diff options
43 files changed, 626 insertions, 83 deletions
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index 47e099cde..bf58e1dff 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md | |||
@@ -31,9 +31,9 @@ Steps to reproduce the behavior: | |||
31 | Other context about the problem like related errors to understand the problem. | 31 | Other context about the problem like related errors to understand the problem. |
32 | 32 | ||
33 | **Checklist** | 33 | **Checklist** |
34 | - [ ] The upstream profile (and redirect profile if exists) have no changes fixing it. | 34 | - [ ] The profile (and redirect profile if exists) hasn't already been fixed [upstream](https://github.com/netblue30/firejail/tree/master/etc). |
35 | - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) | 35 | - [ ] The program has a profile. (If not, request one in `https://github.com/netblue30/firejail/issues/1139`) |
36 | - [ ] A short search for duplicates was performed. | 36 | - [ ] I have performed a short search for similar issues (to avoid opening a duplicate). |
37 | - [ ] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. | 37 | - [ ] If it is a AppImage, `--profile=PROFILENAME` is used to set the right profile. |
38 | - [ ] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. | 38 | - [ ] Used `LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8 PROGRAM` to get english error-messages. |
39 | - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. | 39 | - [ ] I'm aware of `browser-allow-drm yes`/`browser-disable-u2f no` in `firejail.config` to allow DRM/U2F in browsers. |
@@ -69,7 +69,7 @@ Adrian L. Shaw (https://github.com/adrianlshaw) | |||
69 | - add profanity profile | 69 | - add profanity profile |
70 | - add barrirer profile | 70 | - add barrirer profile |
71 | Aidan Gauland (https://github.com/aidalgol) | 71 | Aidan Gauland (https://github.com/aidalgol) |
72 | - added electron and riot-web profiles | 72 | - added electron, riot-web and npm profiles |
73 | Akhil Hans Maulloo (https://github.com/kouul) | 73 | Akhil Hans Maulloo (https://github.com/kouul) |
74 | - xz profile | 74 | - xz profile |
75 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) | 75 | Alexey Kuznetsov (kuznet@ms2.inr.ac.ru) |
@@ -195,4 +195,4 @@ Stats: | |||
195 | 195 | ||
196 | ### New profiles: | 196 | ### New profiles: |
197 | 197 | ||
198 | spectacle, chromium-browser-privacy, gtk-straw-viewer, gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer, lutris, dolphin-emu, authenticator-rs, servo | 198 | spectacle, chromium-browser-privacy, gtk-straw-viewer, gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer, lutris, dolphin-emu, authenticator-rs, servo, tutanota-desktop, npm, marker, yarn, lsar, unar, agetpkg, mdr, shotwell, qnapi |
@@ -3,9 +3,11 @@ firejail (0.9.65) baseline; urgency=low | |||
3 | * --disable-usertmpfs compile time option | 3 | * --disable-usertmpfs compile time option |
4 | * allow AF_BLUETOOTH via --protocol=bluetooth | 4 | * allow AF_BLUETOOTH via --protocol=bluetooth |
5 | * Setup guide for new users: contrib/firejail-welcome.sh | 5 | * Setup guide for new users: contrib/firejail-welcome.sh |
6 | * implement netns in profiles | ||
6 | * new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer | 7 | * new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer |
7 | * new profiles: gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer | 8 | * new profiles: gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer |
8 | * new profiles: straw-viewer, lutris, dolphin-emu, authenticator-rs, servo | 9 | * new profiles: straw-viewer, lutris, dolphin-emu, authenticator-rs, servo |
10 | * new profiles: npm, marker | ||
9 | 11 | ||
10 | -- netblue30 <netblue30@yahoo.com> Wed, 21 Oct 2020 09:00:00 -0500 | 12 | -- netblue30 <netblue30@yahoo.com> Wed, 21 Oct 2020 09:00:00 -0500 |
11 | 13 | ||
diff --git a/etc/inc/allow-common-devel.inc b/etc/inc/allow-common-devel.inc index 7cd087b14..41643657d 100644 --- a/etc/inc/allow-common-devel.inc +++ b/etc/inc/allow-common-devel.inc | |||
@@ -11,6 +11,15 @@ noblacklist ${HOME}/.git-credentials | |||
11 | noblacklist ${HOME}/.gradle | 11 | noblacklist ${HOME}/.gradle |
12 | noblacklist ${HOME}/.java | 12 | noblacklist ${HOME}/.java |
13 | 13 | ||
14 | # Node.js | ||
15 | noblacklist ${HOME}/.node-gyp | ||
16 | noblacklist ${HOME}/.npm | ||
17 | noblacklist ${HOME}/.npmrc | ||
18 | noblacklist ${HOME}/.yarn | ||
19 | noblacklist ${HOME}/.yarn-config | ||
20 | noblacklist ${HOME}/.yarncache | ||
21 | noblacklist ${HOME}/.yarnrc | ||
22 | |||
14 | # Python | 23 | # Python |
15 | noblacklist ${HOME}/.pylint.d | 24 | noblacklist ${HOME}/.pylint.d |
16 | noblacklist ${HOME}/.python-history | 25 | noblacklist ${HOME}/.python-history |
diff --git a/etc/inc/allow-nodejs.inc b/etc/inc/allow-nodejs.inc new file mode 100644 index 000000000..78a4bed80 --- /dev/null +++ b/etc/inc/allow-nodejs.inc | |||
@@ -0,0 +1,6 @@ | |||
1 | # This file is overwritten during software install. | ||
2 | # Persistent customizations should go in a .local file. | ||
3 | include allow-nodejs.local | ||
4 | |||
5 | noblacklist ${PATH}/node | ||
6 | noblacklist /usr/include/node | ||
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index d88506d90..0de539d57 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -310,6 +310,7 @@ read-only ${HOME}/.msmtprc | |||
310 | read-only ${HOME}/.mutt/muttrc | 310 | read-only ${HOME}/.mutt/muttrc |
311 | read-only ${HOME}/.muttrc | 311 | read-only ${HOME}/.muttrc |
312 | read-only ${HOME}/.nano | 312 | read-only ${HOME}/.nano |
313 | read-only ${HOME}/.npmrc | ||
313 | read-only ${HOME}/.pythonrc.py | 314 | read-only ${HOME}/.pythonrc.py |
314 | read-only ${HOME}/.reportbugrc | 315 | read-only ${HOME}/.reportbugrc |
315 | read-only ${HOME}/.tmux.conf | 316 | read-only ${HOME}/.tmux.conf |
@@ -318,6 +319,7 @@ read-only ${HOME}/.viminfo | |||
318 | read-only ${HOME}/.vimrc | 319 | read-only ${HOME}/.vimrc |
319 | read-only ${HOME}/.xmonad | 320 | read-only ${HOME}/.xmonad |
320 | read-only ${HOME}/.xscreensaver | 321 | read-only ${HOME}/.xscreensaver |
322 | read-only ${HOME}/.yarnrc | ||
321 | read-only ${HOME}/_exrc | 323 | read-only ${HOME}/_exrc |
322 | read-only ${HOME}/_gvimrc | 324 | read-only ${HOME}/_gvimrc |
323 | read-only ${HOME}/_vimrc | 325 | read-only ${HOME}/_vimrc |
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 7ab11e620..26bcb987f 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -357,6 +357,7 @@ blacklist ${HOME}/.config/psi | |||
357 | blacklist ${HOME}/.config/psi+ | 357 | blacklist ${HOME}/.config/psi+ |
358 | blacklist ${HOME}/.config/qBittorrent | 358 | blacklist ${HOME}/.config/qBittorrent |
359 | blacklist ${HOME}/.config/qBittorrentrc | 359 | blacklist ${HOME}/.config/qBittorrentrc |
360 | blacklist ${HOME}/.config/qnapi.ini | ||
360 | blacklist ${HOME}/.config/qpdfview | 361 | blacklist ${HOME}/.config/qpdfview |
361 | blacklist ${HOME}/.config/qupzilla | 362 | blacklist ${HOME}/.config/qupzilla |
362 | blacklist ${HOME}/.config/qutebrowser | 363 | blacklist ${HOME}/.config/qutebrowser |
@@ -395,6 +396,8 @@ blacklist ${HOME}/.config/tox | |||
395 | blacklist ${HOME}/.config/transgui | 396 | blacklist ${HOME}/.config/transgui |
396 | blacklist ${HOME}/.config/transmission | 397 | blacklist ${HOME}/.config/transmission |
397 | blacklist ${HOME}/.config/truecraft | 398 | blacklist ${HOME}/.config/truecraft |
399 | blacklist ${HOME}/.config/tuta_integration | ||
400 | blacklist ${HOME}/.config/tutanota-desktop | ||
398 | blacklist ${HOME}/.config/tvbrowser | 401 | blacklist ${HOME}/.config/tvbrowser |
399 | blacklist ${HOME}/.config/uGet | 402 | blacklist ${HOME}/.config/uGet |
400 | blacklist ${HOME}/.config/ungoogled-chromium | 403 | blacklist ${HOME}/.config/ungoogled-chromium |
@@ -598,6 +601,7 @@ blacklist ${HOME}/.local/share/baloo | |||
598 | blacklist ${HOME}/.local/share/barrier | 601 | blacklist ${HOME}/.local/share/barrier |
599 | blacklist ${HOME}/.local/share/bibletime | 602 | blacklist ${HOME}/.local/share/bibletime |
600 | blacklist ${HOME}/.local/share/bijiben | 603 | blacklist ${HOME}/.local/share/bijiben |
604 | blacklist ${HOME}/.local/share/bohemiainteractive | ||
601 | blacklist ${HOME}/.local/share/caja-python | 605 | blacklist ${HOME}/.local/share/caja-python |
602 | blacklist ${HOME}/.local/share/cantata | 606 | blacklist ${HOME}/.local/share/cantata |
603 | blacklist ${HOME}/.local/share/cdprojektred | 607 | blacklist ${HOME}/.local/share/cdprojektred |
@@ -707,6 +711,7 @@ blacklist ${HOME}/.local/share/remmina | |||
707 | blacklist ${HOME}/.local/share/rhythmbox | 711 | blacklist ${HOME}/.local/share/rhythmbox |
708 | blacklist ${HOME}/.local/share/rtv | 712 | blacklist ${HOME}/.local/share/rtv |
709 | blacklist ${HOME}/.local/share/scribus | 713 | blacklist ${HOME}/.local/share/scribus |
714 | blacklist ${HOME}/.local/share/shotwell | ||
710 | blacklist ${HOME}/.local/share/signal-cli | 715 | blacklist ${HOME}/.local/share/signal-cli |
711 | blacklist ${HOME}/.local/share/sink | 716 | blacklist ${HOME}/.local/share/sink |
712 | blacklist ${HOME}/.local/share/smuxi | 717 | blacklist ${HOME}/.local/share/smuxi |
@@ -758,6 +763,9 @@ blacklist ${HOME}/.neverball | |||
758 | blacklist ${HOME}/.newsbeuter | 763 | blacklist ${HOME}/.newsbeuter |
759 | blacklist ${HOME}/.newsboat | 764 | blacklist ${HOME}/.newsboat |
760 | blacklist ${HOME}/.nicotine | 765 | blacklist ${HOME}/.nicotine |
766 | blacklist ${HOME}/.node-gyp | ||
767 | blacklist ${HOME}/.npm | ||
768 | blacklist ${HOME}/.npmrc | ||
761 | blacklist ${HOME}/.nv | 769 | blacklist ${HOME}/.nv |
762 | blacklist ${HOME}/.nylas-mail | 770 | blacklist ${HOME}/.nylas-mail |
763 | blacklist ${HOME}/.openarena | 771 | blacklist ${HOME}/.openarena |
@@ -844,6 +852,10 @@ blacklist ${HOME}/.xmr-stak | |||
844 | blacklist ${HOME}/.xonotic | 852 | blacklist ${HOME}/.xonotic |
845 | blacklist ${HOME}/.xournalpp | 853 | blacklist ${HOME}/.xournalpp |
846 | blacklist ${HOME}/.xpdfrc | 854 | blacklist ${HOME}/.xpdfrc |
855 | blacklist ${HOME}/.yarn | ||
856 | blacklist ${HOME}/.yarn-config | ||
857 | blacklist ${HOME}/.yarncache | ||
858 | blacklist ${HOME}/.yarnrc | ||
847 | blacklist ${HOME}/.zoom | 859 | blacklist ${HOME}/.zoom |
848 | blacklist /tmp/akonadi-* | 860 | blacklist /tmp/akonadi-* |
849 | blacklist /tmp/ssh-* | 861 | blacklist /tmp/ssh-* |
@@ -948,6 +960,7 @@ blacklist ${HOME}/.cache/librewolf | |||
948 | blacklist ${HOME}/.cache/liferea | 960 | blacklist ${HOME}/.cache/liferea |
949 | blacklist ${HOME}/.cache/lutris | 961 | blacklist ${HOME}/.cache/lutris |
950 | blacklist ${HOME}/.cache/Mendeley Ltd. | 962 | blacklist ${HOME}/.cache/Mendeley Ltd. |
963 | blacklist ${HOME}/.cache/marker | ||
951 | blacklist ${HOME}/.cache/matrix-mirage | 964 | blacklist ${HOME}/.cache/matrix-mirage |
952 | blacklist ${HOME}/.cache/microsoft-edge-dev | 965 | blacklist ${HOME}/.cache/microsoft-edge-dev |
953 | blacklist ${HOME}/.cache/midori | 966 | blacklist ${HOME}/.cache/midori |
@@ -983,6 +996,7 @@ blacklist ${HOME}/.cache/qBittorrent | |||
983 | blacklist ${HOME}/.cache/qupzilla | 996 | blacklist ${HOME}/.cache/qupzilla |
984 | blacklist ${HOME}/.cache/qutebrowser | 997 | blacklist ${HOME}/.cache/qutebrowser |
985 | blacklist ${HOME}/.cache/rhythmbox | 998 | blacklist ${HOME}/.cache/rhythmbox |
999 | blacklist ${HOME}/.cache/shotwell | ||
986 | blacklist ${HOME}/.cache/simple-scan | 1000 | blacklist ${HOME}/.cache/simple-scan |
987 | blacklist ${HOME}/.cache/slimjet | 1001 | blacklist ${HOME}/.cache/slimjet |
988 | blacklist ${HOME}/.cache/smuxi | 1002 | blacklist ${HOME}/.cache/smuxi |
diff --git a/etc/profile-a-l/agetpkg.profile b/etc/profile-a-l/agetpkg.profile new file mode 100644 index 000000000..6d5dab41a --- /dev/null +++ b/etc/profile-a-l/agetpkg.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for agetpkg | ||
2 | # Description: CLI tool to list/get/install packages from the Arch Linux Archive | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include agetpkg.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | |||
13 | # Allow python (blacklisted by disable-interpreters.inc) | ||
14 | #include allow-python2.inc | ||
15 | include allow-python3.inc | ||
16 | |||
17 | include disable-common.inc | ||
18 | include disable-devel.inc | ||
19 | include disable-exec.inc | ||
20 | include disable-interpreters.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | whitelist ${DOWNLOADS} | ||
27 | include whitelist-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | |||
31 | caps.drop all | ||
32 | hostname agetpkg | ||
33 | ipc-namespace | ||
34 | machine-id | ||
35 | noautopulse | ||
36 | netfilter | ||
37 | no3d | ||
38 | nodvd | ||
39 | nogroups | ||
40 | nonewprivs | ||
41 | noroot | ||
42 | nosound | ||
43 | notv | ||
44 | nou2f | ||
45 | novideo | ||
46 | protocol inet,inet6 | ||
47 | seccomp | ||
48 | shell none | ||
49 | tracelog | ||
50 | |||
51 | private-bin agetpkg,python3 | ||
52 | private-cache | ||
53 | private-dev | ||
54 | private-etc ca-certificates,crypto-policies,pki,resolv.conf,ssl | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
59 | |||
60 | memory-deny-write-execute | ||
diff --git a/etc/profile-a-l/apostrophe.profile b/etc/profile-a-l/apostrophe.profile index 9c0b92598..4986ac63a 100644 --- a/etc/profile-a-l/apostrophe.profile +++ b/etc/profile-a-l/apostrophe.profile | |||
@@ -9,6 +9,9 @@ include globals.local | |||
9 | noblacklist ${DOCUMENTS} | 9 | noblacklist ${DOCUMENTS} |
10 | noblacklist ${PICTURES} | 10 | noblacklist ${PICTURES} |
11 | 11 | ||
12 | # Allow lua (blacklisted by disable-interpreters.inc) | ||
13 | include allow-lua.inc | ||
14 | |||
12 | # Allow python (blacklisted by disable-interpreters.inc) | 15 | # Allow python (blacklisted by disable-interpreters.inc) |
13 | include allow-python3.inc | 16 | include allow-python3.inc |
14 | 17 | ||
diff --git a/etc/profile-a-l/atom.profile b/etc/profile-a-l/atom.profile index f21a5febf..5f237ac59 100644 --- a/etc/profile-a-l/atom.profile +++ b/etc/profile-a-l/atom.profile | |||
@@ -25,7 +25,6 @@ noblacklist ${HOME}/.config/Atom | |||
25 | include allow-common-devel.inc | 25 | include allow-common-devel.inc |
26 | 26 | ||
27 | # net none | 27 | # net none |
28 | netfilter | ||
29 | nosound | 28 | nosound |
30 | 29 | ||
31 | # Redirect | 30 | # Redirect |
diff --git a/etc/profile-a-l/balsa.profile b/etc/profile-a-l/balsa.profile index cda6b1aa0..d755fd803 100644 --- a/etc/profile-a-l/balsa.profile +++ b/etc/profile-a-l/balsa.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.balsa | 9 | noblacklist ${HOME}/.balsa |
10 | noblacklist ${HOME}/.gnupg | 10 | noblacklist ${HOME}/.gnupg |
11 | noblacklist ${HOME}/.mozilla | 11 | noblacklist ${HOME}/.mozilla |
12 | noblacklist ${HOME}/.signature | ||
12 | noblacklist ${HOME}/mail | 13 | noblacklist ${HOME}/mail |
13 | noblacklist /var/mail | 14 | noblacklist /var/mail |
14 | noblacklist /var/spool/mail | 15 | noblacklist /var/spool/mail |
@@ -24,10 +25,12 @@ include disable-xdg.inc | |||
24 | 25 | ||
25 | mkdir ${HOME}/.balsa | 26 | mkdir ${HOME}/.balsa |
26 | mkdir ${HOME}/.gnupg | 27 | mkdir ${HOME}/.gnupg |
28 | mkfile ${HOME}/.signature | ||
27 | mkdir ${HOME}/mail | 29 | mkdir ${HOME}/mail |
28 | whitelist ${HOME}/.balsa | 30 | whitelist ${HOME}/.balsa |
29 | whitelist ${HOME}/.gnupg | 31 | whitelist ${HOME}/.gnupg |
30 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | 32 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
33 | whitelist ${HOME}/.signature | ||
31 | whitelist ${HOME}/mail | 34 | whitelist ${HOME}/mail |
32 | whitelist ${RUNUSER}/gnupg | 35 | whitelist ${RUNUSER}/gnupg |
33 | whitelist /usr/share/balsa | 36 | whitelist /usr/share/balsa |
@@ -58,9 +61,9 @@ shell none | |||
58 | tracelog | 61 | tracelog |
59 | 62 | ||
60 | # disable-mnt | 63 | # disable-mnt |
61 | # Add "gpg,gpg2,gpg-agent,pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg | 64 | # Add "pinentry-curses,pinentry-emacs,pinentry-fltk,pinentry-gnome3,pinentry-gtk,pinentry-gtk2,pinentry-gtk-2,pinentry-qt,pinentry-qt4,pinentry-tty,pinentry-x2go,pinentry-kwallet" for gpg |
62 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. | 65 | # Add "ignore private-bin" for hyperlinks or have a look at the private-bins in firefox.profile and firefox-common.profile. |
63 | private-bin balsa,balsa-ab | 66 | private-bin balsa,balsa-ab,gpg,gpg-agent,gpg2,gpgsm |
64 | private-cache | 67 | private-cache |
65 | private-dev | 68 | private-dev |
66 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg | 69 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gcrypt,groups,gtk-2.0,gtk-3.0,hostname,hosts,mailname,passwd,pki,resolv.conf,selinux,ssl,xdg |
@@ -71,8 +74,9 @@ writable-var | |||
71 | dbus-user filter | 74 | dbus-user filter |
72 | dbus-user.own org.desktop.Balsa | 75 | dbus-user.own org.desktop.Balsa |
73 | dbus-user.talk ca.desrt.dconf | 76 | dbus-user.talk ca.desrt.dconf |
74 | dbus-user.talk org.freedesktop.secrets | ||
75 | dbus-user.talk org.freedesktop.Notifications | 77 | dbus-user.talk org.freedesktop.Notifications |
78 | dbus-user.talk org.freedesktop.secrets | ||
79 | dbus-user.talk org.gnome.keyring.SystemPrompter | ||
76 | dbus-system none | 80 | dbus-system none |
77 | 81 | ||
78 | read-only ${HOME}/.mozilla/firefox/profiles.ini | 82 | read-only ${HOME}/.mozilla/firefox/profiles.ini \ No newline at end of file |
diff --git a/etc/profile-a-l/discord-common.profile b/etc/profile-a-l/discord-common.profile index e6edbd7eb..b583f1a1d 100644 --- a/etc/profile-a-l/discord-common.profile +++ b/etc/profile-a-l/discord-common.profile | |||
@@ -23,7 +23,7 @@ whitelist ${HOME}/.config/BetterDiscord | |||
23 | whitelist ${HOME}/.local/share/betterdiscordctl | 23 | whitelist ${HOME}/.local/share/betterdiscordctl |
24 | 24 | ||
25 | private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh | 25 | private-bin bash,cut,echo,egrep,fish,grep,head,sed,sh,tclsh,tr,xdg-mime,xdg-open,zsh |
26 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,resolv.conf,ssl | 26 | private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl |
27 | 27 | ||
28 | # Redirect | 28 | # Redirect |
29 | include electron.profile | 29 | include electron.profile |
diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index c0c16e929..25d5196fc 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -6,6 +6,10 @@ include evince.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Uncomment this line and the bottom ones to use bookmarks | ||
10 | # NOTE: This possibly exposes information, including file history from other programs. | ||
11 | #noblacklist ${HOME}/.local/share/gvfs-metadata | ||
12 | |||
9 | noblacklist ${HOME}/.config/evince | 13 | noblacklist ${HOME}/.config/evince |
10 | noblacklist ${DOCUMENTS} | 14 | noblacklist ${DOCUMENTS} |
11 | 15 | ||
@@ -54,5 +58,8 @@ private-lib evince,gcc/*/*/libgcc_s.so.*,gcc/*/*/libstdc++.so.*,gconv,gdk-pixbuf | |||
54 | private-tmp | 58 | private-tmp |
55 | 59 | ||
56 | # might break two-page-view on some systems | 60 | # might break two-page-view on some systems |
57 | dbus-user none | 61 | dbus-user filter |
62 | # Also uncomment these two lines if you want to use bookmarks | ||
63 | #dbus-user.talk org.gtk.vfs.Daemon | ||
64 | #dbus-user.talk org.gtk.vfs.Metadata | ||
58 | dbus-system none | 65 | dbus-system none |
diff --git a/etc/profile-a-l/fractal.profile b/etc/profile-a-l/fractal.profile index c3af29e15..dc8d6e3ad 100644 --- a/etc/profile-a-l/fractal.profile +++ b/etc/profile-a-l/fractal.profile | |||
@@ -8,6 +8,9 @@ include globals.local | |||
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/fractal | 9 | noblacklist ${HOME}/.cache/fractal |
10 | 10 | ||
11 | include allow-python2.inc | ||
12 | include allow-python3.inc | ||
13 | |||
11 | include disable-common.inc | 14 | include disable-common.inc |
12 | include disable-devel.inc | 15 | include disable-devel.inc |
13 | include disable-exec.inc | 16 | include disable-exec.inc |
@@ -49,6 +52,6 @@ private-tmp | |||
49 | dbus-user filter | 52 | dbus-user filter |
50 | dbus-user.own org.gnome.Fractal | 53 | dbus-user.own org.gnome.Fractal |
51 | dbus-user.talk ca.desrt.dconf | 54 | dbus-user.talk ca.desrt.dconf |
52 | dbus-user.talk org.freedesktop.secrets | ||
53 | dbus-user.talk org.freedesktop.Notifications | 55 | dbus-user.talk org.freedesktop.Notifications |
56 | dbus-user.talk org.freedesktop.secrets | ||
54 | dbus-system none | 57 | dbus-system none |
diff --git a/etc/profile-a-l/gajim.profile b/etc/profile-a-l/gajim.profile index 85d9b9bd9..125ddf79c 100644 --- a/etc/profile-a-l/gajim.profile +++ b/etc/profile-a-l/gajim.profile | |||
@@ -6,6 +6,7 @@ include gajim.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.gnupg | ||
9 | noblacklist ${HOME}/.cache/gajim | 10 | noblacklist ${HOME}/.cache/gajim |
10 | noblacklist ${HOME}/.config/gajim | 11 | noblacklist ${HOME}/.config/gajim |
11 | noblacklist ${HOME}/.local/share/gajim | 12 | noblacklist ${HOME}/.local/share/gajim |
@@ -20,19 +21,27 @@ include disable-exec.inc | |||
20 | include disable-interpreters.inc | 21 | include disable-interpreters.inc |
21 | include disable-passwdmgr.inc | 22 | include disable-passwdmgr.inc |
22 | include disable-programs.inc | 23 | include disable-programs.inc |
23 | # Comment the following line if you need to whitelist other folders than ~/Downloads | 24 | # Comment the following line if you need to whitelist folders other than ~/Downloads |
24 | include disable-xdg.inc | 25 | include disable-xdg.inc |
25 | 26 | ||
27 | mkdir ${HOME}/.gnupg | ||
26 | mkdir ${HOME}/.cache/gajim | 28 | mkdir ${HOME}/.cache/gajim |
27 | mkdir ${HOME}/.config/gajim | 29 | mkdir ${HOME}/.config/gajim |
28 | mkdir ${HOME}/.local/share/gajim | 30 | mkdir ${HOME}/.local/share/gajim |
31 | whitelist ${HOME}/.gnupg | ||
29 | whitelist ${HOME}/.cache/gajim | 32 | whitelist ${HOME}/.cache/gajim |
30 | whitelist ${HOME}/.config/gajim | 33 | whitelist ${HOME}/.config/gajim |
31 | whitelist ${HOME}/.local/share/gajim | 34 | whitelist ${HOME}/.local/share/gajim |
32 | whitelist ${DOWNLOADS} | 35 | whitelist ${DOWNLOADS} |
36 | whitelist ${RUNUSER}/gnupg | ||
37 | whitelist /usr/share/gnupg | ||
38 | whitelist /usr/share/gnupg2 | ||
33 | include whitelist-common.inc | 39 | include whitelist-common.inc |
40 | include whitelist-runuser-common.inc | ||
41 | include whitelist-usr-share-common.inc | ||
34 | include whitelist-var-common.inc | 42 | include whitelist-var-common.inc |
35 | 43 | ||
44 | apparmor | ||
36 | caps.drop all | 45 | caps.drop all |
37 | netfilter | 46 | netfilter |
38 | nodvd | 47 | nodvd |
@@ -47,9 +56,24 @@ shell none | |||
47 | tracelog | 56 | tracelog |
48 | 57 | ||
49 | disable-mnt | 58 | disable-mnt |
50 | private-bin bash,gajim,gajim-history-manager,gpg,gpg2,paplay,python,python3,sh,zsh | 59 | private-bin bash,gajim,gajim-history-manager,gpg,gpg2,paplay,python*,sh,zsh |
60 | private-cache | ||
51 | private-dev | 61 | private-dev |
52 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl | 62 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,hostname,hosts,ld.so.cache,ld.so.conf,localtime,machine-id,passwd,pki,pulse,resolv.conf,ssl,xdg |
53 | private-tmp | 63 | private-tmp |
64 | writable-run-user | ||
65 | |||
66 | dbus-user filter | ||
67 | dbus-user.own org.gajim.Gajim | ||
68 | dbus-user.talk org.gnome.Mutter.IdleMonitor | ||
69 | dbus-user.talk ca.desrt.dconf | ||
70 | dbus-user.talk org.freedesktop.Notifications | ||
71 | dbus-user.talk org.freedesktop.secrets | ||
72 | dbus-user.talk org.kde.kwalletd5 | ||
73 | dbus-user.talk org.mpris.MediaPlayer2.* | ||
74 | dbus-system filter | ||
75 | dbus-system.talk org.freedesktop.login1 | ||
76 | # Uncomment for location plugin support | ||
77 | #dbus-system.talk org.freedesktop.GeoClue2 | ||
54 | 78 | ||
55 | join-or-start gajim | 79 | join-or-start gajim |
diff --git a/etc/profile-a-l/liferea.profile b/etc/profile-a-l/liferea.profile index 7cfd4fc10..a122e9bbc 100644 --- a/etc/profile-a-l/liferea.profile +++ b/etc/profile-a-l/liferea.profile | |||
@@ -42,7 +42,7 @@ noroot | |||
42 | # nosound | 42 | # nosound |
43 | notv | 43 | notv |
44 | nou2f | 44 | nou2f |
45 | # novideo | 45 | novideo |
46 | protocol unix,inet,inet6 | 46 | protocol unix,inet,inet6 |
47 | seccomp | 47 | seccomp |
48 | shell none | 48 | shell none |
@@ -51,3 +51,12 @@ tracelog | |||
51 | disable-mnt | 51 | disable-mnt |
52 | private-dev | 52 | private-dev |
53 | private-tmp | 53 | private-tmp |
54 | |||
55 | dbus-user filter | ||
56 | dbus-user.own net.sourceforge.liferea | ||
57 | dbus-user.talk ca.desrt.dconf | ||
58 | # Uncomment the below if you use the 'Popup Notifications' plugin or add 'dbus-user.talk org.freedesktop.Notifications' to your liferea.local | ||
59 | #dbus-user.talk org.freedesktop.Notifications | ||
60 | # Uncomment the below if you use the 'Libsecret Support' plugin or add 'dbus-user.talk org.freedesktop.secrets' to your liferea.local | ||
61 | #dbus-user.talk org.freedesktop.secrets | ||
62 | dbus-system none | ||
diff --git a/etc/profile-a-l/lsar.profile b/etc/profile-a-l/lsar.profile new file mode 100644 index 000000000..faf5bb7f9 --- /dev/null +++ b/etc/profile-a-l/lsar.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for lsar | ||
2 | # This file is overwritten after every install/update | ||
3 | quiet | ||
4 | # Persistent local customizations | ||
5 | include lsar.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | private-bin lsar | ||
11 | |||
12 | # Redirect | ||
13 | include ar.profile | ||
diff --git a/etc/profile-m-z/marker.profile b/etc/profile-m-z/marker.profile new file mode 100644 index 000000000..55865fe72 --- /dev/null +++ b/etc/profile-m-z/marker.profile | |||
@@ -0,0 +1,59 @@ | |||
1 | # Firejail profile for marker | ||
2 | # Description: Marker is a markdown editor for Linux made with Gtk+-3.0 | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include marker.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Uncomment (or add to your marker.local) if you need internet access. | ||
10 | #ignore net none | ||
11 | #protocol unix,inet,inet6 | ||
12 | #private-etc ca-certificates,ssl,pki,crypto-policies,nsswitch.conf,resolv.conf | ||
13 | |||
14 | noblacklist ${HOME}/.cache/marker | ||
15 | |||
16 | include disable-common.inc | ||
17 | include disable-devel.inc | ||
18 | include disable-exec.inc | ||
19 | include disable-interpreters.inc | ||
20 | include disable-passwdmgr.inc | ||
21 | include disable-programs.inc | ||
22 | include disable-shell.inc | ||
23 | include disable-xdg.inc | ||
24 | |||
25 | whitelist /usr/share/com.github.fabiocolacio.marker | ||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | machine-id | ||
33 | net none | ||
34 | netfilter | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix | ||
45 | seccomp | ||
46 | seccomp.block-secondary | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | private-bin marker | ||
51 | private-cache | ||
52 | private-dev | ||
53 | private-etc alternatives,dconfgtk-3.0,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,pango,X11 | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user filter | ||
57 | dbus-user.own com.github.fabiocolacio.marker | ||
58 | dbus-user.talk ca.desrt.dconf | ||
59 | dbus-system none | ||
diff --git a/etc/profile-m-z/mattermost-desktop.profile b/etc/profile-m-z/mattermost-desktop.profile index e4487c8aa..3c2bf4fa3 100644 --- a/etc/profile-m-z/mattermost-desktop.profile +++ b/etc/profile-m-z/mattermost-desktop.profile | |||
@@ -5,42 +5,25 @@ include mattermost-desktop.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # Disabled until someone reported positive feedback | ||
9 | ignore apparmor | ||
10 | ignore dbus-user none | ||
11 | ignore dbus-system none | ||
12 | |||
8 | noblacklist ${HOME}/.config/Mattermost | 13 | noblacklist ${HOME}/.config/Mattermost |
9 | 14 | ||
10 | include disable-common.inc | ||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-shell.inc | 15 | include disable-shell.inc |
17 | include disable-xdg.inc | ||
18 | 16 | ||
19 | mkdir ${HOME}/.config/Mattermost | 17 | mkdir ${HOME}/.config/Mattermost |
20 | whitelist ${DOWNLOADS} | ||
21 | whitelist ${HOME}/.config/Mattermost | 18 | whitelist ${HOME}/.config/Mattermost |
22 | include whitelist-common.inc | ||
23 | include whitelist-runuser-common.inc | ||
24 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | ||
26 | |||
27 | caps.keep sys_admin,sys_chroot | ||
28 | netfilter | ||
29 | nodvd | ||
30 | nogroups | ||
31 | notv | ||
32 | nou2f | ||
33 | novideo | ||
34 | shell none | ||
35 | 19 | ||
36 | disable-mnt | ||
37 | private-cache | ||
38 | private-dev | ||
39 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | 20 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl |
40 | private-tmp | ||
41 | 21 | ||
42 | # Not tested | 22 | # Not tested |
43 | #dbus-user filter | 23 | #dbus-user filter |
44 | #dbus-user.own com.mattermost.Desktop | 24 | #dbus-user.own com.mattermost.Desktop |
45 | #dbus-user.talk org.freedesktop.Notifications | 25 | #dbus-user.talk org.freedesktop.Notifications |
46 | #dbus-system none | 26 | #dbus-system none |
27 | |||
28 | # Redirect | ||
29 | include electron.profile | ||
diff --git a/etc/profile-m-z/mdr.profile b/etc/profile-m-z/mdr.profile new file mode 100644 index 000000000..fb97daa27 --- /dev/null +++ b/etc/profile-m-z/mdr.profile | |||
@@ -0,0 +1,55 @@ | |||
1 | # Firejail profile for mdr | ||
2 | # Description: A standalone Markdown renderer for the terminal | ||
3 | # Persistent local customizations | ||
4 | include mdr.local | ||
5 | # Persistent global definitions | ||
6 | include globals.local | ||
7 | |||
8 | blacklist ${RUNUSER}/wayland-* | ||
9 | |||
10 | include disable-common.inc | ||
11 | include disable-devel.inc | ||
12 | include disable-exec.inc | ||
13 | include disable-interpreters.inc | ||
14 | include disable-passwdmgr.inc | ||
15 | include disable-programs.inc | ||
16 | include disable-shell.inc | ||
17 | include disable-xdg.inc | ||
18 | |||
19 | whitelist ${DOWNLOADS} | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | hostname mdr | ||
26 | ipc-namespace | ||
27 | machine-id | ||
28 | net none | ||
29 | no3d | ||
30 | nodvd | ||
31 | nogroups | ||
32 | nonewprivs | ||
33 | noroot | ||
34 | nosound | ||
35 | notv | ||
36 | nou2f | ||
37 | novideo | ||
38 | protocol unix | ||
39 | seccomp | ||
40 | shell none | ||
41 | tracelog | ||
42 | x11 none | ||
43 | |||
44 | disable-mnt | ||
45 | private-bin mdr | ||
46 | private-cache | ||
47 | private-dev | ||
48 | private-etc none | ||
49 | private-lib | ||
50 | private-tmp | ||
51 | |||
52 | dbus-user none | ||
53 | dbus-system none | ||
54 | |||
55 | memory-deny-write-execute | ||
diff --git a/etc/profile-m-z/nodejs-common.profile b/etc/profile-m-z/nodejs-common.profile new file mode 100644 index 000000000..acef622c2 --- /dev/null +++ b/etc/profile-m-z/nodejs-common.profile | |||
@@ -0,0 +1,54 @@ | |||
1 | # Firejail profile for Node.js | ||
2 | # Description: Common profile for npm/yarn | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include nodejs-common.local | ||
6 | # Persistent global definitions | ||
7 | # added by caller profile | ||
8 | #include globals.local | ||
9 | |||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER} | ||
12 | |||
13 | ignore noexec ${HOME} | ||
14 | |||
15 | noblacklist ${PATH}/bash | ||
16 | noblacklist ${PATH}/dash | ||
17 | noblacklist ${PATH}/sh | ||
18 | |||
19 | include disable-common.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-passwdmgr.inc | ||
22 | include disable-programs.inc | ||
23 | include disable-shell.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | include whitelist-runuser-common.inc | ||
27 | include whitelist-usr-share-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | caps.drop all | ||
31 | ipc-namespace | ||
32 | machine-id | ||
33 | netfilter | ||
34 | no3d | ||
35 | nodvd | ||
36 | nogroups | ||
37 | nonewprivs | ||
38 | noroot | ||
39 | nosound | ||
40 | notv | ||
41 | nou2f | ||
42 | novideo | ||
43 | protocol unix,inet,inet6,netlink | ||
44 | seccomp | ||
45 | seccomp.block-secondary | ||
46 | shell none | ||
47 | |||
48 | disable-mnt | ||
49 | private-dev | ||
50 | private-etc alternatives,ca-certificates,crypto-policies,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,login.defs,mime.types,nsswitch.conf,pki,protocols,resolv.conf,rpc,services,ssl,xdg | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user none | ||
54 | dbus-system none | ||
diff --git a/etc/profile-m-z/npm.profile b/etc/profile-m-z/npm.profile new file mode 100644 index 000000000..e95e875be --- /dev/null +++ b/etc/profile-m-z/npm.profile | |||
@@ -0,0 +1,29 @@ | |||
1 | # Firejail profile for npm | ||
2 | # Description: The Node.js Package Manager | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include npm.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | ignore read-only ${HOME}/.npm-packages | ||
11 | ignore read-only ${HOME}/.npmrc | ||
12 | |||
13 | noblacklist ${HOME}/.node-gyp | ||
14 | noblacklist ${HOME}/.npm | ||
15 | noblacklist ${HOME}/.npmrc | ||
16 | |||
17 | # If you want whitelisting, change ${HOME}/Projects below to your npm projects directory | ||
18 | # and uncomment the lines below. | ||
19 | #mkdir ${HOME}/.node-gyp | ||
20 | #mkdir ${HOME}/.npm | ||
21 | #mkfile ${HOME}/.npmrc | ||
22 | #whitelist ${HOME}/.node-gyp | ||
23 | #whitelist ${HOME}/.npm | ||
24 | #whitelist ${HOME}/.npmrc | ||
25 | #whitelist ${HOME}/Projects | ||
26 | #include whitelist-common.inc | ||
27 | |||
28 | # Redirect | ||
29 | include nodejs-common.profile | ||
diff --git a/etc/profile-m-z/openshot.profile b/etc/profile-m-z/openshot.profile index e1839c724..ac960345a 100644 --- a/etc/profile-m-z/openshot.profile +++ b/etc/profile-m-z/openshot.profile | |||
@@ -19,6 +19,10 @@ include disable-interpreters.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | whitelist /usr/share/blender | ||
23 | whitelist /usr/share/inkscape | ||
24 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 26 | include whitelist-var-common.inc |
23 | 27 | ||
24 | apparmor | 28 | apparmor |
@@ -32,11 +36,14 @@ notv | |||
32 | nou2f | 36 | nou2f |
33 | protocol unix,inet,inet6,netlink | 37 | protocol unix,inet,inet6,netlink |
34 | seccomp | 38 | seccomp |
39 | seccomp.block-secondary | ||
35 | shell none | 40 | shell none |
36 | tracelog | 41 | tracelog |
37 | 42 | ||
43 | private-bin blender,inkscape,openshot,openshot-qt,python3* | ||
44 | private-cache | ||
38 | private-dev | 45 | private-dev |
39 | private-tmp | 46 | private-tmp |
40 | 47 | ||
41 | dbus-user none | 48 | dbus-user filter |
42 | dbus-system none | 49 | dbus-system none |
diff --git a/etc/profile-m-z/qnapi.profile b/etc/profile-m-z/qnapi.profile new file mode 100644 index 000000000..0d1f9c3de --- /dev/null +++ b/etc/profile-m-z/qnapi.profile | |||
@@ -0,0 +1,55 @@ | |||
1 | # Firejail profile for qnapi | ||
2 | # Description: Qt client for downloading movie subtitles from NapiProjekt, OpenSubtitles and Napisy24 | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include qnapi.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/qnapi.ini | ||
10 | |||
11 | ignore noexec /tmp | ||
12 | |||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkfile ${HOME}/.config/qnapi.ini | ||
23 | whitelist ${HOME}/.config/qnapi.ini | ||
24 | whitelist ${DOWNLOADS} | ||
25 | include whitelist-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-var-common.inc | ||
29 | |||
30 | apparmor | ||
31 | caps.drop all | ||
32 | ipc-namespace | ||
33 | netfilter | ||
34 | nodvd | ||
35 | nogroups | ||
36 | nonewprivs | ||
37 | noroot | ||
38 | nosound | ||
39 | notv | ||
40 | nou2f | ||
41 | novideo | ||
42 | protocol unix,inet,inet6,netlink | ||
43 | seccomp | ||
44 | shell none | ||
45 | tracelog | ||
46 | |||
47 | private-bin 7z,qnapi | ||
48 | private-cache | ||
49 | private-dev | ||
50 | private-etc alternatives,fonts | ||
51 | private-opt none | ||
52 | private-tmp | ||
53 | |||
54 | dbus-user none | ||
55 | dbus-system none | ||
diff --git a/etc/profile-m-z/shotwell.profile b/etc/profile-m-z/shotwell.profile new file mode 100644 index 000000000..749029530 --- /dev/null +++ b/etc/profile-m-z/shotwell.profile | |||
@@ -0,0 +1,60 @@ | |||
1 | # Firejail profile for shotwell | ||
2 | # Description: A digital photo organizer designed for the GNOME desktop environment | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include shotwell.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.cache/shotwell | ||
10 | noblacklist ${HOME}/.local/share/shotwell | ||
11 | |||
12 | noblacklist ${PICTURES} | ||
13 | include disable-common.inc | ||
14 | include disable-devel.inc | ||
15 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | ||
17 | include disable-passwdmgr.inc | ||
18 | include disable-programs.inc | ||
19 | include disable-shell.inc | ||
20 | include disable-xdg.inc | ||
21 | |||
22 | mkdir ${HOME}/.cache/shotwell | ||
23 | mkdir ${HOME}/.local/share/shotwell | ||
24 | whitelist ${HOME}/.cache/shotwell | ||
25 | whitelist ${HOME}/.local/share/shotwell | ||
26 | whitelist ${PICTURES} | ||
27 | include whitelist-common.inc | ||
28 | include whitelist-runuser-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
30 | include whitelist-var-common.inc | ||
31 | |||
32 | apparmor | ||
33 | caps.drop all | ||
34 | machine-id | ||
35 | netfilter | ||
36 | nodvd | ||
37 | nogroups | ||
38 | nonewprivs | ||
39 | noroot | ||
40 | nosound | ||
41 | notv | ||
42 | nou2f | ||
43 | novideo | ||
44 | protocol unix | ||
45 | seccomp | ||
46 | shell none | ||
47 | tracelog | ||
48 | |||
49 | private-bin shotwell | ||
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc alternatives,fonts,machine-id | ||
53 | private-opt none | ||
54 | private-tmp | ||
55 | |||
56 | dbus-user filter | ||
57 | dbus-user.own org.gnome.Shotwell | ||
58 | dbus-user.talk ca.desrt.dconf | ||
59 | dbus-user.talk org.gtk.vfs.UDisks2VolumeMonitor | ||
60 | dbus-system none | ||
diff --git a/etc/profile-m-z/signal-desktop.profile b/etc/profile-m-z/signal-desktop.profile index 08e1c1f03..666a37def 100644 --- a/etc/profile-m-z/signal-desktop.profile +++ b/etc/profile-m-z/signal-desktop.profile | |||
@@ -21,8 +21,6 @@ noblacklist ${HOME}/.mozilla | |||
21 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | 21 | whitelist ${HOME}/.mozilla/firefox/profiles.ini |
22 | read-only ${HOME}/.mozilla/firefox/profiles.ini | 22 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
23 | 23 | ||
24 | include disable-exec.inc | ||
25 | |||
26 | mkdir ${HOME}/.config/Signal | 24 | mkdir ${HOME}/.config/Signal |
27 | whitelist ${HOME}/.config/Signal | 25 | whitelist ${HOME}/.config/Signal |
28 | 26 | ||
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile index d873a5672..e3e2b4541 100644 --- a/etc/profile-m-z/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -19,8 +19,8 @@ include disable-exec.inc | |||
19 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 20 | include disable-programs.inc |
21 | 21 | ||
22 | whitelist ${RUNUSER}/keyring/ssh | ||
23 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh | 22 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh |
23 | whitelist ${RUNUSER}/keyring/ssh | ||
24 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
25 | include whitelist-runuser-common.inc | 25 | include whitelist-runuser-common.inc |
26 | 26 | ||
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile index 55078d993..758b37815 100644 --- a/etc/profile-m-z/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.killingfloor | 9 | noblacklist ${HOME}/.killingfloor |
10 | noblacklist ${HOME}/.local/share/3909/PapersPlease | 10 | noblacklist ${HOME}/.local/share/3909/PapersPlease |
11 | noblacklist ${HOME}/.local/share/aspyr-media | 11 | noblacklist ${HOME}/.local/share/aspyr-media |
12 | noblacklist ${HOME}/.local/share/bohemiainteractive | ||
12 | noblacklist ${HOME}/.local/share/cdprojektred | 13 | noblacklist ${HOME}/.local/share/cdprojektred |
13 | noblacklist ${HOME}/.local/share/FasterThanLight | 14 | noblacklist ${HOME}/.local/share/FasterThanLight |
14 | noblacklist ${HOME}/.local/share/feral-interactive | 15 | noblacklist ${HOME}/.local/share/feral-interactive |
@@ -45,6 +46,7 @@ mkdir ${HOME}/.config/unity3d | |||
45 | mkdir ${HOME}/.killingfloor | 46 | mkdir ${HOME}/.killingfloor |
46 | mkdir ${HOME}/.local/share/3909/PapersPlease | 47 | mkdir ${HOME}/.local/share/3909/PapersPlease |
47 | mkdir ${HOME}/.local/share/aspyr-media | 48 | mkdir ${HOME}/.local/share/aspyr-media |
49 | mkdir ${HOME}/.local/share/bohemiainteractive | ||
48 | mkdir ${HOME}/.local/share/cdprojektred | 50 | mkdir ${HOME}/.local/share/cdprojektred |
49 | mkdir ${HOME}/.local/share/FasterThanLight | 51 | mkdir ${HOME}/.local/share/FasterThanLight |
50 | mkdir ${HOME}/.local/share/feral-interactive | 52 | mkdir ${HOME}/.local/share/feral-interactive |
@@ -64,6 +66,7 @@ whitelist ${HOME}/.config/unity3d | |||
64 | whitelist ${HOME}/.killingfloor | 66 | whitelist ${HOME}/.killingfloor |
65 | whitelist ${HOME}/.local/share/3909/PapersPlease | 67 | whitelist ${HOME}/.local/share/3909/PapersPlease |
66 | whitelist ${HOME}/.local/share/aspyr-media | 68 | whitelist ${HOME}/.local/share/aspyr-media |
69 | whitelist ${HOME}/.local/share/bohemiainteractive | ||
67 | whitelist ${HOME}/.local/share/cdprojektred | 70 | whitelist ${HOME}/.local/share/cdprojektred |
68 | whitelist ${HOME}/.local/share/FasterThanLight | 71 | whitelist ${HOME}/.local/share/FasterThanLight |
69 | whitelist ${HOME}/.local/share/feral-interactive | 72 | whitelist ${HOME}/.local/share/feral-interactive |
diff --git a/etc/profile-m-z/trojita.profile b/etc/profile-m-z/trojita.profile index a8641af85..b82aadd13 100644 --- a/etc/profile-m-z/trojita.profile +++ b/etc/profile-m-z/trojita.profile | |||
@@ -57,7 +57,8 @@ private-dev | |||
57 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg | 57 | private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,selinux,ssl,xdg |
58 | private-tmp | 58 | private-tmp |
59 | 59 | ||
60 | dbus-user none | 60 | dbus-user filter |
61 | dbus-user.talk org.freedesktop.secrets | ||
61 | dbus-system none | 62 | dbus-system none |
62 | 63 | ||
63 | read-only ${HOME}/.mozilla/firefox/profiles.ini | 64 | read-only ${HOME}/.mozilla/firefox/profiles.ini |
diff --git a/etc/profile-m-z/tutanota-desktop.profile b/etc/profile-m-z/tutanota-desktop.profile new file mode 100644 index 000000000..d2cb0cc8a --- /dev/null +++ b/etc/profile-m-z/tutanota-desktop.profile | |||
@@ -0,0 +1,31 @@ | |||
1 | # Firejail profile for tutanota-desktop | ||
2 | # Description: Encrypted email client | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include tutanota-desktop.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.config/tuta_integration | ||
10 | noblacklist ${HOME}/.config/tutanota-desktop | ||
11 | |||
12 | ignore noexec /tmp | ||
13 | |||
14 | include disable-shell.inc | ||
15 | |||
16 | mkdir ${HOME}/.config/tuta_integration | ||
17 | mkdir ${HOME}/.config/tutanota-desktop | ||
18 | whitelist ${HOME}/.config/tuta_integration | ||
19 | whitelist ${HOME}/.config/tutanota-desktop | ||
20 | |||
21 | # These lines are needed to allow Firefox to open links | ||
22 | noblacklist ${HOME}/.mozilla | ||
23 | whitelist ${HOME}/.mozilla/firefox/profiles.ini | ||
24 | read-only ${HOME}/.mozilla/firefox/profiles.ini | ||
25 | |||
26 | ?HAS_APPIMAGE: ignore private-dev | ||
27 | private-etc alternatives,ca-certificates,crypto-policies,fonts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | ||
28 | private-opt tutanota-desktop | ||
29 | |||
30 | # Redirect | ||
31 | include electron.profile | ||
diff --git a/etc/profile-m-z/unar.profile b/etc/profile-m-z/unar.profile new file mode 100644 index 000000000..0226a7de8 --- /dev/null +++ b/etc/profile-m-z/unar.profile | |||
@@ -0,0 +1,13 @@ | |||
1 | # Firejail profile for unar | ||
2 | # This file is overwritten after every install/update | ||
3 | quiet | ||
4 | # Persistent local customizations | ||
5 | include unar.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | private-bin unar | ||
11 | |||
12 | # Redirect | ||
13 | include ar.profile | ||
diff --git a/etc/profile-m-z/yarn.profile b/etc/profile-m-z/yarn.profile new file mode 100644 index 000000000..f20225050 --- /dev/null +++ b/etc/profile-m-z/yarn.profile | |||
@@ -0,0 +1,29 @@ | |||
1 | # Firejail profile for yarn | ||
2 | # Description: Fast, reliable, and secure dependency management | ||
3 | quiet | ||
4 | # Persistent local customizations | ||
5 | include yarn.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | ignore read-only ${HOME}/.yarnrc | ||
10 | |||
11 | noblacklist ${HOME}/.yarn | ||
12 | noblacklist ${HOME}/.yarn-config | ||
13 | noblacklist ${HOME}/.yarncache | ||
14 | noblacklist ${HOME}/.yarnrc | ||
15 | |||
16 | # If you want whitelisting, change ${HOME}/Projects below to your yarn projects directory and uncomment the lines below. | ||
17 | #mkdir ${HOME}/.yarn | ||
18 | #mkdir ${HOME}/.yarn-config | ||
19 | #mkdir ${HOME}/.yarncache | ||
20 | #mkfile ${HOME}/.yarnrc | ||
21 | #whitelist ${HOME}/.yarn | ||
22 | #whitelist ${HOME}/.yarn-config | ||
23 | #whitelist ${HOME}/.yarncache | ||
24 | #whitelist ${HOME}/.yarnrc | ||
25 | #whitelist ${HOME}/Projects | ||
26 | #include whitelist-common.inc | ||
27 | |||
28 | # Redirect | ||
29 | include nodejs-common.profile | ||
diff --git a/etc/templates/syscalls.txt b/etc/templates/syscalls.txt index c454887dd..ebc648548 100644 --- a/etc/templates/syscalls.txt +++ b/etc/templates/syscalls.txt | |||
@@ -35,7 +35,7 @@ Definition of groups | |||
35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext | 35 | @debug=lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext |
36 | @default=@clock,@cpu-emulation,@debug,@module,@mount,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,userfaultfd,acct,bpf,nfsservctl,setdomainname,sethostname,vhangup | 36 | @default=@clock,@cpu-emulation,@debug,@module,@mount,@obsolete,@raw-io,@reboot,@swap,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,mbind,migrate_pages,move_pages,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,set_mempolicyvmsplice,userfaultfd,acct,bpf,nfsservctl,setdomainname,sethostname,vhangup |
37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv | 37 | @default-nodebuggers=@default,ptrace,personality,process_vm_readv |
38 | @default-keep=execve,prctl | 38 | @default-keep=execveat,execve,prctl |
39 | @file-system=access,chdir,chmod,close,creat,faccessat,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes | 39 | @file-system=access,chdir,chmod,close,creat,faccessat,fallocate,fchdir,fchmod,fchmodat,fcntl,fcntl64,fgetxattr,flistxattr,fremovexattr,fsetxattr,fstat,fstat64,fstatat64,fstatfs,fstatfs64,ftruncate,ftruncate64,futimesat,getcwd,getdents,getdents64,getxattr,inotify_add_watch,inotify_init,inotify_init1,inotify_rm_watch,lgetxattr,link,linkat,listxattr,llistxattr,lremovexattr,lsetxattr,lstat,lstat64,mkdir,mkdirat,mknod,mknodat,mmap,mmap2,munmap,newfstatat,oldfstat,oldlstat,oldstat,open,openat,readlink,readlinkat,removexattr,rename,renameat,renameat2,rmdir,setxattr,stat,stat64,statfs,statfs64,statx,symlink,symlinkat,truncate,truncate64,unlink,unlinkat,utime,utimensat,utimes |
40 | @io-event=_newselect,epoll_create,epoll_create1,epoll_ctl,epoll_ctl_old,epoll_pwait,epoll_wait,epoll_wait_old,eventfd,eventfd2,poll,ppoll,pselect6,select | 40 | @io-event=_newselect,epoll_create,epoll_create1,epoll_ctl,epoll_ctl_old,epoll_pwait,epoll_wait,epoll_wait_old,eventfd,eventfd2,poll,ppoll,pselect6,select |
41 | @ipc=ipc,memfd_create,mq_getsetattr,mq_notify,mq_open,mq_timedreceive,mq_timedsend,mq_unlink,msgctl,msgget,msgrcv,msgsnd,pipe,pipe2,process_vm_readv,process_vm_writev,semctl,semget,semop,semtimedop,shmat,shmctl,shmdt,shmget | 41 | @ipc=ipc,memfd_create,mq_getsetattr,mq_notify,mq_open,mq_timedreceive,mq_timedsend,mq_unlink,msgctl,msgget,msgrcv,msgsnd,pipe,pipe2,process_vm_readv,process_vm_writev,semctl,semget,semop,semtimedop,shmat,shmctl,shmdt,shmget |
diff --git a/src/fbuilder/build_home.c b/src/fbuilder/build_home.c index fca3396c4..c0f4a3407 100644 --- a/src/fbuilder/build_home.c +++ b/src/fbuilder/build_home.c | |||
@@ -24,7 +24,7 @@ static FileDB *db_skip = NULL; | |||
24 | static FileDB *db_out = NULL; | 24 | static FileDB *db_out = NULL; |
25 | 25 | ||
26 | static void load_whitelist_common(void) { | 26 | static void load_whitelist_common(void) { |
27 | FILE *fp = fopen("/etc/firejail/whitelist-common.inc", "r"); | 27 | FILE *fp = fopen(SYSCONFDIR "/whitelist-common.inc", "r"); |
28 | if (!fp) { | 28 | if (!fp) { |
29 | fprintf(stderr, "Error: cannot open whitelist-common.inc\n"); | 29 | fprintf(stderr, "Error: cannot open whitelist-common.inc\n"); |
30 | exit(1); | 30 | exit(1); |
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c index adc00e67b..0517c837e 100644 --- a/src/fbuilder/build_profile.c +++ b/src/fbuilder/build_profile.c | |||
@@ -80,10 +80,19 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
80 | stroutput, | 80 | stroutput, |
81 | }; | 81 | }; |
82 | 82 | ||
83 | // detect strace | 83 | // detect strace and check if Yama LSM allows us to use it |
84 | int have_strace = 0; | 84 | int have_strace = 0; |
85 | if (access("/usr/bin/strace", X_OK) == 0) | 85 | int have_yama_permission = 1; |
86 | if (access("/usr/bin/strace", X_OK) == 0) { | ||
86 | have_strace = 1; | 87 | have_strace = 1; |
88 | FILE *fp = fopen("/proc/sys/kernel/yama/ptrace_scope", "r"); | ||
89 | if (fp) { | ||
90 | unsigned val; | ||
91 | if (fscanf(fp, "%u", &val) == 1) | ||
92 | have_yama_permission = (val < 2); | ||
93 | fclose(fp); | ||
94 | } | ||
95 | } | ||
87 | 96 | ||
88 | // calculate command length | 97 | // calculate command length |
89 | unsigned len = (int) sizeof(cmdlist) / sizeof(char*) + argc - index + 1; | 98 | unsigned len = (int) sizeof(cmdlist) / sizeof(char*) + argc - index + 1; |
@@ -93,10 +102,11 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
93 | cmd[0] = cmdlist[0]; // explicit assignment to clean scan-build error | 102 | cmd[0] = cmdlist[0]; // explicit assignment to clean scan-build error |
94 | 103 | ||
95 | // build command | 104 | // build command |
105 | int skip_strace = !(have_strace && have_yama_permission); | ||
96 | unsigned i = 0; | 106 | unsigned i = 0; |
97 | for (i = 0; i < (int) sizeof(cmdlist) / sizeof(char*); i++) { | 107 | for (i = 0; i < (int) sizeof(cmdlist) / sizeof(char*); i++) { |
98 | // skip strace if not installed | 108 | // skip strace if not installed, or no permission to use it |
99 | if (have_strace == 0 && strcmp(cmdlist[i], "/usr/bin/strace") == 0) | 109 | if (skip_strace && strcmp(cmdlist[i], "/usr/bin/strace") == 0) |
100 | break; | 110 | break; |
101 | cmd[i] = cmdlist[i]; | 111 | cmd[i] = cmdlist[i]; |
102 | } | 112 | } |
@@ -172,12 +182,14 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
172 | fprintf(fp, "caps.drop all\n"); | 182 | fprintf(fp, "caps.drop all\n"); |
173 | fprintf(fp, "nonewprivs\n"); | 183 | fprintf(fp, "nonewprivs\n"); |
174 | fprintf(fp, "seccomp\n"); | 184 | fprintf(fp, "seccomp\n"); |
175 | if (have_strace) | 185 | if (!have_strace) { |
176 | build_seccomp(strace_output, fp); | ||
177 | else { | ||
178 | fprintf(fp, "# If you install strace on your system, Firejail will also create a\n"); | 186 | fprintf(fp, "# If you install strace on your system, Firejail will also create a\n"); |
179 | fprintf(fp, "# whitelisted seccomp filter.\n"); | 187 | fprintf(fp, "# whitelisted seccomp filter.\n"); |
180 | } | 188 | } |
189 | else if (!have_yama_permission) | ||
190 | fprintf(fp, "# Yama security module prevents creation of a whitelisted seccomp filter\n"); | ||
191 | else | ||
192 | build_seccomp(strace_output, fp); | ||
181 | fprintf(fp, "\n"); | 193 | fprintf(fp, "\n"); |
182 | 194 | ||
183 | fprintf(fp, "### network\n"); | 195 | fprintf(fp, "### network\n"); |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 23b1e364a..109f89f39 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -455,6 +455,7 @@ macrofusion | |||
455 | magicor | 455 | magicor |
456 | # man | 456 | # man |
457 | manaplus | 457 | manaplus |
458 | marker | ||
458 | masterpdfeditor | 459 | masterpdfeditor |
459 | masterpdfeditor4 | 460 | masterpdfeditor4 |
460 | masterpdfeditor5 | 461 | masterpdfeditor5 |
@@ -621,6 +622,7 @@ qemu-launcher | |||
621 | qgis | 622 | qgis |
622 | qlipper | 623 | qlipper |
623 | qmmp | 624 | qmmp |
625 | qnapi | ||
624 | qpdfview | 626 | qpdfview |
625 | qt-faststart | 627 | qt-faststart |
626 | qtox | 628 | qtox |
@@ -662,6 +664,7 @@ secret-tool | |||
662 | shellcheck | 664 | shellcheck |
663 | shortwave | 665 | shortwave |
664 | shotcut | 666 | shotcut |
667 | shotwell | ||
665 | signal-cli | 668 | signal-cli |
666 | signal-desktop | 669 | signal-desktop |
667 | silentarmy | 670 | silentarmy |
@@ -771,6 +774,7 @@ tremulous | |||
771 | trojita | 774 | trojita |
772 | truecraft | 775 | truecraft |
773 | tshark | 776 | tshark |
777 | tutanota-desktop | ||
774 | tuxguitar | 778 | tuxguitar |
775 | tvbrowser | 779 | tvbrowser |
776 | twitch | 780 | twitch |
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c index 941d6ad82..b76999d8f 100644 --- a/src/firejail/fs_lib.c +++ b/src/firejail/fs_lib.c | |||
@@ -165,7 +165,7 @@ void fslib_copy_dir(const char *full_path) { | |||
165 | mkdir_attr(dest, 0755, 0, 0); | 165 | mkdir_attr(dest, 0755, 0, 0); |
166 | 166 | ||
167 | if (mount(full_path, dest, NULL, MS_BIND|MS_REC, NULL) < 0 || | 167 | if (mount(full_path, dest, NULL, MS_BIND|MS_REC, NULL) < 0 || |
168 | mount(NULL, dest, NULL, MS_BIND|MS_REMOUNT|MS_NOSUID|MS_NODEV|MS_REC, NULL) < 0) | 168 | mount(NULL, dest, NULL, MS_BIND|MS_REMOUNT|MS_RDONLY|MS_NOSUID|MS_NODEV|MS_REC, NULL) < 0) |
169 | errExit("mount bind"); | 169 | errExit("mount bind"); |
170 | fs_logger2("clone", full_path); | 170 | fs_logger2("clone", full_path); |
171 | fs_logger2("mount", full_path); | 171 | fs_logger2("mount", full_path); |
diff --git a/src/firejail/join.c b/src/firejail/join.c index d2f802add..4f0210f95 100644 --- a/src/firejail/join.c +++ b/src/firejail/join.c | |||
@@ -296,7 +296,7 @@ static void extract_umask(pid_t pid) { | |||
296 | fprintf(stderr, "Error: cannot open umask file\n"); | 296 | fprintf(stderr, "Error: cannot open umask file\n"); |
297 | exit(1); | 297 | exit(1); |
298 | } | 298 | } |
299 | if (fscanf(fp, "%o", &orig_umask) != 1) { | 299 | if (fscanf(fp, "%3o", &orig_umask) != 1) { |
300 | fprintf(stderr, "Error: cannot read umask\n"); | 300 | fprintf(stderr, "Error: cannot read umask\n"); |
301 | exit(1); | 301 | exit(1); |
302 | } | 302 | } |
@@ -335,7 +335,7 @@ bool is_ready_for_join(const pid_t pid) { | |||
335 | struct stat s; | 335 | struct stat s; |
336 | if (fstat(fd, &s) == -1) | 336 | if (fstat(fd, &s) == -1) |
337 | errExit("fstat"); | 337 | errExit("fstat"); |
338 | if (!S_ISREG(s.st_mode) || s.st_uid != 0) { | 338 | if (!S_ISREG(s.st_mode) || s.st_uid != 0 || s.st_size != 1) { |
339 | close(fd); | 339 | close(fd); |
340 | return false; | 340 | return false; |
341 | } | 341 | } |
@@ -411,7 +411,7 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
411 | extract_x11_display(parent); | 411 | extract_x11_display(parent); |
412 | 412 | ||
413 | int shfd = -1; | 413 | int shfd = -1; |
414 | if (!arg_shell_none) | 414 | if (!arg_shell_none && !arg_audit) |
415 | shfd = open_shell(); | 415 | shfd = open_shell(); |
416 | 416 | ||
417 | EUID_ROOT(); | 417 | EUID_ROOT(); |
@@ -423,6 +423,7 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
423 | extract_cgroup(pid); | 423 | extract_cgroup(pid); |
424 | extract_nogroups(pid); | 424 | extract_nogroups(pid); |
425 | extract_user_namespace(pid); | 425 | extract_user_namespace(pid); |
426 | extract_umask(pid); | ||
426 | #ifdef HAVE_APPARMOR | 427 | #ifdef HAVE_APPARMOR |
427 | extract_apparmor(pid); | 428 | extract_apparmor(pid); |
428 | #endif | 429 | #endif |
@@ -432,9 +433,6 @@ void join(pid_t pid, int argc, char **argv, int index) { | |||
432 | if (cfg.cgroup) // not available for uid 0 | 433 | if (cfg.cgroup) // not available for uid 0 |
433 | set_cgroup(cfg.cgroup); | 434 | set_cgroup(cfg.cgroup); |
434 | 435 | ||
435 | // set umask, also uid 0 | ||
436 | extract_umask(pid); | ||
437 | |||
438 | // join namespaces | 436 | // join namespaces |
439 | if (arg_join_network) { | 437 | if (arg_join_network) { |
440 | if (join_namespace(pid, "net")) | 438 | if (join_namespace(pid, "net")) |
diff --git a/src/firejail/util.c b/src/firejail/util.c index 0b095e1be..911c8bd94 100644 --- a/src/firejail/util.c +++ b/src/firejail/util.c | |||
@@ -565,27 +565,18 @@ char *clean_pathname(const char *path) { | |||
565 | if (!rv) | 565 | if (!rv) |
566 | errExit("malloc"); | 566 | errExit("malloc"); |
567 | 567 | ||
568 | if (len > 0) { | 568 | size_t i = 0; |
569 | size_t i = 0, j = 0, cnt = 0; | 569 | size_t j = 0; |
570 | for (; i < len; i++) { | 570 | while (path[i]) { |
571 | if (path[i] == '/') | 571 | while (path[i] == '/' && path[i+1] == '/') |
572 | cnt++; | 572 | i++; |
573 | else | 573 | rv[j++] = path[i++]; |
574 | cnt = 0; | ||
575 | |||
576 | if (cnt < 2) { | ||
577 | rv[j] = path[i]; | ||
578 | j++; | ||
579 | } | ||
580 | } | ||
581 | rv[j] = '\0'; | ||
582 | |||
583 | // remove a trailing slash | ||
584 | if (j > 1 && rv[j - 1] == '/') | ||
585 | rv[j - 1] = '\0'; | ||
586 | } | 574 | } |
587 | else | 575 | rv[j] = '\0'; |
588 | *rv = '\0'; | 576 | |
577 | // remove a trailing slash | ||
578 | if (j > 1 && rv[j - 1] == '/') | ||
579 | rv[j - 1] = '\0'; | ||
589 | 580 | ||
590 | return rv; | 581 | return rv; |
591 | } | 582 | } |
diff --git a/src/lib/syscall.c b/src/lib/syscall.c index 4903971ad..6823d0ae6 100644 --- a/src/lib/syscall.c +++ b/src/lib/syscall.c | |||
@@ -336,6 +336,7 @@ static const SyscallGroupList sysgroups[] = { | |||
336 | #endif | 336 | #endif |
337 | }, | 337 | }, |
338 | { .name = "@default-keep", .list = | 338 | { .name = "@default-keep", .list = |
339 | "execveat," // commonly used by fexecve | ||
339 | "execve," | 340 | "execve," |
340 | "prctl" | 341 | "prctl" |
341 | }, | 342 | }, |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index 9524254c1..030a3c95c 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -862,6 +862,11 @@ the parent interface specified by --net is not configured. An IP address and | |||
862 | a default gateway address also have to be added. | 862 | a default gateway address also have to be added. |
863 | 863 | ||
864 | .TP | 864 | .TP |
865 | \fBnetns namespace | ||
866 | Run the program in a named, persistent network namespace. These can | ||
867 | be created and configured using "ip netns". | ||
868 | |||
869 | .TP | ||
865 | \fBveth-name name | 870 | \fBveth-name name |
866 | Use this name for the interface connected to the bridge for --net=bridge_interface commands, | 871 | Use this name for the interface connected to the bridge for --net=bridge_interface commands, |
867 | instead of the default one. | 872 | instead of the default one. |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 347e2b31b..e72ef48c2 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -2273,7 +2273,7 @@ rm: cannot remove `testfile': Operation not permitted | |||
2273 | .TP | 2273 | .TP |
2274 | \fB\-\-seccomp.keep=syscall,@group,!syscall2 | 2274 | \fB\-\-seccomp.keep=syscall,@group,!syscall2 |
2275 | Enable seccomp filter, blacklist all syscall not listed and "syscall2". | 2275 | Enable seccomp filter, blacklist all syscall not listed and "syscall2". |
2276 | The system calls needed by Firejail (group @default-keep: prctl, execve) | 2276 | The system calls needed by Firejail (group @default-keep: prctl, execve, execveat) |
2277 | are handled with the preload library. On a 64 bit architecture, an | 2277 | are handled with the preload library. On a 64 bit architecture, an |
2278 | additional filter for 32 bit system calls can be installed with | 2278 | additional filter for 32 bit system calls can be installed with |
2279 | \-\-seccomp.32.keep. | 2279 | \-\-seccomp.32.keep. |