aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Add ability to disable user profiles at compile time.Libravatar Dmitry Chestnykh2022-02-28
|
* RELNOTES: add bugfix/ci/docsLibravatar Kelvin M. Klann2022-02-16
| | | | Relates to #4912 #4916 #4930 #4933.
* Merge pull request #4933 from kmk3/disable-nogroups-msgLibravatar netblue302022-02-14
|\ | | | | Disable/comment message about nogroups being ignored
| * Disable/comment message about nogroups being ignoredLibravatar Kelvin M. Klann2022-02-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added on commit 7abce0b4c ("Fix keeping certain groups with nogroups", 2021-11-30) / PR #4732. As reported by @rusty-snake on #4930, conflicting messages are printed when using whitelist-run-common.inc with nogroups: $ cat test.profile include whitelist-run-common.inc nogroups $ firejail --profile=./test.profile groups Reading profile ./test.profile Reading profile /etc/firejail/whitelist-run-common.inc Parent pid 1234, child pid 1235 Warning: logind not detected, nogroups command ignored <--- is a lie Warning: cleaning all supplementary groups Child process initialized in 30.00 ms rusty-snake <---- running `groups` outside of the sandbox shows more so groups are actually cleaned Parent is shutting down, bye... This probably happens because wrc causes /run/systemd to be hidden in the sandbox and because check_can_drop_all_groups is called multiple times, seemingly both before and after the whitelisting goes into effect. So disable the message about nogroups being ignored, but keep the message about cleaning all supplementary groups (which is unlikely to be printed unless it really happens). Fixes #4930.
* | Merge pull request #4920 from Fred-Barclay/secpol_updateLibravatar netblue302022-02-14
|\ \ | | | | | | Update security policy for 0.9.68 release
| * | Update security policy for 0.9.68 releaseLibravatar Fred Barclay2022-02-09
| | | | | | | | | | | | | | | | | | | | | | | | Additional fixes: Ubuntu 16.04 ais EOL. This means that Firejail 0.9.38 is (to reasonable knowledge) not supported by any mainstream distros. Ubuntu 21.04 is also EOL.
* | | Merge pull request #4943 from ↵Libravatar netblue302022-02-14
|\ \ \ | | | | | | | | | | | | | | | | netblue30/dependabot/github_actions/github/codeql-action-1.1.0 Bump github/codeql-action from 1.0.31 to 1.1.0
| * | | Bump github/codeql-action from 1.0.31 to 1.1.0Libravatar dependabot[bot]2022-02-14
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 1.0.31 to 1.1.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1a927e9307bc11970b2c679922ebc4d03a5bd980...474bbf07f9247ffe1856c6a0f94aeeb10e7afee6) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
* | | Merge pull request #4918 from smitsohu/tests2Libravatar netblue302022-02-09
|\ \ \ | |_|/ |/| | testing: fix expect matching of numbers
| * | testing: fix expect matching of numbersLibravatar smitsohu2022-02-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The sandbox timestamp should not be available for matching when output is already expected from the next command (this is only a problem if numeric output if expected from the first command in the sandbox). A possible alternative would be to flush the expect output buffer with 'expect "*"' after the sandbox is up.
* | | Fix iridium.profileLibravatar rusty-snake2022-02-09
|/ / | | | | | | | | | | 0319fbd enabled whitelisting in /usr/share for iridium but wusc was still ignore causing iridium to crash. Fixes #4917
* | Merge pull request #4915 from kmk3/keepassx-restore-nou2fLibravatar Fred Barclay2022-02-09
|\ \ | |/ |/| keepassx: restore nou2f
| * keepassx: restore nou2fLibravatar Kelvin M. Klann2022-02-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I could not find anything to confirm that keepassx supports hardware keys. And as mentioned by @rusty-snake[1]: > The yubikey support in kpxc seems to be based on > https://github.com/kylemanna/keepassx / > https://github.com/keepassx/keepassx/pull/52 > which was never merged. For me it looks like kpx never got official > support for it. > > keepass seems to support hw keys (via plugin). Also of note is the PR that added yubikey support to keepassxc: https://github.com/keepassxreboot/keepassxc/pull/127 This partially reverts commit 09ac1a73e ("keepass*: remove nou2f", 2022-02-05) / PR #4903. See also commit 91b04172b ("keepass*: fix typo in private-dev note", 2022-02-06). Closes #4883. [1] https://github.com/netblue30/firejail/issues/4883#issuecomment-1031172309
* | fix --disable-private-home compile optionLibravatar netblue302022-02-08
| |
* | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-02-08
|\ \
| * | Refer to firejail.config in configuration files (#4916)Libravatar glitsj162022-02-08
| | | | | | | | | | | | | | | * fix globalcfg help string * fix --disable-globalcfg explanation
* | | fix --private-cwd, issue #4910Libravatar netblue302022-02-08
|/ /
* | Merge pull request #4912 from netblue30/ci_centosLibravatar Reiner Herrmann2022-02-07
|\ \ | | | | | | CI: replace centos (EOL) with almalinux
| * | CI: drop hostnames workaroundLibravatar Reiner Herrmann2022-02-07
| | |
| * | CI: replace centos (EOL) with almalinuxLibravatar Reiner Herrmann2022-02-07
|/ /
* | Merge pull request #4911 from netblue30/ci_changelogLibravatar netblue302022-02-07
|\ \ | | | | | | push changelog date, so that it's different from the previous one
| * | push changelog date, so that it's different from the previous oneLibravatar Reiner Herrmann2022-02-07
| | | | | | | | | | | | otherwise the gitlab CI will complain
* | | Merge pull request #4908 from ↵Libravatar netblue302022-02-07
|\ \ \ | |/ / |/| | | | | | | | netblue30/dependabot/github_actions/github/codeql-action-1.0.31 Bump github/codeql-action from 1.0.30 to 1.0.31
| * | Bump github/codeql-action from 1.0.30 to 1.0.31Libravatar dependabot[bot]2022-02-07
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 1.0.30 to 1.0.31. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8b37404d562d866ad6a65d0ecb4fa5131e047ca4...1a927e9307bc11970b2c679922ebc4d03a5bd980) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | fix private-cwd for hyperrogue - issue 4910 (Debian 11, Mint, UbuntuLibravatar netblue302022-02-07
| |
* | fix profstats installLibravatar netblue302022-02-07
| |
* | update README.mdLibravatar netblue302022-02-07
|/
* keepass*: fix typo in private-dev noteLibravatar Kelvin M. Klann2022-02-06
| | | | | | | s/nou2f/private-dev/ This amends commit 8a718ff4a ("keepass*: note that private-dev blocks access to new hardware keys", 2022-02-05).
* moving to 0.9.69Libravatar netblue302022-02-06
|
* 0.9.68 testing0.9.68Libravatar netblue302022-02-06
|
* rel 0.9.68 testingLibravatar netblue302022-02-06
|
* Merge pull request #4903 from kmk3/keepass-rm-nou2fLibravatar netblue302022-02-06
|\ | | | | keepass*: remove nou2f & add note about private-dev
| * keepass*: note that private-dev blocks access to new hardware keysLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | | | | | Which may be surprising to some users (see #4883). Fixes #4883.
| * keepass*: remove nou2fLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | | | | | | | At least keepassxc supports U2F and password managers seem like they would be a common use case for it. See the discussion on #4883.
* | RELNOTES: add new command checklist and issue template reworkLibravatar Kelvin M. Klann2022-02-06
| | | | | | | | Relates to #4413 #4479 #4515 #4561.
* | RELNOTES: add pr related to PATH_MAX bugfixLibravatar Kelvin M. Klann2022-02-06
| | | | | | | | Relates to #4606.
* | RELNOTES: add AppArmor base abstraction support and disable-proc.incLibravatar Kelvin M. Klann2022-02-06
| | | | | | | | Relates to #3226 #4521 #4628.
* | RELNOTES: add ci section with SHA pinning and dependabotLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | | | | | And move the profile checks item to the ci section. Relates to #2739 #4643 #4774.
* | RELNOTES: add build-related itemsLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | Relates to #4594 #4695 #4712.
* | RELNOTES: add com.github.tchx84.Flatseal profileLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | Relates to #4724.
* | RELNOTES: add pipewire in --nosound and ci profile checksLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | Relates to #2739 #4643 #4855.
* | fix joining of sandboxes without shellLibravatar smitsohu2022-02-06
|/ | | | regressed in c764520b5aa343c00c3a73633511df039645973c
* RELNOTES: add bugfix for symlinks on private-bin + globsLibravatar Kelvin M. Klann2022-02-05
| | | | Relates to #4626.
* RELNOTES: add unset TMP if it doesn't existLibravatar Kelvin M. Klann2022-02-05
| | | | Relates to #4151.
* RELNOTES: add missing issue referencesLibravatar Kelvin M. Klann2022-02-05
| | | | | | | Interestingly, some really old issues were fixed in this release (#408 is from 2016). Relates to #408 #928 #3042.
* Merge pull request #4902 from kmk3/relnotes-organizeLibravatar netblue302022-02-05
|\ | | | | Organize relnotes
| * RELNOTES: add docs and group keeping/dropping modifsLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | Relates to #4078 #4632 #4689 #4725 #4732 #4851.
| * RELNOTES: add prefixes for features, modifs and removalsLibravatar Kelvin M. Klann2022-02-05
| | | | | | | | | | | | | | To make it easier to see at a glance what each item is about. Note: Other than "removal", the prefixes are taken from previous releases.
| * RELNOTES: sort items by categoryLibravatar Kelvin M. Klann2022-02-05
|/ | | | | | | | | | Sort in the following category order: security, features, modifications, removals, bugfixes, new includes, removed includes, new profiles. Also, --keep-fd was added to the RELNOTES after whitelist-ro, so move it there.
* RELNOTES: add allow apostrophe in whitelist and blacklistLibravatar Kelvin M. Klann2022-02-05
| | | | Relates to #4614.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-09 12:53:06 +0000