| Commit message (Collapse) | Author | Age |
|---|
| ... | |
| | | |
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* Add profile for npm
* Apply suggestions from code review
* Remove redundant blacklisting of Wayland.
* Remove unnecessary noblacklist lines for nodejs.
* Replace absolute paths to .inc files with filenames.
* Remove unneeded dbus whitelisting.
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Remove empty line
To keep consistent with other profiles, remove the blank line after the header comment.
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Add npm files to add-common-devel
So that our addition of npm paths to disable-programs.inc dose not break IDEs,
we need to unblacklist these same paths in allow-common-devel.inc.
* Remove extra blank line
* Add common whitelist includes to npm profile
* Tighten npm profile
Include disable-exec.inc, but allowing ${HOME}.
* Remove whitelist-common.inc from npm profile
whitelist-common breaks npm, and since we don't know where the user's npm
projects will be, leave the whitelist-common include in a comment with a note
about how to enable it for their setup.
* Fix inverted commands
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Fixes for whitelisting
* Add login.defs to npm profile's private-etc
Co-authored-by: Aidan Gauland <aidalgol+git@fastmail.net>
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
|
| | |
| |
| |
| | |
closes #3237
|
| | | |
|
| | | |
|
| | |
| |
| |
| |
| | |
* drop doubled netfilter in atom.profile
* drop doubled disable-mnt in tutanota-desktop.profile
|
| | |
| |
| |
| |
| |
| |
| | |
* harden liferea
* dbus fixes
On closer investigation it seems wiser to tighten D-Bus filtering as Liferea implements stuff via plugins that are disabled by default.
|
| | |
| |
| |
| | |
avoids creating holes in the basic read-only filesystem
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
* don't mess with umask of root, it could be more strict
than user umask and relaxing it may catch root by surprise
* join needs execveat syscall, need to drop it post-exec
* make things more explicit
|
| | | |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
* new profile: tutanota-desktop
* add tutanota-desktop to firecfg
* blacklist tutanota-desktop files
* Create tutanota-desktop.profile
|
| |/ |
|
| |
|
|
|
|
|
| |
* fix #3859
* fix #3859
* fix #3859
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
* really fix running kernel config check
archiver-common.inc includes `disable-shell.inc`, breaking
$ zcat /proc/config.gz
Cannot start application: Permission denied
* really fix running kernel config check
archiver-common.inc includes `disable-shell.inc`, breaking
$ zgrep -c "CONFIG_USER_NS=y" /proc/config.gz
Cannot start application: Permission denied
|
| |\
| |
| | |
keepassxc.profile: Fix hang due to seccomp
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
With the current profile, keepassxc hangs on startup, before showing the
main window:
$ uname -r -m
5.9.1-artix1-1 x86_64
$ firejail --version | head -n 1
firejail version 0.9.64
$ firejail --quiet keepassxc --version
KeePassXC 2.6.2
$ firejail --quiet keepassxc
# (nothing happens)
^C
Seccomp debugging as explained on etc/templates/syscalls.txt:
$ sudo grep -Eo 'keepassxc.* syscall=[0-9]+' /var/log/messages.log | tail -n 1
keepassxc" exe="/usr/bin/keepassxc" sig=31 arch=c000003e syscall=303
$ firejail --debug-syscalls | grep 303
303 - name_to_handle_at
So allow the name_to_handle_at syscall.
Relates to #3549.
|
| |\ \
| | |
| | | |
join: add fexecve fallback for shells
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Allows users to join a sandbox and get a shell even
if there is none in the sandbox mount namespace.
There are few limitations:
1. This will fail with scripted shells (see man 3 fexecve for an explanation)
2. Shell process names are not user friendly
|
| |\ \ \
| | | |
| | | | |
Implement netns in profiles, closes #3846
|
| | | | | |
|
| |\ \ \ \
| | | | |
| | | | | |
Add profiles for MS Edge dev build for Linux and Librewolf
|
| | |\ \ \ \
| |/ / / /
|/| | | | |
|
| |\ \ \ \ \
| | | | | |
| | | | | | |
Small fixes
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
We do not start /bin/bash in the sandbox, we use $SHELL (which is
usually /bin/bash). See #3434 and #3844. This commit updates the
manpage accordingly until #3434 is resolved with a final solution like
using /bin/bash or /bin/sh as hardcoded default. Close #3844.
The descriptions of --join* are not updated as there is currenly some
work, see #2934 and #3850.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
- split notifications and tray
- fix tray policy
|
| |/ / / / /
| | | | |
| | | | | |
case is handled in guess_shell()
|
| | | | | | |
|
| |/ / / / |
|
| | | | | |
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
issue #3604
follow-up to a7607e423f3336f67daf2ec296414d55c6740f84
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
If firejail is the login shell, the SHELL environment variable
is set to the path of the firejail executable. This leads to execution of a
'firejail -l' command, but firejail inside the sandbox does
not know what to do with the -l option and just starts bash without
forwarding this option.
Fix this by not checking $SHELL when guessing which shell should be used.
run_no_sandbox(), which relies on reading the environment, runs before
setting the login_shell variable, and is not affected.
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
issue #3784
related commit 4bc92b8fd0a5c22c7d4c6f9323378501c60ff149
|
| |/ / / |
|
| | | | |
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
…on to chromium, remove the nowhlist from min and
its whlist from riot-web.
TODO: remove the 'ignore whitelist /usr/share/chomium' from the most
profiles with it.
|
| | | | |
|
| |\ \ \
| | | |
| | | | |
x11=none: don't fail on abstract socket if netns …
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
…is used.
fix #3838 -- --x11=none --netns=isolated invalidly errors on the abstract X11 socket being accessible
|
| | | | |
| | | |
| | | |
| | | | |
plus very minor cosmetic improvements
|
glitsj16
Aidan Gauland
smitsohu
rusty-snake
netblue30
Kelvin M. Klann
Reiner Herrmann
bbhtt