aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
...
* fix typo in firejail-profile.txtLibravatar glitsj162020-04-07
|
* Deprecate --nodbus optionLibravatar Kristóf Marussy2020-04-07
|
* Turn DBus profile errors into warningsLibravatar Kristóf Marussy2020-04-06
| | | | | | This patch also allows setting the DBus policies to filter even if xdg-dbus-proxy is not installed. In that case, unrestricted access to the bus is allowed, but a warning is emitted.
* xdg-dbus-proxy socket finding and mount hardeningLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | | | | | | | | | | To avoid race conditions, the proxy sockets from /run/firejail/dbus/ are bind-mounted to /run/firejail/mnt/dbus/, which is controlled by root. Instead of relying on the default locations of the DBus sockets, the environment variables DBUS_SESSION_BUS_ADDRESS and DBUS_SYSTEM_BUS_ADDRESS are set accordingly. User sockets are tried in the following order when starting the proxy: * DBUS_SESSION_BUS_ADDRES * /run/user/<pid>/bus * /run/user/<pid>/dbus/user_bus_socket These are all blocked (including DBUS_SESSION_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active. System sockets are tried in the following order: * DBUS_SYSTEM_BUS_ADDRESS * /run/dbus/system_bus_socket These are all blocked (including DBUS_SYSTEM_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active.
* xdg-dbus-proxy hardeningLibravatar Kristóf Marussy2020-04-06
|
* Add documentation for DBus filteringLibravatar Kristóf Marussy2020-04-06
|
* Add dbus filter optionsLibravatar Kristóf Marussy2020-04-06
| | | | | | The options --dbus-user.talk, --dbus-user.own, --dbus-system.talk, and --dbus-system.own control which names can be accessed and owned on the user and system buses.
* Add xdg-dbus-proxy supportLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | * The proxy is forked off outside the sandbox namespace to protect the fds of the original buses from the sandboxed process. * The /run/firejail/dbus directory (with the sticky bit set) holds the proxy sockets. The sockets are <parent pid>-user and <parent pid>-system for the user and system buses, respectively. Each socket is owned by the sandbox user. * The sockets are bind-mounted over their expected locations and the /run/firejail/dbus directory is subsequently hidden from the sandbox. * Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets are cleaned up. * Filter rules will be added in a future commit.
* Add sbox_exec_v and SBOX_KEEP_FDSLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | To contain processes forked for long time, such as the xdg-dbus-proxy, sbox_exec_v can be used, which is the non-forking version of sbox_run_v. Additionally, the SBOX_KEEPS_FDS flag avoid closing any open fds, so fds needed by the subordinate process can be left open before calling sbox_exec_v. This flag does not makes sense for sbox_run_v, and causes an assertion failure.
* Add --dbus-user and --dbus-system optionsLibravatar Kristóf Marussy2020-04-06
| | | | | | Allow setting a separate policy for the user and system buses. For now, the filter policy is equivalent to the none (block) policy. Future commits will add more configuration options and filters.
* Allow changing error action in seccomp filtersLibravatar Topi Miettinen2020-04-06
| | | | | | | | | | | | | | Let user specify the action when seccomp filters trigger: - errno name like EPERM (default) or ENOSYS: return errno and let the process continue. - 'kill': kill the process as previous versions The default action is EPERM, but killing can still be specified with syscall:kill syntax or globally with seccomp-error-action=kill. The action can be also overridden /etc/firejail/firejail.config file. Not killing the process weakens Firejail slightly when trying to contain intrusion, but it may also allow tighter filters if the only alternative is to allow a system call.
* cleanup, fixes, more profstatsLibravatar netblue302020-04-06
|
* Fix `man` break - remove less from firecfg by defaultLibravatar Fred Barclay2020-04-05
| | | | | | | | | | | | | | If `less` is sandboxed, then we get a similar message to below when calling `man <anything>` Error clone: main.c:2743 main: Operation not permitted man: command exited with status 1: sed -e '/^[[:space:]]*$/{ N; /^[[:space:]]*\n[[:space:]]*$/D; }' | LESS=-ix8RmPm Manual page grep(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$PM Manual page grep(1) ?ltline %lt?L/%L.:byte %bB?s/%s..?e (END):?pB %pB\%.. (press h for help or q to quit)$-R MAN_PN=grep(1) less See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=899143 https://github.com/netblue30/firejail/issues/1856 Noticed on Debian 10, firejail 0.9.63
* Merge pull request #3319 from topimiettinen/sanity-check-for-args-envsLibravatar netblue302020-04-05
|\ | | | | Simple sanity checks for arguments and environment
| * Simple sanity checks for arguments and environmentLibravatar Topi Miettinen2020-04-05
| | | | | | | | | | Restrict number of program arguments and their length as well as number of environment variables and their length.
* | compile cleanupLibravatar netblue302020-04-05
| |
* | fixing my previous commitLibravatar netblue302020-04-05
|/
* profile fixesLibravatar netblue302020-04-04
|
* gnome games: more + fixesLibravatar rusty-snake2020-04-04
| | | | | | | - fix description - add gnome-klotski, five-or-more, swell-foop [skip ci]
* more gamesLibravatar rusty-snake2020-04-04
| | | | | | | | | | | | | | | | | - blobwars - gravity-beams-and-evaporating-stars - hyperrogue - jumpnbump-menu (alias) - jumpnbump - magicor - mindless - mirrormagic - mrrescue - scorched3d-wrapper (alias) - scorchwentbonkers - seahorse-adventures - wordwarvi - xbill
* misc fixes & hardeningLibravatar rusty-snake2020-04-03
|
* seccomp/join fixLibravatar netblue302020-04-03
|
* Merge branch 'master' of https://github.com/netblue30/firejailLibravatar netblue302020-04-02
|\
| * Merge pull request #3310 from Liorst4/ac-preserve-cflagsLibravatar netblue302020-04-02
| |\ | | | | | | Preserve CFLAGS given to configure in common.mk.in
| | * Preserve CFLAGS given to configure in common.mk.inLibravatar Lior Stern2020-03-31
| | |
* | | fixed firecfg man page, update READMELibravatar netblue302020-04-02
|/ /
* | whitelist globing man pageLibravatar netblue302020-04-01
| |
* | globbing support for whitelistsLibravatar netblue302020-04-01
| |
* | profstatsLibravatar netblue302020-04-01
| |
* | Mention --seccomp.32 etc in usageLibravatar Topi Miettinen2020-03-31
| |
* | extra x11 hardeningLibravatar smitsohu2020-03-31
|/
* abiword and more gnome-gamesLibravatar rusty-snake2020-03-29
| | | | | | | | | | | - four-in-a-row - gnome-mahjongg - gnome-robots - gnome-sudoku - gnome-taquin - gnome-tetravex harden gnome-chess
* Merge pull request #3296 from 0x7969/masterLibravatar rusty-snake2020-03-29
|\ | | | | Create ferdi.profile
| * Added ferdi to firecfg.configLibravatar 0x79692020-03-29
| |
* | seccomp: allow defining separate filters for 32-bit archLibravatar Topi Miettinen2020-03-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | System calls (names and numbers) are not exactly the same for 32 bit and 64 bit architectures. Let's allow defining separate filters for 32-bit arch using seccomp.32, seccomp.32.drop, seccomp.32.keep. This is useful for mixed 64/32 bit application environments like Steam and Wine. Implement protocol and mdwx filtering also for 32 bit arch. It's still better to block secondary archs completely if not needed. Lists of supported system calls are also updated. Warn if preload libraries would be needed due to trace, tracelog or postexecseccomp (seccomp.drop=execve etc), because a 32-bit dynamic linker does not understand the 64 bit preload libraries. Closes #3267. Signed-off-by: Topi Miettinen <toiwoton@gmail.com>
* | fsec-print: print address of BPF_JA jump in hexLibravatar Topi Miettinen2020-03-26
|/ | | | | Since target addresses for other (conditional) jumps are in hex, it's very confusing to have one jump address in decimal.
* Add a profile for X2GoClientLibravatar Tad2020-03-23
|
* penguin-commadLibravatar netblue302020-03-23
|
* kmplayer etcLibravatar netblue302020-03-22
|
* fix profstats to print warning for nonexistent include filesLibravatar netblue302020-03-22
|
* new profiles: agenda, gnome-pomodoro, gnome-todoLibravatar rusty-snake2020-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | rules for xdg-dbus-proxy: dbus-user filter dbus-user.own org.gnome.Pomodoro dbus-user.talk ca.desrt.dconf dbus-user.talk org.gnome.Shell dbus-system none dbus-user filter dbus-user.own org.gnome.Todo dbus-user.talk ca.desrt.dconf dbus-user.talk org.gnome.evolution.dataserver.AddressBook9 dbus-user.talk org.gnome.evolution.dataserver.Calendar8 dbus-user.talk org.gnome.evolution.dataserver.Sources5 dbus-user.talk org.gnome.evolution.dataserver.Subprocess.Backend.* dbus-user.talk org.gnome.OnlineAccounts dbus-user.talk org.gnome.SettingsDaemon.Color dbus-system filter dbus-system.talk org.freedesktop.login1 dbus-user filter dbus.own com.github.dahenson.agenda dbus.talk ca.desrt.dconf dbus-system block
* iagno profileLibravatar netblue302020-03-21
|
* Merge pull request #3275 from ↵Libravatar smitsohu2020-03-19
|\ | | | | | | | | dmfreemon/add-name-or-private-dir-to-xpra-window-title add name or private directory being used to the window title when xpra is being used
| * handle malloc() failures; use gnu_basename() instead of basenaem()Libravatar dmfreemon@users.noreply.github.com2020-03-15
| |
| * add name or basename of private directory being used to the window title ↵Libravatar dmfreemon@users.noreply.github.com2020-03-10
| | | | | | | | when xpra is being used
* | new profiles: ripperx, sound-juicerLibravatar netblue302020-03-19
| |
* | profile statsLibravatar netblue302020-03-19
| |
* | nslookup, host profilesLibravatar netblue302020-03-18
| |
* | remount fix - #3280Libravatar smitsohu2020-03-16
| |
* | Merge pull request #3278 from rusty-snake/has-nosound-conditionLibravatar smitsohu2020-03-15
|\ \ | | | | | | new condition: HAS_NOSOUND
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-30 18:45:28 +0000