| Commit message (Collapse) | Author | Age |
|---|
| ... | |
| | | |
|
| | | |
|
| | | |
|
| |\ \
| | |
| | | |
Miscellaneous whitelist-runuser-common fixes
|
| | | |
| | |
| | |
| | |
| | |
| | | |
If the GDM display manager runs with Wayland support, and it starts a
desktop environment other than (?) GNOME, the desktop environment will
use the `wayland-1` socket instead of the `wayland-0` socket.
|
| | | |
| | |
| | |
| | |
| | | |
We must ignore include `whitelist-runuser-common.profile`,
because it breaks Enigmail (TB 68) and GnuPG smartcard (TB 78) support.
|
| |\ \ \
| | | |
| | | | |
reimplement --private-cache using --tmpfs
|
| | | | | |
|
| |\ \ \ \
| | | | |
| | | | | |
reimplement --get using --cat
|
| | | | | | |
|
| | |_|/ /
|/| | |
| | | | |
Cfr. https://github.com/netblue30/firejail/pull/3517#issuecomment-664715880: element-desktop no longer uses ${HOME}/.config/Element (Riot).
|
| | | | |
| | | |
| | | | |
rm is needed to uninstall mods and delete game saves (worlds).
|
| | |/ /
|/| |
| | |
| | |
| | |
| | | |
- disable-common: read-only ${HOME}/.zfunc
- fix #3761 -- w3m with w3m-img installed does not display images when on virtual console/framebuffer
- yelp can be used to display manpages
|
| | | | |
|
| | | | |
|
| | | | |
|
| |\ \ \
| | | |
| | | | |
install libraries needed by fcopy when using private-lib
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | | |
Fixes #3741
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
* Add profile for straw-viewer
* Remove blacklist, fixes
|
| |\ \ \ \
| | | | |
| | | | | |
from my overrides
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
- add seccomp.block-secondary to a lot profiles
- add wruc to firefox-common and ignore it in TB and
firefox-common-addons
- harden dia, gnome-keyring, libreoffice, megaglest, pngquant,
ghostwriter, rhythmbox, sqlitebrowser
|
| | |_|_|/
|/| | | |
|
| | | | |
| | | |
| | | | |
Follow-up from discussion in https://github.com/netblue30/firejail/pull/3751.
|
| |\ \ \ \
| | | | |
| | | | | |
disable-shell.inc: add mksh shell
|
| |/ / / / |
|
| |/ / /
| | |
| | |
| | |
| | | |
* add dbus comment
* disable dbus
|
| | | |
| | |
| | |
| | | |
…eed to wruc
|
| | | |
| | |
| | |
| | | |
- this might need to be looked into
|
| |/ /
| |
| | |
At least on Ubuntu 16.04 LTS we need an additional own.
|
| | |
| |
| | |
It's the path to the game's data in the official Debian package.
|
| | | |
|
| | | |
|
| | |
| |
| | |
fix for #3737.
|
| | |
| |
| | |
Added ${HOME}/.alsaequal.bin to fix #3736
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
- .github/ISSUE_TEMPLATE/bug_report.md: get ride off spanish,
french, ... error messages
- etc/inc/firefox-common-addons.inc: support ff2mpv
- etc/profile-a-l/gimp.profile: note about xsane
- etc/profile-m-z/min.profile: prettify
- etc/profile-m-z/mpsyt.profile: fix, add lua
- etc/profile-m-z/qbittorrent.profile: add note for tray-icons; this
will get a better note once I investigated and audited all the D-Bus
tray stuff.
- etc/profile-m-z/transmission-daemon.profile: fix, add protocol packet
close #3686 - mps-youtube needs lua
close #3701 - Firefox native messaging regression in 0.9.62.4 -> 0.9.64rc1
close #3636 - transmission-daemon fills log with error
close #3640 - Gimp - add note how to enable scanning (xsane)
close #3707 - qBittorrent tray icon missing from notification panel when running it with firejail
|
| | | |
|
| | |
| |
| | |
As per https://github.com/netblue30/firejail/pull/3688#discussion_r511290714 min needs wusc. Runs fine with wruc too so let's fix min for users.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* rework chromium
+ 516d0811 has removed fundamental security features.
(remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
Though this is only necessary if running under a kernel which
disallow
unprivileged userns clones. Arch's linux-hardened and debian kernel
are
patched accordingly. Arch's linux and linux-lts kernels support this
restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
Other kernels such as mainline or fedora/redhat always support
unprivileged
userns clone and have no sysctl parameter to disable it. Debian and
Arch
users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
This commit adds a chromium-common-hardened.inc which can be included
in
chromium-common to enhance security of chromium-based programs.
+ chromium-common.profile: add private-cache
+ chromium-common.profile: add wruc and wusc, but disable it for the
following
profiles until tested. tests welcome.
- [ ] bnox, dnox, enox, inox, snox
- [ ] brave
- [ ] flashpeak-slimjet
- [ ] google-chrome, google-chrome-beta, google-chrome-unstable
- [ ] iridium
- [ ] min
- [ ] opera, opera-beta
+ move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
/usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
missed also some features from vivaldi.profile, solve this by making
it
redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
also for vivaldi-snapshot?
+ create chromium-browser-privacy.profile (closes #3633)
* update 1
+ add missing 'ignore whitelist /usr/share/chromium'
+ revert 'Move drm-relaktions in vivaldi.profile behind
BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such
as AAC too. In addition vivaldi shows a something is broken pop-up,
we would have a lot of 'does not work with firejail' issues.
* update 2
* update 3
fixes #3709
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| |\ \
| | |
| | | |
ci: enable test-fs tests on github-ci
|
| | |\ \
| |/ /
|/| | |
|
| | | |
| | |
| | |
| | | |
linphone 4.0 changed the location of config and database files
to respect freedesktop standards.
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
- update README.md and RELNOTES
- add 'blacklist ${RUNUSER}/.flatpak-cache' to disable-common.inc
- fix #3728, fonts in openSUSE KDE with wc / wusc
- fix gnome-todo
- fix xournalpp MathTeX whitelist
|
glitsj16
netblue30
Kristóf Marussy
smitsohu
Liorst4
rusty-snake
Reiner Herrmann
kortewegdevries
Ypnose
Tad
Davide Beatrici
netblue30
Dara Adib