diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/bash_completion/Makefile.in | 3 | ||||
-rw-r--r-- | src/fbuilder/Makefile.in | 3 | ||||
-rw-r--r-- | src/fcopy/Makefile.in | 3 | ||||
-rw-r--r-- | src/firecfg/Makefile.in | 3 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 2 | ||||
-rw-r--r-- | src/firejail/Makefile.in | 3 | ||||
-rw-r--r-- | src/firejail/fs_etc.c | 16 | ||||
-rw-r--r-- | src/firejail/profile.c | 5 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 24 | ||||
-rw-r--r-- | src/firemon/Makefile.in | 3 | ||||
-rw-r--r-- | src/fldd/Makefile.in | 3 | ||||
-rw-r--r-- | src/fnet/Makefile.in | 3 | ||||
-rw-r--r-- | src/fnetfilter/Makefile.in | 3 | ||||
-rw-r--r-- | src/fsec-optimize/Makefile.in | 3 | ||||
-rw-r--r-- | src/fsec-print/Makefile.in | 3 | ||||
-rw-r--r-- | src/fseccomp/Makefile.in | 3 | ||||
-rw-r--r-- | src/ftee/Makefile.in | 3 | ||||
-rw-r--r-- | src/jailtest/Makefile.in | 3 | ||||
-rw-r--r-- | src/lib/Makefile.in | 3 | ||||
-rw-r--r-- | src/libpostexecseccomp/Makefile.in | 3 | ||||
-rw-r--r-- | src/libtrace/Makefile.in | 4 | ||||
-rw-r--r-- | src/libtracelog/Makefile.in | 4 | ||||
-rw-r--r-- | src/man/Makefile.in | 4 | ||||
-rw-r--r-- | src/man/firejail-profile.txt | 2 | ||||
-rw-r--r-- | src/man/jailtest.txt | 6 | ||||
-rw-r--r-- | src/profstats/Makefile.in | 3 | ||||
-rw-r--r-- | src/zsh_completion/Makefile.in | 3 |
27 files changed, 96 insertions, 25 deletions
diff --git a/src/bash_completion/Makefile.in b/src/bash_completion/Makefile.in index d8a393aa4..f7db9e6b4 100644 --- a/src/bash_completion/Makefile.in +++ b/src/bash_completion/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: firejail.bash_completion | 2 | all: firejail.bash_completion |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -7,8 +8,10 @@ firejail.bash_completion: firejail.bash_completion.in | |||
7 | sed "s|_SYSCONFDIR_|$(sysconfdir)|" < $@.tmp > $@ | 8 | sed "s|_SYSCONFDIR_|$(sysconfdir)|" < $@.tmp > $@ |
8 | rm $@.tmp | 9 | rm $@.tmp |
9 | 10 | ||
11 | .PHONY: clean | ||
10 | clean: | 12 | clean: |
11 | rm -fr firejail.bash_completion | 13 | rm -fr firejail.bash_completion |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fbuilder/Makefile.in b/src/fbuilder/Makefile.in index 2847ca2cb..6eaee284b 100644 --- a/src/fbuilder/Makefile.in +++ b/src/fbuilder/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fbuilder | 2 | all: fbuilder |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fbuilder: $(OBJS) | 9 | fbuilder: $(OBJS) |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fbuilder *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fbuilder *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fcopy/Makefile.in b/src/fcopy/Makefile.in index 85f84aa32..e19f5d3b5 100644 --- a/src/fcopy/Makefile.in +++ b/src/fcopy/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fcopy | 2 | all: fcopy |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fcopy: $(OBJS) ../lib/common.o | 9 | fcopy: $(OBJS) ../lib/common.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fcopy *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fcopy *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/firecfg/Makefile.in b/src/firecfg/Makefile.in index 40f6b9679..43329be46 100644 --- a/src/firecfg/Makefile.in +++ b/src/firecfg/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: firecfg | 2 | all: firecfg |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | firecfg: $(OBJS) ../lib/common.o ../lib/firejail_user.o | 9 | firecfg: $(OBJS) ../lib/common.o ../lib/firejail_user.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/firejail_user.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/firejail_user.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o firecfg *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o firecfg *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index b44a1bc85..16cd59aa5 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -553,6 +553,8 @@ neverputt | |||
553 | newsbeuter | 553 | newsbeuter |
554 | newsboat | 554 | newsboat |
555 | newsflash | 555 | newsflash |
556 | nextcloud | ||
557 | nextcloud-desktop | ||
556 | nheko | 558 | nheko |
557 | nicotine | 559 | nicotine |
558 | nitroshare | 560 | nitroshare |
diff --git a/src/firejail/Makefile.in b/src/firejail/Makefile.in index b9bf13b9c..793d2cdd1 100644 --- a/src/firejail/Makefile.in +++ b/src/firejail/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: firejail | 2 | all: firejail |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o | 9 | firejail: $(OBJS) ../lib/libnetlink.o ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o ../lib/firejail_user.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o firejail *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o firejail *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/firejail/fs_etc.c b/src/firejail/fs_etc.c index b9ed81db3..abec25d45 100644 --- a/src/firejail/fs_etc.c +++ b/src/firejail/fs_etc.c | |||
@@ -18,6 +18,7 @@ | |||
18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | 18 | * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. |
19 | */ | 19 | */ |
20 | #include "firejail.h" | 20 | #include "firejail.h" |
21 | #include <errno.h> | ||
21 | #include <sys/mount.h> | 22 | #include <sys/mount.h> |
22 | #include <sys/stat.h> | 23 | #include <sys/stat.h> |
23 | #include <sys/types.h> | 24 | #include <sys/types.h> |
@@ -147,12 +148,10 @@ void fs_private_dir_copy(const char *private_dir, const char *private_run_dir, c | |||
147 | struct stat s; | 148 | struct stat s; |
148 | if (stat(private_dir, &s) == -1) { | 149 | if (stat(private_dir, &s) == -1) { |
149 | if (arg_debug) | 150 | if (arg_debug) |
150 | printf("Cannot find %s\n", private_dir); | 151 | printf("Cannot find %s: %s\n", private_dir, strerror(errno)); |
151 | return; | 152 | return; |
152 | } | 153 | } |
153 | 154 | ||
154 | timetrace_start(); | ||
155 | |||
156 | // create /run/firejail/mnt/etc directory | 155 | // create /run/firejail/mnt/etc directory |
157 | mkdir_attr(private_run_dir, 0755, 0, 0); | 156 | mkdir_attr(private_run_dir, 0755, 0, 0); |
158 | selinux_relabel_path(private_run_dir, private_dir); | 157 | selinux_relabel_path(private_run_dir, private_dir); |
@@ -191,16 +190,17 @@ void fs_private_dir_mount(const char *private_dir, const char *private_run_dir) | |||
191 | assert(private_dir); | 190 | assert(private_dir); |
192 | assert(private_run_dir); | 191 | assert(private_run_dir); |
193 | 192 | ||
193 | if (arg_debug) | ||
194 | printf("Mount-bind %s on top of %s\n", private_run_dir, private_dir); | ||
195 | |||
194 | // nothing to do if directory does not exist | 196 | // nothing to do if directory does not exist |
195 | struct stat s; | 197 | struct stat s; |
196 | if (stat(private_dir, &s) == -1) { | 198 | if (stat(private_dir, &s) == -1) { |
197 | if (arg_debug) | 199 | if (arg_debug) |
198 | printf("Cannot find %s\n", private_dir); | 200 | printf("Cannot find %s: %s\n", private_dir, strerror(errno)); |
199 | return; | 201 | return; |
200 | } | 202 | } |
201 | 203 | ||
202 | if (arg_debug) | ||
203 | printf("Mount-bind %s on top of %s\n", private_run_dir, private_dir); | ||
204 | if (mount(private_run_dir, private_dir, NULL, MS_BIND|MS_REC, NULL) < 0) | 204 | if (mount(private_run_dir, private_dir, NULL, MS_BIND|MS_REC, NULL) < 0) |
205 | errExit("mount bind"); | 205 | errExit("mount bind"); |
206 | fs_logger2("mount", private_dir); | 206 | fs_logger2("mount", private_dir); |
@@ -209,11 +209,11 @@ void fs_private_dir_mount(const char *private_dir, const char *private_run_dir) | |||
209 | if (mount("tmpfs", private_run_dir, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME, "mode=755,gid=0") < 0) | 209 | if (mount("tmpfs", private_run_dir, "tmpfs", MS_NOSUID | MS_NODEV | MS_STRICTATIME, "mode=755,gid=0") < 0) |
210 | errExit("mounting tmpfs"); | 210 | errExit("mounting tmpfs"); |
211 | fs_logger2("tmpfs", private_run_dir); | 211 | fs_logger2("tmpfs", private_run_dir); |
212 | |||
213 | fmessage("Private %s installed in %0.2f ms\n", private_dir, timetrace_end()); | ||
214 | } | 212 | } |
215 | 213 | ||
216 | void fs_private_dir_list(const char *private_dir, const char *private_run_dir, const char *private_list) { | 214 | void fs_private_dir_list(const char *private_dir, const char *private_run_dir, const char *private_list) { |
215 | timetrace_start(); | ||
217 | fs_private_dir_copy(private_dir, private_run_dir, private_list); | 216 | fs_private_dir_copy(private_dir, private_run_dir, private_list); |
218 | fs_private_dir_mount(private_dir, private_run_dir); | 217 | fs_private_dir_mount(private_dir, private_run_dir); |
218 | fmessage("Private %s installed in %0.2f ms\n", private_dir, timetrace_end()); | ||
219 | } | 219 | } |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index f3266c23e..351b760df 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -157,6 +157,10 @@ static int check_nosound(void) { | |||
157 | return arg_nosound != 0; | 157 | return arg_nosound != 0; |
158 | } | 158 | } |
159 | 159 | ||
160 | static int check_private(void) { | ||
161 | return arg_private; | ||
162 | } | ||
163 | |||
160 | static int check_x11(void) { | 164 | static int check_x11(void) { |
161 | return (arg_x11_block || arg_x11_xorg || env_get("FIREJAIL_X11")); | 165 | return (arg_x11_block || arg_x11_xorg || env_get("FIREJAIL_X11")); |
162 | } | 166 | } |
@@ -174,6 +178,7 @@ Cond conditionals[] = { | |||
174 | {"HAS_NET", check_netoptions}, | 178 | {"HAS_NET", check_netoptions}, |
175 | {"HAS_NODBUS", check_nodbus}, | 179 | {"HAS_NODBUS", check_nodbus}, |
176 | {"HAS_NOSOUND", check_nosound}, | 180 | {"HAS_NOSOUND", check_nosound}, |
181 | {"HAS_PRIVATE", check_private}, | ||
177 | {"HAS_X11", check_x11}, | 182 | {"HAS_X11", check_x11}, |
178 | {"BROWSER_DISABLE_U2F", check_disable_u2f}, | 183 | {"BROWSER_DISABLE_U2F", check_disable_u2f}, |
179 | {"BROWSER_ALLOW_DRM", check_allow_drm}, | 184 | {"BROWSER_ALLOW_DRM", check_allow_drm}, |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index a04551ed4..b6e0468c6 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -575,12 +575,12 @@ void start_application(int no_sandbox, int fd, char *set_sandbox_status) { | |||
575 | } | 575 | } |
576 | 576 | ||
577 | static void enforce_filters(void) { | 577 | static void enforce_filters(void) { |
578 | fmessage("\n** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl **\n\n"); | ||
578 | // enforce NO_NEW_PRIVS | 579 | // enforce NO_NEW_PRIVS |
579 | arg_nonewprivs = 1; | 580 | arg_nonewprivs = 1; |
580 | force_nonewprivs = 1; | 581 | force_nonewprivs = 1; |
581 | 582 | ||
582 | // disable all capabilities | 583 | // disable all capabilities |
583 | fmessage("\n** Warning: dropping all Linux capabilities and setting NO_NEW_PRIVS prctl **\n\n"); | ||
584 | arg_caps_drop_all = 1; | 584 | arg_caps_drop_all = 1; |
585 | 585 | ||
586 | // drop all supplementary groups; /etc/group file inside chroot | 586 | // drop all supplementary groups; /etc/group file inside chroot |
@@ -786,14 +786,13 @@ int sandbox(void* sandbox_arg) { | |||
786 | #else | 786 | #else |
787 | bool always_enforce_filters = false; | 787 | bool always_enforce_filters = false; |
788 | #endif | 788 | #endif |
789 | // need ld.so.preload if tracing or seccomp with any non-default lists | ||
790 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; | ||
791 | // for --appimage, --chroot and --overlay* we force NO_NEW_PRIVS | 789 | // for --appimage, --chroot and --overlay* we force NO_NEW_PRIVS |
792 | // and drop all capabilities | 790 | // and drop all capabilities |
793 | if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay || always_enforce_filters)) { | 791 | if (getuid() != 0 && (arg_appimage || cfg.chrootdir || arg_overlay || always_enforce_filters)) |
794 | enforce_filters(); | 792 | enforce_filters(); |
795 | need_preload = arg_trace || arg_tracelog; | 793 | |
796 | } | 794 | // need ld.so.preload if tracing or seccomp with any non-default lists |
795 | bool need_preload = arg_trace || arg_tracelog || arg_seccomp_postexec; | ||
797 | 796 | ||
798 | // trace pre-install | 797 | // trace pre-install |
799 | if (need_preload) | 798 | if (need_preload) |
@@ -971,21 +970,24 @@ int sandbox(void* sandbox_arg) { | |||
971 | * 2. unmount bind mounts from /etc | 970 | * 2. unmount bind mounts from /etc |
972 | * 3. mount RUN_ETC_DIR at /etc | 971 | * 3. mount RUN_ETC_DIR at /etc |
973 | */ | 972 | */ |
973 | timetrace_start(); | ||
974 | fs_private_dir_copy("/etc", RUN_ETC_DIR, cfg.etc_private_keep); | 974 | fs_private_dir_copy("/etc", RUN_ETC_DIR, cfg.etc_private_keep); |
975 | fs_private_dir_copy("/usr/etc", RUN_USR_ETC_DIR, cfg.etc_private_keep); // openSUSE | ||
976 | 975 | ||
977 | if (umount2("/etc/group", MNT_DETACH) == -1) | 976 | if (umount2("/etc/group", MNT_DETACH) == -1) |
978 | fprintf(stderr, "/etc/group: unmount: %m\n"); | 977 | fprintf(stderr, "/etc/group: unmount: %s\n", strerror(errno)); |
979 | |||
980 | if (umount2("/etc/passwd", MNT_DETACH) == -1) | 978 | if (umount2("/etc/passwd", MNT_DETACH) == -1) |
981 | fprintf(stderr, "/etc/passwd: unmount: %m\n"); | 979 | fprintf(stderr, "/etc/passwd: unmount: %s\n", strerror(errno)); |
982 | 980 | ||
983 | fs_private_dir_mount("/etc", RUN_ETC_DIR); | 981 | fs_private_dir_mount("/etc", RUN_ETC_DIR); |
984 | fs_private_dir_mount("/usr/etc", RUN_USR_ETC_DIR); | 982 | fmessage("Private /etc installed in %0.2f ms\n", timetrace_end()); |
985 | 983 | ||
986 | // create /etc/ld.so.preload file again | 984 | // create /etc/ld.so.preload file again |
987 | if (need_preload) | 985 | if (need_preload) |
988 | fs_trace_preload(); | 986 | fs_trace_preload(); |
987 | |||
988 | // openSUSE configuration is split between /etc and /usr/etc | ||
989 | // process private-etc a second time | ||
990 | fs_private_dir_list("/usr/etc", RUN_USR_ETC_DIR, cfg.etc_private_keep); | ||
989 | } | 991 | } |
990 | } | 992 | } |
991 | 993 | ||
diff --git a/src/firemon/Makefile.in b/src/firemon/Makefile.in index 9ee798fe9..a1b6692aa 100644 --- a/src/firemon/Makefile.in +++ b/src/firemon/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: firemon | 2 | all: firemon |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | firemon: $(OBJS) ../lib/common.o ../lib/pid.o | 9 | firemon: $(OBJS) ../lib/common.o ../lib/pid.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o firemon *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o firemon *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fldd/Makefile.in b/src/fldd/Makefile.in index 37b139d38..ba87d16cd 100644 --- a/src/fldd/Makefile.in +++ b/src/fldd/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fldd | 2 | all: fldd |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fldd: $(OBJS) ../lib/common.o ../lib/ldd_utils.o | 9 | fldd: $(OBJS) ../lib/common.o ../lib/ldd_utils.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/ldd_utils.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fldd *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fldd *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fnet/Makefile.in b/src/fnet/Makefile.in index bd5fe9e7a..7447c6d3f 100644 --- a/src/fnet/Makefile.in +++ b/src/fnet/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fnet | 2 | all: fnet |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fnet: $(OBJS) ../lib/common.o ../lib/libnetlink.o | 9 | fnet: $(OBJS) ../lib/common.o ../lib/libnetlink.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/libnetlink.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/libnetlink.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fnet *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fnet *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fnetfilter/Makefile.in b/src/fnetfilter/Makefile.in index 6fe650a17..825262482 100644 --- a/src/fnetfilter/Makefile.in +++ b/src/fnetfilter/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fnetfilter | 2 | all: fnetfilter |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fnetfilter: $(OBJS) ../lib/common.o | 9 | fnetfilter: $(OBJS) ../lib/common.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fnetfilter *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fnetfilter *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fsec-optimize/Makefile.in b/src/fsec-optimize/Makefile.in index cc5ac7e35..a2187e89c 100644 --- a/src/fsec-optimize/Makefile.in +++ b/src/fsec-optimize/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fsec-optimize | 2 | all: fsec-optimize |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fsec-optimize: $(OBJS) ../lib/common.o ../lib/libnetlink.o | 9 | fsec-optimize: $(OBJS) ../lib/common.o ../lib/libnetlink.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fsec-optimize *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fsec-optimize *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fsec-print/Makefile.in b/src/fsec-print/Makefile.in index bf39a8c77..824fb5daf 100644 --- a/src/fsec-print/Makefile.in +++ b/src/fsec-print/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fsec-print | 2 | all: fsec-print |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fsec-print: $(OBJS) ../lib/common.o ../lib/libnetlink.o ../lib/errno.o ../lib/syscall.o | 9 | fsec-print: $(OBJS) ../lib/common.o ../lib/libnetlink.o ../lib/errno.o ../lib/syscall.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fsec-print *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fsec-print *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/fseccomp/Makefile.in b/src/fseccomp/Makefile.in index b776a73ce..41abfce17 100644 --- a/src/fseccomp/Makefile.in +++ b/src/fseccomp/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: fseccomp | 2 | all: fseccomp |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | fseccomp: $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o | 9 | fseccomp: $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/errno.o ../lib/syscall.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o fseccomp *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o fseccomp *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/ftee/Makefile.in b/src/ftee/Makefile.in index 32cdc63d3..05caf81be 100644 --- a/src/ftee/Makefile.in +++ b/src/ftee/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: ftee | 2 | all: ftee |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | ftee: $(OBJS) | 9 | ftee: $(OBJS) |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o ftee *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o ftee *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/jailtest/Makefile.in b/src/jailtest/Makefile.in index 9c9c0c508..6306d24ec 100644 --- a/src/jailtest/Makefile.in +++ b/src/jailtest/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: jailtest | 2 | all: jailtest |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | jailtest: $(OBJS) | 9 | jailtest: $(OBJS) |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) ../lib/common.o ../lib/pid.o $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o jailtest *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o jailtest *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/lib/Makefile.in b/src/lib/Makefile.in index 681252832..49c8057b3 100644 --- a/src/lib/Makefile.in +++ b/src/lib/Makefile.in | |||
@@ -1,11 +1,14 @@ | |||
1 | include ../common.mk | 1 | include ../common.mk |
2 | 2 | ||
3 | .PHONY: all | ||
3 | all: $(OBJS) | 4 | all: $(OBJS) |
4 | 5 | ||
5 | %.o : %.c $(H_FILE_LIST) | 6 | %.o : %.c $(H_FILE_LIST) |
6 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ | 7 | $(CC) $(CFLAGS) $(EXTRA_CFLAGS) $(INCLUDE) -c $< -o $@ |
7 | 8 | ||
9 | .PHONY: clean | ||
8 | clean:; rm -fr $(OBJS) *.gcov *.gcda *.gcno *.plist | 10 | clean:; rm -fr $(OBJS) *.gcov *.gcda *.gcno *.plist |
9 | 11 | ||
12 | .PHONY: distclean | ||
10 | distclean: clean | 13 | distclean: clean |
11 | rm -fr Makefile | 14 | rm -fr Makefile |
diff --git a/src/libpostexecseccomp/Makefile.in b/src/libpostexecseccomp/Makefile.in index edd4534b8..e3e5716ca 100644 --- a/src/libpostexecseccomp/Makefile.in +++ b/src/libpostexecseccomp/Makefile.in | |||
@@ -11,6 +11,7 @@ BINOBJS = $(foreach file, $(OBJS), $file) | |||
11 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security | 11 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security |
12 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | 12 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now |
13 | 13 | ||
14 | .PHONY: all | ||
14 | all: libpostexecseccomp.so | 15 | all: libpostexecseccomp.so |
15 | 16 | ||
16 | %.o : %.c $(H_FILE_LIST) ../include/seccomp.h ../include/rundefs.h | 17 | %.o : %.c $(H_FILE_LIST) ../include/seccomp.h ../include/rundefs.h |
@@ -19,7 +20,9 @@ all: libpostexecseccomp.so | |||
19 | libpostexecseccomp.so: $(OBJS) | 20 | libpostexecseccomp.so: $(OBJS) |
20 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | 21 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl |
21 | 22 | ||
23 | .PHONY: clean | ||
22 | clean:; rm -fr $(OBJS) libpostexecseccomp.so *.plist | 24 | clean:; rm -fr $(OBJS) libpostexecseccomp.so *.plist |
23 | 25 | ||
26 | .PHONY: distclean | ||
24 | distclean: clean | 27 | distclean: clean |
25 | rm -fr Makefile | 28 | rm -fr Makefile |
diff --git a/src/libtrace/Makefile.in b/src/libtrace/Makefile.in index 5c7d0f885..095037569 100644 --- a/src/libtrace/Makefile.in +++ b/src/libtrace/Makefile.in | |||
@@ -11,6 +11,7 @@ BINOBJS = $(foreach file, $(OBJS), $file) | |||
11 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security | 11 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security |
12 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | 12 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now |
13 | 13 | ||
14 | .PHONY: all | ||
14 | all: libtrace.so | 15 | all: libtrace.so |
15 | 16 | ||
16 | %.o : %.c $(H_FILE_LIST) | 17 | %.o : %.c $(H_FILE_LIST) |
@@ -19,8 +20,9 @@ all: libtrace.so | |||
19 | libtrace.so: $(OBJS) | 20 | libtrace.so: $(OBJS) |
20 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | 21 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl |
21 | 22 | ||
22 | 23 | .PHONY: clean | |
23 | clean:; rm -fr $(OBJS) libtrace.so *.plist | 24 | clean:; rm -fr $(OBJS) libtrace.so *.plist |
24 | 25 | ||
26 | .PHONY: distclean | ||
25 | distclean: clean | 27 | distclean: clean |
26 | rm -fr Makefile | 28 | rm -fr Makefile |
diff --git a/src/libtracelog/Makefile.in b/src/libtracelog/Makefile.in index b1ac9e57c..5bac19c04 100644 --- a/src/libtracelog/Makefile.in +++ b/src/libtracelog/Makefile.in | |||
@@ -11,6 +11,7 @@ BINOBJS = $(foreach file, $(OBJS), $file) | |||
11 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security | 11 | CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIC -Wformat -Wformat-security |
12 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now | 12 | LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now |
13 | 13 | ||
14 | .PHONY: all | ||
14 | all: libtracelog.so | 15 | all: libtracelog.so |
15 | 16 | ||
16 | %.o : %.c $(H_FILE_LIST) ../include/rundefs.h | 17 | %.o : %.c $(H_FILE_LIST) ../include/rundefs.h |
@@ -19,8 +20,9 @@ all: libtracelog.so | |||
19 | libtracelog.so: $(OBJS) | 20 | libtracelog.so: $(OBJS) |
20 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl | 21 | $(CC) $(LDFLAGS) -shared -fPIC -z relro -o $@ $(OBJS) -ldl |
21 | 22 | ||
22 | 23 | .PHONY: clean | |
23 | clean:; rm -fr $(OBJS) libtracelog.so *.plist | 24 | clean:; rm -fr $(OBJS) libtracelog.so *.plist |
24 | 25 | ||
26 | .PHONY: distclean | ||
25 | distclean: clean | 27 | distclean: clean |
26 | rm -fr Makefile | 28 | rm -fr Makefile |
diff --git a/src/man/Makefile.in b/src/man/Makefile.in index 1a1f8ba08..3711d5cec 100644 --- a/src/man/Makefile.in +++ b/src/man/Makefile.in | |||
@@ -1,10 +1,14 @@ | |||
1 | .PHONY: all | ||
1 | all: firecfg.man firejail.man firejail-login.man firejail-users.man firejail-profile.man firemon.man jailtest.man | 2 | all: firecfg.man firejail.man firejail-login.man firejail-users.man firejail-profile.man firemon.man jailtest.man |
3 | |||
2 | include ../common.mk | 4 | include ../common.mk |
3 | 5 | ||
4 | %.man: %.txt | 6 | %.man: %.txt |
5 | gawk -f ./preproc.awk -- $(MANFLAGS) < $< > $@ | 7 | gawk -f ./preproc.awk -- $(MANFLAGS) < $< > $@ |
6 | 8 | ||
9 | .PHONY: clean | ||
7 | clean:; rm -fr *.man | 10 | clean:; rm -fr *.man |
8 | 11 | ||
12 | .PHONY: distclean | ||
9 | distclean: clean | 13 | distclean: clean |
10 | rm -fr Makefile | 14 | rm -fr Makefile |
diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index b25fc9181..b0b390507 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt | |||
@@ -103,7 +103,7 @@ Example: "?HAS_APPIMAGE: whitelist ${HOME}/special/appimage/dir" | |||
103 | 103 | ||
104 | This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line. | 104 | This example will load the whitelist profile line only if the \-\-appimage option has been specified on the command line. |
105 | 105 | ||
106 | Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS, HAS_NOSOUND and HAS_X11. The conditionals BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM | 106 | Currently the only conditionals supported this way are HAS_APPIMAGE, HAS_NET, HAS_NODBUS, HAS_NOSOUND, HAS_PRIVATE and HAS_X11. The conditionals BROWSER_DISABLE_U2F and BROWSER_ALLOW_DRM |
107 | can be enabled or disabled globally in Firejail's configuration file. | 107 | can be enabled or disabled globally in Firejail's configuration file. |
108 | 108 | ||
109 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. | 109 | The profile line may be any profile line that you would normally use in a profile \fBexcept\fR for "quiet" and "include" lines. |
diff --git a/src/man/jailtest.txt b/src/man/jailtest.txt index 1b64097ea..b52fc5eed 100644 --- a/src/man/jailtest.txt +++ b/src/man/jailtest.txt | |||
@@ -14,7 +14,7 @@ These directories are build by firejail at startup using --private* and --whitel | |||
14 | .TP | 14 | .TP |
15 | \fB2. Noexec test | 15 | \fB2. Noexec test |
16 | jailtest inserts executable programs in /home/username, /tmp, and /var/tmp directories | 16 | jailtest inserts executable programs in /home/username, /tmp, and /var/tmp directories |
17 | and tries to run them form inside the sandbox, thus testing if the directory is executable or not. | 17 | and tries to run them from inside the sandbox, thus testing if the directory is executable or not. |
18 | .TP | 18 | .TP |
19 | \fB3. Read access test | 19 | \fB3. Read access test |
20 | jailtest creates test files in the directories specified by the user and tries to read | 20 | jailtest creates test files in the directories specified by the user and tries to read |
@@ -29,10 +29,10 @@ The program is started as root using sudo. | |||
29 | .SH OPTIONS | 29 | .SH OPTIONS |
30 | .TP | 30 | .TP |
31 | \fB\-\-debug | 31 | \fB\-\-debug |
32 | Print debug messages | 32 | Print debug messages. |
33 | .TP | 33 | .TP |
34 | \fB\-?\fR, \fB\-\-help\fR | 34 | \fB\-?\fR, \fB\-\-help\fR |
35 | Print options end exit. | 35 | Print options and exit. |
36 | .TP | 36 | .TP |
37 | \fB\-\-version | 37 | \fB\-\-version |
38 | Print program version and exit. | 38 | Print program version and exit. |
diff --git a/src/profstats/Makefile.in b/src/profstats/Makefile.in index 2beaa3ed6..e025f5939 100644 --- a/src/profstats/Makefile.in +++ b/src/profstats/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: profstats | 2 | all: profstats |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -8,7 +9,9 @@ include ../common.mk | |||
8 | profstats: $(OBJS) | 9 | profstats: $(OBJS) |
9 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) | 10 | $(CC) $(LDFLAGS) -o $@ $(OBJS) $(LIBS) $(EXTRA_LDFLAGS) |
10 | 11 | ||
12 | .PHONY: clean | ||
11 | clean:; rm -fr *.o profstats *.gcov *.gcda *.gcno *.plist | 13 | clean:; rm -fr *.o profstats *.gcov *.gcda *.gcno *.plist |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |
diff --git a/src/zsh_completion/Makefile.in b/src/zsh_completion/Makefile.in index 3f756aa5f..a83cccf6c 100644 --- a/src/zsh_completion/Makefile.in +++ b/src/zsh_completion/Makefile.in | |||
@@ -1,3 +1,4 @@ | |||
1 | .PHONY: all | ||
1 | all: _firejail | 2 | all: _firejail |
2 | 3 | ||
3 | include ../common.mk | 4 | include ../common.mk |
@@ -7,8 +8,10 @@ _firejail: _firejail.in | |||
7 | sed "s|_SYSCONFDIR_|$(sysconfdir)|" < $@.tmp > $@ | 8 | sed "s|_SYSCONFDIR_|$(sysconfdir)|" < $@.tmp > $@ |
8 | rm $@.tmp | 9 | rm $@.tmp |
9 | 10 | ||
11 | .PHONY: clean | ||
10 | clean: | 12 | clean: |
11 | rm -fr _firejail | 13 | rm -fr _firejail |
12 | 14 | ||
15 | .PHONY: distclean | ||
13 | distclean: clean | 16 | distclean: clean |
14 | rm -fr Makefile | 17 | rm -fr Makefile |