aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
* Merge pull request #5578 from layderv/masterLibravatar netblue302023-01-30
|\ | | | | modif: Prevent sandbox name from containing only digits
| * Prevent sandbox name from containing only digitsLibravatar layderv2023-01-24
| | | | | | | | | | Names should not contain only numbers, as they are used in other commands as PIDs.
* | private-etc: moved group names to @group syntax; GUI group renamed as @x11 ↵Libravatar netblue302023-01-30
| | | | | | | | group; added nvidia and X11 directories to @x11 group.
* | private-etc: corss-distro test for curl, gimp, inkscape, firefox, warzone2100Libravatar netblue302023-01-28
| |
* | private-etc: fixesLibravatar netblue302023-01-25
| |
* | private-etc: fix man pageLibravatar netblue302023-01-25
| |
* | private-etc rework: new man pageLibravatar netblue302023-01-25
| |
* | private-etc rework: file groups moved to src/include/etc_groups.h, new ↵Libravatar netblue302023-01-25
| | | | | | | | groups added
* | private-etc rework: /etc file groupsLibravatar netblue302023-01-22
| |
* | compile fixLibravatar netblue302023-01-20
| |
* | private-etc rework: remove hiding blacklisted files in private-etc directory ↵Libravatar netblue302023-01-20
| | | | | | | | feature
* | Merge pull request #5600 from kmk3/fix-stop-ddash-shLibravatar netblue302023-01-19
|\ \ | | | | | | modif: Stop forwarding own double-dash to the shell
| * | Stop forwarding own double-dash to the shellLibravatar Kelvin M. Klann2023-01-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, if double-dash ("--") is passed to firejail, it is forwarded to the user shell: $ firejail --debug --noprofile -- echo test 2>&1 | grep -e execvp -e test Building quoted command line: 'echo' 'test' Building quoted command line: 'echo' 'test' Running 'echo' 'test' command through /bin/bash execvp argument 0: /bin/bash execvp argument 1: -c execvp argument 2: -- execvp argument 3: 'echo' 'test' test This causes issues when the user shell does not accept "--" / is not POSIX-compatible: $ /bin/bash -c -- 'echo test' test $ /bin/fish -c -- 'echo test' fish: Unknown command: -- fish: -- ^ Fixes #5599. Relates to #3434. Reported-by: @iltep64 Reported-by: @ferreum
* | | cleanupLibravatar netblue302023-01-19
| | |
* | | mergesLibravatar netblue302023-01-18
|/ /
* | Reword CFG_ETC_HIDE_BLACKLISTED explanationLibravatar Kelvin M. Klann2023-01-16
| | | | | | | | | | | | | | To make it clearer. Added on commit ded50200e ("opt-in: skip blacklisted files in private-etc - #5010, #5230", 2023-01-15) / PR #5591.
* | Rename etc-no-blacklisted to etc-hide-blacklistedLibravatar Kelvin M. Klann2023-01-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To avoid boolean confusion (`no-foo no` / `no-foo yes`) in firejail.config: etc-no-blacklisted no etc-no-blacklisted yes Commands used to search and replace: git grep -Ilz -i 'etc.no.blacklisted' -- etc src | xargs -0 -I '{}' sh -c "printf '%s\n' \"\$(sed \ -e 's/etc-no-blacklisted/etc-hide-blacklisted/' \ -e 's/ETC_NO_BLACKLISTED/ETC_HIDE_BLACKLISTED/' \ '{}')\" >'{}'" Added on commit ded50200e ("opt-in: skip blacklisted files in private-etc - #5010, #5230", 2023-01-15) / PR #5591.
* | Merge pull request #5591 from smitsohu/private-etc-no-blacklistedLibravatar netblue302023-01-15
|\ \ | | | | | | opt-in: hide blacklisted files in /etc
| * | opt-in: skip blacklisted files in private-etc - #5010, #5230Libravatar smitsohu2023-01-15
| |/
* | Merge pull request #5563 from glitsj16/linuxqqLibravatar netblue302023-01-15
|\ \ | | | | | | New profiles: linuxqq/qq
| * | Merge branch 'netblue30:master' into linuxqqLibravatar glitsj162023-01-04
| |\|
| * | firecfg: add linuxqq/qqLibravatar glitsj162023-01-03
| | |
* | | fix restrict-namespaces for Debian 10 and olderLibravatar netblue302023-01-14
| | |
* | | bringing back whitelisting /devLibravatar netblue302023-01-14
| | |
* | | Remove --profile-path from --helprusty-snake-patch-1Libravatar rusty-snake2023-01-13
| | | | | | | | | Fixes #5585
* | | rel 0.9.72 testing: disable whitelisting /dev directoryLibravatar netblue302023-01-12
| | |
* | | rel 0.9.72 testingLibravatar netblue302023-01-12
| |/ |/|
* | Merge pull request #5475 from KOLANICH-tools/aa_fixLibravatar netblue302023-01-04
|\ \ | | | | | | A temporary fix to the bug caused by apparmor profiles stacking.
| * | A temporary fix to the bug caused by apparmor profiles stacking.Libravatar KOLANICH2022-11-15
| | |
* | | Merge pull request #5556 from Dpeta/chatterino-profileLibravatar netblue302023-01-04
|\ \ \ | |_|/ |/| | Add profile for Chatterino
| * | Add Chatterino profileLibravatar Dpeta2022-12-25
| | |
* | | restrict-namespaces statsLibravatar netblue302022-12-26
|/ /
* | chroot: make search permission check explicitLibravatar smitsohu2022-12-24
| |
* | add netlock support in profile filesLibravatar netblue302022-12-21
| |
* | Add profile for avidemux3_jobs_qt5Libravatar Hartmut Knaack2022-12-13
| | | | | | | | | | | | | | | | Add a profile for the Qt5 GUI to process Avidemux jobs. Use a redirection to the avidemux3_qt5 profile to reuse translation files. The application needs to create a network socket on localhost and fails to run with protocol unix, so that entry in the default avidemux profile needs to be extended.
* | Add profile for avidemux3_cliLibravatar Hartmut Knaack2022-12-12
| | | | | | | | | | Add a profile for the command-line interface of Avidemux, which redirects to the existing avidemux profile.
* | small nettrace fixesLibravatar netblue302022-12-09
| |
* | Merge pull request #5504 from kmk3/build-cflags-improvementsLibravatar Kelvin M. Klann2022-12-09
|\ \ | | | | | | build: actually set LDFLAGS/LIBS & stop overriding CFLAGS/LDFLAGS
| * | makefiles: stop overriding CFLAGS/LDFLAGSLibravatar Kelvin M. Klann2022-12-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | From the manual of GNU Automake (version 1.16.5)[1] [2]: > 3.6 Variables reserved for the user > > Some `Makefile` variables are reserved by the GNU Coding Standards for > the use of the "user"—the person building the package. For instance, > `CFLAGS` is one such variable. > > Sometimes package developers are tempted to set user variables such > as `CFLAGS` because it appears to make their job easier. However, the > package itself should never set a user variable, particularly not to > include switches that are required for proper compilation of the > package. Since these variables are documented as being for the > package builder, that person rightfully expects to be able to override > any of these variables at build time. > > To get around this problem, Automake introduces an > automake-specific shadow variable for each user flag variable. > (Shadow variables are not introduced for variables like `CC`, where > they would make no sense.) The shadow variable is named by prepending > `AM_` to the user variable's name. For instance, the shadow variable > for `YFLAGS` is `AM_YFLAGS`. The package maintainer—that is, the > author(s) of the `Makefile.am` and `configure.ac` files—may adjust > these shadow variables however necessary. > > Note Flag Variables Ordering::, for more discussion about these > variables and how they interact with per-target variables. See also the description of CFLAGS in the GNU Autoconf manual[3]. Note: We do not use automake (save for aclocal) nor generally follow the GNU Coding Standards, but the concept still applies. Also, the closest analogous in the project to the `AM_` prefix would currently likely be `EXTRA_`. [1] https://www.gnu.org/software/automake/manual/1.16.5/html_node/User-Variables.html [2] https://www.gnu.org/software/automake/manual/1.16.5/html_node/Flag-Variables-Ordering.html [3] https://www.gnu.org/software/autoconf/manual/autoconf-2.69/html_node/Preset-Output-Variables.html
* | | New profile: tesseract (#5516)Libravatar glitsj162022-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add firecfg support for tesseract * Add tesseract to 'New profiles' section in README.md * Create tesseract.profile * tesseract: fix private-etc * tesseract: fix XDG black/whitelisting * tesseract: use 'seccomp socket' instead of 'protocol unix' As kindly suggested by @rusty-snake. * tesseract: add 'restrict-namespaces' As kindly suggested by @rusty-snake. * tesseract: use full seccomp filtering The tesseract application works fine without 'protocol' or 'seccomp socket'.
* | | sandbox.c: print the dir on failed chdir(cfg.homedir)Libravatar Kelvin M. Klann2022-12-09
|/ / | | | | | | | | | | | | | | Just like the other nearby error messages for `chdir`. Relates to #5510. Suggested-by: @gitsteff
* | makefiles: organize CFLAGSLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | Line-wrap them and make the order of the flags more similar across src/prog.mk and src/so.mk. This should make it easier to see the differences in CFLAGS between both files.
* | makefiles: mention variables intended to be used by includersLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | On src/prog.mk and src/so.mk.
* | makefiles: add TOCLEAN and TODISTCLEAN variablesLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | | | | | | | So that includers of src/prog.mk or src/so.mk can just define anything extra that needs to be cleaned without having to override the "clean" target (or having to declare a "distclean" target). Example usage: TOCLEAN += foo TODISTCLEAN += bar
* | makefiles: rename common.mk to prog.mkLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | | | | | | | | | For clarity, as it is included by the Makefiles that create programs and non-shared-objects, but not by the ones that create shared objects (see src/so.mk). Commands used to move and search and replace: $ git mv src/common.mk src/prog.mk $ git grep -IFlz 'common.mk' -- src | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed 's/common.mk/prog.mk/' '{}')\" >'{}'"
* | makefiles: deduplicate lib makefiles into so.mkLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The following makefiles are nearly identical, except for the main target name and for any extra headers that they might use: * src/libpostexecseccomp/Makefile * src/libtrace/Makefile * src/libtracelog/Makefile So move all of their (duplicated) code into a new src/so.mk file, and add an include of src/so.mk, which leaves only variables, and the includes of config.mk and src/so.mk in place. With this commit, CFLAGS and LDFLAGS are only defined/changed in the following files: * config.mk.in * src/common.mk * src/so.mk
* | makefiles: deduplicate main target name into new SO varLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | | | Put the main target name into a new SO variable, put SO into a new TARGET variable, make "all" depend on `$(TARGET)` and replace every other occurrence of the main target name with `$(SO)`. On the makefiles that build shared objects, to make them more similar. With this commit, all of their targets are identical.
* | makefiles: deduplicate many makefiles into common.mkLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | | | | | The makefiles that both build C programs and include src/common.mk are nearly identical, save for the main target name and for any extra headers and objects that they might use. So move all of their (duplicated) code into src/common.mk, which (other than the "lib" target on src/lib/Makefile) leaves only variables and the includes of config.mk and src/common.mk in place.
* | makefiles: deduplicate main target name into new PROG varLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | | | | | | | | | | | Put the main target name into a new PROG variable, put PROG into a new TARGET variable, make "all" depend on `$(TARGET)` and replace every other occurrence of the main target name with `$(PROG)`. On the makefiles that build non-shared objects, to make them more similar. With this commit, all of their targets are identical (except for the extra "lib" target on src/lib/Makefile).
* | makefiles: line-wrap MOD_HDRS and MOD_OBJSLibravatar Kelvin M. Klann2022-11-21
| | | | | | | | | | For increased readability, list one item per line on lines that are currently longer than 80 characters.
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-12 03:22:15 +0000