aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
| * mkdeb.sh.in: stop enabling apparmorLibravatar Kelvin M. Klann2022-06-05
| | | | | | | | | | | | | | | | | | | | | | | | | | Since `make deb-apparmor` already exists, use that for now instead of changing what `make deb` does. This fixes CI. Added on commit 494b26d50 ("adding --enable-apparmor by default for make deb - most Debian-based distros have apparmor enabled by default", 2022-06-03). Kind of relates to #5154.
* | Merge pull request #5174 from kmk3/revert-release-versionLibravatar netblue302022-06-06
|\ \ | |/ |/| Revert "I am preparing a point release for next week, fixes and small…
| * Revert "I am preparing a point release for next week, fixes and small number ↵Libravatar Kelvin M. Klann2022-06-04
| | | | | | | | | | | | | | | | | | | | | | | | | | of new features. Check in everything you have out." This reverts commit e8cb03cde8a3a7d083a6f539b06c6253d031af82. More specifically: s/0.9.68.1/0.9.69/. The current development version contains not only new features, but also breaking changes (see "modif:" on the RELNOTES). Ensure at least a minor (rather than only a patch) version bump (to 0.9.70 on the final version) to avoid breaking user expectations.
* | Add comment for enabling D-Bus desktop notifications to ↵Libravatar glitsj162022-06-05
|/ | | | | | | transmission-{gtk,qt} (#5175) * add comment for enabling desktop notifications * add comment for enabling desktop notifications
* harden blacklistLibravatar smitsohu2022-06-03
|
* adding --enable-apparmor by default for make deb - most Debian-based distros ↵Libravatar netblue302022-06-03
| | | | have apparmor enabled by default
* I am preparing a point release for next week, fixes and small number of new ↵Libravatar netblue302022-06-03
| | | | features. Check in everything you have out.
* removed enforcement of nonewprivs for --noprofileLibravatar netblue302022-06-03
|
* more relnotesLibravatar netblue302022-06-03
|
* relnotesLibravatar netblue302022-06-03
|
* --nettrace only available when running the sandbox as rootLibravatar netblue302022-06-03
|
* enforce nonewprivs for --noprofile optionLibravatar netblue302022-06-03
|
* Merge pull request #5172 from kmk3/ds-add-ids-pathsLibravatar netblue302022-06-03
|\ | | | | disable-shell.inc: add global shell paths from ids.config
| * disable-shell.inc: add global shell paths from ids.configLibravatar Kelvin M. Klann2022-06-02
| | | | | | | | | | | | | | | | | | | | | | Since /etc/profile is present, add the other shell-related paths in /etc that are listed on ids.config. Suggestion by @rusty-snake[1]. Relates to #5167 #5170. [1] https://github.com/netblue30/firejail/pull/5167#pullrequestreview-989621852
| * ids.config: sort global shell pathsLibravatar Kelvin M. Klann2022-06-02
| |
* | fixesLibravatar netblue302022-06-02
| |
* | firemon reworkLibravatar netblue302022-06-02
| |
* | speed up firemonLibravatar netblue302022-06-02
|/
* Merge pull request #5170 from kmk3/ids-add-sh-pathsLibravatar netblue302022-05-31
|\ | | | | ids.config: add missing global shell paths
| * ids.config: add missing global shell pathsLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | Add missing paths for bash, ksh and zsh. Environment: Artix Linux
* | Merge pull request #5167 from kmk3/mv-sh-profile-blacklistLibravatar netblue302022-05-31
|\ \ | |/ |/| profiles: move blacklist of /etc/profile.d & blacklist /etc/profile
| * disable-shell.inc: blacklist /etc/profileLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | Since /etc/profile.d is already being blacklisted.
| * disable-common.inc: move blacklist of /etc/profile.dLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to #3411 #5159.
| * kate.profile: add missing include commentLibravatar Kelvin M. Klann2022-05-30
|/ | | | | | | This amends commit b6b3f3b38 ("kate.profile: allow common development file access", 2022-05-28) / PR #5159. See etc/templates/profile.template.
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-05-30
|\
| * Merge pull request #5154 from kmk3/build-clean-up-distLibravatar netblue302022-05-30
| |\ | | | | | | mkdeb.sh.in: pass remaining arguments to ./configure
| | * mkdeb.sh.in: pass remaining arguments to ./configureLibravatar Kelvin M. Klann2022-05-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, mkdeb.sh (which is used to make a .deb package) runs ./configure with hardcoded options (some of which are automatically detected based on configure-time variables). To work around the hardcoding, contrib/fj-mkdeb.py is used to add additional options by rewriting the actual call to ./configure on mkdeb.sh. For example, the following invocation adds --disable-firetunnel to mkdeb.sh: $ ./configure && ./contrib/fj-mkdeb.py --disable-firetunnel To avoid depending on another script and to avoid re-generating mkdeb.sh, just let the latter pass the remaining arguments (the first one is an optional package filename suffix) to ./configure directly. Example: $ make distclean && ./configure && make dist && ./mkdeb.sh "" --disable-firetunnel Additionally, change contrib/fj-mkdeb.py to do roughly the same as the above example, by simply forwarding the arguments that it receives to ./mkdeb.sh (which then forwards them to ./configure). Also, remove the --only-fix-mkdeb option, since the script does not change mkdeb.sh anymore. With these changes, the script's usage (other than when using --only-fix-mkdeb) should remain the same. Note: To clean the generated files and then make a .deb package using the default configuration, the invocation is still the same: $ make distclean && ./configure && make deb Note2: Running ./configure in the above examples is only needed for generating Makefile/mkdeb.sh from Makefile.in/mkdeb.sh.in after running distclean, so that running `make` / `./mkdeb.sh` afterwards works. Should fully fix #772. Relates to #1205 #3414 #5148.
| | * fj-mkdeb.py: run distclean before ./configureLibravatar Kelvin M. Klann2022-05-27
| | | | | | | | | | | | | | | | | | | | | This (mostly) restores the behavior from before commit 1fb814e51 ("Makefile.in: stop running distclean on dist", 2022-05-13) / PR #5142. ./configure still has to be called before calling ./contrib/fj-mkdeb.py (to generate Makefile from Makefile.in before calling `make distclean`).
| | * mkdeb.sh.in: remove unused PACKAGE_TARNAME/TOP varsLibravatar Kelvin M. Klann2022-05-27
| | | | | | | | | | | | | | | | | | | | | | | | PACKAGE_TARNAME was added on commit 87e7b3139 ("Configure Debian package with AA and SELinux options", 2020-05-13) / PR #3414. TOP was added on commit ed4a24ce7 ("porting make deb-apparmor from LTS build", 2019-01-26).
| * | Merge pull request #5158 from hknaack/seamonkey-support-enigmail-gpgLibravatar netblue302022-05-30
| |\ \ | | | | | | | | seamonkey.profile: support enigmail/gpg
| | * | seamonkey.profile: support enigmail/gpgLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | Changes inspired by Thunderbird profile.
| * | | Merge pull request #5159 from hknaack/kate-fixesLibravatar netblue302022-05-30
| |\ \ \ | | | | | | | | | | Kate fixes
| | * | | kate.profile: drop tracelogLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting kate and loading into a session containing a git repository, tracelog caused about 30 seconds of delay until the project structure appeared in the projects sidebar. Error message on console: QProcess: Destroyed while process ("/usr/bin/git") is still running. Drop tracelog to mitigate the delay and error message.
| | * | | kate.profile: allow access to kwinrcLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting Kate, a blacklist violation from accessing the kwinrc config file is reported. As a KDE application, it should be fine for Kate to access it. blacklist violation - sandbox 13410, name kate, exe kate, syscall access, path /home/user/.config/kwinrc
| | * | | kate.profile: enable bash completion in terminalLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A side effect of including disable-common.inc is loosing access to /etc/profile.d, where Bash completion is located. Explicitly enable access to console scripts in /etc/profile.d, so that Kate's built-in Konsole instance can be used without limitations. Minor side effect: the spawned Bash tries to access /etc/init.d blacklist violation - sandbox 17317, name kate, exe bash, syscall stat, path /etc/init.d
| | * | | kate.profile: allow common development file accessLibravatar Hartmut Knaack2022-05-28
| | |/ / | | | | | | | | | | | | | | | | | | | | Kate has grown support for software development, making it a light IDE. Some version control modules exist, and when using the Git module, a blacklist violation is reported: blacklist violation - sandbox 13902, name kate, exe git, syscall access, path /home/user/.gitconfig Including support for common development file access mitigates this violation issue.
* | / / mergesLibravatar netblue302022-05-30
|/ / /
* | / minor fixes for git.profile (#5165)Libravatar glitsj162022-05-28
| |/ |/|
* | Removed IDS feature from the default build. To enable it, use --enable-ids ↵Libravatar netblue302022-05-25
| | | | | | | | at compile time.
* | build(deps): bump github/codeql-action from 2.1.10 to 2.1.11Libravatar dependabot[bot]2022-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.10 to 2.1.11. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2f58583a1b24a7d3c7034f6bf9fa506d23b1183b...a3a6c128d771b6b9bdebb1c9d0583ebd2728a108) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | config guide (firecfg --guide) man pageLibravatar netblue302022-05-23
|/
* unbound: seccomp cleanupLibravatar smitsohu2022-05-21
|
* netlock: restore environment for terminalLibravatar smitsohu2022-05-21
|
* Merge pull request #5141 from kmk3/nvim-add-xdg-state-homeLibravatar netblue302022-05-20
|\ | | | | nvim: add XDG_STATE_HOME path
| * nvim: add XDG_STATE_HOME pathLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default paths as of neovim 0.7.0: * backupdir: $XDG_DATA_HOME/nvim/backup// * directory: $XDG_DATA_HOME/nvim/swap// * undodir: $XDG_DATA_HOME/nvim/undo// * viewdir: $XDG_DATA_HOME/nvim/view// * shada file: $XDG_DATA_HOME/nvim/shada/main.shada * log dir: $XDG_CACHE_HOME/nvim/log Default paths as of [1]: * backupdir: $XDG_STATE_HOME/nvim/backup// * directory: $XDG_STATE_HOME/nvim/swap// * undodir: $XDG_STATE_HOME/nvim/undo// * viewdir: $XDG_STATE_HOME/nvim/view// * shada file: $XDG_STATE_HOME/nvim/shada/main.shada * log dir: $XDG_STATE_HOME/nvim/log [1] https://github.com/neovim/neovim/pull/15583
| * disable-programs.inc: remove ~/.local/share/nvimLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | It's already blacklisted on disable-common.inc. Added on commit ec966d4c0 ("fix: neovim profile", 2022-01-10) / PR #4841.
* | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-05-20
|\ \
| * | updates for wget2 (#5152)Libravatar glitsj162022-05-20
| | | | | | | | | | | | | | | * update for wget2 * allow ${HOME}/.local/share/wget
* | | --oomLibravatar netblue302022-05-20
|/ /
* | --oom (#5122)Libravatar netblue302022-05-20
| |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 15:25:16 +0000