aboutsummaryrefslogtreecommitdiffstats
path: root/etc/disable-common.inc
Commit message (Collapse)AuthorAge
* blacklist libvirt and flatpak [skip ci]Libravatar rusty-snake2020-03-29
|
* misc fixesLibravatar rusty-snake2020-03-19
| | | | | | | | | remove netfilter from profiles with net none allow Viber to use dig, dig is in its private-bin, so I assume that it need it. blacklist resolvectl which can also be used for dns lookups
* nslookup, host profilesLibravatar netblue302020-03-18
|
* allow ro access to .local/share/flatpak/exportsLibravatar rusty-snake2020-03-15
| | | | | | | | | | | | $PATH and $XDG_DATA_DIRS can contain subdirs of flatpak/exports, some applications crash if they cann't access these files. Layout on my system: ~/.local/share/flatpak/exports |-bin |-share |-applications |-icons
* Add a lot of profilesLibravatar rusty-snake2020-02-10
|
* fix spelling in disable-common.incLibravatar glitsj162020-01-29
|
* tighten info gathering for openrcLibravatar Gauvain "GovanifY" Roussel-Tarbouriech2020-01-15
|
* Make ${HOME}/.config/environment.d read-onlyLibravatar rusty-snake2019-12-30
|
* Fix Brave's native sandbox (#3087)Libravatar glitsj162019-12-19
| | | | | | | | | | * Allow user access to /proc/config.gz * Fix Brave's native sandbox * Move /proc/config.gz to disable-common.inc * Move /proc/config.gz to disable-common.inc
* blacklist gksu, gksudo, kdesudoLibravatar rusty-snake2019-11-25
|
* blacklist .fscrypt directoriesLibravatar smitsohu2019-11-12
|
* blacklist gnome-boxes user files (VM-Images)Libravatar rusty-snake2019-10-13
|
* add HAS_X11 conditional, disconnect session manager - #2205Libravatar smitsohu2019-10-08
|
* protect files that can execute commandsLibravatar rusty-snake2019-09-22
|
* many profile fixes (1)Libravatar rusty-snake2019-08-26
| | | | | | | | | | | | | | | | - add novideo to a lot of profiles (there are still more profiles where novideo can be added) - remove commente mdwe from some gnome applications - add descriptions to some profiles - blacklist ${HOME}/.cargo/credentials - move ${HOME}/.git-credentials and ${HOME}/.git-credential-cache to 'top secret' in disable-common.inc - some ordering in disable-programs.inc - merge tor browser blacklists to ${HOME}/.tor-browser* - qupzilla.profile redirect to falkon.profile - blacklist gnome-builder paths - fix transmission profiles inlude - much more
* various fixes and improvementsLibravatar rusty-snake2019-08-22
| | | | | | | | | | | | - install contrib/syscalls.sh - add GitLab-CI status to README.md - read-only ${HOME}/.cargo/env - move blacklist ${HOME}/.cargo/registry, ${HOME}/.cargo/config to disable-programs - typo in man firejail firejail-profiles firecfg - better descriptions in man firejail-profiles - fixes in man firejail - template descriptions in firejail-profiles
* blacklist kwalletrcLibravatar smitsohu2019-08-01
|
* keep dconf database read-onlyLibravatar smitsohu2019-07-08
|
* three new blacklist in disable-common.incLibravatar rusty-snake2019-06-18
| | | | | | * ~/.viminfo * ~/.lesshst * ~/.python_history
* hardening & fixingLibravatar rusty-snake2019-06-13
|
* Add davfs2 secrets file to blacklist (#2753)Libravatar Jose Riha2019-06-11
| | | | The files holds credentials to WebDAV servers in plaintext hence it's probably a good idea to limit access to them.
* many profile cleanups (3)Libravatar rusty-snake2019-06-02
|
* Add .pythonrc.py to disable-common.inc (#2651)Libravatar Senemu2019-04-14
| | | | | | * Add .pythonrc.py to disable-common.inc * Move .pythonrc.py to more appropriate section
* update plasma vault blacklist in disable-common.incLibravatar smitsohu2019-03-02
|
* Merge branch 'master' of https://github.com/Lockdis/firejail into ↵Libravatar Fred-Barclay2019-02-16
|\ | | | | | | lockdis_ipc_fixes
| * add nyx, fix g earth proLibravatar Lockdis2019-01-24
| |
* | Add '$HOME/.local/share/pki' to blacklistLibravatar Vincent432019-02-03
| | | | | | | | | | Since nss 3.42, '$HOME/.local/share/pki' is supported dir for storing certs https://hg.mozilla.org/projects/nss/rev/da45424cb9a0b4d8e45e5040e2e3b574d994e254
* | additional blacklistingLibravatar rusty-snake2019-01-27
|/
* MergesLibravatar Tad2018-12-22
|
* updates for ~/.cargoLibravatar rusty-snake2018-12-21
|
* Update disable-common.inc, disable-programs.incLibravatar rusty-snake2018-12-20
|
* profile enhancements: blacklist kdesu daemon socket, rework ↵Libravatar smitsohu2018-12-11
| | | | c083a7b737050c532977b46fac6400f1dbc24ff6
* improve sandboxing of KDE apps: set KDE_FORK_SLAVES, blacklist slave-socketsLibravatar smitsohu2018-12-07
| | | | | | | | | | setting the KDE_FORK_SLAVES environment variable removes all inconsistencies that arise from slaves running outside the sandbox or in a different sandbox; it also makes it slightly more difficult to abuse KIO in general and helps to mitigate security problems due to thumbnailing, which now always happens inside the same sandbox. The trade-off is more concurrently running slave processes. closes #2285
* Update disable-common.incLibravatar glitsj162018-11-08
|
* profile fixes for recursive read-write mountsLibravatar smitsohu2018-11-04
| | | | | | | read-write and read-only are applied in sequence, don't override read-only restrictions in ~/.local/share issue #2200
* cleanupLibravatar smitsohu2018-10-25
|
* Remove "/etc/firejail/" from all include paths, now that profile_read will ↵Libravatar Glenn Washburn2018-10-17
| | | | search for the file.
* consolidate cloud blacklisting, alphabetize, other nitpicksLibravatar smitsohu2018-10-12
|
* Write-protection for thumbnailer dir see #2143 (#2144)Libravatar curiosity-seeker2018-10-07
|
* adding fluxbox, blackbox, awesome, i3 profilesLibravatar netblue302018-09-03
|
* Update disable-common.incLibravatar 1dnrr2018-08-23
|
* Blacklist /.snapshots (see #2030)Libravatar ಚಿರಾಗ್ ನಟರಾಜ್2018-07-09
|
* Merges + misc fixesLibravatar Tad2018-07-04
| | | | | | | | - Change some links in README to HTTPS - Fixup some typos in firejail-profile manpage - Cleanup dash from private-etc - Fixup gradio - Synchronize server profile with default profile
* disable flatpak directoriesLibravatar netblue302018-06-20
|
* typo in disable-common.incLibravatar glitsj162018-04-22
|
* Blacklist some GNOME files in disable-common.incLibravatar Tad2018-04-16
|
* update firecfg, shield kde startup betterLibravatar smitsohu2018-04-06
|
* fix a0502dc5144185b6d346e92944e3359a833d2378, various enhancementsLibravatar smitsohu2018-04-04
|
* AWS and GCP store credentials in local directories as part of project setup.Libravatar James Elford2018-03-31
| | | | | | | | | Configuration for cloud providers is sensitive information; it should be in the default block list. I didn't see profiles for gcloud or awscli, so haven't added any exclusions. boto and kubectl are not provider-specific, but also store credentials for whichever platforms they happen to be being used with.
* various profile hardeningLibravatar smitsohu2018-03-25
|
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-21 20:45:34 +0000