aboutsummaryrefslogtreecommitdiffstats
path: root/etc/profile-m-z
Commit message (Collapse)AuthorAge
* adapt to apparmor being opt-in for torbrowser-launcherLibravatar glitsj162021-02-15
|
* make apparmor opt-inLibravatar glitsj162021-02-15
|
* Avoid doubled include globals.localLibravatar glitsj162021-02-15
| | | The final profile in the include chain - torbrowser-launcher.profile - already includes globals.local. Unless there's some kind of potential race condition that needs to be avoided by changing this 'logic' we should avoid doubled includes.
* Avoid doubled include globals.localLibravatar glitsj162021-02-15
| | | The final profile in the include chain - torbrowser-launcher.profile - already includes globals.local. Unless there's some kind of potential race condition that needs to be avoided by changing this 'logic' we should avoid doubled includes.
* fix tor browserLibravatar netblue302021-02-14
|
* add apparmor to torbrowser-launcherLibravatar glitsj162021-02-14
|
* Revert "etc: use ${DOCUMENTS} macro where appropriate"Libravatar Kelvin M. Klann2021-02-09
| | | | | | | | | | | | | | | This reverts commit 5df1f27c638c487dfd664ea3a0f756565e1e57bd. That commit breaks things, as pointed out by @rusty-snake[1]: > @kmk3 @glitsj16 The xdg macros are treated literally if they have sub > components (#2359): > > ``` > Error: "${DOCUMENTS}/KeePassXC" is an invalid filename: rejected character: "{" > ``` [1]: https://github.com/netblue30/firejail/commit/3fa2927c3c1c5cf583864746538ea791c1ba2dc4#commitcomment-46913219
* Merge pull request #3849 from bbhtt/emailLibravatar netblue302021-02-09
|\ | | | | Email part (2)
| * Some minor changesLibravatar bbhtt2021-01-09
| |
| * Add seccomp.block-secondary to email-common,mutt,neomutt; add mdwe to ↵Libravatar bbhtt2021-01-04
| | | | | | | | mutt,neomuut; some sorting
| * Add ipc-namespace, machine-idLibravatar bbhtt2020-12-31
| |
| * Add dbus-system none back to email-common.profileLibravatar bbhtt2020-12-31
| |
| * Some sorting per @kmk3Libravatar bbhtt2020-12-31
| |
| * Rearrange and fixes per commentsLibravatar bbhtt2020-12-31
| |
| * Improve whitelisting and dbus of Sylpheed and Claws-mailLibravatar bbhtt2020-12-31
| |
| * Fix python; add read-only to editors/cli browsers;re-add cache directoryLibravatar bbhtt2020-12-29
| |
| * Add whitelisting to mutt; improve geary, new profile for neomuttLibravatar bbhtt2020-12-28
| |
* | etc: use ${DOCUMENTS} macro where appropriateLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, some paths are hard-coded: $ grep -Fnr '${HOME}/Documents' etc etc-fixes etc/profile-m-z/Mathematica.profile:19:mkdir ${HOME}/Documents/Wolfram Mathematica etc/profile-m-z/Mathematica.profile:22:whitelist ${HOME}/Documents/Wolfram Mathematica etc/profile-a-l/keepassxc.profile:34:# If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx etc/profile-a-l/keepassxc.profile:35:#mkdir ${HOME}/Documents/KeePassXC etc/profile-a-l/keepassxc.profile:36:#whitelist ${HOME}/Documents/KeePassXC Commands used to search and replace: $ find etc etc-fixes/ -type f -exec \ sed -i.bak -e 's|\${HOME}/Documents|${DOCUMENTS}|' '{}' + Related to that, the (lack of) usage of ${DOWNLOADS} has been recently fixed on commit deae31301 ("use ${DOWNLOADS} in lutris.profile (#3955)"). With the above change, all macros other than ${DOCUMENTS} seem to be already used appropriately: $ grep -Fnr '${HOME}/Desktop' etc etc-fixes $ grep -Fnr '${HOME}/Downloads' etc etc-fixes $ grep -Fnr '${HOME}/Music' etc etc-fixes $ grep -Fnr '${HOME}/Pictures' etc etc-fixes $ grep -Fnr '${HOME}/Videos' etc etc-fixes See src/firejail/macros.c for details.
* | archivers: wrap commentsLibravatar Kelvin M. Klann2021-02-08
| |
* | archivers: move archiver-common.inc include to the bottomLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | And mark it as a redirect profile. This is done so when including other *-common.inc profiles, such as firefox-common.profile.
* | fixup! Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | | | | | damn, forgotten to add
* | Update spectacle.profileLibravatar Neo000012021-02-04
| |
* | Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | | | | | | | | | blacklist ${HOME}/.vwmare is already in disable-programs.inc I did not add it to firecfg.config because it has many extra features such as usb-redirection that I could not test.
* | Merge pull request #3931 from glitsj16/follow-up-3914Libravatar glitsj162021-01-30
|\ \ | | | | | | follow-up fixes for #3914
| * | follow-up fixes for ↵Libravatar glitsj162021-01-29
| | | | | | | | | | | | https://github.com/netblue30/firejail/commit/43aa71f8c608ec5bd92fd2c7323c603fa37f6d30
* | | Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ \ \ | | | | | | | | ssh: Refactor, fix bugs & harden
| * | | allow-ssh.inc: allow access to ssh-agent(1)Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Leaving it limited to only ssh, ssh-agent and seahorse by default seems unnecessarily restrictive. From ssh(1): > The most convenient way to use public key or certificate > authentication may be with an authentication agent. See ssh-agent(1) > and (optionally) the AddKeysToAgent directive in ssh_config(5) for > more information. $ pacman -Q openssh openssh 8.4p1-2 With ssh-agent(1) running in the background (and with the private key(s) loaded through ssh-add(1)), ssh(1) doesn't need direct access to the actual key pair(s), so you could probably get away with this on allow-ssh.local: ignore noblacklist ${HOME}/.ssh noblacklist ${HOME}/.ssh/config noblacklist ${HOME}/.ssh/config.d noblacklist ${HOME}/.ssh/known_hosts And then this on the profiles of ssh key pair managers, such as seahorse.local: noblacklist ${HOME}/.ssh
| * | | ssh: deny access to the rest of /etc/ssh/*Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ssh_config (allowed on allow-ssh.inc) is the only file in /etc/ssh that is used by ssh(1). The other paths are only used by sshd(8), so stop allowing them on ssh.profile and ssh-agent.profile. Path examples from sshd(8): * /etc/ssh/moduli * /etc/ssh/ssh_host_ecdsa_key * /etc/ssh/ssh_host_ecdsa_key.pub * /etc/ssh/ssh_known_hosts * /etc/ssh/sshd_config * /etc/ssh/sshrc $ pacman -Q openssh openssh 8.4p1-2
| * | | allow-ssh.inc: allow /etc/ssh/ssh_configLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the system-wide equivalent of ~/.ssh/config. $ pacman -Q openssh openssh 8.4p1-2 Reasons for blacklisting both /etc/ssh and /etc/ssh/* on disable-common.inc: Leave /etc/ssh that way so that profiles without allow-ssh.inc remain unable to see inside of /etc/ssh. And blacklist /etc/ssh/* so that profiles with allow-ssh.inc are able to access only nonblacklisted files inside of /etc/ssh.
| * | | etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
* | | | Fix #3925 -- telegram-desktop launch browser for …Libravatar rusty-snake2021-01-29
| |/ / |/| | | | | | | | …open URL (after update to 0.9.64.2)
* | | Merge pull request #3897 from nidamanx/patch-1Libravatar rusty-snake2021-01-28
|\ \ \ | | | | | | | | Update telegram.profile
| * | | Profile ordering/sorting as in profile.templateLibravatar Nicola Davide Mannarelli2021-01-25
| | | |
| * | | Enhance securityLibravatar Nicola Davide Mannarelli2021-01-25
| | | |
| * | | Update telegram.profileLibravatar Nicola Davide Mannarelli2021-01-17
| | | | | | | | | | | | Optimized "include whitelist-common.inc"
| * | | Update telegram.profileLibravatar Nicola Davide Mannarelli2021-01-17
| | | | | | | | | | | | Allow Telegram ONLY in .TelegramDesktop, .local/share/TelegramDesktop and Downloads
* | | | streamline 'Allow xxx' comments (#3922)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add comment: allow python * add comment: allow python * reorder allow comments * fix perl allow comment * add comment: allow python * add comment: allow lua, perl & python * reorder allow comments * add comment: allow python * add comment: allow python * add comment: allow lua, perl & python * fix allow comments * add comment: allow python * add comment: allow python * fix spacing in comments * add comment: allow python * add comment: allow python * fix comment * add comment: allow perl & python * add comment: allow lua & python * add comment: allow lua, perl & python * fix allow comments * add comment: allow perl & python * streamline allow python comments
* | | | merge/readme updateLibravatar netblue302021-01-25
| | | |
* | | | fix #3914Libravatar netblue302021-01-24
| | | |
* | | | Update vmware.profile (#3913)Libravatar Neo000012021-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * Update vmware.profile `private-etc` can be uncommented. * Update vmware.profile
* | | | misc comment fixes (#3916)Libravatar glitsj162021-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * fix comment in blackbox.profile * fix comment in fluxbox.profile * fix comment in i3.profile * fix comment in krunner.profile * fix comment in openbox.profile
* | | | add new profile: pkglog (#3902)Libravatar glitsj162021-01-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add pkglog to new profiles * Create pkglog.profile * Update README.md * fix ordering in pkglog.profile * drop extra whitespace in pkglog.profile
* | | | harden plv.profile (#3901)Libravatar glitsj162021-01-18
|/ / /
* | | Add new allow include allow-bin-sh.incLibravatar rusty-snake2021-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | /bin/sh is usually just a symlink to bash. However this is not the case for every distro, debian for example uses dash. bash,dash and sh have a blacklist command in disable-shell.inc. An own allow-*.inc for it enusres usage of all necessary nolacklists. For private-bin sh is enough because it follows symlinks.
* | | newsboat: add lynx support (#3895)Libravatar altf_four2021-01-15
| | | | | | | | | | | | | | | | | | | | | * newsboat: add lynx support * newsboat: fix using sort.py * newsboat: remove unneeded perms
* | | fix mdr.profileLibravatar glitsj162021-01-13
| | | | | | | | | Thanks @rusty-snake for [spotting](https://github.com/netblue30/firejail/commit/662ebd214b0a7874072381f5aaf3fbd322f0e460) this!
* | | new profile: qnapi (#3890)Libravatar glitsj162021-01-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add new profile: qnapi * add new profile: qnapi * Create qnapi.profile * add qnapi configs * Update README.md * Update README.md
* | | add new profile: shotwell (#3889)Libravatar glitsj162021-01-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | * new profile: shotwell * Create shotwell.profile * new profile: shotwell * add shotwell blacklists
* | | new profile: mdr (#3888)Libravatar glitsj162021-01-13
| | | | | | | | | | | | | | | * add new profile: mdr * Create mdr.profile
* | | add new profiles: lsar & unar (ar redirects) (#3886)Libravatar glitsj162021-01-13
|/ / | | | | | | | | | | | | * Create lsar.profile * Create unar.profile * new profiles lsar & unar
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-08-18 06:18:26 +0000