aboutsummaryrefslogtreecommitdiffstats
path: root/src/man/firejail.txt
Commit message (Collapse)AuthorAge
* build option: remove deprecated strace feature from manualLibravatar smitsohu2022-01-23
|
* man: mention that private-bin and private-etc are cumulativeLibravatar Kelvin M. Klann2022-01-22
| | | | | | This amends commit ac6c8c038 ("fix #4078", 2022-01-21). Fixes #4078.
* adding netlink to --protocol list (#4605)Libravatar netblue2022-01-21
|
* nettrace fixesLibravatar netblue302022-01-18
|
* keep-fd option (#4845)Libravatar smitsohu2022-01-14
|
* Merge pull request #4827 from kmk3/noprinters-add-missingLibravatar netblue302022-01-08
|\ | | | | noprinters: add missing items & add to profile.template
| * noprinters: add missing items from new command checklistLibravatar Kelvin M. Klann2022-01-05
| | | | | | | | | | | | | | | | | | | | | | | | See CONTRIBUTING.md. The changes are based on what was done on commit 5a612029b ("rename noautopulse to keep-config-pulse", 2021-05-13) / PR #4278. This amends commit bd15e763e ("--noprinter option", 2021-10-20) and commit d9403dcdc ("small fix", 2021-10-20). Relates to #4607.
* | more on nettraceLibravatar netblue302022-01-07
|/
* nettraceLibravatar netblue302021-12-28
|
* Fix a typoLibravatar Tad2021-12-21
| | | | Signed-off-by: Tad <tad@spotco.us>
* updatesLibravatar netblue302021-12-19
|
* --ids-check/--ids-init documentationLibravatar netblue302021-11-13
|
* deterministic-shutdown optionLibravatar smitsohu2021-10-28
|
* man pagesLibravatar smitsohu2021-10-18
|
* cgroup: minor refactor, add v2 support, bugfixesLibravatar smitsohu2021-10-16
| | | | | | | | Adds minimal cgroupv2 support, and fixes an effective user id assertion in --join (instead of asserting effective user id of the user, drop privileges completely in a child process).
* trim excess whitespaceLibravatar a13460542021-09-25
|
* Revert "allow/deny help and man pages"Libravatar Kelvin M. Klann2021-09-02
| | | | | | | | | | | | | | | | | This reverts commit a11707ea273e5665047f8a7d9387ba07f08d72f6. The man pages currently direct users to use the aliases instead of the commands, which some users of firejail-git may end up doing. Example: https://github.com/netblue30/firejail/discussions/4496 So revert the man page changes as well to avoid confusion. Note: This is not a full revert. The commit in question also contains some string formatting fixes on src/firejail/usage.c (related to dbus and netmask), which are left intact. Relates to #4410.
* allow/deny help and man pagesLibravatar netblue302021-07-03
|
* Merge pull request #4340 from smitsohu/kcmpLibravatar smitsohu2021-06-26
|\ | | | | augment seccomp lists in firejail.config
| * seccomp man page updateLibravatar smitsohu2021-06-26
| | | | | | | | | | | | | | | | * move everything related to modification of the default seccomp filter from --seccomp to --seccomp= entry * update errno descriptions
| * augment seccomp lists in firejail.configLibravatar smitsohu2021-06-20
| |
* | Merge branch 'master' into kuesji/masterLibravatar Reiner Herrmann2021-06-21
|\ \
| * | tmpfs option enhancementsLibravatar smitsohu2021-06-21
| |/ | | | | | | | | | | | | | | | | | | | | | | * downgrade error to warning, smiliar to read-write option; this simplifies use of tmpfs option in general purpose profiles, for example we don't need to worry about links people put in their homedir * update manpage
| * Update manpage for whitelist2Libravatar rusty-snake2021-06-03
| |
* | grammar issues and fixing test cases for rlimitLibravatar kuesji koesnu2021-06-20
| |
* | added better parser for size stringsLibravatar kuesji koesnu2021-06-08
|/ | | | | | | | | | | | | this commit add support to size parsing for k,m,g suffix for numbers and applies this support to rlimit-as and rlimit-fsize arguments in both for commandline and profile parsing. supported suffix: - k for kilobytes - m for megabytes - g for gigabytes ( these values uses 1024 bases instead of 1000 )
* Refine appimage example in docsLibravatar slowpeek2021-05-26
|
* jailtest -> jailcheck (#4268)Libravatar netblue302021-05-18
|
* rename noautopulse to keep-config-pulseLibravatar Kelvin M. Klann2021-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | Changes: * add the keep-config-pulse option * make noautopulse an alias for keep-config-pulse * deprecate the noautopulse option * misc: fix indentation of --keep-dev-shm on src/firejail/usage.c Even though noautopulse is not intended for hardening, it looks like it is, because it starts with "no", just like no3d, noroot, etc). In fact, it is the only "no" option that differs in such a way. And it has been accidentally misused as such before; see PR #4269 and commit e4beaeaa8 ("drop noautopulse from agetpkg"). So effectively rename it to keep-config-pulse in order to avoid confusion. This is similar to the keep-var-tmp and keep-dev-shm options, which are used to "leave a path alone", just like noautopulse. Note: The changes on this patch are based on the ones from commit 617ff40c9 ("add --noautopulse arg for complex pulse setups") / PR #1854. See #4269 for the discussion.
* Manpage fixesLibravatar rusty-snake2021-05-13
| | | | Subdirs for private-etc has been implemented since 6ebe8925.
* Merge pull request #4209 from ↵Libravatar netblue302021-05-04
|\ | | | | | | | | davidebeatrici/private-dev-input-support-and-noinput-option Map /dev/input with "--private-dev", add "--no-input" option to disable it
| * Map /dev/input with "--private-dev", add "--no-input" option to disable itLibravatar Davide Beatrici2021-04-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | By default only joystick devices ("/dev/input/js*") can be accessed. At least, that's the case on Debian: the other entries have more restrictive permissions. The original owner and group are "root" and "input", respectively. However, until we have granular input control options, allowing access to joysticks only is better than nothing. $ ls -l /dev total 0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 cdrom -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 cdrw -> /dev/sr0 drwxr-xr-x 3 nobody nogroup 100 22 apr 19.18 dri lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 dvd -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 8 23 apr 07.22 dvdrw -> /dev/sr0 lrwxrwxrwx 1 nobody nogroup 13 23 apr 07.22 fd -> /proc/self/fd crw-rw-rw- 1 nobody nogroup 1, 7 23 apr 07.22 full crw-rw----+ 1 nobody nogroup 244, 0 22 apr 19.18 hidraw0 crw-rw----+ 1 nobody nogroup 244, 1 22 apr 19.18 hidraw1 crw-rw----+ 1 nobody nogroup 244, 2 22 apr 19.18 hidraw2 crw-rw----+ 1 nobody nogroup 244, 3 22 apr 19.18 hidraw3 crw-rw----+ 1 nobody nogroup 244, 4 22 apr 19.18 hidraw4 crw-rw----+ 1 nobody nogroup 244, 5 22 apr 19.18 hidraw5 drwxr-xr-x 4 nobody nogroup 760 23 apr 07.22 input srw-rw-rw- 1 nobody nogroup 0 22 apr 19.18 log crw-rw-rw- 1 nobody nogroup 1, 3 23 apr 07.22 null lrwxrwxrwx 1 nobody nogroup 13 23 apr 07.22 ptmx -> /dev/pts/ptmx drwxr-xr-x 2 nobody nogroup 0 23 apr 07.22 pts crw-rw-rw- 1 nobody nogroup 1, 8 23 apr 07.22 random drwxrwxrwt 2 nobody nogroup 40 23 apr 07.22 shm drwxr-xr-x 4 nobody nogroup 500 22 apr 19.18 snd brw-rw----+ 1 nobody nogroup 11, 0 23 apr 00.24 sr0 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stderr -> /proc/self/fd/2 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stdin -> /proc/self/fd/0 lrwxrwxrwx 1 nobody nogroup 15 23 apr 07.22 stdout -> /proc/self/fd/1 crw-rw-rw- 1 nobody nogroup 5, 0 23 apr 07.22 tty crw-rw-rw- 1 nobody nogroup 1, 9 23 apr 07.22 urandom drwxr-xr-x 2 nobody nogroup 120 22 apr 19.18 usb crw-rw----+ 1 nobody video 81, 0 22 apr 19.18 video0 crw-rw----+ 1 nobody video 81, 1 22 apr 19.18 video1 crw-rw----+ 1 nobody video 81, 2 22 apr 19.18 video2 crw-rw----+ 1 nobody video 81, 3 22 apr 19.18 video3 crw-rw-rw- 1 nobody nogroup 1, 5 23 apr 07.22 zero $ ls -l /dev/input total 0 drwxr-xr-x 2 nobody nogroup 280 23 apr 07.22 by-id drwxr-xr-x 2 nobody nogroup 300 23 apr 07.22 by-path crw-rw---- 1 nobody nogroup 13, 64 22 apr 19.18 event0 crw-rw---- 1 nobody nogroup 13, 65 22 apr 19.18 event1 crw-rw---- 1 nobody nogroup 13, 74 22 apr 19.18 event10 crw-rw---- 1 nobody nogroup 13, 75 22 apr 19.18 event11 crw-rw---- 1 nobody nogroup 13, 76 22 apr 19.18 event12 crw-rw---- 1 nobody nogroup 13, 77 22 apr 19.18 event13 crw-rw---- 1 nobody nogroup 13, 78 22 apr 19.18 event14 crw-rw---- 1 nobody nogroup 13, 79 22 apr 19.18 event15 crw-rw---- 1 nobody nogroup 13, 80 22 apr 19.18 event16 crw-rw---- 1 nobody nogroup 13, 81 22 apr 19.18 event17 crw-rw---- 1 nobody nogroup 13, 82 22 apr 19.18 event18 crw-rw---- 1 nobody nogroup 13, 83 22 apr 19.18 event19 crw-rw---- 1 nobody nogroup 13, 66 22 apr 19.18 event2 crw-rw---- 1 nobody nogroup 13, 84 22 apr 19.18 event20 crw-rw---- 1 nobody nogroup 13, 85 22 apr 19.18 event21 crw-rw---- 1 nobody nogroup 13, 86 22 apr 19.18 event22 crw-rw---- 1 nobody nogroup 13, 87 22 apr 19.18 event23 crw-rw---- 1 nobody nogroup 13, 88 22 apr 19.18 event24 crw-rw---- 1 nobody nogroup 13, 89 22 apr 19.18 event25 crw-rw---- 1 nobody nogroup 13, 90 22 apr 19.18 event26 crw-rw---- 1 nobody nogroup 13, 91 22 apr 19.18 event27 crw-rw----+ 1 nobody nogroup 13, 92 23 apr 07.22 event28 crw-rw---- 1 nobody nogroup 13, 67 22 apr 19.18 event3 crw-rw---- 1 nobody nogroup 13, 68 22 apr 19.18 event4 crw-rw---- 1 nobody nogroup 13, 69 22 apr 19.18 event5 crw-rw---- 1 nobody nogroup 13, 70 22 apr 19.18 event6 crw-rw---- 1 nobody nogroup 13, 71 22 apr 19.18 event7 crw-rw---- 1 nobody nogroup 13, 72 22 apr 19.18 event8 crw-rw---- 1 nobody nogroup 13, 73 22 apr 19.18 event9 crw-rw-r-- 1 nobody nogroup 13, 0 22 apr 19.18 js0 crw-rw-r--+ 1 nobody nogroup 13, 1 23 apr 07.22 js1 crw-rw---- 1 nobody nogroup 13, 63 22 apr 19.18 mice crw-rw---- 1 nobody nogroup 13, 32 22 apr 19.18 mouse0 crw-rw---- 1 nobody nogroup 13, 33 22 apr 19.18 mouse1 $ ls -l /dev/input/by-id total 0 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-event-if01 -> ../event9 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-event-kbd -> ../event8 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-BY_Tech_Usb-if01-event-kbd -> ../event11 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-BY_Tech_Usb-if01-event-mouse -> ../event12 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-BY_Tech_Usb-if01-mouse -> ../mouse1 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-event-if01 -> ../event5 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-event-mouse -> ../event2 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-if01-event-kbd -> ../event3 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 usb-SOAI_USB_Gaming_Mouse-mouse -> ../mouse0 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 usb-Sonix_Technology_Co.__Ltd._H264_USB_Camera_SN0001-event-if00 -> ../event27 lrwxrwxrwx 1 nobody nogroup 10 23 apr 07.22 usb-ZEROPLUS_Controller_3136303033313032354246323543-event-joystick -> ../event28 lrwxrwxrwx 1 nobody nogroup 6 23 apr 07.22 usb-ZEROPLUS_Controller_3136303033313032354246323543-joystick -> ../js1 $ ls -l /dev/input/by-path total 0 lrwxrwxrwx 1 nobody nogroup 10 23 apr 07.22 pci-0000:05:00.1-usb-0:6.1:1.0-event-joystick -> ../event28 lrwxrwxrwx 1 nobody nogroup 6 23 apr 07.22 pci-0000:05:00.1-usb-0:6.1:1.0-joystick -> ../js1 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.0-event-mouse -> ../event2 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.0-mouse -> ../mouse0 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.1-event -> ../event5 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.3:1.1-event-kbd -> ../event3 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.0-event-kbd -> ../event8 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event -> ../event9 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event-kbd -> ../event11 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-event-mouse -> ../event12 lrwxrwxrwx 1 nobody nogroup 9 22 apr 19.18 pci-0000:05:00.3-usb-0:6.4:1.1-mouse -> ../mouse1 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 pci-0000:0c:00.3-usb-0:4:1.0-event -> ../event27 lrwxrwxrwx 1 nobody nogroup 10 22 apr 19.18 platform-pcspkr-event-spkr -> ../event13
* | man: corrections regarding --private-FOO optionsLibravatar Jeff Squyres2021-04-20
|/ | | | | | | | | | | | | | | | | Commit 0.9.60-1070-g40d3604f updated the man pages with respect to --private-opt, --private-etc, and --private-srv. It was made after testing firejail 0.9.52 (from Ubuntu 18.04). However, it unfortunately did not accurately reflect the the behavior of the current HEAD at the time, because commit 0.9.56-rc1-14-ga9242301 had previously slightly changed the behavior of these three options (after 0.9.52), and was released in 0.9.56. The man pages changes made in commit 40d3604f were therefore not entirely correct. This commit updates the man pages to describe the behavior as implemented in a9242301 (and is still the behavior as of the current HEAD: 0.9.64-737-g937815ba). Signed-off-by: Jeff Squyres <jsquyres@cisco.com>
* Fix typo (#4176)Libravatar Jose Riha2021-04-10
|
* Update README.md & RELONTS; Fix manpage HAVE_NETWORKLibravatar rusty-snake2021-03-19
|
* fix --dbus-{system,user}.log requirementLibravatar glitsj162021-03-07
|
* man text for --include commandLibravatar netblue302021-03-05
|
* manpage: Add log as value of seccomp-error-actionLibravatar rusty-snake2021-03-01
| | | | man firejail-profiles has it already. [skip ci]
* retiring --audit (replaced by jailtest)Libravatar netblue302021-03-01
|
* compile time: enable LTSLibravatar startx20172021-02-28
|
* compile time: disable --outputLibravatar startx20172021-02-28
|
* mkdir/mkfile man pagesLibravatar netblue302021-02-26
|
* jailtestLibravatar netblue302021-02-23
|
* fix spacing in man firejailLibravatar glitsj162021-02-10
|
* fix ordering of deterministic-exit-code in man firejailLibravatar glitsj162021-02-10
|
* merge/readme updateLibravatar netblue302021-01-25
|
* update manpages and RELNOTESLibravatar rusty-snake2021-01-08
|
* manpage: /bin/bash -> user's perferred shellLibravatar rusty-snake2020-12-29
| | | | | | | | | | We do not start /bin/bash in the sandbox, we use $SHELL (which is usually /bin/bash). See #3434 and #3844. This commit updates the manpage accordingly until #3434 is resolved with a final solution like using /bin/bash or /bin/sh as hardcoded default. Close #3844. The descriptions of --join* are not updated as there is currenly some work, see #2934 and #3850.
* fix #3782 -- Man pages have #ifdefs in themLibravatar rusty-snake2020-12-01
|
* document protocol=bluetoothLibravatar rusty-snake2020-11-16
|
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-10 01:33:59 +0000