aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/firecfg/firecfg.config6
-rw-r--r--src/firejail/appimage.c13
-rw-r--r--src/firejail/fs.c4
-rw-r--r--src/firejail/ls.c2
-rw-r--r--src/firejail/main.c11
-rw-r--r--src/firejail/paths.c18
-rw-r--r--src/firejail/profile.c4
-rw-r--r--src/firejail/sandbox.c3
-rw-r--r--src/firejail/util.c2
-rw-r--r--src/fnettrace/main.c10
-rw-r--r--src/fnettrace/static-ip-map.txt454
-rw-r--r--src/lib/syscall.c10
-rw-r--r--src/man/firejail.1.in32
13 files changed, 530 insertions, 39 deletions
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config
index 7db4480b6..558fe51ed 100644
--- a/src/firecfg/firecfg.config
+++ b/src/firecfg/firecfg.config
@@ -101,6 +101,7 @@ bitwarden
101bleachbit 101bleachbit
102blender 102blender
103blender-2.8 103blender-2.8
104blender-3.6
104bless 105bless
105blobby 106blobby
106blobwars 107blobwars
@@ -274,6 +275,7 @@ flacsplt
274flameshot 275flameshot
275flashpeak-slimjet 276flashpeak-slimjet
276flowblade 277flowblade
278fluffychat
277font-manager 279font-manager
278fontforge 280fontforge
279fossamail 281fossamail
@@ -480,6 +482,7 @@ kwrite
480lbry-viewer 482lbry-viewer
481leafpad 483leafpad
482#less # breaks man 484#less # breaks man
485lettura
483librecad 486librecad
484libreoffice 487libreoffice
485librewolf 488librewolf
@@ -822,13 +825,16 @@ telegram
822telegram-desktop 825telegram-desktop
823telnet 826telnet
824terasology 827terasology
828termshark
825tesseract 829tesseract
826textmaker18 830textmaker18
827textmaker18free 831textmaker18free
828thunderbird 832thunderbird
829thunderbird-beta 833thunderbird-beta
830thunderbird-wayland 834thunderbird-wayland
835tidal-hifi
831tilp 836tilp
837tiny-rdm
832tor-browser 838tor-browser
833tor-browser-ar 839tor-browser-ar
834tor-browser-ca 840tor-browser-ca
diff --git a/src/firejail/appimage.c b/src/firejail/appimage.c
index a4f727c0a..bb20a0da6 100644
--- a/src/firejail/appimage.c
+++ b/src/firejail/appimage.c
@@ -43,6 +43,16 @@ int appimage_find_profile(const char *archive) {
43 assert(archive); 43 assert(archive);
44 assert(strlen(archive)); 44 assert(strlen(archive));
45 45
46 // extract the name of the appimage from a full path
47 // example: archive = /opt/kdenlive-20.12.2-x86_64.appimage
48 const char *arc = strrchr(archive, '/');
49 if (arc)
50 arc++;
51 else
52 arc = archive;
53 if (arg_debug)
54 printf("Looking for a %s profile\n", arc);
55
46 // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config 56 // try to match the name of the archive with the list of programs in /etc/firejail/firecfg.config
47 FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r"); 57 FILE *fp = fopen(SYSCONFDIR "/firecfg.config", "r");
48 if (!fp) { 58 if (!fp) {
@@ -56,7 +66,8 @@ int appimage_find_profile(const char *archive) {
56 char *ptr = strchr(buf, '\n'); 66 char *ptr = strchr(buf, '\n');
57 if (ptr) 67 if (ptr)
58 *ptr = '\0'; 68 *ptr = '\0';
59 if (strcasestr(archive, buf)) { 69 char *found = strcasestr(arc, buf);
70 if (found == arc) {
60 fclose(fp); 71 fclose(fp);
61 return profile_find_firejail(buf, 1); 72 return profile_find_firejail(buf, 1);
62 } 73 }
diff --git a/src/firejail/fs.c b/src/firejail/fs.c
index 182f26e53..28fecfb98 100644
--- a/src/firejail/fs.c
+++ b/src/firejail/fs.c
@@ -281,6 +281,8 @@ void fs_blacklist(void) {
281 if (!entry) 281 if (!entry)
282 return; 282 return;
283 283
284 timetrace_start();
285
284 size_t noblacklist_c = 0; 286 size_t noblacklist_c = 0;
285 size_t noblacklist_m = 32; 287 size_t noblacklist_m = 32;
286 char **noblacklist = calloc(noblacklist_m, sizeof(*noblacklist)); 288 char **noblacklist = calloc(noblacklist_m, sizeof(*noblacklist));
@@ -463,6 +465,8 @@ void fs_blacklist(void) {
463 for (i = 0; i < noblacklist_c; i++) 465 for (i = 0; i < noblacklist_c; i++)
464 free(noblacklist[i]); 466 free(noblacklist[i]);
465 free(noblacklist); 467 free(noblacklist);
468
469 fmessage("Base filesystem installed in %0.2f ms\n", timetrace_end());
466} 470}
467 471
468//*********************************************** 472//***********************************************
diff --git a/src/firejail/ls.c b/src/firejail/ls.c
index f2ab1c188..6dc4904fc 100644
--- a/src/firejail/ls.c
+++ b/src/firejail/ls.c
@@ -154,7 +154,7 @@ static void print_file_or_dir(const char *path, const char *fname) {
154 154
155 // file size 155 // file size
156 char *sz; 156 char *sz;
157 if (asprintf(&sz, "%d", (int) s.st_size) == -1) 157 if (asprintf(&sz, "%jd", (intmax_t) s.st_size) == -1)
158 errExit("asprintf"); 158 errExit("asprintf");
159 159
160 // file name 160 // file name
diff --git a/src/firejail/main.c b/src/firejail/main.c
index b0d5dac17..0c9c80137 100644
--- a/src/firejail/main.c
+++ b/src/firejail/main.c
@@ -420,7 +420,6 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
420 exit_err_feature("x11"); 420 exit_err_feature("x11");
421 } 421 }
422#endif 422#endif
423#ifdef HAVE_NETWORK
424 else if (strcmp(argv[i], "--nettrace") == 0) { 423 else if (strcmp(argv[i], "--nettrace") == 0) {
425 if (checkcfg(CFG_NETWORK)) { 424 if (checkcfg(CFG_NETWORK)) {
426 if (getuid() != 0) { 425 if (getuid() != 0) {
@@ -524,8 +523,7 @@ static void run_cmd_and_exit(int i, int argc, char **argv) {
524 exit(0); 523 exit(0);
525 } 524 }
526 525
527 526#ifdef HAVE_NETWORK
528
529 else if (strncmp(argv[i], "--bandwidth=", 12) == 0) { 527 else if (strncmp(argv[i], "--bandwidth=", 12) == 0) {
530 if (checkcfg(CFG_NETWORK)) { 528 if (checkcfg(CFG_NETWORK)) {
531 logargs(argc, argv); 529 logargs(argc, argv);
@@ -3217,13 +3215,18 @@ int main(int argc, char **argv, char **envp) {
3217 3215
3218 gid_t g; 3216 gid_t g;
3219 if (!arg_nogroups || !check_can_drop_all_groups()) { 3217 if (!arg_nogroups || !check_can_drop_all_groups()) {
3220 // add audio group 3218 // add audio groups
3221 if (!arg_nosound) { 3219 if (!arg_nosound) {
3222 g = get_group_id("audio"); 3220 g = get_group_id("audio");
3223 if (g) { 3221 if (g) {
3224 sprintf(ptr, "%d %d 1\n", g, g); 3222 sprintf(ptr, "%d %d 1\n", g, g);
3225 ptr += strlen(ptr); 3223 ptr += strlen(ptr);
3226 } 3224 }
3225 g = get_group_id("pipewire");
3226 if (g) {
3227 sprintf(ptr, "%d %d 1\n", g, g);
3228 ptr += strlen(ptr);
3229 }
3227 } 3230 }
3228 3231
3229 // add video group 3232 // add video group
diff --git a/src/firejail/paths.c b/src/firejail/paths.c
index 6bc6230f0..fea842d93 100644
--- a/src/firejail/paths.c
+++ b/src/firejail/paths.c
@@ -47,6 +47,16 @@ static void init_paths(void) {
47 errExit("calloc"); 47 errExit("calloc");
48 memset(paths, 0, path_cnt * sizeof(char *)); // get rid of false positive error from GCC static analyzer 48 memset(paths, 0, path_cnt * sizeof(char *)); // get rid of false positive error from GCC static analyzer
49 49
50 // lots of distros set /bin as a symlink to /usr/bin;
51 // we remove /bin form the path to speed up path-based operations such as blacklist
52 int bin_symlink = 0;
53 p = realpath("/bin", NULL);
54 if (p) {
55 if (strcmp(p, "/usr/bin") == 0)
56 bin_symlink = 1;
57 }
58 free(p);
59
50 // fill in 'paths' with pointers to elements of 'path' 60 // fill in 'paths' with pointers to elements of 'path'
51 unsigned int i = 0, j; 61 unsigned int i = 0, j;
52 unsigned int len; 62 unsigned int len;
@@ -62,6 +72,14 @@ static void init_paths(void) {
62 if (len == 0) 72 if (len == 0)
63 goto skip; 73 goto skip;
64 74
75 //deal with /bin - /usr/bin symlink
76 if (bin_symlink > 0) {
77 if (strcmp(elt, "/bin") == 0 || strcmp(elt, "/usr/bin") == 0)
78 bin_symlink++;
79 if (bin_symlink == 3)
80 goto skip;
81 }
82
65 // filter out duplicate entries 83 // filter out duplicate entries
66 for (j = 0; j < i; j++) 84 for (j = 0; j < i; j++)
67 if (strcmp(elt, paths[j]) == 0) 85 if (strcmp(elt, paths[j]) == 0)
diff --git a/src/firejail/profile.c b/src/firejail/profile.c
index bdaaed433..8cc5c1166 100644
--- a/src/firejail/profile.c
+++ b/src/firejail/profile.c
@@ -484,7 +484,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
484#endif 484#endif
485 return 0; 485 return 0;
486 } 486 }
487 else if (strncmp("dbus-user ", ptr, 10) == 0) { 487 else if (strncmp(ptr, "dbus-user ", 10) == 0) {
488#ifdef HAVE_DBUSPROXY 488#ifdef HAVE_DBUSPROXY
489 ptr += 10; 489 ptr += 10;
490 if (strcmp("filter", ptr) == 0) { 490 if (strcmp("filter", ptr) == 0) {
@@ -551,7 +551,7 @@ int profile_check_line(char *ptr, int lineno, const char *fname) {
551#endif 551#endif
552 return 1; 552 return 1;
553 } 553 }
554 else if (strncmp("dbus-system ", ptr, 12) == 0) { 554 else if (strncmp(ptr, "dbus-system ", 12) == 0) {
555#ifdef HAVE_DBUSPROXY 555#ifdef HAVE_DBUSPROXY
556 ptr += 12; 556 ptr += 12;
557 if (strcmp("filter", ptr) == 0) { 557 if (strcmp("filter", ptr) == 0) {
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index 538f5be67..827be5d85 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -878,7 +878,8 @@ int sandbox(void* sandbox_arg) {
878 //**************************** 878 //****************************
879 // appimage 879 // appimage
880 //**************************** 880 //****************************
881 appimage_mount(); 881 if (arg_appimage)
882 appimage_mount();
882 883
883 //**************************** 884 //****************************
884 // private mode 885 // private mode
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 970832b38..bd32181b5 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -207,6 +207,8 @@ static void clean_supplementary_groups(gid_t gid) {
207 if (!arg_nosound) { 207 if (!arg_nosound) {
208 copy_group_ifcont("audio", groups, ngroups, 208 copy_group_ifcont("audio", groups, ngroups,
209 new_groups, &new_ngroups, MAX_GROUPS); 209 new_groups, &new_ngroups, MAX_GROUPS);
210 copy_group_ifcont("pipewire", groups, ngroups,
211 new_groups, &new_ngroups, MAX_GROUPS);
210 } 212 }
211 213
212 if (!arg_novideo) { 214 if (!arg_novideo) {
diff --git a/src/fnettrace/main.c b/src/fnettrace/main.c
index 5a0b97e89..4db8e7478 100644
--- a/src/fnettrace/main.c
+++ b/src/fnettrace/main.c
@@ -308,6 +308,8 @@ static inline const char *common_port(uint16_t port) {
308 return "Tor"; 308 return "Tor";
309 else if (port == 9030) 309 else if (port == 9030)
310 return "Tor"; 310 return "Tor";
311 else if (port == 9040)
312 return "Tor";
311 else if (port == 9050) 313 else if (port == 9050)
312 return "Tor"; 314 return "Tor";
313 else if (port == 9051) 315 else if (port == 9051)
@@ -506,16 +508,16 @@ static void print_stats(FILE *fp) {
506 508
507 fprintf(fp, "\n\nIP map"); 509 fprintf(fp, "\n\nIP map");
508 if (fp == stdout) 510 if (fp == stdout)
509 ansi_faint(" - server-address network (packets)\n"); 511 ansi_faint(" - network (packets)\n");
510 else 512 else
511 fprintf(fp, " - server-address network (packets)\n"); 513 fprintf(fp, " - network (packets)\n");
512 radix_print(fp, 1); 514 radix_print(fp, 1);
513 515
514 fprintf(fp, "\n\nEvents %d", ev_cnt); 516 fprintf(fp, "\n\nEvents %d", ev_cnt);
515 if (fp == stdout) 517 if (fp == stdout)
516 ansi_faint(" - time address:port data\n"); 518 ansi_faint(" - time address data\n");
517 else 519 else
518 fprintf(fp, " - time address:port data\n"); 520 fprintf(fp, " - time address data\n");
519 ev_print(fp); 521 ev_print(fp);
520 522
521} 523}
diff --git a/src/fnettrace/static-ip-map.txt b/src/fnettrace/static-ip-map.txt
index fa6c74b62..aeac58c6a 100644
--- a/src/fnettrace/static-ip-map.txt
+++ b/src/fnettrace/static-ip-map.txt
@@ -188,6 +188,7 @@
188104.244.40.0/21 Twitter 188104.244.40.0/21 Twitter
189108.160.160.0/20 Dropbox 189108.160.160.0/20 Dropbox
190108.175.32.0/20 Netflix 190108.175.32.0/20 Netflix
191129.144.0.0/12 Oracle
191129.134.0.0/16 Facebook 192129.134.0.0/16 Facebook
192140.82.112.0/20 GitHub 193140.82.112.0/20 GitHub
193143.55.64.0/20 GitHub 194143.55.64.0/20 GitHub
@@ -221,7 +222,6 @@
221185.125.188.0/22 Ubuntu One 222185.125.188.0/22 Ubuntu One
222185.199.108.0/22 GitHub 223185.199.108.0/22 GitHub
223185.205.69.0/24 Tutanota 224185.205.69.0/24 Tutanota
224185.238.113.0/24 Bitchute
225188.64.224.0/21 Twitter 225188.64.224.0/21 Twitter
226190.217.33.0/24 Steam 226190.217.33.0/24 Steam
227192.0.64.0/18 Wordpress 227192.0.64.0/18 Wordpress
@@ -253,7 +253,12 @@
25363.141.247.168/29 BitChute 25363.141.247.168/29 BitChute
25463.141.247.240/29 BitChute 25463.141.247.240/29 BitChute
25569.30.200.200/29 BitChute 25569.30.200.200/29 BitChute
25669.30.230.64/29 BitChute
25769.30.241.40/29 BitChute
25669.30.241.48/29 BitChute 25869.30.241.48/29 BitChute
25969.30.243.168/29 BitChute
26069.30.245.232/29 BitChute
26169.30.253.16/29 BitChute
25769.197.182.184/29 BitChute 26269.197.182.184/29 BitChute
25874.91.28.208/29 BitChute 26374.91.28.208/29 BitChute
25974.91.29.208/29 BitChute 26474.91.29.208/29 BitChute
@@ -263,27 +268,40 @@
263107.150.45.120/29 BitChute 268107.150.45.120/29 BitChute
264142.54.180.104/29 BitChute 269142.54.180.104/29 BitChute
265142.54.181.184/29 BitChute 270142.54.181.184/29 BitChute
271142.54.188.112/29 BitChute
266142.54.189.192/29 BitChute 272142.54.189.192/29 BitChute
267173.208.154.8/29 BitChute 273173.208.154.8/29 BitChute
268173.208.154.160/29 BitChute 274173.208.154.160/29 BitChute
275173.208.176.128/29 BitChute
269173.208.185.200/29 BitChute 276173.208.185.200/29 BitChute
277173.208.203.224/29 BitChute
270173.208.203.248/29 BitChute 278173.208.203.248/29 BitChute
271173.208.211.224/29 BitChute 279173.208.211.224/29 BitChute
272173.208.216.40/29 BitChute 280173.208.216.40/29 BitChute
273173.208.219.112/29 BitChute 281173.208.219.112/29 BitChute
274173.208.246.160/29 BitChute 282173.208.246.160/29 BitChute
283185.238.113.0/24 BitChute
284192.151.147.16/29 BitChute
275192.151.158.136/29 BitChute 285192.151.158.136/29 BitChute
276192.187.97.88/29 BitChute 286192.187.97.88/29 BitChute
277192.187.114.16/29 BitChute 287192.187.114.16/29 BitChute
278192.187.114.96/29 BitChute 288192.187.114.96/29 BitChute
289192.187.118.168/29 BitChute
290192.187.121.208/29 BitChute
279192.187.123.112/29 BitChute 291192.187.123.112/29 BitChute
280192.187.126.0/29 BitChute 292192.187.126.0/29 BitChute
281198.204.226.120/29 BitChute 293198.204.226.120/29 BitChute
282198.204.228.48/29 BitChute 294198.204.228.48/29 BitChute
295198.204.235.88/29 BitChute
296198.204.235.216/29 BitChute
283198.204.245.32/29 BitChute 297198.204.245.32/29 BitChute
284198.204.245.88/29 BitChute 298198.204.245.88/29 BitChute
285198.204.250.208/29 BitChute 299198.204.250.208/29 BitChute
300198.204.253.64/29 BitChute
301198.204.253.184/29 BitChute
286199.168.96.24/29 BitChute 302199.168.96.24/29 BitChute
303199.168.96.64/29 BitChute
304204.12.220.136/29 BitChute
287204.12.194.176/29 BitChute 305204.12.194.176/29 BitChute
288204.12.194.248/29 BitChute 306204.12.194.248/29 BitChute
289204.12.220.232/29 BitChute 307204.12.220.232/29 BitChute
@@ -292,6 +310,7 @@
292# WholeSale Internet 310# WholeSale Internet
29369.30.192.0/18 WholeSale Internet 31169.30.192.0/18 WholeSale Internet
29469.197.128.0/18 WholeSale Internet 31269.197.128.0/18 WholeSale Internet
313142.54.160.0/19 WholeSale Internet
295173.208.128.0/17 WholeSale Internet 314173.208.128.0/17 WholeSale Internet
296204.12.192.0/18 WholeSale Internet 315204.12.192.0/18 WholeSale Internet
297208.67.0.0/21 WholeSale Internet 316208.67.0.0/21 WholeSale Internet
@@ -322,6 +341,7 @@
32266.243.0.0/17 Level 3 34166.243.0.0/17 Level 3
32366.243.128.0/18 Level 3 34266.243.128.0/18 Level 3
32466.251.192.0/19 Level 3 34366.251.192.0/19 Level 3
34474.202.0.0/15 Level 3
325205.128.0.0/14 Level 3 345205.128.0.0/14 Level 3
326205.180.0.0/14 Level 3 346205.180.0.0/14 Level 3
327205.184.0.0/19 Level 3 347205.184.0.0/19 Level 3
@@ -350,6 +370,7 @@
35069.16.173.0/24 StackPath 37069.16.173.0/24 StackPath
35169.16.174.0/23 StackPath 37169.16.174.0/23 StackPath
35269.16.176.0/20 StackPath 37269.16.176.0/20 StackPath
37374.209.128.0/20 StackPath
353151.139.0.0/16 StackPath 374151.139.0.0/16 StackPath
354205.185.194.0/23 StackPath 375205.185.194.0/23 StackPath
355205.185.196.0/23 StackPath 376205.185.196.0/23 StackPath
@@ -379,6 +400,7 @@
37945.79.0.0/16 Linode 40045.79.0.0/16 Linode
38050.116.0.0/18 Linode 40150.116.0.0/18 Linode
38166.175.208.0/20 Linode 40266.175.208.0/20 Linode
40374.207.224.0/19 Linode
382103.29.68.0/22 Linode 404103.29.68.0/22 Linode
383104.200.16.0/21 Linode 405104.200.16.0/21 Linode
384104.200.24.0/22 Linode 406104.200.24.0/22 Linode
@@ -486,6 +508,7 @@
48623.72.0.0/13 Akamai 50823.72.0.0/13 Akamai
48723.192.0.0/11 Akamai 50923.192.0.0/11 Akamai
48872.246.0.0/15 Akamai 51072.246.0.0/15 Akamai
51174.121.124.0/22 Akamai
48992.122.160.0/20 Akamai 51292.122.160.0/20 Akamai
49096.6.0.0/15 Akamai 51396.6.0.0/15 Akamai
49196.16.0.0/15 Akamai 51496.16.0.0/15 Akamai
@@ -559,6 +582,7 @@
55920.48.0.0/12 Microsoft 58220.48.0.0/12 Microsoft
56020.128.0.0/16 Microsoft 58320.128.0.0/16 Microsoft
56120.192.0.0/10 Microsoft 58420.192.0.0/10 Microsoft
58523.96.0.0/13 Microsoft
56240.76.0.0/14 Microsoft 58640.76.0.0/14 Microsoft
56340.96.0.0/12 Microsoft 58740.96.0.0/12 Microsoft
56440.112.0.0/13 Microsoft 58840.112.0.0/13 Microsoft
@@ -567,11 +591,38 @@
56740.80.0.0/12 Microsoft 59140.80.0.0/12 Microsoft
56840.120.0.0/14 Microsoft 59240.120.0.0/14 Microsoft
56940.125.0.0/17 Microsoft 59340.125.0.0/17 Microsoft
59451.4.0.0/15 Microsoft
59551.8.0.0/16 Microsoft
59651.10.0.0/14 Microsoft
59751.51.0.0/16 Microsoft
59851.53.0.0/16 Microsoft
59951.103.0.0/16 Microsoft
60051.107.0.0/16 Microsoft
60151.116.0.0/16 Microsoft
60251.120.0.0/16 Microsoft
60351.124.0.0/16 Microsoft
60451.132.0.0/16 Microsoft
60551.136.0.0/16 Microsoft
60651.140.0.0/15 Microsoft
60752.96.0.0/12 Microsoft
60852.112.0.0/14 Microsoft
60952.120.0.0/14 Microsoft
61052.125.0.0/16 Microsoft
61152.126.0.0/15 Microsoft
61252.132.0.0/14 Microsoft
61352.136.0.0/13 Microsoft
57052.145.0.0/16 Microsoft 61452.145.0.0/16 Microsoft
61552.146.0.0/15 Microsoft
57152.148.0.0/14 Microsoft 61652.148.0.0/14 Microsoft
57252.152.0.0/13 Microsoft 61752.152.0.0/13 Microsoft
57352.146.0.0/15 Microsoft
57452.160.0.0/11 Microsoft 61852.160.0.0/11 Microsoft
61952.224.0.0/11 Microsoft
62074.160.0.0/14 Microsoft
62174.176.0.0/14 Microsoft
62274.224.0.0/14 Microsoft
62374.234.0.0/15 Microsoft
62474.240.0.0/14 Microsoft
62574.248.0.0/15 Microsoft
575168.61.0.0/16 Microsoft 626168.61.0.0/16 Microsoft
576168.62.0.0/15 Microsoft 627168.62.0.0/15 Microsoft
577 628
@@ -587,6 +638,7 @@
587206.190.32.0/19 Yahoo 638206.190.32.0/19 Yahoo
588209.73.160.0/19 Yahoo 639209.73.160.0/19 Yahoo
589209.191.64.0/18 Yahoo 640209.191.64.0/18 Yahoo
641212.82.100.0/22 Yahoo
590216.115.96.0/20 Yahoo 642216.115.96.0/20 Yahoo
591 643
592# Google 644# Google
@@ -596,6 +648,18 @@
5968.35.192.0/20 Google 6488.35.192.0/20 Google
59723.236.48.0/20 Google 64923.236.48.0/20 Google
59823.251.128.0/19 Google 65023.251.128.0/19 Google
65134.4.16.0/20 Google
65234.4.64.0/18 Google
65334.4.6.0/23 Google
65434.16.0.0/12 Google
65534.32.0.0/11 Google
65634.4.128.0/17 Google
65734.8.0.0/13 Google
65834.4.8.0/21 Google
65934.5.0.0/16 Google
66034.6.0.0/15 Google
66134.4.32.0/19 Google
66234.4.5.0/24 Google
59934.64.0.0/10 Google 66334.64.0.0/10 Google
60034.128.0.0/10 Google 66434.128.0.0/10 Google
60135.184.0.0/13 Google 66535.184.0.0/13 Google
@@ -1846,6 +1910,7 @@
184634.192.0.0/12 Amazon 191034.192.0.0/12 Amazon
184734.208.0.0/12 Amazon 191134.208.0.0/12 Amazon
184834.224.0.0/12 Amazon 191234.224.0.0/12 Amazon
191334.225.127.72/10 Amazon
184934.240.0.0/13 Amazon 191434.240.0.0/13 Amazon
185034.248.0.0/13 Amazon 191534.248.0.0/13 Amazon
185135.71.64.0/22 Amazon 191635.71.64.0/22 Amazon
@@ -3394,7 +3459,7 @@
339454.93.0.0/16 Amazon 345954.93.0.0/16 Amazon
339554.94.0.0/16 Amazon 346054.94.0.0/16 Amazon
339654.95.0.0/16 Amazon 346154.95.0.0/16 Amazon
339754.144.0.0/14 Amazon 346254.144.0.0/12 Amazon
339854.148.0.0/15 Amazon 346354.148.0.0/15 Amazon
339954.150.0.0/16 Amazon 346454.150.0.0/16 Amazon
340054.151.0.0/17 Amazon 346554.151.0.0/17 Amazon
@@ -3405,7 +3470,7 @@
340554.154.0.0/16 Amazon 347054.154.0.0/16 Amazon
340654.155.0.0/16 Amazon 347154.155.0.0/16 Amazon
340754.156.0.0/14 Amazon 347254.156.0.0/14 Amazon
340854.160.0.0/13 Amazon 347354.160.0.0/11 Amazon
340954.168.0.0/16 Amazon 347454.168.0.0/16 Amazon
341054.169.0.0/16 Amazon 347554.169.0.0/16 Amazon
341154.170.0.0/15 Amazon 347654.170.0.0/15 Amazon
@@ -3418,7 +3483,7 @@
341854.182.0.0/16 Amazon 348354.182.0.0/16 Amazon
341954.183.0.0/16 Amazon 348454.183.0.0/16 Amazon
342054.184.0.0/13 Amazon 348554.184.0.0/13 Amazon
342154.192.0.0/16 Amazon 348654.192.0.0/12 Amazon
342254.193.0.0/16 Amazon 348754.193.0.0/16 Amazon
342354.194.0.0/15 Amazon 348854.194.0.0/15 Amazon
342454.196.0.0/15 Amazon 348954.196.0.0/15 Amazon
@@ -3429,12 +3494,12 @@
342954.204.0.0/15 Amazon 349454.204.0.0/15 Amazon
343054.206.0.0/16 Amazon 349554.206.0.0/16 Amazon
343154.207.0.0/16 Amazon 349654.207.0.0/16 Amazon
343254.208.0.0/15 Amazon 349754.208.0.0/13 Amazon
343354.210.0.0/15 Amazon 349854.210.0.0/15 Amazon
343454.212.0.0/15 Amazon 349954.212.0.0/15 Amazon
343554.214.0.0/16 Amazon 350054.214.0.0/16 Amazon
343654.215.0.0/16 Amazon 350154.215.0.0/16 Amazon
343754.216.0.0/15 Amazon 350254.216.0.0/14 Amazon
343854.218.0.0/16 Amazon 350354.218.0.0/16 Amazon
343954.219.0.0/16 Amazon 350454.219.0.0/16 Amazon
344054.220.0.0/16 Amazon 350554.220.0.0/16 Amazon
@@ -3694,6 +3759,10 @@
369472.21.192.0/19 Amazon 375972.21.192.0/19 Amazon
369572.41.0.0/20 Amazon 376072.41.0.0/20 Amazon
369672.44.32.0/19 Amazon 376172.44.32.0/19 Amazon
376274.127.0.0/18 Amazon
376374.190.0.0/16 Amazon
376474.230.0.0/16 Amazon
376574.250.0.0/16 Amazon
369775.2.0.0/17 Amazon 376675.2.0.0/17 Amazon
369875.101.128.0/17 Amazon 376775.101.128.0/17 Amazon
369976.223.0.0/17 Amazon 376876.223.0.0/17 Amazon
@@ -5675,3 +5744,374 @@
567564.120.69.0/24 Leaseweb 574464.120.69.0/24 Leaseweb
567669.147.236.0/24 Leaseweb 574569.147.236.0/24 Leaseweb
567770.32.34.0/24 Leaseweb 574670.32.34.0/24 Leaseweb
5747
5748
5749
5750# GoDaddy
5751103.1.172.0/22 GoDaddy
5752103.1.172.0/24 GoDaddy
5753103.1.174.0/24 GoDaddy
5754103.1.175.0/24 GoDaddy
5755104.238.64.0/18 GoDaddy
5756104.238.64.0/19 GoDaddy
5757104.238.64.0/22 GoDaddy
5758104.238.64.0/24 GoDaddy
5759107.180.0.0/17 GoDaddy
5760107.180.0.0/18 GoDaddy
5761107.180.100.0/22 GoDaddy
5762107.180.104.0/22 GoDaddy
5763107.180.108.0/22 GoDaddy
5764107.180.120.0/22 GoDaddy
5765107.180.64.0/19 GoDaddy
5766118.139.160.0/19 GoDaddy
5767118.139.160.0/21 GoDaddy
5768132.148.0.0/16 GoDaddy
5769132.148.16.0/20 GoDaddy
5770132.148.16.0/22 GoDaddy
5771132.148.164.0/22 GoDaddy
5772132.148.184.0/21 GoDaddy
5773132.148.192.0/20 GoDaddy
5774132.148.20.0/22 GoDaddy
5775132.148.24.0/22 GoDaddy
5776132.148.32.0/21 GoDaddy
5777148.66.128.0/19 GoDaddy
5778148.66.128.0/22 GoDaddy
5779148.66.136.0/22 GoDaddy
5780148.66.140.0/22 GoDaddy
5781148.66.144.0/21 GoDaddy
5782148.72.0.0/17 GoDaddy
5783148.72.16.0/22 GoDaddy
5784148.72.204.0/22 GoDaddy
5785148.72.204.0/24 GoDaddy
5786148.72.206.0/23 GoDaddy
5787148.72.208.0/21 GoDaddy
5788148.72.220.0/22 GoDaddy
5789148.72.224.0/19 GoDaddy
5790148.72.224.0/20 GoDaddy
5791148.72.240.0/22 GoDaddy
5792148.72.244.0/22 GoDaddy
5793148.72.32.0/21 GoDaddy
5794148.72.32.0/23 GoDaddy
5795148.72.34.0/24 GoDaddy
5796148.72.36.0/24 GoDaddy
5797148.72.4.0/22 GoDaddy
5798148.72.44.0/22 GoDaddy
5799148.72.88.0/22 GoDaddy
5800160.153.32.0/19 GoDaddy
5801160.153.64.0/18 GoDaddy
5802160.153.64.0/19 GoDaddy
5803160.153.96.0/19 GoDaddy
5804166.62.0.0/19 GoDaddy
5805166.62.0.0/22 GoDaddy
5806166.62.0.0/24 GoDaddy
5807166.62.100.0/22 GoDaddy
5808166.62.10.0/23 GoDaddy
5809166.62.1.0/24 GoDaddy
5810166.62.112.0/20 GoDaddy
5811166.62.116.0/22 GoDaddy
5812166.62.120.0/22 GoDaddy
5813166.62.12.0/22 GoDaddy
5814166.62.12.0/24 GoDaddy
5815166.62.13.0/24 GoDaddy
5816166.62.15.0/24 GoDaddy
5817166.62.16.0/22 GoDaddy
5818166.62.17.0/24 GoDaddy
5819166.62.20.0/22 GoDaddy
5820166.62.2.0/24 GoDaddy
5821166.62.23.0/24 GoDaddy
5822166.62.24.0/22 GoDaddy
5823166.62.24.0/24 GoDaddy
5824166.62.25.0/24 GoDaddy
5825166.62.26.0/23 GoDaddy
5826166.62.28.0/22 GoDaddy
5827166.62.3.0/24 GoDaddy
5828166.62.32.0/19 GoDaddy
5829166.62.32.0/22 GoDaddy
5830166.62.36.0/22 GoDaddy
5831166.62.40.0/22 GoDaddy
5832166.62.4.0/22 GoDaddy
5833166.62.4.0/24 GoDaddy
5834166.62.44.0/22 GoDaddy
5835166.62.5.0/24 GoDaddy
5836166.62.52.0/22 GoDaddy
5837166.62.56.0/22 GoDaddy
5838166.62.60.0/22 GoDaddy
5839166.62.6.0/23 GoDaddy
5840166.62.64.0/18 GoDaddy
5841166.62.64.0/19 GoDaddy
5842166.62.80.0/22 GoDaddy
5843166.62.8.0/22 GoDaddy
5844166.62.8.0/24 GoDaddy
5845166.62.84.0/22 GoDaddy
5846166.62.88.0/22 GoDaddy
5847166.62.9.0/24 GoDaddy
5848
5849# IBM cloud service
5850# https://cloud.ibm.com/docs/cloud-infrastructure?topic=cloud-infrastructure-ibm-cloud-ip-ranges
5851# last update Aug 2023
5852159.8.198.0/23 IBM
5853169.38.118.0/23 IBM
5854173.192.118.0/23 IBM
5855192.255.18.0/24 IBM
5856198.23.118.0/23 IBM
5857169.46.118.0/23 IBM
5858169.47.118.0/23 IBM
5859169.48.118.0/24 IBM
5860159.122.118.0/23 IBM
5861161.156.118.0/24 IBM
5862149.81.118.0/23 IBM
58635.10.118.0/23 IBM
5864158.175.127.0/24 IBM
5865141.125.118.0/23 IBM
5866158.176.118.0/23 IBM
5867159.122.138.0/23 IBM
5868169.54.118.0/23 IBM
5869163.68.118.0/24 IBM
5870163.69.118.0/24 IBM
5871163.73.118.0/24 IBM
5872159.8.118.0/23 IBM
5873169.57.138.0/23 IBM
587450.23.118.0/23 IBM
5875169.45.118.0/23 IBM
5876169.62.118.0/24 IBM
5877174.133.118.0/23 IBM
5878168.1.18.0/23 IBM
5879130.198.118.0/23 IBM
5880135.90.118.0/23 IBM
5881161.202.118.0/23 IBM
5882128.168.118.0/23 IBM
5883165.192.118.0/23 IBM
5884158.85.118.0/23 IBM
5885163.74.118.0/23 IBM
5886163.75.118.0/23 IBM
5887208.43.118.0/23 IBM
5888192.255.38.0/24 IBM
5889169.55.118.0/23 IBM
5890169.60.118.0/23 IBM
5891169.61.118.0/23 IBM
5892159.8.197.0/24 IBM
5893169.38.117.0/24 IBM
589450.23.203.0/24 IBM
5895108.168.157.0/24 IBM
5896173.192.117.0/24 IBM
5897192.155.205.0/24 IBM
5898169.46.187.0/24 IBM
5899198.23.117.0/24 IBM
5900169.46.117.0/24 IBM
5901169.47.117.0/24 IBM
5902169.48.117.0/24 IBM
5903159.122.117.0/24 IBM
5904161.156.117.0/24 IBM
5905149.81.117.0/24 IBM
59065.10.117.0/24 IBM
5907158.175.117.0/24 IBM
5908141.125.117.0/24 IBM
5909158.176.117.0/24 IBM
5910159.122.137.0/24 IBM
5911169.54.117.0/24 IBM
5912159.8.117.0/24 IBM
5913169.57.137.0/24 IBM
591450.23.117.0/24 IBM
5915169.45.117.0/24 IBM
5916174.133.117.0/24 IBM
5917168.1.17.0/24 IBM
5918130.198.117.0/24 IBM
5919135.90.117.0/24 IBM
5920161.202.117.0/24 IBM
5921128.168.117.0/24 IBM
5922165.192.117.0/24 IBM
5923158.85.117.0/24 IBM
592450.22.248.0/25 IBM
5925169.54.27.0/24 IBM
5926198.11.250.0/24 IBM
5927208.43.117.0/24 IBM
5928169.55.117.0/24 IBM
5929169.60.117.0/24 IBM
5930169.61.117.0/24 IBM
593112.96.160.0/24 IBM
593266.98.240.192/26 IBM
593367.18.139.0/24 IBM
593467.19.0.0/24 IBM
593570.84.160.0/24 IBM
593670.85.125.0/24 IBM
593775.125.126.8/32 IBM
5938209.85.4.0/26 IBM
5939216.12.193.9/32 IBM
5940216.40.193.0/24 IBM
5941216.234.234.0/24 IBM
5942
5943# Hetzner
5944116.202.0.0/16 Hetzner
5945116.203.0.0/16 Hetzner
5946128.140.0.0/17 Hetzner
5947135.181.0.0/16 Hetzner
5948142.132.128.0/17 Hetzner
5949157.90.0.0/16 Hetzner
5950159.69.0.0/16 Hetzner
5951162.55.0.0/16 Hetzner
5952167.233.0.0/16 Hetzner
5953167.235.0.0/16 Hetzner
5954168.119.0.0/16 Hetzner
5955176.9.0.0/16 Hetzner
5956178.63.0.0/16 Hetzner
5957188.34.128.0/17 Hetzner
5958188.40.0.0/16 Hetzner
5959195.201.0.0/16 Hetzner
5960213.239.192.0/18 Hetzner
596123.88.0.0/17 Hetzner
596237.27.0.0/16 Hetzner
596346.4.0.0/16 Hetzner
596449.12.0.0/16 Hetzner
596549.13.0.0/16 Hetzner
59665.75.128.0/17 Hetzner
59675.9.0.0/16 Hetzner
596865.108.0.0/16 Hetzner
596965.109.0.0/16 Hetzner
597065.21.0.0/16 Hetzner
597178.46.0.0/15 Hetzner
597285.10.192.0/18 Hetzner
597388.198.0.0/16 Hetzner
597488.99.0.0/16 Hetzner
597591.107.128.0/17 Hetzner
597694.130.0.0/16 Hetzner
597795.216.0.0/16 Hetzner
597895.217.0.0/16 Hetzner
5979
5980# Liquid Web
5981159.135.48.0/20 Liquid Web
5982162.212.134.0/24 Liquid Web
5983162.252.104.0/22 Liquid Web
5984172.255.59.0/24 Liquid Web
5985173.199.128.0/18 Liquid Web
5986184.106.55.0/24 Liquid Web
5987192.126.88.0/22 Liquid Web
5988192.133.82.0/24 Liquid Web
5989192.138.16.0/21 Liquid Web
5990192.190.220.0/22 Liquid Web
5991192.251.32.0/24 Liquid Web
5992199.189.224.0/22 Liquid Web
5993199.195.118.0/24 Liquid Web
5994205.174.24.0/22 Liquid Web
5995207.246.248.0/21 Liquid Web
5996208.75.148.0/22 Liquid Web
5997208.79.232.0/21 Liquid Web
5998208.86.152.0/21 Liquid Web
5999209.124.89.0/24 Liquid Web
6000209.188.80.0/20 Liquid Web
6001209.59.128.0/18 Liquid Web
600250.28.0.0/18 Liquid Web
600350.28.5.0/24 Liquid Web
600450.28.64.0/19 Liquid Web
600550.57.240.0/20 Liquid Web
600664.50.144.0/20 Liquid Web
600764.50.144.0/23 Liquid Web
600864.50.148.0/22 Liquid Web
600964.50.152.0/21 Liquid Web
601064.91.224.0/19 Liquid Web
601167.225.128.0/17 Liquid Web
601267.227.128.0/17 Liquid Web
601367.43.0.0/20 Liquid Web
601468.66.211.0/24 Liquid Web
601569.160.56.0/24 Liquid Web
601669.16.192.0/18 Liquid Web
601769.16.222.0/23 Liquid Web
601869.167.128.0/18 Liquid Web
601972.52.128.0/17 Liquid Web
602096.30.0.0/18 Liquid Web
6021
6022# OVH
6023107.189.64.0/18 OVH
6024135.125.0.0/17 OVH
6025135.125.128.0/17 OVH
6026135.148.0.0/17 OVH
6027135.148.128.0/17 OVH
6028137.74.0.0/16 OVH
6029139.99.0.0/17 OVH
6030139.99.128.0/17 OVH
6031141.94.0.0/16 OVH
6032141.95.0.0/17 OVH
6033141.95.128.0/17 OVH
6034142.4.192.0/19 OVH
6035142.44.128.0/17 OVH
6036144.217.0.0/16 OVH
6037145.239.0.0/16 OVH
6038146.59.0.0/16 OVH
6039146.59.0.0/17 OVH
6040147.135.0.0/17 OVH
6041147.135.128.0/17 OVH
6042148.113.0.0/18 OVH
6043148.113.128.0/17 OVH
6044149.202.0.0/16 OVH
6045149.56.0.0/16 OVH
6046151.80.0.0/16 OVH
604715.204.0.0/17 OVH
604815.204.128.0/17 OVH
6049152.228.128.0/17 OVH
605015.235.0.0/17 OVH
605115.235.128.0/17 OVH
6052158.69.0.0/16 OVH
6053162.19.0.0/17 OVH
6054162.19.128.0/17 OVH
6055164.132.0.0/16 OVH
6056167.114.0.0/17 OVH
6057167.114.128.0/18 OVH
6058167.114.192.0/19 OVH
6059176.31.0.0/16 OVH
6060178.32.0.0/15 OVH
6061185.15.68.0/22 OVH
6062185.45.160.0/22 OVH
6063188.165.0.0/16 OVH
6064192.240.152.0/21 OVH
6065192.95.0.0/18 OVH
6066192.99.0.0/16 OVH
6067193.70.0.0/17 OVH
6068198.100.144.0/20 OVH
6069198.244.128.0/17 OVH
6070198.245.48.0/20 OVH
6071198.27.64.0/18 OVH
6072198.27.92.0/24 OVH
6073198.50.128.0/17 OVH
6074213.186.32.0/19 OVH
6075213.251.128.0/18 OVH
6076213.32.0.0/17 OVH
6077217.182.0.0/16 OVH
607823.92.224.0/19 OVH
607937.187.0.0/16 OVH
608037.59.0.0/16 OVH
608140.160.0.0/17 OVH
608246.105.0.0/16 OVH
608346.105.198.0/24 OVH
608446.105.199.0/24 OVH
608546.105.200.0/24 OVH
608646.105.201.0/24 OVH
608746.105.202.0/24 OVH
608846.105.203.0/24 OVH
608946.105.204.0/24 OVH
609046.105.206.0/24 OVH
609146.105.207.0/24 OVH
609246.244.32.0/20 OVH
609351.161.0.0/17 OVH
609451.161.128.0/17 OVH
6095
6096# Ionos
609774.208.0.0/16 Ionos
6098
6099# WPEngine
6100141.193.213.0/24 WPEngine
6101
6102# Dreamhost
6103208.113.128.0/17 Dreamhost
6104
6105# Shopify
610623.227.32.0/19 Shopify
6107
6108# Sucuri
610966.248.200.0/22 Sucuri
6110185.93.228.0/22 Sucuri
6111192.88.134.0/23 Sucuri
6112192.124.249.0/24 Sucuri
6113192.161.0.0/24 Sucuri
6114
6115# HostGator
6116# Bluehost
6117# Squarespace
diff --git a/src/lib/syscall.c b/src/lib/syscall.c
index ca7c61c8e..602f7218c 100644
--- a/src/lib/syscall.c
+++ b/src/lib/syscall.c
@@ -1104,13 +1104,13 @@ static const SyscallGroupList sysgroups[] = {
1104#ifdef SYS_pciconfig_write 1104#ifdef SYS_pciconfig_write
1105 "pciconfig_write," 1105 "pciconfig_write,"
1106#endif 1106#endif
1107#ifdef SYS_s390_mmio_read 1107#ifdef SYS_s390_pci_mmio_read
1108 "s390_mmio_read," 1108 "s390_pci_mmio_read,"
1109#endif 1109#endif
1110#ifdef SYS_s390_mmio_write 1110#ifdef SYS_s390_pci_mmio_write
1111 "s390_mmio_write" 1111 "s390_pci_mmio_write"
1112#endif 1112#endif
1113#if !defined(SYS_ioperm) && !defined(SYS_iopl) && !defined(SYS_pciconfig_iobase) && !defined(SYS_pciconfig_read) && !defined(SYS_pciconfig_write) && !defined(SYS_s390_mmio_read) && !defined(SYS_s390_mmio_write) 1113#if !defined(SYS_ioperm) && !defined(SYS_iopl) && !defined(SYS_pciconfig_iobase) && !defined(SYS_pciconfig_read) && !defined(SYS_pciconfig_write) && !defined(SYS_s390_pci_mmio_read) && !defined(SYS_s390_pci_mmio_write)
1114 "__dummy_syscall__" // workaround for s390x which doesn't have any of above defined and empty syscall lists are not allowed 1114 "__dummy_syscall__" // workaround for s390x which doesn't have any of above defined and empty syscall lists are not allowed
1115#endif 1115#endif
1116 }, 1116 },
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in
index 19fc94ebd..06969e851 100644
--- a/src/man/firejail.1.in
+++ b/src/man/firejail.1.in
@@ -788,7 +788,6 @@ $ firejail \-\-list
788.br 788.br
789$ firejail \-\-dns.print=3272 789$ firejail \-\-dns.print=3272
790 790
791#ifdef HAVE_NETWORK
792.TP 791.TP
793\fB\-\-dnstrace[=name|pid] 792\fB\-\-dnstrace[=name|pid]
794Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes 793Monitor DNS queries. The sandbox can be specified by name or pid. Only networked sandboxes
@@ -828,7 +827,6 @@ $ sudo firejail --dnstrace
828.br 827.br
82911:32:08 9.9.9.9 www.youtube.com (type 1) 82811:32:08 9.9.9.9 www.youtube.com (type 1)
830.br 829.br
831#endif
832 830
833.TP 831.TP
834\fB\-\-env=name=value 832\fB\-\-env=name=value
@@ -930,7 +928,6 @@ $ firejail --ignore=seccomp --ignore=caps firefox
930$ firejail \-\-ignore="net eth0" firefox 928$ firejail \-\-ignore="net eth0" firefox
931#endif 929#endif
932 930
933#ifdef HAVE_NETWORK
934.TP 931.TP
935\fB\-\-icmptrace[=name|pid] 932\fB\-\-icmptrace[=name|pid]
936Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes 933Monitor ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
@@ -956,7 +953,6 @@ $ sudo firejail --icmptrace
956.br 953.br
95720:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable 95420:53:55 192.168.1.60 -> 1.1.1.1 - 154 bytes - Destination unreachable/Port unreachable
958.br 955.br
959#endif
960 956
961.TP 957.TP
962\fB\-\-\include=file.profile 958\fB\-\-\include=file.profile
@@ -1643,6 +1639,7 @@ PID User RX(KB/s) TX(KB/s) Command
16431294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox 16391294 netblue 53.355 1.473 firejail \-\-net=eth0 firefox
1644.br 1640.br
16457383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission 16417383 netblue 9.045 0.112 firejail \-\-net=eth0 transmission
1642#endif
1646.TP 1643.TP
1647\fB\-\-nettrace[=name|pid] 1644\fB\-\-nettrace[=name|pid]
1648Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes 1645Monitor received TCP. UDP, and ICMP traffic. The sandbox can be specified by name or pid. Only networked sandboxes
@@ -1658,17 +1655,15 @@ Example:
1658.br 1655.br
1659$ sudo firejail --nettrace 1656$ sudo firejail --nettrace
1660.br 1657.br
1661 95 KB/s geoip 457, IP database 4436 1658 93 KB/s address:port (protocol) network
1662.br
1663 52 KB/s *********** 64.222.84.207:443 United States
1664.br 1659.br
1665 33 KB/s ******* 89.147.74.105:63930 Hungary 1660 14 B/s ** 104.24.8.4:443(QUIC) Cloudflare
1666.br 1661.br
1667 0 B/s 45.90.28.0:443 NextDNS 1662 80 KB/s ***************** 192.187.97.90:443(TLS) BitChute
1668.br 1663.br
1669 0 B/s 94.70.122.176:52309(UDP) Greece 1664 1 B/s 149.56.228.45:443(DoH) Canada
1670.br 1665.br
1671 339 B/s 104.26.7.35:443 Cloudflare 1666(D)isplay, (S)ave, (C)lear, e(X)it
1672.br 1667.br
1673 1668
1674.br 1669.br
@@ -1677,7 +1672,6 @@ the country the traffic originates from is added to the trace.
1677We also use the static IP map in /usr/lib/firejail/static-ip-map 1672We also use the static IP map in /usr/lib/firejail/static-ip-map
1678to print the domain names for some of the more common websites and cloud platforms. 1673to print the domain names for some of the more common websites and cloud platforms.
1679No external services are contacted for reverse IP lookup. 1674No external services are contacted for reverse IP lookup.
1680#endif
1681.TP 1675.TP
1682\fB\-\-nice=value 1676\fB\-\-nice=value
1683Set nice value for all processes running inside the sandbox. 1677Set nice value for all processes running inside the sandbox.
@@ -2263,6 +2257,18 @@ All modifications are discarded when the sandbox is closed.
2263Example: 2257Example:
2264.br 2258.br
2265$ firejail --private-opt=firefox /opt/firefox/firefox 2259$ firejail --private-opt=firefox /opt/firefox/firefox
2260.br
2261
2262.br
2263Note: Program installations in /opt tend to be relatively large and private-opt
2264copies the entire path(s) into RAM, which may significantly increase RAM usage
2265and break \fBfile-copy-limit\fR in firejail.config.
2266Therefore, in general it is recommended to use "whitelist /opt/PATH" instead of
2267"private-opt PATH".
2268For details, see
2269.UR https://github.com/netblue30/firejail/discussions/5307
2270#5307
2271.UE
2266 2272
2267.TP 2273.TP
2268\fB\-\-private-srv=file,directory 2274\fB\-\-private-srv=file,directory
@@ -2850,7 +2856,6 @@ $ firejail \-\-list
2850.br 2856.br
2851$ firejail \-\-shutdown=3272 2857$ firejail \-\-shutdown=3272
2852 2858
2853#ifdef HAVE_NETWORK
2854.TP 2859.TP
2855\fB\-\-snitrace[=name|pid] 2860\fB\-\-snitrace[=name|pid]
2856Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes 2861Monitor Server Name Indication (TLS/SNI). The sandbox can be specified by name or pid. Only networked sandboxes
@@ -2892,7 +2897,6 @@ $ sudo firejail --snitrace
2892.br 2897.br
289307:53:11 192.0.73.2 1.gravatar.com 289807:53:11 192.0.73.2 1.gravatar.com
2894.br 2899.br
2895#endif
2896 2900
2897.TP 2901.TP
2898\fB\-\-tab 2902\fB\-\-tab
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-03 04:23:01 +0000