aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
...
* | firecfg: Only use fix_desktop_files automatically when run through sudo (#3382)Libravatar backspac2020-06-04
| | | | | | | | | | * firecfg: Only use fix_desktop_files when --fix is specified * firecfg: Only use fix_desktop_files automatically when run through sudo
* | Merge pull request #3406 from kris7t/dbus-proxyLibravatar Kristóf Marussy2020-06-01
|\ \ | | | | | | DBus filtering enhancements
| * | Turn attempted DBus policy downgrade into warning (fixes #3408)Libravatar Kristóf Marussy2020-05-09
| | |
| * | Documentation for new DBus optionsLibravatar Kristóf Marussy2020-05-07
| | |
| * | Update D-Bus auditLibravatar Kristóf Marussy2020-05-07
| | | | | | | | | | | | | | | | | | | | | | | | D-Bus audit is now more in line with D-Bus filtering settings: * Checks both the DBUS_SESSION_BUS_ADDRESS and DBUS_SYSTEM_BUS_ADDRESS environment variables. * Also checks common paths for fallback sockets in /run. * Will report GOOD when D-Bus filtering is enabled.
| * | Add options for D-Bus loggingLibravatar Kristóf Marussy2020-05-07
| | | | | | | | | | | | | | | | | | | | | --dbus-user.log and --dbus-system.log instruct xdg-dbus-proxy to log interactions with the session and system buses, respectively. --dbus-log= can specify the location of the log file. If no location is specified, log output is written to stdout.
| * | Add dbus-*.call and dbus-*.broadcast commandsLibravatar Kristóf Marussy2020-05-07
| | | | | | | | | | | | | | | This allows setting per-member and per-object path policies for xdg-dbus-proxy.
| * | Add --dbus-*.see optionsLibravatar Kristóf Marussy2020-05-07
| | | | | | | | | | | | | | | | | | | | | The SEE policy of xdg-dbus-proxy allows clients to see objects and bus names, but not interact with them. The --call and --broadcast can allow interactions with objects that have the SEE policy set. Profile support for these proxy options will be added in a future commit.
* | | new profile: mocp (#3437)Libravatar glitsj162020-05-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Create mocp.profile * add mocp support to disable-programs.inc * add mocp support in firecfg.config * update RELNOTES for mocp * fix configuration access for mocp Thanks to @rusty-snake for spotting this.
* | | Add Ubuntu specific name for dinoLibravatar Karoshi422020-05-22
| | | | | | | | | Ubuntu packages dino as dino-im
* | | fix firejail-in-firejail testLibravatar netblue302020-05-18
| | |
* | | add new profile: plv (#3410)Libravatar glitsj162020-05-11
|/ / | | | | | | | | | | | | | | | | | | | | Also fixed a typo for new profiles: nicontine --> nicotine * add plv to firecfg * add plv to disable-programs.inc * Create plv.profile * Update plv.profile
* | Disable browser drm by default.Libravatar Lior Stern2020-05-01
| | | | | | | | Done to match whats stated in etc/firejail/firejail.config
* | Print status of SELinux support with --versionLibravatar Topi Miettinen2020-04-29
| |
* | Increase MAX_ENVS to 256 (#3386)Libravatar Topi Miettinen2020-04-26
| | | | | | | | | | | | Some applications like Byobu, tmux and screen like to use environment and then 100 environment variables may be too few. Closes: #3350
* | Add steam-runtime aliasLibravatar backspac2020-04-24
| |
* | fix gcc10 static analysis warningLibravatar Reiner Herrmann2020-04-22
| |
* | fix gcc10 static analysis warningLibravatar Reiner Herrmann2020-04-22
| |
* | selinux relabeling, little thingsLibravatar smitsohu2020-04-22
| |
* | Merge pull request #3359 from abranson/armLibravatar netblue302020-04-21
|\ \ | | | | | | 32bit ARM syscall table
| * | Add 32bit ARM syscallsLibravatar Andrew Branson2020-04-15
| | |
* | | update --buildLibravatar rusty-snake2020-04-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The profile generated by --build are quite outdated. There are still a lot of things left to do. - fix #2150 (whitelist-common.inc is still opened from /etc/firejail) - include wusc and wvc (todo: remove whitelists in wusc/wvc from the generated profile.) - fix parsing wc / use ${HOME} macro instead of ~ - update profile headers - include all disable includes (mustly commented) in the output - reorder the filesystem section
* | | small fixesLibravatar netblue302020-04-21
| | |
* | | resolve conflict between private and allusers options - #3185Libravatar smitsohu2020-04-21
| | |
* | | relaxing symlink restrictionsLibravatar smitsohu2020-04-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | More liberal use of an already existing fall back path in pulseaudio.c removes issues caused by symlinks in ~/.config/pulse (issue #3351 and some others) Don't die, but print warnings during /home directory masking, so that users with a symbolic link in their home directory path can at least make it to a shell prompt (only in combination with pulseaudio fix).
* | | private-home: create directories as the userLibravatar smitsohu2020-04-20
| | |
* | | debug seccomp as the userLibravatar smitsohu2020-04-20
| | |
* | | sbox: blacklist umount syscallLibravatar smitsohu2020-04-20
| | |
* | | cleanupLibravatar smitsohu2020-04-20
| | |
* | | Profile for jitsi-meet-desktop (#3362)Libravatar Kishore96in2020-04-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Profile for Jitsi Meet desktop app (electron) * Update description. * Correctly include global definitions. * Add jitsi-meet-desktop to firecfg. * blacklist Jitsi-meet config directory in disable-programs.inc * Disable more things. disable-exec.inc not included, as the application shows some error if I include it. * Disable more stuff. * No need to whitelist Downloads directory. I don't think this application has any file sharing / downloading feature. * Use private-bin I needed to allow the bash executable as well for this to work. * Add some whitelist rules. * Use private-cache option * include disable-exec.inc Apparently one needs to allow execution in /tmp for the program to work. * Redirect to electron.profile. * Use private-etc. * Do not whitelist Downloads directory. electron.profile does this, but I do not think this program needs it. * Rearrange whitelisted files to alphabetical order. * Move nonwhitelist to appropriate section. * Newlines as section separators.
* | | Merge pull request #3348 from chrpinedo/profile-nicotineLibravatar rusty-snake2020-04-17
|\ \ \ | |/ / |/| | Add new profile: nicotine
| * | Add nicotine to firecfg.configLibravatar Christian Pinedo2020-04-17
| | |
* | | add sthortwave (#1139) and remove gjs from firecf…Libravatar rusty-snake2020-04-13
| | | | | | | | | | | | …g.config (#3333).
* | | suport mkdir and mkfile for /run/user/<PID> directory (#3346)Libravatar netblue302020-04-13
|/ /
* | Clarify that file globbing occurs only at startLibravatar Antonio Russo2020-04-11
| | | | | | | | | | | | firejail can blacklist (and now also whitelist) files based on glob pattern. This pattern is evaluated at firejail start, and not updated at run time. This patch documents this behavior.
* | Fix (fatal-warnings) warning by adding bracesLibravatar Topi Miettinen2020-04-11
| |
* | Fix build with --enable-fatal-warningsLibravatar Topi Miettinen2020-04-10
| | | | | | | | Delete two unused variables.
* | fix example in firejail-profile.txtLibravatar glitsj162020-04-08
| |
* | add example for overriding individiual DBus filter to firejail-profile.txtLibravatar glitsj162020-04-08
| | | | | | See discussion in https://github.com/netblue30/firejail/pull/3326.
* | fix typos in dbus-{system,user}.talk [usage.c]Libravatar glitsj162020-04-07
| |
* | fix typo in firejail-profile.txtLibravatar glitsj162020-04-07
| |
* | Deprecate --nodbus optionLibravatar Kristóf Marussy2020-04-07
| |
* | Turn DBus profile errors into warningsLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | This patch also allows setting the DBus policies to filter even if xdg-dbus-proxy is not installed. In that case, unrestricted access to the bus is allowed, but a warning is emitted.
* | xdg-dbus-proxy socket finding and mount hardeningLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid race conditions, the proxy sockets from /run/firejail/dbus/ are bind-mounted to /run/firejail/mnt/dbus/, which is controlled by root. Instead of relying on the default locations of the DBus sockets, the environment variables DBUS_SESSION_BUS_ADDRESS and DBUS_SYSTEM_BUS_ADDRESS are set accordingly. User sockets are tried in the following order when starting the proxy: * DBUS_SESSION_BUS_ADDRES * /run/user/<pid>/bus * /run/user/<pid>/dbus/user_bus_socket These are all blocked (including DBUS_SESSION_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active. System sockets are tried in the following order: * DBUS_SYSTEM_BUS_ADDRESS * /run/dbus/system_bus_socket These are all blocked (including DBUS_SYSTEM_BUS_ADDRESS if it points at a socket in the filesystem) when the filtering or blocking policy is active.
* | xdg-dbus-proxy hardeningLibravatar Kristóf Marussy2020-04-06
| |
* | Add documentation for DBus filteringLibravatar Kristóf Marussy2020-04-06
| |
* | Add dbus filter optionsLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | The options --dbus-user.talk, --dbus-user.own, --dbus-system.talk, and --dbus-system.own control which names can be accessed and owned on the user and system buses.
* | Add xdg-dbus-proxy supportLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | | | | | | | | | | | | | | * The proxy is forked off outside the sandbox namespace to protect the fds of the original buses from the sandboxed process. * The /run/firejail/dbus directory (with the sticky bit set) holds the proxy sockets. The sockets are <parent pid>-user and <parent pid>-system for the user and system buses, respectively. Each socket is owned by the sandbox user. * The sockets are bind-mounted over their expected locations and the /run/firejail/dbus directory is subsequently hidden from the sandbox. * Upon sandbox exit, the xdg-dbus-proxy instance is terminated and the sockets are cleaned up. * Filter rules will be added in a future commit.
* | Add sbox_exec_v and SBOX_KEEP_FDSLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | | | | | | | To contain processes forked for long time, such as the xdg-dbus-proxy, sbox_exec_v can be used, which is the non-forking version of sbox_run_v. Additionally, the SBOX_KEEPS_FDS flag avoid closing any open fds, so fds needed by the subordinate process can be left open before calling sbox_exec_v. This flag does not makes sense for sbox_run_v, and causes an assertion failure.
* | Add --dbus-user and --dbus-system optionsLibravatar Kristóf Marussy2020-04-06
| | | | | | | | | | | | Allow setting a separate policy for the user and system buses. For now, the filter policy is equivalent to the none (block) policy. Future commits will add more configuration options and filters.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-05 09:10:58 +0000