aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Merge branch 'master' of http://github.com/netblue30/firejailLibravatar netblue302018-04-04
|\
| * bibbletime.profile: add machine-idLibravatar Vincent432018-04-03
| | | | | | It's needed on Archlinux, see https://github.com/netblue30/firejail/issues/1857
* | EUID cleanupLibravatar netblue302018-04-03
| |
* | deprecating --forceLibravatar netblue302018-04-03
|/
* gimp v.2.10 preparationsLibravatar smitsohu2018-04-03
|
* akonadi blacklist additionsLibravatar smitsohu2018-04-03
|
* added --disable-suid to configuration scriptLibravatar netblue302018-04-02
|
* WIP: Blacklist common programming interpreters. (#1837)Libravatar Fred Barclay2018-04-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * Add xreader thumbnailer and previewer profiles * Add xplayer audio-preview and thumbnailer profiles * Add atril thumbnailer and previewer profiles * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * --nodbus, first draft for #1825 * dbus.c * rework akonadi integration the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). * Add nodbus to some profiles - part 1 * Spotify works with nodbus on Arch * Enable nodbus for keepassx and keepassxc profiles. I've tested on keepassxc but should work for keepassx as well. Settings are not immutable. * recalibrate dbus access, deploy nodbus option see #1822 and #1825. also systematically replaces 'blacklist /run/user/*/bus' with 'nodbus'. with contributions from @Fred-Barclay * various blacklist additions * Add a profile for ncdu, enable private-etc in Steam again, and fixup gnome-recipes * comment nodbus where it interferes with dconf pending further discussion * Add a disabled and extensive private-bin for Steam * Further improve private-bin in steam * comment apparmor, net where they interfere with dconf - #1843 * gnome-calculator fixup * spectre support for clang compiler * spectre clang support * enable/disable dbus handling in /etc/firejail/firejail.config * nodbus man pages, etc. * redirect knotes to kmail, some tweaks * testing * gimp fixup * Even more fixups after adding disable-interpreters.inc * AWS and GCP store credentials in local directories as part of project setup. Configuration for cloud providers is sensitive information; it should be in the default block list. I didn't see profiles for gcloud or awscli, so haven't added any exclusions. boto and kubectl are not provider-specific, but also store credentials for whichever platforms they happen to be being used with. * testing * consolidate makefiles * gitignore * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * Cleanup rebase leftovers * imagej doesn't need javac access * Add cc to blacklisted compilers * Use wildcards when blacklisting some gcc paths * Blacklist lua in disable-interpreters * Correct blacklist for node.js * Fred Barclay note: some of these commits (all of the ones that don't affect files inside etc/) aren't mine but were added during a rebase + squash
* musixmatch: fix profileLibravatar Vincent432018-04-02
|
* Merge branch 'master' of http://github.com/netblue30/firejailLibravatar netblue302018-04-02
|\
| * transmission-gtk: disable mdweLibravatar Vincent432018-04-02
| | | | | | Causes freeze during opening file dialog in Archlinux , see issue https://github.com/netblue30/firejail/issues/1855
* | mergesLibravatar netblue302018-04-02
| |
* | mergesLibravatar netblue302018-04-02
|\|
| * mergesLibravatar netblue302018-04-02
| |
| * mergesLibravatar netblue302018-04-02
| |
| * Merge pull request #1854 from melvinvermeeren/masterLibravatar netblue302018-04-02
| |\ | | | | | | add --noautopulse arg for complex pulse setups
| | * add --noautopulse arg for complex pulse setupsLibravatar Melvin Vermeeren2018-04-01
| | | | | | | | | | | | such as remote pulse servers or non-standard socket paths
| * | Merge pull request #1827 from intika/masterLibravatar netblue302018-04-02
| |\ \ | | |/ | |/| Add support for the devil musixmatch
| | * Add support for the devil musixmatchLibravatar intika2018-03-23
| | |
| * | Fix private-lib again (#1852) for evinceLibravatar glitsj162018-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fix private-lib During conversation around an [earlier attempt at fixing evince] (https://github.com/netblue30/firejail/pull/1829) and the entailing [revert-commit](https://github.com/netblue30/firejail/pull/1829/commits/45732a22d1ea4ec0ade0775be7243e8669b7f850) this slipped through the cracks. The fix is tested on Gnome Shell 3.26.2 and 3.28.0 (on Arch). * Remove irrelevant comment on private-lib * Update private-lib comments Done!
| * | mergesLibravatar Fred-Barclay2018-04-01
| | |
| * | Merge pull request #1851 from glitsj16/gnome-calculatorLibravatar Fred Barclay2018-04-01
| |\ \ | | | | | | | | Fix private-lib for gnome-calculator
| | * | Fix the fixLibravatar glitsj162018-04-01
| | | | | | | | | | | | Forgot to take out [libplotinus.so](https://github.com/p-e-w/plotinus). Something I use myself in all GTK apps, but which isn't needed whatsoever for gnome-calculator.
| | * | Fix private-libLibravatar glitsj162018-04-01
| | | | | | | | | | | | This fixes https://github.com/netblue30/firejail/issues/1841.
* | | | testingLibravatar netblue302018-04-01
| | | |
* | | | testing login as nobodyLibravatar netblue302018-04-01
| | | |
* | | | testing sshLibravatar netblue302018-04-01
| | | |
* | | | testingLibravatar netblue302018-04-01
| | | |
* | | | testingLibravatar netblue302018-04-01
|/ / /
* | | mergesLibravatar Tad2018-04-01
| | |
* | | Merge pull request #1849 from jelford/gcloud-profileLibravatar SkewedZeppelin2018-04-01
|\ \ \ | | | | | | | | Added a basic profile for gcloud
| * | | Remove /usr/local from gcloud.profileLibravatar Tad2018-04-01
| | | |
| * | | Added a basic profile for gcloudLibravatar James Elford2018-03-31
| | | | | | | | | | | | | | | | | | | | | | | | gcloud is the Google Cloud Platform's cli. It understands how to interact with GCP's endpoint, and it need to read config and creds from the user's $HOME, plus it integrates with docker-cli
* | | | Merge pull request #1853 from glitsj16/gnome-logsLibravatar SkewedZeppelin2018-04-01
|\ \ \ \ | | | | | | | | | | Create gnome-logs.profile
| * | | | Cleanup gnome-logsLibravatar Tad2018-04-01
| | | | |
| * | | | Fixup gnome-logsLibravatar Tad2018-04-01
| | | | |
| * | | | Create gnome-logs.profileLibravatar glitsj162018-04-01
|/ / / / | | | | | | | | New profile. A few harmless warnings do show, but nothing that doesn't also show without firejail.
* | | | Disable mdwe in bleachbit - fix #1850.Libravatar Fred-Barclay2018-03-31
| | | |
* | | | gitignoreLibravatar netblue302018-03-31
| | | |
* | | | consolidate makefilesLibravatar netblue302018-03-31
| | | |
* | | | testingLibravatar netblue302018-03-31
|/ / /
* | | Merge pull request #1848 from jelford/cloud-providersLibravatar Vincent432018-03-31
|\ \ \ | | | | | | | | Add a section for cloud-providers to the default block-list
| * | | AWS and GCP store credentials in local directories as part of project setup.Libravatar James Elford2018-03-31
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | Configuration for cloud providers is sensitive information; it should be in the default block list. I didn't see profiles for gcloud or awscli, so haven't added any exclusions. boto and kubectl are not provider-specific, but also store credentials for whichever platforms they happen to be being used with.
* | | gimp fixupLibravatar smitsohu2018-03-30
| | |
* | | Merge branch 'master' of http://github.com/netblue30/firejailLibravatar netblue302018-03-30
|\ \ \
| * | | redirect knotes to kmail, some tweaksLibravatar smitsohu2018-03-30
| | | |
* | | | testingLibravatar netblue302018-03-30
|/ / /
* | | nodbus man pages, etc.Libravatar netblue302018-03-30
| | |
* | | enable/disable dbus handling in /etc/firejail/firejail.configLibravatar netblue302018-03-30
| | |
* | | spectre clang supportLibravatar netblue302018-03-30
| | |