mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
New profiles + fixes + hardening
- blacklist ~/.rustup in disable-devel.inc - add note to mpv (See #3628) - harden warsow - update relnotes - new profile qrencode, dbus-send, notify-send
This commit is contained in:
rusty-snake
parent
59dd146ac1
commit
8d9b12d1c6
8 changed files with 197 additions and 2 deletions
|
|
@ -196,4 +196,4 @@ gnome-screenshot, ripperX, sound-juicer, iagno, com.github.dahenson.agenda, gnom
|
|||
penguin-command, x2goclient, frogatto, gnome-mines, gnome-nibbles, lightsoff, ts3client_runscript.sh, warmux, ferdi, abiword,
|
||||
four-in-a-row, gnome-mahjongg, gnome-robots, gnome-sudoku, gnome-taquin, gnome-tetravex, blobwars, gravity-beams-and-evaporating-stars,
|
||||
hyperrogue, jumpnbump-menu, jumpnbump, magicor, mindless, mirrormagic, mrrescue, scorched3d-wrapper, scorchwentbonkers,
|
||||
seahorse-adventures, wordwarvi, xbill, gnome-klotski, five-or-more, swell-foop, fdns, jitsi-meet-desktop, nicontine, steam-runtime, apostrophe, quadrapassel, dino-im, strawberry, hitori, bijiben, gnote, gnubik, ZeGrapher, gapplication, xonotic-sdl-wrapper, openarena_ded, cawbird, freetube, homebank, mattermost-desktop, newsflash, com.gitlab.newsflash, element-desktop, sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx, minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar, vmware, git-cola, otter-browser, kazam, menulibre, musictube, onboard, fractal, mirage, quaternion, spectral, man, psi, smuxi-frontend-gnome, balsa, kube, trojita, cola, twitch, youtube, youtubemusic-nativefier, ytmdesktop
|
||||
seahorse-adventures, wordwarvi, xbill, gnome-klotski, five-or-more, swell-foop, fdns, jitsi-meet-desktop, nicontine, steam-runtime, apostrophe, quadrapassel, dino-im, strawberry, hitori, bijiben, gnote, gnubik, ZeGrapher, gapplication, xonotic-sdl-wrapper, openarena_ded, cawbird, freetube, homebank, mattermost-desktop, newsflash, com.gitlab.newsflash, element-desktop, sushi, xfce4-screenshooter, org.gnome.NautilusPreviewer, lyx, minitube, nuclear, mtpaint, minecraft-launcher, gnome-calendar, vmware, git-cola, otter-browser, kazam, menulibre, musictube, onboard, fractal, mirage, quaternion, spectral, man, psi, smuxi-frontend-gnome, balsa, kube, trojita, cola, twitch, youtube, youtubemusic-nativefier, ytmdesktop, dbus-send, notify-send, qrencode
|
||||
|
|
|
|||
3
RELNOTES
3
RELNOTES
|
|
@ -19,6 +19,7 @@ firejail (0.9.63) baseline; urgency=low
|
|||
* whitelist globbing
|
||||
* mkdir and mkfile support for /run/user directory
|
||||
* support ignore for include
|
||||
* --include on the command line
|
||||
* new condition: HAS_NOSOUND
|
||||
* new profiles: gfeeds, firefox-x11, tvbrowser, rtv, clipgrab, muraster
|
||||
* new profiles: gnome-passwordsafe, bibtex, gummi, latex, mupdf-x11-curl
|
||||
|
|
@ -46,7 +47,7 @@ firejail (0.9.63) baseline; urgency=low
|
|||
* new profiles: vmware, git-cola, otter-browser, kazam, menulibre, musictube
|
||||
* new profiles: onboard, fractal, mirage, quaternion, spectral, man, psi, twitch
|
||||
* new profiles: smuxi-frontend-gnome, balsa, kube, trojita, youtube, ytmdesktop
|
||||
* new profiles: youtubemusic-nativefier, cola
|
||||
* new profiles: youtubemusic-nativefier, cola, dbus-send, notify-send, qrencode
|
||||
-- netblue30 <netblue30@yahoo.com> Tue, 21 Apr 2020 08:00:00 -0500
|
||||
|
||||
firejail (0.9.62) baseline; urgency=low
|
||||
|
|
|
|||
|
|
@ -49,6 +49,7 @@ blacklist ${PATH}/openssl-1.0
|
|||
blacklist ${PATH}/rust-gdb
|
||||
blacklist ${PATH}/rust-lldb
|
||||
blacklist ${PATH}/rustc
|
||||
blacklist ${HOME}/.rustup
|
||||
|
||||
# tcc - Tiny C Compiler
|
||||
blacklist ${PATH}/tcc
|
||||
|
|
|
|||
59
etc/profile-a-l/dbus-send.profile
Normal file
59
etc/profile-a-l/dbus-send.profile
Normal file
|
|
@ -0,0 +1,59 @@
|
|||
# Firejail profile for dbus-send
|
||||
# Description: Send a message to a message bus
|
||||
# This file is overwritten after every install/update
|
||||
quiet
|
||||
# Persistent local customizations
|
||||
include dbus-send.local
|
||||
# Persistent global definitions
|
||||
include globals.local
|
||||
|
||||
blacklist /tmp/.X11-unix
|
||||
blacklist ${RUNUSER}/wayland-*
|
||||
|
||||
include disable-common.inc
|
||||
include disable-devel.inc
|
||||
include disable-exec.inc
|
||||
include disable-interpreters.inc
|
||||
include disable-passwdmgr.inc
|
||||
include disable-programs.inc
|
||||
include disable-shell.inc
|
||||
include disable-write-mnt.inc
|
||||
include disable-xdg.inc
|
||||
|
||||
include whitelist-common.inc
|
||||
include whitelist-runuser-common.inc
|
||||
include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
apparmor
|
||||
caps.drop all
|
||||
ipc-namespace
|
||||
machine-id
|
||||
# Breaks abstract sockets
|
||||
#net none
|
||||
netfilter
|
||||
no3d
|
||||
nodvd
|
||||
nogroups
|
||||
nonewprivs
|
||||
noroot
|
||||
nosound
|
||||
notv
|
||||
nou2f
|
||||
novideo
|
||||
protocol unix
|
||||
seccomp
|
||||
shell none
|
||||
tracelog
|
||||
|
||||
disable-mnt
|
||||
private
|
||||
private-bin dbus-send
|
||||
private-cache
|
||||
private-dev
|
||||
private-etc alternatives,dbus-1
|
||||
private-lib libpcre2-8.so.0
|
||||
private-tmp
|
||||
|
||||
memory-deny-write-execute
|
||||
read-only ${HOME}
|
||||
|
|
@ -11,6 +11,19 @@ include globals.local
|
|||
# edit ~/.config/mpv/foobar.conf:
|
||||
# screenshot-directory=~/Pictures
|
||||
|
||||
# Mpv has a powerfull lua-API, some off these lua-scripts interact
|
||||
# with external resources which are blocked by firejail. In such cases
|
||||
# you need to allow these resources by
|
||||
# - adding additional binaries to private-bin
|
||||
# - whitelisting additional paths
|
||||
# - noblacklisting paths
|
||||
# - weaking the dbus-policy
|
||||
# - ...
|
||||
#
|
||||
# Often these scripts require a shell:
|
||||
#noblacklist ${PATH}/sh
|
||||
#private-bin sh
|
||||
|
||||
noblacklist ${HOME}/.config/mpv
|
||||
noblacklist ${HOME}/.config/youtube-dl
|
||||
noblacklist ${HOME}/.netrc
|
||||
|
|
|
|||
60
etc/profile-m-z/notify-send.profile
Normal file
60
etc/profile-m-z/notify-send.profile
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
# Firejail profile for notify-send
|
||||
# Description: a program to send desktop notifications
|
||||
# This file is overwritten after every install/update
|
||||
quiet
|
||||
# Persistent local customizations
|
||||
include notify-send.local
|
||||
# Persistent global definitions
|
||||
include globals.local
|
||||
|
||||
blacklist ${RUNUSER}/wayland-*
|
||||
|
||||
include disable-common.inc
|
||||
include disable-devel.inc
|
||||
include disable-exec.inc
|
||||
include disable-interpreters.inc
|
||||
include disable-passwdmgr.inc
|
||||
include disable-programs.inc
|
||||
include disable-shell.inc
|
||||
include disable-write-mnt.inc
|
||||
include disable-xdg.inc
|
||||
|
||||
include whitelist-common.inc
|
||||
include whitelist-runuser-common.inc
|
||||
include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
apparmor
|
||||
caps.drop all
|
||||
ipc-namespace
|
||||
machine-id
|
||||
net none
|
||||
no3d
|
||||
nodvd
|
||||
nogroups
|
||||
nonewprivs
|
||||
noroot
|
||||
nosound
|
||||
notv
|
||||
nou2f
|
||||
novideo
|
||||
protocol unix
|
||||
seccomp
|
||||
shell none
|
||||
tracelog
|
||||
x11 none
|
||||
|
||||
disable-mnt
|
||||
private
|
||||
private-bin notify-send
|
||||
private-cache
|
||||
private-dev
|
||||
private-etc none
|
||||
private-tmp
|
||||
|
||||
dbus-user filter
|
||||
dbus-user.talk org.freedesktop.Notifications
|
||||
dbus-system none
|
||||
|
||||
memory-deny-write-execute
|
||||
read-only ${HOME}
|
||||
58
etc/profile-m-z/qrencode.profile
Normal file
58
etc/profile-m-z/qrencode.profile
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
# Firejail profile for qrencode
|
||||
# Description: Encode input data in a QR Code and save as a PNG or EPS image.
|
||||
# This file is overwritten after every install/update
|
||||
quiet
|
||||
# Persistent local customizations
|
||||
include qrencode.local
|
||||
# Persistent global definitions
|
||||
include globals.local
|
||||
|
||||
blacklist ${RUNUSER}/wayland-*
|
||||
blacklist ${RUNUSER}
|
||||
|
||||
include disable-common.inc
|
||||
include disable-devel.inc
|
||||
include disable-exec.inc
|
||||
include disable-interpreters.inc
|
||||
include disable-passwdmgr.inc
|
||||
include disable-programs.inc
|
||||
include disable-shell.inc
|
||||
include disable-write-mnt.inc
|
||||
include disable-xdg.inc
|
||||
|
||||
include whitelist-runuser-common.inc
|
||||
include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
apparmor
|
||||
caps.drop all
|
||||
ipc-namespace
|
||||
machine-id
|
||||
net none
|
||||
no3d
|
||||
nodvd
|
||||
nogroups
|
||||
nonewprivs
|
||||
noroot
|
||||
nosound
|
||||
notv
|
||||
nou2f
|
||||
novideo
|
||||
protocol unix
|
||||
seccomp
|
||||
shell none
|
||||
tracelog
|
||||
x11 none
|
||||
|
||||
disable-mnt
|
||||
private-bin qrencode
|
||||
private-cache
|
||||
private-dev
|
||||
private-etc none
|
||||
private-lib libpcre2-8.so.0
|
||||
private-tmp
|
||||
|
||||
dbus-user none
|
||||
dbus-system none
|
||||
|
||||
memory-deny-write-execute
|
||||
|
|
@ -24,7 +24,10 @@ mkdir ${HOME}/.cache/warsow-2.1
|
|||
mkdir ${HOME}/.local/share/warsow-2.1
|
||||
whitelist ${HOME}/.cache/warsow-2.1
|
||||
whitelist ${HOME}/.local/share/warsow-2.1
|
||||
whitelist /usr/share/warsow
|
||||
include whitelist-common.inc
|
||||
include whitelist-runuser-common.inc
|
||||
include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
caps.drop all
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue