diff options
Diffstat (limited to 'src/firejail/firejail.h')
-rw-r--r-- | src/firejail/firejail.h | 24 |
1 files changed, 14 insertions, 10 deletions
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index dcec160fb..cf540ff91 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -25,7 +25,6 @@ | |||
25 | // debug restricted shell | 25 | // debug restricted shell |
26 | //#define DEBUG_RESTRICTED_SHELL | 26 | //#define DEBUG_RESTRICTED_SHELL |
27 | 27 | ||
28 | |||
29 | // filesystem | 28 | // filesystem |
30 | #define RUN_FIREJAIL_BASEDIR "/run" | 29 | #define RUN_FIREJAIL_BASEDIR "/run" |
31 | #define RUN_FIREJAIL_DIR "/run/firejail" | 30 | #define RUN_FIREJAIL_DIR "/run/firejail" |
@@ -38,8 +37,6 @@ | |||
38 | #define RUN_RO_DIR "/run/firejail/firejail.ro.dir" | 37 | #define RUN_RO_DIR "/run/firejail/firejail.ro.dir" |
39 | #define RUN_RO_FILE "/run/firejail/firejail.ro.file" | 38 | #define RUN_RO_FILE "/run/firejail/firejail.ro.file" |
40 | #define RUN_MNT_DIR "/run/firejail/mnt" // a tmpfs is mounted on this directory before any of the files below are created | 39 | #define RUN_MNT_DIR "/run/firejail/mnt" // a tmpfs is mounted on this directory before any of the files below are created |
41 | #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp" | ||
42 | #define RUN_SECCOMP_PROTOCOL "/run/firejail/mnt/seccomp.protocol" | ||
43 | #define RUN_CGROUP_CFG "/run/firejail/mnt/cgroup" | 40 | #define RUN_CGROUP_CFG "/run/firejail/mnt/cgroup" |
44 | #define RUN_CPU_CFG "/run/firejail/mnt/cpu" | 41 | #define RUN_CPU_CFG "/run/firejail/mnt/cpu" |
45 | #define RUN_GROUPS_CFG "/run/firejail/mnt/groups" | 42 | #define RUN_GROUPS_CFG "/run/firejail/mnt/groups" |
@@ -50,6 +47,12 @@ | |||
50 | #define RUN_BIN_DIR "/run/firejail/mnt/bin" | 47 | #define RUN_BIN_DIR "/run/firejail/mnt/bin" |
51 | #define RUN_PULSE_DIR "/run/firejail/mnt/pulse" | 48 | #define RUN_PULSE_DIR "/run/firejail/mnt/pulse" |
52 | 49 | ||
50 | #define RUN_SECCOMP_CFG "/run/firejail/mnt/seccomp" // configured filter | ||
51 | #define RUN_SECCOMP_PROTOCOL "/run/firejail/mnt/seccomp.protocol" // protocol filter | ||
52 | #define RUN_SECCOMP_AMD64 "/run/firejail/mnt/seccomp.amd64" // amd64 filter installed on i386 architectures | ||
53 | #define RUN_SECCOMP_I386 "/run/firejail/mnt/seccomp.i386" // i386 filter installed on amd64 architectures | ||
54 | |||
55 | |||
53 | #define RUN_DEV_DIR "/run/firejail/mnt/dev" | 56 | #define RUN_DEV_DIR "/run/firejail/mnt/dev" |
54 | #define RUN_DEVLOG_FILE "/run/firejail/mnt/devlog" | 57 | #define RUN_DEVLOG_FILE "/run/firejail/mnt/devlog" |
55 | 58 | ||
@@ -76,6 +79,8 @@ | |||
76 | #define RUN_GROUP_FILE "/run/firejail/mnt/group" | 79 | #define RUN_GROUP_FILE "/run/firejail/mnt/group" |
77 | #define RUN_FSLOGGER_FILE "/run/firejail/mnt/fslogger" | 80 | #define RUN_FSLOGGER_FILE "/run/firejail/mnt/fslogger" |
78 | 81 | ||
82 | |||
83 | |||
79 | // profiles | 84 | // profiles |
80 | #define DEFAULT_USER_PROFILE "default" | 85 | #define DEFAULT_USER_PROFILE "default" |
81 | #define DEFAULT_ROOT_PROFILE "server" | 86 | #define DEFAULT_ROOT_PROFILE "server" |
@@ -491,12 +496,14 @@ void fs_private_home_list(void); | |||
491 | 496 | ||
492 | 497 | ||
493 | // seccomp.c | 498 | // seccomp.c |
499 | int seccomp_load(const char *fname); | ||
500 | void seccomp_filter_32(void); | ||
501 | void seccomp_filter_64(void); | ||
494 | int seccomp_filter_drop(int enforce_seccomp); | 502 | int seccomp_filter_drop(int enforce_seccomp); |
495 | int seccomp_filter_keep(void); | 503 | int seccomp_filter_keep(void); |
496 | void seccomp_set(void); | 504 | int seccomp_filter_errno(void); |
497 | void seccomp_print_filter_name(const char *name); | 505 | void seccomp_print_filter_name(const char *name); |
498 | void seccomp_print_filter(pid_t pid); | 506 | void seccomp_print_filter(pid_t pid); |
499 | int seccomp_filter_errno(void); | ||
500 | 507 | ||
501 | // caps.c | 508 | // caps.c |
502 | int caps_default_filter(void); | 509 | int caps_default_filter(void); |
@@ -591,13 +598,10 @@ void fs_check_bin_list(void); | |||
591 | void fs_private_bin_list(void); | 598 | void fs_private_bin_list(void); |
592 | 599 | ||
593 | // protocol.c | 600 | // protocol.c |
594 | void protocol_list(); | ||
595 | void protocol_print_filter_name(const char *name); | ||
596 | void protocol_print_filter(pid_t pid); | ||
597 | void protocol_store(const char *prlist); | ||
598 | void protocol_filter(const char *fname); | ||
599 | void protocol_filter_save(void); | 601 | void protocol_filter_save(void); |
600 | void protocol_filter_load(const char *fname); | 602 | void protocol_filter_load(const char *fname); |
603 | void protocol_print_filter_name(const char *name); | ||
604 | void protocol_print_filter(pid_t pid); | ||
601 | 605 | ||
602 | // restrict_users.c | 606 | // restrict_users.c |
603 | void restrict_users(void); | 607 | void restrict_users(void); |