aboutsummaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAge
...
* | refactor mattermost-desktop as electron redirect (#3806)Libravatar rusty-snake2021-01-08
| |
* | update manpages and RELNOTESLibravatar rusty-snake2021-01-08
| |
* | Add profile for npm (#3866)Libravatar Aidan Gauland2021-01-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add profile for npm * Apply suggestions from code review * Remove redundant blacklisting of Wayland. * Remove unnecessary noblacklist lines for nodejs. * Replace absolute paths to .inc files with filenames. * Remove unneeded dbus whitelisting. Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> * Remove empty line To keep consistent with other profiles, remove the blank line after the header comment. Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> * Add npm files to add-common-devel So that our addition of npm paths to disable-programs.inc dose not break IDEs, we need to unblacklist these same paths in allow-common-devel.inc. * Remove extra blank line * Add common whitelist includes to npm profile * Tighten npm profile Include disable-exec.inc, but allowing ${HOME}. * Remove whitelist-common.inc from npm profile whitelist-common breaks npm, and since we don't know where the user's npm projects will be, leave the whitelist-common include in a comment with a note about how to enable it for their setup. * Fix inverted commands Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> * Fixes for whitelisting * Add login.defs to npm profile's private-etc Co-authored-by: Aidan Gauland <aidalgol+git@fastmail.net> Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* | electron redirect fixes (#3875)Libravatar glitsj162021-01-07
| | | | | | | | | | * drop doubled netfilter in atom.profile * drop doubled disable-mnt in tutanota-desktop.profile
* | harden liferea (#3873)Libravatar glitsj162021-01-06
| | | | | | | | | | | | | | * harden liferea * dbus fixes On closer investigation it seems wiser to tighten D-Bus filtering as Liferea implements stuff via plugins that are disabled by default.
* | fix preview in apostropheLibravatar rusty-snake2021-01-05
| |
* | new profile: tutanota-desktop (#3870)Libravatar glitsj162021-01-05
| | | | | | | | | | | | | | | | | | * new profile: tutanota-desktop * add tutanota-desktop to firecfg * blacklist tutanota-desktop files * Create tutanota-desktop.profile
* | drop doubled disable-exec in signal-desktop (#3869)Libravatar glitsj162021-01-05
| |
* | fix #3859 (#3863)Libravatar glitsj162021-01-01
| | | | | | | | | | | | | | * fix #3859 * fix #3859 * fix #3859
* | really fix running kernel config check (#3859)Libravatar glitsj162020-12-31
| | | | | | | | | | | | | | | | | | | | | | | | | | * really fix running kernel config check archiver-common.inc includes `disable-shell.inc`, breaking $ zcat /proc/config.gz Cannot start application: Permission denied * really fix running kernel config check archiver-common.inc includes `disable-shell.inc`, breaking $ zgrep -c "CONFIG_USER_NS=y" /proc/config.gz Cannot start application: Permission denied
* | Merge pull request #3760 from kmk3/fix-keepassxcLibravatar netblue302020-12-30
|\ \ | | | | | | keepassxc.profile: Fix hang due to seccomp
| * | keepassxc.profile: Fix hang due to seccompLibravatar Kelvin M. Klann2020-11-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the current profile, keepassxc hangs on startup, before showing the main window: $ uname -r -m 5.9.1-artix1-1 x86_64 $ firejail --version | head -n 1 firejail version 0.9.64 $ firejail --quiet keepassxc --version KeePassXC 2.6.2 $ firejail --quiet keepassxc # (nothing happens) ^C Seccomp debugging as explained on etc/templates/syscalls.txt: $ sudo grep -Eo 'keepassxc.* syscall=[0-9]+' /var/log/messages.log | tail -n 1 keepassxc" exe="/usr/bin/keepassxc" sig=31 arch=c000003e syscall=303 $ firejail --debug-syscalls | grep 303 303 - name_to_handle_at So allow the name_to_handle_at syscall. Relates to #3549.
* | | Merge branch 'master' into browsersLibravatar Reiner Herrmann2020-12-29
|\ \ \
| * \ \ Merge pull request #3847 from bbhtt/small_fixesLibravatar Reiner Herrmann2020-12-29
| |\ \ \ | | | | | | | | | | Small fixes
| | * | | Put a comment about dbus rules and comment themLibravatar bbhtt2020-12-29
| | | | |
| | * | | Fix Nheko cache directoryLibravatar bbhtt2020-12-28
| | | | |
| | * | | Add dbus rulesLibravatar bbhtt2020-12-28
| | | | |
| | * | | Add whitelists, remove wrong cache whitelist, add dbus rules, apparmorLibravatar bbhtt2020-12-28
| | | | |
| | * | | Add quietLibravatar bbhtt2020-12-28
| | | | |
| | * | | Calls each program from /bin to populate listLibravatar bbhtt2020-12-28
| | | | |
| | * | | Add secret storage dbusLibravatar bbhtt2020-12-28
| | | |/ | | |/|
| * | | profiles: add redirect from matrix-mirage to mirage (#3854)Libravatar Reiner Herrmann2020-12-29
| | | |
| * | | Update keepassxc.profile dbus commentsLibravatar rusty-snake2020-12-29
| |/ / | | | | | | | | | | | | - split notifications and tray - fix tray policy
* | | On Debian/Ubunbtu microsoft-edge redirects to dev-channel right nowLibravatar bbhtt2020-12-29
| | |
* | | Add profiles for MS Edge dev build for Linux and LibrewolfLibravatar bbhtt2020-12-28
|/ /
* | remove trailing whitespacesLibravatar rusty-snake2020-12-21
| |
* | brave: enable wruc and wuscLibravatar rusty-snake2020-12-21
| |
* | move whlist /usr/share/chromium from chomium-comm…Libravatar rusty-snake2020-12-21
| | | | | | | | | | | | | | | | …on to chromium, remove the nowhlist from min and its whlist from riot-web. TODO: remove the 'ignore whitelist /usr/share/chomium' from the most profiles with it.
* | new profile: servoLibravatar rusty-snake2020-12-21
| |
* | disable-common.inc: add missing dns tools (#3828)Libravatar Kelvin2020-12-20
| | | | | | | | | | | | | | | | | | | | Add the missing binaries in the DNS section, as suggested by @glitsj16: https://github.com/netblue30/firejail/pull/3810#issuecomment-742920539 Packages and their relevant binaries: * bind: dnssec-* * knot: khost * unbound: unbound-host
* | archivers: limiting file system access (#3834)Libravatar glitsj162020-12-19
| | | | | | | | | | | | | | | | | | * limit file system access with comments in archiver-common.inc * note wording * Warn against overtightening file system access Be more explicit about things breaking when archiver profiles are too tight. Thanks for the suggestion by @rusty-snake in #3834.
* | Refactor electron.profile and electron based programs (#3807)Libravatar rusty-snake2020-12-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactor electron.profile and electron based programs (1) * Refactor electron.profile and electron based programs (2) * Refactor electron.profile and electron based programs (3) * Refactor electron.profile and electron based programs (4) * Refactor electron.profile and electron based programs (5) * Refactor electron.profile and electron based programs (6) * Refactor electron.profile and electron based programs (7) * Refactor electron.profile and electron based programs (8)
* | Archiver fixes - drop private-bin (#3832)Libravatar glitsj162020-12-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop private-bin * drop private-bin * drop private-bin * drop private-bin * drop private-bin * disable private-lib in tar.profile Removing private-bin caused a test to fail - see discussion in https://github.com/netblue30/firejail/pull/3832. Thanks to @reinerh for explaining why I broke things!
* | disable-shell.inc: add oksh (#3829)Libravatar Kelvin2020-12-16
| | | | | | | | | | | | | | | | | | | | | | "Portable OpenBSD ksh, based on the Public Domain Korn Shell (pdksh)." Project page: https://github.com/ibara/oksh $ pacman -Q oksh oksh 6.8.1-1 $ pacman -Qlq oksh | grep bin/ /usr/bin/ /usr/bin/oksh
* | New profiles for alacarte,tootle,photoflare (#3816)Libravatar kortewegdevries2020-12-16
| | | | | | | | | | | | | | * New profiles for alacarte,tootle,photoflare * Fix dbus Co-authored-by: kortewegdevries <kortewegdevries@protonmail.ch>
* | archiver fixes (#3830)Libravatar glitsj162020-12-16
| | | | | | | | | | * fix gzip * fix tar
* | Refactor archivers ii (#3827)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * harden 7z.profile * harden atool.profile * harden bsdtar.profile * harden cpio.profile * harden gzip.profile * harden tar.profile * harden unrar.profile * harden unzip.profile * harden xzdec.profile * harden zstd.profile
* | Refactor archivers (#3820)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Create archiver-common.inc * add apparmor to archiver-common.inc * refactor 7z.profile * refactor ar.profile * refactor atool.profile * refactor bsdtar.profile * refactor cpio.profile * refactor gzip.profile * refactor tar.profile * refactor unrar.profile * refactor unzip.profile * refactor xzdec.profile * refactor zstd.profile * rewording * blacklist ${RUNUSER} in archiver-common.inc Thanks to @rusty-snake for suggesting this. * drop non-sensical ${RUNUSER}/wayland-* blacklisting in archiver-common.inc See discussion in https://github.com/netblue30/firejail/pull/3820#discussion_r543523343
* | Runuser fixes (#3826)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting * drop non-sensical ${RUNUSER}/wayland-* blacklisting
* | rename softmaker-common.inc to softmaker-common.profile (#3825)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Rename etc/inc/softmaker-common.inc to etc/profile-m-z/softmaker-common.profile As per suggestion by @rusty-snake in https://github.com/netblue30/firejail/pull/3819#issuecomment-745244982 * softmaker-common.profile name change * softmaker-common.profile name change * softmaker-common.profile name change * softmaker-common.profile name change * softmaker-common.profile name change * softmaker-common.profile name change * softmaker-common.profile name change * softmaker-common.profile name change * softmaker-common.profile name change
* | re-enable nogroups with a comment in zoom.profile (#3824)Libravatar glitsj162020-12-15
| | | | | | Better fix for #3711, see discussion there.
* | rename whitelist-players.inc to whitelist-player-common.inc (#3819)Libravatar glitsj162020-12-15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Update and rename whitelist-players.inc to whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc * renamed whitelist-player-common.inc
* | Fix sound in games using FMOD (#3821)Libravatar fenuks2020-12-15
| | | | | | Co-authored-by: fenuks <fenuks>
* | streamline comments in inc files (#3818)Libravatar glitsj162020-12-14
| | | | | | | | | | | | | | | | | | | | | | * streamline comments * streamline comments * streamline comments * streamline comments * streamline comments
* | drill profileLibravatar netblue302020-12-12
| |
* | Merge pull request #3810 from kmk3/dc-add-ldnsLibravatar netblue302020-12-12
|\ \ | | | | | | Dc add ldns
| * | disable-common.inc: blacklist ldns toolsLibravatar Kelvin M. Klann2020-12-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | drill(1) from ldns is the first tool suggested on the Arch Wiki for DNS lookup: https://wiki.archlinux.org/index.php/Domain_name_resolution#Lookup_utilities Home page: https://www.nlnetlabs.nl/projects/ldns/about/ $ pacman -Q ldns ldns 1.7.1-2 $ pacman -Qlq ldns | grep bin /usr/bin/ /usr/bin/drill /usr/bin/ldns-chaos /usr/bin/ldns-compare-zones /usr/bin/ldns-config /usr/bin/ldns-dane /usr/bin/ldns-dpa /usr/bin/ldns-gen-zone /usr/bin/ldns-key2ds /usr/bin/ldns-keyfetcher /usr/bin/ldns-keygen /usr/bin/ldns-mx /usr/bin/ldns-notify /usr/bin/ldns-nsec3-hash /usr/bin/ldns-read-zone /usr/bin/ldns-resolver /usr/bin/ldns-revoke /usr/bin/ldns-rrsig /usr/bin/ldns-signzone /usr/bin/ldns-test-edns /usr/bin/ldns-testns /usr/bin/ldns-update /usr/bin/ldns-verify-zone /usr/bin/ldns-version /usr/bin/ldns-walk /usr/bin/ldns-zcat /usr/bin/ldns-zsplit /usr/bin/ldnsd
| * | disable-common.inc: sort DNS / RUNUSER pathsLibravatar Kelvin M. Klann2020-12-10
| | |
* | | curl HSTS cache support (#3813)Libravatar glitsj162020-12-12
| | | | | | | | | | | | | | | * add curl HSTS support * add HSTS support
* | | refactor playonlinux as wine redirect (#3811)Libravatar rusty-snake2020-12-12
| | |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-05 15:01:56 +0000