aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-a-l
Commit message (Collapse)AuthorAge
* SortingLibravatar Nicola Davide Mannarelli2021-02-14
| | | | Moved in the right place as in template https://github.com/netblue30/firejail/blob/master/etc/templates/profile.template
* Update etc/profile-a-l/firefox.profileLibravatar Nicola Davide Mannarelli2021-02-13
| | | Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Fix for KeePassXC pluginLibravatar Nicola Davide Mannarelli2021-02-13
| | | | | KeePassXC changed the socket name. https://github.com/keepassxreboot/keepassxc/commit/a145bf91191f0a4630a7e31654aff8a8dfd09bf0 Keep also old socket name in whitelist for back compatibility
* Revert "Merge pull request #3607 from kortewegdevries/wemail"Libravatar rusty-snake2021-02-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit bd1819a8641e0eeae016846b28a41e625bcc215b, reversing changes made to 807af3dce05786f10747cc0938cc98af484c8e97. The hole PR looks like a single crap, it is not even syntactically correct. Has anyone at least started kmail with this profile before it was merged? See #3979, thanks @creideiki for reporting. > First, there are syntax errors. Several mkdir lines have file names containing asterisks. > This gives the following error: > > Error: "${HOME}/.cache/akonadi*" is an invalid filename: rejected character: "*" > > I am not sure what they intend to do, but whatever it is it's not working. > Especially confusing is the line > > mkdir /tmp/akonadi-* > > Yes, Akonadi creates a directory in /tmp, but its name is random and seems to have been created > using mkstemp(3) or similar. I'm not sure how Firejail is supposed to be able to pre-create it. > > Removing the asterisks makes Firejail at least accept the profile syntactically and try to run > the program. It is rejected by syntax. Has anyone tested? > At startup, Firejail now prints the following warning: > > *** > *** Warning: cannot whitelist ${DOCUMENTS} directory > *** Any file saved in this directory will be lost when the sandbox is closed. > *** Why was 'include disable-xdg.inc' added together with 'whitelist ${DOCUMENTS}', but no 'nobalcklist ${DOCUMENTS}'? It can not work. > The actual error is that PostgreSQL needs access to /usr/lib64/postgresql-13/ in order to run. > Adding the following line to kmail.profile fixes that: > > whitelist /usr/share/postgresql* Again, has anyone thested this? > The next problem is this message on the console: > > kf.config.core: Couldn't write "/home/creideiki/.config/kmail2rc" . Disk full? > > Which may have something to do with the profile creating a directory with that name: > > mkdir ${HOME}/.config/kmail2rc > > when it's supposed to be a file: > > $ stat ~/.config/kmail2rc > File: /home/creideiki/.config/kmail2rc > Size: 24660 Blocks: 56 IO Block: 4096 regular file Has anyone tested this or is this just a blind copy of the noblacklist from above with noblacklist replaced by mkdir? > However, the error message > > kf.config.core: Couldn't write "/home/creideiki/.config/kmail2rc" . Disk full? > > still appears. Looks like #1793. HAS ANYONE TESTED THIS PROFILE??! > Finally, when exiting KMail, it crashes with a SIGSEGV: > > *** KMail got signal 11 (Exiting) > *** Dead letters dumped. > KCrash: crashing... crashRecursionCounter = 2 > KCrash: Application Name = kmail path = /usr/bin pid = 20 > KCrash: Arguments: /usr/bin/kmail Has any... > I tried restoring an older kmail.profile, from commit 319f2dc, and it has none of the above problems. ... I give up asking if anyone tested this. > Given the multitude of problems with commit 5532fbd, I'd suggest reverting it until it can be fixed. Yes, definitely.
* display-im6.q16Libravatar netblue302021-02-11
|
* Update etc/profile-a-l/firefox.profileLibravatar Albin Kauffmann2021-02-09
| | | Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
* Update etc/profile-a-l/chromium-common.profileLibravatar Albin Kauffmann2021-02-09
| | | Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
* Add a comment to some profiles to allow screen sharingLibravatar Albin Kauffmann2021-02-09
| | | | | | | | This configuration is to be applied in order to get screen sharing working under Wayland (via pipewire and a xdg-desktop-portal backend). Note that {chrome|chromium} does not need the dbus filters (at least as of today) because dbus filtering is not enabled (dbus-user not set to none).
* Revert "etc: use ${DOCUMENTS} macro where appropriate"Libravatar Kelvin M. Klann2021-02-09
| | | | | | | | | | | | | | | This reverts commit 5df1f27c638c487dfd664ea3a0f756565e1e57bd. That commit breaks things, as pointed out by @rusty-snake[1]: > @kmk3 @glitsj16 The xdg macros are treated literally if they have sub > components (#2359): > > ``` > Error: "${DOCUMENTS}/KeePassXC" is an invalid filename: rejected character: "{" > ``` [1]: https://github.com/netblue30/firejail/commit/3fa2927c3c1c5cf583864746538ea791c1ba2dc4#commitcomment-46913219
* Merge pull request #3849 from bbhtt/emailLibravatar netblue302021-02-09
|\ | | | | Email part (2)
| * Some minor changesLibravatar bbhtt2021-01-09
| |
| * Add seccomp.block-secondary to email-common,mutt,neomutt; add mdwe to ↵Libravatar bbhtt2021-01-04
| | | | | | | | mutt,neomuut; some sorting
| * Add dbus-system none back to email-common.profileLibravatar bbhtt2020-12-31
| |
| * Some sorting per @kmk3Libravatar bbhtt2020-12-31
| |
| * Add seccomp.block-secondary per @rusty-snakeLibravatar bbhtt2020-12-31
| |
| * Improve whitelisting and dbus of Sylpheed and Claws-mailLibravatar bbhtt2020-12-31
| |
| * Add Evolution and folks directories coming from evolution data server common ↵Libravatar bbhtt2020-12-29
| | | | | | | | to both geary and evolution; add dbus permissions fromflatpak
| * Add whitelisting to mutt; improve geary, new profile for neomuttLibravatar bbhtt2020-12-28
| |
* | Housekeeping: strip extra whitespaceLibravatar Fred Barclay2021-02-08
| | | | | | | | | | Just `find . -not \( -name .git -prune -o -name *.AppImage -prune \) -type f -print0 | xargs -0 perl -pi -e 's/ +$//'` and filter to avoid unwanted changes (especially .md files)
* | etc: use ${DOCUMENTS} macro where appropriateLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, some paths are hard-coded: $ grep -Fnr '${HOME}/Documents' etc etc-fixes etc/profile-m-z/Mathematica.profile:19:mkdir ${HOME}/Documents/Wolfram Mathematica etc/profile-m-z/Mathematica.profile:22:whitelist ${HOME}/Documents/Wolfram Mathematica etc/profile-a-l/keepassxc.profile:34:# If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx etc/profile-a-l/keepassxc.profile:35:#mkdir ${HOME}/Documents/KeePassXC etc/profile-a-l/keepassxc.profile:36:#whitelist ${HOME}/Documents/KeePassXC Commands used to search and replace: $ find etc etc-fixes/ -type f -exec \ sed -i.bak -e 's|\${HOME}/Documents|${DOCUMENTS}|' '{}' + Related to that, the (lack of) usage of ${DOWNLOADS} has been recently fixed on commit deae31301 ("use ${DOWNLOADS} in lutris.profile (#3955)"). With the above change, all macros other than ${DOCUMENTS} seem to be already used appropriately: $ grep -Fnr '${HOME}/Desktop' etc etc-fixes $ grep -Fnr '${HOME}/Downloads' etc etc-fixes $ grep -Fnr '${HOME}/Music' etc etc-fixes $ grep -Fnr '${HOME}/Pictures' etc etc-fixes $ grep -Fnr '${HOME}/Videos' etc etc-fixes See src/firejail/macros.c for details.
* | archivers: wrap commentsLibravatar Kelvin M. Klann2021-02-08
| |
* | archivers: move archiver-common.inc include to the bottomLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | And mark it as a redirect profile. This is done so when including other *-common.inc profiles, such as firefox-common.profile.
* | use ${DOWNLOADS} in lutris.profile (#3955)Libravatar glitsj162021-02-07
| |
* | Add profile for Gemini (#3946)Libravatar Neo000012021-02-07
| | | | | | | | | | | | | | | | | | | | | | * Update disable-programs.inc * Create calligragemini.profile * Update calligra.profile * Update calligra.profile * Update firecfg.config
* | keepassxc: allow all browser, not just firefoxLibravatar rusty-snake2021-02-02
| | | | | | | | ungoogled-chromium won't work with keepassxc (#3941)
* | Add profile for avidemux (#3935)Libravatar Neo000012021-01-31
| | | | | | | | | | | | | | | | | | | | | | * Update disable-programs.inc * Update disable-programs.inc * Update firecfg.config * Create avidemux.profile * Update avidemux.profile
* | Disable the webkit2gtk-4.0 sandbox in bijibenLibravatar rusty-snake2021-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | webkit2gtk uses a bwrap based sandbox by default since 4.0, see #3647. This is good as it means more security by default on for linux system. Unfortunately is it not possible to run bwrap inside firejail if bwrap is started with --unshare-pid --proc /proc at all. In general we should exclude a program from firecfg until a final solution is found. But bijiben is special, while epiphany or evolution display random stuff from the internet is webkit2gtk in bijiben used to display local files create by the user. Bijiben has a thight profile (net none, whitelist, private-bin, ...) therefore my decision here was to disable the webkit2gtk sandbox rather then firejail.
* | add quiet to lzdiff/lzmadec (#3932)Libravatar glitsj162021-01-30
| | | | | | | | | | * add quiet to lzdiff * add quiet to lzmadec
* | Merge pull request #3931 from glitsj16/follow-up-3914Libravatar glitsj162021-01-30
|\ \ | | | | | | follow-up fixes for #3914
| * | follow-up fixes for ↵Libravatar glitsj162021-01-29
| | | | | | | | | | | | https://github.com/netblue30/firejail/commit/43aa71f8c608ec5bd92fd2c7323c603fa37f6d30
* | | Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ \ \ | | | | | | | | ssh: Refactor, fix bugs & harden
| * | | etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
| * | | git-cola.profile: add missing python template commentLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | See etc/templates/profile.template.
* | | | Add gfeeds directory for saved articlesLibravatar rusty-snake2021-01-29
| |/ / |/| |
* | | add extensive comment on sandboxing google-earth-pro (#3923)Libravatar glitsj162021-01-28
| | |
* | | streamline 'Allow xxx' comments (#3922)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add comment: allow python * add comment: allow python * reorder allow comments * fix perl allow comment * add comment: allow python * add comment: allow lua, perl & python * reorder allow comments * add comment: allow python * add comment: allow python * add comment: allow lua, perl & python * fix allow comments * add comment: allow python * add comment: allow python * fix spacing in comments * add comment: allow python * add comment: allow python * fix comment * add comment: allow perl & python * add comment: allow lua & python * add comment: allow lua, perl & python * fix allow comments * add comment: allow perl & python * streamline allow python comments
* | | Merge pull request #3853 from botherder/masterLibravatar netblue302021-01-25
|\ \ \ | | | | | | | | New profile for CoyIM
| * | | Added additional whitelistsLibravatar Nex2021-01-06
| | | |
| * | | Implementing some of the suggested changes from #3853Libravatar Nex2020-12-29
| | | |
| * | | Added some more restrictions to coyim profileLibravatar Nex2020-12-29
| | | |
| * | | Added first profile for coyimLibravatar Nex2020-12-29
| | |/ | |/|
* | | Merge pull request #3918 from Neo00001/masterLibravatar netblue302021-01-25
|\ \ \ | | | | | | | | Add profile for kdiff3
| * | | Update kdiff3.profileLibravatar Neo000012021-01-24
| | | |
| * | | Create kdiff3.profileLibravatar Neo000012021-01-24
| | | |
* | | | fix #3914Libravatar netblue302021-01-24
|/ / /
* | | misc comment fixes (#3916)Libravatar glitsj162021-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix comment in blackbox.profile * fix comment in fluxbox.profile * fix comment in i3.profile * fix comment in krunner.profile * fix comment in openbox.profile
* | | refactor google-earth{-pro} (#3915)Libravatar glitsj162021-01-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * refactor google-earth{-pro} blacklisting * fix google-earth-pro.profile I've included all binaries found in the Arch Linux AUR package to private-bin. But I also added a note on ignoring private-bin because I'm not sure what google-earth is doing on other distro's. * unbreak google-earth.profile Not sure why we need grep, ls and sed in private-bin exactly but keeping them around wouldn't hurt too much I guess.
* | | Update bibletime.profile, add new whitelist (#3908)Libravatar hhzek00142021-01-22
| | | | | | | | | | | | | | | | | | To solve issue#3907, doc directory of the bibletime has to be whitelisted. Otherwise, it always fails to start. Co-authored-by: hhnb <hhnb@nanenient.cc>
* | | Add profile for guvcviewLibravatar rusty-snake2021-01-18
| | |
* | | harden and fix cheese.profileLibravatar rusty-snake2021-01-18
| | | | | | | | | | | | | | | hardening: wusc + wruc fix: settings was immutable
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-01 21:34:42 +0000