aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--.github/ISSUE_TEMPLATE/build_issue.md72
-rw-r--r--.github/workflows/build-extra.yml2
-rw-r--r--.github/workflows/build.yml2
-rw-r--r--.github/workflows/check-c.yml12
-rw-r--r--.github/workflows/check-profiles.yml2
-rw-r--r--.github/workflows/check-python.yml6
-rw-r--r--.github/workflows/codespell.yml2
-rw-r--r--.github/workflows/test.yml10
-rw-r--r--README39
-rw-r--r--RELNOTES11
-rw-r--r--etc/inc/disable-common.inc4
-rw-r--r--etc/profile-a-l/abrowser.profile3
-rw-r--r--etc/profile-a-l/basilisk.profile3
-rw-r--r--etc/profile-a-l/bijiben.profile5
-rw-r--r--etc/profile-a-l/bitwarden-desktop.profile11
-rw-r--r--etc/profile-a-l/bitwarden.profile6
-rw-r--r--etc/profile-a-l/cachy-browser.profile4
-rw-r--r--etc/profile-a-l/cliqz.profile3
-rw-r--r--etc/profile-a-l/cyberfox.profile3
-rw-r--r--etc/profile-a-l/d-feet.profile39
-rw-r--r--etc/profile-a-l/d-spy.profile40
-rw-r--r--etc/profile-a-l/dbus-debug-common.profile49
-rw-r--r--etc/profile-a-l/dtui.profile15
-rw-r--r--etc/profile-a-l/element-desktop.profile1
-rw-r--r--etc/profile-a-l/firefox-common-addons.profile3
-rw-r--r--etc/profile-a-l/icecat.profile3
-rw-r--r--etc/profile-a-l/iceweasel.profile3
-rw-r--r--etc/profile-a-l/librewolf.profile4
-rw-r--r--etc/profile-m-z/okular.profile2
-rw-r--r--etc/profile-m-z/palemoon.profile3
-rw-r--r--etc/profile-m-z/ssh.profile3
-rw-r--r--etc/profile-m-z/sway.profile4
-rw-r--r--etc/profile-m-z/waterfox.profile4
-rw-r--r--etc/profile-m-z/zoom.profile3
-rw-r--r--src/firecfg/firecfg.config6
-rw-r--r--src/firemon/procevent.c3
-rwxr-xr-xsrc/fshaper/fshaper.sh10
-rw-r--r--src/man/firecfg.1.in46
-rw-r--r--src/man/firejail-profile.5.in60
-rw-r--r--src/man/firejail.1.in292
-rwxr-xr-xsrc/man/mkman.sh11
41 files changed, 467 insertions, 337 deletions
diff --git a/.github/ISSUE_TEMPLATE/build_issue.md b/.github/ISSUE_TEMPLATE/build_issue.md
new file mode 100644
index 000000000..7e0b822bb
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/build_issue.md
@@ -0,0 +1,72 @@
1---
2name: Build issue
3about: There is an issue when trying to build the project from source
4title: 'build: '
5labels: ''
6assignees: ''
7
8---
9
10<!--
11See the following links for help with formatting:
12
13https://guides.github.com/features/mastering-markdown/
14https://docs.github.com/en/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax
15-->
16
17### Description
18
19_Describe the bug_
20
21### Steps to Reproduce
22
23<!--
24Note: If the output is too long to embed it into the comment, you can post it
25in a gist at <https://gist.github.com/> and link it here or upload the build
26log as a file.
27
28Note: Make sure to include the exact command-line used for all commands and to
29include the full output of ./configure.
30
31Feel free to include only the errors in the make output if they are
32self-explanatory (for example, with `make >/dev/null`).
33-->
34
35_Post the commands used to reproduce the issue and their output_
36
37Example:
38
39```console
40$ ./configure --prefix=/usr --enable-apparmor
41checking for gcc... gcc
42checking whether the C compiler works... yes
43[...]
44$ make
45make -C src/lib
46gcc [...]
47[...]
48```
49
50_If ./configure fails, include the output of config.log_
51
52Example:
53
54```console
55$ cat config.log
56This file contains any messages produced by compilers while
57running configure, to aid debugging if configure makes a mistake.
58[...]
59```
60
61### Additional context
62
63_(Optional) Any other detail that may help to understand/debug the problem_
64
65### Environment
66
67- Name/version/arch of the Linux kernel (e.g. the output of `uname -srm`)
68- Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux")
69- Name/version of the C compiler (e.g. "gcc 14.1.1-1")
70- Name/version of the libc (e.g. "glibc 2.40-1")
71- Version of the Linux API headers (e.g. "linux-api-headers 6.10-1" on Arch Linux)
72- Version of the source code being built (e.g. the output of `git rev-parse HEAD`)
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
index ccc5c9bf7..8ad73bb45 100644
--- a/.github/workflows/build-extra.yml
+++ b/.github/workflows/build-extra.yml
@@ -44,7 +44,7 @@ jobs:
44 timeout-minutes: 10 44 timeout-minutes: 10
45 steps: 45 steps:
46 - name: Harden Runner 46 - name: Harden Runner
47 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 47 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
48 with: 48 with:
49 egress-policy: block 49 egress-policy: block
50 allowed-endpoints: > 50 allowed-endpoints: >
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e7752f3d3..e8bfd0c16 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -60,7 +60,7 @@ jobs:
60 timeout-minutes: 10 60 timeout-minutes: 10
61 steps: 61 steps:
62 - name: Harden Runner 62 - name: Harden Runner
63 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 63 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
64 with: 64 with:
65 egress-policy: block 65 egress-policy: block
66 allowed-endpoints: > 66 allowed-endpoints: >
diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml
index a0b7245e5..1b35f684f 100644
--- a/.github/workflows/check-c.yml
+++ b/.github/workflows/check-c.yml
@@ -46,7 +46,7 @@ jobs:
46 timeout-minutes: 10 46 timeout-minutes: 10
47 steps: 47 steps:
48 - name: Harden Runner 48 - name: Harden Runner
49 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 49 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
50 with: 50 with:
51 egress-policy: block 51 egress-policy: block
52 allowed-endpoints: > 52 allowed-endpoints: >
@@ -79,7 +79,7 @@ jobs:
79 timeout-minutes: 10 79 timeout-minutes: 10
80 steps: 80 steps:
81 - name: Harden Runner 81 - name: Harden Runner
82 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 82 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
83 with: 83 with:
84 egress-policy: block 84 egress-policy: block
85 allowed-endpoints: > 85 allowed-endpoints: >
@@ -109,7 +109,7 @@ jobs:
109 timeout-minutes: 10 109 timeout-minutes: 10
110 steps: 110 steps:
111 - name: Harden Runner 111 - name: Harden Runner
112 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 112 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
113 with: 113 with:
114 egress-policy: block 114 egress-policy: block
115 allowed-endpoints: > 115 allowed-endpoints: >
@@ -143,7 +143,7 @@ jobs:
143 143
144 steps: 144 steps:
145 - name: Harden Runner 145 - name: Harden Runner
146 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 146 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
147 with: 147 with:
148 disable-sudo: true 148 disable-sudo: true
149 egress-policy: block 149 egress-policy: block
@@ -161,7 +161,7 @@ jobs:
161 161
162 # Initializes the CodeQL tools for scanning. 162 # Initializes the CodeQL tools for scanning.
163 - name: Initialize CodeQL 163 - name: Initialize CodeQL
164 uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c 164 uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93
165 with: 165 with:
166 languages: cpp 166 languages: cpp
167 167
@@ -172,4 +172,4 @@ jobs:
172 run: make -j "$(nproc)" 172 run: make -j "$(nproc)"
173 173
174 - name: Perform CodeQL Analysis 174 - name: Perform CodeQL Analysis
175 uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c 175 uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93
diff --git a/.github/workflows/check-profiles.yml b/.github/workflows/check-profiles.yml
index 38cb1f29b..cb9d9ce87 100644
--- a/.github/workflows/check-profiles.yml
+++ b/.github/workflows/check-profiles.yml
@@ -33,7 +33,7 @@ jobs:
33 33
34 steps: 34 steps:
35 - name: Harden Runner 35 - name: Harden Runner
36 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 36 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
37 with: 37 with:
38 disable-sudo: true 38 disable-sudo: true
39 egress-policy: block 39 egress-policy: block
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml
index 838414498..ed317a86f 100644
--- a/.github/workflows/check-python.yml
+++ b/.github/workflows/check-python.yml
@@ -31,7 +31,7 @@ jobs:
31 31
32 steps: 32 steps:
33 - name: Harden Runner 33 - name: Harden Runner
34 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 34 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
35 with: 35 with:
36 disable-sudo: true 36 disable-sudo: true
37 egress-policy: block 37 egress-policy: block
@@ -51,9 +51,9 @@ jobs:
51 51
52 # Initializes the CodeQL tools for scanning. 52 # Initializes the CodeQL tools for scanning.
53 - name: Initialize CodeQL 53 - name: Initialize CodeQL
54 uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c 54 uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93
55 with: 55 with:
56 languages: python 56 languages: python
57 57
58 - name: Perform CodeQL Analysis 58 - name: Perform CodeQL Analysis
59 uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c 59 uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 6e0fe73d2..27c6ab125 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -24,7 +24,7 @@ jobs:
24 timeout-minutes: 5 24 timeout-minutes: 5
25 steps: 25 steps:
26 - name: Harden Runner 26 - name: Harden Runner
27 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 27 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
28 with: 28 with:
29 egress-policy: block 29 egress-policy: block
30 allowed-endpoints: > 30 allowed-endpoints: >
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c1ee00934..92eb212e4 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -54,7 +54,7 @@ jobs:
54 SHELL: /bin/bash 54 SHELL: /bin/bash
55 steps: 55 steps:
56 - name: Harden Runner 56 - name: Harden Runner
57 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 57 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
58 with: 58 with:
59 egress-policy: block 59 egress-policy: block
60 allowed-endpoints: > 60 allowed-endpoints: >
@@ -103,7 +103,7 @@ jobs:
103 SHELL: /bin/bash 103 SHELL: /bin/bash
104 steps: 104 steps:
105 - name: Harden Runner 105 - name: Harden Runner
106 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 106 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
107 with: 107 with:
108 egress-policy: block 108 egress-policy: block
109 allowed-endpoints: > 109 allowed-endpoints: >
@@ -143,7 +143,7 @@ jobs:
143 SHELL: /bin/bash 143 SHELL: /bin/bash
144 steps: 144 steps:
145 - name: Harden Runner 145 - name: Harden Runner
146 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 146 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
147 with: 147 with:
148 egress-policy: block 148 egress-policy: block
149 allowed-endpoints: > 149 allowed-endpoints: >
@@ -183,7 +183,7 @@ jobs:
183 SHELL: /bin/bash 183 SHELL: /bin/bash
184 steps: 184 steps:
185 - name: Harden Runner 185 - name: Harden Runner
186 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 186 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
187 with: 187 with:
188 egress-policy: block 188 egress-policy: block
189 allowed-endpoints: > 189 allowed-endpoints: >
@@ -225,7 +225,7 @@ jobs:
225 SHELL: /bin/bash 225 SHELL: /bin/bash
226 steps: 226 steps:
227 - name: Harden Runner 227 - name: Harden Runner
228 uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 228 uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
229 with: 229 with:
230 egress-policy: block 230 egress-policy: block
231 allowed-endpoints: > 231 allowed-endpoints: >
diff --git a/README b/README
index b55cf3ef8..d64554f9a 100644
--- a/README
+++ b/README
@@ -171,7 +171,7 @@ aoand (https://github.com/aoand)
171Arne Welzel (https://github.com/awelzel) 171Arne Welzel (https://github.com/awelzel)
172 - ignore SIGTTOU during flush_stdin() 172 - ignore SIGTTOU during flush_stdin()
173archaon616 (https://github.com/archaon616) 173archaon616 (https://github.com/archaon616)
174 - steam.profile: Allow Factorio 174 - steam.profile: allow Factorio, Zomboid
175Atrate (https://github.com/Atrate) 175Atrate (https://github.com/Atrate)
176 - BetterDiscord support 176 - BetterDiscord support
177Austin Morton (https://github.com/apmorton) 177Austin Morton (https://github.com/apmorton)
@@ -326,6 +326,8 @@ curiosityseeker (https://github.com/curiosityseeker - new)
326 - fixed conky profile 326 - fixed conky profile
327 - thunderbird.profile: harden and enable the rules necessary to make 327 - thunderbird.profile: harden and enable the rules necessary to make
328 Firefox open links 328 Firefox open links
329D357R0Y3R (https://github.com/D357R0Y3R)
330 - added floorp to firejail.config
329da2x (https://github.com/da2x) 331da2x (https://github.com/da2x)
330 - matched RPM license tag 332 - matched RPM license tag
331Daan Bakker (https://github.com/dbakker) 333Daan Bakker (https://github.com/dbakker)
@@ -371,6 +373,8 @@ DiGitHubCap (https://github.com/DiGitHubCap)
371 - fix qt5ct colour schemes and QSS 373 - fix qt5ct colour schemes and QSS
372Dieter Plaetinck (https://github.com/Dieterbe) 374Dieter Plaetinck (https://github.com/Dieterbe)
373 - qutebrowser: update MPRIS name for qutebrowser-qt6 375 - qutebrowser: update MPRIS name for qutebrowser-qt6
376 - fix email-common.profile
377 - fix claws-mail profile
374Disconnect3d (https://github.com/disconnect3d) 378Disconnect3d (https://github.com/disconnect3d)
375 - code cleanup 379 - code cleanup
376dm9pZCAq (https://github.com/dm9pZCAq) 380dm9pZCAq (https://github.com/dm9pZCAq)
@@ -408,13 +412,18 @@ Fabian Würfl (https://github.com/BafDyce)
408 - Liferea profile 412 - Liferea profile
409Felipe Barriga Richards (https://github.com/fbarriga) 413Felipe Barriga Richards (https://github.com/fbarriga)
410 - --private-etc fix 414 - --private-etc fix
415Felix Pehla (https://github.com/FelixPehla)
416 - fix fractal profile
411fenuks (https://github.com/fenuks) 417fenuks (https://github.com/fenuks)
412 - fix sound in games using FMOD 418 - fix sound in games using FMOD
413 - allow /opt/tor-browser for Tor Browser profile 419 - allow /opt/tor-browser for Tor Browser profile
414fkrone (https://github.com/fkrone) 420fkrone (https://github.com/fkrone)
415 - fix Zoom profile 421 - fix Zoom profile
416Fidel Ramos (https://github.com/haplo) 422Fidel Ramos (https://github.com/haplo)
417 - Ledger Live profile 423 - added Ledger Live profile
424 - fixed geeqie profile
425 - added rawtherapee profile
426 - added electron-cache profile
418Florian Begusch (https://github.com/florianbegusch) 427Florian Begusch (https://github.com/florianbegusch)
419 - (la)tex profiles 428 - (la)tex profiles
420 - fixed transmission-common.profile 429 - fixed transmission-common.profile
@@ -567,6 +576,9 @@ Haowei Yu (https://github.com/sfc-gh-hyu)
567Icaro Perseo (https://github.com/icaroperseo) 576Icaro Perseo (https://github.com/icaroperseo)
568 - Icecat profile 577 - Icecat profile
569 - several profile fixes 578 - several profile fixes
579Ilya Pankratov (https://github.com/i-pankrat)
580 - profstats fix
581 - fix various memory resource leaks
570Igor Bukanov (https://github.com/ibukanov) 582Igor Bukanov (https://github.com/ibukanov)
571 - found/fiixed privilege escalation in --hosts-file option 583 - found/fiixed privilege escalation in --hosts-file option
572iiotx (https://github.com/iiotx) 584iiotx (https://github.com/iiotx)
@@ -739,6 +751,8 @@ Liorst4 (https://github.com/Liorst4)
739 - minetest fixes 751 - minetest fixes
740Lockdis (https://github.com/Lockdis) 752Lockdis (https://github.com/Lockdis)
741 - Added crow, nyx, and google-earth-pro profiles 753 - Added crow, nyx, and google-earth-pro profiles
754luca0N (https://github.com/luca0N)
755 - fixed crawl profile
742Lukáš Krejčí (https://github.com/lskrejci) 756Lukáš Krejčí (https://github.com/lskrejci)
743 - fixed parsing of --keep-var-tmp 757 - fixed parsing of --keep-var-tmp
744luzpaz (https://github.com/luzpaz) 758luzpaz (https://github.com/luzpaz)
@@ -794,6 +808,8 @@ Michael Haas (https://github.com/mhaas)
794 - bugfixes 808 - bugfixes
795Michael Hoffmann (https://github.com/brisad) 809Michael Hoffmann (https://github.com/brisad)
796 - added support for subdirs in private-etc 810 - added support for subdirs in private-etc
811Michele Sorcinelli (https://github.com/michelesr)
812 - fix ssh profile
797Mike Frysinger (vapier@gentoo.org) 813Mike Frysinger (vapier@gentoo.org)
798 - Gentoo compile patch 814 - Gentoo compile patch
799minus7 (https://github.com/minus7) 815minus7 (https://github.com/minus7)
@@ -855,6 +871,7 @@ nolanl (https://github.com/nolanl)
855nutta-git (https://github.com/nutta-git) 871nutta-git (https://github.com/nutta-git)
856 - steam.profile: allow process_vm_readv syscall 872 - steam.profile: allow process_vm_readv syscall
857 - lutris.profile: allow more syscalls 873 - lutris.profile: allow more syscalls
874 - steam.profile: update novideo comment for webcam motion trackers
858nyancat18 (https://github.com/nyancat18) 875nyancat18 (https://github.com/nyancat18)
859 - added ardour4, dooble, karbon, krita profiles 876 - added ardour4, dooble, karbon, krita profiles
860nya1 (https://github.com/nya1) 877nya1 (https://github.com/nya1)
@@ -949,6 +966,8 @@ pszxzsd (https://github.com/pszxzsd)
949 -uGet profile 966 -uGet profile
950pwnage-pineapple (https://github.com/pwnage-pineapple) 967pwnage-pineapple (https://github.com/pwnage-pineapple)
951 - update Okular profile 968 - update Okular profile
969qdii (https://github.com/qdii)
970 - added notpm command & keep tpm devices in private-dev
952Quentin Retornaz (https://github.com/qretornaz-adapei42) 971Quentin Retornaz (https://github.com/qretornaz-adapei42)
953 - microsoft-edge profiles fixes 972 - microsoft-edge profiles fixes
954Quentin Minster (https://github.com/laomaiweng) 973Quentin Minster (https://github.com/laomaiweng)
@@ -1003,6 +1022,8 @@ rootalc (https://github.com/rootalc)
1003 - add nolocal6.net filter 1022 - add nolocal6.net filter
1004Ruan (https://github.com/ruany) 1023Ruan (https://github.com/ruany)
1005 - fixed hexchat profile 1024 - fixed hexchat profile
1025RundownRhino (https://github.com/RundownRhino)
1026 - firefox profile fix
1006rusty-snake (https://github.com/rusty-snake) 1027rusty-snake (https://github.com/rusty-snake)
1007 - added profiles: thunderbird-wayland, supertuxkart, ghostwriter 1028 - added profiles: thunderbird-wayland, supertuxkart, ghostwriter
1008 - added profiles: klavaro, mypaint, mypaint-ora-thumbnailer, nano 1029 - added profiles: klavaro, mypaint, mypaint-ora-thumbnailer, nano
@@ -1040,18 +1061,17 @@ Serphentas (https://github.com/Serphentas)
1040 - add Paradox Launcher to Steam profile 1061 - add Paradox Launcher to Steam profile
1041Slava Monich (https://github.com/monich) 1062Slava Monich (https://github.com/monich)
1042 - added configure option to disable man pages 1063 - added configure option to disable man pages
1043Tobias Schmidl (https://github.com/schtobia)
1044 - added profile for webui-aria2
1045Simon Peter (https://github.com/probonopd) 1064Simon Peter (https://github.com/probonopd)
1046 - set $APPIMAGE and $APPDIR environment variables 1065 - set $APPIMAGE and $APPDIR environment variables
1047 - AppImage version detection 1066 - AppImage version detection
1048 - Leafppad type v1 and v2 appimage packages in test/appimage 1067 - Leafppad type v1 and v2 appimage packages in test/appimage
1049 - GitHub/Travis CI integration 1068 - GitHub/Travis CI integration
1069Simo Piiroinen (https://github.com/spiiroin)
1070 - Jolla/SailfishOS patches
1071 - fix startup race condition for /run/firejail directory
1050sinkuu (https://github.com/sinkuu) 1072sinkuu (https://github.com/sinkuu)
1051 - blacklisting kwalletd 1073 - blacklisting kwalletd
1052 - fix symlink invocation for programs placing symlinks in $PATH 1074 - fix symlink invocation for programs placing symlinks in $PATH
1053Simo Piiroinen (https://github.com/spiiroin)
1054 - Jolla/SailfishOS patches
1055slowpeek (https://github.com/slowpeek) 1075slowpeek (https://github.com/slowpeek)
1056 - refine appimage example in docs 1076 - refine appimage example in docs
1057 - allow resolution of .local names with avahi-daemon in the apparmor profile 1077 - allow resolution of .local names with avahi-daemon in the apparmor profile
@@ -1059,6 +1079,9 @@ slowpeek (https://github.com/slowpeek)
1059 - make appimage examples consistent with --appimage option short description 1079 - make appimage examples consistent with --appimage option short description
1060 - blacklist google-drive-ocamlfuse config 1080 - blacklist google-drive-ocamlfuse config
1061 - blacklist sendgmail config 1081 - blacklist sendgmail config
1082Shahriar Heidrich (https://github.com/smheidrich)
1083 - fix manpages
1084 - fix i3 profile and disable-programs.profile
1062smitsohu (https://github.com/smitsohu) 1085smitsohu (https://github.com/smitsohu)
1063 - read-only kde4 services directory 1086 - read-only kde4 services directory
1064 - enhanced mediathekview profile 1087 - enhanced mediathekview profile
@@ -1187,6 +1210,8 @@ Tomasz Jan Góralczyk (https://github.com/tjg)
1187 - fixed Steam profile 1210 - fixed Steam profile
1188Tomi Leppänen (https://github.com/Tomin1) 1211Tomi Leppänen (https://github.com/Tomin1)
1189 - Jolla/SailfishOS patches 1212 - Jolla/SailfishOS patches
1213Tobias Schmidl (https://github.com/schtobia)
1214 - added profile for webui-aria2
1190Topi Miettinen (https://github.com/topimiettinen) 1215Topi Miettinen (https://github.com/topimiettinen)
1191 - improved seccomp printing 1216 - improved seccomp printing
1192 - improve mount handling, fix /run/user handling 1217 - improve mount handling, fix /run/user handling
@@ -1201,6 +1226,8 @@ Ted Robertson (https://github.com/tredondo)
1201 - various documentation fixes 1226 - various documentation fixes
1202 - blacklist Exodus wallet 1227 - blacklist Exodus wallet
1203 - blacklist monero-project directory 1228 - blacklist monero-project directory
1229tools200ms (https://github.com/tools200ms)
1230 - fixed allow-ssh.inc
1204Tus1688 (https://github.com/Tus1688) 1231Tus1688 (https://github.com/Tus1688)
1205 - added neovim profile 1232 - added neovim profile
1206user1024 (user1024@tut.by) 1233user1024 (user1024@tut.by)
diff --git a/RELNOTES b/RELNOTES
index 8598bba46..4e55f9447 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -17,7 +17,9 @@ firejail (0.9.73) baseline; urgency=low
17 * feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200 17 * feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200
18 #6228 #6260 #6302 #6305) 18 #6228 #6260 #6302 #6305)
19 * feature: add support for comm, coredump, and prctl procevents in firemon 19 * feature: add support for comm, coredump, and prctl procevents in firemon
20 (#6414 #6415)
20 * feature: add notpm command & keep tpm devices in private-dev (#6379 #6390) 21 * feature: add notpm command & keep tpm devices in private-dev (#6379 #6390)
22 * feature: fshaper.sh: support tc on NixOS (#6426 #6431)
21 * modif: Stop forwarding own double-dash to the shell (#5599 #5600) 23 * modif: Stop forwarding own double-dash to the shell (#5599 #5600)
22 * modif: Prevent sandbox name (--name=) and host name (--hostname=) 24 * modif: Prevent sandbox name (--name=) and host name (--hostname=)
23 from containing only digits (#5578 #5741) 25 from containing only digits (#5578 #5741)
@@ -32,7 +34,6 @@ firejail (0.9.73) baseline; urgency=low
32 * modif: drop deprecated 'shell' option references (#5894) 34 * modif: drop deprecated 'shell' option references (#5894)
33 * modif: keep pipewire group unless nosound is used (#5992 #5993) 35 * modif: keep pipewire group unless nosound is used (#5992 #5993)
34 * modif: fcopy: Use lstat when copying directory (#5957) 36 * modif: fcopy: Use lstat when copying directory (#5957)
35 * modif: populate /run/firejail while holding flock (#6307)
36 * modif: private-dev: keep /dev/kfd unless no3d is used (#6380) 37 * modif: private-dev: keep /dev/kfd unless no3d is used (#6380)
37 * modif: keep /sys/module/nvidia* if prop driver and no no3d (#6372 #6387) 38 * modif: keep /sys/module/nvidia* if prop driver and no no3d (#6372 #6387)
38 * removal: LTS and FIRETUNNEL support 39 * removal: LTS and FIRETUNNEL support
@@ -43,8 +44,10 @@ firejail (0.9.73) baseline; urgency=low
43 (#5965 #5976) 44 (#5965 #5976)
44 * bugfix: firejail --ls reports wrong file sizes for large files (#5982 45 * bugfix: firejail --ls reports wrong file sizes for large files (#5982
45 #6086) 46 #6086)
47 * bugfix: fix startup race condition for /run/firejail directory (#6307)
46 * bugfix: fix various resource leaks (#6367) 48 * bugfix: fix various resource leaks (#6367)
47 * bugfix: profstats: fix restrict-namespaces max count (#6369) 49 * bugfix: profstats: fix restrict-namespaces max count (#6369)
50 * bugfix: remove --noautopulse from --help and zsh comp (#6401)
48 * build: auto-generate syntax files (#5627) 51 * build: auto-generate syntax files (#5627)
49 * build: mark all phony targets as such (#5637) 52 * build: mark all phony targets as such (#5637)
50 * build: mkdeb.sh: pass all arguments to ./configure (#5654) 53 * build: mkdeb.sh: pass all arguments to ./configure (#5654)
@@ -55,8 +58,7 @@ firejail (0.9.73) baseline; urgency=low
55 * build: disable all built-in implicit make rules (#5864) 58 * build: disable all built-in implicit make rules (#5864)
56 * build: organize and standardize make vars and targets (#5866) 59 * build: organize and standardize make vars and targets (#5866)
57 * build: fix seccomp filters and man pages always being rebuilt when running 60 * build: fix seccomp filters and man pages always being rebuilt when running
58 make 61 make (#5156 #5898)
59 * build: simplify code related to man pages (#5898)
60 * build: fix hardcoded make & remove unnecessary distclean targets (#5911) 62 * build: fix hardcoded make & remove unnecessary distclean targets (#5911)
61 * build: dist and asc improvements (#5916) 63 * build: dist and asc improvements (#5916)
62 * build: fix some shellcheck issues & use config.sh in more scripts (#5927) 64 * build: fix some shellcheck issues & use config.sh in more scripts (#5927)
@@ -80,6 +82,7 @@ firejail (0.9.73) baseline; urgency=low
80 * build: remove clean dependency from cppcheck targets (#6343) 82 * build: remove clean dependency from cppcheck targets (#6343)
81 * build: allow overriding common tools (#6354) 83 * build: allow overriding common tools (#6354)
82 * build: standardize install commands (#6366) 84 * build: standardize install commands (#6366)
85 * build: improve reliability/portability of date command usage (#6403 #6404)
83 * ci: always update the package db before installing packages (#5742) 86 * ci: always update the package db before installing packages (#5742)
84 * ci: fix codeql unable to download its own bundle (#5783) 87 * ci: fix codeql unable to download its own bundle (#5783)
85 * ci: split configure/build/install commands on gitlab (#5784) 88 * ci: split configure/build/install commands on gitlab (#5784)
@@ -109,6 +112,8 @@ firejail (0.9.73) baseline; urgency=low
109 #6359) 112 #6359)
110 * docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382) 113 * docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382)
111 * docs: man: format and sort some private- items (#6398) 114 * docs: man: format and sort some private- items (#6398)
115 * docs: man: improve blacklist/whitelist examples with spaces (#6425)
116 * docs: add build_issue.md issue template (#6423)
112 * legal: selinux.c: Split Copyright notice & use same license as upstream 117 * legal: selinux.c: Split Copyright notice & use same license as upstream
113 (#5667) 118 (#5667)
114 * profiles: qutebrowser: fix links not opening in the existing instance 119 * profiles: qutebrowser: fix links not opening in the existing instance
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc
index 14f7d8cf7..faae99543 100644
--- a/etc/inc/disable-common.inc
+++ b/etc/inc/disable-common.inc
@@ -171,6 +171,10 @@ blacklist ${RUNUSER}/gsconnect
171blacklist ${RUNUSER}/i3/ipc-socket.* 171blacklist ${RUNUSER}/i3/ipc-socket.*
172blacklist /tmp/i3-*/ipc-socket.* 172blacklist /tmp/i3-*/ipc-socket.*
173 173
174# sway IPC socket (allows arbitrary shell script execution)
175blacklist ${RUNUSER}/sway-ipc.*
176blacklist /tmp/sway-ipc.*
177
174# systemd 178# systemd
175blacklist ${HOME}/.config/systemd 179blacklist ${HOME}/.config/systemd
176blacklist ${HOME}/.local/share/systemd 180blacklist ${HOME}/.local/share/systemd
diff --git a/etc/profile-a-l/abrowser.profile b/etc/profile-a-l/abrowser.profile
index 8b70756ba..6217af780 100644
--- a/etc/profile-a-l/abrowser.profile
+++ b/etc/profile-a-l/abrowser.profile
@@ -14,8 +14,7 @@ whitelist ${HOME}/.cache/mozilla/abrowser
14whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
15whitelist /usr/share/abrowser 15whitelist /usr/share/abrowser
16 16
17# private-etc must first be enabled in firefox-common.profile 17private-etc abrowser
18#private-etc abrowser
19 18
20# Redirect 19# Redirect
21include firefox-common.profile 20include firefox-common.profile
diff --git a/etc/profile-a-l/basilisk.profile b/etc/profile-a-l/basilisk.profile
index 7d2fe143c..f5595274e 100644
--- a/etc/profile-a-l/basilisk.profile
+++ b/etc/profile-a-l/basilisk.profile
@@ -19,8 +19,7 @@ seccomp
19ignore seccomp 19ignore seccomp
20 20
21#private-bin basilisk 21#private-bin basilisk
22# private-etc must first be enabled in firefox-common.profile 22private-etc basilisk
23#private-etc basilisk
24#private-opt basilisk 23#private-opt basilisk
25 24
26restrict-namespaces 25restrict-namespaces
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile
index e596ec9d2..7afccf5cd 100644
--- a/etc/profile-a-l/bijiben.profile
+++ b/etc/profile-a-l/bijiben.profile
@@ -59,5 +59,8 @@ dbus-user.talk ca.desrt.dconf
59dbus-user.talk org.freedesktop.Tracker1 59dbus-user.talk org.freedesktop.Tracker1
60dbus-system none 60dbus-system none
61 61
62env WEBKIT_FORCE_SANDBOX=0 62# Warning: Disabling the webkit sandbox may be needed to make firejail work
63# with webkit2gtk, but this is not recommended (see #2995).
64# Add the following line to bijiben.local at your own risk:
65#env WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1
63restrict-namespaces 66restrict-namespaces
diff --git a/etc/profile-a-l/bitwarden-desktop.profile b/etc/profile-a-l/bitwarden-desktop.profile
new file mode 100644
index 000000000..4c1994c50
--- /dev/null
+++ b/etc/profile-a-l/bitwarden-desktop.profile
@@ -0,0 +1,11 @@
1# Firejail profile for bitwarden-desktop
2# Description: A secure and free password manager for all of your devices
3# This file is overwritten after every install/update.
4# Persistent local customisations
5include bitwarden-desktop.local
6# Persistent global definitions
7# added by included profile
8#include globals.local
9
10# Redirect
11include bitwarden.profile
diff --git a/etc/profile-a-l/bitwarden.profile b/etc/profile-a-l/bitwarden.profile
index 1572ca572..9ed48b02d 100644
--- a/etc/profile-a-l/bitwarden.profile
+++ b/etc/profile-a-l/bitwarden.profile
@@ -6,13 +6,13 @@ include bitwarden.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9# Disabled until someone reported positive feedback
10ignore include whitelist-usr-share-common.inc
11
12ignore noexec /tmp 9ignore noexec /tmp
13 10
14noblacklist ${HOME}/.config/Bitwarden 11noblacklist ${HOME}/.config/Bitwarden
15 12
13# Allow /bin/sh (blacklisted by disable-shell.inc)
14include allow-bin-sh.inc
15
16include disable-shell.inc 16include disable-shell.inc
17 17
18mkdir ${HOME}/.config/Bitwarden 18mkdir ${HOME}/.config/Bitwarden
diff --git a/etc/profile-a-l/cachy-browser.profile b/etc/profile-a-l/cachy-browser.profile
index 05e1a69f1..6218dbbe8 100644
--- a/etc/profile-a-l/cachy-browser.profile
+++ b/etc/profile-a-l/cachy-browser.profile
@@ -26,9 +26,7 @@ whitelist /usr/share/cachy-browser
26 26
27# Add the next line to your cachy-browser.local to enable private-bin (Arch Linux). 27# Add the next line to your cachy-browser.local to enable private-bin (Arch Linux).
28#private-bin dbus-launch,dbus-send,cachy-browser,sh 28#private-bin dbus-launch,dbus-send,cachy-browser,sh
29# Add the next line to your cachy-browser.local to enable private-etc. 29private-etc cachy-browser
30# Note: private-etc must first be enabled in firefox-common.local.
31#private-etc cachy-browser
32 30
33dbus-user filter 31dbus-user filter
34dbus-user.own org.mozilla.cachybrowser.* 32dbus-user.own org.mozilla.cachybrowser.*
diff --git a/etc/profile-a-l/cliqz.profile b/etc/profile-a-l/cliqz.profile
index d0bf9797e..bded735a9 100644
--- a/etc/profile-a-l/cliqz.profile
+++ b/etc/profile-a-l/cliqz.profile
@@ -17,8 +17,7 @@ whitelist ${HOME}/.cliqz
17whitelist ${HOME}/.config/cliqz 17whitelist ${HOME}/.config/cliqz
18whitelist /usr/share/cliqz 18whitelist /usr/share/cliqz
19 19
20# private-etc must first be enabled in firefox-common.profile 20private-etc cliqz
21#private-etc cliqz
22 21
23# Redirect 22# Redirect
24include firefox-common.profile 23include firefox-common.profile
diff --git a/etc/profile-a-l/cyberfox.profile b/etc/profile-a-l/cyberfox.profile
index c7a42e0eb..173c5b4a5 100644
--- a/etc/profile-a-l/cyberfox.profile
+++ b/etc/profile-a-l/cyberfox.profile
@@ -16,8 +16,7 @@ whitelist /usr/share/8pecxstudios
16whitelist /usr/share/cyberfox 16whitelist /usr/share/cyberfox
17 17
18#private-bin cyberfox,dbus-launch,dbus-send,env,sh,which 18#private-bin cyberfox,dbus-launch,dbus-send,env,sh,which
19# private-etc must first be enabled in firefox-common.profile 19private-etc cyberfox
20#private-etc cyberfox
21 20
22# Redirect 21# Redirect
23include firefox-common.profile 22include firefox-common.profile
diff --git a/etc/profile-a-l/d-feet.profile b/etc/profile-a-l/d-feet.profile
index 75338eb6d..e11134616 100644
--- a/etc/profile-a-l/d-feet.profile
+++ b/etc/profile-a-l/d-feet.profile
@@ -12,45 +12,16 @@ noblacklist ${HOME}/.config/d-feet
12include allow-python2.inc 12include allow-python2.inc
13include allow-python3.inc 13include allow-python3.inc
14 14
15include disable-common.inc
16include disable-devel.inc
17include disable-exec.inc
18include disable-interpreters.inc
19include disable-programs.inc
20include disable-shell.inc
21include disable-xdg.inc
22
23mkdir ${HOME}/.config/d-feet 15mkdir ${HOME}/.config/d-feet
24whitelist ${HOME}/.config/d-feet 16whitelist ${HOME}/.config/d-feet
25whitelist /usr/share/d-feet 17whitelist /usr/share/d-feet
26include whitelist-common.inc
27include whitelist-runuser-common.inc
28include whitelist-usr-share-common.inc
29include whitelist-var-common.inc
30 18
31apparmor 19# breaks on Ubuntu
32caps.drop all 20ignore net none
33ipc-namespace
34#net none # breaks on Ubuntu
35no3d
36nodvd
37nogroups
38noinput
39nonewprivs
40noroot
41nosound
42notv
43nou2f
44novideo
45protocol unix
46seccomp
47 21
48disable-mnt
49private-bin d-feet,python* 22private-bin d-feet,python*
50private-cache
51private-dev
52private-etc dbus-1
53private-tmp
54 23
55#memory-deny-write-execute # breaks on Arch (see issue #1803) 24#memory-deny-write-execute # breaks on Arch (see issue #1803)
56restrict-namespaces 25
26# Redirect
27include dbus-debug-common.profile
diff --git a/etc/profile-a-l/d-spy.profile b/etc/profile-a-l/d-spy.profile
index 9ff429ecb..2c9ef52cb 100644
--- a/etc/profile-a-l/d-spy.profile
+++ b/etc/profile-a-l/d-spy.profile
@@ -6,43 +6,7 @@ include d-spy.local
6# Persistent global definitions 6# Persistent global definitions
7include globals.local 7include globals.local
8 8
9include disable-common.inc
10include disable-devel.inc
11include disable-exec.inc
12include disable-interpreters.inc
13include disable-proc.inc
14include disable-programs.inc
15include disable-shell.inc
16include disable-xdg.inc
17
18include whitelist-common.inc
19include whitelist-runuser-common.inc
20include whitelist-usr-share-common.inc
21include whitelist-var-common.inc
22
23apparmor
24caps.drop all
25ipc-namespace
26net none
27no3d
28nodvd
29nogroups
30noinput
31nonewprivs
32noroot
33nosound
34notv
35nou2f
36novideo
37protocol unix
38seccomp
39
40disable-mnt
41private-bin d-spy 9private-bin d-spy
42private-cache
43private-dev
44private-etc dbus-1
45private-tmp
46 10
47read-only ${HOME} 11# Redirect
48restrict-namespaces 12include dbus-debug-common.profile
diff --git a/etc/profile-a-l/dbus-debug-common.profile b/etc/profile-a-l/dbus-debug-common.profile
new file mode 100644
index 000000000..0ef060f3a
--- /dev/null
+++ b/etc/profile-a-l/dbus-debug-common.profile
@@ -0,0 +1,49 @@
1# Firejail profile for dbus-debug-common
2# This file is overwritten after every install/update
3# Persistent local customizations
4include dbus-debug-common.local
5# Persistent global definitions
6# added by caller profile
7#include globals.local
8
9include disable-common.inc
10include disable-devel.inc
11include disable-exec.inc
12include disable-interpreters.inc
13include disable-proc.inc
14include disable-programs.inc
15include disable-shell.inc
16include disable-xdg.inc
17
18include whitelist-common.inc
19include whitelist-runuser-common.inc
20include whitelist-usr-share-common.inc
21include whitelist-var-common.inc
22
23apparmor
24caps.drop all
25ipc-namespace
26net none
27no3d
28nodvd
29nogroups
30noinput
31nonewprivs
32noroot
33nosound
34notv
35nou2f
36novideo
37protocol unix
38seccomp
39seccomp.block-secondary
40tracelog
41
42disable-mnt
43private-cache
44private-dev
45private-etc dbus-1
46private-tmp
47
48read-only ${HOME}
49restrict-namespaces
diff --git a/etc/profile-a-l/dtui.profile b/etc/profile-a-l/dtui.profile
new file mode 100644
index 000000000..b85ae451b
--- /dev/null
+++ b/etc/profile-a-l/dtui.profile
@@ -0,0 +1,15 @@
1# Firejail profile for dtui
2# Description: TUI D-Bus debugger
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include dtui.local
7# Persistent global definitions
8include globals.local
9
10private-bin dtui
11
12memory-deny-write-execute
13
14# Redirect
15include dbus-debug-common.profile
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile
index 1af2884b6..52a439c48 100644
--- a/etc/profile-a-l/element-desktop.profile
+++ b/etc/profile-a-l/element-desktop.profile
@@ -14,6 +14,7 @@ noblacklist ${HOME}/.config/Element
14mkdir ${HOME}/.config/Element 14mkdir ${HOME}/.config/Element
15whitelist ${HOME}/.config/Element 15whitelist ${HOME}/.config/Element
16whitelist /opt/Element 16whitelist /opt/Element
17whitelist /usr/share/element
17 18
18dbus-user filter 19dbus-user filter
19dbus-user.talk org.freedesktop.Notifications 20dbus-user.talk org.freedesktop.Notifications
diff --git a/etc/profile-a-l/firefox-common-addons.profile b/etc/profile-a-l/firefox-common-addons.profile
index ccc2dc7f6..5e3d0983d 100644
--- a/etc/profile-a-l/firefox-common-addons.profile
+++ b/etc/profile-a-l/firefox-common-addons.profile
@@ -92,8 +92,7 @@ include allow-python3.inc
92#private-bin keepassxc-proxy 92#private-bin keepassxc-proxy
93 93
94# Flash plugin 94# Flash plugin
95# private-etc must first be enabled in firefox-common.profile and in profiles including it. 95private-etc adobe
96#private-etc adobe
97 96
98# ff2mpv 97# ff2mpv
99#ignore noexec ${HOME} 98#ignore noexec ${HOME}
diff --git a/etc/profile-a-l/icecat.profile b/etc/profile-a-l/icecat.profile
index b0a42fb77..19bda5454 100644
--- a/etc/profile-a-l/icecat.profile
+++ b/etc/profile-a-l/icecat.profile
@@ -14,8 +14,7 @@ whitelist ${HOME}/.cache/mozilla/icecat
14whitelist ${HOME}/.mozilla 14whitelist ${HOME}/.mozilla
15whitelist /usr/share/icecat 15whitelist /usr/share/icecat
16 16
17# private-etc must first be enabled in firefox-common.profile 17private-etc icecat
18#private-etc icecat
19 18
20# Redirect 19# Redirect
21include firefox-common.profile 20include firefox-common.profile
diff --git a/etc/profile-a-l/iceweasel.profile b/etc/profile-a-l/iceweasel.profile
index badd2648a..d6a925a77 100644
--- a/etc/profile-a-l/iceweasel.profile
+++ b/etc/profile-a-l/iceweasel.profile
@@ -6,8 +6,7 @@ include iceweasel.local
6# added by included profile 6# added by included profile
7#include globals.local 7#include globals.local
8 8
9# private-etc must first be enabled in firefox-common.profile 9private-etc iceweasel
10#private-etc iceweasel
11 10
12# Redirect 11# Redirect
13include firefox.profile 12include firefox.profile
diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile
index 65a4a3787..8db82d364 100644
--- a/etc/profile-a-l/librewolf.profile
+++ b/etc/profile-a-l/librewolf.profile
@@ -27,9 +27,7 @@ whitelist /usr/share/librewolf
27 27
28# Add the next line to your librewolf.local to enable private-bin (Arch Linux). 28# Add the next line to your librewolf.local to enable private-bin (Arch Linux).
29#private-bin dbus-launch,dbus-send,librewolf,sh 29#private-bin dbus-launch,dbus-send,librewolf,sh
30# Add the next line to your librewolf.local to enable private-etc. 30private-etc librewolf
31# Note: private-etc must first be enabled in firefox-common.local.
32#private-etc librewolf
33 31
34dbus-user filter 32dbus-user filter
35dbus-user.own io.gitlab.librewolf.* 33dbus-user.own io.gitlab.librewolf.*
diff --git a/etc/profile-m-z/okular.profile b/etc/profile-m-z/okular.profile
index 9f4990246..645510124 100644
--- a/etc/profile-m-z/okular.profile
+++ b/etc/profile-m-z/okular.profile
@@ -58,7 +58,7 @@ protocol unix
58seccomp 58seccomp
59tracelog 59tracelog
60 60
61private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar 61private-bin kbuildsycoca4,kdeinit4,lpr,okular,ps2pdf,unar,unrar
62private-dev 62private-dev
63private-etc @x11,cups 63private-etc @x11,cups
64# on KDE we need access to the real /tmp for data exchange with email clients 64# on KDE we need access to the real /tmp for data exchange with email clients
diff --git a/etc/profile-m-z/palemoon.profile b/etc/profile-m-z/palemoon.profile
index 8917a9bc5..8e1a5daf5 100644
--- a/etc/profile-m-z/palemoon.profile
+++ b/etc/profile-m-z/palemoon.profile
@@ -21,8 +21,7 @@ seccomp
21ignore seccomp 21ignore seccomp
22 22
23#private-bin palemoon 23#private-bin palemoon
24# private-etc must first be enabled in firefox-common.profile 24private-etc palemoon
25#private-etc palemoon
26 25
27restrict-namespaces 26restrict-namespaces
28ignore restrict-namespaces 27ignore restrict-namespaces
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile
index 62efa28db..1c4d85ea0 100644
--- a/etc/profile-m-z/ssh.profile
+++ b/etc/profile-m-z/ssh.profile
@@ -19,7 +19,8 @@ include disable-exec.inc
19include disable-programs.inc 19include disable-programs.inc
20 20
21whitelist ${RUNUSER}/gcr/ssh 21whitelist ${RUNUSER}/gcr/ssh
22whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh 22whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh # default gpg homedir setup
23whitelist ${RUNUSER}/gnupg/*/S.gpg-agent.ssh # custom gpg homedir setup
23whitelist ${RUNUSER}/keyring/ssh 24whitelist ${RUNUSER}/keyring/ssh
24include whitelist-usr-share-common.inc 25include whitelist-usr-share-common.inc
25include whitelist-runuser-common.inc 26include whitelist-runuser-common.inc
diff --git a/etc/profile-m-z/sway.profile b/etc/profile-m-z/sway.profile
index f71905150..b7f90f6ad 100644
--- a/etc/profile-m-z/sway.profile
+++ b/etc/profile-m-z/sway.profile
@@ -10,6 +10,10 @@ include globals.local
10noblacklist ${HOME}/.config/sway 10noblacklist ${HOME}/.config/sway
11# sway uses ~/.config/i3 as fallback if there is no ~/.config/sway 11# sway uses ~/.config/i3 as fallback if there is no ~/.config/sway
12noblacklist ${HOME}/.config/i3 12noblacklist ${HOME}/.config/i3
13# allow creation of IPC socket
14noblacklist ${RUNUSER}/sway-ipc.*
15noblacklist /tmp/sway-ipc.*
16
13include disable-common.inc 17include disable-common.inc
14 18
15caps.drop all 19caps.drop all
diff --git a/etc/profile-m-z/waterfox.profile b/etc/profile-m-z/waterfox.profile
index bf6f45e41..cf2fced64 100644
--- a/etc/profile-m-z/waterfox.profile
+++ b/etc/profile-m-z/waterfox.profile
@@ -21,9 +21,7 @@ whitelist /usr/share/waterfox
21# waterfox requires a shell to launch on Arch. We can possibly remove sh though. 21# waterfox requires a shell to launch on Arch. We can possibly remove sh though.
22# Add the next line to your waterfox.local to enable private-bin. 22# Add the next line to your waterfox.local to enable private-bin.
23#private-bin bash,dbus-launch,dbus-send,env,sh,waterfox,waterfox-classic,waterfox-current,which 23#private-bin bash,dbus-launch,dbus-send,env,sh,waterfox,waterfox-classic,waterfox-current,which
24# Add the next line to your waterfox.local to enable private-etc. Note that private-etc must first be 24private-etc waterfox
25# enabled in your firefox-common.local.
26#private-etc waterfox
27 25
28# Redirect 26# Redirect
29include firefox-common.profile 27include firefox-common.profile
diff --git a/etc/profile-m-z/zoom.profile b/etc/profile-m-z/zoom.profile
index 306212f85..430934df2 100644
--- a/etc/profile-m-z/zoom.profile
+++ b/etc/profile-m-z/zoom.profile
@@ -19,6 +19,7 @@ ignore dbus-system none
19noblacklist ${HOME}/.config/zoom.conf 19noblacklist ${HOME}/.config/zoom.conf
20noblacklist ${HOME}/.config/zoomus.conf 20noblacklist ${HOME}/.config/zoomus.conf
21noblacklist ${HOME}/.zoom 21noblacklist ${HOME}/.zoom
22noblacklist ${DOCUMENTS}
22 23
23nowhitelist ${DOWNLOADS} 24nowhitelist ${DOWNLOADS}
24 25
@@ -26,10 +27,12 @@ mkdir ${HOME}/.cache/zoom
26mkfile ${HOME}/.config/zoom.conf 27mkfile ${HOME}/.config/zoom.conf
27mkfile ${HOME}/.config/zoomus.conf 28mkfile ${HOME}/.config/zoomus.conf
28mkdir ${HOME}/.zoom 29mkdir ${HOME}/.zoom
30mkdir ${HOME}/Documents/Zoom
29whitelist ${HOME}/.cache/zoom 31whitelist ${HOME}/.cache/zoom
30whitelist ${HOME}/.config/zoom.conf 32whitelist ${HOME}/.config/zoom.conf
31whitelist ${HOME}/.config/zoomus.conf 33whitelist ${HOME}/.config/zoomus.conf
32whitelist ${HOME}/.zoom 34whitelist ${HOME}/.zoom
35whitelist ${HOME}/Documents/Zoom
33 36
34# Disable for now, see https://github.com/netblue30/firejail/issues/3726 37# Disable for now, see https://github.com/netblue30/firejail/issues/3726
35#private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl 38#private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 8d0a30521..08170bee6 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -97,10 +97,11 @@ basilisk
97bcompare 97bcompare
98beaker 98beaker
99bibletime 99bibletime
100bijiben 100#bijiben # webkit2gtk-4.x requires bwrap (see #3647)
101bitcoin-qt 101bitcoin-qt
102bitlbee 102bitlbee
103bitwarden 103bitwarden
104bitwarden-desktop
104bleachbit 105bleachbit
105blender 106blender
106blender-2.8 107blender-2.8
@@ -227,6 +228,7 @@ dragon
227drawio 228drawio
228drill 229drill
229dropbox 230dropbox
231dtui
230easystroke 232easystroke
231ebook-convert 233ebook-convert
232ebook-edit 234ebook-edit
@@ -824,7 +826,7 @@ soffice
824sol 826sol
825sound-juicer 827sound-juicer
826soundconverter 828soundconverter
827spectacle 829#spectacle # may be broken on wayland (see #5127)
828spectral 830spectral
829spotify 831spotify
830sqlitebrowser 832sqlitebrowser
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c
index 430730374..1a6f23919 100644
--- a/src/firemon/procevent.c
+++ b/src/firemon/procevent.c
@@ -396,6 +396,8 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my
396 sprintf(lineptr, " sid "); 396 sprintf(lineptr, " sid ");
397 break; 397 break;
398 398
399// Note: PROC_EVENT_COREDUMP only exists since Linux 3.10 (see #6414).
400#ifdef PROC_EVENT_COREDUMP
399 case PROC_EVENT_COREDUMP: 401 case PROC_EVENT_COREDUMP:
400 pid = proc_ev->event_data.coredump.process_tgid; 402 pid = proc_ev->event_data.coredump.process_tgid;
401#ifdef DEBUG_PRCTL 403#ifdef DEBUG_PRCTL
@@ -403,6 +405,7 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my
403#endif 405#endif
404 sprintf(lineptr, " coredump "); 406 sprintf(lineptr, " coredump ");
405 break; 407 break;
408#endif /* PROC_EVENT_COREDUMP */
406 409
407 case PROC_EVENT_COMM: 410 case PROC_EVENT_COMM:
408 pid = proc_ev->event_data.comm.process_tgid; 411 pid = proc_ev->event_data.comm.process_tgid;
diff --git a/src/fshaper/fshaper.sh b/src/fshaper/fshaper.sh
index cd2bf79bf..16a2485bf 100755
--- a/src/fshaper/fshaper.sh
+++ b/src/fshaper/fshaper.sh
@@ -3,13 +3,9 @@
3# Copyright (C) 2014-2024 Firejail Authors 3# Copyright (C) 2014-2024 Firejail Authors
4# License GPL v2 4# License GPL v2
5 5
6TCFILE="" 6TCFILE="$(PATH=/usr/sbin:/sbin:/run/current-system/sw/bin command -v tc)"
7if [ -x "/usr/sbin/tc" ]; then 7if [ -z "$TCFILE" ]; then
8 TCFILE="/usr/sbin/tc" 8 echo "Error: traffic control utility (tc) not found"
9elif [ -x "/sbin/tc" ]; then
10 TCFILE="/sbin/tc";
11else
12 echo "Error: traffic control utility (tc) not found";
13 exit 1 9 exit 1
14fi 10fi
15 11
diff --git a/src/man/firecfg.1.in b/src/man/firecfg.1.in
index a50ed765e..e47014702 100644
--- a/src/man/firecfg.1.in
+++ b/src/man/firecfg.1.in
@@ -139,29 +139,6 @@ $ sudo firecfg --clean
139/usr/local/bin/vlc removed 139/usr/local/bin/vlc removed
140.br 140.br
141[...] 141[...]
142.SH FILES
143.PP
144Configuration files are searched for and parsed in the following paths:
145.PP
146.RS
1471. /etc/firejail/firecfg.d/*.conf (in alphabetical order)
148.br
1492. /etc/firejail/firecfg.config
150.RE
151.PP
152The programs that are supported by default are listed in
153/etc/firejail/firecfg.config.
154It is recommended to leave it as is and put all customizations inside
155/etc/firejail/firecfg.d/.
156.PP
157Profile files are also searched in the user configuration directory:
158.PP
159.RS
1603. ~/.config/firejail/*.profile
161.RE
162.PP
163For every \fBPROGRAM.profile\fR file found, firecfg attempts to create a
164symlink for "PROGRAM", as if "PROGRAM" was listed in a configuration file.
165.SH SYNTAX 142.SH SYNTAX
166Configuration file syntax: 143Configuration file syntax:
167.PP 144.PP
@@ -200,6 +177,29 @@ following lines can to be used to ignore both:
200.br 177.br
201!spectacle 178!spectacle
202.RE 179.RE
180.SH FILES
181.PP
182Configuration files are searched for and parsed in the following paths:
183.PP
184.RS
1851. /etc/firejail/firecfg.d/*.conf (in alphabetical order)
186.br
1872. /etc/firejail/firecfg.config
188.RE
189.PP
190The programs that are supported by default are listed in
191/etc/firejail/firecfg.config.
192It is recommended to leave it as is and put all customizations inside
193/etc/firejail/firecfg.d/.
194.PP
195Profile files are also searched in the user configuration directory:
196.PP
197.RS
1983. ~/.config/firejail/*.profile
199.RE
200.PP
201For every \fBPROGRAM.profile\fR file found, firecfg attempts to create a
202symlink for "PROGRAM", as if "PROGRAM" was listed in a configuration file.
203.SH LICENSE 203.SH LICENSE
204This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. 204This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
205.PP 205.PP
diff --git a/src/man/firejail-profile.5.in b/src/man/firejail-profile.5.in
index 89784a984..4d725ed99 100644
--- a/src/man/firejail-profile.5.in
+++ b/src/man/firejail-profile.5.in
@@ -668,20 +668,20 @@ Enable filtered access to the system DBus. Filters can be specified with the dbu
668\fBdbus-system none 668\fBdbus-system none
669Disable access to the system DBus. Once access is disabled, it cannot be relaxed to filtering. 669Disable access to the system DBus. Once access is disabled, it cannot be relaxed to filtering.
670.TP 670.TP
671\fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
672Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
673.TP
674\fBdbus-system.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
675Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
676.TP
671\fBdbus-system.own org.gnome.ghex.* 677\fBdbus-system.own org.gnome.ghex.*
672Allow the application to own the name org.gnome.ghex and all names underneath in on the system DBus. 678Allow the application to own the name org.gnome.ghex and all names underneath in on the system DBus.
673.TP 679.TP
674\fBdbus-system.talk org.freedesktop.Notifications
675Allow the application to talk to the name org.freedesktop.Notifications on the system DBus.
676.TP
677\fBdbus-system.see org.freedesktop.Notifications 680\fBdbus-system.see org.freedesktop.Notifications
678Allow the application to see but not talk to the name org.freedesktop.Notifications on the system DBus. 681Allow the application to see but not talk to the name org.freedesktop.Notifications on the system DBus.
679.TP 682.TP
680\fBdbus-system.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications 683\fBdbus-system.talk org.freedesktop.Notifications
681Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. 684Allow the application to talk to the name org.freedesktop.Notifications on the system DBus.
682.TP
683\fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
684Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus.
685.TP 685.TP
686\fBdbus-user filter 686\fBdbus-user filter
687Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. 687Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands.
@@ -689,20 +689,20 @@ Enable filtered access to the session DBus. Filters can be specified with the db
689\fBdbus-user none 689\fBdbus-user none
690Disable access to the session DBus. Once access is disabled, it cannot be relaxed to filtering. 690Disable access to the session DBus. Once access is disabled, it cannot be relaxed to filtering.
691.TP 691.TP
692\fBdbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
693Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus.
694.TP
695\fBdbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
696Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus.
697.TP
692\fBdbus-user.own org.gnome.ghex.* 698\fBdbus-user.own org.gnome.ghex.*
693Allow the application to own the name org.gnome.ghex and all names underneath in on the session DBus. 699Allow the application to own the name org.gnome.ghex and all names underneath in on the session DBus.
694.TP 700.TP
695\fBdbus-user.talk org.freedesktop.Notifications
696Allow the application to talk to the name org.freedesktop.Notifications on the session DBus.
697.TP
698\fBdbus-user.see org.freedesktop.Notifications 701\fBdbus-user.see org.freedesktop.Notifications
699Allow the application to see but not talk to the name org.freedesktop.Notifications on the session DBus. 702Allow the application to see but not talk to the name org.freedesktop.Notifications on the session DBus.
700.TP 703.TP
701\fBdbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications 704\fBdbus-user.talk org.freedesktop.Notifications
702Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus. 705Allow the application to talk to the name org.freedesktop.Notifications on the session DBus.
703.TP
704\fBdbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications
705Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus.
706.TP 706.TP
707\fBnodbus \fR(deprecated) 707\fBnodbus \fR(deprecated)
708Disable D-Bus access (both system and session buses). Equivalent to dbus-system none and dbus-user none. 708Disable D-Bus access (both system and session buses). Equivalent to dbus-system none and dbus-user none.
@@ -867,20 +867,6 @@ net eth0
867ip 10.10.20.56 867ip 10.10.20.56
868 868
869.TP 869.TP
870\fBip none
871No IP address and no default gateway are configured for the last interface
872defined by a net command. Use this option
873in case you intend to start an external DHCP client in the sandbox.
874.br
875
876.br
877Example:
878.br
879net eth0
880.br
881ip none
882
883.TP
884\fBip dhcp 870\fBip dhcp
885Acquire an IP address and default gateway for the last interface defined by a 871Acquire an IP address and default gateway for the last interface defined by a
886net command, as well as set the DNS servers according to the DHCP response. 872net command, as well as set the DNS servers according to the DHCP response.
@@ -908,6 +894,20 @@ a DHCP client and releasing the lease manually in conjunction with the
908net none command. 894net none command.
909 895
910.TP 896.TP
897\fBip none
898No IP address and no default gateway are configured for the last interface
899defined by a net command. Use this option
900in case you intend to start an external DHCP client in the sandbox.
901.br
902
903.br
904Example:
905.br
906net eth0
907.br
908ip none
909
910.TP
911\fBip6 address 911\fBip6 address
912Assign IPv6 addresses to the last network interface defined by a net command. 912Assign IPv6 addresses to the last network interface defined by a net command.
913.br 913.br
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in
index f14eb6ec0..bf447be93 100644
--- a/src/man/firejail.1.in
+++ b/src/man/firejail.1.in
@@ -207,7 +207,7 @@ $ firejail \-\-blacklist=/sbin \-\-blacklist=/usr/sbin
207.br 207.br
208$ firejail \-\-blacklist=~/.mozilla 208$ firejail \-\-blacklist=~/.mozilla
209.br 209.br
210$ firejail "\-\-blacklist=/home/username/My Virtual Machines" 210$ firejail \-\-blacklist="/home/username/My Virtual Machines"
211.br 211.br
212$ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines 212$ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines
213.TP 213.TP
@@ -611,8 +611,9 @@ Example:
611$ firejail --dbus-user=filter --dbus-user.own=org.gnome.ghex.* 611$ firejail --dbus-user=filter --dbus-user.own=org.gnome.ghex.*
612 612
613.TP 613.TP
614\fB\-\-dbus-user.talk=name 614\fB\-\-dbus-user.see=name
615Allows the application to talk to the specified well-known name on the session DBus. 615Allows the application to see, but not talk to the specified well-known name on
616the session DBus.
616The name may have a .* suffix to match all names underneath it, including itself 617The name may have a .* suffix to match all names underneath it, including itself
617(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but 618(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
618not "foobar"). 619not "foobar").
@@ -621,14 +622,13 @@ not "foobar").
621.br 622.br
622Example: 623Example:
623.br 624.br
624$ firejail --dbus-user=filter --dbus-user.talk=\\ 625$ firejail --dbus-user=filter --dbus-user.see=\\
625.br 626.br
626org.freedesktop.Notifications 627org.freedesktop.Notifications
627 628
628.TP 629.TP
629\fB\-\-dbus-user.see=name 630\fB\-\-dbus-user.talk=name
630Allows the application to see, but not talk to the specified well-known name on 631Allows the application to talk to the specified well-known name on the session DBus.
631the session DBus.
632The name may have a .* suffix to match all names underneath it, including itself 632The name may have a .* suffix to match all names underneath it, including itself
633(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but 633(e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but
634not "foobar"). 634not "foobar").
@@ -637,7 +637,7 @@ not "foobar").
637.br 637.br
638Example: 638Example:
639.br 639.br
640$ firejail --dbus-user=filter --dbus-user.see=\\ 640$ firejail --dbus-user=filter --dbus-user.talk=\\
641.br 641.br
642org.freedesktop.Notifications 642org.freedesktop.Notifications
643#endif 643#endif
@@ -888,6 +888,32 @@ Example:
888.br 888.br
889$ firejail \-\-hosts-file=~/myhosts firefox 889$ firejail \-\-hosts-file=~/myhosts firefox
890 890
891.TP
892\fB\-\-icmptrace[=name|pid]
893Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
894created with \-\-net are supported. This option is only available when running the sandbox as root.
895.br
896
897.br
898Without a name/pid, Firejail will monitor the main system network namespace.
899.br
900
901.br
902Example
903.br
904$ sudo firejail --icmptrace
905.br
90620:53:54 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
907.br
90820:53:54 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
909.br
91020:53:55 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
911.br
91220:53:55 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
913.br
91420:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable
915.br
916
891#ifdef HAVE_IDS 917#ifdef HAVE_IDS
892.TP 918.TP
893\fB\-\-ids-check 919\fB\-\-ids-check
@@ -925,32 +951,6 @@ $ firejail \-\-ignore="net eth0" firefox
925#endif 951#endif
926 952
927.TP 953.TP
928\fB\-\-icmptrace[=name|pid]
929Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
930created with \-\-net are supported. This option is only available when running the sandbox as root.
931.br
932
933.br
934Without a name/pid, Firejail will monitor the main system network namespace.
935.br
936
937.br
938Example
939.br
940$ sudo firejail --icmptrace
941.br
94220:53:54 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
943.br
94420:53:54 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
945.br
94620:53:55 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0
947.br
94820:53:55 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0
949.br
95020:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable
951.br
952
953.TP
954\fB\-\-\include=file.profile 954\fB\-\-\include=file.profile
955Include a profile file before the regular profiles are used. 955Include a profile file before the regular profiles are used.
956.br 956.br
@@ -984,23 +984,6 @@ Example:
984$ firejail \-\-net=eth0 \-\-ip=10.10.20.56 firefox 984$ firejail \-\-net=eth0 \-\-ip=10.10.20.56 firefox
985 985
986.TP 986.TP
987\fB\-\-ip=none
988No IP address and no default gateway are configured for the last interface
989defined by a \-\-net option. Use this option
990in case you intend to start an external DHCP client in the sandbox.
991.br
992
993.br
994Example:
995.br
996$ firejail \-\-net=eth0 \-\-\ip=none
997.br
998
999.br
1000If the corresponding interface doesn't have an IP address configured, this
1001option is enabled by default.
1002
1003.TP
1004\fB\-\-ip=dhcp 987\fB\-\-ip=dhcp
1005Acquire an IP address and default gateway for the last interface defined by a 988Acquire an IP address and default gateway for the last interface defined by a
1006\-\-net option, as well as set the DNS servers according to the DHCP response. 989\-\-net option, as well as set the DNS servers according to the DHCP response.
@@ -1026,6 +1009,23 @@ a DHCP client and releasing the lease manually in conjunction with the
1026\-\-net=none option. 1009\-\-net=none option.
1027 1010
1028.TP 1011.TP
1012\fB\-\-ip=none
1013No IP address and no default gateway are configured for the last interface
1014defined by a \-\-net option. Use this option
1015in case you intend to start an external DHCP client in the sandbox.
1016.br
1017
1018.br
1019Example:
1020.br
1021$ firejail \-\-net=eth0 \-\-\ip=none
1022.br
1023
1024.br
1025If the corresponding interface doesn't have an IP address configured, this
1026option is enabled by default.
1027
1028.TP
1029\fB\-\-ip6=address 1029\fB\-\-ip6=address
1030Assign IPv6 addresses to the last network interface defined by a \-\-net option. 1030Assign IPv6 addresses to the last network interface defined by a \-\-net option.
1031.br 1031.br
@@ -1324,6 +1324,21 @@ Example:
1324$ firejail \-\-machine-id 1324$ firejail \-\-machine-id
1325 1325
1326.TP 1326.TP
1327\fB\-\-memory-deny-write-execute
1328Install a seccomp filter to block attempts to create memory mappings
1329that are both writable and executable, to change mappings to be
1330executable, or to create executable shared memory. The filter examines
1331the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create
1332and shmat system calls and returns error EPERM to the process (or
1333kills it or log the attempt, see \-\-seccomp-error-action below) if necessary.
1334.br
1335
1336.br
1337Note: shmat is not implemented
1338as a system call on some platforms including i386, and it cannot be
1339handled by seccomp-bpf.
1340
1341.TP
1327\fB\-\-mkdir=dirname 1342\fB\-\-mkdir=dirname
1328Create a directory in user home. Parent directories are created as needed. 1343Create a directory in user home. Parent directories are created as needed.
1329.br 1344.br
@@ -1343,20 +1358,6 @@ Example:
1343.br 1358.br
1344$ firejail --mkfile=~/work/project/readme 1359$ firejail --mkfile=~/work/project/readme
1345 1360
1346.TP
1347\fB\-\-memory-deny-write-execute
1348Install a seccomp filter to block attempts to create memory mappings
1349that are both writable and executable, to change mappings to be
1350executable, or to create executable shared memory. The filter examines
1351the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create
1352and shmat system calls and returns error EPERM to the process (or
1353kills it or log the attempt, see \-\-seccomp-error-action below) if necessary.
1354.br
1355
1356.br
1357Note: shmat is not implemented
1358as a system call on some platforms including i386, and it cannot be
1359handled by seccomp-bpf.
1360#ifdef HAVE_NETWORK 1361#ifdef HAVE_NETWORK
1361.TP 1362.TP
1362\fB\-\-mtu=number 1363\fB\-\-mtu=number
@@ -1792,15 +1793,6 @@ Example:
1792.br 1793.br
1793$ firejail \-\-nodvd 1794$ firejail \-\-nodvd
1794.TP 1795.TP
1795\fB\-\-noinput
1796Disable input devices.
1797.br
1798
1799.br
1800Example:
1801.br
1802$ firejail \-\-noinput
1803.TP
1804\fB\-\-noexec=dirname_or_filename 1796\fB\-\-noexec=dirname_or_filename
1805Remount directory or file noexec, nodev and nosuid. File globbing is supported, see \fBFILE GLOBBING\fR section for more details. 1797Remount directory or file noexec, nodev and nosuid. File globbing is supported, see \fBFILE GLOBBING\fR section for more details.
1806.br 1798.br
@@ -1845,6 +1837,16 @@ uid=1000(netblue) gid=1000(netblue) groups=1000(netblue)
1845$ 1837$
1846 1838
1847.TP 1839.TP
1840\fB\-\-noinput
1841Disable input devices.
1842.br
1843
1844.br
1845Example:
1846.br
1847$ firejail \-\-noinput
1848
1849.TP
1848\fB\-\-nonewprivs 1850\fB\-\-nonewprivs
1849Sets the NO_NEW_PRIVS prctl. This ensures that child processes 1851Sets the NO_NEW_PRIVS prctl. This ensures that child processes
1850cannot acquire new privileges using execve(2); in particular, 1852cannot acquire new privileges using execve(2); in particular,
@@ -3143,7 +3145,9 @@ $ firejail \-\-noprofile \-\-whitelist=~/.mozilla
3143.br 3145.br
3144$ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null 3146$ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null
3145.br 3147.br
3146$ firejail "\-\-whitelist=/home/username/My Virtual Machines" 3148$ firejail \-\-whitelist="/home/username/My Virtual Machines"
3149.br
3150$ firejail \-\-whitelist=/home/username/My\\ Virtual\\ Machines
3147.br 3151.br
3148$ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups* 3152$ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups*
3149 3153
@@ -3351,16 +3355,6 @@ $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox
3351.br 3355.br
3352#endif 3356#endif
3353.\" Note: Keep this in sync with invalid_name() in src/firejail/util.c. 3357.\" Note: Keep this in sync with invalid_name() in src/firejail/util.c.
3354.SH NAME VALIDATION
3355For simplicity, the same name validation is used for multiple options.
3356Rules:
3357.PP
3358The name must be 1-253 characters long.
3359The name can only contain ASCII letters, digits and the special characters
3360"-._" (that is, the name cannot contain spaces or control characters).
3361The name cannot contain only digits.
3362The first and last characters must be an ASCII letter or digit and the name
3363may contain special characters in the middle.
3364#ifdef HAVE_APPARMOR 3358#ifdef HAVE_APPARMOR
3365.SH APPARMOR 3359.SH APPARMOR
3366.TP 3360.TP
@@ -3406,64 +3400,6 @@ To enable AppArmor confinement on top of your current Firejail security features
3406$ firejail --apparmor firefox 3400$ firejail --apparmor firefox
3407#endif 3401#endif
3408 3402
3409#ifdef HAVE_LANDLOCK
3410.SH LANDLOCK
3411Warning: Landlock support in firejail is considered experimental and unstable.
3412The contents of landlock-common.inc are likely to change and the feature is
3413still being expanded upon in the Linux kernel.
3414Also, note that its functionality overlaps with existing firejail features,
3415such as the \fBblacklist\fR, \fBread-only\fR and \fBread-write\fR commands.
3416Its filesystem access rules can currently only restrict direct access to paths;
3417it is not able to make only select paths appear in the sandbox such as with the
3418\fBwhitelist\fR and \fBprivate-etc\fR commands (see also unveil(2) on OpenBSD).
3419Lastly, note that depending on the Linux kernel version, Landlock may not
3420protect all of the relevant syscalls (see the kernel's Landlock documentation
3421for details).
3422Therefore, it is recommended to treat Landlock as an extra layer of protection,
3423to be used together with other firejail features (rather than as a bulletproof
3424mechanism by itself).
3425.PP
3426Landlock is a Linux security module first introduced in version 5.13 of the
3427Linux kernel.
3428It allows unprivileged processes to restrict their access to the filesystem.
3429Once imposed, these restrictions can never be removed, and all child processes
3430created by a Landlock-restricted processes inherit these restrictions.
3431Firejail supports Landlock as an additional sandboxing feature.
3432It can be used to ensure that a sandboxed application can only access files and
3433directories that it was explicitly allowed to access.
3434Firejail supports populating the ruleset with both a basic set of rules (see
3435landlock-common.inc) and with a custom set of rules.
3436.TP
3437Important notes:
3438.PP
3439.RS
3440- Currently only Landlock ABI version 1 is supported.
3441.PP
3442- If "lsm=" is used in the kernel command line, it should contain "landlock"
3443(such as "lsm=apparmor,landlock"), or else it will be disabled.
3444.PP
3445- A process can install a Landlock ruleset only if it has either
3446\fBCAP_SYS_ADMIN\fR in its effective capability set, or the "No New
3447Privileges" restriction enabled.
3448Because of this, enabling the Landlock feature will also cause Firejail to
3449enable the "No New Privileges" restriction, regardless of the profile or the
3450\fB\-\-nonewprivs\fR command line option.
3451.PP
3452- Access to the /etc directory is automatically allowed.
3453To override this, use the \fB\-\-writable\-etc\fR command line option.
3454You can also use the \fB\-\-private\-etc\fR option to restrict access to the
3455/etc directory.
3456.RE
3457.PP
3458To enable Landlock self-restriction on top of your current Firejail security
3459features, pass \fB\-\-landlock.enforce\fR flag to Firejail command line.
3460Without it, the other Landlock commands have no effect.
3461Example:
3462.PP
3463$ firejail \-\-landlock.enforce \-\-landlock.fs.read=/media mc
3464.PP
3465To disable Landlock self-restriction, use \fB\-\-ignore=landlock.enforce\fR.
3466#endif
3467.SH DESKTOP INTEGRATION 3403.SH DESKTOP INTEGRATION
3468A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. 3404A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox.
3469The symbolic link should be placed in the first $PATH position. On most systems, a good place 3405The symbolic link should be placed in the first $PATH position. On most systems, a good place
@@ -3711,6 +3647,65 @@ Currently while scanning the file system, symbolic links are not followed, and f
3711The program can also be run as root (sudo firejail --ids-init/--ids-check). 3647The program can also be run as root (sudo firejail --ids-init/--ids-check).
3712#endif 3648#endif
3713 3649
3650#ifdef HAVE_LANDLOCK
3651.SH LANDLOCK
3652Warning: Landlock support in firejail is considered experimental and unstable.
3653The contents of landlock-common.inc are likely to change and the feature is
3654still being expanded upon in the Linux kernel.
3655Also, note that its functionality overlaps with existing firejail features,
3656such as the \fBblacklist\fR, \fBread-only\fR and \fBread-write\fR commands.
3657Its filesystem access rules can currently only restrict direct access to paths;
3658it is not able to make only select paths appear in the sandbox such as with the
3659\fBwhitelist\fR and \fBprivate-etc\fR commands (see also unveil(2) on OpenBSD).
3660Lastly, note that depending on the Linux kernel version, Landlock may not
3661protect all of the relevant syscalls (see the kernel's Landlock documentation
3662for details).
3663Therefore, it is recommended to treat Landlock as an extra layer of protection,
3664to be used together with other firejail features (rather than as a bulletproof
3665mechanism by itself).
3666.PP
3667Landlock is a Linux security module first introduced in version 5.13 of the
3668Linux kernel.
3669It allows unprivileged processes to restrict their access to the filesystem.
3670Once imposed, these restrictions can never be removed, and all child processes
3671created by a Landlock-restricted processes inherit these restrictions.
3672Firejail supports Landlock as an additional sandboxing feature.
3673It can be used to ensure that a sandboxed application can only access files and
3674directories that it was explicitly allowed to access.
3675Firejail supports populating the ruleset with both a basic set of rules (see
3676landlock-common.inc) and with a custom set of rules.
3677.TP
3678Important notes:
3679.PP
3680.RS
3681- Currently only Landlock ABI version 1 is supported.
3682.PP
3683- If "lsm=" is used in the kernel command line, it should contain "landlock"
3684(such as "lsm=apparmor,landlock"), or else it will be disabled.
3685.PP
3686- A process can install a Landlock ruleset only if it has either
3687\fBCAP_SYS_ADMIN\fR in its effective capability set, or the "No New
3688Privileges" restriction enabled.
3689Because of this, enabling the Landlock feature will also cause Firejail to
3690enable the "No New Privileges" restriction, regardless of the profile or the
3691\fB\-\-nonewprivs\fR command line option.
3692.PP
3693- Access to the /etc directory is automatically allowed.
3694To override this, use the \fB\-\-writable\-etc\fR command line option.
3695You can also use the \fB\-\-private\-etc\fR option to restrict access to the
3696/etc directory.
3697.RE
3698.PP
3699To enable Landlock self-restriction on top of your current Firejail security
3700features, pass \fB\-\-landlock.enforce\fR flag to Firejail command line.
3701Without it, the other Landlock commands have no effect.
3702Example:
3703.PP
3704$ firejail \-\-landlock.enforce \-\-landlock.fs.read=/media mc
3705.PP
3706To disable Landlock self-restriction, use \fB\-\-ignore=landlock.enforce\fR.
3707#endif
3708
3714.SH MONITORING 3709.SH MONITORING
3715Option \-\-list prints a list of all sandboxes. The format 3710Option \-\-list prints a list of all sandboxes. The format
3716for each process entry is as follows: 3711for each process entry is as follows:
@@ -3768,6 +3763,17 @@ Sandbox running time in hours:minutes:seconds format.
3768USER 3763USER
3769The owner of the sandbox. 3764The owner of the sandbox.
3770 3765
3766.SH NAME VALIDATION
3767For simplicity, the same name validation is used for multiple options.
3768Rules:
3769.PP
3770The name must be 1-253 characters long.
3771The name can only contain ASCII letters, digits and the special characters
3772"-._" (that is, the name cannot contain spaces or control characters).
3773The name cannot contain only digits.
3774The first and last characters must be an ASCII letter or digit and the name
3775may contain special characters in the middle.
3776
3771.SH RESTRICTED SHELL 3777.SH RESTRICTED SHELL
3772To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in 3778To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in
3773/etc/passwd file for each user that needs to be restricted. Alternatively, 3779/etc/passwd file for each user that needs to be restricted. Alternatively,
diff --git a/src/man/mkman.sh b/src/man/mkman.sh
index 00c4ffe72..d854b6537 100755
--- a/src/man/mkman.sh
+++ b/src/man/mkman.sh
@@ -5,8 +5,15 @@
5 5
6set -e 6set -e
7 7
8MONTH="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%b)" 8test -z "$SOURCE_DATE_EPOCH" && SOURCE_DATE_EPOCH="$(date +%s)"
9YEAR="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y)" 9
10format='+%b %Y'
11date="$(LC_ALL=C date -u -d "@$SOURCE_DATE_EPOCH" "$format" 2>/dev/null ||
12 LC_ALL=C date -u -r "$SOURCE_DATE_EPOCH" "$format" 2>/dev/null ||
13 LC_ALL=C date -u "$format")"
14
15MONTH="$(printf '%s\n' "$date" | cut -f 1 -d ' ')"
16YEAR="$(printf '%s\n' "$date" | cut -f 2 -d ' ')"
10 17
11sed \ 18sed \
12 -e "s/VERSION/$1/g" \ 19 -e "s/VERSION/$1/g" \
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-12 15:53:38 +0000