aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--README5
-rw-r--r--README.md34
-rw-r--r--RELNOTES5
-rwxr-xr-xconfigure18
-rw-r--r--configure.ac2
-rw-r--r--etc/QMediathekView.profile54
-rw-r--r--etc/aria2c.profile45
-rw-r--r--etc/authenticator.profile49
-rw-r--r--etc/checkbashisms.profile49
-rw-r--r--etc/claws-mail.profile5
-rw-r--r--etc/desktop.profile44
-rw-r--r--etc/devilspie.profile49
-rw-r--r--etc/devilspie2.profile49
-rw-r--r--etc/disable-programs.inc9
-rw-r--r--etc/easystroke.profile45
-rw-r--r--etc/file.profile4
-rw-r--r--etc/min.profile50
-rw-r--r--etc/strings.profile4
-rw-r--r--src/firecfg/firecfg.config5
-rw-r--r--src/firejail/firejail.h2
-rw-r--r--src/firejail/fs.c22
-rw-r--r--src/firejail/sandbox.c6
22 files changed, 533 insertions, 22 deletions
diff --git a/README b/README
index ba29905f0..c3a046ead 100644
--- a/README
+++ b/README
@@ -33,14 +33,15 @@ Maintainer:
33- netblue30 (netblue30@yahoo.com) 33- netblue30 (netblue30@yahoo.com)
34 34
35Committers 35Committers
36- chiraag-nataraj (https://github.com/chiraag-nataraj)
37- crass (https://github.com/crass)
36- Fred-Barclay (https://github.com/Fred-Barclay) 38- Fred-Barclay (https://github.com/Fred-Barclay)
37- Reiner Herrmann (https://github.com/reinerh - Debian/Ubuntu maintainer) 39- Reiner Herrmann (https://github.com/reinerh - Debian/Ubuntu maintainer)
38- smithsohu (https://github.com/smitsohu) 40- smithsohu (https://github.com/smitsohu)
39- SkewedZeppelin (https://github.com/SkewedZeppelin) 41- SkewedZeppelin (https://github.com/SkewedZeppelin)
40- startx2017 (https://github.com/startx2017) - 0.9.38-LTS and *bugfixes branches maintainer) 42- startx2017 (https://github.com/startx2017) - LTS and *bugfixes branches maintainer)
41- Topi Miettinen (https://github.com/topimiettinen) 43- Topi Miettinen (https://github.com/topimiettinen)
42- Vincent43 (https://github.com/Vincent43) 44- Vincent43 (https://github.com/Vincent43)
43- chiraag-nataraj (https://github.com/chiraag-nataraj)
44- netblue30 (netblue30@yahoo.com) 45- netblue30 (netblue30@yahoo.com)
45 46
46 47
diff --git a/README.md b/README.md
index 0c3cd38bb..e5b38827d 100644
--- a/README.md
+++ b/README.md
@@ -98,4 +98,36 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe
98````` 98`````
99 99
100````` 100`````
101# Current development version: 0.9.57 101# Current development version: 0.9.56.1
102
103This is probably a bugfix release: fixes, small features, new profiles. If we end up implementing something major
104we'll switch to a regular 0.9.57 release.
105
106# New Long Term Support (LTS) version
107
108We are rebasing our Long Term Support branch of Firejail. The current LTS version (0.9.38.x) is more than two years old.
109The new version updates the code base to 0.9.56. We target a reduction of approx. 40% of the code by removing rarely
110used features (chroot, overlay, rlimits, cgroups), incomplete features (private-bin, private-lib),
111and a lot of instrumentation (build profile feature, tracing, auditing, etc). Sandbox-specific security features such as
112seccomp, capabilities, filesystem whitelist/blacklist and networking are updated and hardened.
113
114We have an rc1 release out, the final version will follow in the next few weeks:
115`````
116firejail (0.9.56-LTS~rc1) baseline; urgency=low
117 * code based on Firejail version 0.9.56
118 * much smaller code base for SUID executable
119 * command line options removed:
120 --audit, --build, --cgroup, --chroot, --get, --ls, --output,
121 --output-stderr, --overlay, --overlay-named, --overlay-tmpfs,
122 --overlay-clean, --private-home, --private-bin, --private-etc,
123 --private-opt, --private-srv, --put, --rlimit*, --trace, --tracelog,
124 --x11*, --xephyr*
125 * compile-time options: --enable-apparmor, --disable-seccomp,
126 --disable-globalcfg, --disable-network, --disable-userns,
127 --disable-whitelist, --disable-suid, --enable-fatal-warnings,
128 --enable-busybox-workaround
129 -- netblue30 <netblue30@yahoo.com> Wed, 3 Oct 2018 08:00:00 -0500
130`````
131
132The new LTS branch is here: https://github.com/netblue30/firejail/tree/LTSbase
133
diff --git a/RELNOTES b/RELNOTES
index 98398e51f..e3e3cdf35 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -1,3 +1,8 @@
1firejail (0.9.56.1) baseline; urgency=low
2 * work in progress
3 * --disable-mnt rework
4 -- netblue30 <netblue30@yahoo.com> Thu, 11 Oct 2018 08:00:00 -0500
5
1firejail (0.9.56) baseline; urgency=low 6firejail (0.9.56) baseline; urgency=low
2 * modif: removed CFG_CHROOT_DESKTOP configuration option 7 * modif: removed CFG_CHROOT_DESKTOP configuration option
3 * modif: removed compile time --enable-network=restricted 8 * modif: removed compile time --enable-network=restricted
diff --git a/configure b/configure
index a7ef3a392..9e117dcbe 100755
--- a/configure
+++ b/configure
@@ -1,6 +1,6 @@
1#! /bin/sh 1#! /bin/sh
2# Guess values for system-dependent variables and create Makefiles. 2# Guess values for system-dependent variables and create Makefiles.
3# Generated by GNU Autoconf 2.69 for firejail 0.9.57. 3# Generated by GNU Autoconf 2.69 for firejail 0.9.56.1.
4# 4#
5# Report bugs to <netblue30@yahoo.com>. 5# Report bugs to <netblue30@yahoo.com>.
6# 6#
@@ -580,8 +580,8 @@ MAKEFLAGS=
580# Identity of this package. 580# Identity of this package.
581PACKAGE_NAME='firejail' 581PACKAGE_NAME='firejail'
582PACKAGE_TARNAME='firejail' 582PACKAGE_TARNAME='firejail'
583PACKAGE_VERSION='0.9.57' 583PACKAGE_VERSION='0.9.56.1'
584PACKAGE_STRING='firejail 0.9.57' 584PACKAGE_STRING='firejail 0.9.56.1'
585PACKAGE_BUGREPORT='netblue30@yahoo.com' 585PACKAGE_BUGREPORT='netblue30@yahoo.com'
586PACKAGE_URL='https://firejail.wordpress.com' 586PACKAGE_URL='https://firejail.wordpress.com'
587 587
@@ -1275,7 +1275,7 @@ if test "$ac_init_help" = "long"; then
1275 # Omit some internal or obsolete options to make the list less imposing. 1275 # Omit some internal or obsolete options to make the list less imposing.
1276 # This message is too long to be a string in the A/UX 3.1 sh. 1276 # This message is too long to be a string in the A/UX 3.1 sh.
1277 cat <<_ACEOF 1277 cat <<_ACEOF
1278\`configure' configures firejail 0.9.57 to adapt to many kinds of systems. 1278\`configure' configures firejail 0.9.56.1 to adapt to many kinds of systems.
1279 1279
1280Usage: $0 [OPTION]... [VAR=VALUE]... 1280Usage: $0 [OPTION]... [VAR=VALUE]...
1281 1281
@@ -1337,7 +1337,7 @@ fi
1337 1337
1338if test -n "$ac_init_help"; then 1338if test -n "$ac_init_help"; then
1339 case $ac_init_help in 1339 case $ac_init_help in
1340 short | recursive ) echo "Configuration of firejail 0.9.57:";; 1340 short | recursive ) echo "Configuration of firejail 0.9.56.1:";;
1341 esac 1341 esac
1342 cat <<\_ACEOF 1342 cat <<\_ACEOF
1343 1343
@@ -1442,7 +1442,7 @@ fi
1442test -n "$ac_init_help" && exit $ac_status 1442test -n "$ac_init_help" && exit $ac_status
1443if $ac_init_version; then 1443if $ac_init_version; then
1444 cat <<\_ACEOF 1444 cat <<\_ACEOF
1445firejail configure 0.9.57 1445firejail configure 0.9.56.1
1446generated by GNU Autoconf 2.69 1446generated by GNU Autoconf 2.69
1447 1447
1448Copyright (C) 2012 Free Software Foundation, Inc. 1448Copyright (C) 2012 Free Software Foundation, Inc.
@@ -1744,7 +1744,7 @@ cat >config.log <<_ACEOF
1744This file contains any messages produced by compilers while 1744This file contains any messages produced by compilers while
1745running configure, to aid debugging if configure makes a mistake. 1745running configure, to aid debugging if configure makes a mistake.
1746 1746
1747It was created by firejail $as_me 0.9.57, which was 1747It was created by firejail $as_me 0.9.56.1, which was
1748generated by GNU Autoconf 2.69. Invocation command line was 1748generated by GNU Autoconf 2.69. Invocation command line was
1749 1749
1750 $ $0 $@ 1750 $ $0 $@
@@ -4379,7 +4379,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
4379# report actual input values of CONFIG_FILES etc. instead of their 4379# report actual input values of CONFIG_FILES etc. instead of their
4380# values after options handling. 4380# values after options handling.
4381ac_log=" 4381ac_log="
4382This file was extended by firejail $as_me 0.9.57, which was 4382This file was extended by firejail $as_me 0.9.56.1, which was
4383generated by GNU Autoconf 2.69. Invocation command line was 4383generated by GNU Autoconf 2.69. Invocation command line was
4384 4384
4385 CONFIG_FILES = $CONFIG_FILES 4385 CONFIG_FILES = $CONFIG_FILES
@@ -4433,7 +4433,7 @@ _ACEOF
4433cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 4433cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
4434ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" 4434ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
4435ac_cs_version="\\ 4435ac_cs_version="\\
4436firejail config.status 0.9.57 4436firejail config.status 0.9.56.1
4437configured by $0, generated by GNU Autoconf 2.69, 4437configured by $0, generated by GNU Autoconf 2.69,
4438 with options \\"\$ac_cs_config\\" 4438 with options \\"\$ac_cs_config\\"
4439 4439
diff --git a/configure.ac b/configure.ac
index d1b827fef..2084b66f1 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,5 +1,5 @@
1AC_PREREQ([2.68]) 1AC_PREREQ([2.68])
2AC_INIT(firejail, 0.9.57, netblue30@yahoo.com, , https://firejail.wordpress.com) 2AC_INIT(firejail, 0.9.56.1, netblue30@yahoo.com, , https://firejail.wordpress.com)
3AC_CONFIG_SRCDIR([src/firejail/main.c]) 3AC_CONFIG_SRCDIR([src/firejail/main.c])
4#AC_CONFIG_HEADERS([config.h]) 4#AC_CONFIG_HEADERS([config.h])
5 5
diff --git a/etc/QMediathekView.profile b/etc/QMediathekView.profile
new file mode 100644
index 000000000..558f62f0e
--- /dev/null
+++ b/etc/QMediathekView.profile
@@ -0,0 +1,54 @@
1# Firejail profile for QMediathekView
2# Description: Search, download or stream files from mediathek.de
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/QMediathekView.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.config/QMediathekView
10noblacklist ${HOME}/.local/share/QMediathekView
11
12noblacklist ${HOME}/.config/mpv
13noblacklist ${HOME}/.config/smplayer
14noblacklist ${HOME}/.config/totem
15noblacklist ${HOME}/.config/vlc
16noblacklist ${HOME}/.config/xplayer
17noblacklist ${HOME}/.local/share/totem
18noblacklist ${HOME}/.local/share/xplayer
19noblacklist ${HOME}/.mplayer
20
21include /etc/firejail/disable-common.inc
22include /etc/firejail/disable-devel.inc
23include /etc/firejail/disable-interpreters.inc
24include /etc/firejail/disable-passwdmgr.inc
25include /etc/firejail/disable-programs.inc
26
27include /etc/firejail/whitelist-var-common.inc
28
29caps.drop all
30netfilter
31# no3d
32# nodbus
33nodvd
34nogroups
35nonewprivs
36noroot
37notv
38nou2f
39protocol unix,inet,inet6
40seccomp
41shell none
42tracelog
43
44disable-mnt
45private-bin QMediathekView,mplayer,mpv,smplayer,totem,vlc,xplayer
46private-cache
47private-dev
48# private-etc none
49# private-lib
50private-tmp
51
52# memory-deny-write-execute - breaks on Arch
53noexec ${HOME}
54noexec /tmp
diff --git a/etc/aria2c.profile b/etc/aria2c.profile
new file mode 100644
index 000000000..4231c58ff
--- /dev/null
+++ b/etc/aria2c.profile
@@ -0,0 +1,45 @@
1# Firejail profile for aria2c
2# Description: Download utility that supports HTTP(S), FTP, BitTorrent and Metalink
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/aria2c.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.aria2
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-interpreters.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16include /etc/firejail/disable-xdg.inc
17
18caps.drop all
19ipc-namespace
20netfilter
21no3d
22nodbus
23nodvd
24nogroups
25nonewprivs
26noroot
27nosound
28notv
29novideo
30protocol unix,inet,inet6
31seccomp
32shell none
33
34disable-mnt
35# private
36private-bin aria2c,gzip
37private-cache
38private-dev
39private-etc ca-certificates,ssl
40private-lib libreadline.so.*
41private-tmp
42
43memory-deny-write-execute
44noexec ${HOME}
45noexec /tmp
diff --git a/etc/authenticator.profile b/etc/authenticator.profile
new file mode 100644
index 000000000..f10abdda8
--- /dev/null
+++ b/etc/authenticator.profile
@@ -0,0 +1,49 @@
1# Firejail profile for authenticator
2# Description: 2FA code generator for GNOME
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/authenticator.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9# blacklisted in 'disable-programs.local'
10noblacklist ${HOME}/.config/Authenticator
11
12# Allow python 3.x (blacklisted by disable-interpreters.inc)
13noblacklist ${PATH}/python3*
14noblacklist /usr/lib/python3*
15
16include /etc/firejail/disable-common.inc
17include /etc/firejail/disable-devel.inc
18include /etc/firejail/disable-interpreters.inc
19include /etc/firejail/disable-passwdmgr.inc
20include /etc/firejail/disable-programs.inc
21
22# apparmor
23caps.drop all
24net none
25no3d
26# nodbus - makes settings immutable
27nodvd
28nogroups
29nonewprivs
30noroot
31nosound
32notv
33# novideo
34nou2f
35protocol unix
36seccomp
37shell none
38
39disable-mnt
40# private-bin authenticator
41private-cache
42private-dev
43private-etc fonts,ld.so.cache
44# private-lib
45private-tmp
46
47# memory-deny-write-execute - breaks on Arch
48noexec ${HOME}
49noexec /tmp
diff --git a/etc/checkbashisms.profile b/etc/checkbashisms.profile
new file mode 100644
index 000000000..c8b8be04e
--- /dev/null
+++ b/etc/checkbashisms.profile
@@ -0,0 +1,49 @@
1# Firejail profile for checkbashisms
2# Description: Lint tool for shell scripts
3# This file is overwritten after every install/update
4quiet
5# Persistent local customizations
6include /etc/firejail/checkbashisms.local
7# Persistent global definitions
8include /etc/firejail/globals.local
9
10noblacklist ${DOCUMENTS}
11
12# Allow perl (blacklisted by disable-interpreters.inc)
13noblacklist ${PATH}/cpan*
14noblacklist ${PATH}/core_perl
15noblacklist ${PATH}/perl
16noblacklist /usr/lib/perl*
17noblacklist /usr/share/perl*
18
19include /etc/firejail/disable-common.inc
20include /etc/firejail/disable-devel.inc
21include /etc/firejail/disable-interpreters.inc
22include /etc/firejail/disable-passwdmgr.inc
23include /etc/firejail/disable-programs.inc
24include /etc/firejail/disable-xdg.inc
25
26include /etc/firejail/whitelist-var-common.inc
27
28caps.drop all
29ipc-namespace
30net none
31no3d
32nodbus
33nodvd
34nogroups
35nonewprivs
36noroot
37nosound
38notv
39novideo
40protocol unix
41seccomp
42shell none
43
44private-dev
45private-tmp
46
47memory-deny-write-execute
48noexec ${HOME}
49noexec /tmp
diff --git a/etc/claws-mail.profile b/etc/claws-mail.profile
index cb8ae6a80..0274fd66b 100644
--- a/etc/claws-mail.profile
+++ b/etc/claws-mail.profile
@@ -16,19 +16,24 @@ include /etc/firejail/disable-interpreters.inc
16include /etc/firejail/disable-passwdmgr.inc 16include /etc/firejail/disable-passwdmgr.inc
17include /etc/firejail/disable-programs.inc 17include /etc/firejail/disable-programs.inc
18 18
19include /etc/firejail/whitelist-common.inc
20
19caps.drop all 21caps.drop all
20netfilter 22netfilter
23no3d
21nodvd 24nodvd
22nogroups 25nogroups
23nonewprivs 26nonewprivs
24noroot 27noroot
25nosound 28nosound
26notv 29notv
30nou2f
27novideo 31novideo
28protocol unix,inet,inet6 32protocol unix,inet,inet6
29seccomp 33seccomp
30shell none 34shell none
31 35
36private-cache
32private-dev 37private-dev
33private-tmp 38private-tmp
34 39
diff --git a/etc/desktop.profile b/etc/desktop.profile
new file mode 100644
index 000000000..8bfa885a3
--- /dev/null
+++ b/etc/desktop.profile
@@ -0,0 +1,44 @@
1# Firejail profile for desktop
2# Description: Extend your GitHub workflow beyond your browser with GitHub Desktop
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/github-desktop.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9whitelist ${HOME}/.gitconfig
10whitelist ${HOME}/.config/GitHub Desktop
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-passwdmgr.inc
14include /etc/firejail/disable-programs.inc
15include /etc/firejail/disable-devel.inc
16include /etc/firejail/disable-interpreters.inc
17
18include /etc/firejail/whitelist-common.inc
19
20caps.drop all
21netfilter
22# no3d
23nodvd
24nogroups
25nonewprivs
26noroot
27nosound
28notv
29nou2f
30novideo
31protocol unix,inet,inet6,netlink
32seccomp
33
34disable-mnt
35# private-bin Atom,desktop
36# private-cache
37# private-dev
38# private-etc none
39# private-lib
40# private-tmp
41
42# memory-deny-write-execute
43# noexec ${HOME}
44# noexec /tmp
diff --git a/etc/devilspie.profile b/etc/devilspie.profile
new file mode 100644
index 000000000..dbfb05798
--- /dev/null
+++ b/etc/devilspie.profile
@@ -0,0 +1,49 @@
1# Firejail profile for devilspie
2# Description: Window matching daemon
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/devilspie.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.devilspie
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-interpreters.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16
17caps.drop all
18ipc-namespace
19machine-id
20net none
21no3d
22nodbus
23nodvd
24nogroups
25nonewprivs
26noroot
27nosound
28notv
29nou2f
30novideo
31protocol unix
32seccomp
33shell none
34tracelog
35
36disable-mnt
37private-bin devilspie
38private-cache
39private-dev
40private-etc none
41private-lib gconv
42private-tmp
43
44memory-deny-write-execute
45noexec ${HOME}
46noexec /tmp
47
48# devilspie will never write anything
49read-only ${HOME}
diff --git a/etc/devilspie2.profile b/etc/devilspie2.profile
new file mode 100644
index 000000000..3a9a9659a
--- /dev/null
+++ b/etc/devilspie2.profile
@@ -0,0 +1,49 @@
1# Firejail profile for devilspie2
2# Description: Window matching daemon (Lua)
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/devilspie2.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.config/devilspie2
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-interpreters.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16
17caps.drop all
18ipc-namespace
19machine-id
20net none
21no3d
22nodbus
23nodvd
24nogroups
25nonewprivs
26noroot
27nosound
28notv
29nou2f
30novideo
31protocol unix
32seccomp
33shell none
34tracelog
35
36disable-mnt
37private-bin devilspie2
38private-cache
39private-dev
40private-etc none
41private-lib gconv
42private-tmp
43
44memory-deny-write-execute
45noexec ${HOME}
46noexec /tmp
47
48# devilspie2 will never write anything
49read-only ${HOME}
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index 1213e4f24..6fa0eed26 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -32,6 +32,7 @@ blacklist ${HOME}/.aMule
32blacklist ${HOME}/.android 32blacklist ${HOME}/.android
33blacklist ${HOME}/.anydesk 33blacklist ${HOME}/.anydesk
34blacklist ${HOME}/.arduino15 34blacklist ${HOME}/.arduino15
35blacklist ${HOME}/.aria2
35blacklist ${HOME}/.arm 36blacklist ${HOME}/.arm
36blacklist ${HOME}/.asunder_album_genre 37blacklist ${HOME}/.asunder_album_genre
37blacklist ${HOME}/.asunder_album_title 38blacklist ${HOME}/.asunder_album_title
@@ -46,6 +47,7 @@ blacklist ${HOME}/.config/0ad
46blacklist ${HOME}/.config/2048-qt 47blacklist ${HOME}/.config/2048-qt
47blacklist ${HOME}/.config/Atom 48blacklist ${HOME}/.config/Atom
48blacklist ${HOME}/.config/Audaciousrc 49blacklist ${HOME}/.config/Audaciousrc
50blacklist ${HOME}/.config/Authenticator
49blacklist ${HOME}/.config/Beaker Browser 51blacklist ${HOME}/.config/Beaker Browser
50blacklist ${HOME}/.config/Brackets 52blacklist ${HOME}/.config/Brackets
51blacklist ${HOME}/.config/Clementine 53blacklist ${HOME}/.config/Clementine
@@ -55,6 +57,7 @@ blacklist ${HOME}/.config/Franz
55blacklist ${HOME}/.config/FreeCAD 57blacklist ${HOME}/.config/FreeCAD
56blacklist ${HOME}/.config/Fritzing 58blacklist ${HOME}/.config/Fritzing
57blacklist ${HOME}/.config/GIMP 59blacklist ${HOME}/.config/GIMP
60blacklist ${HOME}/.config/GitHub Desktop
58blacklist ${HOME}/.config/Gitter 61blacklist ${HOME}/.config/Gitter
59blacklist ${HOME}/.config/Google 62blacklist ${HOME}/.config/Google
60blacklist ${HOME}/.config/Google Play Music Desktop Player 63blacklist ${HOME}/.config/Google Play Music Desktop Player
@@ -63,6 +66,7 @@ blacklist ${HOME}/.config/INRIA
63blacklist ${HOME}/.config/InSilmaril 66blacklist ${HOME}/.config/InSilmaril
64blacklist ${HOME}/.config/Luminance 67blacklist ${HOME}/.config/Luminance
65blacklist ${HOME}/.config/Meltytech 68blacklist ${HOME}/.config/Meltytech
69blacklist ${HOME}/.config/Min
66blacklist ${HOME}/.config/Mousepad 70blacklist ${HOME}/.config/Mousepad
67blacklist ${HOME}/.config/Mumble 71blacklist ${HOME}/.config/Mumble
68blacklist ${HOME}/.config/MusE 72blacklist ${HOME}/.config/MusE
@@ -70,6 +74,7 @@ blacklist ${HOME}/.config/MuseScore
70blacklist ${HOME}/.config/MusicBrainz 74blacklist ${HOME}/.config/MusicBrainz
71blacklist ${HOME}/.config/Nylas Mail 75blacklist ${HOME}/.config/Nylas Mail
72blacklist ${HOME}/.config/Qlipper 76blacklist ${HOME}/.config/Qlipper
77blacklist ${HOME}/.config/QMediathekView
73blacklist ${HOME}/.config/QuiteRss 78blacklist ${HOME}/.config/QuiteRss
74blacklist ${HOME}/.config/QuiteRssrc 79blacklist ${HOME}/.config/QuiteRssrc
75blacklist ${HOME}/.config/Rambox 80blacklist ${HOME}/.config/Rambox
@@ -111,6 +116,7 @@ blacklist ${HOME}/.config/corebird
111blacklist ${HOME}/.config/darktable 116blacklist ${HOME}/.config/darktable
112blacklist ${HOME}/.config/deadbeef 117blacklist ${HOME}/.config/deadbeef
113blacklist ${HOME}/.config/deluge 118blacklist ${HOME}/.config/deluge
119blacklist ${HOME}/.config/devilspie2
114blacklist ${HOME}/.config/digikam 120blacklist ${HOME}/.config/digikam
115blacklist ${HOME}/.config/digikamrc 121blacklist ${HOME}/.config/digikamrc
116blacklist ${HOME}/.config/discord 122blacklist ${HOME}/.config/discord
@@ -252,11 +258,13 @@ blacklist ${HOME}/.config/zoomus.conf
252blacklist ${HOME}/.conkeror.mozdev.org 258blacklist ${HOME}/.conkeror.mozdev.org
253blacklist ${HOME}/.curlrc 259blacklist ${HOME}/.curlrc
254blacklist ${HOME}/.dashcore 260blacklist ${HOME}/.dashcore
261blacklist ${HOME}/.devilspie
255blacklist ${HOME}/.dia 262blacklist ${HOME}/.dia
256blacklist ${HOME}/.dillo 263blacklist ${HOME}/.dillo
257blacklist ${HOME}/.dooble 264blacklist ${HOME}/.dooble
258blacklist ${HOME}/.dosbox 265blacklist ${HOME}/.dosbox
259blacklist ${HOME}/.dropbox* 266blacklist ${HOME}/.dropbox*
267blacklist ${HOME}/.easystroke
260blacklist ${HOME}/.electron-cache 268blacklist ${HOME}/.electron-cache
261blacklist ${HOME}/.electrum* 269blacklist ${HOME}/.electrum*
262blacklist ${HOME}/.elinks 270blacklist ${HOME}/.elinks
@@ -360,6 +368,7 @@ blacklist ${HOME}/.local/share/3909/PapersPlease
360blacklist ${HOME}/.local/share/Empathy 368blacklist ${HOME}/.local/share/Empathy
361blacklist ${HOME}/.local/share/JetBrains 369blacklist ${HOME}/.local/share/JetBrains
362blacklist ${HOME}/.local/share/Mumble 370blacklist ${HOME}/.local/share/Mumble
371blacklist ${HOME}/.local/share/QMediathekView
363blacklist ${HOME}/.local/share/QuiteRss 372blacklist ${HOME}/.local/share/QuiteRss
364blacklist ${HOME}/.local/share/Ricochet 373blacklist ${HOME}/.local/share/Ricochet
365blacklist ${HOME}/.local/share/Steam 374blacklist ${HOME}/.local/share/Steam
diff --git a/etc/easystroke.profile b/etc/easystroke.profile
new file mode 100644
index 000000000..6fac08a5d
--- /dev/null
+++ b/etc/easystroke.profile
@@ -0,0 +1,45 @@
1# Firejail profile for easystroke
2# Description: Control your desktop using mouse gestures
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/easystroke.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.easystroke
10
11include /etc/firejail/disable-common.inc
12include /etc/firejail/disable-devel.inc
13include /etc/firejail/disable-interpreters.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16
17caps.drop all
18ipc-namespace
19machine-id
20net none
21no3d
22# nodbus
23nodvd
24nogroups
25nonewprivs
26noroot
27nosound
28notv
29nou2f
30novideo
31protocol unix
32seccomp
33shell none
34
35disable-mnt
36private-bin easystroke
37private-cache
38private-dev
39private-etc fonts
40private-lib gdk-pixbuf-2.*,gio,gvfs/libgvfscommon.so,libgconf-2.so.*,librsvg-2.so.*
41private-tmp
42
43memory-deny-write-execute
44noexec ${HOME}
45noexec /tmp
diff --git a/etc/file.profile b/etc/file.profile
index 5d1227520..00e18de20 100644
--- a/etc/file.profile
+++ b/etc/file.profile
@@ -30,10 +30,12 @@ shell none
30tracelog 30tracelog
31x11 none 31x11 none
32 32
33private-bin file 33#private-bin file
34private-cache
34private-dev 35private-dev
35private-etc magic.mgc,magic,localtime 36private-etc magic.mgc,magic,localtime
36private-lib 37private-lib
38private-tmp
37 39
38memory-deny-write-execute 40memory-deny-write-execute
39noexec ${HOME} 41noexec ${HOME}
diff --git a/etc/min.profile b/etc/min.profile
new file mode 100644
index 000000000..91c6fce3c
--- /dev/null
+++ b/etc/min.profile
@@ -0,0 +1,50 @@
1# Firejail profile for min
2# Description: A faster, smarter web browser.
3# This file is overwritten after every install/update
4# Persistent local customizations
5include /etc/firejail/min.local
6# Persistent global definitions
7include /etc/firejail/globals.local
8
9noblacklist ${HOME}/.config/Min
10
11noblacklist ${HOME}/.pki
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-devel.inc
15include /etc/firejail/disable-interpreters.inc
16include /etc/firejail/disable-programs.inc
17
18mkdir ${HOME}/.pki
19whitelist ${DOWNLOADS}
20whitelist ${HOME}/.pki
21include /etc/firejail/whitelist-common.inc
22include /etc/firejail/whitelist-var-common.inc
23
24caps.drop all
25# ipc-namespace
26# machine-id breaks pulse audio; it should work fine in setups where sound is not required
27#machine-id
28netfilter
29# no3d
30nodbus
31nodvd
32nogroups
33nonewprivs
34noroot
35notv
36protocol unix,inet,inet6
37seccomp
38shell none
39
40disable-mnt
41# private-bin min
42private-cache
43private-dev
44# private-etc below works fine on most distributions. There are some problems on CentOS.
45private-etc ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,mime.types,mailcap,asound.conf,pulse,pki,crypto-policies,ld.so.cache
46private-tmp
47
48# memory-deny-write-execute
49noexec ${HOME}
50noexec /tmp
diff --git a/etc/strings.profile b/etc/strings.profile
index 5bea9525f..ae2fbf18f 100644
--- a/etc/strings.profile
+++ b/etc/strings.profile
@@ -21,9 +21,13 @@ shell none
21tracelog 21tracelog
22 22
23private-bin strings 23private-bin strings
24private-cache
24private-dev 25private-dev
26private-etc none
25private-lib 27private-lib
26 28
27memory-deny-write-execute 29memory-deny-write-execute
30noexec ${HOME}
31noexec /tmp
28 32
29include /etc/firejail/default.profile 33include /etc/firejail/default.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 746c70c53..2190f133d 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -10,9 +10,11 @@ Discord
10DiscordCanary 10DiscordCanary
11FossaMail 11FossaMail
12Fritzing 12Fritzing
13GitHub Desktop
13JDownloader 14JDownloader
14Mathematica 15Mathematica
15Natron 16Natron
17QMediathekView
16Telegram 18Telegram
17Viber 19Viber
18VirtualBox 20VirtualBox
@@ -85,6 +87,7 @@ clipit
85cliqz 87cliqz
86cmus 88cmus
87code 89code
90com.github.bilelmoussaoui.Authenticator
88conkeror 91conkeror
89conky 92conky
90corebird 93corebird
@@ -111,6 +114,7 @@ dooble-qt4
111dosbox 114dosbox
112dragon 115dragon
113dropbox 116dropbox
117easystroke
114ebook-viewer 118ebook-viewer
115electrum 119electrum
116elinks 120elinks
@@ -276,6 +280,7 @@ mediainfo
276mediathekview 280mediathekview
277meld 281meld
278midori 282midori
283min
279minetest 284minetest
280mousepad 285mousepad
281mplayer 286mplayer
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index 40155b155..1d74dc8dc 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -453,7 +453,7 @@ void fs_chroot(const char *rootdir);
453void fs_check_chroot_dir(const char *rootdir); 453void fs_check_chroot_dir(const char *rootdir);
454void fs_private_tmp(void); 454void fs_private_tmp(void);
455void fs_private_cache(void); 455void fs_private_cache(void);
456void fs_mnt(void); 456void fs_mnt(const int enforce);
457 457
458// profile.c 458// profile.c
459// find and read the profile specified by name from dir directory 459// find and read the profile specified by name from dir directory
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 83830cff6..b958df81a 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -545,11 +545,23 @@ void fs_noexec(const char *dir) {
545} 545}
546 546
547// Disable /mnt, /media, /run/mount and /run/media access 547// Disable /mnt, /media, /run/mount and /run/media access
548void fs_mnt(void) { 548void fs_mnt(const int enforce) {
549 disable_file(BLACKLIST_FILE, "/mnt"); 549 if (enforce) {
550 disable_file(BLACKLIST_FILE, "/media"); 550 // disable-mnt set in firejail.config
551 disable_file(BLACKLIST_FILE, "/run/mount"); 551 // overriding with noblacklist is not possible in this case
552 disable_file(BLACKLIST_FILE, "//run/media"); 552 disable_file(BLACKLIST_FILE, "/mnt");
553 disable_file(BLACKLIST_FILE, "/media");
554 disable_file(BLACKLIST_FILE, "/run/mount");
555 disable_file(BLACKLIST_FILE, "/run/media");
556 }
557 else {
558 EUID_USER();
559 profile_add("blacklist /mnt");
560 profile_add("blacklist /media");
561 profile_add("blacklist /run/mount");
562 profile_add("blacklist /run/media");
563 EUID_ROOT();
564 }
553} 565}
554 566
555 567
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 5441522ab..8eede6f93 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -923,8 +923,10 @@ int sandbox(void* sandbox_arg) {
923 //**************************** 923 //****************************
924 // handle /mnt and /media 924 // handle /mnt and /media
925 //**************************** 925 //****************************
926 if (arg_disable_mnt || checkcfg(CFG_DISABLE_MNT)) 926 if (checkcfg(CFG_DISABLE_MNT))
927 fs_mnt(); 927 fs_mnt(1);
928 else if (arg_disable_mnt)
929 fs_mnt(0);
928 930
929 //**************************** 931 //****************************
930 // apply the profile file 932 // apply the profile file
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-31 14:49:46 +0000