aboutsummaryrefslogtreecommitdiffstats
path: root/etc/ssh.profile
Commit message (Collapse)AuthorAge
* Replace `nodbus` with dbus-* filtersLibravatar Fred Barclay2020-04-07
| | | | | | | | | | | | | See - 07fac581f6b9b5ed068f4c54a9521b51826375c5 for new dbus filters - https://github.com/netblue30/firejail/pull/3326#issuecomment-610423183 Except for ocenaudio, access/restrictions on dbus options should be unchanged Ocenaudio profile: dbus filters were sandboxed (initially `nodbus` was enabled) since comments indicated blocking dbus meant preferences were broken
* noblacklist ncat in ssh profileLibravatar Tad2020-04-04
| | | | nc is a symlink to ncat on some distros
* Whitelist runuser common (#3286)Libravatar rusty-snake2020-03-31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * introduce whitelist-runuser-common.inc * If an applications does not need a whitelist it can/should be nowhitelisted. Example: nowhitelist ${RUNUSER}/pulse include whitelist-runuser-common.inc * ${RUNUSER}/bus is inaccessible with nodbus regardless of the whitelist. (as it should) * strange wayland setups with an second wayland-compostior need to whitelist ${RUNUSER}/wayland-1, ${RUNUSER}/wayland-2 and so on. * some display-manager store there Xauthority file in ${RUNUSER}. test results with fedora 31: - ssdm: ~/.Xauthority is used - lightdm: /run/lightdm/USER/Xauthority - gdm: /run/user/UID/gdm/Xauthority * IMPORTANT: ATM we can only enable this for non-graphical and GTK3 programs because mutter (GNOMEs window-manger) stores the Xauthority file for Xwayland under /run/user/UID/.mutter-Xwaylandauth.XXXXXX where XXXXXX is random. Until we have whitelist globbing we can't whitelist this file. QT/KDE and other toolkits without full wayland support won't be able to start. * wru update 1 - add wru to more profiles. - blacklist ${RUNUSER} works for the most cli programs too. * add wruc to more profiles * fixes * fixes * wruc: hide pulse pid * update * remove wruc from all the x11 profiles * fixes * fix ordering * read-only * revert read-only * update *
* profiles: allow nc in ssh profile by defaultLibravatar Reiner Herrmann2019-11-13
|
* Add wusc to more profiles (#3005)Libravatar glitsj162019-10-18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add qt/qt4 support to wusc * Add wusc to more profiles * Add wusc to more profiles * Update enchant.profile * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add wusc to more profiles * Add /usr/share/ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc * Add ca-certs to wusc
* many profile fixes (1)Libravatar rusty-snake2019-08-26
| | | | | | | | | | | | | | | | - add novideo to a lot of profiles (there are still more profiles where novideo can be added) - remove commente mdwe from some gnome applications - add descriptions to some profiles - blacklist ${HOME}/.cargo/credentials - move ${HOME}/.git-credentials and ${HOME}/.git-credential-cache to 'top secret' in disable-common.inc - some ordering in disable-programs.inc - merge tor browser blacklists to ${HOME}/.tor-browser* - qupzilla.profile redirect to falkon.profile - blacklist gnome-builder paths - fix transmission profiles inlude - much more
* Tighten SSH with nodbus (#2789)Libravatar glitsj162019-06-24
| | | | | | * nodbus for ssh-agent * nodbus for ssh.profile
* consequent order of writable-*Libravatar rusty-snake2019-06-16
|
* Add comment to use tor to ssh.profileLibravatar rusty-snake2019-06-06
|
* profile hardening: add disable-exec.inc in more placesLibravatar smitsohu2019-03-15
|
* Merge pull request #2201 from SkewedZeppelin/u2f-apLibravatar netblue302018-10-17
|\ | | | | Add nou2f to all profiles
| * Add nou2f to all profilesLibravatar Tad2018-10-15
| | | | | | | | - Closes #2194
* | Remove "/etc/firejail/" from all include paths, now that profile_read will ↵Libravatar Glenn Washburn2018-10-17
|/ | | | search for the file.
* Cleanup descriptionsLibravatar Tad2018-08-13
|
* Add descriptions to profiles, pulled from Ubuntu 18.04Libravatar Tad2018-08-13
|
* Add private-cache to many profilesLibravatar Tad2018-06-14
| | | | grep "cache" -L $(grep "redirect" -iL $(grep "whitelist" -RL))
* Consistent home directory nomenclatureLibravatar Fred-Barclay2017-11-17
|
* --writable-run-user, solving ssh/gnupg authentication problems for smarcardsLibravatar netblue302017-09-14
|
* ssh fix: #1543Libravatar netblue302017-09-14
|
* Fix nodvd placementLibravatar Tad2017-08-13
|
* added nodvd to most profilesLibravatar netblue302017-08-13
|
* Fix notv placementLibravatar Tad2017-08-11
|
* added notv to most profilesLibravatar netblue302017-08-11
|
* Fix comments in 88 profilesLibravatar Tad2017-08-07
| | | | There may actually be some other comments that were removed, but the bulk have been restored
* Unify all profilesLibravatar Tad2017-08-07
|
* Initial adding of memory-deny-write-execute to profilesLibravatar Tad2017-08-02
| | | | | | | | - mdwe breaks most vm-based languages so python/java/javascript and some mono programs are not compatible - mdwe also breaks most 3d accelerated programs such as 3d games - mdwe is similar to PaX's mprotect meaning PaX flag managers can be used as reference -- See https://github.com/copperhead/paxd-archive/blob/master/paxd.conf -- See https://github.com/nning/linux-pax-flags
* fix quiet in profilesLibravatar netblue302017-06-08
|
* added /etc/firejail/globals.local for global customizationsLibravatar netblue302017-05-23
|
* Harden more profilesLibravatar Tad2017-04-17
|
* Harden 9 more profilesLibravatar Tad2017-04-16
|
* persistent support for all profile filesLibravatar netblue302017-02-09
|
* ssh fixLibravatar netblue302016-11-24
|
* Quiet SSH configLibravatar Dara Adib2016-09-19
| | | | | | | | | | | | | | firejail output in ssh client breaks git+ssh for me, e.g., $ git clone git@github.com:netblue30/firejail.git Cloning into 'firejail'... Reading profile /etc/firejail/ssh.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-passwdmgr.inc fatal: protocol error: bad line length character: Pare The "Pare" comes from "Parent pid x, child pid y".
* disable ssh-agent sockets in disable-programs.incLibravatar netblue302016-08-21
|
* merged Various #542 pull request from Fred-BarclayLibravatar netblue302016-05-31
|
* profiles: Add nonewprivs where sensibleLibravatar The Fox in the Shell2016-05-25
|
* delete blacklist wine from profilesLibravatar avoidr2016-04-12
|
* introducing disable-passwdmgr.incLibravatar netblue302016-03-28
|
* consolidated disable-terminals into disable-commonLibravatar netblue302016-03-27
|
* consolidating disable-mgmt and disable-sercret into disable-commonLibravatar netblue302016-03-26
|
* profile workLibravatar netblue302016-03-26
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-25 11:46:52 +0000