From 6eafbfdfcc261b8d89ed22358ed9f351d4bf5bf2 Mon Sep 17 00:00:00 2001 From: a1346054 <36859588+a1346054@users.noreply.github.com> Date: Tue, 31 Aug 2021 12:21:43 +0000 Subject: trim excess whitespace --- src/bash_completion/firejail.bash_completion.in | 8 ++++---- src/man/firejail-profile.txt | 22 +++++++++++----------- src/man/firejail.txt | 18 +++++++++--------- src/man/firemon.txt | 2 +- 4 files changed, 25 insertions(+), 25 deletions(-) (limited to 'src') diff --git a/src/bash_completion/firejail.bash_completion.in b/src/bash_completion/firejail.bash_completion.in index f68edf380..ff411c807 100644 --- a/src/bash_completion/firejail.bash_completion.in +++ b/src/bash_completion/firejail.bash_completion.in @@ -5,7 +5,7 @@ # http://bash-completion.alioth.debian.org #******************************************************************* -__interfaces(){ +__interfaces() { cut -f 1 -d ':' /proc/net/dev | tail -n +3 | grep -v lo | xargs } @@ -90,11 +90,11 @@ _firejail() _filedir return 0 ;; - --net) - comps=$(__interfaces) + --net) + comps=$(__interfaces) COMPREPLY=( $(compgen -W '$comps' -- "$cur") ) return 0 - ;; + ;; esac $split && return 0 diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt index a768829a1..a76fd3765 100644 --- a/src/man/firejail-profile.txt +++ b/src/man/firejail-profile.txt @@ -78,7 +78,7 @@ in your desktop environment copy the profile file in ~/.config/firejail director Several command line options can be passed to the program using profile files. Firejail chooses the profile file as follows: -\fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. +\fB1.\fR If a profile file is provided by the user with \-\-profile option, the profile file is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. Example: .PP .RS @@ -324,16 +324,16 @@ Remount the file or the directory noexec, nodev and nosuid. #ifdef HAVE_OVERLAYFS .TP \fBoverlay -Mount a filesystem overlay on top of the current filesystem. -The overlay is stored in $HOME/.firejail/ directory. +Mount a filesystem overlay on top of the current filesystem. +The overlay is stored in $HOME/.firejail/ directory. .TP \fBoverlay-named name -Mount a filesystem overlay on top of the current filesystem. -The overlay is stored in $HOME/.firejail/name directory. +Mount a filesystem overlay on top of the current filesystem. +The overlay is stored in $HOME/.firejail/name directory. .TP \fBoverlay-tmpfs -Mount a filesystem overlay on top of the current filesystem. -All filesystem modifications are discarded when the sandbox is closed. +Mount a filesystem overlay on top of the current filesystem. +All filesystem modifications are discarded when the sandbox is closed. #endif .TP \fBprivate @@ -487,12 +487,12 @@ does not result in an increase of privilege. #ifdef HAVE_USERNS .TP \fBnoroot -Use this command to enable an user namespace. The namespace has only one user, the current user. +Use this command to enable an user namespace. The namespace has only one user, the current user. There is no root account (uid 0) defined in the namespace. #endif .TP \fBprotocol protocol1,protocol2,protocol3 -Enable protocol filter. The filter is based on seccomp and checks the +Enable protocol filter. The filter is based on seccomp and checks the first argument to socket system call. Recognized values: \fBunix\fR, \fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR. .TP @@ -873,8 +873,8 @@ a DHCP client and releasing the lease manually. .TP \fBiprange address,address -Assign an IP address in the provided range to the last network -interface defined by a net command. A default gateway is assigned by default. +Assign an IP address in the provided range to the last network +interface defined by a net command. A default gateway is assigned by default. .br .br diff --git a/src/man/firejail.txt b/src/man/firejail.txt index 0462705c0..2883ab257 100644 --- a/src/man/firejail.txt +++ b/src/man/firejail.txt @@ -45,7 +45,7 @@ firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-deb #ifdef HAVE_LTS This is Firejail long-term support (LTS), an enterprise focused version of the software, LTS is usually supported for two or three years. -During this time only bugs and the occasional documentation problems are fixed. +During this time only bugs and the occasional documentation problems are fixed. The attack surface of the SUID executable was greatly reduced by removing some of the features. .br @@ -109,7 +109,7 @@ ptrace system call allows a full bypass of the seccomp filter. .br Example: .br -$ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox +$ firejail --allow-debuggers --profile=/etc/firejail/firefox.profile strace -f firefox .TP \fB\-\-allusers All directories under /home are visible inside the sandbox. By default, only current user home directory is visible. @@ -947,7 +947,7 @@ $ firejail \-\-net=eth0 \-\-\iprange=192.168.1.100,192.168.1.150 .TP \fB\-\-ipc-namespace -Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default +Enable a new IPC namespace if the sandbox was started as a regular user. IPC namespace is enabled by default for sandboxes started as root. .br @@ -1014,7 +1014,7 @@ $ sudo firejail --join-network=browser /sbin/iptables -vL .br .br -# verify IP addresses +# verify IP addresses .br $ sudo firejail --join-network=browser ip addr .br @@ -2134,7 +2134,7 @@ Use k(ilobyte), m(egabyte) or g(igabyte) for size suffix (base 1024). .TP \fB\-\-rlimit-cpu=number Set the maximum limit, in seconds, for the amount of CPU time each -sandboxed process can consume. When the limit is reached, the processes are killed. +sandboxed process can consume. When the limit is reached, the processes are killed. The CPU limit is a limit on CPU seconds rather than elapsed time. CPU seconds is basically how many seconds the CPU has been in use and does not necessarily directly relate to the elapsed time. Linux kernel keeps @@ -2178,7 +2178,7 @@ $ firejail \-\-net=eth0 \-\-scan .TP \fB\-\-seccomp Enable seccomp filter and blacklist the syscalls in the default list, -which is @default-nodebuggers unless \-\-allow-debuggers is specified, +which is @default-nodebuggers unless \-\-allow-debuggers is specified, then it is @default. .br @@ -2865,7 +2865,7 @@ and it is installed by default on most Linux distributions. It provides support connection model. Untrusted clients are restricted in certain ways to prevent them from reading window contents of other clients, stealing input events, etc. -The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients +The untrusted mode has several limitations. A lot of regular programs assume they are a trusted X11 clients and will crash or lock up when run in untrusted mode. Chromium browser and xterm are two examples. Firefox and transmission-gtk seem to be working fine. A network namespace is not required for this option. @@ -3256,7 +3256,7 @@ The owner of the sandbox. .SH RESTRICTED SHELL To configure a restricted shell, replace /bin/bash with /usr/bin/firejail in /etc/passwd file for each user that needs to be restricted. Alternatively, -you can specify /usr/bin/firejail in adduser command: +you can specify /usr/bin/firejail in adduser command: adduser \-\-shell /usr/bin/firejail username @@ -3266,7 +3266,7 @@ Additional arguments passed to firejail executable upon login are declared in /e Several command line options can be passed to the program using profile files. Firejail chooses the profile file as follows: -1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME. +1. If a profile file is provided by the user with --profile=FILE option, the profile FILE is loaded. If a profile name is given, it is searched for first in the ~/.config/firejail directory and if not found then in /etc/firejail directory. Profile names do not include the .profile suffix. If there is a file with the same name as the given profile name, it will be used instead of doing the profile search. To force a profile search, prefix the profile name with a colon (:), eg. --profile=:PROFILE_NAME. Example: .PP .RS diff --git a/src/man/firemon.txt b/src/man/firemon.txt index 76b2f7be2..c4e6e15b3 100644 --- a/src/man/firemon.txt +++ b/src/man/firemon.txt @@ -56,7 +56,7 @@ Print route table for each sandbox. Print seccomp configuration for each sandbox. .TP \fB\-\-top -Monitor the most CPU-intensive sandboxes. This command is similar to +Monitor the most CPU-intensive sandboxes. This command is similar to the regular UNIX top command, however it applies only to sandboxes. .TP \fB\-\-tree -- cgit v1.2.3-70-g09d2