aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAge
* Use dbus-user filterLibravatar NetSysFire2023-12-08
|
* Update minecraft-launcher.profileLibravatar NetSysFire2023-12-07
|
* firecfg.config: drop geary (#6116)Libravatar glitsj162023-12-07
| | | | | Geary uses bubblewrap now. Fixes #6103.
* landlock: deduplicate fs functions into ll_fsLibravatar Kelvin M. Klann2023-12-06
| | | | | | | The relevant functions are all identical except for the access flags used. Relates to #6078.
* landlock: fix profile entries processed in reverseLibravatar Kelvin M. Klann2023-12-05
| | | | | | | | | | | | | | When a new landlock entry is parsed from a profile, the first entry in the `cfg.lprofile` list is being set as the next/second entry and the new entry is being set as the first entry in the list, so all entries are being processed from last to first. This commit makes the behavior of ll_add_profile() match the one from profile_add() in src/firejail/profile.c so that the entries are processed in the same order that they are parsed. This amends commit b94cc754a ("landlock: apply rules in sandbox before app start", 2023-10-26) / PR #6078.
* landlock: simplify variables in ll_add_profileLibravatar Kelvin M. Klann2023-12-05
| | | | | This amends commit 520508d5b ("landlock: avoid parsing landlock commands twice", 2023-11-02) / PR #6078.
* landlock: stop setting global ruleset in ll_create_full_rulesetLibravatar Kelvin M. Klann2023-12-05
| | | | | | | | To avoid confusion, only return a new ruleset and let the caller set the global one. This amends commit 13b2c566d ("feature: add Landlock support", 2023-10-24) / PR #6078.
* landlock: make parameters void in ll_create_full_rulesetLibravatar Kelvin M. Klann2023-12-05
| | | | | | | For consistency with the other functions that have no paramters. This amends commit 13b2c566d ("feature: add Landlock support", 2023-10-24) / PR #6078.
* landlock: fix misc messages in ll_is_supportedLibravatar Kelvin M. Klann2023-12-05
| | | | | This amends commit d10bf154a ("landlock: detect support at runtime", 2023-11-06) / PR #6078.
* landlock: add missing empty function ll_is_supportedLibravatar Kelvin M. Klann2023-12-05
| | | | | This amends commit d10bf154a ("landlock: detect support at runtime", 2023-11-06) / PR #6078.
* landlock: fix incomplete zsh completionLibravatar Kelvin M. Klann2023-12-05
| | | | | This amends commit 13b2c566d ("feature: add Landlock support", 2023-10-24) / PR #6078.
* README.md: fix Landlock support listLibravatar Kelvin M. Klann2023-12-05
| | | | | | | | | Fix formatting and wrong/outdated information. This amends commit 6d0559de7 ("landlock: update README.md, small fix in man firejal; update profile stats in README.md", 2023-12-04). Relates to #6078.
* docs: fix typo of --nonewprivs in Landlock sectionLibravatar glitsj162023-12-05
| | | | | | Originally from PR #5359. Relates to #6078.
* landlock: update README.md, small fix in man firejal; update profile stats ↵Libravatar netblue302023-12-04
| | | | in README.md
* nettraceLibravatar netblue302023-12-04
|
* Merge pull request #6078 from kmk3/landlock_v3Libravatar netblue302023-12-04
|\ | | | | feature: add Landlock support
| * landlock: detect support at runtimeLibravatar Kelvin M. Klann2023-11-07
| | | | | | | | | | And ignore landlock-related commands if Landlock is unsupported at runtime.
| * landlock: avoid parsing landlock commands twiceLibravatar netblue302023-11-07
| |
| * landlock: apply rules in sandbox before app startLibravatar netblue302023-11-07
| | | | | | | | Apply rules in the sandbox thread before the application is started.
| * landlock: new filesystem for --landlock commandLibravatar netblue302023-11-07
| |
| * feature: add Landlock supportLibravatar netblue302023-11-07
| | | | | | | | | | | | | | | | | | | | Based on 5315 by ChrysoliteAzalea. It is based on the same underlying structure, but with a lot of refactoring/simplification and with bugfixes and improvements. Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com> Co-authored-by: Азалия Смарагдова <charming.flurry@yandex.ru>
| * cleanupLibravatar netblue302023-11-06
| |
* | Merge pull request #6104 from kmk3/ci-enable-sort-pyLibravatar netblue302023-12-04
|\ \ | | | | | | ci: re-enable sort.py
| * | ci: re-enable sort.pyLibravatar Kelvin M. Klann2023-11-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It was disabled on commit df6ea884f ("merges, disable sort.py in profile checks temporarely, two more private-etc profiles", 2023-02-14). Currently all profiles are sorted and there are no ongoing `private-etc` changes, so it should be safe to re-enable. Note that the script is useful to catch sorting issues not only in `private-etc` but also in other commands, such as `seccomp`[1] [2]. This is a follow-up to #6070. Relates to #5610. [1] https://github.com/netblue30/firejail/pull/6066#discussion_r1372055800 [2] https://github.com/netblue30/firejail/pull/6067#discussion_r1372027243
* | | Merge pull request #6107 from kmk3/lutris-allow-mangohudLibravatar netblue302023-12-04
|\ \ \ | | | | | | | | lutris.profile: allow mangohud
| * | | lutris.profile: allow mangohudLibravatar Kelvin M. Klann2023-11-27
| |/ / | | | | | | | | | | | | | | | Similarly to steam.profile (see #4864). Fixes #6106.
* | | Merge pull request #6109 from kmk3/netfilter-expand-macrosLibravatar netblue302023-12-04
|\ \ \ | | | | | | | | feature: expand simple macros in more commands
| * | | feature: expand simple macros in more commandsLibravatar Kelvin M. Klann2023-11-27
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This includes macros such as `${HOME}` and `${RUNUSER}`. Commands: * --chroot= * --netfilter= * --netfilter6= * --trace= Closes #6032. Reported-by: @michelesr
* | | Merge pull request #5876 from kmk3/firecfg-add-confdir-ignoreLibravatar netblue302023-12-04
|\ \ \ | | | | | | | | feature: firecfg: add firecfg.d & add ignore command
| * | | firecfg: add ignore command and docsLibravatar Kelvin M. Klann2023-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ignore command (`!PROGRAM`), as suggested by @WhyNotHugo[1]. It prevents firecfg from creating a symlink for the given program. Also, document the paths used and the config file syntax. Note that `/etc/firejail/firecfg.d/*.conf` files are parsed before /etc/firejail/firecfg.config, so the former can ignore/override any item in the latter. Closes #2097. [1] https://github.com/netblue30/firejail/issues/2097#issuecomment-1179160459
| * | | firecfg: parse config files in /etc/firejail/firecfg.dLibravatar Kelvin M. Klann2023-08-04
| | | | | | | | | | | | | | | | | | | | | | | | As suggested by @WhyNotHugo[1]. [1] https://github.com/netblue30/firejail/issues/2097#issuecomment-1179160459
| * | | firecfg: turn constant strings into constantsLibravatar Kelvin M. Klann2023-08-04
| | | | | | | | | | | | | | | | | | | | | | | | Instead of using asprintf + free. Also, use LIBDIR instead of hardcoded "/usr/lib" for fzenity.
| * | | firecfg: fix missing free and formattingLibravatar Kelvin M. Klann2023-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * fix inconsistent indentation/braces * add missing free
* | | | RELNOTES: add modif, bugfix, build and contrib itemsLibravatar Kelvin M. Klann2023-11-27
| | | | | | | | | | | | | | | | Relates to #5982 #6006 #6057 #6059 #6070 #6086 #6087.
* | | | build(deps): bump github/codeql-action from 2.22.7 to 2.22.8Libravatar dependabot[bot]2023-11-27
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.7 to 2.22.8. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/66b90a5db151a8042fa97405c6cf843bbe433f7b...407ffafae6a767df3e0230c3df91b6443ae8df75) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | lutris.profile: fix seccomp argumentsLibravatar Kelvin M. Klann2023-11-25
| | | | | | | | | | | | | | | | | | | | | I accidentally removed the `!` when sorting the arguments in #6067. This amends commit fbba03790 ("lutris.profile: allow more syscalls", 2023-10-24) / PR #6067.
* | | mergesLibravatar netblue302023-11-24
| | |
* | | Merge pull request #6087 from chestnykh/issue-6006Libravatar netblue302023-11-24
|\ \ \ | | | | | | | | Lookup xauth in PATH.
| * | | Lookup xauth in PATH.Libravatar Dmitry Chestnykh2023-11-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't use hardcoded `/usr/bin/xauth`, iterate over directories inside PATH instead. This fixes https://github.com/netblue30/firejail/issues/6006
* | | | Merge pull request #6070 from kmk3/sort-py-csortLibravatar netblue302023-11-24
|\ \ \ \ | | | | | | | | | | build: sort.py: use case-sensitive sorting
| * | | | build: sort.py: use case-sensitive sortingLibravatar Kelvin M. Klann2023-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To match how things are sorted elsewhere, such as with `noblacklist` / `whitelist` lines (vertically) in profiles and in ci/check/profiles/sort-disable-programs.sh and src/etc-cleanup/main.c. This makes the order in `private-etc` always be groups (`@group`), then uppercase paths, then lowercase paths. Example from etc/profile-m-z/softmaker-common.profile: private-etc @tls-ca,SoftMaker,fstab Note that this does not affect a significant amount of profiles; most changes are in `private-bin` / `private-lib` lines and in `private-etc` lines for newer profiles that do not use groups. This is partly due to commit 5d0822c52 ("private-etc: big profile changes", 2023-02-05) replacing `X11` with `@x11` in `private-etc` lines and then commit 0f996ea4d ("private-etc: groups modified", 2023-02-05) removing `Trolltech.conf` from `private-etc` lines and using case-sensitive sorting in them. Relates to #5610.
* | | | | Merge pull request #6067 from nutta-git/patch-2Libravatar netblue302023-11-24
|\ \ \ \ \ | | | | | | | | | | | | lutris.profile: allow more syscalls
| * | | | | lutris.profile: allow more syscallsLibravatar duevo2023-11-01
| | |_|_|/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Need to whitelist `ptrace` and `clone3` for Ubisoft Connect to work. journalctl did list `process_vm_readv` when a game was running, but it didn't crash the game. Fixes #6035.
* | | | | Merge pull request #6066 from nutta-git/patch-1Libravatar netblue302023-11-24
|\ \ \ \ \ | | | | | | | | | | | | steam.profile: allow process_vm_readv syscall
| * | | | | steam.profile: allow process_vm_readv syscallLibravatar duevo2023-10-31
| |/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | EA Origin (game launcher) won't launch without this. See https://github.com/netblue30/firejail/issues/5185#issuecomment-1776516159
* | | | | Merge pull request #5957 from gerasiov/fcopy-fix-size-calculationLibravatar netblue302023-11-24
|\ \ \ \ \ | | | | | | | | | | | | fcopy: Use lstat when copy directory.
| * | | | | fcopy: Use lstat when copy directory.Libravatar Alexander Gerasiov2023-08-14
| | | | | | | | | | | | | | | | | | | | | | | | When copying directories use lstat when reading info about source files.
* | | | | | Fix displaying of large file sizes. (#6086)Libravatar Dmitriy Chestnykh2023-11-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The most generic way is to use `intmax_t` because we dont't know what is the "parent" type of `off_t`. This fixes https://github.com/netblue30/firejail/issues/5982 .
* | | | | | build(deps): bump step-security/harden-runner from 2.6.0 to 2.6.1Libravatar dependabot[bot]2023-11-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 2.6.0 to 2.6.1. - [Release notes](https://github.com/step-security/harden-runner/releases) - [Commits](https://github.com/step-security/harden-runner/compare/1b05615854632b887b69ae1be8cbefe72d3ae423...eb238b55efaa70779f274895e782ed17c84f2895) --- updated-dependencies: - dependency-name: step-security/harden-runner dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
* | | | | | build(deps): bump github/codeql-action from 2.22.5 to 2.22.7Libravatar dependabot[bot]2023-11-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.22.5 to 2.22.7. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/74483a38d39275f33fcff5f35b679b5ca4a26a99...66b90a5db151a8042fa97405c6cf843bbe433f7b) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-23 01:34:01 +0000