aboutsummaryrefslogtreecommitdiffstats
path: root/etc-fixes
diff options
context:
space:
mode:
Diffstat (limited to 'etc-fixes')
-rw-r--r--etc-fixes/0.9.38/firefox.profile32
-rw-r--r--etc-fixes/0.9.52/atom.profile31
-rw-r--r--etc-fixes/0.9.52/firefox.profile99
-rw-r--r--etc-fixes/0.9.52/gedit.profile44
-rw-r--r--etc-fixes/0.9.52/libreoffice.profile36
-rw-r--r--etc-fixes/0.9.56/brave-browser.profile6
-rw-r--r--etc-fixes/0.9.56/brave.profile24
-rw-r--r--etc-fixes/0.9.58/atom.profile36
-rw-r--r--etc-fixes/0.9.60/atom.profile37
-rw-r--r--etc-fixes/seccomp-join-bug/README11
-rw-r--r--etc-fixes/seccomp-join-bug/eecf35c-backports.zipbin0 -> 10472 bytes
11 files changed, 356 insertions, 0 deletions
diff --git a/etc-fixes/0.9.38/firefox.profile b/etc-fixes/0.9.38/firefox.profile
new file mode 100644
index 000000000..00244aaa4
--- /dev/null
+++ b/etc-fixes/0.9.38/firefox.profile
@@ -0,0 +1,32 @@
1# Firejail profile for Mozilla Firefox (Iceweasel in Debian)
2noblacklist ${HOME}/.mozilla
3include /etc/firejail/disable-mgmt.inc
4include /etc/firejail/disable-secret.inc
5include /etc/firejail/disable-common.inc
6include /etc/firejail/disable-devel.inc
7caps.drop all
8
9#seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
10seccomp.drop adjtimex,clock_adjtime,clock_settime,settimeofday,stime,modify_ldt,subpage_prot,switch_endian,vm86,vm86old,lookup_dcookie,perf_event_open,process_vm_writev,rtas,s390_runtime_instr,sys_debug_setcontext,delete_module,finit_module,init_module,_sysctl,afs_syscall,bdflush,break,create_module,ftime,get_kernel_syms,getpmsg,gtty,lock,mpx,prof,profil,putpmsg,query_module,security,sgetmask,ssetmask,stty,sysfs,tuxcall,ulimit,uselib,ustat,vserver,ioperm,iopl,pciconfig_iobase,pciconfig_read,pciconfig_write,s390_mmio_read,s390_mmio_write,kexec_load,kexec_file_load,reboot,set_mempolicy,migrate_pages,move_pages,mbind,swapon,swapoff,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
11
12protocol unix,inet,inet6,netlink
13netfilter
14# tracelog
15noroot
16whitelist ${DOWNLOADS}
17whitelist ${HOME}/.mozilla
18whitelist ${HOME}/.cache/mozilla/firefox
19whitelist ${HOME}/dwhelper
20whitelist ${HOME}/.zotero
21whitelist ${HOME}/.lastpass
22whitelist ${HOME}/.vimperatorrc
23whitelist ${HOME}/.vimperator
24whitelist ${HOME}/.pentadactylrc
25whitelist ${HOME}/.pentadactyl
26whitelist ${HOME}/.keysnail.js
27whitelist ${HOME}/.config/gnome-mplayer
28whitelist ${HOME}/.cache/gnome-mplayer/plugin
29include /etc/firejail/whitelist-common.inc
30
31# experimental features
32#private-etc alternatives,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,gtk-2.0,pango,fonts,iceweasel,firefox,adobe,mime.types,mailcap,asound.conf,pulse
diff --git a/etc-fixes/0.9.52/atom.profile b/etc-fixes/0.9.52/atom.profile
new file mode 100644
index 000000000..87ffdced9
--- /dev/null
+++ b/etc-fixes/0.9.52/atom.profile
@@ -0,0 +1,31 @@
1# Firejail profile for atom
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/atom.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8# blacklist /run/user/*/bus
9
10noblacklist ${HOME}/.atom
11noblacklist ${HOME}/.config/Atom
12
13include /etc/firejail/disable-common.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16
17caps.keep sys_admin,sys_chroot
18# net none
19netfilter
20nodvd
21nogroups
22nosound
23notv
24novideo
25shell none
26
27private-dev
28private-tmp
29
30noexec ${HOME}
31noexec /tmp
diff --git a/etc-fixes/0.9.52/firefox.profile b/etc-fixes/0.9.52/firefox.profile
new file mode 100644
index 000000000..6a9ff977e
--- /dev/null
+++ b/etc-fixes/0.9.52/firefox.profile
@@ -0,0 +1,99 @@
1# Firejail profile for firefox
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/firefox.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.cache/mozilla
9noblacklist ${HOME}/.config/okularpartrc
10noblacklist ${HOME}/.config/okularrc
11noblacklist ${HOME}/.config/qpdfview
12noblacklist ${HOME}/.kde/share/apps/kget
13noblacklist ${HOME}/.kde/share/apps/okular
14noblacklist ${HOME}/.kde/share/config/kgetrc
15noblacklist ${HOME}/.kde/share/config/okularpartrc
16noblacklist ${HOME}/.kde/share/config/okularrc
17noblacklist ${HOME}/.kde4/share/apps/kget
18noblacklist ${HOME}/.kde4/share/apps/okular
19noblacklist ${HOME}/.kde4/share/config/kgetrc
20noblacklist ${HOME}/.kde4/share/config/okularpartrc
21noblacklist ${HOME}/.kde4/share/config/okularrc
22# noblacklist ${HOME}/.local/share/gnome-shell/extensions
23noblacklist ${HOME}/.local/share/okular
24noblacklist ${HOME}/.local/share/qpdfview
25noblacklist ${HOME}/.mozilla
26noblacklist ${HOME}/.pki
27noblacklist ${HOME}/.local/share/pki
28
29include /etc/firejail/disable-common.inc
30include /etc/firejail/disable-devel.inc
31include /etc/firejail/disable-programs.inc
32
33mkdir ${HOME}/.cache/mozilla/firefox
34mkdir ${HOME}/.mozilla
35mkdir ${HOME}/.pki
36mkdir ${HOME}/.local/share/pki
37whitelist ${DOWNLOADS}
38whitelist ${HOME}/.cache/gnome-mplayer/plugin
39whitelist ${HOME}/.cache/mozilla/firefox
40whitelist ${HOME}/.config/gnome-mplayer
41whitelist ${HOME}/.config/okularpartrc
42whitelist ${HOME}/.config/okularrc
43whitelist ${HOME}/.config/pipelight-silverlight5.1
44whitelist ${HOME}/.config/pipelight-widevine
45whitelist ${HOME}/.config/qpdfview
46whitelist ${HOME}/.kde/share/apps/kget
47whitelist ${HOME}/.kde/share/apps/okular
48whitelist ${HOME}/.kde/share/config/kgetrc
49whitelist ${HOME}/.kde/share/config/okularpartrc
50whitelist ${HOME}/.kde/share/config/okularrc
51whitelist ${HOME}/.kde4/share/apps/kget
52whitelist ${HOME}/.kde4/share/apps/okular
53whitelist ${HOME}/.kde4/share/config/kgetrc
54whitelist ${HOME}/.kde4/share/config/okularpartrc
55whitelist ${HOME}/.kde4/share/config/okularrc
56whitelist ${HOME}/.keysnail.js
57whitelist ${HOME}/.lastpass
58whitelist ${HOME}/.local/share/gnome-shell/extensions
59whitelist ${HOME}/.local/share/okular
60whitelist ${HOME}/.local/share/qpdfview
61whitelist ${HOME}/.mozilla
62whitelist ${HOME}/.pentadactyl
63whitelist ${HOME}/.pentadactylrc
64whitelist ${HOME}/.pki
65whitelist ${HOME}/.local/share/pki
66whitelist ${HOME}/.vimperator
67whitelist ${HOME}/.vimperatorrc
68whitelist ${HOME}/.wine-pipelight
69whitelist ${HOME}/.wine-pipelight64
70whitelist ${HOME}/.zotero
71whitelist ${HOME}/dwhelper
72include /etc/firejail/whitelist-common.inc
73include /etc/firejail/whitelist-var-common.inc
74
75caps.drop all
76# machine-id breaks pulse audio; it should work fine in setups where sound is not required
77#machine-id
78netfilter
79nodvd
80nogroups
81nonewprivs
82noroot
83notv
84protocol unix,inet,inet6,netlink
85#seccomp - replaced with seccomp.drop for Firefox 60
86seccomp.drop @clock,@cpu-emulation,@debug,@module,@obsolete,@raw-io,@reboot,@resources,@swap,acct,add_key,bpf,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,mount,name_to_handle_at,nfsservctl,ni_syscall,open_by_handle_at,personality,pivot_root,process_vm_readv,ptrace,remap_file_pages,request_key,setdomainname,sethostname,syslog,umount,umount2,userfaultfd,vhangup,vmsplice
87shell none
88#tracelog - disabled for Firefox 60
89
90disable-mnt
91# firefox requires a shell to launch on Arch.
92# private-bin firefox,which,sh,dbus-launch,dbus-send,env,bash
93private-dev
94# private-etc below works fine on most distributions. There are some problems on CentOS.
95# private-etc alternatives,iceweasel,ca-certificates,ssl,machine-id,dconf,selinux,passwd,group,hostname,hosts,localtime,nsswitch.conf,resolv.conf,xdg,gtk-2.0,gtk-3.0,X11,pango,fonts,firefox,mime.types,mailcap,asound.conf,pulse
96private-tmp
97
98noexec ${HOME}
99noexec /tmp
diff --git a/etc-fixes/0.9.52/gedit.profile b/etc-fixes/0.9.52/gedit.profile
new file mode 100644
index 000000000..8dd71a196
--- /dev/null
+++ b/etc-fixes/0.9.52/gedit.profile
@@ -0,0 +1,44 @@
1# Firejail profile for gedit
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/gedit.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8# blacklist /run/user/*/bus - makes settings immutable
9
10noblacklist ${HOME}/.config/enchant
11noblacklist ${HOME}/.config/gedit
12noblacklist ${HOME}/.gitconfig
13
14include /etc/firejail/disable-common.inc
15# include /etc/firejail/disable-devel.inc
16include /etc/firejail/disable-passwdmgr.inc
17include /etc/firejail/disable-programs.inc
18
19include /etc/firejail/whitelist-var-common.inc
20
21caps.drop all
22# net none - makes settings immutable
23machine-id
24no3d
25nodvd
26nogroups
27nonewprivs
28noroot
29nosound
30notv
31novideo
32protocol unix
33seccomp
34shell none
35tracelog
36
37# private-bin gedit
38private-dev
39# private-etc alternatives,fonts
40#private-lib gedit - disabled; problems when running "firejail gedit"; "firejail /usr/bin/gedit" works fine
41private-tmp
42
43noexec ${HOME}
44noexec /tmp
diff --git a/etc-fixes/0.9.52/libreoffice.profile b/etc-fixes/0.9.52/libreoffice.profile
new file mode 100644
index 000000000..bbc52ff5e
--- /dev/null
+++ b/etc-fixes/0.9.52/libreoffice.profile
@@ -0,0 +1,36 @@
1# Firejail profile for libreoffice
2# This file is overwritten after every install/update
3# Persistent local customizations
4include /etc/firejail/libreoffice.local
5# Persistent global definitions
6include /etc/firejail/globals.local
7
8noblacklist ${HOME}/.java
9noblacklist /usr/local/sbin
10noblacklist ${HOME}/.config/libreoffice
11
12include /etc/firejail/disable-common.inc
13include /etc/firejail/disable-devel.inc
14include /etc/firejail/disable-passwdmgr.inc
15include /etc/firejail/disable-programs.inc
16
17include /etc/firejail/whitelist-var-common.inc
18
19caps.drop all
20machine-id
21netfilter
22nodvd
23nogroups
24#nonewprivs
25noroot
26notv
27#protocol unix,inet,inet6
28#seccomp
29shell none
30#tracelog
31
32private-dev
33private-tmp
34
35noexec ${HOME}
36noexec /tmp
diff --git a/etc-fixes/0.9.56/brave-browser.profile b/etc-fixes/0.9.56/brave-browser.profile
new file mode 100644
index 000000000..6e3a5df28
--- /dev/null
+++ b/etc-fixes/0.9.56/brave-browser.profile
@@ -0,0 +1,6 @@
1# Firejail profile alias for brave
2# This file is overwritten after every install/update
3
4
5# Redirect
6include /etc/firejail/brave.profile
diff --git a/etc-fixes/0.9.56/brave.profile b/etc-fixes/0.9.56/brave.profile
new file mode 100644
index 000000000..4c59c103f
--- /dev/null
+++ b/etc-fixes/0.9.56/brave.profile
@@ -0,0 +1,24 @@
1# Firejail profile for brave
2# This file is overwritten after every install/update
3# Description: Web browser that blocks ads and trackers by default.
4# Persistent local customizations
5include brave.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.config/brave
10noblacklist ${HOME}/.config/BraveSoftware
11# brave uses gpg for built-in password manager
12noblacklist ${HOME}/.gnupg
13
14mkdir ${HOME}/.config/brave
15mkdir ${HOME}/.config/BraveSoftware
16whitelist ${HOME}/.config/brave
17whitelist ${HOME}/.config/BraveSoftware
18whitelist ${HOME}/.gnupg
19
20# noexec /tmp is included in chromium-common.profile and breaks Brave
21ignore noexec /tmp
22
23# Redirect
24include /etc/firejail/chromium-common.profile
diff --git a/etc-fixes/0.9.58/atom.profile b/etc-fixes/0.9.58/atom.profile
new file mode 100644
index 000000000..9bc35da5a
--- /dev/null
+++ b/etc-fixes/0.9.58/atom.profile
@@ -0,0 +1,36 @@
1
2# Firejail profile for atom
3# Description: A hackable text editor for the 21st Century
4# This file is overwritten after every install/update
5# Persistent local customizations
6include atom.local
7# Persistent global definitions
8include globals.local
9
10noblacklist ${HOME}/.atom
11noblacklist ${HOME}/.config/Atom
12noblacklist ${HOME}/.cargo/config
13noblacklist ${HOME}/.cargo/registry
14
15include disable-common.inc
16include disable-passwdmgr.inc
17include disable-programs.inc
18
19caps.keep sys_admin,sys_chroot
20# net none
21netfilter
22nodbus
23nodvd
24nogroups
25nosound
26notv
27nou2f
28novideo
29shell none
30
31private-cache
32private-dev
33private-tmp
34
35noexec ${HOME}
36noexec /tmp
diff --git a/etc-fixes/0.9.60/atom.profile b/etc-fixes/0.9.60/atom.profile
new file mode 100644
index 000000000..c8929127b
--- /dev/null
+++ b/etc-fixes/0.9.60/atom.profile
@@ -0,0 +1,37 @@
1# Firejail profile for atom
2# Description: A hackable text editor for the 21st Century
3# This file is overwritten after every install/update
4# Persistent local customizations
5include atom.local
6# Persistent global definitions
7include globals.local
8
9noblacklist ${HOME}/.atom
10noblacklist ${HOME}/.config/Atom
11noblacklist ${HOME}/.config/git
12noblacklist ${HOME}/.cargo/config
13noblacklist ${HOME}/.cargo/registry
14noblacklist ${HOME}/.gitconfig
15noblacklist ${HOME}/.git-credentials
16noblacklist ${HOME}/.pythonrc.py
17
18include disable-common.inc
19include disable-exec.inc
20include disable-passwdmgr.inc
21include disable-programs.inc
22
23caps.keep sys_admin,sys_chroot
24# net none
25netfilter
26nodbus
27nodvd
28nogroups
29nosound
30notv
31nou2f
32novideo
33shell none
34
35private-cache
36private-dev
37private-tmp
diff --git a/etc-fixes/seccomp-join-bug/README b/etc-fixes/seccomp-join-bug/README
new file mode 100644
index 000000000..9f85a0e00
--- /dev/null
+++ b/etc-fixes/seccomp-join-bug/README
@@ -0,0 +1,11 @@
1These are patches for various Firejail versions for the security bug reported by Austin Morton
2on May 21, 2019:
3
4 Seccomp filters are copied into /run/firejail/mnt, and are writable
5 within the jail. A malicious process can modify files from inside the
6 jail. Processes that are later joined to the jail will not have seccomp
7 filters applied.
8
9The original discussion thread: https://github.com/netblue30/firejail/issues/2718
10The fix on mainline: https://github.com/netblue30/firejail/commit/eecf35c2f8249489a1d3e512bb07f0d427183134
11
diff --git a/etc-fixes/seccomp-join-bug/eecf35c-backports.zip b/etc-fixes/seccomp-join-bug/eecf35c-backports.zip
new file mode 100644
index 000000000..59782461e
--- /dev/null
+++ b/etc-fixes/seccomp-join-bug/eecf35c-backports.zip
Binary files differ
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-21 07:19:02 +0000