github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

build-systems-common: Make whitelist opt-in

Browse source
This commit is contained in:
rusty-snake 2021-09-11 14:38:18 +02:00
parent d452e45a91
commit 2712dd7274
4 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

5
etc/profile-a-l/build-systems-common.profile
View file

@ -28,9 +28,10 @@ include disable-shell.inc
include disable-X11.inc include disable-X11.inc
include disable-xdg.inc include disable-xdg.inc
whitelist ${HOME}/Projects #whitelist ${HOME}/Projects
#include whitelist-common.inc
whitelist /usr/share/pkgconfig whitelist /usr/share/pkgconfig
include whitelist-common.inc
include whitelist-run-common.inc include whitelist-run-common.inc
include whitelist-usr-share-common.inc include whitelist-usr-share-common.inc
include whitelist-var-common.inc include whitelist-var-common.inc

5
etc/profile-a-l/bundle.profile
View file

@ -12,8 +12,9 @@ noblacklist ${HOME}/.bundle
# Allow ruby (blacklisted by disable-interpreters.inc) # Allow ruby (blacklisted by disable-interpreters.inc)
include allow-ruby.inc include allow-ruby.inc
mkdir ${HOME}/.bundle #whitelist ${HOME}/.bundle
whitelist ${HOME}/.bundle #whitelist ${HOME}/.gem
#whitelist ${HOME}/.local/share/gem
whitelist /usr/share/gems whitelist /usr/share/gems
whitelist /usr/share/ruby whitelist /usr/share/ruby
whitelist /usr/share/rubygems whitelist /usr/share/rubygems

5
etc/profile-a-l/cargo.profile
View file

@ -12,9 +12,8 @@ ignore read-only ${HOME}/.cargo/bin
noblacklist ${HOME}/.cargo/credentials noblacklist ${HOME}/.cargo/credentials
noblacklist ${HOME}/.cargo/credentials.toml noblacklist ${HOME}/.cargo/credentials.toml
mkdir ${HOME}/.cargo #whitelist ${HOME}/.cargo
whitelist ${HOME}/.cargo #whitelist ${HOME}/.rustup
whitelist ${HOME}/.rustup
#private-bin cargo,rustc #private-bin cargo,rustc
private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,magic,magic.mgc,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl private-etc alternatives,ca-certificates,crypto-policies,group,host.conf,hostname,hosts,ld.so.cache,ld.so.conf,ld.so.conf.d,ld.so.preload,locale,locale.alias,locale.conf,localtime,magic,magic.mgc,nsswitch.conf,passwd,pki,protocols,resolv.conf,rpc,services,ssl

2
etc/profile-m-z/pip.profile
View file

@ -12,7 +12,7 @@ ignore read-only ${HOME}/.local/lib
# Allow python3 (blacklisted by disable-interpreters.inc) # Allow python3 (blacklisted by disable-interpreters.inc)
include allow-python3.inc include allow-python3.inc
whitelist ${HOME}/.local/lib/python* #whitelist ${HOME}/.local/lib/python*
private-bin pip,pip[0-9].[0-9],pip[0-9].[0-9],python3* private-bin pip,pip[0-9].[0-9],pip[0-9].[0-9],python3*