aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
...
* | speed up firemonLibravatar netblue302022-06-02
|/
* Merge pull request #5170 from kmk3/ids-add-sh-pathsLibravatar netblue302022-05-31
|\ | | | | ids.config: add missing global shell paths
| * ids.config: add missing global shell pathsLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | Add missing paths for bash, ksh and zsh. Environment: Artix Linux
* | Merge pull request #5167 from kmk3/mv-sh-profile-blacklistLibravatar netblue302022-05-31
|\ \ | |/ |/| profiles: move blacklist of /etc/profile.d & blacklist /etc/profile
| * disable-shell.inc: blacklist /etc/profileLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | Since /etc/profile.d is already being blacklisted.
| * disable-common.inc: move blacklist of /etc/profile.dLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to #3411 #5159.
| * kate.profile: add missing include commentLibravatar Kelvin M. Klann2022-05-30
|/ | | | | | | This amends commit b6b3f3b38 ("kate.profile: allow common development file access", 2022-05-28) / PR #5159. See etc/templates/profile.template.
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-05-30
|\
| * Merge pull request #5154 from kmk3/build-clean-up-distLibravatar netblue302022-05-30
| |\ | | | | | | mkdeb.sh.in: pass remaining arguments to ./configure
| | * mkdeb.sh.in: pass remaining arguments to ./configureLibravatar Kelvin M. Klann2022-05-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, mkdeb.sh (which is used to make a .deb package) runs ./configure with hardcoded options (some of which are automatically detected based on configure-time variables). To work around the hardcoding, contrib/fj-mkdeb.py is used to add additional options by rewriting the actual call to ./configure on mkdeb.sh. For example, the following invocation adds --disable-firetunnel to mkdeb.sh: $ ./configure && ./contrib/fj-mkdeb.py --disable-firetunnel To avoid depending on another script and to avoid re-generating mkdeb.sh, just let the latter pass the remaining arguments (the first one is an optional package filename suffix) to ./configure directly. Example: $ make distclean && ./configure && make dist && ./mkdeb.sh "" --disable-firetunnel Additionally, change contrib/fj-mkdeb.py to do roughly the same as the above example, by simply forwarding the arguments that it receives to ./mkdeb.sh (which then forwards them to ./configure). Also, remove the --only-fix-mkdeb option, since the script does not change mkdeb.sh anymore. With these changes, the script's usage (other than when using --only-fix-mkdeb) should remain the same. Note: To clean the generated files and then make a .deb package using the default configuration, the invocation is still the same: $ make distclean && ./configure && make deb Note2: Running ./configure in the above examples is only needed for generating Makefile/mkdeb.sh from Makefile.in/mkdeb.sh.in after running distclean, so that running `make` / `./mkdeb.sh` afterwards works. Should fully fix #772. Relates to #1205 #3414 #5148.
| | * fj-mkdeb.py: run distclean before ./configureLibravatar Kelvin M. Klann2022-05-27
| | | | | | | | | | | | | | | | | | | | | This (mostly) restores the behavior from before commit 1fb814e51 ("Makefile.in: stop running distclean on dist", 2022-05-13) / PR #5142. ./configure still has to be called before calling ./contrib/fj-mkdeb.py (to generate Makefile from Makefile.in before calling `make distclean`).
| | * mkdeb.sh.in: remove unused PACKAGE_TARNAME/TOP varsLibravatar Kelvin M. Klann2022-05-27
| | | | | | | | | | | | | | | | | | | | | | | | PACKAGE_TARNAME was added on commit 87e7b3139 ("Configure Debian package with AA and SELinux options", 2020-05-13) / PR #3414. TOP was added on commit ed4a24ce7 ("porting make deb-apparmor from LTS build", 2019-01-26).
| * | Merge pull request #5158 from hknaack/seamonkey-support-enigmail-gpgLibravatar netblue302022-05-30
| |\ \ | | | | | | | | seamonkey.profile: support enigmail/gpg
| | * | seamonkey.profile: support enigmail/gpgLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | Changes inspired by Thunderbird profile.
| * | | Merge pull request #5159 from hknaack/kate-fixesLibravatar netblue302022-05-30
| |\ \ \ | | | | | | | | | | Kate fixes
| | * | | kate.profile: drop tracelogLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting kate and loading into a session containing a git repository, tracelog caused about 30 seconds of delay until the project structure appeared in the projects sidebar. Error message on console: QProcess: Destroyed while process ("/usr/bin/git") is still running. Drop tracelog to mitigate the delay and error message.
| | * | | kate.profile: allow access to kwinrcLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting Kate, a blacklist violation from accessing the kwinrc config file is reported. As a KDE application, it should be fine for Kate to access it. blacklist violation - sandbox 13410, name kate, exe kate, syscall access, path /home/user/.config/kwinrc
| | * | | kate.profile: enable bash completion in terminalLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A side effect of including disable-common.inc is loosing access to /etc/profile.d, where Bash completion is located. Explicitly enable access to console scripts in /etc/profile.d, so that Kate's built-in Konsole instance can be used without limitations. Minor side effect: the spawned Bash tries to access /etc/init.d blacklist violation - sandbox 17317, name kate, exe bash, syscall stat, path /etc/init.d
| | * | | kate.profile: allow common development file accessLibravatar Hartmut Knaack2022-05-28
| | |/ / | | | | | | | | | | | | | | | | | | | | Kate has grown support for software development, making it a light IDE. Some version control modules exist, and when using the Git module, a blacklist violation is reported: blacklist violation - sandbox 13902, name kate, exe git, syscall access, path /home/user/.gitconfig Including support for common development file access mitigates this violation issue.
* | / / mergesLibravatar netblue302022-05-30
|/ / /
* | / minor fixes for git.profile (#5165)Libravatar glitsj162022-05-28
| |/ |/|
* | Removed IDS feature from the default build. To enable it, use --enable-ids ↵Libravatar netblue302022-05-25
| | | | | | | | at compile time.
* | build(deps): bump github/codeql-action from 2.1.10 to 2.1.11Libravatar dependabot[bot]2022-05-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.10 to 2.1.11. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/2f58583a1b24a7d3c7034f6bf9fa506d23b1183b...a3a6c128d771b6b9bdebb1c9d0583ebd2728a108) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | config guide (firecfg --guide) man pageLibravatar netblue302022-05-23
|/
* unbound: seccomp cleanupLibravatar smitsohu2022-05-21
|
* netlock: restore environment for terminalLibravatar smitsohu2022-05-21
|
* Merge pull request #5141 from kmk3/nvim-add-xdg-state-homeLibravatar netblue302022-05-20
|\ | | | | nvim: add XDG_STATE_HOME path
| * nvim: add XDG_STATE_HOME pathLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default paths as of neovim 0.7.0: * backupdir: $XDG_DATA_HOME/nvim/backup// * directory: $XDG_DATA_HOME/nvim/swap// * undodir: $XDG_DATA_HOME/nvim/undo// * viewdir: $XDG_DATA_HOME/nvim/view// * shada file: $XDG_DATA_HOME/nvim/shada/main.shada * log dir: $XDG_CACHE_HOME/nvim/log Default paths as of [1]: * backupdir: $XDG_STATE_HOME/nvim/backup// * directory: $XDG_STATE_HOME/nvim/swap// * undodir: $XDG_STATE_HOME/nvim/undo// * viewdir: $XDG_STATE_HOME/nvim/view// * shada file: $XDG_STATE_HOME/nvim/shada/main.shada * log dir: $XDG_STATE_HOME/nvim/log [1] https://github.com/neovim/neovim/pull/15583
| * disable-programs.inc: remove ~/.local/share/nvimLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | It's already blacklisted on disable-common.inc. Added on commit ec966d4c0 ("fix: neovim profile", 2022-01-10) / PR #4841.
* | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-05-20
|\ \
| * | updates for wget2 (#5152)Libravatar glitsj162022-05-20
| | | | | | | | | | | | | | | * update for wget2 * allow ${HOME}/.local/share/wget
* | | --oomLibravatar netblue302022-05-20
|/ /
* | --oom (#5122)Libravatar netblue302022-05-20
| |
* | onionshare-gui.profile: fix breakageLibravatar Tad2022-05-20
| | | | | | | | | | | | | | Fails to start without this, eg: FileNotFoundError: [Errno 2] No such file or directory: '/usr/share/onionshare/images/favicon.ico' Signed-off-by: Tad <tad@spotco.us>
* | Merge pull request #5142 from kmk3/stop-distclean-on-distLibravatar Kelvin M. Klann2022-05-19
|\ \ | | | | | | Makefile.in: stop running distclean on dist
| * | Makefile.in: stop running distclean on distLibravatar Kelvin M. Klann2022-05-13
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | distclean erases user-made modifications to the files generated by the configure script; it is not obvious that a non-"clean" target would ever run it. That is, instead of: ./configure --enable-foo && make distclean && make dist It would probably be safer (and more maintainable) to do: make distclean && ./configure --enable-foo && make dist So drop the distclean call and the file-moving hacks around it. Added on commit 137985136 ("Baseline firejail 0.9.28", 2015-08-08). Relates to commit 684919100 ("bug: preserve config.status during make dist", 2016-09-19) and commit 31dc1218a ("fixups", 2020-07-19).
* | Merge pull request #5148 from kmk3/ci-fix-build-apparmorLibravatar Kelvin M. Klann2022-05-18
|\ \ | | | | | | ci: print version after install & fix apparmor support on build_apparmor
| * | gitlab-ci: actually link libapparmor on build_apparmorLibravatar Kelvin M. Klann2022-05-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "build_apparmor" job was added on commit 342e71cd8 ("Add deb-apparmor build to Gitlab CI", 2019-01-26). It would call `./mkdeb-apparmor.sh`, which would run `./configure --enable-apparmor` directly, adding `-lapparmor` to `EXTRA_LDFLAGS` and thus passing it to the linker. Later, commit 87e7b3139 ("Configure Debian package with AA and SELinux options", 2020-05-13) / PR #3414 merged mkdeb.sh and mkdeb-apparmor.sh into mkdeb.sh.in, which does not always pass `--enable-apparmor` to ./configure directly. Instead, it adds `--enable-apparmor` depending on whether the `$HAVE_APPARMOR` environment variable is set, which would be done by a previous run of ./configure with `--enable-apparmor`. Since on "build_apparmor" ./configure is not run the first time with `--enable-apparmor`, neither is it on the second time and thus `-lapparmor` is never passed to the linker. This commit adds `--enable-apparmor` to the first ./configure run on the ci job, so that it gets passed to the one being executed on mkdeb.sh as well.
| * | gitlab-ci: check for apparmor support on build_apparmorLibravatar Kelvin M. Klann2022-05-17
| | | | | | | | | | | | | | | | | | | | | To ensure that firejail was actually built with support for it. Note: This commit intentionally fails on GitLab CI to demonstrate that the above is currently not the case.
| * | ci: run firejail --version after build/installLibravatar Kelvin M. Klann2022-05-17
|/ / | | | | | | | | To ensure that the resulting program actually runs and also to show which compile-time features it supports.
* | ci: fix --version not printing compile-time featuresLibravatar Kelvin M. Klann2022-05-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, when running on CI, `firejail --version` only prints the following line: firejail version 0.9.69 Add a new print_version() function that always prints both the above and the compile-time options (like it is done outside of CI) and call it in both of the places that handle --version on main.c. Misc: The printing of compile-time features was added on commit 48dd1fbec ("apparmor", 2016-08-02).
* | build(deps): bump github/codeql-action from 2.1.9 to 2.1.10Libravatar dependabot[bot]2022-05-16
|/ | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.9 to 2.1.10. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/7502d6e991ca767d2db617bfd823a1ed925a0d59...2f58583a1b24a7d3c7034f6bf9fa506d23b1183b) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* xonotic.profile: fix audit denial spamLibravatar Tad2022-05-12
| | | | | | After a3f00edb32aca7516d690db046dd1ed3eb186bdd Signed-off-by: Tad <tad@spotco.us>
* Prevent emptty /usr/share in google-chrome profilesLibravatar crocket2022-05-12
| | | | | | | | | | | Without whitelist-usr-share-common, /usr/share becomes empty. Adding whitelist-runuser-common didn't break google chrome. Whitelisting /usr/share/mozilla/extensions and /usr/share/webext shouldn't break google chrome, either. I tested google-chrome.profile only, but I think later versions should not be different.
* fzenity: fix dead storeLibravatar Kelvin M. Klann2022-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As caught by the Clang Static Analyzer: $ make clean && NO_EXTRA_CFLAGS="yes" scan-build --status-bugs make -C src/fzenity [...] main.c:77:10: warning: Value stored to 'ptr' is never read [deadcode.DeadStores] return ptr++; ^~~~~ 1 warning generated. [...] scan-build: Analysis run complete. scan-build: 1 bug found. The above increment is a no-op, as it is equivalent to `return ptr; ptr++;`. For it to make any difference, the prefix increment operator would have to be used in place of the postfix one: return ++ptr; Which would be equivalent to `++ptr; return ptr;`. But in order to fix the warning (and CI) while avoiding to change the current behavior, just remove the operator instead. Added on commit 1cdfa6f95 ("more on firecfg --guide: fzenity", 2022-04-25).
* always log seccomp errors (#5110)Libravatar netblue302022-05-09
|
* configure*: remove ultimately unused INSTALL and RANLIB check macrosLibravatar Kelvin M. Klann2022-05-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the manual of GNU Autoconf (version 2.69): > -- Macro: AC_PROG_INSTALL > Set output variable 'INSTALL' to the name of a BSD-compatible > 'install' program, if one is found in the current 'PATH'. > Otherwise, set 'INSTALL' to 'DIR/install-sh -c', checking the > directories specified to 'AC_CONFIG_AUX_DIR' (or its default > directories) to determine DIR (*note Output::). Also set the > variables 'INSTALL_PROGRAM' and 'INSTALL_SCRIPT' to '${INSTALL}' > and 'INSTALL_DATA' to '${INSTALL} -m 644'. > -- Macro: AC_PROG_RANLIB > Set output variable 'RANLIB' to 'ranlib' if 'ranlib' is found, > and otherwise to ':' (do nothing). None of the aforementioned variables are used: $ git grep -F -e '${INSTALL}' -e INSTALL_PROGRAM -e INSTALL_SCRIPT \ -e INSTALL_DATA -e RANLIB $ So remove the macros that define them. Misc: The macros in question have been present on configure.ac since it was created, on commit 137985136 ("Baseline firejail 0.9.28", 2015-08-08). And while the install command is called multiple times, ranlib is not used anywhere (and it seems that it was never used): $ git grep -E '^[[:blank:]]+install ' -- '*Makefile*' '*.mk*' | wc -l 32 $ git grep -F ranlib | wc -l 0 $ git log --pretty= --name-only -G'RANLIB|ranlib' \ 137985136..master | sort -u README.md Kind of relates to #4695.
* Whitelist for NixOS to resolve binary paths in user environmentLibravatar Jonas Heinrich2022-05-07
|
* NixOS fix OpenGL app supportLibravatar Jonas Heinrich2022-05-07
|
* build(deps): bump github/codeql-action from 2.1.8 to 2.1.9Libravatar dependabot[bot]2022-05-02
| | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.8 to 2.1.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/1ed1437484560351c5be56cf73a48a279d116b78...7502d6e991ca767d2db617bfd823a1ed925a0d59) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-22 13:35:31 +0000