aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAge
* fix: PyCharm profilesLibravatar Bogdan Ruslanovich Drozd2022-11-23
| | | | | | | Do not use `private-cache`, because PyCharm places in cache directories stuff like spelling dictionary (i. e. if you download spelling dictionary with `private-cache`, on restart PyCharm you need to download spelling dictionary again).
* disable-common.inc: blacklist doas binaryLibravatar Kelvin M. Klann2022-10-05
| | | | | | | | | | | | | | | OpenDoas is an alternative to sudo. It is an unofficial port of OpenBSD's doas. Details: $ LC_ALL=C pacman -Si galaxy/opendoas | grep -e '^Version' -e '^Description' -e '^URL' Version : 6.8.2-1 Description : Run commands as super user or another user URL : https://github.com/Duncaen/OpenDoas Environment: Artix Linux. Also, add /etc/doas.conf to etc/ids.config.
* Fix Firefox 'Profile not found' for psd (v6.45) (#5348)Libravatar godbless2022-09-08
| | | | | | | | | | | * Fix Firefox 'Profile not found' for psd (v6.45) code change: `whitelist ${RUNUSER}/psd/*firefox*` fixes: #4568 * Whitelist ${RUNUSER}/psd/*firefox* * Fix workflow for github
* Make /etc/ssh/ssh_config.d visible for ssh (#5353)Libravatar slowpeek2022-09-02
|
* Merge pull request #5331 from pirate486743186/lbry-viewer.profile-createLibravatar netblue302022-08-29
|\ | | | | lbry-viewer.profile create
| * lbry-viewer.profile createLibravatar pirate4867431862022-08-21
| |
* | tuir.profile creation (#5330)Libravatar pirate4867431862022-08-28
| | | | | | Co-authored-by: pirate486743186 <>
* | microsoft-edge.profile: rewrite profile for stable channelLibravatar Quentin RETORNAZ2022-08-11
|/ | | | | | * replaced private-opt by whitelist #5307 * added stable channel config dirs to disable-programs.inc
* add Colossal Order to steam.profileLibravatar 0x9fff002022-07-05
|
* add Paradox Launcher to blacklisted programs listLibravatar Serphentas2022-06-26
|
* disable-shell.inc: add global shell paths from ids.configLibravatar Kelvin M. Klann2022-06-02
| | | | | | | | | | | Since /etc/profile is present, add the other shell-related paths in /etc that are listed on ids.config. Suggestion by @rusty-snake[1]. Relates to #5167 #5170. [1] https://github.com/netblue30/firejail/pull/5167#pullrequestreview-989621852
* disable-shell.inc: blacklist /etc/profileLibravatar Kelvin M. Klann2022-05-30
| | | | Since /etc/profile.d is already being blacklisted.
* disable-common.inc: move blacklist of /etc/profile.dLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | | | | | | To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to #3411 #5159.
* Merge pull request #5141 from kmk3/nvim-add-xdg-state-homeLibravatar netblue302022-05-20
|\ | | | | nvim: add XDG_STATE_HOME path
| * nvim: add XDG_STATE_HOME pathLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default paths as of neovim 0.7.0: * backupdir: $XDG_DATA_HOME/nvim/backup// * directory: $XDG_DATA_HOME/nvim/swap// * undodir: $XDG_DATA_HOME/nvim/undo// * viewdir: $XDG_DATA_HOME/nvim/view// * shada file: $XDG_DATA_HOME/nvim/shada/main.shada * log dir: $XDG_CACHE_HOME/nvim/log Default paths as of [1]: * backupdir: $XDG_STATE_HOME/nvim/backup// * directory: $XDG_STATE_HOME/nvim/swap// * undodir: $XDG_STATE_HOME/nvim/undo// * viewdir: $XDG_STATE_HOME/nvim/view// * shada file: $XDG_STATE_HOME/nvim/shada/main.shada * log dir: $XDG_STATE_HOME/nvim/log [1] https://github.com/neovim/neovim/pull/15583
| * disable-programs.inc: remove ~/.local/share/nvimLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | It's already blacklisted on disable-common.inc. Added on commit ec966d4c0 ("fix: neovim profile", 2022-01-10) / PR #4841.
* | updates for wget2 (#5152)Libravatar glitsj162022-05-20
|/ | | | | * update for wget2 * allow ${HOME}/.local/share/wget
* Whitelist for NixOS to resolve binary paths in user environmentLibravatar Jonas Heinrich2022-05-07
|
* NixOS fix OpenGL app supportLibravatar Jonas Heinrich2022-05-07
|
* okLibravatar Łukasz Mariański2022-04-23
|
* Fix glob pattern and update other profiles/includesLibravatar Łukasz Mariański2022-04-23
|
* steam: add HotLine Miami (#5097)Libravatar Kelvin M. Klann2022-04-08
| | | https://store.steampowered.com/app/219150/Hotline_Miami/
* more snap blacklisting (#5093)Libravatar smitsohu2022-04-04
|
* Merge pull request #5077 from kmk3/dc-add-pkcs11Libravatar netblue302022-03-29
|\ | | | | disable-common.inc: make ~/.config/pkcs11 read-only
| * disable-common.inc: make ~/.config/pkcs11 read-onlyLibravatar Kelvin M. Klann2022-03-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like it allows arbitrary command execution. From pkcs11.conf(5): > remote: > Instead of loading the PKCS#11 module locally, run the module > remotely. > > Specify a command to run, prefixed with | a pipe. The command > must speak the p11-kit remoting protocol on its standard in > and standard out. For example: > > remote: |ssh user@remote p11-kit remote /path/to/module.so > > Other forms of remoting will appear in later p11-kit releases. Environment: p11-kit 0.24.1-1 on Artix Linux. Currently this entry only exists on whitelist-common.inc, added on commit f74cfd07c ("add p11-kit support - #1646"). With this commit applied, all read-only entries on whitelist-commons.inc are also part of disable-common.inc. See also the discussion on #5069.
* | disable-programs.inc: blacklist ~/Applications dirLibravatar Kelvin M. Klann2022-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | It is used for storing AppImages. Note that even when blacklisting a directory, it is possible to execute an AppImage from it. For example, the following works: firejail --noprofile --blacklist='${HOME}/Applications' --appimage \ ~/Applications/foo.AppImage While the resulting process does not appear to have access to the blacklisted directory.
* | disable-common.inc: make ~/Applications dir read-onlyLibravatar Kelvin M. Klann2022-03-24
|/ | | | | | | | | | This directory is monitored by both appimaged[1] and AppImageLauncher[2]. Also, when opening an AppImage with AppImageLauncher, it may prompt the user to move the AppImage to ~/Applications. [1] https://github.com/AppImage/appimaged/blob/2323f1825ed6abe19f2d3791d81307449692be03/README.md#monitored-directories [2] https://github.com/TheAssassin/AppImageLauncher/wiki/Configuration
* allow-nodejs.inc: add nvm supportLibravatar glitsj162022-03-20
|
* ocenaudio hardening (#5056)Libravatar glitsj162022-03-18
| | | | | | | * ocenaudio: blacklist cache dir * ocenaudio: hardenings * ocenaudio: fix protocol comment
* allow-common-devel.inc: add missing java/scala pathsLibravatar Kelvin M. Klann2022-03-14
| | | | | | | | This amends commit f32cb8393 ("Blacklist scala devel stuff", 2022-03-05) / PR #5013. See the following review: https://github.com/netblue30/firejail/pull/5013#pullrequestreview-903794958
* opera fixes (#5041)Libravatar glitsj162022-03-14
| | | | | * opera fixes * disable-common.inc: add blacklist /usr/lib/opera/opera_sandbox
* mupdf refactoring cfr. ↵Libravatar glitsj162022-03-14
| | | | | | | | | | | | | | | | | | | | | | | | | https://github.com/netblue30/firejail/discussions/4993 (#5042) * refactor mupdf * refactor mupdf * refactor mupdf * refactor mupdf * add mupdf-gl blacklist * move history file back to mupdf-gl * refactor mupdf-gl * add no3d to mupdf.profile * add suggestions from review * drop unix from protocol [accumulates] * fix protocol
* disable-programs.inc: add ~/.preyLibravatar Kelvin M. Klann2022-03-11
| | | | | This amends commit af8f681c0 ("steam.profile: allow "${HOME}/.prey"", 2022-03-11) / PR #5029.
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar smitsohu2022-03-11
|\
| * Blacklist scala devel stuffLibravatar rusty-snake2022-03-05
| |
* | harden songrecLibravatar smitsohu2022-03-11
|/ | | | | | as suggested by @rusty-snake in addition blacklist/noblacklist/whitelist songrec application files
* add opera-developer.profile (#5001)Libravatar glitsj162022-03-03
| | | | | | | | | | | | | | | * add opera-developer to firecfg * add opera-developer * fix typo * add configs for opera-developer * Create opera-developer.profile * fixes for opera-developer * fix for opera-developer
* openSUSE Leap - whitelist-run-common.inc (#4954)Libravatar netblue302022-02-22
|
* Add support for changing appearance of the Qt6 apps with qt6ct (#4966)Libravatar avallach20002022-02-21
| | | | | | | * Add support for changing appearance of the Qt6 apps with qt6ct * Remove qt5ct artifact from zeal.profile * Remove qt5ct artifact from bibletime.profile
* disable-programs.inc: blacklist new qbittorrent data directoryLibravatar Andrew Kotsyuba2022-02-20
|
* Merge pull request #4894 from jmetrius/fix-eglLibravatar netblue302022-02-03
|\ | | | | Allow common access to EGL External platform configuration directory
| * Allow common access to EGL External platform configuration directoryLibravatar Jan Sonntag2022-02-02
| | | | | | | | This commit fixes Issue #4893 by allowing access to the configuration directory for the Wayland EGL external platform library
* | Merge pull request #4864 from antonv6/antonv6-steam-mangohudLibravatar netblue302022-02-03
|\ \ | |/ |/| steam.profile: allow ~/.config/MangoHud
| * disable-programs.inc: sort correctlyLibravatar Anton Shestakov2022-01-17
| |
| * disable-programs.inc: add ~/.config/MangoHudLibravatar Anton Shestakov2022-01-17
| |
* | Merge pull request #4841 from Tus1688/masterLibravatar netblue302022-01-24
|\ \ | | | | | | Add neovim profile
| * | fix: neovim profileLibravatar user2022-01-11
| | |
| * | fix: neovim profileLibravatar user2022-01-10
| | |
* | | mergesLibravatar netblue302022-01-24
| | |
* | | Merge pull request #4829 from CaseOf/seafileLibravatar netblue302022-01-24
|\ \ \ | | | | | | | | Seafile
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 15:16:28 +0000