aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Merge pull request #5309 from qretornaz-adapei42/masterLibravatar netblue302022-08-14
|\ | | | | microsoft-edge.profile rewritten for stable channel and moved microsoft-edge{,-beta,-dev} from private-opt to whitelist
| * microsoft-edge-{dev,beta}: replaced private-opt by whitelist #5307Libravatar Quentin RETORNAZ2022-08-11
| |
| * microsoft-edge.profile: rewrite profile for stable channelLibravatar Quentin RETORNAZ2022-08-11
| | | | | | | | | | | | * replaced private-opt by whitelist #5307 * added stable channel config dirs to disable-programs.inc
* | Merge pull request #5296 from kmk3/docs-man-vim-ftLibravatar netblue302022-08-14
|\ \ | | | | | | docs: set vim filetype on man pages for syntax highlighting
| * | docs: set vim filetype on man pages for syntax highlightingLibravatar Kelvin M. Klann2022-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the man pages in src/man use a ".txt" file extension (rather than ".1" or ".5"), their filetype is detected by (neo)vim as "text". So at the bottom of every man page, add a vim modeline in a comment and set the filetype to "groff", to enable syntax highlighting. Note: All of the generated ".man", ".1" and ".5" files are currently being detected as "nroff". Note2: Set the filetype to "groff" rather than "nroff" because at least .UR and .UE are groff extensions. These macros look the same with either filetype, but there may be more extensions being used and the nroff.vim syntax file (which is included by groff.vim) does things differently based on which filetype is used. Based on the following example from (neo)vim's filetype.txt: or add this modeline to the file: /* vim: set filetype=idl : */ See `:help groff.vim` and `:help filetype.txt` in (neo)vim. See also groff_man(7) for the man page macros (including extensions). Environment: neovim 0.7.2-3 on Artix Linux. Misc: I noticed this on #5290.
* | | Merge pull request #5290 from kmk3/docs-suid-firejail-usersLibravatar netblue302022-08-14
|\ \ \ | | | | | | | | docs: mention risk of SUID binaries and also firejail-users(5)
| * | | docs: mention risk of SUID binaries and also firejail-users(5)Libravatar Kelvin M. Klann2022-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On the introduction of firejail(1), mention the main risk of SUID binaries and that by default, only trusted users should be allowed to run firejail (and how to accomplish that). Note: The added comment line is completely discarded (so there is no extraneous blank line); see groff_man(7) for details. Suggested by @emerajid on #5288. Relates to #4601.
* | | | Merge pull request #5285 from ra1nb0w/vmware-snapshotLibravatar netblue302022-08-14
|\ \ \ \ | | | | | | | | | | vmware.profile: snapshot requires /etc/mtab
| * | | | vmware.profile: snapshot requires /etc/mtabLibravatar Davide Gerhard2022-08-02
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | This patch avoid the following error: Error: One of the parameters supplied is invalid Tested with VMware Workstation 16.2.4
* | | | mergesLibravatar netblue302022-08-14
| | | |
* | | | Merge pull request #5274 from ChrysoliteAzalea/masterLibravatar netblue302022-08-14
|\ \ \ \ | | | | | | | | | | Add support for custom AppArmor profiles (--apparmor=)
| * | | | Add support for custom AppArmor profiles (--apparmor=)Libravatar Азалия Смарагдова2022-08-05
| |/ / /
* | | | RELNOTES: add build itemsLibravatar Kelvin M. Klann2022-08-12
| | | | | | | | | | | | | | | | Relates to #5283 #5284.
* | | | neomutt: Avoid creating empty files/directoriesLibravatar Hugo Osvaldo Barrera2022-08-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | neomutt won't write to these locations. Processes it spawns might read to some of them, but creating an empty file doesn't help. This just pollutes user's $HOME with empty files and directories. I've kept a few paths that MAY be written to by neomutt; it's not ideal, but I want to minimise the risk of potential data loss, even if it is corener cases. See: https://github.com/netblue30/firejail/discussions/5276
* | | | Merge pull request #5284 from kmk3/build-config-sh-fixesLibravatar Kelvin M. Klann2022-08-11
|\ \ \ \ | | | | | | | | | | build: config.sh.in: quote variables and fix shellcheck issues
| * | | | config.sh.in: fix all issues reported by shellcheckLibravatar Kelvin M. Klann2022-08-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following error and warnings: $ shellcheck --version | grep ^version: version: 0.8.0 $ shellcheck config.sh.in In config.sh.in line 1: # @configure_input@ ^-- SC2148 (error): Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive. In config.sh.in line 3: NAME=@PACKAGE_NAME@ ^--^ SC2034 (warning): NAME appears unused. Verify use (or export if used externally). In config.sh.in line 4: VERSION=@PACKAGE_VERSION@ ^-----^ SC2034 (warning): VERSION appears unused. Verify use (or export if used externally). For more information: https://www.shellcheck.net/wiki/SC2148 -- Tips depend on target shell and y... https://www.shellcheck.net/wiki/SC2034 -- NAME appears unused. Verify use (... Relates to #5140.
| * | | | config.sh.in: quote all variablesLibravatar Kelvin M. Klann2022-08-01
| |/ / / | | | | | | | | | | | | | | | | | | | | | | | | Output variables in general may contain values with spaces in them. Example: `CC=gcc -foo`. Relates to #5140.
* | | | Merge pull request #5283 from remyabel2/make-uninstallLibravatar Kelvin M. Klann2022-08-11
|\ \ \ \ | |_|_|/ |/| | | build: Add files `make uninstall` forgot to remove
| * | | Add files `make uninstall` forgot to removeLibravatar Tommy Nguyen2022-08-01
| | | | | | | | | | | | | | | | | | | | There were a couple of files leftover after `make uninstall`. This patch fixes that.
* | | | fix(audacity): !5281 sharedlib bug on Arch/Fedora (#5300)Libravatar Christopher Morrow2022-08-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix(audacity): !5281 sharedlib bug on Arch/Fedora removed `private-bin` line from audacity profile as it appears to block access to shared libraries needed to start audacity on some distributions. Relates to github issue #5281 * fix(audacity): Disabling apparmor and reenabling private-bin
* | | | Merge pull request #5299 from pirate486743186/description-makepkgLibravatar Kelvin M. Klann2022-08-10
|\ \ \ \ | | | | | | | | | | makepkg: add description
| * | | | makepkg.profile: add descriptionLibravatar pirate4867431862022-08-10
| | |_|/ | |/| |
* | | | new profile: gdu (#5289)Libravatar glitsj162022-08-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add gdu to 'new profiles' section * Create gdu.profile * add gdu to firecfg * harden gdu sandbox * fix protocol * simulate empty protocol in gdu * more user-friendly gdu sandboxing
* | | | build(deps): bump github/codeql-action from 2.1.17 to 2.1.18Libravatar dependabot[bot]2022-08-08
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.17 to 2.1.18. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/0c670bbf0414f39666df6ce8e718ec5662c21e03...2ca79b6fa8d3ec278944088b4aa5f46912db5d63) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | / build(deps): bump github/codeql-action from 2.1.16 to 2.1.17Libravatar dependabot[bot]2022-08-03
| |/ |/| | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.16 to 2.1.17. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/3e7e3b32d0fb8283594bb0a76cc60a00918b0969...0c670bbf0414f39666df6ce8e718ec5662c21e03) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | RELNOTES: add build and ci itemsLibravatar Kelvin M. Klann2022-08-01
| | | | | | | | Relates to #5248 #5249 #5251.
* | RELNOTES: add feature: Warn when encountering EIO during remountLibravatar Kelvin M. Klann2022-08-01
|/ | | | Relates to #5240 #5242.
* Merge pull request #5259 from smitsohu/nsLibravatar smitsohu2022-07-31
|\ | | | | introduce new option restrict-namespaces
| * introduce new option restrict-namespacesLibravatar smitsohu2022-07-23
| |
| * protocol filter: add x32 ABI handlingLibravatar smitsohu2022-07-19
| |
* | Merge pull request #5271 from smitsohu/nnpLibravatar smitsohu2022-07-31
|\ \ | | | | | | improve force-nonewprivs security guarantees
| * | improve force-nonewprivs security guaranteesLibravatar smitsohu2022-07-24
| | |
* | | Merge pull request #5251 from kmk3/build-add-autoconf-commentLibravatar smitsohu2022-07-31
|\ \ \ | | | | | | | | build: add autoconf auto-generation comment to input files
| * | | build: add autoconf auto-generation comment to input filesLibravatar Kelvin M. Klann2022-07-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To note on the output files that they are generated and to clarify how they are generated. From the manual of GNU Autoconf (version 2.69): > -- Variable: configure_input > A comment saying that the file was generated automatically by > 'configure' and giving the name of the input file. 'AC_OUTPUT' > adds a comment line containing this variable to the top of every > makefile it creates. For other files, you should reference this > variable in a comment at the top of each input file. For > example, an input shell script should begin like this: > > #!/bin/sh > # @configure_input@ > > The presence of that line also reminds people editing the file > that it needs to be processed by 'configure' in order to be used. Resulting output on config.mk: # config.mk. Generated from config.mk.in by configure. Relates to #5140.
* | | | Merge pull request #5249 from kmk3/ci-ignore-git-pathsLibravatar smitsohu2022-07-31
|\ \ \ \ | | | | | | | | | | ci: ignore git-related paths and the project license
| * | | | ci: ignore git-related paths and the project licenseLibravatar Kelvin M. Klann2022-07-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add the following paths to the ignore lists: - .git-blame-ignore-revs - .gitignore - COPYING To avoid running CI unnecessarily. Commands used to show only the root files: $ git ls-files | grep -v / Misc: I noticed the missing paths on #5248.
* | | | | Merge pull request #5248 from kmk3/build-gitignore-distdirLibravatar smitsohu2022-07-31
|\ \ \ \ \ | | | | | | | | | | | | build: add dist build directory to .gitignore
| * | | | | build: add dist build directory to .gitignoreLibravatar Kelvin M. Klann2022-07-12
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ignore it only on the repository root path, as a directory that matches `firejail-*` could eventually be added. Note that the dist archive is already ignored since commit da6b131c3 ("chore(.gitignore) ignore built packages", 2018-01-15) / PR #1733. Example paths: * build dir: firejail-0.9.71/ * archive: firejail-0.9.71.tar.xz See `$(NAME)-$(VERSION)` and `$(NAME)-$(VERSION).tar.xz` in the "dist" target on the root Makefile.
* | | | | update m4 macro from autoconf-archive (2022.02.11)Libravatar Reiner Herrmann2022-07-31
| | | | |
* | | | | Merge pull request #5275 from netblue30/ci_ubuntu_2204Libravatar Reiner Herrmann2022-07-30
|\ \ \ \ \ | | | | | | | | | | | | CI: bump ubuntu to 22.04 and use newer compilers / analyzers
| * | | | | CI: keep old cppcheck job and ignore two files in new job that take too long ↵Libravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | to check
| * | | | | CI: bump ubuntu to 22.04 and use newer compilers / analyzersLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | tests: disable calling curl in dns test, as systemd-resolved is used on CI ↵Libravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | runner
| * | | | | tests: try curl instead of wget for tracing dns resolutionLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | tests: add alternative message for skipping testLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | tests: drop checking for hosts file in trace testLibravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | firejail is no longer detecting that /etc/hosts is getting opened. in strace it can still be seen that the file is opened via syscall, but on C library layer (which firejail is tracing) it's probably implemented differently now.
| * | | | | CI: fix wrong matching for test errorsLibravatar Reiner Herrmann2022-07-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | grep was returning non-zero exit code if it did NOT find the error marker, and zero if it did.
| * | | | | Make list of paths const to fix a false positive of gcc analyzerLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | zero-initialize two variablesLibravatar Reiner Herrmann2022-07-30
| | | | | |
| * | | | | CI: build all jobs with apparmor / selinux to cover more codeLibravatar Reiner Herrmann2022-07-30
|/ / / / /
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-11 22:01:09 +0000