aboutsummaryrefslogtreecommitdiffstats
path: root/src/firejail/profile.c
Commit message (Collapse)AuthorAge
* Merge pull request #3852 from rusty-snake/fix-3846Libravatar netblue302020-12-30
|\ | | | | Implement netns in profiles, closes #3846
| * Implement netns in profiles, closes #3846Libravatar rusty-snake2020-12-29
| |
* | add mac multicast address check to profile_check_lineLibravatar smitsohu2020-12-21
|/ | | | | issue #3784 related commit 4bc92b8fd0a5c22c7d4c6f9323378501c60ff149
* revisit join-or-start hidepid fixLibravatar smitsohu2020-11-25
| | | | | | cf. 9eb9e8d4c1b8995f0e7af4d604f3becd5dc91f62 No need to expect pid's in profile files.
* join-or-start hidepid fixLibravatar smitsohu2020-11-24
|
* added bluetooth to the list of protocols allowed by seccompLibravatar netblue302020-10-28
|
* reverted --bind as root - some security problemsLibravatar netblue302020-10-27
|
* compile time option to disable --private-cache and --tmpfs for regular userLibravatar netblue302020-10-27
|
* Likewise allow --bind inside $HOME for usersLibravatar rusty-snake2020-10-23
|
* Allow --tmpfs inside $HOME for unprivileged usersLibravatar rusty-snake2020-10-23
| | | | | | | --tmpfs was added in 0.9.14 and restricted to root only in 0.9.38 due to priv-esc CVE-2016-10117 (e.g. --tmpfs=/etc and modify /etc/sudoers). This commit reintroduce it for normal users, if the realpath of it is inside users-home.
* fix #3478Libravatar netblue302020-10-19
|
* Apply --rmenv immediately to help to avoid the env var length checkLibravatar Topi Miettinen2020-10-16
| | | | | | | | | | | | | | | | | | Remove environment variables with --rmenv immediately. This fixes removing long environment variables (LS_COLORS generated by vivid), previously the length filter would trip before the command was processed. This changes user visible behavior slightly, for example --rmenv=LANG now applies also to Firejail, while earlier it would only apply to sandboxed program. Partially fixes #3673, but not handling `rmenv` in profiles. Also suggest --rmenv when there are problems with enviroment variables. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* more nvidia (#3644)Libravatar netblue302020-10-03
|
* temporary fix for nvidia/nogroups/noroot issue (#3644, #841)Libravatar netblue302020-10-02
|
* some cleanup for the previous commit (#3530)Libravatar netblue302020-10-01
|
* don't execute include disable-shell.inc for appimages (#3530)Libravatar netblue302020-10-01
|
* print errors to stderr and prefix them consistentlyLibravatar Reiner Herrmann2020-09-12
|
* disable dbus proxy at compile time (default enabled) - part 1Libravatar netblue302020-09-09
|
* removed --disable-seccomp from ./configureLibravatar startx20172020-09-01
|
* seccomp: loggingLibravatar Topi Miettinen2020-08-05
| | | | | | | Allow `log` as an alternative seccomp error action instead of killing or returning an errno code. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* Support to ingore a include foobar.incLibravatar rusty-snake2020-08-04
| | | | closes #1139
* Turn attempted DBus policy downgrade into warning (fixes #3408)Libravatar Kristóf Marussy2020-05-09
|
* Add options for D-Bus loggingLibravatar Kristóf Marussy2020-05-07
| | | | | | | --dbus-user.log and --dbus-system.log instruct xdg-dbus-proxy to log interactions with the session and system buses, respectively. --dbus-log= can specify the location of the log file. If no location is specified, log output is written to stdout.
* Add dbus-*.call and dbus-*.broadcast commandsLibravatar Kristóf Marussy2020-05-07
| | | | | This allows setting per-member and per-object path policies for xdg-dbus-proxy.
* Add --dbus-*.see optionsLibravatar Kristóf Marussy2020-05-07
| | | | | | | The SEE policy of xdg-dbus-proxy allows clients to see objects and bus names, but not interact with them. The --call and --broadcast can allow interactions with objects that have the SEE policy set. Profile support for these proxy options will be added in a future commit.
* Turn DBus profile errors into warningsLibravatar Kristóf Marussy2020-04-06
| | | | | | This patch also allows setting the DBus policies to filter even if xdg-dbus-proxy is not installed. In that case, unrestricted access to the bus is allowed, but a warning is emitted.
* Add dbus filter optionsLibravatar Kristóf Marussy2020-04-06
| | | | | | The options --dbus-user.talk, --dbus-user.own, --dbus-system.talk, and --dbus-system.own control which names can be accessed and owned on the user and system buses.
* Add --dbus-user and --dbus-system optionsLibravatar Kristóf Marussy2020-04-06
| | | | | | Allow setting a separate policy for the user and system buses. For now, the filter policy is equivalent to the none (block) policy. Future commits will add more configuration options and filters.
* Allow changing error action in seccomp filtersLibravatar Topi Miettinen2020-04-06
| | | | | | | | | | | | | | Let user specify the action when seccomp filters trigger: - errno name like EPERM (default) or ENOSYS: return errno and let the process continue. - 'kill': kill the process as previous versions The default action is EPERM, but killing can still be specified with syscall:kill syntax or globally with seccomp-error-action=kill. The action can be also overridden /etc/firejail/firejail.config file. Not killing the process weakens Firejail slightly when trying to contain intrusion, but it may also allow tighter filters if the only alternative is to allow a system call.
* seccomp: allow defining separate filters for 32-bit archLibravatar Topi Miettinen2020-03-28
| | | | | | | | | | | | | | | | | | | | | System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes #3267. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* new condition: HAS_NOSOUNDLibravatar rusty-snake2020-03-15
|
* Fix indentation for dhcp client codeLibravatar Kristóf Marussy2020-01-27
|
* move copyright to 2020 (part 2) (#3181)Libravatar glitsj162020-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020
* Add --ip=dhcp and --ip6=dhcp optionsLibravatar Kristóf Marussy2019-12-30
| | | | | Currently, --ip=dhcp is equivalent to --ip=none and --ip6=dhcp does nothing either, except for parsing correctly
* add HAS_NET conditionalLibravatar smitsohu2019-11-11
|
* dns fixesLibravatar netblue302019-10-31
|
* add x11 xorg option to HAS_X11 conditional - #2205Libravatar smitsohu2019-10-08
|
* add HAS_X11 conditional, disconnect session manager - #2205Libravatar smitsohu2019-10-08
|
* profile support for allow-debuggers (#2856)Libravatar Sebastian Hafner2019-07-15
|
* small private-cwd adjustmentsLibravatar smitsohu2019-05-24
|
* Merge pull request #2712 from apmorton/features/private-cwdLibravatar smitsohu2019-05-24
|\ | | | | Add private-cwd option to control working directory within jail
| * Add private-cwd option to control working directory within jailLibravatar Austin Morton2019-05-23
| |
* | Add deterministic-exit-code option to ensure firejail exits with the first ↵Libravatar Austin Morton2019-05-20
|/ | | | childs exit code regardless of the termination ordering of orphaned children
* Add a conditional to control DRM/noexec exception for browsersLibravatar Tad2019-04-13
|
* profile.c: errout with too many dns argsLibravatar smitsohu2019-03-02
|
* misc cleanupLibravatar smitsohu2019-02-22
| | | | | removing the branches checking for "." has no effect, as calling openat on this just reopens the previous path element.
* move copyright statement to 2019Libravatar smitsohu2019-02-07
|
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar smitsohu2019-02-06
|\
| * variable only used when whitelisting enabledLibravatar Reiner Herrmann2019-02-05
| |
* | strncmp byte count fixesLibravatar smitsohu2019-02-06
|/
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-26 07:55:37 +0000