| Commit message (Collapse) | Author | Age |
|
|
| |
On arch,wire-desktop is now depending on electron9. Using wildcard for this sorta packages would be better.
|
|
|
|
|
|
|
|
|
|
|
|
| |
AppArmor introduces the @{run} variable, which is used in
<abstractions/dbus-strict> and <abstractions/dbus-session-strict> among
other places. Thus, we follow suit of the built-in profiles and #include
<tunables/global>, which includes <tunables/run> in AppArmor 3.0,
defining the variable.
As <tunables/global> exists in previous versions of AppArmor, too, this
patch does not introduce a backward-compatibility issue with Apparmor
2.x.
|
|
|
| |
With private-etc enabled vmware-tools doesn't get installed. Existing VM with an installed vmware-tools works as usual. For the time being keep it commented.
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
- blacklist ~/.rustup in disable-devel.inc
- add note to mpv (See #3628)
- harden warsow
- update relnotes
- new profile qrencode, dbus-send, notify-send
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* New disable include: disable-write-mnt.inc
It is for profiles which have a reasonable mnt access (we can not add
disable-mnt), but no edit function (e.g. any kind of viewer).
Added to
- profile.template
- default.profile
- eo-common.profile
* Update default.profile
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
* README.md & RELNOTES
* Allow gnome-build do read and write .bash_history, it has a build-in
terminal
* D-Bus filter for gnome-passwordsafe
* wruc for supertuxkart
* wruc+wusc for totem
* dbus-system none for totem
* remove src/man/preproc.c it is replaced by preproc.awk
* remove dead-code form preproc.awk
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Add profile for twitch,youtube wrappers
* Fix git-cola, add Youtube music wrapper profiles
* Fixes for git-cola again
* Add profile for alternative name for git-cola
* Fixes
* Fix
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Added minecraft-launcher-profile
Initial
* Changed minecraft-launcher profile
Added space,tracelog,nodvd
* New profiles for balsa,trojita,kube
* Switch to whitelisting
* Enable gpg,firefox uniformity between other clients
* Hyperlinks
* Fix
Co-authored-by: kortewegdevries <k0rtic_dv@aol.com>
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Profile for Psi
* Fix pidgin buddy icon
* Profile for man
* Add profile for smuxi
* Comment man in firecfg
* Add pinentry programs
* Update etc/profile-m-z/psi.profile
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
|
|
|
|
|
|
|
|
|
| |
* Fix private-etc of electron-mail
* Fix dbus of geary
* Fix geary again, remove GPG
* Fix seccomp on Arch
|
| |
|
|
|
|
|
|
|
|
|
| |
* Matrix clients
Initial
* Add profile for fractal, # 1139
* Fixes
|
|
|
|
|
|
|
|
|
| |
* Various profiles
Initial
* Various fixes # 1
Removed blacklist,no3d; added icon flatpak paths;sorting;added space
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
This commit removes it from profile which have it.
/usr/share/perl* is still inaccessible for profiles with wusc and
disable-interpreters.inc w/o allow-perl.inc.
|
|
|
|
|
|
|
|
|
| |
* add ~/.uim.d directory to whitelist-common.inc
uim is a multilingual input method framework (similar to ibus, which has its own entry in this file).
* add /var/lib/uim to whitelist-var-common.inc
When user installs an uim module (for example, an input method like anthy or mozc), it gets registered in a file in this directory.
|
|
|
|
| |
/etc/apparmor.d/local/firejail.default - merge form 0.9.62.4
|
|
|
|
|
| |
Signal is adding support for video calls on desktop, see
https://signal.org/blog/desktop-calling-beta/
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Use whitelisting for video players
See https://github.com/netblue30/firejail/pull/3469
* Update media player whitelists
See reviews at https://github.com/netblue30/firejail/pull/3472
Block $DOCUMENTS
Make $DESKTOP read-only
* Review fixes: include read-only Desktop in whitelist
|
|\
| |
| | |
Fix nomacs
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
```
Aug 11 16:32:32 korte audit[29004]: SECCOMP auid=1000 uid=1000 gid=1000
ses=2 subj==firejail-default (enforce) pid=29004 comm="nomacs"
exe="/usr/bin/nomacs" sig=31 arch=c000003e syscall=9 compat=0
ip=0x7fa2a1cc98c6 code=0x0
```
|
|\ \
| | |
| | | |
seccomp: logging
|
| |/
| |
| |
| |
| |
| |
| | |
Allow `log` as an alternative seccomp error action instead of killing
or returning an errno code.
Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
|
|/
|
|
|
| |
Initial,amend: wrong dir,delete gtk-*,added new files
Co-authored-by: kortewegdevries <k0rtic_dv@aol.com>
|
|
|
|
|
|
|
| |
* Add profile for otter-browser
Initial
* private-bin,sorting
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
* Added git-cola profile
Initial
* Edit private-etc
Add alternatives,pki
* Add disable-xdg
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
| |
* Added lyx profile
Initial
* Rmoved whitelists
Make home directory more accessible
|