aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-m-z/mpv.profile
Commit message (Collapse)AuthorAge
* mpv.profile: add new XDG_CACHE_HOME pathLibravatar Kelvin M. Klann2023-08-03
| | | | | | | | | mpv v0.36.0 uses ~/.cache/mpv[1] [2]: Relates to #2838 #5936. [1] https://github.com/mpv-player/mpv/releases/tag/v0.36.0 [2] https://github.com/mpv-player/mpv/pull/10838
* mpv.profile: add new XDG_STATE_HOME pathLibravatar CodeWithMa2023-08-03
| | | | | | | The new version of mpv changed the path of the watch_later folder to ~/.local/state/mpv/watch_later. See https://github.com/mpv-player/mpv/pull/10838
* profiles: Miscellaneous cleanups (#5918)Libravatar glitsj162023-07-25
|
* profiles: remove /usr/share/vulkan already whitelisted by wusc (#5910)Libravatar glitsj162023-07-20
|
* Fix mpv 0.35.1 in Fedora 38Libravatar rusty-snake2023-04-29
|
* mpv: improve and clarify comments (#5711)Libravatar glitsj162023-03-09
|
* add restrict-namespaces to (almost) all profilesLibravatar smitsohu2022-12-20
|
* Revert "mpv: whitelist mpv-mpris (#5386)"Libravatar Kelvin M. Klann2022-10-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 393c5beff2686d7732221dadb6730917f24835a0. Which broke mpv: $ mpv --version Cannot start application: No such file or directory Probably because mpv itself uses many libraries and it has plugins that may depend on files in /usr/lib as well: $ pacman -Qlq mpv | grep /lib/ | grep -v '/$' /usr/lib/libmpv.so /usr/lib/libmpv.so.1 /usr/lib/libmpv.so.1.109.0 /usr/lib/pkgconfig/mpv.pc $ strings /usr/bin/mpv | grep '^lib.*\.so' | sort -u | wc -l 53 $ pacman -Qlq yt-dlp | grep /lib/ | grep -v '/$' | cut -f -4 -d / | sort -u /usr/lib/python3.10 $ pacman -Q mpv yt-dlp mpv 1:0.34.1-5 yt-dlp 2022.09.01-1 Environment: Artix Linux. Also, private-lib is disabled by default in firejail.config (see #5190) and mpv.profile does not use private-lib, so there should be no need to whitelist anything in /usr/lib in the default profile.
* mpv: whitelist mpv-mpris (#5386)Libravatar Hugo2022-10-01
| | | | | This is an mpv plugin for MPRIS integration. See: https://github.com/hoyon/mpv-mpris
* Remove shell none from profilesLibravatar rusty-snake2022-06-19
| | | | | | | | | | | | | | | | | | | | | | | Command: sed -i "/^shell none/d" etc/*/* TODO: ``` etc/profile-a-l/beaker.profile:ignore shell none etc/profile-a-l/default.profile:# shell none etc/profile-a-l/fdns.profile:#shell none etc/profile-a-l/gnome-nettool.profile:#shell none etc/profile-a-l/jitsi-meet-desktop.profile:ignore shell none etc/profile-m-z/pidgin.profile:# shell none etc/profile-m-z/rocketchat.profile:ignore shell none etc/profile-m-z/server.profile:# shell none etc/templates/profile.template:# OPTIONS (caps*, net*, no*, protocol, seccomp*, shell none, tracelog) etc/templates/profile.template:#shell none ``` - manpage - RELNOTES - fbuilder
* mpv.profile: whitelist paths for yt-dlpLibravatar Kelvin M. Klann2021-12-09
| | | | | | | | | See etc/profile-m-z/yt-dlp.profile. Relates to commit d6ca41c19 ("update mpv.profile", 2021-10-24) / PR #4634. Fixes #4754.
* mpv.profile: sort whitelistLibravatar Kelvin M. Klann2021-12-09
|
* mpv.profile: stop creating youtube-dl config dirLibravatar Kelvin M. Klann2021-12-09
| | | | | | | | If it does not already exist, mpv is unlikely to need or to create it, so just whitelist it if it exists. This amends commit 5d741795c ("Use whitelisting for video players (#3472)", 2020-08-15).
* etc: Remove comments about nogroups and noroot on nvidiaLibravatar Kelvin M. Klann2021-11-29
| | | | | | | | | | | | | | | | | | | | | | | | `nogroups` should not have been causing issues with rendering on nvidia since commit 623e68216 ("temporary fix for nvidia/nogroups/noroot issue (#3644, #841)", 2020-10-02) and commit cb460c32c ("more nvidia (#3644)", 2020-10-03), which had made it a no-op on nvidia. And the handling of the "render" and "video" groups are independent to the handling of `nogroups` now; see the previous 3 commits. Commits which introduced the comments on each profile: * kodi.profile: commit ce462b6b1 ("fix #3501", 2020-07-16) * mpsyt.profile: commit e17b48fca ("new profile mpsyt.profile", 2018-11-28) * mpv.profile: commit cc7c48983 ("Document #1945", 2018-07-25) * steam.profile: commit d6f8169dd ("steam fixes; #841, #3267", 2020-03-15) Commands used to find the comments: git grep -i nvidia -- etc/profile-* | grep -v private-etc Relates to #4632.
* update mpv.profileLibravatar pirate4867431862021-10-24
| | | add yt-dlp in private-bin
* fix spelling (#4573)Libravatar a13460542021-09-22
|
* Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | | (#4461) See #4454
* Revert "move whitelist/blacklist to allow/deny"Libravatar Kelvin M. Klann2021-07-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fe0f975f447d59977d90c3226cc8c623b31b20b3. Note: This only reverts the changes from etc. The 4 aliases introduced on commit 45f2ba544 are mere, well, aliases. That is, they fail to address the different usability problems discussed on [#3447][3447] and in fact only make things more confusing (as has already been mentioned on [this][4379] and later comments). The main reason is that the aliases do not meaningfully map to the original commands. For example, the commands from each pair below seem like they would do the exact same thing: * `allow` and `nodeny` * `deny` and `noallow` Additionally, if these aliases are not the final commands, but only a test/work-in-progress, then keeping the wide-scale search/replace changes made on commit fe0f975f4 would only serve to cause confusion, as users of firejail-git, contributors and downstream projects might start changing the commands used on their profiles, only to later have to change them again, potentially to completely different commands. The sooner this is undone the better, as (besides the above reasons) the more profile changes there are between the original commit and the revert, the harder it is to e.g.: `git diff` versions of files across the following revision ranges: before the commit, after the commit but before the revert and after the revert. Note: This is still the case even if a commit is [ignored by `git blame`][4390]. So let us revert fe0f975f4 and only reapply similar large-scale changes once we have discussed and settled on better commands. How the revert was applied: Despite using the auto-generated message from `git revert`, to ensure correctness and to avoid conflicts the changes were reverted in different steps: Firstly, revert the files which can be safely reverted directly ("filestorevert"): # Find out which files have been changed on fe0f975f44, but have not # been changed afterwards and list them on "filestorevert" git show --pretty='' --name-only fe0f975f44 -- etc | LC_ALL=C sort >allfiles git diff --name-only fe0f975f44..master -- etc | LC_ALL=C sort >filestoignore comm -2 -3 allfiles filestoignore >filestorevert # Note: There are 3 extra files on filestoignore because they were # added after commit fe0f975f44 wc -l allfiles filestoignore filestorevert | head -n 3 # 797 allfiles # 8 filestoignore # 792 filestorevert # Automatically revert files in "filestorevert" # See https://stackoverflow.com/a/23401018/10095231 tr '\n' '\000' <filestorevert | xargs -0 git show fe0f975f44 -- | git apply --reverse printf 'Total files reverted:\n' git diff --name-only | wc -l # 792 Secondly, do some search/replace on the rest: tr '\n' '\000' <filestoignore | xargs -0 sed -i.bak \ -e 's/allow /whitelist /' -e 's/noallow /nowhitelist /' \ -e 's/deny /blacklist /' -e 's/nodeny /noblacklist /' \ -e 's/deny-nolog /blacklist-nolog /' find etc -name '*.bak' -print0 | xargs -0 rm Thirdly, verify the result. The following command shows the difference between all the changes in etc from before fe0f975f44 and this commit (inclusive): git diff fe0f975f44~1 -- etc From the output, it looks like all alias changes are fully reverted and that the other changes to etc (from after fe0f975f44) remain, so the revert seems to be done correctly. [3447]: https://github.com/netblue30/firejail/issues/3447 [4379]: https://github.com/netblue30/firejail/issues/4379#issuecomment-876460222 [4390]: https://github.com/netblue30/firejail/issues/4390
* move whitelist/blacklist to allow/denyLibravatar netblue302021-07-05
|
* Restrict /usr/libexecLibravatar rusty-snake2021-05-29
|
* Add noinput to all profiles with private-devLibravatar rusty-snake2021-05-05
|
* streamline 'Allow xxx' comments (#3922)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add comment: allow python * add comment: allow python * reorder allow comments * fix perl allow comment * add comment: allow python * add comment: allow lua, perl & python * reorder allow comments * add comment: allow python * add comment: allow python * add comment: allow lua, perl & python * fix allow comments * add comment: allow python * add comment: allow python * fix spacing in comments * add comment: allow python * add comment: allow python * fix comment * add comment: allow perl & python * add comment: allow lua & python * add comment: allow lua, perl & python * fix allow comments * add comment: allow perl & python * streamline allow python comments
* Add new allow include allow-bin-sh.incLibravatar rusty-snake2021-01-16
| | | | | | | | | /bin/sh is usually just a symlink to bash. However this is not the case for every distro, debian for example uses dash. bash,dash and sh have a blacklist command in disable-shell.inc. An own allow-*.inc for it enusres usage of all necessary nolacklists. For private-bin sh is enough because it follows symlinks.
* rename whitelist-players.inc to whitelist-player-common.inc (#3819)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | * Update and rename whitelist-players.inc to whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc
* from my overridesLibravatar rusty-snake2020-11-16
| | | | | | | | - add seccomp.block-secondary to a lot profiles - add wruc to firefox-common and ignore it in TB and firefox-common-addons - harden dia, gnome-keyring, libreoffice, megaglest, pngquant, ghostwriter, rhythmbox, sqlitebrowser
* splitting up media players whitelists in whitelist-players.incLibravatar netblue302020-10-02
|
* New profiles + fixes + hardeningLibravatar rusty-snake2020-09-14
| | | | | | | | - blacklist ~/.rustup in disable-devel.inc - add note to mpv (See #3628) - harden warsow - update relnotes - new profile qrencode, dbus-send, notify-send
* fix private-bin in mpv.profileLibravatar glitsj162020-09-02
|
* Fixes #3596 (#3619)Libravatar kortewegdevries2020-09-02
|
* Fix missing mkfile in 5d741795c3bb2060730e282a8f512b999418e098Libravatar Fred Barclay2020-08-16
|
* Use whitelisting for video players (#3472)Libravatar Fred Barclay2020-08-15
| | | | | | | | | | | | | | | * Use whitelisting for video players See https://github.com/netblue30/firejail/pull/3469 * Update media player whitelists See reviews at https://github.com/netblue30/firejail/pull/3472 Block $DOCUMENTS Make $DESKTOP read-only * Review fixes: include read-only Desktop in whitelist
* fix Lua in mpv.profileLibravatar glitsj162020-07-28
| | | Fixes for #3554.
* disable-shell.inc (#3411)Libravatar rusty-snake2020-06-04
| | | | | | | | | | | | * disable-shell.inc * add disable-shell.inc to all profiles with a … … private-bin line without bash/sh except profiles with redirect profiles. * add it to some more profiles * exclude aria2c.profile
* reorganize github etc directoryLibravatar netblue302020-04-21