aboutsummaryrefslogtreecommitdiffstats
path: root/src/man/firejail.txt
Commit message (Collapse)AuthorAge
* jailtest -> jailcheck (#4268)Libravatar netblue302021-05-18
|
* rename noautopulse to keep-config-pulseLibravatar Kelvin M. Klann2021-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | Changes: * add the keep-config-pulse option * make noautopulse an alias for keep-config-pulse * deprecate the noautopulse option * misc: fix indentation of --keep-dev-shm on src/firejail/usage.c Even though noautopulse is not intended for hardening, it looks like it is, because it starts with "no", just like no3d, noroot, etc). In fact, it is the only "no" option that differs in such a way. And it has been accidentally misused as such before; see PR #4269 and commit e4beaeaa8 ("drop noautopulse from agetpkg"). So effectively rename it to keep-config-pulse in order to avoid confusion. This is similar to the keep-var-tmp and keep-dev-shm options, which are used to "leave a path alone", just like noautopulse. Note: The changes on this patch are based on the ones from commit 617ff40c9 ("add --noautopulse arg for complex pulse setups") / PR #1854. See #4269 for the discussion.
* Manpage fixesLibravatar rusty-snake2021-05-13
| | | | Subdirs for private-etc has been implemented since 6ebe8925.
* Merge pull request #4209 from ↵Libravatar netblue302021-05-04
|\ | | | | | | | | davidebeatrici/private-dev-input-support-and-noinput-option Map /dev/input with "--private-dev", add "--no-input" option to disable it
| * Map /dev/input with "--private-dev", add "--no-input" option to disable itLibravatar Davide Beatrici2021-04-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default only joystick devices ("/dev/input/js*") can be accessed. At least, that's the case on Debian: the other entries have more restrictive permissions. The original owner and group are "root" and "input", respectively. However, until we have granular input control options, allowing access to joysticks only is better than nothing. $ ls -l /dev total 0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 cdrom -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 cdrw -> /dev/sr0 drwxr-xr-x 3 nobody nogroup 100 22 apr 19.18 dri lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 dvd -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 dvdrw -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 13 23 apr 07.22 fd -> /proc/self/fd crw-rw-rw- 1 nobody nogroup 1, 7 23 apr 07.22 full crw-rw----+ 1 nobody nogroup 244, 0 22 apr 19.18 hidraw0 crw-rw----+ 1 nobody nogroup 244, 1 22 apr 19.18 hidraw1 crw-rw----+ 1 nobody nogroup 244, 2 22 apr 19.18 hidraw2 crw-rw----+ 1 nobody nogroup 244, 3 22 apr 19.18 hidraw3 crw-rw----+ 1 nobody nogroup 244, 4 22 apr 19.18 hidraw4 crw-rw----+ 1 nobody nogroup 244, 5 22 apr 19.18 hidraw5 drwxr-xr-x 4 nobody nogroup 760 23 apr 07.22 input srw-rw-rw- 1 nobody nogroup 0 22 apr 19.18 log crw-rw-rw- 1 nobody nogroup 1, 3 23 apr 07.22 null lrwxrwxrwx 1 nobody nogroup 13 23 apr 07.22 ptmx -> /dev/pts/ptmx drwxr-xr-x 2 nobody nogroup 0 23 apr 07.22 pts crw-rw-rw- 1 nobody nogroup 1, 8 23 apr 07.22 random drwxrwxrwt 2 nobody nogroup 40 23 apr 07.22 shm drwxr-xr-x 4 nobody nogroup 500 22 apr 19.18 snd brw-rw----+ 1 nobody nogroup 11, 0 23 apr 00.24 sr0 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stderr -> /proc/self/fd/2 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stdin -> /proc/self/fd/0 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stdout -> /proc/self/fd/1 crw-rw-rw- 1 nobody nogroup 5, 0 23 apr 07.22 tty crw-rw-rw- 1 nobody nogroup 1, 9 23 apr 07.22 urandom drwxr-xr-x 2 nobody nogroup 120 22 apr 19.18 usb crw-rw----+ 1 nobody video 81, 0 22 apr 19.18 video0 crw-rw----+ 1 nobody video 81, 1 22 apr 19.18 video1 crw-rw----+ 1 nobody video 81, 2 22 apr 19.18 video2 crw-rw----+ 1 nobody video 81, 3 22 apr 19.18 video3 crw-rw-rw- 1 nobody nogroup 1, 5 23 apr 07.22 zero $ ls -l /dev/input total 0 drwxr-xr-x 2 nobody nogroup 280 23 apr 07.22 by-id drwxr-xr-x 2 nobody nogroup 300 23 apr 07.22 by-path crw-rw---- 1 nobody nogroup 13, 64 22 apr 19.18 event0 crw-rw---- 1 nobody nogroup 13, 65 22 apr 19.18 event1 crw-rw---- 1 nobody nogroup 13, 74 22 apr 19.18 event10 crw-rw---- 1 nobody nogroup 13, 75 22 apr 19.18 event11 crw-rw---- 1 nobody nogroup 13, 76 22 apr 19.18 event12 crw-rw---- 1 nobody nogroup 13, 77 22 apr 19.18 event13 crw-rw---- 1 nobody nogroup 13, 78 22 apr 19.18 event14 crw-rw---- 1 nobody nogroup 13, 79 22 apr 19.18 event15 crw-rw---- 1 nobody nogroup 13, 80 22 apr 19.18 event16 crw-rw---- 1 nobody nogroup 13, 81 22 apr 19.18 event17 crw-rw---- 1 nobody nogroup 13, 82 22 apr 19.18 event18 crw-rw---- 1 nobody nogroup 13, 83 22 apr 19.18 event19 crw-rw---- 1 nobody nogroup 13, 66 22 apr 19.18 event2 crw-rw---- 1 nobody nogroup 13, 84 22 apr 19.18 event20 crw-rw---- 1 nobody nogroup 13, 85 22 apr 19.18 event21 crw-rw---- 1 nobody nogroup 13, 86 22 apr 19.18 event22 crw-rw---- 1 nobody nogroup 13, 87 22 apr 19.18 event23 crw-rw---- 1 nobody nogroup 13, 88 22 apr 19.18 event24 crw-rw---- 1 nobody nogroup 13, 89 22 apr 19.18 event25 crw-rw---- 1 nobody nogroup 13, 90 22 apr 19.18 event26 crw-rw---- 1 nobody nogroup 13, 91 22 apr 19.18 event27 crw-rw----+ 1 nobody nogroup 13, 92 23 apr 07.22 event28 crw-rw---- 1 nobody nogroup 13, 67 22 apr 19.18 event3 crw-rw---- 1 nobody nogroup 13, 68 22 apr 19.18 event4 crw-rw---- 1 nobody nogroup 13, 69 22 apr 19.18 event5 crw-rw---- 1 nobody nogroup 13, 70 22 apr 19.18 event6 crw-rw---- 1 nobody nogroup 13, 71 22 apr 19.18 event7 crw-rw---- 1 nobody nogroup 13, 72 22 apr 19.18 event8 crw-rw---- 1 nobody nogroup 13, 73 22 apr 19.18 event9 crw-rw-r-- 1 nobody nogroup 13, 0 22 apr 19.18 js0 crw-rw-r--+ 1 nobody nogroup 13, 1 23 apr 07.22 js1 crw-rw---- 1 nobody nogroup 13, 63 22 apr 19.18 mice crw-rw---- 1 nobody nogroup 13, 32 22 apr 19.18 mouse0 crw-rw---- 1 nobody nogroup 13, 33 22 apr 19.18 mouse1 $ ls -l /dev/input/by-id total 0 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-event-if01 -> ../event9 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-event-kbd -> ../event8 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-BY_Tech_Usb-if01-event-kbd -> ../event11 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-BY_Tech_Usb-if01-event-mouse -> ../event12 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-if01-mouse -> ../mouse1 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-event-if01 -> ../event5 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-event-mouse -> ../event2 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-if01-event-kbd -> ../event3 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-mouse -> ../mouse0 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-Sonix_Technology_Co.__Ltd._H264_USB_Camera_SN0001-event-if00 -> ../event27 lrwxrwxrwx 1 nobody nogroup 10 23 apr 07.22 usb-ZEROPLUS_Controller_3136303033313032354246323543-event-joystick -> ../event28 lrwxrwxrwx 1 nobody nogroup 6 23 apr 07.22 usb-ZEROPLUS_Controller_3136303033313032354246323543-joystick -> ../js1 $ ls -l /dev/input/by-path total 0 lrwxrwxrwx 1 nobody nogroup 10 23 apr 07.22 pci-0000:05:00.1-usb-0:6.1:1.0-event-joystick -> ../event28 lrwxrwxrwx 1 nobody nogroup 6 23 apr 07.22 pci-0000:05:00.1-usb-0:6.1:1.0-joystick -> ../js1 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.0-event-mouse -> ../event2 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.0-mouse -> ../mouse0 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.1-event -> ../event5 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.1-event-kbd -> ../event3 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.0-event-kbd -> ../event8 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event -> ../event9 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event-kbd -> ../event11 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event-mouse -> ../event12 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-mouse -> ../mouse1 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:0c:00.3-usb-0:4:1.0-event -> ../event27 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 platform-pcspkr-event-spkr -> ../event13
* | man: corrections regarding --private-FOO optionsLibravatar Jeff Squyres2021-04-20
|/ | | | | | | | | | | | | | | | | Commit 0.9.60-1070-g40d3604f updated the man pages with respect to --private-opt, --private-etc, and --private-srv. It was made after testing firejail 0.9.52 (from Ubuntu 18.04). However, it unfortunately did not accurately reflect the the behavior of the current HEAD at the time, because commit 0.9.56-rc1-14-ga9242301 had previously slightly changed the behavior of these three options (after 0.9.52), and was released in 0.9.56. The man pages changes made in commit 40d3604f were therefore not entirely correct. This commit updates the man pages to describe the behavior as implemented in a9242301 (and is still the behavior as of the current HEAD: 0.9.64-737-g937815ba). Signed-off-by: Jeff Squyres <jsquyres@cisco.com>
* Fix typo (#4176)Libravatar Jose Riha2021-04-10
|
* Update README.md & RELONTS; Fix manpage HAVE_NETWORKLibravatar rusty-snake2021-03-19
|
* fix --dbus-{system,user}.log requirementLibravatar glitsj162021-03-07
|
* man text for --include commandLibravatar netblue302021-03-05
|
* manpage: Add log as value of seccomp-error-actionLibravatar rusty-snake2021-03-01
| | | | man firejail-profiles has it already. [skip ci]
* retiring --audit (replaced by jailtest)Libravatar netblue302021-03-01
|
* compile time: enable LTSLibravatar startx20172021-02-28
|
* compile time: disable --outputLibravatar startx20172021-02-28
|
* mkdir/mkfile man pagesLibravatar netblue302021-02-26
|
* jailtestLibravatar netblue302021-02-23
|
* fix spacing in man firejailLibravatar glitsj162021-02-10
|
* fix ordering of deterministic-exit-code in man firejailLibravatar glitsj162021-02-10
|
* merge/readme updateLibravatar netblue302021-01-25
|
* update manpages and RELNOTESLibravatar rusty-snake2021-01-08
|
* manpage: /bin/bash -> user's perferred shellLibravatar rusty-snake2020-12-29
| | | | | | | | | | We do not start /bin/bash in the sandbox, we use $SHELL (which is usually /bin/bash). See #3434 and #3844. This commit updates the manpage accordingly until #3434 is resolved with a final solution like using /bin/bash or /bin/sh as hardcoded default. Close #3844. The descriptions of --join* are not updated as there is currenly some work, see #2934 and #3850.
* fix #3782 -- Man pages have #ifdefs in themLibravatar rusty-snake2020-12-01
|
* document protocol=bluetoothLibravatar rusty-snake2020-11-16
|
* fix manpage wanings (#3563)Libravatar netblue302020-10-19
|
* document private-bin and private-lib disabled by default when running ↵Libravatar netblue302020-10-01
| | | | appimages (#3530)
* fix shell=none for --audit (#3116)Libravatar netblue302020-10-01
|
* manpages: file transferLibravatar startx20172020-09-30
|
* manpages: network configurationLibravatar startx20172020-09-30
|
* manpages: configuration for dbusLibravatar startx20172020-09-30
|
* manpages: configuration for user namespace, x11Libravatar startx20172020-09-03
|
* manpages: configuration for tunnel, chroot, private-homeLibravatar startx20172020-09-03
|
* manpage: remove overlayfs from non-overlayfs buildsLibravatar startx20172020-09-02
|
* manpage: remove apparmor from non-apparor buildsLibravatar startx20172020-09-02
|
* harden cat optionLibravatar smitsohu2020-08-20
|
* Merge branch 'master' into lsLibravatar smitsohu2020-08-19
|\
| * seccomp: loggingLibravatar Topi Miettinen2020-08-05
| | | | | | | | | | | | | | Allow `log` as an alternative seccomp error action instead of killing or returning an errno code. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* | cat optionLibravatar smitsohu2020-08-19
|/
* Man pages: were missing info about .profile .local resolution (#3440)Libravatar OndrejMalek2020-06-04
| | | | | | | | | * Man pages: link to .profile resolution, urls * Man pages: firejail-profile add link to wiki profile creation * Man pages: line break, slash in path * Man pages remove space before dots
* man: minor clarifications to man pages (#3445)Libravatar Jeff Squyres2020-06-04
| | | | | | | | Add verbiage to the man pages clarifying that the files/directories in the lists given to options such as --private-bin must be relative to the directory that is being limited (e.g., --private-opt requires a list of files/directories that are relative to /opt). Signed-off-by: Jeff Squyres <jeff@squyres.com>
* Documentation for new DBus optionsLibravatar Kristóf Marussy2020-05-07
|
* Clarify that file globbing occurs only at startLibravatar Antonio Russo2020-04-11
| | | | | | firejail can blacklist (and now also whitelist) files based on glob pattern. This pattern is evaluated at firejail start, and not updated at run time. This patch documents this behavior.
* Deprecate --nodbus optionLibravatar Kristóf Marussy2020-04-07
|
* Add documentation for DBus filteringLibravatar Kristóf Marussy2020-04-06
|
* Allow changing error action in seccomp filtersLibravatar Topi Miettinen2020-04-06
| | | | | | | | | | | | | | Let user specify the action when seccomp filters trigger: - errno name like EPERM (default) or ENOSYS: return errno and let the process continue. - 'kill': kill the process as previous versions The default action is EPERM, but killing can still be specified with syscall:kill syntax or globally with seccomp-error-action=kill. The action can be also overridden /etc/firejail/firejail.config file. Not killing the process weakens Firejail slightly when trying to contain intrusion, but it may also allow tighter filters if the only alternative is to allow a system call.
* whitelist globing man pageLibravatar netblue302020-04-01
|
* seccomp: allow defining separate filters for 32-bit archLibravatar Topi Miettinen2020-03-28
| | | | | | | | | | | | | | | | | | | | | System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes #3267. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* misc thingsLibravatar rusty-snake2020-02-22
| | | | | | - spelling suggestion from @glitsj16 on fda62527 - drop python2 from openshot it never has a python2 version - #3126 note in manpage: cannot combine --private with --private=
* Documentation for DHCP supportLibravatar Kristóf Marussy2020-01-27
|
* Improve --version command exampleLibravatar glitsj162020-01-20
| | | Fixes #3135.
* spelling fixLibravatar Reiner Herrmann2019-12-30
|
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-28 09:22:50 +0000