summaryrefslogtreecommitdiffstats
path: root/src/man/firejail.txt
diff options
context:
space:
mode:
Diffstat (limited to 'src/man/firejail.txt')
-rw-r--r--src/man/firejail.txt23
1 files changed, 16 insertions, 7 deletions
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 7427b1009..f7d18536d 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -395,7 +395,7 @@ $ firejail \-\-net=eth0 \-\-defaultgw=10.10.20.1 firefox
395 395
396.TP 396.TP
397\fB\-\-disable-mnt 397\fB\-\-disable-mnt
398Disable /mnt, /media, /run/mount and /run/media access. 398Blacklist /mnt, /media, /run/mount and /run/media access.
399.br 399.br
400 400
401.br 401.br
@@ -1531,7 +1531,7 @@ drwxrwxrwt 2 nobody nogroup 4096 Apr 30 10:52 .X11-unix
1531 1531
1532 1532
1533.TP 1533.TP
1534\fB\-\-profile=filename 1534\fB\-\-profile=filename_or_profilename
1535Load a custom security profile from filename. For filename use an absolute path or a path relative to the current path. 1535Load a custom security profile from filename. For filename use an absolute path or a path relative to the current path.
1536For more information, see \fBSECURITY PROFILES\fR section below. 1536For more information, see \fBSECURITY PROFILES\fR section below.
1537.br 1537.br
@@ -1681,12 +1681,12 @@ Enable seccomp filter and blacklist the syscalls in the default list (@default).
1681_sysctl, acct, add_key, adjtimex, afs_syscall, bdflush, bpf, break, chroot, clock_adjtime, clock_settime, 1681_sysctl, acct, add_key, adjtimex, afs_syscall, bdflush, bpf, break, chroot, clock_adjtime, clock_settime,
1682create_module, delete_module, fanotify_init, finit_module, ftime, get_kernel_syms, getpmsg, gtty, init_module, 1682create_module, delete_module, fanotify_init, finit_module, ftime, get_kernel_syms, getpmsg, gtty, init_module,
1683io_cancel, io_destroy, io_getevents, io_setup, io_submit, ioperm, iopl, ioprio_set, kcmp, kexec_file_load, 1683io_cancel, io_destroy, io_getevents, io_setup, io_submit, ioperm, iopl, ioprio_set, kcmp, kexec_file_load,
1684kexec_load, keyctl, lock, lookup_dcookie, mbind, mfsservctl, migrate_pages, modify_ldt, mount, move_pages, mpx, 1684kexec_load, keyctl, lock, lookup_dcookie, mbind, migrate_pages, modify_ldt, mount, move_pages, mpx,
1685name_to_handle_at, open_by_handle_at, pciconfig_iobase, pciconfig_read, pciconfig_write, perf_event_open, 1685name_to_handle_at, nfsservctl, ni_syscall, open_by_handle_at, pciconfig_iobase, pciconfig_read, pciconfig_write, perf_event_open,
1686personality, pivot_root, process_vm_readv, process_vm_writev, process_vm_writev, prof, profil, ptrace, putpmsg, 1686personality, pivot_root, process_vm_readv, process_vm_writev, prof, profil, ptrace, putpmsg,
1687query_module, reboot, remap_file_pages, request_key, rtas, s390_mmio_read, s390_mmio_write, s390_runtime_instr, 1687query_module, reboot, remap_file_pages, request_key, rtas, s390_mmio_read, s390_mmio_write, s390_runtime_instr,
1688security, set_mempolicy, setdomainname, sethostname, settimeofday, sgetmask, ssetmask, stime, stty, subpage_prot, 1688security, set_mempolicy, setdomainname, sethostname, settimeofday, sgetmask, ssetmask, stime, stty, subpage_prot,
1689swapoff, swapon, switch_endian, sysfs, syslog, tuxcall, ulimit, umount, umount2, uselib, userfaultfd, ustat, vhangup, 1689swapoff, swapon, switch_endian, sys_debug_setcontext, sysfs, syslog, tuxcall, ulimit, umount, umount2, uselib, userfaultfd, ustat, vhangup,
1690vm86, vm86old, vmsplice and vserver. 1690vm86, vm86old, vmsplice and vserver.
1691 1691
1692.br 1692.br
@@ -2701,7 +2701,7 @@ The owner of the sandbox.
2701Several command line options can be passed to the program using 2701Several command line options can be passed to the program using
2702profile files. Firejail chooses the profile file as follows: 2702profile files. Firejail chooses the profile file as follows:
2703 2703
27041. If a profile file is provided by the user with --profile option, the profile file is loaded. 27041. If a profile file is provided by the user with --profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix.
2705Example: 2705Example:
2706.PP 2706.PP
2707.RS 2707.RS
@@ -2712,6 +2712,15 @@ Reading profile /home/netblue/icecat.profile
2712[...] 2712[...]
2713.RE 2713.RE
2714 2714
2715.PP
2716.RS
2717$ firejail --profile=icecat icecat-wrapper.sh
2718.br
2719Reading profile /etc/firejail/icecat.profile
2720.br
2721[...]
2722.RE
2723
27152. If a profile file with the same name as the application is present in ~/.config/firejail directory or 27242. If a profile file with the same name as the application is present in ~/.config/firejail directory or
2716in /etc/firejail, the profile is loaded. ~/.config/firejail takes precedence over /etc/firejail. Example: 2725in /etc/firejail, the profile is loaded. ~/.config/firejail takes precedence over /etc/firejail. Example:
2717.PP 2726.PP