aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAge
* Merge pull request #5077 from kmk3/dc-add-pkcs11Libravatar netblue302022-03-29
|\ | | | | disable-common.inc: make ~/.config/pkcs11 read-only
| * disable-common.inc: make ~/.config/pkcs11 read-onlyLibravatar Kelvin M. Klann2022-03-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like it allows arbitrary command execution. From pkcs11.conf(5): > remote: > Instead of loading the PKCS#11 module locally, run the module > remotely. > > Specify a command to run, prefixed with | a pipe. The command > must speak the p11-kit remoting protocol on its standard in > and standard out. For example: > > remote: |ssh user@remote p11-kit remote /path/to/module.so > > Other forms of remoting will appear in later p11-kit releases. Environment: p11-kit 0.24.1-1 on Artix Linux. Currently this entry only exists on whitelist-common.inc, added on commit f74cfd07c ("add p11-kit support - #1646"). With this commit applied, all read-only entries on whitelist-commons.inc are also part of disable-common.inc. See also the discussion on #5069.
* | disable-programs.inc: blacklist ~/Applications dirLibravatar Kelvin M. Klann2022-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | It is used for storing AppImages. Note that even when blacklisting a directory, it is possible to execute an AppImage from it. For example, the following works: firejail --noprofile --blacklist='${HOME}/Applications' --appimage \ ~/Applications/foo.AppImage While the resulting process does not appear to have access to the blacklisted directory.
* | disable-common.inc: make ~/Applications dir read-onlyLibravatar Kelvin M. Klann2022-03-24
|/ | | | | | | | | | This directory is monitored by both appimaged[1] and AppImageLauncher[2]. Also, when opening an AppImage with AppImageLauncher, it may prompt the user to move the AppImage to ~/Applications. [1] https://github.com/AppImage/appimaged/blob/2323f1825ed6abe19f2d3791d81307449692be03/README.md#monitored-directories [2] https://github.com/TheAssassin/AppImageLauncher/wiki/Configuration
* allow-nodejs.inc: add nvm supportLibravatar glitsj162022-03-20
|
* ocenaudio hardening (#5056)Libravatar glitsj162022-03-18
| | | | | | | * ocenaudio: blacklist cache dir * ocenaudio: hardenings * ocenaudio: fix protocol comment
* allow-common-devel.inc: add missing java/scala pathsLibravatar Kelvin M. Klann2022-03-14
| | | | | | | | This amends commit f32cb8393 ("Blacklist scala devel stuff", 2022-03-05) / PR #5013. See the following review: https://github.com/netblue30/firejail/pull/5013#pullrequestreview-903794958
* opera fixes (#5041)Libravatar glitsj162022-03-14
| | | | | * opera fixes * disable-common.inc: add blacklist /usr/lib/opera/opera_sandbox
* mupdf refactoring cfr. ↵Libravatar glitsj162022-03-14
| | | | | | | | | | | | | | | | | | | | | | | | | https://github.com/netblue30/firejail/discussions/4993 (#5042) * refactor mupdf * refactor mupdf * refactor mupdf * refactor mupdf * add mupdf-gl blacklist * move history file back to mupdf-gl * refactor mupdf-gl * add no3d to mupdf.profile * add suggestions from review * drop unix from protocol [accumulates] * fix protocol
* disable-programs.inc: add ~/.preyLibravatar Kelvin M. Klann2022-03-11
| | | | | This amends commit af8f681c0 ("steam.profile: allow "${HOME}/.prey"", 2022-03-11) / PR #5029.
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar smitsohu2022-03-11
|\
| * Blacklist scala devel stuffLibravatar rusty-snake2022-03-05
| |
* | harden songrecLibravatar smitsohu2022-03-11
|/ | | | | | as suggested by @rusty-snake in addition blacklist/noblacklist/whitelist songrec application files
* add opera-developer.profile (#5001)Libravatar glitsj162022-03-03
| | | | | | | | | | | | | | | * add opera-developer to firecfg * add opera-developer * fix typo * add configs for opera-developer * Create opera-developer.profile * fixes for opera-developer * fix for opera-developer
* openSUSE Leap - whitelist-run-common.inc (#4954)Libravatar netblue302022-02-22
|
* Add support for changing appearance of the Qt6 apps with qt6ct (#4966)Libravatar avallach20002022-02-21
| | | | | | | * Add support for changing appearance of the Qt6 apps with qt6ct * Remove qt5ct artifact from zeal.profile * Remove qt5ct artifact from bibletime.profile
* disable-programs.inc: blacklist new qbittorrent data directoryLibravatar Andrew Kotsyuba2022-02-20
|
* Merge pull request #4894 from jmetrius/fix-eglLibravatar netblue302022-02-03
|\ | | | | Allow common access to EGL External platform configuration directory
| * Allow common access to EGL External platform configuration directoryLibravatar Jan Sonntag2022-02-02
| | | | | | | | This commit fixes Issue #4893 by allowing access to the configuration directory for the Wayland EGL external platform library
* | Merge pull request #4864 from antonv6/antonv6-steam-mangohudLibravatar netblue302022-02-03
|\ \ | |/ |/| steam.profile: allow ~/.config/MangoHud
| * disable-programs.inc: sort correctlyLibravatar Anton Shestakov2022-01-17
| |
| * disable-programs.inc: add ~/.config/MangoHudLibravatar Anton Shestakov2022-01-17
| |
* | Merge pull request #4841 from Tus1688/masterLibravatar netblue302022-01-24
|\ \ | | | | | | Add neovim profile
| * | fix: neovim profileLibravatar user2022-01-11
| | |
| * | fix: neovim profileLibravatar user2022-01-10
| | |
* | | mergesLibravatar netblue302022-01-24
| | |
* | | Merge pull request #4829 from CaseOf/seafileLibravatar netblue302022-01-24
|\ \ \ | | | | | | | | Seafile
| * | | Create seafile-applet.profileLibravatar CaseOf2022-01-06
| | | |
* | | | Merge pull request #4863 from antonv6/antonv6-wine-cacheLibravatar netblue302022-01-24
|\ \ \ \ | | | | | | | | | | {lutris,wine}.profile: allow ~/.cache/wine
| * | | | disable-programs.inc: add ~/.cache/wineLibravatar Anton Shestakov2022-01-17
| | |_|/ | |/| |
* | | | Merge pull request #4868 from reedriley/disable-programsLibravatar netblue302022-01-24
|\ \ \ \ | | | | | | | | | | Blacklist rclone, 1Password, Ledger Live and cointop
| * | | | Blacklist rclone, 1Password, Ledger Live and cointopLibravatar Reed Riley2022-01-19
| |/ / /
* | | | Merge pull request #4873 from reedriley/cointopLibravatar netblue302022-01-24
|\ \ \ \ | | | | | | | | | | add a profile for cointop
| * | | | add a profile for cointopLibravatar Reed Riley2022-01-21
| |/ / /
* | | | akonadi: chasing the socketsLibravatar smitsohu2022-01-23
| | | |
* | | | more on pass utilityLibravatar netblue302022-01-21
| | | |
* | | | blacklist password store directory for pass packageLibravatar netblue302022-01-21
|/ / /
* | | profiles: sort pathsLibravatar Reiner Herrmann2022-01-14
| | |
* | | fix warzone2100 (Debian 11)Libravatar netblue302022-01-13
| | |
* | | add wget2rc to disable-programs.incLibravatar glitsj162022-01-13
| | |
* | | Noblacklist rxvt in allow-perl.incLibravatar Vincent Lefevre2022-01-10
| |/ |/| | | | | | | This is the counterpart of the blacklist of rxvt in commit ed5c259f, as suggested in the discussion of pull request #4831.
* | Merge pull request #4826 from adrianlshaw/masterLibravatar netblue302022-01-08
|\ \ | | | | | | RPCS3 profile
| * | Add rpcs3 profileLibravatar Adrian L. Shaw2022-01-06
| |/
* / Blacklist rxvt after the blacklist of Perl.Libravatar Vincent Lefevre2022-01-07
|/ | | | | | rxvt needs Perl modules, thus does not work. And its blacklist is needed so that Firefox can run applications with Terminal=true in their .desktop file (depending on what is installed).
* add notable blacklistsLibravatar glitsj162022-01-05
|
* Merge pull request #4755 from kmk3/mpv-add-yt-dlpLibravatar netblue302021-12-28
|\ | | | | yt-dlp: add missing paths & mpv.profile: whitelist paths for yt-dlp
| * disable-programs.inc: blacklist missing yt-dlp pathsLibravatar Kelvin M. Klann2021-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This amends commit d6ca41c19 ("update mpv.profile", 2021-10-24) / PR #4634. These paths were taken from yt-dlp(1). They are used since yt-dlp commit e2e43aea2 ("Portable Configuration file (closes #19)", 2021-01-16)[1]. Environment: yt-dlp 2021.12.01-1 on Artix Linux. Relates to: https://github.com/yt-dlp/yt-dlp/issues/19 [1] https://github.com/yt-dlp/yt-dlp/commit/e2e43aea2159a235e151f56bd14383129a6b4355
* | Fix clipgrab profile (yt-dlp requires python)Libravatar Jose Riha2021-12-28
| |
* | Whitelist ${HOME}/.local/opt/tor-browser to make tor-browser workLibravatar York Zhao2021-12-17
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tor-browser 11.0.2-1 doesn't work without whitelisting this directory. The following was the message I got before whitelisting this directory. Reading profile /etc/firejail/tor-browser.profile Reading profile /etc/firejail/torbrowser-launcher.profile Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Warning: Warning: NVIDIA card detected, nogroups command disabled Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 12653, child pid 12654 104 programs installed in 153.32 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping asound.conf for private /etc Warning: skipping crypto-policies for private /etc Warning fcopy: skipping /etc/fonts/conf.d/11-lcdfilter-default.conf, cannot find inode Warning: skipping pki for private /etc Private /etc installed in 64.84 ms Private /usr/etc installed in 0.00 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Warning: cleaning all supplementary groups Child process initialized in 325.75 ms /usr/bin/tor-browser: [Error] The tor-browser archive could not be extracted to your home directory. Check the permissions of ~/.local/opt/tor-browser/app. The error log can be found in ~/.local/opt/tor-browser/LOG. /usr/bin/tor-browser: line 218: ~/.local/opt/tor-browser/app/Browser/start-tor-browser: No such file or directory
* Add new cachy-browser profileLibravatar Vladislav Nepogodin2021-12-06
|
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-09 05:52:31 +0000