aboutsummaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAge
...
* | New profile: qt6ct (#6250)Libravatar glitsj162024-03-05
| |
* | New profile: qt5ct (#6249)Libravatar glitsj162024-03-05
| |
* | New profiles: lz4 and redirects (#6241)Libravatar glitsj162024-03-05
| |
* | gnome-boxes: deny access to /usr/libexec (#6239)Libravatar glitsj162024-03-05
| |
* | virt-manager: deny access to /usr/libexec (#6238)Libravatar glitsj162024-03-05
| |
* | makepkg: fix ordering (#6265)Libravatar glitsj162024-03-05
| |
* | Add quiet to enchant-2, it has a cliLibravatar rusty-snake2024-03-03
|/
* Merge pull request #6219 from haplo/ledger-live-desktopLibravatar netblue302024-02-29
|\ | | | | Profile for Ledger Live desktop app
| * Profile for ledger-live-desktopLibravatar Fidel Ramos2024-02-28
| | | | | | | | | | | | | | | | | | /opt/ledger-live installation currently sits at 345 MiB, so I decided to whitelist it instead of using private-opt ledger-live, in case future installations grow in size. Not using private-dev was the only way I managed to get my USB wallet to work.
* | Merge pull request #6228 from kmk3/landlock-add-fsLibravatar netblue302024-02-29
|\ \ | | | | | | landlock: use "landlock.fs." prefix in filesystem commands
| * | landlock: use "landlock.fs." prefix in filesystem commandsLibravatar Kelvin M. Klann2024-02-27
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since Landlock ABI v4 it is possible to restrict actions related to the network and potentially more areas will be added in the future. So use `landlock.fs.` as the prefix in the current filesystem-related commands (and later `landlock.net.` for the network-related commands) to keep them organized and to match what is used in the kernel. Examples of filesystem and network access flags: * `LANDLOCK_ACCESS_FS_EXECUTE`: Execute a file. * `LANDLOCK_ACCESS_FS_READ_DIR`: Open a directory or list its content. * `LANDLOCK_ACCESS_NET_BIND_TCP`: Bind a TCP socket to a local port. * `LANDLOCK_ACCESS_NET_CONNECT_TCP`: Connect an active TCP socket to a remote port. Relates to #6078.
* | Merge pull request #6227 from glitsj16/virt-managerLibravatar netblue302024-02-29
|\ \ | | | | | | New profile: virt-manager
| * | Create virt-manager.profileLibravatar glitsj162024-02-27
| | |
| * | disable-programs.inc: add virt-manager supportLibravatar glitsj162024-02-27
| |/
* | Merge pull request #6226 from glitsj16/gnome-boxesLibravatar netblue302024-02-29
|\ \ | | | | | | New profile: gnome-boxes
| * | Create gnome-boxes.profileLibravatar glitsj162024-02-27
| |/
* | Merge pull request #6216 from powerjungle/masterLibravatar netblue302024-02-29
|\ \ | |/ |/| multimc: instances not running, because of missing permissions
| * multimc: instances not running, because of missing permissionsLibravatar powerjungle2024-02-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When starting an instance, in the logs, a failed attempt to load the lwjgl library is shown and the game doesn't run. The library is in the /tmp directory. The reason for this appears to be, in the lwjgl source code, the shared library loading function, extracts in the temporary directory and continues from there. This is fixed by whitelisting. The reason for adding "ignore noexec /tmp" as well, is that without it, the game can't run, even if the directory is whitelisted. It seems the library needs to be loaded from /tmp. A second error for a failed attempt to access /home/user/.cache/JNA is also shown in the logs. This is also fixed by whitelisting.
* | profiles: drop paths already in wusc (#6218)Libravatar glitsj162024-02-23
|/ | | | Drop paths present in etc/inc/whitelist-usr-share-common.inc from profiles that include it.
* electron-cash: use new private-etc syntaxLibravatar glitsj162024-02-19
|
* Merge pull request #6211 from glitsj16/nextcloud-fixLibravatar glitsj162024-02-19
|\ | | | | nextcloud: D-Bus filtering changes
| * nextcloud: fix the comment link to the wiki FAQLibravatar glitsj162024-02-16
| |
| * nextcloud: edit dbus comment as requested in reviewLibravatar glitsj162024-02-16
| |
| * nextcloud: harden D-Bus filteringLibravatar glitsj162024-02-16
| |
* | Merge pull request #6181 from haplo/electron-cashLibravatar glitsj162024-02-19
|\ \ | | | | | | Profile for Electron Cash
| * | Blacklist ~/.electron-cash in disable-programs.incLibravatar Fidel Ramos2024-01-31
| | |
| * | electron-cash.profileLibravatar Fidel Ramos2024-01-30
| | |
* | | Merge pull request #6180 from haplo/rawtherapeeLibravatar glitsj162024-02-19
|\ \ \ | |_|/ |/| | Profile for RawTherapee
| * | rawtherapee.profileLibravatar Fidel Ramos2024-01-31
| |/
* | Merge pull request #6201 from glitsj16/gnome-keyring-fixesLibravatar glitsj162024-02-08
|\ \ | | | | | | gnome-keyring: harden and add gnome-keyring-daemon.profile
| * | Create gnome-keyring-daemon.profileLibravatar glitsj162024-02-08
| | | | | | | | | | | | And use it as the base for the existing gnome-keyring.profile.
| * | gnome-keyring: harden and remove quietLibravatar glitsj162024-02-08
| | |
* | | enchant-lsmod-2: redirect to enchant-2 (#6202)Libravatar glitsj162024-02-08
|/ /
* | Merge pull request #6187 from kmk3/landlock-add-devLibravatar Kelvin M. Klann2024-02-05
|\ \ | | | | | | landlock: split .special into .makeipc and .makedev
| * | landlock: split .special into .makeipc and .makedevLibravatar Kelvin M. Klann2024-02-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As discussed with @topimiettinen[1], it is unlikely that an unprivileged process would need to directly create block or character devices. Also, `landlock.special` is not very descriptive of what it allows. So split `landlock.special` into: * `landlock.makeipc`: allow creating named pipes and sockets (which are usually used for inter-process communication) * `landlock.makedev`: allow creating block and character devices Misc: The `makedev` name is based on `nodev` from mount(8), which makes mount not interpret block and character devices. `ipc` was suggested by @rusty-snake[2]. Relates to #6078. [1] https://github.com/netblue30/firejail/pull/6078#pullrequestreview-1740569786 [2] https://github.com/netblue30/firejail/pull/6187#issuecomment-1924107294
* | | geeqie.profile: allow Lua interpreter (#6183)Libravatar Fidel Ramos2024-02-03
|/ / | | | | | | | | | | | | | | | | | | Recent versions of geeqie[1] use a Lua interpreter, like the one currently in Arch Linux (2.2). Without this fix it fails with: /usr/bin/geeqie: error while loading shared libraries: liblua.so.5.4: [...] [1] https://www.geeqie.org/
* | crawl.profile: allow lua (#6182)Libravatar luca0N!2024-02-02
| | | | | | | | | | Add common Lua include to crawl.profile (Dungeon Crawl Stone Soup) to allow Lua libraries, as both the ncurses and tiles executables are dynamically linked to Lua.
* | tesseract.profile: add quiet (#6173)Libravatar Kelvin M. Klann2024-01-31
|/ | | | | | | | | Tesseract is a CLI program and its output may be parsed by other programs (such as `ocrmypdf`). Including messages from firejail in the output may break the parsing, so remove them. Fixes #6171. Reported-by: @kmille
* profiles: add profiles for gtk youtube viewers symlinks (#6154)Libravatar pirate4867431862024-01-19
| | | | | | | | | Committer note: For each profile there is both XXX-gtk and gtk-XXX (such as lbry-viewer-gtk and gtk-lbry-viewer). XXX-gtk is the symlink gtk-XXX is the actual file Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* lobster.profile: allow basename (#6155)Libravatar pirate4867431862024-01-19
| | | Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
* profiles: use only /usr/share/lua* (#6150)Libravatar Kelvin M. Klann2024-01-08
| | | | | | | | | | | | | | | | | | To ensure that it includes luajit paths as well: * /usr/share/lua * /usr/share/luajit-2.1 And remove all entries of the same path without the wildcard, to avoid redundancy. Misc: The wildcard entries were added on commit 56b60dfd0 ("additional Lua blacklisting (#3246)", 2020-02-24) and the entries without the wildcard were partially removed on commit 721a984a5 ("Fix Lua in disable-interpreters.inc", 2020-02-24). This is a follow-up to #6128. Reported-by: @pirate486743186
* disable-devel.inc: deduplicate g++ and gcc entriesLibravatar Kelvin M. Klann2024-01-05
| | | | | Added on commit 2d8ff695a ("WIP: Blacklist common programming interpreters. (#1837)", 2018-04-02).
* man: allow Perl (#6143)Libravatar glitsj162024-01-04
| | | gropdf (`man -Tpdf`) needs Perl (see #6142).
* Merge pull request #6128 from pirate486743186/masterLibravatar netblue302023-12-21
|\ | | | | mpv: whitelist /usr/share/mpv
| * mpv: whitelist /usr/share/mpvLibravatar pirate4867431862023-12-13
| | | | | | | | | | | | Use case: You install scripts in `/usr/share/mpv` but they remain inactive. You then symlink them to `/etc/mpv` to activate them if you want.
* | Merge pull request #6125 from kmk3/landlock-enforceLibravatar netblue302023-12-21
|\ \ | | | | | | landlock: move commands into profile and add landlock.enforce
| * | landlock: move commands into profile and add landlock.enforceLibravatar Kelvin M. Klann2023-12-11
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Move commands from --landlock and --landlock.proc= into etc/inc/landlock-common.inc * Remove --landlock and --landlock.proc= * Add --landlock.enforce Instead of hard-coding the default commands (and having a separate command just for /proc), move them into a dedicated profile to make it easier for users to interact with the entries (view, copy, add ignore entries, etc). Only enforce the Landlock commands if --landlock.enforce is supplied. This allows safely adding Landlock commands to (upstream) profiles while keeping their enforcement opt-in. It also makes it simpler to effectively disable all Landlock commands, by using `--ignore=landlock.enforce`. Relates to #6078.
* | Merge pull request #6118 from NetSysFire/patch-4Libravatar netblue302023-12-21
|\ \ | | | | | | minecraft-launcher.profile: allow keyring access
| * | Use dbus-user filterLibravatar NetSysFire2023-12-08
| | |
| * | Update minecraft-launcher.profileLibravatar NetSysFire2023-12-07
| | |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-19 17:21:23 +0000