aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc/disable-common.inc
Commit message (Collapse)AuthorAge
* disable-common.inc: add foot to 'bad terminals' section (#6025)Libravatar glitsj162023-09-28
|
* profiles: fix commented code and eol commentsLibravatar Kelvin M. Klann2023-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Main changes: * Remove the space after `#` for commented code lines to distinguish them from normal comments * Use `#` instead of `-` for comments at the end of the line so that commented code lines work after being uncommented Commands used to search and replace: arg0="$(cat contrib/syntax/lists/profile_commands_arg0.list | LC_ALL=C sort -u | tr '\n' '|' | sed -e 's/|$//' -e 's/\./\\./g')" arg1="$(cat contrib/syntax/lists/profile_commands_arg1.list | LC_ALL=C sort -u | tr '\n' '|' | sed -e 's/|$//' -e 's/\./\\./g')" git ls-files -z -- etc/inc etc/profile* | xargs -0 -I '{}' \ sh -c "printf '%s\n' \"\$(sed -E \ -e 's/^# ($arg0)( [#-]-? .*)?\$/#\\1\\2/' \ -e 's/^# ($arg1)( [^ ]*)?( [#-]-? .*)?\$/#\\1\\2\\3/' \ -e 's/^# (whitelist \\$)/#\\1/' \ -e 's/^(#[^ ].+) --? /\\1 # /' \ '{}')\" >'{}'" Commands used to check for leftover entries: arg0="$(cat contrib/syntax/lists/profile_commands_arg0.list | LC_ALL=C sort -u | tr '\n' '|' | sed -e 's/|$//' -e 's/\./\\./g')" arg1="$(cat contrib/syntax/lists/profile_commands_arg1.list | LC_ALL=C sort -u | tr '\n' '|' | sed -e 's/|$//' -e 's/\./\\./g')" git grep -E "^# ($arg0|$arg1)( +|$)" -- etc/inc etc/profile* See also commit 30f9ad908 ("build: improve comments in firecfg.config", 2023-08-05) / PR #5942.
* profiles: fix some commentsLibravatar Kelvin M. Klann2023-09-06
| | | | | | | | | Changes: * Turn very long end-of-line comments into normal comments * Turn multi-line end-of-line comments into normal comments * Fix a comment being below instead of above the relevant entry * Turn some comments that look like code into end-of-line comments
* profiles: move fakeroot blacklisting to disable-devel.inc (#5968)Libravatar glitsj162023-08-23
| | | | | | As of commit 96beb3358, `fakeroot` is blacklisted in disable-common.inc, which may break makepkg and other build-related tools; cfr [1]. [1] https://github.com/netblue30/firejail/commit/96beb3358c430a5e470ce02fd64ffc3f7fc23706#r125237349.
* a second round of blacklisting in disable-common.incLibravatar netblue302023-08-22
|
* profiles: restore entries for ssh-related pathsLibravatar Kelvin M. Klann2023-08-21
| | | | | | | | | | | | | | | | This partially reverts commit d94f54736 ("disable all ssh utilities in disable-common.inc", 2023-08-20). Certain files in ~/.ssh are only used by sshd (not by ssh), so always blacklist them. Also, ssh itself does not need write access to the configuration files, so make them read-only by default. For details, see commit 2ec3f3a96 ("disable-common.inc: add missing openssh paths", 2021-01-09) / PR #3885. Cc: @netblue30
* disable all /bin/dpkg* programs in disable-common.incLibravatar netblue302023-08-20
|
* disable all ssh utilities in disable-common.incLibravatar netblue302023-08-20
|
* disable-common.inc: blacklist sudo/doas paths in /etcLibravatar Kelvin M. Klann2023-07-14
| | | | | | | | | | | | | | | | | | | | | | Commands used to find the relevant paths in /etc: $ pacman -Qo /etc/* 2>/dev/null | grep sudo | LC_ALL=C sort /etc/pam.d/ is owned by sudo 1.9.14.p1-1 /etc/sudo.conf is owned by sudo 1.9.14.p1-1 /etc/sudo_logsrvd.conf is owned by sudo 1.9.14.p1-1 /etc/sudoers is owned by sudo 1.9.14.p1-1 /etc/sudoers.d/ is owned by sudo 1.9.14.p1-1 Environment: Artix Linux. Also, add missing paths sudo/doas to etc/ids.config and jailcheck. See also commit dbebd71db ("disable-common.inc: blacklist doas binary", 2022-10-05). Relates to #5385. Reported-by: Dieter Plaetinck <dieter@plaetinck.be>
* Merge pull request #5755 from kmk3/profiles-allow-lxqtLibravatar netblue302023-04-06
|\ | | | | profiles: allow lxqt config dir
| * profiles: allow lxqt config dirLibravatar Kelvin M. Klann2023-03-26
| | | | | | | | | | | | | | | | | | As suggested by @glitsj16: https://github.com/netblue30/firejail/discussions/5754#discussioncomment-5428651 Fixes #5754 (font size/dpi issues). Reported-by: @hotcapy
* | profiles: move read-only config entries to dcLibravatar Kelvin M. Klann2023-03-28
| | | | | | | | | | | | | | | | | | | | Command used to search for entries: $ git grep '^read-only ${HOME}/' -- 'etc/profile*' Note for gpg: ~/.gnupg/gpg.conf is apparently only managed by gpgconf(1) rather than through gpg(1) itself, in which case it does not need to be made read-write in gpg.profile.
* | cower: move blacklist from disable-programs to dcLibravatar Kelvin M. Klann2023-03-28
| | | | | | | | | | | | | | | | This is an AUR helper and disable-common.inc has entries for pacman and other system package managers. Added on commit 6c10737f0 ("archaudit-report and cower for Arch platforms, #1642", 2017-11-15).
* | firefox: move read-only entries to disable-common.incLibravatar Kelvin M. Klann2023-03-28
| | | | | | | | | | | | | | Instead of duplicating them on every profile that tries to allow opening links in Firefox. And make that path read-write on firefox.profile.
* | mpv: move read-only entries to disable-common.incLibravatar Kelvin M. Klann2023-03-27
|/ | | | | | | Note: mpv itself does not modify anything in ~/.config/mpv as far as I know, in which case it does not need a read-write entry. Relates to #5706 #5707 #5710.
* microsoft-edge fixes (#5697)Libravatar glitsj162023-03-14
| | | | | | | | | | | | | * microsoft-edge*: fix spacing * Create microsoft-edge-stable.profile Relates to #5696. * firecfg.config: add support for microsoft-edge-stable redirect * disable-common.inc: blacklist msedge SUID executables * microsoft-edge: add private-opt and allow internal sandbox access
* disable-common.inc: add systemd v253 blacklists (#5669)Libravatar glitsj162023-02-23
| | | | | | | | | | | | | | Arch Linux got systemd v253: https://github.com/archlinux/svntogit-packages/commit/05d0aedb2b83a2e1ba07cab47205772f82cb4814 It adds a few new files we should blacklist in `disable-common.inc`: - /etc/credstore - /etc/credstore.encrypted - /run/credentials/systemd-sysctl.service - /run/credentials/systemd-sysusers.service - /run/credentials/systemd-tmpfiles-setup.service - /run/credentials/systemd-tmpfiles-setup-dev.service
* Prevent access to LUKS keyfileLibravatar Netcarver2023-02-14
|
* disable-common.inc: make ~/.config/nano read-onlyLibravatar Kelvin M. Klann2023-01-30
| | | | | | Similarly to the existing ~/.nanorc entry. Taken from nano.profile.
* disable-common.inc: add more ro editor/browser pathsLibravatar Kelvin M. Klann2023-01-30
| | | | | | | | | Move some paths from mutt.profile and neomutt.profile. Added on commit 6b9bfad37 ("Fix python; add read-only to editors/cli browsers;re-add cache directory", 2020-12-29) / PR #3849. Misc: This is a follow-up to #5626.
* disable-common.inc: sort history file pathsLibravatar Kelvin M. Klann2023-01-30
|
* disable-common.inc: remove redundant history entryLibravatar Kelvin M. Klann2023-01-30
| | | | | | | | | This is already blocked by the first entry: blacklist-nolog ${HOME}/.*_history Added on commit 1d56e466c ("three new blacklist in disable-common.inc", 2019-06-18).
* mutt.profile: add ~/.mutthistoryLibravatar Kelvin M. Klann2023-01-27
| | | | | | | | | | | From the manual of mutt 2.2.9: > 3.125. history_file > > Type: path > Default: "~/.mutthistory" > > The file in which Mutt will save its history.
* clarify that duplicated blacklisting of /proc/config.gz is intentional (#5548)Libravatar glitsj162022-12-21
| | | | | | | * add comment on intentional duplication of blacklisted kernel configuration * disable-proc.inc: update the duplication comment * disable-common.inc: add duplication notice for kernel configuration
* disable-common.inc: add gnome-console to disabled terminals (#5542)Libravatar glitsj162022-12-20
|
* disable-common.inc: blacklist doas binaryLibravatar Kelvin M. Klann2022-10-05
| | | | | | | | | | | | | | | OpenDoas is an alternative to sudo. It is an unofficial port of OpenBSD's doas. Details: $ LC_ALL=C pacman -Si galaxy/opendoas | grep -e '^Version' -e '^Description' -e '^URL' Version : 6.8.2-1 Description : Run commands as super user or another user URL : https://github.com/Duncaen/OpenDoas Environment: Artix Linux. Also, add /etc/doas.conf to etc/ids.config.
* disable-common.inc: move blacklist of /etc/profile.dLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | | | | | | To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to #3411 #5159.
* nvim: add XDG_STATE_HOME pathLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | | | | | | | | | Default paths as of neovim 0.7.0: * backupdir: $XDG_DATA_HOME/nvim/backup// * directory: $XDG_DATA_HOME/nvim/swap// * undodir: $XDG_DATA_HOME/nvim/undo// * viewdir: $XDG_DATA_HOME/nvim/view// * shada file: $XDG_DATA_HOME/nvim/shada/main.shada * log dir: $XDG_CACHE_HOME/nvim/log Default paths as of [1]: * backupdir: $XDG_STATE_HOME/nvim/backup// * directory: $XDG_STATE_HOME/nvim/swap// * undodir: $XDG_STATE_HOME/nvim/undo// * viewdir: $XDG_STATE_HOME/nvim/view// * shada file: $XDG_STATE_HOME/nvim/shada/main.shada * log dir: $XDG_STATE_HOME/nvim/log [1] https://github.com/neovim/neovim/pull/15583
* more snap blacklisting (#5093)Libravatar smitsohu2022-04-04
|
* Merge pull request #5077 from kmk3/dc-add-pkcs11Libravatar netblue302022-03-29
|\ | | | | disable-common.inc: make ~/.config/pkcs11 read-only
| * disable-common.inc: make ~/.config/pkcs11 read-onlyLibravatar Kelvin M. Klann2022-03-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like it allows arbitrary command execution. From pkcs11.conf(5): > remote: > Instead of loading the PKCS#11 module locally, run the module > remotely. > > Specify a command to run, prefixed with | a pipe. The command > must speak the p11-kit remoting protocol on its standard in > and standard out. For example: > > remote: |ssh user@remote p11-kit remote /path/to/module.so > > Other forms of remoting will appear in later p11-kit releases. Environment: p11-kit 0.24.1-1 on Artix Linux. Currently this entry only exists on whitelist-common.inc, added on commit f74cfd07c ("add p11-kit support - #1646"). With this commit applied, all read-only entries on whitelist-commons.inc are also part of disable-common.inc. See also the discussion on #5069.
* | disable-common.inc: make ~/Applications dir read-onlyLibravatar Kelvin M. Klann2022-03-24
|/ | | | | | | | | | This directory is monitored by both appimaged[1] and AppImageLauncher[2]. Also, when opening an AppImage with AppImageLauncher, it may prompt the user to move the AppImage to ~/Applications. [1] https://github.com/AppImage/appimaged/blob/2323f1825ed6abe19f2d3791d81307449692be03/README.md#monitored-directories [2] https://github.com/TheAssassin/AppImageLauncher/wiki/Configuration
* opera fixes (#5041)Libravatar glitsj162022-03-14
| | | | | * opera fixes * disable-common.inc: add blacklist /usr/lib/opera/opera_sandbox
* mupdf refactoring cfr. ↵Libravatar glitsj162022-03-14
| | | | | | | | | | | | | | | | | | | | | | | | | https://github.com/netblue30/firejail/discussions/4993 (#5042) * refactor mupdf * refactor mupdf * refactor mupdf * refactor mupdf * add mupdf-gl blacklist * move history file back to mupdf-gl * refactor mupdf-gl * add no3d to mupdf.profile * add suggestions from review * drop unix from protocol [accumulates] * fix protocol
* Blacklist scala devel stuffLibravatar rusty-snake2022-03-05
|
* Merge pull request #4841 from Tus1688/masterLibravatar netblue302022-01-24
|\ | | | | Add neovim profile
| * fix: neovim profileLibravatar user2022-01-11
| |
* | blacklist password store directory for pass packageLibravatar netblue302022-01-21
|/
* Whitelist ${HOME}/.local/opt/tor-browser to make tor-browser workLibravatar York Zhao2021-12-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tor-browser 11.0.2-1 doesn't work without whitelisting this directory. The following was the message I got before whitelisting this directory. Reading profile /etc/firejail/tor-browser.profile Reading profile /etc/firejail/torbrowser-launcher.profile Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Warning: Warning: NVIDIA card detected, nogroups command disabled Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 12653, child pid 12654 104 programs installed in 153.32 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping asound.conf for private /etc Warning: skipping crypto-policies for private /etc Warning fcopy: skipping /etc/fonts/conf.d/11-lcdfilter-default.conf, cannot find inode Warning: skipping pki for private /etc Private /etc installed in 64.84 ms Private /usr/etc installed in 0.00 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Warning: cleaning all supplementary groups Child process initialized in 325.75 ms /usr/bin/tor-browser: [Error] The tor-browser archive could not be extracted to your home directory. Check the permissions of ~/.local/opt/tor-browser/app. The error log can be found in ~/.local/opt/tor-browser/LOG. /usr/bin/tor-browser: line 218: ~/.local/opt/tor-browser/app/Browser/start-tor-browser: No such file or directory
* fix #4714Libravatar netblue302021-11-29
|
* disable by default several network toolsLibravatar netblue302021-11-24
|
* Profile fixesLibravatar rusty-snake2021-11-14
| | | | | | | | - Update RELNOTES and README.md - disable-common.inc - blacklist ${HOME}/.local/share/ibus-typing-booster - blacklist /run/timeshift (closes #4660) - fix audacity.profile (closes #4659)
* Merge pull request #4680 from kmk3/dc-fix-slock-pathLibravatar netblue302021-11-13
|\ | | | | disable-common.inc: fix paths of slock and physlock
| * disable-common.inc: fix paths of slock and physlockLibravatar Kelvin M. Klann2021-11-11
| | | | | | | | | | | | Added on commit f0adf06c3 ("disable-common.inc: more SUID", 2021-11-09). Relates to #4668.
* | telnet and ftpLibravatar netblue302021-11-12
|/
* change Fedora ssh fixLibravatar glitsj162021-11-10
| | | Suggested in https://github.com/netblue30/firejail/pull/4675#discussion_r746510840. Makes sense!
* add Fedora fixLibravatar glitsj162021-11-10
| | | | Added Fedora path as per https://github.com/netblue30/firejail/pull/4675#pullrequestreview-802438767. NOTE: there are several other profiles touching /usr/libexec, so untill someone on Fedora can shed some light on what files are installed under /usr/libexec, I only blacklisted ssh-keysign. I'll pick this up tomorrow, a bit pressed for time in the non-digital worlds...
* fixes for sshLibravatar glitsj162021-11-10
| | | Counterpart fix for changes in allow-ssh.inc.
* disable-common.inc: more SUIDLibravatar netblue302021-11-09
|
* disable-common.inc: vmware SUID binariesLibravatar netblue302021-11-09
|
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-29 16:00:47 +0000