From 516d08114f73133f8f3d8330b361f79843a06254 Mon Sep 17 00:00:00 2001 From: Fred Barclay Date: Sat, 4 Apr 2020 12:20:01 -0500 Subject: Fixes for slack 4.4 I'd like to tighten this up more esp. for seccomp - caps.keep sys_chroot needed or fails with Cannot chroot into /proc/ directory: Operation not permitted 1. caps.drop all replaced with caps.keep - caps.keep sys_admin needed or fails with Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 2. nonewprivs dropped to avoid failure: The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 3. noroot dropped to avoid failure: [22:0404/121643.400578:FATAL:setuid_sandbox_host.cc(157)] The SUID sandbox helper binary was found, but is not configured correctly. Rather than run without sandboxing I'm aborting now. You need to make sure that /usr/lib/slack/chrome-sandbox is owned by root and has mode 4755. 4. Removed protocol filter to avoid: The setuid sandbox is not running as root. Common causes: * An unprivileged process using ptrace on it, like a debugger. * A parent process set prctl(PR_SET_NO_NEW_PRIVS, ...) Failed to move to new namespace: PID namespaces supported, Network namespace supported, but failed: errno = Operation not permitted 5. Unable to get a working seccomp filter See https://github.com/netblue30/firejail/issues/2946#issuecomment-598612520 seccomp !chroot seems to have worked for earlier versions of slack 6. private-tmp means no tray icon Observed on Debian 10, Slack 4.4.0 --- etc/slack.profile | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) (limited to 'etc') diff --git a/etc/slack.profile b/etc/slack.profile index 9a10e38fe..79e427dce 100644 --- a/etc/slack.profile +++ b/etc/slack.profile @@ -19,16 +19,12 @@ whitelist ${DOWNLOADS} include whitelist-common.inc include whitelist-var-common.inc -caps.drop all +caps.keep sys_chroot,sys_admin netfilter nodvd nogroups -nonewprivs -noroot notv nou2f -protocol unix,inet,inet6,netlink -seccomp !chroot shell none disable-mnt @@ -36,4 +32,3 @@ private-bin locale,slack private-cache private-dev private-etc alternatives,asound.conf,ca-certificates,crypto-policies,debian_version,fedora-release,fonts,group,ld.so.cache,ld.so.conf,localtime,machine-id,os-release,passwd,pki,pulse,redhat-release,resolv.conf,ssl,system-release,system-release-cpe -private-tmp -- cgit v1.2.3-70-g09d2