aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* fbuilder: consider unix socketsLibravatar smitsohu2022-03-13
|
* minor cleanups, no functional changes (#5040)Libravatar glitsj162022-03-13
| | | | | | | | | * drop redundant noblacklist noblacklist ${HOME}/.vscode-oss already exists in included code.profile * remove newline Nitpick for persistency with other profiles that have the comment about #2624.
* hardening onionshare-gui.profile (#4959)Libravatar glitsj162022-03-13
| | | | | | | * hardening onionshare-gui.profile * add another dbus-user filter to onionshare-gui.profile * harden onionshare
* fbuilder: don't consider flatpak/snapd directoriesLibravatar smitsohu2022-03-12
|
* fbuilder: fix Electron appsLibravatar smitsohu2022-03-12
| | | | | tracelog is known to be incompatible with Chromium/Electron apps keep it commented for the time being
* fbuilder tweaksLibravatar smitsohu2022-03-12
|
* disable-programs.inc: add ~/.preyLibravatar Kelvin M. Klann2022-03-11
| | | | | This amends commit af8f681c0 ("steam.profile: allow "${HOME}/.prey"", 2022-03-11) / PR #5029.
* moving videos to OdyseeLibravatar netblue302022-03-11
|
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar smitsohu2022-03-11
|\
| * Merge pull request #5013 from rusty-snake/scalaLibravatar netblue302022-03-11
| |\ | | | | | | Blacklist scala devel stuff
| | * Blacklist scala devel stuffLibravatar rusty-snake2022-03-05
| | |
| * | Merge pull request #5017 from TheOneric/fix_steam+protonLibravatar netblue302022-03-11
| |\ \ | | | | | | | | Fix newest Steam client and Proton ≥ 5.13
| | * | steam.profile: fix black windowLibravatar Oneric2022-03-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After the Steam cleint update of the 04th March 2022 the steamwebhelper process now needs to be able to do chroot syscalls to render anything. If not all content tabs in the client will just appear black. fixes: https://github.com/netblue30/firejail/issues/5014
| | * | steam.profile: fix Proton 5.13+Libravatar Oneric2022-03-06
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | Starting with version 5.13 Proton internally uses bubblewrap to create a container for the game. To make this work with firejail we need to allow these 4 additional syscalls. fixes: https://github.com/netblue30/firejail/issues/4366 fixes: https://github.com/netblue30/firejail/issues/4686
| * | Merge pull request #5028 from kmk3/fix-gcov-macroLibravatar netblue302022-03-11
| |\ \ | | | | | | | | gcov: fix gcov functions always declared as dummy
| | * | gcov: fix gcov functions always declared as dummyLibravatar Kelvin M. Klann2022-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the check to enable gcov relies on a non-existent macro due to a typo, which looks like it would cause the dummy/empty versions of the gcov functions to always be declared (even with --enable-gcov), instead of the real ones from gcov.h. This commit fixes the typo (HAS_GCOV -> HAVE_GCOV). See configure.ac for the macro declaration. This amends commit 5106b2ec4 ("gcov: use no-op functions if not enabled", 2021-06-20) / PR #4376. Occurrences of each macro with this commit applied: $ git grep -F HAVE_GCOV | wc -l 16 $ git grep -F HAS_GCOV | wc -l 0
| * | | Merge pull request #5029 from davidebeatrici/steam-prey-2006Libravatar netblue302022-03-11
| |\ \ \ | | | | | | | | | | steam.profile: allow "${HOME}/.prey"
| | * | | steam.profile: allow "${HOME}/.prey"Libravatar Davide Beatrici2022-03-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The directory is used by the Linux binary for Prey (2006), available at https://icculus.org/prey. Not whitelisting the directory results in the game failing to launch: found DLL in pak file: /home/user/.steam/steamapps/common/Prey 2006/base/game01.pk4/gamex86.so copy gamex86.so to /home/user/.prey/base/gamex86.so dlopen '/home/user/.prey/base/gamex86.so' failed: /home/user/.prey/base/gamex86.so: failed to map segment from shared object
* | | | | mergeLibravatar smitsohu2022-03-11
| | | | |
* | | | | harden songrecLibravatar smitsohu2022-03-11
|/ / / / | | | | | | | | | | | | | | | | | | | | as suggested by @rusty-snake in addition blacklist/noblacklist/whitelist songrec application files
* | | | Merge pull request #4260 from sandsmark/martin/songrecLibravatar smitsohu2022-03-11
|\ \ \ \ | |/ / / |/| | | Add songrec
| * | | Add songrecLibravatar Martin T. H. Sandsmark2021-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | It is a Rust application using Cargo, so harden based on common supply chain attacks seen. https://github.com/marin-m/SongRec
* | | | fix testingLibravatar smitsohu2022-03-10
| | | |
* | | | fix testingLibravatar smitsohu2022-03-10
| | | |
* | | | ls: add control character filtering (similar to cat option)Libravatar smitsohu2022-03-10
| | | |
* | | | refactor meta character filteringLibravatar smitsohu2022-03-10
| |/ / |/| |
* | | RELNOTES: add warning about allow-trayLibravatar Kelvin M. Klann2022-03-09
| | | | | | | | | | | | Relates to #4946.
* | | RELNOTES: sort items by categoryLibravatar Kelvin M. Klann2022-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | Put it in a similar order to 0.9.68: features, modifs/reworks, bugfixes, ci, docs, new profiles. See commit 5fbc1cd50 ("RELNOTES: sort items by category", 2022-02-05). Misc: The last paragraph of that commit message is wrong; just ignore it.
* | | RELNOTES: add missing PR references; fix typoLibravatar Kelvin M. Klann2022-03-09
| | | | | | | | | | | | | | | | | | This amends commit 481321881 ("merges", 2022-03-05). Relates to #4985 #4990 #5011.
* | | Merge pull request #5026 from smitsohu/electronLibravatar smitsohu2022-03-09
|\ \ \ | | | | | | | | Electron app fixes
| * | | skypeforlinux cleanupLibravatar smitsohu2022-03-09
| | | |
| * | | fix Electron app profiles (#5012)Libravatar smitsohu2022-03-09
| | | |
* | | | fbuilder: fix suggested profileLibravatar smitsohu2022-03-09
| | | | | | | | | | | | | | | | follow-up to fdee4dc1326bb2d5ce90ef2a0410dccba56beb70
* | | | build option: support chromium/electron apps most of the timeLibravatar smitsohu2022-03-09
| | | |
* | | | xdg dir translation cleanupLibravatar smitsohu2022-03-09
|/ / / | | | | | | | | | remove all duplicate entries
* | / Bump actions/checkout from 2.4.0 to 3Libravatar dependabot[bot]2022-03-08
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 2.4.0 to 3. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/ec3a7ce113134d7a93b817d10a8272cb61118579...a12a3943b4bdde767164f792f33f40b04645d846) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
* | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-03-05
|\ \
| * \ Merge pull request #5009 from glitsj16/chromium-basedLibravatar netblue302022-03-05
| |\ \ | | | | | | | | drop redundant ignore in chromium-based browsers
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
| | * | drop redundant ignoreLibravatar glitsj162022-03-04
| | | |
* | | | mergesLibravatar netblue302022-03-05
|/ / /
* | | Merge pull request #4985 from smitsohu/whitelistLibravatar netblue302022-03-05
|\ \ \ | | | | | | | | whitelist restructuring
| * | | whitelist: avoid nested whitelist mountsLibravatar smitsohu2022-03-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Check mountids while creating path of a new mount target. If the mountid differs from the top level directory (tmpfs) mountid, this proves an earlier whitelist command. It is important to note though that this check is not exhaustive, as besides nested whitelist commands there are also nested top level directories. So a user could run: firejail --whitelist=/a/b --whitelist=/a/b/c where both a and b are (whitelist) top level directories. Such a command may result in b and c sharing the filesystem and hence mountid. In this case the nested nature of the whitelist commands will go unnoticed. A more rigorous version will probably need to apply some sorting to the whitelist command, possibly by means of glob(3).
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-23 02:10:41 +0000