mirror of
https://github.com/netblue30/firejail.git
synced 2026-05-15 14:16:14 -06:00
[GH-ISSUE #3575] New release on Monday (Aug 10): CVE fixes #2241
Labels
No labels
LTS merge
LTS merge
bug
bug
converted-to-discussion
doc-todo
documentation
duplicate
enhancement
file-transfer
firecfg
firejail-in-firejail
firetools
graphics
help wanted
information_old
installation
invalid
modif
moved
needinfo
networking
notabug
notourbug
old-version
overlayfs
packaging
profile-request
pull-request
question
question_old
removal
runtime-permissions
sandbox-ipc
security
stale
wiki
wiki
wontfix
wordpress
workaround
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/firejail#2241
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @netblue30 on GitHub (Aug 8, 2020).
Original GitHub issue: https://github.com/netblue30/firejail/issues/3575
Details here: https://www.debian.org/security/2020/dsa-4742, thanks @reinerh
The release is on branch relase-0.9.62 ($ git clone -b release-0.9.62 https://github.com/netblue30/firejail)
I included most of the patches from Debian (firejail 0.9.64-4 in Debian sid): profile-fixes.patch, apparmor-include.patch, element-profile.patch, usrsharedoc.patch, pathnames.patch, usr-share-firefox.patch. I'll check they are already in on mainline.
If you want to put other fixes in go right ahead, we can delay the release 2 or 3 days. Profile fixes, new app profiles, security hardening, etc. - no big features please!
Also LTS release next week (ping @startx2017)
CVE fixes already on mainline:
34193604fe,2c734d6350@rusty-snake commented on GitHub (Aug 8, 2020):
Until #3530 is fixed, we should not add
disable-shell.incto a profile since it breaks AppImages. We can (and maybe should) include the file itself in a release.wruc must also not be used in 0.9.62.
I'll go trough
git log 0.9.62..master etcto add more fixes.Ok, I thing I got the most commits which fix profiles. I've not looked for C fixes, new profiles and hardenings though some commits in this list are this. Keep in mind that some commits in this list are reverted/superseded by later ones.
commits
6993a84377cdc478fea8ac9bc5d7b0b200664a61b7487015a9518c5155c835927cb101c33703804c8e0881698d3f94dd1d47dd692ac6a9702b0f705ac3a6402a0308061fb59048ccadaeecf61cffdb22a5434508db2da2b6e79d93c1480ff9b5a90863d8457634af7822cb248eb372f58733ad1c6d171fd6d0db73fbdd70ac4bfb64da44ecb21925a1d24651cbcf7fafe3a8f22b244805a1030918ddc6981ca7585fd4fc919b5702faeabf53cec58831772d81f527eb40b849aada597ea8bc337e23304b93f0d6f27302908ea853169c093d37ac96c28e81997259ef77351a4b4e04f78ea9610171ecaa2f32c36691151b0ea83425bb34fa1c97ebe7dca1c0a6f921313c89f30f1f29afb7e0363b0bb3a50f217a6522a4b922f7452215971f3f6b814ba52849eeb9b3417fc5d9182bfdf6fbaff8dbeccb918b683b62ca356af066459e31214bfec4f64a12d7e0d71cbde02c0c5ffcd63d6c41117fc7939bd7bca1137c91cefc6a466d1e24df0dff43b7818aa404b6e0cb609be4fda2cd184e9919fda62527d91ed97156a712c361b32f340699fbd4db2bdaadd256b60dfd0e721a984a5becdc8119ac3e6402ac46d83ed63be94ca4e4217a03dba48fcd2c5f7bfc0a0c2e2df64fc96efe7d0a7ca2c2055e284b9762c6b1d54b042f41f71ebb5bbd04804306d6f8169dde3ab7e4bb77a81a8b45394442aac3f293be590192779937d250b68c243c45077f1bb23c3559f453e9255697b15a65c8a6bf663737f792a4ec0a097a07a8d4501732f5920f2bec516d08114f63be2045950a21dc1600062e21d650010b6722bcfc8bd014ec1267eb2e3b676b613ece55e5cc5e6984aaf827d3c23fb14420ca6eec7dcfc6e77685d4d6a6fb905271ca655b1da004db36e861ccd6234d8c69eab21392f02e91b46980c99ae457ff39eb7e10a67cba6b28cc889d9476127399a53d61f52d4dd1dd36355a378d0e613a821dd6c91a0a10ecff51ff3fe37e14a35d3c4d6bcb67995230feabde38033fdbdd2d851a47e5b9a5f369a7bb38b6ef77ddaf816ce5ae03467f69eb9b4b56fd61f2924b556529d16e82977738dbc0537724e08f13af3c71607db41628821fe94436b2d2e8f5fabe7637470effe5b33bab1ae24cce462b6b1f0d875d2d5331dc1218aaa9aabada2f9738b205115c5462d0130d721970264f1b660c2669ff53d456ccff014de5@netblue30 commented on GitHub (Aug 8, 2020):
Go for it, but make sure when you test you are on that branch, not on main.
@netblue30 commented on GitHub (Aug 11, 2020):
0.9.62.2 is up and running!
@rusty-snake:I think you are the Fedora guy here, can you build a Fedora packages? I'll loaded on sourceforge and here in the release section. Thanks!
LTS coming up in the next few days.
@FOSSONLY commented on GitHub (Aug 11, 2020):
@netblue30
0.9.62.2? Not 0.9.64? I'm confused.
@reinerh commented on GitHub (Aug 11, 2020):
It's a small bugfix update on top of .62.
.64 will be the next release based on current master branch.
@startx2017 commented on GitHub (Aug 12, 2020):
We don't have output.c in LTS. No new release!
@rusty-snake commented on GitHub (Aug 12, 2020):
Once #3530 is fixed, we should release a 0.9.64 soon IMO. 0.9.62 is from December 2019, now we have August 2020. That is a long time, especially for profiles.
@netblue30 I tried with
./configure && make rpmsbut it failed. I then build on using mock with this firejail.spec: firejail-0.9.62.2-1.fc32.x86_64.rpm. It definitely do not work on OpenSUSE Leap. IDK if this is helpful. However I have unfortunately no time in the next week to do more on this.@netblue30 commented on GitHub (Aug 13, 2020):
Thanks, it is good enough, I'll load it on the sites. And yes, will go for a full release as you suggested.
@netblue30 commented on GitHub (Aug 13, 2020):
New release (0.9.62.4) at the end of the week, apparmor broken: https://github.com/netblue30/firejail/issues/3585
@netblue30 commented on GitHub (Aug 18, 2020):
All set, 0.9.62.4 is out.