aboutsummaryrefslogtreecommitdiffstats
path: root/etc/templates
Commit message (Collapse)AuthorAge
* landlock: use "landlock.fs." prefix in filesystem commandsLibravatar Kelvin M. Klann2024-02-27
| | | | | | | | | | | | | | | | | | | Since Landlock ABI v4 it is possible to restrict actions related to the network and potentially more areas will be added in the future. So use `landlock.fs.` as the prefix in the current filesystem-related commands (and later `landlock.net.` for the network-related commands) to keep them organized and to match what is used in the kernel. Examples of filesystem and network access flags: * `LANDLOCK_ACCESS_FS_EXECUTE`: Execute a file. * `LANDLOCK_ACCESS_FS_READ_DIR`: Open a directory or list its content. * `LANDLOCK_ACCESS_NET_BIND_TCP`: Bind a TCP socket to a local port. * `LANDLOCK_ACCESS_NET_CONNECT_TCP`: Connect an active TCP socket to a remote port. Relates to #6078.
* landlock: split .special into .makeipc and .makedevLibravatar Kelvin M. Klann2024-02-02
| | | | | | | | | | | | | | | | | | | | | As discussed with @topimiettinen[1], it is unlikely that an unprivileged process would need to directly create block or character devices. Also, `landlock.special` is not very descriptive of what it allows. So split `landlock.special` into: * `landlock.makeipc`: allow creating named pipes and sockets (which are usually used for inter-process communication) * `landlock.makedev`: allow creating block and character devices Misc: The `makedev` name is based on `nodev` from mount(8), which makes mount not interpret block and character devices. `ipc` was suggested by @rusty-snake[2]. Relates to #6078. [1] https://github.com/netblue30/firejail/pull/6078#pullrequestreview-1740569786 [2] https://github.com/netblue30/firejail/pull/6187#issuecomment-1924107294
* landlock: move commands into profile and add landlock.enforceLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | | | | | | | | | | | | | Changes: * Move commands from --landlock and --landlock.proc= into etc/inc/landlock-common.inc * Remove --landlock and --landlock.proc= * Add --landlock.enforce Instead of hard-coding the default commands (and having a separate command just for /proc), move them into a dedicated profile to make it easier for users to interact with the entries (view, copy, add ignore entries, etc). Only enforce the Landlock commands if --landlock.enforce is supplied. This allows safely adding Landlock commands to (upstream) profiles while keeping their enforcement opt-in. It also makes it simpler to effectively disable all Landlock commands, by using `--ignore=landlock.enforce`. Relates to #6078.
* profiles: exchange private-opt with a whitelist (#6021)Libravatar glitsj162023-10-18
| | | | | | | | | | | | | * profiles: drop private-opt (existing whitelist) * profiles: replace private-opt with whitelist In most profiles. Kept private-opt for enpass (~85MB), mate-dictionary (<20MB), minecraft-launcher (~1.6MB) and ppsspp (~44MB). The only app I couldn't check: xmr-stak. * docs: note potential issues with private-opt
* Fix wrong syscall names for s390_pci_mmio_{read,write}Libravatar Topi Miettinen2023-08-26
| | | | Closes #5965
* modif: drop deprecated 'shell' option references (#5894)Libravatar glitsj162023-07-19
| | | | | | | | | | | | The `shell` option has been removed. Remove stale references. This does NOT remove `shell none`-related code comments in: - src/firejail/fs_lib.c (L433-L441) - src/firejail/join.c (L415-L417) Relates to #5196. Suggested by #5891.
* profile.template: note to put read-only entries in dcLibravatar Kelvin M. Klann2023-03-29
|
* Update DBus wiki linkLibravatar Dpeta2022-12-23
|
* introduce new option restrict-namespacesLibravatar smitsohu2022-07-23
|
* refresh syscall groups (#5188)Libravatar smitsohu2022-07-17
| | | | | | | | | | | | now covers syscalls up to including process_madvise (440) group assignment was blindly copied from systemd: https://github.com/systemd/systemd/blob/729d2df8065ac90ac606e1fff91dc2d588b2795d/src/shared/seccomp-util.c#L305 the only exception is close_range, which was added to both @basic-io and @file-system this commit adds the following syscalls to the default blacklist: pidfd_getfd,fsconfig,fsmount,fsopen,fspick,move_mount,open_tree
* Fix chromium browsers in firejail 0.9.68Libravatar rusty-snake2022-04-14
| | | | closes #4965
* profile.template: add noprintersLibravatar Kelvin M. Klann2022-01-05
| | | | | | | See commit bd15e763e ("--noprinter option", 2021-10-20) and commit d9403dcdc ("small fix", 2021-10-20). Relates to #4607.
* deterministic-shutdown optionLibravatar smitsohu2021-10-28
|
* Merge pull request #4521 from rusty-snake/disable-proc.incLibravatar smitsohu2021-10-20
|\ | | | | Create disable-proc.inc
| * Create disable-proc.incLibravatar rusty-snake2021-09-09
| |
* | fix spelling (#4573)Libravatar a13460542021-09-22
|/
* Update profile.template to use disable-X11.incLibravatar rusty-snake2021-09-08
|
* add disable-X11.inc to profile templateLibravatar Reiner Herrmann2021-08-14
|
* Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | follow up
* Add wru to firefox-common, chromium-common and profile.templateLibravatar rusty-snake2021-08-04
| | | | | | | Still unresolved: > If someone who use systemd-resolved can say more which resolv.conf is necessary on such system. > whitelist /run/systemd/resolve/resolv.conf > whitelist /run/systemd/resolve/stub-resolv.conf
* Profile fixesLibravatar rusty-snake2021-08-04
| | | | | | | | | | - Fix #4157 -- [Feature] Should rmenv GitHub auth tokens There are still more token variables from other program that should be added. - Fix #4093 -- darktable needs read access to liblua* - Fix #4383 -- move noblacklist ${HOME}/.bogofilter to email-common.profile for claws-mail (and other mailers) - Fix xournalpp.profile - syscalls.txt: ausyscall i386 -> firejail --debug-syscalls32
* Update etc/templates/syscalls.txtLibravatar rusty-snake2021-07-28
| | | | Rework + suggest --seccomp-error-action=log
* Merge pull request #4375 from smitsohu/kcmpLibravatar netblue302021-06-27
|\ | | | | remove kcmp from seccomp default drop list
| * remove kcmp from seccomp default drop list (#3219)Libravatar smitsohu2021-06-26
| |
* | Fix sort error in profile.template (#4334)Libravatar pirate4867431862021-06-04
|/
* Update profile.templateLibravatar rusty-snake2021-06-03
| | | | | | | | | The header of profile.template define this order: IGNORES NOBLACKLISTS ALLOW INCLUDES BLACKLISTS DISABLE INCLUDES
* Add read-write to profile.templateLibravatar rusty-snake2021-05-16
|
* Update profile.templateLibravatar rusty-snake2021-05-13
| | | | Clarify some options that supersede others.
* Stying fixes (mrrescue.profile, pingus.profile, profile.template)Libravatar rusty-snake2021-05-05
|
* Add noinput to all profiles with private-devLibravatar rusty-snake2021-05-05
|
* Add allow-bin-sh.inc to profile.templateLibravatar rusty-snake2021-04-17
| | | | [skip ci]
* Fix typo policiesLibravatar Ted Robertson2021-03-13
|
* Merge pull request #4084 from tredondo/patch-4Libravatar glitsj162021-03-11
|\ | | | | Clarify what the Description comment is for
| * Clarify what the Description comment is forLibravatar Ted Robertson2021-03-11
| |
* | Improve EnglishLibravatar Ted Robertson2021-03-11
|/
* fixesLibravatar rusty-snake2021-03-01
| | | | | | | | | | | | | - RELNOTS: protocol now accumulates - fix #3978 -- Android Studio: cannot create the directory Unresolved: > google-earth.profile has a 'noblacklist ${HOME}/.config/Google' too, > so we should consider to add additional blacklists for ~/.config/Google/*. - marker.profile: allow ${DOCUMENTS} - profile.template: add bluetooth protocol - profile.template: add DBus portal note - firejail-profile.txt: revert 17fe4b9e -- fix private=directory in man firejail-profile see https://github.com/netblue30/firejail/pull/3970#discussion_r574411745
* fix Common-ExtraLibravatar glitsj162021-02-17
| | | See https://github.com/netblue30/firejail/pull/3993/files/660bc3435b43e32d156d9bb5bee2dbad2f84cf36#r577366805.
* fix ordering in profile.templateLibravatar glitsj162021-02-16
|
* miscellaneous fixes to profile.templateLibravatar glitsj162021-02-16
|
* add support for faccessat2 syscallLibravatar glitsj162021-02-10
|
* Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ | | | | ssh: Refactor, fix bugs & harden
| * etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
* | Add 'seccomp-error-action log' to profile.templateLibravatar rusty-snake2021-01-18
|/
* update manpages and RELNOTESLibravatar rusty-snake2021-01-08
|
* from my overridesLibravatar rusty-snake2020-11-16
| | | | | | | | - add seccomp.block-secondary to a lot profiles - add wruc to firefox-common and ignore it in TB and firefox-common-addons - harden dia, gnome-keyring, libreoffice, megaglest, pngquant, ghostwriter, rhythmbox, sqlitebrowser
* New disable include: disable-write-mnt.inc (#3622)Libravatar rusty-snake2020-09-07
| | | | | | | | | | | | | * New disable include: disable-write-mnt.inc It is for profiles which have a reasonable mnt access (we can not add disable-mnt), but no edit function (e.g. any kind of viewer). Added to - profile.template - default.profile - eo-common.profile * Update default.profile
* #3106-1, include @mount in @default insted of all the syscallsLibravatar rusty-snake2020-09-01
|
* disable-shell.inc (#3411)Libravatar rusty-snake2020-06-04
| | | | | | | | | | | | * disable-shell.inc * add disable-shell.inc to all profiles with a … … private-bin line without bash/sh except profiles with redirect profiles. * add it to some more profiles * exclude aria2c.profile
* dbus filter profiles (1) (#3326)Libravatar rusty-snake2020-05-02
| | | | | | | * dbus filter (1) * dbus-filter: firefox * drop org.gtk.vfs and com.canonical.AppMenu.Registrar
* add sthortwave (#1139) and remove gjs from firecf…Libravatar rusty-snake2020-04-13
| | | | …g.config (#3333).
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-20 01:44:59 +0000