| Commit message (Collapse) | Author | Age |
|---|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* add tuxguitar profile
tested for versions < 1.3
* blacklist tuxguitar
* add tuxguitar
* add tuxguitar
* add support for tuxguitar > 1.2
higher versions fail to launch without protocol=inet,inet6 and with noexec=~. Yet, net=none seems to be still tolerated, which comes handy to block talk with internet and dbus.
* unbreak tuxguitar Internet access
versions >= 1.3 actually run fine with net=none enabled, if the built-in internet dependent feature is not used
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
* add disable-mnt
* support alternative media players
* add novideo
* fix comment, add novideo
* drop disable-mnt
saving to mounted locations is legitimate use
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* add novideo
* add novideo
* add novideo
* put noexec last
* blacklist Clementine configuration and database
* blacklist Clementine configuration and database
* add novideo
* add novideo, permit access to ~/.java
* add novideo
* spoof machine-id
* mimeapps.list is already in whitelist-common.inc
* ~/.local/share/applications is already read-only
see disable-common.inc
* mimeapps.list is already in whitelist-common.inc
* ~/.local/share/applications is already read-only
see disable-common.inc
* drop machine-id option
private-etc hides it anyway
|
| | |
|
| |
|
|
| |
There may actually be some other comments that were removed, but the bulk have been restored
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* calibre: add netlink protocol (FB note: removed before merge)
calibre started without netlink protocol throws following error in console:
Exception in thread Thread-8:
Traceback (most recent call last):
File "/usr/lib/python2.7/threading.py", line 801, in __bootstrap_inner
self.run()
File "/usr/lib/calibre/calibre/utils/mdns.py", line 43, in run
_all_ip_addresses = self.get_all_ips()
File "/usr/lib/calibre/calibre/utils/mdns.py", line 27, in get_all_ips
for x in netifaces.interfaces():
OSError: [Errno 95] Operation not supported
* mpv: add nogroups, tracelog, ipc-namespace, private-dev
I used testes all above options and didn't noticed any breakage.
* qbittorrent: add netlink protocol, private-etc
Netlink protocol is needed if user select to bind specific network interface in config. Otherwise it throws an error in qbittorent log:
The network interface defined is invalid: tun0
Example private-etc is added but commented out by default. It's tested but as there are many different system configurations users should enable it manually.
* vlc: disable memory-deny-write-execute
With memory-deny-write-execute vlc freezes after loading video file. According to https://github.com/VladimirSchowalter20/firejail/commit/b18f42ab0236de7eed5888f43ba36cdaf990cbca memory-deny-write-execute is similar to PAX mprotect feature and linked github project explicitly disables that feature for vlc binary, see https://github.com/copperhead/paxd-archive/commit/deb39e0b91996e2e9c7917b3543030880cd476f4
* Update vlc.profile
* wine: add nogroups
Nogroups should be safe addition for wine
* wireshark: allow users to run wireshark as non-root
Wireshark can be run unprivileged when user is part of wireshark group. Unfortunately enabling nogroups,nonewprivs and seccomp will break it with permissions errors.
Also added example private-etc option which is commented out by default for now.
* cosmetic fix
* mpv: comment out ipc-namespace for now
As requested in review https://github.com/netblue30/firejail/pull/1433#discussion_r131550515
* calibre: disable netlink protocol
It throws an error but actual breakage isn't observed for now.
|
| |\
| |
| | |
Change KDE4 services folder to read-only
|
| | | |
|
| | |
| |
| | |
Configurations in this folder are not secret, but need to be protected from manipulation. Let's make it available to all KDE apps for legitimate use. Discussion in #1428
|
| |/ |
|
| | |
|
| | |
|
| |\ |
|
| | | |
|
| |/ |
|
| |
|
|
| |
apktool, Baobab, dex2jar, gitg, Hashcat, MusicBrainz Picard, OBS Studio, Remmina, sdat2img, Sound Converter, SQLiteBrowser, Truecraft
|
| |
|
|
|
|
|
|
| |
* Update qbittorrent.profile
* Update gwenview.profile
* Update disable-programs.inc
|
| | |
|
| |\
| |
| | |
Apparmor: add local configuration
|
| | | |
|
| | | |
|
| |\ \
| | |
| | |
| | |
| | | |
VladimirSchowalter20/VladimirSchowalter20-apparmor-kde-fix
Apparmor: update whitelist path for kde
|
| | |/ |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | |
| |
| |
| | |
See https://github.com/netblue30/firejail/pull/1367#issuecomment-315793729
|
| | |
| |
| |
| |
| |
| |
| |
| | |
- mdwe breaks most vm-based languages so python/java/javascript and some mono programs are not compatible
- mdwe also breaks most 3d accelerated programs such as 3d games
- mdwe is similar to PaX's mprotect meaning PaX flag managers can be used as reference
-- See https://github.com/copperhead/paxd-archive/blob/master/paxd.conf
-- See https://github.com/nning/linux-pax-flags
|
| |/
|
|
|
|
|
|
| |
- Added 'disable-devel.conf' to many profiles
- Added 'disable-mnt' to many profiles
- Added 'noexec' to many profiles
- Removed 'netfilter' and 'net none' from profiles with 'protocol unix'
- Cleaned up profiles using defaults
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
Zoom seems to use of a QT cache-disk feature which depends upon a ~/.cache/<app>/qmlcache directory.
If it can not, Zoom will segfault with
mprotect failed in ExecutableAllocator::makeExecutable: Permission denied
|
| | |
|
Tad
netblue30
smitsohu
Fred Barclay
Vladimir Schowalter
soredake
startx2017
Rahiel Kasim
Raphaël Droz