diff options
Diffstat (limited to 'README.md')
-rw-r--r-- | README.md | 69 |
1 files changed, 4 insertions, 65 deletions
@@ -42,76 +42,15 @@ If you keep your Firejail profiles in a public repository, please give us a link | |||
42 | * https://github.com/chiraag-nataraj/firejail-profiles | 42 | * https://github.com/chiraag-nataraj/firejail-profiles |
43 | 43 | ||
44 | * https://github.com/triceratops1/fe | 44 | * https://github.com/triceratops1/fe |
45 | ````` | ||
46 | 45 | ||
46 | Use this issue to request new profiles: https://github.com/netblue30/firejail/issues/825 | ||
47 | ````` | 47 | ````` |
48 | # Current development version: 0.9.43 | ||
49 | 48 | ||
50 | ## X11 development | ||
51 | ````` | ||
52 | --x11=none | ||
53 | Blacklist /tmp/.X11-unix directory, ${HOME}/.Xauthority and the | ||
54 | file specified in ${XAUTHORITY} environment variable. Remove | ||
55 | DISPLAY and XAUTHORITY environment variables. Stop with error | ||
56 | message if X11 abstract socket will be accessible in jail. | ||
57 | |||
58 | --x11=xorg | ||
59 | Sandbox the application using the untrusted mode implemented by | ||
60 | X11 security extension. The extension is available in Xorg | ||
61 | package and it is installed by default on most Linux distribu‐ | ||
62 | tions. It provides support for a simple trusted/untrusted con‐ | ||
63 | nection model. Untrusted clients are restricted in certain ways | ||
64 | to prevent them from reading window contents of other clients, | ||
65 | stealing input events, etc. | ||
66 | |||
67 | The untrusted mode has several limitations. A lot of regular | ||
68 | programs assume they are a trusted X11 clients and will crash | ||
69 | or lock up when run in untrusted mode. Chromium browser and | ||
70 | xterm are two examples. Firefox and transmission-gtk seem to be | ||
71 | working fine. A network namespace is not required for this | ||
72 | option. | ||
73 | |||
74 | Example: | ||
75 | $ firejail --x11=xorg firefox | ||
76 | ````` | 49 | ````` |
77 | 50 | # Current development version: 0.9.45 | |
78 | ## Other command line options | ||
79 | ````` | 51 | ````` |
80 | --put=name|pid src-filename dest-filename | ||
81 | Put src-filename in sandbox container. The container is specified by name or PID. | ||
82 | |||
83 | --allusers | ||
84 | All user home directories are visible inside the sandbox. By default, only current user home | ||
85 | directory is visible. | ||
86 | |||
87 | Example: | ||
88 | $ firejail --allusers | ||
89 | |||
90 | --join-or-start=name | ||
91 | Join the sandbox identified by name or start a new one. Same as "firejail --join=name" if | ||
92 | sandbox with specified name exists, otherwise same as "firejail --name=name ..." | ||
93 | Note that in contrary to other join options there is respective profile option. | ||
94 | |||
95 | --no3d Disable 3D hardware acceleration. | ||
96 | |||
97 | Example: | ||
98 | $ firejail --no3d firefox | ||
99 | |||
100 | --veth-name=name | ||
101 | Use this name for the interface connected to the bridge for | ||
102 | --net=bridge_interface commands, instead of the default one. | ||
103 | |||
104 | Example: | ||
105 | $ firejail --net=br0 --veth-name=if0 | ||
106 | 52 | ||
107 | ````` | 53 | ````` |
108 | 54 | ## New Profiles | |
109 | ## New profile commands | 55 | xiphos, Tor Browser Bundle |
110 | |||
111 | x11 xpra, x11 xephyr, x11 none, x11 xorg, allusers, join-or-start | ||
112 | |||
113 | ## New profiles | ||
114 | |||
115 | qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape, feh, ranger, zathura, 7z, keepass, keepassx, | ||
116 | claws-mail, mutt, git, emacs, vim, xpdf | ||
117 | 56 | ||