aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
* | tweakLibravatar smitsohu2021-02-12
| | | | | | | | | | readability/making it more obvious buffers are properly initialized
* | remount hardeningLibravatar smitsohu2021-02-12
| |
* | chroot hardeningLibravatar smitsohu2021-02-12
| | | | | | | | | | the check was introduced some time ago in fs_x11(), but fs_chroot() does the same thing and needs it as well
* | Revert "Merge pull request #3607 from kortewegdevries/wemail"Libravatar rusty-snake2021-02-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit bd1819a8641e0eeae016846b28a41e625bcc215b, reversing changes made to 807af3dce05786f10747cc0938cc98af484c8e97. The hole PR looks like a single crap, it is not even syntactically correct. Has anyone at least started kmail with this profile before it was merged? See #3979, thanks @creideiki for reporting. > First, there are syntax errors. Several mkdir lines have file names containing asterisks. > This gives the following error: > > Error: "${HOME}/.cache/akonadi*" is an invalid filename: rejected character: "*" > > I am not sure what they intend to do, but whatever it is it's not working. > Especially confusing is the line > > mkdir /tmp/akonadi-* > > Yes, Akonadi creates a directory in /tmp, but its name is random and seems to have been created > using mkstemp(3) or similar. I'm not sure how Firejail is supposed to be able to pre-create it. > > Removing the asterisks makes Firejail at least accept the profile syntactically and try to run > the program. It is rejected by syntax. Has anyone tested? > At startup, Firejail now prints the following warning: > > *** > *** Warning: cannot whitelist ${DOCUMENTS} directory > *** Any file saved in this directory will be lost when the sandbox is closed. > *** Why was 'include disable-xdg.inc' added together with 'whitelist ${DOCUMENTS}', but no 'nobalcklist ${DOCUMENTS}'? It can not work. > The actual error is that PostgreSQL needs access to /usr/lib64/postgresql-13/ in order to run. > Adding the following line to kmail.profile fixes that: > > whitelist /usr/share/postgresql* Again, has anyone thested this? > The next problem is this message on the console: > > kf.config.core: Couldn't write "/home/creideiki/.config/kmail2rc" . Disk full? > > Which may have something to do with the profile creating a directory with that name: > > mkdir ${HOME}/.config/kmail2rc > > when it's supposed to be a file: > > $ stat ~/.config/kmail2rc > File: /home/creideiki/.config/kmail2rc > Size: 24660 Blocks: 56 IO Block: 4096 regular file Has anyone tested this or is this just a blind copy of the noblacklist from above with noblacklist replaced by mkdir? > However, the error message > > kf.config.core: Couldn't write "/home/creideiki/.config/kmail2rc" . Disk full? > > still appears. Looks like #1793. HAS ANYONE TESTED THIS PROFILE??! > Finally, when exiting KMail, it crashes with a SIGSEGV: > > *** KMail got signal 11 (Exiting) > *** Dead letters dumped. > KCrash: crashing... crashRecursionCounter = 2 > KCrash: Application Name = kmail path = /usr/bin pid = 20 > KCrash: Arguments: /usr/bin/kmail Has any... > I tried restoring an older kmail.profile, from commit 319f2dc, and it has none of the above problems. ... I give up asking if anyone tested this. > Given the multitude of problems with commit 5532fbd, I'd suggest reverting it until it can be fixed. Yes, definitely.
* | Always allow empty environment variablesLibravatar Topi Miettinen2021-02-11
| | | | | | | | | | | | | | With the recent changes to environment variable handling, it should be safe to always allow empty variables. Closes: #3965
* | display-im6.q16Libravatar netblue302021-02-11
| |
* | display-im6.q16Libravatar netblue302021-02-11
| |
* | Merge pull request #3969 from glitsj16/fsaccessat2Libravatar netblue302021-02-11
|\ \ | | | | | | add support for faccessat2 syscall
| * | add support for faccessat2 syscallLibravatar glitsj162021-02-10
| | |
| * | add support for faccessat2 syscallLibravatar glitsj162021-02-10
| | |
| * | add support for faccessat2 syscallLibravatar glitsj162021-02-10
| | |
| * | add support for fsaccessat2 syscallLibravatar glitsj162021-02-10
| | |
| * | add support for faccessat2 syscallLibravatar glitsj162021-02-10
| | |
| * | add support for fsaccessat2 syscallLibravatar glitsj162021-02-10
| | |
* | | fix spacing in man firejailLibravatar glitsj162021-02-10
| | |
* | | Merge pull request #3970 from glitsj16/man-fixesLibravatar glitsj162021-02-10
|\ \ \ | |/ / |/| | small man fixes
| * | fix private=directory in man firejail-profileLibravatar glitsj162021-02-10
| | |
| * | fix ordering of deterministic-exit-code in man firejailLibravatar glitsj162021-02-10
|/ /
* | Merge pull request #3966 from albinou/masterLibravatar netblue302021-02-09
|\ \ | | | | | | Add a comment in some profiles to allow screen sharing
| * | Update etc/profile-a-l/firefox.profileLibravatar Albin Kauffmann2021-02-09
| | | | | | | | | Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
| * | Update etc/profile-a-l/chromium-common.profileLibravatar Albin Kauffmann2021-02-09
| | | | | | | | | Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
| * | Add a comment to some profiles to allow screen sharingLibravatar Albin Kauffmann2021-02-09
| | | | | | | | | | | | | | | | | | | | | | | | This configuration is to be applied in order to get screen sharing working under Wayland (via pipewire and a xdg-desktop-portal backend). Note that {chrome|chromium} does not need the dbus filters (at least as of today) because dbus filtering is not enabled (dbus-user not set to none).
* | | Merge pull request #3967 from kmk3/fix-tmpfs-typoLibravatar netblue302021-02-09
|\ \ \ | | | | | | | | configure*: fix typo of HAVE_USERTMPFS
| * | | configure*: fix typo of HAVE_USERTMPFSLibravatar Kelvin M. Klann2021-02-09
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added on commit 64a8d6a7f ("compile time option to disable --private-cache and --tmpfs for regular user"). These are the only occurrences: $ git ls-files -z | xargs -0 grep -Fin USERTMPS configure:3542:HAVE_USERTMPS="" configure.ac:80:HAVE_USERTMPS=""
* / / Remove skip ci if conndition from workflowsLibravatar rusty-snake2021-02-09
|/ / | | | | | | | | GitHub added native support for it, no need for this anymore. https://github.blog/changelog/2021-02-08-github-actions-skip-pull-request-and-push-workflows-with-skip-ci/
* | Revert "etc: use ${DOCUMENTS} macro where appropriate"Libravatar Kelvin M. Klann2021-02-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 5df1f27c638c487dfd664ea3a0f756565e1e57bd. That commit breaks things, as pointed out by @rusty-snake[1]: > @kmk3 @glitsj16 The xdg macros are treated literally if they have sub > components (#2359): > > ``` > Error: "${DOCUMENTS}/KeePassXC" is an invalid filename: rejected character: "{" > ``` [1]: https://github.com/netblue30/firejail/commit/3fa2927c3c1c5cf583864746538ea791c1ba2dc4#commitcomment-46913219
* | adding DISPLAY to env_whitelistLibravatar netblue302021-02-09
| |
* | Merge pull request #3849 from bbhtt/emailLibravatar netblue302021-02-09
|\ \ | | | | | | Email part (2)
| * | Some minor changesLibravatar bbhtt2021-01-09
| | |
| * | Add seccomp.block-secondary to email-common,mutt,neomutt; add mdwe to ↵Libravatar bbhtt2021-01-04
| | | | | | | | | | | | mutt,neomuut; some sorting
| * | Add ipc-namespace, machine-idLibravatar bbhtt2020-12-31
| | |
| * | Add dbus-system none back to email-common.profileLibravatar bbhtt2020-12-31
| | |
| * | Some sorting per @kmk3Libravatar bbhtt2020-12-31
| | |
| * | Rearrange and fixes per commentsLibravatar bbhtt2020-12-31
| | |
| * | Add seccomp.block-secondary per @rusty-snakeLibravatar bbhtt2020-12-31
| | |
| * | Improve whitelisting and dbus of Sylpheed and Claws-mailLibravatar bbhtt2020-12-31
| | |
| * | Add folks cache directoryLibravatar bbhtt2020-12-29
| | |
| * | Fix python; add read-only to editors/cli browsers;re-add cache directoryLibravatar bbhtt2020-12-29
| | |
| * | Add Evolution and folks directories coming from evolution data server common ↵Libravatar bbhtt2020-12-29
| | | | | | | | | | | | to both geary and evolution; add dbus permissions fromflatpak
| * | Add neomutt to firefg.configLibravatar bbhtt2020-12-28
| | |
| * | Add whitelisting to mutt; improve geary, new profile for neomuttLibravatar bbhtt2020-12-28
| | |
* | | Merge pull request #3322 from topimiettinen/filter-environment-variablesLibravatar netblue302021-02-09
|\ \ \ | | | | | | | | Filter environment variables
| * | | Filter environment variablesLibravatar Topi Miettinen2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Save all environment variables for later use in the application, clear environment and re-apply only whitelisted variables for the main firejail process. The whitelisted environment is only used by C library. Sandboxed tools will get further variables used internally (FIREJAIL_*). All variables will be reapplied for the firejailed application. This also lifts the length restriction for environment variables, except for the variables used by Firejail itself or the sandboxed tools.
* | | | bump RELNOTES date to fix CILibravatar Reiner Herrmann2021-02-09
| | | |
* | | | Housekeeping: strip extra whitespaceLibravatar Fred Barclay2021-02-08
| | | | | | | | | | | | | | | | | | | | Just `find . -not \( -name .git -prune -o -name *.AppImage -prune \) -type f -print0 | xargs -0 perl -pi -e 's/ +$//'` and filter to avoid unwanted changes (especially .md files)
* | | | Merge pull request #3961 from kmk3/fix-macro-usageLibravatar glitsj162021-02-08
|\ \ \ \ | | | | | | | | | | etc: use ${DOCUMENTS} macro where appropriate
| * | | | etc: use ${DOCUMENTS} macro where appropriateLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, some paths are hard-coded: $ grep -Fnr '${HOME}/Documents' etc etc-fixes etc/profile-m-z/Mathematica.profile:19:mkdir ${HOME}/Documents/Wolfram Mathematica etc/profile-m-z/Mathematica.profile:22:whitelist ${HOME}/Documents/Wolfram Mathematica etc/profile-a-l/keepassxc.profile:34:# If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx etc/profile-a-l/keepassxc.profile:35:#mkdir ${HOME}/Documents/KeePassXC etc/profile-a-l/keepassxc.profile:36:#whitelist ${HOME}/Documents/KeePassXC Commands used to search and replace: $ find etc etc-fixes/ -type f -exec \ sed -i.bak -e 's|\${HOME}/Documents|${DOCUMENTS}|' '{}' + Related to that, the (lack of) usage of ${DOWNLOADS} has been recently fixed on commit deae31301 ("use ${DOWNLOADS} in lutris.profile (#3955)"). With the above change, all macros other than ${DOCUMENTS} seem to be already used appropriately: $ grep -Fnr '${HOME}/Desktop' etc etc-fixes $ grep -Fnr '${HOME}/Downloads' etc etc-fixes $ grep -Fnr '${HOME}/Music' etc etc-fixes $ grep -Fnr '${HOME}/Pictures' etc etc-fixes $ grep -Fnr '${HOME}/Videos' etc etc-fixes See src/firejail/macros.c for details.
* | | | | merge 0.9.64.4 RELNOTESLibravatar Reiner Herrmann2021-02-08
|/ / / /
* | | | archivers: wrap commentsLibravatar Kelvin M. Klann2021-02-08
| | | |
* | | | archivers: move archiver-common.inc include to the bottomLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | And mark it as a redirect profile. This is done so when including other *-common.inc profiles, such as firefox-common.profile.
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-05 22:36:56 +0000