mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
profiles: add llm-agent-common.inc (#7158)
Note: This also sets `env NO_BROWSER=true` in pi.profile.
This commit is contained in:
Amin Vakil
GitHub
parent
46a111166e
commit
c81777164c
6 changed files with 70 additions and 157 deletions
1
README
1
README
|
|
@ -167,6 +167,7 @@ Amin Vakil (https://github.com/aminvakil)
|
|||
- new profile: gemini (#6936)
|
||||
- new profile: opencode (#7135)
|
||||
- new profile: pi (#7136)
|
||||
- profiles: add llm-agent-common.inc (#7158)
|
||||
Ammon Smith (https://github.com/ammongit)
|
||||
- Add DBus filter rules specific to firefox-developer-edition
|
||||
Andreas Hunkeler (https://github.com/Karneades)
|
||||
|
|
|
|||
1
RELNOTES
1
RELNOTES
|
|
@ -24,6 +24,7 @@ firejail (0.9.81) baseline; urgency=low
|
|||
* profiles: firefox-common: allow auto light/dark theme switching (#7103)
|
||||
* profiles: steam: allow more 3d cache paths (#7149)
|
||||
* profiles: torbrowser-launcher: add no3d (#7143)
|
||||
* profiles: add llm-agent-common.inc (#7158)
|
||||
* new profile: gemini (#6936)
|
||||
* new profile: opencode (#7135)
|
||||
* new profile: pi (#7136)
|
||||
|
|
|
|||
62
etc/inc/llm-agent-common.inc
Normal file
62
etc/inc/llm-agent-common.inc
Normal file
|
|
@ -0,0 +1,62 @@
|
|||
# Firejail profile for llm-agent-common
|
||||
# Description: Common profile for LLM agents
|
||||
# This file is overwritten after every install/update
|
||||
# Persistent local customizations
|
||||
include llm-agent-common.local
|
||||
# Persistent global definitions
|
||||
# added by caller profile
|
||||
#include globals.local
|
||||
|
||||
# Allow /bin/sh (blacklisted by disable-shell.inc)
|
||||
include allow-bin-sh.inc
|
||||
|
||||
# Allows files commonly used by IDEs
|
||||
include allow-common-devel.inc
|
||||
|
||||
# Allow ssh (blacklisted by disable-common.inc)
|
||||
include allow-ssh.inc
|
||||
|
||||
blacklist ${RUNUSER}
|
||||
|
||||
include disable-common.inc
|
||||
include disable-proc.inc
|
||||
include disable-programs.inc
|
||||
include disable-x11.inc
|
||||
include disable-xdg.inc
|
||||
|
||||
whitelist ${RUNUSER}/openssh_agent
|
||||
include whitelist-run-common.inc
|
||||
#include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
caps.drop all
|
||||
ipc-namespace
|
||||
machine-id
|
||||
netfilter
|
||||
no3d
|
||||
nodvd
|
||||
nogroups
|
||||
noinput
|
||||
nonewprivs
|
||||
noprinters
|
||||
noroot
|
||||
nosound
|
||||
notv
|
||||
nou2f
|
||||
novideo
|
||||
protocol unix,inet,inet6,netlink
|
||||
seccomp
|
||||
seccomp.block-secondary
|
||||
tracelog
|
||||
|
||||
disable-mnt
|
||||
private-cache
|
||||
private-dev
|
||||
private-etc @network,@tls-ca
|
||||
private-tmp
|
||||
|
||||
dbus-user none
|
||||
dbus-system none
|
||||
|
||||
env NO_BROWSER=true
|
||||
restrict-namespaces
|
||||
|
|
@ -9,23 +9,6 @@ include globals.local
|
|||
|
||||
noblacklist ${HOME}/.gemini
|
||||
|
||||
# Allow /bin/sh (blacklisted by disable-shell.inc)
|
||||
include allow-bin-sh.inc
|
||||
|
||||
# Allows files commonly used by IDEs
|
||||
include allow-common-devel.inc
|
||||
|
||||
# Allow ssh (blacklisted by disable-common.inc)
|
||||
include allow-ssh.inc
|
||||
|
||||
blacklist ${RUNUSER}
|
||||
|
||||
include disable-common.inc
|
||||
include disable-proc.inc
|
||||
include disable-programs.inc
|
||||
include disable-x11.inc
|
||||
include disable-xdg.inc
|
||||
|
||||
# Add the following lines to gemini.local to enable whitelisting in `${HOME}`.
|
||||
#whitelist ${HOME}/.config/git
|
||||
#whitelist ${HOME}/.gemini
|
||||
|
|
@ -34,39 +17,5 @@ include disable-xdg.inc
|
|||
#whitelist ${HOME}/.gitconfig
|
||||
#include whitelist-common.inc
|
||||
|
||||
whitelist ${RUNUSER}/openssh_agent
|
||||
include whitelist-run-common.inc
|
||||
#include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
caps.drop all
|
||||
ipc-namespace
|
||||
machine-id
|
||||
netfilter
|
||||
no3d
|
||||
nodvd
|
||||
nogroups
|
||||
noinput
|
||||
nonewprivs
|
||||
noprinters
|
||||
noroot
|
||||
nosound
|
||||
notv
|
||||
nou2f
|
||||
novideo
|
||||
protocol unix,inet,inet6,netlink
|
||||
seccomp
|
||||
seccomp.block-secondary
|
||||
tracelog
|
||||
|
||||
disable-mnt
|
||||
private-cache
|
||||
private-dev
|
||||
private-etc @network,@tls-ca
|
||||
private-tmp
|
||||
|
||||
dbus-user none
|
||||
dbus-system none
|
||||
|
||||
env NO_BROWSER=true
|
||||
restrict-namespaces
|
||||
# Redirect
|
||||
include llm-agent-common.inc
|
||||
|
|
|
|||
|
|
@ -12,23 +12,6 @@ noblacklist ${HOME}/.config/opencode
|
|||
noblacklist ${HOME}/.local/share/opencode
|
||||
noblacklist ${HOME}/.local/state/opencode
|
||||
|
||||
# Allow /bin/sh (blacklisted by disable-shell.inc)
|
||||
include allow-bin-sh.inc
|
||||
|
||||
# Allows files commonly used by IDEs
|
||||
include allow-common-devel.inc
|
||||
|
||||
# Allow ssh (blacklisted by disable-common.inc)
|
||||
include allow-ssh.inc
|
||||
|
||||
blacklist ${RUNUSER}
|
||||
|
||||
include disable-common.inc
|
||||
include disable-proc.inc
|
||||
include disable-programs.inc
|
||||
include disable-x11.inc
|
||||
include disable-xdg.inc
|
||||
|
||||
# Add the following lines to opencode.local to enable whitelisting in `${HOME}`.
|
||||
#mkdir ${HOME}/.cache/opencode
|
||||
#mkdir ${HOME}/.config/opencode
|
||||
|
|
@ -42,40 +25,7 @@ include disable-xdg.inc
|
|||
#whitelist ${HOME}/.local/state/opencode
|
||||
#include whitelist-common.inc
|
||||
|
||||
whitelist ${RUNUSER}/openssh_agent
|
||||
include whitelist-run-common.inc
|
||||
#include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
apparmor
|
||||
caps.drop all
|
||||
ipc-namespace
|
||||
machine-id
|
||||
netfilter
|
||||
no3d
|
||||
nodvd
|
||||
nogroups
|
||||
noinput
|
||||
nonewprivs
|
||||
noprinters
|
||||
noroot
|
||||
nosound
|
||||
notv
|
||||
nou2f
|
||||
novideo
|
||||
protocol unix,inet,inet6,netlink
|
||||
seccomp
|
||||
seccomp.block-secondary
|
||||
tracelog
|
||||
|
||||
disable-mnt
|
||||
private-cache
|
||||
private-dev
|
||||
private-etc @network,@tls-ca
|
||||
private-tmp
|
||||
|
||||
dbus-user none
|
||||
dbus-system none
|
||||
|
||||
env NO_BROWSER=true
|
||||
restrict-namespaces
|
||||
# Redirect
|
||||
include llm-agent-common.inc
|
||||
|
|
|
|||
|
|
@ -10,23 +10,6 @@ include globals.local
|
|||
noblacklist ${HOME}/.agents
|
||||
noblacklist ${HOME}/.pi
|
||||
|
||||
# Allow /bin/sh (blacklisted by disable-shell.inc)
|
||||
include allow-bin-sh.inc
|
||||
|
||||
# Allows files commonly used by IDEs
|
||||
include allow-common-devel.inc
|
||||
|
||||
# Allow ssh (blacklisted by disable-common.inc)
|
||||
include allow-ssh.inc
|
||||
|
||||
blacklist ${RUNUSER}
|
||||
|
||||
include disable-common.inc
|
||||
include disable-proc.inc
|
||||
include disable-programs.inc
|
||||
include disable-x11.inc
|
||||
include disable-xdg.inc
|
||||
|
||||
# Add the following lines to pi.local to enable whitelisting in `${HOME}`.
|
||||
#mkdir ${HOME}/.agents
|
||||
#mkdir ${HOME}/.pi
|
||||
|
|
@ -36,38 +19,5 @@ include disable-xdg.inc
|
|||
#whitelist ${HOME}/.pi
|
||||
#include whitelist-common.inc
|
||||
|
||||
whitelist ${RUNUSER}/openssh_agent
|
||||
include whitelist-run-common.inc
|
||||
#include whitelist-usr-share-common.inc
|
||||
include whitelist-var-common.inc
|
||||
|
||||
caps.drop all
|
||||
ipc-namespace
|
||||
machine-id
|
||||
netfilter
|
||||
no3d
|
||||
nodvd
|
||||
nogroups
|
||||
noinput
|
||||
nonewprivs
|
||||
noprinters
|
||||
noroot
|
||||
nosound
|
||||
notv
|
||||
nou2f
|
||||
novideo
|
||||
protocol unix,inet,inet6,netlink
|
||||
seccomp
|
||||
seccomp.block-secondary
|
||||
tracelog
|
||||
|
||||
disable-mnt
|
||||
private-cache
|
||||
private-dev
|
||||
private-etc @network,@tls-ca
|
||||
private-tmp
|
||||
|
||||
dbus-user none
|
||||
dbus-system none
|
||||
|
||||
restrict-namespaces
|
||||
# Redirect
|
||||
include llm-agent-common.inc
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue