aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
...
| | * build: remove MOD_SRCS variableLibravatar Kelvin M. Klann2023-06-24
| | | | | | | | | | | | | | | | | | | | | It is unused and is unlikely to be used. Added on commit f5b1ccaad ("makefiles: move extra deps into new MOD vars", 2022-05-07) / PR #5478.
* | | fbreader/FBReader profile fixes; more on static ip mapLibravatar netblue302023-06-27
|/ /
* | fix geoiplookup executable detection for --nettraceLibravatar netblue302023-06-25
| |
* | QUIC (HTTP/3) support in --nettraceLibravatar netblue2023-06-25
|/
* build: move MAKEFLAGS to config.mk.inLibravatar Kelvin M. Klann2023-06-24
| | | | | | | To reduce the amount of boilerplate in the makefiles. This amends commit 9789c263a ("build: disable all built-in implicit make rules", 2023-06-21) / PR #5864.
* Merge pull request #5865 from kmk3/profiles-add-vmplayerLibravatar Kelvin M. Klann2023-06-23
|\ | | | | profiles: vmware improvements and new redirect
| * profiles: vmware: disable on firecfgLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | It appears to be broken on Linux Mint 20.3 (based on Ubuntu 20.04), due to the "VMWare Kernel Module Updater" being unable to install kernel modules[1]. Relates to #3526. [1] https://github.com/netblue30/firejail/issues/5861#issuecomment-1598407890 Reported-by: @MikeNavy
| * profiles: add vmplayer.profileLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | As a redirect to vmware.profile. This is apparently the filename for the "VMWare Workstation Player" on Linux Mint 20.3 (based on Ubuntu 20.04)[1]. Relates to #3526. [1] https://github.com/netblue30/firejail/issues/5861#issuecomment-1598132860 Reported-by: @MikeNavy
* | build: disable all built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use `make -r` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~93.3% (~97.5% compared to a8f01a383) for the default build and by ~83.3% (~99.3% compared to a8f01a383) for the "man" target (as an example): $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (in the previous commit) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 170 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 7 Environment: GNU make 4.4.1-2 on Artix Linux. Note: According to make(1p) in POSIX.1-2017, "If .SUFFIXES does not have any prerequisites, the list of known suffixes shall be cleared.", while "The result of setting MAKEFLAGS in the Makefile is unspecified." Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed -E \ 's/^(.SUFFIXES:)/\1\nMAKEFLAGS += -r\n/' '{}')\" >'{}'"
* | build: disable most built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clear `.SUFFIXES:` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~62% for the default build and by ~96% for the "man" target (as an example): $ git checkout master >/dev/null 2>&1 $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 Environment: GNU make 4.4.1-2 on Artix Linux. Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed '1s/^/.SUFFIXES:\n/' '{}')\" >'{}'" See also commit f48886f25 ("build: mark most phony targets as such", 2023-02-01) / PR #5637.
* | build: standardize commands on top of makefilesLibravatar Kelvin M. Klann2023-06-21
|/ | | | To make the makefiles look more similar.
* Merge pull request #5856 from kmk3/standardize-name-checksLibravatar Kelvin M. Klann2023-06-19
|\ | | | | modif: Standardize and add missing name/hostname checks
| * docs: document NAME VALIDATION in firejail.txtLibravatar Kelvin M. Klann2023-06-13
| |
| * Add missing name/hostname checksLibravatar Kelvin M. Klann2023-06-13
| | | | | | | | | | | | | | Note that the sandbox name may also be set through the "join-or-start" option. Relates to #5578 #5708.
| * Standardize name/hostname checksLibravatar Kelvin M. Klann2023-06-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Use only `invalid_name` to check the name and hostname instead of ad-hoc checks * Standardize empty/invalid error messages for name/hostname Note: This makes the hostname validation less strict, though it still forbids control characters and only numbers. Relates to #5578 #5708. See also commit b4ffaa207 ("merges; more on cleaning up esc chars", 2023-02-14).
| * util.c: check first/last char and allow extra charsLibravatar Kelvin M. Klann2023-06-13
| | | | | | | | In `invalid_name`.
| * util.c: increase name max length from 64 to 253Libravatar Kelvin M. Klann2023-06-13
| | | | | | | | To match the hostname check in src/firejail/main.c.
| * main.c: remove redundant has_cntrl_chars checkLibravatar Kelvin M. Klann2023-06-13
| | | | | | | | | | | | | | The `invalid_name` function does not allow control characters. Added on commit d349a2ff8 ("Forbid control chars in names", 2023-03-03) / PR #5708.
* | cleanupLibravatar netblue2023-06-18
|/
* build: enable compiler warnings by defaultLibravatar Kelvin M. Klann2023-05-31
| | | | Enable -Wall by default and add -Wextra.
* build: organize warning flags in CFLAGSLibravatar Kelvin M. Klann2023-05-31
|
* Print version on startup for firejail/firecfgLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | | | It is not too uncommon for the firejail version to be missing when issues are reported; this commit makes it more likely that any posted logs will contain the program version. Do so just for firejail and firecfg for now because they are the most common user-facing programs. Print the version after argument parsing, in order to avoid printing the program version more than once and to avoid interfering with commands that generate machine-readable output (like `firejail --list` and `firecfg --list`). Also, only print it after all profiles have been loaded, because a profile may contain `quiet`. Note: This does not cover the case where the program exits before the end of argument/profile parsing (such as when an error occurs).
* Move usage text into usage_str varLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | For consistency and readability. Note: This also makes exactly one extra blank line be printed at the end of every usage text, which is currently only done in the following files: * src/fcopy/main.c * src/fnettrace-dns/main.c * src/fnettrace-icmp/main.c * src/fnettrace-sni/main.c * src/fnettrace/main.c * src/profstats/main.c
* Standardize usage string var declarationsLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | Changes: * Name them all "usage_str" * Make them const For the latter item, see commit eb20f52ef ("Make list of paths const to fix a false positive of gcc analyzer", 2022-07-27) / PR #5275.
* Standardize version outputLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | Changes: * Only print the version line in the print_version function * Add a print_version function where missing (put it in usage.c if the file exists) * Always a blank line after the version
* firejail: simplify print_compiletime_support functionLibravatar Kelvin M. Klann2023-05-14
| | | | Build the entire string at once and print it only once.
* firejail: deduplicate version printingLibravatar Kelvin M. Klann2023-05-14
| | | | | | | Split print_version into two functions: * print_version: only prints the version line * print_version_full: also prints compile-time support
* firejail: move print_version from checkcfg.c to usage.cLibravatar Kelvin M. Klann2023-05-14
|
* Remove dash before version on --help outputLibravatar Kelvin M. Klann2023-05-14
| | | | | | | | | | | | | | | | Currently, --version doesn't print a dash while --help does. Example: $ firejail --version | grep 'version 0' firejail version 0.9.73 $ firejail --help | grep 'version 0' firejail - version 0.9.73 For consistency, always print the version without a dash. Commands used to search and replace: $ git grep -IFlz ' - version' -- src | xargs -0 -I '{}' sh -c "printf '%s\n' \"\$(sed 's/ - version/ version/' '{}')\" >'{}'"
* jailcheck: fix wrong program name in --versionLibravatar Kelvin M. Klann2023-05-12
| | | | | Added on commit 42e2db127 ("jaitest - simple sandbox testing utility program", 2021-02-20).
* etc-cleanup: fix wrong header path in MakefileLibravatar Kelvin M. Klann2023-05-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is causing main.o to be built using an implicit rule (rather than the rule from src/prog.mk), which does not use PROG_CFLAGS. Example (using src/fldd as a working example for comparison): $ make -C src/etc-cleanup clean >/dev/null && make -C src/etc-cleanup | grep -Ev '(Entering|Leaving) directory' gcc -g -O2 -c -o main.o main.c gcc -pie -fPIE -Wl,-z,relro -Wl,-z,now -o etc-cleanup main.o $ make -C src/etc-cleanup clean >/dev/null && make -C src/etc-cleanup -r | grep -Ev '(Entering|Leaving) directory' make: *** No rule to make target 'main.o', needed by 'etc-cleanup'. Stop. $ make -C src/fldd clean >/dev/null && make -C src/fldd | grep -Ev '(Entering|Leaving) directory' gcc -ggdb -O2 -DVERSION='"0.9.73"' -fstack-protector-all [...] gcc -pie -fPIE -Wl,-z,relro -Wl,-z,now -o fldd main.o ../lib/common.o ../lib/ldd_utils.o $ make -C src/fldd clean >/dev/null && make -C src/fldd -r | grep -Ev '(Entering|Leaving) directory' gcc -ggdb -O2 -DVERSION='"0.9.73"' -fstack-protector-all [...] gcc -pie -fPIE -Wl,-z,relro -Wl,-z,now -o fldd main.o ../lib/common.o ../lib/ldd_utils.o Environment: GNU make 4.4.1-2 on Artix Linux. This amends commit e889db095 ("build fix", 2023-02-06). See also commit 02d37680c ("private-etc rework: file groups moved to src/include/etc_groups.h, new groups added", 2023-01-25). Relates to #5610.
* sbox: improve seccomp blacklistLibravatar smitsohu2023-05-09
|
* arp.c: ensure positive timeout on select(2)Libravatar Kelvin M. Klann2023-05-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Log from build_and_test[1]: TESTING: network scan (net_scan.exp) [...] firejail /bin/bash Child process initialized in 1704.83 ms spawn /bin/bash firejail --net=br0 --ip=10.10.20.60 runner@fv-az576-472:~/work/firejail/firejail/test/network$ <l/test/network$ firejail --net=br0 --ip=10.10.20.60 Reading profile /etc/firejail/default.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-programs.inc ** Note: you can use --noprofile to disable default.profile ** Error select: arp.c:202 arp_check: Invalid argument runner@fv-az576-472:~/work/firejail/firejail/test/network$ TESTING ERROR 4 This "Invalid argument" error does not always happen, so I assume that it may be due to a negative integer value in `ts` when calling select. Misc: Found in #5805. [1] https://github.com/netblue30/firejail/actions/runs/4806275219/jobs/8553597462
* New profile: url-eater (#5780)Libravatar glitsj162023-04-18
| | | | | * Create url-eater.profile * RELNOTES: add url-eater to 'new profiles'
* fix for old compilersLibravatar netblue302023-04-06
|
* Merge pull request #5710 from pirate486743186/mov-cliLibravatar netblue302023-03-23
|\ | | | | add mov-cli.profile
| * add mov-cliLibravatar pirate4867431862023-03-04
| |
* | Merge pull request #5737 from glitsj16/private-etc-bugfixLibravatar netblue302023-03-23
|\ \ | | | | | | fs_etc.c: conditionally create /etc/resolv.conf
| * | fs_etc.c: fix misleading indentationLibravatar glitsj162023-03-15
| | |
| * | fs_etc.c: conditionally create /etc/resolv.confLibravatar glitsj162023-03-15
| | |
* | | util.c: add and use ascii-only char functionsLibravatar Kelvin M. Klann2023-03-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The "invalid_name" function claims to "allow strict ASCII letters and numbers". However, it uses isalnum(3) and isdigit(3), which may take the current locale into account and thus return 1 for non-ASCII characters. So add the following functions: * ascii_isalnum * ascii_isalpha * ascii_isdigit * ascii_islower * ascii_isupper * ascii_isxdigit And use the applicable ones in "invalid_name" so that it actually uses strictly ASCII in its comparisons. Added on commit b4ffaa207 ("merges; more on cleaning up esc chars", 2023-02-14). Relates to #5578. Kind of relates to #5708.
* | | firejail.h: move invalid_name prototype to proper placeLibravatar Kelvin M. Klann2023-03-20
| | | | | | | | | | | | | | | | | | | | | Follow the same order as on util.c. Added on commit b4ffaa207 ("merges; more on cleaning up esc chars", 2023-02-14).
* | | Add profiles for jami and postman (#5691)Libravatar Kobaxidze2562023-03-15
|/ /
* | microsoft-edge fixes (#5697)Libravatar glitsj162023-03-14
| | | | | | | | | | | | | | | | | | | | | | | | | | * microsoft-edge*: fix spacing * Create microsoft-edge-stable.profile Relates to #5696. * firecfg.config: add support for microsoft-edge-stable redirect * disable-common.inc: blacklist msedge SUID executables * microsoft-edge: add private-opt and allow internal sandbox access
* | Add Discord PTB profileLibravatar Neotamandua2023-03-12
| |
* | firejail.txt: remove extraneous endifLibravatar Kelvin M. Klann2023-03-10
| | | | | | | | | | | | | | Added on commit b689b69f6 ("make --private-lib a compile time option, disabled by default", 2023-03-09). Relates to #5727.
* | allow symlinks for .asoundrc - part 2 (#5709)Libravatar netblue302023-03-09
| |
* | allow symlinks for .asoundrc (5709)Libravatar netblue302023-03-09
| |
* | private-lib cleanupLibravatar netblue302023-03-09
| |
* | make --private-lib a compile time option, disabled by defaultLibravatar netblue302023-03-09
| |
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-11 14:48:52 +0000