Commit graph

8641 commits

Author SHA1 Message Date
dependabot[bot]
399178eb56
build(deps): bump github/codeql-action from 2.1.19 to 2.1.21
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.19 to 2.1.21.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](f5d217be74...c7f292ea4f)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-08-29 06:13:04 +00:00
pirate486743186
fd5659e43a
tuir.profile creation (#5330)
Co-authored-by: pirate486743186 <>
2022-08-28 20:00:36 +00:00
Kelvin M. Klann
783c700510 steam.profile: fix Proton-GE version in comment
This amends commit e2631b40d ("steam.profile: fix breakage with newer
Proton-GE (process_vm_readv)", 2022-08-20).
2022-08-26 16:33:52 -03:00
Kelvin M. Klann
e2631b40d9 steam.profile: fix breakage with newer Proton-GE (process_vm_readv)
As reported by @rsramkis on #5185, upgrading from Proton-7.2-GE-2[1]
(released on 2022-02-14) to GE-Proton7-18[2] (released on 2022-05-19)
breaks logging in on World of Tanks Blitz unless the `process_vm_ready`
32-bit syscall is allowed[3], so allow it.

Fixes #5185.

[1] https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/7.2-GE-2
[2] https://github.com/GloriousEggroll/proton-ge-custom/releases/tag/GE-Proton7-18
[3] https://github.com/netblue30/firejail/issues/5185#issuecomment-1152350336
2022-08-26 19:30:14 +00:00
dependabot[bot]
79d5b03884 build(deps): bump github/codeql-action from 2.1.18 to 2.1.19
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.18 to 2.1.19.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](2ca79b6fa8...f5d217be74)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-08-24 16:38:57 +00:00
Kelvin M. Klann
9f900534f1 src/firejail/profile.c: fix trailing whitespace
This amends commit 7f3b6c19a ("Add support for custom AppArmor profiles
(--apparmor=)", 2022-07-25) / PR #5274.
2022-08-23 06:37:52 -03:00
Kelvin M. Klann
64cad40118 docs: set vim filetype on the other man pages
Some man pages are missing it.

This amends commit aacd2e7d8 ("docs: set vim filetype on man pages for
syntax highlighting", 2022-08-04) / PR #5296.
2022-08-20 12:08:25 -03:00
Kelvin M. Klann
ffc4f72c5c RELNOTES: add seccomp log flood bugfix
Relates to #5207.
2022-08-20 06:44:53 -03:00
Kelvin M. Klann
0d49c7a42d RELNOTES: sort features by date added
Relates to #4939 #5259.
2022-08-20 06:40:56 -03:00
glitsj16
d3116a98e9
man.profile needs additional private-etc items on arch (#5322) 2022-08-18 13:52:41 +00:00
Kelvin M. Klann
df00c1388f RELNOTES: add build and docs items
Relates to #5288 #5290 #5296 #5310.
2022-08-18 03:16:59 -03:00
Kelvin M. Klann
64421e1cf2 RELNOTES: add missing references for --restrict-namespaces
And fix a typo of "implemented".

Relates to #4939 #5259.
2022-08-18 03:16:25 -03:00
Kelvin M. Klann
eaccc59df9 RELNOTES: add more references related to --apparmor=
Relates to #5274 #5316 #5317.
2022-08-18 03:06:54 -03:00
Kelvin M. Klann
4fe11d1638 RELNOTES: restore build item and build PR reference
Which were removed on commit d4323ae26 ("merges", 2022-08-14).

Relates to #5283 #5284.
2022-08-18 03:06:54 -03:00
Азалия Смарагдова
9109f60151
Fixed an AppArmor profile denial issue with ptrace and signals (#5317) 2022-08-18 01:12:37 +00:00
netblue30
5ab4aeb35c more merges 2022-08-14 09:38:32 -04:00
netblue30
07a5f9db6f more merges 2022-08-14 09:37:52 -04:00
netblue30
ea6f8a18bb
Merge pull request #5302 from pirate486743186/makedeb-profile-creation
makedeb profile creation
2022-08-14 09:36:25 -04:00
netblue30
11e06fb051
Merge pull request #5310 from kmk3/build-use-tarname
build: add and use TARNAME instead of NAME for paths
2022-08-14 09:33:32 -04:00
netblue30
d48736f70f
Merge pull request #5309 from qretornaz-adapei42/master
microsoft-edge.profile rewritten for stable channel and moved microsoft-edge{,-beta,-dev} from private-opt to whitelist
2022-08-14 09:32:53 -04:00
netblue30
9fed7985b6
Merge pull request #5296 from kmk3/docs-man-vim-ft
docs: set vim filetype on man pages for syntax highlighting
2022-08-14 09:29:39 -04:00
netblue30
e7dccf7a54
Merge pull request #5290 from kmk3/docs-suid-firejail-users
docs: mention risk of SUID binaries and also firejail-users(5)
2022-08-14 09:29:04 -04:00
netblue30
c4e2ee9205
Merge pull request #5285 from ra1nb0w/vmware-snapshot
vmware.profile: snapshot requires /etc/mtab
2022-08-14 09:26:45 -04:00
netblue30
d4323ae26f merges 2022-08-14 09:00:01 -04:00
netblue30
b987cf001a
Merge pull request #5274 from ChrysoliteAzalea/master
Add support for custom AppArmor profiles (--apparmor=)
2022-08-14 08:43:15 -04:00
Kelvin M. Klann
7bbcf7eab2 build: use TARNAME instead of NAME for paths
PACKAGE_TARNAME is the same as PACKAGE_NAME but normalized, so it should
be safer to use in paths.  For example, on a downstream project, if
spaces or shell metacharacters are added to the package name, a path
that uses PACKAGE_TARNAME should keep working.

From the manual of GNU Autoconf (version 2.69):

>  -- Macro: AC_INIT (PACKAGE, VERSION, [BUG-REPORT], [TARNAME], [URL])
>      Process any command-line arguments and perform initialization and
>      verification.
>
>      Set the name of the PACKAGE and its VERSION.  These are typically
>      used in '--version' support, including that of 'configure'.  The
>      optional argument BUG-REPORT should be the email to which users
>      should send bug reports.  The package TARNAME differs from
>      PACKAGE: the latter designates the full package name (e.g., 'GNU
>      Autoconf'), while the former is meant for distribution tar ball
>      names (e.g., 'autoconf').  It defaults to PACKAGE with 'GNU '
>      stripped, lower-cased, and all characters other than
>      alphanumerics and underscores are changed to '-'.

Note also that by default (on autoconf v2.69), `docdir=@docdir@` in
config.mk.in expands to the following in config.mk:

    docdir=${datarootdir}/doc/${PACKAGE_TARNAME}
2022-08-14 02:17:39 -03:00
Kelvin M. Klann
891fd02701 build: add new TARNAME variable
That expands to `@PACKAGE_TARNAME@`, similar to the existing
PACKAGE_TARNAME variable.

To make it easier to use (and read) and to be more consistent with the
surrounding variables (NAME and VERSION).

Note that the original PACKAGE_TARNAME is still needed, as by default
(on autoconf v2.69) `docdir=@docdir@` in config.mk.in expands to the
following in config.mk:

    docdir=${datarootdir}/doc/${PACKAGE_TARNAME}
2022-08-14 02:17:39 -03:00
Kelvin M. Klann
9a45c34fc7 build: rename DOCDIR to docdir
To match other similar variables, such as datarootdir and mandir.
2022-08-13 23:38:53 -03:00
Kelvin M. Klann
3bb8064677 config.mk.in: move basic variables to the top
Move up the variables that are defined in the `AC_INIT` call on
configure.ac.

And put VERSION last, to match the usual `$(NAME)-$(VERSION)` usage.
2022-08-13 23:38:32 -03:00
Kelvin M. Klann
0d200264b1 config.mk.in: move CC variable near CFLAGS
Move it to the bottom, near other compilation-related flags.
2022-08-13 17:06:56 -03:00
Kelvin M. Klann
40c0f3cff6 RELNOTES: add build items
Relates to #5283 #5284.
2022-08-12 03:43:18 -03:00
Hugo Osvaldo Barrera
d7c31bdbfe neomutt: Avoid creating empty files/directories
neomutt won't write to these locations. Processes it spawns might read
to some of them, but creating an empty file doesn't help. This just
pollutes user's $HOME with empty files and directories.

I've kept a few paths that MAY be written to by neomutt; it's not ideal,
but I want to minimise the risk of potential data loss, even if it is
corener cases.

See: https://github.com/netblue30/firejail/discussions/5276
2022-08-11 21:33:17 +00:00
Kelvin M. Klann
06c4359399
Merge pull request #5284 from kmk3/build-config-sh-fixes
build: config.sh.in: quote variables and fix shellcheck issues
2022-08-11 21:17:52 +00:00
Kelvin M. Klann
9a37b90514
Merge pull request #5283 from remyabel2/make-uninstall
build: Add files `make uninstall` forgot to remove
2022-08-11 21:15:13 +00:00
Quentin RETORNAZ
121e043df2 microsoft-edge-{dev,beta}: replaced private-opt by whitelist #5307 2022-08-11 21:00:15 +02:00
Quentin RETORNAZ
f3f739c5dc microsoft-edge.profile: rewrite profile for stable channel
* replaced private-opt by whitelist #5307

* added stable channel config dirs to disable-programs.inc
2022-08-11 20:52:04 +02:00
Christopher Morrow
72eac26725
fix(audacity): !5281 sharedlib bug on Arch/Fedora (#5300)
* fix(audacity): !5281 sharedlib bug on Arch/Fedora

removed `private-bin` line from audacity profile as it appears to block
access to shared libraries needed to start audacity on some
distributions.

Relates to github issue #5281

* fix(audacity): Disabling apparmor and reenabling private-bin
2022-08-10 23:00:54 +00:00
Kelvin M. Klann
56c2f82802
Merge pull request #5299 from pirate486743186/description-makepkg
makepkg: add description
2022-08-10 20:12:04 +00:00
pirate486743186
bf8ce57f7c makedeb profile creation 2022-08-10 11:50:55 +02:00
pirate486743186
f9500a5602 makepkg.profile: add description 2022-08-10 11:33:07 +02:00
glitsj16
b18120cc2e
new profile: gdu (#5289)
* add gdu to 'new profiles' section

* Create gdu.profile

* add gdu to firecfg

* harden gdu sandbox

* fix protocol

* simulate empty protocol in gdu

* more user-friendly gdu sandboxing
2022-08-09 21:11:18 +00:00
dependabot[bot]
4b9f6af9f8 build(deps): bump github/codeql-action from 2.1.17 to 2.1.18
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.17 to 2.1.18.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](0c670bbf04...2ca79b6fa8)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-08-08 16:19:32 +00:00
Kelvin M. Klann
aacd2e7d8d docs: set vim filetype on man pages for syntax highlighting
Since the man pages in src/man use a ".txt" file extension (rather than
".1" or ".5"), their filetype is detected by (neo)vim as "text".

So at the bottom of every man page, add a vim modeline in a comment and
set the filetype to "groff", to enable syntax highlighting.

Note: All of the generated ".man", ".1" and ".5" files are currently
being detected as "nroff".

Note2: Set the filetype to "groff" rather than "nroff" because at least
.UR and .UE are groff extensions.  These macros look the same with
either filetype, but there may be more extensions being used and the
nroff.vim syntax file (which is included by groff.vim) does things
differently based on which filetype is used.

Based on the following example from (neo)vim's filetype.txt:

    or add this modeline to the file:
            /* vim: set filetype=idl : */

See `:help groff.vim` and `:help filetype.txt` in (neo)vim.

See also groff_man(7) for the man page macros (including extensions).

Environment: neovim 0.7.2-3 on Artix Linux.

Misc: I noticed this on #5290.
2022-08-05 17:18:21 -03:00
Kelvin M. Klann
ba0ac271e6 docs: mention risk of SUID binaries and also firejail-users(5)
On the introduction of firejail(1), mention the main risk of SUID
binaries and that by default, only trusted users should be allowed to
run firejail (and how to accomplish that).

Note: The added comment line is completely discarded (so there is no
extraneous blank line); see groff_man(7) for details.

Suggested by @emerajid on #5288.

Relates to #4601.
2022-08-05 16:43:59 -03:00
Азалия Смарагдова
7f3b6c19a0
Add support for custom AppArmor profiles (--apparmor=) 2022-08-05 11:47:24 +05:00
dependabot[bot]
316749ae46 build(deps): bump github/codeql-action from 2.1.16 to 2.1.17
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.16 to 2.1.17.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](3e7e3b32d0...0c670bbf04)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-08-03 16:43:02 +00:00
Davide Gerhard
f6076a9076 vmware.profile: snapshot requires /etc/mtab
This patch avoid the following error:
Error: One of the parameters supplied is invalid

Tested with VMware Workstation 16.2.4
2022-08-02 11:17:05 +02:00
Kelvin M. Klann
f08c378d5a config.sh.in: fix all issues reported by shellcheck
Fix the following error and warnings:

    $ shellcheck --version | grep ^version:
    version: 0.8.0
    $ shellcheck config.sh.in

    In config.sh.in line 1:
    # @configure_input@
    ^-- SC2148 (error): Tips depend on target shell and yours is unknown. Add a shebang or a 'shell' directive.

    In config.sh.in line 3:
    NAME=@PACKAGE_NAME@
    ^--^ SC2034 (warning): NAME appears unused. Verify use (or export if used externally).

    In config.sh.in line 4:
    VERSION=@PACKAGE_VERSION@
    ^-----^ SC2034 (warning): VERSION appears unused. Verify use (or export if used externally).

    For more information:
      https://www.shellcheck.net/wiki/SC2148 -- Tips depend on target shell and y...
      https://www.shellcheck.net/wiki/SC2034 -- NAME appears unused. Verify use (...

Relates to #5140.
2022-08-01 20:33:10 -03:00
Kelvin M. Klann
f1f40cbaa3 config.sh.in: quote all variables
Output variables in general may contain values with spaces in them.
Example: `CC=gcc -foo`.

Relates to #5140.
2022-08-01 20:31:39 -03:00
Kelvin M. Klann
74b5d24ba3 RELNOTES: add build and ci items
Relates to #5248 #5249 #5251.
2022-08-01 10:07:34 -03:00