aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Run dhclient inside the sandboxLibravatar Kristóf Marussy2019-12-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * In order to ensure that network interfaces are already configured when the sandboxed launches, we run dhclient in forking mode (no -d switch), which makes the dhclient command exit when it successfully acquired a lease. The dhclient daemon process keeps running in the background. * We read the pid file for dhclient to find out the pid of the daemon process. Because dhclient only writes the pid file in the child process potentially after the forking parent process exits, there is some handling for possible race conditions. * All lease files and pid files are under /run/firejail/dhclient/ * The v4 and v6 dhclient has a separate lease as recommended. * The v4 client is set to generate a DUID, which is also used by the v6 client so that the server can associate the two leases if needed. * /etc/resolv.conf is created in the sandbox just like with the --dns option, by mirroring /etc. When DHCP is used, /etc/resolv.conf is normally empty so that dhclient can overwrite it the nameservers from the DHCP server. Current limitations: * The dhclient processes in the background are not terminated properly (by SIGTERM or dhclient -x), nor is the DHCP lease released (by dclient -r). The reason for this is that firejail drops all capabilities and privileges before the application in the sandbox is launched, which makes it impossible to launch dhclient to release the lease or kill the dhclient processes still running with the effective user id of root. Instead the dhclient daemons die with the sandbox. According to the dhclient man page, releasing the lease is not required by the DHCP specification, so this is not a problem, however some ISPs may require releasing leases. A possible workaround would be to fork another process upon sandbox initialization that invokes dhclient -r when the sandbox is ready to exit. This would require communication with the main firejail process through a pipe, while keeping and required privileges. As this would add some complexity but the benefits have limited applicability (compatibility with esoteric DHCP server configurations), I chose not to implement this. * When only an IPv6 address is requested, the interface may possible not have a link-local address when we run dhclient. This causes dhclient -6 fail, since DHCPv6 uses link-local addressing instead of layer 2 addressing, see e.g., https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783387 In a future commit, waiting for a link-local address will be added.
* Add capability filter for network services, additive filterLibravatar Kristóf Marussy2019-12-30
| | | | | | | | | | | The new capability filter SBOX_CAPS_NET_SERVICE allows forked processes to bind to low ports (privileged network services). Because dhcp clients require both low ports and network administration privileges, this patch also allows (bitwise) combination of capability filters (except SBOX_CAPS_NONE, which completely drops any capabilities) to grant both SBOX_CAPS_NETWORK and SBOX_CAPS_NET_SERVICE to a dhcp client. This way, fnet and fnetfilter calls still do not get CAP_NET_BIND_SERVICE.
* Add sbox_run_v to run programs with explicit argument listsLibravatar Kristóf Marussy2019-12-30
| | | | | | | Refactored sbox_run to pass the varargs argument list as an array to an auxiliary function. The auxiliary function allows running programs with dynamically built argument lists.
* Allow resolv.conf be written by dhclientLibravatar Kristóf Marussy2019-12-30
| | | | | | | | | | | When dhclient is used to assign and IP to the container, it should be able to overwrite resolv.conf Therefore, we do the /etc mirroring similarly to the situation with manually configured nameservers. When both DHCP and manually set nameservers are in use, warn that the manual ones will be overwritten
* Do not try to set up default gateway without an IP addressLibravatar Kristóf Marussy2019-12-30
| | | | | | | If the container has no IP address (because it will be assigned via DHCP later), setting up a default route fails with a warning message. While this is harmless, the default route should be omitted instead.
* Add --ip=dhcp and --ip6=dhcp optionsLibravatar Kristóf Marussy2019-12-30
| | | | | Currently, --ip=dhcp is equivalent to --ip=none and --ip6=dhcp does nothing either, except for parsing correctly
* Harden file-rollerLibravatar rusty-snake2019-12-29
|
* disable-devel: blacklist source-codeLibravatar rusty-snake2019-12-29
|
* Add appimage fix to electrum.profileLibravatar glitsj162019-12-29
|
* Merge pull request #3097 from glitsj16/firecfgLibravatar netblue302019-12-26
|\ | | | | Drop CLI archivers from firecfg
| * Drop CLI archivers from firecfgLibravatar glitsj162019-12-26
| | | | | | More research/testing is needed to make CLI-based archivers work on Arch (based distributions). See ongoing discussion in #3095.
* | Update private-bin in tar.profileLibravatar glitsj162019-12-26
| |
* | Add login.defs to private-etcLibravatar glitsj162019-12-26
|/
* Merge pull request #3093 from smitsohu/joinLibravatar smitsohu2019-12-25
|\ | | | | add join timeout and make it configurable
| * let is_ready_for_join() return a booleanLibravatar smitsohu2019-12-23
| |
| * simplify join timeoutLibravatar smitsohu2019-12-23
| |
| * cleanupLibravatar smitsohu2019-12-23
| |
| * make join timeout configurable in firejail.configLibravatar smitsohu2019-12-23
| |
| * let join wait if target sandbox is not ready yetLibravatar smitsohu2019-12-23
| | | | | | | | fixes #2139
| * move invalid_sandbox function to join moduleLibravatar smitsohu2019-12-22
| |
* | Fix private-lib in gconf.profileLibravatar glitsj162019-12-25
| |
* | Update description in p7zip.profileLibravatar glitsj162019-12-24
| |
* | Add decription in 7zr.profileLibravatar glitsj162019-12-24
| |
* | Add description in 7za.profileLibravatar glitsj162019-12-24
| |
* | Add description in 7z.profileLibravatar glitsj162019-12-24
| |
* | Add ephemeral profile (#3094)Libravatar glitsj162019-12-23
| | | | | | | | | | | | | | | | * Create ephemeral.profile * Add ephemeral.profile * Add ephemeral.profile
* | Fix comments in thunderbird.profileLibravatar glitsj162019-12-21
| |
* | Add gfeeds.profileLibravatar rusty-snake2019-12-20
| |
* | add publicsuffix to wuscLibravatar rusty-snake2019-12-20
| |
* | Fix Brave's native sandbox (#3087)Libravatar glitsj162019-12-19
| | | | | | | | | | | | | | | | | | | | * Allow user access to /proc/config.gz * Fix Brave's native sandbox * Move /proc/config.gz to disable-common.inc * Move /proc/config.gz to disable-common.inc
* | Fix private-etc ordering in seahorse-toolLibravatar glitsj162019-12-19
| |
* | Create gtk-update-icon-cache.profileLibravatar rusty-snake2019-12-19
| |
* | fix seahorse-toolLibravatar rusty-snake2019-12-19
| |
* | Update baobab.profileLibravatar rusty-snake2019-12-19
| |
* | Update disable-programs.incLibravatar glitsj162019-12-19
| |
* | Update brave.profileLibravatar glitsj162019-12-19
| |
* | Add brave redirect profiles (#3088)Libravatar glitsj162019-12-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add more brave redirects to firecfg.config These redirects are found on Debian/Ubuntu when enabling the official Brave repositories cfr. https://brave-browser.readthedocs.io/en/latest/installing-brave.html#linux * Create brave-browser-beta.profile * Create brave-browser-dev.profile * Create brave-browser-nightly.profile * Create brave-browser-stable.profile
* | Fix description ordering in brave.profileLibravatar glitsj162019-12-16
| |
* | Add gzip redirect profiles (#3083)Libravatar glitsj162019-12-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Create gzexe.profile * Create uncompress.profile * Create zcat.profile * Create zcmp.profile * Create zdiff.profile * Create zegrep.profile * Create zfgrep.profile * Create zforce.profile * Create zgrep.profile * Create zless.profile * Create zmore.profile * Create znew.profile
* | Fix ordering of 'RESTRICTED SHELL'Libravatar glitsj162019-12-15
| |
* | postmortem: playing aroundLibravatar netblue302019-12-15
| |
* | small fixLibravatar netblue302019-12-15
| |
* | spellingLibravatar netblue302019-12-14
| |
* | new release branchLibravatar netblue302019-12-14
| |
* | Fix --appimage on linux 5.4.x kernelLibravatar glitsj162019-12-14
| | | | | | Fixes #3068.
* | wine: enable allow-debuggers by default - #446Libravatar smitsohu2019-12-11
| |
* | little thingsLibravatar smitsohu2019-12-11
| |
* | gpg additions (#3077)Libravatar glitsj162019-12-10
| | | | | | | | | | | | | | | | * Add 'quiet' to gpg.profile * Add 'quiet' to gpg-agent.profile * Create gpg2.profile
* | tentative fix for #3075Libravatar netblue302019-12-08
| |
* | Fix DeVeDe-NG exportLibravatar rusty-snake2019-12-06
| | | | | | | | It is better to comment wusc in ffmpeg?
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-19 20:21:04 +0000