aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* various profile fixes (#1433)Libravatar Vladimir Schowalter2017-08-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * calibre: add netlink protocol (FB note: removed before merge) calibre started without netlink protocol throws following error in console: Exception in thread Thread-8: Traceback (most recent call last): File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner self.run() File "/usr/lib/calibre/calibre/utils/mdns.py", line 43, in run _all_ip_addresses = self.get_all_ips() File "/usr/lib/calibre/calibre/utils/mdns.py", line 27, in get_all_ips for x in netifaces.interfaces(): OSError: [Errno 95] Operation not supported * mpv: add nogroups, tracelog, ipc-namespace, private-dev I used testes all above options and didn't noticed any breakage. * qbittorrent: add netlink protocol, private-etc Netlink protocol is needed if user select to bind specific network interface in config. Otherwise it throws an error in qbittorent log: The network interface defined is invalid: tun0 Example private-etc is added but commented out by default. It's tested but as there are many different system configurations users should enable it manually. * vlc: disable memory-deny-write-execute With memory-deny-write-execute vlc freezes after loading video file. According to https://github.com/VladimirSchowalter20/firejail/commit/b18f42ab0236de7eed5888f43ba36cdaf990cbca memory-deny-write-execute is similar to PAX mprotect feature and linked github project explicitly disables that feature for vlc binary, see https://github.com/copperhead/paxd-archive/commit/deb39e0b91996e2e9c7917b3543030880cd476f4 * Update vlc.profile * wine: add nogroups Nogroups should be safe addition for wine * wireshark: allow users to run wireshark as non-root Wireshark can be run unprivileged when user is part of wireshark group. Unfortunately enabling nogroups,nonewprivs and seccomp will break it with permissions errors. Also added example private-etc option which is commented out by default for now. * cosmetic fix * mpv: comment out ipc-namespace for now As requested in review https://github.com/netblue30/firejail/pull/1433#discussion_r131550515 * calibre: disable netlink protocol It throws an error but actual breakage isn't observed for now.
* Seccomp: split @default into more meaningful smaller groupsLibravatar Topi Miettinen2017-08-06
|
* Seccomp: system call grouping and call numbersLibravatar Topi Miettinen2017-08-06
|
* private-lib fixesLibravatar netblue302017-08-06
|
* Merge pull request #1438 from smitsohu/patch-1Libravatar Fred Barclay2017-08-06
|\ | | | | Change KDE4 services folder to read-only
| * services folder is read-only nowLibravatar smitsohu2017-08-06
| |
| * Change KDE4 services folder to read-onlyLibravatar smitsohu2017-08-06
| | | | | | Configurations in this folder are not secret, but need to be protected from manipulation. Let's make it available to all KDE apps for legitimate use. Discussion in #1428
* | Merge pull request #1437 from soredake/steamfixLibravatar Fred Barclay2017-08-06
|\ \ | | | | | | fix steam startup with >=llvm-4
| * | fix steam startup with >=llvm-4Libravatar soredake2017-08-06
| |/
* | private-lib: fix crashLibravatar netblue302017-08-06
| |
* | prive-lib: integration with firetoolsLibravatar netblue302017-08-06
| |
* | bring in private-lib libraries for all private-bin programs. ↵Libravatar startx20172017-08-06
|/ | | | Example:firejail --private-lib --private-bin=bash,ls,find,pwd,grep
* fix copyright statementLibravatar netblue302017-08-05
|
* Improve library handling: use DT_RPATH/DT_RUNPATH to find more libsLibravatar Topi Miettinen2017-08-05
| | | | | | Helps in more complex cases like this: libpulse.so wants libpulsecommon-10.0.so, which is located in /usr/lib/x86_64-linux-gnu/pulseaudio. This path is specified with DT_RUNPATH.
* Merge pull request #1436 from SpotComms/gtLibravatar Fred Barclay2017-08-05
|\ | | | | Add a profile for Gnome Twitch
| * Add a profile for Gnome TwitchLibravatar Tad2017-08-05
| |
* | private-lib: preliminary support for directories in private-lib listLibravatar netblue302017-08-05
|/
* Merge pull request #1435 from SpotComms/fcLibravatar Fred Barclay2017-08-04
|\ | | | | Update firecfg.config and add a wireshark-* alias
| * Update firecfg.config and add a wireshark-* aliasLibravatar Tad2017-08-04
|/
* .gitignore updateLibravatar netblue302017-08-04
|
* private-lib: add src/flddLibravatar netblue302017-08-04
|
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar netblue302017-08-04
|\
| * Merge pull request #1432 from VladimirSchowalter20/masterLibravatar Fred Barclay2017-08-04
| |\ | | | | | | Gwenview: drop kbuildsycoca5 from private-bin
| | * Gwenview: drop kbuildsycoca5 from private-binLibravatar Vladimir Schowalter2017-08-04
| |/
* | private-lib: support for /etc/firejail/firejail.configLibravatar netblue302017-08-04
| |
* | private-lib: bringing in private-lib list from command lineLibravatar netblue302017-08-04
| |
* | Merge branch 'master' of https://github.com/netblue30/firejailLibravatar netblue302017-08-04
|\|
| * Merge pull request #1431 from SpotComms/npLibravatar Fred Barclay2017-08-03
| |\ | | | | | | Add 8 new profiles
| | * Add 12 new profilesLibravatar Tad2017-08-03
| |/ | | | | | | apktool, Baobab, dex2jar, gitg, Hashcat, MusicBrainz Picard, OBS Studio, Remmina, sdat2img, Sound Converter, SQLiteBrowser, Truecraft
* | Merge branch 'master' of https://github.com/netblue30/firejailLibravatar netblue302017-08-03
|\|
| * Merge pull request #1430 from VladimirSchowalter20/masterLibravatar Fred Barclay2017-08-03
| |\ | | | | | | profile fixes
| | * profile fixesLibravatar Vladimir Schowalter2017-08-04
| |/ | | | | | | | | | | | | | | * Update qbittorrent.profile * Update gwenview.profile * Update disable-programs.inc
| * Merge pull request #1428 from VladimirSchowalter20/masterLibravatar Fred Barclay2017-08-03
| |\ | | | | | | Change ${HOME}/.local/share/kservices5 to read-only
| | * Change ~/.local/share/kservices5 to read-onlyLibravatar Vladimir Schowalter2017-08-03
| |/
* / private-lib: split fldd as a separate applicationLibravatar netblue302017-08-03
|/
* Merge pull request #1426 from VladimirSchowalter20/masterLibravatar startx20172017-08-02
|\ | | | | Apparmor: add local configuration
| * Minor fix for completnessLibravatar Vladimir Schowalter2017-08-02
| |
| * Apparmor: add local configurationLibravatar Vladimir Schowalter2017-08-02
| |
* | Merge pull request #1424 from ↵Libravatar startx20172017-08-02
|\ \ | | | | | | | | | | | | VladimirSchowalter20/VladimirSchowalter20-apparmor-kde-fix Apparmor: update whitelist path for kde
| * | Apparmor: update whitelist path for kdeLibravatar Vladimir Schowalter2017-08-02
| |/
* | Add rambox profile from #1425Libravatar Fred Barclay2017-08-02
| |
* | mergesLibravatar Fred Barclay2017-08-02
| |
* | Merge pull request #1367 from SpotComms/mhLibravatar Fred Barclay2017-08-02
|\ \ | |/ |/| Harden profiles
| * FixesLibravatar Fred-Barclay2017-08-02
| |
| * Add back net none/netfilter as neededLibravatar Fred-Barclay2017-08-02
| |
| * Partially synchronize Chromium-based profilesLibravatar Tad2017-08-02
| |
| * Add noexec to more profiles as tested by @curiosity-seekerLibravatar Tad2017-08-02
| | | | | | | | See https://github.com/netblue30/firejail/pull/1367#issuecomment-315793729
| * Initial adding of memory-deny-write-execute to profilesLibravatar Tad2017-08-02
| | | | | | | | | | | | | | | | - mdwe breaks most vm-based languages so python/java/javascript and some mono programs are not compatible - mdwe also breaks most 3d accelerated programs such as 3d games - mdwe is similar to PaX's mprotect meaning PaX flag managers can be used as reference -- See https://github.com/copperhead/paxd-archive/blob/master/paxd.conf -- See https://github.com/nning/linux-pax-flags
| * Harden profilesLibravatar Tad2017-08-02
| | | | | | | | | | | | | | | | - Added 'disable-devel.conf' to many profiles - Added 'disable-mnt' to many profiles - Added 'noexec' to many profiles - Removed 'netfilter' and 'net none' from profiles with 'protocol unix' - Cleaned up profiles using defaults
* | get_mempolicy syscall was temporarily removed from the default seccomp list. ↵Libravatar netblue302017-08-02
|/ | | | | | It seems to break playing youtube videos on Firefox Nightly - #1414
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 16:45:35 +0000