Commit message (Collapse) | Author | Age | |
---|---|---|---|
* | Streamline 'Allow python' options (#2588) | 2019-03-13 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Fix 'allow python' in xpra * Fix 'allow python' in xplayer * Fix 'allow python' in xed * Fix 'allow python' in uzbl-browser * Fix 'allow python' in transmission-remote-cli * Fix 'allow python' in torbrowser-launcher * fix 'allow python' in subdownloader * Fix 'allow python' in steam * Fix 'allow python' in soundconverter * Fix 'allow python' in sdat2img * Fix 'allow python' in scribus * Fix 'allow python' in ranger * Fix 'allow python' in qutebrowser * Fix 'allow python' in qbittorrent * Fix 'allow python' in pybitmessage * Fix 'allow python' in playonlinux * Fix 'allow python' in pitivi * Fix 'allow python' in pithos * Fix 'allow python' in picard * Fix 'allow python' in openshot * Fix 'allow python' in onionshare-gui * Fix 'allow python' in obs * Fix 'allow python' in nitroshare * Fix 'allow python' in nemo * Fix 'allow python' in nautilus * Fix 'allow python' in natron * Fix 'allow python' in ms-office * Fix 'allow python' in mpDris2 * Fix 'allow python' in mendeleydesktop * Fix 'allow python' in macrofusion * Fix 'allow python' in lollypop * Fix 'allow python' in liferea * Fix 'allow python' in krita * Fix 'allow python' in kodi * Fix 'allow python' in inkscape * Fix 'allow python' in hexchat * Fix 'allow python' in gnome-schedule * Fix 'allow python' in gnome-music * Fix 'allow python' in gconf * Fix 'allow python' in gajim * Fix 'allow python' in font-manager * Fix 'allow python' in fontforge * Fix 'allow python' in flowblade * Fix 'allow python' in filezilla * Fix 'allow python' in exfalso * Fix 'allow python' in electrum * Fix 'allow python' in display * Fix 'allow python' in d-feet * Fix 'allow python' in deluge * Fix 'allow python' in cherrytree * Fix 'allow python' in catfish * Fix 'allow python' in caja * Fix 'allow python' in blender * Fix 'allow python' in bleachbit * Fix 'allow python' in authenticator * Fix 'allow python' in arm | ||
* | Add alternatives to private-etc for profiles in etc/ | 2019-02-17 | |
| | | | | See discussion in #2399 | ||
* | Merge pull request #2201 from SkewedZeppelin/u2f-ap | 2018-10-17 | |
|\ | | | | | Add nou2f to all profiles | ||
| * | Add nou2f to all profiles | 2018-10-15 | |
| | | | | | | | | - Closes #2194 | ||
* | | Remove "/etc/firejail/" from all include paths, now that profile_read will ↵ | 2018-10-17 | |
|/ | | | | search for the file. | ||
* | Minor fixes | 2018-10-11 | |
| | |||
* | Update steam.profile to support proton/steamplay | 2018-08-21 | |
| | |||
* | Minor steam.profile fixup from downstream ParrotSec fork | 2018-08-19 | |
| | |||
* | Add descriptions to profiles, pulled from Ubuntu 18.04 | 2018-08-13 | |
| | |||
* | Add a profile alias for firefox-wayland | 2018-05-29 | |
| | | | | | | | firefox-wayland is a new wrapper script included with Firefox on Fedora 28 it has firefox hardcoded as /usr/bin/firefox + some minor fixes in other profiles | ||
* | allow java in some profiles | 2018-04-12 | |
| | |||
* | WIP: Blacklist common programming interpreters. (#1837) | 2018-04-02 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * Add xreader thumbnailer and previewer profiles * Add xplayer audio-preview and thumbnailer profiles * Add atril thumbnailer and previewer profiles * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * --nodbus, first draft for #1825 * dbus.c * rework akonadi integration the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). * Add nodbus to some profiles - part 1 * Spotify works with nodbus on Arch * Enable nodbus for keepassx and keepassxc profiles. I've tested on keepassxc but should work for keepassx as well. Settings are not immutable. * recalibrate dbus access, deploy nodbus option see #1822 and #1825. also systematically replaces 'blacklist /run/user/*/bus' with 'nodbus'. with contributions from @Fred-Barclay * various blacklist additions * Add a profile for ncdu, enable private-etc in Steam again, and fixup gnome-recipes * comment nodbus where it interferes with dconf pending further discussion * Add a disabled and extensive private-bin for Steam * Further improve private-bin in steam * comment apparmor, net where they interfere with dconf - #1843 * gnome-calculator fixup * spectre support for clang compiler * spectre clang support * enable/disable dbus handling in /etc/firejail/firejail.config * nodbus man pages, etc. * redirect knotes to kmail, some tweaks * testing * gimp fixup * Even more fixups after adding disable-interpreters.inc * AWS and GCP store credentials in local directories as part of project setup. Configuration for cloud providers is sensitive information; it should be in the default block list. I didn't see profiles for gcloud or awscli, so haven't added any exclusions. boto and kubectl are not provider-specific, but also store credentials for whichever platforms they happen to be being used with. * testing * consolidate makefiles * gitignore * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * Cleanup rebase leftovers * imagej doesn't need javac access * Add cc to blacklisted compilers * Use wildcards when blacklisting some gcc paths * Blacklist lua in disable-interpreters * Correct blacklist for node.js * Fred Barclay note: some of these commits (all of the ones that don't affect files inside etc/) aren't mine but were added during a rebase + squash | ||
* | Further improve private-bin in steam | 2018-03-30 | |
| | |||
* | Add a disabled and extensive private-bin for Steam | 2018-03-29 | |
| | |||
* | Add a profile for ncdu, enable private-etc in Steam again, and fixup ↵ | 2018-03-28 | |
| | | | | gnome-recipes | ||
* | Add whitelist-var-common to 4 profiles | 2018-01-21 | |
| | |||
* | Add crypto-policies to private-etc in all profiles with private-etc *ssl* | 2018-01-15 | |
| | | | | | | Seems to be necessary under Fedora like pki This also fixes an issue with no audio in Lollypop on Fedora | ||
* | Add pki to private-etc in all profiles with private-etc *ssl* | 2018-01-15 | |
| | |||
* | Add iana-etc's services to private-etc in steam.profile, fixes #1688 | 2017-12-22 | |
| | |||
* | Comment private-etc on Steam | 2017-09-25 | |
| | |||
* | fix usage of STEAM_RUNTIME_PREFER_HOST_LIBRARIES=1 in steam.profile | 2017-09-18 | |
| | | | | | | steam.sh executes `/sbin/ldconfig -XNv 2> /dev/null` when STEAM_RUNTIME_PREFER_HOST_LIBRARIES is not zero and fails in some cases (see https://github.com/ValveSoftware/steam-for-linux/issues/4768) because of blacklisted /sbin and missing ld.so.conf{,.d} https://steamcommunity.com/groups/SteamClientBeta/announcements/detail/586991182161672256 | ||
* | Fix Steam regressions | 2017-08-22 | |
| | |||
* | Fix nodvd placement | 2017-08-13 | |
| | |||
* | added nodvd to most profiles | 2017-08-13 | |
| | |||
* | Fix notv placement | 2017-08-11 | |
| | |||
* | added notv to most profiles | 2017-08-11 | |
| | |||
* | Fix comments in 88 profiles | 2017-08-07 | |
| | | | | There may actually be some other comments that were removed, but the bulk have been restored | ||
* | Unify all profiles | 2017-08-07 | |
| | |||
* | fix steam startup with >=llvm-4 | 2017-08-06 | |
| | |||
* | Fix .java after e2449ae7d25925cec444ac08bbfb9cbc7199e647 | 2017-07-13 | |
| | |||
* | profiles: tracelog breaks integrated browser in steam | 2017-07-11 | |
| | | | | | Thanks to @viq for the hint. Fixes: #1280 | ||
* | Harden 50 profiles | 2017-07-04 | |
| | | | | | Hardened many profiles using disable-mnt and novideo Fixed gnome-font-viewer | ||
* | profiles: steampath/pid were blacklisted in disable-programs, but not ↵ | 2017-06-26 | |
| | | | | | | | allowed in steam profile Probably related to #1280. Reported also in https://bugs.debian.org/866014 | ||
* | commented out ipc-namespace in most profiles - it breaks newer versions of ↵ | 2017-05-25 | |
| | | | | GDK with the following error: Gdk-ERROR **: The program 'thunderbird' received an X Window System error | ||
* | added /etc/firejail/globals.local for global customizations | 2017-05-23 | |
| | |||
* | Potential fix for #1280 | 2017-05-19 | |
| | | | | Many steam directories can begin with either lower- or upper-case 's'. | ||
* | Harden more profiles | 2017-04-17 | |
| | |||
* | Harden 9 more profiles | 2017-04-16 | |
| | |||
* | Harden Steam | 2017-04-15 | |
| | |||
* | persistent support for all profile files | 2017-02-09 | |
| | |||
* | Add netlink to --protocols in steam profile | 2016-09-17 | |
| | | | | Fixes #779 | ||
* | merged Various #542 pull request from Fred-Barclay | 2016-05-31 | |
| | |||
* | profiles: Add nonewprivs where sensible | 2016-05-25 | |
| | |||
* | introducing disable-passwdmgr.inc | 2016-03-28 | |
| | |||
* | consolidated disable-terminals into disable-common | 2016-03-27 | |
| | |||
* | consolidating disable-mgmt and disable-sercret into disable-common | 2016-03-26 | |
| | |||
* | profile work | 2016-03-26 | |
| | |||
* | split out terminal blacklisting in disable-terminals.inc | 2016-02-12 | |
| | |||
* | tracelog fixes | 2015-12-06 | |
| | |||
* | traclog added to various profiles | 2015-12-06 | |
| |