firejail - Mirror of https://github.com/netblue30/firejail

	Commit message (Collapse)	Author	Age
...
\| * \| \|	ssh: move auth socket blacklist to disable-common.inc	Kelvin M. Klann	2021-01-22
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	That was added on the commit e93fbf3bd ("disable ssh-agent sockets in disable-programs.inc"). Currently, it's the only ssh-related entry on disable-programs.inc. Further, it seems that all the other socket blacklists live on disable-common.inc. Also, even though this socket does not necessarily allow arbitrary command execution on the local machine (like some paths on disable-common.inc do), it could still do so for remote systems. Put it above the "top secret" section, like the terminal sockets are above the terminal server section.
* \| \| \|	Fix #3925 -- telegram-desktop launch browser for …	rusty-snake	2021-01-29
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	…open URL (after update to 0.9.64.2)
* \| \| \|	Add gfeeds directory for saved articles	rusty-snake	2021-01-29
\| \|/ / \|/\| \|
* \| \|	Merge pull request #3897 from nidamanx/patch-1	rusty-snake	2021-01-28
\|\ \ \ \| \| \| \| \| \| \| \|	Update telegram.profile
\| * \| \|	Profile ordering/sorting as in profile.template	Nicola Davide Mannarelli	2021-01-25
\| \| \| \|
\| * \| \|	Enhance security	Nicola Davide Mannarelli	2021-01-25
\| \| \| \|
\| * \| \|	Update telegram.profile	Nicola Davide Mannarelli	2021-01-17
\| \| \| \| \| \| \| \| \| \| \| \|	Optimized "include whitelist-common.inc"
\| * \| \|	Update telegram.profile	Nicola Davide Mannarelli	2021-01-17
\| \| \| \| \| \| \| \| \| \| \| \|	Allow Telegram ONLY in .TelegramDesktop, .local/share/TelegramDesktop and Downloads
* \| \| \|	add extensive comment on sandboxing google-earth-pro (#3923)	glitsj16	2021-01-28
\| \| \| \|
* \| \| \|	streamline 'Allow xxx' comments (#3922)	glitsj16	2021-01-27
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* add comment: allow python * add comment: allow python * reorder allow comments * fix perl allow comment * add comment: allow python * add comment: allow lua, perl & python * reorder allow comments * add comment: allow python * add comment: allow python * add comment: allow lua, perl & python * fix allow comments * add comment: allow python * add comment: allow python * fix spacing in comments * add comment: allow python * add comment: allow python * fix comment * add comment: allow perl & python * add comment: allow lua & python * add comment: allow lua, perl & python * fix allow comments * add comment: allow perl & python * streamline allow python comments
* \| \| \|	merge/readme update	netblue30	2021-01-25
\| \| \| \|
* \| \| \|	Merge pull request #3853 from botherder/master	netblue30	2021-01-25
\|\ \ \ \ \| \| \| \| \| \| \| \| \| \|	New profile for CoyIM
\| * \| \| \|	Added additional whitelists	Nex	2021-01-06
\| \| \| \| \|
\| * \| \| \|	Implementing some of the suggested changes from #3853	Nex	2020-12-29
\| \| \| \| \|
\| * \| \| \|	Added some more restrictions to coyim profile	Nex	2020-12-29
\| \| \| \| \|
\| * \| \| \|	Added first profile for coyim	Nex	2020-12-29
\| \| \|_\|/ \| \|/\| \|
* \| \| \|	Merge pull request #3899 from rootalc/nolocal6	netblue30	2021-01-25
\|\ \ \ \ \| \| \| \| \| \| \| \| \| \|	Create nolocal6.net
\| * \| \| \|	Create nolocal6.net	rootalc	2021-01-18
\| \| \|/ / \| \|/\| \|
* \| \| \|	Merge pull request #3918 from Neo00001/master	netblue30	2021-01-25
\|\ \ \ \ \| \| \| \| \| \| \| \| \| \|	Add profile for kdiff3
\| * \| \| \|	Update kdiff3.profile	Neo00001	2021-01-24
\| \| \| \| \|
\| * \| \| \|	Create kdiff3.profile	Neo00001	2021-01-24
\| \| \| \| \|
\| * \| \| \|	Update disable-programs.inc	Neo00001	2021-01-24
\| \| \| \| \|
* \| \| \| \|	fix #3914	netblue30	2021-01-24
\|/ / / /
* \| \| \|	Update vmware.profile (#3913)	Neo00001	2021-01-24
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* Update vmware.profile `private-etc` can be uncommented. * Update vmware.profile
* \| \| \|	misc comment fixes (#3916)	glitsj16	2021-01-24
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* fix comment in blackbox.profile * fix comment in fluxbox.profile * fix comment in i3.profile * fix comment in krunner.profile * fix comment in openbox.profile
* \| \| \|	refactor google-earth{-pro} (#3915)	glitsj16	2021-01-23
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* refactor google-earth{-pro} blacklisting * fix google-earth-pro.profile I've included all binaries found in the Arch Linux AUR package to private-bin. But I also added a note on ignoring private-bin because I'm not sure what google-earth is doing on other distro's. * unbreak google-earth.profile Not sure why we need grep, ls and sed in private-bin exactly but keeping them around wouldn't hurt too much I guess.
* \| \| \|	Update bibletime.profile, add new whitelist (#3908)	hhzek0014	2021-01-22
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	To solve issue#3907, doc directory of the bibletime has to be whitelisted. Otherwise, it always fails to start. Co-authored-by: hhnb <hhnb@nanenient.cc>
* \| \| \|	add new profile: pkglog (#3902)	glitsj16	2021-01-18
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* add pkglog to new profiles * Create pkglog.profile * Update README.md * fix ordering in pkglog.profile * drop extra whitespace in pkglog.profile
* \| \| \|	harden plv.profile (#3901)	glitsj16	2021-01-18
\| \| \| \|
* \| \| \|	Add 'seccomp-error-action log' to profile.template	rusty-snake	2021-01-18
\| \| \| \|
* \| \| \|	Add profile for guvcview	rusty-snake	2021-01-18
\| \| \| \|
* \| \| \|	harden and fix cheese.profile	rusty-snake	2021-01-18
\|/ / / \| \| \| \| \| \| \| \| \| \| \| \|	hardening: wusc + wruc fix: settings was immutable
* \| \|	Add new allow include allow-bin-sh.inc	rusty-snake	2021-01-16
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	/bin/sh is usually just a symlink to bash. However this is not the case for every distro, debian for example uses dash. bash,dash and sh have a blacklist command in disable-shell.inc. An own allow-*.inc for it enusres usage of all necessary nolacklists. For private-bin sh is enough because it follows symlinks.
* \| \|	newsboat: add lynx support (#3895)	altf_four	2021-01-15
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* newsboat: add lynx support * newsboat: fix using sort.py * newsboat: remove unneeded perms
* \| \|	fix mdr.profile	glitsj16	2021-01-13
\| \| \| \| \| \| \| \| \|	Thanks @rusty-snake for [spotting](https://github.com/netblue30/firejail/commit/662ebd214b0a7874072381f5aaf3fbd322f0e460) this!
* \| \|	new profile: qnapi (#3890)	glitsj16	2021-01-13
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* add new profile: qnapi * add new profile: qnapi * Create qnapi.profile * add qnapi configs * Update README.md * Update README.md
* \| \|	add new profile: shotwell (#3889)	glitsj16	2021-01-13
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* new profile: shotwell * Create shotwell.profile * new profile: shotwell * add shotwell blacklists
* \| \|	new profile: mdr (#3888)	glitsj16	2021-01-13
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* add new profile: mdr * Create mdr.profile
* \| \|	new profile: agetpkg (#3887)	glitsj16	2021-01-13
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* Create agetpkg.profile * new profile: agetpkg
* \| \|	add new profiles: lsar & unar (ar redirects) (#3886)	glitsj16	2021-01-13
\| \|/ \|/\| \| \| \| \| \| \| \| \| \| \|	* Create lsar.profile * Create unar.profile * new profiles lsar & unar
* \|	refactor nodejs applications (npm & yarn) (#3876)	glitsj16	2021-01-11
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* add yarn & reorder * add node-gyp & yarn files * Create nodejs-common.profile * Create yarn.profile * refactor npm.profile * add new profile: yarn * read-only's for npm/yarn Thanks to the [suggestion](https://github.com/netblue30/firejail/pull/3876#pullrequestreview-564682989) from @kmk3. * ignore read-only's for npm As [suggested](https://github.com/netblue30/firejail/pull/3876#pullrequestreview-564682989) by @kmk3. * ignore read-only for yarn As suggested in https://github.com/netblue30/firejail/pull/3876#pullrequestreview-564682989 by @kmk3. * remove quiet from nodejs-common.profile quiet should go into the caller profiles instead * add quiet to npm.profile Thanks @rusty-snake for the review. * re-ordering some options * re-ordering
* \|	fix ordering in ssh.profile (#3882)	glitsj16	2021-01-11
\| \|
* \|	Improvements to balsa,fractal,gajim,trojita (#3791)	bbhtt	2021-01-11
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* Improvements to balsa,fractal,gajim,trojita * sort * Add gpg plugin support to gajim,remove notifications dbus from trojita * Add dbus policy from flatpak per @rusty-snake * Add python* to private-bin; remove some dbus Co-authored-by: kortewegdevries <kortewegdevries@protonmail.ch>
* \|	Merge pull request #3879 from aidalgol/steam-arma3-fix	SkewedZeppelin	2021-01-11
\|\ \ \| \| \| \| \| \|	Whitelist Bohemia Interactive config dir for Steam
\| * \|	Add blacklist line for Bohemia Interactive to disable-programs	Aidan Gauland	2021-01-10
\| \| \|
\| * \|	Whitelist Bohemia Interactive config dir for Steam	Aidan Gauland	2021-01-10
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	At least Arma 3 stores its config directory under ~/.local/share/bohemiainteractive
* \| \|	discord-common.profile: Fix audio support (#3880)	Nikos Chantziaras	2021-01-10
\|/ / \| \| \| \|	Discord needs PulseAudio. Without it, it's unable to play any audio.
* \|	evince.profile: optionally allow bookmark/metadata access	Samtinel	2021-01-09
\| \| \| \| \| \| \| \| \| \| \| \| \| \|	bookmarks are saved unter $HOME/.local/share/gvfs-metadata since evince is the primary pdf reader, a firejailed evince can't read or write those this commit adds instructions to enable metadata writing and reading
* \|	Add new profile for marker	rusty-snake	2021-01-08
\| \|
* \|	Harden openshot.profile	rusty-snake	2021-01-08
\| \| \| \| \| \| \| \| \| \|	'dbus-user none' freeze openshot when clicking on open project, 'dbus-user filter' works.