diff options
-rw-r--r-- | Makefile.in | 3 | ||||
-rw-r--r-- | README | 5 | ||||
-rw-r--r-- | README.md | 8 | ||||
-rw-r--r-- | RELNOTES | 2 | ||||
-rw-r--r-- | etc/corebird.profile | 12 | ||||
-rw-r--r-- | etc/disable-common.inc | 1 | ||||
-rw-r--r-- | etc/disable-programs.inc | 1 | ||||
-rw-r--r-- | etc/firejail.config | 4 | ||||
-rw-r--r-- | etc/konversation.profile | 12 | ||||
-rw-r--r-- | etc/psi-plus.profile | 27 | ||||
-rw-r--r-- | etc/whitelist-common.inc | 1 | ||||
-rw-r--r-- | platform/debian/conffiles | 3 | ||||
-rw-r--r-- | src/firejail/checkcfg.c | 2 | ||||
-rw-r--r-- | src/firejail/main.c | 31 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 2 | ||||
-rw-r--r-- | src/man/firejail-config.txt | 4 |
16 files changed, 106 insertions, 12 deletions
diff --git a/Makefile.in b/Makefile.in index 34daed387..edcf09225 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -184,6 +184,9 @@ realinstall: | |||
184 | install -c -m 0644 .etc/xreader.profile $(DESTDIR)/$(sysconfdir)/firejail/. | 184 | install -c -m 0644 .etc/xreader.profile $(DESTDIR)/$(sysconfdir)/firejail/. |
185 | install -c -m 0644 .etc/xviewer.profile $(DESTDIR)/$(sysconfdir)/firejail/. | 185 | install -c -m 0644 .etc/xviewer.profile $(DESTDIR)/$(sysconfdir)/firejail/. |
186 | install -c -m 0644 .etc/mcabber.profile $(DESTDIR)/$(sysconfdir)/firejail/. | 186 | install -c -m 0644 .etc/mcabber.profile $(DESTDIR)/$(sysconfdir)/firejail/. |
187 | install -c -m 0644 .etc/corebird.profile $(DESTDIR)/$(sysconfdir)/firejail/. | ||
188 | install -c -m 0644 .etc/konversation.profile $(DESTDIR)/$(sysconfdir)/firejail/. | ||
189 | install -c -m 0644 .etc/psi-plus.profile $(DESTDIR)/$(sysconfdir)/firejail/. | ||
187 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" | 190 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/login.users ]; then install -c -m 0644 etc/login.users $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" |
188 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/firejail.config ]; then install -c -m 0644 etc/firejail.config $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" | 191 | sh -c "if [ ! -f $(DESTDIR)/$(sysconfdir)/firejail/firejail.config ]; then install -c -m 0644 etc/firejail.config $(DESTDIR)/$(sysconfdir)/firejail/.; fi;" |
189 | rm -fr .etc | 192 | rm -fr .etc |
@@ -25,6 +25,11 @@ Reiner Herrmann | |||
25 | - clang-analyzer fixes | 25 | - clang-analyzer fixes |
26 | - Debian reproducible build | 26 | - Debian reproducible build |
27 | - unit testing framework | 27 | - unit testing framework |
28 | KellerFuchs (https://github.com/KellerFuchs) | ||
29 | - nonewpriv support | ||
30 | ValdikSS (https://github.com/ValdikSS) | ||
31 | - Psi+, Corebird, Konversation profiles | ||
32 | - various profile fixes | ||
28 | avoidr (https://github.com/avoidr) | 33 | avoidr (https://github.com/avoidr) |
29 | - whitelist fix | 34 | - whitelist fix |
30 | - recently-used.xbel fix | 35 | - recently-used.xbel fix |
@@ -197,9 +197,9 @@ The following features can be enabled or disabled: | |||
197 | restricted-network | 197 | restricted-network |
198 | Enable or disable restricted network support, default disabled. | 198 | Enable or disable restricted network support, default disabled. |
199 | If enabled, networking features should also be enabled (network | 199 | If enabled, networking features should also be enabled (network |
200 | yes). Restricted networking grants access to --interface and | 200 | yes). Restricted networking grants access to --interface, |
201 | --net=ethXXX only to root user. Regular users are only allowed | 201 | --net=ethXXX and --netfilter only to root user. Regular users |
202 | --net=none. | 202 | are only allowed --net=none. Default disabled |
203 | 203 | ||
204 | secomp Enable or disable seccomp support, default enabled. | 204 | secomp Enable or disable seccomp support, default enabled. |
205 | 205 | ||
@@ -290,6 +290,6 @@ $ man firejail-profile | |||
290 | lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril, qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars, qTox, | 290 | lxterminal, Epiphany, cherrytree, Polari, Vivaldi, Atril, qutebrowser, SlimJet, Battle for Wesnoth, Hedgewars, qTox, |
291 | OpenSSH client, OpenBox window manager, Dillo, cmus, dnsmasq, PaleMoon, Icedove, abrowser, 0ad, netsurf, | 291 | OpenSSH client, OpenBox window manager, Dillo, cmus, dnsmasq, PaleMoon, Icedove, abrowser, 0ad, netsurf, |
292 | Warzone2100, okular, gwenview, Gpredict, Aweather, Stellarium, Google-Play-Music-Desktop-Player, quiterss, | 292 | Warzone2100, okular, gwenview, Gpredict, Aweather, Stellarium, Google-Play-Music-Desktop-Player, quiterss, |
293 | cyberfox, generic Ubuntu snap application profile, xplayer, xreader, xviewer, mcabber | 293 | cyberfox, generic Ubuntu snap application profile, xplayer, xreader, xviewer, mcabber, Psi+, Corebird, Konversation |
294 | 294 | ||
295 | 295 | ||
@@ -24,7 +24,7 @@ firejail (0.9.40) baseline; urgency=low | |||
24 | * new profiles: okular, gwenview, Google-Play-Music-Desktop-Player | 24 | * new profiles: okular, gwenview, Google-Play-Music-Desktop-Player |
25 | * new profiles: Aweather, Stellarium, gpredict, quiterss, cyberfox | 25 | * new profiles: Aweather, Stellarium, gpredict, quiterss, cyberfox |
26 | * new profiles: generic Ubuntu snap application profile, xplayer | 26 | * new profiles: generic Ubuntu snap application profile, xplayer |
27 | * new profiles: xreader, xviewer, mcabber | 27 | * new profiles: xreader, xviewer, mcabber, Psi+, Corebird, Konversation |
28 | * generic.profile renamed default.profile | 28 | * generic.profile renamed default.profile |
29 | * build rpm packages using "make rpms" | 29 | * build rpm packages using "make rpms" |
30 | * bugfixes | 30 | * bugfixes |
diff --git a/etc/corebird.profile b/etc/corebird.profile new file mode 100644 index 000000000..f3f73a44f --- /dev/null +++ b/etc/corebird.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail corebird profile | ||
2 | |||
3 | include /etc/firejail/disable-common.inc | ||
4 | include /etc/firejail/disable-programs.inc | ||
5 | include /etc/firejail/disable-devel.inc | ||
6 | include /etc/firejail/disable-passwdmgr.inc | ||
7 | |||
8 | caps.drop all | ||
9 | seccomp | ||
10 | protocol unix,inet,inet6 | ||
11 | netfilter | ||
12 | noroot | ||
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index 479f32cb1..a61f1b210 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -93,6 +93,7 @@ read-only ${HOME}/bin | |||
93 | 93 | ||
94 | # top secret | 94 | # top secret |
95 | blacklist ${HOME}/.ssh | 95 | blacklist ${HOME}/.ssh |
96 | blacklist ${HOME}/.cert | ||
96 | blacklist ${HOME}/.gnome2/keyrings | 97 | blacklist ${HOME}/.gnome2/keyrings |
97 | blacklist ${HOME}/kde4/share/apps/kwallet | 98 | blacklist ${HOME}/kde4/share/apps/kwallet |
98 | blacklist ${HOME}/kde/share/apps/kwallet | 99 | blacklist ${HOME}/kde/share/apps/kwallet |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index 307ccaf6c..3474a6592 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -112,3 +112,4 @@ blacklist ${HOME}/.local/share/wesnoth | |||
112 | blacklist ${HOME}/.local/share/0ad | 112 | blacklist ${HOME}/.local/share/0ad |
113 | blacklist ${HOME}/.local/share/xplayer | 113 | blacklist ${HOME}/.local/share/xplayer |
114 | blacklist ${HOME}/.local/share/totem | 114 | blacklist ${HOME}/.local/share/totem |
115 | blacklist ${HOME}/.local/share/psi+ | ||
diff --git a/etc/firejail.config b/etc/firejail.config index caaeb6792..55d2faa9f 100644 --- a/etc/firejail.config +++ b/etc/firejail.config | |||
@@ -17,8 +17,8 @@ | |||
17 | 17 | ||
18 | # Enable or disable restricted network support, default disabled. If enabled, | 18 | # Enable or disable restricted network support, default disabled. If enabled, |
19 | # networking features should also be enabled (network yes). | 19 | # networking features should also be enabled (network yes). |
20 | # Restricted networking grants access to --interface and --net=ethXXX | 20 | # Restricted networking grants access to --interface, --net=ethXXX and |
21 | # only to root user. Regular users are only allowed --net=none. | 21 | # --netfilter only to root user. Regular users are only allowed --net=none. |
22 | # restricted-network no | 22 | # restricted-network no |
23 | 23 | ||
24 | # Enable or disable seccomp support, default enabled. | 24 | # Enable or disable seccomp support, default enabled. |
diff --git a/etc/konversation.profile b/etc/konversation.profile new file mode 100644 index 000000000..d10decb8f --- /dev/null +++ b/etc/konversation.profile | |||
@@ -0,0 +1,12 @@ | |||
1 | # Firejail konversation profile | ||
2 | |||
3 | include /etc/firejail/disable-common.inc | ||
4 | include /etc/firejail/disable-programs.inc | ||
5 | include /etc/firejail/disable-devel.inc | ||
6 | include /etc/firejail/disable-passwdmgr.inc | ||
7 | |||
8 | caps.drop all | ||
9 | seccomp | ||
10 | protocol unix,inet,inet6 | ||
11 | netfilter | ||
12 | noroot | ||
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile new file mode 100644 index 000000000..8194da74f --- /dev/null +++ b/etc/psi-plus.profile | |||
@@ -0,0 +1,27 @@ | |||
1 | # Firejail profile for Psi+ | ||
2 | |||
3 | noblacklist ${HOME}/.config/psi+ | ||
4 | noblacklist ${HOME}/.local/share/psi+ | ||
5 | include /etc/firejail/disable-common.inc | ||
6 | include /etc/firejail/disable-programs.inc | ||
7 | include /etc/firejail/disable-passwdmgr.inc | ||
8 | |||
9 | whitelist ${DOWNLOADS} | ||
10 | mkdir ~/.config | ||
11 | mkdir ~/.config/psi+ | ||
12 | whitelist ~/.config/psi+ | ||
13 | mkdir ~/.local | ||
14 | mkdir ~/.local/share | ||
15 | mkdir ~/.local/share/psi+ | ||
16 | whitelist ~/.local/share/psi+ | ||
17 | mkdir ~/.cache | ||
18 | mkdir ~/.cache/psi+ | ||
19 | whitelist ~/.cache/psi+ | ||
20 | |||
21 | include /etc/firejail/whitelist-common.inc | ||
22 | |||
23 | caps.drop all | ||
24 | seccomp | ||
25 | protocol unix,inet,inet6 | ||
26 | netfilter | ||
27 | noroot | ||
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc index 9d5ef3d96..b3a1a1d30 100644 --- a/etc/whitelist-common.inc +++ b/etc/whitelist-common.inc | |||
@@ -1,5 +1,6 @@ | |||
1 | # common whitelist for all profiles | 1 | # common whitelist for all profiles |
2 | 2 | ||
3 | whitelist ~/.XCompose | ||
3 | whitelist ~/.config/mimeapps.list | 4 | whitelist ~/.config/mimeapps.list |
4 | whitelist ~/.icons | 5 | whitelist ~/.icons |
5 | whitelist ~/.config/user-dirs.dirs | 6 | whitelist ~/.config/user-dirs.dirs |
diff --git a/platform/debian/conffiles b/platform/debian/conffiles index 8cf8f165c..eff859cc5 100644 --- a/platform/debian/conffiles +++ b/platform/debian/conffiles | |||
@@ -98,3 +98,6 @@ | |||
98 | /etc/firejail/xreader.profile | 98 | /etc/firejail/xreader.profile |
99 | /etc/firejail/xviewer.profile | 99 | /etc/firejail/xviewer.profile |
100 | /etc/firejail/mcabber.profile | 100 | /etc/firejail/mcabber.profile |
101 | /etc/firejail/corebird.profile | ||
102 | /etc/firejail/konversation.profile | ||
103 | /etc/firejail/psi-plus.profile | ||
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index 4fdbe1897..3ea8caf5b 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -47,7 +47,7 @@ int checkcfg(int val) { | |||
47 | 47 | ||
48 | FILE *fp = fopen(fname, "r"); | 48 | FILE *fp = fopen(fname, "r"); |
49 | if (!fp) { | 49 | if (!fp) { |
50 | fprintf(stderr, "Error: Firejail configuration file %s not found\n", fname); | 50 | fprintf(stderr, "Warning: Firejail configuration file %s not found\n", fname); |
51 | exit(1); | 51 | exit(1); |
52 | } | 52 | } |
53 | 53 | ||
diff --git a/src/firejail/main.c b/src/firejail/main.c index 2f4a78d4b..955bd36bf 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -806,7 +806,7 @@ int main(int argc, char **argv) { | |||
806 | } | 806 | } |
807 | } | 807 | } |
808 | 808 | ||
809 | // is this a login shell, or a command passed by sshd insert command line options from /etc/firejail/login.users | 809 | // is this a login shell, or a command passed by sshd, insert command line options from /etc/firejail/login.users |
810 | if (*argv[0] == '-' || parent_sshd) { | 810 | if (*argv[0] == '-' || parent_sshd) { |
811 | fullargc = restricted_shell(cfg.username); | 811 | fullargc = restricted_shell(cfg.username); |
812 | if (fullargc) { | 812 | if (fullargc) { |
@@ -825,6 +825,11 @@ int main(int argc, char **argv) { | |||
825 | check_user(argc, argv); // the function will not return if --user option was found | 825 | check_user(argc, argv); // the function will not return if --user option was found |
826 | } | 826 | } |
827 | 827 | ||
828 | |||
829 | // check for force-nonewprivs in /etc/firejail/firejail.config file | ||
830 | if (!option_force && checkcfg(CFG_FORCE_NONEWPRIVS)) | ||
831 | arg_nonewprivs = 1; | ||
832 | |||
828 | // parse arguments | 833 | // parse arguments |
829 | for (i = 1; i < argc; i++) { | 834 | for (i = 1; i < argc; i++) { |
830 | run_cmd_and_exit(i, argc, argv); // will exit if the command is recognized | 835 | run_cmd_and_exit(i, argc, argv); // will exit if the command is recognized |
@@ -1679,6 +1684,18 @@ int main(int argc, char **argv) { | |||
1679 | 1684 | ||
1680 | #ifdef HAVE_NETWORK | 1685 | #ifdef HAVE_NETWORK |
1681 | else if (strcmp(argv[i], "--netfilter") == 0) { | 1686 | else if (strcmp(argv[i], "--netfilter") == 0) { |
1687 | #ifdef HAVE_NETWORK_RESTRICTED | ||
1688 | // compile time restricted networking | ||
1689 | if (getuid() != 0) { | ||
1690 | fprintf(stderr, "Error: --netfilter is only allowed for root\n"); | ||
1691 | exit(1); | ||
1692 | } | ||
1693 | #endif | ||
1694 | // run time restricted networking | ||
1695 | if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) { | ||
1696 | fprintf(stderr, "Error: --netfilter is only allowed for root\n"); | ||
1697 | exit(1); | ||
1698 | } | ||
1682 | if (checkcfg(CFG_NETWORK)) { | 1699 | if (checkcfg(CFG_NETWORK)) { |
1683 | arg_netfilter = 1; | 1700 | arg_netfilter = 1; |
1684 | } | 1701 | } |
@@ -1689,6 +1706,18 @@ int main(int argc, char **argv) { | |||
1689 | } | 1706 | } |
1690 | 1707 | ||
1691 | else if (strncmp(argv[i], "--netfilter=", 12) == 0) { | 1708 | else if (strncmp(argv[i], "--netfilter=", 12) == 0) { |
1709 | #ifdef HAVE_NETWORK_RESTRICTED | ||
1710 | // compile time restricted networking | ||
1711 | if (getuid() != 0) { | ||
1712 | fprintf(stderr, "Error: --netfilter is only allowed for root\n"); | ||
1713 | exit(1); | ||
1714 | } | ||
1715 | #endif | ||
1716 | // run time restricted networking | ||
1717 | if (checkcfg(CFG_RESTRICTED_NETWORK) && getuid() != 0) { | ||
1718 | fprintf(stderr, "Error: --netfilter is only allowed for root\n"); | ||
1719 | exit(1); | ||
1720 | } | ||
1692 | if (checkcfg(CFG_NETWORK)) { | 1721 | if (checkcfg(CFG_NETWORK)) { |
1693 | arg_netfilter = 1; | 1722 | arg_netfilter = 1; |
1694 | arg_netfilter_file = argv[i] + 12; | 1723 | arg_netfilter_file = argv[i] + 12; |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 6133a610d..843c1efe5 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -750,7 +750,7 @@ int sandbox(void* sandbox_arg) { | |||
750 | //**************************************** | 750 | //**************************************** |
751 | // Set NO_NEW_PRIVS if desired | 751 | // Set NO_NEW_PRIVS if desired |
752 | //**************************************** | 752 | //**************************************** |
753 | if (arg_nonewprivs || checkcfg(CFG_FORCE_NONEWPRIVS)) { | 753 | if (arg_nonewprivs) { |
754 | int no_new_privs = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); | 754 | int no_new_privs = prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); |
755 | 755 | ||
756 | if(no_new_privs != 0) | 756 | if(no_new_privs != 0) |
diff --git a/src/man/firejail-config.txt b/src/man/firejail-config.txt index dcede2ec6..026765f1a 100644 --- a/src/man/firejail-config.txt +++ b/src/man/firejail-config.txt | |||
@@ -33,8 +33,8 @@ Enable or disable networking features, default enabled. | |||
33 | \fBrestricted-network | 33 | \fBrestricted-network |
34 | Enable or disable restricted network support, default disabled. If enabled, | 34 | Enable or disable restricted network support, default disabled. If enabled, |
35 | networking features should also be enabled (network yes). | 35 | networking features should also be enabled (network yes). |
36 | Restricted networking grants access to --interface and --net=ethXXX | 36 | Restricted networking grants access to --interface, --net=ethXXX and |
37 | only to root user. Regular users are only allowed --net=none. | 37 | \-\-netfilter only to root user. Regular users are only allowed --net=none. |
38 | 38 | ||
39 | .TP | 39 | .TP |
40 | \fBsecomp | 40 | \fBsecomp |