| Commit message (Collapse) | Author | Age |
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The profile currently does not include disable-common nor makes
`${HOME}` read-only, so the program can simply write to ~/.bashrc
directly[1].
disable-common.inc was commented due to it apparently breaking bwrap.
As discovered by @glitsj16, it seems that allowing the bwrap binary is
enough to make it work (and that apparmor breaks loupe)[2].
So disable apparmor, allow bwrap and include disable-common.inc, plus
other hardening by @glitsj16.
This amends commit 9a0db13e1 ("profiles: add loupe", 2024-04-30) /
PR #6327.
[1] https://github.com/netblue30/firejail/pull/6327#pullrequestreview-2033860865
[2] https://github.com/netblue30/firejail/pull/6333#issuecomment-2099805480
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* profiles: hexchat: hardenings
* profiles: hexchat: allow lua/downloads and harden
Allow more paths and add some extra options to harden the profile.
We allow Perl but keep it out of private-bin. Do the same for Lua and
clarify in the private-bin comment how to enable these interpreters.
Consulted resources:
- https://github.com/hexchat/hexchat/
- https://hexchat.readthedocs.io/
|
|
|
|
|
|
|
|
|
|
|
| |
Description: D-Bus debugger for GNOME
https://gitlab.gnome.org/GNOME/d-spy
From [1]:
> D-Feet is no longer maintained. Please use d-spy
[1] https://wiki.gnome.org/Apps/DFeet
|
|
|
|
| |
Signed-off-by: Tavi <tavi@divested.dev>
|
|
|
|
|
|
|
|
| |
Fix sorting and improve comments.
See etc/templates/profile.template.
This amends commit 4c5f55899 ("several kids programs", 2024-04-29).
|
| |
|
|
|
|
| |
(#6322)
|
|
|
|
|
|
|
| |
Newly-released audacity 3.5 supports cloud-saving and remote backup
features:
- https://www.audacityteam.org/blog/audacity-3-5/
- https://support.audacityteam.org/additional-resources/changelog/audacity-3.5#cloud-project-saving
|
|
|
| |
https://github.com/axel-download-accelerator/axel
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
To make it consistent with the other include profiles.
See etc/templates/profile.template.
With this, all `etc/inc/allow-*` files are listed in profile.template.
The explanation is based on a comment by @rusty-snake[1].
Relates to #4071.
This is a follow-up to #6299.
[1] https://github.com/netblue30/firejail/pull/4071#issuecomment-822003473
|
|
|
|
|
| |
Description: GitHub's official command-line tool.
https://github.com/cli/cli
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
That is, make "X11" lowercase so that the order of the includes in the
disable- section remain the same when sorted with `LC_ALL=C`, as is the
case for most of the other sections. That is also likely to be the
default in text editors (such as in vim on Arch), so this should make
the disable- section more consistent and easier to sort when editing the
profile.
Also, keep the old include as a redirect to the new one for now to avoid
breakage.
Commands used to search and replace:
git mv etc/inc/disable-X11.inc etc/inc/disable-x11.inc
git grep -Ilz 'disable-X11' -- etc | xargs -0 \
perl -pi -e 's/disable-X11/disable-x11/'
Relates to #4462 #4854 #6070 #6289.
This is a follow-up to #6286.
|
|
|
|
|
| |
See etc/templates/profile.template.
This is a follow-up to #6286.
|
|
|
|
|
|
|
| |
I recently set up KDE connect and plasma-browser-integration for firefox
(Linux Mint 21.2) and needed this line in addition to the ones mentioned
in the profile. Found it via running `firejail
--profile=/etc/firejail/firefox.profile --dbus-user.log firefox`, trying
to send links to device, and seeing what events get logged.
|
|\
| |
| | |
profiles: replace x11 socket blacklist with disable-X11.inc
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Replace all occurrences of `blacklist /tmp/.X11-unix` with
`include disable-X11.inc`, which blacklists more X11-related files.
Commands used to search and replace:
$ git grep -Ilz '^blacklist /tmp/.X11-unix' -- \
etc/profile*/*.profile | xargs -0 perl -0 -pi -e '\
s/\nblacklist \/tmp\/.X11-unix\n/\n/; \
s/(\ninclude disable-xdg.inc\n)/\ninclude disable-X11.inc$1/; \
s/(\ninclude disable-[^Xx\n]+\n)(\n|# )/$1include disable-X11.inc\n$2/'
Note: The following files were also edited manually:
* etc/profile-a-l/erd.profile
* etc/profile-a-l/links-common.profile
* etc/profile-m-z/termshark.profile
* etc/profile-m-z/tmux.profile
* etc/profile-m-z/tshark.profile
Relates to #4462 #4854.
|
|/
|
|
|
|
|
|
|
|
| |
The files in this directory are intended to be automatically executed
when the user logs in.
In which case, granting write access to this directory allows the
program to easily escape the sandbox (by autostarting itself outside of
firejail, for example).
Misc: This was noticed on #6244.
|
|
|
|
|
|
|
|
|
|
| |
It is a GUI program.
It was apparently added by accident on commit 73321c597 ("Fixes
(#2816)", 2019-07-01).
Reported by @glitsj16 at
https://github.com/netblue30/firejail/pull/6286#discussion_r1536618241
|
|
|
|
|
|
|
|
|
|
| |
@hedgehog29 commented[1]:
> It prevents k3b from detecting all dvd drives, incudling USB ones, and
> it seems that also SATA.
Fixes #6279.
[1] https://github.com/netblue30/firejail/issues/6279#issue-2191392448
|
|
|
|
|
| |
Description: An open source cross-platform alternative to AirDrop.
https://github.com/localsend/localsend
|
|
|
|
|
|
|
| |
Description: Plain tool to validate and compare .editorconfig files.
https://github.com/aegoroff/editorconfiger
https://aur.archlinux.org/packages/editorconfiger
https://aur.archlinux.org/packages/editorconfiger-bin
|
|
|
|
|
| |
Description: Ebook reader application.
https://koreader.rocks/
|
|
|
|
|
|
| |
Description: CLI encryption tool
https://github.com/brxken128/dexios
https://aur.archlinux.org/packages/dexios-bin
|
|
|
|
|
|
| |
Description: Checks and fixes URLs in code and documentation.
https://github.com/nschloe/deadlink
https://aur.archlinux.org/packages/deadlink
|
|
|
|
|
|
|
|
| |
Description: A CLI tool to download specific GitHub directories or
files.
https://github.com/alok8bb/cloneit
https://aur.archlinux.org/packages/cloneit-git
|
|
|
|
|
|
| |
Description: A multi-threaded GTK application to fetch lyrics of
currently playing songs.
https://gitlab.com/bartwillems/lyriek
|
|
|
|
|
|
|
|
|
|
| |
Description: Multi-threaded file-tree visualizer and disk usage
analyzer.
https://github.com/solidiquis/erdtree
https://archlinux.org/packages/extra/x86_64/erdtree/
Note: The repo and package are called `erdtree`, but the executable is
`erd`.
|
|
|
|
|
|
|
|
| |
Description: Dynamic real-time view of running eBPF programs.
https://github.com/Netflix/bpftop
https://aur.archlinux.org/packages/bpftop
https://aur.archlinux.org/packages/bpftop-bin
https://aur.archlinux.org/packages/bpftop-git
|
|\
| |
| | |
build: sort.py: filter empty and duplicate items
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Note: This seems to already be done for `protocol` lines.
Before:
$ ./contrib/sort.py test.profile
sort.py: checking 1 profile(s)...
test.profile:1:-private-etc ,,bar,,foo,,bar,,,
test.profile:1:+private-etc ,,,,,,,bar,bar,foo
test.profile:2:-protocol ,,unix,,bluetooth,,unix,,inet,,,
test.profile:2:+protocol unix,inet,bluetooth
[ Fixed ] test.profile
After:
$ ./contrib/sort.py test.profile
sort.py: checking 1 profile(s)...
test.profile:1:-private-etc ,,bar,,foo,,bar,,,
test.profile:1:+private-etc bar,foo
test.profile:2:-protocol ,,unix,,bluetooth,,unix,,inet,,,
test.profile:2:+protocol unix,inet,bluetooth
[ Fixed ] test.profile
|
| |
| |
| |
| |
| |
| |
| | |
Simple screen recorder for Linux desktop, supports Wayland & Xorg.
https://github.com/dvershinin/green-recorder
https://aur.archlinux.org/packages/green-recorder
https://aur.archlinux.org/packages/green-recorder-git
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
mkinitcpio (used to generate initramfs images) supports several
compression formats:
https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/blob/master/mkinitcpio.conf#L54-L64.
On Arch Linux (based distributions) at least this implies the supported
archivers to have access to mkinitcpio-related files under /etc.
This was no problem before 29da82d added `private-etc` to
`archivers-common.profile`.
This adds the now needed extra private-etc items to
archiver-common.profile, for mkinitcpio's supported compressors (which
seem to be at least cpio, gzip and zstd).
Relates to #5610.
|
| |
| |
| |
| |
| |
| |
| |
| | |
Commit 29da82d added `private-etc` to `archiver-common.profile`.
To avoid doubled options this PR removes it from archiver profiles which
already had it.
Relates to #5610.
|
| | |
|
| | |
|
| | |
|
|/ |
|
|\
| |
| | |
Profile for Ledger Live desktop app
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
/opt/ledger-live installation currently sits at 345 MiB, so I decided to
whitelist it instead of using private-opt ledger-live, in case future
installations grow in size.
Not using private-dev was the only way I managed to get my USB wallet to
work.
|
|/ |
|
|
|
|
| |
Drop paths present in etc/inc/whitelist-usr-share-common.inc from
profiles that include it.
|
| |
|
|\
| |
| | |
Profile for Electron Cash
|
| | |
|
|\ \
| | |
| | | |
gnome-keyring: harden and add gnome-keyring-daemon.profile
|
| | |
| | |
| | |
| | | |
And use it as the base for the existing gnome-keyring.profile.
|
| | | |
|
|/ / |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Recent versions of geeqie[1] use a Lua interpreter, like the one
currently in Arch Linux (2.2).
Without this fix it fails with:
/usr/bin/geeqie: error while loading shared libraries: liblua.so.5.4: [...]
[1] https://www.geeqie.org/
|