aboutsummaryrefslogtreecommitdiffstats
path: root/src/man
Commit message (Collapse)AuthorAge
* landlock: small fixesLibravatar netblue302023-12-22
|
* landlock: move commands into profile and add landlock.enforceLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | | | | | | | | | | | | | Changes: * Move commands from --landlock and --landlock.proc= into etc/inc/landlock-common.inc * Remove --landlock and --landlock.proc= * Add --landlock.enforce Instead of hard-coding the default commands (and having a separate command just for /proc), move them into a dedicated profile to make it easier for users to interact with the entries (view, copy, add ignore entries, etc). Only enforce the Landlock commands if --landlock.enforce is supplied. This allows safely adding Landlock commands to (upstream) profiles while keeping their enforcement opt-in. It also makes it simpler to effectively disable all Landlock commands, by using `--ignore=landlock.enforce`. Relates to #6078.
* docs: fix typo of --nonewprivs in Landlock sectionLibravatar glitsj162023-12-05
| | | | | | Originally from PR #5359. Relates to #6078.
* landlock: update README.md, small fix in man firejal; update profile stats ↵Libravatar netblue302023-12-04
| | | | in README.md
* Merge pull request #6078 from kmk3/landlock_v3Libravatar netblue302023-12-04
|\ | | | | feature: add Landlock support
| * feature: add Landlock supportLibravatar netblue302023-11-07
| | | | | | | | | | | | | | | | | | | | Based on 5315 by ChrysoliteAzalea. It is based on the same underlying structure, but with a lot of refactoring/simplification and with bugfixes and improvements. Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com> Co-authored-by: Азалия Смарагдова <charming.flurry@yandex.ru>
* | Merge pull request #5876 from kmk3/firecfg-add-confdir-ignoreLibravatar netblue302023-12-04
|\ \ | |/ |/| feature: firecfg: add firecfg.d & add ignore command
| * firecfg: add ignore command and docsLibravatar Kelvin M. Klann2023-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ignore command (`!PROGRAM`), as suggested by @WhyNotHugo[1]. It prevents firecfg from creating a symlink for the given program. Also, document the paths used and the config file syntax. Note that `/etc/firejail/firecfg.d/*.conf` files are parsed before /etc/firejail/firecfg.config, so the former can ignore/override any item in the latter. Closes #2097. [1] https://github.com/netblue30/firejail/issues/2097#issuecomment-1179160459
* | enabled nettraces by default in the main build - you would need to be root ↵landlock-splitLibravatar netblue302023-10-24
| | | | | | | | to run these options
* | profiles: exchange private-opt with a whitelist (#6021)Libravatar glitsj162023-10-18
|/ | | | | | | | | | | | | * profiles: drop private-opt (existing whitelist) * profiles: replace private-opt with whitelist In most profiles. Kept private-opt for enpass (~85MB), mate-dictionary (<20MB), minecraft-launcher (~1.6MB) and ppsspp (~44MB). The only app I couldn't check: xmr-stak. * docs: note potential issues with private-opt
* modif: drop deprecated 'shell' option references (#5894)Libravatar glitsj162023-07-19
| | | | | | | | | | | | The `shell` option has been removed. Remove stale references. This does NOT remove `shell none`-related code comments in: - src/firejail/fs_lib.c (L433-L441) - src/firejail/join.c (L415-L417) Relates to #5196. Suggested by #5891.
* feature: add doas support in firecfg and jailcheckLibravatar Kelvin M. Klann2023-07-14
| | | | | | Closes #5899. Suggested-by: @shaggonit
* build: simplify code related to man pagesLibravatar Kelvin M. Klann2023-07-13
| | | | | | | | | | | | | | | | | | | | | | | | | Simplify the main targets and use wildcards instead of repeating the filenames manually. Also, restore the `man` target and building only when `HAVE_MAN` is enabled. Note: Make automatically removes intermediate files (.1 and .5), so in general only the .gz files have to be cleaned. Commands used to rename the man pages: cd src/man git mv firecfg.txt firecfg.1.in git mv firejail-login.txt firejail-login.5.in git mv firejail-profile.txt firejail-profile.5.in git mv firejail-users.txt firejail-users.5.in git mv firejail.txt firejail.1.in git mv firemon.txt firemon.1.in git mv jailcheck.txt jailcheck.1.in This is kind of a follow-up to commit 9e206b7f2 ("rework src/man Makefile", 2023-07-07).
* build: remove extraneous blank lines in makefilesLibravatar Kelvin M. Klann2023-07-12
| | | | | | | | Added in the following commits: * f3774678f ("compress static ip map for fnettrace at compile time", 2023-07-06) * 9e206b7f2 ("rework src/man Makefile", 2023-07-07)
* rework src/man MakefileLibravatar netblue302023-07-07
|
* build: move MAKEFLAGS to config.mk.inLibravatar Kelvin M. Klann2023-06-24
| | | | | | | To reduce the amount of boilerplate in the makefiles. This amends commit 9789c263a ("build: disable all built-in implicit make rules", 2023-06-21) / PR #5864.
* build: disable all built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use `make -r` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~93.3% (~97.5% compared to a8f01a383) for the default build and by ~83.3% (~99.3% compared to a8f01a383) for the "man" target (as an example): $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (in the previous commit) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 170 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 7 Environment: GNU make 4.4.1-2 on Artix Linux. Note: According to make(1p) in POSIX.1-2017, "If .SUFFIXES does not have any prerequisites, the list of known suffixes shall be cleared.", while "The result of setting MAKEFLAGS in the Makefile is unspecified." Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed -E \ 's/^(.SUFFIXES:)/\1\nMAKEFLAGS += -r\n/' '{}')\" >'{}'"
* build: disable most built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clear `.SUFFIXES:` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~62% for the default build and by ~96% for the "man" target (as an example): $ git checkout master >/dev/null 2>&1 $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 Environment: GNU make 4.4.1-2 on Artix Linux. Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed '1s/^/.SUFFIXES:\n/' '{}')\" >'{}'" See also commit f48886f25 ("build: mark most phony targets as such", 2023-02-01) / PR #5637.
* build: standardize commands on top of makefilesLibravatar Kelvin M. Klann2023-06-21
| | | | To make the makefiles look more similar.
* docs: document NAME VALIDATION in firejail.txtLibravatar Kelvin M. Klann2023-06-13
|
* firejail.txt: remove extraneous endifLibravatar Kelvin M. Klann2023-03-10
| | | | | | | Added on commit b689b69f6 ("make --private-lib a compile time option, disabled by default", 2023-03-09). Relates to #5727.
* make --private-lib a compile time option, disabled by defaultLibravatar netblue302023-03-09
|
* remove firemon --interface option - it is a duplication of firejail --net.printLibravatar netblue302023-03-08
|
* Update copyright to 2023 (#5664)Libravatar David Fetter2023-02-15
|
* feature: add 'keep-shell-rc' flag and optionLibravatar Antoine Catton2023-02-03
| | | | | | | | This fixes #1127. This allow a user to provide their own zshrc/bashrc inside the jail. This is very useful when using firejail to develop and prevent bad pip packages to access your system.
* Merge pull request #5578 from layderv/masterLibravatar netblue302023-01-30
|\ | | | | modif: Prevent sandbox name from containing only digits
| * Prevent sandbox name from containing only digitsLibravatar layderv2023-01-24
| | | | | | | | | | Names should not contain only numbers, as they are used in other commands as PIDs.
* | private-etc: moved group names to @group syntax; GUI group renamed as @x11 ↵Libravatar netblue302023-01-30
| | | | | | | | group; added nvidia and X11 directories to @x11 group.
* | private-etc: fix man pageLibravatar netblue302023-01-25
| |
* | private-etc rework: new man pageLibravatar netblue302023-01-25
| |
* | bringing back whitelisting /devLibravatar netblue302023-01-14
| |
* | rel 0.9.72 testing: disable whitelisting /dev directoryLibravatar netblue302023-01-12
|/
* add netlock support in profile filesLibravatar netblue302022-12-21
|
* docs: clarify that --appimage should appear before --profileLibravatar Kelvin M. Klann2022-11-04
| | | | | | | | | | | | | | | | | | | | | | And fix the argument order in the examples to reflect that. Background: The order in which these options appeared in the documentation was inconsistent. src/man/firejail.txt used --appimage before --profile and src/man/firejail-profile.txt used --profile before --appimage. Then commit 44fefcac0 ("Make appimage examples consistent with --appimage option short description", 2022-10-05) / PR #5402 was made, which standardized on --profile before --appimage in both places. But as mentioned by @rusty-snake[1], --appimage has be specified before --profile in order for any `?HAS_APPIMAGE` conditionals inside of the profile to evaluate to true. So change the documentation to use and recommend the latter form. Also, add --quiet to one example to make it clear that --appimage does not have to be the first option (nor the last option before --profile). [1] https://github.com/netblue30/firejail/pull/5402#issuecomment-1274889618
* --icmptraceLibravatar netblue302022-10-24
|
* remove deprecated --shell from man pageLibravatar netblue302022-10-23
|
* dnstrace and snitraceLibravatar netblue302022-10-23
|
* Merge pull request #5402 from slowpeek/masterLibravatar netblue302022-10-11
|\ | | | | docs: Make appimage examples consistent with --appimage option short description
| * Make appimage examples consistent with --appimage option short descriptionLibravatar slowpeek2022-10-05
| |
* | nettrace-dns and nettrace-sniLibravatar netblue302022-10-11
|/
* docs: man: Note that some commands can be disabled in firejail.config (#5366)Libravatar glitsj162022-09-14
| | | | | | | | | | | | | | | | | * [man firejail] Make it explicit that some options are disabled by default in firejail.config * Reword firejail.config notes * Only add relevant firejail.config option in notes * move firejail.config notes to the end of each section * fix tracelog note * fix erroneous line break * really fix erroneous line break Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
* docs: change /foo to /bar in symlink handling exampleLibravatar Kelvin M. Klann2022-09-06
| | | | | | | | | As suggested by @birdie-github[1]. This amends commit c78c2b4ec ("docs: note that blacklist/whitelist follow symlinks", 2022-08-28) / PR #5344. [1] https://github.com/netblue30/firejail/pull/5344#issuecomment-1229903967
* Revert "Merge pull request #5315 from ChrysoliteAzalea/landlock"Libravatar Kelvin M. Klann2022-09-05
| | | | | | | | | | | This reverts commit 54cb3e741e972c754e595d56de0bca0792299f83, reversing changes made to 97b1e02d5f4dca4261dc9928f8a5ebf8966682d7. There were many issues and requests for changes raised in the pull request (both code-wise and design-wise) and most of them are still unresolved[1]. [1] https://github.com/netblue30/firejail/pull/5315
* Merge pull request #5315 from ChrysoliteAzalea/landlockLibravatar netblue302022-08-29
|\ | | | | Add Landlock support to Firejail
| * Proposed fixes.Libravatar Азалия Смарагдова2022-08-16
| |
| * Landlock support has been added.Libravatar Азалия Смарагдова2022-08-15
| |
* | docs: note that blacklist/whitelist follow symlinksLibravatar Kelvin M. Klann2022-08-28
| | | | | | | | | | | | Make it more explicit that they do and add an example for each command. Relates to #5338.
* | docs: clarify symlink handling description in --whitelistLibravatar Kelvin M. Klann2022-08-28
| | | | | | | | Format it and improve the grammar and explanation.
* | docs: set vim filetype on the other man pagesLibravatar Kelvin M. Klann2022-08-20
|/ | | | | | | Some man pages are missing it. This amends commit aacd2e7d8 ("docs: set vim filetype on man pages for syntax highlighting", 2022-08-04) / PR #5296.
* Merge pull request #5296 from kmk3/docs-man-vim-ftLibravatar netblue302022-08-14
|\ | | | | docs: set vim filetype on man pages for syntax highlighting
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-24 18:54:08 +0000