aboutsummaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAge
...
| * Some sorting per @kmk3Libravatar bbhtt2020-12-31
| |
| * Rearrange and fixes per commentsLibravatar bbhtt2020-12-31
| |
| * Add seccomp.block-secondary per @rusty-snakeLibravatar bbhtt2020-12-31
| |
| * Improve whitelisting and dbus of Sylpheed and Claws-mailLibravatar bbhtt2020-12-31
| |
| * Add folks cache directoryLibravatar bbhtt2020-12-29
| |
| * Fix python; add read-only to editors/cli browsers;re-add cache directoryLibravatar bbhtt2020-12-29
| |
| * Add Evolution and folks directories coming from evolution data server common ↵Libravatar bbhtt2020-12-29
| | | | | | | | to both geary and evolution; add dbus permissions fromflatpak
| * Add whitelisting to mutt; improve geary, new profile for neomuttLibravatar bbhtt2020-12-28
| |
* | Housekeeping: strip extra whitespaceLibravatar Fred Barclay2021-02-08
| | | | | | | | | | Just `find . -not \( -name .git -prune -o -name *.AppImage -prune \) -type f -print0 | xargs -0 perl -pi -e 's/ +$//'` and filter to avoid unwanted changes (especially .md files)
* | etc: use ${DOCUMENTS} macro where appropriateLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, some paths are hard-coded: $ grep -Fnr '${HOME}/Documents' etc etc-fixes etc/profile-m-z/Mathematica.profile:19:mkdir ${HOME}/Documents/Wolfram Mathematica etc/profile-m-z/Mathematica.profile:22:whitelist ${HOME}/Documents/Wolfram Mathematica etc/profile-a-l/keepassxc.profile:34:# If you do so, you MUST store your database under ${HOME}/Documents/KeePassXC/foo.kdbx etc/profile-a-l/keepassxc.profile:35:#mkdir ${HOME}/Documents/KeePassXC etc/profile-a-l/keepassxc.profile:36:#whitelist ${HOME}/Documents/KeePassXC Commands used to search and replace: $ find etc etc-fixes/ -type f -exec \ sed -i.bak -e 's|\${HOME}/Documents|${DOCUMENTS}|' '{}' + Related to that, the (lack of) usage of ${DOWNLOADS} has been recently fixed on commit deae31301 ("use ${DOWNLOADS} in lutris.profile (#3955)"). With the above change, all macros other than ${DOCUMENTS} seem to be already used appropriately: $ grep -Fnr '${HOME}/Desktop' etc etc-fixes $ grep -Fnr '${HOME}/Downloads' etc etc-fixes $ grep -Fnr '${HOME}/Music' etc etc-fixes $ grep -Fnr '${HOME}/Pictures' etc etc-fixes $ grep -Fnr '${HOME}/Videos' etc etc-fixes See src/firejail/macros.c for details.
* | archivers: wrap commentsLibravatar Kelvin M. Klann2021-02-08
| |
* | archivers: move archiver-common.inc include to the bottomLibravatar Kelvin M. Klann2021-02-08
| | | | | | | | | | | | | | And mark it as a redirect profile. This is done so when including other *-common.inc profiles, such as firefox-common.profile.
* | use ${DOWNLOADS} in lutris.profile (#3955)Libravatar glitsj162021-02-07
| |
* | Add profile for Gemini (#3946)Libravatar Neo000012021-02-07
| | | | | | | | | | | | | | | | | | | | | | * Update disable-programs.inc * Create calligragemini.profile * Update calligra.profile * Update calligra.profile * Update firecfg.config
* | disable-interpreters.inc: blacklist the other libmozjsLibravatar Kelvin M. Klann2021-02-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And sort the paths on allow-gjs.inc. $ pacman -Q js78 js78 78.6.0-1 $ pacman -Qlq js78 | grep -v /usr/include/ /usr/ /usr/bin/ /usr/bin/js78 /usr/bin/js78-config /usr/lib/ /usr/lib/libmozjs-78.so /usr/lib/pkgconfig/ /usr/lib/pkgconfig/mozjs-78.pc This appears to be the only counterpart path missing when looking at the current lib64 entries with: $ grep -Fnr lib64 etc
* | disable-interpreters.inc: sort pathsLibravatar Kelvin M. Klann2021-02-06
| |
* | add a /usr/share whitelist item for uimLibravatar Anton Shestakov2021-02-05
| | | | | | uim is a multilingual input method framework, so any program that takes user input potentially needs it to work.
* | fixup! Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | | | | | damn, forgotten to add
* | Update spectacle.profileLibravatar Neo000012021-02-04
| |
* | Add profile for vmware-viewLibravatar rusty-snake2021-02-04
| | | | | | | | | | | | blacklist ${HOME}/.vwmare is already in disable-programs.inc I did not add it to firecfg.config because it has many extra features such as usb-redirection that I could not test.
* | keepassxc: allow all browser, not just firefoxLibravatar rusty-snake2021-02-02
| | | | | | | | ungoogled-chromium won't work with keepassxc (#3941)
* | Add profile for avidemux (#3935)Libravatar Neo000012021-01-31
| | | | | | | | | | | | | | | | | | | | | | * Update disable-programs.inc * Update disable-programs.inc * Update firecfg.config * Create avidemux.profile * Update avidemux.profile
* | Disable the webkit2gtk-4.0 sandbox in bijibenLibravatar rusty-snake2021-01-31
| | | | | | | | | | | | | | | | | | | | | | | | | | webkit2gtk uses a bwrap based sandbox by default since 4.0, see #3647. This is good as it means more security by default on for linux system. Unfortunately is it not possible to run bwrap inside firejail if bwrap is started with --unshare-pid --proc /proc at all. In general we should exclude a program from firecfg until a final solution is found. But bijiben is special, while epiphany or evolution display random stuff from the internet is webkit2gtk in bijiben used to display local files create by the user. Bijiben has a thight profile (net none, whitelist, private-bin, ...) therefore my decision here was to disable the webkit2gtk sandbox rather then firejail.
* | add quiet to lzdiff/lzmadec (#3932)Libravatar glitsj162021-01-30
| | | | | | | | | | * add quiet to lzdiff * add quiet to lzmadec
* | Merge pull request #3931 from glitsj16/follow-up-3914Libravatar glitsj162021-01-30
|\ \ | | | | | | follow-up fixes for #3914
| * | follow-up fixes for ↵Libravatar glitsj162021-01-29
| | | | | | | | | | | | https://github.com/netblue30/firejail/commit/43aa71f8c608ec5bd92fd2c7323c603fa37f6d30
* | | Merge pull request #3885 from kmk3/fix-sshLibravatar glitsj162021-01-30
|\ \ \ | | | | | | | | ssh: Refactor, fix bugs & harden
| * | | disable-common.inc: add missing openssh pathsLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The paths are taken from ssh(1) and sshd(8). $ pacman -Q openssh openssh 8.4p1-2 These are only used by sshd(8), so always blacklist them: * ~/.rhosts: controls remote access to the local machine * ~/.shosts: same as above * ~/.ssh/authorized_keys: same as above * ~/.ssh/authorized_keys2: same as above * ~/.ssh/environment: potentially allows arbitrary command execution on the local machine * ~/.ssh/rc: allows arbitrary command execution on the local machine * /etc/hosts.equiv: system-wide equivalent of ~/.rhosts Note: There are files in /etc/ssh that are equivalent to some of the above ones, but they are already blocked by `blacklist /etc/ssh/*`. Note2: From sshd(8): > If the file ~/.ssh/rc exists, sh(1) runs it after reading the > environment files but before starting the user's shell or command. So even if the user shell is set to /usr/bin/firejail and disable-common.inc is loaded, this patch shouldn't interfere with sshd. This file is actually used by ssh(1), so just mark it read-only: * ~/.ssh/config: allows arbitrary command execution on the remote machine (with e.g.: RemoteCommand) and also defines the connection strength Since version 7.3p1 (released on 2016-08-01), openssh supports including other config files on ssh_config(5)[1][2]. This is the conventional path for storing them[3], so mark it read-only: * ~/.ssh/config.d: same as above P.S. See also the explanation on the commit b5542fc94 ("disable-common.inc: read-only access to ~/.ssh/authorized_keys"), which last touched/added the "Remote access" section. [1]: https://anongit.mindrot.org/openssh.git/commit/?id=dc7990be865450574c7940c9880567f5d2555b37 [2]: https://www.openssh.com/txt/release-7.3 [3]: https://superuser.com/a/1142813
| * | | allow-ssh.inc: allow access to ssh-agent(1)Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Leaving it limited to only ssh, ssh-agent and seahorse by default seems unnecessarily restrictive. From ssh(1): > The most convenient way to use public key or certificate > authentication may be with an authentication agent. See ssh-agent(1) > and (optionally) the AddKeysToAgent directive in ssh_config(5) for > more information. $ pacman -Q openssh openssh 8.4p1-2 With ssh-agent(1) running in the background (and with the private key(s) loaded through ssh-add(1)), ssh(1) doesn't need direct access to the actual key pair(s), so you could probably get away with this on allow-ssh.local: ignore noblacklist ${HOME}/.ssh noblacklist ${HOME}/.ssh/config noblacklist ${HOME}/.ssh/config.d noblacklist ${HOME}/.ssh/known_hosts And then this on the profiles of ssh key pair managers, such as seahorse.local: noblacklist ${HOME}/.ssh
| * | | ssh: deny access to the rest of /etc/ssh/*Libravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ssh_config (allowed on allow-ssh.inc) is the only file in /etc/ssh that is used by ssh(1). The other paths are only used by sshd(8), so stop allowing them on ssh.profile and ssh-agent.profile. Path examples from sshd(8): * /etc/ssh/moduli * /etc/ssh/ssh_host_ecdsa_key * /etc/ssh/ssh_host_ecdsa_key.pub * /etc/ssh/ssh_known_hosts * /etc/ssh/sshd_config * /etc/ssh/sshrc $ pacman -Q openssh openssh 8.4p1-2
| * | | allow-ssh.inc: allow /etc/ssh/ssh_configLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is the system-wide equivalent of ~/.ssh/config. $ pacman -Q openssh openssh 8.4p1-2 Reasons for blacklisting both /etc/ssh and /etc/ssh/* on disable-common.inc: Leave /etc/ssh that way so that profiles without allow-ssh.inc remain unable to see inside of /etc/ssh. And blacklist /etc/ssh/* so that profiles with allow-ssh.inc are able to access only nonblacklisted files inside of /etc/ssh.
| * | | etc: add allow-ssh.incLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | And move the scattered `noblacklist ${HOME}/.ssh` entries into it. Command used to find the relevant files: $ grep -Fnr 'noblacklist ${HOME}/.ssh' etc Also, add it to profile.template, as reminded by @rusty-snake at https://github.com/netblue30/firejail/pull/3885#pullrequestreview-567527031
| * | | git-cola.profile: add missing python template commentLibravatar Kelvin M. Klann2021-01-27
| | | | | | | | | | | | | | | | See etc/templates/profile.template.
| * | | ssh: move auth socket blacklist to disable-common.incLibravatar Kelvin M. Klann2021-01-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | That was added on the commit e93fbf3bd ("disable ssh-agent sockets in disable-programs.inc"). Currently, it's the only ssh-related entry on disable-programs.inc. Further, it seems that all the other socket blacklists live on disable-common.inc. Also, even though this socket does not necessarily allow arbitrary command execution on the local machine (like some paths on disable-common.inc do), it could still do so for remote systems. Put it above the "top secret" section, like the terminal sockets are above the terminal server section.
* | | | Fix #3925 -- telegram-desktop launch browser for …Libravatar rusty-snake2021-01-29
| | | | | | | | | | | | | | | | …open URL (after update to 0.9.64.2)
* | | | Add gfeeds directory for saved articlesLibravatar rusty-snake2021-01-29
| |/ / |/| |
* | | Merge pull request #3897 from nidamanx/patch-1Libravatar rusty-snake2021-01-28
|\ \ \ | | | | | | | | Update telegram.profile
| * | | Profile ordering/sorting as in profile.templateLibravatar Nicola Davide Mannarelli2021-01-25
| | | |
| * | | Enhance securityLibravatar Nicola Davide Mannarelli2021-01-25
| | | |
| * | | Update telegram.profileLibravatar Nicola Davide Mannarelli2021-01-17
| | | | | | | | | | | | Optimized "include whitelist-common.inc"
| * | | Update telegram.profileLibravatar Nicola Davide Mannarelli2021-01-17
| | | | | | | | | | | | Allow Telegram ONLY in .TelegramDesktop, .local/share/TelegramDesktop and Downloads
* | | | add extensive comment on sandboxing google-earth-pro (#3923)Libravatar glitsj162021-01-28
| | | |
* | | | streamline 'Allow xxx' comments (#3922)Libravatar glitsj162021-01-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add comment: allow python * add comment: allow python * reorder allow comments * fix perl allow comment * add comment: allow python * add comment: allow lua, perl & python * reorder allow comments * add comment: allow python * add comment: allow python * add comment: allow lua, perl & python * fix allow comments * add comment: allow python * add comment: allow python * fix spacing in comments * add comment: allow python * add comment: allow python * fix comment * add comment: allow perl & python * add comment: allow lua & python * add comment: allow lua, perl & python * fix allow comments * add comment: allow perl & python * streamline allow python comments
* | | | merge/readme updateLibravatar netblue302021-01-25
| | | |
* | | | Merge pull request #3853 from botherder/masterLibravatar netblue302021-01-25
|\ \ \ \ | | | | | | | | | | New profile for CoyIM
| * | | | Added additional whitelistsLibravatar Nex2021-01-06
| | | | |
| * | | | Implementing some of the suggested changes from #3853Libravatar Nex2020-12-29
| | | | |
| * | | | Added some more restrictions to coyim profileLibravatar Nex2020-12-29
| | | | |
| * | | | Added first profile for coyimLibravatar Nex2020-12-29
| | |_|/ | |/| |
* | | | Merge pull request #3899 from rootalc/nolocal6Libravatar netblue302021-01-25
|\ \ \ \ | | | | | | | | | | Create nolocal6.net
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-04 03:04:16 +0000