| Commit message (Collapse) | Author | Age |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
It has been reported in #6372 that after upgrading the nvidia
proprietary driver from version 550.78 to 550.90.07, programs using
hardware acceleration fail unless paths in `/sys/module/nvidia*` are
accessible. Example:
$ firejail --noprofile prime-run /bin/glxdemo
[...]
X Error of failed request: BadValue (integer parameter out of range for operation)
Major opcode of failed request: 150 (GLX)
Minor opcode of failed request: 3 (X_GLXCreateContext)
Value in failed request: 0x0
Serial number of failed request: 22
Current serial number in output stream: 23
[...]
Meanwhile, the AMD proprietary driver (AMDGPU Pro) seems to depend on
`/sys/module/amdgpu` for OpenCL (though it is unclear how to detect that
driver). See commit 95c8e284d ("Allow accessing /sys/module directory",
2018-05-08) and commit 9dd581d25 ("Allow AMD GPU usage by Blender",
2018-05-08) from PR #1932.
So whitelist `/sys/module/nvidia*` by default if the nvidia proprietary
driver is detected and `no3d` is not used.
Note: The driver check is copied from src/firejail/util.c (see #841).
To keep the current behavior (that is, block all modules), add
`blacklist /sys/module` to globals.local.
Fixes #6372.
Reported-by: @GreatBigWhiteWorld
Reported-by: @orzogc
Reported-by: @krop
Reported-by: @michelesr
Suggested-by: @glitsj16
Tested-by: @flyxyz123
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Apparently hashcat needs access to this device for hardware acceleration
on AMD gpus and `private-dev` currently breaks that (see #6364).
It seems to be used by the "amdgpu" and "amdkfd" Linux kernel drivers
and as with /dev/dri/renderD128, this file is owned by the "render"
group.
Relevant udev rules from /usr/lib/udev/rules.d/50-udev-default.rules:
SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="0666"
SUBSYSTEM=="kfd", GROUP="render", MODE="0666"
SUBSYSTEM=="accel", GROUP="render", MODE="0666"
Environment: udev 255.6-1 on Artix Linux.
Reported-by: @schrotthaufen
|
|
|
| |
Fixes #6358.
|
|
|
|
|
|
|
|
| |
Description: Standalone Discord client.
https://armcord.app/
https://github.com/NextWork123/ArmCord
Requested in https://github.com/netblue30/firejail/issues/1139#issuecomment-2140174880.
|
|
|
| |
Signed-off-by: Ilya Pankratov <i.pankratov.main@gmail.com>
|
|
|
|
|
| |
Fix memory and descriptor leaks.
Signed-off-by: Ilya Pankratov <i.pankratov.main@gmail.com>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Tools:
* gzip
* install
* rm
* strip
* tar
For the programs not checked in configure.ac:
From the manual of GNU Autoconf (version 2.71):
> If you use `AC_PROG_INSTALL`, you must include `install-sh` in your
> distribution
So set `install` just in the Makefile. Use `$(RM)` to ensure that `-f`
is always used and to make it easier to spot when `-r` is used.
See commit 93d623fdf ("build: allow overriding certain tools",
2024-02-23) / PR #6222.
|
|
|
|
|
|
|
|
|
| |
Just in case the value is not defined in config.mk and `make` is first
executed from another directory (such as in src/man) instead of the root
directory.
This amends commit 93d623fdf ("build: allow overriding certain tools",
2024-02-23) / PR #6222.
|
|
|
|
|
|
| |
Description: Tauri-based IRC client inspired by HexChat.
https://nhexirc.com/
https://github.com/nhexirc/nhex
|
|
|
|
|
|
|
| |
This amends commit bf5a99360 ("landlock: add support for PATH macro",
2023-12-22).
Relates to #6078.
|
|
|
|
|
|
|
|
|
|
|
| |
Description: D-Bus debugger for GNOME
https://gitlab.gnome.org/GNOME/d-spy
From [1]:
> D-Feet is no longer maintained. Please use d-spy
[1] https://wiki.gnome.org/Apps/DFeet
|
|
|
|
| |
Signed-off-by: Tavi <tavi@divested.dev>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
landlock.h may not be available on the system (such as with older
versions of Linux API headers), so only try to include it if
`HAVE_LANDLOCK` is defined.
This fixes the following error from `build_debian_package` (which uses
`debian:buster`) on GitLab CI[1]:
$ ./mkdeb.sh --enable-fatal-warnings
[...]
gcc [...] -c ../../src/firejail/landlock.c -o ../../src/firejail/landlock.o
../../src/firejail/landlock.c:22:10: fatal error: linux/landlock.h: No such file or directory
#include <linux/landlock.h>
^~~~~~~~~~~~~~~~~~
compilation terminated.
This amends commit a05ae97af ("landlock: amend empty functions and
comments", 2024-04-08) / PR #6305.
Relates to #6078.
[1] https://gitlab.com/Firejail/firejail_ci/-/jobs/6743161059
|
| |
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
There are reports of firejail sandboxed applications occasionally
taking a long time (12 seconds) to start up. When this happens, it
affects all sandboxed applications until the device is rebooted.
The reason for the slowdown seems to be a timing hazard in the way
remounts under /run/firejail are handled. This gets triggered when
multiple firejail processes are launched in parallel as part of user
session bring up and results in some, dozens, hundreds, or even
thousands of stray /run/firejail/xxx mounts. The amount of mount
points then affects every mount operation that is done during sandbox
filesystem construction.
To stop this from happening, arrange it so that only one firejail
process at time is inspecting and/or modifying mountpoints under
/run/firejail by doing:
1. Create /run/firejail directory (without locking)
2. Create and obtain a lock for /run/firejail/firejail-run.lock
3. Setup files, directories and mounts under /run/firejail
4. Release /run/firejail/firejail-run.lock
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Changes:
* Centralize flock handling in preproc.c
* Add debug and error logging
* Abort if anything fails
Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
|
| |
| |
| |
| | |
To enable using them outside of src/firejail/main.c.
|
| | |
|
|/ |
|
|
|
| |
https://github.com/axel-download-accelerator/axel
|
|\
| |
| | |
docs: warn about limitations of landlock
|
| |
| |
| |
| |
| |
| | |
And mark it as experimental.
Relates to #6078.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Changes:
* Always declare public landlock functions, regardless of
`HAVE_LANDLOCK`
* Make the other public landlock functions (besides `ll_add_profile`)
also be empty when `HAVE_LANDLOCK` is not defined
* Clarify related comments
This amends commit 8259f66e1 ("landlock fix for old kernel versions",
2024-04-06).
For clarity, landlock-common.inc is included by default.profile and the
issue that the aforementioned commit fixes is that if profile.c is built
without the part that parses landlock commands (that is, when
`HAVE_LANDLOCK` is not defined), using default.profile would cause
firejail to abort due to "invalid lines".
Note that the issue would only occur when firejail is built with an
older kernel (or with --disable-landlock), not when simply running on an
older kernel.
See also commit b02a7a337 ("landlock: remove empty functions",
2023-12-07).
Relates to #6078.
|
|/ |
|
|
|
|
|
| |
Description: GitHub's official command-line tool.
https://github.com/cli/cli
|
|
|
|
|
| |
Description: QEMU frontend without libvirt.
https://github.com/thanoulis/tqemu
|
|
|
|
|
|
| |
Description: Python GTK3 application to view and clean metadata in
files, using mat2.
https://gitlab.com/rmnvgr/metadata-cleaner
|
|
|
| |
Co-authored-by: exponential <echo ZXhwb25lbnRpYWxtYXRyaXhAcHJvdG9ubWFpbC5jb20K | base64 -d>
|
|
|
|
|
|
|
|
|
|
| |
Description: Encrypted messenger.
https://github.com/oxen-io/session-desktop/
https://aur.archlinux.org/packages/session-desktop
https://aur.archlinux.org/packages/session-desktop-bin
https://aur.archlinux.org/packages/session-desktop-appimage
Note: The AUR packages all work with the profiles.
|
|
|
|
|
| |
Description: Automatic TV episode file renamer.
https://github.com/dbr/tvnamer
|
|
|
|
|
|
|
| |
Description: Full Screen text editor heavily inspired by Q10 and
JDarkRoom.
https://code.google.com/p/textroom/
https://aur.archlinux.org/packages/textroom
|
|
|
|
|
|
| |
Description: Encrypted sharing of files, folders, and text between
devices.
https://github.com/Jacalz/rymdport
|
|
|
|
|
| |
Description: An open source cross-platform alternative to AirDrop.
https://github.com/localsend/localsend
|
|
|
|
|
|
|
| |
Description: Plain tool to validate and compare .editorconfig files.
https://github.com/aegoroff/editorconfiger
https://aur.archlinux.org/packages/editorconfiger
https://aur.archlinux.org/packages/editorconfiger-bin
|
|
|
|
|
| |
Description: Ebook reader application.
https://koreader.rocks/
|
|
|
|
|
|
| |
Description: CLI encryption tool
https://github.com/brxken128/dexios
https://aur.archlinux.org/packages/dexios-bin
|
|
|
|
|
|
| |
Description: Checks and fixes URLs in code and documentation.
https://github.com/nschloe/deadlink
https://aur.archlinux.org/packages/deadlink
|
|
|
|
|
|
|
|
| |
Description: A CLI tool to download specific GitHub directories or
files.
https://github.com/alok8bb/cloneit
https://aur.archlinux.org/packages/cloneit-git
|
|
|
|
|
| |
Description: Python script to check the status of a list of URLs.
https://github.com/Arthurdw/statusof
|
|
|
|
|
|
| |
Description: A multi-threaded GTK application to fetch lyrics of
currently playing songs.
https://gitlab.com/bartwillems/lyriek
|
|
|
|
|
|
|
|
|
|
| |
Description: Multi-threaded file-tree visualizer and disk usage
analyzer.
https://github.com/solidiquis/erdtree
https://archlinux.org/packages/extra/x86_64/erdtree/
Note: The repo and package are called `erdtree`, but the executable is
`erd`.
|
|
|
|
|
|
|
|
| |
Description: Dynamic real-time view of running eBPF programs.
https://github.com/Netflix/bpftop
https://aur.archlinux.org/packages/bpftop
https://aur.archlinux.org/packages/bpftop-bin
https://aur.archlinux.org/packages/bpftop-git
|
|
|
|
|
|
|
|
| |
Based on the discussion at #5063.
Misc: The `\&` is used to escape the dot in `.desktop` (see roff(7)).
This amends commit a9c851ee4 ("firecfg: use ignorelist also for .desktop
files", 2024-01-08) / PR #6153.
|
| |
|
|
|
|
|
|
|
| |
Simple screen recorder for Linux desktop, supports Wayland & Xorg.
https://github.com/dvershinin/green-recorder
https://aur.archlinux.org/packages/green-recorder
https://aur.archlinux.org/packages/green-recorder-git
|
| |
|
| |
|
| |
|