diff options
41 files changed, 467 insertions, 337 deletions
diff --git a/.github/ISSUE_TEMPLATE/build_issue.md b/.github/ISSUE_TEMPLATE/build_issue.md new file mode 100644 index 000000000..7e0b822bb --- /dev/null +++ b/.github/ISSUE_TEMPLATE/build_issue.md | |||
@@ -0,0 +1,72 @@ | |||
1 | --- | ||
2 | name: Build issue | ||
3 | about: There is an issue when trying to build the project from source | ||
4 | title: 'build: ' | ||
5 | labels: '' | ||
6 | assignees: '' | ||
7 | |||
8 | --- | ||
9 | |||
10 | <!-- | ||
11 | See the following links for help with formatting: | ||
12 | |||
13 | https://guides.github.com/features/mastering-markdown/ | ||
14 | https://docs.github.com/en/github/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax | ||
15 | --> | ||
16 | |||
17 | ### Description | ||
18 | |||
19 | _Describe the bug_ | ||
20 | |||
21 | ### Steps to Reproduce | ||
22 | |||
23 | <!-- | ||
24 | Note: If the output is too long to embed it into the comment, you can post it | ||
25 | in a gist at <https://gist.github.com/> and link it here or upload the build | ||
26 | log as a file. | ||
27 | |||
28 | Note: Make sure to include the exact command-line used for all commands and to | ||
29 | include the full output of ./configure. | ||
30 | |||
31 | Feel free to include only the errors in the make output if they are | ||
32 | self-explanatory (for example, with `make >/dev/null`). | ||
33 | --> | ||
34 | |||
35 | _Post the commands used to reproduce the issue and their output_ | ||
36 | |||
37 | Example: | ||
38 | |||
39 | ```console | ||
40 | $ ./configure --prefix=/usr --enable-apparmor | ||
41 | checking for gcc... gcc | ||
42 | checking whether the C compiler works... yes | ||
43 | [...] | ||
44 | $ make | ||
45 | make -C src/lib | ||
46 | gcc [...] | ||
47 | [...] | ||
48 | ``` | ||
49 | |||
50 | _If ./configure fails, include the output of config.log_ | ||
51 | |||
52 | Example: | ||
53 | |||
54 | ```console | ||
55 | $ cat config.log | ||
56 | This file contains any messages produced by compilers while | ||
57 | running configure, to aid debugging if configure makes a mistake. | ||
58 | [...] | ||
59 | ``` | ||
60 | |||
61 | ### Additional context | ||
62 | |||
63 | _(Optional) Any other detail that may help to understand/debug the problem_ | ||
64 | |||
65 | ### Environment | ||
66 | |||
67 | - Name/version/arch of the Linux kernel (e.g. the output of `uname -srm`) | ||
68 | - Name/version of the Linux distribution (e.g. "Ubuntu 20.04" or "Arch Linux") | ||
69 | - Name/version of the C compiler (e.g. "gcc 14.1.1-1") | ||
70 | - Name/version of the libc (e.g. "glibc 2.40-1") | ||
71 | - Version of the Linux API headers (e.g. "linux-api-headers 6.10-1" on Arch Linux) | ||
72 | - Version of the source code being built (e.g. the output of `git rev-parse HEAD`) | ||
diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml index ccc5c9bf7..8ad73bb45 100644 --- a/.github/workflows/build-extra.yml +++ b/.github/workflows/build-extra.yml | |||
@@ -44,7 +44,7 @@ jobs: | |||
44 | timeout-minutes: 10 | 44 | timeout-minutes: 10 |
45 | steps: | 45 | steps: |
46 | - name: Harden Runner | 46 | - name: Harden Runner |
47 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 47 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
48 | with: | 48 | with: |
49 | egress-policy: block | 49 | egress-policy: block |
50 | allowed-endpoints: > | 50 | allowed-endpoints: > |
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e7752f3d3..e8bfd0c16 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml | |||
@@ -60,7 +60,7 @@ jobs: | |||
60 | timeout-minutes: 10 | 60 | timeout-minutes: 10 |
61 | steps: | 61 | steps: |
62 | - name: Harden Runner | 62 | - name: Harden Runner |
63 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 63 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
64 | with: | 64 | with: |
65 | egress-policy: block | 65 | egress-policy: block |
66 | allowed-endpoints: > | 66 | allowed-endpoints: > |
diff --git a/.github/workflows/check-c.yml b/.github/workflows/check-c.yml index a0b7245e5..1b35f684f 100644 --- a/.github/workflows/check-c.yml +++ b/.github/workflows/check-c.yml | |||
@@ -46,7 +46,7 @@ jobs: | |||
46 | timeout-minutes: 10 | 46 | timeout-minutes: 10 |
47 | steps: | 47 | steps: |
48 | - name: Harden Runner | 48 | - name: Harden Runner |
49 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 49 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
50 | with: | 50 | with: |
51 | egress-policy: block | 51 | egress-policy: block |
52 | allowed-endpoints: > | 52 | allowed-endpoints: > |
@@ -79,7 +79,7 @@ jobs: | |||
79 | timeout-minutes: 10 | 79 | timeout-minutes: 10 |
80 | steps: | 80 | steps: |
81 | - name: Harden Runner | 81 | - name: Harden Runner |
82 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 82 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
83 | with: | 83 | with: |
84 | egress-policy: block | 84 | egress-policy: block |
85 | allowed-endpoints: > | 85 | allowed-endpoints: > |
@@ -109,7 +109,7 @@ jobs: | |||
109 | timeout-minutes: 10 | 109 | timeout-minutes: 10 |
110 | steps: | 110 | steps: |
111 | - name: Harden Runner | 111 | - name: Harden Runner |
112 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 112 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
113 | with: | 113 | with: |
114 | egress-policy: block | 114 | egress-policy: block |
115 | allowed-endpoints: > | 115 | allowed-endpoints: > |
@@ -143,7 +143,7 @@ jobs: | |||
143 | 143 | ||
144 | steps: | 144 | steps: |
145 | - name: Harden Runner | 145 | - name: Harden Runner |
146 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 146 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
147 | with: | 147 | with: |
148 | disable-sudo: true | 148 | disable-sudo: true |
149 | egress-policy: block | 149 | egress-policy: block |
@@ -161,7 +161,7 @@ jobs: | |||
161 | 161 | ||
162 | # Initializes the CodeQL tools for scanning. | 162 | # Initializes the CodeQL tools for scanning. |
163 | - name: Initialize CodeQL | 163 | - name: Initialize CodeQL |
164 | uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c | 164 | uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 |
165 | with: | 165 | with: |
166 | languages: cpp | 166 | languages: cpp |
167 | 167 | ||
@@ -172,4 +172,4 @@ jobs: | |||
172 | run: make -j "$(nproc)" | 172 | run: make -j "$(nproc)" |
173 | 173 | ||
174 | - name: Perform CodeQL Analysis | 174 | - name: Perform CodeQL Analysis |
175 | uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c | 175 | uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 |
diff --git a/.github/workflows/check-profiles.yml b/.github/workflows/check-profiles.yml index 38cb1f29b..cb9d9ce87 100644 --- a/.github/workflows/check-profiles.yml +++ b/.github/workflows/check-profiles.yml | |||
@@ -33,7 +33,7 @@ jobs: | |||
33 | 33 | ||
34 | steps: | 34 | steps: |
35 | - name: Harden Runner | 35 | - name: Harden Runner |
36 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 36 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
37 | with: | 37 | with: |
38 | disable-sudo: true | 38 | disable-sudo: true |
39 | egress-policy: block | 39 | egress-policy: block |
diff --git a/.github/workflows/check-python.yml b/.github/workflows/check-python.yml index 838414498..ed317a86f 100644 --- a/.github/workflows/check-python.yml +++ b/.github/workflows/check-python.yml | |||
@@ -31,7 +31,7 @@ jobs: | |||
31 | 31 | ||
32 | steps: | 32 | steps: |
33 | - name: Harden Runner | 33 | - name: Harden Runner |
34 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 34 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
35 | with: | 35 | with: |
36 | disable-sudo: true | 36 | disable-sudo: true |
37 | egress-policy: block | 37 | egress-policy: block |
@@ -51,9 +51,9 @@ jobs: | |||
51 | 51 | ||
52 | # Initializes the CodeQL tools for scanning. | 52 | # Initializes the CodeQL tools for scanning. |
53 | - name: Initialize CodeQL | 53 | - name: Initialize CodeQL |
54 | uses: github/codeql-action/init@b611370bb5703a7efb587f9d136a52ea24c5c38c | 54 | uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 |
55 | with: | 55 | with: |
56 | languages: python | 56 | languages: python |
57 | 57 | ||
58 | - name: Perform CodeQL Analysis | 58 | - name: Perform CodeQL Analysis |
59 | uses: github/codeql-action/analyze@b611370bb5703a7efb587f9d136a52ea24c5c38c | 59 | uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93 |
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml index 6e0fe73d2..27c6ab125 100644 --- a/.github/workflows/codespell.yml +++ b/.github/workflows/codespell.yml | |||
@@ -24,7 +24,7 @@ jobs: | |||
24 | timeout-minutes: 5 | 24 | timeout-minutes: 5 |
25 | steps: | 25 | steps: |
26 | - name: Harden Runner | 26 | - name: Harden Runner |
27 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 27 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
28 | with: | 28 | with: |
29 | egress-policy: block | 29 | egress-policy: block |
30 | allowed-endpoints: > | 30 | allowed-endpoints: > |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c1ee00934..92eb212e4 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml | |||
@@ -54,7 +54,7 @@ jobs: | |||
54 | SHELL: /bin/bash | 54 | SHELL: /bin/bash |
55 | steps: | 55 | steps: |
56 | - name: Harden Runner | 56 | - name: Harden Runner |
57 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 57 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
58 | with: | 58 | with: |
59 | egress-policy: block | 59 | egress-policy: block |
60 | allowed-endpoints: > | 60 | allowed-endpoints: > |
@@ -103,7 +103,7 @@ jobs: | |||
103 | SHELL: /bin/bash | 103 | SHELL: /bin/bash |
104 | steps: | 104 | steps: |
105 | - name: Harden Runner | 105 | - name: Harden Runner |
106 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 106 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
107 | with: | 107 | with: |
108 | egress-policy: block | 108 | egress-policy: block |
109 | allowed-endpoints: > | 109 | allowed-endpoints: > |
@@ -143,7 +143,7 @@ jobs: | |||
143 | SHELL: /bin/bash | 143 | SHELL: /bin/bash |
144 | steps: | 144 | steps: |
145 | - name: Harden Runner | 145 | - name: Harden Runner |
146 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 146 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
147 | with: | 147 | with: |
148 | egress-policy: block | 148 | egress-policy: block |
149 | allowed-endpoints: > | 149 | allowed-endpoints: > |
@@ -183,7 +183,7 @@ jobs: | |||
183 | SHELL: /bin/bash | 183 | SHELL: /bin/bash |
184 | steps: | 184 | steps: |
185 | - name: Harden Runner | 185 | - name: Harden Runner |
186 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 186 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
187 | with: | 187 | with: |
188 | egress-policy: block | 188 | egress-policy: block |
189 | allowed-endpoints: > | 189 | allowed-endpoints: > |
@@ -225,7 +225,7 @@ jobs: | |||
225 | SHELL: /bin/bash | 225 | SHELL: /bin/bash |
226 | steps: | 226 | steps: |
227 | - name: Harden Runner | 227 | - name: Harden Runner |
228 | uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 | 228 | uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde |
229 | with: | 229 | with: |
230 | egress-policy: block | 230 | egress-policy: block |
231 | allowed-endpoints: > | 231 | allowed-endpoints: > |
@@ -171,7 +171,7 @@ aoand (https://github.com/aoand) | |||
171 | Arne Welzel (https://github.com/awelzel) | 171 | Arne Welzel (https://github.com/awelzel) |
172 | - ignore SIGTTOU during flush_stdin() | 172 | - ignore SIGTTOU during flush_stdin() |
173 | archaon616 (https://github.com/archaon616) | 173 | archaon616 (https://github.com/archaon616) |
174 | - steam.profile: Allow Factorio | 174 | - steam.profile: allow Factorio, Zomboid |
175 | Atrate (https://github.com/Atrate) | 175 | Atrate (https://github.com/Atrate) |
176 | - BetterDiscord support | 176 | - BetterDiscord support |
177 | Austin Morton (https://github.com/apmorton) | 177 | Austin Morton (https://github.com/apmorton) |
@@ -326,6 +326,8 @@ curiosityseeker (https://github.com/curiosityseeker - new) | |||
326 | - fixed conky profile | 326 | - fixed conky profile |
327 | - thunderbird.profile: harden and enable the rules necessary to make | 327 | - thunderbird.profile: harden and enable the rules necessary to make |
328 | Firefox open links | 328 | Firefox open links |
329 | D357R0Y3R (https://github.com/D357R0Y3R) | ||
330 | - added floorp to firejail.config | ||
329 | da2x (https://github.com/da2x) | 331 | da2x (https://github.com/da2x) |
330 | - matched RPM license tag | 332 | - matched RPM license tag |
331 | Daan Bakker (https://github.com/dbakker) | 333 | Daan Bakker (https://github.com/dbakker) |
@@ -371,6 +373,8 @@ DiGitHubCap (https://github.com/DiGitHubCap) | |||
371 | - fix qt5ct colour schemes and QSS | 373 | - fix qt5ct colour schemes and QSS |
372 | Dieter Plaetinck (https://github.com/Dieterbe) | 374 | Dieter Plaetinck (https://github.com/Dieterbe) |
373 | - qutebrowser: update MPRIS name for qutebrowser-qt6 | 375 | - qutebrowser: update MPRIS name for qutebrowser-qt6 |
376 | - fix email-common.profile | ||
377 | - fix claws-mail profile | ||
374 | Disconnect3d (https://github.com/disconnect3d) | 378 | Disconnect3d (https://github.com/disconnect3d) |
375 | - code cleanup | 379 | - code cleanup |
376 | dm9pZCAq (https://github.com/dm9pZCAq) | 380 | dm9pZCAq (https://github.com/dm9pZCAq) |
@@ -408,13 +412,18 @@ Fabian Würfl (https://github.com/BafDyce) | |||
408 | - Liferea profile | 412 | - Liferea profile |
409 | Felipe Barriga Richards (https://github.com/fbarriga) | 413 | Felipe Barriga Richards (https://github.com/fbarriga) |
410 | - --private-etc fix | 414 | - --private-etc fix |
415 | Felix Pehla (https://github.com/FelixPehla) | ||
416 | - fix fractal profile | ||
411 | fenuks (https://github.com/fenuks) | 417 | fenuks (https://github.com/fenuks) |
412 | - fix sound in games using FMOD | 418 | - fix sound in games using FMOD |
413 | - allow /opt/tor-browser for Tor Browser profile | 419 | - allow /opt/tor-browser for Tor Browser profile |
414 | fkrone (https://github.com/fkrone) | 420 | fkrone (https://github.com/fkrone) |
415 | - fix Zoom profile | 421 | - fix Zoom profile |
416 | Fidel Ramos (https://github.com/haplo) | 422 | Fidel Ramos (https://github.com/haplo) |
417 | - Ledger Live profile | 423 | - added Ledger Live profile |
424 | - fixed geeqie profile | ||
425 | - added rawtherapee profile | ||
426 | - added electron-cache profile | ||
418 | Florian Begusch (https://github.com/florianbegusch) | 427 | Florian Begusch (https://github.com/florianbegusch) |
419 | - (la)tex profiles | 428 | - (la)tex profiles |
420 | - fixed transmission-common.profile | 429 | - fixed transmission-common.profile |
@@ -567,6 +576,9 @@ Haowei Yu (https://github.com/sfc-gh-hyu) | |||
567 | Icaro Perseo (https://github.com/icaroperseo) | 576 | Icaro Perseo (https://github.com/icaroperseo) |
568 | - Icecat profile | 577 | - Icecat profile |
569 | - several profile fixes | 578 | - several profile fixes |
579 | Ilya Pankratov (https://github.com/i-pankrat) | ||
580 | - profstats fix | ||
581 | - fix various memory resource leaks | ||
570 | Igor Bukanov (https://github.com/ibukanov) | 582 | Igor Bukanov (https://github.com/ibukanov) |
571 | - found/fiixed privilege escalation in --hosts-file option | 583 | - found/fiixed privilege escalation in --hosts-file option |
572 | iiotx (https://github.com/iiotx) | 584 | iiotx (https://github.com/iiotx) |
@@ -739,6 +751,8 @@ Liorst4 (https://github.com/Liorst4) | |||
739 | - minetest fixes | 751 | - minetest fixes |
740 | Lockdis (https://github.com/Lockdis) | 752 | Lockdis (https://github.com/Lockdis) |
741 | - Added crow, nyx, and google-earth-pro profiles | 753 | - Added crow, nyx, and google-earth-pro profiles |
754 | luca0N (https://github.com/luca0N) | ||
755 | - fixed crawl profile | ||
742 | Lukáš Krejčí (https://github.com/lskrejci) | 756 | Lukáš Krejčí (https://github.com/lskrejci) |
743 | - fixed parsing of --keep-var-tmp | 757 | - fixed parsing of --keep-var-tmp |
744 | luzpaz (https://github.com/luzpaz) | 758 | luzpaz (https://github.com/luzpaz) |
@@ -794,6 +808,8 @@ Michael Haas (https://github.com/mhaas) | |||
794 | - bugfixes | 808 | - bugfixes |
795 | Michael Hoffmann (https://github.com/brisad) | 809 | Michael Hoffmann (https://github.com/brisad) |
796 | - added support for subdirs in private-etc | 810 | - added support for subdirs in private-etc |
811 | Michele Sorcinelli (https://github.com/michelesr) | ||
812 | - fix ssh profile | ||
797 | Mike Frysinger (vapier@gentoo.org) | 813 | Mike Frysinger (vapier@gentoo.org) |
798 | - Gentoo compile patch | 814 | - Gentoo compile patch |
799 | minus7 (https://github.com/minus7) | 815 | minus7 (https://github.com/minus7) |
@@ -855,6 +871,7 @@ nolanl (https://github.com/nolanl) | |||
855 | nutta-git (https://github.com/nutta-git) | 871 | nutta-git (https://github.com/nutta-git) |
856 | - steam.profile: allow process_vm_readv syscall | 872 | - steam.profile: allow process_vm_readv syscall |
857 | - lutris.profile: allow more syscalls | 873 | - lutris.profile: allow more syscalls |
874 | - steam.profile: update novideo comment for webcam motion trackers | ||
858 | nyancat18 (https://github.com/nyancat18) | 875 | nyancat18 (https://github.com/nyancat18) |
859 | - added ardour4, dooble, karbon, krita profiles | 876 | - added ardour4, dooble, karbon, krita profiles |
860 | nya1 (https://github.com/nya1) | 877 | nya1 (https://github.com/nya1) |
@@ -949,6 +966,8 @@ pszxzsd (https://github.com/pszxzsd) | |||
949 | -uGet profile | 966 | -uGet profile |
950 | pwnage-pineapple (https://github.com/pwnage-pineapple) | 967 | pwnage-pineapple (https://github.com/pwnage-pineapple) |
951 | - update Okular profile | 968 | - update Okular profile |
969 | qdii (https://github.com/qdii) | ||
970 | - added notpm command & keep tpm devices in private-dev | ||
952 | Quentin Retornaz (https://github.com/qretornaz-adapei42) | 971 | Quentin Retornaz (https://github.com/qretornaz-adapei42) |
953 | - microsoft-edge profiles fixes | 972 | - microsoft-edge profiles fixes |
954 | Quentin Minster (https://github.com/laomaiweng) | 973 | Quentin Minster (https://github.com/laomaiweng) |
@@ -1003,6 +1022,8 @@ rootalc (https://github.com/rootalc) | |||
1003 | - add nolocal6.net filter | 1022 | - add nolocal6.net filter |
1004 | Ruan (https://github.com/ruany) | 1023 | Ruan (https://github.com/ruany) |
1005 | - fixed hexchat profile | 1024 | - fixed hexchat profile |
1025 | RundownRhino (https://github.com/RundownRhino) | ||
1026 | - firefox profile fix | ||
1006 | rusty-snake (https://github.com/rusty-snake) | 1027 | rusty-snake (https://github.com/rusty-snake) |
1007 | - added profiles: thunderbird-wayland, supertuxkart, ghostwriter | 1028 | - added profiles: thunderbird-wayland, supertuxkart, ghostwriter |
1008 | - added profiles: klavaro, mypaint, mypaint-ora-thumbnailer, nano | 1029 | - added profiles: klavaro, mypaint, mypaint-ora-thumbnailer, nano |
@@ -1040,18 +1061,17 @@ Serphentas (https://github.com/Serphentas) | |||
1040 | - add Paradox Launcher to Steam profile | 1061 | - add Paradox Launcher to Steam profile |
1041 | Slava Monich (https://github.com/monich) | 1062 | Slava Monich (https://github.com/monich) |
1042 | - added configure option to disable man pages | 1063 | - added configure option to disable man pages |
1043 | Tobias Schmidl (https://github.com/schtobia) | ||
1044 | - added profile for webui-aria2 | ||
1045 | Simon Peter (https://github.com/probonopd) | 1064 | Simon Peter (https://github.com/probonopd) |
1046 | - set $APPIMAGE and $APPDIR environment variables | 1065 | - set $APPIMAGE and $APPDIR environment variables |
1047 | - AppImage version detection | 1066 | - AppImage version detection |
1048 | - Leafppad type v1 and v2 appimage packages in test/appimage | 1067 | - Leafppad type v1 and v2 appimage packages in test/appimage |
1049 | - GitHub/Travis CI integration | 1068 | - GitHub/Travis CI integration |
1069 | Simo Piiroinen (https://github.com/spiiroin) | ||
1070 | - Jolla/SailfishOS patches | ||
1071 | - fix startup race condition for /run/firejail directory | ||
1050 | sinkuu (https://github.com/sinkuu) | 1072 | sinkuu (https://github.com/sinkuu) |
1051 | - blacklisting kwalletd | 1073 | - blacklisting kwalletd |
1052 | - fix symlink invocation for programs placing symlinks in $PATH | 1074 | - fix symlink invocation for programs placing symlinks in $PATH |
1053 | Simo Piiroinen (https://github.com/spiiroin) | ||
1054 | - Jolla/SailfishOS patches | ||
1055 | slowpeek (https://github.com/slowpeek) | 1075 | slowpeek (https://github.com/slowpeek) |
1056 | - refine appimage example in docs | 1076 | - refine appimage example in docs |
1057 | - allow resolution of .local names with avahi-daemon in the apparmor profile | 1077 | - allow resolution of .local names with avahi-daemon in the apparmor profile |
@@ -1059,6 +1079,9 @@ slowpeek (https://github.com/slowpeek) | |||
1059 | - make appimage examples consistent with --appimage option short description | 1079 | - make appimage examples consistent with --appimage option short description |
1060 | - blacklist google-drive-ocamlfuse config | 1080 | - blacklist google-drive-ocamlfuse config |
1061 | - blacklist sendgmail config | 1081 | - blacklist sendgmail config |
1082 | Shahriar Heidrich (https://github.com/smheidrich) | ||
1083 | - fix manpages | ||
1084 | - fix i3 profile and disable-programs.profile | ||
1062 | smitsohu (https://github.com/smitsohu) | 1085 | smitsohu (https://github.com/smitsohu) |
1063 | - read-only kde4 services directory | 1086 | - read-only kde4 services directory |
1064 | - enhanced mediathekview profile | 1087 | - enhanced mediathekview profile |
@@ -1187,6 +1210,8 @@ Tomasz Jan Góralczyk (https://github.com/tjg) | |||
1187 | - fixed Steam profile | 1210 | - fixed Steam profile |
1188 | Tomi Leppänen (https://github.com/Tomin1) | 1211 | Tomi Leppänen (https://github.com/Tomin1) |
1189 | - Jolla/SailfishOS patches | 1212 | - Jolla/SailfishOS patches |
1213 | Tobias Schmidl (https://github.com/schtobia) | ||
1214 | - added profile for webui-aria2 | ||
1190 | Topi Miettinen (https://github.com/topimiettinen) | 1215 | Topi Miettinen (https://github.com/topimiettinen) |
1191 | - improved seccomp printing | 1216 | - improved seccomp printing |
1192 | - improve mount handling, fix /run/user handling | 1217 | - improve mount handling, fix /run/user handling |
@@ -1201,6 +1226,8 @@ Ted Robertson (https://github.com/tredondo) | |||
1201 | - various documentation fixes | 1226 | - various documentation fixes |
1202 | - blacklist Exodus wallet | 1227 | - blacklist Exodus wallet |
1203 | - blacklist monero-project directory | 1228 | - blacklist monero-project directory |
1229 | tools200ms (https://github.com/tools200ms) | ||
1230 | - fixed allow-ssh.inc | ||
1204 | Tus1688 (https://github.com/Tus1688) | 1231 | Tus1688 (https://github.com/Tus1688) |
1205 | - added neovim profile | 1232 | - added neovim profile |
1206 | user1024 (user1024@tut.by) | 1233 | user1024 (user1024@tut.by) |
@@ -17,7 +17,9 @@ firejail (0.9.73) baseline; urgency=low | |||
17 | * feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200 | 17 | * feature: add Landlock support (#5269 #6078 #6115 #6125 #6187 #6195 #6200 |
18 | #6228 #6260 #6302 #6305) | 18 | #6228 #6260 #6302 #6305) |
19 | * feature: add support for comm, coredump, and prctl procevents in firemon | 19 | * feature: add support for comm, coredump, and prctl procevents in firemon |
20 | (#6414 #6415) | ||
20 | * feature: add notpm command & keep tpm devices in private-dev (#6379 #6390) | 21 | * feature: add notpm command & keep tpm devices in private-dev (#6379 #6390) |
22 | * feature: fshaper.sh: support tc on NixOS (#6426 #6431) | ||
21 | * modif: Stop forwarding own double-dash to the shell (#5599 #5600) | 23 | * modif: Stop forwarding own double-dash to the shell (#5599 #5600) |
22 | * modif: Prevent sandbox name (--name=) and host name (--hostname=) | 24 | * modif: Prevent sandbox name (--name=) and host name (--hostname=) |
23 | from containing only digits (#5578 #5741) | 25 | from containing only digits (#5578 #5741) |
@@ -32,7 +34,6 @@ firejail (0.9.73) baseline; urgency=low | |||
32 | * modif: drop deprecated 'shell' option references (#5894) | 34 | * modif: drop deprecated 'shell' option references (#5894) |
33 | * modif: keep pipewire group unless nosound is used (#5992 #5993) | 35 | * modif: keep pipewire group unless nosound is used (#5992 #5993) |
34 | * modif: fcopy: Use lstat when copying directory (#5957) | 36 | * modif: fcopy: Use lstat when copying directory (#5957) |
35 | * modif: populate /run/firejail while holding flock (#6307) | ||
36 | * modif: private-dev: keep /dev/kfd unless no3d is used (#6380) | 37 | * modif: private-dev: keep /dev/kfd unless no3d is used (#6380) |
37 | * modif: keep /sys/module/nvidia* if prop driver and no no3d (#6372 #6387) | 38 | * modif: keep /sys/module/nvidia* if prop driver and no no3d (#6372 #6387) |
38 | * removal: LTS and FIRETUNNEL support | 39 | * removal: LTS and FIRETUNNEL support |
@@ -43,8 +44,10 @@ firejail (0.9.73) baseline; urgency=low | |||
43 | (#5965 #5976) | 44 | (#5965 #5976) |
44 | * bugfix: firejail --ls reports wrong file sizes for large files (#5982 | 45 | * bugfix: firejail --ls reports wrong file sizes for large files (#5982 |
45 | #6086) | 46 | #6086) |
47 | * bugfix: fix startup race condition for /run/firejail directory (#6307) | ||
46 | * bugfix: fix various resource leaks (#6367) | 48 | * bugfix: fix various resource leaks (#6367) |
47 | * bugfix: profstats: fix restrict-namespaces max count (#6369) | 49 | * bugfix: profstats: fix restrict-namespaces max count (#6369) |
50 | * bugfix: remove --noautopulse from --help and zsh comp (#6401) | ||
48 | * build: auto-generate syntax files (#5627) | 51 | * build: auto-generate syntax files (#5627) |
49 | * build: mark all phony targets as such (#5637) | 52 | * build: mark all phony targets as such (#5637) |
50 | * build: mkdeb.sh: pass all arguments to ./configure (#5654) | 53 | * build: mkdeb.sh: pass all arguments to ./configure (#5654) |
@@ -55,8 +58,7 @@ firejail (0.9.73) baseline; urgency=low | |||
55 | * build: disable all built-in implicit make rules (#5864) | 58 | * build: disable all built-in implicit make rules (#5864) |
56 | * build: organize and standardize make vars and targets (#5866) | 59 | * build: organize and standardize make vars and targets (#5866) |
57 | * build: fix seccomp filters and man pages always being rebuilt when running | 60 | * build: fix seccomp filters and man pages always being rebuilt when running |
58 | make | 61 | make (#5156 #5898) |
59 | * build: simplify code related to man pages (#5898) | ||
60 | * build: fix hardcoded make & remove unnecessary distclean targets (#5911) | 62 | * build: fix hardcoded make & remove unnecessary distclean targets (#5911) |
61 | * build: dist and asc improvements (#5916) | 63 | * build: dist and asc improvements (#5916) |
62 | * build: fix some shellcheck issues & use config.sh in more scripts (#5927) | 64 | * build: fix some shellcheck issues & use config.sh in more scripts (#5927) |
@@ -80,6 +82,7 @@ firejail (0.9.73) baseline; urgency=low | |||
80 | * build: remove clean dependency from cppcheck targets (#6343) | 82 | * build: remove clean dependency from cppcheck targets (#6343) |
81 | * build: allow overriding common tools (#6354) | 83 | * build: allow overriding common tools (#6354) |
82 | * build: standardize install commands (#6366) | 84 | * build: standardize install commands (#6366) |
85 | * build: improve reliability/portability of date command usage (#6403 #6404) | ||
83 | * ci: always update the package db before installing packages (#5742) | 86 | * ci: always update the package db before installing packages (#5742) |
84 | * ci: fix codeql unable to download its own bundle (#5783) | 87 | * ci: fix codeql unable to download its own bundle (#5783) |
85 | * ci: split configure/build/install commands on gitlab (#5784) | 88 | * ci: split configure/build/install commands on gitlab (#5784) |
@@ -109,6 +112,8 @@ firejail (0.9.73) baseline; urgency=low | |||
109 | #6359) | 112 | #6359) |
110 | * docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382) | 113 | * docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382) |
111 | * docs: man: format and sort some private- items (#6398) | 114 | * docs: man: format and sort some private- items (#6398) |
115 | * docs: man: improve blacklist/whitelist examples with spaces (#6425) | ||
116 | * docs: add build_issue.md issue template (#6423) | ||
112 | * legal: selinux.c: Split Copyright notice & use same license as upstream | 117 | * legal: selinux.c: Split Copyright notice & use same license as upstream |
113 | (#5667) | 118 | (#5667) |
114 | * profiles: qutebrowser: fix links not opening in the existing instance | 119 | * profiles: qutebrowser: fix links not opening in the existing instance |
diff --git a/etc/inc/disable-common.inc b/etc/inc/disable-common.inc index 14f7d8cf7..faae99543 100644 --- a/etc/inc/disable-common.inc +++ b/etc/inc/disable-common.inc | |||
@@ -171,6 +171,10 @@ blacklist ${RUNUSER}/gsconnect | |||
171 | blacklist ${RUNUSER}/i3/ipc-socket.* | 171 | blacklist ${RUNUSER}/i3/ipc-socket.* |
172 | blacklist /tmp/i3-*/ipc-socket.* | 172 | blacklist /tmp/i3-*/ipc-socket.* |
173 | 173 | ||
174 | # sway IPC socket (allows arbitrary shell script execution) | ||
175 | blacklist ${RUNUSER}/sway-ipc.* | ||
176 | blacklist /tmp/sway-ipc.* | ||
177 | |||
174 | # systemd | 178 | # systemd |
175 | blacklist ${HOME}/.config/systemd | 179 | blacklist ${HOME}/.config/systemd |
176 | blacklist ${HOME}/.local/share/systemd | 180 | blacklist ${HOME}/.local/share/systemd |
diff --git a/etc/profile-a-l/abrowser.profile b/etc/profile-a-l/abrowser.profile index 8b70756ba..6217af780 100644 --- a/etc/profile-a-l/abrowser.profile +++ b/etc/profile-a-l/abrowser.profile | |||
@@ -14,8 +14,7 @@ whitelist ${HOME}/.cache/mozilla/abrowser | |||
14 | whitelist ${HOME}/.mozilla | 14 | whitelist ${HOME}/.mozilla |
15 | whitelist /usr/share/abrowser | 15 | whitelist /usr/share/abrowser |
16 | 16 | ||
17 | # private-etc must first be enabled in firefox-common.profile | 17 | private-etc abrowser |
18 | #private-etc abrowser | ||
19 | 18 | ||
20 | # Redirect | 19 | # Redirect |
21 | include firefox-common.profile | 20 | include firefox-common.profile |
diff --git a/etc/profile-a-l/basilisk.profile b/etc/profile-a-l/basilisk.profile index 7d2fe143c..f5595274e 100644 --- a/etc/profile-a-l/basilisk.profile +++ b/etc/profile-a-l/basilisk.profile | |||
@@ -19,8 +19,7 @@ seccomp | |||
19 | ignore seccomp | 19 | ignore seccomp |
20 | 20 | ||
21 | #private-bin basilisk | 21 | #private-bin basilisk |
22 | # private-etc must first be enabled in firefox-common.profile | 22 | private-etc basilisk |
23 | #private-etc basilisk | ||
24 | #private-opt basilisk | 23 | #private-opt basilisk |
25 | 24 | ||
26 | restrict-namespaces | 25 | restrict-namespaces |
diff --git a/etc/profile-a-l/bijiben.profile b/etc/profile-a-l/bijiben.profile index e596ec9d2..7afccf5cd 100644 --- a/etc/profile-a-l/bijiben.profile +++ b/etc/profile-a-l/bijiben.profile | |||
@@ -59,5 +59,8 @@ dbus-user.talk ca.desrt.dconf | |||
59 | dbus-user.talk org.freedesktop.Tracker1 | 59 | dbus-user.talk org.freedesktop.Tracker1 |
60 | dbus-system none | 60 | dbus-system none |
61 | 61 | ||
62 | env WEBKIT_FORCE_SANDBOX=0 | 62 | # Warning: Disabling the webkit sandbox may be needed to make firejail work |
63 | # with webkit2gtk, but this is not recommended (see #2995). | ||
64 | # Add the following line to bijiben.local at your own risk: | ||
65 | #env WEBKIT_DISABLE_SANDBOX_THIS_IS_DANGEROUS=1 | ||
63 | restrict-namespaces | 66 | restrict-namespaces |
diff --git a/etc/profile-a-l/bitwarden-desktop.profile b/etc/profile-a-l/bitwarden-desktop.profile new file mode 100644 index 000000000..4c1994c50 --- /dev/null +++ b/etc/profile-a-l/bitwarden-desktop.profile | |||
@@ -0,0 +1,11 @@ | |||
1 | # Firejail profile for bitwarden-desktop | ||
2 | # Description: A secure and free password manager for all of your devices | ||
3 | # This file is overwritten after every install/update. | ||
4 | # Persistent local customisations | ||
5 | include bitwarden-desktop.local | ||
6 | # Persistent global definitions | ||
7 | # added by included profile | ||
8 | #include globals.local | ||
9 | |||
10 | # Redirect | ||
11 | include bitwarden.profile | ||
diff --git a/etc/profile-a-l/bitwarden.profile b/etc/profile-a-l/bitwarden.profile index 1572ca572..9ed48b02d 100644 --- a/etc/profile-a-l/bitwarden.profile +++ b/etc/profile-a-l/bitwarden.profile | |||
@@ -6,13 +6,13 @@ include bitwarden.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | # Disabled until someone reported positive feedback | ||
10 | ignore include whitelist-usr-share-common.inc | ||
11 | |||
12 | ignore noexec /tmp | 9 | ignore noexec /tmp |
13 | 10 | ||
14 | noblacklist ${HOME}/.config/Bitwarden | 11 | noblacklist ${HOME}/.config/Bitwarden |
15 | 12 | ||
13 | # Allow /bin/sh (blacklisted by disable-shell.inc) | ||
14 | include allow-bin-sh.inc | ||
15 | |||
16 | include disable-shell.inc | 16 | include disable-shell.inc |
17 | 17 | ||
18 | mkdir ${HOME}/.config/Bitwarden | 18 | mkdir ${HOME}/.config/Bitwarden |
diff --git a/etc/profile-a-l/cachy-browser.profile b/etc/profile-a-l/cachy-browser.profile index 05e1a69f1..6218dbbe8 100644 --- a/etc/profile-a-l/cachy-browser.profile +++ b/etc/profile-a-l/cachy-browser.profile | |||
@@ -26,9 +26,7 @@ whitelist /usr/share/cachy-browser | |||
26 | 26 | ||
27 | # Add the next line to your cachy-browser.local to enable private-bin (Arch Linux). | 27 | # Add the next line to your cachy-browser.local to enable private-bin (Arch Linux). |
28 | #private-bin dbus-launch,dbus-send,cachy-browser,sh | 28 | #private-bin dbus-launch,dbus-send,cachy-browser,sh |
29 | # Add the next line to your cachy-browser.local to enable private-etc. | 29 | private-etc cachy-browser |
30 | # Note: private-etc must first be enabled in firefox-common.local. | ||
31 | #private-etc cachy-browser | ||
32 | 30 | ||
33 | dbus-user filter | 31 | dbus-user filter |
34 | dbus-user.own org.mozilla.cachybrowser.* | 32 | dbus-user.own org.mozilla.cachybrowser.* |
diff --git a/etc/profile-a-l/cliqz.profile b/etc/profile-a-l/cliqz.profile index d0bf9797e..bded735a9 100644 --- a/etc/profile-a-l/cliqz.profile +++ b/etc/profile-a-l/cliqz.profile | |||
@@ -17,8 +17,7 @@ whitelist ${HOME}/.cliqz | |||
17 | whitelist ${HOME}/.config/cliqz | 17 | whitelist ${HOME}/.config/cliqz |
18 | whitelist /usr/share/cliqz | 18 | whitelist /usr/share/cliqz |
19 | 19 | ||
20 | # private-etc must first be enabled in firefox-common.profile | 20 | private-etc cliqz |
21 | #private-etc cliqz | ||
22 | 21 | ||
23 | # Redirect | 22 | # Redirect |
24 | include firefox-common.profile | 23 | include firefox-common.profile |
diff --git a/etc/profile-a-l/cyberfox.profile b/etc/profile-a-l/cyberfox.profile index c7a42e0eb..173c5b4a5 100644 --- a/etc/profile-a-l/cyberfox.profile +++ b/etc/profile-a-l/cyberfox.profile | |||
@@ -16,8 +16,7 @@ whitelist /usr/share/8pecxstudios | |||
16 | whitelist /usr/share/cyberfox | 16 | whitelist /usr/share/cyberfox |
17 | 17 | ||
18 | #private-bin cyberfox,dbus-launch,dbus-send,env,sh,which | 18 | #private-bin cyberfox,dbus-launch,dbus-send,env,sh,which |
19 | # private-etc must first be enabled in firefox-common.profile | 19 | private-etc cyberfox |
20 | #private-etc cyberfox | ||
21 | 20 | ||
22 | # Redirect | 21 | # Redirect |
23 | include firefox-common.profile | 22 | include firefox-common.profile |
diff --git a/etc/profile-a-l/d-feet.profile b/etc/profile-a-l/d-feet.profile index 75338eb6d..e11134616 100644 --- a/etc/profile-a-l/d-feet.profile +++ b/etc/profile-a-l/d-feet.profile | |||
@@ -12,45 +12,16 @@ noblacklist ${HOME}/.config/d-feet | |||
12 | include allow-python2.inc | 12 | include allow-python2.inc |
13 | include allow-python3.inc | 13 | include allow-python3.inc |
14 | 14 | ||
15 | include disable-common.inc | ||
16 | include disable-devel.inc | ||
17 | include disable-exec.inc | ||
18 | include disable-interpreters.inc | ||
19 | include disable-programs.inc | ||
20 | include disable-shell.inc | ||
21 | include disable-xdg.inc | ||
22 | |||
23 | mkdir ${HOME}/.config/d-feet | 15 | mkdir ${HOME}/.config/d-feet |
24 | whitelist ${HOME}/.config/d-feet | 16 | whitelist ${HOME}/.config/d-feet |
25 | whitelist /usr/share/d-feet | 17 | whitelist /usr/share/d-feet |
26 | include whitelist-common.inc | ||
27 | include whitelist-runuser-common.inc | ||
28 | include whitelist-usr-share-common.inc | ||
29 | include whitelist-var-common.inc | ||
30 | 18 | ||
31 | apparmor | 19 | # breaks on Ubuntu |
32 | caps.drop all | 20 | ignore net none |
33 | ipc-namespace | ||
34 | #net none # breaks on Ubuntu | ||
35 | no3d | ||
36 | nodvd | ||
37 | nogroups | ||
38 | noinput | ||
39 | nonewprivs | ||
40 | noroot | ||
41 | nosound | ||
42 | notv | ||
43 | nou2f | ||
44 | novideo | ||
45 | protocol unix | ||
46 | seccomp | ||
47 | 21 | ||
48 | disable-mnt | ||
49 | private-bin d-feet,python* | 22 | private-bin d-feet,python* |
50 | private-cache | ||
51 | private-dev | ||
52 | private-etc dbus-1 | ||
53 | private-tmp | ||
54 | 23 | ||
55 | #memory-deny-write-execute # breaks on Arch (see issue #1803) | 24 | #memory-deny-write-execute # breaks on Arch (see issue #1803) |
56 | restrict-namespaces | 25 | |
26 | # Redirect | ||
27 | include dbus-debug-common.profile | ||
diff --git a/etc/profile-a-l/d-spy.profile b/etc/profile-a-l/d-spy.profile index 9ff429ecb..2c9ef52cb 100644 --- a/etc/profile-a-l/d-spy.profile +++ b/etc/profile-a-l/d-spy.profile | |||
@@ -6,43 +6,7 @@ include d-spy.local | |||
6 | # Persistent global definitions | 6 | # Persistent global definitions |
7 | include globals.local | 7 | include globals.local |
8 | 8 | ||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-proc.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | include whitelist-common.inc | ||
19 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | ipc-namespace | ||
26 | net none | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | noinput | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | |||
40 | disable-mnt | ||
41 | private-bin d-spy | 9 | private-bin d-spy |
42 | private-cache | ||
43 | private-dev | ||
44 | private-etc dbus-1 | ||
45 | private-tmp | ||
46 | 10 | ||
47 | read-only ${HOME} | 11 | # Redirect |
48 | restrict-namespaces | 12 | include dbus-debug-common.profile |
diff --git a/etc/profile-a-l/dbus-debug-common.profile b/etc/profile-a-l/dbus-debug-common.profile new file mode 100644 index 000000000..0ef060f3a --- /dev/null +++ b/etc/profile-a-l/dbus-debug-common.profile | |||
@@ -0,0 +1,49 @@ | |||
1 | # Firejail profile for dbus-debug-common | ||
2 | # This file is overwritten after every install/update | ||
3 | # Persistent local customizations | ||
4 | include dbus-debug-common.local | ||
5 | # Persistent global definitions | ||
6 | # added by caller profile | ||
7 | #include globals.local | ||
8 | |||
9 | include disable-common.inc | ||
10 | include disable-devel.inc | ||
11 | include disable-exec.inc | ||
12 | include disable-interpreters.inc | ||
13 | include disable-proc.inc | ||
14 | include disable-programs.inc | ||
15 | include disable-shell.inc | ||
16 | include disable-xdg.inc | ||
17 | |||
18 | include whitelist-common.inc | ||
19 | include whitelist-runuser-common.inc | ||
20 | include whitelist-usr-share-common.inc | ||
21 | include whitelist-var-common.inc | ||
22 | |||
23 | apparmor | ||
24 | caps.drop all | ||
25 | ipc-namespace | ||
26 | net none | ||
27 | no3d | ||
28 | nodvd | ||
29 | nogroups | ||
30 | noinput | ||
31 | nonewprivs | ||
32 | noroot | ||
33 | nosound | ||
34 | notv | ||
35 | nou2f | ||
36 | novideo | ||
37 | protocol unix | ||
38 | seccomp | ||
39 | seccomp.block-secondary | ||
40 | tracelog | ||
41 | |||
42 | disable-mnt | ||
43 | private-cache | ||
44 | private-dev | ||
45 | private-etc dbus-1 | ||
46 | private-tmp | ||
47 | |||
48 | read-only ${HOME} | ||
49 | restrict-namespaces | ||
diff --git a/etc/profile-a-l/dtui.profile b/etc/profile-a-l/dtui.profile new file mode 100644 index 000000000..b85ae451b --- /dev/null +++ b/etc/profile-a-l/dtui.profile | |||
@@ -0,0 +1,15 @@ | |||
1 | # Firejail profile for dtui | ||
2 | # Description: TUI D-Bus debugger | ||
3 | # This file is overwritten after every install/update | ||
4 | quiet | ||
5 | # Persistent local customizations | ||
6 | include dtui.local | ||
7 | # Persistent global definitions | ||
8 | include globals.local | ||
9 | |||
10 | private-bin dtui | ||
11 | |||
12 | memory-deny-write-execute | ||
13 | |||
14 | # Redirect | ||
15 | include dbus-debug-common.profile | ||
diff --git a/etc/profile-a-l/element-desktop.profile b/etc/profile-a-l/element-desktop.profile index 1af2884b6..52a439c48 100644 --- a/etc/profile-a-l/element-desktop.profile +++ b/etc/profile-a-l/element-desktop.profile | |||
@@ -14,6 +14,7 @@ noblacklist ${HOME}/.config/Element | |||
14 | mkdir ${HOME}/.config/Element | 14 | mkdir ${HOME}/.config/Element |
15 | whitelist ${HOME}/.config/Element | 15 | whitelist ${HOME}/.config/Element |
16 | whitelist /opt/Element | 16 | whitelist /opt/Element |
17 | whitelist /usr/share/element | ||
17 | 18 | ||
18 | dbus-user filter | 19 | dbus-user filter |
19 | dbus-user.talk org.freedesktop.Notifications | 20 | dbus-user.talk org.freedesktop.Notifications |
diff --git a/etc/profile-a-l/firefox-common-addons.profile b/etc/profile-a-l/firefox-common-addons.profile index ccc2dc7f6..5e3d0983d 100644 --- a/etc/profile-a-l/firefox-common-addons.profile +++ b/etc/profile-a-l/firefox-common-addons.profile | |||
@@ -92,8 +92,7 @@ include allow-python3.inc | |||
92 | #private-bin keepassxc-proxy | 92 | #private-bin keepassxc-proxy |
93 | 93 | ||
94 | # Flash plugin | 94 | # Flash plugin |
95 | # private-etc must first be enabled in firefox-common.profile and in profiles including it. | 95 | private-etc adobe |
96 | #private-etc adobe | ||
97 | 96 | ||
98 | # ff2mpv | 97 | # ff2mpv |
99 | #ignore noexec ${HOME} | 98 | #ignore noexec ${HOME} |
diff --git a/etc/profile-a-l/icecat.profile b/etc/profile-a-l/icecat.profile index b0a42fb77..19bda5454 100644 --- a/etc/profile-a-l/icecat.profile +++ b/etc/profile-a-l/icecat.profile | |||
@@ -14,8 +14,7 @@ whitelist ${HOME}/.cache/mozilla/icecat | |||
14 | whitelist ${HOME}/.mozilla | 14 | whitelist ${HOME}/.mozilla |
15 | whitelist /usr/share/icecat | 15 | whitelist /usr/share/icecat |
16 | 16 | ||
17 | # private-etc must first be enabled in firefox-common.profile | 17 | private-etc icecat |
18 | #private-etc icecat | ||
19 | 18 | ||
20 | # Redirect | 19 | # Redirect |
21 | include firefox-common.profile | 20 | include firefox-common.profile |
diff --git a/etc/profile-a-l/iceweasel.profile b/etc/profile-a-l/iceweasel.profile index badd2648a..d6a925a77 100644 --- a/etc/profile-a-l/iceweasel.profile +++ b/etc/profile-a-l/iceweasel.profile | |||
@@ -6,8 +6,7 @@ include iceweasel.local | |||
6 | # added by included profile | 6 | # added by included profile |
7 | #include globals.local | 7 | #include globals.local |
8 | 8 | ||
9 | # private-etc must first be enabled in firefox-common.profile | 9 | private-etc iceweasel |
10 | #private-etc iceweasel | ||
11 | 10 | ||
12 | # Redirect | 11 | # Redirect |
13 | include firefox.profile | 12 | include firefox.profile |
diff --git a/etc/profile-a-l/librewolf.profile b/etc/profile-a-l/librewolf.profile index 65a4a3787..8db82d364 100644 --- a/etc/profile-a-l/librewolf.profile +++ b/etc/profile-a-l/librewolf.profile | |||
@@ -27,9 +27,7 @@ whitelist /usr/share/librewolf | |||
27 | 27 | ||
28 | # Add the next line to your librewolf.local to enable private-bin (Arch Linux). | 28 | # Add the next line to your librewolf.local to enable private-bin (Arch Linux). |
29 | #private-bin dbus-launch,dbus-send,librewolf,sh | 29 | #private-bin dbus-launch,dbus-send,librewolf,sh |
30 | # Add the next line to your librewolf.local to enable private-etc. | 30 | private-etc librewolf |
31 | # Note: private-etc must first be enabled in firefox-common.local. | ||
32 | #private-etc librewolf | ||
33 | 31 | ||
34 | dbus-user filter | 32 | dbus-user filter |
35 | dbus-user.own io.gitlab.librewolf.* | 33 | dbus-user.own io.gitlab.librewolf.* |
diff --git a/etc/profile-m-z/okular.profile b/etc/profile-m-z/okular.profile index 9f4990246..645510124 100644 --- a/etc/profile-m-z/okular.profile +++ b/etc/profile-m-z/okular.profile | |||
@@ -58,7 +58,7 @@ protocol unix | |||
58 | seccomp | 58 | seccomp |
59 | tracelog | 59 | tracelog |
60 | 60 | ||
61 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,unar,unrar | 61 | private-bin kbuildsycoca4,kdeinit4,lpr,okular,ps2pdf,unar,unrar |
62 | private-dev | 62 | private-dev |
63 | private-etc @x11,cups | 63 | private-etc @x11,cups |
64 | # on KDE we need access to the real /tmp for data exchange with email clients | 64 | # on KDE we need access to the real /tmp for data exchange with email clients |
diff --git a/etc/profile-m-z/palemoon.profile b/etc/profile-m-z/palemoon.profile index 8917a9bc5..8e1a5daf5 100644 --- a/etc/profile-m-z/palemoon.profile +++ b/etc/profile-m-z/palemoon.profile | |||
@@ -21,8 +21,7 @@ seccomp | |||
21 | ignore seccomp | 21 | ignore seccomp |
22 | 22 | ||
23 | #private-bin palemoon | 23 | #private-bin palemoon |
24 | # private-etc must first be enabled in firefox-common.profile | 24 | private-etc palemoon |
25 | #private-etc palemoon | ||
26 | 25 | ||
27 | restrict-namespaces | 26 | restrict-namespaces |
28 | ignore restrict-namespaces | 27 | ignore restrict-namespaces |
diff --git a/etc/profile-m-z/ssh.profile b/etc/profile-m-z/ssh.profile index 62efa28db..1c4d85ea0 100644 --- a/etc/profile-m-z/ssh.profile +++ b/etc/profile-m-z/ssh.profile | |||
@@ -19,7 +19,8 @@ include disable-exec.inc | |||
19 | include disable-programs.inc | 19 | include disable-programs.inc |
20 | 20 | ||
21 | whitelist ${RUNUSER}/gcr/ssh | 21 | whitelist ${RUNUSER}/gcr/ssh |
22 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh | 22 | whitelist ${RUNUSER}/gnupg/S.gpg-agent.ssh # default gpg homedir setup |
23 | whitelist ${RUNUSER}/gnupg/*/S.gpg-agent.ssh # custom gpg homedir setup | ||
23 | whitelist ${RUNUSER}/keyring/ssh | 24 | whitelist ${RUNUSER}/keyring/ssh |
24 | include whitelist-usr-share-common.inc | 25 | include whitelist-usr-share-common.inc |
25 | include whitelist-runuser-common.inc | 26 | include whitelist-runuser-common.inc |
diff --git a/etc/profile-m-z/sway.profile b/etc/profile-m-z/sway.profile index f71905150..b7f90f6ad 100644 --- a/etc/profile-m-z/sway.profile +++ b/etc/profile-m-z/sway.profile | |||
@@ -10,6 +10,10 @@ include globals.local | |||
10 | noblacklist ${HOME}/.config/sway | 10 | noblacklist ${HOME}/.config/sway |
11 | # sway uses ~/.config/i3 as fallback if there is no ~/.config/sway | 11 | # sway uses ~/.config/i3 as fallback if there is no ~/.config/sway |
12 | noblacklist ${HOME}/.config/i3 | 12 | noblacklist ${HOME}/.config/i3 |
13 | # allow creation of IPC socket | ||
14 | noblacklist ${RUNUSER}/sway-ipc.* | ||
15 | noblacklist /tmp/sway-ipc.* | ||
16 | |||
13 | include disable-common.inc | 17 | include disable-common.inc |
14 | 18 | ||
15 | caps.drop all | 19 | caps.drop all |
diff --git a/etc/profile-m-z/waterfox.profile b/etc/profile-m-z/waterfox.profile index bf6f45e41..cf2fced64 100644 --- a/etc/profile-m-z/waterfox.profile +++ b/etc/profile-m-z/waterfox.profile | |||
@@ -21,9 +21,7 @@ whitelist /usr/share/waterfox | |||
21 | # waterfox requires a shell to launch on Arch. We can possibly remove sh though. | 21 | # waterfox requires a shell to launch on Arch. We can possibly remove sh though. |
22 | # Add the next line to your waterfox.local to enable private-bin. | 22 | # Add the next line to your waterfox.local to enable private-bin. |
23 | #private-bin bash,dbus-launch,dbus-send,env,sh,waterfox,waterfox-classic,waterfox-current,which | 23 | #private-bin bash,dbus-launch,dbus-send,env,sh,waterfox,waterfox-classic,waterfox-current,which |
24 | # Add the next line to your waterfox.local to enable private-etc. Note that private-etc must first be | 24 | private-etc waterfox |
25 | # enabled in your firefox-common.local. | ||
26 | #private-etc waterfox | ||
27 | 25 | ||
28 | # Redirect | 26 | # Redirect |
29 | include firefox-common.profile | 27 | include firefox-common.profile |
diff --git a/etc/profile-m-z/zoom.profile b/etc/profile-m-z/zoom.profile index 306212f85..430934df2 100644 --- a/etc/profile-m-z/zoom.profile +++ b/etc/profile-m-z/zoom.profile | |||
@@ -19,6 +19,7 @@ ignore dbus-system none | |||
19 | noblacklist ${HOME}/.config/zoom.conf | 19 | noblacklist ${HOME}/.config/zoom.conf |
20 | noblacklist ${HOME}/.config/zoomus.conf | 20 | noblacklist ${HOME}/.config/zoomus.conf |
21 | noblacklist ${HOME}/.zoom | 21 | noblacklist ${HOME}/.zoom |
22 | noblacklist ${DOCUMENTS} | ||
22 | 23 | ||
23 | nowhitelist ${DOWNLOADS} | 24 | nowhitelist ${DOWNLOADS} |
24 | 25 | ||
@@ -26,10 +27,12 @@ mkdir ${HOME}/.cache/zoom | |||
26 | mkfile ${HOME}/.config/zoom.conf | 27 | mkfile ${HOME}/.config/zoom.conf |
27 | mkfile ${HOME}/.config/zoomus.conf | 28 | mkfile ${HOME}/.config/zoomus.conf |
28 | mkdir ${HOME}/.zoom | 29 | mkdir ${HOME}/.zoom |
30 | mkdir ${HOME}/Documents/Zoom | ||
29 | whitelist ${HOME}/.cache/zoom | 31 | whitelist ${HOME}/.cache/zoom |
30 | whitelist ${HOME}/.config/zoom.conf | 32 | whitelist ${HOME}/.config/zoom.conf |
31 | whitelist ${HOME}/.config/zoomus.conf | 33 | whitelist ${HOME}/.config/zoomus.conf |
32 | whitelist ${HOME}/.zoom | 34 | whitelist ${HOME}/.zoom |
35 | whitelist ${HOME}/Documents/Zoom | ||
33 | 36 | ||
34 | # Disable for now, see https://github.com/netblue30/firejail/issues/3726 | 37 | # Disable for now, see https://github.com/netblue30/firejail/issues/3726 |
35 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl | 38 | #private-etc alternatives,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,machine-id,nsswitch.conf,pki,resolv.conf,ssl |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 8d0a30521..08170bee6 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -97,10 +97,11 @@ basilisk | |||
97 | bcompare | 97 | bcompare |
98 | beaker | 98 | beaker |
99 | bibletime | 99 | bibletime |
100 | bijiben | 100 | #bijiben # webkit2gtk-4.x requires bwrap (see #3647) |
101 | bitcoin-qt | 101 | bitcoin-qt |
102 | bitlbee | 102 | bitlbee |
103 | bitwarden | 103 | bitwarden |
104 | bitwarden-desktop | ||
104 | bleachbit | 105 | bleachbit |
105 | blender | 106 | blender |
106 | blender-2.8 | 107 | blender-2.8 |
@@ -227,6 +228,7 @@ dragon | |||
227 | drawio | 228 | drawio |
228 | drill | 229 | drill |
229 | dropbox | 230 | dropbox |
231 | dtui | ||
230 | easystroke | 232 | easystroke |
231 | ebook-convert | 233 | ebook-convert |
232 | ebook-edit | 234 | ebook-edit |
@@ -824,7 +826,7 @@ soffice | |||
824 | sol | 826 | sol |
825 | sound-juicer | 827 | sound-juicer |
826 | soundconverter | 828 | soundconverter |
827 | spectacle | 829 | #spectacle # may be broken on wayland (see #5127) |
828 | spectral | 830 | spectral |
829 | spotify | 831 | spotify |
830 | sqlitebrowser | 832 | sqlitebrowser |
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c index 430730374..1a6f23919 100644 --- a/src/firemon/procevent.c +++ b/src/firemon/procevent.c | |||
@@ -396,6 +396,8 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my | |||
396 | sprintf(lineptr, " sid "); | 396 | sprintf(lineptr, " sid "); |
397 | break; | 397 | break; |
398 | 398 | ||
399 | // Note: PROC_EVENT_COREDUMP only exists since Linux 3.10 (see #6414). | ||
400 | #ifdef PROC_EVENT_COREDUMP | ||
399 | case PROC_EVENT_COREDUMP: | 401 | case PROC_EVENT_COREDUMP: |
400 | pid = proc_ev->event_data.coredump.process_tgid; | 402 | pid = proc_ev->event_data.coredump.process_tgid; |
401 | #ifdef DEBUG_PRCTL | 403 | #ifdef DEBUG_PRCTL |
@@ -403,6 +405,7 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my | |||
403 | #endif | 405 | #endif |
404 | sprintf(lineptr, " coredump "); | 406 | sprintf(lineptr, " coredump "); |
405 | break; | 407 | break; |
408 | #endif /* PROC_EVENT_COREDUMP */ | ||
406 | 409 | ||
407 | case PROC_EVENT_COMM: | 410 | case PROC_EVENT_COMM: |
408 | pid = proc_ev->event_data.comm.process_tgid; | 411 | pid = proc_ev->event_data.comm.process_tgid; |
diff --git a/src/fshaper/fshaper.sh b/src/fshaper/fshaper.sh index cd2bf79bf..16a2485bf 100755 --- a/src/fshaper/fshaper.sh +++ b/src/fshaper/fshaper.sh | |||
@@ -3,13 +3,9 @@ | |||
3 | # Copyright (C) 2014-2024 Firejail Authors | 3 | # Copyright (C) 2014-2024 Firejail Authors |
4 | # License GPL v2 | 4 | # License GPL v2 |
5 | 5 | ||
6 | TCFILE="" | 6 | TCFILE="$(PATH=/usr/sbin:/sbin:/run/current-system/sw/bin command -v tc)" |
7 | if [ -x "/usr/sbin/tc" ]; then | 7 | if [ -z "$TCFILE" ]; then |
8 | TCFILE="/usr/sbin/tc" | 8 | echo "Error: traffic control utility (tc) not found" |
9 | elif [ -x "/sbin/tc" ]; then | ||
10 | TCFILE="/sbin/tc"; | ||
11 | else | ||
12 | echo "Error: traffic control utility (tc) not found"; | ||
13 | exit 1 | 9 | exit 1 |
14 | fi | 10 | fi |
15 | 11 | ||
diff --git a/src/man/firecfg.1.in b/src/man/firecfg.1.in index a50ed765e..e47014702 100644 --- a/src/man/firecfg.1.in +++ b/src/man/firecfg.1.in | |||
@@ -139,29 +139,6 @@ $ sudo firecfg --clean | |||
139 | /usr/local/bin/vlc removed | 139 | /usr/local/bin/vlc removed |
140 | .br | 140 | .br |
141 | [...] | 141 | [...] |
142 | .SH FILES | ||
143 | .PP | ||
144 | Configuration files are searched for and parsed in the following paths: | ||
145 | .PP | ||
146 | .RS | ||
147 | 1. /etc/firejail/firecfg.d/*.conf (in alphabetical order) | ||
148 | .br | ||
149 | 2. /etc/firejail/firecfg.config | ||
150 | .RE | ||
151 | .PP | ||
152 | The programs that are supported by default are listed in | ||
153 | /etc/firejail/firecfg.config. | ||
154 | It is recommended to leave it as is and put all customizations inside | ||
155 | /etc/firejail/firecfg.d/. | ||
156 | .PP | ||
157 | Profile files are also searched in the user configuration directory: | ||
158 | .PP | ||
159 | .RS | ||
160 | 3. ~/.config/firejail/*.profile | ||
161 | .RE | ||
162 | .PP | ||
163 | For every \fBPROGRAM.profile\fR file found, firecfg attempts to create a | ||
164 | symlink for "PROGRAM", as if "PROGRAM" was listed in a configuration file. | ||
165 | .SH SYNTAX | 142 | .SH SYNTAX |
166 | Configuration file syntax: | 143 | Configuration file syntax: |
167 | .PP | 144 | .PP |
@@ -200,6 +177,29 @@ following lines can to be used to ignore both: | |||
200 | .br | 177 | .br |
201 | !spectacle | 178 | !spectacle |
202 | .RE | 179 | .RE |
180 | .SH FILES | ||
181 | .PP | ||
182 | Configuration files are searched for and parsed in the following paths: | ||
183 | .PP | ||
184 | .RS | ||
185 | 1. /etc/firejail/firecfg.d/*.conf (in alphabetical order) | ||
186 | .br | ||
187 | 2. /etc/firejail/firecfg.config | ||
188 | .RE | ||
189 | .PP | ||
190 | The programs that are supported by default are listed in | ||
191 | /etc/firejail/firecfg.config. | ||
192 | It is recommended to leave it as is and put all customizations inside | ||
193 | /etc/firejail/firecfg.d/. | ||
194 | .PP | ||
195 | Profile files are also searched in the user configuration directory: | ||
196 | .PP | ||
197 | .RS | ||
198 | 3. ~/.config/firejail/*.profile | ||
199 | .RE | ||
200 | .PP | ||
201 | For every \fBPROGRAM.profile\fR file found, firecfg attempts to create a | ||
202 | symlink for "PROGRAM", as if "PROGRAM" was listed in a configuration file. | ||
203 | .SH LICENSE | 203 | .SH LICENSE |
204 | This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. | 204 | This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. |
205 | .PP | 205 | .PP |
diff --git a/src/man/firejail-profile.5.in b/src/man/firejail-profile.5.in index 89784a984..4d725ed99 100644 --- a/src/man/firejail-profile.5.in +++ b/src/man/firejail-profile.5.in | |||
@@ -668,20 +668,20 @@ Enable filtered access to the system DBus. Filters can be specified with the dbu | |||
668 | \fBdbus-system none | 668 | \fBdbus-system none |
669 | Disable access to the system DBus. Once access is disabled, it cannot be relaxed to filtering. | 669 | Disable access to the system DBus. Once access is disabled, it cannot be relaxed to filtering. |
670 | .TP | 670 | .TP |
671 | \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
672 | Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | ||
673 | .TP | ||
674 | \fBdbus-system.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
675 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | ||
676 | .TP | ||
671 | \fBdbus-system.own org.gnome.ghex.* | 677 | \fBdbus-system.own org.gnome.ghex.* |
672 | Allow the application to own the name org.gnome.ghex and all names underneath in on the system DBus. | 678 | Allow the application to own the name org.gnome.ghex and all names underneath in on the system DBus. |
673 | .TP | 679 | .TP |
674 | \fBdbus-system.talk org.freedesktop.Notifications | ||
675 | Allow the application to talk to the name org.freedesktop.Notifications on the system DBus. | ||
676 | .TP | ||
677 | \fBdbus-system.see org.freedesktop.Notifications | 680 | \fBdbus-system.see org.freedesktop.Notifications |
678 | Allow the application to see but not talk to the name org.freedesktop.Notifications on the system DBus. | 681 | Allow the application to see but not talk to the name org.freedesktop.Notifications on the system DBus. |
679 | .TP | 682 | .TP |
680 | \fBdbus-system.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | 683 | \fBdbus-system.talk org.freedesktop.Notifications |
681 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | 684 | Allow the application to talk to the name org.freedesktop.Notifications on the system DBus. |
682 | .TP | ||
683 | \fBdbus-system.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
684 | Allow the application to receive broadcast signals from the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the system DBus. | ||
685 | .TP | 685 | .TP |
686 | \fBdbus-user filter | 686 | \fBdbus-user filter |
687 | Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. | 687 | Enable filtered access to the session DBus. Filters can be specified with the dbus-user.talk and dbus-user.own commands. |
@@ -689,20 +689,20 @@ Enable filtered access to the session DBus. Filters can be specified with the db | |||
689 | \fBdbus-user none | 689 | \fBdbus-user none |
690 | Disable access to the session DBus. Once access is disabled, it cannot be relaxed to filtering. | 690 | Disable access to the session DBus. Once access is disabled, it cannot be relaxed to filtering. |
691 | .TP | 691 | .TP |
692 | \fBdbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
693 | Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus. | ||
694 | .TP | ||
695 | \fBdbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
696 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus. | ||
697 | .TP | ||
692 | \fBdbus-user.own org.gnome.ghex.* | 698 | \fBdbus-user.own org.gnome.ghex.* |
693 | Allow the application to own the name org.gnome.ghex and all names underneath in on the session DBus. | 699 | Allow the application to own the name org.gnome.ghex and all names underneath in on the session DBus. |
694 | .TP | 700 | .TP |
695 | \fBdbus-user.talk org.freedesktop.Notifications | ||
696 | Allow the application to talk to the name org.freedesktop.Notifications on the session DBus. | ||
697 | .TP | ||
698 | \fBdbus-user.see org.freedesktop.Notifications | 701 | \fBdbus-user.see org.freedesktop.Notifications |
699 | Allow the application to see but not talk to the name org.freedesktop.Notifications on the session DBus. | 702 | Allow the application to see but not talk to the name org.freedesktop.Notifications on the session DBus. |
700 | .TP | 703 | .TP |
701 | \fBdbus-user.call org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | 704 | \fBdbus-user.talk org.freedesktop.Notifications |
702 | Allow the application to call methods of the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus. | 705 | Allow the application to talk to the name org.freedesktop.Notifications on the session DBus. |
703 | .TP | ||
704 | \fBdbus-user.broadcast org.freedesktop.Notifications=org.freedesktop.Notifications.*@/org/freedesktop/Notifications | ||
705 | Allow the application to receive broadcast signals from the the interface org.freedesktop.Notifications of the object exposed at the path /org/freedesktop/Notifications by the client owning the bus name org.freedesktop.Notifications on the session DBus. | ||
706 | .TP | 706 | .TP |
707 | \fBnodbus \fR(deprecated) | 707 | \fBnodbus \fR(deprecated) |
708 | Disable D-Bus access (both system and session buses). Equivalent to dbus-system none and dbus-user none. | 708 | Disable D-Bus access (both system and session buses). Equivalent to dbus-system none and dbus-user none. |
@@ -867,20 +867,6 @@ net eth0 | |||
867 | ip 10.10.20.56 | 867 | ip 10.10.20.56 |
868 | 868 | ||
869 | .TP | 869 | .TP |
870 | \fBip none | ||
871 | No IP address and no default gateway are configured for the last interface | ||
872 | defined by a net command. Use this option | ||
873 | in case you intend to start an external DHCP client in the sandbox. | ||
874 | .br | ||
875 | |||
876 | .br | ||
877 | Example: | ||
878 | .br | ||
879 | net eth0 | ||
880 | .br | ||
881 | ip none | ||
882 | |||
883 | .TP | ||
884 | \fBip dhcp | 870 | \fBip dhcp |
885 | Acquire an IP address and default gateway for the last interface defined by a | 871 | Acquire an IP address and default gateway for the last interface defined by a |
886 | net command, as well as set the DNS servers according to the DHCP response. | 872 | net command, as well as set the DNS servers according to the DHCP response. |
@@ -908,6 +894,20 @@ a DHCP client and releasing the lease manually in conjunction with the | |||
908 | net none command. | 894 | net none command. |
909 | 895 | ||
910 | .TP | 896 | .TP |
897 | \fBip none | ||
898 | No IP address and no default gateway are configured for the last interface | ||
899 | defined by a net command. Use this option | ||
900 | in case you intend to start an external DHCP client in the sandbox. | ||
901 | .br | ||
902 | |||
903 | .br | ||
904 | Example: | ||
905 | .br | ||
906 | net eth0 | ||
907 | .br | ||
908 | ip none | ||
909 | |||
910 | .TP | ||
911 | \fBip6 address | 911 | \fBip6 address |
912 | Assign IPv6 addresses to the last network interface defined by a net command. | 912 | Assign IPv6 addresses to the last network interface defined by a net command. |
913 | .br | 913 | .br |
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in index f14eb6ec0..bf447be93 100644 --- a/src/man/firejail.1.in +++ b/src/man/firejail.1.in | |||
@@ -207,7 +207,7 @@ $ firejail \-\-blacklist=/sbin \-\-blacklist=/usr/sbin | |||
207 | .br | 207 | .br |
208 | $ firejail \-\-blacklist=~/.mozilla | 208 | $ firejail \-\-blacklist=~/.mozilla |
209 | .br | 209 | .br |
210 | $ firejail "\-\-blacklist=/home/username/My Virtual Machines" | 210 | $ firejail \-\-blacklist="/home/username/My Virtual Machines" |
211 | .br | 211 | .br |
212 | $ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines | 212 | $ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines |
213 | .TP | 213 | .TP |
@@ -611,8 +611,9 @@ Example: | |||
611 | $ firejail --dbus-user=filter --dbus-user.own=org.gnome.ghex.* | 611 | $ firejail --dbus-user=filter --dbus-user.own=org.gnome.ghex.* |
612 | 612 | ||
613 | .TP | 613 | .TP |
614 | \fB\-\-dbus-user.talk=name | 614 | \fB\-\-dbus-user.see=name |
615 | Allows the application to talk to the specified well-known name on the session DBus. | 615 | Allows the application to see, but not talk to the specified well-known name on |
616 | the session DBus. | ||
616 | The name may have a .* suffix to match all names underneath it, including itself | 617 | The name may have a .* suffix to match all names underneath it, including itself |
617 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | 618 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but |
618 | not "foobar"). | 619 | not "foobar"). |
@@ -621,14 +622,13 @@ not "foobar"). | |||
621 | .br | 622 | .br |
622 | Example: | 623 | Example: |
623 | .br | 624 | .br |
624 | $ firejail --dbus-user=filter --dbus-user.talk=\\ | 625 | $ firejail --dbus-user=filter --dbus-user.see=\\ |
625 | .br | 626 | .br |
626 | org.freedesktop.Notifications | 627 | org.freedesktop.Notifications |
627 | 628 | ||
628 | .TP | 629 | .TP |
629 | \fB\-\-dbus-user.see=name | 630 | \fB\-\-dbus-user.talk=name |
630 | Allows the application to see, but not talk to the specified well-known name on | 631 | Allows the application to talk to the specified well-known name on the session DBus. |
631 | the session DBus. | ||
632 | The name may have a .* suffix to match all names underneath it, including itself | 632 | The name may have a .* suffix to match all names underneath it, including itself |
633 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but | 633 | (e.g. "foo.bar.*" matches "foo.bar", "foo.bar.baz" and "foo.bar.baz.quux", but |
634 | not "foobar"). | 634 | not "foobar"). |
@@ -637,7 +637,7 @@ not "foobar"). | |||
637 | .br | 637 | .br |
638 | Example: | 638 | Example: |
639 | .br | 639 | .br |
640 | $ firejail --dbus-user=filter --dbus-user.see=\\ | 640 | $ firejail --dbus-user=filter --dbus-user.talk=\\ |
641 | .br | 641 | .br |
642 | org.freedesktop.Notifications | 642 | org.freedesktop.Notifications |
643 | #endif | 643 | #endif |
@@ -888,6 +888,32 @@ Example: | |||
888 | .br | 888 | .br |
889 | $ firejail \-\-hosts-file=~/myhosts firefox | 889 | $ firejail \-\-hosts-file=~/myhosts firefox |
890 | 890 | ||
891 | .TP | ||
892 | \fB\-\-icmptrace[=name|pid] | ||
893 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | ||
894 | created with \-\-net are supported. This option is only available when running the sandbox as root. | ||
895 | .br | ||
896 | |||
897 | .br | ||
898 | Without a name/pid, Firejail will monitor the main system network namespace. | ||
899 | .br | ||
900 | |||
901 | .br | ||
902 | Example | ||
903 | .br | ||
904 | $ sudo firejail --icmptrace | ||
905 | .br | ||
906 | 20:53:54 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0 | ||
907 | .br | ||
908 | 20:53:54 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0 | ||
909 | .br | ||
910 | 20:53:55 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0 | ||
911 | .br | ||
912 | 20:53:55 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0 | ||
913 | .br | ||
914 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable | ||
915 | .br | ||
916 | |||
891 | #ifdef HAVE_IDS | 917 | #ifdef HAVE_IDS |
892 | .TP | 918 | .TP |
893 | \fB\-\-ids-check | 919 | \fB\-\-ids-check |
@@ -925,32 +951,6 @@ $ firejail \-\-ignore="net eth0" firefox | |||
925 | #endif | 951 | #endif |
926 | 952 | ||
927 | .TP | 953 | .TP |
928 | \fB\-\-icmptrace[=name|pid] | ||
929 | Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes | ||
930 | created with \-\-net are supported. This option is only available when running the sandbox as root. | ||
931 | .br | ||
932 | |||
933 | .br | ||
934 | Without a name/pid, Firejail will monitor the main system network namespace. | ||
935 | .br | ||
936 | |||
937 | .br | ||
938 | Example | ||
939 | .br | ||
940 | $ sudo firejail --icmptrace | ||
941 | .br | ||
942 | 20:53:54 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0 | ||
943 | .br | ||
944 | 20:53:54 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0 | ||
945 | .br | ||
946 | 20:53:55 192.168.1.60 -> 142.250.65.174 - 98 bytes - Echo request/0 | ||
947 | .br | ||
948 | 20:53:55 142.250.65.174 -> 192.168.1.60 - 98 bytes - Echo reply/0 | ||
949 | .br | ||
950 | 20:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable | ||
951 | .br | ||
952 | |||
953 | .TP | ||
954 | \fB\-\-\include=file.profile | 954 | \fB\-\-\include=file.profile |
955 | Include a profile file before the regular profiles are used. | 955 | Include a profile file before the regular profiles are used. |
956 | .br | 956 | .br |
@@ -984,23 +984,6 @@ Example: | |||
984 | $ firejail \-\-net=eth0 \-\-ip=10.10.20.56 firefox | 984 | $ firejail \-\-net=eth0 \-\-ip=10.10.20.56 firefox |
985 | 985 | ||
986 | .TP | 986 | .TP |
987 | \fB\-\-ip=none | ||
988 | No IP address and no default gateway are configured for the last interface | ||
989 | defined by a \-\-net option. Use this option | ||
990 | in case you intend to start an external DHCP client in the sandbox. | ||
991 | .br | ||
992 | |||
993 | .br | ||
994 | Example: | ||
995 | .br | ||
996 | $ firejail \-\-net=eth0 \-\-\ip=none | ||
997 | .br | ||
998 | |||
999 | .br | ||
1000 | If the corresponding interface doesn't have an IP address configured, this | ||
1001 | option is enabled by default. | ||
1002 | |||
1003 | .TP | ||
1004 | \fB\-\-ip=dhcp | 987 | \fB\-\-ip=dhcp |
1005 | Acquire an IP address and default gateway for the last interface defined by a | 988 | Acquire an IP address and default gateway for the last interface defined by a |
1006 | \-\-net option, as well as set the DNS servers according to the DHCP response. | 989 | \-\-net option, as well as set the DNS servers according to the DHCP response. |
@@ -1026,6 +1009,23 @@ a DHCP client and releasing the lease manually in conjunction with the | |||
1026 | \-\-net=none option. | 1009 | \-\-net=none option. |
1027 | 1010 | ||
1028 | .TP | 1011 | .TP |
1012 | \fB\-\-ip=none | ||
1013 | No IP address and no default gateway are configured for the last interface | ||
1014 | defined by a \-\-net option. Use this option | ||
1015 | in case you intend to start an external DHCP client in the sandbox. | ||
1016 | .br | ||
1017 | |||
1018 | .br | ||
1019 | Example: | ||
1020 | .br | ||
1021 | $ firejail \-\-net=eth0 \-\-\ip=none | ||
1022 | .br | ||
1023 | |||
1024 | .br | ||
1025 | If the corresponding interface doesn't have an IP address configured, this | ||
1026 | option is enabled by default. | ||
1027 | |||
1028 | .TP | ||
1029 | \fB\-\-ip6=address | 1029 | \fB\-\-ip6=address |
1030 | Assign IPv6 addresses to the last network interface defined by a \-\-net option. | 1030 | Assign IPv6 addresses to the last network interface defined by a \-\-net option. |
1031 | .br | 1031 | .br |
@@ -1324,6 +1324,21 @@ Example: | |||
1324 | $ firejail \-\-machine-id | 1324 | $ firejail \-\-machine-id |
1325 | 1325 | ||
1326 | .TP | 1326 | .TP |
1327 | \fB\-\-memory-deny-write-execute | ||
1328 | Install a seccomp filter to block attempts to create memory mappings | ||
1329 | that are both writable and executable, to change mappings to be | ||
1330 | executable, or to create executable shared memory. The filter examines | ||
1331 | the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create | ||
1332 | and shmat system calls and returns error EPERM to the process (or | ||
1333 | kills it or log the attempt, see \-\-seccomp-error-action below) if necessary. | ||
1334 | .br | ||
1335 | |||
1336 | .br | ||
1337 | Note: shmat is not implemented | ||
1338 | as a system call on some platforms including i386, and it cannot be | ||
1339 | handled by seccomp-bpf. | ||
1340 | |||
1341 | .TP | ||
1327 | \fB\-\-mkdir=dirname | 1342 | \fB\-\-mkdir=dirname |
1328 | Create a directory in user home. Parent directories are created as needed. | 1343 | Create a directory in user home. Parent directories are created as needed. |
1329 | .br | 1344 | .br |
@@ -1343,20 +1358,6 @@ Example: | |||
1343 | .br | 1358 | .br |
1344 | $ firejail --mkfile=~/work/project/readme | 1359 | $ firejail --mkfile=~/work/project/readme |
1345 | 1360 | ||
1346 | .TP | ||
1347 | \fB\-\-memory-deny-write-execute | ||
1348 | Install a seccomp filter to block attempts to create memory mappings | ||
1349 | that are both writable and executable, to change mappings to be | ||
1350 | executable, or to create executable shared memory. The filter examines | ||
1351 | the arguments of mmap, mmap2, mprotect, pkey_mprotect, memfd_create | ||
1352 | and shmat system calls and returns error EPERM to the process (or | ||
1353 | kills it or log the attempt, see \-\-seccomp-error-action below) if necessary. | ||
1354 | .br | ||
1355 | |||
1356 | .br | ||
1357 | Note: shmat is not implemented | ||
1358 | as a system call on some platforms including i386, and it cannot be | ||
1359 | handled by seccomp-bpf. | ||
1360 | #ifdef HAVE_NETWORK | 1361 | #ifdef HAVE_NETWORK |
1361 | .TP | 1362 | .TP |
1362 | \fB\-\-mtu=number | 1363 | \fB\-\-mtu=number |
@@ -1792,15 +1793,6 @@ Example: | |||
1792 | .br | 1793 | .br |
1793 | $ firejail \-\-nodvd | 1794 | $ firejail \-\-nodvd |
1794 | .TP | 1795 | .TP |
1795 | \fB\-\-noinput | ||
1796 | Disable input devices. | ||
1797 | .br | ||
1798 | |||
1799 | .br | ||
1800 | Example: | ||
1801 | .br | ||
1802 | $ firejail \-\-noinput | ||
1803 | .TP | ||
1804 | \fB\-\-noexec=dirname_or_filename | 1796 | \fB\-\-noexec=dirname_or_filename |
1805 | Remount directory or file noexec, nodev and nosuid. File globbing is supported, see \fBFILE GLOBBING\fR section for more details. | 1797 | Remount directory or file noexec, nodev and nosuid. File globbing is supported, see \fBFILE GLOBBING\fR section for more details. |
1806 | .br | 1798 | .br |
@@ -1845,6 +1837,16 @@ uid=1000(netblue) gid=1000(netblue) groups=1000(netblue) | |||
1845 | $ | 1837 | $ |
1846 | 1838 | ||
1847 | .TP | 1839 | .TP |
1840 | \fB\-\-noinput | ||
1841 | Disable input devices. | ||
1842 | .br | ||
1843 | |||
1844 | .br | ||
1845 | Example: | ||
1846 | .br | ||
1847 | $ firejail \-\-noinput | ||
1848 | |||
1849 | .TP | ||
1848 | \fB\-\-nonewprivs | 1850 | \fB\-\-nonewprivs |
1849 | Sets the NO_NEW_PRIVS prctl. This ensures that child processes | 1851 | Sets the NO_NEW_PRIVS prctl. This ensures that child processes |
1850 | cannot acquire new privileges using execve(2); in particular, | 1852 | cannot acquire new privileges using execve(2); in particular, |
@@ -3143,7 +3145,9 @@ $ firejail \-\-noprofile \-\-whitelist=~/.mozilla | |||
3143 | .br | 3145 | .br |
3144 | $ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null | 3146 | $ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null |
3145 | .br | 3147 | .br |
3146 | $ firejail "\-\-whitelist=/home/username/My Virtual Machines" | 3148 | $ firejail \-\-whitelist="/home/username/My Virtual Machines" |
3149 | .br | ||
3150 | $ firejail \-\-whitelist=/home/username/My\\ Virtual\\ Machines | ||
3147 | .br | 3151 | .br |
3148 | $ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups* | 3152 | $ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups* |
3149 | 3153 | ||
@@ -3351,16 +3355,6 @@ $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox | |||
3351 | .br | 3355 | .br |
3352 | #endif | 3356 | #endif |
3353 | .\" Note: Keep this in sync with invalid_name() in src/firejail/util.c. | 3357 | .\" Note: Keep this in sync with invalid_name() in src/firejail/util.c. |
3354 | .SH NAME VALIDATION | ||
3355 | For simplicity, the same name validation is used for multiple options. | ||
3356 | Rules: | ||
3357 | .PP | ||
3358 | The name must be 1-253 characters long. | ||
3359 | The name can only contain ASCII letters, digits and the special characters | ||
3360 | "-._" (that is, the name cannot contain spaces or control characters). | ||
3361 | The name cannot contain only digits. | ||
3362 | The first and last characters must be an ASCII letter or digit and the name | ||
3363 | may contain special characters in the middle. | ||
3364 | #ifdef HAVE_APPARMOR | 3358 | #ifdef HAVE_APPARMOR |
3365 | .SH APPARMOR | 3359 | .SH APPARMOR |
3366 | .TP | 3360 | .TP |
@@ -3406,64 +3400,6 @@ To enable AppArmor confinement on top of your current Firejail security features | |||
3406 | $ firejail --apparmor firefox | 3400 | $ firejail --apparmor firefox |
3407 | #endif | 3401 | #endif |
3408 | 3402 | ||
3409 | #ifdef HAVE_LANDLOCK | ||
3410 | .SH LANDLOCK | ||
3411 | Warning: Landlock support in firejail is considered experimental and unstable. | ||
3412 | The contents of landlock-common.inc are likely to change and the feature is | ||
3413 | still being expanded upon in the Linux kernel. | ||
3414 | Also, note that its functionality overlaps with existing firejail features, | ||
3415 | such as the \fBblacklist\fR, \fBread-only\fR and \fBread-write\fR commands. | ||
3416 | Its filesystem access rules can currently only restrict direct access to paths; | ||
3417 | it is not able to make only select paths appear in the sandbox such as with the | ||
3418 | \fBwhitelist\fR and \fBprivate-etc\fR commands (see also unveil(2) on OpenBSD). | ||
3419 | Lastly, note that depending on the Linux kernel version, Landlock may not | ||
3420 | protect all of the relevant syscalls (see the kernel's Landlock documentation | ||
3421 | for details). | ||
3422 | Therefore, it is recommended to treat Landlock as an extra layer of protection, | ||
3423 | to be used together with other firejail features (rather than as a bulletproof | ||
3424 | mechanism by itself). | ||
3425 | .PP | ||
3426 | Landlock is a Linux security module first introduced in version 5.13 of the | ||
3427 | Linux kernel. | ||
3428 | It allows unprivileged processes to restrict their access to the filesystem. | ||
3429 | Once imposed, these restrictions can never be removed, and all child processes | ||
3430 | created by a Landlock-restricted processes inherit these restrictions. | ||
3431 | Firejail supports Landlock as an additional sandboxing feature. | ||
3432 | It can be used to ensure that a sandboxed application can only access files and | ||
3433 | directories that it was explicitly allowed to access. | ||
3434 | Firejail supports populating the ruleset with both a basic set of rules (see | ||
3435 | landlock-common.inc) and with a custom set of rules. | ||
3436 | .TP | ||
3437 | Important notes: | ||
3438 | .PP | ||
3439 | .RS | ||
3440 | - Currently only Landlock ABI version 1 is supported. | ||
3441 | .PP | ||
3442 | - If "lsm=" is used in the kernel command line, it should contain "landlock" | ||
3443 | (such as "lsm=apparmor,landlock"), or else it will be disabled. | ||
3444 | .PP | ||
3445 | - A process can install a Landlock ruleset only if it has either | ||
3446 | \fBCAP_SYS_ADMIN\fR in its effective capability set, or the "No New | ||
3447 | Privileges" restriction enabled. | ||
3448 | Because of this, enabling the Landlock feature will also cause Firejail to | ||
3449 | enable the "No New Privileges" restriction, regardless of the profile or the | ||
3450 | \fB\-\-nonewprivs\fR command line option. | ||
3451 | .PP | ||
3452 | - Access to the /etc directory is automatically allowed. | ||
3453 | To override this, use the \fB\-\-writable\-etc\fR command line option. | ||
3454 | You can also use the \fB\-\-private\-etc\fR option to restrict access to the | ||
3455 | /etc directory. | ||
3456 | .RE | ||
3457 | .PP | ||
3458 | To enable Landlock self-restriction on top of your current Firejail security | ||
3459 | features, pass \fB\-\-landlock.enforce\fR flag to Firejail command line. | ||
3460 | Without it, the other Landlock commands have no effect. | ||
3461 | Example: | ||
3462 | .PP | ||
3463 | $ firejail \-\-landlock.enforce \-\-landlock.fs.read=/media mc | ||
3464 | .PP | ||
3465 | To disable Landlock self-restriction, use \fB\-\-ignore=landlock.enforce\fR. | ||
3466 | #endif | ||
3467 | .SH DESKTOP INTEGRATION | 3403 | .SH DESKTOP INTEGRATION |
3468 | A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. | 3404 | A symbolic link to /usr/bin/firejail under the name of a program, will start the program in Firejail sandbox. |
3469 | The symbolic link should be placed in the first $PATH position. On most systems, a good place | 3405 | The symbolic link should be placed in the first $PATH position. On most systems, a good place |
@@ -3711,6 +3647,65 @@ Currently while scanning the file system, symbolic links are not followed, and f | |||
3711 | The program can also be run as root (sudo firejail --ids-init/--ids-check). | 3647 | The program can also be run as root (sudo firejail --ids-init/--ids-check). |
3712 | #endif | 3648 | #endif |
3713 | 3649 | ||
3650 | #ifdef HAVE_LANDLOCK | ||
3651 | .SH LANDLOCK | ||
3652 | Warning: Landlock support in firejail is considered experimental and unstable. | ||
3653 | The contents of landlock-common.inc are likely to change and the feature is | ||
3654 | still being expanded upon in the Linux kernel. | ||
3655 | Also, note that its functionality overlaps with existing firejail features, | ||
3656 | such as the \fBblacklist\fR, \fBread-only\fR and \fBread-write\fR commands. | ||
3657 | Its filesystem access rules can currently only restrict direct access to paths; | ||
3658 | it is not able to make only select paths appear in the sandbox such as with the | ||
3659 | \fBwhitelist\fR and \fBprivate-etc\fR commands (see also unveil(2) on OpenBSD). | ||
3660 | Lastly, note that depending on the Linux kernel version, Landlock may not | ||
3661 | protect all of the relevant syscalls (see the kernel's Landlock documentation | ||
3662 | for details). | ||
3663 | Therefore, it is recommended to treat Landlock as an extra layer of protection, | ||
3664 | to be used together with other firejail features (rather than as a bulletproof | ||
3665 | mechanism by itself). | ||
3666 | .PP | ||
3667 | Landlock is a Linux security module first introduced in version 5.13 of the | ||
3668 | Linux kernel. | ||
3669 | It allows unprivileged processes to restrict their access to the filesystem. | ||
3670 | Once imposed, these restrictions can never be removed, and all child processes | ||
3671 | created by a Landlock-restricted processes inherit these restrictions. | ||
3672 | Firejail supports Landlock as an additional sandboxing feature. | ||
3673 | It can be used to ensure that a sandboxed application can only access files and | ||
3674 | directories that it was explicitly allowed to access. | ||
3675 | Firejail supports populating the ruleset with both a basic set of rules (see | ||
3676 | landlock-common.inc) and with a custom set of rules. | ||
3677 | .TP | ||
3678 | Important notes: | ||
3679 | .PP | ||
3680 | .RS | ||
3681 | - Currently only Landlock ABI version 1 is supported. | ||
3682 | .PP | ||
3683 | - If "lsm=" is used in the kernel command line, it should contain "landlock" | ||
3684 | (such as "lsm=apparmor,landlock"), or else it will be disabled. | ||
3685 | .PP | ||
3686 | - A process can install a Landlock ruleset only if it has either | ||
3687 | \fBCAP_SYS_ADMIN\fR in its effective capability set, or the "No New | ||
3688 | Privileges" restriction enabled. | ||
3689 | Because of this, enabling the Landlock feature will also cause Firejail to | ||
3690 | enable the "No New Privileges" restriction, regardless of the profile or the | ||
3691 | \fB\-\-nonewprivs\fR command line option. | ||
3692 | .PP | ||
3693 | - Access to the /etc directory is automatically allowed. | ||
3694 | To override this, use the \fB\-\-writable\-etc\fR command line option. | ||
3695 | You can also use the \fB\-\-private\-etc\fR option to restrict access to the | ||
3696 | /etc directory. | ||
3697 | .RE | ||
3698 | .PP | ||
3699 | To enable Landlock self-restriction on top of your current Firejail security | ||
3700 | features, pass \fB\-\-landlock.enforce\fR flag to Firejail command line. | ||
3701 | Without it, the other Landlock commands have no effect. | ||
3702 | Example: | ||
3703 | .PP | ||
3704 | $ firejail \-\-landlock.enforce \-\-landlock.fs.read=/media mc | ||
3705 | .PP | ||
3706 | To disable Landlock self-restriction, use \fB\-\-ignore=landlock.enforce\fR. | ||
3707 | #endif | ||
3708 | |||
3714 | .SH MONITORING | 3709 | .SH MONITORING |
3715 | Option \-\-list prints a list of all sandboxes. The format | 3710 | Option \-\-list prints a list of all sandboxes. The format |
3716 | for each process entry is as follows: | 3711 | for each process entry is as follows: |
@@ -3768,6 +3763,17 @@ Sandbox running time in hours:minutes:seconds format. | |||
3768 | USER | 3763 | USER |
3769 | The owner of the sandbox. | 3764 | The owner of the sandbox. |
3770 | 3765 | ||
3766 | .SH NAME VALIDATION | ||
3767 | For simplicity, the same name validation is used for multiple options. | ||
3768 | Rules: | ||
3769 | .PP | ||
3770 | The name must be 1-253 characters long. | ||
3771 | The name can only contain ASCII letters, digits and the special characters | ||
3772 | "-._" (that is, the name cannot contain spaces or control characters). | ||
3773 | The name cannot contain only digits. | ||
3774 | The first and last characters must be an ASCII letter or digit and the name | ||
3775 | may contain special characters in the middle. | ||
3776 | |||
3771 | .SH RESTRICTED SHELL | 3777 | .SH RESTRICTED SHELL |
3772 | To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in | 3778 | To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in |
3773 | /etc/passwd file for each user that needs to be restricted. Alternatively, | 3779 | /etc/passwd file for each user that needs to be restricted. Alternatively, |
diff --git a/src/man/mkman.sh b/src/man/mkman.sh index 00c4ffe72..d854b6537 100755 --- a/src/man/mkman.sh +++ b/src/man/mkman.sh | |||
@@ -5,8 +5,15 @@ | |||
5 | 5 | ||
6 | set -e | 6 | set -e |
7 | 7 | ||
8 | MONTH="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%b)" | 8 | test -z "$SOURCE_DATE_EPOCH" && SOURCE_DATE_EPOCH="$(date +%s)" |
9 | YEAR="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y)" | 9 | |
10 | format='+%b %Y' | ||
11 | date="$(LC_ALL=C date -u -d "@$SOURCE_DATE_EPOCH" "$format" 2>/dev/null || | ||
12 | LC_ALL=C date -u -r "$SOURCE_DATE_EPOCH" "$format" 2>/dev/null || | ||
13 | LC_ALL=C date -u "$format")" | ||
14 | |||
15 | MONTH="$(printf '%s\n' "$date" | cut -f 1 -d ' ')" | ||
16 | YEAR="$(printf '%s\n' "$date" | cut -f 2 -d ' ')" | ||
10 | 17 | ||
11 | sed \ | 18 | sed \ |
12 | -e "s/VERSION/$1/g" \ | 19 | -e "s/VERSION/$1/g" \ |