github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

various hardening (#3394)

Browse source
This commit is contained in:
rusty-snake 2020-05-02 17:58:02 +00:00 • committed by GitHub
parent 8c69eab213
commit 49280197cc
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
17 changed files with 91 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
etc/inc/allow-common-devel.inc
View file

@ -12,10 +12,16 @@ noblacklist ${HOME}/.gradle
noblacklist ${HOME}/.java
# Python
noblacklist ${HOME}/.pylint.d
noblacklist ${HOME}/.python-history
noblacklist ${HOME}/.python_history
noblacklist ${HOME}/.pythonhist
# Rust
noblacklist ${HOME}/.cargo/advisory-db
noblacklist ${HOME}/.cargo/config
noblacklist ${HOME}/.cargo/git
noblacklist ${HOME}/.cargo/registry
noblacklist ${HOME}/.cargo/.crates.toml
noblacklist ${HOME}/.cargo/.crates2.json
noblacklist ${HOME}/.cargo/.package-cache

10
etc/inc/disable-common.inc
View file

@ -149,8 +149,9 @@ read-only ${HOME}/.config/dconf
blacklist ${HOME}/.config/systemd
blacklist ${HOME}/.local/share/systemd
blacklist /var/lib/systemd
# blacklist /var/run/systemd
blacklist ${PATH}/systemd-run
# creates problems on Arch where /etc/resolv.conf is a symlink to /var/run/systemd/resolve/resolv.conf
#blacklist /var/run/systemd
# openrc
blacklist /etc/runlevels/
@ -308,13 +309,17 @@ read-only ${HOME}/bin
read-only ${HOME}/.bin
read-only ${HOME}/.local/bin
read-only ${HOME}/.cargo/bin
read-only ${HOME}/.cargo/env
# Write-protection for desktop entries
read-only ${HOME}/.config/menus
read-only ${HOME}/.gnome/apps
read-only ${HOME}/.local/share/applications
read-only ${HOME}/.config/mimeapps.list
read-only ${HOME}/.config/user-dirs.dirs
read-only ${HOME}/.config/user-dirs.locale
read-only ${HOME}/.local/share/mime
# Write-protection for thumbnailer dir
read-only ${HOME}/.local/share/thumbnailers
@ -451,6 +456,7 @@ blacklist /vmlinuz*
blacklist /.snapshots
# flatpak
blacklist ${HOME}/.cache/flatpak
blacklist ${HOME}/.config/flatpak
blacklist ${HOME}/.local/share/flatpak/app
blacklist ${HOME}/.local/share/flatpak/appstream

30
etc/inc/disable-programs.inc
View file

@ -54,8 +54,13 @@ blacklist ${HOME}/.bibletime
blacklist ${HOME}/.bitcoin
blacklist ${HOME}/.bogofilter
blacklist ${HOME}/.bzf
blacklist ${HOME}/.cargo/registry
blacklist ${HOME}/.cargo/advisory-db
blacklist ${HOME}/.cargo/config
blacklist ${HOME}/.cargo/git
blacklist ${HOME}/.cargo/registry
blacklist ${HOME}/.cargo/.crates.toml
blacklist ${HOME}/.cargo/.crates2.json
blacklist ${HOME}/.cargo/.package-cache
blacklist ${HOME}/.claws-mail
blacklist ${HOME}/.cliqz
blacklist ${HOME}/.clonk
@ -75,6 +80,7 @@ blacklist ${HOME}/.config/Code - OSS
blacklist ${HOME}/.config/Code Industry
blacklist ${HOME}/.config/Cryptocat
blacklist ${HOME}/.config/Debauchee/Barrier.conf
blacklist ${HOME}/.config/Dharkael
blacklist ${HOME}/.config/Enox
blacklist ${HOME}/.config/Ferdi
blacklist ${HOME}/.config/Franz
@ -118,6 +124,7 @@ blacklist ${HOME}/.config/Slack
blacklist ${HOME}/.config/Standard Notes
blacklist ${HOME}/.config/SubDownloader
blacklist ${HOME}/.config/Thunar
blacklist ${HOME}/.config/Unknown Organization
blacklist ${HOME}/.config/VirtualBox
blacklist ${HOME}/.config/Wire
blacklist ${HOME}/.config/Zeal
@ -125,6 +132,7 @@ blacklist ${HOME}/.config/abiword
blacklist ${HOME}/.config/agenda
blacklist ${HOME}/.config/akonadi*
blacklist ${HOME}/.config/akregatorrc
blacklist ${HOME}/.config/alacritty
blacklist ${HOME}/.config/ardour4
blacklist ${HOME}/.config/ardour5
blacklist ${HOME}/.config/aria2
@ -136,6 +144,7 @@ blacklist ${HOME}/.config/atril
blacklist ${HOME}/.config/audacious
blacklist ${HOME}/.config/autokey
blacklist ${HOME}/.config/aweather
blacklist ${HOME}/.config/backintime
blacklist ${HOME}/.config/baloofilerc
blacklist ${HOME}/.config/baloorc
blacklist ${HOME}/.config/blender
@ -195,14 +204,18 @@ blacklist ${HOME}/.config/geeqie
blacklist ${HOME}/.config/ghb
blacklist ${HOME}/.config/ghostwriter
blacklist ${HOME}/.config/git
blacklist ${HOME}/.config/glade.conf
blacklist ${HOME}/.config/globaltime
blacklist ${HOME}/.config/gmpc
blacklist ${HOME}/.config/gnome-builder
blacklist ${HOME}/.config/gnome-chess
blacklist ${HOME}/.config/gnome-control-center
blacklist ${HOME}/.config/gnome-initial-setup-done
blacklist ${HOME}/.config/gnome-latex
blacklist ${HOME}/.config/gnome-mplayer
blacklist ${HOME}/.config/gnome-mpv
blacklist ${HOME}/.config/gnome-pie
blacklist ${HOME}/.config/gnome-session
blacklist ${HOME}/.config/godot
blacklist ${HOME}/.config/google-chrome
blacklist ${HOME}/.config/google-chrome-beta
@ -255,6 +268,7 @@ blacklist ${HOME}/.config/mate/eom
blacklist ${HOME}/.config/mate/mate-dictionary
blacklist ${HOME}/.config/meld
blacklist ${HOME}/.config/meteo-qt
blacklist ${HOME}/.config/menulibre.cfg
blacklist ${HOME}/.config/mfusion
blacklist ${HOME}/.config/Microsoft
blacklist ${HOME}/.config/midori
@ -264,6 +278,7 @@ blacklist ${HOME}/.config/mpd
blacklist ${HOME}/.config/mps-youtube
blacklist ${HOME}/.config/mpv
blacklist ${HOME}/.config/mupen64plus
blacklist ${HOME}/.config/mutter
blacklist ${HOME}/.config/mypaint
blacklist ${HOME}/.config/nano
blacklist ${HOME}/.config/nautilus
@ -362,6 +377,7 @@ blacklist ${HOME}/.config/zoomus.conf
blacklist ${HOME}/.config/Zulip
blacklist ${HOME}/.conkeror.mozdev.org
blacklist ${HOME}/.crawl
blacklist ${HOME}/.cups
blacklist ${HOME}/.curlrc
blacklist ${HOME}/.dashcore
blacklist ${HOME}/.devilspie
@ -400,6 +416,7 @@ blacklist ${HOME}/.gradle
blacklist ${HOME}/.gramps
blacklist ${HOME}/.guayadeque
blacklist ${HOME}/.hashcat
blacklist ${HOME}/.hex-a-hop
blacklist ${HOME}/.hedgewars
blacklist ${HOME}/.hugin
blacklist ${HOME}/.i2p
@ -515,6 +532,7 @@ blacklist ${HOME}/.local/share/agenda
blacklist ${HOME}/.local/share/apps/korganizer
blacklist ${HOME}/.local/share/aspyr-media
blacklist ${HOME}/.local/share/autokey
blacklist ${HOME}/.local/share/backintime
blacklist ${HOME}/.local/share/baloo
blacklist ${HOME}/.local/share/barrier
blacklist ${HOME}/.local/share/bibletime
@ -545,8 +563,9 @@ blacklist ${HOME}/.local/share/geeqie
blacklist ${HOME}/.local/share/ghostwriter
blacklist ${HOME}/.local/share/gitg
blacklist ${HOME}/.local/share/gnome-2048
blacklist ${HOME}/.local/share/gnome-chess
blacklist ${HOME}/.local/share/gnome-boxes
blacklist ${HOME}/.local/share/gnome-builder
blacklist ${HOME}/.local/share/gnome-chess
blacklist ${HOME}/.local/share/gnome-klotski
blacklist ${HOME}/.local/share/gnome-latex
blacklist ${HOME}/.local/share/gnome-mines
@ -672,6 +691,7 @@ blacklist ${HOME}/.penguin-command
blacklist ${HOME}/.pingus
blacklist ${HOME}/.pioneer
blacklist ${HOME}/.purple
blacklist ${HOME}/.pylint.d
blacklist ${HOME}/.qemu-launcher
blacklist ${HOME}/.qgis2
blacklist ${HOME}/.qmmp
@ -702,6 +722,7 @@ blacklist ${HOME}/.config/teams-for-linux
blacklist ${HOME}/.tb
blacklist ${HOME}/.tconn
blacklist ${HOME}/.teeworlds
blacklist ${HOME}/.texlive2018
blacklist ${HOME}/.thunderbird
blacklist ${HOME}/.tilp
blacklist ${HOME}/.tooling
@ -779,6 +800,7 @@ blacklist ${HOME}/.cache/chromium-dev
blacklist ${HOME}/.cache/cliqz
blacklist ${HOME}/.cache/com.github.johnfactotum.Foliate
blacklist ${HOME}/.cache/darktable
blacklist ${HOME}/.cache/deja-dup
blacklist ${HOME}/.cache/discover
blacklist ${HOME}/.cache/dnox
blacklist ${HOME}/.cache/dolphin
@ -795,9 +817,12 @@ blacklist ${HOME}/.cache/gegl-0.4
blacklist ${HOME}/.cache/geeqie
blacklist ${HOME}/.cache/gfeeds
blacklist ${HOME}/.cache/gimp
blacklist ${HOME}/.cache/gnome-boxes
blacklist ${HOME}/.cache/gnome-builder
blacklist ${HOME}/.cache/gnome-control-center
blacklist ${HOME}/.cache/gnome-recipes
blacklist ${HOME}/.cache/gnome-screenshot
blacklist ${HOME}/.cache/gnome-software
blacklist ${HOME}/.cache/gnome-twitch
blacklist ${HOME}/.cache/godot
blacklist ${HOME}/.cache/google-chrome
@ -848,6 +873,7 @@ blacklist ${HOME}/.cache/org.gnome.Books
blacklist ${HOME}/.cache/org.gnome.Maps
blacklist ${HOME}/.cache/pdfmod
blacklist ${HOME}/.cache/peek
blacklist ${HOME}/.cache/pip
blacklist ${HOME}/.cache/plasmashell
blacklist ${HOME}/.cache/plasmashellbookmarkrunnerfirefoxdbfile.sqlite*
blacklist ${HOME}/.cache/qBittorrent

1
etc/inc/whitelist-common.inc
View file

@ -38,6 +38,7 @@ whitelist ${HOME}/.pangorc
# gtk
whitelist ${HOME}/.config/gtk-2.0
whitelist ${HOME}/.config/gtk-3.0
whitelist ${HOME}/.config/gtk-4.0
whitelist ${HOME}/.config/gtkrc
whitelist ${HOME}/.config/gtkrc-2.0
whitelist ${HOME}/.gnome2

4
etc/profile-a-l/etr.profile
View file

@ -9,6 +9,7 @@ include globals.local
noblacklist ${HOME}/.etr
include disable-common.inc
include disable-devel.inc
include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
@ -17,7 +18,10 @@ include disable-xdg.inc
mkdir ${HOME}/.etr
whitelist ${HOME}/.etr
whitelist /usr/share/etr
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
apparmor

5
etc/profile-a-l/frozen-bubble.profile
View file

@ -17,10 +17,14 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
mkdir ${HOME}/.frozen-bubble
whitelist ${HOME}/.frozen-bubble
whitelist /usr/share/perl5
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
apparmor
@ -36,6 +40,7 @@ novideo
protocol unix,netlink
seccomp
shell none
tracelog
disable-mnt
# private-bin frozen-bubble

4
etc/profile-a-l/gnome-chess.profile
View file

@ -17,6 +17,10 @@ include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
#mkdir ${HOME}/.local/share/gnome-chess
#whitelist ${HOME}/.local/share/gnome-chess
#include whitelist-common.inc
whitelist /usr/share/gnuchess
whitelist /usr/share/gnome-chess
include whitelist-runuser-common.inc

2
etc/profile-a-l/gnome-hexgl.profile
View file

@ -40,7 +40,7 @@ private
private-bin gnome-hexgl
private-cache
private-dev
private-etc machine-id
private-etc alsa,asound.conf,machine-id,pulse
private-tmp
dbus-user none

4
etc/profile-m-z/megaglest.profile
View file

@ -18,9 +18,13 @@ include disable-xdg.inc
mkdir ${HOME}/.megaglest
whitelist ${HOME}/.megaglest
whitelist /usr/share/megaglest
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
apparmor
caps.drop all
ipc-namespace
netfilter

3
etc/profile-m-z/minetest.profile
View file

@ -21,7 +21,10 @@ mkdir ${HOME}/.cache/minetest
mkdir ${HOME}/.minetest
whitelist ${HOME}/.cache/minetest
whitelist ${HOME}/.minetest
whitelist /usr/share/minetest
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
caps.drop all

2
etc/profile-m-z/ostrichriders.profile
View file

@ -18,7 +18,9 @@ include disable-xdg.inc
mkdir ${HOME}/.ostrichriders
whitelist ${HOME}/.ostrichriders
whitelist /usr/share/ostrichriders
include whitelist-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
caps.drop all

10
etc/profile-m-z/pingus.profile
View file

@ -14,10 +14,14 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
mkdir ${HOME}/.pingus
whitelist ${HOME}/.pingus
whitelist /usr/share/pingus
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
apparmor
@ -33,9 +37,13 @@ novideo
protocol unix,netlink
seccomp
shell none
tracelog
# private-bin pingus
disbale-mnt
private-bin pingus,pingus.bin,sh
private-cache
private-dev
private-etc machine-id
private-tmp
dbus-user none

3
etc/profile-m-z/scorched3d-wrapper.profile
View file

@ -3,5 +3,8 @@
# Persistent local customizations
include scorched3d-wrapper.local
whitelist /usr/share/opengl-games-utils
private-bin basename,bash,cut,glxinfo,grep,head,sed,zenity
# Redirect
include scorched3d.profile

3
etc/profile-m-z/scorched3d.profile
View file

@ -18,7 +18,10 @@ include disable-xdg.inc
mkdir ${HOME}/.scorched3d
whitelist ${HOME}/.scorched3d
whitelist /usr/share/scorched3d
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
caps.drop all

5
etc/profile-m-z/supertux2.profile
View file

@ -14,10 +14,14 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
mkdir ${HOME}/.local/share/supertux2
whitelist ${HOME}/.local/share/supertux2
whitelist /usr/share/supertux2
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
apparmor
@ -33,6 +37,7 @@ novideo
protocol unix,netlink
seccomp
shell none
tracelog
disable-mnt
# private-bin supertux2

4
etc/profile-m-z/torcs.profile
View file

@ -18,7 +18,10 @@ include disable-xdg.inc
mkdir ${HOME}/.torcs
whitelist ${HOME}/.torcs
whitelist /usr/share/games/torcs
whitelist /var/games/torcs
include whitelist-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
caps.drop all
@ -37,6 +40,7 @@ shell none
tracelog
disable-mnt
private-bin bash,chmod,cp,mkdir,rm,torcs
private-cache
private-dev
private-tmp

1
etc/profile-m-z/transmission-gtk.profile
View file

@ -10,6 +10,7 @@ include globals.local
include whitelist-runuser-common.inc
private-bin transmission-gtk
private-cache
ignore memory-deny-write-execute