Commit graph

8593 commits

Author SHA1 Message Date
Kelvin M. Klann
aacd2e7d8d docs: set vim filetype on man pages for syntax highlighting
Since the man pages in src/man use a ".txt" file extension (rather than
".1" or ".5"), their filetype is detected by (neo)vim as "text".

So at the bottom of every man page, add a vim modeline in a comment and
set the filetype to "groff", to enable syntax highlighting.

Note: All of the generated ".man", ".1" and ".5" files are currently
being detected as "nroff".

Note2: Set the filetype to "groff" rather than "nroff" because at least
.UR and .UE are groff extensions.  These macros look the same with
either filetype, but there may be more extensions being used and the
nroff.vim syntax file (which is included by groff.vim) does things
differently based on which filetype is used.

Based on the following example from (neo)vim's filetype.txt:

    or add this modeline to the file:
            /* vim: set filetype=idl : */

See `:help groff.vim` and `:help filetype.txt` in (neo)vim.

See also groff_man(7) for the man page macros (including extensions).

Environment: neovim 0.7.2-3 on Artix Linux.

Misc: I noticed this on #5290.
2022-08-05 17:18:21 -03:00
dependabot[bot]
316749ae46 build(deps): bump github/codeql-action from 2.1.16 to 2.1.17
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.16 to 2.1.17.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](3e7e3b32d0...0c670bbf04)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-08-03 16:43:02 +00:00
Kelvin M. Klann
74b5d24ba3 RELNOTES: add build and ci items
Relates to #5248 #5249 #5251.
2022-08-01 10:07:34 -03:00
Kelvin M. Klann
86c0c2d507 RELNOTES: add feature: Warn when encountering EIO during remount
Relates to #5240 #5242.
2022-08-01 10:06:55 -03:00
smitsohu
06d3fd0581
Merge pull request #5259 from smitsohu/ns
introduce new option restrict-namespaces
2022-07-31 20:06:37 +02:00
smitsohu
95f8cc7b8d
Merge pull request #5271 from smitsohu/nnp
improve force-nonewprivs security guarantees
2022-07-31 20:05:51 +02:00
smitsohu
f986753277
Merge pull request #5251 from kmk3/build-add-autoconf-comment
build: add autoconf auto-generation comment to input files
2022-07-31 20:05:07 +02:00
smitsohu
b90516d4a0
Merge pull request #5249 from kmk3/ci-ignore-git-paths
ci: ignore git-related paths and the project license
2022-07-31 20:04:20 +02:00
smitsohu
00b2db8c8f
Merge pull request #5248 from kmk3/build-gitignore-distdir
build: add dist build directory to .gitignore
2022-07-31 20:03:34 +02:00
Reiner Herrmann
a724bbd991 update m4 macro from autoconf-archive (2022.02.11) 2022-07-31 02:05:35 +02:00
Reiner Herrmann
364a5659c9
Merge pull request #5275 from netblue30/ci_ubuntu_2204
CI: bump ubuntu to 22.04 and use newer compilers / analyzers
2022-07-30 11:07:38 +02:00
Reiner Herrmann
53f0b39507 CI: keep old cppcheck job and ignore two files in new job that take too long to check 2022-07-30 10:49:28 +02:00
Reiner Herrmann
cfc8547883 CI: bump ubuntu to 22.04 and use newer compilers / analyzers 2022-07-30 10:49:26 +02:00
Reiner Herrmann
c971903de0 tests: disable calling curl in dns test, as systemd-resolved is used on CI runner 2022-07-30 10:48:33 +02:00
Reiner Herrmann
4221b15f93 tests: try curl instead of wget for tracing dns resolution 2022-07-30 10:48:33 +02:00
Reiner Herrmann
b4f4444862 tests: add alternative message for skipping test 2022-07-30 10:48:33 +02:00
Reiner Herrmann
e1cb7ce296 tests: drop checking for hosts file in trace test
firejail is no longer detecting that /etc/hosts is getting opened.
in strace it can still be seen that the file is opened via syscall,
but on C library layer (which firejail is tracing) it's probably
implemented differently now.
2022-07-30 10:48:33 +02:00
Reiner Herrmann
057f431b0a CI: fix wrong matching for test errors
grep was returning non-zero exit code if it did NOT find the
error marker, and zero if it did.
2022-07-30 10:48:33 +02:00
Reiner Herrmann
eb20f52ef5 Make list of paths const to fix a false positive of gcc analyzer 2022-07-30 10:48:33 +02:00
Reiner Herrmann
e47bc3bc14 zero-initialize two variables 2022-07-30 10:48:33 +02:00
Reiner Herrmann
3a5954c128 CI: build all jobs with apparmor / selinux to cover more code 2022-07-30 10:48:30 +02:00
smitsohu
2cfd4dafc5 improve force-nonewprivs security guarantees 2022-07-24 20:39:23 +02:00
Tad
89441e48e8 Deny Tor related profiles access to /sys/class/net
This directory contains the MAC address for connections available

Tested working with torbrowser-launcher and onionshare

Signed-off-by: Tad <tad@spotco.us>
2022-07-23 13:18:13 -04:00
smitsohu
87afef810c introduce new option restrict-namespaces 2022-07-23 16:21:14 +02:00
NetSysFire
0ba8ed88b9
viewnior.profile: allow accessing its /usr/share directory (#5270) 2022-07-23 14:17:17 +00:00
dependabot[bot]
4780c47785 build(deps): bump github/codeql-action from 2.1.15 to 2.1.16
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.15 to 2.1.16.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](3f62b754e2...3e7e3b32d0)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-07-22 07:18:45 +00:00
smitsohu
8c627c37e7 apparmor cleanup 2022-07-20 16:21:01 +02:00
smitsohu
214ac20849 protocol filter: add x32 ABI handling 2022-07-19 14:58:32 +02:00
NetSysFire
fb87e9a4d9
remmina.profile: allow python3 (#5253)
* remmina.profile: allow python

* Update etc/profile-m-z/remmina.profile

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
2022-07-17 21:36:20 +00:00
smitsohu
f4f44a5f96 refresh syscall groups (#5188)
now covers syscalls up to including process_madvise (440)

group assignment was blindly copied from systemd:
729d2df806/src/shared/seccomp-util.c (L305)

the only exception is close_range, which was added to both @basic-io and @file-system

this commit adds the following syscalls to the default blacklist:
pidfd_getfd,fsconfig,fsmount,fsopen,fspick,move_mount,open_tree
2022-07-17 17:05:36 +02:00
Kelvin M. Klann
8fc604f5f0 build: add autoconf auto-generation comment to input files
To note on the output files that they are generated and to clarify how
they are generated.

From the manual of GNU Autoconf (version 2.69):

>  -- Variable: configure_input
>      A comment saying that the file was generated automatically by
>      'configure' and giving the name of the input file.  'AC_OUTPUT'
>      adds a comment line containing this variable to the top of every
>      makefile it creates.  For other files, you should reference this
>      variable in a comment at the top of each input file.  For
>      example, an input shell script should begin like this:
>
>           #!/bin/sh
>           # @configure_input@
>
>      The presence of that line also reminds people editing the file
>      that it needs to be processed by 'configure' in order to be used.

Resulting output on config.mk:

    # config.mk.  Generated from config.mk.in by configure.

Relates to #5140.
2022-07-16 01:07:40 -03:00
smitsohu
fbceab90a9 refresh and sort syscall tables
produced using commands documented in src/lib/syscall.c:
awk '/__NR_/ { print "{ \"" gensub("__NR_", "", "g", $2) "\", " $3 " },"; }' < /usr/include/x86_64-linux-gnu/asm/unistd_64.h
awk '/__NR_/ { print "{ \"" gensub("__NR_", "", "g", $2) "\", " $3 " },"; }' < /usr/include/x86_64-linux-gnu/asm/unistd_32.h
2022-07-15 16:22:35 +02:00
Kelvin M. Klann
f46b6c09df ci: ignore git-related paths and the project license
Add the following paths to the ignore lists:

- .git-blame-ignore-revs
- .gitignore
- COPYING

To avoid running CI unnecessarily.

Commands used to show only the root files:

    $ git ls-files | grep -v /

Misc: I noticed the missing paths on #5248.
2022-07-12 18:56:11 -03:00
Kelvin M. Klann
30d55f030b build: add dist build directory to .gitignore
Ignore it only on the repository root path, as a directory that matches
`firejail-*` could eventually be added.

Note that the dist archive is already ignored since commit da6b131c3
("chore(.gitignore) ignore built packages", 2018-01-15) / PR #1733.

Example paths:

* build dir: firejail-0.9.71/
* archive:   firejail-0.9.71.tar.xz

See `$(NAME)-$(VERSION)` and `$(NAME)-$(VERSION).tar.xz` in the "dist"
target on the root Makefile.
2022-07-12 17:14:31 -03:00
Kelvin M. Klann
c9019bfd04 RELNOTES: add build items (plus commands)
The following leverages the fact that when using a normal merge (as
opposed to "rebase and merge" or "squash and merge") on GitHub, the pull
request number is put in the commit message title and the title of the
PR is added to the commit message body.

Commands used to find and print the items for the RELNOTES:

    $ git log --grep='^build:' --merges --reverse --pretty='%s %b' 0.9.70.. |
      sed -E -n 's/Merge pull request (#[0-9]+) from [^ ]+ (.*)/  * \2 (\1)/p'
      * build: deduplicate configure-time vars into new config files (#5140)
      * build: fix file mode of shell scripts (644 -> 755) (#5206)
      * build: reduce autoconf input files from 32 to 2 (#5219)

Commands used to generate the message below:

    $ git log --grep='^build:' --merges --reverse --pretty='%s %b' 0.9.70.. |
      sed -E -n 's/Merge pull request (#[0-9]+).*/\1/p' | sort | tr '\n' ' ' |
      sed -E 's/^(.*) /Relates to \1./'
    Relates to #5140 #5206 #5219.

Relates to #5140 #5206 #5219.
2022-07-12 18:05:36 +00:00
smitsohu
56aebe3c27 tweaks 2022-07-12 14:00:51 +02:00
smitsohu
5a991622e2 always assert runfile mode and ownership 2022-07-12 11:54:15 +02:00
smitsohu
5d4c2b3e6a minor sandbox lock improvements 2022-07-11 23:01:06 +02:00
smitsohu
bd86049c52 cleanup 2022-07-11 21:37:05 +02:00
smitsohu
d991805cd2 remove dependency on sendfile syscall 2022-07-11 21:35:53 +02:00
smitsohu
604cbd3afc simplify put option
copy using file descriptors, similar
to implementation of get option
2022-07-11 21:28:34 +02:00
Kelvin M. Klann
a13f39ca1d aria2c.profile: add comment to winetricks workaround
As a reminder to create a profile for winetricks instead of allowing
access to its paths to programs used by winetricks (see #5238).

Added on commit 0ec1c66b5 ("aria2c.profile: allow access to
~/.cache/winetricks") / PR #5238.
2022-07-11 01:31:11 -03:00
netblue30
502b9bbd90 testing fix 2022-07-10 11:07:46 -04:00
netblue30
29783d9704
Merge pull request #5242 from alkim0/master
Warn when encountering EIO during remount
2022-07-10 11:05:29 -04:00
netblue30
949b8aec4a
Merge pull request #5238 from davidebeatrici/aria2c-winetricks-cache
aria2c.profile: allow access to ~/.cache/winetricks
2022-07-10 11:04:16 -04:00
Albert Kim
f9540c2b13 Warn when encountering EIO during remount
Instead of simply erroring out, just warn the user that a filesystem was
unable to be remounted due to EIO. This is helpful for FUSE filesystems
which might be buggy or having issues.
2022-07-07 10:43:18 -07:00
Davide Beatrici
0ec1c66b57 aria2c.profile: allow access to ~/.cache/winetricks
Otherwise winetricks fails to download packages.
2022-07-06 06:56:12 +02:00
0x9fff00
8a0520d279 add Colossal Order to steam.profile 2022-07-05 17:48:24 +00:00
dependabot[bot]
c5d426b245 build(deps): bump github/codeql-action from 2.1.14 to 2.1.15
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.14 to 2.1.15.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](41a4ada31b...3f62b754e2)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2022-07-04 19:24:28 +00:00
netblue30
32ec5b0d82 merges 2022-06-30 09:18:11 -04:00