aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
* makefiles: stop failing when config.mk does not existLibravatar Kelvin M. Klann2022-06-30
| | | | | | | | | | | | | | | | | | | This allows running `make clean` and `make distclean` (and possibly others) without having to run ./configure beforehand. Note that some packaging-related targets still depend on the existence of generated files. For example: * dist: config.mk * deb: config.sh Commands used to search and replace: $ git grep -Elz 'include *([^ ]*/)?config.mk' | xargs -0 -I '{}' \ sh -c "printf '%s\n' \ \"\$(sed -E 's|^include *(([^ ]*/)?config.mk)|-include \1|' '{}')\" >'{}'" Relates to #5140.
* build: reduce autoconf input files from 32 to 2Libravatar Kelvin M. Klann2022-06-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Configure summary: autoconf essentially only parses configure.ac and generates the configure script (that is, the "./configure" shell script). The latter is what actually checks what is available on the system and internally sets the value of the output variables. It then, for every filename foo in AC_CONFIG_FILES (and for every output variable name BAR in AC_SUBST), reads foo.in, replaces every occurrence of `@BAR@` with the value of the shell variable `$BAR` and generates the file foo from the result. After this, configure is finished and `make` could be executed to start the build. Now that (as of #5140) all output variables are only defined on config.mk.in and on config.sh.in, there is no need to generate any makefile nor any other mkfile or shell script at configure time. So rename every "Makefile.in" to "Makefile", mkdeb.sh.in to mkdeb.sh, src/common.mk.in to src/common.mk and leave just config.mk and config.sh as the files to be generated at configure time. This allows editing and committing all makefiles directly, without potentially having to run ./configure in between. Commands used to rename the makefiles: $ git ls-files -z -- '*Makefile.in' | xargs -0 -I '{}' sh -c \ "git mv '{}' \"\$(dirname '{}')/Makefile\"" Additionally, from my (rudimentary) testing, this commit reduces the time it takes to run ./configure by about 20~25% compared to commit 72ece92ea ("Transmission fixes: drop private-lib (#5213)", 2022-06-22). Environment: dash 0.5.11.5-1, gcc 12.1.0-2, Artix Linux, ext4 on an HDD. Commands used for benchmarking each commit: $ : >time_configure && ./configure && make distclean && for i in $(seq 1 10); do { time -p ./configure; } 2>>time_configure; done $ grep real time_configure | awk '{ total += $2 } END { print total/NR }'
* deprecating --shell (3) (#5196)Libravatar netblue302022-06-21
|
* deprecating --shell (2) (#5196)Libravatar netblue302022-06-20
|
* compile fixLibravatar netblue302022-06-20
|
* deprecating --shell (#5196)Libravatar netblue302022-06-20
|
* shell none set as default (4)Libravatar netblue302022-06-19
|
* shell none set as default (3)Libravatar netblue302022-06-19
|
* shell none set as default (2)Libravatar netblue302022-06-19
|
* shell none set as defaultLibravatar netblue302022-06-19
|
* removing guess_shell() function and using instead the shell configured in ↵Libravatar netblue302022-06-19
| | | | the password database (/etc/passwd file)
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-06-18
|\
| * errno.c: fix reference to extract_errnos.sh in commentLibravatar Kelvin M. Klann2022-06-18
| | | | | | | | | | | | | | See src/tools/extract_errnos.sh. Added on commit 081d1fbf2 ("Add seccomp errno filter support", 2015-09-23) / PR #66.
* | seccomp-log support in firejail.configLibravatar netblue302022-06-18
|/
* remving src/fgitLibravatar netblue302022-06-17
|
* build: fix file mode of shell scripts (644 -> 755)Libravatar Kelvin M. Klann2022-06-16
| | | | | | | | | | | | | | | | | | | | | Some shell scripts are not executable, so fix their file modes: $ git grep -Elz '^#!/bin/(ba)?sh' | xargs -0 -I '{}' \ chmod +x '{}' Files changed: * src/fgit/fgit-uninstall.sh * src/tools/extract_errnos.sh Note: I have manually checked that the files above are indeed intended to be executable directly and not just sourced, as a script of the latter kind could also contain a shebang (for example, to help ensure proper syntax highlighting). Misc: The affected files were added on commit e46dd3e95 ("git-install", 2017-02-04) and on commit 081d1fbf2 ("Add seccomp errno filter support", 2015-09-23) / PR #66, respectively.
* more on removing cgroups (#5200)Libravatar netblue302022-06-16
|
* disable chroot by default in /etc/firejail/firejail.configLibravatar netblue302022-06-13
|
* more on disable cgroupsLibravatar netblue302022-06-13
|
* disable cgroup codeLibravatar netblue302022-06-13
|
* makefiles: include config.mk instead of common.mk where possibleLibravatar Kelvin M. Klann2022-06-12
| | | | | | | | | | | common.mk contains definitions for building programs and it includes config.mk. Some makefiles that include common.mk do not contain any targets for building programs. They depend only on configure-time variable definitions (which are defined on config.mk) rather than anything specific to common.mk. So change their includes of common.mk to config.mk.
* makefiles: deduplicate configure-time vars into new config.mk.inLibravatar Kelvin M. Klann2022-06-12
| | | | | | | | | | | Currently, the configure-time variables (that is, the ones that assign to placeholders, such as "@HAVE_MAN@", which are set/replaced at configure-time) are defined on multiple files (such as on Makefile.in and on common.mk.in). To avoid duplication, centralize these variables on a single file (config.mk.in) and replace all of the other definitions of them with an include of config.mk.
* makefiles: define root dir and include relative to itLibravatar Kelvin M. Klann2022-06-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A non-absolute path on an include command is always treated as being relative to the directory in which "make" was started in, rather than being relative to the makefile that contains the command. For example, given the following project structure and file contents: * Makefile: include src/foo.mk * src/foo.mk: include bar.mk * src/bar.mk: Running "make" on the root project directory (that is, where "Makefile" is) yields the following: src/foo.mk:1: bar.mk: No such file or directory As "bar.mk" in "include bar.mk" is relative to the current (process) directory (that is, "./bar.mk") and not to where foo.mk is located in ("./src/bar.mk"). So on every makefile that contains an include command, define the root project directory in the ROOT variable and always include relative to it, to later enable any included mkfiles to include other mkfiles without having to worry about the correct path. Commands used to search and replace: $ git grep -Flz 'include ../common.mk' -- src | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\`sed 's|include ../common.mk|ROOT = ../..\ninclude \$(ROOT)/src/common.mk|' '{}'\`\" >'{}'" Environment: GNU make 4.3-3.1 on Artix Linux
* common.mk.in: fix comment about file usage intentLibravatar Kelvin M. Klann2022-06-12
| | | | | | | | | | | | | | | | | | It currently claims to contain "common definitions for all makefiles", but it is not included by all makefiles under src/ and it contains variable definitions that may possibly clash with the ones defined on certain makefiles. Mainly, the following makefiles (which are used for building shared objects) use a different set of CFLAGS compared to src/common.mk.in: * src/libpostexecseccomp/Makefile.in * src/libtrace/Makefile.in * src/libtracelog/Makefile.in Given the contents of common.mk.in, it seems to be intended only for makefiles that build C programs and/or non-shared objects (which are most of, but not all of the makefiles under src/), so put that in the comment instead.
* fix typo in firejail-welcome.shLibravatar PizzaDude2022-06-10
|
* fix typoLibravatar Reiner Herrmann2022-06-09
|
* CVE-2022-31214: fixing the fix, one more timeLibravatar smitsohu2022-06-08
| | | | | | | | | the previous commit "CVE-2022-31214: fixing the fix" made private-etc=fonts,fonts and similar commands fail with an error fix that regression by tolerating already existing directories
* CVE-2022-31214: fixing the fixLibravatar smitsohu2022-06-08
|
* fixing CVE-2022-31214Libravatar smitsohu2022-06-08
|
* harden blacklistLibravatar smitsohu2022-06-03
|
* removed enforcement of nonewprivs for --noprofileLibravatar netblue302022-06-03
|
* --nettrace only available when running the sandbox as rootLibravatar netblue302022-06-03
|
* enforce nonewprivs for --noprofile optionLibravatar netblue302022-06-03
|
* fixesLibravatar netblue302022-06-02
|
* firemon reworkLibravatar netblue302022-06-02
|
* speed up firemonLibravatar netblue302022-06-02
|
* Removed IDS feature from the default build. To enable it, use --enable-ids ↵Libravatar netblue302022-05-25
| | | | at compile time.
* config guide (firecfg --guide) man pageLibravatar netblue302022-05-23
|
* netlock: restore environment for terminalLibravatar smitsohu2022-05-21
|
* --oomLibravatar netblue302022-05-20
|
* --oom (#5122)Libravatar netblue302022-05-20
|
* ci: fix --version not printing compile-time featuresLibravatar Kelvin M. Klann2022-05-16
| | | | | | | | | | | | | | Currently, when running on CI, `firejail --version` only prints the following line: firejail version 0.9.69 Add a new print_version() function that always prints both the above and the compile-time options (like it is done outside of CI) and call it in both of the places that handle --version on main.c. Misc: The printing of compile-time features was added on commit 48dd1fbec ("apparmor", 2016-08-02).
* fzenity: fix dead storeLibravatar Kelvin M. Klann2022-05-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As caught by the Clang Static Analyzer: $ make clean && NO_EXTRA_CFLAGS="yes" scan-build --status-bugs make -C src/fzenity [...] main.c:77:10: warning: Value stored to 'ptr' is never read [deadcode.DeadStores] return ptr++; ^~~~~ 1 warning generated. [...] scan-build: Analysis run complete. scan-build: 1 bug found. The above increment is a no-op, as it is equivalent to `return ptr; ptr++;`. For it to make any difference, the prefix increment operator would have to be used in place of the postfix one: return ++ptr; Which would be equivalent to `++ptr; return ptr;`. But in order to fix the warning (and CI) while avoiding to change the current behavior, just remove the operator instead. Added on commit 1cdfa6f95 ("more on firecfg --guide: fzenity", 2022-04-25).
* always log seccomp errors (#5110)Libravatar netblue302022-05-09
|
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-04-29
|\
| * hostnames.c: fix mismatched dealloc (fclose -> pclose)Libravatar Kelvin M. Klann2022-04-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Partial error log when building firejail-git (afee8603f) with --enable-fatal-warnings: hostnames.c: In function ‘retrieve_hostname’: hostnames.c:53:17: error: ‘fclose’ called on pointer returned from a mismatched allocation function [-Werror=mismatched-dealloc] 53 | fclose(fp); | ^~~~~~~~~~ hostnames.c:38:20: note: returned from ‘popen’ 38 | FILE *fp = popen(cmd, "r"); | ^~~~~~~~~~~~~~~ cc1: all warnings being treated as errors make[1]: *** [Makefile:7: hostnames.o] Error 1 Environment: gcc 11.2.0-4 on Artix Linux. Added on commit 500a56efd ("more on nettrace", 2022-01-07).
* | fix firemon, speed-upLibravatar netblue302022-04-29
| |
* | remove inode warning from fcopy - long list of warnings for ↵Libravatar netblue302022-04-29
|/ | | | /etc/alternatives on Debian
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302022-04-25
|\
| * Merge pull request #5114 from kmk3/stop-warn-group-cleanLibravatar netblue302022-04-25
| |\ | | | | | | Stop warning on safe supplementary group clean