aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-a-l/chromium-common.profile
Commit message (Collapse)AuthorAge
* create blink-common.profileLibravatar pirate4867431862023-03-16
|
* minor clarify userns comments (#5686)Libravatar pirate4867431862023-02-26
| | | Co-authored-by: pirate486743186 <>
* Remove shell none from profilesLibravatar rusty-snake2022-06-19
| | | | | | | | | | | | | | | | | | | | | | | Command: sed -i "/^shell none/d" etc/*/* TODO: ``` etc/profile-a-l/beaker.profile:ignore shell none etc/profile-a-l/default.profile:# shell none etc/profile-a-l/fdns.profile:#shell none etc/profile-a-l/gnome-nettool.profile:#shell none etc/profile-a-l/jitsi-meet-desktop.profile:ignore shell none etc/profile-m-z/pidgin.profile:# shell none etc/profile-m-z/rocketchat.profile:ignore shell none etc/profile-m-z/server.profile:# shell none etc/templates/profile.template:# OPTIONS (caps*, net*, no*, protocol, seccomp*, shell none, tracelog) etc/templates/profile.template:#shell none ``` - manpage - RELNOTES - fbuilder
* blacklist wget2 in chromium-common.profileLibravatar glitsj162022-01-13
|
* ordering fixesLibravatar glitsj162022-01-06
|
* profiles: allow extensions directories in chromium-common profileLibravatar Reiner Herrmann2022-01-06
|
* disable curl and wget in browsers based on firefox and chromiumLibravatar netblue302021-12-18
|
* disable-common.inc: disable chrome-sandboxLibravatar netblue302021-11-09
|
* Rework pipewire/waylandLibravatar rusty-snake2021-09-07
| | | | | | | | | | | - closes #4483 -- mpv requires whitelisting /usr/share/pipewire - wruc: whitelist pipewire-?, pipewire is becoming more popular and was developed with isolation (container/sandbox) in mind. - wruc: whitelist wayland-? instead of only -0 and -1 - wusc: whitelist /usr/share/pipewire - remove these wruc/wusc lines from other profiles - firefox-common-addons: Make ignore wruc work again (#4512) - firefox: org.freedesktop.portal.Desktop should be enough
* Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | follow up
* Add wru to firefox-common, chromium-common and profile.templateLibravatar rusty-snake2021-08-04
| | | | | | | Still unresolved: > If someone who use systemd-resolved can say more which resolv.conf is necessary on such system. > whitelist /run/systemd/resolve/resolv.conf > whitelist /run/systemd/resolve/stub-resolv.conf
* Revert "move whitelist/blacklist to allow/deny"Libravatar Kelvin M. Klann2021-07-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fe0f975f447d59977d90c3226cc8c623b31b20b3. Note: This only reverts the changes from etc. The 4 aliases introduced on commit 45f2ba544 are mere, well, aliases. That is, they fail to address the different usability problems discussed on [#3447][3447] and in fact only make things more confusing (as has already been mentioned on [this][4379] and later comments). The main reason is that the aliases do not meaningfully map to the original commands. For example, the commands from each pair below seem like they would do the exact same thing: * `allow` and `nodeny` * `deny` and `noallow` Additionally, if these aliases are not the final commands, but only a test/work-in-progress, then keeping the wide-scale search/replace changes made on commit fe0f975f4 would only serve to cause confusion, as users of firejail-git, contributors and downstream projects might start changing the commands used on their profiles, only to later have to change them again, potentially to completely different commands. The sooner this is undone the better, as (besides the above reasons) the more profile changes there are between the original commit and the revert, the harder it is to e.g.: `git diff` versions of files across the following revision ranges: before the commit, after the commit but before the revert and after the revert. Note: This is still the case even if a commit is [ignored by `git blame`][4390]. So let us revert fe0f975f4 and only reapply similar large-scale changes once we have discussed and settled on better commands. How the revert was applied: Despite using the auto-generated message from `git revert`, to ensure correctness and to avoid conflicts the changes were reverted in different steps: Firstly, revert the files which can be safely reverted directly ("filestorevert"): # Find out which files have been changed on fe0f975f44, but have not # been changed afterwards and list them on "filestorevert" git show --pretty='' --name-only fe0f975f44 -- etc | LC_ALL=C sort >allfiles git diff --name-only fe0f975f44..master -- etc | LC_ALL=C sort >filestoignore comm -2 -3 allfiles filestoignore >filestorevert # Note: There are 3 extra files on filestoignore because they were # added after commit fe0f975f44 wc -l allfiles filestoignore filestorevert | head -n 3 # 797 allfiles # 8 filestoignore # 792 filestorevert # Automatically revert files in "filestorevert" # See https://stackoverflow.com/a/23401018/10095231 tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975f44 -- | git apply --reverse printf 'Total files reverted:\n' git diff --name-only | wc -l # 792 Secondly, do some search/replace on the rest: tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \ -e 's/allow /whitelist /' -e 's/noallow /nowhitelist /' \ -e 's/deny /blacklist /' -e 's/nodeny /noblacklist /' \ -e 's/deny-nolog /blacklist-nolog /' find etc -name '*.bak' -print0 | xargs -0 rm Thirdly, verify the result. The following command shows the difference between all the changes in etc from before fe0f975f44 and this commit (inclusive): git diff fe0f975f44~1 -- etc From the output, it looks like all alias changes are fully reverted and that the other changes to etc (from after fe0f975f44) remain, so the revert seems to be done correctly. [3447]: https://github.com/netblue30/firejail/issues/3447 [4379]: https://github.com/netblue30/firejail/issues/4379#issuecomment-876460222 [4390]: https://github.com/netblue30/firejail/issues/4390
* move whitelist/blacklist to allow/denyLibravatar netblue302021-07-05
|
* Address #3872 with changes in pipewire for Firefox and ChromiumLibravatar Alex Leahu2021-06-22
|
* Add noinput to browsers as wellLibravatar rusty-snake2021-05-13
| | | | Profiles with private-dev behind BROWSER_DISABLE_U2F were missed by 0cee0ba5.
* Improve hints for allowing browser access to Gnome extensions connectorLibravatar Jose Riha2021-04-16
| | | | Fixes #4177.
* Encourage making overrides in *.local files (#4165)Libravatar glitsj162021-04-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments * refactor local override comments
* fix hardening commentLibravatar rusty-snake2021-03-24
| | | | [skip ci]
* rename chromium-common-hardened.incLibravatar glitsj162021-03-02
|
* Update etc/profile-a-l/chromium-common.profileLibravatar Albin Kauffmann2021-02-09
| | | Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
* Add a comment to some profiles to allow screen sharingLibravatar Albin Kauffmann2021-02-09
| | | | | | | | This configuration is to be applied in order to get screen sharing working under Wayland (via pipewire and a xdg-desktop-portal backend). Note that {chrome|chromium} does not need the dbus filters (at least as of today) because dbus filtering is not enabled (dbus-user not set to none).
* move whlist /usr/share/chromium from chomium-comm…Libravatar rusty-snake2020-12-21
| | | | | | | | …on to chromium, remove the nowhlist from min and its whlist from riot-web. TODO: remove the 'ignore whitelist /usr/share/chomium' from the most profiles with it.
* rework chromium (#3688)Libravatar rusty-snake2020-11-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * rework chromium + 516d0811 has removed fundamental security features. (remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add caps.keep) Though this is only necessary if running under a kernel which disallow unprivileged userns clones. Arch's linux-hardened and debian kernel are patched accordingly. Arch's linux and linux-lts kernels support this restriction via sysctk (kernel.unprivileged_userns_clone=0) as users opt-in. Other kernels such as mainline or fedora/redhat always support unprivileged userns clone and have no sysctl parameter to disable it. Debian and Arch users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'. This commit adds a chromium-common-hardened.inc which can be included in chromium-common to enhance security of chromium-based programs. + chromium-common.profile: add private-cache + chromium-common.profile: add wruc and wusc, but disable it for the following profiles until tested. tests welcome. - [ ] bnox, dnox, enox, inox, snox - [ ] brave - [ ] flashpeak-slimjet - [ ] google-chrome, google-chrome-beta, google-chrome-unstable - [ ] iridium - [ ] min - [ ] opera, opera-beta + move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi. /usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can be vivaldi-stable, vivaldi-beta or vivaldi-snapshot. vivaldi-snapshot.profile missed also some features from vivaldi.profile, solve this by making it redirect to vivaldi.profile. TODO: exist new paths such as .local/lib/vivaldi also for vivaldi-snapshot? + create chromium-browser-privacy.profile (closes #3633) * update 1 + add missing 'ignore whitelist /usr/share/chromium' + revert 'Move drm-relaktions in vivaldi.profile behind BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such as AAC too. In addition vivaldi shows a something is broken pop-up, we would have a lot of 'does not work with firejail' issues. * update 2 * update 3 fixes #3709
* Follow-up for #3326 (#3397)Libravatar glitsj162020-05-04
| | | | | | | | | | | * use the new dbus format in chromium-common.profile * use new dbus format in firejail.config Now that #3326 landed I think it might be less confusing to keep using the --nodbus wording. Couldn't come up with a better alternative (yet), so this might need future improvements. * block dbus system bus Blocking the system bus shouldn't affect password functionality etc, as that uses the session bus.
* reorganize github etc directoryLibravatar netblue302020-04-21
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-18 10:46:24 +0000