diff options
96 files changed, 860 insertions, 595 deletions
@@ -2,11 +2,11 @@ Firejail is a SUID sandbox program that reduces the risk of security | |||
2 | breaches by restricting the running environment of untrusted applications | 2 | breaches by restricting the running environment of untrusted applications |
3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for | 3 | using Linux namespaces and seccomp-bpf. It includes sandbox profiles for |
4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, | 4 | Iceweasel/Mozilla Firefox, Chromium, Midori, Opera, Evince, Transmission, |
5 | VLC, Audoacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. | 5 | VLC, Audacious, Clementine, Rhythmbox, Totem, Deluge, qBittorrent. |
6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, | 6 | DeaDBeeF, Dropbox, Empathy, FileZilla, IceCat, Thunderbird/Icedove, |
7 | Pidgin, Quassel and XChat. | 7 | Pidgin, Quassel, and XChat. |
8 | 8 | ||
9 | Firejail also expands the restricted shell facility found in bash by adding | 9 | Firejail also expands the restricted shell facility found in bash by adding |
10 | Linux namespace support. It supports sandboxing specific users upon login. | 10 | Linux namespace support. It supports sandboxing specific users upon login. |
11 | 11 | ||
12 | Download: http://sourceforge.net/projects/firejail/files/ | 12 | Download: http://sourceforge.net/projects/firejail/files/ |
@@ -15,7 +15,9 @@ Documentation and support: https://firejail.wordpress.com/ | |||
15 | Development: https://github.com/netblue30/firejail | 15 | Development: https://github.com/netblue30/firejail |
16 | License: GPL v2 | 16 | License: GPL v2 |
17 | 17 | ||
18 | Compile and install | 18 | |
19 | |||
20 | Compile and install mainline version from GitHub: | ||
19 | 21 | ||
20 | $ git clone https://github.com/netblue30/firejail.git | 22 | $ git clone https://github.com/netblue30/firejail.git |
21 | $ cd firejail | 23 | $ cd firejail |
@@ -26,19 +28,23 @@ On Debian/Ubuntu you will need to install git and a compiler: | |||
26 | $ sudo apt-get install build-essential | 28 | $ sudo apt-get install build-essential |
27 | 29 | ||
28 | 30 | ||
29 | Firejail Authors: | ||
30 | 31 | ||
31 | netblue30 (netblue30@yahoo.com) | 32 | Maintainer: |
32 | Reiner Herrmann (https://github.com/reinerh) | 33 | - netblue30 (netblue30@yahoo.com) |
33 | - a number of build patches | 34 | |
34 | - man page fixes | 35 | Committers |
35 | - Debian and Ubuntu integration | 36 | - Fred-Barclay (https://github.com/Fred-Barclay) |
36 | - clang-analyzer fixes | 37 | - Reiner Herrmann (https://github.com/reinerh) |
37 | - Debian reproducible build | 38 | - netblue30 (netblue30@yahoo.com) |
38 | - unit testing framework | 39 | |
39 | - moved build to .xz | 40 | |
40 | - detached signatures for source archive | 41 | |
41 | - recursive mkdir | 42 | Firejail Authors (alphabetical order) |
43 | |||
44 | Akhil Hans Maulloo (https://github.com/kouul) | ||
45 | - xz profile | ||
46 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) | ||
47 | - src/lib/libnetlink.c extracted from iproute2 software package | ||
42 | Aleksey Manevich (https://github.com/manevich) | 48 | Aleksey Manevich (https://github.com/manevich) |
43 | - several profile fixes | 49 | - several profile fixes |
44 | - fix problem with relative path in storage_find function | 50 | - fix problem with relative path in storage_find function |
@@ -57,6 +63,80 @@ Aleksey Manevich (https://github.com/manevich) | |||
57 | - x11 xpra, xphyr, none profile commands | 63 | - x11 xpra, xphyr, none profile commands |
58 | - added --join-or-start command | 64 | - added --join-or-start command |
59 | - CVE-2016-7545 | 65 | - CVE-2016-7545 |
66 | Alexander Stein (https://github.com/ajstein) | ||
67 | - added profile for qutebrowser | ||
68 | Andrey Alekseenko (https://github.com/al42and) | ||
69 | - fixing lintian warnings | ||
70 | - fixed Skype profile | ||
71 | andrew160 (https://github.com/andrew160) | ||
72 | - profile and man pages fixes | ||
73 | Austin S. Hemmelgarn (https://github.com/Ferroin) | ||
74 | - unbound profile update | ||
75 | avoidr (https://github.com/avoidr) | ||
76 | - whitelist fix | ||
77 | - recently-used.xbel fix | ||
78 | - added parole profile | ||
79 | - blacklist ncat | ||
80 | - hostname support in profile file | ||
81 | - Google Chrome profile rework | ||
82 | - added cmus profile | ||
83 | - man page fixes | ||
84 | - add net iface support in profile files | ||
85 | - paths fix | ||
86 | - lots of profile fixes | ||
87 | - added mcabber profile | ||
88 | - fixed mpv profile | ||
89 | - various other fixes | ||
90 | Bader Zaidan (https://github.com/BaderSZ) | ||
91 | - Telegram profile | ||
92 | Benjamin Kampmann (https://github.com/ligthyear) | ||
93 | - Forward exit code from child process | ||
94 | BogDan Vatra (https://github.com/bog-dan-ro) | ||
95 | - zoom profile | ||
96 | Bruno Nova (https://github.com/brunonova) | ||
97 | - whitelist fix | ||
98 | - bash arguments fix | ||
99 | Cat (https://github.com/ecat3) | ||
100 | - prevent tmux connecting to an existing session | ||
101 | creideiki (https://github.com/creideiki) | ||
102 | - make the sandbox process reap all children | ||
103 | Christian Stadelmann (https://github.com/genodeftest) | ||
104 | - profile fixes | ||
105 | - evolution profile fix | ||
106 | curiosity-seeker (https://github.com/curiosity-seeker) | ||
107 | - tightening unbound and dnscrypt-proxy profiles | ||
108 | - correct and tighten QuiteRss profile | ||
109 | - dnsmasq profile | ||
110 | - okular and gwenview profiles | ||
111 | - cherrytree profile fixes | ||
112 | - added quiterss profile | ||
113 | - added guayadeque profile | ||
114 | - added VirtualBox.profile | ||
115 | - various other profile fixes | ||
116 | Daan Bakker (https://github.com/dbakker) | ||
117 | - protect shell startup files | ||
118 | Dara Adib (https://github.com/daradib) | ||
119 | - ssh profile fix | ||
120 | - evince profile fix | ||
121 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) | ||
122 | - added xpdf profile | ||
123 | dewbasaur (https://github.com/dewbasaur) | ||
124 | - block access to history files | ||
125 | - Firefox PDF.js exploit (CVE-2015-4495) fixes | ||
126 | - Steam profile | ||
127 | dshmgh (https://github.com/dshmgh) | ||
128 | - overlayfs fix for systems with /home mounted on a separate partition | ||
129 | Duncan Overbruck (https://github.com/Duncaen) | ||
130 | - musl libc fix | ||
131 | - utmp fix | ||
132 | emacsomancer (https://github.com/emacsomancer) | ||
133 | - added profile for Conkeror browser | ||
134 | eventyrer (https://github.com/eventyrer) | ||
135 | - update gnome-mplayer.profile | ||
136 | Felipe Barriga Richards (https://github.com/fbarriga) | ||
137 | - --private-etc fix | ||
138 | Franco (nextime) Lanza (https://github.com/nextime) | ||
139 | - added --private-template/--private-home | ||
60 | Fred-Barclay (https://github.com/Fred-Barclay) | 140 | Fred-Barclay (https://github.com/Fred-Barclay) |
61 | - lots of profile fixes | 141 | - lots of profile fixes |
62 | - added Vivaldi, Atril profiles | 142 | - added Vivaldi, Atril profiles |
@@ -99,169 +179,57 @@ Fred-Barclay (https://github.com/Fred-Barclay) | |||
99 | - compile/install scripts for --git-install/--git-uninstall commands | 179 | - compile/install scripts for --git-install/--git-uninstall commands |
100 | - tighten keepassx | 180 | - tighten keepassx |
101 | - added Thunar profile | 181 | - added Thunar profile |
102 | SYN-cook (https://github.com/SYN-cook) | 182 | G4JC (http://sourceforge.net/u/gaming4jc/profile/) |
103 | - keepass/keepassx browser fixes | 183 | - ARM support |
104 | - disable-common.inc fixes | ||
105 | - blacklist GNOME keyring and Konqueror | ||
106 | - fixed Keepass(x) profiles | ||
107 | - Engrampa profile | ||
108 | - Scribus profile | ||
109 | valoq (https://github.com/valoq) | ||
110 | - lots of profile fixes | ||
111 | - added support for /srv in --whitelist feature | ||
112 | - Eye of GNOME, Evolution, display (imagemagik) and Wire profiles | ||
113 | - blacklist suid binaries in disable-common.inc | ||
114 | - fix man pages | ||
115 | - added keypass2, qemu profiles | ||
116 | - added amarok, ark, atool, bleachbit, brasero, dolphin, dragon, elinks, enchant, exiftool profiles | ||
117 | - added file-roller, gedit, gjs,gnome-books, gnome-documents, gnome-maps, gnome-music profiles | ||
118 | - added gnome-photos, gnome-weather, goobox, gpa, gpg, gpg-agent, highlight profiles | ||
119 | - added img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, simple-scan profiles | ||
120 | - added skanlite, ssh-agent, transmission-cli, tracker, transmission-show, w3m, xfburn, xpra profiles | ||
121 | - added wget profile | ||
122 | - disable gnupg and systemd directories under /run/user | ||
123 | - added iridium browser profile | ||
124 | Zack Weinberg (https://github.com/zackw) | ||
125 | - removed libconnect | ||
126 | - fixed memory corruption in noblacklist processing | ||
127 | - rework DISPLAY environment parsing | ||
128 | - rework masking X11 sockets in /tmp/.X11-unix directory | ||
129 | - rework xpra and xephyr detection | ||
130 | - rework abstract X11 socket detection | ||
131 | - rework X11 display number assignment | ||
132 | - rework X11 xorg processing | ||
133 | - rework fcopy, --follow-link support in fcopy | ||
134 | - follow link support in --private-bin | ||
135 | - wait_for_other function rewrite | ||
136 | - xvfb X11 server support | ||
137 | Austin S. Hemmelgarn (https://github.com/Ferroin) | ||
138 | - unbound profile update | ||
139 | Igor Bukanov (https://github.com/ibukanov) | ||
140 | - found/fiixed privilege escalation in --hosts-file option | ||
141 | Cat (https://github.com/ecat3) | ||
142 | - prevent tmux connecting to an existing session | ||
143 | Zack Weinberg (https://github.com/zackw) | ||
144 | - sdded support for joining a persistent, named network namespace | ||
145 | GSI (https://github.com/GSI) | ||
146 | - added Uzbl browser profile | ||
147 | Mike Frysinger (vapier@gentoo.org) | ||
148 | - Gentoo compile patch | ||
149 | Jericho (https://github.com/attritionorg) | ||
150 | - spelling | ||
151 | Pixel Fairy (https://github.com/xahare) | ||
152 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section | ||
153 | pshpsh (https://github.com/pshpsh) | ||
154 | - added FossaMail profile | ||
155 | eventyrer (https://github.com/eventyrer) | ||
156 | - update gnome-mplayer.profile | ||
157 | thewisenerd (https://github.com/thewisenerd) | ||
158 | - allow multiple private-home commands | ||
159 | - use $SHELL variable if the shell is not specified | ||
160 | thewisenerd (https://github.com/thewisenerd) | ||
161 | - appimage: pass commandline arguments | ||
162 | KOLANICH (https://github.com/KOLANICH) | ||
163 | - added symlink fixer fix_private-bin.py in contrib section | ||
164 | Jesse Smith (https://github.com/slicer69) | ||
165 | - added QupZilla profile | ||
166 | Lari Rauno (https://github.com/tuutti) | ||
167 | - qutebrowser profile fixes | ||
168 | SpotComms (https://github.com/SpotComms) | ||
169 | - added Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5 profiles | ||
170 | - added PDFSam, Pithos, and Xonotic profiles | ||
171 | Vasya Novikov (https://github.com/vn971) | ||
172 | - Wesnoth profile | ||
173 | - Hedegewars profile | ||
174 | - manpage fixes | ||
175 | - fixed firecfg clean/clear issue | ||
176 | - found the ugliest bug so far | ||
177 | - seccomp debug description in man page | ||
178 | curiosity-seeker (https://github.com/curiosity-seeker) | ||
179 | - tightening unbound and dnscrypt-proxy profiles | ||
180 | - correct and tighten QuiteRss profile | ||
181 | - dnsmasq profile | ||
182 | - okular and gwenview profiles | ||
183 | - cherrytree profile fixes | ||
184 | - added quiterss profile | ||
185 | - added guayadeque profile | ||
186 | - added VirtualBox.profile | ||
187 | - various other profile fixes | ||
188 | Simon Peter (https://github.com/probonopd) | ||
189 | - set $APPIMAGE and $APPDIR environment variables | ||
190 | - AppImage version detection | ||
191 | - Leafppad type v1 and v2 appimage packages in test/appimage | ||
192 | BogDan Vatra (https://github.com/bog-dan-ro) | ||
193 | - zoom profile | ||
194 | Impyy (https://github.com/Impyy) | ||
195 | - added mumble profile | ||
196 | Vadim A. Misbakh-Soloviov (https://github.com/msva) | ||
197 | - profile fixes | 184 | - profile fixes |
198 | Rafael Cavalcanti (https://github.com/rccavalcanti) | 185 | Gaman Gabriel (https://github.com/stelariusinfinitek) |
199 | - chromium profile fixes for Arch Linux | 186 | - inox profile |
200 | Deelvesh Bunjun (https://github.com/DeelveshBunjun) | 187 | geg2048 (https://github.com/geg2048) |
201 | - added xpdf profile | 188 | - kwallet profile fixes |
202 | Dara Adib (https://github.com/daradib) | ||
203 | - ssh profile fix | ||
204 | - evince profile fix | ||
205 | vismir2 (https://github.com/vismir2) | ||
206 | - feh, ranger, 7z, keepass, keepassx and zathura profiles | ||
207 | - claws-mail, mutt, git, emacs, vim profiles | ||
208 | - lots of profile fixes | ||
209 | - support for truecrypt and zuluCrypt | ||
210 | graywolf (https://github.com/graywolf) | 189 | graywolf (https://github.com/graywolf) |
211 | - spelling fix | 190 | - spelling fix |
212 | Tomasz Jan Góralczyk (https://github.com/tjg) | ||
213 | - fixed Steam profile | ||
214 | pwnage-pineapple (https://github.com/pwnage-pineapple) | ||
215 | - update Okular profile | ||
216 | Sergey Alirzaev (https://github.com/l29ah) | ||
217 | - firejail.h enum fix | ||
218 | greigdp (https://github.com/greigdp) | 191 | greigdp (https://github.com/greigdp) |
219 | - Gajim IM client profile | 192 | - Gajim IM client profile |
220 | - fix Slack profile | 193 | - fixed spotify profile |
194 | - added Slack profile | ||
195 | - add Spotify profile | ||
196 | GSI (https://github.com/GSI) | ||
197 | - added Uzbl browser profile | ||
198 | hamzadis (https://github.com/hamzadis) | ||
199 | - added --overlay-named=name and --overlay-path=path | ||
200 | Holger Heinz (https://github.com/hheinz) | ||
201 | - manpage work | ||
221 | Icaro Perseo (https://github.com/icaroperseo) | 202 | Icaro Perseo (https://github.com/icaroperseo) |
222 | - Icecat profile | 203 | - Icecat profile |
223 | - several profile fixes | 204 | - several profile fixes |
224 | hamzadis (https://github.com/hamzadis) | 205 | Igor Bukanov (https://github.com/ibukanov) |
225 | - added --overlay-named=name and --overlay-path=path | 206 | - found/fiixed privilege escalation in --hosts-file option |
226 | Gaman Gabriel (https://github.com/stelariusinfinitek) | 207 | iiotx (https://github.com/iiotx) |
227 | - inox profile | 208 | - use generic.profile by default |
228 | greigdp (https://github.com/greigdp) | 209 | Impyy (https://github.com/Impyy) |
229 | - fixed spotify profile | 210 | - added mumble profile |
230 | - added Slack profile | 211 | Ivan Kozik (https://github.com/ivan) |
231 | Laurent Declercq (https://github.com/nuxwin) | 212 | - speed up sandbox exit |
232 | - fixed test for shell interpreter in chroots | ||
233 | Franco (nextime) Lanza (https://github.com/nextime) | ||
234 | - added --private-template/--private-home | ||
235 | xee5ch (https://github.com/xee5ch) | ||
236 | - skypeforlinux profile | ||
237 | Peter Hogg (https://github.com/pigmonkey) | ||
238 | - WeeChat profile | ||
239 | - rtorrent profile | ||
240 | - bitlbee profile fixes | ||
241 | - mutt profile fixes | ||
242 | Thomas Jarosch (https://github.com/thomasjfox) | ||
243 | - disable keepassx in disable-passwdmgr.inc | ||
244 | - added uudeview profile | ||
245 | - added tar (gtar), unzip and unrar profile | ||
246 | - added file profile | ||
247 | - improved profile list | ||
248 | - fixed small variable glitch in stat64() / lstat64() (libtracelog) | ||
249 | - added lstat() / lstat64() support to libtrace | ||
250 | - include mkuid.sh in make dist | ||
251 | Niklas Haas (https://github.com/haasn) | ||
252 | - blacklisting for keybase.io's client | ||
253 | Jaykishan Mutkawoa (https://github.com/jmutkawoa) | 213 | Jaykishan Mutkawoa (https://github.com/jmutkawoa) |
254 | - cpio profile | 214 | - cpio profile |
255 | Paupiah Yash (https://github.com/CaffeinatedStud) | 215 | Jericho (https://github.com/attritionorg) |
256 | - gzip profile | 216 | - spelling |
257 | Akhil Hans Maulloo (https://github.com/kouul) | 217 | Jesse Smith (https://github.com/slicer69) |
258 | - xz profile | 218 | - added QupZilla profile |
259 | Rahul Golam (https://github.com/technoLord) | 219 | jgriffiths (https://github.com/jgriffiths) |
260 | - strings profile | 220 | - make rpm packages support |
261 | geg2048 (https://github.com/geg2048) | 221 | Joan Figueras (https://github.com/figue) |
262 | - kwallet profile fixes | 222 | - added abrowser profile |
263 | maces (https://github.com/maces) | 223 | - added Google-Play-Music-Desktop-Player |
264 | - Franz messenger profile | 224 | - added cyberfox profile |
225 | jrabe (https://github.com/jrabe) | ||
226 | - disallow access to kdbx files | ||
227 | - Epiphany profile | ||
228 | - Polari profile | ||
229 | - qTox profile | ||
230 | - X11 fixes | ||
231 | Kaan Genç (https://github.com/SeriousBug) | ||
232 | - dynamic allocation of noblacklist buffer | ||
265 | KellerFuchs (https://github.com/KellerFuchs) | 233 | KellerFuchs (https://github.com/KellerFuchs) |
266 | - nonewpriv support, extended profiles for this feature | 234 | - nonewpriv support, extended profiles for this feature |
267 | - make `restricted-network` prevent use of netfilter | 235 | - make `restricted-network` prevent use of netfilter |
@@ -270,116 +238,45 @@ KellerFuchs (https://github.com/KellerFuchs) | |||
270 | - added support for .local profile files in /etc/firejail | 238 | - added support for .local profile files in /etc/firejail |
271 | - fixed Cryptocat profile | 239 | - fixed Cryptocat profile |
272 | - make ~/.local read-only | 240 | - make ~/.local read-only |
273 | ValdikSS (https://github.com/ValdikSS) | 241 | KOLANICH (https://github.com/KOLANICH) |
274 | - Psi+, Corebird, Konversation profiles | 242 | - added symlink fixer fix_private-bin.py in contrib section |
275 | - various profile fixes | 243 | Lari Rauno (https://github.com/tuutti) |
276 | avoidr (https://github.com/avoidr) | 244 | - qutebrowser profile fixes |
277 | - whitelist fix | 245 | Laurent Declercq (https://github.com/nuxwin) |
278 | - recently-used.xbel fix | 246 | - fixed test for shell interpreter in chroots |
279 | - added parole profile | 247 | Loïc Damien (https://github.com/dzamlo) |
280 | - blacklist ncat | 248 | - small fixes |
281 | - hostname support in profile file | 249 | maces (https://github.com/maces) |
282 | - Google Chrome profile rework | 250 | - Franz messenger profile |
283 | - added cmus profile | ||
284 | - man page fixes | ||
285 | - add net iface support in profile files | ||
286 | - paths fix | ||
287 | - lots of profile fixes | ||
288 | - added mcabber profile | ||
289 | - fixed mpv profile | ||
290 | - various other fixes | ||
291 | Ruan (https://github.com/ruany) | ||
292 | - fixed hexchat profile | ||
293 | Matthew Gyurgyik (https://github.com/pyther) | ||
294 | - rpm spec and several fixes | ||
295 | Joan Figueras (https://github.com/figue) | ||
296 | - added abrowser profile | ||
297 | - added Google-Play-Music-Desktop-Player | ||
298 | - added cyberfox profile | ||
299 | Petter Reinholdtsen (pere@hungry.com) | ||
300 | - Opera profile patch | ||
301 | n1trux (https://github.com/n1trux) | ||
302 | - fix flashpeak-slimjet profile typos | ||
303 | Felipe Barriga Richards (https://github.com/fbarriga) | ||
304 | - --private-etc fix | ||
305 | Alexander Stein (https://github.com/ajstein) | ||
306 | - added profile for qutebrowser | ||
307 | Benjamin Kampmann (https://github.com/ligthyear) | ||
308 | - Forward exit code from child process | ||
309 | dshmgh (https://github.com/dshmgh) | ||
310 | - overlayfs fix for systems with /home mounted on a separate partition | ||
311 | yumkam (https://github.com/yumkam) | ||
312 | - add compile-time option to restrict --net= to root only | ||
313 | - man page fixes | ||
314 | mahdi1234 (https://github.com/mahdi1234) | 251 | mahdi1234 (https://github.com/mahdi1234) |
315 | - cherrytree profile | 252 | - cherrytree profile |
316 | - Seamonkey profiles | 253 | - Seamonkey profiles |
317 | jrabe (https://github.com/jrabe) | ||
318 | - disallow access to kdbx files | ||
319 | - Epiphany profile | ||
320 | - Polari profile | ||
321 | - qTox profile | ||
322 | - X11 fixes | ||
323 | jgriffiths (https://github.com/jgriffiths) | ||
324 | - make rpm packages support | ||
325 | Tom Mellor (https://github.com/kalegrill) | ||
326 | - mupen64plus profile | ||
327 | Martin Carpenter (https://github.com/mcarpenter) | 254 | Martin Carpenter (https://github.com/mcarpenter) |
328 | - security audit and bug fixes | 255 | - security audit and bug fixes |
329 | - Centos 6.x support | 256 | - Centos 6.x support |
330 | pszxzsd (https://github.com/pszxzsd) | ||
331 | -uGet profile | ||
332 | Rahiel Kasim (https://github.com/rahiel) | ||
333 | - Mathematica profile | ||
334 | - whitelisted Dropbox profile | ||
335 | - whitelisted keysnail config for firefox | ||
336 | creideiki (https://github.com/creideiki) | ||
337 | - make the sandbox process reap all children | ||
338 | sinkuu (https://github.com/sinkuu) | ||
339 | - blacklisting kwalletd | ||
340 | - fix symlink invocation for programs placing symlinks in $PATH | ||
341 | Bader Zaidan (https://github.com/BaderSZ) | ||
342 | - Telegram profile | ||
343 | Holger Heinz (https://github.com/hheinz) | ||
344 | - manpage work | ||
345 | Andrey Alekseenko (https://github.com/al42and) | ||
346 | - fixing lintian warnings | ||
347 | - fixed Skype profile | ||
348 | Ivan Kozik (https://github.com/ivan) | ||
349 | - speed up sandbox exit | ||
350 | Christian Stadelmann (https://github.com/genodeftest) | ||
351 | - profile fixes | ||
352 | - evolution profile fix | ||
353 | pirate486743186 (https://github.com/pirate486743186) | ||
354 | - KMail profile | ||
355 | Kaan Genç (https://github.com/SeriousBug) | ||
356 | - dynamic allocation of noblacklist buffer | ||
357 | Veeti Paananen (https://github.com/veeti) | ||
358 | - fixed Spotify profile | ||
359 | rogshdo (https://github.com/rogshdo) | ||
360 | - BitlBee profile | ||
361 | Bruno Nova (https://github.com/brunonova) | ||
362 | - whitelist fix | ||
363 | - bash arguments fix | ||
364 | Matt Parnell (https://github.com/ilikenwf) | 257 | Matt Parnell (https://github.com/ilikenwf) |
365 | - whitelisting for core firefox related functionality | 258 | - whitelisting for core firefox related functionality |
366 | Ondra Nekola (https://github.com/satai) | ||
367 | - allow firefox theming with non-global themes | ||
368 | emacsomancer (https://github.com/emacsomancer) | ||
369 | - added profile for Conkeror browser | ||
370 | Daan Bakker (https://github.com/dbakker) | ||
371 | - protect shell startup files | ||
372 | Duncan Overbruck (https://github.com/Duncaen) | ||
373 | - musl libc fix | ||
374 | - utmp fix | ||
375 | andrew160 (https://github.com/andrew160) | ||
376 | - profile and man pages fixes | ||
377 | Loïc Damien (https://github.com/dzamlo) | ||
378 | - small fixes | ||
379 | greigdp (https://github.com/greigdp) | ||
380 | - add Spotify profile | ||
381 | Mattias Wadman (https://github.com/wader) | 259 | Mattias Wadman (https://github.com/wader) |
382 | - seccomp errno filter support | 260 | - seccomp errno filter support |
261 | Matthew Gyurgyik (https://github.com/pyther) | ||
262 | - rpm spec and several fixes | ||
263 | Michael Haas (https://github.com/mhaas) | ||
264 | - bugfixes | ||
265 | Mike Frysinger (vapier@gentoo.org) | ||
266 | - Gentoo compile patch | ||
267 | mjudtmann (https://github.com/mjudtmann) | ||
268 | - lock firejail configuration in disable-mgmt.inc | ||
269 | n1trux (https://github.com/n1trux) | ||
270 | - fix flashpeak-slimjet profile typos | ||
271 | netblue30 (netblue30@yahoo.com) | ||
272 | Niklas Haas (https://github.com/haasn) | ||
273 | - blacklisting for keybase.io's client | ||
274 | Ondra Nekola (https://github.com/satai) | ||
275 | - allow firefox theming with non-global themes | ||
276 | Patrick Toomey (http://sourceforge.net/u/ptoomey/profile/) | ||
277 | - user namespace implementation | ||
278 | Paupiah Yash (https://github.com/CaffeinatedStud) | ||
279 | - gzip profile | ||
383 | Peter Millerchip (https://github.com/pmillerchip) | 280 | Peter Millerchip (https://github.com/pmillerchip) |
384 | - memory allocation fix | 281 | - memory allocation fix |
385 | - --private.keep to --private-home transition | 282 | - --private.keep to --private-home transition |
@@ -387,30 +284,146 @@ Peter Millerchip (https://github.com/pmillerchip) | |||
387 | - support for files and directories with spaces in blacklist option | 284 | - support for files and directories with spaces in blacklist option |
388 | - lots of other fixes | 285 | - lots of other fixes |
389 | - implement the --allow-private-blacklist option | 286 | - implement the --allow-private-blacklist option |
287 | Peter Hogg (https://github.com/pigmonkey) | ||
288 | - WeeChat profile | ||
289 | - rtorrent profile | ||
290 | - bitlbee profile fixes | ||
291 | - mutt profile fixes | ||
292 | Petter Reinholdtsen (pere@hungry.com) | ||
293 | - Opera profile patch | ||
294 | pirate486743186 (https://github.com/pirate486743186) | ||
295 | - KMail profile | ||
296 | Pixel Fairy (https://github.com/xahare) | ||
297 | - added fjclip.py, fjdisplay.py and fjresize.py in contrib section | ||
298 | pshpsh (https://github.com/pshpsh) | ||
299 | - added FossaMail profile | ||
300 | pstn (https://github.com/pstn) | ||
301 | - added install-strip, make install without strip | ||
302 | pszxzsd (https://github.com/pszxzsd) | ||
303 | -uGet profile | ||
304 | pwnage-pineapple (https://github.com/pwnage-pineapple) | ||
305 | - update Okular profile | ||
306 | Rafael Cavalcanti (https://github.com/rccavalcanti) | ||
307 | - chromium profile fixes for Arch Linux | ||
308 | Rahiel Kasim (https://github.com/rahiel) | ||
309 | - Mathematica profile | ||
310 | - whitelisted Dropbox profile | ||
311 | - whitelisted keysnail config for firefox | ||
312 | Rahul Golam (https://github.com/technoLord) | ||
313 | - strings profile | ||
314 | Reiner Herrmann (https://github.com/reinerh) | ||
315 | - a number of build patches | ||
316 | - man page fixes | ||
317 | - Debian and Ubuntu integration | ||
318 | - clang-analyzer fixes | ||
319 | - Debian reproducible build | ||
320 | - unit testing framework | ||
321 | - moved build to .xz | ||
322 | - detached signatures for source archive | ||
323 | - recursive mkdir | ||
324 | rogshdo (https://github.com/rogshdo) | ||
325 | - BitlBee profile | ||
326 | Ruan (https://github.com/ruany) | ||
327 | - fixed hexchat profile | ||
390 | sarneaud (https://github.com/sarneaud) | 328 | sarneaud (https://github.com/sarneaud) |
391 | - rewrite globbing code to fix various minor issues | 329 | - rewrite globbing code to fix various minor issues |
392 | - added noblacklist command for profile files | 330 | - added noblacklist command for profile files |
393 | - various enhancements and bug fixes | 331 | - various enhancements and bug fixes |
394 | Patrick Toomey (http://sourceforge.net/u/ptoomey/profile/) | 332 | Sergey Alirzaev (https://github.com/l29ah) |
395 | - user namespace implementation | 333 | - firejail.h enum fix |
334 | Simon Peter (https://github.com/probonopd) | ||
335 | - set $APPIMAGE and $APPDIR environment variables | ||
336 | - AppImage version detection | ||
337 | - Leafppad type v1 and v2 appimage packages in test/appimage | ||
338 | sinkuu (https://github.com/sinkuu) | ||
339 | - blacklisting kwalletd | ||
340 | - fix symlink invocation for programs placing symlinks in $PATH | ||
396 | sshirokov (http://sourceforge.net/u/yshirokov/profile/) | 341 | sshirokov (http://sourceforge.net/u/yshirokov/profile/) |
397 | - Patch to output "Reading profile" to stderr instead of stdout | 342 | - Patch to output "Reading profile" to stderr instead of stdout |
398 | G4JC (http://sourceforge.net/u/gaming4jc/profile/) | 343 | SpotComms (https://github.com/SpotComms) |
399 | - ARM support | 344 | - added Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5 profiles |
345 | - added PDFSam, Pithos, and Xonotic profiles | ||
346 | SYN-cook (https://github.com/SYN-cook) | ||
347 | - keepass/keepassx browser fixes | ||
348 | - disable-common.inc fixes | ||
349 | - blacklist GNOME keyring and Konqueror | ||
350 | - fixed Keepass(x) profiles | ||
351 | - Engrampa profile | ||
352 | - Scribus profile | ||
353 | - autostart blacklist for KDE | ||
354 | - blacklist startup scripts | ||
355 | startx2017 (https://github.com/startx2017) | ||
356 | - syscall list update | ||
357 | - enable/disable join support in /etc/firejail/firejail.config | ||
358 | thewisenerd (https://github.com/thewisenerd) | ||
359 | - allow multiple private-home commands | ||
360 | - use $SHELL variable if the shell is not specified | ||
361 | - appimage: pass commandline arguments | ||
362 | Thomas Jarosch (https://github.com/thomasjfox) | ||
363 | - disable keepassx in disable-passwdmgr.inc | ||
364 | - added uudeview profile | ||
365 | - added tar (gtar), unzip and unrar profile | ||
366 | - added file profile | ||
367 | - improved profile list | ||
368 | - fixed small variable glitch in stat64() / lstat64() (libtracelog) | ||
369 | - added lstat() / lstat64() support to libtrace | ||
370 | - include mkuid.sh in make dist | ||
371 | Tom Mellor (https://github.com/kalegrill) | ||
372 | - mupen64plus profile | ||
373 | Tomasz Jan Góralczyk (https://github.com/tjg) | ||
374 | - fixed Steam profile | ||
375 | valoq (https://github.com/valoq) | ||
376 | - lots of profile fixes | ||
377 | - added support for /srv in --whitelist feature | ||
378 | - Eye of GNOME, Evolution, display (imagemagik) and Wire profiles | ||
379 | - blacklist suid binaries in disable-common.inc | ||
380 | - fix man pages | ||
381 | - added keypass2, qemu profiles | ||
382 | - added amarok, ark, atool, bleachbit, brasero, dolphin, dragon, elinks, enchant, exiftool profiles | ||
383 | - added file-roller, gedit, gjs,gnome-books, gnome-documents, gnome-maps, gnome-music profiles | ||
384 | - added gnome-photos, gnome-weather, goobox, gpa, gpg, gpg-agent, highlight profiles | ||
385 | - added img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, simple-scan profiles | ||
386 | - added skanlite, ssh-agent, transmission-cli, tracker, transmission-show, w3m, xfburn, xpra profiles | ||
387 | - added wget profile | ||
388 | - disable gnupg and systemd directories under /run/user | ||
389 | - added iridium browser profile | ||
390 | Vadim A. Misbakh-Soloviov (https://github.com/msva) | ||
400 | - profile fixes | 391 | - profile fixes |
401 | dewbasaur (https://github.com/dewbasaur) | 392 | ValdikSS (https://github.com/ValdikSS) |
402 | - block access to history files | 393 | - Psi+, Corebird, Konversation profiles |
403 | - Firefox PDF.js exploit (CVE-2015-4495) fixes | 394 | - various profile fixes |
404 | - Steam profile | 395 | Vasya Novikov (https://github.com/vn971) |
405 | Michael Haas (https://github.com/mhaas) | 396 | - Wesnoth profile |
406 | - bugfixes | 397 | - Hedegewars profile |
407 | mjudtmann (https://github.com/mjudtmann) | 398 | - manpage fixes |
408 | - lock firejail configuration in disable-mgmt.inc | 399 | - fixed firecfg clean/clear issue |
409 | iiotx (https://github.com/iiotx) | 400 | - found the ugliest bug so far |
410 | - use generic.profile by default | 401 | - seccomp debug description in man page |
411 | pstn (https://github.com/pstn) | 402 | Veeti Paananen (https://github.com/veeti) |
412 | - added install-strip, make install without strip | 403 | - fixed Spotify profile |
413 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) | 404 | vismir2 (https://github.com/vismir2) |
414 | - src/lib/libnetlink.c extracted from iproute2 software package | 405 | - feh, ranger, 7z, keepass, keepassx and zathura profiles |
415 | 406 | - claws-mail, mutt, git, emacs, vim profiles | |
407 | - lots of profile fixes | ||
408 | - support for truecrypt and zuluCrypt | ||
409 | xee5ch (https://github.com/xee5ch) | ||
410 | - skypeforlinux profile | ||
411 | yumkam (https://github.com/yumkam) | ||
412 | - add compile-time option to restrict --net= to root only | ||
413 | - man page fixes | ||
414 | Zack Weinberg (https://github.com/zackw) | ||
415 | - added support for joining a persistent, named network namespace | ||
416 | - removed libconnect | ||
417 | - fixed memory corruption in noblacklist processing | ||
418 | - rework DISPLAY environment parsing | ||
419 | - rework masking X11 sockets in /tmp/.X11-unix directory | ||
420 | - rework xpra and xephyr detection | ||
421 | - rework abstract X11 socket detection | ||
422 | - rework X11 display number assignment | ||
423 | - rework X11 xorg processing | ||
424 | - rework fcopy, --follow-link support in fcopy | ||
425 | - follow link support in --private-bin | ||
426 | - wait_for_other function rewrite | ||
427 | - xvfb X11 server support | ||
428 | |||
416 | Copyright (C) 2014-2017 Firejail Authors | 429 | Copyright (C) 2014-2017 Firejail Authors |
@@ -58,7 +58,7 @@ If you keep your Firejail profiles in a public repository, please give us a link | |||
58 | 58 | ||
59 | * https://github.com/triceratops1/fe | 59 | * https://github.com/triceratops1/fe |
60 | 60 | ||
61 | Use this issue to request new profiles: https://github.com/netblue30/firejail/issues/825 | 61 | Use this issue to request new profiles: https://github.com/netblue30/firejail/issues/1139 |
62 | ````` | 62 | ````` |
63 | 63 | ||
64 | ````` | 64 | ````` |
@@ -195,4 +195,4 @@ goobox, gpa, gpg, gpg-agent, highlight, img2txt, k3b, kate, lynx, mediainfo, nau | |||
195 | simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget, | 195 | simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget, |
196 | xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5, | 196 | xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5, |
197 | PDFSam, Pithos, Xonotic, wireshark, keepassx2, QupZilla, FossaMail, Uzbl browser, xmms, iridium browser, | 197 | PDFSam, Pithos, Xonotic, wireshark, keepassx2, QupZilla, FossaMail, Uzbl browser, xmms, iridium browser, |
198 | Kino, Thunar, Geeqie, Engrampa, Scribus | 198 | Kino, Thunar, Geeqie, Engrampa, Scribus, mousepad |
@@ -26,7 +26,7 @@ firejail (0.9.45) baseline; urgency=low | |||
26 | * feature: AppImage type 2 support | 26 | * feature: AppImage type 2 support |
27 | * feature: pass command line arguments to appimages | 27 | * feature: pass command line arguments to appimages |
28 | * feature: allow non-seccomp setup for OverlayFS sandboxes - more work to come | 28 | * feature: allow non-seccomp setup for OverlayFS sandboxes - more work to come |
29 | * feature: added a number o Python scripts for handling sandboxes | 29 | * feature: added a number of Python scripts for handling sandboxes |
30 | * feature: allow local customization using .local files under /etc/firejail | 30 | * feature: allow local customization using .local files under /etc/firejail |
31 | * feature: follow-symlink-as-user runtime config option in /etc/firejail/firejail.config | 31 | * feature: follow-symlink-as-user runtime config option in /etc/firejail/firejail.config |
32 | * feature: follow-symlink-private-bin option in /etc/firejail/firejail.config | 32 | * feature: follow-symlink-private-bin option in /etc/firejail/firejail.config |
@@ -34,16 +34,14 @@ firejail (0.9.45) baseline; urgency=low | |||
34 | * feature: allow /tmp directory in mkdir and mkfile profile commands | 34 | * feature: allow /tmp directory in mkdir and mkfile profile commands |
35 | * feature: implemented --noblacklist command, profile support | 35 | * feature: implemented --noblacklist command, profile support |
36 | * feature: config support to disable access to /mnt and /media (disable-mnt) | 36 | * feature: config support to disable access to /mnt and /media (disable-mnt) |
37 | * feature: allow tmpfs for regular users for files in home directory | 37 | * feature: config support to disable join (join) |
38 | * feature: mount a tmpfs on top of ~/.cache directory by default | ||
39 | * feature: config support to disable tmpfs mounting on ~/.cache (cache-tmpfs) | ||
40 | * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire, | 38 | * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire, |
41 | * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma, | 39 | * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma, |
42 | * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator, | 40 | * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator, |
43 | * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos, | 41 | * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos, |
44 | * new profies: Xonotic, wireshark, keepassx2, QupZilla, FossaMail, | 42 | * new profies: Xonotic, wireshark, keepassx2, QupZilla, FossaMail, |
45 | * new profiles: Uzbl browser, iridium browser, Thunar, Geeqie, Engrampa | 43 | * new profiles: Uzbl browser, iridium browser, Thunar, Geeqie, Engrampa |
46 | * new profiles: Scribus | 44 | * new profiles: Scribus, mousepad |
47 | * bugfixes | 45 | * bugfixes |
48 | -- netblue30 <netblue30@yahoo.com> Sun, 23 Oct 2016 08:00:00 -0500 | 46 | -- netblue30 <netblue30@yahoo.com> Sun, 23 Oct 2016 08:00:00 -0500 |
49 | 47 | ||
diff --git a/etc/0ad.profile b/etc/0ad.profile index 84addc229..d4f06f732 100644 --- a/etc/0ad.profile +++ b/etc/0ad.profile | |||
@@ -3,7 +3,6 @@ | |||
3 | include /etc/firejail/0ad.local | 3 | include /etc/firejail/0ad.local |
4 | 4 | ||
5 | # Firejail profile for 0ad. | 5 | # Firejail profile for 0ad. |
6 | noblacklist ~/.cache/0ad | ||
7 | noblacklist ~/.config/0ad | 6 | noblacklist ~/.config/0ad |
8 | noblacklist ~/.local/share/0ad | 7 | noblacklist ~/.local/share/0ad |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
@@ -12,9 +11,6 @@ include /etc/firejail/disable-passwdmgr.inc | |||
12 | include /etc/firejail/disable-programs.inc | 11 | include /etc/firejail/disable-programs.inc |
13 | 12 | ||
14 | # Whitelists | 13 | # Whitelists |
15 | mkdir ~/.cache/0ad | ||
16 | whitelist ~/.cache/0ad | ||
17 | |||
18 | mkdir ~/.config/0ad | 14 | mkdir ~/.config/0ad |
19 | whitelist ~/.config/0ad | 15 | whitelist ~/.config/0ad |
20 | 16 | ||
diff --git a/etc/abrowser.profile b/etc/abrowser.profile index b9a30d6bf..3b60750d5 100644 --- a/etc/abrowser.profile +++ b/etc/abrowser.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/abrowser.local | |||
4 | 4 | ||
5 | # Firejail profile for Abrowser | 5 | # Firejail profile for Abrowser |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.mozilla | 22 | mkdir ~/.mozilla |
24 | whitelist ~/.mozilla | 23 | whitelist ~/.mozilla |
25 | mkdir ~/.cache/mozilla/abrowser | ||
26 | whitelist ~/.cache/mozilla/abrowser | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | 34 | ||
diff --git a/etc/chromium.profile b/etc/chromium.profile index 995c0001b..ce823e0db 100644 --- a/etc/chromium.profile +++ b/etc/chromium.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/chromium.local | |||
4 | 4 | ||
5 | # Chromium browser profile | 5 | # Chromium browser profile |
6 | noblacklist ~/.config/chromium | 6 | noblacklist ~/.config/chromium |
7 | noblacklist ~/.cache/chromium | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/chromium | 18 | mkdir ~/.config/chromium |
20 | whitelist ~/.config/chromium | 19 | whitelist ~/.config/chromium |
21 | mkdir ~/.cache/chromium | ||
22 | whitelist ~/.cache/chromium | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | 22 | ||
diff --git a/etc/cyberfox.profile b/etc/cyberfox.profile index a79303f77..d9896e4a7 100644 --- a/etc/cyberfox.profile +++ b/etc/cyberfox.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/cyberfox.local | |||
4 | 4 | ||
5 | # Firejail profile for Cyberfox (based on Mozilla Firefox) | 5 | # Firejail profile for Cyberfox (based on Mozilla Firefox) |
6 | noblacklist ~/.8pecxstudios | 6 | noblacklist ~/.8pecxstudios |
7 | noblacklist ~/.cache/8pecxstudios | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.8pecxstudios | 22 | mkdir ~/.8pecxstudios |
24 | whitelist ~/.8pecxstudios | 23 | whitelist ~/.8pecxstudios |
25 | mkdir ~/.cache/8pecxstudios | ||
26 | whitelist ~/.cache/8pecxstudios | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | 34 | ||
diff --git a/etc/disable-common.inc b/etc/disable-common.inc index ae15a3f63..78b41371a 100644 --- a/etc/disable-common.inc +++ b/etc/disable-common.inc | |||
@@ -1,4 +1,4 @@ | |||
1 | # This file is overwritten during software install. | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/disable-common.local | 3 | include /etc/firejail/disable-common.local |
4 | 4 | ||
@@ -236,6 +236,7 @@ blacklist ${PATH}/pantheon-terminal | |||
236 | blacklist ${PATH}/roxterm | 236 | blacklist ${PATH}/roxterm |
237 | blacklist ${PATH}/roxterm-config | 237 | blacklist ${PATH}/roxterm-config |
238 | blacklist ${PATH}/terminix | 238 | blacklist ${PATH}/terminix |
239 | blacklist ${PATH}/tilix | ||
239 | blacklist ${PATH}/urxvtc | 240 | blacklist ${PATH}/urxvtc |
240 | blacklist ${PATH}/urxvtcd | 241 | blacklist ${PATH}/urxvtcd |
241 | #konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 | 242 | #konsole doesn't seem to have this problem - last tested on Ubuntu 16.04 |
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc index c60333a00..39a8ed4f5 100644 --- a/etc/disable-programs.inc +++ b/etc/disable-programs.inc | |||
@@ -1,4 +1,4 @@ | |||
1 | # This file is overwritten during software install. | 1 | # This file is overwritten during software install. |
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/disable-programs.local | 3 | include /etc/firejail/disable-programs.local |
4 | 4 | ||
@@ -17,44 +17,6 @@ blacklist ${HOME}/.arduino15 | |||
17 | blacklist ${HOME}/.atom | 17 | blacklist ${HOME}/.atom |
18 | blacklist ${HOME}/.audacity-data | 18 | blacklist ${HOME}/.audacity-data |
19 | blacklist ${HOME}/.bcast5 | 19 | blacklist ${HOME}/.bcast5 |
20 | blacklist ${HOME}/.cache/0ad | ||
21 | blacklist ${HOME}/.cache/8pecxstudios | ||
22 | blacklist ${HOME}/.cache/Franz | ||
23 | blacklist ${HOME}/.cache/INRIA | ||
24 | blacklist ${HOME}/.cache/QuiteRss | ||
25 | blacklist ${HOME}/.cache/champlain | ||
26 | blacklist ${HOME}/.cache/chromium | ||
27 | blacklist ${HOME}/.cache/qupzilla | ||
28 | blacklist ${HOME}/.cache/chromium-dev | ||
29 | blacklist ${HOME}/.cache/darktable | ||
30 | blacklist ${HOME}/.cache/epiphany | ||
31 | blacklist ${HOME}/.cache/evolution | ||
32 | blacklist ${HOME}/.cache/gajim | ||
33 | blacklist ${HOME}/.cache/geeqie | ||
34 | blacklist ${HOME}/.cache/google-chrome | ||
35 | blacklist ${HOME}/.cache/google-chrome-beta | ||
36 | blacklist ${HOME}/.cache/google-chrome-unstable | ||
37 | blacklist ${HOME}/.cache/icedove | ||
38 | blacklist ${HOME}/.cache/inox | ||
39 | blacklist ${HOME}/.cache/libgweather | ||
40 | blacklist ${HOME}/.cache/midori | ||
41 | blacklist ${HOME}/.cache/mozilla | ||
42 | blacklist ${HOME}/.cache/mutt | ||
43 | blacklist ${HOME}/.cache/netsurf | ||
44 | blacklist ${HOME}/.cache/opera | ||
45 | blacklist ${HOME}/.cache/opera-beta | ||
46 | blacklist ${HOME}/.cache/org.gnome.Books | ||
47 | blacklist ${HOME}/.cache/qutebrowser | ||
48 | blacklist ${HOME}/.cache/simple-scan | ||
49 | blacklist ${HOME}/.cache/slimjet | ||
50 | blacklist ${HOME}/.cache/spotify | ||
51 | blacklist ${HOME}/.cache/telepathy | ||
52 | blacklist ${HOME}/.cache/thunderbird | ||
53 | blacklist ${HOME}/.cache/torbrowser | ||
54 | blacklist ${HOME}/.cache/transmission | ||
55 | blacklist ${HOME}/.cache/vivaldi | ||
56 | blacklist ${HOME}/.cache/wesnoth | ||
57 | blacklist ${HOME}/.cache/xreader | ||
58 | blacklist ${HOME}/.claws-mail | 20 | blacklist ${HOME}/.claws-mail |
59 | blacklist ${HOME}/.config/0ad | 21 | blacklist ${HOME}/.config/0ad |
60 | blacklist ${HOME}/.config/Atom | 22 | blacklist ${HOME}/.config/Atom |
@@ -68,6 +30,7 @@ blacklist ${HOME}/.config/Gpredict | |||
68 | blacklist ${HOME}/.config/INRIA | 30 | blacklist ${HOME}/.config/INRIA |
69 | blacklist ${HOME}/.config/Luminance | 31 | blacklist ${HOME}/.config/Luminance |
70 | blacklist ${HOME}/.config/Meltytech | 32 | blacklist ${HOME}/.config/Meltytech |
33 | blacklist ${HOME}/.config/Mousepad | ||
71 | blacklist ${HOME}/.config/Mumble | 34 | blacklist ${HOME}/.config/Mumble |
72 | blacklist ${HOME}/.config/QuiteRss | 35 | blacklist ${HOME}/.config/QuiteRss |
73 | blacklist ${HOME}/.config/QuiteRssrc | 36 | blacklist ${HOME}/.config/QuiteRssrc |
@@ -283,7 +246,7 @@ blacklist ${HOME}/.thunderbird | |||
283 | blacklist ${HOME}/.ts3client | 246 | blacklist ${HOME}/.ts3client |
284 | blacklist ${HOME}/.vst | 247 | blacklist ${HOME}/.vst |
285 | blacklist ${HOME}/.w3m | 248 | blacklist ${HOME}/.w3m |
286 | blacklist ${HOME}/.warzone2100-3.1 | 249 | blacklist ${HOME}/.warzone2100-3.* |
287 | blacklist ${HOME}/.weechat | 250 | blacklist ${HOME}/.weechat |
288 | blacklist ${HOME}/.wine | 251 | blacklist ${HOME}/.wine |
289 | blacklist ${HOME}/.wine64 | 252 | blacklist ${HOME}/.wine64 |
diff --git a/etc/epiphany.profile b/etc/epiphany.profile index 1bf259440..0b281c448 100644 --- a/etc/epiphany.profile +++ b/etc/epiphany.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/epiphany.local | |||
4 | 4 | ||
5 | # Epiphany browser profile | 5 | # Epiphany browser profile |
6 | noblacklist ${HOME}/.config/epiphany | 6 | noblacklist ${HOME}/.config/epiphany |
7 | noblacklist ${HOME}/.cache/epiphany | ||
8 | noblacklist ${HOME}/.local/share/epiphany | 7 | noblacklist ${HOME}/.local/share/epiphany |
9 | 8 | ||
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -16,8 +15,6 @@ mkdir ${HOME}/.local/share/epiphany | |||
16 | whitelist ${HOME}/.local/share/epiphany | 15 | whitelist ${HOME}/.local/share/epiphany |
17 | mkdir ${HOME}/.config/epiphany | 16 | mkdir ${HOME}/.config/epiphany |
18 | whitelist ${HOME}/.config/epiphany | 17 | whitelist ${HOME}/.config/epiphany |
19 | mkdir ${HOME}/.cache/epiphany | ||
20 | whitelist ${HOME}/.cache/epiphany | ||
21 | include /etc/firejail/whitelist-common.inc | 18 | include /etc/firejail/whitelist-common.inc |
22 | 19 | ||
23 | caps.drop all | 20 | caps.drop all |
diff --git a/etc/evolution.profile b/etc/evolution.profile index cb6615716..637ac334a 100644 --- a/etc/evolution.profile +++ b/etc/evolution.profile | |||
@@ -5,7 +5,6 @@ include /etc/firejail/evolution.local | |||
5 | # evolution profile | 5 | # evolution profile |
6 | noblacklist ~/.config/evolution | 6 | noblacklist ~/.config/evolution |
7 | noblacklist ~/.local/share/evolution | 7 | noblacklist ~/.local/share/evolution |
8 | noblacklist ~/.cache/evolution | ||
9 | noblacklist ~/.pki | 8 | noblacklist ~/.pki |
10 | noblacklist ~/.pki/nssdb | 9 | noblacklist ~/.pki/nssdb |
11 | noblacklist ~/.gnupg | 10 | noblacklist ~/.gnupg |
diff --git a/etc/firefox.profile b/etc/firefox.profile index e2cfb9138..20acde62a 100644 --- a/etc/firefox.profile +++ b/etc/firefox.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/firefox.local | |||
4 | 4 | ||
5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) | 5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.config/qpdfview | 7 | noblacklist ~/.config/qpdfview |
9 | noblacklist ~/.local/share/qpdfview | 8 | noblacklist ~/.local/share/qpdfview |
10 | noblacklist ~/.kde/share/apps/okular | 9 | noblacklist ~/.kde/share/apps/okular |
@@ -25,8 +24,6 @@ tracelog | |||
25 | whitelist ${DOWNLOADS} | 24 | whitelist ${DOWNLOADS} |
26 | mkdir ~/.mozilla | 25 | mkdir ~/.mozilla |
27 | whitelist ~/.mozilla | 26 | whitelist ~/.mozilla |
28 | mkdir ~/.cache/mozilla/firefox | ||
29 | whitelist ~/.cache/mozilla/firefox | ||
30 | whitelist ~/dwhelper | 27 | whitelist ~/dwhelper |
31 | whitelist ~/.zotero | 28 | whitelist ~/.zotero |
32 | whitelist ~/.vimperatorrc | 29 | whitelist ~/.vimperatorrc |
@@ -35,7 +32,6 @@ whitelist ~/.pentadactylrc | |||
35 | whitelist ~/.pentadactyl | 32 | whitelist ~/.pentadactyl |
36 | whitelist ~/.keysnail.js | 33 | whitelist ~/.keysnail.js |
37 | whitelist ~/.config/gnome-mplayer | 34 | whitelist ~/.config/gnome-mplayer |
38 | whitelist ~/.cache/gnome-mplayer/plugin | ||
39 | mkdir ~/.pki | 35 | mkdir ~/.pki |
40 | whitelist ~/.pki | 36 | whitelist ~/.pki |
41 | whitelist ~/.lastpass | 37 | whitelist ~/.lastpass |
@@ -55,4 +51,4 @@ include /etc/firejail/whitelist-common.inc | |||
55 | #private-bin firefox,which,sh,dbus-launch,dbus-send,env | 51 | #private-bin firefox,which,sh,dbus-launch,dbus-send,env |
56 | #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse | 52 | #private-etc passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse |
57 | private-dev | 53 | private-dev |
58 | #private-tmp | 54 | private-tmp |
diff --git a/etc/firejail.config b/etc/firejail.config index 0887e05b5..121f2dd74 100644 --- a/etc/firejail.config +++ b/etc/firejail.config | |||
@@ -43,6 +43,10 @@ | |||
43 | # that is partially under their control. Default disabled. | 43 | # that is partially under their control. Default disabled. |
44 | # force-nonewprivs no | 44 | # force-nonewprivs no |
45 | 45 | ||
46 | # Allow sandbox joining as a regular user, default enabled. | ||
47 | # root user can always join sandboxes. | ||
48 | # join yes | ||
49 | |||
46 | # Enable or disable networking features, default enabled. | 50 | # Enable or disable networking features, default enabled. |
47 | # network yes | 51 | # network yes |
48 | 52 | ||
@@ -99,3 +103,13 @@ | |||
99 | # Xephyr command extra parameters. None by default; these are examples. | 103 | # Xephyr command extra parameters. None by default; these are examples. |
100 | # xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev | 104 | # xephyr-extra-params -keybd ephyr,,,xkbmodel=evdev |
101 | # xephyr-extra-params -grayscale | 105 | # xephyr-extra-params -grayscale |
106 | |||
107 | # Screen size for --x11=xvfb, default 800x600x24. The third dimension is | ||
108 | # color depth; use 24 unless you know exactly what you're doing. | ||
109 | # xvfb-screen 640x480x24 | ||
110 | # xvfb-screen 800x600x24 | ||
111 | # xvfb-screen 1024x768x24 | ||
112 | # xvfb-screen 1280x1024x24 | ||
113 | |||
114 | # Xvfb command extra parameters. None by default; this is an example. | ||
115 | # xvfb-extra-params -pixdepths 8 24 32 | ||
diff --git a/etc/flashpeak-slimjet.profile b/etc/flashpeak-slimjet.profile index 4dc5b5cfc..a35aa7a33 100644 --- a/etc/flashpeak-slimjet.profile +++ b/etc/flashpeak-slimjet.profile | |||
@@ -10,7 +10,6 @@ include /etc/firejail/flashpeak-slimjet.local | |||
10 | # firejail flashpeak-slimjet --no-sandbox | 10 | # firejail flashpeak-slimjet --no-sandbox |
11 | # | 11 | # |
12 | noblacklist ~/.config/slimjet | 12 | noblacklist ~/.config/slimjet |
13 | noblacklist ~/.cache/slimjet | ||
14 | noblacklist ~/.pki | 13 | noblacklist ~/.pki |
15 | include /etc/firejail/disable-common.inc | 14 | include /etc/firejail/disable-common.inc |
16 | include /etc/firejail/disable-programs.inc | 15 | include /etc/firejail/disable-programs.inc |
@@ -29,8 +28,6 @@ seccomp | |||
29 | whitelist ${DOWNLOADS} | 28 | whitelist ${DOWNLOADS} |
30 | mkdir ~/.config/slimjet | 29 | mkdir ~/.config/slimjet |
31 | whitelist ~/.config/slimjet | 30 | whitelist ~/.config/slimjet |
32 | mkdir ~/.cache/slimjet | ||
33 | whitelist ~/.cache/slimjet | ||
34 | mkdir ~/.pki | 31 | mkdir ~/.pki |
35 | whitelist ~/.pki | 32 | whitelist ~/.pki |
36 | 33 | ||
diff --git a/etc/fossamail.profile b/etc/fossamail.profile index 3caaad71c..a33514c88 100644 --- a/etc/fossamail.profile +++ b/etc/fossamail.profile | |||
@@ -12,8 +12,5 @@ noblacklist ~/.fossamail | |||
12 | mkdir ~/.fossamail | 12 | mkdir ~/.fossamail |
13 | whitelist ~/.fossamail | 13 | whitelist ~/.fossamail |
14 | 14 | ||
15 | noblacklist ~/.cache/fossamail | ||
16 | mkdir ~/.cache/fossamail | ||
17 | whitelist ~/.cache/fossamail | ||
18 | 15 | ||
19 | include /etc/firejail/firefox.profile | 16 | include /etc/firejail/firefox.profile |
diff --git a/etc/franz.profile b/etc/franz.profile index 05ff72a47..1692f4516 100644 --- a/etc/franz.profile +++ b/etc/franz.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/franz.local | |||
4 | 4 | ||
5 | # Franz profile | 5 | # Franz profile |
6 | noblacklist ~/.config/Franz | 6 | noblacklist ~/.config/Franz |
7 | noblacklist ~/.cache/Franz | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -21,8 +20,6 @@ seccomp | |||
21 | whitelist ${DOWNLOADS} | 20 | whitelist ${DOWNLOADS} |
22 | mkdir ~/.config/Franz | 21 | mkdir ~/.config/Franz |
23 | whitelist ~/.config/Franz | 22 | whitelist ~/.config/Franz |
24 | mkdir ~/.cache/Franz | ||
25 | whitelist ~/.cache/Franz | ||
26 | mkdir ~/.pki | 23 | mkdir ~/.pki |
27 | whitelist ~/.pki | 24 | whitelist ~/.pki |
28 | 25 | ||
diff --git a/etc/gajim.profile b/etc/gajim.profile index bac6cc466..f64d9241a 100644 --- a/etc/gajim.profile +++ b/etc/gajim.profile | |||
@@ -3,11 +3,9 @@ | |||
3 | include /etc/firejail/gajim.local | 3 | include /etc/firejail/gajim.local |
4 | 4 | ||
5 | # Firejail profile for Gajim | 5 | # Firejail profile for Gajim |
6 | noblacklist ${HOME}/.cache/gajim | ||
7 | noblacklist ${HOME}/.local/share/gajim | 6 | noblacklist ${HOME}/.local/share/gajim |
8 | noblacklist ${HOME}/.config/gajim | 7 | noblacklist ${HOME}/.config/gajim |
9 | 8 | ||
10 | mkdir ${HOME}/.cache/gajim | ||
11 | mkdir ${HOME}/.local/share/gajim | 9 | mkdir ${HOME}/.local/share/gajim |
12 | mkdir ${HOME}/.config/gajim | 10 | mkdir ${HOME}/.config/gajim |
13 | mkdir ${HOME}/Downloads | 11 | mkdir ${HOME}/Downloads |
@@ -17,7 +15,6 @@ mkdir ${HOME}/.local/lib/python2.7/site-packages/ | |||
17 | whitelist ${HOME}/.local/lib/python2.7/site-packages/ | 15 | whitelist ${HOME}/.local/lib/python2.7/site-packages/ |
18 | read-only ${HOME}/.local/lib/python2.7/site-packages/ | 16 | read-only ${HOME}/.local/lib/python2.7/site-packages/ |
19 | 17 | ||
20 | whitelist ${HOME}/.cache/gajim | ||
21 | whitelist ${HOME}/.local/share/gajim | 18 | whitelist ${HOME}/.local/share/gajim |
22 | whitelist ${HOME}/.config/gajim | 19 | whitelist ${HOME}/.config/gajim |
23 | whitelist ${HOME}/Downloads | 20 | whitelist ${HOME}/Downloads |
diff --git a/etc/geeqie.profile b/etc/geeqie.profile index 57f942a50..9f79e15b8 100644 --- a/etc/geeqie.profile +++ b/etc/geeqie.profile | |||
@@ -3,7 +3,6 @@ | |||
3 | include /etc/firejail/geeqie.local | 3 | include /etc/firejail/geeqie.local |
4 | 4 | ||
5 | # Firejail profile for Geeqie | 5 | # Firejail profile for Geeqie |
6 | noblacklist ~/.cache/geeqie | ||
7 | noblacklist ~/.config/geeqie | 6 | noblacklist ~/.config/geeqie |
8 | noblacklist ~/.local/share/geeqie | 7 | noblacklist ~/.local/share/geeqie |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
diff --git a/etc/gjs.profile b/etc/gjs.profile index 24ec70e86..03dd7893c 100644 --- a/etc/gjs.profile +++ b/etc/gjs.profile | |||
@@ -6,10 +6,8 @@ include /etc/firejail/gjs.local | |||
6 | 6 | ||
7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them | 7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them |
8 | 8 | ||
9 | noblacklist ~/.cache/org.gnome.Books | ||
10 | noblacklist ~/.config/libreoffice | 9 | noblacklist ~/.config/libreoffice |
11 | noblacklist ~/.local/share/gnome-photos | 10 | noblacklist ~/.local/share/gnome-photos |
12 | noblacklist ~/.cache/libgweather | ||
13 | 11 | ||
14 | include /etc/firejail/disable-common.inc | 12 | include /etc/firejail/disable-common.inc |
15 | include /etc/firejail/disable-programs.inc | 13 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/gnome-books.profile b/etc/gnome-books.profile index 692e32896..bf2a9f36f 100644 --- a/etc/gnome-books.profile +++ b/etc/gnome-books.profile | |||
@@ -6,8 +6,6 @@ include /etc/firejail/gnome-books.local | |||
6 | 6 | ||
7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them | 7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them |
8 | 8 | ||
9 | noblacklist ~/.cache/org.gnome.Books | ||
10 | |||
11 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-programs.inc | 10 | include /etc/firejail/disable-programs.inc |
13 | include /etc/firejail/disable-devel.inc | 11 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/gnome-weather.profile b/etc/gnome-weather.profile index 925420a5a..3b6bdd130 100644 --- a/etc/gnome-weather.profile +++ b/etc/gnome-weather.profile | |||
@@ -6,8 +6,6 @@ include /etc/firejail/gnome-weather.local | |||
6 | 6 | ||
7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them | 7 | # when gjs apps are started via gnome-shell, firejail is not applied because systemd will start them |
8 | 8 | ||
9 | noblacklist ~/.cache/libgweather | ||
10 | |||
11 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
12 | include /etc/firejail/disable-programs.inc | 10 | include /etc/firejail/disable-programs.inc |
13 | include /etc/firejail/disable-devel.inc | 11 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/google-chrome-beta.profile b/etc/google-chrome-beta.profile index 3bd16de4a..65bc42648 100644 --- a/etc/google-chrome-beta.profile +++ b/etc/google-chrome-beta.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/google-chrome-beta.local | |||
4 | 4 | ||
5 | # Google Chrome beta browser profile | 5 | # Google Chrome beta browser profile |
6 | noblacklist ~/.config/google-chrome-beta | 6 | noblacklist ~/.config/google-chrome-beta |
7 | noblacklist ~/.cache/google-chrome-beta | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/google-chrome-beta | 18 | mkdir ~/.config/google-chrome-beta |
20 | whitelist ~/.config/google-chrome-beta | 19 | whitelist ~/.config/google-chrome-beta |
21 | mkdir ~/.cache/google-chrome-beta | ||
22 | whitelist ~/.cache/google-chrome-beta | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/google-chrome-unstable.profile b/etc/google-chrome-unstable.profile index d2def4f96..6f6fa1bf2 100644 --- a/etc/google-chrome-unstable.profile +++ b/etc/google-chrome-unstable.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/google-chrome-unstable.local | |||
4 | 4 | ||
5 | # Google Chrome unstable browser profile | 5 | # Google Chrome unstable browser profile |
6 | noblacklist ~/.config/google-chrome-unstable | 6 | noblacklist ~/.config/google-chrome-unstable |
7 | noblacklist ~/.cache/google-chrome-unstable | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/google-chrome-unstable | 18 | mkdir ~/.config/google-chrome-unstable |
20 | whitelist ~/.config/google-chrome-unstable | 19 | whitelist ~/.config/google-chrome-unstable |
21 | mkdir ~/.cache/google-chrome-unstable | ||
22 | whitelist ~/.cache/google-chrome-unstable | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/google-chrome.profile b/etc/google-chrome.profile index 38feb12a5..131538dd9 100644 --- a/etc/google-chrome.profile +++ b/etc/google-chrome.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/google-chrome.local | |||
4 | 4 | ||
5 | # Google Chrome browser profile | 5 | # Google Chrome browser profile |
6 | noblacklist ~/.config/google-chrome | 6 | noblacklist ~/.config/google-chrome |
7 | noblacklist ~/.cache/google-chrome | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -18,8 +17,6 @@ netfilter | |||
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | mkdir ~/.config/google-chrome | 18 | mkdir ~/.config/google-chrome |
20 | whitelist ~/.config/google-chrome | 19 | whitelist ~/.config/google-chrome |
21 | mkdir ~/.cache/google-chrome | ||
22 | whitelist ~/.cache/google-chrome | ||
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
24 | whitelist ~/.pki | 21 | whitelist ~/.pki |
25 | include /etc/firejail/whitelist-common.inc | 22 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/icecat.profile b/etc/icecat.profile index 64401efe8..4bd3f3047 100644 --- a/etc/icecat.profile +++ b/etc/icecat.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/icecat.local | |||
4 | 4 | ||
5 | # Firejail profile for GNU Icecat | 5 | # Firejail profile for GNU Icecat |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.mozilla | 22 | mkdir ~/.mozilla |
24 | whitelist ~/.mozilla | 23 | whitelist ~/.mozilla |
25 | mkdir ~/.cache/mozilla/icecat | ||
26 | whitelist ~/.cache/mozilla/icecat | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | 34 | ||
diff --git a/etc/icedove.profile b/etc/icedove.profile index b5265e992..aae0e3bf5 100644 --- a/etc/icedove.profile +++ b/etc/icedove.profile | |||
@@ -14,10 +14,6 @@ noblacklist ~/.icedove | |||
14 | mkdir ~/.icedove | 14 | mkdir ~/.icedove |
15 | whitelist ~/.icedove | 15 | whitelist ~/.icedove |
16 | 16 | ||
17 | noblacklist ~/.cache/icedove | ||
18 | mkdir ~/.cache/icedove | ||
19 | whitelist ~/.cache/icedove | ||
20 | |||
21 | # allow browsers | 17 | # allow browsers |
22 | ignore private-tmp | 18 | ignore private-tmp |
23 | include /etc/firejail/firefox.profile | 19 | include /etc/firejail/firefox.profile |
diff --git a/etc/inox.profile b/etc/inox.profile index 0b2e4ee5e..6043ded8a 100644 --- a/etc/inox.profile +++ b/etc/inox.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/inox.local | |||
4 | 4 | ||
5 | # Inox browser profile | 5 | # Inox browser profile |
6 | noblacklist ~/.config/inox | 6 | noblacklist ~/.config/inox |
7 | noblacklist ~/.cache/inox | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -14,8 +13,6 @@ netfilter | |||
14 | whitelist ${DOWNLOADS} | 13 | whitelist ${DOWNLOADS} |
15 | mkdir ~/.config/inox | 14 | mkdir ~/.config/inox |
16 | whitelist ~/.config/inox | 15 | whitelist ~/.config/inox |
17 | mkdir ~/.cache/inox | ||
18 | whitelist ~/.cache/inox | ||
19 | mkdir ~/.pki | 16 | mkdir ~/.pki |
20 | whitelist ~/.pki | 17 | whitelist ~/.pki |
21 | 18 | ||
diff --git a/etc/iridium.profile b/etc/iridium.profile index 2d79a3935..dcbd0b84b 100644 --- a/etc/iridium.profile +++ b/etc/iridium.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/iridium.local | |||
4 | 4 | ||
5 | # Iridium browser profile | 5 | # Iridium browser profile |
6 | noblacklist ~/.config/iridium | 6 | noblacklist ~/.config/iridium |
7 | noblacklist ~/.cache/iridium | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | 9 | ||
@@ -17,8 +16,6 @@ netfilter | |||
17 | whitelist ${DOWNLOADS} | 16 | whitelist ${DOWNLOADS} |
18 | mkdir ~/.config/iridium | 17 | mkdir ~/.config/iridium |
19 | whitelist ~/.config/iridium | 18 | whitelist ~/.config/iridium |
20 | mkdir ~/.cache/iridium | ||
21 | whitelist ~/.cache/iridium | ||
22 | mkdir ~/.pki | 19 | mkdir ~/.pki |
23 | whitelist ~/.pki | 20 | whitelist ~/.pki |
24 | 21 | ||
diff --git a/etc/mousepad.profile b/etc/mousepad.profile new file mode 100644 index 000000000..3901c8a0e --- /dev/null +++ b/etc/mousepad.profile | |||
@@ -0,0 +1,26 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include /etc/firejail/mousepad.local | ||
4 | |||
5 | # Firejail profile for mousepad | ||
6 | noblacklist ~/.config/Mousepad | ||
7 | |||
8 | include /etc/firejail/disable-common.inc | ||
9 | include /etc/firejail/disable-programs.inc | ||
10 | include /etc/firejail/disable-devel.inc | ||
11 | include /etc/firejail/disable-passwdmgr.inc | ||
12 | |||
13 | caps.drop all | ||
14 | netfilter | ||
15 | nogroups | ||
16 | nonewprivs | ||
17 | noroot | ||
18 | nosound | ||
19 | protocol unix | ||
20 | seccomp | ||
21 | shell none | ||
22 | tracelog | ||
23 | |||
24 | private-bin mousepad | ||
25 | private-dev | ||
26 | private-tmp | ||
diff --git a/etc/mutt.profile b/etc/mutt.profile index 2f0809f02..f9d537779 100644 --- a/etc/mutt.profile +++ b/etc/mutt.profile | |||
@@ -14,7 +14,6 @@ noblacklist ~/mail | |||
14 | noblacklist ~/Mail | 14 | noblacklist ~/Mail |
15 | noblacklist ~/sent | 15 | noblacklist ~/sent |
16 | noblacklist ~/postponed | 16 | noblacklist ~/postponed |
17 | noblacklist ~/.cache/mutt | ||
18 | noblacklist ~/.w3m | 17 | noblacklist ~/.w3m |
19 | noblacklist ~/.elinks | 18 | noblacklist ~/.elinks |
20 | noblacklist ~/.vim | 19 | noblacklist ~/.vim |
diff --git a/etc/netsurf.profile b/etc/netsurf.profile index c217346de..a3c360c1e 100644 --- a/etc/netsurf.profile +++ b/etc/netsurf.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/netsurf.local | |||
4 | 4 | ||
5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) | 5 | # Firejail profile for Mozilla Firefox (Iceweasel in Debian) |
6 | noblacklist ~/.config/netsurf | 6 | noblacklist ~/.config/netsurf |
7 | noblacklist ~/.cache/netsurf | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -20,7 +19,5 @@ tracelog | |||
20 | whitelist ${DOWNLOADS} | 19 | whitelist ${DOWNLOADS} |
21 | mkdir ~/.config/netsurf | 20 | mkdir ~/.config/netsurf |
22 | whitelist ~/.config/netsurf | 21 | whitelist ~/.config/netsurf |
23 | mkdir ~/.cache/netsurf | ||
24 | whitelist ~/.cache/netsurf | ||
25 | 22 | ||
26 | include /etc/firejail/whitelist-common.inc | 23 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/opera-beta.profile b/etc/opera-beta.profile index 92624f334..5a0d54744 100644 --- a/etc/opera-beta.profile +++ b/etc/opera-beta.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/opera-beta.local | |||
4 | 4 | ||
5 | # Opera-beta browser profile | 5 | # Opera-beta browser profile |
6 | noblacklist ~/.config/opera-beta | 6 | noblacklist ~/.config/opera-beta |
7 | noblacklist ~/.cache/opera-beta | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -15,8 +14,6 @@ netfilter | |||
15 | whitelist ${DOWNLOADS} | 14 | whitelist ${DOWNLOADS} |
16 | mkdir ~/.config/opera-beta | 15 | mkdir ~/.config/opera-beta |
17 | whitelist ~/.config/opera-beta | 16 | whitelist ~/.config/opera-beta |
18 | mkdir ~/.cache/opera-beta | ||
19 | whitelist ~/.cache/opera-beta | ||
20 | mkdir ~/.pki | 17 | mkdir ~/.pki |
21 | whitelist ~/.pki | 18 | whitelist ~/.pki |
22 | include /etc/firejail/whitelist-common.inc | 19 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/opera.profile b/etc/opera.profile index 57835f2f2..4af502060 100644 --- a/etc/opera.profile +++ b/etc/opera.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/opera.local | |||
4 | 4 | ||
5 | # Opera browser profile | 5 | # Opera browser profile |
6 | noblacklist ~/.config/opera | 6 | noblacklist ~/.config/opera |
7 | noblacklist ~/.cache/opera | ||
8 | noblacklist ~/.opera | 7 | noblacklist ~/.opera |
9 | noblacklist ~/.pki | 8 | noblacklist ~/.pki |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -16,8 +15,6 @@ netfilter | |||
16 | whitelist ${DOWNLOADS} | 15 | whitelist ${DOWNLOADS} |
17 | mkdir ~/.config/opera | 16 | mkdir ~/.config/opera |
18 | whitelist ~/.config/opera | 17 | whitelist ~/.config/opera |
19 | mkdir ~/.cache/opera | ||
20 | whitelist ~/.cache/opera | ||
21 | mkdir ~/.opera | 18 | mkdir ~/.opera |
22 | whitelist ~/.opera | 19 | whitelist ~/.opera |
23 | mkdir ~/.pki | 20 | mkdir ~/.pki |
diff --git a/etc/palemoon.profile b/etc/palemoon.profile index 8cac00e03..472d58cee 100644 --- a/etc/palemoon.profile +++ b/etc/palemoon.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/palemoon.local | |||
4 | 4 | ||
5 | # Firejail profile for Pale Moon | 5 | # Firejail profile for Pale Moon |
6 | noblacklist ~/.moonchild productions/pale moon | 6 | noblacklist ~/.moonchild productions/pale moon |
7 | noblacklist ~/.cache/moonchild productions/pale moon | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -13,8 +12,6 @@ include /etc/firejail/whitelist-common.inc | |||
13 | whitelist ${DOWNLOADS} | 12 | whitelist ${DOWNLOADS} |
14 | mkdir ~/.moonchild productions | 13 | mkdir ~/.moonchild productions |
15 | whitelist ~/.moonchild productions | 14 | whitelist ~/.moonchild productions |
16 | mkdir ~/.cache/moonchild productions/pale moon | ||
17 | whitelist ~/.cache/moonchild productions/pale moon | ||
18 | 15 | ||
19 | caps.drop all | 16 | caps.drop all |
20 | netfilter | 17 | netfilter |
@@ -40,7 +37,6 @@ private-tmp | |||
40 | #whitelist ~/.pentadactyl | 37 | #whitelist ~/.pentadactyl |
41 | #whitelist ~/.keysnail.js | 38 | #whitelist ~/.keysnail.js |
42 | #whitelist ~/.config/gnome-mplayer | 39 | #whitelist ~/.config/gnome-mplayer |
43 | #whitelist ~/.cache/gnome-mplayer/plugin | ||
44 | #whitelist ~/.pki | 40 | #whitelist ~/.pki |
45 | #whitelist ~/.lastpass | 41 | #whitelist ~/.lastpass |
46 | 42 | ||
diff --git a/etc/polari.profile b/etc/polari.profile index 834a8b3d6..52a58322e 100644 --- a/etc/polari.profile +++ b/etc/polari.profile | |||
@@ -15,8 +15,6 @@ mkdir ${HOME}/.local/share/TpLogger | |||
15 | whitelist ${HOME}/.local/share/TpLogger | 15 | whitelist ${HOME}/.local/share/TpLogger |
16 | mkdir ${HOME}/.config/telepathy-account-widgets | 16 | mkdir ${HOME}/.config/telepathy-account-widgets |
17 | whitelist ${HOME}/.config/telepathy-account-widgets | 17 | whitelist ${HOME}/.config/telepathy-account-widgets |
18 | mkdir ${HOME}/.cache/telepathy | ||
19 | whitelist ${HOME}/.cache/telepathy | ||
20 | mkdir ${HOME}/.purple | 18 | mkdir ${HOME}/.purple |
21 | whitelist ${HOME}/.purple | 19 | whitelist ${HOME}/.purple |
22 | include /etc/firejail/whitelist-common.inc | 20 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/psi-plus.profile b/etc/psi-plus.profile index 45cb22ee4..5106fccb2 100644 --- a/etc/psi-plus.profile +++ b/etc/psi-plus.profile | |||
@@ -14,8 +14,6 @@ mkdir ~/.config/psi+ | |||
14 | whitelist ~/.config/psi+ | 14 | whitelist ~/.config/psi+ |
15 | mkdir ~/.local/share/psi+ | 15 | mkdir ~/.local/share/psi+ |
16 | whitelist ~/.local/share/psi+ | 16 | whitelist ~/.local/share/psi+ |
17 | mkdir ~/.cache/psi+ | ||
18 | whitelist ~/.cache/psi+ | ||
19 | 17 | ||
20 | caps.drop all | 18 | caps.drop all |
21 | netfilter | 19 | netfilter |
diff --git a/etc/quiterss.profile b/etc/quiterss.profile index f4e4f96d3..158425e18 100644 --- a/etc/quiterss.profile +++ b/etc/quiterss.profile | |||
@@ -2,7 +2,6 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include /etc/firejail/quiterss.local | 3 | include /etc/firejail/quiterss.local |
4 | 4 | ||
5 | noblacklist ${HOME}/.cache/QuiteRss | ||
6 | noblacklist ${HOME}/.config/QuiteRss | 5 | noblacklist ${HOME}/.config/QuiteRss |
7 | noblacklist ${HOME}/.config/QuiteRssrc | 6 | noblacklist ${HOME}/.config/QuiteRssrc |
8 | noblacklist ${HOME}/.local/share/QuiteRss | 7 | noblacklist ${HOME}/.local/share/QuiteRss |
@@ -19,8 +18,6 @@ whitelist ${HOME}/.config/QuiteRssrc | |||
19 | mkdir ~/.local/share/data | 18 | mkdir ~/.local/share/data |
20 | mkdir ~/.local/share/data/QuiteRss | 19 | mkdir ~/.local/share/data/QuiteRss |
21 | whitelist ${HOME}/.local/share/data/QuiteRss | 20 | whitelist ${HOME}/.local/share/data/QuiteRss |
22 | mkdir ~/.cache/QuiteRss | ||
23 | whitelist ${HOME}/.cache/QuiteRss | ||
24 | 21 | ||
25 | caps.drop all | 22 | caps.drop all |
26 | netfilter | 23 | netfilter |
diff --git a/etc/qupzilla.profile b/etc/qupzilla.profile index 3f5cb60c0..783bc516d 100644 --- a/etc/qupzilla.profile +++ b/etc/qupzilla.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/qupzilla.local | |||
4 | 4 | ||
5 | # Firejail profile for Qupzilla web browser | 5 | # Firejail profile for Qupzilla web browser |
6 | noblacklist ${HOME}/.config/qupzilla | 6 | noblacklist ${HOME}/.config/qupzilla |
7 | noblacklist ${HOME}/.cache/qupzilla | ||
8 | include /etc/firejail/disable-mgmt.inc | 7 | include /etc/firejail/disable-mgmt.inc |
9 | include /etc/firejail/disable-secret.inc | 8 | include /etc/firejail/disable-secret.inc |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -17,7 +16,6 @@ tracelog | |||
17 | noroot | 16 | noroot |
18 | whitelist ${DOWNLOADS} | 17 | whitelist ${DOWNLOADS} |
19 | whitelist ~/.config/qupzilla | 18 | whitelist ~/.config/qupzilla |
20 | whitelist ~/.cache/qupzilla | ||
21 | include /etc/firejail/whitelist-common.inc | 19 | include /etc/firejail/whitelist-common.inc |
22 | 20 | ||
23 | # experimental features | 21 | # experimental features |
diff --git a/etc/qutebrowser.profile b/etc/qutebrowser.profile index f43307ef9..53be1178c 100644 --- a/etc/qutebrowser.profile +++ b/etc/qutebrowser.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/qutebrowser.local | |||
4 | 4 | ||
5 | # Firejail profile for Qutebrowser (Qt5-Webkit+Python) browser | 5 | # Firejail profile for Qutebrowser (Qt5-Webkit+Python) browser |
6 | noblacklist ~/.config/qutebrowser | 6 | noblacklist ~/.config/qutebrowser |
7 | noblacklist ~/.cache/qutebrowser | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -20,8 +19,6 @@ tracelog | |||
20 | whitelist ${DOWNLOADS} | 19 | whitelist ${DOWNLOADS} |
21 | mkdir ~/.config/qutebrowser | 20 | mkdir ~/.config/qutebrowser |
22 | whitelist ~/.config/qutebrowser | 21 | whitelist ~/.config/qutebrowser |
23 | mkdir ~/.cache/qutebrowser | ||
24 | whitelist ~/.cache/qutebrowser | ||
25 | mkdir ~/.local/share/qutebrowser | 22 | mkdir ~/.local/share/qutebrowser |
26 | whitelist ~/.local/share/qutebrowser | 23 | whitelist ~/.local/share/qutebrowser |
27 | include /etc/firejail/whitelist-common.inc | 24 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/seamonkey.profile b/etc/seamonkey.profile index df1910469..756700c2f 100644 --- a/etc/seamonkey.profile +++ b/etc/seamonkey.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/seamonkey.local | |||
4 | 4 | ||
5 | # Firejail profile for Seamoneky based off Mozilla Firefox | 5 | # Firejail profile for Seamoneky based off Mozilla Firefox |
6 | noblacklist ~/.mozilla | 6 | noblacklist ~/.mozilla |
7 | noblacklist ~/.cache/mozilla | ||
8 | noblacklist ~/.pki | 7 | noblacklist ~/.pki |
9 | noblacklist ~/.lastpass | 8 | noblacklist ~/.lastpass |
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -22,8 +21,6 @@ tracelog | |||
22 | whitelist ${DOWNLOADS} | 21 | whitelist ${DOWNLOADS} |
23 | mkdir ~/.mozilla/seamonkey | 22 | mkdir ~/.mozilla/seamonkey |
24 | whitelist ~/.mozilla/seamonkey | 23 | whitelist ~/.mozilla/seamonkey |
25 | mkdir ~/.cache/mozilla/seamonkey | ||
26 | whitelist ~/.cache/mozilla/seamonkey | ||
27 | whitelist ~/dwhelper | 24 | whitelist ~/dwhelper |
28 | whitelist ~/.zotero | 25 | whitelist ~/.zotero |
29 | whitelist ~/.vimperatorrc | 26 | whitelist ~/.vimperatorrc |
@@ -32,7 +29,6 @@ whitelist ~/.pentadactylrc | |||
32 | whitelist ~/.pentadactyl | 29 | whitelist ~/.pentadactyl |
33 | whitelist ~/.keysnail.js | 30 | whitelist ~/.keysnail.js |
34 | whitelist ~/.config/gnome-mplayer | 31 | whitelist ~/.config/gnome-mplayer |
35 | whitelist ~/.cache/gnome-mplayer/plugin | ||
36 | whitelist ~/.pki | 32 | whitelist ~/.pki |
37 | whitelist ~/.lastpass | 33 | whitelist ~/.lastpass |
38 | include /etc/firejail/whitelist-common.inc | 34 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/simple-scan.profile b/etc/simple-scan.profile index ee7e50ba7..0f6d626a5 100644 --- a/etc/simple-scan.profile +++ b/etc/simple-scan.profile | |||
@@ -3,8 +3,6 @@ | |||
3 | include /etc/firejail/simple-scan.local | 3 | include /etc/firejail/simple-scan.local |
4 | 4 | ||
5 | # simple-scan profile | 5 | # simple-scan profile |
6 | noblacklist ~/.cache/simple-scan | ||
7 | |||
8 | include /etc/firejail/disable-common.inc | 6 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 7 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 8 | include /etc/firejail/disable-devel.inc |
diff --git a/etc/spotify.profile b/etc/spotify.profile index 843038a2b..23ef75b71 100644 --- a/etc/spotify.profile +++ b/etc/spotify.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/spotify.local | |||
4 | 4 | ||
5 | # Spotify media player profile | 5 | # Spotify media player profile |
6 | noblacklist ${HOME}/.config/spotify | 6 | noblacklist ${HOME}/.config/spotify |
7 | noblacklist ${HOME}/.cache/spotify | ||
8 | noblacklist ${HOME}/.local/share/spotify | 7 | noblacklist ${HOME}/.local/share/spotify |
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
@@ -16,8 +15,6 @@ mkdir ${HOME}/.config/spotify | |||
16 | whitelist ${HOME}/.config/spotify | 15 | whitelist ${HOME}/.config/spotify |
17 | mkdir ${HOME}/.local/share/spotify | 16 | mkdir ${HOME}/.local/share/spotify |
18 | whitelist ${HOME}/.local/share/spotify | 17 | whitelist ${HOME}/.local/share/spotify |
19 | mkdir ${HOME}/.cache/spotify | ||
20 | whitelist ${HOME}/.cache/spotify | ||
21 | 18 | ||
22 | caps.drop all | 19 | caps.drop all |
23 | netfilter | 20 | netfilter |
diff --git a/etc/thunderbird.profile b/etc/thunderbird.profile index 88ab7501e..df1a4cdbb 100644 --- a/etc/thunderbird.profile +++ b/etc/thunderbird.profile | |||
@@ -14,9 +14,9 @@ noblacklist ~/.thunderbird | |||
14 | mkdir ~/.thunderbird | 14 | mkdir ~/.thunderbird |
15 | whitelist ~/.thunderbird | 15 | whitelist ~/.thunderbird |
16 | 16 | ||
17 | noblacklist ~/.cache/thunderbird | 17 | noblacklist ~/.icedove |
18 | mkdir ~/.cache/thunderbird | 18 | mkdir ~/.icedove |
19 | whitelist ~/.cache/thunderbird | 19 | whitelist ~/.icedove |
20 | 20 | ||
21 | # allow browsers | 21 | # allow browsers |
22 | ignore private-tmp | 22 | ignore private-tmp |
diff --git a/etc/transmission-cli.profile b/etc/transmission-cli.profile index dbcc8d041..5b6bec4c1 100644 --- a/etc/transmission-cli.profile +++ b/etc/transmission-cli.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-cli.local | |||
4 | 4 | ||
5 | # transmission-cli bittorrent profile | 5 | # transmission-cli bittorrent profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/transmission-gtk.profile b/etc/transmission-gtk.profile index dcd3317ef..78ce5fba2 100644 --- a/etc/transmission-gtk.profile +++ b/etc/transmission-gtk.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-gtk.local | |||
4 | 4 | ||
5 | # transmission-gtk bittorrent profile | 5 | # transmission-gtk bittorrent profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/transmission-qt.profile b/etc/transmission-qt.profile index ed63f7cff..2f7fe0714 100644 --- a/etc/transmission-qt.profile +++ b/etc/transmission-qt.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-qt.local | |||
4 | 4 | ||
5 | # transmission-qt bittorrent profile | 5 | # transmission-qt bittorrent profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/transmission-show.profile b/etc/transmission-show.profile index 0b88789b1..052843882 100644 --- a/etc/transmission-show.profile +++ b/etc/transmission-show.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/transmission-show.local | |||
4 | 4 | ||
5 | # transmission-show profile | 5 | # transmission-show profile |
6 | noblacklist ${HOME}/.config/transmission | 6 | noblacklist ${HOME}/.config/transmission |
7 | noblacklist ${HOME}/.cache/transmission | ||
8 | 7 | ||
9 | include /etc/firejail/disable-common.inc | 8 | include /etc/firejail/disable-common.inc |
10 | include /etc/firejail/disable-programs.inc | 9 | include /etc/firejail/disable-programs.inc |
diff --git a/etc/vivaldi.profile b/etc/vivaldi.profile index 2c2fbd9f0..bf6af3926 100644 --- a/etc/vivaldi.profile +++ b/etc/vivaldi.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/vivaldi.local | |||
4 | 4 | ||
5 | # Vivaldi browser profile | 5 | # Vivaldi browser profile |
6 | noblacklist ~/.config/vivaldi | 6 | noblacklist ~/.config/vivaldi |
7 | noblacklist ~/.cache/vivaldi | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-programs.inc | 8 | include /etc/firejail/disable-programs.inc |
10 | include /etc/firejail/disable-devel.inc | 9 | include /etc/firejail/disable-devel.inc |
@@ -14,6 +13,4 @@ netfilter | |||
14 | whitelist ${DOWNLOADS} | 13 | whitelist ${DOWNLOADS} |
15 | mkdir ~/.config/vivaldi | 14 | mkdir ~/.config/vivaldi |
16 | whitelist ~/.config/vivaldi | 15 | whitelist ~/.config/vivaldi |
17 | mkdir ~/.cache/vivaldi | ||
18 | whitelist ~/.cache/vivaldi | ||
19 | include /etc/firejail/whitelist-common.inc | 16 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/warzone2100.profile b/etc/warzone2100.profile index 702097d98..2f4055887 100644 --- a/etc/warzone2100.profile +++ b/etc/warzone2100.profile | |||
@@ -3,16 +3,17 @@ | |||
3 | include /etc/firejail/warzone2100.local | 3 | include /etc/firejail/warzone2100.local |
4 | 4 | ||
5 | # Firejail profile for warzone2100 | 5 | # Firejail profile for warzone2100 |
6 | # Currently supports warzone2100-3.1 | 6 | noblacklist ~/.warzone2100-3.* |
7 | noblacklist ~/.warzone2100-3.1 | ||
8 | include /etc/firejail/disable-common.inc | 7 | include /etc/firejail/disable-common.inc |
9 | include /etc/firejail/disable-devel.inc | 8 | include /etc/firejail/disable-devel.inc |
10 | include /etc/firejail/disable-passwdmgr.inc | 9 | include /etc/firejail/disable-passwdmgr.inc |
11 | include /etc/firejail/disable-programs.inc | 10 | include /etc/firejail/disable-programs.inc |
12 | 11 | ||
13 | # Whitelist | 12 | # Whitelist |
14 | mkdir ~/.warzone2100-3.1 | 13 | #mkdir ~/.warzone2100-3.1 |
15 | whitelist ~/.warzone2100-3.1 | 14 | whitelist ~/.warzone2100-3.1 |
15 | #mkdir ~/.warzone2100-3.2 | ||
16 | whitelist ~/.warzone2100-3.2 | ||
16 | 17 | ||
17 | # Call these options | 18 | # Call these options |
18 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/wesnoth.profile b/etc/wesnoth.profile index 212466f5a..fbb381a86 100644 --- a/etc/wesnoth.profile +++ b/etc/wesnoth.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/wesnoth.local | |||
4 | 4 | ||
5 | # Whitelist-based profile for "Battle for Wesnoth" (game). | 5 | # Whitelist-based profile for "Battle for Wesnoth" (game). |
6 | noblacklist ${HOME}/.config/wesnoth | 6 | noblacklist ${HOME}/.config/wesnoth |
7 | noblacklist ${HOME}/.cache/wesnoth | ||
8 | noblacklist ${HOME}/.local/share/wesnoth | 7 | noblacklist ${HOME}/.local/share/wesnoth |
9 | 8 | ||
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
@@ -23,8 +22,6 @@ private-tmp | |||
23 | 22 | ||
24 | mkdir ${HOME}/.local/share/wesnoth | 23 | mkdir ${HOME}/.local/share/wesnoth |
25 | mkdir ${HOME}/.config/wesnoth | 24 | mkdir ${HOME}/.config/wesnoth |
26 | mkdir ${HOME}/.cache/wesnoth | ||
27 | whitelist ${HOME}/.local/share/wesnoth | 25 | whitelist ${HOME}/.local/share/wesnoth |
28 | whitelist ${HOME}/.config/wesnoth | 26 | whitelist ${HOME}/.config/wesnoth |
29 | whitelist ${HOME}/.cache/wesnoth | ||
30 | include /etc/firejail/whitelist-common.inc | 27 | include /etc/firejail/whitelist-common.inc |
diff --git a/etc/whitelist-common.inc b/etc/whitelist-common.inc index cf7797100..516f47041 100644 --- a/etc/whitelist-common.inc +++ b/etc/whitelist-common.inc | |||
@@ -19,7 +19,6 @@ whitelist ~/.fonts.conf | |||
19 | whitelist ~/.fonts.conf.d | 19 | whitelist ~/.fonts.conf.d |
20 | whitelist ~/.local/share/fonts | 20 | whitelist ~/.local/share/fonts |
21 | whitelist ~/.config/fontconfig | 21 | whitelist ~/.config/fontconfig |
22 | whitelist ~/.cache/fontconfig | ||
23 | 22 | ||
24 | # gtk | 23 | # gtk |
25 | whitelist ~/.gtkrc | 24 | whitelist ~/.gtkrc |
diff --git a/etc/xreader.profile b/etc/xreader.profile index 2e6015aef..51dbcad51 100644 --- a/etc/xreader.profile +++ b/etc/xreader.profile | |||
@@ -4,7 +4,6 @@ include /etc/firejail/xreader.local | |||
4 | 4 | ||
5 | # Xreader profile | 5 | # Xreader profile |
6 | noblacklist ~/.config/xreader | 6 | noblacklist ~/.config/xreader |
7 | noblacklist ~/.cache/xreader | ||
8 | noblacklist ~/.local/share | 7 | noblacklist ~/.local/share |
9 | 8 | ||
10 | include /etc/firejail/disable-common.inc | 9 | include /etc/firejail/disable-common.inc |
diff --git a/platform/debian/conffiles b/platform/debian/conffiles index c68852f26..253af3f01 100644 --- a/platform/debian/conffiles +++ b/platform/debian/conffiles | |||
@@ -132,6 +132,7 @@ | |||
132 | /etc/firejail/mcabber.profile | 132 | /etc/firejail/mcabber.profile |
133 | /etc/firejail/mediainfo.profile | 133 | /etc/firejail/mediainfo.profile |
134 | /etc/firejail/midori.profile | 134 | /etc/firejail/midori.profile |
135 | /etc/firejail/mousepad.profile | ||
135 | /etc/firejail/mpv.profile | 136 | /etc/firejail/mpv.profile |
136 | /etc/firejail/mumble.profile | 137 | /etc/firejail/mumble.profile |
137 | /etc/firejail/mupdf.profile | 138 | /etc/firejail/mupdf.profile |
diff --git a/platform/debian/control b/platform/debian/control index 991abb656..4287d6561 100644 --- a/platform/debian/control +++ b/platform/debian/control | |||
@@ -4,6 +4,7 @@ Architecture: amd64 | |||
4 | Maintainer: netblue30 <netblue30@yahoo.com> | 4 | Maintainer: netblue30 <netblue30@yahoo.com> |
5 | Installed-Size: 272 | 5 | Installed-Size: 272 |
6 | Depends: libc6 | 6 | Depends: libc6 |
7 | Suggests: python, python3 | ||
7 | Section: admin | 8 | Section: admin |
8 | Priority: extra | 9 | Priority: extra |
9 | Homepage: http://github.com/netblue30/firejail | 10 | Homepage: http://github.com/netblue30/firejail |
@@ -17,4 +18,3 @@ Description: Linux namepaces sandbox program. | |||
17 | Firejail also expands the restricted shell facility found in bash by | 18 | Firejail also expands the restricted shell facility found in bash by |
18 | adding Linux namespace support. It also supports sandboxing SSH users | 19 | adding Linux namespace support. It also supports sandboxing SSH users |
19 | upon login. | 20 | upon login. |
20 | |||
diff --git a/platform/debian/copyright b/platform/debian/copyright index 4fd3a15d1..83952080f 100644 --- a/platform/debian/copyright +++ b/platform/debian/copyright | |||
@@ -7,7 +7,7 @@ This is the Debian/Ubuntu prepackaged version of firejail. | |||
7 | and networking stack isolation, and it runs on any recent Linux system. It | 7 | and networking stack isolation, and it runs on any recent Linux system. It |
8 | includes a sandbox profile for Mozilla Firefox. | 8 | includes a sandbox profile for Mozilla Firefox. |
9 | 9 | ||
10 | Copyright (C) 2014,2015 Firejail Authors (see README file for more details) | 10 | Copyright (C) 2014-2017 Firejail Authors (see README file for more details) |
11 | 11 | ||
12 | This program is free software; you can redistribute it and/or modify | 12 | This program is free software; you can redistribute it and/or modify |
13 | it under the terms of the GNU General Public License as published by | 13 | it under the terms of the GNU General Public License as published by |
@@ -27,4 +27,3 @@ The complete text of the GNU General Public License can be found | |||
27 | in /usr/share/common-licenses/GPL-2. | 27 | in /usr/share/common-licenses/GPL-2. |
28 | 28 | ||
29 | Homepage: http://github.com/netblue30/firejail. | 29 | Homepage: http://github.com/netblue30/firejail. |
30 | |||
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 656e3b14a..1db8736e9 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -192,6 +192,7 @@ keepass | |||
192 | keepass2 | 192 | keepass2 |
193 | keepassx | 193 | keepassx |
194 | keepassx2 | 194 | keepassx2 |
195 | mousepad | ||
195 | pluma | 196 | pluma |
196 | Thunar | 197 | Thunar |
197 | thunar | 198 | thunar |
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c index 4cc5cc180..980c80bd9 100644 --- a/src/firejail/appimage.c +++ b/src/firejail/appimage.c | |||
@@ -31,6 +31,11 @@ | |||
31 | static char *devloop = NULL; // device file | 31 | static char *devloop = NULL; // device file |
32 | static char *mntdir = NULL; // mount point in /tmp directory | 32 | static char *mntdir = NULL; // mount point in /tmp directory |
33 | 33 | ||
34 | static void err_loop(void) { | ||
35 | fprintf(stderr, "Error: cannot configure loopback device\n"); | ||
36 | exit(1); | ||
37 | } | ||
38 | |||
34 | void appimage_set(const char *appimage) { | 39 | void appimage_set(const char *appimage) { |
35 | assert(appimage); | 40 | assert(appimage); |
36 | assert(devloop == NULL); // don't call this twice! | 41 | assert(devloop == NULL); // don't call this twice! |
@@ -61,35 +66,27 @@ void appimage_set(const char *appimage) { | |||
61 | // find or allocate a free loop device to use | 66 | // find or allocate a free loop device to use |
62 | EUID_ROOT(); | 67 | EUID_ROOT(); |
63 | int cfd = open("/dev/loop-control", O_RDWR); | 68 | int cfd = open("/dev/loop-control", O_RDWR); |
64 | if (cfd == -1) { | 69 | if (cfd == -1) |
65 | fprintf(stderr, "Error: /dev/loop-control interface is not supported by your kernel\n"); | 70 | err_loop(); |
66 | exit(1); | ||
67 | } | ||
68 | int devnr = ioctl(cfd, LOOP_CTL_GET_FREE); | 71 | int devnr = ioctl(cfd, LOOP_CTL_GET_FREE); |
69 | if (devnr == -1) { | 72 | if (devnr == -1) |
70 | fprintf(stderr, "Error: cannot allocate a new loopback device\n"); | 73 | err_loop(); |
71 | exit(1); | ||
72 | } | ||
73 | close(cfd); | 74 | close(cfd); |
74 | if (asprintf(&devloop, "/dev/loop%d", devnr) == -1) | 75 | if (asprintf(&devloop, "/dev/loop%d", devnr) == -1) |
75 | errExit("asprintf"); | 76 | errExit("asprintf"); |
76 | 77 | ||
77 | int lfd = open(devloop, O_RDONLY); | 78 | int lfd = open(devloop, O_RDONLY); |
78 | if (lfd == -1) { | 79 | if (lfd == -1) |
79 | fprintf(stderr, "Error: cannot open %s\n", devloop); | 80 | err_loop(); |
80 | exit(1); | 81 | if (ioctl(lfd, LOOP_SET_FD, ffd) == -1) |
81 | } | 82 | err_loop(); |
82 | if (ioctl(lfd, LOOP_SET_FD, ffd) == -1) { | ||
83 | fprintf(stderr, "Error: cannot configure the loopback device\n"); | ||
84 | exit(1); | ||
85 | } | ||
86 | 83 | ||
87 | if (size) { | 84 | if (size) { |
88 | struct loop_info64 info; | 85 | struct loop_info64 info; |
89 | memset(&info, 0, sizeof(struct loop_info64)); | 86 | memset(&info, 0, sizeof(struct loop_info64)); |
90 | info.lo_offset = size; | 87 | info.lo_offset = size; |
91 | if (ioctl(lfd, LOOP_SET_STATUS64, &info) == -1) | 88 | if (ioctl(lfd, LOOP_SET_STATUS64, &info) == -1) |
92 | errExit("configure appimage offset"); | 89 | err_loop(); |
93 | } | 90 | } |
94 | 91 | ||
95 | close(lfd); | 92 | close(lfd); |
@@ -151,8 +148,12 @@ void appimage_clear(void) { | |||
151 | int rv = 0; | 148 | int rv = 0; |
152 | for (i = 0; i < 5; i++) { | 149 | for (i = 0; i < 5; i++) { |
153 | rv = umount2(mntdir, MNT_FORCE); | 150 | rv = umount2(mntdir, MNT_FORCE); |
154 | if (rv == 0) | 151 | if (rv == 0) { |
152 | if (!arg_quiet) | ||
153 | printf("AppImage unmounted\n"); | ||
154 | |||
155 | break; | 155 | break; |
156 | } | ||
156 | if (rv == -1 && errno == EBUSY) { | 157 | if (rv == -1 && errno == EBUSY) { |
157 | if (!arg_quiet) | 158 | if (!arg_quiet) |
158 | printf("Warning: EBUSY error trying to unmount %s\n", mntdir); | 159 | printf("Warning: EBUSY error trying to unmount %s\n", mntdir); |
diff --git a/src/firejail/checkcfg.c b/src/firejail/checkcfg.c index 476ecbe10..f76f83d85 100644 --- a/src/firejail/checkcfg.c +++ b/src/firejail/checkcfg.c | |||
@@ -92,6 +92,15 @@ int checkcfg(int val) { | |||
92 | else | 92 | else |
93 | goto errout; | 93 | goto errout; |
94 | } | 94 | } |
95 | // join | ||
96 | else if (strncmp(ptr, "join ", 5) == 0) { | ||
97 | if (strcmp(ptr + 5, "yes") == 0) | ||
98 | cfg_val[CFG_JOIN] = 1; | ||
99 | else if (strcmp(ptr + 5, "no") == 0) | ||
100 | cfg_val[CFG_JOIN] = 0; | ||
101 | else | ||
102 | goto errout; | ||
103 | } | ||
95 | // x11 | 104 | // x11 |
96 | else if (strncmp(ptr, "x11 ", 4) == 0) { | 105 | else if (strncmp(ptr, "x11 ", 4) == 0) { |
97 | if (strcmp(ptr + 4, "yes") == 0) | 106 | if (strcmp(ptr + 4, "yes") == 0) |
@@ -282,6 +291,10 @@ int checkcfg(int val) { | |||
282 | else if (strncmp(ptr, "quiet-by-default ", 17) == 0) { | 291 | else if (strncmp(ptr, "quiet-by-default ", 17) == 0) { |
283 | if (strcmp(ptr + 17, "yes") == 0) | 292 | if (strcmp(ptr + 17, "yes") == 0) |
284 | arg_quiet = 1; | 293 | arg_quiet = 1; |
294 | else if (strcmp(ptr + 17, "no") == 0) | ||
295 | arg_quiet = 0; | ||
296 | else | ||
297 | goto errout; | ||
285 | } | 298 | } |
286 | // remount /proc and /sys | 299 | // remount /proc and /sys |
287 | else if (strncmp(ptr, "remount-proc-sys ", 17) == 0) { | 300 | else if (strncmp(ptr, "remount-proc-sys ", 17) == 0) { |
@@ -404,16 +417,16 @@ void print_compiletime_support(void) { | |||
404 | #endif | 417 | #endif |
405 | ); | 418 | ); |
406 | 419 | ||
407 | printf("\t- networking support is %s\n", | 420 | printf("\t- git install support is %s\n", |
408 | #ifdef HAVE_NETWORK | 421 | #ifdef HAVE_GIT_INSTALL |
409 | "enabled" | 422 | "enabled" |
410 | #else | 423 | #else |
411 | "disabled" | 424 | "disabled" |
412 | #endif | 425 | #endif |
413 | ); | 426 | ); |
414 | 427 | ||
415 | printf("\t- git install support is %s\n", | 428 | printf("\t- networking support is %s\n", |
416 | #ifdef HAVE_GIT_INSTALL | 429 | #ifdef HAVE_NETWORK |
417 | "enabled" | 430 | "enabled" |
418 | #else | 431 | #else |
419 | "disabled" | 432 | "disabled" |
diff --git a/src/firejail/cmdline.c b/src/firejail/cmdline.c index 60301ed58..e62ed8d33 100644 --- a/src/firejail/cmdline.c +++ b/src/firejail/cmdline.c | |||
@@ -153,6 +153,9 @@ void build_cmdline(char **command_line, char **window_title, int argc, char **ar | |||
153 | errExit("malloc"); | 153 | errExit("malloc"); |
154 | 154 | ||
155 | quote_cmdline(*command_line, *window_title, len, argc, argv, index); | 155 | quote_cmdline(*command_line, *window_title, len, argc, argv, index); |
156 | |||
157 | if (arg_debug) | ||
158 | printf("Building quoted command line: %s\n", *command_line); | ||
156 | 159 | ||
157 | assert(*command_line); | 160 | assert(*command_line); |
158 | assert(*window_title); | 161 | assert(*window_title); |
@@ -163,7 +166,9 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, | |||
163 | // the program should exit with an error before entering this function | 166 | // the program should exit with an error before entering this function |
164 | assert(index != -1); | 167 | assert(index != -1); |
165 | 168 | ||
166 | // unsigned argcount = argc - index; | 169 | if (arg_debug) |
170 | printf("Building AppImage command line: %s\n", *command_line); | ||
171 | |||
167 | 172 | ||
168 | int len1 = cmdline_length(argc, argv, index); // length of argv w/o changes | 173 | int len1 = cmdline_length(argc, argv, index); // length of argv w/o changes |
169 | int len2 = cmdline_length(1, &argv[index], 0); // apptest.AppImage | 174 | int len2 = cmdline_length(1, &argv[index], 0); // apptest.AppImage |
@@ -198,6 +203,9 @@ void build_appimage_cmdline(char **command_line, char **window_title, int argc, | |||
198 | if (asprintf(command_line, "'%s' %s", tmp1, command_line_tmp + len2) == -1) | 203 | if (asprintf(command_line, "'%s' %s", tmp1, command_line_tmp + len2) == -1) |
199 | errExit("asprintf"); | 204 | errExit("asprintf"); |
200 | 205 | ||
206 | if (arg_debug) | ||
207 | printf("AppImage quoted command line: %s\n", *command_line); | ||
208 | |||
201 | // free strdup | 209 | // free strdup |
202 | free(tmp1); | 210 | free(tmp1); |
203 | } | 211 | } |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index fa6ba5c6a..75e5feaff 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -407,6 +407,7 @@ void fs_overlayfs(void); | |||
407 | // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf | 407 | // chroot into an existing directory; mount exiting /dev and update /etc/resolv.conf |
408 | void fs_chroot(const char *rootdir); | 408 | void fs_chroot(const char *rootdir); |
409 | void fs_check_chroot_dir(const char *rootdir); | 409 | void fs_check_chroot_dir(const char *rootdir); |
410 | void fs_cache(void); | ||
410 | 411 | ||
411 | // profile.c | 412 | // profile.c |
412 | // find and read the profile specified by name from dir directory | 413 | // find and read the profile specified by name from dir directory |
@@ -541,7 +542,7 @@ void fs_trace(void); | |||
541 | // fs_hostname.c | 542 | // fs_hostname.c |
542 | void fs_hostname(const char *hostname); | 543 | void fs_hostname(const char *hostname); |
543 | void fs_resolvconf(void); | 544 | void fs_resolvconf(void); |
544 | char *fs_check_hosts_fiile(const char *fname); | 545 | char *fs_check_hosts_file(const char *fname); |
545 | void fs_store_hosts_file(void); | 546 | void fs_store_hosts_file(void); |
546 | void fs_mount_hosts_file(void); | 547 | void fs_mount_hosts_file(void); |
547 | 548 | ||
@@ -685,6 +686,7 @@ enum { | |||
685 | CFG_FOLLOW_SYMLINK_PRIVATE_BIN, | 686 | CFG_FOLLOW_SYMLINK_PRIVATE_BIN, |
686 | CFG_DISABLE_MNT, | 687 | CFG_DISABLE_MNT, |
687 | CFG_CACHE_TMPFS, | 688 | CFG_CACHE_TMPFS, |
689 | CFG_JOIN, | ||
688 | CFG_MAX // this should always be the last entry | 690 | CFG_MAX // this should always be the last entry |
689 | }; | 691 | }; |
690 | extern char *xephyr_screen; | 692 | extern char *xephyr_screen; |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 3413febcb..fc6bdc7d0 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -486,7 +486,15 @@ void fs_cache(void) { | |||
486 | char *cache; | 486 | char *cache; |
487 | if (asprintf(&cache, "%s/.cache", cfg.homedir) == -1) | 487 | if (asprintf(&cache, "%s/.cache", cfg.homedir) == -1) |
488 | errExit("asprintf"); | 488 | errExit("asprintf"); |
489 | if (is_link(cache)) { | ||
490 | fprintf(stderr, "Error: ~/.cache directory is a symbolik link\n"); | ||
491 | exit(1); | ||
492 | } | ||
489 | disable_file(MOUNT_TMPFS, cache); | 493 | disable_file(MOUNT_TMPFS, cache); |
494 | if (is_link(cache)) { | ||
495 | fprintf(stderr, "Error: ~/.cache directory is a symbolik link\n"); | ||
496 | exit(1); | ||
497 | } | ||
490 | free(cache); | 498 | free(cache); |
491 | } | 499 | } |
492 | 500 | ||
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c index 19c2210b3..69c422f1d 100644 --- a/src/firejail/fs_etc.c +++ b/src/firejail/fs_etc.c | |||
@@ -34,7 +34,9 @@ void fs_machineid(void) { | |||
34 | // if --machine-id flag is inactive, do nothing | 34 | // if --machine-id flag is inactive, do nothing |
35 | if (arg_machineid == 0) | 35 | if (arg_machineid == 0) |
36 | return; | 36 | return; |
37 | 37 | if (arg_debug) | |
38 | printf("Generating a new machine-id\n"); | ||
39 | |||
38 | // init random number generator | 40 | // init random number generator |
39 | srand(time(NULL)); | 41 | srand(time(NULL)); |
40 | 42 | ||
diff --git a/src/firejail/fs_hostname.c b/src/firejail/fs_hostname.c index 535526409..32243c700 100644 --- a/src/firejail/fs_hostname.c +++ b/src/firejail/fs_hostname.c | |||
@@ -127,7 +127,7 @@ void fs_resolvconf(void) { | |||
127 | } | 127 | } |
128 | } | 128 | } |
129 | 129 | ||
130 | char *fs_check_hosts_fiile(const char *fname) { | 130 | char *fs_check_hosts_file(const char *fname) { |
131 | assert(fname); | 131 | assert(fname); |
132 | invalid_filename(fname); | 132 | invalid_filename(fname); |
133 | char *rv = expand_home(fname, cfg.homedir); | 133 | char *rv = expand_home(fname, cfg.homedir); |
@@ -151,6 +151,9 @@ void fs_store_hosts_file(void) { | |||
151 | } | 151 | } |
152 | 152 | ||
153 | void fs_mount_hosts_file(void) { | 153 | void fs_mount_hosts_file(void) { |
154 | if (arg_debug) | ||
155 | printf("Loading user hosts file\n"); | ||
156 | |||
154 | // check /etc/hosts file | 157 | // check /etc/hosts file |
155 | struct stat s; | 158 | struct stat s; |
156 | if (stat("/etc/hosts", &s) == -1) | 159 | if (stat("/etc/hosts", &s) == -1) |
diff --git a/src/firejail/main.c b/src/firejail/main.c index aead29957..843dc2f3a 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -615,23 +615,27 @@ static void run_cmd_and_exit(int i, int argc, char **argv) { | |||
615 | } | 615 | } |
616 | #endif | 616 | #endif |
617 | else if (strncmp(argv[i], "--join=", 7) == 0) { | 617 | else if (strncmp(argv[i], "--join=", 7) == 0) { |
618 | logargs(argc, argv); | 618 | if (checkcfg(CFG_JOIN) || getuid() == 0) { |
619 | 619 | logargs(argc, argv); | |
620 | if (arg_shell_none) { | 620 | |
621 | if (argc <= (i+1)) { | 621 | if (arg_shell_none) { |
622 | fprintf(stderr, "Error: --shell=none set, but no command specified\n"); | 622 | if (argc <= (i+1)) { |
623 | exit(1); | 623 | fprintf(stderr, "Error: --shell=none set, but no command specified\n"); |
624 | exit(1); | ||
625 | } | ||
626 | cfg.original_program_index = i + 1; | ||
624 | } | 627 | } |
625 | cfg.original_program_index = i + 1; | 628 | |
629 | if (!cfg.shell && !arg_shell_none) | ||
630 | cfg.shell = guess_shell(); | ||
631 | |||
632 | // join sandbox by pid or by name | ||
633 | pid_t pid = read_pid(argv[i] + 7); | ||
634 | join(pid, argc, argv, i + 1); | ||
635 | exit(0); | ||
626 | } | 636 | } |
627 | 637 | else | |
628 | if (!cfg.shell && !arg_shell_none) | 638 | exit_err_feature("join"); |
629 | cfg.shell = guess_shell(); | ||
630 | |||
631 | // join sandbox by pid or by name | ||
632 | pid_t pid = read_pid(argv[i] + 7); | ||
633 | join(pid, argc, argv, i + 1); | ||
634 | exit(0); | ||
635 | 639 | ||
636 | } | 640 | } |
637 | else if (strncmp(argv[i], "--join-or-start=", 16) == 0) { | 641 | else if (strncmp(argv[i], "--join-or-start=", 16) == 0) { |
@@ -1965,7 +1969,7 @@ int main(int argc, char **argv) { | |||
1965 | } | 1969 | } |
1966 | 1970 | ||
1967 | else if (strncmp(argv[i], "--hosts-file=", 13) == 0) | 1971 | else if (strncmp(argv[i], "--hosts-file=", 13) == 0) |
1968 | cfg.hosts_file = fs_check_hosts_fiile(argv[i] + 13); | 1972 | cfg.hosts_file = fs_check_hosts_file(argv[i] + 13); |
1969 | 1973 | ||
1970 | #ifdef HAVE_NETWORK | 1974 | #ifdef HAVE_NETWORK |
1971 | else if (strcmp(argv[i], "--netfilter") == 0) { | 1975 | else if (strcmp(argv[i], "--netfilter") == 0) { |
@@ -2472,32 +2476,34 @@ int main(int argc, char **argv) { | |||
2472 | sprintf(ptr, "%d %d 1\n", gid, gid); | 2476 | sprintf(ptr, "%d %d 1\n", gid, gid); |
2473 | ptr += strlen(ptr); | 2477 | ptr += strlen(ptr); |
2474 | 2478 | ||
2475 | // add tty group | 2479 | if (!arg_nogroups) { |
2476 | gid_t g = get_group_id("tty"); | 2480 | // add tty group |
2477 | if (g) { | 2481 | gid_t g = get_group_id("tty"); |
2478 | sprintf(ptr, "%d %d 1\n", g, g); | 2482 | if (g) { |
2479 | ptr += strlen(ptr); | 2483 | sprintf(ptr, "%d %d 1\n", g, g); |
2480 | } | 2484 | ptr += strlen(ptr); |
2481 | 2485 | } | |
2482 | // add audio group | 2486 | |
2483 | g = get_group_id("audio"); | 2487 | // add audio group |
2484 | if (g) { | 2488 | g = get_group_id("audio"); |
2485 | sprintf(ptr, "%d %d 1\n", g, g); | 2489 | if (g) { |
2486 | ptr += strlen(ptr); | 2490 | sprintf(ptr, "%d %d 1\n", g, g); |
2487 | } | 2491 | ptr += strlen(ptr); |
2488 | 2492 | } | |
2489 | // add video group | 2493 | |
2490 | g = get_group_id("video"); | 2494 | // add video group |
2491 | if (g) { | 2495 | g = get_group_id("video"); |
2492 | sprintf(ptr, "%d %d 1\n", g, g); | 2496 | if (g) { |
2493 | ptr += strlen(ptr); | 2497 | sprintf(ptr, "%d %d 1\n", g, g); |
2494 | } | 2498 | ptr += strlen(ptr); |
2495 | 2499 | } | |
2496 | // add games group | 2500 | |
2497 | g = get_group_id("games"); | 2501 | // add games group |
2498 | if (g) { | 2502 | g = get_group_id("games"); |
2499 | sprintf(ptr, "%d %d 1\n", g, g); | 2503 | if (g) { |
2500 | } | 2504 | sprintf(ptr, "%d %d 1\n", g, g); |
2505 | } | ||
2506 | } | ||
2501 | 2507 | ||
2502 | EUID_ROOT(); | 2508 | EUID_ROOT(); |
2503 | update_map(gidmap, map_path); | 2509 | update_map(gidmap, map_path); |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 00dd87dad..993acf2aa 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -608,7 +608,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
608 | 608 | ||
609 | // hosts-file | 609 | // hosts-file |
610 | if (strncmp(ptr, "hosts-file ", 11) == 0) { | 610 | if (strncmp(ptr, "hosts-file ", 11) == 0) { |
611 | cfg.hosts_file = fs_check_hosts_fiile(ptr + 11); | 611 | cfg.hosts_file = fs_check_hosts_file(ptr + 11); |
612 | return 0; | 612 | return 0; |
613 | } | 613 | } |
614 | 614 | ||
@@ -970,19 +970,8 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
970 | ptr += 7; | 970 | ptr += 7; |
971 | else if (strncmp(ptr, "tmpfs ", 6) == 0) { | 971 | else if (strncmp(ptr, "tmpfs ", 6) == 0) { |
972 | if (getuid() != 0) { | 972 | if (getuid() != 0) { |
973 | // allow a non-root user to mount tmpfs in user home directory, links are not allowed | 973 | fprintf(stderr, "Error: tmpfs available only when running the sandbox as root\n"); |
974 | invalid_filename(ptr + 6); | 974 | exit(1); |
975 | char *newfname = expand_home(ptr + 6, cfg.homedir); | ||
976 | assert(newfname); | ||
977 | if (is_link(newfname)) { | ||
978 | fprintf(stderr, "Error: for regular user, tmpfs is not available for symbolic links\n"); | ||
979 | exit(1); | ||
980 | } | ||
981 | if (strncmp(newfname, cfg.homedir, strlen(cfg.homedir)) != 0) { | ||
982 | fprintf(stderr, "Error: for regular user, tmpfs is available only for files in user home directory\n"); | ||
983 | exit(1); | ||
984 | } | ||
985 | free(newfname); | ||
986 | } | 975 | } |
987 | ptr += 6; | 976 | ptr += 6; |
988 | } | 977 | } |
diff --git a/src/firejail/restrict_users.c b/src/firejail/restrict_users.c index 774e2908f..f759e7333 100644 --- a/src/firejail/restrict_users.c +++ b/src/firejail/restrict_users.c | |||
@@ -167,7 +167,7 @@ static void sanitize_passwd(void) { | |||
167 | int rv = sscanf(ptr, "%d:", &uid); | 167 | int rv = sscanf(ptr, "%d:", &uid); |
168 | if (rv == 0 || uid < 0) | 168 | if (rv == 0 || uid < 0) |
169 | goto errout; | 169 | goto errout; |
170 | if (uid < UID_MIN) { | 170 | if (uid < UID_MIN || uid == 65534) { // on Debian platforms user nobody is 65534 |
171 | fprintf(fpout, "%s", buf); | 171 | fprintf(fpout, "%s", buf); |
172 | continue; | 172 | continue; |
173 | } | 173 | } |
@@ -299,7 +299,7 @@ static void sanitize_group(void) { | |||
299 | int rv = sscanf(ptr, "%d:", &gid); | 299 | int rv = sscanf(ptr, "%d:", &gid); |
300 | if (rv == 0 || gid < 0) | 300 | if (rv == 0 || gid < 0) |
301 | goto errout; | 301 | goto errout; |
302 | if (gid < GID_MIN) { | 302 | if (gid < GID_MIN || gid == 65534) { // on Debian platforms 65534 is group nogroup |
303 | if (copy_line(fpout, buf, ptr)) | 303 | if (copy_line(fpout, buf, ptr)) |
304 | goto errout; | 304 | goto errout; |
305 | continue; | 305 | continue; |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index f26f8b06a..f9e59f1ed 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -742,6 +742,20 @@ int sandbox(void* sandbox_arg) { | |||
742 | else { | 742 | else { |
743 | // private-tmp is implemented as a whitelist | 743 | // private-tmp is implemented as a whitelist |
744 | EUID_USER(); | 744 | EUID_USER(); |
745 | // check XAUTHORITY file, KDE keeps it under /tmp | ||
746 | char *xauth = getenv("XAUTHORITY"); | ||
747 | if (xauth) { | ||
748 | char *rp = realpath(xauth, NULL); | ||
749 | if (rp && strncmp(rp, "/tmp/", 5) == 0) { | ||
750 | char *cmd; | ||
751 | if (asprintf(&cmd, "whitelist %s", rp) == -1) | ||
752 | errExit("asprintf"); | ||
753 | profile_add(cmd); // profile_add does not duplicate the string | ||
754 | } | ||
755 | if (rp) | ||
756 | free(rp); | ||
757 | } | ||
758 | // whitelist x11 directory | ||
745 | profile_add("whitelist /tmp/.X11-unix"); | 759 | profile_add("whitelist /tmp/.X11-unix"); |
746 | EUID_ROOT(); | 760 | EUID_ROOT(); |
747 | } | 761 | } |
@@ -851,6 +865,14 @@ int sandbox(void* sandbox_arg) { | |||
851 | } | 865 | } |
852 | } | 866 | } |
853 | } | 867 | } |
868 | if (arg_debug) { | ||
869 | char *cpath = get_current_dir_name(); | ||
870 | if (cpath) { | ||
871 | printf("Current directory: %s\n", cpath); | ||
872 | free(cpath); | ||
873 | } | ||
874 | } | ||
875 | |||
854 | 876 | ||
855 | // set nice | 877 | // set nice |
856 | if (arg_nice) { | 878 | if (arg_nice) { |
diff --git a/src/include/syscall.h b/src/include/syscall.h index c49760703..8852fcbd5 100644 --- a/src/include/syscall.h +++ b/src/include/syscall.h | |||
@@ -1076,6 +1076,11 @@ | |||
1076 | {"preadv", __NR_preadv}, | 1076 | {"preadv", __NR_preadv}, |
1077 | #endif | 1077 | #endif |
1078 | #endif | 1078 | #endif |
1079 | #ifdef SYS_preadv2 | ||
1080 | #ifdef __NR_preadv2 | ||
1081 | {"preadv2", __NR_preadv2}, | ||
1082 | #endif | ||
1083 | #endif | ||
1079 | #ifdef SYS_prlimit64 | 1084 | #ifdef SYS_prlimit64 |
1080 | #ifdef __NR_prlimit64 | 1085 | #ifdef __NR_prlimit64 |
1081 | {"prlimit64", __NR_prlimit64}, | 1086 | {"prlimit64", __NR_prlimit64}, |
@@ -1126,6 +1131,11 @@ | |||
1126 | {"pwritev", __NR_pwritev}, | 1131 | {"pwritev", __NR_pwritev}, |
1127 | #endif | 1132 | #endif |
1128 | #endif | 1133 | #endif |
1134 | #ifdef SYS_pwritev2 | ||
1135 | #ifdef __NR_pwritev2 | ||
1136 | {"pwritev2", __NR_pwritev2}, | ||
1137 | #endif | ||
1138 | #endif | ||
1129 | #ifdef SYS_query_module | 1139 | #ifdef SYS_query_module |
1130 | #ifdef __NR_query_module | 1140 | #ifdef __NR_query_module |
1131 | {"query_module", __NR_query_module}, | 1141 | {"query_module", __NR_query_module}, |
@@ -1892,6 +1902,7 @@ | |||
1892 | #endif | 1902 | #endif |
1893 | #endif | 1903 | #endif |
1894 | #endif | 1904 | #endif |
1905 | //#endif | ||
1895 | #if defined __x86_64__ && defined __LP64__ | 1906 | #if defined __x86_64__ && defined __LP64__ |
1896 | #ifdef SYS__sysctl | 1907 | #ifdef SYS__sysctl |
1897 | #ifdef __NR__sysctl | 1908 | #ifdef __NR__sysctl |
@@ -2828,6 +2839,11 @@ | |||
2828 | {"preadv", __NR_preadv}, | 2839 | {"preadv", __NR_preadv}, |
2829 | #endif | 2840 | #endif |
2830 | #endif | 2841 | #endif |
2842 | #ifdef SYS_preadv2 | ||
2843 | #ifdef __NR_preadv2 | ||
2844 | {"preadv2", __NR_preadv2}, | ||
2845 | #endif | ||
2846 | #endif | ||
2831 | #ifdef SYS_prlimit64 | 2847 | #ifdef SYS_prlimit64 |
2832 | #ifdef __NR_prlimit64 | 2848 | #ifdef __NR_prlimit64 |
2833 | {"prlimit64", __NR_prlimit64}, | 2849 | {"prlimit64", __NR_prlimit64}, |
@@ -2868,6 +2884,11 @@ | |||
2868 | {"pwritev", __NR_pwritev}, | 2884 | {"pwritev", __NR_pwritev}, |
2869 | #endif | 2885 | #endif |
2870 | #endif | 2886 | #endif |
2887 | #ifdef SYS_pwritev2 | ||
2888 | #ifdef __NR_pwritev2 | ||
2889 | {"pwritev2", __NR_pwritev2}, | ||
2890 | #endif | ||
2891 | #endif | ||
2871 | #ifdef SYS_query_module | 2892 | #ifdef SYS_query_module |
2872 | #ifdef __NR_query_module | 2893 | #ifdef __NR_query_module |
2873 | {"query_module", __NR_query_module}, | 2894 | {"query_module", __NR_query_module}, |
@@ -3529,6 +3550,7 @@ | |||
3529 | #endif | 3550 | #endif |
3530 | #endif | 3551 | #endif |
3531 | #endif | 3552 | #endif |
3553 | //#endif | ||
3532 | #if defined __x86_64__ && defined __ILP32__ | 3554 | #if defined __x86_64__ && defined __ILP32__ |
3533 | #ifdef SYS_accept | 3555 | #ifdef SYS_accept |
3534 | #ifdef __NR_accept | 3556 | #ifdef __NR_accept |
@@ -4430,6 +4452,11 @@ | |||
4430 | {"preadv", __NR_preadv}, | 4452 | {"preadv", __NR_preadv}, |
4431 | #endif | 4453 | #endif |
4432 | #endif | 4454 | #endif |
4455 | #ifdef SYS_preadv2 | ||
4456 | #ifdef __NR_preadv2 | ||
4457 | {"preadv2", __NR_preadv2}, | ||
4458 | #endif | ||
4459 | #endif | ||
4433 | #ifdef SYS_prlimit64 | 4460 | #ifdef SYS_prlimit64 |
4434 | #ifdef __NR_prlimit64 | 4461 | #ifdef __NR_prlimit64 |
4435 | {"prlimit64", __NR_prlimit64}, | 4462 | {"prlimit64", __NR_prlimit64}, |
@@ -4470,6 +4497,11 @@ | |||
4470 | {"pwritev", __NR_pwritev}, | 4497 | {"pwritev", __NR_pwritev}, |
4471 | #endif | 4498 | #endif |
4472 | #endif | 4499 | #endif |
4500 | #ifdef SYS_pwritev2 | ||
4501 | #ifdef __NR_pwritev2 | ||
4502 | {"pwritev2", __NR_pwritev2}, | ||
4503 | #endif | ||
4504 | #endif | ||
4473 | #ifdef SYS_quotactl | 4505 | #ifdef SYS_quotactl |
4474 | #ifdef __NR_quotactl | 4506 | #ifdef __NR_quotactl |
4475 | {"quotactl", __NR_quotactl}, | 4507 | {"quotactl", __NR_quotactl}, |
@@ -5111,3 +5143,5 @@ | |||
5111 | #endif | 5143 | #endif |
5112 | #endif | 5144 | #endif |
5113 | #endif | 5145 | #endif |
5146 | //#endif | ||
5147 | |||
diff --git a/test/appimage/appimage-args.exp b/test/appimage/appimage-args.exp index f304f5b94..b93ad509d 100755 --- a/test/appimage/appimage-args.exp +++ b/test/appimage/appimage-args.exp | |||
@@ -7,6 +7,7 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | set appimage_id $spawn_id | ||
10 | send -- "firejail --name=appimage-test --debug --appimage Leafpad-0.8.17-x86_64.AppImage testfile\r" | 11 | send -- "firejail --name=appimage-test --debug --appimage Leafpad-0.8.17-x86_64.AppImage testfile\r" |
11 | expect { | 12 | expect { |
12 | timeout {puts "TESTING ERROR 1\n";exit} | 13 | timeout {puts "TESTING ERROR 1\n";exit} |
@@ -91,7 +92,14 @@ after 100 | |||
91 | 92 | ||
92 | spawn $env(SHELL) | 93 | spawn $env(SHELL) |
93 | send -- "firejail --shutdown=appimage-test\r" | 94 | send -- "firejail --shutdown=appimage-test\r" |
94 | sleep 3 | 95 | |
96 | set spawn_id $appimage_id | ||
97 | expect { | ||
98 | timeout {puts "TESTING ERROR 15\n";exit} | ||
99 | "AppImage unmounted" | ||
100 | } | ||
101 | |||
102 | after 100 | ||
95 | 103 | ||
96 | puts "\nall done\n" | 104 | puts "\nall done\n" |
97 | 105 | ||
diff --git a/test/appimage/appimage-v1.exp b/test/appimage/appimage-v1.exp index d9b64af1d..3364ff677 100755 --- a/test/appimage/appimage-v1.exp +++ b/test/appimage/appimage-v1.exp | |||
@@ -6,6 +6,7 @@ | |||
6 | set timeout 10 | 6 | set timeout 10 |
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | set appimage_id $spawn_id | ||
9 | 10 | ||
10 | send -- "firejail --name=appimage-test --debug --appimage Leafpad-0.8.17-x86_64.AppImage\r" | 11 | send -- "firejail --name=appimage-test --debug --appimage Leafpad-0.8.17-x86_64.AppImage\r" |
11 | expect { | 12 | expect { |
@@ -79,7 +80,14 @@ after 100 | |||
79 | 80 | ||
80 | spawn $env(SHELL) | 81 | spawn $env(SHELL) |
81 | send -- "firejail --shutdown=appimage-test\r" | 82 | send -- "firejail --shutdown=appimage-test\r" |
82 | sleep 3 | 83 | |
84 | set spawn_id $appimage_id | ||
85 | expect { | ||
86 | timeout {puts "TESTING ERROR 7\n";exit} | ||
87 | "AppImage unmounted" | ||
88 | } | ||
89 | |||
90 | after 100 | ||
83 | 91 | ||
84 | puts "\nall done\n" | 92 | puts "\nall done\n" |
85 | 93 | ||
diff --git a/test/appimage/appimage-v2.exp b/test/appimage/appimage-v2.exp index 10443a1c7..ad741c559 100755 --- a/test/appimage/appimage-v2.exp +++ b/test/appimage/appimage-v2.exp | |||
@@ -6,8 +6,9 @@ | |||
6 | set timeout 10 | 6 | set timeout 10 |
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | set appimage_id $spawn_id | ||
9 | 10 | ||
10 | send -- "firejail --appimage Leafpad-0.8.18.1.glibc2.4-x86_64.AppImage\r" | 11 | send -- "firejail --name=appimage-test --appimage Leafpad-0.8.18.1.glibc2.4-x86_64.AppImage\r" |
11 | expect { | 12 | expect { |
12 | timeout {puts "TESTING ERROR 1\n";exit} | 13 | timeout {puts "TESTING ERROR 1\n";exit} |
13 | "Child process initialized" | 14 | "Child process initialized" |
@@ -79,7 +80,13 @@ after 100 | |||
79 | 80 | ||
80 | spawn $env(SHELL) | 81 | spawn $env(SHELL) |
81 | send -- "firejail --shutdown=appimage-test\r" | 82 | send -- "firejail --shutdown=appimage-test\r" |
82 | sleep 3 | 83 | set spawn_id $appimage_id |
84 | expect { | ||
85 | timeout {puts "TESTING ERROR 7\n";exit} | ||
86 | "AppImage unmounted" | ||
87 | } | ||
88 | |||
89 | after 100 | ||
83 | 90 | ||
84 | puts "\nall done\n" | 91 | puts "\nall done\n" |
85 | 92 | ||
diff --git a/test/apps-x11-xorg/apps-x11-xorg.sh b/test/apps-x11-xorg/apps-x11-xorg.sh index d39d8390e..7d1d681ab 100755 --- a/test/apps-x11-xorg/apps-x11-xorg.sh +++ b/test/apps-x11-xorg/apps-x11-xorg.sh | |||
@@ -24,12 +24,12 @@ else | |||
24 | echo "TESTING SKIP: transmission-gtk not found" | 24 | echo "TESTING SKIP: transmission-gtk not found" |
25 | fi | 25 | fi |
26 | 26 | ||
27 | which icedove | 27 | which thunderbird |
28 | if [ "$?" -eq 0 ]; | 28 | if [ "$?" -eq 0 ]; |
29 | then | 29 | then |
30 | echo "TESTING: icedove x11 xorg" | 30 | echo "TESTING: thunderbird x11 xorg" |
31 | ./icedove.exp | 31 | ./thunderbird.exp |
32 | else | 32 | else |
33 | echo "TESTING SKIP: icedove not found" | 33 | echo "TESTING SKIP: thunderbird not found" |
34 | fi | 34 | fi |
35 | 35 | ||
diff --git a/test/apps-x11-xorg/icedove.exp b/test/apps-x11-xorg/thunderbird.exp index 8f6722cd7..1626c732b 100755 --- a/test/apps-x11-xorg/icedove.exp +++ b/test/apps-x11-xorg/thunderbird.exp | |||
@@ -7,7 +7,7 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail --name=test --x11=xorg --ignore=net --ignore=netfilter --ignore=iprange icedove\r" | 10 | send -- "firejail --name=test --x11=xorg --ignore=net --ignore=netfilter --ignore=iprange thunderbird\r" |
11 | sleep 10 | 11 | sleep 10 |
12 | 12 | ||
13 | spawn $env(SHELL) | 13 | spawn $env(SHELL) |
@@ -18,7 +18,7 @@ expect { | |||
18 | } | 18 | } |
19 | expect { | 19 | expect { |
20 | timeout {puts "TESTING ERROR 3.1\n";exit} | 20 | timeout {puts "TESTING ERROR 3.1\n";exit} |
21 | "icedove" | 21 | "thunderbird" |
22 | } | 22 | } |
23 | sleep 1 | 23 | sleep 1 |
24 | 24 | ||
@@ -46,7 +46,7 @@ expect { | |||
46 | } | 46 | } |
47 | expect { | 47 | expect { |
48 | timeout {puts "TESTING ERROR 5.0\n";exit} | 48 | timeout {puts "TESTING ERROR 5.0\n";exit} |
49 | "icedove" | 49 | "thunderbird" |
50 | } | 50 | } |
51 | expect { | 51 | expect { |
52 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} | 52 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} |
@@ -64,7 +64,7 @@ expect { | |||
64 | } | 64 | } |
65 | expect { | 65 | expect { |
66 | timeout {puts "TESTING ERROR 6.0\n";exit} | 66 | timeout {puts "TESTING ERROR 6.0\n";exit} |
67 | "icedove" | 67 | "thunderbird" |
68 | } | 68 | } |
69 | expect { | 69 | expect { |
70 | timeout {puts "TESTING ERROR 6.1\n";exit} | 70 | timeout {puts "TESTING ERROR 6.1\n";exit} |
diff --git a/test/apps-x11/apps-x11.sh b/test/apps-x11/apps-x11.sh index 739a94f2e..965f1a56b 100755 --- a/test/apps-x11/apps-x11.sh +++ b/test/apps-x11/apps-x11.sh | |||
@@ -77,12 +77,12 @@ else | |||
77 | echo "TESTING SKIP: transmission-gtk not found" | 77 | echo "TESTING SKIP: transmission-gtk not found" |
78 | fi | 78 | fi |
79 | 79 | ||
80 | which icedove | 80 | which thunderbird |
81 | if [ "$?" -eq 0 ]; | 81 | if [ "$?" -eq 0 ]; |
82 | then | 82 | then |
83 | echo "TESTING: icedove x11" | 83 | echo "TESTING: thunderbird x11" |
84 | ./icedove.exp | 84 | ./thunderbird.exp |
85 | else | 85 | else |
86 | echo "TESTING SKIP: icedove not found" | 86 | echo "TESTING SKIP: thunderbird not found" |
87 | fi | 87 | fi |
88 | 88 | ||
diff --git a/test/apps-x11/icedove.exp b/test/apps-x11/thunderbird.exp index f81d814a7..060b5a760 100755 --- a/test/apps-x11/icedove.exp +++ b/test/apps-x11/thunderbird.exp | |||
@@ -7,7 +7,7 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail --name=test --x11 icedove\r" | 10 | send -- "firejail --name=test --x11 thunderbird\r" |
11 | sleep 10 | 11 | sleep 10 |
12 | 12 | ||
13 | spawn $env(SHELL) | 13 | spawn $env(SHELL) |
@@ -18,7 +18,7 @@ expect { | |||
18 | } | 18 | } |
19 | expect { | 19 | expect { |
20 | timeout {puts "TESTING ERROR 3.1\n";exit} | 20 | timeout {puts "TESTING ERROR 3.1\n";exit} |
21 | "icedove" | 21 | "thunderbird" |
22 | } | 22 | } |
23 | sleep 1 | 23 | sleep 1 |
24 | 24 | ||
@@ -46,7 +46,7 @@ expect { | |||
46 | } | 46 | } |
47 | expect { | 47 | expect { |
48 | timeout {puts "TESTING ERROR 5.0\n";exit} | 48 | timeout {puts "TESTING ERROR 5.0\n";exit} |
49 | "icedove" | 49 | "thunderbird" |
50 | } | 50 | } |
51 | expect { | 51 | expect { |
52 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} | 52 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} |
@@ -64,7 +64,7 @@ expect { | |||
64 | } | 64 | } |
65 | expect { | 65 | expect { |
66 | timeout {puts "TESTING ERROR 6.0\n";exit} | 66 | timeout {puts "TESTING ERROR 6.0\n";exit} |
67 | "icedove" | 67 | "thunderbird" |
68 | } | 68 | } |
69 | expect { | 69 | expect { |
70 | timeout {puts "TESTING ERROR 6.1\n";exit} | 70 | timeout {puts "TESTING ERROR 6.1\n";exit} |
diff --git a/test/apps/apps.sh b/test/apps/apps.sh index 4b7afe1a9..fc04f188b 100755 --- a/test/apps/apps.sh +++ b/test/apps/apps.sh | |||
@@ -106,13 +106,13 @@ else | |||
106 | echo "TESTING SKIP: gthumb not found" | 106 | echo "TESTING SKIP: gthumb not found" |
107 | fi | 107 | fi |
108 | 108 | ||
109 | which icedove | 109 | which thunderbird |
110 | if [ "$?" -eq 0 ]; | 110 | if [ "$?" -eq 0 ]; |
111 | then | 111 | then |
112 | echo "TESTING: icedove" | 112 | echo "TESTING: thunderbird" |
113 | ./icedove.exp | 113 | ./thunderbird.exp |
114 | else | 114 | else |
115 | echo "TESTING SKIP: icedove not found" | 115 | echo "TESTING SKIP: thunderbird not found" |
116 | fi | 116 | fi |
117 | 117 | ||
118 | which vlc | 118 | which vlc |
diff --git a/test/apps/icedove.exp b/test/apps/thunderbird.exp index 1acb59112..16b0dc60e 100755 --- a/test/apps/icedove.exp +++ b/test/apps/thunderbird.exp | |||
@@ -7,10 +7,10 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | send -- "firejail icedove\r" | 10 | send -- "firejail thunderbird\r" |
11 | expect { | 11 | expect { |
12 | timeout {puts "TESTING ERROR 0\n";exit} | 12 | timeout {puts "TESTING ERROR 0\n";exit} |
13 | "Reading profile /etc/firejail/icedove.profile" | 13 | "Reading profile /etc/firejail/thunderbird.profile" |
14 | } | 14 | } |
15 | expect { | 15 | expect { |
16 | timeout {puts "TESTING ERROR 1\n";exit} | 16 | timeout {puts "TESTING ERROR 1\n";exit} |
@@ -26,7 +26,7 @@ expect { | |||
26 | } | 26 | } |
27 | expect { | 27 | expect { |
28 | timeout {puts "TESTING ERROR 3.1\n";exit} | 28 | timeout {puts "TESTING ERROR 3.1\n";exit} |
29 | "icedove" | 29 | "thunderbird" |
30 | } | 30 | } |
31 | after 100 | 31 | after 100 |
32 | 32 | ||
@@ -50,7 +50,7 @@ send -- "firemon --seccomp\r" | |||
50 | expect { | 50 | expect { |
51 | timeout {puts "TESTING ERROR 5\n";exit} | 51 | timeout {puts "TESTING ERROR 5\n";exit} |
52 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} | 52 | "need to be root" {puts "/proc mounted as hidepid, exiting...\n"; exit} |
53 | ":firejail icedove" | 53 | ":firejail thunderbird" |
54 | } | 54 | } |
55 | expect { | 55 | expect { |
56 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} | 56 | timeout {puts "TESTING ERROR 5.1 (seccomp)\n";exit} |
@@ -64,7 +64,7 @@ after 100 | |||
64 | send -- "firemon --caps\r" | 64 | send -- "firemon --caps\r" |
65 | expect { | 65 | expect { |
66 | timeout {puts "TESTING ERROR 6\n";exit} | 66 | timeout {puts "TESTING ERROR 6\n";exit} |
67 | ":firejail icedove" | 67 | ":firejail thunderbird" |
68 | } | 68 | } |
69 | expect { | 69 | expect { |
70 | timeout {puts "TESTING ERROR 6.1\n";exit} | 70 | timeout {puts "TESTING ERROR 6.1\n";exit} |
diff --git a/test/environment/environment.sh b/test/environment/environment.sh index e2b9cb9d4..60ba7f245 100755 --- a/test/environment/environment.sh +++ b/test/environment/environment.sh | |||
@@ -10,6 +10,12 @@ export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) | |||
10 | echo "TESTING: DNS (test/environment/dns.exp)" | 10 | echo "TESTING: DNS (test/environment/dns.exp)" |
11 | ./dns.exp | 11 | ./dns.exp |
12 | 12 | ||
13 | echo "TESTING: machine-id (test/environment/machineid.exp)" | ||
14 | ./machineid.exp | ||
15 | |||
16 | echo "TESTING: hosts file (test/environment/hostfile.exp)" | ||
17 | ./hostfile.exp | ||
18 | |||
13 | echo "TESTING: doubledash (test/environment/doubledash.exp" | 19 | echo "TESTING: doubledash (test/environment/doubledash.exp" |
14 | mkdir -- -testdir | 20 | mkdir -- -testdir |
15 | touch -- -testdir/ttt | 21 | touch -- -testdir/ttt |
diff --git a/test/environment/hostfile b/test/environment/hostfile new file mode 100644 index 000000000..913f90c13 --- /dev/null +++ b/test/environment/hostfile | |||
@@ -0,0 +1 @@ | |||
hostfile test | |||
diff --git a/test/environment/hostfile.exp b/test/environment/hostfile.exp new file mode 100755 index 000000000..06003f744 --- /dev/null +++ b/test/environment/hostfile.exp | |||
@@ -0,0 +1,32 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2017 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | |||
7 | set timeout 10 | ||
8 | spawn $env(SHELL) | ||
9 | match_max 100000 | ||
10 | |||
11 | send -- "firejail --debug --hosts-file=hostfile\r" | ||
12 | expect { | ||
13 | timeout {puts "TESTING ERROR 1\n";exit} | ||
14 | "Loading user hosts file" | ||
15 | } | ||
16 | expect { | ||
17 | timeout {puts "TESTING ERROR 2\n";exit} | ||
18 | "Child process initialized" | ||
19 | } | ||
20 | after 100 | ||
21 | |||
22 | send -- "cat /etc/hosts\r" | ||
23 | expect { | ||
24 | timeout {puts "TESTING ERROR 3\n";exit} | ||
25 | "hostfile test" | ||
26 | } | ||
27 | |||
28 | send -- "exit\r" | ||
29 | after 100 | ||
30 | |||
31 | puts "\nall done\n" | ||
32 | |||
diff --git a/test/environment/machineid.exp b/test/environment/machineid.exp new file mode 100755 index 000000000..85510247b --- /dev/null +++ b/test/environment/machineid.exp | |||
@@ -0,0 +1,25 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2017 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | |||
7 | set timeout 10 | ||
8 | spawn $env(SHELL) | ||
9 | match_max 100000 | ||
10 | |||
11 | send -- "firejail --debug --machine-id\r" | ||
12 | expect { | ||
13 | timeout {puts "TESTING ERROR 1\n";exit} | ||
14 | "Generating a new machine-id" | ||
15 | } | ||
16 | expect { | ||
17 | timeout {puts "TESTING ERROR 1\n";exit} | ||
18 | "Child process initialized" | ||
19 | } | ||
20 | after 100 | ||
21 | send -- "exit\r" | ||
22 | after 100 | ||
23 | |||
24 | puts "\nall done\n" | ||
25 | |||
diff --git a/test/fs/mkdir.exp b/test/fs/mkdir.exp index 111db06db..81df7cd86 100755 --- a/test/fs/mkdir.exp +++ b/test/fs/mkdir.exp | |||
@@ -17,4 +17,11 @@ expect { | |||
17 | send -- "rm -rf ~/.firejail_test\r" | 17 | send -- "rm -rf ~/.firejail_test\r" |
18 | after 100 | 18 | after 100 |
19 | 19 | ||
20 | send -- "firejail --profile=mkdir2.profile\r" | ||
21 | expect { | ||
22 | timeout {puts "TESTING ERROR 2\n";exit} | ||
23 | "only directories in user home or /tmp" | ||
24 | } | ||
25 | after 100 | ||
26 | |||
20 | puts "\nall done\n" | 27 | puts "\nall done\n" |
diff --git a/test/fs/mkdir2.profile b/test/fs/mkdir2.profile new file mode 100644 index 000000000..28afb8d21 --- /dev/null +++ b/test/fs/mkdir2.profile | |||
@@ -0,0 +1 @@ | |||
mkdir /etc/somefile | |||
diff --git a/test/fs/mkdir_mkfile.exp b/test/fs/mkdir_mkfile.exp index e2e7d3ef0..28a5ae459 100755 --- a/test/fs/mkdir_mkfile.exp +++ b/test/fs/mkdir_mkfile.exp | |||
@@ -42,5 +42,14 @@ expect { | |||
42 | "_firejail_test_dir/dir1/dir2/dir3/file1" | 42 | "_firejail_test_dir/dir1/dir2/dir3/file1" |
43 | } | 43 | } |
44 | after 100 | 44 | after 100 |
45 | send -- "exit\r" | ||
46 | after 100 | ||
47 | |||
48 | send -- "firejail --profile=mkfile.profile\r" | ||
49 | expect { | ||
50 | timeout {puts "TESTING ERROR 1\n";exit} | ||
51 | "only files in user home or /tmp" | ||
52 | } | ||
53 | after 100 | ||
45 | 54 | ||
46 | puts "all done\n" | 55 | puts "all done\n" |
diff --git a/test/fs/mkfile.profile b/test/fs/mkfile.profile new file mode 100644 index 000000000..6b7fbb322 --- /dev/null +++ b/test/fs/mkfile.profile | |||
@@ -0,0 +1 @@ | |||
mkfile /etc/somefile | |||
diff --git a/test/network/configure b/test/network/configure index 35d938340..d4511c705 100755 --- a/test/network/configure +++ b/test/network/configure | |||
@@ -25,3 +25,6 @@ ip link add link eth0 name eth0.6 type vlan id 6 | |||
25 | ip link add link eth0 name eth0.7 type vlan id 7 | 25 | ip link add link eth0 name eth0.7 type vlan id 7 |
26 | /sbin/ifconfig eth0.7 10.10.207.10/24 up | 26 | /sbin/ifconfig eth0.7 10.10.207.10/24 up |
27 | 27 | ||
28 | # network namespace | ||
29 | ip netns add red | ||
30 | |||
diff --git a/test/network/netns.exp b/test/network/netns.exp new file mode 100755 index 000000000..9475cf958 --- /dev/null +++ b/test/network/netns.exp | |||
@@ -0,0 +1,34 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2017 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | spawn $env(SHELL) | ||
8 | match_max 100000 | ||
9 | |||
10 | send -- "firejail --netns=red --noprofile\r" | ||
11 | expect { | ||
12 | timeout {puts "TESTING ERROR 1\n";exit} | ||
13 | "Child process initialized" | ||
14 | } | ||
15 | after 100 | ||
16 | |||
17 | send -- "ip link show\r" | ||
18 | expect { | ||
19 | timeout {puts "TESTING ERROR 2\n";exit} | ||
20 | "LOOPBACK" | ||
21 | } | ||
22 | expect { | ||
23 | timeout {puts "TESTING ERROR 3\n";exit} | ||
24 | "DOWN" | ||
25 | } | ||
26 | expect { | ||
27 | timeout {puts "TESTING ERROR 4\n";exit} | ||
28 | "link/loopback" | ||
29 | } | ||
30 | after 100 | ||
31 | send -- "exit\r" | ||
32 | after 100 | ||
33 | |||
34 | puts "all done\n" | ||
diff --git a/test/network/network.sh b/test/network/network.sh index 2c60be0a5..c4c104042 100755 --- a/test/network/network.sh +++ b/test/network/network.sh | |||
@@ -11,6 +11,9 @@ sudo ./configure | |||
11 | echo "TESTING: firemon interface (firemon-interfaces.exp)" | 11 | echo "TESTING: firemon interface (firemon-interfaces.exp)" |
12 | sudo ./firemon-interfaces.exp | 12 | sudo ./firemon-interfaces.exp |
13 | 13 | ||
14 | echo "TESTING: netns (netns.exp)" | ||
15 | ./netns.exp | ||
16 | |||
14 | echo "TESTING: print dns (dns-print.exp)" | 17 | echo "TESTING: print dns (dns-print.exp)" |
15 | ./dns-print.exp | 18 | ./dns-print.exp |
16 | 19 | ||
diff --git a/test/root/cgroup.exp b/test/root/cgroup.exp new file mode 100755 index 000000000..4b07183a1 --- /dev/null +++ b/test/root/cgroup.exp | |||
@@ -0,0 +1,61 @@ | |||
1 | #!/usr/bin/expect -f | ||
2 | # This file is part of Firejail project | ||
3 | # Copyright (C) 2014-2017 Firejail Authors | ||
4 | # License GPL v2 | ||
5 | |||
6 | set timeout 10 | ||
7 | cd /home | ||
8 | spawn $env(SHELL) | ||
9 | match_max 100000 | ||
10 | |||
11 | |||
12 | send -- "mkdir /sys/fs/cgroup/systemd/firejail\r" | ||
13 | sleep 1 | ||
14 | send -- "ls /sys/fs/cgroup/systemd/firejail\r" | ||
15 | expect { | ||
16 | timeout {puts "TESTING ERROR 0\n";exit} | ||
17 | "tasks" | ||
18 | } | ||
19 | |||
20 | send -- "firejail --name=\"join testing\" --cgroup=/sys/fs/cgroup/systemd/firejail/tasks\r" | ||
21 | expect { | ||
22 | timeout {puts "TESTING ERROR 1\n";exit} | ||
23 | "Child process initialized" | ||
24 | } | ||
25 | sleep 2 | ||
26 | |||
27 | spawn $env(SHELL) | ||
28 | send -- "wc -l /sys/fs/cgroup/systemd/firejail/tasks\r" | ||
29 | expect { | ||
30 | timeout {puts "TESTING ERROR 2\n";exit} | ||
31 | "3" | ||
32 | } | ||
33 | |||
34 | spawn $env(SHELL) | ||
35 | send -- "firejail --join=\"join testing\"\r" | ||
36 | expect { | ||
37 | timeout {puts "TESTING ERROR 3\n";exit} | ||
38 | "Switching to pid" | ||
39 | } | ||
40 | sleep 1 | ||
41 | send -- "ps aux\r" | ||
42 | expect { | ||
43 | timeout {puts "TESTING ERROR 4\n";exit} | ||
44 | "/bin/bash" | ||
45 | } | ||
46 | expect { | ||
47 | timeout {puts "TESTING ERROR 5\n";exit} | ||
48 | "/bin/bash" | ||
49 | } | ||
50 | |||
51 | after 100 | ||
52 | |||
53 | spawn $env(SHELL) | ||
54 | send -- "wc -l /sys/fs/cgroup/systemd/firejail/tasks\r" | ||
55 | expect { | ||
56 | timeout {puts "TESTING ERROR 6\n";exit} | ||
57 | "3" | ||
58 | } | ||
59 | after 100 | ||
60 | |||
61 | puts "\nall done\n" | ||
diff --git a/test/root/checkcfg.exp b/test/root/checkcfg.exp index e1ec6cf79..205ef1e0c 100755 --- a/test/root/checkcfg.exp +++ b/test/root/checkcfg.exp | |||
@@ -8,13 +8,6 @@ cd /home | |||
8 | spawn $env(SHELL) | 8 | spawn $env(SHELL) |
9 | match_max 100000 | 9 | match_max 100000 |
10 | 10 | ||
11 | send -- "firejail --noprofile --overlay\r" | ||
12 | expect { | ||
13 | timeout {puts "TESTING ERROR 0\n";exit} | ||
14 | "Child process initialized" | ||
15 | } | ||
16 | sleep 2 | ||
17 | |||
18 | send -- "rm /etc/firejail/firejail.config\r" | 11 | send -- "rm /etc/firejail/firejail.config\r" |
19 | after 100 | 12 | after 100 |
20 | 13 | ||
@@ -27,18 +20,16 @@ expect { | |||
27 | # seccomp | 20 | # seccomp |
28 | send -- "echo \"seccomp no\" > /etc/firejail/firejail.config\r" | 21 | send -- "echo \"seccomp no\" > /etc/firejail/firejail.config\r" |
29 | after 100 | 22 | after 100 |
30 | send -- "firejail --noprofile --seccomp --force\r" | 23 | send -- "firejail --noprofile --seccomp\r" |
31 | expect { | 24 | expect { |
32 | timeout {puts "TESTING ERROR 2\n";exit} | 25 | timeout {puts "TESTING ERROR 2\n";exit} |
33 | "seccomp feature is disabled in Firejail configuration file\r" | 26 | "seccomp feature is disabled in Firejail configuration file\r" |
34 | } | 27 | } |
35 | send -- "exit\r" | ||
36 | after 100 | ||
37 | 28 | ||
38 | # whitelist | 29 | # whitelist |
39 | send -- "echo \"whitelist no\" > /etc/firejail/firejail.config\r" | 30 | send -- "echo \"whitelist no\" > /etc/firejail/firejail.config\r" |
40 | after 100 | 31 | after 100 |
41 | send -- "firejail --noprofile --whitelist=~/.config --force\r" | 32 | send -- "firejail --noprofile --whitelist=~/.config\r" |
42 | expect { | 33 | expect { |
43 | timeout {puts "TESTING ERROR 3\n";exit} | 34 | timeout {puts "TESTING ERROR 3\n";exit} |
44 | "whitelist feature is disabled in Firejail configuration file\r" | 35 | "whitelist feature is disabled in Firejail configuration file\r" |
@@ -47,7 +38,7 @@ expect { | |||
47 | # network | 38 | # network |
48 | send -- "echo \"network no\" > /etc/firejail/firejail.config\r" | 39 | send -- "echo \"network no\" > /etc/firejail/firejail.config\r" |
49 | after 100 | 40 | after 100 |
50 | send -- "firejail --noprofile --net=eth0 --force\r" | 41 | send -- "firejail --noprofile --net=eth0\r" |
51 | expect { | 42 | expect { |
52 | timeout {puts "TESTING ERROR 4\n";exit} | 43 | timeout {puts "TESTING ERROR 4\n";exit} |
53 | "networking feature is disabled in Firejail configuration file\r" | 44 | "networking feature is disabled in Firejail configuration file\r" |
@@ -56,7 +47,7 @@ expect { | |||
56 | # bind | 47 | # bind |
57 | send -- "echo \"bind no\" > /etc/firejail/firejail.config\r" | 48 | send -- "echo \"bind no\" > /etc/firejail/firejail.config\r" |
58 | after 100 | 49 | after 100 |
59 | send -- "firejail --noprofile --bind=/tmp,/var/tmp --force\r" | 50 | send -- "firejail --noprofile --bind=/tmp,/var/tmp\r" |
60 | expect { | 51 | expect { |
61 | timeout {puts "TESTING ERROR 5\n";exit} | 52 | timeout {puts "TESTING ERROR 5\n";exit} |
62 | "bind feature is disabled in Firejail configuration file\r" | 53 | "bind feature is disabled in Firejail configuration file\r" |
@@ -65,7 +56,7 @@ expect { | |||
65 | # overlay | 56 | # overlay |
66 | send -- "echo \"overlayfs no\" > /etc/firejail/firejail.config\r" | 57 | send -- "echo \"overlayfs no\" > /etc/firejail/firejail.config\r" |
67 | after 100 | 58 | after 100 |
68 | send -- "firejail --noprofile --overlay --force\r" | 59 | send -- "firejail --noprofile --overlay\r" |
69 | expect { | 60 | expect { |
70 | timeout {puts "TESTING ERROR 6\n";exit} | 61 | timeout {puts "TESTING ERROR 6\n";exit} |
71 | "overlayfs feature is disabled in Firejail configuration file\r" | 62 | "overlayfs feature is disabled in Firejail configuration file\r" |
@@ -74,7 +65,7 @@ expect { | |||
74 | # private-home | 65 | # private-home |
75 | send -- "echo \"private-home no\" > /etc/firejail/firejail.config\r" | 66 | send -- "echo \"private-home no\" > /etc/firejail/firejail.config\r" |
76 | after 100 | 67 | after 100 |
77 | send -- "firejail --noprofile --private-home=/tmp --force\r" | 68 | send -- "firejail --noprofile --private-home=/tmp\r" |
78 | expect { | 69 | expect { |
79 | timeout {puts "TESTING ERROR 7\n";exit} | 70 | timeout {puts "TESTING ERROR 7\n";exit} |
80 | "private-home feature is disabled in Firejail configuration file\r" | 71 | "private-home feature is disabled in Firejail configuration file\r" |
@@ -83,7 +74,7 @@ expect { | |||
83 | # chroot | 74 | # chroot |
84 | send -- "echo \"chroot no\" > /etc/firejail/firejail.config\r" | 75 | send -- "echo \"chroot no\" > /etc/firejail/firejail.config\r" |
85 | after 100 | 76 | after 100 |
86 | send -- "firejail --noprofile --chroot=/tmp --force\r" | 77 | send -- "firejail --noprofile --chroot=/tmp\r" |
87 | expect { | 78 | expect { |
88 | timeout {puts "TESTING ERROR 8\n";exit} | 79 | timeout {puts "TESTING ERROR 8\n";exit} |
89 | "chroot feature is disabled in Firejail configuration file\r" | 80 | "chroot feature is disabled in Firejail configuration file\r" |
@@ -92,15 +83,80 @@ expect { | |||
92 | # userns | 83 | # userns |
93 | send -- "echo \"userns no\" > /etc/firejail/firejail.config\r" | 84 | send -- "echo \"userns no\" > /etc/firejail/firejail.config\r" |
94 | after 100 | 85 | after 100 |
95 | send -- "firejail --noprofile --noroot --force\r" | 86 | send -- "firejail --noprofile --noroot\r" |
96 | expect { | 87 | expect { |
97 | timeout {puts "TESTING ERROR 9\n";exit} | 88 | timeout {puts "TESTING ERROR 9\n";exit} |
98 | "noroot feature is disabled in Firejail configuration file\r" | 89 | "noroot feature is disabled in Firejail configuration file\r" |
99 | } | 90 | } |
100 | 91 | ||
101 | send -- "exit\r" | 92 | # netfilter-default |
93 | send -- "echo \"netfilter-default blablabla\" > /etc/firejail/firejail.config\r" | ||
102 | after 100 | 94 | after 100 |
95 | send -- "firejail --noprofile\r" | ||
96 | expect { | ||
97 | timeout {puts "TESTING ERROR 10\n";exit} | ||
98 | "netfilter-default file blablabla not available\r" | ||
99 | } | ||
103 | 100 | ||
101 | # strings | ||
102 | send -- "echo \"xephyr-screen 800x600\" > /etc/firejail/firejail.config\r" | ||
103 | after 100 | ||
104 | send -- "echo \"xvfb-screen 800x600x24\" >> /etc/firejail/firejail.config\r" | ||
105 | after 100 | ||
106 | send -- "echo \"xvfb-extra-params blablabla\" >> /etc/firejail/firejail.config\r" | ||
107 | after 100 | ||
108 | send -- "firejail --noprofile\r" | ||
109 | expect { | ||
110 | timeout {puts "TESTING ERROR 11\n";exit} | ||
111 | "Child process initialized\r" | ||
112 | } | ||
113 | after 100 | ||
114 | send -- "exit\r" | ||
115 | after 100 | ||
104 | 116 | ||
117 | # error exit | ||
118 | send -- "echo \"join no\" > /etc/firejail/firejail.config\r" | ||
119 | after 100 | ||
120 | send -- "echo \"cache-tmpfs no\" >> /etc/firejail/firejail.config\r" | ||
121 | after 100 | ||
122 | send -- "echo \"file-transfer no\" >> /etc/firejail/firejail.config\r" | ||
123 | after 100 | ||
124 | send -- "echo \"x11 no\" >> /etc/firejail/firejail.config\r" | ||
125 | after 100 | ||
126 | send -- "echo \"firejail-prompt yes\" >> /etc/firejail/firejail.config\r" | ||
127 | after 100 | ||
128 | send -- "echo \"follow-symlink-as-user yes\" >> /etc/firejail/firejail.config\r" | ||
129 | after 100 | ||
130 | send -- "echo \"follow-symlink-private-bin yes\" >> /etc/firejail/firejail.config\r" | ||
131 | after 100 | ||
132 | send -- "echo \"force-nonewprivs yes\" >> /etc/firejail/firejail.config\r" | ||
133 | after 100 | ||
134 | send -- "echo \"seccomp no\" >> /etc/firejail/firejail.config\r" | ||
135 | after 100 | ||
136 | send -- "echo \"restricted-network yes\" >> /etc/firejail/firejail.config\r" | ||
137 | after 100 | ||
138 | send -- "echo \"xephyr-window-title yes\" >> /etc/firejail/firejail.config\r" | ||
139 | after 100 | ||
140 | send -- "echo \"quiet-by-default yes\" >> /etc/firejail/firejail.config\r" | ||
141 | after 100 | ||
142 | send -- "echo \"chroot-desktop no\" >> /etc/firejail/firejail.config\r" | ||
143 | after 100 | ||
144 | send -- "echo \"private-bin-no-local yes\" >> /etc/firejail/firejail.config\r" | ||
145 | after 100 | ||
146 | send -- "echo \"disable-mnt yes\" >> /etc/firejail/firejail.config\r" | ||
147 | after 100 | ||
148 | send -- "echo \"xephyr-window-title no\" >> /etc/firejail/firejail.config\r" | ||
149 | after 100 | ||
150 | send -- "echo \"remount-proc-sys no\" >> /etc/firejail/firejail.config\r" | ||
151 | after 100 | ||
152 | send -- "echo \"disable-mnt no\" >> /etc/firejail/firejail.config\r" | ||
153 | after 100 | ||
154 | send -- "echo \"blablabla\" >> /etc/firejail/firejail.config\r" | ||
155 | after 100 | ||
156 | send -- "firejail --noprofile\r" | ||
157 | expect { | ||
158 | timeout {puts "TESTING ERROR 12\n";exit} | ||
159 | "" | ||
160 | } | ||
105 | after 100 | 161 | after 100 |
106 | puts "\nall done\n" | 162 | puts "\nall done\n" |
diff --git a/test/root/firejail.config b/test/root/firejail.config index 71ff2f4e9..4ad5edd4d 100644 --- a/test/root/firejail.config +++ b/test/root/firejail.config | |||
@@ -1,8 +1,14 @@ | |||
1 | |||
1 | bind yes | 2 | bind yes |
2 | chroot yes | 3 | chroot yes |
3 | chroot-desktop yes | 4 | chroot-desktop yes |
5 | cache-tmpfs yes | ||
4 | file-transfer yes | 6 | file-transfer yes |
7 | firejail-prompt no | ||
8 | follow-symlink-as-user no | ||
9 | follow-symlink-private-bin no | ||
5 | force-nonewprivs no | 10 | force-nonewprivs no |
11 | join yes | ||
6 | network yes | 12 | network yes |
7 | overlayfs yes | 13 | overlayfs yes |
8 | private-bin-no-local no | 14 | private-bin-no-local no |
diff --git a/test/root/root.sh b/test/root/root.sh index e23499d2a..406e7dc4f 100755 --- a/test/root/root.sh +++ b/test/root/root.sh | |||
@@ -1,7 +1,7 @@ | |||
1 | #!/bin/bash | 1 | #!/bin/bash |
2 | 2 | ||
3 | # set a new firejail config file | 3 | # set a new firejail config file |
4 | cp firejail.config /etc/firejail/firejail.config | 4 | #cp firejail.config /etc/firejail/firejail.config |
5 | 5 | ||
6 | #******************************** | 6 | #******************************** |
7 | # servers | 7 | # servers |
@@ -82,6 +82,10 @@ echo "TESTING: seccomp chown (test/root/seccomp-chown.exp)" | |||
82 | #******************************** | 82 | #******************************** |
83 | echo "TESTING: firejail configuration (test/root/checkcfg.exp)" | 83 | echo "TESTING: firejail configuration (test/root/checkcfg.exp)" |
84 | ./checkcfg.exp | 84 | ./checkcfg.exp |
85 | cp ../../etc/firejail.config /etc/firejail/. | ||
86 | |||
87 | echo "TESTING: cgroup (test/root/cgroup.exp)" | ||
88 | ./cgroup.exp | ||
85 | 89 | ||
86 | echo "TESTING: tmpfs (test/root/option_tmpfs.exp)" | 90 | echo "TESTING: tmpfs (test/root/option_tmpfs.exp)" |
87 | ./option_tmpfs.exp | 91 | ./option_tmpfs.exp |
@@ -116,5 +120,5 @@ else | |||
116 | fi | 120 | fi |
117 | 121 | ||
118 | # restore the default config file | 122 | # restore the default config file |
119 | cp ../../etc/firejail.config /etc/firejail/firejail.config | 123 | #cp ../../etc/firejail.config /etc/firejail/firejail.config |
120 | 124 | ||
diff --git a/test/utils/join-profile.exp b/test/utils/join-profile.exp index a2078c2f6..716bd2947 100755 --- a/test/utils/join-profile.exp +++ b/test/utils/join-profile.exp | |||
@@ -29,7 +29,7 @@ expect { | |||
29 | "/bin/bash" | 29 | "/bin/bash" |
30 | } | 30 | } |
31 | 31 | ||
32 | send -- "exit" | 32 | send -- "exit\r" |
33 | after 100 | 33 | after 100 |
34 | 34 | ||
35 | puts "\nall done\n" | 35 | puts "\nall done\n" |
diff --git a/test/utils/join2.exp b/test/utils/join2.exp index b7d1f345f..0c1fa6684 100755 --- a/test/utils/join2.exp +++ b/test/utils/join2.exp | |||
@@ -32,7 +32,7 @@ expect { | |||
32 | "/bin/bash" | 32 | "/bin/bash" |
33 | } | 33 | } |
34 | 34 | ||
35 | send -- "exit" | 35 | send -- "exit\r" |
36 | after 100 | 36 | after 100 |
37 | 37 | ||
38 | puts "\nall done\n" | 38 | puts "\nall done\n" |
diff --git a/test/utils/join3.exp b/test/utils/join3.exp index c0cc7c2e4..968aa3008 100755 --- a/test/utils/join3.exp +++ b/test/utils/join3.exp | |||
@@ -32,7 +32,7 @@ expect { | |||
32 | "/bin/bash" | 32 | "/bin/bash" |
33 | } | 33 | } |
34 | 34 | ||
35 | send -- "exit" | 35 | send -- "exit\r" |
36 | after 100 | 36 | after 100 |
37 | 37 | ||
38 | puts "\nall done\n" | 38 | puts "\nall done\n" |
diff --git a/test/utils/join4.exp b/test/utils/join4.exp index c953320e0..27f52fd56 100755 --- a/test/utils/join4.exp +++ b/test/utils/join4.exp | |||
@@ -32,7 +32,7 @@ expect { | |||
32 | "/bin/bash" | 32 | "/bin/bash" |
33 | } | 33 | } |
34 | 34 | ||
35 | send -- "exit" | 35 | send -- "exit\r" |
36 | after 100 | 36 | after 100 |
37 | 37 | ||
38 | puts "\nall done\n" | 38 | puts "\nall done\n" |