aboutsummaryrefslogtreecommitdiffstats
path: root/README.md
diff options
context:
space:
mode:
Diffstat (limited to 'README.md')
-rw-r--r--README.md71
1 files changed, 0 insertions, 71 deletions
diff --git a/README.md b/README.md
index 5e39b8765..ecae2d38a 100644
--- a/README.md
+++ b/README.md
@@ -34,74 +34,3 @@ FAQ: https://l3net.wordpress.com/projects/firejail/firejail-faq/
34 34
35 35
36 36
37## New features in the development version
38
39### Whitelisting in default Firefox profile
40
41The next release will bring in default whitelisting for Firefox files and folders under /home/user.
42If you start the sandbox without any other options, this is what you'll get:
43
44![Whitelisted home directory](firefox-whitelist.png?raw=true)
45
46The code is located in etc/firefox.inc file:
47
48`````
49whitelist ~/.mozilla
50whitelist ~/Downloads
51whitelist ~/dwhelper
52whitelist ~/.zotero
53whitelist ~/.lastpass
54whitelist ~/.gtkrc-2.0
55whitelist ~/.vimperatorrc
56whitelist ~/.vimperator
57whitelist ~/.pentadactylrc
58whitelist ~/.pentadactyl
59`````
60
61I intend to bring in all files and directories used by Firefox addons and plugins. So far I have
62[Video DownloadHelper](https://addons.mozilla.org/en-US/firefox/addon/video-downloadhelper/),
63[Zotero](https://www.zotero.org/download/),
64[LastPass](https://addons.mozilla.org/en-US/firefox/addon/lastpass-password-manager/),
65[Vimperator](https://addons.mozilla.org/en-US/firefox/addon/vimperator/)
66and [Pentadactyl](http://5digits.org/pentadactyl/)
67If you're using anything else, please let me know.
68
69### Whitelisting in default Chromium profile
70
71![Whitelisted home directory](chromium-whitelist.png?raw=true)
72
73### --ignore option
74
75Ignore commands in profile files. Example:
76`````
77$ firejail --ignore=seccomp wine
78`````
79
80### --protocol option
81
82Enable protocol filter. It is based on seccomp and it filters the first argument to socket system call.
83If the value is not recognized, seccomp will kill the process.
84Valid values: unix, inet, inet6, netlink and packet.
85
86Example:
87`````
88$ firejail --protocol=unix,inet,inet6
89`````
90
91"unix" describes the regular Unix socket connections,
92and "inet" and "inet6" describe the regular IPv4 and IPv6 traffic. Most GUI applications need "unix,inet,inet6". "netlink" is the protocol
93used to talk to Linux kernel. You'll only need this for applications such as [iproute2](http://www.linuxfoundation.org/collaborate/workgroups/networking/iproute2)
94used in system administration, and "packet" is used by sniffers to talk directly with the Ethernet layer.
95
96Protocol filter is enabled in all default security profiles for GUI applications ("protocol unix,inet,inet6").
97
98### Dual i386/amd64 seccomp filter
99
100--seccomp option now installs a dual i386/amd64 default filter.
10132bit applications, such as Skype, running on regular 64bit computers, are protected by i386 seccomp filter.
102
103### New security profiles
104
105Steam, Skype, Wine. The dual seccomp filter is enabled by default for these applications.
106
107