aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-a-l
Commit message (Collapse)AuthorAge
...
* | Merge pull request #3931 from glitsj16/follow-up-3914Libravatar glitsj162021-01-30
|\ \ | | | | | | follow-up fixes for #3914
| * | follow-up fixes for ↵Libravatar glitsj162021-01-29
| | | | | | | | | | | | https://github.com/netblue30/firejail/commit/43aa71f8c608ec5bd92fd2c7323c603fa37f6d30
* | | Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ \ \ | | | | | | | | ssh: Refactor, fix bugs & harden
| * | | etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
| * | | git-cola.profile: add missing python template commentLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | See etc/templates/profile.template.
* | | | Add gfeeds directory for saved articlesLibravatar rusty-snake2021-01-29
| |/ / |/| |
* | | add extensive comment on sandboxing google-earth-pro (#3923)Libravatar glitsj162021-01-28
| | |
* | | streamline 'Allow xxx' comments (#3922)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add comment: allow python * add comment: allow python * reorder allow comments * fix perl allow comment * add comment: allow python * add comment: allow lua, perl & python * reorder allow comments * add comment: allow python * add comment: allow python * add comment: allow lua, perl & python * fix allow comments * add comment: allow python * add comment: allow python * fix spacing in comments * add comment: allow python * add comment: allow python * fix comment * add comment: allow perl & python * add comment: allow lua & python * add comment: allow lua, perl & python * fix allow comments * add comment: allow perl & python * streamline allow python comments
* | | Merge pull request #3853 from botherder/masterLibravatar netblue302021-01-25
|\ \ \ | | | | | | | | New profile for CoyIM
| * | | Added additional whitelistsLibravatar Nex2021-01-06
| | | |
| * | | Implementing some of the suggested changes from #3853Libravatar Nex2020-12-29
| | | |
| * | | Added some more restrictions to coyim profileLibravatar Nex2020-12-29
| | | |
| * | | Added first profile for coyimLibravatar Nex2020-12-29
| | |/ | |/|
* | | Merge pull request #3918 from Neo00001/masterLibravatar netblue302021-01-25
|\ \ \ | | | | | | | | Add profile for kdiff3
| * | | Update kdiff3.profileLibravatar Neo000012021-01-24
| | | |
| * | | Create kdiff3.profileLibravatar Neo000012021-01-24
| | | |
* | | | fix #3914Libravatar netblue302021-01-24
|/ / /
* | | misc comment fixes (#3916)Libravatar glitsj162021-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix comment in blackbox.profile * fix comment in fluxbox.profile * fix comment in i3.profile * fix comment in krunner.profile * fix comment in openbox.profile
* | | refactor google-earth{-pro} (#3915)Libravatar glitsj162021-01-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refactor google-earth{-pro} blacklisting * fix google-earth-pro.profile I've included all binaries found in the Arch Linux AUR package to private-bin. But I also added a note on ignoring private-bin because I'm not sure what google-earth is doing on other distro's. * unbreak google-earth.profile Not sure why we need grep, ls and sed in private-bin exactly but keeping them around wouldn't hurt too much I guess.
* | | Update bibletime.profile, add new whitelist (#3908)Libravatar hhzek00142021-01-22
| | | | | | | | | | | | | | | | | | To solve issue#3907, doc directory of the bibletime has to be whitelisted. Otherwise, it always fails to start. Co-authored-by: hhnb <hhnb@nanenient.cc>
* | | Add profile for guvcviewLibravatar rusty-snake2021-01-18
| | |
* | | harden and fix cheese.profileLibravatar rusty-snake2021-01-18
| | | | | | | | | | | | | | | hardening: wusc + wruc fix: settings was immutable
* | | new profile: agetpkg (#3887)Libravatar glitsj162021-01-13
| | | | | | | | | | | | | | | * Create agetpkg.profile * new profile: agetpkg
* | | add new profiles: lsar & unar (ar redirects) (#3886)Libravatar glitsj162021-01-13
| |/ |/| | | | | | | | | | | * Create lsar.profile * Create unar.profile * new profiles lsar & unar
* | Improvements to balsa,fractal,gajim,trojita (#3791)Libravatar bbhtt2021-01-11
| | | | | | | | | | | | | | | | | | | | | | | | | | * Improvements to balsa,fractal,gajim,trojita * sort * Add gpg plugin support to gajim,remove notifications dbus from trojita * Add dbus policy from flatpak per @rusty-snake * Add python* to private-bin; remove some dbus Co-authored-by: kortewegdevries <kortewegdevries@protonmail.ch>
* | discord-common.profile: Fix audio support (#3880)Libravatar Nikos Chantziaras2021-01-10
| | | | | | Discord needs PulseAudio. Without it, it's unable to play any audio.
* | evince.profile: optionally allow bookmark/metadata accessLibravatar Samtinel2021-01-09
| | | | | | | | | | | | | | bookmarks are saved unter $HOME/.local/share/gvfs-metadata since evince is the primary pdf reader, a firejailed evince can't read or write those this commit adds instructions to enable metadata writing and reading
* | electron redirect fixes (#3875)Libravatar glitsj162021-01-07
| | | | | | | | | | * drop doubled netfilter in atom.profile * drop doubled disable-mnt in tutanota-desktop.profile
* | harden liferea (#3873)Libravatar glitsj162021-01-06
| | | | | | | | | | | | | | * harden liferea * dbus fixes On closer investigation it seems wiser to tighten D-Bus filtering as Liferea implements stuff via plugins that are disabled by default.
* | fix preview in apostropheLibravatar rusty-snake2021-01-05
| |
* | fix #3859 (#3863)Libravatar glitsj162021-01-01
| | | | | | | | | | | | | | * fix #3859 * fix #3859 * fix #3859
* | Merge pull request #3760 from kmk3/fix-keepassxcLibravatar netblue302020-12-30
|\ \ | | | | | | keepassxc.profile: Fix hang due to seccomp
| * | keepassxc.profile: Fix hang due to seccompLibravatar Kelvin M. Klann2020-11-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the current profile, keepassxc hangs on startup, before showing the main window: $ uname -r -m 5.9.1-artix1-1 x86_64 $ firejail --version | head -n 1 firejail version 0.9.64 $ firejail --quiet keepassxc --version KeePassXC 2.6.2 $ firejail --quiet keepassxc # (nothing happens) ^C Seccomp debugging as explained on etc/templates/syscalls.txt: $ sudo grep -Eo 'keepassxc.* syscall=[0-9]+' /var/log/messages.log | tail -n 1 keepassxc" exe="/usr/bin/keepassxc" sig=31 arch=c000003e syscall=303 $ firejail --debug-syscalls | grep 303 303 - name_to_handle_at So allow the name_to_handle_at syscall. Relates to #3549.
* | | Merge branch 'master' into browsersLibravatar Reiner Herrmann2020-12-29
|\ \ \
| * \ \ Merge pull request #3847 from bbhtt/small_fixesLibravatar Reiner Herrmann2020-12-29
| |\ \ \ | | | | | | | | | | Small fixes
| | * | | Add quietLibravatar bbhtt2020-12-28
| | | | |
| | * | | Calls each program from /bin to populate listLibravatar bbhtt2020-12-28
| | | | |
| | * | | Add secret storage dbusLibravatar bbhtt2020-12-28
| | | |/ | | |/|
| * / | Update keepassxc.profile dbus commentsLibravatar rusty-snake2020-12-29
| |/ / | | | | | | | | | | | | - split notifications and tray - fix tray policy
* / / Add profiles for MS Edge dev build for Linux and LibrewolfLibravatar bbhtt2020-12-28
|/ /
* | remove trailing whitespacesLibravatar rusty-snake2020-12-21
| |
* | brave: enable wruc and wuscLibravatar rusty-snake2020-12-21
| |
* | move whlist /usr/share/chromium from chomium-comm…Libravatar rusty-snake2020-12-21
| | | | | | | | | | | | | | | | …on to chromium, remove the nowhlist from min and its whlist from riot-web. TODO: remove the 'ignore whitelist /usr/share/chomium' from the most profiles with it.
* | Refactor electron.profile and electron based programs (#3807)Libravatar rusty-snake2020-12-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactor electron.profile and electron based programs (1) * Refactor electron.profile and electron based programs (2) * Refactor electron.profile and electron based programs (3) * Refactor electron.profile and electron based programs (4) * Refactor electron.profile and electron based programs (5) * Refactor electron.profile and electron based programs (6) * Refactor electron.profile and electron based programs (7) * Refactor electron.profile and electron based programs (8)
* | Archiver fixes - drop private-bin (#3832)Libravatar glitsj162020-12-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop private-bin * drop private-bin * drop private-bin * drop private-bin * drop private-bin * disable private-lib in tar.profile Removing private-bin caused a test to fail - see discussion in https://github.com/netblue30/firejail/pull/3832. Thanks to @reinerh for explaining why I broke things!
* | New profiles for alacarte,tootle,photoflare (#3816)Libravatar kortewegdevries2020-12-16
| | | | | | | | | | | | | | * New profiles for alacarte,tootle,photoflare * Fix dbus Co-authored-by: kortewegdevries <kortewegdevries@protonmail.ch>
* | archiver fixes (#3830)Libravatar glitsj162020-12-16
| | | | | | | | | | * fix gzip * fix tar
* | Refactor archivers ii (#3827)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * harden 7z.profile * harden atool.profile * harden bsdtar.profile * harden cpio.profile * harden gzip.profile * harden tar.profile * harden unrar.profile * harden unzip.profile * harden xzdec.profile * harden zstd.profile
* | Refactor archivers (#3820)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Create archiver-common.inc * add apparmor to archiver-common.inc * refactor 7z.profile * refactor ar.profile * refactor atool.profile * refactor bsdtar.profile * refactor cpio.profile * refactor gzip.profile * refactor tar.profile * refactor unrar.profile * refactor unzip.profile * refactor xzdec.profile * refactor zstd.profile * rewording * blacklist ${RUNUSER} in archiver-common.inc Thanks to @rusty-snake for suggesting this. * drop non-sensical ${RUNUSER}/wayland-* blacklisting in archiver-common.inc See discussion in https://github.com/netblue30/firejail/pull/3820#discussion_r543523343
* | Runuser fixes (#3826)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-10 14:44:27 +0000