diff options
Diffstat (limited to 'src')
-rw-r--r-- | src/fbuilder/build_profile.c | 1 | ||||
-rw-r--r-- | src/firecfg/firecfg.config | 6 | ||||
-rw-r--r-- | src/firejail/firejail.h | 2 | ||||
-rw-r--r-- | src/firejail/fs_dev.c | 17 | ||||
-rw-r--r-- | src/firejail/main.c | 3 | ||||
-rw-r--r-- | src/firejail/profile.c | 4 | ||||
-rw-r--r-- | src/firejail/sandbox.c | 3 | ||||
-rw-r--r-- | src/firejail/usage.c | 2 | ||||
-rw-r--r-- | src/firemon/procevent.c | 3 | ||||
-rwxr-xr-x | src/fshaper/fshaper.sh | 10 | ||||
-rw-r--r-- | src/man/firejail-profile.5.in | 11 | ||||
-rw-r--r-- | src/man/firejail.1.in | 27 | ||||
-rwxr-xr-x | src/man/mkman.sh | 11 | ||||
-rw-r--r-- | src/zsh_completion/_firejail.in | 2 |
14 files changed, 80 insertions, 22 deletions
diff --git a/src/fbuilder/build_profile.c b/src/fbuilder/build_profile.c index ab6eaf1dd..089dff663 100644 --- a/src/fbuilder/build_profile.c +++ b/src/fbuilder/build_profile.c | |||
@@ -138,6 +138,7 @@ void build_profile(int argc, char **argv, int index, FILE *fp) { | |||
138 | fprintf(fp, "#noinput\t# disable input devices\n"); | 138 | fprintf(fp, "#noinput\t# disable input devices\n"); |
139 | fprintf(fp, "nonewprivs\n"); | 139 | fprintf(fp, "nonewprivs\n"); |
140 | fprintf(fp, "noroot\n"); | 140 | fprintf(fp, "noroot\n"); |
141 | fprintf(fp, "#notpm\t# disable TPM devices\n"); | ||
141 | fprintf(fp, "#notv\t# disable DVB TV devices\n"); | 142 | fprintf(fp, "#notv\t# disable DVB TV devices\n"); |
142 | fprintf(fp, "#nou2f\t# disable U2F devices\n"); | 143 | fprintf(fp, "#nou2f\t# disable U2F devices\n"); |
143 | fprintf(fp, "#novideo\t# disable video capture devices\n"); | 144 | fprintf(fp, "#novideo\t# disable video capture devices\n"); |
diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 8d0a30521..08170bee6 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config | |||
@@ -97,10 +97,11 @@ basilisk | |||
97 | bcompare | 97 | bcompare |
98 | beaker | 98 | beaker |
99 | bibletime | 99 | bibletime |
100 | bijiben | 100 | #bijiben # webkit2gtk-4.x requires bwrap (see #3647) |
101 | bitcoin-qt | 101 | bitcoin-qt |
102 | bitlbee | 102 | bitlbee |
103 | bitwarden | 103 | bitwarden |
104 | bitwarden-desktop | ||
104 | bleachbit | 105 | bleachbit |
105 | blender | 106 | blender |
106 | blender-2.8 | 107 | blender-2.8 |
@@ -227,6 +228,7 @@ dragon | |||
227 | drawio | 228 | drawio |
228 | drill | 229 | drill |
229 | dropbox | 230 | dropbox |
231 | dtui | ||
230 | easystroke | 232 | easystroke |
231 | ebook-convert | 233 | ebook-convert |
232 | ebook-edit | 234 | ebook-edit |
@@ -824,7 +826,7 @@ soffice | |||
824 | sol | 826 | sol |
825 | sound-juicer | 827 | sound-juicer |
826 | soundconverter | 828 | soundconverter |
827 | spectacle | 829 | #spectacle # may be broken on wayland (see #5127) |
828 | spectral | 830 | spectral |
829 | spotify | 831 | spotify |
830 | sqlitebrowser | 832 | sqlitebrowser |
diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h index 736af018d..8683e0f77 100644 --- a/src/firejail/firejail.h +++ b/src/firejail/firejail.h | |||
@@ -368,6 +368,7 @@ extern int arg_noprofile; // use default.profile if none other found/specified | |||
368 | extern int arg_memory_deny_write_execute; // block writable and executable memory | 368 | extern int arg_memory_deny_write_execute; // block writable and executable memory |
369 | extern int arg_notv; // --notv | 369 | extern int arg_notv; // --notv |
370 | extern int arg_nodvd; // --nodvd | 370 | extern int arg_nodvd; // --nodvd |
371 | extern int arg_notpm; // --notpm | ||
371 | extern int arg_nou2f; // --nou2f | 372 | extern int arg_nou2f; // --nou2f |
372 | extern int arg_noinput; // --noinput | 373 | extern int arg_noinput; // --noinput |
373 | extern int arg_deterministic_exit_code; // always exit with first child's exit status | 374 | extern int arg_deterministic_exit_code; // always exit with first child's exit status |
@@ -646,6 +647,7 @@ void fs_dev_disable_3d(void); | |||
646 | void fs_dev_disable_video(void); | 647 | void fs_dev_disable_video(void); |
647 | void fs_dev_disable_tv(void); | 648 | void fs_dev_disable_tv(void); |
648 | void fs_dev_disable_dvd(void); | 649 | void fs_dev_disable_dvd(void); |
650 | void fs_dev_disable_tpm(void); | ||
649 | void fs_dev_disable_u2f(void); | 651 | void fs_dev_disable_u2f(void); |
650 | void fs_dev_disable_input(void); | 652 | void fs_dev_disable_input(void); |
651 | 653 | ||
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c index e8e486f12..34a26464a 100644 --- a/src/firejail/fs_dev.c +++ b/src/firejail/fs_dev.c | |||
@@ -39,6 +39,7 @@ typedef enum { | |||
39 | DEV_VIDEO, | 39 | DEV_VIDEO, |
40 | DEV_TV, | 40 | DEV_TV, |
41 | DEV_DVD, | 41 | DEV_DVD, |
42 | DEV_TPM, | ||
42 | DEV_U2F, | 43 | DEV_U2F, |
43 | DEV_INPUT | 44 | DEV_INPUT |
44 | } DEV_TYPE; | 45 | } DEV_TYPE; |
@@ -79,6 +80,12 @@ static DevEntry dev[] = { | |||
79 | {"/dev/video9", RUN_DEV_DIR "/video9", DEV_VIDEO}, | 80 | {"/dev/video9", RUN_DEV_DIR "/video9", DEV_VIDEO}, |
80 | {"/dev/dvb", RUN_DEV_DIR "/dvb", DEV_TV}, // DVB (Digital Video Broadcasting) - TV device | 81 | {"/dev/dvb", RUN_DEV_DIR "/dvb", DEV_TV}, // DVB (Digital Video Broadcasting) - TV device |
81 | {"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players | 82 | {"/dev/sr0", RUN_DEV_DIR "/sr0", DEV_DVD}, // for DVD and audio CD players |
83 | {"/dev/tpm0", RUN_DEV_DIR "/tpm0", DEV_TPM}, // TPM (Trusted Platform Module) devices | ||
84 | {"/dev/tpm1", RUN_DEV_DIR "/tpm1", DEV_TPM}, | ||
85 | {"/dev/tpm2", RUN_DEV_DIR "/tpm2", DEV_TPM}, | ||
86 | {"/dev/tpm3", RUN_DEV_DIR "/tpm3", DEV_TPM}, | ||
87 | {"/dev/tpm4", RUN_DEV_DIR "/tpm4", DEV_TPM}, | ||
88 | {"/dev/tpm5", RUN_DEV_DIR "/tpm5", DEV_TPM}, | ||
82 | {"/dev/hidraw0", RUN_DEV_DIR "/hidraw0", DEV_U2F}, | 89 | {"/dev/hidraw0", RUN_DEV_DIR "/hidraw0", DEV_U2F}, |
83 | {"/dev/hidraw1", RUN_DEV_DIR "/hidraw1", DEV_U2F}, | 90 | {"/dev/hidraw1", RUN_DEV_DIR "/hidraw1", DEV_U2F}, |
84 | {"/dev/hidraw2", RUN_DEV_DIR "/hidraw2", DEV_U2F}, | 91 | {"/dev/hidraw2", RUN_DEV_DIR "/hidraw2", DEV_U2F}, |
@@ -105,6 +112,7 @@ static void deventry_mount(void) { | |||
105 | (dev[i].type == DEV_VIDEO && arg_novideo == 0) || | 112 | (dev[i].type == DEV_VIDEO && arg_novideo == 0) || |
106 | (dev[i].type == DEV_TV && arg_notv == 0) || | 113 | (dev[i].type == DEV_TV && arg_notv == 0) || |
107 | (dev[i].type == DEV_DVD && arg_nodvd == 0) || | 114 | (dev[i].type == DEV_DVD && arg_nodvd == 0) || |
115 | (dev[i].type == DEV_TPM && arg_notpm == 0) || | ||
108 | (dev[i].type == DEV_U2F && arg_nou2f == 0) || | 116 | (dev[i].type == DEV_U2F && arg_nou2f == 0) || |
109 | (dev[i].type == DEV_INPUT && arg_noinput == 0)) { | 117 | (dev[i].type == DEV_INPUT && arg_noinput == 0)) { |
110 | 118 | ||
@@ -384,6 +392,15 @@ void fs_dev_disable_dvd(void) { | |||
384 | } | 392 | } |
385 | } | 393 | } |
386 | 394 | ||
395 | void fs_dev_disable_tpm(void) { | ||
396 | int i = 0; | ||
397 | while (dev[i].dev_fname != NULL) { | ||
398 | if (dev[i].type == DEV_TPM) | ||
399 | disable_file_or_dir(dev[i].dev_fname); | ||
400 | i++; | ||
401 | } | ||
402 | } | ||
403 | |||
387 | void fs_dev_disable_u2f(void) { | 404 | void fs_dev_disable_u2f(void) { |
388 | int i = 0; | 405 | int i = 0; |
389 | while (dev[i].dev_fname != NULL) { | 406 | while (dev[i].dev_fname != NULL) { |
diff --git a/src/firejail/main.c b/src/firejail/main.c index acbb4bf38..27ae68eb0 100644 --- a/src/firejail/main.c +++ b/src/firejail/main.c | |||
@@ -155,6 +155,7 @@ int arg_noprofile = 0; // use default.profile if none other found/specified | |||
155 | int arg_memory_deny_write_execute = 0; // block writable and executable memory | 155 | int arg_memory_deny_write_execute = 0; // block writable and executable memory |
156 | int arg_notv = 0; // --notv | 156 | int arg_notv = 0; // --notv |
157 | int arg_nodvd = 0; // --nodvd | 157 | int arg_nodvd = 0; // --nodvd |
158 | int arg_notpm = 0; // --notpm | ||
158 | int arg_nou2f = 0; // --nou2f | 159 | int arg_nou2f = 0; // --nou2f |
159 | int arg_noinput = 0; // --noinput | 160 | int arg_noinput = 0; // --noinput |
160 | int arg_deterministic_exit_code = 0; // always exit with first child's exit status | 161 | int arg_deterministic_exit_code = 0; // always exit with first child's exit status |
@@ -2209,6 +2210,8 @@ int main(int argc, char **argv, char **envp) { | |||
2209 | arg_notv = 1; | 2210 | arg_notv = 1; |
2210 | else if (strcmp(argv[i], "--nodvd") == 0) | 2211 | else if (strcmp(argv[i], "--nodvd") == 0) |
2211 | arg_nodvd = 1; | 2212 | arg_nodvd = 1; |
2213 | else if (strcmp(argv[i], "--notpm") == 0) | ||
2214 | arg_notpm = 1; | ||
2212 | else if (strcmp(argv[i], "--nou2f") == 0) | 2215 | else if (strcmp(argv[i], "--nou2f") == 0) |
2213 | arg_nou2f = 1; | 2216 | arg_nou2f = 1; |
2214 | else if (strcmp(argv[i], "--noinput") == 0) | 2217 | else if (strcmp(argv[i], "--noinput") == 0) |
diff --git a/src/firejail/profile.c b/src/firejail/profile.c index 4c6830250..1bb008f5f 100644 --- a/src/firejail/profile.c +++ b/src/firejail/profile.c | |||
@@ -618,6 +618,10 @@ int profile_check_line(char *ptr, int lineno, const char *fname) { | |||
618 | #endif | 618 | #endif |
619 | return 1; | 619 | return 1; |
620 | } | 620 | } |
621 | else if (strcmp(ptr, "notpm") == 0) { | ||
622 | arg_notpm = 1; | ||
623 | return 0; | ||
624 | } | ||
621 | else if (strcmp(ptr, "nou2f") == 0) { | 625 | else if (strcmp(ptr, "nou2f") == 0) { |
622 | arg_nou2f = 1; | 626 | arg_nou2f = 1; |
623 | return 0; | 627 | return 0; |
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c index 9e2b10d9c..57c90d489 100644 --- a/src/firejail/sandbox.c +++ b/src/firejail/sandbox.c | |||
@@ -1101,6 +1101,9 @@ int sandbox(void* sandbox_arg) { | |||
1101 | if (arg_nodvd) | 1101 | if (arg_nodvd) |
1102 | fs_dev_disable_dvd(); | 1102 | fs_dev_disable_dvd(); |
1103 | 1103 | ||
1104 | if (arg_notpm) | ||
1105 | fs_dev_disable_tpm(); | ||
1106 | |||
1104 | if (arg_nou2f) | 1107 | if (arg_nou2f) |
1105 | fs_dev_disable_u2f(); | 1108 | fs_dev_disable_u2f(); |
1106 | 1109 | ||
diff --git a/src/firejail/usage.c b/src/firejail/usage.c index 248b35853..01a7330fd 100644 --- a/src/firejail/usage.c +++ b/src/firejail/usage.c | |||
@@ -189,8 +189,8 @@ static const char *const usage_str = | |||
189 | " --noroot - install a user namespace with only the current user.\n" | 189 | " --noroot - install a user namespace with only the current user.\n" |
190 | #endif | 190 | #endif |
191 | " --nosound - disable sound system.\n" | 191 | " --nosound - disable sound system.\n" |
192 | " --noautopulse - disable automatic ~/.config/pulse init.\n" | ||
193 | " --novideo - disable video devices.\n" | 192 | " --novideo - disable video devices.\n" |
193 | " --notpm - disable TPM devices.\n" | ||
194 | " --nou2f - disable U2F devices.\n" | 194 | " --nou2f - disable U2F devices.\n" |
195 | " --nowhitelist=filename - disable whitelist for file or directory.\n" | 195 | " --nowhitelist=filename - disable whitelist for file or directory.\n" |
196 | " --oom=value - configure OutOfMemory killer for the sandbox\n" | 196 | " --oom=value - configure OutOfMemory killer for the sandbox\n" |
diff --git a/src/firemon/procevent.c b/src/firemon/procevent.c index 430730374..1a6f23919 100644 --- a/src/firemon/procevent.c +++ b/src/firemon/procevent.c | |||
@@ -396,6 +396,8 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my | |||
396 | sprintf(lineptr, " sid "); | 396 | sprintf(lineptr, " sid "); |
397 | break; | 397 | break; |
398 | 398 | ||
399 | // Note: PROC_EVENT_COREDUMP only exists since Linux 3.10 (see #6414). | ||
400 | #ifdef PROC_EVENT_COREDUMP | ||
399 | case PROC_EVENT_COREDUMP: | 401 | case PROC_EVENT_COREDUMP: |
400 | pid = proc_ev->event_data.coredump.process_tgid; | 402 | pid = proc_ev->event_data.coredump.process_tgid; |
401 | #ifdef DEBUG_PRCTL | 403 | #ifdef DEBUG_PRCTL |
@@ -403,6 +405,7 @@ static void __attribute__((noreturn)) procevent_monitor(const int sock, pid_t my | |||
403 | #endif | 405 | #endif |
404 | sprintf(lineptr, " coredump "); | 406 | sprintf(lineptr, " coredump "); |
405 | break; | 407 | break; |
408 | #endif /* PROC_EVENT_COREDUMP */ | ||
406 | 409 | ||
407 | case PROC_EVENT_COMM: | 410 | case PROC_EVENT_COMM: |
408 | pid = proc_ev->event_data.comm.process_tgid; | 411 | pid = proc_ev->event_data.comm.process_tgid; |
diff --git a/src/fshaper/fshaper.sh b/src/fshaper/fshaper.sh index cd2bf79bf..16a2485bf 100755 --- a/src/fshaper/fshaper.sh +++ b/src/fshaper/fshaper.sh | |||
@@ -3,13 +3,9 @@ | |||
3 | # Copyright (C) 2014-2024 Firejail Authors | 3 | # Copyright (C) 2014-2024 Firejail Authors |
4 | # License GPL v2 | 4 | # License GPL v2 |
5 | 5 | ||
6 | TCFILE="" | 6 | TCFILE="$(PATH=/usr/sbin:/sbin:/run/current-system/sw/bin command -v tc)" |
7 | if [ -x "/usr/sbin/tc" ]; then | 7 | if [ -z "$TCFILE" ]; then |
8 | TCFILE="/usr/sbin/tc" | 8 | echo "Error: traffic control utility (tc) not found" |
9 | elif [ -x "/sbin/tc" ]; then | ||
10 | TCFILE="/sbin/tc"; | ||
11 | else | ||
12 | echo "Error: traffic control utility (tc) not found"; | ||
13 | exit 1 | 9 | exit 1 |
14 | fi | 10 | fi |
15 | 11 | ||
diff --git a/src/man/firejail-profile.5.in b/src/man/firejail-profile.5.in index 8c039eb46..89784a984 100644 --- a/src/man/firejail-profile.5.in +++ b/src/man/firejail-profile.5.in | |||
@@ -382,9 +382,11 @@ Set working directory inside jail to the home directory, and failing that, the r | |||
382 | Set working directory inside the jail. Full directory path is required. Symbolic links are not allowed. | 382 | Set working directory inside the jail. Full directory path is required. Symbolic links are not allowed. |
383 | .TP | 383 | .TP |
384 | \fBprivate-dev | 384 | \fBprivate-dev |
385 | Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx, | 385 | Create a new /dev directory. |
386 | random, snd, urandom, video, log, shm and usb devices are available. | 386 | Only disc, dri, dvb, full, hidraw, log, null, ptmx, pts, random, shm, snd, tpm, |
387 | Use the options no3d, nodvd, nosound, notv, nou2f and novideo for additional restrictions. | 387 | tty, urandom, usb, video and zero devices are available. |
388 | Use the options no3d, nodvd, nosound, notpm, notv, nou2f and novideo for | ||
389 | additional restrictions. | ||
388 | 390 | ||
389 | .TP | 391 | .TP |
390 | \fBprivate-etc file,directory | 392 | \fBprivate-etc file,directory |
@@ -817,6 +819,9 @@ Disable input devices. | |||
817 | \fBnosound | 819 | \fBnosound |
818 | Disable sound system. | 820 | Disable sound system. |
819 | .TP | 821 | .TP |
822 | \fBnotpm | ||
823 | Disable Trusted Platform Module (TPM) devices. | ||
824 | .TP | ||
820 | \fBnotv | 825 | \fBnotv |
821 | Disable DVB (Digital Video Broadcasting) TV devices. | 826 | Disable DVB (Digital Video Broadcasting) TV devices. |
822 | .TP | 827 | .TP |
diff --git a/src/man/firejail.1.in b/src/man/firejail.1.in index fa2329d67..4edb0902e 100644 --- a/src/man/firejail.1.in +++ b/src/man/firejail.1.in | |||
@@ -207,7 +207,7 @@ $ firejail \-\-blacklist=/sbin \-\-blacklist=/usr/sbin | |||
207 | .br | 207 | .br |
208 | $ firejail \-\-blacklist=~/.mozilla | 208 | $ firejail \-\-blacklist=~/.mozilla |
209 | .br | 209 | .br |
210 | $ firejail "\-\-blacklist=/home/username/My Virtual Machines" | 210 | $ firejail \-\-blacklist="/home/username/My Virtual Machines" |
211 | .br | 211 | .br |
212 | $ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines | 212 | $ firejail \-\-blacklist=/home/username/My\\ Virtual\\ Machines |
213 | .TP | 213 | .TP |
@@ -1919,6 +1919,16 @@ Example: | |||
1919 | $ firejail \-\-nosound firefox | 1919 | $ firejail \-\-nosound firefox |
1920 | 1920 | ||
1921 | .TP | 1921 | .TP |
1922 | \fB\-\-notpm | ||
1923 | Disable Trusted Platform Module (TPM) devices. | ||
1924 | .br | ||
1925 | |||
1926 | .br | ||
1927 | Example: | ||
1928 | .br | ||
1929 | $ firejail \-\-notpm | ||
1930 | |||
1931 | .TP | ||
1922 | \fB\-\-notv | 1932 | \fB\-\-notv |
1923 | Disable DVB (Digital Video Broadcasting) TV devices. | 1933 | Disable DVB (Digital Video Broadcasting) TV devices. |
1924 | .br | 1934 | .br |
@@ -2108,7 +2118,7 @@ File globbing is supported, see \fBFILE GLOBBING\fR section for more details. | |||
2108 | .br | 2118 | .br |
2109 | Example: | 2119 | Example: |
2110 | .br | 2120 | .br |
2111 | $ firejail \-\-private-bin=bash,sed,ls,cat | 2121 | $ firejail \-\-private-bin=bash,cat,ls,sed |
2112 | .br | 2122 | .br |
2113 | Parent pid 20841, child pid 20842 | 2123 | Parent pid 20841, child pid 20842 |
2114 | .br | 2124 | .br |
@@ -2172,8 +2182,11 @@ $ pwd | |||
2172 | 2182 | ||
2173 | .TP | 2183 | .TP |
2174 | \fB\-\-private-dev | 2184 | \fB\-\-private-dev |
2175 | Create a new /dev directory. Only disc, dri, dvb, hidraw, null, full, zero, tty, pts, ptmx, random, snd, urandom, video, log, shm and usb devices are available. | 2185 | Create a new /dev directory. |
2176 | Use the options --no3d, --nodvd, --nosound, --notv, --nou2f and --novideo for additional restrictions. | 2186 | Only disc, dri, dvb, full, hidraw, log, null, ptmx, pts, random, shm, snd, tpm, |
2187 | tty, urandom, usb, video and zero devices are available. | ||
2188 | Use the options \-\-no3d, \-\-nodvd, \-\-nosound, \-\-notpm, \-\-notv, | ||
2189 | \-\-nou2f and \-\-novideo for additional restrictions. | ||
2177 | .br | 2190 | .br |
2178 | 2191 | ||
2179 | .br | 2192 | .br |
@@ -2191,7 +2204,7 @@ cdrom cdrw dri dvd dvdrw full log null ptmx pts random shm snd sr0 | |||
2191 | .br | 2204 | .br |
2192 | $ | 2205 | $ |
2193 | .TP | 2206 | .TP |
2194 | \fB\-\-private-etc, \-\-private-etc=file,directory,@group | 2207 | \fB\-\-private-etc, \-\-private-etc=@group,file,directory |
2195 | The files installed by \-\-private-etc are copies of the original system files from /etc directory. | 2208 | The files installed by \-\-private-etc are copies of the original system files from /etc directory. |
2196 | By default, the command brings in a skeleton of files and directories used by most console tools: | 2209 | By default, the command brings in a skeleton of files and directories used by most console tools: |
2197 | 2210 | ||
@@ -3130,7 +3143,9 @@ $ firejail \-\-noprofile \-\-whitelist=~/.mozilla | |||
3130 | .br | 3143 | .br |
3131 | $ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null | 3144 | $ firejail \-\-whitelist=/tmp/.X11-unix \-\-whitelist=/dev/null |
3132 | .br | 3145 | .br |
3133 | $ firejail "\-\-whitelist=/home/username/My Virtual Machines" | 3146 | $ firejail \-\-whitelist="/home/username/My Virtual Machines" |
3147 | .br | ||
3148 | $ firejail \-\-whitelist=/home/username/My\\ Virtual\\ Machines | ||
3134 | .br | 3149 | .br |
3135 | $ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups* | 3150 | $ firejail \-\-whitelist=~/work* \-\-whitelist=/var/backups* |
3136 | 3151 | ||
diff --git a/src/man/mkman.sh b/src/man/mkman.sh index 00c4ffe72..d854b6537 100755 --- a/src/man/mkman.sh +++ b/src/man/mkman.sh | |||
@@ -5,8 +5,15 @@ | |||
5 | 5 | ||
6 | set -e | 6 | set -e |
7 | 7 | ||
8 | MONTH="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%b)" | 8 | test -z "$SOURCE_DATE_EPOCH" && SOURCE_DATE_EPOCH="$(date +%s)" |
9 | YEAR="$(LC_ALL=C date -u --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y)" | 9 | |
10 | format='+%b %Y' | ||
11 | date="$(LC_ALL=C date -u -d "@$SOURCE_DATE_EPOCH" "$format" 2>/dev/null || | ||
12 | LC_ALL=C date -u -r "$SOURCE_DATE_EPOCH" "$format" 2>/dev/null || | ||
13 | LC_ALL=C date -u "$format")" | ||
14 | |||
15 | MONTH="$(printf '%s\n' "$date" | cut -f 1 -d ' ')" | ||
16 | YEAR="$(printf '%s\n' "$date" | cut -f 2 -d ' ')" | ||
10 | 17 | ||
11 | sed \ | 18 | sed \ |
12 | -e "s/VERSION/$1/g" \ | 19 | -e "s/VERSION/$1/g" \ |
diff --git a/src/zsh_completion/_firejail.in b/src/zsh_completion/_firejail.in index 15e9a5111..ecfe2ffdf 100644 --- a/src/zsh_completion/_firejail.in +++ b/src/zsh_completion/_firejail.in | |||
@@ -124,7 +124,6 @@ _firejail_args=( | |||
124 | # many would enjoy getting a list from -20..20 | 124 | # many would enjoy getting a list from -20..20 |
125 | '--nice=-[set nice value]: :(1 10 15 20)' | 125 | '--nice=-[set nice value]: :(1 10 15 20)' |
126 | '--no3d[disable 3D hardware acceleration]' | 126 | '--no3d[disable 3D hardware acceleration]' |
127 | '--noautopulse[disable automatic ~/.config/pulse init]' | ||
128 | '--noblacklist=-[disable blacklist for file or directory]: :_files' | 127 | '--noblacklist=-[disable blacklist for file or directory]: :_files' |
129 | '--nodbus[disable D-Bus access]' | 128 | '--nodbus[disable D-Bus access]' |
130 | '--nodvd[disable DVD and audio CD devices]' | 129 | '--nodvd[disable DVD and audio CD devices]' |
@@ -134,6 +133,7 @@ _firejail_args=( | |||
134 | '--nonewprivs[sets the NO_NEW_PRIVS prctl]' | 133 | '--nonewprivs[sets the NO_NEW_PRIVS prctl]' |
135 | '--noprinters[disable printers]' | 134 | '--noprinters[disable printers]' |
136 | '--nosound[disable sound system]' | 135 | '--nosound[disable sound system]' |
136 | '--notpm[disable TPM devices]' | ||
137 | '--nou2f[disable U2F devices]' | 137 | '--nou2f[disable U2F devices]' |
138 | '--novideo[disable video devices]' | 138 | '--novideo[disable video devices]' |
139 | '--private[temporary home directory]' | 139 | '--private[temporary home directory]' |