| Commit message (Collapse) | Author | Age |
| |
|
|
|
|
|
|
|
|
|
|
| |
While it is believed that blacklisting these files is a safe default,
it has the effect that untrusted certificates have to be acknowledged every
time they are encountered (with whitelisting it is possible to accept
them for the duration of an application session).
Where this causes usability issues, it will be necessary to noblacklist
these paths.
|
|
|
|
|
|
|
|
| |
while it is essential to deny manipulation of these files,
the information contained therein should be only of secondary value
by changing blacklist to read-only, notification functionality is
restored
|
| |
|
| |
|
| |
|
|
|
|
|
| |
and whitelist some kio settings, because we don't know if slave processes will run inside or outside the sandbox.
also prevents weird bugs that depend on sequence in which applications were started.
|
|
|
|
| |
further to 8aec7694cb4c7c0d07b333b689ab19faacb519f9
|
| |
|
| |
|
|
|
| |
hardcoded since 1e7045b55cc1e189dba6d9ed21c05c90663f3736
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
disable-common.inc blacklists whole .ssh, but some profiles (e.g. idea.sh)
unblacklists it to allow git over ssh with public key auth.
But this creates security hole, since firejailed app could modify
~/.ssh/authorized_keys and allow arbitrary code execution on the host with sshd
installed (e.g. ssh localhost and run any program) or even open backdoor for
remote attacker.
This commits disallows write access to ~/.ssh/authorized_keys even if .ssh was
unblacklisted.
Signed-off-by: Alexander GQ Gerasiov <gq@cs.msu.su>
|
|
|
|
|
| |
homesick is dotfiles manager. It keeps dotfiles (e.g. .bashrc) in repository
under ~/.homesick and puts symlinks into home directory.
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
and whitelist kioslaverc because we don't know if kdeinit
will run outside or inside the sandbox.
|
| |
|
|
|
|
| |
attempts to handle #1599
|
| |
|
| |
|
|
|
|
|
|
|
| |
* ~/.bash_history is already included in ~/.*_history, same file
* ~/.password-store is already included in disable-passwdmgr.inc (and not
whitelisted in browsers)
* ~/.local/share/applications is in whitelist-common.inc since recently
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
pass is a password manager that keeps files under ~/.password-store by default.
See http://www.passwordstore.org/ for more info
|
| |
|
| |
|
|
|
| |
Configurations in this folder are not secret, but need to be protected from manipulation. Let's make it available to all KDE apps for legitimate use. Discussion in #1428
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
| |
#1238
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* minor reorganization
* tidy up
* tidy up
* tidy up
* tidy up
* tidy up
* tidy up
|
|
|
|
|
|
|
|
|
|
| |
* update noblacklist
* blacklist local plasma overrides, plasmoids
* add more KDE configuration (kdeglobals, plasmoids)
* kdeglobals now in disable-common.inc
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* private-dev breaks playing CDs
* reenable services
* blacklist kservices5 folder
* blacklist nautilus scripts
* blacklist ~/.kde4 files, k3b config, nautilus/nemo
* sort
* update noblacklisting
* update blacklisting
* update blacklisting/whitelisting (okular)
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* blacklist more KDE files
* undo doubling of ~/.profile
* remove ksmserverrc
* remove ksmserverrc
* blacklist kdeconnect
* blacklist KDE device actions
* blacklist kglobalaccel
|
|\
| |
| | |
profile enhancements
|