github-starred/firejail
2
0
Fork 0
mirror of https://github.com/netblue30/firejail.git synced 2026-05-21 06:45:29 -06:00
Code Issues 531 Projects Packages Wiki Activity Actions 1

Refactor archivers ii (#3827)

Browse source 
* harden 7z.profile

* harden atool.profile

* harden bsdtar.profile

* harden cpio.profile

* harden gzip.profile

* harden tar.profile

* harden unrar.profile

* harden unzip.profile

* harden xzdec.profile

* harden zstd.profile
This commit is contained in:
glitsj16 2020-12-15 20:06:10 +00:00 • committed by GitHub
parent 4a40e2a5f2
commit 95ad89d24e
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 8 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

6
etc/profile-a-l/7z.profile
View file

@ -7,8 +7,8 @@ include 7z.local
# Persistent global definitions
include globals.local
ignore include disable-shell.inc
ignore nogroups
noblacklist ${PATH}/bash
noblacklist ${PATH}/sh
include archiver-common.inc
#private-bin 7z,7z*,p7zip
private-bin 7z,7z*,bash,p7zip,sh

3
etc/profile-a-l/atool.profile
View file

@ -9,13 +9,10 @@ include globals.local
# Allow perl (blacklisted by disable-interpreters.inc)
include allow-perl.inc
ignore include disable-devel.inc
ignore include disable-shell.inc
include archiver-common.inc
noroot
# private-bin atool,perl
# without login.defs atool complains and uses UID/GID 1000 by default
private-etc alternatives,group,login.defs,passwd
private-tmp

2
etc/profile-a-l/bsdtar.profile
View file

@ -6,8 +6,6 @@ include bsdtar.local
# Persistent global definitions
include globals.local
ignore include disable-devel.inc
ignore include disable-shell.inc
include archiver-common.inc
# support compressed archives

3
etc/profile-a-l/cpio.profile
View file

@ -10,7 +10,4 @@ include globals.local
noblacklist /sbin
noblacklist /usr/sbin
ignore include disable-devel.inc
ignore include disable-interpreters.inc
ignore include disable-shell.inc
include archiver-common.inc

3
etc/profile-a-l/gzip.profile
View file

@ -10,5 +10,6 @@ include globals.local
# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
noblacklist /var/lib/pacman
ignore include disable-shell.inc
include archiver-common.inc
private-bin gunzip,gzexe,gzip,uncompress,zcat,zcmp,zdiff,zegrep,zfgrep,zforce,zgrep,zless,zmore,znew

5
etc/profile-m-z/tar.profile
View file

@ -10,12 +10,13 @@ include globals.local
# Arch Linux (based distributions) need access to /var/lib/pacman. As we drop all capabilities this is automatically read-only.
noblacklist /var/lib/pacman
ignore include disable-shell.inc
noblacklist ${PATH}/bash
noblacklist ${PATH}/sh
include archiver-common.inc
# support compressed archives
private-bin awk,bash,bzip2,compress,firejail,grep,gtar,gzip,lbzip2,lzip,lzma,lzop,sh,tar,xz
private-etc alternatives,group,localtime,login.defs,passwd
private-lib libfakeroot
private-lib libfakeroot,liblzma.so.*,libreadline.so.*
# Debian based distributions need this for 'dpkg --unpack' (incl. synaptic)
writable-var

2
etc/profile-m-z/unrar.profile
View file

@ -7,8 +7,6 @@ include unrar.local
# Persistent global definitions
include globals.local
ignore nogroups
ignore private-cache
include archiver-common.inc
private-bin unrar

1
etc/profile-m-z/unzip.profile
View file

@ -10,7 +10,6 @@ include globals.local
# GNOME Shell integration (chrome-gnome-shell)
noblacklist ${HOME}/.local/share/gnome-shell
ignore nogroups
noroot
include archiver-common.inc

2
etc/profile-m-z/xzdec.profile
View file

@ -7,6 +7,4 @@ include xzdec.local
# Persistent global definitions
include globals.local
ignore include disable-shell.inc
ignore nogroups
include archiver-common.inc

1
etc/profile-m-z/zstd.profile
View file

@ -7,5 +7,4 @@ include zstd.local
# Persistent global definitions
include globals.local
ignore include disable-shell.inc
include archiver-common.inc