| Commit message (Collapse) | Author | Age |
| |
|
| |
|
|\
| |
| | |
add --noautopulse arg for complex pulse setups
|
| |
| |
| |
| | |
such as remote pulse servers or non-standard socket paths
|
|\ \
| |/
|/| |
Add support for the devil musixmatch
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* Fix private-lib
During conversation around an [earlier attempt at fixing evince] (https://github.com/netblue30/firejail/pull/1829) and the entailing [revert-commit](https://github.com/netblue30/firejail/pull/1829/commits/45732a22d1ea4ec0ade0775be7243e8669b7f850) this slipped through the cracks. The fix is tested on Gnome Shell 3.26.2 and 3.28.0 (on Arch).
* Remove irrelevant comment on private-lib
* Update private-lib comments
Done!
|
| | |
|
|\ \
| | |
| | | |
Fix private-lib for gnome-calculator
|
| | |
| | |
| | | |
Forgot to take out [libplotinus.so](https://github.com/p-e-w/plotinus). Something I use myself in all GTK apps, but which isn't needed whatsoever for gnome-calculator.
|
| | |
| | |
| | | |
This fixes https://github.com/netblue30/firejail/issues/1841.
|
| | | |
|
|\ \ \
| | | |
| | | | |
Added a basic profile for gcloud
|
| | | | |
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
gcloud is the Google Cloud Platform's cli. It understands how to
interact with GCP's endpoint, and it need to read config and creds
from the user's $HOME, plus it integrates with docker-cli
|
|\ \ \ \
| | | | |
| | | | | |
Create gnome-logs.profile
|
| | | | | |
|
| | | | | |
|
|/ / / /
| | | |
| | | | |
New profile. A few harmless warnings do show, but nothing that doesn't also show without firejail.
|
| | | | |
|
| | | | |
|
| | | | |
|
|/ / / |
|
|\ \ \
| | | |
| | | | |
Add a section for cloud-providers to the default block-list
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Configuration for cloud providers is sensitive information; it should be
in the default block list. I didn't see profiles for gcloud or awscli,
so haven't added any exclusions.
boto and kubectl are not provider-specific, but also store credentials for
whichever platforms they happen to be being used with.
|
| | | |
|
|\ \ \ |
|
| | | | |
|
|/ / / |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
|\ \ \
| | | |
| | | | |
recalibrate dbus access, deploy nodbus option
|
| |\ \ \
| |/ / /
|/| | | |
|
| | | | |
|
| | | | |
|
| | | |
| | | |
| | | |
| | | | |
gnome-recipes
|
| | | | |
|
| | | | |
|
| | | |
| | | |
| | | |
| | | | |
pending further discussion
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | | |
see #1822 and #1825. also systematically replaces
'blacklist /run/user/*/bus' with 'nodbus'.
with contributions from @Fred-Barclay
|
| | |
| | |
| | |
| | | |
I've tested on keepassxc but should work for keepassx as well. Settings are not immutable.
|
| | | |
|
|/ / |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and
debian testing (and probably opensuse), doesn't play well with a number of firejail options.
the reason for this is that once the no_new_privs bit is set, apparmor profile
transitions are forbidden.
enforcing our own apparmor policy instead is also no solution, because
these programs don't even start without d-bus.
relaxing the kmail profile was necessary so that kmail can fire up akonadi itself,
just in case akonadi has not been started earlier already by another program.
this is always an issue when kmail is the only installed akonadi client, but
there may be more circumstances. for reasons outlined above this doesn't help
debian and ubuntu (opensuse?) users though :-/
a brief summary of the seccomp exceptions: chroot is needed for qt webengine,
io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup
are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions
to the seccomp filter are necessary, but mysqld is the default.
in the future all kontact suite profiles (itm only kmail, knotes) should
probably be redirections to akonadi_control, but the issues with apparmor
make this somewhat impractical for now (options like 'protocol' couldn't go to
akonadi_control.local any more, if current kmail redirected to there).
|
| | |
|
| | |
|
| | |
|