diff options
-rw-r--r-- | .github/pull_request_template.md | 9 | ||||
-rw-r--r-- | SECURITY.md | 2 | ||||
-rw-r--r-- | etc/akonadi_control.profile | 3 | ||||
-rw-r--r-- | etc/checkbashisms.profile | 2 | ||||
-rw-r--r-- | etc/disable-common.inc | 3 | ||||
-rw-r--r-- | etc/disable-programs.inc | 5 | ||||
-rw-r--r-- | etc/firefox.profile | 2 | ||||
-rw-r--r-- | etc/ghostwriter.profile | 22 | ||||
-rw-r--r-- | etc/itch.profile | 3 | ||||
-rw-r--r-- | etc/kwin_x11.profile | 3 | ||||
-rw-r--r-- | etc/pluma.profile | 3 | ||||
-rw-r--r-- | etc/slack.profile | 3 | ||||
-rw-r--r-- | etc/tb-starter-wrapper.profile | 19 | ||||
-rw-r--r-- | etc/tor-browser.profile | 10 | ||||
-rw-r--r-- | etc/torbrowser-launcher.profile | 2 | ||||
-rw-r--r-- | etc/unzip.profile | 1 | ||||
-rw-r--r-- | etc/whalebird.profile | 45 | ||||
-rw-r--r-- | etc/zulip.profile | 47 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 4 | ||||
-rw-r--r-- | src/firejail/fs_whitelist.c | 16 |
20 files changed, 175 insertions, 29 deletions
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index f0e4dd416..71791c000 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md | |||
@@ -1,17 +1,18 @@ | |||
1 | |||
2 | If your PR isn't about profiles or you have no idea how to do one of these, skip the following and go ahead with this PR. | ||
3 | |||
1 | If you make a PR for new profiles or changeing profiles please do the following: | 4 | If you make a PR for new profiles or changeing profiles please do the following: |
2 | - The ordering of options follow the rules descripted in [/usr/share/doc/firejail/profile.template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template). | 5 | - The ordering of options follow the rules descripted in [/usr/share/doc/firejail/profile.template](https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template). |
3 | Hint: The profile-template is very new, if you install firejail with your package-manager, it maybe missing, therefore, and to follow the latest rules, it is recommended to use the template from the repository. | 6 | > Hint: The profile-template is very new, if you install firejail with your package-manager, it maybe missing, therefore, and to follow the latest rules, it is recommended to use the template from the repository. |
4 | - Order the arguments of options alphabetical, you can easy do this with the [sort.py](https://github.com/netblue30/firejail/tree/master/contrib/sort.py). | 7 | - Order the arguments of options alphabetical, you can easy do this with the [sort.py](https://github.com/netblue30/firejail/tree/master/contrib/sort.py). |
5 | The path to it depends on your distro: | 8 | The path to it depends on your distro: |
6 | 9 | ||
7 | | Distro | Path | | 10 | | Distro | Path | |
8 | | ------ | ---- | | 11 | | ------ | ---- | |
9 | | Arch/Fedora | `/lib64/firejail/sort.py` | | 12 | | Arch/Fedora | `/usr/lib64/firejail/sort.py` | |
10 | | Debian/Ubuntu/Mint | `/usr/lib/x86_64-linux-gnu/firejail/sort.py` | | 13 | | Debian/Ubuntu/Mint | `/usr/lib/x86_64-linux-gnu/firejail/sort.py` | |
11 | | local git clone | `contrib/sort.py` | | 14 | | local git clone | `contrib/sort.py` | |
12 | 15 | ||
13 | Note also that the sort.py script exists only since firejail `0.9.61`. | 16 | Note also that the sort.py script exists only since firejail `0.9.61`. |
14 | 17 | ||
15 | If you have no idea how to do one of these, you can open the PR anyway. | ||
16 | |||
17 | See also [CONTRIBUTING.md](/CONTRIBUTING.md). | 18 | See also [CONTRIBUTING.md](/CONTRIBUTING.md). |
diff --git a/SECURITY.md b/SECURITY.md index 8a45fd163..558b6870a 100644 --- a/SECURITY.md +++ b/SECURITY.md | |||
@@ -4,7 +4,7 @@ | |||
4 | 4 | ||
5 | | Version | Supported by us | EOL | Supported by distribution | | 5 | | Version | Supported by us | EOL | Supported by distribution | |
6 | | ------- | ------------------ | ---- | --------------------------- | 6 | | ------- | ------------------ | ---- | --------------------------- |
7 | | 0.9.60 | :heavy_check_mark: | | :white_check_mark: Debian 11 (testing/unstable), Ubuntu 19.10 | 7 | | 0.9.60 | :heavy_check_mark: | | :white_check_mark: Debian 11 (testing/unstable), 10 **backports**; Ubuntu 19.10 |
8 | | 0.9.58 | :x: | | :white_check_mark: Ubuntu 19.04; Debian 9 **backports**, 10 | 8 | | 0.9.58 | :x: | | :white_check_mark: Ubuntu 19.04; Debian 9 **backports**, 10 |
9 | | 0.9.56 | :x: | 27 Jan 2019 | | 9 | | 0.9.56 | :x: | 27 Jan 2019 | |
10 | | 0.9.54 | :x: | | :white_check_mark: Ubuntu 18.10 | 10 | | 0.9.54 | :x: | | :white_check_mark: Ubuntu 18.10 |
diff --git a/etc/akonadi_control.profile b/etc/akonadi_control.profile index 1c16f940e..904c784c6 100644 --- a/etc/akonadi_control.profile +++ b/etc/akonadi_control.profile | |||
@@ -17,6 +17,7 @@ noblacklist ${HOME}/.local/share/apps/korganizer | |||
17 | noblacklist ${HOME}/.local/share/contacts | 17 | noblacklist ${HOME}/.local/share/contacts |
18 | noblacklist ${HOME}/.local/share/local-mail | 18 | noblacklist ${HOME}/.local/share/local-mail |
19 | noblacklist ${HOME}/.local/share/notes | 19 | noblacklist ${HOME}/.local/share/notes |
20 | noblacklist /sbin | ||
20 | noblacklist /tmp/akonadi-* | 21 | noblacklist /tmp/akonadi-* |
21 | noblacklist /usr/sbin | 22 | noblacklist /usr/sbin |
22 | 23 | ||
@@ -45,7 +46,7 @@ nosound | |||
45 | notv | 46 | notv |
46 | nou2f | 47 | nou2f |
47 | novideo | 48 | novideo |
48 | # protocol unix,inet,inet6 | 49 | # protocol unix,inet,inet6,netlink |
49 | # seccomp.drop @cpu-emulation,@debug,@obsolete,@privileged,@resources,add_key,fanotify_init,io_cancel,io_destroy,kcmp,keyctl,name_to_handle_at,ni_syscall,open_by_handle_at,personality,process_vm_readv,ptrace,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice | 50 | # seccomp.drop @cpu-emulation,@debug,@obsolete,@privileged,@resources,add_key,fanotify_init,io_cancel,io_destroy,kcmp,keyctl,name_to_handle_at,ni_syscall,open_by_handle_at,personality,process_vm_readv,ptrace,remap_file_pages,request_key,syslog,umount,userfaultfd,vmsplice |
50 | tracelog | 51 | tracelog |
51 | 52 | ||
diff --git a/etc/checkbashisms.profile b/etc/checkbashisms.profile index fe3202cea..7b2d344e5 100644 --- a/etc/checkbashisms.profile +++ b/etc/checkbashisms.profile | |||
@@ -44,7 +44,7 @@ x11 none | |||
44 | 44 | ||
45 | private-cache | 45 | private-cache |
46 | private-dev | 46 | private-dev |
47 | private-lib perl* | 47 | private-lib libfreebl3.so,perl* |
48 | private-tmp | 48 | private-tmp |
49 | 49 | ||
50 | memory-deny-write-execute | 50 | memory-deny-write-execute |
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index 7ca5a6b89..e1762719f 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -67,6 +67,7 @@ blacklist ${HOME}/.config/khotkeysrc | |||
67 | blacklist ${HOME}/.config/krunnerrc | 67 | blacklist ${HOME}/.config/krunnerrc |
68 | blacklist ${HOME}/.config/kscreenlockerrc | 68 | blacklist ${HOME}/.config/kscreenlockerrc |
69 | blacklist ${HOME}/.config/ksslcertificatemanager | 69 | blacklist ${HOME}/.config/ksslcertificatemanager |
70 | blacklist ${HOME}/.config/kwalletrc | ||
70 | blacklist ${HOME}/.config/kwinrc | 71 | blacklist ${HOME}/.config/kwinrc |
71 | blacklist ${HOME}/.config/kwinrulesrc | 72 | blacklist ${HOME}/.config/kwinrulesrc |
72 | blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc | 73 | blacklist ${HOME}/.config/plasma-org.kde.plasma.desktop-appletsrc |
@@ -79,6 +80,7 @@ blacklist ${HOME}/.kde/share/config/khotkeysrc | |||
79 | blacklist ${HOME}/.kde/share/config/krunnerrc | 80 | blacklist ${HOME}/.kde/share/config/krunnerrc |
80 | blacklist ${HOME}/.kde/share/config/kscreensaverrc | 81 | blacklist ${HOME}/.kde/share/config/kscreensaverrc |
81 | blacklist ${HOME}/.kde/share/config/ksslcertificatemanager | 82 | blacklist ${HOME}/.kde/share/config/ksslcertificatemanager |
83 | blacklist ${HOME}/.kde/share/config/kwalletrc | ||
82 | blacklist ${HOME}/.kde/share/config/kwinrc | 84 | blacklist ${HOME}/.kde/share/config/kwinrc |
83 | blacklist ${HOME}/.kde/share/config/kwinrulesrc | 85 | blacklist ${HOME}/.kde/share/config/kwinrulesrc |
84 | blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc | 86 | blacklist ${HOME}/.kde/share/config/plasma-desktop-appletsrc |
@@ -89,6 +91,7 @@ blacklist ${HOME}/.kde4/share/config/khotkeysrc | |||
89 | blacklist ${HOME}/.kde4/share/config/krunnerrc | 91 | blacklist ${HOME}/.kde4/share/config/krunnerrc |
90 | blacklist ${HOME}/.kde4/share/config/kscreensaverrc | 92 | blacklist ${HOME}/.kde4/share/config/kscreensaverrc |
91 | blacklist ${HOME}/.kde4/share/config/ksslcertificatemanager | 93 | blacklist ${HOME}/.kde4/share/config/ksslcertificatemanager |
94 | blacklist ${HOME}/.kde4/share/config/kwalletrc | ||
92 | blacklist ${HOME}/.kde4/share/config/kwinrc | 95 | blacklist ${HOME}/.kde4/share/config/kwinrc |
93 | blacklist ${HOME}/.kde4/share/config/kwinrulesrc | 96 | blacklist ${HOME}/.kde4/share/config/kwinrulesrc |
94 | blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc | 97 | blacklist ${HOME}/.kde4/share/config/plasma-desktop-appletsrc |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index c061e94a2..c0bf1f8d4 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -302,6 +302,7 @@ blacklist ${HOME}/.config/vivaldi | |||
302 | blacklist ${HOME}/.config/vivaldi-snapshot | 302 | blacklist ${HOME}/.config/vivaldi-snapshot |
303 | blacklist ${HOME}/.config/vlc | 303 | blacklist ${HOME}/.config/vlc |
304 | blacklist ${HOME}/.config/wesnoth | 304 | blacklist ${HOME}/.config/wesnoth |
305 | blacklist ${HOME}/.config/Whalebird | ||
305 | blacklist ${HOME}/.config/wireshark | 306 | blacklist ${HOME}/.config/wireshark |
306 | blacklist ${HOME}/.config/xchat | 307 | blacklist ${HOME}/.config/xchat |
307 | blacklist ${HOME}/.config/xed | 308 | blacklist ${HOME}/.config/xed |
@@ -322,6 +323,7 @@ blacklist ${HOME}/.config/yelp | |||
322 | blacklist ${HOME}/.config/youtube-dl | 323 | blacklist ${HOME}/.config/youtube-dl |
323 | blacklist ${HOME}/.config/zathura | 324 | blacklist ${HOME}/.config/zathura |
324 | blacklist ${HOME}/.config/zoomus.conf | 325 | blacklist ${HOME}/.config/zoomus.conf |
326 | blacklist ${HOME}/.config/Zulip | ||
325 | blacklist ${HOME}/.conkeror.mozdev.org | 327 | blacklist ${HOME}/.conkeror.mozdev.org |
326 | blacklist ${HOME}/.crawl | 328 | blacklist ${HOME}/.crawl |
327 | blacklist ${HOME}/.curlrc | 329 | blacklist ${HOME}/.curlrc |
@@ -367,6 +369,7 @@ blacklist ${HOME}/.hugin | |||
367 | blacklist ${HOME}/.icedove | 369 | blacklist ${HOME}/.icedove |
368 | blacklist ${HOME}/.imagej | 370 | blacklist ${HOME}/.imagej |
369 | blacklist ${HOME}/.inkscape | 371 | blacklist ${HOME}/.inkscape |
372 | blacklist ${HOME}/.itch | ||
370 | blacklist ${HOME}/.jack-server | 373 | blacklist ${HOME}/.jack-server |
371 | blacklist ${HOME}/.jack-settings | 374 | blacklist ${HOME}/.jack-settings |
372 | blacklist ${HOME}/.jak | 375 | blacklist ${HOME}/.jak |
@@ -620,11 +623,13 @@ blacklist ${HOME}/.sword | |||
620 | blacklist ${HOME}/.sylpheed-2.0 | 623 | blacklist ${HOME}/.sylpheed-2.0 |
621 | blacklist ${HOME}/.synfig | 624 | blacklist ${HOME}/.synfig |
622 | blacklist ${HOME}/.config/teams-for-linux | 625 | blacklist ${HOME}/.config/teams-for-linux |
626 | blacklist ${HOME}/.tb | ||
623 | blacklist ${HOME}/.tconn | 627 | blacklist ${HOME}/.tconn |
624 | blacklist ${HOME}/.teeworlds | 628 | blacklist ${HOME}/.teeworlds |
625 | blacklist ${HOME}/.thunderbird | 629 | blacklist ${HOME}/.thunderbird |
626 | blacklist ${HOME}/.tilp | 630 | blacklist ${HOME}/.tilp |
627 | blacklist ${HOME}/.tooling | 631 | blacklist ${HOME}/.tooling |
632 | blacklist ${HOME}/.tor-browser | ||
628 | blacklist ${HOME}/.tor-browser-* | 633 | blacklist ${HOME}/.tor-browser-* |
629 | blacklist ${HOME}/.tor-browser_* | 634 | blacklist ${HOME}/.tor-browser_* |
630 | blacklist ${HOME}/.torcs | 635 | blacklist ${HOME}/.torcs |
diff --git a/etc/firefox.profile b/etc/firefox.profile index 84c647cb9..0c143f569 100644 --- a/etc/firefox.profile +++ b/etc/firefox.profile | |||
@@ -16,6 +16,8 @@ whitelist ${HOME}/.mozilla | |||
16 | 16 | ||
17 | # firefox requires a shell to launch on Arch. | 17 | # firefox requires a shell to launch on Arch. |
18 | #private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which | 18 | #private-bin bash,dbus-launch,dbus-send,env,firefox,sh,which |
19 | # Fedora use shell scripts to launch firefox, at least this is required | ||
20 | #private-bin awk,basename,bash,cat,dirname,env,expr,false,firefox,firefox-wayland,ln,mkdir,pidof,rm,rmdir,sed,sh,tclsh,true,uname,which | ||
19 | # private-etc must first be enabled in firefox-common.profile | 21 | # private-etc must first be enabled in firefox-common.profile |
20 | #private-etc firefox | 22 | #private-etc firefox |
21 | 23 | ||
diff --git a/etc/ghostwriter.profile b/etc/ghostwriter.profile index 48c02f195..cb7e7c513 100644 --- a/etc/ghostwriter.profile +++ b/etc/ghostwriter.profile | |||
@@ -18,20 +18,10 @@ include disable-passwdmgr.inc | |||
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | #mkdir ${HOME}/.config/ghostwriter | ||
22 | #whitelist ${HOME}/.config/ghostwriter | ||
23 | #whitelist ${DESKTOP} | ||
24 | #whitelist ${DOCUMENTS} | ||
25 | #whitelist ${DOWNLOADS} | ||
26 | #whitelist ${PICTURES} | ||
27 | #include whitelist-common.inc | ||
28 | |||
29 | apparmor | 21 | apparmor |
30 | caps.drop all | 22 | caps.drop all |
31 | machine-id | 23 | machine-id |
32 | netfilter | 24 | netfilter |
33 | #no3d | ||
34 | #nodbus | ||
35 | nodvd | 25 | nodvd |
36 | nogroups | 26 | nogroups |
37 | nonewprivs | 27 | nonewprivs |
@@ -40,17 +30,15 @@ nosound | |||
40 | notv | 30 | notv |
41 | nou2f | 31 | nou2f |
42 | novideo | 32 | novideo |
43 | protocol unix,inet,netlink | 33 | protocol unix,inet,inet6,netlink |
44 | seccomp | 34 | #seccomp -- breaks |
45 | shell none | 35 | shell none |
46 | tracelog | 36 | #tracelog -- breaks |
47 | 37 | ||
48 | # Breaks Translation | 38 | # Breaks Translation |
49 | #private-bin ghostwriter,pandoc | 39 | #private-bin ghostwriter,pandoc |
50 | private-cache | 40 | private-cache |
51 | private-dev | 41 | private-dev |
52 | private-etc alternatives,crypto-policies,cups,dconf,drirc,fonts,gtk-3.0,localtime,machine-id | 42 | # passwd,login.defs,firejail are a temporary workaround for #2877 and can be removed once it is fixed |
53 | # Breaks Translation | 43 | private-etc alternatives,ca-certificates,crypto-policies,dbus-1,dconf,firejail,fonts,gconf,groups,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,machine-id,mime.types,nsswitch.conf,pango,passwd,pki,protocols,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg |
54 | #private-lib | ||
55 | private-tmp | 44 | private-tmp |
56 | |||
diff --git a/etc/itch.profile b/etc/itch.profile index c0b4fe6ce..b3c78c810 100644 --- a/etc/itch.profile +++ b/etc/itch.profile | |||
@@ -8,6 +8,7 @@ include globals.local | |||
8 | # itch.io has native firejail/sandboxing support bundled in | 8 | # itch.io has native firejail/sandboxing support bundled in |
9 | # See https://itch.io/docs/itch/using/sandbox/linux.html | 9 | # See https://itch.io/docs/itch/using/sandbox/linux.html |
10 | 10 | ||
11 | noblacklist ${HOME}/.itch | ||
11 | noblacklist ${HOME}/.config/itch | 12 | noblacklist ${HOME}/.config/itch |
12 | 13 | ||
13 | include disable-common.inc | 14 | include disable-common.inc |
@@ -16,7 +17,9 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 18 | include disable-programs.inc |
18 | 19 | ||
20 | mkdir ${HOME}/.itch | ||
19 | mkdir ${HOME}/.config/itch | 21 | mkdir ${HOME}/.config/itch |
22 | whitelist ${HOME}/.itch | ||
20 | whitelist ${HOME}/.config/itch | 23 | whitelist ${HOME}/.config/itch |
21 | include whitelist-common.inc | 24 | include whitelist-common.inc |
22 | 25 | ||
diff --git a/etc/kwin_x11.profile b/etc/kwin_x11.profile index ee07636d3..d512dd100 100644 --- a/etc/kwin_x11.profile +++ b/etc/kwin_x11.profile | |||
@@ -5,6 +5,9 @@ include kwin_x11.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # fix automatical kwin_x11 sandboxing: | ||
9 | # echo KDEWM=kwin_x11 >> ~/.pam_environment | ||
10 | |||
8 | noblacklist ${HOME}/.cache/kwin | 11 | noblacklist ${HOME}/.cache/kwin |
9 | noblacklist ${HOME}/.config/kwinrc | 12 | noblacklist ${HOME}/.config/kwinrc |
10 | noblacklist ${HOME}/.config/kwinrulesrc | 13 | noblacklist ${HOME}/.config/kwinrulesrc |
diff --git a/etc/pluma.profile b/etc/pluma.profile index 81b2b1481..1e0512fd8 100644 --- a/etc/pluma.profile +++ b/etc/pluma.profile | |||
@@ -6,6 +6,7 @@ include pluma.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.config/enchant | ||
9 | noblacklist ${HOME}/.config/pluma | 10 | noblacklist ${HOME}/.config/pluma |
10 | noblacklist ${HOME}/.python-history | 11 | noblacklist ${HOME}/.python-history |
11 | noblacklist ${HOME}/.python_history | 12 | noblacklist ${HOME}/.python_history |
@@ -42,7 +43,7 @@ tracelog | |||
42 | 43 | ||
43 | private-bin pluma | 44 | private-bin pluma |
44 | private-dev | 45 | private-dev |
45 | private-lib pluma | 46 | private-lib aspell,gconv,libgspell-1.so.*,libreadline.so.*,libtinfo.so.*,pluma |
46 | private-tmp | 47 | private-tmp |
47 | 48 | ||
48 | memory-deny-write-execute | 49 | memory-deny-write-execute |
diff --git a/etc/slack.profile b/etc/slack.profile index 5c10ef0ba..f71ae9584 100644 --- a/etc/slack.profile +++ b/etc/slack.profile | |||
@@ -20,7 +20,6 @@ include whitelist-common.inc | |||
20 | include whitelist-var-common.inc | 20 | include whitelist-var-common.inc |
21 | 21 | ||
22 | caps.drop all | 22 | caps.drop all |
23 | name slack | ||
24 | netfilter | 23 | netfilter |
25 | nodvd | 24 | nodvd |
26 | nogroups | 25 | nogroups |
@@ -35,5 +34,5 @@ shell none | |||
35 | disable-mnt | 34 | disable-mnt |
36 | private-bin locale,slack | 35 | private-bin locale,slack |
37 | private-dev | 36 | private-dev |
38 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl | 37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl |
39 | private-tmp | 38 | private-tmp |
diff --git a/etc/tb-starter-wrapper.profile b/etc/tb-starter-wrapper.profile new file mode 100644 index 000000000..8a7d45449 --- /dev/null +++ b/etc/tb-starter-wrapper.profile | |||
@@ -0,0 +1,19 @@ | |||
1 | # Firejail profile for tb-starter-wrapper | ||
2 | # Description: wrapper-script used by whonix to start the tor browser | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include tb-starter-wrapper.local | ||
7 | # Persistent global definitions | ||
8 | # added by included profile | ||
9 | #include globals.local | ||
10 | |||
11 | noblacklist ${HOME}/.tb | ||
12 | |||
13 | mkdir ${HOME}/.tb | ||
14 | whitelist ${HOME}/.tb | ||
15 | |||
16 | x11 xorg | ||
17 | |||
18 | # Redirect | ||
19 | include torbrowser-launcher.profile | ||
diff --git a/etc/tor-browser.profile b/etc/tor-browser.profile new file mode 100644 index 000000000..0cd84abf5 --- /dev/null +++ b/etc/tor-browser.profile | |||
@@ -0,0 +1,10 @@ | |||
1 | # Firejail profile alias for torbrowser-launcher | ||
2 | # This file is overwritten after every install/update | ||
3 | |||
4 | noblacklist ${HOME}/.tor-browser | ||
5 | |||
6 | mkdir ${HOME}/.tor-browser | ||
7 | whitelist ${HOME}/.tor-browser | ||
8 | |||
9 | # Redirect | ||
10 | include torbrowser-launcher.profile | ||
diff --git a/etc/torbrowser-launcher.profile b/etc/torbrowser-launcher.profile index 75bcb04b4..00b82e852 100644 --- a/etc/torbrowser-launcher.profile +++ b/etc/torbrowser-launcher.profile | |||
@@ -48,7 +48,7 @@ shell none | |||
48 | #tracelog | 48 | #tracelog |
49 | 49 | ||
50 | disable-mnt | 50 | disable-mnt |
51 | private-bin bash,cat,cp,cut,dirname,env,expr,file,getconf,gpg,grep,gxmessage,id,kdialog,ln,mkdir,pwd,python*,readlink,realpath,rm,sed,sh,tail,tar,tclsh,test,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity | 51 | private-bin bash,cat,cp,cut,dirname,env,expr,file,getconf,gpg,grep,gxmessage,id,kdialog,ln,mkdir,mv,pwd,python*,readlink,realpath,rm,sed,sh,tail,tar,tclsh,test,tor-browser,tor-browser-en,torbrowser-launcher,update-desktop-database,xmessage,xz,zenity |
52 | private-dev | 52 | private-dev |
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl | 53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,hostname,hosts,ld.so.cache,machine-id,pki,pulse,resolv.conf,ssl |
54 | private-tmp | 54 | private-tmp |
diff --git a/etc/unzip.profile b/etc/unzip.profile index 94aee724d..60e447049 100644 --- a/etc/unzip.profile +++ b/etc/unzip.profile | |||
@@ -39,6 +39,5 @@ tracelog | |||
39 | x11 none | 39 | x11 none |
40 | 40 | ||
41 | private-bin unzip | 41 | private-bin unzip |
42 | private-cache | ||
43 | private-dev | 42 | private-dev |
44 | private-etc alternatives,group,localtime,passwd | 43 | private-etc alternatives,group,localtime,passwd |
diff --git a/etc/whalebird.profile b/etc/whalebird.profile new file mode 100644 index 000000000..26932b6b3 --- /dev/null +++ b/etc/whalebird.profile | |||
@@ -0,0 +1,45 @@ | |||
1 | # Firejail profile for whalebird | ||
2 | # Description: Electron-based Mastodon/Pleroma client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include whalebird.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/Whalebird | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | mkdir ${HOME}/.config/Whalebird | ||
20 | whitelist ${HOME}/.config/Whalebird | ||
21 | whitelist ${DOWNLOADS} | ||
22 | include whitelist-common.inc | ||
23 | include whitelist-var-common.inc | ||
24 | |||
25 | apparmor | ||
26 | caps.drop all | ||
27 | netfilter | ||
28 | no3d | ||
29 | nodvd | ||
30 | nogroups | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | notv | ||
34 | nou2f | ||
35 | novideo | ||
36 | protocol unix,inet,inet6 | ||
37 | seccomp | ||
38 | shell none | ||
39 | |||
40 | disable-mnt | ||
41 | private-bin whalebird | ||
42 | private-cache | ||
43 | private-dev | ||
44 | private-etc fonts,machine-id | ||
45 | private-tmp | ||
diff --git a/etc/zulip.profile b/etc/zulip.profile new file mode 100644 index 000000000..999c2f77a --- /dev/null +++ b/etc/zulip.profile | |||
@@ -0,0 +1,47 @@ | |||
1 | # Firejail profile for zulip | ||
2 | # Description: Real-time team chat based on the email threading model | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include zulip.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore noexec /tmp | ||
10 | |||
11 | noblacklist ${HOME}/.config/Zulip | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-xdg.inc | ||
20 | |||
21 | mkdir ${HOME}/.config/Zulip | ||
22 | whitelist ${HOME}/.config/Zulip | ||
23 | whitelist ${DOWNLOADS} | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | apparmor | ||
28 | caps.drop all | ||
29 | netfilter | ||
30 | no3d | ||
31 | nodvd | ||
32 | nogroups | ||
33 | nonewprivs | ||
34 | noroot | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix,inet,inet6 | ||
39 | seccomp | ||
40 | shell none | ||
41 | |||
42 | disable-mnt | ||
43 | private-bin locale,zulip | ||
44 | private-cache | ||
45 | private-dev | ||
46 | private-etc asound.conf,fonts,machine-id | ||
47 | private-tmp | ||
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 72fac1893..a6f259466 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -550,6 +550,7 @@ sylpheed | |||
550 | synfigstudio | 550 | synfigstudio |
551 | sysprof | 551 | sysprof |
552 | sysprof-cli | 552 | sysprof-cli |
553 | tb-starter-wrapper | ||
553 | teams-for-linux | 554 | teams-for-linux |
554 | teamspeak3 | 555 | teamspeak3 |
555 | teeworlds | 556 | teeworlds |
@@ -560,6 +561,7 @@ thunderbird | |||
560 | thunderbird-beta | 561 | thunderbird-beta |
561 | thunderbird-wayland | 562 | thunderbird-wayland |
562 | tilp | 563 | tilp |
564 | tor-browser | ||
563 | tor-browser-ar | 565 | tor-browser-ar |
564 | tor-browser-ca | 566 | tor-browser-ca |
565 | tor-browser-cs | 567 | tor-browser-cs |
@@ -639,6 +641,7 @@ weechat | |||
639 | weechat-curses | 641 | weechat-curses |
640 | wesnoth | 642 | wesnoth |
641 | wget | 643 | wget |
644 | whalebird | ||
642 | whois | 645 | whois |
643 | widelands | 646 | widelands |
644 | wine | 647 | wine |
@@ -678,3 +681,4 @@ zathura | |||
678 | zeal | 681 | zeal |
679 | zoom | 682 | zoom |
680 | zpaq | 683 | zpaq |
684 | zulip | ||
diff --git a/src/firejail/fs_whitelist.c b/src/firejail/fs_whitelist.c index 666f02e4d..fa93751cc 100644 --- a/src/firejail/fs_whitelist.c +++ b/src/firejail/fs_whitelist.c | |||
@@ -735,6 +735,22 @@ void fs_whitelist(void) { | |||
735 | errExit("mounting tmpfs on /tmp"); | 735 | errExit("mounting tmpfs on /tmp"); |
736 | fs_logger("tmpfs /tmp"); | 736 | fs_logger("tmpfs /tmp"); |
737 | 737 | ||
738 | // pam-tmpdir - issue #2685 | ||
739 | char *env = getenv("TMP"); | ||
740 | if (env) { | ||
741 | char *pamtmpdir; | ||
742 | if (asprintf(&pamtmpdir, "/tmp/user/%u", getuid()) == -1) | ||
743 | errExit("asprintf"); | ||
744 | if (strcmp(env, pamtmpdir) == 0) { | ||
745 | // create empty user-owned /tmp/user/$uid directory | ||
746 | mkdir_attr("/tmp/user", 0711, 0, 0); | ||
747 | fs_logger("mkdir /tmp/user"); | ||
748 | mkdir_attr(pamtmpdir, 0700, getuid(), 0); | ||
749 | fs_logger2("mkdir", pamtmpdir); | ||
750 | } | ||
751 | free(pamtmpdir); | ||
752 | } | ||
753 | |||
738 | // autowhitelist home directory if it is masked by the tmpfs | 754 | // autowhitelist home directory if it is masked by the tmpfs |
739 | if (strncmp(cfg.homedir, "/tmp/", 5) == 0) | 755 | if (strncmp(cfg.homedir, "/tmp/", 5) == 0) |
740 | whitelist_home(WLDIR_TMP); | 756 | whitelist_home(WLDIR_TMP); |