github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 22:01:33 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

Sort caps.keep and seccomp.drop options (#2780)

Browse source 
* Sort seccomp.drop in unbound.profile

* Sort caps.keep in tor.profile

* Sort seccomp.drop in qgjs.profile

* Sort seccomp.drop in dnscrypt-proxy.profile

* Sort caps.keep in chromium-common.profile
This commit is contained in:
glitsj16 2019-06-16 01:26:18 +00:00 • committed by GitHub
parent d97fe42b86
commit 0a9beba3c6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
etc/chromium-common.profile
View file

@ -27,7 +27,7 @@ include whitelist-common.inc
include whitelist-var-common.inc
apparmor
caps.keep sys_chroot,sys_admin
caps.keep sys_admin,sys_chroot
netfilter
# nodbus - prevents access to passwords saved in GNOME Keyring, also breaks Gnome connector
nodvd

2
etc/dnscrypt-proxy.profile
View file

@ -26,7 +26,7 @@ nosound
notv
nou2f
novideo
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
seccomp.drop _sysctl,acct,add_key,adjtimex,clock_adjtime,delete_module,fanotify_init,finit_module,get_mempolicy,init_module,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioperm,iopl,kcmp,kexec_file_load,kexec_load,keyctl,lookup_dcookie,mbind,migrate_pages,modify_ldt,mount,move_pages,open_by_handle_at,perf_event_open,perf_event_open,pivot_root,process_vm_readv,process_vm_writev,ptrace,remap_file_pages,request_key,set_mempolicy,swapoff,swapon,sysfs,syslog,umount2,uselib,vmsplice
disable-mnt
private

2
etc/qgis.profile
View file

@ -45,7 +45,7 @@ notv
nou2f
novideo
# blacklisting of mbind system calls breaks old version
seccomp.drop @cpu-emulation,@debug,@obsolete,@privileged,set_mempolicy,migrate_pages,move_pages,open_by_handle_at,name_to_handle_at,ioprio_set,ni_syscall,syslog,fanotify_init,kcmp,add_key,request_key,keyctl,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,vmsplice,umount,userfaultfd,mincore
seccomp.drop @cpu-emulation,@debug,@obsolete,@privileged,add_key,fanotify_init,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioprio_set,kcmp,keyctl,migrate_pages,mincore,move_pages,name_to_handle_at,ni_syscall,open_by_handle_at,remap_file_pages,request_key,set_mempolicy,syslog,umount,userfaultfd,vmsplice
protocol unix,inet,inet6,netlink
shell none
tracelog

2
etc/tor.profile
View file

@ -25,7 +25,7 @@ include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
caps.keep setuid,setgid,net_bind_service,dac_read_search
caps.keep dac_read_search,net_bind_service,setgid,setuid
ipc-namespace
machine-id
netfilter

2
etc/unbound.profile
View file

@ -29,7 +29,7 @@ nosound
notv
nou2f
novideo
seccomp.drop mount,umount2,ptrace,kexec_load,kexec_file_load,open_by_handle_at,init_module,finit_module,delete_module,iopl,ioperm,swapon,swapoff,syslog,process_vm_readv,process_vm_writev,sysfs,_sysctl,adjtimex,clock_adjtime,lookup_dcookie,perf_event_open,fanotify_init,kcmp,add_key,request_key,keyctl,uselib,acct,modify_ldt,pivot_root,io_setup,io_destroy,io_getevents,io_submit,io_cancel,remap_file_pages,mbind,get_mempolicy,set_mempolicy,migrate_pages,move_pages,vmsplice,perf_event_open
seccomp.drop _sysctl,acct,add_key,adjtimex,clock_adjtime,delete_module,fanotify_init,finit_module,get_mempolicy,init_module,io_cancel,io_destroy,io_getevents,io_setup,io_submit,ioperm,iopl,kcmp,kexec_file_load,kexec_load,keyctl,lookup_dcookie,mbind,migrate_pages,modify_ldt,mount,move_pages,open_by_handle_at,perf_event_open,perf_event_open,pivot_root,process_vm_readv,process_vm_writev,ptrace,remap_file_pages,request_key,set_mempolicy,swapoff,swapon,sysfs,syslog,umount2,uselib,vmsplice
writable-var
disable-mnt