aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* modif: private-dev: keep /dev/kfd unless no3d is used (#6380)Libravatar Kelvin M. Klann2024-06-15
| | | | | | | | | | | | | | | | | | Apparently hashcat needs access to this device for hardware acceleration on AMD gpus and `private-dev` currently breaks that (see #6364). It seems to be used by the "amdgpu" and "amdkfd" Linux kernel drivers and as with /dev/dri/renderD128, this file is owned by the "render" group. Relevant udev rules from /usr/lib/udev/rules.d/50-udev-default.rules: SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="0666" SUBSYSTEM=="kfd", GROUP="render", MODE="0666" SUBSYSTEM=="accel", GROUP="render", MODE="0666" Environment: udev 255.6-1 on Artix Linux. Reported-by: @schrotthaufen
* profiles: claws-mail: note no3d issue with "fancy" plugin (#6383)Libravatar Dieter Plaetinck2024-06-14
| | | Fixes #6377.
* profiles: email-common: fix trailing whitespaceLibravatar Dieter Plaetinck2024-06-14
| | | | | Added on commit 2453f0ecf ("email-common.profile: allow clamav plugin for claws-mail", 2023-03-07) / PR #5719.
* docs: bug_report.md: use absolute path in 'steps to reproduce' (#6382)Libravatar glitsj162024-06-14
| | | | | | We still see lots of issue reports where the user runs `firejail foo` and ends up running foo's sandbox twice (due to firecfg's symlink precedence). Try to improve the situation by explicitly using absolute paths in the 'steps to reproduce' section.
* profiles: hashcat: support newer configuration paths (#6376)Libravatar glitsj162024-06-11
| | | Relates to #6364.
* RELNOTES: add many itemsLibravatar Kelvin M. Klann2024-06-10
| | | | Relates to #6352 #6353 #6354 #6358 #6359 #6361 #6366 #6367 #6369.
* Merge pull request #6366 from kmk3/build-standardize-installLibravatar Kelvin M. Klann2024-06-10
|\ | | | | build: standardize install commands
| * build: sort/split some install commandsLibravatar Kelvin M. Klann2024-06-02
| | | | | | | | For increased consistency and readability.
| * build: use -t in applicable install commandsLibravatar Kelvin M. Klann2024-06-02
| | | | | | | | For increased consistency and readability.
| * build: stop checking for dir existence on installLibravatar Kelvin M. Klann2024-06-02
| | | | | | | | | | Just try to install them, as is done in the other `$(INSTALL) -d` commands.
| * build: fix some inconsistencies in install commandsLibravatar Kelvin M. Klann2024-06-02
| | | | | | | | | | | | | | | | | | | | | | | | Changes: * Remove / after `$(DESTDIR)` * Remove useless -c * Use 0755 instead of 755 * Use -d after -m See also commit dae3933bc ("rework make realinstall and uninstall (#3435)", 2020-06-04).
| * build: remove redundant parent dir installLibravatar Kelvin M. Klann2024-06-02
| | | | | | | | | | | | | | The command below already installs it. Added on commit 926790411 ("add basic Firejail support to AppArmor base abstraction (#3226)", 2021-10-21) / PR #4628.
| * build: line-break sh install commandsLibravatar Kelvin M. Klann2024-06-02
| | | | | | | | | | | | | | And remove the extraneous semicolon at the end of the command string. See also commit dae3933bc ("rework make realinstall and uninstall (#3435)", 2020-06-04).
* | docs: add precedence info to manpage & fix noblacklist example (#6359)Libravatar Shahriar Heidrich2024-06-10
| | | | | | Fixes #6358.
* | profiles: blacklist i3 IPC socket & dir except for i3 itself (#6361)Libravatar Shahriar Heidrich2024-06-08
| | | | | | | | | | | | | | | | | | This closes the escape route discussed in #6357. It's left open for i3's own profile, so that people who run i3 itself sandboxed still have the option to use IPC with it at all. Reference for file paths: https://i3wm.org/docs/userguide.html#_interprocess_communication
* | New profile: armcord (#6365)Libravatar glitsj162024-06-06
| | | | | | | | | | | | | | | | Description: Standalone Discord client. https://armcord.app/ https://github.com/NextWork123/ArmCord Requested in https://github.com/netblue30/firejail/issues/1139#issuecomment-2140174880.
* | bugfix: profstats: fix restrict-namespaces max count (#6369)Libravatar Ilya Pankratov2024-06-05
| | | | | | Signed-off-by: Ilya Pankratov <i.pankratov.main@gmail.com>
* | bugfix: fix various resource leaks (#6367)Libravatar Ilya Pankratov2024-06-05
|/ | | | | Fix memory and descriptor leaks. Signed-off-by: Ilya Pankratov <i.pankratov.main@gmail.com>
* build(deps): bump step-security/harden-runner from 2.7.1 to 2.8.0Libravatar dependabot[bot]2024-06-01
| | | | | | | | | | | | | | Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.7.1 to 2.8.0. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/a4aa98b93cab29d9b1101a6143fb8bce00e2eac4...f086349bfa2bd1361f7909c78558e816508cdc10) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump github/codeql-action from 3.25.5 to 3.25.7Libravatar dependabot[bot]2024-06-01
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.5 to 3.25.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/b7cec7526559c32f1616476ff32d17ba4c59b2d6...f079b8493333aace61c81488f8bd40919487bd9f) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* Merge pull request #6354 from kmk3/build-tool-varsLibravatar Kelvin M. Klann2024-05-29
|\ | | | | build: allow overriding common tools
| * build: allow overriding common toolsLibravatar Kelvin M. Klann2024-05-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tools: * gzip * install * rm * strip * tar For the programs not checked in configure.ac: From the manual of GNU Autoconf (version 2.71): > If you use `AC_PROG_INSTALL`, you must include `install-sh` in your > distribution So set `install` just in the Makefile. Use `$(RM)` to ensure that `-f` is always used and to make it easier to spot when `-r` is used. See commit 93d623fdf ("build: allow overriding certain tools", 2024-02-23) / PR #6222.
| * build: define CC/GAWK if undefinedLibravatar Kelvin M. Klann2024-05-24
| | | | | | | | | | | | | | | | | | Just in case the value is not defined in config.mk and `make` is first executed from another directory (such as in src/man) instead of the root directory. This amends commit 93d623fdf ("build: allow overriding certain tools", 2024-02-23) / PR #6222.
* | profiles: libreoffice: support signing documents with GPG (#6353)Libravatar glitsj162024-05-24
| | | | | | | | | | Based on the entries in etc/profile-m-z/makepkg.profile. This fixes #6352.
* | profiles: streamline Firefox URL opening support (#6348)Libravatar glitsj162024-05-20
|/ | | | | | | | Changes: * Improve Firefox D-Bus comment * Add missing/standardize related comments * Include allow-bin-sh.inc in relevant profiles * Use Firefox URL open section in relevant profiles
* profiles: yelp: add Firefox URL open support (#6349)Libravatar glitsj162024-05-20
|
* RELNOTES: add ci itemLibravatar Kelvin M. Klann2024-05-20
| | | | Relates to #6338.
* RELNOTES: add build itemsLibravatar Kelvin M. Klann2024-05-20
| | | | Relates to #6339 #6342 #6343.
* build: remove clean dependency from cppcheck targets (#6343)Libravatar Kelvin M. Klann2024-05-20
| | | | | | | | | | Cleaning does not appear to make a difference; the same amount of files is checked with/without cleaning. Environment: cppcheck 2.12.0-3 on Artix Linux. Added on commit 4e22add64 ("llvm scan", 2015-11-29). This is a follow-up to #6222.
* Merge pull request #6342 from kmk3/build-add-stripLibravatar Kelvin M. Klann2024-05-20
|\ | | | | build: add strip target and simplify install targets
| * build: remove redundant realinstall targetLibravatar Kelvin M. Klann2024-05-17
| | | | | | | | | | | | | | | | Leave just the "install" and "install-strip" targets. See commit 099925e18 ("added install-strip, make install now without strip.", 2015-09-10) / PR #60 and commit 0215cbc02 ("make install, make install-strip", 2015-09-11).
| * build: add a standalone strip targetLibravatar Kelvin M. Klann2024-05-17
| | | | | | | | | | Move the strip invocation into its own target to allow stripping binaries without having to run the "realinstall" target.
* | Merge pull request #6339 from kmk3/build-sort-py-nLibravatar Kelvin M. Klann2024-05-20
|\ \ | | | | | | build: sort.py: use -i by default and add -n
| * | build: sort.py: support "--" and fail on unknown optionLibravatar Kelvin M. Klann2024-05-13
| | | | | | | | | | | | Support "--" to end options and fail if an unknown option is given.
| * | build: sort.py: use -i by default and add -nLibravatar Kelvin M. Klann2024-05-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Overwrite in-place by default (`-i`) and add `-n` to override it. This restores the previous default behavior (from 0.9.72), for the sake of being consistent with all previous versions and because it's more likely to be the desired behavior in most cases. This amends commit aa08aa132 ("build: sort.py: add and require -i to edit in-place (#6290)", 2024-03-25).
* | | build(deps): bump github/codeql-action from 3.25.4 to 3.25.5Libravatar dependabot[bot]2024-05-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.4 to 3.25.5. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/ccf74c947955fd1cf117aef6a0e4e66191ef6f61...b7cec7526559c32f1616476ff32d17ba4c59b2d6) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | build(deps): bump actions/checkout from 4.1.5 to 4.1.6Libravatar dependabot[bot]2024-05-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.5 to 4.1.6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/44c2b7a8a4ea60a981eaca3cf939b5f4305c123b...a5ac7e51b41094c92402da3b24376905380afc29) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | ci: make dependabot updates monthly and bump PR limit (#6338)Libravatar Kelvin M. Klann2024-05-18
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is currently only used for GitHub Actions. The ones used in this project rarely ever contain notable changes in their changelogs (in a way that would cause a noticeable difference in our CI). Also, there are weeks when most/all of the PR/commit activity is from dependabot PRs being opened/merged. For example, see the output of the following command: git log --no-decorate --oneline 9a0db13e12..bef085035 So change the checks from weekly to monthly to reduce the noise. Additionally, bump `open-pull-requests-limit` to 4, as it seems that we only have 4 dependencies: $ git grep 'uses:' -- .github/ | sed -E 's/.*(uses: .*)@.*/\1/' | LC_ALL=C sort -u uses: actions/checkout uses: github/codeql-action/analyze uses: github/codeql-action/init uses: step-security/harden-runner This should ensure that PRs can be opened against all of them when the dependabot check is run.
* | New profile: nhex (#6341)Libravatar glitsj162024-05-17
| | | | | | | | | | | | Description: Tauri-based IRC client inspired by HexChat. https://nhexirc.com/ https://github.com/nhexirc/nhex
* | profiles: hexchat: add noprinters (#6340)Libravatar glitsj162024-05-14
|/
* build(deps): bump github/codeql-action from 3.25.3 to 3.25.4Libravatar dependabot[bot]2024-05-13
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.3 to 3.25.4. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/d39d31e687223d841ef683f52467bd88e9b21c14...ccf74c947955fd1cf117aef6a0e4e66191ef6f61) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump actions/checkout from 4.1.4 to 4.1.5Libravatar dependabot[bot]2024-05-13
| | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.4 to 4.1.5. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/0ad4b8fadaa221de15dcec353f45205ec38ea70b...44c2b7a8a4ea60a981eaca3cf939b5f4305c123b) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* profiles: steam: update novideo comment for webcam motion trackers (#6334)Libravatar duevo2024-05-12
| | | | | | Update comment to account for camera-based motion trackers. Fixes an issue with https://github.com/markx86/opentrack-launcher, where video input devices won't show up unless novideo is removed.
* profiles: loupe: harden and disable apparmor (#6333)Libravatar Kelvin M. Klann2024-05-12
| | | | | | | | | | | | | | | | | | The profile currently does not include disable-common nor makes `${HOME}` read-only, so the program can simply write to ~/.bashrc directly[1]. disable-common.inc was commented due to it apparently breaking bwrap. As discovered by @glitsj16, it seems that allowing the bwrap binary is enough to make it work (and that apparmor breaks loupe)[2]. So disable apparmor, allow bwrap and include disable-common.inc, plus other hardening by @glitsj16. This amends commit 9a0db13e1 ("profiles: add loupe", 2024-04-30) / PR #6327. [1] https://github.com/netblue30/firejail/pull/6327#pullrequestreview-2033860865 [2] https://github.com/netblue30/firejail/pull/6333#issuecomment-2099805480
* landlock: fix misc alignment/newlineLibravatar Kelvin M. Klann2024-05-12
| | | | | | | This amends commit bf5a99360 ("landlock: add support for PATH macro", 2023-12-22). Relates to #6078.
* profiles: hexchat: allow lua/downloads and harden (#6331)Libravatar glitsj162024-05-07
| | | | | | | | | | | | | | | * profiles: hexchat: hardenings * profiles: hexchat: allow lua/downloads and harden Allow more paths and add some extra options to harden the profile. We allow Perl but keep it out of private-bin. Do the same for Lua and clarify in the private-bin comment how to enable these interpreters. Consulted resources: - https://github.com/hexchat/hexchat/ - https://hexchat.readthedocs.io/
* build(deps): bump step-security/harden-runner from 2.7.0 to 2.7.1Libravatar dependabot[bot]2024-05-07
| | | | | | | | | | | | | | Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.7.0 to 2.7.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/63c24ba6bd7ba022e95695ff85de572c04a18142...a4aa98b93cab29d9b1101a6143fb8bce00e2eac4) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* New profile: d-spy (#6328)Libravatar glitsj162024-05-02
| | | | | | | | | | | Description: D-Bus debugger for GNOME https://gitlab.gnome.org/GNOME/d-spy From [1]: > D-Feet is no longer maintained. Please use d-spy [1] https://wiki.gnome.org/Apps/DFeet
* build(deps): bump github/codeql-action from 3.24.10 to 3.25.3Libravatar dependabot[bot]2024-05-01
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.24.10 to 3.25.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/4355270be187e1b672a7a1c7c7bae5afdc1ab94a...d39d31e687223d841ef683f52467bd88e9b21c14) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
* build(deps): bump actions/checkout from 4.1.2 to 4.1.4Libravatar dependabot[bot]2024-05-01
| | | | | | | | | | | | | | | Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.2 to 4.1.4. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/9bb56186c3b09b4f86b1c65136769dd318469633...0ad4b8fadaa221de15dcec353f45205ec38ea70b) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 12:28:20 +0000