aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--README.md6
-rw-r--r--RELNOTES16
-rw-r--r--etc/disable-common.inc28
-rw-r--r--etc/disable-programs.inc4
-rw-r--r--etc/keepassx2.profile22
-rw-r--r--platform/debian/conffiles1
-rw-r--r--src/firecfg/firecfg.config2
7 files changed, 51 insertions, 28 deletions
diff --git a/README.md b/README.md
index 609533a91..df594a465 100644
--- a/README.md
+++ b/README.md
@@ -18,7 +18,7 @@ prefix your command with “firejail”:
18 18
19````` 19`````
20$ firejail firefox # starting Mozilla Firefox 20$ firejail firefox # starting Mozilla Firefox
21$ firejail transmission-gtk # starting Transmission BitTorrent 21$ firejail transmission-gtk # starting Transmission BitTorrent
22$ firejail vlc # starting VideoLAN Client 22$ firejail vlc # starting VideoLAN Client
23$ sudo firejail /etc/init.d/nginx start 23$ sudo firejail /etc/init.d/nginx start
24````` 24`````
@@ -88,5 +88,5 @@ amarok, ark, atool, bleachbit, brasero, dolphin, dragon, elinks, enchant, exifto
88gjs, gnome-books, gnome-clocks, gnome-documents, gnome-maps, gnome-music, gnome-photos, gnome-weather, 88gjs, gnome-books, gnome-clocks, gnome-documents, gnome-maps, gnome-music, gnome-photos, gnome-weather,
89goobox, gpa, gpg, gpg-agent, highlight, img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext, 89goobox, gpa, gpg, gpg-agent, highlight, img2txt, k3b, kate, lynx, mediainfo, nautilus, odt2txt, pdftotext,
90simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget, 90simple-scan, skanlite, ssh-agent, tracker, transmission-cli, transmission-show, w3m, xfburn, xpra, wget,
91xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5, 91xed, pluma, Cryptocat, Bless, Gnome 2048, Gnome Calculator, Gnome Contacts, JD-GUI, Lollypop, MultiMC5,
92PDFSam, Pithos, Xonotic, wireshark 92PDFSam, Pithos, Xonotic, wireshark, keepassx2
diff --git a/RELNOTES b/RELNOTES
index 064553f98..fbfd99093 100644
--- a/RELNOTES
+++ b/RELNOTES
@@ -16,9 +16,9 @@ firejail (0.9.45) baseline; urgency=low
16 * feature: config support for firejail prompt in terminal 16 * feature: config support for firejail prompt in terminal
17 * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire, 17 * new profiles: xiphos, Tor Browser Bundle, display (imagemagik), Wire,
18 * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma, 18 * new profiles: mumble, zoom, Guayadeque, qemu, keypass2, xed, pluma,
19 * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator, 19 * new profiles: Cryptocat, Bless, Gnome 2048, Gnome Calculator,
20 * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos, 20 * new profiles: Gnome Contacts, JD-GUI, Lollypop, MultiMC5, PDFSam, Pithos,
21 * new profies: Xonotic, wireshark 21 * new profies: Xonotic, wireshark, keepassx2
22 * bugfixes 22 * bugfixes
23 -- netblue30 <netblue30@yahoo.com> Sun, 23 Oct 2016 08:00:00 -0500 23 -- netblue30 <netblue30@yahoo.com> Sun, 23 Oct 2016 08:00:00 -0500
24 24
@@ -32,7 +32,7 @@ firejail (0.9.44) baseline; urgency=low
32 * feature: support starting/joining sandbox is a single command 32 * feature: support starting/joining sandbox is a single command
33 (--join-or-start) 33 (--join-or-start)
34 * feature: X11 detection support for --audit 34 * feature: X11 detection support for --audit
35 * feature: assign a name to the interface connected to the bridge 35 * feature: assign a name to the interface connected to the bridge
36 (--veth-name) 36 (--veth-name)
37 * feature: all user home directories are visible (--allusers) 37 * feature: all user home directories are visible (--allusers)
38 * feature: add files to sandbox container (--put) 38 * feature: add files to sandbox container (--put)
@@ -265,7 +265,7 @@ firejail (0.9.24) baseline; urgency=low
265 * two build patches from Reiner Herman (tickets 11, 12) 265 * two build patches from Reiner Herman (tickets 11, 12)
266 * man page patch from Reiner Herman (ticket 13) 266 * man page patch from Reiner Herman (ticket 13)
267 * output patch (ticket 15) from sshirokov 267 * output patch (ticket 15) from sshirokov
268 268
269 -- netblue30 <netblue30@yahoo.com> Sun, 5 Apr 2015 08:00:00 -0500 269 -- netblue30 <netblue30@yahoo.com> Sun, 5 Apr 2015 08:00:00 -0500
270 270
271firejail (0.9.22) baseline; urgency=low 271firejail (0.9.22) baseline; urgency=low
@@ -330,7 +330,7 @@ firejail (0.9.16) baseline; urgency=low
330 -- netblue30 <netblue30@yahoo.com> Tue, 4 Nov 2014 10:00:00 -0500 330 -- netblue30 <netblue30@yahoo.com> Tue, 4 Nov 2014 10:00:00 -0500
331 331
332firejail (0.9.14) baseline; urgency=low 332firejail (0.9.14) baseline; urgency=low
333 * Linux capabilities and seccomp filters are automatically enabled in 333 * Linux capabilities and seccomp filters are automatically enabled in
334 chroot mode (--chroot option) if the sandbox is started as regular user 334 chroot mode (--chroot option) if the sandbox is started as regular user
335 * Added support for user defined seccomp blacklists 335 * Added support for user defined seccomp blacklists
336 * Added syscall trace support 336 * Added syscall trace support
@@ -382,7 +382,7 @@ firejail (0.9.8.1) baseline; urgency=low
382 * FIxed a number of bugs introduced in 0.9.8 382 * FIxed a number of bugs introduced in 0.9.8
383 383
384 -- netblue30 <netblue30@yahoo.com> Fri, 25 Jul 2014 07:25:00 -0500 384 -- netblue30 <netblue30@yahoo.com> Fri, 25 Jul 2014 07:25:00 -0500
385 385
386firejail (0.9.8) baseline; urgency=low 386firejail (0.9.8) baseline; urgency=low
387 * Implemented nowrap mode for firejail --list command option 387 * Implemented nowrap mode for firejail --list command option
388 * Added --top option in both firejail and firemon 388 * Added --top option in both firejail and firemon
@@ -391,7 +391,7 @@ firejail (0.9.8) baseline; urgency=low
391 * bugfixes 391 * bugfixes
392 392
393 -- netblue30 <netblue30@yahoo.com> Tue, 24 Jul 2014 08:51:00 -0500 393 -- netblue30 <netblue30@yahoo.com> Tue, 24 Jul 2014 08:51:00 -0500
394 394
395firejail (0.9.6) baseline; urgency=low 395firejail (0.9.6) baseline; urgency=low
396 396
397 * Mounting tmpfs on top of /var/log, required by several server programs 397 * Mounting tmpfs on top of /var/log, required by several server programs
@@ -430,7 +430,7 @@ firejail (0.9.2) baseline; urgency=low
430 * Added an expect-based testing framework for the project 430 * Added an expect-based testing framework for the project
431 * Added bash completion support 431 * Added bash completion support
432 * Added support for multiple networks 432 * Added support for multiple networks
433 433
434 -- netblue30 <netblue30@yahoo.com> Fri, 25 Apr 2014 08:00:00 -0500 434 -- netblue30 <netblue30@yahoo.com> Fri, 25 Apr 2014 08:00:00 -0500
435 435
436firejail (0.9) baseline; urgency=low 436firejail (0.9) baseline; urgency=low
diff --git a/etc/disable-common.inc b/etc/disable-common.inc
index b86c6f998..07814a704 100644
--- a/etc/disable-common.inc
+++ b/etc/disable-common.inc
@@ -39,19 +39,19 @@ blacklist /usr/share/applications/veracrypt.*
39blacklist /usr/share/pixmaps/veracrypt.* 39blacklist /usr/share/pixmaps/veracrypt.*
40blacklist ${HOME}/.VeraCrypt 40blacklist ${HOME}/.VeraCrypt
41 41
42# TrueCrypt 42# TrueCrypt
43blacklist ${PATH}/truecrypt 43blacklist ${PATH}/truecrypt
44blacklist ${PATH}/truecrypt-uninstall.sh 44blacklist ${PATH}/truecrypt-uninstall.sh
45blacklist /usr/share/truecrypt 45blacklist /usr/share/truecrypt
46blacklist /usr/share/applications/truecrypt.* 46blacklist /usr/share/applications/truecrypt.*
47blacklist /usr/share/pixmaps/truecrypt.* 47blacklist /usr/share/pixmaps/truecrypt.*
48blacklist ${HOME}/.TrueCrypt 48blacklist ${HOME}/.TrueCrypt
49 49
50# zuluCrypt 50# zuluCrypt
51blacklist ${HOME}/.zuluCrypt 51blacklist ${HOME}/.zuluCrypt
52blacklist ${HOME}/.zuluCrypt-socket 52blacklist ${HOME}/.zuluCrypt-socket
53blacklist ${PATH}/zuluCrypt-cli 53blacklist ${PATH}/zuluCrypt-cli
54blacklist ${PATH}/zuluMount-cli 54blacklist ${PATH}/zuluMount-cli
55 55
56# var 56# var
57blacklist /var/spool/cron 57blacklist /var/spool/cron
@@ -154,7 +154,7 @@ blacklist /etc/ssh
154blacklist /var/backup 154blacklist /var/backup
155blacklist /home/.ecryptfs 155blacklist /home/.ecryptfs
156 156
157# system directories 157# system directories
158blacklist /sbin 158blacklist /sbin
159blacklist /usr/sbin 159blacklist /usr/sbin
160blacklist /usr/local/sbin 160blacklist /usr/local/sbin
diff --git a/etc/disable-programs.inc b/etc/disable-programs.inc
index a9ca487c5..8e9392c7b 100644
--- a/etc/disable-programs.inc
+++ b/etc/disable-programs.inc
@@ -107,7 +107,7 @@ blacklist ${HOME}/.config/katepartrc
107blacklist ${HOME}/.config/katerc 107blacklist ${HOME}/.config/katerc
108blacklist ${HOME}/.config/kateschemarc 108blacklist ${HOME}/.config/kateschemarc
109blacklist ${HOME}/.config/katesyntaxhighlightingrc 109blacklist ${HOME}/.config/katesyntaxhighlightingrc
110blacklist ${HOME}/.config/katevirc 110blacklist ${HOME}/.config/katevir
111blacklist ${HOME}/.config/libreoffice 111blacklist ${HOME}/.config/libreoffice
112blacklist ${HOME}/.config/mate/eom 112blacklist ${HOME}/.config/mate/eom
113blacklist ${HOME}/.config/midori 113blacklist ${HOME}/.config/midori
@@ -148,7 +148,7 @@ blacklist ${HOME}/.config/xreader
148blacklist ${HOME}/.config/xviewer 148blacklist ${HOME}/.config/xviewer
149blacklist ${HOME}/.config/zathura 149blacklist ${HOME}/.config/zathura
150blacklist ${HOME}/.config/zoomus.conf 150blacklist ${HOME}/.config/zoomus.conf
151blacklist ${HOME}/.conkeror.mozdev.org 151blacklist ${HOME}/.conkeror.mozdev.org
152blacklist ${HOME}/.dillo 152blacklist ${HOME}/.dillo
153blacklist ${HOME}/.dosbox 153blacklist ${HOME}/.dosbox
154blacklist ${HOME}/.dropbox-dist 154blacklist ${HOME}/.dropbox-dist
diff --git a/etc/keepassx2.profile b/etc/keepassx2.profile
new file mode 100644
index 000000000..d8621773f
--- /dev/null
+++ b/etc/keepassx2.profile
@@ -0,0 +1,22 @@
1# keepassx password manager profile
2noblacklist ${HOME}/.config/keepassx
3noblacklist ${HOME}/.keepassx
4noblacklist ${HOME}/keepassx.kdbx
5
6include /etc/firejail/disable-common.inc
7include /etc/firejail/disable-programs.inc
8include /etc/firejail/disable-devel.inc
9include /etc/firejail/disable-passwdmgr.inc
10
11caps.drop all
12nogroups
13nonewprivs
14noroot
15nosound
16protocol unix
17seccomp
18netfilter
19shell none
20
21private-tmp
22private-dev
diff --git a/platform/debian/conffiles b/platform/debian/conffiles
index 97e7cf884..57657f208 100644
--- a/platform/debian/conffiles
+++ b/platform/debian/conffiles
@@ -111,6 +111,7 @@
111/etc/firejail/keepass.profile 111/etc/firejail/keepass.profile
112/etc/firejail/keepass2.profile 112/etc/firejail/keepass2.profile
113/etc/firejail/keepassx.profile 113/etc/firejail/keepassx.profile
114/etc/firejail/keepassx2.profile
114/etc/firejail/kmail.profile 115/etc/firejail/kmail.profile
115/etc/firejail/konversation.profile 116/etc/firejail/konversation.profile
116/etc/firejail/less.profile 117/etc/firejail/less.profile
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index c4f52e256..fe65a5077 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -190,6 +190,7 @@ ranger
190keepass 190keepass
191keepass2 191keepass2
192keepassx 192keepassx
193keepassx2
193pluma 194pluma
194tracker 195tracker
195wireshark 196wireshark
@@ -204,4 +205,3 @@ gnome-weather
204ark 205ark
205atool 206atool
206file-roller 207file-roller
207
generated by cgit v1.2.3-54-g00ecf (git 2.45.1) at 2024-05-28 01:20:36 +0000