Commit graph

7550 commits

Author SHA1 Message Date
netblue30
fe0f975f44 move whitelist/blacklist to allow/deny 2021-07-05 07:23:31 -04:00
netblue30
c32924b825 deprecated whitelist=yes/no in /etc/firejail/firejail.config 2021-07-04 08:21:06 -04:00
netblue30
a11707ea27 allow/deny help and man pages 2021-07-03 22:09:20 -04:00
netblue30
45f2ba544e allow/noallow/deny/nodeny aliases for whitelist/nowhitelist/blacklist/noblacklist 2021-07-03 21:06:11 -04:00
netblue30
c08414fdbb deprecated --disable-whitelist at compile time 2021-07-03 19:24:31 -04:00
netblue30
0562ceb658 cleanup for the next development cycle 2021-07-01 08:59:59 -04:00
netblue30
9abc12bf9b
Merge pull request #4365 from lxeiqr/sndio-fix
Fix sndio support
2021-07-01 07:36:50 -05:00
netblue30
8816dd541d rel 0.9.66 is out, moving to 0.9.67 2021-06-29 15:21:54 -04:00
rusty-snake
a67bb37b0d Fix gnome-calendar crashes 2021-06-29 08:45:01 +02:00
netblue30
648af4ecac Merge branch 'master' of ssh://github.com/netblue30/firejail 2021-06-28 13:13:02 -04:00
netblue30
b3ce082430 release 0.9.66 testing 2021-06-28 13:12:42 -04:00
rusty-snake
835dd5f8eb
Fix #4377 -- telegram-desktop 2.8.2 not starting using firejail-git 2021-06-28 15:59:08 +00:00
netblue30
a3397a78d9
Merge pull request #4332 from rusty-snake/bitwarden-electron
Refactor bitwarden as electron redirect
2021-06-28 09:37:37 -05:00
netblue30
17c60578e7 README update 2021-06-27 20:15:02 -04:00
netblue30
fd6d58d425 README update 2021-06-27 20:13:33 -04:00
netblue30
807bf63c80
Merge pull request #4376 from kmk3/gcov-add-nop-functions
gcov: use no-op functions if not enabled
2021-06-27 19:03:32 -05:00
netblue30
e05610190d
Merge pull request #4369 from pirate486743186/rtv
rtv profile correction
2021-06-27 15:25:47 -05:00
Kelvin M. Klann
5106b2ec40 gcov: use no-op functions if not enabled
Instead of wrapping every gcov function call in an ifdef.

Note: The usage of `((void)0)` is based on section 7.2 of the C99
standard (N1256)[1] [2]:

> 7.2 Diagnostics <assert.h>
>
> 1 The header <assert.h> defines the assert macro and refers to another
> macro,
>
>     NDEBUG
>
> which is not defined by <assert.h>. If NDEBUG is defined as a macro
> name at the point in the source file where <assert.h> is included, the
> assert macro is defined simply as
>
>     #define assert(ignore) ((void)0)

See also assert.h(0p) from POSIX.1-2017[3].

Note: This is a continuation of commit b408b20c7 ("gcov: fix build
failure with gcc 11.1.0") / PR #4373.

[1] http://www.open-std.org/JTC1/SC22/WG14/www/docs/n1256.pdf
[2] https://port70.net/~nsz/c/c99/n1256.html#7.2
[3] https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/assert.h.html
2021-06-27 15:23:22 -03:00
netblue30
ed142c62bf
Merge pull request #4375 from smitsohu/kcmp
remove kcmp from seccomp default drop list
2021-06-27 13:11:20 -05:00
netblue30
77e9d0dd89
Merge pull request #4373 from kmk3/gcov-fix-build-gcc11
gcov: fix build failure with gcc 11.1.0
2021-06-27 13:10:53 -05:00
Kelvin M. Klann
98d223da37 gcov: fix indentation 2021-06-27 13:52:34 -03:00
smitsohu
0c2a5e31c6 tweaks 2021-06-26 17:25:14 +02:00
smitsohu
533a57ebe1 remove kcmp from seccomp default drop list (#3219) 2021-06-26 16:46:43 +02:00
smitsohu
46712f70d9
Merge pull request #4340 from smitsohu/kcmp
augment seccomp lists in firejail.config
2021-06-26 16:37:13 +02:00
smitsohu
99e533580b
Merge pull request #4374 from smitsohu/euid
fs_home.c: run more code with euid of the user
2021-06-26 16:34:49 +02:00
smitsohu
771dccecba fs_home.c: improve EUID switching, fix selinux relabeling 2021-06-26 16:18:52 +02:00
smitsohu
43fb38e18e RELNOTES 2021-06-26 12:57:05 +02:00
smitsohu
925c9fe6b0 seccomp man page update
* move everything related to modification
of the default seccomp filter from --seccomp
to --seccomp= entry

* update errno descriptions
2021-06-26 12:56:41 +02:00
Kelvin M. Klann
ff4277a3ff firejail.h: fix typo of "either" in license header
Added on commit e770ab6d8 ("appimage: automatically detect profile").
2021-06-26 00:13:46 -03:00
Kelvin M. Klann
b408b20c70 gcov: fix build failure with gcc 11.1.0
The build currently fails if gcov support is enabled:

    $ pacman -Q gcc
    gcc 11.1.0-1
    $ ./configure --prefix=/usr --enable-apparmor --enable-gcov >/dev/null
    $ make >/dev/null
    [...]
    netstats.c: In function ‘netstats’:
    netstats.c:250:25: warning: implicit declaration of function ‘__gcov_flush’; did you mean ‘__gcov_dump’? [-Wimplicit-function-declaration]
      250 |                         __gcov_flush();
          |                         ^~~~~~~~~~~~
          |                         __gcov_dump
    [...]
    /usr/bin/ld: netstats.o: in function `netstats':
    /tmp/firejail-git/src/firejail-git/src/firemon/netstats.c:250: undefined reference to `__gcov_flush'
    [...]
    collect2: error: ld returned 1 exit status
    make[1]: *** [Makefile:10: firemon] Error 1
    make: *** [Makefile:42: src/firemon/firemon] Error 2
    [...]

This happens because __gcov_flush was removed on gcc 11.1.0[1] [2] [3].
See the following gcc commits:

* d39f7dc8d5 ("Do locking for __gcov_dump and __gcov_reset as well.")
* c0532db47d ("Use __gcov_dump and __gcov_reset in execv and fork context.")
* 811b7636cb ("Remove __gcov_flush.")

Its implementation did the following[4]:

      __gcov_lock ();
      __gcov_dump_int ();
      __gcov_reset_int ();
      __gcov_unlock ();

As hinted in the commit messages above, the function is no longer needed
because locking is now done inside each of __gcov_dump and __gcov_reset.

So add an implementation of __gcov_flush (on a new gcov_wrapper.h file)
for gcc >= 11.1.0, which just calls __gcov_dump and then __gcov_reset.

Commands used to search and replace:

    $ git grep -Flz '#include <gcov.h>' -- '*.c' |
      xargs -0 -I '{}' sh -c \
      "printf '%s\n' \"\`sed 's|<gcov\\.h>|\"../include/gcov_wrapper.h\"|' '{}'\`\" >'{}'"

Note: This is the continuation of commit 31557e9c7 ("gcov: add missing
gcov.h includes") / PR #4360.

[1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=d39f7dc8d558ca31a661b02d08ff090ce65e6652
[2] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=c0532db47d092430f8e8f497b2dc53343527bb13
[3] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=811b7636cb8c10f1a550a76242b5666c7ae36da2
[4] https://gcc.gnu.org/git/?p=gcc.git;a=blob;f=libgcc/libgcov-interface.c;h=855e8612018d1c9caf90396a3271337aaefdb9b3#l86
2021-06-25 17:00:35 -03:00
rusty-snake
a90428833a
Merge pull request #4368 from alxjsn/master
Address #3872 with changes in pipewire for Firefox and Chromium
2021-06-25 06:57:06 +00:00
glitsj16
2e29cf72c6
Merge pull request #4370 from glitsj16/fix-wusc
allow access to pkgconfig
2021-06-23 19:44:34 +00:00
glitsj16
db6a0fc7d0
allow access to pkgconfig 2021-06-23 17:48:55 +00:00
smitsohu
87548960b8 copy_file_as_user function: drop not needed arguments 2021-06-23 15:30:31 +02:00
pirate486743186
3ecb41efbf
Update rtv-addons.profile 2021-06-22 22:16:12 +02:00
pirate486743186
f79bf43e76
comments 2021-06-22 20:42:14 +02:00
pirate486743186
8113ceb03c
corrections 2021-06-22 20:28:06 +02:00
Alex Leahu
e943e2f295 Address #3872 with changes for Librewolf 2021-06-22 11:59:46 -05:00
Alex Leahu
04d15e3e06 Address #3872 with changes in pipewire for Firefox and Chromium 2021-06-22 11:39:04 -05:00
Reiner Herrmann
eb87b417e2 README update 2021-06-21 23:21:24 +02:00
Reiner Herrmann
0f0325459e Merge branch 'master' into kuesji/master 2021-06-21 23:10:09 +02:00
Reiner Herrmann
ee1ea7d226 style: grammer and codestyle improvements 2021-06-21 23:09:34 +02:00
pirate486743186
1ca9046cf1
creating alpine.profile (#4350)
* firecfg.config alpine

* Create alpinef.profile

* Create alpine.profile

* disable-programs.inc alpine

* workaround in comment

* Update etc/profile-a-l/alpine.profile

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>

* deactivating whitelists in ${HOME}

* comment

Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
2021-06-21 12:25:19 +00:00
smitsohu
1a66c8b805 testing 2021-06-21 02:00:20 +02:00
smitsohu
435d739d96 tmpfs option enhancements
* downgrade error to warning,
smiliar to read-write option;
this simplifies use of tmpfs
option in general purpose
profiles, for example we
don't need to worry about links
people put in their homedir

* update manpage
2021-06-21 01:26:17 +02:00
smitsohu
9c071c863b cleanup 2021-06-20 22:58:19 +02:00
lxeiqr
e0ed6339f8 Convert spaces to tabs in firejail/fs.c 2021-06-20 17:51:06 +02:00
smitsohu
533242ac32 augment seccomp lists in firejail.config 2021-06-20 13:29:48 +02:00
lxeiqr
64d1ef4755 Whitelist /tmp/sndio in private-tmp 2021-06-20 13:20:36 +02:00
lxeiqr
e6f573b39f
Update etc/inc/whitelist-common.inc
Co-authored-by: rusty-snake <41237666+rusty-snake@users.noreply.github.com>
2021-06-20 12:45:18 +02:00