aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
* Add new cachy-browser profileLibravatar Vladislav Nepogodin2021-12-06
|
* Add a profile for FlatsealLibravatar Hugo Osvaldo Barrera2021-12-03
|
* profstats cleanupLibravatar glitsj162021-12-01
|
* Merge pull request #4725 from kmk3/fix-groups-misc2Libravatar netblue302021-11-30
|\ | | | | Keep some groups regardless of nogroups and restore nogroups on nvidia
| * Make nogroups work on nvidia againLibravatar Kelvin M. Klann2021-11-29
| | | | | | | | | | | | | | | | | | | | | | | | Remove workaround from commit 623e68216 ("temporary fix for nvidia/nogroups/noroot issue (#3644, #841)", 2020-10-02) and from commit cb460c32c ("more nvidia (#3644)", 2020-10-03). The handling of the "render" and "video" groups is separate from `nogroups` now, so disabling `nogroups` on nvidia shouldn't be necessary anymore. See the previous 2 commits for details. See also the discussion on PR #4632.
| * Keep render, lp, input and other groups regardless of nogroupsLibravatar Kelvin M. Klann2021-11-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Mappings of command -> group that this commit adds: * no3d -> render * noprinters -> lp * nodvd -> cdrom (Debian[1] and Gentoo[2]), optical (Arch[3]) * noinput -> input Mappings that were considered but that are not added: * notv -> ? (unknown group) * nou2f -> ? (devices are apparently owned by root; see #4603) Based on @rusty-snake's suggestion: https://github.com/netblue30/firejail/issues/4603#issuecomment-944046299 See the previous commit ("Keep audio and video groups regardless of nogroups") for details. Relates to #2042 and #4632. [1] https://wiki.debian.org/SystemGroups [2] https://api.gentoo.org/uid-gid.txt [3] https://wiki.archlinux.org/title/Users_and_groups
| * Keep audio and video groups regardless of nogroupsLibravatar Kelvin M. Klann2021-11-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, on systems that use seat managers that do not implement seat-based ACLs (such as seatd), sound is broken whenever `nogroups` is used. This happens because without ACLs, access to the audio devices in /dev is controlled by the standard group permissions and the "audio" group is always dropped when `nogroups` is used. This patch makes the "audio" and "video" groups be dropped if and only if `noaudio` and `novideo` are in effect, respectively (and independently of `nogroups`). See #4603 and the linked issues/discussions for details. Note: This is a continuation of commit ea564eb74 ("Consider nosound and novideo when keeping groups") / PR #4632. Relates to #2042 and #4531.
* | more profstatsLibravatar netblue302021-11-30
| |
* | install profstats in /etc/firejail directory - undocumented, used only for ↵Libravatar netblue302021-11-30
| | | | | | | | development
* | Merge pull request #4712 from kmk3/configure-improvements2Libravatar netblue302021-11-30
|\ \ | | | | | | Configure improvements2
| * | build: Normalize HAVE_SUIDLibravatar Kelvin M. Klann2021-11-25
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | See commit 15d793838 ("Try to fix #2310 -- Can't create run directory without suid-root", 2021-05-13) / PR #4273. It is the only "HAVE_" option whose value is set by if/else on a makefile. Also, it is set in different places to either "yes", "no", blank or "-DHAVE_SUID". Set the value only on configure.ac and only to either blank or to "-DHAVE_SUID". Misc: The `ifeq ($(HAVE_SUID),-DHAVE_SUID)` comparison that this adds is based on the existing `ifeq ($(HAVE_APPARMOR),-DHAVE_APPARMOR)` comparison on Makefile.in.
* | fix: allow tilde (home directory) in --netfilter file nameLibravatar netblue302021-11-29
| |
* | disable shell tab completion for --whitelist and --private commandsLibravatar netblue302021-11-29
|/
* Merge pull request #4632 from kmk3/consider-nosound-novideo-groupsLibravatar smitsohu2021-11-20
|\ | | | | Consider nosound and novideo when keeping groups & misc refactors
| * Consider nosound and novideo when keeping groupsLibravatar Kelvin M. Klann2021-10-22
| | | | | | | | | | | | | | | | | | | | Even when `nogroups` is not used, avoid keeping the audio and video groups when `nosound` and `novideo` are used, respectively. Based on @rusty-snake's suggestion: https://github.com/netblue30/firejail/issues/4603#issuecomment-944046299 Relates to #4603.
| * util.c: check array size on copy_group_ifcontLibravatar Kelvin M. Klann2021-10-22
| | | | | | | | Check if new_groups already is full before trying to add to it.
| * util.c: [ref] move group find/copy into new functionsLibravatar Kelvin M. Klann2021-10-22
| | | | | | | | | | | | | | | | | | | | | | | | | | Move the logic from clean_supplementary_groups into the following new functions: * find_group * copy_group_ifcont These will be reused later. Misc: The latter function's signature is based on getgrouplist(2), which is used on clean_supplementary_groups.
| * main.c: [ref] fix indentation and whitespace around group handlingLibravatar Kelvin M. Klann2021-10-22
| |
* | build: Stop linking pthread (#4695)Libravatar Kelvin M. Klann2021-11-17
| | | | | | | | | | | | | | | | | | | | | | | | | | Added on commit 137985136 ("Baseline firejail 0.9.28", 2015-08-08). See also commit ad6bb83fa ("consolidate makefiles", 2018-03-31). It is not used anywhere. And it looks like it has never been used anywhere: $ git log --oneline -Gpthread.h 137985136..master $ Issue mentioned by @rusty-snake: https://github.com/netblue30/firejail/issues/4642#issuecomment-955795463
* | zsh-comp: update description of machine-id to match --helpLibravatar Kelvin M. Klann2021-11-15
| | | | | | | | | | | | | | This amends commit b5de1d0f9 ("Fix inconsistent descriptions of machine-id option"). Relates to #4689.
* | Fix inconsistent descriptions of machine-id optionLibravatar Kelvin M. Klann2021-11-15
| | | | | | | | | | | | | | | | | | | | | | | | Some places say that it "preserves" the file and other places say that it "spoofs" the file. Based on the fs_machineid function on src/firejail/fs_etc.c, the latter one is correct. This amends commit d0cc960c9 ("spoof machine-id", 2016-12-05). Fixes #4689. Reported-by: @svc88
* | --ids-check/--ids-init documentationLibravatar netblue302021-11-13
| |
* | Merge pull request #4635 from smitsohu/noorphansLibravatar netblue302021-11-13
|\ \ | | | | | | deterministic-shutdown option
| * | deterministic-shutdown optionLibravatar smitsohu2021-10-28
| | |
* | | Merge pull request #4681 from jmetrius/openstego-profileLibravatar netblue302021-11-13
|\ \ \ | | | | | | | | Add OpenStego profile
| * | | Add OpenStego profileLibravatar Jan Sonntag2021-11-12
| | | |
* | | | telnet and ftpLibravatar netblue302021-11-12
|/ / /
* | | Merge pull request #4676 from hlein/firejail_envchecksLibravatar netblue302021-11-11
|\ \ \ | | | | | | | | Make env/arg sanity check failure messages more useful
| * | | Make env/arg sanity check failure messages more usefulLibravatar Hank Leininger2021-11-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This change doesn't alter any checks, but it gives more specific errors when a sanity check of env vars or argv does not pass, which can point to limits to raise or at least give us better detailed bug reports. Signed-off-by: Hank Leininger <hlein@korelogic.com> Bug: https://github.com/netblue30/firejail/issues/3678 Bug: https://github.com/netblue30/firejail/issues/3851 Bug: https://github.com/netblue30/firejail/issues/4633
* | | | Merge pull request #4652 from kmk3/fix-toctou-easyLibravatar netblue302021-11-11
|\ \ \ \ | | | | | | | | | | Fix TOCTOU/CodeQL CWE-367 warnings (easy ones + fs.c)
| * | | | fs.c: Fix TOCTOU/CodeQL CWE-367 warningLibravatar Kelvin M. Klann2021-10-30
| | | | | | | | | | | | | | | | | | | | Relates to #4503.
| * | | | Fix TOCTOU/CodeQL CWE-367 warnings (easy ones)Libravatar Kelvin M. Klann2021-10-30
| | |/ / | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This should fix all such warnings on the following files: * src/fids/main.c * src/firejail/seccomp.c Misc: Besides the above reason, these are some of the more straightforward TOCTOU warning fixes and they are done without any additional refactor commits, so that's the reason for "easy ones". List of TOCTOU warnings: https://github.com/netblue30/firejail/security/code-scanning?query=id%3Acpp%2Ftoctou-race-condition See https://cwe.mitre.org/data/definitions/367.html Relates to #4503.
* | | | Relocate firecfg.config to /etc/firejail/Libravatar Hank Leininger2021-11-05
| |/ / |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This should make it easier for users, and distributions, to customize which programs they want firejail to wrap. Also fixed some firecfg.cfg -> firecfg.config references. Signed-off-by: Hank Leininger <hlein@korelogic.com> Closes: https://github.com/netblue30/firejail/issues/408 Bug: https://github.com/netblue30/firejail/issues/2097 Bug: https://github.com/netblue30/firejail/issues/2829 Bug: https://github.com/netblue30/firejail/issues/3665
* | | improve detection of firejail login shellLibravatar smitsohu2021-11-01
| | |
* | | Merge pull request #4643 from rusty-snake/profile-checksLibravatar Kelvin M. Klann2021-10-29
|\ \ \ | | | | | | | | Profile Checks
| * | | Sort src/firecfg/firecfg.configLibravatar rusty-snake2021-10-27
| |/ /
* | | private-bin fixup (#4646)Libravatar smitsohu2021-10-28
| | | | | | | | | | | | | | | cannot create fslogger file as user, so raise privs and create it as root
* | | more cleanupLibravatar smitsohu2021-10-28
|/ / | | | | | | | | possible because selinux_relabel_path now raises privs itself where necessary
* | cleanupLibravatar smitsohu2021-10-22
| |
* | private-bin: switch effective uidLibravatar smitsohu2021-10-22
| |
* | private-bin: fix #4626, refactor symlink detectionLibravatar smitsohu2021-10-22
|/
* Merge pull request #4600 from crocket/masterLibravatar netblue302021-10-21
|\ | | | | Add profiles for imv, retroarch, and torbrowser
| * Add profiles for imv, retroarch, and torbrowserLibravatar crocket2021-10-17
| | | | | | | | | | imv, retroarch, and torbrowser are also added to firecfg.config
* | small fixLibravatar netblue302021-10-20
| |
* | --noprinter optionLibravatar netblue302021-10-20
| |
* | mountinfo: improve readabilityLibravatar smitsohu2021-10-18
| | | | | | | | | | | | | | | | | | | | | | | | Removes the inconsistency that some blacklisted paths could be remounted (files specified explicitly) and some could not. Now all blacklisted paths can be mounted nosuid, nodev, noexec if users specify this. Also fixes the bug that mount id can indeed be 0. Other than that no functional or algorithmic changes, only readability improvements.
* | readabilityLibravatar smitsohu2021-10-18
| |
* | cleanupLibravatar smitsohu2021-10-18
| |
* | man pagesLibravatar smitsohu2021-10-18
| |
* | Merge pull request #4610 from kmk3/fix-misc-get-group-idLibravatar smitsohu2021-10-17
|\ \ | | | | | | Fix misc in get_group_id
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-19 18:47:33 +0000