aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
* | | | cleanup: move overlayfs code in separate moduleLibravatar smitsohu2021-10-13
| | | |
* | | | Merge pull request #4599 from rusty-snake/use-allow-trayLibravatar netblue302021-10-10
|\ \ \ \ | | | | | | | | | | Use ?ALLOW_TRAY: (#4510) in profiles
| * | | | Use ?ALLOW_TRAY: (#4510) in profilesLibravatar rusty-snake2021-10-09
| | |/ / | |/| |
* | | | new fixLibravatar netblue302021-10-09
| | | |
* | | | fix linksLibravatar netblue302021-10-09
| | | |
* | | | markup fixLibravatar netblue302021-10-09
| | | |
* | | | moving out of youtube, and some cleanupLibravatar netblue302021-10-09
| | | |
* | | | Merge pull request #4591 from kmk3/replace-iwrite-iwuserLibravatar netblue302021-10-09
|\ \ \ \ | | | | | | | | | | s/S_IWRITE/S_IWUSR/
| * \ \ \ Merge branch 'master' into replace-iwrite-iwuserLibravatar netblue302021-10-09
| |\ \ \ \ | |/ / / / |/| | | |
* | | | | Merge pull request #4583 from kmk3/fix-include-limits-hLibravatar netblue302021-10-09
|\ \ \ \ \ | | | | | | | | | | | | firejail.h: add missing linux/limits.h include & include cleanup
| * \ \ \ \ Merge branch 'master' into fix-include-limits-hLibravatar netblue302021-10-09
| |\ \ \ \ \ | |/ / / / / |/| | | | |
* | | | | | Merge pull request #4579 from dm9pZCAq/masterLibravatar netblue302021-10-09
|\ \ \ \ \ \ | |_|_|/ / / |/| | | | | fix compilation on musl (#4578)
| * | | | | fix compilation on musl (#4578)Libravatar dm9pZCAq2021-09-27
| | | | | |
* | | | | | Update README.md RELNOTESLibravatar rusty-snake2021-10-09
| | | | | |
* | | | | | Merge pull request #4593 from kmk3/revert-allow-deny-fbuilderLibravatar netblue302021-10-09
|\ \ \ \ \ \ | | | | | | | | | | | | | | Revert "allow/deny fbuilder"
| * | | | | | Revert "allow/deny fbuilder"Libravatar Kelvin M. Klann2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 4438f14f2892b5c88d158ae8fad0a80a2eebfd44. Also, partially revert related commit e4307b409 ("fix whitelist/allow in make test-utils") to keep the tests working. The profiles are being generated using aliases, which are not used on the profiles in the repository. So generate them using the normal commands for consistency. See also commit dd13595b8 ("Revert "allow/deny help and man pages"") / PR #4502. Relates to #4410. Misc: I noticed this on issue #4592.
| * | | | | | build_profile.c: fix typo of "begins"Libravatar Kelvin M. Klann2021-10-05
| | |_|_|_|/ | |/| | | | | | | | | | | | | | | | Added on commit 9af2c1472 ("Better debug handling.").
* | | | | | Merge pull request #4587 from kmk3/fix-vscodiumLibravatar netblue302021-10-09
|\ \ \ \ \ \ | | | | | | | | | | | | | | Fix vscodium
| * | | | | | Add codium.profile as a redirect to vscodium.profileLibravatar Kelvin M. Klann2021-10-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both base names are valid: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 $ pacman -Qlq vscodium-bin | grep -v -e '/$' -e /resources/ | grep /bin/ /usr/bin/codium /usr/bin/vscodium /usr/share/vscodium-bin/bin/codium Note: The first two paths are symlinks to the third one. Fixes #3871.
| * | | | | | vscodium.profile: add missing pathsLibravatar Kelvin M. Klann2021-10-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It creates the following directories on startup: * ~/.config/VSCodium * ~/.vscode-oss Environment: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 Note: The following entry is already on disable-programs.inc: noblacklist ${HOME}/.vscode-oss It was added on commit de90834a8 ("Update disable-programs.inc", 2019-03-02). Relates to #3871.
| * | | | | | vscodium.profile: fix wrong program name in the commentsLibravatar Kelvin M. Klann2021-10-04
| |/ / / / / | | | | | | | | | | | | | | | | | | Added on commit 4bb7dee49 ("small changes", 2019-02-07).
* | | | | | Merge pull request #4586 from smitsohu/traceLibravatar netblue302021-10-09
|\ \ \ \ \ \ | | | | | | | | | | | | | | trace, tracelog: don't truncate /etc/ld.so.preload in sandbox
| * | | | | | trace, tracelog: don't truncate /etc/ld.so.preloadLibravatar smitsohu2021-10-05
| | | | | | |
* | | | | | | Merge pull request #4561 from kmk3/issue-template-improvements2Libravatar netblue302021-10-09
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | Issue template improvements2
| * | | | | | | bug_report.md: link to markdown formatting helpLibravatar Kelvin M. Klann2021-09-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As suggested by @rusty-snake.
| * | | | | | | bug_report.md: add checked item exampleLibravatar Kelvin M. Klann2021-09-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is not uncommon for people to use other characters to try to mark an item as checked (which usually screws up the html output), so be sure to include an example with "[x]".
| * | | | | | | bug_report.md: use LC_ALL where appropriateLibravatar Kelvin M. Klann2021-09-19
| | | | | | | |
| * | | | | | | bug_report.md: use LC_ALL instead of LANGLibravatar Kelvin M. Klann2021-09-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This overrides all `LC_*` variables (and LANG) rather than just LANG. From Section 8.2, Internationalization Variables of POSIX.1-2017[1]: > LANG > This variable shall determine the locale category for native > language, local customs, and coded character set in the absence of > the LC_ALL and other LC_* (LC_COLLATE, LC_CTYPE, LC_MESSAGES, > LC_MONETARY, LC_NUMERIC, LC_TIME) environment variables. This can > be used by applications to determine the language to use for error > messages and instructions, collating sequences, date formats, and > so on. > > LC_ALL > This variable shall determine the values for all locale > categories. The value of the LC_ALL environment variable has > precedence over any of the other environment variables starting > with LC_ (LC_COLLATE, LC_CTYPE, LC_MESSAGES, LC_MONETARY, > LC_NUMERIC, LC_TIME) and the LANG environment variable. [1] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html
* | | | | | | | Merge pull request #4510 from rusty-snake/allow-tray-conditionLibravatar netblue302021-10-09
|\ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | Add new condition ALLOW_TRAY
| * | | | | | | | Add new condition ALLOW_TRAYLibravatar rusty-snake2021-09-04
| | | | | | | | |
* | | | | | | | | Merge pull request #4519 from rusty-snake/build-systemsLibravatar netblue302021-10-09
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | Add profiles for build-systems (/package-managers)
| * | | | | | | | | Drop private-bin from build-systemsLibravatar rusty-snake2021-09-11
| | | | | | | | | |
| * | | | | | | | | build-systems-common: Make whitelist opt-inLibravatar rusty-snake2021-09-11
| | | | | | | | | |
| * | | | | | | | | Add profiles for build-systems (/package-managers)Libravatar rusty-snake2021-09-08
| | |_|_|_|_|_|_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Profiles: bunler, cargo (refactor), cmake (untested), make, meson, pip All redirect to build-systems-common.profile Other fixes: - blacklist ${HOME}/.bundle - blacklist ${HOME}/.cargo/* -> blacklist ${HOME}/.cargo - blacklist /usr/lib64/ruby
* | | | | | | | | update relnotesLibravatar smitsohu2021-10-08
| | | | | | | | |
* | | | | | | | | profile parsing fixesLibravatar smitsohu2021-10-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | results from a systematic search for strncmp calls with a suspicious (non-fitting) integer literal as third argument
* | | | | | | | | Merge pull request #4590 from smitsohu/mountidLibravatar smitsohu2021-10-06
|\ \ \ \ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | Read mount id also on legacy kernels
| * | | | | | | | | mountinfo: get mount id from failed call to name_to_handle_atLibravatar smitsohu2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables recursive remounting on very old kernels, which has some relevance for SailfishOS community ports.
| * | | | | | | | | simplify recursive remountingLibravatar smitsohu2021-10-05
| | |_|_|_|/ / / / | |/| | | | | | |
* | | | | | | | | Merge pull request #4371 from chrpinedo/patch-1Libravatar smitsohu2021-10-05
|\ \ \ \ \ \ \ \ \ | |/ / / / / / / / |/| | | | | | | | Correct amule.profile for upnp
| * | | | | | | | Comment to use UPnP with amule.profileLibravatar Christian Pinedo2021-10-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In order UPnP to work netlink protocol must be enabled.
| | | | | | | * | firejail.h: add missing linux/limits.h includeLibravatar Kelvin M. Klann2021-10-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | firejail.h uses PATH_MAX when defining a macro. Note that ARG_MAX and PATH_MAX are not guaranteed to be (and potentially should not be) defined. From POSIX.1-2017's limits.h(0p)[1]: > A definition of one of the symbolic constants in the following list > shall be omitted from the <limits.h> header on specific > implementations where the corresponding value is equal to or greater > than the stated minimum, but where the value can vary depending on the > file to which it is applied. The actual value supported for a > specific pathname shall be provided by the pathconf() function. Use linux/limits.h instead of limits.h because glibc's limits.h deliberately undefines ARG_MAX. See glibc commit f96853beaf ("* sysdeps/unix/sysv/linux/bits/local_lim.h: Undefined ARG_MAX if", 2008-03-27)[2]. From /usr/include/bits/local_lim.h (glibc 2.33-5 on Artix Linux): #ifndef ARG_MAX # define __undef_ARG_MAX #endif /* The kernel sources contain a file with all the needed information. */ #include <linux/limits.h> /* [...] */ /* Have to remove ARG_MAX? */ #ifdef __undef_ARG_MAX # undef ARG_MAX # undef __undef_ARG_MAX #endif So if a file uses ARG_MAX (currently only cmdline.c) and limits.h (or a firejail.h that includes limits.h) is included before linux/limits.h, then the build will fail on glibc. Build log from using limits.h (instead of linux/limits.h) on firejail.h: $ make clean >/dev/null && make >/dev/null cmdline.c:145:12: error: use of undeclared identifier 'ARG_MAX'; did you mean 'CFG_MAX'? if (len > ARG_MAX) { ^~~~~~~ CFG_MAX ./firejail.h:805:2: note: 'CFG_MAX' declared here CFG_MAX // this should always be the last entry ^ [...] Fixes #4578. [1] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=f96853beafc26d4f030961b0b67a79b5bfad5733
| | | | | | | * | Remove unnecessary linux/limits.h includeLibravatar Kelvin M. Klann2021-09-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | None of the files affected use any macros from linux/limits.h: $ git grep -Fl 'NGROUPS_MAX ARG_MAX LINK_MAX MAX_CANON MAX_INPUT NAME_MAX PATH_MAX PIPE_BUF XATTR_NAME_MAX XATTR_SIZE_MAX XATTR_LIST_MAX RTSIG_MAX' -- src src/firejail/cmdline.c src/firejail/firejail.h src/libtrace/libtrace.c src/libtracelog/libtracelog.c Environment: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Qo /usr/include/linux/limits.h /usr/include/linux/limits.h is owned by linux-api-headers 5.12.3-1 Note: This include has been present on all of the affected files since their inception. For restrict_users.c, that's on commit 4f003daec ("prevent leaking user information by modifying /home directory, /etc/passwd and /etc/group") and for every other file, it's on commit 137985136 ("Baseline firejail 0.9.28"). Relates to #4578.
| | | | | | | * | main.c: remove unnecessary limits.h includeLibravatar Kelvin M. Klann2021-09-28
| | | | | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | Relates to #4578.
| | | | | | | * s/S_IWRITE/S_IWUSR/Libravatar Kelvin M. Klann2021-10-02
| |_|_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | They are equivalent, but only the latter is POSIX. See sys_stat.h(0p) of POSIX.1-2017[1]. From Section 14.9.5, The Mode Bits for Access Permission of the glibc manual[2]: > S_IWUSR > S_IWRITE > > Write permission bit for the owner of the file. Usually 0200. > S_IWRITE is an obsolete synonym provided for BSD compatibility. Current usage: $ git grep -F S_IWRITE -- src | wc -l 11 $ git grep -F S_IWUSR -- src | wc -l 26 Commands used to search and replace: $ git grep -l -z S_IWRITE -- src | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\`sed 's/S_IWRITE/S_IWUSR/g' '{}'\`\" >'{}'" Note: The other related non-POSIX macros are not used anywhere: $ git grep -F -e S_IREAD -e S_IEXEC -- src $ [1] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/sys_stat.h.html [2] https://www.gnu.org/software/libc/manual/html_node/Permission-Bits.html
* | | | | | | Merge pull request #4585 from smitsohu/euidLibravatar smitsohu2021-10-02
|\ \ \ \ \ \ \ | | | | | | | | | | | | | | | | add more EUID improvements
| * | | | | | | add more EUID improvementsLibravatar smitsohu2021-10-01
| | |_|_|_|/ / | |/| | | | |
* | | | | | | Profile fixes and hardeningLibravatar rusty-snake2021-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * cheese - fix: dbus-user.own org.gnome.Cheese - fix: whitelist /usr/share/gstreamer-1.0 - fix: include allow-python3.inc - hardening: include disable-shell.inc - hardening: include whitelist-run-common.inc and whitelist /run/udev/data - hardening: whitelist /usr/libexec/gstreamer-1.0/gst-plugin-scanner - hardening: noinput - hardening: nosound - hardening: seccomp.block-secondary - hardening: private-dev * geekbench (closes #4576) - fix: noblacklist /sbin and noblacklist /usr/sbin - fix: noblacklist, blacklist, mkdir, whitelist, read-write ${HOME}/.geekbench5 - fix: comment/remove private-bin, private-lib, private-opt * inkscape - add quiet for cli usage * musixmatch (#4518) - allow chroot * pandoc - fix: include allow-bin-sh.inc - fix: drop private-bin - hardening: include whitelist-runuser-common.inc - hardening: seccomp.block-secondary
* | | | | | | Rework D-Bus policy of nhekoLibravatar rusty-snake2021-09-29
| |_|_|_|_|/ |/| | | | | | | | | | | | | | | | | | | | | | | - Allow org.freedesktop.secrets, fixes #4584 - Improve comments about notifications and systray
* | | | | | Merge pull request #4575 from a1346054/whitespace-fixLibravatar Kelvin M. Klann2021-09-27
|\ \ \ \ \ \ | |/ / / / / |/| | | | | Trim excess whitespace
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 11:36:32 +0000