aboutsummaryrefslogtreecommitdiffstats
path: root/src/man
Commit message (Collapse)AuthorAge
* Merge pull request #5876 from kmk3/firecfg-add-confdir-ignoreLibravatar netblue302023-12-04
|\ | | | | feature: firecfg: add firecfg.d & add ignore command
| * firecfg: add ignore command and docsLibravatar Kelvin M. Klann2023-08-04
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add ignore command (`!PROGRAM`), as suggested by @WhyNotHugo[1]. It prevents firecfg from creating a symlink for the given program. Also, document the paths used and the config file syntax. Note that `/etc/firejail/firecfg.d/*.conf` files are parsed before /etc/firejail/firecfg.config, so the former can ignore/override any item in the latter. Closes #2097. [1] https://github.com/netblue30/firejail/issues/2097#issuecomment-1179160459
* | enabled nettraces by default in the main build - you would need to be root ↵landlock-splitLibravatar netblue302023-10-24
| | | | | | | | to run these options
* | profiles: exchange private-opt with a whitelist (#6021)Libravatar glitsj162023-10-18
|/ | | | | | | | | | | | | * profiles: drop private-opt (existing whitelist) * profiles: replace private-opt with whitelist In most profiles. Kept private-opt for enpass (~85MB), mate-dictionary (<20MB), minecraft-launcher (~1.6MB) and ppsspp (~44MB). The only app I couldn't check: xmr-stak. * docs: note potential issues with private-opt
* modif: drop deprecated 'shell' option references (#5894)Libravatar glitsj162023-07-19
| | | | | | | | | | | | The `shell` option has been removed. Remove stale references. This does NOT remove `shell none`-related code comments in: - src/firejail/fs_lib.c (L433-L441) - src/firejail/join.c (L415-L417) Relates to #5196. Suggested by #5891.
* feature: add doas support in firecfg and jailcheckLibravatar Kelvin M. Klann2023-07-14
| | | | | | Closes #5899. Suggested-by: @shaggonit
* build: simplify code related to man pagesLibravatar Kelvin M. Klann2023-07-13
| | | | | | | | | | | | | | | | | | | | | | | | | Simplify the main targets and use wildcards instead of repeating the filenames manually. Also, restore the `man` target and building only when `HAVE_MAN` is enabled. Note: Make automatically removes intermediate files (.1 and .5), so in general only the .gz files have to be cleaned. Commands used to rename the man pages: cd src/man git mv firecfg.txt firecfg.1.in git mv firejail-login.txt firejail-login.5.in git mv firejail-profile.txt firejail-profile.5.in git mv firejail-users.txt firejail-users.5.in git mv firejail.txt firejail.1.in git mv firemon.txt firemon.1.in git mv jailcheck.txt jailcheck.1.in This is kind of a follow-up to commit 9e206b7f2 ("rework src/man Makefile", 2023-07-07).
* build: remove extraneous blank lines in makefilesLibravatar Kelvin M. Klann2023-07-12
| | | | | | | | Added in the following commits: * f3774678f ("compress static ip map for fnettrace at compile time", 2023-07-06) * 9e206b7f2 ("rework src/man Makefile", 2023-07-07)
* rework src/man MakefileLibravatar netblue302023-07-07
|
* build: move MAKEFLAGS to config.mk.inLibravatar Kelvin M. Klann2023-06-24
| | | | | | | To reduce the amount of boilerplate in the makefiles. This amends commit 9789c263a ("build: disable all built-in implicit make rules", 2023-06-21) / PR #5864.
* build: disable all built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use `make -r` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~93.3% (~97.5% compared to a8f01a383) for the default build and by ~83.3% (~99.3% compared to a8f01a383) for the "man" target (as an example): $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (in the previous commit) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 170 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 7 Environment: GNU make 4.4.1-2 on Artix Linux. Note: According to make(1p) in POSIX.1-2017, "If .SUFFIXES does not have any prerequisites, the list of known suffixes shall be cleared.", while "The result of setting MAKEFLAGS in the Makefile is unspecified." Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed -E \ 's/^(.SUFFIXES:)/\1\nMAKEFLAGS += -r\n/' '{}')\" >'{}'"
* build: disable most built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clear `.SUFFIXES:` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~62% for the default build and by ~96% for the "man" target (as an example): $ git checkout master >/dev/null 2>&1 $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 Environment: GNU make 4.4.1-2 on Artix Linux. Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed '1s/^/.SUFFIXES:\n/' '{}')\" >'{}'" See also commit f48886f25 ("build: mark most phony targets as such", 2023-02-01) / PR #5637.
* build: standardize commands on top of makefilesLibravatar Kelvin M. Klann2023-06-21
| | | | To make the makefiles look more similar.
* docs: document NAME VALIDATION in firejail.txtLibravatar Kelvin M. Klann2023-06-13
|
* firejail.txt: remove extraneous endifLibravatar Kelvin M. Klann2023-03-10
| | | | | | | Added on commit b689b69f6 ("make --private-lib a compile time option, disabled by default", 2023-03-09). Relates to #5727.
* make --private-lib a compile time option, disabled by defaultLibravatar netblue302023-03-09
|
* remove firemon --interface option - it is a duplication of firejail --net.printLibravatar netblue302023-03-08
|
* Update copyright to 2023 (#5664)Libravatar David Fetter2023-02-15
|
* feature: add 'keep-shell-rc' flag and optionLibravatar Antoine Catton2023-02-03
| | | | | | | | This fixes #1127. This allow a user to provide their own zshrc/bashrc inside the jail. This is very useful when using firejail to develop and prevent bad pip packages to access your system.
* Merge pull request #5578 from layderv/masterLibravatar netblue302023-01-30
|\ | | | | modif: Prevent sandbox name from containing only digits
| * Prevent sandbox name from containing only digitsLibravatar layderv2023-01-24
| | | | | | | | | | Names should not contain only numbers, as they are used in other commands as PIDs.
* | private-etc: moved group names to @group syntax; GUI group renamed as @x11 ↵Libravatar netblue302023-01-30
| | | | | | | | group; added nvidia and X11 directories to @x11 group.
* | private-etc: fix man pageLibravatar netblue302023-01-25
| |
* | private-etc rework: new man pageLibravatar netblue302023-01-25
| |
* | bringing back whitelisting /devLibravatar netblue302023-01-14
| |
* | rel 0.9.72 testing: disable whitelisting /dev directoryLibravatar netblue302023-01-12
|/
* add netlock support in profile filesLibravatar netblue302022-12-21
|
* docs: clarify that --appimage should appear before --profileLibravatar Kelvin M. Klann2022-11-04
| | | | | | | | | | | | | | | | | | | | | | And fix the argument order in the examples to reflect that. Background: The order in which these options appeared in the documentation was inconsistent. src/man/firejail.txt used --appimage before --profile and src/man/firejail-profile.txt used --profile before --appimage. Then commit 44fefcac0 ("Make appimage examples consistent with --appimage option short description", 2022-10-05) / PR #5402 was made, which standardized on --profile before --appimage in both places. But as mentioned by @rusty-snake[1], --appimage has be specified before --profile in order for any `?HAS_APPIMAGE` conditionals inside of the profile to evaluate to true. So change the documentation to use and recommend the latter form. Also, add --quiet to one example to make it clear that --appimage does not have to be the first option (nor the last option before --profile). [1] https://github.com/netblue30/firejail/pull/5402#issuecomment-1274889618
* --icmptraceLibravatar netblue302022-10-24
|
* remove deprecated --shell from man pageLibravatar netblue302022-10-23
|
* dnstrace and snitraceLibravatar netblue302022-10-23
|
* Merge pull request #5402 from slowpeek/masterLibravatar netblue302022-10-11
|\ | | | | docs: Make appimage examples consistent with --appimage option short description
| * Make appimage examples consistent with --appimage option short descriptionLibravatar slowpeek2022-10-05
| |
* | nettrace-dns and nettrace-sniLibravatar netblue302022-10-11
|/
* docs: man: Note that some commands can be disabled in firejail.config (#5366)Libravatar glitsj162022-09-14
| | | | | | | | | | | | | | | | | * [man firejail] Make it explicit that some options are disabled by default in firejail.config * Reword firejail.config notes * Only add relevant firejail.config option in notes * move firejail.config notes to the end of each section * fix tracelog note * fix erroneous line break * really fix erroneous line break Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
* docs: change /foo to /bar in symlink handling exampleLibravatar Kelvin M. Klann2022-09-06
| | | | | | | | | As suggested by @birdie-github[1]. This amends commit c78c2b4ec ("docs: note that blacklist/whitelist follow symlinks", 2022-08-28) / PR #5344. [1] https://github.com/netblue30/firejail/pull/5344#issuecomment-1229903967
* Revert "Merge pull request #5315 from ChrysoliteAzalea/landlock"Libravatar Kelvin M. Klann2022-09-05
| | | | | | | | | | | This reverts commit 54cb3e741e972c754e595d56de0bca0792299f83, reversing changes made to 97b1e02d5f4dca4261dc9928f8a5ebf8966682d7. There were many issues and requests for changes raised in the pull request (both code-wise and design-wise) and most of them are still unresolved[1]. [1] https://github.com/netblue30/firejail/pull/5315
* Merge pull request #5315 from ChrysoliteAzalea/landlockLibravatar netblue302022-08-29
|\ | | | | Add Landlock support to Firejail
| * Proposed fixes.Libravatar Азалия Смарагдова2022-08-16
| |
| * Landlock support has been added.Libravatar Азалия Смарагдова2022-08-15
| |
* | docs: note that blacklist/whitelist follow symlinksLibravatar Kelvin M. Klann2022-08-28
| | | | | | | | | | | | Make it more explicit that they do and add an example for each command. Relates to #5338.
* | docs: clarify symlink handling description in --whitelistLibravatar Kelvin M. Klann2022-08-28
| | | | | | | | Format it and improve the grammar and explanation.
* | docs: set vim filetype on the other man pagesLibravatar Kelvin M. Klann2022-08-20
|/ | | | | | | Some man pages are missing it. This amends commit aacd2e7d8 ("docs: set vim filetype on man pages for syntax highlighting", 2022-08-04) / PR #5296.
* Merge pull request #5296 from kmk3/docs-man-vim-ftLibravatar netblue302022-08-14
|\ | | | | docs: set vim filetype on man pages for syntax highlighting
| * docs: set vim filetype on man pages for syntax highlightingLibravatar Kelvin M. Klann2022-08-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the man pages in src/man use a ".txt" file extension (rather than ".1" or ".5"), their filetype is detected by (neo)vim as "text". So at the bottom of every man page, add a vim modeline in a comment and set the filetype to "groff", to enable syntax highlighting. Note: All of the generated ".man", ".1" and ".5" files are currently being detected as "nroff". Note2: Set the filetype to "groff" rather than "nroff" because at least .UR and .UE are groff extensions. These macros look the same with either filetype, but there may be more extensions being used and the nroff.vim syntax file (which is included by groff.vim) does things differently based on which filetype is used. Based on the following example from (neo)vim's filetype.txt: or add this modeline to the file: /* vim: set filetype=idl : */ See `:help groff.vim` and `:help filetype.txt` in (neo)vim. See also groff_man(7) for the man page macros (including extensions). Environment: neovim 0.7.2-3 on Artix Linux. Misc: I noticed this on #5290.
* | Merge pull request #5290 from kmk3/docs-suid-firejail-usersLibravatar netblue302022-08-14
|\ \ | | | | | | docs: mention risk of SUID binaries and also firejail-users(5)
| * | docs: mention risk of SUID binaries and also firejail-users(5)Libravatar Kelvin M. Klann2022-08-05
| |/ | | | | | | | | | | | | | | | | | | | | | | | | On the introduction of firejail(1), mention the main risk of SUID binaries and that by default, only trusted users should be allowed to run firejail (and how to accomplish that). Note: The added comment line is completely discarded (so there is no extraneous blank line); see groff_man(7) for details. Suggested by @emerajid on #5288. Relates to #4601.
* / Add support for custom AppArmor profiles (--apparmor=)Libravatar Азалия Смарагдова2022-08-05
|/
* introduce new option restrict-namespacesLibravatar smitsohu2022-07-23
|
* makefiles: add generated files as dependenciesLibravatar Kelvin M. Klann2022-06-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the previous commit ("makefiles: stop failing when config.mk does not exist", 2022-06-23), make will not immediately fail when trying to build a target without having the proper compile-time flags (which are defined on common.mk). For example, when running the command below: make distclean && make It will throw an error only after (mis-)compiling multiple objects. So add a dependency on config.mk on every target that uses output variables (such as @NAME@ / $(NAME)) on its recipe. And add a dependency on config.sh on targets that call shell scripts that use output variables (such as @NAME@ / $NAME). Also, add a recipe for config.mk / config.sh telling to run ./configure, to make it a bit more obvious just in case. With this commit, make will abort earlier, by detecting that the config.mk / config.sh dependency does not exist. This happens before trying to execute the recipe. This also makes the dependencies more accurate, since if config.mk (which defines some CFLAGS) is changed, the CFLAGS may also have changed, so a target that uses CFLAGS should probably be considered out of date in this case anyway. Relates to #5140.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-03 20:36:44 +0000