aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-a-l
Commit message (Collapse)AuthorAge
* profiles: libreoffice: support signing documents with GPG (#6353)HEADmasterLibravatar glitsj1619 hours
| | | | | Based on the entries in etc/profile-m-z/makepkg.profile. This fixes #6352.
* profiles: streamline Firefox URL opening support (#6348)Libravatar glitsj165 days
| | | | | | | | Changes: * Improve Firefox D-Bus comment * Add missing/standardize related comments * Include allow-bin-sh.inc in relevant profiles * Use Firefox URL open section in relevant profiles
* profiles: hexchat: add noprinters (#6340)Libravatar glitsj1611 days
|
* profiles: loupe: harden and disable apparmor (#6333)Libravatar Kelvin M. Klann13 days
| | | | | | | | | | | | | | | | | | The profile currently does not include disable-common nor makes `${HOME}` read-only, so the program can simply write to ~/.bashrc directly[1]. disable-common.inc was commented due to it apparently breaking bwrap. As discovered by @glitsj16, it seems that allowing the bwrap binary is enough to make it work (and that apparmor breaks loupe)[2]. So disable apparmor, allow bwrap and include disable-common.inc, plus other hardening by @glitsj16. This amends commit 9a0db13e1 ("profiles: add loupe", 2024-04-30) / PR #6327. [1] https://github.com/netblue30/firejail/pull/6327#pullrequestreview-2033860865 [2] https://github.com/netblue30/firejail/pull/6333#issuecomment-2099805480
* profiles: hexchat: allow lua/downloads and harden (#6331)Libravatar glitsj162024-05-07
| | | | | | | | | | | | | | | * profiles: hexchat: hardenings * profiles: hexchat: allow lua/downloads and harden Allow more paths and add some extra options to harden the profile. We allow Perl but keep it out of private-bin. Do the same for Lua and clarify in the private-bin comment how to enable these interpreters. Consulted resources: - https://github.com/hexchat/hexchat/ - https://hexchat.readthedocs.io/
* New profile: d-spy (#6328)Libravatar glitsj162024-05-02
| | | | | | | | | | | Description: D-Bus debugger for GNOME https://gitlab.gnome.org/GNOME/d-spy From [1]: > D-Feet is no longer maintained. Please use d-spy [1] https://wiki.gnome.org/Apps/DFeet
* profiles: add loupeLibravatar Tavi2024-05-01
| | | | Signed-off-by: Tavi <tavi@divested.dev>
* profiles: fix new game profilesLibravatar Kelvin M. Klann2024-04-29
| | | | | | | | Fix sorting and improve comments. See etc/templates/profile.template. This amends commit 4c5f55899 ("several kids programs", 2024-04-29).
* several kids programsLibravatar netblue302024-04-29
|
* profiles: fluffychat: remove option already present in disable-common.inc ↵Libravatar glitsj162024-04-25
| | | | (#6322)
* profiles: audacity: allow networking by default (#6321)Libravatar glitsj162024-04-25
| | | | | | | Newly-released audacity 3.5 supports cloud-saving and remote backup features: - https://www.audacityteam.org/blog/audacity-3-5/ - https://support.audacityteam.org/additional-resources/changelog/audacity-3.5#cloud-project-saving
* New profile: axel (#6315)Libravatar glitsj162024-04-20
| | | https://github.com/axel-download-accelerator/axel
* profiles: clarify and add opengl-game to profile.template (#6300)Libravatar Kelvin M. Klann2024-04-05
| | | | | | | | | | | | | | | To make it consistent with the other include profiles. See etc/templates/profile.template. With this, all `etc/inc/allow-*` files are listed in profile.template. The explanation is based on a comment by @rusty-snake[1]. Relates to #4071. This is a follow-up to #6299. [1] https://github.com/netblue30/firejail/pull/4071#issuecomment-822003473
* New profile: gh (GitHub CLI) (#6293)Libravatar glitsj162024-03-27
| | | | | Description: GitHub's official command-line tool. https://github.com/cli/cli
* profiles: rename disable-X11.inc to disable-x11.inc (#6294)Libravatar Kelvin M. Klann2024-03-27
| | | | | | | | | | | | | | | | | | | | | That is, make "X11" lowercase so that the order of the includes in the disable- section remain the same when sorted with `LC_ALL=C`, as is the case for most of the other sections. That is also likely to be the default in text editors (such as in vim on Arch), so this should make the disable- section more consistent and easier to sort when editing the profile. Also, keep the old include as a redirect to the new one for now to avoid breakage. Commands used to search and replace: git mv etc/inc/disable-X11.inc etc/inc/disable-x11.inc git grep -Ilz 'disable-X11' -- etc | xargs -0 \ perl -pi -e 's/disable-X11/disable-x11/' Relates to #4462 #4854 #6070 #6289. This is a follow-up to #6286.
* profiles: sort blacklist sections (#6289)Libravatar Kelvin M. Klann2024-03-27
| | | | | See etc/templates/profile.template. This is a follow-up to #6286.
* firefox: Add org.kde.kdeconnect to plasma integration comment (#6285)Libravatar RundownRhino2024-03-24
| | | | | | | I recently set up KDE connect and plasma-browser-integration for firefox (Linux Mint 21.2) and needed this line in addition to the ones mentioned in the profile. Found it via running `firejail --profile=/etc/firejail/firefox.profile --dbus-user.log firefox`, trying to send links to device, and seeing what events get logged.
* Merge pull request #6286 from kmk3/x11-none-improvementsLibravatar Kelvin M. Klann2024-03-24
|\ | | | | profiles: replace x11 socket blacklist with disable-X11.inc
| * profiles: replace x11 socket blacklist with disable-X11.incLibravatar Kelvin M. Klann2024-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace all occurrences of `blacklist /tmp/.X11-unix` with `include disable-X11.inc`, which blacklists more X11-related files. Commands used to search and replace: $ git grep -Ilz '^blacklist /tmp/.X11-unix' -- \ etc/profile*/*.profile | xargs -0 perl -0 -pi -e '\ s/\nblacklist \/tmp\/.X11-unix\n/\n/; \ s/(\ninclude disable-xdg.inc\n)/\ninclude disable-X11.inc$1/; \ s/(\ninclude disable-[^Xx\n]+\n)(\n|# )/$1include disable-X11.inc\n$2/' Note: The following files were also edited manually: * etc/profile-a-l/erd.profile * etc/profile-a-l/links-common.profile * etc/profile-m-z/termshark.profile * etc/profile-m-z/tmux.profile * etc/profile-m-z/tshark.profile Relates to #4462 #4854.
* | profiles: deny access to ~/.config/autostart (#6257)Libravatar Kelvin M. Klann2024-03-24
|/ | | | | | | | | | The files in this directory are intended to be automatically executed when the user logs in. In which case, granting write access to this directory allows the program to easily escape the sandbox (by autostarting itself outside of firejail, for example). Misc: This was noticed on #6244.
* gconf-editor: remove X11 socket blacklistLibravatar Kelvin M. Klann2024-03-23
| | | | | | | | | | It is a GUI program. It was apparently added by accident on commit 73321c597 ("Fixes (#2816)", 2019-07-01). Reported by @glitsj16 at https://github.com/netblue30/firejail/pull/6286#discussion_r1536618241
* k3b.profile: fix dvd drive detection (private-dev) (#6280)Libravatar Kelvin M. Klann2024-03-23
| | | | | | | | | | @hedgehog29 commented[1]: > It prevents k3b from detecting all dvd drives, incudling USB ones, and > it seems that also SATA. Fixes #6279. [1] https://github.com/netblue30/firejail/issues/6279#issue-2191392448
* New profile: localsend_app.profile (#6244)Libravatar glitsj162024-03-18
| | | | | Description: An open source cross-platform alternative to AirDrop. https://github.com/localsend/localsend
* New profile: editorconfiger.profile (#6235)Libravatar glitsj162024-03-18
| | | | | | | Description: Plain tool to validate and compare .editorconfig files. https://github.com/aegoroff/editorconfiger https://aur.archlinux.org/packages/editorconfiger https://aur.archlinux.org/packages/editorconfiger-bin
* New profile: koreader.profile (#6243)Libravatar glitsj162024-03-16
| | | | | Description: Ebook reader application. https://koreader.rocks/
* New profile: dexios.profile (#6234)Libravatar glitsj162024-03-16
| | | | | | Description: CLI encryption tool https://github.com/brxken128/dexios https://aur.archlinux.org/packages/dexios-bin
* New profile: deadlink.profile (#6233)Libravatar glitsj162024-03-15
| | | | | | Description: Checks and fixes URLs in code and documentation. https://github.com/nschloe/deadlink https://aur.archlinux.org/packages/deadlink
* New profile: cloneit (#6232)Libravatar glitsj162024-03-15
| | | | | | | | Description: A CLI tool to download specific GitHub directories or files. https://github.com/alok8bb/cloneit https://aur.archlinux.org/packages/cloneit-git
* New profile: lyriek.profile (#6245)Libravatar glitsj162024-03-14
| | | | | | Description: A multi-threaded GTK application to fetch lyrics of currently playing songs. https://gitlab.com/bartwillems/lyriek
* New profile: erd.profile (#6236)Libravatar glitsj162024-03-14
| | | | | | | | | | Description: Multi-threaded file-tree visualizer and disk usage analyzer. https://github.com/solidiquis/erdtree https://archlinux.org/packages/extra/x86_64/erdtree/ Note: The repo and package are called `erdtree`, but the executable is `erd`.
* New profile: bpftop.profile (#6231)Libravatar glitsj162024-03-14
| | | | | | | | Description: Dynamic real-time view of running eBPF programs. https://github.com/Netflix/bpftop https://aur.archlinux.org/packages/bpftop https://aur.archlinux.org/packages/bpftop-bin https://aur.archlinux.org/packages/bpftop-git
* Merge pull request #6261 from kmk3/sort-py-strip-commasLibravatar Kelvin M. Klann2024-03-08
|\ | | | | build: sort.py: filter empty and duplicate items
| * build: sort.py: filter empty and duplicate itemsLibravatar Kelvin M. Klann2024-03-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Note: This seems to already be done for `protocol` lines. Before: $ ./contrib/sort.py test.profile sort.py: checking 1 profile(s)... test.profile:1:-private-etc ,,bar,,foo,,bar,,, test.profile:1:+private-etc ,,,,,,,bar,bar,foo test.profile:2:-protocol ,,unix,,bluetooth,,unix,,inet,,, test.profile:2:+protocol unix,inet,bluetooth [ Fixed ] test.profile After: $ ./contrib/sort.py test.profile sort.py: checking 1 profile(s)... test.profile:1:-private-etc ,,bar,,foo,,bar,,, test.profile:1:+private-etc bar,foo test.profile:2:-protocol ,,unix,,bluetooth,,unix,,inet,,, test.profile:2:+protocol unix,inet,bluetooth [ Fixed ] test.profile
* | New profile: green-recoder.profile (#6237)Libravatar glitsj162024-03-05
| | | | | | | | | | | | | | Simple screen recorder for Linux desktop, supports Wayland & Xorg. https://github.com/dvershinin/green-recorder https://aur.archlinux.org/packages/green-recorder https://aur.archlinux.org/packages/green-recorder-git
* | archiver-common: add mkinitcpio support to private-etc (#5656)Libravatar glitsj162024-03-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mkinitcpio (used to generate initramfs images) supports several compression formats: https://gitlab.archlinux.org/archlinux/mkinitcpio/mkinitcpio/-/blob/master/mkinitcpio.conf#L54-L64. On Arch Linux (based distributions) at least this implies the supported archivers to have access to mkinitcpio-related files under /etc. This was no problem before 29da82d added `private-etc` to `archivers-common.profile`. This adds the now needed extra private-etc items to archiver-common.profile, for mkinitcpio's supported compressors (which seem to be at least cpio, gzip and zstd). Relates to #5610.
* | archivers: drop private-etc now that it's in archiver-common (#5655)Libravatar glitsj162024-03-05
| | | | | | | | | | | | | | | | Commit 29da82d added `private-etc` to `archiver-common.profile`. To avoid doubled options this PR removes it from archiver profiles which already had it. Relates to #5610.
* | iagno: ordering fixes (#5681)Libravatar glitsj162024-03-05
| |
* | New profiles: lz4 and redirects (#6241)Libravatar glitsj162024-03-05
| |
* | gnome-boxes: deny access to /usr/libexec (#6239)Libravatar glitsj162024-03-05
| |
* | Add quiet to enchant-2, it has a cliLibravatar rusty-snake2024-03-03
|/
* Merge pull request #6219 from haplo/ledger-live-desktopLibravatar netblue302024-02-29
|\ | | | | Profile for Ledger Live desktop app
| * Profile for ledger-live-desktopLibravatar Fidel Ramos2024-02-28
| | | | | | | | | | | | | | | | | | /opt/ledger-live installation currently sits at 345 MiB, so I decided to whitelist it instead of using private-opt ledger-live, in case future installations grow in size. Not using private-dev was the only way I managed to get my USB wallet to work.
* | Create gnome-boxes.profileLibravatar glitsj162024-02-27
|/
* profiles: drop paths already in wusc (#6218)Libravatar glitsj162024-02-23
| | | | Drop paths present in etc/inc/whitelist-usr-share-common.inc from profiles that include it.
* electron-cash: use new private-etc syntaxLibravatar glitsj162024-02-19
|
* Merge pull request #6181 from haplo/electron-cashLibravatar glitsj162024-02-19
|\ | | | | Profile for Electron Cash
| * electron-cash.profileLibravatar Fidel Ramos2024-01-30
| |
* | Merge pull request #6201 from glitsj16/gnome-keyring-fixesLibravatar glitsj162024-02-08
|\ \ | | | | | | gnome-keyring: harden and add gnome-keyring-daemon.profile
| * | Create gnome-keyring-daemon.profileLibravatar glitsj162024-02-08
| | | | | | | | | | | | And use it as the base for the existing gnome-keyring.profile.
| * | gnome-keyring: harden and remove quietLibravatar glitsj162024-02-08
| | |
generated by cgit v1.2.3-54-g00ecf (git 2.45.0) at 2024-05-25 09:28:54 +0000