aboutsummaryrefslogtreecommitdiffstats
path: root/src/include
Commit message (Collapse)AuthorAge
* simplify X11 socket whitelistingLibravatar smitsohu2021-06-03
|
* add support for arbitrary whitelist directoriesLibravatar smitsohu2021-05-03
|
* simplify initial /home and /run/user cleaningLibravatar smitsohu2021-03-14
| | | | mount without stash locations, only using the file descriptors
* copyright updateLibravatar startx20172021-02-15
|
* add support for faccessat2 syscallLibravatar glitsj162021-02-10
|
* add support for faccessat2 syscallLibravatar glitsj162021-02-10
|
* add support for fsaccessat2 syscallLibravatar glitsj162021-02-10
|
* Seccomp error action fixesLibravatar Topi Miettinen2021-02-01
| | | | | | | | | | | | | | fsec-optimize: Optimize BPF with current seccomp error action, not just KILL fseccomp: use correct BPF code for errno action firejail: honor seccomp error action for X32 and secondary filters, rebuild filters if the error action is changed Closes: #3933 Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* non-dumpable pluginsLibravatar smitsohu2021-01-04
| | | | | (hopefully) fixes the issues that led to reverting commits 6abb65d328af61d67361890743190bd4c57f8e3c and 98e42dc6da4e4b1e47ed2aa020012d4dedc1e80e
* a more portable implementation for time measurementsLibravatar netblue302020-12-01
|
* DHCP fixesLibravatar netblue302020-10-06
|
* testing 0.9.64rc1 - disable dumpable working for this release, problems on ↵0.9.64rc1Libravatar netblue2020-10-04
| | | | Debian8; we will bring it back in the next release
* removed --disable-seccomp from ./configureLibravatar startx20172020-09-01
|
* join: move to mmapped sandbox status indicatorLibravatar smitsohu2020-08-31
| | | | | | | | | | 1) close #3612 2) remove an implicit limitation on rlimit-fsize option (could not set limit to smaller than 6 bytes without affecting the ability to join a sandbox) 3) rename 'join-or-start' file to just 'join' 4) when waiting for a sandbox that is not fully configured yet, increase polling frequency from 10 per second to 100 per second
* firemon fix for xdg-bus-proxyLibravatar netblue302020-08-22
|
* Merge pull request #3572 from smitsohu/dumpableLibravatar netblue302020-08-22
|\ | | | | hardening: run plugins with dumpable flag cleared
| * add dumpable warningsLibravatar smitsohu2020-08-17
| |
| * various x11 xorg enhancementsLibravatar smitsohu2020-08-17
| | | | | | | | | | | | | | | | | | | | | | | | 1) copy xauth binary into the sandbox and set mode to 0711, so it runs with cleared dumpable flag for unprivileged users 2) run xauth in an sbox sandbox 3) generate Xauthority file in runtime directory instead of /tmp; this way xauth is able to connect to the X11 socket even if the abstract socket doesn't exist, for example because a new network namespace was instantiated
* | Merge pull request #3569 from topimiettinen/seccomp-logLibravatar startx20172020-08-12
|\ \ | | | | | | seccomp: logging
| * | seccomp: loggingLibravatar Topi Miettinen2020-08-05
| |/ | | | | | | | | | | | | Allow `log` as an alternative seccomp error action instead of killing or returning an errno code. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* / annotate some functions as non-returning (#3574)Libravatar Reiner Herrmann2020-08-08
|/
* Add 32bit ARM syscallsLibravatar Andrew Branson2020-04-15
|
* xdg-dbus-proxy socket finding and mount hardeningLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | | | | | | | | | | To avoid race conditions, the proxy sockets from /run/firejail/dbus/ are bind-mounted to /run/firejail/mnt/dbus/, which is controlled by root. Instead of relying on the default locations of the DBus sockets, the environment variables DBUS_SESSION_BUS_ADDRESS and DBUS_SYSTEM_BUS_ADDRESS are set accordingly. User sockets are tried in the following order when starting the proxy: * DBUS_SESSION_BUS_ADDRES * /run/user/<pid>/bus * /run/user/<pid>/dbus/user_bus_socket These are all blocked (including DBUS_SESSION_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active. System sockets are tried in the following order: * DBUS_SYSTEM_BUS_ADDRESS * /run/dbus/system_bus_socket These are all blocked (including DBUS_SYSTEM_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active.
* Add xdg-dbus-proxy supportLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | * The proxy is forked off outside the sandbox namespace to protect the fds of the original buses from the sandboxed process. * The /run/firejail/dbus directory (with the sticky bit set) holds the proxy sockets. The sockets are <parent pid>-user and <parent pid>-system for the user and system buses, respectively. Each socket is owned by the sandbox user. * The sockets are bind-mounted over their expected locations and the /run/firejail/dbus directory is subsequently hidden from the sandbox. * Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets are cleaned up. * Filter rules will be added in a future commit.
* Allow changing error action in seccomp filtersLibravatar Topi Miettinen2020-04-06
| | | | | | | | | | | | | | Let user specify the action when seccomp filters trigger: - errno name like EPERM (default) or ENOSYS: return errno and let the process continue. - 'kill': kill the process as previous versions The default action is EPERM, but killing can still be specified with syscall:kill syntax or globally with seccomp-error-action=kill. The action can be also overridden /etc/firejail/firejail.config file. Not killing the process weakens Firejail slightly when trying to contain intrusion, but it may also allow tighter filters if the only alternative is to allow a system call.
* seccomp: allow defining separate filters for 32-bit archLibravatar Topi Miettinen2020-03-28
| | | | | | | | | | | | | | | | | | | | | System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes #3267. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* openSUSE fix: mount private-etc on /usr/etc as wellLibravatar smitsohu2020-02-09
| | | | see issue #3145
* Fix indentation for dhcp client codeLibravatar Kristóf Marussy2020-01-27
|
* move copyright to 2020 (part 2) (#3181)Libravatar glitsj162020-01-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020
* Run dhclient inside the sandboxLibravatar Kristóf Marussy2019-12-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * In order to ensure that network interfaces are already configured when the sandboxed launches, we run dhclient in forking mode (no -d switch), which makes the dhclient command exit when it successfully acquired a lease. The dhclient daemon process keeps running in the background. * We read the pid file for dhclient to find out the pid of the daemon process. Because dhclient only writes the pid file in the child process potentially after the forking parent process exits, there is some handling for possible race conditions. * All lease files and pid files are under /run/firejail/dhclient/ * The v4 and v6 dhclient has a separate lease as recommended. * The v4 client is set to generate a DUID, which is also used by the v6 client so that the server can associate the two leases if needed. * /etc/resolv.conf is created in the sandbox just like with the --dns option, by mirroring /etc. When DHCP is used, /etc/resolv.conf is normally empty so that dhclient can overwrite it the nameservers from the DHCP server. Current limitations: * The dhclient processes in the background are not terminated properly (by SIGTERM or dhclient -x), nor is the DHCP lease released (by dclient -r). The reason for this is that firejail drops all capabilities and privileges before the application in the sandbox is launched, which makes it impossible to launch dhclient to release the lease or kill the dhclient processes still running with the effective user id of root. Instead the dhclient daemons die with the sandbox. According to the dhclient man page, releasing the lease is not required by the DHCP specification, so this is not a problem, however some ISPs may require releasing leases. A possible workaround would be to fork another process upon sandbox initialization that invokes dhclient -r when the sandbox is ready to exit. This would require communication with the main firejail process through a pipe, while keeping and required privileges. As this would add some complexity but the benefits have limited applicability (compatibility with esoteric DHCP server configurations), I chose not to implement this. * When only an IPv6 address is requested, the interface may possible not have a link-local address when we run dhclient. This causes dhclient -6 fail, since DHCPv6 uses link-local addressing instead of layer 2 addressing, see e.g., https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783387 In a future commit, waiting for a link-local address will be added.
* Allow libtrace preload library to use for trace output a logfile specified ↵Libravatar Glenn Washburn2019-08-29
| | | | by the environment variable FIREJAIL_TRACEFILE or as the RUN_TRACE_FILE if it exists ortherwise use the console as before.
* reduce redundancy in pathsLibravatar Reiner Herrmann2019-06-21
|
* rundefs.h: housekeepingLibravatar smitsohu2019-05-28
|
* fix previous commit, more seccomp testingLibravatar netblue302019-04-09
|
* HousekeepingLibravatar Fred-Barclay2019-02-17
| | | | | Make sure all files end with a newline Strip extra newlines and trailing whitespace from files
* move copyright statement to 2019Libravatar smitsohu2019-02-07
|
* fix and harden overlay optionsLibravatar smitsohu2018-08-28
|
* Replace all possible HTTP links with HTTPSLibravatar Tad2018-08-08
|
* evaluate UID_MIN/GID_MID at runtime, remove compile time evaluation - fixes ↵Libravatar netblue302018-06-04
| | | | #1964
* user access database in /etc/firejail/firejail.users - more to comeLibravatar netblue302018-04-05
|
* fix seccomp compile problem on Debian wheezy 32bitLibravatar netblue302018-03-22
|
* fix seccomp compile on Debian wheezyLibravatar netblue302018-03-22
|
* private-lib bug: 32 bit libraries being copied instead of 64 bit versions; ↵Libravatar startx20172018-03-12
| | | | splitting common code for firejail and fldd in a common static library
* add new syscalls from glibc 2.26-10Libravatar Vasya Novikov2018-01-18
| | | | File generated by ../tools/extract_syscall, as per instructions
* move copyright statement to 2018Libravatar startx20172018-01-14
|
* replacing seccomp printing with a seccomp disassemblerLibravatar netblue302017-12-28
|
* added a tool to measure time spent in various functionsLibravatar startx20172017-10-09
|
* merge fixes from 0.9.50-bugfixes branchLibravatar netblue302017-09-11
|
* Improve seccomp architecture supportLibravatar Topi Miettinen2017-09-10
|
* fix #1522Libravatar netblue302017-09-03
|
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-02 16:52:16 +0000