| Commit message (Collapse) | Author | Age |
|---|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
To disable-shell.inc.
Interactive shells can be executed from certain development-related
programs (such as IDEs) and the shells themselves are not blocked by
default, but this shell startup directory currently is. To avoid
running a shell without access to potentially needed startup files, only
blacklist /etc/profile.d when interactive shells are also blocked.
Note that /etc/profile.d should only be of concern to interactive
shells, so a profile that includes both disable-shell.inc and
allow-bin-sh.inc (which likely means that it needs access to only
non-interactive shells) should not be affected by the blacklisting.
Relates to #3411 #5159.
|
| |
|
|
|
|
|
| |
This amends commit b6b3f3b38 ("kate.profile: allow common development
file access", 2022-05-28) / PR #5159.
See etc/templates/profile.template.
|
| |\
| |
| | |
Kate fixes
|
| | |
| |
| |
| |
| |
| |
| | |
When starting kate and loading into a session containing a git repository, tracelog caused about 30 seconds of delay until the project structure appeared in the projects sidebar. Error message on console:
QProcess: Destroyed while process ("/usr/bin/git") is still running.
Drop tracelog to mitigate the delay and error message.
|
| | |
| |
| |
| |
| |
| | |
When starting Kate, a blacklist violation from accessing the kwinrc config file is reported. As a KDE application, it should be fine for Kate to access it.
blacklist violation - sandbox 13410, name kate, exe kate, syscall access, path /home/user/.config/kwinrc
|
| | |
| |
| |
| |
| |
| |
| |
| | |
A side effect of including disable-common.inc is loosing access to /etc/profile.d, where Bash completion is located.
Explicitly enable access to console scripts in /etc/profile.d, so that Kate's built-in Konsole instance can be used without limitations.
Minor side effect: the spawned Bash tries to access /etc/init.d
blacklist violation - sandbox 17317, name kate, exe bash, syscall stat, path /etc/init.d
|
| | |
| |
| |
| |
| |
| | |
Kate has grown support for software development, making it a light IDE. Some version control modules exist, and when using the Git module, a blacklist violation is reported:
blacklist violation - sandbox 13902, name kate, exe git, syscall access, path /home/user/.gitconfig
Including support for common development file access mitigates this violation issue.
|
| |/ |
|
| |
|
|
|
|
|
|
|
|
|
| |
Without whitelist-usr-share-common, /usr/share becomes empty.
Adding whitelist-runuser-common didn't break google chrome.
Whitelisting /usr/share/mozilla/extensions and
/usr/share/webext shouldn't break google chrome, either.
I tested google-chrome.profile only, but
I think later versions should not be different.
|
| | |
|
| | |
|
| | |
|
| |
|
| |
Add electron-flags.conf for all versions of electron
|
| |
|
|
| |
closes #4965
|
| |
|
|
|
|
|
| |
following up ce6f792efd0af09b95050864b71f79c46359fa49
/var/lib/libvirt is blacklisted in disable-common.inc
so merely whitelisting the directory is not enough
|
| |
|
|
|
| |
private option implies private-cache,
so it is safe to remove
|
| | |
|
| |
|
| |
Fixes #5068.
|
| | |
|
| |
|
|
|
| |
* cmake: fix local override & wusc
* cmake: another wusc fix
|
| |
|
|
|
|
|
|
|
| |
* drop redundant noblacklist
noblacklist ${HOME}/.vscode-oss already exists in included code.profile
* remove newline
Nitpick for persistency with other profiles that have the comment about #2624.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
* geary fixes
* comment ipc-namespace
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
* Add support for changing appearance of the Qt6 apps with qt6ct
* Remove qt5ct artifact from zeal.profile
* Remove qt5ct artifact from bibletime.profile
|
| | |
|
| |
|
|
|
|
| |
0319fbd enabled whitelisting in /usr/share for iridium but wusc
was still ignore causing iridium to crash.
Fixes #4917
|
| |\
| |
| | |
keepassx: restore nou2f
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
I could not find anything to confirm that keepassx supports hardware
keys. And as mentioned by @rusty-snake[1]:
> The yubikey support in kpxc seems to be based on
> https://github.com/kylemanna/keepassx /
> https://github.com/keepassx/keepassx/pull/52
> which was never merged. For me it looks like kpx never got official
> support for it.
>
> keepass seems to support hw keys (via plugin).
Also of note is the PR that added yubikey support to keepassxc:
https://github.com/keepassxreboot/keepassxc/pull/127
This partially reverts commit 09ac1a73e ("keepass*: remove nou2f",
2022-02-05) / PR #4903. See also commit 91b04172b ("keepass*: fix typo
in private-dev note", 2022-02-06).
Closes #4883.
[1] https://github.com/netblue30/firejail/issues/4883#issuecomment-1031172309
|
| |/ |
|
| |
|
|
|
|
|
| |
s/nou2f/private-dev/
This amends commit 8a718ff4a ("keepass*: note that private-dev blocks
access to new hardware keys", 2022-02-05).
|
| |
|
|
|
|
| |
Which may be surprising to some users (see #4883).
Fixes #4883.
|
| |
|
|
|
|
|
| |
At least keepassxc supports U2F and password managers seem like they
would be a common use case for it.
See the discussion on #4883.
|
| | |
|
| |\
| |
| | |
Update librewolf.profile: use new d-bus message bus
|
| | |
| |
| | |
Starting Librewolf 96.0, Librewolf switched from using d-bus org.mozilla.librewolf.* to io.gitlab.librewolf.*
|
| | | |
|
| |/ |
|
| |\
| |
| | |
{lutris,wine}.profile: allow ~/.cache/wine
|
glitsj16
Kelvin M. Klann
netblue30
Hartmut Knaack
crocket
Łukasz Mariański
rusty-snake
smitsohu
Jose Riha
avallach2000
Fred Barclay
Eklektisk