| Commit message (Collapse) | Author | Age |
|---|
| ... | |
| |/ /
| |
| |
| |
| |
| |
| | |
The zoom SSO workflow launches an embedded sandboxed browser
(QtWebEngineProcess) which requires chroot and netlink to work.
Fixes #3272
|
| | | |
|
| | |
| |
| | |
See also: https://bugs.debian.org/948656
|
| | |
| |
| |
| |
| | |
add AppArmor confinement to processes started with --join and,
more importantly, --join-or-start
|
| |\ \
| | |
| | | |
conky needs lua
|
| | | |
| | |
| | | |
Place `include allow-lua.inc` above the other includes
|
| | | |
| | |
| | | |
Replace `noblacklist /usr/lib/liblua*` by including `allow-lua.inc`
|
| |/ /
| |
| | |
See issue #3250
|
| |\ \
| | |
| | | |
add xournal.profile
|
| |/ / |
|
| | |
| |
| | |
Fixes #3221.
|
| | |
| |
| |
| | |
blacklist process_vm_readv and process_vm_writev
while we're at it also remove duplicate iopl blacklisting
|
| | |
| |
| | |
See discussion in https://github.com/netblue30/firejail/commit/56b60dfd0ec5227318f21409093eca965baf136a.
|
| | |
| |
| | |
Thanks to @rusty-snake in https://github.com/netblue30/firejail/commit/56b60dfd0ec5227318f21409093eca965baf136a#r37460831.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* more lua blacklisting in disable-interpreters.inc
* add some paths to allow-lua.inc
* Revert blacklisting /usr/include/lauxlib.h in disable-interpreters.inc
/usr/include/lauxlib.h is handled in disable-devel.inc. Thanks to @rusty-snake for pointing that out.
|
| | |
| |
| |
| |
| |
| |
| |
| | |
* allow lua in mpv.profile
* fix allow-lua.inc for mpv
* extra lua blacklisting for mpv
|
| |/ |
|
| |\
| |
| | |
Harden sbox_run by using fexecve instead of execvp
|
| | |
| |
| |
| | |
The check is already performed by sbox_run
|
| |/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We require the command passed to sbox_run to be an absolute path,
and avoid resolving PATH.
Note that PATH-based attacks were already difficult to pull of,
because sbox_run clears the environment before executing the command.
This patch hopefully makes then impossible.
As an additional precaution, we check that the executable is owned by either
the root user or the root group, and is not world-writable.
The use of O_PATH, fstat and fexecve aims to prevent a race condition when
the invoked path (e.g., /usr/lib/firejail/fnet) is owned by root
or is a symlink to a binary owned by root, but the containing directory
(e.g., /usr/lib/firejail) is somehow owned by a user.
This is quite unlikely (but may be possible by abusing some other setuid
executable is a specific way), and would allow swapping the binary or symlink
to a malicious one after we checked ownership.
"Locking in" the file descriptor gets rid of the race condition.
We have to get rid of the `/proc/[pid]/comm` check in dhcp_read_pidfile,
because fexecve sets the comm value to the fd being exec'd (e.g., 3)
instead of the name of the file.
This is not a problem, unless by the time we pick up the pidfile of dhclient,
it has already crashed, and the pid number have wrapper around.
Needless to say, this is extremely unlikely
(and does not cause a security issue, anyways).
|
| |\
| |
| | |
Harden dhcp by checking for /sbin/dhclient
|
| | |
| |
| |
| |
| |
| |
| | |
Running /sbin/dhclient or /usr/sbin/dhclient avoids PATH-based vulnerabilities.
We also check that the dhclient is owned by root.
We take an approach similar to netfiler.c and assume that the required binary
ar in /sbin or /usr/sbin, or (like on Arch) /sbin is a symlink to /usr/bin.
|
| |/ |
|
| |
|
|
|
|
| |
- spelling suggestion from @glitsj16 on fda62527
- drop python2 from openshot it never has a python2 version
- #3126 note in manpage: cannot combine --private with --private=
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Add profile for offical Linux Teams application
* fix: add mkdir suggestions in Teams profile
* Merge suggestions for Teams profile
* Add suggestion to Teams profile
* Add Teams to firecfg.config
* Add paths from Teams profile to disable-programs
* Remove the duplicated whitelist for downloads in Teams profile
Co-Authored-By: rusty-snake <print_hello_world+GitHub@protonmail.com>
* Cleanup teams profile after testing
* Add comment to Teams profile
Co-authored-by: rusty-snake <print_hello_world+GitHub@protonmail.com>
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Running `firejail --noprofile --private-bin=bash,ls ls -1Za /usr/bin`
shows that the SELinux labels are not correct:
```
user_u:object_r:user_tmpfs_t:s0 .
system_u:object_r:usr_t:s0 ..
user_u:object_r:user_tmpfs_t:s0 bash
user_u:object_r:user_tmpfs_t:s0 ls
```
After fixing this:
```
system_u:object_r:bin_t:s0 .
system_u:object_r:usr_t:s0 ..
system_u:object_r:shell_exec_t:s0 bash
system_u:object_r:bin_t:s0 ls
```
Most copied files and created directories should now have correct
labels (bind mounted objects keep their labels). This is useful to
avoid having to change the SELinux rules when using Firejail.
|
| |
|
|
|
|
|
|
|
| |
Some distributions include fonts in the texmf and texlive subdirectories
of /usr/share. This makes those fonts accessible, addressing buggy
behavior in okular where some text fails to render.
This also whitelists /usr/share/config.kcfg which contains default
settings that should be available to many applications.
|
| | |
|
| |
|
| |
Allow writing some proc paths used by browsers but restrict it to their owner.
|
| |
|
| |
Openshot 2.5.0 needs networking. This fixes #3221.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
- mdwe broken
- ${HOME}/.ssr
|
| |
|
|
| |
see issue #3145
|
| |
|
|
| |
see issue #3145
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* include wvc in aria2c.profile
* include wvc in clawsker.profile
* include wvc in conky.profile
* include wvc in dconf.profile
* include wvc in dconf-editor.profile
* include wvc in exiftool.profile
* include wvc in font-manager.profile
* include wvc in gconf.profile
* include wvc in git.profile
* include wvc in gjs.profile
* include wvc in gpg.profile
* include wvc in img2txt.profile
* include wvc in mediainfo.profile
* include wvc in mpd.profile
* include wvc in nitroshare.profile
* include wvc in ocenaudio.profile
* include wvc to ping.profile
* include wvc in simple-scan.profile
* include wvc in simplescreenrecorder.profile
* include wvc in sysprof.profile
* include wvc in tshark.profile
* include wvc in uget-gtk.profile
* include wvc in viewnior.profile
* include wvc in weechat.profile
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Added typing.
Replaced os.path with pathlib.
Made it work.
Fixes in .gitignore.
|
Peter Sanford
Reiner Herrmann
smitsohu
rusty-snake
curiosityseeker
Hans-Christoph Steiner
glitsj16
Kristóf Marussy
Andreas Hunkeler
Quentin Minster
Topi Miettinen
Antonio Russo
Vincent43
KOLANICH