Commit graph

7521 commits

Author SHA1 Message Date
netblue30
ed142c62bf
Merge pull request #4375 from smitsohu/kcmp
remove kcmp from seccomp default drop list
2021-06-27 13:11:20 -05:00
netblue30
77e9d0dd89
Merge pull request #4373 from kmk3/gcov-fix-build-gcc11
gcov: fix build failure with gcc 11.1.0
2021-06-27 13:10:53 -05:00
smitsohu
0c2a5e31c6 tweaks 2021-06-26 17:25:14 +02:00
smitsohu
533a57ebe1 remove kcmp from seccomp default drop list (#3219) 2021-06-26 16:46:43 +02:00
smitsohu
46712f70d9
Merge pull request #4340 from smitsohu/kcmp
augment seccomp lists in firejail.config
2021-06-26 16:37:13 +02:00
smitsohu
99e533580b
Merge pull request #4374 from smitsohu/euid
fs_home.c: run more code with euid of the user
2021-06-26 16:34:49 +02:00
smitsohu
771dccecba fs_home.c: improve EUID switching, fix selinux relabeling 2021-06-26 16:18:52 +02:00
smitsohu
43fb38e18e RELNOTES 2021-06-26 12:57:05 +02:00
smitsohu
925c9fe6b0 seccomp man page update
* move everything related to modification
of the default seccomp filter from --seccomp
to --seccomp= entry

* update errno descriptions
2021-06-26 12:56:41 +02:00
Kelvin M. Klann
ff4277a3ff firejail.h: fix typo of "either" in license header
Added on commit e770ab6d8 ("appimage: automatically detect profile").
2021-06-26 00:13:46 -03:00
Kelvin M. Klann
b408b20c70 gcov: fix build failure with gcc 11.1.0
The build currently fails if gcov support is enabled:

    $ pacman -Q gcc
    gcc 11.1.0-1
    $ ./configure --prefix=/usr --enable-apparmor --enable-gcov >/dev/null
    $ make >/dev/null
    [...]
    netstats.c: In function ‘netstats’:
    netstats.c:250:25: warning: implicit declaration of function ‘__gcov_flush’; did you mean ‘__gcov_dump’? [-Wimplicit-function-declaration]
      250 |                         __gcov_flush();
          |                         ^~~~~~~~~~~~
          |                         __gcov_dump
    [...]
    /usr/bin/ld: netstats.o: in function `netstats':
    /tmp/firejail-git/src/firejail-git/src/firemon/netstats.c:250: undefined reference to `__gcov_flush'
    [...]
    collect2: error: ld returned 1 exit status
    make[1]: *** [Makefile:10: firemon] Error 1
    make: *** [Makefile:42: src/firemon/firemon] Error 2
    [...]

This happens because __gcov_flush was removed on gcc 11.1.0[1] [2] [3].
See the following gcc commits:

* d39f7dc8d5 ("Do locking for __gcov_dump and __gcov_reset as well.")
* c0532db47d ("Use __gcov_dump and __gcov_reset in execv and fork context.")
* 811b7636cb ("Remove __gcov_flush.")

Its implementation did the following[4]:

      __gcov_lock ();
      __gcov_dump_int ();
      __gcov_reset_int ();
      __gcov_unlock ();

As hinted in the commit messages above, the function is no longer needed
because locking is now done inside each of __gcov_dump and __gcov_reset.

So add an implementation of __gcov_flush (on a new gcov_wrapper.h file)
for gcc >= 11.1.0, which just calls __gcov_dump and then __gcov_reset.

Commands used to search and replace:

    $ git grep -Flz '#include <gcov.h>' -- '*.c' |
      xargs -0 -I '{}' sh -c \
      "printf '%s\n' \"\`sed 's|<gcov\\.h>|\"../include/gcov_wrapper.h\"|' '{}'\`\" >'{}'"

Note: This is the continuation of commit 31557e9c7 ("gcov: add missing
gcov.h includes") / PR #4360.

[1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=d39f7dc8d558ca31a661b02d08ff090ce65e6652
[2] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c0532db47d092430f8e8f497b2dc53343527bb13
[3] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=811b7636cb8c10f1a550a76242b5666c7ae36da2
[4] https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=libgcc/libgcov-interface.c;h=855e8612018d1c9caf90396a3271337aaefdb9b3#l86
2021-06-25 17:00:35 -03:00
rusty-snake
a90428833a
Merge pull request #4368 from alxjsn/master
Address #3872 with changes in pipewire for Firefox and Chromium
2021-06-25 06:57:06 +00:00
glitsj16
2e29cf72c6
Merge pull request #4370 from glitsj16/fix-wusc
allow access to pkgconfig
2021-06-23 19:44:34 +00:00
glitsj16
db6a0fc7d0
allow access to pkgconfig 2021-06-23 17:48:55 +00:00
smitsohu
87548960b8 copy_file_as_user function: drop not needed arguments 2021-06-23 15:30:31 +02:00
Alex Leahu
e943e2f295 Address #3872 with changes for Librewolf 2021-06-22 11:59:46 -05:00
Alex Leahu
04d15e3e06 Address #3872 with changes in pipewire for Firefox and Chromium 2021-06-22 11:39:04 -05:00
Reiner Herrmann
eb87b417e2 README update 2021-06-21 23:21:24 +02:00
Reiner Herrmann
0f0325459e Merge branch 'master' into kuesji/master 2021-06-21 23:10:09 +02:00
Reiner Herrmann
ee1ea7d226 style: grammer and codestyle improvements 2021-06-21 23:09:34 +02:00
pirate486743186
1ca9046cf1
creating alpine.profile (#4350)
* firecfg.config alpine

* Create alpinef.profile

* Create alpine.profile

* disable-programs.inc alpine

* workaround in comment

* Update etc/profile-a-l/alpine.profile

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

* deactivating whitelists in ${HOME}

* comment

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
2021-06-21 12:25:19 +00:00
smitsohu
1a66c8b805 testing 2021-06-21 02:00:20 +02:00
smitsohu
435d739d96 tmpfs option enhancements
* downgrade error to warning,
smiliar to read-write option;
this simplifies use of tmpfs
option in general purpose
profiles, for example we
don't need to worry about links
people put in their homedir

* update manpage
2021-06-21 01:26:17 +02:00
smitsohu
9c071c863b cleanup 2021-06-20 22:58:19 +02:00
smitsohu
533242ac32 augment seccomp lists in firejail.config 2021-06-20 13:29:48 +02:00
kuesji koesnu
271dc51fa6 grammar issues and fixing test cases for rlimit 2021-06-20 08:41:33 +03:00
netblue30
447e30e2c9 Merge branch 'master' of ssh://github.com/netblue30/firejail 2021-06-19 16:19:43 -04:00
netblue30
1da3f20159 fixing broken build 2021-06-19 16:19:27 -04:00
rusty-snake
f46f514e83
Fix #4363 -- minecraft-launcher not running with firejail 2021-06-19 19:16:10 +00:00
netblue30
7b78bf75c7 jailcheck: networking support 2021-06-19 10:34:03 -04:00
netblue30
b71fd925a3
Merge pull request #4360 from kmk3/gcov-add-missing-includes
gcov: add missing gcov.h includes
2021-06-18 19:02:56 -05:00
Kelvin M. Klann
31557e9c77 gcov: add missing gcov.h includes
Fixes the following "implicit declaration" warning (13 occurrences in
total) when building with gcov support:

    $ pacman -Q gcc10
    gcc10 1:10.2.0-3
    $ CC=gcc-10 && export CC
    $ ./configure --prefix=/usr --enable-apparmor --enable-gcov >/dev/null
    $ make >/dev/null
    appimage.c: In function ‘appimage_set’:
    appimage.c:140:2: warning: implicit declaration of function ‘__gcov_flush’ [-Wimplicit-function-declaration]
      140 |  __gcov_flush();
          |  ^~~~~~~~~~~~
    interface.c: In function ‘print_sandbox’:
    interface.c:149:3: warning: implicit declaration of function ‘__gcov_flush’ [-Wimplicit-function-declaration]
      149 |   __gcov_flush();
          |   ^~~~~~~~~~~~
    netstats.c: In function ‘netstats’:
    netstats.c:246:4: warning: implicit declaration of function ‘__gcov_flush’ [-Wimplicit-function-declaration]
      246 |    __gcov_flush();
          |    ^~~~~~~~~~~~
    [...]

Note: The commands above were executed from makepkg, while building
firejail-git from the AUR.

Note2: gcc-10 was used because the build fails with the current gcc
version (11.1.0) on Artix Linux.  The failure happens because
__gcov_flush was removed on gcc 11.1.0[1]; this will be addressed later.

Note3: The following command helped find the affected files:

    $ git grep -Fl __gcov -- src

[1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=811b7636cb8c10f1a550a76242b5666c7ae36da2
2021-06-18 14:48:56 -03:00
netblue30
f6e5a588c4 appimage fix 2021-06-17 14:44:59 -04:00
netblue30
e770ab6d85 appimage: automatically detect profile 2021-06-14 10:15:35 -04:00
Reiner Herrmann
e182eccac8 mention new tin profile in readme/relnotes 2021-06-12 20:41:52 +02:00
Reiner Herrmann
6d559182d2
profiles: add profile for tin news reader (#4356) 2021-06-12 20:39:48 +02:00
Reiner Herrmann
8b523c875c README.md: minor markdown improvements 2021-06-11 22:20:28 +02:00
kuesji koesnu
ef1956e87a
update src/firejail/util.c
Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
2021-06-11 17:31:08 +03:00
kuesji koesnu
be41df0d72
update src/firejail/firejail.h
Co-authored-by: Kelvin M. Klann <kmk3.code@protonmail.com>
2021-06-11 17:30:02 +03:00
smitsohu
e8dab962c9 Merge branch 'master' of https://github.com/netblue30/firejail 2021-06-11 12:31:54 +02:00
smitsohu
b55d612287 follow-up
PR #4349
2021-06-11 12:28:59 +02:00
pirate486743186
326fcf2518
mcomix profile creation (#4338)
* mcomix

* Create mcomix.profile

* tightening

* fixes

* comment
2021-06-10 14:23:34 +00:00
kuesji koesnu
c6f5120dfb added better parser for size strings
this commit add support to size parsing for k,m,g suffix for numbers and
applies this support to rlimit-as and rlimit-fsize arguments in both for
commandline and profile parsing.

supported suffix:
- k for kilobytes
- m for megabytes
- g for gigabytes

( these values uses 1024 bases instead of 1000 )
2021-06-08 20:23:02 +03:00
Reiner Herrmann
d95bb8f5a2
Merge pull request #4348 from NetSysFire/patch-1
Update weechat.profile
2021-06-08 17:07:15 +00:00
Reiner Herrmann
814eec54f3
Merge pull request #4347 from pirate486743186/w3m
Update w3m.profile
2021-06-08 16:56:23 +00:00
Reiner Herrmann
8d3bccf685
Merge pull request #4344 from pirate486743186/qcomicbook
creating qcomicbook profile
2021-06-08 16:55:16 +00:00
smitsohu
5e30eb4935
Merge pull request #4349 from smitsohu/misc
Misc hardening + refactoring
2021-06-08 18:24:22 +02:00
smitsohu
5b921120a3 add more EUID switching
always access files under control of the user
with effective user id of the user
2021-06-08 18:15:12 +02:00
smitsohu
0ad36056e3 refactor mounting 2021-06-08 15:53:47 +02:00
NetSysFire
1f91fed636
Update etc/profile-m-z/weechat.profile
remove whitespace to comply with the profile template

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
2021-06-08 11:12:36 +02:00