aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* ci: run firejail --version after build/installLibravatar Kelvin M. Klann2022-05-17
| | | | | To ensure that the resulting program actually runs and also to show which compile-time features it supports.
* ci: fix --version not printing compile-time featuresLibravatar Kelvin M. Klann2022-05-16
| | | | | | | | | | | | | | Currently, when running on CI, `firejail --version` only prints the following line: firejail version 0.9.69 Add a new print_version() function that always prints both the above and the compile-time options (like it is done outside of CI) and call it in both of the places that handle --version on main.c. Misc: The printing of compile-time features was added on commit 48dd1fbec ("apparmor", 2016-08-02).
* build(deps): bump github/codeql-action from 2.1.9 to 2.1.10Libravatar dependabot[bot]2022-05-16
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.9 to 2.1.10. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7502d6e991ca767d2db617bfd823a1ed925a0d59...2f58583a1b24a7d3c7034f6bf9fa506d23b1183b) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* xonotic.profile: fix audit denial spamLibravatar Tad2022-05-12
| | | | | | After a3f00edb32aca7516d690db046dd1ed3eb186bdd Signed-off-by: Tad <tad@spotco.us>
* Prevent emptty /usr/share in google-chrome profilesLibravatar crocket2022-05-12
| | | | | | | | | | | Without whitelist-usr-share-common, /usr/share becomes empty. Adding whitelist-runuser-common didn't break google chrome. Whitelisting /usr/share/mozilla/extensions and /usr/share/webext shouldn't break google chrome, either. I tested google-chrome.profile only, but I think later versions should not be different.
* fzenity: fix dead storeLibravatar Kelvin M. Klann2022-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As caught by the Clang Static Analyzer: $ make clean && NO_EXTRA_CFLAGS="yes" scan-build --status-bugs make -C src/fzenity [...] main.c:77:10: warning: Value stored to 'ptr' is never read [deadcode.DeadStores] return ptr++; ^~~~~ 1 warning generated. [...] scan-build: Analysis run complete. scan-build: 1 bug found. The above increment is a no-op, as it is equivalent to `return ptr; ptr++;`. For it to make any difference, the prefix increment operator would have to be used in place of the postfix one: return ++ptr; Which would be equivalent to `++ptr; return ptr;`. But in order to fix the warning (and CI) while avoiding to change the current behavior, just remove the operator instead. Added on commit 1cdfa6f95 ("more on firecfg --guide: fzenity", 2022-04-25).
* always log seccomp errors (#5110)Libravatar netblue302022-05-09
|
* configure*: remove ultimately unused INSTALL and RANLIB check macrosLibravatar Kelvin M. Klann2022-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the manual of GNU Autoconf (version 2.69): > -- Macro: AC_PROG_INSTALL > Set output variable 'INSTALL' to the name of a BSD-compatible > 'install' program, if one is found in the current 'PATH'. > Otherwise, set 'INSTALL' to 'DIR/install-sh -c', checking the > directories specified to 'AC_CONFIG_AUX_DIR' (or its default > directories) to determine DIR (*note Output::). Also set the > variables 'INSTALL_PROGRAM' and 'INSTALL_SCRIPT' to '${INSTALL}' > and 'INSTALL_DATA' to '${INSTALL} -m 644'. > -- Macro: AC_PROG_RANLIB > Set output variable 'RANLIB' to 'ranlib' if 'ranlib' is found, > and otherwise to ':' (do nothing). None of the aforementioned variables are used: $ git grep -F -e '${INSTALL}' -e INSTALL_PROGRAM -e INSTALL_SCRIPT \ -e INSTALL_DATA -e RANLIB $ So remove the macros that define them. Misc: The macros in question have been present on configure.ac since it was created, on commit 137985136 ("Baseline firejail 0.9.28", 2015-08-08). And while the install command is called multiple times, ranlib is not used anywhere (and it seems that it was never used): $ git grep -E '^[[:blank:]]+install ' -- '*Makefile*' '*.mk*' | wc -l 32 $ git grep -F ranlib | wc -l 0 $ git log --pretty= --name-only -G'RANLIB|ranlib' \ 137985136..master | sort -u README.md Kind of relates to #4695.
* Whitelist for NixOS to resolve binary paths in user environmentLibravatar Jonas Heinrich2022-05-07
|
* NixOS fix OpenGL app supportLibravatar Jonas Heinrich2022-05-07
|
* build(deps): bump github/codeql-action from 2.1.8 to 2.1.9Libravatar dependabot[bot]2022-05-02
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.8 to 2.1.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1ed1437484560351c5be56cf73a48a279d116b78...7502d6e991ca767d2db617bfd823a1ed925a0d59) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-04-29
|\
| * hostnames.c: fix mismatched dealloc (fclose -> pclose)Libravatar Kelvin M. Klann2022-04-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Partial error log when building firejail-git (afee8603f) with --enable-fatal-warnings: hostnames.c: In function ‘retrieve_hostname’: hostnames.c:53:17: error: ‘fclose’ called on pointer returned from a mismatched allocation function [-Werror=mismatched-dealloc] 53 | fclose(fp); | ^~~~~~~~~~ hostnames.c:38:20: note: returned from ‘popen’ 38 | FILE *fp = popen(cmd, "r"); | ^~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[1]: *** [Makefile:7: hostnames.o] Error 1 Environment: gcc 11.2.0-4 on Artix Linux. Added on commit 500a56efd ("more on nettrace", 2022-01-07).
* | fix firemon, speed-upLibravatar netblue302022-04-29
| |
* | remove inode warning from fcopy - long list of warnings for ↵Libravatar netblue302022-04-29
|/ | | | /etc/alternatives on Debian
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-04-25
|\
| * Merge pull request #5115 from m00nwtchr/patch-1Libravatar netblue302022-04-25
| |\ | | | | | | Whitelist electron-flags.conf for all versions of electron
| | * okLibravatar Łukasz Mariański2022-04-23
| | |
| | * Fix glob pattern and update other profiles/includesLibravatar Łukasz Mariański2022-04-23
| | |
| | * Update electron.profileLibravatar m00nwtchr2022-04-23
| | |
| | * Update electron.profileLibravatar m00nwtchr2022-04-23
| | | | | | | | | Add electron-flags.conf for all versions of electron
| * | Merge pull request #5114 from kmk3/stop-warn-group-cleanLibravatar netblue302022-04-25
| |\ \ | | | | | | | | Stop warning on safe supplementary group clean
| | * | Stop warning on safe supplementary group cleanLibravatar Kelvin M. Klann2022-04-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When nogroups is used, the following warning may be issued (potentially multiple times, as drop_privs may be called more than once): Warning: cleaning all supplementary groups But the warning is being shown even when it seems that all supplementary groups can be safely dropped (and are thus dropped), which is likely a common scenario. This commit prevents the warning from being printed in that case, making it so that it is only shown in the non-happy paths (as was the case on firejail 0.9.66). Misc: The added code was copied from drop_privs. This amends commit 7abce0b4c ("Fix keeping certain groups with nogroups", 2021-11-30) / PR #4732. Kind of relates to #4930.
* | | | merges, fix compileLibravatar netblue302022-04-25
|/ / /
* | | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-04-25
|\ \ \
| * | | build(deps): bump actions/checkout from 3.0.1 to 3.0.2Libravatar dependabot[bot]2022-04-25
| | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/dcd71f646680f2efd8db4afa5ad64fdcba30e748...2541b1294d2704b0964813337f33b291d3f8596b) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
| * | CI: run apt-get update before install to get updated package listsLibravatar Reiner Herrmann2022-04-22
| | |
* | | more on firecfg --guide: fzenityLibravatar netblue302022-04-25
|/ /
* | fix firecfg --guideLibravatar netblue302022-04-21
| |
* | firejail-welcome.sh fixesLibravatar rusty-snake2022-04-21
| | | | | | | | | | | | | | - fix shellcheck - break long lines - remove unseless $? check - remove needless \\
* | more on firecfg --guideLibravatar netblue302022-04-21
| |
* | firecfg --guideLibravatar netblue302022-04-19
| |
* | resurecting welcome.shLibravatar netblue302022-04-19
|/
* build(deps): bump actions/checkout from 3.0.0 to 3.0.1Libravatar dependabot[bot]2022-04-18
| | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 3.0.0 to 3.0.1. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/a12a3943b4bdde767164f792f33f40b04645d846...dcd71f646680f2efd8db4afa5ad64fdcba30e748) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-04-17
|\
| * Merge pull request #5088 from slowpeek/masterLibravatar netblue302022-04-17
| |\ | | | | | | Allow resolution of .local names with avahi-daemon in the apparmor profile.
| | * Update firejail-defaultLibravatar slowpeek2022-04-02
| | | | | | | | | Allow access to avahi-daemon socket in the apparmor profile.
* | | documentation (#5107)Libravatar netblue302022-04-17
|/ /
* | Fix chromium browsers in firejail 0.9.68Libravatar rusty-snake2022-04-14
| | | | | | | | closes #4965
* | fix --writable-etcLibravatar netblue302022-04-12
| |
* | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-04-12
|\ \
| * | build(deps): bump github/codeql-action from 2.1.6 to 2.1.8Libravatar dependabot[bot]2022-04-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.6 to 2.1.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/28eead240834b314f7def40f6fcba65d100d99b1...1ed1437484560351c5be56cf73a48a279d116b78) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | small fixesLibravatar netblue302022-04-10
|/ /
* | Merge pull request #5092 from smitsohu/vlcLibravatar smitsohu2022-04-10
|\ \ | | | | | | harden vlc
| * | harden vlcLibravatar smitsohu2022-04-10
| |/ | | | | | | | | apparmor doesn't disable D-Bus anymore, so add it back remove memory-deny-write-execute comment, as this also breaks JIT compiled QtQuick nowadays
* | libvirt dnsmasq: more fixes (#5089)Libravatar smitsohu2022-04-10
| | | | | | | | | | | | | | following up ce6f792efd0af09b95050864b71f79c46359fa49 /var/lib/libvirt is blacklisted in disable-common.inc so merely whitelisting the directory is not enough
* | harden dnsmasqLibravatar smitsohu2022-04-10
| | | | | | | | | | private option implies private-cache, so it is safe to remove
* | libvirt dnsmasq fix (#5089)Libravatar smitsohu2022-04-10
| |
* | unbound: fixes, blacklist all of ${RUNUSER}Libravatar smitsohu2022-04-10
| |
* | steam: add HotLine Miami (#5097)Libravatar Kelvin M. Klann2022-04-08
| | | | | | https://store.steampowered.com/app/219150/Hotline_Miami/
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 14:33:05 +0000