aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* main.c: remove redundant has_cntrl_chars checkLibravatar Kelvin M. Klann2023-06-13
| | | | | | | The `invalid_name` function does not allow control characters. Added on commit d349a2ff8 ("Forbid control chars in names", 2023-03-03) / PR #5708.
* build(deps): bump github/codeql-action from 2.3.5 to 2.3.6Libravatar dependabot[bot]2023-06-05
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.5 to 2.3.6. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/0225834cc549ee0ca93cb085b92954821a145866...83f0fe6c4988d98a455712a27f0255212bba9bd4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* firefox: fix private-etc firefoxLibravatar glitsj162023-06-05
|
* Merge pull request #5842 from kmk3/build-enable-warningsLibravatar netblue302023-05-31
|\ | | | | build: enable compiler warnings by default
| * build: enable compiler warnings by defaultLibravatar Kelvin M. Klann2023-05-31
| | | | | | | | Enable -Wall by default and add -Wextra.
| * build: organize warning flags in CFLAGSLibravatar Kelvin M. Klann2023-05-31
|/
* build(deps): bump github/codeql-action from 2.3.3 to 2.3.5Libravatar dependabot[bot]2023-05-29
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.3 to 2.3.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/29b1f65c5e92e24fe6b6647da1eaabe529cec70f...0225834cc549ee0ca93cb085b92954821a145866) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* RELNOTES: add print version modifLibravatar Kelvin M. Klann2023-05-19
| | | | Relates to #5829.
* mergesLibravatar netblue302023-05-19
|
* Merge pull request #5719 from marek22k/clawsmail-clamavLibravatar netblue302023-05-19
|\ | | | | email-common.profile: allow clamav plugin for claws-mail
| * Merge branch 'master' into clawsmail-clamavLibravatar netblue302023-05-19
| |\ | |/ |/|
* | Merge pull request #5808 from Dieterbe/qutebrowser-qt6-mpris-changeLibravatar netblue302023-05-19
|\ \ | | | | | | qutebrowser: update MPRIS name for qutebrowser-qt6
| * | qutebrowser: update MPRIS name for qutebrowser-qt6Libravatar Dieter Plaetinck2023-05-05
| | | | | | | | | | | | see https://github.com/qutebrowser/qutebrowser/issues/7431
* | | Merge pull request #5829 from kmk3/improve-print-versionLibravatar netblue302023-05-19
|\ \ \ | | | | | | | | modif: Improve --version/--help & print version on startup
| * | | Print version on startup for firejail/firecfgLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is not too uncommon for the firejail version to be missing when issues are reported; this commit makes it more likely that any posted logs will contain the program version. Do so just for firejail and firecfg for now because they are the most common user-facing programs. Print the version after argument parsing, in order to avoid printing the program version more than once and to avoid interfering with commands that generate machine-readable output (like `firejail --list` and `firecfg --list`). Also, only print it after all profiles have been loaded, because a profile may contain `quiet`. Note: This does not cover the case where the program exits before the end of argument/profile parsing (such as when an error occurs).
| * | | Move usage text into usage_str varLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For consistency and readability. Note: This also makes exactly one extra blank line be printed at the end of every usage text, which is currently only done in the following files: * src/fcopy/main.c * src/fnettrace-dns/main.c * src/fnettrace-icmp/main.c * src/fnettrace-sni/main.c * src/fnettrace/main.c * src/profstats/main.c
| * | | Standardize usage string var declarationsLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Name them all "usage_str" * Make them const For the latter item, see commit eb20f52ef ("Make list of paths const to fix a false positive of gcc analyzer", 2022-07-27) / PR #5275.
| * | | Standardize version outputLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Only print the version line in the print_version function * Add a print_version function where missing (put it in usage.c if the file exists) * Always a blank line after the version
| * | | firejail: simplify print_compiletime_support functionLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | Build the entire string at once and print it only once.
| * | | firejail: deduplicate version printingLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Split print_version into two functions: * print_version: only prints the version line * print_version_full: also prints compile-time support
| * | | firejail: move print_version from checkcfg.c to usage.cLibravatar Kelvin M. Klann2023-05-14
| | | |
| * | | Remove dash before version on --help outputLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, --version doesn't print a dash while --help does. Example: $ firejail --version | grep 'version 0' firejail version 0.9.73 $ firejail --help | grep 'version 0' firejail - version 0.9.73 For consistency, always print the version without a dash. Commands used to search and replace: $ git grep -IFlz ' - version' -- src | xargs -0 -I '{}' sh -c "printf '%s\n' \"\$(sed 's/ - version/ version/' '{}')\" >'{}'"
| * | | jailcheck: fix wrong program name in --versionLibravatar Kelvin M. Klann2023-05-12
|/ / / | | | | | | | | | | | | Added on commit 42e2db127 ("jaitest - simple sandbox testing utility program", 2021-02-20).
* | | etc-cleanup: fix wrong header path in MakefileLibravatar Kelvin M. Klann2023-05-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is causing main.o to be built using an implicit rule (rather than the rule from src/prog.mk), which does not use PROG_CFLAGS. Example (using src/fldd as a working example for comparison): $ make -C src/etc-cleanup clean >/dev/null && make -C src/etc-cleanup | grep -Ev '(Entering|Leaving) directory' gcc -g -O2 -c -o main.o main.c gcc -pie -fPIE -Wl,-z,relro -Wl,-z,now -o etc-cleanup main.o $ make -C src/etc-cleanup clean >/dev/null && make -C src/etc-cleanup -r | grep -Ev '(Entering|Leaving) directory' make: *** No rule to make target 'main.o', needed by 'etc-cleanup'. Stop. $ make -C src/fldd clean >/dev/null && make -C src/fldd | grep -Ev '(Entering|Leaving) directory' gcc -ggdb -O2 -DVERSION='"0.9.73"' -fstack-protector-all [...] gcc -pie -fPIE -Wl,-z,relro -Wl,-z,now -o fldd main.o ../lib/common.o ../lib/ldd_utils.o $ make -C src/fldd clean >/dev/null && make -C src/fldd -r | grep -Ev '(Entering|Leaving) directory' gcc -ggdb -O2 -DVERSION='"0.9.73"' -fstack-protector-all [...] gcc -pie -fPIE -Wl,-z,relro -Wl,-z,now -o fldd main.o ../lib/common.o ../lib/ldd_utils.o Environment: GNU make 4.4.1-2 on Artix Linux. This amends commit e889db095 ("build fix", 2023-02-06). See also commit 02d37680c ("private-etc rework: file groups moved to src/include/etc_groups.h, new groups added", 2023-01-25). Relates to #5610.
* | | block local python (#5826)Libravatar pirate4867431862023-05-11
| | | | | | | | | Co-authored-by: pirate486743186 <>
* | | sbox: improve seccomp blacklistLibravatar smitsohu2023-05-09
| | |
* | | build(deps): bump step-security/harden-runner from 2.3.1 to 2.4.0Libravatar dependabot[bot]2023-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.3.1 to 2.4.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/6b3083af2869dc3314a0257a42f4af696cc79ba3...128a63446a954579617e875aaab7d2978154e969) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
* | | build(deps): bump github/codeql-action from 2.3.2 to 2.3.3Libravatar dependabot[bot]2023-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.2 to 2.3.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/f3feb00acb00f31a6f60280e6ace9ca31d91c76a...29b1f65c5e92e24fe6b6647da1eaabe529cec70f) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | ci: upgrade debian:stretch to debian:busterLibravatar Kelvin M. Klann2023-05-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of Debian 9, use Debian 10 in build_debian_package. It currently fails to update the package index[1]: $ apt-get update -qq W: The repository 'http://deb.debian.org/debian stretch Release' does not have a Release file. W: The repository 'http://deb.debian.org/debian stretch-updates Release' does not have a Release file. W: The repository 'http://security.debian.org/debian-security stretch/updates Release' does not have a Release file. E: Failed to fetch http://deb.debian.org/debian/dists/stretch/main/binary-amd64/Packages 404 Not Found [IP: 146.75.38.132 80] E: Failed to fetch http://deb.debian.org/debian/dists/stretch-updates/main/binary-amd64/Packages 404 Not Found [IP: 146.75.38.132 80] E: Failed to fetch http://security.debian.org/debian-security/dists/stretch/updates/main/binary-amd64/Packages 404 Not Found [IP: 151.101.130.132 80] E: Some index files failed to download. They have been ignored, or old ones used instead. Also, note that LTS support for Debian 9 ended on 2022-06-30, while Debian 10 has LTS support until 2024-06-30[2]. Relates to #5818. [1] https://gitlab.com/Firejail/firejail_ci/-/jobs/4195782936 [2] https://wiki.debian.org/LTS
* | | email-common: fix bogofilter/bsfilter support (#5810)Libravatar glitsj162023-05-05
| | |
* | | RELNOTES: add bugfix, ci and docs itemsLibravatar Kelvin M. Klann2023-05-05
| | | | | | | | | | | | Relates to #5806 #5812 #5815.
* | | Merge pull request #5812 from kmk3/docs-add-uninstallLibravatar Kelvin M. Klann2023-05-05
|\ \ \ | | | | | | | | docs: add uninstall instructions to README.md
| * | | docs: add uninstall instructions to README.mdLibravatar Kelvin M. Klann2023-05-02
| | | | | | | | | | | | | | | | | | | | | | | | Clarify how to remove the symlinks created by firecfg. Reported by @MikeNavy in #5098.
* | | | Merge pull request #5815 from kmk3/ci-allow-any-branchLibravatar Kelvin M. Klann2023-05-05
|\ \ \ \ | | | | | | | | | | ci: run for every branch instead of just master
| * | | | ci: run for every branch instead of just masterLibravatar Kelvin M. Klann2023-05-03
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Having CI always run on WIP branches without having to open a PR beforehand makes it easier to debug CI issues. GitHub currently does not have any apparent limit for CI runs and there are no project-specific secrets as far as I know, so it should be safe to remove these restrictions.
* | | | ci: allow endpoints used in testsLibravatar Kelvin M. Klann2023-05-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Relevant lines from build_and_test[1]: endpoint called ip address:port 1.1.1.1:1025, domain: endpoint called ip address:port 54.185.253.63:43, domain: whois.pir.org. ##[error]StepSecurity Harden Runner: DNS resolution for domain dns.quad9.net. was blocked. This domain is not in the list of allowed-endpoints. ##[error]StepSecurity Harden Runner: DNS resolution for domain whois.pir.org. was blocked. This domain is not in the list of allowed-endpoints. The relevant tests were added in the following commits: * ef4409e7b ("added whois and dig profiles", 2018-08-30) * 171898233 ("more profile fixes/testing", 2023-01-19) Relates to #5439 #5485. [1] https://github.com/netblue30/firejail/actions/runs/4854586882/jobs/8652141329
* | | | tests: disable ping test in test/chroot/fs_chroot.expLibravatar Kelvin M. Klann2023-05-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Sometimes ping just works normally. Log from build_and_test[1]: TESTING: chroot (test/chroot/fs_chroot.exp) spawn /bin/bash firejail --chroot=/tmp/chroot runner@fv-az615-403:~/work/firejail/firejail/test/chroot$ [...] bash-5.1$ /bin/ping 1.1.1.1 PING 1.1.1.1 (1.1.1.1) 56(84) bytes of data. TESTING ERROR 9 [1] https://github.com/kmk3/firejail/actions/runs/4875037540/jobs/8696877757
* | | | arp.c: ensure positive timeout on select(2)Libravatar Kelvin M. Klann2023-05-01
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Log from build_and_test[1]: TESTING: network scan (net_scan.exp) [...] firejail /bin/bash Child process initialized in 1704.83 ms spawn /bin/bash firejail --net=br0 --ip=10.10.20.60 runner@fv-az576-472:~/work/firejail/firejail/test/network$ <l/test/network$ firejail --net=br0 --ip=10.10.20.60 Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc ** Note: you can use --noprofile to disable default.profile ** Error select: arp.c:202 arp_check: Invalid argument runner@fv-az576-472:~/work/firejail/firejail/test/network$ TESTING ERROR 4 This "Invalid argument" error does not always happen, so I assume that it may be due to a negative integer value in `ts` when calling select. Misc: Found in #5805. [1] https://github.com/netblue30/firejail/actions/runs/4806275219/jobs/8553597462
* | | build(deps): bump github/codeql-action from 2.3.0 to 2.3.2Libravatar dependabot[bot]2023-05-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.3.0 to 2.3.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/b2c19fb9a2a485599ccf4ed5d65527d94bc57226...f3feb00acb00f31a6f60280e6ace9ca31d91c76a) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | Fix mpv 0.35.1 in Fedora 38Libravatar rusty-snake2023-04-29
| | |
* | | RELNOTES: add ci itemsLibravatar Kelvin M. Klann2023-04-28
| | | | | | | | | | | | Relates to #5795 #5802.
* | | Merge pull request #5802 from kmk3/ci-format-improveLibravatar Kelvin M. Klann2023-04-28
|\ \ \ | |/ / |/| | ci: formatting and misc improvements
| * | ci: print env-related settings in each jobLibravatar Kelvin M. Klann2023-04-28
| | | | | | | | | | | | | | | | | | | | | To make debugging easier. Use a separate shell script instead of just a make target to ensure that it can safely run before ./configure and without having make installed.
| * | ci: print some program versionsLibravatar Kelvin M. Klann2023-04-28
| | | | | | | | | | | | To make debugging easier.
| * | ci: improve quotes in gitlab ciLibravatar Kelvin M. Klann2023-04-28
| | | | | | | | | | | | | | | | | | | | | Changes: * Add quotes around variables * Use single quotes where applicable
| * | ci: use one command per line instead of chaining themLibravatar Kelvin M. Klann2023-04-24
| | | | | | | | | | | | | | | | | | To turn each step in question into a normal multi-line shell script. Note that each step already runs with `set -e` by default.
| * | ci: line-wrap and split/join some commandsLibravatar Kelvin M. Klann2023-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For increased readability. Note: `>` basically turns each newline into a space while `|` keeps newlines as is. Both remove leading indentation. Note2: On jobs using `apt-get install`, this commit moves package names to their own line, to make it easier to compare which packages are being installed across such jobs.
| * | ci: simplify test steps in build.ymlLibravatar Kelvin M. Klann2023-04-24
| | | | | | | | | | | | | | | Kind of relates to commit 6d0c7514e ("split make test-github into different actions", 2023-01-31).
| * | ci: ignore build workflows on more workflowsLibravatar Kelvin M. Klann2023-04-24
| | | | | | | | | | | | | | | | | | This makes each workflow ignore every other workflow. Relates to #5481.
| * | ci: fix commented sort.py code in alpine jobLibravatar Kelvin M. Klann2023-04-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This amends the following commits: * 370b9db39 ("gitlab pipeline fixes", 2020-04-21) * 42fdea77f ("gitlab", 2020-04-21) Added on commit 2e14c1a1d ("Adding sort.py to GitLab CI (#2973)", 2019-09-21).
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-27 14:05:41 +0000