| Commit message (Collapse) | Author | Age |
|
|
| |
At least on Ubuntu 16.04 LTS we need an additional own.
|
|
|
| |
It's the path to the game's data in the official Debian package.
|
|
|
| |
fix for #3737.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- .github/ISSUE_TEMPLATE/bug_report.md: get ride off spanish,
french, ... error messages
- etc/inc/firefox-common-addons.inc: support ff2mpv
- etc/profile-a-l/gimp.profile: note about xsane
- etc/profile-m-z/min.profile: prettify
- etc/profile-m-z/mpsyt.profile: fix, add lua
- etc/profile-m-z/qbittorrent.profile: add note for tray-icons; this
will get a better note once I investigated and audited all the D-Bus
tray stuff.
- etc/profile-m-z/transmission-daemon.profile: fix, add protocol packet
close #3686 - mps-youtube needs lua
close #3701 - Firefox native messaging regression in 0.9.62.4 -> 0.9.64rc1
close #3636 - transmission-daemon fills log with error
close #3640 - Gimp - add note how to enable scanning (xsane)
close #3707 - qBittorrent tray icon missing from notification panel when running it with firejail
|
| |
|
|
|
| |
As per https://github.com/netblue30/firejail/pull/3688#discussion_r511290714 min needs wusc. Runs fine with wruc too so let's fix min for users.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* rework chromium
+ 516d0811 has removed fundamental security features.
(remove caps.drop=all, nonewprivs, noroot, seccomp, protocol; add
caps.keep)
Though this is only necessary if running under a kernel which
disallow
unprivileged userns clones. Arch's linux-hardened and debian kernel
are
patched accordingly. Arch's linux and linux-lts kernels support this
restriction via sysctk (kernel.unprivileged_userns_clone=0) as users
opt-in.
Other kernels such as mainline or fedora/redhat always support
unprivileged
userns clone and have no sysctl parameter to disable it. Debian and
Arch
users can enable it with 'sysctl kernel.unprivileged_userns_clone=1'.
This commit adds a chromium-common-hardened.inc which can be included
in
chromium-common to enhance security of chromium-based programs.
+ chromium-common.profile: add private-cache
+ chromium-common.profile: add wruc and wusc, but disable it for the
following
profiles until tested. tests welcome.
- [ ] bnox, dnox, enox, inox, snox
- [ ] brave
- [ ] flashpeak-slimjet
- [ ] google-chrome, google-chrome-beta, google-chrome-unstable
- [ ] iridium
- [ ] min
- [ ] opera, opera-beta
+ move vivaldi-snapshot paths from vivaldi-snapshot.profile to vivaldi.
/usr/bin/vivaldi is a symlink to /etc/alternatives/vivaldi which can
be
vivaldi-stable, vivaldi-beta or vivaldi-snapshot.
vivaldi-snapshot.profile
missed also some features from vivaldi.profile, solve this by making
it
redirect to vivaldi.profile. TODO: exist new paths such as
.local/lib/vivaldi
also for vivaldi-snapshot?
+ create chromium-browser-privacy.profile (closes #3633)
* update 1
+ add missing 'ignore whitelist /usr/share/chromium'
+ revert 'Move drm-relaktions in vivaldi.profile behind
BROWSER_ALLOW_DRM.'. This breaks not just DRM, it break things such
as AAC too. In addition vivaldi shows a something is broken pop-up,
we would have a lot of 'does not work with firejail' issues.
* update 2
* update 3
fixes #3709
|
|
|
|
|
|
|
|
| |
- update README.md and RELNOTES
- add 'blacklist ${RUNUSER}/.flatpak-cache' to disable-common.inc
- fix #3728, fonts in openSUSE KDE with wc / wusc
- fix gnome-todo
- fix xournalpp MathTeX whitelist
|
|
|
|
|
| |
Closes #3723
Introduced in 388826683c3b90926e73c83ddb91d5c84a7fa1fa
|
|
|
|
|
|
|
| |
* Update firecfg.config
* Update disable-programs.inc
* Create spectacle.profile
|
| |
|
|
|
| |
This fixes #3711.
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
* Update okular.profile
okular has support for reading cbr (rar-compressed comic book). without unrar or unar in private-bin, okular fails to decompress the files for viewing.
* Sorted private-bin
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* remove read-only item redundancy
'read-only ${HOME}/.config/mimeapps.list' is already part of disable-common.inc
* remove read-only item redundancy
'read-only ${HOME}/.config/mimeapps.list' is already part of disable-common.inc, which is included in the redirect profile
* remove read-only item redundancy
'read-only ${HOME}/.config/mimeapps.list' is already part of disable-common.inc, which is included in the redirect profile
|
|
|
|
| |
…recorder to firecfg.config
|
| |
|
| |
|
| |
|
|
|
| |
On arch,wire-desktop is now depending on electron9. Using wildcard for this sorta packages would be better.
|
|
|
| |
With private-etc enabled vmware-tools doesn't get installed. Existing VM with an installed vmware-tools works as usual. For the time being keep it commented.
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
- blacklist ~/.rustup in disable-devel.inc
- add note to mpv (See #3628)
- harden warsow
- update relnotes
- new profile qrencode, dbus-send, notify-send
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
* README.md & RELNOTES
* Allow gnome-build do read and write .bash_history, it has a build-in
terminal
* D-Bus filter for gnome-passwordsafe
* wruc for supertuxkart
* wruc+wusc for totem
* dbus-system none for totem
* remove src/man/preproc.c it is replaced by preproc.awk
* remove dead-code form preproc.awk
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Add profile for twitch,youtube wrappers
* Fix git-cola, add Youtube music wrapper profiles
* Fixes for git-cola again
* Add profile for alternative name for git-cola
* Fixes
* Fix
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Added minecraft-launcher-profile
Initial
* Changed minecraft-launcher profile
Added space,tracelog,nodvd
* New profiles for balsa,trojita,kube
* Switch to whitelisting
* Enable gpg,firefox uniformity between other clients
* Hyperlinks
* Fix
Co-authored-by: kortewegdevries <k0rtic_dv@aol.com>
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Profile for Psi
* Fix pidgin buddy icon
* Profile for man
* Add profile for smuxi
* Comment man in firecfg
* Add pinentry programs
* Update etc/profile-m-z/psi.profile
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
|
|
|
|
|
|
|
|
|
| |
* Fix private-etc of electron-mail
* Fix dbus of geary
* Fix geary again, remove GPG
* Fix seccomp on Arch
|
| |
|
|
|
|
|
|
|
|
|
| |
* Matrix clients
Initial
* Add profile for fractal, # 1139
* Fixes
|
|
|
|
|
|
|
|
|
| |
* Various profiles
Initial
* Various fixes # 1
Removed blacklist,no3d; added icon flatpak paths;sorting;added space
|
| |
|
|
|
|
|
|
|
| |
This commit removes it from profile which have it.
/usr/share/perl* is still inaccessible for profiles with wusc and
disable-interpreters.inc w/o allow-perl.inc.
|
|
|
|
|
| |
Signal is adding support for video calls on desktop, see
https://signal.org/blog/desktop-calling-beta/
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Use whitelisting for video players
See https://github.com/netblue30/firejail/pull/3469
* Update media player whitelists
See reviews at https://github.com/netblue30/firejail/pull/3472
Block $DOCUMENTS
Make $DESKTOP read-only
* Review fixes: include read-only Desktop in whitelist
|
|\
| |
| | |
Fix nomacs
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
```
Aug 11 16:32:32 korte audit[29004]: SECCOMP auid=1000 uid=1000 gid=1000
ses=2 subj==firejail-default (enforce) pid=29004 comm="nomacs"
exe="/usr/bin/nomacs" sig=31 arch=c000003e syscall=9 compat=0
ip=0x7fa2a1cc98c6 code=0x0
```
|
|/
|
|
|
| |
Initial,amend: wrong dir,delete gtk-*,added new files
Co-authored-by: kortewegdevries <k0rtic_dv@aol.com>
|