diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/bash_completion/firejail.bash_completion.in | 10 | ||||
-rw-r--r-- | src/firejail/main.c | 20 | ||||
-rw-r--r-- | src/firejail/profile.c | 20 | ||||
-rw-r--r-- | src/firejail/usage.c | 10 | ||||
-rw-r--r-- | src/man/firejail-profile.5.in | 10 | ||||
-rw-r--r-- | src/man/firejail.1.in | 16 | ||||
-rw-r--r-- | src/zsh_completion/_firejail.in | 10 |
7 files changed, 48 insertions, 48 deletions
diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in index 6c985bc6e..4a1adbc26 100644 --- a/src/bash_completion/firejail.bash_completion.in +++ b/src/bash_completion/firejail.bash_completion.in | |||
@@ -45,23 +45,23 @@ _firejail() | |||
45 | --landlock.enforce) | 45 | --landlock.enforce) |
46 | return 0 | 46 | return 0 |
47 | ;; | 47 | ;; |
48 | --landlock.read) | 48 | --landlock.fs.read) |
49 | _filedir | 49 | _filedir |
50 | return 0 | 50 | return 0 |
51 | ;; | 51 | ;; |
52 | --landlock.write) | 52 | --landlock.fs.write) |
53 | _filedir | 53 | _filedir |
54 | return 0 | 54 | return 0 |
55 | ;; | 55 | ;; |
56 | --landlock.makeipc) | 56 | --landlock.fs.makeipc) |
57 | _filedir | 57 | _filedir |
58 | return 0 | 58 | return 0 |
59 | ;; | 59 | ;; |
60 | --landlock.makedev) | 60 | --landlock.fs.makedev) |
61 | _filedir | 61 | _filedir |
62 | return 0 | 62 | return 0 |
63 | ;; | 63 | ;; |
64 | --landlock.execute) | 64 | --landlock.fs.execute) |
65 | _filedir | 65 | _filedir |
66 | return 0 | 66 | return 0 |
67 | ;; | 67 | ;; |
diff --git a/src/firejail/main.c b/src/firejail/main.c index 0d56eeb55..0ce18ab01 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -1505,16 +1505,16 @@ int main(int argc, char **argv, char **envp) { | |||
1505 | #ifdef HAVE_LANDLOCK | 1505 | #ifdef HAVE_LANDLOCK |
1506 | else if (strncmp(argv[i], "--landlock.enforce", 18) == 0) | 1506 | else if (strncmp(argv[i], "--landlock.enforce", 18) == 0) |
1507 | arg_landlock_enforce = 1; | 1507 | arg_landlock_enforce = 1; |
1508 | else if (strncmp(argv[i], "--landlock.read=", 16) == 0) | 1508 | else if (strncmp(argv[i], "--landlock.fs.read=", 19) == 0) |
1509 | ll_add_profile(LL_FS_READ, argv[i] + 16); | 1509 | ll_add_profile(LL_FS_READ, argv[i] + 19); |
1510 | else if (strncmp(argv[i], "--landlock.write=", 17) == 0) | 1510 | else if (strncmp(argv[i], "--landlock.fs.write=", 20) == 0) |
1511 | ll_add_profile(LL_FS_WRITE, argv[i] + 17); | 1511 | ll_add_profile(LL_FS_WRITE, argv[i] + 20); |
1512 | else if (strncmp(argv[i], "--landlock.makeipc=", 19) == 0) | 1512 | else if (strncmp(argv[i], "--landlock.fs.makeipc=", 22) == 0) |
1513 | ll_add_profile(LL_FS_MAKEIPC, argv[i] + 19); | 1513 | ll_add_profile(LL_FS_MAKEIPC, argv[i] + 22); |
1514 | else if (strncmp(argv[i], "--landlock.makedev=", 19) == 0) | 1514 | else if (strncmp(argv[i], "--landlock.fs.makedev=", 22) == 0) |
1515 | ll_add_profile(LL_FS_MAKEDEV, argv[i] + 19); | 1515 | ll_add_profile(LL_FS_MAKEDEV, argv[i] + 22); |
1516 | else if (strncmp(argv[i], "--landlock.execute=", 19) == 0) | 1516 | else if (strncmp(argv[i], "--landlock.fs.execute=", 22) == 0) |
1517 | ll_add_profile(LL_FS_EXEC, argv[i] + 19); | 1517 | ll_add_profile(LL_FS_EXEC, argv[i] + 22); |
1518 | #endif | 1518 | #endif |
1519 | else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) { | 1519 | else if (strcmp(argv[i], "--memory-deny-write-execute") == 0) { |
1520 | if (checkcfg(CFG_SECCOMP)) | 1520 | if (checkcfg(CFG_SECCOMP)) |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 945ed518e..4e0b17a8c 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -1078,24 +1078,24 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
1078 | arg_landlock_enforce = 1; | 1078 | arg_landlock_enforce = 1; |
1079 | return 0; | 1079 | return 0; |
1080 | } | 1080 | } |
1081 | if (strncmp(ptr, "landlock.read ", 14) == 0) { | 1081 | if (strncmp(ptr, "landlock.fs.read ", 17) == 0) { |
1082 | ll_add_profile(LL_FS_READ, ptr + 14); | 1082 | ll_add_profile(LL_FS_READ, ptr + 17); |
1083 | return 0; | 1083 | return 0; |
1084 | } | 1084 | } |
1085 | if (strncmp(ptr, "landlock.write ", 15) == 0) { | 1085 | if (strncmp(ptr, "landlock.fs.write ", 18) == 0) { |
1086 | ll_add_profile(LL_FS_WRITE, ptr + 15); | 1086 | ll_add_profile(LL_FS_WRITE, ptr + 18); |
1087 | return 0; | 1087 | return 0; |
1088 | } | 1088 | } |
1089 | if (strncmp(ptr, "landlock.makeipc ", 17) == 0) { | 1089 | if (strncmp(ptr, "landlock.fs.makeipc ", 20) == 0) { |
1090 | ll_add_profile(LL_FS_MAKEIPC, ptr + 17); | 1090 | ll_add_profile(LL_FS_MAKEIPC, ptr + 20); |
1091 | return 0; | 1091 | return 0; |
1092 | } | 1092 | } |
1093 | if (strncmp(ptr, "landlock.makedev ", 17) == 0) { | 1093 | if (strncmp(ptr, "landlock.fs.makedev ", 20) == 0) { |
1094 | ll_add_profile(LL_FS_MAKEDEV, ptr + 17); | 1094 | ll_add_profile(LL_FS_MAKEDEV, ptr + 20); |
1095 | return 0; | 1095 | return 0; |
1096 | } | 1096 | } |
1097 | if (strncmp(ptr, "landlock.execute ", 17) == 0) { | 1097 | if (strncmp(ptr, "landlock.fs.execute ", 20) == 0) { |
1098 | ll_add_profile(LL_FS_EXEC, ptr + 17); | 1098 | ll_add_profile(LL_FS_EXEC, ptr + 20); |
1099 | return 0; | 1099 | return 0; |
1100 | } | 1100 | } |
1101 | #endif | 1101 | #endif |
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index c62e8c369..248b35853 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -135,11 +135,11 @@ static const char *const usage_str = | |||
135 | " --keep-var-tmp - /var/tmp directory is untouched.\n" | 135 | " --keep-var-tmp - /var/tmp directory is untouched.\n" |
136 | #ifdef HAVE_LANDLOCK | 136 | #ifdef HAVE_LANDLOCK |
137 | " --landlock.enforce - enforce the Landlock ruleset.\n" | 137 | " --landlock.enforce - enforce the Landlock ruleset.\n" |
138 | " --landlock.read=path - add a read access rule for the path to the Landlock ruleset.\n" | 138 | " --landlock.fs.read=path - add a read access rule for the path to the Landlock ruleset.\n" |
139 | " --landlock.write=path - add a write access rule for the path to the Landlock ruleset.\n" | 139 | " --landlock.fs.write=path - add a write access rule for the path to the Landlock ruleset.\n" |
140 | " --landlock.makeipc=path - add an access rule for the path to the Landlock ruleset for creating named pipes and sockets.\n" | 140 | " --landlock.fs.makeipc=path - add an access rule for the path to the Landlock ruleset for creating named pipes and sockets.\n" |
141 | " --landlock.makedev=path - add an access rule for the path to the Landlock ruleset for creating block/char devices.\n" | 141 | " --landlock.fs.makedev=path - add an access rule for the path to the Landlock ruleset for creating block/char devices.\n" |
142 | " --landlock.execute=path - add an execute access rule for the path to the Landlock ruleset.\n" | 142 | " --landlock.fs.execute=path - add an execute access rule for the path to the Landlock ruleset.\n" |
143 | #endif | 143 | #endif |
144 | " --list - list all sandboxes.\n" | 144 | " --list - list all sandboxes.\n" |
145 | #ifdef HAVE_FILE_TRANSFER | 145 | #ifdef HAVE_FILE_TRANSFER |
diff --git a/src/man/firejail-profile.5.in b/src/man/firejail-profile.5.in index b6672c16b..e274a91d1 100644 --- a/src/man/firejail-profile.5.in +++ b/src/man/firejail-profile.5.in | |||
@@ -514,25 +514,25 @@ Enforce the Landlock ruleset. | |||
514 | .PP | 514 | .PP |
515 | Without it, the other Landlock commands have no effect. | 515 | Without it, the other Landlock commands have no effect. |
516 | .TP | 516 | .TP |
517 | \fBlandlock.read path | 517 | \fBlandlock.fs.read path |
518 | Create a Landlock ruleset (if it doesn't already exist) and add a read access | 518 | Create a Landlock ruleset (if it doesn't already exist) and add a read access |
519 | rule for path. | 519 | rule for path. |
520 | .TP | 520 | .TP |
521 | \fBlandlock.write path | 521 | \fBlandlock.fs.write path |
522 | Create a Landlock ruleset (if it doesn't already exist) and add a write access | 522 | Create a Landlock ruleset (if it doesn't already exist) and add a write access |
523 | rule for path. | 523 | rule for path. |
524 | .TP | 524 | .TP |
525 | \fBlandlock.makeipc path | 525 | \fBlandlock.fs.makeipc path |
526 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that | 526 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that |
527 | allows the creation of named pipes (FIFOs) and Unix domain sockets beneath | 527 | allows the creation of named pipes (FIFOs) and Unix domain sockets beneath |
528 | the given path. | 528 | the given path. |
529 | .TP | 529 | .TP |
530 | \fBlandlock.makedev path | 530 | \fBlandlock.fs.makedev path |
531 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that | 531 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that |
532 | allows the creation of block devices and character devices beneath the given | 532 | allows the creation of block devices and character devices beneath the given |
533 | path. | 533 | path. |
534 | .TP | 534 | .TP |
535 | \fBlandlock.execute path | 535 | \fBlandlock.fs.execute path |
536 | Create a Landlock ruleset (if it doesn't already exist) and add an execution | 536 | Create a Landlock ruleset (if it doesn't already exist) and add an execution |
537 | permission rule for path. | 537 | permission rule for path. |
538 | #endif | 538 | #endif |
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in index 6548b8e5d..618b4955e 100644 --- a/src/man/firejail.1.in +++ b/src/man/firejail.1.in | |||
@@ -1241,25 +1241,25 @@ Enforce the Landlock ruleset. | |||
1241 | Without it, the other Landlock commands have no effect. | 1241 | Without it, the other Landlock commands have no effect. |
1242 | See the \fBLANDLOCK\fR section for more information. | 1242 | See the \fBLANDLOCK\fR section for more information. |
1243 | .TP | 1243 | .TP |
1244 | \fB\-\-landlock.read=path | 1244 | \fB\-\-landlock.fs.read=path |
1245 | Create a Landlock ruleset (if it doesn't already exist) and add a read access | 1245 | Create a Landlock ruleset (if it doesn't already exist) and add a read access |
1246 | rule for path. | 1246 | rule for path. |
1247 | .TP | 1247 | .TP |
1248 | \fB\-\-landlock.write=path | 1248 | \fB\-\-landlock.fs.write=path |
1249 | Create a Landlock ruleset (if it doesn't already exist) and add a write access | 1249 | Create a Landlock ruleset (if it doesn't already exist) and add a write access |
1250 | rule for path. | 1250 | rule for path. |
1251 | .TP | 1251 | .TP |
1252 | \fB\-\-landlock.makeipc=path | 1252 | \fB\-\-landlock.fs.makeipc=path |
1253 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that | 1253 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that |
1254 | allows the creation of named pipes (FIFOs) and Unix domain sockets beneath | 1254 | allows the creation of named pipes (FIFOs) and Unix domain sockets beneath |
1255 | the given path. | 1255 | the given path. |
1256 | .TP | 1256 | .TP |
1257 | \fB\-\-landlock.makedev=path | 1257 | \fB\-\-landlock.fs.makedev=path |
1258 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that | 1258 | Create a Landlock ruleset (if it doesn't already exist) and add a rule that |
1259 | allows the creation of block devices and character devices beneath the given | 1259 | allows the creation of block devices and character devices beneath the given |
1260 | path. | 1260 | path. |
1261 | .TP | 1261 | .TP |
1262 | \fB\-\-landlock.execute=path | 1262 | \fB\-\-landlock.fs.execute=path |
1263 | Create a Landlock ruleset (if it doesn't already exist) and add an execution | 1263 | Create a Landlock ruleset (if it doesn't already exist) and add an execution |
1264 | permission rule for path. | 1264 | permission rule for path. |
1265 | .br | 1265 | .br |
@@ -1267,8 +1267,8 @@ permission rule for path. | |||
1267 | .br | 1267 | .br |
1268 | Example: | 1268 | Example: |
1269 | .br | 1269 | .br |
1270 | $ firejail \-\-landlock.read=/ \-\-landlock.write=/home | 1270 | $ firejail \-\-landlock.fs.read=/ \-\-landlock.fs.write=/home |
1271 | \-\-landlock.execute=/usr \-\-landlock.enforce | 1271 | \-\-landlock.fs.execute=/usr \-\-landlock.enforce |
1272 | #endif | 1272 | #endif |
1273 | .TP | 1273 | .TP |
1274 | \fB\-\-list | 1274 | \fB\-\-list |
@@ -3404,7 +3404,7 @@ features, pass \fB\-\-landlock.enforce\fR flag to Firejail command line. | |||
3404 | Without it, the other Landlock commands have no effect. | 3404 | Without it, the other Landlock commands have no effect. |
3405 | Example: | 3405 | Example: |
3406 | .PP | 3406 | .PP |
3407 | $ firejail \-\-landlock.enforce \-\-landlock.read=/media mc | 3407 | $ firejail \-\-landlock.enforce \-\-landlock.fs.read=/media mc |
3408 | .PP | 3408 | .PP |
3409 | To disable Landlock self-restriction, use \fB\-\-ignore=landlock.enforce\fR. | 3409 | To disable Landlock self-restriction, use \fB\-\-ignore=landlock.enforce\fR. |
3410 | #endif | 3410 | #endif |
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in index 45f24d5f3..15e9a5111 100644 --- a/src/zsh_completion/_firejail.in +++ b/src/zsh_completion/_firejail.in | |||
@@ -108,11 +108,11 @@ _firejail_args=( | |||
108 | '--keep-var-tmp[/var/tmp directory is untouched]' | 108 | '--keep-var-tmp[/var/tmp directory is untouched]' |
109 | #ifdef HAVE_LANDLOCK | 109 | #ifdef HAVE_LANDLOCK |
110 | '--landlock.enforce[enforce the Landlock ruleset]' | 110 | '--landlock.enforce[enforce the Landlock ruleset]' |
111 | '--landlock.read=-[add a read access rule for the path to the Landlock ruleset]: :_files' | 111 | '--landlock.fs.read=-[add a read access rule for the path to the Landlock ruleset]: :_files' |
112 | '--landlock.write=-[add a write access rule for the path to the Landlock ruleset]: :_files' | 112 | '--landlock.fs.write=-[add a write access rule for the path to the Landlock ruleset]: :_files' |
113 | '--landlock.makeipc=-[add an access rule for the path to the Landlock ruleset for creating named pipes and sockets]: :_files' | 113 | '--landlock.fs.makeipc=-[add an access rule for the path to the Landlock ruleset for creating named pipes and sockets]: :_files' |
114 | '--landlock.makedev=-[add an access rule for the path to the Landlock ruleset for creating block/char devices]: :_files' | 114 | '--landlock.fs.makedev=-[add an access rule for the path to the Landlock ruleset for creating block/char devices]: :_files' |
115 | '--landlock.execute=-[add an execute access rule for the path to the Landlock ruleset]: :_files' | 115 | '--landlock.fs.execute=-[add an execute access rule for the path to the Landlock ruleset]: :_files' |
116 | #endif | 116 | #endif |
117 | '--machine-id[spoof /etc/machine-id with a random id]' | 117 | '--machine-id[spoof /etc/machine-id with a random id]' |
118 | '--memory-deny-write-execute[seccomp filter to block attempts to create memory mappings that are both writable and executable]' | 118 | '--memory-deny-write-execute[seccomp filter to block attempts to create memory mappings that are both writable and executable]' |