aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
| * | Improve whitelisting and dbus of Sylpheed and Claws-mailLibravatar bbhtt2020-12-31
| | |
| * | Add folks cache directoryLibravatar bbhtt2020-12-29
| | |
| * | Fix python; add read-only to editors/cli browsers;re-add cache directoryLibravatar bbhtt2020-12-29
| | |
| * | Add Evolution and folks directories coming from evolution data server common ↵Libravatar bbhtt2020-12-29
| | | | | | | | | | | | to both geary and evolution; add dbus permissions fromflatpak
| * | Add neomutt to firefg.configLibravatar bbhtt2020-12-28
| | |
| * | Add whitelisting to mutt; improve geary, new profile for neomuttLibravatar bbhtt2020-12-28
| | |
* | | Merge pull request #3322 from topimiettinen/filter-environment-variablesLibravatar netblue302021-02-09
|\ \ \ | | | | | | | | Filter environment variables
| * | | Filter environment variablesLibravatar Topi Miettinen2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Save all environment variables for later use in the application, clear environment and re-apply only whitelisted variables for the main firejail process. The whitelisted environment is only used by C library. Sandboxed tools will get further variables used internally (FIREJAIL_*). All variables will be reapplied for the firejailed application. This also lifts the length restriction for environment variables, except for the variables used by Firejail itself or the sandboxed tools.
* | | | bump RELNOTES date to fix CILibravatar Reiner Herrmann2021-02-09
| | | |
* | | | Housekeeping: strip extra whitespaceLibravatar Fred Barclay2021-02-08
| | | | | | | | | | | | | | | | | | | | Just `find . -not \( -name .git -prune -o -name *.AppImage -prune \) -type f -print0 | xargs -0 perl -pi -e 's/ +$//'` and filter to avoid unwanted changes (especially .md files)
* | | | Merge pull request #3961 from kmk3/fix-macro-usageLibravatar glitsj162021-02-08
|\ \ \ \ | | | | | | | | | | etc: use ${DOCUMENTS} macro where appropriate
| * | | | etc: use ${DOCUMENTS} macro where appropriateLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, some paths are hard-coded: $ grep -Fnr '${HOME}/Documents' etc etc-fixes etc/profile-m-z/Mathematica.profile:19:mkdir ${HOME}/Documents/Wolfram Mathematica etc/profile-m-z/Mathematica.profile:22:whitelist ${HOME}/Documents/Wolfram Mathematica etc/profile-a-l/keepassxc.profile:34:# If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx etc/profile-a-l/keepassxc.profile:35:#mkdir ${HOME}/Documents/KeePassXC etc/profile-a-l/keepassxc.profile:36:#whitelist ${HOME}/Documents/KeePassXC Commands used to search and replace: $ find etc etc-fixes/ -type f -exec \ sed -i.bak -e 's|\${HOME}/Documents|${DOCUMENTS}|' '{}' + Related to that, the (lack of) usage of ${DOWNLOADS} has been recently fixed on commit deae31301 ("use ${DOWNLOADS} in lutris.profile (#3955)"). With the above change, all macros other than ${DOCUMENTS} seem to be already used appropriately: $ grep -Fnr '${HOME}/Desktop' etc etc-fixes $ grep -Fnr '${HOME}/Downloads' etc etc-fixes $ grep -Fnr '${HOME}/Music' etc etc-fixes $ grep -Fnr '${HOME}/Pictures' etc etc-fixes $ grep -Fnr '${HOME}/Videos' etc etc-fixes See src/firejail/macros.c for details.
* | | | | merge 0.9.64.4 RELNOTESLibravatar Reiner Herrmann2021-02-08
|/ / / /
* | | | archivers: wrap commentsLibravatar Kelvin M. Klann2021-02-08
| | | |
* | | | archivers: move archiver-common.inc include to the bottomLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | And mark it as a redirect profile. This is done so when including other *-common.inc profiles, such as firefox-common.profile.
* | | | formatingLibravatar netblue302021-02-08
| | | |
* | | | security advisoryLibravatar netblue302021-02-08
|/ / /
* | | use ${DOWNLOADS} in lutris.profile (#3955)Libravatar glitsj162021-02-07
| | |
* | | Add profile for Gemini (#3946)Libravatar Neo000012021-02-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Update disable-programs.inc * Create calligragemini.profile * Update calligra.profile * Update calligra.profile * Update firecfg.config
* | | Merge pull request #3950 from kmk3/di-fixesLibravatar rusty-snake2021-02-07
|\ \ \ | | | | | | | | disable-interpreters.inc: blacklist the other libmozjs
| * | | disable-interpreters.inc: blacklist the other libmozjsLibravatar Kelvin M. Klann2021-02-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And sort the paths on allow-gjs.inc. $ pacman -Q js78 js78 78.6.0-1 $ pacman -Qlq js78 | grep -v /usr/include/ /usr/ /usr/bin/ /usr/bin/js78 /usr/bin/js78-config /usr/lib/ /usr/lib/libmozjs-78.so /usr/lib/pkgconfig/ /usr/lib/pkgconfig/mozjs-78.pc This appears to be the only counterpart path missing when looking at the current lib64 entries with: $ grep -Fnr lib64 etc
| * | | disable-interpreters.inc: sort pathsLibravatar Kelvin M. Klann2021-02-06
| | | |
* | | | disabled overlayfs, fixes pending; added video channels to README* filesLibravatar netblue302021-02-06
|/ / /
* | | add a /usr/share whitelist item for uimLibravatar Anton Shestakov2021-02-05
| | | | | | | | | uim is a multilingual input method framework, so any program that takes user input potentially needs it to work.
* | | fixup! Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | | | | | | | | | damn, forgotten to add
* | | Update spectacle.profileLibravatar Neo000012021-02-04
| | |
* | | Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | | | | | | | | | | | | | | | blacklist ${HOME}/.vwmare is already in disable-programs.inc I did not add it to firecfg.config because it has many extra features such as usb-redirection that I could not test.
* | | tests: check with faudit if tests are run sandboxedLibravatar Reiner Herrmann2021-02-03
| | |
* | | Add Github Actions badgesLibravatar Fred Barclay2021-02-02
| | |
* | | Update support/security info for release 0.9.64Libravatar Fred Barclay2021-02-02
| | |
* | | keepassxc: allow all browser, not just firefoxLibravatar rusty-snake2021-02-02
| | | | | | | | | | | | ungoogled-chromium won't work with keepassxc (#3941)
* | | Seccomp error action fixesLibravatar Topi Miettinen2021-02-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fsec-optimize: Optimize BPF with current seccomp error action, not just KILL fseccomp: use correct BPF code for errno action firejail: honor seccomp error action for X32 and secondary filters, rebuild filters if the error action is changed Closes: #3933 Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* | | Add profile for avidemux (#3935)Libravatar Neo000012021-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Update disable-programs.inc * Update disable-programs.inc * Update firecfg.config * Create avidemux.profile * Update avidemux.profile
* | | build: clean generated test/MakefileLibravatar Reiner Herrmann2021-01-31
| | |
* | | tests: increase shutdown timeout a bitLibravatar Reiner Herrmann2021-01-31
| | | | | | | | | | | | in Debian CI and during local tests I ran into the timeout
* | | Merge pull request #3936 from irandms/fix-firecfg-man-typoLibravatar rusty-snake2021-01-31
|\ \ \ | | | | | | | | Fix minor typo in firecfg's manual page
| * | | Fix minor typo in firecfg's manual pageLibravatar irandms2021-01-31
|/ / /
* | | Disable the webkit2gtk-4.0 sandbox in bijibenLibravatar rusty-snake2021-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | webkit2gtk uses a bwrap based sandbox by default since 4.0, see #3647. This is good as it means more security by default on for linux system. Unfortunately is it not possible to run bwrap inside firejail if bwrap is started with --unshare-pid --proc /proc at all. In general we should exclude a program from firecfg until a final solution is found. But bijiben is special, while epiphany or evolution display random stuff from the internet is webkit2gtk in bijiben used to display local files create by the user. Bijiben has a thight profile (net none, whitelist, private-bin, ...) therefore my decision here was to disable the webkit2gtk sandbox rather then firejail.
* | | add quiet to lzdiff/lzmadec (#3932)Libravatar glitsj162021-01-30
| | | | | | | | | | | | | | | * add quiet to lzdiff * add quiet to lzmadec
* | | Merge pull request #3931 from glitsj16/follow-up-3914Libravatar glitsj162021-01-30
|\ \ \ | | | | | | | | follow-up fixes for #3914
| * | | follow-up fixes for ↵Libravatar glitsj162021-01-29
| | | | | | | | | | | | | | | | https://github.com/netblue30/firejail/commit/43aa71f8c608ec5bd92fd2c7323c603fa37f6d30
* | | | tests: improve check for sound capabilities (#3929)Libravatar Reiner Herrmann2021-01-30
| | | | | | | | | | | | Fixes: #3928
* | | | Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ \ \ \ | | | | | | | | | | ssh: Refactor, fix bugs & harden
| * | | | disable-common.inc: add missing openssh pathsLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The paths are taken from ssh(1) and sshd(8). $ pacman -Q openssh openssh 8.4p1-2 These are only used by sshd(8), so always blacklist them: * ~/.rhosts: controls remote access to the local machine * ~/.shosts: same as above * ~/.ssh/authorized_keys: same as above * ~/.ssh/authorized_keys2: same as above * ~/.ssh/environment: potentially allows arbitrary command execution on the local machine * ~/.ssh/rc: allows arbitrary command execution on the local machine * /etc/hosts.equiv: system-wide equivalent of ~/.rhosts Note: There are files in /etc/ssh that are equivalent to some of the above ones, but they are already blocked by `blacklist /etc/ssh/*`. Note2: From sshd(8): > If the file ~/.ssh/rc exists, sh(1) runs it after reading the > environment files but before starting the user's shell or command. So even if the user shell is set to /usr/bin/firejail and disable-common.inc is loaded, this patch shouldn't interfere with sshd. This file is actually used by ssh(1), so just mark it read-only: * ~/.ssh/config: allows arbitrary command execution on the remote machine (with e.g.: RemoteCommand) and also defines the connection strength Since version 7.3p1 (released on 2016-08-01), openssh supports including other config files on ssh_config(5)[1][2]. This is the conventional path for storing them[3], so mark it read-only: * ~/.ssh/config.d: same as above P.S. See also the explanation on the commit b5542fc94 ("disable-common.inc: read-only access to ~/.ssh/authorized_keys"), which last touched/added the "Remote access" section. [1]: https://anongit.mindrot.org/openssh.git/commit/?id=dc7990be865450574c7940c9880567f5d2555b37 [2]: https://www.openssh.com/txt/release-7.3 [3]: https://superuser.com/a/1142813
| * | | | allow-ssh.inc: allow access to ssh-agent(1)Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Leaving it limited to only ssh, ssh-agent and seahorse by default seems unnecessarily restrictive. From ssh(1): > The most convenient way to use public key or certificate > authentication may be with an authentication agent. See ssh-agent(1) > and (optionally) the AddKeysToAgent directive in ssh_config(5) for > more information. $ pacman -Q openssh openssh 8.4p1-2 With ssh-agent(1) running in the background (and with the private key(s) loaded through ssh-add(1)), ssh(1) doesn't need direct access to the actual key pair(s), so you could probably get away with this on allow-ssh.local: ignore noblacklist ${HOME}/.ssh noblacklist ${HOME}/.ssh/config noblacklist ${HOME}/.ssh/config.d noblacklist ${HOME}/.ssh/known_hosts And then this on the profiles of ssh key pair managers, such as seahorse.local: noblacklist ${HOME}/.ssh
| * | | | ssh: deny access to the rest of /etc/ssh/*Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ssh_config (allowed on allow-ssh.inc) is the only file in /etc/ssh that is used by ssh(1). The other paths are only used by sshd(8), so stop allowing them on ssh.profile and ssh-agent.profile. Path examples from sshd(8): * /etc/ssh/moduli * /etc/ssh/ssh_host_ecdsa_key * /etc/ssh/ssh_host_ecdsa_key.pub * /etc/ssh/ssh_known_hosts * /etc/ssh/sshd_config * /etc/ssh/sshrc $ pacman -Q openssh openssh 8.4p1-2
| * | | | allow-ssh.inc: allow /etc/ssh/ssh_configLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the system-wide equivalent of ~/.ssh/config. $ pacman -Q openssh openssh 8.4p1-2 Reasons for blacklisting both /etc/ssh and /etc/ssh/* on disable-common.inc: Leave /etc/ssh that way so that profiles without allow-ssh.inc remain unable to see inside of /etc/ssh. And blacklist /etc/ssh/* so that profiles with allow-ssh.inc are able to access only nonblacklisted files inside of /etc/ssh.
| * | | | etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
| * | | | git-cola.profile: add missing python template commentLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | See etc/templates/profile.template.
| * | | | ssh: move auth socket blacklist to disable-common.incLibravatar Kelvin M. Klann2021-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | That was added on the commit e93fbf3bd ("disable ssh-agent sockets in disable-programs.inc"). Currently, it's the only ssh-related entry on disable-programs.inc. Further, it seems that all the other socket blacklists live on disable-common.inc. Also, even though this socket does not necessarily allow arbitrary command execution on the local machine (like some paths on disable-common.inc do), it could still do so for remote systems. Put it above the "top secret" section, like the terminal sockets are above the terminal server section.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 17:31:00 +0000