aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
* | | | Add 'ignore nodbus', remove 'private-tmp'Libravatar Fred Barclay2020-04-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Without 'ignore nodbus', Teams will not close properly. It looks like, by design, Teams ignores the close signal from window managers (i.e. clicking the X in the top corner) - this occurs even without firejail. Instead, there are two ways to close: by right-clicking the tray icon and selecting "Close" or by running `teams --quit`. 'nodbus' hides/prevents the tray icon, and also ignores `teams --quit` if firecfg has been run (so that `teams` and `teams --quit` with both be sandboxed). The only way to stop Teams is then to manually either kill the process (via `kill -9`) or run something like `/usr/bin/teams --quit` so that the unsandboxed app is run. 'private-tmp' blocks the tray icon so, again, there's no good way to kill Teams. Observed on Debian 10 and Teams 1.3.00.5153
* | | | whitelist globing man pageLibravatar netblue302020-04-01
| | | |
* | | | globbing support for whitelistsLibravatar netblue302020-04-01
| | | |
* | | | profstatsLibravatar netblue302020-04-01
| | | |
* | | | Whitelist runuser common (#3286)Libravatar rusty-snake2020-03-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * introduce whitelist-runuser-common.inc * If an applications does not need a whitelist it can/should be nowhitelisted. Example: nowhitelist ${RUNUSER}/pulse include whitelist-runuser-common.inc * ${RUNUSER}/bus is inaccessible with nodbus regardless of the whitelist. (as it should) * strange wayland setups with an second wayland-compostior need to whitelist ${RUNUSER}/wayland-1, ${RUNUSER}/wayland-2 and so on. * some display-manager store there Xauthority file in ${RUNUSER}. test results with fedora 31: - ssdm: ~/.Xauthority is used - lightdm: /run/lightdm/USER/Xauthority - gdm: /run/user/UID/gdm/Xauthority * IMPORTANT: ATM we can only enable this for non-graphical and GTK3 programs because mutter (GNOMEs window-manger) stores the Xauthority file for Xwayland under /run/user/UID/.mutter-Xwaylandauth.XXXXXX where XXXXXX is random. Until we have whitelist globbing we can't whitelist this file. QT/KDE and other toolkits without full wayland support won't be able to start. * wru update 1 - add wru to more profiles. - blacklist ${RUNUSER} works for the most cli programs too. * add wruc to more profiles * fixes * fixes * wruc: hide pulse pid * update * remove wruc from all the x11 profiles * fixes * fix ordering * read-only * revert read-only * update *
* | | | Mention --seccomp.32 etc in usageLibravatar Topi Miettinen2020-03-31
| | | |
* | | | mergesLibravatar smitsohu2020-03-31
| | | |
* | | | extra x11 hardeningLibravatar smitsohu2020-03-31
|/ / /
* | | abiword and more gnome-gamesLibravatar rusty-snake2020-03-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - four-in-a-row - gnome-mahjongg - gnome-robots - gnome-sudoku - gnome-taquin - gnome-tetravex harden gnome-chess
* | | Merge pull request #3296 from 0x7969/masterLibravatar rusty-snake2020-03-29
|\ \ \ | | | | | | | | Create ferdi.profile
| * | | Added paths for ferdiLibravatar 0x79692020-03-29
| | | |
| * | | Added ferdi to firecfg.configLibravatar 0x79692020-03-29
| | | |
| * | | Create ferdi.profileLibravatar 0x79692020-03-25
| | |/ | |/| | | | Exact copy of franz.profile, simply renamed franz to ferdi.
* | | blacklist libvirt and flatpak [skip ci]Libravatar rusty-snake2020-03-29
| | |
* | | more game profilesLibravatar rusty-snake2020-03-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - frogatto - gnome_games-common.profile - gnome-2048 (make redirect) - gnome-mines - gnome-nibbles - lightsoff - ts3client_runscript.sh (fix #3279) - warmux (don't get confused with the warmux/wormux thing)
* | | support GTK2 apps in wuscLibravatar glitsj162020-03-28
| | |
* | | seccomp: allow defining separate filters for 32-bit archLibravatar Topi Miettinen2020-03-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes #3267. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* | | Added compatibility with BetterDiscord (#3300)Libravatar Atrate2020-03-27
| | | | | | | | | Signed-off-by: Atrate <Atrate@protonmail.com>
* | | fsec-print: print address of BPF_JA jump in hexLibravatar Topi Miettinen2020-03-26
|/ / | | | | | | | | Since target addresses for other (conditional) jumps are in hex, it's very confusing to have one jump address in decimal.
* | Add a profile for X2GoClientLibravatar Tad2020-03-23
| |
* | penguin-commandLibravatar netblue302020-03-23
| |
* | Merge branch 'master' of https://github.com/netblue30/firejailLibravatar netblue302020-03-23
|\ \
| * | fixup 255697bLibravatar rusty-snake2020-03-23
| | |
* | | penguin-commadLibravatar netblue302020-03-23
|/ /
* | apparmorLibravatar netblue302020-03-23
| |
* | Merge pull request #3293 from 0x7969/masterLibravatar rusty-snake2020-03-23
|\ \ | | | | | | Update wire-desktop.profile
| * | Update etc/wire-desktop.profileLibravatar 0x79692020-03-23
| | | | | | | | | Co-Authored-By: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
| * | Update wire-desktop.profileLibravatar 0x79692020-03-23
| | |
* | | replace tabs with spacesLibravatar rusty-snake2020-03-23
|/ /
* | kmplayer etcLibravatar netblue302020-03-22
| |
* | fix profstats to print warning for nonexistent include filesLibravatar netblue302020-03-22
| |
* | fixesLibravatar rusty-snake2020-03-22
| |
* | new profiles: agenda, gnome-pomodoro, gnome-todoLibravatar rusty-snake2020-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | rules for xdg-dbus-proxy: dbus-user filter dbus-user.own org.gnome.Pomodoro dbus-user.talk ca.desrt.dconf dbus-user.talk org.gnome.Shell dbus-system none dbus-user filter dbus-user.own org.gnome.Todo dbus-user.talk ca.desrt.dconf dbus-user.talk org.gnome.evolution.dataserver.AddressBook9 dbus-user.talk org.gnome.evolution.dataserver.Calendar8 dbus-user.talk org.gnome.evolution.dataserver.Sources5 dbus-user.talk org.gnome.evolution.dataserver.Subprocess.Backend.* dbus-user.talk org.gnome.OnlineAccounts dbus-user.talk org.gnome.SettingsDaemon.Color dbus-system filter dbus-system.talk org.freedesktop.login1 dbus-user filter dbus.own com.github.dahenson.agenda dbus.talk ca.desrt.dconf dbus-system block
* | iagno profileLibravatar netblue302020-03-21
| |
* | Merge pull request #3275 from ↵Libravatar smitsohu2020-03-19
|\ \ | | | | | | | | | | | | dmfreemon/add-name-or-private-dir-to-xpra-window-title add name or private directory being used to the window title when xpra is being used
| * | handle malloc() failures; use gnu_basename() instead of basenaem()Libravatar dmfreemon@users.noreply.github.com2020-03-15
| | |
| * | add name or basename of private directory being used to the window title ↵Libravatar dmfreemon@users.noreply.github.com2020-03-10
| | | | | | | | | | | | when xpra is being used
* | | Merge branch 'master' of https://github.com/netblue30/firejailLibravatar netblue302020-03-19
|\ \ \
| * | | extend default.profileLibravatar rusty-snake2020-03-19
| | | |
| * | | harden baobab and gitgLibravatar rusty-snake2020-03-19
| | | |
* | | | new profiles: ripperx, sound-juicerLibravatar netblue302020-03-19
|/ / /
* | | various profile fixesLibravatar netblue302020-03-19
| | |
* | | apparmor support for bind, nslookup, hostLibravatar netblue302020-03-19
| | |
* | | fix readme.mdLibravatar netblue302020-03-19
| | |
* | | fix readme.mdLibravatar netblue302020-03-19
| | |
* | | profile statsLibravatar netblue302020-03-19
| | |
* | | misc fixesLibravatar rusty-snake2020-03-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | remove netfilter from profiles with net none allow Viber to use dig, dig is in its private-bin, so I assume that it need it. blacklist resolvectl which can also be used for dns lookups
* | | fix nslookup.profile headerLibravatar glitsj162020-03-19
| | |
* | | fix host.profile headerLibravatar glitsj162020-03-19
| | |
* | | nslookup, host profilesLibravatar netblue302020-03-18
| | |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-01 10:31:30 +0000