aboutsummaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAge
* Deny Tor related profiles access to /sys/class/netLibravatar Tad2022-07-23
| | | | | | | | This directory contains the MAC address for connections available Tested working with torbrowser-launcher and onionshare Signed-off-by: Tad <tad@spotco.us>
* viewnior.profile: allow accessing its /usr/share directory (#5270)Libravatar NetSysFire2022-07-23
|
* remmina.profile: allow python3 (#5253)Libravatar NetSysFire2022-07-17
| | | | | | | | | * remmina.profile: allow python * Update etc/profile-m-z/remmina.profile Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com> Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* refresh syscall groups (#5188)Libravatar smitsohu2022-07-17
| | | | | | | | | | | | now covers syscalls up to including process_madvise (440) group assignment was blindly copied from systemd: https://github.com/systemd/systemd/blob/729d2df8065ac90ac606e1fff91dc2d588b2795d/src/shared/seccomp-util.c#L305 the only exception is close_range, which was added to both @basic-io and @file-system this commit adds the following syscalls to the default blacklist: pidfd_getfd,fsconfig,fsmount,fsopen,fspick,move_mount,open_tree
* aria2c.profile: add comment to winetricks workaroundLibravatar Kelvin M. Klann2022-07-11
| | | | | | | | As a reminder to create a profile for winetricks instead of allowing access to its paths to programs used by winetricks (see #5238). Added on commit 0ec1c66b5 ("aria2c.profile: allow access to ~/.cache/winetricks") / PR #5238.
* aria2c.profile: allow access to ~/.cache/winetricksLibravatar Davide Beatrici2022-07-06
| | | | Otherwise winetricks fails to download packages.
* add Colossal Order to steam.profileLibravatar 0x9fff002022-07-05
|
* add Paradox Launcher to blacklisted programs listLibravatar Serphentas2022-06-26
|
* add Paradox Launcher to Steam profileLibravatar Serphentas2022-06-26
|
* disabled private-lib in /etc/firejail/firejail.configLibravatar netblue302022-06-23
|
* Transmission fixes: drop private-lib (#5213)Libravatar glitsj162022-06-22
| | | | | | | * drop private-lib * drop private-lib * drop private-lib
* Revert "xonotic.profile: fix audit denial spam"Libravatar Tad2022-06-20
| | | | | | | Logging is now default disabled in c7e4c8ed592fee7f1644152a23c3e1343b01b922 See https://github.com/netblue30/firejail/issues/5207 This reverts commit c0d314f945b405f1e90a1a43719059cd22f55de7.
* reverting previous seccomp log fix (#5207)Libravatar netblue302022-06-20
|
* Remove shell none from profilesLibravatar rusty-snake2022-06-19
| | | | | | | | | | | | | | | | | | | | | | | Command: sed -i "/^shell none/d" etc/*/* TODO: ``` etc/profile-a-l/beaker.profile:ignore shell none etc/profile-a-l/default.profile:# shell none etc/profile-a-l/fdns.profile:#shell none etc/profile-a-l/gnome-nettool.profile:#shell none etc/profile-a-l/jitsi-meet-desktop.profile:ignore shell none etc/profile-m-z/pidgin.profile:# shell none etc/profile-m-z/rocketchat.profile:ignore shell none etc/profile-m-z/server.profile:# shell none etc/templates/profile.template:# OPTIONS (caps*, net*, no*, protocol, seccomp*, shell none, tracelog) etc/templates/profile.template:#shell none ``` - manpage - RELNOTES - fbuilder
* seccomp-log support in firejail.configLibravatar netblue302022-06-18
|
* fixing seccomp log (#5207)Libravatar netblue302022-06-17
|
* fix artha and add dbus-user filteringLibravatar glitsj162022-06-16
|
* disable chroot by default in /etc/firejail/firejail.configLibravatar netblue302022-06-13
|
* disable cgroup codeLibravatar netblue302022-06-13
|
* Add comment for enabling D-Bus desktop notifications to ↵Libravatar glitsj162022-06-05
| | | | | | | transmission-{gtk,qt} (#5175) * add comment for enabling desktop notifications * add comment for enabling desktop notifications
* disable-shell.inc: add global shell paths from ids.configLibravatar Kelvin M. Klann2022-06-02
| | | | | | | | | | | Since /etc/profile is present, add the other shell-related paths in /etc that are listed on ids.config. Suggestion by @rusty-snake[1]. Relates to #5167 #5170. [1] https://github.com/netblue30/firejail/pull/5167#pullrequestreview-989621852
* ids.config: sort global shell pathsLibravatar Kelvin M. Klann2022-06-02
|
* Merge pull request #5170 from kmk3/ids-add-sh-pathsLibravatar netblue302022-05-31
|\ | | | | ids.config: add missing global shell paths
| * ids.config: add missing global shell pathsLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | Add missing paths for bash, ksh and zsh. Environment: Artix Linux
* | disable-shell.inc: blacklist /etc/profileLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | Since /etc/profile.d is already being blacklisted.
* | disable-common.inc: move blacklist of /etc/profile.dLibravatar Kelvin M. Klann2022-05-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To disable-shell.inc. Interactive shells can be executed from certain development-related programs (such as IDEs) and the shells themselves are not blocked by default, but this shell startup directory currently is. To avoid running a shell without access to potentially needed startup files, only blacklist /etc/profile.d when interactive shells are also blocked. Note that /etc/profile.d should only be of concern to interactive shells, so a profile that includes both disable-shell.inc and allow-bin-sh.inc (which likely means that it needs access to only non-interactive shells) should not be affected by the blacklisting. Relates to #3411 #5159.
* | kate.profile: add missing include commentLibravatar Kelvin M. Klann2022-05-30
|/ | | | | | | This amends commit b6b3f3b38 ("kate.profile: allow common development file access", 2022-05-28) / PR #5159. See etc/templates/profile.template.
* Merge pull request #5158 from hknaack/seamonkey-support-enigmail-gpgLibravatar netblue302022-05-30
|\ | | | | seamonkey.profile: support enigmail/gpg
| * seamonkey.profile: support enigmail/gpgLibravatar Hartmut Knaack2022-05-28
| | | | | | | | Changes inspired by Thunderbird profile.
* | Merge pull request #5159 from hknaack/kate-fixesLibravatar netblue302022-05-30
|\ \ | | | | | | Kate fixes
| * | kate.profile: drop tracelogLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | When starting kate and loading into a session containing a git repository, tracelog caused about 30 seconds of delay until the project structure appeared in the projects sidebar. Error message on console: QProcess: Destroyed while process ("/usr/bin/git") is still running. Drop tracelog to mitigate the delay and error message.
| * | kate.profile: allow access to kwinrcLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | When starting Kate, a blacklist violation from accessing the kwinrc config file is reported. As a KDE application, it should be fine for Kate to access it. blacklist violation - sandbox 13410, name kate, exe kate, syscall access, path /home/user/.config/kwinrc
| * | kate.profile: enable bash completion in terminalLibravatar Hartmut Knaack2022-05-28
| | | | | | | | | | | | | | | | | | | | | | | | A side effect of including disable-common.inc is loosing access to /etc/profile.d, where Bash completion is located. Explicitly enable access to console scripts in /etc/profile.d, so that Kate's built-in Konsole instance can be used without limitations. Minor side effect: the spawned Bash tries to access /etc/init.d blacklist violation - sandbox 17317, name kate, exe bash, syscall stat, path /etc/init.d
| * | kate.profile: allow common development file accessLibravatar Hartmut Knaack2022-05-28
| |/ | | | | | | | | | | Kate has grown support for software development, making it a light IDE. Some version control modules exist, and when using the Git module, a blacklist violation is reported: blacklist violation - sandbox 13902, name kate, exe git, syscall access, path /home/user/.gitconfig Including support for common development file access mitigates this violation issue.
* / minor fixes for git.profile (#5165)Libravatar glitsj162022-05-28
|/
* unbound: seccomp cleanupLibravatar smitsohu2022-05-21
|
* Merge pull request #5141 from kmk3/nvim-add-xdg-state-homeLibravatar netblue302022-05-20
|\ | | | | nvim: add XDG_STATE_HOME path
| * nvim: add XDG_STATE_HOME pathLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Default paths as of neovim 0.7.0: * backupdir: $XDG_DATA_HOME/nvim/backup// * directory: $XDG_DATA_HOME/nvim/swap// * undodir: $XDG_DATA_HOME/nvim/undo// * viewdir: $XDG_DATA_HOME/nvim/view// * shada file: $XDG_DATA_HOME/nvim/shada/main.shada * log dir: $XDG_CACHE_HOME/nvim/log Default paths as of [1]: * backupdir: $XDG_STATE_HOME/nvim/backup// * directory: $XDG_STATE_HOME/nvim/swap// * undodir: $XDG_STATE_HOME/nvim/undo// * viewdir: $XDG_STATE_HOME/nvim/view// * shada file: $XDG_STATE_HOME/nvim/shada/main.shada * log dir: $XDG_STATE_HOME/nvim/log [1] https://github.com/neovim/neovim/pull/15583
| * disable-programs.inc: remove ~/.local/share/nvimLibravatar Kelvin M. Klann2022-05-12
| | | | | | | | | | | | | | It's already blacklisted on disable-common.inc. Added on commit ec966d4c0 ("fix: neovim profile", 2022-01-10) / PR #4841.
* | updates for wget2 (#5152)Libravatar glitsj162022-05-20
| | | | | | | | | | * update for wget2 * allow ${HOME}/.local/share/wget
* | onionshare-gui.profile: fix breakageLibravatar Tad2022-05-20
|/ | | | | | | Fails to start without this, eg: FileNotFoundError: [Errno 2] No such file or directory: '/usr/share/onionshare/images/favicon.ico' Signed-off-by: Tad <tad@spotco.us>
* xonotic.profile: fix audit denial spamLibravatar Tad2022-05-12
| | | | | | After a3f00edb32aca7516d690db046dd1ed3eb186bdd Signed-off-by: Tad <tad@spotco.us>
* Prevent emptty /usr/share in google-chrome profilesLibravatar crocket2022-05-12
| | | | | | | | | | | Without whitelist-usr-share-common, /usr/share becomes empty. Adding whitelist-runuser-common didn't break google chrome. Whitelisting /usr/share/mozilla/extensions and /usr/share/webext shouldn't break google chrome, either. I tested google-chrome.profile only, but I think later versions should not be different.
* Whitelist for NixOS to resolve binary paths in user environmentLibravatar Jonas Heinrich2022-05-07
|
* NixOS fix OpenGL app supportLibravatar Jonas Heinrich2022-05-07
|
* okLibravatar Łukasz Mariański2022-04-23
|
* Fix glob pattern and update other profiles/includesLibravatar Łukasz Mariański2022-04-23
|
* Update electron.profileLibravatar m00nwtchr2022-04-23
|
* Update electron.profileLibravatar m00nwtchr2022-04-23
| | | Add electron-flags.conf for all versions of electron
* Merge pull request #5088 from slowpeek/masterLibravatar netblue302022-04-17
|\ | | | | Allow resolution of .local names with avahi-daemon in the apparmor profile.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-28 13:42:16 +0000