aboutsummaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAge
* private-etc: groups modifiedLibravatar netblue302023-02-05
|
* private-etc: cleanup toolLibravatar netblue302023-02-05
|
* etc_groups.h: sort groups alphabeticallyLibravatar glitsj162023-02-04
|
* etc_groups.h: internally sort groups alphabeticallyLibravatar glitsj162023-02-04
|
* private-etc: moved group names to @group syntax; GUI group renamed as @x11 ↵Libravatar netblue302023-01-30
| | | | group; added nvidia and X11 directories to @x11 group.
* private-etc: corss-distro test for curl, gimp, inkscape, firefox, warzone2100Libravatar netblue302023-01-28
|
* private-etc: fixesLibravatar netblue302023-01-25
|
* private-etc rework: file groups moved to src/include/etc_groups.h, new ↵Libravatar netblue302023-01-25
| | | | groups added
* private-etc rework: remove hiding blacklisted files in private-etc directory ↵Libravatar netblue302023-01-20
| | | | feature
* introduce new option restrict-namespacesLibravatar smitsohu2022-07-23
|
* refresh and sort syscall tablesLibravatar smitsohu2022-07-15
| | | | | | produced using commands documented in src/lib/syscall.c: awk '/__NR_/ { print "{ \"" gensub("__NR_", "", "g", $2) "\", " $3 " },"; }' < /usr/include/x86_64-linux-gnu/asm/unistd_64.h awk '/__NR_/ { print "{ \"" gensub("__NR_", "", "g", $2) "\", " $3 " },"; }' < /usr/include/x86_64-linux-gnu/asm/unistd_32.h
* more on removing cgroups (#5200)Libravatar netblue302022-06-16
|
* fixing CVE-2022-31214Libravatar smitsohu2022-06-08
|
* firemon reworkLibravatar netblue302022-06-02
|
* small fixesLibravatar netblue302022-04-10
|
* Merge pull request #5028 from kmk3/fix-gcov-macroLibravatar netblue302022-03-11
|\ | | | | gcov: fix gcov functions always declared as dummy
| * gcov: fix gcov functions always declared as dummyLibravatar Kelvin M. Klann2022-03-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, the check to enable gcov relies on a non-existent macro due to a typo, which looks like it would cause the dummy/empty versions of the gcov functions to always be declared (even with --enable-gcov), instead of the real ones from gcov.h. This commit fixes the typo (HAS_GCOV -> HAVE_GCOV). See configure.ac for the macro declaration. This amends commit 5106b2ec4 ("gcov: use no-op functions if not enabled", 2021-06-20) / PR #4376. Occurrences of each macro with this commit applied: $ git grep -F HAVE_GCOV | wc -l 16 $ git grep -F HAS_GCOV | wc -l 0
* | refactor meta character filteringLibravatar smitsohu2022-03-10
|/
* keep-fd option (#4845)Libravatar smitsohu2022-01-14
|
* 2022 copyright updateLibravatar netblue302022-01-07
|
* more on nettraceLibravatar netblue302022-01-07
|
* gcov: use no-op functions if not enabledLibravatar Kelvin M. Klann2021-06-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of wrapping every gcov function call in an ifdef. Note: The usage of `((void)0)` is based on section 7.2 of the C99 standard (N1256)[1] [2]: > 7.2 Diagnostics <assert.h> > > 1 The header <assert.h> defines the assert macro and refers to another > macro, > > NDEBUG > > which is not defined by <assert.h>. If NDEBUG is defined as a macro > name at the point in the source file where <assert.h> is included, the > assert macro is defined simply as > > #define assert(ignore) ((void)0) See also assert.h(0p) from POSIX.1-2017[3]. Note: This is a continuation of commit b408b20c7 ("gcov: fix build failure with gcc 11.1.0") / PR #4373. [1] http://www.open-std.org/JTC1/SC22/WG14/www/docs/n1256.pdf [2] https://port70.net/~nsz/c/c99/n1256.html#7.2 [3] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/assert.h.html
* gcov: fix build failure with gcc 11.1.0Libravatar Kelvin M. Klann2021-06-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The build currently fails if gcov support is enabled: $ pacman -Q gcc gcc 11.1.0-1 $ ./configure --prefix=/usr --enable-apparmor --enable-gcov >/dev/null $ make >/dev/null [...] netstats.c: In function ‘netstats’: netstats.c:250:25: warning: implicit declaration of function ‘__gcov_flush’; did you mean ‘__gcov_dump’? [-Wimplicit-function-declaration] 250 | __gcov_flush(); | ^~~~~~~~~~~~ | __gcov_dump [...] /usr/bin/ld: netstats.o: in function `netstats': /tmp/firejail-git/src/firejail-git/src/firemon/netstats.c:250: undefined reference to `__gcov_flush' [...] collect2: error: ld returned 1 exit status make[1]: *** [Makefile:10: firemon] Error 1 make: *** [Makefile:42: src/firemon/firemon] Error 2 [...] This happens because __gcov_flush was removed on gcc 11.1.0[1] [2] [3]. See the following gcc commits: * d39f7dc8d5 ("Do locking for __gcov_dump and __gcov_reset as well.") * c0532db47d ("Use __gcov_dump and __gcov_reset in execv and fork context.") * 811b7636cb ("Remove __gcov_flush.") Its implementation did the following[4]: __gcov_lock (); __gcov_dump_int (); __gcov_reset_int (); __gcov_unlock (); As hinted in the commit messages above, the function is no longer needed because locking is now done inside each of __gcov_dump and __gcov_reset. So add an implementation of __gcov_flush (on a new gcov_wrapper.h file) for gcc >= 11.1.0, which just calls __gcov_dump and then __gcov_reset. Commands used to search and replace: $ git grep -Flz '#include <gcov.h>' -- '*.c' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\`sed 's|<gcov\\.h>|\"../include/gcov_wrapper.h\"|' '{}'\`\" >'{}'" Note: This is the continuation of commit 31557e9c7 ("gcov: add missing gcov.h includes") / PR #4360. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=d39f7dc8d558ca31a661b02d08ff090ce65e6652 [2] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c0532db47d092430f8e8f497b2dc53343527bb13 [3] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=811b7636cb8c10f1a550a76242b5666c7ae36da2 [4] https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=libgcc/libgcov-interface.c;h=855e8612018d1c9caf90396a3271337aaefdb9b3#l86
* simplify X11 socket whitelistingLibravatar smitsohu2021-06-03
|
* add support for arbitrary whitelist directoriesLibravatar smitsohu2021-05-03
|
* simplify initial /home and /run/user cleaningLibravatar smitsohu2021-03-14
| | | | mount without stash locations, only using the file descriptors
* copyright updateLibravatar startx20172021-02-15
|
* add support for faccessat2 syscallLibravatar glitsj162021-02-10
|
* add support for faccessat2 syscallLibravatar glitsj162021-02-10
|
* add support for fsaccessat2 syscallLibravatar glitsj162021-02-10
|
* Seccomp error action fixesLibravatar Topi Miettinen2021-02-01
| | | | | | | | | | | | | | fsec-optimize: Optimize BPF with current seccomp error action, not just KILL fseccomp: use correct BPF code for errno action firejail: honor seccomp error action for X32 and secondary filters, rebuild filters if the error action is changed Closes: #3933 Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* non-dumpable pluginsLibravatar smitsohu2021-01-04
| | | | | (hopefully) fixes the issues that led to reverting commits 6abb65d328af61d67361890743190bd4c57f8e3c and 98e42dc6da4e4b1e47ed2aa020012d4dedc1e80e
* a more portable implementation for time measurementsLibravatar netblue302020-12-01
|
* DHCP fixesLibravatar netblue302020-10-06
|
* testing 0.9.64rc1 - disable dumpable working for this release, problems on ↵0.9.64rc1Libravatar netblue2020-10-04
| | | | Debian8; we will bring it back in the next release
* removed --disable-seccomp from ./configureLibravatar startx20172020-09-01
|
* join: move to mmapped sandbox status indicatorLibravatar smitsohu2020-08-31
| | | | | | | | | | 1) close #3612 2) remove an implicit limitation on rlimit-fsize option (could not set limit to smaller than 6 bytes without affecting the ability to join a sandbox) 3) rename 'join-or-start' file to just 'join' 4) when waiting for a sandbox that is not fully configured yet, increase polling frequency from 10 per second to 100 per second
* firemon fix for xdg-bus-proxyLibravatar netblue302020-08-22
|
* Merge pull request #3572 from smitsohu/dumpableLibravatar netblue302020-08-22
|\ | | | | hardening: run plugins with dumpable flag cleared
| * add dumpable warningsLibravatar smitsohu2020-08-17
| |
| * various x11 xorg enhancementsLibravatar smitsohu2020-08-17
| | | | | | | | | | | | | | | | | | | | | | | | 1) copy xauth binary into the sandbox and set mode to 0711, so it runs with cleared dumpable flag for unprivileged users 2) run xauth in an sbox sandbox 3) generate Xauthority file in runtime directory instead of /tmp; this way xauth is able to connect to the X11 socket even if the abstract socket doesn't exist, for example because a new network namespace was instantiated
* | Merge pull request #3569 from topimiettinen/seccomp-logLibravatar startx20172020-08-12
|\ \ | | | | | | seccomp: logging
| * | seccomp: loggingLibravatar Topi Miettinen2020-08-05
| |/ | | | | | | | | | | | | Allow `log` as an alternative seccomp error action instead of killing or returning an errno code. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* / annotate some functions as non-returning (#3574)Libravatar Reiner Herrmann2020-08-08
|/
* Add 32bit ARM syscallsLibravatar Andrew Branson2020-04-15
|
* xdg-dbus-proxy socket finding and mount hardeningLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | | | | | | | | | | To avoid race conditions, the proxy sockets from /run/firejail/dbus/ are bind-mounted to /run/firejail/mnt/dbus/, which is controlled by root. Instead of relying on the default locations of the DBus sockets, the environment variables DBUS_SESSION_BUS_ADDRESS and DBUS_SYSTEM_BUS_ADDRESS are set accordingly. User sockets are tried in the following order when starting the proxy: * DBUS_SESSION_BUS_ADDRES * /run/user/<pid>/bus * /run/user/<pid>/dbus/user_bus_socket These are all blocked (including DBUS_SESSION_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active. System sockets are tried in the following order: * DBUS_SYSTEM_BUS_ADDRESS * /run/dbus/system_bus_socket These are all blocked (including DBUS_SYSTEM_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active.
* Add xdg-dbus-proxy supportLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | * The proxy is forked off outside the sandbox namespace to protect the fds of the original buses from the sandboxed process. * The /run/firejail/dbus directory (with the sticky bit set) holds the proxy sockets. The sockets are <parent pid>-user and <parent pid>-system for the user and system buses, respectively. Each socket is owned by the sandbox user. * The sockets are bind-mounted over their expected locations and the /run/firejail/dbus directory is subsequently hidden from the sandbox. * Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets are cleaned up. * Filter rules will be added in a future commit.
* Allow changing error action in seccomp filtersLibravatar Topi Miettinen2020-04-06
| | | | | | | | | | | | | | Let user specify the action when seccomp filters trigger: - errno name like EPERM (default) or ENOSYS: return errno and let the process continue. - 'kill': kill the process as previous versions The default action is EPERM, but killing can still be specified with syscall:kill syntax or globally with seccomp-error-action=kill. The action can be also overridden /etc/firejail/firejail.config file. Not killing the process weakens Firejail slightly when trying to contain intrusion, but it may also allow tighter filters if the only alternative is to allow a system call.
* seccomp: allow defining separate filters for 32-bit archLibravatar Topi Miettinen2020-03-28
| | | | | | | | | | | | | | | | | | | | | System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes #3267. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* openSUSE fix: mount private-etc on /usr/etc as wellLibravatar smitsohu2020-02-09
| | | | see issue #3145
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-30 20:42:10 +0000