| Commit message (Collapse) | Author | Age |
| |
|
|\
| |
| | |
Apparmor: restrict access to writable files
|
| | |
|
| |
| |
| |
| | |
Kodi plugins need /proc/@PID/net/dev access outside user processes:
AVC apparmor="DENIED" operation="open" profile="firejail-default" name="/proc/28/net/dev" pid=2354 comm="kodi.bin" requested_mask="r" denied_mask="r"
|
| |
| |
| | |
Access to writable files can be restricted to their owner only.
|
| |
| |
| |
| | |
- This appears to be a general issue with private-lib, that might've already been fixed in master
|
| | |
|
|/
|
|
| |
- Tor browser doesn't have nosound, so include pulse in private-etc
|
| |
|
|\
| |
| | |
Apparmor: fix broken file dialogs in kde plasma
|
| |
| |
| |
| |
| | |
Escaping this create warning and is dropped anyway:
Warning from /etc/apparmor.d/firejail-default (/etc/apparmor.d/firejail-default line 163): Character # was quoted unnecessarily, dropped preceding quote ('\') character
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
For some time apparmor started breaking file dialogs in kde plasma (gwenview, calibre, qbittorrent, etc). typical audit report below:
AVC apparmor="DENIED" operation="open" profile="firejail-default" name="/run/user/1000/#28520" pid=1997 comm="qbittorrent" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000
AVC apparmor="DENIED" operation="link" profile="firejail-default" name="/run/user/1000/qBittorrentZcaeTi.1.slave-socket" pid=3679 comm="qbittorrent" requested_mask="l" denied_mask="l" fsuid=1000 ouid=1000 target="/run/user/1000/#79965"
This commit fixes this issue. Tested on Archlinux (linux 4.14.11, kde 5.11.5)
|
| | |
|
| | |
|
| | |
|
| |
| |
| | |
hardcoded since 1e7045b55cc1e189dba6d9ed21c05c90663f3736
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
|\ \
| | |
| | | |
Create discord-canary.profile
|
| | |
| | |
| | | |
Created by adding `whitelist ${HOME}/.config/discordcanary` to `electron.profile` and replacing references to electron. Seems to work for me with light usage.
|
| | |
| | |
| | |
| | |
| | |
| | | |
Seems to be necessary under Fedora like pki
This also fixes an issue with no audio in Lollypop on Fedora
|
| | |
| | |
| | |
| | | |
https://github.com/netblue30/firejail/commit/68ccf1efee030470bf3f1666429e31374f2ae3a6#r26873132
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
| | | |
|
|/ / |
|
| | |
|
|/ |
|
| |
|
|\
| |
| | |
tor flavours
|
| | |
|
| | |
|
| | |
|
|\ \
| | |
| | | |
Add profile for "playonlinux"
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This profile have been successfully tested by starting a windows application through it.
"wine.profile" has been used as template for this. Only "noblacklist ${PATH}/nc" has been added because playonlinux needs it to run.
Please note that this is currently not tested due to security aspects, so it may need a rework later on. Because opening a unknown windows application through it could possibly be a security risk.
|
|\| |
| | |
| | | |
Fix #1702 - Couldn't start 'minetest' in Debian Testing
|
| | | |
|
| |/
| |
| | |
This removes the "private-etc" line from the "minetest"-profile for a successfully start of the game.
|
| | |
|
|/
|
| |
This profile have been successfully tested by sending and receiving an Email. "claws-mail.profile" has been used as template for this.
|
| |
|
| |
|
|
|
|
| |
for #1695
|