aboutsummaryrefslogtreecommitdiffstats
path: root/etc/inc
Commit message (Collapse)AuthorAge
...
* disable-common.inc: vmware SUID binariesLibravatar netblue302021-11-09
|
* disable-common.inc: disable chrome-sandboxLibravatar netblue302021-11-09
|
* disable-common.inc: blacklist sshLibravatar netblue302021-11-09
|
* adding more SUID executables to disable-common.incLibravatar netblue302021-11-04
|
* Sort disaple-programs.incLibravatar rusty-snake2021-10-27
|
* wrc: whitelist journal socketsLibravatar smitsohu2021-10-23
| | | | fixes --tracelog among other things
* promote /run/udev/data to wrcLibravatar smitsohu2021-10-23
|
* disable-exec: add /run/shmLibravatar smitsohu2021-10-23
|
* Merge pull request #4521 from rusty-snake/disable-proc.incLibravatar smitsohu2021-10-20
|\ | | | | Create disable-proc.inc
| * Update disable-proc.incLibravatar rusty-snake2021-10-09
| |
| * Update disable-proc.incLibravatar rusty-snake2021-09-10
| |
| * Create disable-proc.incLibravatar rusty-snake2021-09-09
| |
* | add /run/shm to wrcLibravatar smitsohu2021-10-16
| | | | | | | | | | | | | | | | found in Debian Bullseye. /run/shm is a symbolic link to /dev/shm, and whitelisting it will just recreate the symbolic link.
* | Merge pull request #4587 from kmk3/fix-vscodiumLibravatar netblue302021-10-09
|\ \ | | | | | | Fix vscodium
| * | vscodium.profile: add missing pathsLibravatar Kelvin M. Klann2021-10-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It creates the following directories on startup: * ~/.config/VSCodium * ~/.vscode-oss Environment: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 Note: The following entry is already on disable-programs.inc: noblacklist ${HOME}/.vscode-oss It was added on commit de90834a8 ("Update disable-programs.inc", 2019-03-02). Relates to #3871.
* | | Merge pull request #4519 from rusty-snake/build-systemsLibravatar netblue302021-10-09
|\ \ \ | |/ / |/| | Add profiles for build-systems (/package-managers)
| * | Add profiles for build-systems (/package-managers)Libravatar rusty-snake2021-09-08
| |/ | | | | | | | | | | | | | | | | | | Profiles: bunler, cargo (refactor), cmake (untested), make, meson, pip All redirect to build-systems-common.profile Other fixes: - blacklist ${HOME}/.bundle - blacklist ${HOME}/.cargo/* -> blacklist ${HOME}/.cargo - blacklist /usr/lib64/ruby
* | Profile fixes and hardeningLibravatar rusty-snake2021-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * cheese - fix: dbus-user.own org.gnome.Cheese - fix: whitelist /usr/share/gstreamer-1.0 - fix: include allow-python3.inc - hardening: include disable-shell.inc - hardening: include whitelist-run-common.inc and whitelist /run/udev/data - hardening: whitelist /usr/libexec/gstreamer-1.0/gst-plugin-scanner - hardening: noinput - hardening: nosound - hardening: seccomp.block-secondary - hardening: private-dev * geekbench (closes #4576) - fix: noblacklist /sbin and noblacklist /usr/sbin - fix: noblacklist, blacklist, mkdir, whitelist, read-write ${HOME}/.geekbench5 - fix: comment/remove private-bin, private-lib, private-opt * inkscape - add quiet for cli usage * musixmatch (#4518) - allow chroot * pandoc - fix: include allow-bin-sh.inc - fix: drop private-bin - hardening: include whitelist-runuser-common.inc - hardening: seccomp.block-secondary
* | trim excess whitespaceLibravatar a13460542021-09-25
| |
* | Create goldendict.profileLibravatar lecso72021-09-20
| |
* | Merge pull request #4501 from tredondo/patch-9Libravatar rusty-snake2021-09-19
|\ \ | |/ |/| Blacklist Exodus wallet
| * Blacklist Exodus walletLibravatar Ted Robertson2021-09-02
| |
* | Rework pipewire/waylandLibravatar rusty-snake2021-09-07
| | | | | | | | | | | | | | | | | | | | | | - closes #4483 -- mpv requires whitelisting /usr/share/pipewire - wruc: whitelist pipewire-?, pipewire is becoming more popular and was developed with isolation (container/sandbox) in mind. - wruc: whitelist wayland-? instead of only -0 and -1 - wusc: whitelist /usr/share/pipewire - remove these wruc/wusc lines from other profiles - firefox-common-addons: Make ignore wruc work again (#4512) - firefox: org.freedesktop.portal.Desktop should be enough
* | Blacklist ~/.minisign in disable-commonLibravatar rusty-snake2021-09-07
| |
* | Profile fixesLibravatar rusty-snake2021-09-04
| | | | | | | | | | | | | | | | | | | | - disable-programs.inc: blacklist ${HOME}/.local/state/pipewire If you did not yet noticed, on 08th May 2021 the XDG Base Directory Specification 0.8 was resleased (the first update since 2010). New are $XDG_STATE_HOME and $HOME/.local/bin. - keepassxc: mkdirs are necessary - gnote: harden - pngquant: harden
* | Update wrc for Arch Linux (#4507)Libravatar Martynas Janonis2021-09-03
| | | | | | This is a quick fix of #4482 for distributions that link /etc/resolv.conf to /run/systemd/resolve/stub-resolv.conf (Arch Linux is one of them).
* | Update wrcLibravatar rusty-snake2021-09-03
|/ | | | | | - whitelist /run/resolvconf/resolv.conf -- Fixes #4482 - Drop whitelist for /run/systemd/resolve/stub-resolv.conf, /run/systemd/resolve/resolv.conf is the right path AIUI.
* Merge pull request #4486 from pirate486743186/yt-dlp-profileLibravatar netblue302021-08-30
|\ | | | | create yt-dlp.profile
| * create yt-dlp.profileLibravatar pirate4867431862021-08-27
| |
* | creating gallery-dl.profileLibravatar pirate4867431862021-08-27
|/
* Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | | (#4461) See #4454
* Create disable-X11.inc (#4462)Libravatar rusty-snake2021-08-11
|
* Add /run/media to whitelist-run-common.incLibravatar rusty-snake2021-08-09
|
* Add rmenv RESTIC_* to disable-passwdmgr.incLibravatar rusty-snake2021-08-09
|
* remove cargo registry token for crates.io from environmentLibravatar Reiner Herrmann2021-08-06
|
* Profile fixesLibravatar rusty-snake2021-08-04
| | | | | | | | | | - Fix #4157 -- [Feature] Should rmenv GitHub auth tokens There are still more token variables from other program that should be added. - Fix #4093 -- darktable needs read access to liblua* - Fix #4383 -- move noblacklist ${HOME}/.bogofilter to email-common.profile for claws-mail (and other mailers) - Fix xournalpp.profile - syscalls.txt: ausyscall i386 -> firejail --debug-syscalls32
* Added ~/Private blacklist (#4434)Libravatar caydey2021-08-03
|
* Fixup: Fix Firefox 'Profile not found' - whitelist /run/user/xxx/firefoxLibravatar rusty-snake2021-07-28
|
* Merge pull request #4420 from glitsj16/dciLibravatar netblue302021-07-28
|\ | | | | ordering and additions
| * drop trailing slashes from openrc itemsLibravatar glitsj162021-07-26
| | | | | | As suggested in https://github.com/netblue30/firejail/pull/4420#discussion_r676929867.
| * ordering and additionsLibravatar glitsj162021-07-26
| |
* | Merge branch 'master' into masterLibravatar netblue302021-07-28
|\|
| * Merge branch 'master' into revert-allow-deny-etcLibravatar netblue302021-07-25
| |\
| | * Complete 42a03511d0877690276da83bf548635d7e8ca693Libravatar Fred Barclay2021-07-23
| | | | | | | | | | | | | | | | | | | | | | | | Add ms-edge-beta paths to disable-programs.inc Support firecfg Adding to release notes (already added to README.md)
| | * new profilesLibravatar rusty-snake2021-07-20
| | |
| * | Revert "move whitelist/blacklist to allow/deny"Libravatar Kelvin M. Klann2021-07-18
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fe0f975f447d59977d90c3226cc8c623b31b20b3. Note: This only reverts the changes from etc. The 4 aliases introduced on commit 45f2ba544 are mere, well, aliases. That is, they fail to address the different usability problems discussed on [#3447][3447] and in fact only make things more confusing (as has already been mentioned on [this][4379] and later comments). The main reason is that the aliases do not meaningfully map to the original commands. For example, the commands from each pair below seem like they would do the exact same thing: * `allow` and `nodeny` * `deny` and `noallow` Additionally, if these aliases are not the final commands, but only a test/work-in-progress, then keeping the wide-scale search/replace changes made on commit fe0f975f4 would only serve to cause confusion, as users of firejail-git, contributors and downstream projects might start changing the commands used on their profiles, only to later have to change them again, potentially to completely different commands. The sooner this is undone the better, as (besides the above reasons) the more profile changes there are between the original commit and the revert, the harder it is to e.g.: `git diff` versions of files across the following revision ranges: before the commit, after the commit but before the revert and after the revert. Note: This is still the case even if a commit is [ignored by `git blame`][4390]. So let us revert fe0f975f4 and only reapply similar large-scale changes once we have discussed and settled on better commands. How the revert was applied: Despite using the auto-generated message from `git revert`, to ensure correctness and to avoid conflicts the changes were reverted in different steps: Firstly, revert the files which can be safely reverted directly ("filestorevert"): # Find out which files have been changed on fe0f975f44, but have not # been changed afterwards and list them on "filestorevert" git show --pretty='' --name-only fe0f975f44 -- etc | LC_ALL=C sort >allfiles git diff --name-only fe0f975f44..master -- etc | LC_ALL=C sort >filestoignore comm -2 -3 allfiles filestoignore >filestorevert # Note: There are 3 extra files on filestoignore because they were # added after commit fe0f975f44 wc -l allfiles filestoignore filestorevert | head -n 3 # 797 allfiles # 8 filestoignore # 792 filestorevert # Automatically revert files in "filestorevert" # See https://stackoverflow.com/a/23401018/10095231 tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975f44 -- | git apply --reverse printf 'Total files reverted:\n' git diff --name-only | wc -l # 792 Secondly, do some search/replace on the rest: tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \ -e 's/allow /whitelist /' -e 's/noallow /nowhitelist /' \ -e 's/deny /blacklist /' -e 's/nodeny /noblacklist /' \ -e 's/deny-nolog /blacklist-nolog /' find etc -name '*.bak' -print0 | xargs -0 rm Thirdly, verify the result. The following command shows the difference between all the changes in etc from before fe0f975f44 and this commit (inclusive): git diff fe0f975f44~1 -- etc From the output, it looks like all alias changes are fully reverted and that the other changes to etc (from after fe0f975f44) remain, so the revert seems to be done correctly. [3447]: https://github.com/netblue30/firejail/issues/3447 [4379]: https://github.com/netblue30/firejail/issues/4379#issuecomment-876460222 [4390]: https://github.com/netblue30/firejail/issues/4390
* / Blacklist /*firefox* except for firefox itselfLibravatar 0x6a2021-07-20
|/
* Merge pull request #4288 from rusty-snake/whitelist-run-commonLibravatar rusty-snake2021-07-16
|\ | | | | Create whitelist-run-common.inc
| * wrc: allow cups socketLibravatar rusty-snake2021-07-03
| |
| * Create whitelist-run-common.incLibravatar rusty-snake2021-05-19
| |
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-25 08:27:08 +0000