| Commit message (Collapse) | Author | Age |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Add profile for npm
* Apply suggestions from code review
* Remove redundant blacklisting of Wayland.
* Remove unnecessary noblacklist lines for nodejs.
* Replace absolute paths to .inc files with filenames.
* Remove unneeded dbus whitelisting.
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Remove empty line
To keep consistent with other profiles, remove the blank line after the header comment.
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Add npm files to add-common-devel
So that our addition of npm paths to disable-programs.inc dose not break IDEs,
we need to unblacklist these same paths in allow-common-devel.inc.
* Remove extra blank line
* Add common whitelist includes to npm profile
* Tighten npm profile
Include disable-exec.inc, but allowing ${HOME}.
* Remove whitelist-common.inc from npm profile
whitelist-common breaks npm, and since we don't know where the user's npm
projects will be, leave the whitelist-common include in a comment with a note
about how to enable it for their setup.
* Fix inverted commands
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Fixes for whitelisting
* Add login.defs to npm profile's private-etc
Co-authored-by: Aidan Gauland <aidalgol+git@fastmail.net>
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
|
|
|
|
|
| |
* drop doubled netfilter in atom.profile
* drop doubled disable-mnt in tutanota-desktop.profile
|
|
|
|
|
|
|
|
|
| |
* new profile: tutanota-desktop
* add tutanota-desktop to firecfg
* blacklist tutanota-desktop files
* Create tutanota-desktop.profile
|
| |
|
|
|
|
|
|
|
| |
* fix #3859
* fix #3859
* fix #3859
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* really fix running kernel config check
archiver-common.inc includes `disable-shell.inc`, breaking
$ zcat /proc/config.gz
Cannot start application: Permission denied
* really fix running kernel config check
archiver-common.inc includes `disable-shell.inc`, breaking
$ zgrep -c "CONFIG_USER_NS=y" /proc/config.gz
Cannot start application: Permission denied
|
|\ |
|
| |\
| | |
| | | |
Small fixes
|
| | | |
|
| | | |
|
| | | |
|
| |/ |
|
| | |
|
|/ |
|
| |
|
|
|
|
|
|
|
|
| |
…on to chromium, remove the nowhlist from min and
its whlist from riot-web.
TODO: remove the 'ignore whitelist /usr/share/chomium' from the most
profiles with it.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Refactor electron.profile and electron based programs (1)
* Refactor electron.profile and electron based programs (2)
* Refactor electron.profile and electron based programs (3)
* Refactor electron.profile and electron based programs (4)
* Refactor electron.profile and electron based programs (5)
* Refactor electron.profile and electron based programs (6)
* Refactor electron.profile and electron based programs (7)
* Refactor electron.profile and electron based programs (8)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* drop private-bin
* drop private-bin
* drop private-bin
* drop private-bin
* drop private-bin
* disable private-lib in tar.profile
Removing private-bin caused a test to fail - see discussion in https://github.com/netblue30/firejail/pull/3832. Thanks to @reinerh for explaining why I broke things!
|
|
|
|
|
|
|
| |
* New profiles for alacarte,tootle,photoflare
* Fix dbus
Co-authored-by: kortewegdevries <kortewegdevries@protonmail.ch>
|
|
|
|
|
| |
* fix gzip
* fix tar
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* harden 7z.profile
* harden atool.profile
* harden bsdtar.profile
* harden cpio.profile
* harden gzip.profile
* harden tar.profile
* harden unrar.profile
* harden unzip.profile
* harden xzdec.profile
* harden zstd.profile
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Create archiver-common.inc
* add apparmor to archiver-common.inc
* refactor 7z.profile
* refactor ar.profile
* refactor atool.profile
* refactor bsdtar.profile
* refactor cpio.profile
* refactor gzip.profile
* refactor tar.profile
* refactor unrar.profile
* refactor unzip.profile
* refactor xzdec.profile
* refactor zstd.profile
* rewording
* blacklist ${RUNUSER} in archiver-common.inc
Thanks to @rusty-snake for suggesting this.
* drop non-sensical ${RUNUSER}/wayland-* blacklisting in archiver-common.inc
See discussion in https://github.com/netblue30/firejail/pull/3820#discussion_r543523343
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
* drop non-sensical ${RUNUSER}/wayland-* blacklisting
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Rename etc/inc/softmaker-common.inc to etc/profile-m-z/softmaker-common.profile
As per suggestion by @rusty-snake in https://github.com/netblue30/firejail/pull/3819#issuecomment-745244982
* softmaker-common.profile name change
* softmaker-common.profile name change
* softmaker-common.profile name change
* softmaker-common.profile name change
* softmaker-common.profile name change
* softmaker-common.profile name change
* softmaker-common.profile name change
* softmaker-common.profile name change
* softmaker-common.profile name change
|
|
|
| |
Better fix for #3711, see discussion there.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Update and rename whitelist-players.inc to whitelist-player-common.inc
* renamed whitelist-player-common.inc
* renamed whitelist-player-common.inc
* renamed whitelist-player-common.inc
* renamed whitelist-player-common.inc
* renamed whitelist-player-common.inc
* renamed whitelist-player-common.inc
* renamed whitelist-player-common.inc
|
|
|
| |
Co-authored-by: fenuks <fenuks>
|
| |
|
|
|
|
|
| |
* integrate relevant options into server.profile
* relax mdwe and dbus-system in server.profile
|
| |
|
| |
|
|
|
| |
Fixes #3805.
|
| |
|
| |
|
| |
|
|
|
|
|
|
| |
- hopefully fix #3795 finally
- fix README.md codeblock
- blacklist ${HOME}/.texlive20*
|
| |
|
|
|
|
| |
closes #3786; closes #3776
|
| |
|
|
|
|
|
|
|
|
|
| |
- gimp: allow mbind syscall. no start on Fedora 33 without
- minetest: disable private-cache. without persistent cache connecting to servers can take many minutes
- supertuxkart: allow bluetooth protocol. stk can directly connect/pair to WiiMote controllers
- supertuxkart: comment private-dev to allow controller use
- profiles: unify controller support comments
- firecfg: comment evolution with a note, and add a note to epiphany #3647 + #2995
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
- Lutris isn't added to firecfg just yet, needs more testing
- aria2c profile has a comment regarding Lutris/Winetricks,
but it shouldn't matter since it can't be nested
- Add commented wusc to wine.profile
- Add vulkan and zenity to wusc.inc
|
| |
|
| |
|
|
|
|
|
| |
We must ignore include `whitelist-runuser-common.profile`,
because it breaks Enigmail (TB 68) and GnuPG smartcard (TB 78) support.
|
|
|
| |
rm is needed to uninstall mods and delete game saves (worlds).
|
|
|
|
|
|
| |
- disable-common: read-only ${HOME}/.zfunc
- fix #3761 -- w3m with w3m-img installed does not display images when on virtual console/framebuffer
- yelp can be used to display manpages
|