aboutsummaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAge
* fractal.profile: allow /usr/share/fractalLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | This fixes Fractal 5 not opening on Void Linux due to it failing to access "/usr/share/fractal/resources.gresource". Fixes #6119. Reported-by: @mhmdana Suggested-by: @rusty-snake
* lutris.profile: allow mangohudLibravatar Kelvin M. Klann2023-11-27
| | | | | | Similarly to steam.profile (see #4864). Fixes #6106.
* lutris.profile: fix seccomp argumentsLibravatar Kelvin M. Klann2023-11-25
| | | | | | | I accidentally removed the `!` when sorting the arguments in #6067. This amends commit fbba03790 ("lutris.profile: allow more syscalls", 2023-10-24) / PR #6067.
* Merge pull request #6070 from kmk3/sort-py-csortLibravatar netblue302023-11-24
|\ | | | | build: sort.py: use case-sensitive sorting
| * build: sort.py: use case-sensitive sortingLibravatar Kelvin M. Klann2023-10-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To match how things are sorted elsewhere, such as with `noblacklist` / `whitelist` lines (vertically) in profiles and in ci/check/profiles/sort-disable-programs.sh and src/etc-cleanup/main.c. This makes the order in `private-etc` always be groups (`@group`), then uppercase paths, then lowercase paths. Example from etc/profile-m-z/softmaker-common.profile: private-etc @tls-ca,SoftMaker,fstab Note that this does not affect a significant amount of profiles; most changes are in `private-bin` / `private-lib` lines and in `private-etc` lines for newer profiles that do not use groups. This is partly due to commit 5d0822c52 ("private-etc: big profile changes", 2023-02-05) replacing `X11` with `@x11` in `private-etc` lines and then commit 0f996ea4d ("private-etc: groups modified", 2023-02-05) removing `Trolltech.conf` from `private-etc` lines and using case-sensitive sorting in them. Relates to #5610.
* | Merge pull request #6067 from nutta-git/patch-2Libravatar netblue302023-11-24
|\ \ | | | | | | lutris.profile: allow more syscalls
| * | lutris.profile: allow more syscallsLibravatar duevo2023-11-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | Need to whitelist `ptrace` and `clone3` for Ubisoft Connect to work. journalctl did list `process_vm_readv` when a game was running, but it didn't crash the game. Fixes #6035.
* | | Merge pull request #6066 from nutta-git/patch-1Libravatar netblue302023-11-24
|\ \ \ | | | | | | | | steam.profile: allow process_vm_readv syscall
| * | | steam.profile: allow process_vm_readv syscallLibravatar duevo2023-10-31
| |/ / | | | | | | | | | | | | | | | EA Origin (game launcher) won't launch without this. See https://github.com/netblue30/firejail/issues/5185#issuecomment-1776516159
* | | profiles: whitelist alternative data directory for tesseractLibravatar Reiner Herrmann2023-11-18
| | | | | | | | | | | | on Debian the data is in /usr/share/tesseract-ocr/
* | | New profile: tiny-rdm (#6083)Libravatar glitsj162023-11-11
| | | | | | | | | | | | | | | | | | | | | * disable-programs.inc: add support for tiny-rdm * Create tiny-rdm.profile * firecfg.config: add support for tiny-rdm
* | | clamtk: fix scanning (#6074)Libravatar glitsj162023-11-02
| | |
* | | freshclam: fix .local include (#6075)Libravatar glitsj162023-11-02
| | |
* | | discord.profile: allow /usr/share/discord (#6072)Libravatar veloute2023-10-29
| |/ |/| | | | | | | | | | | discord_arch_electron[1] stores its files in /usr/share/discord, rather than the usual /opt/discord. [1] https://aur.archlinux.org/packages/discord_arch_electron
* | profiles: Extend node stack support for pnpm (#6063)Libravatar glitsj162023-10-24
| | | | | | | | | | | | | | | | | | * nodejs-common: add pnpm support * disable-programs.inc: add pnpm support * Create pnpm.profile * Create pnpx.profile
* | disable-programs.inc: remove duplicated entriesLibravatar Kelvin M. Klann2023-10-24
| | | | | | | | | | | | | | | | | | | | | | | | | | They are already present in disable-common.inc. Added in the following commits: * 6bf6d5ed5 ("updated program files", 2016-12-02) / PR #951 * 49280197c ("various hardening (#3394)", 2020-05-02) * 2e2c2327f ("profiles: support more msmtp configuration paths (#6060)", 2023-10-22) Misc: This was noticed on PR #6060.
* | profiles: centralize gnome-boxes blacklisting in dcLibravatar Kelvin M. Klann2023-10-22
|/ | | | | | | | | They are currently spread over disable-common.inc and disable-programs.inc. Added on commit 6f7ab41e4 ("blacklist gnome-boxes user files (VM-Images)", 2019-10-13) and commit 49280197c ("various hardening (#3394)", 2020-05-02).
* profiles: support more msmtp configuration paths (#6060)Libravatar glitsj162023-10-22
| | | | | | | | | | | | | | | | | Since version 1.8.6 msmtp supports per-user configuration at either ~/.msmtprc (already supported by firejail) or `$XDG_CONFIG_HOME/msmtp/config`. System-wide support can be placed at /etc/msmtprc. This adds the missing paths to the relevant .inc and .profile files. Note that `blacklist ${HOME}/.msmtprc` is present on both disable-common.inc and disable-programs.inc, so the new paths are added to both files. References: https://wiki.archlinux.org/title/Msmtp#Basic_setup https://marlam.de/msmtp/msmtp.html#Configuration-files
* profiles: exchange private-opt with a whitelist (#6021)Libravatar glitsj162023-10-18
| | | | | | | | | | | | | * profiles: drop private-opt (existing whitelist) * profiles: replace private-opt with whitelist In most profiles. Kept private-opt for enpass (~85MB), mate-dictionary (<20MB), minecraft-launcher (~1.6MB) and ppsspp (~44MB). The only app I couldn't check: xmr-stak. * docs: note potential issues with private-opt
* steam.profile: Allow Baba Is You (#6054)Libravatar Frostbyte46642023-10-16
|
* ssmtp: allow (SUID) binary (#6052)Libravatar glitsj162023-10-15
|
* disable-common.inc: more SUID binaries (#6051)Libravatar glitsj162023-10-15
|
* disable-common.inc: add more suid programsLibravatar Kelvin M. Klann2023-10-11
| | | | | | | | | | | Programs: $ pacman -Qo fusermount3 groupmems mount.cifs wall write /usr/bin/fusermount3 is owned by fuse3 3.16.1-1 /usr/bin/groupmems is owned by shadow 4.14.0-4 /usr/bin/mount.cifs is owned by cifs-utils 7.0-3 /usr/bin/wall is owned by util-linux 2.39.2-1 /usr/bin/write is owned by util-linux 2.39.2-1
* disable-common.inc: sort suid sectionLibravatar Kelvin M. Klann2023-10-11
|
* pavucontrol-qt: fix broken whitelisting in ${HOME} (#6045)Libravatar glitsj162023-10-09
|
* tshark: CLI hardening (#6040)Libravatar glitsj162023-10-07
|
* New profile: termshark (#6039)Libravatar glitsj162023-10-07
| | | | | | | * Create termshark.profile * firecfg.config: add termshark support * termshark: CLI hardening
* wireshark: fix access to dumpcap (#6038)Libravatar glitsj162023-10-07
|
* nicotine: allow sound notifications (#6037)Libravatar glitsj162023-10-07
|
* nicotine: support Fcitx and dconf via dbus-user filter (#6036)Libravatar glu87162023-10-07
| | | | | * Update nicotine.profile * dbus.user set to filter
* Merge pull request #6009 from jtrv/tidal-hifiLibravatar netblue302023-10-05
|\ | | | | New profile: tidal-hifi
| * New profile: tidal-hifi (#6008)Libravatar jtrv2023-09-25
| | | | | | | | | | | | | | | | | | | | | | modified src/firecfg/firecfg.config to add tidal-hifi created etc/profile-m-z/tidal-hifi.profile closes: #6008 Apply suggestions from code review Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* | Merge pull request #6030 from glitsj16/np-floorpLibravatar netblue302023-10-05
|\ \ | | | | | | New profile: floorp
| * | disable-programs.inc: fix sortingLibravatar glitsj162023-10-02
| | |
| * | Create floorp.profileLibravatar glitsj162023-10-02
| | |
| * | disable-programs.inc: add floorp supportLibravatar glitsj162023-10-02
| | |
* | | Create brz.profile and bzr.profile (#6028)Libravatar glitsj162023-10-03
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From Breezy's documentation[1] [2]: > Breezy is a friendly fork of the Bazaar (bzr) project, hosted on > http://bazaar.canonical.com/. It is backwards compatibility with > Bazaar's disk format and protocols. One of the key differences with > Bazaar is that Breezy runs on Python 3, rather than on Python 2. breezy is also the drop-in replacement for bazaar on Arch Linux since pacman 6.0.2-8[3]. > By default, Breezy provides support for both the Bazaar and Git file > formats. Note: The profile is implemented as a git redirect. [1] https://github.com/breezy-team/breezy [2] https://www.breezy-vcs.org/ [3] https://gitlab.archlinux.org/archlinux/packaging/packages/pacman/-/commit/c68a4e6602e3488fa093a18d35202c76a730faf6
* | | New profile: lettura (#6027)Libravatar glitsj162023-10-03
|/ / | | | | | | | | | | | | * disable-programs.inc: add lettura support * Create lettura.profile * firecfg.config: add lettura
* | disable-common.inc: add foot to 'bad terminals' section (#6025)Libravatar glitsj162023-09-28
| |
* | youtubemusic-nativefier: fix include .local name (#6020)Libravatar glitsj162023-09-26
| |
* | profiles: dpkg fix (#6019)Libravatar glitsj162023-09-26
|/
* profiles: fix path of system-log-common.profileLibravatar Kelvin M. Klann2023-09-23
| | | | | | | | | | | | | This amends commit dd5539012 ("profiles: refactor log viewers (#5996)", 2023-09-23). Commands used: git mv \ etc/profile-m-z/profile-m-z/profile-m-z/system-log-common.profile \ etc/profile-m-z/system-log-common.profile rmdir etc/profile-m-z/profile-m-z/profile-m-z/ rmdir etc/profile-m-z/profile-m-z/
* create fluffychat.profile (#6007)Libravatar pirate4867431862023-09-23
| | | Co-authored-by: pirate486743186 <>
* mocp: hardening (#6017)Libravatar glitsj162023-09-23
|
* mocp: fix networking (#6016)Libravatar glitsj162023-09-23
|
* profiles: refactor log viewers (#5996)Libravatar glitsj162023-09-23
| | | | | | | | * profiles: refactor log viewers Introduces system-log-common.profile as a common profile for existing GUI log viewer applications. * system-log-common: enable no3d
* steam.profile: Allow Factorio (#6012)Libravatar archaon6162023-09-19
| | | | Add directories to config so Factorio runs correctly.
* Add blender-3.6 redirect (#6013)Libravatar Frostbyte46642023-09-18
|
* gwenview: add Trash support (#6001)Libravatar glitsj162023-09-18
|
* telegram.profile: allow ~/.local/share/telegram-desktop (#5994)Libravatar Denis Subbotin2023-09-18
| | | New TelegramWebApps uses another directory for saving local storage.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-20 01:58:23 +0000