aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* remove make deb and use make deb-apparmor to build packagesLibravatar netblue302022-12-19
|
* fixesLibravatar netblue302022-12-14
|
* Merge pull request #5523 from ↵Libravatar netblue302022-12-14
|\ | | | | | | | | netblue30/dependabot/github_actions/github/codeql-action-2.1.36 build(deps): bump github/codeql-action from 2.1.35 to 2.1.36
| * build(deps): bump github/codeql-action from 2.1.35 to 2.1.36dependabot/github_actions/github/codeql-action-2.1.36Libravatar dependabot[bot]2022-12-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.35 to 2.1.36. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/b2a92eb56d8cb930006a1c6ed86b0782dd8a4297...a669cc5936cc5e1b6a362ec1ff9e410dc570d190) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | Merge pull request #5522 from hknaack/avidemux-fixes-for-opensuseLibravatar netblue302022-12-14
|\ \ | | | | | | Avidemux tools support
| * | Add profile for avidemux3_jobs_qt5Libravatar Hartmut Knaack2022-12-13
| | | | | | | | | | | | | | | | | | | | | | | | Add a profile for the Qt5 GUI to process Avidemux jobs. Use a redirection to the avidemux3_qt5 profile to reuse translation files. The application needs to create a network socket on localhost and fails to run with protocol unix, so that entry in the default avidemux profile needs to be extended.
| * | Add profile for avidemux3_cliLibravatar Hartmut Knaack2022-12-12
| | | | | | | | | | | | | | | Add a profile for the command-line interface of Avidemux, which redirects to the existing avidemux profile.
| * | Avidemux: openSUSE-Packman fixesLibravatar Hartmut Knaack2022-12-12
| | | | | | | | | | | | | | | | | | The Avidemux project stores configuration profile data in ~/.avidemux6, while the package built by Packman-repositories for openSUSE patches it to use ~/.avidemux3 at the moment (at least for Avidemux 2.8).
| * | Add profile for avidemux3_qt5Libravatar Hartmut Knaack2022-12-12
| | | | | | | | | | | | Add a profile for the Qt5-GUI of Avidemux.
| * | Avidemux: add information from template profileLibravatar Hartmut Knaack2022-12-12
| | | | | | | | | | | | Add the information that file contents will be overwritten on updates.
* | | Add support for Qt6 (#5527)Libravatar glitsj162022-12-14
| | | | | | | | | | | | | | | * qbittorrent: add support for Qt6 * wusc: add support for Qt6
* | | Fix whitelisting for wusc (#5526)Libravatar glitsj162022-12-14
|/ / | | | | Overlooked [this comment](https://github.com/netblue30/firejail/pull/5389#discussion_r992471940) that pointed out a mistake I made.
* / clipit hardening (#5521)Libravatar glitsj162022-12-12
|/ | | | | | | * clipit hardening * clipit: fix hardening * clipit: add xdotool lib to private-lib
* small nettrace fixesLibravatar netblue302022-12-09
|
* Merge pull request #5504 from kmk3/build-cflags-improvementsLibravatar Kelvin M. Klann2022-12-09
|\ | | | | build: actually set LDFLAGS/LIBS & stop overriding CFLAGS/LDFLAGS
| * makefiles: stop overriding CFLAGS/LDFLAGSLibravatar Kelvin M. Klann2022-12-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the manual of GNU Automake (version 1.16.5)[1] [2]: > 3.6 Variables reserved for the user > > Some `Makefile` variables are reserved by the GNU Coding Standards for > the use of the "user"—the person building the package. For instance, > `CFLAGS` is one such variable. > > Sometimes package developers are tempted to set user variables such > as `CFLAGS` because it appears to make their job easier. However, the > package itself should never set a user variable, particularly not to > include switches that are required for proper compilation of the > package. Since these variables are documented as being for the > package builder, that person rightfully expects to be able to override > any of these variables at build time. > > To get around this problem, Automake introduces an > automake-specific shadow variable for each user flag variable. > (Shadow variables are not introduced for variables like `CC`, where > they would make no sense.) The shadow variable is named by prepending > `AM_` to the user variable's name. For instance, the shadow variable > for `YFLAGS` is `AM_YFLAGS`. The package maintainer—that is, the > author(s) of the `Makefile.am` and `configure.ac` files—may adjust > these shadow variables however necessary. > > Note Flag Variables Ordering::, for more discussion about these > variables and how they interact with per-target variables. See also the description of CFLAGS in the GNU Autoconf manual[3]. Note: We do not use automake (save for aclocal) nor generally follow the GNU Coding Standards, but the concept still applies. Also, the closest analogous in the project to the `AM_` prefix would currently likely be `EXTRA_`. [1] https://www.gnu.org/software/automake/manual/1.16.5/html_node/User-Variables.html [2] https://www.gnu.org/software/automake/manual/1.16.5/html_node/Flag-Variables-Ordering.html [3] https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Preset-Output-Variables.html
| * build: move library flags from EXTRA_LDFLAGS to LIBSLibravatar Kelvin M. Klann2022-12-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | LIBS is the variable that Autoconf uses to put library flags. From the manual of GNU Autoconf (version 2.69): > -- Variable: LDFLAGS > > [...] > > This variable's contents should contain options like '-s' and '-L' > that affect only the behavior of the linker. Please see the > explanation of 'CFLAGS' for what you can do if an option also > affects other phases of the compiler. > > Don't use this variable to pass library names ('-l') to the linker; > use 'LIBS' instead. > > -- Variable: LIBS > > '-l' options to pass to the linker. The default value is empty, > but some Autoconf macros may prepend extra libraries to this > variable if those libraries are found and provide necessary > functions, see *note Libraries::. 'configure' uses this variable > when linking programs to test for C, C++, Objective C, Objective > C++, Fortran, and Go features.
| * build: actually set LDFLAGS and LIBS in makefilesLibravatar Kelvin M. Klann2022-12-03
| | | | | | | | | | | | | | | | | | | | | | Both variables are used inside on src/prog.mk and src/so.mk, but they are not currently defined in any makefile, so their values cannot be substituted by ./configure. This means that the variables can be set when running make (such as with `make LDFLAGS=-Lfoo`), but changing them in configure.ac has no effect. The same applies when trying to set them when running ./configure (such as with `./configure LDFLAGS=-Lfoo`).
| * configure*: print CC and CFLAGSLibravatar Kelvin M. Klann2022-12-03
| | | | | | | | | | | | Currently, only EXTRA_CFLAGS and EXTRA_LDFLAGS are printed. See also the variables defined on config.mk.in.
* | private-etc: always reference 'alternatives' (#5517)Libravatar glitsj162022-12-09
| | | | | | | | | | | | | | | | | | * private-etc: always include 'alternatives' * private-etc: always include 'alternatives' * private-etc: always include 'alternatives' * private-etc: always include 'alternatives'
* | New profile: tesseract (#5516)Libravatar glitsj162022-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add firecfg support for tesseract * Add tesseract to 'New profiles' section in README.md * Create tesseract.profile * tesseract: fix private-etc * tesseract: fix XDG black/whitelisting * tesseract: use 'seccomp socket' instead of 'protocol unix' As kindly suggested by @rusty-snake. * tesseract: add 'restrict-namespaces' As kindly suggested by @rusty-snake. * tesseract: use full seccomp filtering The tesseract application works fine without 'protocol' or 'seccomp socket'.
* | sandbox.c: print the dir on failed chdir(cfg.homedir)Libravatar Kelvin M. Klann2022-12-09
| | | | | | | | | | | | | | | | Just like the other nearby error messages for `chdir`. Relates to #5510. Suggested-by: @gitsteff
* | Merge pull request #5498 from kmk3/spotify-allow-adblockLibravatar Kelvin M. Klann2022-12-08
|\ \ | | | | | | spotify.profile: allow spotify-adblock paths
| * | spotify.profile: allow spotify-adblock pathsLibravatar Kelvin M. Klann2022-12-02
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As suggested by @glitsj16[1]. Project homepage: https://github.com/abba23/spotify-adblock Configuration paths: * /etc/spotify-adblock/config.toml * ~/.config/spotify-adblock/config.toml Fixes #5494. [1] https://github.com/netblue30/firejail/discussions/5494#discussioncomment-4280887 Reported-by: @Rewig95
* | Merge pull request #5496 from kmk3/kcalc-fix-mkfileLibravatar Kelvin M. Klann2022-12-08
|\ \ | | | | | | kcalc.profile: fix mkfile without mkdir & comment legacy paths
| * | kcalc.profile: stop creating legacy KDE pathsLibravatar Kelvin M. Klann2022-12-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Leave them commented. With this commit, there are no more profiles creating paths in ~/.kde nor in ~/.kde4: $ git grep -e '^mkdir .*\.kde' -e '^mkfile .*\.kde' -- etc $ See also commit 3ef030257 ("ktorrent.profile: stop creating legacy KDE paths", 2022-10-11) / PR #5415.
| * | kcalc.profile: fix mkfile without mkdirLibravatar Kelvin M. Klann2022-12-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | firejail may fail to create the following files: * ~/.kde/share/config/kcalcrc * ~/.kde4/share/config/kcalcrc Because it does not create the preceding directories beforehand: * ~/.kde/share/config * ~/.kde4/share/config See also commit 7f1906dba ("ktorrent.profile: fix mkfile without mkdir", 2022-10-11) / PR #5415.
* | | build(deps): bump github/codeql-action from 2.1.31 to 2.1.35Libravatar dependabot[bot]2022-12-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.31 to 2.1.35. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898...b2a92eb56d8cb930006a1c6ed86b0782dd8a4297) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | Add basic gtksourceview language-spec (#5502)Libravatar rusty-snake2022-12-04
| |/ |/| | | | | | | | | | | Tested with org.gnome.TextEditor. The gtksourceview language-spec hasn't changed between gtksourceview 3, 4 and 5 AFAIK so it should also work on older systems if you copy/link the file in the right places.
* | Merge pull request #5488 from kmk3/configure-fix-format-miscLibravatar Reiner Herrmann2022-12-01
|\ \ | | | | | | build: fix formatting and misc in configure
| * | configure*: quote and line-wrap AC_CHECK_HEADER lineLibravatar Kelvin M. Klann2022-11-28
| | | | | | | | | | | | | | | Misc: I missed this one on commit 221c10177 ("configure*: Add missing quotes to arguments", 2021-06-03) / PR #4712.
| * | configure*: fix quotes/parens alignment (sanitizer)Libravatar Kelvin M. Klann2022-11-28
| | |
| * | configure*: wrap long AS_HELP_STRING line (sanitizer)Libravatar Kelvin M. Klann2022-11-28
| | |
| * | configure*: wrap long shell command output linesLibravatar Kelvin M. Klann2022-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of binding them together with conditionals in a single line, split shell commands into multiple lines to make them more readable. Note that for the macro arguments in question, the content inside [] quotes is output literally into ./configure, so the commands can be written as if they were in a shell script directly (save for any special characters/tokens in Autoconf). Misc: Relates to commit 2c64d1fdd ("use AX_CHECK_COMPILE_FLAG to check for spectre flags", 2019-06-21).
| * | configure*: remove extraneous blank lines (warning)Libravatar Kelvin M. Klann2022-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added on commit d1acb31c9 ("compile time: enable LTS", 2021-02-28). Note: Do not print a preceding blank line because one is already printed right before the warning message, right after the items on "Features:". Example of the resulting warning message: $ autoconf && ./configure [...] configure: creating ./config.status config.status: creating config.mk config.status: creating config.sh Compile options: [...] prefix: /usr/local sysconfdir: ${prefix}/etc Spectre compiler patch: yes Features: [...] SELinux labeling support: user namespace: -DHAVE_USERNS X11 sandboxing support: -DHAVE_X11 ********************************************************* * Warning: Long-term support (LTS) was enabled! * * Most compile-time options have been rewritten! * ********************************************************* $
| * | configure*: remove extraneous blank linesLibravatar Kelvin M. Klann2022-11-28
| | |
| * | configure*: fix indentationLibravatar Kelvin M. Klann2022-11-28
| | |
| * | configure*: fix trailing comma in HAVE_CONTRIB_INSTALLLibravatar Kelvin M. Klann2022-11-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Consider the current code: AS_IF([test "x$enable_lts" = "xyes"], [ # ... HAVE_CONTRIB_INSTALL="no", Result of testing the value: $ HAVE_CONTRIB_INSTALL="no", $ printf '%s\n' "$HAVE_CONTRIB_INSTALL" no, $ test "x$HAVE_CONTRIB_INSTALL" = "xno" && echo equal || echo 'not equal' not equal This means that whenever HAVE_LTS is enabled, HAVE_CONTRIB_INSTALL is always considered enabled when testing against "no". But luckily, in the current code the latter variable is only tested against "yes", so nothing should be affected: $ git grep HAVE_CONTRIB_INSTALL | grep -v -e '^configure:' -e '^configure.ac:' Makefile:ifeq ($(HAVE_CONTRIB_INSTALL),yes) config.mk.in:HAVE_CONTRIB_INSTALL=@HAVE_CONTRIB_INSTALL@ Added on commit d1acb31c9 ("compile time: enable LTS", 2021-02-28).
| * | configure*: fix typo of "been"Libravatar Kelvin M. Klann2022-11-28
| | | | | | | | | | | | | | | | | | s/bean/been Added on commit d1acb31c9 ("compile time: enable LTS", 2021-02-28).
* | | firefox-common-addons: fix whitelisting in ${RUNUSER} (#5497)Libravatar glitsj162022-12-01
| | | | | | | | | | | | | | | | | | | | | * fix whitelisting in ${RUNUSER} See discussions https://github.com/netblue30/firejail/discussions/5495 for context. * Prevent whitelisting ${RUNUSER} comment
* | | AppArmor: add more examples to firejail-local (#5493)Libravatar glitsj162022-12-01
| |/ |/| | | | | | | * AppArmor: add more examples to firejail-local * comments fixes
* | RELNOTES: add ci and docs itemsLibravatar Kelvin M. Klann2022-11-28
| | | | | | | | Relates to #5189 #5349 #5439 #5485.
* | [firefox-common.profile] Add DRM support when using psd (#5486)Libravatar glitsj162022-11-28
|/
* ci: ignore profile-checks.yml on other workflowsLibravatar Kelvin M. Klann2022-11-28
| | | | | | | | | | To avoid running CI unnecessarily. Misc: I noticed this on commit a42c1de0b ("profile-checks.yml: sort paths-ignore", 2022-11-27). See also commit 768410cf5 ("Run profile-ckeck on workflow edits", 2022-11-27). Relates to #5481.
* profile-checks.yml: sort paths-ignoreLibravatar Kelvin M. Klann2022-11-27
| | | | | See commit 9bf5e453c ("ci: sort items on paths-ignore lists", 2022-07-12) / PR #5481 for details.
* Run profile-ckeck on workflow editsLibravatar rusty-snake2022-11-27
|
* Workflows: Change egress-policy to block (#5485)Libravatar rusty-snake2022-11-27
|
* Workflows: Change egress-policy to blockLibravatar rusty-snake2022-11-26
|
* RELNOTES: add build and ci itemsLibravatar Kelvin M. Klann2022-11-25
| | | | Relates to #5429 #5478 #5481.
* Merge pull request #5415 from kmk3/ktorrent-fix-mkfileLibravatar netblue302022-11-25
|\ | | | | ktorrent.profile: fix mkfile without mkdir & comment legacy paths
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-01 09:55:07 +0000