diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 69 |
1 files changed, 4 insertions, 65 deletions
| @@ -42,76 +42,15 @@ If you keep your Firejail profiles in a public repository, please give us a link | |||
| 42 | * https://github.com/chiraag-nataraj/firejail-profiles | 42 | * https://github.com/chiraag-nataraj/firejail-profiles |
| 43 | 43 | ||
| 44 | * https://github.com/triceratops1/fe | 44 | * https://github.com/triceratops1/fe |
| 45 | ````` | ||
| 46 | 45 | ||
| 46 | Use this issue to request new profiles: https://github.com/netblue30/firejail/issues/825 | ||
| 47 | ````` | 47 | ````` |
| 48 | # Current development version: 0.9.43 | ||
| 49 | 48 | ||
| 50 | ## X11 development | ||
| 51 | ````` | ||
| 52 | --x11=none | ||
| 53 | Blacklist /tmp/.X11-unix directory, ${HOME}/.Xauthority and the | ||
| 54 | file specified in ${XAUTHORITY} environment variable. Remove | ||
| 55 | DISPLAY and XAUTHORITY environment variables. Stop with error | ||
| 56 | message if X11 abstract socket will be accessible in jail. | ||
| 57 | |||
| 58 | --x11=xorg | ||
| 59 | Sandbox the application using the untrusted mode implemented by | ||
| 60 | X11 security extension. The extension is available in Xorg | ||
| 61 | package and it is installed by default on most Linux distribu‐ | ||
| 62 | tions. It provides support for a simple trusted/untrusted con‐ | ||
| 63 | nection model. Untrusted clients are restricted in certain ways | ||
| 64 | to prevent them from reading window contents of other clients, | ||
| 65 | stealing input events, etc. | ||
| 66 | |||
| 67 | The untrusted mode has several limitations. A lot of regular | ||
| 68 | programs assume they are a trusted X11 clients and will crash | ||
| 69 | or lock up when run in untrusted mode. Chromium browser and | ||
| 70 | xterm are two examples. Firefox and transmission-gtk seem to be | ||
| 71 | working fine. A network namespace is not required for this | ||
| 72 | option. | ||
| 73 | |||
| 74 | Example: | ||
| 75 | $ firejail --x11=xorg firefox | ||
| 76 | ````` | 49 | ````` |
| 77 | 50 | # Current development version: 0.9.45 | |
| 78 | ## Other command line options | ||
| 79 | ````` | 51 | ````` |
| 80 | --put=name|pid src-filename dest-filename | ||
| 81 | Put src-filename in sandbox container. The container is specified by name or PID. | ||
| 82 | |||
| 83 | --allusers | ||
| 84 | All user home directories are visible inside the sandbox. By default, only current user home | ||
| 85 | directory is visible. | ||
| 86 | |||
| 87 | Example: | ||
| 88 | $ firejail --allusers | ||
| 89 | |||
| 90 | --join-or-start=name | ||
| 91 | Join the sandbox identified by name or start a new one. Same as "firejail --join=name" if | ||
| 92 | sandbox with specified name exists, otherwise same as "firejail --name=name ..." | ||
| 93 | Note that in contrary to other join options there is respective profile option. | ||
| 94 | |||
| 95 | --no3d Disable 3D hardware acceleration. | ||
| 96 | |||
| 97 | Example: | ||
| 98 | $ firejail --no3d firefox | ||
| 99 | |||
| 100 | --veth-name=name | ||
| 101 | Use this name for the interface connected to the bridge for | ||
| 102 | --net=bridge_interface commands, instead of the default one. | ||
| 103 | |||
| 104 | Example: | ||
| 105 | $ firejail --net=br0 --veth-name=if0 | ||
| 106 | 52 | ||
| 107 | ````` | 53 | ````` |
| 108 | 54 | ## New Profiles | |
| 109 | ## New profile commands | 55 | xiphos, Tor Browser Bundle |
| 110 | |||
| 111 | x11 xpra, x11 xephyr, x11 none, x11 xorg, allusers, join-or-start | ||
| 112 | |||
| 113 | ## New profiles | ||
| 114 | |||
| 115 | qpdfview, mupdf, Luminance HDR, Synfig Studio, Gimp, Inkscape, feh, ranger, zathura, 7z, keepass, keepassx, | ||
| 116 | claws-mail, mutt, git, emacs, vim, xpdf | ||
| 117 | 56 | ||