Kelvin M. Klann
18f5d335f2
test/apps: fix wrong program names in messages
...
Build / build (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
This amends commit 1c54aadb6
2026-06-29 03:31:21 -03:00
Kelvin M. Klann
e6943245ac
profiles: disable-common: fix dpkg comment
...
Build / build (push) Waiting to run
Codespell / codespell (push) Waiting to run
Test / test-main (push) Waiting to run
Test / test-fs (push) Waiting to run
Test / test-environment (push) Waiting to run
Test / test-utils (push) Waiting to run
Test / test-network (push) Waiting to run
Check-Profiles / profile-checks (push) Has been cancelled
This amends commit 6c0ec7cce#5987 .
2026-06-29 03:05:18 -03:00
netblue30
1c54aadb6f
testing
2026-06-28 19:34:28 -04:00
netblue30
01ac6260f7
profile fixes (Arch)
Build / build (push) Waiting to run
Check-Profiles / profile-checks (push) Waiting to run
Codespell / codespell (push) Waiting to run
2026-06-28 10:02:00 -04:00
Kelvin M. Klann
8baad2bebf
profiles: profile.template: fix leading comments
...
Build / build (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
This amends commit 925bba49a#7172 .
2026-06-24 19:24:47 -03:00
netblue30
6c0ec7cce0
remove dpkg blacklist from disable-common.inc
Build / build (push) Waiting to run
Check-Profiles / profile-checks (push) Waiting to run
Codespell / codespell (push) Waiting to run
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
2026-06-24 06:18:13 -04:00
netblue30
a0f31ffe15
Merge pull request #7172 from kmk3/profile-template-improve-rules
...
profiles: templates: improve formatting & clarify rules
2026-06-24 06:08:36 -04:00
netblue30
925bba49ae
Merge branch 'master' into profile-template-improve-rules
2026-06-24 06:07:44 -04:00
netblue30
1527c3042e
Merge pull request #7186 from netblue30/fix-metachars
...
modif: add more metachars in `reject_meta_chars()`
2026-06-24 06:05:42 -04:00
pierretom
2b122d1947
remove the --color option in gen-syscalls.sh
...
Build / build (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
It was used for tests in the terminal and no longer required, because
Bash disables alias expansion in non-interactive shells.
2026-06-19 16:22:28 +02:00
Kelvin M. Klann
ad968e7ebf
common.c: add more metachars in reject_meta_chars()
...
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Build / build (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
Add:
* `#$|`
Ignore:
* `'()~`
Note: `,` does not appear to be a metacharacter, but it (and `%`) are
checked in test/fcopy/cmdline.exp. I'm not sure if they matter for
fcopy, so they are left as is.
Misc: `$` was suggested by @rusty-snake[1].
This is a follow-up to #7183 .
Relates to #3001 #3156 #4614 .
[1] https://github.com/netblue30/firejail/pull/7183#issuecomment-4709569497
2026-06-18 12:29:35 -03:00
Kelvin M. Klann
76d9dd7037
common.c: deduplicate metachar strings in reject_meta_chars()
2026-06-18 12:29:35 -03:00
pierretom
3725c08b2a
add allow-bwrap in profile.template
Build / build (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
2026-06-17 17:04:20 +02:00
Kelvin M. Klann
abe7313d29
common.c: sort metachar strings in reject_meta_chars()
2026-06-16 16:41:51 -03:00
Devon Kirk
ad655fe79f
bugfix: add missing backtick in reject_meta_chars() ( #7183 )
Build / build (push) Waiting to run
Check-Profiles / profile-checks (push) Waiting to run
Codespell / codespell (push) Waiting to run
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
2026-06-16 16:54:47 +00:00
sofoxe1
4e80550beb
profiles: lutris: fix proton compatibility ( #7181 )
...
umu: https://github.com/Open-Wine-Components/umu-launcher
seccomp based on this PR:
* #5017
2026-06-16 14:25:17 +00:00
Kelvin M. Klann
b3407c6cd0
profiles: inkscape: format comment
...
This amends commit 02a81c2f1#5987 .
2026-06-16 09:47:40 -03:00
netblue30
02a81c2f1c
gimp, inkscape profile fixes (Arch)
Build / build (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
2026-06-12 15:52:07 -04:00
netblue30
0447f1eeec
reverting: firecfg: add and use firejail-symlink wrapper
...
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Build / build (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
Most programs run fine, but I'm running into problems with a small number of them. Among them firefox and libreoffice. I'll bring it back after I figure out what's going on.
2026-06-10 12:40:11 -04:00
dependabot[bot]
ac36bb9e8b
build(deps): bump step-security/harden-runner from 2.19.0 to 2.19.4
...
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Build / build (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Check-Python / codeql-python (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner ) from 2.19.0 to 2.19.4.
- [Release notes](https://github.com/step-security/harden-runner/releases )
- [Commits](8d3c67de8e...9af89fc715
2026-06-02 01:22:04 +00:00
dependabot[bot]
a60f1504a0
build(deps): bump github/codeql-action from 4.35.2 to 4.36.0
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.35.2 to 4.36.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](95e58e9a2c...7211b7c807
2026-06-02 01:21:54 +00:00
netblue30
d5f761f0c4
fix add and use firejail-symlink wrapper - added support for make uninstall
Build-extra / build-gcc (push) Waiting to run
Build-extra / build-clang (push) Waiting to run
Build / build (push) Waiting to run
Check-C / scan-build (push) Waiting to run
Check-C / cppcheck (push) Waiting to run
Check-C / codeql-cpp (push) Waiting to run
Check-Profiles / profile-checks (push) Waiting to run
Codespell / codespell (push) Waiting to run
Test / test-main (push) Waiting to run
Test / test-fs (push) Waiting to run
Test / test-environment (push) Waiting to run
Test / test-utils (push) Waiting to run
Test / test-network (push) Waiting to run
2026-06-01 12:27:26 -04:00
netblue30
1e02263e35
Merge pull request #7142 from kmk3/add-firejail-symlink-exec
...
feature: firecfg: add and use firejail-symlink wrapper
2026-06-01 09:43:32 -04:00
netblue30
ec996e7b7d
Merge pull request #7148 from kmk3/build-remove-etc-fixes
...
build: remove etc-fixes directory
2026-06-01 09:42:11 -04:00
netblue30
d545e38dfe
Merge pull request #7131 from hlein/profile-man
...
profiles: man: add terminfo
2026-06-01 09:41:07 -04:00
Kelvin M. Klann
31eae2148f
profiles: profile.template: improve rules section
...
Improve wording/formatting and clarify that lines starting with `# `
should be copied to profiles and that lines starting with `## ` should
not.
2026-05-25 16:23:19 -03:00
Kelvin M. Klann
fed9405b73
profiles: templates: improve formatting
2026-05-25 16:23:18 -03:00
Kelvin M. Klann
37f96718f9
profiles: profile.template: fix inconsistent list indentation
2026-05-22 18:14:22 -03:00
Kelvin M. Klann
494846aa33
profiles: profile.template: join lines from header
...
For clarity and to make it easier to cut the top documentation section.
2026-05-22 18:14:22 -03:00
Kelvin M. Klann
6d95046e9c
profiles: templates: improve leading comments
...
Use `## ` for comments that should be ignored / not copied to profiles
and `# ` for comments that should.
This should clarify which lines are which when creating new profiles.
2026-05-22 18:14:22 -03:00
Amin Vakil
060b839387
new profile: claude ( #7169 )
...
Build / build (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
https://github.com/anthropics/claude-code
2026-05-22 15:29:23 +00:00
Kelvin M. Klann
7eda434483
RELNOTES: add feature, build, test, ci and profile items
...
Relates to #7157 #7159 #7160 #7162 #7163 #7164 #7166 #7167 .
2026-05-22 12:14:26 -03:00
Kelvin M. Klann
cccf4c46b5
RELNOTES: reword test item
...
For consistency with the more recent test items.
This amends commit 082956b4f#7147 .
2026-05-22 12:13:59 -03:00
Fidel Ramos
8c60e29c39
new profile: tldr ( #7166 )
...
Build / build (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
This is a profile for tldr official Python CLI:
* https://github.com/tldr-pages/tldr
* https://github.com/tldr-pages/tldr-python-client
It's working on my machine (Arch Linux) with stable Firejail (0.9.80). I tried
to make it as restrictive as possible, as it's only downloading files and
putting them in `~/.cache/tldr`.
2026-05-18 15:02:46 +00:00
Kelvin M. Klann
772b81809c
profiles: gemini: add mkdir ~/.gemini in whitelist comment
...
Build / build (push) Waiting to run
Check-Profiles / profile-checks (push) Waiting to run
Codespell / codespell (push) Waiting to run
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
This amends commit 3469e5de6#6936 )",
2026-05-01).
Misc: This was noticed on #7169 .
2026-05-17 16:04:53 -03:00
Kelvin M. Klann
f58990646e
test/fs: support and use XDG user dir env vars ( #7167 )
...
This should ensure that the tests work even if custom XDG user
directories are used (such as when set in `~/.config/user-dirs.dirs`).
The tests should work even if the relevant environment variables are
empty (or set to `$HOME`), though note that the setup commands in
test/fs/fs.sh likely still have to be executed before the .exp files are
executed.
Relates to #7147 #7163 .
2026-05-17 19:04:04 +00:00
Kelvin M. Klann
34f12c442e
feature: add ${PUBLICSHARE} and ${TEMPLATES} macros ( #7164 )
...
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Build / build (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
Add the following directories from the xdg-user-dirs specification[1]:
* `XDG_PUBLICSHARE_DIR="$HOME/Public"`
* `XDG_TEMPLATES_DIR="$HOME/Templates"`
With this, all directories from the specification are supported as
macros.
See also /etc/xdg/user-dirs.defaults.
Relates to #7157 #7163 .
[1] https://www.freedesktop.org/wiki/Software/xdg-user-dirs/
2026-05-15 13:11:54 +00:00
Kelvin M. Klann
2f722c85da
profiles: sort macros in profile.template
...
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Build / build (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
Added on commit d4f824519#2759 )",
2019-06-11).
Kind of relates to #7157 .
2026-05-13 11:32:56 -03:00
Kelvin M. Klann
ad89817c08
test/fs: deduplicate xdg dirs in macro tests ( #7163 )
...
To make it easier to add new directories.
Relates to #7147 .
2026-05-13 14:14:31 +00:00
orbisai0security
5b5952573f
build: netfilter.c: replace system() with execv() ( #7159 )
2026-05-13 13:48:27 +00:00
Kelvin M. Klann
f2df11ae37
ci: make all main make steps parallel and sync output ( #7162 )
...
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Build / build (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
Changes:
* Use `scan-build make` instead of running `scan-build` inside of `make`
(this appears to be necessary for the output synchronization to work)
* Use `-j "$(nproc)"` and `-Orecurse` for the main `make` step in all
jobs (including where this step is currently not parallel)
The main drawback of using parallel make (`-j`) is that the output of
different jobs may be printed interspersed, which makes the output
harder to read and less stable across multiple executions.
Example:
job1: line1
job1: line2
job2: line1
job3: line1
job1: line3
Using `-Orecurse` should fix this by ensuring that the output of all
jobs is still printed sequentially in the order that the jobs were
executed (that is, as if `-j` was not used), even if the jobs themselves
are executed in parallel.
This should ensure that the main `make` step in each job runs its
targets in parallel and has a stable output at the same time, making it
easier to compare the logs of the same job across different CI runs.
Note: The `-O` flag is specific to GNU make and was added in version 4.0
(2013-10-09).
Related commits:
* 500d8f2d6#5960
* 1f6400bd8#6222
2026-05-11 14:33:36 +00:00
Kelvin M. Klann
fce18b90f3
test/fs/fs.sh: fix typo of "root"
...
This amends commit 6b7d77c41
2026-05-11 11:09:00 -03:00
Kelvin M. Klann
98fe3af8ba
test/fs/macro-subpath.exp: fix permissions (644 -> 755)
...
The tests from this file are currently not even being executed in CI[1]:
TESTING: macro subpaths (test/fs/macro-subpath.exp)
./fs.sh: line 130: ./macro-subpath.exp: Permission denied
TESTING: whitelist empty (test/fs/whitelist-empty.exp)
This amends commit aff7cb630#7151 .
Relates to #7147 .
[1] https://github.com/netblue30/firejail/actions/runs/25602127293/job/75157737035
2026-05-11 11:08:51 -03:00
Kelvin M. Klann
9426ba79a2
test/fs/macro-subpath.exp: fix ls -> find
...
The whitelist test is currently broken[1]:
TESTING: macro subpaths (test/fs/macro-subpath.exp)
spawn /bin/bash
firejail --profile=./macro-subpath-whitelist.profile ls ~/Desktop/_firejail_test_dir [...]
[...]
/home/runner/Desktop/_firejail_test_dir:
a
[...]
Parent is shutting down, bye...
runner@runnervmrc6n4:~/work/firejail/firejail/test/fs$ TESTING ERROR 1.1 Desktop
This amends commit aff7cb630#7151 .
Relates to #7147 .
[1] https://github.com/netblue30/firejail/actions/runs/25638061680/job/75253423623
2026-05-11 11:08:39 -03:00
Kelvin M. Klann
0298a7eba7
profiles: use xdg macros with subpaths ( #7160 )
...
Commands used to search and replace:
$ git grep -IElz '\$\{HOME\}/(Desktop|Documents|Downloads|Music|Pictures|Projects|Videos)' -- etc |
xargs -0 perl -pi -e '
s/\$\{HOME\}\/Desktop/\${DESKTOP}/;
s/\$\{HOME\}\/Documents/\${DOCUMENTS}/;
s/\$\{HOME\}\/Downloads/\${DOWNLOADS}/;
s/\$\{HOME\}\/Music/\${MUSIC}/;
s/\$\{HOME\}\/Pictures/\${PICTURES}/;
s/\$\{HOME\}\/Projects/\${PROJECTS}/;
s/\$\{HOME\}\/Videos/\${VIDEOS}/;
'
Note: The entries in the following profiles were sorted manually:
* etc/profile-m-z/Mathematica.profile
* etc/profile-m-z/prismlauncher.profile
* etc/profile-m-z/zoom.profile
This is a follow-up to #7151 .
2026-05-11 14:07:42 +00:00
Kelvin M. Klann
3664750f8f
profiles: zoom: sort noblacklist/whitelist sections
Build-extra / build-gcc (push) Has been cancelled
Build-extra / build-clang (push) Has been cancelled
Build / build (push) Has been cancelled
Check-C / scan-build (push) Has been cancelled
Check-C / cppcheck (push) Has been cancelled
Check-C / codeql-cpp (push) Has been cancelled
Check-Profiles / profile-checks (push) Has been cancelled
Codespell / codespell (push) Has been cancelled
Test / test-main (push) Has been cancelled
Test / test-fs (push) Has been cancelled
Test / test-environment (push) Has been cancelled
Test / test-utils (push) Has been cancelled
Test / test-network (push) Has been cancelled
2026-05-09 10:20:32 -03:00
Kelvin M. Klann
85962902a8
profiles: keepassxc: sort noblacklist section
2026-05-09 10:20:32 -03:00
Kelvin M. Klann
5abf0577a7
feature: add ${PROJECTS} macro ( #7157 )
...
Based on the new ~/Projects directory from version 0.20 of the
xdg-user-dirs specification[1]:
* `XDG_PROJECTS_DIR="$HOME/Projects"`
Relates to #7147 #7151 .
[1] https://www.freedesktop.org/wiki/Software/xdg-user-dirs/
2026-05-09 13:19:42 +00:00
Kelvin M. Klann
f4170dd82e
profiles: move llm-agent-common.inc to llm-agent-common.profile
...
Move it together with the other profiles used for redirecting in
`etc/profile*`.
Commands used to search and replace:
git mv etc/inc/llm-agent-common.inc etc/profile-a-l/llm-agent-common.profile
git grep -IElz llm-agent-common.inc | xargs -0 perl -pi -e '
s/llm-agent-common.inc/llm-agent-common.profile/
'
This amends commit c81777164#7158 )", 2026-05-08).
2026-05-09 09:16:46 -03:00
Kelvin M. Klann
0959f0f653
profiles: nodejs-common: sort whitelist section
...
Build / build (push) Waiting to run
Check-Profiles / profile-checks (push) Waiting to run
Codespell / codespell (push) Waiting to run
Added on commit 699a803f1#4255 )",
2021-05-08).
2026-05-08 13:27:32 -03:00
