From ef4409e7b79b3dabf5a35879138d66b0b8a0c24d Mon Sep 17 00:00:00 2001 From: startx2017 Date: Thu, 30 Aug 2018 07:29:05 -0400 Subject: [PATCH] added whois and dig profiles --- README.md | 2 +- RELNOTES | 2 +- etc/dig.profile | 47 +++++++++++++++++++++++++++++++++ etc/whois.profile | 45 +++++++++++++++++++++++++++++++ src/firecfg/firecfg.config | 2 ++ test/private-lib/dig.exp | 17 ++++++++++++ test/private-lib/private-lib.sh | 2 +- test/private-lib/whois.exp | 17 ++++++++++++ 8 files changed, 131 insertions(+), 3 deletions(-) create mode 100644 etc/dig.profile create mode 100644 etc/whois.profile create mode 100755 test/private-lib/dig.exp create mode 100755 test/private-lib/whois.exp diff --git a/README.md b/README.md index 3a76dbf50..89b85a09a 100644 --- a/README.md +++ b/README.md @@ -167,4 +167,4 @@ We also keep a list of profile fixes for previous released versions in [etc-fixe ## New profiles Microsoft Office Online, riot-desktop, gnome-mpv, snox, gradio, standardnotes-desktop, shellcheck, patch, flameshot, rview, rvim, vimcat, vimdiff, vimpager, vimtutor, -xxd, Beaker, electrum, clamtk, pybitmessage +xxd, Beaker, electrum, clamtk, pybitmessage, dig, whois diff --git a/RELNOTES b/RELNOTES index cf9d95982..74c7551f5 100644 --- a/RELNOTES +++ b/RELNOTES @@ -19,7 +19,7 @@ firejail (0.9.56~rc1) baseline; urgency=low * new profiles: ms-skype, ms-word, riot-desktop, gnome-mpv, snox, gradio, * new profiles: standardnotes-desktop, shellcheck, patch, flameshot, * new profiles: rview, rvim, vimcat, vimdiff, vimpager, vimtutor, xxd, - * new profiles: Beaker, electrum, clamtk, pybitmessage + * new profiles: Beaker, electrum, clamtk, pybitmessage, dig, whois -- netblue30 Sat, 11 Aug 2018 08:00:00 -0500 firejail (0.9.54) baseline; urgency=low diff --git a/etc/dig.profile b/etc/dig.profile new file mode 100644 index 000000000..4b6ab0975 --- /dev/null +++ b/etc/dig.profile @@ -0,0 +1,47 @@ +quiet +# Firejail profile for dig +# This file is overwritten after every install/update +# Persistent local customizations +include /etc/firejail/dig.local +# Persistent global definitions +include /etc/firejail/globals.local + +include /etc/firejail/disable-common.inc +# include /etc/firejail/disable-devel.inc +# include /etc/firejail/disable-interpreters.inc +include /etc/firejail/disable-passwdmgr.inc +include /etc/firejail/disable-programs.inc +#include /etc/firejail/disable-xdg.inc + +whitelist ~/.digrc +include /etc/firejail/whitelist-common.inc +include /etc/firejail/whitelist-var-common.inc + +caps.drop all +# ipc-namespace +netfilter +no3d +nodbus +nodvd +nogroups +nonewprivs +noroot +nosound +notv +novideo +protocol unix,inet,inet6 +seccomp +shell none + +disable-mnt +private +private-bin sh,bash,dig +private-cache +private-dev +# private-etc resolv.conf +private-lib +private-tmp + +memory-deny-write-execute +# noexec ${HOME} +# noexec /tmp diff --git a/etc/whois.profile b/etc/whois.profile new file mode 100644 index 000000000..3ef2e1476 --- /dev/null +++ b/etc/whois.profile @@ -0,0 +1,45 @@ +quiet +# Firejail profile for whois +# This file is overwritten after every install/update +# Persistent local customizations +include /etc/firejail/whois.local +# Persistent global definitions +include /etc/firejail/globals.local + +include /etc/firejail/disable-common.inc +# include /etc/firejail/disable-devel.inc +# include /etc/firejail/disable-interpreters.inc +include /etc/firejail/disable-passwdmgr.inc +include /etc/firejail/disable-programs.inc +#include /etc/firejail/disable-xdg.inc + +include /etc/firejail/whitelist-var-common.inc + +caps.drop all +# ipc-namespace +netfilter +no3d +nodbus +nodvd +nogroups +nonewprivs +noroot +nosound +notv +novideo +protocol inet,inet6 +seccomp +shell none + +disable-mnt +private +private-bin sh,bash,whois +private-cache +private-dev +# private-etc hosts,services,whois.conf +private-lib +private-tmp + +memory-deny-write-execute +# noexec ${HOME} +# noexec /tmp diff --git a/src/firecfg/firecfg.config b/src/firecfg/firecfg.config index 0bbafb343..5ae1c28cd 100644 --- a/src/firecfg/firecfg.config +++ b/src/firecfg/firecfg.config @@ -94,6 +94,7 @@ deadbeef deluge dex2jar dia +dig digikam dillo dino @@ -442,6 +443,7 @@ weechat weechat-curses wesnoth wget +whois wine wire-desktop wireshark diff --git a/test/private-lib/dig.exp b/test/private-lib/dig.exp new file mode 100755 index 000000000..6e03b0503 --- /dev/null +++ b/test/private-lib/dig.exp @@ -0,0 +1,17 @@ +#!/usr/bin/expect -f +# This file is part of Firejail project +# Copyright (C) 2014-2018 Firejail Authors +# License GPL v2 + +set timeout 10 +spawn $env(SHELL) +match_max 100000 + +send -- "firejail dig 1.1.1.1\r" +expect { + timeout {puts "TESTING ERROR 0\n";exit} + "Query time" +} + +after 100 +puts "\nall done\n" diff --git a/test/private-lib/private-lib.sh b/test/private-lib/private-lib.sh index edf81917a..5d23ebe88 100755 --- a/test/private-lib/private-lib.sh +++ b/test/private-lib/private-lib.sh @@ -5,7 +5,7 @@ export MALLOC_CHECK_=3 export MALLOC_PERTURB_=$(($RANDOM % 255 + 1)) -LIST="evince galculator gnome-calculator gedit leafpad mousepad pluma transmission-gtk xcalc atril gpicview eom eog" +LIST="dig whois evince galculator gnome-calculator gedit leafpad mousepad pluma transmission-gtk xcalc atril gpicview eom eog" for app in $LIST; do diff --git a/test/private-lib/whois.exp b/test/private-lib/whois.exp new file mode 100755 index 000000000..6807b7cc2 --- /dev/null +++ b/test/private-lib/whois.exp @@ -0,0 +1,17 @@ +#!/usr/bin/expect -f +# This file is part of Firejail project +# Copyright (C) 2014-2018 Firejail Authors +# License GPL v2 + +set timeout 10 +spawn $env(SHELL) +match_max 100000 + +send -- "firejail whois debian.org\r" +expect { + timeout {puts "TESTING ERROR 0\n";exit} + "Domain Name" +} + +after 100 +puts "\nall done\n"