firejail - Mirror of https://github.com/netblue30/firejail

	Commit message (Collapse)	Author	Age
*	Whitelist runuser common (#3286)	rusty-snake	2020-03-31
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* introduce whitelist-runuser-common.inc * If an applications does not need a whitelist it can/should be nowhitelisted. Example: nowhitelist ${RUNUSER}/pulse include whitelist-runuser-common.inc * ${RUNUSER}/bus is inaccessible with nodbus regardless of the whitelist. (as it should) * strange wayland setups with an second wayland-compostior need to whitelist ${RUNUSER}/wayland-1, ${RUNUSER}/wayland-2 and so on. * some display-manager store there Xauthority file in ${RUNUSER}. test results with fedora 31: - ssdm: ~/.Xauthority is used - lightdm: /run/lightdm/USER/Xauthority - gdm: /run/user/UID/gdm/Xauthority * IMPORTANT: ATM we can only enable this for non-graphical and GTK3 programs because mutter (GNOMEs window-manger) stores the Xauthority file for Xwayland under /run/user/UID/.mutter-Xwaylandauth.XXXXXX where XXXXXX is random. Until we have whitelist globbing we can't whitelist this file. QT/KDE and other toolkits without full wayland support won't be able to start. * wru update 1 - add wru to more profiles. - blacklist ${RUNUSER} works for the most cli programs too. * add wruc to more profiles * fixes * fixes * wruc: hide pulse pid * update * remove wruc from all the x11 profiles * fixes * fix ordering * read-only * revert read-only * update *
*	fixes for 'blacklist ${RUNUSER}/wayland-*' (#3166)	glitsj16	2020-01-18
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* unbreak audio-recorder Support both X11 and Wayland by default. Users can add 'blacklist ${RUNUSER}/wayland-' or 'x11 none' in their audio-recorder.local. unbreak ddgtk Support both X11 and Wayland by default. Users can add 'blacklist ${RUNUSER}/wayland-' or 'x11 none' in their ddgtk.local. unbreak and harden gconf-editor Support both X11 and Wayland by default. Also whitelist /usr/share/gconf-editor for wusc. * unbreak seahorse Support both X11 and Wayland by default. * add blacklist ${RUNUSER}/wayland-* to dnscrypt-proxy
*	add 'blacklist ${RUNUSER}/wayland-*' to all profi…	rusty-snake	2020-01-18
\| \| \| \|	…les with 'blacklist /tmp/.X11-unix'
*	fix seahorse-tool	rusty-snake	2019-12-19
\|
*	Add wusc to more profiles (#3005)	glitsj16	2019-10-18
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add qt/qt4 support to wusc * Add wusc to more profiles * Add wusc to more profiles * Update enchant.profile * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add /usr/share/ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc
*	remove ~/.config/dconf from whitelist-common.inc	rusty-snake	2019-09-05
\| \| \| \| \|	- dconf database is read-only (fde6e04b) and accessed over dbus, there are no reasons to keep it in the sandbox
*	noblacklist but no blacklist (#2886)	rusty-snake	2019-08-19
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* beginn fixup * continue * continue * continue * continue * continue * continue
*	Put 'blacklist /tmp/.X11-unix' in seahorse.profile	glitsj16	2019-07-01
\|
*	More sorting private-etc (#2779)	glitsj16	2019-06-15
\| \| \| \| \| \| \| \|	* Sort private-etc This .inc file got missed by https://github.com/netblue30/firejail/pull/2766. * Sort private-etc
*	Use private-etc directly	glitsj16	2019-06-15
\| \| \|	Thanks to @rusty-snake for pointing this out.
*	Re-order seahorse profile	glitsj16	2019-06-15
\|
*	many profile cleanups (3)	rusty-snake	2019-06-02
\|
*	Re-add 'shell none' to gpg.profile (#2716)	glitsj16	2019-05-21
\| \| \| \| \| \|	* Re-add 'shell none' to gpg.profile * Update seahorse.profile
*	Seahorse revisited (#2600)	glitsj16	2019-03-16
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* Refactor seahorse into a whitelist profile * Refactor seahorse-tool as a whitelist profile * Create seahorse-daemon.profile * Add seahorse-daemon to firecfg * Drop blacklist /tmp/.X11-unix from seahorse.profile Thanks to @rusty-snake for pointing out blacklisting /tmp/.X11-unix is ridiculous for GUI's. * Add non-GUI option to seahorse-daemon
*	Fix seahorse.profile seahorse-tool.profile (#2599)	rusty-snake	2019-03-15
\|
*	Fixes for seahorse/seahorse-tool (#2592)	glitsj16	2019-03-14
\| \| \| \| \| \|	* Fix seahorse GUI * Fix seahorse-tool GUI
*	add disable-exec.inc to all profiles with apparmor (#2576)	smitsohu	2019-03-12
\| \| \| \| \| \|	* add disable-exec.inc to all profiles with apparmor - #2385 #2505 * drop disable-exec.inc from generic electron.profile
*	Add new profile for seahorse (#2491)	glitsj16	2019-03-01
	* Create seahorse.profile * Create seahorse-tool.profile * Add seahorse to firecfg