aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAge
* Merge branch 'netblue30:master' into linuxqqLibravatar glitsj162023-01-04
|\
| * Merge pull request #5556 from Dpeta/chatterino-profileLibravatar netblue302023-01-04
| |\ | | | | | | Add profile for Chatterino
| | * Add Chatterino profileLibravatar Dpeta2022-12-25
| | |
| * | Blacklist XDG cache and data dirs for google-drive-ocamlfuseLibravatar slowpeek2022-12-23
| | |
| * | Blacklist google-drive-ocamlfuse configLibravatar slowpeek2022-12-23
| |/
* | disable-programs.inc: fix ordering QQ configLibravatar glitsj162023-01-03
| |
* | disable-programs.inc: add QQ configLibravatar glitsj162023-01-03
|/
* clarify that duplicated blacklisting of /proc/config.gz is intentional (#5548)Libravatar glitsj162022-12-21
| | | | | | | * add comment on intentional duplication of blacklisted kernel configuration * disable-proc.inc: update the duplication comment * disable-common.inc: add duplication notice for kernel configuration
* New profile: ssmtp (#5544)Libravatar glitsj162022-12-21
| | | | | | | | | | | | | | | * disable-programs.inc: add ssmtp support * Create ssmtp.profile * ssmtp: support Debian/Ubuntu * README.md: add ssmtp to 'New profiles' section * disable-common.inc: move ssmtp support to keep CI happy * ssmtp: improve dead.letter comment Suggested in [review](https://github.com/netblue30/firejail/pull/5544#pullrequestreview-1225322546).
* Fix mDNS name resolution with wrc (#5541)Libravatar rusty-snake2022-12-21
|
* disable-common.inc: add gnome-console to disabled terminals (#5542)Libravatar glitsj162022-12-20
|
* audacity: support more config locations (#5538)Libravatar glitsj162022-12-20
| | | | | | | | | | | | | | | * audacity: support more config locations * disable-programs.inc: add more audacity locations * audacity: cover all XDG supported locations * audacity: cover all XDG supported locations * audacity: fix state dir entree in disable-programs.inc * unbreak disable-programs.inc Oh my, GitHub syntax highlighting support completely threw me off here. Thanks to @kmk3 for [saving the bacon](https://github.com/netblue30/firejail/pull/5538#pullrequestreview-1224604663)!
* Merge pull request #5522 from hknaack/avidemux-fixes-for-opensuseLibravatar netblue302022-12-14
|\ | | | | Avidemux tools support
| * Avidemux: openSUSE-Packman fixesLibravatar Hartmut Knaack2022-12-12
| | | | | | | | | | | | The Avidemux project stores configuration profile data in ~/.avidemux6, while the package built by Packman-repositories for openSUSE patches it to use ~/.avidemux3 at the moment (at least for Avidemux 2.8).
* | Add support for Qt6 (#5527)Libravatar glitsj162022-12-14
|/ | | | | * qbittorrent: add support for Qt6 * wusc: add support for Qt6
* spotify.profile: allow spotify-adblock pathsLibravatar Kelvin M. Klann2022-12-02
| | | | | | | | | | | | | | | | | As suggested by @glitsj16[1]. Project homepage: https://github.com/abba23/spotify-adblock Configuration paths: * /etc/spotify-adblock/config.toml * ~/.config/spotify-adblock/config.toml Fixes #5494. [1] https://github.com/netblue30/firejail/discussions/5494#discussioncomment-4280887 Reported-by: @Rewig95
* fix: PyCharm profilesLibravatar Bogdan Ruslanovich Drozd2022-11-23
| | | | | | | Do not use `private-cache`, because PyCharm places in cache directories stuff like spelling dictionary (i. e. if you download spelling dictionary with `private-cache`, on restart PyCharm you need to download spelling dictionary again).
* disable-common.inc: blacklist doas binaryLibravatar Kelvin M. Klann2022-10-05
| | | | | | | | | | | | | | | OpenDoas is an alternative to sudo. It is an unofficial port of OpenBSD's doas. Details: $ LC_ALL=C pacman -Si galaxy/opendoas | grep -e '^Version' -e '^Description' -e '^URL' Version : 6.8.2-1 Description : Run commands as super user or another user URL : https://github.com/Duncaen/OpenDoas Environment: Artix Linux. Also, add /etc/doas.conf to etc/ids.config.
* Fix Firefox 'Profile not found' for psd (v6.45) (#5348)Libravatar godbless2022-09-08
| | | | | | | | | | | * Fix Firefox 'Profile not found' for psd (v6.45) code change: `whitelist ${RUNUSER}/psd/*firefox*` fixes: #4568 * Whitelist ${RUNUSER}/psd/*firefox* * Fix workflow for github
* Make /etc/ssh/ssh_config.d visible for ssh (#5353)Libravatar slowpeek2022-09-02
|
* Merge pull request #5331 from pirate486743186/lbry-viewer.profile-createLibravatar netblue302022-08-29
|\ | | | | lbry-viewer.profile create
| * lbry-viewer.profile createLibravatar pirate4867431862022-08-21
| |
* | tuir.profile creation (#5330)Libravatar pirate4867431862022-08-28
| | | | | | Co-authored-by: pirate486743186 <>
* | microsoft-edge.profile: rewrite profile for stable channelLibravatar Quentin RETORNAZ2022-08-11
|/ | | | | | * replaced private-opt by whitelist #5307 * added stable channel config dirs to disable-programs.inc
* add Colossal Order to steam.profileLibravatar 0x9fff002022-07-05
|
* add Paradox Launcher to blacklisted programs listLibravatar Serphentas2022-06-26
|
* disable-shell.inc: add global shell paths from ids.configLibravatar Kelvin M. Klann2022-06-02
| | | | | | | | | | | Since /etc/profile is present, add the other shell-related paths in /etc that are listed on ids.config. Suggestion by @rusty-snake[1]. Relates to #5167 #5170. [1] https://github.com/netblue30/firejail/pull/5167#pullrequestreview-989621852
* disable-shell.inc: blacklist /etc/profileLibravatar Kelvin M. Klann2022-05-30
| | | | Since /etc/profile.d is already being blacklisted.
* disable-common.inc: move blacklist of /etc/profile.dLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | | | | | | To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to #3411 #5159.
* Merge pull request #5141 from kmk3/nvim-add-xdg-state-homeLibravatar netblue302022-05-20
|\ | | | | nvim: add XDG_STATE_HOME path
| * nvim: add XDG_STATE_HOME pathLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default paths as of neovim 0.7.0: * backupdir: $XDG_DATA_HOME/nvim/backup// * directory: $XDG_DATA_HOME/nvim/swap// * undodir: $XDG_DATA_HOME/nvim/undo// * viewdir: $XDG_DATA_HOME/nvim/view// * shada file: $XDG_DATA_HOME/nvim/shada/main.shada * log dir: $XDG_CACHE_HOME/nvim/log Default paths as of [1]: * backupdir: $XDG_STATE_HOME/nvim/backup// * directory: $XDG_STATE_HOME/nvim/swap// * undodir: $XDG_STATE_HOME/nvim/undo// * viewdir: $XDG_STATE_HOME/nvim/view// * shada file: $XDG_STATE_HOME/nvim/shada/main.shada * log dir: $XDG_STATE_HOME/nvim/log [1] https://github.com/neovim/neovim/pull/15583
| * disable-programs.inc: remove ~/.local/share/nvimLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | It's already blacklisted on disable-common.inc. Added on commit ec966d4c0 ("fix: neovim profile", 2022-01-10) / PR #4841.
* | updates for wget2 (#5152)Libravatar glitsj162022-05-20
|/ | | | | * update for wget2 * allow ${HOME}/.local/share/wget
* Whitelist for NixOS to resolve binary paths in user environmentLibravatar Jonas Heinrich2022-05-07
|
* NixOS fix OpenGL app supportLibravatar Jonas Heinrich2022-05-07
|
* okLibravatar Łukasz Mariański2022-04-23
|
* Fix glob pattern and update other profiles/includesLibravatar Łukasz Mariański2022-04-23
|
* steam: add HotLine Miami (#5097)Libravatar Kelvin M. Klann2022-04-08
| | | https://store.steampowered.com/app/219150/Hotline_Miami/
* more snap blacklisting (#5093)Libravatar smitsohu2022-04-04
|
* Merge pull request #5077 from kmk3/dc-add-pkcs11Libravatar netblue302022-03-29
|\ | | | | disable-common.inc: make ~/.config/pkcs11 read-only
| * disable-common.inc: make ~/.config/pkcs11 read-onlyLibravatar Kelvin M. Klann2022-03-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like it allows arbitrary command execution. From pkcs11.conf(5): > remote: > Instead of loading the PKCS#11 module locally, run the module > remotely. > > Specify a command to run, prefixed with | a pipe. The command > must speak the p11-kit remoting protocol on its standard in > and standard out. For example: > > remote: |ssh user@remote p11-kit remote /path/to/module.so > > Other forms of remoting will appear in later p11-kit releases. Environment: p11-kit 0.24.1-1 on Artix Linux. Currently this entry only exists on whitelist-common.inc, added on commit f74cfd07c ("add p11-kit support - #1646"). With this commit applied, all read-only entries on whitelist-commons.inc are also part of disable-common.inc. See also the discussion on #5069.
* | disable-programs.inc: blacklist ~/Applications dirLibravatar Kelvin M. Klann2022-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | It is used for storing AppImages. Note that even when blacklisting a directory, it is possible to execute an AppImage from it. For example, the following works: firejail --noprofile --blacklist='${HOME}/Applications' --appimage \ ~/Applications/foo.AppImage While the resulting process does not appear to have access to the blacklisted directory.
* | disable-common.inc: make ~/Applications dir read-onlyLibravatar Kelvin M. Klann2022-03-24
|/ | | | | | | | | | This directory is monitored by both appimaged[1] and AppImageLauncher[2]. Also, when opening an AppImage with AppImageLauncher, it may prompt the user to move the AppImage to ~/Applications. [1] https://github.com/AppImage/appimaged/blob/2323f1825ed6abe19f2d3791d81307449692be03/README.md#monitored-directories [2] https://github.com/TheAssassin/AppImageLauncher/wiki/Configuration
* allow-nodejs.inc: add nvm supportLibravatar glitsj162022-03-20
|
* ocenaudio hardening (#5056)Libravatar glitsj162022-03-18
| | | | | | | * ocenaudio: blacklist cache dir * ocenaudio: hardenings * ocenaudio: fix protocol comment
* allow-common-devel.inc: add missing java/scala pathsLibravatar Kelvin M. Klann2022-03-14
| | | | | | | | This amends commit f32cb8393 ("Blacklist scala devel stuff", 2022-03-05) / PR #5013. See the following review: https://github.com/netblue30/firejail/pull/5013#pullrequestreview-903794958
* opera fixes (#5041)Libravatar glitsj162022-03-14
| | | | | * opera fixes * disable-common.inc: add blacklist /usr/lib/opera/opera_sandbox
* mupdf refactoring cfr. ↵Libravatar glitsj162022-03-14
| | | | | | | | | | | | | | | | | | | | | | | | | https://github.com/netblue30/firejail/discussions/4993 (#5042) * refactor mupdf * refactor mupdf * refactor mupdf * refactor mupdf * add mupdf-gl blacklist * move history file back to mupdf-gl * refactor mupdf-gl * add no3d to mupdf.profile * add suggestions from review * drop unix from protocol [accumulates] * fix protocol
* disable-programs.inc: add ~/.preyLibravatar Kelvin M. Klann2022-03-11
| | | | | This amends commit af8f681c0 ("steam.profile: allow "${HOME}/.prey"", 2022-03-11) / PR #5029.
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar smitsohu2022-03-11
|\
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-02 17:27:56 +0000