aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAge
* Whitelist ${HOME}/.local/opt/tor-browser to make tor-browser workLibravatar York Zhao2021-12-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | tor-browser 11.0.2-1 doesn't work without whitelisting this directory. The following was the message I got before whitelisting this directory. Reading profile /etc/firejail/tor-browser.profile Reading profile /etc/firejail/torbrowser-launcher.profile Reading profile /etc/firejail/allow-python2.inc Reading profile /etc/firejail/allow-python3.inc Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-exec.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-common.inc Reading profile /etc/firejail/whitelist-var-common.inc Reading profile /etc/firejail/whitelist-runuser-common.inc Reading profile /etc/firejail/whitelist-usr-share-common.inc Warning: Warning: NVIDIA card detected, nogroups command disabled Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Parent pid 12653, child pid 12654 104 programs installed in 153.32 ms Warning: An abstract unix socket for session D-BUS might still be available. Use --net or remove unix from --protocol set. Warning: skipping asound.conf for private /etc Warning: skipping crypto-policies for private /etc Warning fcopy: skipping /etc/fonts/conf.d/11-lcdfilter-default.conf, cannot find inode Warning: skipping pki for private /etc Private /etc installed in 64.84 ms Private /usr/etc installed in 0.00 ms Warning: cleaning all supplementary groups Warning: cleaning all supplementary groups Warning: /sbin directory link was not blacklisted Warning: /usr/sbin directory link was not blacklisted Warning: cleaning all supplementary groups Seccomp list in: !chroot, check list: @default-keep, prelist: unknown, Warning: cleaning all supplementary groups Child process initialized in 325.75 ms /usr/bin/tor-browser: [Error] The tor-browser archive could not be extracted to your home directory. Check the permissions of ~/.local/opt/tor-browser/app. The error log can be found in ~/.local/opt/tor-browser/LOG. /usr/bin/tor-browser: line 218: ~/.local/opt/tor-browser/app/Browser/start-tor-browser: No such file or directory
* Add new cachy-browser profileLibravatar Vladislav Nepogodin2021-12-06
|
* additional electron blacklistsLibravatar glitsj162021-11-30
|
* Blacklist ~/.config/monero-projectLibravatar Ted Robertson2021-11-30
|
* fix #4714Libravatar netblue302021-11-29
|
* disable by default several network toolsLibravatar netblue302021-11-24
|
* Profile fixesLibravatar rusty-snake2021-11-14
| | | | | | | | - Update RELNOTES and README.md - disable-common.inc - blacklist ${HOME}/.local/share/ibus-typing-booster - blacklist /run/timeshift (closes #4660) - fix audacity.profile (closes #4659)
* Merge pull request #4681 from jmetrius/openstego-profileLibravatar netblue302021-11-13
|\ | | | | Add OpenStego profile
| * Add OpenStego profileLibravatar Jan Sonntag2021-11-12
| |
* | Merge pull request #4680 from kmk3/dc-fix-slock-pathLibravatar netblue302021-11-13
|\ \ | | | | | | disable-common.inc: fix paths of slock and physlock
| * | disable-common.inc: fix paths of slock and physlockLibravatar Kelvin M. Klann2021-11-11
| |/ | | | | | | | | | | Added on commit f0adf06c3 ("disable-common.inc: more SUID", 2021-11-09). Relates to #4668.
* / telnet and ftpLibravatar netblue302021-11-12
|/
* change Fedora ssh fixLibravatar glitsj162021-11-10
| | | Suggested in https://github.com/netblue30/firejail/pull/4675#discussion_r746510840. Makes sense!
* add Fedora fixLibravatar glitsj162021-11-10
| | | | Added Fedora path as per https://github.com/netblue30/firejail/pull/4675#pullrequestreview-802438767. NOTE: there are several other profiles touching /usr/libexec, so untill someone on Fedora can shed some light on what files are installed under /usr/libexec, I only blacklisted ssh-keysign. I'll pick this up tomorrow, a bit pressed for time in the non-digital worlds...
* add Fedora fixesLibravatar glitsj162021-11-10
| | | Added Fedora path as per https://github.com/netblue30/firejail/pull/4675#pullrequestreview-802438767.
* fixes for sshLibravatar glitsj162021-11-10
| | | Counterpart fix for changes in allow-ssh.inc.
* fixes for sshLibravatar glitsj162021-11-10
| | | After seeing https://github.com/netblue30/firejail/commit/9a81078ddbbb4215d06f7d1861481ece05ebda99 it dawned on me that Arch Linux doesn't have /usr/lib/openssh, but uses /usr/lib/ssh instead. That's a different path than what's referenced in our current {allow-ssh,disable-common}.inc files. Some very superficial checks revealed that OpenSSH seems to be packaged quite differently, at least on Debian/Ubuntu and Arch Linux. And then there's version differences on non-rolling distro's to consider. All in all IMO it makes more sense to (no)blacklist /usr/lib/openssh and /usr/lib/ssh instead of referencing all the possible individual files that live under those paths.
* disable-common.inc: fix sshLibravatar netblue302021-11-09
|
* disable-common.inc: more SUIDLibravatar netblue302021-11-09
|
* disable-common.inc: vmware SUID binariesLibravatar netblue302021-11-09
|
* disable-common.inc: disable chrome-sandboxLibravatar netblue302021-11-09
|
* disable-common.inc: blacklist sshLibravatar netblue302021-11-09
|
* adding more SUID executables to disable-common.incLibravatar netblue302021-11-04
|
* Sort disaple-programs.incLibravatar rusty-snake2021-10-27
|
* wrc: whitelist journal socketsLibravatar smitsohu2021-10-23
| | | | fixes --tracelog among other things
* promote /run/udev/data to wrcLibravatar smitsohu2021-10-23
|
* disable-exec: add /run/shmLibravatar smitsohu2021-10-23
|
* Merge pull request #4521 from rusty-snake/disable-proc.incLibravatar smitsohu2021-10-20
|\ | | | | Create disable-proc.inc
| * Update disable-proc.incLibravatar rusty-snake2021-10-09
| |
| * Update disable-proc.incLibravatar rusty-snake2021-09-10
| |
| * Create disable-proc.incLibravatar rusty-snake2021-09-09
| |
* | add /run/shm to wrcLibravatar smitsohu2021-10-16
| | | | | | | | | | | | | | | | found in Debian Bullseye. /run/shm is a symbolic link to /dev/shm, and whitelisting it will just recreate the symbolic link.
* | Merge pull request #4587 from kmk3/fix-vscodiumLibravatar netblue302021-10-09
|\ \ | | | | | | Fix vscodium
| * | vscodium.profile: add missing pathsLibravatar Kelvin M. Klann2021-10-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It creates the following directories on startup: * ~/.config/VSCodium * ~/.vscode-oss Environment: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 Note: The following entry is already on disable-programs.inc: noblacklist ${HOME}/.vscode-oss It was added on commit de90834a8 ("Update disable-programs.inc", 2019-03-02). Relates to #3871.
* | | Merge pull request #4519 from rusty-snake/build-systemsLibravatar netblue302021-10-09
|\ \ \ | |/ / |/| | Add profiles for build-systems (/package-managers)
| * | Add profiles for build-systems (/package-managers)Libravatar rusty-snake2021-09-08
| |/ | | | | | | | | | | | | | | | | | | Profiles: bunler, cargo (refactor), cmake (untested), make, meson, pip All redirect to build-systems-common.profile Other fixes: - blacklist ${HOME}/.bundle - blacklist ${HOME}/.cargo/* -> blacklist ${HOME}/.cargo - blacklist /usr/lib64/ruby
* | Profile fixes and hardeningLibravatar rusty-snake2021-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * cheese - fix: dbus-user.own org.gnome.Cheese - fix: whitelist /usr/share/gstreamer-1.0 - fix: include allow-python3.inc - hardening: include disable-shell.inc - hardening: include whitelist-run-common.inc and whitelist /run/udev/data - hardening: whitelist /usr/libexec/gstreamer-1.0/gst-plugin-scanner - hardening: noinput - hardening: nosound - hardening: seccomp.block-secondary - hardening: private-dev * geekbench (closes #4576) - fix: noblacklist /sbin and noblacklist /usr/sbin - fix: noblacklist, blacklist, mkdir, whitelist, read-write ${HOME}/.geekbench5 - fix: comment/remove private-bin, private-lib, private-opt * inkscape - add quiet for cli usage * musixmatch (#4518) - allow chroot * pandoc - fix: include allow-bin-sh.inc - fix: drop private-bin - hardening: include whitelist-runuser-common.inc - hardening: seccomp.block-secondary
* | trim excess whitespaceLibravatar a13460542021-09-25
| |
* | Create goldendict.profileLibravatar lecso72021-09-20
| |
* | Merge pull request #4501 from tredondo/patch-9Libravatar rusty-snake2021-09-19
|\ \ | |/ |/| Blacklist Exodus wallet
| * Blacklist Exodus walletLibravatar Ted Robertson2021-09-02
| |
* | Rework pipewire/waylandLibravatar rusty-snake2021-09-07
| | | | | | | | | | | | | | | | | | | | | | - closes #4483 -- mpv requires whitelisting /usr/share/pipewire - wruc: whitelist pipewire-?, pipewire is becoming more popular and was developed with isolation (container/sandbox) in mind. - wruc: whitelist wayland-? instead of only -0 and -1 - wusc: whitelist /usr/share/pipewire - remove these wruc/wusc lines from other profiles - firefox-common-addons: Make ignore wruc work again (#4512) - firefox: org.freedesktop.portal.Desktop should be enough
* | Blacklist ~/.minisign in disable-commonLibravatar rusty-snake2021-09-07
| |
* | Profile fixesLibravatar rusty-snake2021-09-04
| | | | | | | | | | | | | | | | | | | | - disable-programs.inc: blacklist ${HOME}/.local/state/pipewire If you did not yet noticed, on 08th May 2021 the XDG Base Directory Specification 0.8 was resleased (the first update since 2010). New are $XDG_STATE_HOME and $HOME/.local/bin. - keepassxc: mkdirs are necessary - gnote: harden - pngquant: harden
* | Update wrc for Arch Linux (#4507)Libravatar Martynas Janonis2021-09-03
| | | | | | This is a quick fix of #4482 for distributions that link /etc/resolv.conf to /run/systemd/resolve/stub-resolv.conf (Arch Linux is one of them).
* | Update wrcLibravatar rusty-snake2021-09-03
|/ | | | | | - whitelist /run/resolvconf/resolv.conf -- Fixes #4482 - Drop whitelist for /run/systemd/resolve/stub-resolv.conf, /run/systemd/resolve/resolv.conf is the right path AIUI.
* Merge pull request #4486 from pirate486743186/yt-dlp-profileLibravatar netblue302021-08-30
|\ | | | | create yt-dlp.profile
| * create yt-dlp.profileLibravatar pirate4867431862021-08-27
| |
* | creating gallery-dl.profileLibravatar pirate4867431862021-08-27
|/
* Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | | (#4461) See #4454
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-22 21:52:33 +0000