aboutsummaryrefslogtreecommitdiffstats
path: root/src/zsh_completion
Commit message (Collapse)AuthorAge
* build: allow overriding common toolsLibravatar Kelvin M. Klann2024-05-29
| | | | | | | | | | | | | | | | | | | | | | | Tools: * gzip * install * rm * strip * tar For the programs not checked in configure.ac: From the manual of GNU Autoconf (version 2.71): > If you use `AC_PROG_INSTALL`, you must include `install-sh` in your > distribution So set `install` just in the Makefile. Use `$(RM)` to ensure that `-f` is always used and to make it easier to spot when `-r` is used. See commit 93d623fdf ("build: allow overriding certain tools", 2024-02-23) / PR #6222.
* build: define CC/GAWK if undefinedLibravatar Kelvin M. Klann2024-05-24
| | | | | | | | | Just in case the value is not defined in config.mk and `make` is first executed from another directory (such as in src/man) instead of the root directory. This amends commit 93d623fdf ("build: allow overriding certain tools", 2024-02-23) / PR #6222.
* landlock: use "landlock.fs." prefix in filesystem commandsLibravatar Kelvin M. Klann2024-02-27
| | | | | | | | | | | | | | | | | | | Since Landlock ABI v4 it is possible to restrict actions related to the network and potentially more areas will be added in the future. So use `landlock.fs.` as the prefix in the current filesystem-related commands (and later `landlock.net.` for the network-related commands) to keep them organized and to match what is used in the kernel. Examples of filesystem and network access flags: * `LANDLOCK_ACCESS_FS_EXECUTE`: Execute a file. * `LANDLOCK_ACCESS_FS_READ_DIR`: Open a directory or list its content. * `LANDLOCK_ACCESS_NET_BIND_TCP`: Bind a TCP socket to a local port. * `LANDLOCK_ACCESS_NET_CONNECT_TCP`: Connect an active TCP socket to a remote port. Relates to #6078.
* build: allow overriding certain toolsLibravatar Kelvin M. Klann2024-02-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Allow overriding the following tools at configure-time and build-time: * codespell * cppcheck * gawk * scan-build For example, instead of hardcoding `gawk`, enable overriding it at configure-time with: ./configure GAWK=/path/to/gawk To override it for a single `make` invocation: make GAWK=/path/to/gawk Also, add default values for the programs that are not found (rather than leaving the variables empty), to make error messages clearer when trying to run them: $ make CPPCHECK= cppcheck-old [...] force --error-exitcode=1 --enable=warning,performance . make: force: No such file or directory $ make CPPCHECK=cppcheck cppcheck-old [...] cppcheck --force --error-exitcode=1 --enable=warning,performance . make: cppcheck: No such file or directory
* landlock: split .special into .makeipc and .makedevLibravatar Kelvin M. Klann2024-02-02
| | | | | | | | | | | | | | | | | | | | | As discussed with @topimiettinen[1], it is unlikely that an unprivileged process would need to directly create block or character devices. Also, `landlock.special` is not very descriptive of what it allows. So split `landlock.special` into: * `landlock.makeipc`: allow creating named pipes and sockets (which are usually used for inter-process communication) * `landlock.makedev`: allow creating block and character devices Misc: The `makedev` name is based on `nodev` from mount(8), which makes mount not interpret block and character devices. `ipc` was suggested by @rusty-snake[2]. Relates to #6078. [1] https://github.com/netblue30/firejail/pull/6078#pullrequestreview-1740569786 [2] https://github.com/netblue30/firejail/pull/6187#issuecomment-1924107294
* remove LTS and FIRETUNNEL supportLibravatar netblue302023-12-23
|
* landlock: move commands into profile and add landlock.enforceLibravatar Kelvin M. Klann2023-12-11
| | | | | | | | | | | | | | | | | | | | | | Changes: * Move commands from --landlock and --landlock.proc= into etc/inc/landlock-common.inc * Remove --landlock and --landlock.proc= * Add --landlock.enforce Instead of hard-coding the default commands (and having a separate command just for /proc), move them into a dedicated profile to make it easier for users to interact with the entries (view, copy, add ignore entries, etc). Only enforce the Landlock commands if --landlock.enforce is supplied. This allows safely adding Landlock commands to (upstream) profiles while keeping their enforcement opt-in. It also makes it simpler to effectively disable all Landlock commands, by using `--ignore=landlock.enforce`. Relates to #6078.
* landlock: fix incomplete zsh completionLibravatar Kelvin M. Klann2023-12-05
| | | | | This amends commit 13b2c566d ("feature: add Landlock support", 2023-10-24) / PR #6078.
* feature: add Landlock supportLibravatar netblue302023-11-07
| | | | | | | | | | Based on 5315 by ChrysoliteAzalea. It is based on the same underlying structure, but with a lot of refactoring/simplification and with bugfixes and improvements. Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com> Co-authored-by: Азалия Смарагдова <charming.flurry@yandex.ru>
* build: remove unnecessary distclean targetsLibravatar Kelvin M. Klann2023-07-20
| | | | This also fixes the duplicate execution of the "clean" targets.
* modif: drop deprecated 'shell' option references (#5894)Libravatar glitsj162023-07-19
| | | | | | | | | | | | The `shell` option has been removed. Remove stale references. This does NOT remove `shell none`-related code comments in: - src/firejail/fs_lib.c (L433-L441) - src/firejail/join.c (L415-L417) Relates to #5196. Suggested by #5891.
* zsh: add shell completion for --tabLibravatar Kelvin M. Klann2023-07-19
| | | | | | | | | | | Note: It already works for bash and it's already present in the syntax files: $ grep '^tab' contrib/syntax/lists/profile_commands_arg0.list tab Added on commit e6c50240f ("--tab: enable shell tab completion", 2022-02-20) / #4936.
* build: move MAKEFLAGS to config.mk.inLibravatar Kelvin M. Klann2023-06-24
| | | | | | | To reduce the amount of boilerplate in the makefiles. This amends commit 9789c263a ("build: disable all built-in implicit make rules", 2023-06-21) / PR #5864.
* build: disable all built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use `make -r` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~93.3% (~97.5% compared to a8f01a383) for the default build and by ~83.3% (~99.3% compared to a8f01a383) for the "man" target (as an example): $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (in the previous commit) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 170 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 7 Environment: GNU make 4.4.1-2 on Artix Linux. Note: According to make(1p) in POSIX.1-2017, "If .SUFFIXES does not have any prerequisites, the list of known suffixes shall be cleared.", while "The result of setting MAKEFLAGS in the Makefile is unspecified." Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed -E \ 's/^(.SUFFIXES:)/\1\nMAKEFLAGS += -r\n/' '{}')\" >'{}'"
* build: disable most built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clear `.SUFFIXES:` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~62% for the default build and by ~96% for the "man" target (as an example): $ git checkout master >/dev/null 2>&1 $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 Environment: GNU make 4.4.1-2 on Artix Linux. Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed '1s/^/.SUFFIXES:\n/' '{}')\" >'{}'" See also commit f48886f25 ("build: mark most phony targets as such", 2023-02-01) / PR #5637.
* build: standardize commands on top of makefilesLibravatar Kelvin M. Klann2023-06-21
| | | | To make the makefiles look more similar.
* editorconfig: add indentation rulesLibravatar Kelvin M. Klann2023-02-20
| | | | | | | | | | Commands used to list the file extensions used in the project: $ git ls-files | sed -En 's/.*(\.[^.]+)$/\1/p' | LC_ALL=C sort | uniq -c For rules that are more specific to a given directory, put a dedicated .editorconfig file in it.
* feature: add 'keep-shell-rc' flag and optionLibravatar Antoine Catton2023-02-03
| | | | | | | | This fixes #1127. This allow a user to provide their own zshrc/bashrc inside the jail. This is very useful when using firejail to develop and prevent bad pip packages to access your system.
* Revert "Merge pull request #5315 from ChrysoliteAzalea/landlock"Libravatar Kelvin M. Klann2022-09-05
| | | | | | | | | | | This reverts commit 54cb3e741e972c754e595d56de0bca0792299f83, reversing changes made to 97b1e02d5f4dca4261dc9928f8a5ebf8966682d7. There were many issues and requests for changes raised in the pull request (both code-wise and design-wise) and most of them are still unresolved[1]. [1] https://github.com/netblue30/firejail/pull/5315
* Proposed fixes.Libravatar Азалия Смарагдова2022-08-16
|
* Update quotation marks in src/zsh_completion/_firejail.inLibravatar Азалия Смарагдова2022-08-15
| | | Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
* Landlock support has been added.Libravatar Азалия Смарагдова2022-08-15
|
* Add support for custom AppArmor profiles (--apparmor=)Libravatar Азалия Смарагдова2022-08-05
|
* introduce new option restrict-namespacesLibravatar smitsohu2022-07-23
|
* makefiles: add generated files as dependenciesLibravatar Kelvin M. Klann2022-06-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With the previous commit ("makefiles: stop failing when config.mk does not exist", 2022-06-23), make will not immediately fail when trying to build a target without having the proper compile-time flags (which are defined on common.mk). For example, when running the command below: make distclean && make It will throw an error only after (mis-)compiling multiple objects. So add a dependency on config.mk on every target that uses output variables (such as @NAME@ / $(NAME)) on its recipe. And add a dependency on config.sh on targets that call shell scripts that use output variables (such as @NAME@ / $NAME). Also, add a recipe for config.mk / config.sh telling to run ./configure, to make it a bit more obvious just in case. With this commit, make will abort earlier, by detecting that the config.mk / config.sh dependency does not exist. This happens before trying to execute the recipe. This also makes the dependencies more accurate, since if config.mk (which defines some CFLAGS) is changed, the CFLAGS may also have changed, so a target that uses CFLAGS should probably be considered out of date in this case anyway. Relates to #5140.
* makefiles: stop failing when config.mk does not existLibravatar Kelvin M. Klann2022-06-30
| | | | | | | | | | | | | | | | | | | This allows running `make clean` and `make distclean` (and possibly others) without having to run ./configure beforehand. Note that some packaging-related targets still depend on the existence of generated files. For example: * dist: config.mk * deb: config.sh Commands used to search and replace: $ git grep -Elz 'include *([^ ]*/)?config.mk' | xargs -0 -I '{}' \ sh -c "printf '%s\n' \ \"\$(sed -E 's|^include *(([^ ]*/)?config.mk)|-include \1|' '{}')\" >'{}'" Relates to #5140.
* build: reduce autoconf input files from 32 to 2Libravatar Kelvin M. Klann2022-06-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Configure summary: autoconf essentially only parses configure.ac and generates the configure script (that is, the "./configure" shell script). The latter is what actually checks what is available on the system and internally sets the value of the output variables. It then, for every filename foo in AC_CONFIG_FILES (and for every output variable name BAR in AC_SUBST), reads foo.in, replaces every occurrence of `@BAR@` with the value of the shell variable `$BAR` and generates the file foo from the result. After this, configure is finished and `make` could be executed to start the build. Now that (as of #5140) all output variables are only defined on config.mk.in and on config.sh.in, there is no need to generate any makefile nor any other mkfile or shell script at configure time. So rename every "Makefile.in" to "Makefile", mkdeb.sh.in to mkdeb.sh, src/common.mk.in to src/common.mk and leave just config.mk and config.sh as the files to be generated at configure time. This allows editing and committing all makefiles directly, without potentially having to run ./configure in between. Commands used to rename the makefiles: $ git ls-files -z -- '*Makefile.in' | xargs -0 -I '{}' sh -c \ "git mv '{}' \"\$(dirname '{}')/Makefile\"" Additionally, from my (rudimentary) testing, this commit reduces the time it takes to run ./configure by about 20~25% compared to commit 72ece92ea ("Transmission fixes: drop private-lib (#5213)", 2022-06-22). Environment: dash 0.5.11.5-1, gcc 12.1.0-2, Artix Linux, ext4 on an HDD. Commands used for benchmarking each commit: $ : >time_configure && ./configure && make distclean && for i in $(seq 1 10); do { time -p ./configure; } 2>>time_configure; done $ grep real time_configure | awk '{ total += $2 } END { print total/NR }'
* more on removing cgroups (#5200)Libravatar netblue302022-06-16
|
* makefiles: include config.mk instead of common.mk where possibleLibravatar Kelvin M. Klann2022-06-12
| | | | | | | | | | | common.mk contains definitions for building programs and it includes config.mk. Some makefiles that include common.mk do not contain any targets for building programs. They depend only on configure-time variable definitions (which are defined on config.mk) rather than anything specific to common.mk. So change their includes of common.mk to config.mk.
* makefiles: define root dir and include relative to itLibravatar Kelvin M. Klann2022-06-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A non-absolute path on an include command is always treated as being relative to the directory in which "make" was started in, rather than being relative to the makefile that contains the command. For example, given the following project structure and file contents: * Makefile: include src/foo.mk * src/foo.mk: include bar.mk * src/bar.mk: Running "make" on the root project directory (that is, where "Makefile" is) yields the following: src/foo.mk:1: bar.mk: No such file or directory As "bar.mk" in "include bar.mk" is relative to the current (process) directory (that is, "./bar.mk") and not to where foo.mk is located in ("./src/bar.mk"). So on every makefile that contains an include command, define the root project directory in the ROOT variable and always include relative to it, to later enable any included mkfiles to include other mkfiles without having to worry about the correct path. Commands used to search and replace: $ git grep -Flz 'include ../common.mk' -- src | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\`sed 's|include ../common.mk|ROOT = ../..\ninclude \$(ROOT)/src/common.mk|' '{}'\`\" >'{}'" Environment: GNU make 4.3-3.1 on Artix Linux
* keep-fd option (#4845)Libravatar smitsohu2022-01-14
|
* noprinters: add missing items from new command checklistLibravatar Kelvin M. Klann2022-01-05
| | | | | | | | | | | | See CONTRIBUTING.md. The changes are based on what was done on commit 5a612029b ("rename noautopulse to keep-config-pulse", 2021-05-13) / PR #4278. This amends commit bd15e763e ("--noprinter option", 2021-10-20) and commit d9403dcdc ("small fix", 2021-10-20). Relates to #4607.
* Revert "allow/deny in zsh completion"Libravatar Kelvin M. Klann2021-12-10
| | | | | | This reverts commit 1021fb9e5d32a48698c0c8c913d44a048b12db7f. Relates to #4388 and #4410.
* zsh-comp: update description of machine-id to match --helpLibravatar Kelvin M. Klann2021-11-15
| | | | | | | This amends commit b5de1d0f9 ("Fix inconsistent descriptions of machine-id option"). Relates to #4689.
* Fix inconsistent descriptions of machine-id optionLibravatar Kelvin M. Klann2021-11-15
| | | | | | | | | | | | Some places say that it "preserves" the file and other places say that it "spoofs" the file. Based on the fs_machineid function on src/firejail/fs_etc.c, the latter one is correct. This amends commit d0cc960c9 ("spoof machine-id", 2016-12-05). Fixes #4689. Reported-by: @svc88
* deterministic-shutdown optionLibravatar smitsohu2021-10-28
|
* Fix typo of "parent"Libravatar Kelvin M. Klann2021-09-02
|
* Add --ids-* to zsh completionLibravatar rusty-snake2021-07-31
|
* allow/deny in zsh completionLibravatar rusty-snake2021-07-07
|
* deprecated --disable-whitelist at compile timeLibravatar netblue302021-07-03
|
* Merge pull request #4278 from kmk3/rename-noautopulseLibravatar Kelvin M. Klann2021-05-16
|\ | | | | rename noautopulse to keep-config-pulse
| * rename noautopulse to keep-config-pulseLibravatar Kelvin M. Klann2021-05-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * add the keep-config-pulse option * make noautopulse an alias for keep-config-pulse * deprecate the noautopulse option * misc: fix indentation of --keep-dev-shm on src/firejail/usage.c Even though noautopulse is not intended for hardening, it looks like it is, because it starts with "no", just like no3d, noroot, etc). In fact, it is the only "no" option that differs in such a way. And it has been accidentally misused as such before; see PR #4269 and commit e4beaeaa8 ("drop noautopulse from agetpkg"). So effectively rename it to keep-config-pulse in order to avoid confusion. This is similar to the keep-var-tmp and keep-dev-shm options, which are used to "leave a path alone", just like noautopulse. Note: The changes on this patch are based on the ones from commit 617ff40c9 ("add --noautopulse arg for complex pulse setups") / PR #1854. See #4269 for the discussion.
* | Add noinput to usage.c and _firejail.inLibravatar rusty-snake2021-05-16
|/
* Merge pull request #4038 from rusty-snake/zsh-comp-improvementsLibravatar netblue302021-03-05
|\ | | | | Zsh completion improvements
| * zsh-comp: better value completionLibravatar rusty-snake2021-03-03
| |
| * zsh-comp: make some options mutually exclusiveLibravatar rusty-snake2021-03-03
| |
| * zsh-comp: order and sortLibravatar rusty-snake2021-03-01
| |
| * zsh-comp: Use easiery syntaxLibravatar rusty-snake2021-03-01
| | | | | | | | | | | | | | | | | | | | I don't understand the current brace expansions, so let's use a easier one: --foo <> one-time; no argument *--foo <> multi-time; no argument --foo=- <> one-time; with argument (direct after the =) *--foo=- <> multi-time; with argument (direct after the =)
* | Merge pull request #4024 from kmk3/improve-makefilesLibravatar Reiner Herrmann2021-03-01
|\ \ | |/ |/| Makefile improvements
| * makefiles: make all, clean and distclean PHONYLibravatar Kelvin M. Klann2021-03-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid a stat() call for each affected target and also potentially speed up parallel builds. From the GNU make manual[1]: > Phony targets are also useful in conjunction with recursive > invocations of make (see Recursive Use of make). In this situation > the makefile will often contain a variable which lists a number of > sub-directories to be built. [...] > The implicit rule search (see Implicit Rules) is skipped for .PHONY > targets. This is why declaring a target as .PHONY is good for > performance, even if you are not worried about the actual file > existing. Commands used to search, replace and cleanup: $ find -type f -name '*Makefile.in' -exec sed -i.bak \ -e 's/^all:/.PHONY: all\nall:/' \ -e 's/^clean:/.PHONY: clean\nclean:/' \ -e 's/^distclean:/.PHONY: distclean\ndistclean:/' '{}' + $ find -type f -name '*Makefile.in.bak' -exec rm '{}' + [1]: https://www.gnu.org/software/make/manual/html_node/Phony-Targets.html
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-06-29 09:35:32 +0000