diff options
-rw-r--r-- | etc/inc/disable-programs.inc | 3 | ||||
-rw-r--r-- | etc/profile-a-l/keepassxc.profile | 7 | ||||
-rw-r--r-- | etc/profile-m-z/matrix-mirage.profile | 24 | ||||
-rw-r--r-- | etc/profile-m-z/mirage.profile | 3 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 1 | ||||
-rw-r--r-- | src/firejail/no_sandbox.c | 11 | ||||
-rw-r--r-- | src/man/firejail.txt | 10 |
7 files changed, 44 insertions, 15 deletions
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 7423d53fa..961437ad7 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -303,6 +303,7 @@ blacklist ${HOME}/.config/mana | |||
303 | blacklist ${HOME}/.config/mate-calc | 303 | blacklist ${HOME}/.config/mate-calc |
304 | blacklist ${HOME}/.config/mate/eom | 304 | blacklist ${HOME}/.config/mate/eom |
305 | blacklist ${HOME}/.config/mate/mate-dictionary | 305 | blacklist ${HOME}/.config/mate/mate-dictionary |
306 | blacklist ${HOME}/.config/matrix-mirage | ||
306 | blacklist ${HOME}/.config/meld | 307 | blacklist ${HOME}/.config/meld |
307 | blacklist ${HOME}/.config/meteo-qt | 308 | blacklist ${HOME}/.config/meteo-qt |
308 | blacklist ${HOME}/.config/menulibre.cfg | 309 | blacklist ${HOME}/.config/menulibre.cfg |
@@ -671,6 +672,7 @@ blacklist ${HOME}/.local/share/lugaru | |||
671 | blacklist ${HOME}/.local/share/lutris | 672 | blacklist ${HOME}/.local/share/lutris |
672 | blacklist ${HOME}/.local/share/mana | 673 | blacklist ${HOME}/.local/share/mana |
673 | blacklist ${HOME}/.local/share/maps-places.json | 674 | blacklist ${HOME}/.local/share/maps-places.json |
675 | blacklist ${HOME}/.local/share/matrix-mirage | ||
674 | blacklist ${HOME}/.local/share/meld | 676 | blacklist ${HOME}/.local/share/meld |
675 | blacklist ${HOME}/.local/share/midori | 677 | blacklist ${HOME}/.local/share/midori |
676 | blacklist ${HOME}/.local/share/mirage | 678 | blacklist ${HOME}/.local/share/mirage |
@@ -943,6 +945,7 @@ blacklist ${HOME}/.cache/libgweather | |||
943 | blacklist ${HOME}/.cache/liferea | 945 | blacklist ${HOME}/.cache/liferea |
944 | blacklist ${HOME}/.cache/lutris | 946 | blacklist ${HOME}/.cache/lutris |
945 | blacklist ${HOME}/.cache/Mendeley Ltd. | 947 | blacklist ${HOME}/.cache/Mendeley Ltd. |
948 | blacklist ${HOME}/.cache/matrix-mirage | ||
946 | blacklist ${HOME}/.cache/midori | 949 | blacklist ${HOME}/.cache/midori |
947 | blacklist ${HOME}/.cache/minetest | 950 | blacklist ${HOME}/.cache/minetest |
948 | blacklist ${HOME}/.cache/mirage | 951 | blacklist ${HOME}/.cache/mirage |
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile index 58db056b2..456f1820d 100644 --- a/etc/profile-a-l/keepassxc.profile +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -73,12 +73,11 @@ dbus-user.talk org.freedesktop.login1.Session | |||
73 | dbus-user.talk org.gnome.ScreenSaver | 73 | dbus-user.talk org.gnome.ScreenSaver |
74 | dbus-user.talk org.gnome.SessionManager | 74 | dbus-user.talk org.gnome.SessionManager |
75 | dbus-user.talk org.gnome.SessionManager.Presence | 75 | dbus-user.talk org.gnome.SessionManager.Presence |
76 | # Uncomment or add to your keepassxc.local to allow Notifications/Tray. | 76 | # Uncomment or add to your keepassxc.local to allow Notifications. |
77 | #dbus-user.talk org.freedesktop.Notifications | 77 | #dbus-user.talk org.freedesktop.Notifications |
78 | # Uncomment or add to your keepassxc.local to allow Tray. | ||
78 | #dbus-user.talk org.kde.StatusNotifierWatcher | 79 | #dbus-user.talk org.kde.StatusNotifierWatcher |
79 | # These numbers seems to be not stable, see #3713. Play around with them. | 80 | #dbus-user.own org.kde.* |
80 | #dbus-user.own org.kde.StatusNotifierItem-2-2 | ||
81 | #dbus-user.own org.kde.StatusNotifierItem-10-2 | ||
82 | dbus-system none | 81 | dbus-system none |
83 | 82 | ||
84 | # Mutex is stored in /tmp by default, which is broken by private-tmp | 83 | # Mutex is stored in /tmp by default, which is broken by private-tmp |
diff --git a/etc/profile-m-z/matrix-mirage.profile b/etc/profile-m-z/matrix-mirage.profile new file mode 100644 index 000000000..b3080df88 --- /dev/null +++ b/etc/profile-m-z/matrix-mirage.profile | |||
@@ -0,0 +1,24 @@ | |||
1 | # Firejail profile for matrix-mirage | ||
2 | # Description: Debian name for mirage binary/package | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include matrix-mirage.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.cache/matrix-mirage | ||
11 | noblacklist ${HOME}/.config/matrix-mirage | ||
12 | noblacklist ${HOME}/.local/share/matrix-mirage | ||
13 | |||
14 | mkdir ${HOME}/.cache/matrix-mirage | ||
15 | mkdir ${HOME}/.config/matrix-mirage | ||
16 | mkdir ${HOME}/.local/share/matrix-mirage | ||
17 | whitelist ${HOME}/.cache/matrix-mirage | ||
18 | whitelist ${HOME}/.config/matrix-mirage | ||
19 | whitelist ${HOME}/.local/share/matrix-mirage | ||
20 | |||
21 | private-bin matrix-mirage | ||
22 | |||
23 | # Redirect | ||
24 | include mirage.profile | ||
diff --git a/etc/profile-m-z/mirage.profile b/etc/profile-m-z/mirage.profile index 55c11be29..7130267e8 100644 --- a/etc/profile-m-z/mirage.profile +++ b/etc/profile-m-z/mirage.profile | |||
@@ -9,6 +9,7 @@ include globals.local | |||
9 | noblacklist ${HOME}/.cache/mirage | 9 | noblacklist ${HOME}/.cache/mirage |
10 | noblacklist ${HOME}/.config/mirage | 10 | noblacklist ${HOME}/.config/mirage |
11 | noblacklist ${HOME}/.local/share/mirage | 11 | noblacklist ${HOME}/.local/share/mirage |
12 | noblacklist /sbin | ||
12 | 13 | ||
13 | include allow-python2.inc | 14 | include allow-python2.inc |
14 | include allow-python3.inc | 15 | include allow-python3.inc |
@@ -49,7 +50,7 @@ shell none | |||
49 | tracelog | 50 | tracelog |
50 | 51 | ||
51 | disable-mnt | 52 | disable-mnt |
52 | private-bin mirage | 53 | private-bin ldconfig,mirage |
53 | private-cache | 54 | private-cache |
54 | private-dev | 55 | private-dev |
55 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg | 56 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,mime.types,nsswitch.conf,pki,pulse,resolv.conf,selinux,ssl,X11,xdg |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 3f1591cbd..74264b91a 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -462,6 +462,7 @@ mate-calculator | |||
462 | mate-color-select | 462 | mate-color-select |
463 | mate-dictionary | 463 | mate-dictionary |
464 | mathematica | 464 | mathematica |
465 | matrix-mirage | ||
465 | mattermost-desktop | 466 | mattermost-desktop |
466 | mcabber | 467 | mcabber |
467 | mediainfo | 468 | mediainfo |
diff --git a/src/firejail/no_sandbox.c b/src/firejail/no_sandbox.c index 01df77ee6..d7426f6ae 100644 --- a/src/firejail/no_sandbox.c +++ b/src/firejail/no_sandbox.c | |||
@@ -204,11 +204,12 @@ void run_no_sandbox(int argc, char **argv) { | |||
204 | break; | 204 | break; |
205 | } | 205 | } |
206 | } | 206 | } |
207 | // if shell is /usr/bin/firejail, replace it with /bin/bash | 207 | |
208 | if (strcmp(cfg.shell, PATH_FIREJAIL) == 0) { | 208 | // if shell is /usr/bin/firejail, replace it with /bin/bash |
209 | cfg.shell = "/bin/bash"; | 209 | // if (strcmp(cfg.shell, PATH_FIREJAIL) == 0) { |
210 | prog_index = 0; | 210 | // cfg.shell = "/bin/bash"; |
211 | } | 211 | // prog_index = 0; |
212 | // } | ||
212 | 213 | ||
213 | if (prog_index == 0) { | 214 | if (prog_index == 0) { |
214 | cfg.command_line = cfg.shell; | 215 | cfg.command_line = cfg.shell; |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 562b3eda3..347e2b31b 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -76,10 +76,10 @@ If an appropriate profile is not found, Firejail will use a default profile. | |||
76 | The default profile is quite restrictive. In case the application doesn't work, use --noprofile option | 76 | The default profile is quite restrictive. In case the application doesn't work, use --noprofile option |
77 | to disable it. For more information, please see \fBSECURITY PROFILES\fR section below. | 77 | to disable it. For more information, please see \fBSECURITY PROFILES\fR section below. |
78 | .PP | 78 | .PP |
79 | If a program argument is not specified, Firejail starts /bin/bash shell. | 79 | If a program argument is not specified, Firejail starts the user's preferred shell. |
80 | Examples: | 80 | Examples: |
81 | .PP | 81 | .PP |
82 | $ firejail [OPTIONS] # starting a /bin/bash shell | 82 | $ firejail [OPTIONS] # starting the program specified in $SHELL, usually /bin/bash |
83 | .PP | 83 | .PP |
84 | $ firejail [OPTIONS] firefox # starting Mozilla Firefox | 84 | $ firejail [OPTIONS] firefox # starting Mozilla Firefox |
85 | .PP | 85 | .PP |
@@ -2476,7 +2476,7 @@ $ firejail \-\-shell=none script.sh | |||
2476 | \fB\-\-shell=program | 2476 | \fB\-\-shell=program |
2477 | Set default user shell. Use this shell to run the application using \-c shell option. | 2477 | Set default user shell. Use this shell to run the application using \-c shell option. |
2478 | For example "firejail \-\-shell=/bin/dash firefox" will start Mozilla Firefox as "/bin/dash \-c firefox". | 2478 | For example "firejail \-\-shell=/bin/dash firefox" will start Mozilla Firefox as "/bin/dash \-c firefox". |
2479 | By default Bash shell (/bin/bash) is used. | 2479 | By default the user's preferred shell is used. |
2480 | .br | 2480 | .br |
2481 | 2481 | ||
2482 | .br | 2482 | .br |
@@ -3023,7 +3023,7 @@ We provide a tool that automates all this integration, please see \&\flfirecfg\f | |||
3023 | .SH EXAMPLES | 3023 | .SH EXAMPLES |
3024 | .TP | 3024 | .TP |
3025 | \f\firejail | 3025 | \f\firejail |
3026 | Sandbox a regular /bin/bash session. | 3026 | Sandbox a regular shell session. |
3027 | .TP | 3027 | .TP |
3028 | \f\firejail firefox | 3028 | \f\firejail firefox |
3029 | Start Mozilla Firefox. | 3029 | Start Mozilla Firefox. |
@@ -3043,7 +3043,7 @@ Start Firefox in a new network namespace. An IP address is | |||
3043 | assigned automatically. | 3043 | assigned automatically. |
3044 | .TP | 3044 | .TP |
3045 | \f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2 | 3045 | \f\firejail \-\-net=br0 \-\-ip=10.10.20.5 \-\-net=br1 \-\-net=br2 |
3046 | Start a /bin/bash session in a new network namespace and connect it | 3046 | Start a shell session in a new network namespace and connect it |
3047 | to br0, br1, and br2 host bridge devices. IP addresses are assigned | 3047 | to br0, br1, and br2 host bridge devices. IP addresses are assigned |
3048 | automatically for the interfaces connected to br1 and b2 | 3048 | automatically for the interfaces connected to br1 and b2 |
3049 | #endif | 3049 | #endif |