aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAge
...
* | Merge branch 'netblue30:master' into warzone2100Libravatar glitsj162023-01-31
|\|
| * disable-common.inc: sort history file pathsLibravatar Kelvin M. Klann2023-01-30
| |
| * disable-common.inc: remove redundant history entryLibravatar Kelvin M. Klann2023-01-30
| | | | | | | | | | | | | | | | | | This is already blocked by the first entry: blacklist-nolog ${HOME}/.*_history Added on commit 1d56e466c ("three new blacklist in disable-common.inc", 2019-06-18).
| * mutt.profile: add ~/.mutthistoryLibravatar Kelvin M. Klann2023-01-27
| | | | | | | | | | | | | | | | | | | | | | From the manual of mutt 2.2.9: > 3.125. history_file > > Type: path > Default: "~/.mutthistory" > > The file in which Mutt will save its history.
* | additional blacklisting for warzone2100 on Arch LinuxLibravatar glitsj162023-01-29
|/
* fix qutebrowser not opening tabs (#5618)Libravatar Alexandre Provencio2023-01-25
| | | | Closes #5601
* zoom.profile: whitelist ~/.config/zoom.conf (#5596)Libravatar fkrone2023-01-24
| | | | | | | | | | | | | * zoom.profile: whitelist ~/.config/zoom.conf With Zoom version 5.12.6, Zoom changed how they handle encrypting the local database. This change resulted in the new file zoom.conf being used. As it is not allowed by the current profile, this could lead to users losing their chat history if they cannot be retrieved from the cloud (e.g. when e2e encryption is used). * zoom.profile: noblacklist ~/.config/zoom.conf Additional blacklisting for other programs to the configuration file.
* Merge branch 'netblue30:master' into linuxqqLibravatar glitsj162023-01-04
|\
| * Merge pull request #5556 from Dpeta/chatterino-profileLibravatar netblue302023-01-04
| |\ | | | | | | Add profile for Chatterino
| | * Add Chatterino profileLibravatar Dpeta2022-12-25
| | |
| * | Blacklist XDG cache and data dirs for google-drive-ocamlfuseLibravatar slowpeek2022-12-23
| | |
| * | Blacklist google-drive-ocamlfuse configLibravatar slowpeek2022-12-23
| |/
* | disable-programs.inc: fix ordering QQ configLibravatar glitsj162023-01-03
| |
* | disable-programs.inc: add QQ configLibravatar glitsj162023-01-03
|/
* clarify that duplicated blacklisting of /proc/config.gz is intentional (#5548)Libravatar glitsj162022-12-21
| | | | | | | * add comment on intentional duplication of blacklisted kernel configuration * disable-proc.inc: update the duplication comment * disable-common.inc: add duplication notice for kernel configuration
* New profile: ssmtp (#5544)Libravatar glitsj162022-12-21
| | | | | | | | | | | | | | | * disable-programs.inc: add ssmtp support * Create ssmtp.profile * ssmtp: support Debian/Ubuntu * README.md: add ssmtp to 'New profiles' section * disable-common.inc: move ssmtp support to keep CI happy * ssmtp: improve dead.letter comment Suggested in [review](https://github.com/netblue30/firejail/pull/5544#pullrequestreview-1225322546).
* Fix mDNS name resolution with wrc (#5541)Libravatar rusty-snake2022-12-21
|
* disable-common.inc: add gnome-console to disabled terminals (#5542)Libravatar glitsj162022-12-20
|
* audacity: support more config locations (#5538)Libravatar glitsj162022-12-20
| | | | | | | | | | | | | | | * audacity: support more config locations * disable-programs.inc: add more audacity locations * audacity: cover all XDG supported locations * audacity: cover all XDG supported locations * audacity: fix state dir entree in disable-programs.inc * unbreak disable-programs.inc Oh my, GitHub syntax highlighting support completely threw me off here. Thanks to @kmk3 for [saving the bacon](https://github.com/netblue30/firejail/pull/5538#pullrequestreview-1224604663)!
* Merge pull request #5522 from hknaack/avidemux-fixes-for-opensuseLibravatar netblue302022-12-14
|\ | | | | Avidemux tools support
| * Avidemux: openSUSE-Packman fixesLibravatar Hartmut Knaack2022-12-12
| | | | | | | | | | | | The Avidemux project stores configuration profile data in ~/.avidemux6, while the package built by Packman-repositories for openSUSE patches it to use ~/.avidemux3 at the moment (at least for Avidemux 2.8).
* | Add support for Qt6 (#5527)Libravatar glitsj162022-12-14
|/ | | | | * qbittorrent: add support for Qt6 * wusc: add support for Qt6
* spotify.profile: allow spotify-adblock pathsLibravatar Kelvin M. Klann2022-12-02
| | | | | | | | | | | | | | | | | As suggested by @glitsj16[1]. Project homepage: https://github.com/abba23/spotify-adblock Configuration paths: * /etc/spotify-adblock/config.toml * ~/.config/spotify-adblock/config.toml Fixes #5494. [1] https://github.com/netblue30/firejail/discussions/5494#discussioncomment-4280887 Reported-by: @Rewig95
* fix: PyCharm profilesLibravatar Bogdan Ruslanovich Drozd2022-11-23
| | | | | | | Do not use `private-cache`, because PyCharm places in cache directories stuff like spelling dictionary (i. e. if you download spelling dictionary with `private-cache`, on restart PyCharm you need to download spelling dictionary again).
* disable-common.inc: blacklist doas binaryLibravatar Kelvin M. Klann2022-10-05
| | | | | | | | | | | | | | | OpenDoas is an alternative to sudo. It is an unofficial port of OpenBSD's doas. Details: $ LC_ALL=C pacman -Si galaxy/opendoas | grep -e '^Version' -e '^Description' -e '^URL' Version : 6.8.2-1 Description : Run commands as super user or another user URL : https://github.com/Duncaen/OpenDoas Environment: Artix Linux. Also, add /etc/doas.conf to etc/ids.config.
* Fix Firefox 'Profile not found' for psd (v6.45) (#5348)Libravatar godbless2022-09-08
| | | | | | | | | | | * Fix Firefox 'Profile not found' for psd (v6.45) code change: `whitelist ${RUNUSER}/psd/*firefox*` fixes: #4568 * Whitelist ${RUNUSER}/psd/*firefox* * Fix workflow for github
* Make /etc/ssh/ssh_config.d visible for ssh (#5353)Libravatar slowpeek2022-09-02
|
* Merge pull request #5331 from pirate486743186/lbry-viewer.profile-createLibravatar netblue302022-08-29
|\ | | | | lbry-viewer.profile create
| * lbry-viewer.profile createLibravatar pirate4867431862022-08-21
| |
* | tuir.profile creation (#5330)Libravatar pirate4867431862022-08-28
| | | | | | Co-authored-by: pirate486743186 <>
* | microsoft-edge.profile: rewrite profile for stable channelLibravatar Quentin RETORNAZ2022-08-11
|/ | | | | | * replaced private-opt by whitelist #5307 * added stable channel config dirs to disable-programs.inc
* add Colossal Order to steam.profileLibravatar 0x9fff002022-07-05
|
* add Paradox Launcher to blacklisted programs listLibravatar Serphentas2022-06-26
|
* disable-shell.inc: add global shell paths from ids.configLibravatar Kelvin M. Klann2022-06-02
| | | | | | | | | | | Since /etc/profile is present, add the other shell-related paths in /etc that are listed on ids.config. Suggestion by @rusty-snake[1]. Relates to #5167 #5170. [1] https://github.com/netblue30/firejail/pull/5167#pullrequestreview-989621852
* disable-shell.inc: blacklist /etc/profileLibravatar Kelvin M. Klann2022-05-30
| | | | Since /etc/profile.d is already being blacklisted.
* disable-common.inc: move blacklist of /etc/profile.dLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | | | | | | To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to #3411 #5159.
* Merge pull request #5141 from kmk3/nvim-add-xdg-state-homeLibravatar netblue302022-05-20
|\ | | | | nvim: add XDG_STATE_HOME path
| * nvim: add XDG_STATE_HOME pathLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default paths as of neovim 0.7.0: * backupdir: $XDG_DATA_HOME/nvim/backup// * directory: $XDG_DATA_HOME/nvim/swap// * undodir: $XDG_DATA_HOME/nvim/undo// * viewdir: $XDG_DATA_HOME/nvim/view// * shada file: $XDG_DATA_HOME/nvim/shada/main.shada * log dir: $XDG_CACHE_HOME/nvim/log Default paths as of [1]: * backupdir: $XDG_STATE_HOME/nvim/backup// * directory: $XDG_STATE_HOME/nvim/swap// * undodir: $XDG_STATE_HOME/nvim/undo// * viewdir: $XDG_STATE_HOME/nvim/view// * shada file: $XDG_STATE_HOME/nvim/shada/main.shada * log dir: $XDG_STATE_HOME/nvim/log [1] https://github.com/neovim/neovim/pull/15583
| * disable-programs.inc: remove ~/.local/share/nvimLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | It's already blacklisted on disable-common.inc. Added on commit ec966d4c0 ("fix: neovim profile", 2022-01-10) / PR #4841.
* | updates for wget2 (#5152)Libravatar glitsj162022-05-20
|/ | | | | * update for wget2 * allow ${HOME}/.local/share/wget
* Whitelist for NixOS to resolve binary paths in user environmentLibravatar Jonas Heinrich2022-05-07
|
* NixOS fix OpenGL app supportLibravatar Jonas Heinrich2022-05-07
|
* okLibravatar Łukasz Mariański2022-04-23
|
* Fix glob pattern and update other profiles/includesLibravatar Łukasz Mariański2022-04-23
|
* steam: add HotLine Miami (#5097)Libravatar Kelvin M. Klann2022-04-08
| | | https://store.steampowered.com/app/219150/Hotline_Miami/
* more snap blacklisting (#5093)Libravatar smitsohu2022-04-04
|
* Merge pull request #5077 from kmk3/dc-add-pkcs11Libravatar netblue302022-03-29
|\ | | | | disable-common.inc: make ~/.config/pkcs11 read-only
| * disable-common.inc: make ~/.config/pkcs11 read-onlyLibravatar Kelvin M. Klann2022-03-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It looks like it allows arbitrary command execution. From pkcs11.conf(5): > remote: > Instead of loading the PKCS#11 module locally, run the module > remotely. > > Specify a command to run, prefixed with | a pipe. The command > must speak the p11-kit remoting protocol on its standard in > and standard out. For example: > > remote: |ssh user@remote p11-kit remote /path/to/module.so > > Other forms of remoting will appear in later p11-kit releases. Environment: p11-kit 0.24.1-1 on Artix Linux. Currently this entry only exists on whitelist-common.inc, added on commit f74cfd07c ("add p11-kit support - #1646"). With this commit applied, all read-only entries on whitelist-commons.inc are also part of disable-common.inc. See also the discussion on #5069.
* | disable-programs.inc: blacklist ~/Applications dirLibravatar Kelvin M. Klann2022-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | It is used for storing AppImages. Note that even when blacklisting a directory, it is possible to execute an AppImage from it. For example, the following works: firejail --noprofile --blacklist='${HOME}/Applications' --appimage \ ~/Applications/foo.AppImage While the resulting process does not appear to have access to the blacklisted directory.
* | disable-common.inc: make ~/Applications dir read-onlyLibravatar Kelvin M. Klann2022-03-24
|/ | | | | | | | | | This directory is monitored by both appimaged[1] and AppImageLauncher[2]. Also, when opening an AppImage with AppImageLauncher, it may prompt the user to move the AppImage to ~/Applications. [1] https://github.com/AppImage/appimaged/blob/2323f1825ed6abe19f2d3791d81307449692be03/README.md#monitored-directories [2] https://github.com/TheAssassin/AppImageLauncher/wiki/Configuration
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-20 12:00:23 +0000