diff options
55 files changed, 354 insertions, 481 deletions
@@ -2,11 +2,11 @@ Firejail is a SUID sandbox program that reduces the risk of security | |||
2 | breaches by restricting the running environment of untrusted applications | 2 | breaches by restricting the running environment of untrusted applications |
3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for | 3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for |
4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, | 4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, |
5 | VLC, Audoacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. | 5 | VLC, Audacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. |
6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, | 6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, |
7 | Pidgin, Quassel and XChat. | 7 | Pidgin, Quassel, and XChat. |
8 | 8 | ||
9 | Firejail also expands the restricted shell facility found in bash by adding | 9 | Firejail also expands the restricted shell facility found in bash by adding |
10 | Linux namespace support. It supports sandboxing specific users upon login. | 10 | Linux namespace support. It supports sandboxing specific users upon login. |
11 | 11 | ||
12 | Download: http://sourceforge.net/projects/firejail/files/ | 12 | Download: http://sourceforge.net/projects/firejail/files/ |
@@ -15,7 +15,9 @@ Documentation and support: https://firejail.wordpress.com/ | |||
15 | Development: https://github.com/netblue30/firejail | 15 | Development: https://github.com/netblue30/firejail |
16 | License: GPL v2 | 16 | License: GPL v2 |
17 | 17 | ||
18 | Compile and install | 18 | |
19 | |||
20 | Compile and install mainline version from GitHub: | ||
19 | 21 | ||
20 | $ git clone https://github.com/netblue30/firejail.git | 22 | $ git clone https://github.com/netblue30/firejail.git |
21 | $ cd firejail | 23 | $ cd firejail |
@@ -26,19 +28,23 @@ On Debian/Ubuntu you will need to install git and a compiler: | |||
26 | $ sudo apt-get install build-essential | 28 | $ sudo apt-get install build-essential |
27 | 29 | ||
28 | 30 | ||
29 | Firejail Authors: | ||
30 | 31 | ||
31 | netblue30 (netblue30@yahoo.com) | 32 | Maintainer: |
32 | Reiner Herrmann (https://github.com/reinerh) | 33 | - netblue30 (netblue30@yahoo.com) |
33 | - a number of build patches | 34 | |
34 | - man page fixes | 35 | Committers |
35 | - Debian and Ubuntu integration | 36 | - Fred-Barclay (https://github.com/Fred-Barclay) |
36 | - clang-analyzer fixes | 37 | - Reiner Herrmann (https://github.com/reinerh) |
37 | - Debian reproducible build | 38 | - netblue30 (netblue30@yahoo.com) |
38 | - unit testing framework | 39 | |
39 | - moved build to .xz | 40 | |
40 | - detached signatures for source archive | 41 | |
41 | - recursive mkdir | 42 | Firejail Authors (alphabetical order) |
43 | |||
44 | Akhil Hans Maulloo (https://github.com/kouul) | ||
45 | - xz profile | ||
46 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) | ||
47 | - src/lib/libnetlink.c extracted from iproute2 software package | ||
42 | Aleksey Manevich (https://github.com/manevich) | 48 | Aleksey Manevich (https://github.com/manevich) |
43 | - several profile fixes | 49 | - several profile fixes |
44 | - fix problem with relative path in storage_find function | 50 | - fix problem with relative path in storage_find function |
@@ -57,6 +63,80 @@ Aleksey Manevich (https://github.com/manevich) | |||
57 | - x11 xpra, xphyr, none profile commands | 63 | - x11 xpra, xphyr, none profile commands |
58 | - added --join-or-start command | 64 | - added --join-or-start command |
59 | - CVE-2016-7545 | 65 | - CVE-2016-7545 |
66 | Alexander Stein (https://github.com/ajstein) | ||
67 | - added profile for qutebrowser | ||
68 | Andrey Alekseenko (https://github.com/al42and) | ||
69 | - fixing lintian warnings | ||
70 | - fixed Skype profile | ||
71 | andrew160 (https://github.com/andrew160) | ||
72 | - profile and man pages fixes | ||
73 | Austin S. Hemmelgarn (https://github.com/Ferroin) | ||
74 | - unbound profile update | ||
75 | avoidr (https://github.com/avoidr) | ||
76 | - whitelist fix | ||
77 | - recently-used.xbel fix | ||
78 | - added parole profile | ||
79 | - blacklist ncat | ||
80 | - hostname support in profile file | ||
81 | - Google Chrome profile rework | ||
82 | - added cmus profile | ||
83 | - man page fixes | ||
84 | - add net iface support in profile files | ||
85 | - paths fix | ||
86 | - lots of profile fixes | ||
87 | - added mcabber profile | ||
88 | - fixed mpv profile | ||
89 | - various other fixes | ||
90 | Bader Zaidan (https://github.com/BaderSZ) | ||
91 | - Telegram profile | ||
92 | Benjamin Kampmann (https://github.com/ligthyear) | ||
93 | - Forward exit code from child process | ||
94 | BogDan Vatra (https://github.com/bog-dan-ro) | ||
95 | - zoom profile | ||
96 | Bruno Nova (https://github.com/brunonova) | ||
97 | - whitelist fix | ||
98 | - bash arguments fix | ||
99 | Cat (https://github.com/ecat3) | ||
100 | - prevent tmux connecting to an existing session | ||
101 | creideiki (https://github.com/creideiki) | ||
102 | - make the sandbox process reap all children | ||
103 | Christian Stadelmann (https://github.com/genodeftest) | ||
104 | - profile fixes | ||
105 | - evolution profile fix | ||
106 | curiosity-seeker (https://github.com/curiosity-seeker) | ||
107 | - tightening unbound and dnscrypt-proxy profiles | ||
108 | - correct and tighten QuiteRss profile | ||
109 | - dnsmasq profile | ||
110 | - okular and gwenview profiles | ||
111 | - cherrytree profile fixes | ||
112 | - added quiterss profile | ||
113 | - added guayadeque profile | ||
114 | - added VirtualBox.profile | ||
115 | - various other profile fixes | ||
116 | Daan Bakker (https://github.com/dbakker) | ||
117 | - protect shell startup files | ||
118 | Dara Adib (https://github.com/daradib) | ||
119 | - ssh profile fix | ||
120 | - evince profile fix | ||
121 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) | ||
122 | - added xpdf profile | ||
123 | dewbasaur (https://github.com/dewbasaur) | ||
124 | - block access to history files | ||
125 | - Firefox PDF.js exploit (CVE-2015-4495) fixes | ||
126 | - Steam profile | ||
127 | dshmgh (https://github.com/dshmgh) | ||
128 | - overlayfs fix for systems with /home mounted on a separate partition | ||
129 | Duncan Overbruck (https://github.com/Duncaen) | ||
130 | - musl libc fix | ||
131 | - utmp fix | ||
132 | emacsomancer (https://github.com/emacsomancer) | ||
133 | - added profile for Conkeror browser | ||
134 | eventyrer (https://github.com/eventyrer) | ||
135 | - update gnome-mplayer.profile | ||
136 | Felipe Barriga Richards (https://github.com/fbarriga) | ||
137 | - --private-etc fix | ||
138 | Franco (nextime) Lanza (https://github.com/nextime) | ||
139 | - added --private-template/--private-home | ||
60 | Fred-Barclay (https://github.com/Fred-Barclay) | 140 | Fred-Barclay (https://github.com/Fred-Barclay) |
61 | - lots of profile fixes | 141 | - lots of profile fixes |
62 | - added Vivaldi, Atril profiles | 142 | - added Vivaldi, Atril profiles |
@@ -99,169 +179,57 @@ Fred-Barclay (https://github.com/Fred-Barclay) | |||
99 | - compile/install scripts for --git-install/--git-uninstall commands | 179 | - compile/install scripts for --git-install/--git-uninstall commands |
100 | - tighten keepassx | 180 | - tighten keepassx |
101 | - added Thunar profile | 181 | - added Thunar profile |
102 | SYN-cook (https://github.com/SYN-cook) | 182 | G4JC (http://sourceforge.net/u/gaming4jc/profile/) |
103 | - keepass/keepassx browser fixes | 183 | - ARM support |
104 | - disable-common.inc fixes | ||
105 | - blacklist GNOME keyring and Konqueror | ||
106 | - fixed Keepass(x) profiles | ||
107 | - Engrampa profile | ||
108 | - Scribus profile | ||
109 | valoq (https://github.com/valoq) | ||
110 | - lots of profile fixes | ||
111 | - added support for /srv in --whitelist feature | ||
112 | - Eye of GNOME, Evolution, display (imagemagik) and Wire profiles | ||
113 | - blacklist suid binaries in disable-common.inc | ||
114 | - fix man pages | ||
115 | - added keypass2, qemu profiles | ||
116 | - added amarok, ark, atool, bleachbit, brasero, dolphin, dragon, elinks, enchant, exiftool profiles | ||
117 | - added file-roller, gedit, gjs,gnome-books, gnome-documents, gnome-maps, gnome-music profiles | ||
118 | - added gnome-photos, gnome-weather, goobox, gpa, gpg, gpg-agent, highlight profiles | ||
119 | - added img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, simple-scan profiles | ||
120 | - added skanlite, ssh-agent, transmission-cli, tracker, transmission-show, w3m, xfburn, xpra profiles | ||
121 | - added wget profile | ||
122 | - disable gnupg and systemd directories under /run/user | ||
123 | - added iridium browser profile | ||
124 | Zack Weinberg (https://github.com/zackw) | ||
125 | - removed libconnect | ||
126 | - fixed memory corruption in noblacklist processing | ||
127 | - rework DISPLAY environment parsing | ||
128 | - rework masking X11 sockets in /tmp/.X11-unix directory | ||
129 | - rework xpra and xephyr detection | ||
130 | - rework abstract X11 socket detection | ||
131 | - rework X11 display number assignment | ||
132 | - rework X11 xorg processing | ||
133 | - rework fcopy, --follow-link support in fcopy | ||
134 | - follow link support in --private-bin | ||
135 | - wait_for_other function rewrite | ||
136 | - xvfb X11 server support | ||
137 | Austin S. Hemmelgarn (https://github.com/Ferroin) | ||
138 | - unbound profile update | ||
139 | Igor Bukanov (https://github.com/ibukanov) | ||
140 | - found/fiixed privilege escalation in --hosts-file option | ||
141 | Cat (https://github.com/ecat3) | ||
142 | - prevent tmux connecting to an existing session | ||
143 | Zack Weinberg (https://github.com/zackw) | ||
144 | - sdded support for joining a persistent, named network namespace | ||
145 | GSI (https://github.com/GSI) | ||
146 | - added Uzbl browser profile | ||
147 | Mike Frysinger (vapier@gentoo.org) | ||
148 | - Gentoo compile patch | ||
149 | Jericho (https://github.com/attritionorg) | ||
150 | - spelling | ||
151 | Pixel Fairy (https://github.com/xahare) | ||
152 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section | ||
153 | pshpsh (https://github.com/pshpsh) | ||
154 | - added FossaMail profile | ||
155 | eventyrer (https://github.com/eventyrer) | ||
156 | - update gnome-mplayer.profile | ||
157 | thewisenerd (https://github.com/thewisenerd) | ||
158 | - allow multiple private-home commands | ||
159 | - use $SHELL variable if the shell is not specified | ||
160 | thewisenerd (https://github.com/thewisenerd) | ||
161 | - appimage: pass commandline arguments | ||
162 | KOLANICH (https://github.com/KOLANICH) | ||
163 | - added symlink fixer fix_private-bin.py in contrib section | ||
164 | Jesse Smith (https://github.com/slicer69) | ||
165 | - added QupZilla profile | ||
166 | Lari Rauno (https://github.com/tuutti) | ||
167 | - qutebrowser profile fixes | ||
168 | SpotComms (https://github.com/SpotComms) | ||
169 | - added Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5 profiles | ||
170 | - added PDFSam, Pithos, and Xonotic profiles | ||
171 | Vasya Novikov (https://github.com/vn971) | ||
172 | - Wesnoth profile | ||
173 | - Hedegewars profile | ||
174 | - manpage fixes | ||
175 | - fixed firecfg clean/clear issue | ||
176 | - found the ugliest bug so far | ||
177 | - seccomp debug description in man page | ||
178 | curiosity-seeker (https://github.com/curiosity-seeker) | ||
179 | - tightening unbound and dnscrypt-proxy profiles | ||
180 | - correct and tighten QuiteRss profile | ||
181 | - dnsmasq profile | ||
182 | - okular and gwenview profiles | ||
183 | - cherrytree profile fixes | ||
184 | - added quiterss profile | ||
185 | - added guayadeque profile | ||
186 | - added VirtualBox.profile | ||
187 | - various other profile fixes | ||
188 | Simon Peter (https://github.com/probonopd) | ||
189 | - set $APPIMAGE and $APPDIR environment variables | ||
190 | - AppImage version detection | ||
191 | - Leafppad type v1 and v2 appimage packages in test/appimage | ||
192 | BogDan Vatra (https://github.com/bog-dan-ro) | ||
193 | - zoom profile | ||
194 | Impyy (https://github.com/Impyy) | ||
195 | - added mumble profile | ||
196 | Vadim A. Misbakh-Soloviov (https://github.com/msva) | ||
197 | - profile fixes | 184 | - profile fixes |
198 | Rafael Cavalcanti (https://github.com/rccavalcanti) | 185 | Gaman Gabriel (https://github.com/stelariusinfinitek) |
199 | - chromium profile fixes for Arch Linux | 186 | - inox profile |
200 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) | 187 | geg2048 (https://github.com/geg2048) |
201 | - added xpdf profile | 188 | - kwallet profile fixes |
202 | Dara Adib (https://github.com/daradib) | ||
203 | - ssh profile fix | ||
204 | - evince profile fix | ||
205 | vismir2 (https://github.com/vismir2) | ||
206 | - feh, ranger, 7z, keepass, keepassx and zathura profiles | ||
207 | - claws-mail, mutt, git, emacs, vim profiles | ||
208 | - lots of profile fixes | ||
209 | - support for truecrypt and zuluCrypt | ||
210 | graywolf (https://github.com/graywolf) | 189 | graywolf (https://github.com/graywolf) |
211 | - spelling fix | 190 | - spelling fix |
212 | Tomasz Jan Góralczyk (https://github.com/tjg) | ||
213 | - fixed Steam profile | ||
214 | pwnage-pineapple (https://github.com/pwnage-pineapple) | ||
215 | - update Okular profile | ||
216 | Sergey Alirzaev (https://github.com/l29ah) | ||
217 | - firejail.h enum fix | ||
218 | greigdp (https://github.com/greigdp) | 191 | greigdp (https://github.com/greigdp) |
219 | - Gajim IM client profile | 192 | - Gajim IM client profile |
220 | - fix Slack profile | 193 | - fixed spotify profile |
194 | - added Slack profile | ||
195 | - add Spotify profile | ||
196 | GSI (https://github.com/GSI) | ||
197 | - added Uzbl browser profile | ||
198 | hamzadis (https://github.com/hamzadis) | ||
199 | - added --overlay-named=name and --overlay-path=path | ||
200 | Holger Heinz (https://github.com/hheinz) | ||
201 | - manpage work | ||
221 | Icaro Perseo (https://github.com/icaroperseo) | 202 | Icaro Perseo (https://github.com/icaroperseo) |
222 | - Icecat profile | 203 | - Icecat profile |
223 | - several profile fixes | 204 | - several profile fixes |
224 | hamzadis (https://github.com/hamzadis) | 205 | Igor Bukanov (https://github.com/ibukanov) |
225 | - added --overlay-named=name and --overlay-path=path | 206 | - found/fiixed privilege escalation in --hosts-file option |
226 | Gaman Gabriel (https://github.com/stelariusinfinitek) | 207 | iiotx (https://github.com/iiotx) |
227 | - inox profile | 208 | - use generic.profile by default |
228 | greigdp (https://github.com/greigdp) | 209 | Impyy (https://github.com/Impyy) |
229 | - fixed spotify profile | 210 | - added mumble profile |
230 | - added Slack profile | 211 | Ivan Kozik (https://github.com/ivan) |
231 | Laurent Declercq (https://github.com/nuxwin) | 212 | - speed up sandbox exit |
232 | - fixed test for shell interpreter in chroots | ||
233 | Franco (nextime) Lanza (https://github.com/nextime) | ||
234 | - added --private-template/--private-home | ||
235 | xee5ch (https://github.com/xee5ch) | ||
236 | - skypeforlinux profile | ||
237 | Peter Hogg (https://github.com/pigmonkey) | ||
238 | - WeeChat profile | ||
239 | - rtorrent profile | ||
240 | - bitlbee profile fixes | ||
241 | - mutt profile fixes | ||
242 | Thomas Jarosch (https://github.com/thomasjfox) | ||
243 | - disable keepassx in disable-passwdmgr.inc | ||
244 | - added uudeview profile | ||
245 | - added tar (gtar), unzip and unrar profile | ||
246 | - added file profile | ||
247 | - improved profile list | ||
248 | - fixed small variable glitch in stat64() / lstat64() (libtracelog) | ||
249 | - added lstat() / lstat64() support to libtrace | ||
250 | - include mkuid.sh in make dist | ||
251 | Niklas Haas (https://github.com/haasn) | ||
252 | - blacklisting for keybase.io's client | ||
253 | Jaykishan Mutkawoa (https://github.com/jmutkawoa) | 213 | Jaykishan Mutkawoa (https://github.com/jmutkawoa) |
254 | - cpio profile | 214 | - cpio profile |
255 | Paupiah Yash (https://github.com/CaffeinatedStud) | 215 | Jericho (https://github.com/attritionorg) |
256 | - gzip profile | 216 | - spelling |
257 | Akhil Hans Maulloo (https://github.com/kouul) | 217 | Jesse Smith (https://github.com/slicer69) |
258 | - xz profile | 218 | - added QupZilla profile |
259 | Rahul Golam (https://github.com/technoLord) | 219 | jgriffiths (https://github.com/jgriffiths) |
260 | - strings profile | 220 | - make rpm packages support |
261 | geg2048 (https://github.com/geg2048) | 221 | Joan Figueras (https://github.com/figue) |
262 | - kwallet profile fixes | 222 | - added abrowser profile |
263 | maces (https://github.com/maces) | 223 | - added Google-Play-Music-Desktop-Player |
264 | - Franz messenger profile | 224 | - added cyberfox profile |
225 | jrabe (https://github.com/jrabe) | ||
226 | - disallow access to kdbx files | ||
227 | - Epiphany profile | ||
228 | - Polari profile | ||
229 | - qTox profile | ||
230 | - X11 fixes | ||
231 | Kaan Genç (https://github.com/SeriousBug) | ||
232 | - dynamic allocation of noblacklist buffer | ||
265 | KellerFuchs (https://github.com/KellerFuchs) | 233 | KellerFuchs (https://github.com/KellerFuchs) |
266 | - nonewpriv support, extended profiles for this feature | 234 | - nonewpriv support, extended profiles for this feature |
267 | - make `restricted-network` prevent use of netfilter | 235 | - make `restricted-network` prevent use of netfilter |
@@ -270,116 +238,45 @@ KellerFuchs (https://github.com/KellerFuchs) | |||
270 | - added support for .local profile files in /etc/firejail | 238 | - added support for .local profile files in /etc/firejail |
271 | - fixed Cryptocat profile | 239 | - fixed Cryptocat profile |
272 | - make ~/.local read-only | 240 | - make ~/.local read-only |
273 | ValdikSS (https://github.com/ValdikSS) | 241 | KOLANICH (https://github.com/KOLANICH) |
274 | - Psi+, Corebird, Konversation profiles | 242 | - added symlink fixer fix_private-bin.py in contrib section |
275 | - various profile fixes | 243 | Lari Rauno (https://github.com/tuutti) |
276 | avoidr (https://github.com/avoidr) | 244 | - qutebrowser profile fixes |
277 | - whitelist fix | 245 | Laurent Declercq (https://github.com/nuxwin) |
278 | - recently-used.xbel fix | 246 | - fixed test for shell interpreter in chroots |
279 | - added parole profile | 247 | Loïc Damien (https://github.com/dzamlo) |
280 | - blacklist ncat | 248 | - small fixes |
281 | - hostname support in profile file | 249 | maces (https://github.com/maces) |
282 | - Google Chrome profile rework | 250 | - Franz messenger profile |
283 | - added cmus profile | ||
284 | - man page fixes | ||
285 | - add net iface support in profile files | ||
286 | - paths fix | ||
287 | - lots of profile fixes | ||
288 | - added mcabber profile | ||
289 | - fixed mpv profile | ||
290 | - various other fixes | ||
291 | Ruan (https://github.com/ruany) | ||
292 | - fixed hexchat profile | ||
293 | Matthew Gyurgyik (https://github.com/pyther) | ||
294 | - rpm spec and several fixes | ||
295 | Joan Figueras (https://github.com/figue) | ||
296 | - added abrowser profile | ||
297 | - added Google-Play-Music-Desktop-Player | ||
298 | - added cyberfox profile | ||
299 | Petter Reinholdtsen (pere@hungry.com) | ||
300 | - Opera profile patch | ||
301 | n1trux (https://github.com/n1trux) | ||
302 | - fix flashpeak-slimjet profile typos | ||
303 | Felipe Barriga Richards (https://github.com/fbarriga) | ||
304 | - --private-etc fix | ||
305 | Alexander Stein (https://github.com/ajstein) | ||
306 | - added profile for qutebrowser | ||
307 | Benjamin Kampmann (https://github.com/ligthyear) | ||
308 | - Forward exit code from child process | ||
309 | dshmgh (https://github.com/dshmgh) | ||
310 | - overlayfs fix for systems with /home mounted on a separate partition | ||
311 | yumkam (https://github.com/yumkam) | ||
312 | - add compile-time option to restrict --net= to root only | ||
313 | - man page fixes | ||
314 | mahdi1234 (https://github.com/mahdi1234) | 251 | mahdi1234 (https://github.com/mahdi1234) |
315 | - cherrytree profile | 252 | - cherrytree profile |
316 | - Seamonkey profiles | 253 | - Seamonkey profiles |
317 | jrabe (https://github.com/jrabe) | ||
318 | - disallow access to kdbx files | ||
319 | - Epiphany profile | ||
320 | - Polari profile | ||
321 | - qTox profile | ||
322 | - X11 fixes | ||
323 | jgriffiths (https://github.com/jgriffiths) | ||
324 | - make rpm packages support | ||
325 | Tom Mellor (https://github.com/kalegrill) | ||
326 | - mupen64plus profile | ||
327 | Martin Carpenter (https://github.com/mcarpenter) | 254 | Martin Carpenter (https://github.com/mcarpenter) |
328 | - security audit and bug fixes | 255 | - security audit and bug fixes |
329 | - Centos 6.x support | 256 | - Centos 6.x support |
330 | pszxzsd (https://github.com/pszxzsd) | ||
331 | -uGet profile | ||
332 | Rahiel Kasim (https://github.com/rahiel) | ||
333 | - Mathematica profile | ||
334 | - whitelisted Dropbox profile | ||
335 | - whitelisted keysnail config for firefox | ||
336 | creideiki (https://github.com/creideiki) | ||
337 | - make the sandbox process reap all children | ||
338 | sinkuu (https://github.com/sinkuu) | ||
339 | - blacklisting kwalletd | ||
340 | - fix symlink invocation for programs placing symlinks in $PATH | ||
341 | Bader Zaidan (https://github.com/BaderSZ) | ||
342 | - Telegram profile | ||
343 | Holger Heinz (https://github.com/hheinz) | ||
344 | - manpage work | ||
345 | Andrey Alekseenko (https://github.com/al42and) | ||
346 | - fixing lintian warnings | ||
347 | - fixed Skype profile | ||
348 | Ivan Kozik (https://github.com/ivan) | ||
349 | - speed up sandbox exit | ||
350 | Christian Stadelmann (https://github.com/genodeftest) | ||
351 | - profile fixes | ||
352 | - evolution profile fix | ||
353 | pirate486743186 (https://github.com/pirate486743186) | ||
354 | - KMail profile | ||
355 | Kaan Genç (https://github.com/SeriousBug) | ||
356 | - dynamic allocation of noblacklist buffer | ||
357 | Veeti Paananen (https://github.com/veeti) | ||
358 | - fixed Spotify profile | ||
359 | rogshdo (https://github.com/rogshdo) | ||
360 | - BitlBee profile | ||
361 | Bruno Nova (https://github.com/brunonova) | ||
362 | - whitelist fix | ||
363 | - bash arguments fix | ||
364 | Matt Parnell (https://github.com/ilikenwf) | 257 | Matt Parnell (https://github.com/ilikenwf) |
365 | - whitelisting for core firefox related functionality | 258 | - whitelisting for core firefox related functionality |
366 | Ondra Nekola (https://github.com/satai) | ||
367 | - allow firefox theming with non-global themes | ||
368 | emacsomancer (https://github.com/emacsomancer) | ||
369 | - added profile for Conkeror browser | ||
370 | Daan Bakker (https://github.com/dbakker) | ||
371 | - protect shell startup files | ||
372 | Duncan Overbruck (https://github.com/Duncaen) | ||
373 | - musl libc fix | ||
374 | - utmp fix | ||
375 | andrew160 (https://github.com/andrew160) | ||
376 | - profile and man pages fixes | ||
377 | Loïc Damien (https://github.com/dzamlo) | ||
378 | - small fixes | ||
379 | greigdp (https://github.com/greigdp) | ||
380 | - add Spotify profile | ||
381 | Mattias Wadman (https://github.com/wader) | 259 | Mattias Wadman (https://github.com/wader) |
382 | - seccomp errno filter support | 260 | - seccomp errno filter support |
261 | Matthew Gyurgyik (https://github.com/pyther) | ||
262 | - rpm spec and several fixes | ||
263 | Michael Haas (https://github.com/mhaas) | ||
264 | - bugfixes | ||
265 | Mike Frysinger (vapier@gentoo.org) | ||
266 | - Gentoo compile patch | ||
267 | mjudtmann (https://github.com/mjudtmann) | ||
268 | - lock firejail configuration in disable-mgmt.inc | ||
269 | n1trux (https://github.com/n1trux) | ||
270 | - fix flashpeak-slimjet profile typos | ||
271 | netblue30 (netblue30@yahoo.com) | ||
272 | Niklas Haas (https://github.com/haasn) | ||
273 | - blacklisting for keybase.io's client | ||
274 | Ondra Nekola (https://github.com/satai) | ||
275 | - allow firefox theming with non-global themes | ||
276 | Patrick Toomey (http://sourceforge.net/u/ptoomey/profile/) | ||
277 | - user namespace implementation | ||
278 | Paupiah Yash (https://github.com/CaffeinatedStud) | ||
279 | - gzip profile | ||
383 | Peter Millerchip (https://github.com/pmillerchip) | 280 | Peter Millerchip (https://github.com/pmillerchip) |
384 | - memory allocation fix | 281 | - memory allocation fix |
385 | - --private.keep to --private-home transition | 282 | - --private.keep to --private-home transition |
@@ -387,30 +284,142 @@ Peter Millerchip (https://github.com/pmillerchip) | |||
387 | - support for files and directories with spaces in blacklist option | 284 | - support for files and directories with spaces in blacklist option |
388 | - lots of other fixes | 285 | - lots of other fixes |
389 | - implement the --allow-private-blacklist option | 286 | - implement the --allow-private-blacklist option |
287 | Peter Hogg (https://github.com/pigmonkey) | ||
288 | - WeeChat profile | ||
289 | - rtorrent profile | ||
290 | - bitlbee profile fixes | ||
291 | - mutt profile fixes | ||
292 | Petter Reinholdtsen (pere@hungry.com) | ||
293 | - Opera profile patch | ||
294 | pirate486743186 (https://github.com/pirate486743186) | ||
295 | - KMail profile | ||
296 | Pixel Fairy (https://github.com/xahare) | ||
297 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section | ||
298 | pshpsh (https://github.com/pshpsh) | ||
299 | - added FossaMail profile | ||
300 | pstn (https://github.com/pstn) | ||
301 | - added install-strip, make install without strip | ||
302 | pszxzsd (https://github.com/pszxzsd) | ||
303 | -uGet profile | ||
304 | pwnage-pineapple (https://github.com/pwnage-pineapple) | ||
305 | - update Okular profile | ||
306 | Rafael Cavalcanti (https://github.com/rccavalcanti) | ||
307 | - chromium profile fixes for Arch Linux | ||
308 | Rahiel Kasim (https://github.com/rahiel) | ||
309 | - Mathematica profile | ||
310 | - whitelisted Dropbox profile | ||
311 | - whitelisted keysnail config for firefox | ||
312 | Rahul Golam (https://github.com/technoLord) | ||
313 | - strings profile | ||
314 | Reiner Herrmann (https://github.com/reinerh) | ||
315 | - a number of build patches | ||
316 | - man page fixes | ||
317 | - Debian and Ubuntu integration | ||
318 | - clang-analyzer fixes | ||
319 | - Debian reproducible build | ||
320 | - unit testing framework | ||
321 | - moved build to .xz | ||
322 | - detached signatures for source archive | ||
323 | - recursive mkdir | ||
324 | rogshdo (https://github.com/rogshdo) | ||
325 | - BitlBee profile | ||
326 | Ruan (https://github.com/ruany) | ||
327 | - fixed hexchat profile | ||
390 | sarneaud (https://github.com/sarneaud) | 328 | sarneaud (https://github.com/sarneaud) |
391 | - rewrite globbing code to fix various minor issues | 329 | - rewrite globbing code to fix various minor issues |
392 | - added noblacklist command for profile files | 330 | - added noblacklist command for profile files |
393 | - various enhancements and bug fixes | 331 | - various enhancements and bug fixes |
394 | Patrick Toomey (http://sourceforge.net/u/ptoomey/profile/) | 332 | Sergey Alirzaev (https://github.com/l29ah) |
395 | - user namespace implementation | 333 | - firejail.h enum fix |
334 | Simon Peter (https://github.com/probonopd) | ||
335 | - set $APPIMAGE and $APPDIR environment variables | ||
336 | - AppImage version detection | ||
337 | - Leafppad type v1 and v2 appimage packages in test/appimage | ||
338 | sinkuu (https://github.com/sinkuu) | ||
339 | - blacklisting kwalletd | ||
340 | - fix symlink invocation for programs placing symlinks in $PATH | ||
396 | sshirokov (http://sourceforge.net/u/yshirokov/profile/) | 341 | sshirokov (http://sourceforge.net/u/yshirokov/profile/) |
397 | - Patch to output "Reading profile" to stderr instead of stdout | 342 | - Patch to output "Reading profile" to stderr instead of stdout |
398 | G4JC (http://sourceforge.net/u/gaming4jc/profile/) | 343 | SpotComms (https://github.com/SpotComms) |
399 | - ARM support | 344 | - added Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5 profiles |
345 | - added PDFSam, Pithos, and Xonotic profiles | ||
346 | SYN-cook (https://github.com/SYN-cook) | ||
347 | - keepass/keepassx browser fixes | ||
348 | - disable-common.inc fixes | ||
349 | - blacklist GNOME keyring and Konqueror | ||
350 | - fixed Keepass(x) profiles | ||
351 | - Engrampa profile | ||
352 | - Scribus profile | ||
353 | - autostart blacklist for KDE | ||
354 | thewisenerd (https://github.com/thewisenerd) | ||
355 | - allow multiple private-home commands | ||
356 | - use $SHELL variable if the shell is not specified | ||
357 | - appimage: pass commandline arguments | ||
358 | Thomas Jarosch (https://github.com/thomasjfox) | ||
359 | - disable keepassx in disable-passwdmgr.inc | ||
360 | - added uudeview profile | ||
361 | - added tar (gtar), unzip and unrar profile | ||
362 | - added file profile | ||
363 | - improved profile list | ||
364 | - fixed small variable glitch in stat64() / lstat64() (libtracelog) | ||
365 | - added lstat() / lstat64() support to libtrace | ||
366 | - include mkuid.sh in make dist | ||
367 | Tom Mellor (https://github.com/kalegrill) | ||
368 | - mupen64plus profile | ||
369 | Tomasz Jan Góralczyk (https://github.com/tjg) | ||
370 | - fixed Steam profile | ||
371 | valoq (https://github.com/valoq) | ||
372 | - lots of profile fixes | ||
373 | - added support for /srv in --whitelist feature | ||
374 | - Eye of GNOME, Evolution, display (imagemagik) and Wire profiles | ||
375 | - blacklist suid binaries in disable-common.inc | ||
376 | - fix man pages | ||
377 | - added keypass2, qemu profiles | ||
378 | - added amarok, ark, atool, bleachbit, brasero, dolphin, dragon, elinks, enchant, exiftool profiles | ||
379 | - added file-roller, gedit, gjs,gnome-books, gnome-documents, gnome-maps, gnome-music profiles | ||
380 | - added gnome-photos, gnome-weather, goobox, gpa, gpg, gpg-agent, highlight profiles | ||
381 | - added img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, simple-scan profiles | ||
382 | - added skanlite, ssh-agent, transmission-cli, tracker, transmission-show, w3m, xfburn, xpra profiles | ||
383 | - added wget profile | ||
384 | - disable gnupg and systemd directories under /run/user | ||
385 | - added iridium browser profile | ||
386 | Vadim A. Misbakh-Soloviov (https://github.com/msva) | ||
400 | - profile fixes | 387 | - profile fixes |
401 | dewbasaur (https://github.com/dewbasaur) | 388 | ValdikSS (https://github.com/ValdikSS) |
402 | - block access to history files | 389 | - Psi+, Corebird, Konversation profiles |
403 | - Firefox PDF.js exploit (CVE-2015-4495) fixes | 390 | - various profile fixes |
404 | - Steam profile | 391 | Vasya Novikov (https://github.com/vn971) |
405 | Michael Haas (https://github.com/mhaas) | 392 | - Wesnoth profile |
406 | - bugfixes | 393 | - Hedegewars profile |
407 | mjudtmann (https://github.com/mjudtmann) | 394 | - manpage fixes |
408 | - lock firejail configuration in disable-mgmt.inc | 395 | - fixed firecfg clean/clear issue |
409 | iiotx (https://github.com/iiotx) | 396 | - found the ugliest bug so far |
410 | - use generic.profile by default | 397 | - seccomp debug description in man page |
411 | pstn (https://github.com/pstn) | 398 | Veeti Paananen (https://github.com/veeti) |
412 | - added install-strip, make install without strip | 399 | - fixed Spotify profile |
413 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) | 400 | vismir2 (https://github.com/vismir2) |
414 | - src/lib/libnetlink.c extracted from iproute2 software package | 401 | - feh, ranger, 7z, keepass, keepassx and zathura profiles |
415 | 402 | - claws-mail, mutt, git, emacs, vim profiles | |
403 | - lots of profile fixes | ||
404 | - support for truecrypt and zuluCrypt | ||
405 | xee5ch (https://github.com/xee5ch) | ||
406 | - skypeforlinux profile | ||
407 | yumkam (https://github.com/yumkam) | ||
408 | - add compile-time option to restrict --net= to root only | ||
409 | - man page fixes | ||
410 | Zack Weinberg (https://github.com/zackw) | ||
411 | - added support for joining a persistent, named network namespace | ||
412 | - removed libconnect | ||
413 | - fixed memory corruption in noblacklist processing | ||
414 | - rework DISPLAY environment parsing | ||
415 | - rework masking X11 sockets in /tmp/.X11-unix directory | ||
416 | - rework xpra and xephyr detection | ||
417 | - rework abstract X11 socket detection | ||
418 | - rework X11 display number assignment | ||
419 | - rework X11 xorg processing | ||
420 | - rework fcopy, --follow-link support in fcopy | ||
421 | - follow link support in --private-bin | ||
422 | - wait_for_other function rewrite | ||
423 | - xvfb X11 server support | ||
424 | |||
416 | Copyright (C) 2014-2017 Firejail Authors | 425 | Copyright (C) 2014-2017 Firejail Authors |
@@ -58,7 +58,7 @@ If you keep your Firejail profiles in a public repository, please give us a link | |||
58 | 58 | ||
59 | * https://github.com/triceratops1/fe | 59 | * https://github.com/triceratops1/fe |
60 | 60 | ||
61 | Use this issue to request new profiles: https://github.com/netblue30/firejail/issues/825 | 61 | Use this issue to request new profiles: https://github.com/netblue30/firejail/issues/1139 |
62 | ````` | 62 | ````` |
63 | 63 | ||
64 | ````` | 64 | ````` |
diff --git a/etc/0ad.profile b/etc/0ad.profile index 84addc229..d4f06f732 100644 --- a/etc/0ad.profile +++ b/etc/0ad.profile | |||
@@ -3,7 +3,6 @@ | |||
3 | include /etc/firejail/0ad.local | 3 | include /etc/firejail/0ad.local |
4 | 4 | ||
5 | # Firejail profile for 0ad. | 5 | # Firejail profile for 0ad. |
6 | noblacklist ~/.cache/0ad | ||
7 | noblacklist ~/.config/0ad | 6 | noblacklist ~/.config/0ad |
8 | noblacklist ~/.local/share/0ad | 7 | noblacklist ~/.local/share/0ad |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
@@ -12,9 +11,6 @@ include /etc/firejail/disable-passwdmgr.inc | |||
12 | include /etc/firejail/disable-programs.inc | 11 | include /etc/firejail/disable-programs.inc |
13 | 12 | ||
14 | # Whitelists | 13 | # Whitelists |
15 | mkdir ~/.cache/0ad | ||
16 | whitelist ~/.cache/0ad | ||
17 | |||
18 | mkdir ~/.config/0ad | 14 | mkdir ~/.config/0ad |
19 | whitelist ~/.config/0ad | 15 | whitelist ~/.config/0ad |
20 | 16 | ||
diff --git a/etc/abrowser.profile b/etc/abrowser.profile index b9a30d6bf..3b60750d5 100644 --- a/etc/abrowser.profile +++ b/etc/abrowser.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/abrowser.local | |||
4 | 4 | ||
5 | # Firejail profile for Abrowser | 5 | # Firejail profile for Abrowser |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.mozilla | 22 | mkdir ~/.mozilla |
24 | whitelist ~/.mozilla | 23 | whitelist ~/.mozilla |
25 | mkdir ~/.cache/mozilla/abrowser | ||
26 | whitelist ~/.cache/mozilla/abrowser | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | 34 | ||
diff --git a/etc/chromium.profile b/etc/chromium.profile index 995c0001b..ce823e0db 100644 --- a/etc/chromium.profile +++ b/etc/chromium.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/chromium.local | |||
4 | 4 | ||
5 | # Chromium browser profile | 5 | # Chromium browser profile |
6 | noblacklist ~/.config/chromium | 6 | noblacklist ~/.config/chromium |
7 | noblacklist ~/.cache/chromium | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/chromium | 18 | mkdir ~/.config/chromium |
20 | whitelist ~/.config/chromium | 19 | whitelist ~/.config/chromium |
21 | mkdir ~/.cache/chromium | ||
22 | whitelist ~/.cache/chromium | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | 22 | ||
diff --git a/etc/cyberfox.profile b/etc/cyberfox.profile index a79303f77..d9896e4a7 100644 --- a/etc/cyberfox.profile +++ b/etc/cyberfox.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/cyberfox.local | |||
4 | 4 | ||
5 | # Firejail profile for Cyberfox (based on Mozilla Firefox) | 5 | # Firejail profile for Cyberfox (based on Mozilla Firefox) |
6 | noblacklist ~/.8pecxstudios | 6 | noblacklist ~/.8pecxstudios |
7 | noblacklist ~/.cache/8pecxstudios | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.8pecxstudios | 22 | mkdir ~/.8pecxstudios |
24 | whitelist ~/.8pecxstudios | 23 | whitelist ~/.8pecxstudios |
25 | mkdir ~/.cache/8pecxstudios | ||
26 | whitelist ~/.cache/8pecxstudios | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | 34 | ||
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index 49ba7bc15..be3144133 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -1,4 +1,4 @@ | |||
1 | # This file is overwritten during software install. | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/disable-common.local | 3 | include /etc/firejail/disable-common.local |
4 | 4 | ||
@@ -235,6 +235,7 @@ blacklist ${PATH}/pantheon-terminal | |||
235 | blacklist ${PATH}/roxterm | 235 | blacklist ${PATH}/roxterm |
236 | blacklist ${PATH}/roxterm-config | 236 | blacklist ${PATH}/roxterm-config |
237 | blacklist ${PATH}/terminix | 237 | blacklist ${PATH}/terminix |
238 | blacklist ${PATH}/tilix | ||
238 | blacklist ${PATH}/urxvtc | 239 | blacklist ${PATH}/urxvtc |
239 | blacklist ${PATH}/urxvtcd | 240 | blacklist ${PATH}/urxvtcd |
240 | #konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 | 241 | #konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index 12f40e062..e61715ea2 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -1,4 +1,4 @@ | |||
1 | # This file is overwritten during software install. | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/disable-programs.local | 3 | include /etc/firejail/disable-programs.local |
4 | 4 | ||
@@ -17,44 +17,6 @@ blacklist ${HOME}/.arduino15 | |||
17 | blacklist ${HOME}/.atom | 17 | blacklist ${HOME}/.atom |
18 | blacklist ${HOME}/.audacity-data | 18 | blacklist ${HOME}/.audacity-data |
19 | blacklist ${HOME}/.bcast5 | 19 | blacklist ${HOME}/.bcast5 |
20 | blacklist ${HOME}/.cache/0ad | ||
21 | blacklist ${HOME}/.cache/8pecxstudios | ||
22 | blacklist ${HOME}/.cache/Franz | ||
23 | blacklist ${HOME}/.cache/INRIA | ||
24 | blacklist ${HOME}/.cache/QuiteRss | ||
25 | blacklist ${HOME}/.cache/champlain | ||
26 | blacklist ${HOME}/.cache/chromium | ||
27 | blacklist ${HOME}/.cache/qupzilla | ||
28 | blacklist ${HOME}/.cache/chromium-dev | ||
29 | blacklist ${HOME}/.cache/darktable | ||
30 | blacklist ${HOME}/.cache/epiphany | ||
31 | blacklist ${HOME}/.cache/evolution | ||
32 | blacklist ${HOME}/.cache/gajim | ||
33 | blacklist ${HOME}/.cache/geeqie | ||
34 | blacklist ${HOME}/.cache/google-chrome | ||
35 | blacklist ${HOME}/.cache/google-chrome-beta | ||
36 | blacklist ${HOME}/.cache/google-chrome-unstable | ||
37 | blacklist ${HOME}/.cache/icedove | ||
38 | blacklist ${HOME}/.cache/inox | ||
39 | blacklist ${HOME}/.cache/libgweather | ||
40 | blacklist ${HOME}/.cache/midori | ||
41 | blacklist ${HOME}/.cache/mozilla | ||
42 | blacklist ${HOME}/.cache/mutt | ||
43 | blacklist ${HOME}/.cache/netsurf | ||
44 | blacklist ${HOME}/.cache/opera | ||
45 | blacklist ${HOME}/.cache/opera-beta | ||
46 | blacklist ${HOME}/.cache/org.gnome.Books | ||
47 | blacklist ${HOME}/.cache/qutebrowser | ||
48 | blacklist ${HOME}/.cache/simple-scan | ||
49 | blacklist ${HOME}/.cache/slimjet | ||
50 | blacklist ${HOME}/.cache/spotify | ||
51 | blacklist ${HOME}/.cache/telepathy | ||
52 | blacklist ${HOME}/.cache/thunderbird | ||
53 | blacklist ${HOME}/.cache/torbrowser | ||
54 | blacklist ${HOME}/.cache/transmission | ||
55 | blacklist ${HOME}/.cache/vivaldi | ||
56 | blacklist ${HOME}/.cache/wesnoth | ||
57 | blacklist ${HOME}/.cache/xreader | ||
58 | blacklist ${HOME}/.claws-mail | 20 | blacklist ${HOME}/.claws-mail |
59 | blacklist ${HOME}/.config/0ad | 21 | blacklist ${HOME}/.config/0ad |
60 | blacklist ${HOME}/.config/Atom | 22 | blacklist ${HOME}/.config/Atom |
@@ -280,7 +242,7 @@ blacklist ${HOME}/.thunderbird | |||
280 | blacklist ${HOME}/.ts3client | 242 | blacklist ${HOME}/.ts3client |
281 | blacklist ${HOME}/.vst | 243 | blacklist ${HOME}/.vst |
282 | blacklist ${HOME}/.w3m | 244 | blacklist ${HOME}/.w3m |
283 | blacklist ${HOME}/.warzone2100-3.1 | 245 | blacklist ${HOME}/.warzone2100-3.* |
284 | blacklist ${HOME}/.weechat | 246 | blacklist ${HOME}/.weechat |
285 | blacklist ${HOME}/.wine | 247 | blacklist ${HOME}/.wine |
286 | blacklist ${HOME}/.wine64 | 248 | blacklist ${HOME}/.wine64 |
diff --git a/etc/epiphany.profile b/etc/epiphany.profile index 1bf259440..0b281c448 100644 --- a/etc/epiphany.profile +++ b/etc/epiphany.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/epiphany.local | |||
4 | 4 | ||
5 | # Epiphany browser profile | 5 | # Epiphany browser profile |
6 | noblacklist ${HOME}/.config/epiphany | 6 | noblacklist ${HOME}/.config/epiphany |
7 | noblacklist ${HOME}/.cache/epiphany | ||
8 | noblacklist ${HOME}/.local/share/epiphany | 7 | noblacklist ${HOME}/.local/share/epiphany |
9 | 8 | ||
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -16,8 +15,6 @@ mkdir ${HOME}/.local/share/epiphany | |||
16 | whitelist ${HOME}/.local/share/epiphany | 15 | whitelist ${HOME}/.local/share/epiphany |
17 | mkdir ${HOME}/.config/epiphany | 16 | mkdir ${HOME}/.config/epiphany |
18 | whitelist ${HOME}/.config/epiphany | 17 | whitelist ${HOME}/.config/epiphany |
19 | mkdir ${HOME}/.cache/epiphany | ||
20 | whitelist ${HOME}/.cache/epiphany | ||
21 | include /etc/firejail/whitelist-common.inc | 18 | include /etc/firejail/whitelist-common.inc |
22 | 19 | ||
23 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/evolution.profile b/etc/evolution.profile index cb6615716..637ac334a 100644 --- a/etc/evolution.profile +++ b/etc/evolution.profile | |||
@@ -5,7 +5,6 @@ include /etc/firejail/evolution.local | |||
5 | # evolution profile | 5 | # evolution profile |
6 | noblacklist ~/.config/evolution | 6 | noblacklist ~/.config/evolution |
7 | noblacklist ~/.local/share/evolution | 7 | noblacklist ~/.local/share/evolution |
8 | noblacklist ~/.cache/evolution | ||
9 | noblacklist ~/.pki | 8 | noblacklist ~/.pki |
10 | noblacklist ~/.pki/nssdb | 9 | noblacklist ~/.pki/nssdb |
11 | noblacklist ~/.gnupg | 10 | noblacklist ~/.gnupg |
diff --git a/etc/firefox.profile b/etc/firefox.profile index e2cfb9138..20acde62a 100644 --- a/etc/firefox.profile +++ b/etc/firefox.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/firefox.local | |||
4 | 4 | ||
5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) | 5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.config/qpdfview | 7 | noblacklist ~/.config/qpdfview |
9 | noblacklist ~/.local/share/qpdfview | 8 | noblacklist ~/.local/share/qpdfview |
10 | noblacklist ~/.kde/share/apps/okular | 9 | noblacklist ~/.kde/share/apps/okular |
@@ -25,8 +24,6 @@ tracelog | |||
25 | whitelist ${DOWNLOADS} | 24 | whitelist ${DOWNLOADS} |
26 | mkdir ~/.mozilla | 25 | mkdir ~/.mozilla |
27 | whitelist ~/.mozilla | 26 | whitelist ~/.mozilla |
28 | mkdir ~/.cache/mozilla/firefox | ||
29 | whitelist ~/.cache/mozilla/firefox | ||
30 | whitelist ~/dwhelper | 27 | whitelist ~/dwhelper |
31 | whitelist ~/.zotero | 28 | whitelist ~/.zotero |
32 | whitelist ~/.vimperatorrc | 29 | whitelist ~/.vimperatorrc |
@@ -35,7 +32,6 @@ whitelist ~/.pentadactylrc | |||
35 | whitelist ~/.pentadactyl | 32 | whitelist ~/.pentadactyl |
36 | whitelist ~/.keysnail.js | 33 | whitelist ~/.keysnail.js |
37 | whitelist ~/.config/gnome-mplayer | 34 | whitelist ~/.config/gnome-mplayer |
38 | whitelist ~/.cache/gnome-mplayer/plugin | ||
39 | mkdir ~/.pki | 35 | mkdir ~/.pki |
40 | whitelist ~/.pki | 36 | whitelist ~/.pki |
41 | whitelist ~/.lastpass | 37 | whitelist ~/.lastpass |
@@ -55,4 +51,4 @@ include /etc/firejail/whitelist-common.inc | |||
55 | #private-bin firefox,which,sh,dbus-launch,dbus-send,env | 51 | #private-bin firefox,which,sh,dbus-launch,dbus-send,env |
56 | #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse | 52 | #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse |
57 | private-dev | 53 | private-dev |
58 | #private-tmp | 54 | private-tmp |
diff --git a/etc/flashpeak-slimjet.profile b/etc/flashpeak-slimjet.profile index 4dc5b5cfc..a35aa7a33 100644 --- a/etc/flashpeak-slimjet.profile +++ b/etc/flashpeak-slimjet.profile | |||
@@ -10,7 +10,6 @@ include /etc/firejail/flashpeak-slimjet.local | |||
10 | # firejail flashpeak-slimjet --no-sandbox | 10 | # firejail flashpeak-slimjet --no-sandbox |
11 | # | 11 | # |
12 | noblacklist ~/.config/slimjet | 12 | noblacklist ~/.config/slimjet |
13 | noblacklist ~/.cache/slimjet | ||
14 | noblacklist ~/.pki | 13 | noblacklist ~/.pki |
15 | include /etc/firejail/disable-common.inc | 14 | include /etc/firejail/disable-common.inc |
16 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
@@ -29,8 +28,6 @@ seccomp | |||
29 | whitelist ${DOWNLOADS} | 28 | whitelist ${DOWNLOADS} |
30 | mkdir ~/.config/slimjet | 29 | mkdir ~/.config/slimjet |
31 | whitelist ~/.config/slimjet | 30 | whitelist ~/.config/slimjet |
32 | mkdir ~/.cache/slimjet | ||
33 | whitelist ~/.cache/slimjet | ||
34 | mkdir ~/.pki | 31 | mkdir ~/.pki |
35 | whitelist ~/.pki | 32 | whitelist ~/.pki |
36 | 33 | ||
diff --git a/etc/fossamail.profile b/etc/fossamail.profile index 3caaad71c..a33514c88 100644 --- a/etc/fossamail.profile +++ b/etc/fossamail.profile | |||
@@ -12,8 +12,5 @@ noblacklist ~/.fossamail | |||
12 | mkdir ~/.fossamail | 12 | mkdir ~/.fossamail |
13 | whitelist ~/.fossamail | 13 | whitelist ~/.fossamail |
14 | 14 | ||
15 | noblacklist ~/.cache/fossamail | ||
16 | mkdir ~/.cache/fossamail | ||
17 | whitelist ~/.cache/fossamail | ||
18 | 15 | ||
19 | include /etc/firejail/firefox.profile | 16 | include /etc/firejail/firefox.profile |
diff --git a/etc/franz.profile b/etc/franz.profile index 05ff72a47..1692f4516 100644 --- a/etc/franz.profile +++ b/etc/franz.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/franz.local | |||
4 | 4 | ||
5 | # Franz profile | 5 | # Franz profile |
6 | noblacklist ~/.config/Franz | 6 | noblacklist ~/.config/Franz |
7 | noblacklist ~/.cache/Franz | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -21,8 +20,6 @@ seccomp | |||
21 | whitelist ${DOWNLOADS} | 20 | whitelist ${DOWNLOADS} |
22 | mkdir ~/.config/Franz | 21 | mkdir ~/.config/Franz |
23 | whitelist ~/.config/Franz | 22 | whitelist ~/.config/Franz |
24 | mkdir ~/.cache/Franz | ||
25 | whitelist ~/.cache/Franz | ||
26 | mkdir ~/.pki | 23 | mkdir ~/.pki |
27 | whitelist ~/.pki | 24 | whitelist ~/.pki |
28 | 25 | ||
diff --git a/etc/gajim.profile b/etc/gajim.profile index bac6cc466..f64d9241a 100644 --- a/etc/gajim.profile +++ b/etc/gajim.profile | |||
@@ -3,11 +3,9 @@ | |||
3 | include /etc/firejail/gajim.local | 3 | include /etc/firejail/gajim.local |
4 | 4 | ||
5 | # Firejail profile for Gajim | 5 | # Firejail profile for Gajim |
6 | noblacklist ${HOME}/.cache/gajim | ||
7 | noblacklist ${HOME}/.local/share/gajim | 6 | noblacklist ${HOME}/.local/share/gajim |
8 | noblacklist ${HOME}/.config/gajim | 7 | noblacklist ${HOME}/.config/gajim |
9 | 8 | ||
10 | mkdir ${HOME}/.cache/gajim | ||
11 | mkdir ${HOME}/.local/share/gajim | 9 | mkdir ${HOME}/.local/share/gajim |
12 | mkdir ${HOME}/.config/gajim | 10 | mkdir ${HOME}/.config/gajim |
13 | mkdir ${HOME}/Downloads | 11 | mkdir ${HOME}/Downloads |
@@ -17,7 +15,6 @@ mkdir ${HOME}/.local/lib/python2.7/site-packages/ | |||
17 | whitelist ${HOME}/.local/lib/python2.7/site-packages/ | 15 | whitelist ${HOME}/.local/lib/python2.7/site-packages/ |
18 | read-only ${HOME}/.local/lib/python2.7/site-packages/ | 16 | read-only ${HOME}/.local/lib/python2.7/site-packages/ |
19 | 17 | ||
20 | whitelist ${HOME}/.cache/gajim | ||
21 | whitelist ${HOME}/.local/share/gajim | 18 | whitelist ${HOME}/.local/share/gajim |
22 | whitelist ${HOME}/.config/gajim | 19 | whitelist ${HOME}/.config/gajim |
23 | whitelist ${HOME}/Downloads | 20 | whitelist ${HOME}/Downloads |
diff --git a/etc/geeqie.profile b/etc/geeqie.profile index 57f942a50..9f79e15b8 100644 --- a/etc/geeqie.profile +++ b/etc/geeqie.profile | |||
@@ -3,7 +3,6 @@ | |||
3 | include /etc/firejail/geeqie.local | 3 | include /etc/firejail/geeqie.local |
4 | 4 | ||
5 | # Firejail profile for Geeqie | 5 | # Firejail profile for Geeqie |
6 | noblacklist ~/.cache/geeqie | ||
7 | noblacklist ~/.config/geeqie | 6 | noblacklist ~/.config/geeqie |
8 | noblacklist ~/.local/share/geeqie | 7 | noblacklist ~/.local/share/geeqie |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
diff --git a/etc/gjs.profile b/etc/gjs.profile index 24ec70e86..03dd7893c 100644 --- a/etc/gjs.profile +++ b/etc/gjs.profile | |||
@@ -6,10 +6,8 @@ include /etc/firejail/gjs.local | |||
6 | 6 | ||
7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them | 7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them |
8 | 8 | ||
9 | noblacklist ~/.cache/org.gnome.Books | ||
10 | noblacklist ~/.config/libreoffice | 9 | noblacklist ~/.config/libreoffice |
11 | noblacklist ~/.local/share/gnome-photos | 10 | noblacklist ~/.local/share/gnome-photos |
12 | noblacklist ~/.cache/libgweather | ||
13 | 11 | ||
14 | include /etc/firejail/disable-common.inc | 12 | include /etc/firejail/disable-common.inc |
15 | include /etc/firejail/disable-programs.inc | 13 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/gnome-books.profile b/etc/gnome-books.profile index 692e32896..bf2a9f36f 100644 --- a/etc/gnome-books.profile +++ b/etc/gnome-books.profile | |||
@@ -6,8 +6,6 @@ include /etc/firejail/gnome-books.local | |||
6 | 6 | ||
7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them | 7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them |
8 | 8 | ||
9 | noblacklist ~/.cache/org.gnome.Books | ||
10 | |||
11 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-programs.inc | 10 | include /etc/firejail/disable-programs.inc |
13 | include /etc/firejail/disable-devel.inc | 11 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/gnome-weather.profile b/etc/gnome-weather.profile index 925420a5a..3b6bdd130 100644 --- a/etc/gnome-weather.profile +++ b/etc/gnome-weather.profile | |||
@@ -6,8 +6,6 @@ include /etc/firejail/gnome-weather.local | |||
6 | 6 | ||
7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them | 7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them |
8 | 8 | ||
9 | noblacklist ~/.cache/libgweather | ||
10 | |||
11 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-programs.inc | 10 | include /etc/firejail/disable-programs.inc |
13 | include /etc/firejail/disable-devel.inc | 11 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile index 3bd16de4a..65bc42648 100644 --- a/etc/google-chrome-beta.profile +++ b/etc/google-chrome-beta.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/google-chrome-beta.local | |||
4 | 4 | ||
5 | # Google Chrome beta browser profile | 5 | # Google Chrome beta browser profile |
6 | noblacklist ~/.config/google-chrome-beta | 6 | noblacklist ~/.config/google-chrome-beta |
7 | noblacklist ~/.cache/google-chrome-beta | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/google-chrome-beta | 18 | mkdir ~/.config/google-chrome-beta |
20 | whitelist ~/.config/google-chrome-beta | 19 | whitelist ~/.config/google-chrome-beta |
21 | mkdir ~/.cache/google-chrome-beta | ||
22 | whitelist ~/.cache/google-chrome-beta | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile index d2def4f96..6f6fa1bf2 100644 --- a/etc/google-chrome-unstable.profile +++ b/etc/google-chrome-unstable.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/google-chrome-unstable.local | |||
4 | 4 | ||
5 | # Google Chrome unstable browser profile | 5 | # Google Chrome unstable browser profile |
6 | noblacklist ~/.config/google-chrome-unstable | 6 | noblacklist ~/.config/google-chrome-unstable |
7 | noblacklist ~/.cache/google-chrome-unstable | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/google-chrome-unstable | 18 | mkdir ~/.config/google-chrome-unstable |
20 | whitelist ~/.config/google-chrome-unstable | 19 | whitelist ~/.config/google-chrome-unstable |
21 | mkdir ~/.cache/google-chrome-unstable | ||
22 | whitelist ~/.cache/google-chrome-unstable | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile index 38feb12a5..131538dd9 100644 --- a/etc/google-chrome.profile +++ b/etc/google-chrome.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/google-chrome.local | |||
4 | 4 | ||
5 | # Google Chrome browser profile | 5 | # Google Chrome browser profile |
6 | noblacklist ~/.config/google-chrome | 6 | noblacklist ~/.config/google-chrome |
7 | noblacklist ~/.cache/google-chrome | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/google-chrome | 18 | mkdir ~/.config/google-chrome |
20 | whitelist ~/.config/google-chrome | 19 | whitelist ~/.config/google-chrome |
21 | mkdir ~/.cache/google-chrome | ||
22 | whitelist ~/.cache/google-chrome | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/icecat.profile b/etc/icecat.profile index 64401efe8..4bd3f3047 100644 --- a/etc/icecat.profile +++ b/etc/icecat.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/icecat.local | |||
4 | 4 | ||
5 | # Firejail profile for GNU Icecat | 5 | # Firejail profile for GNU Icecat |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.mozilla | 22 | mkdir ~/.mozilla |
24 | whitelist ~/.mozilla | 23 | whitelist ~/.mozilla |
25 | mkdir ~/.cache/mozilla/icecat | ||
26 | whitelist ~/.cache/mozilla/icecat | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | 34 | ||
diff --git a/etc/icedove.profile b/etc/icedove.profile index b5265e992..aae0e3bf5 100644 --- a/etc/icedove.profile +++ b/etc/icedove.profile | |||
@@ -14,10 +14,6 @@ noblacklist ~/.icedove | |||
14 | mkdir ~/.icedove | 14 | mkdir ~/.icedove |
15 | whitelist ~/.icedove | 15 | whitelist ~/.icedove |
16 | 16 | ||
17 | noblacklist ~/.cache/icedove | ||
18 | mkdir ~/.cache/icedove | ||
19 | whitelist ~/.cache/icedove | ||
20 | |||
21 | # allow browsers | 17 | # allow browsers |
22 | ignore private-tmp | 18 | ignore private-tmp |
23 | include /etc/firejail/firefox.profile | 19 | include /etc/firejail/firefox.profile |
diff --git a/etc/inox.profile b/etc/inox.profile index 0b2e4ee5e..6043ded8a 100644 --- a/etc/inox.profile +++ b/etc/inox.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/inox.local | |||
4 | 4 | ||
5 | # Inox browser profile | 5 | # Inox browser profile |
6 | noblacklist ~/.config/inox | 6 | noblacklist ~/.config/inox |
7 | noblacklist ~/.cache/inox | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -14,8 +13,6 @@ netfilter | |||
14 | whitelist ${DOWNLOADS} | 13 | whitelist ${DOWNLOADS} |
15 | mkdir ~/.config/inox | 14 | mkdir ~/.config/inox |
16 | whitelist ~/.config/inox | 15 | whitelist ~/.config/inox |
17 | mkdir ~/.cache/inox | ||
18 | whitelist ~/.cache/inox | ||
19 | mkdir ~/.pki | 16 | mkdir ~/.pki |
20 | whitelist ~/.pki | 17 | whitelist ~/.pki |
21 | 18 | ||
diff --git a/etc/iridium.profile b/etc/iridium.profile index 2d79a3935..dcbd0b84b 100644 --- a/etc/iridium.profile +++ b/etc/iridium.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/iridium.local | |||
4 | 4 | ||
5 | # Iridium browser profile | 5 | # Iridium browser profile |
6 | noblacklist ~/.config/iridium | 6 | noblacklist ~/.config/iridium |
7 | noblacklist ~/.cache/iridium | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | 9 | ||
@@ -17,8 +16,6 @@ netfilter | |||
17 | whitelist ${DOWNLOADS} | 16 | whitelist ${DOWNLOADS} |
18 | mkdir ~/.config/iridium | 17 | mkdir ~/.config/iridium |
19 | whitelist ~/.config/iridium | 18 | whitelist ~/.config/iridium |
20 | mkdir ~/.cache/iridium | ||
21 | whitelist ~/.cache/iridium | ||
22 | mkdir ~/.pki | 19 | mkdir ~/.pki |
23 | whitelist ~/.pki | 20 | whitelist ~/.pki |
24 | 21 | ||
diff --git a/etc/mutt.profile b/etc/mutt.profile index 2f0809f02..f9d537779 100644 --- a/etc/mutt.profile +++ b/etc/mutt.profile | |||
@@ -14,7 +14,6 @@ noblacklist ~/mail | |||
14 | noblacklist ~/Mail | 14 | noblacklist ~/Mail |
15 | noblacklist ~/sent | 15 | noblacklist ~/sent |
16 | noblacklist ~/postponed | 16 | noblacklist ~/postponed |
17 | noblacklist ~/.cache/mutt | ||
18 | noblacklist ~/.w3m | 17 | noblacklist ~/.w3m |
19 | noblacklist ~/.elinks | 18 | noblacklist ~/.elinks |
20 | noblacklist ~/.vim | 19 | noblacklist ~/.vim |
diff --git a/etc/netsurf.profile b/etc/netsurf.profile index c217346de..a3c360c1e 100644 --- a/etc/netsurf.profile +++ b/etc/netsurf.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/netsurf.local | |||
4 | 4 | ||
5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) | 5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) |
6 | noblacklist ~/.config/netsurf | 6 | noblacklist ~/.config/netsurf |
7 | noblacklist ~/.cache/netsurf | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -20,7 +19,5 @@ tracelog | |||
20 | whitelist ${DOWNLOADS} | 19 | whitelist ${DOWNLOADS} |
21 | mkdir ~/.config/netsurf | 20 | mkdir ~/.config/netsurf |
22 | whitelist ~/.config/netsurf | 21 | whitelist ~/.config/netsurf |
23 | mkdir ~/.cache/netsurf | ||
24 | whitelist ~/.cache/netsurf | ||
25 | 22 | ||
26 | include /etc/firejail/whitelist-common.inc | 23 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile index 92624f334..5a0d54744 100644 --- a/etc/opera-beta.profile +++ b/etc/opera-beta.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/opera-beta.local | |||
4 | 4 | ||
5 | # Opera-beta browser profile | 5 | # Opera-beta browser profile |
6 | noblacklist ~/.config/opera-beta | 6 | noblacklist ~/.config/opera-beta |
7 | noblacklist ~/.cache/opera-beta | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -15,8 +14,6 @@ netfilter | |||
15 | whitelist ${DOWNLOADS} | 14 | whitelist ${DOWNLOADS} |
16 | mkdir ~/.config/opera-beta | 15 | mkdir ~/.config/opera-beta |
17 | whitelist ~/.config/opera-beta | 16 | whitelist ~/.config/opera-beta |
18 | mkdir ~/.cache/opera-beta | ||
19 | whitelist ~/.cache/opera-beta | ||
20 | mkdir ~/.pki | 17 | mkdir ~/.pki |
21 | whitelist ~/.pki | 18 | whitelist ~/.pki |
22 | include /etc/firejail/whitelist-common.inc | 19 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/opera.profile b/etc/opera.profile index 57835f2f2..4af502060 100644 --- a/etc/opera.profile +++ b/etc/opera.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/opera.local | |||
4 | 4 | ||
5 | # Opera browser profile | 5 | # Opera browser profile |
6 | noblacklist ~/.config/opera | 6 | noblacklist ~/.config/opera |
7 | noblacklist ~/.cache/opera | ||
8 | noblacklist ~/.opera | 7 | noblacklist ~/.opera |
9 | noblacklist ~/.pki | 8 | noblacklist ~/.pki |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -16,8 +15,6 @@ netfilter | |||
16 | whitelist ${DOWNLOADS} | 15 | whitelist ${DOWNLOADS} |
17 | mkdir ~/.config/opera | 16 | mkdir ~/.config/opera |
18 | whitelist ~/.config/opera | 17 | whitelist ~/.config/opera |
19 | mkdir ~/.cache/opera | ||
20 | whitelist ~/.cache/opera | ||
21 | mkdir ~/.opera | 18 | mkdir ~/.opera |
22 | whitelist ~/.opera | 19 | whitelist ~/.opera |
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
diff --git a/etc/palemoon.profile b/etc/palemoon.profile index 8cac00e03..472d58cee 100644 --- a/etc/palemoon.profile +++ b/etc/palemoon.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/palemoon.local | |||
4 | 4 | ||
5 | # Firejail profile for Pale Moon | 5 | # Firejail profile for Pale Moon |
6 | noblacklist ~/.moonchild productions/pale moon | 6 | noblacklist ~/.moonchild productions/pale moon |
7 | noblacklist ~/.cache/moonchild productions/pale moon | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -13,8 +12,6 @@ include /etc/firejail/whitelist-common.inc | |||
13 | whitelist ${DOWNLOADS} | 12 | whitelist ${DOWNLOADS} |
14 | mkdir ~/.moonchild productions | 13 | mkdir ~/.moonchild productions |
15 | whitelist ~/.moonchild productions | 14 | whitelist ~/.moonchild productions |
16 | mkdir ~/.cache/moonchild productions/pale moon | ||
17 | whitelist ~/.cache/moonchild productions/pale moon | ||
18 | 15 | ||
19 | caps.drop all | 16 | caps.drop all |
20 | netfilter | 17 | netfilter |
@@ -40,7 +37,6 @@ private-tmp | |||
40 | #whitelist ~/.pentadactyl | 37 | #whitelist ~/.pentadactyl |
41 | #whitelist ~/.keysnail.js | 38 | #whitelist ~/.keysnail.js |
42 | #whitelist ~/.config/gnome-mplayer | 39 | #whitelist ~/.config/gnome-mplayer |
43 | #whitelist ~/.cache/gnome-mplayer/plugin | ||
44 | #whitelist ~/.pki | 40 | #whitelist ~/.pki |
45 | #whitelist ~/.lastpass | 41 | #whitelist ~/.lastpass |
46 | 42 | ||
diff --git a/etc/polari.profile b/etc/polari.profile index 834a8b3d6..52a58322e 100644 --- a/etc/polari.profile +++ b/etc/polari.profile | |||
@@ -15,8 +15,6 @@ mkdir ${HOME}/.local/share/TpLogger | |||
15 | whitelist ${HOME}/.local/share/TpLogger | 15 | whitelist ${HOME}/.local/share/TpLogger |
16 | mkdir ${HOME}/.config/telepathy-account-widgets | 16 | mkdir ${HOME}/.config/telepathy-account-widgets |
17 | whitelist ${HOME}/.config/telepathy-account-widgets | 17 | whitelist ${HOME}/.config/telepathy-account-widgets |
18 | mkdir ${HOME}/.cache/telepathy | ||
19 | whitelist ${HOME}/.cache/telepathy | ||
20 | mkdir ${HOME}/.purple | 18 | mkdir ${HOME}/.purple |
21 | whitelist ${HOME}/.purple | 19 | whitelist ${HOME}/.purple |
22 | include /etc/firejail/whitelist-common.inc | 20 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile index 45cb22ee4..5106fccb2 100644 --- a/etc/psi-plus.profile +++ b/etc/psi-plus.profile | |||
@@ -14,8 +14,6 @@ mkdir ~/.config/psi+ | |||
14 | whitelist ~/.config/psi+ | 14 | whitelist ~/.config/psi+ |
15 | mkdir ~/.local/share/psi+ | 15 | mkdir ~/.local/share/psi+ |
16 | whitelist ~/.local/share/psi+ | 16 | whitelist ~/.local/share/psi+ |
17 | mkdir ~/.cache/psi+ | ||
18 | whitelist ~/.cache/psi+ | ||
19 | 17 | ||
20 | caps.drop all | 18 | caps.drop all |
21 | netfilter | 19 | netfilter |
diff --git a/etc/quiterss.profile b/etc/quiterss.profile index f4e4f96d3..158425e18 100644 --- a/etc/quiterss.profile +++ b/etc/quiterss.profile | |||
@@ -2,7 +2,6 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/quiterss.local | 3 | include /etc/firejail/quiterss.local |
4 | 4 | ||
5 | noblacklist ${HOME}/.cache/QuiteRss | ||
6 | noblacklist ${HOME}/.config/QuiteRss | 5 | noblacklist ${HOME}/.config/QuiteRss |
7 | noblacklist ${HOME}/.config/QuiteRssrc | 6 | noblacklist ${HOME}/.config/QuiteRssrc |
8 | noblacklist ${HOME}/.local/share/QuiteRss | 7 | noblacklist ${HOME}/.local/share/QuiteRss |
@@ -19,8 +18,6 @@ whitelist ${HOME}/.config/QuiteRssrc | |||
19 | mkdir ~/.local/share/data | 18 | mkdir ~/.local/share/data |
20 | mkdir ~/.local/share/data/QuiteRss | 19 | mkdir ~/.local/share/data/QuiteRss |
21 | whitelist ${HOME}/.local/share/data/QuiteRss | 20 | whitelist ${HOME}/.local/share/data/QuiteRss |
22 | mkdir ~/.cache/QuiteRss | ||
23 | whitelist ${HOME}/.cache/QuiteRss | ||
24 | 21 | ||
25 | caps.drop all | 22 | caps.drop all |
26 | netfilter | 23 | netfilter |
diff --git a/etc/qupzilla.profile b/etc/qupzilla.profile index 3f5cb60c0..783bc516d 100644 --- a/etc/qupzilla.profile +++ b/etc/qupzilla.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/qupzilla.local | |||
4 | 4 | ||
5 | # Firejail profile for Qupzilla web browser | 5 | # Firejail profile for Qupzilla web browser |
6 | noblacklist ${HOME}/.config/qupzilla | 6 | noblacklist ${HOME}/.config/qupzilla |
7 | noblacklist ${HOME}/.cache/qupzilla | ||
8 | include /etc/firejail/disable-mgmt.inc | 7 | include /etc/firejail/disable-mgmt.inc |
9 | include /etc/firejail/disable-secret.inc | 8 | include /etc/firejail/disable-secret.inc |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -17,7 +16,6 @@ tracelog | |||
17 | noroot | 16 | noroot |
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | whitelist ~/.config/qupzilla | 18 | whitelist ~/.config/qupzilla |
20 | whitelist ~/.cache/qupzilla | ||
21 | include /etc/firejail/whitelist-common.inc | 19 | include /etc/firejail/whitelist-common.inc |
22 | 20 | ||
23 | # experimental features | 21 | # experimental features |
diff --git a/etc/qutebrowser.profile b/etc/qutebrowser.profile index f43307ef9..53be1178c 100644 --- a/etc/qutebrowser.profile +++ b/etc/qutebrowser.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/qutebrowser.local | |||
4 | 4 | ||
5 | # Firejail profile for Qutebrowser (Qt5-Webkit+Python) browser | 5 | # Firejail profile for Qutebrowser (Qt5-Webkit+Python) browser |
6 | noblacklist ~/.config/qutebrowser | 6 | noblacklist ~/.config/qutebrowser |
7 | noblacklist ~/.cache/qutebrowser | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -20,8 +19,6 @@ tracelog | |||
20 | whitelist ${DOWNLOADS} | 19 | whitelist ${DOWNLOADS} |
21 | mkdir ~/.config/qutebrowser | 20 | mkdir ~/.config/qutebrowser |
22 | whitelist ~/.config/qutebrowser | 21 | whitelist ~/.config/qutebrowser |
23 | mkdir ~/.cache/qutebrowser | ||
24 | whitelist ~/.cache/qutebrowser | ||
25 | mkdir ~/.local/share/qutebrowser | 22 | mkdir ~/.local/share/qutebrowser |
26 | whitelist ~/.local/share/qutebrowser | 23 | whitelist ~/.local/share/qutebrowser |
27 | include /etc/firejail/whitelist-common.inc | 24 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/seamonkey.profile b/etc/seamonkey.profile index df1910469..756700c2f 100644 --- a/etc/seamonkey.profile +++ b/etc/seamonkey.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/seamonkey.local | |||
4 | 4 | ||
5 | # Firejail profile for Seamoneky based off Mozilla Firefox | 5 | # Firejail profile for Seamoneky based off Mozilla Firefox |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.mozilla/seamonkey | 22 | mkdir ~/.mozilla/seamonkey |
24 | whitelist ~/.mozilla/seamonkey | 23 | whitelist ~/.mozilla/seamonkey |
25 | mkdir ~/.cache/mozilla/seamonkey | ||
26 | whitelist ~/.cache/mozilla/seamonkey | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | include /etc/firejail/whitelist-common.inc | 34 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/simple-scan.profile b/etc/simple-scan.profile index ee7e50ba7..0f6d626a5 100644 --- a/etc/simple-scan.profile +++ b/etc/simple-scan.profile | |||
@@ -3,8 +3,6 @@ | |||
3 | include /etc/firejail/simple-scan.local | 3 | include /etc/firejail/simple-scan.local |
4 | 4 | ||
5 | # simple-scan profile | 5 | # simple-scan profile |
6 | noblacklist ~/.cache/simple-scan | ||
7 | |||
8 | include /etc/firejail/disable-common.inc | 6 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 7 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 8 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/spotify.profile b/etc/spotify.profile index 843038a2b..23ef75b71 100644 --- a/etc/spotify.profile +++ b/etc/spotify.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/spotify.local | |||
4 | 4 | ||
5 | # Spotify media player profile | 5 | # Spotify media player profile |
6 | noblacklist ${HOME}/.config/spotify | 6 | noblacklist ${HOME}/.config/spotify |
7 | noblacklist ${HOME}/.cache/spotify | ||
8 | noblacklist ${HOME}/.local/share/spotify | 7 | noblacklist ${HOME}/.local/share/spotify |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -16,8 +15,6 @@ mkdir ${HOME}/.config/spotify | |||
16 | whitelist ${HOME}/.config/spotify | 15 | whitelist ${HOME}/.config/spotify |
17 | mkdir ${HOME}/.local/share/spotify | 16 | mkdir ${HOME}/.local/share/spotify |
18 | whitelist ${HOME}/.local/share/spotify | 17 | whitelist ${HOME}/.local/share/spotify |
19 | mkdir ${HOME}/.cache/spotify | ||
20 | whitelist ${HOME}/.cache/spotify | ||
21 | 18 | ||
22 | caps.drop all | 19 | caps.drop all |
23 | netfilter | 20 | netfilter |
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile index 88ab7501e..1dc8b15c7 100644 --- a/etc/thunderbird.profile +++ b/etc/thunderbird.profile | |||
@@ -14,10 +14,6 @@ noblacklist ~/.thunderbird | |||
14 | mkdir ~/.thunderbird | 14 | mkdir ~/.thunderbird |
15 | whitelist ~/.thunderbird | 15 | whitelist ~/.thunderbird |
16 | 16 | ||
17 | noblacklist ~/.cache/thunderbird | ||
18 | mkdir ~/.cache/thunderbird | ||
19 | whitelist ~/.cache/thunderbird | ||
20 | |||
21 | # allow browsers | 17 | # allow browsers |
22 | ignore private-tmp | 18 | ignore private-tmp |
23 | include /etc/firejail/firefox.profile | 19 | include /etc/firejail/firefox.profile |
diff --git a/etc/transmission-cli.profile b/etc/transmission-cli.profile index dbcc8d041..5b6bec4c1 100644 --- a/etc/transmission-cli.profile +++ b/etc/transmission-cli.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-cli.local | |||
4 | 4 | ||
5 | # transmission-cli bittorrent profile | 5 | # transmission-cli bittorrent profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile index dcd3317ef..78ce5fba2 100644 --- a/etc/transmission-gtk.profile +++ b/etc/transmission-gtk.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-gtk.local | |||
4 | 4 | ||
5 | # transmission-gtk bittorrent profile | 5 | # transmission-gtk bittorrent profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile index ed63f7cff..2f7fe0714 100644 --- a/etc/transmission-qt.profile +++ b/etc/transmission-qt.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-qt.local | |||
4 | 4 | ||
5 | # transmission-qt bittorrent profile | 5 | # transmission-qt bittorrent profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/transmission-show.profile b/etc/transmission-show.profile index 0b88789b1..052843882 100644 --- a/etc/transmission-show.profile +++ b/etc/transmission-show.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-show.local | |||
4 | 4 | ||
5 | # transmission-show profile | 5 | # transmission-show profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile index 2c2fbd9f0..bf6af3926 100644 --- a/etc/vivaldi.profile +++ b/etc/vivaldi.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/vivaldi.local | |||
4 | 4 | ||
5 | # Vivaldi browser profile | 5 | # Vivaldi browser profile |
6 | noblacklist ~/.config/vivaldi | 6 | noblacklist ~/.config/vivaldi |
7 | noblacklist ~/.cache/vivaldi | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -14,6 +13,4 @@ netfilter | |||
14 | whitelist ${DOWNLOADS} | 13 | whitelist ${DOWNLOADS} |
15 | mkdir ~/.config/vivaldi | 14 | mkdir ~/.config/vivaldi |
16 | whitelist ~/.config/vivaldi | 15 | whitelist ~/.config/vivaldi |
17 | mkdir ~/.cache/vivaldi | ||
18 | whitelist ~/.cache/vivaldi | ||
19 | include /etc/firejail/whitelist-common.inc | 16 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile index 702097d98..2f4055887 100644 --- a/etc/warzone2100.profile +++ b/etc/warzone2100.profile | |||
@@ -3,16 +3,17 @@ | |||
3 | include /etc/firejail/warzone2100.local | 3 | include /etc/firejail/warzone2100.local |
4 | 4 | ||
5 | # Firejail profile for warzone2100 | 5 | # Firejail profile for warzone2100 |
6 | # Currently supports warzone2100-3.1 | 6 | noblacklist ~/.warzone2100-3.* |
7 | noblacklist ~/.warzone2100-3.1 | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-devel.inc | 8 | include /etc/firejail/disable-devel.inc |
10 | include /etc/firejail/disable-passwdmgr.inc | 9 | include /etc/firejail/disable-passwdmgr.inc |
11 | include /etc/firejail/disable-programs.inc | 10 | include /etc/firejail/disable-programs.inc |
12 | 11 | ||
13 | # Whitelist | 12 | # Whitelist |
14 | mkdir ~/.warzone2100-3.1 | 13 | #mkdir ~/.warzone2100-3.1 |
15 | whitelist ~/.warzone2100-3.1 | 14 | whitelist ~/.warzone2100-3.1 |
15 | #mkdir ~/.warzone2100-3.2 | ||
16 | whitelist ~/.warzone2100-3.2 | ||
16 | 17 | ||
17 | # Call these options | 18 | # Call these options |
18 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/wesnoth.profile b/etc/wesnoth.profile index 212466f5a..fbb381a86 100644 --- a/etc/wesnoth.profile +++ b/etc/wesnoth.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/wesnoth.local | |||
4 | 4 | ||
5 | # Whitelist-based profile for "Battle for Wesnoth" (game). | 5 | # Whitelist-based profile for "Battle for Wesnoth" (game). |
6 | noblacklist ${HOME}/.config/wesnoth | 6 | noblacklist ${HOME}/.config/wesnoth |
7 | noblacklist ${HOME}/.cache/wesnoth | ||
8 | noblacklist ${HOME}/.local/share/wesnoth | 7 | noblacklist ${HOME}/.local/share/wesnoth |
9 | 8 | ||
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -23,8 +22,6 @@ private-tmp | |||
23 | 22 | ||
24 | mkdir ${HOME}/.local/share/wesnoth | 23 | mkdir ${HOME}/.local/share/wesnoth |
25 | mkdir ${HOME}/.config/wesnoth | 24 | mkdir ${HOME}/.config/wesnoth |
26 | mkdir ${HOME}/.cache/wesnoth | ||
27 | whitelist ${HOME}/.local/share/wesnoth | 25 | whitelist ${HOME}/.local/share/wesnoth |
28 | whitelist ${HOME}/.config/wesnoth | 26 | whitelist ${HOME}/.config/wesnoth |
29 | whitelist ${HOME}/.cache/wesnoth | ||
30 | include /etc/firejail/whitelist-common.inc | 27 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc index cf7797100..516f47041 100644 --- a/etc/whitelist-common.inc +++ b/etc/whitelist-common.inc | |||
@@ -19,7 +19,6 @@ whitelist ~/.fonts.conf | |||
19 | whitelist ~/.fonts.conf.d | 19 | whitelist ~/.fonts.conf.d |
20 | whitelist ~/.local/share/fonts | 20 | whitelist ~/.local/share/fonts |
21 | whitelist ~/.config/fontconfig | 21 | whitelist ~/.config/fontconfig |
22 | whitelist ~/.cache/fontconfig | ||
23 | 22 | ||
24 | # gtk | 23 | # gtk |
25 | whitelist ~/.gtkrc | 24 | whitelist ~/.gtkrc |
diff --git a/etc/xreader.profile b/etc/xreader.profile index 2e6015aef..51dbcad51 100644 --- a/etc/xreader.profile +++ b/etc/xreader.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/xreader.local | |||
4 | 4 | ||
5 | # Xreader profile | 5 | # Xreader profile |
6 | noblacklist ~/.config/xreader | 6 | noblacklist ~/.config/xreader |
7 | noblacklist ~/.cache/xreader | ||
8 | noblacklist ~/.local/share | 7 | noblacklist ~/.local/share |
9 | 8 | ||
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
diff --git a/platform/debian/control b/platform/debian/control index 991abb656..4287d6561 100644 --- a/platform/debian/control +++ b/platform/debian/control | |||
@@ -4,6 +4,7 @@ Architecture: amd64 | |||
4 | Maintainer: netblue30 <netblue30@yahoo.com> | 4 | Maintainer: netblue30 <netblue30@yahoo.com> |
5 | Installed-Size: 272 | 5 | Installed-Size: 272 |
6 | Depends: libc6 | 6 | Depends: libc6 |
7 | Suggests: python, python3 | ||
7 | Section: admin | 8 | Section: admin |
8 | Priority: extra | 9 | Priority: extra |
9 | Homepage: http://github.com/netblue30/firejail | 10 | Homepage: http://github.com/netblue30/firejail |
@@ -17,4 +18,3 @@ Description: Linux namepaces sandbox program. | |||
17 | Firejail also expands the restricted shell facility found in bash by | 18 | Firejail also expands the restricted shell facility found in bash by |
18 | adding Linux namespace support. It also supports sandboxing SSH users | 19 | adding Linux namespace support. It also supports sandboxing SSH users |
19 | upon login. | 20 | upon login. |
20 | |||
diff --git a/platform/debian/copyright b/platform/debian/copyright index 4fd3a15d1..83952080f 100644 --- a/platform/debian/copyright +++ b/platform/debian/copyright | |||
@@ -7,7 +7,7 @@ This is the Debian/Ubuntu prepackaged version of firejail. | |||
7 | and networking stack isolation, and it runs on any recent Linux system. It | 7 | and networking stack isolation, and it runs on any recent Linux system. It |
8 | includes a sandbox profile for Mozilla Firefox. | 8 | includes a sandbox profile for Mozilla Firefox. |
9 | 9 | ||
10 | Copyright (C) 2014,2015 Firejail Authors (see README file for more details) | 10 | Copyright (C) 2014-2017 Firejail Authors (see README file for more details) |
11 | 11 | ||
12 | This program is free software; you can redistribute it and/or modify | 12 | This program is free software; you can redistribute it and/or modify |
13 | it under the terms of the GNU General Public License as published by | 13 | it under the terms of the GNU General Public License as published by |
@@ -27,4 +27,3 @@ The complete text of the GNU General Public License can be found | |||
27 | in /usr/share/common-licenses/GPL-2. | 27 | in /usr/share/common-licenses/GPL-2. |
28 | 28 | ||
29 | Homepage: http://github.com/netblue30/firejail. | 29 | Homepage: http://github.com/netblue30/firejail. |
30 | |||
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index fa6ba5c6a..f85560588 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -407,6 +407,7 @@ void fs_overlayfs(void); | |||
407 | // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf | 407 | // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf |
408 | void fs_chroot(const char *rootdir); | 408 | void fs_chroot(const char *rootdir); |
409 | void fs_check_chroot_dir(const char *rootdir); | 409 | void fs_check_chroot_dir(const char *rootdir); |
410 | void fs_cache(void); | ||
410 | 411 | ||
411 | // profile.c | 412 | // profile.c |
412 | // find and read the profile specified by name from dir directory | 413 | // find and read the profile specified by name from dir directory |
diff --git a/src/firejail/main.c b/src/firejail/main.c index aead29957..db9a9c8cb 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -2472,32 +2472,34 @@ int main(int argc, char **argv) { | |||
2472 | sprintf(ptr, "%d %d 1\n", gid, gid); | 2472 | sprintf(ptr, "%d %d 1\n", gid, gid); |
2473 | ptr += strlen(ptr); | 2473 | ptr += strlen(ptr); |
2474 | 2474 | ||
2475 | // add tty group | 2475 | if (!arg_nogroups) { |
2476 | gid_t g = get_group_id("tty"); | 2476 | // add tty group |
2477 | if (g) { | 2477 | gid_t g = get_group_id("tty"); |
2478 | sprintf(ptr, "%d %d 1\n", g, g); | 2478 | if (g) { |
2479 | ptr += strlen(ptr); | 2479 | sprintf(ptr, "%d %d 1\n", g, g); |
2480 | } | 2480 | ptr += strlen(ptr); |
2481 | 2481 | } | |
2482 | // add audio group | 2482 | |
2483 | g = get_group_id("audio"); | 2483 | // add audio group |
2484 | if (g) { | 2484 | g = get_group_id("audio"); |
2485 | sprintf(ptr, "%d %d 1\n", g, g); | 2485 | if (g) { |
2486 | ptr += strlen(ptr); | 2486 | sprintf(ptr, "%d %d 1\n", g, g); |
2487 | } | 2487 | ptr += strlen(ptr); |
2488 | 2488 | } | |
2489 | // add video group | 2489 | |
2490 | g = get_group_id("video"); | 2490 | // add video group |
2491 | if (g) { | 2491 | g = get_group_id("video"); |
2492 | sprintf(ptr, "%d %d 1\n", g, g); | 2492 | if (g) { |
2493 | ptr += strlen(ptr); | 2493 | sprintf(ptr, "%d %d 1\n", g, g); |
2494 | } | 2494 | ptr += strlen(ptr); |
2495 | 2495 | } | |
2496 | // add games group | 2496 | |
2497 | g = get_group_id("games"); | 2497 | // add games group |
2498 | if (g) { | 2498 | g = get_group_id("games"); |
2499 | sprintf(ptr, "%d %d 1\n", g, g); | 2499 | if (g) { |
2500 | } | 2500 | sprintf(ptr, "%d %d 1\n", g, g); |
2501 | } | ||
2502 | } | ||
2501 | 2503 | ||
2502 | EUID_ROOT(); | 2504 | EUID_ROOT(); |
2503 | update_map(gidmap, map_path); | 2505 | update_map(gidmap, map_path); |
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c index 774e2908f..f759e7333 100644 --- a/src/firejail/restrict_users.c +++ b/src/firejail/restrict_users.c | |||
@@ -167,7 +167,7 @@ static void sanitize_passwd(void) { | |||
167 | int rv = sscanf(ptr, "%d:", &uid); | 167 | int rv = sscanf(ptr, "%d:", &uid); |
168 | if (rv == 0 || uid < 0) | 168 | if (rv == 0 || uid < 0) |
169 | goto errout; | 169 | goto errout; |
170 | if (uid < UID_MIN) { | 170 | if (uid < UID_MIN || uid == 65534) { // on Debian platforms user nobody is 65534 |
171 | fprintf(fpout, "%s", buf); | 171 | fprintf(fpout, "%s", buf); |
172 | continue; | 172 | continue; |
173 | } | 173 | } |
@@ -299,7 +299,7 @@ static void sanitize_group(void) { | |||
299 | int rv = sscanf(ptr, "%d:", &gid); | 299 | int rv = sscanf(ptr, "%d:", &gid); |
300 | if (rv == 0 || gid < 0) | 300 | if (rv == 0 || gid < 0) |
301 | goto errout; | 301 | goto errout; |
302 | if (gid < GID_MIN) { | 302 | if (gid < GID_MIN || gid == 65534) { // on Debian platforms 65534 is group nogroup |
303 | if (copy_line(fpout, buf, ptr)) | 303 | if (copy_line(fpout, buf, ptr)) |
304 | goto errout; | 304 | goto errout; |
305 | continue; | 305 | continue; |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index f26f8b06a..d1557e8b2 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -742,6 +742,20 @@ int sandbox(void* sandbox_arg) { | |||
742 | else { | 742 | else { |
743 | // private-tmp is implemented as a whitelist | 743 | // private-tmp is implemented as a whitelist |
744 | EUID_USER(); | 744 | EUID_USER(); |
745 | // check XAUTHORITY file, KDE keeps it under /tmp | ||
746 | char *xauth = getenv("XAUTHORITY"); | ||
747 | if (xauth) { | ||
748 | char *rp = realpath(xauth, NULL); | ||
749 | if (rp && strncmp(rp, "/tmp/", 5) == 0) { | ||
750 | char *cmd; | ||
751 | if (asprintf(&cmd, "whitelist %s", rp) == -1) | ||
752 | errExit("asprintf"); | ||
753 | profile_add(cmd); // profile_add does not duplicate the string | ||
754 | } | ||
755 | if (rp) | ||
756 | free(rp); | ||
757 | } | ||
758 | // whitelist x11 directory | ||
745 | profile_add("whitelist /tmp/.X11-unix"); | 759 | profile_add("whitelist /tmp/.X11-unix"); |
746 | EUID_ROOT(); | 760 | EUID_ROOT(); |
747 | } | 761 | } |