aboutsummaryrefslogtreecommitdiffstats
path: root/src
Commit message (Collapse)AuthorAge
* Create mullvad-browser.profile (#5887)Libravatar glitsj162023-07-22
| | | | | | | | | Homepage: https://mullvad.net/en/download/browser/linux mullvad-browser: don't use restrict-namespaces mullvad-browser: cover both installation paths Suggested in review by @kmk3.
* hostnames.c: fix scan-build warningLibravatar Kelvin M. Klann2023-07-20
| | | | | | | | | | | | | | | | This is breaking scan-build in CI[1]: /usr/share/clang/scan-build-14/bin/../libexec/ccc-analyzer [...] -c hostnames.c -o hostnames.o hostnames.c:59:10: warning: Null pointer passed to 1st parameter expecting 'nonnull' [core.NonNullParamChecker] return strdup(rv); ^~~~~~~~~~ 1 warning generated. Likely caused by commit d2802ce60 ("fnettrace cleanup", 2023-07-15). This also fixes a memory leak of `cmd`. [1] https://github.com/netblue30/firejail/actions/runs/5568460702/jobs/10171098449
* modif: drop deprecated 'shell' option references (#5894)Libravatar glitsj162023-07-19
| | | | | | | | | | | | The `shell` option has been removed. Remove stale references. This does NOT remove `shell none`-related code comments in: - src/firejail/fs_lib.c (L433-L441) - src/firejail/join.c (L415-L417) Relates to #5196. Suggested by #5891.
* zsh: add shell completion for --tabLibravatar Kelvin M. Klann2023-07-19
| | | | | | | | | | | Note: It already works for bash and it's already present in the syntax files: $ grep '^tab' contrib/syntax/lists/profile_commands_arg0.list tab Added on commit e6c50240f ("--tab: enable shell tab completion", 2022-02-20) / #4936.
* feature: stats support for --nettraceLibravatar netblue302023-07-16
|
* Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302023-07-16
|\
| * feature: add doas support in firecfg and jailcheckLibravatar Kelvin M. Klann2023-07-14
| | | | | | | | | | | | Closes #5899. Suggested-by: @shaggonit
| * firecfg: add const to a few functions/variablesLibravatar Kelvin M. Klann2023-07-14
| | | | | | | | To make it clearer that they are not modified later.
| * firecfg: rename get_user to get_sudo_userLibravatar Kelvin M. Klann2023-07-14
| | | | | | | | To make it match the function used in src/jailcheck/utils.c.
| * disable-common.inc: blacklist sudo/doas paths in /etcLibravatar Kelvin M. Klann2023-07-14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commands used to find the relevant paths in /etc: $ pacman -Qo /etc/* 2>/dev/null | grep sudo | LC_ALL=C sort /etc/pam.d/ is owned by sudo 1.9.14.p1-1 /etc/sudo.conf is owned by sudo 1.9.14.p1-1 /etc/sudo_logsrvd.conf is owned by sudo 1.9.14.p1-1 /etc/sudoers is owned by sudo 1.9.14.p1-1 /etc/sudoers.d/ is owned by sudo 1.9.14.p1-1 Environment: Artix Linux. Also, add missing paths sudo/doas to etc/ids.config and jailcheck. See also commit dbebd71db ("disable-common.inc: blacklist doas binary", 2022-10-05). Relates to #5385. Reported-by: Dieter Plaetinck <dieter@plaetinck.be>
| * Merge pull request #5881 from glitsj16/rssguardLibravatar netblue302023-07-13
| |\ | | | | | | New profile: rssguard
| | * Merge branch 'netblue30:master' into rssguardLibravatar glitsj162023-07-06
| | |\
| | * | firecfg.config: add rssguardLibravatar glitsj162023-07-03
| | | |
* | | | fnettrace cleanupLibravatar netblue302023-07-15
|/ / /
* | | build: simplify code related to man pagesLibravatar Kelvin M. Klann2023-07-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Simplify the main targets and use wildcards instead of repeating the filenames manually. Also, restore the `man` target and building only when `HAVE_MAN` is enabled. Note: Make automatically removes intermediate files (.1 and .5), so in general only the .gz files have to be cleaned. Commands used to rename the man pages: cd src/man git mv firecfg.txt firecfg.1.in git mv firejail-login.txt firejail-login.5.in git mv firejail-profile.txt firejail-profile.5.in git mv firejail-users.txt firejail-users.5.in git mv firejail.txt firejail.1.in git mv firemon.txt firemon.1.in git mv jailcheck.txt jailcheck.1.in This is kind of a follow-up to commit 9e206b7f2 ("rework src/man Makefile", 2023-07-07).
* | | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302023-07-12
|\ \ \
| * | | build: remove extraneous blank lines in makefilesLibravatar Kelvin M. Klann2023-07-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added in the following commits: * f3774678f ("compress static ip map for fnettrace at compile time", 2023-07-06) * 9e206b7f2 ("rework src/man Makefile", 2023-07-07)
* | | | feature: use seccomp filters build at install time for --restrict-namespacesLibravatar netblue302023-07-12
|/ / /
* | | fix random hostnameLibravatar netblue302023-07-10
| | |
* | | rework src/man MakefileLibravatar netblue302023-07-07
| |/ |/|
* | compress static ip map for fnettrace at compile timeLibravatar netblue302023-07-06
| |
* | rename static-ip-map to static-ip-map.txtLibravatar netblue302023-07-05
|/
* Merge pull request #5871 from kmk3/improve-errexitLibravatar Kelvin M. Klann2023-07-01
|\ | | | | modif: improve errExit error messages
| * Improve errExit error messagesLibravatar Kelvin M. Klann2023-06-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Move msg to the end of errExit (right before perror(3p)) * Include the full file path (within the repository) * Add "()" to function name for clarity Before: Error malloc: main.c:123 main: Cannot allocate memory After: Error src/firejail/main.c:123 main(): malloc: Cannot allocate memory Note: This clarifies which is the exact file that the error message comes from, as there are many source files with the same name. For example: $ git ls-files 'src/*/main.c' | wc -l 20
| * common.h: use __func__ instead of __FUNCTION__Libravatar Kelvin M. Klann2023-06-28
| | | | | | | | | | | | For increased portability. The former is in C99, the latter is from gcc.
| * common.h: line-wrap errExitLibravatar Kelvin M. Klann2023-06-28
| |
| * Deduplicate calls similar to errExitLibravatar Kelvin M. Klann2023-06-28
| | | | | | | | | | | | Use errExit in every place that uses __FILE__ and __LINE__ manually. Note: This currently only happens in the duplicated `is_dir` function.
* | firecfg.config: actually fix sortingLibravatar Kelvin M. Klann2023-06-28
| | | | | | | | | | | | | | | | | | | | | | And remove the comment, as firecfg does not appear to support end-of-line comments and normal comments break the linter: $ ./ci/check/profiles/sort-firecfg.config.sh src/firecfg/firecfg.config sort: -:13: disorder: #Debian 11 seems to be installing the same fbreader executable twice under two different names This amends commit 869333a5f ("firecfg.config: fix sorting", 2023-06-28).
* | main.c: fix typo in --icmptrace error messageLibravatar Kelvin M. Klann2023-06-28
| |
* | firecfg.config: fix sortingLibravatar Kelvin M. Klann2023-06-28
| | | | | | | | | | | | | | | | | | It's currently breaking the profile-checks job in CI[1]. Tihs amends commit d88c8d439 ("fbreader/FBReader profile fixes; more on static ip map", 2023-06-27). [1] https://github.com/netblue30/firejail/actions/runs/5394764503/jobs/9796380881
* | Merge branch 'master' of ssh://github.com/netblue30/firejailLibravatar netblue302023-06-27
|\|
| * Merge pull request #5866 from kmk3/build-organize-make-varsLibravatar Kelvin M. Klann2023-06-27
| |\ | | | | | | build: organize and standardize make vars and targets
| | * build: move remaining build flags into config.mk.inLibravatar Kelvin M. Klann2023-06-25
| | | | | | | | | | | | Put all definitions in the same file.
| | * build: move common CFLAGS/LDFLAGS firstLibravatar Kelvin M. Klann2023-06-25
| | |
| | * build: remove redundant LDFLAGS in so.mkLibravatar Kelvin M. Klann2023-06-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Changes: * Remove -fPIE, as it is mutually exclusive with -fPIC * Remove -pie, as it is intended for executables (with -fPIE / -fpie) * Remove duplicated `-z relro` Note: The files built by the affected recipe are identical with and without these changes when using gcc 13.1.1-1 on Artix Linux.
| | * build: standardize clean/distclean targets in srcLibravatar Kelvin M. Klann2023-06-25
| | | | | | | | | | | | | | | | | | | | | Changes: * clean: remove the same types of files in src/prog.mk and src/so.mk * distclean: remove unused recipes and DISTCLEANFILES variable
| | * build: rename TOCLEAN and TODISTCLEAN variablesLibravatar Kelvin M. Klann2023-06-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To CLEANFILES and DISTCLEANFILES, respectively. This matches what GNU automake uses. Commands used to search and replace: $ git grep -IFlz -e TOCLEAN -e TODISTCLEAN | xargs -0 -I '{}' sh -c "printf '%s\n' \"\$(sed \ -e 's/TOCLEAN/CLEANFILES/g' \ -e 's/TODISTCLEAN/DISTCLEANFILES/g' '{}')\" >'{}'" Added on commit cbdee6555 ("makefiles: add TOCLEAN and TODISTCLEAN variables", 2022-07-15) / PR #5478.
| | * build: rename MOD vars to EXTRA varsLibravatar Kelvin M. Klann2023-06-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To make them less confusing, as they are extra dependencies, not files that are specific to the module. Commands used to search and replace: $ git grep -IFlz -e 'MOD_HDRS' -e 'MOD_OBJS' -- src | xargs -0 -I '{}' sh -c "printf '%s\n' \"\$(sed \ -e 's/MOD_HDRS/EXTRA_HDRS/g' \ -e 's/MOD_OBJS/EXTRA_OBJS/g' '{}')\" >'{}'" Added on commit f5b1ccaad ("makefiles: move extra deps into new MOD vars", 2022-05-07) / PR #5478.
| | * build: remove MOD_SRCS variableLibravatar Kelvin M. Klann2023-06-24
| | | | | | | | | | | | | | | | | | | | | It is unused and is unlikely to be used. Added on commit f5b1ccaad ("makefiles: move extra deps into new MOD vars", 2022-05-07) / PR #5478.
* | | fbreader/FBReader profile fixes; more on static ip mapLibravatar netblue302023-06-27
|/ /
* | fix geoiplookup executable detection for --nettraceLibravatar netblue302023-06-25
| |
* | QUIC (HTTP/3) support in --nettraceLibravatar netblue2023-06-25
|/
* build: move MAKEFLAGS to config.mk.inLibravatar Kelvin M. Klann2023-06-24
| | | | | | | To reduce the amount of boilerplate in the makefiles. This amends commit 9789c263a ("build: disable all built-in implicit make rules", 2023-06-21) / PR #5864.
* Merge pull request #5865 from kmk3/profiles-add-vmplayerLibravatar Kelvin M. Klann2023-06-23
|\ | | | | profiles: vmware improvements and new redirect
| * profiles: vmware: disable on firecfgLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | It appears to be broken on Linux Mint 20.3 (based on Ubuntu 20.04), due to the "VMWare Kernel Module Updater" being unable to install kernel modules[1]. Relates to #3526. [1] https://github.com/netblue30/firejail/issues/5861#issuecomment-1598407890 Reported-by: @MikeNavy
| * profiles: add vmplayer.profileLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | As a redirect to vmware.profile. This is apparently the filename for the "VMWare Workstation Player" on Linux Mint 20.3 (based on Ubuntu 20.04)[1]. Relates to #3526. [1] https://github.com/netblue30/firejail/issues/5861#issuecomment-1598132860 Reported-by: @MikeNavy
* | build: disable all built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use `make -r` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~93.3% (~97.5% compared to a8f01a383) for the default build and by ~83.3% (~99.3% compared to a8f01a383) for the "man" target (as an example): $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (in the previous commit) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 170 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 7 Environment: GNU make 4.4.1-2 on Artix Linux. Note: According to make(1p) in POSIX.1-2017, "If .SUFFIXES does not have any prerequisites, the list of known suffixes shall be cleared.", while "The result of setting MAKEFLAGS in the Makefile is unspecified." Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed -E \ 's/^(.SUFFIXES:)/\1\nMAKEFLAGS += -r\n/' '{}')\" >'{}'"
* | build: disable most built-in implicit make rulesLibravatar Kelvin M. Klann2023-06-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Clear `.SUFFIXES:` to reduce unnecessary filesystem lookups. Overall, this appears to reduce the amount of implicit rule searches by ~62% for the default build and by ~96% for the "man" target (as an example): $ git checkout master >/dev/null 2>&1 $ git show --pretty='%h %ai %s' -s a8f01a383 2023-06-20 05:26:23 +0000 Merge pull request #5859 from kmk3/build-remove-retpoline $ ./configure >/dev/null $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 6798 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 1085 # (with this commit applied) $ make clean >/dev/null && make --debug=i -j 4 | grep -F 'Trying implicit' | wc -l 2535 $ make clean >/dev/null && make --debug=i -j 4 man | grep -F 'Trying implicit' | wc -l 42 Environment: GNU make 4.4.1-2 on Artix Linux. Commands used to search and replace: $ git ls-files -z -- '*Makefile*' | xargs -0 -I '{}' sh -c \ "printf '%s\n' \"\$(sed '1s/^/.SUFFIXES:\n/' '{}')\" >'{}'" See also commit f48886f25 ("build: mark most phony targets as such", 2023-02-01) / PR #5637.
* | build: standardize commands on top of makefilesLibravatar Kelvin M. Klann2023-06-21
|/ | | | To make the makefiles look more similar.
* Merge pull request #5856 from kmk3/standardize-name-checksLibravatar Kelvin M. Klann2023-06-19
|\ | | | | modif: Standardize and add missing name/hostname checks
generated by cgit v1.2.3-54-g00ecf (git 2.45.2) at 2024-07-19 16:07:22 +0000