aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* man: corrections regarding --private-FOO optionsLibravatar Jeff Squyres2021-04-20
| | | | | | | | | | | | | | | | | Commit 0.9.60-1070-g40d3604f updated the man pages with respect to --private-opt, --private-etc, and --private-srv. It was made after testing firejail 0.9.52 (from Ubuntu 18.04). However, it unfortunately did not accurately reflect the the behavior of the current HEAD at the time, because commit 0.9.56-rc1-14-ga9242301 had previously slightly changed the behavior of these three options (after 0.9.52), and was released in 0.9.56. The man pages changes made in commit 40d3604f were therefore not entirely correct. This commit updates the man pages to describe the behavior as implemented in a9242301 (and is still the behavior as of the current HEAD: 0.9.64-737-g937815ba). Signed-off-by: Jeff Squyres <jsquyres@cisco.com>
* profile fixesLibravatar rusty-snake2021-04-20
| | | | | | | | | | | | | | | README.md/RELNOTES: - Add new profiles etr.profile: - adding passwd to private-etc makes it work for me file-roller.profile - add netfilter - add zstd to private-bin - add cp,mv,rm to private-bin which seems to be necessary in some cases. #4113 is likely fixed with this but wait for OP.
* Update Librewolf profile and Add Sway profile (#4164)Libravatar Vladislav Nepogodin2021-04-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add Sway profile * Fix issue Not working then including firefox-common-addons.profile * Allow sway's fallback config * So I agree with @glitsj16 and @BL4CKH47H4CK3R so.. `No its not needed as it reveals lots of important /usr/share folders like /usr/share/fonts which can used for font fingerprinting and OS detection. Like the site or attacker will know that which font you are using. Linux and windows common font are not same so its a problem. Besides there are so many other important folders as I see. Librewolf can launch and work perfectly without this options` * well.. Revert `include whitelist-usr-share-common.inc` Sync with Firefox profile * πŸ˜„ What just hapened * πŸ”„ Sync with upstream * Merge tested from PR * πŸ”„ Sync with upstream * Merge tested from PR * Revert changes * Add Sway profile * Fix issue Not working then including firefox-common-addons.profile * Allow sway's fallback config * So I agree with @glitsj16 and @BL4CKH47H4CK3R so.. `No its not needed as it reveals lots of important /usr/share folders like /usr/share/fonts which can used for font fingerprinting and OS detection. Like the site or attacker will know that which font you are using. Linux and windows common font are not same so its a problem. Besides there are so many other important folders as I see. Librewolf can launch and work perfectly without this options` * πŸ”„ Rebase * πŸ˜„ What just hapened * Merge tested from PR * πŸ”„ Sync with upstream * Merge tested from PR * Revert changes * Update * Update librewolf.profile Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* unblock tor support in brave (#4200)Libravatar glitsj162021-04-18
| | | | | | | | | | | * opt-in for brave's native tor support * fix brave's native tor support * warn about potential tor breakage when using apparmor * update comment for opting in to tor * move brave's tor apparmor fix in brave.profile
* broaden support for pcre in private-libLibravatar glitsj162021-04-18
| | | Follow-up for https://github.com/netblue30/firejail/commit/692311bcc6fe0744d7831459ad7ec0bc5811b9a9. Thanks to @rusty-snake for tracking this down in #4202.
* broaden support for pcre in private-libLibravatar glitsj162021-04-17
| | | Fixes #4202 until we have tooling to generate system-specific lists at install time, as suggested by @loveshack.
* Add allow-bin-sh.inc to profile.templateLibravatar rusty-snake2021-04-17
| | | | [skip ci]
* Merge pull request #4196 from pholodniak/patch-1Libravatar glitsj162021-04-15
|\ | | | | profstats - fix printf for include globals
| * Update main.cLibravatar pholodniak2021-04-15
|/ | | profstats - correct variable for include global
* add passwd to private-etc (#4193)Libravatar glitsj162021-04-14
|
* Create tmux.profile (#4188)Libravatar rusty-snake2021-04-14
| | | requested in #1139 by @vatonbero
* New profile: Quodlibet (#3983)Libravatar Bundy012021-04-14
| | | | | * New profile: Quodlibet * New profile: Quodlibet
* Fix export in apostropheLibravatar rusty-snake2021-04-12
|
* profile fixesLibravatar rusty-snake2021-04-12
| | | | | | | | | | | | | | | | | | discord-canary.profile: fix #4175 flameshot.profile: - private-tmp break flameshot (wayland only?) - Screengrabbing (under wayland) is done via dbus, the following names must be allowed: - GNOME: org.gnome.Shell - KDE: org.kde.KWin - Sway: org.freedesktop.portal.Desktop - Allow notifications and tray too, because org.gnome.Shell (for example) is already totaly unsafe. mumble.profile: fix #4181
* Merge pull request #4180 from jose1711/readme_typoLibravatar Reiner Herrmann2021-04-11
|\ | | | | Fix typo (adivsory -> advisory)
| * Fix typo (adivsory -> advisory)Libravatar Jose Riha2021-04-10
|/
* Fix typo (#4176)Libravatar Jose Riha2021-04-10
|
* Merge pull request #4174 from Neo00001/masterLibravatar Neo000012021-04-09
|\ | | | | Minor Fixes
| * Minor FixesLibravatar Neo000012021-04-09
|/
* fix comment typoLibravatar glitsj162021-04-07
|
* Merge pull request #4170 from matthew-cline/steamLibravatar Reiner Herrmann2021-04-07
|\ | | | | steam: some more games added
| * steam: also added paths to disable-programs.incLibravatar Matthew Cline2021-04-05
| |
| * steam: some more games addedLibravatar Matthew Cline2021-04-05
| | | | | | | | | | | | | | | | | | | | | | | | Games added: * Don't Starve * Dungeons of Dredmor * Epic * Loop Hero * Pillars of Eternity I * Rogue Legacy I * Slay the Spire modding * Steam World Dig I & II
* | Fix #3783 -- Google Chrome (wayland ozone) is brokenLibravatar rusty-snake2021-04-06
| |
* | Merge pull request #4167 from tredondo/patch-7Libravatar rusty-snake2021-04-06
|\ \ | | | | | | WebStorm: allow Dolphin to access its config file
| * | WebStorm: allow Dolphin to access its config fileLibravatar Ted Robertson2021-04-05
| |/
* / Encourage making overrides in *.local files (#4165)Libravatar glitsj162021-04-06
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments
* Merge pull request #4161 from glitsj16/signal-desktopLibravatar glitsj162021-04-04
|\ | | | | allow notifications + comment fixes
| * drop some stuff based on discussion with @rusty-snakeLibravatar glitsj162021-04-04
| |
| * allow notifications + comment fixesLibravatar glitsj162021-04-04
|/
* Merge pull request #4159 from vnepogodin/masterLibravatar rusty-snake2021-04-04
|\ | | | | New profile: Librewolf Nightly
| * Add Librewolf Nightly profileLibravatar Vladislav Nepogodin2021-04-04
|/
* Merge pull request #4155 from matthew-cline/dropbox-python3Libravatar Reiner Herrmann2021-04-02
|\ | | | | dropbox: allow python3, fix for issue #4150
| * dropbox: allow python3, fix for issue #4150Libravatar Matthew Cline2021-04-01
|/ | | | | | /usr/bin/dropbox needs access to python3, at least for dropbox command-line interface version 2020.03.04 as packaged by the RPM Fusion project. Fixes issue #4150
* Merge pull request #4148 from glitsj16/masterLibravatar glitsj162021-03-31
|\ | | | | Improve comments in apparmor files
| * Add examples to allow running programs from specific home dirLibravatar glitsj162021-03-30
| |
| * Recommend doing overrides in local apparmor dirLibravatar glitsj162021-03-30
| |
* | Merge pull request #4149 from nolanl/masterLibravatar rusty-snake2021-03-31
|\ \ | |/ |/| Add localtime to signal-desktop's profile.
| * Add localtime to signal-desktop's profile.Libravatar Nolan Leake2021-03-30
|/ | | | Without it, all chat timestamps are in UTC.
* Fixes (man: allow rustup; Books -> gnome-books)Libravatar rusty-snake2021-03-28
|
* Improve issue template (#4141)Libravatar rusty-snake2021-03-25
| | | | - Avoid confusing on "What changed calling the program by path" - Checklist: Questions should be asked in discussions
* private-lib: trim ending slashes and dotsLibravatar smitsohu2021-03-25
| | | | | | | | | | | | | | | | Currently pathological endings like in /foo/bar/./. are mapped to RUN_LIB_DIR, with the effect that the mount is skipped because this directory always exists at this point in time. Even though it's harmless, it is wrong behaviour, so handle trailing slashes and dots before doing the mounts. Also avoids running into an assertion if there is a trailing slash. Plus few small cosmetic changes to make things more explicit.
* fix hardening commentLibravatar rusty-snake2021-03-24
| | | | [skip ci]
* Merge pull request #4140 from glitsj16/follow-upsLibravatar glitsj162021-03-24
|\ | | | | Follow up for #4126
| * fix hardening commentLibravatar glitsj162021-03-24
| |
| * fix network access commentLibravatar glitsj162021-03-24
|/
* Merge pull request #4126 from rusty-snake/better-renamesLibravatar netblue302021-03-24
|\ | | | | Rename chromium-common-hardened and feh-network …
| * Rename chromium-common-hardened and feh-network …Libravatar rusty-snake2021-03-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | …again I am still not really happy about the rename from #4028, #4029, #4030 and #4031. I've no problem with moving away .inc but I don't like the result. So here's a proposal to make this better: | NAME | DESCRIPTION | | ------------------------- | ------------------------------------------------------------ | | `*-addons.profile` | (include) Allow external addons | | `*-common.profile` | (include) Common parts across multiple profiles | | `*-hardened.inc.profile` | Further hardening which can not be made default | | `*-network.inc.profile` | Allow optional network access | | `*-whitelist.inc.profile` | Enabled whitelisting (which can not be made default) ΒΉ | | `*.inc.profile` | Other profile specific includes | | `*.profile` | A profile for a program | | `allow-*.inc` | Multiple `noblacklist`s that should always be used together | | `disable-*.inc` | `blacklist`ing | | `whitelist-*-common.inc` | common `whitelist`s | | `*.inc` | Other generic includes | | `globals.local` | User overrides for all profiles | | `*.local` | Per profile user overrides | ΒΉ can be used for programs like KeePassXC or editors.
* | Merge pull request #4116 from Neo00001/masterLibravatar netblue302021-03-24
|\ \ | | | | | | Update vmware.profile & dbus-policy for amarok
| * | Update amarok.profileLibravatar Neo000012021-03-21
| | |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-04 00:35:44 +0000