aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-m-z
Commit message (Collapse)AuthorAge
* profiles: add allow-nodejs.inc to profile.template (#6298)Libravatar Kelvin M. Klann2024-03-30
| | | | | | | To make it consistent with the other include profiles. See etc/templates/profile.template. Relates to #3866 #5881.
* pkglog: hardening (x11) (#6292)Libravatar glitsj162024-03-27
|
* profiles: rename disable-X11.inc to disable-x11.inc (#6294)Libravatar Kelvin M. Klann2024-03-27
| | | | | | | | | | | | | | | | | | | | | That is, make "X11" lowercase so that the order of the includes in the disable- section remain the same when sorted with `LC_ALL=C`, as is the case for most of the other sections. That is also likely to be the default in text editors (such as in vim on Arch), so this should make the disable- section more consistent and easier to sort when editing the profile. Also, keep the old include as a redirect to the new one for now to avoid breakage. Commands used to search and replace: git mv etc/inc/disable-X11.inc etc/inc/disable-x11.inc git grep -Ilz 'disable-X11' -- etc | xargs -0 \ perl -pi -e 's/disable-X11/disable-x11/' Relates to #4462 #4854 #6070 #6289. This is a follow-up to #6286.
* profiles: sort blacklist sections (#6289)Libravatar Kelvin M. Klann2024-03-27
| | | | | See etc/templates/profile.template. This is a follow-up to #6286.
* New profile: qemu-common.profile (#6287)Libravatar Kelvin M. Klann2024-03-25
| | | | | | Add a common profile to deduplicate entries and make qemu-related profiles redirect to it. Relates to #6255.
* Merge pull request #6286 from kmk3/x11-none-improvementsLibravatar Kelvin M. Klann2024-03-24
|\ | | | | profiles: replace x11 socket blacklist with disable-X11.inc
| * profiles: replace x11 socket blacklist with disable-X11.incLibravatar Kelvin M. Klann2024-03-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Replace all occurrences of `blacklist /tmp/.X11-unix` with `include disable-X11.inc`, which blacklists more X11-related files. Commands used to search and replace: $ git grep -Ilz '^blacklist /tmp/.X11-unix' -- \ etc/profile*/*.profile | xargs -0 perl -0 -pi -e '\ s/\nblacklist \/tmp\/.X11-unix\n/\n/; \ s/(\ninclude disable-xdg.inc\n)/\ninclude disable-X11.inc$1/; \ s/(\ninclude disable-[^Xx\n]+\n)(\n|# )/$1include disable-X11.inc\n$2/' Note: The following files were also edited manually: * etc/profile-a-l/erd.profile * etc/profile-a-l/links-common.profile * etc/profile-m-z/termshark.profile * etc/profile-m-z/tmux.profile * etc/profile-m-z/tshark.profile Relates to #4462 #4854.
| * sstmp.profile: sort disable includesLibravatar Kelvin M. Klann2024-03-23
| | | | | | | | | | | | | | Move disable-X11.inc before disable-xdg.inc for consistency with other profiles. Added on commit 73a6fced2 ("New profile: ssmtp (#5544)", 2022-12-21).
* | profiles: deny access to ~/.config/autostart (#6257)Libravatar Kelvin M. Klann2024-03-24
|/ | | | | | | | | | The files in this directory are intended to be automatically executed when the user logs in. In which case, granting write access to this directory allows the program to easily escape the sandbox (by autostarting itself outside of firejail, for example). Misc: This was noticed on #6244.
* New profile: tqemu.profile (#6255)Libravatar glitsj162024-03-23
| | | | | Description: QEMU frontend without libvirt. https://github.com/thanoulis/tqemu
* New profile: metadata-cleaner.profile (#6246)Libravatar glitsj162024-03-20
| | | | | | Description: Python GTK3 application to view and clean metadata in files, using mat2. https://gitlab.com/rmnvgr/metadata-cleaner
* remove porn-cli.profile (#6284)Libravatar pirate4867431862024-03-20
| | | Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* Rename etc/session-desktop.profile to etc/profile-m-z/session-desktop.profileLibravatar glitsj162024-03-19
|
* New profile: session-desktop.profile (#6259)Libravatar glitsj162024-03-19
| | | | | | | | | | Description: Encrypted messenger. https://github.com/oxen-io/session-desktop/ https://aur.archlinux.org/packages/session-desktop https://aur.archlinux.org/packages/session-desktop-bin https://aur.archlinux.org/packages/session-desktop-appimage Note: The AUR packages all work with the profiles.
* New profile: mimetype.profile (#6247)Libravatar glitsj162024-03-19
| | | | | | Description: Determines the file type. https://metacpan.org/release/File-MimeInfo https://archlinux.org/packages/extra/any/perl-file-mimeinfo/
* New profile: tvnamer.profile (#6256)Libravatar glitsj162024-03-18
| | | | | Description: Automatic TV episode file renamer. https://github.com/dbr/tvnamer
* New profile: textroom.profile (#6254)Libravatar glitsj162024-03-18
| | | | | | | Description: Full Screen text editor heavily inspired by Q10 and JDarkRoom. https://code.google.com/p/textroom/ https://aur.archlinux.org/packages/textroom
* New profile: rymdport.profile (#6251)Libravatar glitsj162024-03-18
| | | | | | Description: Encrypted sharing of files, folders, and text between devices. https://github.com/Jacalz/rymdport
* New profile: statusof.profile (#6253)Libravatar glitsj162024-03-14
| | | | | Description: Python script to check the status of a list of URLs. https://github.com/Arthurdw/statusof
* qt6ct: add dbus-filtering rules (#6272)Libravatar glitsj162024-03-12
| | | | | | Add support for qt6ct packages that use XDG desktop portal. https://github.com/MikeWalrus/qt6ct#branch=colorscheme-portal https://aur.archlinux.org/packages/qt6ct-xdg-colorscheme-git
* torbrowser-launcher fixes (#6270)Libravatar glitsj162024-03-09
| | | | | | | | | | | | | | | Apparently Tor Browser 13.0.11 (based on Mozilla Firefox 115.8.0esr) changed a few things. The former versions installed under `${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser` and now under `${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser`. All of our tor-browser-foo.profile profiles redirect to torbrowser-launcher.profile and are covered by the fixes. torbrowser.profile was not tested. It redirects to firefox-common.profile and seems to be Gentoo-specific. Fixes #6269.
* profiles: remove blacklisting of qt5ct/qt6ct paths (#6266)Libravatar glitsj162024-03-06
| | | | | | | | Blacklisting qt5ct/qt6ct configuration and data paths breaks styling in all apps that use them. This was working as expected before #6249 and #6250, so remove the blacklisting.
* ssh: whitelist gcr-ssh-agent unix socket (#6258)Libravatar Michele Sorcinelli2024-03-05
| | | | | | | | | Since gnome-keyring 1.46, the ssh-agent functionality has been removed and gcr-ssh-agent is the recommended alternative. Source: - https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67 - https://wiki.archlinux.org/title/GNOME/Keyring#SSH_keys
* archivers: drop private-etc now that it's in archiver-common (#5655)Libravatar glitsj162024-03-05
| | | | | | | | Commit 29da82d added `private-etc` to `archiver-common.profile`. To avoid doubled options this PR removes it from archiver profiles which already had it. Relates to #5610.
* New profile: qt6ct (#6250)Libravatar glitsj162024-03-05
|
* New profile: qt5ct (#6249)Libravatar glitsj162024-03-05
|
* New profiles: lz4 and redirects (#6241)Libravatar glitsj162024-03-05
|
* virt-manager: deny access to /usr/libexec (#6238)Libravatar glitsj162024-03-05
|
* makepkg: fix ordering (#6265)Libravatar glitsj162024-03-05
|
* Merge pull request #6227 from glitsj16/virt-managerLibravatar netblue302024-02-29
|\ | | | | New profile: virt-manager
| * Create virt-manager.profileLibravatar glitsj162024-02-27
| |
* | Merge pull request #6216 from powerjungle/masterLibravatar netblue302024-02-29
|\ \ | |/ |/| multimc: instances not running, because of missing permissions
| * multimc: instances not running, because of missing permissionsLibravatar powerjungle2024-02-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting an instance, in the logs, a failed attempt to load the lwjgl library is shown and the game doesn't run. The library is in the /tmp directory. The reason for this appears to be, in the lwjgl source code, the shared library loading function, extracts in the temporary directory and continues from there. This is fixed by whitelisting. The reason for adding "ignore noexec /tmp" as well, is that without it, the game can't run, even if the directory is whitelisted. It seems the library needs to be loaded from /tmp. A second error for a failed attempt to access /home/user/.cache/JNA is also shown in the logs. This is also fixed by whitelisting.
* | profiles: drop paths already in wusc (#6218)Libravatar glitsj162024-02-23
|/ | | | Drop paths present in etc/inc/whitelist-usr-share-common.inc from profiles that include it.
* Merge pull request #6211 from glitsj16/nextcloud-fixLibravatar glitsj162024-02-19
|\ | | | | nextcloud: D-Bus filtering changes
| * nextcloud: fix the comment link to the wiki FAQLibravatar glitsj162024-02-16
| |
| * nextcloud: edit dbus comment as requested in reviewLibravatar glitsj162024-02-16
| |
| * nextcloud: harden D-Bus filteringLibravatar glitsj162024-02-16
| |
* | Merge pull request #6180 from haplo/rawtherapeeLibravatar glitsj162024-02-19
|\ \ | |/ |/| Profile for RawTherapee
| * rawtherapee.profileLibravatar Fidel Ramos2024-01-31
| |
* | tesseract.profile: add quiet (#6173)Libravatar Kelvin M. Klann2024-01-31
|/ | | | | | | | | Tesseract is a CLI program and its output may be parsed by other programs (such as `ocrmypdf`). Including messages from firejail in the output may break the parsing, so remove them. Fixes #6171. Reported-by: @kmille
* profiles: add profiles for gtk youtube viewers symlinks (#6154)Libravatar pirate4867431862024-01-19
| | | | | | | | | Committer note: For each profile there is both XXX-gtk and gtk-XXX (such as lbry-viewer-gtk and gtk-lbry-viewer). XXX-gtk is the symlink gtk-XXX is the actual file Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* profiles: use only /usr/share/lua* (#6150)Libravatar Kelvin M. Klann2024-01-08
| | | | | | | | | | | | | | | | | | To ensure that it includes luajit paths as well: * /usr/share/lua * /usr/share/luajit-2.1 And remove all entries of the same path without the wildcard, to avoid redundancy. Misc: The wildcard entries were added on commit 56b60dfd0 ("additional Lua blacklisting (#3246)", 2020-02-24) and the entries without the wildcard were partially removed on commit 721a984a5 ("Fix Lua in disable-interpreters.inc", 2020-02-24). This is a follow-up to #6128. Reported-by: @pirate486743186
* man: allow Perl (#6143)Libravatar glitsj162024-01-04
| | | gropdf (`man -Tpdf`) needs Perl (see #6142).
* Merge pull request #6128 from pirate486743186/masterLibravatar netblue302023-12-21
|\ | | | | mpv: whitelist /usr/share/mpv
| * mpv: whitelist /usr/share/mpvLibravatar pirate4867431862023-12-13
| | | | | | | | | | | | Use case: You install scripts in `/usr/share/mpv` but they remain inactive. You then symlink them to `/etc/mpv` to activate them if you want.
* | Merge pull request #6118 from NetSysFire/patch-4Libravatar netblue302023-12-21
|\ \ | | | | | | minecraft-launcher.profile: allow keyring access
| * | Use dbus-user filterLibravatar NetSysFire2023-12-08
| | |
| * | Update minecraft-launcher.profileLibravatar NetSysFire2023-12-07
| | |
* | | obs.profile: allow lua (#6131)Libravatar Kelvin M. Klann2023-12-14
| |/ |/| | | | | | | | | | | | | | | Some plugins may require it[1]: error: os_dlopen([...]): libluajit-5.1.so.2: [...]: Permission denied warning: Module '/usr//lib/obs-plugins/frontend-tools.so' not loaded [1] https://github.com/netblue30/firejail/issues/6130#issue-2040800338
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-05 11:37:34 +0000