38 | notv |
39 | # novideo | 39 | #novideo |
40 | seccomp | 40 | seccomp |
41 | 41 | ||
42 | private-dev | 42 | private-dev |
diff --git a/etc/profile-m-z/wireshark.profile b/etc/profile-m-z/wireshark.profile index d1b757a25..55c4e6ac7 100644 --- a/etc/profile-m-z/wireshark.profile +++ b/etc/profile-m-z/wireshark.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.config/wireshark | 9 | noblacklist ${HOME}/.config/wireshark |
10 | noblacklist ${HOME}/.wireshark | 10 | noblacklist ${HOME}/.wireshark |
11 | noblacklist ${DOCUMENTS} | 11 | noblacklist ${DOCUMENTS} |
12 | noblacklist ${PATH}/dumpcap | ||
12 | 13 | ||
13 | # Allow lua (blacklisted by disable-interpreters.inc) | 14 | # Allow lua (blacklisted by disable-interpreters.inc) |
14 | include allow-lua.inc | 15 | include allow-lua.inc |
@@ -25,29 +26,30 @@ include whitelist-usr-share-common.inc | |||
25 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
26 | 27 | ||
27 | apparmor | 28 | apparmor |
28 | # caps.drop all | 29 | #caps.drop all |
29 | caps.keep dac_override,dac_read_search,net_admin,net_raw | 30 | caps.keep dac_override,dac_read_search,net_admin,net_raw |
30 | netfilter | 31 | netfilter |
31 | no3d | 32 | no3d |
32 | # nogroups - breaks network traffic capture for unprivileged users | 33 | #nogroups # breaks network traffic capture for unprivileged users |
33 | noinput | 34 | noinput |
34 | # nonewprivs - breaks network traffic capture for unprivileged users | 35 | #nonewprivs # breaks network traffic capture for unprivileged users |
35 | # noroot | 36 | #noroot |
36 | nodvd | 37 | nodvd |
37 | nosound | 38 | nosound |
38 | notv | 39 | notv |
39 | nou2f | 40 | nou2f |
40 | novideo | 41 | novideo |
41 | # protocol unix,inet,inet6,netlink,packet,bluetooth - commented out in case they bring in new protocols | 42 | # commented out in case they bring in new protocols |
43 | #protocol unix,inet,inet6,netlink,packet,bluetooth | ||
42 | #seccomp | 44 | #seccomp |
43 | tracelog | 45 | tracelog |
44 | 46 | ||
45 | # private-bin wireshark | 47 | #private-bin wireshark |
46 | private-cache | 48 | private-cache |
47 | # private-dev prevents (some) interfaces from being shown. | 49 | # private-dev prevents (some) interfaces from being shown. |
48 | # Add the below line to your wirehsark.local if you only want to inspect pcap files. | 50 | # Add the below line to your wirehsark.local if you only want to inspect pcap files. |
49 | #private-dev | 51 | #private-dev |
50 | # private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl | 52 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,group,hosts,machine-id,passwd,pki,resolv.conf,ssl |
51 | private-tmp | 53 | private-tmp |
52 | 54 | ||
53 | dbus-user none | 55 | dbus-user none |
diff --git a/etc/profile-m-z/wordwarvi.profile b/etc/profile-m-z/wordwarvi.profile index 310e8b470..970063f93 100644 --- a/etc/profile-m-z/wordwarvi.profile +++ b/etc/profile-m-z/wordwarvi.profile | |||
@@ -40,7 +40,6 @@ seccomp | |||
40 | tracelog | 40 | tracelog |
41 | 41 | ||
42 | disable-mnt | 42 | disable-mnt |
43 | private | ||
44 | private-bin wordwarvi | 43 | private-bin wordwarvi |
45 | private-cache | 44 | private-cache |
46 | private-dev | 45 | private-dev |
diff --git a/etc/profile-m-z/xbill.profile b/etc/profile-m-z/xbill.profile index e85bb9f18..46e3e81bc 100644 --- a/etc/profile-m-z/xbill.profile +++ b/etc/profile-m-z/xbill.profile | |||
@@ -16,7 +16,7 @@ include disable-xdg.inc | |||
16 | 16 | ||
17 | whitelist /usr/share/xbill | 17 | whitelist /usr/share/xbill |
18 | whitelist /var/games/xbill/scores | 18 | whitelist /var/games/xbill/scores |
19 | include whitelist-common.inc | 19 | #include whitelist-common.inc # see #903 |
20 | include whitelist-usr-share-common.inc | 20 | include whitelist-usr-share-common.inc |
21 | include whitelist-var-common.inc | 21 | include whitelist-var-common.inc |
22 | 22 | ||
diff --git a/etc/profile-m-z/xed.profile b/etc/profile-m-z/xed.profile index dda803bd5..b47437e2d 100644 --- a/etc/profile-m-z/xed.profile +++ b/etc/profile-m-z/xed.profile | |||
@@ -23,10 +23,10 @@ include disable-shell.inc | |||
23 | 23 | ||
24 | include whitelist-var-common.inc | 24 | include whitelist-var-common.inc |
25 | 25 | ||
26 | # apparmor - makes settings immutable | 26 | #apparmor # makes settings immutable |
27 | caps.drop all | 27 | caps.drop all |
28 | machine-id | 28 | machine-id |
29 | # net none - makes settings immutable | 29 | #net none # makes settings immutable |
30 | no3d | 30 | no3d |
31 | nodvd | 31 | nodvd |
32 | nogroups | 32 | nogroups |
@@ -46,9 +46,9 @@ private-dev | |||
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | # makes settings immutable | 48 | # makes settings immutable |
49 | # dbus-user none | 49 | #dbus-user none |
50 | # dbus-system none | 50 | #dbus-system none |
51 | 51 | ||
52 | # xed uses python plugins, memory-deny-write-execute breaks python | 52 | # xed uses python plugins, memory-deny-write-execute breaks python |
53 | # memory-deny-write-execute | 53 | #memory-deny-write-execute |
54 | restrict-namespaces | 54 | restrict-namespaces |
diff --git a/etc/profile-m-z/xfburn.profile b/etc/profile-m-z/xfburn.profile index 141fda909..96edc15ab 100644 --- a/etc/profile-m-z/xfburn.profile +++ b/etc/profile-m-z/xfburn.profile | |||
@@ -25,8 +25,8 @@ protocol unix | |||
25 | seccomp | 25 | seccomp |
26 | tracelog | 26 | tracelog |
27 | 27 | ||
28 | # private-bin xfburn | 28 | #private-bin xfburn |
29 | # private-dev | 29 | #private-dev |
30 | # private-tmp | 30 | #private-tmp |
31 | 31 | ||
32 | restrict-namespaces | 32 | restrict-namespaces |
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index 9c4fa8293..6c3a5812b 100644 --- a/etc/profile-m-z/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -53,5 +53,5 @@ dbus-user.own org.xfce.xfce4-mixer | |||
53 | dbus-user.talk org.xfce.Xfconf | 53 | dbus-user.talk org.xfce.Xfconf |
54 | dbus-system none | 54 | dbus-system none |
55 | 55 | ||
56 | # memory-deny-write-execute - breaks on Arch | 56 | #memory-deny-write-execute # breaks on Arch |
57 | restrict-namespaces | 57 | restrict-namespaces |
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile index 4d841b35c..9094a7872 100644 --- a/etc/profile-m-z/xfce4-screenshooter.profile +++ b/etc/profile-m-z/xfce4-screenshooter.profile | |||
@@ -47,5 +47,5 @@ private-tmp | |||
47 | dbus-user none | 47 | dbus-user none |
48 | dbus-system none | 48 | dbus-system none |
49 | 49 | ||
50 | # memory-deny-write-execute -- see #3790 | 50 | #memory-deny-write-execute # see #3790 |
51 | restrict-namespaces | 51 | restrict-namespaces |
diff --git a/etc/profile-m-z/xmr-stak.profile b/etc/profile-m-z/xmr-stak.profile index b8bf0ae96..06f0b5833 100644 --- a/etc/profile-m-z/xmr-stak.profile +++ b/etc/profile-m-z/xmr-stak.profile | |||
@@ -16,6 +16,7 @@ include disable-shell.inc | |||
16 | include disable-xdg.inc | 16 | include disable-xdg.inc |
17 | 17 | ||
18 | mkdir ${HOME}/.xmr-stak | 18 | mkdir ${HOME}/.xmr-stak |
19 | whitelist /opt/cuda | ||
19 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
20 | 21 | ||
21 | caps.drop all | 22 | caps.drop all |
@@ -39,7 +40,6 @@ private-bin xmr-stak | |||
39 | private-dev | 40 | private-dev |
40 | private-etc @tls-ca | 41 | private-etc @tls-ca |
41 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend | 42 | #private-lib libxmrstak_opencl_backend,libxmrstak_cuda_backend |
42 | private-opt cuda | ||
43 | private-tmp | 43 | private-tmp |
44 | 44 | ||
45 | memory-deny-write-execute | 45 | memory-deny-write-execute |
diff --git a/etc/profile-m-z/xplayer.profile b/etc/profile-m-z/xplayer.profile index a673d6aa3..9741888f0 100644 --- a/etc/profile-m-z/xplayer.profile +++ b/etc/profile-m-z/xplayer.profile | |||
@@ -27,7 +27,7 @@ include whitelist-common.inc | |||
27 | include whitelist-player-common.inc | 27 | include whitelist-player-common.inc |
28 | include whitelist-var-common.inc | 28 | include whitelist-var-common.inc |
29 | 29 | ||
30 | # apparmor - makes settings immutable | 30 | #apparmor # makes settings immutable |
31 | caps.drop all | 31 | caps.drop all |
32 | netfilter | 32 | netfilter |
33 | nogroups | 33 | nogroups |
@@ -41,11 +41,11 @@ tracelog | |||
41 | 41 | ||
42 | private-bin xplayer,xplayer-audio-preview,xplayer-video-thumbnailer | 42 | private-bin xplayer,xplayer-audio-preview,xplayer-video-thumbnailer |
43 | private-dev | 43 | private-dev |
44 | # private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl | 44 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,machine-id,pki,pulse,ssl |
45 | private-tmp | 45 | private-tmp |
46 | 46 | ||
47 | # makes settings immutable | 47 | # makes settings immutable |
48 | # dbus-user none | 48 | #dbus-user none |
49 | # dbus-system none | 49 | #dbus-system none |
50 | 50 | ||
51 | restrict-namespaces | 51 | restrict-namespaces |
diff --git a/etc/profile-m-z/xpra.profile b/etc/profile-m-z/xpra.profile index 05c12b9a2..b00307394 100644 --- a/etc/profile-m-z/xpra.profile +++ b/etc/profile-m-z/xpra.profile | |||
@@ -45,11 +45,11 @@ seccomp | |||
45 | 45 | ||
46 | disable-mnt | 46 | disable-mnt |
47 | # private home directory doesn't work on some distros, so we go for a regular home | 47 | # private home directory doesn't work on some distros, so we go for a regular home |
48 | # private | 48 | #private |
49 | # older Xpra versions also use Xvfb | 49 | # older Xpra versions also use Xvfb |
50 | # private-bin bash,cat,dbus-launch,ldconfig,ls,pactl,python*,sh,strace,which,xauth,xkbcomp,Xorg,xpra,Xvfb | 50 | #private-bin bash,cat,dbus-launch,ldconfig,ls,pactl,python*,sh,strace,which,xauth,xkbcomp,Xorg,xpra,Xvfb |
51 | private-dev | 51 | private-dev |
52 | # private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,nsswitch.conf,resolv.conf,X11,xpra | 52 | #private-etc alternatives,gai.conf,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,machine-id,nsswitch.conf,resolv.conf,X11,xpra |
53 | private-tmp | 53 | private-tmp |
54 | 54 | ||
55 | restrict-namespaces | 55 | restrict-namespaces |
diff --git a/etc/profile-m-z/xreader.profile b/etc/profile-m-z/xreader.profile index 6edbf9357..cad836fdc 100644 --- a/etc/profile-m-z/xreader.profile +++ b/etc/profile-m-z/xreader.profile | |||
@@ -18,9 +18,9 @@ include disable-programs.inc | |||
18 | include disable-xdg.inc | 18 | include disable-xdg.inc |
19 | 19 | ||
20 | # Breaks xreader on Mint 18.3 | 20 | # Breaks xreader on Mint 18.3 |
21 | # include whitelist-var-common.inc | 21 | #include whitelist-var-common.inc |
22 | 22 | ||
23 | # apparmor | 23 | #apparmor |
24 | caps.drop all | 24 | caps.drop all |
25 | no3d | 25 | no3d |
26 | nodvd | 26 | nodvd |
diff --git a/etc/profile-m-z/xviewer.profile b/etc/profile-m-z/xviewer.profile index 6c31df4a9..575c1bf68 100644 --- a/etc/profile-m-z/xviewer.profile +++ b/etc/profile-m-z/xviewer.profile | |||
@@ -19,9 +19,9 @@ include disable-shell.inc | |||
19 | 19 | ||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | # apparmor - makes settings immutable | 22 | #apparmor # makes settings immutable |
23 | caps.drop all | 23 | caps.drop all |
24 | # net none - makes settings immutable | 24 | #net none # makes settings immutable |
25 | no3d | 25 | no3d |
26 | nodvd | 26 | nodvd |
27 | nogroups | 27 | nogroups |
@@ -42,8 +42,8 @@ private-lib | |||
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | # makes settings immutable | 44 | # makes settings immutable |
45 | # dbus-user none | 45 | #dbus-user none |
46 | # dbus-system none | 46 | #dbus-system none |
47 | 47 | ||
48 | memory-deny-write-execute | 48 | memory-deny-write-execute |
49 | restrict-namespaces | 49 | restrict-namespaces |
diff --git a/etc/profile-m-z/yelp.profile b/etc/profile-m-z/yelp.profile index f5dd0c309..f957954dd 100644 --- a/etc/profile-m-z/yelp.profile +++ b/etc/profile-m-z/yelp.profile | |||
@@ -33,16 +33,14 @@ include whitelist-var-common.inc | |||
33 | 33 | ||
34 | apparmor | 34 | apparmor |
35 | caps.drop all | 35 | caps.drop all |
36 | # machine-id breaks sound - add the next line to your yelp.local if you don't need sound support. | 36 | #machine-id # add this to your yelp.local if you don't need sound support. |
37 | #machine-id | ||
38 | net none | 37 | net none |
39 | nodvd | 38 | nodvd |
40 | nogroups | 39 | nogroups |
41 | noinput | 40 | noinput |
42 | nonewprivs | 41 | nonewprivs |
43 | noroot | 42 | noroot |
44 | # nosound - add the next line to your yelp.local if you don't need sound support. | 43 | #nosound # add this to your yelp.local if you don't need sound support. |
45 | #nosound | ||
46 | notv | 44 | notv |
47 | nou2f | 45 | nou2f |
48 | novideo | 46 | novideo |
diff --git a/etc/profile-m-z/youtube-viewers-common.profile b/etc/profile-m-z/youtube-viewers-common.profile index c9d2ea53b..5950c3639 100644 --- a/etc/profile-m-z/youtube-viewers-common.profile +++ b/etc/profile-m-z/youtube-viewers-common.profile | |||
@@ -7,8 +7,10 @@ include youtube-viewers-common.local | |||
7 | # added by caller profile | 7 | # added by caller profile |
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.cache/mpv | ||
10 | noblacklist ${HOME}/.cache/youtube-dl | 11 | noblacklist ${HOME}/.cache/youtube-dl |
11 | noblacklist ${HOME}/.config/mpv | 12 | noblacklist ${HOME}/.config/mpv |
13 | noblacklist ${HOME}/.local/state/mpv | ||
12 | 14 | ||
13 | # Allow lua (blacklisted by disable-interpreters.inc) | 15 | # Allow lua (blacklisted by disable-interpreters.inc) |
14 | include allow-lua.inc | 16 | include allow-lua.inc |
diff --git a/etc/profile-m-z/youtube.profile b/etc/profile-m-z/youtube.profile index 4d1e9a063..0fb87f747 100644 --- a/etc/profile-m-z/youtube.profile +++ b/etc/profile-m-z/youtube.profile | |||
@@ -1,5 +1,5 @@ | |||
1 | # Firejail profile for youtube | 1 | # Firejail profile for youtube |
2 | # Description: Unofficial electron based desktop warpper for YouTube | 2 | # Description: Unofficial electron based desktop wrapper for YouTube |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include youtube.local | 5 | include youtube.local |
@@ -15,10 +15,10 @@ include disable-shell.inc | |||
15 | 15 | ||
16 | mkdir ${HOME}/.config/Youtube | 16 | mkdir ${HOME}/.config/Youtube |
17 | whitelist ${HOME}/.config/Youtube | 17 | whitelist ${HOME}/.config/Youtube |
18 | whitelist /opt/Youtube | ||
18 | 19 | ||
19 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube | 20 | private-bin electron,electron[0-9],electron[0-9][0-9],youtube |
20 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 21 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
21 | private-opt Youtube | ||
22 | 22 | ||
23 | # Redirect | 23 | # Redirect |
24 | include electron-common.profile | 24 | include electron-common.profile |
diff --git a/etc/profile-m-z/youtubemusic-nativefier.profile b/etc/profile-m-z/youtubemusic-nativefier.profile index cfee8c426..e5ece41bc 100644 --- a/etc/profile-m-z/youtubemusic-nativefier.profile +++ b/etc/profile-m-z/youtubemusic-nativefier.profile | |||
@@ -1,8 +1,8 @@ | |||
1 | # Firejail profile for youtubemusic-nativefier | 1 | # Firejail profile for youtubemusic-nativefier |
2 | # Description: Unofficial electron based desktop warpper for YouTube Music | 2 | # Description: Unofficial electron based desktop wrapper for YouTube Music |
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include youtube.local | 5 | include youtubemusic-nativefier.local |
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
@@ -12,10 +12,10 @@ include disable-shell.inc | |||
12 | 12 | ||
13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 | 13 | mkdir ${HOME}/.config/youtubemusic-nativefier-040164 |
14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 | 14 | whitelist ${HOME}/.config/youtubemusic-nativefier-040164 |
15 | whitelist /opt/youtubemusic-nativefier | ||
15 | 16 | ||
16 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier | 17 | private-bin electron,electron[0-9],electron[0-9][0-9],youtubemusic-nativefier |
17 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 18 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
18 | private-opt youtubemusic-nativefier | ||
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include electron-common.profile | 21 | include electron-common.profile |
diff --git a/etc/profile-m-z/ytmdesktop.profile b/etc/profile-m-z/ytmdesktop.profile index de07e3ddf..ccf5f1e63 100644 --- a/etc/profile-m-z/ytmdesktop.profile +++ b/etc/profile-m-z/ytmdesktop.profile | |||
@@ -13,9 +13,9 @@ noblacklist ${HOME}/.config/youtube-music-desktop-app | |||
13 | mkdir ${HOME}/.config/youtube-music-desktop-app | 13 | mkdir ${HOME}/.config/youtube-music-desktop-app |
14 | whitelist ${HOME}/.config/youtube-music-desktop-app | 14 | whitelist ${HOME}/.config/youtube-music-desktop-app |
15 | 15 | ||
16 | # private-bin env,ytmdesktop | 16 | #private-bin env,ytmdesktop |
17 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types | 17 | private-etc @tls-ca,@x11,bumblebee,host.conf,mime.types |
18 | # private-opt | 18 | #private-opt |
19 | 19 | ||
20 | # Redirect | 20 | # Redirect |
21 | include electron-common.profile | 21 | include electron-common.profile |
diff --git a/etc/profile-m-z/zeal.profile b/etc/profile-m-z/zeal.profile index 09a1d37a3..d576dbefd 100644 --- a/etc/profile-m-z/zeal.profile +++ b/etc/profile-m-z/zeal.profile | |||
@@ -67,5 +67,5 @@ dbus-user.talk org.mozilla.* | |||
67 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher | 67 | ?ALLOW_TRAY: dbus-user.talk org.kde.StatusNotifierWatcher |
68 | dbus-system none | 68 | dbus-system none |
69 | 69 | ||
70 | # memory-deny-write-execute - breaks on Arch | 70 | #memory-deny-write-execute # breaks on Arch |
71 | restrict-namespaces | 71 | restrict-namespaces |
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index 9329fe297..6299d42cd 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -196,6 +196,13 @@ include globals.local | |||
196 | # Extra: gai.conf,proxychains.conf | 196 | # Extra: gai.conf,proxychains.conf |
197 | # Qt: Trolltech.conf | 197 | # Qt: Trolltech.conf |
198 | ##private-lib LIBS | 198 | ##private-lib LIBS |
199 | ## Note: private-opt copies the entire path(s) to RAM, which may break | ||
200 | ## file-copy-limit in firejail.config (see firejail(1)). | ||
201 | ## For sizeable apps (if in doubt, do this): | ||
202 | ## - never use 'private-opt NAME' | ||
203 | ## - place 'whitelist /opt/NAME' in the whitelist section above | ||
204 | ## For acceptable apps: | ||
205 | ## - use 'private-opt NAME' | ||
199 | ##private-opt NAME | 206 | ##private-opt NAME |
200 | #private-tmp | 207 | #private-tmp |
201 | ##writable-etc | 208 | ##writable-etc |
diff --git a/etc/templates/syscalls.txt b/etc/templates/syscalls.txt index c33e6d602..569509534 100644 --- a/etc/templates/syscalls.txt +++ b/etc/templates/syscalls.txt | |||
@@ -47,7 +47,7 @@ Definition of groups | |||
47 | @obsolete=_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,idle,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver | 47 | @obsolete=_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,idle,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver |
48 | @privileged=@chown,@clock,@module,@raw-io,@reboot,@swap,_sysctl,acct,bpf,capset,chroot,fanotify_init,mount,nfsservctl,open_by_handle_at,pivot_root,quotactl,setdomainname,setfsuid,setfsuid32,setgroups,setgroups32,sethostname,setresuid,setresuid32,setreuid,setreuid32,setuid,setuid32,umount2,vhangup | 48 | @privileged=@chown,@clock,@module,@raw-io,@reboot,@swap,_sysctl,acct,bpf,capset,chroot,fanotify_init,mount,nfsservctl,open_by_handle_at,pivot_root,quotactl,setdomainname,setfsuid,setfsuid32,setgroups,setgroups32,sethostname,setresuid,setresuid32,setreuid,setreuid32,setuid,setuid32,umount2,vhangup |
49 | @process=arch_prctl,capget,clone,clone3,execveat,fork,getrusage,kill,pidfd_open,pidfd_send_signal,prctl,rt_sigqueueinfo,rt_tgsigqueueinfo,setns,swapcontext,tgkill,times,tkill,unshare,vfork,wait4,waitid,waitpid | 49 | @process=arch_prctl,capget,clone,clone3,execveat,fork,getrusage,kill,pidfd_open,pidfd_send_signal,prctl,rt_sigqueueinfo,rt_tgsigqueueinfo,setns,swapcontext,tgkill,times,tkill,unshare,vfork,wait4,waitid,waitpid |
50 | @raw-io=ioperm,iopl,pciconfig_iobase,pciconfig_read,pciconfig_write,s390_mmio_read,s390_mmio_write | 50 | @raw-io=ioperm,iopl,pciconfig_iobase,pciconfig_read,pciconfig_write,s390_pci_mmio_read,s390_pci_mmio_write |
51 | @reboot=kexec_load,kexec_file_load,reboot | 51 | @reboot=kexec_load,kexec_file_load,reboot |
52 | @resources=ioprio_set,mbind,migrate_pages,move_pages,nice,sched_setaffinity,sched_setattr,sched_setparam,sched_setscheduler,set_mempolicy | 52 | @resources=ioprio_set,mbind,migrate_pages,move_pages,nice,sched_setaffinity,sched_setattr,sched_setparam,sched_setscheduler,set_mempolicy |
53 | @setuid=setgid,setgid32,setgroups,setgroups32,setregid,setregid32,setresgid,setresgid32,setresuid,setresuid32,setreuid,setreuid32,setuid,setuid32 | 53 | @setuid=setgid,setgid32,setgroups,setgroups32,setregid,setregid32,setresgid,setresgid32,setresuid,setresuid32,setreuid,setreuid32,setuid,setuid32 |
diff --git a/src/fcopy/main.c b/src/fcopy/main.c index a56e8a91b..84fe44d73 100644 --- a/src/fcopy/main.c +++ b/src/fcopy/main.c | |||
@@ -277,7 +277,7 @@ static int fs_copydir(const char *infname, const struct stat *st, int ftype, str | |||
277 | 277 | ||
278 | // don't copy it if we already have the file | 278 | // don't copy it if we already have the file |
279 | struct stat s; | 279 | struct stat s; |
280 | if (stat(outfname, &s) == 0) { | 280 | if (lstat(outfname, &s) == 0) { |
281 | if (first) | 281 | if (first) |
282 | first = 0; | 282 | first = 0; |
283 | else if (!arg_quiet) | 283 | else if (!arg_quiet) |
@@ -286,7 +286,7 @@ static int fs_copydir(const char *infname, const struct stat *st, int ftype, str | |||
286 | } | 286 | } |
287 | 287 | ||
288 | // extract mode and ownership | 288 | // extract mode and ownership |
289 | if (stat(infname, &s) != 0) | 289 | if (lstat(infname, &s) != 0) |
290 | goto out; | 290 | goto out; |
291 | 291 | ||
292 | uid_t uid = s.st_uid; | 292 | uid_t uid = s.st_uid; |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index a89add9d0..558fe51ed 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -1,6 +1,8 @@ | |||
1 | # /etc/firejail/firecfg.config - firecfg utility configuration file | 1 | # /etc/firejail/firecfg.config - firecfg utility configuration file |
2 | # This is the list of programs in alphabetical order handled by firecfg utility | 2 | # This is the list of programs in alphabetical order handled by firecfg utility |
3 | # | 3 | # |
4 | # Note: Normal comment lines should start with `# ` and commented code lines | ||
5 | # should start with just `#` (no spaces). | ||
4 | 0ad | 6 | 0ad |
5 | 1password | 7 | 1password |
6 | 2048-qt | 8 | 2048-qt |
@@ -51,7 +53,7 @@ ani-cli | |||
51 | anydesk | 53 | anydesk |
52 | apktool | 54 | apktool |
53 | apostrophe | 55 | apostrophe |
54 | # ar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 56 | #ar # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
55 | arch-audit | 57 | arch-audit |
56 | archaudit-report | 58 | archaudit-report |
57 | ardour4 | 59 | ardour4 |
@@ -63,9 +65,9 @@ arm | |||
63 | artha | 65 | artha |
64 | assogiate | 66 | assogiate |
65 | asunder | 67 | asunder |
66 | # atom | 68 | #atom |
67 | # atom-beta | 69 | #atom-beta |
68 | # atool - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 70 | #atool # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
69 | atril | 71 | atril |
70 | atril-previewer | 72 | atril-previewer |
71 | atril-thumbnailer | 73 | atril-thumbnailer |
@@ -99,6 +101,7 @@ bitwarden | |||
99 | bleachbit | 101 | bleachbit |
100 | blender | 102 | blender |
101 | blender-2.8 | 103 | blender-2.8 |
104 | blender-3.6 | ||
102 | bless | 105 | bless |
103 | blobby | 106 | blobby |
104 | blobwars | 107 | blobwars |
@@ -112,10 +115,10 @@ brave-browser-beta | |||
112 | brave-browser-dev | 115 | brave-browser-dev |
113 | brave-browser-nightly | 116 | brave-browser-nightly |
114 | brave-browser-stable | 117 | brave-browser-stable |
115 | # bunzip2 - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 118 | #bunzip2 # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
116 | # bzcat - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 119 | #bzcat # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
117 | bzflag | 120 | bzflag |
118 | # bzip2 - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 121 | #bzip2 # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
119 | cachy-browser | 122 | cachy-browser |
120 | calibre | 123 | calibre |
121 | calligra | 124 | calligra |
@@ -145,12 +148,13 @@ chromium-freeworld | |||
145 | cin | 148 | cin |
146 | cinelerra | 149 | cinelerra |
147 | cinelerra-gg | 150 | cinelerra-gg |
151 | clac | ||
148 | clamdscan | 152 | clamdscan |
149 | clamdtop | 153 | clamdtop |
150 | clamscan | 154 | clamscan |
151 | clamtk | 155 | clamtk |
152 | clawsker | ||
153 | claws-mail | 156 | claws-mail |
157 | clawsker | ||
154 | clementine | 158 | clementine |
155 | clion | 159 | clion |
156 | clion-eap | 160 | clion-eap |
@@ -182,6 +186,7 @@ crow | |||
182 | cryptocat | 186 | cryptocat |
183 | cvlc | 187 | cvlc |
184 | cyberfox | 188 | cyberfox |
189 | d-feet | ||
185 | daisy | 190 | daisy |
186 | darktable | 191 | darktable |
187 | dconf-editor | 192 | dconf-editor |
@@ -192,7 +197,6 @@ deluge | |||
192 | desktopeditors | 197 | desktopeditors |
193 | devhelp | 198 | devhelp |
194 | dex2jar | 199 | dex2jar |
195 | d-feet | ||
196 | dia | 200 | dia |
197 | dig | 201 | dig |
198 | digikam | 202 | digikam |
@@ -236,14 +240,14 @@ enpass | |||
236 | eog | 240 | eog |
237 | eom | 241 | eom |
238 | ephemeral | 242 | ephemeral |
239 | #epiphany - see #2995 | 243 | #epiphany # see #2995 |
240 | equalx | 244 | equalx |
241 | et | 245 | et |
242 | etr | 246 | etr |
243 | evince | 247 | evince |
244 | evince-previewer | 248 | evince-previewer |
245 | evince-thumbnailer | 249 | evince-thumbnailer |
246 | #evolution - see #3647 | 250 | #evolution # see #3647 |
247 | exfalso | 251 | exfalso |
248 | exiftool | 252 | exiftool |
249 | falkon | 253 | falkon |
@@ -271,8 +275,9 @@ flacsplt | |||
271 | flameshot | 275 | flameshot |
272 | flashpeak-slimjet | 276 | flashpeak-slimjet |
273 | flowblade | 277 | flowblade |
274 | fontforge | 278 | fluffychat |
275 | font-manager | 279 | font-manager |
280 | fontforge | ||
276 | fossamail | 281 | fossamail |
277 | four-in-a-row | 282 | four-in-a-row |
278 | fractal | 283 | fractal |
@@ -319,7 +324,7 @@ git-cola | |||
319 | gitg | 324 | gitg |
320 | github-desktop | 325 | github-desktop |
321 | gitter | 326 | gitter |
322 | # gjs -- https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 | 327 | #gjs # https://github.com/netblue30/firejail/issues/3333#issuecomment-612601102 |
323 | gl-117 | 328 | gl-117 |
324 | glaxium | 329 | glaxium |
325 | globaltime | 330 | globaltime |
@@ -384,12 +389,12 @@ gradio | |||
384 | gramps | 389 | gramps |
385 | gravity-beams-and-evaporating-stars | 390 | gravity-beams-and-evaporating-stars |
386 | gthumb | 391 | gthumb |
387 | gtk2-youtube-viewer | ||
388 | gtk3-youtube-viewer | ||
389 | gtk-lbry-viewer | 392 | gtk-lbry-viewer |
390 | gtk-pipe-viewer | 393 | gtk-pipe-viewer |
391 | gtk-straw-viewer | 394 | gtk-straw-viewer |
392 | gtk-youtube-viewer | 395 | gtk-youtube-viewer |
396 | gtk2-youtube-viewer | ||
397 | gtk3-youtube-viewer | ||
393 | guayadeque | 398 | guayadeque |
394 | gucharmap | 399 | gucharmap |
395 | gummi | 400 | gummi |
@@ -410,8 +415,8 @@ icecat | |||
410 | icedove | 415 | icedove |
411 | iceweasel | 416 | iceweasel |
412 | idea | 417 | idea |
413 | ideaIC | ||
414 | idea.sh | 418 | idea.sh |
419 | ideaIC | ||
415 | imagej | 420 | imagej |
416 | img2txt | 421 | img2txt |
417 | impressive | 422 | impressive |
@@ -430,6 +435,7 @@ jdownloader | |||
430 | jerry | 435 | jerry |
431 | jitsi | 436 | jitsi |
432 | jitsi-meet-desktop | 437 | jitsi-meet-desktop |
438 | journal-viewer | ||
433 | jumpnbump | 439 | jumpnbump |
434 | jumpnbump-menu | 440 | jumpnbump-menu |
435 | k3b | 441 | k3b |
@@ -440,7 +446,7 @@ karbon | |||
440 | kate | 446 | kate |
441 | kazam | 447 | kazam |
442 | kcalc | 448 | kcalc |
443 | # kdeinit4 | 449 | #kdeinit4 |
444 | kdenlive | 450 | kdenlive |
445 | kdiff3 | 451 | kdiff3 |
446 | keepass | 452 | keepass |
@@ -450,7 +456,7 @@ keepassx2 | |||
450 | keepassxc | 456 | keepassxc |
451 | keepassxc-cli | 457 | keepassxc-cli |
452 | keepassxc-proxy | 458 | keepassxc-proxy |
453 | # kfind | 459 | #kfind |
454 | kget | 460 | kget |
455 | kid3 | 461 | kid3 |
456 | kid3-cli | 462 | kid3-cli |
@@ -467,15 +473,16 @@ kodi | |||
467 | konversation | 473 | konversation |
468 | kopete | 474 | kopete |
469 | krita | 475 | krita |
470 | # krunner | 476 | #krunner |
471 | ktorrent | 477 | ktorrent |
472 | ktouch | 478 | ktouch |
473 | kube | 479 | kube |
474 | # kwin_x11 | 480 | #kwin_x11 |
475 | kwrite | 481 | kwrite |
476 | lbry-viewer | 482 | lbry-viewer |
477 | leafpad | 483 | leafpad |
478 | # less - breaks man | 484 | #less # breaks man |
485 | lettura | ||
479 | librecad | 486 | librecad |
480 | libreoffice | 487 | libreoffice |
481 | librewolf | 488 | librewolf |
@@ -500,12 +507,12 @@ lollypop | |||
500 | lomath | 507 | lomath |
501 | loweb | 508 | loweb |
502 | lowriter | 509 | lowriter |
503 | # lrunzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 510 | #lrunzip # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
504 | # lrz - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 511 | #lrz # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
505 | # lrzcat - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 512 | #lrzcat # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
506 | # lrzip - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 513 | #lrzip # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
507 | # lrztar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 514 | #lrztar # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
508 | # lrzuntar - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 515 | #lrzuntar # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
509 | luminance-hdr | 516 | luminance-hdr |
510 | lximage-qt | 517 | lximage-qt |
511 | lxmusic | 518 | lxmusic |
@@ -559,7 +566,6 @@ mp3wrap | |||
559 | mpDris2 | 566 | mpDris2 |
560 | mpg123 | 567 | mpg123 |
561 | mpg123-alsa | 568 | mpg123-alsa |
562 | mpg123.bin | ||
563 | mpg123-id3dump | 569 | mpg123-id3dump |
564 | mpg123-jack | 570 | mpg123-jack |
565 | mpg123-nas | 571 | mpg123-nas |
@@ -568,6 +574,7 @@ mpg123-oss | |||
568 | mpg123-portaudio | 574 | mpg123-portaudio |
569 | mpg123-pulse | 575 | mpg123-pulse |
570 | mpg123-strip | 576 | mpg123-strip |
577 | mpg123.bin | ||
571 | mplayer | 578 | mplayer |
572 | mpsyt | 579 | mpsyt |
573 | mpv | 580 | mpv |
@@ -636,11 +643,11 @@ onionshare-cli | |||
636 | onionshare-gui | 643 | onionshare-gui |
637 | ooffice | 644 | ooffice |
638 | ooviewdoc | 645 | ooviewdoc |
646 | open-invaders | ||
639 | openarena | 647 | openarena |
640 | openarena_ded | 648 | openarena_ded |
641 | opencity | 649 | opencity |
642 | openclonk | 650 | openclonk |
643 | open-invaders | ||
644 | openmw | 651 | openmw |
645 | openmw-launcher | 652 | openmw-launcher |
646 | openoffice.org | 653 | openoffice.org |
@@ -697,9 +704,9 @@ profanity | |||
697 | psi | 704 | psi |
698 | psi-plus | 705 | psi-plus |
699 | pybitmessage | 706 | pybitmessage |
700 | # pycharm-community - FB note: may enable later | 707 | #pycharm-community # FB note: may enable later |
701 | # pycharm-professional | 708 | #pycharm-professional |
702 | # pzstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 709 | #pzstd # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
703 | qbittorrent | 710 | qbittorrent |
704 | qcomicbook | 711 | qcomicbook |
705 | qemu-launcher | 712 | qemu-launcher |
@@ -780,22 +787,22 @@ sniffnet | |||
780 | snox | 787 | snox |
781 | soffice | 788 | soffice |
782 | sol | 789 | sol |
783 | soundconverter | ||
784 | sound-juicer | 790 | sound-juicer |
791 | soundconverter | ||
785 | spectacle | 792 | spectacle |
786 | spectral | 793 | spectral |
787 | spotify | 794 | spotify |
788 | sqlitebrowser | 795 | sqlitebrowser |
789 | ssh | 796 | ssh |
790 | # ssh-agent - problems on Arch with Fish shell (#1568) | 797 | #ssh-agent # problems on Arch with Fish shell (#1568) |
791 | standardnotes-desktop | 798 | standardnotes-desktop |
792 | start-tor-browser | 799 | start-tor-browser |
793 | steam | 800 | steam |
794 | steam-native | 801 | steam-native |
795 | steam-runtime | 802 | steam-runtime |
796 | stellarium | 803 | stellarium |
797 | strawberry | ||
798 | straw-viewer | 804 | straw-viewer |
805 | strawberry | ||
799 | strings | 806 | strings |
800 | studio.sh | 807 | studio.sh |
801 | subdownloader | 808 | subdownloader |
@@ -818,15 +825,17 @@ telegram | |||
818 | telegram-desktop | 825 | telegram-desktop |
819 | telnet | 826 | telnet |
820 | terasology | 827 | terasology |
828 | termshark | ||
821 | tesseract | 829 | tesseract |
822 | textmaker18 | 830 | textmaker18 |
823 | textmaker18free | 831 | textmaker18free |
824 | thunderbird | 832 | thunderbird |
825 | thunderbird-beta | 833 | thunderbird-beta |
826 | thunderbird-wayland | 834 | thunderbird-wayland |
835 | tidal-hifi | ||
827 | tilp | 836 | tilp |
837 | tiny-rdm | ||
828 | tor-browser | 838 | tor-browser |
829 | torbrowser | ||
830 | tor-browser-ar | 839 | tor-browser-ar |
831 | tor-browser-ca | 840 | tor-browser-ca |
832 | tor-browser-cs | 841 | tor-browser-cs |
@@ -848,7 +857,6 @@ tor-browser-it | |||
848 | tor-browser-ja | 857 | tor-browser-ja |
849 | tor-browser-ka | 858 | tor-browser-ka |
850 | tor-browser-ko | 859 | tor-browser-ko |
851 | torbrowser-launcher | ||
852 | tor-browser-nb | 860 | tor-browser-nb |
853 | tor-browser-nl | 861 | tor-browser-nl |
854 | tor-browser-pl | 862 | tor-browser-pl |
@@ -859,6 +867,8 @@ tor-browser-tr | |||
859 | tor-browser-vi | 867 | tor-browser-vi |
860 | tor-browser-zh-cn | 868 | tor-browser-zh-cn |
861 | tor-browser-zh-tw | 869 | tor-browser-zh-tw |
870 | torbrowser | ||
871 | torbrowser-launcher | ||
862 | torcs | 872 | torcs |
863 | totem | 873 | totem |
864 | tracker | 874 | tracker |
@@ -888,7 +898,7 @@ uget-gtk | |||
888 | unbound | 898 | unbound |
889 | unf | 899 | unf |
890 | unknown-horizons | 900 | unknown-horizons |
891 | # unzstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 901 | #unzstd # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
892 | url-eater | 902 | url-eater |
893 | utox | 903 | utox |
894 | uudeview | 904 | uudeview |
@@ -901,10 +911,10 @@ vivaldi-beta | |||
901 | vivaldi-snapshot | 911 | vivaldi-snapshot |
902 | vivaldi-stable | 912 | vivaldi-stable |
903 | vlc | 913 | vlc |
904 | #vmplayer - unable to install kernel modules (see #5861) | 914 | #vmplayer # unable to install kernel modules (see #5861) |
905 | #vmware - unable to install kernel modules (see #5861) | 915 | #vmware # unable to install kernel modules (see #5861) |
906 | #vmware-player - unable to install kernel modules (see #5861) | 916 | #vmware-player # unable to install kernel modules (see #5861) |
907 | #vmware-workstation - unable to install kernel modules (see #5861) | 917 | #vmware-workstation # unable to install kernel modules (see #5861) |
908 | vscodium | 918 | vscodium |
909 | vulturesclaw | 919 | vulturesclaw |
910 | vultureseye | 920 | vultureseye |
@@ -968,8 +978,8 @@ yelp | |||
968 | youtube | 978 | youtube |
969 | youtube-dl | 979 | youtube-dl |
970 | youtube-dl-gui | 980 | youtube-dl-gui |
971 | youtubemusic-nativefier | ||
972 | youtube-viewer | 981 | youtube-viewer |
982 | youtubemusic-nativefier | ||
973 | yt-dlp | 983 | yt-dlp |
974 | ytmdesktop | 984 | ytmdesktop |
975 | zaproxy | 985 | zaproxy |
@@ -979,10 +989,10 @@ zeal | |||
979 | zim | 989 | zim |
980 | zlib-flate | 990 | zlib-flate |
981 | zoom | 991 | zoom |
982 | # zpaq - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 992 | #zpaq # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
983 | # zstd - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 993 | #zstd # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
984 | # zstdcat - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 994 | #zstdcat # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
985 | # zstdgrep - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 995 | #zstdgrep # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
986 | # zstdless - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 996 | #zstdless # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
987 | # zstdmt - disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) | 997 | #zstdmt # disable until we fix CLI archivers for makepkg on Arch (see discussion in #3095) |
988 | zulip | 998 | zulip |
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c index a4f727c0a..bb20a0da6 100644 --- a/src/firejail/appimage.c +++ b/src/firejail/appimage.c | |||
@@ -43,6 +43,16 @@ int appimage_find_profile(const char *archive) { | |||
43 | assert(archive); | 43 | assert(archive); |
44 | assert(strlen(archive)); | 44 | assert(strlen(archive)); |
45 | 45 | ||
46 | // extract the name of the appimage from a full path | ||
47 | // example: archive = /opt/kdenlive-20.12.2-x86_64.appimage | ||
48 | const char *arc = strrchr(archive, '/'); | ||
49 | if (arc) | ||
50 | arc++; | ||
51 | else | ||
52 | arc = archive; | ||
53 | if (arg_debug) | ||
54 | printf("Looking for a %s profile\n", arc); | ||
55 | |||
46 | // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config | 56 | // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config |
47 | FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r"); | 57 | FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r"); |
48 | if (!fp) { | 58 | if (!fp) { |
@@ -56,7 +66,8 @@ int appimage_find_profile(const char *archive) { | |||
56 | char *ptr = strchr(buf, '\n'); | 66 | char *ptr = strchr(buf, '\n'); |
57 | if (ptr) | 67 | if (ptr) |
58 | *ptr = '\0'; | 68 | *ptr = '\0'; |
59 | if (strcasestr(archive, buf)) { | 69 | char *found = strcasestr(arc, buf); |
70 | if (found == arc) { | ||
60 | fclose(fp); | 71 | fclose(fp); |
61 | return profile_find_firejail(buf, 1); | 72 | return profile_find_firejail(buf, 1); |
62 | } | 73 | } |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 182f26e53..28fecfb98 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -281,6 +281,8 @@ void fs_blacklist(void) { | |||
281 | if (!entry) | 281 | if (!entry) |
282 | return; | 282 | return; |
283 | 283 | ||
284 | timetrace_start(); | ||
285 | |||
284 | size_t noblacklist_c = 0; | 286 | size_t noblacklist_c = 0; |
285 | size_t noblacklist_m = 32; | 287 | size_t noblacklist_m = 32; |
286 | char **noblacklist = calloc(noblacklist_m, sizeof(*noblacklist)); | 288 | char **noblacklist = calloc(noblacklist_m, sizeof(*noblacklist)); |
@@ -463,6 +465,8 @@ void fs_blacklist(void) { | |||
463 | for (i = 0; i < noblacklist_c; i++) | 465 | for (i = 0; i < noblacklist_c; i++) |
464 | free(noblacklist[i]); | 466 | free(noblacklist[i]); |
465 | free(noblacklist); | 467 | free(noblacklist); |
468 | |||
469 | fmessage("Base filesystem installed in %0.2f ms\n", timetrace_end()); | ||
466 | } | 470 | } |
467 | 471 | ||
468 | //*********************************************** | 472 | //*********************************************** |
diff --git a/src/firejail/fs_lib2.c b/src/firejail/fs_lib2.c index 583888e0e..b43c36c1a 100644 --- a/src/firejail/fs_lib2.c +++ b/src/firejail/fs_lib2.c | |||
@@ -166,8 +166,12 @@ void fslib_install_firejail(void) { | |||
166 | fslib_mount_libs(RUN_MNT_DIR "/dhclient", 1); // parse as user | 166 | fslib_mount_libs(RUN_MNT_DIR "/dhclient", 1); // parse as user |
167 | 167 | ||
168 | // bring in xauth libraries | 168 | // bring in xauth libraries |
169 | |||
170 | char *xauth_bin = find_in_path("xauth"); | ||
169 | if (arg_x11_xorg) | 171 | if (arg_x11_xorg) |
170 | fslib_mount_libs("/usr/bin/xauth", 1); // parse as user | 172 | fslib_mount_libs(xauth_bin, 1); // parse as user |
173 | |||
174 | free(xauth_bin); | ||
171 | 175 | ||
172 | fmessage("Firejail libraries installed in %0.2f ms\n", timetrace_end()); | 176 | fmessage("Firejail libraries installed in %0.2f ms\n", timetrace_end()); |
173 | } | 177 | } |
diff --git a/src/firejail/ls.c b/src/firejail/ls.c index f2ab1c188..6dc4904fc 100644 --- a/src/firejail/ls.c +++ b/src/firejail/ls.c | |||
@@ -154,7 +154,7 @@ static void print_file_or_dir(const char *path, const char *fname) { | |||
154 | 154 | ||
155 | // file size | 155 | // file size |
156 | char *sz; | 156 | char *sz; |
157 | if (asprintf(&sz, "%d", (int) s.st_size) == -1) | 157 | if (asprintf(&sz, "%jd", (intmax_t) s.st_size) == -1) |
158 | errExit("asprintf"); | 158 | errExit("asprintf"); |
159 | 159 | ||
160 | // file name | 160 | // file name |
diff --git a/src/firejail/main.c b/src/firejail/main.c index b0d5dac17..0c9c80137 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -420,7 +420,6 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
420 | exit_err_feature("x11"); | 420 | exit_err_feature("x11"); |
421 | } | 421 | } |
422 | #endif | 422 | #endif |
423 | #ifdef HAVE_NETWORK | ||
424 | else if (strcmp(argv[i], "--nettrace") == 0) { | 423 | else if (strcmp(argv[i], "--nettrace") == 0) { |
425 | if (checkcfg(CFG_NETWORK)) { | 424 | if (checkcfg(CFG_NETWORK)) { |
426 | if (getuid() != 0) { | 425 | if (getuid() != 0) { |
@@ -524,8 +523,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
524 | exit(0); | 523 | exit(0); |
525 | } | 524 | } |
526 | 525 | ||
527 | 526 | #ifdef HAVE_NETWORK | |
528 | |||
529 | else if (strncmp(argv[i], "--bandwidth=", 12) == 0) { | 527 | else if (strncmp(argv[i], "--bandwidth=", 12) == 0) { |
530 | if (checkcfg(CFG_NETWORK)) { | 528 | if (checkcfg(CFG_NETWORK)) { |
531 | logargs(argc, argv); | 529 | logargs(argc, argv); |
@@ -3217,13 +3215,18 @@ int main(int argc, char **argv, char **envp) { | |||
3217 | 3215 | ||
3218 | gid_t g; | 3216 | gid_t g; |
3219 | if (!arg_nogroups || !check_can_drop_all_groups()) { | 3217 | if (!arg_nogroups || !check_can_drop_all_groups()) { |
3220 | // add audio group | 3218 | // add audio groups |
3221 | if (!arg_nosound) { | 3219 | if (!arg_nosound) { |
3222 | g = get_group_id("audio"); | 3220 | g = get_group_id("audio"); |
3223 | if (g) { | 3221 | if (g) { |
3224 | sprintf(ptr, "%d %d 1\n", g, g); | 3222 | sprintf(ptr, "%d %d 1\n", g, g); |
3225 | ptr += strlen(ptr); | 3223 | ptr += strlen(ptr); |
3226 | } | 3224 | } |
3225 | g = get_group_id("pipewire"); | ||
3226 | if (g) { | ||
3227 | sprintf(ptr, "%d %d 1\n", g, g); | ||
3228 | ptr += strlen(ptr); | ||
3229 | } | ||
3227 | } | 3230 | } |
3228 | 3231 | ||
3229 | // add video group | 3232 | // add video group |
diff --git a/src/firejail/paths.c b/src/firejail/paths.c index 6bc6230f0..fea842d93 100644 --- a/src/firejail/paths.c +++ b/src/firejail/paths.c | |||
@@ -47,6 +47,16 @@ static void init_paths(void) { | |||
47 | errExit("calloc"); | 47 | errExit("calloc"); |
48 | memset(paths, 0, path_cnt * sizeof(char *)); // get rid of false positive error from GCC static analyzer | 48 | memset(paths, 0, path_cnt * sizeof(char *)); // get rid of false positive error from GCC static analyzer |
49 | 49 | ||
50 | // lots of distros set /bin as a symlink to /usr/bin; | ||
51 | // we remove /bin form the path to speed up path-based operations such as blacklist | ||
52 | int bin_symlink = 0; | ||
53 | p = realpath("/bin", NULL); | ||
54 | if (p) { | ||
55 | if (strcmp(p, "/usr/bin") == 0) | ||
56 | bin_symlink = 1; | ||
57 | } | ||
58 | free(p); | ||
59 | |||
50 | // fill in 'paths' with pointers to elements of 'path' | 60 | // fill in 'paths' with pointers to elements of 'path' |
51 | unsigned int i = 0, j; | 61 | unsigned int i = 0, j; |
52 | unsigned int len; | 62 | unsigned int len; |
@@ -62,6 +72,14 @@ static void init_paths(void) { | |||
62 | if (len == 0) | 72 | if (len == 0) |
63 | goto skip; | 73 | goto skip; |
64 | 74 | ||
75 | //deal with /bin - /usr/bin symlink | ||
76 | if (bin_symlink > 0) { | ||
77 | if (strcmp(elt, "/bin") == 0 || strcmp(elt, "/usr/bin") == 0) | ||
78 | bin_symlink++; | ||
79 | if (bin_symlink == 3) | ||
80 | goto skip; | ||
81 | } | ||
82 | |||
65 | // filter out duplicate entries | 83 | // filter out duplicate entries |
66 | for (j = 0; j < i; j++) | 84 | for (j = 0; j < i; j++) |
67 | if (strcmp(elt, paths[j]) == 0) | 85 | if (strcmp(elt, paths[j]) == 0) |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index bdaaed433..8cc5c1166 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -484,7 +484,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
484 | #endif | 484 | #endif |
485 | return 0; | 485 | return 0; |
486 | } | 486 | } |
487 | else if (strncmp("dbus-user ", ptr, 10) == 0) { | 487 | else if (strncmp(ptr, "dbus-user ", 10) == 0) { |
488 | #ifdef HAVE_DBUSPROXY | 488 | #ifdef HAVE_DBUSPROXY |
489 | ptr += 10; | 489 | ptr += 10; |
490 | if (strcmp("filter", ptr) == 0) { | 490 | if (strcmp("filter", ptr) == 0) { |
@@ -551,7 +551,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
551 | #endif | 551 | #endif |
552 | return 1; | 552 | return 1; |
553 | } | 553 | } |
554 | else if (strncmp("dbus-system ", ptr, 12) == 0) { | 554 | else if (strncmp(ptr, "dbus-system ", 12) == 0) { |
555 | #ifdef HAVE_DBUSPROXY | 555 | #ifdef HAVE_DBUSPROXY |
556 | ptr += 12; | 556 | ptr += 12; |
557 | if (strcmp("filter", ptr) == 0) { | 557 | if (strcmp("filter", ptr) == 0) { |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 538f5be67..827be5d85 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -878,7 +878,8 @@ int sandbox(void* sandbox_arg) { | |||
878 | //**************************** | 878 | //**************************** |
879 | // appimage | 879 | // appimage |
880 | //**************************** | 880 | //**************************** |
881 | appimage_mount(); | 881 | if (arg_appimage) |
882 | appimage_mount(); | ||
882 | 883 | ||
883 | //**************************** | 884 | //**************************** |
884 | // private mode | 885 | // private mode |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 87b771867..bd32181b5 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -207,6 +207,8 @@ static void clean_supplementary_groups(gid_t gid) { | |||
207 | if (!arg_nosound) { | 207 | if (!arg_nosound) { |
208 | copy_group_ifcont("audio", groups, ngroups, | 208 | copy_group_ifcont("audio", groups, ngroups, |
209 | new_groups, &new_ngroups, MAX_GROUPS); | 209 | new_groups, &new_ngroups, MAX_GROUPS); |
210 | copy_group_ifcont("pipewire", groups, ngroups, | ||
211 | new_groups, &new_ngroups, MAX_GROUPS); | ||
210 | } | 212 | } |
211 | 213 | ||
212 | if (!arg_novideo) { | 214 | if (!arg_novideo) { |
@@ -1474,7 +1476,7 @@ int ascii_isxdigit(unsigned char c) { | |||
1474 | return ret; | 1476 | return ret; |
1475 | } | 1477 | } |
1476 | 1478 | ||
1477 | // Note: Keep this in sync with NAME VALIDATION in src/man/firejail.txt. | 1479 | // Note: Keep this in sync with NAME VALIDATION in src/man/firejail.1.in. |
1478 | // | 1480 | // |
1479 | // Allow only ASCII letters, digits and a few special characters; names with | 1481 | // Allow only ASCII letters, digits and a few special characters; names with |
1480 | // only numbers are rejected; spaces and control characters are rejected. | 1482 | // only numbers are rejected; spaces and control characters are rejected. |
diff --git a/src/firejail/x11.c b/src/firejail/x11.c index 2eaa9bde5..3721a2c2c 100644 --- a/src/firejail/x11.c +++ b/src/firejail/x11.c | |||
@@ -1164,7 +1164,6 @@ void x11_start(int argc, char **argv) { | |||
1164 | } | 1164 | } |
1165 | #endif | 1165 | #endif |
1166 | 1166 | ||
1167 | |||
1168 | void x11_xorg(void) { | 1167 | void x11_xorg(void) { |
1169 | #ifdef HAVE_X11 | 1168 | #ifdef HAVE_X11 |
1170 | 1169 | ||
@@ -1175,31 +1174,38 @@ void x11_xorg(void) { | |||
1175 | exit(1); | 1174 | exit(1); |
1176 | } | 1175 | } |
1177 | 1176 | ||
1177 | char *xauth_bin = find_in_path("xauth"); | ||
1178 | |||
1178 | // check xauth utility is present in the system | 1179 | // check xauth utility is present in the system |
1179 | struct stat s; | 1180 | if (!xauth_bin) { |
1180 | if (stat("/usr/bin/xauth", &s) == -1) { | 1181 | fprintf(stderr, "Error: xauth utility not found in PATH. Please install it:\n"); |
1181 | fprintf(stderr, "Error: xauth utility not found in /usr/bin. Please install it:\n"); | ||
1182 | fprintf(stderr, " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); | 1182 | fprintf(stderr, " Debian/Ubuntu/Mint: sudo apt-get install xauth\n"); |
1183 | fprintf(stderr, " Arch: sudo pacman -S xorg-xauth\n"); | 1183 | fprintf(stderr, " Arch: sudo pacman -S xorg-xauth\n"); |
1184 | fprintf(stderr, " Fedora: sudo dnf install xorg-x11-xauth\n"); | 1184 | fprintf(stderr, " Fedora: sudo dnf install xorg-x11-xauth\n"); |
1185 | exit(1); | 1185 | exit(1); |
1186 | } | 1186 | } |
1187 | |||
1188 | struct stat s; | ||
1189 | if (stat(xauth_bin, &s) == -1) { | ||
1190 | fprintf(stderr, "Error: %s: %s\n", xauth_bin, strerror(errno)); | ||
1191 | exit(1); | ||
1192 | } | ||
1187 | if ((s.st_uid != 0 && s.st_gid != 0) || (s.st_mode & S_IWOTH)) { | 1193 | if ((s.st_uid != 0 && s.st_gid != 0) || (s.st_mode & S_IWOTH)) { |
1188 | fprintf(stderr, "Error: invalid /usr/bin/xauth executable\n"); | 1194 | fprintf(stderr, "Error: invalid %s executable\n", xauth_bin); |
1189 | exit(1); | 1195 | exit(1); |
1190 | } | 1196 | } |
1191 | if (s.st_size > 1024 * 1024) { | 1197 | if (s.st_size > 1024 * 1024) { |
1192 | fprintf(stderr, "Error: /usr/bin/xauth executable is too large\n"); | 1198 | fprintf(stderr, "Error: %s executable is too large\n", xauth_bin); |
1193 | exit(1); | 1199 | exit(1); |
1194 | } | 1200 | } |
1195 | // copy /usr/bin/xauth in the sandbox and set mode to 0711 | 1201 | // copy xauth in the sandbox and set mode to 0711 |
1196 | // users are not able to trace the running xauth this way | 1202 | // users are not able to trace the running xauth this way |
1197 | if (arg_debug) | 1203 | if (arg_debug) |
1198 | printf("Copying /usr/bin/xauth to %s\n", RUN_XAUTH_FILE); | 1204 | printf("Copying %s to %s\n", xauth_bin, RUN_XAUTH_FILE); |
1199 | if (copy_file("/usr/bin/xauth", RUN_XAUTH_FILE, 0, 0, 0711)) { | 1205 | |
1200 | fprintf(stderr, "Error: cannot copy /usr/bin/xauth executable\n"); | 1206 | copy_file_from_user_to_root(xauth_bin, RUN_XAUTH_FILE, 0, 0, 0711); |
1201 | exit(1); | 1207 | |
1202 | } | 1208 | free(xauth_bin); |
1203 | 1209 | ||
1204 | fmessage("Generating a new .Xauthority file\n"); | 1210 | fmessage("Generating a new .Xauthority file\n"); |
1205 | mkdir_attr(RUN_XAUTHORITY_SEC_DIR, 0700, getuid(), getgid()); | 1211 | mkdir_attr(RUN_XAUTHORITY_SEC_DIR, 0700, getuid(), getgid()); |
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c index 77739c1f3..63d69d1cd 100644 --- a/src/firemon/procevent.c +++ b/src/firemon/procevent.c | |||
@@ -185,7 +185,7 @@ static int procevent_netlink_setup(void) { | |||
185 | if (getsockopt(sock, SOL_SOCKET, SO_RCVBUF, &bsize, &blen) == -1) | 185 | if (getsockopt(sock, SOL_SOCKET, SO_RCVBUF, &bsize, &blen) == -1) |
186 | fprintf(stderr, "Error: cannot read rx buffer size\n"); | 186 | fprintf(stderr, "Error: cannot read rx buffer size\n"); |
187 | else | 187 | else |
188 | printf("rx buffer size %d\n", bsize / 2); // the value returned is duble the real one, see man 7 socket | 188 | printf("rx buffer size %d\n", bsize / 2); // the value returned is double the real one, see man 7 socket |
189 | } | 189 | } |
190 | 190 | ||
191 | // send monitoring message | 191 | // send monitoring message |
diff --git a/src/fnettrace-dns/main.c b/src/fnettrace-dns/main.c index 6324a17db..38222fe2e 100644 --- a/src/fnettrace-dns/main.c +++ b/src/fnettrace-dns/main.c | |||
@@ -66,7 +66,7 @@ void print_dns(uint32_t ip_src, unsigned char *pkt) { | |||
66 | 66 | ||
67 | // filter output | 67 | // filter output |
68 | char tmp[sizeof(last)]; | 68 | char tmp[sizeof(last)]; |
69 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s %s (type %u)%s", | 69 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s DNS %s (type %u)%s", |
70 | t->tm_hour, t->tm_min, t->tm_sec, ip, pkt + 12 + 1, | 70 | t->tm_hour, t->tm_min, t->tm_sec, ip, pkt + 12 + 1, |
71 | type, (nxdomain)? " NXDOMAIN": ""); | 71 | type, (nxdomain)? " NXDOMAIN": ""); |
72 | if (strcmp(tmp, last)) { | 72 | if (strcmp(tmp, last)) { |
diff --git a/src/fnettrace-sni/main.c b/src/fnettrace-sni/main.c index d4fbf703a..d0a4f115a 100644 --- a/src/fnettrace-sni/main.c +++ b/src/fnettrace-sni/main.c | |||
@@ -32,16 +32,15 @@ static char last[512] = {'\0'}; | |||
32 | static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { | 32 | static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { |
33 | assert(pkt); | 33 | assert(pkt); |
34 | 34 | ||
35 | // expecting a handshake packet and client hello | ||
36 | if (pkt[0] != 0x16 || pkt[5] != 0x01) | ||
37 | return; | ||
38 | |||
35 | char ip[30]; | 39 | char ip[30]; |
36 | sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_dest)); | 40 | sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_dest)); |
37 | time_t seconds = time(NULL); | 41 | time_t seconds = time(NULL); |
38 | struct tm *t = localtime(&seconds); | 42 | struct tm *t = localtime(&seconds); |
39 | 43 | ||
40 | // expecting a handshake packet and client hello | ||
41 | if (pkt[0] != 0x16 || pkt[5] != 0x01) | ||
42 | goto errout; | ||
43 | |||
44 | |||
45 | // look for server name indication | 44 | // look for server name indication |
46 | unsigned char *ptr = pkt; | 45 | unsigned char *ptr = pkt; |
47 | unsigned int i = 0; | 46 | unsigned int i = 0; |
@@ -74,7 +73,7 @@ static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { | |||
74 | if (name) { | 73 | if (name) { |
75 | // filter output | 74 | // filter output |
76 | char tmp[sizeof(last)]; | 75 | char tmp[sizeof(last)]; |
77 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s %s", t->tm_hour, t->tm_min, t->tm_sec, ip, name); | 76 | snprintf(tmp, sizeof(last), "%02d:%02d:%02d %-15s SNI %s", t->tm_hour, t->tm_min, t->tm_sec, ip, name); |
78 | if (strcmp(tmp, last)) { | 77 | if (strcmp(tmp, last)) { |
79 | printf("%s\n", tmp); | 78 | printf("%s\n", tmp); |
80 | fflush(0); | 79 | fflush(0); |
@@ -85,11 +84,6 @@ static void print_tls(uint32_t ip_dest, unsigned char *pkt, unsigned len) { | |||
85 | goto nosni; | 84 | goto nosni; |
86 | return; | 85 | return; |
87 | 86 | ||
88 | errout: | ||
89 | printf("%02d:%02d:%02d %-15s Error: invalid TLS packet\n", t->tm_hour, t->tm_min, t->tm_sec, ip); | ||
90 | fflush(0); | ||
91 | return; | ||
92 | |||
93 | nosni: | 87 | nosni: |
94 | printf("%02d:%02d:%02d %-15s no SNI\n", t->tm_hour, t->tm_min, t->tm_sec, ip); | 88 | printf("%02d:%02d:%02d %-15s no SNI\n", t->tm_hour, t->tm_min, t->tm_sec, ip); |
95 | return; | 89 | return; |
diff --git a/src/fnettrace/event.c b/src/fnettrace/event.c new file mode 100644 index 000000000..f4ccf5360 --- /dev/null +++ b/src/fnettrace/event.c | |||
@@ -0,0 +1,105 @@ | |||
1 | /* | ||
2 | * Copyright (C) 2014-2023 Firejail Authors | ||
3 | * | ||
4 | * This file is part of firejail project | ||
5 | * | ||
6 | * This program is free software; you can redistribute it and/or modify | ||
7 | * it under the terms of the GNU General Public License as published by | ||
8 | * the Free Software Foundation; either version 2 of the License, or | ||
9 | * (at your option) any later version. | ||
10 | * | ||
11 | * This program is distributed in the hope that it will be useful, | ||
12 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
13 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
14 | * GNU General Public License for more details. | ||
15 | * | ||
16 | * You should have received a copy of the GNU General Public License along | ||
17 | * with this program; if not, write to the Free Software Foundation, Inc., | ||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | ||
19 | */ | ||
20 | #include "fnettrace.h" | ||
21 | |||
22 | typedef struct event_t { | ||
23 | struct event_t *next; | ||
24 | char *record; | ||
25 | } Event; | ||
26 | |||
27 | static Event *event = NULL; | ||
28 | static Event *last_event = NULL; | ||
29 | int ev_cnt = 0; | ||
30 | |||
31 | void ev_clear(void) { | ||
32 | ev_cnt = 0; | ||
33 | Event *ev = event; | ||
34 | while (ev) { | ||
35 | Event *next = ev->next; | ||
36 | free(ev->record); | ||
37 | free(ev); | ||
38 | ev = next; | ||
39 | } | ||
40 | event = NULL; | ||
41 | } | ||
42 | |||
43 | void ev_add(char *record) { | ||
44 | assert(record); | ||
45 | |||
46 | // braking recursivity | ||
47 | if (*record == '\0') | ||
48 | return; | ||
49 | |||
50 | char *ptr = strchr(record, '\n'); | ||
51 | if (ptr) | ||
52 | *ptr = '\0'; | ||
53 | |||
54 | // filter out duplicates | ||
55 | if (event && strcmp(event->record, record) == 0) | ||
56 | return; | ||
57 | |||
58 | Event *ev = malloc(sizeof(Event)); | ||
59 | if (!ev) | ||
60 | errExit("malloc"); | ||
61 | memset(ev, 0, sizeof(Event)); | ||
62 | |||
63 | ev->record = strdup(record); | ||
64 | if (!ev->record) | ||
65 | errExit("strdup"); | ||
66 | |||
67 | if (event == NULL) { | ||
68 | event = ev; | ||
69 | last_event = ev; | ||
70 | } | ||
71 | else { | ||
72 | last_event->next = ev; | ||
73 | last_event = ev; | ||
74 | } | ||
75 | ev_cnt++; | ||
76 | |||
77 | // recursivity | ||
78 | if (ptr) | ||
79 | ev_add(++ptr); | ||
80 | } | ||
81 | |||
82 | void ev_print(FILE *fp) { | ||
83 | assert(fp); | ||
84 | |||
85 | Event *ev = event; | ||
86 | while (ev) { | ||
87 | fprintf(fp, " "); | ||
88 | if (strstr(ev->record, "NXDOMAIN")) { | ||
89 | if (fp == stdout) | ||
90 | ansi_red(ev->record); | ||
91 | else | ||
92 | fprintf(fp, "%s", ev->record); | ||
93 | } | ||
94 | else if (strstr(ev->record, "SSH connection")) { | ||
95 | if (fp == stdout) | ||
96 | ansi_red(ev->record); | ||
97 | else | ||
98 | fprintf(fp, "%s", ev->record); | ||
99 | } | ||
100 | else | ||
101 | fprintf(fp, "%s", ev->record); | ||
102 | fprintf(fp, "\n"); | ||
103 | ev = ev->next; | ||
104 | } | ||
105 | } | ||
diff --git a/src/fnettrace/fnettrace.h b/src/fnettrace/fnettrace.h index b4a8f26c7..9b4973235 100644 --- a/src/fnettrace/fnettrace.h +++ b/src/fnettrace/fnettrace.h | |||
@@ -53,6 +53,27 @@ static inline void ansi_clrscr(void) { | |||
53 | fflush(0); | 53 | fflush(0); |
54 | } | 54 | } |
55 | 55 | ||
56 | static inline void ansi_bold(const char *str) { | ||
57 | char str1[] = {0x1b, '[', '1', 'm', '\0'}; | ||
58 | char str2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
59 | printf("%s%s%s", str1, str, str2); | ||
60 | fflush(0); | ||
61 | } | ||
62 | |||
63 | static inline void ansi_faint(const char *str) { | ||
64 | char str1[] = {0x1b, '[', '2', 'm', '\0'}; | ||
65 | char str2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
66 | printf("%s%s%s", str1, str, str2); | ||
67 | fflush(0); | ||
68 | } | ||
69 | |||
70 | static inline void ansi_red(const char *str) { | ||
71 | char str1[] = {0x1b, '[', '9', '1', 'm', '\0'}; | ||
72 | char str2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
73 | printf("%s%s%s", str1, str, str2); | ||
74 | fflush(0); | ||
75 | } | ||
76 | |||
56 | static inline uint8_t hash(uint32_t ip) { | 77 | static inline uint8_t hash(uint32_t ip) { |
57 | uint8_t *ptr = (uint8_t *) &ip; | 78 | uint8_t *ptr = (uint8_t *) &ip; |
58 | // simple byte xor | 79 | // simple byte xor |
@@ -78,4 +99,11 @@ void terminal_restore(void); | |||
78 | // runprog.c | 99 | // runprog.c |
79 | int runprog(const char *program); | 100 | int runprog(const char *program); |
80 | 101 | ||
102 | // event.c | ||
103 | extern int ev_cnt; | ||
104 | void ev_clear(void); | ||
105 | void ev_add(char *record); | ||
106 | void ev_print(FILE *fp); | ||
107 | |||
108 | |||
81 | #endif | 109 | #endif |
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c index 3bafd9090..4db8e7478 100644 --- a/src/fnettrace/main.c +++ b/src/fnettrace/main.c | |||
@@ -27,6 +27,12 @@ | |||
27 | 27 | ||
28 | static char *arg_log = NULL; | 28 | static char *arg_log = NULL; |
29 | 29 | ||
30 | // only 0 or negative values; positive values as defined in RFC | ||
31 | #define PROTOCOL_ICMP 0 | ||
32 | #define PROTOCOL_SSH -1 | ||
33 | |||
34 | |||
35 | |||
30 | //***************************************************************** | 36 | //***************************************************************** |
31 | // packet stats | 37 | // packet stats |
32 | //***************************************************************** | 38 | //***************************************************************** |
@@ -42,41 +48,18 @@ uint32_t stats_tor = 0; | |||
42 | uint32_t stats_http = 0; | 48 | uint32_t stats_http = 0; |
43 | uint32_t stats_ssh = 0; | 49 | uint32_t stats_ssh = 0; |
44 | 50 | ||
45 | //***************************************************************** | 51 | static void clear_stats(void) { |
46 | // sni/dns log storage | 52 | stats_pkts = 0; |
47 | //***************************************************************** | 53 | stats_icmp_echo = 0; |
48 | typedef struct lognode_t { | 54 | stats_dns = 0; |
49 | #define LOG_RECORD_LEN 255 | 55 | stats_dns_dot = 0; |
50 | char record[LOG_RECORD_LEN + 1]; | 56 | stats_dns_doh = 0; |
51 | } LogNode; | 57 | stats_dns_doq = 0; |
52 | // circular list of SNI log records | 58 | stats_tls = 0; |
53 | #define SNIMAX 64 | 59 | stats_quic = 0; |
54 | LogNode sni_table[SNIMAX] = {0}; | 60 | stats_tor = 0; |
55 | int sni_index = 0; | 61 | stats_http = 0; |
56 | 62 | stats_ssh = 0; | |
57 | // circular list of SNI log records | ||
58 | #define DNSMAX 64 | ||
59 | LogNode dns_table[SNIMAX] = {0}; | ||
60 | int dns_index = 0; | ||
61 | |||
62 | static void print_sni(void) { | ||
63 | int i; | ||
64 | for (i = sni_index; i < SNIMAX; i++) | ||
65 | if (*sni_table[i].record) | ||
66 | printf(" %s", sni_table[i].record); | ||
67 | for (i = 0; i < sni_index; i++) | ||
68 | if (*sni_table[i].record) | ||
69 | printf(" %s", sni_table[i].record); | ||
70 | } | ||
71 | |||
72 | static void print_dns(void) { | ||
73 | int i; | ||
74 | for (i = dns_index; i < DNSMAX; i++) | ||
75 | if (*dns_table[i].record) | ||
76 | printf(" %s", dns_table[i].record); | ||
77 | for (i = 0; i < dns_index; i++) | ||
78 | if (*dns_table[i].record) | ||
79 | printf(" %s", dns_table[i].record); | ||
80 | } | 63 | } |
81 | 64 | ||
82 | //***************************************************************** | 65 | //***************************************************************** |
@@ -92,7 +75,7 @@ typedef struct hnode_t { | |||
92 | uint32_t bytes; // number of bytes received in the last display interval | 75 | uint32_t bytes; // number of bytes received in the last display interval |
93 | uint32_t pkts; // number of packets received in the last display interval | 76 | uint32_t pkts; // number of packets received in the last display interval |
94 | uint16_t port_src; | 77 | uint16_t port_src; |
95 | uint8_t protocol; | 78 | int protocol; |
96 | 79 | ||
97 | // the firewall is build based on source address, and in the linked list | 80 | // the firewall is build based on source address, and in the linked list |
98 | // we could have elements with the same address but different ports | 81 | // we could have elements with the same address but different ports |
@@ -135,7 +118,7 @@ void hfree(HNode *ptr) { | |||
135 | } | 118 | } |
136 | 119 | ||
137 | // using protocol 0 and port 0 for ICMP | 120 | // using protocol 0 and port 0 for ICMP |
138 | static void hnode_add(uint32_t ip_src, uint8_t protocol, uint16_t port_src, uint32_t bytes) { | 121 | static void hnode_add(uint32_t ip_src, int protocol, uint16_t port_src, uint32_t bytes) { |
139 | uint8_t h = hash(ip_src); | 122 | uint8_t h = hash(ip_src); |
140 | 123 | ||
141 | // find | 124 | // find |
@@ -325,6 +308,8 @@ static inline const char *common_port(uint16_t port) { | |||
325 | return "Tor"; | 308 | return "Tor"; |
326 | else if (port == 9030) | 309 | else if (port == 9030) |
327 | return "Tor"; | 310 | return "Tor"; |
311 | else if (port == 9040) | ||
312 | return "Tor"; | ||
328 | else if (port == 9050) | 313 | else if (port == 9050) |
329 | return "Tor"; | 314 | return "Tor"; |
330 | else if (port == 9051) | 315 | else if (port == 9051) |
@@ -383,7 +368,9 @@ static void hnode_print(unsigned bw) { | |||
383 | else | 368 | else |
384 | sprintf(stats, "%u KB/s ", bw / (1024 * DISPLAY_INTERVAL)); | 369 | sprintf(stats, "%u KB/s ", bw / (1024 * DISPLAY_INTERVAL)); |
385 | // int len = snprintf(line, LINE_MAX, "%32s geoip %d, IP database %d\n", stats, geoip_calls, radix_nodes); | 370 | // int len = snprintf(line, LINE_MAX, "%32s geoip %d, IP database %d\n", stats, geoip_calls, radix_nodes); |
386 | int len = snprintf(line, LINE_MAX, "%32s address:port (protocol) network\n", stats); | 371 | char faint1[] = {0x1b, '[', '2', 'm', '\0'}; |
372 | char faint2[] = {0x1b, '[', '0', 'm', '\0'}; | ||
373 | int len = snprintf(line, LINE_MAX, "%32s %saddress:port (protocol) network%s\n", stats, faint1, faint2); | ||
387 | adjust_line(line, len, cols); | 374 | adjust_line(line, len, cols); |
388 | printf("%s", line); | 375 | printf("%s", line); |
389 | 376 | ||
@@ -461,10 +448,14 @@ static void hnode_print(unsigned bw) { | |||
461 | protocol = "UDP"; | 448 | protocol = "UDP"; |
462 | else if (ptr->protocol == 0x06) | 449 | else if (ptr->protocol == 0x06) |
463 | protocol = "TCP"; | 450 | protocol = "TCP"; |
451 | else if (ptr->protocol == PROTOCOL_SSH) { | ||
452 | protocol = "SSH"; | ||
453 | stats_ssh += ptr->pkts; | ||
454 | } | ||
464 | 455 | ||
465 | if (protocol == NULL) | 456 | if (protocol == NULL) |
466 | protocol = ""; | 457 | protocol = ""; |
467 | if (ptr->port_src == 0) | 458 | if (ptr->port_src == PROTOCOL_ICMP) |
468 | len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d (ICMP) %s\n", | 459 | len = snprintf(line, LINE_MAX, "%10s %s %d.%d.%d.%d (ICMP) %s\n", |
469 | bytes, bwline, PRINT_IP(ptr->ip_src), ptr->rnode->name); | 460 | bytes, bwline, PRINT_IP(ptr->ip_src), ptr->rnode->name); |
470 | else | 461 | else |
@@ -490,7 +481,7 @@ static void hnode_print(unsigned bw) { | |||
490 | 481 | ||
491 | ptr = next; | 482 | ptr = next; |
492 | } | 483 | } |
493 | printf("press any key to access stats\n"); | 484 | ansi_faint("(D)isplay, (S)ave, (C)lear, e(X)it\n"); |
494 | 485 | ||
495 | #ifdef DEBUG | 486 | #ifdef DEBUG |
496 | { | 487 | { |
@@ -505,10 +496,34 @@ static void hnode_print(unsigned bw) { | |||
505 | #endif | 496 | #endif |
506 | } | 497 | } |
507 | 498 | ||
499 | static void print_stats(FILE *fp) { | ||
500 | assert(fp); | ||
501 | |||
502 | fprintf(fp, "Stats: %u packets\n", stats_pkts); | ||
503 | fprintf(fp, " encrypted: TLS %u, QUIC %u, Tor %u\n", | ||
504 | stats_tls, stats_quic, stats_tor); | ||
505 | fprintf(fp, " unencrypted: HTTP %u\n", stats_http); | ||
506 | fprintf(fp, " C&C backchannel: SSH %u, PING %u, DNS %u, DoH %u, DoT %u, DoQ %u\n", | ||
507 | stats_ssh, stats_icmp_echo, stats_dns, stats_dns_doh, stats_dns_dot, stats_dns_doq); | ||
508 | |||
509 | fprintf(fp, "\n\nIP map"); | ||
510 | if (fp == stdout) | ||
511 | ansi_faint(" - network (packets)\n"); | ||
512 | else | ||
513 | fprintf(fp, " - network (packets)\n"); | ||
514 | radix_print(fp, 1); | ||
515 | |||
516 | fprintf(fp, "\n\nEvents %d", ev_cnt); | ||
517 | if (fp == stdout) | ||
518 | ansi_faint(" - time address data\n"); | ||
519 | else | ||
520 | fprintf(fp, " - time address data\n"); | ||
521 | ev_print(fp); | ||
508 | 522 | ||
509 | void print_stats(void) { | ||
510 | } | 523 | } |
511 | 524 | ||
525 | |||
526 | |||
512 | // trace rx traffic coming in | 527 | // trace rx traffic coming in |
513 | static void run_trace(void) { | 528 | static void run_trace(void) { |
514 | // trace only rx ipv4 tcp and upd | 529 | // trace only rx ipv4 tcp and upd |
@@ -523,7 +538,7 @@ static void run_trace(void) { | |||
523 | if (p1 != -1) | 538 | if (p1 != -1) |
524 | printf("loading snitrace..."); | 539 | printf("loading snitrace..."); |
525 | 540 | ||
526 | int p2 = runprog(LIBDIR "/firejail/fnettrace-dns --nolocal"); | 541 | int p2 = runprog(LIBDIR "/firejail/fnettrace-dns"); |
527 | if (p2 != -1) | 542 | if (p2 != -1) |
528 | printf("loading dnstrace..."); | 543 | printf("loading dnstrace..."); |
529 | unsigned last_print_traces = 0; | 544 | unsigned last_print_traces = 0; |
@@ -575,40 +590,67 @@ static void run_trace(void) { | |||
575 | int icmp = 0; | 590 | int icmp = 0; |
576 | 591 | ||
577 | if (FD_ISSET(0, &rfds)) { | 592 | if (FD_ISSET(0, &rfds)) { |
578 | getchar(); | 593 | int c = getchar(); |
579 | printf("\n\nStats: %u packets\n", stats_pkts); | 594 | if (c == 'c' || c == 'C') { |
580 | printf(" encrypted: TLS %u, QUIC %u, SSH %u, Tor %u\n", | 595 | clear_stats(); |
581 | stats_tls, stats_quic, stats_ssh, stats_tor); | 596 | ev_clear(); |
582 | printf(" unencrypted: HTTP %u\n", stats_http); | 597 | radix_clear_data(); |
583 | printf(" C&C backchannel: PING %u, DNS %u, DoH %u, DoT %u, DoQ %u\n", | 598 | continue; |
584 | stats_icmp_echo, stats_dns, stats_dns_doh, stats_dns_dot, stats_dns_doq); | 599 | } |
585 | printf("press any key to continue..."); | 600 | else if (c == 'd' || c == 'D') { |
586 | fflush(0); | 601 | printf("\n\n"); |
587 | 602 | ansi_bold("__________________________________________________________________________\n"); | |
588 | getchar(); | 603 | print_stats(stdout); |
589 | printf("\n\nSNI log - time server-address SNI\n"); | 604 | ansi_bold("__________________________________________________________________________\n"); |
590 | print_sni(); | 605 | ansi_faint("press any key to continue..."); |
591 | printf("press any key to continue..."); | 606 | fflush(0); |
592 | fflush(0); | 607 | |
593 | 608 | getchar(); | |
594 | getchar(); | 609 | continue; |
595 | printf("\n\nDNS log - time server-address domain\n"); | 610 | } |
596 | print_dns(); | 611 | if (c == 's' || c == 'S') { |
597 | printf("press any key to continue..."); | 612 | printf("The file is saved in /tmp directory. Please enter the file name: "); |
598 | fflush(0); | 613 | fflush(0); |
599 | 614 | ||
600 | getchar(); | 615 | char buf[LINE_MAX + 5]; // eave some room to add /tmp/ |
601 | printf("\n\nIP table: %d addresses - server-address network (packets)\n", radix_nodes); | 616 | strcpy(buf, "/tmp/"); |
602 | radix_print(1); | 617 | terminal_restore(); |
603 | printf("press any key to continue..."); | 618 | if (fgets(buf + 5, LINE_MAX, stdin) == NULL) |
604 | fflush(0); | 619 | errExit("fgets"); |
605 | 620 | terminal_set(); | |
606 | getchar(); | 621 | |
622 | // remove '\n' and open the file | ||
623 | char *ptr = strchr(buf, '\n'); | ||
624 | if (!ptr) { // we should have a '\n' | ||
625 | printf("Error: invalid file name\n"); | ||
626 | sleep(5); | ||
627 | continue; | ||
628 | } | ||
629 | *ptr = '\0'; | ||
630 | |||
631 | FILE *fp = fopen(buf, "w"); | ||
632 | if (!fp) { | ||
633 | printf("Error: cannot open file %s\n", buf); | ||
634 | perror("fopen"); | ||
635 | sleep(5); | ||
636 | continue; | ||
637 | } | ||
638 | |||
639 | printf("Saving stats in %s file...\n", buf); | ||
640 | print_stats(fp); | ||
641 | fclose(fp); | ||
642 | int rv = chmod(buf, 0600); | ||
643 | (void) rv; | ||
644 | sleep(1); | ||
645 | continue; | ||
646 | } | ||
647 | else if (c == 'x' || c == 'X') | ||
648 | break; | ||
607 | continue; | 649 | continue; |
608 | } | 650 | } |
609 | else if (FD_ISSET(p1, &rfds)) { | 651 | else if (FD_ISSET(p1, &rfds)) { |
610 | char buf[1024]; | 652 | char buf[LINE_MAX]; |
611 | ssize_t sz = read(p1, buf, 1024 - 1); | 653 | ssize_t sz = read(p1, buf, LINE_MAX - 1); |
612 | if (sz == -1) | 654 | if (sz == -1) |
613 | errExit("error reading snitrace"); | 655 | errExit("error reading snitrace"); |
614 | if (sz == 0) { | 656 | if (sz == 0) { |
@@ -618,19 +660,13 @@ static void run_trace(void) { | |||
618 | if (strncmp(buf, "SNI trace", 9) == 0) | 660 | if (strncmp(buf, "SNI trace", 9) == 0) |
619 | continue; | 661 | continue; |
620 | 662 | ||
621 | if (sz > LOG_RECORD_LEN) | ||
622 | sz = LOG_RECORD_LEN; | ||
623 | buf[sz] = '\0'; | 663 | buf[sz] = '\0'; |
624 | strcpy(sni_table[sni_index].record, buf); | 664 | ev_add(buf); |
625 | if (++sni_index >= SNIMAX) { | ||
626 | sni_index = 0; | ||
627 | *sni_table[sni_index].record = '\0'; | ||
628 | } | ||
629 | continue; | 665 | continue; |
630 | } | 666 | } |
631 | else if (FD_ISSET(p2, &rfds)) { | 667 | else if (FD_ISSET(p2, &rfds)) { |
632 | char buf[1024]; | 668 | char buf[LINE_MAX]; |
633 | ssize_t sz = read(p2, buf, 1024 - 1); | 669 | ssize_t sz = read(p2, buf, LINE_MAX - 1); |
634 | if (sz == -1) | 670 | if (sz == -1) |
635 | errExit("error reading dnstrace"); | 671 | errExit("error reading dnstrace"); |
636 | if (sz == 0) { | 672 | if (sz == 0) { |
@@ -640,16 +676,11 @@ static void run_trace(void) { | |||
640 | if (strncmp(buf, "DNS trace", 9) == 0) | 676 | if (strncmp(buf, "DNS trace", 9) == 0) |
641 | continue; | 677 | continue; |
642 | 678 | ||
643 | if (sz > LOG_RECORD_LEN) | ||
644 | sz = LOG_RECORD_LEN; | ||
645 | buf[sz] = '\0'; | 679 | buf[sz] = '\0'; |
646 | strcpy(dns_table[dns_index].record, buf); | 680 | ev_add(buf); |
647 | if (++dns_index >= DNSMAX) { | ||
648 | dns_index = 0; | ||
649 | *dns_table[dns_index].record = '\0'; | ||
650 | } | ||
651 | continue; | 681 | continue; |
652 | } | 682 | } |
683 | // by default we assume TCP | ||
653 | else if (FD_ISSET(s2, &rfds)) | 684 | else if (FD_ISSET(s2, &rfds)) |
654 | sock = s2; | 685 | sock = s2; |
655 | else if (FD_ISSET(s3, &rfds)) { | 686 | else if (FD_ISSET(s3, &rfds)) { |
@@ -658,7 +689,7 @@ static void run_trace(void) { | |||
658 | } | 689 | } |
659 | 690 | ||
660 | unsigned bytes = recvfrom(sock, buf, MAX_BUF_SIZE, 0, NULL, NULL); | 691 | unsigned bytes = recvfrom(sock, buf, MAX_BUF_SIZE, 0, NULL, NULL); |
661 | if (bytes >= 20) { // size of IP header | 692 | if (bytes >= 20) { // minimum size of IP packet |
662 | #ifdef DEBUG | 693 | #ifdef DEBUG |
663 | { | 694 | { |
664 | uint32_t ip_src; | 695 | uint32_t ip_src; |
@@ -682,12 +713,30 @@ static void run_trace(void) { | |||
682 | uint8_t hlen = (buf[0] & 0x0f) * 4; | 713 | uint8_t hlen = (buf[0] & 0x0f) * 4; |
683 | uint16_t port_src = 0; | 714 | uint16_t port_src = 0; |
684 | if (icmp) | 715 | if (icmp) |
685 | hnode_add(ip_src, 0, 0, bytes + 14); | 716 | hnode_add(ip_src, PROTOCOL_ICMP, 0, bytes + 14); |
686 | else { | 717 | else { // itcp or udp |
687 | memcpy(&port_src, buf + hlen, 2); | 718 | memcpy(&port_src, buf + hlen, 2); |
688 | port_src = ntohs(port_src); | 719 | port_src = ntohs(port_src); |
689 | 720 | int protocol = (int) buf[9]; | |
690 | uint8_t protocol = buf[9]; | 721 | |
722 | // detect ssh on a standard or not so standard port (22) | ||
723 | if (protocol == 6) { // tcp | ||
724 | uint8_t dataoffset = *(buf + hlen + 12); | ||
725 | uint8_t tcphlen = (dataoffset >> 2); | ||
726 | if (memcmp(buf + hlen + tcphlen, "SSH-", 4) == 0) { | ||
727 | time_t seconds = time(NULL); | ||
728 | struct tm *t = localtime(&seconds); | ||
729 | char ip[30]; | ||
730 | sprintf(ip, "%d.%d.%d.%d", PRINT_IP(ip_src)); | ||
731 | char *msg; | ||
732 | if (asprintf(&msg, "%02d:%02d:%02d %-15s SSH connection", | ||
733 | t->tm_hour, t->tm_min, t->tm_sec, ip) == -1) | ||
734 | errExit("asprintf"); | ||
735 | ev_add(msg); | ||
736 | free(msg); | ||
737 | protocol = PROTOCOL_SSH; | ||
738 | } | ||
739 | } | ||
691 | hnode_add(ip_src, protocol, port_src, bytes + 14); | 740 | hnode_add(ip_src, protocol, port_src, bytes + 14); |
692 | } | 741 | } |
693 | 742 | ||
@@ -705,7 +754,10 @@ static void run_trace(void) { | |||
705 | close(s1); | 754 | close(s1); |
706 | close(s2); | 755 | close(s2); |
707 | close(s3); | 756 | close(s3); |
708 | print_stats(); | 757 | if (p1 != -1) |
758 | close(p1); | ||
759 | if (p2 != -1) | ||
760 | close(p2); | ||
709 | } | 761 | } |
710 | 762 | ||
711 | 763 | ||
@@ -765,7 +817,7 @@ int main(int argc, char **argv) { | |||
765 | else if (strcmp(argv[i], "--print-map") == 0) { | 817 | else if (strcmp(argv[i], "--print-map") == 0) { |
766 | char *fname = "static-ip-map.txt"; | 818 | char *fname = "static-ip-map.txt"; |
767 | load_hostnames(fname); | 819 | load_hostnames(fname); |
768 | radix_print(0); | 820 | radix_print(stdout, 0); |
769 | return 0; | 821 | return 0; |
770 | } | 822 | } |
771 | else if (strncmp(argv[i], "--squash-map=", 13) == 0) { | 823 | else if (strncmp(argv[i], "--squash-map=", 13) == 0) { |
@@ -787,7 +839,7 @@ int main(int argc, char **argv) { | |||
787 | printf("# License GPLv2\n"); | 839 | printf("# License GPLv2\n"); |
788 | printf("#\n"); | 840 | printf("#\n"); |
789 | 841 | ||
790 | radix_print(0); | 842 | radix_print(stdout, 0); |
791 | printf("\n#\n#\n# input %d, output %d\n#\n#\n", in, radix_nodes); | 843 | printf("\n#\n#\n# input %d, output %d\n#\n#\n", in, radix_nodes); |
792 | fprintf(stderr, "static ip map: input %d, output %d\n", in, radix_nodes); | 844 | fprintf(stderr, "static ip map: input %d, output %d\n", in, radix_nodes); |
793 | return 0; | 845 | return 0; |
diff --git a/src/fnettrace/radix.c b/src/fnettrace/radix.c index 322ee2643..9dfa725a2 100644 --- a/src/fnettrace/radix.c +++ b/src/fnettrace/radix.c | |||
@@ -151,21 +151,22 @@ RNode *radix_longest_prefix_match(uint32_t ip) { | |||
151 | } | 151 | } |
152 | 152 | ||
153 | static uint32_t sum; | 153 | static uint32_t sum; |
154 | static void print(RNode *ptr, int level, int pkts) { | 154 | static void print(FILE *fp, RNode *ptr, int level, int pkts) { |
155 | assert(fp); | ||
155 | if (!ptr) | 156 | if (!ptr) |
156 | return; | 157 | return; |
157 | if (ptr->name) { | 158 | if (ptr->name) { |
158 | if (pkts) { | 159 | if (pkts) { |
159 | if (ptr->pkts) { | 160 | if (ptr->pkts) { |
160 | printf(" %d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); | 161 | fprintf(fp, " %d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); |
161 | printf("%s", ptr->name); | 162 | fprintf(fp, "%s", ptr->name); |
162 | printf(" (%u)\n", ptr->pkts); | 163 | fprintf(fp, " (%u)\n", ptr->pkts); |
163 | } | 164 | } |
164 | } | 165 | } |
165 | else { | 166 | else { |
166 | printf("%d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); | 167 | fprintf(fp, "%d.%d.%d.%d/%d ", PRINT_IP(sum << (32 - level)), level); |
167 | printf("%s", ptr->name); | 168 | fprintf(fp, "%s", ptr->name); |
168 | printf("\n"); | 169 | fprintf(fp, "\n"); |
169 | } | 170 | } |
170 | } | 171 | } |
171 | 172 | ||
@@ -174,21 +175,21 @@ static void print(RNode *ptr, int level, int pkts) { | |||
174 | 175 | ||
175 | level++; | 176 | level++; |
176 | sum <<= 1; | 177 | sum <<= 1; |
177 | print(ptr->zero, level, pkts); | 178 | print(fp, ptr->zero, level, pkts); |
178 | sum++; | 179 | sum++; |
179 | print(ptr->one, level, pkts); | 180 | print(fp, ptr->one, level, pkts); |
180 | sum--; | 181 | sum--; |
181 | sum >>= 1; | 182 | sum >>= 1; |
182 | } | 183 | } |
183 | 184 | ||
184 | void radix_print(int pkts) { | 185 | void radix_print(FILE *fp, int pkts) { |
185 | if (!head) | 186 | if (!head) |
186 | return; | 187 | return; |
187 | sum = 0; | 188 | sum = 0; |
188 | print(head->zero, 1, pkts); | 189 | print(fp, head->zero, 1, pkts); |
189 | assert(sum == 0); | 190 | assert(sum == 0); |
190 | sum = 1; | 191 | sum = 1; |
191 | print(head->one, 1, pkts); | 192 | print(fp, head->one, 1, pkts); |
192 | assert(sum == 1); | 193 | assert(sum == 1); |
193 | } | 194 | } |
194 | 195 | ||
@@ -241,3 +242,18 @@ void radix_squash(void) { | |||
241 | assert(sum == 1); | 242 | assert(sum == 1); |
242 | 243 | ||
243 | } | 244 | } |
245 | |||
246 | static void clear_data(RNode *ptr) { | ||
247 | if (!ptr) | ||
248 | return; | ||
249 | ptr->pkts = 0; | ||
250 | clear_data(ptr->zero); | ||
251 | clear_data(ptr->one); | ||
252 | } | ||
253 | |||
254 | void radix_clear_data(void) { | ||
255 | if (!head) | ||
256 | return; | ||
257 | clear_data(head->zero); | ||
258 | clear_data(head->one); | ||
259 | } | ||
diff --git a/src/fnettrace/radix.h b/src/fnettrace/radix.h index 358524723..686d60ace 100644 --- a/src/fnettrace/radix.h +++ b/src/fnettrace/radix.h | |||
@@ -30,7 +30,8 @@ typedef struct rnode_t { | |||
30 | extern int radix_nodes; | 30 | extern int radix_nodes; |
31 | RNode *radix_longest_prefix_match(uint32_t ip); | 31 | RNode *radix_longest_prefix_match(uint32_t ip); |
32 | RNode*radix_add(uint32_t ip, uint32_t mask, char *name); | 32 | RNode*radix_add(uint32_t ip, uint32_t mask, char *name); |
33 | void radix_print(int pkts); | 33 | void radix_print(FILE *fp, int pkts); |
34 | void radix_squash(void); | 34 | void radix_squash(void); |
35 | void radix_clear_data(void); | ||
35 | 36 | ||
36 | #endif | 37 | #endif |
diff --git a/src/fnettrace/static-ip-map.txt b/src/fnettrace/static-ip-map.txt index eb66df73f..830df058f 100644 --- a/src/fnettrace/static-ip-map.txt +++ b/src/fnettrace/static-ip-map.txt | |||
@@ -92,7 +92,7 @@ | |||
92 | 8.8.4.0/24 Google DNS | 92 | 8.8.4.0/24 Google DNS |
93 | 8.8.8.0/24 Google DNS | 93 | 8.8.8.0/24 Google DNS |
94 | 8.20.247.20/32 Comodo DNS | 94 | 8.20.247.20/32 Comodo DNS |
95 | 8.26.56.26/32 Comodo DNS | 95 | 8.26.56.0/24 Comodo DNS |
96 | 9.9.9.0/24 Quad9 DNS | 96 | 9.9.9.0/24 Quad9 DNS |
97 | 45.90.28.0/22 NextDNS | 97 | 45.90.28.0/22 NextDNS |
98 | 45.11.45.0/24 DNS-SB | 98 | 45.11.45.0/24 DNS-SB |
@@ -103,8 +103,7 @@ | |||
103 | 76.76.10.0/24 ControlD DNS | 103 | 76.76.10.0/24 ControlD DNS |
104 | 76.76.19.0/24 Alternate DNS | 104 | 76.76.19.0/24 Alternate DNS |
105 | 76.223.122.150/32 Alternate DNS | 105 | 76.223.122.150/32 Alternate DNS |
106 | 77.88.8.8/32 Yandex DNS | 106 | 77.88.8.0/24 Yandex DNS |
107 | 77.88.8.1/32 Yandex DNS | ||
108 | 80.80.80.0/24 Freenom DNS Cloud | 107 | 80.80.80.0/24 Freenom DNS Cloud |
109 | 80.80.81.0/24 Freenom DNS Cloud | 108 | 80.80.81.0/24 Freenom DNS Cloud |
110 | 84.200.69.80/32 DSN Watch | 109 | 84.200.69.80/32 DSN Watch |
@@ -123,8 +122,7 @@ | |||
123 | 205.171.3.66/32 CentyrLink DNS | 122 | 205.171.3.66/32 CentyrLink DNS |
124 | 205.171.202.166/32 CentyrLink DNS | 123 | 205.171.202.166/32 CentyrLink DNS |
125 | 208.67.216.0/21 OpenDNS | 124 | 208.67.216.0/21 OpenDNS |
126 | 216.146.35.35/32 Dyn DNS | 125 | 216.146.32.0/20 Dyn DNS |
127 | 216.146.36.36/32 Dyn DNS | ||
128 | 126 | ||
129 | # whois | 127 | # whois |
130 | 45.88.202.0/24 Anonymize Inc WHOIS Privacy Service | 128 | 45.88.202.0/24 Anonymize Inc WHOIS Privacy Service |
@@ -167,12 +165,9 @@ | |||
167 | 66.211.176.0/20 eBay | 165 | 66.211.176.0/20 eBay |
168 | 66.218.64.0/19 Yahoo | 166 | 66.218.64.0/19 Yahoo |
169 | 66.220.144.0/20 Facebook | 167 | 66.220.144.0/20 Facebook |
170 | 69.30.200.200/29 BitChute | ||
171 | 69.53.224.0/19 Netflix | 168 | 69.53.224.0/19 Netflix |
172 | 69.171.224.0/19 Facebook | 169 | 69.171.224.0/19 Facebook |
173 | 69.197.182.184/29 BitChute | ||
174 | 74.6.0.0/16 Yahoo | 170 | 74.6.0.0/16 Yahoo |
175 | 74.91.29.208/29 BitChute | ||
176 | 87.250.254.0/24 Yandex | 171 | 87.250.254.0/24 Yandex |
177 | 91.105.192.0/23 Telegram | 172 | 91.105.192.0/23 Telegram |
178 | 91.108.4.0/22 Telegram | 173 | 91.108.4.0/22 Telegram |
@@ -185,22 +180,16 @@ | |||
185 | 91.189.94.0/24 Ubuntu One | 180 | 91.189.94.0/24 Ubuntu One |
186 | 95.161.64.0/20 Telegram | 181 | 95.161.64.0/20 Telegram |
187 | 99.181.64.0/18 Twitch | 182 | 99.181.64.0/18 Twitch |
188 | 69.197.138.24/29 BitChute | ||
189 | 103.10.124.0/23 Steam | 183 | 103.10.124.0/23 Steam |
190 | 103.28.54.0/24 Steam | 184 | 103.28.54.0/24 Steam |
191 | 103.53.48.0/23 Twitch | 185 | 103.53.48.0/23 Twitch |
192 | 104.244.40.0/21 Twitter | 186 | 104.244.40.0/21 Twitter |
193 | 107.150.32.0/19 BitChute | ||
194 | 107.150.35.192/29 BitChute | ||
195 | 107.150.45.120/29 BitChute | ||
196 | 108.160.160.0/20 Dropbox | 187 | 108.160.160.0/20 Dropbox |
197 | 108.175.32.0/20 Netflix | 188 | 108.175.32.0/20 Netflix |
189 | 129.144.0.0/12 Oracle | ||
198 | 129.134.0.0/16 Facebook | 190 | 129.134.0.0/16 Facebook |
199 | 140.82.112.0/20 GitHub | 191 | 140.82.112.0/20 GitHub |
200 | 142.54.180.104/29 BitChute | 192 | 143.55.64.0/20 GitHub |
201 | 142.54.181.184/29 BitChute | ||
202 | 142.54.189.192/29 BitChute | ||
203 | 143.55.64.0/20 Github | ||
204 | 146.66.152.0/24 Steam | 193 | 146.66.152.0/24 Steam |
205 | 146.66.155.0/24 Steam | 194 | 146.66.155.0/24 Steam |
206 | 149.154.160.0/20 Telegram | 195 | 149.154.160.0/20 Telegram |
@@ -219,10 +208,6 @@ | |||
219 | 162.213.32.0/22 Ubuntu One | 208 | 162.213.32.0/22 Ubuntu One |
220 | 162.254.192.0/21 Steam | 209 | 162.254.192.0/21 Steam |
221 | 172.98.56.0/22 Rumble | 210 | 172.98.56.0/22 Rumble |
222 | 173.208.154.8/29 BitChute | ||
223 | 173.208.154.160/29 BitChute | ||
224 | 173.208.185.200/29 BitChute | ||
225 | 173.208.219.112/29 BitChute | ||
226 | 178.154.131.0/24 Yandex | 211 | 178.154.131.0/24 Yandex |
227 | 185.2.220.0/22 Netflix | 212 | 185.2.220.0/22 Netflix |
228 | 185.9.188.0/22 Netflix | 213 | 185.9.188.0/22 Netflix |
@@ -235,7 +220,6 @@ | |||
235 | 185.125.188.0/22 Ubuntu One | 220 | 185.125.188.0/22 Ubuntu One |
236 | 185.199.108.0/22 GitHub | 221 | 185.199.108.0/22 GitHub |
237 | 185.205.69.0/24 Tutanota | 222 | 185.205.69.0/24 Tutanota |
238 | 185.238.113.0/24 Bitchute | ||
239 | 188.64.224.0/21 Twitter | 223 | 188.64.224.0/21 Twitter |
240 | 190.217.33.0/24 Steam | 224 | 190.217.33.0/24 Steam |
241 | 192.0.64.0/18 Wordpress | 225 | 192.0.64.0/18 Wordpress |
@@ -243,24 +227,15 @@ | |||
243 | 192.30.252.0/22 GitHub | 227 | 192.30.252.0/22 GitHub |
244 | 192.69.96.0/22 Steam | 228 | 192.69.96.0/22 Steam |
245 | 192.108.239.0/24 Twitch | 229 | 192.108.239.0/24 Twitch |
246 | 192.151.158.136/29 BitChute | ||
247 | 192.173.64.0/18 Netflix | 230 | 192.173.64.0/18 Netflix |
248 | 192.187.97.88/29 BitChute | ||
249 | 192.187.114.96/29 BitChute | ||
250 | 192.187.123.112/29 BitChute | ||
251 | 192.187.126.0/29 BitChute | ||
252 | 192.189.200.0/23 Dropbox | 231 | 192.189.200.0/23 Dropbox |
253 | 194.169.254.0/24 Ubuntu One | 232 | 194.169.254.0/24 Ubuntu One |
254 | 198.38.96.0/19 Netflix | 233 | 198.38.96.0/19 Netflix |
255 | 198.45.48.0/20 Netflix | 234 | 198.45.48.0/20 Netflix |
256 | 198.204.226.120/29 BitChute | ||
257 | 198.204.245.88/29 BitChute | ||
258 | 198.252.206.0/24 Stack Exchange | 235 | 198.252.206.0/24 Stack Exchange |
259 | 199.9.248.0/21 Twitch | 236 | 199.9.248.0/21 Twitch |
260 | 199.16.156.0/22 Twitter | 237 | 199.16.156.0/22 Twitter |
261 | 199.59.148.0/22 Twitter | 238 | 199.59.148.0/22 Twitter |
262 | 199.168.96.24/29 BitChute | ||
263 | 204.12.194.176/29 BitChute | ||
264 | 205.185.194.0/24 Steam | 239 | 205.185.194.0/24 Steam |
265 | 205.196.6.0/24 Steam | 240 | 205.196.6.0/24 Steam |
266 | 207.45.72.0/22 Netflix | 241 | 207.45.72.0/22 Netflix |
@@ -270,9 +245,77 @@ | |||
270 | 208.75.76.0/22 Netflix | 245 | 208.75.76.0/22 Netflix |
271 | 208.78.164.0/22 Steam | 246 | 208.78.164.0/22 Steam |
272 | 208.80.152.0/22 Wikipedia | 247 | 208.80.152.0/22 Wikipedia |
273 | 208.110.68.56/29 BitChute | ||
274 | 209.140.128.0/18 eBay | 248 | 209.140.128.0/18 eBay |
275 | 249 | ||
250 | # BitChute | ||
251 | 63.141.247.168/29 BitChute | ||
252 | 63.141.247.240/29 BitChute | ||
253 | 69.30.200.200/29 BitChute | ||
254 | 69.30.230.64/29 BitChute | ||
255 | 69.30.241.40/29 BitChute | ||
256 | 69.30.241.48/29 BitChute | ||
257 | 69.30.243.168/29 BitChute | ||
258 | 69.30.245.232/29 BitChute | ||
259 | 69.30.253.16/29 BitChute | ||
260 | 69.197.182.184/29 BitChute | ||
261 | 74.91.28.208/29 BitChute | ||
262 | 74.91.29.208/29 BitChute | ||
263 | 69.197.138.24/29 BitChute | ||
264 | 107.150.32.0/19 BitChute | ||
265 | 107.150.35.192/29 BitChute | ||
266 | 107.150.45.120/29 BitChute | ||
267 | 142.54.180.104/29 BitChute | ||
268 | 142.54.181.184/29 BitChute | ||
269 | 142.54.188.112/29 BitChute | ||
270 | 142.54.189.192/29 BitChute | ||
271 | 173.208.154.8/29 BitChute | ||
272 | 173.208.154.160/29 BitChute | ||
273 | 173.208.176.128/29 BitChute | ||
274 | 173.208.185.200/29 BitChute | ||
275 | 173.208.203.224/29 BitChute | ||
276 | 173.208.203.248/29 BitChute | ||
277 | 173.208.211.224/29 BitChute | ||
278 | 173.208.216.40/29 BitChute | ||
279 | 173.208.219.112/29 BitChute | ||
280 | 173.208.246.160/29 BitChute | ||
281 | 185.238.113.0/24 BitChute | ||
282 | 192.151.147.16/29 BitChute | ||
283 | 192.151.158.136/29 BitChute | ||
284 | 192.187.97.88/29 BitChute | ||
285 | 192.187.114.16/29 BitChute | ||
286 | 192.187.114.96/29 BitChute | ||
287 | 192.187.118.168/29 BitChute | ||
288 | 192.187.121.208/29 BitChute | ||
289 | 192.187.122.72/29 BitChute | ||
290 | 192.187.123.112/29 BitChute | ||
291 | 192.187.126.0/29 BitChute | ||
292 | 198.204.226.120/29 BitChute | ||
293 | 198.204.228.48/29 BitChute | ||
294 | 198.204.235.88/29 BitChute | ||
295 | 198.204.235.216/29 BitChute | ||
296 | 198.204.245.32/29 BitChute | ||
297 | 198.204.245.88/29 BitChute | ||
298 | 198.204.250.208/29 BitChute | ||
299 | 198.204.253.64/29 BitChute | ||
300 | 198.204.253.184/29 BitChute | ||
301 | 199.168.96.24/29 BitChute | ||
302 | 199.168.96.64/29 BitChute | ||
303 | 204.12.220.136/29 BitChute | ||
304 | 204.12.194.176/29 BitChute | ||
305 | 204.12.194.248/29 BitChute | ||
306 | 204.12.220.232/29 BitChute | ||
307 | 208.110.68.56/29 BitChute | ||
308 | |||
309 | # WholeSale Internet | ||
310 | 69.30.192.0/18 WholeSale Internet | ||
311 | 69.197.128.0/18 WholeSale Internet | ||
312 | 142.54.160.0/19 WholeSale Internet | ||
313 | 173.208.128.0/17 WholeSale Internet | ||
314 | 204.12.192.0/18 WholeSale Internet | ||
315 | 208.67.0.0/21 WholeSale Internet | ||
316 | 208.110.64.0/19 WholeSale Internet | ||
317 | 208.110.91.0/24 WholeSale Internet | ||
318 | |||
276 | # Imperva | 319 | # Imperva |
277 | 199.83.128.0/21 Imperva | 320 | 199.83.128.0/21 Imperva |
278 | 198.143.32.0/19 Imperva | 321 | 198.143.32.0/19 Imperva |
@@ -297,6 +340,7 @@ | |||
297 | 66.243.0.0/17 Level 3 | 340 | 66.243.0.0/17 Level 3 |
298 | 66.243.128.0/18 Level 3 | 341 | 66.243.128.0/18 Level 3 |
299 | 66.251.192.0/19 Level 3 | 342 | 66.251.192.0/19 Level 3 |
343 | 74.202.0.0/15 Level 3 | ||
300 | 205.128.0.0/14 Level 3 | 344 | 205.128.0.0/14 Level 3 |
301 | 205.180.0.0/14 Level 3 | 345 | 205.180.0.0/14 Level 3 |
302 | 205.184.0.0/19 Level 3 | 346 | 205.184.0.0/19 Level 3 |
@@ -325,6 +369,7 @@ | |||
325 | 69.16.173.0/24 StackPath | 369 | 69.16.173.0/24 StackPath |
326 | 69.16.174.0/23 StackPath | 370 | 69.16.174.0/23 StackPath |
327 | 69.16.176.0/20 StackPath | 371 | 69.16.176.0/20 StackPath |
372 | 74.209.128.0/20 StackPath | ||
328 | 151.139.0.0/16 StackPath | 373 | 151.139.0.0/16 StackPath |
329 | 205.185.194.0/23 StackPath | 374 | 205.185.194.0/23 StackPath |
330 | 205.185.196.0/23 StackPath | 375 | 205.185.196.0/23 StackPath |
@@ -354,6 +399,7 @@ | |||
354 | 45.79.0.0/16 Linode | 399 | 45.79.0.0/16 Linode |
355 | 50.116.0.0/18 Linode | 400 | 50.116.0.0/18 Linode |
356 | 66.175.208.0/20 Linode | 401 | 66.175.208.0/20 Linode |
402 | 74.207.224.0/19 Linode | ||
357 | 103.29.68.0/22 Linode | 403 | 103.29.68.0/22 Linode |
358 | 104.200.16.0/21 Linode | 404 | 104.200.16.0/21 Linode |
359 | 104.200.24.0/22 Linode | 405 | 104.200.24.0/22 Linode |
@@ -461,6 +507,8 @@ | |||
461 | 23.72.0.0/13 Akamai | 507 | 23.72.0.0/13 Akamai |
462 | 23.192.0.0/11 Akamai | 508 | 23.192.0.0/11 Akamai |
463 | 72.246.0.0/15 Akamai | 509 | 72.246.0.0/15 Akamai |
510 | 74.121.124.0/22 Akamai | ||
511 | 92.122.160.0/20 Akamai | ||
464 | 96.6.0.0/15 Akamai | 512 | 96.6.0.0/15 Akamai |
465 | 96.16.0.0/15 Akamai | 513 | 96.16.0.0/15 Akamai |
466 | 104.64.0.0/10 Akamai | 514 | 104.64.0.0/10 Akamai |
@@ -533,6 +581,7 @@ | |||
533 | 20.48.0.0/12 Microsoft | 581 | 20.48.0.0/12 Microsoft |
534 | 20.128.0.0/16 Microsoft | 582 | 20.128.0.0/16 Microsoft |
535 | 20.192.0.0/10 Microsoft | 583 | 20.192.0.0/10 Microsoft |
584 | 23.96.0.0/13 Microsoft | ||
536 | 40.76.0.0/14 Microsoft | 585 | 40.76.0.0/14 Microsoft |
537 | 40.96.0.0/12 Microsoft | 586 | 40.96.0.0/12 Microsoft |
538 | 40.112.0.0/13 Microsoft | 587 | 40.112.0.0/13 Microsoft |
@@ -541,11 +590,38 @@ | |||
541 | 40.80.0.0/12 Microsoft | 590 | 40.80.0.0/12 Microsoft |
542 | 40.120.0.0/14 Microsoft | 591 | 40.120.0.0/14 Microsoft |
543 | 40.125.0.0/17 Microsoft | 592 | 40.125.0.0/17 Microsoft |
593 | 51.4.0.0/15 Microsoft | ||
594 | 51.8.0.0/16 Microsoft | ||
595 | 51.10.0.0/14 Microsoft | ||
596 | 51.51.0.0/16 Microsoft | ||
597 | 51.53.0.0/16 Microsoft | ||
598 | 51.103.0.0/16 Microsoft | ||
599 | 51.107.0.0/16 Microsoft | ||
600 | 51.116.0.0/16 Microsoft | ||
601 | 51.120.0.0/16 Microsoft | ||
602 | 51.124.0.0/16 Microsoft | ||
603 | 51.132.0.0/16 Microsoft | ||
604 | 51.136.0.0/16 Microsoft | ||
605 | 51.140.0.0/15 Microsoft | ||
606 | 52.96.0.0/12 Microsoft | ||
607 | 52.112.0.0/14 Microsoft | ||
608 | 52.120.0.0/14 Microsoft | ||
609 | 52.125.0.0/16 Microsoft | ||
610 | 52.126.0.0/15 Microsoft | ||
611 | 52.132.0.0/14 Microsoft | ||
612 | 52.136.0.0/13 Microsoft | ||
544 | 52.145.0.0/16 Microsoft | 613 | 52.145.0.0/16 Microsoft |
614 | 52.146.0.0/15 Microsoft | ||
545 | 52.148.0.0/14 Microsoft | 615 | 52.148.0.0/14 Microsoft |
546 | 52.152.0.0/13 Microsoft | 616 | 52.152.0.0/13 Microsoft |
547 | 52.146.0.0/15 Microsoft | ||
548 | 52.160.0.0/11 Microsoft | 617 | 52.160.0.0/11 Microsoft |
618 | 52.224.0.0/11 Microsoft | ||
619 | 74.160.0.0/14 Microsoft | ||
620 | 74.176.0.0/14 Microsoft | ||
621 | 74.224.0.0/14 Microsoft | ||
622 | 74.234.0.0/15 Microsoft | ||
623 | 74.240.0.0/14 Microsoft | ||
624 | 74.248.0.0/15 Microsoft | ||
549 | 168.61.0.0/16 Microsoft | 625 | 168.61.0.0/16 Microsoft |
550 | 168.62.0.0/15 Microsoft | 626 | 168.62.0.0/15 Microsoft |
551 | 627 | ||
@@ -561,6 +637,7 @@ | |||
561 | 206.190.32.0/19 Yahoo | 637 | 206.190.32.0/19 Yahoo |
562 | 209.73.160.0/19 Yahoo | 638 | 209.73.160.0/19 Yahoo |
563 | 209.191.64.0/18 Yahoo | 639 | 209.191.64.0/18 Yahoo |
640 | 212.82.100.0/22 Yahoo | ||
564 | 216.115.96.0/20 Yahoo | 641 | 216.115.96.0/20 Yahoo |
565 | 642 | ||
566 | 643 | ||
@@ -570,6 +647,18 @@ | |||
570 | 8.35.192.0/20 Google | 647 | 8.35.192.0/20 Google |
571 | 23.236.48.0/20 Google | 648 | 23.236.48.0/20 Google |
572 | 23.251.128.0/19 Google | 649 | 23.251.128.0/19 Google |
650 | 34.4.16.0/20 Google | ||
651 | 34.4.64.0/18 Google | ||
652 | 34.4.6.0/23 Google | ||
653 | 34.16.0.0/12 Google | ||
654 | 34.32.0.0/11 Google | ||
655 | 34.4.128.0/17 Google | ||
656 | 34.8.0.0/13 Google | ||
657 | 34.4.8.0/21 Google | ||
658 | 34.5.0.0/16 Google | ||
659 | 34.6.0.0/15 Google | ||
660 | 34.4.32.0/19 Google | ||
661 | 34.4.5.0/24 Google | ||
573 | 34.64.0.0/10 Google | 662 | 34.64.0.0/10 Google |
574 | 34.128.0.0/10 Google | 663 | 34.128.0.0/10 Google |
575 | 35.184.0.0/13 Google | 664 | 35.184.0.0/13 Google |
@@ -1820,6 +1909,7 @@ | |||
1820 | 34.192.0.0/12 Amazon | 1909 | 34.192.0.0/12 Amazon |
1821 | 34.208.0.0/12 Amazon | 1910 | 34.208.0.0/12 Amazon |
1822 | 34.224.0.0/12 Amazon | 1911 | 34.224.0.0/12 Amazon |
1912 | 34.225.127.72/10 Amazon | ||
1823 | 34.240.0.0/13 Amazon | 1913 | 34.240.0.0/13 Amazon |
1824 | 34.248.0.0/13 Amazon | 1914 | 34.248.0.0/13 Amazon |
1825 | 35.71.64.0/22 Amazon | 1915 | 35.71.64.0/22 Amazon |
@@ -3368,7 +3458,7 @@ | |||
3368 | 54.93.0.0/16 Amazon | 3458 | 54.93.0.0/16 Amazon |
3369 | 54.94.0.0/16 Amazon | 3459 | 54.94.0.0/16 Amazon |
3370 | 54.95.0.0/16 Amazon | 3460 | 54.95.0.0/16 Amazon |
3371 | 54.144.0.0/14 Amazon | 3461 | 54.144.0.0/12 Amazon |
3372 | 54.148.0.0/15 Amazon | 3462 | 54.148.0.0/15 Amazon |
3373 | 54.150.0.0/16 Amazon | 3463 | 54.150.0.0/16 Amazon |
3374 | 54.151.0.0/17 Amazon | 3464 | 54.151.0.0/17 Amazon |
@@ -3379,7 +3469,7 @@ | |||
3379 | 54.154.0.0/16 Amazon | 3469 | 54.154.0.0/16 Amazon |
3380 | 54.155.0.0/16 Amazon | 3470 | 54.155.0.0/16 Amazon |
3381 | 54.156.0.0/14 Amazon | 3471 | 54.156.0.0/14 Amazon |
3382 | 54.160.0.0/13 Amazon | 3472 | 54.160.0.0/11 Amazon |
3383 | 54.168.0.0/16 Amazon | 3473 | 54.168.0.0/16 Amazon |
3384 | 54.169.0.0/16 Amazon | 3474 | 54.169.0.0/16 Amazon |
3385 | 54.170.0.0/15 Amazon | 3475 | 54.170.0.0/15 Amazon |
@@ -3392,7 +3482,7 @@ | |||
3392 | 54.182.0.0/16 Amazon | 3482 | 54.182.0.0/16 Amazon |
3393 | 54.183.0.0/16 Amazon | 3483 | 54.183.0.0/16 Amazon |
3394 | 54.184.0.0/13 Amazon | 3484 | 54.184.0.0/13 Amazon |
3395 | 54.192.0.0/16 Amazon | 3485 | 54.192.0.0/12 Amazon |
3396 | 54.193.0.0/16 Amazon | 3486 | 54.193.0.0/16 Amazon |
3397 | 54.194.0.0/15 Amazon | 3487 | 54.194.0.0/15 Amazon |
3398 | 54.196.0.0/15 Amazon | 3488 | 54.196.0.0/15 Amazon |
@@ -3403,12 +3493,12 @@ | |||
3403 | 54.204.0.0/15 Amazon | 3493 | 54.204.0.0/15 Amazon |
3404 | 54.206.0.0/16 Amazon | 3494 | 54.206.0.0/16 Amazon |
3405 | 54.207.0.0/16 Amazon | 3495 | 54.207.0.0/16 Amazon |
3406 | 54.208.0.0/15 Amazon | 3496 | 54.208.0.0/13 Amazon |
3407 | 54.210.0.0/15 Amazon | 3497 | 54.210.0.0/15 Amazon |
3408 | 54.212.0.0/15 Amazon | 3498 | 54.212.0.0/15 Amazon |
3409 | 54.214.0.0/16 Amazon | 3499 | 54.214.0.0/16 Amazon |
3410 | 54.215.0.0/16 Amazon | 3500 | 54.215.0.0/16 Amazon |
3411 | 54.216.0.0/15 Amazon | 3501 | 54.216.0.0/14 Amazon |
3412 | 54.218.0.0/16 Amazon | 3502 | 54.218.0.0/16 Amazon |
3413 | 54.219.0.0/16 Amazon | 3503 | 54.219.0.0/16 Amazon |
3414 | 54.220.0.0/16 Amazon | 3504 | 54.220.0.0/16 Amazon |
@@ -3668,6 +3758,10 @@ | |||
3668 | 72.21.192.0/19 Amazon | 3758 | 72.21.192.0/19 Amazon |
3669 | 72.41.0.0/20 Amazon | 3759 | 72.41.0.0/20 Amazon |
3670 | 72.44.32.0/19 Amazon | 3760 | 72.44.32.0/19 Amazon |
3761 | 74.127.0.0/18 Amazon | ||
3762 | 74.190.0.0/16 Amazon | ||
3763 | 74.230.0.0/16 Amazon | ||
3764 | 74.250.0.0/16 Amazon | ||
3671 | 75.2.0.0/17 Amazon | 3765 | 75.2.0.0/17 Amazon |
3672 | 75.101.128.0/17 Amazon | 3766 | 75.101.128.0/17 Amazon |
3673 | 76.223.0.0/17 Amazon | 3767 | 76.223.0.0/17 Amazon |
@@ -5649,3 +5743,374 @@ | |||
5649 | 64.120.69.0/24 Leaseweb | 5743 | 64.120.69.0/24 Leaseweb |
5650 | 69.147.236.0/24 Leaseweb | 5744 | 69.147.236.0/24 Leaseweb |
5651 | 70.32.34.0/24 Leaseweb | 5745 | 70.32.34.0/24 Leaseweb |
5746 | |||
5747 | |||
5748 | |||
5749 | # GoDaddy | ||
5750 | 103.1.172.0/22 GoDaddy | ||
5751 | 103.1.172.0/24 GoDaddy | ||
5752 | 103.1.174.0/24 GoDaddy | ||
5753 | 103.1.175.0/24 GoDaddy | ||
5754 | 104.238.64.0/18 GoDaddy | ||
5755 | 104.238.64.0/19 GoDaddy | ||
5756 | 104.238.64.0/22 GoDaddy | ||
5757 | 104.238.64.0/24 GoDaddy | ||
5758 | 107.180.0.0/17 GoDaddy | ||
5759 | 107.180.0.0/18 GoDaddy | ||
5760 | 107.180.100.0/22 GoDaddy | ||
5761 | 107.180.104.0/22 GoDaddy | ||
5762 | 107.180.108.0/22 GoDaddy | ||
5763 | 107.180.120.0/22 GoDaddy | ||
5764 | 107.180.64.0/19 GoDaddy | ||
5765 | 118.139.160.0/19 GoDaddy | ||
5766 | 118.139.160.0/21 GoDaddy | ||
5767 | 132.148.0.0/16 GoDaddy | ||
5768 | 132.148.16.0/20 GoDaddy | ||
5769 | 132.148.16.0/22 GoDaddy | ||
5770 | 132.148.164.0/22 GoDaddy | ||
5771 | 132.148.184.0/21 GoDaddy | ||
5772 | 132.148.192.0/20 GoDaddy | ||
5773 | 132.148.20.0/22 GoDaddy | ||
5774 | 132.148.24.0/22 GoDaddy | ||
5775 | 132.148.32.0/21 GoDaddy | ||
5776 | 148.66.128.0/19 GoDaddy | ||
5777 | 148.66.128.0/22 GoDaddy | ||
5778 | 148.66.136.0/22 GoDaddy | ||
5779 | 148.66.140.0/22 GoDaddy | ||
5780 | 148.66.144.0/21 GoDaddy | ||
5781 | 148.72.0.0/17 GoDaddy | ||
5782 | 148.72.16.0/22 GoDaddy | ||
5783 | 148.72.204.0/22 GoDaddy | ||
5784 | 148.72.204.0/24 GoDaddy | ||
5785 | 148.72.206.0/23 GoDaddy | ||
5786 | 148.72.208.0/21 GoDaddy | ||
5787 | 148.72.220.0/22 GoDaddy | ||
5788 | 148.72.224.0/19 GoDaddy | ||
5789 | 148.72.224.0/20 GoDaddy | ||
5790 | 148.72.240.0/22 GoDaddy | ||
5791 | 148.72.244.0/22 GoDaddy | ||
5792 | 148.72.32.0/21 GoDaddy | ||
5793 | 148.72.32.0/23 GoDaddy | ||
5794 | 148.72.34.0/24 GoDaddy | ||
5795 | 148.72.36.0/24 GoDaddy | ||
5796 | 148.72.4.0/22 GoDaddy | ||
5797 | 148.72.44.0/22 GoDaddy | ||
5798 | 148.72.88.0/22 GoDaddy | ||
5799 | 160.153.32.0/19 GoDaddy | ||
5800 | 160.153.64.0/18 GoDaddy | ||
5801 | 160.153.64.0/19 GoDaddy | ||
5802 | 160.153.96.0/19 GoDaddy | ||
5803 | 166.62.0.0/19 GoDaddy | ||
5804 | 166.62.0.0/22 GoDaddy | ||
5805 | 166.62.0.0/24 GoDaddy | ||
5806 | 166.62.100.0/22 GoDaddy | ||
5807 | 166.62.10.0/23 GoDaddy | ||
5808 | 166.62.1.0/24 GoDaddy | ||
5809 | 166.62.112.0/20 GoDaddy | ||
5810 | 166.62.116.0/22 GoDaddy | ||
5811 | 166.62.120.0/22 GoDaddy | ||
5812 | 166.62.12.0/22 GoDaddy | ||
5813 | 166.62.12.0/24 GoDaddy | ||
5814 | 166.62.13.0/24 GoDaddy | ||
5815 | 166.62.15.0/24 GoDaddy | ||
5816 | 166.62.16.0/22 GoDaddy | ||
5817 | 166.62.17.0/24 GoDaddy | ||
5818 | 166.62.20.0/22 GoDaddy | ||
5819 | 166.62.2.0/24 GoDaddy | ||
5820 | 166.62.23.0/24 GoDaddy | ||
5821 | 166.62.24.0/22 GoDaddy | ||
5822 | 166.62.24.0/24 GoDaddy | ||
5823 | 166.62.25.0/24 GoDaddy | ||
5824 | 166.62.26.0/23 GoDaddy | ||
5825 | 166.62.28.0/22 GoDaddy | ||
5826 | 166.62.3.0/24 GoDaddy | ||
5827 | 166.62.32.0/19 GoDaddy | ||
5828 | 166.62.32.0/22 GoDaddy | ||
5829 | 166.62.36.0/22 GoDaddy | ||
5830 | 166.62.40.0/22 GoDaddy | ||
5831 | 166.62.4.0/22 GoDaddy | ||
5832 | 166.62.4.0/24 GoDaddy | ||
5833 | 166.62.44.0/22 GoDaddy | ||
5834 | 166.62.5.0/24 GoDaddy | ||
5835 | 166.62.52.0/22 GoDaddy | ||
5836 | 166.62.56.0/22 GoDaddy | ||
5837 | 166.62.60.0/22 GoDaddy | ||
5838 | 166.62.6.0/23 GoDaddy | ||
5839 | 166.62.64.0/18 GoDaddy | ||
5840 | 166.62.64.0/19 GoDaddy | ||
5841 | 166.62.80.0/22 GoDaddy | ||
5842 | 166.62.8.0/22 GoDaddy | ||
5843 | 166.62.8.0/24 GoDaddy | ||
5844 | 166.62.84.0/22 GoDaddy | ||
5845 | 166.62.88.0/22 GoDaddy | ||
5846 | 166.62.9.0/24 GoDaddy | ||
5847 | |||
5848 | # IBM cloud service | ||
5849 | # https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-ibm-cloud-ip-ranges | ||
5850 | # last update Aug 2023 | ||
5851 | 159.8.198.0/23 IBM | ||
5852 | 169.38.118.0/23 IBM | ||
5853 | 173.192.118.0/23 IBM | ||
5854 | 192.255.18.0/24 IBM | ||
5855 | 198.23.118.0/23 IBM | ||
5856 | 169.46.118.0/23 IBM | ||
5857 | 169.47.118.0/23 IBM | ||
5858 | 169.48.118.0/24 IBM | ||
5859 | 159.122.118.0/23 IBM | ||
5860 | 161.156.118.0/24 IBM | ||
5861 | 149.81.118.0/23 IBM | ||
5862 | 5.10.118.0/23 IBM | ||
5863 | 158.175.127.0/24 IBM | ||
5864 | 141.125.118.0/23 IBM | ||
5865 | 158.176.118.0/23 IBM | ||
5866 | 159.122.138.0/23 IBM | ||
5867 | 169.54.118.0/23 IBM | ||
5868 | 163.68.118.0/24 IBM | ||
5869 | 163.69.118.0/24 IBM | ||
5870 | 163.73.118.0/24 IBM | ||
5871 | 159.8.118.0/23 IBM | ||
5872 | 169.57.138.0/23 IBM | ||
5873 | 50.23.118.0/23 IBM | ||
5874 | 169.45.118.0/23 IBM | ||
5875 | 169.62.118.0/24 IBM | ||
5876 | 174.133.118.0/23 IBM | ||
5877 | 168.1.18.0/23 IBM | ||
5878 | 130.198.118.0/23 IBM | ||
5879 | 135.90.118.0/23 IBM | ||
5880 | 161.202.118.0/23 IBM | ||
5881 | 128.168.118.0/23 IBM | ||
5882 | 165.192.118.0/23 IBM | ||
5883 | 158.85.118.0/23 IBM | ||
5884 | 163.74.118.0/23 IBM | ||
5885 | 163.75.118.0/23 IBM | ||
5886 | 208.43.118.0/23 IBM | ||
5887 | 192.255.38.0/24 IBM | ||
5888 | 169.55.118.0/23 IBM | ||
5889 | 169.60.118.0/23 IBM | ||
5890 | 169.61.118.0/23 IBM | ||
5891 | 159.8.197.0/24 IBM | ||
5892 | 169.38.117.0/24 IBM | ||
5893 | 50.23.203.0/24 IBM | ||
5894 | 108.168.157.0/24 IBM | ||
5895 | 173.192.117.0/24 IBM | ||
5896 | 192.155.205.0/24 IBM | ||
5897 | 169.46.187.0/24 IBM | ||
5898 | 198.23.117.0/24 IBM | ||
5899 | 169.46.117.0/24 IBM | ||
5900 | 169.47.117.0/24 IBM | ||
5901 | 169.48.117.0/24 IBM | ||
5902 | 159.122.117.0/24 IBM | ||
5903 | 161.156.117.0/24 IBM | ||
5904 | 149.81.117.0/24 IBM | ||
5905 | 5.10.117.0/24 IBM | ||
5906 | 158.175.117.0/24 IBM | ||
5907 | 141.125.117.0/24 IBM | ||
5908 | 158.176.117.0/24 IBM | ||
5909 | 159.122.137.0/24 IBM | ||
5910 | 169.54.117.0/24 IBM | ||
5911 | 159.8.117.0/24 IBM | ||
5912 | 169.57.137.0/24 IBM | ||
5913 | 50.23.117.0/24 IBM | ||
5914 | 169.45.117.0/24 IBM | ||
5915 | 174.133.117.0/24 IBM | ||
5916 | 168.1.17.0/24 IBM | ||
5917 | 130.198.117.0/24 IBM | ||
5918 | 135.90.117.0/24 IBM | ||
5919 | 161.202.117.0/24 IBM | ||
5920 | 128.168.117.0/24 IBM | ||
5921 | 165.192.117.0/24 IBM | ||
5922 | 158.85.117.0/24 IBM | ||
5923 | 50.22.248.0/25 IBM | ||
5924 | 169.54.27.0/24 IBM | ||
5925 | 198.11.250.0/24 IBM | ||
5926 | 208.43.117.0/24 IBM | ||
5927 | 169.55.117.0/24 IBM | ||
5928 | 169.60.117.0/24 IBM | ||
5929 | 169.61.117.0/24 IBM | ||
5930 | 12.96.160.0/24 IBM | ||
5931 | 66.98.240.192/26 IBM | ||
5932 | 67.18.139.0/24 IBM | ||
5933 | 67.19.0.0/24 IBM | ||
5934 | 70.84.160.0/24 IBM | ||
5935 | 70.85.125.0/24 IBM | ||
5936 | 75.125.126.8/32 IBM | ||
5937 | 209.85.4.0/26 IBM | ||
5938 | 216.12.193.9/32 IBM | ||
5939 | 216.40.193.0/24 IBM | ||
5940 | 216.234.234.0/24 IBM | ||
5941 | |||
5942 | # Hetzner | ||
5943 | 116.202.0.0/16 Hetzner | ||
5944 | 116.203.0.0/16 Hetzner | ||
5945 | 128.140.0.0/17 Hetzner | ||
5946 | 135.181.0.0/16 Hetzner | ||
5947 | 142.132.128.0/17 Hetzner | ||
5948 | 157.90.0.0/16 Hetzner | ||
5949 | 159.69.0.0/16 Hetzner | ||
5950 | 162.55.0.0/16 Hetzner | ||
5951 | 167.233.0.0/16 Hetzner | ||
5952 | 167.235.0.0/16 Hetzner | ||
5953 | 168.119.0.0/16 Hetzner | ||
5954 | 176.9.0.0/16 Hetzner | ||
5955 | 178.63.0.0/16 Hetzner | ||
5956 | 188.34.128.0/17 Hetzner | ||
5957 | 188.40.0.0/16 Hetzner | ||
5958 | 195.201.0.0/16 Hetzner | ||
5959 | 213.239.192.0/18 Hetzner | ||
5960 | 23.88.0.0/17 Hetzner | ||
5961 | 37.27.0.0/16 Hetzner | ||
5962 | 46.4.0.0/16 Hetzner | ||
5963 | 49.12.0.0/16 Hetzner | ||
5964 | 49.13.0.0/16 Hetzner | ||
5965 | 5.75.128.0/17 Hetzner | ||
5966 | 5.9.0.0/16 Hetzner | ||
5967 | 65.108.0.0/16 Hetzner | ||
5968 | 65.109.0.0/16 Hetzner | ||
5969 | 65.21.0.0/16 Hetzner | ||
5970 | 78.46.0.0/15 Hetzner | ||
5971 | 85.10.192.0/18 Hetzner | ||
5972 | 88.198.0.0/16 Hetzner | ||
5973 | 88.99.0.0/16 Hetzner | ||
5974 | 91.107.128.0/17 Hetzner | ||
5975 | 94.130.0.0/16 Hetzner | ||
5976 | 95.216.0.0/16 Hetzner | ||
5977 | 95.217.0.0/16 Hetzner | ||
5978 | |||
5979 | # Liquid Web | ||
5980 | 159.135.48.0/20 Liquid Web | ||
5981 | 162.212.134.0/24 Liquid Web | ||
5982 | 162.252.104.0/22 Liquid Web | ||
5983 | 172.255.59.0/24 Liquid Web | ||
5984 | 173.199.128.0/18 Liquid Web | ||
5985 | 184.106.55.0/24 Liquid Web | ||
5986 | 192.126.88.0/22 Liquid Web | ||
5987 | 192.133.82.0/24 Liquid Web | ||
5988 | 192.138.16.0/21 Liquid Web | ||
5989 | 192.190.220.0/22 Liquid Web | ||
5990 | 192.251.32.0/24 Liquid Web | ||
5991 | 199.189.224.0/22 Liquid Web | ||
5992 | 199.195.118.0/24 Liquid Web | ||
5993 | 205.174.24.0/22 Liquid Web | ||
5994 | 207.246.248.0/21 Liquid Web | ||
5995 | 208.75.148.0/22 Liquid Web | ||
5996 | 208.79.232.0/21 Liquid Web | ||
5997 | 208.86.152.0/21 Liquid Web | ||
5998 | 209.124.89.0/24 Liquid Web | ||
5999 | 209.188.80.0/20 Liquid Web | ||
6000 | 209.59.128.0/18 Liquid Web | ||
6001 | 50.28.0.0/18 Liquid Web | ||
6002 | 50.28.5.0/24 Liquid Web | ||
6003 | 50.28.64.0/19 Liquid Web | ||
6004 | 50.57.240.0/20 Liquid Web | ||
6005 | 64.50.144.0/20 Liquid Web | ||
6006 | 64.50.144.0/23 Liquid Web | ||
6007 | 64.50.148.0/22 Liquid Web | ||
6008 | 64.50.152.0/21 Liquid Web | ||
6009 | 64.91.224.0/19 Liquid Web | ||
6010 | 67.225.128.0/17 Liquid Web | ||
6011 | 67.227.128.0/17 Liquid Web | ||
6012 | 67.43.0.0/20 Liquid Web | ||
6013 | 68.66.211.0/24 Liquid Web | ||
6014 | 69.160.56.0/24 Liquid Web | ||
6015 | 69.16.192.0/18 Liquid Web | ||
6016 | 69.16.222.0/23 Liquid Web | ||
6017 | 69.167.128.0/18 Liquid Web | ||
6018 | 72.52.128.0/17 Liquid Web | ||
6019 | 96.30.0.0/18 Liquid Web | ||
6020 | |||
6021 | # OVH | ||
6022 | 107.189.64.0/18 OVH | ||
6023 | 135.125.0.0/17 OVH | ||
6024 | 135.125.128.0/17 OVH | ||
6025 | 135.148.0.0/17 OVH | ||
6026 | 135.148.128.0/17 OVH | ||
6027 | 137.74.0.0/16 OVH | ||
6028 | 139.99.0.0/17 OVH | ||
6029 | 139.99.128.0/17 OVH | ||
6030 | 141.94.0.0/16 OVH | ||
6031 | 141.95.0.0/17 OVH | ||
6032 | 141.95.128.0/17 OVH | ||
6033 | 142.4.192.0/19 OVH | ||
6034 | 142.44.128.0/17 OVH | ||
6035 | 144.217.0.0/16 OVH | ||
6036 | 145.239.0.0/16 OVH | ||
6037 | 146.59.0.0/16 OVH | ||
6038 | 146.59.0.0/17 OVH | ||
6039 | 147.135.0.0/17 OVH | ||
6040 | 147.135.128.0/17 OVH | ||
6041 | 148.113.0.0/18 OVH | ||
6042 | 148.113.128.0/17 OVH | ||
6043 | 149.202.0.0/16 OVH | ||
6044 | 149.56.0.0/16 OVH | ||
6045 | 151.80.0.0/16 OVH | ||
6046 | 15.204.0.0/17 OVH | ||
6047 | 15.204.128.0/17 OVH | ||
6048 | 152.228.128.0/17 OVH | ||
6049 | 15.235.0.0/17 OVH | ||
6050 | 15.235.128.0/17 OVH | ||
6051 | 158.69.0.0/16 OVH | ||
6052 | 162.19.0.0/17 OVH | ||
6053 | 162.19.128.0/17 OVH | ||
6054 | 164.132.0.0/16 OVH | ||
6055 | 167.114.0.0/17 OVH | ||
6056 | 167.114.128.0/18 OVH | ||
6057 | 167.114.192.0/19 OVH | ||
6058 | 176.31.0.0/16 OVH | ||
6059 | 178.32.0.0/15 OVH | ||
6060 | 185.15.68.0/22 OVH | ||
6061 | 185.45.160.0/22 OVH | ||
6062 | 188.165.0.0/16 OVH | ||
6063 | 192.240.152.0/21 OVH | ||
6064 | 192.95.0.0/18 OVH | ||
6065 | 192.99.0.0/16 OVH | ||
6066 | 193.70.0.0/17 OVH | ||
6067 | 198.100.144.0/20 OVH | ||
6068 | 198.244.128.0/17 OVH | ||
6069 | 198.245.48.0/20 OVH | ||
6070 | 198.27.64.0/18 OVH | ||
6071 | 198.27.92.0/24 OVH | ||
6072 | 198.50.128.0/17 OVH | ||
6073 | 213.186.32.0/19 OVH | ||
6074 | 213.251.128.0/18 OVH | ||
6075 | 213.32.0.0/17 OVH | ||
6076 | 217.182.0.0/16 OVH | ||
6077 | 23.92.224.0/19 OVH | ||
6078 | 37.187.0.0/16 OVH | ||
6079 | 37.59.0.0/16 OVH | ||
6080 | 40.160.0.0/17 OVH | ||
6081 | 46.105.0.0/16 OVH | ||
6082 | 46.105.198.0/24 OVH | ||
6083 | 46.105.199.0/24 OVH | ||
6084 | 46.105.200.0/24 OVH | ||
6085 | 46.105.201.0/24 OVH | ||
6086 | 46.105.202.0/24 OVH | ||
6087 | 46.105.203.0/24 OVH | ||
6088 | 46.105.204.0/24 OVH | ||
6089 | 46.105.206.0/24 OVH | ||
6090 | 46.105.207.0/24 OVH | ||
6091 | 46.244.32.0/20 OVH | ||
6092 | 51.161.0.0/17 OVH | ||
6093 | 51.161.128.0/17 OVH | ||
6094 | |||
6095 | # Ionos | ||
6096 | 74.208.0.0/16 Ionos | ||
6097 | |||
6098 | # WPEngine | ||
6099 | 141.193.213.0/24 WPEngine | ||
6100 | |||
6101 | # Dreamhost | ||
6102 | 208.113.128.0/17 Dreamhost | ||
6103 | |||
6104 | # Shopify | ||
6105 | 23.227.32.0/19 Shopify | ||
6106 | |||
6107 | # Sucuri | ||
6108 | 66.248.200.0/22 Sucuri | ||
6109 | 185.93.228.0/22 Sucuri | ||
6110 | 192.88.134.0/23 Sucuri | ||
6111 | 192.124.249.0/24 Sucuri | ||
6112 | 192.161.0.0/24 Sucuri | ||
6113 | |||
6114 | # HostGator | ||
6115 | # Bluehost | ||
6116 | # Squarespace | ||
diff --git a/src/lib/syscall.c b/src/lib/syscall.c index ca7c61c8e..602f7218c 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c | |||
@@ -1104,13 +1104,13 @@ static const SyscallGroupList sysgroups[] = { | |||
1104 | #ifdef SYS_pciconfig_write | 1104 | #ifdef SYS_pciconfig_write |
1105 | "pciconfig_write," | 1105 | "pciconfig_write," |
1106 | #endif | 1106 | #endif |
1107 | #ifdef SYS_s390_mmio_read | 1107 | #ifdef SYS_s390_pci_mmio_read |
1108 | "s390_mmio_read," | 1108 | "s390_pci_mmio_read," |
1109 | #endif | 1109 | #endif |
1110 | #ifdef SYS_s390_mmio_write | 1110 | #ifdef SYS_s390_pci_mmio_write |
1111 | "s390_mmio_write" | 1111 | "s390_pci_mmio_write" |
1112 | #endif | 1112 | #endif |
1113 | #if !defined(SYS_ioperm) && !defined(SYS_iopl) && !defined(SYS_pciconfig_iobase) && !defined(SYS_pciconfig_read) && !defined(SYS_pciconfig_write) && !defined(SYS_s390_mmio_read) && !defined(SYS_s390_mmio_write) | 1113 | #if !defined(SYS_ioperm) && !defined(SYS_iopl) && !defined(SYS_pciconfig_iobase) && !defined(SYS_pciconfig_read) && !defined(SYS_pciconfig_write) && !defined(SYS_s390_pci_mmio_read) && !defined(SYS_s390_pci_mmio_write) |
1114 | "__dummy_syscall__" // workaround for s390x which doesn't have any of above defined and empty syscall lists are not allowed | 1114 | "__dummy_syscall__" // workaround for s390x which doesn't have any of above defined and empty syscall lists are not allowed |
1115 | #endif | 1115 | #endif |
1116 | }, | 1116 | }, |
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in index 19fc94ebd..06969e851 100644 --- a/src/man/firejail.1.in +++ b/src/man/firejail.1.in | |||
@@ -788,7 +788,6 @@ $ firejail \-\-list | |||
788 | .br | 788 | .br |
789 | $ firejail \-\-dns.print=3272 | 789 | $ firejail \-\-dns.print=3272 |
790 | 790 | ||
791 | #ifdef HAVE_NETWORK | ||
792 | .TP | 791 | .TP |
793 | \fB\-\-dnstrace[=name|pid] | 792 | \fB\-\-dnstrace[=name|pid] |
794 | Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes | 793 | Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -828,7 +827,6 @@ $ sudo firejail --dnstrace | |||
828 | .br | 827 | .br |
829 | 11:32:08 9.9.9.9 www.youtube.com (type 1) | 828 | 11:32:08 9.9.9.9 www.youtube.com (type 1) |
830 | .br | 829 | .br |
831 | #endif | ||
832 | 830 | ||
833 | .TP | 831 | .TP |
834 | \fB\-\-env=name=value | 832 | \fB\-\-env=name=value |
@@ -930,7 +928,6 @@ $ firejail --ignore=seccomp --ignore=caps firefox | |||
930 | $ firejail \-\-ignore="net eth0" firefox | 928 | $ firejail \-\-ignore="net eth0" firefox |
931 | #endif | 929 | #endif |
932 | 930 | ||
933 | #ifdef HAVE_NETWORK | ||
934 | .TP | 931 | .TP |
935 | \fB\-\-icmptrace[=name|pid] | 932 | \fB\-\-icmptrace[=name|pid] |
936 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | 933 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -956,7 +953,6 @@ $ sudo firejail --icmptrace | |||
956 | .br | 953 | .br |
957 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable | 954 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable |
958 | .br | 955 | .br |
959 | #endif | ||
960 | 956 | ||
961 | .TP | 957 | .TP |
962 | \fB\-\-\include=file.profile | 958 | \fB\-\-\include=file.profile |
@@ -1643,6 +1639,7 @@ PID User RX(KB/s) TX(KB/s) Command | |||
1643 | 1294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox | 1639 | 1294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox |
1644 | .br | 1640 | .br |
1645 | 7383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission | 1641 | 7383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission |
1642 | #endif | ||
1646 | .TP | 1643 | .TP |
1647 | \fB\-\-nettrace[=name|pid] | 1644 | \fB\-\-nettrace[=name|pid] |
1648 | Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | 1645 | Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -1658,17 +1655,15 @@ Example: | |||
1658 | .br | 1655 | .br |
1659 | $ sudo firejail --nettrace | 1656 | $ sudo firejail --nettrace |
1660 | .br | 1657 | .br |
1661 | 95 KB/s geoip 457, IP database 4436 | 1658 | 93 KB/s address:port (protocol) network |
1662 | .br | ||
1663 | 52 KB/s *********** 64.222.84.207:443 United States | ||
1664 | .br | 1659 | .br |
1665 | 33 KB/s ******* 89.147.74.105:63930 Hungary | 1660 | 14 B/s ** 104.24.8.4:443(QUIC) Cloudflare |
1666 | .br | 1661 | .br |
1667 | 0 B/s 45.90.28.0:443 NextDNS | 1662 | 80 KB/s ***************** 192.187.97.90:443(TLS) BitChute |
1668 | .br | 1663 | .br |
1669 | 0 B/s 94.70.122.176:52309(UDP) Greece | 1664 | 1 B/s 149.56.228.45:443(DoH) Canada |
1670 | .br | 1665 | .br |
1671 | 339 B/s 104.26.7.35:443 Cloudflare | 1666 | (D)isplay, (S)ave, (C)lear, e(X)it |
1672 | .br | 1667 | .br |
1673 | 1668 | ||
1674 | .br | 1669 | .br |
@@ -1677,7 +1672,6 @@ the country the traffic originates from is added to the trace. | |||
1677 | We also use the static IP map in /usr/lib/firejail/static-ip-map | 1672 | We also use the static IP map in /usr/lib/firejail/static-ip-map |
1678 | to print the domain names for some of the more common websites and cloud platforms. | 1673 | to print the domain names for some of the more common websites and cloud platforms. |
1679 | No external services are contacted for reverse IP lookup. | 1674 | No external services are contacted for reverse IP lookup. |
1680 | #endif | ||
1681 | .TP | 1675 | .TP |
1682 | \fB\-\-nice=value | 1676 | \fB\-\-nice=value |
1683 | Set nice value for all processes running inside the sandbox. | 1677 | Set nice value for all processes running inside the sandbox. |
@@ -2263,6 +2257,18 @@ All modifications are discarded when the sandbox is closed. | |||
2263 | Example: | 2257 | Example: |
2264 | .br | 2258 | .br |
2265 | $ firejail --private-opt=firefox /opt/firefox/firefox | 2259 | $ firejail --private-opt=firefox /opt/firefox/firefox |
2260 | .br | ||
2261 | |||
2262 | .br | ||
2263 | Note: Program installations in /opt tend to be relatively large and private-opt | ||
2264 | copies the entire path(s) into RAM, which may significantly increase RAM usage | ||
2265 | and break \fBfile-copy-limit\fR in firejail.config. | ||
2266 | Therefore, in general it is recommended to use "whitelist /opt/PATH" instead of | ||
2267 | "private-opt PATH". | ||
2268 | For details, see | ||
2269 | .UR https://github.com/netblue30/firejail/discussions/5307 | ||
2270 | #5307 | ||
2271 | .UE | ||
2266 | 2272 | ||
2267 | .TP | 2273 | .TP |
2268 | \fB\-\-private-srv=file,directory | 2274 | \fB\-\-private-srv=file,directory |
@@ -2850,7 +2856,6 @@ $ firejail \-\-list | |||
2850 | .br | 2856 | .br |
2851 | $ firejail \-\-shutdown=3272 | 2857 | $ firejail \-\-shutdown=3272 |
2852 | 2858 | ||
2853 | #ifdef HAVE_NETWORK | ||
2854 | .TP | 2859 | .TP |
2855 | \fB\-\-snitrace[=name|pid] | 2860 | \fB\-\-snitrace[=name|pid] |
2856 | Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes | 2861 | Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes |
@@ -2892,7 +2897,6 @@ $ sudo firejail --snitrace | |||
2892 | .br | 2897 | .br |
2893 | 07:53:11 192.0.73.2 1.gravatar.com | 2898 | 07:53:11 192.0.73.2 1.gravatar.com |
2894 | .br | 2899 | .br |
2895 | #endif | ||
2896 | 2900 | ||
2897 | .TP | 2901 | .TP |
2898 | \fB\-\-tab | 2902 | \fB\-\-tab |
diff --git a/test/compile/compile.sh b/test/compile/compile.sh index 0e3425f8d..b7a3b39d8 100755 --- a/test/compile/compile.sh +++ b/test/compile/compile.sh | |||
@@ -52,7 +52,7 @@ print_title() { | |||
52 | echo "**************************************************" | 52 | echo "**************************************************" |
53 | } | 53 | } |
54 | 54 | ||
55 | DIST="$(TARNAME)-$(VERSION)" | 55 | DIST="$TARNAME-$VERSION" |
56 | while [[ $# -gt 0 ]]; do # Until you run out of parameters . . . | 56 | while [[ $# -gt 0 ]]; do # Until you run out of parameters . . . |
57 | case "$1" in | 57 | case "$1" in |
58 | --clean) | 58 | --clean) |
diff --git a/test/fs/kmsg.exp b/test/fs/kmsg.exp index 3f952a4d4..deab8fcf5 100755 --- a/test/fs/kmsg.exp +++ b/test/fs/kmsg.exp | |||
@@ -7,7 +7,7 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail\r" | 10 | send -- "firejail --ignore=private-dev\r" |
11 | expect { | 11 | expect { |
12 | timeout {puts "TESTING ERROR 1\n";exit} | 12 | timeout {puts "TESTING ERROR 1\n";exit} |
13 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | 13 | -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" |
diff --git a/test/sysutils/strings.exp b/test/sysutils/strings.exp index f440a7674..cec1aac69 100755 --- a/test/sysutils/strings.exp +++ b/test/sysutils/strings.exp | |||
@@ -13,7 +13,7 @@ sleep 1 | |||
13 | send -- "firejail /usr/bin/strings /usr/bin/firejail > firejail_t2\r" | 13 | send -- "firejail /usr/bin/strings /usr/bin/firejail > firejail_t2\r" |
14 | sleep 1 | 14 | sleep 1 |
15 | 15 | ||
16 | send -- "diff -s firejail_t1 firejail_t2\r" | 16 | send -- "diff -s firejail_t1 firejail_t2 | head\r" |
17 | expect { | 17 | expect { |
18 | timeout {puts "TESTING ERROR 1\n";exit} | 18 | timeout {puts "TESTING ERROR 1\n";exit} |
19 | "firejail_t1 and firejail_t2 are identical" | 19 | "firejail_t1 and firejail_t2 are identical" |
diff --git a/test/sysutils/sysutils.sh b/test/sysutils/sysutils.sh index f5567ff02..354bd0aba 100755 --- a/test/sysutils/sysutils.sh +++ b/test/sysutils/sysutils.sh | |||
@@ -121,8 +121,8 @@ fi | |||
121 | 121 | ||
122 | if command -v wget | 122 | if command -v wget |
123 | then | 123 | then |
124 | echo "TESTING: wget" | 124 | echo "TESTING: FIXME: wget" |
125 | ./wget.exp | 125 | #./wget.exp # FIXME: Broken in CI |
126 | else | 126 | else |
127 | echo "TESTING SKIP: wget not found" | 127 | echo "TESTING SKIP: wget not found" |
128 | fi | 128 | fi |
@@ -137,8 +137,8 @@ fi | |||
137 | 137 | ||
138 | if command -v strings | 138 | if command -v strings |
139 | then | 139 | then |
140 | echo "TESTING: strings" | 140 | echo "TESTING: FIXME: strings" |
141 | ./strings.exp | 141 | #./strings.exp # FIXME: Broken since commit 3077b2d1f |
142 | else | 142 | else |
143 | echo "TESTING SKIP: strings not found" | 143 | echo "TESTING SKIP: strings not found" |
144 | fi | 144 | fi |
diff --git a/test/sysutils/wget.exp b/test/sysutils/wget.exp index 7f994ff81..26756eeb2 100755 --- a/test/sysutils/wget.exp +++ b/test/sysutils/wget.exp | |||
@@ -3,7 +3,7 @@ | |||
3 | # Copyright (C) 2014-2023 Firejail Authors | 3 | # Copyright (C) 2014-2023 Firejail Authors |
4 | # License GPL v2 | 4 | # License GPL v2 |
5 | 5 | ||
6 | set timeout 10 | 6 | set timeout 30 |
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
diff --git a/test/utils/build.exp b/test/utils/build.exp index e1ea6af69..d8813b3a4 100755 --- a/test/utils/build.exp +++ b/test/utils/build.exp | |||
@@ -94,15 +94,19 @@ expect { | |||
94 | } | 94 | } |
95 | after 100 | 95 | after 100 |
96 | 96 | ||
97 | send -- "firejail --build wget --output-document=~ debian.org\r" | 97 | # increase the timeout for remote services |
98 | expect { | 98 | set timeout 30 |
99 | timeout {puts "TESTING ERROR 13\n";exit} | 99 | |
100 | "protocol" | 100 | # FIXME: Broken in CI |
101 | } | 101 | #send -- "firejail --build wget --output-document=~ debian.org\r" |
102 | expect { | 102 | #expect { |
103 | timeout {puts "TESTING ERROR 13.1\n";exit} | 103 | # timeout {puts "TESTING ERROR 13\n";exit} |
104 | "inet" | 104 | # "protocol" |
105 | } | 105 | #} |
106 | after 100 | 106 | #expect { |
107 | # timeout {puts "TESTING ERROR 13.1\n";exit} | ||
108 | # "inet" | ||
109 | #} | ||
110 | #after 100 | ||
107 | 111 | ||
108 | puts "all done\n" | 112 | puts "all done\n" |
diff --git a/test/utils/trace.exp b/test/utils/trace.exp index 3805955d7..282b52e50 100755 --- a/test/utils/trace.exp +++ b/test/utils/trace.exp | |||
@@ -52,7 +52,8 @@ expect { | |||
52 | } | 52 | } |
53 | sleep 1 | 53 | sleep 1 |
54 | 54 | ||
55 | send -- "firejail --trace wget -q debian.org\r" | 55 | # FIXME: Broken in CI |
56 | #send -- "firejail --trace wget -q debian.org\r" | ||
56 | #expect { | 57 | #expect { |
57 | # timeout {puts "TESTING ERROR 8.1\n";exit} | 58 | # timeout {puts "TESTING ERROR 8.1\n";exit} |
58 | # -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" | 59 | # -re "Child process initialized in \[0-9\]+.\[0-9\]+ ms" |
@@ -62,22 +63,23 @@ send -- "firejail --trace wget -q debian.org\r" | |||
62 | # "bash:open /dev/tty" {puts "OK\n";} | 63 | # "bash:open /dev/tty" {puts "OK\n";} |
63 | # "bash:open64 /dev/tty" {puts "OK\n";} | 64 | # "bash:open64 /dev/tty" {puts "OK\n";} |
64 | #} | 65 | #} |
65 | expect { | 66 | #expect { |
66 | timeout {puts "TESTING ERROR 8.3\n";exit} | 67 | # timeout {puts "TESTING ERROR 8.3\n";exit} |
67 | "wget:fopen64 /etc/wgetrc" {puts "OK\n";} | 68 | # "wget:fopen64 /etc/wgetrc" {puts "OK\n";} |
68 | "wget:fopen /etc/wgetrc" {puts "OK\n";} | 69 | # "wget:fopen /etc/wgetrc" {puts "OK\n";} |
69 | } | 70 | #} |
70 | expect { | 71 | #expect { |
71 | timeout {puts "TESTING ERROR 8.5\n";exit} | 72 | # timeout {puts "TESTING ERROR 8.5\n";exit} |
72 | "wget:connect" | 73 | # "wget:connect" |
73 | } | 74 | #} |
74 | expect { | 75 | #expect { |
75 | timeout {puts "TESTING ERROR 8.6\n";exit} | 76 | # timeout {puts "TESTING ERROR 8.6\n";exit} |
76 | "wget:fopen64 index.html" {puts "OK\n";} | 77 | # "wget:stat64 index.html" {puts "OK\n";} |
77 | "wget:fopen index.html" {puts "OK\n";} | 78 | # "wget:fopen64 index.html" {puts "OK\n";} |
78 | "Parent is shutting down" {puts "OK\n";} | 79 | # "wget:fopen index.html" {puts "OK\n";} |
79 | } | 80 | # "Parent is shutting down" {puts "OK\n";} |
80 | sleep 1 | 81 | #} |
82 | #sleep 1 | ||
81 | 83 | ||
82 | send -- "firejail --trace rm index.html\r" | 84 | send -- "firejail --trace rm index.html\r" |
83 | expect { | 85 | expect { |