diff options
116 files changed, 695 insertions, 309 deletions
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml new file mode 100644 index 000000000..1468ef898 --- /dev/null +++ b/.github/workflows/build-extra.yml | |||
@@ -0,0 +1,52 @@ | |||
1 | name: Build-extra CI | ||
2 | |||
3 | on: | ||
4 | push: | ||
5 | branches: [ master ] | ||
6 | paths-ignore: | ||
7 | - CONTRIBUTING.md | ||
8 | - README | ||
9 | - README.md | ||
10 | - RELNOTES | ||
11 | - SECURITY.md | ||
12 | - 'etc/**' | ||
13 | pull_request: | ||
14 | branches: [ master ] | ||
15 | paths-ignore: | ||
16 | - CONTRIBUTING.md | ||
17 | - README | ||
18 | - README.md | ||
19 | - RELNOTES | ||
20 | - SECURITY.md | ||
21 | - 'etc/**' | ||
22 | |||
23 | jobs: | ||
24 | build-clang: | ||
25 | if: ${{ ! contains(github.event.commits[0].message, '[skip ci]') }} | ||
26 | runs-on: ubuntu-20.04 | ||
27 | steps: | ||
28 | - uses: actions/checkout@v2 | ||
29 | - name: configure | ||
30 | run: CC=clang-10 ./configure --enable-fatal-warnings | ||
31 | - name: make | ||
32 | run: make | ||
33 | scan-build: | ||
34 | if: ${{ ! contains(github.event.commits[0].message, '[skip ci]') }} | ||
35 | runs-on: ubuntu-20.04 | ||
36 | steps: | ||
37 | - uses: actions/checkout@v2 | ||
38 | - name: install clang-tools-10 | ||
39 | run: sudo apt-get install clang-tools-10 | ||
40 | - name: configure | ||
41 | run: CC=clang-10 ./configure --enable-fatal-warnings | ||
42 | - name: scan-build | ||
43 | run: NO_EXTRA_CFLAGS="yes" scan-build-10 --status-bugs make | ||
44 | cppcheck: | ||
45 | if: ${{ ! contains(github.event.commits[0].message, '[skip ci]') }} | ||
46 | runs-on: ubuntu-20.04 | ||
47 | steps: | ||
48 | - uses: actions/checkout@v2 | ||
49 | - name: install cppcheck | ||
50 | run: sudo apt-get install cppcheck | ||
51 | - name: cppcheck | ||
52 | run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance . | ||
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 71cb7f0b4..99b8a3be5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml | |||
@@ -3,11 +3,24 @@ name: Build CI | |||
3 | on: | 3 | on: |
4 | push: | 4 | push: |
5 | branches: [ master ] | 5 | branches: [ master ] |
6 | paths-ignore: | ||
7 | - CONTRIBUTING.md | ||
8 | - README | ||
9 | - README.md | ||
10 | - RELNOTES | ||
11 | - SECURITY.md | ||
6 | pull_request: | 12 | pull_request: |
7 | branches: [ master ] | 13 | branches: [ master ] |
14 | paths-ignore: | ||
15 | - CONTRIBUTING.md | ||
16 | - README | ||
17 | - README.md | ||
18 | - RELNOTES | ||
19 | - SECURITY.md | ||
8 | 20 | ||
9 | jobs: | 21 | jobs: |
10 | build_and_test: | 22 | build_and_test: |
23 | if: ${{ ! contains(github.event.commits[0].message, '[skip ci]') }} | ||
11 | runs-on: ubuntu-20.04 | 24 | runs-on: ubuntu-20.04 |
12 | steps: | 25 | steps: |
13 | - uses: actions/checkout@v2 | 26 | - uses: actions/checkout@v2 |
@@ -21,35 +34,3 @@ jobs: | |||
21 | run: sudo make install | 34 | run: sudo make install |
22 | - name: run tests | 35 | - name: run tests |
23 | run: SHELL=/bin/bash make test-github | 36 | run: SHELL=/bin/bash make test-github |
24 | build-clang: | ||
25 | runs-on: ubuntu-20.04 | ||
26 | steps: | ||
27 | - uses: actions/checkout@v2 | ||
28 | - name: configure | ||
29 | run: CC=clang-10 ./configure --enable-fatal-warnings | ||
30 | - name: make | ||
31 | run: make | ||
32 | scan-build: | ||
33 | runs-on: ubuntu-20.04 | ||
34 | steps: | ||
35 | - uses: actions/checkout@v2 | ||
36 | - name: install clang-tools-10 | ||
37 | run: sudo apt-get install clang-tools-10 | ||
38 | - name: configure | ||
39 | run: CC=clang-10 ./configure --enable-fatal-warnings | ||
40 | - name: scan-build | ||
41 | run: NO_EXTRA_CFLAGS="yes" scan-build-10 --status-bugs make | ||
42 | cppcheck: | ||
43 | runs-on: ubuntu-20.04 | ||
44 | steps: | ||
45 | - uses: actions/checkout@v2 | ||
46 | - name: install cppcheck | ||
47 | run: sudo apt-get install cppcheck | ||
48 | - name: cppcheck | ||
49 | run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance . | ||
50 | profile-sort: | ||
51 | runs-on: ubuntu-20.04 | ||
52 | steps: | ||
53 | - uses: actions/checkout@v2 | ||
54 | - name: check profiles | ||
55 | run: ./contrib/sort.py etc/*/{*.inc,*.net,*.profile} | ||
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index a37bbb5c7..301c7fad2 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml | |||
@@ -8,9 +8,23 @@ name: "CodeQL" | |||
8 | on: | 8 | on: |
9 | push: | 9 | push: |
10 | branches: [master] | 10 | branches: [master] |
11 | paths-ignore: | ||
12 | - CONTRIBUTING.md | ||
13 | - README | ||
14 | - README.md | ||
15 | - RELNOTES | ||
16 | - SECURITY.md | ||
17 | - 'etc/**' | ||
11 | pull_request: | 18 | pull_request: |
12 | # The branches below must be a subset of the branches above | 19 | # The branches below must be a subset of the branches above |
13 | branches: [master] | 20 | branches: [master] |
21 | paths-ignore: | ||
22 | - CONTRIBUTING.md | ||
23 | - README | ||
24 | - README.md | ||
25 | - RELNOTES | ||
26 | - SECURITY.md | ||
27 | - 'etc/**' | ||
14 | schedule: | 28 | schedule: |
15 | - cron: '0 7 * * 2' | 29 | - cron: '0 7 * * 2' |
16 | 30 | ||
diff --git a/.github/workflows/sort.yml b/.github/workflows/sort.yml new file mode 100644 index 000000000..55ac065b6 --- /dev/null +++ b/.github/workflows/sort.yml | |||
@@ -0,0 +1,21 @@ | |||
1 | name: sort.py | ||
2 | |||
3 | on: | ||
4 | push: | ||
5 | branches: [ master ] | ||
6 | paths: | ||
7 | - 'etc/**' | ||
8 | pull_request: | ||
9 | branches: [ master ] | ||
10 | paths: | ||
11 | - 'etc/**' | ||
12 | |||
13 | jobs: | ||
14 | profile-sort: | ||
15 | if: ${{ ! contains(github.event.commits[0].message, '[skip ci]') }} | ||
16 | runs-on: ubuntu-20.04 | ||
17 | steps: | ||
18 | - uses: actions/checkout@v2 | ||
19 | - name: check profiles | ||
20 | run: ./contrib/sort.py etc/*/{*.inc,*.profile} | ||
21 | |||
@@ -194,4 +194,4 @@ Stats: | |||
194 | 194 | ||
195 | ### New profiles: | 195 | ### New profiles: |
196 | 196 | ||
197 | spectacle, chromium-browser-privacy | 197 | spectacle, chromium-browser-privacy, gtk-straw-viewer, gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer, straw-viewer, lutris, dolphin-emu, authenticator-rs |
@@ -1,7 +1,11 @@ | |||
1 | firejail (0.9.65) baseline; urgency=low | 1 | firejail (0.9.65) baseline; urgency=low |
2 | * allow --tmpfs inside $HOME for unprivileged users | 2 | * allow --tmpfs inside $HOME for unprivileged users |
3 | * --disable-usertmpfs compile time option | 3 | * --disable-usertmpfs compile time option |
4 | * new profiles: spectacle, chromium-browser-privacy | 4 | * allow AF_BLUETOOTH via --protocol=bluetooth |
5 | * new profiles: spectacle, chromium-browser-privacy, gtk-straw-viewer | ||
6 | * new profiles: gtk-youtube-viewer, gtk2-youtube-viewer, gtk3-youtube-viewer | ||
7 | * new profiles: straw-viewer, lutris, dolphin-emu, authenticator-rs | ||
8 | |||
5 | -- netblue30 <netblue30@yahoo.com> Wed, 21 Oct 2020 09:00:00 -0500 | 9 | -- netblue30 <netblue30@yahoo.com> Wed, 21 Oct 2020 09:00:00 -0500 |
6 | 10 | ||
7 | firejail (0.9.64) baseline; urgency=low | 11 | firejail (0.9.64) baseline; urgency=low |
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 1268b4cd2..bf40457a2 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -280,6 +280,7 @@ read-only ${HOME}/.plan | |||
280 | read-only ${HOME}/.profile | 280 | read-only ${HOME}/.profile |
281 | read-only ${HOME}/.project | 281 | read-only ${HOME}/.project |
282 | read-only ${HOME}/.tcshrc | 282 | read-only ${HOME}/.tcshrc |
283 | read-only ${HOME}/.zfunc | ||
283 | read-only ${HOME}/.zlogin | 284 | read-only ${HOME}/.zlogin |
284 | read-only ${HOME}/.zlogout | 285 | read-only ${HOME}/.zlogout |
285 | read-only ${HOME}/.zprofile | 286 | read-only ${HOME}/.zprofile |
@@ -302,6 +303,7 @@ read-only ${HOME}/.exrc | |||
302 | read-only ${HOME}/.gvimrc | 303 | read-only ${HOME}/.gvimrc |
303 | read-only ${HOME}/.homesick | 304 | read-only ${HOME}/.homesick |
304 | read-only ${HOME}/.iscreenrc | 305 | read-only ${HOME}/.iscreenrc |
306 | read-only ${HOME}/.local/lib | ||
305 | read-only ${HOME}/.local/share/cool-retro-term | 307 | read-only ${HOME}/.local/share/cool-retro-term |
306 | read-only ${HOME}/.mailcap | 308 | read-only ${HOME}/.mailcap |
307 | read-only ${HOME}/.msmtprc | 309 | read-only ${HOME}/.msmtprc |
diff --git a/etc/inc/disable-programs.inc b/etc/inc/disable-programs.inc index 7e3c0b657..976c2dab9 100644 --- a/etc/inc/disable-programs.inc +++ b/etc/inc/disable-programs.inc | |||
@@ -200,6 +200,7 @@ blacklist ${HOME}/.config/discord | |||
200 | blacklist ${HOME}/.config/discordcanary | 200 | blacklist ${HOME}/.config/discordcanary |
201 | blacklist ${HOME}/.config/dkl | 201 | blacklist ${HOME}/.config/dkl |
202 | blacklist ${HOME}/.config/dnox | 202 | blacklist ${HOME}/.config/dnox |
203 | blacklist ${HOME}/.config/dolphin-emu | ||
203 | blacklist ${HOME}/.config/dolphinrc | 204 | blacklist ${HOME}/.config/dolphinrc |
204 | blacklist ${HOME}/.config/dragonplayerrc | 205 | blacklist ${HOME}/.config/dragonplayerrc |
205 | blacklist ${HOME}/.config/draw.io | 206 | blacklist ${HOME}/.config/draw.io |
@@ -293,6 +294,7 @@ blacklist ${HOME}/.config/libreoffice | |||
293 | blacklist ${HOME}/.config/liferea | 294 | blacklist ${HOME}/.config/liferea |
294 | blacklist ${HOME}/.config/linphone | 295 | blacklist ${HOME}/.config/linphone |
295 | blacklist ${HOME}/.config/lugaru | 296 | blacklist ${HOME}/.config/lugaru |
297 | blacklist ${HOME}/.config/lutris | ||
296 | blacklist ${HOME}/.config/lximage-qt | 298 | blacklist ${HOME}/.config/lximage-qt |
297 | blacklist ${HOME}/.config/mailtransports | 299 | blacklist ${HOME}/.config/mailtransports |
298 | blacklist ${HOME}/.local/share/man | 300 | blacklist ${HOME}/.local/share/man |
@@ -378,6 +380,7 @@ blacklist ${HOME}/.config/spotify | |||
378 | blacklist ${HOME}/.config/sqlitebrowser | 380 | blacklist ${HOME}/.config/sqlitebrowser |
379 | blacklist ${HOME}/.config/stellarium | 381 | blacklist ${HOME}/.config/stellarium |
380 | blacklist ${HOME}/.config/strawberry | 382 | blacklist ${HOME}/.config/strawberry |
383 | blacklist ${HOME}/.config/straw-viewer | ||
381 | blacklist ${HOME}/.config/supertuxkart | 384 | blacklist ${HOME}/.config/supertuxkart |
382 | blacklist ${HOME}/.config/synfig | 385 | blacklist ${HOME}/.config/synfig |
383 | blacklist ${HOME}/.config/teams | 386 | blacklist ${HOME}/.config/teams |
@@ -584,6 +587,7 @@ blacklist ${HOME}/.local/share/agenda | |||
584 | blacklist ${HOME}/.local/share/apps/korganizer | 587 | blacklist ${HOME}/.local/share/apps/korganizer |
585 | blacklist ${HOME}/.local/share/aspyr-media | 588 | blacklist ${HOME}/.local/share/aspyr-media |
586 | blacklist ${HOME}/.local/share/autokey | 589 | blacklist ${HOME}/.local/share/autokey |
590 | blacklist ${HOME}/.local/share/authenticator-rs | ||
587 | blacklist ${HOME}/.local/share/backintime | 591 | blacklist ${HOME}/.local/share/backintime |
588 | blacklist ${HOME}/.local/share/baloo | 592 | blacklist ${HOME}/.local/share/baloo |
589 | blacklist ${HOME}/.local/share/barrier | 593 | blacklist ${HOME}/.local/share/barrier |
@@ -603,6 +607,7 @@ blacklist ${HOME}/.local/share/data/nomacs | |||
603 | blacklist ${HOME}/.local/share/data/qBittorrent | 607 | blacklist ${HOME}/.local/share/data/qBittorrent |
604 | blacklist ${HOME}/.local/share/dino | 608 | blacklist ${HOME}/.local/share/dino |
605 | blacklist ${HOME}/.local/share/dolphin | 609 | blacklist ${HOME}/.local/share/dolphin |
610 | blacklist ${HOME}/.local/share/dolphin-emu | ||
606 | blacklist ${HOME}/.local/share/emailidentities | 611 | blacklist ${HOME}/.local/share/emailidentities |
607 | blacklist ${HOME}/.local/share/epiphany | 612 | blacklist ${HOME}/.local/share/epiphany |
608 | blacklist ${HOME}/.local/share/evolution | 613 | blacklist ${HOME}/.local/share/evolution |
@@ -661,6 +666,7 @@ blacklist ${HOME}/.local/share/local-mail | |||
661 | blacklist ${HOME}/.local/share/lollypop | 666 | blacklist ${HOME}/.local/share/lollypop |
662 | blacklist ${HOME}/.local/share/love | 667 | blacklist ${HOME}/.local/share/love |
663 | blacklist ${HOME}/.local/share/lugaru | 668 | blacklist ${HOME}/.local/share/lugaru |
669 | blacklist ${HOME}/.local/share/lutris | ||
664 | blacklist ${HOME}/.local/share/mana | 670 | blacklist ${HOME}/.local/share/mana |
665 | blacklist ${HOME}/.local/share/maps-places.json | 671 | blacklist ${HOME}/.local/share/maps-places.json |
666 | blacklist ${HOME}/.local/share/meld | 672 | blacklist ${HOME}/.local/share/meld |
@@ -883,6 +889,7 @@ blacklist ${HOME}/.cache/deja-dup | |||
883 | blacklist ${HOME}/.cache/discover | 889 | blacklist ${HOME}/.cache/discover |
884 | blacklist ${HOME}/.cache/dnox | 890 | blacklist ${HOME}/.cache/dnox |
885 | blacklist ${HOME}/.cache/dolphin | 891 | blacklist ${HOME}/.cache/dolphin |
892 | blacklist ${HOME}/.cache/dolphin-emu | ||
886 | blacklist ${HOME}/.cache/ephemeral | 893 | blacklist ${HOME}/.cache/ephemeral |
887 | blacklist ${HOME}/.cache/epiphany | 894 | blacklist ${HOME}/.cache/epiphany |
888 | blacklist ${HOME}/.cache/evolution | 895 | blacklist ${HOME}/.cache/evolution |
@@ -932,6 +939,7 @@ blacklist ${HOME}/.cache/kube | |||
932 | blacklist ${HOME}/.cache/kwin | 939 | blacklist ${HOME}/.cache/kwin |
933 | blacklist ${HOME}/.cache/libgweather | 940 | blacklist ${HOME}/.cache/libgweather |
934 | blacklist ${HOME}/.cache/liferea | 941 | blacklist ${HOME}/.cache/liferea |
942 | blacklist ${HOME}/.cache/lutris | ||
935 | blacklist ${HOME}/.cache/Mendeley Ltd. | 943 | blacklist ${HOME}/.cache/Mendeley Ltd. |
936 | blacklist ${HOME}/.cache/midori | 944 | blacklist ${HOME}/.cache/midori |
937 | blacklist ${HOME}/.cache/minetest | 945 | blacklist ${HOME}/.cache/minetest |
@@ -972,6 +980,7 @@ blacklist ${HOME}/.cache/smuxi | |||
972 | blacklist ${HOME}/.cache/snox | 980 | blacklist ${HOME}/.cache/snox |
973 | blacklist ${HOME}/.cache/spotify | 981 | blacklist ${HOME}/.cache/spotify |
974 | blacklist ${HOME}/.cache/strawberry | 982 | blacklist ${HOME}/.cache/strawberry |
983 | blacklist ${HOME}/.cache/straw-viewer | ||
975 | blacklist ${HOME}/.cache/supertuxkart | 984 | blacklist ${HOME}/.cache/supertuxkart |
976 | blacklist ${HOME}/.cache/systemsettings | 985 | blacklist ${HOME}/.cache/systemsettings |
977 | blacklist ${HOME}/.cache/telepathy | 986 | blacklist ${HOME}/.cache/telepathy |
@@ -986,6 +995,7 @@ blacklist ${HOME}/.cache/vmware | |||
986 | blacklist ${HOME}/.cache/warsow-2.1 | 995 | blacklist ${HOME}/.cache/warsow-2.1 |
987 | blacklist ${HOME}/.cache/waterfox | 996 | blacklist ${HOME}/.cache/waterfox |
988 | blacklist ${HOME}/.cache/wesnoth | 997 | blacklist ${HOME}/.cache/wesnoth |
998 | blacklist ${HOME}/.cache/winetricks | ||
989 | blacklist ${HOME}/.cache/xmms2 | 999 | blacklist ${HOME}/.cache/xmms2 |
990 | blacklist ${HOME}/.cache/xreader | 1000 | blacklist ${HOME}/.cache/xreader |
991 | blacklist ${HOME}/.cache/yandex-browser | 1001 | blacklist ${HOME}/.cache/yandex-browser |
diff --git a/etc/inc/disable-write-mnt.inc b/etc/inc/disable-write-mnt.inc index 3990cf760..01f57cb0f 100644 --- a/etc/inc/disable-write-mnt.inc +++ b/etc/inc/disable-write-mnt.inc | |||
@@ -2,7 +2,7 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include disable-write-mnt.local | 3 | include disable-write-mnt.local |
4 | 4 | ||
5 | read-only /mnt | ||
6 | read-only /media | 5 | read-only /media |
7 | read-only /run/mount | 6 | read-only /mnt |
8 | read-only /run/media | 7 | read-only /run/media |
8 | read-only /run/mount | ||
diff --git a/etc/inc/firefox-common-addons.inc b/etc/inc/firefox-common-addons.inc index 198941ac9..03f09fece 100644 --- a/etc/inc/firefox-common-addons.inc +++ b/etc/inc/firefox-common-addons.inc | |||
@@ -2,6 +2,8 @@ | |||
2 | # Persistent customizations should go in a .local file. | 2 | # Persistent customizations should go in a .local file. |
3 | include firefox-common-addons.local | 3 | include firefox-common-addons.local |
4 | 4 | ||
5 | ignore include whitelist-runuser-common.inc | ||
6 | |||
5 | noblacklist ${HOME}/.config/kgetrc | 7 | noblacklist ${HOME}/.config/kgetrc |
6 | noblacklist ${HOME}/.config/okularpartrc | 8 | noblacklist ${HOME}/.config/okularpartrc |
7 | noblacklist ${HOME}/.config/okularrc | 9 | noblacklist ${HOME}/.config/okularrc |
diff --git a/etc/inc/whitelist-runuser-common.inc b/etc/inc/whitelist-runuser-common.inc index 7d9f106ef..d08d79eef 100644 --- a/etc/inc/whitelist-runuser-common.inc +++ b/etc/inc/whitelist-runuser-common.inc | |||
@@ -10,4 +10,5 @@ whitelist ${RUNUSER}/ICEauthority | |||
10 | whitelist ${RUNUSER}/.mutter-Xwaylandauth.* | 10 | whitelist ${RUNUSER}/.mutter-Xwaylandauth.* |
11 | whitelist ${RUNUSER}/pulse/native | 11 | whitelist ${RUNUSER}/pulse/native |
12 | whitelist ${RUNUSER}/wayland-0 | 12 | whitelist ${RUNUSER}/wayland-0 |
13 | whitelist ${RUNUSER}/wayland-1 | ||
13 | whitelist ${RUNUSER}/xauth_* | 14 | whitelist ${RUNUSER}/xauth_* |
diff --git a/etc/inc/whitelist-usr-share-common.inc b/etc/inc/whitelist-usr-share-common.inc index de4ae2101..785a1d7d4 100644 --- a/etc/inc/whitelist-usr-share-common.inc +++ b/etc/inc/whitelist-usr-share-common.inc | |||
@@ -60,6 +60,8 @@ whitelist /usr/share/texlive | |||
60 | whitelist /usr/share/texmf | 60 | whitelist /usr/share/texmf |
61 | whitelist /usr/share/themes | 61 | whitelist /usr/share/themes |
62 | whitelist /usr/share/thumbnail.so | 62 | whitelist /usr/share/thumbnail.so |
63 | whitelist /usr/share/vulkan | ||
63 | whitelist /usr/share/X11 | 64 | whitelist /usr/share/X11 |
64 | whitelist /usr/share/xml | 65 | whitelist /usr/share/xml |
66 | whitelist /usr/share/zenity | ||
65 | whitelist /usr/share/zoneinfo | 67 | whitelist /usr/share/zoneinfo |
diff --git a/etc/profile-a-l/0ad.profile b/etc/profile-a-l/0ad.profile index 6869ea631..c4e820078 100644 --- a/etc/profile-a-l/0ad.profile +++ b/etc/profile-a-l/0ad.profile | |||
@@ -16,6 +16,7 @@ include disable-exec.inc | |||
16 | include disable-interpreters.inc | 16 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 17 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 18 | include disable-programs.inc |
19 | include disable-xdg.inc | ||
19 | 20 | ||
20 | mkdir ${HOME}/.cache/0ad | 21 | mkdir ${HOME}/.cache/0ad |
21 | mkdir ${HOME}/.config/0ad | 22 | mkdir ${HOME}/.config/0ad |
@@ -40,6 +41,7 @@ nou2f | |||
40 | novideo | 41 | novideo |
41 | protocol unix,inet,inet6 | 42 | protocol unix,inet,inet6 |
42 | seccomp | 43 | seccomp |
44 | seccomp.block-secondary | ||
43 | shell none | 45 | shell none |
44 | tracelog | 46 | tracelog |
45 | 47 | ||
diff --git a/etc/profile-a-l/authenticator-rs.profile b/etc/profile-a-l/authenticator-rs.profile new file mode 100644 index 000000000..1eb802d9b --- /dev/null +++ b/etc/profile-a-l/authenticator-rs.profile | |||
@@ -0,0 +1,55 @@ | |||
1 | # Firejail profile for authenticator-rs | ||
2 | # Description: Rust based 2FA authentication program | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include authenticator-rs.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${HOME}/.local/share/authenticator-rs | ||
10 | |||
11 | include disable-common.inc | ||
12 | include disable-devel.inc | ||
13 | include disable-exec.inc | ||
14 | include disable-interpreters.inc | ||
15 | include disable-passwdmgr.inc | ||
16 | include disable-programs.inc | ||
17 | include disable-shell.inc | ||
18 | include disable-xdg.inc | ||
19 | |||
20 | mkdir ${HOME}/.local/share/authenticator-rs | ||
21 | whitelist ${HOME}/.local/share/authenticator-rs | ||
22 | whitelist ${DOWNLOADS} | ||
23 | whitelist /usr/share/uk.co.grumlimited.authenticator-rs | ||
24 | include whitelist-common.inc | ||
25 | include whitelist-runuser-common.inc | ||
26 | include whitelist-usr-share-common.inc | ||
27 | include whitelist-var-common.inc | ||
28 | |||
29 | apparmor | ||
30 | caps.drop all | ||
31 | netfilter | ||
32 | no3d | ||
33 | nodvd | ||
34 | nogroups | ||
35 | nonewprivs | ||
36 | noroot | ||
37 | nosound | ||
38 | notv | ||
39 | nou2f | ||
40 | novideo | ||
41 | protocol unix,inet,inet6 | ||
42 | seccomp | ||
43 | shell none | ||
44 | tracelog | ||
45 | |||
46 | disable-mnt | ||
47 | private-bin authenticator-rs | ||
48 | private-cache | ||
49 | private-dev | ||
50 | private-etc alternatives,ca-certificates,crypto-policies,dconf,fonts,gtk-2.0,gtk-3.0,pki,resolv.conf,ssl,xdg | ||
51 | private-tmp | ||
52 | |||
53 | dbus-user filter | ||
54 | dbus-user.talk ca.desrt.dconf | ||
55 | dbus-system none | ||
diff --git a/etc/profile-a-l/baobab.profile b/etc/profile-a-l/baobab.profile index 3937e1966..4401c9dfd 100644 --- a/etc/profile-a-l/baobab.profile +++ b/etc/profile-a-l/baobab.profile | |||
@@ -30,6 +30,7 @@ nou2f | |||
30 | novideo | 30 | novideo |
31 | protocol unix | 31 | protocol unix |
32 | seccomp | 32 | seccomp |
33 | seccomp.block-secondary | ||
33 | shell none | 34 | shell none |
34 | tracelog | 35 | tracelog |
35 | 36 | ||
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile index c1c338536..dbde3e4de 100644 --- a/etc/profile-a-l/bijiben.profile +++ b/etc/profile-a-l/bijiben.profile | |||
@@ -41,6 +41,7 @@ nou2f | |||
41 | novideo | 41 | novideo |
42 | protocol unix | 42 | protocol unix |
43 | seccomp | 43 | seccomp |
44 | seccomp.block-secondary | ||
44 | shell none | 45 | shell none |
45 | tracelog | 46 | tracelog |
46 | 47 | ||
diff --git a/etc/profile-a-l/celluloid.profile b/etc/profile-a-l/celluloid.profile index 8bf086ab4..56709a466 100644 --- a/etc/profile-a-l/celluloid.profile +++ b/etc/profile-a-l/celluloid.profile | |||
@@ -46,6 +46,7 @@ noroot | |||
46 | nou2f | 46 | nou2f |
47 | protocol unix,inet,inet6 | 47 | protocol unix,inet,inet6 |
48 | seccomp | 48 | seccomp |
49 | seccomp.block-secondary | ||
49 | shell none | 50 | shell none |
50 | tracelog | 51 | tracelog |
51 | 52 | ||
diff --git a/etc/profile-a-l/cower.profile b/etc/profile-a-l/cower.profile index 0ab5a7f78..2c6b15e02 100644 --- a/etc/profile-a-l/cower.profile +++ b/etc/profile-a-l/cower.profile | |||
@@ -46,5 +46,4 @@ private-dev | |||
46 | private-tmp | 46 | private-tmp |
47 | 47 | ||
48 | memory-deny-write-execute | 48 | memory-deny-write-execute |
49 | |||
50 | read-only ${HOME}/.config/cower/config | 49 | read-only ${HOME}/.config/cower/config |
diff --git a/etc/profile-a-l/dconf-editor.profile b/etc/profile-a-l/dconf-editor.profile index d6541850d..b41a73916 100644 --- a/etc/profile-a-l/dconf-editor.profile +++ b/etc/profile-a-l/dconf-editor.profile | |||
@@ -35,6 +35,7 @@ nou2f | |||
35 | novideo | 35 | novideo |
36 | protocol unix | 36 | protocol unix |
37 | seccomp | 37 | seccomp |
38 | seccomp.block-secondary | ||
38 | shell none | 39 | shell none |
39 | tracelog | 40 | tracelog |
40 | 41 | ||
diff --git a/etc/profile-a-l/default.profile b/etc/profile-a-l/default.profile index 7eb7660dd..2ecf1a45d 100644 --- a/etc/profile-a-l/default.profile +++ b/etc/profile-a-l/default.profile | |||
@@ -5,7 +5,7 @@ include default.local | |||
5 | # Persistent global definitions | 5 | # Persistent global definitions |
6 | include globals.local | 6 | include globals.local |
7 | 7 | ||
8 | # generic gui profile | 8 | # generic GUI profile |
9 | # depending on your usage, you can enable some of the commands below: | 9 | # depending on your usage, you can enable some of the commands below: |
10 | 10 | ||
11 | include disable-common.inc | 11 | include disable-common.inc |
@@ -14,12 +14,13 @@ include disable-common.inc | |||
14 | # include disable-interpreters.inc | 14 | # include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | # include disable-shell.inc | ||
17 | # include disable-write-mnt.inc | 18 | # include disable-write-mnt.inc |
18 | # include disable-xdg.inc | 19 | # include disable-xdg.inc |
19 | 20 | ||
20 | # include whitelist-common.inc | 21 | # include whitelist-common.inc |
21 | # include whitelist-usr-share-common.inc | ||
22 | # include whitelist-runuser-common.inc | 22 | # include whitelist-runuser-common.inc |
23 | # include whitelist-usr-share-common.inc | ||
23 | # include whitelist-var-common.inc | 24 | # include whitelist-var-common.inc |
24 | 25 | ||
25 | # apparmor | 26 | # apparmor |
diff --git a/etc/profile-a-l/devhelp.profile b/etc/profile-a-l/devhelp.profile index b8b07469d..a47a71feb 100644 --- a/etc/profile-a-l/devhelp.profile +++ b/etc/profile-a-l/devhelp.profile | |||
@@ -50,5 +50,4 @@ private-tmp | |||
50 | # dbus-system none | 50 | # dbus-system none |
51 | 51 | ||
52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 52 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
53 | |||
54 | read-only ${HOME} | 53 | read-only ${HOME} |
diff --git a/etc/profile-a-l/devilspie.profile b/etc/profile-a-l/devilspie.profile index 1ab10a6f6..7c3ac50ad 100644 --- a/etc/profile-a-l/devilspie.profile +++ b/etc/profile-a-l/devilspie.profile | |||
@@ -56,5 +56,4 @@ dbus-user none | |||
56 | dbus-system none | 56 | dbus-system none |
57 | 57 | ||
58 | memory-deny-write-execute | 58 | memory-deny-write-execute |
59 | |||
60 | read-only ${HOME} | 59 | read-only ${HOME} |
diff --git a/etc/profile-a-l/dia.profile b/etc/profile-a-l/dia.profile index 52bf1c7f8..e409eb044 100644 --- a/etc/profile-a-l/dia.profile +++ b/etc/profile-a-l/dia.profile | |||
@@ -9,16 +9,24 @@ include globals.local | |||
9 | noblacklist ${HOME}/.dia | 9 | noblacklist ${HOME}/.dia |
10 | noblacklist ${DOCUMENTS} | 10 | noblacklist ${DOCUMENTS} |
11 | 11 | ||
12 | include allow-python2.inc | ||
13 | include allow-python3.inc | ||
14 | |||
12 | include disable-common.inc | 15 | include disable-common.inc |
13 | include disable-devel.inc | 16 | include disable-devel.inc |
14 | include disable-exec.inc | 17 | include disable-exec.inc |
15 | include allow-python2.inc | ||
16 | include allow-python3.inc | ||
17 | include disable-interpreters.inc | 18 | include disable-interpreters.inc |
18 | include disable-passwdmgr.inc | 19 | include disable-passwdmgr.inc |
19 | include disable-programs.inc | 20 | include disable-programs.inc |
20 | include disable-xdg.inc | 21 | include disable-xdg.inc |
21 | 22 | ||
23 | #mkdir ${HOME}/.dia | ||
24 | #whitelist ${HOME}/.dia | ||
25 | #whitelist ${DOCUMENTS} | ||
26 | #include whitelist-common.inc | ||
27 | whitelist /usr/share/dia | ||
28 | include whitelist-runuser-common.inc | ||
29 | include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
23 | 31 | ||
24 | apparmor | 32 | apparmor |
@@ -36,6 +44,7 @@ novideo | |||
36 | protocol unix | 44 | protocol unix |
37 | seccomp | 45 | seccomp |
38 | shell none | 46 | shell none |
47 | tracelog | ||
39 | 48 | ||
40 | disable-mnt | 49 | disable-mnt |
41 | #private-bin dia | 50 | #private-bin dia |
diff --git a/etc/profile-a-l/dolphin-emu.profile b/etc/profile-a-l/dolphin-emu.profile new file mode 100644 index 000000000..13d830b55 --- /dev/null +++ b/etc/profile-a-l/dolphin-emu.profile | |||
@@ -0,0 +1,63 @@ | |||
1 | # Firejail profile for dolphin-emu | ||
2 | # Description: An emulator for Gamecube and Wii games | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include dolphin-emu.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | # Note: you must whitelist your games folder in a dolphin-emu.local | ||
10 | |||
11 | noblacklist ${HOME}/.cache/dolphin-emu | ||
12 | noblacklist ${HOME}/.config/dolphin-emu | ||
13 | noblacklist ${HOME}/.local/share/dolphin-emu | ||
14 | |||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-passwdmgr.inc | ||
20 | include disable-programs.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | mkdir ${HOME}/.cache/dolphin-emu | ||
24 | mkdir ${HOME}/.config/dolphin-emu | ||
25 | mkdir ${HOME}/.local/share/dolphin-emu | ||
26 | whitelist ${HOME}/.cache/dolphin-emu | ||
27 | whitelist ${HOME}/.config/dolphin-emu | ||
28 | whitelist ${HOME}/.local/share/dolphin-emu | ||
29 | whitelist /usr/share/dolphin-emu | ||
30 | include whitelist-common.inc | ||
31 | include whitelist-runuser-common.inc | ||
32 | include whitelist-usr-share-common.inc | ||
33 | include whitelist-var-common.inc | ||
34 | |||
35 | apparmor | ||
36 | caps.drop all | ||
37 | ipc-namespace | ||
38 | # uncomment the following line if you do not need NetPlay support | ||
39 | # net none | ||
40 | netfilter | ||
41 | # uncomment the following line if you do not need disc support | ||
42 | #nodvd | ||
43 | nogroups | ||
44 | nonewprivs | ||
45 | noroot | ||
46 | notv | ||
47 | nou2f | ||
48 | novideo | ||
49 | protocol unix,inet,inet6,netlink,bluetooth | ||
50 | seccomp | ||
51 | shell none | ||
52 | tracelog | ||
53 | |||
54 | private-bin bash,dolphin-emu,dolphin-emu-x11,sh | ||
55 | private-cache | ||
56 | # uncomment the following line if you do not need controller support | ||
57 | #private-dev | ||
58 | private-etc alsa,alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dconf,drirc,fonts,gconf,glvnd,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,kde4rc,kde5rc,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,machine-id,mime.types,nsswitch.conf,nvidia,pango,pki,protocols,pulse,resolv.conf,rpc,services,ssl,Trolltech.conf,X11,xdg | ||
59 | private-opt none | ||
60 | private-tmp | ||
61 | |||
62 | dbus-user none | ||
63 | dbus-system none | ||
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile index c1aa821e3..2d56369cd 100644 --- a/etc/profile-a-l/element-desktop.profile +++ b/etc/profile-a-l/element-desktop.profile | |||
@@ -8,12 +8,9 @@ include element-desktop.local | |||
8 | #include globals.local | 8 | #include globals.local |
9 | 9 | ||
10 | noblacklist ${HOME}/.config/Element | 10 | noblacklist ${HOME}/.config/Element |
11 | noblacklist ${HOME}/.config/Element (Riot) | ||
12 | 11 | ||
13 | mkdir ${HOME}/.config/Element | 12 | mkdir ${HOME}/.config/Element |
14 | mkdir ${HOME}/.config/Element (Riot) | ||
15 | whitelist ${HOME}/.config/Element | 13 | whitelist ${HOME}/.config/Element |
16 | whitelist ${HOME}/.config/Element (Riot) | ||
17 | whitelist /opt/Element | 14 | whitelist /opt/Element |
18 | 15 | ||
19 | private-opt Element | 16 | private-opt Element |
diff --git a/etc/profile-a-l/eo-common.profile b/etc/profile-a-l/eo-common.profile index e8b49a395..e059f3b74 100644 --- a/etc/profile-a-l/eo-common.profile +++ b/etc/profile-a-l/eo-common.profile | |||
@@ -27,6 +27,7 @@ apparmor | |||
27 | caps.drop all | 27 | caps.drop all |
28 | ipc-namespace | 28 | ipc-namespace |
29 | machine-id | 29 | machine-id |
30 | net none | ||
30 | no3d | 31 | no3d |
31 | nodvd | 32 | nodvd |
32 | nogroups | 33 | nogroups |
@@ -38,6 +39,7 @@ nou2f | |||
38 | novideo | 39 | novideo |
39 | protocol unix,netlink | 40 | protocol unix,netlink |
40 | seccomp | 41 | seccomp |
42 | seccomp.block-secondary | ||
41 | shell none | 43 | shell none |
42 | tracelog | 44 | tracelog |
43 | 45 | ||
diff --git a/etc/profile-a-l/evince.profile b/etc/profile-a-l/evince.profile index 77a48f0ba..c0c16e929 100644 --- a/etc/profile-a-l/evince.profile +++ b/etc/profile-a-l/evince.profile | |||
@@ -41,6 +41,7 @@ nou2f | |||
41 | novideo | 41 | novideo |
42 | protocol unix | 42 | protocol unix |
43 | seccomp | 43 | seccomp |
44 | seccomp.block-secondary | ||
44 | shell none | 45 | shell none |
45 | tracelog | 46 | tracelog |
46 | 47 | ||
diff --git a/etc/profile-a-l/falkon.profile b/etc/profile-a-l/falkon.profile index 0024b6660..640b0e485 100644 --- a/etc/profile-a-l/falkon.profile +++ b/etc/profile-a-l/falkon.profile | |||
@@ -15,15 +15,20 @@ include disable-exec.inc | |||
15 | include disable-interpreters.inc | 15 | include disable-interpreters.inc |
16 | include disable-passwdmgr.inc | 16 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 17 | include disable-programs.inc |
18 | include disable-xdg.inc | ||
18 | 19 | ||
19 | mkdir ${HOME}/.cache/falkon | 20 | mkdir ${HOME}/.cache/falkon |
20 | mkdir ${HOME}/.config/falkon | 21 | mkdir ${HOME}/.config/falkon |
21 | whitelist ${DOWNLOADS} | 22 | whitelist ${DOWNLOADS} |
22 | whitelist ${HOME}/.cache/falkon | 23 | whitelist ${HOME}/.cache/falkon |
23 | whitelist ${HOME}/.config/falkon | 24 | whitelist ${HOME}/.config/falkon |
25 | whitelist /usr/share/falkon | ||
24 | include whitelist-common.inc | 26 | include whitelist-common.inc |
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
25 | include whitelist-var-common.inc | 29 | include whitelist-var-common.inc |
26 | 30 | ||
31 | apparmor | ||
27 | caps.drop all | 32 | caps.drop all |
28 | netfilter | 33 | netfilter |
29 | nodvd | 34 | nodvd |
@@ -37,7 +42,13 @@ protocol unix,inet,inet6,netlink | |||
37 | seccomp !chroot | 42 | seccomp !chroot |
38 | # tracelog | 43 | # tracelog |
39 | 44 | ||
45 | disable-mnt | ||
46 | # private-bin falkon | ||
47 | private-cache | ||
40 | private-dev | 48 | private-dev |
41 | # private-etc alternatives,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,adobe,mime.types,mailcap,asound.conf,pulse,machine-id,ca-certificates,ssl,pki,crypto-policies | 49 | private-etc adobe,alternatives,asound.conf,ati,ca-certificates,crypto-policies,dconf,drirc,fonts,group,gtk-2.0,gtk-3.0,hostname,hosts,localtime,machine-id,mailcap,mime.types,nsswitch.conf,pango,passwd,pki,pulse,resolv.conf,selinux,ssl,xdg |
42 | # private-tmp - interferes with the opening of downloaded files | 50 | private-tmp |
43 | 51 | ||
52 | # dbus-user filter | ||
53 | # dbus-user.own org.kde.Falkon | ||
54 | dbus-system none | ||
diff --git a/etc/profile-a-l/ffmpeg.profile b/etc/profile-a-l/ffmpeg.profile index fb5c9ee57..c6e9ba095 100644 --- a/etc/profile-a-l/ffmpeg.profile +++ b/etc/profile-a-l/ffmpeg.profile | |||
@@ -41,6 +41,7 @@ novideo | |||
41 | protocol inet,inet6 | 41 | protocol inet,inet6 |
42 | # allow set_mempolicy, which is required to encode using libx265 | 42 | # allow set_mempolicy, which is required to encode using libx265 |
43 | seccomp !set_mempolicy | 43 | seccomp !set_mempolicy |
44 | seccomp.block-secondary | ||
44 | shell none | 45 | shell none |
45 | tracelog | 46 | tracelog |
46 | 47 | ||
diff --git a/etc/profile-a-l/file-roller.profile b/etc/profile-a-l/file-roller.profile index 745b8b8e9..2a1eb2001 100644 --- a/etc/profile-a-l/file-roller.profile +++ b/etc/profile-a-l/file-roller.profile | |||
@@ -34,6 +34,7 @@ nou2f | |||
34 | novideo | 34 | novideo |
35 | protocol unix | 35 | protocol unix |
36 | seccomp | 36 | seccomp |
37 | seccomp.block-secondary | ||
37 | shell none | 38 | shell none |
38 | tracelog | 39 | tracelog |
39 | 40 | ||
diff --git a/etc/profile-a-l/firefox-common.profile b/etc/profile-a-l/firefox-common.profile index 7c343c26d..fe0a27828 100644 --- a/etc/profile-a-l/firefox-common.profile +++ b/etc/profile-a-l/firefox-common.profile | |||
@@ -27,6 +27,7 @@ whitelist ${DOWNLOADS} | |||
27 | whitelist ${HOME}/.pki | 27 | whitelist ${HOME}/.pki |
28 | whitelist ${HOME}/.local/share/pki | 28 | whitelist ${HOME}/.local/share/pki |
29 | include whitelist-common.inc | 29 | include whitelist-common.inc |
30 | include whitelist-runuser-common.inc | ||
30 | include whitelist-var-common.inc | 31 | include whitelist-var-common.inc |
31 | 32 | ||
32 | apparmor | 33 | apparmor |
diff --git a/etc/profile-a-l/firefox.profile b/etc/profile-a-l/firefox.profile index 3472ac5c4..772aad7da 100644 --- a/etc/profile-a-l/firefox.profile +++ b/etc/profile-a-l/firefox.profile | |||
@@ -16,6 +16,7 @@ whitelist ${HOME}/.mozilla | |||
16 | 16 | ||
17 | whitelist /usr/share/doc | 17 | whitelist /usr/share/doc |
18 | whitelist /usr/share/firefox | 18 | whitelist /usr/share/firefox |
19 | whitelist /usr/share/gnome-shell/search-providers/firefox-search-provider.ini | ||
19 | whitelist /usr/share/gtk-doc/html | 20 | whitelist /usr/share/gtk-doc/html |
20 | whitelist /usr/share/mozilla | 21 | whitelist /usr/share/mozilla |
21 | whitelist /usr/share/webext | 22 | whitelist /usr/share/webext |
@@ -29,6 +30,7 @@ include whitelist-usr-share-common.inc | |||
29 | #private-etc firefox | 30 | #private-etc firefox |
30 | 31 | ||
31 | dbus-user filter | 32 | dbus-user filter |
33 | dbus-user.own org.mozilla.Firefox.* | ||
32 | dbus-user.own org.mozilla.firefox.* | 34 | dbus-user.own org.mozilla.firefox.* |
33 | dbus-user.own org.mpris.MediaPlayer2.firefox.* | 35 | dbus-user.own org.mpris.MediaPlayer2.firefox.* |
34 | # Uncomment or put in your firefox.local to enable native notifications. | 36 | # Uncomment or put in your firefox.local to enable native notifications. |
diff --git a/etc/profile-a-l/flameshot.profile b/etc/profile-a-l/flameshot.profile index 357354e70..851a7c747 100644 --- a/etc/profile-a-l/flameshot.profile +++ b/etc/profile-a-l/flameshot.profile | |||
@@ -45,6 +45,7 @@ nou2f | |||
45 | novideo | 45 | novideo |
46 | protocol unix,inet,inet6 | 46 | protocol unix,inet,inet6 |
47 | seccomp | 47 | seccomp |
48 | seccomp.block-secondary | ||
48 | shell none | 49 | shell none |
49 | tracelog | 50 | tracelog |
50 | 51 | ||
diff --git a/etc/profile-a-l/frogatto.profile b/etc/profile-a-l/frogatto.profile index 653272499..23d259337 100644 --- a/etc/profile-a-l/frogatto.profile +++ b/etc/profile-a-l/frogatto.profile | |||
@@ -36,6 +36,7 @@ nou2f | |||
36 | novideo | 36 | novideo |
37 | protocol unix | 37 | protocol unix |
38 | seccomp | 38 | seccomp |
39 | seccomp.block-secondary | ||
39 | shell none | 40 | shell none |
40 | tracelog | 41 | tracelog |
41 | 42 | ||
diff --git a/etc/profile-a-l/gapplication.profile b/etc/profile-a-l/gapplication.profile index 74b468020..e339f6abb 100644 --- a/etc/profile-a-l/gapplication.profile +++ b/etc/profile-a-l/gapplication.profile | |||
@@ -38,6 +38,7 @@ nou2f | |||
38 | novideo | 38 | novideo |
39 | protocol unix | 39 | protocol unix |
40 | seccomp | 40 | seccomp |
41 | seccomp.block-secondary | ||
41 | shell none | 42 | shell none |
42 | tracelog | 43 | tracelog |
43 | x11 none | 44 | x11 none |
diff --git a/etc/profile-a-l/gedit.profile b/etc/profile-a-l/gedit.profile index 17b7ad563..30251fbe5 100644 --- a/etc/profile-a-l/gedit.profile +++ b/etc/profile-a-l/gedit.profile | |||
@@ -37,6 +37,7 @@ nou2f | |||
37 | novideo | 37 | novideo |
38 | protocol unix | 38 | protocol unix |
39 | seccomp | 39 | seccomp |
40 | seccomp.block-secondary | ||
40 | shell none | 41 | shell none |
41 | tracelog | 42 | tracelog |
42 | 43 | ||
diff --git a/etc/profile-a-l/geekbench.profile b/etc/profile-a-l/geekbench.profile index e06a9afad..77287769a 100644 --- a/etc/profile-a-l/geekbench.profile +++ b/etc/profile-a-l/geekbench.profile | |||
@@ -51,5 +51,4 @@ dbus-user none | |||
51 | dbus-system none | 51 | dbus-system none |
52 | 52 | ||
53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 53 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
54 | |||
55 | read-only ${HOME} | 54 | read-only ${HOME} |
diff --git a/etc/profile-a-l/gfeeds.profile b/etc/profile-a-l/gfeeds.profile index d97ab530b..b8d1b9608 100644 --- a/etc/profile-a-l/gfeeds.profile +++ b/etc/profile-a-l/gfeeds.profile | |||
@@ -49,6 +49,7 @@ nou2f | |||
49 | novideo | 49 | novideo |
50 | protocol unix,inet,inet6 | 50 | protocol unix,inet,inet6 |
51 | seccomp | 51 | seccomp |
52 | seccomp.block-secondary | ||
52 | shell none | 53 | shell none |
53 | tracelog | 54 | tracelog |
54 | 55 | ||
diff --git a/etc/profile-a-l/ghostwriter.profile b/etc/profile-a-l/ghostwriter.profile index 5bb410278..d56d6714e 100644 --- a/etc/profile-a-l/ghostwriter.profile +++ b/etc/profile-a-l/ghostwriter.profile | |||
@@ -11,6 +11,8 @@ noblacklist ${HOME}/.local/share/ghostwriter | |||
11 | noblacklist ${DOCUMENTS} | 11 | noblacklist ${DOCUMENTS} |
12 | noblacklist ${PICTURES} | 12 | noblacklist ${PICTURES} |
13 | 13 | ||
14 | include allow-lua.inc | ||
15 | |||
14 | include disable-common.inc | 16 | include disable-common.inc |
15 | include disable-devel.inc | 17 | include disable-devel.inc |
16 | include disable-exec.inc | 18 | include disable-exec.inc |
@@ -26,6 +28,7 @@ whitelist /usr/share/texlive | |||
26 | whitelist /usr/share/pandoc* | 28 | whitelist /usr/share/pandoc* |
27 | include whitelist-runuser-common.inc | 29 | include whitelist-runuser-common.inc |
28 | include whitelist-usr-share-common.inc | 30 | include whitelist-usr-share-common.inc |
31 | include whitelist-var-common.inc | ||
29 | 32 | ||
30 | apparmor | 33 | apparmor |
31 | caps.drop all | 34 | caps.drop all |
@@ -41,6 +44,7 @@ nou2f | |||
41 | novideo | 44 | novideo |
42 | protocol unix,inet,inet6,netlink | 45 | protocol unix,inet,inet6,netlink |
43 | seccomp !chroot | 46 | seccomp !chroot |
47 | seccomp.block-secondary | ||
44 | shell none | 48 | shell none |
45 | #tracelog -- breaks | 49 | #tracelog -- breaks |
46 | 50 | ||
diff --git a/etc/profile-a-l/gimp.profile b/etc/profile-a-l/gimp.profile index ed27de7f5..bc5ef966c 100644 --- a/etc/profile-a-l/gimp.profile +++ b/etc/profile-a-l/gimp.profile | |||
@@ -52,7 +52,7 @@ nosound | |||
52 | notv | 52 | notv |
53 | nou2f | 53 | nou2f |
54 | protocol unix | 54 | protocol unix |
55 | seccomp | 55 | seccomp !mbind |
56 | shell none | 56 | shell none |
57 | tracelog | 57 | tracelog |
58 | 58 | ||
diff --git a/etc/profile-a-l/gitg.profile b/etc/profile-a-l/gitg.profile index 71b8e9b11..3d80c1ed2 100644 --- a/etc/profile-a-l/gitg.profile +++ b/etc/profile-a-l/gitg.profile | |||
@@ -45,6 +45,7 @@ nou2f | |||
45 | novideo | 45 | novideo |
46 | protocol unix,inet,inet6 | 46 | protocol unix,inet,inet6 |
47 | seccomp | 47 | seccomp |
48 | seccomp.block-secondary | ||
48 | shell none | 49 | shell none |
49 | tracelog | 50 | tracelog |
50 | 51 | ||
diff --git a/etc/profile-a-l/gnome-calculator.profile b/etc/profile-a-l/gnome-calculator.profile index ceb01f2a0..7780dfa65 100644 --- a/etc/profile-a-l/gnome-calculator.profile +++ b/etc/profile-a-l/gnome-calculator.profile | |||
@@ -38,6 +38,7 @@ nou2f | |||
38 | novideo | 38 | novideo |
39 | protocol unix,inet,inet6 | 39 | protocol unix,inet,inet6 |
40 | seccomp | 40 | seccomp |
41 | seccomp.block-secondary | ||
41 | shell none | 42 | shell none |
42 | tracelog | 43 | tracelog |
43 | 44 | ||
diff --git a/etc/profile-a-l/gnome-calendar.profile b/etc/profile-a-l/gnome-calendar.profile index 3e815234c..9927fb869 100644 --- a/etc/profile-a-l/gnome-calendar.profile +++ b/etc/profile-a-l/gnome-calendar.profile | |||
@@ -36,6 +36,7 @@ nou2f | |||
36 | novideo | 36 | novideo |
37 | protocol unix,inet,inet6 | 37 | protocol unix,inet,inet6 |
38 | seccomp | 38 | seccomp |
39 | seccomp.block-secondary | ||
39 | shell none | 40 | shell none |
40 | tracelog | 41 | tracelog |
41 | 42 | ||
diff --git a/etc/profile-a-l/gnome-characters.profile b/etc/profile-a-l/gnome-characters.profile index f4f3ae2d7..4d53a67dd 100644 --- a/etc/profile-a-l/gnome-characters.profile +++ b/etc/profile-a-l/gnome-characters.profile | |||
@@ -39,6 +39,7 @@ nou2f | |||
39 | novideo | 39 | novideo |
40 | protocol unix | 40 | protocol unix |
41 | seccomp | 41 | seccomp |
42 | seccomp.block-secondary | ||
42 | shell none | 43 | shell none |
43 | tracelog | 44 | tracelog |
44 | 45 | ||
diff --git a/etc/profile-a-l/gnome-contacts.profile b/etc/profile-a-l/gnome-contacts.profile index 7a38bdc8a..03b89e394 100644 --- a/etc/profile-a-l/gnome-contacts.profile +++ b/etc/profile-a-l/gnome-contacts.profile | |||
@@ -32,6 +32,7 @@ nou2f | |||
32 | novideo | 32 | novideo |
33 | protocol unix,inet,inet6,netlink | 33 | protocol unix,inet,inet6,netlink |
34 | seccomp | 34 | seccomp |
35 | seccomp.block-secondary | ||
35 | 36 | ||
36 | disable-mnt | 37 | disable-mnt |
37 | private-dev | 38 | private-dev |
diff --git a/etc/profile-a-l/gnome-hexgl.profile b/etc/profile-a-l/gnome-hexgl.profile index 5ae7bbe01..bb5ef0eab 100644 --- a/etc/profile-a-l/gnome-hexgl.profile +++ b/etc/profile-a-l/gnome-hexgl.profile | |||
@@ -33,6 +33,7 @@ nou2f | |||
33 | novideo | 33 | novideo |
34 | protocol unix | 34 | protocol unix |
35 | seccomp | 35 | seccomp |
36 | seccomp.block-secondary | ||
36 | shell none | 37 | shell none |
37 | tracelog | 38 | tracelog |
38 | 39 | ||
diff --git a/etc/profile-a-l/gnome-keyring.profile b/etc/profile-a-l/gnome-keyring.profile index ecbb74158..a0b9ef04e 100644 --- a/etc/profile-a-l/gnome-keyring.profile +++ b/etc/profile-a-l/gnome-keyring.profile | |||
@@ -9,8 +9,6 @@ include globals.local | |||
9 | 9 | ||
10 | noblacklist ${HOME}/.gnupg | 10 | noblacklist ${HOME}/.gnupg |
11 | 11 | ||
12 | whitelist ${HOME}/.gnupg | ||
13 | whitelist ${DOWNLOADS} | ||
14 | include disable-common.inc | 12 | include disable-common.inc |
15 | include disable-devel.inc | 13 | include disable-devel.inc |
16 | include disable-exec.inc | 14 | include disable-exec.inc |
@@ -19,9 +17,15 @@ include disable-interpreters.inc | |||
19 | include disable-programs.inc | 17 | include disable-programs.inc |
20 | include disable-xdg.inc | 18 | include disable-xdg.inc |
21 | 19 | ||
20 | mkdir ${HOME}/.gnupg | ||
21 | whitelist ${HOME}/.gnupg | ||
22 | whitelist ${DOWNLOADS} | ||
23 | whitelist ${RUNUSER}/gnupg | ||
24 | whitelist ${RUNUSER}/keyring | ||
22 | whitelist /usr/share/gnupg | 25 | whitelist /usr/share/gnupg |
23 | whitelist /usr/share/gnupg2 | 26 | whitelist /usr/share/gnupg2 |
24 | include whitelist-common.inc | 27 | include whitelist-common.inc |
28 | include whitelist-runuser-common.inc | ||
25 | include whitelist-usr-share-common.inc | 29 | include whitelist-usr-share-common.inc |
26 | include whitelist-var-common.inc | 30 | include whitelist-var-common.inc |
27 | 31 | ||
@@ -41,6 +45,7 @@ nou2f | |||
41 | novideo | 45 | novideo |
42 | protocol unix,inet,inet6 | 46 | protocol unix,inet,inet6 |
43 | seccomp | 47 | seccomp |
48 | seccomp.block-secondary | ||
44 | shell none | 49 | shell none |
45 | tracelog | 50 | tracelog |
46 | 51 | ||
@@ -52,6 +57,6 @@ private-dev | |||
52 | private-tmp | 57 | private-tmp |
53 | 58 | ||
54 | # dbus-user none | 59 | # dbus-user none |
55 | # dbus-system none | 60 | dbus-system none |
56 | 61 | ||
57 | memory-deny-write-execute | 62 | memory-deny-write-execute |
diff --git a/etc/profile-a-l/gnome-latex.profile b/etc/profile-a-l/gnome-latex.profile index 11d184bc6..87376da40 100644 --- a/etc/profile-a-l/gnome-latex.profile +++ b/etc/profile-a-l/gnome-latex.profile | |||
@@ -41,6 +41,7 @@ nou2f | |||
41 | novideo | 41 | novideo |
42 | protocol unix | 42 | protocol unix |
43 | seccomp | 43 | seccomp |
44 | seccomp.block-secondary | ||
44 | shell none | 45 | shell none |
45 | tracelog | 46 | tracelog |
46 | 47 | ||
diff --git a/etc/profile-a-l/gnome-maps.profile b/etc/profile-a-l/gnome-maps.profile index eb0030dda..23629df95 100644 --- a/etc/profile-a-l/gnome-maps.profile +++ b/etc/profile-a-l/gnome-maps.profile | |||
@@ -54,6 +54,7 @@ nou2f | |||
54 | novideo | 54 | novideo |
55 | protocol unix,inet,inet6 | 55 | protocol unix,inet,inet6 |
56 | seccomp | 56 | seccomp |
57 | seccomp.block-secondary | ||
57 | shell none | 58 | shell none |
58 | tracelog | 59 | tracelog |
59 | 60 | ||
diff --git a/etc/profile-a-l/gnome-passwordsafe.profile b/etc/profile-a-l/gnome-passwordsafe.profile index ed430b654..073de47b9 100644 --- a/etc/profile-a-l/gnome-passwordsafe.profile +++ b/etc/profile-a-l/gnome-passwordsafe.profile | |||
@@ -43,6 +43,7 @@ nou2f | |||
43 | novideo | 43 | novideo |
44 | protocol unix | 44 | protocol unix |
45 | seccomp | 45 | seccomp |
46 | seccomp.block-secondary | ||
46 | shell none | 47 | shell none |
47 | tracelog | 48 | tracelog |
48 | 49 | ||
diff --git a/etc/profile-a-l/gnome-photos.profile b/etc/profile-a-l/gnome-photos.profile index 2af406af9..65cc23b5f 100644 --- a/etc/profile-a-l/gnome-photos.profile +++ b/etc/profile-a-l/gnome-photos.profile | |||
@@ -33,6 +33,7 @@ nou2f | |||
33 | novideo | 33 | novideo |
34 | protocol unix | 34 | protocol unix |
35 | seccomp | 35 | seccomp |
36 | seccomp.block-secondary | ||
36 | shell none | 37 | shell none |
37 | tracelog | 38 | tracelog |
38 | 39 | ||
diff --git a/etc/profile-a-l/gnome-screenshot.profile b/etc/profile-a-l/gnome-screenshot.profile index 82fb1b658..2534eed5a 100644 --- a/etc/profile-a-l/gnome-screenshot.profile +++ b/etc/profile-a-l/gnome-screenshot.profile | |||
@@ -35,6 +35,7 @@ nou2f | |||
35 | novideo | 35 | novideo |
36 | protocol unix | 36 | protocol unix |
37 | seccomp | 37 | seccomp |
38 | seccomp.block-secondary | ||
38 | shell none | 39 | shell none |
39 | tracelog | 40 | tracelog |
40 | 41 | ||
diff --git a/etc/profile-a-l/gnome-sound-recorder.profile b/etc/profile-a-l/gnome-sound-recorder.profile index a64ec25a9..2e063ebfe 100644 --- a/etc/profile-a-l/gnome-sound-recorder.profile +++ b/etc/profile-a-l/gnome-sound-recorder.profile | |||
@@ -33,6 +33,7 @@ nou2f | |||
33 | novideo | 33 | novideo |
34 | protocol unix | 34 | protocol unix |
35 | seccomp | 35 | seccomp |
36 | seccomp.block-secondary | ||
36 | shell none | 37 | shell none |
37 | tracelog | 38 | tracelog |
38 | 39 | ||
diff --git a/etc/profile-a-l/gnome-system-log.profile b/etc/profile-a-l/gnome-system-log.profile index 14b0f758e..9c0a26a02 100644 --- a/etc/profile-a-l/gnome-system-log.profile +++ b/etc/profile-a-l/gnome-system-log.profile | |||
@@ -53,7 +53,6 @@ writable-var-log | |||
53 | # dbus-system none | 53 | # dbus-system none |
54 | 54 | ||
55 | memory-deny-write-execute | 55 | memory-deny-write-execute |
56 | 56 | # Comment the line below if you export logs to a file in your ${HOME} | |
57 | # comment this if you export logs to a file in your ${HOME} | ||
58 | # or put 'ignore read-only ${HOME}' in your gnome-system-log.local | 57 | # or put 'ignore read-only ${HOME}' in your gnome-system-log.local |
59 | read-only ${HOME} | 58 | read-only ${HOME} |
diff --git a/etc/profile-a-l/gnome-weather.profile b/etc/profile-a-l/gnome-weather.profile index a181f1b9e..beed92a7d 100644 --- a/etc/profile-a-l/gnome-weather.profile +++ b/etc/profile-a-l/gnome-weather.profile | |||
@@ -37,6 +37,7 @@ nou2f | |||
37 | novideo | 37 | novideo |
38 | protocol unix,inet,inet6 | 38 | protocol unix,inet,inet6 |
39 | seccomp | 39 | seccomp |
40 | seccomp.block-secondary | ||
40 | shell none | 41 | shell none |
41 | tracelog | 42 | tracelog |
42 | 43 | ||
diff --git a/etc/profile-a-l/gnome_games-common.profile b/etc/profile-a-l/gnome_games-common.profile index c46fbc1d9..56ed7a436 100644 --- a/etc/profile-a-l/gnome_games-common.profile +++ b/etc/profile-a-l/gnome_games-common.profile | |||
@@ -34,6 +34,7 @@ nou2f | |||
34 | novideo | 34 | novideo |
35 | protocol unix | 35 | protocol unix |
36 | seccomp | 36 | seccomp |
37 | seccomp.block-secondary | ||
37 | shell none | 38 | shell none |
38 | tracelog | 39 | tracelog |
39 | 40 | ||
diff --git a/etc/profile-a-l/godot.profile b/etc/profile-a-l/godot.profile index 8324a4eb5..f37f345ba 100644 --- a/etc/profile-a-l/godot.profile +++ b/etc/profile-a-l/godot.profile | |||
@@ -38,7 +38,7 @@ tracelog | |||
38 | # private-bin godot | 38 | # private-bin godot |
39 | private-cache | 39 | private-cache |
40 | private-dev | 40 | private-dev |
41 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl | 41 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,machine-id,mono,nsswitch.conf,openal,pki,pulse,resolv.conf,ssl |
42 | private-tmp | 42 | private-tmp |
43 | 43 | ||
44 | dbus-user none | 44 | dbus-user none |
diff --git a/etc/profile-a-l/gtk-straw-viewer.profile b/etc/profile-a-l/gtk-straw-viewer.profile new file mode 100644 index 000000000..e2721360b --- /dev/null +++ b/etc/profile-a-l/gtk-straw-viewer.profile | |||
@@ -0,0 +1,14 @@ | |||
1 | # Firejail profile for gtk-straw-viewer | ||
2 | # Description: Gtk front-end to straw-viewer | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include gtk-straw-viewer.local | ||
6 | # added by included profile | ||
7 | #include globals.local | ||
8 | |||
9 | ignore quiet | ||
10 | |||
11 | include whitelist-runuser-common.inc | ||
12 | |||
13 | # Redirect | ||
14 | include straw-viewer.profile | ||
diff --git a/etc/profile-a-l/gtk-youtube-viewer b/etc/profile-a-l/gtk-youtube-viewer.profile index 023f10d3d..848979b52 100644 --- a/etc/profile-a-l/gtk-youtube-viewer +++ b/etc/profile-a-l/gtk-youtube-viewer.profile | |||
@@ -3,16 +3,12 @@ | |||
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include gtk-youtube-viewer.local | 5 | include gtk-youtube-viewer.local |
6 | # Persistent global definitions | 6 | # added by included profile |
7 | # include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | ignore quiet | 9 | ignore quiet |
10 | 10 | ||
11 | noblacklist /tmp/.X11-unix | ||
12 | noblacklist ${RUNUSER}/wayland-* | ||
13 | noblacklist ${RUNUSER} | ||
14 | |||
15 | include whitelist-runuser-common.inc | 11 | include whitelist-runuser-common.inc |
16 | 12 | ||
17 | # Redirect | 13 | # Redirect |
18 | include youtube-viewer.profile \ No newline at end of file | 14 | include youtube-viewer.profile |
diff --git a/etc/profile-a-l/gtk2-youtube-viewer b/etc/profile-a-l/gtk2-youtube-viewer.profile index 331e73218..dccadcf2e 100644 --- a/etc/profile-a-l/gtk2-youtube-viewer +++ b/etc/profile-a-l/gtk2-youtube-viewer.profile | |||
@@ -3,8 +3,8 @@ | |||
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include gtk2-youtube-viewer.local | 5 | include gtk2-youtube-viewer.local |
6 | # Persistent global definitions | 6 | # added by included profile |
7 | # include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | ignore quiet | 9 | ignore quiet |
10 | 10 | ||
@@ -15,4 +15,4 @@ noblacklist ${RUNUSER} | |||
15 | include whitelist-runuser-common.inc | 15 | include whitelist-runuser-common.inc |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include youtube-viewer.profile \ No newline at end of file | 18 | include youtube-viewer.profile |
diff --git a/etc/profile-a-l/gtk3-youtube-viewer b/etc/profile-a-l/gtk3-youtube-viewer.profile index 4c5bde55f..3d91e284d 100644 --- a/etc/profile-a-l/gtk3-youtube-viewer +++ b/etc/profile-a-l/gtk3-youtube-viewer.profile | |||
@@ -3,8 +3,8 @@ | |||
3 | # This file is overwritten after every install/update | 3 | # This file is overwritten after every install/update |
4 | # Persistent local customizations | 4 | # Persistent local customizations |
5 | include gtk3-youtube-viewer.local | 5 | include gtk3-youtube-viewer.local |
6 | # Persistent global definitions | 6 | # added by included profile |
7 | # include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | ignore quiet | 9 | ignore quiet |
10 | 10 | ||
@@ -15,4 +15,4 @@ noblacklist ${RUNUSER} | |||
15 | include whitelist-runuser-common.inc | 15 | include whitelist-runuser-common.inc |
16 | 16 | ||
17 | # Redirect | 17 | # Redirect |
18 | include youtube-viewer.profile \ No newline at end of file | 18 | include youtube-viewer.profile |
diff --git a/etc/profile-a-l/gucharmap.profile b/etc/profile-a-l/gucharmap.profile index c0254b5ec..3df42d209 100644 --- a/etc/profile-a-l/gucharmap.profile +++ b/etc/profile-a-l/gucharmap.profile | |||
@@ -35,6 +35,7 @@ nou2f | |||
35 | novideo | 35 | novideo |
36 | protocol unix | 36 | protocol unix |
37 | seccomp | 37 | seccomp |
38 | seccomp.block-secondary | ||
38 | shell none | 39 | shell none |
39 | tracelog | 40 | tracelog |
40 | 41 | ||
diff --git a/etc/profile-a-l/keepassxc.profile b/etc/profile-a-l/keepassxc.profile index 06447c3e6..58db056b2 100644 --- a/etc/profile-a-l/keepassxc.profile +++ b/etc/profile-a-l/keepassxc.profile | |||
@@ -55,6 +55,7 @@ nou2f | |||
55 | novideo | 55 | novideo |
56 | protocol unix,netlink | 56 | protocol unix,netlink |
57 | seccomp | 57 | seccomp |
58 | seccomp.block-secondary | ||
58 | shell none | 59 | shell none |
59 | tracelog | 60 | tracelog |
60 | 61 | ||
diff --git a/etc/profile-a-l/libreoffice.profile b/etc/profile-a-l/libreoffice.profile index f9c92f6f6..031f0e19f 100644 --- a/etc/profile-a-l/libreoffice.profile +++ b/etc/profile-a-l/libreoffice.profile | |||
@@ -43,6 +43,8 @@ shell none | |||
43 | # comment tracelog when using the ubuntu 18.04/debian 10 apparmor profile | 43 | # comment tracelog when using the ubuntu 18.04/debian 10 apparmor profile |
44 | tracelog | 44 | tracelog |
45 | 45 | ||
46 | #private-bin libreoffice,sh,uname,dirname,grep,sed,basename,ls | ||
47 | private-cache | ||
46 | private-dev | 48 | private-dev |
47 | private-tmp | 49 | private-tmp |
48 | 50 | ||
diff --git a/etc/profile-a-l/lutris.profile b/etc/profile-a-l/lutris.profile new file mode 100644 index 000000000..652f571bb --- /dev/null +++ b/etc/profile-a-l/lutris.profile | |||
@@ -0,0 +1,74 @@ | |||
1 | # Firejail profile for lutris | ||
2 | # Description: Multi-library game handler with special support for Wine | ||
3 | # This file is overwritten after every install/update | ||
4 | # Persistent local customizations | ||
5 | include lutris.local | ||
6 | # Persistent global definitions | ||
7 | include globals.local | ||
8 | |||
9 | noblacklist ${PATH}/llvm* | ||
10 | noblacklist ${HOME}/Games | ||
11 | noblacklist ${HOME}/.cache/lutris | ||
12 | noblacklist ${HOME}/.cache/winetricks | ||
13 | noblacklist ${HOME}/.config/lutris | ||
14 | noblacklist ${HOME}/.local/share/lutris | ||
15 | # noblacklist ${HOME}/.wine | ||
16 | noblacklist /tmp/.wine-* | ||
17 | |||
18 | ignore noexec ${HOME} | ||
19 | |||
20 | # Allow python (blacklisted by disable-interpreters.inc) | ||
21 | include allow-python2.inc | ||
22 | include allow-python3.inc | ||
23 | |||
24 | include disable-common.inc | ||
25 | include disable-devel.inc | ||
26 | include disable-exec.inc | ||
27 | include disable-interpreters.inc | ||
28 | include disable-passwdmgr.inc | ||
29 | include disable-programs.inc | ||
30 | include disable-xdg.inc | ||
31 | |||
32 | mkdir ${HOME}/Games | ||
33 | mkdir ${HOME}/.cache/lutris | ||
34 | mkdir ${HOME}/.cache/winetricks | ||
35 | mkdir ${HOME}/.config/lutris | ||
36 | mkdir ${HOME}/.local/share/lutris | ||
37 | # mkdir ${HOME}/.wine | ||
38 | whitelist ${HOME}/Downloads | ||
39 | whitelist ${HOME}/Games | ||
40 | whitelist ${HOME}/.cache/lutris | ||
41 | whitelist ${HOME}/.cache/winetricks | ||
42 | whitelist ${HOME}/.config/lutris | ||
43 | whitelist ${HOME}/.local/share/lutris | ||
44 | # whitelist ${HOME}/.wine | ||
45 | whitelist /usr/share/lutris | ||
46 | whitelist /usr/share/wine | ||
47 | include whitelist-common.inc | ||
48 | include whitelist-usr-share-common.inc | ||
49 | include whitelist-runuser-common.inc | ||
50 | include whitelist-var-common.inc | ||
51 | |||
52 | # allow-debuggers | ||
53 | # apparmor | ||
54 | caps.drop all | ||
55 | ipc-namespace | ||
56 | # net none | ||
57 | netfilter | ||
58 | nodvd | ||
59 | nogroups | ||
60 | nonewprivs | ||
61 | noroot | ||
62 | notv | ||
63 | nou2f | ||
64 | novideo | ||
65 | protocol unix,inet,inet6,netlink | ||
66 | seccomp | ||
67 | shell none | ||
68 | |||
69 | # uncomment the following line if you do not need controller support | ||
70 | # private-dev | ||
71 | private-tmp | ||
72 | |||
73 | dbus-user none | ||
74 | dbus-system none | ||
diff --git a/etc/profile-a-l/lyx.profile b/etc/profile-a-l/lyx.profile index b2c0afbe7..ffde057d5 100644 --- a/etc/profile-a-l/lyx.profile +++ b/etc/profile-a-l/lyx.profile | |||
@@ -27,7 +27,7 @@ apparmor | |||
27 | machine-id | 27 | machine-id |
28 | 28 | ||
29 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex | 29 | # private-bin atril,dvilualatex,env,latex,lua*,luatex,lyx,lyxclient,okular,pdf2latex,pdflatex,pdftex,perl*,python*,qpdf,qpdfview,sh,tex2lyx,texmf,xelatex |
30 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,lyx,mime.types,passwd,texmf,X11,xdg | 30 | private-etc alternatives,dconf,fonts,gtk-2.0,gtk-3.0,locale,locale.alias,locale.conf,lyx,machine-id,mime.types,passwd,texmf,X11,xdg |
31 | 31 | ||
32 | # Redirect | 32 | # Redirect |
33 | include latex-common.profile | 33 | include latex-common.profile |
diff --git a/etc/profile-m-z/QMediathekView.profile b/etc/profile-m-z/QMediathekView.profile index 589dcfeb6..5ab302218 100644 --- a/etc/profile-m-z/QMediathekView.profile +++ b/etc/profile-m-z/QMediathekView.profile | |||
@@ -53,7 +53,7 @@ private-cache | |||
53 | private-dev | 53 | private-dev |
54 | private-tmp | 54 | private-tmp |
55 | 55 | ||
56 | # dbus-user none | 56 | dbus-user none |
57 | # dbus-system none | 57 | dbus-system none |
58 | 58 | ||
59 | #memory-deny-write-execute - breaks on Arch (see issue #1803) | 59 | #memory-deny-write-execute - breaks on Arch (see issue #1803) |
diff --git a/etc/profile-m-z/megaglest.profile b/etc/profile-m-z/megaglest.profile index 19f9edf05..37ac9e304 100644 --- a/etc/profile-m-z/megaglest.profile +++ b/etc/profile-m-z/megaglest.profile | |||
@@ -14,6 +14,7 @@ include disable-exec.inc | |||
14 | include disable-interpreters.inc | 14 | include disable-interpreters.inc |
15 | include disable-passwdmgr.inc | 15 | include disable-passwdmgr.inc |
16 | include disable-programs.inc | 16 | include disable-programs.inc |
17 | include disable-shell.inc | ||
17 | include disable-xdg.inc | 18 | include disable-xdg.inc |
18 | 19 | ||
19 | mkdir ${HOME}/.megaglest | 20 | mkdir ${HOME}/.megaglest |
@@ -37,6 +38,7 @@ nou2f | |||
37 | novideo | 38 | novideo |
38 | protocol unix,inet,inet6,netlink | 39 | protocol unix,inet,inet6,netlink |
39 | seccomp | 40 | seccomp |
41 | seccomp.block-secondary | ||
40 | shell none | 42 | shell none |
41 | tracelog | 43 | tracelog |
42 | 44 | ||
diff --git a/etc/profile-m-z/meld.profile b/etc/profile-m-z/meld.profile index 385700648..6ceeb867f 100644 --- a/etc/profile-m-z/meld.profile +++ b/etc/profile-m-z/meld.profile | |||
@@ -62,6 +62,7 @@ nou2f | |||
62 | novideo | 62 | novideo |
63 | protocol unix,inet,inet6 | 63 | protocol unix,inet,inet6 |
64 | seccomp | 64 | seccomp |
65 | seccomp.block-secondary | ||
65 | shell none | 66 | shell none |
66 | tracelog | 67 | tracelog |
67 | 68 | ||
diff --git a/etc/profile-m-z/menulibre.profile b/etc/profile-m-z/menulibre.profile index 3468bc22d..c70090a25 100644 --- a/etc/profile-m-z/menulibre.profile +++ b/etc/profile-m-z/menulibre.profile | |||
@@ -44,6 +44,7 @@ nou2f | |||
44 | novideo | 44 | novideo |
45 | protocol unix | 45 | protocol unix |
46 | seccomp | 46 | seccomp |
47 | seccomp.block-secondary | ||
47 | shell none | 48 | shell none |
48 | tracelog | 49 | tracelog |
49 | 50 | ||
diff --git a/etc/profile-m-z/minetest.profile b/etc/profile-m-z/minetest.profile index a22d2c2e3..666af323d 100644 --- a/etc/profile-m-z/minetest.profile +++ b/etc/profile-m-z/minetest.profile | |||
@@ -47,12 +47,14 @@ nou2f | |||
47 | novideo | 47 | novideo |
48 | protocol unix,inet,inet6 | 48 | protocol unix,inet,inet6 |
49 | seccomp | 49 | seccomp |
50 | seccomp.block-secondary | ||
50 | shell none | 51 | shell none |
51 | tracelog | 52 | tracelog |
52 | 53 | ||
53 | disable-mnt | 54 | disable-mnt |
54 | private-bin minetest | 55 | private-bin minetest,rm |
55 | private-cache | 56 | # cache is used for storing assets when connecting to servers |
57 | #private-cache | ||
56 | private-dev | 58 | private-dev |
57 | # private-etc needs to be updated, see #1702 | 59 | # private-etc needs to be updated, see #1702 |
58 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl | 60 | #private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl |
diff --git a/etc/profile-m-z/mpv.profile b/etc/profile-m-z/mpv.profile index 389b64535..ce3bfe421 100644 --- a/etc/profile-m-z/mpv.profile +++ b/etc/profile-m-z/mpv.profile | |||
@@ -67,6 +67,7 @@ noroot | |||
67 | nou2f | 67 | nou2f |
68 | protocol unix,inet,inet6,netlink | 68 | protocol unix,inet,inet6,netlink |
69 | seccomp | 69 | seccomp |
70 | seccomp.block-secondary | ||
70 | shell none | 71 | shell none |
71 | tracelog | 72 | tracelog |
72 | 73 | ||
diff --git a/etc/profile-m-z/ostrichriders.profile b/etc/profile-m-z/ostrichriders.profile index cc44d5a48..3bfda7946 100644 --- a/etc/profile-m-z/ostrichriders.profile +++ b/etc/profile-m-z/ostrichriders.profile | |||
@@ -42,7 +42,7 @@ tracelog | |||
42 | disable-mnt | 42 | disable-mnt |
43 | private-bin ostrichriders | 43 | private-bin ostrichriders |
44 | private-cache | 44 | private-cache |
45 | # private-dev should be commented for controllers | 45 | # comment the following line if you need controller support |
46 | private-dev | 46 | private-dev |
47 | private-tmp | 47 | private-tmp |
48 | 48 | ||
diff --git a/etc/profile-m-z/patch.profile b/etc/profile-m-z/patch.profile index 8663fb453..6cbaa66ad 100644 --- a/etc/profile-m-z/patch.profile +++ b/etc/profile-m-z/patch.profile | |||
@@ -37,6 +37,7 @@ nou2f | |||
37 | novideo | 37 | novideo |
38 | protocol unix | 38 | protocol unix |
39 | seccomp | 39 | seccomp |
40 | seccomp.block-secondary | ||
40 | shell none | 41 | shell none |
41 | tracelog | 42 | tracelog |
42 | x11 none | 43 | x11 none |
diff --git a/etc/profile-m-z/pdftotext.profile b/etc/profile-m-z/pdftotext.profile index eee42424f..2a7d0cec1 100644 --- a/etc/profile-m-z/pdftotext.profile +++ b/etc/profile-m-z/pdftotext.profile | |||
@@ -13,6 +13,7 @@ noblacklist ${DOCUMENTS} | |||
13 | 13 | ||
14 | include disable-common.inc | 14 | include disable-common.inc |
15 | include disable-devel.inc | 15 | include disable-devel.inc |
16 | include disable-exec.inc | ||
16 | include disable-interpreters.inc | 17 | include disable-interpreters.inc |
17 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
18 | include disable-programs.inc | 19 | include disable-programs.inc |
@@ -40,6 +41,7 @@ nou2f | |||
40 | novideo | 41 | novideo |
41 | protocol unix | 42 | protocol unix |
42 | seccomp | 43 | seccomp |
44 | seccomp.block-secondary | ||
43 | shell none | 45 | shell none |
44 | tracelog | 46 | tracelog |
45 | x11 none | 47 | x11 none |
diff --git a/etc/profile-m-z/peek.profile b/etc/profile-m-z/peek.profile index 28a7da404..710a533a9 100644 --- a/etc/profile-m-z/peek.profile +++ b/etc/profile-m-z/peek.profile | |||
@@ -41,6 +41,7 @@ nou2f | |||
41 | novideo | 41 | novideo |
42 | protocol unix | 42 | protocol unix |
43 | seccomp | 43 | seccomp |
44 | seccomp.block-secondary | ||
44 | shell none | 45 | shell none |
45 | tracelog | 46 | tracelog |
46 | 47 | ||
diff --git a/etc/profile-m-z/pngquant.profile b/etc/profile-m-z/pngquant.profile index 83905b108..3513e91cc 100644 --- a/etc/profile-m-z/pngquant.profile +++ b/etc/profile-m-z/pngquant.profile | |||
@@ -7,6 +7,8 @@ include pngquant.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | noblacklist ${PICTURES} | ||
11 | |||
10 | blacklist ${RUNUSER}/wayland-* | 12 | blacklist ${RUNUSER}/wayland-* |
11 | 13 | ||
12 | include disable-common.inc | 14 | include disable-common.inc |
@@ -16,6 +18,7 @@ include disable-interpreters.inc | |||
16 | include disable-passwdmgr.inc | 18 | include disable-passwdmgr.inc |
17 | include disable-programs.inc | 19 | include disable-programs.inc |
18 | include disable-shell.inc | 20 | include disable-shell.inc |
21 | include disable-xdg.inc | ||
19 | 22 | ||
20 | include whitelist-runuser-common.inc | 23 | include whitelist-runuser-common.inc |
21 | include whitelist-usr-share-common.inc | 24 | include whitelist-usr-share-common.inc |
diff --git a/etc/profile-m-z/ppsspp.profile b/etc/profile-m-z/ppsspp.profile index c62e53151..c71553bcd 100644 --- a/etc/profile-m-z/ppsspp.profile +++ b/etc/profile-m-z/ppsspp.profile | |||
@@ -32,7 +32,7 @@ protocol unix,netlink | |||
32 | seccomp | 32 | seccomp |
33 | shell none | 33 | shell none |
34 | 34 | ||
35 | # private-dev is disabled to allow controller support | 35 | # uncomment the following line if you do not need controller support |
36 | #private-dev | 36 | #private-dev |
37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl | 37 | private-etc alternatives,asound.conf,ca-certificates,crypto-policies,drirc,fonts,group,host.conf,hostname,hosts,ld.so.cache,ld.so.preload,localtime,machine-id,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl |
38 | private-opt ppsspp | 38 | private-opt ppsspp |
diff --git a/etc/profile-m-z/rhythmbox.profile b/etc/profile-m-z/rhythmbox.profile index f906ec31d..9fb7dc713 100644 --- a/etc/profile-m-z/rhythmbox.profile +++ b/etc/profile-m-z/rhythmbox.profile | |||
@@ -45,10 +45,12 @@ nou2f | |||
45 | novideo | 45 | novideo |
46 | protocol unix,inet,inet6,netlink | 46 | protocol unix,inet,inet6,netlink |
47 | seccomp | 47 | seccomp |
48 | seccomp.block-secondary | ||
48 | shell none | 49 | shell none |
49 | tracelog | 50 | tracelog |
50 | 51 | ||
51 | private-bin rhythmbox,rhythmbox-client | 52 | private-bin rhythmbox,rhythmbox-client |
53 | private-cache | ||
52 | private-dev | 54 | private-dev |
53 | private-tmp | 55 | private-tmp |
54 | 56 | ||
@@ -57,6 +59,7 @@ dbus-user.own org.gnome.Rhythmbox3 | |||
57 | dbus-user.own org.mpris.MediaPlayer2.rhythmbox | 59 | dbus-user.own org.mpris.MediaPlayer2.rhythmbox |
58 | dbus-user.own org.gnome.UPnP.MediaServer2.Rhythmbox | 60 | dbus-user.own org.gnome.UPnP.MediaServer2.Rhythmbox |
59 | dbus-user.talk ca.desrt.dconf | 61 | dbus-user.talk ca.desrt.dconf |
62 | dbus-user.talk org.gtk.vfs.* | ||
60 | dbus-user.talk org.freedesktop.Notifications | 63 | dbus-user.talk org.freedesktop.Notifications |
61 | dbus-user.talk org.gnome.SettingsDaemon.MediaKeys | 64 | dbus-user.talk org.gnome.SettingsDaemon.MediaKeys |
62 | dbus-system filter | 65 | dbus-system filter |
diff --git a/etc/profile-m-z/shellcheck.profile b/etc/profile-m-z/shellcheck.profile index 6cd70c2ea..c67a88161 100644 --- a/etc/profile-m-z/shellcheck.profile +++ b/etc/profile-m-z/shellcheck.profile | |||
@@ -40,6 +40,7 @@ nou2f | |||
40 | novideo | 40 | novideo |
41 | protocol unix | 41 | protocol unix |
42 | seccomp | 42 | seccomp |
43 | seccomp.block-secondary | ||
43 | shell none | 44 | shell none |
44 | tracelog | 45 | tracelog |
45 | x11 none | 46 | x11 none |
diff --git a/etc/profile-m-z/sqlitebrowser.profile b/etc/profile-m-z/sqlitebrowser.profile index cdb20b4e0..110434736 100644 --- a/etc/profile-m-z/sqlitebrowser.profile +++ b/etc/profile-m-z/sqlitebrowser.profile | |||
@@ -18,6 +18,7 @@ include disable-programs.inc | |||
18 | include disable-shell.inc | 18 | include disable-shell.inc |
19 | include disable-xdg.inc | 19 | include disable-xdg.inc |
20 | 20 | ||
21 | include whitelist-runuser-common.inc | ||
21 | include whitelist-usr-share-common.inc | 22 | include whitelist-usr-share-common.inc |
22 | include whitelist-var-common.inc | 23 | include whitelist-var-common.inc |
23 | 24 | ||
@@ -35,6 +36,7 @@ nou2f | |||
35 | novideo | 36 | novideo |
36 | protocol unix,inet,inet6,netlink | 37 | protocol unix,inet,inet6,netlink |
37 | seccomp | 38 | seccomp |
39 | seccomp.block-secondary | ||
38 | shell none | 40 | shell none |
39 | 41 | ||
40 | private-bin sqlitebrowser | 42 | private-bin sqlitebrowser |
diff --git a/etc/profile-m-z/steam.profile b/etc/profile-m-z/steam.profile index 7292f189c..adf9c9317 100644 --- a/etc/profile-m-z/steam.profile +++ b/etc/profile-m-z/steam.profile | |||
@@ -109,7 +109,7 @@ shell none | |||
109 | # picture viewers are needed for viewing screenshots | 109 | # picture viewers are needed for viewing screenshots |
110 | #private-bin eog,eom,gthumb,pix,viewnior,xviewer | 110 | #private-bin eog,eom,gthumb,pix,viewnior,xviewer |
111 | 111 | ||
112 | # private-dev should be commented for controllers | 112 | # comment the following line if you need controller support |
113 | private-dev | 113 | private-dev |
114 | # private-etc breaks a small selection of games on some systems, comment to support those | 114 | # private-etc breaks a small selection of games on some systems, comment to support those |
115 | private-etc alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl | 115 | private-etc alternatives,asound.conf,bumblebee,ca-certificates,crypto-policies,dbus-1,drirc,fonts,group,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,localtime,lsb-release,machine-id,mime.types,nvidia,os-release,passwd,pki,pulse,resolv.conf,services,ssl |
diff --git a/etc/profile-m-z/straw-viewer.profile b/etc/profile-m-z/straw-viewer.profile new file mode 100644 index 000000000..721ad38ee --- /dev/null +++ b/etc/profile-m-z/straw-viewer.profile | |||
@@ -0,0 +1,58 @@ | |||
1 | # Firejail profile for straw-viewer | ||
2 | # Description: Fork of youtube-viewer acts like an invidious frontend | ||
3 | quiet | ||
4 | # This file is overwritten after every install/update | ||
5 | # Persistent local customizations | ||
6 | include straw-viewer.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | noblacklist ${HOME}/.cache/straw-viewer | ||
11 | noblacklist ${HOME}/.config/straw-viewer | ||
12 | |||
13 | include allow-lua.inc | ||
14 | include allow-perl.inc | ||
15 | include allow-python2.inc | ||
16 | include allow-python3.inc | ||
17 | |||
18 | include disable-common.inc | ||
19 | include disable-devel.inc | ||
20 | include disable-exec.inc | ||
21 | include disable-interpreters.inc | ||
22 | include disable-passwdmgr.inc | ||
23 | include disable-programs.inc | ||
24 | include disable-xdg.inc | ||
25 | |||
26 | mkdir ${HOME}/.config/straw-viewer | ||
27 | mkdir ${HOME}/.cache/straw-viewer | ||
28 | whitelist ${HOME}/.cache/straw-viewer | ||
29 | whitelist ${HOME}/.config/straw-viewer | ||
30 | whitelist ${DOWNLOADS} | ||
31 | include whitelist-common.inc | ||
32 | include whitelist-usr-share-common.inc | ||
33 | include whitelist-var-common.inc | ||
34 | |||
35 | apparmor | ||
36 | caps.drop all | ||
37 | netfilter | ||
38 | nodvd | ||
39 | nogroups | ||
40 | nonewprivs | ||
41 | noroot | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix,inet,inet6 | ||
46 | seccomp | ||
47 | shell none | ||
48 | tracelog | ||
49 | |||
50 | disable-mnt | ||
51 | private-bin bash,ffmpeg,ffprobe,gtk-straw-viewer,mpv,perl,python*,sh,smplayer,straw-viewer,stty,vlc,wget,which,youtube-dl | ||
52 | private-cache | ||
53 | private-dev | ||
54 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | ||
55 | private-tmp | ||
56 | |||
57 | dbus-user none | ||
58 | dbus-system none | ||
diff --git a/etc/profile-m-z/strings.profile b/etc/profile-m-z/strings.profile index 426b2dc1c..09ada1e25 100644 --- a/etc/profile-m-z/strings.profile +++ b/etc/profile-m-z/strings.profile | |||
@@ -38,6 +38,7 @@ nou2f | |||
38 | novideo | 38 | novideo |
39 | protocol unix | 39 | protocol unix |
40 | seccomp | 40 | seccomp |
41 | seccomp.block-secondary | ||
41 | shell none | 42 | shell none |
42 | tracelog | 43 | tracelog |
43 | x11 none | 44 | x11 none |
diff --git a/etc/profile-m-z/supertux2.profile b/etc/profile-m-z/supertux2.profile index ceaae8fbf..9cc023765 100644 --- a/etc/profile-m-z/supertux2.profile +++ b/etc/profile-m-z/supertux2.profile | |||
@@ -36,6 +36,7 @@ nou2f | |||
36 | novideo | 36 | novideo |
37 | protocol unix,netlink | 37 | protocol unix,netlink |
38 | seccomp | 38 | seccomp |
39 | seccomp.block-secondary | ||
39 | shell none | 40 | shell none |
40 | tracelog | 41 | tracelog |
41 | 42 | ||
diff --git a/etc/profile-m-z/supertuxkart.profile b/etc/profile-m-z/supertuxkart.profile index 40b996794..1b20f5d3d 100644 --- a/etc/profile-m-z/supertuxkart.profile +++ b/etc/profile-m-z/supertuxkart.profile | |||
@@ -41,15 +41,17 @@ noroot | |||
41 | notv | 41 | notv |
42 | nou2f | 42 | nou2f |
43 | novideo | 43 | novideo |
44 | protocol unix,inet,inet6 | 44 | protocol unix,inet,inet6,bluetooth |
45 | seccomp | 45 | seccomp |
46 | seccomp.block-secondary | ||
46 | shell none | 47 | shell none |
47 | tracelog | 48 | tracelog |
48 | 49 | ||
49 | disable-mnt | 50 | disable-mnt |
50 | private-bin supertuxkart | 51 | private-bin supertuxkart |
51 | private-cache | 52 | private-cache |
52 | private-dev | 53 | # uncomment the following line if you do not need controller support |
54 | #private-dev | ||
53 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,machine-id,openal,pki,resolv.conf,ssl | 55 | private-etc alternatives,ca-certificates,crypto-policies,drirc,hosts,machine-id,openal,pki,resolv.conf,ssl |
54 | private-tmp | 56 | private-tmp |
55 | private-opt none | 57 | private-opt none |
diff --git a/etc/profile-m-z/thunderbird.profile b/etc/profile-m-z/thunderbird.profile index e3eb73730..b478fbe1e 100644 --- a/etc/profile-m-z/thunderbird.profile +++ b/etc/profile-m-z/thunderbird.profile | |||
@@ -6,6 +6,8 @@ include thunderbird.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | ignore include whitelist-runuser-common.inc | ||
10 | |||
9 | # writable-run-user and dbus are needed by enigmail | 11 | # writable-run-user and dbus are needed by enigmail |
10 | ignore dbus-user none | 12 | ignore dbus-user none |
11 | ignore dbus-system none | 13 | ignore dbus-system none |
diff --git a/etc/profile-m-z/transmission-common.profile b/etc/profile-m-z/transmission-common.profile index 9d2e8e990..d601f0f15 100644 --- a/etc/profile-m-z/transmission-common.profile +++ b/etc/profile-m-z/transmission-common.profile | |||
@@ -39,6 +39,7 @@ nou2f | |||
39 | novideo | 39 | novideo |
40 | protocol unix,inet,inet6 | 40 | protocol unix,inet,inet6 |
41 | seccomp | 41 | seccomp |
42 | seccomp.block-secondary | ||
42 | shell none | 43 | shell none |
43 | tracelog | 44 | tracelog |
44 | 45 | ||
diff --git a/etc/profile-m-z/vivaldi.profile b/etc/profile-m-z/vivaldi.profile index 541942453..fdeb0307f 100644 --- a/etc/profile-m-z/vivaldi.profile +++ b/etc/profile-m-z/vivaldi.profile | |||
@@ -29,9 +29,13 @@ whitelist ${HOME}/.config/vivaldi | |||
29 | whitelist ${HOME}/.config/vivaldi-snapshot | 29 | whitelist ${HOME}/.config/vivaldi-snapshot |
30 | whitelist ${HOME}/.local/lib/vivaldi | 30 | whitelist ${HOME}/.local/lib/vivaldi |
31 | 31 | ||
32 | #private-bin bash,cat,dirname,readlink,rm,vivaldi,vivaldi-stable,vivaldi-snapshot | ||
33 | |||
32 | # breaks vivaldi sync | 34 | # breaks vivaldi sync |
33 | ignore dbus-user none | 35 | ignore dbus-user none |
34 | ignore dbus-system none | 36 | ignore dbus-system none |
35 | 37 | ||
38 | read-write ${HOME}/.local/lib/vivaldi | ||
39 | |||
36 | # Redirect | 40 | # Redirect |
37 | include chromium-common.profile | 41 | include chromium-common.profile |
diff --git a/etc/profile-m-z/w3m.profile b/etc/profile-m-z/w3m.profile index bd33edd6a..0e172333a 100644 --- a/etc/profile-m-z/w3m.profile +++ b/etc/profile-m-z/w3m.profile | |||
@@ -7,6 +7,11 @@ include w3m.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | # Uncomment or add to your w3m.local if you want to use w3m-img on a vconsole | ||
11 | #ignore nogroups | ||
12 | #ignore private-dev | ||
13 | #ignore private-etc | ||
14 | |||
10 | noblacklist ${HOME}/.w3m | 15 | noblacklist ${HOME}/.w3m |
11 | 16 | ||
12 | blacklist /tmp/.X11-unix | 17 | blacklist /tmp/.X11-unix |
diff --git a/etc/profile-m-z/wget.profile b/etc/profile-m-z/wget.profile index cdb8f0b93..8a64d2d73 100644 --- a/etc/profile-m-z/wget.profile +++ b/etc/profile-m-z/wget.profile | |||
@@ -44,6 +44,7 @@ nou2f | |||
44 | novideo | 44 | novideo |
45 | protocol unix,inet,inet6 | 45 | protocol unix,inet,inet6 |
46 | seccomp | 46 | seccomp |
47 | seccomp.block-secondary | ||
47 | shell none | 48 | shell none |
48 | tracelog | 49 | tracelog |
49 | 50 | ||
diff --git a/etc/profile-m-z/whois.profile b/etc/profile-m-z/whois.profile index 2af1379e0..a9cecb18d 100644 --- a/etc/profile-m-z/whois.profile +++ b/etc/profile-m-z/whois.profile | |||
@@ -39,6 +39,7 @@ nou2f | |||
39 | novideo | 39 | novideo |
40 | protocol inet,inet6 | 40 | protocol inet,inet6 |
41 | seccomp | 41 | seccomp |
42 | seccomp.block-secondary | ||
42 | shell none | 43 | shell none |
43 | tracelog | 44 | tracelog |
44 | 45 | ||
diff --git a/etc/profile-m-z/wine.profile b/etc/profile-m-z/wine.profile index 901340052..6ac74b9da 100644 --- a/etc/profile-m-z/wine.profile +++ b/etc/profile-m-z/wine.profile | |||
@@ -6,6 +6,7 @@ include wine.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | noblacklist ${HOME}/.cache/winetricks | ||
9 | noblacklist ${HOME}/.Steam | 10 | noblacklist ${HOME}/.Steam |
10 | noblacklist ${HOME}/.local/share/Steam | 11 | noblacklist ${HOME}/.local/share/Steam |
11 | noblacklist ${HOME}/.local/share/steam | 12 | noblacklist ${HOME}/.local/share/steam |
@@ -19,6 +20,8 @@ include disable-interpreters.inc | |||
19 | include disable-passwdmgr.inc | 20 | include disable-passwdmgr.inc |
20 | include disable-programs.inc | 21 | include disable-programs.inc |
21 | 22 | ||
23 | # whitelist /usr/share/wine | ||
24 | # include whitelist-usr-share-common.inc | ||
22 | include whitelist-var-common.inc | 25 | include whitelist-var-common.inc |
23 | 26 | ||
24 | # some applications don't need allow-debuggers, comment the next line | 27 | # some applications don't need allow-debuggers, comment the next line |
diff --git a/etc/profile-m-z/xfce4-mixer.profile b/etc/profile-m-z/xfce4-mixer.profile index 6ff4a1103..78cb2862c 100644 --- a/etc/profile-m-z/xfce4-mixer.profile +++ b/etc/profile-m-z/xfce4-mixer.profile | |||
@@ -19,6 +19,7 @@ include disable-xdg.inc | |||
19 | 19 | ||
20 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml | 20 | mkfile ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml |
21 | whitelist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml | 21 | whitelist ${HOME}/.config/xfce4/xfconf/xfce-perchannel-xml/xfce4-mixer.xml |
22 | whitelist /usr/share/gstreamer | ||
22 | whitelist /usr/share/xfce4 | 23 | whitelist /usr/share/xfce4 |
23 | whitelist /usr/share/xfce4-mixer | 24 | whitelist /usr/share/xfce4-mixer |
24 | include whitelist-common.inc | 25 | include whitelist-common.inc |
@@ -48,7 +49,9 @@ private-dev | |||
48 | private-etc alternatives,asound.conf,fonts,machine-id,pulse | 49 | private-etc alternatives,asound.conf,fonts,machine-id,pulse |
49 | private-tmp | 50 | private-tmp |
50 | 51 | ||
51 | # dbus-user none | 52 | dbus-user filter |
52 | # dbus-system none | 53 | dbus-user.own org.xfce.xfce4-mixer |
54 | dbus-user.talk org.xfce.Xfconf | ||
55 | dbus-system none | ||
53 | 56 | ||
54 | memory-deny-write-execute | 57 | # memory-deny-write-execute - breaks on Arch |
diff --git a/etc/profile-m-z/xfce4-screenshooter.profile b/etc/profile-m-z/xfce4-screenshooter.profile index b760b44dd..c9200304c 100644 --- a/etc/profile-m-z/xfce4-screenshooter.profile +++ b/etc/profile-m-z/xfce4-screenshooter.profile | |||
@@ -48,4 +48,4 @@ private-tmp | |||
48 | dbus-user none | 48 | dbus-user none |
49 | dbus-system none | 49 | dbus-system none |
50 | 50 | ||
51 | memory-deny-write-execute | 51 | # memory-deny-write-execute -- see #3790 |
diff --git a/etc/profile-m-z/xournal.profile b/etc/profile-m-z/xournal.profile index b842b5307..0c6969e09 100644 --- a/etc/profile-m-z/xournal.profile +++ b/etc/profile-m-z/xournal.profile | |||
@@ -36,6 +36,7 @@ nou2f | |||
36 | novideo | 36 | novideo |
37 | protocol unix | 37 | protocol unix |
38 | seccomp | 38 | seccomp |
39 | seccomp.block-secondary | ||
39 | shell none | 40 | shell none |
40 | tracelog | 41 | tracelog |
41 | 42 | ||
diff --git a/etc/profile-m-z/yelp.profile b/etc/profile-m-z/yelp.profile index fd95ceb04..3ba1dca1a 100644 --- a/etc/profile-m-z/yelp.profile +++ b/etc/profile-m-z/yelp.profile | |||
@@ -20,7 +20,9 @@ include disable-xdg.inc | |||
20 | mkdir ${HOME}/.config/yelp | 20 | mkdir ${HOME}/.config/yelp |
21 | whitelist ${HOME}/.config/yelp | 21 | whitelist ${HOME}/.config/yelp |
22 | whitelist /usr/share/doc | 22 | whitelist /usr/share/doc |
23 | whitelist /usr/share/groff | ||
23 | whitelist /usr/share/help | 24 | whitelist /usr/share/help |
25 | whitelist /usr/share/man | ||
24 | whitelist /usr/share/yelp | 26 | whitelist /usr/share/yelp |
25 | whitelist /usr/share/yelp-tools | 27 | whitelist /usr/share/yelp-tools |
26 | whitelist /usr/share/yelp-xsl | 28 | whitelist /usr/share/yelp-xsl |
@@ -41,14 +43,15 @@ nou2f | |||
41 | novideo | 43 | novideo |
42 | protocol unix | 44 | protocol unix |
43 | seccomp | 45 | seccomp |
46 | seccomp.block-secondary | ||
44 | shell none | 47 | shell none |
45 | tracelog | 48 | tracelog |
46 | 49 | ||
47 | disable-mnt | 50 | disable-mnt |
48 | private-bin yelp | 51 | private-bin groff,man,tbl,troff,yelp |
49 | private-cache | 52 | private-cache |
50 | private-dev | 53 | private-dev |
51 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,gtk-3.0,machine-id,openal,os-release,pulse,sgml,xml | 54 | private-etc alsa,alternatives,asound.conf,crypto-policies,cups,dconf,drirc,fonts,gcrypt,groff,gtk-3.0,machine-id,man_db.conf,openal,os-release,pulse,sgml,xml |
52 | private-tmp | 55 | private-tmp |
53 | 56 | ||
54 | dbus-system none | 57 | dbus-system none |
@@ -59,3 +62,4 @@ dbus-system none | |||
59 | # 1. yelp --editor-mode | 62 | # 1. yelp --editor-mode |
60 | # 2. saving the window geometry | 63 | # 2. saving the window geometry |
61 | read-only ${HOME} | 64 | read-only ${HOME} |
65 | read-write ${HOME}/.cache | ||
diff --git a/etc/profile-m-z/youtube-dl.profile b/etc/profile-m-z/youtube-dl.profile index db3535f78..d9dee6891 100644 --- a/etc/profile-m-z/youtube-dl.profile +++ b/etc/profile-m-z/youtube-dl.profile | |||
@@ -52,6 +52,7 @@ nou2f | |||
52 | novideo | 52 | novideo |
53 | protocol unix,inet,inet6 | 53 | protocol unix,inet,inet6 |
54 | seccomp | 54 | seccomp |
55 | seccomp.block-secondary | ||
55 | shell none | 56 | shell none |
56 | tracelog | 57 | tracelog |
57 | 58 | ||
diff --git a/etc/profile-m-z/youtube-viewer.profile b/etc/profile-m-z/youtube-viewer.profile index 513cb0f6e..a3a2afa29 100644 --- a/etc/profile-m-z/youtube-viewer.profile +++ b/etc/profile-m-z/youtube-viewer.profile | |||
@@ -7,10 +7,6 @@ include youtube-viewer.local | |||
7 | # Persistent global definitions | 7 | # Persistent global definitions |
8 | include globals.local | 8 | include globals.local |
9 | 9 | ||
10 | blacklist /tmp/.X11-unix | ||
11 | blacklist ${RUNUSER}/wayland-* | ||
12 | blacklist ${RUNUSER} | ||
13 | |||
14 | noblacklist ${HOME}/.config/youtube-viewer | 10 | noblacklist ${HOME}/.config/youtube-viewer |
15 | 11 | ||
16 | include allow-perl.inc | 12 | include allow-perl.inc |
@@ -47,11 +43,11 @@ shell none | |||
47 | tracelog | 43 | tracelog |
48 | 44 | ||
49 | disable-mnt | 45 | disable-mnt |
50 | # private-bin ffmpeg,ffprobe,firefox,gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,mpv,python*,smplayer,sh,which,vlc,youtube-dl,youtube-viewer | 46 | private-bin ffmpeg,ffprobe,firefox,gtk-youtube-viewer,gtk2-youtube-viewer,gtk3-youtube-viewer,mpv,python*,sh,smplayer,stty,vlc,which,youtube-dl,youtube-viewer |
51 | private-cache | 47 | private-cache |
52 | private-dev | 48 | private-dev |
53 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg | 49 | private-etc alsa,alternatives,asound.conf,ca-certificates,crypto-policies,fonts,gtk-2.0,gtk-3.0,host.conf,hostname,hosts,machine-id,mime.types,nsswitch.conf,passwd,pki,pulse,resolv.conf,ssl,X11,xdg |
54 | private-tmp | 50 | private-tmp |
55 | 51 | ||
56 | dbus-user none | 52 | dbus-user none |
57 | dbus-system none \ No newline at end of file | 53 | dbus-system none |
diff --git a/etc/profile-m-z/zathura.profile b/etc/profile-m-z/zathura.profile index 5274e5b42..86615341f 100644 --- a/etc/profile-m-z/zathura.profile +++ b/etc/profile-m-z/zathura.profile | |||
@@ -28,7 +28,6 @@ include whitelist-var-common.inc | |||
28 | 28 | ||
29 | apparmor | 29 | apparmor |
30 | caps.drop all | 30 | caps.drop all |
31 | ipc-namespace | ||
32 | machine-id | 31 | machine-id |
33 | net none | 32 | net none |
34 | nodvd | 33 | nodvd |
diff --git a/etc/templates/profile.template b/etc/templates/profile.template index d57306aee..3d37fc827 100644 --- a/etc/templates/profile.template +++ b/etc/templates/profile.template | |||
@@ -157,6 +157,7 @@ include globals.local | |||
157 | #seccomp | 157 | #seccomp |
158 | ##seccomp !chroot | 158 | ##seccomp !chroot |
159 | ##seccomp.drop SYSCALLS (see syscalls.txt) | 159 | ##seccomp.drop SYSCALLS (see syscalls.txt) |
160 | #seccomp.block-secondary | ||
160 | #shell none | 161 | #shell none |
161 | #tracelog | 162 | #tracelog |
162 | # Prefer 'x11 none' instead of 'blacklist /tmp/.X11-unix' if 'net none' is set | 163 | # Prefer 'x11 none' instead of 'blacklist /tmp/.X11-unix' if 'net none' is set |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index b0a223911..000ed5258 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -63,6 +63,7 @@ audacious | |||
63 | audacity | 63 | audacity |
64 | audio-recorder | 64 | audio-recorder |
65 | authenticator | 65 | authenticator |
66 | authenticator-rs | ||
66 | autokey-gtk | 67 | autokey-gtk |
67 | autokey-qt | 68 | autokey-qt |
68 | autokey-run | 69 | autokey-run |
@@ -173,6 +174,7 @@ dnox | |||
173 | dnscrypt-proxy | 174 | dnscrypt-proxy |
174 | dnsmasq | 175 | dnsmasq |
175 | dolphin | 176 | dolphin |
177 | dolphin-emu | ||
176 | dooble | 178 | dooble |
177 | dooble-qt4 | 179 | dooble-qt4 |
178 | dosbox | 180 | dosbox |
@@ -197,14 +199,14 @@ enpass | |||
197 | eog | 199 | eog |
198 | eom | 200 | eom |
199 | ephemeral | 201 | ephemeral |
200 | #epiphany | 202 | #epiphany - see #2995 |
201 | equalx | 203 | equalx |
202 | et | 204 | et |
203 | etr | 205 | etr |
204 | evince | 206 | evince |
205 | evince-previewer | 207 | evince-previewer |
206 | evince-thumbnailer | 208 | evince-thumbnailer |
207 | evolution | 209 | #evolution - see #3647 |
208 | exfalso | 210 | exfalso |
209 | exiftool | 211 | exiftool |
210 | falkon | 212 | falkon |
@@ -212,7 +214,7 @@ fbreader | |||
212 | feedreader | 214 | feedreader |
213 | feh | 215 | feh |
214 | ferdi | 216 | ferdi |
215 | ffmpeg | 217 | #ffmpeg |
216 | ffmpegthumbnailer | 218 | ffmpegthumbnailer |
217 | ffplay | 219 | ffplay |
218 | ffprobe | 220 | ffprobe |
@@ -334,6 +336,7 @@ gradio | |||
334 | gramps | 336 | gramps |
335 | gravity-beams-and-evaporating-stars | 337 | gravity-beams-and-evaporating-stars |
336 | gthumb | 338 | gthumb |
339 | gtk-straw-viewer | ||
337 | gtk-youtube-viewer | 340 | gtk-youtube-viewer |
338 | gtk2-youtube-viewer | 341 | gtk2-youtube-viewer |
339 | gtk3-youtube-viewer | 342 | gtk3-youtube-viewer |
@@ -682,6 +685,7 @@ steam-native | |||
682 | steam-runtime | 685 | steam-runtime |
683 | stellarium | 686 | stellarium |
684 | strawberry | 687 | strawberry |
688 | straw-viewer | ||
685 | strings | 689 | strings |
686 | studio.sh | 690 | studio.sh |
687 | subdownloader | 691 | subdownloader |
diff --git a/src/firejail/fs.c b/src/firejail/fs.c index 76ec102c3..0d4e496e8 100644 --- a/src/firejail/fs.c +++ b/src/firejail/fs.c | |||
@@ -162,6 +162,13 @@ static void disable_file(OPERATION op, const char *filename) { | |||
162 | } | 162 | } |
163 | else if (op == MOUNT_TMPFS) { | 163 | else if (op == MOUNT_TMPFS) { |
164 | if (S_ISDIR(s.st_mode)) { | 164 | if (S_ISDIR(s.st_mode)) { |
165 | if (getuid()) { | ||
166 | if (strncmp(cfg.homedir, fname, strlen(cfg.homedir)) != 0 || | ||
167 | fname[strlen(cfg.homedir)] != '/') { | ||
168 | fprintf(stderr, "Error: tmpfs outside $HOME is only available for root\n"); | ||
169 | exit(1); | ||
170 | } | ||
171 | } | ||
165 | fs_tmpfs(fname, getuid()); | 172 | fs_tmpfs(fname, getuid()); |
166 | last_disable = SUCCESSFUL; | 173 | last_disable = SUCCESSFUL; |
167 | } | 174 | } |
@@ -366,14 +373,6 @@ void fs_blacklist(void) { | |||
366 | else if (strncmp(entry->data, "tmpfs ", 6) == 0) { | 373 | else if (strncmp(entry->data, "tmpfs ", 6) == 0) { |
367 | ptr = entry->data + 6; | 374 | ptr = entry->data + 6; |
368 | op = MOUNT_TMPFS; | 375 | op = MOUNT_TMPFS; |
369 | char *resolved_path = realpath(ptr, NULL); | ||
370 | if (!resolved_path || strncmp(cfg.homedir, resolved_path, strlen(cfg.homedir)) != 0) { | ||
371 | if (getuid() != 0) { | ||
372 | fprintf(stderr, "Error: tmpfs outside $HOME is only available for root\n"); | ||
373 | exit(1); | ||
374 | } | ||
375 | } | ||
376 | free(resolved_path); | ||
377 | } | 376 | } |
378 | else if (strncmp(entry->data, "mkdir ", 6) == 0) { | 377 | else if (strncmp(entry->data, "mkdir ", 6) == 0) { |
379 | EUID_USER(); | 378 | EUID_USER(); |
@@ -1262,28 +1261,3 @@ void fs_private_tmp(void) { | |||
1262 | } | 1261 | } |
1263 | closedir(dir); | 1262 | closedir(dir); |
1264 | } | 1263 | } |
1265 | |||
1266 | // this function is called from sandbox.c before blacklist/whitelist functions | ||
1267 | void fs_private_cache(void) { | ||
1268 | char *cache; | ||
1269 | if (asprintf(&cache, "%s/.cache", cfg.homedir) == -1) | ||
1270 | errExit("asprintf"); | ||
1271 | // check if ~/.cache is a valid destination | ||
1272 | struct stat s; | ||
1273 | if (lstat(cache, &s) == -1) { | ||
1274 | fwarning("skipping private-cache: cannot find %s\n", cache); | ||
1275 | free(cache); | ||
1276 | return; | ||
1277 | } | ||
1278 | if (!S_ISDIR(s.st_mode)) { | ||
1279 | if (S_ISLNK(s.st_mode)) | ||
1280 | fwarning("skipping private-cache: %s is a symbolic link\n", cache); | ||
1281 | else | ||
1282 | fwarning("skipping private-cache: %s is not a directory\n", cache); | ||
1283 | free(cache); | ||
1284 | return; | ||
1285 | } | ||
1286 | // do the mount | ||
1287 | fs_tmpfs(cache, getuid()); // check ownership of ~/.cache | ||
1288 | free(cache); | ||
1289 | } | ||
diff --git a/src/firejail/fs_lib.c b/src/firejail/fs_lib.c index 64444bba2..5cfd33b42 100644 --- a/src/firejail/fs_lib.c +++ b/src/firejail/fs_lib.c | |||
@@ -378,6 +378,9 @@ void fs_private_lib(void) { | |||
378 | // bring in firejail executable libraries in case we are redirected here by a firejail symlink from /usr/local/bin/firejail | 378 | // bring in firejail executable libraries in case we are redirected here by a firejail symlink from /usr/local/bin/firejail |
379 | fslib_install_list("/usr/bin/firejail,firejail"); // todo: use the installed path for the executable | 379 | fslib_install_list("/usr/bin/firejail,firejail"); // todo: use the installed path for the executable |
380 | 380 | ||
381 | // install libraries needed by fcopy | ||
382 | fslib_install_list(PATH_FCOPY); | ||
383 | |||
381 | fmessage("Installed %d %s and %d %s\n", lib_cnt, (lib_cnt == 1)? "library": "libraries", | 384 | fmessage("Installed %d %s and %d %s\n", lib_cnt, (lib_cnt == 1)? "library": "libraries", |
382 | dir_cnt, (dir_cnt == 1)? "directory": "directories"); | 385 | dir_cnt, (dir_cnt == 1)? "directory": "directories"); |
383 | 386 | ||
diff --git a/src/firejail/ls.c b/src/firejail/ls.c index 1a65c9ff0..e61edf427 100644 --- a/src/firejail/ls.c +++ b/src/firejail/ls.c | |||
@@ -26,6 +26,7 @@ | |||
26 | #include <dirent.h> | 26 | #include <dirent.h> |
27 | #include <pwd.h> | 27 | #include <pwd.h> |
28 | #include <grp.h> | 28 | #include <grp.h> |
29 | #include <fcntl.h> | ||
29 | //#include <dirent.h> | 30 | //#include <dirent.h> |
30 | //#include <stdio.h> | 31 | //#include <stdio.h> |
31 | //#include <stdlib.h> | 32 | //#include <stdlib.h> |
@@ -293,6 +294,41 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { | |||
293 | printf("file2 %s\n", fname2 ? fname2 : "(null)"); | 294 | printf("file2 %s\n", fname2 ? fname2 : "(null)"); |
294 | } | 295 | } |
295 | 296 | ||
297 | // get file from sandbox and store it in the current directory | ||
298 | // implemented using --cat | ||
299 | if (op == SANDBOX_FS_GET) { | ||
300 | char *dest_fname = strrchr(fname1, '/'); | ||
301 | if (!dest_fname || *(++dest_fname) == '\0') { | ||
302 | fprintf(stderr, "Error: invalid file name %s\n", fname1); | ||
303 | exit(1); | ||
304 | } | ||
305 | // create destination file if necessary | ||
306 | EUID_ASSERT(); | ||
307 | int fd = open(dest_fname, O_WRONLY|O_CREAT|O_CLOEXEC, S_IRUSR | S_IWRITE); | ||
308 | if (fd == -1) { | ||
309 | fprintf(stderr, "Error: cannot open %s for writing\n", dest_fname); | ||
310 | exit(1); | ||
311 | } | ||
312 | struct stat s; | ||
313 | if (fstat(fd, &s) == -1) | ||
314 | errExit("fstat"); | ||
315 | if (!S_ISREG(s.st_mode)) { | ||
316 | fprintf(stderr, "Error: %s is no regular file\n", dest_fname); | ||
317 | exit(1); | ||
318 | } | ||
319 | if (ftruncate(fd, 0) == -1) | ||
320 | errExit("ftruncate"); | ||
321 | // go quiet - messages on stdout will corrupt the file | ||
322 | arg_debug = 0; | ||
323 | arg_quiet = 1; | ||
324 | // redirection | ||
325 | if (dup2(fd, STDOUT_FILENO) == -1) | ||
326 | errExit("dup2"); | ||
327 | assert(fd != STDOUT_FILENO); | ||
328 | close(fd); | ||
329 | op = SANDBOX_FS_CAT; | ||
330 | } | ||
331 | |||
296 | // sandbox root directory | 332 | // sandbox root directory |
297 | char *rootdir; | 333 | char *rootdir; |
298 | if (asprintf(&rootdir, "/proc/%d/root", pid) == -1) | 334 | if (asprintf(&rootdir, "/proc/%d/root", pid) == -1) |
@@ -317,92 +353,6 @@ void sandboxfs(int op, pid_t pid, const char *path1, const char *path2) { | |||
317 | __gcov_flush(); | 353 | __gcov_flush(); |
318 | #endif | 354 | #endif |
319 | } | 355 | } |
320 | |||
321 | // get file from sandbox and store it in the current directory | ||
322 | else if (op == SANDBOX_FS_GET) { | ||
323 | char *src_fname =fname1; | ||
324 | char *dest_fname = strrchr(fname1, '/'); | ||
325 | if (!dest_fname || *(++dest_fname) == '\0') { | ||
326 | fprintf(stderr, "Error: invalid file name %s\n", fname1); | ||
327 | exit(1); | ||
328 | } | ||
329 | |||
330 | EUID_ROOT(); | ||
331 | if (arg_debug) | ||
332 | printf("copy %s to %s\n", src_fname, dest_fname); | ||
333 | |||
334 | // create a user-owned temporary file in /run/firejail directory | ||
335 | char tmp_fname[] = "/run/firejail/tmpget-XXXXXX"; | ||
336 | int fd = mkstemp(tmp_fname); | ||
337 | if (fd == -1) { | ||
338 | fprintf(stderr, "Error: cannot create temporary file %s\n", tmp_fname); | ||
339 | exit(1); | ||
340 | } | ||
341 | SET_PERMS_FD(fd, getuid(), getgid(), 0600); | ||
342 | close(fd); | ||
343 | |||
344 | // copy the source file into the temporary file - we need to chroot | ||
345 | pid_t child = fork(); | ||
346 | if (child < 0) | ||
347 | errExit("fork"); | ||
348 | if (child == 0) { | ||
349 | // chroot | ||
350 | if (chroot(rootdir) < 0) | ||
351 | errExit("chroot"); | ||
352 | if (chdir("/") < 0) | ||
353 | errExit("chdir"); | ||
354 | |||
355 | // drop privileges | ||
356 | drop_privs(0); | ||
357 | |||
358 | // copy the file | ||
359 | if (copy_file(src_fname, tmp_fname, getuid(), getgid(), 0600)) // already a regular user | ||
360 | _exit(1); | ||
361 | #ifdef HAVE_GCOV | ||
362 | __gcov_flush(); | ||
363 | #endif | ||
364 | _exit(0); | ||
365 | } | ||
366 | |||
367 | // wait for the child to finish | ||
368 | int status = 0; | ||
369 | waitpid(child, &status, 0); | ||
370 | if (WIFEXITED(status) && WEXITSTATUS(status) == 0); | ||
371 | else { | ||
372 | unlink(tmp_fname); | ||
373 | exit(1); | ||
374 | } | ||
375 | |||
376 | // copy the temporary file into the destination file | ||
377 | child = fork(); | ||
378 | if (child < 0) | ||
379 | errExit("fork"); | ||
380 | if (child == 0) { | ||
381 | // drop privileges | ||
382 | drop_privs(0); | ||
383 | |||
384 | // copy the file | ||
385 | if (copy_file(tmp_fname, dest_fname, getuid(), getgid(), 0600)) // already a regular user | ||
386 | _exit(1); | ||
387 | #ifdef HAVE_GCOV | ||
388 | __gcov_flush(); | ||
389 | #endif | ||
390 | _exit(0); | ||
391 | } | ||
392 | |||
393 | // wait for the child to finish | ||
394 | status = 0; | ||
395 | waitpid(child, &status, 0); | ||
396 | if (WIFEXITED(status) && WEXITSTATUS(status) == 0); | ||
397 | else { | ||
398 | unlink(tmp_fname); | ||
399 | exit(1); | ||
400 | } | ||
401 | |||
402 | // remove the temporary file | ||
403 | unlink(tmp_fname); | ||
404 | EUID_USER(); | ||
405 | } | ||
406 | // get file from host and store it in the sandbox | 356 | // get file from host and store it in the sandbox |
407 | else if (op == SANDBOX_FS_PUT && path2) { | 357 | else if (op == SANDBOX_FS_PUT && path2) { |
408 | char *src_fname =fname1; | 358 | char *src_fname =fname1; |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 676d04895..53300fe2d 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -161,7 +161,6 @@ int fullargc = 0; | |||
161 | static pid_t child = 0; | 161 | static pid_t child = 0; |
162 | pid_t sandbox_pid; | 162 | pid_t sandbox_pid; |
163 | mode_t orig_umask = 022; | 163 | mode_t orig_umask = 022; |
164 | unsigned long long start_timestamp; | ||
165 | 164 | ||
166 | static void clear_atexit(void) { | 165 | static void clear_atexit(void) { |
167 | EUID_ROOT(); | 166 | EUID_ROOT(); |
@@ -1026,7 +1025,7 @@ int main(int argc, char **argv, char **envp) { | |||
1026 | init_cfg(argc, argv); | 1025 | init_cfg(argc, argv); |
1027 | 1026 | ||
1028 | // get starting timestamp, process --quiet | 1027 | // get starting timestamp, process --quiet |
1029 | start_timestamp = getticks(); | 1028 | timetrace_start(); |
1030 | char *env_quiet = getenv("FIREJAIL_QUIET"); | 1029 | char *env_quiet = getenv("FIREJAIL_QUIET"); |
1031 | if (check_arg(argc, argv, "--quiet", 1) || (env_quiet && strcmp(env_quiet, "yes") == 0)) | 1030 | if (check_arg(argc, argv, "--quiet", 1) || (env_quiet && strcmp(env_quiet, "yes") == 0)) |
1032 | arg_quiet = 1; | 1031 | arg_quiet = 1; |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 5ddf6fdbb..ff8b47102 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -1497,7 +1497,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
1497 | if (checkcfg(CFG_JOIN) || getuid() == 0) { | 1497 | if (checkcfg(CFG_JOIN) || getuid() == 0) { |
1498 | // try to join by name only | 1498 | // try to join by name only |
1499 | pid_t pid; | 1499 | pid_t pid; |
1500 | if (!name2pid(ptr + 14, &pid)) { | 1500 | EUID_ROOT(); |
1501 | int r = name2pid(ptr + 14, &pid); | ||
1502 | EUID_USER(); | ||
1503 | if (!r) { | ||
1501 | if (!cfg.shell && !arg_shell_none) | 1504 | if (!cfg.shell && !arg_shell_none) |
1502 | cfg.shell = guess_shell(); | 1505 | cfg.shell = guess_shell(); |
1503 | 1506 | ||
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 8bfe76603..5c7b5e556 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -400,19 +400,8 @@ static int monitor_application(pid_t app_pid) { | |||
400 | } | 400 | } |
401 | 401 | ||
402 | static void print_time(void) { | 402 | static void print_time(void) { |
403 | if (start_timestamp) { | 403 | float delta = timetrace_end(); |
404 | unsigned long long end_timestamp = getticks(); | 404 | fmessage("Child process initialized in %.02f ms\n", delta); |
405 | // measure 1 ms | ||
406 | usleep(1000); | ||
407 | unsigned long long onems = getticks() - end_timestamp; | ||
408 | if (onems) { | ||
409 | fmessage("Child process initialized in %.02f ms\n", | ||
410 | (float) (end_timestamp - start_timestamp) / (float) onems); | ||
411 | return; | ||
412 | } | ||
413 | } | ||
414 | |||
415 | fmessage("Child process initialized\n"); | ||
416 | } | 405 | } |
417 | 406 | ||
418 | 407 | ||
@@ -923,12 +912,9 @@ int sandbox(void* sandbox_arg) { | |||
923 | 912 | ||
924 | #ifdef HAVE_USERTMPFS | 913 | #ifdef HAVE_USERTMPFS |
925 | if (arg_private_cache) { | 914 | if (arg_private_cache) { |
926 | if (cfg.chrootdir) | 915 | EUID_USER(); |
927 | fwarning("private-cache feature is disabled in chroot\n"); | 916 | profile_add("tmpfs ${HOME}/.cache"); |
928 | else if (arg_overlay) | 917 | EUID_ROOT(); |
929 | fwarning("private-cache feature is disabled in overlay\n"); | ||
930 | else | ||
931 | fs_private_cache(); | ||
932 | } | 918 | } |
933 | #endif | 919 | #endif |
934 | 920 | ||
diff --git a/src/include/common.h b/src/include/common.h index 2fa61cc91..5df51c5a9 100644 --- a/src/include/common.h +++ b/src/include/common.h | |||
@@ -118,21 +118,6 @@ static inline int mac_not_zero(const unsigned char mac[6]) { | |||
118 | return 0; | 118 | return 0; |
119 | } | 119 | } |
120 | 120 | ||
121 | // rtdsc timestamp on x86-64/amd64 processors | ||
122 | static inline unsigned long long getticks(void) { | ||
123 | #if defined(__x86_64__) | ||
124 | unsigned a, d; | ||
125 | asm volatile("rdtsc" : "=a" (a), "=d" (d)); | ||
126 | return ((unsigned long long)a) | (((unsigned long long)d) << 32); | ||
127 | #elif defined(__i386__) | ||
128 | unsigned long long ret; | ||
129 | __asm__ __volatile__("rdtsc" : "=A" (ret)); | ||
130 | return ret; | ||
131 | #else | ||
132 | return 0; // not implemented | ||
133 | #endif | ||
134 | } | ||
135 | |||
136 | void timetrace_start(void); | 121 | void timetrace_start(void); |
137 | float timetrace_end(void); | 122 | float timetrace_end(void); |
138 | int join_namespace(pid_t pid, char *type); | 123 | int join_namespace(pid_t pid, char *type); |
diff --git a/src/lib/common.c b/src/lib/common.c index 1fd317d4f..823442835 100644 --- a/src/lib/common.c +++ b/src/lib/common.c | |||
@@ -30,6 +30,7 @@ | |||
30 | #include <signal.h> | 30 | #include <signal.h> |
31 | #include <dirent.h> | 31 | #include <dirent.h> |
32 | #include <string.h> | 32 | #include <string.h> |
33 | #include <time.h> | ||
33 | #include "../include/common.h" | 34 | #include "../include/common.h" |
34 | #define BUFLEN 4096 | 35 | #define BUFLEN 4096 |
35 | 36 | ||
@@ -277,7 +278,7 @@ int pid_hidepid(void) { | |||
277 | if (strstr(buf, "proc /proc proc")) { | 278 | if (strstr(buf, "proc /proc proc")) { |
278 | fclose(fp); | 279 | fclose(fp); |
279 | // check hidepid | 280 | // check hidepid |
280 | if (strstr(buf, "hidepid=2") || strstr(buf, "hidepid=1")) | 281 | if (strstr(buf, "hidepid=")) |
281 | return 1; | 282 | return 1; |
282 | return 0; | 283 | return 0; |
283 | } | 284 | } |
@@ -290,38 +291,42 @@ int pid_hidepid(void) { | |||
290 | //************************** | 291 | //************************** |
291 | // time trace based on getticks function | 292 | // time trace based on getticks function |
292 | //************************** | 293 | //************************** |
293 | static int tt_not_implemented = 0; // not implemented for the current architecture | 294 | typedef struct list_entry_t { |
294 | static unsigned long long tt_1ms = 0; | 295 | struct list_entry_t *next; |
295 | static unsigned long long tt = 0; // start time | 296 | struct timespec ts; |
297 | } ListEntry; | ||
296 | 298 | ||
297 | void timetrace_start(void) { | 299 | static ListEntry *ts_list = NULL; |
298 | if (tt_not_implemented) | ||
299 | return; | ||
300 | unsigned long long t1 = getticks(); | ||
301 | if (t1 == 0) { | ||
302 | tt_not_implemented = 1; | ||
303 | return; | ||
304 | } | ||
305 | 300 | ||
306 | if (tt_1ms == 0) { | 301 | static inline float msdelta(struct timespec *start, struct timespec *end) { |
307 | usleep(1000); // sleep 1 ms | 302 | unsigned sec = end->tv_sec - start->tv_sec; |
308 | unsigned long long t2 = getticks(); | 303 | long nsec = end->tv_nsec - start->tv_nsec; |
309 | tt_1ms = t2 - t1; | 304 | return (float) sec * 1000 + (float) nsec / 1000000; |
310 | if (tt_1ms == 0) { | 305 | } |
311 | tt_not_implemented = 1; | ||
312 | return; | ||
313 | } | ||
314 | } | ||
315 | 306 | ||
316 | tt = getticks(); | 307 | void timetrace_start(void) { |
308 | ListEntry *t = malloc(sizeof(ListEntry)); | ||
309 | if (!t) | ||
310 | errExit("malloc"); | ||
311 | memset(t, 0, sizeof(ListEntry)); | ||
312 | clock_gettime(CLOCK_MONOTONIC, &t->ts); | ||
313 | |||
314 | // add it to the list | ||
315 | t->next = ts_list; | ||
316 | ts_list = t; | ||
317 | } | 317 | } |
318 | 318 | ||
319 | float timetrace_end(void) { | 319 | float timetrace_end(void) { |
320 | if (tt_not_implemented) | 320 | if (!ts_list) |
321 | return 0; | 321 | return 0; |
322 | 322 | ||
323 | unsigned long long delta = getticks() - tt; | 323 | // remove start time from the list |
324 | assert(tt_1ms); | 324 | ListEntry *t = ts_list; |
325 | ts_list = t->next; | ||
325 | 326 | ||
326 | return (float) delta / (float) tt_1ms; | 327 | struct timespec end; |
328 | clock_gettime(CLOCK_MONOTONIC, &end); | ||
329 | float rv = msdelta(&t->ts, &end); | ||
330 | free(t); | ||
331 | return rv; | ||
327 | } | 332 | } |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index ef7dccbfb..9524254c1 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -412,7 +412,7 @@ There is no root account (uid 0) defined in the namespace. | |||
412 | \fBprotocol protocol1,protocol2,protocol3 | 412 | \fBprotocol protocol1,protocol2,protocol3 |
413 | Enable protocol filter. The filter is based on seccomp and checks the | 413 | Enable protocol filter. The filter is based on seccomp and checks the |
414 | first argument to socket system call. Recognized values: \fBunix\fR, | 414 | first argument to socket system call. Recognized values: \fBunix\fR, |
415 | \fBinet\fR, \fBinet6\fR, \fBnetlink\fR and \fBpacket\fR. | 415 | \fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR. |
416 | .TP | 416 | .TP |
417 | \fBseccomp | 417 | \fBseccomp |
418 | Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details. | 418 | Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details. |
diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 219eba10e..562b3eda3 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt | |||
@@ -1558,7 +1558,7 @@ Parent pid 8553, child pid 8554 | |||
1558 | Child process initialized | 1558 | Child process initialized |
1559 | .br | 1559 | .br |
1560 | [...] | 1560 | [...] |
1561 | #if HAVE_USERNS | 1561 | #ifdef HAVE_USERNS |
1562 | .TP | 1562 | .TP |
1563 | \fB\-\-noroot | 1563 | \fB\-\-noroot |
1564 | Install a user namespace with a single user - the current user. | 1564 | Install a user namespace with a single user - the current user. |
@@ -2003,7 +2003,7 @@ $ firejail \-\-profile.print=browser | |||
2003 | .TP | 2003 | .TP |
2004 | \fB\-\-protocol=protocol,protocol,protocol | 2004 | \fB\-\-protocol=protocol,protocol,protocol |
2005 | Enable protocol filter. The filter is based on seccomp and checks the first argument to socket system call. | 2005 | Enable protocol filter. The filter is based on seccomp and checks the first argument to socket system call. |
2006 | Recognized values: unix, inet, inet6, netlink and packet. This option is not supported for i386 architecture. | 2006 | Recognized values: unix, inet, inet6, netlink, packet and bluetooth. This option is not supported for i386 architecture. |
2007 | .br | 2007 | .br |
2008 | 2008 | ||
2009 | .br | 2009 | .br |
diff --git a/src/man/preproc.awk b/src/man/preproc.awk index 20081b551..1471be3ec 100755 --- a/src/man/preproc.awk +++ b/src/man/preproc.awk | |||
@@ -23,7 +23,7 @@ | |||
23 | BEGIN { | 23 | BEGIN { |
24 | macros[0] = 0 | 24 | macros[0] = 0 |
25 | for (arg in ARGV) { | 25 | for (arg in ARGV) { |
26 | if (ARGV[arg] ~ /^-D[A-Z_]+$/) { | 26 | if (ARGV[arg] ~ /^-D[A-Z0-9_]+$/) { |
27 | macros[length(macros) + 1] = substr(ARGV[arg], 3) | 27 | macros[length(macros) + 1] = substr(ARGV[arg], 3) |
28 | } | 28 | } |
29 | ARGV[arg] = "" | 29 | ARGV[arg] = "" |
@@ -31,7 +31,7 @@ BEGIN { | |||
31 | 31 | ||
32 | include = 1 | 32 | include = 1 |
33 | } | 33 | } |
34 | /^#ifdef [A-Z_]+$/ { | 34 | /^#ifdef [A-Z0-9_]+$/ { |
35 | macro = substr($0, 8) | 35 | macro = substr($0, 8) |
36 | for (i in macros) { | 36 | for (i in macros) { |
37 | if (macros[i] == macro) { | 37 | if (macros[i] == macro) { |
diff --git a/test/fs/fscheck-tmpfs.exp b/test/fs/fscheck-tmpfs.exp index ebd3eeb9c..818549fe2 100755 --- a/test/fs/fscheck-tmpfs.exp +++ b/test/fs/fscheck-tmpfs.exp | |||
@@ -7,12 +7,49 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | # .. | 10 | send -- "mkdir -p ~/fjtest-dir/fjtest-dir\r" |
11 | send -- "firejail --tmpfs=fscheck-dir\r" | 11 | after 100 |
12 | send -- "mkdir /tmp/fjtest-dir\r" | ||
13 | after 100 | ||
14 | |||
15 | if { ! [file exists ~/fjtest-dir/fjtest-dir] } { | ||
16 | puts "TESTING ERROR 1\n" | ||
17 | exit | ||
18 | } | ||
19 | if { ! [file exists /tmp/fjtest-dir] } { | ||
20 | puts "TESTING ERROR 2\n" | ||
21 | exit | ||
22 | } | ||
23 | |||
24 | send -- "firejail --noprofile --tmpfs=~/fjtest-dir\r" | ||
25 | expect { | ||
26 | timeout {puts "TESTING ERROR 3\n";exit} | ||
27 | "Child process initialized" | ||
28 | } | ||
29 | after 500 | ||
30 | |||
31 | send -- "ls ~/fjtest-dir/fjtest-dir\r" | ||
32 | expect { | ||
33 | timeout {puts "TESTING ERROR 4\n";exit} | ||
34 | "No such file or directory" | ||
35 | } | ||
36 | after 500 | ||
37 | |||
38 | send -- "exit\r" | ||
39 | after 500 | ||
40 | |||
41 | send -- "firejail --noprofile --tmpfs=/tmp/fjtest-dir\r" | ||
12 | expect { | 42 | expect { |
13 | timeout {puts "TESTING ERROR 0.1\n";exit} | 43 | timeout {puts "TESTING ERROR 5\n";exit} |
14 | "Error" | 44 | "Error" |
15 | } | 45 | } |
46 | after 500 | ||
47 | |||
48 | # cleanup | ||
49 | send -- "rm -fr ~/fjtest-dir\r" | ||
16 | after 100 | 50 | after 100 |
51 | send -- "rm -fr /tmp/fjtest-dir\r" | ||
52 | after 100 | ||
53 | |||
17 | 54 | ||
18 | puts "\nall done\n" | 55 | puts "\nall done\n" |
diff --git a/test/fs/private-cache.exp b/test/fs/private-cache.exp index 0597e8921..6e4c6bd1b 100755 --- a/test/fs/private-cache.exp +++ b/test/fs/private-cache.exp | |||
@@ -7,16 +7,17 @@ set timeout 10 | |||
7 | spawn $env(SHELL) | 7 | spawn $env(SHELL) |
8 | match_max 100000 | 8 | match_max 100000 |
9 | 9 | ||
10 | if {[file exists ~/.cache]} { | 10 | send -- "mkdir --mode=700 ~/.cache\r" |
11 | puts "found .cache directory\n" | ||
12 | } else { | ||
13 | send -- "mkdir --mode=755 ~/.cache\r" | ||
14 | } | ||
15 | after 100 | 11 | after 100 |
16 | 12 | ||
17 | send -- "touch ~/.cache/abcdefg\r" | 13 | send -- "touch ~/.cache/abcdefg\r" |
18 | after 100 | 14 | after 100 |
19 | 15 | ||
16 | if { ! [file exists ~/.cache/abcdefg] } { | ||
17 | puts "TESTING ERROR 0\n" | ||
18 | exit | ||
19 | } | ||
20 | |||
20 | send -- "firejail --noprofile --private-cache\r" | 21 | send -- "firejail --noprofile --private-cache\r" |
21 | expect { | 22 | expect { |
22 | timeout {puts "TESTING ERROR 1\n";exit} | 23 | timeout {puts "TESTING ERROR 1\n";exit} |
@@ -34,23 +35,8 @@ after 100 | |||
34 | send -- "exit\r" | 35 | send -- "exit\r" |
35 | sleep 1 | 36 | sleep 1 |
36 | 37 | ||
37 | send -- "rm -v ~/.cache/abcdefg\r" | 38 | # cleanup |
38 | expect { | 39 | send -- "rm ~/.cache/abcdefg\r" |
39 | timeout {puts "TESTING ERROR 3\n";exit} | ||
40 | "removed" | ||
41 | } | ||
42 | after 100 | 40 | after 100 |
43 | 41 | ||
44 | # redo the test with --private | ||
45 | |||
46 | send -- "firejail --noprofile --private --private-cache\r" | ||
47 | expect { | ||
48 | timeout {puts "TESTING ERROR 4\n";exit} | ||
49 | "Warning" | ||
50 | } | ||
51 | sleep 1 | ||
52 | |||
53 | send -- "exit\r" | ||
54 | sleep 1 | ||
55 | |||
56 | puts "\nall done\n" | 42 | puts "\nall done\n" |
diff --git a/test/profiles/profiles.sh b/test/profiles/profiles.sh index 75d961eb1..2d7d2a966 100755 --- a/test/profiles/profiles.sh +++ b/test/profiles/profiles.sh | |||
@@ -40,7 +40,7 @@ if [ -d "/run/user/$UID" ]; then | |||
40 | PROFILES=`ls /etc/firejail/*.profile` | 40 | PROFILES=`ls /etc/firejail/*.profile` |
41 | echo "TESTING: default profiles installed in /etc" | 41 | echo "TESTING: default profiles installed in /etc" |
42 | else | 42 | else |
43 | PROFILES=`ls /etc/firejail/fi*.profile /etc/firejail/fl*.profile /etc/firejail/free*.profile` | 43 | PROFILES=`ls /etc/firejail/transmission*.profile /etc/firejail/fi*.profile /etc/firejail/fl*.profile /etc/firejail/free*.profile` |
44 | echo "TESTING: small number of default profiles installed in /etc" | 44 | echo "TESTING: small number of default profiles installed in /etc" |
45 | fi | 45 | fi |
46 | 46 | ||