aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* makefiles: rename H_FILE_LIST and C_FILE_LISTLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | | | | To HDRS and SRCS, respectively. To be more consistent with the OBJS variable. Misc: These names also appear to be more common from the makefiles that I've seen. Commands used to search and replace: git grep -IFlz -e H_FILE_LIST -e C_FILE_LIST -- src | xargs -0 -I '{}' sh -c "printf '%s\n' \"\$(sed \ -e 's/^H_FILE_LIST *=/HDRS =/' \ -e 's/\$(H_FILE_LIST)/\$(HDRS)/g' \ -e 's/^C_FILE_LIST *=/SRCS =/' \ -e 's/\$(C_FILE_LIST:/\$(SRCS:/g' \ '{}')\" >'{}'"
* makefiles: equalize object dependencies in program targetsLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | Compared to the objects that are actually used in a given recipe, some program targets are missing object dependencies, while others appear to have unused object dependencies. Make each of those targets depend on the objects that are actually used when linking. Note: No check was done for extraneous/missing objects when linking; this commit only makes the object dependencies equal to the objects that are linked.
* makefiles: include config.mk directlyLibravatar Kelvin M. Klann2022-11-21
| | | | | | | Instead of including it through src/common.mk. This allows each makefile to directly override any value defined in config.mk.
* Makefile: put the all target after variablesLibravatar Kelvin M. Klann2022-11-21
| | | | | | | This should make it more consistent with the other makefiles (especially considering the subsequent deduplication commits on this branch) and enables it to depend on the variables in question (as variables in dependencies are immediately expanded, at least by default).
* lib/Makefile: put all target before include of common.mkLibravatar Kelvin M. Klann2022-11-20
| | | | | | | | | | | | | | | | | | | The "all" target is usually intended to be the default one and when running make, the first target on a makefile is the one that gets built if no target is specified (such as when running `make` with no arguments). Also, note that unlike config.mk, src/common.mk may define its own targets, so move the "all" target to before the include of src/common.mk, to ensure that "all" keeps being the default target regardless of what is defined in src/common.mk. Note: If the "all" target is defined as depending directly on `$(OBJS)` while it is empty (that is, before src/common.mk is included), running `make` (or `make all`) will result in make always concluding that there is nothing to be done and exiting. So make "all" depend on an intermediary phony "lib" target instead, which in turn depends on `$(OBJS)` (and is declared after `$(OBJS)` is populated).
* makefiles: remove unused BINOBJS variableLibravatar Kelvin M. Klann2022-11-20
| | | | | | | | | | | | | | | | It is unclear what its intended purpose would be. Example: $ cat Makefile OBJS = a b c BINOBJS = $(foreach file, $(OBJS), $file) all: printf '"%s"\n' "$(BINOBJS)" $ make printf '"%s"\n' " ile ile ile" " ile ile ile" Added on commit 137985136 ("Baseline firejail 0.9.28", 2015-08-08).
* fids/Makefile: remove code commentLibravatar Kelvin M. Klann2022-11-20
| | | | Added on commit a627071b3 ("intrusion detection system", 2021-07-28).
* RELNOTES: add docsLibravatar Kelvin M. Klann2022-11-20
| | | | Relates to #5398 #5402 #5451.
* Merge pull request #5451 from kmk3/docs-clarify-appimageLibravatar Kelvin M. Klann2022-11-20
|\ | | | | docs: clarify that --appimage should appear before --profile
| * docs: clarify that --appimage should appear before --profileLibravatar Kelvin M. Klann2022-11-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And fix the argument order in the examples to reflect that. Background: The order in which these options appeared in the documentation was inconsistent. src/man/firejail.txt used --appimage before --profile and src/man/firejail-profile.txt used --profile before --appimage. Then commit 44fefcac0 ("Make appimage examples consistent with --appimage option short description", 2022-10-05) / PR #5402 was made, which standardized on --profile before --appimage in both places. But as mentioned by @rusty-snake[1], --appimage has be specified before --profile in order for any `?HAS_APPIMAGE` conditionals inside of the profile to evaluate to true. So change the documentation to use and recommend the latter form. Also, add --quiet to one example to make it clear that --appimage does not have to be the first option (nor the last option before --profile). [1] https://github.com/netblue30/firejail/pull/5402#issuecomment-1274889618
* | Add support for cinelerra-gg (#5467)Libravatar glitsj162022-11-13
| | | | | | | | | | | | | | * Create cinelerra-gg * add cinelerra-gg to `New profiles` section * Add cinelerra-gg to firecfg.config
* | build(deps): bump github/codeql-action from 2.1.29 to 2.1.31Libravatar dependabot[bot]2022-11-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.29 to 2.1.31. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ec3cf9c605b848da5f1e41e8452719eb1ccfb9a6...c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | Add netlink to list of allowed protocols (#5464)Libravatar Jan Sonntag2022-11-10
| | | | | | Fixes #5463 by adding netlink to the list of allowed protocols
* | Add godot3 redirect (#5456)Libravatar Frostbyte46642022-11-07
|/ | | | | * Create godot3.profile * Add godot3 redirect to firecfg.config
* RELNOTES: add build: Fix musl warningsLibravatar Kelvin M. Klann2022-11-03
| | | | Relates to #5421 #5431.
* RELNOTES: add missing issue referenceLibravatar Kelvin M. Klann2022-11-03
| | | | Relates to #5356.
* [StepSecurity] ci: Harden GitHub ActionsLibravatar StepSecurity Bot2022-10-31
| | | Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
* build(deps): bump github/codeql-action from 2.1.28 to 2.1.29Libravatar dependabot[bot]2022-10-31
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.28 to 2.1.29. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/cc7986c02bac29104a72998e67239bb5ee2ee110...ec3cf9c605b848da5f1e41e8452719eb1ccfb9a6) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* Fix freetube mpris supportLibravatar rusty-snake2022-10-30
| | | | Closes #5437
* build(deps): bump github/codeql-action from 2.1.27 to 2.1.28Libravatar dependabot[bot]2022-10-29
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.27 to 2.1.28. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/807578363a7869ca324a79039e6db9c843e0e100...cc7986c02bac29104a72998e67239bb5ee2ee110) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* compile fixLibravatar netblue302022-10-25
|
* nettrace: various fixesLibravatar netblue302022-10-25
|
* fix nolocal netfilterLibravatar netblue302022-10-25
|
* removed grsecurity supportLibravatar netblue302022-10-24
|
* --icmptraceLibravatar netblue302022-10-24
|
* Merge pull request #5431 from netblue30/musl_warningsLibravatar Reiner Herrmann2022-10-23
|\ | | | | Fix musl warnings
| * check for availability of symbols instead of glibc definesLibravatar Reiner Herrmann2022-10-23
| | | | | | | | in musl they are just redefines of the non-64 versions
| * include limits.h instead of manually defining LINE_MAXLibravatar Reiner Herrmann2022-10-23
|/
* remove deprecated --shell from man pageLibravatar netblue302022-10-23
|
* dnstrace and snitraceLibravatar netblue302022-10-23
|
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-10-11
|\
| * Merge pull request #5389 from glitsj16/qutebrowser-fixesLibravatar netblue302022-10-11
| |\ | | | | | | Harden qutebrowser profile
| | * Harden qutebrowserLibravatar glitsj162022-10-03
| | |
| | * Fix D-Bus mpris supportLibravatar glitsj162022-10-02
| | |
| | * unbreak D-Bus mpris supportLibravatar glitsj162022-10-02
| | |
| | * Harden qutebrowser profileLibravatar glitsj162022-10-01
| | |
| * | Merge pull request #5402 from slowpeek/masterLibravatar netblue302022-10-11
| |\ \ | | | | | | | | docs: Make appimage examples consistent with --appimage option short description
| | * | Make appimage examples consistent with --appimage option short descriptionLibravatar slowpeek2022-10-05
| | | |
| * | | Merge pull request #5298 from pirate486743186/patch-1Libravatar netblue302022-10-11
| |\ \ \ | | | | | | | | | | electron-mail.profile refactoring
| | * | | electron-mail.profile: refactor and redirect to electron.profileLibravatar pirate4867431862022-10-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: - redirect to electron.profile - fix program name - update program description - allow /bin/sh - allow opening links in Firefox - remove no3d, nonewprivs, noroot, protocol, seccomp - add machine-id, nosound - remove private-bin, disable-mnt - harden private-etc - allow D-Bus notifications, secrets
* | | | | compile fixLibravatar netblue302022-10-11
|/ / / /
* | | | nettrace-dns and nettrace-sniLibravatar netblue302022-10-11
| | | |
* | | | build(deps): bump actions/checkout from 3.0.2 to 3.1.0Libravatar dependabot[bot]2022-10-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 3.0.2 to 3.1.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/2541b1294d2704b0964813337f33b291d3f8596b...93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
* | | | build(deps): bump github/codeql-action from 2.1.26 to 2.1.27Libravatar dependabot[bot]2022-10-10
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.26 to 2.1.27. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/e0e5ded33cabb451ae0a9768fc7b0410bad9ad44...807578363a7869ca324a79039e6db9c843e0e100) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | disable-common.inc: blacklist doas binaryLibravatar Kelvin M. Klann2022-10-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | OpenDoas is an alternative to sudo. It is an unofficial port of OpenBSD's doas. Details: $ LC_ALL=C pacman -Si galaxy/opendoas | grep -e '^Version' -e '^Description' -e '^URL' Version : 6.8.2-1 Description : Run commands as super user or another user URL : https://github.com/Duncaen/OpenDoas Environment: Artix Linux. Also, add /etc/doas.conf to etc/ids.config.
* | | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-10-04
|\ \ \
| * \ \ Merge pull request #5394 from ↵Libravatar netblue302022-10-04
| |\ \ \ | | | | | | | | | | | | | | | | | | | | netblue30/dependabot/github_actions/github/codeql-action-2.1.26 build(deps): bump github/codeql-action from 2.1.25 to 2.1.26
| | * | | build(deps): bump github/codeql-action from 2.1.25 to 2.1.26dependabot/github_actions/github/codeql-action-2.1.26Libravatar dependabot[bot]2022-10-03
| | | |/ | | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.25 to 2.1.26. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/86f3159a697a097a813ad9bfa0002412d97690a4...e0e5ded33cabb451ae0a9768fc7b0410bad9ad44) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
| * | | Merge pull request #5400 from kmk3/mpv-fix-libLibravatar netblue302022-10-04
| |\ \ \ | | | | | | | | | | Revert "mpv: whitelist mpv-mpris (#5386)"
| | * | | Revert "mpv: whitelist mpv-mpris (#5386)"Libravatar Kelvin M. Klann2022-10-04
| | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 393c5beff2686d7732221dadb6730917f24835a0. Which broke mpv: $ mpv --version Cannot start application: No such file or directory Probably because mpv itself uses many libraries and it has plugins that may depend on files in /usr/lib as well: $ pacman -Qlq mpv | grep /lib/ | grep -v '/$' /usr/lib/libmpv.so /usr/lib/libmpv.so.1 /usr/lib/libmpv.so.1.109.0 /usr/lib/pkgconfig/mpv.pc $ strings /usr/bin/mpv | grep '^lib.*\.so' | sort -u | wc -l 53 $ pacman -Qlq yt-dlp | grep /lib/ | grep -v '/$' | cut -f -4 -d / | sort -u /usr/lib/python3.10 $ pacman -Q mpv yt-dlp mpv 1:0.34.1-5 yt-dlp 2022.09.01-1 Environment: Artix Linux. Also, private-lib is disabled by default in firejail.config (see #5190) and mpv.profile does not use private-lib, so there should be no need to whitelist anything in /usr/lib in the default profile.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-19 16:19:25 +0000