github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 6

Use whitelisting for video players (#3472)

Browse source 
* Use whitelisting for video players

See https://github.com/netblue30/firejail/pull/3469

* Update media player whitelists

See reviews at https://github.com/netblue30/firejail/pull/3472

Block $DOCUMENTS

Make $DESKTOP read-only

* Review fixes: include read-only Desktop in whitelist
This commit is contained in:
Fred Barclay 2020-08-15 17:27:10 -05:00 • committed by GitHub
parent 6937df00d6
commit 5d741795c3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 74 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

16
etc/profile-a-l/celluloid.profile
View file

@ -9,8 +9,6 @@ include globals.local
noblacklist ${HOME}/.config/celluloid
noblacklist ${HOME}/.config/gnome-mpv
noblacklist ${HOME}/.config/youtube-dl
noblacklist ${MUSIC}
noblacklist ${VIDEOS}
# Allow python (blacklisted by disable-interpreters.inc)
include allow-python2.inc
@ -22,8 +20,20 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
read-only ${DESKTOP}
mkdir ${HOME}/.config/celluloid
mkdir ${HOME}/.config/gnome-mpv
mkdir ${HOME}/.config/youtube-dl
whitelist ${HOME}/.config/celluloid
whitelist ${HOME}/.config/gnome-mpv
whitelist ${HOME}/.config/youtube-dl
whitelist ${DESKTOP}
whitelist ${DOWNLOADS}
whitelist ${MUSIC}
whitelist ${PICTURES}
whitelist ${VIDEOS}
include whitelist-common.inc
include whitelist-runuser-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc

13
etc/profile-m-z/mplayer.profile
View file

@ -7,8 +7,6 @@ include mplayer.local
include globals.local
noblacklist ${HOME}/.mplayer
noblacklist ${MUSIC}
noblacklist ${VIDEOS}
include disable-common.inc
include disable-devel.inc
@ -16,8 +14,16 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
read-only ${DESKTOP}
mkdir ${HOME}/.mplayer
whitelist ${HOME}/.mplayer
whitelist ${DESKTOP}
whitelist ${DOWNLOADS}
whitelist ${MUSIC}
whitelist ${PICTURES}
whitelist ${VIDEOS}
include whitelist-common.inc
include whitelist-usr-share-common.inc
include whitelist-var-common.inc
@ -36,4 +42,3 @@ shell none
private-bin mplayer
private-dev
private-tmp

22
etc/profile-m-z/mpv.profile
View file

@ -7,6 +7,10 @@ include mpv.local
# Persistent global definitions
include globals.local
# In order to save screenshots to a persistent location,
# edit ~/.config/mpv/foobar.conf:
# screenshot-directory=~/Pictures
noblacklist ${HOME}/.config/mpv
noblacklist ${HOME}/.config/youtube-dl
noblacklist ${HOME}/.netrc
@ -17,10 +21,6 @@ include allow-lua.inc
include allow-python2.inc
include allow-python3.inc
noblacklist ${MUSIC}
noblacklist ${PICTURES}
noblacklist ${VIDEOS}
include disable-common.inc
include disable-devel.inc
include disable-exec.inc
@ -28,8 +28,20 @@ include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc
read-only ${DESKTOP}
mkdir ${HOME}/.config/mpv
mkdir ${HOME}/.config/youtube-dl
mkdir ${HOME}/.netrc
whitelist ${HOME}/.config/mpv
whitelist ${HOME}/.config/youtube-dl
whitelist ${HOME}/.netrc
whitelist ${DESKTOP}
whitelist ${DOWNLOADS}
whitelist ${MUSIC}
whitelist ${PICTURES}
whitelist ${VIDEOS}
include whitelist-common.inc
whitelist /usr/share/lua
whitelist /usr/share/lua*
whitelist /usr/share/vulkan

15
etc/profile-m-z/totem.profile
View file

@ -14,9 +14,6 @@ include allow-python3.inc
noblacklist ${HOME}/.config/totem
noblacklist ${HOME}/.local/share/totem
noblacklist ${MUSIC}
noblacklist ${PICTURES}
noblacklist ${VIDEOS}
include disable-common.inc
include disable-devel.inc
@ -25,8 +22,18 @@ include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-shell.inc
include disable-xdg.inc
read-only ${DESKTOP}
mkdir ${HOME}/.config/totem
mkdir ${HOME}/.local/share/totem
whitelist ${HOME}/.config/totem
whitelist ${HOME}/.local/share/totem
whitelist ${DESKTOP}
whitelist ${DOWNLOADS}
whitelist ${MUSIC}
whitelist ${PICTURES}
whitelist ${VIDEOS}
include whitelist-common.inc
include whitelist-var-common.inc
# apparmor - makes settings immutable

16
etc/profile-m-z/vlc.profile
View file

@ -9,8 +9,6 @@ include globals.local
noblacklist ${HOME}/.cache/vlc
noblacklist ${HOME}/.config/vlc
noblacklist ${HOME}/.local/share/vlc
noblacklist ${MUSIC}
noblacklist ${VIDEOS}
include disable-common.inc
include disable-devel.inc
@ -18,8 +16,20 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
read-only ${DESKTOP}
mkdir ${HOME}/.cache/vlc
mkdir ${HOME}/.config/vlc
mkdir ${HOME}/.local/share/vlc
whitelist ${HOME}/.cache/vlc
whitelist ${HOME}/.config/vlc
whitelist ${HOME}/.local/share/vlc
whitelist ${DESKTOP}
whitelist ${DOWNLOADS}
whitelist ${MUSIC}
whitelist ${PICTURES}
whitelist ${VIDEOS}
include whitelist-common.inc
include whitelist-var-common.inc
#apparmor - on Ubuntu 18.04 it refuses to start without dbus access

14
etc/profile-m-z/xplayer.profile
View file

@ -7,8 +7,6 @@ include globals.local
noblacklist ${HOME}/.config/xplayer
noblacklist ${HOME}/.local/share/xplayer
noblacklist ${MUSIC}
noblacklist ${VIDEOS}
# Allow python (blacklisted by disable-interpreters.inc)
include allow-python2.inc
@ -20,8 +18,18 @@ include disable-exec.inc
include disable-interpreters.inc
include disable-passwdmgr.inc
include disable-programs.inc
include disable-xdg.inc
read-only ${DESKTOP}
mkdir ${HOME}/.config/xplayer
mkdir ${HOME}/.local/share/xplayer
whitelist ${HOME}/.config/xplayer
whitelist ${HOME}/.local/share/xplayer
whitelist ${DESKTOP}
whitelist ${DOWNLOADS}
whitelist ${MUSIC}
whitelist ${PICTURES}
whitelist ${VIDEOS}
include whitelist-common.inc
include whitelist-var-common.inc
# apparmor - makes settings immutable