aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Add cargo.profileLibravatar rusty-snake2021-05-16
|
* Merge pull request #4278 from kmk3/rename-noautopulseLibravatar Kelvin M. Klann2021-05-16
|\ | | | | rename noautopulse to keep-config-pulse
| * rename arg_noautopulse var to arg_keep_config_pulseLibravatar Kelvin M. Klann2021-05-14
| |
| * rename noautopulse to keep-config-pulseLibravatar Kelvin M. Klann2021-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * add the keep-config-pulse option * make noautopulse an alias for keep-config-pulse * deprecate the noautopulse option * misc: fix indentation of --keep-dev-shm on src/firejail/usage.c Even though noautopulse is not intended for hardening, it looks like it is, because it starts with "no", just like no3d, noroot, etc). In fact, it is the only "no" option that differs in such a way. And it has been accidentally misused as such before; see PR #4269 and commit e4beaeaa8 ("drop noautopulse from agetpkg"). So effectively rename it to keep-config-pulse in order to avoid confusion. This is similar to the keep-var-tmp and keep-dev-shm options, which are used to "leave a path alone", just like noautopulse. Note: The changes on this patch are based on the ones from commit 617ff40c9 ("add --noautopulse arg for complex pulse setups") / PR #1854. See #4269 for the discussion.
* | O_CLOEXEC follow-upLibravatar smitsohu2021-05-16
| |
* | utmp follow-upLibravatar smitsohu2021-05-16
| | | | | | | | | | | | | | Cosmetics, align RUN_UTMP_FILE open flags with others in 825ac9cdc38c4285584e69d6f29102b149914dfe Fix fslogger
* | fix firemon signal handler - #4274Libravatar smitsohu2021-05-16
| |
* | fix utmp error messageLibravatar smitsohu2021-05-16
| |
* | open files O_CLOEXEC|O_EXCLLibravatar smitsohu2021-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | Dumb patch that adds O_CLOEXEC to all open/fopen calls, even where it is obviously pointless. While at it, also add O_EXCL where it might be considered useful, for example to clear Coverity warnings, or on files that subsequently are used to configure a join sandbox. Pure defense in depth, this patch should have no observable effects.
* | Update disable-common.incLibravatar rusty-snake2021-05-16
| | | | | | | | Make ${HOME}/.rustup read-only and blacklist ${HOME}/.cargo/credentials.toml
* | Add read-write to profile.templateLibravatar rusty-snake2021-05-16
| |
* | Add noinput to usage.c and _firejail.inLibravatar rusty-snake2021-05-16
|/
* CI: build with clang 11 (#4277)Libravatar Reiner Herrmann2021-05-14
|
* fix: discord logout on opening twiceLibravatar sak962021-05-14
|
* Harden device access in default.profileLibravatar rusty-snake2021-05-14
|
* check if allocation was successfulLibravatar Reiner Herrmann2021-05-13
| | | | See #4274
* Follow-up for #4165 (#4271)Libravatar glitsj162021-05-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * Follow-up for #4165 * fix noroot comment As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630981737). * fix dbus-user comment As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630982527). * fix private-dev comment As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630980029). * fix private-etc comment As suggested [here](https://github.com/netblue30/firejail/pull/4271#discussion_r630979698). * move writable-var comment cfr. profile.template
* Manpage fixesLibravatar rusty-snake2021-05-13
| | | | Subdirs for private-etc has been implemented since 6ebe8925.
* Update profile.templateLibravatar rusty-snake2021-05-13
| | | | Clarify some options that supersede others.
* Add noinput to browsers as wellLibravatar rusty-snake2021-05-13
| | | | Profiles with private-dev behind BROWSER_DISABLE_U2F were missed by 0cee0ba5.
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar netblue302021-05-12
|\
| * tests: adjust expected values of --build testLibravatar Reiner Herrmann2021-05-12
| |
* | force --noautopulse when running --noprofile in order to leave ↵Libravatar netblue302021-05-12
|/ | | | ~/.config/pulse directory unchanged
* more --buildLibravatar netblue302021-05-12
|
* Update dino.profileLibravatar Tad2021-05-11
| | | | It now features audio/video calling.
* drop noautopulse from agetpkgLibravatar glitsj162021-05-11
| | | It's a workaround option, not to be used in any profile by default. Thanks to @rusty-snake for pointing that out.
* Merge pull request #4259 from kmk3/contrib-vim-add-missing-noinputLibravatar Kelvin M. Klann2021-05-11
|\ | | | | contrib/vim: add missing noinput command to syn match
| * contrib/vim: add missing noinput command to syn matchLibravatar Kelvin M. Klann2021-05-07
| | | | | | | | | | | | | | | | | | Added on commit a90386d77 ("Map /dev/input with "--private-dev", add "--no-input" option to disable it") / PR #4209. See also commit 0cee0ba5a ("Add noinput to all profiles with private-dev") / PR #4239. Misc: I noticed that it was missing due to the lack of syntax highlighting on etc/profile-m-z/webstorm.profile.
* | tests: adjust expected values of --build testLibravatar Reiner Herrmann2021-05-10
| | | | | | | | Fixes #4256
* | Fix bijibenLibravatar rusty-snake2021-05-08
| | | | | | | | | | | | | | | | bijiben crashes without access to /usr/share/tracker3 in Fedora 34 with: ** (bijiben:14): WARNING **: 21:48:08.394: Unable to connect to Tracker: 'file:///usr/share/tracker3/ontologies/nepomuk' is not a ontology location ** (bijiben:14): WARNING **: 21:48:08.394: Cannot initialize BijiManager: 'file:///usr/share/tracker3/ontologies/nepomuk' is not a ontology location
* | Node.js stack refactoring (#4255)Libravatar glitsj162021-05-08
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Create node.profile * Create node-gyp.profile * refactor npm as redirect * Create npx.profile * Create nvm.profile * Create semver.profile * refactor yarn as redirect * collect node.js stack configuration in common profile * add ~/.nvm to node section * account for node-gyp python dependency * read-only ~/.nvm for node.js stack * blacklist ~/.nvm for node.js stack * move env var comment cfr. profile.template * Delete node-gyp.profile node-gyp is a shell script with a node shebang. We've got that covered via node.profile. * Delete npx.profile npx is a shell script with a node shebang. We've got that covered via node.profile. * Delete semver.profile semver is a shell script that calls node. We've got that covered via node.profile. * add node and nvm to new profiles section
* revert comment changes from #4257 (#4258)Libravatar glitsj162021-05-07
| | | | | | | | | * revert comment changes from #4257 * revert comment changes from #4257 * revert comment changes from #4257 * revert comment changes from #4257
* read-write fixes (#4257)Libravatar glitsj162021-05-07
| | | | | | | | | * [comment] use 'read-write' instead of 'ignore read-only' * [comment] use 'read-write' instead of 'ignore read-only' * [comment] use 'read-write' instead of 'ignore read-only' * [comment] use 'read-write' instead of 'ignore read-only'
* Merge pull request #4251 from pirate486743186/patch-2Libravatar glitsj162021-05-07
|\ | | | | whitelist /var/lib/aspell in whitelist-var-common.inc
| * whitelist /var/lib/aspellLibravatar pirate4867431862021-05-06
| |
* | pluma broken with memory-deny-write-executeLibravatar pirate4867431862021-05-07
|/
* more --buildLibravatar netblue302021-05-06
|
* some wireshark hardening (#4245)Libravatar glitsj162021-05-05
| | | | | * restrict D-Bus access in wireshark * add private-cache to wireshark
* Merge pull request #4242 from aminvakil/wireshark_seccomp_disableLibravatar Reiner Herrmann2021-05-05
|\ | | | | Disable seccomp in wireshark profile
| * Disable seccomp in wireshark profileLibravatar Amin Vakil2021-05-05
| |
* | Stying fixes (mrrescue.profile, pingus.profile, profile.template)Libravatar rusty-snake2021-05-05
| |
* | steam.profile: Allow input devicesLibravatar rusty-snake2021-05-05
| |
* | Add noinput to all profiles with private-devLibravatar rusty-snake2021-05-05
| |
* | mergeLibravatar netblue302021-05-04
|\|
| * Merge pull request #4240 from netblue30/chromium-webextLibravatar Reiner Herrmann2021-05-04
| |\ | | | | | | profiles: whitelist mozilla (webext) extensions in chromium profile
| | * profiles: whitelist mozilla (webext) extensions in chromium profileLibravatar Reiner Herrmann2021-05-04
| |/
| * Update RELNOTESLibravatar rusty-snake2021-05-04
| |
* | --build fixesLibravatar netblue302021-05-04
|/
* Merge pull request #4209 from ↵Libravatar netblue302021-05-04
|\ | | | | | | | | davidebeatrici/private-dev-input-support-and-noinput-option Map /dev/input with "--private-dev", add "--no-input" option to disable it
| * Map /dev/input with "--private-dev", add "--no-input" option to disable itLibravatar Davide Beatrici2021-04-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default only joystick devices ("/dev/input/js*") can be accessed. At least, that's the case on Debian: the other entries have more restrictive permissions. The original owner and group are "root" and "input", respectively. However, until we have granular input control options, allowing access to joysticks only is better than nothing. $ ls -l /dev total 0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 cdrom -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 cdrw -> /dev/sr0 drwxr-xr-x 3 nobody nogroup 100 22 apr 19.18 dri lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 dvd -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 dvdrw -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 13 23 apr 07.22 fd -> /proc/self/fd crw-rw-rw- 1 nobody nogroup 1, 7 23 apr 07.22 full crw-rw----+ 1 nobody nogroup 244, 0 22 apr 19.18 hidraw0 crw-rw----+ 1 nobody nogroup 244, 1 22 apr 19.18 hidraw1 crw-rw----+ 1 nobody nogroup 244, 2 22 apr 19.18 hidraw2 crw-rw----+ 1 nobody nogroup 244, 3 22 apr 19.18 hidraw3 crw-rw----+ 1 nobody nogroup 244, 4 22 apr 19.18 hidraw4 crw-rw----+ 1 nobody nogroup 244, 5 22 apr 19.18 hidraw5 drwxr-xr-x 4 nobody nogroup 760 23 apr 07.22 input srw-rw-rw- 1 nobody nogroup 0 22 apr 19.18 log crw-rw-rw- 1 nobody nogroup 1, 3 23 apr 07.22 null lrwxrwxrwx 1 nobody nogroup 13 23 apr 07.22 ptmx -> /dev/pts/ptmx drwxr-xr-x 2 nobody nogroup 0 23 apr 07.22 pts crw-rw-rw- 1 nobody nogroup 1, 8 23 apr 07.22 random drwxrwxrwt 2 nobody nogroup 40 23 apr 07.22 shm drwxr-xr-x 4 nobody nogroup 500 22 apr 19.18 snd brw-rw----+ 1 nobody nogroup 11, 0 23 apr 00.24 sr0 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stderr -> /proc/self/fd/2 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stdin -> /proc/self/fd/0 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stdout -> /proc/self/fd/1 crw-rw-rw- 1 nobody nogroup 5, 0 23 apr 07.22 tty crw-rw-rw- 1 nobody nogroup 1, 9 23 apr 07.22 urandom drwxr-xr-x 2 nobody nogroup 120 22 apr 19.18 usb crw-rw----+ 1 nobody video 81, 0 22 apr 19.18 video0 crw-rw----+ 1 nobody video 81, 1 22 apr 19.18 video1 crw-rw----+ 1 nobody video 81, 2 22 apr 19.18 video2 crw-rw----+ 1 nobody video 81, 3 22 apr 19.18 video3 crw-rw-rw- 1 nobody nogroup 1, 5 23 apr 07.22 zero $ ls -l /dev/input total 0 drwxr-xr-x 2 nobody nogroup 280 23 apr 07.22 by-id drwxr-xr-x 2 nobody nogroup 300 23 apr 07.22 by-path crw-rw---- 1 nobody nogroup 13, 64 22 apr 19.18 event0 crw-rw---- 1 nobody nogroup 13, 65 22 apr 19.18 event1 crw-rw---- 1 nobody nogroup 13, 74 22 apr 19.18 event10 crw-rw---- 1 nobody nogroup 13, 75 22 apr 19.18 event11 crw-rw---- 1 nobody nogroup 13, 76 22 apr 19.18 event12 crw-rw---- 1 nobody nogroup 13, 77 22 apr 19.18 event13 crw-rw---- 1 nobody nogroup 13, 78 22 apr 19.18 event14 crw-rw---- 1 nobody nogroup 13, 79 22 apr 19.18 event15 crw-rw---- 1 nobody nogroup 13, 80 22 apr 19.18 event16 crw-rw---- 1 nobody nogroup 13, 81 22 apr 19.18 event17 crw-rw---- 1 nobody nogroup 13, 82 22 apr 19.18 event18 crw-rw---- 1 nobody nogroup 13, 83 22 apr 19.18 event19 crw-rw---- 1 nobody nogroup 13, 66 22 apr 19.18 event2 crw-rw---- 1 nobody nogroup 13, 84 22 apr 19.18 event20 crw-rw---- 1 nobody nogroup 13, 85 22 apr 19.18 event21 crw-rw---- 1 nobody nogroup 13, 86 22 apr 19.18 event22 crw-rw---- 1 nobody nogroup 13, 87 22 apr 19.18 event23 crw-rw---- 1 nobody nogroup 13, 88 22 apr 19.18 event24 crw-rw---- 1 nobody nogroup 13, 89 22 apr 19.18 event25 crw-rw---- 1 nobody nogroup 13, 90 22 apr 19.18 event26 crw-rw---- 1 nobody nogroup 13, 91 22 apr 19.18 event27 crw-rw----+ 1 nobody nogroup 13, 92 23 apr 07.22 event28 crw-rw---- 1 nobody nogroup 13, 67 22 apr 19.18 event3 crw-rw---- 1 nobody nogroup 13, 68 22 apr 19.18 event4 crw-rw---- 1 nobody nogroup 13, 69 22 apr 19.18 event5 crw-rw---- 1 nobody nogroup 13, 70 22 apr 19.18 event6 crw-rw---- 1 nobody nogroup 13, 71 22 apr 19.18 event7 crw-rw---- 1 nobody nogroup 13, 72 22 apr 19.18 event8 crw-rw---- 1 nobody nogroup 13, 73 22 apr 19.18 event9 crw-rw-r-- 1 nobody nogroup 13, 0 22 apr 19.18 js0 crw-rw-r--+ 1 nobody nogroup 13, 1 23 apr 07.22 js1 crw-rw---- 1 nobody nogroup 13, 63 22 apr 19.18 mice crw-rw---- 1 nobody nogroup 13, 32 22 apr 19.18 mouse0 crw-rw---- 1 nobody nogroup 13, 33 22 apr 19.18 mouse1 $ ls -l /dev/input/by-id total 0 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-event-if01 -> ../event9 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-event-kbd -> ../event8 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-BY_Tech_Usb-if01-event-kbd -> ../event11 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-BY_Tech_Usb-if01-event-mouse -> ../event12 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-if01-mouse -> ../mouse1 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-event-if01 -> ../event5 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-event-mouse -> ../event2 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-if01-event-kbd -> ../event3 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-mouse -> ../mouse0 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-Sonix_Technology_Co.__Ltd._H264_USB_Camera_SN0001-event-if00 -> ../event27 lrwxrwxrwx 1 nobody nogroup 10 23 apr 07.22 usb-ZEROPLUS_Controller_3136303033313032354246323543-event-joystick -> ../event28 lrwxrwxrwx 1 nobody nogroup 6 23 apr 07.22 usb-ZEROPLUS_Controller_3136303033313032354246323543-joystick -> ../js1 $ ls -l /dev/input/by-path total 0 lrwxrwxrwx 1 nobody nogroup 10 23 apr 07.22 pci-0000:05:00.1-usb-0:6.1:1.0-event-joystick -> ../event28 lrwxrwxrwx 1 nobody nogroup 6 23 apr 07.22 pci-0000:05:00.1-usb-0:6.1:1.0-joystick -> ../js1 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.0-event-mouse -> ../event2 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.0-mouse -> ../mouse0 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.1-event -> ../event5 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.1-event-kbd -> ../event3 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.0-event-kbd -> ../event8 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event -> ../event9 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event-kbd -> ../event11 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event-mouse -> ../event12 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-mouse -> ../mouse1 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:0c:00.3-usb-0:4:1.0-event -> ../event27 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 platform-pcspkr-event-spkr -> ../event13
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-07 21:45:27 +0000