mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
compile time: enable LTS
This commit is contained in:
startx2017
parent
72ba0b7e5e
commit
d1acb31c97
4 changed files with 178 additions and 20 deletions
100
configure
vendored
100
configure
vendored
|
|
@ -627,7 +627,7 @@ LIBOBJS
|
|||
EGREP
|
||||
GREP
|
||||
CPP
|
||||
HAVE_SELINUX
|
||||
HAVE_LTS
|
||||
HAVE_CONTRIB_INSTALL
|
||||
HAVE_GCOV
|
||||
BUSYBOX_WORKAROUND
|
||||
|
|
@ -650,6 +650,7 @@ HAVE_OVERLAYFS
|
|||
HAVE_DBUSPROXY
|
||||
EXTRA_LDFLAGS
|
||||
EXTRA_CFLAGS
|
||||
HAVE_SELINUX
|
||||
HAVE_APPARMOR
|
||||
AA_LIBS
|
||||
AA_CFLAGS
|
||||
|
|
@ -711,6 +712,7 @@ ac_user_opts='
|
|||
enable_option_checking
|
||||
enable_analyzer
|
||||
enable_apparmor
|
||||
enable_selinux
|
||||
enable_dbusproxy
|
||||
enable_output
|
||||
enable_usertmpfs
|
||||
|
|
@ -729,7 +731,7 @@ enable_fatal_warnings
|
|||
enable_busybox_workaround
|
||||
enable_gcov
|
||||
enable_contrib_install
|
||||
enable_selinux
|
||||
enable_lts
|
||||
'
|
||||
ac_precious_vars='build_alias
|
||||
host_alias
|
||||
|
|
@ -1367,6 +1369,7 @@ Optional Features:
|
|||
--enable-FEATURE[=ARG] include FEATURE [ARG=yes]
|
||||
--enable-analyzer enable GCC 10 static analyzer
|
||||
--enable-apparmor enable apparmor
|
||||
--enable-selinux SELinux labeling support
|
||||
--disable-dbusproxy disable dbus proxy
|
||||
--disable-output disable --output logging
|
||||
--disable-usertmpfs disable tmpfs as regular user
|
||||
|
|
@ -1388,7 +1391,7 @@ Optional Features:
|
|||
--enable-gcov Gcov instrumentation
|
||||
--enable-contrib-install
|
||||
install contrib scripts
|
||||
--enable-selinux SELinux labeling support
|
||||
--enable-lts enable long-term support software version (LTS)
|
||||
|
||||
Some influential environment variables:
|
||||
CC C compiler command
|
||||
|
|
@ -3514,6 +3517,20 @@ fi
|
|||
|
||||
fi
|
||||
|
||||
HAVE_SELINUX=""
|
||||
# Check whether --enable-selinux was given.
|
||||
if test "${enable_selinux+set}" = set; then :
|
||||
enableval=$enable_selinux;
|
||||
fi
|
||||
|
||||
if test "x$enable_selinux" = "xyes"; then :
|
||||
|
||||
HAVE_SELINUX="-DHAVE_SELINUX"
|
||||
EXTRA_LDFLAGS+=" -lselinux "
|
||||
|
||||
|
||||
fi
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
@ -3808,20 +3825,67 @@ else
|
|||
fi
|
||||
|
||||
|
||||
HAVE_SELINUX=""
|
||||
# Check whether --enable-selinux was given.
|
||||
if test "${enable_selinux+set}" = set; then :
|
||||
enableval=$enable_selinux;
|
||||
HAVE_LTS=""
|
||||
# Check whether --enable-lts was given.
|
||||
if test "${enable_lts+set}" = set; then :
|
||||
enableval=$enable_lts;
|
||||
fi
|
||||
|
||||
if test "x$enable_selinux" = "xyes"; then :
|
||||
if test "x$enable_lts" = "xyes"; then :
|
||||
|
||||
HAVE_SELINUX="-DHAVE_SELINUX"
|
||||
EXTRA_LDFLAGS+=" -lselinux "
|
||||
HAVE_LTS="-DHAVE_LTS"
|
||||
|
||||
|
||||
HAVE_DBUSPROXY=""
|
||||
|
||||
|
||||
HAVE_OVERLAYFS=""
|
||||
|
||||
|
||||
HAVE_OUTPUT=""
|
||||
|
||||
|
||||
HAVE_USERTMPFS=""
|
||||
|
||||
|
||||
HAVE_MAN="-DHAVE_MAN"
|
||||
|
||||
|
||||
HAVE_FIRETUNNEL=""
|
||||
|
||||
|
||||
HAVE_PRIVATEHOME=""
|
||||
|
||||
|
||||
HAVE_CHROOT=""
|
||||
|
||||
|
||||
HAVE_GLOBALCFG=""
|
||||
|
||||
|
||||
HAVE_USERNS=""
|
||||
|
||||
|
||||
HAVE_X11=""
|
||||
|
||||
|
||||
HAVE_FILE_TRANSFER=""
|
||||
|
||||
|
||||
HAVE_SUID="yes"
|
||||
|
||||
|
||||
BUSYBOX_WORKAROUND="no"
|
||||
|
||||
|
||||
HAVE_CONTRIB_INSTALL="no",
|
||||
|
||||
|
||||
fi
|
||||
|
||||
|
||||
|
||||
|
||||
# checking pthread library
|
||||
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for main in -lpthread" >&5
|
||||
$as_echo_n "checking for main in -lpthread... " >&6; }
|
||||
|
|
@ -5485,6 +5549,7 @@ echo "Configuration options:"
|
|||
echo " prefix: $prefix"
|
||||
echo " sysconfdir: $sysconfdir"
|
||||
echo " apparmor: $HAVE_APPARMOR"
|
||||
echo " SELinux labeling support: $HAVE_SELINUX"
|
||||
echo " global config: $HAVE_GLOBALCFG"
|
||||
echo " chroot: $HAVE_CHROOT"
|
||||
echo " network: $HAVE_NETWORK"
|
||||
|
|
@ -5506,6 +5571,19 @@ echo " EXTRA_CFLAGS: $EXTRA_CFLAGS"
|
|||
echo " fatal warnings: $HAVE_FATAL_WARNINGS"
|
||||
echo " Gcov instrumentation: $HAVE_GCOV"
|
||||
echo " Install contrib scripts: $HAVE_CONTRIB_INSTALL"
|
||||
echo " SELinux labeling support: $HAVE_SELINUX"
|
||||
echo " Install as a SUID executable: $HAVE_SUID"
|
||||
echo " LTS: $HAVE_LTS"
|
||||
echo
|
||||
|
||||
|
||||
if test "$HAVE_LTS" = -DHAVE_LTS; then
|
||||
echo
|
||||
echo
|
||||
echo "*********************************************************"
|
||||
echo "* Warning: Long-term support (LTS) was enabled! *"
|
||||
echo "* Most compile-time options have bean rewritten! *"
|
||||
echo "*********************************************************"
|
||||
echo
|
||||
echo
|
||||
fi
|
||||
|
||||
|
|
|
|||
86
configure.ac
86
configure.ac
|
|
@ -54,6 +54,15 @@ AS_IF([test "x$enable_apparmor" = "xyes"], [
|
|||
AC_SUBST(HAVE_APPARMOR)
|
||||
])
|
||||
|
||||
HAVE_SELINUX=""
|
||||
AC_ARG_ENABLE([selinux],
|
||||
AS_HELP_STRING([--enable-selinux], [SELinux labeling support]))
|
||||
AS_IF([test "x$enable_selinux" = "xyes"], [
|
||||
HAVE_SELINUX="-DHAVE_SELINUX"
|
||||
EXTRA_LDFLAGS+=" -lselinux "
|
||||
AC_SUBST(HAVE_SELINUX)
|
||||
])
|
||||
|
||||
AC_SUBST([EXTRA_CFLAGS])
|
||||
AC_SUBST([EXTRA_LDFLAGS])
|
||||
|
||||
|
|
@ -219,15 +228,62 @@ AS_IF([test "x$enable_contrib_install" = "xno"],
|
|||
)
|
||||
AC_SUBST(HAVE_CONTRIB_INSTALL)
|
||||
|
||||
HAVE_SELINUX=""
|
||||
AC_ARG_ENABLE([selinux],
|
||||
AS_HELP_STRING([--enable-selinux], [SELinux labeling support]))
|
||||
AS_IF([test "x$enable_selinux" = "xyes"], [
|
||||
HAVE_SELINUX="-DHAVE_SELINUX"
|
||||
EXTRA_LDFLAGS+=" -lselinux "
|
||||
AC_SUBST(HAVE_SELINUX)
|
||||
HAVE_LTS=""
|
||||
AC_ARG_ENABLE([lts],
|
||||
AS_HELP_STRING([--enable-lts], [enable long-term support software version (LTS)]))
|
||||
AS_IF([test "x$enable_lts" = "xyes"], [
|
||||
HAVE_LTS="-DHAVE_LTS"
|
||||
AC_SUBST(HAVE_LTS)
|
||||
|
||||
HAVE_DBUSPROXY=""
|
||||
AC_SUBST(HAVE_DBUSPROXY)
|
||||
|
||||
HAVE_OVERLAYFS=""
|
||||
AC_SUBST(HAVE_OVERLAYFS)
|
||||
|
||||
HAVE_OUTPUT=""
|
||||
AC_SUBST(HAVE_OUTPUT)
|
||||
|
||||
HAVE_USERTMPFS=""
|
||||
AC_SUBST(HAVE_USERTMPFS)
|
||||
|
||||
HAVE_MAN="-DHAVE_MAN"
|
||||
AC_SUBST(HAVE_MAN)
|
||||
|
||||
HAVE_FIRETUNNEL=""
|
||||
AC_SUBST(HAVE_FIRETUNNEL)
|
||||
|
||||
HAVE_PRIVATEHOME=""
|
||||
AC_SUBST(HAVE_PRIVATE_HOME)
|
||||
|
||||
HAVE_CHROOT=""
|
||||
AC_SUBST(HAVE_CHROOT)
|
||||
|
||||
HAVE_GLOBALCFG=""
|
||||
AC_SUBST(HAVE_GLOBALCFG)
|
||||
|
||||
HAVE_USERNS=""
|
||||
AC_SUBST(HAVE_USERNS)
|
||||
|
||||
HAVE_X11=""
|
||||
AC_SUBST(HAVE_X11)
|
||||
|
||||
HAVE_FILE_TRANSFER=""
|
||||
AC_SUBST(HAVE_FILE_TRANSFER)
|
||||
|
||||
HAVE_SUID="yes"
|
||||
AC_SUBST(HAVE_SUID)
|
||||
|
||||
BUSYBOX_WORKAROUND="no"
|
||||
AC_SUBST(BUSYBOX_WORKAROUND)
|
||||
|
||||
HAVE_CONTRIB_INSTALL="no",
|
||||
AC_SUBST(HAVE_CONTRIB_INSTALL)
|
||||
])
|
||||
|
||||
|
||||
|
||||
|
||||
# checking pthread library
|
||||
AC_CHECK_LIB([pthread], [main], [], AC_MSG_ERROR([*** POSIX thread support not installed ***]))
|
||||
AC_CHECK_HEADER(pthread.h,,AC_MSG_ERROR([*** POSIX thread support not installed ***]))
|
||||
|
|
@ -250,6 +306,7 @@ echo "Configuration options:"
|
|||
echo " prefix: $prefix"
|
||||
echo " sysconfdir: $sysconfdir"
|
||||
echo " apparmor: $HAVE_APPARMOR"
|
||||
echo " SELinux labeling support: $HAVE_SELINUX"
|
||||
echo " global config: $HAVE_GLOBALCFG"
|
||||
echo " chroot: $HAVE_CHROOT"
|
||||
echo " network: $HAVE_NETWORK"
|
||||
|
|
@ -271,6 +328,19 @@ echo " EXTRA_CFLAGS: $EXTRA_CFLAGS"
|
|||
echo " fatal warnings: $HAVE_FATAL_WARNINGS"
|
||||
echo " Gcov instrumentation: $HAVE_GCOV"
|
||||
echo " Install contrib scripts: $HAVE_CONTRIB_INSTALL"
|
||||
echo " SELinux labeling support: $HAVE_SELINUX"
|
||||
echo " Install as a SUID executable: $HAVE_SUID"
|
||||
echo " LTS: $HAVE_LTS"
|
||||
echo
|
||||
|
||||
|
||||
if test "$HAVE_LTS" = -DHAVE_LTS; then
|
||||
echo
|
||||
echo
|
||||
echo "*********************************************************"
|
||||
echo "* Warning: Long-term support (LTS) was enabled! *"
|
||||
echo "* Most compile-time options have bean rewritten! *"
|
||||
echo "*********************************************************"
|
||||
echo
|
||||
echo
|
||||
fi
|
||||
|
||||
|
|
|
|||
|
|
@ -26,6 +26,7 @@ HAVE_SELINUX=@HAVE_SELINUX@
|
|||
HAVE_DBUSPROXY=@HAVE_DBUSPROXY@
|
||||
HAVE_USERTMPFS=@HAVE_USERTMPFS@
|
||||
HAVE_OUTPUT=@HAVE_OUTPUT@
|
||||
HAVE_LTS=@HAVE_LTS@
|
||||
|
||||
H_FILE_LIST = $(sort $(wildcard *.[h]))
|
||||
C_FILE_LIST = $(sort $(wildcard *.c))
|
||||
|
|
@ -35,7 +36,7 @@ BINOBJS = $(foreach file, $(OBJS), $file)
|
|||
CFLAGS = @CFLAGS@
|
||||
CFLAGS += -ggdb $(HAVE_FATAL_WARNINGS) -O2 -DVERSION='"$(VERSION)"' $(HAVE_GCOV)
|
||||
CFLAGS += -DPREFIX='"$(prefix)"' -DSYSCONFDIR='"$(sysconfdir)/firejail"' -DLIBDIR='"$(libdir)"' -DBINDIR='"$(bindir)"'
|
||||
MANFLAGS = $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX)
|
||||
MANFLAGS = $(HAVE_LTS) $(HAVE_OUTPUT) $(HAVE_X11) $(HAVE_PRIVATE_HOME) $(HAVE_APPARMOR) $(HAVE_OVERLAYFS) $(HAVE_USERTMPFS) $(HAVE_DBUSPROXY) $(HAVE_FIRETUNNEL) $(HAVE_GLOBALCFG) $(HAVE_CHROOT) $(HAVE_NETWORK) $(HAVE_USERNS) $(HAVE_FILE_TRANSFER) $(HAVE_WHITELIST) $(HAVE_SELINUX)
|
||||
CFLAGS += $(MANFLAGS)
|
||||
CFLAGS += -fstack-protector-all -D_FORTIFY_SOURCE=2 -fPIE -Wformat -Wformat-security
|
||||
LDFLAGS += -pie -fPIE -Wl,-z,relro -Wl,-z,now -lpthread
|
||||
|
|
|
|||
|
|
@ -42,6 +42,15 @@ Miscellaneous:
|
|||
firejail {\-? | \-\-debug-caps | \-\-debug-errnos | \-\-debug-syscalls | \-\-debug-syscalls32 | \-\-debug-protocols | \-\-help | \-\-version}
|
||||
.RE
|
||||
.SH DESCRIPTION
|
||||
#ifdef HAVE_LTS
|
||||
This is Firejail long-term support (LTS), an enterprise focused version of the software,
|
||||
LTS is usually supported for two or three years.
|
||||
During this time only bugs and the occasional documentation problems are fixed.
|
||||
The attack surface of the SUID executable was greatly reduced by removing some of the features.
|
||||
.br
|
||||
|
||||
.br
|
||||
#endif
|
||||
Firejail is a SUID sandbox program that reduces the risk of security breaches by
|
||||
restricting the running environment of untrusted applications using Linux
|
||||
namespaces, seccomp-bpf and Linux capabilities.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue