Commit graph

549 commits

Author SHA1 Message Date
smitsohu
e4f0f91ebd add restrict-namespaces to (almost) all profiles 2022-12-20 01:39:53 +01:00
glitsj16
52a13f70cb
Rename cinelerra-gg to cinelerra-gg.profile 2022-12-19 20:50:13 +00:00
Hartmut Knaack
15bce3c83c Add profile for avidemux3_jobs_qt5
Add a profile for the Qt5 GUI to process Avidemux jobs.
Use a redirection to the avidemux3_qt5 profile to reuse translation
files. The application needs to create a network socket on localhost and
fails to run with protocol unix, so that entry in the default avidemux
profile needs to be extended.
2022-12-13 23:35:43 +01:00
Hartmut Knaack
8b4b976c82 Add profile for avidemux3_cli
Add a profile for the command-line interface of Avidemux, which
redirects to the existing avidemux profile.
2022-12-12 22:26:16 +01:00
Hartmut Knaack
0163ef0c38 Avidemux: openSUSE-Packman fixes
The Avidemux project stores configuration profile data in ~/.avidemux6,
while the package built by Packman-repositories for openSUSE patches it
to use ~/.avidemux3 at the moment (at least for Avidemux 2.8).
2022-12-12 22:26:16 +01:00
Hartmut Knaack
845b409d6f Add profile for avidemux3_qt5
Add a profile for the Qt5-GUI of Avidemux.
2022-12-12 22:26:16 +01:00
Hartmut Knaack
1ccd560994 Avidemux: add information from template profile
Add the information that file contents will be overwritten on updates.
2022-12-12 22:26:16 +01:00
glitsj16
f99a296347
clipit hardening (#5521)
* clipit hardening

* clipit: fix hardening

* clipit: add xdotool lib to private-lib
2022-12-12 13:10:48 +00:00
glitsj16
91b6abb4f0
private-etc: always reference 'alternatives' (#5517)
* private-etc: always include 'alternatives'

* private-etc: always include 'alternatives'

* private-etc: always include 'alternatives'

* private-etc: always include 'alternatives'
2022-12-09 12:37:13 +00:00
Kelvin M. Klann
48c3045d3f
Merge pull request #5496 from kmk3/kcalc-fix-mkfile
kcalc.profile: fix mkfile without mkdir & comment legacy paths
2022-12-08 10:00:01 +00:00
glitsj16
116557c2f8
firefox-common-addons: fix whitelisting in ${RUNUSER} (#5497)
* fix whitelisting in ${RUNUSER}

See discussions https://github.com/netblue30/firejail/discussions/5495 for context.

* Prevent whitelisting ${RUNUSER} comment
2022-12-01 12:30:24 +00:00
Kelvin M. Klann
f6360fc046 kcalc.profile: stop creating legacy KDE paths
Leave them commented.

With this commit, there are no more profiles creating paths in ~/.kde
nor in ~/.kde4:

    $ git grep -e '^mkdir .*\.kde' -e '^mkfile .*\.kde' -- etc
    $

See also commit 3ef030257 ("ktorrent.profile: stop creating legacy KDE
paths", 2022-10-11) / PR #5415.
2022-12-01 04:58:46 -03:00
Kelvin M. Klann
9b87289d22 kcalc.profile: fix mkfile without mkdir
firejail may fail to create the following files:

* ~/.kde/share/config/kcalcrc
* ~/.kde4/share/config/kcalcrc

Because it does not create the preceding directories beforehand:

* ~/.kde/share/config
* ~/.kde4/share/config

See also commit 7f1906dba ("ktorrent.profile: fix mkfile without mkdir",
2022-10-11) / PR #5415.
2022-12-01 04:57:06 -03:00
glitsj16
860bd545b5
[firefox-common.profile] Add DRM support when using psd (#5486) 2022-11-28 09:19:03 +00:00
netblue30
5286ec802e
Merge pull request #5415 from kmk3/ktorrent-fix-mkfile
ktorrent.profile: fix mkfile without mkdir & comment legacy paths
2022-11-25 11:34:28 -05:00
glitsj16
86c6cd4b35
[email-common.profile] add localtime to private-etc 2022-11-25 04:39:56 +00:00
Kelvin M. Klann
274db94266
Merge pull request #5449 from kmk3/lutris-fix-lol
lutris.profile: fix running League of Legends
2022-11-23 16:39:26 +00:00
Kelvin M. Klann
1a69932720
Merge pull request #5442 from rusty-snake/fixes
Profile fixes
2022-11-23 16:39:07 +00:00
Kelvin M. Klann
72b662fa68 ktorrent.profile: add missing private-bin paths
Package-provided binaries:

    $ pacman -Q ktorrent
    ktorrent 22.08.3-1.2
    $ pacman -Qlq ktorrent | grep bin/.
    /usr/bin/ktmagnetdownloader
    /usr/bin/ktorrent
    /usr/bin/ktupnptest

Environment: Artix Linux
2022-11-22 03:28:44 -03:00
Kelvin M. Klann
3ef0302575 ktorrent.profile: stop creating legacy KDE paths
Leave them commented.
2022-11-22 03:28:36 -03:00
Kelvin M. Klann
7f1906dba7 ktorrent.profile: fix mkfile without mkdir
firejail fails to create the following files:

* ~/.kde/share/config/ktorrentrc
* ~/.kde4/share/config/ktorrentrc

Because it does not create the preceding directories beforehand:

* ~/.kde/share/config
* ~/.kde4/share/config

Relates to #5414.
2022-11-22 02:52:58 -03:00
glitsj16
98e8f28164
Add support for cinelerra-gg (#5467)
* Create cinelerra-gg

* add cinelerra-gg to `New profiles` section

* Add cinelerra-gg to firecfg.config
2022-11-13 00:05:03 +00:00
Jan Sonntag
25930fd70a
Add netlink to list of allowed protocols (#5464)
Fixes #5463 by adding netlink to the list of allowed protocols
2022-11-10 17:48:52 +00:00
Frostbyte4664
bd119c5ecd
Add godot3 redirect (#5456)
* Create godot3.profile

* Add godot3 redirect to firecfg.config
2022-11-07 02:27:22 +00:00
Kelvin M. Klann
e045a601e3 lutris.profile: fix running League of Legends
@Latrolage on Oct 20, 2022[1]:

> When I open the game the only error line which appears is this
> `modify_ldt: Operation not permitted`

So as suggested by @Latrolage[1] and @rusty-snake[2], allow the
`modify_ldt` syscall in seccomp.

Fixes #5430.

[1] https://github.com/netblue30/firejail/discussions/5430#discussion-4488996
[2] https://github.com/netblue30/firejail/discussions/5430#discussioncomment-3924098

Reported-by: @Latrolage
2022-11-03 12:23:02 -03:00
rusty-snake
4c08719b9f
Update etc/profile-a-l/evince.profile 2022-10-30 17:37:43 +00:00
rusty-snake
adc10aacad Fix #4604 -- Brave browser takes a long time opening under Firejail 2022-10-30 17:41:11 +01:00
rusty-snake
6829fe6a12 Fix #5392 -- Evince doesn't remember settings 2022-10-30 17:32:30 +01:00
rusty-snake
e24eadec1c Fix freetube mpris support
Closes #5437
2022-10-30 17:02:47 +01:00
netblue30
daf5fdf69f
Merge pull request #5298 from pirate486743186/patch-1
electron-mail.profile refactoring
2022-10-11 11:04:47 -04:00
pirate486743186
8562ec9852 electron-mail.profile: refactor and redirect to electron.profile
Changes:

- redirect to electron.profile
- fix program name
- update program description
- allow /bin/sh
- allow opening links in Firefox
- remove no3d, nonewprivs, noroot, protocol, seccomp
- add machine-id, nosound
- remove private-bin, disable-mnt
- harden private-etc
- allow D-Bus notifications, secrets
2022-10-05 17:48:25 +02:00
netblue30
445d6b525d
Merge pull request #5360 from glitsj16/ff-dbus
Streamline Firefoxes D-Bus filtering
2022-09-26 10:43:13 -04:00
netblue30
6a19625e47
Merge pull request #5371 from kmk3/profiles-allow-exiftool
profiles: allow perl/exiftool on the relevant profiles
2022-09-26 10:24:44 -04:00
Kelvin M. Klann
b6a21daad9 arduino.profile: allow devel paths
As mentioned in its description, this profile is intended for an IDE, so
allow paths used for development and stop including the following
profiles:

* disable-devel.inc
* disable-exec.inc
* disable-interpreters.inc

Fixes #5292.
2022-09-17 10:58:59 -03:00
Kelvin M. Klann
2aa9bbb4e5 profiles: allow perl/exiftool on the relevant profiles
Programs that seem to support exiftool:

    $ LC_ALL=C pacman -Sii perl-image-exiftool |
      grep -e '^Version' -e '^Required' -e '^Optional For' | head -n 3
    Version         : 12.42-1
    Required By     : digikam  geotag  gitlab-workhorse  mat2  rapid-photo-downloader
    Optional For    : darktable  geeqie  gpsprune  hugin  jpeg-archive  ranger  recoll  shutter

Environment: Artix Linux.

Note for hugin.profile: Does not currently work with private-bin on
Arch/Artix; see the private-bin comment on
etc/profile-a-l/exiftool.profile.

Relates to #5365.
2022-09-17 09:32:08 -03:00
glitsj16
3e7b65da2e
discord: fix issues with command-line usage (#5368)
* use both capitalized and regular discord commands to private-bin

* use both capitalized and regular discord commands to private-bin

* add awk and which to private-bin for better xdg-open support

* use both capitalized and regular discord commands to private-bin

* use both capitalized and regular discord commands to private-bin

* refactor CamelCased discord profiles

* refactor CamelCased discord profiles

* fix private-{bin,opt} sorting

* fix private-{bin,opt} sorting

* unfuck private-{bin,opt} sorting

* unfuck private-{bin,opt} sorting

* fix sorting once more for CI

* fix sorting once again for CI
2022-09-14 17:36:01 +00:00
godbless
2cfe3ea9d0
Fix Firefox 'Profile not found' for psd (v6.45) (#5348)
* Fix Firefox 'Profile not found' for psd (v6.45)

code change: `whitelist ${RUNUSER}/psd/*firefox*`

fixes: #4568

* Whitelist ${RUNUSER}/psd/*firefox*

* Fix workflow for github
2022-09-08 19:15:58 +00:00
glitsj16
0190529d84
De-complicate D-Bus naming schemes
Inspired by https://github.com/netblue30/firejail/pull/5352/files/c04ceb49c7001bb931a35667c831545cd64aeece#r963032151.
2022-09-05 17:07:30 +00:00
glitsj16
d165194297
De-complicate D-Bus naming schemes
Inspired by https://github.com/netblue30/firejail/pull/5352/files/c04ceb49c7001bb931a35667c831545cd64aeece#r963032151.
2022-09-05 17:06:03 +00:00
glitsj16
15ac6e41bc
De-complicate D-Bus naming schemes
Inspired by https://github.com/netblue30/firejail/pull/5352/files/c04ceb49c7001bb931a35667c831545cd64aeece#r963032151.
2022-09-05 17:05:00 +00:00
glitsj16
bc57595d32
De-complicate D-Bus naming schemes
Inspired by https://github.com/netblue30/firejail/pull/5352/files/c04ceb49c7001bb931a35667c831545cd64aeece#r963032151.
2022-09-05 17:03:59 +00:00
glitsj16
bfd700b072
De-complicate D-Bus naming schemes
Inspired by https://github.com/netblue30/firejail/pull/5352/files/c04ceb49c7001bb931a35667c831545cd64aeece#r963032151.
2022-09-05 17:01:52 +00:00
glitsj16
bc10399b53
Add CamelCase D-Bus filter for backward-compatibility 2022-09-05 12:09:19 +00:00
glitsj16
f97486b1bf
Add CamelCase D-Bus filter for backward-compatibility 2022-09-05 12:08:07 +00:00
glitsj16
940ae478cd
Re-add CamelCase D-Bus filter for backward-compatibility 2022-09-05 12:06:46 +00:00
glitsj16
46305e9f35
Add CamelCase D-Bus filter for backward-compatibility 2022-09-05 12:04:47 +00:00
glitsj16
98e4f0e56b
Add CamelCase D-Bus name for backward-compatibility 2022-09-05 12:02:26 +00:00
glitsj16
24a56e2cce
fix D-Bus filter in firefox 2022-09-05 02:36:52 +00:00
glitsj16
cda46884dd
add specific D-Bus filter in firefox-nightly 2022-09-05 02:34:44 +00:00
glitsj16
1ff89b492b
add specific D-Bus filter in firefox-esr 2022-09-05 02:31:35 +00:00