aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Fix seahorse-adventures + CILibravatar rusty-snake2021-06-04
|
* Better error message for jail_prober.py cli usageLibravatar rusty-snake2021-06-04
| | | | | | | | | | | | | | | | | | | Curerently sys.argv is accessed without checks, resulting in an IndexError: ``` Traceback (most recent call last): File "/home/rusty-snake/Projects/firejail/contrib/jail_prober.py", line 205, in <module> main() File "/home/rusty-snake/Projects/firejail/contrib/jail_prober.py", line 170, in main profile_path = sys.argv[1] IndexError: list index out of range ``` This commit catches this IndexError and prints a more helpfull message instaed: ``` USAGE: jail_prober.py <PROFILE-PATH> <PROGRAM> ```
* Merge pull request #4325 from florianbegusch/fbegusch-improve-jail_prober.pyLibravatar rusty-snake2021-06-04
|\ | | | | jail_prober: enable absolut include directives
| * jail_prober: enable absolut include directivesLibravatar Florian Begusch2021-06-03
| |
* | some profile fixes for Debian 10Libravatar netblue302021-06-03
| |
* | simplify X11 socket whitelistingLibravatar smitsohu2021-06-03
| |
* | Update profile.templateLibravatar rusty-snake2021-06-03
| | | | | | | | | | | | | | | | | | The header of profile.template define this order: IGNORES NOBLACKLISTS ALLOW INCLUDES BLACKLISTS DISABLE INCLUDES
* | kodi.profile: Add note for CEC AdaptersLibravatar rusty-snake2021-06-03
| | | | | | | | closes #4324
* | Fix slack.profile (fixes #4329)Libravatar rusty-snake2021-06-03
| |
* | Update manpage for whitelist2Libravatar rusty-snake2021-06-03
| |
* | Merge pull request #4327 from ordinary-dev/fix-telegram-profileLibravatar glitsj162021-06-03
|\ \ | |/ |/| Correct typo in telegram-desktop profile
| * Correct typo in telegram-desktop profileLibravatar Ivan Reshetnikov2021-06-03
|/
* version 0.9.66rc1 released0.9.66rc1Libravatar netblue302021-06-02
|
* Update README.md & RELNOTESLibravatar rusty-snake2021-05-31
|
* reorganizing links browsers (#4320)Libravatar pirate4867431862021-05-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Create links-common.profile * Update links.profile * Create links2.profile * Update links.profile * Update links2.profile * Update elinks.profile * Update elinks.profile * links2 * Update firecfg.config * Update xlinks.profile * .xlinks * add dbus and whitelist-usr-share-common * .xlinks doesn't exist * revert * Create xlinks2 * xlinks2 * Update xlinks2 * Update xlinks.profile * no wayland * no wayland * doesn't use /tmp/.X11-unix * doesn't use /tmp/.X11-unix * noblacklist /tmp/.X11-unix * noblacklist /tmp/.X11-unix
* --debug takes precedence over --quiet (#2743)Libravatar netblue302021-05-30
|
* fix fcoy error message (#2743)Libravatar netblue302021-05-30
|
* allow --debug if quite-by-default is set (#3125, #4168)Libravatar netblue302021-05-30
|
* Merge pull request #4318 from netblue30/vimLibravatar netblue302021-05-29
|\ | | | | Update vim syntax highlighting
| * vim: escape dots in seccomp.32Libravatar Reiner Herrmann2021-05-29
| |
| * vim: use setfiletype command for setting filetypeLibravatar Reiner Herrmann2021-05-29
| | | | | | | | | | this is a bit nicer, as it does not overwrite the filetype if it already has been set.
| * vim: use type instead of constant for seccomp actionLibravatar Reiner Herrmann2021-05-29
| |
| * vim: support commands private-cwd, dbus-*, seccomp.32, allow-debuggersLibravatar Reiner Herrmann2021-05-29
| |
| * vim: update conditionalsLibravatar Reiner Herrmann2021-05-29
| |
| * vim: update syscall groupsLibravatar Reiner Herrmann2021-05-29
| |
| * vim: highlight seccomp-error-actionLibravatar Reiner Herrmann2021-05-29
| |
| * vim: update list of syscallsLibravatar Reiner Herrmann2021-05-29
| |
* | Merge pull request #4287 from rusty-snake/restrict-usr-libexecLibravatar netblue302021-05-29
|\ \ | | | | | | Restrict /usr/libexec
| * | Restrict /usr/libexecLibravatar rusty-snake2021-05-29
| | |
* | | Merge pull request #4316 from kmk3/configure-improvementsLibravatar netblue302021-05-29
|\ \ \ | | | | | | | | Configure improvements
| * | | configure*: use cat instead of many echoesLibravatar Kelvin M. Klann2021-05-28
| | | | | | | | | | | | | | | | For simplicity and increased portability.
| * | | configure.ac: run autoupdate to fix autoconf warningLibravatar Kelvin M. Klann2021-05-28
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This fixes the following warning: $ autoconf configure.ac:306: warning: AC_OUTPUT should be used without arguments. configure.ac:306: You should run autoupdate. Environment: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q autoconf autoconf 2.71-1 Though keep `AC_PREREQ` at 2.68 (released on 2010-09-23[1]), as version 2.71 (which autoupdate automatically bumps to) is rather recent (released on 2021-01-28[2]) and the changes do not appear to require a version bump, as on `AC_INIT` it only adds some quotes, and the rest of the changes are consistent with the autoconf 2.68 manual. From Section 18.4, Obsolete Macros[3]: > — Macro: AC_OUTPUT ([file]..., [extra-cmds], [init-cmds]) > > The use of AC_OUTPUT with arguments is deprecated. This obsoleted > interface is equivalent to: > > AC_CONFIG_FILES(file...) > AC_CONFIG_COMMANDS([default], > extra-cmds, init-cmds) > AC_OUTPUT > > See AC_CONFIG_FILES, AC_CONFIG_COMMANDS, and AC_OUTPUT. Note: The usage of the above format has been present since the inception of configure.ac, on commit 137985136 ("Baseline firejail 0.9.28"). Misc: This is a continuation of #4293. [1] https://lists.gnu.org/archive/html/info-gnu/2010-09/msg00013.html [2] https://lists.gnu.org/archive/html/autoconf/2021-01/msg00126.html [3] https://www.gnu.org/software/autoconf/manual/autoconf-2.68/html_node/Obsolete-Macros.html#index-AC_005fOUTPUT-2058
* | | Fix #3823 -- Unable to start hexchat with firejailLibravatar rusty-snake2021-05-29
| | |
* | | fix crash during --shutdonwLibravatar netblue302021-05-29
| | |
* | | disable home dir whitelists when --private is presentLibravatar netblue302021-05-29
| |/ |/|
* | [minor] gunzip profile broken (#4317)Libravatar pirate4867431862021-05-29
|/ | | | | * ignore include disable-shell.inc * allow-bin-sh.inc
* reorganizing youtube-viewers (#4128)Libravatar pirate4867431862021-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Create youtube-viewers-common.profile * reorganising youtube viewers * rm globals * reorganise youtube viewers * adding pipe-viewer * adding gtk-pipe-viewer * xterm and youtube-dl cache * sort * Update youtube-viewers-common.profile * quiet * quiet * quiet * Update firecfg.config * rm vlc * rm invalid binary * noinput * rm whitelist-runuser-common.inc * rm whitelist-runuser-common.inc * rm whitelist-runuser-common.inc * whitelist-runuser-common.inc
* Merge pull request #4307 from slowpeek/masterLibravatar Reiner Herrmann2021-05-28
|\ | | | | Refine appimage example in docs
| * Refine appimage example in docsLibravatar slowpeek2021-05-26
| |
* | default gw fix - #4306Libravatar netblue302021-05-27
| |
* | remove dophin from firecfg.configLibravatar netblue302021-05-26
|/
* deprecated follow-symlink-as-user from firejail.configLibravatar netblue302021-05-26
|
* fix firejail startup raceLibravatar smitsohu2021-05-24
| | | | | | | | sandboxes can race to create RUN_RO_FILE in shared memory similiar to #1013 regression from 825ac9cdc38c4285584e69d6f29102b149914dfe
* Merge pull request #4302 from smitsohu/whitelist2Libravatar smitsohu2021-05-23
|\ | | | | Whitelist2 follow-up
| * whitelist testing (#4229, #4297, #4300)Libravatar smitsohu2021-05-23
| |
| * whitelist: following up #4229Libravatar smitsohu2021-05-23
| | | | | | | | | | | | | | | | | | | | | | | | besides some cosmetic tweaks, fixes --whitelist=/a/b where /a/b is a symbolic link to /a/c/d and c is the user home directory: create path as user and not as root. (going forward, a better and more comprehensive fix would be to prevent all mount point traversals in whitelist_mkpath, but it will take a bit of time to implement)
* | Merge pull request #4300 from netblue30/gcc11Libravatar smitsohu2021-05-23
|\ \ | | | | | | CI: build with GCC 11
| * | CI: build with GCC 11Libravatar Reiner Herrmann2021-05-23
|/ / | | | | | | | | | | | | | | | | this fixes a new false positive memory leak (#4297), but unfortunately opens a few new false positives (#4274). therefore let it ignore memleak checks for now, until the detection is a bit more stable in GCC. Fixes: #4274, #4297
* | Merge pull request #4293 from kmk3/configure-fix-portabilityLibravatar Reiner Herrmann2021-05-22
|\ \ | | | | | | configure*: fix build with non-bash /bin/sh
| * | configure*: fix build with non-bash /bin/shLibravatar Kelvin M. Klann2021-05-22
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The configure script happens to work if /bin/sh supports the non-POSIX "+=" operator (e.g.: bash) and fails otherwise (e.g.: dash). This usage first appeared on configure.ac on commit 66a476419 ("gcov support"), which is from 2016. If the --enable-apparmor flag is passed to ./configure (which is the default on Arch Linux), running `make` fails due to the missing -lapparmor LDFLAG. Thus, building firejail-git from the AUR does not work if /bin/sh is e.g.: dash. Errors when running the build commands below from makepkg: $ ./configure --prefix=/usr --enable-apparmor >/dev/null ./configure: 3174: EXTRA_CFLAGS+= -mindirect-branch=thunk: not found ./configure: 3246: EXTRA_CFLAGS+= -fstack-clash-protection: not found ./configure: 3282: EXTRA_CFLAGS+= -fstack-protector-strong: not found ./configure: 3518: EXTRA_CFLAGS+= : not found $ make >/dev/null /usr/bin/ld: apparmor.o: in function `apparmor_test': /tmp/firejail-git/src/firejail-git/src/jailcheck/apparmor.c:28: undefined reference to `aa_gettaskcon' collect2: error: ld returned 1 exit status make[1]: *** [Makefile:10: jailcheck] Error 1 make: *** [Makefile:42: src/jailcheck/jailcheck] Error 2 make: *** Waiting for unfinished jobs.... /usr/bin/ld: apparmor.o: in function `print_apparmor': /tmp/firejail-git/src/firejail-git/src/firemon/apparmor.c:28: undefined reference to `aa_gettaskcon' collect2: error: ld returned 1 exit status make[1]: *** [Makefile:10: firemon] Error 1 make: *** [Makefile:42: src/firemon/firemon] Error 2 /usr/bin/ld: join.o: in function `extract_apparmor': /tmp/firejail-git/src/firejail-git/src/firejail/join.c:65: undefined reference to `aa_is_enabled' /usr/bin/ld: sandbox.o: in function `set_apparmor': /tmp/firejail-git/src/firejail-git/src/firejail/sandbox.c:133: undefined reference to `aa_change_onexec' collect2: error: ld returned 1 exit status make[1]: *** [Makefile:10: firejail] Error 1 make: *** [Makefile:42: src/firejail/firejail] Error 2 Without the apparmor flag, the CFLAGS related to HAVE_SPECTRE do not get applied either, but `make` does not error out, so the problem is harder to detect in this case. Diff comparing the output of `./configure 2>&1` when running without and then with this patch: $ git --no-pager diff --no-index configure_current.log configure_patch.log diff --git a/configure_current.log b/configure_patch.log index f5e814f..099d836 100644 --- a/configure_current.log +++ b/configure_patch.log @@ -10,12 +10,9 @@ checking for gcc option to accept ISO C89... none needed checking for a BSD-compatible install... /usr/bin/install -c checking for ranlib... ranlib checking whether C compiler accepts -mindirect-branch=thunk... yes -./configure: 3174: EXTRA_CFLAGS+= -mindirect-branch=thunk: not found checking whether C compiler accepts -mretpoline... no checking whether C compiler accepts -fstack-clash-protection... yes -./configure: 3246: EXTRA_CFLAGS+= -fstack-clash-protection: not found checking whether C compiler accepts -fstack-protector-strong... yes -./configure: 3282: EXTRA_CFLAGS+= -fstack-protector-strong: not found checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for gawk... yes @@ -88,7 +85,7 @@ Configuration options: busybox workaround: no Spectre compiler patch: yes EXTRA_LDFLAGS: - EXTRA_CFLAGS: + EXTRA_CFLAGS: -mindirect-branch=thunk -fstack-clash-protection -fstack-protector-strong fatal warnings: Gcov instrumentation: Install contrib scripts: yes
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-28 16:51:03 +0000