aboutsummaryrefslogtreecommitdiffstats
path: root/etc/templates
Commit message (Collapse)AuthorAge
* profiles: add allow-nodejs.inc to profile.template (#6298)Libravatar Kelvin M. Klann2024-03-30
| | | | | | | To make it consistent with the other include profiles. See etc/templates/profile.template. Relates to #3866 #5881.
* profiles: rename disable-X11.inc to disable-x11.inc (#6294)Libravatar Kelvin M. Klann2024-03-27
| | | | | | | | | | | | | | | | | | | | | That is, make "X11" lowercase so that the order of the includes in the disable- section remain the same when sorted with `LC_ALL=C`, as is the case for most of the other sections. That is also likely to be the default in text editors (such as in vim on Arch), so this should make the disable- section more consistent and easier to sort when editing the profile. Also, keep the old include as a redirect to the new one for now to avoid breakage. Commands used to search and replace: git mv etc/inc/disable-X11.inc etc/inc/disable-x11.inc git grep -Ilz 'disable-X11' -- etc | xargs -0 \ perl -pi -e 's/disable-X11/disable-x11/' Relates to #4462 #4854 #6070 #6289. This is a follow-up to #6286.
* landlock: use "landlock.fs." prefix in filesystem commandsLibravatar Kelvin M. Klann2024-02-27
| | | | | | | | | | | | | | | | | | | Since Landlock ABI v4 it is possible to restrict actions related to the network and potentially more areas will be added in the future. So use `landlock.fs.` as the prefix in the current filesystem-related commands (and later `landlock.net.` for the network-related commands) to keep them organized and to match what is used in the kernel. Examples of filesystem and network access flags: * `LANDLOCK_ACCESS_FS_EXECUTE`: Execute a file. * `LANDLOCK_ACCESS_FS_READ_DIR`: Open a directory or list its content. * `LANDLOCK_ACCESS_NET_BIND_TCP`: Bind a TCP socket to a local port. * `LANDLOCK_ACCESS_NET_CONNECT_TCP`: Connect an active TCP socket to a remote port. Relates to #6078.
* landlock: split .special into .makeipc and .makedevLibravatar Kelvin M. Klann2024-02-02
| | | | | | | | | | | | | | | | | | | | | As discussed with @topimiettinen[1], it is unlikely that an unprivileged process would need to directly create block or character devices. Also, `landlock.special` is not very descriptive of what it allows. So split `landlock.special` into: * `landlock.makeipc`: allow creating named pipes and sockets (which are usually used for inter-process communication) * `landlock.makedev`: allow creating block and character devices Misc: The `makedev` name is based on `nodev` from mount(8), which makes mount not interpret block and character devices. `ipc` was suggested by @rusty-snake[2]. Relates to #6078. [1] https://github.com/netblue30/firejail/pull/6078#pullrequestreview-1740569786 [2] https://github.com/netblue30/firejail/pull/6187#issuecomment-1924107294
* landlock: move commands into profile and add landlock.enforceLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | | | | | | | | | | | | | Changes: * Move commands from --landlock and --landlock.proc= into etc/inc/landlock-common.inc * Remove --landlock and --landlock.proc= * Add --landlock.enforce Instead of hard-coding the default commands (and having a separate command just for /proc), move them into a dedicated profile to make it easier for users to interact with the entries (view, copy, add ignore entries, etc). Only enforce the Landlock commands if --landlock.enforce is supplied. This allows safely adding Landlock commands to (upstream) profiles while keeping their enforcement opt-in. It also makes it simpler to effectively disable all Landlock commands, by using `--ignore=landlock.enforce`. Relates to #6078.
* profiles: exchange private-opt with a whitelist (#6021)Libravatar glitsj162023-10-18
| | | | | | | | | | | | | * profiles: drop private-opt (existing whitelist) * profiles: replace private-opt with whitelist In most profiles. Kept private-opt for enpass (~85MB), mate-dictionary (<20MB), minecraft-launcher (~1.6MB) and ppsspp (~44MB). The only app I couldn't check: xmr-stak. * docs: note potential issues with private-opt
* Fix wrong syscall names for s390_pci_mmio_{read,write}Libravatar Topi Miettinen2023-08-26
| | | | Closes #5965
* modif: drop deprecated 'shell' option references (#5894)Libravatar glitsj162023-07-19
| | | | | | | | | | | | The `shell` option has been removed. Remove stale references. This does NOT remove `shell none`-related code comments in: - src/firejail/fs_lib.c (L433-L441) - src/firejail/join.c (L415-L417) Relates to #5196. Suggested by #5891.
* profile.template: note to put read-only entries in dcLibravatar Kelvin M. Klann2023-03-29
|
* Update DBus wiki linkLibravatar Dpeta2022-12-23
|
* introduce new option restrict-namespacesLibravatar smitsohu2022-07-23
|
* refresh syscall groups (#5188)Libravatar smitsohu2022-07-17
| | | | | | | | | | | | now covers syscalls up to including process_madvise (440) group assignment was blindly copied from systemd: https://github.com/systemd/systemd/blob/729d2df8065ac90ac606e1fff91dc2d588b2795d/src/shared/seccomp-util.c#L305 the only exception is close_range, which was added to both @basic-io and @file-system this commit adds the following syscalls to the default blacklist: pidfd_getfd,fsconfig,fsmount,fsopen,fspick,move_mount,open_tree
* Fix chromium browsers in firejail 0.9.68Libravatar rusty-snake2022-04-14
| | | | closes #4965
* profile.template: add noprintersLibravatar Kelvin M. Klann2022-01-05
| | | | | | | See commit bd15e763e ("--noprinter option", 2021-10-20) and commit d9403dcdc ("small fix", 2021-10-20). Relates to #4607.
* deterministic-shutdown optionLibravatar smitsohu2021-10-28
|
* Merge pull request #4521 from rusty-snake/disable-proc.incLibravatar smitsohu2021-10-20
|\ | | | | Create disable-proc.inc
| * Create disable-proc.incLibravatar rusty-snake2021-09-09
| |
* | fix spelling (#4573)Libravatar a13460542021-09-22
|/
* Update profile.template to use disable-X11.incLibravatar rusty-snake2021-09-08
|
* add disable-X11.inc to profile templateLibravatar Reiner Herrmann2021-08-14
|
* Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | follow up
* Add wru to firefox-common, chromium-common and profile.templateLibravatar rusty-snake2021-08-04
| | | | | | | Still unresolved: > If someone who use systemd-resolved can say more which resolv.conf is necessary on such system. > whitelist /run/systemd/resolve/resolv.conf > whitelist /run/systemd/resolve/stub-resolv.conf
* Profile fixesLibravatar rusty-snake2021-08-04
| | | | | | | | | | - Fix #4157 -- [Feature] Should rmenv GitHub auth tokens There are still more token variables from other program that should be added. - Fix #4093 -- darktable needs read access to liblua* - Fix #4383 -- move noblacklist ${HOME}/.bogofilter to email-common.profile for claws-mail (and other mailers) - Fix xournalpp.profile - syscalls.txt: ausyscall i386 -> firejail --debug-syscalls32
* Update etc/templates/syscalls.txtLibravatar rusty-snake2021-07-28
| | | | Rework + suggest --seccomp-error-action=log
* Merge pull request #4375 from smitsohu/kcmpLibravatar netblue302021-06-27
|\ | | | | remove kcmp from seccomp default drop list
| * remove kcmp from seccomp default drop list (#3219)Libravatar smitsohu2021-06-26
| |
* | Fix sort error in profile.template (#4334)Libravatar pirate4867431862021-06-04
|/
* Update profile.templateLibravatar rusty-snake2021-06-03
| | | | | | | | | The header of profile.template define this order: IGNORES NOBLACKLISTS ALLOW INCLUDES BLACKLISTS DISABLE INCLUDES
* Add read-write to profile.templateLibravatar rusty-snake2021-05-16
|
* Update profile.templateLibravatar rusty-snake2021-05-13
| | | | Clarify some options that supersede others.
* Stying fixes (mrrescue.profile, pingus.profile, profile.template)Libravatar rusty-snake2021-05-05
|
* Add noinput to all profiles with private-devLibravatar rusty-snake2021-05-05
|
* Add allow-bin-sh.inc to profile.templateLibravatar rusty-snake2021-04-17
| | | | [skip ci]
* Fix typo policiesLibravatar Ted Robertson2021-03-13
|
* Merge pull request #4084 from tredondo/patch-4Libravatar glitsj162021-03-11
|\ | | | | Clarify what the Description comment is for
| * Clarify what the Description comment is forLibravatar Ted Robertson2021-03-11
| |
* | Improve EnglishLibravatar Ted Robertson2021-03-11
|/
* fixesLibravatar rusty-snake2021-03-01
| | | | | | | | | | | | | - RELNOTS: protocol now accumulates - fix #3978 -- Android Studio: cannot create the directory Unresolved: > google-earth.profile has a 'noblacklist ${HOME}/.config/Google' too, > so we should consider to add additional blacklists for ~/.config/Google/*. - marker.profile: allow ${DOCUMENTS} - profile.template: add bluetooth protocol - profile.template: add DBus portal note - firejail-profile.txt: revert 17fe4b9e -- fix private=directory in man firejail-profile see https://github.com/netblue30/firejail/pull/3970#discussion_r574411745
* fix Common-ExtraLibravatar glitsj162021-02-17
| | | See https://github.com/netblue30/firejail/pull/3993/files/660bc3435b43e32d156d9bb5bee2dbad2f84cf36#r577366805.
* fix ordering in profile.templateLibravatar glitsj162021-02-16
|
* miscellaneous fixes to profile.templateLibravatar glitsj162021-02-16
|
* add support for faccessat2 syscallLibravatar glitsj162021-02-10
|
* Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ | | | | ssh: Refactor, fix bugs & harden
| * etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
* | Add 'seccomp-error-action log' to profile.templateLibravatar rusty-snake2021-01-18
|/
* update manpages and RELNOTESLibravatar rusty-snake2021-01-08
|
* from my overridesLibravatar rusty-snake2020-11-16
| | | | | | | | - add seccomp.block-secondary to a lot profiles - add wruc to firefox-common and ignore it in TB and firefox-common-addons - harden dia, gnome-keyring, libreoffice, megaglest, pngquant, ghostwriter, rhythmbox, sqlitebrowser
* New disable include: disable-write-mnt.inc (#3622)Libravatar rusty-snake2020-09-07
| | | | | | | | | | | | | * New disable include: disable-write-mnt.inc It is for profiles which have a reasonable mnt access (we can not add disable-mnt), but no edit function (e.g. any kind of viewer). Added to - profile.template - default.profile - eo-common.profile * Update default.profile
* #3106-1, include @mount in @default insted of all the syscallsLibravatar rusty-snake2020-09-01
|
* disable-shell.inc (#3411)Libravatar rusty-snake2020-06-04
| | | | | | | | | | | | * disable-shell.inc * add disable-shell.inc to all profiles with a … … private-bin line without bash/sh except profiles with redirect profiles. * add it to some more profiles * exclude aria2c.profile
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-08 16:10:25 +0000