aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* build: remove redundant clean commandsLibravatar Kelvin M. Klann2024-01-31
|
* build: sort clean commandsLibravatar Kelvin M. Klann2024-01-31
|
* tesseract.profile: add quiet (#6173)Libravatar Kelvin M. Klann2024-01-31
| | | | | | | | | Tesseract is a CLI program and its output may be parsed by other programs (such as `ocrmypdf`). Including messages from firejail in the output may break the parsing, so remove them. Fixes #6171. Reported-by: @kmille
* bugfix: print version to stderr on startup (#6172)Libravatar Kelvin M. Klann2024-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | Unlike the rest of the normal startup output (which goes to stderr), the version number is being printed to stdout, which makes it harder to ignore all of firejail's output. Example: $ firejail --noprofile /usr/bin/true --version 2>/dev/null firejail version 0.9.73 true (GNU coreutils) 9.4 Copyright (C) 2023 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Written by Jim Meyering. So make the normal startup version output go to stderr and keep the other occurrences (such as in `firejail --version`) going to stdout, to make it easier to grep things in the output. Added on commit f019f0ec3 ("Print version on startup for firejail/firecfg", 2023-05-11) / PR #5829. Reported by @rusty-snake[1]. [1] https://github.com/netblue30/firejail/issues/6171#issuecomment-1912768721
* RELNOTES: add feature and build itemsLibravatar Kelvin M. Klann2024-01-29
| | | | Relates to #5269 #6164.
* Merge pull request #6164 from kmk3/build-header-depfilesLibravatar Kelvin M. Klann2024-01-30
|\ | | | | build: automatically generate header dependencies
| * build: automatically generate header dependenciesLibravatar Kelvin M. Klann2024-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of manually specifying which source files depend on which headers, use compiler flags to automatically generate depfiles (.d), which declare the correct header (make) dependencies for each source file (.c). Use `-MMD` (which ignores system headers) to generate the dependencies and `-MP` to prevent make from complaining when a header file is removed while it is listed as a dependency in a depfile. If depfiles exist, just include them. If not, make each object file (.o) unconditionally depend on all header files in its source directory and in src/include, to ensure that rebuilds are done when needed. The latter case applies to the first build after `make clean` (which would build everything anyway) and when the compiler does not support generating depfiles. Note that both gcc and clang have supported these options for a long time. Misc: This depends on the changes from commit 5b1bd33c7 ("build: use full paths on compile/link targets", 2023-07-02) / PR #6158 to avoid issues with make dependency tracking.
| * build: move EXTRA vars directly into targetsLibravatar Kelvin M. Klann2024-01-22
| |
* | build(deps): bump github/codeql-action from 3.23.1 to 3.23.2Libravatar dependabot[bot]2024-01-29
|/ | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.23.1 to 3.23.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/0b21cf2492b6b02c465a3e5d7c473717ad7721ba...b7bf0a3ed3ecfa44160715d7c442788f65f0f923) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump github/codeql-action from 3.23.0 to 3.23.1Libravatar dependabot[bot]2024-01-22
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.23.0 to 3.23.1. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e5f05b81d5b6ff8cfa111c80c22c5fd02a384118...0b21cf2492b6b02c465a3e5d7c473717ad7721ba) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* RELNOTES: add feature and build itemsLibravatar Kelvin M. Klann2024-01-20
| | | | Relates to #5245 #6153 #6158 #6159.
* Merge pull request #6158 from kmk3/build-use-full-pathsLibravatar Kelvin M. Klann2024-01-20
|\ | | | | build: use full paths on compile/link targets
| * build: use full paths on compile/link targetsLibravatar Kelvin M. Klann2024-01-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes the compile commands clearer when building in parallel (with `make -j`) and ensures that `__FILE__` includes the full build-time path (relative to the root of the repository) whenever it is referenced, such as in failed assert() messages (currently the full path is only shown in errExit() messages). Example: Before: firejail: main.c:100: main: Assertion `1 == 2' failed. Error src/firecfg/main.c:100: main: malloc: Cannot allocate memory After: firejail: ../../src/firejail/main.c:100: main: Assertion `1 == 2' failed. Error ../../src/firecfg/main.c:100: main: malloc: Cannot allocate memory Commands used to search and replace: $ git grep -Ilz '^MOD_DIR =' -- '*Makefile' | xargs -0 -I '{}' \ sh -c "printf '%s\n' \"\$(sed -E \ -e 's|^MOD_DIR = src/(.*)|MOD = \\1\\nMOD_DIR = \$(ROOT)/src/\$(MOD)|' \ -e 's:^(PROG|SO) = [^.]+(\.so)?$:\\1 = \$(MOD_DIR)/\$(MOD)\2:' \ '{}')\" >'{}'" $ git grep -Ilz '^HDRS :=' -- '*.mk' | xargs -0 -I '{}' \ sh -c "printf '%s\n' \"\$(sed -E \ -e 's|wildcard (\*\..)|wildcard \$(MOD_DIR)/\\1|' '{}')\" >'{}'" Note: config.mk.in, src/fnettrace/Makefile and src/include/common.h were edited manually. This is a follow-up to #5871.
| * modif: Change errExit msg format to match assertLibravatar Kelvin M. Klann2024-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Make it more similar to the assert() message format for consistency. Example: Before: firejail: main.c:100: main: Assertion `1 == 2' failed. Error src/firecfg/main.c:100 main(): malloc: Cannot allocate memory After: firejail: main.c:100: main: Assertion `1 == 2' failed. Error src/firecfg/main.c:100: main: malloc: Cannot allocate memory This amends commit b963fe41a ("Improve errExit error messages", 2023-06-16) / PR #5871.
* | Merge pull request #6159 from kmk3/build-use-cppflagsLibravatar Kelvin M. Klann2024-01-20
|\ \ | | | | | | build: use CPPFLAGS instead of INCLUDE in compile targets
| * | build: use CPPFLAGS instead of INCLUDE in compile targetsLibravatar Kelvin M. Klann2024-01-17
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With this, CFLAGS and CPPFLAGS are used when compiling and LDFLAGS when linking, just like in the built-in GNU make rules. From `make -p`: COMPILE.c = $(CC) $(CFLAGS) $(CPPFLAGS) $(TARGET_ARCH) -c LINK.c = $(CC) $(CFLAGS) $(CPPFLAGS) $(LDFLAGS) $(TARGET_ARCH) LINK.o = $(CC) $(LDFLAGS) $(TARGET_ARCH) Note: It is unclear where the `INCLUDE` variable comes from; it is not documented in autoconf nor GNU make and automake (which itself is not used in this repository) only mentions `INCLUDES`: `INCLUDES` This does the same job as `AM_CPPFLAGS` (or any per-target `_CPPFLAGS` variable if it is used). It is an older name for the same functionality. This variable is deprecated; we suggest using `AM_CPPFLAGS` and per-target `_CPPFLAGS` instead. Environment: automake 1.16.5-2 and GNU make 4.4.1 on Artix Linux. See also commit 671c3f249 ("build: actually set LDFLAGS and LIBS in makefiles", 2022-11-30) / PR #5504.
* | Merge pull request #6153 from kmk3/firecfg-ignorelist-extraLibravatar Kelvin M. Klann2024-01-19
|\ \ | | | | | | firecfg: use ignorelist also for .profile/.desktop files
| * | firecfg: use ignorelist also for .desktop filesLibravatar Kelvin M. Klann2024-01-11
| | | | | | | | | | | | | | | | | | Closes #5245. Relates to #5876.
| * | firecfg: use filename var earlierLibravatar Kelvin M. Klann2024-01-11
| | | | | | | | | | | | And make it const.
| * | firecfg: refactor config parse functionsLibravatar Kelvin M. Klann2024-01-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Export `in_ignorelist` function * Allow only building the ignorelist without setting the symlinks * Rename the functions to reflect the above * Add a function that parses all config files (`parse_config_all`) Also, make sure that `parse_config_all` only parses config files once, even if called multiple times. Relates to #5876.
| * | firecfg: use ignorelist also for .profile filesLibravatar Kelvin M. Klann2024-01-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently it is only used when parsing the configuration files: * /etc/firecfg.d/*.conf * /etc/firecfg.config Use it when searching for profile filenames as well: * ~/.config/firejail/*.profile Relates to #5876.
* | | profiles: add profiles for gtk youtube viewers symlinks (#6154)Libravatar pirate4867431862024-01-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | Committer note: For each profile there is both XXX-gtk and gtk-XXX (such as lbry-viewer-gtk and gtk-lbry-viewer). XXX-gtk is the symlink gtk-XXX is the actual file Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* | | lobster.profile: allow basename (#6155)Libravatar pirate4867431862024-01-19
| |/ |/| | | Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* | build(deps): bump github/codeql-action from 3.22.12 to 3.23.0Libravatar dependabot[bot]2024-01-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.22.12 to 3.23.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/012739e5082ff0c22ca6d6ab32e07c36df03c4a4...e5f05b81d5b6ff8cfa111c80c22c5fd02a384118) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
* | update copyright 2024Libravatar netblue302024-01-12
|/
* profiles: use only /usr/share/lua* (#6150)Libravatar Kelvin M. Klann2024-01-08
| | | | | | | | | | | | | | | | | | To ensure that it includes luajit paths as well: * /usr/share/lua * /usr/share/luajit-2.1 And remove all entries of the same path without the wildcard, to avoid redundancy. Misc: The wildcard entries were added on commit 56b60dfd0 ("additional Lua blacklisting (#3246)", 2020-02-24) and the entries without the wildcard were partially removed on commit 721a984a5 ("Fix Lua in disable-interpreters.inc", 2020-02-24). This is a follow-up to #6128. Reported-by: @pirate486743186
* disable-devel.inc: deduplicate g++ and gcc entriesLibravatar Kelvin M. Klann2024-01-05
| | | | | Added on commit 2d8ff695a ("WIP: Blacklist common programming interpreters. (#1837)", 2018-04-02).
* build(deps): bump github/codeql-action from 3.22.11 to 3.22.12Libravatar dependabot[bot]2024-01-04
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.22.11 to 3.22.12. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/b374143c1149a9115d881581d29b8390bbcbb59c...012739e5082ff0c22ca6d6ab32e07c36df03c4a4) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* RELNOTES: add feature itemsLibravatar Kelvin M. Klann2024-01-03
| | | | Relates to #2097 #5876 #6032 #6078 #6109 #6115 #6125.
* man: allow Perl (#6143)Libravatar glitsj162024-01-04
| | | gropdf (`man -Tpdf`) needs Perl (see #6142).
* RELNOTES: add build and ci itemsLibravatar Kelvin M. Klann2024-01-03
| | | | Relates to #6104 #6126.
* RELNOTES: remove xauth modif itemLibravatar Kelvin M. Klann2024-01-03
| | | | | | | Reverted by commit 8f33e7284 ("Revert "Lookup xauth in PATH."", 2023-12-13) / PR #6129. Relates to #6006 #6087.
* RELNOTES: sort/rename removal itemLibravatar Kelvin M. Klann2024-01-03
| | | | | | | For consistency; see the RELNOTES of version 0.9.68. Added on commit db09546f2 ("remove LTS and FIRETUNNEL support", 2023-12-23).
* remove LTS and FIRETUNNEL supportLibravatar netblue302023-12-23
|
* fix cppcheckLibravatar netblue302023-12-23
|
* fix /usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games macro initLibravatar netblue302023-12-22
|
* landlock: add support for PATH macroLibravatar netblue302023-12-22
|
* landlock: small fixesLibravatar netblue302023-12-22
|
* mergesLibravatar netblue302023-12-21
|
* Merge pull request #6129 from kmk3/revert-lookup-xauthLibravatar netblue302023-12-21
|\ | | | | Revert "Lookup xauth in PATH."
| * Revert "Lookup xauth in PATH."Libravatar Kelvin M. Klann2023-12-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 407c05ebefe23e725f858b6170b3e52659e044a2. If --private-lib is used (and firejail is configured with --enable-private-lib), the following error occurs: $ firejail --quiet --noprofile --private-lib true firejail: fs_lib.c:56: find_in_path: Assertion `geteuid() != 0' failed. Error: proc 10000 cannot sync with peer: unexpected EOF Peer 10001 unexpectedly killed (Segmentation fault) Given that it causes an uid assertion failure, the logic appears to not be correct and the current behavior may be unsafe, so for now revert that commit until the issue is properly addressed. Relates to #6006 #6087. Fixes #6113.
* | Merge pull request #6128 from pirate486743186/masterLibravatar netblue302023-12-21
|\ \ | | | | | | mpv: whitelist /usr/share/mpv
| * | mpv: whitelist /usr/share/mpvLibravatar pirate4867431862023-12-13
| |/ | | | | | | | | | | Use case: You install scripts in `/usr/share/mpv` but they remain inactive. You then symlink them to `/etc/mpv` to activate them if you want.
* | Merge pull request #6126 from kmk3/build-mkrpm-append-argsLibravatar netblue302023-12-21
|\ \ | | | | | | build: mkrpm.sh: append instead of override configure args
| * | build: mkrpm.sh: append instead of override configure argsLibravatar Kelvin M. Klann2023-12-13
| |/ | | | | | | | | | | | | | | | | | | | | | | For consistency with mkdeb.sh. Note: The default arguments and support for argument overriding was added to to mkrpm.sh on commit 3d97332fd ("Add configure options when building rpm (#3422)", 2020-05-19). The support for appending arguments was added to mkdeb.sh on commit 9a0fbbd71 ("mkdeb.sh.in: pass remaining arguments to ./configure", 2022-05-13) / PR #5154.
* | Merge pull request #6125 from kmk3/landlock-enforceLibravatar netblue302023-12-21
|\ \ | | | | | | landlock: move commands into profile and add landlock.enforce
| * | landlock: move commands into profile and add landlock.enforceLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Move commands from --landlock and --landlock.proc= into etc/inc/landlock-common.inc * Remove --landlock and --landlock.proc= * Add --landlock.enforce Instead of hard-coding the default commands (and having a separate command just for /proc), move them into a dedicated profile to make it easier for users to interact with the entries (view, copy, add ignore entries, etc). Only enforce the Landlock commands if --landlock.enforce is supplied. This allows safely adding Landlock commands to (upstream) profiles while keeping their enforcement opt-in. It also makes it simpler to effectively disable all Landlock commands, by using `--ignore=landlock.enforce`. Relates to #6078.
| * | landlock: avoid landlock syscalls before ll_restrictLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | | | | | | | | | | | | | | | Avoid checking if Landlock is supported in ll_add_profile(), as it may result in a warning being printed in ll_is_supported() in the next commit. Relates to #6078.
| * | landlock: sort --landlock commandsLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | | | Relates to #6078.
| * | landlock: expand simple macros in commandsLibravatar Kelvin M. Klann2023-12-11
| |/ | | | | | | | | | | | | This includes macros such as `${HOME}` and `${RUNUSER}`, but not `${PATH}`, which may expand to multiple strings. Relates to #6078.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-06 14:45:41 +0000