aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-a-l
Commit message (Collapse)AuthorAge
...
* | Merge pull request #4587 from kmk3/fix-vscodiumLibravatar netblue302021-10-09
|\ \ | | | | | | Fix vscodium
| * | Add codium.profile as a redirect to vscodium.profileLibravatar Kelvin M. Klann2021-10-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both base names are valid: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 $ pacman -Qlq vscodium-bin | grep -v -e '/$' -e /resources/ | grep /bin/ /usr/bin/codium /usr/bin/vscodium /usr/share/vscodium-bin/bin/codium Note: The first two paths are symlinks to the third one. Fixes #3871.
* | | Merge pull request #4519 from rusty-snake/build-systemsLibravatar netblue302021-10-09
|\ \ \ | | | | | | | | Add profiles for build-systems (/package-managers)
| * | | Drop private-bin from build-systemsLibravatar rusty-snake2021-09-11
| | | |
| * | | build-systems-common: Make whitelist opt-inLibravatar rusty-snake2021-09-11
| | | |
| * | | Add profiles for build-systems (/package-managers)Libravatar rusty-snake2021-09-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Profiles: bunler, cargo (refactor), cmake (untested), make, meson, pip All redirect to build-systems-common.profile Other fixes: - blacklist ${HOME}/.bundle - blacklist ${HOME}/.cargo/* -> blacklist ${HOME}/.cargo - blacklist /usr/lib64/ruby
* | | | Merge pull request #4371 from chrpinedo/patch-1Libravatar smitsohu2021-10-05
|\ \ \ \ | |_|/ / |/| | | Correct amule.profile for upnp
| * | | Comment to use UPnP with amule.profileLibravatar Christian Pinedo2021-10-02
| | | | | | | | | | | | | | | | In order UPnP to work netlink protocol must be enabled.
* | | | Profile fixes and hardeningLibravatar rusty-snake2021-09-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * cheese - fix: dbus-user.own org.gnome.Cheese - fix: whitelist /usr/share/gstreamer-1.0 - fix: include allow-python3.inc - hardening: include disable-shell.inc - hardening: include whitelist-run-common.inc and whitelist /run/udev/data - hardening: whitelist /usr/libexec/gstreamer-1.0/gst-plugin-scanner - hardening: noinput - hardening: nosound - hardening: seccomp.block-secondary - hardening: private-dev * geekbench (closes #4576) - fix: noblacklist /sbin and noblacklist /usr/sbin - fix: noblacklist, blacklist, mkdir, whitelist, read-write ${HOME}/.geekbench5 - fix: comment/remove private-bin, private-lib, private-opt * inkscape - add quiet for cli usage * musixmatch (#4518) - allow chroot * pandoc - fix: include allow-bin-sh.inc - fix: drop private-bin - hardening: include whitelist-runuser-common.inc - hardening: seccomp.block-secondary
* | | | trim excess whitespaceLibravatar a13460542021-09-25
| | | |
* | | | Merge pull request #4559 from rusty-snake/private-etc_ld.so.preloadLibravatar netblue302021-09-24
|\ \ \ \ | | | | | | | | | | Add ld.so.preload to all private-etc lines
| * | | | Add ld.so.preload to all private-etc linesLibravatar rusty-snake2021-09-18
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | Command: sed -i -E "s/^private-etc /private-etc ld.so.preload,/" \ $(grep -LE "^private-etc .*ld.so.preload" etc/profile-*/*) \ && python3 contrib/sort.py etc/profile-*/*
* | | | Merge pull request #4564 from lecso7/masterLibravatar netblue302021-09-24
|\ \ \ \ | | | | | | | | | | Create goldendict.profile
| * | | | Create goldendict.profileLibravatar lecso72021-09-20
| | | | |
* | | | | Merge pull request #4572 from a1346054/newline-fixLibravatar netblue302021-09-24
|\ \ \ \ \ | | | | | | | | | | | | Add missing final newlines
| * | | | | add missing final newlines at end of filesLibravatar a13460542021-09-22
| |/ / / /
* / / / / fix spelling (#4573)Libravatar a13460542021-09-22
|/ / / /
* | | | Let programs outside librewolf sandbox open new tabs in librewolf (#4546)Libravatar crocket2021-09-19
| | | |
* | | | Fix #4555 - Allow evince to read .cbz file formatLibravatar lecso72021-09-19
|/ / / | | | | | | | | | | | | Enable evince to display archived images (.cbz) file with plugin installed.
* | | Merge pull request #4493 from pirate486743186/fix-duplicate-globalLibravatar rusty-snake2021-09-08
|\ \ \ | | | | | | | | fix duplicate globals
| * | | fix duplicate globalLibravatar pirate4867431862021-08-30
| | | |
* | | | Fix #4367 -- gimp 2.10.22-3: gegl:introspect brokenLibravatar rusty-snake2021-09-08
| | | |
* | | | Rework pipewire/waylandLibravatar rusty-snake2021-09-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - closes #4483 -- mpv requires whitelisting /usr/share/pipewire - wruc: whitelist pipewire-?, pipewire is becoming more popular and was developed with isolation (container/sandbox) in mind. - wruc: whitelist wayland-? instead of only -0 and -1 - wusc: whitelist /usr/share/pipewire - remove these wruc/wusc lines from other profiles - firefox-common-addons: Make ignore wruc work again (#4512) - firefox: org.freedesktop.portal.Desktop should be enough
* | | | Profile fixesLibravatar rusty-snake2021-09-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - disable-programs.inc: blacklist ${HOME}/.local/state/pipewire If you did not yet noticed, on 08th May 2021 the XDG Base Directory Specification 0.8 was resleased (the first update since 2010). New are $XDG_STATE_HOME and $HOME/.local/bin. - keepassxc: mkdirs are necessary - gnote: harden - pngquant: harden
* | | | Fix #4506 -- Freetube does not startLibravatar rusty-snake2021-09-03
|/ / / | | | | | | | | | Freetube from AUR uses a wrapper script
* | | creating gallery-dl.profileLibravatar pirate4867431862021-08-27
| | |
* | | Update celluloid.profileLibravatar rusty-snake2021-08-16
| | | | | | | | | | | | Fix #4469
* | | Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | | | | | | | | | follow up
* | | Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | | | | | | | | | | | | (#4461) See #4454
* | | Update keepassxc.profileLibravatar rusty-snake2021-08-09
| | | | | | | | | | | | | | | | | | | | | - Add whitelist-run-common.inc - Drop netlink (there are no error or borken feature for me (including auto-type)) - Second update for the dbus-policy
* | | Correct directory for sway.profile and io.github.lainsce.Notejot.profileLibravatar rusty-snake2021-08-09
| | |
* | | Revice keepassxc's dbus policyLibravatar rusty-snake2021-08-05
| | |
* | | Add wru to firefox-common, chromium-common and profile.templateLibravatar rusty-snake2021-08-04
| | | | | | | | | | | | | | | | | | | | | Still unresolved: > If someone who use systemd-resolved can say more which resolv.conf is necessary on such system. > whitelist /run/systemd/resolve/resolv.conf > whitelist /run/systemd/resolve/stub-resolv.conf
* | | Profile fixesLibravatar rusty-snake2021-08-04
| |/ |/| | | | | | | | | | | | | | | | | - Fix #4157 -- [Feature] Should rmenv GitHub auth tokens There are still more token variables from other program that should be added. - Fix #4093 -- darktable needs read access to liblua* - Fix #4383 -- move noblacklist ${HOME}/.bogofilter to email-common.profile for claws-mail (and other mailers) - Fix xournalpp.profile - syscalls.txt: ausyscall i386 -> firejail --debug-syscalls32
* | Add electron[0-9]{0,2} to all electron redirect …Libravatar rusty-snake2021-08-01
| | | | | | | | …profiles with private-bin
* | Fixup: Fix Firefox 'Profile not found' - whitelist /run/user/xxx/firefoxLibravatar rusty-snake2021-07-28
| |
* | Merge branch 'master' of https://github.com/netblue30/firejailLibravatar Fred Barclay2021-07-28
|\ \
| * \ Merge branch 'master' into masterLibravatar netblue302021-07-28
| |\ \
| * | | moved rules from firefox-common.profile to firefox.profileLibravatar 0x6a2021-07-20
| | | |
| * | | Blacklist /*firefox* except for firefox itselfLibravatar 0x6a2021-07-20
| | | |
| * | | Fix Firefox 'Profile not found' - whitelist /run/user/xxx/firefoxLibravatar 0x6a2021-07-17
| | | |
* | | | Revert allow/deny additional filesLibravatar Fred Barclay2021-07-28
| |/ / |/| | | | | | | | | | | See #4410 8b50039a1fad123b90172fadc85bc232e97eb6d1
* | | kodi.profile: Add Lutris Kodi Addon noteLibravatar rusty-snake2021-07-28
| | | | | | | | | | | | | | | | | | | | | Closes #3785 -- Allowing calling specific apps outside the sandbox or with a different firejail profile The idea isn't worng but should be reweiten in a seperate issue without all the kodi/lutris clutter.
* | | Refactor code.profile as electron redirectLibravatar rusty-snake2021-07-28
| | | | | | | | | | | | closes #4408
* | | kcmp is allowed by default, no need to add seccomp exceptions for it anylongerLibravatar rusty-snake2021-07-28
| | |
* | | Merge branch 'master' into revert-allow-deny-etcLibravatar netblue302021-07-25
|\ \ \
| * | | new profilesLibravatar rusty-snake2021-07-20
| | | |
| * | | Update avidemux.profileLibravatar Neo000012021-07-20
| |/ /
* / / Revert "move whitelist/blacklist to allow/deny"Libravatar Kelvin M. Klann2021-07-18
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fe0f975f447d59977d90c3226cc8c623b31b20b3. Note: This only reverts the changes from etc. The 4 aliases introduced on commit 45f2ba544 are mere, well, aliases. That is, they fail to address the different usability problems discussed on [#3447][3447] and in fact only make things more confusing (as has already been mentioned on [this][4379] and later comments). The main reason is that the aliases do not meaningfully map to the original commands. For example, the commands from each pair below seem like they would do the exact same thing: * `allow` and `nodeny` * `deny` and `noallow` Additionally, if these aliases are not the final commands, but only a test/work-in-progress, then keeping the wide-scale search/replace changes made on commit fe0f975f4 would only serve to cause confusion, as users of firejail-git, contributors and downstream projects might start changing the commands used on their profiles, only to later have to change them again, potentially to completely different commands. The sooner this is undone the better, as (besides the above reasons) the more profile changes there are between the original commit and the revert, the harder it is to e.g.: `git diff` versions of files across the following revision ranges: before the commit, after the commit but before the revert and after the revert. Note: This is still the case even if a commit is [ignored by `git blame`][4390]. So let us revert fe0f975f4 and only reapply similar large-scale changes once we have discussed and settled on better commands. How the revert was applied: Despite using the auto-generated message from `git revert`, to ensure correctness and to avoid conflicts the changes were reverted in different steps: Firstly, revert the files which can be safely reverted directly ("filestorevert"): # Find out which files have been changed on fe0f975f44, but have not # been changed afterwards and list them on "filestorevert" git show --pretty='' --name-only fe0f975f44 -- etc | LC_ALL=C sort >allfiles git diff --name-only fe0f975f44..master -- etc | LC_ALL=C sort >filestoignore comm -2 -3 allfiles filestoignore >filestorevert # Note: There are 3 extra files on filestoignore because they were # added after commit fe0f975f44 wc -l allfiles filestoignore filestorevert | head -n 3 # 797 allfiles # 8 filestoignore # 792 filestorevert # Automatically revert files in "filestorevert" # See https://stackoverflow.com/a/23401018/10095231 tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975f44 -- | git apply --reverse printf 'Total files reverted:\n' git diff --name-only | wc -l # 792 Secondly, do some search/replace on the rest: tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \ -e 's/allow /whitelist /' -e 's/noallow /nowhitelist /' \ -e 's/deny /blacklist /' -e 's/nodeny /noblacklist /' \ -e 's/deny-nolog /blacklist-nolog /' find etc -name '*.bak' -print0 | xargs -0 rm Thirdly, verify the result. The following command shows the difference between all the changes in etc from before fe0f975f44 and this commit (inclusive): git diff fe0f975f44~1 -- etc From the output, it looks like all alias changes are fully reverted and that the other changes to etc (from after fe0f975f44) remain, so the revert seems to be done correctly. [3447]: https://github.com/netblue30/firejail/issues/3447 [4379]: https://github.com/netblue30/firejail/issues/4379#issuecomment-876460222 [4390]: https://github.com/netblue30/firejail/issues/4390
* | Fix #4396 -- tracelog causes anki to segfaultLibravatar rusty-snake2021-07-11
| |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-19 13:35:03 +0000