aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Merge pull request #5290 from kmk3/docs-suid-firejail-usersLibravatar netblue302022-08-14
|\ | | | | docs: mention risk of SUID binaries and also firejail-users(5)
| * docs: mention risk of SUID binaries and also firejail-users(5)Libravatar Kelvin M. Klann2022-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | On the introduction of firejail(1), mention the main risk of SUID binaries and that by default, only trusted users should be allowed to run firejail (and how to accomplish that). Note: The added comment line is completely discarded (so there is no extraneous blank line); see groff_man(7) for details. Suggested by @emerajid on #5288. Relates to #4601.
* | Merge pull request #5285 from ra1nb0w/vmware-snapshotLibravatar netblue302022-08-14
|\ \ | | | | | | vmware.profile: snapshot requires /etc/mtab
| * | vmware.profile: snapshot requires /etc/mtabLibravatar Davide Gerhard2022-08-02
| |/ | | | | | | | | | | | | This patch avoid the following error: Error: One of the parameters supplied is invalid Tested with VMware Workstation 16.2.4
* | mergesLibravatar netblue302022-08-14
| |
* | Merge pull request #5274 from ChrysoliteAzalea/masterLibravatar netblue302022-08-14
|\ \ | | | | | | Add support for custom AppArmor profiles (--apparmor=)
| * | Add support for custom AppArmor profiles (--apparmor=)Libravatar Азалия Смарагдова2022-08-05
| |/
* | RELNOTES: add build itemsLibravatar Kelvin M. Klann2022-08-12
| | | | | | | | Relates to #5283 #5284.
* | neomutt: Avoid creating empty files/directoriesLibravatar Hugo Osvaldo Barrera2022-08-11
| | | | | | | | | | | | | | | | | | | | | | | | neomutt won't write to these locations. Processes it spawns might read to some of them, but creating an empty file doesn't help. This just pollutes user's $HOME with empty files and directories. I've kept a few paths that MAY be written to by neomutt; it's not ideal, but I want to minimise the risk of potential data loss, even if it is corener cases. See: https://github.com/netblue30/firejail/discussions/5276
* | Merge pull request #5284 from kmk3/build-config-sh-fixesLibravatar Kelvin M. Klann2022-08-11
|\ \ | | | | | | build: config.sh.in: quote variables and fix shellcheck issues
| * | config.sh.in: fix all issues reported by shellcheckLibravatar Kelvin M. Klann2022-08-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following error and warnings: $ shellcheck --version | grep ^version: version: 0.8.0 $ shellcheck config.sh.in In config.sh.in line 1: # @configure_input@ ^-- SC2148 (error): Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive. In config.sh.in line 3: NAME=@PACKAGE_NAME@ ^--^ SC2034 (warning): NAME appears unused. Verify use (or export if used externally). In config.sh.in line 4: VERSION=@PACKAGE_VERSION@ ^-----^ SC2034 (warning): VERSION appears unused. Verify use (or export if used externally). For more information: https://www.shellcheck.net/wiki/SC2148 -- Tips depend on target shell and y... https://www.shellcheck.net/wiki/SC2034 -- NAME appears unused. Verify use (... Relates to #5140.
| * | config.sh.in: quote all variablesLibravatar Kelvin M. Klann2022-08-01
| |/ | | | | | | | | | | | | Output variables in general may contain values with spaces in them. Example: `CC=gcc -foo`. Relates to #5140.
* | Merge pull request #5283 from remyabel2/make-uninstallLibravatar Kelvin M. Klann2022-08-11
|\ \ | | | | | | build: Add files `make uninstall` forgot to remove
| * | Add files `make uninstall` forgot to removeLibravatar Tommy Nguyen2022-08-01
| | | | | | | | | | | | | | | There were a couple of files leftover after `make uninstall`. This patch fixes that.
* | | fix(audacity): !5281 sharedlib bug on Arch/Fedora (#5300)Libravatar Christopher Morrow2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix(audacity): !5281 sharedlib bug on Arch/Fedora removed `private-bin` line from audacity profile as it appears to block access to shared libraries needed to start audacity on some distributions. Relates to github issue #5281 * fix(audacity): Disabling apparmor and reenabling private-bin
* | | Merge pull request #5299 from pirate486743186/description-makepkgLibravatar Kelvin M. Klann2022-08-10
|\ \ \ | | | | | | | | makepkg: add description
| * | | makepkg.profile: add descriptionLibravatar pirate4867431862022-08-10
| | | |
* | | | new profile: gdu (#5289)Libravatar glitsj162022-08-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add gdu to 'new profiles' section * Create gdu.profile * add gdu to firecfg * harden gdu sandbox * fix protocol * simulate empty protocol in gdu * more user-friendly gdu sandboxing
* | | | build(deps): bump github/codeql-action from 2.1.17 to 2.1.18Libravatar dependabot[bot]2022-08-08
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.17 to 2.1.18. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/0c670bbf0414f39666df6ce8e718ec5662c21e03...2ca79b6fa8d3ec278944088b4aa5f46912db5d63) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | / build(deps): bump github/codeql-action from 2.1.16 to 2.1.17Libravatar dependabot[bot]2022-08-03
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.16 to 2.1.17. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/3e7e3b32d0fb8283594bb0a76cc60a00918b0969...0c670bbf0414f39666df6ce8e718ec5662c21e03) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | RELNOTES: add build and ci itemsLibravatar Kelvin M. Klann2022-08-01
| | | | | | | | Relates to #5248 #5249 #5251.
* | RELNOTES: add feature: Warn when encountering EIO during remountLibravatar Kelvin M. Klann2022-08-01
|/ | | | Relates to #5240 #5242.
* Merge pull request #5259 from smitsohu/nsLibravatar smitsohu2022-07-31
|\ | | | | introduce new option restrict-namespaces
| * introduce new option restrict-namespacesLibravatar smitsohu2022-07-23
| |
| * protocol filter: add x32 ABI handlingLibravatar smitsohu2022-07-19
| |
* | Merge pull request #5271 from smitsohu/nnpLibravatar smitsohu2022-07-31
|\ \ | | | | | | improve force-nonewprivs security guarantees
| * | improve force-nonewprivs security guaranteesLibravatar smitsohu2022-07-24
| | |
* | | Merge pull request #5251 from kmk3/build-add-autoconf-commentLibravatar smitsohu2022-07-31
|\ \ \ | | | | | | | | build: add autoconf auto-generation comment to input files
| * | | build: add autoconf auto-generation comment to input filesLibravatar Kelvin M. Klann2022-07-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To note on the output files that they are generated and to clarify how they are generated. From the manual of GNU Autoconf (version 2.69): > -- Variable: configure_input > A comment saying that the file was generated automatically by > 'configure' and giving the name of the input file. 'AC_OUTPUT' > adds a comment line containing this variable to the top of every > makefile it creates. For other files, you should reference this > variable in a comment at the top of each input file. For > example, an input shell script should begin like this: > > #!/bin/sh > # @configure_input@ > > The presence of that line also reminds people editing the file > that it needs to be processed by 'configure' in order to be used. Resulting output on config.mk: # config.mk. Generated from config.mk.in by configure. Relates to #5140.
* | | | Merge pull request #5249 from kmk3/ci-ignore-git-pathsLibravatar smitsohu2022-07-31
|\ \ \ \ | | | | | | | | | | ci: ignore git-related paths and the project license
| * | | | ci: ignore git-related paths and the project licenseLibravatar Kelvin M. Klann2022-07-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the following paths to the ignore lists: - .git-blame-ignore-revs - .gitignore - COPYING To avoid running CI unnecessarily. Commands used to show only the root files: $ git ls-files | grep -v / Misc: I noticed the missing paths on #5248.
* | | | | Merge pull request #5248 from kmk3/build-gitignore-distdirLibravatar smitsohu2022-07-31
|\ \ \ \ \ | | | | | | | | | | | | build: add dist build directory to .gitignore
| * | | | | build: add dist build directory to .gitignoreLibravatar Kelvin M. Klann2022-07-12
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ignore it only on the repository root path, as a directory that matches `firejail-*` could eventually be added. Note that the dist archive is already ignored since commit da6b131c3 ("chore(.gitignore) ignore built packages", 2018-01-15) / PR #1733. Example paths: * build dir: firejail-0.9.71/ * archive: firejail-0.9.71.tar.xz See `$(NAME)-$(VERSION)` and `$(NAME)-$(VERSION).tar.xz` in the "dist" target on the root Makefile.
* | | | | update m4 macro from autoconf-archive (2022.02.11)Libravatar Reiner Herrmann2022-07-31
| | | | |
* | | | | Merge pull request #5275 from netblue30/ci_ubuntu_2204Libravatar Reiner Herrmann2022-07-30
|\ \ \ \ \ | | | | | | | | | | | | CI: bump ubuntu to 22.04 and use newer compilers / analyzers
| * | | | | CI: keep old cppcheck job and ignore two files in new job that take too long ↵Libravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | to check
| * | | | | CI: bump ubuntu to 22.04 and use newer compilers / analyzersLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | tests: disable calling curl in dns test, as systemd-resolved is used on CI ↵Libravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | runner
| * | | | | tests: try curl instead of wget for tracing dns resolutionLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | tests: add alternative message for skipping testLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | tests: drop checking for hosts file in trace testLibravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | firejail is no longer detecting that /etc/hosts is getting opened. in strace it can still be seen that the file is opened via syscall, but on C library layer (which firejail is tracing) it's probably implemented differently now.
| * | | | | CI: fix wrong matching for test errorsLibravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | grep was returning non-zero exit code if it did NOT find the error marker, and zero if it did.
| * | | | | Make list of paths const to fix a false positive of gcc analyzerLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | zero-initialize two variablesLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | CI: build all jobs with apparmor / selinux to cover more codeLibravatar Reiner Herrmann2022-07-30
|/ / / / /
* | | | | Deny Tor related profiles access to /sys/class/netLibravatar Tad2022-07-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This directory contains the MAC address for connections available Tested working with torbrowser-launcher and onionshare Signed-off-by: Tad <tad@spotco.us>
* | | | | viewnior.profile: allow accessing its /usr/share directory (#5270)Libravatar NetSysFire2022-07-23
| |_|/ / |/| | |
* | | | build(deps): bump github/codeql-action from 2.1.15 to 2.1.16Libravatar dependabot[bot]2022-07-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.15 to 2.1.16. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/3f62b754e23e0dd60f91b744033e1dc1654c0ec6...3e7e3b32d0fb8283594bb0a76cc60a00918b0969) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | | apparmor cleanupLibravatar smitsohu2022-07-20
| |_|/ |/| |
* | | remmina.profile: allow python3 (#5253)Libravatar NetSysFire2022-07-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | * remmina.profile: allow python * Update etc/profile-m-z/remmina.profile Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-25 15:13:57 +0000