github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

adding netlink to --protocol list (#4605)

Browse source
This commit is contained in:
netblue 2022-01-21 10:13:22 -05:00
parent de879e88c9
commit 39654d0166
4 changed files with 7 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

1
RELNOTES
View file

@ -12,6 +12,7 @@ firejail (0.9.68rc1) baseline; urgency=low
* build: firecfg.config is now installed to /etc/firejail/ (#4669)
* removed --disable-whitelist at compile time
* removed whitelist=yes/no in /etc/firejail/firejail.config
* added netlink to --protocol list (#4605)
* new condition: ALLOW_TRAY (#4510 #4599)
* remove (some) environment variables with auth-tokens (#4157)
* new includes: whitelist-run-common.inc (#4288), disable-X11.inc (#4462)

4
src/fseccomp/protocol.c
View file

@ -58,6 +58,7 @@ static char *protocol[] = {
"netlink",
"packet",
"bluetooth",
"netlink",
NULL
};
@ -68,7 +69,8 @@ static struct sock_filter protocol_filter_command[] = {
WHITELIST(AF_INET6),
WHITELIST(AF_NETLINK),
WHITELIST(AF_PACKET),
WHITELIST(AF_BLUETOOTH)
WHITELIST(AF_BLUETOOTH),
WHITELIST(AF_NETLINK)
};
#endif
// Note: protocol[] and protocol_filter_command are synchronized

3
src/man/firejail-profile.txt
View file

@ -504,7 +504,8 @@ There is no root account (uid 0) defined in the namespace.
\fBprotocol protocol1,protocol2,protocol3
Enable protocol filter. The filter is based on seccomp and checks the
first argument to socket system call. Recognized values: \fBunix\fR,
\fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR and \fBbluetooth\fR.
\fBinet\fR, \fBinet6\fR, \fBnetlink\fR, \fBpacket\fR, \fBbluetooth\fR and \fBnetlink\fR.
Multiple protocol commands are allowed.
.TP
\fBseccomp
Enable seccomp filter and blacklist the syscalls in the default list. See man 1 firejail for more details.

2
src/man/firejail.txt
View file

@ -2167,7 +2167,7 @@ $ firejail \-\-profile.print=browser
.TP
\fB\-\-protocol=protocol,protocol,protocol
Enable protocol filter. The filter is based on seccomp and checks the first argument to socket system call.
Recognized values: unix, inet, inet6, netlink, packet and bluetooth. This option is not supported for i386 architecture.
Recognized values: unix, inet, inet6, netlink, packet, bluetooth and netlink. This option is not supported for i386 architecture.
.br
.br