firejail - Mirror of https://github.com/netblue30/firejail

	Commit message (Collapse)	Author	Age
*	Merge pull request #3278 from rusty-snake/has-nosound-condition	smitsohu	2020-03-15
\|\ \| \| \| \|	new condition: HAS_NOSOUND
\| *	new condition: HAS_NOSOUND	rusty-snake	2020-03-15
\| \|
* \|	add gnome-screenshot.profile	rusty-snake	2020-03-15
\|/ \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	patch for xdg-dbus-proxy ``` --- a/etc/gnome-screenshot.profile +++ b/etc/gnome-screenshot.profile @@ -45,3 +45,8 @@ private-bin gnome-screenshot private-dev private-etc dconf,fonts,gtk-3.0,localtime,machine-id private-tmp + +dbus-user filter +dbus-user.own org.gnome.Screenshot +dbus-user.talk org.gnome.Shell.Screenshot +dbus-system block ``` patch for whitelist-runuser-common.inc ``` --- a/etc/gnome-screenshot.profile +++ b/etc/gnome-screenshot.profile @@ -17,11 +17,8 @@ include disable-passwdmgr.inc include disable-programs.inc include disable-xdg.inc -whitelist ${RUNUSER}/bus -whitelist ${RUNUSER}/pulse -whitelist ${RUNUSER}/gdm/Xauthority -whitelist ${RUNUSER}/wayland-0 include whitelist-usr-share-common.inc +include whitelist-runuser-common.inc include whitelist-var-common.inc apparmor ```
*	improve the previous fix: don't remount FUSE without permission	smitsohu	2020-03-14
\| \| \| \|	previous commit 3d35c039074cc11fbacf8de5bc8cb1a0952ceae4 issue #3277
*	tentative: don't remount FUSE without permission	smitsohu	2020-03-14
\| \| \|	issue #3277
*	Merge pull request #3268 from smitsohu/remount	startx2017	2020-03-13
\|\ \| \| \| \|	remount hardening: move to file descriptor based mounts
\| *	fail if opening the resolved path fails	smitsohu	2020-03-06
\| \|
\| *	remount hardening: move to file descriptor based mounts	smitsohu	2020-03-06
\| \|
* \|	integrate AppArmor with join options (#3242)	smitsohu	2020-03-02
\| \| \| \| \| \| \| \| \| \|	add AppArmor confinement to processes started with --join and, more importantly, --join-or-start
* \|	add xournal.profile	Hans-Christoph Steiner	2020-02-27
\| \|
* \|	minor sbox hardening	smitsohu	2020-02-26
\| \| \| \| \| \| \| \|	blacklist process_vm_readv and process_vm_writev while we're at it also remove duplicate iopl blacklisting
* \|	private-dev: bringing back stdin, stdout, stderr, fd symbolic links	smitsohu	2020-02-24
\|/
*	Remove redundant permission check from dhcp_start	Kristóf Marussy	2020-02-23
\| \| \| \|	The check is already performed by sbox_run
*	Harden sbox_run by using fexecve instead of execvp	Kristóf Marussy	2020-02-23
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	We require the command passed to sbox_run to be an absolute path, and avoid resolving PATH. Note that PATH-based attacks were already difficult to pull of, because sbox_run clears the environment before executing the command. This patch hopefully makes then impossible. As an additional precaution, we check that the executable is owned by either the root user or the root group, and is not world-writable. The use of O_PATH, fstat and fexecve aims to prevent a race condition when the invoked path (e.g., /usr/lib/firejail/fnet) is owned by root or is a symlink to a binary owned by root, but the containing directory (e.g., /usr/lib/firejail) is somehow owned by a user. This is quite unlikely (but may be possible by abusing some other setuid executable is a specific way), and would allow swapping the binary or symlink to a malicious one after we checked ownership. "Locking in" the file descriptor gets rid of the race condition. We have to get rid of the `/proc/[pid]/comm` check in dhcp_read_pidfile, because fexecve sets the comm value to the fd being exec'd (e.g., 3) instead of the name of the file. This is not a problem, unless by the time we pick up the pidfile of dhclient, it has already crashed, and the pid number have wrapper around. Needless to say, this is extremely unlikely (and does not cause a security issue, anyways).
*	Harden dhcp by checking for /sbin/dhclient	Kristóf Marussy	2020-02-23
\| \| \| \| \| \| \|	Running /sbin/dhclient or /usr/sbin/dhclient avoids PATH-based vulnerabilities. We also check that the dhclient is owned by root. We take an approach similar to netfiler.c and assume that the required binary ar in /sbin or /usr/sbin, or (like on Arch) /sbin is a symlink to /usr/bin.
*	misc things	rusty-snake	2020-02-22
\| \| \| \| \| \|	- spelling suggestion from @glitsj16 on fda62527 - drop python2 from openshot it never has a python2 version - #3126 note in manpage: cannot combine --private with --private=
*	Add profile for offical Linux Teams application (#3152)	Andreas Hunkeler	2020-02-22
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* Add profile for offical Linux Teams application * fix: add mkdir suggestions in Teams profile * Merge suggestions for Teams profile * Add suggestion to Teams profile * Add Teams to firecfg.config * Add paths from Teams profile to disable-programs * Remove the duplicated whitelist for downloads in Teams profile Co-Authored-By: rusty-snake <print_hello_world+GitHub@protonmail.com> * Cleanup teams profile after testing * Add comment to Teams profile Co-authored-by: rusty-snake <print_hello_world+GitHub@protonmail.com>
*	Add support for SELinux labeling	Topi Miettinen	2020-02-22
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Running `firejail --noprofile --private-bin=bash,ls ls -1Za /usr/bin` shows that the SELinux labels are not correct: ``` user_u:object_r:user_tmpfs_t:s0 . system_u:object_r:usr_t:s0 .. user_u:object_r:user_tmpfs_t:s0 bash user_u:object_r:user_tmpfs_t:s0 ls ``` After fixing this: ``` system_u:object_r:bin_t:s0 . system_u:object_r:usr_t:s0 .. system_u:object_r:shell_exec_t:s0 bash system_u:object_r:bin_t:s0 ls ``` Most copied files and created directories should now have correct labels (bind mounted objects keep their labels). This is useful to avoid having to change the SELinux rules when using Firejail.
*	add tool to dump seccomp filters	smitsohu	2020-02-17
\|
*	Add a lot of profiles	rusty-snake	2020-02-10
\|
*	openSUSE fix: search login.defs in /usr/etc, too	smitsohu	2020-02-09
\| \| \| \|	see issue #3145
*	openSUSE fix: mount private-etc on /usr/etc as well	smitsohu	2020-02-09
\| \| \| \|	see issue #3145
*	Add gnome-hexgl.profile	rusty-snake	2020-02-03
\|
*	resolve cppcheck memleak warning	smitsohu	2020-02-02
\|
*	housekeeping: strip unneeded whitespace	Fred Barclay	2020-02-01
\|
*	Merge pull request #3156 from smitsohu/filename	smitsohu	2020-02-01
\|\ \| \| \| \|	print rejected character in invalid filenames
\| *	remove parentheses from set of rejected characters	smitsohu	2020-01-28
\| \| \| \| \| \|	issue #3001
\| *	replace control characters and print rejected filenames	smitsohu	2020-01-22
\| \|
\| *	reject control characters in file names	smitsohu	2020-01-17
\| \|
\| *	print rejected character in invalid filenames	smitsohu	2020-01-17
\| \|
* \|	Add a profile alias for multimc5	Tad	2020-01-30
\| \|
* \|	Add profiles for the WPS-Office	rusty-snake	2020-01-29
\| \|
* \|	Add profiles for common (la)tex commands and a latex editor (#3159)	Florian Begusch	2020-01-29
\| \|
* \|	Do not declare variable in for loop	Kristóf Marussy	2020-01-27
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	Caused build failure in Travis (due to lack of C99 mode): sbox.c: In function ‘sbox_run_v’: sbox.c:185:3: error: ‘for’ loop initial declarations are only allowed in C99 mode for (int i = 3; i < max; i++) ^ sbox.c:185:3: note: use option -std=c99 or -std=gnu99 to compile your code
* \|	Documentation for DHCP support	Kristóf Marussy	2020-01-27
\| \|
* \|	Fix unsigned comparison error (#3174)	Kristóf Marussy	2020-01-27
\| \|
* \|	Fix indentation for dhcp client code	Kristóf Marussy	2020-01-27
\| \|
* \|	fix read-only=/	smitsohu	2020-01-26
\| \|
* \|	new profile: gnome-passwordsafe	rusty-snake	2020-01-25
\| \|
* \|	move copyright to 2020 (part 2) (#3181)	glitsj16	2020-01-24
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	* move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020 * move copyright statement to 2020
* \|	Improve --version command example	glitsj16	2020-01-20
\| \| \| \| \| \|	Fixes #3135.
* \|	Update copyright to 2020 in fs_bin.c	glitsj16	2020-01-19
\| \|
* \|	fix typo in fs_bin.c	glitsj16	2020-01-19
\| \|
* \|	add tvbrowser.profile	rusty-snake	2020-01-18
\| \| \| \| \| \| \| \|	Thanks @Micha-Btz for all the testing.
* \|	join: wait with effective uid of the user	smitsohu	2020-01-17
\| \| \| \| \| \| \| \|	issue #3130
* \|	fix join timeout if sleep interval is not a multiple	smitsohu	2020-01-17
\| \|
* \|	Update RELNOTES, README.md\|Add firefox-x11.profile	rusty-snake	2020-01-13
\| \|
* \|	update i2prouter profile, and remove from firecfg (#3123)	corecontingency	2020-01-13
\| \|
* \|	Merge pull request #3102 from kris7t/dhcp-client	netblue30	2020-01-07
\|\ \ \| \|/ \|/\|	DHCP client support
\| *	Wait for link-local address for DHCPv6	Kristóf Marussy	2020-01-01
\| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \| \|	dhclient -6 fails if the interface to be configures has no link-local address. This is especially problematic when only DHCPv6 is used (e.g., --ip=none --ip6=dhcp), because the wait for a DHCPv4 lease is usually ample time for the LL address to become available on the IPv6 link. The LL address must not be tenative. Therefore, this patch implements waiting for a non-tentative link-local address in fnet for DHCPv6 configured interfaces. The command fnet waitll <if> waits for an LL address on the interface <if>. Currently, the maximum waiting time is 30 seconds, and the kernel is polled through rtnetlink every 500 milliseconds. These values seem sufficient for virtual bridged networks, e.g., libvirt NAT networks.