aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* RELNOTES: add profile itemsLibravatar Kelvin M. Klann2024-04-05
| | | | Relates to #6298 #6299 #6300.
* profiles: clarify and add opengl-game to profile.template (#6300)Libravatar Kelvin M. Klann2024-04-05
| | | | | | | | | | | | | | | To make it consistent with the other include profiles. See etc/templates/profile.template. With this, all `etc/inc/allow-*` files are listed in profile.template. The explanation is based on a comment by @rusty-snake[1]. Relates to #4071. This is a follow-up to #6299. [1] https://github.com/netblue30/firejail/pull/4071#issuecomment-822003473
* profiles: add allow-php.inc to profile.template (#6299)Libravatar Kelvin M. Klann2024-04-03
| | | | | | | | | | | To make it consistent with the other include profiles. See etc/templates/profile.template. Note: It is not currently included in any profile. Added on commit 89f30f1f2 ("Create allow-php.inc", 2020-01-25). This is a follow-up to #6298.
* profiles: add allow-nodejs.inc to profile.template (#6298)Libravatar Kelvin M. Klann2024-03-30
| | | | | | | To make it consistent with the other include profiles. See etc/templates/profile.template. Relates to #3866 #5881.
* RELNOTES: move bugfix item into profilesLibravatar Kelvin M. Klann2024-03-30
| | | | Relates to #5601 #5618.
* RELNOTES: add bugfix and profile itemsLibravatar Kelvin M. Klann2024-03-28
| | | | Relates to #5717 #6049 #6051 #6052.
* RELNOTES: add modif and ci itemsLibravatar Kelvin M. Klann2024-03-28
| | | | Relates to #5953 #5957.
* RELNOTES: add profile itemsLibravatar Kelvin M. Klann2024-03-27
| | | | Relates to #6289 #6294.
* pkglog: hardening (x11) (#6292)Libravatar glitsj162024-03-27
|
* New profile: gh (GitHub CLI) (#6293)Libravatar glitsj162024-03-27
| | | | | Description: GitHub's official command-line tool. https://github.com/cli/cli
* profiles: rename disable-X11.inc to disable-x11.inc (#6294)Libravatar Kelvin M. Klann2024-03-27
| | | | | | | | | | | | | | | | | | | | | That is, make "X11" lowercase so that the order of the includes in the disable- section remain the same when sorted with `LC_ALL=C`, as is the case for most of the other sections. That is also likely to be the default in text editors (such as in vim on Arch), so this should make the disable- section more consistent and easier to sort when editing the profile. Also, keep the old include as a redirect to the new one for now to avoid breakage. Commands used to search and replace: git mv etc/inc/disable-X11.inc etc/inc/disable-x11.inc git grep -Ilz 'disable-X11' -- etc | xargs -0 \ perl -pi -e 's/disable-X11/disable-x11/' Relates to #4462 #4854 #6070 #6289. This is a follow-up to #6286.
* profiles: sort blacklist sections (#6289)Libravatar Kelvin M. Klann2024-03-27
| | | | | See etc/templates/profile.template. This is a follow-up to #6286.
* RELNOTES: add many profile itemsLibravatar Kelvin M. Klann2024-03-25
| | | | Relates to #5686 #5700 #5702 #5735 #5763 #5794 #5946 #6218.
* RELNOTES: add build and profile itemsLibravatar Kelvin M. Klann2024-03-25
| | | | Relates to #6257 #6282 #6283 #6286 #6290.
* build: sort.py: add and require -i to edit in-place (#6290)Libravatar Kelvin M. Klann2024-03-25
| | | | | | | | | | Similarly to `sed -i` and `perl -i`. This allows checking if sort.py correctly sorts the relevant lines in a profile without having to overwrite it, which makes debugging and testing easier (for example, in #6261). Note: If it finds items that are not sorted, it still sorts them, prints the diff and returns an error.
* New profile: qemu-common.profile (#6287)Libravatar Kelvin M. Klann2024-03-25
| | | | | | Add a common profile to deduplicate entries and make qemu-related profiles redirect to it. Relates to #6255.
* build(deps): bump github/codeql-action from 3.24.7 to 3.24.9Libravatar dependabot[bot]2024-03-25
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.24.7 to 3.24.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/3ab4101902695724f9365a384f86c1074d94e18c...1b1aada464948af03b950897e5eb522f92603cc2) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* firefox: Add org.kde.kdeconnect to plasma integration comment (#6285)Libravatar RundownRhino2024-03-24
| | | | | | | I recently set up KDE connect and plasma-browser-integration for firefox (Linux Mint 21.2) and needed this line in addition to the ones mentioned in the profile. Found it via running `firejail --profile=/etc/firejail/firefox.profile --dbus-user.log firefox`, trying to send links to device, and seeing what events get logged.
* Merge pull request #6286 from kmk3/x11-none-improvementsLibravatar Kelvin M. Klann2024-03-24
|\ | | | | profiles: replace x11 socket blacklist with disable-X11.inc
| * profiles: replace x11 socket blacklist with disable-X11.incLibravatar Kelvin M. Klann2024-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace all occurrences of `blacklist /tmp/.X11-unix` with `include disable-X11.inc`, which blacklists more X11-related files. Commands used to search and replace: $ git grep -Ilz '^blacklist /tmp/.X11-unix' -- \ etc/profile*/*.profile | xargs -0 perl -0 -pi -e '\ s/\nblacklist \/tmp\/.X11-unix\n/\n/; \ s/(\ninclude disable-xdg.inc\n)/\ninclude disable-X11.inc$1/; \ s/(\ninclude disable-[^Xx\n]+\n)(\n|# )/$1include disable-X11.inc\n$2/' Note: The following files were also edited manually: * etc/profile-a-l/erd.profile * etc/profile-a-l/links-common.profile * etc/profile-m-z/termshark.profile * etc/profile-m-z/tmux.profile * etc/profile-m-z/tshark.profile Relates to #4462 #4854.
| * sstmp.profile: sort disable includesLibravatar Kelvin M. Klann2024-03-23
| | | | | | | | | | | | | | Move disable-X11.inc before disable-xdg.inc for consistency with other profiles. Added on commit 73a6fced2 ("New profile: ssmtp (#5544)", 2022-12-21).
* | profiles: deny access to ~/.config/autostart (#6257)Libravatar Kelvin M. Klann2024-03-24
|/ | | | | | | | | | The files in this directory are intended to be automatically executed when the user logs in. In which case, granting write access to this directory allows the program to easily escape the sandbox (by autostarting itself outside of firejail, for example). Misc: This was noticed on #6244.
* gconf-editor: remove X11 socket blacklistLibravatar Kelvin M. Klann2024-03-23
| | | | | | | | | | It is a GUI program. It was apparently added by accident on commit 73321c597 ("Fixes (#2816)", 2019-07-01). Reported by @glitsj16 at https://github.com/netblue30/firejail/pull/6286#discussion_r1536618241
* New profile: tqemu.profile (#6255)Libravatar glitsj162024-03-23
| | | | | Description: QEMU frontend without libvirt. https://github.com/thanoulis/tqemu
* k3b.profile: fix dvd drive detection (private-dev) (#6280)Libravatar Kelvin M. Klann2024-03-23
| | | | | | | | | | @hedgehog29 commented[1]: > It prevents k3b from detecting all dvd drives, incudling USB ones, and > it seems that also SATA. Fixes #6279. [1] https://github.com/netblue30/firejail/issues/6279#issue-2191392448
* New profile: metadata-cleaner.profile (#6246)Libravatar glitsj162024-03-20
| | | | | | Description: Python GTK3 application to view and clean metadata in files, using mat2. https://gitlab.com/rmnvgr/metadata-cleaner
* remove porn-cli.profile (#6284)Libravatar pirate4867431862024-03-20
| | | Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* build: fix "warning: "_FORTIFY_SOURCE" redefined" (#6283)Libravatar Kelvin M. Klann2024-03-20
| | | | | | | | | | | | | | | | | | | | | | | | | | The warning is being produced on Arch since pacman 6.1, which changed `-D_FORTIFY_SOURCE=2` to `-D_FORTIFY_SOURCE=3` in CFLAGS in makepkg.conf: $ pacman -Q gcc pacman gcc 13.2.1-5 pacman 6.1.0-3 $ makepkg [...] make -C src/lib gcc [...] -D_FORTIFY_SOURCE=2 [...] -Wp,-D_FORTIFY_SOURCE=3 [...] -c ../../src/lib/common.c -o ../../src/lib/common.o <command-line>: warning: "_FORTIFY_SOURCE" redefined <command-line>: note: this is the location of the previous definition To fix this, only add `-D_FORTIFY_SOURCE` to EXTRA_CFLAGS if it does not cause any warnings with CFLAGS and CPPFLAGS during compilation. The effect remains the same: The build system still defines the macro by default (if there are no warnings) and the user/distribution can still override it through CFLAGS/CPPFLAGS. Fixes #6282. Reported-by: @glitsj16
* Rename etc/session-desktop.profile to etc/profile-m-z/session-desktop.profileLibravatar glitsj162024-03-19
|
* New profile: session-desktop.profile (#6259)Libravatar glitsj162024-03-19
| | | | | | | | | | Description: Encrypted messenger. https://github.com/oxen-io/session-desktop/ https://aur.archlinux.org/packages/session-desktop https://aur.archlinux.org/packages/session-desktop-bin https://aur.archlinux.org/packages/session-desktop-appimage Note: The AUR packages all work with the profiles.
* New profile: mimetype.profile (#6247)Libravatar glitsj162024-03-19
| | | | | | Description: Determines the file type. https://metacpan.org/release/File-MimeInfo https://archlinux.org/packages/extra/any/perl-file-mimeinfo/
* New profile: tvnamer.profile (#6256)Libravatar glitsj162024-03-18
| | | | | Description: Automatic TV episode file renamer. https://github.com/dbr/tvnamer
* New profile: textroom.profile (#6254)Libravatar glitsj162024-03-18
| | | | | | | Description: Full Screen text editor heavily inspired by Q10 and JDarkRoom. https://code.google.com/p/textroom/ https://aur.archlinux.org/packages/textroom
* New profile: rymdport.profile (#6251)Libravatar glitsj162024-03-18
| | | | | | Description: Encrypted sharing of files, folders, and text between devices. https://github.com/Jacalz/rymdport
* New profile: localsend_app.profile (#6244)Libravatar glitsj162024-03-18
| | | | | Description: An open source cross-platform alternative to AirDrop. https://github.com/localsend/localsend
* New profile: editorconfiger.profile (#6235)Libravatar glitsj162024-03-18
| | | | | | | Description: Plain tool to validate and compare .editorconfig files. https://github.com/aegoroff/editorconfiger https://aur.archlinux.org/packages/editorconfiger https://aur.archlinux.org/packages/editorconfiger-bin
* build(deps): bump github/codeql-action from 3.24.6 to 3.24.7Libravatar dependabot[bot]2024-03-18
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.24.6 to 3.24.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8a470fddafa5cbb6266ee11b37ef4d8aae19c571...3ab4101902695724f9365a384f86c1074d94e18c) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump actions/checkout from 4.1.1 to 4.1.2Libravatar dependabot[bot]2024-03-18
| | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 4.1.2. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/b4ffde65f46336ab88eb53be808477a3936bae11...9bb56186c3b09b4f86b1c65136769dd318469633) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* New profile: koreader.profile (#6243)Libravatar glitsj162024-03-16
| | | | | Description: Ebook reader application. https://koreader.rocks/
* New profile: dexios.profile (#6234)Libravatar glitsj162024-03-16
| | | | | | Description: CLI encryption tool https://github.com/brxken128/dexios https://aur.archlinux.org/packages/dexios-bin
* firejail-local: be less restrictive with torbrowser-launcherLibravatar glitsj162024-03-16
| | | Cfr. https://github.com/netblue30/firejail/issues/6269#issuecomment-2002021790.
* New profile: deadlink.profile (#6233)Libravatar glitsj162024-03-15
| | | | | | Description: Checks and fixes URLs in code and documentation. https://github.com/nschloe/deadlink https://aur.archlinux.org/packages/deadlink
* New profile: cloneit (#6232)Libravatar glitsj162024-03-15
| | | | | | | | Description: A CLI tool to download specific GitHub directories or files. https://github.com/alok8bb/cloneit https://aur.archlinux.org/packages/cloneit-git
* New profile: statusof.profile (#6253)Libravatar glitsj162024-03-14
| | | | | Description: Python script to check the status of a list of URLs. https://github.com/Arthurdw/statusof
* New profile: lyriek.profile (#6245)Libravatar glitsj162024-03-14
| | | | | | Description: A multi-threaded GTK application to fetch lyrics of currently playing songs. https://gitlab.com/bartwillems/lyriek
* New profile: erd.profile (#6236)Libravatar glitsj162024-03-14
| | | | | | | | | | Description: Multi-threaded file-tree visualizer and disk usage analyzer. https://github.com/solidiquis/erdtree https://archlinux.org/packages/extra/x86_64/erdtree/ Note: The repo and package are called `erdtree`, but the executable is `erd`.
* New profile: bpftop.profile (#6231)Libravatar glitsj162024-03-14
| | | | | | | | Description: Dynamic real-time view of running eBPF programs. https://github.com/Netflix/bpftop https://aur.archlinux.org/packages/bpftop https://aur.archlinux.org/packages/bpftop-bin https://aur.archlinux.org/packages/bpftop-git
* RELNOTES: add feature and build itemsLibravatar Kelvin M. Klann2024-03-14
| | | | Relates to #6260 #6261 #6268.
* docs: firecfg: note different .desktop naming schemes (#6268)Libravatar Kelvin M. Klann2024-03-14
| | | | | | | | Based on the discussion at #5063. Misc: The `\&` is used to escape the dot in `.desktop` (see roff(7)). This amends commit a9c851ee4 ("firecfg: use ignorelist also for .desktop files", 2024-01-08) / PR #6153.
* qt6ct: add dbus-filtering rules (#6272)Libravatar glitsj162024-03-12
| | | | | | Add support for qt6ct packages that use XDG desktop portal. https://github.com/MikeWalrus/qt6ct#branch=colorscheme-portal https://aur.archlinux.org/packages/qt6ct-xdg-colorscheme-git
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-05 08:05:21 +0000