aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
* Merge branch 'master' into replace-iwrite-iwuserLibravatar netblue302021-10-09
|\
| * Merge branch 'master' into fix-include-limits-hLibravatar netblue302021-10-09
| |\
| | * Merge pull request #4579 from dm9pZCAq/masterLibravatar netblue302021-10-09
| | |\ | | | | | | | | fix compilation on musl (#4578)
| | | * fix compilation on musl (#4578)Libravatar dm9pZCAq2021-09-27
| | | |
| | * | Merge pull request #4593 from kmk3/revert-allow-deny-fbuilderLibravatar netblue302021-10-09
| | |\ \ | | | | | | | | | | Revert "allow/deny fbuilder"
| | | * | Revert "allow/deny fbuilder"Libravatar Kelvin M. Klann2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 4438f14f2892b5c88d158ae8fad0a80a2eebfd44. Also, partially revert related commit e4307b409 ("fix whitelist/allow in make test-utils") to keep the tests working. The profiles are being generated using aliases, which are not used on the profiles in the repository. So generate them using the normal commands for consistency. See also commit dd13595b8 ("Revert "allow/deny help and man pages"") / PR #4502. Relates to #4410. Misc: I noticed this on issue #4592.
| | | * | build_profile.c: fix typo of "begins"Libravatar Kelvin M. Klann2021-10-05
| | | | | | | | | | | | | | | | | | | | Added on commit 9af2c1472 ("Better debug handling.").
| | * | | Merge pull request #4587 from kmk3/fix-vscodiumLibravatar netblue302021-10-09
| | |\ \ \ | | | | | | | | | | | | Fix vscodium
| | | * | | Add codium.profile as a redirect to vscodium.profileLibravatar Kelvin M. Klann2021-10-04
| | | |/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both base names are valid: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Q vscodium-bin vscodium-bin 1.60.2-2 $ pacman -Qlq vscodium-bin | grep -v -e '/$' -e /resources/ | grep /bin/ /usr/bin/codium /usr/bin/vscodium /usr/share/vscodium-bin/bin/codium Note: The first two paths are symlinks to the third one. Fixes #3871.
| | * | | Merge pull request #4586 from smitsohu/traceLibravatar netblue302021-10-09
| | |\ \ \ | | | | | | | | | | | | trace, tracelog: don't truncate /etc/ld.so.preload in sandbox
| | | * | | trace, tracelog: don't truncate /etc/ld.so.preloadLibravatar smitsohu2021-10-05
| | | | | |
| | * | | | Merge pull request #4510 from rusty-snake/allow-tray-conditionLibravatar netblue302021-10-09
| | |\ \ \ \ | | | | | | | | | | | | | | Add new condition ALLOW_TRAY
| | | * | | | Add new condition ALLOW_TRAYLibravatar rusty-snake2021-09-04
| | | | | | |
| | * | | | | profile parsing fixesLibravatar smitsohu2021-10-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | results from a systematic search for strncmp calls with a suspicious (non-fitting) integer literal as third argument
| | * | | | | mountinfo: get mount id from failed call to name_to_handle_atLibravatar smitsohu2021-10-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enables recursive remounting on very old kernels, which has some relevance for SailfishOS community ports.
| | * | | | | simplify recursive remountingLibravatar smitsohu2021-10-05
| | | |_|/ / | | |/| | |
| * | | | | firejail.h: add missing linux/limits.h includeLibravatar Kelvin M. Klann2021-10-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | firejail.h uses PATH_MAX when defining a macro. Note that ARG_MAX and PATH_MAX are not guaranteed to be (and potentially should not be) defined. From POSIX.1-2017's limits.h(0p)[1]: > A definition of one of the symbolic constants in the following list > shall be omitted from the <limits.h> header on specific > implementations where the corresponding value is equal to or greater > than the stated minimum, but where the value can vary depending on the > file to which it is applied. The actual value supported for a > specific pathname shall be provided by the pathconf() function. Use linux/limits.h instead of limits.h because glibc's limits.h deliberately undefines ARG_MAX. See glibc commit f96853beaf ("* sysdeps/unix/sysv/linux/bits/local_lim.h: Undefined ARG_MAX if", 2008-03-27)[2]. From /usr/include/bits/local_lim.h (glibc 2.33-5 on Artix Linux): #ifndef ARG_MAX # define __undef_ARG_MAX #endif /* The kernel sources contain a file with all the needed information. */ #include <linux/limits.h> /* [...] */ /* Have to remove ARG_MAX? */ #ifdef __undef_ARG_MAX # undef ARG_MAX # undef __undef_ARG_MAX #endif So if a file uses ARG_MAX (currently only cmdline.c) and limits.h (or a firejail.h that includes limits.h) is included before linux/limits.h, then the build will fail on glibc. Build log from using limits.h (instead of linux/limits.h) on firejail.h: $ make clean >/dev/null && make >/dev/null cmdline.c:145:12: error: use of undeclared identifier 'ARG_MAX'; did you mean 'CFG_MAX'? if (len > ARG_MAX) { ^~~~~~~ CFG_MAX ./firejail.h:805:2: note: 'CFG_MAX' declared here CFG_MAX // this should always be the last entry ^ [...] Fixes #4578. [1] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/limits.h.html [2] https://sourceware.org/git/?p=glibc.git;a=commit;h=f96853beafc26d4f030961b0b67a79b5bfad5733
| * | | | | Remove unnecessary linux/limits.h includeLibravatar Kelvin M. Klann2021-09-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | None of the files affected use any macros from linux/limits.h: $ git grep -Fl 'NGROUPS_MAX ARG_MAX LINK_MAX MAX_CANON MAX_INPUT NAME_MAX PATH_MAX PIPE_BUF XATTR_NAME_MAX XATTR_SIZE_MAX XATTR_LIST_MAX RTSIG_MAX' -- src src/firejail/cmdline.c src/firejail/firejail.h src/libtrace/libtrace.c src/libtracelog/libtracelog.c Environment: $ grep '^NAME' /etc/os-release NAME="Artix Linux" $ pacman -Qo /usr/include/linux/limits.h /usr/include/linux/limits.h is owned by linux-api-headers 5.12.3-1 Note: This include has been present on all of the affected files since their inception. For restrict_users.c, that's on commit 4f003daec ("prevent leaking user information by modifying /home directory, /etc/passwd and /etc/group") and for every other file, it's on commit 137985136 ("Baseline firejail 0.9.28"). Relates to #4578.
| * | | | | main.c: remove unnecessary limits.h includeLibravatar Kelvin M. Klann2021-09-28
| | |_|_|/ | |/| | | | | | | | | | | | | Relates to #4578.
* | | | | s/S_IWRITE/S_IWUSR/Libravatar Kelvin M. Klann2021-10-02
| |/ / / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | They are equivalent, but only the latter is POSIX. See sys_stat.h(0p) of POSIX.1-2017[1]. From Section 14.9.5, The Mode Bits for Access Permission of the glibc manual[2]: > S_IWUSR > S_IWRITE > > Write permission bit for the owner of the file. Usually 0200. > S_IWRITE is an obsolete synonym provided for BSD compatibility. Current usage: $ git grep -F S_IWRITE -- src | wc -l 11 $ git grep -F S_IWUSR -- src | wc -l 26 Commands used to search and replace: $ git grep -l -z S_IWRITE -- src | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\`sed 's/S_IWRITE/S_IWUSR/g' '{}'\`\" >'{}'" Note: The other related non-POSIX macros are not used anywhere: $ git grep -F -e S_IREAD -e S_IEXEC -- src $ [1] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/sys_stat.h.html [2] https://www.gnu.org/software/libc/manual/html_node/Permission-Bits.html
* | | | Merge pull request #4585 from smitsohu/euidLibravatar smitsohu2021-10-02
|\ \ \ \ | |/ / / |/| | | add more EUID improvements
| * | | add more EUID improvementsLibravatar smitsohu2021-10-01
| | |/ | |/|
* / | trim excess whitespaceLibravatar a13460542021-09-25
|/ /
* | private-lib fixupLibravatar smitsohu2021-09-25
| | | | | | | | | | don't try to read /usr/bin/firejail if private-bin removed it from the sandbox filesystem
* | private-lib: check firejail libraries as root user (#4576)Libravatar smitsohu2021-09-25
| | | | | | | | | | | | users, and fldd in particular, might have no read permission on the firejail executable, make that ok by running fldd as root
* | Merge pull request #4564 from lecso7/masterLibravatar netblue302021-09-24
|\ \ | | | | | | Create goldendict.profile
| * | Create goldendict.profileLibravatar lecso72021-09-20
| |/
* | Merge pull request #4572 from a1346054/newline-fixLibravatar netblue302021-09-24
|\ \ | | | | | | Add missing final newlines
| * | add missing final newlines at end of filesLibravatar a13460542021-09-22
| | |
* | | Merge pull request #4560 from onny/nolinkcheckLibravatar netblue302021-09-24
|\ \ \ | | | | | | | | Remove /etc/hosts is_link check
| * | | remove hosts file link checkLibravatar Jonas Heinrich2021-09-19
| | | |
| * | | remove hosts file link checkLibravatar Jonas Heinrich2021-09-19
| | | |
* | | | fix spelling (#4573)Libravatar a13460542021-09-22
| | | |
* | | | join: add support for rlimit optionsLibravatar smitsohu2021-09-22
| | | |
* | | | hardcode PATH for internal useLibravatar smitsohu2021-09-22
| |/ / |/| |
* | | Merge pull request #4533 from smitsohu/exitcodeLibravatar smitsohu2021-09-22
|\ \ \ | | | | | | | | rework exitcodes
| * | | rework exitcodesLibravatar smitsohu2021-09-21
| | |/ | |/| | | | | | | | | | | | | | | | * add 128 to exitcode if child receives a fatal signal (this is similar to what bash and other shells do) * unify exitcodes across firejail: treat join'ed processes the same as processes in the primary process tree
* | | Fix typo of "parent"Libravatar Kelvin M. Klann2021-09-02
| | |
* | | Revert "allow/deny help and man pages"Libravatar Kelvin M. Klann2021-09-02
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit a11707ea273e5665047f8a7d9387ba07f08d72f6. The man pages currently direct users to use the aliases instead of the commands, which some users of firejail-git may end up doing. Example: https://github.com/netblue30/firejail/discussions/4496 So revert the man page changes as well to avoid confusion. Note: This is not a full revert. The commit in question also contains some string formatting fixes on src/firejail/usage.c (related to dbus and netmask), which are left intact. Relates to #4410.
* | Merge pull request #4486 from pirate486743186/yt-dlp-profileLibravatar netblue302021-08-30
|\ \ | | | | | | create yt-dlp.profile
| * | create yt-dlp.profileLibravatar pirate4867431862021-08-27
| | |
* | | Merge pull request #4484 from pirate486743186/gallery-dlLibravatar netblue302021-08-30
|\ \ \ | | | | | | | | creating gallery-dl.profile
| * | | creating gallery-dl.profileLibravatar pirate4867431862021-08-27
| |/ /
* / / Fix hanging arp_checkLibravatar minus2021-08-22
|/ / | | | | | | | | | | | | arp_check relied on select(2) decreasing the timeout. This doesn't seem to be the case on Linux anymore, thus arp_check tends to hang when the interface sees a lot of traffic. Calculating the timeout explicitly solves the problem.
* | Give fbuilder full original environmentLibravatar Topi Miettinen2021-08-16
| | | | | | | | Closes: #4460
* | Move disable-passwordmgr.inc into disable-common.inc/disable-programs.inc ↵Libravatar rusty-snake2021-08-12
| | | | | | | | follow up
* | fix man firejail-profileLibravatar rusty-snake2021-08-09
| | | | | | | | | | machine-id is not affected by --disable-network and matches in "User Environment" as well.
* | Respect quiet if no dbus-user (filter|none) is setLibravatar rusty-snake2021-08-05
| |
* | Add --ids-* to zsh completionLibravatar rusty-snake2021-07-31
| |
* | private-lib: fix double symlinkLibravatar netblue302021-07-30
| |
generated by cgit v1.2.3-70-g09d2 (git 2.46.0) at 2024-09-01 13:27:03 +0000