| Commit message (Collapse) | Author | Age |
... | |
|
|
|
|
|
|
| |
* Update disable-common.inc
* Update disable-common.inc
[skip ci]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Whitelist some config files used by Okular.
These files are used to store the toolbar configurations.
* Whitelist files required for okular in firefox-common-addons.inc
Without this, okular does not follow the user configuration for toolbars
and keyboard shortcuts when launched inside the firefox sandbox (for
eg., while opening a downloaded PDF).
* Alphabetical sort
* Remove noblacklist for files which are not actually blacklisted.
I have blacklisted them in a separate pull request.
|
|
|
| |
Co-authored-by: noir <noir@neire.dev>
|
|
|
| |
hplip is required for scanning using HP printer/scanners.
|
| |
|
| |
|
|
|
|
| |
configuration. (#3490)
|
|
|
|
|
|
| |
(#3490)
Without this, konversation doesn't remember the settings for
notifications.
|
|
|
| |
Blender autosaves to /tmp.
|
|
|
| |
This should clarify how to configure for reading local mail after https://github.com/netblue30/firejail/commit/dfaf7a7660689c055ba45a935e42b1b548669c57.
|
|
|
|
|
|
|
| |
* clarify writing to /var/mail and /var/spool/mail in apparmor
Thunderbird seems to be our only mail client profile that enables the `apparmor` option. Users need this when they follow instructions on how to allow reading local mail.
* fix mail clients rule in firejail-default
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
| |
* fix comment in email-common
* add writable-var to evolution.profile
* add writable-var to mutt.profile
* remove newline above writable-var in evolution.profile
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
| |
Totem saves screenshots of video to ${PICTURES}. Also adding tracelog to slightly harden things a bit.
|
| |
|
| |
|
|
|
|
|
|
|
| |
Atom 1.48 requires a looser sandbox and no longer works with
noroot, nonewprivs, protocol, and seccomp
caps filter needed adjusting to keep sys_admin and sys_chroot
|
|
|
|
| |
https://github.com/hannob/mmapfail
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Add strawberry profile
* Fix comment
* Add to disable-programs.inc & firecfg.config
* Add /home/amin/.local/share/strawberry to profile and disable-programs
* Various hardening for strawberry profile
Signed-off-by: Amin Vakil <info@aminvakil.com>
* Change nodbus to dbus-system none in strawberry profile
* Add dbus-user none to strawberry profile
* Add whitelist-var-common, sort private-etc
* Sort, Add wruc, Add netlink to protocol in strawberry profile
* Remove dbus-user none to allow using gnome functions for various usage in strawberry profile
|
|
|
| |
Applications using Qt5 need this to be whitelisted if the user is using a qt5ct colour scheme (such as "darker") or custom QSS.
|
|
|
|
| |
solves #3454
|
|
|
| |
See https://github.com/netblue30/firejail/issues/3219#issuecomment-638823377
|
|
|
|
|
|
|
|
|
|
|
|
| |
* disable-shell.inc
* add disable-shell.inc to all profiles with a …
… private-bin line without bash/sh except profiles with redirect
profiles.
* add it to some more profiles
* exclude aria2c.profile
|
|
|
|
|
| |
w3m is a text-based web browser as well as a pager like `more' or `less'. With w3m you can browse web pages through a terminal emulator window (xterm, rxvt or something like that).
As it outputs I suppose setting quiet in its profile is appropriate.
|
| |
|
| |
|
|
|
|
|
| |
* harden mpg123.profile
* drop nodvd from mpg123.profile
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Create mocp.profile
* add mocp support to disable-programs.inc
* add mocp support in firecfg.config
* update RELNOTES for mocp
* fix configuration access for mocp
Thanks to @rusty-snake for spotting this.
|
| |
|
|
|
|
|
|
|
|
|
| |
* Update dino-im.profile
comment out the globals.local so it's not included twice
* Update dino-im.profile
add comment
|
|
|
| |
Ubuntu named the dino instant messenger's binary ``dino-im``, so it needs to be present as profile and added to private-bin.
|
|
|
| |
After https://github.com/netblue30/firejail/commit/76127399a5811a0b5ae3fffbd999bf22fba032e1 the caps workaround is no longer needed.
|
|
|
| |
Fixes #3423.
|
| |
|
|
|
|
| |
It's a collection of many tools, that might not be allowed individually.
When it's needed, it can easily be allowed again.
|
| |
|
|
|
|
|
|
|
|
|
| |
* Allow google-chrome access to the custom flags files in ~/.config.
* Added noblacklist for the custom flag files for google-chrome-stable.
* Allow read access to the custom flag files for both google-chrome-beta and google-chrome-unstable.
* Added the custom flag files for google-chrome stable, beta and unstable to the disable-programs.inc list.
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Also fixed a typo for new profiles: nicontine --> nicotine
* add plv to firecfg
* add plv to disable-programs.inc
* Create plv.profile
* Update plv.profile
|
|
|
|
|
|
|
|
|
|
|
|
| |
Add Faster Than Light, Into the Breach, Paradox Interactive, and mbwarband
to disable-programs.inc.
Also, add Faster Than Light and Into the Breach into steam.profile. This
fixes saved games being lost when steam is closed, and also lets Steam
cloud sync work properly.
Lastly, remove a duplicate whitelist ${HOME}/.steampid from
steam.profile.
|