aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-m-z
Commit message (Collapse)AuthorAge
* profiles: deny access to ~/.config/autostart (#6257)Libravatar Kelvin M. Klann2024-03-24
| | | | | | | | | | The files in this directory are intended to be automatically executed when the user logs in. In which case, granting write access to this directory allows the program to easily escape the sandbox (by autostarting itself outside of firejail, for example). Misc: This was noticed on #6244.
* New profile: tqemu.profile (#6255)Libravatar glitsj162024-03-23
| | | | | Description: QEMU frontend without libvirt. https://github.com/thanoulis/tqemu
* New profile: metadata-cleaner.profile (#6246)Libravatar glitsj162024-03-20
| | | | | | Description: Python GTK3 application to view and clean metadata in files, using mat2. https://gitlab.com/rmnvgr/metadata-cleaner
* remove porn-cli.profile (#6284)Libravatar pirate4867431862024-03-20
| | | Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* Rename etc/session-desktop.profile to etc/profile-m-z/session-desktop.profileLibravatar glitsj162024-03-19
|
* New profile: session-desktop.profile (#6259)Libravatar glitsj162024-03-19
| | | | | | | | | | Description: Encrypted messenger. https://github.com/oxen-io/session-desktop/ https://aur.archlinux.org/packages/session-desktop https://aur.archlinux.org/packages/session-desktop-bin https://aur.archlinux.org/packages/session-desktop-appimage Note: The AUR packages all work with the profiles.
* New profile: mimetype.profile (#6247)Libravatar glitsj162024-03-19
| | | | | | Description: Determines the file type. https://metacpan.org/release/File-MimeInfo https://archlinux.org/packages/extra/any/perl-file-mimeinfo/
* New profile: tvnamer.profile (#6256)Libravatar glitsj162024-03-18
| | | | | Description: Automatic TV episode file renamer. https://github.com/dbr/tvnamer
* New profile: textroom.profile (#6254)Libravatar glitsj162024-03-18
| | | | | | | Description: Full Screen text editor heavily inspired by Q10 and JDarkRoom. https://code.google.com/p/textroom/ https://aur.archlinux.org/packages/textroom
* New profile: rymdport.profile (#6251)Libravatar glitsj162024-03-18
| | | | | | Description: Encrypted sharing of files, folders, and text between devices. https://github.com/Jacalz/rymdport
* New profile: statusof.profile (#6253)Libravatar glitsj162024-03-14
| | | | | Description: Python script to check the status of a list of URLs. https://github.com/Arthurdw/statusof
* qt6ct: add dbus-filtering rules (#6272)Libravatar glitsj162024-03-12
| | | | | | Add support for qt6ct packages that use XDG desktop portal. https://github.com/MikeWalrus/qt6ct#branch=colorscheme-portal https://aur.archlinux.org/packages/qt6ct-xdg-colorscheme-git
* torbrowser-launcher fixes (#6270)Libravatar glitsj162024-03-09
| | | | | | | | | | | | | | | Apparently Tor Browser 13.0.11 (based on Mozilla Firefox 115.8.0esr) changed a few things. The former versions installed under `${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser_en-US/Browser` and now under `${HOME}/.local/share/torbrowser/tbb/x86_64/tor-browser/Browser`. All of our tor-browser-foo.profile profiles redirect to torbrowser-launcher.profile and are covered by the fixes. torbrowser.profile was not tested. It redirects to firefox-common.profile and seems to be Gentoo-specific. Fixes #6269.
* profiles: remove blacklisting of qt5ct/qt6ct paths (#6266)Libravatar glitsj162024-03-06
| | | | | | | | Blacklisting qt5ct/qt6ct configuration and data paths breaks styling in all apps that use them. This was working as expected before #6249 and #6250, so remove the blacklisting.
* ssh: whitelist gcr-ssh-agent unix socket (#6258)Libravatar Michele Sorcinelli2024-03-05
| | | | | | | | | Since gnome-keyring 1.46, the ssh-agent functionality has been removed and gcr-ssh-agent is the recommended alternative. Source: - https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67 - https://wiki.archlinux.org/title/GNOME/Keyring#SSH_keys
* archivers: drop private-etc now that it's in archiver-common (#5655)Libravatar glitsj162024-03-05
| | | | | | | | Commit 29da82d added `private-etc` to `archiver-common.profile`. To avoid doubled options this PR removes it from archiver profiles which already had it. Relates to #5610.
* New profile: qt6ct (#6250)Libravatar glitsj162024-03-05
|
* New profile: qt5ct (#6249)Libravatar glitsj162024-03-05
|
* New profiles: lz4 and redirects (#6241)Libravatar glitsj162024-03-05
|
* virt-manager: deny access to /usr/libexec (#6238)Libravatar glitsj162024-03-05
|
* makepkg: fix ordering (#6265)Libravatar glitsj162024-03-05
|
* Merge pull request #6227 from glitsj16/virt-managerLibravatar netblue302024-02-29
|\ | | | | New profile: virt-manager
| * Create virt-manager.profileLibravatar glitsj162024-02-27
| |
* | Merge pull request #6216 from powerjungle/masterLibravatar netblue302024-02-29
|\ \ | |/ |/| multimc: instances not running, because of missing permissions
| * multimc: instances not running, because of missing permissionsLibravatar powerjungle2024-02-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting an instance, in the logs, a failed attempt to load the lwjgl library is shown and the game doesn't run. The library is in the /tmp directory. The reason for this appears to be, in the lwjgl source code, the shared library loading function, extracts in the temporary directory and continues from there. This is fixed by whitelisting. The reason for adding "ignore noexec /tmp" as well, is that without it, the game can't run, even if the directory is whitelisted. It seems the library needs to be loaded from /tmp. A second error for a failed attempt to access /home/user/.cache/JNA is also shown in the logs. This is also fixed by whitelisting.
* | profiles: drop paths already in wusc (#6218)Libravatar glitsj162024-02-23
|/ | | | Drop paths present in etc/inc/whitelist-usr-share-common.inc from profiles that include it.
* Merge pull request #6211 from glitsj16/nextcloud-fixLibravatar glitsj162024-02-19
|\ | | | | nextcloud: D-Bus filtering changes
| * nextcloud: fix the comment link to the wiki FAQLibravatar glitsj162024-02-16
| |
| * nextcloud: edit dbus comment as requested in reviewLibravatar glitsj162024-02-16
| |
| * nextcloud: harden D-Bus filteringLibravatar glitsj162024-02-16
| |
* | Merge pull request #6180 from haplo/rawtherapeeLibravatar glitsj162024-02-19
|\ \ | |/ |/| Profile for RawTherapee
| * rawtherapee.profileLibravatar Fidel Ramos2024-01-31
| |
* | tesseract.profile: add quiet (#6173)Libravatar Kelvin M. Klann2024-01-31
|/ | | | | | | | | Tesseract is a CLI program and its output may be parsed by other programs (such as `ocrmypdf`). Including messages from firejail in the output may break the parsing, so remove them. Fixes #6171. Reported-by: @kmille
* profiles: add profiles for gtk youtube viewers symlinks (#6154)Libravatar pirate4867431862024-01-19
| | | | | | | | | Committer note: For each profile there is both XXX-gtk and gtk-XXX (such as lbry-viewer-gtk and gtk-lbry-viewer). XXX-gtk is the symlink gtk-XXX is the actual file Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* profiles: use only /usr/share/lua* (#6150)Libravatar Kelvin M. Klann2024-01-08
| | | | | | | | | | | | | | | | | | To ensure that it includes luajit paths as well: * /usr/share/lua * /usr/share/luajit-2.1 And remove all entries of the same path without the wildcard, to avoid redundancy. Misc: The wildcard entries were added on commit 56b60dfd0 ("additional Lua blacklisting (#3246)", 2020-02-24) and the entries without the wildcard were partially removed on commit 721a984a5 ("Fix Lua in disable-interpreters.inc", 2020-02-24). This is a follow-up to #6128. Reported-by: @pirate486743186
* man: allow Perl (#6143)Libravatar glitsj162024-01-04
| | | gropdf (`man -Tpdf`) needs Perl (see #6142).
* Merge pull request #6128 from pirate486743186/masterLibravatar netblue302023-12-21
|\ | | | | mpv: whitelist /usr/share/mpv
| * mpv: whitelist /usr/share/mpvLibravatar pirate4867431862023-12-13
| | | | | | | | | | | | Use case: You install scripts in `/usr/share/mpv` but they remain inactive. You then symlink them to `/etc/mpv` to activate them if you want.
* | Merge pull request #6118 from NetSysFire/patch-4Libravatar netblue302023-12-21
|\ \ | | | | | | minecraft-launcher.profile: allow keyring access
| * | Use dbus-user filterLibravatar NetSysFire2023-12-08
| | |
| * | Update minecraft-launcher.profileLibravatar NetSysFire2023-12-07
| | |
* | | obs.profile: allow lua (#6131)Libravatar Kelvin M. Klann2023-12-14
| |/ |/| | | | | | | | | | | | | | | Some plugins may require it[1]: error: os_dlopen([...]): libluajit-5.1.so.2: [...]: Permission denied warning: Module '/usr//lib/obs-plugins/frontend-tools.so' not loaded [1] https://github.com/netblue30/firejail/issues/6130#issue-2040800338
* | steam.profile: Allow Project Zomboid (#6117)Libravatar archaon6162023-12-11
|/
* Merge pull request #6070 from kmk3/sort-py-csortLibravatar netblue302023-11-24
|\ | | | | build: sort.py: use case-sensitive sorting
| * build: sort.py: use case-sensitive sortingLibravatar Kelvin M. Klann2023-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To match how things are sorted elsewhere, such as with `noblacklist` / `whitelist` lines (vertically) in profiles and in ci/check/profiles/sort-disable-programs.sh and src/etc-cleanup/main.c. This makes the order in `private-etc` always be groups (`@group`), then uppercase paths, then lowercase paths. Example from etc/profile-m-z/softmaker-common.profile: private-etc @tls-ca,SoftMaker,fstab Note that this does not affect a significant amount of profiles; most changes are in `private-bin` / `private-lib` lines and in `private-etc` lines for newer profiles that do not use groups. This is partly due to commit 5d0822c52 ("private-etc: big profile changes", 2023-02-05) replacing `X11` with `@x11` in `private-etc` lines and then commit 0f996ea4d ("private-etc: groups modified", 2023-02-05) removing `Trolltech.conf` from `private-etc` lines and using case-sensitive sorting in them. Relates to #5610.
* | Merge pull request #6066 from nutta-git/patch-1Libravatar netblue302023-11-24
|\ \ | | | | | | steam.profile: allow process_vm_readv syscall
| * | steam.profile: allow process_vm_readv syscallLibravatar duevo2023-10-31
| | | | | | | | | | | | | | | | | | EA Origin (game launcher) won't launch without this. See https://github.com/netblue30/firejail/issues/5185#issuecomment-1776516159
* | | profiles: whitelist alternative data directory for tesseractLibravatar Reiner Herrmann2023-11-18
| | | | | | | | | | | | on Debian the data is in /usr/share/tesseract-ocr/
* | | New profile: tiny-rdm (#6083)Libravatar glitsj162023-11-11
| |/ |/| | | | | | | | | | | * disable-programs.inc: add support for tiny-rdm * Create tiny-rdm.profile * firecfg.config: add support for tiny-rdm
* | profiles: Extend node stack support for pnpm (#6063)Libravatar glitsj162023-10-24
|/ | | | | | | | | * nodejs-common: add pnpm support * disable-programs.inc: add pnpm support * Create pnpm.profile * Create pnpx.profile
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-02 14:28:04 +0000