aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* private-lib bug: 32 bit libraries being copied instead of 64 bit versions; ↵Libravatar startx20172018-03-12
| | | | splitting common code for firejail and fldd in a common static library
* fix bash on CentOS 7Libravatar startx20172018-03-12
|
* fix speller support in gedit profileLibravatar startx20172018-03-12
|
* Add a steam profile alias for steam-nativeLibravatar Tad2018-03-10
|
* fix private-devLibravatar netblue302018-03-10
|
* disable symlinks for root userLibravatar netblue302018-03-10
|
* Add more necessary info in new issue templateLibravatar Vincent432018-03-07
|
* Disable memory-deny-write-execute in evince profileLibravatar Vincent432018-03-07
| | | It started breaking application in Archlinux, see https://github.com/netblue30/firejail/issues/1803
* fix whitelist /dev/fd,stdin,stdout,stderr - #1778Libravatar netblue302018-03-06
|
* bringing in /dev/fd,stdin,stdout,stderr in --private-devLibravatar netblue302018-03-06
|
* Add falkon profile - see #1794Libravatar Fred-Barclay2018-03-05
|
* Fix #1797 - Brave doesn't open with noexec /tmpLibravatar Fred-Barclay2018-03-05
|
* fix kioexec/krun for KDE authenticationLibravatar netblue302018-03-05
|
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar smitsohu2018-03-05
|\
| * Add VS Code profile - see request in #1139Libravatar Fred-Barclay2018-03-03
| |
| * Add netlink to protocol list and drop chroot from seccomp filter - should ↵Libravatar Fred-Barclay2018-03-02
| | | | | | | | | | | | | | | | fix #1792. Brackets no longer opens without netlink in the protocol list, or with chroot blacklisted by the seccomp filter (which this commit changes from 'seccomp' to 'seccomp.keep').
* | blacklist smartgit password file - #1796Libravatar smitsohu2018-03-05
|/
* let konsole access its settings - #1789Libravatar smitsohu2018-03-02
|
* cleanup: remove empty private-bin and private-etc linesLibravatar smitsohu2018-03-01
|
* add join-or-start to dolphin, okular and kwriteLibravatar smitsohu2018-03-01
| | | | fixes registration of d-bus services, closes #1391
* fixed RELNOTES datesLibravatar netblue302018-03-01
|
* Fixup private-bin in start-tor-browser.profile after ↵Libravatar Tad2018-02-27
| | | | 63d455fbe6cfde2f97137f51b779d44f22cb4675
* appimage enhancementsLibravatar netblue302018-02-27
|
* Sync start-tor-browser with torbrowser-launcher profile'Libravatar Tad2018-02-27
| | | | | | start-tor-browser.profile should stay seperate from torbrowser-launcher for the case when downloaded manually. The other tor-browser-* are okay to extend torbrowser-launcher because their paths are known.
* Add ld.so.cache to torbrowser-launcher.profileLibravatar Tad2018-02-26
|
* Add ld.so.cache to firefox-common.profile, fixes #1767Libravatar smitsohu2018-02-26
|
* drop cap_mac_admin in apparmor profileLibravatar smitsohu2018-02-27
|
* Merge pull request #1787 from joelazar/masterLibravatar Fred Barclay2018-02-26
|\ | | | | .Xauthority moved from blacklist to read-only
| * .Xauthority moved from blacklist to read-onlyLibravatar joelazar2018-02-26
| |
* | Add join-or-start to kate (should fix #1784)Libravatar Fred-Barclay2018-02-24
| |
* | man page, README.md, RELNOTESLibravatar netblue302018-02-21
|/
* Minor bitcoin-qt nitpicks and update READMELibravatar Tad2018-02-20
|
* Merge pull request #1780 from baryluk/masterLibravatar Fred Barclay2018-02-20
|\ | | | | Add a profile for bitcoin-qt
| * Merge branch 'master' of github.com:baryluk/firejailLibravatar Witold Baryluk2018-02-20
| |\
| | * Revert "Also whitelist .bitcoin-testnet just in case"Libravatar Witold Baryluk2018-02-20
| | | | | | | | | | | | | | | | | | This reverts commit 254d2a9d9b6e752c0e3188fa90e4c5856eae5979. Testnet blockchain is in ~/.bitcoin/testnet3/ no need for anything else.
| * | Revert "Also whitelist .bitcoin-testnet just in case"Libravatar Witold Baryluk2018-02-20
| |/ | | | | | | | | | | | | | | This reverts commit 254d2a9d9b6e752c0e3188fa90e4c5856eae5979. Testnet blockchain is in ~/.bitcoin/testnet3/ no need for anything else. And config is in ./.config/Bitcoin/Bitcoin-Qt-testnet.conf
| * Also whitelist .bitcoin-testnet just in caseLibravatar Witold Baryluk2018-02-20
| |
| * Remove unecassary blacklist for bitcoin-qt config. Comment about private-libLibravatar Witold Baryluk2018-02-20
| |
| * Add a profile for Bitcoin Core QT client / walletLibravatar Witold Baryluk2018-02-20
| |
* | Update firecfg and READMELibravatar Tad2018-02-20
| |
* | Merge pull request #1779 from baryluk/masterLibravatar SkewedZeppelin2018-02-20
|\| | | | | Add a profile for Vivaldi Snapshot
| * Add a profile for Vivaldi SnapshotLibravatar Witold Baryluk2018-02-20
|/
* Apparmor: Allow log Firejail blacklist violationsLibravatar Vincent432018-02-19
|
* Log denied write access for easier debuggingLibravatar Vincent432018-02-19
| | | After more testing we can disable logging gain.
* Apparmor: blacklist /proc and /sys access from firejailLibravatar Vincent432018-02-19
| | | | | Firejail does blacklisting sensitive /proc and /sys files on its own: https://github.com/netblue30/firejail/blob/master/src/firejail/fs.c#L530 There is no need to duplicate this in apparmor using whitelisting approach which is much harder to do and needs never ending maintenance.
* Apparmor: don't duplicate userspace /run/user restrictionsLibravatar Vincent432018-02-19
| | | | | | | Currently userspace firejail do blacklist approach to /run/user/ directory. By default it blacklist /run/user/**/systemd and /run/user/**/gnupg. Additional restrictions can be enabled in profiles like blacklisting /run/user/**/bus , etc. The blacklist can be extended or degraded by profile which allows for fine grained hardening. In apparmor we do whitelist approach instead. It means we have to explicitly enable access to every file which firejail already allow access. This duplicates functionality and amount of work to do. Moreover we end up with same list of allowed files as every one of them is used by some app and appamror profile is global. It's even worse as firejail blacklist can be disabled with "writable-run-user" command which means we have to whitelist literally everything under /run/user/ to not cause breakages when using apparmor. The solution for all above is to leave handling of /run/user to userspace firejail which is better tool to do this. In apparmor we should only handle things which firejail can't do.
* enable apparmor for tranamission-gtk and transmission-qtLibravatar netblue302018-02-19
|
* enable apparmor for all firefox and chromium based browsers; enable apparmor ↵Libravatar netblue302018-02-19
| | | | for tranamission-gtk and transmission-qt
* added support to disable apparmor globally in /etc/firejail/firejail.configLibravatar netblue302018-02-19
|
* new video demoLibravatar netblue302018-02-19
|
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 12:43:29 +0000