aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* archivers: move archiver-common.inc include to the bottomLibravatar Kelvin M. Klann2021-02-08
| | | | | | | And mark it as a redirect profile. This is done so when including other *-common.inc profiles, such as firefox-common.profile.
* formatingLibravatar netblue302021-02-08
|
* security advisoryLibravatar netblue302021-02-08
|
* use ${DOWNLOADS} in lutris.profile (#3955)Libravatar glitsj162021-02-07
|
* Add profile for Gemini (#3946)Libravatar Neo000012021-02-07
| | | | | | | | | | | * Update disable-programs.inc * Create calligragemini.profile * Update calligra.profile * Update calligra.profile * Update firecfg.config
* Merge pull request #3950 from kmk3/di-fixesLibravatar rusty-snake2021-02-07
|\ | | | | disable-interpreters.inc: blacklist the other libmozjs
| * disable-interpreters.inc: blacklist the other libmozjsLibravatar Kelvin M. Klann2021-02-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And sort the paths on allow-gjs.inc. $ pacman -Q js78 js78 78.6.0-1 $ pacman -Qlq js78 | grep -v /usr/include/ /usr/ /usr/bin/ /usr/bin/js78 /usr/bin/js78-config /usr/lib/ /usr/lib/libmozjs-78.so /usr/lib/pkgconfig/ /usr/lib/pkgconfig/mozjs-78.pc This appears to be the only counterpart path missing when looking at the current lib64 entries with: $ grep -Fnr lib64 etc
| * disable-interpreters.inc: sort pathsLibravatar Kelvin M. Klann2021-02-06
| |
* | disabled overlayfs, fixes pending; added video channels to README* filesLibravatar netblue302021-02-06
|/
* add a /usr/share whitelist item for uimLibravatar Anton Shestakov2021-02-05
| | | uim is a multilingual input method framework, so any program that takes user input potentially needs it to work.
* fixup! Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | damn, forgotten to add
* Update spectacle.profileLibravatar Neo000012021-02-04
|
* Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | | | blacklist ${HOME}/.vwmare is already in disable-programs.inc I did not add it to firecfg.config because it has many extra features such as usb-redirection that I could not test.
* tests: check with faudit if tests are run sandboxedLibravatar Reiner Herrmann2021-02-03
|
* Add Github Actions badgesLibravatar Fred Barclay2021-02-02
|
* Update support/security info for release 0.9.64Libravatar Fred Barclay2021-02-02
|
* keepassxc: allow all browser, not just firefoxLibravatar rusty-snake2021-02-02
| | | | ungoogled-chromium won't work with keepassxc (#3941)
* Seccomp error action fixesLibravatar Topi Miettinen2021-02-01
| | | | | | | | | | | | | | fsec-optimize: Optimize BPF with current seccomp error action, not just KILL fseccomp: use correct BPF code for errno action firejail: honor seccomp error action for X32 and secondary filters, rebuild filters if the error action is changed Closes: #3933 Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* Add profile for avidemux (#3935)Libravatar Neo000012021-01-31
| | | | | | | | | | | * Update disable-programs.inc * Update disable-programs.inc * Update firecfg.config * Create avidemux.profile * Update avidemux.profile
* build: clean generated test/MakefileLibravatar Reiner Herrmann2021-01-31
|
* tests: increase shutdown timeout a bitLibravatar Reiner Herrmann2021-01-31
| | | | in Debian CI and during local tests I ran into the timeout
* Merge pull request #3936 from irandms/fix-firecfg-man-typoLibravatar rusty-snake2021-01-31
|\ | | | | Fix minor typo in firecfg's manual page
| * Fix minor typo in firecfg's manual pageLibravatar irandms2021-01-31
|/
* Disable the webkit2gtk-4.0 sandbox in bijibenLibravatar rusty-snake2021-01-31
| | | | | | | | | | | | | webkit2gtk uses a bwrap based sandbox by default since 4.0, see #3647. This is good as it means more security by default on for linux system. Unfortunately is it not possible to run bwrap inside firejail if bwrap is started with --unshare-pid --proc /proc at all. In general we should exclude a program from firecfg until a final solution is found. But bijiben is special, while epiphany or evolution display random stuff from the internet is webkit2gtk in bijiben used to display local files create by the user. Bijiben has a thight profile (net none, whitelist, private-bin, ...) therefore my decision here was to disable the webkit2gtk sandbox rather then firejail.
* add quiet to lzdiff/lzmadec (#3932)Libravatar glitsj162021-01-30
| | | | | * add quiet to lzdiff * add quiet to lzmadec
* Merge pull request #3931 from glitsj16/follow-up-3914Libravatar glitsj162021-01-30
|\ | | | | follow-up fixes for #3914
| * follow-up fixes for ↵Libravatar glitsj162021-01-29
| | | | | | | | https://github.com/netblue30/firejail/commit/43aa71f8c608ec5bd92fd2c7323c603fa37f6d30
* | tests: improve check for sound capabilities (#3929)Libravatar Reiner Herrmann2021-01-30
| | | | | | Fixes: #3928
* | Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ \ | | | | | | ssh: Refactor, fix bugs & harden
| * | disable-common.inc: add missing openssh pathsLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The paths are taken from ssh(1) and sshd(8). $ pacman -Q openssh openssh 8.4p1-2 These are only used by sshd(8), so always blacklist them: * ~/.rhosts: controls remote access to the local machine * ~/.shosts: same as above * ~/.ssh/authorized_keys: same as above * ~/.ssh/authorized_keys2: same as above * ~/.ssh/environment: potentially allows arbitrary command execution on the local machine * ~/.ssh/rc: allows arbitrary command execution on the local machine * /etc/hosts.equiv: system-wide equivalent of ~/.rhosts Note: There are files in /etc/ssh that are equivalent to some of the above ones, but they are already blocked by `blacklist /etc/ssh/*`. Note2: From sshd(8): > If the file ~/.ssh/rc exists, sh(1) runs it after reading the > environment files but before starting the user's shell or command. So even if the user shell is set to /usr/bin/firejail and disable-common.inc is loaded, this patch shouldn't interfere with sshd. This file is actually used by ssh(1), so just mark it read-only: * ~/.ssh/config: allows arbitrary command execution on the remote machine (with e.g.: RemoteCommand) and also defines the connection strength Since version 7.3p1 (released on 2016-08-01), openssh supports including other config files on ssh_config(5)[1][2]. This is the conventional path for storing them[3], so mark it read-only: * ~/.ssh/config.d: same as above P.S. See also the explanation on the commit b5542fc94 ("disable-common.inc: read-only access to ~/.ssh/authorized_keys"), which last touched/added the "Remote access" section. [1]: https://anongit.mindrot.org/openssh.git/commit/?id=dc7990be865450574c7940c9880567f5d2555b37 [2]: https://www.openssh.com/txt/release-7.3 [3]: https://superuser.com/a/1142813
| * | allow-ssh.inc: allow access to ssh-agent(1)Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Leaving it limited to only ssh, ssh-agent and seahorse by default seems unnecessarily restrictive. From ssh(1): > The most convenient way to use public key or certificate > authentication may be with an authentication agent. See ssh-agent(1) > and (optionally) the AddKeysToAgent directive in ssh_config(5) for > more information. $ pacman -Q openssh openssh 8.4p1-2 With ssh-agent(1) running in the background (and with the private key(s) loaded through ssh-add(1)), ssh(1) doesn't need direct access to the actual key pair(s), so you could probably get away with this on allow-ssh.local: ignore noblacklist ${HOME}/.ssh noblacklist ${HOME}/.ssh/config noblacklist ${HOME}/.ssh/config.d noblacklist ${HOME}/.ssh/known_hosts And then this on the profiles of ssh key pair managers, such as seahorse.local: noblacklist ${HOME}/.ssh
| * | ssh: deny access to the rest of /etc/ssh/*Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ssh_config (allowed on allow-ssh.inc) is the only file in /etc/ssh that is used by ssh(1). The other paths are only used by sshd(8), so stop allowing them on ssh.profile and ssh-agent.profile. Path examples from sshd(8): * /etc/ssh/moduli * /etc/ssh/ssh_host_ecdsa_key * /etc/ssh/ssh_host_ecdsa_key.pub * /etc/ssh/ssh_known_hosts * /etc/ssh/sshd_config * /etc/ssh/sshrc $ pacman -Q openssh openssh 8.4p1-2
| * | allow-ssh.inc: allow /etc/ssh/ssh_configLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the system-wide equivalent of ~/.ssh/config. $ pacman -Q openssh openssh 8.4p1-2 Reasons for blacklisting both /etc/ssh and /etc/ssh/* on disable-common.inc: Leave /etc/ssh that way so that profiles without allow-ssh.inc remain unable to see inside of /etc/ssh. And blacklist /etc/ssh/* so that profiles with allow-ssh.inc are able to access only nonblacklisted files inside of /etc/ssh.
| * | etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
| * | git-cola.profile: add missing python template commentLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | See etc/templates/profile.template.
| * | ssh: move auth socket blacklist to disable-common.incLibravatar Kelvin M. Klann2021-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | That was added on the commit e93fbf3bd ("disable ssh-agent sockets in disable-programs.inc"). Currently, it's the only ssh-related entry on disable-programs.inc. Further, it seems that all the other socket blacklists live on disable-common.inc. Also, even though this socket does not necessarily allow arbitrary command execution on the local machine (like some paths on disable-common.inc do), it could still do so for remote systems. Put it above the "top secret" section, like the terminal sockets are above the terminal server section.
* | | Fix #3925 -- telegram-desktop launch browser for …Libravatar rusty-snake2021-01-29
| | | | | | | | | | | | …open URL (after update to 0.9.64.2)
* | | Add gfeeds directory for saved articlesLibravatar rusty-snake2021-01-29
| |/ |/|
* | Merge pull request #3897 from nidamanx/patch-1Libravatar rusty-snake2021-01-28
|\ \ | | | | | | Update telegram.profile
| * | Profile ordering/sorting as in profile.templateLibravatar Nicola Davide Mannarelli2021-01-25
| | |
| * | Enhance securityLibravatar Nicola Davide Mannarelli2021-01-25
| | |
| * | Update telegram.profileLibravatar Nicola Davide Mannarelli2021-01-17
| | | | | | | | | Optimized "include whitelist-common.inc"
| * | Update telegram.profileLibravatar Nicola Davide Mannarelli2021-01-17
| | | | | | | | | Allow Telegram ONLY in .TelegramDesktop, .local/share/TelegramDesktop and Downloads
* | | add extensive comment on sandboxing google-earth-pro (#3923)Libravatar glitsj162021-01-28
| | |
* | | streamline 'Allow xxx' comments (#3922)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add comment: allow python * add comment: allow python * reorder allow comments * fix perl allow comment * add comment: allow python * add comment: allow lua, perl & python * reorder allow comments * add comment: allow python * add comment: allow python * add comment: allow lua, perl & python * fix allow comments * add comment: allow python * add comment: allow python * fix spacing in comments * add comment: allow python * add comment: allow python * fix comment * add comment: allow perl & python * add comment: allow lua & python * add comment: allow lua, perl & python * fix allow comments * add comment: allow perl & python * streamline allow python comments
* | | readme.mdLibravatar netblue302021-01-27
|\ \ \
| * | | revert #3920 (#3921)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | * revert #3920 * revert #3920
| * | | remove noblacklist without blacklist (#3920)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * remove noblacklist without blacklist in aosp ${HOME}/.bash_history is not blacklisted anywhere. Hence a noblacklist doesn't make sense here. * remove noblacklist without blacklist in gnome-builder ${HOME}/.bash_history is not blacklisted anywhere. Hence a noblacklist doesn't make sense here.
* | | | back to 0.9.65; rel 0.9.64.2 moved on a different branch, out in the next ↵Libravatar netblue302021-01-27
|/ / / | | | | | | | | | two days
* | | rel 0.9.64.2 testing - make test-compileLibravatar netblue302021-01-26
| | |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 13:05:10 +0000