aboutsummaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAge
...
* | | Blacklist some GNOME files in disable-common.incLibravatar Tad2018-04-16
| | |
* | | correct spellingLibravatar glitsj162018-04-16
| | |
* | | fix bitblbee doubled-up private-dev optionLibravatar glitsj162018-04-16
|/ /
* | allow java in some profilesLibravatar smitsohu2018-04-12
| |
* | Add Discord profileLibravatar Jean Lucas2018-04-12
| |
* | AppArmor: disable MAC related capabilitiesLibravatar Vincent432018-04-12
|/ | | We probably don't want to control MAC or audit from firejail
* atool 'redirect' profiles (#1873)Libravatar glitsj162018-04-09
| | | | | | | | | | | | | | * Create acat.profile * Create adiff.profile * Create als.profile * Create apack.profile * Create arepack.profile * Create aunpack.profile
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar Fred Barclay2018-04-09
|\
| * fix sqlitebrowser blacklistLibravatar glitsj162018-04-09
| |
| * fix akregator, more firecfg updatesLibravatar smitsohu2018-04-09
| |
| * add back shell=none to firefox-commonLibravatar smitsohu2018-04-09
| | | | | | | | after bbaba69f23ae9e181677044b5afb8c29b3eb83b5
| * Replace shell and seccomp filter for firefox >= 60, should fix #1765 and #1847Libravatar Fred-Barclay2018-04-07
| |
| * Merge branch 'master' of http://github.com/netblue30/firejailLibravatar netblue302018-04-07
| |\
| | * Merge pull request #1868 from glitsj16/sqlitebrowserLibravatar Vincent432018-04-07
| | |\ | | | | | | | | Disable memory-deny-write-execute
| | | * Disable memory-deny-write-executeLibravatar glitsj162018-04-07
| | | |
| * | | mergesLibravatar netblue302018-04-07
| |/ /
| * | Merge pull request #1870 from glitsj16/atoolLibravatar Fred Barclay2018-04-06
| |\ \ | | | | | | | | atool fixes
| | * | gunzip 'redirect' profileLibravatar glitsj162018-04-07
| | | |
| | * | bunzip2 'redirect' profileLibravatar glitsj162018-04-07
| | | |
| | * | private-etc fixupLibravatar glitsj162018-04-07
| | |/
| * / Soundconverter needs pythonLibravatar glitsj162018-04-07
| |/
| * fix basilisk and palemoon blacklistLibravatar smitsohu2018-04-07
| |
* | Spotify requires /etc/group when alsa is audio providerLibravatar Fred Barclay2018-04-09
|/ | | | | See #1872 in issue tracker. Note that this is just re-applying a2aaf6fb3829a2407ea4cb1329819c8c5e5d12ca
* update firecfg, shield kde startup betterLibravatar smitsohu2018-04-06
|
* Bleachbit needs pythonLibravatar Tad2018-04-06
|
* Lollypop needs pythonLibravatar Tad2018-04-05
|
* Merge pull request #1864 from glitsj16/enchantLibravatar smitsohu2018-04-05
|\ | | | | Update enchant profile
| * Create enchant-lsmod-2.profileLibravatar glitsj162018-04-05
| |
| * Create enchant-lsmod.profileLibravatar glitsj162018-04-05
| |
| * Create enchant-2.profileLibravatar glitsj162018-04-05
| |
| * Update enchant.profileLibravatar glitsj162018-04-05
| |
* | support older config dirLibravatar glitsj162018-04-05
| |
* | support older config dirLibravatar glitsj162018-04-05
|/
* Merge pull request #1859 from glitsj16/atoolLibravatar SkewedZeppelin2018-04-04
|\ | | | | Allow perl
| * Allow perlLibravatar glitsj162018-04-04
| | | | | | Now there's `disable-interpreters.inc` atool profile needs allowing perl access.
* | Merge pull request #1860 from glitsj16/makepkgLibravatar SkewedZeppelin2018-04-04
|\ \ | | | | | | syntax fixup
| * | syntax fixupLibravatar glitsj162018-04-04
| |/ | | | | Using 'PKGBUILD' instead of 'pckgbuild' might be slightly more familiar for Arch users.
* | support modern mpd configLibravatar glitsj162018-04-04
| |
* | support modern config dirLibravatar glitsj162018-04-04
|/
* fixupLibravatar smitsohu2018-04-04
|
* fix a0502dc5144185b6d346e92944e3359a833d2378, various enhancementsLibravatar smitsohu2018-04-04
|
* bibbletime.profile: add machine-idLibravatar Vincent432018-04-03
| | | It's needed on Archlinux, see https://github.com/netblue30/firejail/issues/1857
* gimp v.2.10 preparationsLibravatar smitsohu2018-04-03
|
* akonadi blacklist additionsLibravatar smitsohu2018-04-03
|
* WIP: Blacklist common programming interpreters. (#1837)Libravatar Fred Barclay2018-04-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * Add xreader thumbnailer and previewer profiles * Add xplayer audio-preview and thumbnailer profiles * Add atril thumbnailer and previewer profiles * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * --nodbus, first draft for #1825 * dbus.c * rework akonadi integration the usr.sbin.mysqld-akonadi apparmor profile, enforced by default in ubuntu and debian testing (and probably opensuse), doesn't play well with a number of firejail options. the reason for this is that once the no_new_privs bit is set, apparmor profile transitions are forbidden. enforcing our own apparmor policy instead is also no solution, because these programs don't even start without d-bus. relaxing the kmail profile was necessary so that kmail can fire up akonadi itself, just in case akonadi has not been started earlier already by another program. this is always an issue when kmail is the only installed akonadi client, but there may be more circumstances. for reasons outlined above this doesn't help debian and ubuntu (opensuse?) users though :-/ a brief summary of the seccomp exceptions: chroot is needed for qt webengine, io_prioset for the akonadi indexing agent, io_getevents, io_submit, io_setup are needed for mysqld. when akonadi has an sqlite3 backend, less exceptions to the seccomp filter are necessary, but mysqld is the default. in the future all kontact suite profiles (itm only kmail, knotes) should probably be redirections to akonadi_control, but the issues with apparmor make this somewhat impractical for now (options like 'protocol' couldn't go to akonadi_control.local any more, if current kmail redirected to there). * Add nodbus to some profiles - part 1 * Spotify works with nodbus on Arch * Enable nodbus for keepassx and keepassxc profiles. I've tested on keepassxc but should work for keepassx as well. Settings are not immutable. * recalibrate dbus access, deploy nodbus option see #1822 and #1825. also systematically replaces 'blacklist /run/user/*/bus' with 'nodbus'. with contributions from @Fred-Barclay * various blacklist additions * Add a profile for ncdu, enable private-etc in Steam again, and fixup gnome-recipes * comment nodbus where it interferes with dconf pending further discussion * Add a disabled and extensive private-bin for Steam * Further improve private-bin in steam * comment apparmor, net where they interfere with dconf - #1843 * gnome-calculator fixup * spectre support for clang compiler * spectre clang support * enable/disable dbus handling in /etc/firejail/firejail.config * nodbus man pages, etc. * redirect knotes to kmail, some tweaks * testing * gimp fixup * Even more fixups after adding disable-interpreters.inc * AWS and GCP store credentials in local directories as part of project setup. Configuration for cloud providers is sensitive information; it should be in the default block list. I didn't see profiles for gcloud or awscli, so haven't added any exclusions. boto and kubectl are not provider-specific, but also store credentials for whichever platforms they happen to be being used with. * testing * consolidate makefiles * gitignore * Use path variable instead of full path when blacklisting devel tools. * Part 1: blacklist python, perl, ruby, etc in disable-interpreters.inc * Part 2: allow access to java as needed * Typo: missing blacklist * Part 3: allow perl access as needed * typo * More fixups after adding disable-interpreters.inc * Blacklist javac * More javac noblacklisting * Remove javac from dex2jar, libreoffice, multimc5, and pdfsam profiles * Cleanup rebase leftovers * imagej doesn't need javac access * Add cc to blacklisted compilers * Use wildcards when blacklisting some gcc paths * Blacklist lua in disable-interpreters * Correct blacklist for node.js * Fred Barclay note: some of these commits (all of the ones that don't affect files inside etc/) aren't mine but were added during a rebase + squash
* musixmatch: fix profileLibravatar Vincent432018-04-02
|
* transmission-gtk: disable mdweLibravatar Vincent432018-04-02
| | | Causes freeze during opening file dialog in Archlinux , see issue https://github.com/netblue30/firejail/issues/1855
* Merge pull request #1827 from intika/masterLibravatar netblue302018-04-02
|\ | | | | Add support for the devil musixmatch
| * Add support for the devil musixmatchLibravatar intika2018-03-23
| |
* | Fix private-lib again (#1852) for evinceLibravatar glitsj162018-04-01
| | | | | | | | | | | | | | | | | | | | | | | | * Fix private-lib During conversation around an [earlier attempt at fixing evince] (https://github.com/netblue30/firejail/pull/1829) and the entailing [revert-commit](https://github.com/netblue30/firejail/pull/1829/commits/45732a22d1ea4ec0ade0775be7243e8669b7f850) this slipped through the cracks. The fix is tested on Gnome Shell 3.26.2 and 3.28.0 (on Arch). * Remove irrelevant comment on private-lib * Update private-lib comments Done!
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-20 16:56:20 +0000