aboutsummaryrefslogtreecommitdiffstats
path: root/etc/evince.profile
Commit message (Collapse)AuthorAge
* adding disable-exec.inc to more profilesLibravatar netblue302019-04-07
|
* Fixup #2631Libravatar SkewedZeppelin2019-03-31
|
* Add warning about nodbus breaking evince two-page-view on some systemsLibravatar pianoslum2019-03-30
| | | | See https://github.com/netblue30/firejail/issues/2621
* Update evince.profile (#2530)Libravatar rusty-snake2019-03-06
|
* Fixes for evince profiles (#2527)Libravatar glitsj162019-03-06
| | | | | | | | | | * Update evince.profile Needs group and password in private-etc on Arch. Took the liberty to change the memory-deny-write-execute comment. Latest firejail from git with the recent mdwx work included now no longer breaks evince on Arch. It might still break on other platforms, so I left mdwe commented. * Fix including globals.local twice in evince-previewer * Fix including globals.local twice in evince-thumbnailer
* Revert machine-id comment mess (#2439)Libravatar glitsj162019-02-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Update atril.profile Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment * Revert machine-id comment
* Streamline machine-id commentLibravatar glitsj162019-02-21
|
* Add alternatives to private-etc for profiles in etc/Libravatar Fred-Barclay2019-02-17
| | | | See discussion in #2399
* Allow /etc/machine-id for EvinceLibravatar announ2018-11-15
|
* Merge pull request #2201 from SkewedZeppelin/u2f-apLibravatar netblue302018-10-17
|\ | | | | Add nou2f to all profiles
| * Add nou2f to all profilesLibravatar Tad2018-10-15
| | | | | | | | - Closes #2194
* | Remove "/etc/firejail/" from all include paths, now that profile_read will ↵Libravatar Glenn Washburn2018-10-17
|/ | | | search for the file.
* Fixes #2048Libravatar ಚಿರಾಗ್ ನಟರಾಜ್2018-10-03
|
* Fixes #2048Libravatar ಚಿರಾಗ್ ನಟರಾಜ್2018-10-03
|
* hardening evince, dbus not neededLibravatar janph2018-09-01
|
* Add descriptions to profiles, pulled from Ubuntu 18.04Libravatar Tad2018-08-13
|
* Add disable-xdg.inc to ~100 profilesLibravatar Tad2018-07-24
|
* Fix DjVu opening in EvinceLibravatar announ2018-06-01
|
* globbing support in private-libLibravatar netblue302018-05-25
|
* WIP: Blacklist common programming interpreters. (#1837)Libravatar Fred Barclay2018-04-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * Add xreader thumbnailer and previewer profiles * Add xplayer audio-preview and thumbnailer profiles * Add atril thumbnailer and previewer profiles * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * --nodbus, first draft for #1825 * dbus.c * rework akonadi integration the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). * Add nodbus to some profiles - part 1 * Spotify works with nodbus on Arch * Enable nodbus for keepassx and keepassxc profiles. I've tested on keepassxc but should work for keepassx as well. Settings are not immutable. * recalibrate dbus access, deploy nodbus option see #1822 and #1825. also systematically replaces 'blacklist /run/user/*/bus' with 'nodbus'. with contributions from @Fred-Barclay * various blacklist additions * Add a profile for ncdu, enable private-etc in Steam again, and fixup gnome-recipes * comment nodbus where it interferes with dconf pending further discussion * Add a disabled and extensive private-bin for Steam * Further improve private-bin in steam * comment apparmor, net where they interfere with dconf - #1843 * gnome-calculator fixup * spectre support for clang compiler * spectre clang support * enable/disable dbus handling in /etc/firejail/firejail.config * nodbus man pages, etc. * redirect knotes to kmail, some tweaks * testing * gimp fixup * Even more fixups after adding disable-interpreters.inc * AWS and GCP store credentials in local directories as part of project setup. Configuration for cloud providers is sensitive information; it should be in the default block list. I didn't see profiles for gcloud or awscli, so haven't added any exclusions. boto and kubectl are not provider-specific, but also store credentials for whichever platforms they happen to be being used with. * testing * consolidate makefiles * gitignore * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * Cleanup rebase leftovers * imagej doesn't need javac access * Add cc to blacklisted compilers * Use wildcards when blacklisting some gcc paths * Blacklist lua in disable-interpreters * Correct blacklist for node.js * Fred Barclay note: some of these commits (all of the ones that don't affect files inside etc/) aren't mine but were added during a rebase + squash
* Fix private-lib again (#1852) for evinceLibravatar glitsj162018-04-01
| | | | | | | | | | | | * Fix private-lib During conversation around an [earlier attempt at fixing evince] (https://github.com/netblue30/firejail/pull/1829) and the entailing [revert-commit](https://github.com/netblue30/firejail/pull/1829/commits/45732a22d1ea4ec0ade0775be7243e8669b7f850) this slipped through the cracks. The fix is tested on Gnome Shell 3.26.2 and 3.28.0 (on Arch). * Remove irrelevant comment on private-lib * Update private-lib comments Done!
* recalibrate dbus access, deploy nodbus optionLibravatar smitsohu2018-03-28
| | | | | | | see #1822 and #1825. also systematically replaces 'blacklist /run/user/*/bus' with 'nodbus'. with contributions from @Fred-Barclay
* removing private-lib from evince, issue #1711Libravatar netblue302018-03-14
|
* (Temporarily?) fix private-lib for evince. See #1711"eLibravatar Fred-Barclay2018-03-12
|
* bringing back private-lib in evince, and some fixes for Arch LinuxLibravatar netblue302018-03-12
|
* Disable memory-deny-write-execute in evince profileLibravatar Vincent432018-03-07
| | | It started breaking application in Archlinux, see https://github.com/netblue30/firejail/issues/1803
* temporarely removed private-lib, GnomeShell problems: #1711Libravatar netblue302018-01-18
|
* adding machine-id to a number of profilesLibravatar netblue302017-12-04
|
* Consistent home directory nomenclatureLibravatar Fred-Barclay2017-11-17
|
* fix and harden various profilesLibravatar smitsohu2017-10-29
|
* disable non-abstract session bus addressLibravatar smitsohu2017-10-22
| | | | | systematically blacklist /run/user/*/bus in all profiles with 'net none'. targets distros like Fedora
* private-lib developmentsLibravatar netblue302017-10-09
|
* private-lib developmentsLibravatar netblue302017-10-09
|
* various profile enhancementsLibravatar smitsohu2017-09-25
| | | | | | | * okular needs kdeinit4 for open file dialog since recently * memory-deny-write-execute should be a safe addition for desktop use of dnscrypt and unbound * cleanup works
* merge #1565Libravatar netblue302017-09-22
|
* Fixup merge of #1565Libravatar Tad2017-09-22
|
* 1 LISTLibravatar Your Name2017-09-19
|
* whitelist /var - Xubuntu fixesLibravatar netblue302017-09-17
|
* Fix nodvd placementLibravatar Tad2017-08-13
|
* added nodvd to most profilesLibravatar netblue302017-08-13
|
* Fix notv placementLibravatar Tad2017-08-11
|
* added notv to most profilesLibravatar netblue302017-08-11
|
* Fix comments in 88 profilesLibravatar Tad2017-08-07
| | | | There may actually be some other comments that were removed, but the bulk have been restored
* Unify all profilesLibravatar Tad2017-08-07
|
* Add back net none/netfilter as neededLibravatar Fred-Barclay2017-08-02
|
* Initial adding of memory-deny-write-execute to profilesLibravatar Tad2017-08-02
| | | | | | | | - mdwe breaks most vm-based languages so python/java/javascript and some mono programs are not compatible - mdwe also breaks most 3d accelerated programs such as 3d games - mdwe is similar to PaX's mprotect meaning PaX flag managers can be used as reference -- See https://github.com/copperhead/paxd-archive/blob/master/paxd.conf -- See https://github.com/nning/linux-pax-flags
* Harden profilesLibravatar Tad2017-08-02
| | | | | | | | - Added 'disable-devel.conf' to many profiles - Added 'disable-mnt' to many profiles - Added 'noexec' to many profiles - Removed 'netfilter' and 'net none' from profiles with 'protocol unix' - Cleaned up profiles using defaults
* test: add novideo to profiles (part 1)Libravatar Fred Barclay2017-06-15
|
* commented out ipc-namespace in most profiles - it breaks newer versions of ↵Libravatar netblue302017-05-25
| | | | GDK with the following error: Gdk-ERROR **: The program 'thunderbird' received an X Window System error
* added /etc/firejail/globals.local for global customizationsLibravatar netblue302017-05-23
|
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 11:17:28 +0000